[pull] master from php:master

NEWS

@@ -2,9 +2,15 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 8.6.0beta3
 
+- BCMath:
+  . Fixed out-of-bounds read in bc_is_zero_for_scale() when scale exceeds
+    n_scale. (Ilia Alshanetsky)
+
 - Core:
   . Calling is_a() or is_subclass_of() with a string as the first argument
     when $allow_string is false is now deprecated. (Daniel Scherzer)
+  . Fixed bug GH-23232 (lone namespace separator asks the autoloader for an
+    empty class name). (spawnia)
 
 - CLI:
   . Fixed bug GH-23242 (PHP development server does not support Expect
@@ -71,6 +77,10 @@ PHP                                                                        NEWS
   . Fixed WSDL cache corruption when a soap:header defines headerfaults.
     (Ilia Alshanetsky)
 
+- Sodium:
+  . Added support for the libsodium 1.0.22 KEM APIs (X-Wing and ML-KEM768).
+    (Zachary DuBois)
+
 - Standard:
   . Fixed a segfault when a stream filter callback unsets StreamBucket::$data
     before re-attaching the bucket. (iliaal)
@@ -79,6 +89,8 @@ PHP                                                                        NEWS
   . Fixed read buffer compaction in php_stream_filter_flush(). (crystarm)
   . Io\Poll\Context::wait() now rejects a $maxEvents value greater than
     INT_MAX instead of truncating it. (marc-mabe)
+  . Fixed GH-23338 (fsockopen()/pfsockopen() ValueError reported wrong
+    argument number for $timeout). (lacatoire)
 
 - SimpleXML:
   . Fixed writing to a dimension of the object returned by attributes() not
@@ -346,6 +358,10 @@ PHP                                                                        NEWS
     (Girgias)
 
 - Standard:
+  . Passing an object as the $data argument to http_build_query() is now
+    deprecated. The interpretation of object values within $data as arrays
+    is also deprecated. Convert objects to arrays with get_object_vars()
+    before calling the function. (Girgias)
   . Added the "filter.max_filter_count" stream context option for php://filter
     URLs. Using more than 16 filters without configuring this option is now
     deprecated. (Sjoerd Langkemper)

UPGRADING

@@ -624,6 +624,11 @@ PHP 8.6 UPGRADE NOTES
   . Passing an object to array_walk{_recursive} is now deprecated. Use
     get_object_vars() on the object instead.
     RFC: https://wiki.php.net/rfc/deprecations_php_8_6#passing_objects_for_array_parameter_of_array_walk_and_array_walk_recursive
+  . Passing an object as the $data argument to http_build_query() is now
+    deprecated. The interpretation of object values within $data as arrays
+    is also deprecated. Convert objects to arrays with get_object_vars()
+    before calling the function.
+    RFC: https://wiki.php.net/rfc/deprecations_php_8_6#passing_objects_for_data_parameter_of_http_build_query
   . The is_double() function is now deprecated. Use is_float() instead.
     RFC: https://wiki.php.net/rfc/deprecations_php_8_6#deprecate_is_double
   . The is_long() and is_integer() functions are now deprecated. Use is_int()
@@ -763,6 +768,20 @@ PHP 8.6 UPGRADE NOTES
   . snmp_set_output_option()
   . snmp_set_string_output_format()
 
+- Sodium:
+  . sodium_crypto_kem_keypair(), sodium_crypto_kem_seed_keypair(),
+    sodium_crypto_kem_secretkey(), sodium_crypto_kem_publickey(),
+    sodium_crypto_kem_enc() and sodium_crypto_kem_dec() expose the X-Wing
+    KEM (hybrid ML-KEM768+X25519, libsodium's recommended KEM).
+    Available when PHP is built against libsodium >= 1.0.22.
+  . sodium_crypto_kem_mlkem768_keypair(),
+    sodium_crypto_kem_mlkem768_seed_keypair(),
+    sodium_crypto_kem_mlkem768_secretkey(),
+    sodium_crypto_kem_mlkem768_publickey(),
+    sodium_crypto_kem_mlkem768_enc() and sodium_crypto_kem_mlkem768_dec()
+    expose the ML-KEM768 (FIPS 203) KEM.
+    Available when PHP is built against libsodium >= 1.0.22.
+
 - Standard:
   . clamp() returns the given value if in range, else returns the nearest
     bound.
@@ -917,6 +936,18 @@ PHP 8.6 UPGRADE NOTES
   . SODIUM_CRYPTO_XOF_TURBOSHAKE128_STATEBYTES.
   . SODIUM_CRYPTO_XOF_TURBOSHAKE256_BLOCKBYTES.
   . SODIUM_CRYPTO_XOF_TURBOSHAKE256_STATEBYTES.
+  . SODIUM_CRYPTO_KEM_PUBLICKEYBYTES (libsodium >= 1.0.22).
+  . SODIUM_CRYPTO_KEM_SECRETKEYBYTES (libsodium >= 1.0.22).
+  . SODIUM_CRYPTO_KEM_CIPHERTEXTBYTES (libsodium >= 1.0.22).
+  . SODIUM_CRYPTO_KEM_SHAREDSECRETBYTES (libsodium >= 1.0.22).
+  . SODIUM_CRYPTO_KEM_SEEDBYTES (libsodium >= 1.0.22).
+  . SODIUM_CRYPTO_KEM_KEYPAIRBYTES (libsodium >= 1.0.22).
+  . SODIUM_CRYPTO_KEM_MLKEM768_PUBLICKEYBYTES (libsodium >= 1.0.22).
+  . SODIUM_CRYPTO_KEM_MLKEM768_SECRETKEYBYTES (libsodium >= 1.0.22).
+  . SODIUM_CRYPTO_KEM_MLKEM768_CIPHERTEXTBYTES (libsodium >= 1.0.22).
+  . SODIUM_CRYPTO_KEM_MLKEM768_SHAREDSECRETBYTES (libsodium >= 1.0.22).
+  . SODIUM_CRYPTO_KEM_MLKEM768_SEEDBYTES (libsodium >= 1.0.22).
+  . SODIUM_CRYPTO_KEM_MLKEM768_KEYPAIRBYTES (libsodium >= 1.0.22).
 
 - Standard:
   . ARRAY_FILTER_USE_VALUE.

Zend/tests/gh23232.phpt

@@ -0,0 +1,27 @@
+--TEST--
+GH-23232 (lone namespace separator asks the autoloader for an empty class name)
+--FILE--
+<?php
+spl_autoload_register(function (string $class): void {
+    echo "autoload: '$class'\n";
+});
+
+foreach (['::a', '\::a', '\Foo::a', 'Foo::a'] as $callable) {
+    echo "is_callable(\"$callable\")\n";
+    var_dump(is_callable($callable));
+}
+
+var_dump(class_exists('\\'));
+?>
+--EXPECT--
+is_callable("::a")
+bool(false)
+is_callable("\::a")
+bool(false)
+is_callable("\Foo::a")
+autoload: 'Foo'
+bool(false)
+is_callable("Foo::a")
+autoload: 'Foo'
+bool(false)
+bool(false)

Zend/zend_execute_API.c

@@ -1221,6 +1221,10 @@ ZEND_API zend_class_entry *zend_lookup_class_ex(zend_string *name, zend_string *
 		}
 
 		if (ZSTR_VAL(name)[0] == '\\') {
+			if (ZSTR_LEN(name) == 1) {
+				/* A lone namespace separator names no class, e.g. is_callable('\::method'). */
+				return NULL;
+			}
 			lc_name = zend_string_alloc(ZSTR_LEN(name) - 1, 0);
 			zend_str_tolower_copy(ZSTR_VAL(lc_name), ZSTR_VAL(name) + 1, ZSTR_LEN(name) - 1);
 		} else {

ext/bcmath/libbcmath/src/zero.c

@@ -45,6 +45,10 @@ bool bc_is_zero_for_scale(bc_num num, size_t scale)
 		return true;
 	}
 
+	if (scale > num->n_scale) {
+		scale = num->n_scale;
+	}
+
 	/* Initialize */
 	count = num->n_len + scale;
 	nptr = num->n_value;

ext/bcmath/tests/bc_is_zero_for_scale_clamp.phpt

@@ -0,0 +1,12 @@
+--TEST--
+bc_is_zero_for_scale clamps scale to n_scale (Number::compare opposite signs)
+--EXTENSIONS--
+bcmath
+--FILE--
+<?php
+$shortZero = (new BcMath\Number('1.0'))->sub('1.0');
+$longNegative = new BcMath\Number('-0.' . str_repeat('0', 64) . '1');
+var_dump($shortZero->compare($longNegative, 64));
+?>
+--EXPECT--
+int(0)

ext/openssl/tests/bug38261.phpt

@@ -16,28 +16,28 @@ var_dump(openssl_x509_parse("foo"));
 
 try {
     var_dump(openssl_x509_parse($t));
-} catch (TypeError $e) {
-    echo $e->getMessage(), "\n";
+} catch (Throwable $e) {
+    echo $e::class, ': ', $e->getMessage(), "\n";
 }
 
 try {
     openssl_x509_parse([]);
-} catch (TypeError $e) {
-    echo $e->getMessage(), "\n";
+} catch (Throwable $e) {
+    echo $e::class, ': ', $e->getMessage(), "\n";
 }
 
 var_dump(openssl_x509_parse($cert));
 
 try {
     openssl_x509_parse(new stdClass);
-} catch (TypeError $e) {
-    echo $e->getMessage(), "\n";
+} catch (Throwable $e) {
+    echo $e::class, ': ', $e->getMessage(), "\n";
 }
 
 ?>
 --EXPECT--
 bool(false)
 bool(false)
-openssl_x509_parse(): Argument #1 ($certificate) must be of type OpenSSLCertificate|string, array given
+TypeError: openssl_x509_parse(): Argument #1 ($certificate) must be of type OpenSSLCertificate|string, array given
 bool(false)
-openssl_x509_parse(): Argument #1 ($certificate) must be of type OpenSSLCertificate|string, stdClass given
+TypeError: openssl_x509_parse(): Argument #1 ($certificate) must be of type OpenSSLCertificate|string, stdClass given

ext/openssl/tests/bug60632.phpt

@@ -20,9 +20,9 @@ $ekeys = array();
 
 try {
     $result = openssl_seal('test phrase', $encrypted, $ekeys, array($pubkey), 'AES-256-CBC');
-} catch (\ValueError $e) {
-    echo $e->getMessage() . \PHP_EOL;
+} catch (\Throwable $e) {
+    echo $e::class, ': ', $e->getMessage(), "\n";
 }
 ?>
 --EXPECT--
-openssl_seal(): Argument #6 ($iv) cannot be null for the chosen cipher algorithm
+ValueError: openssl_seal(): Argument #6 ($iv) cannot be null for the chosen cipher algorithm

ext/openssl/tests/bug68912.phpt

@@ -15,9 +15,9 @@ $var3=3;
 
 try {
     openssl_spki_new($var1, $var2, $var3);
-} catch (TypeError $e) {
-    echo $e->getMessage(), "\n";
+} catch (Throwable $e) {
+    echo $e::class, ': ', $e->getMessage(), "\n";
 }
 ?>
 --EXPECT--
-openssl_spki_new(): Argument #1 ($private_key) must be of type OpenSSLAsymmetricKey, resource given
+TypeError: openssl_spki_new(): Argument #1 ($private_key) must be of type OpenSSLAsymmetricKey, resource given

ext/openssl/tests/bug71475.phpt

@@ -7,11 +7,11 @@ openssl
 $_ = str_repeat("A", 512);
 try {
     openssl_seal($_, $_, $_, array_fill(0,64,0));
-} catch (TypeError $e) {
-    echo $e->getMessage(), "\n";
+} catch (Throwable $e) {
+    echo $e::class, ': ', $e->getMessage(), "\n";
 }
 ?>
 DONE
 --EXPECT--
-openssl_seal() expects at least 5 arguments, 4 given
+ArgumentCountError: openssl_seal() expects at least 5 arguments, 4 given
 DONE