From 85e0e27e79e55a07cb219b9da0c339e174a41e3a Mon Sep 17 00:00:00 2001 From: Weilin Du Date: Wed, 19 Aug 2026 16:55:54 +0800 Subject: [PATCH 1/4] [skip ci] Fix NEWS SAPI section --- NEWS | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/NEWS b/NEWS index e273a86dfca6..4071136c6afc 100644 --- a/NEWS +++ b/NEWS @@ -34,6 +34,9 @@ PHP NEWS . Fixed a leak when a persistent connection failed a liveness check with no other live PDO handle. (iliaal) +- SAPI: + . Fixed returns uninitialized value on LiteSpeed lsapi SAPI (Go Kudo) + - Standard: . Fixed a memory leak in array_merge_recursive() when the recursive merge of an object converted to an array fails. (David Carlier) @@ -42,9 +45,6 @@ PHP NEWS . Fixed ZipArchive::extractTo() and ZipArchive::getFrom*() reporting success on corrupted entries. (David Carlier) -- SAPI: - . Fixed returns uninitialized value on LiteSpeed lsapi SAPI (Go Kudo) - 27 Aug 2026, PHP 8.4.25 - Core: From dcdc8ab02caf91a4d27c95ab3cd03a9aa00191a2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Kuba=20Wer=C5=82os?= Date: Wed, 19 Aug 2026 11:35:00 +0200 Subject: [PATCH 2/4] Prevent inlining of `zend_compile_expr_inner()` to guarantee low stack usage of compilation (#23294) --- Zend/zend_compile.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c index f3527330a2c9..317114265c57 100644 --- a/Zend/zend_compile.c +++ b/Zend/zend_compile.c @@ -12447,7 +12447,9 @@ static void zend_compile_stmt(zend_ast *ast) /* {{{ */ } /* }}} */ -static void zend_compile_expr_inner(znode *result, zend_ast *ast) /* {{{ */ +/* Keep this out of zend_compile_expr(): the two form a recursion cycle, so inlining merges this + * frame into every nesting level of an expression, tripling the stack needed to compile it. */ +static zend_never_inline void zend_compile_expr_inner(znode *result, zend_ast *ast) /* {{{ */ { /* CG(zend_lineno) = ast->lineno; */ CG(zend_lineno) = zend_ast_get_lineno(ast); From a183f1162e231739e8877dff2de65f51efaeba0f Mon Sep 17 00:00:00 2001 From: Louis-Arnaud Date: Wed, 19 Aug 2026 14:22:25 +0200 Subject: [PATCH 3/4] ext/sockets: socket_cmsg_space() returns int, never null (#23345) * ext/sockets: socket_cmsg_space() returns int, never null The nullable return type dates from the stub introduction, when the error paths were warnings followed by a bare return. PHP 8.0 turned them into ValueError, so every exit is now either RETURN_LONG or RETURN_THROWS. Co-authored-by: NickSdot <32384907+NickSdot@users.noreply.github.com> --- UPGRADING | 3 ++ ext/sockets/sockets.stub.php | 2 +- ext/sockets/sockets_arginfo.h | 4 +- .../tests/socket_cmsg_space_return_type.phpt | 47 +++++++++++++++++++ 4 files changed, 53 insertions(+), 3 deletions(-) create mode 100644 ext/sockets/tests/socket_cmsg_space_return_type.phpt diff --git a/UPGRADING b/UPGRADING index d6e24356ee3a..350d30b12631 100644 --- a/UPGRADING +++ b/UPGRADING @@ -604,6 +604,9 @@ PHP 8.6 UPGRADE NOTES . socket_addrinfo_lookup() now has an additional optional argument $error when not null, and on failure, gives the error code (one of the EAI_* constants). + . socket_cmsg_space() return type has been narrowed from ?int to int. Every + failure path has thrown a ValueError since PHP 8.0, so null was never + returned. - Standard: . ini_get_all() now includes a "builtin_default_value" element for each diff --git a/ext/sockets/sockets.stub.php b/ext/sockets/sockets.stub.php index 56b2ac07e868..fab32628544d 100644 --- a/ext/sockets/sockets.stub.php +++ b/ext/sockets/sockets.stub.php @@ -2313,7 +2313,7 @@ function socket_sendmsg(Socket $socket, array $message, int $flags = 0): int|fal function socket_recvmsg(Socket $socket, array &$message, int $flags = 0): int|false {} -function socket_cmsg_space(int $level, int $type, int $num = 0): ?int {} +function socket_cmsg_space(int $level, int $type, int $num = 0): int {} /** * @return array|false diff --git a/ext/sockets/sockets_arginfo.h b/ext/sockets/sockets_arginfo.h index 2592cb740865..cfd792244084 100644 --- a/ext/sockets/sockets_arginfo.h +++ b/ext/sockets/sockets_arginfo.h @@ -1,5 +1,5 @@ /* This is a generated file, edit sockets.stub.php instead. - * Stub hash: 5e71ef16f2121bd6c75794673d0e0a394759ff8b */ + * Stub hash: 711d3b84051445917c4a8a1d0cdc1d0c6328be07 */ ZEND_BEGIN_ARG_WITH_RETURN_TYPE_MASK_EX(arginfo_socket_select, 0, 4, MAY_BE_LONG|MAY_BE_FALSE) ZEND_ARG_TYPE_INFO(1, read, IS_ARRAY, 1) @@ -174,7 +174,7 @@ ZEND_BEGIN_ARG_WITH_RETURN_TYPE_MASK_EX(arginfo_socket_recvmsg, 0, 2, MAY_BE_LON ZEND_ARG_TYPE_INFO_WITH_DEFAULT_VALUE(0, flags, IS_LONG, 0, "0") ZEND_END_ARG_INFO() -ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_socket_cmsg_space, 0, 2, IS_LONG, 1) +ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_socket_cmsg_space, 0, 2, IS_LONG, 0) ZEND_ARG_TYPE_INFO(0, level, IS_LONG, 0) ZEND_ARG_TYPE_INFO(0, type, IS_LONG, 0) ZEND_ARG_TYPE_INFO_WITH_DEFAULT_VALUE(0, num, IS_LONG, 0, "0") diff --git a/ext/sockets/tests/socket_cmsg_space_return_type.phpt b/ext/sockets/tests/socket_cmsg_space_return_type.phpt new file mode 100644 index 000000000000..f8b0b7364611 --- /dev/null +++ b/ext/sockets/tests/socket_cmsg_space_return_type.phpt @@ -0,0 +1,47 @@ +--TEST-- +socket_cmsg_space() always returns int, never null +--EXTENSIONS-- +sockets +--SKIPIF-- + +--FILE-- +getMessage(), "\n"; +} + +// Negative $num +try { + socket_cmsg_space(SOL_SOCKET, SCM_RIGHTS, -1); +} catch (Throwable $e) { + echo $e::class, ': ', $e->getMessage(), "\n"; +} + +// $num overflows int (64-bit only: PHP_INT_MAX > INT_MAX) +if (PHP_INT_SIZE >= 8) { + try { + socket_cmsg_space(SOL_SOCKET, SCM_RIGHTS, PHP_INT_MAX); + } catch (Throwable $e) { + echo $e::class, ': ', $e->getMessage(), "\n"; + } +} +?> +--EXPECT-- +string(3) "int" +ValueError: Pair level 999999 and/or type 999999 is not supported +ValueError: socket_cmsg_space(): Argument #3 ($num) must be greater than or equal to 0 +ValueError: socket_cmsg_space(): Argument #3 ($num) must be between -2147483648 and 2147483647 From b02e38a4a8b0f7079ecc5fa09b615b2911176e37 Mon Sep 17 00:00:00 2001 From: Levi Morrison Date: Wed, 19 Aug 2026 08:08:57 -0600 Subject: [PATCH 4/4] Fix memfd_create header inclusion --- ext/opcache/zend_shared_alloc.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/ext/opcache/zend_shared_alloc.c b/ext/opcache/zend_shared_alloc.c index 7589cccbe55f..c7ad96a2dfb2 100644 --- a/ext/opcache/zend_shared_alloc.c +++ b/ext/opcache/zend_shared_alloc.c @@ -19,6 +19,10 @@ +----------------------------------------------------------------------+ */ +#ifdef HAVE_CONFIG_H +# include +#endif + #if defined(__linux__) && defined(HAVE_MEMFD_CREATE) # ifndef _GNU_SOURCE # define _GNU_SOURCE