* SECURITY UPDATE: out-of-bounds read in the http:// wrapper when a redirect response carries an empty Location header - debian/patches/php-5.2-CVE-2026-93682.patch: backport the net effect of upstream commits 8196275133edb830ec85330d36659d5b257b44db (the fix) and de3436c76e460ca44829cc8234926280d96ceae6 (its follow-up) to ext/standard/http_fopen_wrapper.c. An empty Location value is stored as a one-byte allocation holding only the NUL terminator, so the relative-redirect test "*(header_info.location+1) != '\0'" read the byte past the end of that allocation; depending on what the heap held there, the wrapper appended a garbage-derived path to the redirect target instead of resolving it against the host root. The length check now uses header_info.location_len, which our CVE-2025-1861 backport already added, and the strlen() in the absolute-URL test is replaced by the same field. The relative join is taken only when location_len > 1, which is the end state of the two upstream commits: the first one used > 0 and regressed single-character relative Location values, and the follow-up restored the host-root behaviour. Only that end state is applied here, so the intermediate form is never present on this branch. Both upstream .phpt tests are carried and adapted to 5.2: nowdoc and array dereferencing of a function call do not exist before 5.3/5.4, so the worker and client bodies become escaped double-quoted strings and the explode() result goes through a temporary; __DIR__ becomes dirname(__FILE__) and the harness include points at ext/openssl/tests/ServerClientTestCase2.inc, the copy this branch ships. - CVE-2026-93682