Merge branch 'PHP-8.4' into PHP-8.5

* PHP-8.4:
  Skip bz2 GH-20807 test when less than 13 GiB of memory is available
  ext/soap: make GHSA-cj93-vc83-wgqv test lean and reliable
  Add NEWS entries
  ext/standard: Fix 1-char relative Location redirects after GH-23467
  [http] Fix out-of-bounds read on empty Location header
  Fix GHSA-ch8v-r6jh-4vvr: encode 0xFF in FILTER_SANITIZE_ENCODED
  Fix GHSA-9f67-6fw4-hpfp
  Fix GHSA-j3wh-g957-2m85: phar tar entry injection
  Fix GHSA-cj93-vc83-wgqv
  Fix GHSA-rgrp-mwpx-f6rm: unbounded recursion in ext/soap XML parsing and decoding
  Fix GHSA-fpwc-w8rq-cr92: strip credentials from user headers on cross-origin redirects
  Fix GHSA-r6x9-5r99-36j7: Various packet overreads in mysqlnd wireprotocol
  Fix GHSA-xr7j-rvgx-xq5p: OOB read in php_openssl_matches_wildcard_name()
  Fix GHSA-vvx9-73fr-5jjx: do not fall back to CN if the cert has a service ID
  Fix GHSA-62xp-839h-2637: FastCGI allowed_clients compared only 96 bits of IPv6 addresses
  Fix heap-buffer-overflow in convert stream filters with NUL in line-break-chars

# Conflicts:
#	NEWS
#	ext/phar/tar.c
#	ext/soap/php_http.c
#	ext/soap/php_xml.c
#	ext/standard/http_fopen_wrapper.c
#	win32/ioutil.c

Author: bukka

NEWS

@@ -119,6 +119,8 @@ PHP                                                                        NEWS
 
 - FPM:
   . Fixed bug GH-19320 (FPM UID and GID overflow). (Pratik Bhujel)
+  . Fixed GHSA-62xp-839h-2637 (IPv6 ACL bypass in FastCGI listen.allowed_clients
+    due to partial address comparison). (CVE-2026-91768) (Alexandre Daubois)
 
 - Intl:
   . Fixed grapheme_strpos() and grapheme_strrpos() with an empty needle
@@ -143,6 +145,10 @@ PHP                                                                        NEWS
     replacement when a \k<name> backref has no closing delimiter.
     (Ilia Alshanetsky)
 
+- MySQLnd:
+  . Fixed GHSA-r6x9-5r99-36j7 (Various packet overreads in mysqlnd wire
+    protocol). (CVE-2025-1218) (Jakub Zelenka, Nora Dossche)
+
 - ODBC:
   . Fixed odbc_field_len(), odbc_field_scale() and odbc_field_type()
     returning uninitialized memory when SQLColAttribute fails.
@@ -156,6 +162,13 @@ PHP                                                                        NEWS
   . Fixed a crash when the huge page SHM remap discarded mappings outside the
     reserved address range. (Piotr Hałas)
 
+- OpenSSL:
+  . Fixed GHSA-vvx9-73fr-5jjx (TLS hostname verification falls back to CN after
+    SAN mismatch). (CVE-2026-91769) (Jakub Zelenka)
+  . Fixed GHSA-xr7j-rvgx-xq5p (Heap buffer overflow in
+    php_openssl_matches_wildcard_name() on crafted server certificate wildcard
+    CN). (CVE-2026-91767) (Jakub Zelenka)
+
 - PDO:
   . Fixed a leak when a persistent connection failed a liveness check
     with no other live PDO handle. (iliaal)
@@ -173,6 +186,8 @@ PHP                                                                        NEWS
     (Weilin Du)
   . Fixed bug GH-23477 (Memory leak on duplicate native Phar manifest entries).
     (Weilin Du)
+  . Fixed GHSA-j3wh-g957-2m85 (Integer overflow in phar_tar_number() allowing
+    TAR archive entry injection). (CVE-2026-6103) (Jakub Zelenka)
 
 - Readline:
   . Fixed the interactive shell not waiting for the pager process to exit.
@@ -183,19 +198,28 @@ PHP                                                                        NEWS
     (Ilia Alshanetsky)
   . Fixed stack overflow when parsing a WSDL with self-referential schema
     groups or attributeGroups. (Ilia Alshanetsky)
+  . Fixed GHSA-rgrp-mwpx-f6rm (Unbounded recursion in server-side
+    cleanup_xml_node()). (CVE-2026-91765) (Alexandre Daubois)
+  . Fixed GHSA-cj93-vc83-wgqv (Integer overflow to buffer overflow in SOAP HTTP
+    parsing). (CVE-2025-14181) (Nora Dossche, Jakub Zelenka)
 
 - Standard:
   . Fixed a segfault when a stream filter callback unsets StreamBucket::$data
     before re-attaching the bucket. (iliaal)
-  . Fixed an out-of-bounds read when following a redirect response with an
-    empty Location header. (iliaal)
+  . Fixed GHSA-7875-c8px-7q5f (Out-of-bounds read in the HTTP stream wrapper
+    when following a redirect with an empty Location header). (CVE-2026-93682)
+    (Ilia Alshanetsky, Jordi Kroon)
   . Fixed read buffer compaction in php_stream_filter_flush(). (crystarm)
   . Fixed bug GH-22410 (Incorrect float behavior with large numbers).
     (arshidkv12)
   . Fixed GH-23338 (fsockopen()/pfsockopen() ValueError reported wrong
     argument number for $timeout). (lacatoire)
   . Fixed bug GH-23576 (Next index for array returned from array_keys() is
     wrong). (Lazizbek Ergashev)
+  . Fixed GHSA-88hq-2827-7pg6 (Out-of-bounds read in convert.* stream filters
+    when line-break-chars contains NUL). (CVE-2026-92842) (geeknik)
+  . Fixed GHSA-fpwc-w8rq-cr92 (Cross-origin credential leak in HTTP stream
+    wrapper redirects). (CVE-2026-91766) (Alexandre Daubois)
 
 - SimpleXML:
   . Fixed writing to a dimension of the object returned by attributes() not
@@ -204,6 +228,10 @@ PHP                                                                        NEWS
     SimpleXMLElement::addChild() not being accessible by property name when
     namespaces are involved. (Ilia Alshanetsky)
 
+- Windows:
+  . Fixed GHSA-9f67-6fw4-hpfp (Reserved device names are not rejected before
+    file and stream I/O). (CVE-2026-17545) (Shivam Mathur, Jakub Zelenka)
+
 - Zip:
   . Fixed bug GH-17787 (ZipArchive stream stops reading early when the archive
     is freed while the stream is still open). (Eyüp Can Akman)

Zend/zend_virtual_cwd.c

@@ -1028,6 +1028,19 @@ CWD_API int virtual_file_ex(cwd_state *state, const char *path, verify_path_func
 	fprintf(stderr,"cwd = %s path = %s\n", state->cwd, path);
 #endif
 
+#ifdef ZEND_WIN32
+	switch (php_win32_ioutil_path_kind_a(path, path_length)) {
+		case PHP_WIN32_IOUTIL_PATH_RESERVED:
+			SET_ERRNO_FROM_WIN32_CODE(ERROR_INVALID_NAME);
+			return 1;
+		case PHP_WIN32_IOUTIL_PATH_DEVICE:
+			memcpy(resolved_path, path, path_length + 1);
+			goto verify;
+		default:
+			break;
+	}
+#endif
+
 	/* cwd_length can be 0 when getcwd() fails.
 	 * This can happen under solaris when a dir does not have read permissions
 	 * but *does* have execute permissions */

ext/bz2/tests/gh20807.phpt

@@ -12,6 +12,12 @@ if (PHP_OS === 'FreeBSD') die('skip Worker does not handle OOM gracefully');
 if (PHP_OS_FAMILY === 'Darwin') die('skip Too slow');
 if (PHP_INT_SIZE !== 8) die('skip Only for 64-bit systems');
 if (getenv('SKIP_ASAN')) die('skip ASAN makes this test too slow');
+// The decompressed output needs more than 12 GiB of memory at its peak, which
+// takes down smaller machines (e.g. 7 GB CI runners) with the OOM killer.
+$memInfo = @file_get_contents('/proc/meminfo');
+if ($memInfo && preg_match('/MemAvailable:\s+(\d+) kB/', $memInfo, $m) && $m[1] < 13 * 1024 * 1024) {
+    die('skip Insufficient available memory (less than 13 GiB)');
+}
 ?>
 --FILE--
 <?php