@@ -1016,6 +1016,18 @@ ZEND_API int _array_init(zval *arg, uint size ZEND_FILE_LINE_DC) /* {{{ */
 }
 /* }}} */
 
+/* The smallest array: $_GET, $_POST, $_COOKIE and their sub-arrays start with
+ * it, so that request variables cost as little memory as possible (the
+ * "singleton" arrays of the official fix). nTableMask == 0 marks a table that is
+ * not initialized yet in PHP 5, so 2 is the smallest size that works. */
+ZEND_API int _array_init_singleton(zval *arg ZEND_FILE_LINE_DC) /* {{{ */
+{
+	_array_init(arg, 0 ZEND_FILE_LINE_RELAY_CC);
+	Z_ARRVAL_P(arg)->nTableSize = 2;
+	return SUCCESS;
+}
+/* }}} */
+
 static int zend_merge_property(zval **value TSRMLS_DC, int num_args, va_list args, const zend_hash_key *hash_key) /* {{{ */
 {
 	/* which name should a numeric property have ? */
 
@@ -363,10 +363,12 @@ ZEND_API char *zend_get_type_by_const(int type);
 
 #define array_init(arg)			_array_init((arg), 0 ZEND_FILE_LINE_CC)
 #define array_init_size(arg, size) _array_init((arg), (size) ZEND_FILE_LINE_CC)
+#define array_init_singleton(arg)	_array_init_singleton((arg) ZEND_FILE_LINE_CC)
 #define object_init(arg)		_object_init((arg) ZEND_FILE_LINE_CC TSRMLS_CC)
 #define object_init_ex(arg, ce)	_object_init_ex((arg), (ce) ZEND_FILE_LINE_CC TSRMLS_CC)
 #define object_and_properties_init(arg, ce, properties)	_object_and_properties_init((arg), (ce), (properties) ZEND_FILE_LINE_CC TSRMLS_CC)
 ZEND_API int _array_init(zval *arg, uint size ZEND_FILE_LINE_DC);
+ZEND_API int _array_init_singleton(zval *arg ZEND_FILE_LINE_DC);
 ZEND_API int _object_init(zval *arg ZEND_FILE_LINE_DC TSRMLS_DC);
 ZEND_API int _object_init_ex(zval *arg, zend_class_entry *ce ZEND_FILE_LINE_DC TSRMLS_DC);
 ZEND_API int _object_and_properties_init(zval *arg, zend_class_entry *ce, HashTable *properties ZEND_FILE_LINE_DC TSRMLS_DC);
 
@@ -91,7 +91,37 @@ static void zend_mm_panic(const char *message)
 #if ZEND_DEBUG && defined(HAVE_KILL) && defined(HAVE_GETPID)
 	kill(getpid(), SIGSEGV);
 #endif
-	exit(1);
+	_exit(1);
+}
+
+/* CVE-2026-109618: fatal allocation error without longjmp(), terminate the process */
+ZEND_API void zend_mm_safe_error_ex(const char *format, ...)
+{
+	const char *error_filename = NULL;
+	uint error_lineno = 0;
+	char buf[1024];
+	va_list args;
+	TSRMLS_FETCH();
+
+	if (zend_is_compiling(TSRMLS_C)) {
+		error_filename = zend_get_compiled_filename(TSRMLS_C);
+		error_lineno = zend_get_compiled_lineno(TSRMLS_C);
+	} else if (EG(in_execution)) {
+		error_filename = EG(active_op_array)?EG(active_op_array)->filename:NULL;
+		error_lineno = EG(opline_ptr)?(*EG(opline_ptr))->lineno:0;
+	}
+
+	va_start(args, format);
+	vsnprintf(buf, sizeof(buf), format, args);
+	va_end(args);
+
+	fprintf(stderr, "\nFatal error: %s in %s on line %d\n", buf,
+		error_filename ? error_filename : "Unknown", error_lineno);
+/* See http://support.microsoft.com/kb/190351 */
+#ifdef PHP_WIN32
+	fflush(stderr);
+#endif
+	_exit(1);
 }
 
 /*******************/
@@ -1749,59 +1779,14 @@ static void zend_mm_safe_error(zend_mm_heap *heap,
 #endif
 	size_t size)
 {
-	if (heap->reserve) {
-		_zend_mm_free_int(heap, heap->reserve ZEND_FILE_LINE_CC ZEND_FILE_LINE_EMPTY_CC);
-		heap->reserve = NULL;
-	}
-	if (heap->overflow == 0) {
-		const char *error_filename;
-		uint error_lineno;
-		TSRMLS_FETCH();
-		if (zend_is_compiling(TSRMLS_C)) {
-			error_filename = zend_get_compiled_filename(TSRMLS_C);
-			error_lineno = zend_get_compiled_lineno(TSRMLS_C);
-		} else if (EG(in_execution)) {
-			error_filename = EG(active_op_array)?EG(active_op_array)->filename:NULL;
-			error_lineno = EG(opline_ptr)?(*EG(opline_ptr))->lineno:0;
-		} else {
-			error_filename = NULL;
-			error_lineno = 0;
-		}
-		if (!error_filename) {
-			error_filename = "Unknown";
-		}
-		heap->overflow = 1;
-		zend_try {
-			zend_error_noreturn(E_ERROR,
-				format,
-				limit,
-#if ZEND_DEBUG
-				filename,
-				lineno,
-#endif
-				size);
-		} zend_catch {
-			if (heap->overflow == 2) {
-				fprintf(stderr, "\nFatal error: ");
-				fprintf(stderr,
-					format,
-					limit,
+	(void) heap;
+	zend_mm_safe_error_ex(format,
+		limit,
 #if ZEND_DEBUG
-					filename,
-					lineno,
+		filename,
+		lineno,
 #endif
-					size);
-				fprintf(stderr, " in %s on line %d\n", error_filename, error_lineno);
-			}
-/* See http://support.microsoft.com/kb/190351 */
-#ifdef PHP_WIN32
-			fflush(stderr);
-#endif
-		} zend_end_try();
-	} else {
-		heap->overflow = 2;
-	}
-	zend_bailout();
+		size);
 }
 
 static zend_mm_free_block *zend_mm_search_large_block(zend_mm_heap *heap, size_t true_size)
@@ -2472,7 +2457,7 @@ static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
 	       "rm"(offset));
 
 	if (UNEXPECTED(overflow)) {
-		zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
+		zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
 		return 0;
 	}
 	return res;
@@ -2501,7 +2486,7 @@ static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
 
 #undef LP_SUFF
         if (UNEXPECTED(overflow)) {
-                zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
+                zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
                 return 0;
         }
         return res;
@@ -2522,7 +2507,7 @@ static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
                "1"(0));
 
         if (UNEXPECTED(overflow)) {
-                zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
+                zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
                 return 0;
         }
         return res;
@@ -2542,7 +2527,7 @@ static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
                "r"(offset));
 
         if (UNEXPECTED(overflow)) {
-                zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
+                zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
                 return 0;
         }
         return res;
@@ -2555,7 +2540,7 @@ static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
 	zend_ulong64 res = (zend_ulong64)nmemb * (zend_ulong64)size + (zend_ulong64)offset;
 
 	if (UNEXPECTED(res > (zend_ulong64)0xFFFFFFFFL)) {
-		zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
+		zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
 		return 0;
 	}
 	return (size_t) res;
@@ -2570,7 +2555,7 @@ static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
 	double _delta = (double)res - _d;
 
 	if (UNEXPECTED((_d + _delta ) != _d)) {
-		zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
+		zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
 		return 0;
 	}
 	return res;
@@ -2582,7 +2567,7 @@ ZEND_API void *_safe_emalloc_string(size_t nmemb, size_t size, size_t offset ZEN
 {
 	size_t str_size = safe_address(nmemb, size, offset);
 	if (UNEXPECTED(str_size > INT_MAX)) {
-		zend_error_noreturn(E_ERROR, "String allocation overflow, max size is %d", INT_MAX);
+		zend_mm_safe_error_ex("String allocation overflow, max size is %d", INT_MAX);
 	}
 	return emalloc_rel(str_size);
 }
 
@@ -26,6 +26,9 @@
 
 #include "../TSRM/TSRM.h"
 #include "zend.h"
+#ifdef HAVE_UNISTD_H
+# include <unistd.h>
+#endif
 
 #ifndef ZEND_MM_ALIGNMENT
 # define ZEND_MM_ALIGNMENT 8
@@ -99,7 +102,7 @@ inline static void * __zend_malloc(size_t len)
 		return tmp;
 	}
 	fprintf(stderr, "Out of memory\n");
-	exit(1);
+	_exit(1);
 }
 
 inline static void * __zend_calloc(size_t nmemb, size_t len)
@@ -116,7 +119,7 @@ inline static void * __zend_realloc(void *p, size_t len)
 		return p;
 	}
 	fprintf(stderr, "Out of memory\n");
-	exit(1);
+	_exit(1);
 }
 
 
@@ -161,6 +164,8 @@ void zend_debug_alloc_output(char *format, ...);
 ZEND_API size_t zend_memory_usage(int real_usage TSRMLS_DC);
 ZEND_API size_t zend_memory_peak_usage(int real_usage TSRMLS_DC);
 
+ZEND_API void zend_mm_safe_error_ex(const char *format, ...) ZEND_ATTRIBUTE_FORMAT(printf, 1, 2);
+
 END_EXTERN_C()
 
 /* fast cache for zval's */
 
@@ -307,6 +307,12 @@ void shutdown_executor(TSRMLS_D) /* {{{ */
 		}
 	} zend_end_try();
 
+	/* May be used by an error in the rest of the shutdown or before the next
+	 * init_executor(): the exception object is freed above (as in the
+	 * official fix, right after the object store). */
+	EG(error_handling) = EH_NORMAL;
+	EG(exception) = NULL;
+
 	zend_try {
 		clean_non_persistent_constants(TSRMLS_C);
 	} zend_end_try();
@@ -328,6 +334,17 @@ void shutdown_executor(TSRMLS_D) /* {{{ */
 		}
 	} zend_end_try();
 
+	/* CVE-2026-109619: may be used by zend_error before init_executor */
+	EG(user_error_handler) = NULL;
+	EG(user_exception_handler) = NULL;
+	memset(&EG(user_error_handlers_error_reporting), 0, sizeof(EG(user_error_handlers_error_reporting)));
+	memset(&EG(user_error_handlers), 0, sizeof(EG(user_error_handlers)));
+	memset(&EG(user_exception_handlers), 0, sizeof(EG(user_exception_handlers)));
+	EG(error_handling) = EH_NORMAL;
+	EG(exception_class) = NULL;
+	EG(exception) = NULL;
+	EG(in_autoload) = NULL;
+
 	zend_shutdown_fpu(TSRMLS_C);
 
 	EG(active) = 0;
 
@@ -115,6 +115,8 @@ ZEND_API void zend_llist_destroy(zend_llist *l)
 		current = next;
 	}
 
+	l->head  = NULL;
+	l->tail  = NULL;
 	l->count = 0;
 }
 
 
@@ -1400,7 +1400,7 @@ ZEND_API int add_char_to_string(zval *result, const zval *op1, const zval *op2)
 	char *buf;
 
 	if (UNEXPECTED(length < 0)) {
-		zend_error(E_ERROR, "String size overflow");
+		zend_mm_safe_error_ex("String size overflow");
 	}
 
 	buf = str_erealloc(Z_STRVAL_P(op1), length + 1);
@@ -1419,7 +1419,7 @@ ZEND_API int add_string_to_string(zval *result, const zval *op1, const zval *op2
 	char *buf;
 
 	if (UNEXPECTED(length < 0)) {
-		zend_error(E_ERROR, "String size overflow");
+		zend_mm_safe_error_ex("String size overflow");
 	}
 
 	buf = str_erealloc(Z_STRVAL_P(op1), length + 1);
@@ -1465,7 +1465,7 @@ ZEND_API int concat_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{
 		if (Z_STRLEN_P(result) < 0 || (int) (Z_STRLEN_P(op1) + Z_STRLEN_P(op2)) < 0) {
 			efree(Z_STRVAL_P(result));
 			ZVAL_EMPTY_STRING(result);
-			zend_error(E_ERROR, "String size overflow");
+			zend_mm_safe_error_ex("String size overflow");
 		}
 
 		Z_STRVAL_P(result) = safe_erealloc(Z_STRVAL_P(result), res_len, 1, 1);
@@ -1478,7 +1478,7 @@ ZEND_API int concat_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{
 		char *buf;
 
 		if (Z_STRLEN_P(op1) < 0 || Z_STRLEN_P(op2) < 0 || (int) (Z_STRLEN_P(op1) + Z_STRLEN_P(op2)) < 0) {
-			zend_error(E_ERROR, "String size overflow");
+			zend_mm_safe_error_ex("String size overflow");
 		}
 		buf = (char *) safe_emalloc(length, 1, 1);
 
 
@@ -490,7 +490,7 @@ static Bigint * Balloc(int k)
 		rv = (Bigint *)MALLOC(sizeof(Bigint) + (x-1)*sizeof(Long));
 		if (!rv) {
 			_THREAD_PRIVATE_MUTEX_UNLOCK(dtoa_mutex);
-			zend_error(E_ERROR, "Balloc() failed to allocate memory");
+			zend_mm_safe_error_ex("Balloc() failed to allocate memory");
 		}
 		rv->k = k;
 		rv->maxwds = x;
 
@@ -4412,6 +4412,30 @@ static int date_period_initialize(timelib_time **st, timelib_time **et, timelib_
 	return retval;
 }
 
+static void date_period_reset(php_period_obj *period_obj) /* {{{ */
+{
+	if (period_obj->start) {
+		timelib_time_dtor(period_obj->start);
+	}
+	if (period_obj->current) {
+		timelib_time_dtor(period_obj->current);
+	}
+	if (period_obj->end) {
+		timelib_time_dtor(period_obj->end);
+	}
+	if (period_obj->interval) {
+		timelib_rel_time_dtor(period_obj->interval);
+	}
+	period_obj->start = NULL;
+	period_obj->start_ce = NULL;
+	period_obj->current = NULL;
+	period_obj->end = NULL;
+	period_obj->interval = NULL;
+	period_obj->recurrences = 0;
+	period_obj->initialized = 0;
+	period_obj->include_start_date = 0;
+} /* }}} */
+
 /* {{{ proto DatePeriod::__construct(DateTime $start, DateInterval $interval, int recurrences|DateTime $end)
    Creates new DatePeriod object.
 */
@@ -4439,7 +4463,7 @@ PHP_METHOD(DatePeriod, __construct)
 	}
 
 	dpobj = zend_object_store_get_object(getThis() TSRMLS_CC);
-	dpobj->current = NULL;
+	date_period_reset(dpobj);
 
 	if (isostr) {
 		date_period_initialize(&(dpobj->start), &(dpobj->end), &(dpobj->interval), &recurrences, isostr, isostr_len TSRMLS_CC);
@@ -4463,9 +4487,19 @@ PHP_METHOD(DatePeriod, __construct)
 	} else {
 		/* init */
 		intobj  = (php_interval_obj *) zend_object_store_get_object(interval TSRMLS_CC);
+		if (!intobj->initialized) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "The DateInterval object has not been correctly initialized by its constructor");
+			zend_restore_error_handling(&error_handling TSRMLS_CC);
+			return;
+		}
+		dateobj = (php_date_obj *) zend_object_store_get_object(start TSRMLS_CC);
+		if (!dateobj->time || (end && !((php_date_obj *) zend_object_store_get_object(end TSRMLS_CC))->time)) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "The DateTimeInterface object has not been correctly initialized by its constructor");
+			zend_restore_error_handling(&error_handling TSRMLS_CC);
+			return;
+		}
 
 		/* start date */
-		dateobj = (php_date_obj *) zend_object_store_get_object(start TSRMLS_CC);
 		clone = timelib_time_ctor();
 		memcpy(clone, dateobj->time, sizeof(timelib_time));
 		if (dateobj->time->tz_abbr) {
 
@@ -71,7 +71,7 @@ static void php_filter_encode_url(zval *value, const unsigned char* chars, const
 	unsigned char *s = (unsigned char *)chars;
 	unsigned char *e = s + char_len;
 
-	memset(tmp, 1, sizeof(tmp)-1);
+	memset(tmp, 1, sizeof(tmp));
 
 	while (s < e) {
 		tmp[*s++] = 0;
Original file line number	Diff line number	Diff line change
`@@ -115,6 +115,8 @@ ZEND_API void zend_llist_destroy(zend_llist *l)`
`115`	`115`	`current = next;`
`116`	`116`	`}`
`117`	`117`
	`118`	`+ l->head = NULL;`
	`119`	`+ l->tail = NULL;`
`118`	`120`	`l->count = 0;`
`119`	`121`	`}`
`120`	`122`
Original file line number	Diff line number	Diff line change
`@@ -490,7 +490,7 @@ static Bigint * Balloc(int k)`
`490`	`490`	`rv = (Bigint )MALLOC(sizeof(Bigint) + (x-1)sizeof(Long));`
`491`	`491`	`if (!rv) {`
`492`	`492`	`_THREAD_PRIVATE_MUTEX_UNLOCK(dtoa_mutex);`
`493`		`- zend_error(E_ERROR, "Balloc() failed to allocate memory");`
	`493`	`+ zend_mm_safe_error_ex("Balloc() failed to allocate memory");`
`494`	`494`	`}`
`495`	`495`	`rv->k = k;`
`496`	`496`	`rv->maxwds = x;`