5.4.43

Merge branch 'PHP-5.4' into PHP-5.4.43
* PHP-5.4: Better fix for bug #69958 update news Fix bug #69669 (mysqlnd is vulnerable to BACKRONYM) Fix bug #69923 - Buffer overflow and stack smashing error in phar_fix_filepath Fix bug #69958 - Segfault in Phar::convertToData on invalid file add missing second argument for ucfirst to the proto Conflicts: ext/mysqlnd/mysqlnd.c ext/phar/phar_object.c ext/phar/tests/bug69958.phpt
2026-11-10 02:30:50 +00:00 · 2015-07-07 15:08:15 -07:00 · 2015-07-07 15:05:35 -07:00 · 2015-07-05 00:00:53 -07:00 · 2015-07-04 23:47:48 -07:00 · 2015-07-04 21:01:50 -07:00
53 changed files with 1101 additions and 1574 deletions
@@ -19,8 +19,6 @@
 *.tgz
 *.tar.gz
 *.tar.bz2
-*.tar.gz.asc
-*.tar.bz2.asc
 .FBCIndex
 .FBCLockFolder
 .deps
@@ -1,76 +1,5 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? ???? PHP 5.4.46
-
-03 Sep 2015 PHP 5.4.45
-
- Core:
-  . Fixed bug #70172 (Use After Free Vulnerability in unserialize()). (Stas)
-  . Fixed bug #70219 (Use after free vulnerability in session deserializer). 
-    (taoguangchen at icloud dot com)
-
- EXIF:
-  . Fixed bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte
-    value of 32 bytes). (Stas) 
-
- hash:
-  . Fixed bug #70312 (HAVAL gives wrong hashes in specific cases). (letsgolee 
-    at naver dot com)
-
- PCRE:
-  . Fixed bug #70345 (Multiple vulnerabilities related to PCRE functions).
-    (Anatol Belski)
-
- SOAP:
-  . Fixed bug #70388 (SOAP serialize_function_call() type confusion / RCE).
-    (Stas)
-  
- SPL:
-  . Fixed bug #70365 (Use-after-free vulnerability in unserialize() with
-    SplObjectStorage). (taoguangchen at icloud dot com)
-  . Fixed bug #70366 (Use-after-free vulnerability in unserialize() with
-    SplDoublyLinkedList). (taoguangchen at icloud dot com)
-
- XSLT:
-  . Fixed bug #69782 (NULL pointer dereference). (Stas)
-
- ZIP:
-  . Fixed bug #70350 (ZipArchive::extractTo allows for directory traversal when 
-    creating directories). (neal at fb dot com)
-
-06 Aug 2015 PHP 5.4.44
-
- Core:
-  . Fixed bug #69793 (Remotely triggerable stack exhaustion via recursive
-    method calls). (Stas)
-  . Fixed bug #69892 (Different arrays compare indentical due to integer key
-    truncation). (Nikita)
-  . Fixed bug #70121 (unserialize() could lead to unexpected methods execution
-    / NULL pointer deref). (Stas)
-
- OpenSSL:
-  . Fixed bug #70014 (openssl_random_pseudo_bytes() is not cryptographically
-    secure). (Stas)
-
- Phar:
-  . Improved fix for bug #69441. (Anatol Belski)
-  . Fixed bug #70019 (Files extracted from archive may be placed outside of 
-    destination directory). (Anatol Belski)
-
- SOAP:
-  . Fixed bug #70081 (SoapClient info leak / null pointer dereference via
-     multiple type confusions). (Stas)
-
- SPL:
-  . Fixed bug #70068 (Dangling pointer in the unserialization of ArrayObject
-    items). (sean.heelan)
-  . Fixed bug #70166 (Use After Free Vulnerability in unserialize() with
-    SPLArrayObject). (taoguangchen at icloud dot com)
-  . Fixed bug #70168 (Use After Free Vulnerability in unserialize() with
-    SplObjectStorage). (taoguangchen at icloud dot com)
-  . Fixed bug #70169 (Use After Free Vulnerability in unserialize() with
-    SplDoublyLinkedList). (taoguangchen at icloud dot com)
-
 09 Jul 2015 PHP 5.4.43

 - Core:
@@ -79,14 +8,13 @@ PHP                                                                        NEWS
    from fix to bug #68776. (Yasuo)

 - Mysqlnd:
-  . Fixed bug #69669 (mysqlnd is vulnerable to BACKRONYM). (CVE-2015-3152)
+  . Fixed bug #69669 (mysqlnd is vulnerable to BACKRONYM) (CVE-2015-3152).
    (Andrey)

 - Phar:
-  . Fixed bug #69958 (Segfault in Phar::convertToData on invalid file).
-    (CVE-2015-5589) (Stas)
+  . Fixed bug #69958 (Segfault in Phar::convertToData on invalid file). (Stas)
  . Fixed bug #69923 (Buffer overflow and stack smashing error in 
-    phar_fix_filepath). (CVE-2015-5590) (Stas)
+    phar_fix_filepath). (Stas)

 11 Jun 2015 PHP 5.4.42

@@ -200,7 +128,7 @@ PHP                                                                        NEWS

 - SOAP:
  . Fixed bug #69085 (SoapClient's __call() type confusion through
-    unserialize()). (CVE-2015-4147, CVE-2015-4148) (Dmitry)
+    unserialize()). (Dmitry)

 - ZIP:
  . Fixed bug #69253 (ZIP Integer Overflow leads to writing past heap
@@ -12,7 +12,7 @@ Collaboration is a Good Thing(tm), and Git lets us do this. Thus, following
 some basic rules with regards to Git usage will::

   a. Make everybody happier, especially those responsible for maintaining
-      PHP itself.
+      Git itself.

   b. Keep the changes consistently well documented and easily trackable.

@@ -48,11 +48,11 @@ Currently we have the following branches in use::
  PHP-5.6   Is used to release the PHP 5.6.x series. This is a current
            stable version and is open for bugfixes only.

-  PHP-5.5   Is used to release the PHP 5.5.x series. This is an old
-            stable version and is open for security fixes only.
+  PHP-5.5   Is used to release the PHP 5.5.x series. This is a current
+            stable version and is open for bugfixes only.

-  PHP-5.4   Is used to release the PHP 5.4.x series. This is an old
-            stable version and is open for security fixes only.
+  PHP-5.4   Is used to release the PHP 5.4.x series. This is a current
+            stable version and is open for bugfixes only.

  PHP-5.3   This branch is closed.

@@ -67,7 +67,7 @@ Currently we have the following branches in use::

 The next few rules are more of a technical nature::

-   1. All changes should first go to the lowest branch (i.e. 5.6) and then
+   1. All changes should first go to the lowest branch (i.e. 5.4) and then
      get merged up to all other branches. If a change is not needed for
      later branches (i.e. fixes for features which where dropped from later
      branches) an empty merge should be done.
@@ -1,10 +0,0 @@
--TEST--
-Bug #69892: Different arrays compare indentical due to integer key truncation
--SKIPIF--
-<?php if (PHP_INT_SIZE != 8) die("skip this test is for 64bit platforms only"); ?>
--FILE--
-<?php
-var_dump([0 => 0] === [0x100000000 => 0]);
-?>
--EXPECT--
-bool(false)
@@ -1,9 +0,0 @@
--TEST--
-Bug #70121 (unserialize() could lead to unexpected methods execution / NULL pointer deref)
--FILE--
-<?php
-unserialize('O:12:"DateInterval":1:{s:4:"days";O:9:"Exception":7:{s:10:"'."\0".'*'."\0".'message";s:1:"x";s:17:"'."\0".'Exception'."\0".'string";s:1:"A";s:7:"'."\0".'*'."\0".'code";i:0;s:7:"'."\0".'*'."\0".'file";s:1:"a";s:7:"'."\0".'*'."\0".'line";i:1337;s:16:"'."\0".'Exception'."\0".'trace";a:0:{}s:19:"'."\0".'Exception'."\0".'previous";O:8:"stdClass":0:{}}}');
-?>
-OK
--EXPECT--
-OK
@@ -41,7 +41,7 @@ void zend_exception_set_previous(zval *exception, zval *add_previous TSRMLS_DC)
 	if (exception == add_previous || !add_previous || !exception) {
 		return;
 	}
-	if (Z_TYPE_P(add_previous) != IS_OBJECT || !instanceof_function(Z_OBJCE_P(add_previous), default_exception_ce TSRMLS_CC)) {
+	if (Z_TYPE_P(add_previous) != IS_OBJECT && !instanceof_function(Z_OBJCE_P(add_previous), default_exception_ce TSRMLS_CC)) {
 		zend_error(E_ERROR, "Cannot set non exception as previous exception");
 		return;
 	}
@@ -218,33 +218,6 @@ ZEND_METHOD(exception, __construct)
 }
 /* }}} */

-/* {{{ proto Exception::__wakeup()
-   Exception unserialize checks */
-#define CHECK_EXC_TYPE(name, type) \
-	value = zend_read_property(default_exception_ce, object, name, sizeof(name)-1, 0 TSRMLS_CC); \
-	if(value && Z_TYPE_P(value) != type) { \
-		zval *tmp; \
-		MAKE_STD_ZVAL(tmp); \
-		ZVAL_STRINGL(tmp, name, sizeof(name)-1, 1); \
-		Z_OBJ_HANDLER_P(object, unset_property)(object, tmp, 0 TSRMLS_CC); \
-		zval_ptr_dtor(&tmp); \
-	}
-
-ZEND_METHOD(exception, __wakeup)
-{
-	zval *value;
-	zval *object = getThis();
-	HashTable *intern_ht = zend_std_get_properties(getThis() TSRMLS_CC);
-	CHECK_EXC_TYPE("message", IS_STRING);
-	CHECK_EXC_TYPE("string", IS_STRING);
-	CHECK_EXC_TYPE("code", IS_LONG);
-	CHECK_EXC_TYPE("file", IS_STRING);
-	CHECK_EXC_TYPE("line", IS_LONG);
-	CHECK_EXC_TYPE("trace", IS_ARRAY);
-	CHECK_EXC_TYPE("previous", IS_OBJECT);
-}
-/* }}} */
-
 /* {{{ proto ErrorException::__construct(string message, int code, int severity [, string filename [, int lineno [, Exception previous]]])
   ErrorException constructor */
 ZEND_METHOD(error_exception, __construct)
@@ -613,7 +586,7 @@ ZEND_METHOD(exception, getTraceAsString)
 	int res_len = 0, *len = &res_len, num = 0;

 	DEFAULT_0_PARAMS;
-
+	
 	trace = zend_read_property(default_exception_ce, getThis(), "trace", sizeof("trace")-1, 1 TSRMLS_CC);
 	if(Z_TYPE_P(trace) != IS_ARRAY) {
 		RETURN_FALSE;
@@ -629,8 +602,8 @@ ZEND_METHOD(exception, getTraceAsString)
 	TRACE_APPEND_STRL(s_tmp, strlen(s_tmp));
 	efree(s_tmp);

-	res[res_len] = '\0';
-	RETURN_STRINGL(res, res_len, 0);
+	res[res_len] = '\0';	
+	RETURN_STRINGL(res, res_len, 0); 
 }
 /* }}} */

@@ -667,15 +640,15 @@ ZEND_METHOD(exception, __toString)
 	int len = 0;
 	zend_fcall_info fci;
 	zval fname;
-
+	
 	DEFAULT_0_PARAMS;
-
+	
 	str = estrndup("", 0);

 	exception = getThis();
 	ZVAL_STRINGL(&fname, "gettraceasstring", sizeof("gettraceasstring")-1, 1);

-	while (exception && Z_TYPE_P(exception) == IS_OBJECT && instanceof_function(Z_OBJCE_P(exception), default_exception_ce TSRMLS_CC)) {
+	while (exception && Z_TYPE_P(exception) == IS_OBJECT) {
 		prev_str = str;
 		_default_exception_get_entry(exception, "message", sizeof("message")-1, &message TSRMLS_CC);
 		_default_exception_get_entry(exception, "file", sizeof("file")-1, &file TSRMLS_CC);
@@ -685,7 +658,6 @@ ZEND_METHOD(exception, __toString)
 		convert_to_string(&file);
 		convert_to_long(&line);

-		trace = NULL;
 		fci.size = sizeof(fci);
 		fci.function_table = &Z_OBJCE_P(exception)->function_table;
 		fci.function_name = &fname;
@@ -698,7 +670,7 @@ ZEND_METHOD(exception, __toString)

 		zend_call_function(&fci, NULL TSRMLS_CC);

-		if (trace && Z_TYPE_P(trace) != IS_STRING) {
+		if (Z_TYPE_P(trace) != IS_STRING) {
 			zval_ptr_dtor(&trace);
 			trace = NULL;
 		}
@@ -755,7 +727,6 @@ ZEND_END_ARG_INFO()
 const static zend_function_entry default_exception_functions[] = {
 	ZEND_ME(exception, __clone, NULL, ZEND_ACC_PRIVATE|ZEND_ACC_FINAL)
 	ZEND_ME(exception, __construct, arginfo_exception___construct, ZEND_ACC_PUBLIC)
-	ZEND_ME(exception, __wakeup, NULL, ZEND_ACC_PUBLIC)
 	ZEND_ME(exception, getMessage, NULL, ZEND_ACC_PUBLIC|ZEND_ACC_FINAL)
 	ZEND_ME(exception, getCode, NULL, ZEND_ACC_PUBLIC|ZEND_ACC_FINAL)
 	ZEND_ME(exception, getFile, NULL, ZEND_ACC_PUBLIC|ZEND_ACC_FINAL)
@@ -1513,10 +1513,11 @@ ZEND_API int zend_hash_compare(HashTable *ht1, HashTable *ht2, compare_func_t co
 		}
 		if (ordered) {
 			if (p1->nKeyLength==0 && p2->nKeyLength==0) { /* numeric indices */
-				if (p1->h != p2->h) {
+				result = p1->h - p2->h;
+				if (result!=0) {
 					HASH_UNPROTECT_RECURSION(ht1); 
 					HASH_UNPROTECT_RECURSION(ht2); 
-					return p1->h > p2->h ? 1 : -1;
+					return result;
 				}
 			} else { /* string indices */
 				result = p1->nKeyLength - p2->nKeyLength;
@@ -119,8 +119,8 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=4
-PHP_RELEASE_VERSION=46
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=43
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -548,7 +548,7 @@ static zend_object_handlers date_object_handlers_period;
 #define DATE_SET_CONTEXT \
 	zval *object; \
 	object = getThis(); \
-
+   
 #define DATE_FETCH_OBJECT	\
 	php_date_obj *obj;	\
 	DATE_SET_CONTEXT; \
@@ -715,7 +715,7 @@ PHP_RSHUTDOWN_FUNCTION(date)
 * RFC2822, Section 3.3: http://www.ietf.org/rfc/rfc2822.txt
 *  FWS             =       ([*WSP CRLF] 1*WSP) /   ; Folding white space
 *  CFWS            =       *([FWS] comment) (([FWS] comment) / FWS)
- *
+ *  
 *  date-time       =       [ day-of-week "," ] date FWS time [CFWS]
 *  day-of-week     =       ([FWS] day-name)
 *  day-name        =       "Mon" / "Tue" / "Wed" / "Thu" / "Fri" / "Sat" / "Sun"
@@ -737,19 +737,19 @@ PHP_RSHUTDOWN_FUNCTION(date)
 *  date-fullyear   = 4DIGIT
 *  date-month      = 2DIGIT  ; 01-12
 *  date-mday       = 2DIGIT  ; 01-28, 01-29, 01-30, 01-31 based on month/year
- *
+ *  
 *  time-hour       = 2DIGIT  ; 00-23
 *  time-minute     = 2DIGIT  ; 00-59
 *  time-second     = 2DIGIT  ; 00-58, 00-59, 00-60 based on leap second rules
- *
+ *  
 *  time-secfrac    = "." 1*DIGIT
 *  time-numoffset  = ("+" / "-") time-hour ":" time-minute
 *  time-offset     = "Z" / time-numoffset
- *
+ *  
 *  partial-time    = time-hour ":" time-minute ":" time-second [time-secfrac]
 *  full-date       = date-fullyear "-" date-month "-" date-mday
 *  full-time       = partial-time time-offset
- *
+ *  
 *  date-time       = full-date "T" full-time
 */
 #define DATE_FORMAT_RFC3339  "Y-m-d\\TH:i:sP"
@@ -839,7 +839,7 @@ PHP_MSHUTDOWN_FUNCTION(date)
 PHP_MINFO_FUNCTION(date)
 {
 	const timelib_tzdb *tzdb = DATE_TIMEZONEDB;
-
+	
 	php_info_print_table_start();
 	php_info_print_table_row(2, "date/time support", "enabled");
 	php_info_print_table_row(2, "\"Olson\" Timezone Database Version", tzdb->version);
@@ -991,8 +991,8 @@ char *php_date_full_day_name(timelib_sll y, timelib_sll m, timelib_sll d)
 	timelib_sll day_of_week = timelib_day_of_week(y, m, d);
 	if (day_of_week < 0) {
 		return "Unknown";
-	}
-	return day_full_names[day_of_week];
+	} 
+	return day_full_names[day_of_week];	
 }

 char *php_date_short_day_name(timelib_sll y, timelib_sll m, timelib_sll d)
@@ -1000,8 +1000,8 @@ char *php_date_short_day_name(timelib_sll y, timelib_sll m, timelib_sll d)
 	timelib_sll day_of_week = timelib_day_of_week(y, m, d);
 	if (day_of_week < 0) {
 		return "Unknown";
-	}
-	return day_short_names[day_of_week];
+	} 
+	return day_short_names[day_of_week];	
 }
 /* }}} */

@@ -1033,7 +1033,7 @@ static char *date_format(char *format, int format_len, timelib_time *t, int loca
 			offset->leap_secs = 0;
 			offset->is_dst = 0;
 			offset->abbr = malloc(9); /* GMT�xxxx\0 */
-			snprintf(offset->abbr, 9, "GMT%c%02d%02d",
+			snprintf(offset->abbr, 9, "GMT%c%02d%02d", 
 			                          localtime ? ((offset->offset < 0) ? '-' : '+') : '+',
 			                          localtime ? abs(offset->offset / 3600) : 0,
 			                          localtime ? abs((offset->offset % 3600) / 60) : 0 );
@@ -1079,7 +1079,7 @@ static char *date_format(char *format, int format_len, timelib_time *t, int loca
 			case 'a': length = slprintf(buffer, 32, "%s", t->h >= 12 ? "pm" : "am"); break;
 			case 'A': length = slprintf(buffer, 32, "%s", t->h >= 12 ? "PM" : "AM"); break;
 			case 'B': {
-				int retval = (((((long)t->sse)-(((long)t->sse) - ((((long)t->sse) % 86400) + 3600))) * 10) / 864);
+				int retval = (((((long)t->sse)-(((long)t->sse) - ((((long)t->sse) % 86400) + 3600))) * 10) / 864);			
 				while (retval < 0) {
 					retval += 1000;
 				}
@@ -1179,7 +1179,7 @@ static void php_date(INTERNAL_FUNCTION_PARAMETERS, int localtime)
 	}

 	string = php_format_date(format, format_len, ts, localtime TSRMLS_CC);
-
+	
 	RETVAL_STRING(string, 0);
 }
 /* }}} */
@@ -1203,7 +1203,7 @@ PHPAPI char *php_format_date(char *format, int format_len, time_t ts, int localt
 	}

 	string = date_format(format, format_len, t, localtime);
-
+	
 	timelib_time_dtor(t);
 	return string;
 }
@@ -1244,7 +1244,7 @@ PHPAPI int php_idate(char format, time_t ts, int localtime TSRMLS_DC)
 			offset->leap_secs = 0;
 			offset->is_dst = t->dst;
 			offset->abbr = malloc(9); /* GMT�xxxx\0 */
-			snprintf(offset->abbr, 9, "GMT%c%02d%02d",
+			snprintf(offset->abbr, 9, "GMT%c%02d%02d", 
 			                          !localtime ? ((offset->offset < 0) ? '-' : '+') : '+',
 			                          !localtime ? abs(offset->offset / 3600) : 0,
 			                          !localtime ? abs((offset->offset % 3600) / 60) : 0 );
@@ -1276,7 +1276,7 @@ PHPAPI int php_idate(char format, time_t ts, int localtime TSRMLS_DC)

 		/* Swatch Beat a.k.a. Internet Time */
 		case 'B':
-			retval = (((((long)t->sse)-(((long)t->sse) - ((((long)t->sse) % 86400) + 3600))) * 10) / 864);
+			retval = (((((long)t->sse)-(((long)t->sse) - ((((long)t->sse) % 86400) + 3600))) * 10) / 864);			
 			while (retval < 0) {
 				retval += 1000;
 			}
@@ -1328,7 +1328,7 @@ PHP_FUNCTION(idate)
 	char   *format;
 	int     format_len;
 	long    ts = 0;
-	int ret;
+	int ret; 

 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|l", &format, &format_len, &ts) == FAILURE) {
 		RETURN_FALSE;
@@ -1356,7 +1356,7 @@ PHP_FUNCTION(idate)
 PHPAPI void php_date_set_tzdb(timelib_tzdb *tzdb)
 {
 	const timelib_tzdb *builtin = timelib_builtin_db();
-
+	
 	if (php_version_compare(tzdb->version, builtin->version) > 0) {
 		php_date_global_timezone_db = tzdb;
 		php_date_global_timezone_db_enabled = 1;
@@ -1428,7 +1428,7 @@ PHP_FUNCTION(strtotime)
 	}

 	if (!time_len) {
-		timelib_time_dtor(now);
+		timelib_time_dtor(now);	
 		RETURN_FALSE;
 	}

@@ -1869,7 +1869,7 @@ static void date_period_it_current_data(zend_object_iterator *iter, zval ***data
 	if (it_time->tz_info) {
 		newdateobj->time->tz_info = it_time->tz_info;
 	}
-
+	
 	*data = &iterator->current;
 }
 /* }}} */
@@ -2037,13 +2037,13 @@ static inline zend_object_value date_object_new_date_ex(zend_class_entry *class_
 	if (ptr) {
 		*ptr = intern;
 	}
-
+	
 	zend_object_std_init(&intern->std, class_type TSRMLS_CC);
 	object_properties_init(&intern->std, class_type);
-
+	
 	retval.handle = zend_objects_store_put(intern, (zend_objects_store_dtor_t)zend_objects_destroy_object, (zend_objects_free_object_storage_t) date_object_free_storage_date, NULL TSRMLS_CC);
 	retval.handlers = &date_object_handlers_date;
-
+	
 	return retval;
 }

@@ -2057,12 +2057,12 @@ static zend_object_value date_object_clone_date(zval *this_ptr TSRMLS_DC)
 	php_date_obj *new_obj = NULL;
 	php_date_obj *old_obj = (php_date_obj *) zend_object_store_get_object(this_ptr TSRMLS_CC);
 	zend_object_value new_ov = date_object_new_date_ex(old_obj->std.ce, &new_obj TSRMLS_CC);
-
+	
 	zend_objects_clone_members(&new_obj->std, new_ov, &old_obj->std, Z_OBJ_HANDLE_P(this_ptr) TSRMLS_CC);
 	if (!old_obj->time) {
 		return new_ov;
 	}
-
+	
 	/* this should probably moved to a new `timelib_time *timelime_time_clone(timelib_time *)` */
 	new_obj->time = timelib_time_ctor();
 	*new_obj->time = *old_obj->time;
@@ -2072,7 +2072,7 @@ static zend_object_value date_object_clone_date(zval *this_ptr TSRMLS_DC)
 	if (old_obj->time->tz_info) {
 		new_obj->time->tz_info = old_obj->time->tz_info;
 	}
-
+	
 	return new_ov;
 }

@@ -2094,10 +2094,10 @@ static int date_object_compare_date(zval *d1, zval *d2 TSRMLS_DC)
 		if (!o2->time->sse_uptodate) {
 			timelib_update_ts(o2->time, o2->time->tz_info);
 		}
-
+		
 		return (o1->time->sse == o2->time->sse) ? 0 : ((o1->time->sse < o2->time->sse) ? -1 : 1);
 	}
-
+	
 	return 1;
 }

@@ -2174,10 +2174,10 @@ static inline zend_object_value date_object_new_timezone_ex(zend_class_entry *cl

 	zend_object_std_init(&intern->std, class_type TSRMLS_CC);
 	object_properties_init(&intern->std, class_type);
-
+	
 	retval.handle = zend_objects_store_put(intern, (zend_objects_store_dtor_t)zend_objects_destroy_object, (zend_objects_free_object_storage_t) date_object_free_storage_timezone, NULL TSRMLS_CC);
 	retval.handlers = &date_object_handlers_timezone;
-
+	
 	return retval;
 }

@@ -2191,12 +2191,12 @@ static zend_object_value date_object_clone_timezone(zval *this_ptr TSRMLS_DC)
 	php_timezone_obj *new_obj = NULL;
 	php_timezone_obj *old_obj = (php_timezone_obj *) zend_object_store_get_object(this_ptr TSRMLS_CC);
 	zend_object_value new_ov = date_object_new_timezone_ex(old_obj->std.ce, &new_obj TSRMLS_CC);
-
+	
 	zend_objects_clone_members(&new_obj->std, new_ov, &old_obj->std, Z_OBJ_HANDLE_P(this_ptr) TSRMLS_CC);
 	if (!old_obj->initialized) {
 		return new_ov;
 	}
-
+	
 	new_obj->type = old_obj->type;
 	new_obj->initialized = 1;
 	switch (new_obj->type) {
@@ -2212,7 +2212,7 @@ static zend_object_value date_object_clone_timezone(zval *this_ptr TSRMLS_DC)
 			new_obj->tzi.z.abbr       = old_obj->tzi.z.abbr;
 			break;
 	}
-
+	
 	return new_ov;
 }

@@ -2229,10 +2229,10 @@ static inline zend_object_value date_object_new_interval_ex(zend_class_entry *cl

 	zend_object_std_init(&intern->std, class_type TSRMLS_CC);
 	object_properties_init(&intern->std, class_type);
-
+	
 	retval.handle = zend_objects_store_put(intern, (zend_objects_store_dtor_t)zend_objects_destroy_object, (zend_objects_free_object_storage_t) date_object_free_storage_interval, NULL TSRMLS_CC);
 	retval.handlers = &date_object_handlers_interval;
-
+	
 	return retval;
 }

@@ -2246,7 +2246,7 @@ static zend_object_value date_object_clone_interval(zval *this_ptr TSRMLS_DC)
 	php_interval_obj *new_obj = NULL;
 	php_interval_obj *old_obj = (php_interval_obj *) zend_object_store_get_object(this_ptr TSRMLS_CC);
 	zend_object_value new_ov = date_object_new_interval_ex(old_obj->std.ce, &new_obj TSRMLS_CC);
-
+	
 	zend_objects_clone_members(&new_obj->std, new_ov, &old_obj->std, Z_OBJ_HANDLE_P(this_ptr) TSRMLS_CC);

 	/** FIX ME ADD CLONE STUFF **/
@@ -2318,10 +2318,10 @@ static inline zend_object_value date_object_new_period_ex(zend_class_entry *clas

 	zend_object_std_init(&intern->std, class_type TSRMLS_CC);
 	object_properties_init(&intern->std, class_type);
-
+	
 	retval.handle = zend_objects_store_put(intern, (zend_objects_store_dtor_t)zend_objects_destroy_object, (zend_objects_free_object_storage_t) date_object_free_storage_period, NULL TSRMLS_CC);
 	retval.handlers = &date_object_handlers_period;
-
+	
 	return retval;
 }

@@ -2335,7 +2335,7 @@ static zend_object_value date_object_clone_period(zval *this_ptr TSRMLS_DC)
 	php_period_obj *new_obj = NULL;
 	php_period_obj *old_obj = (php_period_obj *) zend_object_store_get_object(this_ptr TSRMLS_CC);
 	zend_object_value new_ov = date_object_new_period_ex(old_obj->std.ce, &new_obj TSRMLS_CC);
-
+	
 	zend_objects_clone_members(&new_obj->std, new_ov, &old_obj->std, Z_OBJ_HANDLE_P(this_ptr) TSRMLS_CC);

 	/** FIX ME ADD CLONE STUFF **/
@@ -2421,7 +2421,7 @@ PHPAPI int php_date_initialize(php_date_obj *dateobj, /*const*/ char *time_str,
 	int type = TIMELIB_ZONETYPE_ID, new_dst = 0;
 	char *new_abbr = NULL;
 	timelib_sll     new_offset;
-
+	
 	if (dateobj->time) {
 		timelib_time_dtor(dateobj->time);
 	}
@@ -2710,7 +2710,7 @@ void php_date_do_return_parsed_time(INTERNAL_FUNCTION_PARAMETERS, timelib_time *
 	PHP_DATE_PARSE_DATE_SET_TIME_ELEMENT(hour,      h);
 	PHP_DATE_PARSE_DATE_SET_TIME_ELEMENT(minute,    i);
 	PHP_DATE_PARSE_DATE_SET_TIME_ELEMENT(second,    s);
-
+	
 	if (parsed_time->f == -99999) {
 		add_assoc_bool(return_value, "fraction", 0);
 	} else {
@@ -2777,7 +2777,7 @@ PHP_FUNCTION(date_parse)
 	int                             date_len;
 	struct timelib_error_container *error;
 	timelib_time                   *parsed_time;
-
+	
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &date, &date_len) == FAILURE) {
 		RETURN_FALSE;
 	}
@@ -2796,7 +2796,7 @@ PHP_FUNCTION(date_parse_from_format)
 	int                             date_len, format_len;
 	struct timelib_error_container *error;
 	timelib_time                   *parsed_time;
-
+	
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ss", &format, &format_len, &date, &date_len) == FAILURE) {
 		RETURN_FALSE;
 	}
@@ -3123,7 +3123,7 @@ PHP_FUNCTION(date_isodate_set)
 	memset(&dateobj->time->relative, 0, sizeof(dateobj->time->relative));
 	dateobj->time->relative.d = timelib_daynr_from_weeknr(y, w, d);
 	dateobj->time->have_relative = 1;
-
+	
 	timelib_update_ts(dateobj->time, NULL);

 	RETURN_ZVAL(object, 1, 0);
@@ -3210,15 +3210,15 @@ PHP_FUNCTION(date_diff)
 static int timezone_initialize(timelib_tzinfo **tzi, /*const*/ char *tz TSRMLS_DC)
 {
 	char *tzid;
-
+	
 	*tzi = NULL;
-
+	
 	if ((tzid = timelib_timezone_id_from_abbr(tz, -1, 0))) {
 		*tzi = php_date_parse_tzfile(tzid, DATE_TIMEZONEDB TSRMLS_CC);
 	} else {
 		*tzi = php_date_parse_tzfile(tz, DATE_TIMEZONEDB TSRMLS_CC);
 	}
-
+	
 	if (*tzi) {
 		return SUCCESS;
 	} else {
@@ -3260,7 +3260,7 @@ PHP_METHOD(DateTimeZone, __construct)
 	timelib_tzinfo *tzi = NULL;
 	php_timezone_obj *tzobj;
 	zend_error_handling error_handling;
-
+	
 	zend_replace_error_handling(EH_THROW, NULL, &error_handling TSRMLS_CC);
 	if (SUCCESS == zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &tz, &tz_len)) {
 		if (SUCCESS == timezone_initialize(&tzi, tz TSRMLS_CC)) {
@@ -3487,7 +3487,7 @@ static int date_interval_initialize(timelib_rel_time **rt, /*const*/ char *forma
 	struct timelib_error_container *errors;

 	timelib_strtointerval(format, format_length, &b, &e, &p, &r, &errors);
-
+	
 	if (errors->error_count > 0) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unknown or bad format (%s)", format);
 		retval = FAILURE;
@@ -3646,7 +3646,7 @@ PHP_METHOD(DateInterval, __construct)
 	php_interval_obj *diobj;
 	timelib_rel_time *reltime;
 	zend_error_handling error_handling;
-
+	
 	zend_replace_error_handling(EH_THROW, NULL, &error_handling TSRMLS_CC);
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &interval_string, &interval_string_length) == SUCCESS) {
 		if (date_interval_initialize(&reltime, interval_string, interval_string_length TSRMLS_CC) == SUCCESS) {
@@ -3669,7 +3669,8 @@ static int php_date_interval_initialize_from_hash(zval **return_value, php_inter
 #define PHP_DATE_INTERVAL_READ_PROPERTY(element, member, itype, def) \
 	do { \
 		zval **z_arg = NULL; \
-		if (zend_hash_find(myht, element, strlen(element) + 1, (void**) &z_arg) == SUCCESS && Z_TYPE_PP(z_arg) == IS_LONG) { \
+		if (zend_hash_find(myht, element, strlen(element) + 1, (void**) &z_arg) == SUCCESS) { \
+			convert_to_long(*z_arg); \
 			(*intobj)->diff->member = (itype)Z_LVAL_PP(z_arg); \
 		} else { \
 			(*intobj)->diff->member = (itype)def; \
@@ -3680,15 +3681,8 @@ static int php_date_interval_initialize_from_hash(zval **return_value, php_inter
 	do { \
 		zval **z_arg = NULL; \
 		if (zend_hash_find(myht, element, strlen(element) + 1, (void**) &z_arg) == SUCCESS) { \
-			if (Z_TYPE_PP(z_arg) == IS_STRING) { \
-				DATE_A64I((*intobj)->diff->member, Z_STRVAL_PP(z_arg)); \
-			} else if (Z_TYPE_PP(z_arg) == IS_LONG || Z_TYPE_PP(z_arg) == IS_BOOL) { \
-				(*intobj)->diff->member = (timelib_sll)Z_LVAL_PP(z_arg); \
-			} else if (Z_TYPE_PP(z_arg) == IS_DOUBLE) { \
-				(*intobj)->diff->member = (timelib_sll)Z_DVAL_PP(z_arg); \
-			} else { \
-				(*intobj)->diff->member = -1LL; \
-			} \
+			convert_to_string(*z_arg); \
+			DATE_A64I((*intobj)->diff->member, Z_STRVAL_PP(z_arg)); \
 		} else { \
 			(*intobj)->diff->member = -1LL; \
 		} \
@@ -3866,7 +3860,7 @@ static int date_period_initialize(timelib_time **st, timelib_time **et, timelib_
 	struct timelib_error_container *errors;

 	timelib_strtointerval(format, format_length, &b, &e, &p, &r, &errors);
-
+	
 	if (errors->error_count > 0) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unknown or bad format (%s)", format);
 		retval = FAILURE;
@@ -3895,7 +3889,7 @@ PHP_METHOD(DatePeriod, __construct)
 	int   isostr_len = 0;
 	timelib_time *clone;
 	zend_error_handling error_handling;
-
+	
 	zend_replace_error_handling(EH_THROW, NULL, &error_handling TSRMLS_CC);
 	if (zend_parse_parameters_ex(ZEND_PARSE_PARAMS_QUIET, ZEND_NUM_ARGS() TSRMLS_CC, "OOl|l", &start, date_ce_date, &interval, date_ce_interval, &recurrences, &options) == FAILURE) {
 		if (zend_parse_parameters_ex(ZEND_PARSE_PARAMS_QUIET, ZEND_NUM_ARGS() TSRMLS_CC, "OOO|l", &start, date_ce_date, &interval, date_ce_interval, &end, date_ce_date, &options) == FAILURE) {
@@ -4008,7 +4002,7 @@ PHP_FUNCTION(timezone_identifiers_list)
 	tzdb = DATE_TIMEZONEDB;
 	item_count = tzdb->index_size;
 	table = tzdb->index;
-
+	
 	array_init(return_value);

 	for (i = 0; i < item_count; ++i) {
@@ -4042,7 +4036,7 @@ PHP_FUNCTION(timezone_abbreviations_list)
 {
 	const timelib_tz_lookup_table *table, *entry;
 	zval                          *element, **abbr_array_pp, *abbr_array;
-
+	
 	table = timelib_timezone_abbreviations_list();
 	array_init(return_value);
 	entry = table;
@@ -4118,11 +4112,11 @@ static void php_do_date_sunrise_sunset(INTERNAL_FUNCTION_PARAMETERS, int calc_su
 	timelib_time   *t;
 	timelib_tzinfo *tzi;
 	char           *retstr;
-
+	
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "l|ldddd", &time, &retformat, &latitude, &longitude, &zenith, &gmt_offset) == FAILURE) {
 		RETURN_FALSE;
 	}
-
+	
 	switch (ZEND_NUM_ARGS()) {
 		case 1:
 			retformat = SUNFUNCS_RET_STRING;
@@ -4166,7 +4160,7 @@ static void php_do_date_sunrise_sunset(INTERNAL_FUNCTION_PARAMETERS, int calc_su
 	timelib_unixtime2local(t, time);
 	rs = timelib_astro_rise_set_altitude(t, longitude, latitude, altitude, 1, &h_rise, &h_set, &rise, &set, &transit);
 	timelib_time_dtor(t);
-
+	
 	if (rs != 0) {
 		RETURN_FALSE;
 	}
@@ -4220,7 +4214,7 @@ PHP_FUNCTION(date_sun_info)
 	timelib_sll     rise, set, transit;
 	int             dummy;
 	double          ddummy;
-
+	
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ldd", &time, &latitude, &longitude) == FAILURE) {
 		RETURN_FALSE;
 	}
@@ -4234,7 +4228,7 @@ PHP_FUNCTION(date_sun_info)
 	/* Setup */
 	t2 = timelib_time_ctor();
 	array_init(return_value);
-
+	
 	/* Get sun up/down and transit */
 	rs = timelib_astro_rise_set_altitude(t, longitude, latitude, -35.0/60, 1, &ddummy, &ddummy, &rise, &set, &transit);
 	switch (rs) {
@@ -4378,7 +4372,7 @@ static HashTable *date_object_get_properties_period(zval *object TSRMLS_DC)
 		ZVAL_NULL(zv);
 	}
 	zend_hash_update(props, "interval", sizeof("interval"), &zv, sizeof(zv), NULL);
-
+	
 	/* converted to larger type (int->long); must check when unserializing */
 	MAKE_STD_ZVAL(zv);
 	ZVAL_LONG(zv, (long) period_obj->recurrences);
@@ -4460,7 +4454,7 @@ static int php_date_period_initialize_from_hash(php_period_obj *period_obj, Hash
 	}

 	period_obj->initialized = 1;
-
+	
 	return 1;
 }

@@ -4477,7 +4471,7 @@ PHP_METHOD(DatePeriod, __set_state)
 	}

 	myht = Z_ARRVAL_P(array);
-
+	
 	object_init_ex(return_value, date_ce_period);
 	period_obj = zend_object_store_get_object(return_value TSRMLS_CC);
 	if (!php_date_period_initialize_from_hash(period_obj, myht TSRMLS_CC)) {
@@ -14,17 +14,17 @@ var_dump($di);
 --EXPECTF--
 object(DateInterval)#%d (15) {
  ["y"]=>
-  int(-1)
+  int(2)
  ["m"]=>
-  int(-1)
+  int(0)
  ["d"]=>
-  int(-1)
+  int(0)
  ["h"]=>
-  int(-1)
+  int(6)
  ["i"]=>
-  int(-1)
+  int(8)
  ["s"]=>
-  int(-1)
+  int(0)
  ["weekday"]=>
  int(10)
  ["weekday_behavior"]=>
@@ -14,17 +14,17 @@ var_dump($di);
 --EXPECTF--
 object(DateInterval)#%d (15) {
  ["y"]=>
-  int(-1)
+  int(2)
  ["m"]=>
-  int(-1)
+  int(0)
  ["d"]=>
-  int(-1)
+  int(0)
  ["h"]=>
-  int(-1)
+  int(6)
  ["i"]=>
-  int(-1)
+  int(8)
  ["s"]=>
-  int(-1)
+  int(0)
  ["weekday"]=>
  int(10)
  ["weekday_behavior"]=>
@@ -74,7 +74,7 @@
 #include "php_ini.h"
 #include "ext/standard/php_string.h"
 #include "ext/standard/php_image.h"
-#include "ext/standard/info.h"
+#include "ext/standard/info.h" 

 /* needed for ssize_t definition */
 #include <sys/types.h>
@@ -161,7 +161,7 @@ ZEND_BEGIN_MODULE_GLOBALS(exif)
 	char * encode_jis;
 	char * decode_jis_be;
 	char * decode_jis_le;
-ZEND_END_MODULE_GLOBALS(exif)
+ZEND_END_MODULE_GLOBALS(exif) 

 ZEND_DECLARE_MODULE_GLOBALS(exif)

@@ -170,7 +170,7 @@ ZEND_DECLARE_MODULE_GLOBALS(exif)
 #else
 #define EXIF_G(v) (exif_globals.v)
 #endif
-
+ 
 /* {{{ PHP_INI
 */

@@ -213,7 +213,7 @@ PHP_INI_BEGIN()
    STD_PHP_INI_ENTRY("exif.decode_jis_intel",        "JIS",         PHP_INI_ALL, OnUpdateDecode, decode_jis_le,     zend_exif_globals, exif_globals)
 PHP_INI_END()
 /* }}} */
-
+ 
 /* {{{ PHP_GINIT_FUNCTION
 */
 static PHP_GINIT_FUNCTION(exif)
@@ -233,9 +233,9 @@ PHP_MINIT_FUNCTION(exif)
 {
 	REGISTER_INI_ENTRIES();
 	if (zend_hash_exists(&module_registry, "mbstring", sizeof("mbstring"))) {
-		REGISTER_LONG_CONSTANT("EXIF_USE_MBSTRING", 1, CONST_CS | CONST_PERSISTENT);
+		REGISTER_LONG_CONSTANT("EXIF_USE_MBSTRING", 1, CONST_CS | CONST_PERSISTENT); 
 	} else {
-		REGISTER_LONG_CONSTANT("EXIF_USE_MBSTRING", 0, CONST_CS | CONST_PERSISTENT);
+		REGISTER_LONG_CONSTANT("EXIF_USE_MBSTRING", 0, CONST_CS | CONST_PERSISTENT); 
 	}
 	return SUCCESS;
 }
@@ -265,7 +265,7 @@ zend_module_entry exif_module_entry = {
 	exif_module_deps,
 	"exif",
 	exif_functions,
-	PHP_MINIT(exif),
+	PHP_MINIT(exif), 
 	PHP_MSHUTDOWN(exif),
 	NULL, NULL,
 	PHP_MINFO(exif),
@@ -278,7 +278,7 @@ zend_module_entry exif_module_entry = {
 	NULL,
 	NULL,
 	STANDARD_MODULE_PROPERTIES_EX
-#else
+#else	
 	STANDARD_MODULE_PROPERTIES
 #endif
 };
@@ -667,73 +667,73 @@ static tag_info_array tag_table_IFD = {
  { 0x0213, "YCbCrPositioning"},
  { 0x0214, "ReferenceBlackWhite"},
  { 0x02BC, "ExtensibleMetadataPlatform"}, /* XAP: Extensible Authoring Publishing, obsoleted by XMP: Extensible Metadata Platform */
-  { 0x0301, "Gamma"},
-  { 0x0302, "ICCProfileDescriptor"},
-  { 0x0303, "SRGBRenderingIntent"},
-  { 0x0320, "ImageTitle"},
-  { 0x5001, "ResolutionXUnit"},
-  { 0x5002, "ResolutionYUnit"},
-  { 0x5003, "ResolutionXLengthUnit"},
-  { 0x5004, "ResolutionYLengthUnit"},
-  { 0x5005, "PrintFlags"},
-  { 0x5006, "PrintFlagsVersion"},
-  { 0x5007, "PrintFlagsCrop"},
-  { 0x5008, "PrintFlagsBleedWidth"},
-  { 0x5009, "PrintFlagsBleedWidthScale"},
-  { 0x500A, "HalftoneLPI"},
-  { 0x500B, "HalftoneLPIUnit"},
-  { 0x500C, "HalftoneDegree"},
-  { 0x500D, "HalftoneShape"},
-  { 0x500E, "HalftoneMisc"},
-  { 0x500F, "HalftoneScreen"},
-  { 0x5010, "JPEGQuality"},
-  { 0x5011, "GridSize"},
-  { 0x5012, "ThumbnailFormat"},
-  { 0x5013, "ThumbnailWidth"},
-  { 0x5014, "ThumbnailHeight"},
-  { 0x5015, "ThumbnailColorDepth"},
-  { 0x5016, "ThumbnailPlanes"},
-  { 0x5017, "ThumbnailRawBytes"},
-  { 0x5018, "ThumbnailSize"},
-  { 0x5019, "ThumbnailCompressedSize"},
-  { 0x501A, "ColorTransferFunction"},
-  { 0x501B, "ThumbnailData"},
-  { 0x5020, "ThumbnailImageWidth"},
-  { 0x5021, "ThumbnailImageHeight"},
-  { 0x5022, "ThumbnailBitsPerSample"},
-  { 0x5023, "ThumbnailCompression"},
-  { 0x5024, "ThumbnailPhotometricInterp"},
-  { 0x5025, "ThumbnailImageDescription"},
-  { 0x5026, "ThumbnailEquipMake"},
-  { 0x5027, "ThumbnailEquipModel"},
-  { 0x5028, "ThumbnailStripOffsets"},
-  { 0x5029, "ThumbnailOrientation"},
-  { 0x502A, "ThumbnailSamplesPerPixel"},
-  { 0x502B, "ThumbnailRowsPerStrip"},
-  { 0x502C, "ThumbnailStripBytesCount"},
-  { 0x502D, "ThumbnailResolutionX"},
-  { 0x502E, "ThumbnailResolutionY"},
-  { 0x502F, "ThumbnailPlanarConfig"},
-  { 0x5030, "ThumbnailResolutionUnit"},
-  { 0x5031, "ThumbnailTransferFunction"},
-  { 0x5032, "ThumbnailSoftwareUsed"},
-  { 0x5033, "ThumbnailDateTime"},
-  { 0x5034, "ThumbnailArtist"},
-  { 0x5035, "ThumbnailWhitePoint"},
-  { 0x5036, "ThumbnailPrimaryChromaticities"},
-  { 0x5037, "ThumbnailYCbCrCoefficients"},
-  { 0x5038, "ThumbnailYCbCrSubsampling"},
-  { 0x5039, "ThumbnailYCbCrPositioning"},
-  { 0x503A, "ThumbnailRefBlackWhite"},
-  { 0x503B, "ThumbnailCopyRight"},
-  { 0x5090, "LuminanceTable"},
-  { 0x5091, "ChrominanceTable"},
-  { 0x5100, "FrameDelay"},
-  { 0x5101, "LoopCount"},
-  { 0x5110, "PixelUnit"},
-  { 0x5111, "PixelPerUnitX"},
-  { 0x5112, "PixelPerUnitY"},
-  { 0x5113, "PaletteHistogram"},
+  { 0x0301, "Gamma"}, 
+  { 0x0302, "ICCProfileDescriptor"}, 
+  { 0x0303, "SRGBRenderingIntent"}, 
+  { 0x0320, "ImageTitle"}, 
+  { 0x5001, "ResolutionXUnit"}, 
+  { 0x5002, "ResolutionYUnit"}, 
+  { 0x5003, "ResolutionXLengthUnit"}, 
+  { 0x5004, "ResolutionYLengthUnit"}, 
+  { 0x5005, "PrintFlags"}, 
+  { 0x5006, "PrintFlagsVersion"}, 
+  { 0x5007, "PrintFlagsCrop"}, 
+  { 0x5008, "PrintFlagsBleedWidth"}, 
+  { 0x5009, "PrintFlagsBleedWidthScale"}, 
+  { 0x500A, "HalftoneLPI"}, 
+  { 0x500B, "HalftoneLPIUnit"}, 
+  { 0x500C, "HalftoneDegree"}, 
+  { 0x500D, "HalftoneShape"}, 
+  { 0x500E, "HalftoneMisc"}, 
+  { 0x500F, "HalftoneScreen"}, 
+  { 0x5010, "JPEGQuality"}, 
+  { 0x5011, "GridSize"}, 
+  { 0x5012, "ThumbnailFormat"}, 
+  { 0x5013, "ThumbnailWidth"}, 
+  { 0x5014, "ThumbnailHeight"}, 
+  { 0x5015, "ThumbnailColorDepth"}, 
+  { 0x5016, "ThumbnailPlanes"}, 
+  { 0x5017, "ThumbnailRawBytes"}, 
+  { 0x5018, "ThumbnailSize"}, 
+  { 0x5019, "ThumbnailCompressedSize"}, 
+  { 0x501A, "ColorTransferFunction"}, 
+  { 0x501B, "ThumbnailData"}, 
+  { 0x5020, "ThumbnailImageWidth"}, 
+  { 0x5021, "ThumbnailImageHeight"}, 
+  { 0x5022, "ThumbnailBitsPerSample"}, 
+  { 0x5023, "ThumbnailCompression"}, 
+  { 0x5024, "ThumbnailPhotometricInterp"}, 
+  { 0x5025, "ThumbnailImageDescription"}, 
+  { 0x5026, "ThumbnailEquipMake"}, 
+  { 0x5027, "ThumbnailEquipModel"}, 
+  { 0x5028, "ThumbnailStripOffsets"}, 
+  { 0x5029, "ThumbnailOrientation"}, 
+  { 0x502A, "ThumbnailSamplesPerPixel"}, 
+  { 0x502B, "ThumbnailRowsPerStrip"}, 
+  { 0x502C, "ThumbnailStripBytesCount"}, 
+  { 0x502D, "ThumbnailResolutionX"}, 
+  { 0x502E, "ThumbnailResolutionY"}, 
+  { 0x502F, "ThumbnailPlanarConfig"}, 
+  { 0x5030, "ThumbnailResolutionUnit"}, 
+  { 0x5031, "ThumbnailTransferFunction"}, 
+  { 0x5032, "ThumbnailSoftwareUsed"}, 
+  { 0x5033, "ThumbnailDateTime"}, 
+  { 0x5034, "ThumbnailArtist"}, 
+  { 0x5035, "ThumbnailWhitePoint"}, 
+  { 0x5036, "ThumbnailPrimaryChromaticities"}, 
+  { 0x5037, "ThumbnailYCbCrCoefficients"}, 
+  { 0x5038, "ThumbnailYCbCrSubsampling"}, 
+  { 0x5039, "ThumbnailYCbCrPositioning"}, 
+  { 0x503A, "ThumbnailRefBlackWhite"}, 
+  { 0x503B, "ThumbnailCopyRight"}, 
+  { 0x5090, "LuminanceTable"}, 
+  { 0x5091, "ChrominanceTable"}, 
+  { 0x5100, "FrameDelay"}, 
+  { 0x5101, "LoopCount"}, 
+  { 0x5110, "PixelUnit"}, 
+  { 0x5111, "PixelPerUnitX"}, 
+  { 0x5112, "PixelPerUnitY"}, 
+  { 0x5113, "PaletteHistogram"}, 
  { 0x1000, "RelatedImageFileFormat"},
  { 0x800D, "ImageID"},
  { 0x80E3, "Matteing"},   /* obsoleted by ExtraSamples */
@@ -939,7 +939,7 @@ static tag_info_array tag_table_VND_NIKON = {
  { 0x000b, "Converter"},
  TAG_TABLE_END
 };
-
+  
 static tag_info_array tag_table_VND_NIKON_990 = {
  { 0x0001, "Version"},
  { 0x0002, "ISOSetting"},
@@ -958,7 +958,7 @@ static tag_info_array tag_table_VND_NIKON_990 = {
  { 0x0010, "DataDump"},
  TAG_TABLE_END
 };
-
+  
 static tag_info_array tag_table_VND_OLYMPUS = {
  { 0x0200, "SpecialMode"},
  { 0x0201, "JPEGQuality"},
@@ -1224,7 +1224,7 @@ char * exif_dump_data(int *dump_free, int format, int components, int length, in
 		if (components > 0) {
 			dump = erealloc(dump, len + 2 + 1);
 			snprintf(dump + len, 2 + 1, ", ");
-			len += 2;
+			len += 2;			
 			components--;
 		} else{
 			break;
@@ -1574,7 +1574,7 @@ typedef struct {
 static void exif_error_docref(const char *docref EXIFERR_DC, const image_info_type *ImageInfo, int type, const char *format, ...)
 {
 	va_list args;
-
+	
 	va_start(args, format);
 #ifdef EXIF_DEBUG
 	{
@@ -2627,7 +2627,7 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
 			*pszEncoding = estrdup((const char*)szValuePtr);
 			szValuePtr = szValuePtr+8;
 			ByteCount -= 8;
-			/* First try to detect BOM: ZERO WIDTH NOBREAK SPACE (FEFF 16)
+			/* First try to detect BOM: ZERO WIDTH NOBREAK SPACE (FEFF 16) 
 			 * since we have no encoding support for the BOM yet we skip that.
 			 */
 			if (!memcmp(szValuePtr, "\xFE\xFF", 2)) {
@@ -2645,8 +2645,8 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
 			}
 			/* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX   */
 			if (zend_multibyte_encoding_converter(
-					(unsigned char**)pszInfoPtr,
-					&len,
+					(unsigned char**)pszInfoPtr, 
+					&len, 
 					(unsigned char*)szValuePtr,
 					ByteCount,
 					zend_multibyte_fetch_encoding(ImageInfo->encode_unicode TSRMLS_CC),
@@ -2666,8 +2666,8 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
 			ByteCount -= 8;
 			/* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX   */
 			if (zend_multibyte_encoding_converter(
-					(unsigned char**)pszInfoPtr,
-					&len,
+					(unsigned char**)pszInfoPtr, 
+					&len, 
 					(unsigned char*)szValuePtr,
 					ByteCount,
 					zend_multibyte_fetch_encoding(ImageInfo->encode_jis TSRMLS_CC),
@@ -2701,12 +2701,12 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
 * Process unicode field in IFD. */
 static int exif_process_unicode(image_info_type *ImageInfo, xp_field_type *xp_field, int tag, char *szValuePtr, int ByteCount TSRMLS_DC)
 {
-	xp_field->tag = tag;
+	xp_field->tag = tag;	
 	xp_field->value = NULL;
 	/* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX   */
 	if (zend_multibyte_encoding_converter(
-			(unsigned char**)&xp_field->value,
-			&xp_field->size,
+			(unsigned char**)&xp_field->value, 
+			&xp_field->size, 
 			(unsigned char*)szValuePtr,
 			ByteCount,
 			zend_multibyte_fetch_encoding(ImageInfo->encode_unicode TSRMLS_CC),
@@ -2731,7 +2731,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 		if (i==sizeof(maker_note_array)/sizeof(maker_note_type))
 			return FALSE;
 		maker_note = maker_note_array+i;
-
+		
 		/*exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "check (%s,%s)", maker_note->make?maker_note->make:"", maker_note->model?maker_note->model:"");*/
 		if (maker_note->make && (!ImageInfo->make || strcmp(maker_note->make, ImageInfo->make)))
 			continue;
@@ -2852,9 +2852,9 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 		offset_val = php_ifd_get32u(dir_entry+8, ImageInfo->motorola_intel);
 		/* If its bigger than 4 bytes, the dir entry contains an offset. */
 		value_ptr = offset_base+offset_val;
-        /*
+        /* 
            dir_entry is ImageInfo->file.list[sn].data+2+i*12
-            offset_base is ImageInfo->file.list[sn].data-dir_offset
+            offset_base is ImageInfo->file.list[sn].data-dir_offset 
            dir_entry - offset_base is dir_offset+2+i*12
        */
 		if (byte_count > IFDlength || offset_val > IFDlength-byte_count || value_ptr < dir_entry || offset_val < (size_t)(dir_entry-offset_base)) {
@@ -2925,18 +2925,18 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				case TAG_COMP_IMAGE_WIDTH:
 					ImageInfo->Thumbnail.width = exif_convert_any_to_int(value_ptr, format, ImageInfo->motorola_intel TSRMLS_CC);
 					break;
-
+	
 				case TAG_IMAGEHEIGHT:
 				case TAG_COMP_IMAGE_HEIGHT:
 					ImageInfo->Thumbnail.height = exif_convert_any_to_int(value_ptr, format, ImageInfo->motorola_intel TSRMLS_CC);
 					break;
-
+	
 				case TAG_STRIP_OFFSETS:
 				case TAG_JPEG_INTERCHANGE_FORMAT:
 					/* accept both formats */
 					ImageInfo->Thumbnail.offset = exif_convert_any_to_int(value_ptr, format, ImageInfo->motorola_intel TSRMLS_CC);
 					break;
-
+	
 				case TAG_STRIP_BYTE_COUNTS:
 					if (ImageInfo->FileType == IMAGE_FILETYPE_TIFF_II || ImageInfo->FileType == IMAGE_FILETYPE_TIFF_MM) {
 						ImageInfo->Thumbnail.filetype = ImageInfo->FileType;
@@ -2946,7 +2946,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 					}
 					ImageInfo->Thumbnail.size = exif_convert_any_to_int(value_ptr, format, ImageInfo->motorola_intel TSRMLS_CC);
 					break;
-
+	
 				case TAG_JPEG_INTERCHANGE_FORMAT_LEN:
 					if (ImageInfo->Thumbnail.filetype == IMAGE_FILETYPE_UNKNOWN) {
 						ImageInfo->Thumbnail.filetype = IMAGE_FILETYPE_JPEG;
@@ -2964,16 +2964,16 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 					if (length<byte_count-1) {
 						/* When there are any characters after the first NUL */
 						ImageInfo->CopyrightPhotographer  = estrdup(value_ptr);
-						ImageInfo->CopyrightEditor        = estrndup(value_ptr+length+1, byte_count-length-1);
+						ImageInfo->CopyrightEditor        = estrdup(value_ptr+length+1);
 						spprintf(&ImageInfo->Copyright, 0, "%s, %s", value_ptr, value_ptr+length+1);
 						/* format = TAG_FMT_UNDEFINED; this musn't be ASCII         */
 						/* but we are not supposed to change this                   */
 						/* keep in mind that image_info does not store editor value */
 					} else {
-						ImageInfo->Copyright = estrndup(value_ptr, byte_count);
+						ImageInfo->Copyright = estrdup(value_ptr);
 					}
 				}
-				break;
+				break;   

 			case TAG_USERCOMMENT:
 				ImageInfo->UserCommentLength = exif_process_user_comment(ImageInfo, &(ImageInfo->UserComment), &(ImageInfo->UserCommentEncoding), value_ptr, byte_count TSRMLS_CC);
@@ -3061,10 +3061,10 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				break;

 			case TAG_MAKE:
-				ImageInfo->make = estrndup(value_ptr, byte_count);
+				ImageInfo->make = estrdup(value_ptr);
 				break;
 			case TAG_MODEL:
-				ImageInfo->model = estrndup(value_ptr, byte_count);
+				ImageInfo->model = estrdup(value_ptr);
 				break;

 			case TAG_MAKER_NOTE:
@@ -3414,7 +3414,7 @@ static int exif_scan_JPEG_header(image_info_type *ImageInfo TSRMLS_DC)
 				if ((itemlen - 2) < 6) {
 					return FALSE;
 				}
-
+		
 				exif_process_SOFn(Data, marker, &sof_info);
 				ImageInfo->Width  = sof_info.width;
 				ImageInfo->Height = sof_info.height;
@@ -3459,21 +3459,21 @@ static int exif_scan_thumbnail(image_info_type *ImageInfo TSRMLS_DC)
 	}
 	for (;;) {
 		pos += length;
-		if (pos>=ImageInfo->Thumbnail.size)
+		if (pos>=ImageInfo->Thumbnail.size) 
 			return FALSE;
 		c = data[pos++];
-		if (pos>=ImageInfo->Thumbnail.size)
+		if (pos>=ImageInfo->Thumbnail.size) 
 			return FALSE;
 		if (c != 0xFF) {
 			return FALSE;
 		}
 		n = 8;
 		while ((c = data[pos++]) == 0xFF && n--) {
-			if (pos+3>=ImageInfo->Thumbnail.size)
+			if (pos+3>=ImageInfo->Thumbnail.size) 
 				return FALSE;
 			/* +3 = pos++ of next check when reaching marker + 2 bytes for length */
 		}
-		if (c == 0xFF)
+		if (c == 0xFF) 
 			return FALSE;
 		marker = c;
 		length = php_jpg_get16(data+pos);
@@ -3787,7 +3787,7 @@ static int exif_scan_FILE_header(image_info_type *ImageInfo TSRMLS_DC)
 				exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "File has TIFF/II format");
 #endif
 				ImageInfo->sections_found |= FOUND_IFD0;
-				if (exif_process_IFD_in_TIFF(ImageInfo,
+				if (exif_process_IFD_in_TIFF(ImageInfo, 
 											 php_ifd_get32u(file_header + 4, ImageInfo->motorola_intel),
 											 SECTION_IFD0 TSRMLS_CC)) {
 					ret = TRUE;
@@ -3967,7 +3967,7 @@ PHP_FUNCTION(exif_read_data)
 	sections_str = exif_get_sectionlist(ImageInfo.sections_found TSRMLS_CC);

 #ifdef EXIF_DEBUG
-	if (sections_str)
+	if (sections_str) 
 		exif_error_docref(NULL EXIFERR_CC, &ImageInfo, E_NOTICE, "Sections found: %s", sections_str[0] ? sections_str : "None");
 #endif

@@ -336,7 +336,7 @@ PHP_HASH_API void PHP_HAVAL128Final(unsigned char *digest, PHP_HAVAL_CTX * conte

 	/* Pad out to 118 mod 128.
 	 */
-	index = (unsigned int) ((context->count[0] >> 3) & 0x7f);
+	index = (unsigned int) ((context->count[0] >> 3) & 0x3f);
 	padLen = (index < 118) ? (118 - index) : (246 - index);
 	PHP_HAVALUpdate(context, PADDING, padLen);

@@ -390,7 +390,7 @@ PHP_HASH_API void PHP_HAVAL160Final(unsigned char *digest, PHP_HAVAL_CTX * conte

 	/* Pad out to 118 mod 128.
 	 */
-	index = (unsigned int) ((context->count[0] >> 3) & 0x7f);
+	index = (unsigned int) ((context->count[0] >> 3) & 0x3f);
 	padLen = (index < 118) ? (118 - index) : (246 - index);
 	PHP_HAVALUpdate(context, PADDING, padLen);

@@ -444,7 +444,7 @@ PHP_HASH_API void PHP_HAVAL192Final(unsigned char *digest, PHP_HAVAL_CTX * conte

 	/* Pad out to 118 mod 128.
 	 */
-	index = (unsigned int) ((context->count[0] >> 3) & 0x7f);
+	index = (unsigned int) ((context->count[0] >> 3) & 0x3f);
 	padLen = (index < 118) ? (118 - index) : (246 - index);
 	PHP_HAVALUpdate(context, PADDING, padLen);

@@ -484,7 +484,7 @@ PHP_HASH_API void PHP_HAVAL224Final(unsigned char *digest, PHP_HAVAL_CTX * conte

 	/* Pad out to 118 mod 128.
 	 */
-	index = (unsigned int) ((context->count[0] >> 3) & 0x7f);
+	index = (unsigned int) ((context->count[0] >> 3) & 0x3f);
 	padLen = (index < 118) ? (118 - index) : (246 - index);
 	PHP_HAVALUpdate(context, PADDING, padLen);

@@ -525,7 +525,7 @@ PHP_HASH_API void PHP_HAVAL256Final(unsigned char *digest, PHP_HAVAL_CTX * conte

 	/* Pad out to 118 mod 128.
 	 */
-	index = (unsigned int) ((context->count[0] >> 3) & 0x7f);
+	index = (unsigned int) ((context->count[0] >> 3) & 0x3f);
 	padLen = (index < 118) ? (118 - index) : (246 - index);
 	PHP_HAVALUpdate(context, PADDING, padLen);

@@ -1,18 +0,0 @@
--TEST--
-Bug #70312 HAVAL gives wrong hashes in specific cases
--SKIPIF--
-<?php if(!extension_loaded("hash")) print "skip"; ?>
--FILE--
-<?php
-var_dump(hash('haval128,5', '1234567890123456789012345678901234567890123456789012345678901234'));
-var_dump(hash('haval160,5', '1234567890123456789012345678901234567890123456789012345678901234'));
-var_dump(hash('haval192,5', '1234567890123456789012345678901234567890123456789012345678901234'));
-var_dump(hash('haval224,5', '1234567890123456789012345678901234567890123456789012345678901234'));
-var_dump(hash('haval256,5', '1234567890123456789012345678901234567890123456789012345678901234'));
-?>
--EXPECTF--
-string(32) "f3f0d23819b87228b4b70ee350afaa9d"
-string(40) "aded6485e137f11d7292212ba3fa961714df0564"
-string(48) "e53da2b16269fe732e9a898a96707a9f28404d7333b02286"
-string(56) "c574fb307f0817b514b9bb2e7c4bfaffb7ad667aca3c8b523fefcf10"
-string(64) "fb73c19300b14d5cb393d929bf005e6c2d459a4c9c009e9813af1d2d3637ee8f"
@@ -64,7 +64,7 @@ unlink($file);
 adler32: ff87222e
 crc32: 61664d33
 gost: d9e65f0c0c2ef944e4f8a01f4a46365c4f33a2853756878182a7f03e1490a4cd
-haval128,3: c25962b13383c3ed9f13817c8f2ae7d6
+haval128,3: 8bb81269aca8b7f87829020d76a4e841
 md2: 70f791c0d8fa9edd7d08e32fcba8c354
 md4: a9d034b16bb290c57a645afd6f14cd3b
 md5: 704bf818448f5bbb94061332d2c889aa
@@ -45,7 +45,7 @@ echo "sha256(raw): " . bin2hex(hash_hmac('sha256', $content, $key, TRUE)) . "\n"
 adler32: 12c803f7
 crc32: 96859101
 gost: a4a3c80bdf3f8665bf07376a34dc9c1b11af7c813f4928f62e39f0c0dc564dad
-haval128,3: 4d1318607f0406bd1b7bd50907772672
+haval128,3: 82cd0f4bd36729b5c80c33efa8c13ac5
 md2: 6d111dab563025e4cb5f4425c991fa12
 md4: 10cdbfe843000c623f8b8da0d5d20b0b
 md5: 2a632783e2812cf23de100d7d6a463ae
@@ -73,7 +73,7 @@ unlink($file);
 adler32: 0f8c02f9
 crc32: f2a60b9c
 gost: 94c39a40d5db852a8dc3d24e37eebf2d53e3d711457c59cd02b614f792a9d918
-haval128,3: f1cea637451097d790354a86de3f54a3
+haval128,3: e8fcff647f1a675acb429130fb94a17e
 md2: a685475e600314bb549ab4f33c3b27cb
 md4: cbc6bff781f48f57378d3effa27553e4
 md5: 8bddf39dd1c566c27acc7fa85ec36acf
@@ -5070,6 +5070,7 @@ PHP_FUNCTION(openssl_random_pseudo_bytes)
 	long buffer_length;
 	unsigned char *buffer = NULL;
 	zval *zstrong_result_returned = NULL;
+	int strong_result = 0;

 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "l|z", &buffer_length, &zstrong_result_returned) == FAILURE) {
 		return;
@@ -5087,6 +5088,7 @@ PHP_FUNCTION(openssl_random_pseudo_bytes)
 	buffer = emalloc(buffer_length + 1);

 #ifdef PHP_WIN32
+	strong_result = 1;
 	/* random/urandom equivalent on Windows */
 	if (php_win32_get_random_bytes(buffer, (size_t) buffer_length) == FAILURE) {
 		efree(buffer);
@@ -5096,7 +5098,7 @@ PHP_FUNCTION(openssl_random_pseudo_bytes)
 		RETURN_FALSE;
 	}
 #else
-	if (RAND_bytes(buffer, buffer_length) <= 0) {
+	if ((strong_result = RAND_pseudo_bytes(buffer, buffer_length)) < 0) {
 		efree(buffer);
 		if (zstrong_result_returned) {
 			ZVAL_BOOL(zstrong_result_returned, 0);
@@ -5109,7 +5111,7 @@ PHP_FUNCTION(openssl_random_pseudo_bytes)
 	RETVAL_STRINGL((char *)buffer, buffer_length, 0);

 	if (zstrong_result_returned) {
-		ZVAL_BOOL(zstrong_result_returned, 1);
+		ZVAL_BOOL(zstrong_result_returned, strong_result);
 	}
 }
 /* }}} */
@@ -136,7 +136,7 @@ static PHP_MINFO_FUNCTION(pcre)
 static PHP_MINIT_FUNCTION(pcre)
 {
 	REGISTER_INI_ENTRIES();
-
+	
 	REGISTER_LONG_CONSTANT("PREG_PATTERN_ORDER", PREG_PATTERN_ORDER, CONST_CS | CONST_PERSISTENT);
 	REGISTER_LONG_CONSTANT("PREG_SET_ORDER", PREG_SET_ORDER, CONST_CS | CONST_PERSISTENT);
 	REGISTER_LONG_CONSTANT("PREG_OFFSET_CAPTURE", PREG_OFFSET_CAPTURE, CONST_CS | CONST_PERSISTENT);
@@ -276,18 +276,18 @@ PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(char *regex, int regex_le
 #endif
 		}
 	}
-
+	
 	p = regex;
-
+	
 	/* Parse through the leading whitespace, and display a warning if we
 	   get to the end without encountering a delimiter. */
 	while (isspace((int)*(unsigned char *)p)) p++;
 	if (*p == 0) {
-		php_error_docref(NULL TSRMLS_CC, E_WARNING,
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, 
 						 p < regex + regex_len ? "Null byte in regex" : "Empty regular expression");
 		return NULL;
 	}
-
+	
 	/* Get the delimiter and display a warning if it is alphanumeric
 	   or a backslash. */
 	delimiter = *p++;
@@ -340,7 +340,7 @@ PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(char *regex, int regex_le
 		}
 		return NULL;
 	}
-
+	
 	/* Make a copy of the actual pattern. */
 	pattern = estrndup(p, pp-p);

@@ -348,7 +348,7 @@ PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(char *regex, int regex_le
 	pp++;

 	/* Parse through the options, setting appropriate flags.  Display
-	   a warning if we encounter an unknown modifier. */
+	   a warning if we encounter an unknown modifier. */	
 	while (pp < regex + regex_len) {
 		switch (*pp++) {
 			/* Perl compatible options */
@@ -356,7 +356,7 @@ PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(char *regex, int regex_le
 			case 'm':	coptions |= PCRE_MULTILINE;		break;
 			case 's':	coptions |= PCRE_DOTALL;		break;
 			case 'x':	coptions |= PCRE_EXTENDED;		break;
-
+			
 			/* PCRE specific options */
 			case 'A':	coptions |= PCRE_ANCHORED;		break;
 			case 'D':	coptions |= PCRE_DOLLAR_ENDONLY;break;
@@ -369,12 +369,12 @@ PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(char *regex, int regex_le
       the PCRE_UCP option. */
 #ifdef PCRE_UCP
 						coptions |= PCRE_UCP;
-#endif
+#endif			
 				break;

 			/* Custom preg options */
 			case 'e':	poptions |= PREG_REPLACE_EVAL;	break;
-
+			
 			case ' ':
 			case '\n':
 				break;
@@ -453,7 +453,7 @@ PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(char *regex, int regex_le
 	 * at end of request. However PCRE_G(pcre_cache) must be consistent
 	 * on the next request as well. So we disable usage of interned strings
 	 * as hash keys especually for this table.
-	 * See bug #63180
+	 * See bug #63180 
 	 */
 	if (IS_INTERNED(regex)) {
 		regex = tmp = estrndup(regex, regex_len);
@@ -482,7 +482,7 @@ PHPAPI pcre* pcre_get_compiled_regex(char *regex, pcre_extra **extra, int *preg_
 	if (preg_options) {
 		*preg_options = pce ? pce->preg_options : 0;
 	}
-
+	
 	return pce ? pce->re : NULL;
 }
 /* }}} */
@@ -492,7 +492,7 @@ PHPAPI pcre* pcre_get_compiled_regex(char *regex, pcre_extra **extra, int *preg_
 PHPAPI pcre* pcre_get_compiled_regex_ex(char *regex, pcre_extra **extra, int *preg_options, int *compile_options TSRMLS_DC)
 {
 	pcre_cache_entry * pce = pcre_get_compiled_regex_cache(regex, strlen(regex) TSRMLS_CC);
-
+	
 	if (extra) {
 		*extra = pce ? pce->extra : NULL;
 	}
@@ -502,7 +502,7 @@ PHPAPI pcre* pcre_get_compiled_regex_ex(char *regex, pcre_extra **extra, int *pr
 	if (compile_options) {
 		*compile_options = pce ? pce->compile_options : 0;
 	}
-
+	
 	return pce ? pce->re : NULL;
 }
 /* }}} */
@@ -519,7 +519,7 @@ static inline void add_offset_pair(zval *result, char *str, int len, int offset,
 	/* Add (match, offset) to the return value */
 	add_next_index_stringl(match_pair, str, len, 1);
 	add_next_index_long(match_pair, offset);
-
+	
 	if (name) {
 		zval_add_ref(&match_pair);
 		zend_hash_update(Z_ARRVAL_P(result), name, strlen(name)+1, &match_pair, sizeof(zval *), NULL);
@@ -544,13 +544,13 @@ static void php_do_pcre_match(INTERNAL_FUNCTION_PARAMETERS, int global) /* {{{ *
 							  &subject, &subject_len, &subpats, &flags, &start_offset) == FAILURE) {
 		RETURN_FALSE;
 	}
-
+	
 	/* Compile regex or get it from cache. */
 	if ((pce = pcre_get_compiled_regex_cache(regex, regex_len TSRMLS_CC)) == NULL) {
 		RETURN_FALSE;
 	}

-	php_pcre_match_impl(pce, subject, subject_len, return_value, subpats,
+	php_pcre_match_impl(pce, subject, subject_len, return_value, subpats, 
 		global, ZEND_NUM_ARGS() >= 4, flags, start_offset TSRMLS_CC);
 }
 /* }}} */
@@ -653,7 +653,7 @@ PHPAPI void php_pcre_match_impl(pcre_cache_entry *pce, char *subject, int subjec

 	matched = 0;
 	PCRE_G(error_code) = PHP_PCRE_NO_ERROR;
-
+	
 	do {
 		/* Execute the regular expression. */
 		count = pcre_exec(pce->re, extra, subject, subject_len, start_offset,
@@ -675,7 +675,7 @@ PHPAPI void php_pcre_match_impl(pcre_cache_entry *pce, char *subject, int subjec
 			/* If subpatterns array has been passed, fill it in with values. */
 			if (subpats != NULL) {
 				/* Try to get the list of substrings and display a warning if failed. */
-				if ((offsets[1] - offsets[0] < 0) || pcre_get_substring_list(subject, offsets, count, &stringlist) < 0) {
+				if (pcre_get_substring_list(subject, offsets, count, &stringlist) < 0) {
 					efree(subpat_names);
 					efree(offsets);
 					if (match_sets) efree(match_sets);
@@ -710,7 +710,7 @@ PHPAPI void php_pcre_match_impl(pcre_cache_entry *pce, char *subject, int subjec
 						ALLOC_ZVAL(result_set);
 						array_init(result_set);
 						INIT_PZVAL(result_set);
-
+						
 						/* Add all the subpatterns to it */
 						for (i = 0; i < count; i++) {
 							if (offset_capture) {
@@ -762,13 +762,13 @@ PHPAPI void php_pcre_match_impl(pcre_cache_entry *pce, char *subject, int subjec
 			pcre_handle_exec_error(count TSRMLS_CC);
 			break;
 		}
-
+		
 		/* If we have matched an empty string, mimic what Perl's /g options does.
 		   This turns out to be rather cunning. First we set PCRE_NOTEMPTY and try
 		   the match again at the same point. If this fails (picked up above) we
 		   advance to the next character. */
 		g_notempty = (offsets[1] == offsets[0])? PCRE_NOTEMPTY | PCRE_ANCHORED : 0;
-
+		
 		/* Advance to the position right after the last full match */
 		start_offset = offsets[1];
 	} while (global);
@@ -785,7 +785,7 @@ PHPAPI void php_pcre_match_impl(pcre_cache_entry *pce, char *subject, int subjec
 		}
 		efree(match_sets);
 	}
-
+	
 	efree(offsets);
 	efree(subpat_names);

@@ -835,7 +835,7 @@ static int preg_get_backref(char **str, int *backref)
 		walk++;
 	} else
 		return 0;
-
+	
 	if (*walk && *walk >= '0' && *walk <= '9') {
 		*backref = *backref * 10 + *walk - '0';
 		walk++;
@@ -847,9 +847,9 @@ static int preg_get_backref(char **str, int *backref)
 		else
 			walk++;
 	}
-
+	
 	*str = walk;
-	return 1;
+	return 1;	
 }
 /* }}} */

@@ -859,7 +859,7 @@ static int preg_do_repl_func(zval *function, char *subject, int *offsets, char *
 {
 	zval		*retval_ptr;		/* Function return value */
 	zval	   **args[1];			/* Argument to pass to function */
-	zval		*subpats;			/* Captured subpatterns */
+	zval		*subpats;			/* Captured subpatterns */ 
 	int			 result_len;		/* Return value length */
 	int			 i;

@@ -910,11 +910,11 @@ static int preg_do_eval(char *eval_str, int eval_str_len, char *subject,
 	int			 backref;			/* Current backref */
 	char        *compiled_string_description;
 	smart_str    code = {0};
-
+	
 	eval_str_end = eval_str + eval_str_len;
 	walk = segment = eval_str;
 	walk_last = 0;
-
+	
 	while (walk < eval_str_end) {
 		/* If found a backreference.. */
 		if ('\\' == *walk || '$' == *walk) {
@@ -967,15 +967,15 @@ static int preg_do_eval(char *eval_str, int eval_str_len, char *subject,
 	}
 	efree(compiled_string_description);
 	convert_to_string(&retval);
-
+	
 	/* Save the return value and its length */
 	*result = estrndup(Z_STRVAL(retval), Z_STRLEN(retval));
 	result_len = Z_STRLEN(retval);
-
+	
 	/* Clean up */
 	zval_dtor(&retval);
 	smart_str_free(&code);
-
+	
 	return result_len;
 }
 /* }}} */
@@ -994,13 +994,13 @@ PHPAPI char *php_pcre_replace(char *regex,   int regex_len,
 		return NULL;
 	}

-	return php_pcre_replace_impl(pce, subject, subject_len, replace_val,
+	return php_pcre_replace_impl(pce, subject, subject_len, replace_val, 
 		is_callable_replace, result_len, limit, replace_count TSRMLS_CC);
 }
 /* }}} */

 /* {{{ php_pcre_replace_impl() */
-PHPAPI char *php_pcre_replace_impl(pcre_cache_entry *pce, char *subject, int subject_len, zval *replace_val,
+PHPAPI char *php_pcre_replace_impl(pcre_cache_entry *pce, char *subject, int subject_len, zval *replace_val, 
 	int is_callable_replace, int *result_len, int limit, int *replace_count TSRMLS_DC)
 {
 	pcre_extra		*extra = pce->extra;/* Holds results of studying */
@@ -1072,7 +1072,7 @@ PHPAPI char *php_pcre_replace_impl(pcre_cache_entry *pce, char *subject, int sub
 	}

 	offsets = (int *)safe_emalloc(size_offsets, sizeof(int), 0);
-
+	
 	alloc_len = 2 * subject_len + 1;
 	result = safe_emalloc(alloc_len, sizeof(char), 0);

@@ -1081,7 +1081,7 @@ PHPAPI char *php_pcre_replace_impl(pcre_cache_entry *pce, char *subject, int sub
 	*result_len = 0;
 	start_offset = 0;
 	PCRE_G(error_code) = PHP_PCRE_NO_ERROR;
-
+	
 	while (1) {
 		/* Execute the regular expression. */
 		count = pcre_exec(pce->re, extra, subject, subject_len, start_offset,
@@ -1098,7 +1098,7 @@ PHPAPI char *php_pcre_replace_impl(pcre_cache_entry *pce, char *subject, int sub

 		piece = subject + start_offset;

-		if (count > 0 && (offsets[1] - offsets[0] >= 0) && (limit == -1 || limit > 0)) {
+		if (count > 0 && (limit == -1 || limit > 0)) {
 			if (replace_count) {
 				++*replace_count;
 			}
@@ -1106,7 +1106,7 @@ PHPAPI char *php_pcre_replace_impl(pcre_cache_entry *pce, char *subject, int sub
 			match = subject + offsets[0];

 			new_len = *result_len + offsets[0] - start_offset; /* part before the match */
-
+			
 			/* If evaluating, do it and add the return string's length */
 			if (eval) {
 				eval_result_len = preg_do_eval(replace, replace_len, subject,
@@ -1151,7 +1151,7 @@ PHPAPI char *php_pcre_replace_impl(pcre_cache_entry *pce, char *subject, int sub

 			/* copy replacement and backrefs */
 			walkbuf = result + *result_len;
-
+			
 			/* If evaluating or using custom function, copy result to the buffer
 			 * and clean up. */
 			if (eval || is_callable_replace) {
@@ -1219,13 +1219,13 @@ PHPAPI char *php_pcre_replace_impl(pcre_cache_entry *pce, char *subject, int sub
 			result = NULL;
 			break;
 		}
-
+			
 		/* If we have matched an empty string, mimic what Perl's /g options does.
 		   This turns out to be rather cunning. First we set PCRE_NOTEMPTY and try
 		   the match again at the same point. If this fails (picked up above) we
 		   advance to the next character. */
 		g_notempty = (offsets[1] == offsets[0])? PCRE_NOTEMPTY | PCRE_ANCHORED : 0;
-
+		
 		/* Advance to the next piece. */
 		start_offset = offsets[1];
 	}
@@ -1249,18 +1249,18 @@ static char *php_replace_in_subject(zval *regex, zval *replace, zval **subject,
 				*result;
 	int			 subject_len;

-	/* Make sure we're dealing with strings. */
+	/* Make sure we're dealing with strings. */	
 	convert_to_string_ex(subject);
 	/* FIXME: This might need to be changed to STR_EMPTY_ALLOC(). Check if this zval could be dtor()'ed somehow */
 	ZVAL_STRINGL(&empty_replace, "", 0, 0);
-
+	
 	/* If regex is an array */
 	if (Z_TYPE_P(regex) == IS_ARRAY) {
 		/* Duplicate subject string for repeated replacement */
 		subject_value = estrndup(Z_STRVAL_PP(subject), Z_STRLEN_PP(subject));
 		subject_len = Z_STRLEN_PP(subject);
 		*result_len = subject_len;
-
+		
 		zend_hash_internal_pointer_reset(Z_ARRVAL_P(regex));

 		replace_value = replace;
@@ -1269,9 +1269,9 @@ static char *php_replace_in_subject(zval *regex, zval *replace, zval **subject,

 		/* For each entry in the regex array, get the entry */
 		while (zend_hash_get_current_data(Z_ARRVAL_P(regex), (void **)&regex_entry) == SUCCESS) {
-			/* Make sure we're dealing with strings. */
+			/* Make sure we're dealing with strings. */	
 			convert_to_string_ex(regex_entry);
-
+		
 			/* If replace is an array and not a callable construct */
 			if (Z_TYPE_P(replace) == IS_ARRAY && !is_callable_replace) {
 				/* Get current entry */
@@ -1286,7 +1286,7 @@ static char *php_replace_in_subject(zval *regex, zval *replace, zval **subject,
 					replace_value = &empty_replace;
 				}
 			}
-
+			
 			/* Do the actual replacement and put the result back into subject_value
 			   for further replacements. */
 			if ((result = php_pcre_replace(Z_STRVAL_PP(regex_entry),
@@ -1342,12 +1342,12 @@ static void preg_replace_impl(INTERNAL_FUNCTION_PARAMETERS, int is_callable_repl
 	ulong			 num_key;
 	char			*callback_name;
 	int				 replace_count=0, old_replace_count;
-
+	
 	/* Get function parameters and do error-checking. */
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ZZZ|lZ", &regex, &replace, &subject, &limit, &zcount) == FAILURE) {
 		return;
 	}
-
+	
 	if (!is_callable_replace && Z_TYPE_PP(replace) == IS_ARRAY && Z_TYPE_PP(regex) != IS_ARRAY) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Parameter mismatch, pattern is a string while replacement is an array");
 		RETURN_FALSE;
@@ -1373,10 +1373,10 @@ static void preg_replace_impl(INTERNAL_FUNCTION_PARAMETERS, int is_callable_repl
 	if (ZEND_NUM_ARGS() > 3) {
 		limit_val = limit;
 	}
-
+		
 	if (Z_TYPE_PP(regex) != IS_ARRAY)
 		convert_to_string_ex(regex);
-
+	
 	/* if subject is an array */
 	if (Z_TYPE_PP(subject) == IS_ARRAY) {
 		array_init(return_value);
@@ -1404,7 +1404,7 @@ static void preg_replace_impl(INTERNAL_FUNCTION_PARAMETERS, int is_callable_repl
 					efree(result);
 				}
 			}
-
+		
 			zend_hash_move_forward(Z_ARRVAL_PP(subject));
 		}
 	} else {	/* if subject is not an array */
@@ -1421,7 +1421,7 @@ static void preg_replace_impl(INTERNAL_FUNCTION_PARAMETERS, int is_callable_repl
 		zval_dtor(*zcount);
 		ZVAL_LONG(*zcount, replace_count);
 	}
-
+    	
 }
 /* }}} */

@@ -1449,7 +1449,7 @@ static PHP_FUNCTION(preg_filter)
 }
 /* }}} */

-/* {{{ proto array preg_split(string pattern, string subject [, int limit [, int flags]])
+/* {{{ proto array preg_split(string pattern, string subject [, int limit [, int flags]]) 
   Split string into an array using a perl-style regular expression as a delimiter */
 static PHP_FUNCTION(preg_split)
 {
@@ -1461,12 +1461,12 @@ static PHP_FUNCTION(preg_split)
 	long				 flags = 0;		/* Match control flags */
 	pcre_cache_entry	*pce;			/* Compiled regular expression */

-	/* Get function parameters and do error checking */
+	/* Get function parameters and do error checking */	
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ss|ll", &regex, &regex_len,
 							  &subject, &subject_len, &limit_val, &flags) == FAILURE) {
 		RETURN_FALSE;
 	}
-
+	
 	/* Compile regex or get it from cache. */
 	if ((pce = pcre_get_compiled_regex_cache(regex, regex_len TSRMLS_CC)) == NULL) {
 		RETURN_FALSE;
@@ -1501,7 +1501,7 @@ PHPAPI void php_pcre_split_impl(pcre_cache_entry *pce, char *subject, int subjec
 	no_empty = flags & PREG_SPLIT_NO_EMPTY;
 	delim_capture = flags & PREG_SPLIT_DELIM_CAPTURE;
 	offset_capture = flags & PREG_SPLIT_OFFSET_CAPTURE;
-
+	
 	if (limit_val == 0) {
 		limit_val = -1;
 	}
@@ -1512,7 +1512,7 @@ PHPAPI void php_pcre_split_impl(pcre_cache_entry *pce, char *subject, int subjec
 	}
 	extra->match_limit = PCRE_G(backtrack_limit);
 	extra->match_limit_recursion = PCRE_G(recursion_limit);
-
+	
 	/* Initialize return value */
 	array_init(return_value);

@@ -1524,13 +1524,13 @@ PHPAPI void php_pcre_split_impl(pcre_cache_entry *pce, char *subject, int subjec
 	}
 	size_offsets = (size_offsets + 1) * 3;
 	offsets = (int *)safe_emalloc(size_offsets, sizeof(int), 0);
-
+	
 	/* Start at the beginning of the string */
 	start_offset = 0;
 	next_offset = 0;
 	last_match = subject;
 	PCRE_G(error_code) = PHP_PCRE_NO_ERROR;
-
+	
 	/* Get next piece if no limit or limit not yet reached and something matched*/
 	while ((limit_val == -1 || limit_val > 1)) {
 		count = pcre_exec(pce->re, extra, subject,
@@ -1545,9 +1545,9 @@ PHPAPI void php_pcre_split_impl(pcre_cache_entry *pce, char *subject, int subjec
 			php_error_docref(NULL TSRMLS_CC,E_NOTICE, "Matched, but too many substrings");
 			count = size_offsets/3;
 		}
-
+				
 		/* If something matched */
-		if (count > 0 && (offsets[1] - offsets[0] >= 0)) {
+		if (count > 0) {
 			if (!no_empty || &subject[offsets[0]] != last_match) {

 				if (offset_capture) {
@@ -1563,7 +1563,7 @@ PHPAPI void php_pcre_split_impl(pcre_cache_entry *pce, char *subject, int subjec
 				if (limit_val != -1)
 					limit_val--;
 			}
-
+			
 			last_match = &subject[offsets[1]];
 			next_offset = offsets[1];

@@ -1620,7 +1620,7 @@ PHPAPI void php_pcre_split_impl(pcre_cache_entry *pce, char *subject, int subjec
 		   the match again at the same point. If this fails (picked up above) we
 		   advance to the next character. */
 		g_notempty = (offsets[1] == offsets[0])? PCRE_NOTEMPTY | PCRE_ANCHORED : 0;
-
+		
 		/* Advance to the position right after the last full match */
 		start_offset = offsets[1];
 	}
@@ -1639,7 +1639,7 @@ PHPAPI void php_pcre_split_impl(pcre_cache_entry *pce, char *subject, int subjec
 		}
 	}

-
+	
 	/* Clean up */
 	efree(offsets);
 }
@@ -1660,13 +1660,13 @@ static PHP_FUNCTION(preg_quote)
 			 delim_char=0,	/* Delimiter character to be quoted */
 			 c;				/* Current character */
 	zend_bool quote_delim = 0; /* Whether to quote additional delim char */
-
+	
 	/* Get the arguments and check for errors */
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|s", &in_str, &in_str_len,
 							  &delim, &delim_len) == FAILURE) {
 		return;
 	}
-
+	
 	in_str_end = in_str + in_str_len;

 	/* Nothing to do if we got an empty string */
@@ -1678,11 +1678,11 @@ static PHP_FUNCTION(preg_quote)
 		delim_char = delim[0];
 		quote_delim = 1;
 	}
-
+	
 	/* Allocate enough memory so that even if each character
 	   is quoted, we won't run out of room */
 	out_str = safe_emalloc(4, in_str_len, 1);
-
+	
 	/* Go through the string and quote necessary characters */
 	for(p = in_str, q = out_str; p != in_str_end; p++) {
 		c = *p;
@@ -1726,7 +1726,7 @@ static PHP_FUNCTION(preg_quote)
 		}
 	}
 	*q = '\0';
-
+	
 	/* Reallocate string and return it */
 	RETVAL_STRINGL(erealloc(out_str, q - out_str + 1), q - out_str, 0);
 }
@@ -1747,12 +1747,12 @@ static PHP_FUNCTION(preg_grep)
 							  &input, &flags) == FAILURE) {
 		return;
 	}
-
+	
 	/* Compile regex or get it from cache. */
 	if ((pce = pcre_get_compiled_regex_cache(regex, regex_len TSRMLS_CC)) == NULL) {
 		RETURN_FALSE;
 	}
-
+	
 	php_pcre_grep_impl(pce, input, return_value, flags TSRMLS_CC);
 }
 /* }}} */
@@ -1770,9 +1770,9 @@ PHPAPI void  php_pcre_grep_impl(pcre_cache_entry *pce, zval *input, zval *return
 	zend_bool		 invert;			/* Whether to return non-matching
 										   entries */
 	int				 rc;
-
+	
 	invert = flags & PREG_GREP_INVERT ? 1 : 0;
-
+	
 	if (extra == NULL) {
 		extra_data.flags = PCRE_EXTRA_MATCH_LIMIT | PCRE_EXTRA_MATCH_LIMIT_RECURSION;
 		extra = &extra_data;
@@ -1788,7 +1788,7 @@ PHPAPI void  php_pcre_grep_impl(pcre_cache_entry *pce, zval *input, zval *return
 	}
 	size_offsets = (size_offsets + 1) * 3;
 	offsets = (int *)safe_emalloc(size_offsets, sizeof(int), 0);
-
+	
 	/* Initialize return array */
 	array_init(return_value);

@@ -1901,7 +1901,7 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_preg_split, 0, 0, 2)
    ZEND_ARG_INFO(0, pattern)
    ZEND_ARG_INFO(0, subject)
    ZEND_ARG_INFO(0, limit)
-    ZEND_ARG_INFO(0, flags)
+    ZEND_ARG_INFO(0, flags) 
 ZEND_END_ARG_INFO()

 ZEND_BEGIN_ARG_INFO_EX(arginfo_preg_quote, 0, 0, 1)
@@ -1,24 +0,0 @@
--TEST--
-Bug #70345 (Multiple vulnerabilities related to PCRE functions)
--FILE--
-<?php
-$regex = '/(?=xyz\K)/';
-$subject = "aaaaxyzaaaa";
-
-$v = preg_split($regex, $subject);
-print_r($v);
-
-$regex = '/(a(?=xyz\K))/';
-$subject = "aaaaxyzaaaa";
-preg_match($regex, $subject, $matches);
-
-var_dump($matches);
--EXPECTF--
-Array
-(
-    [0] => aaaaxyzaaaa
-)
-
-Warning: preg_match(): Get subpatterns list failed in %s on line %d
-array(0) {
-}
@@ -618,16 +618,13 @@ static inline void phar_set_inode(phar_entry_info *entry TSRMLS_DC) /* {{{ */
 {
 	char tmp[MAXPATHLEN];
 	int tmp_len;
-	size_t len1, len2;
+	size_t len;

 	tmp_len = MIN(MAXPATHLEN, entry->filename_len + entry->phar->fname_len);
-
-	len1 = MIN(entry->phar->fname_len, tmp_len);
-	memcpy(tmp, entry->phar->fname, len1);
-
-	len2 = MIN(tmp_len - len1, entry->filename_len);
-	memcpy(tmp + len1, entry->filename, len2);
-
+	len = MIN(entry->phar->fname_len, tmp_len);
+	memcpy(tmp, entry->phar->fname, len);
+	len = MIN(tmp_len - len, entry->filename_len);
+	memcpy(tmp + entry->phar->fname_len, entry->filename, len);
 	entry->inode = (unsigned short)zend_get_hash_value(tmp, tmp_len);
 }
 /* }}} */
@@ -4200,9 +4200,6 @@ static int phar_extract_file(zend_bool overwrite, phar_entry_info *entry, char *
 	char *fullpath;
 	const char *slash;
 	mode_t mode;
-	cwd_state new_state;
-	char *filename;
-	size_t filename_len;

 	if (entry->is_mounted) {
 		/* silently ignore mounted entries */
@@ -4212,39 +4209,8 @@ static int phar_extract_file(zend_bool overwrite, phar_entry_info *entry, char *
 	if (entry->filename_len >= sizeof(".phar")-1 && !memcmp(entry->filename, ".phar", sizeof(".phar")-1)) {
 		return SUCCESS;
 	}
-	/* strip .. from path and restrict it to be under dest directory */
-	new_state.cwd = (char*)malloc(2);
-	new_state.cwd[0] = DEFAULT_SLASH;
-	new_state.cwd[1] = '\0';
-	new_state.cwd_length = 1;
-	if (virtual_file_ex(&new_state, entry->filename, NULL, CWD_EXPAND TSRMLS_CC) != 0 ||
-			new_state.cwd_length <= 1) {
-		if (EINVAL == errno && entry->filename_len > 50) {
-			char *tmp = estrndup(entry->filename, 50);
-			spprintf(error, 4096, "Cannot extract \"%s...\" to \"%s...\", extracted filename is too long for filesystem", tmp, dest);
-			efree(tmp);
-		} else {
-			spprintf(error, 4096, "Cannot extract \"%s\", internal error", entry->filename);
-		}
-		free(new_state.cwd);
-		return FAILURE;
-	}
-	filename = new_state.cwd + 1;
-	filename_len = new_state.cwd_length - 1;
-#ifdef PHP_WIN32
-	/* unixify the path back, otherwise non zip formats might be broken */
-	{
-		int cnt = filename_len;

-		do {
-			if ('\\' == filename[cnt]) {
-				filename[cnt] = '/';
-			}
-		} while (cnt-- >= 0);
-	}
-#endif
-
-	len = spprintf(&fullpath, 0, "%s/%s", dest, filename);
+	len = spprintf(&fullpath, 0, "%s/%s", dest, entry->filename);

 	if (len >= MAXPATHLEN) {
 		char *tmp;
@@ -4258,21 +4224,18 @@ static int phar_extract_file(zend_bool overwrite, phar_entry_info *entry, char *
 			spprintf(error, 4096, "Cannot extract \"%s\" to \"%s...\", extracted filename is too long for filesystem", entry->filename, fullpath);
 		}
 		efree(fullpath);
-		free(new_state.cwd);
 		return FAILURE;
 	}

 	if (!len) {
 		spprintf(error, 4096, "Cannot extract \"%s\", internal error", entry->filename);
 		efree(fullpath);
-		free(new_state.cwd);
 		return FAILURE;
 	}

 	if (PHAR_OPENBASEDIR_CHECKPATH(fullpath)) {
 		spprintf(error, 4096, "Cannot extract \"%s\" to \"%s\", openbasedir/safe mode restrictions in effect", entry->filename, fullpath);
 		efree(fullpath);
-		free(new_state.cwd);
 		return FAILURE;
 	}

@@ -4280,15 +4243,14 @@ static int phar_extract_file(zend_bool overwrite, phar_entry_info *entry, char *
 	if (!overwrite && SUCCESS == php_stream_stat_path(fullpath, &ssb)) {
 		spprintf(error, 4096, "Cannot extract \"%s\" to \"%s\", path already exists", entry->filename, fullpath);
 		efree(fullpath);
-		free(new_state.cwd);
 		return FAILURE;
 	}

 	/* perform dirname */
-	slash = zend_memrchr(filename, '/', filename_len);
+	slash = zend_memrchr(entry->filename, '/', entry->filename_len);

 	if (slash) {
-		fullpath[dest_len + (slash - filename) + 1] = '\0';
+		fullpath[dest_len + (slash - entry->filename) + 1] = '\0';
 	} else {
 		fullpath[dest_len] = '\0';
 	}
@@ -4298,27 +4260,23 @@ static int phar_extract_file(zend_bool overwrite, phar_entry_info *entry, char *
 			if (!php_stream_mkdir(fullpath, entry->flags & PHAR_ENT_PERM_MASK,  PHP_STREAM_MKDIR_RECURSIVE, NULL)) {
 				spprintf(error, 4096, "Cannot extract \"%s\", could not create directory \"%s\"", entry->filename, fullpath);
 				efree(fullpath);
-				free(new_state.cwd);
 				return FAILURE;
 			}
 		} else {
 			if (!php_stream_mkdir(fullpath, 0777,  PHP_STREAM_MKDIR_RECURSIVE, NULL)) {
 				spprintf(error, 4096, "Cannot extract \"%s\", could not create directory \"%s\"", entry->filename, fullpath);
 				efree(fullpath);
-				free(new_state.cwd);
 				return FAILURE;
 			}
 		}
 	}

 	if (slash) {
-		fullpath[dest_len + (slash - filename) + 1] = '/';
+		fullpath[dest_len + (slash - entry->filename) + 1] = '/';
 	} else {
 		fullpath[dest_len] = '/';
 	}

-	filename = NULL;
-	free(new_state.cwd);
 	/* it is a standalone directory, job done */
 	if (entry->is_dir) {
 		efree(fullpath);
@@ -1,24 +0,0 @@
--TEST--
-Bug #70019 Files extracted from archive may be placed outside of destination directory
--SKIPIF--
-<?php if (!extension_loaded("phar") || !extension_loaded('zlib')) die("skip"); ?>
--FILE--
-<?php
-$dir = __DIR__."/bug70019";
-$phar = new PharData(__DIR__."/bug70019.zip");
-if(!is_dir($dir)) {
-  mkdir($dir);
-}
-$phar->extractTo($dir); 
-var_dump(file_exists("$dir/ThisIsATestFile.txt"));
-?>
-===DONE===
--CLEAN--
-<?php
-$dir = __DIR__."/bug70019";
-unlink("$dir/ThisIsATestFile.txt");
-rmdir($dir);
-?>
--EXPECTF--
-bool(true)
-===DONE===
@@ -210,18 +210,16 @@ static char *php_session_encode(int *newlen TSRMLS_DC) /* {{{ */
 }
 /* }}} */

-static int php_session_decode(const char *val, int vallen TSRMLS_DC) /* {{{ */
+static void php_session_decode(const char *val, int vallen TSRMLS_DC) /* {{{ */
 {
 	if (!PS(serializer)) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unknown session.serialize_handler. Failed to decode session object");
-		return FAILURE;
+		return;
 	}
 	if (PS(serializer)->decode(val, vallen TSRMLS_CC) == FAILURE) {
 		php_session_destroy(TSRMLS_C);
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Failed to decode session object. Session has been destroyed");
-		return FAILURE;
 	}
-	return SUCCESS;
 }
 /* }}} */

@@ -415,7 +413,7 @@ PHPAPI char *php_session_create_id(PS_CREATE_SID_ARGS) /* {{{ */

 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "The ini setting hash_bits_per_character is out of range (should be 4, 5, or 6) - using 4 for now");
 	}
-
+	
 	outid = emalloc((size_t)((digest_len + 2) * ((8.0f / PS(hash_bits_per_character)) + 0.5)));
 	j = (int) (bin_to_readable((char *)digest, digest_len, outid, (char)PS(hash_bits_per_character)) - outid);
 	efree(digest);
@@ -857,11 +855,8 @@ PS_SERIALIZER_DECODE_FUNC(php_binary) /* {{{ */
 			ALLOC_INIT_ZVAL(current);
 			if (php_var_unserialize(&current, (const unsigned char **) &p, (const unsigned char *) endptr, &var_hash TSRMLS_CC)) {
 				php_set_session_var(name, namelen, current, &var_hash  TSRMLS_CC);
-			} else {
-				PHP_VAR_UNSERIALIZE_DESTROY(var_hash);
-				return FAILURE;
 			}
-			var_push_dtor_no_addref(&var_hash, &current);
+			zval_ptr_dtor(&current);
 		}
 		PS_ADD_VARL(name, namelen);
 		efree(name);
@@ -952,13 +947,8 @@ PS_SERIALIZER_DECODE_FUNC(php) /* {{{ */
 			ALLOC_INIT_ZVAL(current);
 			if (php_var_unserialize(&current, (const unsigned char **) &q, (const unsigned char *) endptr, &var_hash TSRMLS_CC)) {
 				php_set_session_var(name, namelen, current, &var_hash  TSRMLS_CC);
-			} else {
-				var_push_dtor_no_addref(&var_hash, &current);
-				efree(name);
-				PHP_VAR_UNSERIALIZE_DESTROY(var_hash);
-				return FAILURE;
 			}
-			var_push_dtor_no_addref(&var_hash, &current);
+			zval_ptr_dtor(&current);
 		}
 		PS_ADD_VARL(name, namelen);
 skip:
@@ -1754,7 +1744,7 @@ static PHP_FUNCTION(session_set_save_handler)
 		}
 		efree(name);
 	}
-
+	
 	if (PS(mod) && PS(mod) != &ps_mod_user) {
 		zend_alter_ini_entry("session.save_handler", sizeof("session.save_handler"), "user", sizeof("user")-1, PHP_INI_USER, PHP_INI_STAGE_RUNTIME);
 	}
@@ -1932,7 +1922,9 @@ static PHP_FUNCTION(session_decode)
 		return;
 	}

-	RETVAL_BOOL(php_session_decode(str, str_len TSRMLS_CC) == SUCCESS);
+	php_session_decode(str, str_len TSRMLS_CC);
+
+	RETURN_TRUE;
 }
 /* }}} */

@@ -2524,12 +2516,12 @@ static int php_session_rfc1867_callback(unsigned int event, void *event_data, vo
 		case MULTIPART_EVENT_FILE_START: {
 			multipart_event_file_start *data = (multipart_event_file_start *) event_data;

-			/* Do nothing when $_POST["PHP_SESSION_UPLOAD_PROGRESS"] is not set
+			/* Do nothing when $_POST["PHP_SESSION_UPLOAD_PROGRESS"] is not set 
 			 * or when we have no session id */
 			if (!Z_TYPE(progress->sid) || !progress->key.c) {
 				break;
 			}
-
+			
 			/* First FILE_START event, initializing data */
 			if (!progress->data) {

@@ -2579,7 +2571,7 @@ static int php_session_rfc1867_callback(unsigned int event, void *event_data, vo
 			add_assoc_zval_ex(progress->current_file, "bytes_processed", sizeof("bytes_processed"), progress->current_file_bytes_processed);

 			add_next_index_zval(progress->files, progress->current_file);
-
+			
 			Z_LVAL_P(progress->post_bytes_processed) = data->post_bytes_processed;

 			php_session_rfc1867_update(progress, 0 TSRMLS_CC);
@@ -2591,7 +2583,7 @@ static int php_session_rfc1867_callback(unsigned int event, void *event_data, vo
 			if (!Z_TYPE(progress->sid) || !progress->key.c) {
 				break;
 			}
-
+			
 			Z_LVAL_P(progress->current_file_bytes_processed) = data->offset + data->length;
 			Z_LVAL_P(progress->post_bytes_processed) = data->post_bytes_processed;

@@ -2604,7 +2596,7 @@ static int php_session_rfc1867_callback(unsigned int event, void *event_data, vo
 			if (!Z_TYPE(progress->sid) || !progress->key.c) {
 				break;
 			}
-
+			
 			if (data->temp_filename) {
 				add_assoc_string_ex(progress->current_file, "tmp_name",  sizeof("tmp_name"), data->temp_filename, 1);
 			}
@@ -53,247 +53,563 @@ array(0) {
 }

 -- Iteration 4 --
-
-Warning: session_decode(): Failed to decode session object. Session has been destroyed in %s/session_decode_error2.php on line %d
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  NULL
 }

 -- Iteration 5 --
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  NULL
 }

 -- Iteration 6 --
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  NULL
 }

 -- Iteration 7 --
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  NULL
 }

 -- Iteration 8 --
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  NULL
 }

 -- Iteration 9 --
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  NULL
 }

 -- Iteration 10 --
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  NULL
 }

 -- Iteration 11 --
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  NULL
 }

 -- Iteration 12 --
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  NULL
 }

 -- Iteration 13 --
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  NULL
 }

 -- Iteration 14 --
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  NULL
 }

 -- Iteration 15 --
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  NULL
 }

 -- Iteration 16 --
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  NULL
 }

 -- Iteration 17 --
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  NULL
 }

 -- Iteration 18 --
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  NULL
 }

 -- Iteration 19 --
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  NULL
 }

 -- Iteration 20 --
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  NULL
 }

 -- Iteration 21 --
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  NULL
 }

 -- Iteration 22 --
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  NULL
 }

 -- Iteration 23 --
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  NULL
 }

 -- Iteration 24 --
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  NULL
 }

 -- Iteration 25 --
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  NULL
 }

 -- Iteration 26 --
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  NULL
 }

 -- Iteration 27 --
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  NULL
 }

 -- Iteration 28 --
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  NULL
 }

 -- Iteration 29 --
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  NULL
 }

 -- Iteration 30 --
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  NULL
 }

 -- Iteration 31 --
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  NULL
 }

 -- Iteration 32 --
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  NULL
 }

 -- Iteration 33 --
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  NULL
 }

 -- Iteration 34 --
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  array(3) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(2)
+    [2]=>
+    int(3)
+  }
 }

 -- Iteration 35 --
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  array(3) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(2)
+    [2]=>
+    int(3)
+  }
 }

 -- Iteration 36 --
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  array(3) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(2)
+    [2]=>
+    int(3)
+  }
 }

 -- Iteration 37 --
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  array(3) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(2)
+    [2]=>
+    int(3)
+  }
 }

 -- Iteration 38 --
-bool(false)
-array(0) {
+bool(true)
+array(1) {
+  ["foo"]=>
+  array(3) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(2)
+    [2]=>
+    int(3)
+  }
 }

 -- Iteration 39 --
-bool(false)
-array(0) {
+bool(true)
+array(2) {
+  ["foo"]=>
+  array(3) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(2)
+    [2]=>
+    int(3)
+  }
+  ["guff"]=>
+  NULL
 }

 -- Iteration 40 --
-bool(false)
-array(0) {
+bool(true)
+array(2) {
+  ["foo"]=>
+  array(3) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(2)
+    [2]=>
+    int(3)
+  }
+  ["guff"]=>
+  NULL
 }

 -- Iteration 41 --
-bool(false)
-array(0) {
+bool(true)
+array(2) {
+  ["foo"]=>
+  array(3) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(2)
+    [2]=>
+    int(3)
+  }
+  ["guff"]=>
+  NULL
 }

 -- Iteration 42 --
-bool(false)
-array(0) {
+bool(true)
+array(2) {
+  ["foo"]=>
+  array(3) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(2)
+    [2]=>
+    int(3)
+  }
+  ["guff"]=>
+  NULL
 }

 -- Iteration 43 --
-bool(false)
-array(0) {
+bool(true)
+array(2) {
+  ["foo"]=>
+  &array(3) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(2)
+    [2]=>
+    int(3)
+  }
+  ["guff"]=>
+  &array(3) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(2)
+    [2]=>
+    int(3)
+  }
 }

 -- Iteration 44 --
-bool(false)
-array(0) {
+bool(true)
+array(2) {
+  ["foo"]=>
+  &array(3) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(2)
+    [2]=>
+    int(3)
+  }
+  ["guff"]=>
+  &array(3) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(2)
+    [2]=>
+    int(3)
+  }
 }

 -- Iteration 45 --
-bool(false)
-array(0) {
+bool(true)
+array(2) {
+  ["foo"]=>
+  &array(3) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(2)
+    [2]=>
+    int(3)
+  }
+  ["guff"]=>
+  &array(3) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(2)
+    [2]=>
+    int(3)
+  }
 }

 -- Iteration 46 --
-bool(false)
-array(0) {
+bool(true)
+array(2) {
+  ["foo"]=>
+  &array(3) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(2)
+    [2]=>
+    int(3)
+  }
+  ["guff"]=>
+  &array(3) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(2)
+    [2]=>
+    int(3)
+  }
 }

 -- Iteration 47 --
-bool(false)
-array(0) {
+bool(true)
+array(2) {
+  ["foo"]=>
+  &array(3) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(2)
+    [2]=>
+    int(3)
+  }
+  ["guff"]=>
+  &array(3) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(2)
+    [2]=>
+    int(3)
+  }
 }

 -- Iteration 48 --
-bool(false)
-array(0) {
+bool(true)
+array(3) {
+  ["foo"]=>
+  &array(3) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(2)
+    [2]=>
+    int(3)
+  }
+  ["guff"]=>
+  &array(3) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(2)
+    [2]=>
+    int(3)
+  }
+  ["blah"]=>
+  NULL
 }

 -- Iteration 49 --
-bool(false)
-array(0) {
+bool(true)
+array(3) {
+  ["foo"]=>
+  &array(3) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(2)
+    [2]=>
+    int(3)
+  }
+  ["guff"]=>
+  &array(3) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(2)
+    [2]=>
+    int(3)
+  }
+  ["blah"]=>
+  NULL
 }

 -- Iteration 50 --
-bool(false)
-array(0) {
+bool(true)
+array(3) {
+  ["foo"]=>
+  &array(3) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(2)
+    [2]=>
+    int(3)
+  }
+  ["guff"]=>
+  &array(3) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(2)
+    [2]=>
+    int(3)
+  }
+  ["blah"]=>
+  NULL
 }

 -- Iteration 51 --
-bool(false)
-array(0) {
+bool(true)
+array(3) {
+  ["foo"]=>
+  &array(3) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(2)
+    [2]=>
+    int(3)
+  }
+  ["guff"]=>
+  &array(3) {
+    [0]=>
+    int(1)
+    [1]=>
+    int(2)
+    [2]=>
+    int(3)
+  }
+  ["blah"]=>
+  NULL
 }
-
-Warning: session_destroy(): Trying to destroy uninitialized session in %s/session_decode_error2.php on line %d
-bool(false)
+bool(true)
 Done
+
@@ -49,7 +49,7 @@ array(3) {
 }

 Warning: session_decode(): Unknown session.serialize_handler. Failed to decode session object in %s on line %d
-bool(false)
+bool(true)
 array(3) {
  ["foo"]=>
  int(1234567890)
@@ -313,7 +313,7 @@ int make_http_soap_request(zval  *this_ptr,
 		int kind  = Z_LVAL_PP(tmp) & SOAP_COMPRESSION_DEFLATE;

 		if (level > 9) {level = 9;}
-
+		
 	  if ((Z_LVAL_PP(tmp) & SOAP_COMPRESSION_ACCEPT) != 0) {
 			smart_str_append_const(&soap_headers_z,"Accept-Encoding: gzip, deflate\r\n");
 	  }
@@ -372,7 +372,7 @@ int make_http_soap_request(zval  *this_ptr,
 		context = php_stream_context_from_zval(*tmp, 0);
 	}

-	if (context &&
+	if (context && 
 		php_stream_context_get_option(context, "http", "max_redirects", &tmp) == SUCCESS) {
 		if (Z_TYPE_PP(tmp) != IS_STRING || !is_numeric_string(Z_STRVAL_PP(tmp), Z_STRLEN_PP(tmp), &redirect_max, NULL, 1)) {
 			if (Z_TYPE_PP(tmp) == IS_LONG)
@@ -470,7 +470,7 @@ try_again:
 		add_property_resource(this_ptr, "httpurl", ret);
 		/*zend_list_addref(ret);*/

-		if (context &&
+		if (context && 
 		    php_stream_context_get_option(context, "http", "protocol_version", &tmp) == SUCCESS &&
 		    Z_TYPE_PP(tmp) == IS_DOUBLE &&
 		    Z_DVAL_PP(tmp) == 1.0) {
@@ -528,7 +528,7 @@ try_again:
 				smart_str_appendl(&soap_headers, Z_STRVAL_PP(tmp), Z_STRLEN_PP(tmp));
 				smart_str_append_const(&soap_headers, "\r\n");
 			}
-		} else if (context &&
+		} else if (context && 
 		           php_stream_context_get_option(context, "http", "user_agent", &tmp) == SUCCESS &&
 		           Z_TYPE_PP(tmp) == IS_STRING) {
 			if (Z_STRLEN_PP(tmp) > 0) {
@@ -670,7 +670,7 @@ try_again:
 					PHP_MD5Update(&md5ctx, (unsigned char*)HA2, 32);
 					PHP_MD5Final(hash, &md5ctx);
 					make_digest(response, hash);
-
+	
 					smart_str_append_const(&soap_headers, "Authorization: Digest username=\"");
 					smart_str_appendl(&soap_headers, Z_STRVAL_PP(login), Z_STRLEN_PP(login));
 					if (zend_hash_find(Z_ARRVAL_PP(digest), "realm", sizeof("realm"), (void **)&tmp) == SUCCESS &&
@@ -688,7 +688,7 @@ try_again:
 						smart_str_appends(&soap_headers, phpurl->path);
 					} else {
 						smart_str_appendc(&soap_headers, '/');
-					}
+					} 
 					if (phpurl->query) {
 						smart_str_appendc(&soap_headers, '?');
 						smart_str_appends(&soap_headers, phpurl->query);
@@ -759,21 +759,18 @@ try_again:
 				zend_hash_internal_pointer_reset(Z_ARRVAL_PP(cookies));
 				smart_str_append_const(&soap_headers, "Cookie: ");
 				for (i = 0; i < n; i++) {
-					ulong numindx;
-					int res = zend_hash_get_current_key(Z_ARRVAL_PP(cookies), &key, &numindx, FALSE);
 					zend_hash_get_current_data(Z_ARRVAL_PP(cookies), (void **)&data);
+					zend_hash_get_current_key(Z_ARRVAL_PP(cookies), &key, NULL, FALSE);

-					if (res == HASH_KEY_IS_STRING && Z_TYPE_PP(data) == IS_ARRAY) {
+					if (Z_TYPE_PP(data) == IS_ARRAY) {
 					  zval** value;

 						if (zend_hash_index_find(Z_ARRVAL_PP(data), 0, (void**)&value) == SUCCESS &&
 						    Z_TYPE_PP(value) == IS_STRING) {
 						  zval **tmp;
 						  if ((zend_hash_index_find(Z_ARRVAL_PP(data), 1, (void**)&tmp) == FAILURE ||
-					           Z_TYPE_PP(tmp) != IS_STRING ||
 						       strncmp(phpurl->path?phpurl->path:"/",Z_STRVAL_PP(tmp),Z_STRLEN_PP(tmp)) == 0) &&
 						      (zend_hash_index_find(Z_ARRVAL_PP(data), 2, (void**)&tmp) == FAILURE ||
-						       Z_TYPE_PP(tmp) != IS_STRING ||
 						       in_domain(phpurl->host,Z_STRVAL_PP(tmp))) &&
 						      (use_ssl || zend_hash_index_find(Z_ARRVAL_PP(data), 3, (void**)&tmp) == FAILURE)) {
 								smart_str_appendl(&soap_headers, key, strlen(key));
@@ -1000,7 +997,7 @@ try_again:
 				efree(connection);
 			}
 		}
-	}
+	}	

 	if (!get_http_body(stream, http_close, http_headers, &http_body, &http_body_size TSRMLS_CC)) {
 		if (request != buf) {efree(request);}
@@ -1051,7 +1048,7 @@ try_again:
 								strcat(s, new_url->path);
 								efree(new_url->path);
 								new_url->path = s;
-							}
+							} 
 						} else {
 							char *s = emalloc(strlen(new_url->path) + 2);
 							s[0] = '/'; s[1] = 0;
@@ -989,7 +989,7 @@ static HashTable* soap_create_typemap(sdlPtr sdl, HashTable *ht TSRMLS_DC)
 	HashTable *ht2;
 	HashPosition pos1, pos2;
 	HashTable *typemap = NULL;
-
+	
 	zend_hash_internal_pointer_reset_ex(ht, &pos1);
 	while (zend_hash_get_current_data_ex(ht, (void**)&tmp, &pos1) == SUCCESS) {
 		char *type_name = NULL;
@@ -1033,7 +1033,7 @@ static HashTable* soap_create_typemap(sdlPtr sdl, HashTable *ht TSRMLS_DC)
 				}
 			}
 			zend_hash_move_forward_ex(ht2, &pos2);
-		}
+		}		

 		if (type_name) {
 			smart_str nscat = {0};
@@ -1063,7 +1063,7 @@ static HashTable* soap_create_typemap(sdlPtr sdl, HashTable *ht TSRMLS_DC)
 			new_enc->to_xml = enc->to_xml;
 			new_enc->to_zval = enc->to_zval;
 			new_enc->details.map = emalloc(sizeof(soapMapping));
-			memset(new_enc->details.map, 0, sizeof(soapMapping));
+			memset(new_enc->details.map, 0, sizeof(soapMapping));			
 			if (to_xml) {
 				zval_add_ref(&to_xml);
 				new_enc->details.map->to_xml = to_xml;
@@ -1120,7 +1120,7 @@ PHP_METHOD(SoapServer, SoapServer)
 	if (Z_TYPE_P(wsdl) != IS_STRING && Z_TYPE_P(wsdl) != IS_NULL) {
 		php_error_docref(NULL TSRMLS_CC, E_ERROR, "Invalid parameters");
 	}
-
+	
 	service = emalloc(sizeof(soapService));
 	memset(service, 0, sizeof(soapService));
 	service->send_errors = 1;
@@ -1155,7 +1155,7 @@ PHP_METHOD(SoapServer, SoapServer)
 		if (zend_hash_find(ht, "encoding", sizeof("encoding"), (void**)&tmp) == SUCCESS &&
 		    Z_TYPE_PP(tmp) == IS_STRING) {
 			xmlCharEncodingHandlerPtr encoding;
-
+		
 			encoding = xmlFindCharEncodingHandler(Z_STRVAL_PP(tmp));
 			if (encoding == NULL) {
 				php_error_docref(NULL TSRMLS_CC, E_ERROR, "Invalid 'encoding' option - '%s'", Z_STRVAL_PP(tmp));
@@ -1215,7 +1215,7 @@ PHP_METHOD(SoapServer, SoapServer)
 			}
 		}
 	}
-
+	
 	if (typemap_ht) {
 		service->typemap = soap_create_typemap(service->sdl, typemap_ht TSRMLS_CC);
 	}
@@ -1345,7 +1345,7 @@ PHP_METHOD(SoapServer, getFunctions)
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
-
+	
 	FETCH_THIS_SERVICE(service);

 	array_init(return_value);
@@ -1505,7 +1505,7 @@ PHP_METHOD(SoapServer, handle)

 	FETCH_THIS_SERVICE(service);
 	SOAP_GLOBAL(soap_version) = service->version;
-
+	
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|s", &arg, &arg_len) == FAILURE) {
 		return;
 	}
@@ -1930,7 +1930,7 @@ PHP_METHOD(SoapServer, handle)

 		if (size == 0) {
 			php_error_docref(NULL TSRMLS_CC, E_ERROR, "Dump memory failed");
-		}
+		} 	

 		if (soap_version == SOAP_1_2) {
 			sapi_add_header("Content-Type: application/soap+xml; charset=utf-8", sizeof("Content-Type: application/soap+xml; charset=utf-8")-1, 1);
@@ -2147,10 +2147,10 @@ static void soap_error_handler(int error_num, const char *error_filename, const
 		     use_exceptions = 1;
 		}

-		if ((error_num == E_USER_ERROR ||
-		     error_num == E_COMPILE_ERROR ||
+		if ((error_num == E_USER_ERROR || 
+		     error_num == E_COMPILE_ERROR || 
 		     error_num == E_CORE_ERROR ||
-		     error_num == E_ERROR ||
+		     error_num == E_ERROR || 
 		     error_num == E_PARSE) &&
 		    use_exceptions) {
 			zval *fault, *exception;
@@ -2219,10 +2219,10 @@ static void soap_error_handler(int error_num, const char *error_filename, const
 		va_list argcopy;
 #endif

-		if (error_num == E_USER_ERROR ||
-		    error_num == E_COMPILE_ERROR ||
+		if (error_num == E_USER_ERROR || 
+		    error_num == E_COMPILE_ERROR || 
 		    error_num == E_CORE_ERROR ||
-		    error_num == E_ERROR ||
+		    error_num == E_ERROR || 
 		    error_num == E_PARSE) {

 			char* code = SOAP_GLOBAL(error_code);
@@ -2452,13 +2452,13 @@ PHP_METHOD(SoapClient, SoapClient)
 		if (zend_hash_find(ht, "encoding", sizeof("encoding"), (void**)&tmp) == SUCCESS &&
 		    Z_TYPE_PP(tmp) == IS_STRING) {
 			xmlCharEncodingHandlerPtr encoding;
-
+		
 			encoding = xmlFindCharEncodingHandler(Z_STRVAL_PP(tmp));
 			if (encoding == NULL) {
 				php_error_docref(NULL TSRMLS_CC, E_ERROR, "Invalid 'encoding' option - '%s'", Z_STRVAL_PP(tmp));
 			} else {
 				xmlCharEncCloseFunc(encoding);
-				add_property_stringl(this_ptr, "_encoding", Z_STRVAL_PP(tmp), Z_STRLEN_PP(tmp), 1);
+				add_property_stringl(this_ptr, "_encoding", Z_STRVAL_PP(tmp), Z_STRLEN_PP(tmp), 1);			
 			}
 		}
 		if (zend_hash_find(ht, "classmap", sizeof("classmap"), (void**)&tmp) == SUCCESS &&
@@ -2493,7 +2493,7 @@ PHP_METHOD(SoapClient, SoapClient)
 		if (context) {
 			add_property_resource(this_ptr, "_stream_context", context->rsrc_id);
 		}
-
+	
 		if (zend_hash_find(ht, "cache_wsdl", sizeof("cache_wsdl"), (void**)&tmp) == SUCCESS &&
 		    Z_TYPE_PP(tmp) == IS_LONG) {
 			cache_wsdl = Z_LVAL_PP(tmp);
@@ -2503,7 +2503,7 @@ PHP_METHOD(SoapClient, SoapClient)
 		    Z_TYPE_PP(tmp) == IS_STRING) {
 			add_property_stringl(this_ptr, "_user_agent", Z_STRVAL_PP(tmp), Z_STRLEN_PP(tmp), 1);
 		}
-
+		
 		if (zend_hash_find(ht, "keep_alive", sizeof("keep_alive"), (void**)&tmp) == SUCCESS &&
 				(Z_TYPE_PP(tmp) == IS_BOOL || Z_TYPE_PP(tmp) == IS_LONG) && Z_LVAL_PP(tmp) == 0) {
 			add_property_long(this_ptr, "_keep_alive", 0);
@@ -2606,7 +2606,7 @@ static int do_request(zval *this_ptr, xmlDoc *request, char *location, char *act
 	xmlFree(buf);
 	if (ret && zend_hash_find(Z_OBJPROP_P(this_ptr), "__soap_fault", sizeof("__soap_fault"), (void **) &fault) == SUCCESS) {
 	  return FALSE;
-	}
+	}	  
  return ret;
 }

@@ -2903,10 +2903,8 @@ PHP_METHOD(SoapClient, __call)
 			}
 			zend_hash_internal_pointer_reset(default_headers);
 			while (zend_hash_get_current_data(default_headers, (void**)&tmp) == SUCCESS) {
-				if(Z_TYPE_PP(tmp) == IS_OBJECT) {
-					Z_ADDREF_PP(tmp);
-					zend_hash_next_index_insert(soap_headers, tmp, sizeof(zval *), NULL);
-				}
+				Z_ADDREF_PP(tmp);
+				zend_hash_next_index_insert(soap_headers, tmp, sizeof(zval *), NULL);
 				zend_hash_move_forward(default_headers);
 			}
 		} else {
@@ -2914,7 +2912,7 @@ PHP_METHOD(SoapClient, __call)
 			free_soap_headers = 0;
 		}
 	}
-
+	
 	arg_count = zend_hash_num_elements(Z_ARRVAL_P(args));

 	if (arg_count > 0) {
@@ -2980,7 +2978,7 @@ PHP_METHOD(SoapClient, __getTypes)
 	HashPosition pos;

 	FETCH_THIS_SDL(sdl);
-
+	
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
@@ -3009,7 +3007,7 @@ PHP_METHOD(SoapClient, __getTypes)
 PHP_METHOD(SoapClient, __getLastRequest)
 {
 	zval **tmp;
-
+	
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
@@ -3032,7 +3030,7 @@ PHP_METHOD(SoapClient, __getLastResponse)
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
-
+	
 	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__last_response", sizeof("__last_response"), (void **)&tmp) == SUCCESS &&
 	    Z_TYPE_PP(tmp) == IS_STRING) {
 		RETURN_STRINGL(Z_STRVAL_PP(tmp), Z_STRLEN_PP(tmp), 1);
@@ -3047,11 +3045,11 @@ PHP_METHOD(SoapClient, __getLastResponse)
 PHP_METHOD(SoapClient, __getLastRequestHeaders)
 {
 	zval **tmp;
-
+	
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
-
+	
 	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__last_request_headers", sizeof("__last_request_headers"), (void **)&tmp) == SUCCESS &&
 	    Z_TYPE_PP(tmp) == IS_STRING) {
 		RETURN_STRINGL(Z_STRVAL_PP(tmp), Z_STRLEN_PP(tmp), 1);
@@ -3066,7 +3064,7 @@ PHP_METHOD(SoapClient, __getLastRequestHeaders)
 PHP_METHOD(SoapClient, __getLastResponseHeaders)
 {
 	zval **tmp;
-
+	
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
@@ -3211,10 +3209,10 @@ PHP_METHOD(SoapClient, __setSoapHeaders)


 /* {{{ proto string SoapClient::__setLocation([string new_location])
-   Sets the location option (the endpoint URL that will be touched by the
+   Sets the location option (the endpoint URL that will be touched by the 
   following SOAP requests).
   If new_location is not specified or null then SoapClient will use endpoint
-   from WSDL file.
+   from WSDL file. 
   The function returns old value of location options. */
 PHP_METHOD(SoapClient, __setLocation)
 {
@@ -3263,10 +3261,10 @@ static void set_soap_fault(zval *obj, char *fault_code_ns, char *fault_code, cha
 	if (Z_TYPE_P(obj) != IS_OBJECT) {
 		object_init_ex(obj, soap_fault_class_entry);
 	}
-
+	
 	add_property_string(obj, "faultstring", fault_string ? fault_string : "", 1);
 	zend_update_property_string(zend_exception_get_default(TSRMLS_C), obj, "message", sizeof("message")-1, (fault_string ? fault_string : "") TSRMLS_CC);
-
+	
 	if (fault_code != NULL) {
 		int soap_version = SOAP_GLOBAL(soap_version);

@@ -3691,7 +3689,7 @@ ignore_header:
 		func = func->children;
 	}
 	deserialize_parameters(func, function, num_params, parameters TSRMLS_CC);
-
+	
 	encode_finish();

 	return function;
@@ -3973,8 +3971,8 @@ static xmlDocPtr serialize_response_call(sdlFunctionPtr function, char *function
 		}

 		if (fault_ns == NULL &&
-		    fault &&
-		    fault->details &&
+		    fault && 
+		    fault->details && 
 		    zend_hash_num_elements(fault->details) == 1) {
 			sdlParamPtr sparam;

@@ -3998,7 +3996,7 @@ static xmlDocPtr serialize_response_call(sdlFunctionPtr function, char *function
 					xmlChar *code = xmlBuildQName(BAD_CAST(str), nsptr->prefix, NULL, 0);
 					xmlNodeSetContent(node, code);
 					xmlFree(code);
-				} else {
+				} else {	
 					xmlNodeSetContentLen(node, BAD_CAST(str), (int)new_len);
 				}
 				efree(str);
@@ -4024,7 +4022,7 @@ static xmlDocPtr serialize_response_call(sdlFunctionPtr function, char *function
 					xmlChar *code = xmlBuildQName(BAD_CAST(str), nsptr->prefix, NULL, 0);
 					xmlNodeSetContent(node, code);
 					xmlFree(code);
-				} else {
+				} else {	
 					xmlNodeSetContentLen(node, BAD_CAST(str), (int)new_len);
 				}
 				efree(str);
@@ -4196,7 +4194,7 @@ static xmlDocPtr serialize_response_call(sdlFunctionPtr function, char *function

 	encode_finish();

-	if (function && function->responseName == NULL &&
+	if (function && function->responseName == NULL && 
 	    body->children == NULL && head == NULL) {
 		xmlFreeDoc(doc);
 		return NULL;
@@ -4330,18 +4328,11 @@ static xmlDocPtr serialize_function_call(zval *this_ptr, sdlFunctionPtr function
 	if (head) {
 		zval** header;

-		for(zend_hash_internal_pointer_reset(soap_headers);
-				zend_hash_get_current_data(soap_headers,(void**)&header) == SUCCESS;
-				zend_hash_move_forward(soap_headers)
-			) {
-			HashTable *ht;
+		zend_hash_internal_pointer_reset(soap_headers);
+		while (zend_hash_get_current_data(soap_headers,(void**)&header) == SUCCESS) {
+			HashTable *ht = Z_OBJPROP_PP(header);
 			zval **name, **ns, **tmp;

-			if (Z_TYPE_PP(header) != IS_OBJECT) {
-				continue;
-			}
-
-			ht = Z_OBJPROP_PP(header);
 			if (zend_hash_find(ht, "name", sizeof("name"), (void**)&name) == SUCCESS &&
 			    Z_TYPE_PP(name) == IS_STRING &&
 			    zend_hash_find(ht, "namespace", sizeof("namespace"), (void**)&ns) == SUCCESS &&
@@ -4380,6 +4371,7 @@ static xmlDocPtr serialize_function_call(zval *this_ptr, sdlFunctionPtr function
 				xmlSetNs(h, nsptr);
 				set_soap_header_attributes(h, ht, version);
 			}
+			zend_hash_move_forward(soap_headers);
 		}
 	}

@@ -4490,7 +4482,7 @@ static sdlParamPtr get_param(sdlFunctionPtr function, char *param_name, int inde
 			return *tmp;
 		} else {
 			HashPosition pos;
-
+		
 			zend_hash_internal_pointer_reset_ex(ht, &pos);
 			while (zend_hash_get_current_data_ex(ht, (void **)&tmp, &pos) != FAILURE) {
 				if ((*tmp)->paramName && strcmp(param_name, (*tmp)->paramName) == 0) {
@@ -1,17 +0,0 @@
--TEST--
-Bug #70388 (SOAP serialize_function_call() type confusion / RCE)
--SKIPIF--
-<?php require_once('skipif.inc'); ?>
--FILE--
-<?php
-$dummy = unserialize('O:10:"SoapClient":3:{s:3:"uri";s:1:"X";s:8:"location";s:22:"http://localhost/a.xml";s:17:"__default_headers";a:1:{i:1;s:1337:"'.str_repeat("X", 1337).'";}}');
-try {
-	var_dump($dummy->notexisting());
-} catch(Exception $e) {
-	var_dump($e->getMessage());
-	var_dump(get_class($e));
-}
-?>
--EXPECTF--
-string(%d) "%s"
-string(9) "SoapFault"
@@ -309,7 +309,7 @@ static zval **spl_array_get_dimension_ptr_ptr(int check_inherited, zval *object,
 	if (!offset) {
 		return &EG(uninitialized_zval_ptr);
 	}
-
+	
 	if ((type == BP_VAR_W || type == BP_VAR_RW) && (ht->nApplyCount > 0)) {
 		zend_error(E_WARNING, "Modification of ArrayObject during sorting is prohibited");
 		return &EG(error_zval_ptr);;
@@ -341,8 +341,8 @@ static zval **spl_array_get_dimension_ptr_ptr(int check_inherited, zval *object,
 	case IS_RESOURCE:
 		zend_error(E_STRICT, "Resource ID#%ld used as offset, casting to integer (%ld)", Z_LVAL_P(offset), Z_LVAL_P(offset));
 	case IS_DOUBLE:
-	case IS_BOOL:
-	case IS_LONG:
+	case IS_BOOL: 
+	case IS_LONG: 
 		if (offset->type == IS_DOUBLE) {
 			index = (long)Z_DVAL_P(offset);
 		} else {
@@ -386,7 +386,7 @@ static zval *spl_array_read_dimension_ex(int check_inherited, zval *object, zval
 			} else {
 				SEPARATE_ARG_IF_REF(offset);
 			}
-			zend_call_method_with_1_params(&object, Z_OBJCE_P(object), &intern->fptr_offset_get, "offsetGet", &rv, offset);
+			zend_call_method_with_1_params(&object, Z_OBJCE_P(object), &intern->fptr_offset_get, "offsetGet", &rv, offset);	
 			zval_ptr_dtor(&offset);
 			if (rv) {
 				zval_ptr_dtor(&intern->retval);
@@ -444,7 +444,7 @@ static void spl_array_write_dimension_ex(int check_inherited, zval *object, zval
 		zval_ptr_dtor(&offset);
 		return;
 	}
-
+	
 	if (!offset) {
 		ht = spl_array_get_hash_table(intern, 0 TSRMLS_CC);
 		if (ht->nApplyCount > 0) {
@@ -467,8 +467,8 @@ static void spl_array_write_dimension_ex(int check_inherited, zval *object, zval
 		return;
 	case IS_DOUBLE:
 	case IS_RESOURCE:
-	case IS_BOOL:
-	case IS_LONG:
+	case IS_BOOL: 
+	case IS_LONG: 
 		ht = spl_array_get_hash_table(intern, 0 TSRMLS_CC);
 		if (ht->nApplyCount > 0) {
 			zend_error(E_WARNING, "Modification of ArrayObject during sorting is prohibited");
@@ -556,13 +556,13 @@ static void spl_array_unset_dimension_ex(int check_inherited, zval *object, zval
 					    obj->std.properties_table[property_info->offset] = NULL;
 					}
 				}
-			}
+			}			
 		}
 		break;
 	case IS_DOUBLE:
 	case IS_RESOURCE:
-	case IS_BOOL:
-	case IS_LONG:
+	case IS_BOOL: 
+	case IS_LONG: 
 		if (offset->type == IS_DOUBLE) {
 			index = (long)Z_DVAL_P(offset);
 		} else {
@@ -608,7 +608,7 @@ static int spl_array_has_dimension_ex(int check_inherited, zval *object, zval *o
 		}
 		return 0;
 	}
-
+	
 	switch(Z_TYPE_P(offset)) {
 		case IS_STRING:
 			{
@@ -627,9 +627,9 @@ static int spl_array_has_dimension_ex(int check_inherited, zval *object, zval *o
 			return 0;
 		case IS_DOUBLE:
 		case IS_RESOURCE:
-		case IS_BOOL:
+		case IS_BOOL: 
 		case IS_LONG:
-			{
+			{	
 				HashTable *ht = spl_array_get_hash_table(intern, 0 TSRMLS_CC);
 				if (offset->type == IS_DOUBLE) {
 					index = (long)Z_DVAL_P(offset);
@@ -727,7 +727,7 @@ void spl_array_iterator_append(zval *object, zval *append_value TSRMLS_DC) /* {{
 		php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Array was modified outside object and is no longer an array");
 		return;
 	}
-
+	
 	if (Z_TYPE_P(intern->array) == IS_OBJECT) {
 		php_error_docref(NULL TSRMLS_CC, E_RECOVERABLE_ERROR, "Cannot append properties to objects, use %s::offsetSet() instead", Z_OBJCE_P(object)->name);
 		return;
@@ -771,7 +771,7 @@ SPL_METHOD(Array, getArrayCopy)
 {
 	zval *object = getThis(), *tmp;
 	spl_array_object *intern = (spl_array_object*)zend_object_store_get_object(object TSRMLS_CC);
-
+    
    array_init(return_value);
 	zend_hash_copy(HASH_OF(return_value), spl_array_get_hash_table(intern, 0 TSRMLS_CC), (copy_ctor_func_t) zval_add_ref, &tmp, sizeof(zval*));
 } /* }}} */
@@ -990,7 +990,7 @@ static void spl_array_it_dtor(zend_object_iterator *iter TSRMLS_DC) /* {{{ */
 	efree(iterator);
 }
 /* }}} */
-
+	
 static int spl_array_it_valid(zend_object_iterator *iter TSRMLS_DC) /* {{{ */
 {
 	spl_array_it       *iterator = (spl_array_it *)iter;
@@ -1037,7 +1037,7 @@ static int spl_array_it_get_current_key(zend_object_iterator *iter, char **str_k
 		if (spl_array_object_verify_pos_ex(object, aht, "ArrayIterator::current(): " TSRMLS_CC) == FAILURE) {
 			return HASH_KEY_NON_EXISTANT;
 		}
-
+	
 		return zend_hash_get_current_key_ex(aht, str_key, str_key_len, int_key, 1, &object->pos);
 	}
 }
@@ -1057,7 +1057,7 @@ static void spl_array_it_move_forward(zend_object_iterator *iter TSRMLS_DC) /* {
 			php_error_docref(NULL TSRMLS_CC, E_NOTICE, "ArrayIterator::current(): Array was modified outside object and is no longer an array");
 			return;
 		}
-
+	
 		if ((object->ar_flags & SPL_ARRAY_IS_REF) && spl_hash_verify_pos_ex(object, aht TSRMLS_CC) == FAILURE) {
 			php_error_docref(NULL TSRMLS_CC, E_NOTICE, "ArrayIterator::next(): Array was modified outside object and internal position is no longer valid");
 		} else {
@@ -1115,7 +1115,7 @@ static void spl_array_set_array(zval *object, spl_array_object *intern, zval **a
 		if (just_array)	{
 			spl_array_object *other = (spl_array_object*)zend_object_store_get_object(*array TSRMLS_CC);
 			ar_flags = other->ar_flags & ~SPL_ARRAY_INT_MASK;
-		}
+		}		
 		ar_flags |= SPL_ARRAY_USE_OTHER;
 		intern->array = *array;
 	} else {
@@ -1173,7 +1173,7 @@ zend_object_iterator *spl_array_get_iterator(zend_class_entry *ce, zval *object,
 	iterator->intern.ce = ce;
 	iterator->intern.value = NULL;
 	iterator->object = array_object;
-
+	
 	return (zend_object_iterator*)iterator;
 }
 /* }}} */
@@ -1238,7 +1238,7 @@ SPL_METHOD(Array, getIteratorClass)
 {
 	zval *object = getThis();
 	spl_array_object *intern = (spl_array_object*)zend_object_store_get_object(object TSRMLS_CC);
-
+	
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
@@ -1253,11 +1253,11 @@ SPL_METHOD(Array, getFlags)
 {
 	zval *object = getThis();
 	spl_array_object *intern = (spl_array_object*)zend_object_store_get_object(object TSRMLS_CC);
-
+	
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
-
+	
 	RETURN_LONG(intern->ar_flags & ~SPL_ARRAY_INT_MASK);
 }
 /* }}} */
@@ -1273,7 +1273,7 @@ SPL_METHOD(Array, setFlags)
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "l", &ar_flags) == FAILURE) {
 		return;
 	}
-
+	
 	intern->ar_flags = (intern->ar_flags & SPL_ARRAY_INT_MASK) | (ar_flags & ~SPL_ARRAY_INT_MASK);
 }
 /* }}} */
@@ -1287,7 +1287,7 @@ SPL_METHOD(Array, exchangeArray)

 	array_init(return_value);
 	zend_hash_copy(HASH_OF(return_value), spl_array_get_hash_table(intern, 0 TSRMLS_CC), (copy_ctor_func_t) zval_add_ref, &tmp, sizeof(zval*));
-
+	
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "Z", &array) == FAILURE) {
 		return;
 	}
@@ -1305,7 +1305,7 @@ SPL_METHOD(Array, getIterator)
 	spl_array_object *intern = (spl_array_object*)zend_object_store_get_object(object TSRMLS_CC);
 	spl_array_object *iterator;
 	HashTable *aht = spl_array_get_hash_table(intern, 0 TSRMLS_CC);
-
+	
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
@@ -1328,7 +1328,7 @@ SPL_METHOD(Array, rewind)
 {
 	zval *object = getThis();
 	spl_array_object *intern = (spl_array_object*)zend_object_store_get_object(object TSRMLS_CC);
-
+	
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
@@ -1361,9 +1361,9 @@ SPL_METHOD(Array, seek)
 	if (position >= 0) { /* negative values are not supported */
 		spl_array_rewind(intern TSRMLS_CC);
 		result = SUCCESS;
-
+		
 		while (position-- > 0 && (result = spl_array_next(intern TSRMLS_CC)) == SUCCESS);
-
+	
 		if (result == SUCCESS && zend_hash_has_more_elements_ex(aht, &intern->pos) == SUCCESS) {
 			return; /* ok */
 		}
@@ -1383,7 +1383,7 @@ int static spl_array_object_count_elements_helper(spl_array_object *intern, long
 	}

 	if (Z_TYPE_P(intern->array) == IS_OBJECT) {
-		/* We need to store the 'pos' since we'll modify it in the functions
+		/* We need to store the 'pos' since we'll modify it in the functions 
 		 * we're going to call and which do not support 'pos' as parameter. */
 		pos = intern->pos;
 		*count = 0;
@@ -1427,7 +1427,7 @@ SPL_METHOD(Array, count)
 {
 	long count;
 	spl_array_object *intern = (spl_array_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
-
+	
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
@@ -1443,11 +1443,11 @@ static void spl_array_method(INTERNAL_FUNCTION_PARAMETERS, char *fname, int fnam
 	HashTable *aht = spl_array_get_hash_table(intern, 0 TSRMLS_CC);
 	zval *tmp, *arg = NULL;
 	zval *retval_ptr = NULL;
-
+	
 	MAKE_STD_ZVAL(tmp);
 	Z_TYPE_P(tmp) = IS_ARRAY;
 	Z_ARRVAL_P(tmp) = aht;
-
+	
 	if (!use_arg) {
 		aht->nApplyCount++;
 		zend_call_method(NULL, NULL, NULL, fname, fname_len, &retval_ptr, 1, tmp, NULL TSRMLS_CC);
@@ -1524,7 +1524,7 @@ SPL_METHOD(Array, current)
 	spl_array_object *intern = (spl_array_object*)zend_object_store_get_object(object TSRMLS_CC);
 	zval **entry;
 	HashTable *aht = spl_array_get_hash_table(intern, 0 TSRMLS_CC);
-
+	
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
@@ -1547,7 +1547,7 @@ SPL_METHOD(Array, key)
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
-
+	
 	spl_array_iterator_key(getThis(), return_value TSRMLS_CC);
 } /* }}} */

@@ -1594,7 +1594,7 @@ SPL_METHOD(Array, next)

 	spl_array_next_no_verify(intern, aht TSRMLS_CC);
 }
-/* }}} */
+/* }}} */ 

 /* {{{ proto bool ArrayIterator::valid()
   Check whether array contains more entries */
@@ -1623,7 +1623,7 @@ SPL_METHOD(Array, hasChildren)
 	zval *object = getThis(), **entry;
 	spl_array_object *intern = (spl_array_object*)zend_object_store_get_object(object TSRMLS_CC);
 	HashTable *aht = spl_array_get_hash_table(intern, 0 TSRMLS_CC);
-
+	
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
@@ -1647,7 +1647,7 @@ SPL_METHOD(Array, getChildren)
 	zval *object = getThis(), **entry, *flags;
 	spl_array_object *intern = (spl_array_object*)zend_object_store_get_object(object TSRMLS_CC);
 	HashTable *aht = spl_array_get_hash_table(intern, 0 TSRMLS_CC);
-
+	
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
@@ -1687,7 +1687,7 @@ SPL_METHOD(Array, serialize)
 	php_serialize_data_t var_hash;
 	smart_str buf = {0};
 	zval *flags;
-
+	
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
@@ -1747,7 +1747,7 @@ SPL_METHOD(Array, unserialize)
 	zval *pmembers, *pflags = NULL;
 	HashTable *aht;
 	long flags;
-
+	
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &buf, &buf_len) == FAILURE) {
 		return;
 	}
@@ -1774,12 +1774,13 @@ SPL_METHOD(Array, unserialize)

 	ALLOC_INIT_ZVAL(pflags);
 	if (!php_var_unserialize(&pflags, &p, s + buf_len, &var_hash TSRMLS_CC) || Z_TYPE_P(pflags) != IS_LONG) {
+		zval_ptr_dtor(&pflags);
 		goto outexcept;
 	}

-	var_push_dtor(&var_hash, &pflags);
 	--p; /* for ';' */
 	flags = Z_LVAL_P(pflags);
+	zval_ptr_dtor(&pflags);
 	/* flags needs to be verified and we also need to verify whether the next
 	 * thing we get is ';'. After that we require an 'm' or somethign else
 	 * where 'm' stands for members and anything else should be an array. If
@@ -1801,7 +1802,6 @@ SPL_METHOD(Array, unserialize)
 		if (!php_var_unserialize(&intern->array, &p, s + buf_len, &var_hash TSRMLS_CC)) {
 			goto outexcept;
 		}
-		var_push_dtor(&var_hash, &intern->array);
 	}
 	if (*p != ';') {
 		goto outexcept;
@@ -1820,7 +1820,6 @@ SPL_METHOD(Array, unserialize)
 		goto outexcept;
 	}

-	var_push_dtor(&var_hash, &pmembers);
 	/* copy members */
 	if (!intern->std.properties) {
 		rebuild_object_properties(&intern->std);
@@ -1831,16 +1830,10 @@ SPL_METHOD(Array, unserialize)
 	/* done reading $serialized */

 	PHP_VAR_UNSERIALIZE_DESTROY(var_hash);
-	if (pflags) {
-		zval_ptr_dtor(&pflags);
-	}
 	return;

 outexcept:
 	PHP_VAR_UNSERIALIZE_DESTROY(var_hash);
-	if (pflags) {
-		zval_ptr_dtor(&pflags);
-	}
 	zend_throw_exception_ex(spl_ce_UnexpectedValueException, 0 TSRMLS_CC, "Error at offset %ld of %d bytes", (long)((char*)p - buf), buf_len);
 	return;

@@ -1989,7 +1982,7 @@ PHP_MINIT_FUNCTION(spl_array)
 	REGISTER_SPL_IMPLEMENTS(ArrayIterator, Countable);
 	memcpy(&spl_handler_ArrayIterator, &spl_handler_ArrayObject, sizeof(zend_object_handlers));
 	spl_ce_ArrayIterator->get_iterator = spl_array_get_iterator;
-
+	
 	REGISTER_SPL_SUB_CLASS_EX(RecursiveArrayIterator, ArrayIterator, spl_array_object_new, spl_funcs_RecursiveArrayIterator);
 	REGISTER_SPL_IMPLEMENTS(RecursiveArrayIterator, RecursiveIterator);
 	spl_ce_RecursiveArrayIterator->get_iterator = spl_array_get_iterator;
@@ -500,7 +500,7 @@ static int spl_dllist_object_count_elements(zval *object, long *count TSRMLS_DC)

 	*count = spl_ptr_llist_count(intern->llist);
 	return SUCCESS;
-}
+} 
 /* }}} */

 static HashTable* spl_dllist_object_get_debug_info(zval *obj, int *is_temp TSRMLS_DC) /* {{{{ */
@@ -571,7 +571,7 @@ SPL_METHOD(SplDoublyLinkedList, push)
 	spl_ptr_llist_push(intern->llist, value TSRMLS_CC);

 	RETURN_TRUE;
-}
+} 
 /* }}} */

 /* {{{ proto bool SplDoublyLinkedList::unshift(mixed $value) U
@@ -614,7 +614,7 @@ SPL_METHOD(SplDoublyLinkedList, pop)
 	}

 	RETURN_ZVAL(value, 1, 1);
-}
+} 
 /* }}} */

 /* {{{ proto mixed SplDoublyLinkedList::shift() U
@@ -637,7 +637,7 @@ SPL_METHOD(SplDoublyLinkedList, shift)
 	}

 	RETURN_ZVAL(value, 1, 1);
-}
+} 
 /* }}} */

 /* {{{ proto mixed SplDoublyLinkedList::top() U
@@ -1051,7 +1051,7 @@ static void spl_dllist_it_move_forward(zend_object_iterator *iter TSRMLS_DC) /*
 SPL_METHOD(SplDoublyLinkedList, key)
 {
 	spl_dllist_object *intern = (spl_dllist_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
-
+	
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
@@ -1065,7 +1065,7 @@ SPL_METHOD(SplDoublyLinkedList, key)
 SPL_METHOD(SplDoublyLinkedList, prev)
 {
 	spl_dllist_object *intern = (spl_dllist_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
-
+	
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
@@ -1079,7 +1079,7 @@ SPL_METHOD(SplDoublyLinkedList, prev)
 SPL_METHOD(SplDoublyLinkedList, next)
 {
 	spl_dllist_object *intern = (spl_dllist_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
-
+	
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
@@ -1093,7 +1093,7 @@ SPL_METHOD(SplDoublyLinkedList, next)
 SPL_METHOD(SplDoublyLinkedList, valid)
 {
 	spl_dllist_object *intern = (spl_dllist_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
-
+	
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
@@ -1107,7 +1107,7 @@ SPL_METHOD(SplDoublyLinkedList, valid)
 SPL_METHOD(SplDoublyLinkedList, rewind)
 {
 	spl_dllist_object *intern = (spl_dllist_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
-
+	
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
@@ -1122,7 +1122,7 @@ SPL_METHOD(SplDoublyLinkedList, current)
 {
 	spl_dllist_object     *intern  = (spl_dllist_object*)zend_object_store_get_object(getThis() TSRMLS_CC);
 	spl_ptr_llist_element *element = intern->traverse_pointer;
-
+	
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
@@ -1177,7 +1177,7 @@ SPL_METHOD(SplDoublyLinkedList, serialize)
 	} else {
 		RETURN_NULL();
 	}
-
+	
 } /* }}} */

 /* {{{ proto void SplDoublyLinkedList::unserialize(string serialized)
@@ -1190,7 +1190,7 @@ SPL_METHOD(SplDoublyLinkedList, unserialize)
 	int buf_len;
 	const unsigned char *p, *s;
 	php_unserialize_data_t var_hash;
-
+	
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &buf, &buf_len) == FAILURE) {
 		return;
 	}
@@ -1209,7 +1209,6 @@ SPL_METHOD(SplDoublyLinkedList, unserialize)
 		zval_ptr_dtor(&flags);
 		goto error;
 	}
-	var_push_dtor(&var_hash, &flags);
 	intern->flags = Z_LVAL_P(flags);
 	zval_ptr_dtor(&flags);

@@ -1221,7 +1220,6 @@ SPL_METHOD(SplDoublyLinkedList, unserialize)
 			zval_ptr_dtor(&elem);
 			goto error;
 		}
-		var_push_dtor(&var_hash, &elem);

 		spl_ptr_llist_push(intern->llist, elem TSRMLS_CC);
 	}
@@ -99,9 +99,9 @@ void spl_SplOjectStorage_free_storage(void *object TSRMLS_DC) /* {{{ */
 	spl_SplObjectStorage *intern = (spl_SplObjectStorage *)object;

 	zend_object_std_dtor(&intern->std TSRMLS_CC);
-
+	
 	zend_hash_destroy(&intern->storage);
-
+	
 	if (intern->debug_info != NULL) {
 		zend_hash_destroy(intern->debug_info);
 		efree(intern->debug_info);
@@ -196,7 +196,7 @@ spl_SplObjectStorageElement* spl_object_storage_get(spl_SplObjectStorage *intern
 void spl_object_storage_attach(spl_SplObjectStorage *intern, zval *this, zval *obj, zval *inf TSRMLS_DC) /* {{{ */
 {
 	spl_SplObjectStorageElement *pelement, element;
-
+	
 	int hash_len;
 	char *hash = spl_object_storage_get_hash(intern, this, obj, &hash_len TSRMLS_CC);
 	if (!hash) {
@@ -232,7 +232,7 @@ int spl_object_storage_detach(spl_SplObjectStorage *intern, zval *this, zval *ob
 	}
 	ret = zend_hash_del(&intern->storage, hash, hash_len);
 	spl_object_storage_free_hash(intern, hash);
-
+	
 	return ret;
 } /* }}}*/

@@ -372,7 +372,7 @@ static HashTable *spl_object_storage_get_gc(zval *obj, zval ***table, int *n TSR
 		 **gcdata_arr_pp;

 	props = std_object_handlers.get_properties(obj TSRMLS_CC);
-
+	
 	*table = NULL;
 	*n = 0;

@@ -492,7 +492,7 @@ SPL_METHOD(SplObjectStorage, getHash)

 	hash = emalloc(33);
 	php_spl_object_hash(obj, hash TSRMLS_CC);
-
+	
 	RETVAL_STRING(hash, 0);

 } /* }}} */
@@ -621,11 +621,11 @@ SPL_METHOD(SplObjectStorage, contains)
 SPL_METHOD(SplObjectStorage, count)
 {
 	spl_SplObjectStorage *intern = (spl_SplObjectStorage*)zend_object_store_get_object(getThis() TSRMLS_CC);
-
+	
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
-
+	
 	RETURN_LONG(zend_hash_num_elements(&intern->storage));
 } /* }}} */

@@ -634,11 +634,11 @@ SPL_METHOD(SplObjectStorage, count)
 SPL_METHOD(SplObjectStorage, rewind)
 {
 	spl_SplObjectStorage *intern = (spl_SplObjectStorage*)zend_object_store_get_object(getThis() TSRMLS_CC);
-
+	
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
-
+	
 	zend_hash_internal_pointer_reset_ex(&intern->storage, &intern->pos);
 	intern->index = 0;
 } /* }}} */
@@ -648,11 +648,11 @@ SPL_METHOD(SplObjectStorage, rewind)
 SPL_METHOD(SplObjectStorage, valid)
 {
 	spl_SplObjectStorage *intern = (spl_SplObjectStorage*)zend_object_store_get_object(getThis() TSRMLS_CC);
-
+	
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
-
+	
 	RETURN_BOOL(zend_hash_has_more_elements_ex(&intern->storage, &intern->pos) == SUCCESS);
 } /* }}} */

@@ -661,11 +661,11 @@ SPL_METHOD(SplObjectStorage, valid)
 SPL_METHOD(SplObjectStorage, key)
 {
 	spl_SplObjectStorage *intern = (spl_SplObjectStorage*)zend_object_store_get_object(getThis() TSRMLS_CC);
-
+	
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
-
+	
 	RETURN_LONG(intern->index);
 } /* }}} */

@@ -675,11 +675,11 @@ SPL_METHOD(SplObjectStorage, current)
 {
 	spl_SplObjectStorageElement *element;
 	spl_SplObjectStorage *intern = (spl_SplObjectStorage*)zend_object_store_get_object(getThis() TSRMLS_CC);
-
+	
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
-
+	
 	if (zend_hash_get_current_data_ex(&intern->storage, (void**)&element, &intern->pos) == FAILURE) {
 		return;
 	}
@@ -696,7 +696,7 @@ SPL_METHOD(SplObjectStorage, getInfo)
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
-
+	
 	if (zend_hash_get_current_data_ex(&intern->storage, (void**)&element, &intern->pos) == FAILURE) {
 		return;
 	}
@@ -710,7 +710,7 @@ SPL_METHOD(SplObjectStorage, setInfo)
 	spl_SplObjectStorageElement *element;
 	spl_SplObjectStorage *intern = (spl_SplObjectStorage*)zend_object_store_get_object(getThis() TSRMLS_CC);
 	zval *inf;
-
+	
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "z", &inf) == FAILURE) {
 		return;
 	}
@@ -728,11 +728,11 @@ SPL_METHOD(SplObjectStorage, setInfo)
 SPL_METHOD(SplObjectStorage, next)
 {
 	spl_SplObjectStorage *intern = (spl_SplObjectStorage*)zend_object_store_get_object(getThis() TSRMLS_CC);
-
+	
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
-
+	
 	zend_hash_move_forward_ex(&intern->storage, &intern->pos);
 	intern->index++;
 } /* }}} */
@@ -754,7 +754,7 @@ SPL_METHOD(SplObjectStorage, serialize)
 	}

 	PHP_VAR_SERIALIZE_INIT(var_hash);
-
+	
 	/* storage */
 	smart_str_appendl(&buf, "x:", 2);
 	MAKE_STD_ZVAL(flags);
@@ -793,7 +793,7 @@ SPL_METHOD(SplObjectStorage, serialize)
 	} else {
 		RETURN_NULL();
 	}
-
+	
 } /* }}} */

 /* {{{ proto void SplObjectStorage::unserialize(string serialized)
@@ -808,7 +808,7 @@ SPL_METHOD(SplObjectStorage, unserialize)
 	php_unserialize_data_t var_hash;
 	zval *pentry, *pmembers, *pcount = NULL, *pinf;
 	long count;
-
+	
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &buf, &buf_len) == FAILURE) {
 		return;
 	}
@@ -832,15 +832,14 @@ SPL_METHOD(SplObjectStorage, unserialize)
 		goto outexcept;
 	}

-	var_push_dtor(&var_hash, &pcount);
 	--p; /* for ';' */
 	count = Z_LVAL_P(pcount);
-
+		
 	while(count-- > 0) {
 		spl_SplObjectStorageElement *pelement;
 		char *hash;
 		int hash_len;
-
+		
 		if (*p != ';') {
 			goto outexcept;
 		}
@@ -853,7 +852,6 @@ SPL_METHOD(SplObjectStorage, unserialize)
 			zval_ptr_dtor(&pentry);
 			goto outexcept;
 		}
-		var_push_dtor(&var_hash, &pentry);
 		if(Z_TYPE_P(pentry) != IS_OBJECT) {
 			zval_ptr_dtor(&pentry);
 			goto outexcept;
@@ -865,7 +863,6 @@ SPL_METHOD(SplObjectStorage, unserialize)
 				zval_ptr_dtor(&pinf);
 				goto outexcept;
 			}
-			var_push_dtor(&var_hash, &pinf);
 		}

 		hash = spl_object_storage_get_hash(intern, getThis(), pentry, &hash_len TSRMLS_CC);
@@ -883,7 +880,7 @@ SPL_METHOD(SplObjectStorage, unserialize)
 			if(pelement->obj) {
 				var_push_dtor(&var_hash, &pelement->obj);
 			}
-		}
+		} 
 		spl_object_storage_attach(intern, getThis(), pentry, pinf TSRMLS_CC);
 		zval_ptr_dtor(&pentry);
 		zval_ptr_dtor(&pinf);
@@ -906,7 +903,6 @@ SPL_METHOD(SplObjectStorage, unserialize)
 		goto outexcept;
 	}

-	var_push_dtor(&var_hash, &pmembers);
 	/* copy members */
 	if (!intern->std.properties) {
 		rebuild_object_properties(&intern->std);
@@ -1024,7 +1020,7 @@ SPL_METHOD(MultipleIterator, __construct)
 SPL_METHOD(MultipleIterator, getFlags)
 {
 	spl_SplObjectStorage *intern = (spl_SplObjectStorage*)zend_object_store_get_object(getThis() TSRMLS_CC);
-
+	
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
@@ -1091,7 +1087,7 @@ SPL_METHOD(MultipleIterator, rewind)
 	zval                        *it;

 	intern = (spl_SplObjectStorage*)zend_object_store_get_object(getThis() TSRMLS_CC);
-
+	
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
@@ -1114,7 +1110,7 @@ SPL_METHOD(MultipleIterator, next)
 	zval                        *it;

 	intern = (spl_SplObjectStorage*)zend_object_store_get_object(getThis() TSRMLS_CC);
-
+	
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
@@ -1138,7 +1134,7 @@ SPL_METHOD(MultipleIterator, valid)
 	long                         expect, valid;

 	intern = (spl_SplObjectStorage*)zend_object_store_get_object(getThis() TSRMLS_CC);
-
+	
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
@@ -1184,7 +1180,7 @@ static void spl_multiple_iterator_get_all(spl_SplObjectStorage *intern, int get_
 	}

 	array_init_size(return_value, num_elements);
-
+	
 	zend_hash_internal_pointer_reset_ex(&intern->storage, &intern->pos);
 	while (zend_hash_get_current_data_ex(&intern->storage, (void**)&element, &intern->pos) == SUCCESS && !EG(exception)) {
 		it = element->obj;
@@ -1246,7 +1242,7 @@ SPL_METHOD(MultipleIterator, current)
 {
 	spl_SplObjectStorage        *intern;
 	intern = (spl_SplObjectStorage*)zend_object_store_get_object(getThis() TSRMLS_CC);
-
+	
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
@@ -1261,7 +1257,7 @@ SPL_METHOD(MultipleIterator, key)
 {
 	spl_SplObjectStorage        *intern;
 	intern = (spl_SplObjectStorage*)zend_object_store_get_object(getThis() TSRMLS_CC);
-
+	
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
@@ -1,9 +0,0 @@
--TEST--
-Bug #70068 (Dangling pointer in the unserialization of ArrayObject items)
--FILE--
-<?php
-$a = unserialize('a:3:{i:0;C:11:"ArrayObject":20:{x:i:0;r:3;;m:a:0:{};}i:1;d:11;i:2;S:31:"AAAAAAAABBBBCCCC\01\00\00\00\04\00\00\00\00\00\00\00\00\00\00";}');
-?>
-OK
--EXPECT--
-OK
@@ -1,50 +0,0 @@
--TEST--
-SPL: Bug #70155 Use After Free Vulnerability in unserialize() with SPLArrayObject
--FILE--
-<?php
-$inner = 'x:i:0;O:12:"DateInterval":1:{s:1:"y";i:3;};m:a:1:{i:0;R:2;}';
-$exploit = 'C:11:"ArrayObject":'.strlen($inner).':{'.$inner.'}';
-$data = unserialize($exploit);
-
-var_dump($data);
-?>
-===DONE===
--EXPECTF--
-object(ArrayObject)#1 (2) {
-  [0]=>
-  int(0)
-  ["storage":"ArrayObject":private]=>
-  object(DateInterval)#2 (15) {
-    ["y"]=>
-    int(3)
-    ["m"]=>
-    int(-1)
-    ["d"]=>
-    int(-1)
-    ["h"]=>
-    int(-1)
-    ["i"]=>
-    int(-1)
-    ["s"]=>
-    int(-1)
-    ["weekday"]=>
-    int(-1)
-    ["weekday_behavior"]=>
-    int(-1)
-    ["first_last_day_of"]=>
-    int(-1)
-    ["invert"]=>
-    int(0)
-    ["days"]=>
-    int(-1)
-    ["special_type"]=>
-    int(0)
-    ["special_amount"]=>
-    int(-1)
-    ["have_weekday_relative"]=>
-    int(0)
-    ["have_special_relative"]=>
-    int(0)
-  }
-}
-===DONE===
@@ -1,29 +0,0 @@
--TEST--
-SPL: Bug #70166 Use After Free Vulnerability in unserialize() with SPLArrayObject
--FILE--
-<?php
-$inner = 'x:i:1;a:0:{};m:a:0:{}';
-$exploit = 'a:2:{i:0;C:11:"ArrayObject":'.strlen($inner).':{'.$inner.'}i:1;R:5;}';
-
-$data = unserialize($exploit);
-
-for($i = 0; $i < 5; $i++) {
-    $v[$i] = 'hi'.$i;
-}
-
-var_dump($data);
-?>
-===DONE===
--EXPECTF--
-array(2) {
-  [0]=>
-  object(ArrayObject)#%d (1) {
-    ["storage":"ArrayObject":private]=>
-    array(0) {
-    }
-  }
-  [1]=>
-  array(0) {
-  }
-}
-===DONE===
@@ -1,36 +0,0 @@
--TEST--
-SPL: Bug #70168 Use After Free Vulnerability in unserialize() with SplObjectStorage
--FILE--
-<?php
-$inner = 'x:i:1;O:8:"stdClass":0:{};m:a:0:{}';
-$exploit = 'a:2:{i:0;C:16:"SplObjectStorage":'.strlen($inner).':{'.$inner.'}i:1;R:3;}';
-
-$data = unserialize($exploit);
-
-for($i = 0; $i < 5; $i++) {
-    $v[$i] = 'hi'.$i;
-}
-
-var_dump($data);
-?>
-===DONE===
--EXPECTF--
-array(2) {
-  [0]=>
-  object(SplObjectStorage)#%d (1) {
-    ["storage":"SplObjectStorage":private]=>
-    array(1) {
-      ["%s"]=>
-      array(2) {
-        ["obj"]=>
-        object(stdClass)#2 (0) {
-        }
-        ["inf"]=>
-        NULL
-      }
-    }
-  }
-  [1]=>
-  int(1)
-}
-===DONE===
@@ -1,30 +0,0 @@
--TEST--
-SPL: Bug #70169	Use After Free Vulnerability in unserialize() with SplDoublyLinkedList
--FILE--
-<?php
-$inner = 'i:1;';
-$exploit = 'a:2:{i:0;C:19:"SplDoublyLinkedList":'.strlen($inner).':{'.$inner.'}i:1;R:3;}';
-
-$data = unserialize($exploit);
-
-for($i = 0; $i < 5; $i++) {
-    $v[$i] = 'hi'.$i;
-}
-
-var_dump($data);
-?>
-===DONE===
--EXPECTF--
-array(2) {
-  [0]=>
-  object(SplDoublyLinkedList)#%d (2) {
-    ["flags":"SplDoublyLinkedList":private]=>
-    int(1)
-    ["dllist":"SplDoublyLinkedList":private]=>
-    array(0) {
-    }
-  }
-  [1]=>
-  int(1)
-}
-===DONE===
@@ -1,50 +0,0 @@
--TEST--
-SPL: Bug #70365 use-after-free vulnerability in unserialize() with SplObjectStorage
--FILE--
-<?php
-class obj {
-	var $ryat;
-	function __wakeup() {
-		$this->ryat = 1;
-	}
-}
-
-$fakezval = ptr2str(1122334455);
-$fakezval .= ptr2str(0);
-$fakezval .= "\x00\x00\x00\x00";
-$fakezval .= "\x01";
-$fakezval .= "\x00";
-$fakezval .= "\x00\x00";
-
-$inner = 'x:i:1;O:8:"stdClass":0:{},i:1;;m:a:0:{}';
-$exploit = 'a:5:{i:0;i:1;i:1;C:16:"SplObjectStorage":'.strlen($inner).':{'.$inner.'}i:2;O:3:"obj":1:{s:4:"ryat";R:3;}i:3;R:6;i:4;s:'.strlen($fakezval).':"'.$fakezval.'";}';
-
-$data = unserialize($exploit);
-
-var_dump($data);
-
-function ptr2str($ptr)
-{
-	$out = '';
-	for ($i = 0; $i < 8; $i++) {
-		$out .= chr($ptr & 0xff);
-		$ptr >>= 8;
-	}
-	return $out;
-}
--EXPECTF--
-array(5) {
-  [0]=>
-  int(1)
-  [1]=>
-  &int(1)
-  [2]=>
-  object(obj)#%d (1) {
-    ["ryat"]=>
-    &int(1)
-  }
-  [3]=>
-  int(1)
-  [4]=>
-  string(24) "%s"
-}
@@ -1,54 +0,0 @@
--TEST--
-SPL: Bug #70366 use-after-free vulnerability in unserialize() with SplDoublyLinkedList
--FILE--
-<?php
-class obj {
-	var $ryat;
-	function __wakeup() {
-		$this->ryat = 1;
-	}
-}
-
-$fakezval = ptr2str(1122334455);
-$fakezval .= ptr2str(0);
-$fakezval .= "\x00\x00\x00\x00";
-$fakezval .= "\x01";
-$fakezval .= "\x00";
-$fakezval .= "\x00\x00";
-
-$inner = 'i:1234;:i:1;';
-$exploit = 'a:5:{i:0;i:1;i:1;C:19:"SplDoublyLinkedList":'.strlen($inner).':{'.$inner.'}i:2;O:3:"obj":1:{s:4:"ryat";R:3;}i:3;a:1:{i:0;R:5;}i:4;s:'.strlen($fakezval).':"'.$fakezval.'";}';
-
-$data = unserialize($exploit);
-
-var_dump($data);
-
-function ptr2str($ptr)
-{
-	$out = '';
-	for ($i = 0; $i < 8; $i++) {
-		$out .= chr($ptr & 0xff);
-		$ptr >>= 8;
-	}
-	return $out;
-}
-?>
--EXPECTF--
-array(5) {
-  [0]=>
-  int(1)
-  [1]=>
-  &int(1)
-  [2]=>
-  object(obj)#%d (1) {
-    ["ryat"]=>
-    &int(1)
-  }
-  [3]=>
-  array(1) {
-    [0]=>
-    int(1)
-  }
-  [4]=>
-  string(24) "%s"
-}
@@ -9,7 +9,6 @@ $x->test();

 ?>
 --EXPECTF--
-Notice: Undefined property: Exception::$previous in %s on line %d
 exception 'Exception' in %s:%d
 Stack trace:
 #0 {main}
@@ -1,17 +0,0 @@
--TEST--
-Bug #69793: Remotely triggerable stack exhaustion via recursive method calls
--FILE--
-<?php
-$e = unserialize('O:9:"Exception":7:{s:17:"'."\0".'Exception'."\0".'string";s:1:"a";s:7:"'."\0".'*'."\0".'code";i:0;s:7:"'."\0".'*'."\0".'file";R:1;s:7:"'."\0".'*'."\0".'line";i:1337;s:16:"'."\0".'Exception'."\0".'trace";a:0:{}s:19:"'."\0".'Exception'."\0".'previous";i:10;s:10:"'."\0".'*'."\0".'message";N;}');
-
-var_dump($e."");
-?>
--EXPECTF--
-Notice: Undefined property: Exception::$message in %s/bug69793.php on line %d
-
-Notice: Undefined property: Exception::$file in %s/bug69793.php on line %d
-
-Notice: Undefined property: Exception::$previous in %s/bug69793.php on line %d
-string(53) "exception 'Exception' in :1337
-Stack trace:
-#0 {main}"
@@ -1,54 +0,0 @@
--TEST--
-Bug #70172 - Use After Free Vulnerability in unserialize()
--XFAIL--
-Memory leak on debug build, needs fix.
--FILE--
-<?php
-class obj implements Serializable {
-	var $data;
-	function serialize() {
-		return serialize($this->data);
-	}
-	function unserialize($data) {
-		$this->data = unserialize($data);
-	}
-}
-
-$fakezval = ptr2str(1122334455);
-$fakezval .= ptr2str(0);
-$fakezval .= "\x00\x00\x00\x00";
-$fakezval .= "\x01";
-$fakezval .= "\x00";
-$fakezval .= "\x00\x00";
-
-$inner = 'r:2;';
-$exploit = 'a:2:{i:0;i:1;i:1;C:3:"obj":'.strlen($inner).':{'.$inner.'}}';
-
-$data = unserialize($exploit);
-
-for ($i = 0; $i < 5; $i++) {
-	$v[$i] = $fakezval.$i;
-}
-
-var_dump($data);
-
-function ptr2str($ptr)
-{
-	$out = '';
-	for ($i = 0; $i < 8; $i++) {
-		$out .= chr($ptr & 0xff);
-		$ptr >>= 8;
-	}
-	return $out;
-}
-?>
--EXPECTF--
-array(2) {
-  [0]=>
-  int(1)
-  [1]=>
-  object(obj)#%d (1) {
-    ["data"]=>
-    int(1)
-  }
-}
@@ -1,68 +0,0 @@
--TEST--
-Bug #70172 - Use After Free Vulnerability in unserialize()
--FILE--
-<?php
-class obj implements Serializable {
-	var $data;
-	function serialize() {
-		return serialize($this->data);
-	}
-	function unserialize($data) {
-		$this->data = unserialize($data);
-	}
-}
-
-class obj2 {
-	var $ryat;
-	function __wakeup() {
-		$this->ryat = 1;
-	}
-}
-
-$fakezval = ptr2str(1122334455);
-$fakezval .= ptr2str(0);
-$fakezval .= "\x00\x00\x00\x00";
-$fakezval .= "\x01";
-$fakezval .= "\x00";
-$fakezval .= "\x00\x00";
-
-$inner = 'r:2;';
-$exploit = 'a:2:{i:0;O:4:"obj2":1:{s:4:"ryat";C:3:"obj":'.strlen($inner).':{'.$inner.'}}i:1;a:1:{i:0;a:1:{i:0;R:4;}}}';
-
-$data = unserialize($exploit);
-
-for ($i = 0; $i < 5; $i++) {
-	$v[$i] = $fakezval.$i;
-}
-
-var_dump($data);
-
-function ptr2str($ptr)
-{
-	$out = '';
-	for ($i = 0; $i < 8; $i++) {
-		$out .= chr($ptr & 0xff);
-		$ptr >>= 8;
-	}
-	return $out;
-}
-?>
--EXPECTF--
-array(2) {
-  [0]=>
-  object(obj2)#%d (1) {
-    ["ryat"]=>
-    int(1)
-  }
-  [1]=>
-  array(1) {
-    [0]=>
-    array(1) {
-      [0]=>
-      object(obj2)#%d (1) {
-        ["ryat"]=>
-        int(1)
-      }
-    }
-  }
-}
@@ -1,38 +0,0 @@
--TEST--
-Bug #70219 Use after free vulnerability in session deserializer
--FILE--
-<?php
-class obj implements Serializable {
-    var $data;
-    function serialize() {
-        return serialize($this->data);
-    }
-    function unserialize($data) {
-        session_start();
-        session_decode($data);
-    }
-}
-
-$inner = 'ryat|a:1:{i:0;a:1:{i:1;';
-$exploit = 'a:2:{i:0;C:3:"obj":'.strlen($inner).':{'.$inner.'}i:1;R:4;}';
-
-$data = unserialize($exploit);
-
-for ($i = 0; $i < 5; $i++) {
-    $v[$i] = 'hi'.$i;
-}
-
-var_dump($data);	
-?>
--EXPECTF--
-Warning: session_decode(): Failed to decode session object. Session has been destroyed in %s on line %d
-array(2) {
-  [0]=>
-  object(obj)#%d (1) {
-    ["data"]=>
-    NULL
-  }
-  [1]=>
-  array(0) {
-  }
-}
@@ -373,7 +373,7 @@ static int php_array_element_export(zval **zv TSRMLS_DC, int num_args, va_list a

 	smart_str_appendc(buf, ',');
 	smart_str_appendc(buf, '\n');
-
+	
 	return 0;
 }
 /* }}} */
@@ -392,7 +392,7 @@ static int php_object_element_export(zval **zv TSRMLS_DC, int num_args, va_list
 		const char *pname;
 		char *pname_esc;
 		int  pname_esc_len;
-
+		
 		zend_unmangle_property_name(hash_key->arKey, hash_key->nKeyLength - 1,
 				&class_name, &pname);
 		pname_esc = php_addcslashes(pname, strlen(pname), &pname_esc_len, 0,
@@ -469,7 +469,7 @@ PHPAPI void php_var_export_ex(zval **struc, int level, smart_str *buf TSRMLS_DC)
 			buffer_append_spaces(buf, level - 1);
 		}
 		smart_str_appendc(buf, ')');
-
+    
 		break;

 	case IS_OBJECT:
@@ -802,7 +802,7 @@ static void php_var_serialize_intern(smart_str *buf, zval *struc, HashTable *var
 					BG(serialize_lock)++;
 					res = call_user_function_ex(CG(function_table), &struc, &fname, &retval_ptr, 0, 0, 1, NULL TSRMLS_CC);
 					BG(serialize_lock)--;
-
+                    
 					if (EG(exception)) {
 						if (retval_ptr) {
 							zval_ptr_dtor(&retval_ptr);
@@ -951,8 +951,6 @@ PHP_FUNCTION(unserialize)
 	int buf_len;
 	const unsigned char *p;
 	php_unserialize_data_t var_hash;
-	int oldlevel;
-	zval *old_rval = return_value;

 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &buf, &buf_len) == FAILURE) {
 		RETURN_FALSE;
@@ -972,20 +970,6 @@ PHP_FUNCTION(unserialize)
 		}
 		RETURN_FALSE;
 	}
-	if (return_value != old_rval) {
-		/*
-		 * Terrible hack due to the fact that executor passes us zval *,
-		 * but unserialize with r/R wants to replace it with another zval *
-		 */
-		zval_dtor(old_rval);
-		*old_rval = *return_value;
-		zval_copy_ctor(old_rval);
-		var_push_dtor_no_addref(&var_hash, &return_value);
-		/* FIXME: old_rval is not freed in some scenarios, see bug #70172
-		   var_push_dtor_no_addref(&var_hash, &old_rval); */
-	} else {
-		var_push_dtor(&var_hash, &return_value);
-	}
 	PHP_VAR_UNSERIALIZE_DESTROY(var_hash);
 }
 /* }}} */
@@ -1,4 +1,4 @@
-/* Generated by re2c 0.13.7.5 on Mon Aug 31 23:15:46 2015 */
+/* Generated by re2c 0.13.7.5 on Tue Mar 17 13:14:30 2015 */
 #line 1 "ext/standard/var_unserializer.re"
 /*
  +----------------------------------------------------------------------+
@@ -69,7 +69,7 @@ PHPAPI void var_push_dtor(php_unserialize_data_t *var_hashx, zval **rval)

 	var_hash = (*var_hashx)->last_dtor;
 #if VAR_ENTRIES_DBG
-	fprintf(stderr, "var_push_dtor(%p, %ld): %d\n", *rval, var_hash?var_hash->used_slots:-1L, Z_TYPE_PP(rval));
+	fprintf(stderr, "var_push_dtor(%ld): %d\n", var_hash?var_hash->used_slots:-1L, Z_TYPE_PP(rval));
 #endif

 	if (!var_hash || var_hash->used_slots == VAR_ENTRIES_MAX) {
@@ -92,15 +92,9 @@ PHPAPI void var_push_dtor(php_unserialize_data_t *var_hashx, zval **rval)

 PHPAPI void var_push_dtor_no_addref(php_unserialize_data_t *var_hashx, zval **rval)
 {
-	var_entries *var_hash;
-
-    if (!var_hashx || !*var_hashx) {
-        return;
-    }
-
-    var_hash = (*var_hashx)->last_dtor;
+	var_entries *var_hash = (*var_hashx)->last_dtor;
 #if VAR_ENTRIES_DBG
-	fprintf(stderr, "var_push_dtor_no_addref(%p, %ld): %d (%d)\n", *rval, var_hash?var_hash->used_slots:-1L, Z_TYPE_PP(rval), Z_REFCOUNT_PP(rval));
+	fprintf(stderr, "var_push_dtor_no_addref(%ld): %d (%d)\n", var_hash?var_hash->used_slots:-1L, Z_TYPE_PP(rval), Z_REFCOUNT_PP(rval));
 #endif

 	if (!var_hash || var_hash->used_slots == VAR_ENTRIES_MAX) {
@@ -127,7 +121,7 @@ PHPAPI void var_replace(php_unserialize_data_t *var_hashx, zval *ozval, zval **n
 #if VAR_ENTRIES_DBG
 	fprintf(stderr, "var_replace(%ld): %d\n", var_hash?var_hash->used_slots:-1L, Z_TYPE_PP(nzval));
 #endif
-
+	
 	while (var_hash) {
 		for (i = 0; i < var_hash->used_slots; i++) {
 			if (var_hash->data[i] == ozval) {
@@ -145,7 +139,7 @@ static int var_access(php_unserialize_data_t *var_hashx, long id, zval ***store)
 #if VAR_ENTRIES_DBG
 	fprintf(stderr, "var_access(%ld): %ld\n", var_hash?var_hash->used_slots:-1L, id);
 #endif
-
+		
 	while (id >= VAR_ENTRIES_MAX && var_hash && var_hash->used_slots == VAR_ENTRIES_MAX) {
 		var_hash = var_hash->next;
 		id -= VAR_ENTRIES_MAX;
@@ -168,7 +162,7 @@ PHPAPI void var_destroy(php_unserialize_data_t *var_hashx)
 #if VAR_ENTRIES_DBG
 	fprintf(stderr, "var_destroy(%ld)\n", var_hash?var_hash->used_slots:-1L);
 #endif
-
+	
 	while (var_hash) {
 		next = var_hash->next;
 		efree(var_hash);
@@ -176,12 +170,9 @@ PHPAPI void var_destroy(php_unserialize_data_t *var_hashx)
 	}

 	var_hash = (*var_hashx)->first_dtor;
-
+	
 	while (var_hash) {
 		for (i = 0; i < var_hash->used_slots; i++) {
-#if VAR_ENTRIES_DBG
-    fprintf(stderr, "var_destroy dtor(%p, %ld)\n", var_hash->data[i], Z_REFCOUNT_P(var_hash->data[i]));
-#endif
 			zval_ptr_dtor(&var_hash->data[i]);
 		}
 		next = var_hash->next;
@@ -242,7 +233,7 @@ static char *unserialize_str(const unsigned char **p, size_t *len, size_t maxlen
 #define YYMARKER marker


-#line 250 "ext/standard/var_unserializer.re"
+#line 241 "ext/standard/var_unserializer.re"



@@ -260,7 +251,7 @@ static inline long parse_iv2(const unsigned char *p, const unsigned char **q)
 		case '+':
 			p++;
 	}
-
+	
 	while (1) {
 		cursor = (char)*p;
 		if (cursor >= '0' && cursor <= '9') {
@@ -289,7 +280,7 @@ static inline size_t parse_uiv(const unsigned char *p)
 	if (*p == '+') {
 		p++;
 	}
-
+	
 	while (1) {
 		cursor = *p;
 		if (cursor >= '0' && cursor <= '9') {
@@ -313,20 +304,24 @@ static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, long
 		ALLOC_INIT_ZVAL(key);

 		if (!php_var_unserialize(&key, p, max, NULL TSRMLS_CC)) {
-            var_push_dtor_no_addref(var_hash, &key);
+			zval_dtor(key);
+			FREE_ZVAL(key);
 			return 0;
 		}

 		if (Z_TYPE_P(key) != IS_LONG && Z_TYPE_P(key) != IS_STRING) {
-            var_push_dtor_no_addref(var_hash, &key);
+			zval_dtor(key);
+			FREE_ZVAL(key);
 			return 0;
 		}

 		ALLOC_INIT_ZVAL(data);

 		if (!php_var_unserialize(&data, p, max, var_hash TSRMLS_CC)) {
-            var_push_dtor_no_addref(var_hash, &key);
-            var_push_dtor_no_addref(var_hash, &data);
+			zval_dtor(key);
+			FREE_ZVAL(key);
+			zval_dtor(data);
+			FREE_ZVAL(data);
 			return 0;
 		}

@@ -355,7 +350,9 @@ static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, long
 					sizeof data, NULL);
 		}
 		var_push_dtor(var_hash, &data);
-        var_push_dtor_no_addref(var_hash, &key);
+		
+		zval_dtor(key);
+		FREE_ZVAL(key);

 		if (elements && *(*p-1) != ';' && *(*p-1) != '}') {
 			(*p)--;
@@ -405,11 +402,11 @@ static inline int object_custom(UNSERIALIZE_PARAMETER, zend_class_entry *ce)
 static inline long object_common1(UNSERIALIZE_PARAMETER, zend_class_entry *ce)
 {
 	long elements;
-
+	
 	elements = parse_iv2((*p) + 2, p);

 	(*p) += 2;
-
+	
 	/* The internal class check here is a BC fix only, userspace classes implementing the
 	Serializable interface have eventually an inconsistent behavior at this place when
 	unserialized from a manipulated string. Additionaly the interal classes can possibly
@@ -473,21 +470,21 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)

 	limit = max;
 	cursor = *p;
-
+	
 	if (YYCURSOR >= YYLIMIT) {
 		return 0;
 	}
-
+	
 	if (var_hash && cursor[0] != 'R') {
 		var_push(var_hash, rval);
 	}

 	start = cursor;

+	
+	

-
-
-#line 491 "ext/standard/var_unserializer.c"
+#line 488 "ext/standard/var_unserializer.c"
 {
 	YYCTYPE yych;
 	static const unsigned char yybm[] = {
@@ -547,9 +544,9 @@ yy2:
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych == ':') goto yy95;
 yy3:
-#line 845 "ext/standard/var_unserializer.re"
+#line 839 "ext/standard/var_unserializer.re"
 	{ return 0; }
-#line 553 "ext/standard/var_unserializer.c"
+#line 550 "ext/standard/var_unserializer.c"
 yy4:
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych == ':') goto yy89;
@@ -592,13 +589,13 @@ yy13:
 	goto yy3;
 yy14:
 	++YYCURSOR;
-#line 839 "ext/standard/var_unserializer.re"
+#line 833 "ext/standard/var_unserializer.re"
 	{
 	/* this is the case where we have less data than planned */
 	php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Unexpected end of serialized data");
 	return 0; /* not sure if it should be 0 or 1 here? */
 }
-#line 602 "ext/standard/var_unserializer.c"
+#line 599 "ext/standard/var_unserializer.c"
 yy16:
 	yych = *++YYCURSOR;
 	goto yy3;
@@ -629,7 +626,7 @@ yy20:
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 692 "ext/standard/var_unserializer.re"
+#line 687 "ext/standard/var_unserializer.re"
 	{
 	size_t len, len2, len3, maxlen;
 	long elements;
@@ -645,11 +642,10 @@ yy20:
 	zval **args[1];
 	zval *arg_func_name;

-    if (!var_hash) return 0;
 	if (*start == 'C') {
 		custom_object = 1;
 	}
-
+	
 	INIT_PZVAL(*rval);
 	len2 = len = parse_uiv(start + 2);
 	maxlen = max - YYCURSOR;
@@ -698,14 +694,14 @@ yy20:
 			efree(class_name);
 			return 0;
 		}
-
+		
 		/* Check for unserialize callback */
 		if ((PG(unserialize_callback_func) == NULL) || (PG(unserialize_callback_func)[0] == '\0')) {
 			incomplete_class = 1;
 			ce = PHP_IC_ENTRY;
 			break;
 		}
-
+		
 		/* Call unserialize callback */
 		MAKE_STD_ZVAL(user_func);
 		ZVAL_STRING(user_func, PG(unserialize_callback_func), 1);
@@ -738,7 +734,7 @@ yy20:
 			zval_ptr_dtor(&arg_func_name);
 			return 0;
 		}
-
+		
 		/* The callback function may have defined the class */
 		if (zend_lookup_class(class_name, len2, &pce TSRMLS_CC) == SUCCESS) {
 			ce = *pce;
@@ -766,7 +762,7 @@ yy20:
 		efree(class_name);
 		return ret;
 	}
-
+	
 	elements = object_common1(UNSERIALIZE_PASSTHRU, ce);

 	if (incomplete_class) {
@@ -776,7 +772,7 @@ yy20:

 	return object_common2(UNSERIALIZE_PASSTHRU, elements);
 }
-#line 780 "ext/standard/var_unserializer.c"
+#line 776 "ext/standard/var_unserializer.c"
 yy25:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -801,16 +797,15 @@ yy27:
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 683 "ext/standard/var_unserializer.re"
+#line 679 "ext/standard/var_unserializer.re"
 	{
-    if (!var_hash) return 0;

 	INIT_PZVAL(*rval);
-
+	
 	return object_common2(UNSERIALIZE_PASSTHRU,
 			object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR));
 }
-#line 814 "ext/standard/var_unserializer.c"
+#line 809 "ext/standard/var_unserializer.c"
 yy32:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy33;
@@ -831,12 +826,11 @@ yy34:
 	yych = *++YYCURSOR;
 	if (yych != '{') goto yy18;
 	++YYCURSOR;
-#line 662 "ext/standard/var_unserializer.re"
+#line 659 "ext/standard/var_unserializer.re"
 	{
 	long elements = parse_iv(start + 2);
 	/* use iv() not uiv() in order to check data range */
 	*p = YYCURSOR;
-    if (!var_hash) return 0;

 	if (elements < 0) {
 		return 0;
@@ -852,7 +846,7 @@ yy34:

 	return finish_nested_data(UNSERIALIZE_PASSTHRU);
 }
-#line 856 "ext/standard/var_unserializer.c"
+#line 850 "ext/standard/var_unserializer.c"
 yy39:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy40;
@@ -873,7 +867,7 @@ yy41:
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 633 "ext/standard/var_unserializer.re"
+#line 630 "ext/standard/var_unserializer.re"
 	{
 	size_t len, maxlen;
 	char *str;
@@ -902,7 +896,7 @@ yy41:
 	ZVAL_STRINGL(*rval, str, len, 0);
 	return 1;
 }
-#line 906 "ext/standard/var_unserializer.c"
+#line 900 "ext/standard/var_unserializer.c"
 yy46:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy47;
@@ -923,7 +917,7 @@ yy48:
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 605 "ext/standard/var_unserializer.re"
+#line 602 "ext/standard/var_unserializer.re"
 	{
 	size_t len, maxlen;
 	char *str;
@@ -951,7 +945,7 @@ yy48:
 	ZVAL_STRINGL(*rval, str, len, 1);
 	return 1;
 }
-#line 955 "ext/standard/var_unserializer.c"
+#line 949 "ext/standard/var_unserializer.c"
 yy53:
 	yych = *++YYCURSOR;
 	if (yych <= '/') {
@@ -1039,7 +1033,7 @@ yy61:
 	}
 yy63:
 	++YYCURSOR;
-#line 595 "ext/standard/var_unserializer.re"
+#line 592 "ext/standard/var_unserializer.re"
 	{
 #if SIZEOF_LONG == 4
 use_double:
@@ -1049,7 +1043,7 @@ use_double:
 	ZVAL_DOUBLE(*rval, zend_strtod((const char *)start + 2, NULL));
 	return 1;
 }
-#line 1053 "ext/standard/var_unserializer.c"
+#line 1047 "ext/standard/var_unserializer.c"
 yy65:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1108,7 +1102,7 @@ yy73:
 	yych = *++YYCURSOR;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 580 "ext/standard/var_unserializer.re"
+#line 577 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
@@ -1123,7 +1117,7 @@ yy73:

 	return 1;
 }
-#line 1127 "ext/standard/var_unserializer.c"
+#line 1121 "ext/standard/var_unserializer.c"
 yy76:
 	yych = *++YYCURSOR;
 	if (yych == 'N') goto yy73;
@@ -1150,7 +1144,7 @@ yy79:
 	if (yych <= '9') goto yy79;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 553 "ext/standard/var_unserializer.re"
+#line 550 "ext/standard/var_unserializer.re"
 	{
 #if SIZEOF_LONG == 4
 	int digits = YYCURSOR - start - 3;
@@ -1177,7 +1171,7 @@ yy79:
 	ZVAL_LONG(*rval, parse_iv(start + 2));
 	return 1;
 }
-#line 1181 "ext/standard/var_unserializer.c"
+#line 1175 "ext/standard/var_unserializer.c"
 yy83:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy18;
@@ -1185,24 +1179,24 @@ yy83:
 	yych = *++YYCURSOR;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 546 "ext/standard/var_unserializer.re"
+#line 543 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
 	ZVAL_BOOL(*rval, parse_iv(start + 2));
 	return 1;
 }
-#line 1196 "ext/standard/var_unserializer.c"
+#line 1190 "ext/standard/var_unserializer.c"
 yy87:
 	++YYCURSOR;
-#line 539 "ext/standard/var_unserializer.re"
+#line 536 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
 	ZVAL_NULL(*rval);
 	return 1;
 }
-#line 1206 "ext/standard/var_unserializer.c"
+#line 1200 "ext/standard/var_unserializer.c"
 yy89:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1225,7 +1219,7 @@ yy91:
 	if (yych <= '9') goto yy91;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 516 "ext/standard/var_unserializer.re"
+#line 513 "ext/standard/var_unserializer.re"
 	{
 	long id;

@@ -1245,10 +1239,10 @@ yy91:
 	*rval = *rval_ref;
 	Z_ADDREF_PP(rval);
 	Z_UNSET_ISREF_PP(rval);
-
+	
 	return 1;
 }
-#line 1252 "ext/standard/var_unserializer.c"
+#line 1246 "ext/standard/var_unserializer.c"
 yy95:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1271,7 +1265,7 @@ yy97:
 	if (yych <= '9') goto yy97;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 495 "ext/standard/var_unserializer.re"
+#line 492 "ext/standard/var_unserializer.re"
 	{
 	long id;

@@ -1284,17 +1278,17 @@ yy97:
 	}

 	if (*rval != NULL) {
-		var_push_dtor_no_addref(var_hash, rval);
+		zval_ptr_dtor(rval);
 	}
 	*rval = *rval_ref;
 	Z_ADDREF_PP(rval);
 	Z_SET_ISREF_PP(rval);
-
+	
 	return 1;
 }
-#line 1296 "ext/standard/var_unserializer.c"
+#line 1290 "ext/standard/var_unserializer.c"
 }
-#line 847 "ext/standard/var_unserializer.re"
+#line 841 "ext/standard/var_unserializer.re"


 	return 0;
@@ -67,7 +67,7 @@ PHPAPI void var_push_dtor(php_unserialize_data_t *var_hashx, zval **rval)

 	var_hash = (*var_hashx)->last_dtor;
 #if VAR_ENTRIES_DBG
-	fprintf(stderr, "var_push_dtor(%p, %ld): %d\n", *rval, var_hash?var_hash->used_slots:-1L, Z_TYPE_PP(rval));
+	fprintf(stderr, "var_push_dtor(%ld): %d\n", var_hash?var_hash->used_slots:-1L, Z_TYPE_PP(rval));
 #endif

 	if (!var_hash || var_hash->used_slots == VAR_ENTRIES_MAX) {
@@ -90,15 +90,9 @@ PHPAPI void var_push_dtor(php_unserialize_data_t *var_hashx, zval **rval)

 PHPAPI void var_push_dtor_no_addref(php_unserialize_data_t *var_hashx, zval **rval)
 {
-	var_entries *var_hash;
-
-    if (!var_hashx || !*var_hashx) {
-        return;
-    }
-
-    var_hash = (*var_hashx)->last_dtor;
+	var_entries *var_hash = (*var_hashx)->last_dtor;
 #if VAR_ENTRIES_DBG
-	fprintf(stderr, "var_push_dtor_no_addref(%p, %ld): %d (%d)\n", *rval, var_hash?var_hash->used_slots:-1L, Z_TYPE_PP(rval), Z_REFCOUNT_PP(rval));
+	fprintf(stderr, "var_push_dtor_no_addref(%ld): %d (%d)\n", var_hash?var_hash->used_slots:-1L, Z_TYPE_PP(rval), Z_REFCOUNT_PP(rval));
 #endif

 	if (!var_hash || var_hash->used_slots == VAR_ENTRIES_MAX) {
@@ -125,7 +119,7 @@ PHPAPI void var_replace(php_unserialize_data_t *var_hashx, zval *ozval, zval **n
 #if VAR_ENTRIES_DBG
 	fprintf(stderr, "var_replace(%ld): %d\n", var_hash?var_hash->used_slots:-1L, Z_TYPE_PP(nzval));
 #endif
-
+	
 	while (var_hash) {
 		for (i = 0; i < var_hash->used_slots; i++) {
 			if (var_hash->data[i] == ozval) {
@@ -143,7 +137,7 @@ static int var_access(php_unserialize_data_t *var_hashx, long id, zval ***store)
 #if VAR_ENTRIES_DBG
 	fprintf(stderr, "var_access(%ld): %ld\n", var_hash?var_hash->used_slots:-1L, id);
 #endif
-
+		
 	while (id >= VAR_ENTRIES_MAX && var_hash && var_hash->used_slots == VAR_ENTRIES_MAX) {
 		var_hash = var_hash->next;
 		id -= VAR_ENTRIES_MAX;
@@ -166,7 +160,7 @@ PHPAPI void var_destroy(php_unserialize_data_t *var_hashx)
 #if VAR_ENTRIES_DBG
 	fprintf(stderr, "var_destroy(%ld)\n", var_hash?var_hash->used_slots:-1L);
 #endif
-
+	
 	while (var_hash) {
 		next = var_hash->next;
 		efree(var_hash);
@@ -174,12 +168,9 @@ PHPAPI void var_destroy(php_unserialize_data_t *var_hashx)
 	}

 	var_hash = (*var_hashx)->first_dtor;
-
+	
 	while (var_hash) {
 		for (i = 0; i < var_hash->used_slots; i++) {
-#if VAR_ENTRIES_DBG
-    fprintf(stderr, "var_destroy dtor(%p, %ld)\n", var_hash->data[i], Z_REFCOUNT_P(var_hash->data[i]));
-#endif
 			zval_ptr_dtor(&var_hash->data[i]);
 		}
 		next = var_hash->next;
@@ -264,7 +255,7 @@ static inline long parse_iv2(const unsigned char *p, const unsigned char **q)
 		case '+':
 			p++;
 	}
-
+	
 	while (1) {
 		cursor = (char)*p;
 		if (cursor >= '0' && cursor <= '9') {
@@ -293,7 +284,7 @@ static inline size_t parse_uiv(const unsigned char *p)
 	if (*p == '+') {
 		p++;
 	}
-
+	
 	while (1) {
 		cursor = *p;
 		if (cursor >= '0' && cursor <= '9') {
@@ -317,20 +308,24 @@ static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, long
 		ALLOC_INIT_ZVAL(key);

 		if (!php_var_unserialize(&key, p, max, NULL TSRMLS_CC)) {
-            var_push_dtor_no_addref(var_hash, &key);
+			zval_dtor(key);
+			FREE_ZVAL(key);
 			return 0;
 		}

 		if (Z_TYPE_P(key) != IS_LONG && Z_TYPE_P(key) != IS_STRING) {
-            var_push_dtor_no_addref(var_hash, &key);
+			zval_dtor(key);
+			FREE_ZVAL(key);
 			return 0;
 		}

 		ALLOC_INIT_ZVAL(data);

 		if (!php_var_unserialize(&data, p, max, var_hash TSRMLS_CC)) {
-            var_push_dtor_no_addref(var_hash, &key);
-            var_push_dtor_no_addref(var_hash, &data);
+			zval_dtor(key);
+			FREE_ZVAL(key);
+			zval_dtor(data);
+			FREE_ZVAL(data);
 			return 0;
 		}

@@ -359,7 +354,9 @@ static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, long
 					sizeof data, NULL);
 		}
 		var_push_dtor(var_hash, &data);
-        var_push_dtor_no_addref(var_hash, &key);
+		
+		zval_dtor(key);
+		FREE_ZVAL(key);

 		if (elements && *(*p-1) != ';' && *(*p-1) != '}') {
 			(*p)--;
@@ -409,11 +406,11 @@ static inline int object_custom(UNSERIALIZE_PARAMETER, zend_class_entry *ce)
 static inline long object_common1(UNSERIALIZE_PARAMETER, zend_class_entry *ce)
 {
 	long elements;
-
+	
 	elements = parse_iv2((*p) + 2, p);

 	(*p) += 2;
-
+	
 	/* The internal class check here is a BC fix only, userspace classes implementing the
 	Serializable interface have eventually an inconsistent behavior at this place when
 	unserialized from a manipulated string. Additionaly the interal classes can possibly
@@ -477,19 +474,19 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)

 	limit = max;
 	cursor = *p;
-
+	
 	if (YYCURSOR >= YYLIMIT) {
 		return 0;
 	}
-
+	
 	if (var_hash && cursor[0] != 'R') {
 		var_push(var_hash, rval);
 	}

 	start = cursor;

-
-
+	
+	
 /*!re2c

 "R:" iv ";"		{
@@ -504,12 +501,12 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 	}

 	if (*rval != NULL) {
-		var_push_dtor_no_addref(var_hash, rval);
+		zval_ptr_dtor(rval);
 	}
 	*rval = *rval_ref;
 	Z_ADDREF_PP(rval);
 	Z_SET_ISREF_PP(rval);
-
+	
 	return 1;
 }

@@ -532,7 +529,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 	*rval = *rval_ref;
 	Z_ADDREF_PP(rval);
 	Z_UNSET_ISREF_PP(rval);
-
+	
 	return 1;
 }

@@ -663,7 +660,6 @@ use_double:
 	long elements = parse_iv(start + 2);
 	/* use iv() not uiv() in order to check data range */
 	*p = YYCURSOR;
-    if (!var_hash) return 0;

 	if (elements < 0) {
 		return 0;
@@ -681,10 +677,9 @@ use_double:
 }

 "o:" iv ":" ["] {
-    if (!var_hash) return 0;

 	INIT_PZVAL(*rval);
-
+	
 	return object_common2(UNSERIALIZE_PASSTHRU,
 			object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR));
 }
@@ -704,11 +699,10 @@ object ":" uiv ":" ["]	{
 	zval **args[1];
 	zval *arg_func_name;

-    if (!var_hash) return 0;
 	if (*start == 'C') {
 		custom_object = 1;
 	}
-
+	
 	INIT_PZVAL(*rval);
 	len2 = len = parse_uiv(start + 2);
 	maxlen = max - YYCURSOR;
@@ -757,14 +751,14 @@ object ":" uiv ":" ["]	{
 			efree(class_name);
 			return 0;
 		}
-
+		
 		/* Check for unserialize callback */
 		if ((PG(unserialize_callback_func) == NULL) || (PG(unserialize_callback_func)[0] == '\0')) {
 			incomplete_class = 1;
 			ce = PHP_IC_ENTRY;
 			break;
 		}
-
+		
 		/* Call unserialize callback */
 		MAKE_STD_ZVAL(user_func);
 		ZVAL_STRING(user_func, PG(unserialize_callback_func), 1);
@@ -797,7 +791,7 @@ object ":" uiv ":" ["]	{
 			zval_ptr_dtor(&arg_func_name);
 			return 0;
 		}
-
+		
 		/* The callback function may have defined the class */
 		if (zend_lookup_class(class_name, len2, &pce TSRMLS_CC) == SUCCESS) {
 			ce = *pce;
@@ -825,7 +819,7 @@ object ":" uiv ":" ["]	{
 		efree(class_name);
 		return ret;
 	}
-
+	
 	elements = object_common1(UNSERIALIZE_PASSTHRU, ce);

 	if (incomplete_class) {
@@ -81,10 +81,10 @@ ZEND_END_ARG_INFO();
 /* }}} */

 /*
-* class xsl_xsltprocessor
+* class xsl_xsltprocessor 
 *
 * URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#
-* Since:
+* Since: 
 */

 const zend_function_entry php_xsl_xsltprocessor_class_functions[] = {
@@ -111,9 +111,9 @@ static char *php_xsl_xslt_string_to_xpathexpr(const char *str TSRMLS_DC)

 	xmlChar *value;
 	int str_len;
-
+	
 	str_len = xmlStrlen(string) + 3;
-
+	
 	if (xmlStrchr(string, '"')) {
 		if (xmlStrchr(string, '\'')) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot create XPath expression (string contains both quote and double-quotes)");
@@ -133,7 +133,7 @@ static char *php_xsl_xslt_string_to_xpathexpr(const char *str TSRMLS_DC)
   Translates a PHP array to a libxslt parameters array */
 static char **php_xsl_xslt_make_params(HashTable *parht, int xpath_params TSRMLS_DC)
 {
-
+	
 	int parsize;
 	zval **value;
 	char *xpath_expr, *string_key = NULL;
@@ -158,7 +158,7 @@ static char **php_xsl_xslt_make_params(HashTable *parht, int xpath_params TSRMLS
 				SEPARATE_ZVAL(value);
 				convert_to_string(*value);
 			}
-
+			
 			if (!xpath_params) {
 				xpath_expr = php_xsl_xslt_string_to_xpathexpr(Z_STRVAL_PP(value) TSRMLS_CC);
 			} else {
@@ -192,7 +192,7 @@ static void xsl_ext_function_php(xmlXPathParserContextPtr ctxt, int nargs, int t
 	char *str;
 	char *callable = NULL;
 	xsl_object *intern;
-
+	
 	TSRMLS_FETCH();

 	if (! zend_is_executing(TSRMLS_C)) {
@@ -219,17 +219,15 @@ static void xsl_ext_function_php(xmlXPathParserContextPtr ctxt, int nargs, int t
 			}
 		}
 	}
-
+	
 	if (error == 1) {
 		for (i = nargs - 1; i >= 0; i--) {
 			obj = valuePop(ctxt);
-			if (obj) {
-				xmlXPathFreeObject(obj);
-			}
+			xmlXPathFreeObject(obj);
 		}
 		return;
 	}
-
+		
 	fci.param_count = nargs - 1;
 	if (fci.param_count > 0) {
 		fci.params = safe_emalloc(fci.param_count, sizeof(zval**), 0);
@@ -267,7 +265,7 @@ static void xsl_ext_function_php(xmlXPathParserContextPtr ctxt, int nargs, int t
 							if (node->type == XML_NAMESPACE_DECL) {
 								xmlNsPtr curns;
 								xmlNodePtr nsparent;
-
+								
 								nsparent = node->_private;
 								curns = xmlNewNs(NULL, node->name, NULL);
 								if (node->children) {
@@ -299,16 +297,14 @@ static void xsl_ext_function_php(xmlXPathParserContextPtr ctxt, int nargs, int t
 		xmlXPathFreeObject(obj);
 		fci.params[i] = &args[i];
 	}
-
+	
 	fci.size = sizeof(fci);
 	fci.function_table = EG(function_table);
-
+	
 	obj = valuePop(ctxt);
-	if (obj == NULL || obj->stringval == NULL) {
-		if (obj) {
-			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Handler name must be a string");
-			xmlXPathFreeObject(obj);
-		}
+	if (obj->stringval == NULL) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Handler name must be a string");
+		xmlXPathFreeObject(obj);
 		valuePush(ctxt, xmlXPathNewString(""));
 		if (fci.param_count > 0) {
 			for (i = 0; i < nargs - 1; i++) {
@@ -317,12 +313,12 @@ static void xsl_ext_function_php(xmlXPathParserContextPtr ctxt, int nargs, int t
 			efree(args);
 			efree(fci.params);
 		}
-		return;
+		return; 
 	}
 	INIT_PZVAL(&handler);
 	ZVAL_STRING(&handler, obj->stringval, 1);
 	xmlXPathFreeObject(obj);
-
+	
 	fci.function_name = &handler;
 	fci.symbol_table = NULL;
 	fci.object_ptr = NULL;
@@ -332,7 +328,7 @@ static void xsl_ext_function_php(xmlXPathParserContextPtr ctxt, int nargs, int t
 	if (!zend_make_callable(&handler, &callable TSRMLS_CC)) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to call handler %s()", callable);
 		valuePush(ctxt, xmlXPathNewString(""));
-	} else if ( intern->registerPhpFunctions == 2 && zend_hash_exists(intern->registered_phpfunctions, callable, strlen(callable) + 1) == 0) {
+	} else if ( intern->registerPhpFunctions == 2 && zend_hash_exists(intern->registered_phpfunctions, callable, strlen(callable) + 1) == 0) { 
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Not allowed to call handler '%s()'", callable);
 		/* Push an empty string, so that we at least have an xslt result... */
 		valuePush(ctxt, xmlXPathNewString(""));
@@ -396,7 +392,7 @@ void xsl_ext_function_object_php(xmlXPathParserContextPtr ctxt, int nargs) /* {{

 /* {{{ proto void xsl_xsltprocessor_import_stylesheet(domdocument doc);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#
-Since:
+Since: 
 */
 PHP_FUNCTION(xsl_xsltprocessor_import_stylesheet)
 {
@@ -408,13 +404,13 @@ PHP_FUNCTION(xsl_xsltprocessor_import_stylesheet)
 	xmlNode *nodep = NULL;
 	zend_object_handlers *std_hnd;
 	zval *cloneDocu, *member;
-
+	
 	if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Oo", &id, xsl_xsltprocessor_class_entry, &docp) == FAILURE) {
 		RETURN_FALSE;
 	}

 	nodep = php_libxml_import_node(docp TSRMLS_CC);
-
+	
 	if (nodep) {
 		doc = nodep->doc;
 	}
@@ -423,7 +419,7 @@ PHP_FUNCTION(xsl_xsltprocessor_import_stylesheet)
 		RETURN_FALSE;
 	}

-	/* libxslt uses _private, so we must copy the imported
+	/* libxslt uses _private, so we must copy the imported 
 	stylesheet document otherwise the node proxies will be a mess */
 	newdoc = xmlCopyDoc(doc, 1);
 	xmlNodeSetBase((xmlNodePtr) newdoc, (xmlChar *)doc->URL);
@@ -440,7 +436,7 @@ PHP_FUNCTION(xsl_xsltprocessor_import_stylesheet)
 		RETURN_FALSE;
 	}

-	intern = (xsl_object *)zend_object_store_get_object(id TSRMLS_CC);
+	intern = (xsl_object *)zend_object_store_get_object(id TSRMLS_CC); 

 	std_hnd = zend_get_std_object_handlers();
 	MAKE_STD_ZVAL(member);
@@ -467,10 +463,10 @@ PHP_FUNCTION(xsl_xsltprocessor_import_stylesheet)
 		intern->hasKeys = clone_docu;
 	}

-	if ((oldsheetp = (xsltStylesheetPtr)intern->ptr)) {
+	if ((oldsheetp = (xsltStylesheetPtr)intern->ptr)) { 
 		/* free wrapper */
 		if (((xsltStylesheetPtr) intern->ptr)->_private != NULL) {
-			((xsltStylesheetPtr) intern->ptr)->_private = NULL;
+			((xsltStylesheetPtr) intern->ptr)->_private = NULL;   
 		}
 		xsltFreeStylesheet((xsltStylesheetPtr) intern->ptr);
 		intern->ptr = NULL;
@@ -498,7 +494,7 @@ static xmlDocPtr php_xsl_apply_stylesheet(zval *id, xsl_object *intern, xsltStyl
 	xsltSecurityPrefsPtr secPrefs = NULL;

 	node = php_libxml_import_node(docp TSRMLS_CC);
-
+	
 	if (node) {
 		doc = node->doc;
 	}
@@ -511,7 +507,7 @@ static xmlDocPtr php_xsl_apply_stylesheet(zval *id, xsl_object *intern, xsltStyl
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "No stylesheet associated to this object");
 		return NULL;
 	}
-
+	
 	if (intern->profiling) {
 		if (php_check_open_basedir(intern->profiling TSRMLS_CC)) {
 			f = NULL;
@@ -521,7 +517,7 @@ static xmlDocPtr php_xsl_apply_stylesheet(zval *id, xsl_object *intern, xsltStyl
 	} else {
 		f = NULL;
 	}
-
+	
 	if (intern->parameter) {
 		params = php_xsl_xslt_make_params(intern->parameter, 0 TSRMLS_CC);
 	}
@@ -553,7 +549,7 @@ static xmlDocPtr php_xsl_apply_stylesheet(zval *id, xsl_object *intern, xsltStyl
 	efree(member);

 	secPrefsValue = intern->securityPrefs;
-
+	
 	/* This whole if block can be removed, when we remove the xsl.security_prefs php.ini option in PHP 6+ */
 	secPrefsIni= INI_INT("xsl.security_prefs");
 	/* if secPrefsIni has the same value as secPrefsValue, all is fine */
@@ -573,38 +569,38 @@ static xmlDocPtr php_xsl_apply_stylesheet(zval *id, xsl_object *intern, xsltStyl

 	/* if securityPrefs is set to NONE, we don't have to do any checks, but otherwise... */
 	if (secPrefsValue != XSL_SECPREF_NONE) {
-		secPrefs = xsltNewSecurityPrefs();
-		if (secPrefsValue & XSL_SECPREF_READ_FILE ) {
-			if (0 != xsltSetSecurityPrefs(secPrefs, XSLT_SECPREF_READ_FILE, xsltSecurityForbid)) {
+		secPrefs = xsltNewSecurityPrefs(); 
+		if (secPrefsValue & XSL_SECPREF_READ_FILE ) { 
+			if (0 != xsltSetSecurityPrefs(secPrefs, XSLT_SECPREF_READ_FILE, xsltSecurityForbid)) { 
 				secPrefsError = 1;
 			}
 		}
-		if (secPrefsValue & XSL_SECPREF_WRITE_FILE ) {
-			if (0 != xsltSetSecurityPrefs(secPrefs, XSLT_SECPREF_WRITE_FILE, xsltSecurityForbid)) {
+		if (secPrefsValue & XSL_SECPREF_WRITE_FILE ) { 
+			if (0 != xsltSetSecurityPrefs(secPrefs, XSLT_SECPREF_WRITE_FILE, xsltSecurityForbid)) { 
 				secPrefsError = 1;
 			}
 		}
-		if (secPrefsValue & XSL_SECPREF_CREATE_DIRECTORY ) {
-			if (0 != xsltSetSecurityPrefs(secPrefs, XSLT_SECPREF_CREATE_DIRECTORY, xsltSecurityForbid)) {
+		if (secPrefsValue & XSL_SECPREF_CREATE_DIRECTORY ) { 
+			if (0 != xsltSetSecurityPrefs(secPrefs, XSLT_SECPREF_CREATE_DIRECTORY, xsltSecurityForbid)) { 
 				secPrefsError = 1;
 			}
 		}
-		if (secPrefsValue & XSL_SECPREF_READ_NETWORK) {
-			if (0 != xsltSetSecurityPrefs(secPrefs, XSLT_SECPREF_READ_NETWORK, xsltSecurityForbid)) {
+		if (secPrefsValue & XSL_SECPREF_READ_NETWORK) { 
+			if (0 != xsltSetSecurityPrefs(secPrefs, XSLT_SECPREF_READ_NETWORK, xsltSecurityForbid)) { 
 				secPrefsError = 1;
 			}
 		}
-		if (secPrefsValue & XSL_SECPREF_WRITE_NETWORK) {
-			if (0 != xsltSetSecurityPrefs(secPrefs, XSLT_SECPREF_WRITE_NETWORK, xsltSecurityForbid)) {
+		if (secPrefsValue & XSL_SECPREF_WRITE_NETWORK) { 
+			if (0 != xsltSetSecurityPrefs(secPrefs, XSLT_SECPREF_WRITE_NETWORK, xsltSecurityForbid)) { 
 				secPrefsError = 1;
 			}
 		}
-
-		if (0 != xsltSetCtxtSecurityPrefs(secPrefs, ctxt)) {
+	
+		if (0 != xsltSetCtxtSecurityPrefs(secPrefs, ctxt)) { 
 			secPrefsError = 1;
 		}
 	}
-
+	
 	if (secPrefsError == 1) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Can't set libxslt security properties, not doing transformation for security reasons");
 	} else {
@@ -613,7 +609,7 @@ static xmlDocPtr php_xsl_apply_stylesheet(zval *id, xsl_object *intern, xsltStyl
 	if (f) {
 		fclose(f);
 	}
-
+	
 	xsltFreeTransformContext(ctxt);
 	if (secPrefs) {
 		xsltFreeSecurityPrefs(secPrefs);
@@ -621,7 +617,7 @@ static xmlDocPtr php_xsl_apply_stylesheet(zval *id, xsl_object *intern, xsltStyl

 	if (intern->node_list != NULL) {
 		zend_hash_destroy(intern->node_list);
-		FREE_HASHTABLE(intern->node_list);
+		FREE_HASHTABLE(intern->node_list);	
 		intern->node_list = NULL;
 	}

@@ -644,7 +640,7 @@ static xmlDocPtr php_xsl_apply_stylesheet(zval *id, xsl_object *intern, xsltStyl

 /* {{{ proto domdocument xsl_xsltprocessor_transform_to_doc(domnode doc);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#
-Since:
+Since: 
 */
 PHP_FUNCTION(xsl_xsltprocessor_transform_to_doc)
 {
@@ -681,13 +677,13 @@ PHP_FUNCTION(xsl_xsltprocessor_transform_to_doc)
 			found = zend_lookup_class(ret_class, ret_class_len, &ce TSRMLS_CC);
 			if ((found != SUCCESS) || !instanceof_function(*ce, curce TSRMLS_CC)) {
 				xmlFreeDoc(newdocp);
-				php_error_docref(NULL TSRMLS_CC, E_WARNING,
+				php_error_docref(NULL TSRMLS_CC, E_WARNING, 
 					"Expecting class compatible with %s, '%s' given", curclass_name, ret_class);
 				RETURN_FALSE;
 			}

 			object_init_ex(return_value, *ce);
-
+		
 			interndoc = (php_libxml_node_object *)zend_objects_get_address(return_value TSRMLS_CC);
 			php_libxml_increment_doc_ref(interndoc, newdocp TSRMLS_CC);
 			php_libxml_increment_node_ptr(interndoc, (xmlNodePtr)newdocp, (void *)interndoc TSRMLS_CC);
@@ -697,7 +693,7 @@ PHP_FUNCTION(xsl_xsltprocessor_transform_to_doc)
 	} else {
 		RETURN_FALSE;
 	}
-
+	
 }
 /* }}} end xsl_xsltprocessor_transform_to_doc */

@@ -711,7 +707,7 @@ PHP_FUNCTION(xsl_xsltprocessor_transform_to_uri)
 	int ret, uri_len;
 	char *uri;
 	xsl_object *intern;
-
+	
 	id = getThis();
 	intern = (xsl_object *)zend_object_store_get_object(id TSRMLS_CC);
 	sheetp = (xsltStylesheetPtr) intern->ptr;
@@ -743,7 +739,7 @@ PHP_FUNCTION(xsl_xsltprocessor_transform_to_xml)
 	xmlChar *doc_txt_ptr;
 	int doc_txt_len;
 	xsl_object *intern;
-
+	
 	id = getThis();
 	intern = (xsl_object *)zend_object_store_get_object(id TSRMLS_CC);
 	sheetp = (xsltStylesheetPtr) intern->ptr;
@@ -774,7 +770,7 @@ PHP_FUNCTION(xsl_xsltprocessor_transform_to_xml)
 */
 PHP_FUNCTION(xsl_xsltprocessor_set_parameter)
 {
-
+ 
 	zval *id;
 	zval *array_value, **entry, *new_string;
 	xsl_object *intern;
@@ -790,34 +786,34 @@ PHP_FUNCTION(xsl_xsltprocessor_set_parameter)
 		while (zend_hash_get_current_data(Z_ARRVAL_P(array_value), (void **)&entry) == SUCCESS) {
 			SEPARATE_ZVAL(entry);
 			convert_to_string_ex(entry);
-
+			
 			if (zend_hash_get_current_key_ex(Z_ARRVAL_P(array_value), &string_key, &string_key_len, &idx, 0, NULL) != HASH_KEY_IS_STRING) {
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid parameter array");
 				RETURN_FALSE;
 			}
-
+			
 			ALLOC_ZVAL(new_string);
 			Z_ADDREF_PP(entry);
 			COPY_PZVAL_TO_ZVAL(*new_string, *entry);
-
+			
 			zend_hash_update(intern->parameter, string_key, string_key_len, &new_string, sizeof(zval*), NULL);
 			zend_hash_move_forward(Z_ARRVAL_P(array_value));
 		}
 		RETURN_TRUE;

 	} else if (zend_parse_parameters_ex(ZEND_PARSE_PARAMS_QUIET, ZEND_NUM_ARGS() TSRMLS_CC, "sss", &namespace, &namespace_len, &name, &name_len, &value, &value_len) == SUCCESS) {
-
+		
 		intern = (xsl_object *)zend_object_store_get_object(id TSRMLS_CC);
-
+		
 		MAKE_STD_ZVAL(new_string);
 		ZVAL_STRING(new_string, value, 1);
-
+		
 		zend_hash_update(intern->parameter, name, name_len + 1, &new_string, sizeof(zval*), NULL);
 		RETURN_TRUE;
 	} else {
 		WRONG_PARAM_COUNT;
 	}
-
+	
 }
 /* }}} end xsl_xsltprocessor_set_parameter */

@@ -832,7 +828,7 @@ PHP_FUNCTION(xsl_xsltprocessor_get_parameter)
 	xsl_object *intern;

 	DOM_GET_THIS(id);
-
+	
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ss", &namespace, &namespace_len, &name, &name_len) == FAILURE) {
 		RETURN_FALSE;
 	}
@@ -856,7 +852,7 @@ PHP_FUNCTION(xsl_xsltprocessor_remove_parameter)
 	xsl_object *intern;

 	DOM_GET_THIS(id);
-
+	
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ss", &namespace, &namespace_len, &name, &name_len) == FAILURE) {
 		RETURN_FALSE;
 	}
@@ -880,7 +876,7 @@ PHP_FUNCTION(xsl_xsltprocessor_register_php_functions)
 	char *name;

 	DOM_GET_THIS(id);
-
+	
 	if (zend_parse_parameters_ex(ZEND_PARSE_PARAMS_QUIET, ZEND_NUM_ARGS() TSRMLS_CC, "a",  &array_value) == SUCCESS) {
 		intern = (xsl_object *)zend_object_store_get_object(id TSRMLS_CC);
 		zend_hash_internal_pointer_reset(Z_ARRVAL_P(array_value));
@@ -888,10 +884,10 @@ PHP_FUNCTION(xsl_xsltprocessor_register_php_functions)
 		while (zend_hash_get_current_data(Z_ARRVAL_P(array_value), (void **)&entry) == SUCCESS) {
 			SEPARATE_ZVAL(entry);
 			convert_to_string_ex(entry);
-
+			
 			MAKE_STD_ZVAL(new_string);
 			ZVAL_LONG(new_string,1);
-
+		
 			zend_hash_update(intern->registered_phpfunctions, Z_STRVAL_PP(entry), Z_STRLEN_PP(entry) + 1, &new_string, sizeof(zval*), NULL);
 			zend_hash_move_forward(Z_ARRVAL_P(array_value));
 		}
@@ -899,17 +895,17 @@ PHP_FUNCTION(xsl_xsltprocessor_register_php_functions)

 	} else if (zend_parse_parameters_ex(ZEND_PARSE_PARAMS_QUIET, ZEND_NUM_ARGS() TSRMLS_CC, "s",  &name, &name_len) == SUCCESS) {
 		intern = (xsl_object *)zend_object_store_get_object(id TSRMLS_CC);
-
+		
 		MAKE_STD_ZVAL(new_string);
 		ZVAL_LONG(new_string,1);
 		zend_hash_update(intern->registered_phpfunctions, name, name_len + 1, &new_string, sizeof(zval*), NULL);
 		intern->registerPhpFunctions = 2;
-
+		
 	} else {
 		intern = (xsl_object *)zend_object_store_get_object(id TSRMLS_CC);
 		intern->registerPhpFunctions = 1;
 	}
-
+	
 }
 /* }}} end xsl_xsltprocessor_register_php_functions(); */

@@ -951,7 +947,7 @@ PHP_FUNCTION(xsl_xsltprocessor_set_security_prefs)
 		return;
 	}
 	intern = (xsl_object *)zend_object_store_get_object(id TSRMLS_CC);
-	oldSecurityPrefs = intern->securityPrefs;
+	oldSecurityPrefs = intern->securityPrefs; 
 	intern->securityPrefs = securityPrefs;
 	/* set this to 1 so that we know, it was set through this method. Can be removed, when we remove the ini setting */
 	intern->securityPrefsSet = 1;
@@ -133,7 +133,7 @@ static char * php_zip_make_relative_path(char *path, int path_len) /* {{{ */
 }
 /* }}} */

-#ifdef PHP_ZIP_USE_OO
+#ifdef PHP_ZIP_USE_OO 
 /* {{{ php_zip_extract_file */
 static int php_zip_extract_file(struct zip * za, char *dest, char *file, int file_len TSRMLS_DC)
 {
@@ -174,7 +174,7 @@ static int php_zip_extract_file(struct zip * za, char *dest, char *file, int fil

 	/* it is a directory only, see #40228 */
 	if (path_cleaned_len > 1 && IS_SLASH(path_cleaned[path_cleaned_len - 1])) {
-		len = spprintf(&file_dirname_fullpath, 0, "%s/%s", dest, path_cleaned);
+		len = spprintf(&file_dirname_fullpath, 0, "%s/%s", dest, file);
 		is_dir_only = 1;
 	} else {
 		memcpy(file_dirname, path_cleaned, path_cleaned_len);
@@ -295,7 +295,7 @@ done:
 }
 /* }}} */

-static int php_zip_add_file(struct zip *za, const char *filename, size_t filename_len,
+static int php_zip_add_file(struct zip *za, const char *filename, size_t filename_len, 
 	char *entry_name, size_t entry_name_len, long offset_start, long offset_len TSRMLS_DC) /* {{{ */
 {
 	struct zip_source *zs;
@@ -345,7 +345,7 @@ static int php_zip_add_file(struct zip *za, const char *filename, size_t filenam
 }
 /* }}} */

-static int php_zip_parse_options(zval *options, long *remove_all_path,
+static int php_zip_parse_options(zval *options, long *remove_all_path, 
 	char **remove_path, int *remove_path_len, char **add_path, int *add_path_len TSRMLS_DC) /* {{{ */
 {
 	zval **option;
@@ -375,11 +375,11 @@ static int php_zip_parse_options(zval *options, long *remove_all_path,
 		}

 		if (Z_STRLEN_PP(option) >= MAXPATHLEN) {
-			php_error_docref(NULL TSRMLS_CC, E_WARNING, "remove_path string is too long (max: %i, %i given)",
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "remove_path string is too long (max: %i, %i given)", 
 						MAXPATHLEN - 1, Z_STRLEN_PP(option));
 			return -1;
 		}
-		*remove_path_len = Z_STRLEN_PP(option);
+		*remove_path_len = Z_STRLEN_PP(option); 
 		*remove_path = Z_STRVAL_PP(option);
 	}

@@ -395,11 +395,11 @@ static int php_zip_parse_options(zval *options, long *remove_all_path,
 		}

 		if (Z_STRLEN_PP(option) >= MAXPATHLEN) {
-			php_error_docref(NULL TSRMLS_CC, E_WARNING, "add_path string too long (max: %i, %i given)",
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "add_path string too long (max: %i, %i given)", 
 						MAXPATHLEN - 1, Z_STRLEN_PP(option));
 			return -1;
 		}
-		*add_path_len = Z_STRLEN_PP(option);
+		*add_path_len = Z_STRLEN_PP(option); 
 		*add_path = Z_STRVAL_PP(option);
 	}
 	return 1;
@@ -528,7 +528,7 @@ int php_zip_glob(char *pattern, int pattern_len, long flags, zval *return_value
 	glob_t globbuf;
 	int n;
 	int ret;
-
+	
 	if (pattern_len >= MAXPATHLEN) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Pattern exceeds the maximum allowed length of %d characters", MAXPATHLEN);
 		return -1;
@@ -539,9 +539,9 @@ int php_zip_glob(char *pattern, int pattern_len, long flags, zval *return_value
 		return -1;
 	}

-#ifdef ZTS
+#ifdef ZTS 
 	if (!IS_ABSOLUTE_PATH(pattern, pattern_len)) {
-		result = VCWD_GETCWD(cwd, MAXPATHLEN);
+		result = VCWD_GETCWD(cwd, MAXPATHLEN);	
 		if (!result) {
 			cwd[0] = '\0';
 		}
@@ -554,7 +554,7 @@ int php_zip_glob(char *pattern, int pattern_len, long flags, zval *return_value

 		snprintf(work_pattern, MAXPATHLEN, "%s%c%s", cwd, DEFAULT_SLASH, pattern);
 		pattern = work_pattern;
-	}
+	} 
 #endif

 	globbuf.gl_offs = 0;
@@ -564,7 +564,7 @@ int php_zip_glob(char *pattern, int pattern_len, long flags, zval *return_value
 			/* Some glob implementation simply return no data if no matches
 			   were found, others return the GLOB_NOMATCH error code.
 			   We don't want to treat GLOB_NOMATCH as an error condition
-			   so that PHP glob() behaves the same on both types of
+			   so that PHP glob() behaves the same on both types of 
 			   implementations and so that 'foreach (glob() as ...'
 			   can be used for simple glob() calls without further error
 			   checking.
@@ -593,11 +593,11 @@ int php_zip_glob(char *pattern, int pattern_len, long flags, zval *return_value
 	for (n = 0; n < globbuf.gl_pathc; n++) {
 		/* we need to do this everytime since GLOB_ONLYDIR does not guarantee that
 		 * all directories will be filtered. GNU libc documentation states the
-		 * following:
-		 * If the information about the type of the file is easily available
-		 * non-directories will be rejected but no extra work will be done to
-		 * determine the information for each file. I.e., the caller must still be
-		 * able to filter directories out.
+		 * following: 
+		 * If the information about the type of the file is easily available 
+		 * non-directories will be rejected but no extra work will be done to 
+		 * determine the information for each file. I.e., the caller must still be 
+		 * able to filter directories out. 
 		 */
 		if (flags & GLOB_ONLYDIR) {
 			struct stat s;
@@ -633,9 +633,9 @@ int php_zip_pcre(char *regexp, int regexp_len, char *path, int path_len, zval *r
 	int files_cnt;
 	char **namelist;

-#ifdef ZTS
+#ifdef ZTS 
 	if (!IS_ABSOLUTE_PATH(path, path_len)) {
-		result = VCWD_GETCWD(cwd, MAXPATHLEN);
+		result = VCWD_GETCWD(cwd, MAXPATHLEN);	
 		if (!result) {
 			cwd[0] = '\0';
 		}
@@ -648,7 +648,7 @@ int php_zip_pcre(char *regexp, int regexp_len, char *path, int path_len, zval *r

 		snprintf(work_path, MAXPATHLEN, "%s%c%s", cwd, DEFAULT_SLASH, path);
 		path = work_path;
-	}
+	} 
 #endif

 	if (ZIP_OPENBASEDIR_CHECKPATH(path)) {
@@ -665,7 +665,7 @@ int php_zip_pcre(char *regexp, int regexp_len, char *path, int path_len, zval *r
 		re = pcre_get_compiled_regex(regexp, &pcre_extra, &preg_options TSRMLS_CC);
 		if (!re) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid expression");
-			return -1;
+			return -1;	
 		}

 		array_init(return_value);
@@ -678,7 +678,7 @@ int php_zip_pcre(char *regexp, int regexp_len, char *path, int path_len, zval *r
 			int    matches;
 			int    namelist_len = strlen(namelist[i]);

-
+			
 			if ((namelist_len == 1 && namelist[i][0] == '.') ||
 				(namelist_len == 2 && namelist[i][0] == '.' && namelist[i][1] == '.')) {
 				efree(namelist[i]);
@@ -686,7 +686,7 @@ int php_zip_pcre(char *regexp, int regexp_len, char *path, int path_len, zval *r
 			}

 			if ((path_len + namelist_len + 1) >= MAXPATHLEN) {
-				php_error_docref(NULL TSRMLS_CC, E_WARNING, "add_path string too long (max: %i, %i given)",
+				php_error_docref(NULL TSRMLS_CC, E_WARNING, "add_path string too long (max: %i, %i given)", 
 						MAXPATHLEN - 1, (path_len + namelist_len + 1));
 				efree(namelist[i]);
 				break;
@@ -709,7 +709,7 @@ int php_zip_pcre(char *regexp, int regexp_len, char *path, int path_len, zval *r
 			/* 0 means that the vector is too small to hold all the captured substring offsets */
 			if (matches < 0) {
 				efree(namelist[i]);
-				continue;
+				continue;	
 			}

 			add_next_index_string(return_value, fullpath, 1);
@@ -785,7 +785,7 @@ static const zend_function_entry zip_functions[] = {
 /* }}} */

 /* {{{ ZE2 OO definitions */
-#ifdef PHP_ZIP_USE_OO
+#ifdef PHP_ZIP_USE_OO 
 static zend_class_entry *zip_class_entry;
 static zend_object_handlers zip_object_handlers;

@@ -805,7 +805,7 @@ typedef struct _zip_prop_handler {
 #endif
 /* }}} */

-#ifdef PHP_ZIP_USE_OO
+#ifdef PHP_ZIP_USE_OO 
 static void php_zip_register_prop_handler(HashTable *prop_handler, char *name, zip_read_int_t read_int_func, zip_read_const_char_t read_char_func, zip_read_const_char_from_ze_t read_char_from_obj_func, int rettype TSRMLS_DC) /* {{{ */
 {
 	zip_prop_handler hnd;
@@ -893,7 +893,7 @@ static zval **php_zip_get_property_ptr_ptr(zval *object, zval *member, const zen
 	if (obj->prop_handler != NULL) {
 		if (key) {
 			ret = zend_hash_quick_find(obj->prop_handler, Z_STRVAL_P(member), Z_STRLEN_P(member)+1, key->hash_value, (void **) &hnd);
-		} else {
+		} else {	
 			ret = zend_hash_find(obj->prop_handler, Z_STRVAL_P(member), Z_STRLEN_P(member)+1, (void **) &hnd);
 		}
 	}
@@ -1483,7 +1483,7 @@ static PHP_NAMED_FUNCTION(zif_zip_entry_compressionmethod)
 }
 /* }}} */

-#ifdef PHP_ZIP_USE_OO
+#ifdef PHP_ZIP_USE_OO 
 /* {{{ proto mixed ZipArchive::open(string source [, int flags])
 Create new zip using source uri for output, return TRUE on success or the error code */
 static ZIPARCHIVE_METHOD(open)
@@ -1590,7 +1590,7 @@ static ZIPARCHIVE_METHOD(getStatusString)
 	zip_error_get(intern, &zep, &syp);

 	len = zip_error_to_str(error_string, 128, zep, syp);
-	RETVAL_STRINGL(error_string, len, 1);
+	RETVAL_STRINGL(error_string, len, 1); 
 }
 /* }}} */

@@ -1667,12 +1667,12 @@ static void php_zip_add_from_pattern(INTERNAL_FUNCTION_PARAMETERS, int type) /*
 	ZIP_FROM_OBJECT(intern, this);
 	/* 1 == glob, 2==pcre */
 	if (type == 1) {
-		if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|la",
+		if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|la", 
 					&pattern, &pattern_len, &flags, &options) == FAILURE) {
 			return;
 		}
 	} else {
-		if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|sa",
+		if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|sa", 
 					&pattern, &pattern_len, &path, &path_len, &options) == FAILURE) {
 			return;
 		}
@@ -1724,14 +1724,14 @@ static void php_zip_add_from_pattern(INTERNAL_FUNCTION_PARAMETERS, int type) /*

 				if (add_path) {
 					if ((add_path_len + file_stripped_len) > MAXPATHLEN) {
-						php_error_docref(NULL TSRMLS_CC, E_WARNING, "Entry name too long (max: %d, %ld given)",
+						php_error_docref(NULL TSRMLS_CC, E_WARNING, "Entry name too long (max: %d, %ld given)", 
 						MAXPATHLEN - 1, (add_path_len + file_stripped_len));
 						zval_dtor(return_value);
 						RETURN_FALSE;
 					}

 					snprintf(entry_name_buf, MAXPATHLEN, "%s%s", add_path, file_stripped);
-					entry_name = entry_name_buf;
+					entry_name = entry_name_buf; 
 					entry_name_len = strlen(entry_name);
 				} else {
 					entry_name = Z_STRVAL_PP(zval_file);
@@ -1741,7 +1741,7 @@ static void php_zip_add_from_pattern(INTERNAL_FUNCTION_PARAMETERS, int type) /*
 					efree(basename);
 					basename = NULL;
 				}
-				if (php_zip_add_file(intern, Z_STRVAL_PP(zval_file), Z_STRLEN_PP(zval_file),
+				if (php_zip_add_file(intern, Z_STRVAL_PP(zval_file), Z_STRLEN_PP(zval_file), 
 					entry_name, entry_name_len, 0, 0 TSRMLS_CC) < 0) {
 					zval_dtor(return_value);
 					RETURN_FALSE;
@@ -1801,7 +1801,7 @@ static ZIPARCHIVE_METHOD(addFile)
 		entry_name_len = filename_len;
 	}

-	if (php_zip_add_file(intern, filename, filename_len,
+	if (php_zip_add_file(intern, filename, filename_len, 
 		entry_name, entry_name_len, 0, 0 TSRMLS_CC) < 0) {
 		RETURN_FALSE;
 	} else {
@@ -1865,7 +1865,7 @@ static ZIPARCHIVE_METHOD(addFromString)
 	}
 fail:
 	zip_source_free(zs);
-	RETURN_FALSE;
+	RETURN_FALSE;	
 }
 /* }}} */

@@ -2770,7 +2770,7 @@ static const zend_function_entry zip_class_functions[] = {
 /* {{{ PHP_MINIT_FUNCTION */
 static PHP_MINIT_FUNCTION(zip)
 {
-#ifdef PHP_ZIP_USE_OO
+#ifdef PHP_ZIP_USE_OO 
 	zend_class_entry ce;

 	memcpy(&zip_object_handlers, zend_get_std_object_handlers(), sizeof(zend_object_handlers));
@@ -2859,7 +2859,7 @@ static PHP_MINIT_FUNCTION(zip)
 */
 static PHP_MSHUTDOWN_FUNCTION(zip)
 {
-#ifdef PHP_ZIP_USE_OO
+#ifdef PHP_ZIP_USE_OO 
 	zend_hash_destroy(&zip_prop_handlers);
 	php_unregister_url_stream_wrapper("zip" TSRMLS_CC);
 #endif
@@ -1,33 +0,0 @@
--TEST--
-Bug #70350 (ZipArchive::extractTo allows for directory traversal when creating directories)
--SKIPIF--
-<?php
-if(!extension_loaded('zip')) die('skip');
-?>
--FILE--
-<?php
-
-$dir = dirname(__FILE__)."/bug70350";
-mkdir($dir);
-$archive = new ZipArchive();
-$archive->open("$dir/a.zip",ZipArchive::CREATE);
-$archive->addEmptyDir("../down2/");
-$archive->close();
-
-$archive2 = new ZipArchive();
-$archive2->open("$dir/a.zip");
-$archive2->extractTo($dir);
-$archive2->close();
-var_dump(file_exists("$dir/down2/"));
-var_dump(file_exists("../down2/"));
-?>
--CLEAN--
-<?php
-$dir = dirname(__FILE__)."/bug70350";
-rmdir("$dir/down2");
-unlink("$dir/a.zip");
-rmdir($dir);
-?>
--EXPECT--
-bool(true)
-bool(false)
@@ -2,7 +2,7 @@
 /* edit configure.in to change version number */
 #define PHP_MAJOR_VERSION 5
 #define PHP_MINOR_VERSION 4
-#define PHP_RELEASE_VERSION 46
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "5.4.46-dev"
-#define PHP_VERSION_ID 50446
+#define PHP_RELEASE_VERSION 43
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "5.4.43"
+#define PHP_VERSION_ID 50443
@@ -4,7 +4,7 @@ show information about class
 <?php 
 include "skipif.inc"; 
 if (!extension_loaded("reflection")) {
-    die("skip reflection extension required");
+	die("skip reflection extension required");
 }
 ?>
 --FILE--
@@ -18,7 +18,7 @@ var_dump(`"$php" -n --rc exception`);

 echo "Done\n";
 ?>
--EXPECTF-- 
+--EXPECTF--	
 string(40) "Exception: Class unknown does not exist
 "
 string(183) "Class [ <internal:Core> class stdClass ] {
@@ -40,7 +40,7 @@ string(183) "Class [ <internal:Core> class stdClass ] {
 }

 "
-string(1418) "Class [ <internal:Core> class Exception ] {
+string(1355) "Class [ <internal:Core> class Exception ] {

  - Constants [0] {
  }
@@ -61,7 +61,7 @@ string(1418) "Class [ <internal:Core> class Exception ] {
    Property [ <default> private $previous ]
  }

-  - Methods [11] {
+  - Methods [10] {
    Method [ <internal:Core> final private method __clone ] {
    }

@@ -74,9 +74,6 @@ string(1418) "Class [ <internal:Core> class Exception ] {
      }
    }

-    Method [ <internal:Core> public method __wakeup ] {
-    }
-
    Method [ <internal:Core> final public method getMessage ] {
    }
Author	SHA1	Message	Date
Stanislav Malyshev	86aa35b787	5.4.43	2015-07-07 15:08:15 -07:00
Stanislav Malyshev	e4fc1d5d1d	Merge branch 'PHP-5.4' into PHP-5.4.43 * PHP-5.4: Better fix for bug #69958 update news Fix bug #69669 (mysqlnd is vulnerable to BACKRONYM) Fix bug #69923 - Buffer overflow and stack smashing error in phar_fix_filepath Fix bug #69958 - Segfault in Phar::convertToData on invalid file add missing second argument for ucfirst to the proto Conflicts: ext/mysqlnd/mysqlnd.c ext/phar/phar_object.c ext/phar/tests/bug69958.phpt	2015-07-07 15:05:35 -07:00
Stanislav Malyshev	a46bae2df2	Fix bug #69669 (mysqlnd is vulnerable to BACKRONYM)	2015-07-05 00:00:53 -07:00
Stanislav Malyshev	3e88d610e5	Fix bug #69923 - Buffer overflow and stack smashing error in phar_fix_filepath	2015-07-04 23:47:48 -07:00
Stanislav Malyshev	452d30cf7d	Fix bug #69958 - Segfault in Phar::convertToData on invalid file	2015-07-04 21:01:50 -07:00