Skip to content

[pull] master from php:master#935

Merged
pull[bot] merged 7 commits into
turkdevops:masterfrom
php:master
May 16, 2026
Merged

[pull] master from php:master#935
pull[bot] merged 7 commits into
turkdevops:masterfrom
php:master

Conversation

@pull
Copy link
Copy Markdown

@pull pull Bot commented May 16, 2026

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

TimWolla and others added 7 commits May 16, 2026 18:20
* Deprecate making `__debugInfo()` nullable

Returning `null` is already deprecated since PHP 8.5
(3dc962b). Not deprecating a corresponding
return type seems like an oversight.

* NEWS / UPGRADING
* PHP-8.4:
  ext/intl: Fix out-of-bounds argument positions in calendar date/time APIs.
* PHP-8.5:
  ext/intl: Fix out-of-bounds argument positions in calendar date/time APIs.
The previous code computed `Z_STRLEN_P(myval) + ZSTR_LEN(decoded_value)`
as a plain `size_t` addition before passing the result to
zend_string_extend(), which can wrap on 32-bit and lead to a heap
overflow in the following strncpy(). Switch to zend_string_safe_realloc()
so the size computation is bounds-checked.

close GH-22056
* PHP-8.4:
  ext/xml: Use zend_string_safe_realloc() for cdata concatenation.
* PHP-8.5:
  ext/xml: Use zend_string_safe_realloc() for cdata concatenation.
@pull pull Bot locked and limited conversation to collaborators May 16, 2026
@pull pull Bot added the ⤵️ pull label May 16, 2026
@pull pull Bot merged commit 51911cc into turkdevops:master May 16, 2026
0 of 2 checks passed
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants