Skip to content

Conversation

@pull
Copy link

@pull pull bot commented Mar 13, 2025

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.1)

Can you help keep this open source service alive? 💖 Please sponsor : )

adoy and others added 22 commits March 13, 2025 13:14
* PHP-8.1:
  [skip ci] Fix invalid release date of 8.1.1
* PHP-8.2:
  [skip ci] Fix invalid release date of 8.1.1
* PHP-8.3:
  [skip ci] Fix release dates on NEWS
  [skip ci] Fix invalid release date of 8.1.1
  [skip ci] Fix release date of 8.3.19
* PHP-8.4:
  [skip ci] Fix release dates on NEWS
  [skip ci] Fix release dates on NEWS
  [skip ci] Fix invalid release date of 8.1.1
  [skip ci] Fix release date of 8.3.19
We should first check truthiness and only after that destroy the value.

Closes GH-18034.
* PHP-8.3:
  Fix GH-18018: RC1 data returned from offsetGet causes UAF in ArrayObject
* PHP-8.4:
  [ci skip] Fix NEWS order
  Fix GH-18018: RC1 data returned from offsetGet causes UAF in ArrayObject
This is a bit of a theoretical issue, but the maximum string length is
actually ZSTR_MAX_LEN instead of SIZE_MAX. The resulting check is a bit
slower but should still be relatively cheap.

Closes GH-18049.
A frameless icall with 3 arguments is a special case because it uses
OP_DATA, but this was not added to the list, so the opline pointed to
the wrong address resulting in UBSAN report or crash.

Closes GH-18048.
* PHP-8.4:
  Fix GH-18037: SEGV Zend/zend_execute.c
* PHP-8.3:
  Correct check for maximum string length in JIT helpers
* PHP-8.4:
  Correct check for maximum string length in JIT helpers
@pull pull bot added the ⤵️ pull label Mar 13, 2025
@pull pull bot merged commit b6e55d9 into wudi:master Mar 13, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants