Fix Use-After-Free in RecursiveArrayIterator::getChildren()

.circleci/config.yml

@@ -4,7 +4,7 @@ jobs:
   arm:
     resource_class: arm.medium
     docker:
-      - image: cimg/base:current-22.04
+      - image: cimg/base:current-24.04
       - image: mysql:8.4
         environment:
           MYSQL_ALLOW_EMPTY_PASSWORD: true
@@ -60,7 +60,7 @@ jobs:
               libreadline-dev \
               libldap2-dev \
               libsodium-dev \
-              libargon2-0-dev \
+              libargon2-dev \
               libmm-dev \
               libsnmp-dev \
               snmpd \
@@ -78,7 +78,7 @@ jobs:
               libqdbm-dev \
               libjpeg-dev \
               libpng-dev \
-              libfreetype6-dev
+              libfreetype-dev
       - run:
           name: ./configure
           command: |
@@ -90,7 +90,6 @@ jobs:
               --prefix=/usr \
               --enable-phpdbg \
               --enable-fpm \
-              --enable-opcache \
               --with-pdo-mysql=mysqlnd \
               --with-mysqli=mysqlnd \
               --with-pgsql \
@@ -169,7 +168,6 @@ jobs:
           command: |
             export RUN_RESOURCE_HEAVY_TESTS=1
             sapi/cli/php run-tests.php \
-              -d zend_extension=opcache.so \
               -d opcache.enable_cli=1 \
               -d opcache.jit_buffer_size=64M \
               -d opcache.jit=tracing \

.editorconfig

@@ -32,3 +32,7 @@ max_line_length          = 80
 
 [*.patch]
 trim_trailing_whitespace = false
+
+[*.rst]
+indent_style             = space
+max_line_length          = 100

.gitattributes

@@ -21,7 +21,8 @@
 
 # Collapse generated files within git and pull request diff.
 **/*_arginfo.h linguist-generated -diff
-/main/gdb_inlined_script.c linguist-generated -diff
+**/*_decl.h linguist-generated -diff
+/main/debug_gdb_scripts.c linguist-generated -diff
 /Zend/zend_vm_execute.h linguist-generated -diff
 /Zend/zend_vm_handlers.h linguist-generated -diff
 /Zend/zend_vm_opcodes.[ch] linguist-generated -diff
@@ -30,4 +31,5 @@
 /ext/date/tests/ossfuzz*.txt binary
 
 # Vendored libraries
-/ext/dom/lexbor/lexbor linguist-vendored
+/ext/lexbor/lexbor linguist-vendored
+/ext/uri/uriparser linguist-vendored

.github/CODEOWNERS

@@ -16,7 +16,7 @@
 
 /.github @TimWolla
 /build/gen_stub.php @kocsismate
-/ext/bcmath @Girgias @ndossche @SakiTakamachi
+/ext/bcmath @ndossche @SakiTakamachi
 /ext/curl @adoy
 /ext/date @derickr
 /ext/dba @Girgias
@@ -27,6 +27,7 @@
 /ext/gmp @Girgias
 /ext/intl @devnexen
 /ext/json @bukka
+/ext/lexbor @kocsismate @ndossche
 /ext/libxml @ndossche
 /ext/mbstring @alexdowad @youkidearitai
 /ext/mysqli @bukka @kamil-tekiela
@@ -52,6 +53,7 @@
 /ext/spl @Girgias
 /ext/standard @bukka
 /ext/tidy @ndossche
+/ext/uri @kocsismate @TimWolla
 /ext/xml @ndossche
 /ext/xmlreader @ndossche
 /ext/xmlwriter @ndossche

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -22,15 +22,24 @@ body:
         ```
     validations:
       required: true
-  - type: input
+  - type: textarea
     attributes:
       label: PHP Version
-      description: "The used PHP version. Make sure it is [supported](https://www.php.net/supported-versions.php)."
-      placeholder: "PHP 8.0.12"
+      description: |
+        Please run PHP with the `-v` flag (e.g. `php -v`, `php8.5 -v`, `php-fpm -v` or similar) and provide the full output of that command. If executing that command is not possible, please provide the full version number as given in PHPInfo.
+
+        Please make sure that the used PHP version [is a supported version](https://www.php.net/supported-versions.php).
+      placeholder: |
+        PHP 8.5.2 (cli) (built: Jan 21 2026 17:35:28) (NTS)
+        Copyright (c) The PHP Group
+        Built by Ubuntu
+        Zend Engine v4.5.2, Copyright (c) Zend Technologies
+            with Zend OPcache v8.5.2, Copyright (c), by Zend Technologies
+      render: plain
     validations:
       required: true
   - type: input
     attributes:
       label: Operating System
       description: "The used operating system, if relevant."
-      placeholder: "Ubuntu 20.04"
+      placeholder: "Ubuntu 24.04"

.github/actions/apt-x32/action.yml

@@ -35,13 +35,11 @@ runs:
           libsodium-dev:i386 \
           libsqlite3-dev:i386 \
           libssl-dev:i386 \
-          libtidy-dev:i386 \
           libwebp-dev:i386 \
           libxml2-dev:i386 \
-          libxml2-dev:i386 \
           libxpm-dev:i386 \
           libxslt1-dev:i386 \
-          libzip-dev:i386 \
+          firebird-dev:i386 \
           locales \
           make \
           pkg-config:i386 \

.github/actions/brew/action.yml

@@ -19,7 +19,8 @@ runs:
           tidy-html5 \
           libzip \
           libsodium \
-          icu4c
+          icu4c \
+          curl
         brew install -v \
           bison \
           re2c

.github/actions/configure-unit-tests/action.yml

@@ -0,0 +1,10 @@
+name: ./configure (unit tests)
+description: Configure PHP with minimal settings for unit testing
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      run: |
+        set -x
+        ./buildconf --force
+        ./configure --disable-all --enable-embed=static

.github/actions/configure-x32/action.yml

@@ -10,6 +10,7 @@ runs:
       run: |
         set -x
 
+        export PKG_CONFIG_PATH="$PKG_CONFIG_PATH:/usr/lib/i386-linux-gnu/pkgconfig"
         ./buildconf --force
         export CFLAGS="-m32 -msse2"
         export CXXFLAGS="-m32 -msse2"
@@ -26,19 +27,18 @@ runs:
             --with-pgsql \
             --with-pdo-pgsql \
             --with-pdo-sqlite \
+            --with-pdo-firebird \
             --without-pear \
             --enable-gd \
             --with-jpeg \
             --with-webp \
             --with-freetype \
             --with-xpm \
             --enable-exif \
-            --with-zip \
             --with-zlib \
             --enable-soap \
             --enable-xmlreader \
             --with-xsl \
-            --with-tidy \
             --enable-sysvsem \
             --enable-sysvshm \
             --enable-shmop \

.github/actions/freebsd/action.yml

@@ -115,8 +115,7 @@ runs:
             --offline \
             --show-diff \
             --show-slow 1000 \
-            --set-timeout 120 \
-            -d zend_extension=opcache.so
+            --set-timeout 120
 
           if test "${{ inputs.runExtraTests }}" = "true"; then
             sapi/cli/php run-extra-tests.php

.github/actions/setup-mssql/action.yml

@@ -11,4 +11,4 @@ runs:
           -p 1433:1433 \
           --name sql1 \
           -h sql1 \
-          -d mcr.microsoft.com/mssql/server:2022-CU14-ubuntu-22.04
+          -d mcr.microsoft.com/mssql/server:2025-latest

.github/actions/test-alpine/action.yml

@@ -18,7 +18,7 @@ runs:
         export SKIP_IO_CAPTURE_TESTS=1
         export STACK_LIMIT_DEFAULTS_CHECK=1
         sapi/cli/php run-tests.php -P -q ${{ inputs.runTestsParameters }} \
-          ${{ inputs.enableOpcache == 'true' && '-d zend_extension=opcache.so -d opcache.enable_cli=1' || '' }} \
+          ${{ inputs.enableOpcache == 'true' && '-d opcache.enable_cli=1' || '' }} \
           -d opcache.jit=${{ inputs.jitType }} \
           -d opcache.jit_buffer_size=64M \
           -j$(nproc) \

.github/actions/test-linux/action.yml

@@ -33,7 +33,9 @@ runs:
           export PDO_PGSQL_TEST_DSN="pgsql:host=localhost port=5432 dbname=test user=postgres password=postgres"
         fi
         export PDO_FIREBIRD_TEST_DATABASE=test.fdb
-        export PDO_FIREBIRD_TEST_DSN=firebird:dbname=localhost:test.fdb
+        if [[ -z "$PDO_FIREBIRD_TEST_DSN" ]]; then
+          export PDO_FIREBIRD_TEST_DSN=firebird:dbname=localhost:test.fdb
+        fi
         export PDO_FIREBIRD_TEST_PASS=test
         export PDO_FIREBIRD_TEST_USER=test
         export ODBC_TEST_USER="odbc_test"
@@ -44,7 +46,7 @@ runs:
         export STACK_LIMIT_DEFAULTS_CHECK=1
         export RUN_RESOURCE_HEAVY_TESTS=1
         sapi/cli/php run-tests.php -P -q ${{ inputs.runTestsParameters }} \
-          ${{ inputs.enableOpcache == 'true' && '-d zend_extension=opcache.so -d opcache.enable_cli=1' || '' }} \
+          ${{ inputs.enableOpcache == 'true' && '-d opcache.enable_cli=1' || '' }} \
           -d opcache.jit=${{ inputs.jitType }} \
           -d opcache.protect_memory=1 \
           -d opcache.jit_buffer_size=64M \

.github/actions/test-macos/action.yml

@@ -20,7 +20,7 @@ runs:
         export STACK_LIMIT_DEFAULTS_CHECK=1
         export RUN_RESOURCE_HEAVY_TESTS=1
         sapi/cli/php run-tests.php -P -q ${{ inputs.runTestsParameters }} \
-          ${{ inputs.enableOpcache == 'true' && '-d zend_extension=opcache.so -d opcache.enable_cli=1' || '' }} \
+          ${{ inputs.enableOpcache == 'true' && '-d opcache.enable_cli=1' || '' }} \
           -d opcache.jit=${{ inputs.jitType }} \
           -d opcache.protect_memory=1 \
           -d opcache.jit_buffer_size=64M \

.github/actions/verify-generated-files/action.yml

@@ -12,5 +12,5 @@ runs:
         Zend/zend_vm_gen.php
         ext/tokenizer/tokenizer_data_gen.php
         build/gen_stub.php -f --generate-optimizer-info --verify
-        # Use the -a flag for a bug in git 2.46.0, which doesn't consider changed -diff files.
-        git add . -N && git diff -a --exit-code
+        ext/phar/makestub.php
+        .github/scripts/test-directory-unchanged.sh .

.github/labeler.yml

@@ -320,6 +320,11 @@
       - any-glob-to-any-file:
         - ext/tokenizer/**/*
 
+"Extension: uri":
+  - changed-files:
+      - any-glob-to-any-file:
+        - ext/uri/**/*
+
 "Extension: xml":
   - changed-files:
       - any-glob-to-any-file:
@@ -464,7 +469,6 @@
       - 'ext/pdo/php_pdo.h'
       - 'ext/pdo/php_pdo_driver.h'
       - 'ext/pdo/php_pdo_error.h'
-      - 'ext/phar/php_phar.h'
       - 'ext/random/php_random.h'
       - 'ext/random/php_random_csprng.h'
       - 'ext/random/php_random_uint128.h'
@@ -488,6 +492,7 @@
       - 'ext/spl/spl_iterators.h'
       - 'ext/spl/spl_observer.h'
       - 'ext/standard/*.h'
+      - 'ext/uri/*.h'
       - 'ext/xml/expat_compat.h'
       - 'ext/xml/php_xml.h'
       - 'main/*.h'

.github/lsan-suppressions.txt

@@ -1,3 +1,4 @@
 leak:acommon::DictInfoList::elements
 leak:timer_create
 leak:netsnmp_init_mib_internals
+leak:isc_attach_database

.github/scripts/download-bundled/.gitignore

@@ -0,0 +1 @@
+!*.patch

.github/scripts/download-bundled/boost-context.sh

@@ -0,0 +1,41 @@
+#!/bin/sh
+set -ex
+cd "$(dirname "$0")/../../.."
+
+tmp_dir=/tmp/php-src-download-bundled/boost-context
+rm -rf "$tmp_dir"
+
+revision=refs/tags/boost-1.86.0
+
+git clone --depth 1 --revision="$revision" https://github.com/boostorg/context.git "$tmp_dir"
+
+rm -rf Zend/asm
+cp -R "$tmp_dir"/src/asm Zend/asm
+
+cd Zend/asm
+
+# remove unneeded files
+rm jump_arm_aapcs_pe_armasm.asm
+rm jump_i386_ms_pe_clang_gas.S
+rm jump_i386_ms_pe_gas.asm
+rm jump_i386_x86_64_sysv_macho_gas.S
+rm jump_ppc32_ppc64_sysv_macho_gas.S
+rm jump_x86_64_ms_pe_clang_gas.S
+rm make_arm_aapcs_pe_armasm.asm
+rm make_i386_ms_pe_clang_gas.S
+rm make_i386_ms_pe_gas.asm
+rm make_i386_x86_64_sysv_macho_gas.S
+rm make_ppc32_ppc64_sysv_macho_gas.S
+rm make_x86_64_ms_pe_clang_gas.S
+rm ontop_*.S
+rm ontop_*.asm
+rm tail_ontop_ppc32_sysv.cpp
+
+# move renamed files
+# GH-13896 introduced these 2 files named as .S but since https://github.com/boostorg/context/pull/265 they are named as .asm
+mv jump_x86_64_ms_pe_gas.asm jump_x86_64_ms_pe_gas.S
+mv make_x86_64_ms_pe_gas.asm make_x86_64_ms_pe_gas.S
+
+# add extra files
+git restore LICENSE
+git restore save_xmm_x86_64_ms_masm.asm # added in GH-18352, not an upstream boost.context file

.github/scripts/download-bundled/pcre2.sh

@@ -0,0 +1,35 @@
+#!/bin/sh
+set -ex
+cd "$(dirname "$0")/../../.."
+
+tmp_dir=/tmp/php-src-download-bundled/pcre2
+rm -rf "$tmp_dir"
+
+revision=refs/tags/pcre2-10.44
+
+git clone --depth 1 --recurse-submodules --revision="$revision" https://github.com/PCRE2Project/pcre2.git "$tmp_dir"
+
+rm -rf ext/pcre/pcre2lib
+cp -R "$tmp_dir"/src ext/pcre/pcre2lib
+
+cd ext/pcre/pcre2lib
+
+# remove unneeded files
+rm config.h.generic
+rm pcre2.h.in
+rm pcre2_dftables.c
+rm pcre2_fuzzsupport.c
+rm pcre2_jit_test.c
+rm pcre2demo.c
+rm pcre2grep.c
+rm pcre2posix.c
+rm pcre2posix.h
+rm pcre2posix_test.c
+rm pcre2test.c
+
+# move renamed files
+mv pcre2.h.generic pcre2.h
+mv pcre2_chartables.c.dist pcre2_chartables.c
+
+# add extra files
+git restore config.h # based on config.h.generic but with many changes

.github/scripts/download-bundled/uriparser.config.patch

@@ -0,0 +1,14 @@
+diff --git a/ext/uri/uriparser/src/UriConfig.h b/ext/uri/uriparser/src/UriConfig.h
+index b9a85a8..ab78b96 100644
+--- a/ext/uri/uriparser/src/UriConfig.h
++++ b/ext/uri/uriparser/src/UriConfig.h
+@@ -41,7 +41,9 @@
+
+ #  define PACKAGE_VERSION "@PROJECT_VERSION@"
+
++/*
+ #cmakedefine HAVE_WPRINTF
+ #cmakedefine HAVE_REALLOCARRAY
++*/
+
+ #endif /* !defined(URI_CONFIG_H) */