PHP full changelog

Core:
Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via bailout).
Fixed bug GH-23644 (Optimizer leaves a constant-vs-constant comparison unfolded, crashing the VM in zval_undefined_cv).
Fixed OSS-Fuzz 532353396 (assertion failure with static type).
Fix GH-23662 (Avoid NAN warning in print_r()).
Fix GH-21999: GC inconsistency with lazy object, var_dump(), and object comparison.
Fixed OSS-Fuzz #536440507 (Immutable class incorrect assertion).
Fixed AVX being reported as supported when the OS has not enabled AVX state.
Fixed GH-23980 (ZEND_ASSERT violation @ ZEND_INCLUDE_OR_EVAL).
Fixed use-after-free when a dl()-loaded extension declares a frameless function and a later request calls it.
Fixed System V shared memory emulation for Windows attaching segments past the end of their mapping.
Fixed exception thrown by destructor during GC in a Fiber not being rethrown into the frame that triggered the GC.
BCMath:
Fixed BcMathNumber results that truncate to zero keeping a negative sign and comparing less than zero.
BZ2:
Fixed double close of the descriptor and use-after-free of the inner stream when bzopen() is given a stream resource.
CLI:
Fix GH-22567 (Windows ZTS CLI SAPI should refresh its TSRMLS cache during request activation).
Fixed bug GH-23764 (Built-in server leaks a file descriptor on every HEAD request for a static file).
Fixed crash in the built-in server when a client is reset before being accepted.
Fixed the built-in server truncating an error page and leaking its unsent part after a partial socket write.
DOM:
Fixed use-after-free when re-constructing a DOMXPath whose php:function registrations are freed while still reachable from the cycle collector.
Fixed DomHTMLDocument::getElementById() not finding ids of SVG and MathML elements.
Fixed DomHTMLDocument giving attributes the namespace of their element when a fragment is parsed with an xlink, xml or xmlns context element.
Fixed bug GH-23887 (DomHTMLCollection::namedItem() assertion fa

Core:
Fixed bug GH-22782 (Const expr FCC crashes under preloading).
Fixed bug GH-23088 (Stack overflow when comparing deeply nested arrays).
Date:
Fixed leak on double DatePeriod::__construct() call.
DOM:
Fixed bug GH-23116 (Stack overflow when normalizing a deeply nested DOMDocument).
Fixed bug GH-23117 (Stack overflow when normalizing a deeply nested DomXMLDocument).
Fixed bug GH-22825 (DOMElement::setAttribute() fails silently when the DTD declares a default value for the attribute).
Fixed bug GH-23120 (Stack overflow when comparing deeply nested DOM nodes with DOMNode::isEqualNode()).
Exif:
Fixed exif_read_data() allocating a HEIF meta box larger than the file it came from.
Intl:
Fixed IntlListFormatter::__construct() leaving stale global error state after successful calls.
Opcache:
Fixed GH-22693 (DT_TEXTREL in JIT-generated TLS access on x86_64).
Fixed bug GH-22763 (JIT fails to clear ZREG_TYPE_ONLY after setting reg).
Fixed bug GH-22857 (Function JIT emits wrong code for FETCH_OBJ_FUNC_ARG on a property hook getter, losing register-held variables).
Fixed bug GH-22916 (Preserve parent regs in zend_jit_deoptimizer_start()).
OpenSSL:
Fix missing error check on invalid alpn protocols.
MBString:
Fixed bug GH-22779 (mb_strrpos() returns the wrong position for a negative offset in a non-UTF-8 encoding).
Fixed bug GH-21036 (mb_ereg_search_getregs() crashes after mb_eregi() invalidates the regex cache).
PCRE:
Fixed bug GH-21134 (Crash with C + UTF-8). Using C in UTF-8 patterns is now forbidden.
PDO_ODBC:
Fixed bug GH-23016 (NULL values in long columns come back as garbage binary strings).
PDO_PGSQL:
Fixed several lazy fetch (PDO::ATTR_PREFETCH => 0) defects: an infinite loop when cleaning up a fetch left in a COPY, a use-after-free when a statement with emulated or disabled prepares is destroyed, a connection left busy for the next fetch, and rows delivered from a result another statement took over.
Reflection:
Fixed bug GH-22905 (Reflection exception messages trun

Date:
Fixed bug GH-18422 (int overflow in php_date_llabs).
Intl:
Fix incorrect argument positions in out-of-bounds errors for IntlCalendar::set(), IntlCalendar::setDate(), IntlCalendar::setDateTime(), and IntlGregorianCalendar date/time construction.
Expose Spoofchecker restriction-level APIs on all supported ICU versions.
Fix SpoofChecker::setAllowedChars() and IntlDateFormatter::__construct() to report PHP constant names instead of ICU constant names in user-visible error messages.
MySQLnd:
Fix persistent free of non-persistent connect_attr key (David Carlier).
Opcache:
Fixed tracing JIT crash when a VM interrupt is handled during an observed user function call.
Fixed bug GH-22004 (Assertion failure at ext/opcache/jit/zend_jit_trace.c).
OpenSSL:
Fix compatibility issues with OpenSSL 4.0.
SPL:
Fix SplFixedArray::setSize leak when destructor grows during clear.
Fixed bug GH-21933 (use after free of self-freeing MultipleIterator children).
Standard:
Fixed bug GH-21689 (version_compare() incorrectly handles versions ending with a dot).
Fixed ip2long() leading zeros handling inconsistency on AIX.

Core:
Fixed bug GH-21029 (zend_mm_heap corrupted on Aarch64, LTO builds).
Fixed bug GH-21059 (Segfault when preloading constant AST closure).
Fixed bug GH-21072 (Crash on (unset) cast in constant expression).
Fix deprecation now showing when accessing null key of an array with JIT.
Fixed bug GH-20657 (Assertion failure in zend_lazy_object_get_info triggered by setRawValueWithoutLazyInitialization() and newLazyGhost()).
Fixed bug GH-20504 (Assertion failure in zend_get_property_guard when accessing properties on Reflection LazyProxy via isset()).
Fixed OSS-Fuzz #478009707 (Borked assign-op/inc/dec on untyped hooked property backing value).
Fixed bug GH-21215 (Build fails with -std=).
Fixed bug GH-13674 (Build system installs libtool wrappers when using slibtool).
Curl:
Don't truncate length.
Date:
Fixed bug GH-20936 (DatePeriod::__set_state() cannot handle null start).
Fix timezone offset with seconds losing precision.
DOM:
Fixed bug GH-21077 (Accessing DomNode::baseURI can throw TypeError).
Fixed bug GH-21097 (Accessing DomNode properties can can throw TypeError).
LDAP:
Fixed bug GH-21262 (ldap_modify() too strict controls argument validation makes it impossible to unset attribute).
MBString:
Fixed bug GH-21223; mb_guess_encoding no longer crashes when passed huge list of candidate encodings (with 200,000+ entries).
Opcache:
Fixed bug GH-20718 ("Insufficient shared memory" when using JIT on Solaris).
Fixed bug GH-21227 (Borked SCCP of array containing partial object).
OpenSSL:
Fix a bunch of leaks and error propagation.
Windows:
Fixed compilation with clang (missing intrin.h include).

Core:
Fixed bug GH-21029 (zend_mm_heap corrupted on Aarch64, LTO builds).
Fixed bug GH-21059 (Segfault when preloading constant AST closure).
Fixed bug GH-21072 (Crash on (unset) cast in constant expression).
Fix deprecation now showing when accessing null key of an array with JIT.
Fixed bug GH-20657 (Assertion failure in zend_lazy_object_get_info triggered by setRawValueWithoutLazyInitialization() and newLazyGhost()).
Fixed bug GH-20504 (Assertion failure in zend_get_property_guard when accessing properties on Reflection LazyProxy via isset()).
Fixed OSS-Fuzz #478009707 (Borked assign-op/inc/dec on untyped hooked property backing value).
Fixed bug GH-21215 (Build fails with -std=).
Fixed bug GH-13674 (Build system installs libtool wrappers when using slibtool).
Curl:
Don't truncate length.
Date:
Fixed bug GH-20936 (DatePeriod::__set_state() cannot handle null start).
Fix timezone offset with seconds losing precision.
DOM:
Fixed bug GH-21077 (Accessing DomNode::baseURI can throw TypeError).
Fixed bug GH-21097 (Accessing DomNode properties can can throw TypeError).
LDAP:
Fixed bug GH-21262 (ldap_modify() too strict controls argument validation makes it impossible to unset attribute).
MBString:
Fixed bug GH-21223; mb_guess_encoding no longer crashes when passed huge list of candidate encodings (with 200,000+ entries).
Opcache:
Fixed bug GH-20718 ("Insufficient shared memory" when using JIT on Solaris).
Fixed bug GH-21227 (Borked SCCP of array containing partial object).
OpenSSL:
Fix a bunch of leaks and error propagation.
Windows:
Fixed compilation with clang (missing intrin.h include).

Core:
Fixed bug GH-20806 (preserve_none feature compatiblity with LTO).
Fixed bug GH-20767 (build failure with musttail/preserve_none feature on macOs).
Fixed bug GH-20837 (NULL dereference when calling ob_start() in shutdown function triggered by bailout in php_output_lock_error()).
Fix OSS-Fuzz #471533782 (Infinite loop in GC destructor fiber).
Fix OSS-Fuzz #472563272 (Borked block_pass JMP[N]Z optimization).
Fixed bug GH-20914 (Internal enums can be cloned and compared).
Fix OSS-Fuzz #474613951 (Leaked parent property default value).
Fixed bug GH-20895 (ReflectionProperty does not return the PHPDoc of a property if it contains an attribute with a Closure).
Fixed bug GH-20766 (Use-after-free in FE_FREE with GC interaction).
Fix OSS-Fuzz #471486164 (Broken by-ref assignment to uninitialized hooked backing value).
Fix OSS-Fuzz #438780145 (Nested finally with repeated return type check may uaf).
Fixed bug GH-20905 (Lazy proxy bailing __clone assertion).
Fixed bug GH-20479 (Hooked object properties overflow).
Date:
Update timelib to 2022.16.
DOM:
Fixed GH-21041 (DomHTMLDocument corrupts closing tags within scripts).
MbString:
Fixed bug GH-20833 (mb_str_pad() divide by zero if padding string is invalid in the encoding).
Fixed bug GH-20836 (Stack overflow in mb_convert_variables with recursive array references).
Opcache:
Fixed bug GH-20818 (Segfault in Tracing JIT with object reference).
OpenSSL:
Fix memory leaks when sk_X509_new_null() fails.
Fix crash when in openssl_x509_parse() when i2s_ASN1_INTEGER() fails.
Fix crash in openssl_x509_parse() when X509_NAME_oneline() fails.
Phar:
Fixed bug GH-20882 (buildFromIterator breaks with missing base directory).
PGSQL:
Fixed INSERT/UPDATE queries building with PQescapeIdentifier() and possible UB.
Readline:
Fixed bug GH-18139 (Memory leak when overriding some settings via readline_info()).
SPL:
Fixed bug GH-20856 (heap-use-after-free in SplDoublyLinkedList iterator when modifying during iteration).
Standard:
Fixed bug #74357

Core:
Fixed bug GH-20806 (preserve_none feature compatiblity with LTO).
Fixed bug GH-20767 (build failure with musttail/preserve_none feature on macOs).
Fixed bug GH-20837 (NULL dereference when calling ob_start() in shutdown function triggered by bailout in php_output_lock_error()).
Fix OSS-Fuzz #471533782 (Infinite loop in GC destructor fiber).
Fix OSS-Fuzz #472563272 (Borked block_pass JMP[N]Z optimization).
Fixed bug GH-20914 (Internal enums can be cloned and compared).
Fix OSS-Fuzz #474613951 (Leaked parent property default value).
Fixed bug GH-20895 (ReflectionProperty does not return the PHPDoc of a property if it contains an attribute with a Closure).
Fixed bug GH-20766 (Use-after-free in FE_FREE with GC interaction).
Fix OSS-Fuzz #471486164 (Broken by-ref assignment to uninitialized hooked backing value).
Fix OSS-Fuzz #438780145 (Nested finally with repeated return type check may uaf).
Fixed bug GH-20905 (Lazy proxy bailing __clone assertion).
Fixed bug GH-20479 (Hooked object properties overflow).
Date:
Update timelib to 2022.16.
DOM:
Fixed GH-21041 (DomHTMLDocument corrupts closing tags within scripts).
MbString:
Fixed bug GH-20833 (mb_str_pad() divide by zero if padding string is invalid in the encoding).
Fixed bug GH-20836 (Stack overflow in mb_convert_variables with recursive array references).
Opcache:
Fixed bug GH-20818 (Segfault in Tracing JIT with object reference).
OpenSSL:
Fix memory leaks when sk_X509_new_null() fails.
Fix crash when in openssl_x509_parse() when i2s_ASN1_INTEGER() fails.
Fix crash in openssl_x509_parse() when X509_NAME_oneline() fails.
Phar:
Fixed bug GH-20882 (buildFromIterator breaks with missing base directory).
PGSQL:
Fixed INSERT/UPDATE queries building with PQescapeIdentifier() and possible UB.
Readline:
Fixed bug GH-18139 (Memory leak when overriding some settings via readline_info()).
SPL:
Fixed bug GH-20856 (heap-use-after-free in SplDoublyLinkedList iterator when modifying during iteration).
Standard:
Fixed bug #74357

Core:
Fix OSS-Fuzz #465488618 (Wrong assumptions when dumping function signature with dynamic class const lookup default argument).
Fixed bug GH-20695 (Assertion failure in normalize_value() when parsing malformed INI input via parse_ini_string()).
Fixed bug GH-20714 (Uncatchable exception thrown in generator).
Fixed bug GH-20352 (UAF in php_output_handler_free via re-entrant ob_start() during error deactivation).
Fixed bug GH-20745 ("Casting out of range floats to int" applies to strings).
DOM:
Fixed bug GH-20722 (Null pointer dereference in DOM namespace node cloning via clone on malformed objects).
Fixed bug GH-20444 (DomXMLDocument::C14N() seems broken compared to DOMDocument::C14N()).
EXIF:
Fixed bug GH-20631 (Integer underflow in exif HEIF parsing when pos.size < 2).
Intl:
Fix leak in umsg_format_helper().
LDAP:
Fix memory leak in ldap_set_options().
Lexbor:
Fixed bug GH-20668 (UriWhatWgUrl::withHost() crashes (SEGV) for URLs using the file: scheme).
Mbstring:
Fixed bug GH-20674 (mb_decode_mimeheader does not handle separator).
PCNTL:
Fixed bug with pcntl_getcpuaffinity() on solaris regarding invalid process ids handling.
Phar:
Fixed bug GH-20732 (Phar::LoadPhar undefined behavior when reading fails).
Fix SplFileInfo::openFile() in write mode.
Fix build on legacy OpenSSL 1.1.0 systems.
Fixed bug #74154 (Phar extractTo creates empty files).
Session:
Fix support for MM module.
Sqlite3:
Fixed bug GH-20699 (SQLite3Result fetchArray return array|false, null returned).
Standard:
Fix error check for proc_open() command.
Fix memory leak in mail() when header key is numeric.
Fixed bug GH-20582 (Heap Buffer Overflow in iptcembed).
URI:
Fixed bug GH-20771 (Assertion failure when getUnicodeHost() returns empty string).
Zlib:
Fix OOB gzseek() causing assertion failure.

Core:
Fix OSS-Fuzz #465488618 (Wrong assumptions when dumping function signature with dynamic class const lookup default argument).
Fixed bug GH-20695 (Assertion failure in normalize_value() when parsing malformed INI input via parse_ini_string()).
Fixed bug GH-20714 (Uncatchable exception thrown in generator).
Fixed bug GH-20352 (UAF in php_output_handler_free via re-entrant ob_start() during error deactivation).
Fixed bug GH-20745 ("Casting out of range floats to int" applies to strings).
DOM:
Fixed bug GH-20722 (Null pointer dereference in DOM namespace node cloning via clone on malformed objects).
Fixed bug GH-20444 (DomXMLDocument::C14N() seems broken compared to DOMDocument::C14N()).
EXIF:
Fixed bug GH-20631 (Integer underflow in exif HEIF parsing when pos.size < 2).
Intl:
Fix leak in umsg_format_helper().
LDAP:
Fix memory leak in ldap_set_options().
Lexbor:
Fixed bug GH-20668 (UriWhatWgUrl::withHost() crashes (SEGV) for URLs using the file: scheme).
Mbstring:
Fixed bug GH-20674 (mb_decode_mimeheader does not handle separator).
PCNTL:
Fixed bug with pcntl_getcpuaffinity() on solaris regarding invalid process ids handling.
Phar:
Fixed bug GH-20732 (Phar::LoadPhar undefined behavior when reading fails).
Fix SplFileInfo::openFile() in write mode.
Fix build on legacy OpenSSL 1.1.0 systems.
Fixed bug #74154 (Phar extractTo creates empty files).
Session:
Fix support for MM module.
Sqlite3:
Fixed bug GH-20699 (SQLite3Result fetchArray return array|false, null returned).
Standard:
Fix error check for proc_open() command.
Fix memory leak in mail() when header key is numeric.
Fixed bug GH-20582 (Heap Buffer Overflow in iptcembed).
URI:
Fixed bug GH-20771 (Assertion failure when getUnicodeHost() returns empty string).
Zlib:
Fix OOB gzseek() causing assertion failure.

Core:
Added the #[NoDiscard] attribute to indicate that a function's return value is important and should be consumed.
Added the (void) cast to indicate that not using a value is intentional.
Added get_error_handler(), get_exception_handler() functions.
Added support for casts in constant expressions.
Added the pipe (|>) operator.
Added the #[DelayedTargetValidation] attribute to delay target errors for internal attributes from compile time to runtime.
Added support for `final` with constructor property promotion.
Added support for configuring the URI parser for the FTP/FTPS as well as the SSL/TLS stream wrappers as described in https://wiki.php.net/rfc/url_parsing_api#plugability.
Added PHP_BUILD_PROVIDER constant.
Added PHP_BUILD_DATE constant.
Added support for Closures and first class callables in constant expressions.
Add support for backtraces for fatal errors.
Add clone-with support to the clone() function.
Add RFC 3986 and WHATWG URL compliant APIs for URL parsing and manipulation (kocsismate, timwolla)
Fixed AST printing for immediately invoked Closure.
Properly handle __debugInfo() returning an array reference.
Properly handle reference return value from __toString().
Improved error message of UnhandledMatchError for zend.exception_string_param_max_len=0.
Fixed bug GH-15753 and GH-16198 (Bind traits before parent class).
Fixed bug GH-17951 (memory_limit is not always limited by max_memory_limit).
Fixed bug GH-20183 (Stale EG(opline_before_exception) pointer through eval).
Fixed bug GH-20113 (Missing new Foo(...) error in constant expressions).
Fixed bug GH-19844 (Don't bail when closing resources on shutdown).
Fixed bug GH-20177 (Accessing overridden private property in get_object_vars() triggers assertion error).
Fix OSS-Fuzz #447521098 (Fatal error during sccp shift eval).
Fixed bug GH-20002 (Broken build on *BSD with MSAN).
Fixed bug GH-19352 (Cross-compilation with musl C library).
Fixed bug GH-19765 (object_properties_load() bypasses readonly prope