Really makes me appreciate using language with exceptions and not that crazy "manually check if error handling is required - and do it everywhere". The fix adds:
if (ZEND_HAS_OOM()) {
goto oom_nodeset;
}
all over the codebase.
What an absolute unit of a security patch. What's the chance that this was sufficiently reviewed and doesn't add new vulnerabilities?
It says "3 days ago". The tag is 2 days old.
I assume it just got pushed?
Yeah… it was patched in the source 3 days ago. Check the linked GHSA.