From 2709ebc0ce64fb016be2c4647d979061677e0fdb Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+ndossche@users.noreply.github.com>
Date: Fri, 26 Dec 2025 13:58:01 +0100
Subject: [PATCH 01/11] Fix OOB gzseek() causing assertion failure

Closes GH-20785.
---
 NEWS                                |  3 +++
 ext/zlib/tests/gzseek_seek_oob.phpt | 19 +++++++++++++++++++
 ext/zlib/zlib_fopen_wrapper.c       |  9 +++++++--
 3 files changed, 29 insertions(+), 2 deletions(-)
 create mode 100644 ext/zlib/tests/gzseek_seek_oob.phpt

diff --git a/NEWS b/NEWS
index 77119e29fcfc4..0b5020c6f0c80 100644
--- a/NEWS
+++ b/NEWS
@@ -54,6 +54,9 @@ PHP                                                                        NEWS
   . Fix error check for proc_open() command. (ndossche)
   . Fixed bug GH-20582 (Heap Buffer Overflow in iptcembed). (ndossche)
 
+- Zlib:
+  . Fix OOB gzseek() causing assertion failure. (ndossche)
+
 18 Dec 2025, PHP 8.3.29
 
 - Core:
diff --git a/ext/zlib/tests/gzseek_seek_oob.phpt b/ext/zlib/tests/gzseek_seek_oob.phpt
new file mode 100644
index 0000000000000..021f8cb174dab
--- /dev/null
+++ b/ext/zlib/tests/gzseek_seek_oob.phpt
@@ -0,0 +1,19 @@
+--TEST--
+Test function gzseek() by seeking out of bounds
+--EXTENSIONS--
+zlib
+--FILE--
+<?php
+$f = __DIR__."/004.txt.gz";
+$h = gzopen($f, 'r');
+
+var_dump(gzseek($h, -100, SEEK_CUR));
+var_dump(gzseek($h, 0, SEEK_CUR));
+var_dump(gztell($h));
+
+gzclose($h);
+?>
+--EXPECT--
+int(-1)
+int(0)
+int(0)
diff --git a/ext/zlib/zlib_fopen_wrapper.c b/ext/zlib/zlib_fopen_wrapper.c
index 31b5212a720ac..da948af37ffc6 100644
--- a/ext/zlib/zlib_fopen_wrapper.c
+++ b/ext/zlib/zlib_fopen_wrapper.c
@@ -94,9 +94,14 @@ static int php_gziop_seek(php_stream *stream, zend_off_t offset, int whence, zen
 		php_error_docref(NULL, E_WARNING, "SEEK_END is not supported");
 		return -1;
 	}
-	*newoffs = gzseek(self->gz_file, offset, whence);
 
-	return (*newoffs < 0) ? -1 : 0;
+	z_off_t new_offset = gzseek(self->gz_file, offset, whence);
+	if (new_offset < 0) {
+		return -1;
+	}
+
+	*newoffs = new_offset;
+	return 0;
 }
 
 static int php_gziop_close(php_stream *stream, int close_handle)

From b86f107076cc328eb777355163a5880713ef337d Mon Sep 17 00:00:00 2001
From: Gina Peter Banyard <girgias@php.net>
Date: Wed, 24 Dec 2025 16:46:09 +0100
Subject: [PATCH 02/11] ext/standard: refactor _php_error_log()

In preparation for php_mail() refactoring
---
 UPGRADING.INTERNALS            |  5 +++++
 ext/standard/basic_functions.c | 32 ++++++++++++--------------------
 ext/standard/basic_functions.h |  4 +---
 3 files changed, 18 insertions(+), 23 deletions(-)

diff --git a/UPGRADING.INTERNALS b/UPGRADING.INTERNALS
index 3ec54f49391b8..9b30458392a87 100644
--- a/UPGRADING.INTERNALS
+++ b/UPGRADING.INTERNALS
@@ -70,6 +70,11 @@ PHP 8.6 INTERNALS UPGRADE NOTES
 - ext/mbstring:
   . Added GB18030-2022 to default encoding list for zh-CN.
 
+- ext/standard:
+  . _php_error_log() now has a formal return type of zend_result.
+  . _php_error_log() now accepts zend_string* values instead of char*.
+  . _php_error_log_ex() has been removed.
+
 ========================
 4. OpCode changes
 ========================
diff --git a/ext/standard/basic_functions.c b/ext/standard/basic_functions.c
index 8b72ffffc8379..b87eacfdfda32 100644
--- a/ext/standard/basic_functions.c
+++ b/ext/standard/basic_functions.c
@@ -1330,19 +1330,18 @@ error options:
 /* {{{ Send an error message somewhere */
 PHP_FUNCTION(error_log)
 {
-	char *message, *opt = NULL, *headers = NULL;
-	size_t message_len, opt_len = 0, headers_len = 0;
+	zend_string *message, *opt = NULL, *headers = NULL;
 	zend_long erropt = 0;
 
 	ZEND_PARSE_PARAMETERS_START(1, 4)
-		Z_PARAM_STRING(message, message_len)
+		Z_PARAM_STR(message)
 		Z_PARAM_OPTIONAL
 		Z_PARAM_LONG(erropt)
-		Z_PARAM_PATH_OR_NULL(opt, opt_len)
-		Z_PARAM_STRING_OR_NULL(headers, headers_len)
+		Z_PARAM_PATH_STR_OR_NULL(opt)
+		Z_PARAM_STR_OR_NULL(headers)
 	ZEND_PARSE_PARAMETERS_END();
 
-	if (_php_error_log_ex((int) erropt, message, message_len, opt, headers) == FAILURE) {
+	if (_php_error_log((int) erropt, message, opt, headers) == FAILURE) {
 		RETURN_FALSE;
 	}
 
@@ -1350,14 +1349,7 @@ PHP_FUNCTION(error_log)
 }
 /* }}} */
 
-/* For BC (not binary-safe!) */
-PHPAPI int _php_error_log(int opt_err, const char *message, const char *opt, const char *headers) /* {{{ */
-{
-	return _php_error_log_ex(opt_err, message, (opt_err == 3) ? strlen(message) : 0, opt, headers);
-}
-/* }}} */
-
-PHPAPI int _php_error_log_ex(int opt_err, const char *message, size_t message_len, const char *opt, const char *headers) /* {{{ */
+PHPAPI zend_result _php_error_log(int opt_err, const zend_string *message, const zend_string *opt, const zend_string *headers) /* {{{ */
 {
 	php_stream *stream = NULL;
 	size_t nbytes;
@@ -1365,7 +1357,7 @@ PHPAPI int _php_error_log_ex(int opt_err, const char *message, size_t message_le
 	switch (opt_err)
 	{
 		case 1:		/*send an email */
-			if (!php_mail(opt, "PHP error_log message", message, headers, NULL)) {
+			if (!php_mail(ZSTR_VAL(opt), "PHP error_log message", ZSTR_VAL(message), ZSTR_VAL(headers), NULL)) {
 				return FAILURE;
 			}
 			break;
@@ -1375,27 +1367,27 @@ PHPAPI int _php_error_log_ex(int opt_err, const char *message, size_t message_le
 			return FAILURE;
 
 		case 3:		/*save to a file */
-			stream = php_stream_open_wrapper(opt, "a", REPORT_ERRORS, NULL);
+			stream = php_stream_open_wrapper(ZSTR_VAL(opt), "a", REPORT_ERRORS, NULL);
 			if (!stream) {
 				return FAILURE;
 			}
-			nbytes = php_stream_write(stream, message, message_len);
+			nbytes = php_stream_write(stream, ZSTR_VAL(message), ZSTR_LEN(message));
 			php_stream_close(stream);
-			if (nbytes != message_len) {
+			if (nbytes != ZSTR_LEN(message)) {
 				return FAILURE;
 			}
 			break;
 
 		case 4: /* send to SAPI */
 			if (sapi_module.log_message) {
-				sapi_module.log_message(message, -1);
+				sapi_module.log_message(ZSTR_VAL(message), -1);
 			} else {
 				return FAILURE;
 			}
 			break;
 
 		default:
-			php_log_err_with_severity(message, LOG_NOTICE);
+			php_log_err_with_severity(ZSTR_VAL(message), LOG_NOTICE);
 			break;
 	}
 	return SUCCESS;
diff --git a/ext/standard/basic_functions.h b/ext/standard/basic_functions.h
index 8c8c6ba58dfd6..e5b85fbc2d53c 100644
--- a/ext/standard/basic_functions.h
+++ b/ext/standard/basic_functions.h
@@ -46,9 +46,7 @@ PHP_MINIT_FUNCTION(user_filters);
 PHP_RSHUTDOWN_FUNCTION(user_filters);
 PHP_RSHUTDOWN_FUNCTION(browscap);
 
-/* Left for BC (not binary safe!) */
-PHPAPI int _php_error_log(int opt_err, const char *message, const char *opt, const char *headers);
-PHPAPI int _php_error_log_ex(int opt_err, const char *message, size_t message_len, const char *opt, const char *headers);
+PHPAPI zend_result _php_error_log(int opt_err, const zend_string *message, const zend_string *opt, const zend_string *headers);
 
 typedef struct _php_basic_globals {
 	HashTable *user_shutdown_function_names;

From 87278167340dec0d65696118ac402b8783e0875c Mon Sep 17 00:00:00 2001
From: Gina Peter Banyard <girgias@php.net>
Date: Wed, 24 Dec 2025 16:53:09 +0100
Subject: [PATCH 03/11] ext/standard: use RETURN_BOOL() when possible

---
 ext/standard/basic_functions.c | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/ext/standard/basic_functions.c b/ext/standard/basic_functions.c
index b87eacfdfda32..c108900103cc1 100644
--- a/ext/standard/basic_functions.c
+++ b/ext/standard/basic_functions.c
@@ -1341,11 +1341,7 @@ PHP_FUNCTION(error_log)
 		Z_PARAM_STR_OR_NULL(headers)
 	ZEND_PARSE_PARAMETERS_END();
 
-	if (_php_error_log((int) erropt, message, opt, headers) == FAILURE) {
-		RETURN_FALSE;
-	}
-
-	RETURN_TRUE;
+	RETURN_BOOL(_php_error_log((int) erropt, message, opt, headers) == SUCCESS);
 }
 /* }}} */
 
@@ -2314,11 +2310,7 @@ PHP_FUNCTION(is_uploaded_file)
 		RETURN_FALSE;
 	}
 
-	if (zend_hash_exists(SG(rfc1867_uploaded_files), path)) {
-		RETURN_TRUE;
-	} else {
-		RETURN_FALSE;
-	}
+	RETURN_BOOL(zend_hash_exists(SG(rfc1867_uploaded_files), path));
 }
 /* }}} */
 

From e101706ecfba86fcf19d015d6950aefb51a3a393 Mon Sep 17 00:00:00 2001
From: Gina Peter Banyard <girgias@php.net>
Date: Wed, 24 Dec 2025 17:08:16 +0100
Subject: [PATCH 04/11] ext/standard/mail.c: add const qualifiers

---
 ext/standard/mail.c     | 16 ++++++++--------
 ext/standard/php_mail.h |  2 +-
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/ext/standard/mail.c b/ext/standard/mail.c
index 3ffb7d05bb4b0..d2abd13643ba0 100644
--- a/ext/standard/mail.c
+++ b/ext/standard/mail.c
@@ -113,7 +113,7 @@ static php_mail_header_value_error_type php_mail_build_headers_check_field_value
 }
 
 
-static bool php_mail_build_headers_check_field_name(zend_string *key)
+static bool php_mail_build_headers_check_field_name(const zend_string *key)
 {
 	size_t len = 0;
 
@@ -128,9 +128,9 @@ static bool php_mail_build_headers_check_field_name(zend_string *key)
 }
 
 
-static void php_mail_build_headers_elems(smart_str *s, zend_string *key, zval *val);
+static void php_mail_build_headers_elems(smart_str *s, const zend_string *key, zval *val);
 
-static void php_mail_build_headers_elem(smart_str *s, zend_string *key, zval *val)
+static void php_mail_build_headers_elem(smart_str *s, const zend_string *key, zval *val)
 {
 	switch(Z_TYPE_P(val)) {
 		case IS_STRING:
@@ -174,7 +174,7 @@ static void php_mail_build_headers_elem(smart_str *s, zend_string *key, zval *va
 }
 
 
-static void php_mail_build_headers_elems(smart_str *s, zend_string *key, zval *val)
+static void php_mail_build_headers_elems(smart_str *s, const zend_string *key, zval *val)
 {
 	zend_string *tmp_key;
 	zval *tmp_val;
@@ -208,7 +208,7 @@ do { \
 	} \
 } while(0)
 
-PHPAPI zend_string *php_mail_build_headers(HashTable *headers)
+PHPAPI zend_string *php_mail_build_headers(const HashTable *headers)
 {
 	zend_ulong idx;
 	zend_string *key;
@@ -392,7 +392,7 @@ static void php_mail_log_to_syslog(char *message) {
 }
 
 
-static void php_mail_log_to_file(char *filename, char *message, size_t message_size) {
+static void php_mail_log_to_file(const char *filename, const char *message, size_t message_size) {
 	/* Write 'message' to the given file. */
 	uint32_t flags = REPORT_ERRORS | STREAM_DISABLE_OPEN_BASEDIR;
 	php_stream *stream = php_stream_open_wrapper(filename, "a", flags, NULL);
@@ -446,7 +446,7 @@ PHPAPI bool php_mail(const char *to, const char *subject, const char *message, c
 	FILE *sendmail;
 	char *sendmail_path = INI_STR("sendmail_path");
 	char *sendmail_cmd = NULL;
-	char *mail_log = INI_STR("mail.log");
+	const char *mail_log = INI_STR("mail.log");
 	const char *hdr = headers;
 	char *ahdr = NULL;
 #if PHP_SIGCHILD
@@ -495,7 +495,7 @@ PHPAPI bool php_mail(const char *to, const char *subject, const char *message, c
 		MAIL_RET(false);
 	}
 
-	char *line_sep;
+	const char *line_sep;
 	zend_string *cr_lf_mode = PG(mail_cr_lf_mode);
 	
 	if (cr_lf_mode && !zend_string_equals_literal(cr_lf_mode, "crlf")) {
diff --git a/ext/standard/php_mail.h b/ext/standard/php_mail.h
index c2e22240c48e9..731b70c0e105f 100644
--- a/ext/standard/php_mail.h
+++ b/ext/standard/php_mail.h
@@ -19,7 +19,7 @@
 
 PHP_MINFO_FUNCTION(mail);
 
-PHPAPI zend_string *php_mail_build_headers(HashTable *headers);
+PHPAPI zend_string *php_mail_build_headers(const HashTable *headers);
 PHPAPI extern bool php_mail(const char *to, const char *subject, const char *message, const char *headers, const char *extra_cmd);
 
 #endif /* PHP_MAIL_H */

From d3a372c70d176966f87bd50ed2a8c00be2cbe665 Mon Sep 17 00:00:00 2001
From: Gina Peter Banyard <girgias@php.net>
Date: Wed, 24 Dec 2025 17:14:52 +0100
Subject: [PATCH 05/11] ext/standard/mail.c: use zend_string for mail_log

---
 ext/standard/mail.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/ext/standard/mail.c b/ext/standard/mail.c
index d2abd13643ba0..b3f40847d568e 100644
--- a/ext/standard/mail.c
+++ b/ext/standard/mail.c
@@ -392,10 +392,10 @@ static void php_mail_log_to_syslog(char *message) {
 }
 
 
-static void php_mail_log_to_file(const char *filename, const char *message, size_t message_size) {
+static void php_mail_log_to_file(const zend_string *filename, const char *message, size_t message_size) {
 	/* Write 'message' to the given file. */
 	uint32_t flags = REPORT_ERRORS | STREAM_DISABLE_OPEN_BASEDIR;
-	php_stream *stream = php_stream_open_wrapper(filename, "a", flags, NULL);
+	php_stream *stream = php_stream_open_wrapper(ZSTR_VAL(filename), "a", flags, NULL);
 	if (stream) {
 		php_stream_write(stream, message, message_size);
 		php_stream_close(stream);
@@ -446,7 +446,7 @@ PHPAPI bool php_mail(const char *to, const char *subject, const char *message, c
 	FILE *sendmail;
 	char *sendmail_path = INI_STR("sendmail_path");
 	char *sendmail_cmd = NULL;
-	const char *mail_log = INI_STR("mail.log");
+	const zend_string *mail_log = zend_ini_str(ZEND_STRL("mail.log"), false);
 	const char *hdr = headers;
 	char *ahdr = NULL;
 #if PHP_SIGCHILD
@@ -459,7 +459,7 @@ PHPAPI bool php_mail(const char *to, const char *subject, const char *message, c
 	}	\
 	return val;	\
 
-	if (mail_log && *mail_log) {
+	if (mail_log && ZSTR_LEN(mail_log)) {
 		char *logline;
 
 		spprintf(&logline, 0, "mail() on [%s:%d]: To: %s -- Headers: %s -- Subject: %s", zend_get_executed_filename(), zend_get_executed_lineno(), to, hdr ? hdr : "", subject);
@@ -468,7 +468,7 @@ PHPAPI bool php_mail(const char *to, const char *subject, const char *message, c
 			php_mail_log_crlf_to_spaces(logline);
 		}
 
-		if (!strcmp(mail_log, "syslog")) {
+		if (zend_string_equals_literal(mail_log, "syslog")) {
 			php_mail_log_to_syslog(logline);
 		} else {
 			/* Add date when logging to file */

From 10425538075238165f3d8d6fb94b57aeec7c5cb3 Mon Sep 17 00:00:00 2001
From: Gina Peter Banyard <girgias@php.net>
Date: Wed, 24 Dec 2025 17:23:06 +0100
Subject: [PATCH 06/11] ext/standard/mail.c: use smart_str_append when we have
 zend_string*

---
 ext/standard/mail.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ext/standard/mail.c b/ext/standard/mail.c
index b3f40847d568e..b8381be0626b4 100644
--- a/ext/standard/mail.c
+++ b/ext/standard/mail.c
@@ -162,7 +162,7 @@ static void php_mail_build_headers_elem(smart_str *s, const zend_string *key, zv
 			}
 			smart_str_append(s, key);
 			smart_str_appendl(s, ": ", 2);
-			smart_str_appends(s, Z_STRVAL_P(val));
+			smart_str_append(s, Z_STR_P(val));
 			smart_str_appendl(s, "\r\n", 2);
 			break;
 		case IS_ARRAY:

From 67a89f6bf0034f0bc70e0ab08fcb77c4f0443c22 Mon Sep 17 00:00:00 2001
From: Gina Peter Banyard <girgias@php.net>
Date: Wed, 24 Dec 2025 17:28:27 +0100
Subject: [PATCH 07/11] ext/standard/mail.c: refactor
 php_mail_build_headers_check_field_name()

Fix incorrect return type
Use zend_string macros
---
 ext/standard/mail.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/ext/standard/mail.c b/ext/standard/mail.c
index b8381be0626b4..0d1b34d71662c 100644
--- a/ext/standard/mail.c
+++ b/ext/standard/mail.c
@@ -112,14 +112,13 @@ static php_mail_header_value_error_type php_mail_build_headers_check_field_value
 	return NO_HEADER_ERROR;
 }
 
-
-static bool php_mail_build_headers_check_field_name(const zend_string *key)
+static zend_result php_mail_build_headers_check_field_name(const zend_string *key)
 {
 	size_t len = 0;
 
 	/* https://tools.ietf.org/html/rfc2822#section-2.2 */
-	while (len < key->len) {
-		if (*(key->val+len) < 33 || *(key->val+len) > 126 || *(key->val+len) == ':') {
+	while (len < ZSTR_LEN(key)) {
+		if (*(ZSTR_VAL(key)+len) < 33 || *(ZSTR_VAL(key)+len) > 126 || *(ZSTR_VAL(key)+len) == ':') {
 			return FAILURE;
 		}
 		len++;

From 402f08437377660ec7cb15aa4b207594dddd7231 Mon Sep 17 00:00:00 2001
From: Gina Peter Banyard <girgias@php.net>
Date: Wed, 24 Dec 2025 17:37:43 +0100
Subject: [PATCH 08/11] ext/standard/mail.c: use php_mail_build_headers_elem()
 directly

The branching logic is already defined in the function
---
 ext/standard/mail.c | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/ext/standard/mail.c b/ext/standard/mail.c
index 0d1b34d71662c..0788d54ebf012 100644
--- a/ext/standard/mail.c
+++ b/ext/standard/mail.c
@@ -245,13 +245,7 @@ PHPAPI zend_string *php_mail_build_headers(const HashTable *headers)
 		} else if (zend_string_equals_literal_ci(key, "subject")) {
 			zend_value_error("The additional headers cannot contain the \"Subject\" header");
 		} else {
-			if (Z_TYPE_P(val) == IS_STRING) {
-				php_mail_build_headers_elem(&s, key, val);
-			} else if (Z_TYPE_P(val) == IS_ARRAY) {
-				php_mail_build_headers_elems(&s, key, val);
-			} else {
-				zend_type_error("Header \"%s\" must be of type array|string, %s given", ZSTR_VAL(key), zend_zval_value_name(val));
-			}
+			php_mail_build_headers_elem(&s, key, val);
 		}
 
 		if (EG(exception)) {

From 5f8c7dc87c50a6a4077248c69bad1bc443972f98 Mon Sep 17 00:00:00 2001
From: Gina Peter Banyard <girgias@php.net>
Date: Wed, 24 Dec 2025 17:55:18 +0100
Subject: [PATCH 09/11] ext/standard/mail.c: refactor
 php_mail_build_headers_check_field_value()

Change paremeter type to be zend_string* rather than assuming the zval IS_STRING
Use zend_string macros
Add const qualifier
---
 ext/standard/mail.c | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/ext/standard/mail.c b/ext/standard/mail.c
index 0788d54ebf012..01e1148af0829 100644
--- a/ext/standard/mail.c
+++ b/ext/standard/mail.c
@@ -68,21 +68,20 @@ typedef enum {
 	CONTAINS_NULL
 } php_mail_header_value_error_type;
 
-static php_mail_header_value_error_type php_mail_build_headers_check_field_value(zval *val)
+static php_mail_header_value_error_type php_mail_build_headers_check_field_value(const zend_string *value)
 {
 	size_t len = 0;
-	zend_string *value = Z_STR_P(val);
 
 	/* https://tools.ietf.org/html/rfc2822#section-2.2.1 */
 	/* https://tools.ietf.org/html/rfc2822#section-2.2.3 */
-	while (len < value->len) {
-		if (*(value->val+len) == '\r') {
-			if (*(value->val+len+1) != '\n') {
+	while (len < ZSTR_LEN(value)) {
+		if (*(ZSTR_VAL(value)+len) == '\r') {
+			if (*(ZSTR_VAL(value)+len+1) != '\n') {
 				return CONTAINS_CR_ONLY;
 			}
 
-			if (value->len - len >= 3
-				&& (*(value->val+len+2) == ' '  || *(value->val+len+2) == '\t')) {
+			if (ZSTR_LEN(value) - len >= 3
+				&& (*(ZSTR_VAL(value)+len+2) == ' ' || *(ZSTR_VAL(value)+len+2) == '\t')) {
 				len += 3;
 				continue;
 			}
@@ -96,15 +95,15 @@ static php_mail_header_value_error_type php_mail_build_headers_check_field_value
 		 * Therefore, considering such an environment, folding with LF alone
 		 * is allowed.
 		 */
-		if (*(value->val+len) == '\n') {
-			if (value->len - len >= 2
-				&& (*(value->val+len+1) == ' '  || *(value->val+len+1) == '\t')) {
+		if (*(ZSTR_VAL(value)+len) == '\n') {
+			if (ZSTR_LEN(value) - len >= 2
+				&& (*(ZSTR_VAL(value)+len+1) == ' ' || *(ZSTR_VAL(value)+len+1) == '\t')) {
 				len += 2;
 				continue;
 			}
 			return CONTAINS_LF_ONLY;
 		}
-		if (*(value->val+len) == '\0') {
+		if (*(ZSTR_VAL(value)+len) == '\0') {
 			return CONTAINS_NULL;
 		}
 		len++;
@@ -138,7 +137,8 @@ static void php_mail_build_headers_elem(smart_str *s, const zend_string *key, zv
 				return;
 			}
 
-			php_mail_header_value_error_type error_type = php_mail_build_headers_check_field_value(val);
+			zend_string *str_value = Z_STR_P(val);
+			php_mail_header_value_error_type error_type = php_mail_build_headers_check_field_value(str_value);
 			switch (error_type) {
 				case NO_HEADER_ERROR:
 					break;
@@ -161,7 +161,7 @@ static void php_mail_build_headers_elem(smart_str *s, const zend_string *key, zv
 			}
 			smart_str_append(s, key);
 			smart_str_appendl(s, ": ", 2);
-			smart_str_append(s, Z_STR_P(val));
+			smart_str_append(s, str_value);
 			smart_str_appendl(s, "\r\n", 2);
 			break;
 		case IS_ARRAY:

From c727f4d6c5f258a69db04fc6f7d21e034afdc412 Mon Sep 17 00:00:00 2001
From: Gina Peter Banyard <girgias@php.net>
Date: Wed, 24 Dec 2025 18:08:32 +0100
Subject: [PATCH 10/11] ext/standard/mail: use zend_string* for extra_cmd param
 of php_mail()

---
 UPGRADING.INTERNALS     | 1 +
 ext/mbstring/mbstring.c | 2 +-
 ext/standard/mail.c     | 6 +++---
 ext/standard/php_mail.h | 2 +-
 4 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/UPGRADING.INTERNALS b/UPGRADING.INTERNALS
index 9b30458392a87..22b9e6f660cb1 100644
--- a/UPGRADING.INTERNALS
+++ b/UPGRADING.INTERNALS
@@ -74,6 +74,7 @@ PHP 8.6 INTERNALS UPGRADE NOTES
   . _php_error_log() now has a formal return type of zend_result.
   . _php_error_log() now accepts zend_string* values instead of char*.
   . _php_error_log_ex() has been removed.
+  . php_mail()'s extra_cmd parameter is now a zend_string*.
 
 ========================
 4. OpCode changes
diff --git a/ext/mbstring/mbstring.c b/ext/mbstring/mbstring.c
index 12c366c33d5e2..c5331ef017af6 100644
--- a/ext/mbstring/mbstring.c
+++ b/ext/mbstring/mbstring.c
@@ -4703,7 +4703,7 @@ PHP_FUNCTION(mb_send_mail)
 		extra_cmd = php_escape_shell_cmd(extra_cmd);
 	}
 
-	RETVAL_BOOL(php_mail(to_r, ZSTR_VAL(subject), message, ZSTR_VAL(str_headers), extra_cmd ? ZSTR_VAL(extra_cmd) : NULL));
+	RETVAL_BOOL(php_mail(to_r, ZSTR_VAL(subject), message, ZSTR_VAL(str_headers), extra_cmd));
 
 	if (extra_cmd) {
 		zend_string_release_ex(extra_cmd, 0);
diff --git a/ext/standard/mail.c b/ext/standard/mail.c
index 01e1148af0829..395c7bb81d4f9 100644
--- a/ext/standard/mail.c
+++ b/ext/standard/mail.c
@@ -343,7 +343,7 @@ PHP_FUNCTION(mail)
 		extra_cmd = php_escape_shell_cmd(extra_cmd);
 	}
 
-	if (php_mail(to_r, subject_r, message, headers_str && ZSTR_LEN(headers_str) ? ZSTR_VAL(headers_str) : NULL, extra_cmd ? ZSTR_VAL(extra_cmd) : NULL)) {
+	if (php_mail(to_r, subject_r, message, headers_str && ZSTR_LEN(headers_str) ? ZSTR_VAL(headers_str) : NULL, extra_cmd)) {
 		RETVAL_TRUE;
 	} else {
 		RETVAL_FALSE;
@@ -434,7 +434,7 @@ static int php_mail_detect_multiple_crlf(const char *hdr) {
 
 
 /* {{{ php_mail */
-PHPAPI bool php_mail(const char *to, const char *subject, const char *message, const char *headers, const char *extra_cmd)
+PHPAPI bool php_mail(const char *to, const char *subject, const char *message, const char *headers, const zend_string *extra_cmd)
 {
 	FILE *sendmail;
 	char *sendmail_path = INI_STR("sendmail_path");
@@ -551,7 +551,7 @@ PHPAPI bool php_mail(const char *to, const char *subject, const char *message, c
 #endif
 	}
 	if (extra_cmd != NULL) {
-		spprintf(&sendmail_cmd, 0, "%s %s", sendmail_path, extra_cmd);
+		spprintf(&sendmail_cmd, 0, "%s %s", sendmail_path, ZSTR_VAL(extra_cmd));
 	} else {
 		sendmail_cmd = sendmail_path;
 	}
diff --git a/ext/standard/php_mail.h b/ext/standard/php_mail.h
index 731b70c0e105f..bebb526699d0b 100644
--- a/ext/standard/php_mail.h
+++ b/ext/standard/php_mail.h
@@ -20,6 +20,6 @@
 PHP_MINFO_FUNCTION(mail);
 
 PHPAPI zend_string *php_mail_build_headers(const HashTable *headers);
-PHPAPI extern bool php_mail(const char *to, const char *subject, const char *message, const char *headers, const char *extra_cmd);
+PHPAPI extern bool php_mail(const char *to, const char *subject, const char *message, const char *headers, const zend_string *extra_cmd);
 
 #endif /* PHP_MAIL_H */

From 6e733a2bd0842f7919d7ad7665b7c8a6729bb717 Mon Sep 17 00:00:00 2001
From: Niels Dossche <7771979+ndossche@users.noreply.github.com>
Date: Sun, 28 Dec 2025 01:32:21 +0100
Subject: [PATCH 11/11] Fix zlib test for 8.5+

---
 ext/zlib/tests/gzseek_seek_oob.phpt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ext/zlib/tests/gzseek_seek_oob.phpt b/ext/zlib/tests/gzseek_seek_oob.phpt
index 021f8cb174dab..e05ea4778b94b 100644
--- a/ext/zlib/tests/gzseek_seek_oob.phpt
+++ b/ext/zlib/tests/gzseek_seek_oob.phpt
@@ -4,7 +4,7 @@ Test function gzseek() by seeking out of bounds
 zlib
 --FILE--
 <?php
-$f = __DIR__."/004.txt.gz";
+$f = __DIR__."/data/test.txt.gz";
 $h = gzopen($f, 'r');
 
 var_dump(gzseek($h, -100, SEEK_CUR));