Commit ca0030ba189 for php

commit ca0030ba189c7b60f4d36c52e1f2afa91541ad48
Merge: 3678f391d8f 018b0a8d4d5
Author: ndossche <7771979+ndossche@users.noreply.github.com>
Date:   Mon Oct 26 18:44:01 2026 +0100

    Merge branch 'PHP-8.5' into PHP-8.6

    * PHP-8.5:
      Fix GH-24438: Preserve indirect types in JIT side traces
      Fix GH-17733: System entropy does not take into account function order, resulting in wrong functions possibly called in different configurations

diff --cc NEWS
index 355ea8880a6,9f3932c7565..2fb4c542850
--- a/NEWS
+++ b/NEWS
@@@ -1,81 -1,8 +1,85 @@@
  PHP                                                                        NEWS
  |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 -?? ??? ????, PHP 8.5.13
 +?? ??? ????, PHP 8.6.0RC5

  - Core:
 +  . Fix function and constant imports in compile_to_ast and add support
 +    for grouping. (Klaas Skelte van der Werf)
 +  . Fixed unmapping of an unrelated range when the aligned chunk mmap fails
 +    (Marti2203).
 +
 +- DBA:
 +  . Fixed bug GH-24641 (ndbm backend never checks dbm_open() return value,
 +    NULL deref on first use after a failed open). (Girgias)
 +
 +- DOM:
 +  . Fix error paths in dom_xml_serializing_a_document_node(). (ndossche)
 +
 +- Hash:
 +  . Fix GOST and Snefru digests of 512 MiB or more. (Martin Mirchev)
 +
 +- Opcache:
 +  . Fixed tracing JIT returning a wrapped integer instead of a float on
 +    integer overflow after an integer was compared with a float or
 +    numeric-string literal. (Ilia Alshanetsky)
 +  . Fixed use-after-free in JIT ASSIGN_DIM_OP when concatenating into an
 +    empty array element. (jorgsowa)
 +  . Fixed bug GH-24396 (Assertion failure in zend_jit_def_reg() "reg forwarding"
 +    with chained Pi nodes). (ndossche)
 +  . Fixed JIT treating an array as packed after a string key write turned it
 +    into a hash. (jorgsowa)
 +  . Fixed bug GH-24436 (Tracing JIT: keep the SEND_VAL type guard after
 +    assigning to a reference). (waroad)
 +  . Fixed bug GH-24745 (File cache loses attributes on constants on 32-bit
 +    builds). (Yannick Decat, Lazizbek Ergashev)
++  . Fixed bug GH-17733 (System entropy does not take into account function
++    order, resulting in wrong functions possibly called
++    in different configurations). (ndossche)
++  . Fixed bug GH-24438 (Preserve indirect types in JIT side traces). (aasul)
 +
 +- OpenSSL:
 +  . Fixed build with OpenSSL 4.1. (Weilin Du)
 +
 +- PDO_PGSQL:
 +  . Fixed bug GH-24461 (DISCARD ALL on persistent connection cleanup drops
 +    PgBouncer's prepared statements). (David Carlier, Artem Ukrainskiy)
 +
 +- SAPI:
 +  . Fixed infinite loop in sapi_header_op() for headers of 4 GiB or more.
 +    (Martin Mirchev)
 +
 +- SPL:
 +  . Fixed bug GH-24264 (Unwind/GracefulExit discarded in spl_iterators.c).
 +    (Lazizbek Ergashev)
 +
 +- Standard:
 +  . Fixed bug GH-24308 (Request shutdown calls closelog() even when syslog
 +    was not opened by PHP). (lazerg)
 +
 +- Streams:
 +  . Fixed bug GH-24506 (stream_select() leaks a stream-error operation level
 +    on its FD_SETSIZE failure path). (azjezz)
 +  . Fixed bug GH-24508 (HTTP wrapper leaks the dechunk filter when header
 +    parsing fails after Transfer-Encoding). (bercedev)
 +  . Fixed bug GH-24509 (HTTP wrapper leaks Location buffer on empty
 +    Location header). (bercedev)
 +
 +- Zip:
 +  . Reject broken libzip versions 1.3.1, 1.7.0 and 1.12.0 during Windows
 +    configuration. (Weilin Du)
 +  . Excluded libzip 1.12.0 due to a regression preventing additions and
 +    replacements in torrentzip archives. (Weilin Du)
 +
 +- Zlib:
 +  . Fixed bug GH-24533 (zlib.lib could not be found because zlib 1.3.2
 +    CMake build does not emit it). (Lazizbek Ergashev)
 +
 +21 Oct 2026, PHP 8.6.0RC4
 +
 +- Core:
 +  . Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via
 +    bailout). (CVE-2026-109618, CVE-2026-109619) (Arnaud, ilutov, Jakub Zelenka,
 +    ndossche, Nicolas Grekas)
    . Fixed bug GH-24184 (System ID not being reinitialized after an Apache
      graceful restart, potentially causing incompatible OPcache file cache
      entries to be reused). (Levi Morrison)
diff --cc Zend/zend_system_id.c
index 3e5077279b7,450d497f7c7..cdba4ea6fca
--- a/Zend/zend_system_id.c
+++ b/Zend/zend_system_id.c
@@@ -87,7 -90,22 +87,22 @@@ void zend_finalize_system_id(void
  		}
  	}

+ 	/* Cached scripts can refer to offsets of internal functions.
+ 	 * Effects of disable_functions and frameless functions must be taken into account.
+ 	 * Therefore, embed the function names in-order.
+ 	 * Updating third party extensions may change function signatures, arginfo, offsets, ...
+ 	 * Therefore, also embed the loaded modules and their versions. */
+ 	ZEND_HASH_MAP_FOREACH_STR_KEY(CG(function_table), zend_string *name) {
+ 		PHP_MD5Update(&context, ZSTR_VAL(name), ZSTR_LEN(name) + 1);
+ 	} ZEND_HASH_FOREACH_END();
+ 	ZEND_HASH_MAP_FOREACH_PTR(&module_registry, zend_module_entry *mod) {
+ 		PHP_MD5Update(&context, mod->name, strlen(mod->name) + 1);
+ 		if (EXPECTED(mod->version != NO_VERSION_YET)) {
+ 			PHP_MD5Update(&context, mod->version, strlen(mod->version) + 1);
+ 		}
+ 	} ZEND_HASH_FOREACH_END();
+
  	PHP_MD5Final(digest, &context);
 -	php_hash_bin2hex(zend_system_id, digest, sizeof digest);
 +	zend_bin2hex(zend_system_id, digest, sizeof digest);
  	finalized = 1;
  }