PHP Release 5.1.2


    PHP 5.1.2. Release Announcement

    The PHP development team is proud to announce the release of PHP 5.1.2. This release combines small feature enhancements with a fair number of bug fixes and addresses three security issues. All PHP 5 users are encouraged to upgrade to this release.

    The security issues resolved include the following:

    • HTTP Response Splitting has been addressed in ext/session and in the header() function. Header() can no longer be used to send multiple response headers in a single call.
    • Format string vulnerability in ext/mysqli.
    • Possible cross-site scripting problems in certain error conditions.

    The feature enhancements include the following notables:

    • Hash extension was added to core and is now enabled by default. This extension provides support for most common hashing algorithms without reliance on 3rd party libraries.
    • XMLWriter was added and enabled by default.
    • New OCI8 extension that includes numerous fixes.
    • PNG compression support added to the GD extension.
    • Added --enable-gcov configure option to enable C-level code coverage.
    • getNamespaces() and getDocNamespaces() methods added to SimpleXML extension.

    The release also includes over 85 bug fixes with a focus on:

    • Correction of the many regressions in the strtotime() function.
    • Fixes of several crashes, leaks and memory corruptions found in the imap, pdo, gd, mysqli, mcrypt and soap extensions.
    • Corrected problems with the usage of SSI and virtual() in the Apache2 SAPI.
    • Build fixes for iconv and sybase_ct extensions.
    • Fixed the previously broken Sun(rise|set) functions.
    • SQLite libraries upgraded to 2.8.17 and 3.2.8
    • Win32 binaries now include libxml2-2.6.22 and libxslt-1.1.15.

    For a full list of changes in PHP 5.1.2, see the ChangeLog.

    Source Code
    Change Logs
    added new extensions
    • Updated to libxml2-2.6.22 and libxslt-1.1.15 in the win32 bundle.
    • XMLWriter
    • Hash
    • Added PNG compression support to GD extension.
    • Added reflection constants as class constants.
    • Added --enable-gcov configure option to enable C-level code coverage.
    • Added missing support for 'B' format identifier to date() function.
    • Changed reflection to be an extension.
    improved spl extension
    • Added class SplFileInfo as root class for DirectoryIterator and SplFileObject
    • Added SplTempFileObject
    improved simplexml extension
    • Fixed memleaks
    • Fixed var_dump()
    • Fixed isset/empty/(bool) behavior
    • Fixed iterator edge cases
    • Added methods getNamespaces(), getDocNamespaces()
    • Upgraded pear to version 1.4.6.
    added constants for libxslt and libexslt versions
    • Fixed possible crash in apache_getenv()/apache_setenv() on invalid parameters.
    • Changed errors to warnings in imagecolormatch().
    • Fixed segfault/leak in imagecolormatch().
    • Fixed small leak in mysqli_stmt_fetch() when bound variable was empty string.
    • Fixed prepared statement name conflict handling in PDO_PGSQL.
    fixed memory corruption when pdo
    • Fixed possible leaks in imagecreatefromstring() with invalid data.
    • Fixed possible memory corruption inside mb_strcut().
    • Fixed possible header injection by limiting each header to a single line.
    • Fixed possible XSS inside error reporting functionality.
    • Fixed many bugs in OCI8.
    • Fixed crash and leak in mysqli when using 4.1.x client libraries and connecting to 5.x server.
    • Fixed bug #35916 (Duplicate calls to stream_bucket_append() lead to a crash).
    • Fixed bug #35908 (curl extension uses undefined GCRY_THREAD_OPTIONS_USER).
    • Fixed bug #35907 (PDO_OCI uses hardcoded lib path $ORACLE_HOME/lib).
    • Fixed bug #35887 (wddx_deserialize not parsing dateTime fields properly).
    • Fixed bug #35885 (strtotime("NOW") no longer works).
    • Fixed bug #35821 (array_map() segfaults when exception is throwed from the callback).
    • Fixed bug #35817 (unpack() does not decode odd number of hexadecimal values).
    fixed bug #35797 (segfault on pdostatement
    • Fixed bug #35781 (stream_filter_append() can cause segfault).
    • Fixed bug #35760 (sybase_ct doesn't compile on Solaris using old gcc).
    • Fixed bug #35759 (mysqli_stmt_bind_result() makes huge allocation when column empty).
    • Fixed bug #35751 (using date with a timestamp makes httpd segfault).
    • Fixed bug #35740 (memory leak when including a directory).
    fixed bug #35730 (ext/mssql + freetds
    • Fixed bug #35723 (xmlrpc_introspection.c fails compile per C99 std).
    • Fixed bug #35720 (A final constructor can be overwritten).
    • Fixed bug #35713 (getopt() returns array with numeric strings when passed options like '-1').
    • Fixed bug #35705 (strtotime() fails to parse soap date format without TZ).
    • Fixed bug #35699 (date() can't handle leap years before 1970).
    • Fixed bug #35694 (Improved error message for invalid fetch mode).
    • Fixed bug #35692 (iconv_mime_decode() segmentation fault; with libiconv only).
    • Fixed bug #35690 (pack() tries to allocate huge memory block when packing float values to strings).
    • Fixed bug #35669 (imap_mail_compose() crashes with multipart-multiboundary-email).
    • Fixed bug #35660 (AIX TZ variable format not understood, yields UTC timezone).
    • Fixed bug #35655 (whitespace following end of heredoc is lost).
    • Fixed bug #35630 (strtotime() crashes on certain relative identifiers).
    fixed bug #35629 (crash in http
    • Fixed bug #35624 (strtotime() does not handle 3 character weekdays).
    • Fixed bug #35612 (iis6 Access Violation crash).
    • Fixed bug #35594 (Multiple calls to getopt() may result in a crash).
    • Fixed bug #35571 (Fixed crash in Apache 2 SAPI when more then one php script is loaded via SSI include).
    • Fixed bug #35570 (segfault when re-using soap client object).
    • Fixed bug #35558 (mktime() interpreting 3 digit years incorrectly).
    • Fixed bug #35543 (php crash when calling non existing method of a class that extends PDO).
    • Fixed bug #35539 (typo in error message for ErrorException).
    • FIxed bug #35536 (mysql_field_type() doesn't handle NEWDECIMAL).
    • Fixed bug #35517 (mysql_stmt_fetch returns NULL on data truncation).
    • Fixed bug #35509 (string constant as array key has different behavior inside object).
    • Fixed bug #35508 (PDO fails when unknown fetch mode specified).
    • Fixed bug #35499 (strtotime() does not handle whitespace around the date string).
    • Fixed bug #35496 (Crash in mcrypt_generic()/mdecrypt_generic() without proper init).
    • Fixed bug #35490 (socket_sendto() unable to handle IPv6 addresses).
    • Fixed bug #35461 (Ming extension fails to compile with ming 0.3beta1).
    • Fixed bug #35437 (Segfault or Invalid Opcode 137/1/4).
    • Fixed bug #35470 (Assigning global using variable name from array doesn't function).
    • Fixed bug #35456 (+ 1 [time unit] format did not work).
    • Fixed bug #35447 (xml_parse_into_struct() chokes on the UTF-8 BOM).
    • Fixed bug #35431 (PDO crashes when using LAZY fetch with fetchAll).
    • Fixed bug #35430 (PDO crashes on incorrect FETCH_FUNC use).
    • Fixed bug #35427 (str_word_count() handles '-' incorrectly).
    • Fixed bug #35425 (idate() function ignores timezone settings).
    • Fixed bug #35422 (strtotime() does not parse times with UTC as timezone).
    • Fixed bug #35414 (strtotime() no longer works with ordinal suffix).
    • Fixed bug #35410 (wddx_deserialize() doesn't handle large ints as keys properly).
    • Fixed bug #35409 (undefined reference to 'rl_completion_matches').
    • Fixed bug #35399 (Since fix of bug #35273 SOAP decoding of soapenc:base64binary fails).
    • Fixed bug #35393 (changing static protected members from outside the class, one more reference issue).
    • Fixed bug #35381 (ssl library is not initialized properly).
    fixed bug #35377 (pdo_sqlite
    • Fixed bug #35373 (HP-UX "alias not allowed in this configuration").
    • Fixed bug #35288 (iconv() function defined as libiconv()).
    • Fixed bug #35103 (mysqli handles bad unsigned int incorrectly).(Andrey)
    • Fixed bug #35062 (socket_read() produces warnings on non blocking sockets).
    • Fixed bug #35028 (SimpleXML object fails FALSE test).
    • Fixed bug #34729 (Crash in ZTS mode under Apache).
    • Fixed bug #34429 (Output buffering cannot be turned off with FastCGI).
    • Fixed bug #34359 (Possible crash inside fopen http wrapper).
    • Fixed bug #33789 (Many Problems with SunFuncs).
    • Fixed bug #33671 (sun_rise and sun_set don't return a GMT timestamp if one passes an offset).
    • Fixed bug #32820 (date_sunrise and date_sunset don't handle GMT offset well).
    • Fixed bug #31347 (is_dir and is_file (incorrectly) return true for any string greater then 255 characters).
    • Fixed bug #30937 (date_sunrise() & date_sunset() don't handle endless day/night at high latitudes).
    • Fixed bug #30760 (Remove MessageBox on win32 for E_CORE errors if display_startup_error is off).
    • Fixed bug #29955 (mb_strtoupper() / lower() broken with Turkish encoding).
    • Fixed bug #28899 (mb_substr() and substr() behave differently when "mbstring.func_overload" is enabled).
    • Fixed bug #27678 (number_format() crashes with large numbers).
    PHP logo

    PHP is developed and maintained by a global community of contributors.

    The PHP Foundation helps fund this work. If PHP is part of your business or projects, consider sponsoring the Foundation.
    PHP

    Learn

    The PHP Foundation

    Legal

    Copyright © 2001 - 2026 the PHP Group. All Rights Reserved.
    To Top