NEWS

PHP                                                                        NEWS
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
17 Feb 2022, PHP 8.1.3

- Core:
  . Fixed bug #81430 (Attribute instantiation leaves dangling pointer).
    (beberlei)
  . Fixed bug GH-7896 (Environment vars may be mangled on Windows). (cmb)
  . Fixed bug GH-7883 (Segfault when INI file is not readable). (Remi)

- Filter:
  . Fix #81708: UAF due to php_filter_float() failing for ints. (CVE-2021-21708) (cmb)

- FFI:
  . Fixed bug GH-7867 (FFI::cast() from pointer to array is broken). (cmb,
    dmitry)

- FPM:
  . Fixed memory leak on invalid port. (David Carlier)
  . Fixed bug GH-7842 (Invalid OpenMetrics response format returned by FPM
    status page. (Stefano Arlandini)

- MBString:
  . Fixed bug GH-7902 (mb_send_mail may delimit headers with LF only). (cmb)

- MySQLnd:
  . Fixed bug GH-7972 (MariaDB version prefix 5.5.5- is not stripped). (Kamil Tekiela)

- pcntl:
  . Fixed pcntl_rfork build for DragonFlyBSD. (David Carlier)

- Sockets:
  . Fixed bug GH-7978 (sockets extension compilation errors). (David Carlier)

- Standard:
  . Fixed bug GH-7899 (Regression in unpack for negative int value). (Remi)
  . Fixed bug GH-7875 (mails are sent even if failure to log throws exception).
    (cmb)

20 Jan 2022, PHP 8.1.2

- Core:
  . Fixed bug #81216 (Nullsafe operator leaks dynamic property name). (Dmitry)
  . Fixed bug #81684 (Using null coalesce assignment with $GLOBALS["x"] produces
    opcode error). (ilutov)
  . Fixed bug #81656 (GCC-11 silently ignores -R). (Michael Wallner)
  . Fixed bug #81683 (Misleading "access type ... must be public" error message
    on final or abstract interface methods). (ilutov)
  . Fixed bug #81585 (cached_chunks are not counted to real_size on shutdown).
    (cmb)
  . Fixed bug GH-7757 (Multi-inherited final constant causes fatal error).
    (cmb)
  . Fixed zend_fibers.c build with ZEND_FIBER_UCONTEXT. (Petr Sumbera)
  . Added riscv64 support for fibers. (Jeremie Courreges-Anglas)

- Filter:
  . Fixed FILTER_FLAG_NO_RES_RANGE flag. (Yifan Tong)

- Hash:
  . Fixed bug GH-7759 (Incorrect return types for hash() and hash_hmac()).
    (cmb)
  . Fixed bug GH-7826 (Inconsistent argument name in hash_hmac_file and
    hash_file). (cmb)

- MBString:
  . Fixed bug #81693 (mb_check_encoding(7bit) segfaults). (cmb)

- MySQLi:
  . Fixed bug #81658 (MYSQL_OPT_LOAD_DATA_LOCAL_DIR not available in MariaDB).
    (devnexen)
  . Introduced MYSQLI_IS_MARIADB. (devnexen)
  . Fixed bug GH-7746 (mysqli_sql_exception->getSqlState()). (Kamil Tekiela)

- MySQLnd:
  . Fixed bug where large bigints may be truncated. (Nathan Freeman, cmb)

- OCI8:
  . Fixed bug GH-7765 (php_oci_cleanup_global_handles segfaults at second
    call). (cmb)

- OPcache:
  . Fixed bug #81679 (Tracing JIT crashes on reattaching). (cmb)

- Readline:
  . Fixed bug #81598 (Cannot input unicode characters in PHP 8 interactive
    shell). (Nikita)

- Reflection:
  . Fixed bug #81681 (ReflectionEnum throwing exceptions). (cmb)

- PDO_PGSQL:
  . Fixed error message allocation of PDO PgSQL. (SATO Kentaro)

- Sockets:
  . Avoid void* arithmetic in sockets/multicast.c on NetBSD. (David Carlier)
  . Fixed ext/sockets build on Haiku. (David Carlier)

- Spl:
  . Fixed bug #75917 (SplFileObject::seek broken with CSV flags). (Aliaksandr
    Bystry)
  . Fixed bug GH-7809 (Cloning a faked SplFileInfo object may segfault). (cmb)

- Standard:
  . Fixed bug GH-7748 (gethostbyaddr outputs binary string). (cmb)
  . Fixed bug GH-7815 (php_uname doesn't recognise latest Windows versions).
    (David Warner)

02 Dec 2021, PHP 8.1.1

- IMAP:
  . Fixed bug #81649 (imap_(un)delete accept sequences, not single numbers).
    (cmb)

- PCRE:
  . Update bundled PCRE2 to 10.39. (cmb)
  . Fixed bug #74604 (Out of bounds in php_pcre_replace_impl). (cmb, Dmitry)

- Standard:
  . Fixed bug #81659 (stream_get_contents() may unnecessarily overallocate).
    (cmb)

25 Nov 2021, PHP 8.1.0

- Core:
  . Fixed inclusion order for phpize builds on Windows. (cmb)
  . Added missing hashtable insertion APIs for arr/obj/ref. (Sara)
  . Implemented FR #77372 (Relative file path is removed from uploaded file).
    (Björn Tantau)
  . Fixed bug #81607 (CE_CACHE allocation with concurrent access). (Nikita,
    Dmitry)
  . Fixed bug #81507 (Fiber does not compile on AIX). (Clément Chigot)
  . Fixed bug #78647 (SEGFAULT in zend_do_perform_implementation_check).
    (Nikita)
  . Fixed bug #81518 (Header injection via default_mimetype / default_charset).
    (cmb)
  . Fixed bug #75941 (Fix compile failure on Solaris with clang). (Jaromír
    Doleček)
  . Fixed bug #81380 (Observer may not be initialized properly). (krakjoe)
  . Fixed bug #81514 (Using Enum as key in WeakMap triggers GC + SegFault).
    (Nikita)
  . Fixed bug #81520 (TEST_PHP_CGI_EXECUTABLE badly set in run-tests.php).
    (Remi)
  . Fixed bug #81377 (unset() of $GLOBALS sub-key yields warning). (Nikita)
  . Fixed bug #81342 (New ampersand token parsing depends on new line after it).
    (Nikita)
  . Fixed bug #81280 (Unicode characters in cli.prompt causes segfault).
    (krakjoe)
  . Fixed bug #81192 ("Declaration should be compatible with" gives incorrect
    line number with traits). (Nikita)
  . Fixed bug #78919 (CLI server: insufficient cleanup if request startup
    fails). (cataphract, cmb)
  . Fixed bug #81303 (match error message improvements). (krakjoe)
  . Fixed bug #81238 (Fiber support missing for Solaris Sparc). (trowski)
  . Fixed bug #81237 (Comparison of fake closures doesn't work). (krakjoe)
  . Fixed bug #81202 (powerpc64 build fails on fibers). (krakjoe)
  . Fixed bug #80072 (Cyclic unserialize in TMPVAR operand may leak). (Nikita)
  . Fixed bug #81163 (__sleep allowed to return non-array). (krakjoe)
  . Fixed bug #75474 (function scope static variables are not bound to a unique
    function). (Nikita)
  . Fixed bug #53826 (__callStatic fired in base class through a parent call if
    the method is private). (Nikita)
  . Fixed bug #81076 (incorrect debug info on Closures with implicit binds).
    (krakjoe)

- CLI:
  . Fixed bug #81496 (Server logs incorrect request method). (lauri)

- COM:
  . Dispatch using LANG_NEUTRAL instead of LOCALE_SYSTEM_DEFAULT. (Dmitry
    Maksimov)

- Curl:
  . Fixed bug #81085 (Support CURLOPT_SSLCERT_BLOB for cert strings).
    (camporter)

- Date:
  . Fixed bug #81458 (Regression Incorrect difference after timezone change).
    (Derick)
  . Fixed bug #81500 (Interval serialization regression since 7.3.14 / 7.4.2).
    (cmb)
  . Fixed bug #81504 (Incorrect timezone transition details for POSIX data).
    (Derick)
  . Fixed bug #80998 (Missing second with inverted interval). (Derick)
  . Speed up finding timezone offset information. (Derick)
  . Fixed bug #79580 (date_create_from_format misses leap year). (Derick)
  . Fixed bug #80963 (DateTimeZone::getTransitions() truncated). (Derick)
  . Fixed bug #80974 (Wrong diff between 2 dates in different timezones).
    (Derick)
  . Fixed bug #80998 (Missing second with inverted interval). (Derick)
  . Fixed bug #81097 (DateTimeZone silently falls back to UTC when providing an
    offset with seconds). (Derick)
  . Fixed bug #81106 (Regression in 8.1: add() now truncate ->f). (Derick)
  . Fixed bug #81273 (Date interval calculation not correct). (Derick)
  . Fixed bug #52480 (Incorrect difference using DateInterval). (Derick)
  . Fixed bug #62326 (date_diff() function returns false result). (Derick)
  . Fixed bug #64992 (dst not handled past 2038). (Derick)
  . Fixed bug #65003 (Wrong date diff). (Derick)
  . Fixed bug #66545 (DateTime. diff returns negative values). (Derick)
  . Fixed bug #68503 (date_diff on two dates with timezone set localised
    returns wrong results). (Derick)
  . Fixed bug #69806 (Incorrect date from timestamp). (Derick)
  . Fixed bug #71700 (Extra day on diff between begin and end of march 2016).
    (Derick)
  . Fixed bug #71826 (DateTime::diff confuse on timezone 'Asia/Tokyo'). (Derick)
  . Fixed bug #73460 (Datetime add not realising it already applied DST
    change). (Derick)
  . Fixed bug #74173 (DateTimeImmutable::getTimestamp() triggers DST switch in
    incorrect time). (Derick)
  . Fixed bug #74274 (Handling DST transitions correctly). (Derick)
  . Fixed bug #74524 (Date diff is bad calculated, in same time zone). (Derick)
  . Fixed bug #75167 (DateTime::add does only care about backward DST
    transition, not forward). (Derick)
  . Fixed bug #76032 (DateTime->diff having issues with leap days for
    timezones ahead of UTC). (Derick)
  . Fixed bug #76374 (Date difference varies according day time). (Derick)
  . Fixed bug #77571 (DateTime's diff DateInterval incorrect in timezones from
    UTC+01:00 to UTC+12:00). (Derick)
  . Fixed bug #78452 (diff makes wrong in hour for Asia/Tehran). (Derick)
  . Fixed bug #79452 (DateTime::diff() generates months differently between
    time zones). (Derick)
  . Fixed bug #79698 (timelib mishandles future timestamps (triggered by 'zic
    -b slim')). (Derick)
  . Fixed bug #79716 (Invalid date time created (with day "00")). (Derick)
  . Fixed bug #80610 (DateTime calculate wrong with DateInterval). (Derick)
  . Fixed bug #80664 (DateTime objects behave incorrectly around DST
    transition). (Derick)
  . Fixed bug #80913 (DateTime(Immutable)::sub around DST yield incorrect
    time). (Derick)

- DBA:
  . Fixed bug #81588 (TokyoCabinet driver leaks memory). (girgias)

- DOM:
  . Fixed bug #81433 (DOMElement::setIdAttribute() called twice may remove ID).
    (Viktor Volkov)

- FFI:
  . Fixed bug #79576 ("TYPE *" shows unhelpful message when type is not
    defined). (Dmitry)

- Filter:
  . Fixed bug #61700 (FILTER_FLAG_IPV6/FILTER_FLAG_NO_PRIV|RES_RANGE failing).
    (cmb, Nikita)

- FPM:
  . Fixed bug #81513 (Future possibility for heap overflow in FPM zlog).
    (Jakub Zelenka)
  . Fixed bug #81026 (PHP-FPM oob R/W in root process leading to privilege
    escalation) (CVE-2021-21703). (Jakub Zelenka)
  . Added openmetrics status format. (Cees-Jan Kiewiet)
  . Enable process renaming on macOS. (devnexen)
  . Added pm.max_spawn_rate option to configure max spawn child processes rate.
    (Paulius Sapragonas)
  . Fixed bug #65800 (Events port mechanism). (psumbera)

- FTP:
  . Convert resource<ftp> to object \FTP\Connection. (Sara)

- GD:
  . Fixed bug #71316 (libpng warning from imagecreatefromstring). (cmb)
  . Convert resource<gd font> to object \GdFont. (Sara)

- hash:
  . Implemented FR #68109 (Add MurmurHash V3). (Anatol, Michael)
  . Implemented FR #73385 (Add xxHash support). (Anatol)

- JSON:
  . Fixed bug #81532 (Change of $depth behaviour in json_encode() on PHP 8.1).
    (Nikita)

- LDAP:
  . Convert resource<ldap link> to object \LDAP\Connection. (Máté)
  . Convert resource<ldap result> to object \LDAP\Result. (Máté)
  . Convert resource<ldap result entry> to object \LDAP\ResultEntry. (Máté)

- MBString:
  . Fixed bug #76167 (mbstring may use pointer from some previous request).
    (cmb, cataphract)
  . Fixed bug #81390 (mb_detect_encoding() regression). (alexdowad)
  . Fixed bug #81349 (mb_detect_encoding misdetcts ASCII in some cases).
    (Nikita)
  . Fixed bug #81298 (mb_detect_encoding() segfaults when 7bit encoding is
    specified). (Nikita)

- MySQLi:
  . Fixed bug #70372 (Emulate mysqli_fetch_all() for libmysqlclient). (Nikita)
  . Fixed bug #80330 (Replace language in APIs and source code/docs).
    (Darek Ślusarczyk)
  . Fixed bug #80329 (Add option to specify LOAD DATA LOCAL white list folder
    (including libmysql)). (Darek Ślusarczyk)

- MySQLnd:
  . Fixed bug #63327 (Crash (Bus Error) in mysqlnd due to wrong alignment).
    (Nikita)
  . Fixed bug #80761 (PDO uses too much memory). (Nikita)

- Opcache:
  . Fixed bug #81409 (Incorrect JIT code for ADD with a reference to array).
    (Dmitry)
  . Fixed bug #81255 (Memory leak in PHPUnit with functional JIT).
  . Fixed bug #80959 (infinite loop in building cfg during JIT compilation).
    (Nikita, Dmitry)
  . Fixed bug #81225 (Wrong result with pow operator with JIT enabled).
    (Dmitry)
  . Fixed bug #81249 (Intermittent property assignment failure with JIT
    enabled). (Dmitry)
  . Fixed bug #81256 (Assertion `zv != ((void *)0)' failed for "preload" with
    JIT). (Dmitry)
  . Fixed bug #81133 (building opcache with phpize fails). (krakjoe)
  . Fixed bug #81136 (opcache header not installed). (krakjoe)
  . Added inheritance cache. (Dmitry)

- OpenSSL:
  . Fixed bug #81502 ($tag argument of openssl_decrypt() should accept
    null/empty string). (Nikita)
  . Bump minimal OpenSSL version to 1.0.2. (Jakub Zelenka)

- PCRE:
  . Fixed bug #81424 (PCRE2 10.35 JIT performance regression). (cmb)
  . Bundled PCRE2 is 10.37.

- PDO:
  . Fixed bug #40913 (PDO_MYSQL: PDO::PARAM_LOB does not bind to a stream for
    fetching a BLOB). (Nikita)

- PDO MySQL:
  . Fixed bug #80908 (PDO::lastInsertId() return wrong). (matt)
  . Fixed bug #81037 (PDO discards error message text from prepared
    statement). (Kamil Tekiela)

- PDO OCI:
  . Fixed bug #77120 (Support 'success with info' at connection).
    (Sergei Morozov)

- PDO ODBC:
  . Implement PDO_ATTR_SERVER_VERSION and PDO_ATTR_SERVER_INFO for
    PDO::getAttribute(). (Calvin Buckley)

- PDO PgSQL:
  . Fixed bug #81343 (pdo_pgsql: Inconsitent boolean conversion after calling
    closeCursor()). (Philip Hofstetter)

- PDO SQLite:
  . Fixed bug #38334 (Proper data-type support for PDO_SQLITE). (Nikita)

- PgSQL:
  . Fixed bug #81509 (pg_end_copy still expects a resource). (Matteo)
  . Convert resource<pgsql link> to object \PgSql\Connection. (Máté)
  . Convert resource<pgsql result> to object \PgSql\Result. (Máté)
  . Convert resource<pgsql large object> to object \PgSql\Lob. (Máté)

- Phar:
  . Use SHA256 by default for signature. (remi)
  . Add support for OpenSSL_SHA256 and OpenSSL_SHA512 signature. (remi)

- phpdbg:
  . Fixed bug #81135 (unknown help topic causes assertion failure). (krakjoe)

- PSpell:
  . Convert resource<pspell> to object \PSpell\Dictionary. (Sara)
  . Convert resource<pspell config> to object \PSpell\Config. (Sara)

- readline:
  . Fixed bug #72998 (invalid read in readline completion). (krakjoe)

- Reflection:
  . Fixed bug #81611 (ArgumentCountError when getting default value from
    ReflectionParameter with new). (Cameron Porter)
  . Fixed bug #81630 (PHP 8.1: ReflectionClass->getTraitAliases() crashes with
    Internal error). (Nikita)
  . Fixed bug #81457 (Enum: ReflectionMethod->getDeclaringClass() return a
    ReflectionClass). (Nikita)
  . Fixed bug #81474 (Make ReflectionEnum and related class non-final). (Nikita)
  . Fixed bug #80821 (ReflectionProperty::getDefaultValue() returns current
    value for statics). (Nikita)
  . Fixed bug #80564 (ReflectionProperty::__toString() renders current value,
    not default value). (Nikita)
  . Fixed bug #80097 (ReflectionAttribute is not a Reflector). (beberlei)
  . Fixed bug #81200 (no way to determine if Closure is static). (krakjoe)
  . Implement ReflectionFunctionAbstract::getClosureUsedVariables. (krakjoe)

- Shmop:
  . Fixed bug #81407 (shmop_open won't attach and causes php to crash). (cmb)

- SimpleXML:
  . Fixed bug #81325 (Segfault in zif_simplexml_import_dom). (remi)

- SNMP:
  . Implement SHA256 and SHA512 for security protocol. (remi)

- Sodium:
  . Added the XChaCha20 stream cipher functions. (P.I.E. Security Team)
  . Added the Ristretto255 functions, which are available in libsodium 1.0.18.
    (P.I.E. Security Team)

- SPL:
  . Fixed bug #66588 (SplFileObject::fgetcsv incorrectly returns a row on
    premature EOF). (Aliaksandr Bystry)
  . Fixed bug #80663 (Recursive SplFixedArray::setSize() may cause double-free).
    (cmb, Nikita, Tyson Andre)
  . Fixed bug #81477 (LimitIterator + SplFileObject regression in 8.0.1). (cmb)
  . Fixed bug #81112 (Special json_encode behavior for SplFixedArray). (Nikita)
  . Fixed bug #80945 ("Notice: Undefined index" on unset() ArrayObject
    non-existing key). (Nikita)
  . Fixed bug #80724 (FilesystemIterator::FOLLOW_SYMLINKS remove KEY_AS_FILE
    from bitmask). (Cameron Porter)

- Standard:
  . Fixed bug #81441 (gethostbyaddr('::1') returns ip instead of name after
    calling some other method). (Nikita)
  . Fixed bug #81491 (Incorrectly using libsodium for argon2 hashing).
    (Dan Pock)
  . Fixed bug #81142 (PHP 7.3+ memory leak when unserialize() is used on an
    associative array). (Nikita)
  . Fixed bug #81111 (Serialization is unexpectedly allowed on anonymous classes
    with __serialize()). (Nikita)
  . Fixed bug #81137 (hrtime breaks build on OSX before Sierra). (krakjoe)
  . Fixed bug #77627 (method_exists on Closure::__invoke inconsistency).
    (krakjoe)

- Streams:
  . Fixed bug #81475 (stream_isatty emits warning with attached stream wrapper).
    (cmb)

- XML:
  . Fixed bug #79971 (special character is breaking the path in xml function)
    (CVE-2021-21707). (cmb)
  . Fixed bug #70962 (XML_OPTION_SKIP_WHITE strips embedded whitespace).
    (Aliaksandr Bystry, cmb)

- Zip:
  . Fixed bug #81490 (ZipArchive::extractTo() may leak memory). (cmb, Remi)
  . Fixed bug #77978 (Dirname ending in colon unzips to wrong dir). (cmb)
  . Fixed bug #81420 (ZipArchive::extractTo extracts outside of destination)
    (CVE-2021-21706). (cmb)
  . Fixed bug #80833 (ZipArchive::getStream doesn't use setPassword). (Remi)