Skip to content

[pull] master from php:master - #1227

Merged
pull[bot] merged 4 commits into
turkdevops:masterfrom
php:master
Aug 28, 2026
Merged

[pull] master from php:master#1227
pull[bot] merged 4 commits into
turkdevops:masterfrom
php:master

Conversation

@pull

@pull pull Bot commented Aug 28, 2026

Copy link
Copy Markdown

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

marc-mabe and others added 4 commits August 27, 2026 21:38
Reject a $maxEvents value greater than INT_MAX instead of truncating it,
which prevents an integer overflow where SIZEOF_INT < SIZEOF_ZEND_LONG.

Close GH-23468
stream_bucket_prepend()/append() assumed a successful zend_read_property()
of StreamBucket::$data always yields a string, but for an unset typed
property it throws while returning &EG(uninitialized_zval), so
Z_STRLEN_P() dereferenced a NULL string pointer and crashed when the
brigade was consumed. Reject non-string reads up front (rethrowing any
pending exception) so the bucket is never re-attached with undefined
data; the sibling $bucket property path is already safe because
zend_fetch_resource_ex() rejects non-resources.

Closes GH-23466
* PHP-8.4:
  [standard] Fix crash when filter callback unsets StreamBucket::$data
* PHP-8.5:
  [standard] Fix crash when filter callback unsets StreamBucket::$data
@pull pull Bot locked and limited conversation to collaborators Aug 28, 2026
@pull pull Bot added the ⤵️ pull label Aug 28, 2026
@pull
pull Bot merged commit f16b1d5 into turkdevops:master Aug 28, 2026
1 of 3 checks passed
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants