From 386a46757d510d551160abdf371341374517984e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= Date: Wed, 2 Sep 2026 15:24:19 +0200 Subject: [PATCH 1/4] ext/intl: fix build with older ICU (#23539) Covariant return types for clone() were only introduced in ICU 65; before that NumberFormat::clone() returns Format*, so cast the result explicitly in NumberFormatter_object_clone(). is a C++-only header, and older ICU does not wrap it in U_SHOW_CPLUSPLUS_API, so including it from php_intl.c breaks the C compile. Move it into the __cplusplus branch, next to the using declaration that needs it. --- ext/intl/formatter/formatter_class.cpp | 2 +- ext/intl/rangeformatter/rangeformatter_class.h | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/ext/intl/formatter/formatter_class.cpp b/ext/intl/formatter/formatter_class.cpp index 5b82b53c6d62..29817132acac 100644 --- a/ext/intl/formatter/formatter_class.cpp +++ b/ext/intl/formatter/formatter_class.cpp @@ -71,7 +71,7 @@ U_CFUNC zend_object *NumberFormatter_object_clone(zend_object *object) /* clone formatter object. It may fail, the destruction code must handle this case */ if (FORMATTER_OBJECT(nfo) != nullptr) { - FORMATTER_OBJECT(new_nfo) = FORMATTER_OBJECT(nfo)->clone(); + FORMATTER_OBJECT(new_nfo) = static_cast(FORMATTER_OBJECT(nfo)->clone()); if (FORMATTER_OBJECT(new_nfo) == nullptr) { zend_throw_error(NULL, "Failed to clone NumberFormatter"); } diff --git a/ext/intl/rangeformatter/rangeformatter_class.h b/ext/intl/rangeformatter/rangeformatter_class.h index 494a6d09a05f..4b6f02dc93c9 100644 --- a/ext/intl/rangeformatter/rangeformatter_class.h +++ b/ext/intl/rangeformatter/rangeformatter_class.h @@ -15,9 +15,8 @@ #ifndef RANGEFORMATTER_CLASS_H #define RANGEFORMATTER_CLASS_H -#include - #ifdef __cplusplus +#include using icu::number::LocalizedNumberRangeFormatter; #else typedef void LocalizedNumberRangeFormatter; From a25f0c5d77d384612491c89b01c79d3946d4cb3d Mon Sep 17 00:00:00 2001 From: Weilin Du Date: Thu, 3 Sep 2026 00:00:55 +0800 Subject: [PATCH 2/4] [skip ci] UPGRADING: Fix entry for snmp_init_mib Per: https://wiki.php.net/rfc/snmp_improvements_2026#allow_the_snmp_mib_to_be_reset The new function here is snmp_init_mib not snmp_read_mib. --- NEWS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/NEWS b/NEWS index 2fd0fa3a3ace..623a29b0d6c8 100644 --- a/NEWS +++ b/NEWS @@ -180,7 +180,7 @@ PHP NEWS . It is now possible to use the AES192, AES192C, AES256, and AES256C as SNMPv3 security protocols if the underlying library supports them. (eskyuu) - . It is now possible to reset the MIB tree using the new snmp_read_mib() + . It is now possible to reset the MIB tree using the new snmp_init_mib() function. (eskyuu) . Additional MIB parsing and output control functionality has been exposed via the snmp_set_mib_option(), snmp_set_output_option(), From 3d3d336e24b0c18a93697e846a1f7e4ad33a309c Mon Sep 17 00:00:00 2001 From: Weilin Du Date: Thu, 3 Sep 2026 00:06:06 +0800 Subject: [PATCH 3/4] [skip ci] Update UPGRADING with new Sodium constants This adds constants added in #20960 commit: 8a907a9 --- UPGRADING | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/UPGRADING b/UPGRADING index fb2d48a22ce9..42ee8f4228d4 100644 --- a/UPGRADING +++ b/UPGRADING @@ -878,6 +878,28 @@ PHP 8.6 UPGRADE NOTES . EAI_IDN_ENCODE. . SO_DETACH_REUSEPORT_BPF (Linux only). +- Sodium: + . SODIUM_CRYPTO_IPCRYPT_BYTES. + . SODIUM_CRYPTO_IPCRYPT_KEYBYTES. + . SODIUM_CRYPTO_IPCRYPT_ND_KEYBYTES. + . SODIUM_CRYPTO_IPCRYPT_ND_TWEAKBYTES. + . SODIUM_CRYPTO_IPCRYPT_ND_INPUTBYTES. + . SODIUM_CRYPTO_IPCRYPT_ND_OUTPUTBYTES. + . SODIUM_CRYPTO_IPCRYPT_NDX_KEYBYTES. + . SODIUM_CRYPTO_IPCRYPT_NDX_TWEAKBYTES. + . SODIUM_CRYPTO_IPCRYPT_NDX_INPUTBYTES. + . SODIUM_CRYPTO_IPCRYPT_NDX_OUTPUTBYTES. + . SODIUM_CRYPTO_IPCRYPT_PFX_KEYBYTES. + . SODIUM_CRYPTO_IPCRYPT_PFX_BYTES. + . SODIUM_CRYPTO_XOF_SHAKE128_BLOCKBYTES. + . SODIUM_CRYPTO_XOF_SHAKE128_STATEBYTES. + . SODIUM_CRYPTO_XOF_SHAKE256_BLOCKBYTES. + . SODIUM_CRYPTO_XOF_SHAKE256_STATEBYTES. + . SODIUM_CRYPTO_XOF_TURBOSHAKE128_BLOCKBYTES. + . SODIUM_CRYPTO_XOF_TURBOSHAKE128_STATEBYTES. + . SODIUM_CRYPTO_XOF_TURBOSHAKE256_BLOCKBYTES. + . SODIUM_CRYPTO_XOF_TURBOSHAKE256_STATEBYTES. + - Standard: . ARRAY_FILTER_USE_VALUE. . STREAM_CRYPTO_STATUS_NONE. From dab13a022a54f8bc03302f93ccb6484907ec1245 Mon Sep 17 00:00:00 2001 From: Volker Dusch <247397+edorian@users.noreply.github.com> Date: Wed, 2 Sep 2026 18:13:09 +0200 Subject: [PATCH 4/4] Keep EG(errors) buffer consistent on erealloc failure (#23257) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Update the error count only after the buffer has been resized and the new entry initialized. This prevents fatal error handling from reading past the buffer if reallocating it triggers an OOM bailout. Prefer safe_erealloc to avoid overflows --------- Co-authored-by: Tim Düsterhus --- Zend/zend.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/Zend/zend.c b/Zend/zend.c index e58566541dd2..aa621c4daa8e 100644 --- a/Zend/zend.c +++ b/Zend/zend.c @@ -1486,9 +1486,10 @@ ZEND_API ZEND_COLD void zend_error_zstr_at( /* This is very inefficient for a large number of errors. * Use pow2 realloc if it becomes a problem. */ - EG(num_errors)++; - EG(errors) = erealloc(EG(errors), sizeof(zend_error_info*) * EG(num_errors)); - EG(errors)[EG(num_errors)-1] = info; + uint32_t new_num_errors = EG(num_errors) + 1; + EG(errors) = safe_erealloc(EG(errors), new_num_errors, sizeof(zend_error_info*), 0); + EG(errors)[EG(num_errors)] = info; + EG(num_errors) = new_num_errors; /* Do not process non-fatal recorded error */ if (!(type & E_FATAL_ERRORS) || (type & E_DONT_BAIL)) {