Merge branch 'master' into array-chunk-fill

Author: mehmetcansahin

CONTRIBUTING.md

@@ -211,13 +211,20 @@ locations.
     └─ gd/
        ├─ libgd/                    # Bundled and modified GD library https://github.com/libgd/libgd
        └─ ...
+    └─ hash/
+       ├─ xxhash/                   # Bundled xxHash library https://github.com/Cyan4973/xxHash
+       └─ ...
+    └─ lexbor/
+       ├─ lexbor/                   # Bundled and modified Lexbor library https://github.com/lexbor/lexbor
+       └─ ...
     └─ mbstring/
        ├─ libmbfl/                  # Forked and maintained in php-src
        ├─ unicode_data.h            # Generated by `ext/mbstring/ucgendat/ucgendat.php`
        └─ ...
     └─ opcache/
        └─ jit/
-          └─ ir/                    # Bundled part of IR framework https://github.com/dstogov/ir
+          ├─ ir/                    # Bundled part of IR framework https://github.com/dstogov/ir
+          └─ ...
     └─ pcre/
        ├─ pcre2lib/                 # https://www.pcre.org/
        └─ ...
@@ -230,10 +237,14 @@ locations.
        ├─ credits_ext.h             # Generated by `scripts/dev/credits`
        ├─ credits_sapi.h            # Generated by `scripts/dev/credits`
        ├─ html_tables.h             # Generated by `ext/standard/html_tables/html_table_gen.php`
+       ├─ libavifinfo/              # Bundled libavifinfo https://aomedia.googlesource.com/libavifinfo
        └─ ...
     └─ tokenizer/
        ├─ tokenizer_data.c          # Generated by `ext/tokenizer/tokenizer_data_gen.sh`
        └─ ...
+    └─ uri/
+       ├─ uriparser/                # Bundled uriparser https://github.com/uriparser/uriparser
+       └─ ...
     └─ zend_test                    # For testing internal APIs. Not needed for regular builds.
        └─ ...
     └─ zip/                         # Bundled https://github.com/pierrejoye/php_zip
@@ -247,6 +258,8 @@ locations.
  └─ sapi/                           # PHP SAPI modules
     └─ cli/
        ├─ mime_type_map.h           # Generated by `sapi/cli/generate_mime_type_map.php`
+       ├─ php_http_parser.[ch]      # Forked from https://github.com/nodejs/http-parser
+       ├─ ps_title.c                # Adopted from https://github.com/postgres/postgres/blob/master/src/backend/utils/misc/ps_status.c
        └─ ...
     └─ ...
  ├─ scripts/                        # php-config, phpize and internal development scripts

NEWS

@@ -6,13 +6,43 @@ PHP                                                                        NEWS
   . Fixed bug GH-23242 (PHP development server does not support Expect
     100-continue flow control). (Sjoerd Langkemper)
 
+- DOM:
+  . Fixed NamedNodeMap::getNamedItemNS() with an empty URI not matching
+    the null namespace in spec-following mode. (Ilia Alshanetsky)
+  . Fixed stale getElementsByClassName() and other node list caches after
+    className/classList writes and attribute removals. (Ilia Alshanetsky)
+
+- Hash:
+  . Fixed hash_file() reporting argument #1 ($algo) instead of argument #2
+    ($filename) when the filename contains null bytes. (lacatoire)
+
 - Intl:
+  . Fixed grapheme_strpos() and grapheme_strrpos() with an empty needle
+    returning UTF-16 offsets instead of grapheme offsets. (Ilia Alshanetsky)
+  . Fixed a memory leak when dumping IntlCalendar instances. (Ilia Alshanetsky)
+  . Fixed Collator::sortWithSortKeys() allocating fixed 2MiB buffers
+    regardless of array size. (Ilia Alshanetsky)
   . Fixed a memory leak when iterating IntlBreakIterator::getPartsIterator()
     results. (iliaal)
   . Fixed a leak in Locale::getKeywords() when a keyword value cannot be
     read. (iliaal)
   . Fixed a use-after-free when IntlRuleBasedBreakIterator is constructed
     from compiled rules. (iliaal)
+  . Fixed Spoofchecker methods not recording the ICU error code when an ICU
+    call fails. (Ilia Alshanetsky)
+  . Fixed idn_to_ascii() and idn_to_utf8() reporting argument #2 ($flags)
+    instead of argument #3 ($variant) for an invalid IDNA variant, and the
+    domain length error message printing a literal "d" instead of the limit.
+    (lacatoire)
+
+- MBString:
+  . Fixed mb_ereg_replace() emitting a NUL or out-of-bounds bytes in the
+    replacement when a \k<name> backref has no closing delimiter.
+    (Ilia Alshanetsky)
+
+- PCNTL:
+  . Fixed the declared signature of pcntl_signal(), whose $restart_syscalls
+    argument accepts null and defaults to it. (lacatoire)
 
 - PDO_PGSQL:
   . Added Pdo\Pgsql::ATTR_CHUNK_SIZE to fetch a result set in chunks of the
@@ -28,6 +58,15 @@ PHP                                                                        NEWS
   . Fixed bug GH-23477 (Memory leak on duplicate native Phar manifest entries).
     (Weilin Du)
 
+- Sockets:
+  . Fixed socket_set_option() with SO_ATTACH_REUSEPORT_CBPF and a zero value,
+    which detached the classic BPF filter instead of the reuseport program.
+    (David Carlier)
+
+- SOAP:
+  . Fixed WSDL cache corruption when a soap:header defines headerfaults.
+    (Ilia Alshanetsky)
+
 - Standard:
   . Fixed a segfault when a stream filter callback unsets StreamBucket::$data
     before re-attaching the bucket. (iliaal)
@@ -39,6 +78,10 @@ PHP                                                                        NEWS
   . Improved performance of array_chunk() when not preserving keys.
     (mehmetcansahin)
 
+- SimpleXML:
+  . Fixed writing to a dimension of the object returned by attributes() not
+    creating the attribute. (Ilia Alshanetsky)
+
 
 27 Aug 2026, PHP 8.6.0beta2
 
@@ -139,7 +182,7 @@ PHP                                                                        NEWS
   . It is now possible to use the AES192, AES192C, AES256, and AES256C as
     SNMPv3 security protocols if the underlying library supports them.
     (eskyuu)
-  . It is now possible to reset the MIB tree using the new snmp_read_mib()
+  . It is now possible to reset the MIB tree using the new snmp_init_mib()
     function. (eskyuu)
   . Additional MIB parsing and output control functionality has been exposed
     via the snmp_set_mib_option(), snmp_set_output_option(),
@@ -622,6 +665,8 @@ PHP                                                                        NEWS
   . Deprecate returning values from __construct() and __destruct(). (timwolla)
   . base_convert, bindex, hexdec and octdec now raise a notice when they cannot
     precisely convert the given number. (Sjoerd Langkemper)
+  . Added error_include_args INI option to make the display of function
+    arguments consistent in error output. (Calvin Buckley)
 
 - BCMath:
   . Added NUL-byte validation to BCMath functions. (jorgsowa)

UPGRADING

@@ -133,7 +133,7 @@ PHP 8.6 UPGRADE NOTES
     unchanged. Previously, NUL bytes were silently accepted: for cookie_path
     and cookie_domain this caused the SAPI to drop the Set-Cookie header; for
     cache_limiter the value was silently truncated at the NUL byte.
-  . A ValueError is not thrown if $name is a string containing NUL bytes in
+  . A ValueError is thrown if $name is a string containing NUL bytes in
     session_module_name().
   . session_encode() now returns an empty string instead of false for empty
     sessions. It only returns false now when the session data could not be
@@ -199,6 +199,16 @@ PHP 8.6 UPGRADE NOTES
     rules" message. Code that compares the exact message may need to be
     updated.
 
+- Sockets:
+  . socket_set_option() with SO_ATTACH_REUSEPORT_CBPF now requires an int
+    $value and a $level of SOL_SOCKET. Any other value type throws a TypeError
+    instead of being coerced, and any other level raises a warning and returns
+    false.
+  . socket_set_option() with SO_ATTACH_REUSEPORT_CBPF and a $value of 0 now
+    detaches the reuseport filter through SO_DETACH_REUSEPORT_BPF. It
+    previously used SO_DETACH_BPF, an alias of SO_DETACH_FILTER, which left the
+    reuseport program attached.
+
 - Sodium:
   . The password-hashing functions sodium_crypto_pwhash(),
     sodium_crypto_pwhash_str(),
@@ -309,6 +319,9 @@ PHP 8.6 UPGRADE NOTES
     when the "remove_all_path" option is not of type bool, or when the
     "comp_method", "comp_flags", or "enc_method" options are not of type int
     (numeric strings are coerced), instead of emitting a warning.
+  . Serializing or unserializing a ZipArchive now throws an Exception. A
+    subclass can override __serialize() and __unserialize() to round-trip
+    through ZipArchive::closeString() and ZipArchive::openString().
 
 - Zlib:
   . deflate_init() now raises a TypeError when the value for option "level",
@@ -484,10 +497,10 @@ PHP 8.6 UPGRADE NOTES
     RFC: https://wiki.php.net/rfc/uri_followup#uri_type_detection
   . Added Uri\Rfc3986\Uri::getHostType() and Uri\WhatWg\Url::getHostType().
     RFC: https://wiki.php.net/rfc/uri_followup#host_type_detection
-  . Added Uri\Rfc3986\UriBuilder.
-    RFC: https://wiki.php.net/rfc/uri_followup#uri_building
-  . Added Uri\WhatWg\UrlBuilder.
+  . Added Uri\Rfc3986\UriBuilder and Uri\WhatWg\UrlBuilder.
     RFC: https://wiki.php.net/rfc/uri_followup#uri_building
+  . Added Uri\url_percent_encode().
+    RFC: https://wiki.php.net/rfc/uri_followup#percent-encoding_support
 
 ========================================
 3. Changes in SAPI modules
@@ -629,6 +642,12 @@ PHP 8.6 UPGRADE NOTES
 5. Changed Functions
 ========================================
 
+- Filter:
+  . filter_var_array() return type has been narrowed from array|false|null to
+    array|false. The function always establishes an array before filtering, so
+    null was never returned. filter_input_array() is unaffected: it still
+    returns null when the requested superglobal does not exist.
+
 - GMP:
   . gmp_fact() now throws a ValueError if $num does not fit into an unsigned
     long.
@@ -639,6 +658,10 @@ PHP 8.6 UPGRADE NOTES
   . gmp_powm() modulo-by-zero now raises a DivisionByZeroError whose message
     includes the function name and argument index ($modulus).
 
+- LDAP:
+  . ldap_free_result() return type has been narrowed from bool to true. The
+    function already always returned true.
+
 - MySQLi:
   . The return structure of mysqli_get_charset() no longer contains the
     undocumented "comment" element. The value of "charsetnr" is now set to a
@@ -800,7 +823,7 @@ PHP 8.6 UPGRADE NOTES
   . StreamPollHandle
 
 - URI:
-  . Uri\Rfc3986\UriBuilder
+  . Uri\Rfc3986\UriBuilder and Uri\WhatWg\UrlBuilder
     RFC: https://wiki.php.net/rfc/uri_followup#uri_building
 
 ========================================
@@ -860,6 +883,29 @@ PHP 8.6 UPGRADE NOTES
   . EAI_ALLDONE.
   . EAI_INTR.
   . EAI_IDN_ENCODE.
+  . SO_DETACH_REUSEPORT_BPF (Linux only).
+
+- Sodium:
+  . SODIUM_CRYPTO_IPCRYPT_BYTES.
+  . SODIUM_CRYPTO_IPCRYPT_KEYBYTES.
+  . SODIUM_CRYPTO_IPCRYPT_ND_KEYBYTES.
+  . SODIUM_CRYPTO_IPCRYPT_ND_TWEAKBYTES.
+  . SODIUM_CRYPTO_IPCRYPT_ND_INPUTBYTES.
+  . SODIUM_CRYPTO_IPCRYPT_ND_OUTPUTBYTES.
+  . SODIUM_CRYPTO_IPCRYPT_NDX_KEYBYTES.
+  . SODIUM_CRYPTO_IPCRYPT_NDX_TWEAKBYTES.
+  . SODIUM_CRYPTO_IPCRYPT_NDX_INPUTBYTES.
+  . SODIUM_CRYPTO_IPCRYPT_NDX_OUTPUTBYTES.
+  . SODIUM_CRYPTO_IPCRYPT_PFX_KEYBYTES.
+  . SODIUM_CRYPTO_IPCRYPT_PFX_BYTES.
+  . SODIUM_CRYPTO_XOF_SHAKE128_BLOCKBYTES.
+  . SODIUM_CRYPTO_XOF_SHAKE128_STATEBYTES.
+  . SODIUM_CRYPTO_XOF_SHAKE256_BLOCKBYTES.
+  . SODIUM_CRYPTO_XOF_SHAKE256_STATEBYTES.
+  . SODIUM_CRYPTO_XOF_TURBOSHAKE128_BLOCKBYTES.
+  . SODIUM_CRYPTO_XOF_TURBOSHAKE128_STATEBYTES.
+  . SODIUM_CRYPTO_XOF_TURBOSHAKE256_BLOCKBYTES.
+  . SODIUM_CRYPTO_XOF_TURBOSHAKE256_STATEBYTES.
 
 - Standard:
   . ARRAY_FILTER_USE_VALUE.
@@ -871,6 +917,15 @@ PHP 8.6 UPGRADE NOTES
 11. Changes to INI File Handling
 ========================================
 
+- Core:
+  . The error_include_args INI option has been added to make the display of
+    function arguments consistent in errors; it is off by default. Previously,
+    some functions shown a parameter in the error that was up to each call to
+    the internal error function. Now, all parameters as were actually passed to
+    the function will be displayed. This uses the same infrastructure as stack
+    traces, so i.e. sensitive parameters will not be displayed, and strings
+    will be truncated according to zend.exception_string_param_max_len.
+
 - Mbstring:
   . The mbstring.detect_order INI directive now updates the internal detection
     order when changed at runtime via ini_set(). Previously, runtime changes
@@ -940,6 +995,9 @@ PHP 8.6 UPGRADE NOTES
   . Made splitText() faster and consume less memory.
 
 - GD:
+  . imagebmp(), imagewbmp(), imagegd(), and imagegd2() now buffer output when
+    writing to PHP streams, significantly improving performance when writing
+    images to files.
   . Improved performance of imagegrabscreen() and imagegrabwindow() on
     Windows.
 
@@ -960,6 +1018,7 @@ PHP 8.6 UPGRADE NOTES
 
 - Standard:
   . Improved performance of array_chunk() when not preserving keys.
+  . Improved performance of sorting single-element arrays.
   . Improved performance of array_fill_keys().
   . Improved performance of array_intersect().
   . Improved performance of array_map() with multiple arrays passed.

Zend/Optimizer/zend_func_infos.h

@@ -95,7 +95,7 @@ static const func_info_t func_infos[] = {
 	F1("finfo_buffer", MAY_BE_STRING|MAY_BE_FALSE),
 	F1("mime_content_type", MAY_BE_STRING|MAY_BE_FALSE),
 	F1("filter_input_array", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_KEY_STRING|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF|MAY_BE_FALSE|MAY_BE_NULL),
-	F1("filter_var_array", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_KEY_STRING|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF|MAY_BE_FALSE|MAY_BE_NULL),
+	F1("filter_var_array", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_KEY_STRING|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF|MAY_BE_FALSE),
 	F1("filter_list", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_OF_STRING),
 	F1("ftp_raw", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_OF_STRING|MAY_BE_NULL),
 	F1("ftp_nlist", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_OF_STRING|MAY_BE_FALSE),

Zend/tests/is_a_string.phpt

@@ -0,0 +1,16 @@
+--TEST--
+is_a() with $allow_string false and a string
+--FILE--
+<?php
+
+class Demo {}
+
+var_dump(is_a(Demo::class, Demo::class, true));
+var_dump(is_a(Demo::class, Demo::class, false));
+
+?>
+--EXPECTF--
+bool(true)
+
+Deprecated: Calling is_a() with a string when $allow_string is false in %s on line %d
+bool(false)

Zend/tests/is_subclass_of_string.phpt

@@ -0,0 +1,18 @@
+--TEST--
+is_subclass_of() with $allow_string false and a string
+--FILE--
+<?php
+
+class Demo {}
+
+class Child extends Demo {}
+
+var_dump(is_subclass_of(Child::class, Demo::class, true));
+var_dump(is_subclass_of(Child::class, Demo::class, false));
+
+?>
+--EXPECTF--
+bool(true)
+
+Deprecated: Calling is_subclass_of() with a string when $allow_string is false in %s on line %d
+bool(false)

Zend/zend.c

@@ -1487,13 +1487,14 @@ ZEND_API ZEND_COLD void zend_error_zstr_at(
 		info->lineno = error_lineno;
 		info->filename = zend_string_copy(error_filename);
 		info->message = zend_string_copy(message);
-		EG(errors).size++;
-		if (EG(errors).size > EG(errors).capacity) {
+		uint32_t new_size = EG(errors).size + 1;
+		if (new_size > EG(errors).capacity) {
 			uint32_t capacity = EG(errors).capacity ? EG(errors).capacity + (EG(errors).capacity >> 1) : 2;
 			EG(errors).errors = erealloc(EG(errors).errors, sizeof(zend_error_info *) * capacity);
 			EG(errors).capacity = capacity;
 		}
-		EG(errors).errors[EG(errors).size - 1] = info;
+		EG(errors).errors[EG(errors).size] = info;
+		EG(errors).size = new_size;
 
 		/* Do not process non-fatal recorded error */
 		if (!(type & E_FATAL_ERRORS) || (type & E_DONT_BAIL)) {

Zend/zend_alloc.c

@@ -1841,6 +1841,20 @@ static zend_always_inline void *zend_mm_realloc_heap(zend_mm_heap *heap, void *p
 /* Huge Runs (again) */
 /*********************/
 
+/* Huge block metadata is allocated from the very heap it describes, so a heap
+ * overflow can reach it. size ends up as a munmap() length, where a corrupted
+ * value would unmap unrelated mappings, so bound it before use: a live block is
+ * page aligned and is still accounted for in real_size. */
+static zend_always_inline void zend_mm_check_huge_block_size(const zend_mm_heap *heap, size_t size)
+{
+	ZEND_MM_CHECK(size != 0 && ZEND_MM_ALIGNED_OFFSET(size, REAL_PAGE_SIZE) == 0, "zend_mm_heap corrupted");
+#if ZEND_MM_STAT || ZEND_MM_LIMIT
+	ZEND_MM_CHECK(size <= heap->real_size, "zend_mm_heap corrupted");
+#else
+	(void)heap;
+#endif
+}
+
 #if ZEND_DEBUG
 static void zend_mm_add_huge_block(zend_mm_heap *heap, void *ptr, size_t size, size_t dbg_size ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)
 #else
@@ -1890,6 +1904,7 @@ static size_t zend_mm_get_huge_block_size(zend_mm_heap *heap, void *ptr ZEND_FIL
 	zend_mm_huge_list *list = heap->huge_list;
 	while (list != NULL) {
 		if (list->ptr == ptr) {
+			zend_mm_check_huge_block_size(heap, list->size);
 			return list->size;
 		}
 		list = list->next;
@@ -2000,6 +2015,7 @@ static void zend_mm_free_huge(zend_mm_heap *heap, void *ptr ZEND_FILE_LINE_DC ZE
 
 	ZEND_MM_CHECK(ZEND_MM_ALIGNED_OFFSET(ptr, ZEND_MM_CHUNK_SIZE) == 0, "zend_mm_heap corrupted");
 	size = zend_mm_del_huge_block(heap, ptr ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
+	zend_mm_check_huge_block_size(heap, size);
 	zend_mm_chunk_free(heap, ptr, size);
 #if ZEND_MM_STAT || ZEND_MM_LIMIT
 	heap->real_size -= size;
@@ -2492,6 +2508,7 @@ ZEND_API void zend_mm_shutdown(zend_mm_heap *heap, bool full, bool silent)
 	while (list) {
 		zend_mm_huge_list *q = list;
 		list = list->next;
+		zend_mm_check_huge_block_size(heap, q->size);
 		zend_mm_chunk_free(heap, q->ptr, q->size);
 	}