From b757a5c73b78aa3e7429b2fd9919960c8e3ccc9e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tim=20D=C3=BCsterhus?= Date: Tue, 13 Jan 2026 15:22:29 +0100 Subject: [PATCH 1/7] [skip ci] Fix typo in NEWS --- NEWS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/NEWS b/NEWS index b699badddbf3..754ab95409e6 100644 --- a/NEWS +++ b/NEWS @@ -11,7 +11,7 @@ PHP NEWS function triggered by bailout in php_output_lock_error()). (timwolla) . Fix OSS-Fuzz #471533782 (Infinite loop in GC destructor fiber). (ilutov) . Fix OSS-Fuzz #472563272 (Borked block_pass JMP[N]Z optimization). (ilutov) - . Fixed bug GH-GH-20914 (Internal enums can be cloned and compared). (Arnaud) + . Fixed bug GH-20914 (Internal enums can be cloned and compared). (Arnaud) . Fix OSS-Fuzz #474613951 (Leaked parent property default value). (ilutov) - MbString: From bf4f8f5c9c8e35473c4f55033437d8a6a622e193 Mon Sep 17 00:00:00 2001 From: Ilija Tovilo Date: Tue, 13 Jan 2026 14:47:26 +0100 Subject: [PATCH 2/7] Upgrade to mssql 2025 Closes GH-20924 --- .github/actions/setup-mssql/action.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/actions/setup-mssql/action.yml b/.github/actions/setup-mssql/action.yml index dd372a5637aa..cbd220d0b29e 100644 --- a/.github/actions/setup-mssql/action.yml +++ b/.github/actions/setup-mssql/action.yml @@ -11,4 +11,4 @@ runs: -p 1433:1433 \ --name sql1 \ -h sql1 \ - -d mcr.microsoft.com/mssql/server:2022-CU14-ubuntu-22.04 + -d mcr.microsoft.com/mssql/server:2025-latest From 11ae6ad0be9e6a3f9d02ec5be9ef28cd0567d438 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tim=20D=C3=BCsterhus?= Date: Tue, 13 Jan 2026 16:07:50 +0100 Subject: [PATCH 3/7] zend_language_parser: Backup / restore doc comment when parsing attributes (#20896) Attributes may themselves contain elements which can have a doc comment on their own (namely Closures). A doc comment before the attribute list is generally understood as belonging to the symbol having the attributes. Fixes php/php-src#20895. --- NEWS | 2 + Zend/zend_language_parser.y | 2 +- ext/reflection/tests/gh20895.phpt | 108 ++++++++++++++++++++++++++++++ 3 files changed, 111 insertions(+), 1 deletion(-) create mode 100644 ext/reflection/tests/gh20895.phpt diff --git a/NEWS b/NEWS index 754ab95409e6..6af8ce6b2cb9 100644 --- a/NEWS +++ b/NEWS @@ -13,6 +13,8 @@ PHP NEWS . Fix OSS-Fuzz #472563272 (Borked block_pass JMP[N]Z optimization). (ilutov) . Fixed bug GH-20914 (Internal enums can be cloned and compared). (Arnaud) . Fix OSS-Fuzz #474613951 (Leaked parent property default value). (ilutov) + . Fixed bug GH-20895 (ReflectionProperty does not return the PHPDoc of a + property if it contains an attribute with a Closure). (timwolla) - MbString: . Fixed bug GH-20833 (mb_str_pad() divide by zero if padding string is diff --git a/Zend/zend_language_parser.y b/Zend/zend_language_parser.y index e4d61006fe12..897abbbe9773 100644 --- a/Zend/zend_language_parser.y +++ b/Zend/zend_language_parser.y @@ -379,7 +379,7 @@ attribute_group: ; attribute: - T_ATTRIBUTE attribute_group possible_comma ']' { $$ = $2; } + T_ATTRIBUTE backup_doc_comment attribute_group possible_comma ']' { $$ = $3; CG(doc_comment) = $2; } ; attributes: diff --git a/ext/reflection/tests/gh20895.phpt b/ext/reflection/tests/gh20895.phpt new file mode 100644 index 000000000000..f281078de446 --- /dev/null +++ b/ext/reflection/tests/gh20895.phpt @@ -0,0 +1,108 @@ +--TEST-- +GH-20895: ReflectionProperty does not return the PHPDoc of a property if it contains an attribute with a Closure +--FILE-- +getDocComment()); +foreach ((new ReflectionClass(Foo::class))->getAttributes() as $attribute) { + foreach ($attribute->getArguments() as $argument) { + var_dump((new ReflectionFunction($argument))->getDocComment()); + } +} +var_dump((new ReflectionProperty(Foo::class, 'bar'))->getDocComment()); +foreach ((new ReflectionProperty(Foo::class, 'bar'))->getAttributes() as $attribute) { + foreach ($attribute->getArguments() as $argument) { + var_dump((new ReflectionFunction($argument))->getDocComment()); + } +} +var_dump((new ReflectionMethod(Foo::class, 'bar'))->getDocComment()); +foreach ((new ReflectionMethod(Foo::class, 'bar'))->getAttributes() as $attribute) { + foreach ($attribute->getArguments() as $argument) { + var_dump((new ReflectionFunction($argument))->getDocComment()); + } +} +var_dump((new ReflectionFunction('foo'))->getDocComment()); +foreach ((new ReflectionFunction('foo'))->getAttributes() as $attribute) { + foreach ($attribute->getArguments() as $argument) { + var_dump((new ReflectionFunction($argument))->getDocComment()); + } +} +var_dump((new ReflectionFunction('bar'))->getDocComment()); +foreach ((new ReflectionFunction('bar'))->getAttributes() as $attribute) { + foreach ($attribute->getArguments() as $argument) { + var_dump((new ReflectionFunction($argument))->getDocComment()); + } +} +var_dump((new ReflectionFunction('baz'))->getDocComment()); +foreach ((new ReflectionFunction('baz'))->getAttributes() as $attribute) { + foreach ($attribute->getArguments() as $argument) { + var_dump((new ReflectionFunction($argument))->getDocComment()); + } +} + +?> +--EXPECT-- +string(10) "/** Foo */" +string(16) "/** Closure 1 */" +string(16) "/** Closure 2 */" +string(16) "/** Foo::$bar */" +string(16) "/** Closure 3 */" +string(16) "/** Closure 4 */" +string(16) "/** Closure 5 */" +string(17) "/** Foo::bar() */" +string(16) "/** Closure 6 */" +string(12) "/** foo() */" +string(16) "/** Closure 7 */" +string(12) "/** bar() */" +string(16) "/** Closure 8 */" +string(12) "/** baz() */" +bool(false) From 648ad5be3109afdd448a2b9c5b6d2329fa62cc5f Mon Sep 17 00:00:00 2001 From: Ilija Tovilo Date: Tue, 13 Jan 2026 14:49:21 +0100 Subject: [PATCH 4/7] [skip ci] Upgrade to Ubuntu 24.04 for PECL and coverage builds --- .github/workflows/nightly.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml index 00e2cbb43c23..fc490f079b6b 100644 --- a/.github/workflows/nightly.yml +++ b/.github/workflows/nightly.yml @@ -436,7 +436,7 @@ jobs: FIREBIRD_DATABASE: test.fdb FIREBIRD_USER: test FIREBIRD_PASSWORD: test - runs-on: ubuntu-22.04 + runs-on: ubuntu-24.04 steps: - name: git checkout uses: actions/checkout@v6 @@ -877,7 +877,7 @@ jobs: uses: ./.github/actions/verify-generated-files PECL: if: inputs.branch == 'master' - runs-on: ubuntu-22.04 + runs-on: ubuntu-24.04 env: CC: ccache gcc CXX: ccache g++ @@ -924,6 +924,8 @@ jobs: sudo apt-get install -y --no-install-recommends \ ccache \ libmemcached-dev \ + imagemagick \ + libmagickwand-dev \ bison \ re2c - name: ccache From ba581b931a6c090dcf783df936a1344f6cd9246e Mon Sep 17 00:00:00 2001 From: Ilija Tovilo Date: Tue, 13 Jan 2026 16:13:30 +0100 Subject: [PATCH 5/7] [skip ci] Use ubuntu-latest for docs No need to keep bumping this build if breakage is unlikely. Closes GH-20926 --- .github/workflows/docs.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 0ab56f77ab3f..ffb45c9a20cd 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -10,7 +10,7 @@ on: - docs/** jobs: pages: - runs-on: ubuntu-22.04 + runs-on: ubuntu-latest permissions: pages: write id-token: write From 3c654a85742482fab213f76107b296585cf77366 Mon Sep 17 00:00:00 2001 From: Niels Dossche <7771979+ndossche@users.noreply.github.com> Date: Tue, 23 Dec 2025 00:35:14 +0100 Subject: [PATCH 6/7] date: Remove unused argument for internal functions --- ext/date/php_date.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/ext/date/php_date.c b/ext/date/php_date.c index 692136bbad2a..4494f79a0dbc 100644 --- a/ext/date/php_date.c +++ b/ext/date/php_date.c @@ -4063,7 +4063,7 @@ PHP_METHOD(DateTimeZone, __construct) } /* }}} */ -static bool php_date_timezone_initialize_from_hash(zval **return_value, php_timezone_obj **tzobj, const HashTable *myht) /* {{{ */ +static bool php_date_timezone_initialize_from_hash(php_timezone_obj **tzobj, const HashTable *myht) /* {{{ */ { zval *z_timezone_type; @@ -4104,7 +4104,7 @@ PHP_METHOD(DateTimeZone, __set_state) php_date_instantiate(date_ce_timezone, return_value); tzobj = Z_PHPTIMEZONE_P(return_value); - if (!php_date_timezone_initialize_from_hash(&return_value, &tzobj, myht)) { + if (!php_date_timezone_initialize_from_hash(&tzobj, myht)) { zend_throw_error(NULL, "Invalid serialization data for DateTimeZone object"); RETURN_THROWS(); } @@ -4124,7 +4124,7 @@ PHP_METHOD(DateTimeZone, __wakeup) myht = Z_OBJPROP_P(object); - if (!php_date_timezone_initialize_from_hash(&return_value, &tzobj, myht)) { + if (!php_date_timezone_initialize_from_hash(&tzobj, myht)) { zend_throw_error(NULL, "Invalid serialization data for DateTimeZone object"); RETURN_THROWS(); } @@ -4188,7 +4188,7 @@ PHP_METHOD(DateTimeZone, __unserialize) tzobj = Z_PHPTIMEZONE_P(object); - if (!php_date_timezone_initialize_from_hash(&object, &tzobj, myht)) { + if (!php_date_timezone_initialize_from_hash(&tzobj, myht)) { zend_throw_error(NULL, "Invalid serialization data for DateTimeZone object"); RETURN_THROWS(); } @@ -4613,7 +4613,7 @@ PHP_METHOD(DateInterval, __construct) } /* }}} */ -static void php_date_interval_initialize_from_hash(zval **return_value, php_interval_obj **intobj, const HashTable *myht) /* {{{ */ +static void php_date_interval_initialize_from_hash(php_interval_obj **intobj, const HashTable *myht) /* {{{ */ { /* If we have a date_string, use that instead */ const zval *date_str = zend_hash_str_find(myht, "date_string", strlen("date_string")); @@ -4752,7 +4752,7 @@ PHP_METHOD(DateInterval, __set_state) php_date_instantiate(date_ce_interval, return_value); intobj = Z_PHPINTERVAL_P(return_value); - php_date_interval_initialize_from_hash(&return_value, &intobj, myht); + php_date_interval_initialize_from_hash(&intobj, myht); } /* }}} */ @@ -4823,7 +4823,7 @@ PHP_METHOD(DateInterval, __unserialize) intervalobj = Z_PHPINTERVAL_P(object); - php_date_interval_initialize_from_hash(&object, &intervalobj, myht); + php_date_interval_initialize_from_hash(&intervalobj, myht); restore_custom_dateinterval_properties(object, myht); } /* }}} */ @@ -4841,7 +4841,7 @@ PHP_METHOD(DateInterval, __wakeup) myht = Z_OBJPROP_P(object); - php_date_interval_initialize_from_hash(&return_value, &intobj, myht); + php_date_interval_initialize_from_hash(&intobj, myht); } /* }}} */ From d86182f7efa8066d53c4fe3c940907ff75d12133 Mon Sep 17 00:00:00 2001 From: Niels Dossche <7771979+ndossche@users.noreply.github.com> Date: Tue, 23 Dec 2025 00:37:29 +0100 Subject: [PATCH 7/7] date: Avoid passing objects using double pointers Using single pointers is cleaner and also generates better machine code. --- ext/date/php_date.c | 54 ++++++++++++++++++++++----------------------- 1 file changed, 27 insertions(+), 27 deletions(-) diff --git a/ext/date/php_date.c b/ext/date/php_date.c index 4494f79a0dbc..8f98589b2b47 100644 --- a/ext/date/php_date.c +++ b/ext/date/php_date.c @@ -4613,7 +4613,7 @@ PHP_METHOD(DateInterval, __construct) } /* }}} */ -static void php_date_interval_initialize_from_hash(php_interval_obj **intobj, const HashTable *myht) /* {{{ */ +static void php_date_interval_initialize_from_hash(php_interval_obj *intobj, const HashTable *myht) /* {{{ */ { /* If we have a date_string, use that instead */ const zval *date_str = zend_hash_str_find(myht, "date_string", strlen("date_string")); @@ -4635,15 +4635,15 @@ static void php_date_interval_initialize_from_hash(php_interval_obj **intobj, co } /* If ->diff is already set, then we need to free it first */ - if ((*intobj)->diff) { - timelib_rel_time_dtor((*intobj)->diff); + if (intobj->diff) { + timelib_rel_time_dtor(intobj->diff); } - (*intobj)->diff = timelib_rel_time_clone(&time->relative); - (*intobj)->initialized = true; - (*intobj)->civil_or_wall = PHP_DATE_CIVIL; - (*intobj)->from_string = true; - (*intobj)->date_string = zend_string_copy(Z_STR_P(date_str)); + intobj->diff = timelib_rel_time_clone(&time->relative); + intobj->initialized = true; + intobj->civil_or_wall = PHP_DATE_CIVIL; + intobj->from_string = true; + intobj->date_string = zend_string_copy(Z_STR_P(date_str)); timelib_time_dtor(time); timelib_error_container_dtor(err); @@ -4652,20 +4652,20 @@ static void php_date_interval_initialize_from_hash(php_interval_obj **intobj, co } /* If ->diff is already set, then we need to free it first */ - if ((*intobj)->diff) { - timelib_rel_time_dtor((*intobj)->diff); + if (intobj->diff) { + timelib_rel_time_dtor(intobj->diff); } /* Set new value */ - (*intobj)->diff = timelib_rel_time_ctor(); + intobj->diff = timelib_rel_time_ctor(); #define PHP_DATE_INTERVAL_READ_PROPERTY(element, member, itype, def) \ do { \ zval *z_arg = zend_hash_str_find(myht, element, sizeof(element) - 1); \ if (z_arg && Z_TYPE_P(z_arg) <= IS_STRING) { \ - (*intobj)->diff->member = (itype)zval_get_long(z_arg); \ + intobj->diff->member = (itype)zval_get_long(z_arg); \ } else { \ - (*intobj)->diff->member = (itype)def; \ + intobj->diff->member = (itype)def; \ } \ } while (0); @@ -4675,10 +4675,10 @@ static void php_date_interval_initialize_from_hash(php_interval_obj **intobj, co if (z_arg && Z_TYPE_P(z_arg) <= IS_STRING) { \ zend_string *tmp_str; \ zend_string *str = zval_get_tmp_string(z_arg, &tmp_str); \ - DATE_A64I((*intobj)->diff->member, ZSTR_VAL(str)); \ + DATE_A64I(intobj->diff->member, ZSTR_VAL(str)); \ zend_tmp_string_release(tmp_str); \ } else { \ - (*intobj)->diff->member = -1LL; \ + intobj->diff->member = -1LL; \ } \ } while (0); @@ -4686,14 +4686,14 @@ static void php_date_interval_initialize_from_hash(php_interval_obj **intobj, co do { \ zval *z_arg = zend_hash_str_find(myht, "days", sizeof("days") - 1); \ if (z_arg && Z_TYPE_P(z_arg) == IS_FALSE) { \ - (*intobj)->diff->member = TIMELIB_UNSET; \ + intobj->diff->member = TIMELIB_UNSET; \ } else if (z_arg && Z_TYPE_P(z_arg) <= IS_STRING) { \ zend_string *tmp_str; \ zend_string *str = zval_get_tmp_string(z_arg, &tmp_str); \ - DATE_A64I((*intobj)->diff->member, ZSTR_VAL(str)); \ + DATE_A64I(intobj->diff->member, ZSTR_VAL(str)); \ zend_tmp_string_release(tmp_str); \ } else { \ - (*intobj)->diff->member = -1LL; \ + intobj->diff->member = -1LL; \ } \ } while (0); @@ -4701,9 +4701,9 @@ static void php_date_interval_initialize_from_hash(php_interval_obj **intobj, co do { \ zval *z_arg = zend_hash_str_find(myht, element, sizeof(element) - 1); \ if (z_arg) { \ - (*intobj)->diff->member = (double)zval_get_double(z_arg); \ + intobj->diff->member = (double)zval_get_double(z_arg); \ } else { \ - (*intobj)->diff->member = (double)def; \ + intobj->diff->member = (double)def; \ } \ } while (0); @@ -4716,7 +4716,7 @@ static void php_date_interval_initialize_from_hash(php_interval_obj **intobj, co { const zval *z_arg = zend_hash_str_find(myht, "f", sizeof("f") - 1); if (z_arg) { - (*intobj)->diff->us = zend_dval_to_lval(zval_get_double(z_arg) * 1000000.0); + intobj->diff->us = zend_dval_to_lval(zval_get_double(z_arg) * 1000000.0); } } PHP_DATE_INTERVAL_READ_PROPERTY("weekday", weekday, int, -1) @@ -4730,14 +4730,14 @@ static void php_date_interval_initialize_from_hash(php_interval_obj **intobj, co PHP_DATE_INTERVAL_READ_PROPERTY("have_special_relative", have_special_relative, unsigned int, 0); { const zval *z_arg = zend_hash_str_find(myht, "civil_or_wall", sizeof("civil_or_wall") - 1); - (*intobj)->civil_or_wall = PHP_DATE_CIVIL; + intobj->civil_or_wall = PHP_DATE_CIVIL; if (z_arg) { zend_long val = zval_get_long(z_arg); - (*intobj)->civil_or_wall = val; + intobj->civil_or_wall = val; } } - (*intobj)->initialized = true; + intobj->initialized = true; } /* }}} */ /* {{{ */ @@ -4752,7 +4752,7 @@ PHP_METHOD(DateInterval, __set_state) php_date_instantiate(date_ce_interval, return_value); intobj = Z_PHPINTERVAL_P(return_value); - php_date_interval_initialize_from_hash(&intobj, myht); + php_date_interval_initialize_from_hash(intobj, myht); } /* }}} */ @@ -4823,7 +4823,7 @@ PHP_METHOD(DateInterval, __unserialize) intervalobj = Z_PHPINTERVAL_P(object); - php_date_interval_initialize_from_hash(&intervalobj, myht); + php_date_interval_initialize_from_hash(intervalobj, myht); restore_custom_dateinterval_properties(object, myht); } /* }}} */ @@ -4841,7 +4841,7 @@ PHP_METHOD(DateInterval, __wakeup) myht = Z_OBJPROP_P(object); - php_date_interval_initialize_from_hash(&intobj, myht); + php_date_interval_initialize_from_hash(intobj, myht); } /* }}} */