1PHP NEWS 2||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| 3?? ??? ????, PHP 7.3.34 4 5 618 Nov 2021, PHP 7.3.33 7 8- XML: 9 . Fixed bug #79971 (special character is breaking the path in xml function). 10 (CVE-2021-21707) (cmb) 11 1228 Oct 2021, PHP 7.3.32 13 14- FPM: 15 . Fixed bug #81026 (PHP-FPM oob R/W in root process leading to privilege 16 escalation). (CVE-2021-21703) (Jakub Zelenka) 17 1823 Sep 2021, PHP 7.3.31 19 20- Zip: 21 . Fixed bug #81420 (ZipArchive::extractTo extracts outside of destination). 22 (CVE-2021-21706) (cmb) 23 2426 Aug 2021, PHP 7.3.30 25 26- Phar: 27 . Fixed bug #81211: Symlinks are followed when creating PHAR archive (cmb) 28 2901 Jul 2021, PHP 7.3.29 30 31- Core: 32 . Fixed bug #81122: SSRF bypass in FILTER_VALIDATE_URL. (CVE-2021-21705) (cmb) 33 34- PDO_Firebird: 35 . Fixed bug #76448: Stack buffer overflow in firebird_info_cb. 36 (CVE-2021-21704) (cmb) 37 . Fixed bug #76449: SIGSEGV in firebird_handle_doer. (CVE-2021-21704) (cmb) 38 . Fixed bug #76450: SIGSEGV in firebird_stmt_execute. (CVE-2021-21704) (cmb) 39 . Fixed bug #76452: Crash while parsing blob data in firebird_fetch_blob. 40 (CVE-2021-21704) (cmb) 41 4229 Apr 2021, PHP 7.3.28 43 44- Core: 45 . Fixed ./makedist wrt. to GH move. (cmb, Remi) 46 47- Imap: 48 . Fixed bug #80710 (imap_mail_compose() header injection). (cmb, Stas) 49 5004 Feb 2021, PHP 7.3.27 51 52- SOAP: 53 . Fixed bug #80672 (Null Dereference in SoapClient). (CVE-2021-21702) (cmb, Stas) 54 5507 Jan 2021, PHP 7.3.26 56 57- Standard: 58 . Fixed bug #77423 (FILTER_VALIDATE_URL accepts URLs with invalid userinfo). 59 (CVE-2020-7071) (cmb) 60 . Fixed bug #80457 (stream_get_contents() fails with maxlength=-1 or default). 61 (bruno dot premont at restena dot lu) 62 6326 Nov 2020, PHP 7.3.25 64 65- Core: 66 . Fixed bug #80280 (ADD_EXTENSION_DEP() fails for ext/standard and ext/date). 67 (cmb) 68 . Fixed bug #80258 (Windows Deduplication Enabled, randon permission errors). 69 (cmb) 70 71- COM: 72 . Fixed bug #62474 (com_event_sink crashes on certain arguments). (cmb) 73 74- DOM: 75 . Fixed bug #80268 (loadHTML() truncates at NUL bytes). (cmb) 76 77- IMAP: 78 . Fixed bug #64076 (imap_sort() does not return FALSE on failure). (cmb) 79 . Fixed bug #76618 (segfault on imap_reopen). (girgias) 80 . Fixed bug #80239 (imap_rfc822_write_address() leaks memory). (cmb) 81 . Fixed minor regression caused by fixing bug #80220. (cmb) 82 . Fixed bug #80242 (imap_mail_compose() segfaults for multipart with rfc822). 83 (cmb) 84 85- Intl: 86 . Fixed bug #80310 (ext-intl with icu4c 68.1: use of undeclared identifier 87 'TRUE'). (Alexander M. Turek) 88 89- ODBC: 90 . Fixed bug #44618 (Fetching may rely on uninitialized data). (cmb) 91 92- SNMP: 93 . Fixed bug #70461 (disable md5 code when it is not supported in net-snmp). 94 (Alexander Bergmann, cmb) 95 96- Standard: 97 . Fixed bug #80266 (parse_url silently drops port number 0). (cmb, Nikita) 98 9929 Oct 2020, PHP 7.3.24 100 101- Core: 102 . Fixed bug #79423 (copy command is limited to size of file it can copy). 103 (cmb) 104 105- Calendar: 106 . Fixed bug #80185 (jdtounix() fails after 2037). (cmb) 107 108- IMAP: 109 . Fixed bug #80213 (imap_mail_compose() segfaults on certain $bodies). (cmb) 110 . Fixed bug #80215 (imap_mail_compose() may modify by-val parameters). (cmb) 111 . Fixed bug #80220 (imap_mail_compose() may leak memory). (cmb) 112 . Fixed bug #80223 (imap_mail_compose() leaks envelope on malformed bodies). 113 (cmb) 114 . Fixed bug #80216 (imap_mail_compose() does not validate types/encodings). 115 (cmb) 116 . Fixed bug #80226 (imap_sort() leaks sortpgm memory). (cmb) 117 118- MySQLnd: 119 . Fixed bug #80115 (mysqlnd.debug doesn't recognize absolute paths with 120 slashes). (cmb) 121 . Fixed bug #80107 (mysqli_query() fails for ~16 MB long query when 122 compression is enabled). (Nikita) 123 124- ODBC: 125 . Fixed bug #78470 (odbc_specialcolumns() no longer accepts $nullable). (cmb) 126 . Fixed bug #80147 (BINARY strings may not be properly zero-terminated). 127 (cmb) 128 . Fixed bug #80150 (Failure to fetch error message). (cmb) 129 . Fixed bug #80152 (odbc_execute() moves internal pointer of $params). (cmb) 130 . Fixed bug #46050 (odbc_next_result corrupts prepared resource). (cmb) 131 132- OPcache: 133 . Fixed bug #80083 (Optimizer pass 6 removes variables used for ibm_db2 data 134 binding). (Nikita) 135 136- PDO_ODBC: 137 . Fixed bug #67465 (NULL Pointer dereference in odbc_handle_preparer). (cmb) 138 139- Standard: 140 . Fixed bug #80114 (parse_url does not accept URLs with port 0). (cmb, twosee) 141 . Fixed bug #76943 (Inconsistent stream_wrapper_restore() errors). (cmb) 142 . Fixed bug #76735 (Incorrect message in fopen on invalid mode). (cmb) 143 144- Tidy: 145 . Fixed bug #77040 (tidyNode::isHtml() is completely broken). (cmb) 146 14701 Oct 2020, PHP 7.3.23 148 149- Core: 150 . Fixed bug #80048 (Bug #69100 has not been fixed for Windows). (cmb) 151 . Fixed bug #80049 (Memleak when coercing integers to string via variadic 152 argument). (Nikita) 153 . Fixed bug #79699 (PHP parses encoded cookie names so malicious `__Host-` 154 cookies can be sent). (CVE-2020-7070) (Stas) 155 156- Calendar: 157 . Fixed bug #80007 (Potential type confusion in unixtojd() parameter parsing). 158 (Andy Postnikov) 159 160- COM: 161 . Fixed bug #64130 (COM obj parameters passed by reference are not updated). 162 (cmb) 163 164- OPcache: 165 . Fixed bug #80002 (calc free space for new interned string is wrong). 166 (t-matsuno) 167 . Fixed bug #79825 (opcache.file_cache causes SIGSEGV when custom opcode 168 handlers changed). (SammyK) 169 170- OpenSSL: 171 . Fixed bug #79601 (Wrong ciphertext/tag in AES-CCM encryption for a 12 172 bytes IV). (CVE-2020-7069) (Jakub Zelenka) 173 174- PDO: 175 . Fixed bug #80027 (Terrible performance using $query->fetch on queries with 176 many bind parameters). (Matteo) 177 178- SOAP: 179 . Fixed bug #47021 (SoapClient stumbles over WSDL delivered with 180 "Transfer-Encoding: chunked"). (Matteo) 181 182- Standard: 183 . Fixed bug #79986 (str_ireplace bug with diacritics characters). (cmb) 184 . Fixed bug #80077 (getmxrr test bug). (Rainer Jung) 185 . Fixed bug #72941 (Modifying bucket->data by-ref has no effect any longer). 186 (cmb) 187 . Fixed bug #80067 (Omitting the port in bindto setting errors). (cmb) 188 18903 Sep 2020, PHP 7.3.22 190 191- Core: 192 . Fixed bug #79884 (PHP_CONFIG_FILE_PATH is meaningless). (cmb) 193 . Fixed bug #77932 (File extensions are case-sensitive). (cmb) 194 . Fixed bug #79806 (realpath() erroneously resolves link to link). (cmb) 195 . Fixed bug #79895 (PHP_CHECK_GCC_ARG does not allow flags with equal sign). 196 (Santiago M. Mola) 197 . Fixed bug #79919 (Stack use-after-scope in define()). (cmb) 198 . Fixed bug #79934 (CRLF-only line in heredoc causes parsing error). 199 (Pieter van den Ham) 200 201- COM: 202 . Fixed bug #48585 (com_load_typelib holds reference, fails on second call). 203 (cmb) 204 205- Exif: 206 . Fixed bug #75785 (Many errors from exif_read_data). 207 (Níckolas Daniel da Silva) 208 209- Gettext: 210 . Fixed bug #70574 (Tests fail due to relying on Linux fallback behavior for 211 gettext()). (Florian Engelhardt) 212 213- LDAP: 214 . Fixed memory leaks. (ptomulik) 215 216- OPcache: 217 . Fixed bug #73060 (php failed with error after temp folder cleaned up). 218 (cmb) 219 220- PDO: 221 . Fixed bug #64705 (errorInfo property of PDOException is null when 222 PDO::__construct() fails). (Ahmed Abdou) 223 224- Standard: 225 . Fixed bug #79930 (array_merge_recursive() crashes when called with array 226 with single reference). (Nikita) 227 . Fixed bug #79944 (getmxrr always returns true on Alpine linux). (Nikita) 228 . Fixed bug #79951 (Memory leak in str_replace of empty string). (Nikita) 229 230- XML: 231 . Fixed bug #79922 (Crash after multiple calls to xml_parser_free()). (cmb) 232 23306 Aug 2020, PHP 7.3.21 234 235- Apache: 236 . Fixed bug #79030 (Upgrade apache2handler's php_apache_sapi_get_request_time 237 to return usec). (Herbert256) 238 239- Core: 240 . Fixed bug #79877 (getimagesize function silently truncates after a null 241 byte) (cmb) 242 . Fixed bug #79778 (Assertion failure if dumping closure with unresolved 243 static variable). (Nikita) 244 . Fixed bug #79792 (HT iterators not removed if empty array is destroyed). 245 (Nikita) 246 247- COM: 248 . Fixed bug #63208 (BSTR to PHP string conversion not binary safe). (cmb) 249 . Fixed bug #63527 (DCOM does not work with Username, Password parameter). 250 (cmb) 251 252- Curl: 253 . Fixed bug #79741 (curl_setopt CURLOPT_POSTFIELDS asserts on object with 254 declared properties). (Nikita) 255 256- Fileinfo: 257 . Fixed bug #79756 (finfo_file crash (FILEINFO_MIME)). (cmb) 258 259- FTP: 260 . Fixed bug #55857 (ftp_size on large files). (cmb) 261 262- Mbstring: 263 . Fixed bug #79787 (mb_strimwidth does not trim string). (XXiang) 264 265- Phar: 266 . Fixed bug #79797 (Use of freed hash key in the phar_parse_zipfile 267 function). (CVE-2020-7068) (cmb) 268 269- Standard: 270 . Fixed bug #70362 (Can't copy() large 'data://' with open_basedir). (cmb) 271 . Fixed bug #79817 (str_replace() does not handle INDIRECT elements). (Nikita) 272 . Fixed bug #78008 (dns_check_record() always return true on Alpine). 273 (Andy Postnikov) 274 27509 Jul 2020, PHP 7.3.20 276 277- Core: 278 . Fixed bug #79650 (php-win.exe 100% cpu lockup). (cmb) 279 . Fixed bug #79668 (get_defined_functions(true) may miss functions). (cmb, 280 Nikita) 281 . Fixed possibly unsupported timercmp() usage. (cmb) 282 283- Exif: 284 . Fixed bug #79687 (Sony picture - PHP Warning - Make, Model, MakerNotes). 285 (cmb) 286 287- Filter: 288 . Fixed bug #73527 (Invalid memory access in php_filter_strip). (cmb) 289 290- GD: 291 . Fixed bug #79676 (imagescale adds black border with IMG_BICUBIC). (cmb) 292 293- OpenSSL: 294 . Fixed bug #62890 (default_socket_timeout=-1 causes connection to timeout). 295 (cmb) 296 297- PDO SQLite: 298 . Fixed bug #79664 (PDOStatement::getColumnMeta fails on empty result set). 299 (cmb) 300 301- SPL: 302 . Fixed bug #79710 (Reproducible segfault in error_handler during GC 303 involved an SplFileObject). (Nikita) 304 305- Standard: 306 . Fixed bug #74267 (segfault with streams and invalid data). (cmb) 307 . Fixed bug #79579 (ZTS build of PHP 7.3.17 doesn't handle ERANGE for 308 posix_getgrgid and others). (Böszörményi Zoltán) 309 31011 Jun 2020, PHP 7.3.19 311 312- Core: 313 . Fixed bug #79566 (Private SHM is not private on Windows). (cmb) 314 . Fixed bug #79489 (.user.ini does not inherit). (cmb) 315 316- GD: 317 . Fixed bug #79615 (Wrong GIF header written in GD GIFEncode). (sageptr, cmb) 318 319- MySQLnd: 320 . Fixed bug #79596 (MySQL FLOAT truncates to int some locales). (cmb) 321 322- Opcache: 323 . Fixed bug #79535 (PHP crashes with specific opcache.optimization_level). 324 (Nikita) 325 . Fixed bug #79588 (Boolean opcache settings ignore on/off values). (cmb) 326 327- Standard: 328 . Fixed bug #79561 (dns_get_record() fails with DNS_ALL). (cmb) 329 33014 May 2020, PHP 7.3.18 331 332- Core: 333 . Fixed bug #78875 (Long filenames cause OOM and temp files are not cleaned). 334 (CVE-2019-11048) (cmb) 335 . Fixed bug #78876 (Long variables in multipart/form-data cause OOM and temp 336 files are not cleaned). (CVE-2019-11048) (cmb) 337 . Fixed bug #79434 (PHP 7.3 and PHP-7.4 crash with NULL-pointer dereference 338 on !CS constant). (Nikita) 339 . Fixed bug #79477 (casting object into array creates references). (Nikita) 340 . Fixed bug #79470 (PHP incompatible with 3rd party file system on demand). 341 (cmb) 342 . Fixed bug #78784 (Unable to interact with files inside a VFS for Git 343 repository). (cmb) 344 345- DOM: 346 . Fixed bug #78221 (DOMNode::normalize() doesn't remove empty text nodes). 347 (cmb) 348 349- FCGI: 350 . Fixed bug #79491 (Search for .user.ini extends up to root dir). (cmb) 351 352- MBString: 353 . Fixed bug #79441 (Segfault in mb_chr() if internal encoding is unsupported). 354 (Girgias) 355 356- OpenSSL: 357 . Fixed bug #79497 (stream_socket_client() throws an unknown error sometimes 358 with <1s timeout). (Joe Cai) 359 360- Phar: 361 . Fix bug #79503 (Memory leak on duplicate metadata). (cmb) 362 363- SimpleXML: 364 . Fixed bug #79528 (Different object of the same xml between 7.4.5 and 365 7.4.4). (cmb) 366 367- Standard: 368 . Fixed bug #79468 (SIGSEGV when closing stream handle with a stream filter 369 appended). (dinosaur) 370 37116 Apr 2020, PHP 7.3.17 372 373- Core: 374 . Fixed bug #79364 (When copy empty array, next key is unspecified). (cmb) 375 . Fixed bug #78210 (Invalid pointer address). (cmb, Nikita) 376 377- CURL: 378 . Fixed bug #79199 (curl_copy_handle() memory leak). (cmb) 379 380- Date: 381 . Fixed bug #79396 (DateTime hour incorrect during DST jump forward). (Nate 382 Brunette) 383 384- Iconv: 385 . Fixed bug #79200 (Some iconv functions cut Windows-1258). (cmb) 386 387- OPcache: 388 . Fixed bug #79412 (Opcache chokes and uses 100% CPU on specific script). 389 (Dmitry) 390 391- Session: 392 . Fixed bug #79413 (session_create_id() fails for active sessions). (cmb) 393 394- Shmop: 395 . Fixed bug #79427 (Integer Overflow in shmop_open()). (cmb) 396 397- SimpleXML: 398 . Fixed bug #61597 (SXE properties may lack attributes and content). (cmb) 399 400- Spl: 401 . Fixed bug #75673 (SplStack::unserialize() behavior). (cmb) 402 . Fixed bug #79393 (Null coalescing operator failing with SplFixedArray). 403 (cmb) 404 405- Standard: 406 . Fixed bug #79330 (shell_exec() silently truncates after a null byte). (stas) 407 . Fixed bug #79465 (OOB Read in urldecode()). (CVE-2020-7067) (stas) 408 . Fixed bug #79410 (system() swallows last chunk if it is exactly 4095 bytes 409 without newline). (Christian Schneider) 410 411- Zip: 412 . Fixed Bug #79296 (ZipArchive::open fails on empty file). (Remi) 413 . Fixed bug #79424 (php_zip_glob uses gl_pathc after call to globfree). 414 (Max Rees) 415 41619 Mar 2020, PHP 7.3.16 417 418- Core: 419 . Fixed bug #63206 (restore_error_handler does not restore previous errors 420 mask). (Mark Plomer) 421 422- COM: 423 . Fixed bug #66322 (COMPersistHelper::SaveToFile can save to wrong location). 424 (cmb) 425 . Fixed bug #79242 (COM error constants don't match com_exception codes on 426 x86). (cmb) 427 . Fixed bug #79248 (Traversing empty VT_ARRAY throws com_exception). (cmb) 428 . Fixed bug #79299 (com_print_typeinfo prints duplicate variables). (Litiano 429 Moura) 430 . Fixed bug #79332 (php_istreams are never freed). (cmb) 431 . Fixed bug #79333 (com_print_typeinfo() leaks memory). (cmb) 432 433- DOM: 434 . Fixed bug #77569: (Write Access Violation in DomImplementation). (Nikita, 435 cmb) 436 . Fixed bug #79271 (DOMDocumentType::$childNodes is NULL). (cmb) 437 438- Enchant: 439 . Fixed bug #79311 (enchant_dict_suggest() fails on big endian architecture). 440 (cmb) 441 442- EXIF: 443 . Fixed bug #79282 (Use-of-uninitialized-value in exif). (CVE-2020-7064) 444 (Nikita) 445 446- MBstring: 447 . Fixed bug #79371 (mb_strtolower (UTF-32LE): stack-buffer-overflow at 448 php_unicode_tolower_full). (CVE-2020-7065) (cmb) 449 450- MySQLi: 451 . Fixed bug #64032 (mysqli reports different client_version). (cmb) 452 453- PCRE: 454 . Fixed bug #79188 (Memory corruption in preg_replace/preg_replace_callback 455 and unicode). (Nikita) 456 457- PDO_ODBC: 458 . Fixed bug #79038 (PDOStatement::nextRowset() leaks column values). (cmb) 459 460- Reflection: 461 . Fixed bug #79062 (Property with heredoc default value returns false for 462 getDocComment). (Nikita) 463 464- SQLite3: 465 . Fixed bug #79294 (::columnType() may fail after SQLite3Stmt::reset()). (cmb) 466 467- Standard: 468 . Fixed bug #79329 (get_headers() silently truncates after a null byte). 469 (CVE-2020-7066) (cmb) 470 . Fixed bug #79254 (getenv() w/o arguments not showing changes). (cmb) 471 . Fixed bug #79265 (Improper injection of Host header when using fopen for 472 http requests). (Miguel Xavier Penha Neto) 473 47420 Feb 2020, PHP 7.3.15 475 476- Core: 477 . Fixed bug #71876 (Memory corruption htmlspecialchars(): charset `*' not 478 supported). (Nikita) 479 . Fixed bug #79146 (cscript can fail to run on some systems). (clarodeus) 480 . Fixed bug #78323 (Code 0 is returned on invalid options). (Ivan Mikheykin) 481 . Fixed bug #76047 (Use-after-free when accessing already destructed 482 backtrace arguments). (Nikita) 483 484- CURL: 485 . Fixed bug #79078 (Hypothetical use-after-free in curl_multi_add_handle()). 486 (cmb) 487 488- Intl: 489 . Fixed bug #79212 (NumberFormatter::format() may detect wrong type). (cmb) 490 491- Libxml: 492 . Fixed bug #79191 (Error in SoapClient ctor disables DOMDocument::save()). 493 (Nikita, cmb) 494 495- MBString: 496 . Fixed bug #79154 (mb_convert_encoding() can modify $from_encoding). (cmb) 497 498- MySQLnd: 499 . Fixed bug #79084 (mysqlnd may fetch wrong column indexes with MYSQLI_BOTH). 500 (cmb) 501 502- OpenSSL: 503 . Fixed bug #79145 (openssl memory leak). (cmb, Nikita) 504 505- Phar: 506 . Fixed bug #79082 (Files added to tar with Phar::buildFromIterator have 507 all-access permissions). (CVE-2020-7063) (stas) 508 . Fixed bug #79171 (heap-buffer-overflow in phar_extract_file). 509 (CVE-2020-7061) (cmb) 510 . Fixed bug #76584 (PharFileInfo::decompress not working). (cmb) 511 512- Reflection: 513 . Fixed bug #79115 (ReflectionClass::isCloneable call reflected class 514 __destruct). (Nikita) 515 516- Session: 517 . Fixed bug #79221 (Null Pointer Dereference in PHP Session Upload Progress). 518 (CVE-2020-7062) (stas) 519 520- SPL: 521 . Fixed bug #79151 (heap use after free caused by 522 spl_dllist_it_helper_move_forward). (Nikita) 523 524- Standard: 525 . Fixed bug #78902 (Memory leak when using stream_filter_append). (liudaixiao) 526 527- Testing: 528 . Fixed bug #78090 (bug45161.phpt takes forever to finish). (cmb) 529 530- XSL: 531 . Fixed bug #70078 (XSL callbacks with nodes as parameter leak memory). (cmb) 532 53323 Jan 2020, PHP 7.3.14 534 535- Core 536 . Fixed bug #78999 (Cycle leak when using function result as temporary). 537 (Dmitry) 538 539- CURL: 540 . Fixed bug #79033 (Curl timeout error with specific url and post). (cmb) 541 542- Date: 543 . Fixed bug #79015 (undefined-behavior in php_date.c). (cmb) 544 545- DBA: 546 . Fixed bug #78808 ([LMDB] MDB_MAP_FULL: Environment mapsize limit reached). 547 (cmb) 548 549- Fileinfo: 550 . Fixed bug #74170 (locale information change after mime_content_type). 551 (Sergei Turchanov) 552 553- GD: 554 . Fixed bug #78923 (Artifacts when convoluting image with transparency). 555 (wilson chen) 556 . Fixed bug #79067 (gdTransformAffineCopy() may use unitialized values). (cmb) 557 . Fixed bug #79068 (gdTransformAffineCopy() changes interpolation method). 558 (cmb) 559 560- Libxml: 561 . Fixed bug #79029 (Use After Free's in XMLReader / XMLWriter). (Laruence) 562 563- Mbstring: 564 . Fixed bug #79037 (global buffer-overflow in `mbfl_filt_conv_big5_wchar`). 565 (CVE-2020-7060) (Nikita) 566 567- OPcache: 568 . Fixed bug #79040 (Warning Opcode handlers are unusable due to ASLR). (cmb) 569 570- Pcntl: 571 . Fixed bug #78402 (Converting null to string in error message is bad DX). 572 (SATŌ Kentarō) 573 574- PDO_PgSQL: 575 . Fixed bug #78983 (pdo_pgsql config.w32 cannot find libpq-fe.h). (SATŌ 576 Kentarō) 577 . Fixed bug #78980 (pgsqlGetNotify() overlooks dead connection). (SATŌ 578 Kentarō) 579 . Fixed bug #78982 (pdo_pgsql returns dead persistent connection). (SATŌ 580 Kentarō) 581 582- Session: 583 . Fixed bug #79091 (heap use-after-free in session_create_id()). (cmb, Nikita) 584 585- Shmop: 586 . Fixed bug #78538 (shmop memory leak). (cmb) 587 588- Standard: 589 . Fixed bug #79099 (OOB read in php_strip_tags_ex). (CVE-2020-7059). (cmb) 590 . Fixed bug #54298 (Using empty additional_headers adding extraneous CRLF). 591 (cmb) 592 59318 Dec 2019, PHP 7.3.13 594 595- Bcmath: 596 . Fixed bug #78878 (Buffer underflow in bc_shift_addsub). (CVE-2019-11046). 597 (cmb) 598 599- Core: 600 . Fixed bug #78862 (link() silently truncates after a null byte on Windows). 601 (CVE-2019-11044). (cmb) 602 . Fixed bug #78863 (DirectoryIterator class silently truncates after a null 603 byte). (CVE-2019-11045). (cmb) 604 . Fixed bug #78943 (mail() may release string with refcount==1 twice). 605 (CVE-2019-11049). (cmb) 606 . Fixed bug #78787 (Segfault with trait overriding inherited private shadow 607 property). (Nikita) 608 . Fixed bug #78868 (Calling __autoload() with incorrect EG(fake_scope) value). 609 (Antony Dovgal, Dmitry) 610 . Fixed bug #78296 (is_file fails to detect file). (cmb) 611 612- EXIF: 613 . Fixed bug #78793 (Use-after-free in exif parsing under memory sanitizer). 614 (CVE-2019-11050). (Nikita) 615 . Fixed bug #78910 (Heap-buffer-overflow READ in exif). (CVE-2019-11047). 616 (Nikita) 617 618- GD: 619 . Fixed bug #78849 (GD build broken with -D SIGNED_COMPARE_SLOW). (cmb) 620 621- MBString: 622 . Upgraded bundled Oniguruma to 6.9.4. (cmb) 623 624- OPcache: 625 . Fixed potential ASLR related invalid opline handler issues. (cmb) 626 . Fixed $x = (bool)$x; with opcache (should emit undeclared variable notice). 627 (Tyson Andre) 628 629- PCRE: 630 . Fixed bug #78853 (preg_match() may return integer > 1). (cmb) 631 632- Standard: 633 . Fixed bug #78759 (array_search in $GLOBALS). (Nikita) 634 . Fixed bug #77638 (var_export'ing certain class instances segfaults). (cmb) 635 . Fixed bug #78840 (imploding $GLOBALS crashes). (cmb) 636 . Fixed bug #78833 (Integer overflow in pack causes out-of-bound access). 637 (cmb) 638 . Fixed bug #78814 (strip_tags allows / in tag name => whitelist bypass). 639 (cmb) 640 64121 Nov 2019, PHP 7.3.12 642 643- Core: 644 . Fixed bug #78658 (Memory corruption using Closure::bindTo). (Nikita) 645 . Fixed bug #78656 (Parse errors classified as highest log-level). (Erik 646 Lundin) 647 . Fixed bug #78752 (Segfault if GC triggered while generator stack frame is 648 being destroyed). (Nikita) 649 . Fixed bug #78689 (Closure::fromCallable() doesn't handle 650 [Closure, '__invoke']). (Nikita) 651 652- COM: 653 . Fixed bug #78694 (Appending to a variant array causes segfault). (cmb) 654 655- Date: 656 . Fixed bug #70153 (\DateInterval incorrectly unserialized). (Maksim Iakunin) 657 . Fixed bug #78751 (Serialising DatePeriod converts DateTimeImmutable). (cmb) 658 659- Iconv: 660 . Fixed bug #78642 (Wrong libiconv version displayed). (gedas at martynas, 661 cmb). 662 663- OpCache: 664 . Fixed bug #78654 (Incorrectly computed opcache checksum on files with 665 non-ascii characters). (mhagstrand) 666 . Fixed bug #78747 (OpCache corrupts custom extension result). (Nikita) 667 668- OpenSSL: 669 . Fixed bug #78775 (TLS issues from HTTP request affecting other encrypted 670 connections). (Nikita) 671 672- Reflection: 673 . Fixed bug #78697 (ReflectionClass::ImplementsInterface - inaccurate error 674 message with traits). (villfa) 675 676- Sockets: 677 . Fixed bug #78665 (Multicasting may leak memory). (cmb) 678 67924 Oct 2019, PHP 7.3.11 680 681- Core: 682 . Fixed bug #78535 (auto_detect_line_endings value not parsed as bool). 683 (bugreportuser) 684 . Fixed bug #78620 (Out of memory error). (cmb, Nikita) 685 686- Exif : 687 . Fixed bug #78442 ('Illegal component' on exif_read_data since PHP7) 688 (Kalle) 689 690- FPM: 691 . Fixed bug #78599 (env_path_info underflow in fpm_main.c can lead to RCE). 692 (CVE-2019-11043) (Jakub Zelenka) 693 . Fixed bug #78413 (request_terminate_timeout does not take effect after 694 fastcgi_finish_request). (Sergei Turchanov) 695 696- MBString: 697 . Fixed bug #78633 (Heap buffer overflow (read) in mb_eregi). (cmb) 698 . Fixed bug #78579 (mb_decode_numericentity: args number inconsistency). 699 (cmb) 700 . Fixed bug #78609 (mb_check_encoding() no longer supports stringable 701 objects). (cmb) 702 703- MySQLi: 704 . Fixed bug #76809 (SSL settings aren't respected when persistent connections 705 are used). (fabiomsouto) 706 707- Mysqlnd: 708 . Fixed bug #78525 (Memory leak in pdo when reusing native prepared 709 statements). (Nikita) 710 711- PCRE: 712 . Fixed bug #78272 (calling preg_match() before pcntl_fork() will freeze 713 child process). (Nikita) 714 715- PDO_MySQL: 716 . Fixed bug #78623 (Regression caused by "SP call yields additional empty 717 result set"). (cmb) 718 719- Session: 720 . Fixed bug #78624 (session_gc return value for user defined session 721 handlers). (bshaffer) 722 723- Standard: 724 . Fixed bug #76342 (file_get_contents waits twice specified timeout). 725 (Thomas Calvet) 726 . Fixed bug #78612 (strtr leaks memory when integer keys are used and the 727 subject string shorter). (Nikita) 728 . Fixed bug #76859 (stream_get_line skips data if used with data-generating 729 filter). (kkopachev) 730 731- Zip: 732 . Fixed bug #78641 (addGlob can modify given remove_path value). (cmb) 733 73426 Sep 2019, PHP 7.3.10 735 736- Core: 737 . Fixed bug #78220 (Can't access OneDrive folder). (cmb, ab) 738 . Fixed bug #77922 (Double release of doc comment on inherited shadow 739 property). (Nikita) 740 . Fixed bug #78441 (Parse error due to heredoc identifier followed by digit). 741 (cmb) 742 . Fixed bug #77812 (Interactive mode does not support PHP 7.3-style heredoc). 743 (cmb, Nikita) 744 745- FastCGI: 746 . Fixed bug #78469 (FastCGI on_accept hook is not called when using named 747 pipes on Windows). (Sergei Turchanov) 748 749- FPM: 750 . Fixed bug #78334 (fpm log prefix message includes wrong stdout/stderr 751 notation). (Tsuyoshi Sadakata) 752 753- Intl: 754 . Ensure IDNA2003 rules are used with idn_to_ascii() and idn_to_utf8() 755 when requested. (Sara) 756 757- MBString: 758 . Fixed bug #78559 (Heap buffer overflow in mb_eregi). (cmb) 759 760- MySQLnd: 761 . Fixed connect_attr issues and added the _server_host connection attribute. 762 (Qianqian Bu) 763 764- ODBC: 765 . Fixed bug #78473 (odbc_close() closes arbitrary resources). (cmb) 766 767- PDO_MySQL: 768 . Fixed bug #41997 (SP call yields additional empty result set). (cmb) 769 770- sodium: 771 . Fixed bug #78510 (Partially uninitialized buffer returned by 772 sodium_crypto_generichash_init()). (Frank Denis, cmb) 773 77429 Aug 2019, PHP 7.3.9 775 776- Core: 777 . Fixed bug #78363 (Buffer overflow in zendparse). (Nikita) 778 . Fixed bug #78379 (Cast to object confuses GC, causes crash). (Dmitry) 779 . Fixed bug #78412 (Generator incorrectly reports non-releasable $this as GC 780 child). (Nikita) 781 782- Curl: 783 . Fixed bug #77946 (Bad cURL resources returned by curl_multi_info_read()). 784 (Abyr Valg) 785 786- Exif: 787 . Fixed bug #78333 (Exif crash (bus error) due to wrong alignment and 788 invalid cast). (Nikita) 789 790- FPM: 791 . Fixed bug #77185 (Use-after-free in FPM master event handling). 792 (Maksim Nikulin) 793 794- Iconv: 795 . Fixed bug #78342 (Bus error in configure test for iconv //IGNORE). (Rainer 796 Jung) 797 798- LiteSpeed: 799 . Updated to LiteSpeed SAPI V7.5 (Fixed clean shutdown). (George Wang) 800 801- MBString: 802 . Fixed bug #78380 (Oniguruma 6.9.3 fixes CVEs). (CVE-2019-13224) (Stas) 803 804- MySQLnd: 805 . Fixed bug #78179 (MariaDB server version incorrectly detected). (cmb) 806 . Fixed bug #78213 (Empty row pocket). (cmb) 807 808- Opcache: 809 . Fixed bug #77191 (Assertion failure in dce_live_ranges() when silencing is 810 used). (Nikita) 811 812- Standard: 813 . Fixed bug #69100 (Bus error from stream_copy_to_stream (file -> SSL stream) 814 with invalid length). (Nikita) 815 . Fixed bug #78282 (atime and mtime mismatch). (cmb) 816 . Fixed bug #78326 (improper memory deallocation on stream_get_contents() 817 with fixed length buffer). (Albert Casademont) 818 . Fixed bug #78346 (strip_tags no longer handling nested php tags). (cmb) 819 82001 Aug 2019, PHP 7.3.8 821 822- Core: 823 . Added syslog.filter=raw option. (Erik Lundin) 824 . Fixed bug #78212 (Segfault in built-in webserver). (cmb) 825 826- Date: 827 . Fixed bug #69044 (discrepency between time and microtime). (krakjoe) 828 . Updated timelib to 2018.02. (Derick) 829 830- EXIF: 831 . Fixed bug #78256 (heap-buffer-overflow on exif_process_user_comment). 832 (CVE-2019-11042) (Stas) 833 . Fixed bug #78222 (heap-buffer-overflow on exif_scan_thumbnail). 834 (CVE-2019-11041) (Stas) 835 836- FTP: 837 . Fixed bug #78039 (FTP with SSL memory leak). (Nikita) 838 839- Libxml: 840 . Fixed bug #78279 (libxml_disable_entity_loader settings is shared between 841 requests (cgi-fcgi)). (Nikita) 842 843- LiteSpeed: 844 . Updated to LiteSpeed SAPI V7.4.3 (increased response header count limit from 845 100 to 1000, added crash handler to cleanly shutdown PHP request, added 846 CloudLinux mod_lsapi mode). (George Wang) 847 . Fixed bug #76058 (After "POST data can't be buffered", using php://input 848 makes huge tmp files). (George Wang) 849 850- Openssl: 851 . Fixed bug #78231 (Segmentation fault upon stream_socket_accept of exported 852 socket-to-stream). (Nikita) 853 854- Opcache: 855 . Fixed bug #78189 (file cache strips last character of uname hash). (cmb) 856 . Fixed bug #78202 (Opcache stats for cache hits are capped at 32bit NUM). 857 (cmb) 858 . Fixed bug #78271 (Invalid result of if-else). (Nikita) 859 . Fixed bug #78291 (opcache_get_configuration doesn't list all directives). 860 (Andrew Collington) 861 . Fixed bug #78341 (Failure to detect smart branch in DFA pass). (Nikita) 862 863- PCRE: 864 . Fixed bug #78197 (PCRE2 version check in configure fails for "##.##-xxx" 865 version strings). (pgnet, Peter Kokot) 866 . Fixed bug #78338 (Array cross-border reading in PCRE). (cmb) 867 868- PDO_Sqlite: 869 . Fixed bug #78192 (SegFault when reuse statement after schema has changed). 870 (Vincent Quatrevieux) 871 872- Phar: 873 . Fixed bug #77919 (Potential UAF in Phar RSHUTDOWN). (cmb) 874 875- Phpdbg: 876 . Fixed bug #78297 (Include unexistent file memory leak). (Nikita) 877 878- SQLite: 879 . Upgraded to SQLite 3.28.0. (cmb) 880 881- Standard: 882 . Fixed bug #78241 (touch() does not handle dates after 2038 in PHP 64-bit). (cmb) 883 . Fixed bug #78269 (password_hash uses weak options for argon2). (Remi) 884 88504 Jul 2019, PHP 7.3.7 886 887- Core: 888 . Fixed bug #76980 (Interface gets skipped if autoloader throws an exception). 889 (Nikita) 890 891- DOM: 892 . Fixed bug #78025 (segfault when accessing properties of DOMDocumentType). 893 (cmb) 894 895- MySQLi: 896 . Fixed bug #77956 (When mysqli.allow_local_infile = Off, use a meaningful 897 error message). (Sjon Hortensius) 898 . Fixed bug #38546 (bindParam incorrect processing of bool types). 899 (camporter) 900 901- MySQLnd: 902 . Fixed bug #77955 (Random segmentation fault in mysqlnd from php-fpm). 903 (Nikita) 904 905- Opcache: 906 . Fixed bug #78015 (Incorrect evaluation of expressions involving partials 907 arrays in SCCP). (Nikita) 908 . Fixed bug #78106 (Path resolution fails if opcache disabled during request). 909 (Nikita) 910 911- OpenSSL: 912 . Fixed bug #78079 (openssl_encrypt_ccm.phpt fails with OpenSSL 1.1.1c). 913 (Jakub Zelenka) 914 915- phpdbg: 916 . Fixed bug #78050 (SegFault phpdbg + opcache on include file twice). 917 (Nikita) 918 919- Sockets: 920 . Fixed bug #78038 (Socket_select fails when resource array contains 921 references). (Nikita) 922 923- Sodium: 924 . Fixed bug #78114 (segfault when calling sodium_* functions from eval). (cmb) 925 926- Standard: 927 . Fixed bug #77135 (Extract with EXTR_SKIP should skip $this). 928 (Craig Duncan, Dmitry) 929 . Fixed bug #77937 (preg_match failed). (cmb, Anatol) 930 931- Zip: 932 . Fixed bug #76345 (zip.h not found). (Michael Maroszek) 933 93430 May 2019, PHP 7.3.6 935 936- cURL: 937 . Implemented FR #72189 (Add missing CURL_VERSION_* constants). (Javier 938 Spagnoletti) 939 940- Date: 941 . Fixed bug #77909 (DatePeriod::__construct() with invalid recurrence count 942 value). (Ignace Nyamagana Butera) 943 944- EXIF: 945 . Fixed bug #77988 (heap-buffer-overflow on php_jpg_get16). 946 (CVE-2019-11040) (Stas) 947 948- FPM: 949 . Fixed bug #77934 (php-fpm kill -USR2 not working). (Jakub Zelenka) 950 . Fixed bug #77921 (static.php.net doesn't work anymore). (Peter Kokot) 951 952- GD: 953 . Fixed bug #77943 (imageantialias($image, false); does not work). (cmb) 954 . Fixed bug #77973 (Uninitialized read in gdImageCreateFromXbm). 955 (CVE-2019-11038) (cmb) 956 957- Iconv: 958 . Fixed bug #78069 (Out-of-bounds read in iconv.c:_php_iconv_mime_decode() 959 due to integer overflow). (CVE-2019-11039). (maris dot adam) 960 961- JSON: 962 . Fixed bug #77843 (Use after free with json serializer). (Nikita) 963 964- Opcache: 965 . Fixed possible crashes, because of inconsistent PCRE cache and opcache 966 SHM reset. (Alexey Kalinin, Dmitry) 967 968- PDO_MySQL: 969 . Fixed bug #77944 (Wrong meta pdo_type for bigint on LLP64). (cmb) 970 971- Reflection: 972 . Fixed bug #75186 (Inconsistent reflection of Closure:::__invoke()). (Nikita) 973 974- Session: 975 . Fixed bug #77911 (Wrong warning for session.sid_bits_per_character). (cmb) 976 977- SOAP: 978 . Fixed bug #77945 (Segmentation fault when constructing SoapClient with 979 WSDL_CACHE_BOTH). (Nikita) 980 981- SPL: 982 . Fixed bug #77024 (SplFileObject::__toString() may return array). (Craig 983 Duncan) 984 985- SQLite: 986 . Fixed bug #77967 (Bypassing open_basedir restrictions via file uris). (Stas) 987 988- Standard: 989 . Fixed bug #77931 (Warning for array_map mentions wrong type). (Nikita) 990 . Fixed bug #78003 (strip_tags output change since PHP 7.3). (cmb) 991 99202 May 2019, PHP 7.3.5 993 994- Core: 995 . Fixed bug #77903 (ArrayIterator stops iterating after offsetSet call). 996 (Nikita) 997 998- CLI: 999 . Fixed bug #77794 (Incorrect Date header format in built-in server). 1000 (kelunik) 1001 1002- EXIF 1003 . Fixed bug #77950 (Heap-buffer-overflow in _estrndup via exif_process_IFD_TAG). 1004 (CVE-2019-11036) (Stas) 1005 1006- Interbase: 1007 . Fixed bug #72175 (Impossibility of creating multiple connections to 1008 Interbase with php 7.x). (Nikita) 1009 1010- Intl: 1011 . Fixed bug #77895 (IntlDateFormatter::create fails in strict mode if $locale 1012 = null). (Nikita) 1013 1014- LDAP: 1015 . Fixed bug #77869 (Core dump when using server controls) (mcmic) 1016 1017- Mail 1018 . Fixed bug #77821 (Potential heap corruption in TSendMail()). (cmb) 1019 1020- mbstring: 1021 . Implemented FR #72777 (Implement regex stack limits for mbregex functions). 1022 (Yasuo Ohgaki, Stas) 1023 1024- MySQLi: 1025 . Fixed bug #77773 (Unbuffered queries leak memory - MySQLi / mysqlnd). 1026 (Nikita) 1027 1028- PCRE: 1029 . Fixed bug #77827 (preg_match does not ignore \r in regex flags). (requinix, 1030 cmb) 1031 1032- PDO: 1033 . Fixed bug #77849 (Disable cloning of PDO handle/connection objects). 1034 (camporter) 1035 1036- phpdbg: 1037 . Fixed bug #76801 (too many open files). (alekitto) 1038 . Fixed bug #77800 (phpdbg segfaults on listing some conditional breakpoints). 1039 (krakjoe) 1040 . Fixed bug #77805 (phpdbg build fails when readline is shared). (krakjoe) 1041 1042- Reflection: 1043 . Fixed bug #77772 (ReflectionClass::getMethods(null) doesn't work). (Nikita) 1044 . Fixed bug #77882 (Different behavior: always calls destructor). (Nikita) 1045 1046- Standard: 1047 . Fixed bug #77793 (Segmentation fault in extract() when overwriting 1048 reference with itself). (Nikita) 1049 . Fixed bug #77844 (Crash due to null pointer in parse_ini_string with 1050 INI_SCANNER_TYPED). (Nikita) 1051 . Fixed bug #77853 (Inconsistent substr_compare behaviour with empty 1052 haystack). (Nikita) 1053 105404 Apr 2019, PHP 7.3.4 1055 1056- Core: 1057 . Fixed bug #77738 (Nullptr deref in zend_compile_expr). (Laruence) 1058 . Fixed bug #77660 (Segmentation fault on break 2147483648). (Laruence) 1059 . Fixed bug #77652 (Anonymous classes can lose their interface information). 1060 (Nikita) 1061 . Fixed bug #77345 (Stack Overflow caused by circular reference in garbage 1062 collection). (Alexandru Patranescu, Nikita, Dmitry) 1063 . Fixed bug #76956 (Wrong value for 'syslog.filter' documented in php.ini). 1064 (cmb) 1065 1066- Apache2Handler: 1067 . Fixed bug #77648 (BOM in sapi/apache2handler/php_functions.c). (cmb) 1068 1069- Bcmath: 1070 . Fixed bug #77742 (bcpow() implementation related to gcc compiler 1071 optimization). (Nikita) 1072 1073- CLI Server: 1074 . Fixed bug #77722 (Incorrect IP set to $_SERVER['REMOTE_ADDR'] on the 1075 localhost). (Nikita) 1076 1077- COM: 1078 . Fixed bug #77578 (Crash when php unload). (cmb) 1079 1080- EXIF: 1081 . Fixed bug #77753 (Heap-buffer-overflow in php_ifd_get32s). (CVE-2019-11034) 1082 (Stas) 1083 . Fixed bug #77831 (Heap-buffer-overflow in exif_iif_add_value). 1084 (CVE-2019-11035) (Stas) 1085 1086- FPM: 1087 . Fixed bug #77677 (FPM fails to build on AIX due to missing WCOREDUMP). 1088 (Kevin Adler) 1089 1090- GD: 1091 . Fixed bug #77700 (Writing truecolor images as GIF ignores interlace flag). 1092 (cmb) 1093 1094- MySQLi: 1095 . Fixed bug #77597 (mysqli_fetch_field hangs scripts). (Nikita) 1096 1097- Opcache: 1098 . Fixed bug #77743 (Incorrect pi node insertion for jmpznz with identical 1099 successors). (Nikita) 1100 1101- PCRE: 1102 . Fixed bug #76127 (preg_split does not raise an error on invalid UTF-8). 1103 (Nikita) 1104 1105- Phar: 1106 . Fixed bug #77697 (Crash on Big_Endian platform). (Laruence) 1107 1108- phpdbg: 1109 . Fixed bug #77767 (phpdbg break cmd aliases listed in help do not match 1110 actual aliases). (Miriam Lauter) 1111 1112- sodium: 1113 . Fixed bug #77646 (sign_detached() strings not terminated). (Frank) 1114 1115- SQLite3: 1116 . Added sqlite3.defensive INI directive. (BohwaZ) 1117 1118- Standard: 1119 . Fixed bug #77664 (Segmentation fault when using undefined constant in 1120 custom wrapper). (Laruence) 1121 . Fixed bug #77669 (Crash in extract() when overwriting extracted array). 1122 (Nikita) 1123 . Fixed bug #76717 (var_export() does not create a parsable value for 1124 PHP_INT_MIN). (Nikita) 1125 . Fixed bug #77765 (FTP stream wrapper should set the directory as 1126 executable). (Vlad Temian) 1127 112807 Mar 2019, PHP 7.3.3 1129 1130- Core: 1131 . Fixed bug #77589 (Core dump using parse_ini_string with numeric sections). 1132 (Laruence) 1133 . Fixed bug #77329 (Buffer Overflow via overly long Error Messages). 1134 (Dmitry) 1135 . Fixed bug #77494 (Disabling class causes segfault on member access). 1136 (Dmitry) 1137 . Fixed bug #77498 (Custom extension Segmentation fault when declare static 1138 property). (Nikita) 1139 . Fixed bug #77530 (PHP crashes when parsing `(2)::class`). (Ekin) 1140 . Fixed bug #77546 (iptcembed broken function). (gdegoulet) 1141 . Fixed bug #77630 (rename() across the device may allow unwanted access 1142 during processing). (Stas) 1143 1144- COM: 1145 . Fixed bug #77621 (Already defined constants are not properly reported). 1146 (cmb) 1147 . Fixed bug #77626 (Persistence confusion in php_com_import_typelib()). (cmb) 1148 1149- EXIF: 1150 . Fixed bug #77509 (Uninitialized read in exif_process_IFD_in_TIFF). (Stas) 1151 . Fixed bug #77540 (Invalid Read on exif_process_SOFn). (Stas) 1152 . Fixed bug #77563 (Uninitialized read in exif_process_IFD_in_MAKERNOTE). (Stas) 1153 . Fixed bug #77659 (Uninitialized read in exif_process_IFD_in_MAKERNOTE). (Stas) 1154 1155- Mbstring: 1156 . Fixed bug #77514 (mb_ereg_replace() with trailing backslash adds null byte). 1157 (Nikita) 1158 1159- MySQL 1160 . Disabled LOCAL INFILE by default, can be enabled using php.ini directive 1161 mysqli.allow_local_infile for mysqli, or PDO::MYSQL_ATTR_LOCAL_INFILE 1162 attribute for pdo_mysql. (Darek Slusarczyk) 1163 1164- OpenSSL: 1165 . Fixed bug #77390 (feof might hang on TLS streams in case of fragmented TLS 1166 records). (Abyl Valg, Jakub Zelenka) 1167 1168- PDO_OCI: 1169 . Support Oracle Database tracing attributes ACTION, MODULE, 1170 CLIENT_INFO, and CLIENT_IDENTIFIER. (Cameron Porter) 1171 1172- PHAR: 1173 . Fixed bug #77396 (Null Pointer Dereference in phar_create_or_parse_filename). 1174 (bishop) 1175 . Fixed bug #77586 (phar_tar_writeheaders_int() buffer overflow). (bishop) 1176 1177- phpdbg: 1178 . Fixed bug #76596 (phpdbg support for display_errors=stderr). (kabel) 1179 1180- SPL: 1181 . Fixed bug #51068 (DirectoryIterator glob:// don't support current path 1182 relative queries). (Ahmed Abdou) 1183 . Fixed bug #77431 (openFile() silently truncates after a null byte). (cmb) 1184 1185- Standard: 1186 . Fixed bug #77552 (Unintialized php_stream_statbuf in stat functions). 1187 (John Stevenson) 1188 . Fixed bug #77612 (setcookie() sets incorrect SameSite header if all of its 1189 options filled). (Nikita) 1190 119107 Feb 2019, PHP 7.3.2 1192 1193- Core: 1194 . Fixed bug #77369 (memcpy with negative length via crafted DNS response). (Stas) 1195 . Fixed bug #77387 (Recursion detection broken when printing GLOBALS). 1196 (Laruence) 1197 . Fixed bug #77376 ("undefined function" message no longer includes 1198 namespace). (Laruence) 1199 . Fixed bug #77357 (base64_encode / base64_decode doest not work on nested 1200 VM). (Nikita) 1201 . Fixed bug #77339 (__callStatic may get incorrect arguments). (Dmitry) 1202 . Fixed bug #77317 (__DIR__, __FILE__, realpath() reveal physical path for 1203 subst virtual drive). (Anatol) 1204 . Fixed bug #77263 (Segfault when using 2 RecursiveFilterIterator). (Dmitry) 1205 . Fixed bug #77447 (PHP 7.3 built with ASAN crashes in 1206 zend_cpu_supports_avx2). (Nikita) 1207 . Fixed bug #77484 (Zend engine crashes when calling realpath in invalid 1208 working dir). (Anatol) 1209 1210- Curl: 1211 . Fixed bug #76675 (Segfault with H2 server push). (Pedro Magalhães) 1212 1213- Fileinfo: 1214 . Fixed bug #77346 (webm files incorrectly detected as 1215 application/octet-stream). (Anatol) 1216 1217- FPM: 1218 . Fixed bug #77430 (php-fpm crashes with Main process exited, code=dumped, 1219 status=11/SEGV). (Jakub Zelenka) 1220 1221- GD: 1222 . Fixed bug #73281 (imagescale(…, IMG_BILINEAR_FIXED) can cause black border). 1223 (cmb) 1224 . Fixed bug #73614 (gdImageFilledArc() doesn't properly draw pies). (cmb) 1225 . Fixed bug #77272 (imagescale() may return image resource on failure). (cmb) 1226 . Fixed bug #77391 (1bpp BMPs may fail to be loaded). (Romain Déoux, cmb) 1227 . Fixed bug #77479 (imagewbmp() segfaults with very large images). (cmb) 1228 1229- ldap: 1230 . Fixed bug #77440 (ldap_bind using ldaps or ldap_start_tls()=exception in 1231 libcrypto-1_1-x64.dll). (Anatol) 1232 1233- Mbstring: 1234 . Fixed bug #77428 (mb_ereg_replace() doesn't replace a substitution 1235 variable). (Nikita) 1236 . Fixed bug #77454 (mb_scrub() silently truncates after a null byte). 1237 (64796c6e69 at gmail dot com) 1238 1239- MySQLnd: 1240 . Fixed bug #77308 (Unbuffered queries memory leak). (Dmitry) 1241 . Fixed bug #75684 (In mysqlnd_ext_plugin.h the plugin methods family has 1242 no external visibility). (Anatol) 1243 1244- Opcache: 1245 . Fixed bug #77266 (Assertion failed in dce_live_ranges). (Laruence) 1246 . Fixed bug #77257 (value of variable assigned in a switch() construct gets 1247 lost). (Nikita) 1248 . Fixed bug #77434 (php-fpm workers are segfaulting in zend_gc_addre). 1249 (Nikita) 1250 . Fixed bug #77361 (configure fails on 64-bit AIX when opcache enabled). 1251 (Kevin Adler) 1252 . Fixed bug #77287 (Opcache literal compaction is incompatible with EXT 1253 opcodes). (Nikita) 1254 1255- PCRE: 1256 . Fixed bug #77338 (get_browser with empty string). (Nikita) 1257 1258- PDO: 1259 . Fixed bug #77273 (array_walk_recursive corrupts value types leading to PDO 1260 failure). (Nikita) 1261 1262- PDO MySQL: 1263 . Fixed bug #77289 (PDO MySQL segfaults with persistent connection). 1264 (Lauri Kenttä) 1265 1266- SOAP: 1267 . Fixed bug #77410 (Segmentation Fault when executing method with an empty 1268 parameter). (Nikita) 1269 1270- Sockets: 1271 . Fixed bug #76839 (socket_recvfrom may return an invalid 'from' address 1272 on MacOS). (Michael Meyer) 1273 1274- SPL: 1275 . Fixed bug #77298 (segfault occurs when add property to unserialized empty 1276 ArrayObject). (jhdxr) 1277 1278- Standard: 1279 . Fixed bug #77395 (segfault about array_multisort). (Laruence) 1280 . Fixed bug #77439 (parse_str segfaults when inserting item into existing 1281 array). (Nikita) 1282 128310 Jan 2019, PHP 7.3.1 1284 1285- Core: 1286 . Fixed bug #76654 (Build failure on Mac OS X on 32-bit Intel). (Ryandesign) 1287 . Fixed bug #71041 (zend_signal_startup() needs ZEND_API). 1288 (Valentin V. Bartenev) 1289 . Fixed bug #76046 (PHP generates "FE_FREE" opcode on the wrong line). 1290 (Nikita) 1291 . Fixed bug #77291 (magic methods inherited from a trait may be ignored). 1292 (cmb) 1293 1294- CURL: 1295 . Fixed bug #77264 (curl_getinfo returning microseconds, not seconds). 1296 (Pierrick) 1297 1298- COM: 1299 . Fixed bug #77177 (Serializing or unserializing COM objects crashes). (cmb) 1300 1301- Exif: 1302 . Fixed bug #77184 (Unsigned rational numbers are written out as signed 1303 rationals). (Colin Basnett) 1304 1305- GD: 1306 . Fixed bug #77195 (Incorrect error handling of imagecreatefromjpeg()). (cmb) 1307 . Fixed bug #77198 (auto cropping has insufficient precision). (cmb) 1308 . Fixed bug #77200 (imagecropauto(…, GD_CROP_SIDES) crops left but not right). 1309 (cmb) 1310 . Fixed bug #77269 (efree() on uninitialized Heap data in imagescale leads to 1311 use-after-free). (cmb) 1312 . Fixed bug #77270 (imagecolormatch Out Of Bounds Write on Heap). (cmb) 1313 1314- MBString: 1315 . Fixed bug #77367 (Negative size parameter in mb_split). (Stas) 1316 . Fixed bug #77370 (Buffer overflow on mb regex functions - fetch_token). 1317 (Stas) 1318 . Fixed bug #77371 (heap buffer overflow in mb regex functions 1319 - compile_string_node). (Stas) 1320 . Fixed bug #77381 (heap buffer overflow in multibyte match_at). (Stas) 1321 . Fixed bug #77382 (heap buffer overflow due to incorrect length in 1322 expand_case_fold_string). (Stas) 1323 . Fixed bug #77385 (buffer overflow in fetch_token). (Stas) 1324 . Fixed bug #77394 (Buffer overflow in multibyte case folding - unicode). 1325 (Stas) 1326 . Fixed bug #77418 (Heap overflow in utf32be_mbc_to_code). (Stas) 1327 1328- OCI8: 1329 . Fixed bug #76804 (oci_pconnect with OCI_CRED_EXT not working). (KoenigsKind) 1330 . Added oci_set_call_timeout() for call timeouts. 1331 . Added oci_set_db_operation() for the DBOP end-to-end-tracing attribute. 1332 1333- Opcache: 1334 . Fixed bug #77215 (CFG assertion failure on multiple finalizing switch 1335 frees in one block). (Nikita) 1336 . Fixed bug #77275 (OPcache optimization problem for ArrayAccess->offsetGet). 1337 (Nikita) 1338 1339- PCRE: 1340 . Fixed bug #77193 (Infinite loop in preg_replace_callback). (Anatol) 1341 1342- PDO: 1343 . Handle invalid index passed to PDOStatement::fetchColumn() as error. (Sergei 1344 Morozov) 1345 1346- Phar: 1347 . Fixed bug #77247 (heap buffer overflow in phar_detect_phar_fname_ext). (Stas) 1348 1349- Soap: 1350 . Fixed bug #77088 (Segfault when using SoapClient with null options). 1351 (Laruence) 1352 1353- Sockets: 1354 . Fixed bug #77136 (Unsupported IPV6_RECVPKTINFO constants on macOS). 1355 (Mizunashi Mana) 1356 1357- Sodium: 1358 . Fixed bug #77297 (SodiumException segfaults on PHP 7.3). (Nikita, Scott) 1359 1360- SPL: 1361 . Fixed bug #77359 (spl_autoload causes segfault). (Lauri Kenttä) 1362 . Fixed bug #77360 (class_uses causes segfault). (Lauri Kenttä) 1363 1364- SQLite3: 1365 . Fixed bug #77051 (Issue with re-binding on SQLite3). (BohwaZ) 1366 1367- Xmlrpc: 1368 . Fixed bug #77242 (heap out of bounds read in xmlrpc_decode()). (cmb) 1369 . Fixed bug #77380 (Global out of bounds read in xmlrpc base64 code). (Stas) 1370 137106 Dec 2018, PHP 7.3.0 1372 1373- Core: 1374 . Improved PHP GC. (Dmitry, Nikita) 1375 . Redesigned the old ext_skel program written in PHP, run: 1376 'php ext_skel.php' for all options. This means there are no dependencies, 1377 thus making it work on Windows out of the box. (Kalle) 1378 . Removed support for BeOS. (Kalle) 1379 . Add PHP_VERSION to phpinfo() <title/>. (github/MattJeevas) 1380 . Add net_get_interfaces(). (Sara, Joe, Anatol) 1381 . Added gc_status(). (Benjamin Eberlei) 1382 . Implemented flexible heredoc and nowdoc syntax, per 1383 RFC https://wiki.php.net/rfc/flexible_heredoc_nowdoc_syntaxes. 1384 (Thomas Punt) 1385 . Added support for references in list() and array destructuring, per 1386 RFC https://wiki.php.net/rfc/list_reference_assignment. 1387 (David Walker) 1388 . Improved effectiveness of ZEND_SECURE_ZERO for NetBSD and systems 1389 without native similar feature. (devnexen) 1390 . Added syslog.facility and syslog.ident INI entries for customizing syslog 1391 logging. (Philip Prindeville) 1392 . Fixed bug #75683 (Memory leak in zend_register_functions() in ZTS mode). 1393 (Dmitry) 1394 . Fixed bug #75031 (support append mode in temp/memory streams). (adsr) 1395 . Fixed bug #74860 (Uncaught exceptions not being formatted properly when 1396 error_log set to "syslog"). (Philip Prindeville) 1397 . Fixed bug #75220 (Segfault when calling is_callable on parent). 1398 (andrewnester) 1399 . Fixed bug #69954 (broken links and unused config items in distributed ini 1400 files). (petk) 1401 . Fixed bug #74922 (Composed class has fatal error with duplicate, equal const 1402 properties). (pmmaga) 1403 . Fixed bug #63911 (identical trait methods raise errors during composition). 1404 (pmmaga) 1405 . Fixed bug #75677 (Clang ignores fastcall calling convention on variadic 1406 function). (Li-Wen Hsu) 1407 . Fixed bug #54043 (Remove inconsitency of internal exceptions and user 1408 defined exceptions). (Nikita) 1409 . Fixed bug #53033 (Mathematical operations convert objects to integers). 1410 (Nikita) 1411 . Fixed bug #73108 (Internal class cast handler uses integer instead of 1412 float). (Nikita) 1413 . Fixed bug #75765 (Fatal error instead of Error exception when base class is 1414 not found). (Timur Ibragimov) 1415 . Fixed bug #76198 (Wording: "iterable" is not a scalar type). (Levi Morrison) 1416 . Fixed bug #76137 (config.guess/config.sub do not recognize RISC-V). (cmb) 1417 . Fixed bug #76427 (Segfault in zend_objects_store_put). (Laruence) 1418 . Fixed bug #76422 (ftruncate fails on files > 2GB). (Anatol) 1419 . Fixed bug #76509 (Inherited static properties can be desynchronized from 1420 their parent by ref). (Nikita) 1421 . Fixed bug #76439 (Changed behaviour in unclosed HereDoc). (Nikita, tpunt) 1422 . Fixed bug #63217 (Constant numeric strings become integers when used as 1423 ArrayAccess offset). (Rudi Theunissen, Dmitry) 1424 . Fixed bug #33502 (Some nullary functions don't check the number of 1425 arguments). (cmb) 1426 . Fixed bug #76392 (Error relocating sapi/cli/php: unsupported relocation 1427 type 37). (Peter Kokot) 1428 . The declaration and use of case-insensitive constants has been deprecated. 1429 (Nikita) 1430 . Added syslog.filter INI entry for syslog filtering. (Philip Prindeville) 1431 . Fixed bug #76667 (Segfault with divide-assign op and __get + __set). 1432 (Laruence) 1433 . Fixed bug #76030 (RE2C_FLAGS rarely honoured) (Cristian Rodríguez) 1434 . Fixed broken zend_read_static_property (Laruence) 1435 . Fixed bug #76773 (Traits used on the parent are ignored for child classes). 1436 (daverandom) 1437 . Fixed bug #76767 (‘asm’ operand has impossible constraints in zend_operators.h). 1438 (ondrej) 1439 . Fixed bug #76752 (Crash in ZEND_COALESCE_SPEC_TMP_HANDLER - assertion in 1440 _get_zval_ptr_tmp failed). (Laruence) 1441 . Fixed bug #76820 (Z_COPYABLE invalid definition). (mvdwerve, cmb) 1442 . Fixed bug #76510 (file_exists() stopped working for phar://). (cmb) 1443 . Fixed bug #76869 (Incorrect bypassing protected method accessibilty check). 1444 (Dmitry) 1445 . Fixed bug #72635 (Undefined class used by class constant in constexpr 1446 generates fatal error). (Nikita) 1447 . Fixed bug #76947 (file_put_contents() blocks the directory of the file 1448 (__DIR__)). (Anatol) 1449 . Fixed bug #76979 (define() error message does not mention resources as 1450 valid values). (Michael Moravec) 1451 . Fixed bug #76825 (Undefined symbols ___cpuid_count). (Laruence, cmb) 1452 . Fixed bug #77110 (undefined symbol zend_string_equal_val in C++ build). 1453 (Remi) 1454 1455- BCMath: 1456 . Implemented FR #67855 (No way to get current scale in use). (Chris Wright, 1457 cmb) 1458 . Fixed bug #66364 (BCMath bcmul ignores scale parameter). (cmb) 1459 . Fixed bug #75164 (split_bc_num() is pointless). (cmb) 1460 . Fixed bug #75169 (BCMath errors/warnings bypass PHP's error handling). (cmb) 1461 1462- CLI: 1463 . Fixed bug #44217 (Output after stdout/stderr closed cause immediate exit 1464 with status 0). (Robert Lu) 1465 . Fixed bug #77111 (php-win.exe corrupts unicode symbols from cli 1466 parameters). (Anatol) 1467 1468- cURL: 1469 . Expose curl constants from curl 7.50 to 7.61. (Pierrick) 1470 . Fixed bug #74125 (Fixed finding CURL on systems with multiarch support). 1471 (cebe) 1472 1473- Date: 1474 . Implemented FR #74668: Add DateTime::createFromImmutable() method. 1475 (majkl578, Rican7) 1476 . Fixed bug #75222 (DateInterval microseconds property always 0). (jhdxr) 1477 . Fixed bug #68406 (calling var_dump on a DateTimeZone object modifies it). 1478 (jhdxr) 1479 . Fixed bug #76131 (mismatch arginfo for date_create). (carusogabriel) 1480 . Updated timelib to 2018.01RC1 to address several bugs: 1481 . Fixed bug #75577 (DateTime::createFromFormat does not accept 'v' format 1482 specifier). (Derick) 1483 . Fixed bug #75642 (Wrap around behaviour for microseconds is not working). 1484 (Derick) 1485 1486- DBA: 1487 . Fixed bug #75264 (compiler warnings emitted). (petk) 1488 1489- DOM: 1490 . Fixed bug #76285 (DOMDocument::formatOutput attribute sometimes ignored). 1491 (Andrew Nester, Laruence, Anatol) 1492 1493- Fileinfo: 1494 . Fixed bug #77095 (slowness regression in 7.2/7.3 (compared to 7.1)). 1495 (Anatol) 1496 1497- Filter: 1498 . Added the 'add_slashes' sanitization mode (FILTER_SANITIZE_ADD_SLASHES). 1499 (Kalle) 1500 1501- FPM: 1502 . Added fpm_get_status function. (Till Backhaus) 1503 . Fixed bug #62596 (getallheaders() missing with PHP-FPM). (Remi) 1504 . Fixed bug #69031 (Long messages into stdout/stderr are truncated 1505 incorrectly) - added new log related FPM configuration options: 1506 log_limit, log_buffering and decorate_workers_output. (Jakub Zelenka) 1507 1508- ftp: 1509 . Fixed bug #77151 (ftp_close(): SSL_read on shutdown). (Remi) 1510 1511- GD: 1512 . Added support for WebP in imagecreatefromstring(). (Andreas Treichel, cmb) 1513 1514- GMP: 1515 . Export internal structures and accessor helpers for GMP object. (Sara) 1516 . Added gmp_binomial(n, k). (Nikita) 1517 . Added gmp_lcm(a, b). (Nikita) 1518 . Added gmp_perfect_power(a). (Nikita) 1519 . Added gmp_kronecker(a, b). (Nikita) 1520 1521- iconv: 1522 . Fixed bug #53891 (iconv_mime_encode() fails to Q-encode UTF-8 string). (cmb) 1523 . Fixed bug #77147 (Fixing 60494 ignored ICONV_MIME_DECODE_CONTINUE_ON_ERROR). 1524 (cmb) 1525 1526- IMAP: 1527 . Fixed bug #77020 (null pointer dereference in imap_mail). (cmb) 1528 . Fixed bug #77153 (imap_open allows to run arbitrary shell commands via 1529 mailbox parameter). (Stas) 1530 1531- Interbase: 1532 . Fixed bug #75453 (Incorrect reflection for ibase_[p]connect). (villfa) 1533 . Fixed bug #76443 (php+php_interbase.dll crash on module_shutdown). (Kalle) 1534 1535 1536- intl: 1537 . Fixed bug #75317 (UConverter::setDestinationEncoding changes source instead 1538 of destination). (andrewnester) 1539 . Fixed bug #76829 (Incorrect validation of domain on idn_to_utf8() 1540 function). (Anatol) 1541 1542- JSON: 1543 . Added JSON_THROW_ON_ERROR flag. (Andrea) 1544 1545- LDAP: 1546 . Added ldap_exop_refresh helper for EXOP REFRESH operation with dds overlay. 1547 (Come) 1548 . Added full support for sending and parsing ldap controls. (Come) 1549 . Fixed bug #49876 (Fix LDAP path lookup on 64-bit distros). (dzuelke) 1550 1551- libxml2: 1552 . Fixed bug #75871 (use pkg-config where available). (pmmaga) 1553 1554- litespeed: 1555 . Fixed bug #75248 (Binary directory doesn't get created when building 1556 only litespeed SAPI). (petk) 1557 . Fixed bug #75251 (Missing program prefix and suffix). (petk) 1558 1559- MBstring: 1560 . Updated to Oniguruma 6.9.0. (cmb) 1561 . Fixed bug #65544 (mb title case conversion-first word in quotation isn't 1562 capitalized). (Nikita) 1563 . Fixed bug #71298 (MB_CASE_TITLE misbehaves with curled apostrophe/quote). 1564 (Nikita) 1565 . Fixed bug #73528 (Crash in zif_mb_send_mail). (Nikita) 1566 . Fixed bug #74929 (mbstring functions version 7.1.1 are slow compared to 5.3 1567 on Windows). (Nikita) 1568 . Fixed bug #76319 (mb_strtolower with invalid UTF-8 causes segmentation 1569 fault). (Nikita) 1570 . Fixed bug #76574 (use of undeclared identifiers INT_MAX and LONG_MAX). (cmb) 1571 . Fixed bug #76594 (Bus Error due to unaligned access in zend_ini.c 1572 OnUpdateLong). (cmb, Nikita) 1573 . Fixed bug #76706 (mbstring.http_output_conv_mimetypes is ignored). (cmb) 1574 . Fixed bug #76958 (Broken UTF7-IMAP conversion). (Nikita) 1575 . Fixed bug #77025 (mb_strpos throws Unknown encoding or conversion error). 1576 (Nikita) 1577 . Fixed bug #77165 (mb_check_encoding crashes when argument given an empty 1578 array). (Nikita) 1579 1580- Mysqlnd: 1581 . Fixed bug #76386 (Prepared Statement formatter truncates fractional seconds 1582 from date/time column). (Victor Csiky) 1583 1584- ODBC: 1585 . Removed support for ODBCRouter. (Kalle) 1586 . Removed support for Birdstep. (Kalle) 1587 . Fixed bug #77079 (odbc_fetch_object has incorrect type signature). 1588 (Jon Allen) 1589 1590- Opcache: 1591 . Fixed bug #76466 (Loop variable confusion). (Dmitry, Laruence, Nikita) 1592 . Fixed bug #76463 (var has array key type but not value type). (Laruence) 1593 . Fixed bug #76446 (zend_variables.c:73: zend_string_destroy: Assertion 1594 `!(zval_gc_flags((str)->gc)). (Nikita, Laruence) 1595 . Fixed bug #76711 (OPcache enabled triggers false-positive "Illegal string 1596 offset"). (Dmitry) 1597 . Fixed bug #77058 (Type inference in opcache causes side effects). (Nikita) 1598 . Fixed bug #77092 (array_diff_key() - segmentation fault). (Nikita) 1599 1600- OpenSSL: 1601 . Added openssl_pkey_derive function. (Jim Zubov) 1602 . Add min_proto_version and max_proto_version ssl stream options as well as 1603 related constants for possible TLS protocol values. (Jakub Zelenka) 1604 1605- PCRE: 1606 . Implemented https://wiki.php.net/rfc/pcre2-migration. (Anatol, Dmitry) 1607 . Upgrade PCRE2 to 10.32. (Anatol) 1608 . Fixed bug #75355 (preg_quote() does not quote # control character). 1609 (Michael Moravec) 1610 . Fixed bug #76512 (\w no longer includes unicode characters). (cmb) 1611 . Fixed bug #76514 (Regression in preg_match makes it fail with 1612 PREG_JIT_STACKLIMIT_ERROR). (Anatol) 1613 . Fixed bug #76909 (preg_match difference between 7.3 and < 7.3). (Anatol) 1614 1615- PDO_DBlib: 1616 . Implemented FR #69592 (allow 0-column rowsets to be skipped automatically). 1617 (fandrieu) 1618 . Expose TDS version as \PDO::DBLIB_ATTR_TDS_VERSION attribute on \PDO 1619 instance. (fandrieu) 1620 . Treat DATETIME2 columns like DATETIME. (fandrieu) 1621 . Fixed bug #74243 (allow locales.conf to drive datetime format). (fandrieu) 1622 1623- PDO_Firebird: 1624 . Fixed bug #74462 (PDO_Firebird returns only NULLs for results with boolean 1625 for FIREBIRD >= 3.0). (Dorin Marcoci) 1626 1627- PDO_OCI: 1628 . Fixed bug #74631 (PDO_PCO with PHP-FPM: OCI environment initialized 1629 before PHP-FPM sets it up). (Ingmar Runge) 1630 1631- PDO SQLite 1632 . Add support for additional open flags 1633 1634- pgsql: 1635 . Added new error constants for pg_result_error(): PGSQL_DIAG_SCHEMA_NAME, 1636 PGSQL_DIAG_TABLE_NAME, PGSQL_DIAG_COLUMN_NAME, PGSQL_DIAG_DATATYPE_NAME, 1637 PGSQL_DIAG_CONSTRAINT_NAME and PGSQL_DIAG_SEVERITY_NONLOCALIZED. (Kalle) 1638 . Fixed bug #77047 (pg_convert has a broken regex for the 'TIME WITHOUT 1639 TIMEZONE' data type). (Andy Gajetzki) 1640 1641- phar: 1642 . Fixed bug #74991 (include_path has a 4096 char limit in some cases). 1643 (bwbroersma) 1644 . Fixed bug #65414 (deal with leading slash when adding files correctly). 1645 (bishopb) 1646 1647- readline: 1648 . Added completion_append_character and completion_suppress_append options 1649 to readline_info() if linked against libreadline. (krageon) 1650 1651- Session: 1652 . Fixed bug #74941 (session fails to start after having headers sent). 1653 (morozov) 1654 1655- SimpleXML: 1656 . Fixed bug #54973 (SimpleXML casts integers wrong). (Nikita) 1657 . Fixed bug #76712 (Assignment of empty string creates extraneous text node). 1658 (cmb) 1659 1660- Sockets: 1661 . Fixed bug #67619 (Validate length on socket_write). (thiagooak) 1662 1663- SOAP: 1664 . Fixed bug #75464 (Wrong reflection on SoapClient::__setSoapHeaders). 1665 (villfa) 1666 . Fixed bug #70469 (SoapClient generates E_ERROR even if exceptions=1 is 1667 used). (Anton Artamonov) 1668 . Fixed bug #50675 (SoapClient can't handle object references correctly). 1669 (Cameron Porter) 1670 . Fixed bug #76348 (WSDL_CACHE_MEMORY causes Segmentation fault). (cmb) 1671 . Fixed bug #77141 (Signedness issue in SOAP when precision=-1). (cmb) 1672 1673- SPL: 1674 . Fixed bug #74977 (Appending AppendIterator leads to segfault). 1675 (Andrew Nester) 1676 . Fixed bug #75173 (incorrect behavior of AppendIterator::append in foreach 1677 loop). (jhdxr) 1678 . Fixed bug #74372 (autoloading file with syntax error uses next autoloader, 1679 may hide parse error). (Nikita) 1680 . Fixed bug #75878 (RecursiveTreeIterator::setPostfix has wrong signature). 1681 (cmb) 1682 . Fixed bug #74519 (strange behavior of AppendIterator). (jhdxr) 1683 . Fixed bug #76131 (mismatch arginfo for splarray constructor). 1684 (carusogabriel) 1685 1686- SQLite3: 1687 . Updated bundled libsqlite to 3.24.0. (cmb) 1688 1689- Standard: 1690 . Added is_countable() function. (Gabriel Caruso) 1691 . Added support for the SameSite cookie directive, including an alternative 1692 signature for setcookie(), setrawcookie() and session_set_cookie_params(). 1693 (Frederik Bosch, pmmaga) 1694 . Remove superfluous warnings from inet_ntop()/inet_pton(). (daverandom) 1695 . Fixed bug #75916 (DNS_CAA record results contain garbage). (Mike, 1696 Philip Sharp) 1697 . Fixed unserialize(), to disable creation of unsupported data structures 1698 through manually crafted strings. (Dmitry) 1699 . Fixed bug #75409 (accept EFAULT in addition to ENOSYS as indicator 1700 that getrandom() is missing). (sarciszewski) 1701 . Fixed bug #74719 (fopen() should accept NULL as context). (Alexander Holman) 1702 . Fixed bug #69948 (path/domain are not sanitized in setcookie). (cmb) 1703 . Fixed bug #75996 (incorrect url in header for mt_rand). (tatarbj) 1704 . Added hrtime() function, to get high resolution time. (welting) 1705 . Fixed bug #48016 (stdClass::__setState is not defined although var_export() 1706 uses it). (Andrea) 1707 . Fixed bug #76136 (stream_socket_get_name should enclose IPv6 in brackets). 1708 (seliver) 1709 . Fixed bug #76688 (Disallow excessive parameters after options array). 1710 (pmmaga) 1711 . Fixed bug #76713 (Segmentation fault caused by property corruption). 1712 (Laruence) 1713 . Fixed bug #76755 (setcookie does not accept "double" type for expire time). 1714 (Laruence) 1715 . Fixed bug #76674 (improve array_* failure messages exposing what was passed 1716 instead of an array). (carusogabriel) 1717 . Fixed bug #76803 (ftruncate changes file pointer). (Anatol) 1718 . Fixed bug #76818 (Memory corruption and segfault). (Remi) 1719 . Fixed bug #77081 (ftruncate() changes seek pointer in c mode). (cmb, Anatol) 1720 1721- Testing: 1722 . Implemented FR #62055 (Make run-tests.php support --CGI-- sections). (cmb) 1723 1724- Tidy: 1725 . Support using tidyp instead of tidy. (devnexen) 1726 . Fixed bug #74707 (Tidy has incorrect ReflectionFunction param counts for 1727 functions taking tidy). (Gabriel Caruso) 1728 . Fixed arginfo for tidy::__construct(). (Tyson Andre) 1729 1730- Tokenizer: 1731 . Fixed bug #76437 (token_get_all with TOKEN_PARSE flag fails to recognise 1732 close tag). (Laruence) 1733 . Fixed bug #75218 (Change remaining uncatchable fatal errors for parsing 1734 into ParseError). (Nikita) 1735 . Fixed bug #76538 (token_get_all with TOKEN_PARSE flag fails to recognise 1736 close tag with newline). (Nikita) 1737 . Fixed bug #76991 (Incorrect tokenization of multiple invalid flexible 1738 heredoc strings). (Nikita) 1739 1740- XML: 1741 . Fixed bug #71592 (External entity processing never fails). (cmb) 1742 1743- Zlib: 1744 . Added zlib/level context option for compress.zlib wrapper. (Sara) 1745 174608 Nov 2018, PHP 7.2.12 1747 1748- Core: 1749 . Fixed bug #76846 (Segfault in shutdown function after memory limit error). 1750 (Nikita) 1751 . Fixed bug #76946 (Cyclic reference in generator not detected). (Nikita) 1752 . Fixed bug #77035 (The phpize and ./configure create redundant .deps file). 1753 (Peter Kokot) 1754 . Fixed bug #77041 (buildconf should output error messages to stderr) 1755 (Mizunashi Mana) 1756 1757- Date: 1758 . Upgraded timelib to 2017.08. (Derick) 1759 . Fixed bug #75851 (Year component overflow with date formats "c", "o", "r" 1760 and "y"). (Adam Saponara) 1761 . Fixed bug #77007 (fractions in `diff()` are not correctly normalized). 1762 (Derick) 1763 1764- FCGI: 1765 . Fixed #76948 (Failed shutdown/reboot or end session in Windows). (Anatol) 1766 . Fixed bug #76954 (apache_response_headers removes last character from header 1767 name). (stodorovic) 1768 1769- FTP: 1770 . Fixed bug #76972 (Data truncation due to forceful ssl socket shutdown). 1771 (Manuel Mausz) 1772 1773- intl: 1774 . Fixed bug #76942 (U_ARGUMENT_TYPE_MISMATCH). (anthrax at unixuser dot org) 1775 1776- Reflection: 1777 . Fixed bug #76936 (Objects cannot access their private attributes while 1778 handling reflection errors). (Nikita) 1779 . Fixed bug #66430 (ReflectionFunction::invoke does not invoke closure with 1780 object scope). (Nikita) 1781 1782- Sodium: 1783 . Some base64 outputs were truncated; this is not the case any more. 1784 (jedisct1) 1785 . block sizes >= 256 bytes are now supposed by sodium_pad() even 1786 when an old version of libsodium has been installed. (jedisct1) 1787 . Fixed bug #77008 (sodium_pad() could read (but not return nor write) 1788 uninitialized memory when trying to pad an empty input). (jedisct1) 1789 1790- Standard: 1791 . Fixed bug #76965 (INI_SCANNER_RAW doesn't strip trailing whitespace). 1792 (Pierrick) 1793 1794- Tidy: 1795 . Fixed bug #77027 (tidy::getOptDoc() not available on Windows). (cmb) 1796 1797- XML: 1798 . Fixed bug #30875 (xml_parse_into_struct() does not resolve entities). (cmb) 1799 . Add support for getting SKIP_TAGSTART and SKIP_WHITE options. (cmb) 1800 1801- XMLRPC: 1802 . Fixed bug #75282 (xmlrpc_encode_request() crashes). (cmb) 1803 180411 Oct 2018, PHP 7.2.11 1805 1806- Core: 1807 . Fixed bug #76800 (foreach inconsistent if array modified during loop). 1808 (Dmitry) 1809 . Fixed bug #76901 (method_exists on SPL iterator passthrough method corrupts 1810 memory). (Nikita) 1811 1812- CURL: 1813 . Fixed bug #76480 (Use curl_multi_wait() so that timeouts are respected). 1814 (Pierrick) 1815 1816- iconv: 1817 . Fixed bug #66828 (iconv_mime_encode Q-encoding longer than it should be). 1818 (cmb) 1819 1820- Opcache: 1821 . Fixed bug #76832 (ZendOPcache.MemoryBase periodically deleted by the OS). 1822 (Anatol) 1823 . Fixed bug #76796 (Compile-time evaluation of disabled function in opcache 1824 causes segfault). (Nikita) 1825 1826- POSIX: 1827 . Fixed bug #75696 (posix_getgrnam fails to print details of group). (cmb) 1828 1829- Reflection: 1830 . Fixed bug #74454 (Wrong exception being thrown when using ReflectionMethod). 1831 (cmb) 1832 1833- Standard: 1834 . Fixed bug #73457 (Wrong error message when fopen FTP wrapped fails to open 1835 data connection). (Ville Hukkamäki) 1836 . Fixed bug #74764 (Bindto IPv6 works with file_get_contents but fails with 1837 stream_socket_client). (Ville Hukkamäki) 1838 . Fixed bug #75533 (array_reduce is slow when $carry is large array). 1839 (Manabu Matsui) 1840 1841- XMLRPC: 1842 . Fixed bug #76886 (Can't build xmlrpc with expat). (Thomas Petazzoni, cmb) 1843 1844- Zlib: 1845 . Fixed bug #75273 (php_zlib_inflate_filter() may not update bytes_consumed). 1846 (Martin Burke, cmb) 1847 184813 Sep 2018, PHP 7.2.10 1849 1850- Core: 1851 . Fixed bug #76754 (parent private constant in extends class memory leak). 1852 (Laruence) 1853 . Fixed bug #72443 (Generate enabled extension). (petk) 1854 . Fixed bug #75797 (Memory leak when using class_alias() in non-debug mode). 1855 (Massimiliano Braglia) 1856 1857- Apache2: 1858 . Fixed bug #76582 (Apache bucket brigade sometimes becomes invalid). (stas) 1859 1860- Bz2: 1861 . Fixed arginfo for bzcompress. (Tyson Andre) 1862 1863- gettext: 1864 . Fixed bug #76517 (incorrect restoring of LDFLAGS). (sji) 1865 1866- iconv: 1867 . Fixed bug #68180 (iconv_mime_decode can return extra characters in a 1868 header). (cmb) 1869 . Fixed bug #63839 (iconv_mime_decode_headers function is skipping headers). 1870 (cmb) 1871 . Fixed bug #60494 (iconv_mime_decode does ignore special characters). (cmb) 1872 . Fixed bug #55146 (iconv_mime_decode_headers() skips some headers). (cmb) 1873 1874- intl: 1875 . Fixed bug #74484 (MessageFormatter::formatMessage memory corruption with 1876 11+ named placeholders). (Anatol) 1877 1878- libxml: 1879 . Fixed bug #76777 ("public id" parameter of libxml_set_external_entity_loader 1880 callback undefined). (Ville Hukkamäki) 1881 1882- mbstring: 1883 . Fixed bug #76704 (mb_detect_order return value varies based on argument 1884 type). (cmb) 1885 1886- Opcache: 1887 . Fixed bug #76747 (Opcache treats path containing "test.pharma.tld" as a phar 1888 file). (Laruence) 1889 1890- OpenSSL: 1891 . Fixed bug #76705 (unusable ssl => peer_fingerprint in 1892 stream_context_create()). (Jakub Zelenka) 1893 1894- phpdbg: 1895 . Fixed bug #76595 (phpdbg man page contains outdated information). 1896 (Kevin Abel) 1897 1898- SPL: 1899 . Fixed bug #68825 (Exception in DirectoryIterator::getLinkTarget()). (cmb) 1900 . Fixed bug #68175 (RegexIterator pregFlags are NULL instead of 0). (Tim 1901 Siebels) 1902 1903- Standard: 1904 . Fixed bug #76778 (array_reduce leaks memory if callback throws exception). 1905 (cmb) 1906 1907- zlib: 1908 . Fixed bug #65988 (Zlib version check fails when an include/zlib/ style dir 1909 is passed to the --with-zlib configure option). (Jay Bonci) 1910 . Fixed bug #76709 (Minimal required zlib library is 1.2.0.4). (petk) 1911 191216 Aug 2018, PHP 7.2.9 1913 1914- Calendar: 1915 . Fixed bug #52974 (jewish.c: compile error under Windows with GBK charset). 1916 (cmb) 1917 1918- Filter: 1919 . Fixed bug #76366 (References in sub-array for filtering breaks the filter). 1920 (ZiHang Gao) 1921 1922- PDO_Firebird: 1923 . Fixed bug #76488 (Memory leak when fetching a BLOB field). (Simonov Denis) 1924 1925- PDO_PgSQL: 1926 . Fixed bug #75402 (Possible Memory Leak using PDO::CURSOR_SCROLL option). 1927 (Anatol) 1928 1929- SQLite3: 1930 . Fixed #76665 (SQLite3Stmt::bindValue() with SQLITE3_FLOAT doesn't juggle). 1931 (cmb) 1932 1933- Standard: 1934 . Fixed bug #73817 (Incorrect entries in get_html_translation_table). (cmb) 1935 . Fixed bug #68553 (array_column: null values in $index_key become incrementing 1936 keys in result). (Laruence) 1937 . Fixed bug #76643 (Segmentation fault when using `output_add_rewrite_var`). 1938 (cmb) 1939 1940- Zip: 1941 . Fixed bug #76524 (ZipArchive memory leak (OVERWRITE flag and empty archive)). 1942 (Timur Ibragimov) 1943 194419 Jul 2018, PHP 7.2.8 1945 1946- Core: 1947 . Fixed bug #76534 (PHP hangs on 'illegal string offset on string references 1948 with an error handler). (Laruence) 1949 . Fixed bug #76520 (Object creation leaks memory when executed over HTTP). 1950 (Nikita) 1951 . Fixed bug #76502 (Chain of mixed exceptions and errors does not serialize 1952 properly). (Nikita) 1953 1954- Date: 1955 . Fixed bug #76462 (Undefined property: DateInterval::$f). (Anatol) 1956 1957- EXIF: 1958 . Fixed bug #76409 (heap use after free in _php_stream_free). (cmb) 1959 . Fixed bug #76423 (Int Overflow lead to Heap OverFlow in 1960 exif_thumbnail_extract of exif.c). (Stas) 1961 . Fixed bug #76557 (heap-buffer-overflow (READ of size 48) while reading exif 1962 data). (Stas) 1963 1964- FPM: 1965 . Fixed bug #73342 (Vulnerability in php-fpm by changing stdin to 1966 non-blocking). (Nikita) 1967 1968- GMP: 1969 . Fixed bug #74670 (Integer Underflow when unserializing GMP and possible 1970 other classes). (Nikita) 1971 1972- intl: 1973 . Fixed bug #76556 (get_debug_info handler for BreakIterator shows wrong 1974 type). (cmb) 1975 1976- mbstring: 1977 . Fixed bug #76532 (Integer overflow and excessive memory usage 1978 in mb_strimwidth). (MarcusSchwarz) 1979 1980- Opcache: 1981 . Fixed bug #76477 (Opcache causes empty return value). 1982 (Nikita, Laruence) 1983 1984- PGSQL: 1985 . Fixed bug #76548 (pg_fetch_result did not fetch the next row). (Anatol) 1986 1987- phpdbg: 1988 . Fix arginfo wrt. optional/required parameters. (cmb) 1989 1990- Reflection: 1991 . Fixed bug #76536 (PHP crashes with core dump when throwing exception in 1992 error handler). (Laruence) 1993 . Fixed bug #75231 (ReflectionProperty#getValue() incorrectly works with 1994 inherited classes). (Nikita) 1995 1996- Standard: 1997 . Fixed bug #76505 (array_merge_recursive() is duplicating sub-array keys). 1998 (Laruence) 1999 . Fixed bug #71848 (getimagesize with $imageinfo returns false). (cmb) 2000 2001- Win32: 2002 . Fixed bug #76459 (windows linkinfo lacks openbasedir check). (Anatol) 2003 2004- ZIP: 2005 . Fixed bug #76461 (OPSYS_Z_CPM defined instead of OPSYS_CPM). 2006 (Dennis Birkholz, Remi) 2007 200807 Jun 2018, PHP 7.2.7 2009 2010- Core: 2011 . Fixed bug #76337 (segfault when opcache enabled + extension use 2012 zend_register_class_alias). (xKhorasan) 2013 2014- CLI Server: 2015 . Fixed bug #76333 (PHP built-in server does not find files if root path 2016 contains special characters). (Anatol) 2017 2018- OpenSSL: 2019 . Fixed bug #76296 (openssl_pkey_get_public does not respect open_basedir). 2020 (Erik Lax, Jakub Zelenka) 2021 . Fixed bug #76174 (openssl extension fails to build with LibreSSL 2.7). 2022 (Jakub Zelenka) 2023 2024- SPL: 2025 . Fixed bug #76367 (NoRewindIterator segfault 11). (Laruence) 2026 2027- Standard: 2028 . Fixed bug #76410 (SIGV in zend_mm_alloc_small). (Laruence) 2029 . Fixed bug #76335 ("link(): Bad file descriptor" with non-ASCII path). 2030 (Anatol) 2031 203224 May 2018, PHP 7.2.6 2033 2034- EXIF: 2035 . Fixed bug #76164 (exif_read_data zend_mm_heap corrupted). (cmb) 2036 2037- FPM: 2038 . Fixed bug #76075 --with-fpm-acl wrongly tries to find libacl on FreeBSD. 2039 (mgorny) 2040 2041- intl: 2042 . Fixed bug #74385 (Locale::parseLocale() broken with some arguments). 2043 (Anatol) 2044 2045- Opcache: 2046 . Fixed bug #76205 (PHP-FPM sporadic crash when running Infinitewp). (Dmitry) 2047 . Fixed bug #76275 (Assertion failure in file cache when unserializing empty 2048 try_catch_array). (Nikita) 2049 . Fixed bug #76281 (Opcache causes incorrect "undefined variable" errors). 2050 (Nikita) 2051 2052- Reflection: 2053 . Fixed arginfo of array_replace(_recursive) and array_merge(_recursive). 2054 (carusogabriel) 2055 2056- Session: 2057 . Fixed bug #74892 (Url Rewriting (trans_sid) not working on urls that start 2058 with "#"). (Andrew Nester) 2059 206026 Apr 2018, PHP 7.2.5 2061 2062- Core: 2063 . Fixed bug #75722 (Convert valgrind detection to configure option). 2064 (Michael Heimpold) 2065 2066- Date: 2067 . Fixed bug #76131 (mismatch arginfo for date_create). (carusogabriel) 2068 2069- Exif: 2070 . Fixed bug #76130 (Heap Buffer Overflow (READ: 1786) in exif_iif_add_value). 2071 (Stas) 2072 2073- FPM: 2074 . Fixed bug #68440 (ERROR: failed to reload: execvp() failed: Argument list 2075 too long). (Jacob Hipps) 2076 . Fixed incorrect write to getenv result in FPM reload. (Jakub Zelenka) 2077 2078- GD: 2079 . Fixed bug #52070 (imagedashedline() - dashed line sometimes is not visible). 2080 (cmb) 2081 2082- iconv: 2083 . Fixed bug #76249 (stream filter convert.iconv leads to infinite loop on 2084 invalid sequence). (Stas) 2085 2086- intl: 2087 . Fixed bug #76153 (Intl compilation fails with icu4c 61.1). (Anatol) 2088 2089- ldap: 2090 . Fixed bug #76248 (Malicious LDAP-Server Response causes Crash). (Stas) 2091 2092- mbstring: 2093 . Fixed bug #75944 (Wrong cp1251 detection). (dmk001) 2094 . Fixed bug #76113 (mbstring does not build with Oniguruma 6.8.1). 2095 (chrullrich, cmb) 2096 2097- ODBC: 2098 . Fixed bug #76088 (ODBC functions are not available by default on Windows). 2099 (cmb) 2100 2101- Opcache: 2102 . Fixed bug #76094 (Access violation when using opcache). (Laruence) 2103 2104- Phar: 2105 . Fixed bug #76129 (fix for CVE-2018-5712 may not be complete). (Stas) 2106 2107- phpdbg: 2108 . Fixed bug #76143 (Memory corruption: arbitrary NUL overwrite). (Laruence) 2109 2110- SPL: 2111 . Fixed bug #76131 (mismatch arginfo for splarray constructor). 2112 (carusogabriel) 2113 2114- standard: 2115 . Fixed bug #74139 (mail.add_x_header default inconsistent with docs). (cmb) 2116 . Fixed bug #75996 (incorrect url in header for mt_rand). (tatarbj) 2117 211829 Mar 2018, PHP 7.2.4 2119 2120- Core: 2121 . Fixed bug #76025 (Segfault while throwing exception in error_handler). 2122 (Dmitry, Laruence) 2123 . Fixed bug #76044 ('date: illegal option -- -' in ./configure on FreeBSD). 2124 (Anatol) 2125 2126- FPM: 2127 . Fixed bug #75605 (Dumpable FPM child processes allow bypassing opcache 2128 access controls). (Jakub Zelenka) 2129 2130- FTP: 2131 . Fixed ftp_pasv arginfo. (carusogabriel) 2132 2133-GD: 2134 . Fixed bug #73957 (signed integer conversion in imagescale()). (cmb) 2135 . Fixed bug #76041 (null pointer access crashed php). (cmb) 2136 . Fixed imagesetinterpolation arginfo. (Gabriel Caruso) 2137 2138- iconv: 2139 . Fixed bug #75867 (Freeing uninitialized pointer). (Philip Prindeville) 2140 2141- Mbstring: 2142 . Fixed bug #62545 (wrong unicode mapping in some charsets). (cmb) 2143 2144- Opcache: 2145 . Fixed bug #75969 (Assertion failure in live range DCE due to block pass 2146 misoptimization). (Nikita) 2147 2148- OpenSSL: 2149 . Fixed openssl_* arginfos. (carusogabriel) 2150 2151- PCNTL: 2152 . Fixed bug #75873 (pcntl_wexitstatus returns incorrect on Big_Endian platform 2153 (s390x)). (Sam Ding) 2154 2155- Phar: 2156 . Fixed bug #76085 (Segmentation fault in buildFromIterator when directory 2157 name contains a \n). (Laruence) 2158 2159- Standard: 2160 . Fixed bug #75961 (Strange references behavior). (Laruence) 2161 . Fixed some arginfos. (carusogabriel) 2162 . Fixed bug #76068 (parse_ini_string fails to parse "[foo]\nbar=1|>baz" with 2163 segfault). (Anatol) 2164 216501 Mar 2018, PHP 7.2.3 2166 2167- Core: 2168 . Fixed bug #75864 ("stream_isatty" returns wrong value on s390x). (Sam Ding) 2169 2170- Apache2Handler: 2171 . Fixed bug #75882 (a simple way for segfaults in threadsafe php just with 2172 configuration). (Anatol) 2173 2174- Date: 2175 . Fixed bug #75857 (Timezone gets truncated when formatted). (carusogabriel) 2176 . Fixed bug #75928 (Argument 2 for `DateTimeZone::listIdentifiers()` should 2177 accept `null`). (Pedro Lacerda) 2178 . Fixed bug #68406 (calling var_dump on a DateTimeZone object modifies it). 2179 (jhdxr) 2180 2181- LDAP: 2182 . Fixed bug #49876 (Fix LDAP path lookup on 64-bit distros). (dzuelke) 2183 2184- libxml2: 2185 . Fixed bug #75871 (use pkg-config where available). (pmmaga) 2186 2187- PGSQL: 2188 . Fixed bug #75838 (Memory leak in pg_escape_bytea()). (ard_1 at mail dot ru) 2189 2190- Phar: 2191 . Fixed bug #54289 (Phar::extractTo() does not accept specific directories to 2192 be extracted). (bishop) 2193 . Fixed bug #65414 (deal with leading slash while adding files correctly). 2194 (bishopb) 2195 . Fixed bug #65414 (deal with leading slash when adding files correctly). 2196 (bishopb) 2197 2198- ODBC: 2199 . Fixed bug #73725 (Unable to retrieve value of varchar(max) type). (Anatol) 2200 2201- Opcache: 2202 . Fixed bug #75729 (opcache segfault when installing Bitrix). (Nikita) 2203 . Fixed bug #75893 (file_get_contents $http_response_header variable bugged 2204 with opcache). (Nikita) 2205 . Fixed bug #75938 (Modulus value not stored in variable). (Nikita) 2206 2207- SPL: 2208 . Fixed bug #74519 (strange behavior of AppendIterator). (jhdxr) 2209 2210- Standard: 2211 . Fixed bug #75916 (DNS_CAA record results contain garbage). (Mike, 2212 Philip Sharp) 2213 . Fixed bug #75981 (Prevent reading beyond buffer start in http wrapper). 2214 (Stas) 2215 221601 Feb 2018, PHP 7.2.2 2217 2218- Core: 2219 . Fixed bug #75742 (potential memleak in internal classes's static members). 2220 (Laruence) 2221 . Fixed bug #75679 (Path 260 character problem). (Anatol) 2222 . Fixed bug #75614 (Some non-portable == in shell scripts). (jdolecek) 2223 . Fixed bug #75786 (segfault when using spread operator on generator passed 2224 by reference). (Nikita) 2225 . Fixed bug #75799 (arg of get_defined_functions is optional). (carusogabriel) 2226 . Fixed bug #75396 (Exit inside generator finally results in fatal error). 2227 (Nikita) 2228 2229- FCGI: 2230 . Fixed bug #75794 (getenv() crashes on Windows 7.2.1 when second parameter is 2231 false). (Anatol) 2232 2233- IMAP: 2234 . Fixed bug #75774 (imap_append HeapCorruction). (Anatol) 2235 2236- Opcache: 2237 . Fixed bug #75720 (File cache not populated after SHM runs full). (Dmitry) 2238 . Fixed bug #75687 (var 8 (TMP) has array key type but not value type). 2239 (Nikita, Laruence) 2240 . Fixed bug #75698 (Using @ crashes php7.2-fpm). (Nikita) 2241 . Fixed bug #75579 (Interned strings buffer overflow may cause crash). 2242 (Dmitry) 2243 2244- PDO: 2245 . Fixed bug #75616 (PDO extension doesn't allow to be built shared on Darwin). 2246 (jdolecek) 2247 2248- PDO MySQL: 2249 . Fixed bug #75615 (PDO Mysql module can't be built as module). (jdolecek) 2250 2251- PGSQL: 2252 . Fixed bug #75671 (pg_version() crashes when called on a connection to 2253 cockroach). (magicaltux at gmail dot com) 2254 2255- Readline: 2256 . Fixed bug #75775 (readline_read_history segfaults with empty file). 2257 (Anatol) 2258 2259- SAPI: 2260 . Fixed bug #75735 ([embed SAPI] Segmentation fault in 2261 sapi_register_post_entry). (Laruence) 2262 2263- SOAP: 2264 . Fixed bug #70469 (SoapClient generates E_ERROR even if exceptions=1 is 2265 used). (Anton Artamonov) 2266 . Fixed bug #75502 (Segmentation fault in zend_string_release). (Nikita) 2267 2268- SPL: 2269 . Fixed bug #75717 (RecursiveArrayIterator does not traverse arrays by 2270 reference). (Nikita) 2271 . Fixed bug #75242 (RecursiveArrayIterator doesn't have constants from parent 2272 class). (Nikita) 2273 . Fixed bug #73209 (RecursiveArrayIterator does not iterate object 2274 properties). (Nikita) 2275 2276- Standard: 2277 . Fixed bug #75781 (substr_count incorrect result). (Laruence) 2278 . Fixed bug #75653 (array_values don't work on empty array). (Nikita) 2279 2280- Zip: 2281 . Display headers (buildtime) and library (runtime) versions in phpinfo 2282 (with libzip >= 1.3.1). (Remi) 2283 228404 Jan 2018, PHP 7.2.1 2285 2286- Core: 2287 . Fixed bug #75573 (Segmentation fault in 7.1.12 and 7.0.26). (Laruence) 2288 . Fixed bug #75384 (PHP seems incompatible with OneDrive files on demand). 2289 (Anatol) 2290 . Fixed bug #75525 (Access Violation in vcruntime140.dll). (Anatol) 2291 . Fixed bug #74862 (Unable to clone instance when private __clone defined). 2292 (Daniel Ciochiu) 2293 . Fixed bug #75074 (php-process crash when is_file() is used with strings 2294 longer 260 chars). (Anatol) 2295 . Fixed bug #69727 (Remove timestamps from build to make it reproducible). 2296 (jelle van der Waa) 2297 2298- CLI server: 2299 . Fixed bug #73830 (Directory does not exist). (Anatol) 2300 2301- FPM: 2302 . Fixed bug #64938 (libxml_disable_entity_loader setting is shared between 2303 requests). (Remi) 2304 2305- GD: 2306 . Fixed bug #75571 (Potential infinite loop in gdImageCreateFromGifCtx). 2307 (Christoph) 2308 2309- Opcache: 2310 . Fixed bug #75608 ("Narrowing occurred during type inference" error). 2311 (Laruence, Dmitry) 2312 . Fixed bug #75579 (Interned strings buffer overflow may cause crash). 2313 (Dmitry) 2314 . Fixed bug #75570 ("Narrowing occurred during type inference" error). 2315 (Dmitry) 2316 . Fixed bug #75681 (Warning: Narrowing occurred during type inference, 2317 specific case). (Nikita) 2318 . Fixed bug #75556 (Invalid opcode 138/1/1). (Laruence) 2319 2320- PCRE: 2321 . Fixed bug #74183 (preg_last_error not returning error code after error). 2322 (Andrew Nester) 2323 2324- Phar: 2325 . Fixed bug #74782 (remove file name from output to avoid XSS). (stas) 2326 2327- Standard: 2328 . Fixed bug #75511 (fread not free unused buffer). (Laruence) 2329 . Fixed bug #75514 (mt_rand returns value outside [$min,$max]+ on 32-bit) 2330 (Remi) 2331 . Fixed bug #75535 (Inappropriately parsing HTTP response leads to PHP 2332 segment fault). (Nikita) 2333 . Fixed bug #75409 (accept EFAULT in addition to ENOSYS as indicator 2334 that getrandom() is missing). (sarciszewski) 2335 . Fixed bug #73124 (php_ini_scanned_files() not reporting correctly). 2336 (John Stevenson) 2337 . Fixed bug #75574 (putenv does not work properly if parameter contains 2338 non-ASCII unicode character). (Anatol) 2339 2340- Zip: 2341 . Fixed bug #75540 (Segfault with libzip 1.3.1). (Remi) 2342 234330 Nov 2017, PHP 7.2.0 2344 2345- BCMath: 2346 . Fixed bug #46564 (bcmod truncates fractionals). (liborm85) 2347 2348- CLI: 2349 . Fixed bug #74849 (Process is started as interactive shell in PhpStorm). 2350 (Anatol) 2351 . Fixed bug #74979 (Interactive shell opening instead of script execution 2352 with -f flag). (Anatol) 2353 2354- CLI server: 2355 . Fixed bug #60471 (Random "Invalid request (unexpected EOF)" using a router 2356 script). (SammyK) 2357 2358- Core: 2359 . Added ZEND_COUNT, ZEND_GET_CLASS, ZEND_GET_CALLED_CLASS, ZEND_GET_TYPE, 2360 ZEND_FUNC_NUM_ARGS, ZEND_FUNC_GET_ARGS instructions, to implement 2361 corresponding builtin functions. (Dmitry) 2362 . "Countable" interface is moved from SPL to Core. (Dmitry) 2363 . Added ZEND_IN_ARRAY instruction, implementing optimized in_array() builtin 2364 function, through hash lookup in flipped array. (Dmitry) 2365 . Removed IS_TYPE_IMMUTABLE (it's the same as COPYABLE & !REFCOUNTED). (Dmitry) 2366 . Removed the sql.safe_mode directive. (Kalle) 2367 . Removed support for Netware. (Kalle) 2368 . Renamed ReflectionClass::isIterateable() to ReflectionClass::isIterable() 2369 (alias original name for BC). (Sara) 2370 . Fixed bug #54535 (WSA cleanup executes before MSHUTDOWN). (Kalle) 2371 . Implemented FR #69791 (Disallow mail header injections by extra headers) 2372 (Yasuo) 2373 . Implemented FR #49806 (proc_nice() for Windows). (Kalle) 2374 . Fix pthreads detection when cross-compiling (ffontaine) 2375 . Fixed memory leaks caused by exceptions thrown from destructors. (Bob, 2376 Dmitry). 2377 . Fixed bug #73215 (uniqid() should use better random source). (Yasuo) 2378 . Implemented FR #72768 (Add ENABLE_VIRTUAL_TERMINAL_PROCESSING flag for 2379 php.exe). (Michele Locati) 2380 . Implemented "Convert numeric keys in object/array casts" RFC, fixes 2381 bugs #53838, #61655, #66173, #70925, #72254, etc. (Andrea) 2382 . Implemented "Deprecate and Remove Bareword (Unquoted) Strings" RFC. 2383 (Rowan Collins) 2384 . Raised minimum supported Windows versions to Windows 7/Server 2008 R2. 2385 (Anatol) 2386 . Implemented minor optimization in array_keys/array_values(). (Sara) 2387 . Added PHP_OS_FAMILY constant to determine on which OS we are. (Jan Altensen) 2388 . Fixed bug #73987 (Method compatibility check looks to original 2389 definition and not parent). (pmmaga) 2390 . Fixed bug #73991 (JSON_OBJECT_AS_ARRAY not respected). (Sara) 2391 . Fixed bug #74053 (Corrupted class entries on shutdown when a destructor 2392 spawns another object). (jim at commercebyte dot com) 2393 . Fixed bug #73971 (Filename got limited to MAX_PATH on Win32 when scan 2394 directory). (Anatol) 2395 . Fixed bug #72359, bug #72451, bug #73706, bug #71115 and others related 2396 to interned strings handling in TS builds. (Anatol, Dmitry) 2397 . Implemented "Trailing Commas In List Syntax" RFC for group use lists only. 2398 (Sammy Kaye Powers) 2399 . Fixed bug #74269 (It's possible to override trait property with different 2400 loosely-equal value). (pmmaga) 2401 . Fixed bug #61970 (Restraining __construct() access level in subclass gives 2402 a fatal error). (pmmaga) 2403 . Fixed bug #63384 (Cannot override an abstract method with an abstract 2404 method). (pmmaga, wes) 2405 . Fixed bug #74607 (Traits enforce different inheritance rules). (pmmaga) 2406 . Fixed misparsing of abstract unix domain socket names. (Sara) 2407 . Change PHP_OS_FAMILY value from "OSX" to "Darwin". (Sebastian, Kalle) 2408 . Allow loading PHP/Zend extensions by name in ini files (extension=<name>). 2409 (francois at tekwire dot net) 2410 . Added object type annotation. (brzuchal) 2411 . Fixed bug #74815 (crash with a combination of INI entries at startup). 2412 (Anatol) 2413 . Fixed bug #74836 (isset on zero-prefixed numeric indexes in array broken). 2414 (Dmitry) 2415 . Added new VM instuctions ISSET_ISEMPTY_CV and UNSET_CV. Previously they 2416 were implemented as ISSET_ISEMPTY_VAR and UNSET_VAR variants with 2417 ZEND_QUICK_SET flag. (Nikita, Dmitry) 2418 . Fixed bug #49649 (unserialize() doesn't handle changes in property 2419 visibility). (pmmaga) 2420 . Fixed #74866 (extension_dir = "./ext" now use current directory for base). 2421 (Francois Laupretre) 2422 . Implemented FR #74963 (Improved error message on fetching property of 2423 non-object). (Laruence) 2424 . Fixed Bug #75142 (buildcheck.sh check for autoconf version needs to be updated 2425 for v2.64). (zizzy at zizzy dot net, Remi) 2426 . Fixed bug #74878 (Data race in ZTS builds). (Nikita, Dmitry) 2427 . Fixed bug #75515 ("stream_copy_to_stream" doesn't stream anymore). (Sara) 2428 2429- cURL: 2430 . Fixed bug #75093 (OpenSSL support not detected). (Remi) 2431 . Better fix for #74125 (use pkg-config instead of curl-config). (Remi) 2432 2433- Date: 2434 . Fixed bug #55407 (Impossible to prototype DateTime::createFromFormat). 2435 (kelunik) 2436 . Implemented FR #71520 (Adding the DateTime constants to the 2437 DateTimeInterface interface). (Majkl578) 2438 . Fixed bug #75149 (redefinition of typedefs ttinfo and t1info). (Remi) 2439 . Fixed bug #75222 (DateInterval microseconds property always 0). (jhdxr) 2440 2441- Dba: 2442 . Fixed bug #72885 (flatfile: dba_fetch() fails to read replaced entry). 2443 (Anatol) 2444 2445- DOM: 2446 . Implement #74837 (Implement Countable for DomNodeList and DOMNamedNodeMap). 2447 (Andreas Treichel) 2448 2449- EXIF: 2450 . Added support for vendor specific tags for the following formats: 2451 Samsung, DJI, Panasonic, Sony, Pentax, Minolta, Sigma/Foveon, AGFA, 2452 Kyocera, Ricoh & Epson. (Kalle) 2453 . Fixed bug #72682 (exif_read_data() fails to read all data for some 2454 images). (Kalle) 2455 . Fixed bug #71534 (Type confusion in exif_read_data() leading to heap 2456 overflow in debug mode). (hlt99 at blinkenshell dot org, Kalle) 2457 . Fixed bug #68547 (Exif Header component value check error). 2458 (sjh21a at gmail dot com, Kalle) 2459 . Fixed bug #66443 (Corrupt EXIF header: maximum directory nesting level 2460 reached for some cameras). (Kalle) 2461 . Fixed Redhat bug #1362571 (PHP not returning full results for 2462 exif_read_data function). (Kalle) 2463 . Implemented #65187 (exif_read_data/thumbnail: add support for stream 2464 resource). (Kalle) 2465 . Deprecated the read_exif_data() alias. (Kalle) 2466 . Fixed bug #74428 (exif_read_data(): "Illegal IFD size" warning occurs with 2467 correct exif format). (bradpiccho at gmail dot com, Kalle) 2468 . Fixed bug #72819 (EXIF thumbnails not read anymore). (Kalle) 2469 . Fixed bug #62523 (php crashes with segfault when exif_read_data called). 2470 (Kalle) 2471 . Fixed bug #50660 (exif_read_data(): Illegal IFD offset (works fine with 2472 other exif readers). (skinny dot bravo at gmail dot com, Kalle) 2473 2474- Fileinfo: 2475 . Upgrade bundled libmagic to 5.31. (Anatol) 2476 2477- FPM: 2478 . Configuration to limit fpm slow log trace callers. (Sannis) 2479 . Fixed bug #75212 (php_value acts like php_admin_value). (Remi) 2480 2481- FTP: 2482 . Implement MLSD for structured listing of directories. (blar) 2483 . Added ftp_append() function. (blar) 2484 2485- GD: 2486 . Implemented imageresolution as getter and setter (Christoph) 2487 . Fixed bug #74744 (gd.h: stdarg.h include missing for va_list use in 2488 gdErrorMethod). (rainer dot jung at kippdata dot de, cmb) 2489 . Fixed bug #75111 (Memory disclosure or DoS via crafted .bmp image). (cmb) 2490 2491- GMP: 2492 . Fixed bug #70896 (gmp_fact() silently ignores non-integer input). (Sara) 2493 2494- Hash: 2495 . Changed HashContext from resource to object. (Rouven Weßling, Sara) 2496 . Disallowed usage of non-cryptographic hash functions with HMAC and PBKDF2. 2497 (Andrey Andreev, Nikita) 2498 . Fixed Bug #75284 (sha3 is not supported on bigendian machine). (Remi) 2499 2500- IMAP: 2501 . Fixed bug #72324 (imap_mailboxmsginfo() return wrong size). 2502 (ronaldpoon at udomain dot com dot hk, Kalle) 2503 2504- Intl: 2505 . Fixed bug #63790 (test using Spoofchecker which may be unavailable). (Sara) 2506 . Fixed bug #75378 ([REGRESSION] IntlDateFormatter::parse() does not change 2507 $position argument). (Laruence) 2508 2509- JSON: 2510 . Add JSON_INVALID_UTF8_IGNORE and JSON_INVALID_UTF8_SUBSTITUTE options for 2511 json_encode and json_decode to ignore or replace invalid UTF-8 byte 2512 sequences - it addresses request #65082. (Jakub Zelenka) 2513 . Fixed bug #75185 (Buffer overflow in json_decode() with 2514 JSON_INVALID_UTF8_IGNORE or JSON_INVALID). (Jakub Zelenka) 2515 . Fixed bug #68567 (JSON_PARTIAL_OUTPUT_ON_ERROR can result in JSON with null 2516 key). (Jakub Zelenka) 2517 2518- LDAP: 2519 . Implemented FR #69445 (Support for LDAP EXOP operations) 2520 . Fixed support for LDAP_OPT_SERVER_CONTROLS and LDAP_OPT_CLIENT_CONTROLS in ldap_get_option 2521 . Fixed passing an empty array to ldap_set_option for client or server controls. 2522 2523- Mbstring: 2524 . Implemented request #66024 (mb_chr() and mb_ord()). (Masakielastic, Yasuo) 2525 . Implemented request #65081 (mb_scrub()). (Masakielastic, Yasuo) 2526 . Implemented request #69086 (enhancement for mb_convert_encoding() that 2527 handles multibyte replacement char nicely). (Masakielastic, Yasuo) 2528 . Added array input support to mb_convert_encoding(). (Yasuo) 2529 . Added array input support to mb_check_encoding(). (Yasuo) 2530 . Fixed bug #69079 (enhancement for mb_substitute_character). (masakielastic) 2531 . Update to oniguruma version 6.3.0. (Remi) 2532 . Fixed bug #69267 (mb_strtolower fails on titlecase characters). (Nikita) 2533 2534- Mcrypt: 2535 . The deprecated mcrypt extension has been moved to PECL. (leigh) 2536 2537- Opcache: 2538 . Added global optimisation passes based on data flow analysis using Single 2539 Static Assignment (SSA) form: Sparse Conditional Constant Propagation (SCCP), 2540 Dead Code Elimination (DCE), and removal of unused local variables 2541 (Nikita, Dmitry) 2542 . Fixed incorect constant conditional jump elimination. (Dmitry) 2543 . Fixed bug #75230 (Invalid opcode 49/1/8 using opcache). (Laruence) 2544 . Fixed bug (assertion fails with extended info generated). (Laruence) 2545 . Fixed bug (Phi sources removel). (Laruence) 2546 . Fixed bug #75370 (Webserver hangs on valid PHP text). (Laruence) 2547 . Fixed bug #75357 (segfault loading WordPress wp-admin). (Laruence) 2548 2549- OpenSSL: 2550 . Use TLS_ANY for default ssl:// and tls:// negotiation. (kelunik) 2551 . Fix leak in openssl_spki_new(). (jelle at vdwaa dot nl) 2552 . Added openssl_pkcs7_read() and pk7 parameter to openssl_pkcs7_verify(). 2553 (jelle at vdwaa dot nl) 2554 . Add ssl security_level stream option to support OpenSSL security levels. 2555 (Jakub Zelenka). 2556 . Allow setting SNI cert and private key in separate files. (Jakub Zelenka) 2557 . Fixed bug #74903 (openssl_pkcs7_encrypt() uses different EOL than before). 2558 (Anatol) 2559 . Automatically load OpenSSL configuration file. (Jakub Zelenka) 2560 2561- PCRE: 2562 . Added support for PCRE JIT fast path API. (dmitry) 2563 . Fixed bug #61780 (Inconsistent PCRE captures in match results). (cmb) 2564 . Fixed bug #74873 (Minor BC break: PCRE_JIT changes output of preg_match()). 2565 (Dmitry) 2566 . Fixed bug #75089 (preg_grep() is not reporting PREG_BAD_UTF8_ERROR after 2567 first input string). (Dmitry) 2568 . Fixed bug #75223 (PCRE JIT broken in 7.2). (Dmitry) 2569 . Fixed bug #75285 (Broken build when system libpcre don't have jit support). 2570 (Remi) 2571 2572- phar: 2573 . Fixed bug #74196 (phar does not correctly handle names containing dots). 2574 (mhagstrand) 2575 2576- PDO: 2577 . Add "Sent SQL" to debug dump for emulated prepares. (Adam Baratz) 2578 . Add parameter types for national character set strings. (Adam Baratz) 2579 2580- PDO_DBlib: 2581 . Fixed bug #73234 (Emulated statements let value dictate parameter type). 2582 (Adam Baratz) 2583 . Fixed bug #73396 (bigint columns are returned as strings). (Adam Baratz) 2584 . Expose DB-Library version as \PDO::DBLIB_ATTR_VERSION attribute on \PDO 2585 instance. (Adam Baratz) 2586 . Add test coverage for bug #72969. (Jeff Farr) 2587 2588- PDO_OCI: 2589 . Fixed Bug #74537 (Align --with-pdo-oci configure option with --with-oci8 syntax). 2590 (Tianfang Yang) 2591 2592- PDO_Sqlite 2593 . Switch to sqlite3_prepare_v2() and sqlite3_close_v2() functions (rasmus) 2594 2595- PHPDBG 2596 . Added extended_value to opcode dump output. (Sara) 2597 2598- Session: 2599 . Fixed bug #73461 (Prohibit session save handler recursion). (Yasuo) 2600 . PR #2233 Removed register_globals related code and "!" can be used as $_SESSION key name. (Yasuo) 2601 . Improved bug #73100 fix. 'user' save handler can only be set by session_set_save_handler() 2602 . Fixed bug #74514 (5 session functions incorrectly warn when calling in 2603 read-only/getter mode). (Yasuo) 2604 . Fixed bug #74936 (session_cache_expire/cache_limiter/save_path() trigger a 2605 warning in read mode). (morozov) 2606 . Fixed bug #74941 (session fails to start after having headers sent). 2607 (morozov) 2608 2609- Sodium: 2610 . New cryptographic extension 2611 . Added missing bindings for libsodium > 1.0.13. (Frank) 2612 2613- SPL: 2614 . Fixed bug #71412 (Incorrect arginfo for ArrayIterator::__construct). 2615 (tysonandre775 at hotmail dot com) 2616 . Added spl_object_id(). (Tyson Andre) 2617 2618- SQLite3: 2619 . Implement writing to blobs. (bohwaz at github dot com) 2620 . Update to Sqlite 3.20.1. (cmb) 2621 2622- Standard: 2623 . Fixed bug #69442 (closing of fd incorrect when PTS enabled). (jaytaph) 2624 . Fixed bug #74300 (unserialize accepts two plus/minus signs for float number exponent part). 2625 (xKerman) 2626 . Compatibility with libargon2 versions 20161029 and 20160821. 2627 (charlesportwoodii at erianna dot com) 2628 . Fixed Bug #74737 (mysqli_get_client_info reflection info). 2629 (mhagstrand at gmail dot com) 2630 . Add support for extension name as argument to dl(). 2631 (francois at tekwire dot net) 2632 . Fixed bug #74851 (uniqid() without more_entropy performs badly). 2633 (Emmanuel Dreyfus) 2634 . Fixed bug #74103 (heap-use-after-free when unserializing invalid array 2635 size). (Nikita) 2636 . Fixed bug #75054 (A Denial of Service Vulnerability was found when 2637 performing deserialization). (Nikita) 2638 . Fixed bug #75170 (mt_rand() bias on 64-bit machines). (Nikita) 2639 . Fixed bug #75221 (Argon2i always throws NUL at the end). (cmb) 2640 2641- Streams: 2642 . Default ssl/single_dh_use and ssl/honor_cipher_order to true. (kelunik) 2643 2644- XML: 2645 . Moved utf8_encode() and utf8_decode() to the Standard extension. (Andrea) 2646 2647- XMLRPC: 2648 . Use Zend MM for allocation in bundled libxmlrpc (Joe) 2649 2650- ZIP: 2651 . Add support for encrypted archives. (Remi) 2652 . Use of bundled libzip is deprecated, --with-libzip option is recommended. (Remi) 2653 . Fixed Bug #73803 (Reflection of ZipArchive does not show public properties). (Remi) 2654 . ZipArchive implements countable, added ZipArchive::count() method. (Remi) 2655 . Fix segfault in php_stream_context_get_option call. (Remi) 2656 . Fixed bug #75143 (new method setEncryptionName() seems not to exist 2657 in ZipArchive). (Anatol) 2658 2659- zlib: 2660 . Expose inflate_get_status() and inflate_get_read_len() functions. 2661 (Matthew Trescott) 2662
