[php-src] master: Merge branch 'PHP-8.5' into PHP-8.6

Author: Ilia Alshanetsky (iliaal) Date: 2026-10-04T11:06:19-04:00 Commit: https://github.com/php/php-src/commit/a3fc68a05f43e38e779d8e4894d22d1fe1d376bd Raw diff: https://github.com/php/php-src/commit/a3fc68a05f43e38e779d8e4894d22d1fe1d376bd.diff Merge branch 'PHP-8.5' into PHP-8.6 * PHP-8.5: ext/standard: Keep IPTC headers local to each call Changed paths: A ext/standard/tests/image/iptcembed_reentrant.phpt M NEWS M ext/standard/iptc.c Diff: diff --git a/NEWS b/NEWS index 99882674dae3..9c885b9e9a44 100644 --- a/NEWS +++ b/NEWS @@ -126,6 +126,8 @@ PHP NEWS - Standard: . Fixed sha1_file() returning a digest for incomplete data after a stream read failure. (Ilia Alshanetsky) + . Fixed iptcembed() corrupting JPEG headers when called recursively from an + output handler. (Ilia Alshanetsky) - Tidy: . Fixed a use-after-free when a tidyNode is used after its document is diff --git a/ext/standard/iptc.c b/ext/standard/iptc.c index 59db612a7337..302892367b10 100644 --- a/ext/standard/iptc.c +++ b/ext/standard/iptc.c @@ -173,11 +173,10 @@ static int php_iptc_next_marker(FILE *fp, int spool, unsigned char **spoolbuf, c } /* }}} */ -static char psheader[] = "\xFF\xED\0\0Photoshop 3.0\08BIM\x04\x04\0\0\0\0"; - /* {{{ Embed binary IPTC data into a JPEG image. */ PHP_FUNCTION(iptcembed) { + char psheader[] = "\xFF\xED\0\0Photoshop 3.0\08BIM\x04\x04\0\0\0\0"; char *iptcdata, *jpeg_file; size_t iptcdata_len, jpeg_file_len; zend_long spool = 0; diff --git a/ext/standard/tests/image/iptcembed_reentrant.phpt b/ext/standard/tests/image/iptcembed_reentrant.phpt new file mode 100644 index 000000000000..758e50378b02 --- /dev/null +++ b/ext/standard/tests/image/iptcembed_reentrant.phpt @@ -0,0 +1,34 @@ +--TEST-- +iptcembed() keeps APP13 headers local during reentrant output handling +--FILE-- +<?php +$file = __DIR__ . '/iptcembed_reentrant.jpg'; +file_put_contents($file, "\xff\xd8\xff\xe0\x00\x02\xff\xda\x00\x02"); +$output = ''; +$nested = false; +ob_start(function ($chunk) use (&$output, &$nested, $file) { + $output .= $chunk; + if (!$nested && str_ends_with($output, "\xff\xed")) { + $nested = true; + iptcembed(str_repeat('B', 256), $file, 0); + } + return ''; +}, 1); +iptcembed('AA', $file, 2); +ob_end_flush(); +$start = strpos($output, "\xff\xed"); +echo "Nested call: "; +var_dump($nested); +echo "APP13 length: "; +var_dump(unpack('n', substr($output, $start + 2, 2))[1]); +echo "Outer payload: "; +var_dump(substr($output, $start + 30, 2)); +?> +--CLEAN-- +<?php +unlink(__DIR__ . '/iptcembed_reentrant.jpg'); +?> +--EXPECT-- +Nested call: bool(true) +APP13 length: int(30) +Outer payload: string(2) "AA"