Merge tag 'php-8.4.10' into was-8.4.x

Tag for php-8.4.10

Author: MaxKellermann

NEWS

@@ -1,6 +1,102 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-05 Jun 2025 PHP 8.4.8
+03 Jul 2025, PHP 8.4.10
+
+- BcMath:
+  . Fixed bug GH-18641 (Accessing a BcMath\Number property by ref crashes).
+    (nielsdos)
+
+- Core:
+  . Fixed bugs GH-17711 and GH-18022 (Infinite recursion on deprecated attribute
+    evaluation) and GH-18464 (Recursion protection for deprecation constants not
+    released on bailout). (DanielEScherzer and ilutov)
+  . Fixed GH-18695 (zend_ast_export() - float number is not preserved).
+    (Oleg Efimov)
+  . Fix handling of references in zval_try_get_long(). (nielsdos)
+  . Do not delete main chunk in zend_gc. (danog, Arnaud)
+  . Fix compile issues with zend_alloc and some non-default options. (nielsdos)
+
+- Curl:
+  . Fix memory leak when setting a list via curl_setopt fails. (nielsdos)
+
+- Date:
+  . Fix leaks with multiple calls to DatePeriod iterator current(). (nielsdos)
+
+- DOM:
+  . Fixed bug GH-18744 (classList works not correctly if copy HTMLElement by
+    clone keyword). (nielsdos)
+
+- FPM:
+  . Fixed GH-18662 (fpm_get_status segfault). (txuna)
+
+- Hash:
+  . Fixed bug GH-14551 (PGO build fails with xxhash). (nielsdos)
+
+- Intl:
+  . Fix memory leak in intl_datetime_decompose() on failure. (nielsdos)
+  . Fix memory leak in locale lookup on failure. (nielsdos)
+
+- Opcache:
+  . Fixed bug GH-18743 (Incompatibility in Inline TLS Assembly on Alpine 3.22).
+    (nielsdos, Arnaud)
+
+- ODBC:
+  . Fix memory leak on php_odbc_fetch_hash() failure. (nielsdos)
+
+- OpenSSL:
+  . Fix memory leak of X509_STORE in php_openssl_setup_verify() on failure.
+    (nielsdos)
+  . Fixed bug #74796 (Requests through http proxy set peer name).
+    (Jakub Zelenka)
+
+- PGSQL:
+  . Fixed GHSA-hrwm-9436-5mv3 (pgsql extension does not check for errors during
+    escaping). (CVE-2025-1735) (Jakub Zelenka)
+
+- PDO ODBC:
+  . Fix memory leak if WideCharToMultiByte() fails. (nielsdos)
+
+- PDO Sqlite:
+  . Fixed memory leak with Pdo_Sqlite::createCollation when the callback
+    has an incorrect return type. (David Carlier)
+
+- Phar:
+  . Add missing filter cleanups on phar failure. (nielsdos)
+  . Fixed bug GH-18642 (Signed integer overflow in ext/phar fseek). (nielsdos)
+
+- PHPDBG:
+  . Fix 'phpdbg --help' segfault on shutdown with USE_ZEND_ALLOC=0. (nielsdos)
+
+- PGSQL:
+  . Fix warning not being emitted when failure to cancel a query with
+    pg_cancel_query(). (Girgias)
+
+- Random:
+  . Fix reference type confusion and leak in user random engine.
+    (nielsdos, timwolla)
+
+- Readline:
+  . Fix memory leak when calloc() fails in php_readline_completion_cb().
+    (nielsdos)
+
+- SimpleXML:
+  . Fixed bug GH-18597 (Heap-buffer-overflow in zend_alloc.c when assigning
+    string with UTF-8 bytes). (nielsdos)
+
+- SOAP:
+  . Fix memory leaks in php_http.c when call_user_function() fails. (nielsdos)
+  . Fixed GHSA-453j-q27h-5p8x (NULL Pointer Dereference in PHP SOAP Extension
+    via Large XML Namespace Prefix). (CVE-2025-6491) (Lekssays, nielsdos)
+
+- Standard:
+  . Fixed GHSA-3cr5-j632-f35r (Null byte termination in hostnames).
+    (CVE-2025-1220) (Jakub Zelenka)
+
+- Tidy:
+  . Fix memory leak in tidy output handler on error. (nielsdos)
+  . Fix tidyOptIsReadonly deprecation, using tidyOptGetCategory. (David Carlier)
+
+06 Jun 2025, PHP 8.4.8
 
 - Core:
   . Fixed GH-18480 (array_splice with large values for offset/length arguments).

Zend/tests/ast/ast_serialize_floats.phpt

@@ -0,0 +1,26 @@
+--TEST--
+Serialization of floats are correct
+--INI--
+zend.assertions=1
+--FILE--
+<?php
+try {
+    assert(!is_float(0.0));
+} catch (AssertionError $e) {
+    echo 'assert(): ', $e->getMessage(), ' failed', PHP_EOL;
+}
+try {
+    assert(!is_float(1.1));
+} catch (AssertionError $e) {
+    echo 'assert(): ', $e->getMessage(), ' failed', PHP_EOL;
+}
+try {
+    assert(!is_float(1234.5678));
+} catch (AssertionError $e) {
+    echo 'assert(): ', $e->getMessage(), ' failed', PHP_EOL;
+}
+?>
+--EXPECT--
+assert(): assert(!is_float(0.0)) failed
+assert(): assert(!is_float(1.1)) failed
+assert(): assert(!is_float(1234.5678)) failed

Zend/tests/attributes/deprecated/class_constants/gh17711.phpt

@@ -0,0 +1,28 @@
+--TEST--
+GH-17711: Infinite recursion through deprecated class constants self-referencing through deprecation message
+--FILE--
+<?php
+
+class C {
+    #[\Deprecated(self::C)]
+    const C = TEST;
+}
+
+const TEST = 'Message';
+var_dump(C::C);
+
+class D {
+    #[\Deprecated(Alias::C)]
+    const C = 'test';
+}
+
+class_alias('D', 'Alias');
+var_dump(D::C);
+
+?>
+--EXPECTF--
+Deprecated: Constant C::C is deprecated, Message in %s on line %d
+string(7) "Message"
+
+Deprecated: Constant D::C is deprecated, test in %s on line %d
+string(4) "test"

Zend/tests/constants/gh18463-class-constant.phpt

@@ -0,0 +1,20 @@
+--TEST--
+GH-18463: Recursion protection should not be applied to internal class constants
+--EXTENSIONS--
+zend_test
+--FILE--
+<?php
+
+function handler($errno, $errstr, $errfile, $errline) {
+	echo "$errstr in $errfile on line $errline\n";
+	eval('class string {}');
+}
+
+set_error_handler('handler');
+
+var_dump(_ZendTestClass::ZEND_TEST_DEPRECATED);
+?>
+--EXPECTF--
+Constant _ZendTestClass::ZEND_TEST_DEPRECATED is deprecated in %s on line %d
+
+Fatal error: Cannot use "string" as a class name as it is reserved in %s(%d) : eval()'d code on line %d

Zend/tests/exception_027.phpt

@@ -0,0 +1,37 @@
+--TEST--
+Exception properties are overridden by property hooks
+--FILE--
+<?php
+class MyException extends Exception
+{
+    private bool $modified = false;
+
+    protected $code {
+        set($value) {
+            if ($this->modified) {
+                throw new Exception();
+            } else {
+                $this->modified = true;
+
+                $this->code = $value;
+            }
+        }
+    }
+}
+
+$e = new MyException("foo", 1, new Exception());
+
+try {
+    $e->__construct("bar", 2, null);
+} catch (Exception) {
+}
+
+var_dump($e->getMessage());
+var_dump($e->getCode());
+var_dump($e->getPrevious()::class);
+
+?>
+--EXPECTF--
+string(3) "bar"
+int(1)
+string(9) "Exception"

Zend/tests/exception_028.phpt

@@ -0,0 +1,43 @@
+--TEST--
+ErrorException properties are overridden by property hooks
+--FILE--
+<?php
+class MyException extends ErrorException
+{
+    private bool $modified = false;
+
+    protected $code {
+        set($value) {
+            if ($this->modified) {
+                throw new Exception();
+            } else {
+                $this->modified = true;
+
+                $this->code = $value;
+            }
+        }
+    }
+}
+
+$e = new MyException("foo", 1, E_NOTICE, "file1", 1, new Exception());
+
+try {
+    $e->__construct("bar", 2, E_WARNING, "file2", 2, null);
+} catch (Exception) {
+}
+
+var_dump($e->getMessage());
+var_dump($e->getCode());
+var_dump($e->getSeverity());
+var_dump($e->getFile());
+var_dump($e->getLine());
+var_dump($e->getPrevious()::class);
+
+?>
+--EXPECTF--
+string(3) "bar"
+int(1)
+int(8)
+string(5) "file1"
+int(1)
+string(9) "Exception"

Zend/tests/gh18756.phpt

@@ -0,0 +1,13 @@
+--TEST--
+Bug GH-18756: Zend MM may delete the main chunk
+--EXTENSIONS--
+zend_test
+--FILE--
+<?php
+
+zend_test_gh18756();
+
+?>
+==DONE==
+--EXPECT--
+==DONE==

Zend/zend.h

@@ -20,7 +20,7 @@
 #ifndef ZEND_H
 #define ZEND_H
 
-#define ZEND_VERSION "4.4.8"
+#define ZEND_VERSION "4.4.10"
 
 #define ZEND_ENGINE_3
 

Zend/zend_API.c

@@ -1438,7 +1438,7 @@ ZEND_API HashTable *zend_separate_class_constants_table(zend_class_entry *class_
 
 	ZEND_HASH_MAP_FOREACH_STR_KEY_PTR(&class_type->constants_table, key, c) {
 		if (c->ce == class_type) {
-			if (Z_TYPE(c->value) == IS_CONSTANT_AST) {
+			if (Z_TYPE(c->value) == IS_CONSTANT_AST || (ZEND_CLASS_CONST_FLAGS(c) & ZEND_ACC_DEPRECATED)) {
 				new_c = zend_arena_alloc(&CG(arena), sizeof(zend_class_constant));
 				memcpy(new_c, c, sizeof(zend_class_constant));
 				c = new_c;

Zend/zend_alloc.c

@@ -2195,7 +2195,7 @@ ZEND_API size_t zend_mm_gc(zend_mm_heap *heap)
 				i++;
 			}
 		}
-		if (chunk->free_pages == ZEND_MM_PAGES - ZEND_MM_FIRST_PAGE) {
+		if (chunk->free_pages == ZEND_MM_PAGES - ZEND_MM_FIRST_PAGE && chunk != heap->main_chunk) {
 			zend_mm_chunk *next_chunk = chunk->next;
 
 			zend_mm_delete_chunk(heap, chunk);
@@ -2422,7 +2422,9 @@ ZEND_API void zend_mm_shutdown(zend_mm_heap *heap, bool full, bool silent)
 				/* Make sure the heap free below does not use tracked_free(). */
 				heap->custom_heap._free = __zend_free;
 			}
+#if ZEND_MM_STAT
 			heap->size = 0;
+#endif
 		}
 
 		void (*shutdown)(bool, bool) = heap->custom_heap._shutdown;
@@ -2960,6 +2962,7 @@ static zend_always_inline zval *tracked_get_size_zv(zend_mm_heap *heap, void *pt
 }
 
 static zend_always_inline void tracked_check_limit(zend_mm_heap *heap, size_t add_size) {
+#if ZEND_MM_STAT
 	if (add_size > heap->limit - heap->size && !heap->overflow) {
 #if ZEND_DEBUG
 		zend_mm_safe_error(heap,
@@ -2971,6 +2974,7 @@ static zend_always_inline void tracked_check_limit(zend_mm_heap *heap, size_t ad
 			heap->limit, add_size);
 #endif
 	}
+#endif
 }
 
 static void *tracked_malloc(size_t size ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)
@@ -2984,7 +2988,9 @@ static void *tracked_malloc(size_t size ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC
 	}
 
 	tracked_add(heap, ptr, size);
+#if ZEND_MM_STAT
 	heap->size += size;
+#endif
 	return ptr;
 }
 
@@ -2995,7 +3001,9 @@ static void tracked_free(void *ptr ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) {
 
 	zend_mm_heap *heap = AG(mm_heap);
 	zval *size_zv = tracked_get_size_zv(heap, ptr);
+#if ZEND_MM_STAT
 	heap->size -= Z_LVAL_P(size_zv);
+#endif
 	zend_hash_del_bucket(heap->tracked_allocs, (Bucket *) size_zv);
 	free(ptr);
 }
@@ -3020,7 +3028,9 @@ static void *tracked_realloc(void *ptr, size_t new_size ZEND_FILE_LINE_DC ZEND_F
 
 	ptr = __zend_realloc(ptr, new_size ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
 	tracked_add(heap, ptr, new_size);
+#if ZEND_MM_STAT
 	heap->size += new_size - old_size;
+#endif
 	return ptr;
 }