[php-src] PHP-8.5: Merge branch 'PHP-8.4' into PHP-8.5

Author: Ilia Alshanetsky (iliaal)
Date: 2026-07-16T12:35:57-04:00

Commit: https://github.com/php/php-src/commit/27e3f6ba0bbc290667e4727b2b34e2d55502ece9
Raw diff: https://github.com/php/php-src/commit/27e3f6ba0bbc290667e4727b2b34e2d55502ece9.diff

Merge branch 'PHP-8.4' into PHP-8.5

* PHP-8.4:
  ext/filter: fix use-after-free in parse_str() with filter.default

Changed paths:
  A  ext/filter/tests/filter_default_parse_str.phpt
  M  ext/filter/filter.c


Diff:

diff --git a/ext/filter/filter.c b/ext/filter/filter.c
index a169ecf987d0..608d2172a7aa 100644
--- a/ext/filter/filter.c
+++ b/ext/filter/filter.c
@@ -380,15 +380,18 @@ static unsigned int php_sapi_filter(int arg, const char *var, char **val, size_t
 	}
 
 	if (retval) {
+		zend_string *tmp_str;
+		zend_string *str = zval_get_tmp_string(&new_var, &tmp_str);
 		if (new_val_len) {
-			*new_val_len = Z_STRLEN(new_var);
+			*new_val_len = ZSTR_LEN(str);
 		}
 		efree(*val);
-		if (Z_STRLEN(new_var)) {
-			*val = estrndup(Z_STRVAL(new_var), Z_STRLEN(new_var));
+		if (ZSTR_LEN(str)) {
+			*val = estrndup(ZSTR_VAL(str), ZSTR_LEN(str));
 		} else {
 			*val = estrdup("");
 		}
+		zend_tmp_string_release(tmp_str);
 		zval_ptr_dtor(&new_var);
 	}
 
diff --git a/ext/filter/tests/filter_default_parse_str.phpt b/ext/filter/tests/filter_default_parse_str.phpt
new file mode 100644
index 000000000000..71563060db36
--- /dev/null
+++ b/ext/filter/tests/filter_default_parse_str.phpt
@@ -0,0 +1,19 @@
+--TEST--
+filter.default with parse_str must not crash on non-string filter results
+--EXTENSIONS--
+filter
+--INI--
+filter.default=int
+--FILE--
+<?php
+parse_str('a=1&b=notint', $out);
+var_dump($out);
+?>
+--EXPECTF--
+Deprecated: The filter.default ini setting is deprecated in %s on line %d
+array(2) {
+  ["a"]=>
+  string(1) "1"
+  ["b"]=>
+  string(0) ""
+}