PHP 8.3.16 Release Announcement

The PHP development team announces the immediate availability of PHP 8.3.16. This is a bug fix release.

All PHP 8.3 users are encouraged to upgrade to this version.

For source downloads of PHP 8.3.16 please visit our downloads page, Windows source and binaries can be found on windows.php.net/download/. The list of changes is recorded in the ChangeLog.

Source Code

• PHP 8.3.16 (tar.gz)
  sha256: 61441627dca50cf0173e3f054ffe8c4f5db6552555c43cab87a8ecacfd201c7e
• PHP 8.3.16 (tar.bz2)
  sha256: e9208218cbdcb816834b6c5ed8ddc5748fb12ff777cf9e0e03bb4896276608b6
• PHP 8.3.16 (tar.xz)
  sha256: 40d3b4e6cac33d3bcefe096d75a28d4fb4e3a9615eb20a4de55ba139fbfacdd5

Change Log

• core
  • Fixed bug GH-17106 (ZEND_MATCH_ERROR misoptimization).
  • Fixed bug GH-17162 (zend_array_try_init() with dtor can cause engine UAF).
  • Fixed bug GH-17101 (AST->string does not reproduce constructor property promotion correctly).
  • Fixed bug GH-17211 (observer segfault on function loaded with dl()).
  • Fixed bug GH-17216 (Trampoline crash on error).
• date
  • Fixed bug GH-14709 DatePeriod::__construct() overflow on recurrences.
• dba
  • Skip test if inifile is disabled.
• dom
  • Fixed bug GH-17224 (UAF in importNode).
• embed
  • Make build command for program using embed portable.
• ffi
  • Fixed bug #79075 (FFI header parser chokes on comments).
  • Fix memory leak on ZEND_FFI_TYPE_CHAR conversion failure.
  • Fixed bug GH-16013 and bug #80857 (Big endian issues).
• filter
  • Fixed bug GH-16944 (Fix filtering special IPv4 and IPv6 ranges, by using information from RFC 6890).
• fpm
  • Fixed bug GH-13437 (FPM: ERROR: scoreboard: failed to lock (already locked)).
  • Fixed bug GH-17112 (Macro redefinitions).
  • Fixed bug GH-17208 (bug64539-status-json-encoding.phpt fail on 32-bits).
• gd
  • Fixed bug GH-16255 (Unexpected nan value in ext/gd/libgd/gd_filter.c).
  • Ported fix for libgd bug 276 (Sometimes pixels are missing when storing images as BMPs).
• gettext
  • Fixed bug GH-17202 (Segmentation fault ext/gettext/gettext.c bindtextdomain()).
• iconv
  • Fixed bug GH-17047 (UAF on iconv filter failure).
• ldap
  • Fixed bug GH-17280 (ldap_search() fails when $attributes array has holes).
• libxml
  • Fixed bug GH-17223 (Memory leak in libxml encoding handling).
• mbstring
  • Fixed bug GH-17112 (Macro redefinitions).
• opcache
  • opcache_get_configuration() properly reports jit_prof_threshold.
  • Fixed bug GH-17246 (GC during SCCP causes segfault).
• pcntl
  • Fix memory leak in cleanup code of pcntl_exec() when a non stringable value is encountered past the first entry.
• pgsql
  • Fixed bug GH-17158 (pg_fetch_result Shows Incorrect ArgumentCountError Message when Called With 1 Argument).
  • Fixed further ArgumentCountError for calls with flexible number of arguments.
• phar
  • Fixed bug GH-17137 (Segmentation fault ext/phar/phar.c).
• simplexml
  • Fixed bug GH-17040 (SimpleXML's unset can break DOM objects).
  • Fixed bug GH-17153 (SimpleXML crash when using autovivification on document).
• sockets
  • Fixed bug GH-16276 (socket_strerror overflow handling with INT_MIN).
  • Fixed overflow on SO_LINGER values setting, strengthening values check on SO_SNDTIMEO/SO_RCVTIMEO for socket_set_option().
• spl
  • Fixed bug GH-17225 (NULL deref in spl_directory.c).
• streams
  • Fixed bug GH-17037 (UAF in user filter when adding existing filter name due to incorrect error handling).
  • Fixed bug GH-16810 (overflow on fopen HTTP wrapper timeout value).
  • Fixed bug GH-17067 (glob:// wrapper doesn't cater to CWD for ZTS builds).
• windows
  • Hardened proc_open() against cmd.exe hijacking.
• xml
  • Fixed bug GH-1718 (unreachable program point in zend_hash).