Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)
Version 7.4.29
Core:
No source changes to this release. This update allows for re-building the
Windows binaries against upgraded dependencies which have received security
updates.
Date:
Updated to latest IANA timezone database (2022a).
Version 7.4.28
Filter:
Fix #81708: UAF due to php_filter_float() failing for ints (CVE-2021-21708)
Version 7.4.27
Core:
Fixed bug #81626 (Error on use static:: in __сallStatic() wrapped to Closure::fromCallable()).
FPM:
Fixed bug #81513 (Future possibility for heap overflow in FPM zlog).
GD:
Fixed bug #71316 (libpng warning from imagecreatefromstring).
Fixed incorrect usage of QM_ASSIGN instruction. It must not return IS_VAR. As a side effect, this allowed passing left hand list() "by reference", instead of compile-time error.
CLI:
The built-in CLI server now reports the request method in log files.
COM:
Deprecated registering of case-insensitive constants from typelibs.
Fixed bug #77630 (rename() across the device may allow unwanted access during processing). (CVE-2019-9637)
COM:
Fixed bug #77621 (Already defined constants are not properly reported).
Fixed bug #77626 (Persistence confusion in php_com_import_typelib()).
EXIF:
Fixed bug #77509 (Uninitialized read in exif_process_IFD_in_TIFF). (CVE-2019-9641)
Fixed bug #77540 (Invalid Read on exif_process_SOFn). (CVE-2019-9640)
Fixed bug #77563 (Uninitialized read in exif_process_IFD_in_MAKERNOTE). (CVE-2019-9638)
Fixed bug #77659 (Uninitialized read in exif_process_IFD_in_MAKERNOTE). (CVE-2019-9639)
Mbstring:
Fixed bug #77514 (mb_ereg_replace() with trailing backslash adds null byte).
MySQL:
Disabled LOCAL INFILE by default, can be enabled using php.ini directive mysqli.allow_local_infile for mysqli, or PDO::MYSQL_ATTR_LOCAL_INFILE attribute for pdo_mysql.
OpenSSL:
Fixed bug #77390 (feof might hang on TLS streams in case of fragmented TLS records).
PDO_OCI:
Support Oracle Database tracing attributes ACTION, MODULE, CLIENT_INFO, and CLIENT_IDENTIFIER.
PHAR:
Fixed bug #77396 (Null Pointer Dereference in phar_create_or_parse_filename).
Fixed bug #77051 (Issue with re-binding on SQLite3).
Xmlrpc:
Fixed bug #77242 (heap out of bounds read in xmlrpc_decode()). (CVE-2019-9020)
Fixed bug #77380 (Global out of bounds read in xmlrpc base64 code). (CVE-2019-9024)
Version 7.3.0
Core:
Improved PHP GC.
Redesigned the old ext_skel program written in PHP, run: 'php ext_skel.php' for all options. This means there are no dependencies, thus making it work on Windows out of the box.
Removed support for BeOS.
Add PHP_VERSION to phpinfo() <title/>.
Add net_get_interfaces().
Implemented flexible heredoc and nowdoc syntax, per RFC https://wiki.php.net/rfc/flexible_heredoc_nowdoc_syntaxes.
Added support for references in list() and array destructuring, per RFC https://wiki.php.net/rfc/list_reference_assignment.
Improved effectiveness of ZEND_SECURE_ZERO for NetBSD and systems without native similar feature.
Added syslog.facility and syslog.ident INI entries for customizing syslog logging.
Fixed bug #75683 (Memory leak in zend_register_functions() in ZTS mode).
Fixed bug #75031 (support append mode in temp/memory streams).
Fixed bug #74860 (Uncaught exceptions not being formatted properly when error_log set to "syslog").
Fixed bug #75220 (Segfault when calling is_callable on parent).
Fixed bug #69954 (broken links and unused config items in distributed ini files).
Fixed bug #74922 (Composed class has fatal error with duplicate, equal const properties).
Fixed bug #63911 (identical trait methods raise errors during composition).
Fixed bug #76285 (DOMDocument::formatOutput attribute sometimes ignored).
Fileinfo:
Fixed bug #77095 (slowness regression in 7.2/7.3 (compared to 7.1)).
Filter:
Added the 'add_slashes' sanitization mode (FILTER_SANITIZE_ADD_SLASHES).
FPM:
Added fpm_get_status function.
Fixed bug #62596 (getallheaders() missing with PHP-FPM).
Fixed bug #69031 (Long messages into stdout/stderr are truncated incorrectly) - added new log related FPM configuration options: log_limit, log_buffering and decorate_workers_output.
ftp:
Fixed bug #77151 (ftp_close(): SSL_read on shutdown).
GD:
Added support for WebP in imagecreatefromstring().
GMP:
Export internal structures and accessor helpers for GMP object.
Added gmp_binomial(n, k).
Added gmp_lcm(a, b).
Added gmp_perfect_power(a).
Added gmp_kronecker(a, b).
iconv:
Fixed bug #53891 (iconv_mime_encode() fails to Q-encode UTF-8 string).
Fixed bug #75355 (preg_quote() does not quote # control character).
Fixed bug #76512 (\w no longer includes unicode characters).
Fixed bug #76514 (Regression in preg_match makes it fail with PREG_JIT_STACKLIMIT_ERROR).
Fixed bug #76909 (preg_match difference between 7.3 and < 7.3).
PDO_DBlib:
Implemented FR #69592 (allow 0-column rowsets to be skipped automatically).
Expose TDS version as \PDO::DBLIB_ATTR_TDS_VERSION attribute on \PDO instance.
Treat DATETIME2 columns like DATETIME.
Fixed bug #74243 (allow locales.conf to drive datetime format).
PDO_Firebird:
Fixed bug #74462 (PDO_Firebird returns only NULLs for results with boolean for FIREBIRD >= 3.0).
PDO_OCI:
Fixed bug #74631 (PDO_PCO with PHP-FPM: OCI environment initialized before PHP-FPM sets it up).
PDO SQLite:
Add support for additional open flags
pgsql:
Added new error constants for pg_result_error(): PGSQL_DIAG_SCHEMA_NAME, PGSQL_DIAG_TABLE_NAME, PGSQL_DIAG_COLUMN_NAME, PGSQL_DIAG_DATATYPE_NAME, PGSQL_DIAG_CONSTRAINT_NAME and PGSQL_DIAG_SEVERITY_NONLOCALIZED.
Fixed bug #77047 (pg_convert has a broken regex for the 'TIME WITHOUT TIMEZONE' data type).
phar:
Fixed bug #74991 (include_path has a 4096 char limit in some cases).
Fixed bug #65414 (deal with leading slash when adding files correctly).
Fixed bug #77022 (PharData always creates new files with mode 0666).
Fixed bug #77691 (Opcache passes wrong value for inline array push assignments).
Fixed bug #77743 (Incorrect pi node insertion for jmpznz with identical successors).
phpdbg:
Fixed bug #77767 (phpdbg break cmd aliases listed in help do not match actual aliases).
sodium:
Fixed bug #77646 (sign_detached() strings not terminated).
SQLite3:
Added sqlite3.defensive INI directive.
Standard:
Fixed bug #77664 (Segmentation fault when using undefined constant in custom wrapper).
Fixed bug #77669 (Crash in extract() when overwriting extracted array).
Fixed bug #76717 (var_export() does not create a parsable value for PHP_INT_MIN).
Fixed bug #77765 (FTP stream wrapper should set the directory as executable).
Version 7.2.16
Core:
Fixed bug #77589 (Core dump using parse_ini_string with numeric sections).
Fixed bug #77630 (rename() across the device may allow unwanted access during processing). (CVE-2019-9637)
COM:
Fixed bug #77621 (Already defined constants are not properly reported).
EXIF:
Fixed bug #77509 (Uninitialized read in exif_process_IFD_in_TIFF). (CVE-2019-9641)
Fixed bug #77540 (Invalid Read on exif_process_SOFn). (CVE-2019-9640)
Fixed bug #77563 (Uninitialized read in exif_process_IFD_in_MAKERNOTE). (CVE-2019-9638)
Fixed bug #77659 (Uninitialized read in exif_process_IFD_in_MAKERNOTE). (CVE-2019-9639)
PDO_OCI:
Support Oracle Database tracing attributes ACTION, MODULE, CLIENT_INFO, and CLIENT_IDENTIFIER.
PHAR:
Fixed bug #77396 (Null Pointer Dereference in phar_create_or_parse_filename).
SPL:
Fixed bug #51068 (DirectoryIterator glob:// don't support current path relative queries).
Fixed bug #77431 (openFile() silently truncates after a null byte).
Standard:
Fixed bug #77552 (Unintialized php_stream_statbuf in stat functions).
MySQL:
Disabled LOCAL INFILE by default, can be enabled using php.ini directive mysqli.allow_local_infile for mysqli, or PDO::MYSQL_ATTR_LOCAL_INFILE attribute for pdo_mysql.
Version 7.2.15
Core:
Fixed bug #77339 (__callStatic may get incorrect arguments).
Fixed bug #77494 (Disabling class causes segfault on member access).
Fixed bug #77530 (PHP crashes when parsing `(2)::class`).
Implemented "Deprecate and Remove Bareword (Unquoted) Strings" RFC.
Raised minimum supported Windows versions to Windows 7/Server 2008 R2.
Implemented minor optimization in array_keys/array_values().
Added PHP_OS_FAMILY constant to determine on which OS we are.
Fixed bug #73987 (Method compatibility check looks to original definition and not parent).
Fixed bug #73991 (JSON_OBJECT_AS_ARRAY not respected).
Fixed bug #74053 (Corrupted class entries on shutdown when a destructor spawns another object).
Fixed bug #73971 (Filename got limited to MAX_PATH on Win32 when scan directory).
Fixed bug #72359, bug #72451, bug #73706, bug #71115 and others related to interned strings handling in TS builds.
Implemented "Trailing Commas In List Syntax" RFC for group use lists only.
Fixed bug #74269 (It's possible to override trait property with different loosely-equal value).
Fixed bug #61970 (Restraining __construct() access level in subclass gives a fatal error).
Fixed bug #63384 (Cannot override an abstract method with an abstract method).
Fixed bug #74607 (Traits enforce different inheritance rules).
Fixed misparsing of abstract unix domain socket names.
Change PHP_OS_FAMILY value from "OSX" to "Darwin".
Allow loading PHP/Zend extensions by name in ini files (extension=<name>).
Added object type annotation.
Fixed bug #74815 (crash with a combination of INI entries at startup).
Fixed bug #74836 (isset on zero-prefixed numeric indexes in array broken).
Added new VM instuctions ISSET_ISEMPTY_CV and UNSET_CV. Previously they were implemented as ISSET_ISEMPTY_VAR and UNSET_VAR variants with ZEND_QUICK_SET flag.
Fixed bug #49649 (unserialize() doesn't handle changes in property visibility).
Fixed bug #74866 (extension_dir = "./ext" now use current directory for base).
Implemented FR #74963 (Improved error message on fetching property of non-object).
Fixed bug #75142 (buildcheck.sh check for autoconf version needs to be updated for v2.64).
Fixed bug #72885 (flatfile: dba_fetch() fails to read replaced entry).
DOM:
Implemented FR #74837 (Implement Countable for DomNodeList and DOMNamedNodeMap).
EXIF:
Added support for vendor specific tags for the following formats: Samsung, DJI, Panasonic, Sony, Pentax, Minolta, Sigma/Foveon, AGFA, Kyocera, Ricoh & Epson.
Fixed bug #72682 (exif_read_data() fails to read all data for some images).
Fixed bug #71534 (Type confusion in exif_read_data() leading to heap overflow in debug mode).
Fixed bug #68547 (Exif Header component value check error).
Fixed bug #66443 (Corrupt EXIF header: maximum directory nesting level reached for some cameras).
Fixed Redhat bug #1362571 (PHP not returning full results for exif_read_data function).
Implemented FR #65187 (exif_read_data/thumbnail: add support for stream resource).
Fixed bug #63790 (test using Spoofchecker which may be unavailable).
Fixed bug #75378 ([REGRESSION] IntlDateFormatter::parse() does not change $position argument).
JSON:
Add JSON_INVALID_UTF8_IGNORE and JSON_INVALID_UTF8_SUBSTITUTE options for json_encode and json_decode to ignore or replace invalid UTF-8 byte sequences - it addresses request #65082.
Fixed bug #75185 (Buffer overflow in json_decode() with JSON_INVALID_UTF8_IGNORE or JSON_INVALID).
Fixed bug #68567 (JSON_PARTIAL_OUTPUT_ON_ERROR can result in JSON with null key).
LDAP:
Implemented FR #69445 (Support for LDAP EXOP operations)
Fixed support for LDAP_OPT_SERVER_CONTROLS and LDAP_OPT_CLIENT_CONTROLS in ldap_get_option
Fixed passing an empty array to ldap_set_option for client or server controls.
Implemented FR #69086 (enhancement for mb_convert_encoding() that handles multibyte replacement char nicely).
Added array input support to mb_convert_encoding().
Added array input support to mb_check_encoding().
Fixed bug #69079 (enhancement for mb_substitute_character).
Update to oniguruma version 6.3.0.
Fixed bug #69267 (mb_strtolower fails on titlecase characters).
Mcrypt:
The deprecated mcrypt extension has been moved to PECL.
Opcache:
Added global optimisation passes based on data flow analysis using Single Static Assignment (SSA) form: Sparse Conditional Constant Propagation (SCCP), Dead Code Elimination (DCE), and removal of unused local variables (Nikita, Dmitry)
Fixed bug #74852 (property_exists returns true on unknown DateInterval property).
OCI8:
Fixed bug #74625 (Integer overflow in oci_bind_array_by_name).
Opcache:
Fixed bug #74623 (Infinite loop in type inference when using HTMLPurifier).
OpenSSL:
Fixed bug #74798 (pkcs7_en/decrypt does not work if \x0a is used in content).
Added OPENSSL_DONT_ZERO_PAD_KEY constant to prevent key padding and fix bug #71917 (openssl_open() returns junk on envelope < 16 bytes) and bug #72362 (OpenSSL Blowfish encryption is incorrect for short keys).
Change statement and fcall extension handlers to accept frame.
Number operators taking numeric strings now emit E_NOTICEs or E_WARNINGs when given malformed numeric strings.
(int), intval() where $base is 10 or unspecified, settype(), decbin(), decoct(), dechex(), integer operators and other conversions now always respect scientific notation in numeric strings.
Raise a compile-time warning on octal escape sequence overflow.
Fixed bug #66836 (DateTime::createFromFormat 'U' with pre 1970 dates fails parsing).
Invalid serialization data for a DateTime or DatePeriod object will now throw an instance of Error from __wakeup() or __set_state() instead of resulting in a fatal error.
Timezone initialization failure from serialized data will now throw an instance of Error from __wakeup() or __set_state() instead of resulting in a fatal error.
Export date_get_interface_ce() for extension use.
Fixed bug #63740 (strtotime seems to use both sunday and monday as start of week).
Dba:
Fixed bug #70825 (Cannot fetch multiple values with group in ini file).
Data modification functions (e.g.: dba_insert()) now throw an instance of Error instead of triggering a catchable fatal error if the key is does not contain exactly two elements.
DOM:
Fixed bug #73150 (missing NULL check in dom_document_save_html).
Invalid schema or RelaxNG validation contexts will throw an instance of Error instead of resulting in a fatal error.
Attempting to register a node class that does not extend the appropriate base class will now throw an instance of Error instead of resulting in a fatal error.
Attempting to read an invalid or write to a readonly property will throw an instance of Error instead of resulting in a fatal error.
DTrace:
Disabled PHP call tracing by default (it makes significant overhead). This may be enabled again using envirionment variable USE_ZEND_DTRACE=1.
EXIF:
Fixed bug #72735 (Samsung picture thumb not read (zero size)).
Fixed bug #72627 (Memory Leakage In exif_process_IFD_in_TIFF).
Fixed bug #72603 (Out of bound read in exif_process_IFD_in_MAKERNOTE).
Fixed bug #72618 (NULL Pointer Dereference in exif_process_user_comment).
Filter:
Fixed bug #72972 (Bad filter for the flags FILTER_FLAG_NO_RES_RANGE and FILTER_FLAG_NO_PRIV_RANGE).
Fixed bug #73054 (default option ignored when object passed to int filter).
Fixed bug #71745 (FILTER_FLAG_NO_RES_RANGE does not cover whole 127.0.0.0/8 range).
FPM:
Fixed bug #72575 (using --allow-to-run-as-root should ignore missing user).
FTP:
Fixed bug #70195 (Cannot upload file using ftp_put to FTPES with require_ssl_reuse).
Implemented FR #55651 (Option to ignore the returned FTP PASV address).
GD:
Fixed bug #73213 (Integer overflow in imageline() with antialiasing).
Fixed bug #73272 (imagescale() is not affected by, but affects imagesetinterpolation()).
Fixed bug #73279 (Integer overflow in gdImageScaleBilinearPalette()).
Fixed bug #73280 (Stack Buffer Overflow in GD dynamicGetbuf).
Fixed bug #50194 (imagettftext broken on transparent background w/o alphablending).
Fixed bug #73003 (Integer Overflow in gdImageWebpCtx of gd_webp.c).
Fixed bug #53504 (imagettfbbox gives incorrect values for bounding box).
Fixed bug #73157 (imagegd2() ignores 3rd param if 4 are given).
Fixed bug #73155 (imagegd2() writes wrong chunk sizes on boundaries).
Fixed bug #73159 (imagegd2(): unrecognized formats may result in corrupted files).
Fixed bug #73161 (imagecreatefromgd2() may leak memory).
Fixed bug #67325 (imagetruecolortopalette: white is duplicated in palette).
Fixed bug #66005 (imagecopy does not support 1bit transparency on truecolor images).
Fixed bug #72913 (imagecopy() loses single-color transparency on palette images).
Fixed bug #68716 (possible resource leaks in _php_image_convert()).
Fixed bug #72709 (imagesetstyle() causes OOB read for empty $styles).
Failure to call the parent constructor in a class extending Collator before invoking the parent methods will throw an instance of Error instead of resulting in a recoverable fatal error.
Cloning a Transliterator object may will now throw an instance of Error instead of resulting in a fatal error if cloning the internal transliterator fails.
Added IntlTimeZone::getWindowsID() and IntlTimeZone::getIDForWindowsID().
Fixed bug #69398 (IntlDateFormatter formatObject returns wrong value when time style is NONE).
JSON:
Introduced encoder struct instead of global which fixes bugs #66025 and #73254 related to pretty print indentation.
Fixed bug #73113 (Segfault with throwing JsonSerializable).
Implemented earlier return when json_encode fails, fixes bugs #68992 (Stacking exceptions thrown by JsonSerializable) and #70275 (On recursion error, json_encode can eat up all system memory).
Exported JSON parser API including json_parser_method that can be used for implementing custom logic when parsing JSON.
Escaped U+2028 and U+2029 when JSON_UNESCAPED_UNICODE is supplied as json_encode options and added JSON_UNESCAPED_LINE_TERMINATORS to restore the previous behaviour.
LDAP:
Providing an unknown modification type to ldap_batch_modify() will now throw an instance of Error instead of resulting in a fatal error.
Mbstring:
Fixed bug #73532 (Null pointer dereference in mb_eregi).
Custom session handlers that do not return strings for session IDs will now throw an instance of Error instead of resulting in a fatal error when a function is called that must generate a session ID.
An invalid setting for session.hash_function will throw an instance of Error instead of resulting in a fatal error when a session ID is created.
Fixed bug #72562 (Use After Free in unserialize() with Unexpected Session Deserialization).
Improved fix for bug #68063 (Empty session IDs do still start sessions).
Fixed bug #71038 (session_start() returns TRUE on failure). Session save handlers must return 'string' always for successful read. i.e. Non-existing session read must return empty string. PHP 7.0 is made not to tolerate buggy return value.
Fixed bug #71394 (session_regenerate_id() must close opened session on errors).
SimpleXML:
Fixed bug #73293 (NULL pointer dereference in SimpleXMLElement::asXML()).
Fixed bug #72971 (SimpleXML isset/unset do not respect namespace).
Fixed bug #72957 (Null coalescing operator doesn't behave as expected with SimpleXMLElement).
Fixed bug #72588 (Using global var doesn't work while accessing SimpleXML element).
Creating an unnamed or duplicate attribute will throw an instance of Error instead of resulting in a fatal error.
SNMP:
Fixed bug #72708 (php_snmp_parse_oid integer overflow in memory allocation).
Fixed bug #72479 (Use After Free Vulnerability in SNMP with GC and unserialize()).
Fixed bug #69068 (Exchanging array during array_walk -> memory errors).
Fixed bug #70713 (Use After Free Vulnerability in array_walk()/ array_walk_recursive()).
Fixed bug #72622 (array_walk + array_replace_recursive create references from nothing).
Fixed bug #72330 (CSV fields incorrectly split if escape char followed by UTF chars).
Implemented RFC: More precise float values.
array_multisort now uses zend_sort instead zend_qsort.
Fixed bug #72505 (readfile() mangles files larger than 2G).
assert() will throw a ParseError when evaluating a string given as the first argument if the PHP code is invalid instead of resulting in a catchable fatal error.
Calling forward_static_call() outside of a class scope will now throw an instance of Error instead of resulting in a fatal error.
Added is_iterable() function.
Fixed bug #72306 (Heap overflow through proc_open and $env parameter).
Fixed bug #71100 (long2ip() doesn't accept integers in strict mode).
Implemented FR #55716 (Add an option to pass a custom stream context to get_headers()).
Additional validation for parse_url() for login/pass components).
Implemented FR #69359 (Provide a way to fetch the current environment variables).
unpack() function accepts an additional optional argument $offset.
Fixed bug #52355 (Negating zero does not produce negative zero).
Fixed bug #66179 (var_export() exports float as integer).
Fixed bug #70804 (Unary add on negative zero produces positive zero).
CURL:
Fixed bug #71144 (Sementation fault when using cURL with ZTS).
DBA:
Fixed key leak with invalid resource.
Filter:
Fixed bug #71063 (filter_input(INPUT_ENV, ..) does not work).
FTP:
Implemented FR #55651 (Option to ignore the returned FTP PASV address).
FPM:
Fixed bug #70755 (fpm_log.c memory leak and buffer overflow). (CVE-2016-5114)
GD:
Fixed bug #70976 (Memory Read via gdImageRotateInterpolated Array Index Out of Bounds). (CVE-2016-1903)
Mbstring:
Fixed bug #71066 (mb_send_mail: Program terminated with signal SIGSEGV, Segmentation fault).
Opcache:
Fixed bug #71127 (Define in auto_prepend_file is overwrite).
PCRE:
Fixed bug #71178 (preg_replace with arrays creates [0] in replace array if not already set).
Readline:
Fixed bug #71094 (readline_completion_function corrupts static array on second TAB).
Session:
Fixed bug #71122 (Session GC may not remove obsolete session data).
SPL:
Fixed bug #71077 (ReflectionMethod for ArrayObject constructor returns wrong number of parameters).
Fixed bug #71153 (Performance Degradation in ArrayIterator with large arrays).
Standard:
Fixed bug #71270 (Heap BufferOver Flow in escapeshell functions). (CVE-2016-1904)
WDDX:
Fixed bug #70661 (Use After Free Vulnerability in WDDX Packet Deserialization).
Fixed bug #70741 (Session WDDX Packet Deserialization Type Confusion Vulnerability).
XMLRPC:
Fixed bug #70728 (Type Confusion Vulnerability in PHP_to_XMLRPC_worker).
Version 7.0.1
Core:
Fixed bug #71105 (Format String Vulnerability in Class Name Error Message). (CVE-2015-8617)
Fixed bug #70831 (Compile fails on system with 160 CPUs).
Fixed bug #71006 (symbol referencing errors on Sparc/Solaris).
Fixed bug #70997 (When using parentClass:: instead of parent::, static context changed).
Fixed bug #70970 (Segfault when combining error handler with output buffering).
Fixed bug #70967 (Weird error handling for __toString when Error is thrown).
Fixed bug #70958 (Invalid opcode while using ::class as trait method paramater default value).
Fixed bug #70944 (try{ } finally{} can create infinite chains of exceptions).
Fixed bug #70931 (Two errors messages are in conflict).
Fixed bug #70904 (yield from incorrectly marks valid generator as finished).
Fixed bug #70899 (buildconf failure in extensions).
Fixed bug #61751 (SAPI build problem on AIX: Undefined symbol: php_register_internal_extensions).
Fixed \int (or generally every scalar type name with leading backslash) to not be accepted as type name.
Fixed exception not being thrown immediately into a generator yielding from an array.
Fixed bug #70987 (static::class within Closure::call() causes segfault).
Fixed bug #71013 (Incorrect exception handler with yield from).
Fixed double free in error condition of format printer.
CLI server:
Fixed bug #71005 (Segfault in php_cli_server_dispatch_router()).
Intl:
Fixed bug #71020 (Use after free in Collator::sortWithSortKeys). (CVE-2015-8616)
Mysqlnd:
Fixed bug #68077 (LOAD DATA LOCAL INFILE / open_basedir restriction).
Fixed bug #68344 (MySQLi does not provide way to disable peer certificate validation) by introducing MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT connection flag.
OCI8:
Fixed LOB implementation size_t/zend_long mismatch reported by gcov.
Opcache:
Fixed bug #71024 (Unable to use PHP 7.0 x64 side-by-side with PHP 5.6 x32 on the same server).
Fixed bug #70991 (zend_file_cache.c:710: error: array type has incomplete element type).
Fixed bug #70977 (Segmentation fault with opcache.huge_code_pages=1).
PDO_Firebird:
Fixed bug #60052 (Integer returned as a 64bit integer on X64_86).
Fixed bug #69427 (Segfault on magic method __call of private method in superclass).
Improved __call() and __callStatic() magic method handling. Now they are called in a stackless way using ZEND_CALL_TRAMPOLINE opcode, without additional stack frame.
Optimized strings concatenation.
Fixed weird operators behavior. Division by zero now emits warning and returns +/-INF, modulo by zero and intdid() throws an exception, shifts by negative offset throw exceptions. Compile-time evaluation of division by zero is disabled.
Implemented FR #70438 (Add IV parameter for openssl_seal and openssl_open).
Fixed bug #70014 (openssl_random_pseudo_bytes() is not cryptographically secure). (CVE-2015-8867)
Fixed bug #69882 (OpenSSL error "key values mismatch" after openssl_pkcs12_read with extra cert).
Added "alpn_protocols" SSL context option allowing encrypted client/server streams to negotiate alternative protocols using the ALPN TLS extension when built against OpenSSL 1.0.2 or newer. Negotiated protocol information is accessible through stream_get_meta_data() output.
Removed "CN_match" and "SNI_server_name" SSL context options. Use automatic detection or the "peer_name" option instead.
Pcntl:
Fixed bug #70386 (Can't compile on NetBSD because of missing WCONTINUED and WIFCONTINUED).
Fixed bug #60509 (pcntl_signal doesn't decrease ref-count of old handler when setting SIG_DFL).
Implemented FR #68505 (Added wifcontinued and wcontinued).
Added rusage support to pcntl_wait() and pcntl_waitpid().
PCRE:
Fixed bug #70232 (Incorrect bump-along behavior with \K and empty string match).
Fixed bug #70345 (Multiple vulnerabilities related to PCRE functions).
Fixed bug #70232 (Incorrect bump-along behavior with \K and empty string match).
Fixed bug #53823 (preg_replace: * qualifier on unicode replace garbles the string).
Fixed bug #69864 (Segfault in preg_replace_callback).
Removed support for the /e (PREG_REPLACE_EVAL) modifier.
PDO:
Fixed bug #70861 (Segmentation fault in pdo_parse_params() during Drupal 8 test suite).
Fixed bug #68361 (Segmentation fault on SoapClient::__getTypes).
SPL:
Fixed bug #70959 (ArrayObject unserialize does not restore protected fields).
Fixed bug #70853 (SplFixedArray throws exception when using ref variable as index).
Fixed bug #70868 (PCRE JIT and pattern reuse segfault).
Fixed bug #70730 (Incorrect ArrayObject serialization if unset is called in serialize()).
Fixed bug #70573 (Cloning SplPriorityQueue leads to memory leaks).
Fixed bug #70303 (Incorrect constructor reflection for ArrayObject).
Fixed bug #70068 (Dangling pointer in the unserialization of ArrayObject items).
Fixed bug #70166 (Use After Free Vulnerability in unserialize() with SPLArrayObject).
Fixed bug #70168 (Use After Free Vulnerability in unserialize() with SplObjectStorage).
Fixed bug #70169 (Use After Free Vulnerability in unserialize() with SplDoublyLinkedList).
Fixed bug #70053 (MutlitpleIterator array-keys incompatible change in PHP 7).
Fixed bug #69970 (Use-after-free vulnerability in spl_recursive_it_move_forward_ex()).
Fixed bug #69845 (ArrayObject with ARRAY_AS_PROPS broken).
Changed ArrayIterator implementation using zend_hash_iterator_... API. Allowed modification of iterated ArrayObject using the same behavior as proposed in `Fix "foreach" behavior`. Removed "Array was modified outside object and internal position is no longer valid" hack.
Implemented FR #67886 (SplPriorityQueue/SplHeap doesn't expose extractFlags nor curruption state).
Fixed bug #66405 (RecursiveDirectoryIterator::CURRENT_AS_PATHNAME breaks the RecursiveIterator).
SQLite3:
Fixed bug #70571 (Memory leak in sqlite3_do_callback).
Fixed bug #69972 (Use-after-free vulnerability in sqlite3SafetyCheckSickOrOk()).
Fixed bug #69897 (segfault when manually constructing SQLite3Result).
