* SECURITY UPDATE: heap buffer over-read in the convert.* stream filters when line-break-chars contains a NUL - debian/patches/php-5.6-CVE-2026-92842.patch: backport upstream commit b4e3397ec8f4 (GHSA-88hq-2827-7pg6) in ext/standard/filters.c. php_conv_base64_encode_ctor(), php_conv_qprint_encode_ctor() and php_conv_qprint_decode_ctor() duplicated the option with the strlen-based pestrdup() while keeping lbchars_len, which the option reader sets from Z_STRLEN, so a "line-break-chars" of "\0X" allocated one byte and the filters then copied two bytes out of it on every line break. The three calls become pestrndup(lbchars, lbchars_len, persistent). - Note: byte-identical to upstream, only the hunk line numbers differ. Upstream's .phpt is carried, rewritten for the 5.6 runner as ext/standard/tests/filters/ghsa-88hq-2827-7pg6.phpt. The suite is not run during the build, so it ships for manual and downstream runs. - CVE-2026-92842 * SECURITY UPDATE: integer overflow in the SOAP client's chunked response reader - debian/patches/php-5.6-CVE-2025-14181.patch: backport upstream commit b11bd1d9390b (GHSA-cj93-vc83-wgqv) in ext/soap/php_http.c. get_http_body() accumulated the body length in a signed int and guarded growth with "http_buf_size + buf_size + 1 < 0", which is signed overflow - undefined behaviour a modern compiler folds away - so a hostile endpoint answering with two 0x7fffffff-sized chunks made the second erealloc() request wrap to a small allocation that php_stream_read() then overflowed. The accumulator becomes unsigned, each growth step is bounded before it is performed, and the overflow test is a subtraction from the bound rather than a wrapping addition. - Note: PHP 5.x has no zend_string in this path, so the bound is INT_MAX - the representable maximum of the int *out_size this function reports the body length through - in place of upstream's ZSTR_MAX_LEN, and erealloc() stands in for zend_string_safe_realloc(). The Content-Length guard upstream retargets in the same commit is already present here. Upstream's regression test is not carried: tripping the overflow needs a response body past INT_MAX, i.e. more than 4 GB live in the test process, which a build or QA host cannot be assumed to have. - CVE-2025-14181 * SECURITY UPDATE: phar tar entry injection - debian/patches/php-5.6-CVE-2026-6103.patch: backport upstream commit 0994e2e887cd (GHSA-j3wh-g957-2m85) in ext/phar/tar.c and ext/phar/phar_internal.h. phar_tar_number() parsed the 512-byte header's size field with an unchecked octal accumulator over a php_uint32 and ignored trailing garbage and GNU base-256 encoding, and phar_parse_tarfile() skipped the data blocks of only the '\0' and TAR_FILE entry types. Either way the stream was left inside an entry's payload, which was then read as the next tar header, so one archive shows one set of entries to phar and another to every conforming tar reader. A new phar_tar_size() rejects sizes that cannot be parsed or represented, a new phar_tar_type_has_data() decides the skip for every type, GNU long link records are refused outright, and the bug-61065 guard now bounds the long file name by the archive size. - Note: adapted to C89 (the two new helpers return int rather than bool), to phar_destroy_phar_data()'s TSRMLS_CC, and to the pemalloc'd long-name buffer, which the new bail-outs release with pefree(). The three upstream .phpt files are carried, rewritten for the 5.6 runner and 5.6's PharData exception text, as ext/phar/tests/tar/ghsa-j3wh-g957-2m85-{size,typeflag,longlink}.phpt. - CVE-2026-6103 * SECURITY UPDATE: unbounded recursion in ext/soap XML parsing and decoding - debian/patches/php-5.6-CVE-2026-91765.patch: backport upstream commit 3655b79c7bfa (GHSA-rgrp-mwpx-f6rm) in ext/soap/php_xml.c, ext/soap/php_encoding.c, ext/soap/php_soap.h and ext/soap/soap.c. cleanup_xml_node() and get_node_with_attribute_recursive_ex() recursed once per XML nesting level and master_to_zval_int() once per decoded node and per href hop, with no cap; both SOAP parsers set XML_PARSE_HUGE, which turns off libxml2's own depth limit, so a deep envelope or WSDL - or a long href chain in a shallow one - exhausts the C stack. Both walkers become iterative, a 2048-level document cap is enforced after parsing where libxml2 is older than 2.13, and the decoder takes a depth counter bailing out at twice that. - Note: the counter is added to this version's soap globals struct rather than importing upstream's globals plumbing, and is reset in php_soap_init_globals(), encode_reset_ns() and encode_finish(), since soap_error0(E_ERROR) bails out past the matching decrement. Upstream's three .phpt files are carried as ext/soap/tests/GHSA-rgrp-mwpx-f6rm{,-href-chain,-href-cycle}.phpt, with the scalar type hints dropped for 5.6 and, in the href-chain test, the reference marker php-5.6-CVE-2026-6722.patch's added Z_ADDREF_PP() makes var_dump() print here. - CVE-2026-91765