Skip to content

Fix GH-19739: imagefilledellipse/imageellipse overflow#19743

Closed
devnexen wants to merge 4832 commits into
php:PHP-8.3from
devnexen:gh19739
Closed

Fix GH-19739: imagefilledellipse/imageellipse overflow#19743
devnexen wants to merge 4832 commits into
php:PHP-8.3from
devnexen:gh19739

Conversation

@devnexen
Copy link
Copy Markdown
Member

@devnexen devnexen commented Sep 6, 2025

No description provided.

ndossche and others added 29 commits January 22, 2026 22:37
In a lot of places the return value is not checked, and when the
function fails the code continues execution. However, this means that
operations on the stack fail and will cause memory leaks on the objects
that weren't pushed.

We also notice an inconsistency in how these failures are handled.
For example, in one place we explicitly have a fatal error
`php_error_docref(NULL, E_ERROR, "Memory allocation failure");`
but this is the only place to do so.

Closes phpGH-20957.
The X509_NAME_oneline() function can return NULL,
which will cause a crash when the string length is computed via add_assoc_string().

Closes phpGH-21011.
The X509_NAME_oneline() function can return NULL, which will cause a
crash when the string length is computed via add_assoc_string().

Closes phpGH-21010.
* PHP-8.3:
  GitHub actions: drop more 8.1 CI configuration (php#20763)
Inline assembly in zend_safe_address() clobbers flags register. Add missing
register in clobber list for aarch64 and powerpc64. Other archs were already
correct.

Fixes phpGH-21029
we check the FCC is properly initialised beforehand in its handler.

close phpGH-21025
Prior to this patch there was a common read handler, and it relied on
the dom class set in the intern document. However, Dom\Implementation
allows creating DTDs unassociated with a document, so we can't rely on
an intern document and the check fails. This causes the ZVAL_NULL() path
to be taken.
To solve this, just split the handler.

Closes phpGH-21082.
A lazy object is marked non-lazy when all its properties are
initialized. Before doing so we delete the object info, resulting in a
temporarily invalid state. In phpGH-20657 the GC is triggered at this moment.

Fix by deleting the object info _after_ marking it non lazy.

Fixes phpGH-20657
Closes phpGH-21094
In phpGH-18039 we guard the underlying property before forwarding access
to the real instance of a lazy proxy. When the real instance lacks magic
methods, the assertion zobj->ce->ce_flags & ZEND_ACC_USE_GUARDS fails in
zend_get_property_guard().

Fix by checking that the real instance uses guards.

Fixes phpGH-20504
Closes phpGH-21093
* PHP-8.3:
  Make brew verbose, limit to 10 minutes
…r(s)

Split the handler again, or defer to instanceof when performance doesn't
matter.

Closes phpGH-21108.
The "current" and "end" field also rely on start_ce, which is set by
"start". Therefore, if "current" or "end" are provided, so must "start"
be provided.

Closes phpGH-20939.
There are two issues:
1. The 'e' formatter doesn't output the seconds of the timezone even if
   it has seconds.
2. var_dump(), (array) cast, serialization, ... don't include the
   timezone second offset in the output. This means that, for example,
   serializing and then unserializing a date object loses the seconds of
   the timezone. This can be observed by comparing the output of
   getTimezone() for `$dt` vs the unserialized object in the provided test.

Closes phpGH-20764.
This issue was already fixed in phpGH-21124, but some JIT paths were missing.

Closes phpGH-21151
* PHP-8.3:
  [CI] Use MySQL LTS version
The SysV shared memory allocator in OPcache hardcodes a maximum segment size of
32MB (SEG_ALLOC_SIZE_MAX). If the JIT buffer exceeds this, which it does with
the default 64MB size, startup will fail with "Insufficient shared memory!".

The allocator will now try allocating a contiguous buffer first, and only then
use segmentation by searching for continuously smaller powers of 2.

Fixes phpGH-20718
Closes phpGH-20719
… null.

in the ipv6 address creation helper we need to use, for the error
message, the converted data rather than assuming the original
is a proper zend_string().

close phpGH-21166
IR commit: a098f9ed6c2f1c2852d6c0921283212aafb4afed
* PHP-8.3:
  Disable pkg cache for FreeBSD jobs
The PHP_PQ_ERROR macro calls php_error_docref() which triggers user error handlers
thus libpq does not have the chance to clean the resources (and empty
connections string are allowed) on failure thus we avoid this macro
and delay the error handling after.

close phpGH-21165
we just mirror what is done for socket_connect()/AF_UNIX type.

close phpGH-21218
shivammathur and others added 3 commits May 20, 2026 19:38
* PHP-8.3:
  Make curl brotli and zstd optional on Windows (php#21925)
* PHP-8.3:
  Switch to VS18 for the master branch (php#22094)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.