Skip to content

[pull] master from php:master - #1248

Merged
pull[bot] merged 14 commits into
turkdevops:masterfrom
php:master
Sep 6, 2026
Merged

[pull] master from php:master#1248
pull[bot] merged 14 commits into
turkdevops:masterfrom
php:master

Conversation

@pull

@pull pull Bot commented Sep 6, 2026

Copy link
Copy Markdown

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

LamentXU123 and others added 14 commits September 6, 2026 19:48
…23420)

* ext/sodium: Add crypto_kem (X-Wing) bindings

Expose the libsodium 1.0.22 generic KEM API (X-Wing, hybrid
ML-KEM768+X25519). Guarded so older libsodium builds are unaffected.

* ext/sodium: Add crypto_kem_mlkem768 bindings

Expose libsodium 1.0.22's ML-KEM768 (FIPS 203) KEM with the same shape
as the generic crypto_kem API.

* ext/sodium: Test the KEM internal-error paths

An invalid ML-KEM public key encoding and a small-order X25519
ciphertext component deterministically fail inside libsodium,
exercising the memzero-on-error branches. ML-KEM768 decapsulation
never fails (implicit rejection), so it has no such test. Also drop
the cross-family length check, which duplicated existing coverage.
The move to memchr() in GH-21578 changed:
`if (strchr(*path, '/') != NULL || strchr(*path, DEFAULT_SLASH) != NULL) {`
to
`if (memchr(ZSTR_VAL(*path), '/', ZSTR_LEN(*path)) != NULL || memchr(ZSTR_VAL(*path), '/', ZSTR_LEN(*path)) != NULL) {`
instead of
`if (memchr(ZSTR_VAL(*path), '/', ZSTR_LEN(*path)) != NULL || memchr(ZSTR_VAL(*path), DEFAULT_SLASH, ZSTR_LEN(*path)) != NULL) {`

Fix this.
…ty class name (#23233)

A class name consisting solely of the namespace separator passed the
length check in zend_lookup_class_ex(), lost its leading backslash and
was then looked up and autoloaded as an empty string. This affected all
entry points using that lookup, e.g. is_callable('\::method') and
class_exists('\').
php_fsockopen_stream() called zend_argument_value_error(6, ...) for the
$timeout parameter, but $timeout is the 5th argument. This caused the
error message to show "Argument #6" with no parameter name, since
get_function_arg_name() returns NULL when arg_num exceeds the actual
argument count.

The format string also contained ZEND_ULONG_FMT (which expects a zend_ulong)
but received a double expression, causing undefined behavior.
This is fixed by casting to uint64_t instead.
Reduces size from 160 to 152 bytes
Number::compare() may request a scale greater than the stored scale of a
zero result when the opposite operand has a larger scale. The helper then
walked past the shorter digit buffer.

Clamp the requested scale to the digits stored in the number.

Closes GH-23185
* PHP-8.4:
  Clamp scale in bc_is_zero_for_scale to n_scale
* PHP-8.5:
  Clamp scale in bc_is_zero_for_scale to n_scale
@pull pull Bot locked and limited conversation to collaborators Sep 6, 2026
@pull pull Bot added the ⤵️ pull label Sep 6, 2026
@pull
pull Bot merged commit 1d004f0 into turkdevops:master Sep 6, 2026
1 of 3 checks passed
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

9 participants