1PHP NEWS 2||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| 3?? ??? ????, PHP 8.1.29 4 5 6 711 Apr 2024, PHP 8.1.28 8 9- Standard: 10 . Fixed bug GHSA-pc52-254m-w9w7 (Command injection via array-ish $command 11 parameter of proc_open). (CVE-2024-1874) (Jakub Zelenka) 12 . Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to 13 partial CVE-2022-31629 fix). (CVE-2024-2756) (nielsdos) 14 . Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true, 15 opening ATO risk). (CVE-2024-3096) (Jakub Zelenka) 16 1721 Dec 2023, PHP 8.1.27 18 19- Core: 20 . Fixed oss-fuzz #54325 (Use-after-free of name in var-var with malicious 21 error handler). (ilutov) 22 . Fixed oss-fuzz #64209 (In-place modification of filename in 23 php_message_handler_for_zend). (ilutov) 24 . Fixed bug GH-12758 / GH-12768 (Invalid opline in OOM handlers within 25 ZEND_FUNC_GET_ARGS and ZEND_BIND_STATIC). (Florian Engelhardt) 26 27- DOM: 28 . Fixed bug GH-12616 (DOM: Removing XMLNS namespace node results in invalid 29 default: prefix). (nielsdos) 30 31- FPM: 32 . Fixed bug GH-12705 (Segmentation fault in fpm_status_export_to_zval). 33 (Patrick Prasse) 34 35- Intl: 36 . Fixed bug GH-12635 (Test bug69398.phpt fails with ICU 74.1). (nielsdos) 37 38- LibXML: 39 . Fixed bug GH-12702 (libxml2 2.12.0 issue building from src). (nono303) 40 41- MySQLnd: 42 . Avoid using uninitialised struct. (mikhainin) 43 44- OpenSSL: 45 . Fixed bug #50713 (openssl_pkcs7_verify() may ignore untrusted CAs). 46 (Jakub Zelenka) 47 48- PCRE: 49 . Fixed bug GH-12628 (The gh11374 test fails on Alpinelinux). (nielsdos) 50 51- PGSQL: 52 . Fixed bug GH-12763 wrong argument type for pg_untrace. (degtyarov) 53 54- PHPDBG: 55 . Fixed bug GH-12675 (MEMORY_LEAK in phpdbg_prompt.c). (nielsdos) 56 57- SQLite3: 58 . Fixed bug GH-12633 (sqlite3_defensive.phpt fails with sqlite 3.44.0). 59 (SakiTakamachi) 60 61- Standard: 62 . Fix memory leak in syslog device handling. (danog) 63 . Fixed bug GH-12621 (browscap segmentation fault when configured in the 64 vhost). (nielsdos) 65 . Fixed bug GH-12655 (proc_open() does not take into account references 66 in the descriptor array). (nielsdos) 67 68- Streams: 69 . Fixed bug #79945 (Stream wrappers in imagecreatefrompng causes segfault). 70 (Jakub Zelenka) 71 72- Zip: 73 . Fixed bug GH-12661 (Inconsistency in ZipArchive::addGlob remove_path Option 74 Behavior). (Remi) 75 7623 Nov 2023, PHP 8.1.26 77 78- Core: 79 . Fixed bug GH-12468 (Double-free of doc_comment when overriding static 80 property via trait). (ilutov) 81 . Fixed segfault caused by weak references to FFI objects. (sj-i) 82 . Fixed max_execution_time: don't delete an unitialized timer. (Kévin Dunglas) 83 84- DOM: 85 . Fix registerNodeClass with abstract class crashing. (nielsdos) 86 . Add missing NULL pointer error check. (icy17) 87 . Fix validation logic of php:function() callbacks. (nielsdos) 88 89- Fiber: 90 . Fixed bug GH-11121 (ReflectionFiber segfault). (danog, trowski, bwoebi) 91 92- FPM: 93 . Fixed bug GH-9921 (Loading ext in FPM config does not register module 94 handlers). (Jakub Zelenka) 95 . Fixed bug GH-12232 (FPM: segfault dynamically loading extension without 96 opcache). (Jakub Zelenka) 97 98- Intl: 99 . Removed the BC break on IntlDateFormatter::construct which threw an 100 exception with an invalid locale. (David Carlier) 101 102- Opcache: 103 . Added warning when JIT cannot be enabled. (danog) 104 . Fixed bug GH-8143 (Crashes in zend_accel_inheritance_cache_find since 105 upgrading to 8.1.3 due to corrupt on-disk file cache). (turchanov) 106 107- OpenSSL: 108 . Fixed bug GH-12489 (Missing sigbio creation checking in openssl_cms_verify). 109 (Jakub Zelenka) 110 111- PCRE: 112 . Fixed bug GH-11374 (Backport upstream fix, Different preg_match result 113 with -d pcre.jit=0). (mvorisek) 114 115- SOAP: 116 . Fixed bug GH-12392 (Segmentation fault on SoapClient::__getTypes). 117 (nielsdos) 118 . Fixed bug #66150 (SOAP WSDL cache race condition causes Segmentation 119 Fault). (nielsdos) 120 . Fixed bug #67617 (SOAP leaves incomplete cache file on ENOSPC). (nielsdos) 121 . Fix incorrect uri check in SOAP caching. (nielsdos) 122 . Fix segfault and assertion failure with refcounted props and arrays. 123 (nielsdos) 124 . Fix potential crash with an edge case of persistent encoders. (nielsdos) 125 . Fixed bug #75306 (Memleak in SoapClient). (nielsdos) 126 127- Streams: 128 . Fixed bug #75708 (getimagesize with "&$imageinfo" fails on StreamWrappers). 129 (Jakub Zelenka) 130 131- XMLReader: 132 . Add missing NULL pointer error check. (icy17) 133 134- XMLWriter: 135 . Add missing NULL pointer error check. (icy17) 136 137- XSL: 138 . Add missing module dependency. (nielsdos) 139 . Fix validation logic of php:function() callbacks. (nielsdos) 140 14126 Oct 2023, PHP 8.1.25 142 143- Core: 144 . Fixed bug GH-12207 (memory leak when class using trait with doc block). 145 (rioderelfte) 146 . Fixed bug GH-12215 (Module entry being overwritten causes type errors in 147 ext/dom). (nielsdos) 148 . Fixed bug GH-12273 (__builtin_cpu_init check). (Freaky) 149 . Fixed bug #80092 (ZTS + preload = segfault on shutdown). (nielsdos) 150 151- CLI: 152 . Ensure a single Date header is present. (coppolafab) 153 154- CType: 155 . Fixed bug GH-11997 (ctype_alnum 5 times slower in PHP 8.1 or greater). 156 (nielsdos) 157 158- DOM: 159 . Restore old namespace reconciliation behaviour. (nielsdos) 160 . Fixed bug GH-8996 (DOMNode serialization on PHP ^8.1). (nielsdos) 161 162- Fileinfo: 163 . Fixed bug GH-11891 (fileinfo returns text/xml for some svg files). (usarise) 164 165- Filter: 166 . Fix explicit FILTER_REQUIRE_SCALAR with FILTER_CALLBACK (ilutov) 167 168- Hash: 169 . Fixed bug GH-12186 (segfault copying/cloning a finalized HashContext). 170 (MaxSem) 171 172- Intl: 173 . Fixed bug GH-12243 (segfault on IntlDateFormatter::construct). 174 (David Carlier) 175 . Fixed bug GH-12282 (IntlDateFormatter::construct should throw an exception 176 on an invalid locale). (David Carlier) 177 178- MySQLnd: 179 . Fixed bug GH-12297 (PHP Startup: Invalid library (maybe not a PHP library) 180 'mysqlnd.so' in Unknown on line). (nielsdos) 181 182- Opcache: 183 . Fixed opcache_invalidate() on deleted file. (mikhainin) 184 . Fixed bug GH-12380 (JIT+private array property access inside closure 185 accesses private property in child class). (nielsdos) 186 187- PCRE: 188 . Fixed bug GH-11956 (Backport upstream fix, PCRE regular expressions with 189 JIT enabled gives different result). (nielsdos) 190 191- SimpleXML: 192 . Fixed bug GH-12170 (Can't use xpath with comments in SimpleXML). (nielsdos) 193 . Fixed bug GH-12223 (Entity reference produces infinite loop in 194 var_dump/print_r). (nielsdos) 195 . Fixed bug GH-12167 (Unable to get processing instruction contents in 196 SimpleXML). (nielsdos) 197 . Fixed bug GH-12169 (Unable to get comment contents in SimpleXML). 198 (nielsdos) 199 200- Streams: 201 . Fixed bug GH-12190 (binding ipv4 address with both address and port at 0). 202 (David Carlier) 203 204- XML: 205 . Fix return type of stub of xml_parse_into_struct(). (nielsdos) 206 . Fix memory leak when calling xml_parse_into_struct() twice. (nielsdos) 207 208- XSL: 209 . Fix type error on XSLTProcessor::transformToDoc return value with 210 SimpleXML. (nielsdos) 211 212- Sockets: 213 . Fix socket_export_stream() with wrong protocol (twosee) 214 21528 Sep 2023, PHP 8.1.24 216 217- Core: 218 . Fixed bug GH-11937 (Constant ASTs containing objects). (ilutov) 219 . Fixed bug GH-11790 (On riscv64 require libatomic if actually needed). 220 (Jeremie Courreges-Anglas) 221 . Fixed bug GH-12073 (Segfault when freeing incompletely initialized 222 closures). (ilutov) 223 . Fixed bug GH-12060 (Internal iterator rewind handler is called twice). 224 (ju1ius) 225 . Fixed bug GH-12102 (Incorrect compile error when using array access on TMP 226 value in function call). (ilutov) 227 228- DOM: 229 . Fix memory leak when setting an invalid DOMDocument encoding. (nielsdos) 230 231- Iconv: 232 . Fixed build for NetBSD which still uses the old iconv signature. 233 (David Carlier) 234 235- Intl: 236 . Fixed bug GH-12020 (intl_get_error_message() broken after 237 MessageFormatter::formatMessage() fails). (Girgias) 238 239- MySQLnd: 240 . Fixed bug GH-10270 (Invalid error message when connection via SSL fails: 241 "trying to connect via (null)"). (Kamil Tekiela) 242 243- ODBC: 244 . Fixed memory leak with failed SQLPrepare. (NattyNarwhal) 245 . Fixed persistent procedural ODBC connections not getting closed. 246 (NattyNarwhal) 247 248- SimpleXML: 249 . Fixed bug #52751 (XPath processing-instruction() function is not 250 supported). (nielsdos) 251 252- SPL: 253 . Fixed bug GH-11972 (RecursiveCallbackFilterIterator regression in 8.1.18). 254 (nielsdos) 255 256- SQLite3: 257 . Fixed bug GH-11878 (SQLite3 callback functions cause a memory leak with 258 a callable array). (nielsdos, arnaud-lb) 259 26031 Aug 2023, PHP 8.1.23 261 262- CLI: 263 . Fixed bug GH-11716 (cli server crashes on SIGINT when compiled with 264 ZEND_RC_DEBUG=1). (nielsdos) 265 . Fixed bug GH-10964 (Improve man page about the built-in server). 266 (Alexandre Daubois) 267 268- Core: 269 . Fixed strerror_r detection at configuration time. (Kévin Dunglas) 270 271- Date: 272 . Fixed bug GH-11416: Crash with DatePeriod when uninitialised objects 273 are passed in. (Derick) 274 275- DOM: 276 . Fix DOMEntity field getter bugs. (nielsdos) 277 . Fix incorrect attribute existence check in DOMElement::setAttributeNodeNS. 278 (nielsdos) 279 . Fix DOMCharacterData::replaceWith() with itself. (nielsdos) 280 . Fix empty argument cases for DOMParentNode methods. (nielsdos) 281 . Fixed bug GH-11791 (Wrong default value of DOMDocument::xmlStandalone). 282 (nielsdos) 283 . Fix json_encode result on DOMDocument. (nielsdos) 284 . Fix manually calling __construct() on DOM classes. (nielsdos) 285 . Fixed bug GH-11830 (ParentNode methods should perform their checks 286 upfront). (nielsdos) 287 . Fix segfault when DOMParentNode::prepend() is called when the child 288 disappears. (nielsdos) 289 290- FFI: 291 . Fix leaking definitions when using FFI::cdef()->new(...). (ilutov) 292 293- MySQLnd: 294 . Fixed bug GH-11440 (authentication to a sha256_password account fails over 295 SSL). (nielsdos) 296 . Fixed bug GH-11438 (mysqlnd fails to authenticate with sha256_password 297 accounts using passwords longer than 19 characters). 298 (nielsdos, Kamil Tekiela) 299 . Fixed bug GH-11550 (MySQL Statement has a empty query result when 300 the response field has changed, also Segmentation fault). 301 (Yurunsoft) 302 . Fixed invalid error message "Malformed packet" when connection is dropped. 303 (Kamil Tekiela) 304 305- Opcache: 306 . Fixed bug GH-11715 (opcache.interned_strings_buffer either has no effect or 307 opcache_get_status() / phpinfo() is wrong). (nielsdos) 308 . Avoid adding an unnecessary read-lock when loading script from shm if 309 restart is in progress. (mikhainin) 310 311- PCNTL: 312 . Revert behaviour of receiving SIGCHLD signals back to the behaviour 313 before 8.1.22. (nielsdos) 314 315- SPL: 316 . Fixed bug #81992 (SplFixedArray::setSize() causes use-after-free). 317 (nielsdos) 318 319- Standard: 320 . Prevent int overflow on $decimals in number_format. (Marc Bennewitz) 321 . Fixed bug GH-11870 (Fix off-by-one bug when truncating tempnam prefix) 322 (athos-ribeiro) 323 32403 Aug 2023, PHP 8.1.22 325 326- Build: 327 . Fixed bug GH-11522 (PHP version check fails with '-' separator). 328 (SVGAnimate) 329 330- CLI: 331 . Fix interrupted CLI output causing the process to exit. (nielsdos) 332 333- Core: 334 . Fixed oss-fuzz #60011 (Mis-compilation of by-reference nullsafe operator). 335 (ilutov) 336 . Fixed use-of-uninitialized-value with ??= on assert. (ilutov) 337 . Fixed build for FreeBSD before the 11.0 releases. (David Carlier) 338 339- Curl: 340 . Fix crash when an invalid callback function is passed to 341 CURLMOPT_PUSHFUNCTION. (nielsdos) 342 343- Date: 344 . Fixed bug GH-11368 (Date modify returns invalid datetime). (Derick) 345 346- DOM: 347 . Fixed bug GH-11625 (DOMElement::replaceWith() doesn't replace node with 348 DOMDocumentFragment but just deletes node or causes wrapping <></> 349 depending on libxml2 version). (nielsdos) 350 351- Fileinfo: 352 . Fixed bug GH-11298 (finfo returns wrong mime type for xz files). (Anatol) 353 354- FTP: 355 . Fix context option check for "overwrite". (JonasQuinten) 356 . Fixed bug GH-10562 (Memory leak and invalid state with consecutive 357 ftp_nb_fget). (nielsdos) 358 359- GD: 360 . Fix most of the external libgd test failures. (Michael Orlitzky) 361 362- Hash: 363 . Fix use-of-uninitialized-value in hash_pbkdf2(), fix missing $options 364 parameter in signature. (ilutov) 365 366- Intl: 367 . Fix memory leak in MessageFormatter::format() on failure. (Girgias) 368 369- Libxml: 370 . Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading 371 in XML without enabling it). (CVE-2023-3823) (nielsdos, ilutov) 372 373- MBString: 374 . Fix GH-11300 (license issue: restricted unicode license headers). 375 (nielsdos) 376 377- Opcache: 378 . Fixed bug GH-10914 (OPCache with Enum and Callback functions results in 379 segmentation fault). (nielsdos) 380 . Prevent potential deadlock if accelerated globals cannot be allocated. 381 (nielsdos) 382 383- PCNTL: 384 . Fixed bug GH-11498 (SIGCHLD is not always returned from proc_open). 385 (nielsdos) 386 387- PCRE: 388 . Mangle PCRE regex cache key with JIT option. (mvorisek) 389 390- PDO: 391 . Fix GH-11587 (After php8.1, when PDO::ATTR_EMULATE_PREPARES is true 392 and PDO::ATTR_STRINGIFY_FETCHES is true, decimal zeros are no longer 393 filled). (SakiTakamachi) 394 395- PDO SQLite: 396 . Fix GH-11492 (Make test failure: ext/pdo_sqlite/tests/bug_42589.phpt). 397 (KapitanOczywisty, CViniciusSDias) 398 399- Phar: 400 . Add missing check on EVP_VerifyUpdate() in phar util. (nielsdos) 401 . Fixed bug GHSA-jqcx-ccgc-xwhv (Buffer mismanagement in phar_dir_read()). 402 (CVE-2023-3824) (nielsdos) 403 404- PHPDBG: 405 . Fixed bug GH-9669 (phpdbg -h options doesn't list the -z option). (adsr) 406 407- Session: 408 . Removed broken url support for transferring session ID. (ilutov) 409 410- Standard: 411 . Fix serialization of RC1 objects appearing in object graph twice. (ilutov) 412 413- SQLite3: 414 . Fix replaced error handling in SQLite3Stmt::__construct. (nielsdos) 415 41606 Jul 2023, PHP 8.1.21 417 418- CLI: 419 . Fixed bug GH-11246 (cli/get_set_process_title fails on MacOS). 420 (James Lucas) 421 422- Core: 423 . Fixed build for the riscv64 architecture/GCC 12. (Daniil Gentili) 424 425- Curl: 426 . Fixed bug GH-11433 (Unable to set CURLOPT_ACCEPT_ENCODING to NULL). 427 (nielsdos) 428 429- DOM: 430 . Fixed bugs GH-11288 and GH-11289 and GH-11290 and GH-9142 (DOMExceptions 431 and segfaults with replaceWith). (nielsdos) 432 . Fixed bug GH-10234 (Setting DOMAttr::textContent results in an empty 433 attribute value). (nielsdos) 434 . Fix return value in stub file for DOMNodeList::item. (divinity76) 435 . Fix spec compliance error with '*' namespace for 436 DOMDocument::getElementsByTagNameNS. (nielsdos) 437 . Fix DOMElement::append() and DOMElement::prepend() hierarchy checks. 438 (nielsdos) 439 . Fixed bug GH-11347 (Memory leak when calling a static method inside an 440 xpath query). (nielsdos) 441 . Fixed bug #67440 (append_node of a DOMDocumentFragment does not reconcile 442 namespaces). (nielsdos) 443 . Fixed bug #81642 (DOMChildNode::replaceWith() bug when replacing a node 444 with itself). (nielsdos) 445 . Fixed bug #77686 (Removed elements are still returned by getElementById). 446 (nielsdos) 447 . Fixed bug #70359 (print_r() on DOMAttr causes Segfault in 448 php_libxml_node_free_list()). (nielsdos) 449 . Fixed bug #78577 (Crash in DOMNameSpace debug info handlers). (nielsdos) 450 . Fix lifetime issue with getAttributeNodeNS(). (nielsdos) 451 . Fix "invalid state error" with cloned namespace declarations. (nielsdos) 452 . Fixed bug #55294 and #47530 and #47847 (various namespace reconciliation 453 issues). (nielsdos) 454 . Fixed bug #80332 (Completely broken array access functionality with 455 DOMNamedNodeMap). (nielsdos) 456 457- Opcache: 458 . Fix allocation loop in zend_shared_alloc_startup(). (nielsdos) 459 . Access violation on smm_shared_globals with ALLOC_FALLBACK. (KoudelkaB) 460 . Fixed bug GH-11336 (php still tries to unlock the shared memory ZendSem 461 with opcache.file_cache_only=1 but it was never locked). (nielsdos) 462 463- OpenSSL: 464 . Fixed bug GH-9356 Incomplete validation of IPv6 Address fields in 465 subjectAltNames (James Lucas, Jakub Zelenka). 466 467- PGSQL: 468 . Fixed intermittent segfault with pg_trace. (David Carlier) 469 470- Phar: 471 . Fix cross-compilation check in phar generation for FreeBSD. (peter279k) 472 473- SPL: 474 . Fixed bug GH-11338 (SplFileInfo empty getBasename with more than one 475 slash). (nielsdos) 476 477- Standard: 478 . Fix access on NULL pointer in array_merge_recursive(). (ilutov) 479 . Fix exception handling in array_multisort(). (ilutov) 480 48108 Jun 2023, PHP 8.1.20 482 483- Core: 484 . Fixed bug GH-9068 (Conditional jump or move depends on uninitialised 485 value(s)). (nielsdos) 486 . Fixed bug GH-11189 (Exceeding memory limit in zend_hash_do_resize leaves 487 the array in an invalid state). (Bob) 488 . Fixed bug GH-11222 (foreach by-ref may jump over keys during a rehash). 489 (Bob) 490 491- Date: 492 . Fixed bug GH-11281 (DateTimeZone::getName() does not include seconds in 493 offset). (nielsdos) 494 495- Exif: 496 . Fixed bug GH-10834 (exif_read_data() cannot read smaller stream wrapper 497 chunk sizes). (nielsdos) 498 499- FPM: 500 . Fixed bug GH-10461 (PHP-FPM segfault due to after free usage of 501 child->ev_std(out|err)). (Jakub Zelenka) 502 . Fixed bug #64539 (FPM status page: query_string not properly JSON encoded). 503 (Jakub Zelenka) 504 . Fixed memory leak for invalid primary script file handle. (Jakub Zelenka) 505 506- Hash: 507 . Fixed bug GH-11180 (hash_file() appears to be restricted to 3 arguments). 508 (nielsdos) 509 510- LibXML: 511 . Fixed bug GH-11160 (Few tests failed building with new libxml 2.11.0). 512 (nielsdos) 513 514- Opcache: 515 . Fixed bug GH-11134 (Incorrect match default branch optimization). (ilutov) 516 . Fixed too wide OR and AND range inference. (nielsdos) 517 . Fixed bug GH-11245 (In some specific cases SWITCH with one default 518 statement will cause segfault). (nielsdos) 519 520- PGSQL: 521 . Fixed parameter parsing of pg_lo_export(). (kocsismate) 522 523- Phar: 524 . Fixed bug GH-11099 (Generating phar.php during cross-compile can't be 525 done). (peter279k) 526 527- Soap: 528 . Fixed bug GHSA-76gg-c692-v2mw (Missing error check and insufficient random 529 bytes in HTTP Digest authentication for SOAP). 530 (CVE-2023-3247) (nielsdos, timwolla) 531 . Fixed bug GH-8426 (make test fail while soap extension build). (nielsdos) 532 533- SPL: 534 . Fixed bug GH-11178 (Segmentation fault in spl_array_it_get_current_data 535 (PHP 8.1.18)). (nielsdos) 536 537- Standard: 538 . Fixed bug GH-11138 (move_uploaded_file() emits open_basedir warning for 539 source file). (ilutov) 540 . Fixed bug GH-11274 (POST/PATCH request switches to GET after a HTTP 308 541 redirect). (nielsdos) 542 543- Streams: 544 . Fixed bug GH-10031 ([Stream] STREAM_NOTIFY_PROGRESS over HTTP emitted 545 irregularly for last chunk of data). (nielsdos) 546 . Fixed bug GH-11175 (Stream Socket Timeout). (nielsdos) 547 . Fixed bug GH-11177 (ASAN UndefinedBehaviorSanitizer when timeout = -1 548 passed to stream_socket_accept/stream_socket_client). (nielsdos) 549 55011 May 2023, PHP 8.1.19 551 552- Core: 553 . Fix inconsistent float negation in constant expressions. (ilutov) 554 . Fixed bug GH-8841 (php-cli core dump calling a badly formed function). 555 (nielsdos) 556 . Fixed bug GH-10737 (PHP 8.1.16 segfaults on line 597 of 557 sapi/apache2handler/sapi_apache2.c). (nielsdos, ElliotNB) 558 . Fixed bug GH-11028 (Heap Buffer Overflow in zval_undefined_cv.). (nielsdos) 559 . Fixed bug GH-11108 (Incorrect CG(memoize_mode) state after bailout in ??=). 560 (ilutov) 561 562- DOM: 563 . Fixed bug #80602 (Segfault when using DOMChildNode::before()). 564 (Nathan Freeman) 565 . Fixed incorrect error handling in dom_zvals_to_fragment(). (nielsdos) 566 567- Exif: 568 . Fixed bug GH-9397 (exif read : warnings and errors : Potentially invalid 569 endianess, Illegal IFD size and Undefined index). (nielsdos) 570 571- Intl: 572 . Fixed bug GH-11071 (TZData version not displayed anymore). (Remi) 573 574- PCRE: 575 . Fixed bug GH-10968 (Segfault in preg_replace_callback_array()). (ilutov) 576 577- Standard: 578 . Fixed bug GH-10990 (mail() throws TypeError after iterating over 579 $additional_headers array by reference). (nielsdos) 580 . Fixed bug GH-9775 (Duplicates returned by array_unique when using enums). 581 (ilutov) 582 58313 Apr 2023, PHP 8.1.18 584 585- Core: 586 . Added optional support for max_execution_time in ZTS/Linux builds 587 (Kévin Dunglas) 588 . Fixed use-after-free in recursive AST evaluation. (ilutov) 589 . Fixed bug GH-8646 (Memory leak PHP FPM 8.1). (nielsdos) 590 . Fixed bug GH-10801 (Named arguments in CTE functions cause a segfault). 591 (nielsdos) 592 . Fixed bug GH-8789 (PHP 8.0.20 (ZTS) zend_signal_handler_defer crashes on 593 apache). (nielsdos) 594 . Fixed bug GH-10015 (zend_signal_handler_defer crashes on apache shutdown). 595 (nielsdos) 596 . Fixed bug GH-10810 (Fix NUL byte terminating Exception::__toString()). 597 (ilutov) 598 . Fix potential memory corruption when mixing __callStatic() and FFI. (ilutov) 599 600- Date: 601 . Fixed bug GH-10583 (DateTime modify with tz pattern should not update 602 linked timezone). (Derick) 603 604- FPM: 605 . Fixed bug GH-10611 (fpm_env_init_main leaks environ). (nielsdos) 606 . Destroy file_handle in fpm_main. (Jakub Zelenka, nielsdos) 607 . Fixed bug #74129 (Incorrect SCRIPT_NAME with apache ProxyPassMatch when 608 spaces are in path). (Jakub Zelenka) 609 610- FTP: 611 . Propagate success status of ftp_close(). (nielsdos) 612 . Fixed bug GH-10521 (ftp_get/ftp_nb_get resumepos offset is maximum 10GB). 613 (nielsdos) 614 615- IMAP: 616 . Fix build failure with Clang 16. (orlitzky) 617 618- MySQLnd: 619 . Fixed bug GH-8979 (Possible Memory Leak with SSL-enabled MySQL 620 connections). (nielsdos) 621 622- Opcache: 623 . Fixed build for macOS to cater with pkg-config settings. (David Carlier) 624 . Fixed bug GH-8065 (opcache.consistency_checks > 0 causes segfaults in 625 PHP >= 8.1.5 in fpm context). (nielsdos) 626 627- OpenSSL: 628 . Add missing error checks on file writing functions. (nielsdos) 629 630- PDO Firebird: 631 . Fixed bug GH-10908 (Bus error with PDO Firebird on RPI with 64 bit kernel 632 and 32 bit userland). (nielsdos) 633 634- PDO ODBC: 635 . Fixed missing and inconsistent error checks on SQLAllocHandle. (nielsdos) 636 637- Phar: 638 . Fixed bug GH-10766 (PharData archive created with Phar::Zip format does 639 not keep files metadata (datetime)). (nielsdos) 640 . Add missing error checks on EVP_MD_CTX_create() and EVP_VerifyInit(). 641 (nielsdos) 642 643- PGSQL: 644 . Fixed typo in the array returned from pg_meta_data (extended mode). 645 (David Carlier) 646 647- SPL: 648 . Fixed bug GH-10519 (Array Data Address Reference Issue). (Nathan Freeman) 649 . Fixed bug GH-10844 (ArrayIterator allows modification of readonly props). 650 (ilutov) 651 652- Standard: 653 . Fixed bug GH-10885 (stream_socket_server context leaks). (ilutov) 654 . Fixed bug GH-10052 (Browscap crashes PHP 8.1.12 on request shutdown 655 (apache2)). (nielsdos) 656 . Fixed oss-fuzz #57392 (Buffer-overflow in php_fgetcsv() with \0 delimiter 657 and enclosure). (ilutov) 658 . Fixed undefined behaviour in unpack(). (nielsdos) 659 66016 Mar 2023, PHP 8.1.17 661 662- Core: 663 . Fixed incorrect check condition in ZEND_YIELD. (nielsdos) 664 . Fixed incorrect check condition in type inference. (nielsdos) 665 . Fixed overflow check in OnUpdateMemoryConsumption. (nielsdos) 666 . Fixed bug GH-9916 (Entering shutdown sequence with a fiber suspended in a 667 Generator emits an unavoidable fatal error or crashes). (Arnaud) 668 . Fixed bug GH-10437 (Segfault/assertion when using fibers in shutdown 669 function after bailout). (trowski) 670 . Fixed SSA object type update for compound assignment opcodes. (nielsdos) 671 . Fixed language scanner generation build. (Daniel Black) 672 . Fixed zend_update_static_property() calling zend_update_static_property_ex() 673 misleadingly with the wrong return type. (nielsdos) 674 . Fix bug GH-10570 (Fixed unknown string hash on property fetch with integer 675 constant name). (nielsdos) 676 . Fixed php_fopen_primary_script() call resulted on zend_destroy_file_handle() 677 freeing dangling pointers on the handle as it was uninitialized. (nielsdos) 678 679- Curl: 680 . Fixed deprecation warning at compile time. (Max Kellermann) 681 . Fixed bug GH-10270 (Unable to return CURL_READFUNC_PAUSE in readfunc 682 callback). (Pierrick Charron) 683 684- Date: 685 . Fix GH-10447 ('p' format specifier does not yield 'Z' for 00:00). (Derick) 686 687- FFI: 688 . Fixed incorrect bitshifting and masking in ffi bitfield. (nielsdos) 689 690- Fiber: 691 . Fixed assembly on alpine x86. (nielsdos) 692 . Fixed bug GH-10496 (segfault when garbage collector is invoked inside of 693 fiber). (Bob, Arnaud) 694 695- FPM: 696 . Fixed bug GH-10315 (FPM unknown child alert not valid). (Jakub Zelenka) 697 . Fixed bug GH-10385 (FPM successful config test early exit). (nielsdos) 698 699- Intl: 700 . Fixed bug GH-10647 (Spoolchecker isSuspicious/areConfusable methods 701 error code's argument always returning NULL0. (Nathan Freeman) 702 703- JSON: 704 . Fixed JSON scanner and parser generation build. 705 (Daniel Black, Jakub Zelenka) 706 707- MBString: 708 . ext/mbstring: fix new_value length check. (Max Kellermann) 709 . Fix bug GH-10627 (mb_convert_encoding crashes PHP on Windows). (nielsdos) 710 711- Opcache: 712 . Fix incorrect page_size check. (nielsdos) 713 . Fix readonly modification check when using inc/dec operators on readonly 714 property with JIT. (ilutov) 715 716- OpenSSL: 717 . Fixed php_openssl_set_server_dh_param() DH params errors handling. (nielsdos) 718 719- PDO OCI: 720 . Fixed bug #60994 (Reading a multibyte CLOB caps at 8192 chars). 721 (Michael Voříšek) 722 723- PHPDBG: 724 . Fixed bug GH-10715 (heap buffer overflow on --run option misuse). (nielsdos) 725 726- PGSQL: 727 . Fix GH-10672 (pg_lo_open segfaults in the strict_types mode). (girgias) 728 729- Phar: 730 . Fix incorrect check in phar tar parsing. (nielsdos) 731 732- Reflection: 733 . Fixed bug GH-10623 (Reflection::getClosureUsedVariables opcode fix with 734 variadic arguments). (nielsdos) 735 . Fix Segfault when using ReflectionFiber suspended by an internal function. 736 (danog) 737 738- Session: 739 . Fixed ps_files_cleanup_dir() on failure code paths with -1 instead of 0 as 740 the latter was considered success by callers. (nielsdos). 741 742- Standard: 743 . Fixed bug GH-10292 (Made the default value of the first param of srand() and 744 mt_srand() unknown). (kocsismate) 745 . Fix incorrect check in cs_8559_5 in map_from_unicode(). (nielsdos) 746 . Fix bug GH-9697 for reset/end/next/prev() attempting to move pointer of 747 properties table for certain internal classes such as FFI classes 748 . Fix incorrect error check in browsecap for pcre2_match(). (nielsdos) 749 750- Tidy: 751 . Fix memory leaks when attempting to open a non-existing file or a file over 752 4GB. (Girgias) 753 . Add missing error check on tidyLoadConfig. (nielsdos) 754 755- Zlib: 756 . Fixed output_handler directive value's length which counted the string 757 terminator. (nieldos) 758 75914 Feb 2023, PHP 8.1.16 760 761- Core: 762 . Fixed bug #81744 (Password_verify() always return true with some hash). 763 (CVE-2023-0567). (Tim Düsterhus) 764 . Fixed bug #81746 (1-byte array overrun in common path resolve code). 765 (CVE-2023-0568). (Niels Dossche) 766 767- SAPI: 768 . Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart 769 request body). (CVE-2023-0662) (Jakub Zelenka) 770 77102 Feb 2023, PHP 8.1.15 772 773- Apache: 774 . Fixed bug GH-9949 (Partial content on incomplete POST request). (cmb) 775 776- Core: 777 . Fixed bug GH-10072 (PHP crashes when execute_ex is overridden and a __call 778 trampoline is used from internal code). (Derick) 779 . Fix GH-10251 (Assertion `(flag & (1<<3)) == 0' failed). (nielsdos) 780 . Fix wrong comparison in block optimisation pass after opcode update. (nieldsdos) 781 . Fix GH-10248 (Assertion `!(zval_get_type(&(*(property))) == 10)' failed). 782 (nielsdos) 783 784- Date: 785 . Fixed bug GH-9891 (DateTime modify with unixtimestamp (@) must work like 786 setTimestamp). (Derick) 787 . Fixed bug GH-10218 (DateTimeZone fails to parse time zones that contain the 788 "+" character). (Derick) 789 790- Fiber: 791 . Fix assertion on stack allocation size. (nielsdos) 792 793- FPM: 794 . Fixed bug GH-9981 (FPM does not reset fastcgi.error_header). 795 (Jakub Zelenka) 796 . Fixed bug #67244 (Wrong owner:group for listening unix socket). 797 (Jakub Zelenka) 798 799- Hash: 800 . Handle exceptions from __toString in XXH3's initialization (nielsdos) 801 802- LDAP: 803 . Fixed bug GH-10112 (LDAP\Connection::__construct() refers to ldap_create()). 804 (cmb) 805 806- MBString: 807 . Fixed: mb_strlen (and a couple of other mbstring functions) would wrongly treat 0x80, 0xFD, 0xFE, 0xFF, and certain other byte values as the first byte of a 2-byte SJIS character. (Alex Dowad) 808 809- Opcache: 810 . Fix inverted bailout value in zend_runtime_jit() (Max Kellermann). 811 . Fix access to uninitialized variable in accel_preload(). (nielsdos) 812 . Fix zend_jit_find_trace() crashes. (Max Kellermann) 813 . Added missing lock for EXIT_INVALIDATE in zend_jit_trace_exit. (Max Kellermann) 814 815- Phar: 816 . Fix wrong flags check for compression method in phar_object.c (nielsdos) 817 818- PHPDBG: 819 . Fix undefined behaviour in phpdbg_load_module_or_extension(). (nielsdos) 820 . Fix NULL pointer dereference in phpdbg_create_conditional_breal(). (nielsdos) 821 . Fix GH-9710: phpdbg memory leaks by option "-h" (nielsdos) 822 . Fix phpdbg segmentation fault in case of malformed input (nielsdos) 823 824- Posix: 825 . Fix memory leak in posix_ttyname() (girgias) 826 827- Standard: 828 . Fix GH-10187 (Segfault in stripslashes() with arm64). (nielsdos) 829 . Fix substr_replace with slots in repl_ht being UNDEF. (nielsdos) 830 831- TSRM: 832 . Fixed Windows shmget() wrt. IPC_PRIVATE. (Tyson Andre) 833 834- XMLWriter 835 . Fix missing check for xmlTextWriterEndElement (nielsdos) 836 83705 Jan 2023, PHP 8.1.14 838 839- Core: 840 . Fixed bug GH-9905 (constant() behaves inconsistent when class is undefined). 841 (cmb) 842 . Fixed bug GH-9918 (License information for xxHash is not included in 843 README.REDIST.BINS file). (Akama Hitoshi) 844 . Fixed bug GH-9650 (Can't initialize heap: [0x000001e7]). (Michael Voříšek) 845 . Fixed potentially undefined behavior in Windows ftok(3) emulation. (cmb) 846 847- Date: 848 . Fixed bug GH-9699 (DateTimeImmutable::diff differences in 8.1.10 onwards - 849 timezone related). (Derick) 850 . Fixed bug GH-9700 (DateTime::createFromFormat: Parsing TZID string is too 851 greedy). (Derick) 852 . Fixed bug GH-9866 (Time zone bug with \DateTimeInterface::diff()). (Derick) 853 . Fixed bug GH-9880 (DateTime diff returns wrong sign on day count when using 854 a timezone). (Derick) 855 856- FPM: 857 . Fixed bug GH-9959 (Solaris port event mechanism is still broken after bug 858 #66694). (Petr Sumbera) 859 . Fixed bug #68207 (Setting fastcgi.error_header can result in a WARNING). 860 (Jakub Zelenka) 861 . Fixed bug GH-8517 (Random crash of FPM master process in 862 fpm_stdio_child_said). (Jakub Zelenka) 863 864- MBString: 865 . Fixed bug GH-9535 (The behavior of mb_strcut in mbstring has been changed in 866 PHP8.1). (Nathan Freeman) 867 868- Opcache: 869 . Fixed bug GH-9968 (Segmentation Fault during OPCache Preload). 870 (Arnaud, michdingpayc) 871 872- OpenSSL: 873 . Fixed bug GH-9064 (PHP fails to build if openssl was built with --no-ec). 874 (Jakub Zelenka) 875 . Fixed bug GH-10000 (OpenSSL test failures when OpenSSL compiled with 876 no-dsa). (Jakub Zelenka) 877 878- Pcntl: 879 . Fixed bug GH-9298 (Signal handler called after rshutdown leads to crash). 880 (Erki Aring) 881 882- PDO_Firebird: 883 . Fixed bug GH-9971 (Incorrect NUMERIC value returned from PDO_Firebird). 884 (cmb) 885 886- PDO/SQLite: 887 . Fixed bug #81740 (PDO::quote() may return unquoted string). (CVE-2022-31631) 888 (cmb) 889 890- Session: 891 . Fixed GH-9932 (session name silently fails with . and [). (David Carlier) 892 893- SPL: 894 . Fixed GH-9883 (SplFileObject::__toString() reads next line). (Girgias) 895 . Fixed GH-10011 (Trampoline autoloader will get reregistered and cannot be 896 unregistered). (Girgias) 897 898- SQLite3: 899 . Fixed bug #81742 (open_basedir bypass in SQLite3 by using file URI). (cmb) 900 90124 Nov 2022, PHP 8.1.13 902 903- CLI: 904 . Fixed bug GH-9709 (Null pointer dereference with -w/-s options). (Adam Saponara) 905 906- Core: 907 . Fixed bug GH-9752 (Generator crashes when interrupted during argument 908 evaluation with extra named params). (Arnaud) 909 . Fixed bug GH-9801 (Generator crashes when memory limit is exceeded during 910 initialization). (Arnaud) 911 . Fixed potential NULL pointer dereference Windows shm*() functions. (cmb) 912 . Fixed bug GH-9750 (Generator memory leak when interrupted during argument 913 evaluation. (Arnaud) 914 915- Date: 916 . Fixed bug GH-9763 (DateTimeZone ctr mishandles input and adds null byte if 917 the argument is an offset larger than 100*60 minutes). (Derick) 918 919- FPM: 920 . Fixed bug GH-9754 (SaltStack (using Python subprocess) hangs when running 921 php-fpm 8.1.11). (Jakub Zelenka) 922 923- mysqli: 924 . Fixed bug GH-9841 (mysqli_query throws warning despite using 925 silenced error mode). (Kamil Tekiela) 926 927- MySQLnd: 928 . Fixed potential heap corruption due to alignment mismatch. (cmb) 929 930- OpenSSL: 931 . Fixed bug GH-8430 (OpenSSL compiled with no-md2, no-md4 or no-rmd160 does 932 not build). (Jakub Zelenka, fsbruva) 933 934- SOAP: 935 . Fixed GH-9720 (Null pointer dereference while serializing the response). 936 (cmb) 937 93827 Oct 2022, PHP 8.1.12 939 940- Core: 941 . Fixes segfault with Fiber on FreeBSD i386 architecture. (David Carlier) 942 943- Fileinfo: 944 . Fixed bug GH-8805 (finfo returns wrong mime type for woff/woff2 files). 945 (Anatol) 946 947- GD: 948 . Fixed bug #81739: OOB read due to insufficient input validation in 949 imageloadfont(). (CVE-2022-31630) (cmb) 950 951- Hash: 952 . Fixed bug #81738: buffer overflow in hash_update() on long parameter. 953 (CVE-2022-37454) (nicky at mouha dot be) 954 955- MBString: 956 - Fixed bug GH-9683 (Problem when ISO-2022-JP-MS is specified in 957 mb_ encode_mimeheader). (Alex Dowad) 958 959- Opcache: 960 . Added indirect call reduction for jit on x86 architectures. (wxue1) 961 962- Session: 963 . Fixed bug GH-9583 (session_create_id() fails with user defined save handler 964 that doesn't have a validateId() method). (Girgias) 965 966- Streams: 967 . Fixed bug GH-9590 (stream_select does not abort upon exception or empty 968 valid fd set). (Arnaud) 969 97029 Sep 2022, PHP 8.1.11 971 972- Core: 973 . Fixed bug GH-9323 (Crash in ZEND_RETURN/GC/zend_call_function) 974 (Tim Starling) 975 . Fixed bug GH-9361 (Segmentation fault on script exit #9379). (cmb, 976 Christian Schneider) 977 . Fixed bug GH-9447 (Invalid class FQN emitted by AST dump for new and class 978 constants in constant expressions). (ilutov) 979 . Fixed bug #81727: Don't mangle HTTP variable names that clash with ones 980 that have a specific semantic meaning. (CVE-2022-31629). (Derick) 981 982- DOM: 983 . Fixed bug #79451 (DOMDocument->replaceChild on doctype causes double free). 984 (Nathan Freeman) 985 986- FPM: 987 . Fixed bug GH-8885 (FPM access.log with stderr begins to write logs to 988 error_log after daemon reload). (Dmitry Menshikov) 989 . Fixed bug #77780 ("Headers already sent..." when previous connection was 990 aborted). (Jakub Zelenka) 991 992- GMP 993 . Fixed bug GH-9308 (GMP throws the wrong error when a GMP object is passed 994 to gmp_init()). (Girgias) 995 996- Intl 997 . Fixed bug GH-9421 (Incorrect argument number for ValueError in NumberFormatter). 998 (Girgias) 999 1000- PCRE: 1001 . Fixed pcre.jit on Apple Silicon. (Niklas Keller) 1002 1003- PDO_PGSQL: 1004 . Fixed bug GH-9411 (PgSQL large object resource is incorrectly closed). 1005 (Yurunsoft) 1006 1007- Phar: 1008 . Fixed bug #81726: phar wrapper: DOS when using quine gzip file. 1009 (CVE-2022-31628). (cmb) 1010 1011- Reflection: 1012 . Fixed bug GH-8932 (ReflectionFunction provides no way to get the called 1013 class of a Closure). (cmb, Nicolas Grekas) 1014 1015- Streams: 1016 . Fixed bug GH-9316 ($http_response_header is wrong for long status line). 1017 (cmb, timwolla) 1018 101901 Sep 2022, PHP 8.1.10 1020 1021- Core: 1022 . Fixed --CGI-- support of run-tests.php. (cmb) 1023 . Fixed incorrect double to long casting in latest clang. (zeriyoshi) 1024 . Fixed bug GH-9266 (GC root buffer keeps growing when dtors are present). 1025 (Michael Olšavský) 1026 1027- Date: 1028 . Fixed bug GH-8730 (DateTime::diff miscalculation is same time zone of 1029 different type). (Derick) 1030 . Fixed bug GH-8964 (DateTime object comparison after applying delta less 1031 than 1 second). (Derick) 1032 . Fixed bug GH-9106: (DateInterval 1.5s added to DateTimeInterface is rounded 1033 down since PHP 8.1.0). (Derick) 1034 . Fixed bug #81263 (Wrong result from DateTimeImmutable::diff). (Derick) 1035 1036- DBA: 1037 . Fixed LMDB driver memory leak on DB creation failure (Girgias) 1038 . Fixed bug GH-9155 (dba_open("non-existing", "c-", "flatfile") segfaults) 1039 (cmb) 1040 1041- IMAP: 1042 . Fixed bug GH-9309 (Segfault when connection is used after imap_close()). 1043 (cmb) 1044 1045- Intl: 1046 . Fixed IntlDateFormatter::formatObject() parameter type. (Gert de Pagter) 1047 1048- MBString: 1049 . Fixed bug GH-9008 (mb_detect_encoding(): wrong results with null $encodings). 1050 (cmb) 1051 1052- OPcache: 1053 . Fixed bug GH-9033 (Loading blacklist file can fail due to negative length). 1054 (cmb) 1055 . Fixed bug GH-9164 (Segfault in zend_accel_class_hash_copy). 1056 (Arnaud, Sergei Turchanov) 1057 1058- OpenSSL: 1059 . Fixed bug GH-9339 (OpenSSL oid_file path check warning contains 1060 uninitialized path). (Jakub Zelenka) 1061 1062- PDO_SQLite: 1063 . Fixed bug GH-9032 (SQLite3 authorizer crashes on NULL values). (cmb) 1064 1065- SQLite3: 1066 . Fixed bug GH-9032 (SQLite3 authorizer crashes on NULL values). (cmb) 1067 1068- Streams: 1069 . Fixed bug GH-8472 (The resource returned by stream_socket_accept may have 1070 incorrect metadata). (Jakub Zelenka) 1071 . Fixed bug GH-8409 (SSL handshake timeout leaves persistent connections 1072 hanging). (Jakub Zelenka, Twosee) 1073 107404 Aug 2022, PHP 8.1.9 1075 1076- CLI: 1077 . Fixed potential overflow for the builtin server via the PHP_CLI_SERVER_WORKERS 1078 environment variable. (yiyuaner) 1079 1080- Core: 1081 . Fixed bug GH-8923 (error_log on Windows can hold the file write lock). (cmb) 1082 . Fixed bug GH-8995 (WeakMap object reference offset causing TypeError). 1083 (Tobias Bachert) 1084 1085- CLI: 1086 . Fixed GH-8952 (Intentionally closing std handles no longer possible). 1087 (Arnaud, cmb) 1088 1089- Date: 1090 . Fixed bug #80047 (DatePeriod doesn't warn with custom DateTimeImmutable). 1091 (Derick) 1092 1093- FPM: 1094 . Fixed zlog message prepend, free on incorrect address. (Heiko Weber) 1095 . Fixed possible double free on configuration loading failure. (Heiko Weber). 1096 1097- GD: 1098 . Fixed bug GH-8848 (imagecopyresized() error refers to the wrong argument). 1099 (cmb) 1100 1101- Intl: 1102 . Fixed build for ICU 69.x and onwards. (David Carlier) 1103 1104- OPcache: 1105 . Fixed bug GH-8847 (PHP hanging infinitly at 100% cpu when check php 1106 syntaxe of a valid file). (Dmitry) 1107 . Fixed bug GH-8030 (Segfault with JIT and large match/switch statements). 1108 (Arnaud) 1109 1110- Reflection: 1111 . Fixed bug GH-8943 (Fixed Reflection::getModifiersNames() with readonly 1112 modifier). (Pierrick) 1113 . Fixed bug GH-8982 (Attribute with TARGET_METHOD is rejected on fake 1114 closure of method). (ilutov) 1115 1116- Standard: 1117 . Fixed the crypt_sha256/512 api build with clang > 12. (David Carlier) 1118 . Uses CCRandomGenerateBytes instead of arc4random_buf on macOs. (David Carlier). 1119 . Fixed bug GH-9017 (php_stream_sock_open_from_socket could return NULL). 1120 (Heiko Weber) 1121 112207 Jul 2022, PHP 8.1.8 1123 1124- Core: 1125 . Fixed bug GH-8338 (Intel CET is disabled unintentionally). (Chen, Hu) 1126 . Fixed leak in Enum::from/tryFrom for internal enums when using JIT (ilutov) 1127 . Fixed calling internal methods with a static return type from 1128 extension code. (Sara) 1129 . Fixed bug GH-8655 (Casting an object to array does not unwrap refcount=1 1130 references). (Nicolas Grekas) 1131 . Fixed potential use after free in php_binary_init(). (Heiko Weber) 1132 . Fixed bug GH-7942 (Indirect mutation of readonly properties through 1133 references). (ilutov) 1134 1135- CLI: 1136 . Fixed GH-8827 (Intentionally closing std handles no longer possible). (cmb) 1137 1138- COM: 1139 . Fixed bug GH-8778 (Integer arithmethic with large number variants fails). 1140 (cmb) 1141 1142- Curl: 1143 . Fixed CURLOPT_TLSAUTH_TYPE is not treated as a string option. (Pierrick) 1144 1145- Date: 1146 . Fixed bug #72963 (Null-byte injection in CreateFromFormat and related 1147 functions). (Derick) 1148 . Fixed bug #74671 (DST timezone abbreviation has incorrect offset). (Derick) 1149 . Fixed bug #77243 (Weekdays are calculated incorrectly for negative years). 1150 (Derick) 1151 . Fixed bug #78139 (timezone_open accepts invalid timezone string argument). 1152 (Derick) 1153 1154- Fileinfo: 1155 . Fixed bug #81723 (Heap buffer overflow in finfo_buffer). (CVE-2022-31627) 1156 (cmb) 1157 1158- FPM: 1159 . Fixed bug #67764 (fpm: syslog.ident don't work). (Jakub Zelenka) 1160 1161- GD: 1162 . Fixed imagecreatefromavif() memory leak. (cmb) 1163 1164- MBString: 1165 . mb_detect_encoding recognizes all letters in Czech alphabet (alexdowad) 1166 . mb_detect_encoding recognizes all letters in Hungarian alphabet (alexdowad) 1167 . Fixed bug GH-8685 (pcre not ready at mbstring startup). (Remi) 1168 . Backwards-compatible mappings for 0x5C/0x7E in Shift-JIS are restored, 1169 after they had been changed in 8.1.0. (Alex Dowad) 1170 1171- ODBC: 1172 . Fixed handling of single-key connection strings. (Calvin Buckley) 1173 1174- OPcache: 1175 . Fixed bug GH-8591 (tracing JIT crash after private instance method change). 1176 (Arnaud, Dmitry, Oleg Stepanischev) 1177 1178- OpenSSL: 1179 . Fixed bug #50293 (Several openssl functions ignore the VCWD). 1180 (Jakub Zelenka, cmb) 1181 . Fixed bug #81713 (NULL byte injection in several OpenSSL functions working 1182 with certificates). (Jakub Zelenka) 1183 1184- PDO_ODBC: 1185 . Fixed handling of single-key connection strings. (Calvin Buckley) 1186 1187- Zip: 1188 . Fixed bug GH-8781 (ZipArchive::close deletes zip file without updating stat 1189 cache). (Remi) 1190 119109 Jun 2022, PHP 8.1.7 1192 1193- CLI: 1194 . Fixed bug GH-8575 (CLI closes standard streams too early). (Levi Morrison) 1195 1196- Date: 1197 . Fixed bug #51934 (strtotime plurals / incorrect time). (Derick) 1198 . Fixed bug #51987 (Datetime fails to parse an ISO 8601 ordinal date 1199 (extended format)). (Derick) 1200 . Fixed bug #66019 (DateTime object does not support short ISO 8601 time 1201 format - YYYY-MM-DDTHH) (cmb, Derick) 1202 . Fixed bug #68549 (Timezones and offsets are not properly used when working 1203 with dates) (Derick, Roel Harbers) 1204 . Fixed bug #81565 (date parsing fails when provided with timezones including 1205 seconds). (Derick) 1206 . Fixed bug GH-7758 (Problems with negative timestamps and fractions). 1207 (Derick, Ilija) 1208 1209- FPM: 1210 . Fixed ACL build check on MacOS. (David Carlier) 1211 . Fixed bug #72185: php-fpm writes empty fcgi record causing nginx 502. 1212 (Jakub Zelenka, loveharmful) 1213 . Fixes use after free. (Heiko Weber). 1214 1215- mysqlnd: 1216 . Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626) 1217 (c dot fol at ambionics dot io) 1218 1219- OPcache: 1220 . Fixed bug GH-8461 (tracing JIT crash after function/method change). 1221 (Arnaud, Dmitry) 1222 1223- OpenSSL: 1224 . Fixed bug #79589 (error:14095126:SSL routines:ssl3_read_n:unexpected eof 1225 while reading). (Jakub Zelenka) 1226 1227- Pcntl: 1228 . Fixed Haiku build. (David Carlier) 1229 1230- pgsql 1231 . Fixed bug #81720: Uninitialized array in pg_query_params(). 1232 (CVE-2022-31625) (cmb) 1233 1234- Soap: 1235 . Fixed bug GH-8578 (Error on wrong parameter on SoapHeader constructor). 1236 (robertnisipeanu) 1237 . Fixed bug GH-8538 (SoapClient may strip parts of nmtokens). (cmb) 1238 1239- SPL: 1240 . Fixed bug GH-8235 (iterator_count() may run indefinitely). (cmb) 1241 1242- Standard: 1243 . Fixed bug GH-8185 (Crash during unloading of extension after dl() in ZTS). 1244 (Arnaud) 1245 1246- Zip: 1247 . Fixed type for index in ZipArchive::replaceFile. (Martin Rehberger) 1248 124912 May 2022, PHP 8.1.6 1250 1251- Core: 1252 . Fixed bug GH-8310 (Registry settings are no longer recognized). (cmb) 1253 . Fixed potential race condition during resource ID allocation. (ryancaicse) 1254 . Fixed bug GH-8133 (Preloading of constants containing arrays with enums 1255 segfaults). (ilutov) 1256 . Fixed Haiku ZTS builds. (David Carlier) 1257 1258- Date: 1259 . Fixed bug GH-7752 (DateTimeZone::getTransitions() returns insufficient 1260 data). (Derick) 1261 . Fixed bug GH-8108 (Timezone doesn't work as intended). (Derick) 1262 . Fixed bug #81660 (DateTimeZone::getTransitions() returns invalid data). 1263 (Derick) 1264 . Fixed bug GH-8289 (Exceptions thrown within a yielded from iterator are 1265 not rethrown into the generator). (Bob) 1266 1267- FFI: 1268 . Fixed bug GH-8433 (Assigning function pointers to structs in FFI leaks). 1269 (Bob) 1270 1271- FPM: 1272 . Fixed bug #76003 (FPM /status reports wrong number of active processe). 1273 (Jakub Zelenka) 1274 . Fixed bug #77023 (FPM cannot shutdown processes). (Jakub Zelenka) 1275 . Fixed comment in kqueue remove callback log message. (David Carlier) 1276 1277- Hash: 1278 . Fixed bug #81714 (segfault when serializing finalized HashContext). (cmb) 1279 1280- Iconv: 1281 . Fixed bug GH-8218 (ob_end_clean does not reset Content-Encoding header). 1282 (cmb) 1283 1284- Intl: 1285 . Fixed bug GH-8364 (msgfmt_format $values may not support references). (cmb) 1286 1287- MBString: 1288 . Number of error markers emitted for invalid UTF-8 text matches WHATWG specification. 1289 This is a return to the behavior of PHP 8.0 and earlier. (alexdowad) 1290 1291- MySQLi: 1292 . Fixed bug GH-8267 (MySQLi uses unsupported format specifier on Windows). 1293 (cmb) 1294 1295- OPcache: 1296 . Fixed bug GH-8063 (OPcache breaks autoloading after E_COMPILE_ERROR). 1297 (Arnaud) 1298 1299- SPL: 1300 . Fixed bug GH-8366 (ArrayIterator may leak when calling __construct()). 1301 (cmb) 1302 . Fixed bug GH-8273 (SplFileObject: key() returns wrong value). (Girgias) 1303 1304- Streams: 1305 . Fixed php://temp does not preserve file-position when switched to temporary 1306 file. (Bernd Holzmüller) 1307 1308- zlib: 1309 . Fixed bug GH-8218 (ob_end_clean does not reset Content-Encoding header). 1310 (cmb) 1311 131214 Apr 2022, PHP 8.1.5 1313 1314- Core: 1315 . Fixed bug GH-8176 (Enum values in property initializers leak). (Bob) 1316 . Fixed freeing of internal attribute arguments. (Bob) 1317 . Fixed bug GH-8070 (memory leak of internal function attribute hash). 1318 (Tim Düsterhus) 1319 . Fixed bug GH-8160 (ZTS support on Alpine is broken). (Michael Voříšek) 1320 1321- Filter: 1322 . Fixed signedness confusion in php_filter_validate_domain(). (cmb) 1323 1324- Intl: 1325 . Fixed bug GH-8115 (Can't catch arg type deprecation when instantiating Intl 1326 classes). (ilutov) 1327 . Fixed bug GH-8142 (Compilation error on cygwin). (David Carlier) 1328 . Fixed bug GH-7734 (Fix IntlPartsIterator key off-by-one error and first 1329 key). (ilutov) 1330 1331- MBString: 1332 . Fixed bug GH-8208 (mb_encode_mimeheader: $indent functionality broken). 1333 (cmb) 1334 1335- MySQLi: 1336 . Fixed bug GH-8068 (mysqli_fetch_object creates inaccessible properties). 1337 (cmb) 1338 1339- Pcntl: 1340 . Fixed bug GH-8142 (Compilation error on cygwin). (David Carlier) 1341 1342- PgSQL: 1343 . Fixed result_type related stack corruption on LLP64 architectures. (cmb) 1344 . Fixed bug GH-8253 (pg_insert() fails for references). (cmb) 1345 1346- Sockets: 1347 . Fixed Solaris builds. (David Carlier) 1348 . Fix undefined behavior in php_set_inet6_addr. (ilutov) 1349 1350- SPL: 1351 . Fixed bug GH-8121 (SplFileObject - seek and key with csv file inconsistent). 1352 (cmb) 1353 . Fixed bug GH-8192 (Cannot override DirectoryIterator::current() without 1354 return typehint in 8.1). (Nikita) 1355 1356- Standard: 1357 . Fixed bug GH-8048 (Force macOS to use statfs). (risner) 1358 135917 Mar 2022, PHP 8.1.4 1360 1361- Core: 1362 . Fixed Haiku ZTS build. (David Carlier) 1363 . Fixed bug GH-8059 arginfo not regenerated for extension. (Remi) 1364 . Fixed bug GH-8083 Segfault when dumping uncalled fake closure with static 1365 variables. (ilutov) 1366 . Fixed bug GH-7958 (Nested CallbackFilterIterator is leaking memory). (cmb) 1367 . Fixed bug GH-8074 (Wrong type inference of range() result). (cmb) 1368 . Fixed bug GH-8140 (Wrong first class callable by name optimization). (cmb) 1369 . Fixed bug GH-8082 (op_arrays with temporary run_time_cache leak memory 1370 when observed). (Bob) 1371 1372- GD: 1373 . Fixed libpng warning when loading interlaced images. (Brett) 1374 1375- FPM: 1376 . Fixed bug #76109 (Unsafe access to fpm scoreboard). 1377 (Till Backhaus, Jakub Zelenka) 1378 1379- Iconv: 1380 . Fixed bug GH-7953 (ob_clean() only does not set Content-Encoding). (cmb) 1381 . Fixed bug GH-7980 (Unexpected result for iconv_mime_decode). (cmb) 1382 1383- MBString: 1384 . Fixed bug GH-8128 (mb_check_encoding wrong result for 7bit). (alexdowad) 1385 1386- MySQLnd: 1387 . Fixed bug GH-8058 (NULL pointer dereference in mysqlnd package). (Kamil Tekiela) 1388 1389- Reflection: 1390 . Fixed bug GH-8080 (ReflectionClass::getConstants() depends on def. order). 1391 (cmb) 1392 . Fixed bug GH-8444 (Fix ReflectionProperty::__toString() of properties 1393 containing instantiated enums). (ilutov) 1394 1395- Zlib: 1396 . Fixed bug GH-7953 (ob_clean() only does not set Content-Encoding). (cmb) 1397 139803 Feb 2022, PHP 8.1.3 1399 1400- Core: 1401 . Fixed bug #81430 (Attribute instantiation leaves dangling pointer). 1402 (beberlei) 1403 . Fixed bug GH-7896 (Environment vars may be mangled on Windows). (cmb) 1404 . Fixed bug GH-7883 (Segfault when INI file is not readable). (Remi) 1405 1406- FFI: 1407 . Fixed bug GH-7867 (FFI::cast() from pointer to array is broken). (cmb, 1408 dmitry) 1409 1410- Filter: 1411 . Fix #81708: UAF due to php_filter_float() failing for ints. 1412 (CVE-2021-21708) (cmb) 1413 1414- FPM: 1415 . Fixed memory leak on invalid port. (David Carlier) 1416 . Fixed bug GH-7842 (Invalid OpenMetrics response format returned by FPM 1417 status page. (Stefano Arlandini) 1418 1419- MBString: 1420 . Fixed bug GH-7902 (mb_send_mail may delimit headers with LF only). (cmb) 1421 1422- MySQLnd: 1423 . Fixed bug GH-7972 (MariaDB version prefix 5.5.5- is not stripped). (Kamil Tekiela) 1424 1425- pcntl: 1426 . Fixed pcntl_rfork build for DragonFlyBSD. (David Carlier) 1427 1428- Sockets: 1429 . Fixed bug GH-7978 (sockets extension compilation errors). (David Carlier) 1430 1431- Standard: 1432 . Fixed bug GH-7899 (Regression in unpack for negative int value). (Remi) 1433 . Fixed bug GH-7875 (mails are sent even if failure to log throws exception). 1434 (cmb) 1435 143620 Jan 2022, PHP 8.1.2 1437 1438- Core: 1439 . Fixed bug #81216 (Nullsafe operator leaks dynamic property name). (Dmitry) 1440 . Fixed bug #81684 (Using null coalesce assignment with $GLOBALS["x"] produces 1441 opcode error). (ilutov) 1442 . Fixed bug #81656 (GCC-11 silently ignores -R). (Michael Wallner) 1443 . Fixed bug #81683 (Misleading "access type ... must be public" error message 1444 on final or abstract interface methods). (ilutov) 1445 . Fixed bug #81585 (cached_chunks are not counted to real_size on shutdown). 1446 (cmb) 1447 . Fixed bug GH-7757 (Multi-inherited final constant causes fatal error). 1448 (cmb) 1449 . Fixed zend_fibers.c build with ZEND_FIBER_UCONTEXT. (Petr Sumbera) 1450 . Added riscv64 support for fibers. (Jeremie Courreges-Anglas) 1451 1452- Filter: 1453 . Fixed FILTER_FLAG_NO_RES_RANGE flag. (Yifan Tong) 1454 1455- Hash: 1456 . Fixed bug GH-7759 (Incorrect return types for hash() and hash_hmac()). 1457 (cmb) 1458 . Fixed bug GH-7826 (Inconsistent argument name in hash_hmac_file and 1459 hash_file). (cmb) 1460 1461- MBString: 1462 . Fixed bug #81693 (mb_check_encoding(7bit) segfaults). (cmb) 1463 1464- MySQLi: 1465 . Fixed bug #81658 (MYSQL_OPT_LOAD_DATA_LOCAL_DIR not available in MariaDB). 1466 (devnexen) 1467 . Introduced MYSQLI_IS_MARIADB. (devnexen) 1468 . Fixed bug GH-7746 (mysqli_sql_exception->getSqlState()). (Kamil Tekiela) 1469 1470- MySQLnd: 1471 . Fixed bug where large bigints may be truncated. (Nathan Freeman, cmb) 1472 1473- OCI8: 1474 . Fixed bug GH-7765 (php_oci_cleanup_global_handles segfaults at second 1475 call). (cmb) 1476 1477- OPcache: 1478 . Fixed bug #81679 (Tracing JIT crashes on reattaching). (cmb) 1479 1480- Readline: 1481 . Fixed bug #81598 (Cannot input unicode characters in PHP 8 interactive 1482 shell). (Nikita) 1483 1484- Reflection: 1485 . Fixed bug #81681 (ReflectionEnum throwing exceptions). (cmb) 1486 1487- PDO_PGSQL: 1488 . Fixed error message allocation of PDO PgSQL. (SATO Kentaro) 1489 1490- Sockets: 1491 . Avoid void* arithmetic in sockets/multicast.c on NetBSD. (David Carlier) 1492 . Fixed ext/sockets build on Haiku. (David Carlier) 1493 1494- Spl: 1495 . Fixed bug #75917 (SplFileObject::seek broken with CSV flags). (Aliaksandr 1496 Bystry) 1497 . Fixed bug GH-7809 (Cloning a faked SplFileInfo object may segfault). (cmb) 1498 1499- Standard: 1500 . Fixed bug GH-7748 (gethostbyaddr outputs binary string). (cmb) 1501 . Fixed bug GH-7815 (php_uname doesn't recognise latest Windows versions). 1502 (David Warner) 1503 150402 Dec 2021, PHP 8.1.1 1505 1506- IMAP: 1507 . Fixed bug #81649 (imap_(un)delete accept sequences, not single numbers). 1508 (cmb) 1509 1510- PCRE: 1511 . Update bundled PCRE2 to 10.39. (cmb) 1512 . Fixed bug #74604 (Out of bounds in php_pcre_replace_impl). (cmb, Dmitry) 1513 1514- Standard: 1515 . Fixed bug #81659 (stream_get_contents() may unnecessarily overallocate). 1516 (cmb) 1517 151825 Nov 2021, PHP 8.1.0 1519 1520- Core: 1521 . Fixed inclusion order for phpize builds on Windows. (cmb) 1522 . Added missing hashtable insertion APIs for arr/obj/ref. (Sara) 1523 . Implemented FR #77372 (Relative file path is removed from uploaded file). 1524 (Björn Tantau) 1525 . Fixed bug #81607 (CE_CACHE allocation with concurrent access). (Nikita, 1526 Dmitry) 1527 . Fixed bug #81507 (Fiber does not compile on AIX). (Clément Chigot) 1528 . Fixed bug #78647 (SEGFAULT in zend_do_perform_implementation_check). 1529 (Nikita) 1530 . Fixed bug #81518 (Header injection via default_mimetype / default_charset). 1531 (cmb) 1532 . Fixed bug #75941 (Fix compile failure on Solaris with clang). (Jaromír 1533 Doleček) 1534 . Fixed bug #81380 (Observer may not be initialized properly). (krakjoe) 1535 . Fixed bug #81514 (Using Enum as key in WeakMap triggers GC + SegFault). 1536 (Nikita) 1537 . Fixed bug #81520 (TEST_PHP_CGI_EXECUTABLE badly set in run-tests.php). 1538 (Remi) 1539 . Fixed bug #81377 (unset() of $GLOBALS sub-key yields warning). (Nikita) 1540 . Fixed bug #81342 (New ampersand token parsing depends on new line after it). 1541 (Nikita) 1542 . Fixed bug #81280 (Unicode characters in cli.prompt causes segfault). 1543 (krakjoe) 1544 . Fixed bug #81192 ("Declaration should be compatible with" gives incorrect 1545 line number with traits). (Nikita) 1546 . Fixed bug #78919 (CLI server: insufficient cleanup if request startup 1547 fails). (cataphract, cmb) 1548 . Fixed bug #81303 (match error message improvements). (krakjoe) 1549 . Fixed bug #81238 (Fiber support missing for Solaris Sparc). (trowski) 1550 . Fixed bug #81237 (Comparison of fake closures doesn't work). (krakjoe) 1551 . Fixed bug #81202 (powerpc64 build fails on fibers). (krakjoe) 1552 . Fixed bug #80072 (Cyclic unserialize in TMPVAR operand may leak). (Nikita) 1553 . Fixed bug #81163 (__sleep allowed to return non-array). (krakjoe) 1554 . Fixed bug #75474 (function scope static variables are not bound to a unique 1555 function). (Nikita) 1556 . Fixed bug #53826 (__callStatic fired in base class through a parent call if 1557 the method is private). (Nikita) 1558 . Fixed bug #81076 (incorrect debug info on Closures with implicit binds). 1559 (krakjoe) 1560 1561- CLI: 1562 . Fixed bug #81496 (Server logs incorrect request method). (lauri) 1563 1564- COM: 1565 . Dispatch using LANG_NEUTRAL instead of LOCALE_SYSTEM_DEFAULT. (Dmitry 1566 Maksimov) 1567 1568- Curl: 1569 . Fixed bug #81085 (Support CURLOPT_SSLCERT_BLOB for cert strings). 1570 (camporter) 1571 1572- Date: 1573 . Fixed bug #81458 (Regression Incorrect difference after timezone change). 1574 (Derick) 1575 . Fixed bug #81500 (Interval serialization regression since 7.3.14 / 7.4.2). 1576 (cmb) 1577 . Fixed bug #81504 (Incorrect timezone transition details for POSIX data). 1578 (Derick) 1579 . Fixed bug #80998 (Missing second with inverted interval). (Derick) 1580 . Speed up finding timezone offset information. (Derick) 1581 . Fixed bug #79580 (date_create_from_format misses leap year). (Derick) 1582 . Fixed bug #80963 (DateTimeZone::getTransitions() truncated). (Derick) 1583 . Fixed bug #80974 (Wrong diff between 2 dates in different timezones). 1584 (Derick) 1585 . Fixed bug #80998 (Missing second with inverted interval). (Derick) 1586 . Fixed bug #81097 (DateTimeZone silently falls back to UTC when providing an 1587 offset with seconds). (Derick) 1588 . Fixed bug #81106 (Regression in 8.1: add() now truncate ->f). (Derick) 1589 . Fixed bug #81273 (Date interval calculation not correct). (Derick) 1590 . Fixed bug #52480 (Incorrect difference using DateInterval). (Derick) 1591 . Fixed bug #62326 (date_diff() function returns false result). (Derick) 1592 . Fixed bug #64992 (dst not handled past 2038). (Derick) 1593 . Fixed bug #65003 (Wrong date diff). (Derick) 1594 . Fixed bug #66545 (DateTime. diff returns negative values). (Derick) 1595 . Fixed bug #68503 (date_diff on two dates with timezone set localised 1596 returns wrong results). (Derick) 1597 . Fixed bug #69806 (Incorrect date from timestamp). (Derick) 1598 . Fixed bug #71700 (Extra day on diff between begin and end of march 2016). 1599 (Derick) 1600 . Fixed bug #71826 (DateTime::diff confuse on timezone 'Asia/Tokyo'). (Derick) 1601 . Fixed bug #73460 (Datetime add not realising it already applied DST 1602 change). (Derick) 1603 . Fixed bug #74173 (DateTimeImmutable::getTimestamp() triggers DST switch in 1604 incorrect time). (Derick) 1605 . Fixed bug #74274 (Handling DST transitions correctly). (Derick) 1606 . Fixed bug #74524 (Date diff is bad calculated, in same time zone). (Derick) 1607 . Fixed bug #75167 (DateTime::add does only care about backward DST 1608 transition, not forward). (Derick) 1609 . Fixed bug #76032 (DateTime->diff having issues with leap days for 1610 timezones ahead of UTC). (Derick) 1611 . Fixed bug #76374 (Date difference varies according day time). (Derick) 1612 . Fixed bug #77571 (DateTime's diff DateInterval incorrect in timezones from 1613 UTC+01:00 to UTC+12:00). (Derick) 1614 . Fixed bug #78452 (diff makes wrong in hour for Asia/Tehran). (Derick) 1615 . Fixed bug #79452 (DateTime::diff() generates months differently between 1616 time zones). (Derick) 1617 . Fixed bug #79698 (timelib mishandles future timestamps (triggered by 'zic 1618 -b slim')). (Derick) 1619 . Fixed bug #79716 (Invalid date time created (with day "00")). (Derick) 1620 . Fixed bug #80610 (DateTime calculate wrong with DateInterval). (Derick) 1621 . Fixed bug #80664 (DateTime objects behave incorrectly around DST 1622 transition). (Derick) 1623 . Fixed bug #80913 (DateTime(Immutable)::sub around DST yield incorrect 1624 time). (Derick) 1625 1626- DBA: 1627 . Fixed bug #81588 (TokyoCabinet driver leaks memory). (girgias) 1628 1629- DOM: 1630 . Fixed bug #81433 (DOMElement::setIdAttribute() called twice may remove ID). 1631 (Viktor Volkov) 1632 1633- FFI: 1634 . Fixed bug #79576 ("TYPE *" shows unhelpful message when type is not 1635 defined). (Dmitry) 1636 1637- Filter: 1638 . Fixed bug #61700 (FILTER_FLAG_IPV6/FILTER_FLAG_NO_PRIV|RES_RANGE failing). 1639 (cmb, Nikita) 1640 1641- FPM: 1642 . Fixed bug #81513 (Future possibility for heap overflow in FPM zlog). 1643 (Jakub Zelenka) 1644 . Fixed bug #81026 (PHP-FPM oob R/W in root process leading to privilege 1645 escalation) (CVE-2021-21703). (Jakub Zelenka) 1646 . Added openmetrics status format. (Cees-Jan Kiewiet) 1647 . Enable process renaming on macOS. (devnexen) 1648 . Added pm.max_spawn_rate option to configure max spawn child processes rate. 1649 (Paulius Sapragonas) 1650 . Fixed bug #65800 (Events port mechanism). (psumbera) 1651 1652- FTP: 1653 . Convert resource<ftp> to object \FTP\Connection. (Sara) 1654 1655- GD: 1656 . Fixed bug #71316 (libpng warning from imagecreatefromstring). (cmb) 1657 . Convert resource<gd font> to object \GdFont. (Sara) 1658 1659- hash: 1660 . Implemented FR #68109 (Add MurmurHash V3). (Anatol, Michael) 1661 . Implemented FR #73385 (Add xxHash support). (Anatol) 1662 1663- JSON: 1664 . Fixed bug #81532 (Change of $depth behaviour in json_encode() on PHP 8.1). 1665 (Nikita) 1666 . Fixed bug GH-8238 (Register JSON_ERROR_NON_BACKED_ENUM constant). (ilutov) 1667 1668- LDAP: 1669 . Convert resource<ldap link> to object \LDAP\Connection. (Máté) 1670 . Convert resource<ldap result> to object \LDAP\Result. (Máté) 1671 . Convert resource<ldap result entry> to object \LDAP\ResultEntry. (Máté) 1672 1673- MBString: 1674 . Fixed bug #76167 (mbstring may use pointer from some previous request). 1675 (cmb, cataphract) 1676 . Fixed bug #81390 (mb_detect_encoding() regression). (alexdowad) 1677 . Fixed bug #81349 (mb_detect_encoding misdetcts ASCII in some cases). 1678 (Nikita) 1679 . Fixed bug #81298 (mb_detect_encoding() segfaults when 7bit encoding is 1680 specified). (Nikita) 1681 1682- MySQLi: 1683 . Fixed bug #70372 (Emulate mysqli_fetch_all() for libmysqlclient). (Nikita) 1684 . Fixed bug #80330 (Replace language in APIs and source code/docs). 1685 (Darek Ślusarczyk) 1686 . Fixed bug #80329 (Add option to specify LOAD DATA LOCAL white list folder 1687 (including libmysql)). (Darek Ślusarczyk) 1688 1689- MySQLnd: 1690 . Fixed bug #63327 (Crash (Bus Error) in mysqlnd due to wrong alignment). 1691 (Nikita) 1692 . Fixed bug #80761 (PDO uses too much memory). (Nikita) 1693 1694- Opcache: 1695 . Fixed bug #81409 (Incorrect JIT code for ADD with a reference to array). 1696 (Dmitry) 1697 . Fixed bug #81255 (Memory leak in PHPUnit with functional JIT). 1698 . Fixed bug #80959 (infinite loop in building cfg during JIT compilation). 1699 (Nikita, Dmitry) 1700 . Fixed bug #81225 (Wrong result with pow operator with JIT enabled). 1701 (Dmitry) 1702 . Fixed bug #81249 (Intermittent property assignment failure with JIT 1703 enabled). (Dmitry) 1704 . Fixed bug #81256 (Assertion `zv != ((void *)0)' failed for "preload" with 1705 JIT). (Dmitry) 1706 . Fixed bug #81133 (building opcache with phpize fails). (krakjoe) 1707 . Fixed bug #81136 (opcache header not installed). (krakjoe) 1708 . Added inheritance cache. (Dmitry) 1709 1710- OpenSSL: 1711 . Fixed bug #81502 ($tag argument of openssl_decrypt() should accept 1712 null/empty string). (Nikita) 1713 . Bump minimal OpenSSL version to 1.0.2. (Jakub Zelenka) 1714 1715- PCRE: 1716 . Fixed bug #81424 (PCRE2 10.35 JIT performance regression). (cmb) 1717 . Bundled PCRE2 is 10.37. 1718 1719- PDO: 1720 . Fixed bug #40913 (PDO_MYSQL: PDO::PARAM_LOB does not bind to a stream for 1721 fetching a BLOB). (Nikita) 1722 1723- PDO MySQL: 1724 . Fixed bug #80908 (PDO::lastInsertId() return wrong). (matt) 1725 . Fixed bug #81037 (PDO discards error message text from prepared 1726 statement). (Kamil Tekiela) 1727 1728- PDO OCI: 1729 . Fixed bug #77120 (Support 'success with info' at connection). 1730 (Sergei Morozov) 1731 1732- PDO ODBC: 1733 . Implement PDO_ATTR_SERVER_VERSION and PDO_ATTR_SERVER_INFO for 1734 PDO::getAttribute(). (Calvin Buckley) 1735 1736- PDO PgSQL: 1737 . Fixed bug #81343 (pdo_pgsql: Inconsitent boolean conversion after calling 1738 closeCursor()). (Philip Hofstetter) 1739 1740- PDO SQLite: 1741 . Fixed bug #38334 (Proper data-type support for PDO_SQLITE). (Nikita) 1742 1743- PgSQL: 1744 . Fixed bug #81509 (pg_end_copy still expects a resource). (Matteo) 1745 . Convert resource<pgsql link> to object \PgSql\Connection. (Máté) 1746 . Convert resource<pgsql result> to object \PgSql\Result. (Máté) 1747 . Convert resource<pgsql large object> to object \PgSql\Lob. (Máté) 1748 1749- Phar: 1750 . Use SHA256 by default for signature. (remi) 1751 . Add support for OpenSSL_SHA256 and OpenSSL_SHA512 signature. (remi) 1752 1753- phpdbg: 1754 . Fixed bug #81135 (unknown help topic causes assertion failure). (krakjoe) 1755 1756- PSpell: 1757 . Convert resource<pspell> to object \PSpell\Dictionary. (Sara) 1758 . Convert resource<pspell config> to object \PSpell\Config. (Sara) 1759 1760- readline: 1761 . Fixed bug #72998 (invalid read in readline completion). (krakjoe) 1762 1763- Reflection: 1764 . Fixed bug #81611 (ArgumentCountError when getting default value from 1765 ReflectionParameter with new). (Cameron Porter) 1766 . Fixed bug #81630 (PHP 8.1: ReflectionClass->getTraitAliases() crashes with 1767 Internal error). (Nikita) 1768 . Fixed bug #81457 (Enum: ReflectionMethod->getDeclaringClass() return a 1769 ReflectionClass). (Nikita) 1770 . Fixed bug #81474 (Make ReflectionEnum and related class non-final). (Nikita) 1771 . Fixed bug #80821 (ReflectionProperty::getDefaultValue() returns current 1772 value for statics). (Nikita) 1773 . Fixed bug #80564 (ReflectionProperty::__toString() renders current value, 1774 not default value). (Nikita) 1775 . Fixed bug #80097 (ReflectionAttribute is not a Reflector). (beberlei) 1776 . Fixed bug #81200 (no way to determine if Closure is static). (krakjoe) 1777 . Implement ReflectionFunctionAbstract::getClosureUsedVariables. (krakjoe) 1778 1779- Shmop: 1780 . Fixed bug #81407 (shmop_open won't attach and causes php to crash). (cmb) 1781 1782- SimpleXML: 1783 . Fixed bug #81325 (Segfault in zif_simplexml_import_dom). (remi) 1784 1785- SNMP: 1786 . Implement SHA256 and SHA512 for security protocol. (remi) 1787 1788- Sodium: 1789 . Added the XChaCha20 stream cipher functions. (P.I.E. Security Team) 1790 . Added the Ristretto255 functions, which are available in libsodium 1.0.18. 1791 (P.I.E. Security Team) 1792 1793- SPL: 1794 . Fixed bug #66588 (SplFileObject::fgetcsv incorrectly returns a row on 1795 premature EOF). (Aliaksandr Bystry) 1796 . Fixed bug #80663 (Recursive SplFixedArray::setSize() may cause double-free). 1797 (cmb, Nikita, Tyson Andre) 1798 . Fixed bug #81477 (LimitIterator + SplFileObject regression in 8.0.1). (cmb) 1799 . Fixed bug #81112 (Special json_encode behavior for SplFixedArray). (Nikita) 1800 . Fixed bug #80945 ("Notice: Undefined index" on unset() ArrayObject 1801 non-existing key). (Nikita) 1802 . Fixed bug #80724 (FilesystemIterator::FOLLOW_SYMLINKS remove KEY_AS_FILE 1803 from bitmask). (Cameron Porter) 1804 1805- Standard: 1806 . Fixed bug #81441 (gethostbyaddr('::1') returns ip instead of name after 1807 calling some other method). (Nikita) 1808 . Fixed bug #81491 (Incorrectly using libsodium for argon2 hashing). 1809 (Dan Pock) 1810 . Fixed bug #81142 (PHP 7.3+ memory leak when unserialize() is used on an 1811 associative array). (Nikita) 1812 . Fixed bug #81111 (Serialization is unexpectedly allowed on anonymous classes 1813 with __serialize()). (Nikita) 1814 . Fixed bug #81137 (hrtime breaks build on OSX before Sierra). (krakjoe) 1815 . Fixed bug #77627 (method_exists on Closure::__invoke inconsistency). 1816 (krakjoe) 1817 1818- Streams: 1819 . Fixed bug #81475 (stream_isatty emits warning with attached stream wrapper). 1820 (cmb) 1821 1822- XML: 1823 . Fixed bug #79971 (special character is breaking the path in xml function) 1824 (CVE-2021-21707). (cmb) 1825 . Fixed bug #70962 (XML_OPTION_SKIP_WHITE strips embedded whitespace). 1826 (Aliaksandr Bystry, cmb) 1827 1828- Zip: 1829 . Fixed bug #81490 (ZipArchive::extractTo() may leak memory). (cmb, Remi) 1830 . Fixed bug #77978 (Dirname ending in colon unzips to wrong dir). (cmb) 1831 . Fixed bug #81420 (ZipArchive::extractTo extracts outside of destination) 1832 (CVE-2021-21706). (cmb) 1833 . Fixed bug #80833 (ZipArchive::getStream doesn't use setPassword). (Remi) 1834
