PHP 5 ChangeLog

Version 5.2.6

01-May-2008

Security Fixes
- Fixed possible stack buffer overflow in FastCGI SAPI. (Andrei Nigmatulin)
- Properly address incomplete multibyte chars inside escapeshellcmd() (Ilia, Stefan Esser)
- Fixed security issue detailed in CVE-2008-0599. (Rasmus)
- Fixed a safe_mode bypass in cURL identified by Maksymilian Arciemowicz. (Ilia)
- Upgraded PCRE to version 7.6 (Nuno)
Fixed two possible crashes inside posix extension (Tony)
Fixed incorrect heredoc handling when label is used within the block. (Matt)
Fixed sending of uninitialized paddings which may contain some information. (Andrei Nigmatulin)
Fixed a bug in formatting timestamps when DST is active in the default timezone (Derick)
Fix integer overflow in printf(). (Stas, Maksymilian Aciemowicz)
Fixed potential memleak in stream filter parameter for zlib filter. (Greg)
Added Reflection API metadata for the methods of the DOM classes. (Sebastian)
Fixed weird behavior in CGI parameter parsing. (Dmitry, Hannes Magnusson)
Fixed a bug with PDO::FETCH_COLUMN|PDO::FETCH_GROUP mode when a column # by which to group by data is specified. (Ilia)
Fixed segfault in filter extension when using callbacks. (Arnar Mar Sig, Felipe)
Fixed faulty fix for bug Fixed bug #40189 (endless loop in zlib.inflate stream filter). (Greg)
Fixed bug #44742 (timezone_offset_get() causes segmentation faults). (Derick)
Fixed bug #44720 (Prevent crash within session_register()). (Scott)
Fixed bug #44703 (htmlspecialchars() does not detect bad character set argument). (Andy Wharmby)
Fixed bug #44673 (With CGI argv/argc starts from arguments, not from script) (Dmitry)
Fixed bug #44667 (proc_open() does not handle pipes with the mode 'wb' correctly). (Jani)
Fixed bug #44663 (Crash in imap_mail_compose if "body" parameter invalid). (Ilia)
Fixed bug #44650 (escapeshellscmd() does not check arg count). (Ilia)
Fixed bug #44613 (Crash inside imap_headerinfo()). (Ilia, jmessa)
Fixed bug #44603 (Order issues with Content-Type/Length headers on POST). (Ilia)
Fixed bug #44594 (imap_open() does not validate # of retries parameter). (Ilia)
Fixed bug #44591 (imagegif's filename parameter). (Felipe)
Fixed bug #44557 (Crash in imap_setacl when supplied integer as username) (Thomas Jarosch)
Fixed bug #44487 (call_user_method_array issues a warning when throwing an exception). (David Soria Parra)
Fixed bug #44478 (Inconsistent behaviour when assigning new nodes). (Rob, Felipe)
Fixed bug #44445 (email validator does not handle domains starting/ending with a -). (Ilia)
Fixed bug #44440 (st_blocks undefined under BeOS). (Felipe)
Fixed bug #44394 (Last two bytes missing from output). (Felipe)
Fixed bug #44388 (Crash inside exif_read_data() on invalid images) (Ilia)
Fixed bug #44373 (PDO_OCI extension compile failed). (Felipe)
Fixed bug #44333 (SEGFAULT when using mysql_pconnect() with client_flags). (Felipe)
Fixed bug #44306 (Better detection of MIPS processors on Windows). (Ilia)
Fixed bug #44242 (metaphone('CMXFXM') crashes PHP). (Felipe)
Fixed bug #44233 (MSG_PEEK undefined under BeOS R5). (jonathonfreeman at gmail dot com, Ilia)
Fixed bug #44216 (strftime segfaults on large negative value). (Derick)
Fixed bug #44209 (strtotime() doesn't support 64 bit timestamps on 64 bit platforms). (Derick)
Fixed bug #44206 (OCI8 selecting ref cursors leads to ORA-1000 maximum open cursors reached). (Oracle Corp.)
Fixed bug #44200 (A crash in PDO when no bound targets exists and yet bound parameters are present). (Ilia)
Fixed bug #44197 (socket array keys lost on socket_select). (Felipe)
Fixed bug #44191 (preg_grep messes up array index). (Felipe)
Fixed bug #44189 (PDO setAttribute() does not properly validate values for native numeric options). (Ilia)
Fixed bug #44184 (Double free of loop-variable on exception). (Dmitry)
Fixed bug #44171 (Invalid FETCH_COLUMN index does not raise an error). (Ilia)
Fixed bug #44166 (Parameter handling flaw in PDO::getAvailableDrivers()). (Ilia)
Fixed bug #44159 (Crash: $pdo->setAttribute(PDO::STATEMENT_ATTR_CLASS, NULL)). (Felipe)
Fixed bug #44152 (Possible crash with syslog logging on ZTS builds). (Ilia)
Fixed bug #44141 (private parent constructor callable through static function). (Dmitry)
Fixed bug #44113 (OCI8 new collection creation can fail with OCI-22303). (Oracle Corp.)
Fixed bug #44069 (Huge memory usage with concatenation using . instead of .=). (Dmitry)
Fixed bug #44046 (crash inside array_slice() function with an invalid by-ref offset). (Ilia)
Fixed bug #44028 (crash inside stream_socket_enable_crypto() when enabling encryption without crypto type). (Ilia)
Fixed bug #44018 (RecursiveDirectoryIterator options inconsistancy). (Marcus)
Fixed bug #44008 (OCI8 incorrect usage of OCI-Lob->close crashes PHP). (Oracle Corp.)
Fixed bug #43998 (Two error messages returned for incorrect encoding for mb_strto[upper|lower]). (Rui)
Fixed bug #43994 (mb_ereg 'successfully' matching incorrect). (Rui)
Fixed bug #43954 (Memory leak when sending the same HTTP status code multiple times). (Scott)
Fixed bug #43927 (koi8r is missing from html_entity_decode()). (andy at demos dot su, Tony)
Fixed bug #43912 (Interbase column names are truncated to 31 characters). (Ilia)
Fixed bug #43875 (Two error messages returned for $new and $flag argument in mysql_connect()). (Hannes)
Fixed bug #43863 (str_word_count() breaks on cyrillic "ya" in locale cp1251). (phprus at gmail dot com, Tony)
Fixed bug #43841 (mb_strrpos offset is byte count for negative values). (Rui)
Fixed bug #43840 (mb_strpos bounds check is byte count rather than a character count). (Rui)
Fixed bug #43808 (date_create never fails (even when it should)). (Derick)
Fixed bug #43793 (zlib filter is unable to auto-detect gzip/zlib file headers). (Greg)
Fixed bug #43703 (Signature compatibility check broken). (Dmitry)
Fixed bug #43677 (Inconsistent behaviour of include_path set with php_value). (manuel at mausz dot at)
Fixed bug #43663 (Extending PDO class with a __call() function doesn't work). (David Soria Parra)
Fixed bug #43647 (Make FindFile use PATH_SEPARATOR instead of ";"). (Ilia)
Fixed bug #43635 (mysql extension ingores INI settings on NULL values passed to mysql_connect()). (Ilia)
Fixed bug #43620 (Workaround for a bug inside libcurl 7.16.2 that can result in a crash). (Ilia)
Fixed bug #43614 (incorrect processing of numerical string keys of array in arbitrary serialized data). (Dmitriy Buldakov, Felipe)
Fixed bug #43606 (define missing depencies of the exif extension). (crrodriguez at suse dot de)
Fixed bug #43589 (a possible infinite loop in bz2_filter.c). (Greg)
Fixed bug #43580 (removed bogus declaration of a non-existent php_is_url() function). (Ilia)
Fixed bug #43559 (array_merge_recursive() doesn't behave as expected with duplicate NULL values). (Felipe, Tony)
Fixed bug #43533 (escapeshellarg('') returns null). (Ilia)
Fixed bug #43527 (DateTime created from a timestamp reports environment timezone). (Derick)
Fixed bug #43522 (stream_get_line() eats additional characters). (Felipe, Ilia, Tony)
Fixed bug #43507 (SOAPFault HTTP Status 500 - would like to be able to set the HTTP Status). (Dmitry)
Fixed bug #43505 (Assign by reference bug). (Dmitry)
Fixed bug #43498 (file_exists() on a proftpd server got SIZE not allowed in ASCII mode). (Ilia, crrodriguez at suse dot de)
Fixed bug #43497 (OCI8 XML/getClobVal aka temporary LOBs leak UGA memory). (Chris)
Fixed bug #43495 (array_merge_recursive() crashes with recursive arrays). (Ilia)
Fixed bug #43493 (pdo_pgsql does not send username on connect when password is not available). (Ilia)
Fixed bug #43491 (Under certain conditions, file_exists() never returns). (Dmitry)
Fixed bug #43483 (get_class_methods() does not list all visible methods). (Dmitry)
Fixed bug #43482 (array_pad() does not warn on very small pad numbers). (Ilia)
Fixed bug #43457 (Prepared statement with incorrect parms doesn't throw exception with pdo_pgsql driver). (Ilia)
Fixed bug #43450 (Memory leak on some functions with implicit object __toString() call). (David C.)
Fixed bug #43386 (array_globals not reset to 0 properly on init). (Ilia)
Fixed bug #43377 (PHP crashes with invalid argument for DateTimeZone). (Ilia)
Fixed bug #43373 (pcntl_fork() should not raise E_ERROR on error). (Ilia)
Fixed bug #43364 (recursive xincludes don't remove internal xml nodes properly). (Rob, patch from ddb@bitxtender.de)
Fixed bug #43301 (mb_ereg*_replace() crashes when replacement string is invalid PHP expression and 'e' option is used). (Jani)
Fixed bug #43295 (crash because of uninitialized SG(sapi_headers).mimetype). (Dmitry)
Fixed bug #43293 (Multiple segfaults in getopt()). (Hannes)
Fixed bug #43279 (pg_send_query_params() converts all elements in 'params' to strings). (Ilia)
Fixed bug #43276 (Incomplete fix for bug #42739, mkdir() under safe_mode). (Ilia)
Fixed bug #43248 (backward compatibility break in realpath()). (Dmitry)
Fixed bug #43221 (SimpleXML adding default namespace in addAttribute). (Rob)
Fixed bug #43216 (stream_is_local() returns false on "file://"). (Dmitry)
Fixed bug #43201 (Crash on using uninitialized vals and __get/__set). (Dmitry)
Fixed bug #43182 (file_put_contents() LOCK_EX does not work properly on file truncation). (Ilia)
Fixed bug #43175 (__destruct() throwing an exception with __call() causes segfault). (Dmitry)
Fixed bug #43128 (Very long class name causes segfault). (Dmitry)
Fixed bug #43105 (PHP seems to fail to close open files). (Hannes)
Fixed bug #43092 (curl_copy_handle() crashes with > 32 chars long URL). (Jani)
Fixed bug #43003 (Invalid timezone reported for DateTime objects constructed using a timestamp). (Derick)
Fixed bug #42978 (mismatch between number of bound params and values causes a crash in pdo_pgsql). (Ilia)
Fixed bug #42945 (preg_split() swallows part of the string). (Nuno)
Fixed bug #42937 (__call() method not invoked when methods are called on parent from child class). (Dmitry)
Fixed bug #42841 (REF CURSOR and oci_new_cursor() crash PHP). (Chris)
Fixed bug #42838 (Wrong results in array_diff_uassoc) (Felipe)
Fixed bug #42779 (Incorrect forcing from HTTP/1.0 request to HTTP/1.1 response). (Ilia)
Fixed bug #42736 (xmlrpc_server_call_method() crashes). (Tony)
Fixed bug #42692 (Procedure 'int1' not present with doc/lit SoapServer). (Dmitry)
Fixed bug #42548 (mysqli PROCEDURE calls can't return result sets). (Hartmut)
Fixed bug #42505 (new sendmail default breaks on Netware platform) (Guenter Knauf)
Fixed bug #42369 (Implicit conversion to string leaks memory). (David C., Rob).
Fixed bug #42272 (var_export() incorrectly escapes char(0)). (Derick)
Fixed bug #42261 (Incorrect lengths for date and boolean data types). (Ilia)
Fixed bug #42190 (Constructing DateTime with TimeZone Indicator invalidates DateTimeZone). (Derick)
Fixed bug #42177 (Warning "array_merge_recursive(): recursion detected" comes again...). (Felipe)
Fixed bug #41941 (oci8 extension not lib64 savvy). (Chris)
Fixed bug #41828 (Failing to call RecursiveIteratorIterator::__construct() causes a sefault). (Etienne)
Fixed bug #41599 (setTime() fails after modify() is used). (Derick)
Fixed bug #41562 (SimpleXML memory issue). (Rob)
Fixed bug #40013 (php_uname() does not return nodename on Netware (Guenter Knauf)
Fixed bug #38468 (Unexpected creation of cycle). (Dmitry)
Fixed bug #32979 (OpenSSL stream->fd casts broken in 64-bit build) (stotty at tvnet dot hu)

Version 5.2.5

08-November-2007

Security Fixes
- Fixed dl() to only accept filenames. reported by Laurent Gaffie.
- Fixed dl() to limit argument size to MAXPATHLEN (CVE-2007-4887).
- Fixed htmlentities/htmlspecialchars not to accept partial multibyte sequences.
- Fixed possible triggering of buffer overflows inside glibc implementations of the fnmatch(), setlocale() and glob() functions. Reported by Laurent Gaffie.
- Fixed "mail.force_extra_parameters" php.ini directive not to be modifiable in .htaccess due to the security implications reported by SecurityReason.
- Fixed bug #42869 (automatic session id insertion adds sessions id to non-local forms).
- Fixed bug #41561 (Values set with php_admin_* in httpd.conf can be overwritten with ini_set()).
Upgraded PCRE to version 7.3 (Nuno)
Added optional parameter $provide_object to debug_backtrace(). (Sebastian)
Added alpha support for imagefilter() IMG_FILTER_COLORIZE. (Pierre)
Added ability to control memory consumption between request using ZEND_MM_COMPACT environment variable. (Dmitry)
Improved speed of array_intersect_key(), array_intersect_assoc(), array_uintersect_assoc(), array_diff_key(), array_diff_assoc() and array_udiff_assoc(). (Dmitry)
Fixed move_uploaded_file() to always set file permissions of resulting file according to UMASK. (Andrew Sitnikov)
Fixed possible crash in ext/soap because of uninitialized value. (Zdash Urf)
Fixed regression in glob() when enforcing safe_mode/open_basedir checks on paths containing '*'. (Ilia)
Fixed PDO crash when driver returns empty LOB stream. (Stas)
Fixed iconv_*() functions to limit argument sizes as workaround to libc bug (CVE-2007-4783, CVE-2007-4840 by Laurent Gaffie). (Christian Hoffmann, Stas)
Fixed missing brackets leading to build warning and error in the log. Win32 code. (Andrey)
Fixed leaks with multiple connects on one mysqli object. (Andrey)
Fixed endianness detection on MacOS when building universal binary. (Uwe Schindler, Christian Speich, Tony)
Fixed imagerectangle regression with 1x1 rectangle (libgd #106). (Pierre)
Fixed bug #43196 (array_intersect_assoc() crashes with non-array input). (Jani)
Fixed bug #43139 (PDO ignores ATTR_DEFAULT_FETCH_MODE in some cases with fetchAll()). (Ilia)
Fixed bug #43137 (rmdir() and rename() do not clear statcache). (Jani)
Fixed bug #43130 (Bound parameters cannot have - in their name). (Ilia)
Fixed bug #43099 (XMLWriter::endElement() does not check # of params). (Ilia)
Fixed bug #43020 (Warning message is missing with shuffle() and more than one argument). (Scott)
Fixed bug #42976 (Crash when constructor for newInstance() or newInstanceArgs() fails) (Ilia)
Fixed bug #42943 (ext/mssql: Move *timeout initialization from RINIT to connect time). (Ilia)
Fixed bug #42917 (PDO::FETCH_KEY_PAIR doesn't work with setFetchMode). (Ilia)
Fixed bug #42890 (Constant "LIST" defined by mysqlclient and c-client). (Andrey)
Fixed bug #42818 ($foo = clone(array()); leaks memory). (Dmitry)
Fixed bug #42817 (clone() on a non-object does not result in a fatal error). (Ilia)
Fixed bug #42785 (json_encode() formats doubles according to locale rather then following standard syntax). (Ilia)
Fixed bug #42783 (pg_insert() does not accept an empty list for insertion). (Ilia)
Fixed bug #42773 (WSDL error causes HTTP 500 Response). (Dmitry)
Fixed bug #42772 (Storing $this in a static var fails while handling a cast to string). (Dmitry)
Fixed bug #42767 (highlight_string() truncates trailing comment). (Ilia)
Fixed bug #42739 (mkdir() doesn't like a trailing slash when safe_mode is enabled). (Ilia)
Fixed bug #42703 (Exception raised in an iterator::current() causes segfault in FilterIterator) (Marcus)
Fixed bug #42699 (PHP_SELF duplicates path). (Dmitry)
Fixed bug #42654 (RecursiveIteratorIterator modifies only part of leaves) (Marcus)
Fixed bug #42643 (CLI segfaults if using ATTR_PERSISTENT). (Ilia)
Fixed bug #42637 (SoapFault : Only http and https are allowed). (Bill Moran)
Fixed bug #42629 (Dynamically loaded PHP extensions need symbols exported on MacOSX). (jdolecek at NetBSD dot org)
Fixed bug #42627 (bz2 extension fails to build with -fno-common). (dolecek at netbsd dot org)
Fixed bug #42596 (session.save_path MODE option does not work). (Ilia)
Fixed bug #42590 (Make the engine recognize \v and \f escape sequences). (Ilia)
Fixed bug #42587 (behavior change regarding symlinked .php files). (Dmitry)
Fixed bug #42579 (apache_reset_timeout() does not exist). (Jani)
Fixed bug #42549 (ext/mysql failed to compile with libmysql 3.23). (Scott)
Fixed bug #42523 (PHP_SELF duplicates path). (Dmitry)
Fixed bug #42512 (ip2long('255.255.255.255') should return 4294967295 on 64-bit PHP). (Derick)
Fixed bug #42506 (php_pgsql_convert() timezone parse bug) (nonunnet at gmail dot com, Ilia)
Fixed bug #42462 (Segmentation when trying to set an attribute in a DOMElement). (Rob)
Fixed bug #42453 (CGI SAPI does not shut down cleanly with -i/-m/-v cmdline options). (Dmitry)
Fixed bug #42452 (PDO classes do not expose Reflection API information). (Hannes)
Fixed bug #42468 (Write lock on file_get_contents fails when using a compression stream). (Ilia)
Fixed bug #42488 (SoapServer reports an encoding error and the error itself breaks). (Dmitry)
Fixed bug #42378 (mysqli_stmt_bind_result memory exhaustion). (Andrey)
Fixed bug #42359 (xsd:list type not parsed). (Dmitry)
Fixed bug #42326 (SoapServer crash). (Dmitry)
Fixed bug #42214 (SoapServer sends clients internal PHP errors). (Dmitry)
Fixed bug #42189 (xmlrpc_set_type() crashes php on invalid datetime values). (Ilia)
Fixed bug #42139 (XMLReader option constants are broken using XML()). (Rob)
Fixed bug #42086 (SoapServer return Procedure '' not present for WSIBasic compliant wsdl). (Dmitry)
Fixed bug #41822 (Relative includes broken when getcwd() fails). (Ab5602, Jani)
Fixed bug #39651 (proc_open() append mode doesn't work on windows). (Nuno)

Version 5.2.4

30-August-2007

Security Fixes
- Fixed "Floating point exception" inside wordwrap(). (Mattias Bengtsson, Ilia)
- Fixed several integer overflows in ImageCreate(), ImageCreateTrueColor(), ImageCopyResampled() and ImageFilledPolygon() reported by Mattias Bengtsson. (Tony)
- Fixed size calculation in chunk_split(). (Stas)
- Fixed integer overflow in str[c]spn(). (Stas)
- Fixed money_format() not to accept multiple %i or %n tokens. (Stas, Ilia)
- Fixed zend_alter_ini_entry() memory_limit interruption vulnerability. (Ilia)
- Fixed INFILE LOCAL option handling with MySQL extensions not to be allowed when open_basedir or safe_mode is active. (Stas)
- Fixed session.save_path and error_log values to be checked against open_basedir and safe_mode (CVE-2007-3378) (Stas, Maksymilian Arciemowicz)
- Fixed possible invalid read in glob() win32 implementation (CVE-2007-3806). (Tony)
- Improved fix for MOPB-03-2007. (Ilia)
- Corrected fix for CVE-2007-2872. (Ilia)
Removed --enable-versioning configure option. (Jani)
Upgraded PCRE to version 7.2 (Nuno)
Updated timezone database to version 2007.6. (Derick)
Improved openssl_x509_parse() to return extensions in readable form. (Dmitry)
Enabled changing the size of statement cache for non-persistent OCI8 connections. (Chris Jones, Tony)
Changed display_errors php.ini option to accept stderr as value which makes the error messages to be outputted to STDERR instead of STDOUT with CGI and CLI SAPIs (#22839). (Jani)
Changed error handler to send HTTP 500 instead of blank page on PHP errors. (Dmitry, Andrei Nigmatulin)
Changed mail() function to be always available. (Johannes)
Added check for unknown options passed to configure. (Jani)
Added persistent connection status checker to pdo_pgsql. (Elvis Pranskevichus, Ilia)
Added support for ATTR_TIMEOUT inside pdo_pgsql driver. (Ilia)
Added php_ini_loaded_file() function which returns the path to the actual php.ini in use. (Jani)
Added GD version constants GD_MAJOR_VERSION, GD_MINOR_VERSION GD_RELEASE_VERSION, GD_EXTRA_VERSION and GD_VERSION_STRING. (Pierre)
Added missing open_basedir checks to CGI. (anight at eyelinkmedia dot com, Tony)
Added missing format validator to unpack() function. (Ilia)
Added missing error check inside bcpowmod(). (Ilia)
Added CURLOPT_PRIVATE & CURLINFO_PRIVATE constants. (Andrey A. Belashkov, Tony)
Added missing MSG_EOR and MSG_EOF constants to sockets extension. (Jani)
Added PCRE_VERSION constant. (Tony)
Added ReflectionExtension::info() function to print the phpinfo() block for an extension. (Johannes)
Implemented FR #41884 (ReflectionClass::getDefaultProperties() does not handle static attributes). (Tony)
Fixed possible crash in imagepsloadfont(), work around a bug in the pslib on Windows. (Pierre)
Fixed oci8 and PDO_OCI extensions to allow configuring with Oracle 11g client libraries. (Chris Jones)
Fixed EOF handling in case of reading from file opened in write only mode. (Dmitry)
Fixed var_export() to use the new H modifier so that it can generate parseable PHP code for floats, independent of the locale. (Derick)
Fixed regression introduced by the fix for the libgd bug #74. (Pierre)
Fixed SimpleXML's behavior when used with empty(). (Sara)
Fixed crash in OpenSSL extension because of non-string passphrase. (Dmitry)
Fixed PECL Bug #11345 (PDO_OCI crash after National language Support "NLS" environment initialization error). (Chris Jones)
Fixed PECL bug #11216 (crash in ZipArchive::addEmptyDir when a directory already exists). (Pierre)
Fixed bug #42368 (Incorrect error message displayed by pg_escape_string). (Ilia)
Fixed bug #42365 (glob() crashes and/or accepts way too many flags). (Jani)
Fixed bug #42364 (Crash when using getRealPath with DirectoryIterator). (Johannes)
Fixed bug #42292 ($PHP_CONFIG not set for phpized builds). (Jani)
Fixed bug #42261 (header wrong for date field). (roberto at spadim dot com dot br, Ilia)
Fixed bug #42259 (SimpleXMLIterator loses ancestry). (Rob)
Fixed bug #42247 (ldap_parse_result() not defined under win32). (Jani)
Fixed bug #42243 (copy() does not output an error when the first arg is a dir). (Ilia)
Fixed bug #42242 (sybase_connect() crashes). (Ilia)
Fixed bug #42237 (stream_copy_to_stream returns invalid values for mmaped streams). (andrew dot minerd at sellingsource dot com, Ilia)
Fixed bug #42233 (Problems with æøå in extract()). (Jani)
Fixed bug #42222 (possible buffer overflow in php_openssl_make_REQ). (Pierre)
Fixed bug #42211 (property_exists() fails to find protected properties from a parent class). (Dmitry)
Fixed bug #42208 (substr_replace() crashes when the same array is passed more than once). (crrodriguez at suse dot de, Ilia)
Fixed bug #42198 (SCRIPT_NAME and PHP_SELF truncated when inside a userdir and using PATH_INFO). (Dmitry)
Fixed bug #42195 (C++ compiler required always). (Jani)
Fixed bug #42183 (classmap causes crash in non-wsdl mode). (Dmitry)
Fixed bug #42173 (oci8 INTERVAL and TIMESTAMP type fixes). (Chris)
Fixed bug #42151 (__destruct functions not called after catching a SoapFault exception). (Dmitry)
Fixed bug #42142 (substr_replace() returns FALSE when length > string length). (Ilia)
Fixed bug #42135 (Second call of session_start() causes creation of SID). (Ilia)
Fixed bug #42134 (oci_error() returns false after oci_new_collection() fails). (Tony)
Fixed bug #42119 (array_push($arr,&$obj) doesn't work with zend.ze1_compatibility_mode On). (Dmitry)
Fixed bug #42117 (bzip2.compress loses data in internal buffer). (Philip, Ilia)
Fixed bug #42112 (deleting a node produces memory corruption). (Rob)
Fixed bug #42107 (sscanf broken when using %2$s format parameters). (Jani)
Fixed bug #42090 (json_decode causes segmentation fault). (Hannes)
Fixed bug #42082 (NodeList length zero should be empty). (Hannes)
Fixed bug #42072 (No warning message for clearstatcache() with arguments). (Ilia)
Fixed bug #42071 (ini scanner allows using NULL as option name). (Jani)
Fixed bug #42027 (is_file() / is_dir() matches file/dirnames with wildcard char or trailing slash in Windows). (Dmitry)
Fixed bug #42019 (configure option --with-adabas=DIR does not work). (Jani)
Fixed bug #42015 (ldap_rename(): server error "DSA is unwilling to perform"). (bob at mroczka dot com, Jani)
Fixed bug #42009 (is_a() and is_subclass_of() should NOT call autoload, in the same way as "instanceof" operator). (Dmitry)
Fixed bug #41989 (move_uploaded_file() & relative path in ZTS mode). (Tony)
Fixed bug #41984 (Hangs on large SoapClient requests). (Dmitry)
Fixed bug #41983 (Error Fetching http headers terminated by '\n'). (Dmitry)
Fixed bug #41973 (--with-ldap=shared fails with LDFLAGS="-Wl,--as-needed"). (Nuno)
Fixed bug #41971 (PDOStatement::fetch and PDOStatement::setFetchMode causes unexpected behavior). (Ilia)
Fixed bug #41964 (strtotime returns a timestamp for non-time string of pattern '(A|a) .+'). (Derick)
Fixed bug #41961 (Ensure search for hidden private methods does not stray from class hierarchy). (robin_fernandes at uk dot ibm dot com)
Fixed bug #41947 (SimpleXML incorrectly registers empty strings as namespaces). (Rob)
Fixed bug #41929 (Foreach on object does not iterate over all visible properties). (Dmitry)
Fixed bug #41919 (crash in string to array conversion). (judas dot iscariote at gmail dot com, Ilia)
Fixed bug #41909 (var_export() is locale sensitive when exporting float values). (Derick)
Fixed bug #41908 (CFLAGS="-Os" ./configure --enable-debug fails). (christian at hoffie dot info, Tony)
Fixed bug #41904 (proc_open(): empty env array should cause empty environment to be passed to process). (Jani)
Fixed bug #41867 (SimpleXML: getName is broken). (Rob)
Fixed bug #41865 (fputcsv(): 2nd parameter is not optional). (Jani)
Fixed bug #41861 (SimpleXML: getNamespaces() returns the namespaces of a node's siblings). (Rob)
Fixed bug #41845 (pgsql extension does not compile with PostgreSQL <7.4). (Ilia)
Fixed bug #41844 (Format returns incorrect number of digits for negative years -0001 to -0999). (Derick)
Fixed bug #41842 (Cannot create years < 0100 & negative years with date_create or new DateTime). (Derick)
Fixed bug #41833 (addChild() on a non-existent node, no node created, getName() segfaults). (Rob)
Fixed bug #41831 (pdo_sqlite prepared statements convert resources to strings). (Ilia)
Fixed bug #41815 (Concurrent read/write fails when EOF is reached). (Sascha)
Fixed bug #41813 (segmentation fault when using string offset as an object). (judas dot iscariote at gmail dot com, Tony)
Fixed bug #41795 (checkdnsrr does not support DNS_TXT type). (lucas at facebook dot com, Tony)
Fixed bug #41773 (php_strip_whitespace() sends headers with errors suppressed). (Tony)
Fixed bug #41770 (SSL: fatal protocol error due to buffer issues). (Ilia)
Fixed bug #41765 (Recode crashes/does not work on amd64). (nexus at smoula dot net, Stas)
Fixed bug #41724 (libxml_get_last_error() - errors service request scope). (thekid at php dot net, Ilia)
Fixed bug #41717 (imagepolygon does not respect thickness). (Pierre)
Fixed bug #41713 (Persistent memory consumption on win32 since 5.2). (Dmitry)
Fixed bug #41711 (NULL temporary lobs not supported in OCI8). (Chris Jones, Tony)
Fixed bug #41709 (strtotime() does not handle 00.00.0000). (Derick)
Fixed bug #41698 (float parameters truncated to integer in prepared statements). (Ilia)
Fixed bug #41692 (ArrayObject shows weird behavior in respect to inheritance). (Tony)
Fixed bug #41691 (ArrayObject::exchangeArray hangs Apache). (Tony)
Fixed bug #41686 (Omitting length param in array_slice not possible). (Ilia)
Fixed bug #41685 (array_push() fails to warn when next index is already occupied). (Ilia)
Fixed bug #41655 (open_basedir bypass via glob()). (Ilia)
Fixed bug #41640 (get_class_vars produces error on class constants). (Johannes)
Fixed bug #41635 (SoapServer and zlib.output_compression with FastCGI result in major slowdown). (Dmitry)
Fixed bug #41633 (Crash instantiating classes with self-referencing constants). (Dmitry)
Fixed bug #41630 (segfault when an invalid color index is present in the image data). (Reported by Elliot wccoder@gmail dot com) (Pierre)
Fixed bug #41628 (PHP settings leak between Virtual Hosts in Apache 1.3). (Scott, manuel at mausz dot at)
Fixed bug #41608 (segfault on a weird code with objects and switch()). (Tony)
Fixed bug #41600 (url rewriter tags doesn't work with namespaced tags). (Ilia)
Fixed bug #41596 (Fixed a crash inside pdo_pgsql on some non-well-formed SQL queries). (Ilia)
Fixed bug #41594 (OCI8 statement cache is flushed too frequently). (Tony)
Fixed bug #41582 (SimpleXML crashes when accessing newly created element). (Tony)
Fixed bug #41576 (configure failure when using --without-apxs or some other SAPIs disabling options). (Jani)
Fixed bug #41567 (json_encode() double conversion is inconsistent with PHP). (Lucas, Ilia)
Fixed bug #41566 (SOAP Server not properly generating href attributes). (Dmitry)
Fixed bug #41555 (configure failure: regression caused by fix for #41265). (Jani)
Fixed bug #41527 (WDDX deserialize numeric string array key). (Matt, Ilia)
Fixed bug #41523 (strtotime('0000-00-00 00:00:00') is parsed as 1999-11-30). (Derick)
Fixed bug #41518 (file_exists() warns of open_basedir restriction on non-existent file). (Tony)
Fixed bug #41445 (parse_ini_file() has a problem with certain types of integer as sections). (Tony)
Fixed bug #41433 (DBA: configure fails to include correct db.h for db4). (Jani)
Fixed bug #41372 (Internal pointer of source array resets during array copying). (Dmitry)
Fixed bug #41350 (my_thread_global_end() error during request shutdown on Windows). (Scott, Andrey)
Fixed bug #41278 (get_loaded_extensions() should list Zend extensions). (Johannes)
Fixed bug #41127 (Memory leak in ldap_{first|next}_attribute functions). (Jani)
Fixed bug #40757 (get_object_vars get nothing in child class). (Dmitry)
Fixed bug #40705 (Iterating within function moves original array pointer). (Dmitry)
Fixed bug #40509 (key() function changed behaviour if global array is used within function). (Dmitry)
Fixed bug #40419 (Trailing slash in CGI request does not work). (Dmitry)
Fixed bug #39330 (apache2handler does not call shutdown actions before apache child die). (isk at ecommerce dot com, Gopal, Tony)
Fixed bug #39291 (ldap_sasl_bind() misses the sasl_authc_id parameter). (diafour at gmail dot com, Jani)
Fixed bug #37715 (array pointers resetting on copy). (Dmitry)
Fixed bug #37273 (Symlinks and mod_files session handler allow open_basedir bypass). (Ilia)
Fixed bug #36492 (Userfilters can leak buckets). (Sara)
Fixed bugs #36796, #36918, #41371 (stream_set_blocking() does not work). (Jani)
Fixed bug #35981 (pdo-pgsql should not use pkg-config when not present). (Jani)
Fixed bug #31892 (PHP_SELF incorrect without cgi.fix_pathinfo, but turning on screws up PATH_INFO). (Dmitry)
Fixed bug #21197 (socket_read() outputs error with PHP_NORMAL_READ). (Nuno, Jani)

Version 5.2.3

31-May-2007

Security Fixes
- Fixed an integer overflow inside chunk_split() (by Gerhard Wagner, CVE-2007-2872)
- Fixed possible infinite loop in imagecreatefrompng. (by Xavier Roche, CVE-2007-2756)
- Fixed ext/filter Email Validation Vulnerability (MOPB-45 by Stefan Esser, CVE-2007-1900)
- Fixed bug #41492 (open_basedir/safe_mode bypass inside realpath()) (by bugs dot php dot net at chsc dot dk)
- Improved fix for CVE-2007-1887 to work with non-bundled sqlite2 lib.
- Added mysql_set_charset() to allow runtime altering of connection encoding.
Changed CGI install target to php-cgi and 'make install' to install CLI when CGI is selected. (Jani)
Changed JSON maximum nesting depth from 20 to 128. (Rasmus)
Improved compilation of heredocs and interpolated strings. (Matt, Dmitry)
Optimized out a couple of per-request syscalls. (Rasmus)
Optimized digest generation in md5() and sha1() functions. (Ilia)
Upgraded bundled SQLite 3 to version 3.3.17. (Ilia)
Added "max_input_nesting_level" php.ini option to limit nesting level of input variables. Fix for MOPB-03-2007. (Stas)
Added a 4th parameter flag to htmlspecialchars() and htmlentities() that makes the function not encode existing html entities. (Ilia)
Added PDO::FETCH_KEY_PAIR mode that will fetch a 2 column result set into an associated array. (Ilia)
Added CURLOPT_TIMEOUT_MS and CURLOPT_CONNECTTIMEOUT_MS cURL constants. (Sara)
Added --ini switch to CLI that prints out configuration file names. (Marcus)
Implemented FR Fixed bug #41416 (getColumnMeta() should also return table name). (Tony)
Fixed filetype() and linkinfo() processing of symlinks on ZTS systems. (Oliver Block, Tony, Dmitry)
Fixed SOAP extension's handler() to work even when "always_populate_raw_post_data" is off. (Ilia)
Fixed altering $this via argument named "this". (Dmitry)
Fixed PHP CLI usage of php.ini from the binary location. (Hannes)
Fixed segfault in strripos(). (Tony, Joxean Koret)
Fixed gd build when used with freetype 1.x (Pierre, Tony)
Fixed bug #41525 (ReflectionParameter::getPosition() not available). (Marcus)
Fixed bug #41511 (Compile failure under IRIX 6.5.30 building md5.c). (Jani)
Fixed bug #41504 (json_decode() incorrectly decodes JSON arrays with empty string keys). (Ilia)
Fixed bug #41477 (no arginfo about SoapClient::__soapCall()). (Ilia)
Fixed bug #41455 (ext/dba/config.m4 pollutes global $LIBS and $LDFLAGS). (mmarek at suse dot cz, Tony)
Fixed bug #41442 (imagegd2() under output control). (Tony)
Fixed bug #41430 (Fatal error with negative values of maxlen parameter of file_get_contents()). (Tony)
Fixed bug #41423 (PHP assumes wrongly that certain ciphers are enabled in OpenSSL). (Pierre)
Fixed bug #41421 (Uncaught exception from a stream wrapper segfaults). (Tony, Dmitry)
Fixed bug #41403 (json_decode cannot decode floats if localeconv decimal_point is not '.'). (Tony)
Fixed bug #41401 (wrong unary operator precedence). (Stas)
Fixed bug #41394 (dbase_create creates file with corrupted header). (Tony)
Fixed bug #41390 (Clarify error message with invalid protocol scheme). (Scott)
Fixed bug #41378 (fastcgi protocol lacks support for Reason-Phrase in "Status:" header). (anight at eyelinkmedia dot com, Dmitry)
Fixed bug #41374 (whole text concats values of wrong nodes). (Rob)
Fixed bug #41358 (configure cannot determine SSL lib with libcurl >= 7.16.2). (Mike)
Fixed bug #41353 (crash in openssl_pkcs12_read() on invalid input). (Ilia)
Fixed bug #41351 (Invalid opcode with foreach ($a[] as $b)). (Dmitry, Tony)
Fixed bug #41347 (checkdnsrr() segfaults on empty hostname). (Scott)
Fixed bug #41337 (WSDL parsing doesn't ignore non soap bindings). (Dmitry)
Fixed bug #41326 (Writing empty tags with Xmlwriter::WriteElement[ns]) (Pierre)
Fixed bug #41321 (downgrade read errors in getimagesize() to E_NOTICE). (Ilia)
Fixed bug #41304 (compress.zlib temp files left). (Dmitry)
Fixed bug #41293 (Fixed creation of HTTP_RAW_POST_DATA when there is no default post handler). (Ilia)
Fixed bug #41291 (FastCGI does not set SO_REUSEADDR). (fmajid at kefta dot com, Dmitry)
Fixed bug #41287 (Namespace functions don't allow xmlns definition to be optional). (Rob)
Fixed bug #41283 (Bug with deserializing array key that are doubles or floats in wddx). (Ilia)
Fixed bug #41257 (lookupNamespaceURI does not work as expected). (Rob)
Fixed bug #41236 (Regression in timeout handling of non-blocking SSL connections during reads and writes). (Ilia)
Fixed bug #41134 (zend_ts_hash_clean not thread-safe). (marco dot cova at gmail dot com, Tony)
Fixed bug #41097 (ext/soap returning associative array as indexed without using WSDL). (Dmitry)
Fixed bug #41004 (minOccurs="0" and null class member variable). (Dmitry)
Fixed bug #39542 (Behavior of require/include different to < 5.2.0). (Dmitry)

Version 5.2.2

03-May-2007

Security Fixes
- Fixed CVE-2007-1001, GD wbmp used with invalid image size (by Ivan Fratric) (Pierre)
- Fixed a header injection via Subject and To parameters to the mail() function (MOPB-34 by Stefan Esser) (Ilia)
- Fixed asciiz byte truncation inside mail() (MOPB-33 by Stefan Esser) (Ilia)
- Fixed wrong length calculation in unserialize S type (MOPB-29 by Stefan Esser) (Stas)
- Fixed a bug in mb_parse_str() that can be used to activate register_globals (MOPB-26 by Stefan Esser) (Ilia)
- Fixed unallocated memory access/double free in in array_user_key_compare() (MOPB-24 by Stefan Esser) (Stas)
- Fixed a double free inside session_regenerate_id() (MOPB-22 by Stefan Esser) (Ilia)
- Added missing open_basedir & safe_mode checks to zip:// and bzip:// wrappers. (MOPB-20, MOPB-21 by Stefan Esser). (Ilia)
- Fixed substr_compare and substr_count information leak (MOPB-14 by Stefan Esser) (Stas, Ilia)
- Limit nesting level of input variables with max_input_nesting_level as fix for (MOPB-03 by Stefan Esser) (Stas)
- Fixed CRLF injection inside ftp_putcmd(). (by loveshell[at]Bug.Center.Team) (Ilia)
- Fixed a possible super-global overwrite inside import_request_variables(). (by Stefano Di Paola, Stefan Esser) (Ilia)
- Fixed a remotely trigger-able buffer overflow inside make_http_soap_request(). (Ilia)
- Fixed a buffer overflow inside user_filter_factory_create(). (Ilia)
- Fixed a remotely trigger-able buffer overflow inside bundled libxmlrpc library. (Stas)
Improved bundled GD
- Sync to 2.0.35
- Added imagegrabwindow and imagegrabscreen, capture a screen or a window using its handle (Pierre)
- colors allocated henceforth from the resulting image overwrite the palette colors (Rob Leslie)
- Improved thread safety of the gif support (Roman Nemecek, Nuno, Pierre)
  - Use the dimension of the GIF frame to create the destination image (Pierre)
  - Load only once the local color map from a GIF data (Pierre)
- Improved thread safety of the freetype cache (Scott MacVicar, Nuno, Pierre)
  - imagearc huge CPU usage with large angles, libgd bug #74 (Pierre)
Improved FastCGI SAPI to support external pipe and socket servers on win32. (Dmitry)
Improved Zend Memory Manager
- guarantee of reasonable time for worst cases of best-fit free block searching algorithm. (Dmitry)
- better cache usage and less fragmentation on erealloc() (Tony, Dmitry)
Improved SPL (Marcus)
- Added SplFileInfo::getBasename(), DirectoryIterator::getBasename().
- Added SplFileInfo::getLinkTarget(), SplFileInfo::getRealPath().
- Made RecursiveFilterIterator::accept() abstract as stated in documentation.
Improved SOAP
- Added ability to encode arrays with "SOAP-ENC:Array" type instead of WSDL type. To activate the ability use "feature"=>SOAP_USE_XSI_ARRAY_TYPE option in SoapClient/SoapServer constructors. (Rob, Dmitry)
Added GMP_VERSION constant. (Tony)
Added --ri switch to CLI which allows to check extension information. (Marcus)
Added tidyNode::getParent() method (John, Nuno)
Added openbasedir and safemode checks in zip:// stream wrapper and ZipArchive::open (Pierre)
Added php_pdo_sqlite_external.dll, a version of the PDO SQLite driver that links against an external sqlite3.dll. This provides Windows users to upgrade their sqlite3 version outside of the PHP release cycle. (Wez, Edin)
Added linenumbers to array returned by token_get_all(). (Johannes)
Implement #40947, allow a single filter as argument for filter_var_array (Pierre)
Implement #39867 (openssl PKCS#12 support) (Marc Delling, Pierre)
Upgraded SQLite 3 to version 3.3.16 (Ilia)
Upgraded libraries bundled in the Windows distribution. (Edin)
- c-client (imap) to version 2006e
- libpq (PostgreSQL) to version 8.2.3
- libmysql (MySQL) to version 5.0.37
- openssl to version 0.9.8e
Upgraded PCRE to version 7.0 (Nuno)
Updated timezone database to version 2007.5. (Derick)
Fixed commandline handling for CLI and CGI. (Marcus, Johannes)
Fixed iterator_apply() with a callback using __call(). (Johannes)
Fixed possible multi bytes issues in openssl csr parser (Pierre)
Fixed shmop_open() with IPC_CREAT|IPC_EXCL flags on Windows. (Vladimir Kamaev, Tony).
Fixed possible leak in ZipArchive::extractTo when safemode checks fails (Ilia)
Fixed possible relative path issues in zip_open and TS mode (old API) (Pierre)
Fixed zend_llist_remove_tail (Michael Wallner, Dmitry)
Fixed a thread safety issue in gd gif read code (Nuno, Roman Nemecek)
Fixed crash on op-assign where argument is string offset (Brian, Stas)
Fixed bug #41215 (setAttribute return code reversed). (Ilia)
Fixed bug #41192 (Per Directory Values only work for one key). (Dmitry)
Fixed bug #41175 (addAttribute() fails to add an attribute with an empty value). (Ilia)
Fixed bug #41159 (mysql_pconnect() hash does not account for connect flags). (Ilia)
Fixed bug #41121 (range() overflow handling for large numbers on 32bit machines). (Ilia)
Fixed bug #41118 (PHP does not handle overflow of octal integers). (Tony)
Fixed bug #41109 (recursiveiterator.inc says "implements" Iterator instead of "extends"). (Marcus)
Fixed bug #40130 (TTF usage doesn't work properly under Netware). (Scott, gk at gknw dot de)
Fixed bug #41093 (magic_quotes_gpc ignores first arrays keys). (Arpad, Ilia)
Fixed bug #41075 (memleak when creating default object caused exception). (Dmitry)
Fixed bug #41067 (json_encode() problem with UTF-16 input). (jp at df5ea dot net. Ilia)
Fixed bug #41063 (chdir doesn't like root paths). (Dmitry)
Fixed bug #41061 ("visibility error" in ReflectionFunction::export()). (Johannes)
Fixed bug #41043 (pdo_oci crash when freeing error text with persistent connection). (Tony)
Fixed bug #41037 (unregister_tick_function() inside the tick function crash PHP). (Tony)
Fixed bug #41034 (json_encode() ignores null byte started keys in arrays). (Ilia)
Fixed bug #41026 (segfault when calling "self::method()" in shutdown functions). (Tony)
Fixed bug #40999 (mcrypt_create_iv() not using random seed). (Ilia)
Fixed bug #40998 (long session array keys are truncated). (Tony)
Fixed bug #40935 (pdo_mysql does not raise an exception on empty fetchAll()). (Ilia)
Fixed bug #40931 (open_basedir bypass via symlink and move_uploaded_file()). (Tony)
Fixed bug #40921 (php_default_post_reader crashes when post_max_size is exceeded). (trickie at gmail dot com, Ilia)
Fixed bug #40915 (addcslashes unexpected behavior with binary input). (Tony)
Fixed bug #40899 (memory leak when nesting list()). (Dmitry)
Fixed bug #40897 (error_log file not locked). (Ilia)
Fixed bug #40883 (mysql_query() is allocating memory incorrectly). (Tony)
Fixed bug #40872 (inconsistency in offsetSet, offsetExists treatment of string enclosed integers). (Marcus)
Fixed bug #40861 (strtotime() doesn't handle double negative relative time units correctly). (Derick, Ilia)
Fixed bug #40854 (imap_mail_compose() creates an invalid terminator for multipart e-mails). (Ilia)
Fixed bug #40848 (sorting issue on 64-bit Solaris). (Wez)
Fixed bug #40836 (Segfault in ext/dom). (Rob)
Fixed bug #40833 (Crash when using unset() on an ArrayAccess object retrieved via __get()). (Dmitry)
Fixed bug #40822 (pdo_mysql does not return rowCount() on select). (Ilia)
Fixed bug #40815 (using strings like "class::func" and static methods in set_exception_handler() might result in crash). (Tony)
Fixed bug #40809 (Poor performance of ".="). (Dmitry)
Fixed bug #40805 (Failure executing function ibase_execute()). (Tony)
Fixed bug #40800 (cannot disable memory_limit with -1). (Dmitry, Tony)
Fixed bug #40794 (ReflectionObject::getValues() may crash when used with dynamic properties). (Tony)
Fixed bug #40784 (Case sensitivity in constructor's fallback). (Tony)
Fixed bug #40770 (Apache child exits when PHP memory limit reached). (Dmitry)
Fixed bug #40764 (line thickness not respected for horizontal and vertical lines). (Pierre)
Fixed bug #40758 (Test fcgi_is_fastcgi() is wrong on windows). (Dmitry)
Fixed bug #40754 (added substr() & substr_replace() overflow checks). (Ilia)
Fixed bug #40752 (parse_ini_file() segfaults when a scalar setting is redeclared as an array). (Tony)
Fixed bug #40750 (openssl stream wrapper ignores default_stream_timeout). (Tony)
Fixed bug #40727 (segfault in PDO when failed to bind parameters). (Tony)
Fixed bug #40709 (array_reduce() behaves strange with one item stored arrays). (Ilia)
Fixed bug #40703 (Resolved a possible namespace conflict between libxmlrpc and MySQL's NDB table handler). (Ilia)
Fixed bug #40961 (Incorrect results of DateTime equality check). (Mike)
Fixed bug #40678 (Cross compilation fails). (Tony)
Fixed bug #40621 (Crash when constructor called inappropriately). (Tony)
Fixed bug #40609 (Segfaults when using more than one SoapVar in a request). (Rob, Dmitry)
Fixed bug #40606 (umask is not being restored when request is finished). (Tony)
Fixed bug #40598 (libxml segfault). (Rob)
Fixed bug #40591 (list()="string"; gives invalid opcode). (Dmitry)
Fixed bug #40578 (imagettftext() multithreading issue). (Tony, Pierre)
Fixed bug #40576 (double values are truncated to 6 decimal digits when encoding). (Tony)
Fixed bug #40560 (DIR functions do not work on root UNC path). (Dmitry)
Fixed bug #40548 (SplFileInfo::getOwner/getGroup give a warning on broken symlink). (Marcus)
Fixed bug #40546 (SplFileInfo::getPathInfo() throws an exception if directory is in root dir). (Marcus)
Fixed bug #40545 (multithreading issue in zend_strtod()). (Tony)
Fixed bug #40503 (json_encode() value corruption on 32bit systems with overflown values). (Ilia)
Fixed bug #40467 (Partial SOAP request sent when XSD sequence or choice include minOccurs=0). (Dmitry)
Fixed bug #40465 (Ensure that all PHP elements are printed by var_dump). (wharmby at uk dot ibm dot com, Ilia)
Fixed bug #40464 (session.save_path wont use default-value when safe_mode or open_basedir is enabled). (Ilia)
Fixed bug #40455 (proc_open() uses wrong command line when safe_mode_exec_dir is set). (Tony)
Fixed bug #40432 (strip_tags() fails with greater than in attribute). (Ilia)
Fixed bug #40431 (dynamic properties may cause crash in ReflectionProperty methods). (Tony)
Fixed bug #40451 (addAttribute() may crash when used with non-existent child node). (Tony)
Fixed bug #40442 (ArrayObject::offsetExists broke in 5.2.1, works in 5.2.0). (olivier at elma dot fr, Marcus)
Fixed bug #40428 (imagepstext() doesn't accept optional parameter). (Pierre)
Fixed bug #40417 (Allow multiple instances of the same named PDO token in prepared statement emulation code). (Ilia)
Fixed bug #40414 (possible endless fork() loop when running fastcgi). (Dmitry)
Fixed bug #40410 (ext/posix does not compile on MacOS 10.3.9). (Tony)
Fixed bug #40392 (memory leaks in PHP milter SAPI). (tuxracer69 at gmail dot com, Tony)
Fixed bug #40371 (pg_client_encoding() not working on Windows). (Edin)
Fixed bug #40352 (FCGI_WEB_SERVER_ADDRS function get lost). (Dmitry)
Fixed bug #40290 (strtotime() returns unexpected result with particular timezone offset). (Derick)
Fixed bug #40286 (PHP fastcgi with PHP_FCGI_CHILDREN don't kill children when parent is killed). (Dmitry)
Fixed bug #40261 (Extremely slow data handling due to memory fragmentation). (Dmitry)
Fixed bug #40236 (php -a function allocation eats memory). (Dmitry)
Fixed bug #40109 (iptcembed fails on non-jfif jpegs). (Tony)
Fixed bug #39965 (Latitude and longitude are backwards in date_sun_info()). (Derick)
Fixed bug #39836 (SplObjectStorage empty after unserialize). (Marcus)
Fixed bug #39416 (Milliseconds in date()). (Derick)
Fixed bug #39396 (stream_set_blocking crashes on Win32). (Ilia, maurice at iceblog dot de)
Fixed bug #39351 (relative include fails on Solaris). (Dmitry, Tony)
Fixed bug #39322 (proc_terminate() destroys process resource). (Nuno)
Fixed bug #38406 (crash when assigning objects to SimpleXML attributes). (Tony)
Fixed bug #37799 (ftp_ssl_connect() falls back to non-ssl connection). (Nuno)
Fixed bug #36496 (SSL support in imap_open() not working on Windows). (Edin)
Fixed bug #36226 (Inconsistent handling when passing nillable arrays). (Dmitry)
Fixed bug #35872 (Avoid crash caused by object store being referenced during RSHUTDOWN). (Andy)
Fixed bug #34794 (proc_close() hangs when used with two processes). (jdolecek at netbsd dot org, Nuno)
Fixed bug #38710 (data leakage because of nonexisting boundary checking in statements in mysqli) (Stas)
Fixed bug #37386 (autocreating element doesn't assign value to first node). (Rob)
Fixed bug #37013 (server hangs when returning circular object references). (Dmitry)
Fixed bug #33664 Console window appears when using exec() (Richard Quadling, Stas)
Fixed PECL bug #10194 (crash in Oracle client when memory limit reached in the callback). (Tony)

Version 5.2.1

08-Feb-2007

Added CURLOPT_TCP_NODELAY constant to Curl extension. (Sara)
Added support for hex numbers of any size. (Matt)
Added function stream_socket_shutdown(). It is a wrapper for system shutdown() function, that shut downs part of a full-duplex connection. (Dmitry)
Added internal heap protection (Dmitry)
- memory-limit is always enabled (--enable-memory-limit removed)
- default value if memory-limit is set to 128M
- safe unlinking
- cookies
- canary protection (debug build only)
- random generation of cookies and canaries
Added forward support for 'b' prefix in front of string literals. (Andrei)
Added three new functions to ext/xmlwriter (Rob, Ilia)
- xmlwriter_start_dtd_entity()
- xmlwriter_end_dtd_entity()
- xmlwriter_write_dtd_entity()
Added a meta tag to phpinfo() output to prevent search engines from indexing the page. (Ilia)
Added new function, sys_get_temp_dir(). (Hartmut)
Added missing object support to file_put_contents(). (Ilia)
Added support for md2, ripemd256 and ripemd320 algos to hash(). (Sara)
Added forward support for (binary) cast. (Derick)
Added optimization for imageline with horizontal and vertical lines (Pierre)
Removed dependency from SHELL32.DLL. (Dmitry)
Removed double "wrong parameter count" warnings in various functions. (Hannes)
Moved extensions to PECL:
- ext/informix (Derick, Tony)
Changed double-to-string utilities to use BSD implementation. (Dmitry, Tony)
Updated bundled libcURL to version 7.16.0 in the Windows distro. (Edin)
Updated timezone database to version 2006.16. (Derick)
cgi.* and fastcgi.* directives are moved to INI subsystem. The new directive cgi.check_shebang_line can be used to omitting check for "#! /usr/bin/php" line. (Dmitry).
Improved proc_open(). Now on Windows it can run external commands not through CMD.EXE. (Dmitry)
VCWD_REALPATH() is improved to use realpath cache without VIRTUAL_DIR. (Dmitry)
ext/bcmath initialization code is moved from request startup to module startup. (Dmitry)
Zend Memory Manager Improvements (Dmitry)
- use HeapAlloc() instead of VirtualAlloc()
- use "win32" storage manager (instead of "malloc") on Windows by default
Zip Extension Improvements (Pierre)
- Fixed leak in statName and stateIndex
- Fixed return setComment (Hannes)
- Added addEmptyDir method
Filter Extension Improvements (Ilia, Pierre)
- Fixed a bug when callback function returns a non-modified value.
- Added filter support for $_SERVER in cgi/apache2 sapis.
- Make sure PHP_SELF is filtered in Apache 1 sapi.
- Fixed bug #39358 (INSTALL_HEADERS contains incorrect reference to php_filter.h).
- Added "default" option that allows a default value to be set for an invalid or missing value.
- Invalid filters fails instead of returning unsafe value
- Fixed possible double encoding problem with sanitizing filters
- Make use of space-strict strip_tags() function
- Fixed whitespace trimming
- Added support for FastCGI environment variables. (Dmitry)
PDO_MySQL Extension Improvements (Ilia)
- Enabled buffered queries by default.
- Enabled prepared statement emulation by default.
Small optimization of the date() function. (Matt,Ilia)
Optimized the internal is_numeric_string() function. (Matt,Ilia)
Optimized array functions utilizing php_splice(). (Ilia)
Windows related optimizations (Dmitry, Stas)
- COM initialization/deinitialization are done only if necessary
- removed unnecessary checks for ISREG file and corresponding stat() calls
- opendir() is reimplementation using GetFirstFile/GetNextFile those are faster then _findfirst/_findnext
- implemented registry cache that prevent registry lookup on each request. In case of modification of corresponding registry-tree PHP will reload it automatic
- start timeout thread only if necessary
- stat() is reimplementation using GetFileAttributesEx(). The new implementation is faster then implementation in MS VC CRT, but it doesn't support Windows 95.
Streams optimization (Dmitry)
- removed unnecessary ftell() calls (one call for each included PHP file)
- disabled calls to read() after EOF
Fixed incorrect function names on FreeBSD where inet_pton() was named __inet_pton() and inet_ntop() was named __inet_ntop(). (Hannes)
Fixed FastCGI impersonation for persistent connections on Windows. (Dmitry)
Fixed wrong signature initialization in imagepng (Takeshi Abe)
Fixed ftruncate() with negative size on FreeBSD. (Hannes)
Fixed segfault in RegexIterator when given invalid regex. (Hannes)
Fixed segfault in SplFileObject->openFile()->getPathname(). (Hannes)
Fixed segfault in ZTS mode when OCI8 statements containing sub-statements are destroyed in wrong order. (Tony)
Fixed the validate email filter so that the letter "v" can also be used in the user part of the email address. (Derick)
Fixed bug #40297 (compile failure in ZTS mode when collections support is missing). (Tony)
Fixed bug #40285 (The PDO prepare parser goes into an infinite loop in some instances). (Ilia)
Fixed bug #40274 (Sessions fail with numeric root keys). (Ilia)
Fixed bug #40259 (ob_start call many times - memory error). (Dmitry)
Fixed bug #40231 (file_exists incorrectly reports false). (Dmitry)
Fixed bug #40228 (ZipArchive::extractTo does create empty directories recursively). (Pierre)
Fixed bug #40200 (The FastCgi version has different realpath results than thread safe version). (Dmitry)
Fixed bug #40191 (use of array_unique() with objects triggers segfault). (Tony)
Fixed bug #40189 (possible endless loop in zlib.inflate stream filter). (Greg, Tony)
Fixed bug #40169 (CURLOPT_TCP_NODELAY only available in curl >= 7.11.2). (Tony)
Fixed bug #40129 (iconv extension doesn't compile with CodeWarrior on Netware). (gk at gknw dot de, Tony)
Fixed bug #40127 (apache2handler doesn't compile on Netware). (gk at gknw dot de)
Fixed bug #40121 (PDO_DBLIB driver wont free statements). (Ilia)
Fixed bug #40098 (php_fopen_primary_script() not thread safe). (Ilia)
Fixed bug #40092 (chroot() doesn't clear realpath cache). (Dmitry)
Fixed bug #40091 (spl_autoload_register with 2 instances of the same class). (Ilia)
Fixed bug #40083 (milter SAPI functions always return false/null). (Tony)
Fixed bug #40079 (php_get_current_user() not thread safe). (Ilia, wharmby at uk dot ibm dot com)
Fixed bug #40078 (ORA-01405 when fetching NULL values using oci_bind_array_by_name()). (Tony)
Fixed bug #40076 (zend_alloc.c: Value of enumeration constant must be in range of signed integer). (Dmitry)
Fixed bug #40073 (exif_read_data dies on certain images). (Tony, Marcus)
Fixed bug #40036 (empty() does not work correctly with ArrayObject when using ARRAY_AS_PROPS). (Ilia)
Fixed bug #40012 (php_date.c doesn't compile on Netware). (gk at gknw dot de, Derick)
Fixed bug #40009 (http_build_query(array()) returns NULL). (Ilia)
Fixed bug #40002 (Try/Catch performs poorly). (Dmitry)
Fixed bug #39993 (tr_TR.UTF-8 locale has problems with PHP). (Ilia)
Fixed bug #39990 (Cannot "foreach" over overloaded properties). (Dmitry)
Fixed bug #39988 (type argument of oci_define_by_name() is ignored). (Chris Jones, Tony)
Fixed bug #39984 (redirect response code in header() could be ignored in CGI sapi). (Ilia)
Fixed bug #39979 (PGSQL_CONNECT_FORCE_NEW will causes next connect to establish a new connection). (Ilia)
Fixed bug #39971 (pg_insert/pg_update do not allow now() to be used for timestamp fields). (Ilia)
Fixed bug #39969 (ini setting short_open_tag has no effect when using --enable-maintainer-zts). (Dmitry)
Fixed bug #39952 (zip ignoring --with-libdir on zlib checks) (judas dot iscariote at gmail dot com)
Fixed bug #39944 (References broken). (Dmitry)
Fixed bug #39935 (Extensions tidy,mcrypt,mhash,pdo_sqlite ignores --with-libdir). (judas dot iscariote at gmail dot com, Derick)
Fixed bug #39903 (Notice message when executing __halt_compiler() more than once). (Tony)
Fixed bug #39898 (FILTER_VALIDATE_URL validates \r\n\t etc). (Ilia)
Fixed bug #39890 (using autoconf 2.6x and --with-layout=GNU breaks PEAR install path). (Tony)
Fixed bug #39884 (ReflectionParameter::getClass() throws exception for type hint self). (thekid at php dot net)
Fixed bug #39878 (CURL doesn't compile on Sun Studio Pro). (Ilia)
Fixed bug #39873 (number_format() breaks with locale & decimal points). (Ilia)
Fixed bug #39869 (safe_read does not initialize errno). (michiel at boland dot org, Dmitry)
Fixed bug #39850 (SplFileObject throws contradictory/wrong error messages when trying to open "php://wrong"). (Tony)
Fixed bug #39846 (Invalid IPv4 treated as valid). (Ilia)
Fixed bug #39845 (Persistent connections generate a warning in pdo_pgsql). (Ilia)
Fixed bug #39832 (SOAP Server: parameter not matching the WSDL specified type are set to 0). (Dmitry)
Fixed bug #39825 (foreach produces memory error). (Dmitry)
Fixed bug #39816 (apxs2filter ignores httpd.conf & .htaccess php config settings). (Ilia)
Fixed bug #39815 (SOAP double encoding is not locale-independent). (Dmitry)
Fixed bug #39797 (virtual() does not reset changed INI settings). (Ilia)
Fixed bug #39795 (build fails on AIX because crypt_r() uses different data struct). (Tony)
Fixed bug #39791 (Crash in strtotime() on overly long relative date multipliers). (Ilia)
Fixed bug #39787 (PHP doesn't work with Apache 2.3). (mv at binarysec dot com).
Fixed bug #39782 (setTime() on a DateTime constructed with a Weekday yields incorrect results). (Ilia)
Fixed bug #39780 (PNG image with CRC/data error raises fatal error) (Pierre)
Fixed bug #39779 (Enable AUTH PLAIN mechanism in underlying libc-client). (michael dot heimpold at s2000 dot tu-chemnitz dot de, Ilia)
Fixed bug #39775 ("Indirect modification ..." message is not shown). (Dmitry)
Fixed bug #39763 (magic quotes are applied twice by ext/filter in parse_str()). (Ilia)
Fixed bug #39760 (cloning fails on nested SimpleXML-Object). (Rob)
Fixed bug #39759 (Can't use stored procedures fetching multiple result sets in pdo_mysql). (Ilia)
Fixed bug #39754 (Some POSIX extension functions not thread safe). (Ilia, wharmby at uk dot ibm dot com)
Fixed bug #39751 (putenv crash on Windows). (KevinJohnHoffman at gmail.com)
Fixed bug #39732 (oci_bind_array_by_name doesn't work on Solaris 64bit). (Tony)
Fixed bug #39724 (Broken build due to spl/filter usage of pcre extension). (Tony, Ilia)
Fixed bug #39718 (possible crash if assert.callback is set in ini). (Ilia)
Fixed bug #39702 (php crashes in the allocator on linux-m68k). (Dmitry)
Fixed bug #39685 (iconv() - undefined function). (Hannes)
Fixed bug #39673 (file_get_contents causes bus error on certain offsets). (Tony)
Fixed bug #39663 (Memory leak in pg_get_notify() and a possible memory corruption on Windows in pgsql and pdo_pgsql extensions). (Ilia, matteo at beccati dot com)
Fixed bug #39662 (Segfault when calling asXML() of a cloned SimpleXMLElement). (Rob, Tony)
Fixed bug #39656 (crash when calling fetch() on a PDO statment object after closeCursor()). (Ilia, Tony)
Fixed bug #39653 (ext/dba doesn't check for db-4.5 and db-4.4 when db4 support is enabled). (Tony)
Fixed bug #39652 (Wrong negative results from memory_get_usage()). (Dmitry)
Fixed bug #39648 (Implementation of PHP functions chown() and chgrp() are not thread safe). (Ilia, wharmby at uk dot ibm dot com)
Fixed bug #39640 (Segfault with "Allowed memory size exhausted"). (Dmitry)
Fixed bug #39625 (Apache crashes on importStylesheet call). (Rob)
Fixed bug #39623 (thread safety fixes on *nix for putenv() & mime_magic). (Ilia, wharmby at uk dot ibm dot com)
Fixed bug #39621 (str_replace() is not binary safe on strings with equal length). (Tony)
Fixed bug #39613 (Possible segfault in imap initialization due to missing module dependency). (wharmby at uk dot ibm dot com, Tony)
Fixed bug #39606 (Use of com.typelib_file in PHP.ini STILL causes A/V). (Rob)
Fixed bug #39602 (Invalid session.save_handler crashes PHP). (Dmitry)
Fixed bug #39596 (Creating Variant of type VT_ARRAY). (Rob)
Fixed bug #39583 (ftp_put() does not change transfer mode to ASCII). (Tony)
Fixed bug #39576 (array_walk() doesn't separate user data zval). (Tony)
Fixed bug #39575 (move_uploaded_file() no longer working (safe mode related)). (Tony)
Fixed bug #39571 (timeout ssl:// connections). (Ilia)
Fixed bug #39564 (PDO::errorInfo() returns inconsistent information when sqlite3_step() fails). (Tony)
Fixed bug #39548 (ZMSG_LOG_SCRIPT_NAME not routed to OutputDebugString() on Windows). (Dmitry)
Fixed bug #39538 (fgetcsv can't handle starting newlines and trailing odd number of backslashes). (David Soria Parra, Pierre)
Fixed bug #39534 (Error in maths to calculate of ZEND_MM_ALIGNED_MIN_HEADER_SIZE). (wharmby at uk dot ibm dot com, Dmitry)
Fixed bug #39527 (Failure to retrieve results when multiple unbuffered, prepared statements are used in pdo_mysql). (Ilia)
Fixed bug #39508 (imagefill crashes with small images 3 pixels or less). (Pierre)
Fixed bug #39506 (Archive corrupt with ZipArchive::addFile method). (Pierre)
Fixed bug #39504 (xmlwriter_write_dtd_entity() creates Attlist tag, not entity). (Hannes)
Fixed bug #39483 (Problem with handling of \ char in prepared statements). (Ilia, suhachov at gmail dot com)
Fixed bug #39458 (ftp_nlist() returns false on empty dirs). (Nuno)
Fixed bug #39454 (Returning a SOAP array segfaults PHP). (Dmitry)
Fixed bug #39450 (getenv() fills other super-globals). (Ilia, Tony)
Fixed bug #39449 (Overloaded array properties do not work correctly). (Dmitry)
Fixed bug #39445 (Calling debug_backtrace() in the __toString() function produces a crash). (Dmitry)
Fixed bug #39438 (Fatal error: Out of memory). (Dmitry)
Fixed bug #39435 ('foo' instanceof bar gives invalid opcode error). (Sara)
Fixed bug #39414 (Syntax error while compiling with Sun Workshop Complier). (Johannes)
Fixed bug #39398 (Booleans are not automatically translated to integers). (Ilia)
Fixed bug #39394 (Missing check for older variants of openssl). (Ilia)
Fixed bug #39367 (clearstatcache() doesn't clear realpath cache). (j at pureftpd dot org, Dmitry)
Fixed bug #39366 (imagerotate does not use alpha with angle > 45 degrees) (Pierre)
Fixed bug #39364 (Removed warning on empty haystack inside mb_strstr()). (Ilia)
Fixed bug #39362 (Added an option to imap_open/imap_reopen to control the number of connection retries). (Ilia)
Fixed bugs #39361, #39400 (mbstring function overloading problem). (Seiji)
Fixed bug #39354 (Allow building of curl extension against libcurl 7.16.0). (Ilia)
Fixed bug #39350 (crash with implode("\n", array(false))). (Ilia)
Fixed bug #39344 (Unnecessary calls to OnModify callback routine for an extension INI directive). (wharmby at uk dot ibm dot com, Dmitry)
Fixed bug #39320 (ZEND_HASH_APPLY_STOP causes deletion). (Marcus)
Fixed bug #39313 (spl_autoload triggers Fatal error). (Marcus)
Fixed bug #39300 (make install fails if wget is not available). (Tony)
Fixed bug #39297 (Memory corruption because of indirect modification of overloaded array). (Dmitry)
Fixed bug #39286 (misleading error message when invalid dimensions are given) (Pierre)
Fixed bug #39273 (imagecopyresized may ignore alpha channel) (Pierre)
Fixed bug #39265 (Fixed path handling inside mod_files.sh). (michal dot taborsky at gmail dot com, Ilia)
Fixed bug #39217 (serialNumber might be -1 when the value is too large). (Pierre, Tony)
Fixed bug #39215 (Inappropriate close of stdin/stdout/stderr). (Wez, Ilia)
Fixed bug #39201 (Possible crash in Apache 2 with 413 ErrorHandler). (Ilia)
Fixed bug #39151 (Parse error in recursiveiteratoriterator.php). (Marcus)
Fixed bug #39121 (Incorrect return array handling in non-wsdl soap client). (Dmitry)
Fixed bug #39090 (DirectoryFilterDots doxygen docs and example is wrong). (Marcus)
Fixed bug #38852 (XML-RPC Breaks iconv). (Hannes)
Fixed bug #38770 (unpack() broken with longs on 64 bit machines). (Ilia, David Soria Parra).
Fixed bug #38698 (for some keys cdbmake creates corrupted db and cdb can't read valid db). (Marcus)
Fixed bug #38680 (Added missing handling of basic types in json_decode). (Ilia)
Fixed bug #38604 (Fixed request time leak inside foreach() when iterating through virtual properties). (Dmitry)
Fixed bug #38602 (header( "HTTP/1.0 ..." ) does not change proto version). (Ilia)
Fixed bug #38542 (proc_get_status() returns wrong PID on windows). (Nuno)
Fixed bug #38536 (SOAP returns an array of values instead of an object). (Dmitry)
Fixed bug #38456 (Apache2 segfaults when virtual() is called in .php ErrorDocument). (Ilia)
Fixed bug #38325 (spl_autoload_register() gives wrong line for "class not found"). (Ilia)
Fixed bug #38319 (Remove bogus warnings from persistent PDO connections). (Ilia)
Fixed bug #38274 (Memlimit fatal error sent to "wrong" stderr when using fastcgi). (Dmitry)
Fixed bug #38252 (Incorrect PDO error message on invalid default fetch mode). (Ilia)
Fixed bug #37927 (Prevent trap when COM extension processes argument of type VT_DISPATCH|VT_REF) (Andy)
Fixed bug #37773 (iconv_substr() gives "Unknown error" when string length = 1"). (Ilia)
Fixed bug #37627 (session save_path check checks the parent directory). (Ilia)
Fixed bug #37619 (proc_open() closes stdin on fork() failure). (jdolecek at NetBSD dot org, Nuno)
Fixed bug #37588 (COM Property propputref converts to PHP function and can't be accesed). (Rob)
Fixed bug #36975 (natcasesort() causes array_pop() to misbehave). (Hannes)
Fixed bug #36812 (pg_execute() modifies input array). (Ilia)
Fixed bug #36798 (Error parsing named parameters with queries containing high-ascii chars). (Ilia)
Fixed bug #36644 (possible crash in variant_date_from_timestamp()). (Ilia)
Fixed bug #36427 (proc_open() / proc_close() leak handles on windows). (jdolecek at NetBSD dot org, Nuno)
Fixed bug #36392 (wrong number of decimal digits with %e specifier in sprintf). (Matt,Ilia)
Fixed bug #36214 (__get method works properly only when conditional operator is used). (Dmitry)
Fixed bug #35634 (Erroneous "Class declarations may not be nested" error raised). (Carl P. Corliss, Dmitry)
Fixed bug #35106 (nested foreach fails when array variable has a reference). (Dmitry)
Fixed bug #34564 (COM extension not returning modified "out" argument) (Andy)
Fixed bug #33734 (Something strange with COM Object). (Rob)
Fixed bug #33386 (ScriptControl only sees last function of class). (Rob)
Fixed bug #33282 (Re-assignment by reference does not clear the is_ref flag) (Ilia, Dmitry, Matt Wilmas)
Fixed bug #30074 (apparent symbol table error with extract($blah, EXTR_REFS)) (Brian)
Fixed bug #29840 (is_executable() does not honor safe_mode_exec_dir setting). (Ilia)
Fixed PECL bug #7295 (ORA-01405: fetched column value is NULL on LOB fields). (Tony)

Version 5.2.0

02-Nov-2006

Updated bundled OpenSSL to version 0.9.8d in the Windows distro. (Edin)
Updated Postgresql client libraries to 8.1.4 in the Windows distro. (Edin)
Updated PCRE to version 6.7. (Ilia)
Updated libsqlite in ext/pdo_sqlite to 3.3.7. (Ilia)
Updated bundled MySQL client library to version 5.0.22 in the Windows distribution. (Edin)
Updated timezonedb to version 2006.14. (Derick)
Added ability to make SOAP call userspace PHP<->XML converters. (Dmitry)
Added support for character sets in pg_escape_string() for PostgreSQL 8.1.4 and higher. (Ilia)
Added support for character sets in PDO quote() method for PostgreSQL 8.1.4 and higher. (Ilia)
Added DSA key generation support to openssl_pkey_new(), FR #38731 (marci at balabit dot hu, Tony)
Added SoapServer::setObject() method (it is a simplified version of SoapServer::setClass() method). (Dmitry)
Added support for hexadecimal entity in imagettftext() for the bundled GD. (Pierre)
Added support for httpOnly flag for session extension and cookie setting functions. (Scott MacVicar, Ilia)
Added version specific registry keys to allow different configurations for different php version. (Richard, Dmitry)
Added "PHPINIDir" Apache directive to apache and apache_hooks SAPIs. (Dmitry)
Added an optional boolean parameter to memory_get_usage() and memory_get_peak_usage() to get memory size allocated by emalloc() or real size of memory allocated from system. (Dmitry)
Added Zip Archive extension. (Pierre)
Added RFC1867 fileupload processing hook. (Stefan E.)
Added JSON and Filter extensions. (Derick, Rasmus, Pierre, Ilia)
Added error messages to disk_free_space() and disk_total_space() functions. FR #37971 (Tony)
Added PATHINFO_FILENAME option to pathinfo() to get the filename. (Toby S. and Christian S.)
Added array_fill_keys() function. (Marcus, Matt Wilmas)
Added posix_initgroups() function. (Ilia)
Added an optional parameter to parse_url() to allow retrieval of distinct URL components. (Ilia)
Added optional parameter to http_build_query() to allow specification of string separator. (Ilia)
Added image_type_to_extension() function. (Hannes, Ilia)
Added allow_url_include ini directive to complement allow_url_fopen. (Rasmus)
Added automatic module globals management. (Dmitry)
Added RFC2397 (data: stream) support. (Marcus)
Added new error mode E_RECOVERABLE_ERROR. (Derick, Marcus, Tony)
Added support for getenv() input filtering. (Rasmus)
Added support for constructors in interfaces to force constructor signature checks in implementations. (Marcus)
Added memory_get_peak_usage() function for retrieving peak memory usage of a PHP script. (Ilia)
Added pg_field_table() function. (Edin)
Added SimpleXMLElement::saveXML() as an alias for SimpleXMLElement::asXML(). (Hannes)
Added DOMNode::getNodePath() for getting an XPath for a node. (Christian)
Added gmp_nextprime() function. (ants dot aasma at gmail dot com, Tony)
Added error_get_last() function. (Mike)
Removed current working directory from the php.ini search path for CLI and re-added it for other SAPIs (restore to pre 5.1.x behavior). (Edin)
Moved extensions to PECL:
- ext/filepro (Derick, Tony)
- ext/hwapi (Derick, Tony)
Disabled CURLOPT_FOLLOWLOCATION in curl when open_basedir or safe_mode are enabled. (Stefan E., Ilia)
Increased default memory limit to 16 megabytes to accommodate for a more accurate memory utilization measurement.
In addition to path to php.ini, PHPRC now may specify full file name. (Dmitry)
Optimized array/HashTable copying. (Matt Wilmas, Dmitry)
Optimized zend_try/zend_catch macros by eliminating memcpy(3). (Dmitry)
Optimized require_once() and include_once() by eliminating fopen(3) on second usage. (Dmitry)
Optimized request shutdown sequence. Restoring ini directives now iterates only over modified directives instead of all. (Dmitry)
Changed priority of PHPRC environment variable on win32 to be higher then value from registry. (Dmitry)
Changed __toString() to be called wherever applicable. (Marcus)
Changed E_ALL error reporting mode to include E_RECOVERABLE_ERROR. (Marcus)
Changed realpath cache to be disabled when "open_basedir" or "safe_mode" are enabled on per-request basis. (Ilia)
Improved SNMP extension: (Jani)
- Renamed snmp_set_oid_numeric_print() to snmp_set_oid_output_format().
- Added 2 new constants: SNMP_OID_OUTPUT_FULL and SNMP_OID_OUTPUT_NUMERIC
- Fixed bug #37564 (AES privacy encryption not possible due to net-snmp 5.2 compatibility issue). (Patch: scott dot moynes+php at gmail dot com)
Improved OpenSSL extension: (Pierre)
- Added support for all supported algorithms in openssl_verify
- Added openssl_pkey_get_details, returns the details of a key
- Added x509 v3 extensions support
- Added openssl_csr_get_subject() and openssl_csr_get_public_key()
- Added 3 new constants OPENSSL_VERSION_TEXT and OPENSSL_VERSION_NUMBER and OPENSSL_KEYTYPE_EC
Improved the Zend memory manager: (Dmitry)
- Removed unnecessary "--disable-zend-memory-manager" configure option.
- Added "--enable-malloc-mm" configure option which is enabled by default in debug builds to allow using internal and external memory debuggers.
- Allow tweaking the memory manager with ZEND_MM_MEM_TYPE and ZEND_MM_SEG_SIZE environment variables.
- For more information: Zend/README.ZEND_MM
Improved safe_mode check for the error_log() function. (Ilia)
Improved the error reporting in SOAP extension on request failure. (Ilia)
Improved crypt() on win32 to be about 10 times faster and to have friendlier license. (Frank, Dmitry)
Improved performance of the implode() function on associated arrays. (Ilia)
Improved performance of str_replace() when doing 1 char to 1 char or 1 char to many chars replacement. (Ilia)
Improved apache2filter SAPI:
- Allowed PHP to be an arbitrary filter in the chain and read the script from the Apache stream. (John)
- Added support for apache2filter in the Windows build including binary support for both Apache 2.0.x (php5apache2_filter.dll) and Apache 2.2.x (php5apache2_2_filter.dll). (Edin)
Improved apache2handler SAPI:
- Changed ap_set_content_type() to be called only once. (Mike)
- Added support for Apache 2.2 handler in the Windows distribution. (Edin)
Improved FastCGI SAPI: (Dmitry)
- Removed source compatibility with libfcgi.
- Optimized access to FastCGI environment variables by using HashTable instead of linear search.
- Allowed PHP_FCGI_MAX_REQUESTS=0 that assumes no limit.
- Allowed PHP_FCGI_CHILDREN=0 that assumes no worker children. (FastCGI requests are handled by main process itself)
Improved CURL:
- Added control character checks for "open_basedir" and "safe_mode" checks. (Ilia)
- Added implementation of curl_multi_info_read(). (Brian)
Improved PCRE: (Andrei)
- Added run-time configurable backtracking/recursion limits.
- Added preg_last_error(). (Andrei)
Improved PDO:
- Added new attribute ATTR_DEFAULT_FETCH_MODE. (Pierre)
- Added FETCH_PROPS_LATE. (Marcus)
Improved SPL: (Marcus)
- Made most iterator code exception safe.
- Added RegExIterator and RecursiveRegExIterator.
- Added full caching support and ArrayAccess to CachingIterator.
- Added array functions to ArrayObject/ArrayIterator and made them faster.
- Added support for reading csv and skipping empty lines in SplFileObject.
- Added CachingIterator::TOSTRING_USE_INNER, calls inner iterator __toString.
- Added ability to set the CSV separator per SplFileObject.
Improved xmlReader: (Rob)
- Added readInnerXml(), xmlReader::setSchema().
- Added readInnerXML(), readOuterXML(), readString(), setSchema(). (2.6.20+)
- Changed to passing libxml options when loading reader.
Fixed invalid read in imagecreatefrompng when an empty file is given (Pierre, Tony)
Fixed infinite loop when a wrong color index is given to imagefill (Pierre)
Fixed mess with CGI/CLI -d option (now it works with cgi; constants are working exactly like in php.ini; with FastCGI -d affects all requests). (Dmitry)
Fixed missing open_basedir check inside chdir() function. (Ilia)
Fixed overflow on 64bit systems in str_repeat() and wordwrap(). (Stefan E.)
Fixed XSLTProcessor::importStylesheet() to return TRUE on success (Christian)
Fixed leaks in openssl_csr_sign and openssl_csr_new (Pierre)
Fixed phpinfo() cutoff of variables at \0. (Ilia)
Fixed a bug in the filter extension that prevented magic_quotes_gpc from being applied when RAW filter is used. (Ilia)
Fixed memory leaks in openssl streams context options. (Pierre)
Fixed handling of extremely long paths inside tempnam() function. (Ilia)
Fixed bug #39304 Segmentation fault with list unpacking of string offset). (Dmitry)
Fixed bug #39192 Not including nsapi.h properly with SJSWS 7). This will make PHP 5.2 compatible to new Sun Webserver. (Uwe)
Fixed bug #39140 Uncaught exception may cause crash). (Dmitry)
Fixed bug #39125 Memleak when reflecting non-existing class/method). (Tony)
Fixed bug #39067 getDeclaringClass() and private properties). (Tony)
Fixed bug #39039 SSL: fatal protocol error when fetching HTTPS from servers running Google web server). (Ilia)
Fixed bug #39035 Compatibility issue between DOM and zend.ze1_compatibility_mode). (Rob)
Fixed bug #39034 curl_exec() with return transfer returns TRUE on empty files). (Ilia)
Fixed bug #39032 strcspn() stops on null character). (Tony)
Fixed bug #39020 PHP in FastCGI server mode crashes). (Dmitry)
Fixed bug #39017 foreach(($obj = new myClass) as $v); echo $obj; segfaults). (Dmitry)
Fixed bug #39004 Fixed generation of config.nice with autoconf 2.60). (Ilia)
Fixed bug #39003 __autoload() is called for type hinting). (Dmitry, Tony)
Fixed bug #39001 ReflectionProperty returns incorrect declaring class for protected properties). (Tony)
Fixed bug #38996 PDO_MYSQL doesn't check connections for liveness). (Tony)
Fixed bug #38993 Fixed safe_mode/open_basedir checks for session.save_path, allowing them to account for extra parameters). (Ilia)
Fixed bug #38989 Absolute path with slash at beginning doesn't work on win). (Dmitry)
Fixed bug #38985 Can't cast COM objects). (Wez)
Fixed bug #38981 using FTP URLs in get_headers() causes crash). (Tony)
Fixed bug #38963 Fixed a possible open_basedir bypass in tempnam()). (Ilia)
Fixed bug #38961 metaphone() results in segmentation fault on NetBSD). (Tony)
Fixed bug #38949 Cannot get xmlns value attribute). (Rob)
Fixed bug #38942 Double old-style-ctor inheritance). (Dmitry)
Fixed bug #38941 imap extension does not compile against new version of the imap library). (Ilia)
Fixed bug #38934 move_uploaded_file() cannot read uploaded file outside of open_basedir). (Ilia)
Fixed bug #38904 apache2filter changes cwd to /). (Ilia, Hannes)
Fixed bug #38891 get_headers() do not work with curl-wrappers). (Ilia)
Fixed bug #38882 ldap_connect causes segfault with newer versions of OpenLDAP). (Tony)
Fixed bug #38859 parse_url() fails if passing '@' in passwd). (Tony)
Fixed bug #38850 lookupNamespaceURI doesn't return default namespace). (Rob)
Fixed bug #38844 curl_easy_strerror() is defined only since cURL 7.12.0). (Tony)
Fixed bug #38813 DOMEntityReference->__construct crashes when called explicitly). (Rob)
Fixed bug #38808 "maybe ref" issue for current() and others). (Dmitry)
Fixed bug #38779 engine crashes when require()'ing file with syntax error through userspace stream wrapper). (Tony, Dmitry)
Fixed bug #38772 inconsistent overriding of methods in different visibility contexts). (Dmitry)
Fixed bug #38759 PDO sqlite2 empty query causes segfault). (Tony)
Fixed bug #38721 Invalid memory read in date_parse()). (Tony, Derick)
Fixed bug #38700 SoapClient::__getTypes never returns). (Dmitry)
Fixed bug #38693 curl_multi_add_handle() set curl handle to null). (Ilia)
Fixed bug #38687 sockaddr local storage insufficient for all sock families). (Sara)
Fixed bug #38661 mixed-case URL breaks url-wrappers). (Ilia)
Fixed bug #38653 memory leak in ReflectionClass::getConstant()). (Tony)
Fixed bug #38649 uninit'd optional arg in stream_socket_sendto()). (Sara)
Fixed bug #38637 curl_copy_handle() fails to fully copy the cURL handle). (Tony, Ilia)
Fixed bug #38624 Strange warning when incrementing an object property and exception is thrown from __get method). (Tony)
Fixed bug #38623 leaks in a tricky code with switch() and exceptions). (Dmitry)
Fixed bug #38579 include_once() may include the same file twice). (Dmitry)
Fixed bug #38574 missing curl constants and improper constant detection). (Ilia)
Fixed bug #38543 shutdown_executor() may segfault when memory_limit is too low). (Dmitry)
Fixed bug #38535 memory corruption in pdo_pgsql driver on error retrieval inside a failed query executed via query() method). (Ilia)
Fixed bug #38534 segfault when calling setlocale() in userspace session handler). (Tony)
Fixed bug #38524 strptime() does not initialize the internal date storage structure). (Ilia)
Fixed bugs #38511, #38473, #38263 (Fixed session extension request shutdown order to ensure it is shutdown before the extensions it may depend on). (Ilia)
Fixed bug #38488 Access to "php://stdin" and family crashes PHP on win32). (Dmitry)
Fixed bug #38474 getAttribute select attribute by order, even when prefixed). (Rob)
Fixed bug #38467 --enable-versioning causes make fail on OS X). (Tony)
Fixed bug #38465 ReflectionParameter fails if default value is an access to self::). (Johannes)
Fixed bug #38464 array_count_values() mishandles numeric strings). (Matt Wilmas, Ilia)
Fixed bug #38461 setting private attribute with __set() produces segfault). (Tony)
Fixed bug #38458 PECL bug #8944, PECL bug #7775 (error retrieving columns after long/text columns with PDO_ODBC). (Wez)
Fixed bug #38454 warning upon disabling handler via xml_set_element_handler). (dtorop933 at gmail dot com, Rob)
Fixed bug #38451 PDO_MYSQL doesn't compile on Solaris). (Tony)
Fixed bug #38450 constructor is not called for classes used in userspace stream wrappers). (Tony)
Fixed bug #38438 DOMNodeList->item(0) segfault on empty NodeList). (Ilia)
Fixed bug #38431 xmlrpc_get_type() crashes PHP on objects). (Tony)
Fixed bug #38427 unicode causes xml_parser to misbehave). (Rob)
Fixed bug #38424 Different attribute assignment if new or existing). (Rob)
Fixed bug #38400 Use of com.typelib_file may cause a crash). (Ilia)
Fixed bug #38394 PDO fails to recover from failed prepared statement execution). (Ilia)
Fixed bug #38377 session_destroy() gives warning after session_regenerate_id()). (Ilia)
Fixed bug #38357 dbase_open can't open DBase 3 dbf file). (rodrigo at fabricadeideias dot com, Mike)
Fixed bug #38354 Unwanted reformatting of XML when using AsXML). (Christian)
Fixed bug #38347 Segmentation fault when using foreach with an unknown/empty SimpleXMLElement). (Tony)
Fixed bug #38322 reading past array in sscanf() leads to arbitrary code execution). (Tony)
Fixed bug #38315 Constructing in the destructor causes weird behavior). (Dmitry)
Fixed bug #38303 spl_autoload_register() suppress all errors silently). (Ilia)
Fixed bug #38290 configure script ignores --without-cdb,inifile,flatfile). (Marcus)
Fixed bug #38289 segfault in session_decode() when _SESSION is NULL). (Tony)
Fixed bug #38287 static variables mess up global vars). (Dmitry)
Fixed bug #38278 session_cache_expire()'s value does not match phpinfo's session.cache_expire). (Tony)
Fixed bug #38276 file_exists() works incorrectly with long filenames on Windows). (Ilia, Tony)
Fixed bug #38269 fopen wrapper doesn't fail on invalid hostname with curlwrappers enabled). (Tony)
Fixed bug #38265 heap corruption). (Dmitry)
Fixed bug #38261 openssl_x509_parse() leaks with invalid cert) (Pierre)
Fixed bug #38255 openssl possible leaks while passing keys) (Pierre)
Fixed bug #38253 PDO produces segfault with default fetch mode). (Tony)
Fixed bug #38251 socket_select() and invalid arguments). (Tony)
Fixed bug #38236 Binary data gets corrupted on multipart/formdata POST). (Ilia)
Fixed bug #38234 Exception in __clone makes memory leak). (Dmitry, Nuno)
Fixed bug #38229 strtotime() does not parse YYYY-MM format). (Ilia)
Fixed bug #38224 session extension can't handle broken cookies). (Ilia)
Fixed bug #38220 Crash on some object operations). (Dmitry)
Fixed bug #38217 ReflectionClass::newInstanceArgs() tries to allocate too much memory). (Tony)
Fixed bug #38214 gif interlace output cannot work). (Pierre)
Fixed bugs #38213, #37611, #37571 (wddx encoding fails to handle certain characters). (Ilia)
Fixed bug #38212 Segfault on invalid imagecreatefromgd2part() parameters). (Pierre)
Fixed bug #38211 variable name and cookie name match breaks script execution). (Dmitry)
Fixed bug #38199 fclose() unable to close STDOUT and STDERR). (Tony)
Fixed bug #38198 possible crash when COM reports an exception). (Ilia)
Fixed bug #38194 ReflectionClass::isSubclassOf() returns TRUE for the class itself). (Ilia)
Fixed bug #38183 disable_classes=Foobar causes disabled class to be called Foo). (Jani)
Fixed bug #38179 imagecopy from a palette to a truecolor image loose alpha channel) (Pierre)
Fixed bug #38173 Freeing nested cursors causes OCI8 to segfault). (Tony)
Fixed bug #38168 Crash in pdo_pgsql on missing bound parameters). (Ilia)
Fixed bug #38161 oci_bind_by_name() returns garbage when Oracle didn't set the variable). (Tony)
Fixed bug #38146 Cannot use array returned from foo::__get('bar') in write context). (Dmitry)
Fixed bug #38132 ReflectionClass::getStaticProperties() retains \0 in key names). (Ilia)
Fixed bug #38125 undefined reference to spl_dual_it_free_storage). (Marcus)
Fixed bug #38112 corrupted gif segfaults) (Pierre)
Fixed bug #38096 large timeout values ignored on 32bit machines in stream_socket_accept() and stream_socket_client()). (Ilia)
Fixed bug #38086 stream_copy_to_stream() returns 0 when maxlen is bigger than the actual length). (Tony)
Fixed bug #38072 boolean arg for mysqli_autocommit() is always true on Solaris). (Tony)
Fixed bug #38067 Parameters are not decoded from utf-8 when using encoding option). (Dmitry)
Fixed bug #38064 ignored constructor visibility). (Marcus)
Fixed bug #38055 Wrong interpretation of boolean parameters). (Dmitry)
Fixed bug #38047 "file" and "line" sometimes not set in backtrace from inside error handler). (Dmitry)
Fixed bug #38019 segfault extending mysqli class). (Dmitry)
Fixed bug #38005 SoapFault faultstring doesn't follow encoding rules). (Dmitry)
Fixed bug #38004 Parameters in SoapServer are decoded twice). (Dmitry)
Fixed bug #38003 in classes inherited from MySQLi it's possible to call private constructors from invalid context). (Tony)
Fixed bug #37987 invalid return of file_exists() in safe mode). (Ilia)
Fixed bug #37947 zend_ptr_stack reallocation problem). (Dmitry)
Fixed bug #37945 pathinfo() cannot handle argument with special characters like German "Umlaut"). (Mike)
Fixed bug #37931 possible crash in OCI8 after database restart when using persistent connections). (Tony)
Fixed bug #37923 Display constant value in reflection::export). (Johannes)
Fixed bug #37920 compilation problems on z/OS). (Tony)
Fixed bug #37870 pgo_pgsql tries to de-allocate unused statements). (Ilia, ce at netage dot bg)
Fixed bug #37864 file_get_contents() leaks on empty file). (Hannes)
Fixed bug #37862 Integer pointer comparison to numeric value). (bugs-php at thewrittenword dot com)
Fixed bug #37846 wordwrap() wraps incorrectly). (ddk at krasn dot ru, Tony)
Fixed bug #37816 ReflectionProperty does not throw exception when accessing protected attribute). (Marcus)
Fixed bug #37811 define not using toString on objects). (Marcus)
Fixed bug #37807 segmentation fault during SOAP schema import). (Tony)
Fixed bug #37806 weird behavior of object type and comparison). (Marcus)
Fixed bug #37780 memory leak trying to execute a non existing file (CLI)). (Mike)
Fixed bug #37779 empty include_path leads to search for files inside /). (jr at terragate dot net, Ilia)
Fixed bug #37747 strtotime segfaults when given "nextyear"). (Derick)
Fixed bug #37720 merge_php_config scrambles values). (Mike, pumuckel at metropolis dot de)
Fixed bug #37709 Possible crash in PDO::errorCode()). (Ilia)
Fixed bug #37707 clone without assigning leaks memory). (Ilia, Nuno, Dmitri)
Fixed bug #37705 Semaphore constants not available). (Ilia)
Fixed bug #37671 MySQLi extension fails to recognize BIT column). (Ilia)
Fixed bug #37667 Object is not added into array returned by __get). (Marcus)
Fixed bug #37635 parameter of pcntl signal handler is trashed). (Mike)
Fixed bug #37632 Protected method access problem). (Marcus)
Fixed bug #37630 MySQL extensions should link against thread safe client libs if built with ZTS). (Mike)
Fixed bug #37620 mysqli_ssl_set validation is inappropriate). (Georg)
Fixed bug #37616 DATE_RFC822 does not product RFC 822 dates). (Hannes Magnusson, Derick)
Fixed bug #37614 Class name lowercased in error message). (Johannes)
Fixed bug #37587 var without attribute causes segfault). (Marcus)
Fixed bug #37586 Bumped minimum PCRE version to 6.6, needed for recursion limit support). (Ilia)
Fixed bug #37581 oci_bind_array_by_name clobbers input array when using SQLT_AFC, AVC). (Tony)
Fixed bug #37569 WDDX incorrectly encodes high-ascii characters). (Ilia)
Fixed bug #37565 Using reflection::export with simplexml causing a crash).