Merge branch 'PHP-8.2' into PHP-8.3

* PHP-8.2:
  ext/soap: make GHSA-cj93-vc83-wgqv test lean and reliable
  Add NEWS entries
  ext/standard: Fix 1-char relative Location redirects after GH-23467
  [http] Fix out-of-bounds read on empty Location header
  Fix GHSA-ch8v-r6jh-4vvr: encode 0xFF in FILTER_SANITIZE_ENCODED
  Fix GHSA-9f67-6fw4-hpfp
  Fix GHSA-j3wh-g957-2m85: phar tar entry injection
  Fix GHSA-cj93-vc83-wgqv
  Fix GHSA-rgrp-mwpx-f6rm: unbounded recursion in ext/soap XML parsing and decoding
  Fix GHSA-fpwc-w8rq-cr92: strip credentials from user headers on cross-origin redirects
  Fix GHSA-r6x9-5r99-36j7: Various packet overreads in mysqlnd wireprotocol
  Fix GHSA-xr7j-rvgx-xq5p: OOB read in php_openssl_matches_wildcard_name()
  Fix GHSA-vvx9-73fr-5jjx: do not fall back to CN if the cert has a service ID
  Fix GHSA-62xp-839h-2637: FastCGI allowed_clients compared only 96 bits of IPv6 addresses
  Fix heap-buffer-overflow in convert stream filters with NUL in line-break-chars

Author: bukka

NEWS

@@ -2,6 +2,48 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 8.3.34
 
+- Filter:
+  . Fixed GHSA-ch8v-r6jh-4vvr (FILTER_SANITIZE_ENCODED does not encode 0xFF).
+    (Ilia Alshanetsky)
+
+- FPM:
+  . Fixed GHSA-62xp-839h-2637 (IPv6 ACL bypass in FastCGI listen.allowed_clients
+    due to partial address comparison). (CVE-2026-91768) (Alexandre Daubois)
+
+- MySQLnd:
+  . Fixed GHSA-r6x9-5r99-36j7 (Various packet overreads in mysqlnd wire
+    protocol). (CVE-2025-1218) (Jakub Zelenka, Nora Dossche)
+
+- OpenSSL:
+  . Fixed GHSA-vvx9-73fr-5jjx (TLS hostname verification falls back to CN after
+    SAN mismatch). (CVE-2026-91769) (Jakub Zelenka)
+  . Fixed GHSA-xr7j-rvgx-xq5p (Heap buffer overflow in
+    php_openssl_matches_wildcard_name() on crafted server certificate wildcard
+    CN). (CVE-2026-91767) (Jakub Zelenka)
+
+- Phar:
+  . Fixed GHSA-j3wh-g957-2m85 (Integer overflow in phar_tar_number() allowing
+    TAR archive entry injection). (CVE-2026-6103) (Jakub Zelenka)
+
+- SOAP:
+  . Fixed GHSA-rgrp-mwpx-f6rm (Unbounded recursion in server-side
+    cleanup_xml_node()). (CVE-2026-91765) (Alexandre Daubois)
+  . Fixed GHSA-cj93-vc83-wgqv (Integer overflow to buffer overflow in SOAP HTTP
+    parsing). (CVE-2025-14181) (Nora Dossche, Jakub Zelenka)
+
+- Standard:
+  . Fixed GHSA-88hq-2827-7pg6 (Out-of-bounds read in convert.* stream filters
+    when line-break-chars contains NUL). (CVE-2026-92842) (geeknik)
+  . Fixed GHSA-fpwc-w8rq-cr92 (Cross-origin credential leak in HTTP stream
+    wrapper redirects). (CVE-2026-91766) (Alexandre Daubois, Jakub Zelenka)
+  . Fixed GHSA-7875-c8px-7q5f (Out-of-bounds read in the HTTP stream wrapper
+    when following a redirect with an empty Location header). (CVE-2026-93682)
+    (Ilia Alshanetsky, Jordi Kroon)
+
+- Windows:
+  . Fixed GHSA-9f67-6fw4-hpfp (Reserved device names are not rejected before
+    file and stream I/O). (CVE-2026-17545) (Shivam Mathur, Jakub Zelenka)
+
 
 30 Jul 2026, PHP 8.3.33
 

Zend/zend_virtual_cwd.c

@@ -1030,6 +1030,19 @@ CWD_API int virtual_file_ex(cwd_state *state, const char *path, verify_path_func
 	fprintf(stderr,"cwd = %s path = %s\n", state->cwd, path);
 #endif
 
+#ifdef ZEND_WIN32
+	switch (php_win32_ioutil_path_kind_a(path, path_length)) {
+		case PHP_WIN32_IOUTIL_PATH_RESERVED:
+			SET_ERRNO_FROM_WIN32_CODE(ERROR_INVALID_NAME);
+			return 1;
+		case PHP_WIN32_IOUTIL_PATH_DEVICE:
+			memcpy(resolved_path, path, path_length + 1);
+			goto verify;
+		default:
+			break;
+	}
+#endif
+
 	/* cwd_length can be 0 when getcwd() fails.
 	 * This can happen under solaris when a dir does not have read permissions
 	 * but *does* have execute permissions */

ext/filter/sanitizing_filters.c

@@ -66,7 +66,7 @@ static void php_filter_encode_url(zval *value, const unsigned char* chars, const
 	unsigned char *e = s + char_len;
 	zend_string *str;
 
-	memset(tmp, 1, sizeof(tmp)-1);
+	memset(tmp, 1, sizeof(tmp));
 
 	while (s < e) {
 		tmp[*s++] = '\0';

ext/filter/tests/filter_sanitize_encoded_0xff.phpt

@@ -0,0 +1,12 @@
+--TEST--
+FILTER_SANITIZE_ENCODED percent-encodes 0xFF
+--EXTENSIONS--
+filter
+--FILE--
+<?php
+var_dump(filter_var("\xFF", FILTER_SANITIZE_ENCODED));
+var_dump(filter_var("\xFE\xFF\x00A", FILTER_SANITIZE_ENCODED));
+?>
+--EXPECT--
+string(3) "%FF"
+string(10) "%FE%FF%00A"