[php-src] PHP-8.6: Merge branch 'PHP-8.4' into PHP-8.5

Author: Ilia Alshanetsky (iliaal) Date: 2026-10-05T20:36:01-04:00 Commit: https://github.com/php/php-src/commit/f590d93c706bc043d7f52117ddc4b73c6119fdb7 Raw diff: https://github.com/php/php-src/commit/f590d93c706bc043d7f52117ddc4b73c6119fdb7.diff Merge branch 'PHP-8.4' into PHP-8.5 * PHP-8.4: ext/standard: Fix convert.quoted-printable-decode of lowercase hex Changed paths: A ext/standard/tests/filters/qp_decode_lowercase.phpt M NEWS M ext/standard/filters.c Diff: diff --git a/NEWS b/NEWS index b04c1152ed4c..1039ef9a31e2 100644 --- a/NEWS +++ b/NEWS @@ -216,6 +216,8 @@ PHP NEWS . Fix persistent stream context lifetime during shutdown (Levi Morrison) . Fix wordwrap() ignoring an existing break at the end of the string (Nicolas Grekas) + . Fixed convert.quoted-printable-decode decoding lowercase hex digits to + the wrong byte. (Ilia Alshanetsky) - Tidy: . Fixed a use-after-free when a tidyNode is used after its document is diff --git a/ext/standard/filters.c b/ext/standard/filters.c index 60069ac0696f..764f38512f35 100644 --- a/ext/standard/filters.c +++ b/ext/standard/filters.c @@ -953,7 +953,7 @@ static php_conv_err_t php_conv_qprint_decode_convert(php_conv_qprint_decode *ins err = PHP_CONV_ERR_INVALID_SEQ; goto out; } - next_char = (next_char << 4) | (*ps >= 'A' ? *ps - 0x37 : *ps - 0x30); + next_char = (next_char << 4) | (*ps >= 'a' ? *ps - 0x57 : (*ps >= 'A' ? *ps - 0x37 : *ps - 0x30)); scan_stat++; ps++, icnt--; if (scan_stat != 3) { diff --git a/ext/standard/tests/filters/qp_decode_lowercase.phpt b/ext/standard/tests/filters/qp_decode_lowercase.phpt new file mode 100644 index 000000000000..50a6c454d370 --- /dev/null +++ b/ext/standard/tests/filters/qp_decode_lowercase.phpt @@ -0,0 +1,20 @@ +--TEST-- +convert.quoted-printable-decode: lowercase hex digits decode correctly +--FILE-- +<?php +foreach (['=cd', '=0a', '=da', '=CD', '=AB', '=ab'] as $in) { + $fp = fopen('php://temp', 'r+'); + fwrite($fp, $in); + rewind($fp); + stream_filter_append($fp, 'convert.quoted-printable-decode', STREAM_FILTER_READ); + echo $in, ' => ', bin2hex(stream_get_contents($fp)), "\n"; + fclose($fp); +} +?> +--EXPECT-- +=cd => cd +=0a => 0a +=da => da +=CD => cd +=AB => ab +=ab => ab