From 19ee3e6697d6f470df07f9b31fecd255f45e842f Mon Sep 17 00:00:00 2001 From: David Carlier Date: Sun, 8 Feb 2026 14:34:48 +0000 Subject: [PATCH 1/3] Fix GH-21161: socket_set_option() crash with array 'addr' entry as null. in the ipv6 address creation helper we need to use, for the error message, the converted data rather than assuming the original is a proper zend_string(). close GH-21166 --- NEWS | 4 ++++ ext/sockets/conversions.c | 2 +- ext/sockets/tests/gh21161.phpt | 19 +++++++++++++++++++ 3 files changed, 24 insertions(+), 1 deletion(-) create mode 100644 ext/sockets/tests/gh21161.phpt diff --git a/NEWS b/NEWS index cda0658d87cfd..10a3dd00f2fd0 100644 --- a/NEWS +++ b/NEWS @@ -34,6 +34,10 @@ PHP NEWS . Fixed bug GH-21055 (connection attribute status typo for GSS negotiation). (lsaos) +- Sockets: + . Fixed bug GH-21161 (socket_set_option() crash with array 'addr' + entry as null). (David Carlier) + - Windows: . Fixed compilation with clang (missing intrin.h include). (Kévin Dunglas) diff --git a/ext/sockets/conversions.c b/ext/sockets/conversions.c index 60ed970e89672..a419a20c873c5 100644 --- a/ext/sockets/conversions.c +++ b/ext/sockets/conversions.c @@ -611,7 +611,7 @@ static void from_zval_write_sin6_addr(const zval *zaddr_str, char *addr6, ser_co } else { /* error already emitted, but let's emit another more relevant */ do_from_zval_err(ctx, "could not resolve address '%s' to get an AF_INET6 " - "address", Z_STRVAL_P(zaddr_str)); + "address", ZSTR_VAL(addr_str)); } zend_tmp_string_release(tmp_addr_str); diff --git a/ext/sockets/tests/gh21161.phpt b/ext/sockets/tests/gh21161.phpt new file mode 100644 index 0000000000000..8a3958a583d97 --- /dev/null +++ b/ext/sockets/tests/gh21161.phpt @@ -0,0 +1,19 @@ +--TEST-- +GH-21161 (IPV6_PKTINFO socket option crash with null addr array entry) +--EXTENSIONS-- +sockets +--SKIPIF-- + +--FILE-- + null, 'ifindex' => 0]); +?> +--EXPECTF-- +Warning: socket_set_option(): Host lookup failed [%i]: %s on line %d + +Warning: socket_set_option(): error converting user data (path: in6_pktinfo > addr): could not resolve address '' to get an AF_INET6 address in %s on line %d From d1ffe6afd9c5aab0de3ecc03824a0cc447106c06 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tim=20D=C3=BCsterhus?= Date: Mon, 9 Feb 2026 22:41:05 +0100 Subject: [PATCH 2/3] Fix extension order in UPGRADING.INTERNALS --- UPGRADING.INTERNALS | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/UPGRADING.INTERNALS b/UPGRADING.INTERNALS index 1d8734d9fb076..1b9953dff57b4 100644 --- a/UPGRADING.INTERNALS +++ b/UPGRADING.INTERNALS @@ -84,12 +84,6 @@ PHP 8.6 INTERNALS UPGRADE NOTES 3. Module changes ======================== -- ext/xml: - . Removed the XML_ExpatVersion() libxml compatibility wrapper, - as it was unused. - . Removed the XML_GetCurrentByteCount() libxml compatibility wrapper, - as it was unused and could return the wrong result. - - ext/mbstring: . Added GB18030-2022 to default encoding list for zh-CN. @@ -111,6 +105,12 @@ PHP 8.6 INTERNALS UPGRADE NOTES . _php_error_log_ex() has been removed. . php_mail()'s extra_cmd parameter is now a zend_string*. +- ext/xml: + . Removed the XML_ExpatVersion() libxml compatibility wrapper, + as it was unused. + . Removed the XML_GetCurrentByteCount() libxml compatibility wrapper, + as it was unused and could return the wrong result. + ======================== 4. OpCode changes ======================== From ad83353a3d32ba08f3af987f9dc0111e61b36e7c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tim=20D=C3=BCsterhus?= Date: Mon, 9 Feb 2026 22:45:09 +0100 Subject: [PATCH 3/3] Fix line wrapping in NEWS/UPGRADING/UPGRADING.INTERNALS --- NEWS | 15 ++++++++------- UPGRADING | 17 ++++++++++++----- UPGRADING.INTERNALS | 8 +++++--- 3 files changed, 25 insertions(+), 15 deletions(-) diff --git a/NEWS b/NEWS index 0872d8dc542a8..782ee4be4d185 100644 --- a/NEWS +++ b/NEWS @@ -80,23 +80,24 @@ PHP NEWS - Posix: . Added validity check to the flags argument for posix_access(). (arshidkv12) - . Added validity check to the permissions argument for posix_mkfifo(). (arshidkv12) + . Added validity check to the permissions argument for posix_mkfifo(). + (arshidkv12) - Reflection: . Fixed bug GH-20217 (ReflectionClass::isIterable() incorrectly returns true for classes with property hooks). (alexandre-daubois) - Soap: - . Soap::__setCookie() when cookie name is a digit is now not stored and represented - as a string anymore but a int. (David Carlier) + . Soap::__setCookie() when cookie name is a digit is now not stored and + represented as a string anymore but a int. (David Carlier) - Sockets: - . Added the TCP_USER_TIMEOUT constant for Linux to set the maximum time in milliseconds - transmitted data can remain unacknowledged. (James Lucas) + . Added the TCP_USER_TIMEOUT constant for Linux to set the maximum time in + milliseconds transmitted data can remain unacknowledged. (James Lucas) . Added AF_UNSPEC support for sock_addrinfo_lookup() as a sole umbrella for AF_INET* family only. (David Carlier) - . Fixed GH-20532 (socket_addrinfo_lookup gives the error code with a new optional - parameter). (David Carlier) + . Fixed GH-20532 (socket_addrinfo_lookup gives the error code with a new + optional parameter). (David Carlier) - SPL: . DirectoryIterator key can now work better with filesystem supporting larger diff --git a/UPGRADING b/UPGRADING index b1db9893de628..f5bf9729855a1 100644 --- a/UPGRADING +++ b/UPGRADING @@ -43,8 +43,14 @@ PHP 8.6 UPGRADE NOTES . finfo_file() now works with remote streams. - Intl: - . Added IntlNumberRangeFormatter class to format an interval of two numbers with a given skeleton, locale, IntlNumberRangeFormatter::COLLAPSE_AUTO, IntlNumberRangeFormatter::COLLAPSE_NONE, IntlNumberRangeFormatter::COLLAPSE_UNIT, IntlNumberRangeFormatter::COLLAPSE_ALL collapse and - IntlNumberRangeFormatter::IDENTITY_FALLBACK_SINGLE_VALUE, IntlNumberRangeFormatter::IDENTITY_FALLBACK_APPROXIMATELY_OR_SINGLE_VALUE, IntlNumberRangeFormatter::IDENTITY_FALLBACK_APPROXIMATELY and + . Added IntlNumberRangeFormatter class to format an interval of two numbers + with a given skeleton, locale, IntlNumberRangeFormatter::COLLAPSE_AUTO, + IntlNumberRangeFormatter::COLLAPSE_NONE, + IntlNumberRangeFormatter::COLLAPSE_UNIT, + IntlNumberRangeFormatter::COLLAPSE_ALL collapse and + IntlNumberRangeFormatter::IDENTITY_FALLBACK_SINGLE_VALUE, + IntlNumberRangeFormatter::IDENTITY_FALLBACK_APPROXIMATELY_OR_SINGLE_VALUE, + IntlNumberRangeFormatter::IDENTITY_FALLBACK_APPROXIMATELY and IntlNumberRangeFormatter::IDENTITY_FALLBACK_RANGE identity fallbacks. It is supported from icu 63. @@ -106,7 +112,8 @@ PHP 8.6 UPGRADE NOTES ======================================== - Standard: - . `clamp()` returns the given value if in range, else return the nearest bound. + . `clamp()` returns the given value if in range, else return the nearest + bound. RFC: https://wiki.php.net/rfc/clamp_v2 ======================================== @@ -189,8 +196,8 @@ PHP 8.6 UPGRADE NOTES - Core: . `printf()` using only `%s` and `%d` will be compiled into the equivalent - string interpolation, avoiding the overhead of a function call and repeatedly - parsing the format string. + string interpolation, avoiding the overhead of a function call and + repeatedly parsing the format string. . Arguments are now passed more efficiently to known constructors (e.g. when using new self()). . array_map() using a first-class callable or partial function application diff --git a/UPGRADING.INTERNALS b/UPGRADING.INTERNALS index 1b9953dff57b4..c79bd44556da7 100644 --- a/UPGRADING.INTERNALS +++ b/UPGRADING.INTERNALS @@ -77,8 +77,9 @@ PHP 8.6 INTERNALS UPGRADE NOTES . build/gen_stub.php may now generate a _decl.h file in addition to the _arginfo.h file, if the stub declares enums and is annotated with - @generate-c-enums. For each enum the file will contain a C enum. Enum values - can be compared to the result of zend_enum_fetch_case_id(zend_object*). + @generate-c-enums. For each enum the file will contain a C enum. Enum + values can be compared to the result of + zend_enum_fetch_case_id(zend_object*). ======================== 3. Module changes @@ -89,7 +90,8 @@ PHP 8.6 INTERNALS UPGRADE NOTES - ext/mysqlnd: . Dropped session_options parameter from all methods in mysqlnd_auth. - The same information is present in conn->options and should be used instead. + The same information is present in conn->options and should be used + instead. - ext/session: . php_session_flush() now returns a bool rather than a zend_result.