Merge tag 'php-8.2.18' into was-8.2.x

Tag for php-8.2.18

Author: MaxKellermann

.cirrus.yml

@@ -4,7 +4,7 @@ env:
 freebsd_task:
   name: FREEBSD_DEBUG_NTS
   freebsd_instance:
-    image_family: freebsd-13-2
+    image_family: freebsd-13-3
   env:
     ARCH: amd64
   install_script:
@@ -14,7 +14,7 @@ freebsd_task:
     - pkg install -y autoconf bison gmake re2c icu libiconv png freetype2 enchant2 bzip2 krb5 t1lib gmp tidyp libsodium libzip libxml2 libxslt openssl oniguruma pkgconf webp libavif
   script:
     - ./buildconf -f
-    - ./configure --prefix=/usr/local --enable-debug --enable-option-checking=fatal --enable-fpm --with-pdo-sqlite --without-pear --with-bz2 --with-avif --with-jpeg --with-webp --with-freetype --enable-gd --enable-exif --with-zip --with-zlib --enable-soap --enable-xmlreader --with-xsl --with-libxml --enable-shmop --enable-pcntl --enable-mbstring --with-curl --enable-sockets --with-openssl --with-iconv=/usr/local --enable-bcmath --enable-calendar --enable-ftp --with-kerberos --with-ffi --enable-zend-test --enable-dl-test=shared --enable-intl --with-mhash --with-sodium --enable-werror --with-config-file-path=/etc --with-config-file-scan-dir=/etc/php.d
+    - ./configure --prefix=/usr/local --enable-debug --enable-option-checking=fatal --enable-fpm --with-pdo-sqlite --without-pear --with-bz2 --with-avif --with-jpeg --with-webp --with-freetype --enable-gd --enable-exif --with-zip --with-zlib --enable-soap --enable-xmlreader --with-xsl --with-libxml --enable-shmop --enable-pcntl --enable-mbstring --with-curl --enable-sockets --with-openssl --with-iconv=/usr/local --enable-bcmath --enable-calendar --enable-ftp --with-kerberos --with-ffi --enable-zend-test --enable-dl-test=shared --enable-intl --with-mhash --with-sodium --with-config-file-path=/etc --with-config-file-scan-dir=/etc/php.d
     - gmake -j2
     - mkdir /etc/php.d
     - gmake install

.github/CODEOWNERS

@@ -0,0 +1,62 @@
+# The following volunteers have self-identified as subject matter experts
+# or interested parties over a particular area of the php-src source code.
+# While requesting a review from someone does not obligate that person to
+# review a pull request, these reviewers might have valuable knowledge of
+# the problem area and could aid in deciding whether a pull request is ready
+# for merging.
+#
+# For more information, see the GitHub CODEOWNERS documentation:
+# https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+
+/.github @iluuu1994 @TimWolla
+/build/gen_stub.php @kocsismate
+/ext/bcmath @Girgias
+/ext/curl @adoy
+/ext/date @derickr
+/ext/dba @Girgias
+/ext/dom @nielsdos
+/ext/ffi @dstogov
+/ext/gettext @devnexen
+/ext/gmp @Girgias
+/ext/imap @Girgias
+/ext/intl @devnexen
+/ext/json @bukka
+/ext/libxml @nielsdos
+/ext/mbstring @alexdowad
+/ext/odbc @NattyNarwhal
+/ext/opcache @dstogov @iluuu1994
+/ext/openssl @bukka
+/ext/pdo_odbc @NattyNarwhal
+/ext/pdo_pgsql @devnexen
+/ext/pgsql @devnexen
+/ext/random @TimWolla @zeriyoshi
+/ext/session @Girgias
+/ext/sockets @devnexen
+/ext/spl @Girgias
+/ext/standard @bukka
+/ext/xmlreader @nielsdos
+/ext/xsl @nielsdos
+/main @bukka
+/sapi/fpm @bukka
+/Zend @iluuu1994
+/Zend/Optimizer @dstogov
+/Zend/zend.* @dstogov
+/Zend/zend_alloc.* @dstogov
+/Zend/zend_API.* @dstogov
+/Zend/zend_call_stack.* @arnaud-lb
+/Zend/zend_closures.* @dstogov
+/Zend/zend_execute.* @dstogov
+/Zend/zend_execute_API.c @dstogov
+/Zend/zend_gc.* @dstogov @arnaud-lb
+/Zend/zend_hash.* @dstogov
+/Zend/zend_inheritance.* @dstogov
+/Zend/zend_max_execution_timer.* @arnaud-lb
+/Zend/zend_object_handlers.* @dstogov
+/Zend/zend_objects.* @dstogov
+/Zend/zend_objects_API.* @dstogov
+/Zend/zend_opcode.* @dstogov
+/Zend/zend_string.* @dstogov
+/Zend/zend_type*.h @dstogov
+/Zend/zend_variables.* @dstogov
+/Zend/zend_vm* @dstogov
+*.stub.php @kocsismate

.github/actions/brew/action.yml

@@ -5,6 +5,12 @@ runs:
     - shell: bash
       run: |
         set -x
+
+        # Patch brew to overwrite always
+        formula_installer="$(brew --repo)"/Library/Homebrew/formula_installer.rb
+        code=" keg.link\(verbose: verbose\?"
+        sudo sed -Ei '' "s/$code.*/$code, overwrite: true\)/" "$formula_installer"
+
         brew install \
           pkg-config \
           autoconf \

.github/actions/setup-caddy/action.yml

@@ -10,3 +10,4 @@ runs:
         gh release -R caddyserver/caddy download --pattern 'caddy_*_linux_amd64.tar.gz' -O - | sudo tar -xz -C /usr/bin caddy
         sudo chmod +x /usr/bin/caddy
         sudo caddy start --config ext/curl/tests/Caddyfile
+      continue-on-error: true

.github/actions/test-libmysqlclient/action.yml

@@ -14,7 +14,6 @@ runs:
         export PDO_MYSQL_TEST_HOST=127.0.0.1
         export PDO_MYSQL_TEST_USER=root
         export PDO_MYSQL_TEST_PASS=root
-        export REPORT_EXIT_STATUS=no
         sapi/cli/php run-tests.php -P -q \
           -g FAIL,BORK,LEAK,XLEAK \
           --no-progress --offline --show-diff --show-slow 1000 --set-timeout 120 \

NEWS

@@ -1,5 +1,78 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+11 Apr 2024, PHP 8.2.18
+
+- Core:
+  . Fixed bug GH-13612 (Corrupted memory in destructor with weak references).
+    (nielsdos)
+  . Fixed bug GH-13784 (AX_GCC_FUNC_ATTRIBUTE failure). (Remi)
+  . Fixed bug GH-13670 (GC does not scale well with a lot of objects created in
+    destructor). (Arnaud)
+
+- DOM:
+  . Add some missing ZPP checks. (nielsdos)
+  . Fix potential memory leak in XPath evaluation results. (nielsdos)
+  . Fix phpdoc for DOMDocument load methods. (VincentLanglet)
+
+- FPM
+  . Fix incorrect check in fpm_shm_free(). (nielsdos)
+
+- GD:
+  . Fixed bug GH-12019 (add GDLIB_CFLAGS in feature tests). (Michael Orlitzky)
+
+- Gettext:
+  . Fixed sigabrt raised with dcgettext/dcngettext calls with gettext 0.22.5
+    with category set to LC_ALL. (David Carlier)
+
+- MySQLnd:
+  . Fix GH-13452 (Fixed handshake response [mysqlnd]). (Saki Takamachi)
+  . Fix incorrect charset length in check_mb_eucjpms(). (nielsdos)
+
+- Opcache:
+  . Fixed GH-13508 (JITed QM_ASSIGN may be optimized out when op1 is null).
+    (Arnaud, Dmitry)
+  . Fixed GH-13712 (Segmentation fault for enabled observers when calling trait
+    method of internal trait when opcache is loaded). (Bob)
+
+- PDO:
+  . Fix various PDORow bugs. (Girgias)
+
+- Random:
+  . Fixed bug GH-13544 (Pre-PHP 8.2 compatibility for mt_srand with unknown
+    modes). (timwolla)
+  . Fixed bug GH-13690 (Global Mt19937 is not properly reset in-between
+    requests when MT_RAND_PHP is used). (timwolla)
+
+- Session:
+  . Fixed bug GH-13680 (Segfault with session_decode and compilation error).
+    (nielsdos)
+
+- Sockets:
+  . Fixed bug GH-13604 (socket_getsockname returns random characters in the end
+    of the socket name). (David Carlier)
+
+- SPL:
+  . Fixed bug GH-13531 (Unable to resize SplfixedArray after being unserialized
+    in PHP 8.2.15). (nielsdos)
+  . Fixed bug GH-13685 (Unexpected null pointer in zend_string.h). (nielsdos)
+
+- Standard:
+  . Fixed bug GH-11808 (Live filesystem modified by tests). (nielsdos)
+  . Fixed GH-13402 (Added validation of `\n` in $additional_headers of mail()).
+    (SakiTakamachi)
+  . Fixed bug GH-13203 (file_put_contents fail on strings over 4GB on Windows).
+    (divinity76)
+  . Fixed bug GHSA-pc52-254m-w9w7 (Command injection via array-ish $command
+    parameter of proc_open). (CVE-2024-1874) (Jakub Zelenka)
+  . Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to
+    partial CVE-2022-31629 fix). (CVE-2024-2756) (nielsdos)
+  . Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true,
+    opening ATO risk). (CVE-2024-3096) (Jakub Zelenka)
+
+- XML:
+  . Fixed bug GH-13517 (Multiple test failures when building with
+    --with-expat). (nielsdos)
+
 14 Mar 2024, PHP 8.2.17
 
 - Core:
@@ -97,6 +170,8 @@ PHP                                                                        NEWS
     loading composer classmaps with more than 11k elements). (nielsdos)
   . Fixed bug GH-12966 (missing cross-compiling 3rd argument so Autoconf doesn't
     emit warnings). (Peter Kokot)
+  . Fixed bug GH-13727 (missing void keyword for C generate code for feature test).
+    (Peter Kokot/David Carlier)
 
 - Cli:
   . Fix incorrect timeout in built-in web server when using router script and

TSRM/threads.m4

@@ -73,7 +73,7 @@ void *thread_routine(void *data) {
     return data;
 }
 
-int main() {
+int main(void) {
     pthread_t thd;
     pthread_mutexattr_t mattr;
     int data = 1;

UPGRADING

@@ -243,6 +243,8 @@ PHP 8.2 UPGRADE NOTES
     objects.
   . mail() function reverts back to the mixed LF and CRLF new lines (behavior
     before PHP 8.0) if mail.mixed_lf_and_crlf INI is on.
+  . When $additional_headers of mail() is an array, the same validation as
+    `\r\n` is now applied to `\n` alone too.
 
 - XML
   . xml_parser_set_option() now actually returns false when attempting to set a

Zend/Zend.m4

@@ -217,7 +217,7 @@ typedef union _mm_align_test {
 #define ZEND_MM_ALIGNMENT (sizeof(mm_align_test))
 #endif
 
-int main()
+int main(void)
 {
   size_t i = ZEND_MM_ALIGNMENT;
   int zeros = 0;

Zend/tests/gh13670_001.phpt

@@ -0,0 +1,48 @@
+--TEST--
+GH-13670 001
+--SKIPIF--
+<?php
+// gc_threshold is global state
+if (getenv('SKIP_REPEAT')) die('skip Not repeatable');
+?>
+--FILE--
+<?php
+
+register_shutdown_function(function () {
+    global $shutdown;
+    $shutdown = true;
+});
+
+class Cycle {
+    public $self;
+    public function __construct() {
+        $this->self = $this;
+    }
+    public function __destruct() {
+        global $shutdown;
+        if (!$shutdown) {
+            new Cycle();
+        }
+    }
+}
+
+$defaultThreshold = gc_status()['threshold'];
+for ($i = 0; $i < $defaultThreshold+1; $i++) {
+    new Cycle();
+}
+
+$objs = [];
+for ($i = 0; $i < 100; $i++) {
+    $obj = new stdClass;
+    $objs[] = $obj;
+}
+
+$st = gc_status();
+
+if ($st['runs'] > 10) {
+    var_dump($st);
+}
+?>
+==DONE==
+--EXPECT--
+==DONE==