Merge branch 'PHP-8.5'

* PHP-8.5:
  ext/filter: fix use-after-free in parse_str() with filter.default

Author: iliaal

ext/filter/filter.c

@@ -378,15 +378,18 @@ static unsigned int php_sapi_filter(int arg, const char *var, char **val, size_t
 	}
 
 	if (retval) {
+		zend_string *tmp_str;
+		zend_string *str = zval_get_tmp_string(&new_var, &tmp_str);
 		if (new_val_len) {
-			*new_val_len = Z_STRLEN(new_var);
+			*new_val_len = ZSTR_LEN(str);
 		}
 		efree(*val);
-		if (Z_STRLEN(new_var)) {
-			*val = estrndup(Z_STRVAL(new_var), Z_STRLEN(new_var));
+		if (ZSTR_LEN(str)) {
+			*val = estrndup(ZSTR_VAL(str), ZSTR_LEN(str));
 		} else {
 			*val = estrdup("");
 		}
+		zend_tmp_string_release(tmp_str);
 		zval_ptr_dtor(&new_var);
 	}
 

ext/filter/tests/filter_default_parse_str.phpt

@@ -0,0 +1,19 @@
+--TEST--
+filter.default with parse_str must not crash on non-string filter results
+--EXTENSIONS--
+filter
+--INI--
+filter.default=int
+--FILE--
+<?php
+parse_str('a=1&b=notint', $out);
+var_dump($out);
+?>
+--EXPECTF--
+Deprecated: The filter.default ini setting is deprecated in %s on line %d
+array(2) {
+  ["a"]=>
+  string(1) "1"
+  ["b"]=>
+  string(0) ""
+}