Merge branch 'php:master' into master

edorian · web-flow · commit 800d8377b8ab · 2026-05-22T19:18:25.000+02:00
diff --git a/.github/actions/setup-windows/action.yml b/.github/actions/setup-windows/action.yml
@@ -16,5 +16,6 @@ runs:
     - name: Setup PostgreSQL
       shell: pwsh
       run: |
-        Set-Service -Name "postgresql-x64-14" -StartupType manual -Status Running
+        $postgresService = if ($env:PHP_BUILD_CRT -eq "vs18") { "postgresql-x64-17" } else { "postgresql-x64-14" }
+        Set-Service -Name $postgresService -StartupType manual -Status Running
         pwsh -Command { $env:PGPASSWORD="root"; & "$env:PGBIN\psql" -U postgres -c "ALTER USER postgres WITH PASSWORD 'Password12!';" }
diff --git a/.github/matrix.php b/.github/matrix.php
@@ -153,9 +153,11 @@ function select_jobs($repository, $trigger, $nightly, $labels, $php_version, $re
             }
         }
         $jobs['WINDOWS']['matrix'] = ['include' => $matrix];
-        $jobs['WINDOWS']['config'] = version_compare($php_version, '8.4', '>=')
-            ? ['vs_crt_version' => 'vs17']
-            : ['vs_crt_version' => 'vs16'];
+        $jobs['WINDOWS']['config'] = match (true) {
+            version_compare($php_version, '8.6', '>=') => ['vs_crt_version' => 'vs18', 'runs_on' => 'windows-2025-vs2026'],
+            version_compare($php_version, '8.4', '>=') => ['vs_crt_version' => 'vs17', 'runs_on' => 'windows-2022'],
+            default => ['vs_crt_version' => 'vs16', 'runs_on' => 'windows-2022'],
+        };
     }
     if ($all_jobs || !$no_jobs || $test_freebsd) {
         $jobs['FREEBSD']['matrix'] = $all_variations && version_compare($php_version, '8.3', '>=')
diff --git a/.github/scripts/windows/find-vs-toolset.bat b/.github/scripts/windows/find-vs-toolset.bat
@@ -3,14 +3,15 @@
 setlocal enabledelayedexpansion
 
 if "%~1"=="" (
-  echo ERROR: Usage: %~nx0 [vc14^|vc15^|vs16^|vs17]
+  echo ERROR: Usage: %~nx0 [vc14^|vc15^|vs16^|vs17^|vs18]
   exit /b 1
 )
 
 set "toolsets_vc14=14.0"
 set "toolsets_vc15="
 set "toolsets_vs16="
 set "toolsets_vs17="
+set "toolsets_vs18="
 
 
 for /f "usebackq tokens=*" %%I in (`vswhere.exe -latest -find "VC\Tools\MSVC"`) do set "MSVCDIR=%%I"
@@ -30,8 +31,10 @@ for /f "delims=" %%D in ('dir /b /ad "%MSVCDIR%"') do (
         set "toolsets_vc15=%%D"
       ) else if !min! LEQ 29 (
         set "toolsets_vs16=%%D"
-      ) else (
+      ) else if !min! LEQ 49 (
         set "toolsets_vs17=%%D"
+      ) else (
+        set "toolsets_vs18=%%D"
       )
     )
   )
diff --git a/.github/workflows/test-suite.yml b/.github/workflows/test-suite.yml
@@ -941,12 +941,12 @@ jobs:
       fail-fast: false
       matrix: ${{ fromJson(inputs.branch).jobs.WINDOWS.matrix }}
     name: "WINDOWS_${{ matrix.x64 && 'X64' || 'X86' }}_${{ matrix.zts && 'ZTS' || 'NTS' }}${{ matrix.asan && '_ASAN' || ''}}${{ matrix.clang && '_CLANG' || ''}}"
-    runs-on: windows-2022
+    runs-on: ${{ fromJson(inputs.branch).jobs.WINDOWS.config.runs_on }}
     env:
       PHP_BUILD_CACHE_BASE_DIR: C:\build-cache
       PHP_BUILD_OBJ_DIR: C:\obj
       PHP_BUILD_CACHE_SDK_DIR: C:\build-cache\sdk
-      PHP_BUILD_SDK_BRANCH: php-sdk-2.5.0
+      PHP_BUILD_SDK_BRANCH: php-sdk-2.7.1
       PHP_BUILD_CRT: ${{ fromJson(inputs.branch).jobs.WINDOWS.config.vs_crt_version }}
       PLATFORM: ${{ matrix.x64 && 'x64' || 'x86' }}
       THREAD_SAFE: "${{ matrix.zts && '1' || '0' }}"
diff --git a/SECURITY.md b/SECURITY.md
@@ -11,6 +11,29 @@ Vulnerability reports remain private until published. When published, you will
 be credited as a contributor, and your contribution will reflect the MITRE
 Credit System.
 
+# Classification
+
+Issues commonly reported that are _not_ considered security issues include (but
+are not limited to):
+
+- Invocation of specially crafted, malicious code intended to cause memory
+  violations. This commonly includes malicious error handlers, destructors or
+  `__toString()` functions. PHP does not offer sandboxing, and the execution of
+  untrusted code is always considered unsafe. Such issues are bugs, but not
+  security issues. They may still be reported, though please avoid reporting
+  the known issues.
+
+- Passing malicious arguments to functions clearly not intended to receive
+  unsanitized values, e.g. `mysqli_query()`. `escapeshellarg()` on the other
+  hand should clearly be hardened against unsafe inputs.
+
+- The use of legacy APIs or settings known to be insecure, particularly those
+  documented as such, or those with a secure alternative.
+
+- The use of FFI.
+
+- `open_basedir` or `disable_functions` bypasses.
+
 # Vulnerability Policy
 
 Our full policy is described at
diff --git a/Zend/Optimizer/zend_optimizer.c b/Zend/Optimizer/zend_optimizer.c
@@ -943,7 +943,7 @@ zend_function *zend_optimizer_get_called_func(
 				if (ce) {
 					zend_string *func_name = Z_STR_P(CRT_CONSTANT(opline->op2) + 1);
 					zend_function *fbc = zend_hash_find_ptr(&ce->function_table, func_name);
-					if (fbc) {
+					if (fbc && !(fbc->common.fn_flags & ZEND_ACC_ABSTRACT)) {
 						bool is_public = (fbc->common.fn_flags & ZEND_ACC_PUBLIC) != 0;
 						bool same_scope = fbc->common.scope == op_array->scope;
 						if (is_public || same_scope) {
diff --git a/Zend/zend_vm.h b/Zend/zend_vm.h
@@ -40,7 +40,7 @@ void zend_vm_init(void);
 void zend_vm_dtor(void);
 
 #if ZEND_VM_KIND == ZEND_VM_KIND_TAILCALL
-const struct _zend_op *zend_vm_handle_interrupt(struct _zend_execute_data *execute_data, const struct _zend_op *opline);
+const struct _zend_op *ZEND_FASTCALL zend_vm_handle_interrupt(struct _zend_execute_data *execute_data, const struct _zend_op *opline);
 #endif
 
 END_EXTERN_C()
diff --git a/ext/com_dotnet/tests/variants.phpt b/ext/com_dotnet/tests/variants.phpt
@@ -43,7 +43,7 @@ foreach ($values as $t => $val) {
 
 echo "OK!";
 ?>
---EXPECT--
+--EXPECTF--
 --
 add: 84
 cat: 4242
@@ -142,8 +142,8 @@ mul: 0
 and: 0
 div:
 	variant_div(42, )
-	exception Division by zero
-	code 80020012
+	exception %s
+	code 800200%x
 
 eqv: -43
 idiv:
@@ -258,8 +258,8 @@ mul: 0
 and: 0
 div:
 	variant_div(3.5, )
-	exception Division by zero
-	code 80020012
+	exception %s
+	code 800200%x
 
 eqv: -5
 idiv:
diff --git a/ext/curl/config.w32 b/ext/curl/config.w32
@@ -12,11 +12,18 @@ if (PHP_CURL != "no") {
 		SETUP_ZLIB_LIB("curl", PHP_CURL) &&
 		(CHECK_LIB("normaliz.lib", "curl", PHP_CURL) &&
 		 CHECK_LIB("libssh2.lib", "curl", PHP_CURL) &&
-		 CHECK_LIB("nghttp2.lib", "curl", PHP_CURL) &&
-		 CHECK_LIB("brotlidec.lib", "curl", PHP_CURL) &&
-		 CHECK_LIB("brotlicommon.lib", "curl", PHP_CURL) &&
-		 CHECK_LIB("libzstd.lib", "curl", PHP_CURL))
+		 CHECK_LIB("nghttp2.lib", "curl", PHP_CURL))
 		) {
+		if (!(CHECK_HEADER_ADD_INCLUDE("brotli/decode.h", "CFLAGS_CURL") &&
+			CHECK_LIB("brotlidec.lib;brotlidec-static.lib", "curl", PHP_CURL) &&
+			CHECK_LIB("brotlicommon.lib;brotlicommon-static.lib", "curl", PHP_CURL)
+		)) {
+			WARNING("brotli in curl not enabled; libraries or headers not found");
+		}
+		if (!(CHECK_LIB("libzstd.lib;libzstd_a.lib", "curl", PHP_CURL)
+		)) {
+			WARNING("zstd in curl not enabled; library not found");
+		}
 		EXTENSION("curl", "interface.c multi.c share.c curl_file.c");
 		AC_DEFINE('HAVE_CURL', 1, "Define to 1 if the PHP extension 'curl' is available.");
 		ADD_FLAG("CFLAGS_CURL", "/D PHP_CURL_EXPORTS=1");
diff --git a/ext/intl/calendar/calendar_methods.cpp b/ext/intl/calendar/calendar_methods.cpp
@@ -373,7 +373,7 @@ static void _php_intlcal_before_after(
 
 	when_co = Z_INTL_CALENDAR_P(when_object);
 	if (when_co->ucal == NULL) {
-		zend_argument_error(NULL, 2, "is uninitialized");
+		zend_argument_error(NULL, hasThis() ? 1 : 2, "is uninitialized");
 		RETURN_THROWS();
 	}
 
@@ -796,7 +796,7 @@ U_CFUNC PHP_FUNCTION(intlcal_is_equivalent_to)
 
 	other_co = Z_INTL_CALENDAR_P(other_object);
 	if (other_co->ucal == NULL) {
-		zend_argument_error(NULL, 2, "is uninitialized");
+		zend_argument_error(NULL, hasThis() ? 1 : 2, "is uninitialized");
 		RETURN_THROWS();
 	}
 
@@ -933,7 +933,7 @@ U_CFUNC PHP_FUNCTION(intlcal_equals)
 	CALENDAR_METHOD_FETCH_OBJECT;
 	other_co = Z_INTL_CALENDAR_P(other_object);
 	if (other_co->ucal == NULL) {
-		zend_argument_error(NULL, 2, "is uninitialized");
+		zend_argument_error(NULL, hasThis() ? 1 : 2, "is uninitialized");
 		RETURN_THROWS();
 	}
 
diff --git a/ext/intl/tests/calendar_uninitialized_argument_position.phpt b/ext/intl/tests/calendar_uninitialized_argument_position.phpt
@@ -0,0 +1,36 @@
+--TEST--
+IntlCalendar methods report the correct argument position for uninitialized calendar arguments
+--EXTENSIONS--
+intl
+--FILE--
+<?php
+
+$calendar = IntlGregorianCalendar::createFromDate(2024, 0, 1);
+$uninitialized = (new ReflectionClass(IntlGregorianCalendar::class))->newInstanceWithoutConstructor();
+
+foreach (['equals', 'before', 'after', 'isEquivalentTo'] as $method) {
+    try {
+        $calendar->$method($uninitialized);
+    } catch (Error $e) {
+        echo $method, ': ', $e->getMessage(), PHP_EOL;
+    }
+}
+
+foreach (['intlcal_equals', 'intlcal_before', 'intlcal_after', 'intlcal_is_equivalent_to'] as $function) {
+    try {
+        $function($calendar, $uninitialized);
+    } catch (Error $e) {
+        echo $function, ': ', $e->getMessage(), PHP_EOL;
+    }
+}
+
+?>
+--EXPECT--
+equals: IntlCalendar::equals(): Argument #1 ($other) is uninitialized
+before: IntlCalendar::before(): Argument #1 ($other) is uninitialized
+after: IntlCalendar::after(): Argument #1 ($other) is uninitialized
+isEquivalentTo: IntlCalendar::isEquivalentTo(): Argument #1 ($other) is uninitialized
+intlcal_equals: intlcal_equals(): Argument #2 ($other) is uninitialized
+intlcal_before: intlcal_before(): Argument #2 ($other) is uninitialized
+intlcal_after: intlcal_after(): Argument #2 ($other) is uninitialized
+intlcal_is_equivalent_to: intlcal_is_equivalent_to(): Argument #2 ($other) is uninitialized
diff --git a/ext/opcache/tests/gh22071.phpt b/ext/opcache/tests/gh22071.phpt
@@ -0,0 +1,20 @@
+--TEST--
+GH-22071: Assertion failure jit_CONST_FUNC_PROTO on abstract static method call
+--CREDITS--
+YuanchengJiang
+--EXTENSIONS--
+opcache
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.jit=1205
+opcache.jit_buffer_size=16M
+--FILE--
+<?php
+try {
+    $e = enum_exists('UnitEnum') ? UnitEnum::cases() : [];
+} catch (\Throwable $_e) {}
+echo "ok\n";
+?>
+--EXPECT--
+ok
diff --git a/ext/phar/tests/tar/gh21986.phpt b/ext/phar/tests/tar/gh21986.phpt
@@ -0,0 +1,43 @@
+--TEST--
+GH-21986 (PharData::getContent() crash on circular symlink chain in tar)
+--EXTENSIONS--
+phar
+--FILE--
+<?php
+function tar_symlink($name, $target) {
+    $h  = str_pad($name, 100, "\0");
+    $h .= "0000777\0";
+    $h .= "0000000\0";
+    $h .= "0000000\0";
+    $h .= "00000000000\0";
+    $h .= "00000000000\0";
+    $h .= str_repeat(' ', 8);
+    $h .= '2';
+    $h .= str_pad($target, 100, "\0");
+    $h .= "ustar\0" . "00";
+    $h  = str_pad($h, 512, "\0");
+
+    $sum = 0;
+    for ($i = 0; $i < 512; $i++) {
+        $sum += ord($h[$i]);
+    }
+    return substr_replace($h, sprintf("%06o\0 ", $sum), 148, 8);
+}
+
+$tar = __DIR__ . '/gh21986.tar';
+file_put_contents(
+    $tar,
+    tar_symlink('a.txt', 'b.txt') .
+    tar_symlink('b.txt', 'a.txt') .
+    str_repeat("\0", 1024)
+);
+
+$phar = new PharData($tar);
+var_dump($phar['a.txt']->getContent());
+?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . '/gh21986.tar');
+?>
+--EXPECT--
+string(0) ""
diff --git a/ext/phar/util.c b/ext/phar/util.c
@@ -66,23 +66,30 @@ static zend_string *phar_get_link_location(phar_entry_info *entry) /* {{{ */
 phar_entry_info *phar_get_link_source(phar_entry_info *entry) /* {{{ */
 {
 	phar_entry_info *link_entry;
+	uint32_t depth = 0, max_depth;
 
 	if (!entry->symlink) {
 		return entry;
 	}
 
-	link_entry = zend_hash_find_ptr(&(entry->phar->manifest), entry->symlink);
-	if (link_entry) {
-		return phar_get_link_source(link_entry);
-	}
+	max_depth = zend_hash_num_elements(&(entry->phar->manifest));
 
-	zend_string *link = phar_get_link_location(entry);
-	link_entry = zend_hash_find_ptr(&(entry->phar->manifest), link);
-	zend_string_release(link);
-	if (link_entry) {
-		return phar_get_link_source(link_entry);
+	while (entry->symlink) {
+		if (UNEXPECTED(++depth > max_depth)) {
+			return NULL;
+		}
+		zend_string *link = phar_get_link_location(entry);
+
+		if (NULL != (link_entry = zend_hash_find_ptr(&(entry->phar->manifest), entry->symlink)) ||
+			NULL != (link_entry = zend_hash_find_ptr(&(entry->phar->manifest), link))) {
+			zend_string_release(link);
+			entry = link_entry;
+		} else {
+			zend_string_release(link);
+			return NULL;
+		}
 	}
-	return NULL;
+	return entry;
 }
 /* }}} */
 
diff --git a/ext/soap/php_encoding.c b/ext/soap/php_encoding.c
diff --git a/ext/soap/php_packet_soap.c b/ext/soap/php_packet_soap.c
diff --git a/ext/soap/soap.c b/ext/soap/soap.c
diff --git a/ext/soap/tests/soap_array_index_overflow.phpt b/ext/soap/tests/soap_array_index_overflow.phpt
diff --git a/win32/build/confutils.js b/win32/build/confutils.js

Original file line number	Diff line number	Diff line change
`@@ -153,9 +153,11 @@ function select_jobs($repository, $trigger, $nightly, $labels, $php_version, $re`
`153`	`153`	`}`
`154`	`154`	`}`
`155`	`155`	`$jobs['WINDOWS']['matrix'] = ['include' => $matrix];`
`156`		`- $jobs['WINDOWS']['config'] = version_compare($php_version, '8.4', '>=')`
`157`		`- ? ['vs_crt_version' => 'vs17']`
`158`		`- : ['vs_crt_version' => 'vs16'];`
	`156`	`+ $jobs['WINDOWS']['config'] = match (true) {`
	`157`	`+ version_compare($php_version, '8.6', '>=') => ['vs_crt_version' => 'vs18', 'runs_on' => 'windows-2025-vs2026'],`
	`158`	`+ version_compare($php_version, '8.4', '>=') => ['vs_crt_version' => 'vs17', 'runs_on' => 'windows-2022'],`
	`159`	`+ default => ['vs_crt_version' => 'vs16', 'runs_on' => 'windows-2022'],`
	`160`	`+ };`
`159`	`161`	`}`
`160`	`162`	`if ($all_jobs \|\| !$no_jobs \|\| $test_freebsd) {`
`161`	`163`	`$jobs['FREEBSD']['matrix'] = $all_variations && version_compare($php_version, '8.3', '>=')`
Original file line number	Diff line number	Diff line change
`@@ -3,14 +3,15 @@`
`3`	`3`	`setlocal enabledelayedexpansion`
`4`	`4`
`5`	`5`	`if "%~1"=="" (`
`6`		`- echo ERROR: Usage: %~nx0 [vc14^\|vc15^\|vs16^\|vs17]`
	`6`	`+ echo ERROR: Usage: %~nx0 [vc14^\|vc15^\|vs16^\|vs17^\|vs18]`
`7`	`7`	`exit /b 1`
`8`	`8`	`)`
`9`	`9`
`10`	`10`	`set "toolsets_vc14=14.0"`
`11`	`11`	`set "toolsets_vc15="`
`12`	`12`	`set "toolsets_vs16="`
`13`	`13`	`set "toolsets_vs17="`
	`14`	`+set "toolsets_vs18="`
`14`	`15`
`15`	`16`
`16`	`17`	for /f "usebackq tokens=*" %%I in (`vswhere.exe -latest -find "VC\Tools\MSVC"`) do set "MSVCDIR=%%I"
`@@ -30,8 +31,10 @@ for /f "delims=" %%D in ('dir /b /ad "%MSVCDIR%"') do (`
`30`	`31`	`set "toolsets_vc15=%%D"`
`31`	`32`	`) else if !min! LEQ 29 (`
`32`	`33`	`set "toolsets_vs16=%%D"`
`33`		`- ) else (`
	`34`	`+ ) else if !min! LEQ 49 (`
`34`	`35`	`set "toolsets_vs17=%%D"`
	`36`	`+ ) else (`
	`37`	`+ set "toolsets_vs18=%%D"`
`35`	`38`	`)`
`36`	`39`	`)`
`37`	`40`	`)`