[pull] master from php:master

.github/scripts/windows/build_task.bat

@@ -32,7 +32,11 @@ if "%THREAD_SAFE%" equ "0" set ADD_CONF=%ADD_CONF% --disable-zts
 if "%INTRINSICS%" neq "" set ADD_CONF=%ADD_CONF% --enable-native-intrinsics=%INTRINSICS%
 if "%ASAN%" equ "1" set ADD_CONF=%ADD_CONF% --enable-sanitizer --enable-debug-pack
 
-set CFLAGS=/W2 /WX /w14013 /wd4146 /wd4244
+rem C4018: comparison: signed/unsigned mismatch
+rem C4146: unary minus operator applied to unsigned type
+rem C4244: type conversion, possible loss of data
+rem C4267: 'size_t' type conversion, possible loss of data
+set CFLAGS=/W3 /WX /wd4018 /wd4146 /wd4244 /wd4267
 
 cmd /c configure.bat ^
 	--enable-snapshot-build ^

Zend/tests/bug81626.phpt

@@ -1,5 +1,5 @@
 --TEST--
-Bug #81626: Error on use static:: in __сallStatic() wrapped to Closure::fromCallable()
+Bug #81626: Error on use static:: in __callStatic() wrapped to Closure::fromCallable()
 --FILE--
 <?php
 class TestClass {

Zend/zend_multiply.h

@@ -290,6 +290,19 @@ static zend_always_inline size_t zend_safe_address(size_t nmemb, size_t size, si
 	return (size_t) res;
 }
 
+#elif defined(_MSC_VER)
+
+static zend_always_inline size_t zend_safe_address(size_t nmemb, size_t size, size_t offset, bool *overflow)
+{
+	size_t res;
+	if (UNEXPECTED(FAILED(ULongLongMult(nmemb, size, &res)) || FAILED(ULongLongAdd(res, offset, &res)))) {
+		*overflow = 1;
+		return 0;
+	}
+	*overflow = 0;
+	return res;
+}
+
 #else
 
 static zend_always_inline size_t zend_safe_address(size_t nmemb, size_t size, size_t offset, bool *overflow)

Zend/zend_portability.h

@@ -338,9 +338,7 @@ char *alloca();
 # define HAVE_BUILTIN_CONSTANT_P
 #endif
 
-#if __has_attribute(element_count)
-#define ZEND_ELEMENT_COUNT(m) __attribute__((element_count(m)))
-#elif __has_attribute(counted_by)
+#if __has_attribute(counted_by)
 #define ZEND_ELEMENT_COUNT(m) __attribute__((counted_by(m)))
 #else
 #define ZEND_ELEMENT_COUNT(m)

docs/source/core/data-structures/index.rst

@@ -8,5 +8,6 @@
    zval
    reference-counting
    zend_string
+   zend_constant
 
 This section provides an overview of the core data structures used in php-src.

docs/source/core/data-structures/zend_constant.rst

@@ -0,0 +1,64 @@
+###############
+ zend_constant
+###############
+
+PHP constants (referring to non-class constants) are stored in a dedicated structure
+``zend_constant``, which holds both the value of the constant and details for using it.
+
+************
+ definition
+************
+
+.. code:: c
+
+   typedef struct _zend_constant {
+       zval value;
+       zend_string *name;
+       zend_string *filename;
+   } zend_constant;
+
+The ``value`` field stores both the value itself and some metadata. The ``name`` and ``filename``
+store the name of the constant and the name of the file in which it was defined.
+
+*******
+ value
+*******
+
+The value of the constant is stored in the :doc:`./zval` ``value``. However, since the ``zval``
+structure has extra space, for constants this is used to store both the number of the module that
+the constant was defined in, and a combination of the flags that affect the usage of the constant.
+
+This extra information is placed in the ``uint32_t`` field ``value.u2.constant_flags``.
+
+The bottom 16 bits are used to hold flags about the constant
+
+.. code:: c
+
+   #define CONST_PERSISTENT     (1<<0) /* Persistent */
+   #define CONST_NO_FILE_CACHE  (1<<1) /* Can't be saved in file cache */
+   #define CONST_DEPRECATED     (1<<2) /* Deprecated */
+   #define CONST_OWNED          (1<<3) /* constant should be destroyed together
+                                            with class */
+
+These bottom 16 bits can be accessed with the ``ZEND_CONSTANT_FLAGS()`` macro, which is given a
+``zend_constant`` pointer as a parameter.
+
+On the other hand, the top 16 bits are used to store the number of the PHP module that registered
+the constant. For constants defined by the user, the module number stored will be
+``PHP_USER_CONSTANT``. This module number can be accessed with the ``ZEND_CONSTANT_MODULE_NUMBER()``
+macro, which is likewise given a ``zend_constant`` pointer as a parameter.
+
+******
+ name
+******
+
+The ``name`` holds a :doc:`zend_string` with the name of the constant, to allow searching for
+constants that have already been defined. This string is released when the constant itself is freed.
+
+**********
+ filename
+**********
+
+Finally, the ``filename`` holds another ``zend_string`` with the name of the file in which the
+constant was defined, or ``NULL`` if not defined userland code. This field provides the foundation
+for the PHP method ``ReflectionConstant::getFileName()``.

ext/com_dotnet/com_com.c

@@ -38,7 +38,7 @@ PHP_METHOD(com, __construct)
 	OLECHAR *moniker;
 	CLSID clsid;
 	CLSCTX ctx = CLSCTX_SERVER;
-	HRESULT res = E_FAIL;
+	HRESULT res = E_FAIL, res2;
 	ITypeLib *TL = NULL;
 	COSERVERINFO	info;
 	COAUTHIDENTITY	authid = {0};
@@ -142,7 +142,7 @@ PHP_METHOD(com, __construct)
 		}
 	}
 
-	if (FAILED(CLSIDFromString(moniker, &clsid))) {
+	if (FAILED(res2 = CLSIDFromString(moniker, &clsid))) {
 		/* try to use it as a moniker */
 		IBindCtx *pBindCtx = NULL;
 		IMoniker *pMoniker = NULL;
@@ -182,6 +182,9 @@ PHP_METHOD(com, __construct)
 		if (pBindCtx) {
 			IBindCtx_Release(pBindCtx);
 		}
+		if (FAILED(res) && res2 == CO_E_CLASSSTRING && !wcspbrk(moniker, L"\\:")) {
+			res = res2;
+		}
 	} else if (server_name) {
 		MULTI_QI		qi;
 

ext/curl/tests/check_win_config.phpt

@@ -54,7 +54,7 @@ UNICODE => No
 ZSTD => No
 HSTS => Yes
 GSASL => No
-Protocols => dict, file, ftp, ftps, gopher, %r(gophers, )?%rhttp, https, imap, imaps, ldap, ldaps, %r(mqtt, )?%rpop3, pop3s, rtsp, scp, sftp, smb, smbs, smtp, smtps, telnet, tftp
+Protocols => dict, file, ftp, ftps, gopher, %r(gophers, )?%rhttp, https, imap, imaps, ldap, ldaps, %r(mqtt, )?%rpop3, pop3s, rtsp, scp, sftp, smb, smbs, smtp, smtps, telnet, tftp%r(, ws)?(, wss)?%r
 Host => %s-pc-win32
 SSL Version => OpenSSL/%s
 ZLib Version => %s

ext/gd/libgd/gd.c

@@ -3187,7 +3187,11 @@ int gdImagePaletteToTrueColor(gdImagePtr src)
 		const unsigned int sy = gdImageSY(src);
 		const unsigned int sx = gdImageSX(src);
 
-		src->tpixels = (int **) gdMalloc(sizeof(int *) * sy);
+		// Note: do not revert back to gdMalloc() below ; reason here,
+		// due to a bug with a certain memory_limit INI value treshold,
+		// imagepalettetotruecolor crashes with even unrelated ZendMM allocations.
+		// See GH-17772 for an use case.
+		src->tpixels = (int **) gdCalloc(sizeof(int *), sy);
 		if (src->tpixels == NULL) {
 			return 0;
 		}

ext/gd/tests/gh17772.phpt

@@ -0,0 +1,28 @@
+--TEST--
+GH-17772 (imagepalettetotruecolor segfault on image deallocation)
+--EXTENSIONS--
+gd
+--INI--
+memory_limit=2M
+--CREDITS--
+YuanchengJiang
+--SKIPIF--
+<?php
+if (!GD_BUNDLED) die("skip requires bundled GD library");
+?>
+--FILE--
+<?php
+function setStyleAndThickness($im, $color, $thickness)
+{
+$arr = [];
+$i = 0;
+while ($i < 16 * $thickness) {
+$arer[$i++] = $color;
+}
+}
+$im = imagecreate(800, 800);
+setStyleAndThickness($im, 0, 6);
+imagepalettetotruecolor($im);
+?>
+--EXPECTF--
+Fatal error: Allowed memory size of %d bytes exhausted%s(tried to allocate %d bytes) in %s on line %d

ext/reflection/php_reflection.c

@@ -4828,24 +4828,19 @@ ZEND_METHOD(ReflectionClass, isCloneable)
 	if (ce->ce_flags & (ZEND_ACC_INTERFACE | ZEND_ACC_TRAIT | ZEND_ACC_EXPLICIT_ABSTRACT_CLASS | ZEND_ACC_IMPLICIT_ABSTRACT_CLASS | ZEND_ACC_ENUM)) {
 		RETURN_FALSE;
 	}
+	if (ce->clone) {
+		RETURN_BOOL(ce->clone->common.fn_flags & ZEND_ACC_PUBLIC);
+	}
 	if (!Z_ISUNDEF(intern->obj)) {
-		if (ce->clone) {
-			RETURN_BOOL(ce->clone->common.fn_flags & ZEND_ACC_PUBLIC);
-		} else {
-			RETURN_BOOL(Z_OBJ_HANDLER(intern->obj, clone_obj) != NULL);
-		}
+		RETURN_BOOL(Z_OBJ_HANDLER(intern->obj, clone_obj) != NULL);
 	} else {
-		if (ce->clone) {
-			RETURN_BOOL(ce->clone->common.fn_flags & ZEND_ACC_PUBLIC);
-		} else {
-			if (UNEXPECTED(object_init_ex(&obj, ce) != SUCCESS)) {
-				return;
-			}
-			/* We're not calling the constructor, so don't call the destructor either. */
-			zend_object_store_ctor_failed(Z_OBJ(obj));
-			RETVAL_BOOL(Z_OBJ_HANDLER(obj, clone_obj) != NULL);
-			zval_ptr_dtor(&obj);
+		if (UNEXPECTED(object_init_ex(&obj, ce) != SUCCESS)) {
+			return;
 		}
+		/* We're not calling the constructor, so don't call the destructor either. */
+		zend_object_store_ctor_failed(Z_OBJ(obj));
+		RETVAL_BOOL(Z_OBJ_HANDLER(obj, clone_obj) != NULL);
+		zval_ptr_dtor(&obj);
 	}
 }
 /* }}} */

ext/standard/tests/mail/mail_util.inc

@@ -143,7 +143,7 @@ class MailBox
 
         $this->mailConnecter->send(self::SEARCH, "UID SEARCH SUBJECT \"{$subject}\"");
         $res = $this->mailConnecter->getResponse(self::SEARCH);
-        preg_match('/SEARCH ([0-9 ]+)/is', $res, $matches);
+        preg_match('/SEARCH ([0-9 ]+)/i', $res, $matches);
         return isset($matches[1]) ? explode(' ', trim($matches[1])) : [];
     }
 
@@ -166,8 +166,7 @@ class MailBox
             if (!$line) {
                 continue;
             }
-            $items = explode(':', $line);
-            preg_match('/^(.+?):(.+?)$/', $line, $matches);
+            preg_match('/^(.+?):(.+)$/', $line, $matches);
             $key = trim($matches[1] ?? '');
             $val = trim($matches[2] ?? '');
             if (!$key || !$val || $val === self::FETCH_HEADERS.' OK UID completed' || $val === ')') {

win32/build/phpize.js.in

@@ -92,6 +92,7 @@ function find_config_w32(dirname)
 
 		deps = get_module_dep(contents);
 
+		n = "";
 		item = new Module_Item(n, c, dir_line, deps, contents);
 		MODULES.Add(n, item);
 	}