turkdevops · pull · Aug 31, 2026 · Aug 31, 2026 · Aug 31, 2026 · Aug 31, 2026
diff --git a/UPGRADING b/UPGRADING
@@ -639,6 +639,12 @@ PHP 8.6 UPGRADE NOTES
 5. Changed Functions
 ========================================
 
+- Filter:
+  . filter_var_array() return type has been narrowed from array|false|null to
+    array|false. The function always establishes an array before filtering, so
+    null was never returned. filter_input_array() is unaffected: it still
+    returns null when the requested superglobal does not exist.
+
 - GMP:
   . gmp_fact() now throws a ValueError if $num does not fit into an unsigned
     long.

diff --git a/Zend/Optimizer/zend_func_infos.h b/Zend/Optimizer/zend_func_infos.h
@@ -95,7 +95,7 @@ static const func_info_t func_infos[] = {
 	F1("finfo_buffer", MAY_BE_STRING|MAY_BE_FALSE),
 	F1("mime_content_type", MAY_BE_STRING|MAY_BE_FALSE),
 	F1("filter_input_array", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_KEY_STRING|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF|MAY_BE_FALSE|MAY_BE_NULL),
-	F1("filter_var_array", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_KEY_STRING|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF|MAY_BE_FALSE|MAY_BE_NULL),
+	F1("filter_var_array", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_KEY_STRING|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF|MAY_BE_FALSE),
 	F1("filter_list", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_OF_STRING),
 	F1("ftp_raw", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_OF_STRING|MAY_BE_NULL),
 	F1("ftp_nlist", MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_OF_STRING|MAY_BE_FALSE),

diff --git a/ext/filter/filter.stub.php b/ext/filter/filter.stub.php
@@ -310,7 +310,7 @@ function filter_var(mixed $value, int $filter = FILTER_DEFAULT, array|int $optio
 function filter_input_array(int $type, array|int $options = FILTER_DEFAULT, bool $add_empty = true): array|false|null {}
 
 /** @refcount 1 */
-function filter_var_array(array $array, array|int $options = FILTER_DEFAULT, bool $add_empty = true): array|false|null {}
+function filter_var_array(array $array, array|int $options = FILTER_DEFAULT, bool $add_empty = true): array|false {}
 
 /**
  * @return array<int, string>

diff --git a/ext/filter/filter_arginfo.h b/ext/filter/filter_arginfo.h
diff --git a/ext/mysqli/tests/fake_server.inc b/ext/mysqli/tests/fake_server.inc
@@ -721,19 +721,6 @@ function my_mysqli_test_auth_response_message_over_read(my_mysqli_fake_server_co
     $conn->read();
 }
 
-function my_mysqli_test_ok_packet_message_over_read(my_mysqli_fake_server_conn $conn): void
-{
-    $p = new my_mysqli_fake_packet();
-    $p->full = "08000001" . "00" . "00" . "00" . "0200" . "0000" . "fa";
-
-    $conn->send_server_greetings();
-    $conn->read_packets(1);
-    $conn->send_server_ok();
-    $conn->read_packets(1);
-    $conn->send($p->to_bytes(), "Malicious OK Packet [message length past the packet size]");
-    $conn->read();
-}
-
 function my_mysqli_test_stmt_response_row_over_read_string(my_mysqli_fake_server_conn $conn): void
 {
     $rh = $conn->packet_generator->server_stmt_execute_items_response();
@@ -829,50 +816,6 @@ function my_mysqli_test_stmt_response_row_read_two_fields(my_mysqli_fake_server_
     }
 }
 
-function my_mysqli_test_rset_field_metadata_len_over_read(my_mysqli_fake_server_conn $conn): void
-{
-    $rh = $conn->packet_generator->server_tabular_query_response();
-
-    $qr2 = new my_mysqli_fake_packet();
-    $qr2->packet_length = "0c0000";
-    $qr2->packet_number = "02";
-    $qr2->catalog_length_plus_name = "0161";
-    $qr2->db_length_plus_name = "0162";
-    $qr2->table_length_plus_name = "0163";
-    $qr2->original_t = "0164";
-    $qr2->name_length_plus_name = "0165";
-    $qr2->original_n = "fcff";
-
-    $conn->send_server_greetings();
-    $conn->read_packets(1);
-    $conn->send_server_ok();
-    $conn->read_packets(1);
-    $conn->send($conn->packets_to_bytes([$rh[0], $qr2]), "Malicious Tabular Response [metadata string length past the packet size]");
-    $conn->read();
-}
-
-function my_mysqli_test_rset_field_metadata_len_past_packet(my_mysqli_fake_server_conn $conn): void
-{
-    $rh = $conn->packet_generator->server_tabular_query_response();
-
-    $qr2 = new my_mysqli_fake_packet();
-    $qr2->packet_length = "0c0000";
-    $qr2->packet_number = "02";
-    $qr2->catalog_length_plus_name = "0161";
-    $qr2->db_length_plus_name = "0162";
-    $qr2->table_length_plus_name = "0163";
-    $qr2->original_t = "0164";
-    $qr2->name_length_plus_name = "0165";
-    $qr2->original_n = "0561";
-
-    $conn->send_server_greetings();
-    $conn->read_packets(1);
-    $conn->send_server_ok();
-    $conn->read_packets(1);
-    $conn->send($conn->packets_to_bytes([$rh[0], $qr2]), "Malicious Tabular Response [metadata string length past the packet size]");
-    $conn->read();
-}
-
 function my_mysqli_test_query_response_row_length_overflow(my_mysqli_fake_server_conn $conn): void
 {
     $rh = $conn->packet_generator->server_query_execute_data_response('strval');

diff --git a/ext/mysqli/tests/mysqlnd_ok_packet_message_over_read.phpt b/ext/mysqli/tests/mysqlnd_ok_packet_message_over_read.phpt
diff --git a/ext/mysqli/tests/mysqlnd_rset_field_len_over_read.phpt b/ext/mysqli/tests/mysqlnd_rset_field_len_over_read.phpt
diff --git a/ext/mysqli/tests/mysqlnd_rset_field_len_past_packet.phpt b/ext/mysqli/tests/mysqlnd_rset_field_len_past_packet.phpt
diff --git a/ext/mysqlnd/mysqlnd_wireprotocol.c b/ext/mysqlnd/mysqlnd_wireprotocol.c
@@ -876,12 +876,7 @@ php_mysqlnd_ok_read(MYSQLND_CONN_DATA * conn, void * _packet)
 
 	/* There is a message */
 	if (packet->header.size > (size_t) (p - buf) && (net_len = php_mysqlnd_net_field_length(&p))) {
-		if ((p - buf) > packet->header.size || packet->header.size - (p - buf) < net_len) {
-			DBG_ERR_FMT("OK packet message length is past the packet size");
-			php_error_docref(NULL, E_WARNING, "OK packet message length is past the packet size");
-			DBG_RETURN(FAIL);
-		}
-		packet->message_len = net_len;
+		packet->message_len = MIN(net_len, buf_len - (p - begin));
 		packet->message = mnd_pestrndup((char *)p, packet->message_len, FALSE);
 	} else {
 		packet->message = NULL;
@@ -1174,17 +1169,10 @@ void php_mysqlnd_rset_header_free_mem(void * _packet)
 /* }}} */
 
 #define READ_RSET_FIELD(field_name) do { \
-		BAIL_IF_NO_MORE_DATA; \
 		len = php_mysqlnd_net_field_length(&p); \
 		if (UNEXPECTED(len == MYSQLND_NULL_LENGTH)) { \
 			goto faulty_or_fake; \
 		} else if (len != 0) { \
-			BAIL_IF_NO_MORE_DATA; \
-			if (UNEXPECTED((p - begin) > packet->header.size || packet->header.size - (p - begin) < len)) { \
-				DBG_ERR_FMT("Result set field metadata string length is past the packet size"); \
-				php_error_docref(NULL, E_WARNING, "Result set field metadata string length is past the packet size"); \
-				DBG_RETURN(FAIL); \
-			} \
 			meta->field_name = (const char *)p; \
 			meta->field_name ## _length = len; \
 			p += len; \
@@ -1253,7 +1241,7 @@ php_mysqlnd_rset_field_read(MYSQLND_CONN_DATA * conn, void * _packet)
 	READ_RSET_FIELD(name);
 	READ_RSET_FIELD(org_name);
 
-	BAIL_IF_NO_MORE_DATA;
+	/* 1 byte length */
 	if (UNEXPECTED(12 != *p)) {
 		DBG_ERR_FMT("Protocol error. Server sent false length. Expected 12 got %d", (int) *p);
 		php_error_docref(NULL, E_WARNING, "Protocol error. Server sent false length. Expected 12");