Release notes
Version 1.14.0
(stable)
|
* Bounded the resources that the pure PHP decoder spends on a single lookup. A
crafted database could nest data-section pointers to shared targets so that
decoding one record cost exponential time and memory, or point many times at
one large value so that the decoder copied far more data than the file holds.
The decoder now follows the Reader Resource Limits section of the MaxMind DB
specification. Each lookup is limited to 65,536 values, 512 levels of
nesting, and 2 MiB of string and bytes payload.
* Exceeding a limit throws an `InvalidDatabaseException`.
* Opening a database whose metadata exceeds a limit throws the same
exception.
* A scalar that declares more than 16 bytes, the width of the widest
fixed-width type, is rejected as invalid data.
* The bundled libmaxminddb used by `--with-maxminddb-bundled` builds of the
extension now applies the same decoder limits. The extension throws an
`InvalidDatabaseException` when a lookup exceeds them.
* The pure PHP reader is about 40% faster on City lookups. It no longer seeks
before a read that continues where the last one ended, and it checks read
lengths with `strlen()` instead of `ftell()`.
* The Windows build configuration now accepts either `libmaxminddb.lib` or
`maxminddb.lib` when building the extension. The `lib` prefix was removed
in libmaxminddb 1.6.0, but the libmaxminddb that PHP publishes for Windows
builds is still 1.5.0, which uses the prefixed name. Pull request by
Jean-Baptiste Nahan. GitHub #231.
* Replaced `XtOffsetOf()` with `offsetof()`. The `XtOffsetOf()` alias has
been removed in PHP 8.6. Pull request by Remi Collet. GitHub #252.
* The extension can now be built from a bundled copy of libmaxminddb, on
both Unix-like systems and Windows, by passing `--with-maxminddb-bundled`
to `configure` (or to `configure.bat` on Windows). This produces an
extension that does not depend on a system libmaxminddb, which is a
prerequisite for distributing precompiled builds; on Windows it also
replaces the 1.5.0 import library that PHP publishes for Windows builds.
The default is unchanged: without the flag, the extension links against a
system libmaxminddb as before. GitHub #265.
* The `conflict` constraint on `ext-maxminddb` in `composer.json` is again
updated when a release is cut. The substitution that maintains it stopped
matching in April 2024, when the constraint's separator changed from a comma
to `||`, so the constraint has read `<1.11.1` through four releases. Users of
the C extension should note the effect of reviving it: `ext-maxminddb` is a
Composer platform package, so this release conflicts with an older compiled
extension and `composer update` will require upgrading the two together.
GitHub #266. |
