Version 7.1

    PHP 7.1.33
    Released 24 Oct, 2019
    fpm
    • Fixed bug #78599 (env_path_info underflow in fpm_main.c can lead to RCE). (CVE-2019-11043)
    PHP 7.1.32
    Released 29 Aug, 2019
    mbstring
    • Fixed CVE-2019-13224 (don't allow different encodings for onig_new_deluxe)
    pcre
    • Fixed bug #75457 (heap use-after-free in pcrelib)
    PHP 7.1.31
    Released 01 Aug, 2019
    sqlite
    • Upgraded to SQLite 3.28.0.
    exif
    • Fixed bug #78256 (heap-buffer-overflow on exif_process_user_comment). (CVE-2019-11042)
    • Fixed bug #78222 (heap-buffer-overflow on exif_scan_thumbnail). (CVE-2019-11041)
    phar
    • Fixed bug #77919 (Potential UAF in Phar RSHUTDOWN).
    PHP 7.1.30
    Released 30 May, 2019
    exif
    • Fixed bug #77988 (heap-buffer-overflow on php_jpg_get16). (CVE-2019-11040)
    gd
    • Fixed bug #77973 (Uninitialized read in gdImageCreateFromXbm). (CVE-2019-11038)
    iconv
    • Fixed bug #78069 (Out-of-bounds read in iconv.c:_php_iconv_mime_decode() due to integer overflow). (CVE-2019-11039).
    sqlite
    • Fixed bug #77967 (Bypassing open_basedir restrictions via file uris).
    PHP 7.1.29
    Released 02 May, 2019
    exif
    • Fixed bug #77950 (Heap-buffer-overflow in _estrndup via exif_process_IFD_TAG). (CVE-2019-11036)
    mail
    • Fixed bug #77821 (Potential heap corruption in TSendMail()).
    PHP 7.1.28
    Released 02 May, 2019
    exif
    • Fixed bug #77753 (Heap-buffer-overflow in php_ifd_get32s). (CVE-2019-11034)
    • Fixed bug #77831 (Heap-buffer-overflow in exif_iif_add_value). (CVE-2019-11035)
    sqlite3
    • Added sqlite3.defensive INI directive.
    PHP 7.1.27
    Released 07 Mar, 2019
    core
    • Fixed bug #77630 (rename() across the device may allow unwanted access during processing).
    exif
    • Fixed bug #77509 (Uninitialized read in exif_process_IFD_in_TIFF).
    • Fixed bug #77540 (Invalid Read on exif_process_SOFn).
    • Fixed bug #77563 (Uninitialized read in exif_process_IFD_in_MAKERNOTE).
    • Fixed bug #77659 (Uninitialized read in exif_process_IFD_in_MAKERNOTE).
    phar
    • Fixed bug #77396 (Null Pointer Dereference in phar_create_or_parse_filename).
    • Fixed bug #77586 (phar_tar_writeheaders_int() buffer overflow).
    spl
    • Fixed bug #77431 (openFile() silently truncates after a null byte).
    PHP 7.1.26
    Released 10 Jan, 2019
    core
    • Fixed bug #77369 (memcpy with negative length via crafted DNS response).
    gd
    • Fixed bug #77269 (efree() on uninitialized Heap data in imagescale leads to use-after-free).
    • Fixed bug #77270 (imagecolormatch Out Of Bounds Write on Heap).
    imap
    • Fixed bug #77020 (null pointer dereference in imap_mail).
    mbstring
    • Fixed bug #77370 (Buffer overflow on mb regex functions - fetch_token).
    • Fixed bug #77371 (heap buffer overflow in mb regex functions
    • compile_string_node).
    • Fixed bug #77381 (heap buffer overflow in multibyte match_at).
    • Fixed bug #77382 (heap buffer overflow due to incorrect length in expand_case_fold_string).
    • Fixed bug #77385 (buffer overflow in fetch_token).
    • Fixed bug #77394 (Buffer overflow in multibyte case folding - unicode).
    • Fixed bug #77418 (Heap overflow in utf32be_mbc_to_code).
    phar
    • Fixed bug #77247 (heap buffer overflow in phar_detect_phar_fname_ext).
    xmlrpc
    • Fixed bug #77242 (heap out of bounds read in xmlrpc_decode()).
    • Fixed bug #77380 (Global out of bounds read in xmlrpc base64 code).
    PHP 7.1.25
    Released 06 Dec, 2018
    core
    • Fixed bug #71041 (zend_signal_startup() needs ZEND_API).
    ftp
    • Fixed bug #77151 (ftp_close(): SSL_read on shutdown).
    iconv
    • Fixed bug #77147 (Fixing 60494 ignored ICONV_MIME_DECODE_CONTINUE_ON_ERROR).
    imap
    • Fixed bug #77153 (imap_open allows to run arbitrary shell commands via mailbox parameter).
    odbc
    • Fixed bug #77079 (odbc_fetch_object has incorrect type signature).
    opcache
    • Fixed bug #77058 (Type inference in opcache causes side effects).
    pgsql
    • Fixed bug #77047 (pg_convert has a broken regex for the 'TIME WITHOUT TIMEZONE' data type).
    soap
    • Fixed bug #76348 (WSDL_CACHE_MEMORY causes Segmentation fault).
    • Fixed bug #77141 (Signedness issue in SOAP when precision=-1).
    sockets
    • Fixed bug #67619 (Validate length on socket_write).
    PHP 7.1.24
    Released 08 Nov, 2018
    core
    • Fixed bug #76946 (Cyclic reference in generator not detected).
    • Fixed bug #77035 (The phpize and ./configure create redundant .deps file).
    • Fixed bug #77041 (buildconf should output error messages to stderr)
    date
    • Fixed bug #75851 (Year component overflow with date formats "c", "o", "r" and "y").
    fcgi
    • Fixed bug #76948 (Failed shutdown/reboot or end session in Windows).
    • Fixed bug #76954 (apache_response_headers removes last character from header name).
    ftp
    • Fixed bug #76972 (Data truncation due to forceful ssl socket shutdown).
    intl
    • Fixed bug #76942 (U_ARGUMENT_TYPE_MISMATCH).
    standard
    • Fixed bug #76965 (INI_SCANNER_RAW doesn't strip trailing whitespace).
    tidy
    • Fixed bug #77027 (tidy::getOptDoc() not available on Windows).
    xml
    • Fixed bug #30875 (xml_parse_into_struct() does not resolve entities).
    • Add support for getting SKIP_TAGSTART and SKIP_WHITE options.
    PHP 7.1.23
    Released 11 Oct, 2018
    core
    • Fixed bug #76901 (method_exists on SPL iterator passthrough method corrupts memory).
    • Fixed bug #76846 (Segfault in shutdown function after memory limit error).
    curl
    • Fixed bug #76480 (Use curl_multi_wait() so that timeouts are respected).
    iconv
    • Fixed bug #66828 (iconv_mime_encode Q-encoding longer than it should be).
    opcache
    • Fixed bug #76832 (ZendOPcache.MemoryBase periodically deleted by the OS).
    posix
    • Fixed bug #75696 (posix_getgrnam fails to print details of group).
    reflection
    • Fixed bug #74454 (Wrong exception being thrown when using ReflectionMethod).
    standard
    • Fixed bug #73457 (Wrong error message when fopen FTP wrapped fails to open data connection).
    • Fixed bug #74764 (Bindto IPv6 works with file_get_contents but fails with stream_socket_client).
    • Fixed bug #75533 (array_reduce is slow when $carry is large array).
    zlib
    • Fixed bug #75273 (php_zlib_inflate_filter() may not update bytes_consumed).
    PHP 7.1.22
    Released 13 Sep, 2018
    core
    • Fixed bug #76754 (parent private constant in extends class memory leak).
    • Fixed bug #72443 (Generate enabled extension).
    bz2
    • Fixed arginfo for bzcompress.
    gettext
    • Fixed bug #76517 (incorrect restoring of LDFLAGS).
    iconv
    • Fixed bug #68180 (iconv_mime_decode can return extra characters in a header).
    • Fixed bug #63839 (iconv_mime_decode_headers function is skipping headers).
    • Fixed bug #60494 (iconv_mime_decode does ignore special characters).
    • Fixed bug #55146 (iconv_mime_decode_headers() skips some headers).
    intl
    • Fixed bug #74484 (MessageFormatter::formatMessage memory corruption with 11+ named placeholders).
    libxml
    • Fixed bug #76777 ("public id" parameter of libxml_set_external_entity_loader callback undefined).
    mbstring
    • Fixed bug #76704 (mb_detect_order return value varies based on argument type).
    opcache
    • Fixed bug #76747 (Opcache treats path containing "test.pharma.tld" as a phar file).
    openssl
    • Fixed bug #76705 (unusable ssl => peer_fingerprint in stream_context_create()).
    phpdbg
    • Fixed bug #76595 (phpdbg man page contains outdated information).
    spl
    • Fixed bug #68825 (Exception in DirectoryIterator::getLinkTarget()).
    • Fixed bug #68175 (RegexIterator pregFlags are NULL instead of 0).
    standard
    • Fixed bug #76778 (array_reduce leaks memory if callback throws exception).
    zlib
    • Fixed bug #65988 (Zlib version check fails when an include/zlib/ style dir is passed to the --with-zlib configure option).
    • Fixed bug #76709 (Minimal required zlib library is 1.2.0.4).
    PHP 7.1.21
    Released 13 Sep, 2018
    calendar
    • Fixed bug #52974 (jewish.c: compile error under Windows with GBK charset).
    filter
    • Fixed bug #76366 (References in sub-array for filtering breaks the filter).
    pdo_firebird
    • Fixed bug #76488 (Memory leak when fetching a BLOB field).
    pdo_pgsql
    • Fixed bug #75402 (Possible Memory Leak using PDO::CURSOR_SCROLL option).
    sqlite3
    • Fixed #76665 (SQLite3Stmt::bindValue() with SQLITE3_FLOAT doesn't juggle).
    standard
    • Fixed bug #68553 (array_column: null values in $index_key become incrementing keys in result).
    • Fixed bug #73817 (Incorrect entries in get_html_translation_table).
    • Fixed bug #76643 (Segmentation fault when using `output_add_rewrite_var`).
    zip
    • Fixed bug #76524 (ZipArchive memory leak (OVERWRITE flag and empty archive)).
    PHP 7.1.20
    Released 16 Aug, 2018
    core
    • Fixed bug #76534 (PHP hangs on 'illegal string offset on string references with an error handler).
    • Fixed bug #76502 (Chain of mixed exceptions and errors does not serialize properly).
    date
    • Fixed bug #76462 (Undefined property: DateInterval::$f).
    fpm
    • Fixed bug #73342 (Vulnerability in php-fpm by changing stdin to non-blocking).
    gmp
    • Fixed bug #74670 (Integer Underflow when unserializing GMP and possible other classes).
    intl
    • Fixed bug #76556 (get_debug_info handler for BreakIterator shows wrong type).
    mbstring
    • Fixed bug #76532 (Integer overflow and excessive memory usage in mb_strimwidth).
    pgsql
    • Fixed bug #76548 (pg_fetch_result did not fetch the next row).
    phpdbg
    • Fix arginfo wrt. optional/required parameters.
    reflection
    • Fixed bug #76536 (PHP crashes with core dump when throwing exception in error handler).
    • Fixed bug #75231 (ReflectionProperty#getValue() incorrectly works with inherited classes).
    standard
    • Fixed bug #76505 (array_merge_recursive() is duplicating sub-array keys).
    • Fixed bug #71848 (getimagesize with $imageinfo returns false).
    PHP 7.1.19
    Released 21 Jun, 2018
    cli server
    • Fixed bug #76333 (PHP built-in server does not find files if root path contains special characters).
    openssl
    • Fixed bug #76296 (openssl_pkey_get_public does not respect open_basedir).
    • Fixed bug #76174 (openssl extension fails to build with LibreSSL 2.7).
    spl
    • Fixed bug #76367 (NoRewindIterator segfault 11).
    standard
    • Fixed bug #76335 ("link(): Bad file descriptor" with non-ASCII path).
    • Fixed bug #76383 (array_map on $GLOBALS returns IS_INDIRECT).
    PHP 7.1.18
    Released 24 May, 2018
    fpm
    • Fixed bug #76075 --with-fpm-acl wrongly tries to find libacl on FreeBSD.
    intl
    • Fixed bug #74385 (Locale::parseLocale() broken with some arguments).
    opcache
    • Fixed bug #76205 (PHP-FPM sporadic crash when running Infinitewp).
    • Fixed bug #76275 (Assertion failure in file cache when unserializing empty try_catch_array).
    • Fixed bug #76281 (Opcache causes incorrect "undefined variable" errors).
    reflection
    • Fixed arginfo for array_replace(_recursive) and array_merge(_recursive).
    PHP 7.1.17
    Released 26 Apr, 2018
    date
    • Fixed bug #76131 (mismatch arginfo for date_create).
    fpm
    • Fixed bug #68440 (ERROR: failed to reload: execvp() failed: Argument list too long).
    • Fixed incorrect write to getenv result in FPM reload.
    gd
    • Fixed bug #52070 (imagedashedline() - dashed line sometimes is not visible).
    intl
    • Fixed bug #76153 (Intl compilation fails with icu4c 61.1).
    mbstring
    • Fixed bug #75944 (Wrong cp1251 detection).
    • Fixed bug #76113 (mbstring does not build with Oniguruma 6.8.1).
    phpdbg
    • Fixed bug #76143 (Memory corruption: arbitrary NUL overwrite).
    spl
    • Fixed bug #76131 (mismatch arginfo for splarray constructor).
    standard
    • Fixed bug #75996 (incorrect url in header for mt_rand).
    PHP 7.1.16
    Released 29 Mar, 2018
    core
    • Fixed bug #76025 (Segfault while throwing exception in error_handler).
    • Fixed bug #76044 ('date: illegal option -- -' in ./configure on FreeBSD).
    fpm
    • Fixed bug #75605 (Dumpable FPM child processes allow bypassing opcache access controls).
    gd
    • Fixed bug #73957 (signed integer conversion in imagescale()).
    odbc
    • Fixed bug #76088 (ODBC functions are not available by default on Windows).
    opcache
    • Fixed bug #76074 (opcache corrupts variable in for-loop).
    phar
    • Fixed bug #76085 (Segmentation fault in buildFromIterator when directory name contains a \n).
    standard
    • Fixed bug #74139 (mail.add_x_header default inconsistent with docs).
    • Fixed bug #76068 (parse_ini_string fails to parse "[foo]\nbar=1|>baz" with segfault).
    PHP 7.1.15
    Released 01 Mar, 2018
    apache2handler
    • Fixed bug #75882 (a simple way for segfaults in threadsafe php just with configuration).
    date
    • Fixed bug #75857 (Timezone gets truncated when formatted).
    • Fixed bug #75928 (Argument 2 for `DateTimeZone::listIdentifiers()` should accept `null`).
    • Fixed bug #68406 (calling var_dump on a DateTimeZone object modifies it).
    ftp
    • Fixed ftp_pasv arginfo.
    • Fixed imagesetinterpolation arginfo.
    iconv
    • Fixed bug #75867 (Freeing uninitialized pointer).
    ldap
    • Fixed bug #49876 (Fix LDAP path lookup on 64-bit distros).
    libxml2
    • Fixed bug #75871 (use pkg-config where available).
    • mysqlnd
    • Fixed negotiation of MySQL authenticaton plugin.
    • Fixed a memleak with SSL connections.
    odbc
    • Fixed bug #73725 (Unable to retrieve value of varchar(max) type).
    opcache
    • Fixed bug #75969 (Assertion failure in live range DCE due to block pass misoptimization).
    openssl
    • Fixed openssl_* arginfos.
    pcntl
    • Fixed bug #75873 (pcntl_wexitstatus returns incorrect on Big_Endian platform (s390x)).
    pgsql
    • Fixed #75838 (Memory leak in pg_escape_bytea()).
    phar
    • Fixed bug #65414 (deal with leading slash when adding files correctly).
    spl
    • Fixed bug #74519 (strange behavior of AppendIterator).
    standard
    • Fixed bug #75961 (Strange references behavior).
    • Fixed bug #75916 (DNS_CAA record results contain garbage).
    • Fixed some arginfos.
    • Fixed bug #75981 (stack-buffer-overflow while parsing HTTP response).
    PHP 7.1.14
    Released 01 Feb, 2018
    core
    • Fixed bug #75679 (Path 260 character problem).
    • Fixed bug #75786 (segfault when using spread operator on generator passed by reference).
    • Fixed bug #75799 (arg of get_defined_functions is optional).
    • Fixed bug #75396 (Exit inside generator finally results in fatal error).
    • Fixed bug #75079 (self keyword leads to incorrectly generated TypeError when in closure in trait).
    fcgi
    • Fixed bug #75794 (getenv() crashes on Windows 7.2.1 when second parameter is false).
    imap
    • Fixed bug #75774 (imap_append HeapCorruction).
    mbstring
    • Fixed bug #62545 (wrong unicode mapping in some charsets).
    opcache
    • Fixed bug #75720 (File cache not populated after SHM runs full).
    • Fixed bug #75579 (Interned strings buffer overflow may cause crash).
    pgsql
    • Fixed bug #75671 (pg_version() crashes when called on a connection to cockroach).
    readline
    • Fixed bug #75775 (readline_read_history segfaults with empty file).
    sapi
    • Fixed bug #75735 ([embed SAPI] Segmentation fault in sapi_register_post_entry).
    soap
    • Fixed bug #70469 (SoapClient generates E_ERROR even if exceptions=1 is used).
    • Fixed bug #75502 (Segmentation fault in zend_string_release).
    spl
    • Fixed bug #75717 (RecursiveArrayIterator does not traverse arrays by reference).
    • Fixed bug #75242 (RecursiveArrayIterator doesn't have constants from parent class).
    • Fixed bug #73209 (RecursiveArrayIterator does not iterate object properties).
    standard
    • Fixed bug #75781 (substr_count incorrect result).
    PHP 7.1.13
    Released 04 Jan, 2018
    core
    • Fixed bug #75573 (Segmentation fault in 7.1.12 and 7.0.26).
    • Fixed bug #75384 (PHP seems incompatible with OneDrive files on demand).
    • Fixed bug #74862 (Unable to clone instance when private __clone defined).
    • Fixed bug #75074 (php-process crash when is_file() is used with strings longer 260 chars).
    • Fixed bug #69727 (Remove timestamps from build to make it reproducible).
    cli server
    • Fixed bug #60471 (Random "Invalid request (unexpected EOF)" using a router script).
    • Fixed bug #73830 (Directory does not exist).
    fpm
    • Fixed bug #64938 (libxml_disable_entity_loader setting is shared between requests).
    gd
    • Fixed bug #75571 (Potential infinite loop in gdImageCreateFromGifCtx).
    opcache
    • Fixed bug #75608 ("Narrowing occurred during type inference" error).
    • Fixed bug #75570 ("Narrowing occurred during type inference" error).
    • Fixed bug #75579 (Interned strings buffer overflow may cause crash).
    pcre
    • Fixed bug #74183 (preg_last_error not returning error code after error).
    phar
    • Fixed bug #74782 (remove file name from output to avoid XSS).
    standard
    • Fixed bug #75511 (fread not free unused buffer).
    • Fixed bug #75514 (mt_rand returns value outside [$min,$max]+ on 32-bit)
    • Fixed bug #75535 (Inappropriately parsing HTTP response leads to PHP segment fault).
    • Fixed bug #75409 (accept EFAULT in addition to ENOSYS as indicator that getrandom() is missing).
    • Fixed bug #73124 (php_ini_scanned_files() not reporting correctly).
    • Fixed bug #75574 (putenv does not work properly if parameter contains non-ASCII unicode character).
    zip
    • Fixed bug #75540 (Segfault with libzip 1.3.1).
    PHP 7.1.12
    Released 23 Nov, 2017
    core
    • Fixed bug #75420 (Crash when modifing property name in __isset for BP_VAR_IS).
    • Fixed bug #75368 (mmap/munmap trashing on unlucky allocations).
    cli
    • Fixed bug #75287 (Builtin webserver crash after chdir in a shutdown function).
    enchant
    • Fixed bug #53070 (enchant_broker_get_path crashes if no path is set).
    • Fixed bug #75365 (Enchant still reports version 1.1.0).
    exif
    • Fixed bug #75301 (Exif extension has built in revision version).
    gd
    • Fixed bug #65148 (imagerotate may alter image dimensions).
    • Fixed bug #75437 (Wrong reflection on imagewebp).
    intl
    • Fixed bug #75317 (UConverter::setDestinationEncoding changes source instead of destination).
    interbase
    • Fixed bug #75453 (Incorrect reflection for ibase_[p]connect).
    mysqli
    • Fixed bug #75434 (Wrong reflection for mysqli_fetch_all function).
    oci8
    • Fixed valgrind issue.
    openssl
    • Fixed bug #75363 (openssl_x509_parse leaks memory).
    • Fixed bug #75307 (Wrong reflection for openssl_open function).
    opcache
    • Fixed bug #75373 (Warning Internal error: wrong size calculation).
    pgsql
    • Fixed bug #75419 (Default link incorrectly cleared/linked by pg_close()).
    soap
    • Fixed bug #75464 (Wrong reflection on SoapClient::__setSoapHeaders).
    zlib
    • Fixed bug #75299 (Wrong reflection on inflate_init and inflate_add).
    PHP 7.1.11
    Released 26 Oct, 2017
    core
    • Fixed bug #75241 (Null pointer dereference in zend_mm_alloc_small()).
    • Fixed bug #75236 (infinite loop when printing an error-message).
    • Fixed bug #75252 (Incorrect token formatting on two parse errors in one request).
    • Fixed bug #75220 (Segfault when calling is_callable on parent).
    • Fixed bug #75290 (debug info of Closures of internal functions contain garbage argument names).
    apache2handler
    • Fixed bug #75311 (error: 'zend_hash_key' has no member named 'arKey' in apache2handler).
    date
    • Fixed bug #75055 (Out-Of-Bounds Read in timelib_meridian()).
    hash
    • Fixed bug #75303 (sha3 hangs on bigendian).
    intl
    • Fixed bug #75318 (The parameter of UConverter::getAliases() is not optional).
    litespeed
    • Fixed bug #75248 (Binary directory doesn't get created when building only litespeed SAPI).
    • Fixed bug #75251 (Missing program prefix and suffix).
    mcrypt
    • Fixed bug #72535 (arcfour encryption stream filter crashes php).
    mysqli
    • Fixed bug #75018 (Data corruption when reading fields of bit type).
    oci8
    • Fixed incorrect reference counting.
    • Opcache
    • Fixed bug #75255 (Request hangs and not finish).
    pcre
    • Fixed bug #75207 (applied upstream patch for CVE-2016-1283).
    pdo_mysql
    • Fixed bug #75177 (Type 'bit' is fetched as unexpected string).
    spl
    • Fixed bug #73629 (SplDoublyLinkedList::setIteratorMode masks intern flags).
    PHP 7.1.10
    Released 28 Sep, 2017
    core
    • Fixed bug #75042 (run-tests.php issues with EXTENSION block).
    bcmath
    • Fixed bug #44995 (bcpowmod() fails if scale != 0).
    • Fixed bug #46781 (BC math handles minus zero incorrectly).
    • Fixed bug #54598 (bcpowmod() may return 1 if modulus is 1).
    • Fixed bug #75178 (bcpowmod() misbehaves for non-integer base or modulus).
    cli server
    • Fixed bug #70470 (Built-in server truncates headers spanning over TCP packets).
    curl
    • Fixed bug #75093 (OpenSSL support not detected).
    gd
    • Fixed bug #75124 (gdImageGrayScale() may produce colors).
    • Fixed bug #75139 (libgd/gd_interpolation.c:1786: suspicious if ?).
    gettext
    • Fixed bug #73730 (textdomain(null) throws in strict mode).
    intl
    • Fixed bug #75090 (IntlGregorianCalendar doesn't have constants from parent class).
    • Fixed bug #75193 (segfault in collator_convert_object_to_string).
    pdo_oci
    • Fixed bug #74631 (PDO_PCO with PHP-FPM: OCI environment initialized before PHP-FPM sets it up).
    spl
    • Fixed bug #75155 (AppendIterator::append() is broken when appending another AppendIterator).
    • Fixed bug #75173 (incorrect behavior of AppendIterator::append in foreach loop).
    standard
    • Fixed bug #75152 (signed integer overflow in parse_iv).
    • Fixed bug #75097 (gethostname fails if your host name is 64 chars long).
    PHP 7.1.9
    Released 31 Aug, 2017
    core
    • Fixed bug #74947 (Segfault in scanner on INF number).
    • Fixed bug #74954 (null deref and segfault in zend_generator_resume()).
    • Fixed bug #74725 (html_errors=1 breaks unhandled exceptions).
    • Fixed bug #75063 (Main CWD initialized with wrong codepage).
    • Fixed bug #75349 (NAN comparison).
    curl
    • Fixed bug #74125 (Fixed finding CURL on systems with multiarch support).
    date
    • Fixed bug #75002 (Null Pointer Dereference in timelib_time_clone).
    intl
    • Fixed bug #74993 (Wrong reflection on some locale_* functions).
    mbstring
    • Fixed bug #71606 (Segmentation fault mb_strcut with HTML-ENTITIES encoding).
    • Fixed bug #62934 (mb_convert_kana() does not convert iteration marks).
    • Fixed bug #75001 (Wrong reflection on mb_eregi_replace).
    mysqli
    • Fixed bug #74968 (PHP crashes when calling mysqli_result::fetch_object with an abstract class).
    oci8
    • Expose oci_unregister_taf_callback()
    opcache
    • Fixed bug #74980 (Narrowing occurred during type inference).
    phar
    • Fixed bug #74991 (include_path has a 4096 char limit in some cases).
    reflection
    • Fixed bug #74949 (null pointer dereference in _function_string).
    session
    • Fixed bug #74892 (Url Rewriting (trans_sid) not working on urls that start with "#").
    • Fixed bug #74833 (SID constant created with wrong module number).
    simplexml
    • Fixed bug #74950 (nullpointer deref in simplexml_element_getDocNamespaces).
    spl
    • Fixed bug #75049 (spl_autoload_unregister can't handle spl_autoload_functions results).
    • Fixed bug #74669 (Unserialize ArrayIterator broken).
    • Fixed bug #74977 (Appending AppendIterator leads to segfault).
    • Fixed bug #75015 (Crash in recursive iterator destructors).
    standard
    • Fixed bug #75075 (unpack with X* causes infinity loop).
    • Fixed bug #74103 (heap-use-after-free when unserializing invalid array size).
    • Fixed bug #75054 (A Denial of Service Vulnerability was found when performing deserialization).
    wddx
    • Fixed bug #73793 (WDDX uses wrong decimal seperator).
    xmlrpc
    • Fixed bug #74975 (Incorrect xmlrpc serialization for classes with declared properties).
    PHP 7.1.8
    Released 03 Aug, 2017
    core
    • Fixed bug #74832 (Loading PHP extension with already registered function name leads to a crash).
    • Fixed bug #74780 (parse_url() broken when query string contains colon).
    • Fixed bug #74761 (Unary operator expected error on some systems).
    • Fixed bug #73900 (Use After Free in unserialize() SplFixedArray).
    • Fixed bug #74923 (Crash when crawling through network share).
    • Fixed bug #74913 (fixed incorrect poll.h include).
    • Fixed bug #74906 (fixed incorrect errno.h include).
    date
    • Fixed bug #74852 (property_exists returns true on unknown DateInterval property).
    oci8
    • Fixed bug #74625 (Integer overflow in oci_bind_array_by_name).
    opcache
    • Fixed bug #74623 (Infinite loop in type inference when using HTMLPurifier).
    openssl
    • Fixed bug #74798 (pkcs7_en/decrypt does not work if \x0a is used in content).
    • Added OPENSSL_DONT_ZERO_PAD_KEY constant to prevent key padding and fix bug #71917 (openssl_open() returns junk on envelope < 16 bytes) and bug #72362 (OpenSSL Blowfish encryption is incorrect for short keys).
    pdo
    • Fixed bug #69356 (PDOStatement::debugDumpParams() truncates query).
    spl
    • Fixed bug #73471 (PHP freezes with AppendIterator).
    sqlite3
    • Fixed bug #74883 (SQLite3::__construct() produces "out of memory" exception with invalid flags).
    wddx
    • Fixed bug #73173 (huge memleak when wddx_unserialize).
    zlib
    • Fixed bug #73944 (dictionary option of inflate_init() does not work).
    PHP 7.1.7
    Released 06 Jul, 2017
    core
    • Fixed bug #74738 (Multiple [PATH=] and [HOST=] sections not properly parsed).
    • Fixed bug #74658 (Undefined constants in array properties result in broken properties).
    • Fixed misparsing of abstract unix domain socket names.
    • Fixed bug #74603 (PHP INI Parsing Stack Buffer Overflow Vulnerability).
    • Fixed bug #74101, bug #74614 (Unserialize Heap Use-After-Free (READ: 1) in zval_get_type).
    • Fixed bug #74111 (Heap buffer overread (READ: 1) finish_nested_data from unserialize).
    • Fixed bug #74819 (wddx_deserialize() heap out-of-bound read via php_parse_date()).
    date
    • Fixed bug #74639 (implement clone for DatePeriod and DateInterval).
    dom
    • Fixed bug #69373 (References to deleted XPath query results).
    gd
    • Fixed bug #74435 (Buffer over-read into uninitialized memory).
    intl
    • Fixed bug #73473 (Stack Buffer Overflow in msgfmt_parse_message).
    • Fixed bug #74705 (Wrong reflection on Collator::getSortKey and collator_get_sort_key).
    mbstring
    • Add oniguruma upstream fix (CVE-2017-9224, CVE-2017-9226, CVE-2017-9227, CVE-2017-9228, CVE-2017-9229)
    oci8
    • Add TAF callback (PR #2459).
    opcache
    • Fixed bug #74663 (Segfault with opcache.memory_protect and validate_timestamp).
    • Revert opcache.enable_cli to default disabled.
    openssl
    • Fixed bug #74720 (pkcs7_en/decrypt does not work if \x1a is used in content).
    • Fixed bug #74651 (negative-size-param (-1) in memcpy in zif_openssl_seal()).
    pdo_oci
    • Support Instant Client 12.2 in --with-pdo-oci configure option.
    reflection
    • Fixed bug #74673 (Segfault when cast Reflection object to string with undefined constant).
    spl
    • Fixed bug #74478 (null coalescing operator failing with SplFixedArray).
    ftp
    • Fixed bug #74598 (ftp:// wrapper ignores context arg).
    phar
    • Fixed bug #74386 (Phar::__construct reflection incorrect).
    • SOAP
    • Fixed bug #74679 (Incorrect conversion array with WSDL_CACHE_MEMORY).
    streams
    • Fixed bug #74556 (stream_socket_get_name() returns '\0').
    PHP 7.1.6
    Released 08 Jun, 2017
    core
    • Fixed bug #74600 (crash (SIGSEGV) in _zend_hash_add_or_update_i).
    • Fixed bug #74546 (SIGILL in ZEND_FETCH_CLASS_CONSTANT_SPEC_CONST_CONST).
    • Fixed bug #74589 (__DIR__ wrong for unicode character).
    intl
    • Fixed bug #74468 (wrong reflection on Collator::sortWithSortKeys).
    mysqli
    • Fixed bug #74547 (mysqli::change_user() doesn't accept null as $database argument w/strict_types).
    opcache
    • Fixed bug #74596 (SIGSEGV with opcache.revalidate_path enabled).
    phar
    • Fixed bug #51918 (Phar::webPhar() does not handle requests sent through PUT and DELETE method).
    readline
    • Fixed bug #74490 (readline() moves the cursor to the beginning of the line).
    standard
    • Fixed bug #74510 (win32/sendmail.c anchors CC header but not BCC).
    xmlreader
    • Fixed bug #74457 (Wrong reflection on XMLReader::expand).
    PHP 7.1.5
    Released 11 May, 2017
    core
    • Fixed bug #74408 (Endless loop bypassing execution time limit).
    • Fixed bug #74353 (Segfault when killing within bash script trap code).
    • Fixed bug #74340 (Magic function __get has different behavior in php 7.1.x).
    • Fixed bug #74188 (Null coalescing operator fails for undeclared static class properties).
    • Fixed bug #74444 (multiple catch freezes in some cases).
    • Fixed bug #74410 (stream_select() is broken on Windows Nanoserver).
    • Fixed bug #74337 (php-cgi.exe crash on facebook callback).
    • Patch for bug #74216 was reverted.
    date
    • Fixed bug #74404 (Wrong reflection on DateTimeZone::getTransitions).
    • Fixed bug #74080 (add constant for RFC7231 format datetime).
    dom
    • Fixed bug #74416 (Wrong reflection on DOMNode::cloneNode).
    fileinfo
    • Fixed bug #74379 (syntax error compile error in libmagic/apprentice.c).
    gd
    • Fixed bug #74343 (compile fails on solaris 11 with system gd2 library).
    mysqli
    • Fixed bug #74432 (mysqli_connect adding ":3306" to $host if $port parameter not given).
    mysqlnd
    • Fixed bug #74376 (Invalid free of persistent results on error/connection loss).
    intl
    • Fixed bug #65683 (Intl does not support DateTimeImmutable).
    • Fixed bug #74298 (IntlDateFormatter->format() doesn't return microseconds/fractions).
    • Fixed bug #74433 (wrong reflection for Normalizer methods).
    • Fixed bug #74439 (wrong reflection for Locale methods).
    opcache
    • Fixed bug #74456 (Segmentation error while running a script in CLI mode).
    • Fixed bug #74431 (foreach infinite loop).
    • Fixed bug #74442 (Opcached version produces a nested array).
    openssl
    • Fixed bug #73833 (null character not allowed in openssl_pkey_get_private).
    • Fixed bug #73711 (Segfault in openssl_pkey_new when generating DSA or DH key).
    • Fixed bug #74341 (openssl_x509_parse fails to parse ASN.1 UTCTime without seconds).
    • Fixed bug #73808 (iv length warning too restrictive for aes-128-ccm).
    phar
    • Fixed bug #74383 (phar method parameters reflection correction).
    readline
    • Fixed bug #74489 (readline() immediately returns false in interactive console mode).
    standard
    • Fixed bug #72071 (setcookie allows max-age to be negative).
    • Fixed bug #74361 (Compaction in array_rand() violates COW).
    streams
    • Fixed bug #74429 (Remote socket URI with unique persistence identifier broken).
    PHP 7.1.4
    Released 13 Apr, 2017
    core
    • Fixed bug #74149 (static embed SAPI linkage error).
    • Fixed bug #73370 (falsely exits with "Out of Memory" when using USE_ZEND_ALLOC=0).
    • Fixed bug #73960 (Leak with instance method calling static method with referenced return).
    • Fixed bug #69676 (Resolution of self::FOO in class constants not correct).
    • Fixed bug #74265 (Build problems after 7.0.17 release: undefined reference to `isfinite').
    • Fixed bug #74302 (yield fromLABEL is over-greedy).
    apache
    • Reverted patch for bug #61471, fixes bug #74318.
    date
    • Fixed bug #72096 (Swatch time value incorrect for dates before 1970).
    dom
    • Fixed bug #74004 (LIBXML_NOWARNING flag ingnored on loadHTML*).
    iconv
    • Fixed bug #74230 (iconv fails to fail on surrogates).
    oci8
    • Fixed uninitialized data causing random crash.
    opcache
    • Fixed bug #74250 (OPcache compilation performance regression in PHP 5.6/7 with huge classes).
    openssl
    • Fixed bug #72333 (fwrite() on non-blocking SSL sockets doesn't work).
    pdo mysql
    • Fixed bug #71003 (Expose MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT to PDO interface).
    spl
    • Fixed bug #74058 (ArrayObject can not notice changes).
    sqlite
    • Implemented FR #74217 (Allow creation of deterministic sqlite functions).
    streams
    • Fixed bug #74216 (Correctly fail on invalid IP address ports).
    zlib
    • Fixed bug #74240 (deflate_add can allocate too much memory).
    PHP 7.1.3
    Released 16 Mar, 2017
    core
    • Fixed bug #74157 (Segfault with nested generators).
    • Fixed bug #74164 (PHP hangs when an invalid value is dynamically passed to typehinted by-ref arg).
    • Fixed bug #74093 (Maximum execution time of n+2 seconds exceed not written in error_log).
    • Fixed bug #73989 (PHP 7.1 Segfaults within Symfony test suite).
    • Fixed bug #74084 (Out of bound read - zend_mm_alloc_small).
    • Fixed bug #73807 (Performance problem with processing large post request).
    • Fixed bug #73998 (array_key_exists fails on arrays created by get_object_vars).
    • Fixed bug #73954 (NAN check fails on Alpine Linux with musl).
    • Fixed bug #73677 (Generating phar.phar core dump with gcc ASAN enabled build).
    apache
    • Fixed bug #61471 (Incomplete POST does not timeout but is passed to PHP).
    date
    • Fixed bug #73837 ("new DateTime()" sometimes returns 1 second ago value).
    fpm
    • Fixed bug #69860 (php-fpm process accounting is broken with keepalive).
    hash
    • Fixed bug #73127 (gost-crypto hash incorrect if input data contains long 0xFF sequence).
    gd
    • Fixed bug #74031 (ReflectionFunction for imagepng is missing last two parameters).
    mysqlnd
    • Fixed bug #74021 (fetch_array broken data. Data more then MEDIUMBLOB).
    opcache
    • Fixed bug #74152 (if statement says true to a null variable).
    • Fixed bug #74019 (Segfault with list).
    openssl
    • Fixed bug #74022 (PHP Fast CGI crashes when reading from a pfx file).
    • Fixed bug #74099 (Memory leak with openssl_encrypt()).
    • Fixed bug #74159 (Writing a large buffer to a non-blocking encrypted stream fails with "bad write retry").
    pdo_oci
    • Fixed bug #54379 (PDO_OCI: UTF-8 output gets truncated).
    sqlite3
    • Fixed bug #74413 (incorrect reflection for SQLite3::enableExceptions).
    standard
    • Fixed bug #74005 (mail.add_x_header causes RFC-breaking lone line feed).
    • Fixed bug #74041 (substr_count with length=0 broken).
    • Fixed bug #73118 (is_callable callable name reports misleading value for anonymous classes).
    • Fixed bug #74105 (PHP on Linux should use /dev/urandom when getrandom is not available).
    • Fixed bug #74708 (Invalid Reflection signatures for random_bytes and random_int).
    streams
    • Fixed bug #73496 (Invalid memory access in zend_inline_hash_func).
    • Fixed bug #74090 (stream_get_contents maxlength>-1 returns empty string).
    PHP 7.1.2
    Released 16 Feb, 2017
    core
    • Improved GENERATOR_CREATE opcode handler.
    • Fixed bug #73877 (readlink() returns garbage for UTF-8 paths).
    • Fixed bug #73876 (Crash when exporting **= in expansion of assign op).
    • Fixed bug #73962 (bug with symlink related to cyrillic directory).
    • Fixed bug #73969 (segfault in debug_print_backtrace).
    • Fixed bug #73994 (arginfo incorrect for unpack).
    • Fixed bug #73973 (assertion error in debug_zval_dump).
    dom
    • Fixed bug #54382 (getAttributeNodeNS doesn't get xmlns* attributes).
    dtrace
    • Fixed bug #73965 (DTrace reported as enabled when disabled).
    fcgi
    • Fixed bug #73904 (php-cgi fails to load -c specified php.ini file).
    • Fixed bug #72898 (PHP_FCGI_CHILDREN is not included in phpinfo()).
    fpm
    • Fixed bug #69865 (php-fpm does not close stderr when using syslog).
    gd
    • Fixed bug #73968 (Premature failing of XBM reading).
    gmp
    • Fixed bug #69993 (test for gmp.h needs to test machine includes).
    hash
    • Added hash_hkdf() function.
    • Fixed bug #73961 (environmental build dependency in hash sha3 source).
    intl
    • Fix bug #73956 (Link use CC instead of CXX).
    ldap
    • Fixed bug #73933 (error/segfault with ldap_mod_replace and opcache).
    mysqli
    • Fixed bug #73949 (leak in mysqli_fetch_object).
    mysqlnd
    • Fixed bug #69899 (segfault on close() after free_result() with mysqlnd).
    opcache
    • Fixed bug #73983 (crash on finish work with phar in cli + opcache).
    openssl
    • Fixed bug #71519 (add serial hex to return value array).
    • Fixed bug #73692 (Compile ext/openssl with openssl 1.1.0 on Win).
    • Fixed bug #73978 (openssl_decrypt triggers bug in PDO).
    pdo_firebird
    • Implemented FR #72583 (All data are fetched as strings).
    pdo_pgsql
    • Fixed bug #73959 (lastInsertId fails to throw an exception for wrong sequence name).
    phar
    • Fixed bug #70417 (PharData::compress() doesn't close temp file).
    posix
    • Fixed bug #71219 (configure script incorrectly checks for ttyname_r).
    session
    • Fixed bug #69582 (session not readable by root in CLI).
    spl
    • Fixed bug #73896 (spl_autoload() crashes when calls magic _call()).
    standard
    • Fixed bug #69442 (closing of fd incorrect when PTS enabled).
    • Fixed bug #47021 (SoapClient stumbles over WSDL delivered with "Transfer-Encoding: chunked").
    • Fixed bug #72974 (imap is undefined service on AIX).
    • Fixed bug #72979 (money_format stores wrong length AIX).
    • Fixed bug #73374 (intval() with base 0 should detect binary).
    • Fixed bug #69061 (mail.log = syslog contains double information).
    zip
    • Fixed bug #70103 (ZipArchive::addGlob ignores remove_all_path option).
    PHP 7.1.1
    Released 19 Jan, 2017
    core
    • Fixed bug #73792 (invalid foreach loop hangs script).
    • Fixed bug #73686 (Adding settype()ed values to ArrayObject results in references).
    • Fixed bug #73663 ("Invalid opcode 65/16/8" occurs with a variable created with list()).
    • Fixed bug #73727 (ZEND_MM_BITSET_LEN is "undefined symbol" in zend_bitset.h).
    • Fixed bug #73753 (unserialized array pointer not advancing).
    • Fixed bug #73783 (SIG_IGN doesn't work when Zend Signals is enabled).
    cli
    • Fixed bug #72555 (CLI output(japanese) on Windows).
    com
    • Fixed bug #73679 (DOTNET read access violation using invalid codepage).
    dom
    • Fixed bug #67474 (getElementsByTagNameNS filter on default ns).
    mbstring
    • Fixed bug #73646 (mb_ereg_search_init null pointer dereference).
    mysqli
    • Fixed bug #73462 (Persistent connections don't set $connect_errno).
    mysqlnd
    • Optimized handling of BIT fields - less memory copies and lower memory usage.
    • Fixed bug #73800 (sporadic segfault with MYSQLI_OPT_INT_AND_FLOAT_NATIVE).
    opcache
    • Fixed bug #73789 (Strange behavior of class constants in switch/case block).
    • Fixed bug #73746 (Method that returns string returns UNKNOWN:0 instead).
    • Fixed bug #73654 (Segmentation fault in zend_call_function).
    • Fixed bug #73668 ("SIGFPE Arithmetic exception" in opcache when divide by minus 1).
    • Fixed bug #73847 (Recursion when a variable is redefined as array).
    pdo_firebird
    • Fixed bug #72931 (PDO_FIREBIRD with Firebird 3.0 not work on returning statement).
    phpdbg
    • Fixed bug #73794 (Crash (out of memory) when using run and # command separator).
    • Fixed bug #73704 (phpdbg shows the wrong line in files with shebang).
    sqlite3
    • Reverted fix for bug #73530 (Unsetting result set may reset other result set).
    standard
    • Fixed bug #73594 (dns_get_record does not populate $additional out parameter).
    • Fixed bug #70213 (Unserialize context shared on double class lookup).
    • Fixed bug #73154 (serialize object with __sleep function crash).
    • Fixed bug #70490 (get_browser function is very slow).
    • Fixed bug #73265 (Loading browscap.ini at startup causes high memory usage).
    • Add subject to mail log.
    • Fixed bug #31875 (get_defined_functions additional param to exclude disabled functions).
    • Zlib
    • Fixed bug #73373 (deflate_add does not verify that output was not truncated).
    PHP 7.1.0
    Released 01 Dec, 2016
    core
    • Added nullable types.
    • Added DFA optimization framework based on e-SSA form.
    • Added specialized opcode handlers (e.g. ZEND_ADD_LONG_NO_OVERFLOW).
    • Added [] = as alternative construct to list() =.
    • Added void return type.
    • Added support for negative string offsets in string offset syntax and various string functions.
    • Added a form of the list() construct where keys can be specified.
    • Implemented safe execution timeout handling, that prevents random crashes after "Maximum execution time exceeded" error.
    • Implemented the RFC `Support Class Constant Visibility`.
    • Implemented the RFC `Catching multiple exception types`.
    • Implemented logging to syslog with dynamic error levels.
    • Implemented FR #72614 (Support "nmake test" on building extensions by phpize).
    • Implemented RFC: Iterable.
    • Implemented RFC: Closure::fromCallable
    • Implemented RFC: Replace "Missing argument" warning with "\ArgumentCountError" exception.
    • Implemented RFC: Fix inconsistent behavior of $this variable.
    • Fixed bug #73585 (Logging of "Internal Zend error - Missing class information" missing class name).
    • Fixed memory leak(null coalescing operator with Spl hash).
    • Fixed bug #72736 (Slow performance when fetching large dataset with mysqli / PDO).
    • Fixed bug #72482 (Ilegal write/read access caused by gdImageAALine overflow).
    • Fixed bug #72696 (imagefilltoborder stackoverflow on truecolor images).
    • Fixed bug #73350 (Exception::__toString() cause circular references).
    • Fixed bug #73329 ((Float)"Nano" == NAN).
    • Fixed bug #73288 (Segfault in __clone > Exception.toString > __get).
    • Fixed for #73240 (Write out of bounds at number_format).
    • Fix pthreads detection when cross-compiling
    • Fixed bug #73337 (try/catch not working with two exceptions inside a same operation).
    • Fixed bug #73156 (segfault on undefined function).
    • Fixed bug #73163 (PHP hangs if error handler throws while accessing undef const in default value).
    • Fixed bug #73172 (parse error: Invalid numeric literal).
    • Fixed bug #73181 (parse_str() without a second argument leads to crash).
    • Fixed bug #73025 (Heap Buffer Overflow in virtual_popen of zend_virtual_cwd.c).
    • Fixed bug #73058 (crypt broken when salt is 'too' long).
    • Fixed bug #72944 (Null pointer deref in zval_delref_p).
    • Fixed bug #72943 (assign_dim on string doesn't reset hval).
    • Fixed bug #72598 (Reference is lost after array_slice())
    • Fixed bug #72703 (Out of bounds global memory read in BF_crypt triggered by password_verify).
    • Fixed bug #72813 (Segfault with __get returned by ref).
    • Fixed bug #72767 (PHP Segfaults when trying to expand an infinite operator).
    • TypeError messages for arg_info type checks will now say "must be ... or null" where the parameter or return type accepts null.
    • Fixed bug #72857 (stream_socket_recvfrom read access violation).
    • Fixed bug #72663 (Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization).
    • Fixed bug #72681 (PHP Session Data Injection Vulnerability).
    • Fixed bug #72742 (memory allocator fails to realloc small block to large one).
    • Fixed URL rewriter. It would not rewrite '//example.com/' URL unconditionally. URL rewrite target hosts whitelist is implemented.
    • Fixed bug #72641 (phpize (on Windows) ignores PHP_PREFIX).
    • Fixed bug #72683 (getmxrr broken).
    • Fixed bug #72629 (Caught exception assignment to variables ignores references).
    • Fixed bug #72594 (Calling an earlier instance of an included anonymous class fatals).
    • Fixed bug #72581 (previous property undefined in Exception after deserialization).
    • Fixed bug #72543 (Different references behavior comparing to PHP 5)
    • Fixed bug #72347 (VERIFY_RETURN type casts visible in finally).
    • Fixed bug #72216 (Return by reference with finally is not memory safe).
    • Fixed bug #72215 (Wrong return value if var modified in finally).
    • Fixed bug #71818 (Memory leak when array altered in destructor).
    • Fixed bug #71539 (Memory error on $arr[$a] =& $arr[$b] if RHS rehashes)
    • Added new constant PHP_FD_SETSIZE.
    • Added optind parameter to getopt().
    • Added PHP to SAPI error severity mapping for logs.
    • Fixed bug #71911 (Unable to set --enable-debug on building extensions by phpize on Windows).
    • Fixed bug #29368 (The destructor is called when an exception is thrown from the constructor).
    • Implemented RFC: RNG Fixes.
    • Implemented email validation as per RFC 6531.
    • Fixed bug #72513 (Stack-based buffer overflow vulnerability in virtual_file_ex).
    • Fixed bug #72573 (HTTP_PROXY is improperly trusted by some PHP libraries and applications).
    • Fixed bug #72523 (dtrace issue with reflection (failed test)).
    • Fixed bug #72508 (strange references after recursive function call and "switch" statement).
    • Fixed bug #72441 (Segmentation fault: RFC list_keys).
    • Fixed bug #72395 (list() regression).
    • Fixed bug #72373 (TypeError after Generator function w/declared return type finishes).
    • Fixed bug #69489 (tempnam() should raise notice if falling back to temp dir).
    • Fixed UTF-8 and long path support on Windows.
    • Fixed bug #53432 (Assignment via string index access on an empty string converts to array).
    • Fixed bug #62210 (Exceptions can leak temporary variables).
    • Fixed bug #62814 (It is possible to stiffen child class members visibility).
    • Fixed bug #69989 (Generators don't participate in cycle GC).
    • Fixed bug #70228 (Memleak if return in finally block).
    • Fixed bug #71266 (Missing separation of properties HT in foreach etc).
    • Fixed bug #71604 (Aborted Generators continue after nested finally).
    • Fixed bug #71572 (String offset assignment from an empty string inserts null byte).
    • Fixed bug #71897 (ASCII 0x7F Delete control character permitted in identifiers).
    • Fixed bug #72188 (Nested try/finally blocks losing return value).
    • Fixed bug #72213 (Finally leaks on nested exceptions).
    • Fixed bug #47517 (php-cgi.exe missing UAC manifest).
    • Change statement and fcall extension handlers to accept frame.
    • Number operators taking numeric strings now emit E_NOTICEs or E_WARNINGs when given malformed numeric strings.
    • (int), intval() where $base is 10 or unspecified, settype(), decbin(), decoct(), dechex(), integer operators and other conversions now always respect scientific notation in numeric strings.
    • Raise a compile-time warning on octal escape sequence overflow.
    • Fixed bug #73350 (Exception::__toString() cause circular references).
    • Fixed bug #73181 (parse_str() without a second argument leads to crash).
    • Fixed bug #66773 (Autoload with Opcache allows importing conflicting class name to namespace).
    • Fixed bug #66862 ((Sub-)Namespaces unexpected behaviour).
    • Fix pthreads detection when cross-compiling
    • Fixed bug #73337 (try/catch not working with two exceptions inside a same operation).
    • Fixed bug #73338 (Exception thrown from error handler causes valgrind warnings (and crashes)).
    • Fixed bug #73329 ((Float)"Nano" == NAN).
    • Fixed bug #73025 (Heap Buffer Overflow in virtual_popen of zend_virtual_cwd.c).
    • Fixed bug #72703 (Out of bounds global memory read in BF_crypt triggered by password_verify).
    • Fixed bug #73058 (crypt broken when salt is 'too' long).
    • Fixed bug #69579 (Invalid free in extension trait).
    • Fixed bug #73156 (segfault on undefined function).
    • Fixed bug #73163 (PHP hangs if error handler throws while accessing undef const in default value).
    • Fixed bug #73172 (parse error: Invalid numeric literal).
    • Fixed for #73240 (Write out of bounds at number_format).
    • Fixed bug #73147 (Use After Free in PHP7 unserialize()).
    • Fixed bug #73189 (Memcpy negative size parameter php_resolve_path).
    • Fixed bug #72944 (Null pointer deref in zval_delref_p).
    • Fixed bug #72943 (assign_dim on string doesn't reset hval).
    • Fixed bug #72911 (Memleak in zend_binary_assign_op_obj_helper).
    • Fixed bug #72813 (Segfault with __get returned by ref).
    • Fixed bug #72767 (PHP Segfaults when trying to expand an infinite operator).
    • Fixed bug #72854 (PHP Crashes on duplicate destructor call).
    • Fixed bug #72857 (stream_socket_recvfrom read access violation).
    • Fixed bug #72629 (Caught exception assignment to variables ignores references).
    • Fixed bug #72594 (Calling an earlier instance of an included anonymous class fatals).
    • Fixed bug #72581 (previous property undefined in Exception after deserialization).
    • Fixed bug #72496 (Cannot declare public method with signature incompatible with parent private method).
    • Fixed bug #72024 (microtime() leaks memory).
    • Fixed bug #71911 (Unable to set --enable-debug on building extensions by phpize on Windows).
    • Fixed bug causing ClosedGeneratorException being thrown into the calling code instead of the Generator yielding from.
    • Implemented FR #72614 (Support "nmake test" on building extensions by phpize).
    • Fixed bug #72641 (phpize (on Windows) ignores PHP_PREFIX).
    • Fixed potential segfault in object storage freeing in shutdown sequence.
    • Fixed bug #72663 (Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization).
    • Fixed bug #72681 (PHP Session Data Injection Vulnerability).
    • Fixed bug #72683 (getmxrr broken).
    • Fixed bug #72742 (memory allocator fails to realloc small block to large one).
    • Fixed URL rewriter partially. It would not rewrite '//example.com/' URL unconditionally. Only requested host(HTTP_HOST) is rewritten.
    • Fixed bug #72508 (strange references after recursive function call and "switch" statement).
    • Fixed bug #72513 (Stack-based buffer overflow vulnerability in virtual_file_ex).
    • Fixed bug #72573 (HTTP_PROXY is improperly trusted by some PHP libraries and applications).
    • Fixed bug #72218 (If host name cannot be resolved then PHP 7 crashes).
    • Fixed bug #72221 (segfault, past-the-end access).
    • Fixed bug #72268 (Integer Overflow in nl2br()).
    • Fixed bug #72275 (Integer Overflow in json_encode()/json_decode()/ json_utf8_to_utf16()).
    • Fixed bug #72400 (Integer Overflow in addcslashes/addslashes).
    • Fixed bug #72403 (Integer Overflow in Length of String-typed ZVAL).
    • Fixed bug #72162 (use-after-free - error_reporting).
    • Add compiler option to disable special case function calls.
    • Fixed bug #72101 (crash on complex code).
    • Fixed bug #72100 (implode() inserts garbage into resulting string when joins very big integer).
    • Fixed bug #72057 (PHP Hangs when using custom error handler and typehint).
    • Fixed bug #72038 (Function calls with values to a by-ref parameter don't always throw a notice).
    • Fixed bug #71737 (Memory leak in closure with parameter named $this).
    • Fixed bug #72059 (?? is not allowed on constant expressions).
    • Fixed bug #72159 (Imported Class Overrides Local Class Name).
    • Fixed bug #71930 (_zval_dtor_func: Assertion `(arr)->gc.refcount <= 1' failed).
    • Fixed bug #71922 (Crash on assert(new class{})).
    • Fixed bug #71914 (Reference is lost in "switch").
    • Fixed bug #71871 (Interfaces allow final and abstract functions).
    • Fixed Bug #71859 (zend_objects_store_call_destructors operates on realloced memory, crashing).
    • Fixed bug #71841 (EG(error_zval) is not handled well).
    • Fixed bug #71750 (Multiple Heap Overflows in php_raw_url_encode/ php_url_encode).
    • Fixed bug #71731 (Null coalescing operator and ArrayAccess).
    • Fixed bug #71609 (Segmentation fault on ZTS with gethostbyname).
    • Fixed bug #71414 (Inheritance, traits and interfaces).
    • Fixed bug #71359 (Null coalescing operator and magic).
    • Fixed bug #71334 (Cannot access array keys while uksort()).
    • Fixed bug #69659 (ArrayAccess, isset() and the offsetExists method).
    • Fixed bug #69537 (__debugInfo with empty string for key gives error).
    • Fixed bug #62059 (ArrayObject and isset are not friends).
    • Fixed bug #71980 (Decorated/Nested Generator is Uncloseable in Finally).
    • Huge pages disabled by default.
    • Added ability to enable huge pages in Zend Memory Manager through the environment variable USE_ZEND_ALLOC_HUGE_PAGES=1.
    • Fixed bug #71756 (Call-by-reference widens scope to uninvolved functions when used in switch).
    • Fixed bug #71729 (Possible crash in zend_bin_strtod, zend_oct_strtod, zend_hex_strtod).
    • Fixed bug #71695 (Global variables are reserved before execution).
    • Fixed bug #71629 (Out-of-bounds access in php_url_decode in context php_stream_url_wrap_rfc2397).
    • Fixed bug #71622 (Strings used in pass-as-reference cannot be used to invoke C::$callable()).
    • Fixed bug #71596 (Segmentation fault on ZTS with date function (setlocale)).
    • Fixed bug #71535 (Integer overflow in zend_mm_alloc_heap()).
    • Fixed bug #71470 (Leaked 1 hashtable iterators).
    • Fixed bug #71575 (ISO C does not allow extra ‘;’ outside of a function).
    • Fixed bug #71724 (yield from does not count EOLs).
    • Fixed bug #71767 (ReflectionMethod::getDocComment returns the wrong comment).
    • Fixed bug #71806 (php_strip_whitespace() fails on some numerical values).
    • Fixed bug #71624 (`php -R` (PHP_MODE_PROCESS_STDIN) is broken).
    • Fixed bug (Low probability segfault in zend_arena).
    • Fixed bug #71441 (Typehinted Generator with return in try/finally crashes).
    • Fixed bug #71442 (forward_static_call crash).
    • Fixed bug #71443 (Segfault using built-in webserver with intl using symfony).
    • Fixed bug #71449 (An integer overflow bug in php_implode()).
    • Fixed bug #71450 (An integer overflow bug in php_str_to_str_ex()).
    • Fixed bug #71474 (Crash because of VM stack corruption on Magento2).
    • Fixed bug #71485 (Return typehint on internal func causes Fatal error when it throws exception).
    • Fixed bug #71529 (Variable references on array elements don't work when using count).
    • Fixed bug #71601 (finally block not executed after yield from).
    • Fixed bug #71637 (Multiple Heap Overflow due to integer overflows in xml/filter_url/addcslashes). (CVE-2016-4344, CVE-2016-4345, CVE-2016-4346)
    • Added support for new HTTP 451 code.
    • Fixed bug #71039 (exec functions ignore length but look for NULL termination).
    • Fixed bug #71089 (No check to duplicate zend_extension).
    • Fixed bug #71201 (round() segfault on 64-bit builds).
    • Fixed bug #71221 (Null pointer deref (segfault) in get_defined_vars via ob_start).
    • Fixed bug #71248 (Wrong interface is enforced).
    • Fixed bug #71273 (A wrong ext directory setup in php.ini leads to crash).
    • Fixed Bug #71275 (Bad method called on cloning an object having a trait).
    • Fixed bug #71297 (Memory leak with consecutive yield from).
    • Fixed bug #71300 (Segfault in zend_fetch_string_offset).
    • Fixed bug #71314 (var_export(INF) prints INF.0).
    • Fixed bug #71323 (Output of stream_get_meta_data can be falsified by its input).
    • Fixed bug #71336 (Wrong is_ref on properties as exposed via get_object_vars()).
    • Fixed bug #71459 (Integer overflow in iptcembed()).
    • Fixed bug #71165 (-DGC_BENCH=1 doesn't work on PHP7).
    • Fixed bug #71163 (Segmentation Fault: cleanup_unfinished_calls).
    • Fixed bug #71109 (ZEND_MOD_CONFLICTS("xdebug") doesn't work).
    • Fixed bug #71092 (Segmentation fault with return type hinting).
    • Fixed bug memleak in header_register_callback.
    • Fixed bug #71067 (Local object in class method stays in memory for each call).
    • Fixed bug #66909 (configure fails utf8_to_mutf7 test).
    • Fixed bug #70781 (Extension tests fail on dynamic ext dependency).
    • Fixed bug #71089 (No check to duplicate zend_extension).
    • Fixed bug #71086 (Invalid numeric literal parse error within highlight_string() function).
    • Fixed bug #71154 (Incorrect HT iterator invalidation causes iterator reuse).
    • Fixed bug #52355 (Negating zero does not produce negative zero).
    • Fixed bug #66179 (var_export() exports float as integer).
    • Fixed bug #70804 (Unary add on negative zero produces positive zero).
    apache2handler
    • Enable per-module logging in Apache 2.4+.
    • Fix >2G Content-Length headers in apache2handler.
    bcmath
    • Fix bug #73190 (memcpy negative parameter _bc_new_num_ex).
    • Fix bug #73190 (memcpy negative parameter _bc_new_num_ex).
    • Fixed bug #72093 (bcpowmod accepts negative scale and corrupts _one_ definition).
    bz2
    • Fixed bug #72837 (integer overflow in bzdecompress caused heap corruption).
    • Fixed bug #72613 (Inadequate error handling in bzread()).
    • Fixed bug #72837 (integer overflow in bzdecompress caused heap corruption).
    • Fixed bug #72613 (Inadequate error handling in bzread()).
    calendar
    • Fix integer overflows
    • Fixed bug #67976 (cal_days_month() fails for final month of the French calendar).
    • Fixed bug #71894 (AddressSanitizer: global-buffer-overflow in zif_cal_from_jd).
    • Fixed bug #67976 (cal_days_month() fails for final month of the French calendar).
    • Fixed bug #71894 (AddressSanitizer: global-buffer-overflow in zif_cal_from_jd).
    cli server
    • Fixed bug #73360 (Unable to work in root with unicode chars).
    • Fixed bug #71276 (Built-in webserver does not send Date header).
    • Fixed bug #69953 (Support MKCALENDAR request method).
    • Fixed bug #71559 (Built-in HTTP server, we can download file in web by bug).
    com
    • Fixed bug #73126 (Cannot pass parameter 1 by reference).
    • Fixed bug #69579 (Invalid free in extension trait).
    • Fixed bug #72922 (COM called from PHP does not return out parameters).
    • Fixed bug #72569 (DOTNET/COM array parameters broke in PHP7).
    • Fixed bug #72498 (variant_date_from_timestamp null dereference).
    • Curl
    • Implement support for handling HTTP/2 Server Push.
    • Add curl_multi_errno(), curl_share_errno() and curl_share_strerror() functions.
    • Fixed bug #72674 (Heap overflow in curl_escape).
    • Fixed bug #72541 (size_t overflow lead to heap corruption). .
    • Fixed bug #71709 (curl_setopt segfault with empty CURLOPT_HTTPHEADER).
    • Fixed bug #71929 (CURLINFO_CERTINFO data parsing error).
    • Fixed bug #73126 (Cannot pass parameter 1 by reference).
    • Fixed bug #72922 (COM called from PHP does not return out parameters).
    • Fixed bug #72569 (DOTNET/COM array parameters broke in PHP7).
    • Fixed bug #72498 (variant_date_from_timestamp null dereference).
    date
    • Fixed bug #69587 (DateInterval properties and isset).
    • Fixed bug #73426 (createFromFormat with 'z' format char results in incorrect time).
    • Fixed bug #45554 (Inconsistent behavior of the u format char).
    • Fixed bug #48225 (DateTime parser doesn't set microseconds for "now").
    • Fixed bug #52514 (microseconds are missing in DateTime class).
    • Fixed bug #52519 (microseconds in DateInterval are missing).
    • Fixed bug #60089 (DateTime::createFromFormat() U after u nukes microtime).
    • Fixed bug #64887 (Allow DateTime modification with subsecond items).
    • Fixed bug #68506 (General DateTime improvments needed for microseconds to become useful).
    • Fixed bug #73109 (timelib_meridian doesn't parse dots correctly).
    • Fixed bug #73247 (DateTime constructor does not initialise microseconds property).
    • Fixed bug #73147 (Use After Free in PHP7 unserialize()).
    • Fixed bug #73189 (Memcpy negative size parameter php_resolve_path).
    • Fixed bug #66836 (DateTime::createFromFormat 'U' with pre 1970 dates fails parsing).
    • Invalid serialization data for a DateTime or DatePeriod object will now throw an instance of Error from __wakeup() or __set_state() instead of resulting in a fatal error.
    • Timezone initialization failure from serialized data will now throw an instance of Error from __wakeup() or __set_state() instead of resulting in a fatal error.
    • Export date_get_interface_ce() for extension use.
    • Fixed bug #63740 (strtotime seems to use both sunday and monday as start of week).
    • Fixed bug #73091 (Unserializing DateInterval object may lead to __toString invocation).
    • Fixed bug #66836 (DateTime::createFromFormat 'U' with pre 1970 dates fails parsing).
    • Fixed bug #63740 (strtotime seems to use both sunday and monday as start of week).
    • Fixed bug #71889 (DateInterval::format Segmentation fault).
    • Fixed bug #71635 (DatePeriod::getEndDate segfault).
    • Fixed bug #71525 (Calls to date_modify will mutate timelib_rel_time, causing date_date_set issues).
    dba
    • Fixed bug #70825 (Cannot fetch multiple values with group in ini file).
    • Data modification functions (e.g.: dba_insert()) now throw an instance of Error instead of triggering a catchable fatal error if the key is does not contain exactly two elements.
    • Fixed bug #70825 (Cannot fetch multiple values with group in ini file).
    • Fixed bug #72157 (use-after-free caused by dba_open).
    • Fixed key leak with invalid resource.
    dom
    • Fixed bug #73150 (missing NULL check in dom_document_save_html).
    • Fixed bug #66502 (DOM document dangling reference).
    • Invalid schema or RelaxNG validation contexts will throw an instance of Error instead of resulting in a fatal error.
    • Attempting to register a node class that does not extend the appropriate base class will now throw an instance of Error instead of resulting in a fatal error.
    • Attempting to read an invalid or write to a readonly property will throw an instance of Error instead of resulting in a fatal error.
    • Fixed bug #73150 (missing NULL check in dom_document_save_html).
    • Fixed bug #66502 (DOM document dangling reference).
    dtrace
    • Disabled PHP call tracing by default (it makes significant overhead). This may be enabled again using envirionment variable USE_ZEND_DTRACE=1.
    exif
    • Fixed bug #72735 (Samsung picture thumb not read (zero size)).
    • Fixed bug #72627 (Memory Leakage In exif_process_IFD_in_TIFF).
    • Fixed bug #72603 (Out of bound read in exif_process_IFD_in_MAKERNOTE).
    • Fixed bug #72618 (NULL Pointer Dereference in exif_process_user_comment).
    • Fixed bug #72735 (Samsung picture thumb not read (zero size)).
    • Fixed bug #72627 (Memory Leakage In exif_process_IFD_in_TIFF).
    • Fixed bug #72603 (Out of bound read in exif_process_IFD_in_MAKERNOTE).
    • Fixed bug #72618 (NULL Pointer Dereference in exif_process_user_comment).
    • Fixed bug #72094 (Out of bounds heap read access in exif header processing).
    filter
    • Fixed bug #72972 (Bad filter for the flags FILTER_FLAG_NO_RES_RANGE and FILTER_FLAG_NO_PRIV_RANGE).
    • Fixed bug #73054 (default option ignored when object passed to int filter).
    • Fixed bug #71745 (FILTER_FLAG_NO_RES_RANGE does not cover whole 127.0.0.0/8 range).
    • Fixed bug #72972 (Bad filter for the flags FILTER_FLAG_NO_RES_RANGE and FILTER_FLAG_NO_PRIV_RANGE).
    • Fixed bug #73054 (default option ignored when object passed to int filter).
    • Fixed bug #71745 (FILTER_FLAG_NO_RES_RANGE does not cover whole 127.0.0.0/8 range).
    • Fixed bug #71063 (filter_input(INPUT_ENV, ..) does not work).
    fpm
    • Fixed bug #72575 (using --allow-to-run-as-root should ignore missing user).
    • Fixed bug #72575 (using --allow-to-run-as-root should ignore missing user).
    • Fixed bug #72308 (fastcgi_finish_request and logging environment variables).
    • Fixed bug #62172 (FPM not working with Apache httpd 2.4 balancer/fcgi setup).
    • Fixed bug #71269 (php-fpm dumped core).
    • Fixed bug #70755 (fpm_log.c memory leak and buffer overflow).
    ftp
    • Fixed bug #70195 (Cannot upload file using ftp_put to FTPES with require_ssl_reuse).
    • Implemented FR #55651 (Option to ignore the returned FTP PASV address).
    • Fixed bug #70195 (Cannot upload file using ftp_put to FTPES with require_ssl_reuse).
    • Implemented FR #55651 (Option to ignore the returned FTP PASV address).
    gd
    • Fixed bug #73213 (Integer overflow in imageline() with antialiasing).
    • Fixed bug #73272 (imagescale() is not affected by, but affects imagesetinterpolation()).
    • Fixed bug #73279 (Integer overflow in gdImageScaleBilinearPalette()).
    • Fixed bug #73280 (Stack Buffer Overflow in GD dynamicGetbuf).
    • Fixed bug #50194 (imagettftext broken on transparent background w/o alphablending).
    • Fixed bug #73003 (Integer Overflow in gdImageWebpCtx of gd_webp.c).
    • Fixed bug #53504 (imagettfbbox gives incorrect values for bounding box).
    • Fixed bug #73157 (imagegd2() ignores 3rd param if 4 are given).
    • Fixed bug #73155 (imagegd2() writes wrong chunk sizes on boundaries).
    • Fixed bug #73159 (imagegd2(): unrecognized formats may result in corrupted files).
    • Fixed bug #73161 (imagecreatefromgd2() may leak memory).
    • Fixed bug #67325 (imagetruecolortopalette: white is duplicated in palette).
    • Fixed bug #66005 (imagecopy does not support 1bit transparency on truecolor images).
    • Fixed bug #72913 (imagecopy() loses single-color transparency on palette images).
    • Fixed bug #68716 (possible resource leaks in _php_image_convert()).
    • Fixed bug #72709 (imagesetstyle() causes OOB read for empty $styles).
    • Fixed bug #72697 (select_colors write out-of-bounds).
    • Fixed bug #72730 (imagegammacorrect allows arbitrary write access).
    • Fixed bug #72596 (imagetypes function won't advertise WEBP support).
    • Fixed bug #72604 (imagearc() ignores thickness for full arcs).
    • Fixed bug #70315 (500 Server Error but page is fully rendered).
    • Fixed bug #43828 (broken transparency of imagearc for truecolor in blendingmode).
    • Fixed bug #72512 (gdImageTrueColorToPaletteBody allows arbitrary write/read access).
    • Fixed bug #72519 (imagegif/output out-of-bounds access).
    • Fixed bug #72558 (Integer overflow error within _gdContributionsAlloc()).
    • Fixed bug #72482 (Ilegal write/read access caused by gdImageAALine overflow).
    • Fixed bug #72494 (imagecropauto out-of-bounds access).
    • Fixed bug #72404 (imagecreatefromjpeg fails on selfie).
    • Fixed bug #43475 (Thick styled lines have scrambled patterns).
    • Fixed bug #53640 (XBM images require width to be multiple of 8).
    • Fixed bug #64641 (imagefilledpolygon doesn't draw horizontal line).
    • Fixed bug #73213 (Integer overflow in imageline() with antialiasing).
    • Fixed bug #73272 (imagescale() is not affected by, but affects imagesetinterpolation()).
    • Fixed bug #73279 (Integer overflow in gdImageScaleBilinearPalette()).
    • Fixed bug #73280 (Stack Buffer Overflow in GD dynamicGetbuf).
    • Fixed bug #72482 (Ilegal write/read access caused by gdImageAALine overflow).
    • Fixed bug #72696 (imagefilltoborder stackoverflow on truecolor images).
    • Fixed bug #67325 (imagetruecolortopalette: white is duplicated in palette).
    • Fixed bug #50194 (imagettftext broken on transparent background w/o alphablending).
    • Fixed bug #73003 (Integer Overflow in gdImageWebpCtx of gd_webp.c).
    • Fixed bug #53504 (imagettfbbox gives incorrect values for bounding box).
    • Fixed bug #73157 (imagegd2() ignores 3rd param if 4 are given).
    • Fixed bug #73155 (imagegd2() writes wrong chunk sizes on boundaries).
    • Fixed bug #73159 (imagegd2(): unrecognized formats may result in corrupted files).
    • Fixed bug #73161 (imagecreatefromgd2() may leak memory).
    • Fixed bug #72709 (imagesetstyle() causes OOB read for empty $styles).
    • Fixed bug #66005 (imagecopy does not support 1bit transparency on truecolor images).
    • Fixed bug #72913 (imagecopy() loses single-color transparency on palette images).
    • Fixed bug #68716 (possible resource leaks in _php_image_convert()).
    • Fixed bug #72596 (imagetypes function won't advertise WEBP support).
    • Fixed bug #72604 (imagearc() ignores thickness for full arcs).
    • Fixed bug #70315 (500 Server Error but page is fully rendered).
    • Fixed bug #43828 (broken transparency of imagearc for truecolor in blendingmode).
    • Fixed bug #66555 (Always false condition in ext/gd/libgd/gdkanji.c).
    • Fixed bug #68712 (suspicious if-else statements).
    • Fixed bug #72697 (select_colors write out-of-bounds).
    • Fixed bug #72730 (imagegammacorrect allows arbitrary write access).
    • Fixed bug #43475 (Thick styled lines have scrambled patterns).
    • Fixed bug #53640 (XBM images require width to be multiple of 8).
    • Fixed bug #64641 (imagefilledpolygon doesn't draw horizontal line).
    • Fixed bug #72512 (gdImageTrueColorToPaletteBody allows arbitrary write/read access).
    • Fixed bug #72519 (imagegif/output out-of-bounds access).
    • Fixed bug #72558 (Integer overflow error within _gdContributionsAlloc()).
    • Fixed bug #72482 (Ilegal write/read access caused by gdImageAALine overflow).
    • Fixed bug #72494 (imagecropauto out-of-bounds access).
    • Fixed bug #66387 (Stack overflow with imagefilltoborder). (CVE-2015-8874)
    • Fixed bug #72298 (pass2_no_dither out-of-bounds access).
    • Fixed bug #72337 (invalid dimensions can lead to crash).
    • Fixed bug #72339 (Integer Overflow in _gd2GetHeader() resulting in heap overflow). (CVE-2016-5766)
    • Fixed bug #72407 (NULL Pointer Dereference at _gdScaleVert).
    • Fixed bug #72446 (Integer Overflow in gdImagePaletteToTrueColor() resulting in heap overflow). (CVE-2016-5767)
    • Fixed bug #72227 (imagescale out-of-bounds read).
    • Fixed bug #71912 (libgd: signedness vulnerability). (CVE-2016-3074)
    • Improved fix for bug #70976.
    • Fixed bug #70976 (Memory Read via gdImageRotateInterpolated Array Index Out of Bounds). (CVE-2016-1903)
    hash
    • Added SHA3 fixed mode algorithms (224, 256, 384, and 512 bit).
    • Added SHA512/256 and SHA512/224 algorithms.
    iconv
    • Fixed bug #72320 (iconv_substr returns false for empty strings).
    • Fixed bug #72320 (iconv_substr returns false for empty strings).
    imap
    • Fixed bug #73418 (Integer Overflow in "_php_imap_mail" leads to crash).
    • An email address longer than 16385 bytes will throw an instance of Error instead of resulting in a fatal error.
    • Fixed bug #73418 (Integer Overflow in "_php_imap_mail" leads to crash).
    • OCI8
    • Fixed bug #71148 (Bind reference overwritten on PHP 7).
    • Fixed bug #72852 (imap_mail null dereference).
    interbase
    • Fixed bug #73512 (Fails to find firebird headers as don't use fb_config output).
    • Fixed Bug #71305 (Crash when optional resource is omitted).
    intl
    • Fixed bug #73007 (add locale length check).
    • Fixed bug #73218 (add mitigation for ICU int overflow).
    • Fixed bug #65732 (grapheme_*() is not Unicode compliant on CR LF sequence).
    • Fixed bug #73007 (add locale length check).
    • Fixed bug #72639 (Segfault when instantiating class that extends IntlCalendar and adds a property).
    • Fixed bug #72658 (Locale::lookup() / locale_lookup() hangs if no match found).
    • Partially fixed #72506 (idn_to_ascii for UTS #46 incorrect for long domain names).
    • Fixed bug #72533 (locale_accept_from_http out-of-bounds access).
    • Failure to call the parent constructor in a class extending Collator before invoking the parent methods will throw an instance of Error instead of resulting in a recoverable fatal error.
    • Cloning a Transliterator object may will now throw an instance of Error instead of resulting in a fatal error if cloning the internal transliterator fails.
    • Added IntlTimeZone::getWindowsID() and IntlTimeZone::getIDForWindowsID().
    • Fixed bug #69374 (IntlDateFormatter formatObject returns wrong utf8 value).
    • Fixed bug #69398 (IntlDateFormatter formatObject returns wrong value when time style is NONE).
    • Fixed bug #73218 (add mitigation for ICU int overflow).
    • Fixed bug #65732 (grapheme_*() is not Unicode compliant on CR LF sequence).
    • Fixed bug #73007 (add locale length check).
    • Fixed bug #72639 (Segfault when instantiating class that extends IntlCalendar and adds a property).
    • Partially fixed #72506 (idn_to_ascii for UTS #46 incorrect for long domain names).
    • Fixed bug #72533 (locale_accept_from_http out-of-bounds access).
    • Fixed bug #70484 (selectordinal doesn't work with named parameters).
    • Fixed bug #64524 (Add intl.use_exceptions to php.ini-*).
    • Fixed bug #72241 (get_icu_value_internal out-of-bounds read).
    • Fixed bug #71516 (IntlDateFormatter looses locale if pattern is set via constructor).
    • Fixed bug #70455 (Missing constant: IntlChar::NO_NUMERIC_VALUE).
    • Fixed bug #70451, #70452 (Inconsistencies in return values of IntlChar methods).
    • Fixed bug #68893 (Stackoverflow in datefmt_create).
    • Fixed bug #66289 (Locale::lookup incorrectly returns en or en_US if locale is empty).
    • Fixed bug #70484 (selectordinal doesn't work with named parameters).
    • Fixed bug #72061 (Out-of-bounds reads in zif_grapheme_stripos with negative offset).
    json
    • Introduced encoder struct instead of global which fixes bugs #66025 and #73254 related to pretty print indentation.
    • Fixed bug #73113 (Segfault with throwing JsonSerializable).
    • Implemented earlier return when json_encode fails, fixes bugs #68992 (Stacking exceptions thrown by JsonSerializable) and #70275 (On recursion error, json_encode can eat up all system memory).
    • Implemented FR #46600 ("_empty_" key in objects).
    • Exported JSON parser API including json_parser_method that can be used for implementing custom logic when parsing JSON.
    • Escaped U+2028 and U+2029 when JSON_UNESCAPED_UNICODE is supplied as json_encode options and added JSON_UNESCAPED_LINE_TERMINATORS to restore the previous behaviour.
    • Fixed bug #72069 (Behavior \JsonSerializable different from json_encode).
    ldap
    • Providing an unknown modification type to ldap_batch_modify() will now throw an instance of Error instead of resulting in a fatal error.
    • Fixed bug #71249 (ldap_mod_replace/ldap_mod_add store value as string "Array").
    mbstring
    • Fixed bug #73532 (Null pointer dereference in mb_eregi).
    • Fixed bug #66964 (mb_convert_variables() cannot detect recursion)
    • Fixed bug #72992 (mbstring.internal_encoding doesn't inherit default_charset).
    • Fixed bug #66797 (mb_substr only takes 32-bit signed integer).
    • Fixed bug #72711 (`mb_ereg` does not clear the `$regs` parameter on failure).
    • Fixed bug #72691 (mb_ereg_search raises a warning if a match zero-width).
    • Fixed bug #72693 (mb_ereg_search increments search position when a match zero-width).
    • Fixed bug #72694 (mb_ereg_search_setpos does not accept a string's last position).
    • Fixed bug #72710 (`mb_ereg` causes buffer overflow on regexp compile error).
    • Deprecated mb_ereg_replace() eval option.
    • Fixed bug #69151 (mb_ereg should reject ill-formed byte sequence).
    • Fixed bug #72405 (mb_ereg_replace - mbc_to_code (oniguruma) - oob read access).
    • Fixed bug #72399 (Use-After-Free in MBString (search_re)).
    • mb_ereg() and mb_eregi() will now throw an instance of ParseError if an invalid PHP expression is provided and the 'e' option is used.
    • Fixed bug #66797 (mb_substr only takes 32-bit signed integer).
    • Fixed bug #66964 (mb_convert_variables() cannot detect recursion)
    • Fixed bug #72992 (mbstring.internal_encoding doesn't inherit default_charset).
    • Fixed bug #72691 (mb_ereg_search raises a warning if a match zero-width).
    • Fixed bug #72693 (mb_ereg_search increments search position when a match zero-width).
    • Fixed bug #72694 (mb_ereg_search_setpos does not accept a string's last position).
    • Fixed bug #72710 (`mb_ereg` causes buffer overflow on regexp compile error).
    • Fixed bug #72405 (mb_ereg_replace - mbc_to_code (oniguruma) - oob read access).
    • Fixed bug #72399 (Use-After-Free in MBString (search_re)).
    • Fixed bug #72402 (_php_mb_regex_ereg_replace_exec - double free). (CVE-2016-5768)
    • Fixed bug #72164 (Null Pointer Dereference - mb_ereg_replace).
    • Fixed bug #71906 (AddressSanitizer: negative-size-param (-1) in mbfl_strcut). (CVE-2016-4073)
    • Fixed bug #71397 (mb_send_mail segmentation fault).
    • Fixed bug #71066 (mb_send_mail: Program terminated with signal SIGSEGV, Segmentation fault).
    mcrypt
    • Deprecated ext/mcrypt.
    • Fixed bug #72782 (Heap Overflow due to integer overflows).
    • Fixed bug #72551, bug #72552 (In correct casting from size_t to int lead to heap overflow in mdecrypt_generic).
    • mcrypt_encrypt() and mcrypt_decrypt() will throw an instance of Error instead of resulting in a fatal error if mcrypt cannot be initialized.
    • Fixed bug #72782 (Heap Overflow due to integer overflows).
    • Fixed bug #72551, bug #72552 (In correct casting from size_t to int lead to heap overflow in mdecrypt_generic).
    • Fixed bug #72455 (Heap Overflow due to integer overflows). (CVE-2016-5769)
    mysqli
    • Attempting to read an invalid or write to a readonly property will throw an instance of Error instead of resulting in a fatal error.
    mysqlnd
    • Fixed bug #64526 (Add missing mysqlnd.* parameters to php.ini-*).
    • Fixed bug #71863 (Segfault when EXPLAIN with "Unknown column" error when using MariaDB).
    • Fixed bug #72701 (mysqli_get_host_info() wrong output).
    • OCI8
    • Fixed bug #71148 (Bind reference overwritten on PHP 7).
    • Fixed invalid handle error with Implicit Result Sets.
    • Fixed bug #72524 (Binding null values triggers ORA-24816 error).
    • Fixed bug #72489 (PHP Crashes When Modifying Array Containing MySQLi Result Data).
    • Fixed bug #72293 (Heap overflow in mysqlnd related to BIT fields).
    • OCI8
    • Fixed invalid handle error with Implicit Result Sets.
    • Fixed bug #72524 (Binding null values triggers ORA-24816 error).
    odbc
    • Fixed bug #73448 (odbc_errormsg returns trash, always 513 bytes).
    • Fixed bug #63171 (Script hangs after max_execution_time).
    • Fixed bug #47803, #69526 (Executing prepared statements is succesfull only for the first two statements).
    opcache
    • Fixed bug #73583 (Segfaults when conditionally declared class and function have the same name).
    • Fixed bug #69090
    • Fixed bug #72982 (Memory leak in zend_accel_blacklist_update_regexp() function).
    • Fixed bug #72949 (Typo in opcache error message).
    • Fixed bug #72762 (Infinite loop while parsing a file with opcache enabled).
    • Fixed bug #72590 (Opcache restart with kill_all_lockers does not work).
    • Fixed bug #72982 (Memory leak in zend_accel_blacklist_update_regexp() function).
    • Fixed bug #72949 (Typo in opcache error message).
    • Fixed bug #72590 (Opcache restart with kill_all_lockers does not work).
    • Fixed bug #72014 (Including a file with anonymous classes multiple times leads to fatal error).
    • Fixed bug #71843 (null ptr deref ZEND_RETURN_SPEC_CONST_HANDLER).
    • Fixed bug #71584 (Possible use-after-free of ZCG(cwd) in Zend Opcache).
    • Fixed bug #71127 (Define in auto_prepend_file is overwrite).
    openssl
    • Fixed bug #73478 (openssl_pkey_new() generates wrong pub/priv keys with Diffie Hellman).
    • Fixed bug #73276 (crash in openssl_random_pseudo_bytes function).
    • Fixed bug #73072 (Invalid path SNI_server_certs causes segfault).
    • Fixed bug #72360 (ext/openssl build failure with OpenSSL 1.1.0).
    • Bumped a minimal version to 1.0.1.
    • Dropped support for SSL2.
    • Implemented FR #61204 (Add elliptic curve support for OpenSSL).
    • Implemented FR #67304 (Added AEAD support [CCM and GCM modes] to openssl_encrypt and openssl_decrypt).
    • Implemented error storing to the global queue and cleaning up the OpenSSL error queue (resolves bugs #68276 and #69882).
    • Pcntl
    • Implemented asynchronous signal handling without TICKS.
    • Added pcntl_signal_get_handler() that returns the current signal handler for a particular signal. Addresses FR #72409.
    • Add signinfo to pcntl_signal() handler args
    • Fixed bug #73072 (Invalid path SNI_server_certs causes segfault).
    • Fixed bug #73276 (crash in openssl_random_pseudo_bytes function).
    • Fixed bug #73275 (crash in openssl_encrypt function).
    • Fixed bug #72140 (segfault after calling ERR_free_strings()).
    • Fixed bug #72165 (Null pointer dereference - openssl_csr_new).
    • Fixed bug #71475 (openssl_seal() uninitialized memory usage).
    pcre
    • Fixed bug #73483 (Segmentation fault on pcre_replace_callback).
    • Fixed bug #73612 (preg_*() may leak memory).
    • Fixed bug #73392 (A use-after-free in zend allocator management).
    • Fixed bug #73121 (Bundled PCRE doesn't compile because JIT isn't supported on s390).
    • Fixed bug #72688 (preg_match missing group names in matches).
    • Downgraded to PCRE 8.38.
    • Fixed bug #72476 (Memleak in jit_stack).
    • Fixed bug #72463 (mail fails with invalid argument).
    • Upgraded to PCRE 8.39.
    • Fixed bug #73121 (Bundled PCRE doesn't compile because JIT isn't supported on s390).
    • Fixed bug #73174 (heap overflow in php_pcre_replace_impl).
    • Fixed bug #72688 (preg_match missing group names in matches).
    • Fixed bug #72476 (Memleak in jit_stack).
    • Fixed bug #72463 (mail fails with invalid argument).
    • Fixed bug #72143 (preg_replace uses int instead of size_t).
    • Fixed bug #71659 (segmentation fault in pcre running twig tests).
    • Fixed bug #71537 (PCRE segfault from Opcache).
    • Upgraded pcrelib to 8.38.
    • Fixed bug #71178 (preg_replace with arrays creates [0] in replace array if not already set).
    pdo
    • Fixed bug #72788 (Invalid memory access when using persistent PDO connection).
    • Fixed bug #72791 (Memory leak in PDO persistent connection handling).
    • Fixed bug #60665 (call to empty() on NULL result using PDO::FETCH_LAZY returns false).
    • Fixed bug #72788 (Invalid memory access when using persistent PDO connection).
    • Fixed bug #72791 (Memory leak in PDO persistent connection handling).
    • Fixed bug #60665 (call to empty() on NULL result using PDO::FETCH_LAZY returns false).
    • Fixed bug #52098 (Own PDOStatement implementation ignore __call()).
    • Fixed bug #71447 (Quotes inside comments not properly handled).
    pdo_dblib
    • Fixed bug #72414 (Never quote values as raw binary data).
    • Allow \PDO::setAttribute() to set query timeouts.
    • Handle SQLDECIMAL/SQLNUMERIC types, which are used by later TDS versions.
    • Add common PDO test suite.
    • Free error and message strings when cleaning up PDO instances.
    • Fixed bug #67130 (\PDOStatement::nextRowset() should succeed when all rows in current rowset haven't been fetched).
    • Ignore potentially misleading dberr values.
    • Implemented stringify 'uniqueidentifier' fields.
    • Fixed bug #72414 (Never quote values as raw binary data).
    • Allow \PDO::setAttribute() to set query timeouts.
    • Handle SQLDECIMAL/SQLNUMERIC types, which are used by later TDS versions.
    • Add common PDO test suite.
    • Free error and message strings when cleaning up PDO instances.
    • Fixed bug #67130 (\PDOStatement::nextRowset() should succeed when all rows in current rowset haven't been fetched).
    • Ignore potentially misleading dberr values.
    • Implemented stringify 'uniqueidentifier' fields.
    • Fixed bug #71943 (dblib_handle_quoter needs to allocate an extra byte).
    • Add DBLIB-specific attributes for controlling timeouts.
    • Fixed bug #54648 (PDO::MSSQL forces format of datetime fields).
    pdo_firebird
    • Fixed bug #73087, #61183, #71494 (Memory corruption in bindParam).
    • Fixed bug #60052 (Integer returned as a 64bit integer on X86_64).
    pdo_pgsql
    • Fixed bug #70313 (PDO statement fails to throw exception).
    • Fixed bug #72570 (Segmentation fault when binding parameters on a query without placeholders).
    • Implemented FR #72633 (Postgres PDO lastInsertId() should work without specifying a sequence).
    • Implemented FR #72633 (Postgres PDO lastInsertId() should work without specifying a sequence).
    • Fixed bug #72759 (Regression in pgo_pgsql).
    • Fixed bug #70313 (PDO statement fails to throw exception).
    • Fixed bug #72570 (Segmentation fault when binding parameters on a query without placeholders).
    • Fixed bug #71573 (Segfault (core dumped) if paramno beyond bound).
    • Fixed bug #72294 (Segmentation fault/invalid pointer in connection with pgsql_stmt_dtor).
    • Fixed bug #62498 (pdo_pgsql inefficient when getColumnMeta() is used).
    phar
    • Fixed bug #72928 (Out of bound when verify signature of zip phar in phar_parse_zipfile).
    • Fixed bug #73035 (Out of bound when verify signature of tar phar in phar_parse_tarfile).
    • Fixed bug #72928 (Out of bound when verify signature of zip phar in phar_parse_zipfile).
    • Fixed bug #73035 (Out of bound when verify signature of tar phar in phar_parse_tarfile).
    • Fixed bug #72321 (invalid free in phar_extract_file()).
    • Fixed bug #71625 (Crash in php7.dll with bad phar filename).
    • Fixed bug #71317 (PharData fails to open specific file).
    • Fixed bug #71860 (Invalid memory write in phar on filename with \0 in name). (CVE-2016-4072)
    • Fixed bug #71354 (Heap corruption in tar/zip/phar parser). (CVE-2016-4342)
    • Fixed bug #71331 (Uninitialized pointer in phar_make_dirstream()). (CVE-2016-4343)
    • Fixed bug #71391 (NULL Pointer Dereference in phar_tar_setupmetadata()).
    • Fixed bug #71488 (Stack overflow when decompressing tar archives). (CVE-2016-2554)
    phpdbg
    • Added generator command for inspection of currently alive generators.
    • Properly allow for stdin input from a file.
    • Add -s command line option / stdin command for reading script from stdin.
    • Ignore non-executable opcodes in line mode of phpdbg_end_oplog().
    • Fixed bug #70776 (Simple SIGINT does not have any effect with -rr).
    • Fixed bug #71234 (INI files are loaded even invoked as -n --version).
    • Fixed bug #72996 (phpdbg_prompt.c undefined reference to DL_LOAD).
    • Fixed next command not stopping when leaving function.
    • Fixed bug #72284 (phpdbg fatal errors with coverage).
    • Fixed crash when advancing (except step) inside an internal function.
    • Fixed inherited functions from unspecified files being included in phpdbg_get_executable().
    postgres
    • Fixed bug #73498 (Incorrect SQL generated for pg_copy_to()).
    • Implemented FR #31021 (pg_last_notice() is needed to get all notice messages).
    • Implemented FR #48532 (Allow pg_fetch_all() to index numerically).
    • Fixed bug #72195 (pg_pconnect/pg_connect cause use-after-free).
    • Fixed bug #72197 (pg_lo_create arbitrary read).
    • Fixed bug #72028 (pg_query_params(): NULL converts to empty string).
    • Fixed bug #71062 (pg_convert() doesn't accept ISO 8601 for datatype timestamp).
    • Fixed bug #72151 (mysqli_fetch_object changed behaviour).
    • Fixed bug #71820 (pg_fetch_object binds parameters before call constructor).
    • Fixed bug #71998 (Function pg_insert does not insert when column type = inet).
    readline
    • Fixed bug #72538 (readline_redisplay crashes php).
    • Reflection
    • Undo backwards compatiblity break in ReflectionType->__toString() and deprecate via documentation instead.
    • Reverted prepending \ for class names.
    • Implemented request #38992 (invoke() and invokeArgs() static method calls should match). .
    • Add ReflectionNamedType::getName(). This method should be used instead of ReflectionType::__toString()
    • Prepend \ for class names and ? for nullable types returned from ReflectionType::__toString().
    • Fixed bug #72661 (ReflectionType::__toString crashes with iterable).
    • Fixed bug #72222 (ReflectionClass::export doesn't handle array constants).
    • Failure to retrieve a reflection object or retrieve an object property will now throw an instance of Error instead of resulting in a fatal error.
    • Fix #72209 (ReflectionProperty::getValue() doesn't fail if object doesn't match type).
    • Fixed bug #72538 (readline_redisplay crashes php).
    • Fixed bug #71094 (readline_completion_function corrupts static array on second TAB).
    session
    • Fixed bug #73273 (session_unset() empties values from all variables in which is $_session stored).
    • Fixed bug #73100 (session_destroy null dereference in ps_files_path_create).
    • Fixed bug #68015 (Session does not report invalid uid for files save handler).
    • Fixed bug #72940 (SID always return "name=ID", even if session cookie exist).
    • Implemented session_gc() https://wiki.php.net/rfc/session-create-id
    • Implemented session_create_id() https://wiki.php.net/rfc/session-gc
    • Implemented RFC: Session ID without hashing. https://wiki.php.net/rfc/session-id-without-hashing
    • Fixed bug #72531 (ps_files_cleanup_dir Buffer overflow).
    • Custom session handlers that do not return strings for session IDs will now throw an instance of Error instead of resulting in a fatal error when a function is called that must generate a session ID.
    • An invalid setting for session.hash_function will throw an instance of Error instead of resulting in a fatal error when a session ID is created.
    • Fixed bug #72562 (Use After Free in unserialize() with Unexpected Session Deserialization).
    • Improved fix for bug #68063 (Empty session IDs do still start sessions).
    • Fixed bug #71038 (session_start() returns TRUE on failure). Session save handlers must return 'string' always for successful read. i.e. Non-existing session read must return empty string. PHP 7.0 is made not to tolerate buggy return value.
    • Fixed bug #71394 (session_regenerate_id() must close opened session on errors).
    • Fixed bug #73273 (session_unset() empties values from all variables in which is $_session stored).
    • Fixed bug #68015 (Session does not report invalid uid for files save handler).
    • Fixed bug #73100 (session_destroy null dereference in ps_files_path_create).
    • Fixed bug #72724 (PHP7: session-uploadprogress kills httpd).
    • Fixed bug #72940 (SID always return "name=ID", even if session cookie exist).
    • Fixed bug #72531 (ps_files_cleanup_dir Buffer overflow).
    • Fixed bug #72562 (Use After Free in unserialize() with Unexpected Session Deserialization).
    • Fixed bug #71972 (Cyclic references causing session_start(): Failed to decode session object).
    • Fixed bug #71683 (Null pointer dereference in zend_hash_str_find_bucket).
    • Fixed bug #71122 (Session GC may not remove obsolete session data).
    simplexml
    • Fixed bug #73293 (NULL pointer dereference in SimpleXMLElement::asXML()).
    • Fixed bug #72971 (SimpleXML isset/unset do not respect namespace).
    • Fixed bug #72957 (Null coalescing operator doesn't behave as expected with SimpleXMLElement).
    • Fixed bug #72588 (Using global var doesn't work while accessing SimpleXML element).
    • Creating an unnamed or duplicate attribute will throw an instance of Error instead of resulting in a fatal error.
    • Fixed bug #73293 (NULL pointer dereference in SimpleXMLElement::asXML()).
    • Fixed bug #72971 (SimpleXML isset/unset do not respect namespace).
    • Fixed bug #72957 (Null coalescing operator doesn't behave as expected with SimpleXMLElement).
    • Fixed bug #72588 (Using global var doesn't work while accessing SimpleXML element).
    snmp
    • Fixed bug #72708 (php_snmp_parse_oid integer overflow in memory allocation).
    • Fixed bug #72479 (Use After Free Vulnerability in SNMP with GC and unserialize()).
    • Fixed bug #72708 (php_snmp_parse_oid integer overflow in memory allocation).
    • Fixed bug #72479 (Use After Free Vulnerability in SNMP with GC and unserialize()).
    • Fixed bug #71704 (php_snmp_error() Format String Vulnerability). (CVE-2016-4071)
    soap
    • Fixed bug #73538 (SoapClient::__setSoapHeaders doesn't overwrite SOAP headers).
    • Fixed bug #73452 (Segfault (Regression for #69152)).
    • Fixed bug #73037 (SoapServer reports Bad Request when gzipped).
    • Fixed bug #73237 (Nested object in "any" element overwrites other fields).
    • Fixed bug #69137 (Peer verification fails when using a proxy with SoapClient)
    • Fixed bug #71711 (Soap Server Member variables reference bug).
    • Fixed bug #71996 (Using references in arrays doesn't work like expected).
    • Fixed bug #73037 (SoapServer reports Bad Request when gzipped).
    • Fixed bug #73237 (Nested object in "any" element overwrites other fields).
    • Fixed bug #69137 (Peer verification fails when using a proxy with SoapClient)
    • Fixed bug #71711 (Soap Server Member variables reference bug).
    • Fixed bug #71996 (Using references in arrays doesn't work like expected).
    • Fixed bug #71986 (Nested foreach assign-by-reference creates broken variables).
    • Fixed bug #71610 (Type Confusion Vulnerability - SOAP / make_http_soap_request()). (CVE-2016-3185)
    • Fixed bug #70979 (crash with bad soap request).
    spl
    • Fixed bug #73423 (Reproducible crash with GDB backtrace).
    • Fixed bug #72888 (Segfault on clone on splFileObject).
    • Fixed bug #73029 (Missing type check when unserializing SplArray).
    • Fixed bug #72646 (SplFileObject::getCsvControl does not return the escape character).
    • Fixed bug #72684 (AppendIterator segfault with closed generator).
    • Attempting to clone an SplDirectory object will throw an instance of Error instead of resulting in a fatal error.
    • Calling ArrayIterator::append() when iterating over an object will throw an instance of Error instead of resulting in a fatal error.
    • Fixed bug #55701 (GlobIterator throws LogicException).
    • Fixed bug #73257, #73258 (SplObjectStorage unserialize allows use of non-object as key).
    • Fixed bug #73029 (Missing type check when unserializing SplArray).
    • Fixed bug #55701 (GlobIterator throws LogicException).
    • Fixed bug #72646 (SplFileObject::getCsvControl does not return the escape character).
    • Fixed bug #72684 (AppendIterator segfault with closed generator).
    • Fixed bug #72051 (The reference in CallbackFilterIterator doesn't work as expected).
    • Fixed bug #71838 (Deserializing serialized SPLObjectStorage-Object can't access properties in PHP).
    • Fixed bug #71735 (Double-free in SplDoublyLinkedList::offsetSet).
    • Fixed bug #67582 (Cloned SplObjectStorage with overwritten getHash fails offsetExists()).
    • Fixed bug #52339 (SPL autoloader breaks class_exists()).
    • Fixed bug #71617 (private properties lost when unserializing ArrayObject).
    • Fixed bug #71204 (segfault if clean spl_autoload_funcs while autoloading).
    • Fixed bug #71202 (Autoload function registered by another not activated immediately).
    • Fixed bug #71311 (Use-after-free vulnerability in SPL(ArrayObject, unserialize)).
    • Fixed bug #71313 (Use-after-free vulnerability in SPL(SplObjectStorage, unserialize)).
    • Fixed bug #71077 (ReflectionMethod for ArrayObject constructor returns wrong number of parameters).
    • Fixed bug #71153 (Performance Degradation in ArrayIterator with large arrays).
    sqlite3
    • Update to SQLite 3.15.1.
    • Fixed bug #73530 (Unsetting result set may reset other result set).
    • Fixed bug #73333 (2147483647 is fetched as string).
    • Fixed bug #72668 (Spurious warning when exception is thrown in user defined function).
    • Implemented FR #72653 (SQLite should allow opening with empty filename).
    • Fixed bug #70628 (Clearing bindings on an SQLite3 statement doesn't work).
    • Implemented FR #71159 (Upgraded bundled SQLite lib to 3.9.2).
    • Fixed bug #73333 (2147483647 is fetched as string).
    • Updated bundled SQLite3 to 3.14.2.
    • Downgraded bundled SQLite to 3.8.10.2. ;
    • Fixed bug #72668 (Spurious warning when exception is thrown in user defined function).
    • Fixed bug #72571 (SQLite3::bindValue, SQLite3::bindParam crash).
    • Implemented FR #72653 (SQLite should allow opening with empty filename).
    • Updated to SQLite3 3.13.0.
    • Fixed bug #68849 (bindValue is not using the right data type).
    standard
    • Fixed bug #73297 (HTTP stream wrapper should ignore HTTP 100 Continue).
    • Fixed bug #73303 (Scope not inherited by eval in assert()).
    • Fixed bug #73192 (parse_url return wrong hostname).
    • Fixed bug #73203 (passing additional_parameters causes mail to fail).
    • Fixed bug #73203 (passing additional_parameters causes mail to fail).
    • Fixed bug #72920 (Accessing a private constant using constant() creates an exception AND warning).
    • Fixed bug #65550 (get_browser() incorrectly parses entries with "+" sign).
    • Fixed bug #71882 (Negative ftruncate() on php://memory exhausts memory).
    • Fixed bug #55451 (substr_compare NULL length interpreted as 0).
    • Fixed bug #72278 (getimagesize returning FALSE on valid jpg).
    • Fixed bug #61967 (unset array item in array_walk_recursive cause inconsistent array).
    • Fixed bug #62607 (array_walk_recursive move internal pointer).
    • Fixed bug #69068 (Exchanging array during array_walk -> memory errors).
    • Fixed bug #70713 (Use After Free Vulnerability in array_walk()/ array_walk_recursive()).
    • Fixed bug #72622 (array_walk + array_replace_recursive create references from nothing).
    • Fixed bug #72330 (CSV fields incorrectly split if escape char followed by UTF chars).
    • Implemented RFC: More precise float values.
    • array_multisort now uses zend_sort instead zend_qsort.
    • Fixed bug #72505 (readfile() mangles files larger than 2G).
    • assert() will throw a ParseError when evaluating a string given as the first argument if the PHP code is invalid instead of resulting in a catchable fatal error.
    • Calling forward_static_call() outside of a class scope will now throw an instance of Error instead of resulting in a fatal error.
    • Added is_iterable() function.
    • Fixed bug #72306 (Heap overflow through proc_open and $env parameter).
    • Fixed bug #71100 (long2ip() doesn't accept integers in strict mode).
    • Implemented FR #55716 (Add an option to pass a custom stream context to get_headers()).
    • Additional validation for parse_url() for login/pass components). (Ilia)
    • Implemented FR #69359 (Provide a way to fetch the current environment variables).
    • unpack() function accepts an additional optional argument $offset.
    • Implemented #51879 stream context socket option tcp_nodelay
    • Fixed bug #73203 (passing additional_parameters causes mail to fail).
    • Fixed bug #71241 (array_replace_recursive sometimes mutates its parameters).
    • Fixed bug #55451 (substr_compare NULL length interpreted as 0).
    • Fixed bug #72278 (getimagesize returning FALSE on valid jpg).
    • Fixed bug #65550 (get_browser() incorrectly parses entries with "+" sign).
    • Fixed bug #72622 (array_walk + array_replace_recursive create references from nothing).
    • Fixed bug #72152 (base64_decode $strict fails to detect null byte).
    • Fixed bug #72263 (base64_decode skips a character after padding in strict mode).
    • Fixed bug #72264 (base64_decode $strict fails with whitespace between padding).
    • Fixed bug #72330 (CSV fields incorrectly split if escape char followed by UTF chars).
    • Fixed bug #72505 (readfile() mangles files larger than 2G).
    • Fixed bug #72306 (Heap overflow through proc_open and $env parameter).
    • Fixed bug #72369 (array_merge() produces references in PHP7).
    • Fixed bug #72300 (ignore_user_abort(false) has no effect).
    • Fixed bug #72229 (Wrong reference when serialize/unserialize an object).
    • Fixed bug #72193 (dns_get_record returns array containing elements of type 'unknown').
    • Fixed bug #72017 (range() with float step produces unexpected result).
    • Fixed bug #72075 (Referencing socket resources breaks stream_select).
    • Fixed bug #72031 (array_column() against an array of objects discards all values matching null).
    • Fixed bug #71995 (Returning the same var twice from __sleep() produces broken serialized data).
    • Fixed bug #71940 (Unserialize crushes on restore object reference).
    • Fixed bug #71969 (str_replace returns an incorrect resulting array after a foreach by reference).
    • Fixed bug #71891 (header_register_callback() and register_shutdown_function()).
    • Fixed bug #71884 (Null pointer deref (segfault) in stream_context_get_default).
    • Fixed bug #71840 (Unserialize accepts wrongly data).
    • Fixed bug #71837 (Wrong arrays behaviour).
    • Fixed bug #71827 (substr_replace bug, string length).
    • Fixed bug #67512 (php_crypt() crashes if crypt_r() does not exist or _REENTRANT is not defined).
    • Fixed bug #72116 (array_fill optimization breaks implementation).
    • Fixed bug #71660 (array_column behaves incorrectly after foreach by reference).
    • Fixed bug #71798 (Integer Overflow in php_raw_url_encode). (CVE-2016-4070)
    • Fixed bug #71603 (compact() maintains references in php7).
    • Fixed bug #70720 (strip_tags improper php code parsing).
    • Fixed bug #71287 (Error message contains hexadecimal instead of decimal number).
    • Fixed bug #71264 (file_put_contents() returns unexpected value when filesystem runs full).
    • Fixed bug #71245 (file_get_contents() ignores "header" context option if it's a reference).
    • Fixed bug #71220 (Null pointer deref (segfault) in compact via ob_start).
    • Fixed bug #71190 (substr_replace converts integers in original $search array to strings).
    • Fixed bug #71188 (str_replace converts integers in original $search array to strings).
    • Fixed bug #71132, #71197 (range() segfaults).
    • Fixed bug #71270 (Heap BufferOver Flow in escapeshell functions). (CVE-2016-1904)
    streams
    • Fixed bug #73586 (php_user_filter::$stream is not set to the stream the filter is working on).
    • Fixed bug #72853 (stream_set_blocking doesn't work).
    • Fixed bug #72743 (Out-of-bound read in php_stream_filter_create).
    • Implemented FR #27814 (Multiple small packets send for HTTP request).
    • Fixed bug #72764 (ftps:// opendir wrapper data channel encryption fails with IIS FTP 7.5, 8.5).
    • Fixed bug #72810 (Missing SKIP_ONLINE_TESTS checks).
    • Fixed bug #41021 (Problems with the ftps wrapper).
    • Fixed bug #54431 (opendir() does not work with ftps:// wrapper).
    • Fixed bug #72667 (opendir() with ftp:// attempts to open data stream for non-existent directories).
    • Fixed bug #72771 (ftps:// wrapper is vulnerable to protocol downgrade attack).
    • Fixed bug #72534 (stream_socket_get_name crashes).
    • Fixed bug #72439 (Stream socket with remote address leads to a segmentation fault).
    • Fixed bug #72853 (stream_set_blocking doesn't work).
    • Fixed bug #72764 (ftps:// opendir wrapper data channel encryption fails with IIS FTP 7.5, 8.5).
    • Fixed bug #71882 (Negative ftruncate() on php://memory exhausts memory).
    • Fixed bug #41021 (Problems with the ftps wrapper).
    • Fixed bug #54431 (opendir() does not work with ftps:// wrapper).
    • Fixed bug #72667 (opendir() with ftp:// attempts to open data stream for non-existent directories).
    • Fixed bug #72771 (ftps:// wrapper is vulnerable to protocol downgrade attack).
    • Fixed bug #72439 (Stream socket with remote address leads to a segmentation fault).
    sysvshm
    • Fixed bug #72858 (shm_attach null dereference).
    • Fixed bug #72858 (shm_attach null dereference).
    tidy
    • Implemented support for libtidy 5.0.0 and above.
    • Creating a tidyNode manually will now throw an instance of Error instead of resulting in a fatal error.
    wddx
    • Fixed bug #73331 (NULL Pointer Dereference in WDDX Packet Deserialization with PDORow).
    • Fixed bug #72142 (WDDX Packet Injection Vulnerability in wddx_serialize_value()).
    • Fixed bug #72749 (wddx_deserialize allows illegal memory access)
    • Fixed bug #72750 (wddx_deserialize null dereference).
    • Fixed bug #72790 (wddx_deserialize null dereference with invalid xml).
    • Fixed bug #72799 (wddx_deserialize null dereference in php_wddx_pop_element).
    • Fixed bug #72860 (wddx_deserialize use-after-free).
    • Fixed bug #73065 (Out-Of-Bounds Read in php_wddx_push_element).
    • Fixed bug #72564 (boolean always deserialized as "true")
    • A circular reference when serializing will now throw an instance of Error instead of resulting in a fatal error.
    • Fixed bug #73331 (NULL Pointer Dereference in WDDX Packet Deserialization with PDORow).
    • Fixed bug #72860 (wddx_deserialize use-after-free).
    • Fixed bug #73065 (Out-Of-Bounds Read in php_wddx_push_element).
    • Fixed bug #72564 (boolean always deserialized as "true")
    • Fixed bug #72142 (WDDX Packet Injection Vulnerability in wddx_serialize_value()).
    • Fixed bug #72749 (wddx_deserialize allows illegal memory access)
    • Fixed bug #72750 (wddx_deserialize null dereference).
    • Fixed bug #72790 (wddx_deserialize null dereference with invalid xml).
    • Fixed bug #72799 (wddx_deserialize null dereference in php_wddx_pop_element).
    • Fixed bug #72340 (Double Free Courruption in wddx_deserialize). (CVE-2016-5772)
    • Fixed bug #71335 (Type Confusion in WDDX Packet Deserialization).
    • Fixed bug #70661 (Use After Free Vulnerability in WDDX Packet Deserialization).
    • Fixed bug #70741 (Session WDDX Packet Deserialization Type Confusion Vulnerability).
    xml
    • Fixed bug #72135 (malformed XML causes fault)
    • Fixed bug #72714 (_xml_startElementHandler() segmentation fault).
    • Fixed bug #72085 (SEGV on unknown address zif_xml_parse).
    • Fixed bug #72085 (SEGV on unknown address zif_xml_parse).
    • Fixed bug #72714 (_xml_startElementHandler() segmentation fault).
    • Fixed bug #72206 (xml_parser_create/xml_parser_free leaks mem).
    • Fixed bug #72099 (xml_parse_into_struct segmentation fault).
    xmlrpc
    • Fixed bug #72647 (xmlrpc_encode() unexpected output after referencing array elements).
    • Fixed bug #72606 (heap-buffer-overflow (write) simplestring_addn simplestring.c).
    • A circular reference when serializing will now throw an instance of Error instead of resulting in a fatal error.
    • Fixed bug #72647 (xmlrpc_encode() unexpected output after referencing array elements).
    • Fixed bug #72606 (heap-buffer-overflow (write) simplestring_addn simplestring.c).
    • Fixed bug #72155 (use-after-free caused by get_zval_xmlrpc_type).
    • Fixed bug #71501 (xmlrpc_encode_request ignores encoding option).
    • Fixed bug #70728 (Type Confusion Vulnerability in PHP_to_XMLRPC_worker).
    zip
    • Fixed bug #68302 (impossible to compile php with zip support).
    • Fixed bug #72660 (NULL Pointer dereference in zend_virtual_cwd).
    • Fixed bug #72520 (Stack-based buffer overflow vulnerability in php_stream_zip_opener).
    • ZipArchive::addGlob() will throw an instance of Error instead of resulting in a fatal error if glob support is not available.
    • Fixed bug #70752 (Depacking with wrong password leaves 0 length files).
    • Fixed bug #68302 (impossible to compile php with zip support).
    • Fixed bug #72660 (NULL Pointer dereference in zend_virtual_cwd).
    • Fixed bug #72520 (Stack-based buffer overflow vulnerability in php_stream_zip_opener).
    • Fixed ug #72258 (ZipArchive converts filenames to unrecoverable form).
    • Fixed bug #72434 (ZipArchive class Use After Free Vulnerability in PHP's GC algorithm and unserialize). (CVE-2016-5773)
    • Fixed bug #71923 (integer overflow in ZipArchive::getFrom*). (CVE-2016-3078)
    • Update bundled libzip to 1.1.2.
    • Fixed bug #71561 (NULL pointer dereference in Zip::ExtractTo).
    reflection
    • Fixed bug #72846 (getConstant for a array constant with constant values returns NULL/NFC/UKNOWN).
    • Fixed bug #72222 (ReflectionClass::export doesn't handle array constants).
    • Fixed bug #72174 (ReflectionProperty#getValue() causes __isset call).
    curl
    • Fixed bug #71709 (curl_setopt segfault with empty CURLOPT_HTTPHEADER).
    • Fixed bug #71929 (CURLINFO_CERTINFO data parsing error).
    • Fixed bug #72674 (Heap overflow in curl_escape).
    • Fixed bug #72541 (size_t overflow lead to heap corruption).
    • Fixed bug #68658 (Define CURLE_SSL_CACERT_BADFILE).
    • Fixed bug #71831 (CURLOPT_NOPROXY applied as long instead of string).
    • Fixed bug #71694 (Support constant CURLM_ADDED_ALREADY).
    • Fixed bug #71523 (Copied handle with new option CURLOPT_HTTPHEADER crashes while curl_multi_exec).
    • Fixed memory leak in curl_getinfo().
    • Fixed bug #71227 (Can't compile php_curl statically).
    • Fixed bug #71225 (curl_setopt() fails to set CURLOPT_POSTFIELDS with reference to CURLFile).
    • Fixed bug #71144 (Sementation fault when using cURL with ZTS).
    cli
    • Fixed bug #72484 (SCRIPT_FILENAME shows wrong path if the user specify router.php).
    oci8
    • Fixed bug #71600 (oci_fetch_all segfaults when selecting more than eight columns).
    pcntl
    • Fixed bug #72154 (pcntl_wait/pcntl_waitpid array internal structure overwrite).
    posix
    • Fixed bug #72133 (php_posix_group_to_array crashes if gr_passwd is NULL).
    sockets
    • Added socket_export_stream() function for getting a stream compatible resource from a socket resource.
    fileinfo
    • Fixed bug #71527 (Buffer over-write in finfo_open with malformed magic file). (CVE-2015-8865)
    • Fixed bug #71434 (finfo throws notice for specific python file).
    libxml
    • Fixed bug #71536 (Access Violation crashes php-cgi.exe).
    PHP logo

    PHP is developed and maintained by a global community of contributors.

    The PHP Foundation helps fund this work. If PHP is part of your business or projects, consider sponsoring the Foundation.
    PHP

    Learn

    The PHP Foundation

    Legal

    Copyright © 2001 - 2026 the PHP Group. All Rights Reserved.
    To Top