PHP Release 5.4.1


    PHP 5.4.1 Release Announcement

    The PHP development team announces the immediate availability of PHP 5.4.1. This release focuses on improving the stability of the PHP 5.4 branch with over 60 bug fixes, some of which are security related.

    Security Enhancements for PHP 5.4.1:

    • Fixed bug #54374 (Insufficient validating of upload name leading to corrupted $_FILES indices). (CVE-2012-1172). (Stas, lekensteyn at gmail dot com, Pierre)
    • Add open_basedir checks to readline_write_history and readline_read_history. (Rasmus, reported by Mateusz Goik)

    Key enhancements in PHP 5.4.1 include:

    • Added debug info handler to DOM objects. (Gustavo, Joey Smith)
    • Fixed bug #61172 (Add Apache 2.4 support). (Chris Jones)

    For a full list of changes in PHP 5.4.1, see the ChangeLog. For source downloads please visit our downloads page, Windows binaries can be found on windows.php.net/download/.

    All users of PHP are strongly encouraged to upgrade to PHP 5.4.1.

    Source Code
    Change Logs
    cli server
    • Fixed bug #61461 (missing checks around malloc() calls).
    • Implemented FR #60850 (Built in web server does not set $_SERVER['SCRIPT_FILENAME'] when using router).
    • "Connection: close" instead of "Connection: closed"
    core
    • Fixed crash in ZTS using same class in many threads.
    • Fixed bug #61374 (html_entity_decode tries to decode code points that don't exist in ISO-8859-1).
    • Fixed bug #61273 (call_user_func_array with more than 16333 arguments leaks / crashes).
    • Fixed bug #61225 (Incorrect lexing of 0b00*+<NUM>).
    • Fixed bug #61165 (Segfault - strip_tags()).
    • Fixed bug #61106 (Segfault when using header_register_callback).
    • Fixed bug #61087 (Memory leak in parse_ini_file when specifying invalid scanner mode).
    • Fixed bug #61072 (Memory leak when restoring an exception handler).
    • Fixed bug #61058 (array_fill leaks if start index is PHP_INT_MAX).
    • Fixed bug #61052 (Missing error check in trait 'insteadof' clause).
    • Fixed bug #61011 (Crash when an exception is thrown by __autoload accessing a static property).
    • Fixed bug #61000 (Exceeding max nesting level doesn't delete numerical vars).
    • Fixed bug #60978 (exit code incorrect).
    • Fixed bug #60911 (Confusing error message when extending traits).
    • Fixed bug #60801 (strpbrk() mishandles NUL byte).
    • Fixed bug #60717 (Order of traits in use statement can cause a fatal error).
    • Fixed bug #60573 (type hinting with "self" keyword causes weird errors).
    • Fixed bug #60569 (Nullbyte truncates Exception $message).
    • Fixed bug #52719 (array_walk_recursive crashes if third param of the function is by reference).
    • Improve performance of set_exception_handler while doing reset
    fileinfo
    • Fix fileinfo test problems.
    • FPM
    • Fixed bug #61430 (Transposed memset() params in sapi/fpm/fpm/fpm_shm.c).
    • Ibase
    • Fixed bug #60947 (Segmentation fault while executing ibase_db_info).
    • Installation
    • Fixed bug #61172 (Add Apache 2.4 support).
    intl
    • Fixed bug #61487 (Incorrent bounds checking in grapheme_strpos).
    mbstring
    • MFH mb_ereg_replace_callback() for security enhancements.
    • mysqli
    • Fixed bug #61003 (mysql_stat() require a valid connection). .
    • mysqlnd
    • Fixed bug #61704 (Crash apache, phpinfo() threading issue).
    • Fixed bug #60948 (mysqlnd FTBFS when -Wformat-security is enabled).
    • PDO
    • Fixed bug #61292 (Segfault while calling a method on an overloaded PDO object).
    • PDO_mysql
    • Fixed bug #61207 (PDO::nextRowset() after a multi-statement query doesn't always work).
    • Fixed bug #61194 (PDO should export compression flag with myslqnd).
    • PDO_odbc
    • Fixed bug #61212 (PDO ODBC Segfaults on SQL_SUCESS_WITH_INFO).
    • Phar
    • Fixed bug #61184 (Phar::webPhar() generates headers with trailing NUL bytes).
    readline
    • Fixed bug #61088 (Memory leak in readline_callback_handler_install).
    reflection
    • Implemented FR #61602 (Allow access to the name of constant used as function/method parameter's default value).
    • Fixed bug #60968 (Late static binding doesn't work with ReflectionMethod::invokeArgs()).
    • Session
    • Fixed bug #60634 (Segmentation fault when trying to die() in SessionHandler::write()).
    • SOAP
    • Fixed bug #61423 (gzip compression fails).
    • Fixed bug #60887 (SoapClient ignores user_agent option and sends no User-Agent header).
    • Fixed bug #60842, #51775 (Chunked response parsing error when chunksize length line is > 10 bytes).
    • Fixed bug #49853 (Soap Client stream context header option ignored).
    spl
    • Fixed bug #61453 (SplObjectStorage does not identify objects correctly).
    • Fixed bug #61347 (inconsistent isset behavior of Arrayobject).
    standard
    • Fixed memory leak in substr_replace.
    • Make max_file_uploads ini directive settable outside of php.ini
    • Fixed bug #61409 (Bad formatting on phpinfo()).
    • Fixed bug #60222 (time_nanosleep() does validate input params).
    • Fixed bug #60106 (stream_socket_server silently truncates long unix socket paths).
    xmlrpc
    • Fixed bug #61264 (xmlrpc_parse_method_descriptions leaks temporary variable).
    • Fixed bug #61097 (Memory leak in xmlrpc functions copying zvals).
    zlib
    • Fixed bug #61306 (initialization of global inappropriate for ZTS).
    • Fixed bug #61287 (A particular string fails to decompress).
    • Fixed bug #61139 (gzopen leaks when specifying invalid mode).
    PHP logo

    PHP is developed and maintained by a global community of contributors.

    The PHP Foundation helps fund this work. If PHP is part of your business or projects, consider sponsoring the Foundation.
    PHP

    Learn

    The PHP Foundation

    Legal

    Copyright © 2001 - 2026 the PHP Group. All Rights Reserved.
    To Top