Skip to content

[pull] master from php:master#1039

Merged
pull[bot] merged 9 commits into
turkdevops:masterfrom
php:master
Jun 27, 2026
Merged

[pull] master from php:master#1039
pull[bot] merged 9 commits into
turkdevops:masterfrom
php:master

Conversation

@pull

@pull pull Bot commented Jun 27, 2026

Copy link
Copy Markdown

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

kn1g78 and others added 9 commits June 27, 2026 18:08
Use uenum_count() to pre-size arrays built from ICU enumerations.

This avoids unnecessary HashTable growth in transliterator_list_ids(),
resourcebundle_locales() and locale_get_keywords().

locale_get_keywords() also uses the keyword length reported by ICU when
inserting the associative entry, with a fallback to strlen() for unknown
lengths.

If counting fails, the previous behavior is preserved by falling back to an
unsized array initialization.
move_forward_ex() caches the active sub-iterator, then calls the inner
iterator's move_forward(), which can re-enter userland. A next() that
rewinds or advances the RecursiveIteratorIterator frees that sub-iterator,
and the following validity check then reads freed memory. Re-fetch the
sub-iterator after the call, the same way the no-more-elements branch
already re-checks the level after endChildren().

Closes GH-22466
* PHP-8.4:
  Fix use-after-free in RecursiveIteratorIterator on reentry
* PHP-8.5:
  Fix use-after-free in RecursiveIteratorIterator on reentry
A php:function() callback receives DOM node arguments as proxies that own
the underlying libxml node. If the callback detaches such a node, the
argument cleanup frees it while libxml is still evaluating the expression
and still references it in the result node-set. Keep node and node-set
argument proxies alive until evaluation ends, as returned nodes already are.

Closes GH-22468
* PHP-8.4:
  Fix use-after-free in XPath php:function argument nodes
* PHP-8.5:
  Fix use-after-free in XPath php:function argument nodes
@pull pull Bot locked and limited conversation to collaborators Jun 27, 2026
@pull pull Bot added the ⤵️ pull label Jun 27, 2026
@pull pull Bot merged commit 9bc8b7e into turkdevops:master Jun 27, 2026
0 of 2 checks passed
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants