[php-src] PHP-8.6: Merge branch 'PHP-8.4' into PHP-8.5

Author: Ilia Alshanetsky (iliaal) Date: 2026-10-04T10:54:53-04:00 Commit: https://github.com/php/php-src/commit/961335671562feb312219446fe809fe143e075ff Raw diff: https://github.com/php/php-src/commit/961335671562feb312219446fe809fe143e075ff.diff Merge branch 'PHP-8.4' into PHP-8.5 * PHP-8.4: ext/standard: Keep IPTC headers local to each call Changed paths: A ext/standard/tests/image/iptcembed_reentrant.phpt M NEWS M ext/standard/iptc.c Diff: diff --git a/NEWS b/NEWS index 9e7c1c4907c5..106af0768e77 100644 --- a/NEWS +++ b/NEWS @@ -194,6 +194,8 @@ PHP NEWS - Standard: . Fixed sha1_file() returning a digest for incomplete data after a stream read failure. (Ilia Alshanetsky) + . Fixed iptcembed() corrupting JPEG headers when called recursively from an + output handler. (Ilia Alshanetsky) . Fixed three Windows-only proc_open() defects: an uninitialized PROCESS_INFORMATION, an indeterminate comspec pointer after a failed lookup, and an unchecked CreateFileA() failure. (Ilia Alshanetsky) diff --git a/ext/standard/iptc.c b/ext/standard/iptc.c index 0f46ecd19bc7..85f54249dd58 100644 --- a/ext/standard/iptc.c +++ b/ext/standard/iptc.c @@ -175,11 +175,10 @@ static int php_iptc_next_marker(FILE *fp, int spool, unsigned char **spoolbuf, c } /* }}} */ -static char psheader[] = "\xFF\xED\0\0Photoshop 3.0\08BIM\x04\x04\0\0\0\0"; - /* {{{ Embed binary IPTC data into a JPEG image. */ PHP_FUNCTION(iptcembed) { + char psheader[] = "\xFF\xED\0\0Photoshop 3.0\08BIM\x04\x04\0\0\0\0"; char *iptcdata, *jpeg_file; size_t iptcdata_len, jpeg_file_len; zend_long spool = 0; diff --git a/ext/standard/tests/image/iptcembed_reentrant.phpt b/ext/standard/tests/image/iptcembed_reentrant.phpt new file mode 100644 index 000000000000..758e50378b02 --- /dev/null +++ b/ext/standard/tests/image/iptcembed_reentrant.phpt @@ -0,0 +1,34 @@ +--TEST-- +iptcembed() keeps APP13 headers local during reentrant output handling +--FILE-- +<?php +$file = __DIR__ . '/iptcembed_reentrant.jpg'; +file_put_contents($file, "\xff\xd8\xff\xe0\x00\x02\xff\xda\x00\x02"); +$output = ''; +$nested = false; +ob_start(function ($chunk) use (&$output, &$nested, $file) { + $output .= $chunk; + if (!$nested && str_ends_with($output, "\xff\xed")) { + $nested = true; + iptcembed(str_repeat('B', 256), $file, 0); + } + return ''; +}, 1); +iptcembed('AA', $file, 2); +ob_end_flush(); +$start = strpos($output, "\xff\xed"); +echo "Nested call: "; +var_dump($nested); +echo "APP13 length: "; +var_dump(unpack('n', substr($output, $start + 2, 2))[1]); +echo "Outer payload: "; +var_dump(substr($output, $start + 30, 2)); +?> +--CLEAN-- +<?php +unlink(__DIR__ . '/iptcembed_reentrant.jpg'); +?> +--EXPECT-- +Nested call: bool(true) +APP13 length: int(30) +Outer payload: string(2) "AA"