Failed to download pi mod manifest from

Version 7.4.13

• Core:
  • Fixed bug #80280 (ADD_EXTENSION_DEP() fails for ext/standard and ext/date).
  • Fixed bug #80258 (Windows Deduplication Enabled, randon permission errors).
• COM:
  • Fixed bug #62474 (com_event_sink crashes on certain arguments).
• DOM:
  • Fixed bug #80268 (loadHTML() truncates at NUL bytes).
• FFI:
  • Fixed bug #79177 (FFI doesn't handle well PHP exceptions within callback).
• IMAP:
  • Fixed bug #64076 (imap_sort() does not return FALSE on failure).
  • Fixed bug #76618 (segfault on imap_reopen).
  • Fixed bug #80239 (imap_rfc822_write_address() leaks memory).
  • Fixed minor regression caused by fixing bug #80220.
  • Fixed bug #80242 (imap_mail_compose() segfaults for multipart with rfc822).
• MySQLi:
  • Fixed bug #79375 (mysqli_store_result does not report error from lock wait timeout).
  • Fixed bug #76525 (mysqli::commit does not throw if MYSQLI_REPORT_ERROR enabled and mysqlnd used).
  • Fixed bug #72413 (mysqlnd segfault (fetch_row second parameter typemismatch)).
• ODBC:
  • Fixed bug #44618 (Fetching may rely on uninitialized data).
• Opcache:
  • Fixed bug #79643 (PHP with Opcache crashes when a file with specific name is included).
  • Fixed run-time binding of preloaded dynamically declared function.
• OpenSSL:
  • Fixed bug #79983 (openssl_encrypt / openssl_decrypt fail with OCB mode).
• PDO MySQL:
  • Fixed bug #66528 (No PDOException or errorCode if database becomes unavailable before PDO::commit).
  • Fixed bug #65825 (PDOStatement::fetch() does not throw exception on broken server connection).
• SNMP:
  • Fixed bug #70461 (disable md5 code when it is not supported in net-snmp).
• Standard:
  • Fixed bug #80266 (parse_url silently drops port number 0).

Version 7.4.12

• Core:
  • Fixed bug #80061 (Copying large files may have suboptimal performance).
  • Fixed bug #79423 (copy command is limited to size of file it can copy).
  • Fixed bug #80126 (Covariant return types failing compilation).
  • Fixed bug #80186 (Segfault when iterating over FFI object).
• Calendar:
  • Fixed bug #80185 (jdtounix() fails after 2037).
• IMAP:
  • Fixed bug #80213 (imap_mail_compose() segfaults on certain $bodies).
  • Fixed bug #80215 (imap_mail_compose() may modify by-val parameters).
  • Fixed bug #80220 (imap_mail_compose() may leak memory).
  • Fixed bug #80223 (imap_mail_compose() leaks envelope on malformed bodies).
  • Fixed bug #80216 (imap_mail_compose() does not validate types/encodings).
  • Fixed bug #80226 (imap_sort() leaks sortpgm memory).
• MySQLnd:
  • Fixed bug #80115 (mysqlnd.debug doesn't recognize absolute paths with slashes).
  • Fixed bug #80107 (mysqli_query() fails for ~16 MB long query when compression is enabled).
• ODBC:
  • Fixed bug #78470 (odbc_specialcolumns() no longer accepts $nullable).
  • Fixed bug #80147 (BINARY strings may not be properly zero-terminated).
  • Fixed bug #80150 (Failure to fetch error message).
  • Fixed bug #80152 (odbc_execute() moves internal pointer of $params).
  • Fixed bug #46050 (odbc_next_result corrupts prepared resource).
• OPcache:
  • Fixed bug #80083 (Optimizer pass 6 removes variables used for ibm_db2 data binding).
  • Fixed bug #80194 (Assertion failure during block assembly of unreachable free with leading nop).
• PCRE:
  • Updated to PCRE 10.35.
  • Fixed bug #80118 (Erroneous whitespace match with JIT only).
• PDO_ODBC:
  • Fixed bug #67465 (NULL Pointer dereference in odbc_handle_preparer).
• Standard:
  • Fixed bug #80114 (parse_url does not accept URLs with port 0).
  • Fixed bug #76943 (Inconsistent stream_wrapper_restore() errors).
  • Fixed bug #76735 (Incorrect message in fopen on invalid mode).
• Tidy:
  • Fixed bug #77040 (tidyNode::isHtml() is completely broken).

Version 7.4.11

• Core:
  • Fixed bug #79699 (PHP parses encoded cookie names so malicious `__Host-` cookies can be sent). (CVE-2020-7070)
  • Fixed bug #79979 (passing value to by-ref param via CUFA crashes).
  • Fixed bug #80037 (Typed property must not be accessed before initialization when __get() declared).
  • Fixed bug #80048 (Bug #69100 has not been fixed for Windows).
  • Fixed bug #80049 (Memleak when coercing integers to string via variadic argument).
• Calendar:
  • Fixed bug #80007 (Potential type confusion in unixtojd() parameter parsing).
• COM:
  • Fixed bug #64130 (COM obj parameters passed by reference are not updated).
• OPcache:
  • Fixed bug #80002 (calc free space for new interned string is wrong).
  • Fixed bug #80046 (FREE for SWITCH_STRING optimized away).
  • Fixed bug #79825 (opcache.file_cache causes SIGSEGV when custom opcode handlers changed).
• OpenSSL:
  • Fixed bug #79601 (Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV). (CVE-2020-7069)
• PDO:
  • Fixed bug #80027 (Terrible performance using $query->fetch on queries with many bind parameters).
• SOAP:
  • Fixed bug #47021 (SoapClient stumbles over WSDL delivered with "Transfer-Encoding: chunked").
• Standard:
  • Fixed bug #79986 (str_ireplace bug with diacritics characters).
  • Fixed bug #80077 (getmxrr test bug).
  • Fixed bug #72941 (Modifying bucket->data by-ref has no effect any longer).
  • Fixed bug #80067 (Omitting the port in bindto setting errors).

Version 7.4.10

• Core:
  • Fixed bug #79884 (PHP_CONFIG_FILE_PATH is meaningless).
  • Fixed bug #77932 (File extensions are case-sensitive).
  • Fixed bug #79806 (realpath() erroneously resolves link to link).
  • Fixed bug #79895 (PHP_CHECK_GCC_ARG does not allow flags with equal sign).
  • Fixed bug #79919 (Stack use-after-scope in define()).
  • Fixed bug #79934 (CRLF-only line in heredoc causes parsing error).
  • Fixed bug #79947 (Memory leak on invalid offset type in compound assignment).
• COM:
  • Fixed bug #48585 (com_load_typelib holds reference, fails on second call).
• Exif:
  • Fixed bug #75785 (Many errors from exif_read_data).
• Gettext:
  • Fixed bug #70574 (Tests fail due to relying on Linux fallback behavior for gettext()).
• LDAP:
• OPcache:
  • Fixed bug #73060 (php failed with error after temp folder cleaned up).
  • Fixed bug #79917 (File cache segfault with a static variable in inherited method).
• PDO:
  • Fixed bug #64705 (errorInfo property of PDOException is null when PDO::__construct() fails).
• Session:
  • Fixed bug #79724 (Return type does not match in ext/session/mod_mm.c).
• Standard:
  • Fixed bug #79930 (array_merge_recursive() crashes when called with array with single reference).
  • Fixed bug #79944 (getmxrr always returns true on Alpine linux).
  • Fixed bug #79951 (Memory leak in str_replace of empty string).
• XML:
  • Fixed bug #79922 (Crash after multiple calls to xml_parser_free()).

Version 7.4.9

• Apache:
  • Fixed bug #79030 (Upgrade apache2handler's php_apache_sapi_get_request_time to return usec).
• COM:
  • Fixed bug #63208 (BSTR to PHP string conversion not binary safe).
  • Fixed bug #63527 (DCOM does not work with Username, Password parameter).
• Core:
  • Fixed bug #79740 (serialize() and unserialize() methods can not be called statically).
  • Fixed bug #79783 (Segfault in php_str_replace_common).
  • Fixed bug #79778 (Assertion failure if dumping closure with unresolved static variable).
  • Fixed bug #79779 (Assertion failure when assigning property of string offset by reference).
  • Fixed bug #79792 (HT iterators not removed if empty array is destroyed).
  • Fixed bug #78598 (Changing array during undef index RW error segfaults).
  • Fixed bug #79784 (Use after free if changing array during undef var during array write fetch).
  • Fixed bug #79793 (Use after free if string used in undefined index warning is changed).
  • Fixed bug #79862 (Public non-static property in child should take priority over private static).
  • Fixed bug #79877 (getimagesize function silently truncates after a null byte) (cmb)
• Fileinfo:
  • Fixed bug #79756 (finfo_file crash (FILEINFO_MIME)).
• FTP:
  • Fixed bug #55857 (ftp_size on large files).
• Mbstring:
  • Fixed bug #79787 (mb_strimwidth does not trim string).
• Phar:
  • Fixed bug #79797 (Use of freed hash key in the phar_parse_zipfile function). (CVE-2020-7068)
• Reflection:
  • Fixed bug #79487 (::getStaticProperties() ignores property modifications).
  • Fixed bug #69804 (::getStaticPropertyValue() throws on protected props).
  • Fixed bug #79820 (Use after free when type duplicated into ReflectionProperty gets resolved).
• Standard:
  • Fixed bug #70362 (Can't copy() large 'data://' with open_basedir).
  • Fixed bug #78008 (dns_check_record() always return true on Alpine).
  • Fixed bug #79839 (array_walk() does not respect property types).

Version 7.4.8

• Core:
  • Fixed bug #79595 (zend_init_fpu() alters FPU precision).
  • Fixed bug #79650 (php-win.exe 100% cpu lockup).
  • Fixed bug #79668 (get_defined_functions(true) may miss functions).
  • Fixed bug #79683 (Fake reflection scope affects __toString()).
  • Fixed possibly unsupported timercmp() usage.
• Exif:
  • Fixed bug #79687 (Sony picture - PHP Warning - Make, Model, MakerNotes).
• Fileinfo:
  • Fixed bug #79681 (mime_content_type/finfo returning incorrect mimetype).
• Filter:
  • Fixed bug #73527 (Invalid memory access in php_filter_strip).
• GD:
  • Fixed bug #79676 (imagescale adds black border with IMG_BICUBIC).
• OpenSSL:
  • Fixed bug #62890 (default_socket_timeout=-1 causes connection to timeout).
• PDO SQLite:
  • Fixed bug #79664 (PDOStatement::getColumnMeta fails on empty result set).
• phpdbg:
  • Fixed bug #73926 (phpdbg will not accept input on restart execution).
  • Fixed bug #73927 (phpdbg fails with windows error prompt at "watch array").
  • Fixed several mostly Windows related phpdbg bugs.
• SPL:
  • Fixed bug #79710 (Reproducible segfault in error_handler during GC involved an SplFileObject).
• Standard:
  • Fixed bug #74267 (segfault with streams and invalid data).

Version 7.4.7

• Core:
  • Fixed bug #79599 (coredump in set_error_handler).
  • Fixed bug #79566 (Private SHM is not private on Windows).
  • Fixed bug #79489 (.user.ini does not inherit).
  • Fixed bug #79600 (Regression in 7.4.6 when yielding an array based generator).
  • Fixed bug #79657 ("yield from" hangs when invalid value encountered).
• FFI:
  • Fixed bug #79571 (FFI: var_dumping unions may segfault).
• GD:
  • Fixed bug #79615 (Wrong GIF header written in GD GIFEncode).
• MySQLnd:
  • Fixed bug #79596 (MySQL FLOAT truncates to int some locales).
• Opcache:
  • Fixed bug #79588 (Boolean opcache settings ignore on/off values).
  • Fixed bug #79548 (Preloading segfault with inherited method using static variable).
  • Fixed bug #79603 (RTD collision with opcache).
• Standard:
  • Fixed bug #79561 (dns_get_record() fails with DNS_ALL).

Version 7.4.6

• Core:
  • Fixed bug #78434 (Generator yields no items after valid() call).
  • Fixed bug #79477 (casting object into array creates references).
  • Fixed bug #79514 (Memory leaks while including unexistent file).
  • Fixed bug #79470 (PHP incompatible with 3rd party file system on demand).
  • Fixed bug #78784 (Unable to interact with files inside a VFS for Git repository).
  • Fixed bug #78875 (Long variables cause OOM and temp files are not cleaned). (CVE-2019-11048).
  • Fixed bug #78876 (Long variables in multipart/form-data cause OOM and temp files are not cleaned). (CVE-2019-11048).
• DOM:
  • Fixed bug #78221 (DOMNode::normalize() doesn't remove empty text nodes).
• EXIF:
  • Fixed bug #79336 (ext/exif/tests/bug79046.phpt fails on Big endian arch).
• FCGI:
  • Fixed bug #79491 (Search for .user.ini extends up to root dir).
• MBString:
  • Fixed bug #79441 (Segfault in mb_chr() if internal encoding is unsupported).
• OpenSSL:
  • Fixed bug #79497 (stream_socket_client() throws an unknown error sometimes with <1s timeout).
• PCRE:
• Phar:
  • Fixed bug #79503 (Memory leak on duplicate metadata).
• SimpleXML:
  • Fixed bug #79528 (Different object of the same xml between 7.4.5 and 7.4.4).
• SPL:
  • Fixed bug #69264 (__debugInfo() ignored while extending SPL classes).
  • Fixed bug #67369 (ArrayObject serialization drops the iterator class).
• Standard:
  • Fixed bug #79468 (SIGSEGV when closing stream handle with a stream filter appended).
  • Fixed bug #79447 (Serializing uninitialized typed properties with __sleep should not throw).

Version 7.4.5

• Core:
  • Fixed bug #79364 (When copy empty array, next key is unspecified).
  • Fixed bug #78210 (Invalid pointer address).
• CURL:
  • Fixed bug #79199 (curl_copy_handle() memory leak).
• Date:
  • Fixed bug #79396 (DateTime hour incorrect during DST jump forward).
  • Fixed bug #74940 (DateTimeZone loose comparison always true).
• FPM:
  • Implement request #77062 (Allow numeric [UG]ID in FPM listen.{owner,group}) (Andre Nathan)
• Iconv:
  • Fixed bug #79200 (Some iconv functions cut Windows-1258).
• OPcache:
  • Fixed bug #79412 (Opcache chokes and uses 100% CPU on specific script).
• Session:
  • Fixed bug #79413 (session_create_id() fails for active sessions).
• Shmop:
  • Fixed bug #79427 (Integer Overflow in shmop_open()).
• SimpleXML:
  • Fixed bug #61597 (SXE properties may lack attributes and content).
• SOAP:
  • Fixed bug #79357 (SOAP request segfaults when any request parameter is missing).
• Spl:
  • Fixed bug #75673 (SplStack::unserialize() behavior).
  • Fixed bug #79393 (Null coalescing operator failing with SplFixedArray).
• Standard:
  • Fixed bug #79330 (shell_exec() silently truncates after a null byte).
  • Fixed bug #79410 (system() swallows last chunk if it is exactly 4095 bytes without newline).
  • Fixed bug #79465 (OOB Read in urldecode()). (CVE-2020-7067)
• Zip:
  • Fixed bug #79296 (ZipArchive::open fails on empty file).
  • Fixed bug #79424 (php_zip_glob uses gl_pathc after call to globfree).

Version 7.4.4

• Core:
  • Fixed bug #79329 (get_headers() silently truncates after a null byte) (CVE-2020-7066)
  • Fixed bug #79244 (php crashes during parsing INI file).
  • Fixed bug #63206 (restore_error_handler does not restore previous errors mask).
• COM:
  • Fixed bug #66322 (COMPersistHelper::SaveToFile can save to wrong location).
  • Fixed bug #79242 (COM error constants don't match com_exception codes on x86).
  • Fixed bug #79247 (Garbage collecting variant objects segfaults).
  • Fixed bug #79248 (Traversing empty VT_ARRAY throws com_exception).
  • Fixed bug #79299 (com_print_typeinfo prints duplicate variables).
  • Fixed bug #79332 (php_istreams are never freed).
  • Fixed bug #79333 (com_print_typeinfo() leaks memory).
• CURL:
  • Fixed bug #79019 (Copied cURL handles upload empty file).
  • Fixed bug #79013 (Content-Length missing when posting a curlFile with curl).
• DOM:
  • Fixed bug #77569: (Write Access Violation in DomImplementation).
  • Fixed bug #79271 (DOMDocumentType::$childNodes is NULL).
• Enchant:
  • Fixed bug #79311 (enchant_dict_suggest() fails on big endian architecture).
• EXIF:
  • Fixed bug #79282 (Use-of-uninitialized-value in exif) (CVE-2020-7064).
• Fileinfo:
  • Fixed bug #79283 (Segfault in libmagic patch contains a buffer overflow).
• FPM:
  • Fixed bug #77653 (operator displayed instead of the real error message).
  • Fixed bug #79014 (PHP-FPM & Primary script unknown).
• MBstring:
  • Fixed bug #79371 (mb_strtolower (UTF-32LE): stack-buffer-overflow at php_unicode_tolower_full) (CVE-2020-7065).
• MySQLi:
  • Fixed bug #64032 (mysqli reports different client_version).
• MySQLnd:
  • Implemented FR #79275 (Support auth_plugin_caching_sha2_password on Windows).
• Opcache:
  • Fixed bug #79252 (preloading causes php-fpm to segfault during exit).
• PCRE:
  • Fixed bug #79188 (Memory corruption in preg_replace/preg_replace_callback and unicode).
  • Fixed bug #79241 (Segmentation fault on preg_match()).
  • Fixed bug #79257 (Duplicate named groups (?J) prefer last alternative even if not matched).
• PDO_ODBC:
  • Fixed bug #79038 (PDOStatement::nextRowset() leaks column values).
• Reflection:
  • Fixed bug #79062 (Property with heredoc default value returns false for getDocComment).
• SQLite3:
  • Fixed bug #79294 (::columnType() may fail after SQLite3Stmt::reset()).
• Standard:
  • Fixed bug #79254 (getenv() w/o arguments not showing changes).
  • Fixed bug #79265 (Improper injection of Host header when using fopen for http requests).
• Zip:
  • Fixed bug #79315 (ZipArchive::addFile doesn't honor start/length parameters).

Version 7.4.3

• Core:
  • Fixed bug #79146 (cscript can fail to run on some systems).
  • Fixed bug #79155 (Property nullability lost when using multiple property definition).
  • Fixed bug #78323 (Code 0 is returned on invalid options).
  • Fixed bug #78989 (Delayed variance check involving trait segfaults).
  • Fixed bug #79174 (cookie values with spaces fail to round-trip).
  • Fixed bug #76047 (Use-after-free when accessing already destructed backtrace arguments).
• COM:
  • Fixed bug #79247 (Garbage collecting variant objects segfaults).
• CURL:
  • Fixed bug #79078 (Hypothetical use-after-free in curl_multi_add_handle()).
• FFI:
  • Fixed bug #79096 (FFI Struct Segfault).
• IMAP:
  • Fixed bug #79112 (IMAP extension can't find OpenSSL libraries at configure time).
• Intl:
  • Fixed bug #79212 (NumberFormatter::format() may detect wrong type).
• Libxml:
  • Fixed bug #79191 (Error in SoapClient ctor disables DOMDocument::save()).
• MBString:
  • Fixed bug #79149 (SEGV in mb_convert_encoding with non-string encodings).
• MySQLi:
  • Fixed bug #78666 (Properties may emit a warning on var_dump()).
• MySQLnd:
  • Fixed bug #79084 (mysqlnd may fetch wrong column indexes with MYSQLI_BOTH).
  • Fixed bug #79011 (MySQL caching_sha2_password Access denied for password with more than 20 chars).
• Opcache:
  • Fixed bug #79114 (Eval class during preload causes class to be only half available).
  • Fixed bug #79128 (Preloading segfaults if preload_user is used).
  • Fixed bug #79193 (Incorrect type inference for self::$field =& $field).
• OpenSSL:
  • Fixed bug #79145 (openssl memory leak).
• Phar:
  • Fixed bug #79082 (Files added to tar with Phar::buildFromIterator have all-access permissions). (CVE-2020-7063)
  • Fixed bug #79171 (heap-buffer-overflow in phar_extract_file). (CVE-2020-7061)
  • Fixed bug #76584 (PharFileInfo::decompress not working).
• Reflection:
  • Fixed bug #79115 (ReflectionClass::isCloneable call reflected class __destruct).
• Session:
  • Fixed bug #79221 (Null Pointer Dereference in PHP Session Upload Progress). (CVE-2020-7062)
• Standard:
  • Fixed bug #78902 (Memory leak when using stream_filter_append).
  • Fixed bug #78969 (PASSWORD_DEFAULT should match PASSWORD_BCRYPT instead of being null).
• Testing:
  • Fixed bug #78090 (bug45161.phpt takes forever to finish).
• XSL:
  • Fixed bug #70078 (XSL callbacks with nodes as parameter leak memory).
• Zip:
  • Add ZipArchive::CM_LZMA2 and ZipArchive::CM_XZ constants (since libzip 1.6.0).
  • Add ZipArchive::RDONLY (since libzip 1.0.0).
  • Add ZipArchive::ER_* missing constants.
  • Add ZipArchive::LIBZIP_VERSION constant.
  • Fixed bug #73119 (Wrong return for ZipArchive::addEmptyDir Method).

Version 7.4.2

• Core:
  • Preloading support on Windows has been disabled.
  • Fixed bug #79022 (class_exists returns True for classes that are not ready to be used).
  • Fixed bug #78929 (plus signs in cookie values are converted to spaces).
  • Fixed bug #78973 (Destructor during CV freeing causes segfault if opline never saved).
  • Fixed bug #78776 (Abstract method implementation from trait does not check "static").
  • Fixed bug #78999 (Cycle leak when using function result as temporary).
  • Fixed bug #79008 (General performance regression with PHP 7.4 on Windows).
  • Fixed bug #79002 (Serializing uninitialized typed properties with __sleep makes unserialize throw).
• CURL:
  • Fixed bug #79033 (Curl timeout error with specific url and post).
  • Fixed bug #79063 (curl openssl does not respect PKG_CONFIG_PATH).
• Date:
  • Fixed bug #79015 (undefined-behavior in php_date.c).
• DBA:
  • Fixed bug #78808 ([LMDB] MDB_MAP_FULL: Environment mapsize limit reached).
• Exif:
  • Fixed bug #79046 (NaN to int cast undefined behavior in exif).
• Fileinfo:
  • Fixed bug #74170 (locale information change after mime_content_type).
• GD:
  • Fixed bug #79067 (gdTransformAffineCopy() may use unitialized values).
  • Fixed bug #79068 (gdTransformAffineCopy() changes interpolation method).
• Libxml:
  • Fixed bug #79029 (Use After Free's in XMLReader / XMLWriter).
• Mbstring:
  • Fixed bug #79037 (global buffer-overflow in `mbfl_filt_conv_big5_wchar`). (CVE-2020-7060)
• OPcache:
  • Fixed bug #78961 (erroneous optimization of re-assigned $GLOBALS).
  • Fixed bug #78950 (Preloading trait method with static variables).
  • Fixed bug #78903 (Conflict in RTD key for closures results in crash).
  • Fixed bug #78986 (Opcache segfaults when inheriting ctor from immutable into mutable class).
  • Fixed bug #79040 (Warning Opcode handlers are unusable due to ASLR).
  • Fixed bug #79055 (Typed property become unknown with OPcache file cache).
• Pcntl:
  • Fixed bug #78402 (Converting null to string in error message is bad DX).
• PDO_PgSQL:
  • Fixed bug #78983 (pdo_pgsql config.w32 cannot find libpq-fe.h).
  • Fixed bug #78980 (pgsqlGetNotify() overlooks dead connection).
  • Fixed bug #78982 (pdo_pgsql returns dead persistent connection).
• Session:
  • Fixed bug #79091 (heap use-after-free in session_create_id()).
  • Fixed bug #79031 (Session unserialization problem).
• Shmop:
  • Fixed bug #78538 (shmop memory leak).
• Sqlite3:
  • Fixed bug #79056 (sqlite does not respect PKG_CONFIG_PATH during compilation).
• Spl:
  • Fixed bug #78976 (SplFileObject::fputcsv returns -1 on failure).
• Standard:
  • Fixed bug #79099 (OOB read in php_strip_tags_ex). (CVE-2020-7059)
  • Fixed bug #79000 (Non-blocking socket stream reports EAGAIN as error).
  • Fixed bug #54298 (Using empty additional_headers adding extraneous CRLF).

Version 7.4.1

• Bcmath:
  • Fixed bug #78878 (Buffer underflow in bc_shift_addsub). (CVE-2019-11046).
• Core:
  • Fixed bug #78862 (link() silently truncates after a null byte on Windows). (CVE-2019-11044).
  • Fixed bug #78863 (DirectoryIterator class silently truncates after a null byte). (CVE-2019-11045).
  • Fixed bug #78943 (mail() may release string with refcount==1 twice). (CVE-2019-11049).
  • Fixed bug #78810 (RW fetches do not throw "uninitialized property" exception).
  • Fixed bug #78868 (Calling __autoload() with incorrect EG(fake_scope) value).
  • Fixed bug #78296 (is_file fails to detect file).
  • Fixed bug #78883 (fgets(STDIN) fails on Windows).
  • Fixed bug #78898 (call_user_func(['parent', ...]) fails while other succeed).
  • Fixed bug #78904 (Uninitialized property triggers __get()).
  • Fixed bug #78926 (Segmentation fault on Symfony cache:clear).
• GD:
  • Fixed bug #78849 (GD build broken with -D SIGNED_COMPARE_SLOW).
  • Fixed bug #78923 (Artifacts when convoluting image with transparency).
• EXIF:
  • Fixed bug #78793 (Use-after-free in exif parsing under memory sanitizer). (CVE-2019-11050).
  • Fixed bug #78910 (Heap-buffer-overflow READ in exif). (CVE-2019-11047).
• FPM:
  • Fixed bug #76601 (Partially working php-fpm ater incomplete reload).
  • Fixed bug #78889 (php-fpm service fails to start).
  • Fixed bug #78916 (php-fpm 7.4.0 don't send mail via mail()).
• Intl:
  • Implemented FR #78912 (INTL Support for accounting format).
• Mysqlnd:
  • Fixed bug #78823 (ZLIB_LIBS not added to EXTRA_LIBS).
• OPcache:
  • Fixed $x = (bool)$x; with opcache (should emit undeclared variable notice).
  • Fixed bug #78935 (Preloading removes classes that have dependencies).
• PCRE:
  • Fixed bug #78853 (preg_match() may return integer > 1).
• Reflection:
  • Fixed bug #78895 (Reflection detects abstract non-static class as abstract static. IS_IMPLICIT_ABSTRACT is not longer used).
• Standard:
  • Fixed bug #77638 (var_export'ing certain class instances segfaults).
  • Fixed bug #78840 (imploding $GLOBALS crashes).
  • Fixed bug #78833 (Integer overflow in pack causes out-of-bound access).
  • Fixed bug #78814 (strip_tags allows / in tag name => whitelist bypass).

Version 7.4.0

• Core:
  • Implemented RFC: Deprecate curly brace syntax for accessing array elements and string offsets.
  • Implemented RFC: Deprecations for PHP 7.4.
  • Fixed bug #52752 (Crash when lexing).
  • Fixed bug #60677 (CGI doesn't properly validate shebang line contains #!).
  • Fixed bug #71030 (Self-assignment in list() may have inconsistent behavior).
  • Fixed bug #72530 (Use After Free in GC with Certain Destructors).
  • Fixed bug #75921 (Inconsistent: No warning in some cases when stdObj is created on the fly).
  • Implemented FR #76148 (Add array_key_exists() to the list of specially compiled functions).
  • Fixed bug #76430 (__METHOD__ inconsistent outside of method).
  • Fixed bug #76451 (Aliases during inheritance type checks affected by opcache).
  • Implemented FR #77230 (Support custom CFLAGS and LDFLAGS from environment).
  • Fixed bug #77345 (Stack Overflow caused by circular reference in garbage collection).
  • Fixed bug #77812 (Interactive mode does not support PHP 7.3-style heredoc).
  • Fixed bug #77877
  • Fixed bug #78066 (PHP eats the first byte of a program that comes from process substitution).
  • Fixed bug #78151 (Segfault caused by indirect expressions in PHP 7.4a1).
  • Fixed bug #78154 (SEND_VAR_NO_REF does not always send reference).
  • Fixed bug #78182 (Segmentation fault during by-reference property assignment).
  • Fixed bug #78212 (Segfault in built-in webserver).
  • Fixed bug #78220 (Can't access OneDrive folder).
  • Fixed bug #78226 (Unexpected __set behavior with typed properties).
  • Fixed bug #78239 (Deprecation notice during string conversion converted to exception hangs).
  • Fixed bug #78335 (Static properties/variables containing cycles report as leak).
  • Fixed bug #78340 (Include of stream wrapper not reading whole file).
  • Fixed bug #78344 (Segmentation fault on zend_check_protected).
  • Fixed bug #78356 (Array returned from ArrayAccess is incorrectly unpacked as argument).
  • Fixed bug #78379 (Cast to object confuses GC, causes crash).
  • Fixed bug #78386 (fstat mode has unexpected value on PHP 7.4).
  • Fixed bug #78396 (Second file_put_contents in Shutdown hangs script).
  • Fixed bug #78406 (Broken file includes with user-defined stream filters).
  • Fixed bug #78438 (Corruption when __unserializing deeply nested structures).
  • Fixed bug #78441 (Parse error due to heredoc identifier followed by digit).
  • Fixed bug #78454 (Consecutive numeric separators cause OOM error).
  • Fixed bug #78460 (PEAR installation failure).
  • Fixed bug #78531 (Crash when using undefined variable as object).
  • Fixed bug #78535 (auto_detect_line_endings value not parsed as bool).
  • Fixed bug #78604 (token_get_all() does not properly tokenize FOO<?php with short_open_tag=0).
  • Fixed bug #78614 (Does not compile with DTRACE anymore).
  • Fixed bug #78620 (Out of memory error).
  • Fixed bug #78632 (method_exists() in php74 works differently from php73 in checking priv. methods).
  • Fixed bug #78644 (SEGFAULT in ZEND_UNSET_OBJ_SPEC_VAR_CONST_HANDLER).
  • Fixed bug #78658 (Memory corruption using Closure::bindTo).
  • Fixed bug #78656 (Parse errors classified as highest log-level).
  • Fixed bug #78662 (stream_write bad error detection).
  • Fixed bug #78768 (redefinition of typedef zend_property_info).
  • Fixed bug #78788 (./configure generates invalid php_version.h).
  • Fixed incorrect usage of QM_ASSIGN instruction. It must not return IS_VAR. As a side effect, this allowed passing left hand list() "by reference", instead of compile-time error.
• CLI:
  • The built-in CLI server now reports the request method in log files.
• COM:
  • Deprecated registering of case-insensitive constants from typelibs.
  • Fixed bug #78650 (new COM Crash).
  • Fixed bug #78694 (Appending to a variant array causes segfault).
• CURL:
  • Fixed bug #76480 (Use curl_multi_wait() so that timeouts are respected).
  • Implemented FR #77711 (CURLFile should support UNICODE filenames).
  • Deprecated CURLPIPE_HTTP1.
  • Deprecated $version parameter of curl_version().
• Date:
  • Updated timelib to 2018.02.
  • Fixed bug #69044 (discrepency between time and microtime).
  • Fixed bug #70153 (\DateInterval incorrectly unserialized).
  • Fixed bug #75232 (print_r of DateTime creating side-effect).
  • Fixed bug #78383 (Casting a DateTime to array no longer returns its properties).
  • Fixed bug #78751 (Serialising DatePeriod converts DateTimeImmutable).
• Exif:
  • Fixed bug #78333 (Exif crash (bus error) due to wrong alignment and invalid cast).
  • Fixed bug #78256 (heap-buffer-overflow on exif_process_user_comment). (CVE-2019-11042)
  • Fixed bug #78222 (heap-buffer-overflow on exif_scan_thumbnail). (CVE-2019-11041)
• Fileinfo:
  • Fixed bug #78075 (finfo_file treats JSON file as text/plain).
  • Fixed bug #78183 (finfo_file shows wrong mime-type for .tga file).
• Filter:
  • The filter extension no longer has the --with-pcre-dir on Unix builds, allowing the extension to be once more compiled as shared using ./configure.
  • Added min_range and max_range options for FILTER_VALIDATE_FLOAT.
• FFI:
  • Added FFI extension.
  • Fixed bug #78488 (OOB in ZEND_FUNCTION(ffi_trampoline)).
  • Fixed bug #78543 (is_callable() on FFI\CData throws Exception).
  • Fixed bug #78716 (Function name mangling is wrong for some parameter types).
  • Fixed bug #78762 (Failing FFI::cast() may leak memory).
  • Fixed bug #78761 (Zend memory heap corruption with preload and casting).
  • Implement FR #78270 (Support __vectorcall convention with FFI).
  • Added missing FFI::isNull().
• FPM:
  • Implemented FR #72510 (systemd service should be hardened).
  • Fixed bug #74083 (master PHP-fpm is stopped on multiple reloads).
  • Fixed bug #78334 (fpm log prefix message includes wrong stdout/stderr notation).
  • Fixed bug #78599 (env_path_info underflow in fpm_main.c can lead to RCE). (CVE-2019-11043)
• GD:
  • Implemented the scatter filter (IMG_FILTER_SCATTER).
  • The bundled libgd behaves now like system libgd wrt. IMG_CROP_DEFAULT never falling back to IMG_CROP_SIDES.
  • The default $mode parameter of imagecropauto() has been changed to IMG_CROP_DEFAULT; passing -1 is now deprecated.
  • Added support for aspect ratio preserving scaling to a fixed height for imagescale().
  • Added TGA read support.
  • Fixed bug #73291 (imagecropauto() $threshold differs from external libgd).
  • Fixed bug #76324 (cannot detect recent versions of freetype with pkg-config).
  • Fixed bug #78314 (missing freetype support/functions with external gd).
• GMP:
  • Fixed bug #78574 (broken shared build).
• Hash:
• Iconv:
  • Fixed bug #78342 (Bus error in configure test for iconv //IGNORE).
  • Fixed bug #78642 (Wrong libiconv version displayed).
• Libxml:
  • Fixed bug #78279 (libxml_disable_entity_loader settings is shared between requests (cgi-fcgi)).
• InterBase:
  • Unbundled the InterBase extension and moved it to PECL.
• Intl:
  • Raised requirements to ICU ≥ 50.1.
  • Changed ResourceBundle to implement Countable.
  • Changed default of $variant parameter of idn_to_ascii() and idn_to_utf8().
• LDAP:
  • Deprecated ldap_control_paged_result_response and ldap_control_paged_result
• LiteSpeed:
  • Updated to LiteSpeed SAPI V7.5 (Fixed clean shutdown).
  • Updated to LiteSpeed SAPI V7.4.3 (increased response header count limit from 100 to 1000, added crash handler to cleanly shutdown PHP request, added CloudLinux mod_lsapi mode).
  • Fixed bug #76058 (After "POST data can't be buffered", using php://input makes huge tmp files).
• MBString:
  • Fixed bug #77907 (mb-functions do not respect default_encoding).
  • Fixed bug #78579 (mb_decode_numericentity: args number inconsistency).
  • Fixed bug #78609 (mb_check_encoding() no longer supports stringable objects).
• MySQLi:
  • Fixed bug #67348 (Reading $dbc->stat modifies $dbc->affected_rows).
  • Fixed bug #76809 (SSL settings aren't respected when persistent connections are used).
  • Fixed bug #78179 (MariaDB server version incorrectly detected).
  • Fixed bug #78213 (Empty row pocket).
• MySQLnd:
  • Fixed connect_attr issues and added the _server_host connection attribute.
  • Fixed bug #60594 (mysqlnd exposes 160 lines of stats in phpinfo).
• ODBC:
  • Fixed bug #78473 (odbc_close() closes arbitrary resources).
• Opcache:
  • Implemented preloading RFC.
  • Add opcache.preload_user INI directive.
  • Added new INI directive opcache.cache_id (Windows only).
  • Fixed bug #78106 (Path resolution fails if opcache disabled during request).
  • Fixed bug #78175 (Preloading segfaults at preload time and at runtime).
  • Fixed bug #78202 (Opcache stats for cache hits are capped at 32bit NUM).
  • Fixed bug #78271 (Invalid result of if-else).
  • Fixed bug #78341 (Failure to detect smart branch in DFA pass).
  • Fixed bug #78376 (Incorrect preloading of constant static properties).
  • Fixed bug #78429 (opcache_compile_file(__FILE__); segfaults).
  • Fixed bug #78512 (Cannot make preload work).
  • Fixed bug #78514 (Preloading segfaults with inherited typed property).
  • Fixed bug #78654 (Incorrectly computed opcache checksum on files with non-ascii characters).
• OpenSSL:
  • Added TLS 1.3 support to streams including new tlsv1.3 stream.
  • Added openssl_x509_verify function.
  • openssl_random_pseudo_bytes() now throws in error conditions.
  • Changed the default config path (Windows only).
  • Fixed bug #78231 (Segmentation fault upon stream_socket_accept of exported socket-to-stream).
  • Fixed bug #78391 (Assertion failure in openssl_random_pseudo_bytes).
  • Fixed bug #78775 (TLS issues from HTTP request affecting other encrypted connections).
• Pcntl:
  • Fixed bug #77335 (PHP is preventing SIGALRM from specifying SA_RESTART).
• PCRE:
  • Implemented FR #77094 (Support flags in preg_replace_callback).
  • Fixed bug #72685 (Repeated UTF-8 validation of same string in UTF-8 mode).
  • Fixed bug #73948 (Preg_match_all should return NULLs on trailing optional capture groups).
  • Fixed bug #78338 (Array cross-border reading in PCRE).
  • Fixed bug #78349 (Bundled pcre2 library missing LICENCE file).
• PDO:
  • Implemented FR #71885 (Allow escaping question mark placeholders). https://wiki.php.net/rfc/pdo_escape_placeholders
  • Fixed bug #77849 (Disable cloning of PDO handle/connection objects).
  • Implemented FR #78033 (PDO - support username and password specified in DSN).
• PDO_Firebird:
  • Implemented FR #65690 (PDO_Firebird should also support dialect 1).
  • Implemented FR #77863 (PDO firebird support type Boolean in input parameters).
• PDO_MySQL:
  • Fixed bug #41997 (SP call yields additional empty result set).
  • Fixed bug #78623 (Regression caused by "SP call yields additional empty result set").
• PDO_OCI:
  • Support Oracle Database tracing attributes ACTION, MODULE, CLIENT_INFO, and CLIENT_IDENTIFIER.
  • Implemented FR #76908 (PDO_OCI getColumnMeta() not implemented).
• PDO_SQLite:
  • Implemented sqlite_stmt_readonly in PDO_SQLite.
  • Raised requirements to SQLite 3.5.0.
  • Fixed bug #78192 (SegFault when reuse statement after schema has changed).
  • Fixed bug #78348 (Remove -lrt from pdo_sqlite.so).
• Phar:
  • Fixed bug #77919 (Potential UAF in Phar RSHUTDOWN).
• phpdbg:
  • Fixed bug #76596 (phpdbg support for display_errors=stderr).
  • Fixed bug #76801 (too many open files).
  • Fixed bug #77800 (phpdbg segfaults on listing some conditional breakpoints).
  • Fixed bug #77805 (phpdbg build fails when readline is shared).
• Recode:
  • Unbundled the recode extension.
• Reflection:
  • Fixed bug #76737 (Unserialized reflection objects are broken, they shouldn't be serializable).
  • Fixed bug #78263 (\ReflectionReference::fromArrayElement() returns null while item is a reference).
  • Fixed bug #78410 (Cannot "manually" unserialize class that is final and extends an internal one).
  • Fixed bug #78697 (ReflectionClass::implementsInterface - inaccurate error message with traits).
  • Fixed bug #78774 (ReflectionNamedType on Typed Properties Crash).
• Session:
  • Fixed bug #78624 (session_gc return value for user defined session handlers).
• SimpleXML:
  • Implemented FR #65215 (SimpleXMLElement could register as implementing Countable).
  • Fixed bug #75245 (Don't set content of elements with only whitespaces).
• Sockets:
  • Fixed bug #67619 (Validate length on socket_write).
  • Fixed bug #78665 (Multicasting may leak memory).
• sodium:
  • Fixed bug #77646 (sign_detached() strings not terminated).
  • Fixed bug #78510 (Partially uninitialized buffer returned by sodium_crypto_generichash_init()).
  • Fixed bug #78516 (password_hash(): Memory cost is not in allowed range).
• SPL:
  • Fixed bug #77518 (SeekableIterator::seek() should accept 'int' typehint as documented).
  • Fixed bug #78409 (Segfault when creating instance of ArrayIterator without constructor).
  • Fixed bug #78436 (Missing addref in SplPriorityQueue EXTR_BOTH mode).
  • Fixed bug #78456 (Segfault when serializing SplDoublyLinkedList).
• SQLite3:
  • Unbundled libsqlite.
  • Raised requirements to SQLite 3.7.4.
  • Forbid (un)serialization of SQLite3, SQLite3Stmt and SQLite3Result.
  • Added support for the SQLite @name notation.
  • Added SQLite3Stmt::getSQL() to retrieve the SQL of the statement.
  • Implement FR ##70950 (Make SQLite3 Online Backup API available).
• Standard:
  • Implemented RFC password hashing registry.
  • Implemented RFC where password_hash() has argon2i(d) implementations from ext/sodium when PHP is built without libargon.
  • Implemented FR #38301 (field enclosure behavior in fputcsv).
  • Implemented FR #51496 (fgetcsv should take empty string as an escape).
  • Fixed bug #73535 (php_sockop_write() returns 0 on error, can be used to trigger Denial of Service).
  • Fixed bug #74764 (Bindto IPv6 works with file_get_contents but fails with stream_socket_client).
  • Fixed bug #76859 (stream_get_line skips data if used with data-generating filter).
  • Implemented FR #77377 (No way to handle CTRL+C in Windows).
  • Fixed bug #77930 (stream_copy_to_stream should use mmap more often).
  • Implemented FR #78177 (Make proc_open accept command array).
  • Fixed bug #78208 (password_needs_rehash() with an unknown algo should always return true).
  • Fixed bug #78241 (touch() does not handle dates after 2038 in PHP 64-bit).
  • Fixed bug #78282 (atime and mtime mismatch).
  • Fixed bug #78326 (improper memory deallocation on stream_get_contents() with fixed length buffer).
  • Fixed bug #78346 (strip_tags no longer handling nested php tags).
  • Fixed bug #78506 (Error in a php_user_filter::filter() is not reported).
  • Fixed bug #78549 (Stack overflow due to nested serialized input).
  • Fixed bug #78759 (array_search in $GLOBALS).
• Testing:
  • Fixed bug #78684 (PCRE bug72463_2 test is sending emails on Linux).
• Tidy:
  • Added TIDY_TAG_* constants for HTML5 elements.
  • Fixed bug #76736 (wrong reflection for tidy_get_head, tidy_get_html, tidy_get_root, and tidy_getopt)
• WDDX:
  • Deprecated and unbundled the WDDX extension.
• Zip:
  • Fixed bug #78641 (addGlob can modify given remove_path value).

Version 7.3.25

• Core:
  • Fixed bug #80280 (ADD_EXTENSION_DEP() fails for ext/standard and ext/date).
  • Fixed bug #80258 (Windows Deduplication Enabled, randon permission errors).
• COM:
  • Fixed bug #62474 (com_event_sink crashes on certain arguments).
• DOM:
  • Fixed bug #80268 (loadHTML() truncates at NUL bytes).
• IMAP:
  • Fixed bug #64076 (imap_sort() does not return FALSE on failure).
  • Fixed bug #76618 (segfault on imap_reopen).
  • Fixed bug #80239 (imap_rfc822_write_address() leaks memory).
  • Fixed minor regression caused by fixing bug #80220.
  • Fixed bug #80242 (imap_mail_compose() segfaults for multipart with rfc822).
• Intl:
  • Fixed bug #80310 (ext-intl with icu4c 68.1: use of undeclared identifier 'TRUE').
• ODBC:
  • Fixed bug #44618 (Fetching may rely on uninitialized data).
• SNMP:
  • Fixed bug #70461 (disable md5 code when it is not supported in net-snmp).
• Standard:
  • Fixed bug #80266 (parse_url silently drops port number 0).

Version 7.3.24

• Core:
  • Fixed bug #79423 (copy command is limited to size of file it can copy).
• Calendar:
  • Fixed bug #80185 (jdtounix() fails after 2037).
• IMAP:
  • Fixed bug #80213 (imap_mail_compose() segfaults on certain $bodies).
  • Fixed bug #80215 (imap_mail_compose() may modify by-val parameters).
  • Fixed bug #80220 (imap_mail_compose() may leak memory).
  • Fixed bug #80223 (imap_mail_compose() leaks envelope on malformed bodies).
  • Fixed bug #80216 (imap_mail_compose() does not validate types/encodings).
  • Fixed bug #80226 (imap_sort() leaks sortpgm memory).
• MySQLnd:
  • Fixed bug #80115 (mysqlnd.debug doesn't recognize absolute paths with slashes).
  • Fixed bug #80107 (mysqli_query() fails for ~16 MB long query when compression is enabled).
• ODBC:
  • Fixed bug #78470 (odbc_specialcolumns() no longer accepts $nullable).
  • Fixed bug #80147 (BINARY strings may not be properly zero-terminated).
  • Fixed bug #80150 (Failure to fetch error message).
  • Fixed bug #80152 (odbc_execute() moves internal pointer of $params).
  • Fixed bug #46050 (odbc_next_result corrupts prepared resource).
• OPcache:
  • Fixed bug #80083 (Optimizer pass 6 removes variables used for ibm_db2 data binding).
• PDO_ODBC:
  • Fixed bug #67465 (NULL Pointer dereference in odbc_handle_preparer).
• Standard:
  • Fixed bug #80114 (parse_url does not accept URLs with port 0).
  • Fixed bug #76943 (Inconsistent stream_wrapper_restore() errors).
  • Fixed bug #76735 (Incorrect message in fopen on invalid mode).
• Tidy:
  • Fixed bug #77040 (tidyNode::isHtml() is completely broken).

Version 7.3.23

• Core:
  • Fixed bug #80048 (Bug #69100 has not been fixed for Windows).
  • Fixed bug #80049 (Memleak when coercing integers to string via variadic argument).
  • Fixed bug #79699 (PHP parses encoded cookie names so malicious `__Host-` cookies can be sent). (CVE-2020-7070)
• Calendar:
  • Fixed bug #80007 (Potential type confusion in unixtojd() parameter parsing).
• COM:
  • Fixed bug #64130 (COM obj parameters passed by reference are not updated).
• OPcache:
  • Fixed bug #80002 (calc free space for new interned string is wrong).
  • Fixed bug #79825 (opcache.file_cache causes SIGSEGV when custom opcode handlers changed).
• OpenSSL:
  • Fixed bug #79601 (Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV). (CVE-2020-7069)
• PDO:
  • Fixed bug #80027 (Terrible performance using $query->fetch on queries with many bind parameters).
• SOAP:
  • Fixed bug #47021 (SoapClient stumbles over WSDL delivered with "Transfer-Encoding: chunked").
• Standard:
  • Fixed bug #79986 (str_ireplace bug with diacritics characters).
  • Fixed bug #80077 (getmxrr test bug).
  • Fixed bug #72941 (Modifying bucket->data by-ref has no effect any longer).
  • Fixed bug #80067 (Omitting the port in bindto setting errors).

Version 7.3.22

• Core:
  • Fixed bug #79884 (PHP_CONFIG_FILE_PATH is meaningless).
  • Fixed bug #77932 (File extensions are case-sensitive).
  • Fixed bug #79806 (realpath() erroneously resolves link to link).
  • Fixed bug #79895 (PHP_CHECK_GCC_ARG does not allow flags with equal sign).
  • Fixed bug #79919 (Stack use-after-scope in define()).
  • Fixed bug #79934 (CRLF-only line in heredoc causes parsing error).
• COM:
  • Fixed bug #48585 (com_load_typelib holds reference, fails on second call).
• Exif:
  • Fixed bug #75785 (Many errors from exif_read_data).
• Gettext:
  • Fixed bug #70574 (Tests fail due to relying on Linux fallback behavior for gettext()).
• LDAP:
• OPcache:
  • Fixed bug #73060 (php failed with error after temp folder cleaned up).
• PDO:
  • Fixed bug #64705 (errorInfo property of PDOException is null when PDO::__construct() fails).
• Standard:
  • Fixed bug #79930 (array_merge_recursive() crashes when called with array with single reference).
  • Fixed bug #79944 (getmxrr always returns true on Alpine linux).
  • Fixed bug #79951 (Memory leak in str_replace of empty string).
• XML:
  • Fixed bug #79922 (Crash after multiple calls to xml_parser_free()).

Version 7.3.21

• Apache:
  • Fixed bug #79030 (Upgrade apache2handler's php_apache_sapi_get_request_time to return usec).
• Core:
  • Fixed bug #79877 (getimagesize function silently truncates after a null byte).
  • Fixed bug #79778 (Assertion failure if dumping closure with unresolved static variable).
  • Fixed bug #79792 (HT iterators not removed if empty array is destroyed).
• COM:
  • Fixed bug #63208 (BSTR to PHP string conversion not binary safe).
  • Fixed bug #63527 (DCOM does not work with Username, Password parameter).
• Curl:
  • Fixed bug #79741 (curl_setopt CURLOPT_POSTFIELDS asserts on object with declared properties).
• Fileinfo:
  • Fixed bug #79756 (finfo_file crash (FILEINFO_MIME)).
• FTP:
  • Fixed bug #55857 (ftp_size on large files).
• Mbstring:
  • Fixed bug #79787 (mb_strimwidth does not trim string).
• Phar:
  • Fixed bug #79797 (Use of freed hash key in the phar_parse_zipfile function). (CVE-2020-7068)
• Standard:
  • Fixed bug #70362 (Can't copy() large 'data://' with open_basedir).
  • Fixed bug #79817 (str_replace() does not handle INDIRECT elements).
  • Fixed bug #78008 (dns_check_record() always return true on Alpine).

Version 7.3.20

• Core:
  • Fixed bug #79650 (php-win.exe 100% cpu lockup).
  • Fixed bug #79668 (get_defined_functions(true) may miss functions).
  • Fixed possibly unsupported timercmp() usage.
• Exif:
  • Fixed bug #79687 (Sony picture - PHP Warning - Make, Model, MakerNotes).
• Filter:
  • Fixed bug #73527 (Invalid memory access in php_filter_strip).
• GD:
  • Fixed bug #79676 (imagescale adds black border with IMG_BICUBIC).
• OpenSSL:
  • Fixed bug #62890 (default_socket_timeout=-1 causes connection to timeout).
• PDO SQLite:
  • Fixed bug #79664 (PDOStatement::getColumnMeta fails on empty result set).
• SPL:
  • Fixed bug #79710 (Reproducible segfault in error_handler during GC involved an SplFileObject).
• Standard:
  • Fixed bug #74267 (segfault with streams and invalid data).

Version 7.3.19

• Core:
  • Fixed bug #79566 (Private SHM is not private on Windows).
  • Fixed bug #79489 (.user.ini does not inherit).
• GD:
  • Fixed bug #79615 (Wrong GIF header written in GD GIFEncode).
• MySQLnd:
  • Fixed bug #79596 (MySQL FLOAT truncates to int some locales).
• Opcache:
  • Fixed bug #79535 (PHP crashes with specific opcache.optimization_level).
  • Fixed bug #79588 (Boolean opcache settings ignore on/off values).
• Standard:
  • Fixed bug #79561 (dns_get_record() fails with DNS_ALL).

Version 7.3.18

• Core:
  • Fixed bug #78875 (Long filenames cause OOM and temp files are not cleaned). (CVE-2019-11048)
  • Fixed bug #78876 (Long variables in multipart/form-data cause OOM and temp files are not cleaned). (CVE-2019-11048)
  • Fixed bug #79434 (PHP 7.3 and PHP-7.4 crash with NULL-pointer dereference on !CS constant).
  • Fixed bug #79477 (casting object into array creates references).
  • Fixed bug #79470 (PHP incompatible with 3rd party file system on demand).
  • Fixed bug #78784 (Unable to interact with files inside a VFS for Git repository).
• DOM:
  • Fixed bug #78221 (DOMNode::normalize() doesn't remove empty text nodes).
• FCGI:
  • Fixed bug #79491 (Search for .user.ini extends up to root dir).
• MBString:
  • Fixed bug #79441 (Segfault in mb_chr() if internal encoding is unsupported).
• OpenSSL:
  • Fixed bug #79497 (stream_socket_client() throws an unknown error sometimes with <1s timeout).
• Phar:
  • Fixed bug #79503 (Memory leak on duplicate metadata).
• SimpleXML:
  • Fixed bug #79528 (Different object of the same xml between 7.4.5 and 7.4.4).
• Standard:
  • Fixed bug #79468 (SIGSEGV when closing stream handle with a stream filter appended).

Version 7.3.17

• Core:
  • Fixed bug #79364 (When copy empty array, next key is unspecified).
  • Fixed bug #78210 (Invalid pointer address).
• CURL:
  • Fixed bug #79199 (curl_copy_handle() memory leak).
• Date:
  • Fixed bug #79396 (DateTime hour incorrect during DST jump forward).
• Iconv:
  • Fixed bug #79200 (Some iconv functions cut Windows-1258).
• OPcache:
  • Fixed bug #79412 (Opcache chokes and uses 100% CPU on specific script).
• Session:
  • Fixed bug #79413 (session_create_id() fails for active sessions).
• Shmop:
  • Fixed bug #79427 (Integer Overflow in shmop_open()).
• SimpleXML:
  • Fixed bug #61597 (SXE properties may lack attributes and content).
• Spl:
  • Fixed bug #75673 (SplStack::unserialize() behavior).
  • Fixed bug #79393 (Null coalescing operator failing with SplFixedArray).
• Standard:
  • Fixed bug #79330 (shell_exec() silently truncates after a null byte).
  • Fixed bug #79465 (OOB Read in urldecode()). (CVE-2020-7067)
  • Fixed bug #79410 (system() swallows last chunk if it is exactly 4095 bytes without newline).
• Zip:
  • Fixed bug #79296 (ZipArchive::open fails on empty file).
  • Fixed bug #79424 (php_zip_glob uses gl_pathc after call to globfree).

Version 7.3.16

• Core:
  • Fixed bug #63206 (restore_error_handler does not restore previous errors mask).
• COM:
  • Fixed bug #66322 (COMPersistHelper::SaveToFile can save to wrong location).
  • Fixed bug #79242 (COM error constants don't match com_exception codes on x86).
  • Fixed bug #79248 (Traversing empty VT_ARRAY throws com_exception).
  • Fixed bug #79299 (com_print_typeinfo prints duplicate variables).
  • Fixed bug #79332 (php_istreams are never freed).
  • Fixed bug #79333 (com_print_typeinfo() leaks memory).
• DOM:
  • Fixed bug #77569: (Write Access Violation in DomImplementation).
  • Fixed bug #79271 (DOMDocumentType::$childNodes is NULL).
• Enchant:
  • Fixed bug #79311 (enchant_dict_suggest() fails on big endian architecture).
• EXIF:
  • Fixed bug #79282 (Use-of-uninitialized-value in exif). (CVE-2020-7064)
• MBstring:
  • Fixed bug #79371 (mb_strtolower (UTF-32LE): stack-buffer-overflow at php_unicode_tolower_full). (CVE-2020-7065)
• MySQLi:
  • Fixed bug #64032 (mysqli reports different client_version).
• PCRE:
  • Fixed bug #79188 (Memory corruption in preg_replace/preg_replace_callback and unicode).
• PDO_ODBC:
  • Fixed bug #79038 (PDOStatement::nextRowset() leaks column values).
• Reflection:
  • Fixed bug #79062 (Property with heredoc default value returns false for getDocComment).
• SQLite3:
  • Fixed bug #79294 (::columnType() may fail after SQLite3Stmt::reset()).
• Standard:
  • Fixed bug #79329 (get_headers() silently truncates after a null byte). (CVE-2020-7066)
  • Fixed bug #79254 (getenv() w/o arguments not showing changes).
  • Fixed bug #79265 (Improper injection of Host header when using fopen for http requests).

Version 7.3.15

• Core:
  • Fixed bug #71876 (Memory corruption htmlspecialchars(): charset `*' not supported).
  • Fixed bug #79146 (cscript can fail to run on some systems).
  • Fixed bug #78323 (Code 0 is returned on invalid options).
  • Fixed bug #76047 (Use-after-free when accessing already destructed backtrace arguments).
• CURL:
  • Fixed bug #79078 (Hypothetical use-after-free in curl_multi_add_handle()).
• Intl:
  • Fixed bug #79212 (NumberFormatter::format() may detect wrong type).
• Libxml:
  • Fixed bug #79191 (Error in SoapClient ctor disables DOMDocument::save()).
• MBString:
  • Fixed bug #79154 (mb_convert_encoding() can modify $from_encoding).
• MySQLnd:
  • Fixed bug #79084 (mysqlnd may fetch wrong column indexes with MYSQLI_BOTH).
• OpenSSL:
  • Fixed bug #79145 (openssl memory leak).
• Phar:
  • Fixed bug #79082 (Files added to tar with Phar::buildFromIterator have all-access permissions). (CVE-2020-7063)
  • Fixed bug #79171 (heap-buffer-overflow in phar_extract_file). (CVE-2020-7061)
  • Fixed bug #76584 (PharFileInfo::decompress not working).
• Reflection:
  • Fixed bug #79115 (ReflectionClass::isCloneable call reflected class __destruct).
• Session:
  • Fixed bug #79221 (Null Pointer Dereference in PHP Session Upload Progress). (CVE-2020-7062)
• SPL:
  • Fixed bug #79151 (heap use after free caused by spl_dllist_it_helper_move_forward).
• Standard:
  • Fixed bug #78902 (Memory leak when using stream_filter_append).
• Testing:
  • Fixed bug #78090 (bug45161.phpt takes forever to finish).
• XSL:
  • Fixed bug #70078 (XSL callbacks with nodes as parameter leak memory).

Version 7.3.14

• Core:
  • Fixed bug #78999 (Cycle leak when using function result as temporary).
• CURL:
  • Fixed bug #79033 (Curl timeout error with specific url and post).
• Date:
  • Fixed bug #79015 (undefined-behavior in php_date.c).
• DBA:
  • Fixed bug #78808 ([LMDB] MDB_MAP_FULL: Environment mapsize limit reached).
• Fileinfo:
  • Fixed bug #74170 (locale information change after mime_content_type).
• GD:
  • Fixed bug #78923 (Artifacts when convoluting image with transparency).
  • Fixed bug #79067 (gdTransformAffineCopy() may use unitialized values).
  • Fixed bug #79068 (gdTransformAffineCopy() changes interpolation method).
• Libxml:
  • Fixed bug #79029 (Use After Free's in XMLReader / XMLWriter).
• Mbstring:
  • Fixed bug #79037 (global buffer-overflow in `mbfl_filt_conv_big5_wchar`). (CVE-2020-7060)
• OPcache:
  • Fixed bug #79040 (Warning Opcode handlers are unusable due to ASLR).
• Pcntl:
  • Fixed bug #78402 (Converting null to string in error message is bad DX).
• PDO_PgSQL:
  • Fixed bug #78983 (pdo_pgsql config.w32 cannot find libpq-fe.h).
  • Fixed bug #78980 (pgsqlGetNotify() overlooks dead connection).
  • Fixed bug #78982 (pdo_pgsql returns dead persistent connection).
• Session:
  • Fixed bug #79091 (heap use-after-free in session_create_id()).
• Shmop:
  • Fixed bug #78538 (shmop memory leak).
• Standard:
  • Fixed bug #79099 (OOB read in php_strip_tags_ex). (CVE-2020-7059)
  • Fixed bug #54298 (Using empty additional_headers adding extraneous CRLF).

Version 7.3.13