From e9ae04062986023be41798f6a31b3acfcd0a49a2 Mon Sep 17 00:00:00 2001 From: arshidkv12 Date: Thu, 29 Jan 2026 13:51:53 +0530 Subject: [PATCH 1/3] Fix crash on (unset) cast in constant expression Fixes GH-21072 Closes GH-21073 --- NEWS | 2 ++ Zend/tests/ast/gh21072.phpt | 17 +++++++++++++++++ Zend/zend_compile.c | 3 +++ 3 files changed, 22 insertions(+) create mode 100644 Zend/tests/ast/gh21072.phpt diff --git a/NEWS b/NEWS index 8ec869035f0de..07c66ec833e0f 100644 --- a/NEWS +++ b/NEWS @@ -5,6 +5,8 @@ PHP NEWS - Core: . Fixed bug GH-21029 (zend_mm_heap corrupted on Aarch64, LTO builds). (Arnaud) . Fixed bug GH-21059 (Segfault when preloading constant AST closure). (ilutov) + . Fixed bug GH-21072 (Crash on (unset) cast in constant expression). + (arshidkv12) - Windows: . Fixed compilation with clang (missing intrin.h include). (Kévin Dunglas) diff --git a/Zend/tests/ast/gh21072.phpt b/Zend/tests/ast/gh21072.phpt new file mode 100644 index 0000000000000..1ffd0518eaea9 --- /dev/null +++ b/Zend/tests/ast/gh21072.phpt @@ -0,0 +1,17 @@ +--TEST-- +(unset) cast must not be allowed in constant expressions +--CREDITS-- +Viet Hoang Luu (@vi3tL0u1s) +--FILE-- +getMessage(); +} +?> +--EXPECTF-- +Fatal error: The (unset) cast is no longer supported in %s on line %d diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c index 8be1ee14f4859..80f85f421a331 100644 --- a/Zend/zend_compile.c +++ b/Zend/zend_compile.c @@ -12360,6 +12360,9 @@ static void zend_eval_const_expr(zend_ast **ast_ptr) /* {{{ */ zend_eval_const_expr(&ast->child[1]); return; case ZEND_AST_CAST: + if (ast->attr == IS_NULL) { + zend_error_noreturn(E_COMPILE_ERROR, "The (unset) cast is no longer supported"); + } zend_eval_const_expr(&ast->child[0]); if (ast->child[0]->kind == ZEND_AST_ZVAL && zend_try_ct_eval_cast(&result, ast->attr, zend_ast_get_zval(ast->child[0]))) { From 5ce36453d66143548485cb57fb19bf4157ab60c2 Mon Sep 17 00:00:00 2001 From: Arshid Date: Thu, 29 Jan 2026 21:49:14 +0530 Subject: [PATCH 2/3] [skip ci] Use STANDARD_MODULE_HEADER for ext-date (GH-21080) --- ext/date/php_date.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/ext/date/php_date.c b/ext/date/php_date.c index 8f98589b2b47e..e462b70d2cff2 100644 --- a/ext/date/php_date.c +++ b/ext/date/php_date.c @@ -370,9 +370,7 @@ static int date_object_compare_timezone(zval *tz1, zval *tz2); /* {{{ Module struct */ zend_module_entry date_module_entry = { - STANDARD_MODULE_HEADER_EX, - NULL, - NULL, + STANDARD_MODULE_HEADER, "date", /* extension name */ ext_functions, /* function list */ PHP_MINIT(date), /* process startup */ From ce798afac393a70653b34be66eb662b824bed032 Mon Sep 17 00:00:00 2001 From: David CARLIER Date: Thu, 29 Jan 2026 19:49:45 +0000 Subject: [PATCH 3/3] Fix GH-21058: error_log() crash on null destination argument. (#21064) we preserve the lower branches behavior by letting php_stream_open_wrapper_ex handling the null path and propagating the exception. close GH-21064 --- NEWS | 2 ++ ext/standard/basic_functions.c | 2 +- ext/standard/tests/general_functions/gh21058.phpt | 13 +++++++++++++ 3 files changed, 16 insertions(+), 1 deletion(-) create mode 100644 ext/standard/tests/general_functions/gh21058.phpt diff --git a/NEWS b/NEWS index bf00d8f663b90..be349610ff86f 100644 --- a/NEWS +++ b/NEWS @@ -101,6 +101,8 @@ PHP NEWS while COW violation flag is still set). (alexandre-daubois) . Invalid mode values now throw in array_filter() instead of being silently defaulted to 0. (Jorg Sowa) + . Fixed bug GH-21058 (error_log() crashes with message_type 3 and + null destination). (David Carlier) - Streams: . Added so_keepalive, tcp_keepidle, tcp_keepintvl and tcp_keepcnt stream diff --git a/ext/standard/basic_functions.c b/ext/standard/basic_functions.c index dc6146aec9d9c..1d7f2c1a9b59d 100644 --- a/ext/standard/basic_functions.c +++ b/ext/standard/basic_functions.c @@ -1369,7 +1369,7 @@ PHPAPI zend_result _php_error_log(int opt_err, const zend_string *message, const return FAILURE; case 3: /*save to a file */ - stream = php_stream_open_wrapper(ZSTR_VAL(opt), "a", REPORT_ERRORS, NULL); + stream = php_stream_open_wrapper(opt ? ZSTR_VAL(opt) : NULL, "a", REPORT_ERRORS, NULL); if (!stream) { return FAILURE; } diff --git a/ext/standard/tests/general_functions/gh21058.phpt b/ext/standard/tests/general_functions/gh21058.phpt new file mode 100644 index 0000000000000..598625a2017eb --- /dev/null +++ b/ext/standard/tests/general_functions/gh21058.phpt @@ -0,0 +1,13 @@ +--TEST-- +GH-21058 (error_log() crash with null destination and message type 3) +--FILE-- +getMessage(), PHP_EOL; +} +?> +--EXPECT-- +Path must not be empty