-
Notifications
You must be signed in to change notification settings - Fork 7.7k
/
NEWS
1585 lines (1244 loc) · 53.1 KB
/
NEWS
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
PHP NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
03 Aug 2023, PHP 8.0.30
- Libxml:
. Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading
in XML without enabling it). (CVE-2023-3823) (nielsdos, ilutov)
- Phar:
. Fixed bug GHSA-jqcx-ccgc-xwhv (Buffer mismanagement in phar_dir_read()).
(CVE-2023-3824) (nielsdos)
08 Jun 2023, PHP 8.0.29
- Soap:
. Fixed bug GHSA-76gg-c692-v2mw (Missing error check and insufficient random
bytes in HTTP Digest authentication for SOAP).
(CVE-2023-3247) (nielsdos, timwolla)
14 Feb 2023, PHP 8.0.28
- Core:
. Fixed bug #81744 (Password_verify() always return true with some hash).
(CVE-2023-0567). (Tim Düsterhus)
. Fixed bug #81746 (1-byte array overrun in common path resolve code).
(CVE-2023-0568). (Niels Dossche)
- SAPI:
. Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart
request body). (CVE-2023-0662) (Jakub Zelenka)
05 Jan 2023, PHP 8.0.27
- PDO/SQLite:
. Fixed bug #81740 (PDO::quote() may return unquoted string). (CVE-2022-31631)
(cmb)
24 Nov 2022, PHP 8.0.26
- CLI:
. Fixed bug GH-9709 (Null pointer dereference with -w/-s options). (Adam Saponara)
- Core:
. Fixed bug GH-9752 (Generator crashes when interrupted during argument
evaluation with extra named params). (Arnaud)
. Fixed bug GH-9801 (Generator crashes when memory limit is exceeded during
initialization). (Arnaud)
. Fixed potential NULL pointer dereference in Windows shm*() functions. (cmb)
. Fixed bug GH-9750 (Generator memory leak when interrupted during argument
evaluation. (Arnaud)
- Date:
. Fixed bug GH-9763 (DateTimeZone ctr mishandles input and adds null byte if
the argument is an offset larger than 100*60 minutes). (Derick)
- FPM:
. Fixed bug GH-9754 (SaltStack (using Python subprocess) hangs when running
php-fpm 8.1.11). (Jakub Zelenka)
. Fixed bug GH-9959 (Solaris port event mechanism is still broken after bug
#66694). (Petr Sumbera)
- mysqli:
. Fixed bug GH-9841 (mysqli_query throws warning despite using
silenced error mode). (Kamil Tekiela)
- OpenSSL:
. Fixed bug GH-8430 (OpenSSL compiled with no-md2, no-md4 or no-rmd160 does
not build). (Jakub Zelenka, fsbruva)
- SOAP:
. Fixed GH-9720 (Null pointer dereference while serializing the response).
(cmb)
27 Oct 2022, PHP 8.0.25
- GD:
. Fixed bug #81739: OOB read due to insufficient input validation in
imageloadfont(). (CVE-2022-31630) (cmb)
- Hash:
. Fixed bug #81738: buffer overflow in hash_update() on long parameter.
(CVE-2022-37454) (nicky at mouha dot be)
- Session:
. Fixed bug GH-9583 (session_create_id() fails with user defined save handler
that doesn't have a validateId() method). (Girgias)
- Streams:
. Fixed bug GH-9590 (stream_select does not abort upon exception or empty
valid fd set). (Arnaud)
29 Sep 2022, PHP 8.0.24
- Core:
. Fixed bug GH-9323 (Crash in ZEND_RETURN/GC/zend_call_function)
(Tim Starling)
. Fixed bug GH-9361 (Segmentation fault on script exit #9379). (cmb,
Christian Schneider)
. Fixed bug GH-9407 (LSP error in eval'd code refers to wrong class for static
type). (ilutov)
. Fixed bug #81727: Don't mangle HTTP variable names that clash with ones
that have a specific semantic meaning. (CVE-2022-31629). (Derick)
- DOM:
. Fixed bug #79451 (DOMDocument->replaceChild on doctype causes double free).
(Nathan Freeman)
- FPM:
. Fixed bug GH-8885 (FPM access.log with stderr begins to write logs to
error_log after daemon reload). (Dmitry Menshikov)
. Fixed bug #77780 ("Headers already sent..." when previous connection was
aborted). (Jakub Zelenka)
- GMP
. Fixed bug GH-9308 (GMP throws the wrong error when a GMP object is passed
to gmp_init()). (Girgias)
- Intl
. Fixed bug GH-9421 (Incorrect argument number for ValueError in NumberFormatter).
(Girgias)
- PDO_PGSQL:
. Fixed bug GH-9411 (PgSQL large object resource is incorrectly closed).
(Yurunsoft)
- Phar:
. Fixed bug #81726: phar wrapper: DOS when using quine gzip file.
(CVE-2022-31628). (cmb)
- Reflection:
. Fixed bug GH-8932 (ReflectionFunction provides no way to get the called
class of a Closure). (cmb, Nicolas Grekas)
. Fixed bug GH-9409 (Private method is incorrectly dumped as "overwrites").
(ilutov)
- Streams:
. Fixed bug GH-9316 ($http_response_header is wrong for long status line).
(cmb, timwolla)
01 Sep 2022, PHP 8.0.23
- Core:
. Fixed incorrect double to long casting in latest clang. (zeriyoshi)
- DBA:
. Fixed LMDB driver memory leak on DB creation failure (Girgias)
. Fixed bug GH-9155 (dba_open("non-existing", "c-", "flatfile") segfaults).
(cmb)
- Intl:
. Fixed IntlDateFormatter::formatObject() parameter type. (Gert de Pagter)
- OPcache:
. Fixed bug GH-9033 (Loading blacklist file can fail due to negative length).
(cmb)
- OpenSSL:
. Fixed bug GH-9339 (OpenSSL oid_file path check warning contains
uninitialized path). (Jakub Zelenka)
- PDO_SQLite:
. Fixed bug GH-9032 (SQLite3 authorizer crashes on NULL values). (cmb)
- SQLite3:
. Fixed bug GH-9032 (SQLite3 authorizer crashes on NULL values). (cmb)
- Standard:
. Fixed bug GH-9017 (php_stream_sock_open_from_socket could return NULL).
(Heiko Weber)
- Streams:
. Fixed bug GH-8472 (The resource returned by stream_socket_accept may have
incorrect metadata). (Jakub Zelenka)
. Fixed bug GH-8409 (SSL handshake timeout leaves persistent connections
hanging). (Jakub Zelenka, Twosee)
04 Aug 2022, PHP 8.0.22
- CLI:
. Fixed potential overflow for the builtin server via the PHP_CLI_SERVER_WORKERS
environment variable. (yiyuaner)
- Core:
. Fixed bug GH-8923 (error_log on Windows can hold the file write lock). (cmb)
. Fixed bug GH-8995 (WeakMap object reference offset causing TypeError).
(Tobias Bachert)
- Date:
. Fixed bug #80047 (DatePeriod doesn't warn with custom DateTimeImmutable).
(Derick)
- DBA:
. Fixed LMDB driver hanging when attempting to delete a non-existing key
(Girgias)
- FPM:
. Fixed zlog message prepend, free on incorrect address. (Heiko Weber)
. Fixed possible double free on configuration loading failure. (Heiko Weber).
- GD:
. Fixed bug GH-8848 (imagecopyresized() error refers to the wrong argument).
(cmb)
- Intl:
. Fixed build for ICU 69.x and onwards. (David Carlier)
- OPcache:
. Fixed bug GH-8847 (PHP hanging infinitly at 100% cpu when check php
syntaxe of a valid file). (Dmitry)
- Standard:
. Fixed the crypt_sha256/512 api build with clang > 12. (David Carlier)
. Uses CCRandomGenerateBytes instead of arc4random_buf on macOs. (David Carlier).
07 Jul 2022, PHP 8.0.21
- Core:
. Fixed potential use after free in php_binary_init(). (Heiko Weber)
- CLI:
. Fixed GH-8827 (Intentionally closing std handles no longer possible). (cmb)
- COM:
. Fixed bug GH-8778 (Integer arithmethic with large number variants fails).
(cmb)
- Curl:
. Fixed CURLOPT_TLSAUTH_TYPE is not treated as a string option. (Pierrick)
- Date:
. Fixed bug #74671 (DST timezone abbreviation has incorrect offset). (Derick)
. Fixed bug #77243 (Weekdays are calculated incorrectly for negative years).
(Derick)
. Fixed bug #78139 (timezone_open accepts invalid timezone string argument).
(Derick)
- FPM:
. Fixed bug #67764 (fpm: syslog.ident don't work). (Jakub Zelenka)
- MBString:
. Fixed bug GH-8685 (pcre not ready at mbstring startup). (Remi)
- ODBC:
. Fixed handling of single-key connection strings. (Calvin Buckley)
- OpenSSL:
. Fixed bug #50293 (Several openssl functions ignore the VCWD).
(Jakub Zelenka, cmb)
. Fixed bug #81713 (NULL byte injection in several OpenSSL functions working
with certificates). (Jakub Zelenka)
- PDO_ODBC:
. Fixed errorInfo() result on successful PDOStatement->execute(). (Yurunsoft)
. Fixed handling of single-key connection strings. (Calvin Buckley)
- Zip:
. Fixed bug GH-8781 (ZipArchive::close deletes zip file without updating stat
cache). (Remi)
09 Jun 2022, PHP 8.0.20
- CLI:
. Fixed bug GH-8575 (CLI closes standard streams too early). (Levi Morrison)
- Core:
. Fixed Haiku ZTS builds. (David Carlier)
- Date:
. Fixed bug #72963 (Null-byte injection in CreateFromFormat and related
functions). (Derick)
. Fixed bug GH-8471 (Segmentation fault when converting immutable and mutable
DateTime instances created using reflection). (Derick)
- FPM:
. Fixed ACL build check on MacOS. (David Carlier)
. Fixed bug #72185: php-fpm writes empty fcgi record causing nginx 502.
(Jakub Zelenka, loveharmful)
. Fixes use after free. (Heiko Weber).
- Mysqlnd:
. Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
(c dot fol at ambionics dot io)
- OPcache:
. Fixed bug GH-8466 (ini_get() is optimized out when the option does not
exist). (Arnaud)
- Pgsql:
. Fixed bug #81720: Uninitialized array in pg_query_params().
(CVE-2022-31625) (cmb)
- Pcntl:
. Fixed Haiku build. (David Carlier)
- Soap:
. Fixed bug GH-8578 (Error on wrong parameter on SoapHeader constructor).
(robertnisipeanu)
. Fixed bug GH-8538 (SoapClient may strip parts of nmtokens). (cmb)
- SPL:
. Fixed bug GH-8235 (iterator_count() may run indefinitely). (cmb)
- Zip:
. Fixed type for index in ZipArchive::replaceFile. (Martin Rehberger)
12 May 2022, PHP 8.0.19
- Core:
. Fixed bug GH-8289 (Exceptions thrown within a yielded from iterator are
not rethrown into the generator). (Bob)
- Date:
. Fixed bug GH-7979 (DatePeriod iterator advances when checking if valid).
(Derick, Cody Mann)
- FFI:
. Fixed bug GH-8433 (Assigning function pointers to structs in FFI leaks).
(Bob)
- FPM:
. Fixed bug #76003 (FPM /status reports wrong number of active processe).
(Jakub Zelenka)
. Fixed bug #77023 (FPM cannot shutdown processes). (Jakub Zelenka)
. Fixed comment in kqueue remove callback log message. (David Carlier)
- Iconv:
. Fixed bug GH-8218 (ob_end_clean does not reset Content-Encoding header).
(cmb)
- Intl:
. Fixed bug GH-8364 (msgfmt_format $values may not support references). (cmb)
- MySQLi:
. Fixed bug GH-8267 (MySQLi uses unsupported format specifier on Windows).
(cmb)
- SPL:
. Fixed bug GH-8366 (ArrayIterator may leak when calling __construct()).
(cmb)
. Fixed bug GH-8273 (SplFileObject: key() returns wrong value). (Girgias)
- Streams:
. Fixed php://temp does not preserve file-position when switched to temporary
file. (Bernd Holzmüller)
- zlib:
. Fixed bug GH-8218 (ob_end_clean does not reset Content-Encoding header).
(cmb)
14 Apr 2022, PHP 8.0.18
- Core:
. Fixed freeing of internal attribute arguments. (Bob)
. Fixed bug GH-8070 (memory leak of internal function attribute hash).
(Tim Düsterhus)
. Fixed bug GH-8160 (ZTS support on Alpine is broken). (Michael Voříšek)
. Fixed potential race condition during resource ID allocation. (ryancaicse)
- Filter:
. Fixed signedness confusion in php_filter_validate_domain(). (cmb)
- Hash:
. Fixed bug #81714 (segfault when serializing finalized HashContext). (cmb)
- Intl:
. Fixed bug GH-8142 (Compilation error on cygwin). (David Carlier)
- MBString:
. Fixed bug GH-8208 (mb_encode_mimeheader: $indent functionality broken).
(cmb)
- MySQLi:
. Fixed bug GH-8068 (mysqli_fetch_object creates inaccessible properties).
(cmb)
- Pcntl:
. Fixed bug GH-8142 (Compilation error on cygwin). (David Carlier)
- PgSQL:
. Fixed result_type related stack corruption on LLP64 architectures. (cmb)
. Fixed bug GH-8253 (pg_insert() fails for references). (cmb)
- Sockets:
. Fixed Solaris builds. (David Carlier)
. Fix undefined behavior in php_set_inet6_addr. (ilutov)
- SPL:
. Fixed bug GH-8121 (SplFileObject - seek and key with csv file inconsistent).
(cmb)
- Standard:
. Fixed bug GH-8048 (Force macOS to use statfs). (risner)
17 Mar 2022, PHP 8.0.17
- Core:
. Fixed Haiku ZTS build. (David Carlier)
- GD:
. Fixed libpng warning when loading interlaced images. (Brett)
- FPM:
. Fixed bug #76109 (Unsafe access to fpm scoreboard).
(Till Backhaus, Jakub Zelenka)
- Iconv:
. Fixed bug GH-7953 (ob_clean() only does not set Content-Encoding). (cmb)
. Fixed bug GH-7980 (Unexpected result for iconv_mime_decode). (cmb)
- MySQLnd:
. Fixed bug GH-8058 (NULL pointer dereference in mysqlnd package). (Kamil Tekiela)
- OPcache:
. Fixed bug GH-8074 (Wrong type inference of range() result). (cmb)
- Reflection:
. Fixed bug GH-8080 (ReflectionClass::getConstants() depends on def. order).
(cmb)
. Fixed bug GH-8421 (Closures should accept attributes with
Attribute::TARGET_FUNCTION). (ollieread)
- Zlib:
. Fixed bug GH-7953 (ob_clean() only does not set Content-Encoding). (cmb)
17 Feb 2022, PHP 8.0.16
- Core:
. Fixed bug #81430 (Attribute instantiation leaves dangling pointer).
(beberlei)
. Fixed bug GH-7896 (Environment vars may be mangled on Windows). (cmb)
- FFI:
. Fixed bug GH-7867 (FFI::cast() from pointer to array is broken). (cmb,
dmitry)
- Filter:
. Fix #81708: UAF due to php_filter_float() failing for ints.
(CVE-2021-21708) (stas)
- FPM:
. Fixed memory leak on invalid port. (David Carlier)
- MBString:
. Fixed bug GH-7902 (mb_send_mail may delimit headers with LF only). (cmb)
- MySQLnd:
. Fixed bug GH-7972 (MariaDB version prefix 5.5.5- is not stripped). (Kamil Tekiela)
- Sockets:
. Fixed ext/sockets build on Haiku. (David Carlier)
. Fixed bug GH-7978 (sockets extension compilation errors). (David Carlier)
- Standard:
. Fixed bug GH-7875 (mails are sent even if failure to log throws exception).
(cmb)
20 Jan 2022, PHP 8.0.15
- Core:
. Fixed bug #81656 (GCC-11 silently ignores -R). (Michael Wallner)
. Fixed bug #81585 (cached_chunks are not counted to real_size on shutdown).
(cmb)
- Filter:
. Fixed FILTER_FLAG_NO_RES_RANGE flag. (Yifan Tong)
- Hash:
. Fixed bug GH-7759 (Incorrect return types for hash() and hash_hmac()).
(cmb)
. Fixed bug GH-7826 (Inconsistent argument name in hash_hmac_file and
hash_file). (cmb)
- MySQLnd:
. Fixed bug where large bigints may be truncated. (Nathan Freeman, cmb)
- OCI8:
. Fixed bug GH-7765 (php_oci_cleanup_global_handles segfaults at second
call). (cmb)
- OPcache:
. Fixed bug #81679 (Tracing JIT crashes on reattaching). (cmb)
- PDO_PGSQL:
. Fixed error message allocation of PDO PgSQL. (SATO Kentaro)
- Sockets:
. Avoid void* arithmetic in sockets/multicast.c on NetBSD. (David Carlier)
- Spl:
. Fixed bug #75917 (SplFileObject::seek broken with CSV flags). (Aliaksandr
Bystry)
16 Dec 2021, PHP 8.0.14
- Core:
. Fixed bug #81582 (Stringable not implicitly declared if __toString() came
from a trait). (Nikita)
. Fixed bug #81591 (Fatal Error not properly logged in particular cases).
(Nikita)
. Fixed bug #81626 (Error on use static:: in __сallStatic() wrapped to
Closure::fromCallable()). (Nikita)
. Fixed bug #81631 (::class with dynamic class name may yield wrong line
number). (Nikita)
- FPM:
. Fixed bug #81513 (Future possibility for heap overflow in FPM zlog).
(Jakub Zelenka)
- GD:
. Fixed bug #71316 (libpng warning from imagecreatefromstring). (cmb)
- IMAP:
. Fixed bug #81649 (imap_(un)delete accept sequences, not single numbers).
(cmb)
- OpenSSL:
. Fixed bug #75725 (./configure: detecting RAND_egd). (Dilyan Palauzov)
- PCRE:
. Fixed bug #74604 (Out of bounds in php_pcre_replace_impl). (cmb, Dmitry)
- SPL:
. Fixed bug #81587 (MultipleIterator Segmentation fault w/ SimpleXMLElement
attached). (Nikita)
- Standard:
. Fixed bug #81618 (dns_get_record fails on FreeBSD for missing type).
(fsbruva)
. Fixed bug #81659 (stream_get_contents() may unnecessarily overallocate).
(cmb)
18 Nov 2021, PHP 8.0.13
- Core:
. Fixed bug #81518 (Header injection via default_mimetype / default_charset).
(cmb)
- Date:
. Fixed bug #81500 (Interval serialization regression since 7.3.14 / 7.4.2).
(cmb)
- DBA:
. Fixed bug #81588 (TokyoCabinet driver leaks memory). (girgias)
- MBString:
. Fixed bug #76167 (mbstring may use pointer from some previous request).
(cmb, cataphract)
- Opcache:
. Fixed bug #81512 (Unexpected behavior with arrays and JIT). (Dmitry)
. Fixed bug #81652 (The value of error_reporting() gets overridden). (Nikita)
- PCRE:
. Fixed bug #81424 (PCRE2 10.35 JIT performance regression). (cmb)
- XML:
. Fixed bug #79971 (special character is breaking the path in xml function).
(CVE-2021-21707) (cmb)
- XMLReader:
. Fixed bug #81521 (XMLReader::getParserProperty may throw with a valid
property). (Nikita)
21 Oct 2021, PHP 8.0.12
- CLI:
. Fixed bug #81496 (Server logs incorrect request method). (lauri)
- Core:
. Fixed bug #81435 (Observer current_observed_frame may point to an old
(overwritten) frame). (Bob)
. Fixed bug #81380 (Observer may not be initialized properly). (krakjoe)
- DOM:
. Fixed bug #81433 (DOMElement::setIdAttribute() called twice may remove ID).
(Viktor Volkov)
- FFI:
. Fixed bug #79576 ("TYPE *" shows unhelpful message when type is not
defined). (Dmitry)
- Fileinfo:
. Fixed bug #78987 (High memory usage during encoding detection). (Anatol)
- Filter:
. Fixed bug #61700 (FILTER_FLAG_IPV6/FILTER_FLAG_NO_PRIV|RES_RANGE failing).
(cmb, Nikita)
- FPM:
. Fixed bug #81026 (PHP-FPM oob R/W in root process leading to privilege
escalation) (CVE-2021-21703). (Jakub Zelenka)
- Opcache:
. Fixed bug #81472 (Cannot support large linux major/minor device number when
read /proc/self/maps). (Lin Yang)
- Reflection:
. ReflectionAttribute is no longer final. (sasezaki)
- SPL:
. Fixed bug #80663 (Recursive SplFixedArray::setSize() may cause double-free).
(cmb, Nikita, Tyson Andre)
. Fixed bug #81477 (LimitIterator + SplFileObject regression in 8.0.1). (cmb)
- Standard:
. Fixed bug #69751 (Change Error message of sprintf/printf for missing/typo
position specifier). (Aliaksandr Bystry)
- Streams:
. Fixed bug #81475 (stream_isatty emits warning with attached stream wrapper).
(cmb)
- XML:
. Fixed bug #70962 (XML_OPTION_SKIP_WHITE strips embedded whitespace).
(Aliaksandr Bystry, cmb)
- Zip:
. Fixed bug #81490 (ZipArchive::extractTo() may leak memory). (cmb, Remi)
. Fixed bug #77978 (Dirname ending in colon unzips to wrong dir). (cmb)
23 Sep 2021, PHP 8.0.11
- Core:
. Fixed bug #81302 (Stream position after stream filter removed). (cmb)
. Fixed bug #81346 (Non-seekable streams don't update position after write).
(cmb)
. Fixed bug #73122 (Integer Overflow when concatenating strings). (cmb)
-GD:
. Fixed bug #53580 (During resize gdImageCopyResampled cause colors change).
(cmb)
- Opcache:
. Fixed bug #81353 (segfault with preloading and statically bound closure).
(Nikita)
- Shmop:
. Fixed bug #81407 (shmop_open won't attach and causes php to crash). (cmb)
- Standard:
. Fixed bug #71542 (disk_total_space does not work with relative paths). (cmb)
. Fixed bug #81400 (Unterminated string in dns_get_record() results). (cmb)
- SysVMsg:
. Fixed bug #78819 (Heap Overflow in msg_send). (cmb)
- XML:
. Fixed bug #81351 (xml_parse may fail, but has no error code). (cmb, Nikita)
- Zip:
. Fixed bug #80833 (ZipArchive::getStream doesn't use setPassword). (Remi)
. Fixed bug #81420 (ZipArchive::extractTo extracts outside of destination).
(CVE-2021-21706) (cmb)
26 Aug 2021, PHP 8.0.10
- Core:
. Fixed bug #72595 (php_output_handler_append illegal write access). (cmb)
. Fixed bug #66719 (Weird behaviour when using get_called_class() with
call_user_func()). (Nikita)
. Fixed bug #81305 (Built-in Webserver Drops Requests With "Upgrade" Header).
(cmb)
- BCMath:
. Fixed bug #78238 (BCMath returns "-0"). (cmb)
- CGI:
. Fixed bug #80849 (HTTP Status header truncation). (cmb)
- Date:
. Fixed bug #64975 (Error parsing when AM/PM not at the end). (Derick)
. Fixed bug #78984 (DateTimeZone accepting invalid UTC timezones). (Derick)
. Fixed bug #79580 (date_create_from_format misses leap year). (Derick)
. Fixed bug #80409 (DateTime::modify() loses time with 'weekday' parameter).
(Derick)
- GD:
. Fixed bug #51498 (imagefilledellipse does not work for large circles). (cmb)
- MySQLi:
. Fixed bug #74544 (Integer overflow in mysqli_real_escape_string()). (cmb,
johannes)
- Opcache:
. Fixed bug #81225 (Wrong result with pow operator with JIT enabled).
(Dmitry)
. Fixed bug #81249 (Intermittent property assignment failure with JIT
enabled). (Dmitry)
. Fixed bug #81206 (Multiple PHP processes crash with JIT enabled). (cmb,
Nikita)
. Fixed bug #81272 (Segfault in var[] after array_slice with JIT). (Nikita)
. Fixed Bug #81255 (Memory leak in PHPUnit with functional JIT). (Dmitry)
. Fixed Bug #80959 (infinite loop in building cfg during JIT compilation)
(Nikita, Dmitry)
. Fixed bug #81226 (Integer overflow behavior is different with JIT
enabled). (Dmitry)
- OpenSSL:
. Fixed bug #81327 (Error build openssl extension on php 7.4.22). (cmb)
- PDO_ODBC:
. Fixed bug #81252 (PDO_ODBC doesn't account for SQL_NO_TOTAL). (cmb)
- Shmop:
. Fixed bug #81283 (shmop can't read beyond 2147483647 bytes). (cmb, Nikita)
- SimpleXML:
. Fixed bug #81325 (Segfault in zif_simplexml_import_dom). (remi)
- Standard:
. Fixed bug #72146 (Integer overflow on substr_replace). (cmb)
. Fixed bug #81265 (getimagesize returns 0 for 256px ICO images).
(George Dietrich)
. Fixed bug #74960 (Heap buffer overflow via str_repeat). (cmb, Dmitry)
- Streams:
. Fixed bug #81294 (Segfault when removing a filter). (cmb)
29 Jul 2021, PHP 8.0.9
- Core:
. Fixed bug #81145 (copy() and stream_copy_to_stream() fail for +4GB files).
(cmb, Nikita)
. Fixed bug #81163 (incorrect handling of indirect vars in __sleep).
(krakjoe)
. Fixed bug #81159 (Object to int warning when using an object as a string
offset). (girgias)
. Fixed bug #80728 (PHP built-in web server resets timeout when it can kill
the process). (Calvin Buckley)
. Fixed bug #73630 (Built-in Weberver - overwrite $_SERVER['request_uri']).
(cmb)
. Fixed bug #80173 (Using return value of zend_assign_to_variable() is not
safe). (Nikita)
. Fixed bug #73226 (--r[fcez] always return zero exit code). (cmb)
- Intl:
. Fixed bug #72809 (Locale::lookup() wrong result with canonicalize option).
(cmb)
. Fixed bug #68471 (IntlDateFormatter fails for "GMT+00:00" timezone). (cmb)
. Fixed bug #74264 (grapheme_strrpos() broken for negative offsets). (cmb)
- OpenSSL:
. Fixed bug #52093 (openssl_csr_sign truncates $serial). (cmb)
- PCRE:
. Fixed bug #81101 (PCRE2 10.37 shows unexpected result). (Anatol)
. Fixed bug #81243 (Too much memory is allocated for preg_replace()). (cmb)
- Reflection:
. Fixed bug #81208 (Segmentation fault while create newInstance from
attribute). (Nikita)
- Standard:
. Fixed bug #81223 (flock() only locks first byte of file). (cmb)
17 Jun 2021, PHP 8.0.8
- Core:
. Fixed bug #81076 (incorrect debug info on Closures with implicit binds).
(krakjoe)
. Fixed bug #81068 (Double free in realpath_cache_clean()). (Dimitry Andric)
. Fixed bug #76359 (open_basedir bypass through adding ".."). (cmb)
. Fixed bug #81090 (Typed property performance degradation with .= operator).
(Nikita)
. Fixed bug #81070 (Integer underflow in memory limit comparison).
(Peter van Dommelen)
. Fixed bug #81122: SSRF bypass in FILTER_VALIDATE_URL. (CVE-2021-21705) (cmb)
- Bzip2:
. Fixed bug #81092 (fflush before stream_filter_remove corrupts stream).
(cmb)
- Fileinfo:
. Fixed bug #80197 (implicit declaration of function 'magic_stream' is
invalid). (Nikita)
- GMP:
. Fixed bug #81119 (GMP operators throw errors with wrong parameter names).
(Nikita)
- MySQLnd:
. Fixed bug #80761 (PDO uses too much memory). (Nikita)
- OCI8:
. Fixed bug #81088 (error in regression test for oci_fetch_object() and
oci_fetch_array()). (Máté)
- Opcache:
. Fixed bug #81051 (Broken property type handling after incrementing
reference). (Dmitry)
. Fixed bug #80968 (JIT segfault with return from required file). (Dmitry)
- OpenSSL:
. Fixed bug #76694 (native Windows cert verification uses CN as sever name).
(cmb)
- PDO_Firebird:
. Fixed bug #76448: Stack buffer overflow in firebird_info_cb.
(CVE-2021-21704) (cmb)
. Fixed bug #76449: SIGSEGV in firebird_handle_doer. (CVE-2021-21704) (cmb)
. Fixed bug #76450: SIGSEGV in firebird_stmt_execute. (CVE-2021-21704) (cmb)
. Fixed bug #76452: Crash while parsing blob data in firebird_fetch_blob.
(CVE-2021-21704) (cmb)
- readline:
. Fixed bug #72998 (invalid read in readline completion). (krakjoe)
- Standard:
. Fixed bug #81048 (phpinfo(INFO_VARIABLES) "Array to string conversion").
(cmb)
. Fixed bug #77627 (method_exists on Closure::__invoke inconsistency).
(krakjoe)
- Windows:
. Fixed bug #81120 (PGO data for main PHP DLL are not used). (cmb)
03 Jun 2021, PHP 8.0.7
- Core:
. Fixed bug #80960 (opendir() warning wrong info when failed on Windows).
(cmb)
. Fixed bug #67792 (HTTP Authorization schemes are treated as case-sensitive).
(cmb)
. Fixed bug #80972 (Memory exhaustion on invalid string offset). (girgias)
- FPM:
. Fixed bug #65800 (Events port mechanism). (psumbera)
- FTP:
. Fixed bug #80901 (Info leak in ftp extension). (cmb)
. Fixed bug #79100 (Wrong FTP error messages). (cmb)
- GD:
. Fixed bug #81032 (GD install is affected by external libgd installation).
(Flavio Heleno, cmb)
- Intl:
. Fixed bug #81019 (Unable to clone NumberFormatter after failed parse()).
(Nikita)
- MBString:
. Fixed bug #81011 (mb_convert_encoding removes references from arrays). (cmb)
- ODBC:
. Fixed bug #80460 (ODBC doesn't account for SQL_NO_TOTAL indicator). (cmb)
- Opcache:
. Fixed bug #81007 (JIT "not supported" on 32-bit x86 -- build problem?).
(Nikita)
. Fixed bug #81015 (Opcache optimization assumes wrong part of ternary
operator in if-condition). (Nikita)
. Fixed bug #81046 (Literal compaction merges non-equal related literals).
(Nikita)
- PDO_MySQL:
. Fixed bug #81037 (PDO discards error message text from prepared
statement). (Kamil Tekiela)
- PDO_ODBC:
. Fixed bug #44643 (bound parameters ignore explicit type definitions). (cmb)
- pgsql:
. Fixed php_pgsql_fd_cast() wrt. php_stream_can_cast(). (cmb)
- SPL:
. Fixed bug #80933 (SplFileObject::DROP_NEW_LINE is broken for NUL and CR).
(cmb, Nikita)
- XMLReader:
. Fixed bug #73246 (XMLReader: encoding length not checked). (cmb)
- Zip:
. Fixed bug #80863 (ZipArchive::extractTo() ignores references). (cmb)
06 May 2021, PHP 8.0.6
- PDO_pgsql:
. Revert "Fixed bug #80892 (PDO::PARAM_INT is treated the same as PDO::PARAM_STR)"
from PHP 8.0.5.
29 Apr 2021, PHP 8.0.5
- Core:
. Changed PowerPC CPU registers used by Zend VM to work around GCC bug.
Old registers (r28/r29) might be clobbered by _restgpr routine used for
return from C function compiled with -Os. (Dmitry)
- DOM:
. Fixed bug #66783 (UAF when appending DOMDocument to element). (cmb)
- FFI:
. Fixed bug #80847 (CData structs with fields of type struct can't be passed
as C function argument). (Nickolas Daniel da Silva, Dmitry)
- FPM:
. Fixed bug #80024 (Duplication of info about inherited socket after pool
removing). (Jakub Zelenka)
- FTP:
. Fixed bug #80880 (SSL_read on shutdown, ftp/proc_open). (cmb, Jakub
Zelenka)
- Imap:
. Fixed bug #80710 (imap_mail_compose() header injection). (cmb, Stas)
- LibXML:
. Fixed bug #73533 (Invalid memory access in php_libxml_xmlCheckUTF8). (cmb)
- Opcache:
. Fixed bug #80839 (PHP problem with JIT). (Dmitry)
. Fixed bug #80861 (erronous array key overflow in 2D array with JIT).
(Dmitry)
- Pcntl:
. Fixed bug #79812 (Potential integer overflow in pcntl_exec()). (cmb)
- PDO_ODBC:
. Fixed bug #80783 (PDO ODBC truncates BLOB records at every 256th byte).
(cmb)
- PDO_pgsql:
. Fixed bug #80892 (PDO::PARAM_INT is treated the same as PDO::PARAM_STR).
(Matteo)
- Session:
. Fixed bug #80889 (Cannot set save handler when save_handler is invalid).
(cmb)
- SOAP:
. Fixed bug #69668 (SOAP special XML characters in namespace URIs not
encoded). (cmb)
- Standard:
. Fixed bug #80915 (Taking a reference to $_SERVER hides its values from
phpinfo()). (Rowan Tommins)
. Fixed bug #80914 ('getdir' accidentally defined as an alias of 'dir').
(Rowan Tommins)
01 Apr 2021, PHP 8.0.4
- Core:
. Fixed bug #75776 (Flushing streams with compression filter is broken). (cmb)
. Fixed bug #80811 (Function exec without $output but with $restult_code
parameter crashes). (Nikita)
. Fixed bug #80814 (threaded mod_php won't load on FreeBSD: No space
available for static Thread Local Storage). (Dmitry)
- Dba:
. Fixed bug #80817 (dba_popen() may cause segfault during RSHUTDOWN). (cmb)
- IMAP:
. Fixed bug #80800 (imap_open() fails when the flags parameter includes
CL_EXPUNGE). (girgias)
- Intl:
. Fixed bug #80763 (msgfmt_format() does not accept DateTime references).
(cmb)
- Libxml:
. Fixed bug #51903 (simplexml_load_file() doesn't use HTTP headers). (cmb)
- MySQLnd:
. Fixed bug #80837 (Calling stmt_store_result after fetch doesn't throw an
error). (Kamil Tekiela)
- Opcache:
. Fixed bug #80786 (PHP crash using JIT). (Nikita)
. Fixed bug #80782 (DASM_S_RANGE_VREG on PHP_INT_MIN-1). (Dmitry)
- PCRE:
. Fixed bug #80866 (preg_split ignores limit flag when pattern with \K has
0-width fullstring match). (Kamil Tekiela)
- Session:
. Fixed bug #80774 (session_name() problem with backslash). (cmb)
- Standard:
. Fixed bug #80771 (phpinfo(INFO_CREDITS) displays nothing in CLI). (cmb)
. Fixed bug #78719 (http wrapper silently ignores long Location headers).
(cmb)
. Fixed bug #80838 (HTTP wrapper waits for HTTP 1 response after HTTP 101).
(manuelm)
- Zip:
. Fixed bug #80825 (ZipArchive::isCompressionMethodSupported does not exist).
(cmb)
18 Feb 2021, PHP 8.0.3
- Core:
. Fixed #80706 (mail(): Headers after Bcc headers may be ignored). (cmb)
- DOM:
. Fixed bug #80600 (DOMChildNode::remove() doesn't work on CharacterData
nodes). (beberlei)
- Gettext:
. Fixed bug #53251 (bindtextdomain with null dir doesn't return old value).
(cmb)