Skip to content

[pull] master from php:master - #1264

Merged
pull[bot] merged 5 commits into
turkdevops:masterfrom
php:master
Sep 12, 2026
Merged

[pull] master from php:master#1264
pull[bot] merged 5 commits into
turkdevops:masterfrom
php:master

Conversation

@pull

@pull pull Bot commented Sep 12, 2026

Copy link
Copy Markdown

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

devnexen and others added 5 commits September 12, 2026 06:26
…emoval.

Fix GH-23385

The serialization loop passed php_var_serialize() a pointer into the list
element itself, so a userland __serialize() unsetting that entry freed both
the element and its payload while the serializer was still walking them.
Serialize a copy of the element data instead, which outlives the callback.

Close GH-23388
This PR optimizes the user-visible `str_pad()` by reducing repeated small
copy operations during padding. In `php_str_pad_fill()`, the algorithm now uses
doubling copies to grow the written region exponentially. This lowers memcpy counts
and improves throughput for large repeated-pattern padding workloads.

Added `str_pad_repeated_pattern.phpt` to validate repeated pattern and partial-tail
boundaries, including multi-byte patterns and all pad directions. Behavior is
unchanged; this is a performance-only change and is now recorded in the PHP 8.6
performance changelog.
offset_to_pointer_utf8() walks the haystack using the UTF-8 mblen table.
For a truncated multibyte sequence, the lead byte's table entry can exceed
the remaining bytes and leave the search start pointer past the end.

Passing that pointer to zend_memnstr() triggers an assertion in debug
builds and an out-of-bounds read in release builds, producing bogus
offsets or a crash for sufficiently long haystacks.

Clamp the pointer to the end of the string, as mb_str_split() already does
for the same table walk. Add regression coverage for forward and reverse
searches, negative offsets, and offsets beyond the haystack.

Fixes GH-23106.

Closes #23107
* PHP-8.4:
  Fix GH-23106: mb_strpos() overreads truncated UTF-8 haystacks (#23107)
* PHP-8.5:
  Fix GH-23106: mb_strpos() overreads truncated UTF-8 haystacks (#23107)
@pull pull Bot locked and limited conversation to collaborators Sep 12, 2026
@pull pull Bot added the ⤵️ pull label Sep 12, 2026
@pull
pull Bot merged commit 063d787 into turkdevops:master Sep 12, 2026
1 of 3 checks passed
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants