Revert "Updated to version 2016.7 (2016g)"

This reverts commit 6a544f2d1e.
5.6.27RC1
2026-11-12 03:30:50 +00:00 · 2016-09-29 01:34:45 +02:00 · 2016-09-29 01:06:51 +02:00
239 changed files with 10720 additions and 13975 deletions
@@ -1,4 +1,3 @@
-dist: precise
 language: c
 sudo: false
 addons:
@@ -74,7 +74,7 @@ MAINTENANCE:         Maintained
 STATUS:              Working
 -------------------------------------------------------------------------------
 EXTENSION:           fpm
-PRIMARY MAINTAINER:  Jakub Zelenka <bukka@php.net>
+PRIMARY MAINTAINER:  Antony Dovgal <tony2001@php.net>, Jerome Loyet <fat@php.net>
 MAINTENANCE:         Maintained
 STATUS:              Working
 SINCE:               5.3.3
@@ -1,198 +1,6 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-19 Jul 2018, PHP 5.6.37
-
- Exif:
-  . Fixed bug #76423 (Int Overflow lead to Heap OverFlow in
-    exif_thumbnail_extract of exif.c). (Stas)
-  . Fixed bug #76557 (heap-buffer-overflow (READ of size 48) while reading exif
-    data). (Stas)
-
- Win32:
-  . Fixed bug #76459 (windows linkinfo lacks openbasedir check). (Anatol)
-
-26 Apr 2018 PHP 5.6.36
-
- Exif:
-  . Fixed bug #76130 (Heap Buffer Overflow (READ: 1786) in exif_iif_add_value).
-  (Stas)
-
- iconv:
-  . Fixed bug #76249 (stream filter convert.iconv leads to infinite loop on
-    invalid sequence). (Stas)
-
- LDAP:
-  . Fixed bug #76248 (Malicious LDAP-Server Response causes Crash). (Stas)
-
- Phar:
-  . Fixed bug #76129 (fix for CVE-2018-5712 may not be complete). (Stas)
-
-29 Mar 2018, PHP 5.6.35
-
- FPM:
-  . Fixed bug #75605 (Dumpable FPM child processes allow bypassing opcache
-    access controls). (Jakub Zelenka)
-
-01 Mar 2018, PHP 5.6.34
-
- Standard:
-  . Fixed bug #75981 (stack-buffer-overflow while parsing HTTP response). (Stas)
-
-04 Jan 2018, PHP 5.6.33
-
- GD:
-  . Fixed bug #75571 (Potential infinite loop in gdImageCreateFromGifCtx). (cmb)
-
- Phar:
-  . Fixed bug #74782 (Reflected XSS in .phar 404 page). (Stas)
-
-26 Sep 2017, PHP 5.6.32
-
- Date:
-  . Fixed bug #75055 (Out-Of-Bounds Read in timelib_meridian()). (Derick)
-
- mcrypt:
-  . Fixed bug #72535 (arcfour encryption stream filter crashes php). (Leigh)
-
- PCRE:
-  . Fixed bug #75207 (applied upstream patch for CVE-2016-1283). (Anatol)
-
-06 Jul 2017, PHP 5.6.31
-
- Core:
-  . Fixed bug #73807 (Performance problem with processing post request over
-    2000000 chars). (Nikita)
-  . Fixed bug #74111 (Heap buffer overread (READ: 1) finish_nested_data from
-    unserialize). (Nikita)
-  . Fixed bug #74603 (PHP INI Parsing Stack Buffer Overflow Vulnerability).
-    (Stas)
-  . Fixed bug #74819 (wddx_deserialize() heap out-of-bound read via
-    php_parse_date()). (Derick)
-
- GD:
-  . Fixed bug #74435 (Buffer over-read into uninitialized memory). (cmb)
-
- mbstring:
-  . Add oniguruma upstream fix (CVE-2017-9224, CVE-2017-9226, CVE-2017-9227,
-    CVE-2017-9228, CVE-2017-9229) (Remi, Mamoru TASAKA)
-
- OpenSSL:
-  . Fixed bug #74651 (negative-size-param (-1) in memcpy in zif_openssl_seal()).
-    (Stas)
-
- PCRE:
-  . Fixed bug #74087 (Segmentation fault in PHP7.1.1(compiled using the bundled PCRE library)).
-    (Stas)
-
- WDDX:
-   . Fixed bug #74145 (wddx parsing empty boolean tag leads to SIGSEGV). (Stas)
-
-19 Jan 2017, PHP 5.6.30
-
- EXIF:
-  . Fixed bug #73737 (FPE when parsing a tag format). (Stas)
-
- GD:
-  . Fixed bug #73549 (Use after free when stream is passed to imagepng). (cmb)
-  . Fixed bug #73868 (DOS vulnerability in gdImageCreateFromGd2Ctx()). (cmb)
-  . Fixed bug #73869 (Signed Integer Overflow gd_io.c). (cmb)
-
- Intl:
-  . Fixed bug #68447 (grapheme_extract take an extra trailing character). 
-    (SATŌ Kentarō)
-
- Phar:
-  . Fixed bug #73764 (Crash while loading hostile phar archive). (Stas)
-  . Fixed bug #73768 (Memory corruption when loading hostile phar). (Stas)
-  . Fixed bug #73773 (Seg fault when loading hostile phar). (Stas)
-
- SQLite3:
-  . Reverted fix for bug #73530	(Unsetting result set may reset other result
-    set). (cmb)
-
- Standard:
-  . Fixed bug #70213 (Unserialize context shared on double class lookup).
-    (Taoguang Chen)
-  . Fixed bug #73825 (Heap out of bounds read on unserialize in
-    finish_nested_data()). (Stas)
-
-08 Dec 2016, PHP 5.6.29
-
- Mbstring:
-  . Fixed bug #73505 (string length overflow in mbfl_memory_device_output
-    function). (Stas)
-
- Mysqlnd:
-  . Fixed bug #64526 (Add missing mysqlnd.* parameters to php.ini-*). (cmb)
-
- Opcache:
-  . Fixed bug #73402 (Opcache segfault when using class constant to call a
-    method). (Laruence)
-  . Fixed bug #69090 (check cached files permissions)
-
- OpenSSL
-  . Fixed bug #72776 (Invalid parameter in memcpy function trough
-    openssl_pbkdf2). (Jakub Zelenka)
-
- Postgres:
-  . Fixed bug #73498 (Incorrect SQL generated for pg_copy_to()). (Craig Duncan)
-
- SOAP:
-  . Fixed bug #73452 (Segfault (Regression for #69152)). (Dmitry)
-
- SQLite3:
-  . Fixed bug #73530 (Unsetting result set may reset other result set). (cmb)
-
- Standard:
-   . Fixed bug #73297 (HTTP stream wrapper should ignore HTTP 100 Continue).
-     (rowan dot collins at gmail dot com)
-
- WDDX:
-  . Fixed bug #73631 (Memory leak due to invalid wddx stack processing). 
-    (bughunter at fosec dot vn).
-
-10 Nov 2016, PHP 5.6.28
-
- Core:
-  . Fixed bug #73337 (try/catch not working with two exceptions inside a same
-    operation). (Dmitry)
-
- Bz2:
-  . Fixed bug #73356 (crash in bzcompress function). (Stas)
-
-GD:
-  . Fixed bug #73213 (Integer overflow in imageline() with antialiasing). (cmb)
-  . Fixed bug #73272 (imagescale() is not affected by, but affects
-    imagesetinterpolation()). (cmb)
-  . Fixed bug #73279 (Integer overflow in gdImageScaleBilinearPalette()). (cmb)
-  . Fixed bug #73280 (Stack Buffer Overflow in GD dynamicGetbuf). (cmb)
-  . Fixed bug #72482 (Illegal write/read access caused by gdImageAALine overflow).
-    (cmb)
-  . Fixed bug #72696 (imagefilltoborder stackoverflow on truecolor images). (cmb)
-
- Imap:
-  . Fixed bug #73418 (Integer Overflow in "_php_imap_mail" leads Heap Overflow).
-    (Anatol)
-
- SPL:
-  . Fixed bug #73144 (Use-after-free in ArrayObject Deserialization). (Stas)
-
- SOAP:
-  . Fixed bug #73037 (SoapServer reports Bad Request when gzipped). (Anatol)
-
- SQLite3:
-  . Fixed bug #73333 (2147483647 is fetched as string). (cmb)
-
- Standard:
-  . Fixed bug #73203 (passing additional_parameters causes mail to fail). (cmb)
-  . Fixed bug #73188 (use after free in userspace streams). (Sara)
-  . Fixed bug #73192 (parse_url return wrong hostname). (Nikita)
-
- Wddx:
-  . Fixed bug #73331 (NULL Pointer Dereference in WDDX Packet Deserialization
-    with PDORow). (Stas)
-
-13 Oct 2016, PHP 5.6.27
+29 Sep 2016, PHP 5.6.27RC1

 - Core:
  . Fixed bug #73025 (Heap Buffer Overflow in virtual_popen of
@@ -200,17 +8,6 @@ PHP                                                                        NEWS
  . Fixed bug #73058 (crypt broken when salt is 'too' long). (Anatol)
  . Fixed bug #72703 (Out of bounds global memory read in BF_crypt triggered by
    password_verify). (Anatol)
-  . Fixed bug #73189 (Memcpy negative size parameter php_resolve_path). (Stas)
-  . Fixed bug #73147 (Use After Free in unserialize()). (Stas)
-
- BCmath:
-  . Fixed bug #73190 (memcpy negative parameter _bc_new_num_ex). (Stas)
-
- DOM:
-  . Fixed bug #73150 (missing NULL check in dom_document_save_html). (Stas)
-
- Ereg:
-  . Fixed bug #73284 (heap overflow in php_ereg_replace function). (Stas)

 - Filter:
  . Fixed bug #72972 (Bad filter for the flags FILTER_FLAG_NO_RES_RANGE and
@@ -235,22 +32,11 @@ PHP                                                                        NEWS
    files). (cmb)
  . Fixed bug #73161 (imagecreatefromgd2() may leak memory). (cmb)

- Intl:
-  . Fixed bug #73218 (add mitigation for ICU int overflow). (Stas)
-
- Imap:
-  . Fixed bug #73208 (integer overflow in imap_8bit caused heap corruption).
-    (Stas)
-
 - Mbstring:
  . Fixed bug #72994 (mbc_to_code() out of bounds read). (Laruence, cmb)
  . Fixed bug #66964 (mb_convert_variables() cannot detect recursion). (Yasuo)
  . Fixed bug #72992 (mbstring.internal_encoding doesn't inherit default_charset).
    (Yasuo)
-  . Fixed bug #73082 (string length overflow in mb_encode_* function). (Stas)
-
- PCRE:
-  . Fixed bug #73174 (heap overflow in php_pcre_replace_impl). (Stas)

 - Opcache:
  . Fixed bug #72590 (Opcache restart with kill_all_lockers does not work).
@@ -259,8 +45,6 @@ PHP                                                                        NEWS
 - OpenSSL:
  . Fixed bug #73072 (Invalid path SNI_server_certs causes segfault).
    (Jakub Zelenka)
-  . Fixed bug #73275 (crash in openssl_encrypt function). (Stas)
-  . Fixed bug #73276 (crash in openssl_random_pseudo_bytes function). (Stas)

 - Session:
  . Fixed bug #68015 (Session does not report invalid uid for files save handler).
@@ -268,18 +52,6 @@ PHP                                                                        NEWS
  . Fixed bug #73100 (session_destroy null dereference in ps_files_path_create).
    (cmb)

- SimpleXML:
-  . Fixed bug #73293 (NULL pointer dereference in SimpleXMLElement::asXML()).
-    (Stas)
-
- SPL:
-  . Fixed bug #73073 (CachingIterator null dereference when convert to string).
-    (Stas)
-
- Standard:
-  . Fixed bug #73240 (Write out of bounds at number_format). (Stas)
-  . Fixed bug #73017 (memory corruption in wordwrap function). (Stas)
-
 - Stream:
  . Fixed bug #73069 (readfile() mangles files larger than 2G). (Laruence)

@@ -442,8 +214,6 @@ PHP                                                                        NEWS
  . Fixed bug #72697 (select_colors write out-of-bounds). (Stas)
  . Fixed bug #72709 (imagesetstyle() causes OOB read for empty $styles). (cmb)
  . Fixed bug #72730 (imagegammacorrect allows arbitrary write access). (Stas)
-  . Fixed bug #72494 (imagecropauto out-of-bounds access). (Fernando, Pierre,
-    cmb)

 - Intl:
  . Partially fixed #72506 (idn_to_ascii for UTS #46 incorrect for long domain
@@ -1,12 +0,0 @@
--TEST--
-Bug #73337 (try/catch not working with two exceptions inside a same operation)
--FILE--
-<?php
-class d { function __destruct() { throw new Exception; } }
-try { new d + new d; } catch (Exception $e) { print "Exception properly caught\n"; }
-?>
--EXPECTF--
-Notice: Object of class d could not be converted to int in %sbug73337.php on line 3
-
-Notice: Object of class d could not be converted to int in %sbug73337.php on line 3
-Exception properly caught
@@ -1 +0,0 @@
-0=0&~2000000000
@@ -1,15 +0,0 @@
--TEST--
-Bug #74603 (PHP INI Parsing Stack Buffer Overflow Vulnerability)
--SKIPIF--
-<?php
-if (PHP_INT_MAX !== 2147483647)
-        die('skip for 32-bit only');
--FILE--
-<?php
-var_dump(parse_ini_file(__DIR__ . "/bug74603.ini", true, INI_SCANNER_NORMAL));
-?>
--EXPECT--
-array(1) {
-  [0]=>
-  string(1) "0"
-}
@@ -1,7 +1,5 @@
 --TEST--
 Testing __debugInfo() magic method with bad returns RESOURCE
--INI--
-allow_url_fopen=1
 --FILE--
 <?php

@@ -3776,30 +3776,6 @@ ZEND_API void zend_update_property(zend_class_entry *scope, zval *object, const
 }
 /* }}} */

-ZEND_API void zend_unset_property(zend_class_entry *scope, zval *object, const char *name, int name_length TSRMLS_DC) /* {{{ */
-{
-	zval *property;
-	zend_class_entry *old_scope = EG(scope);
-
-	EG(scope) = scope;
-
-	if (!Z_OBJ_HT_P(object)->unset_property) {
-		const char *class_name;
-		zend_uint class_name_len;
-
-		zend_get_object_classname(object, &class_name, &class_name_len TSRMLS_CC);
-
-		zend_error(E_CORE_ERROR, "Property %s of class %s cannot be unset", name, class_name);
-	}
-	MAKE_STD_ZVAL(property);
-	ZVAL_STRINGL(property, name, name_length, 1);
-	Z_OBJ_HT_P(object)->unset_property(object, property, 0 TSRMLS_CC);
-	zval_ptr_dtor(&property);
-
-	EG(scope) = old_scope;
-}
-/* }}} */
-
 ZEND_API void zend_update_property_null(zend_class_entry *scope, zval *object, const char *name, int name_length TSRMLS_DC) /* {{{ */
 {
 	zval *tmp;
@@ -330,7 +330,6 @@ ZEND_API void zend_update_property_long(zend_class_entry *scope, zval *object, c
 ZEND_API void zend_update_property_double(zend_class_entry *scope, zval *object, const char *name, int name_length, double value TSRMLS_DC);
 ZEND_API void zend_update_property_string(zend_class_entry *scope, zval *object, const char *name, int name_length, const char *value TSRMLS_DC);
 ZEND_API void zend_update_property_stringl(zend_class_entry *scope, zval *object, const char *name, int name_length, const char *value, int value_length TSRMLS_DC);
-ZEND_API void zend_unset_property(zend_class_entry *scope, zval *object, const char *name, int name_length TSRMLS_DC);

 ZEND_API int zend_update_static_property(zend_class_entry *scope, const char *name, int name_length, zval *value TSRMLS_DC);
 ZEND_API int zend_update_static_property_null(zend_class_entry *scope, const char *name, int name_length TSRMLS_DC);
@@ -665,9 +664,8 @@ END_EXTERN_C()
 		}									\
 		RETURN_FALSE;						\
 	}										\
-	RETVAL_STRINGL((s), (int)__len, (dup)); \
+	RETVAL_STRINGL((s), __len, (dup)); \
 } while (0)
-#define RETURN_STRINGL_CHECK(s, len, dup) { RETVAL_STRINGL_CHECK(s, len, dup); return; }


 #define SET_VAR_STRING(n, v) {																				\
@@ -229,9 +229,13 @@ ZEND_METHOD(exception, __construct)
 /* {{{ proto Exception::__wakeup()
   Exception unserialize checks */
 #define CHECK_EXC_TYPE(name, type) \
-	value = zend_read_property(default_exception_ce, object, name, sizeof(name)-1, 1 TSRMLS_CC); \
+	value = zend_read_property(default_exception_ce, object, name, sizeof(name)-1, 0 TSRMLS_CC); \
 	if (value && Z_TYPE_P(value) != IS_NULL && Z_TYPE_P(value) != type) { \
-		zend_unset_property(default_exception_ce, object, name, sizeof(name)-1 TSRMLS_CC); \
+		zval *tmp; \
+		MAKE_STD_ZVAL(tmp); \
+		ZVAL_STRINGL(tmp, name, sizeof(name)-1, 1); \
+		Z_OBJ_HANDLER_P(object, unset_property)(object, tmp, 0 TSRMLS_CC); \
+		zval_ptr_dtor(&tmp); \
 	}

 ZEND_METHOD(exception, __wakeup)
@@ -244,12 +248,7 @@ ZEND_METHOD(exception, __wakeup)
 	CHECK_EXC_TYPE("file", IS_STRING);
 	CHECK_EXC_TYPE("line", IS_LONG);
 	CHECK_EXC_TYPE("trace", IS_ARRAY);
-	value = zend_read_property(default_exception_ce, object, "previous", sizeof("previous")-1, 1 TSRMLS_CC);
-	if (value && Z_TYPE_P(value) != IS_NULL && (Z_TYPE_P(value) != IS_OBJECT ||
-			!instanceof_function(Z_OBJCE_P(value), default_exception_ce TSRMLS_CC) ||
-			value == object)) {
-		zend_unset_property(default_exception_ce, object, "previous", sizeof("previous")-1 TSRMLS_CC);
-	}
+	CHECK_EXC_TYPE("previous", IS_OBJECT);
 }
 /* }}} */

@@ -728,11 +727,7 @@ ZEND_METHOD(exception, __toString)
 		zval_dtor(&file);
 		zval_dtor(&line);

-		Z_OBJPROP_P(exception)->nApplyCount++;
-		exception = zend_read_property(default_exception_ce, exception, "previous", sizeof("previous")-1, 1 TSRMLS_CC);
-		if (exception && Z_TYPE_P(exception) == IS_OBJECT && Z_OBJPROP_P(exception)->nApplyCount > 0) {
-			exception = NULL;
-		}
+		exception = zend_read_property(default_exception_ce, exception, "previous", sizeof("previous")-1, 0 TSRMLS_CC);

 		if (trace) {
 			zval_ptr_dtor(&trace);
@@ -741,17 +736,6 @@ ZEND_METHOD(exception, __toString)
 	}
 	zval_dtor(&fname);

-	/* Reset apply counts */
-	exception = getThis();
-	while (exception && Z_TYPE_P(exception) == IS_OBJECT && instanceof_function(Z_OBJCE_P(exception), default_exception_ce TSRMLS_CC)) {
-		if(Z_OBJPROP_P(exception)->nApplyCount) {
-			Z_OBJPROP_P(exception)->nApplyCount--;
-		} else {
-			break;
-		}
-		exception = zend_read_property(default_exception_ce, exception, "previous", sizeof("previous")-1, 1 TSRMLS_CC);
-	}
-
 	/* We store the result in the private property string so we can access
 	 * the result in uncaught exception handlers without memleaks. */
 	zend_update_property_string(default_exception_ce, getThis(), "string", sizeof("string")-1, str TSRMLS_CC);
@@ -909,10 +893,11 @@ static void zend_error_va(int type, const char *file, uint lineno, const char *f
 ZEND_API void zend_exception_error(zval *exception, int severity TSRMLS_DC) /* {{{ */
 {
 	zend_class_entry *ce_exception = Z_OBJCE_P(exception);
-	EG(exception) = NULL;
 	if (instanceof_function(ce_exception, default_exception_ce TSRMLS_CC)) {
 		zval *str, *file, *line;

+		EG(exception) = NULL;
+
 		zend_call_method_with_0_params(&exception, ce_exception, NULL, "__tostring", &str);
 		if (!EG(exception)) {
 			if (Z_TYPE_P(str) != IS_STRING) {
@@ -951,7 +936,6 @@ ZEND_API void zend_exception_error(zval *exception, int severity TSRMLS_DC) /* {
 	} else {
 		zend_error(severity, "Uncaught exception '%s'", ce_exception->name);
 	}
-	zval_ptr_dtor(&exception);
 }
 /* }}} */

@@ -826,10 +826,7 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache TS
 		if (EG(active_op_array)->fn_flags & ZEND_ACC_GENERATOR) {
 			*fci->retval_ptr_ptr = zend_generator_create_zval(EG(active_op_array) TSRMLS_CC);
 		} else {
-			const zend_op *current_opline_before_exception = EG(opline_before_exception);
-
 			zend_execute(EG(active_op_array) TSRMLS_CC);
-			EG(opline_before_exception) = current_opline_before_exception;
 		}

 		if (!fci->symbol_table && EG(active_symbol_table)) {
@@ -53,7 +53,7 @@ static void zend_ini_do_op(char type, zval *result, zval *op1, zval *op2)
 {
 	int i_result;
 	int i_op1, i_op2;
-	char str_result[MAX_LENGTH_OF_LONG+1];
+	char str_result[MAX_LENGTH_OF_LONG];

 	i_op1 = atoi(Z_STRVAL_P(op1));
 	free(Z_STRVAL_P(op1));
@@ -1184,10 +1184,6 @@ ZEND_API zend_function *zend_std_get_static_method(zend_class_entry *ce, const c
 	ALLOCA_FLAG(use_heap)

 	if (EXPECTED(key != NULL)) {
-#if (ZEND_GCC_VERSION == 4009) && !(defined(ZTS) && defined(NETWARE)) && !(defined(ZTS) && defined(HPUX)) && !defined(DARWIN)
-		/* This is a workaround for bug in GCC 4.9.2 */
-		use_heap = 0;
-#endif
 		lc_function_name = Z_STRVAL(key->constant);
 		hash_value = key->hash_value;
 	} else {
@@ -2263,7 +2263,7 @@ AC_DEFUN([PHP_SETUP_KERBEROS],[
  fi

  dnl If krb5-config is found try using it
-  if test "$PHP_KERBEROS" != "no" && test -x "$KRB5_CONFIG"; then
+  if test "$PHP_KERBEROS" = "yes" && test -x "$KRB5_CONFIG"; then
    KERBEROS_LIBS=`$KRB5_CONFIG --libs gssapi`
    KERBEROS_CFLAGS=`$KRB5_CONFIG --cflags gssapi`

@@ -119,8 +119,8 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=6
-PHP_RELEASE_VERSION=37
-PHP_EXTRA_VERSION=""
+PHP_RELEASE_VERSION=27
+PHP_EXTRA_VERSION="RC1"
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -49,10 +49,7 @@ _bc_new_num_ex (length, scale, persistent)
     int length, scale, persistent;
 {
  bc_num temp;
-  /* PHP Change:  add length check */
-  if ((size_t)length+(size_t)scale > INT_MAX) {
-   zend_error(E_ERROR, "Result too long, max is %d", INT_MAX);
-  }
+
  /* PHP Change:  malloc() -> pemalloc(), removed free_list code */
  temp = (bc_num) safe_pemalloc (1, sizeof(bc_struct)+length, scale, persistent);
 #if 0
@@ -41,5 +41,6 @@

 void bc_out_of_memory (void)
 {
-  zend_error(E_ERROR, "bcmath: out of memory!");
+  (void) fprintf (stderr, "bcmath: out of memory!\n");
+  exit (1);
 }
@@ -513,7 +513,7 @@ static PHP_FUNCTION(bzcompress)
 	dest_len   = (unsigned int) (source_len + (0.01 * source_len) + 600);

 	/* Allocate the destination buffer */
-	dest = safe_emalloc(dest_len, 1, 1);
+	dest = emalloc(dest_len + 1);

 	/* Handle the optional arguments */
 	if (argc > 1) {
@@ -533,7 +533,7 @@ static PHP_FUNCTION(bzcompress)
 		   so we erealloc() the buffer to the proper size */
 		dest = erealloc(dest, dest_len + 1);
 		dest[dest_len] = 0;
-		RETURN_STRINGL_CHECK(dest, dest_len, 0);
+		RETURN_STRINGL(dest, dest_len, 0);
 	}
 }
 /* }}} */
@@ -35,7 +35,7 @@ static void curlfile_ctor(INTERNAL_FUNCTION_PARAMETERS)
 	int fname_len, mime_len, postname_len;
 	zval *cf = return_value;

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|ss", &fname, &fname_len, &mime, &mime_len, &postname, &postname_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|ss", &fname, &fname_len, &mime, &mime_len, &postname, &postname_len) == FAILURE) {
 		return;
 	}

@@ -137,10 +137,7 @@ ZEND_METHOD(CURLFile, setPostFilename)
   Unserialization handler */
 ZEND_METHOD(CURLFile, __wakeup)
 {
-	zval *_this = getThis();
-
-	zend_unset_property(curl_CURLFile_class, _this, "name", sizeof("name")-1 TSRMLS_CC);
-	zend_update_property_string(curl_CURLFile_class, _this, "name", sizeof("name")-1, "" TSRMLS_CC);
+	zend_update_property_string(curl_CURLFile_class, getThis(), "name", sizeof("name")-1, "" TSRMLS_CC);
 	zend_throw_exception(NULL, "Unserialization of CURLFile instances is not allowed", 0 TSRMLS_CC);
 }
 /* }}} */
@@ -1,20 +0,0 @@
--TEST--
-Bug #73147: Use After Free in PHP7 unserialize()
--SKIPIF--
-<?php
-if (!extension_loaded("curl")) {
-        exit("skip curl extension not loaded");
-}
-?>
--FILE--
-<?php
-
-$poc = 'a:1:{i:0;O:8:"CURLFile":1:{s:4:"name";R:1;}}';
-try {
-var_dump(unserialize($poc));
-} catch(Exception $e) {
-	echo $e->getMessage();
-}
-?>
--EXPECT--
-Unserialization of CURLFile instances is not allowed
@@ -394,12 +394,8 @@ static timelib_sll timelib_meridian(char **ptr, timelib_sll h)
 	}
 	++*ptr;
 	if (**ptr == '.') {
-		++*ptr;
-	}
-	if (**ptr == 'M' || **ptr == 'm') {
-		++*ptr;
-	}
-	if (**ptr == '.') {
+		*ptr += 3;
+	} else {
 		++*ptr;
 	}
 	return retval;
@@ -899,7 +895,7 @@ datefull         = day ([ \t.-])* monthtext ([ \t.-])* year;
 datenoday        = monthtext ([ .\t-])* year4;
 datenodayrev     = year4 ([ .\t-])* monthtext;
 datetextual      = monthtext ([ .\t-])* day [,.stndrh\t ]+ year;
-datenoyear       = monthtext ([ .\t-])* day ([,.stndrh\t ]+|[\000]);
+datenoyear       = monthtext ([ .\t-])* day [,.stndrh\t ]*;
 datenoyearrev    = day ([ .\t-])* monthtext;
 datenocolon      = year4 monthlz daylz;

@@ -917,8 +913,8 @@ isoweek          = year4 "-"? "W" weekofyear;
 exif             = year4 ":" monthlz ":" daylz " " hour24lz ":" minutelz ":" secondlz;
 firstdayof       = 'first day of';
 lastdayof        = 'last day of';
-backof           = 'back of ' hour24 (space? meridian)?;
-frontof          = 'front of ' hour24 (space? meridian)?;
+backof           = 'back of ' hour24 space? meridian?;
+frontof          = 'front of ' hour24 space? meridian?;

 /* Common Log Format: 10/Oct/2000:13:55:36 -0700 */
 clf              = day "/" monthabbr "/" year4 ":" hour24lz ":" minutelz ":" secondlz space tzcorrection;
@@ -75,8 +75,8 @@ result = Monday 1983-04-18 01:00:00 CEST
 wanted = Monday            00:00:00

 Asia/Yerevan
-ts     = Monday 2037-10-19 17:17:17 +04
-result = Monday 2037-10-26 00:00:00 +04
+ts     = Monday 2037-10-19 17:17:17 AMT
+result = Monday 2037-10-26 00:00:00 AMT
 wanted = Monday            00:00:00

 America/Curacao
@@ -115,8 +115,8 @@ result = Monday 1971-04-05 00:00:00 AST
 wanted = Monday            00:00:00

 Asia/Baku
-ts     = Friday 1971-01-01 17:17:17 +04
-result = Monday 1971-01-04 00:00:00 +04
+ts     = Friday 1971-01-01 17:17:17 BAKT
+result = Monday 1971-01-04 00:00:00 BAKT
 wanted = Monday            00:00:00

 Europe/Sarajevo
@@ -165,6 +165,6 @@ result = Monday 1980-04-07 00:00:00 CEST
 wanted = Monday            00:00:00

 Asia/Baku
-ts     = Monday 1995-12-25 17:17:17 +04
-result = Monday 1996-01-01 00:00:00 +04
+ts     = Monday 1995-12-25 17:17:17 AZT
+result = Monday 1996-01-01 00:00:00 AZT
 wanted = Monday            00:00:00
@@ -226,8 +226,8 @@ result=Thursday 1980-04-10 00:00:00 CEST 1
 wanted=Thursday             00:00:00

 TZ=Asia/Baku - wrong day.
-tStamp=Sunday 1992-09-20 17:17:17 +04 1
-result=Monday 1992-09-28 00:00:00 +04 0
+tStamp=Sunday 1992-09-20 17:17:17 AZST 1
+result=Monday 1992-09-28 00:00:00 AZT 0
 wanted=Monday              00:00:00

 TZ=America/Noronha - wrong day.
@@ -28,6 +28,6 @@ result=Monday 1990-10-22 00:00:00 WART 0
 wanted=Monday            00:00:00

 TZ=Asia/Tbilisi - Is it OK for this to be 2 AM?
-tStamp=Sunday 2005-03-20 17:17:17 +03 0
-result=Sunday 2005-03-27 00:00:00 +03 0
+tStamp=Sunday 2005-03-20 17:17:17 GET 0
+result=Sunday 2005-03-27 00:00:00 GET 0
 wanted=Sunday            00:00:00
@@ -40,7 +40,7 @@ object(DateInterval)#%d (15) {
  ["special_amount"]=>
  int(-1)
  ["have_weekday_relative"]=>
-  int(%d)
+  int(9)
  ["have_special_relative"]=>
  int(0)
 }
@@ -34,14 +34,14 @@ foreach ( $tests as $start => $data )
 echo "\n";
 ?>
 --EXPECT--
-Fri, 15 Oct 2010 23:00:00 +0000
+Sat, 23 Oct 2010 00:00:00 +0000
 Wed, 15 Dec 2010 16:15:00 +0000
 Mon, 20 Dec 2010 00:00:00 +0000
 Mon, 20 Dec 2010 10:00:00 +0000
 Tue, 21 Dec 2010 12:00:00 +0000
 Mon, 03 Jan 2011 00:00:00 +0000
 Mon, 03 Jan 2011 09:00:00 +0000
-Fri, 15 Oct 2010 23:00:00 +0100
+Sat, 23 Oct 2010 00:00:00 +0100
 Sun, 28 Mar 2010 00:15:00 +0000
 Sun, 28 Mar 2010 02:15:00 +0100
 Sun, 28 Mar 2010 02:15:00 +0100
@@ -1792,7 +1792,7 @@ PHP_FUNCTION(dom_document_savexml)
 		if (options & LIBXML_SAVE_NOEMPTYTAG) {
 			xmlSaveNoEmptyTags = saveempty;
 		}
-		if (!size || !mem) {
+		if (!size) {
 			RETURN_FALSE;
 		}
 		RETVAL_STRINGL(mem, size, 1);
@@ -2327,7 +2327,7 @@ PHP_FUNCTION(dom_document_save_html)
 #else
 		htmlDocDumpMemory(docp, &mem, &size);
 #endif
-		if (!size || !mem) {
+		if (!size) {
 			RETVAL_FALSE;
 		} else {
 			RETVAL_STRINGL((const char*) mem, size, 1);
@@ -14,7 +14,7 @@
   +----------------------------------------------------------------------+
   | Authors: Rasmus Lerdorf <rasmus@php.net>                             |
   |          Jim Winstead <jimw@php.net>                                 |
-   |          Jaakko Hyvätti <jaakko@hyvatti.iki.fi>                      |
+   |          Jaakko Hyvätti <jaakko@hyvatti.iki.fi>                      | 
   +----------------------------------------------------------------------+
 */
 /* $Id$ */
@@ -29,7 +29,7 @@
 /* {{{ arginfo */
 ZEND_BEGIN_ARG_INFO_EX(arginfo_ereg, 0, 0, 2)
 	ZEND_ARG_INFO(0, pattern)
-	ZEND_ARG_INFO(0, string)
+	ZEND_ARG_INFO(0, string) 
 	ZEND_ARG_INFO(1, registers) /* ARRAY_INFO(1, registers, 1) */
 ZEND_END_ARG_INFO()

@@ -41,8 +41,8 @@ ZEND_END_ARG_INFO()

 ZEND_BEGIN_ARG_INFO_EX(arginfo_split, 0, 0, 2)
 	ZEND_ARG_INFO(0, pattern)
-	ZEND_ARG_INFO(0, string)
-	ZEND_ARG_INFO(0, limit)
+	ZEND_ARG_INFO(0, string) 
+	ZEND_ARG_INFO(0, limit)  
 ZEND_END_ARG_INFO()

 ZEND_BEGIN_ARG_INFO(arginfo_sql_regcase, 0)
@@ -204,7 +204,7 @@ static int _php_regcomp(regex_t *preg, const char *pattern, int cflags TSRMLS_DC
 }
 /* }}} */

-static void _free_ereg_cache(reg_cache *rc)
+static void _free_ereg_cache(reg_cache *rc) 
 {
 	regfree(&rc->preg);
 }
@@ -309,7 +309,7 @@ static void php_ereg(INTERNAL_FUNCTION_PARAMETERS, int icase)
 	if (icase) {
 		copts |= REG_ICASE;
 	}
-
+	
 	if (argc == 2) {
 		copts |= REG_NOSUB;
 	}
@@ -337,7 +337,7 @@ static void php_ereg(INTERNAL_FUNCTION_PARAMETERS, int icase)

 	/* allocate storage for (sub-)expression-matches */
 	subs = (regmatch_t *)ecalloc(sizeof(regmatch_t),re.re_nsub+1);
-
+	
 	/* actually execute the regular expression */
 	err = regexec(&re, string, re.re_nsub+1, subs, 0);
 	if (err && err != REG_NOMATCH) {
@@ -409,8 +409,8 @@ PHP_EREG_API char *php_ereg_replace(const char *pattern, const char *replace, co
 		 *nbuf,	/* nbuf is used when we grow the buffer */
 		 *walkbuf; /* used to walk buf when replacing backrefs */
 	const char *walk; /* used to walk replacement string for backrefs */
-	size_t buf_len, new_l;
-	int pos, tmp, string_len;
+	int buf_len;
+	int pos, tmp, string_len, new_l;
 	int err, copts = 0;

 	string_len = strlen(string);
@@ -434,8 +434,8 @@ PHP_EREG_API char *php_ereg_replace(const char *pattern, const char *replace, co

 	/* start with a buffer that is twice the size of the stringo
 	   we're doing replacements in */
-	buf = safe_emalloc(string_len, 2, 1);
 	buf_len = 2 * string_len + 1;
+	buf = safe_emalloc(buf_len, sizeof(char), 0);

 	err = pos = 0;
 	buf[0] = '\0';
@@ -472,8 +472,8 @@ PHP_EREG_API char *php_ereg_replace(const char *pattern, const char *replace, co
 				}
 			}
 			if (new_l + 1 > buf_len) {
-				nbuf = safe_emalloc(new_l + 1, 2, buf_len);
 				buf_len = 1 + buf_len + 2 * new_l;
+				nbuf = emalloc(buf_len);
 				strncpy(nbuf, buf, buf_len - 1);
 				nbuf[buf_len - 1] = '\0';
 				efree(buf);
@@ -491,7 +491,7 @@ PHP_EREG_API char *php_ereg_replace(const char *pattern, const char *replace, co
 					if (subs[walk[1] - '0'].rm_so > -1 && subs[walk[1] - '0'].rm_eo > -1
 						/* this next case shouldn't happen. it does. */
 						&& subs[walk[1] - '0'].rm_so <= subs[walk[1] - '0'].rm_eo) {
-
+						
 						tmp = subs[walk[1] - '0'].rm_eo - subs[walk[1] - '0'].rm_so;
 						memcpy (walkbuf, &string[pos + subs[walk[1] - '0'].rm_so], tmp);
 						walkbuf += tmp;
@@ -510,8 +510,8 @@ PHP_EREG_API char *php_ereg_replace(const char *pattern, const char *replace, co
 				}
 				new_l = strlen (buf) + 1;
 				if (new_l + 1 > buf_len) {
-					nbuf = safe_emalloc(new_l + 1, 2, buf_len);
 					buf_len = 1 + buf_len + 2 * new_l;
+					nbuf = safe_emalloc(buf_len, sizeof(char), 0);
 					strncpy(nbuf, buf, buf_len-1);
 					efree(buf);
 					buf = nbuf;
@@ -526,7 +526,7 @@ PHP_EREG_API char *php_ereg_replace(const char *pattern, const char *replace, co
 			new_l = strlen(buf) + strlen(&string[pos]);
 			if (new_l + 1 > buf_len) {
 				buf_len = new_l + 1; /* now we know exactly how long it is */
-				nbuf = safe_emalloc(new_l, 1, 1);
+				nbuf = safe_emalloc(buf_len, sizeof(char), 0);
 				strncpy(nbuf, buf, buf_len-1);
 				efree(buf);
 				buf = nbuf;
@@ -556,7 +556,7 @@ static void php_do_ereg_replace(INTERNAL_FUNCTION_PARAMETERS, int icase)
 	char *replace;
 	char *ret;
 	int arg_string_len;
-
+	
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ZZs", &arg_pattern, &arg_replace, &arg_string, &arg_string_len) == FAILURE) {
 		return;
 	}
@@ -598,7 +598,7 @@ static void php_do_ereg_replace(INTERNAL_FUNCTION_PARAMETERS, int icase)
 	if (ret == (char *) -1) {
 		RETVAL_FALSE;
 	} else {
-		RETVAL_STRINGL_CHECK(ret, strlen(ret), 1);
+		RETVAL_STRING(ret, 1);
 		STR_FREE(ret);
 	}

@@ -664,9 +664,9 @@ static void php_split(INTERNAL_FUNCTION_PARAMETERS, int icase)
 		} else if (subs[0].rm_so == 0 && subs[0].rm_eo == 0) {
 			/* No more matches */
 			regfree(&re);
-
+			
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid Regular Expression");
-
+			
 			zend_hash_destroy(Z_ARRVAL_P(return_value));
 			efree(Z_ARRVAL_P(return_value));
 			RETURN_FALSE;
@@ -675,7 +675,7 @@ static void php_split(INTERNAL_FUNCTION_PARAMETERS, int icase)

 			/* make a copy of the substring */
 			size = subs[0].rm_so;
-
+		
 			/* add it to the array */
 			add_next_index_stringl(return_value, strp, size, 1);

@@ -701,7 +701,7 @@ static void php_split(INTERNAL_FUNCTION_PARAMETERS, int icase)

 	/* otherwise we just have one last element to add to the array */
 	size = endp - strp;
-
+	
 	add_next_index_stringl(return_value, strp, size, 1);

 	regfree(&re);
@@ -738,9 +738,9 @@ PHP_EREG_API PHP_FUNCTION(sql_regcase)
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &string, &string_len) == FAILURE) {
 		return;
 	}
-
+	
 	tmp = safe_emalloc(string_len, 4, 1);
-
+	
 	for (i = j = 0; i < string_len; i++) {
 		c = (unsigned char) string[i];
 		if ( j >= INT_MAX - 1 || (isalpha(c) && j >= INT_MAX - 4)) {
@@ -1303,7 +1303,7 @@ static size_t exif_convert_any_to_int(void *value, int format, int motorola_inte
 			if (s_den == 0) {
 				return 0;
 			} else {
-				return (size_t)((double)php_ifd_get32s(value, motorola_intel) / s_den);
+				return php_ifd_get32s(value, motorola_intel) / s_den;
 			}

 		case TAG_FMT_SSHORT:    return php_ifd_get16u(value, motorola_intel);
@@ -1710,7 +1710,7 @@ static void exif_iif_add_value(image_info_type *image_info, int section_index, c
 		case TAG_FMT_UNDEFINED:
 			if (value) {
 				if (tag == TAG_MAKER_NOTE) {
-					length = (int) php_strnlen(value, length);
+					length = MIN(length, strlen(value));
 				}

 				/* do not recompute length here */
@@ -2545,10 +2545,7 @@ static void exif_thumbnail_extract(image_info_type *ImageInfo, char *offset, siz
 		return;
 	}
 	/* Check to make sure we are not going to go past the ExifLength */
-	if (ImageInfo->Thumbnail.size > length
-		|| (ImageInfo->Thumbnail.offset + ImageInfo->Thumbnail.size) > length
-		|| ImageInfo->Thumbnail.offset > length - ImageInfo->Thumbnail.size
-	) {
+	if ((ImageInfo->Thumbnail.offset + ImageInfo->Thumbnail.size) > length) {
 		EXIF_ERRLOG_THUMBEOF(ImageInfo)
 		return;
 	}
@@ -2728,7 +2725,6 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 	int NumDirEntries, old_motorola_intel, offset_diff;
 	const maker_note_type *maker_note;
 	char *dir_start;
-	int data_len;

 	for (i=0; i<=sizeof(maker_note_array)/sizeof(maker_note_type); i++) {
 		if (i==sizeof(maker_note_array)/sizeof(maker_note_type)) {
@@ -2783,7 +2779,6 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 	switch (maker_note->offset_mode) {
 		case MN_OFFSET_MAKER:
 			offset_base = value_ptr;
-			data_len = value_len;
 			break;
 		case MN_OFFSET_GUESS:
 			if (maker_note->offset + 10 + 4 >= value_len) {
@@ -2800,7 +2795,6 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 				return FALSE;
 			}
 			offset_base = value_ptr + offset_diff;
-			data_len = value_len - offset_diff;
 			break;
 		default:
 		case MN_OFFSET_NORMAL:
@@ -2814,7 +2808,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu

 	for (de=0;de<NumDirEntries;de++) {
 		if (!exif_process_IFD_TAG(ImageInfo, dir_start + 2 + 12 * de,
-								  offset_base, data_len, displacement, section_index, 0, maker_note->tag_table TSRMLS_CC)) {
+								  offset_base, IFDlength, displacement, section_index, 0, maker_note->tag_table TSRMLS_CC)) {
 			return FALSE;
 		}
 	}
@@ -2861,7 +2855,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 	}

 	if (components < 0) {
-		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal components(%d)", tag, exif_get_tagname(tag, tagname, -12, tag_table TSRMLS_CC), components);
+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal components(%ld)", tag, exif_get_tagname(tag, tagname, -12, tag_table TSRMLS_CC), components);
 		return FALSE;
 	}

@@ -4216,7 +4210,7 @@ PHP_FUNCTION(exif_imagetype)
 	php_stream * stream;
 	int itype = 0;

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &imagefile, &imagefile_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &imagefile, &imagefile_len) == FAILURE) {
 		return;
 	}

@@ -1,12 +0,0 @@
--TEST--
-Bug #73737 (Crash when parsing a tag format)
--SKIPIF--
-<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
--FILE--
-<?php
-	$exif = exif_thumbnail(__DIR__ . '/bug73737.tiff');
-	var_dump($exif);
-?>
--EXPECTF--
-Warning: exif_thumbnail(bug73737.tiff): Error in TIFF: filesize(x0030) less than start of IFD dir(x10102) in %s line %d
-bool(false)
@@ -1,20 +0,0 @@
--TEST--
-Bug #76130 (Heap Buffer Overflow (READ: 1786) in exif_iif_add_value)
--DESCRIPTION--
-This test is meant to exhibit memory issues with the `-m` option. Since a lot of
-notices and warnings are to be expected anyway, we suppress these, since the are
-not relevant for this test.
--INI--
-error_reporting=E_ALL & ~E_WARNING & ~E_NOTICE
--SKIPIF--
-<?php
-if (!extension_loaded('exif')) die('skip exif extension not available');
-?>
--FILE--
-<?php
-exif_read_data(__DIR__ . '/bug76130_1.jpg');
-exif_read_data(__DIR__ . '/bug76130_2.jpg');
-?>
-===DONE===
--EXPECT--
-===DONE===
@@ -1,19 +0,0 @@
--TEST--
-Bug #76423 (Int Overflow lead to Heap OverFlow in exif_thumbnail_extract of exif.c)
--SKIPIF--
-<?php
-if (!extension_loaded('exif')) die('skip exif extension not available');
-?>
--FILE--
-<?php
-exif_read_data(__DIR__ . '/bug76423.jpg', 0, true, true);
-?>
-===DONE===
--EXPECTF--
-
-Warning: exif_read_data(%s.jpg): Thumbnail goes IFD boundary or end of file reached in %s on line %d
-
-Warning: exif_read_data(%s.jpg): File structure corrupted in %s on line %d
-
-Warning: exif_read_data(%s.jpg): Invalid JPEG file in %s on line %d
-===DONE===
@@ -1,79 +0,0 @@
--TEST--
-Bug 76557 (heap-buffer-overflow (READ of size 48) while reading exif data)
--SKIPIF--
-<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
--FILE--
-<?php
-var_dump(count(exif_read_data(dirname(__FILE__) . "/bug76557.jpg")));
-?>
-DONE
--EXPECTF--
-Warning: exif_read_data(bug76557.jpg): Process tag(x010F=Make       ): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
-
-Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
-
-Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
-
-Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
-
-Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
-
-Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
-
-Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
-
-Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
-
-Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
-
-Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
-
-Warning: exif_read_data(bug76557.jpg): Process tag(x8769=Exif_IFD_Po): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
-
-Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
-
-Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
-
-Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
-
-Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
-
-Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
-
-Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
-
-Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
-
-Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
-
-Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
-
-Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
-
-Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
-
-Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
-
-Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
-
-Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
-
-Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
-
-Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
-
-Warning: exif_read_data(bug76557.jpg): Process tag(x927C=MakerNote  ): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
-
-Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
-
-Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
-
-Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
-
-Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal pointer offset(x30303030 + x30303030 = x60606060 > x00EE) in %sbug76557.php on line %d
-
-Warning: exif_read_data(bug76557.jpg): File structure corrupted in %sbug76557.php on line %d
-
-Warning: exif_read_data(bug76557.jpg): Invalid JPEG file in %sbug76557.php on line %d
-int(1)
-DONE
@@ -142,23 +142,23 @@ Warning: exif_imagetype(0.5): failed to open stream: No such file or directory i
 bool(false)
 -- Iteration 10 --

-Warning: exif_imagetype() expects parameter 1 to be a valid path, array given in %s on line %d
+Warning: exif_imagetype() expects parameter 1 to be string, array given in %s on line %d
 NULL
 -- Iteration 11 --

-Warning: exif_imagetype() expects parameter 1 to be a valid path, array given in %s on line %d
+Warning: exif_imagetype() expects parameter 1 to be string, array given in %s on line %d
 NULL
 -- Iteration 12 --

-Warning: exif_imagetype() expects parameter 1 to be a valid path, array given in %s on line %d
+Warning: exif_imagetype() expects parameter 1 to be string, array given in %s on line %d
 NULL
 -- Iteration 13 --

-Warning: exif_imagetype() expects parameter 1 to be a valid path, array given in %s on line %d
+Warning: exif_imagetype() expects parameter 1 to be string, array given in %s on line %d
 NULL
 -- Iteration 14 --

-Warning: exif_imagetype() expects parameter 1 to be a valid path, array given in %s on line %d
+Warning: exif_imagetype() expects parameter 1 to be string, array given in %s on line %d
 NULL
 -- Iteration 15 --

@@ -198,7 +198,7 @@ Warning: exif_imagetype(obj'ct): failed to open stream: No such file or director
 bool(false)
 -- Iteration 24 --

-Warning: exif_imagetype() expects parameter 1 to be a valid path, resource given in %s on line %d
+Warning: exif_imagetype() expects parameter 1 to be string, resource given in %s on line %d
 NULL
 -- Iteration 25 --

@@ -5175,7 +5175,7 @@ PHP_FUNCTION(imagescale)
 	gdImagePtr im_scaled = NULL;
 	int new_width, new_height;
 	long tmp_w, tmp_h=-1, tmp_m = GD_BILINEAR_FIXED;
-	gdInterpolationMethod method, old_method;
+	gdInterpolationMethod method;

 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rl|ll", &IM, &tmp_w, &tmp_h, &tmp_m) == FAILURE)  {
 		return;
@@ -5202,12 +5202,9 @@ PHP_FUNCTION(imagescale)
 	new_width = tmp_w;
 	new_height = tmp_h;

-	/* gdImageGetInterpolationMethod() is only available as of GD 2.1.1 */
-	old_method = im->interpolation_id;
 	if (gdImageSetInterpolationMethod(im, method)) {
 		im_scaled = gdImageScale(im, new_width, new_height);
 	}
-	gdImageSetInterpolationMethod(im, old_method);

 	if (im_scaled == NULL) {
 		RETURN_FALSE;
@@ -61,16 +61,6 @@ static int _php_image_stream_putbuf(struct gdIOCtx *ctx, const void* buf, int l)
 }

 static void _php_image_stream_ctxfree(struct gdIOCtx *ctx)
-{
-	if(ctx->data) {
-		ctx->data = NULL;
-	}
-	if(ctx) {
-		efree(ctx);
-	}
-} /* }}} */
-
-static void _php_image_stream_ctxfreeandclose(struct gdIOCtx *ctx) /* {{{ */
 {
 	TSRMLS_FETCH();

@@ -97,7 +87,6 @@ static void _php_image_output_ctx(INTERNAL_FUNCTION_PARAMETERS, int image_type,
 	gdIOCtx *ctx = NULL;
 	zval *to_zval = NULL;
 	php_stream *stream;
-	int close_stream = 1;

 	/* The third (quality) parameter for Wbmp stands for the threshold when called from image2wbmp().
 	 * The third (quality) parameter for Wbmp and Xbm stands for the foreground color index when called
@@ -134,7 +123,6 @@ static void _php_image_output_ctx(INTERNAL_FUNCTION_PARAMETERS, int image_type,
 			if (stream == NULL) {
 				RETURN_FALSE;
 			}
-			close_stream = 0;
 		} else if (Z_TYPE_P(to_zval) == IS_STRING) {
 			if (CHECK_ZVAL_NULL_PATH(to_zval)) {
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid 2nd parameter, filename must not contain null bytes");
@@ -171,11 +159,7 @@ static void _php_image_output_ctx(INTERNAL_FUNCTION_PARAMETERS, int image_type,
 		ctx = emalloc(sizeof(gdIOCtx));
 		ctx->putC = _php_image_stream_putc;
 		ctx->putBuf = _php_image_stream_putbuf;
-		if (close_stream) {
-			ctx->gd_free = _php_image_stream_ctxfreeandclose;
-		} else {
-			ctx->gd_free = _php_image_stream_ctxfree;
-		}
+		ctx->gd_free = _php_image_stream_ctxfree;
 		ctx->data = (void *)stream;
 	}

@@ -1117,7 +1117,7 @@ void gdImageLine (gdImagePtr im, int x1, int y1, int x2, int y2, int color)
 	}

 	/* 2.0.10: Nick Atty: clip to edges of drawing rectangle, return if no points need to be drawn */
-	if (!clip_1d(&x1,&y1,&x2,&y2,gdImageSX(im)-1) || !clip_1d(&y1,&x1,&y2,&x2,gdImageSY(im)-1)) {
+	if (!clip_1d(&x1,&y1,&x2,&y2,gdImageSX(im)) || !clip_1d(&y1,&x1,&y2,&x2,gdImageSY(im))) {
 		return;
 	}

@@ -1298,13 +1298,58 @@ inline static void gdImageSetAAPixelColor(gdImagePtr im, int x, int y, int color
 void gdImageAALine (gdImagePtr im, int x1, int y1, int x2, int y2, int col)
 {
 	/* keep them as 32bits */
-	long x, y, inc, frac;
+	long x, y, inc;
 	long dx, dy,tmp;

-	/* 2.0.10: Nick Atty: clip to edges of drawing rectangle, return if no points need to be drawn */
-	if (!clip_1d(&x1,&y1,&x2,&y2,gdImageSX(im)-1) || !clip_1d(&y1,&x1,&y2,&x2,gdImageSY(im)-1)) {
+	if (y1 < 0 && y2 < 0) {
 		return;
 	}
+	if (y1 < 0) {
+		x1 += (y1 * (x1 - x2)) / (y2 - y1);
+		y1 = 0;
+	}
+	if (y2 < 0) {
+		x2 += (y2 * (x1 - x2)) / (y2 - y1);
+		y2 = 0;
+	}
+
+	/* bottom edge */
+	if (y1 >= im->sy && y2 >= im->sy) {
+		return;
+	}
+	if (y1 >= im->sy) {
+		x1 -= ((im->sy - y1) * (x1 - x2)) / (y2 - y1);
+		y1 = im->sy - 1;
+	}
+	if (y2 >= im->sy) {
+		x2 -= ((im->sy - y2) * (x1 - x2)) / (y2 - y1);
+		y2 = im->sy - 1;
+	}
+
+	/* left edge */
+	if (x1 < 0 && x2 < 0) {
+		return;
+	}
+	if (x1 < 0) {
+		y1 += (x1 * (y1 - y2)) / (x2 - x1);
+		x1 = 0;
+	}
+	if (x2 < 0) {
+		y2 += (x2 * (y1 - y2)) / (x2 - x1);
+		x2 = 0;
+	}
+	/* right edge */
+	if (x1 >= im->sx && x2 >= im->sx) {
+		return;
+	}
+	if (x1 >= im->sx) {
+		y1 -= ((im->sx - x1) * (y1 - y2)) / (x2 - x1);
+		x1 = im->sx - 1;
+	}
+	if (x2 >= im->sx) {
+		y2 -= ((im->sx - x2) * (y1 - y2)) / (x2 - x1);
+		x2 = im->sx - 1;
+	}

 	dx = x2 - x1;
 	dy = y2 - y1;
@@ -1323,22 +1368,16 @@ void gdImageAALine (gdImagePtr im, int x1, int y1, int x2, int y2, int col)
 			dx = x2 - x1;
 			dy = y2 - y1;
 		}
-		y = y1;
+		x = x1 << 16;
+		y = y1 << 16;
 		inc = (dy * 65536) / dx;
-		frac = 0;
-		for (x = x1; x <= x2; x++) {
-			gdImageSetAAPixelColor(im, x, y, col, (frac >> 8) & 0xFF);
-			if (y + 1 < im->sy) {
-				gdImageSetAAPixelColor(im, x, y + 1, col, (~frac >> 8) & 0xFF);
-			}
-			frac += inc;
-			if (frac >= 65536) {
-				frac -= 65536;
-				y++;
-			} else if (frac < 0) {
-				frac += 65536;
-				y--;
+		while ((x >> 16) <= x2) {
+			gdImageSetAAPixelColor(im, x >> 16, y >> 16, col, (y >> 8) & 0xFF);
+			if ((y >> 16) + 1 < im->sy) {
+				gdImageSetAAPixelColor(im, x >> 16, (y >> 16) + 1,col, (~y >> 8) & 0xFF);
 			}
+			x += (1 << 16);
+			y += inc;
 		}
 	} else {
 		if (dy < 0) {
@@ -1351,22 +1390,16 @@ void gdImageAALine (gdImagePtr im, int x1, int y1, int x2, int y2, int col)
 			dx = x2 - x1;
 			dy = y2 - y1;
 		}
-		x = x1;
+		x = x1 << 16;
+		y = y1 << 16;
 		inc = (dx * 65536) / dy;
-		frac = 0;
-		for (y = y1; y <= y2; y++) {
-			gdImageSetAAPixelColor(im, x, y, col, (frac >> 8) & 0xFF);
-			if (x + 1 < im->sx) {
-				gdImageSetAAPixelColor(im, x + 1, y, col, (~frac >> 8) & 0xFF);
-			}
-			frac += inc;
-			if (frac >= 65536) {
-				frac -= 65536;
-				x++;
-			} else if (frac < 0) {
-				frac += 65536;
-				x--;
+		while ((y>>16) <= y2) {
+			gdImageSetAAPixelColor(im, x >> 16, y >> 16, col, (x >> 8) & 0xFF);
+			if ((x >> 16) + 1 < im->sx) {
+				gdImageSetAAPixelColor(im, (x >> 16) + 1, (y >> 16),col, (~x >> 8) & 0xFF);
 			}
+			x += inc;
+			y += (1<<16);
 		}
 	}
 }
@@ -1747,7 +1780,7 @@ void gdImageFillToBorder (gdImagePtr im, int x, int y, int border, int color)
 	int leftLimit = -1, rightLimit;
 	int i, restoreAlphaBlending = 0;

-	if (border < 0 || color < 0) {
+	if (border < 0) {
 		/* Refuse to fill to a non-solid border */
 		return;
 	}
@@ -243,10 +243,6 @@ gdImagePtr gdImageCropThreshold(gdImagePtr im, const unsigned int color, const f
 		return NULL;
 	}

-	if (!gdImageTrueColor(im) && color >= gdImageColorsTotal(im)) {
-		return NULL;
-	}
-
 	/* TODO: Add gdImageGetRowPtr and works with ptr at the row level
 	 * for the true color and palette images
 	 * new formats will simply work with ptr
@@ -136,10 +136,6 @@ static int _gd2GetHeader(gdIOCtxPtr in, int *sx, int *sy, int *cs, int *vers, in
 	GD2_DBG(php_gd_error("%d Chunks vertically", *ncy));

 	if (gd2_compressed(*fmt)) {
-		if (*ncx <= 0 || *ncy <= 0 || *ncx > INT_MAX / *ncy) {
-			GD2_DBG(printf ("Illegal chunk counts: %d * %d\n", *ncx, *ncy));
-			goto fail1;
-		}
 		nc = (*ncx) * (*ncy);
 		GD2_DBG(php_gd_error("Reading %d chunk index entries", nc));
 		if (overflow2(sizeof(t_chunk_info), nc)) {
@@ -344,16 +340,12 @@ gdImagePtr gdImageCreateFromGd2Ctx (gdIOCtxPtr in)
 					for (x = xlo; x < xhi; x++) {
 						if (im->trueColor) {
 							if (!gdGetInt(&im->tpixels[y][x], in)) {
-								php_gd_error("gd2: EOF while reading\n");
-								gdImageDestroy(im);
-								return NULL;
+								im->tpixels[y][x] = 0;
 							}
 						} else {
 							int ch;
 							if (!gdGetByte(&ch, in)) {
-								php_gd_error("gd2: EOF while reading\n");
-								gdImageDestroy(im);
-								return NULL;
+								ch = 0;
 							}
 							im->pixels[y][x] = ch;
 						}
@@ -147,9 +147,6 @@ gdImagePtr gdImageCreateFromGifCtx(gdIOCtxPtr fd) /* {{{ */
 	int haveGlobalColormap;
 	gdImagePtr im = 0;

-	memset(ColorMap, 0, 3 * MAXCOLORMAPSIZE);
-	memset(localColorMap, 0, 3 * MAXCOLORMAPSIZE);
-
 	/*1.4//imageNumber = 1; */
 	if (! ReadOK(fd,buf,6)) {
 		return 0;
@@ -261,6 +258,10 @@ terminated:
 	if (!im) {
 		return 0;
 	}
+	if (!im->colorsTotal) {
+		gdImageDestroy(im);
+		return 0;
+	}
 	/* Check for open colors at the end, so
 	   we can reduce colorsTotal and ultimately
 	   BitsPerPixel */
@@ -271,10 +272,6 @@ terminated:
 			break;
 		}
 	}
-	if (!im->colorsTotal) {
-		gdImageDestroy(im);
-		return 0;
-	}
 	return im;
 }
 /* }}} */
@@ -375,7 +372,7 @@ static int
 GetCode_(gdIOCtx *fd, CODE_STATIC_DATA *scd, int code_size, int flag, int *ZeroDataBlockP)
 {
 	int           i, j, ret;
-	int           count;
+	unsigned char count;

 	if (flag) {
 		scd->curbit = 0;
@@ -1331,10 +1331,10 @@ static gdImagePtr gdImageScaleBilinearPalette(gdImagePtr im, const unsigned int
 			f_a4 = gd_itofx(gdTrueColorGetAlpha(pixel4));

 			{
-				const unsigned char red = (unsigned char) gd_fxtoi(gd_mulfx(f_w1, f_r1) + gd_mulfx(f_w2, f_r2) + gd_mulfx(f_w3, f_r3) + gd_mulfx(f_w4, f_r4));
-				const unsigned char green = (unsigned char) gd_fxtoi(gd_mulfx(f_w1, f_g1) + gd_mulfx(f_w2, f_g2) + gd_mulfx(f_w3, f_g3) + gd_mulfx(f_w4, f_g4));
-				const unsigned char blue = (unsigned char) gd_fxtoi(gd_mulfx(f_w1, f_b1) + gd_mulfx(f_w2, f_b2) + gd_mulfx(f_w3, f_b3) + gd_mulfx(f_w4, f_b4));
-				const unsigned char alpha = (unsigned char) gd_fxtoi(gd_mulfx(f_w1, f_a1) + gd_mulfx(f_w2, f_a2) + gd_mulfx(f_w3, f_a3) + gd_mulfx(f_w4, f_a4));
+				const char red = (char) gd_fxtoi(gd_mulfx(f_w1, f_r1) + gd_mulfx(f_w2, f_r2) + gd_mulfx(f_w3, f_r3) + gd_mulfx(f_w4, f_r4));
+				const char green = (char) gd_fxtoi(gd_mulfx(f_w1, f_g1) + gd_mulfx(f_w2, f_g2) + gd_mulfx(f_w3, f_g3) + gd_mulfx(f_w4, f_g4));
+				const char blue = (char) gd_fxtoi(gd_mulfx(f_w1, f_b1) + gd_mulfx(f_w2, f_b2) + gd_mulfx(f_w3, f_b3) + gd_mulfx(f_w4, f_b4));
+				const char alpha = (char) gd_fxtoi(gd_mulfx(f_w1, f_a1) + gd_mulfx(f_w2, f_a2) + gd_mulfx(f_w3, f_a3) + gd_mulfx(f_w4, f_a4));

 				new_img->tpixels[dst_offset_v][dst_offset_h] = gdTrueColorAlpha(red, green, blue, alpha);
 			}
@@ -237,7 +237,7 @@ static int dynamicGetbuf (gdIOCtxPtr ctx, void *buf, int len)
 	if (remain >= len) {
 		rlen = len;
 	} else {
-		if (remain <= 0) {
+		if (remain == 0) {
 			return EOF;
 		}
 		rlen = remain;
@@ -1,19 +0,0 @@
--TEST--
-Bug #72482 (Ilegal write/read access caused by gdImageAALine overflow)
--SKIPIF--
-<?php
-if (!extension_loaded('gd')) die('skip gd extension not available');
-?>
--FILE--
-<?php
-$img = imagecreatetruecolor(13, 1007);
-imageantialias($img, true);
-imageline($img, 0, 0, 1073745919, 1073745919, 4096);
-
-$img = imagecreatetruecolor(100, 100);
-imageantialias($img, true);
-imageline($img, 1094795585, 0, 2147483647, 255, 0xff);
-?>
-===DONE===
--EXPECT--
-===DONE===
@@ -1,21 +0,0 @@
--TEST--
-Bug 72482 (Ilegal write/read access caused by gdImageAALine overflow)
--SKIPIF--
-<?php
-if (!extension_loaded('gd')) die('skip gd extension not available');
-?>
--FILE--
-<?php
-require_once __DIR__ . DIRECTORY_SEPARATOR . 'func.inc';
-
-$im = imagecreatetruecolor(10, 10);
-imagefilledrectangle($im, 0, 0, 9, 9, imagecolorallocate($im, 255, 255, 255));
-imageantialias($im, true);
-imageline($im, 0, 0, 10, 10, imagecolorallocate($im, 0, 0, 0));
-
-test_image_equals_file(__DIR__ . DIRECTORY_SEPARATOR . 'bug72482_2.png', $im);
-?>
-===DONE===
--EXPECT--
-The images are equal.
-===DONE===
@@ -1,15 +0,0 @@
--TEST--
-Bug #72494 (imagecropauto out-of-bounds access)
--SKIPIF--
-<?php
-if (!extension_loaded('gd')) die('skip gd extension not available');
-?>
--FILE--
-<?php
-$im = imagecreate(10,10);
-imagecropauto($im, IMG_CROP_THRESHOLD, 0, 1337);
-?>
-===DONE===
--EXPECTF--
-Warning: imagecropauto(): Color argument missing with threshold mode in %s on line %d
-===DONE===
@@ -1,14 +0,0 @@
--TEST--
-Bug #72696 (imagefilltoborder stackoverflow on truecolor images)
--SKIPIF--
-<?php
-if (!extension_loaded('gd')) die('skip gd extension not available');
-?>
--FILE--
-<?php
-$im = imagecreatetruecolor(10, 10);
-imagefilltoborder($im, 0, 0, 1, -2);
-?>
-===DONE===
--EXPECT--
-===DONE===
@@ -1,22 +0,0 @@
--TEST--
-Bug #73213 (Integer overflow in imageline() with antialiasing)
--SKIPIF--
-<?php
-if (!extension_loaded('gd')) die('skip gd extension not available');
-?>
--FILE--
-<?php
-require_once __DIR__ . DIRECTORY_SEPARATOR . 'func.inc';
-
-$im = imagecreatetruecolor(32768, 1);
-$black = imagecolorallocate($im, 0, 0, 0);
-imageantialias($im, true);
-
-imageline($im, 0,0, 32767,0, $black);
-
-test_image_equals_file(__DIR__ . DIRECTORY_SEPARATOR . 'bug73213.png', $im);
-?>
-===DONE===
--EXPECT--
-The images are equal.
-===DONE===
@@ -1,24 +0,0 @@
--TEST--
-Bug #73272 (imagescale() is not affected by, but affects imagesetinterpolation())
--SKIPIF--
-<?php
-if (!extension_loaded('gd')) die('skip gd extension not available');
-?>
--FILE--
-<?php
-require_once __DIR__ . DIRECTORY_SEPARATOR . 'func.inc';
-
-$src = imagecreatetruecolor(100, 100);
-imagefilledrectangle($src, 0,0, 99,99, 0xFFFFFF);
-imageellipse($src, 49,49, 40,40, 0x000000);
-
-imagesetinterpolation($src, IMG_NEAREST_NEIGHBOUR);
-imagescale($src, 200, 200, IMG_BILINEAR_FIXED);
-$dst = imagerotate($src, 60, 0xFFFFFF);
-
-test_image_equals_file(__DIR__ . DIRECTORY_SEPARATOR . 'bug73272.png', $dst);
-?>
-===DONE===
--EXPECT--
-The images are equal.
-===DONE===
@@ -1,20 +0,0 @@
--TEST--
-Bug #73279 (Integer overflow in gdImageScaleBilinearPalette())
--SKIPIF--
-<?php
-if (!extension_loaded('gd')) die('skip gd extension not available');
-if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.4', '<')) {
-    die('skip only for bundled libgd or external libgd >= 2.2.4');
-}
-?>
--FILE--
-<?php
-$src = imagecreate(100, 100);
-imagecolorallocate($src, 255, 255, 255);
-$dst = imagescale($src, 200, 200, IMG_BILINEAR_FIXED);
-printf("color: %x\n", imagecolorat($dst, 99, 99));
-?>
-===DONE===
--EXPECT--
-color: ffffff
-===DONE===
@@ -1,22 +0,0 @@
--TEST--
-Bug #73279 (Integer overflow in gdImageScaleBilinearPalette())
--SKIPIF--
-<?php
-if (!extension_loaded('gd')) die('skip gd extension not available');
-if (GD_BUNDLED || version_compare(GD_VERSION, '2.2.4', '>=')) {
-    die('skip only for external libgd < 2.2.4');
-}
-?>
--FILE--
-<?php
-$src = imagecreate(100, 100);
-imagecolorallocate($src, 255, 255, 255);
-$dst = imagescale($src, 200, 200, IMG_BILINEAR_FIXED);
-printf("color: %x\n", imagecolorat($dst, 99, 99));
-?>
-===DONE===
--XFAIL--
-Bug #330 has not yet been fixed
--EXPECT--
-color: ffffff
-===DONE===
@@ -1,22 +0,0 @@
--TEST--
-Bug #73549 (Use after free when stream is passed to imagepng)
--SKIPIF--
-<?php
-if (!extension_loaded('gd')) die('skip gd extension not available');
-?>
--FILE--
-<?php
-$stream = fopen(__DIR__ . DIRECTORY_SEPARATOR . 'bug73549.png', 'w');
-$im = imagecreatetruecolor(8, 8);
-var_dump(imagepng($im, $stream));
-var_dump($stream);
-?>
-===DONE===
--EXPECTF--
-bool(true)
-resource(%d) of type (stream)
-===DONE===
--CLEAN--
-<?php
-unlink(__DIR__ . DIRECTORY_SEPARATOR . 'bug73549.png');
-?>
@@ -1,18 +0,0 @@
--TEST--
-Bug 73868 (DOS vulnerability in gdImageCreateFromGd2Ctx())
--SKIPIF--
-<?php
-if (!extension_loaded('gd')) die('skip gd extension not available');
-?>
--FILE--
-<?php
-var_dump(imagecreatefromgd2(__DIR__ . DIRECTORY_SEPARATOR . 'bug73868.gd2'));
-?>
-===DONE===
--EXPECTF--
-Warning: imagecreatefromgd2(): gd2: EOF while reading
- in %s on line %d
-
-Warning: imagecreatefromgd2(): '%s' is not a valid GD2 file in %s on line %d
-bool(false)
-===DONE===
@@ -1,19 +0,0 @@
--TEST--
-Bug #73869 (Signed Integer Overflow gd_io.c)
--SKIPIF--
-<?php
-if (!extension_loaded('gd')) die('skip gd extension not available');
-?>
--FILE--
-<?php
-var_dump(imagecreatefromgd2(__DIR__ . DIRECTORY_SEPARATOR . 'bug73869a.gd2'));
-var_dump(imagecreatefromgd2(__DIR__ . DIRECTORY_SEPARATOR . 'bug73869b.gd2'));
-?>
-===DONE===
--EXPECTF--
-Warning: imagecreatefromgd2(): '%s' is not a valid GD2 file in %s on line %d
-bool(false)
-
-Warning: imagecreatefromgd2(): '%s' is not a valid GD2 file in %s on line %d
-bool(false)
-===DONE===
@@ -1,27 +0,0 @@
--TEST--
-Bug #74435 (Buffer over-read into uninitialized memory)
--SKIPIF--
-<?php
-if (!extension_loaded('gd')) die('skip gd extension not available');
-?>
--FILE--
-<?php
-$im = imagecreatefromgif(__DIR__ . DIRECTORY_SEPARATOR . 'bug74435.gif');
-var_dump($im);
-$width = imagesx($im);
-$height = imagesy($im);
-for ($i = 0; $i < $width; $i += 16) {
-    for ($j = 0; $j < $height; $j += 16) {
-        if (($index = imagecolorat($im, $i, $j)) >= 2) {
-            list($red, $green, $blue, $alpha) = array_values(imagecolorsforindex($im, $index));
-            if ($red !== 0 || $green !== 0 || $blue !== 0 || $alpha !== 0) {
-                echo "unexpected color at ($i, $j)\n";
-            }
-        }
-    }
-}
-?>
-===DONE===
--EXPECTF--
-resource(%d) of type (gd)
-===DONE===
@@ -1,15 +0,0 @@
--TEST--
-Bug #75571 (Infinite loop in GIF reading causing DoS)
--SKIPIF--
-<?php
-if (!extension_loaded('gd')) die('skip gd extension not available');
-?>
--FILE--
-<?php
-var_dump(imagecreatefromgif(__DIR__ . '/bug75571.gif'));
-?>
-===DONE===
--EXPECTF--
-Warning: imagecreatefromgif(): '%s' is not a valid GIF file in %s on line %d
-bool(false)
-===DONE===
@@ -4,7 +4,6 @@ Font charmap order is deterministic based on order in the font, use the selected
 <?php
 	if(!extension_loaded('gd')){ die('skip gd extension not available'); }
 	if(!function_exists('imagettftext')) die('skip imagettftext() not available');
-  if(gd_info()['JIS-mapped Japanese Font Support']) die('skip JIS-mapped Japanese Font Support not supported');
 ?>
 --FILE--
 <?php
@@ -2491,7 +2491,7 @@ PHP_NAMED_FUNCTION(php_if_iconv)
 		&out_buffer, &out_len, out_charset, in_charset);
 	_php_iconv_show_error(err, out_charset, in_charset TSRMLS_CC);
 	if (err == PHP_ICONV_ERR_SUCCESS && out_buffer != NULL) {
-		RETVAL_STRINGL_CHECK(out_buffer, out_len, 0);
+		RETVAL_STRINGL(out_buffer, out_len, 0);
 	} else {
 		if (out_buffer != NULL) {
 			efree(out_buffer);
@@ -2672,9 +2672,6 @@ static int php_iconv_stream_filter_append_bucket(
 								tcnt = 0;
 								break;
 							}
-						} else {
-						    php_error_docref(NULL TSRMLS_CC, E_WARNING, "iconv stream filter (\"%s\"=>\"%s\"): invalid multibyte sequence", self->from_charset, self->to_charset);
-						    goto out_failure;
 						}
 						break;

@@ -1,20 +0,0 @@
--TEST--
-Bug #76249 (stream filter convert.iconv leads to infinite loop on invalid sequence)
--SKIPIF--
-<?php extension_loaded('iconv') or die('skip iconv extension is not available'); ?>
--FILE--
-<?php
-$fh = fopen('php://memory', 'rw');
-fwrite($fh, "abc");
-rewind($fh);
-if (false === @stream_filter_append($fh, 'convert.iconv.ucs-2/utf8//IGNORE', STREAM_FILTER_READ, [])) {
-	stream_filter_append($fh, 'convert.iconv.ucs-2/utf-8//IGNORE', STREAM_FILTER_READ, []);
-}
-$a = stream_get_contents($fh);
-var_dump(strlen($a));
-?>
-DONE
--EXPECTF--
-Warning: stream_get_contents(): iconv stream filter ("ucs-2"=>"utf%A8//IGNORE"): invalid multibyte sequence in %sbug76249.php on line %d
-int(3)
-DONE
@@ -2523,7 +2523,7 @@ PHP_FUNCTION(imap_8bit)
 		RETURN_FALSE;
 	}

-	RETVAL_STRINGL_CHECK(decode, newlength, 1);
+	RETVAL_STRINGL(decode, newlength, 1);
 	fs_give((void**) &decode);
 }
 /* }}} */
@@ -3900,7 +3900,7 @@ int _php_imap_mail(char *to, char *subject, char *message, char *headers, char *
 	char *tsm_errmsg = NULL;
 	ADDRESS *addr;
 	char *bufferTo = NULL, *bufferCc = NULL, *bufferBcc = NULL, *bufferHeader = NULL;
-	size_t offset, bufferLen = 0;
+	int offset, bufferLen = 0;
 	size_t bt_len;

 	if (headers) {
@@ -3916,7 +3916,7 @@ int _php_imap_mail(char *to, char *subject, char *message, char *headers, char *
 #define PHP_IMAP_CLEAN	if (bufferTo) efree(bufferTo); if (bufferCc) efree(bufferCc); if (bufferBcc) efree(bufferBcc); if (bufferHeader) efree(bufferHeader);
 #define PHP_IMAP_BAD_DEST PHP_IMAP_CLEAN; efree(tempMailTo); return (BAD_MSG_DESTINATION);

-	bufferHeader = (char *)safe_emalloc(bufferLen, 1, 1);
+	bufferHeader = (char *)emalloc(bufferLen + 1);
 	memset(bufferHeader, 0, bufferLen);
 	if (to && *to) {
 		strlcat(bufferHeader, "To: ", bufferLen + 1);
@@ -182,7 +182,7 @@ static void _breakiterator_parts_move_forward(zend_object_iterator *iter TSRMLS_
 	}
 	assert(next <= slen && next >= cur);
 	len = next - cur;
-	res = static_cast<char*>(safe_emalloc(len, 1, 1));
+	res = static_cast<char*>(emalloc(len + 1));

 	memcpy(res, &s[cur], len);
 	res[len] = '\0';
@@ -16,7 +16,7 @@
 */

 #ifndef COLLATOR_COLLATOR_H
-#define COLLATOR_COLLATOR_H
+#define CCOLLATOR_COLLATOR_H

 #include <php.h>

@@ -702,10 +702,8 @@ PHP_FUNCTION(grapheme_stristr)
 static inline int32_t
 grapheme_extract_charcount_iter(UBreakIterator *bi, int32_t csize, unsigned char *pstr, int32_t str_len)
 {
-	int pos = 0;
-	int ret_pos = 0;
-	int break_pos, prev_break_pos;
-	int count = 0;
+	int pos = 0, prev_pos = 0;
+	int ret_pos = 0, prev_ret_pos = 0;

 	while ( 1 ) {
 		pos = ubrk_next(bi);
@@ -714,24 +712,23 @@ grapheme_extract_charcount_iter(UBreakIterator *bi, int32_t csize, unsigned char
 			break;
 		}

-		for ( break_pos = ret_pos; break_pos < pos; ) {
-			count++;
-			prev_break_pos = break_pos;
-			U8_FWD_1(pstr, break_pos, str_len);
-
-			if ( prev_break_pos == break_pos ) {
-				/* something wrong - malformed utf8? */
-				csize = 0;
-				break;
-			}
-		}
-
 		/* if we are beyond our limit, then the loop is done */
-		if ( count > csize ) {
+		if ( pos > csize ) {
 			break;
 		}

-		ret_pos = break_pos;
+		/* update our pointer in the original UTF-8 buffer by as many characters
+		   as ubrk_next iterated over */
+
+		prev_ret_pos = ret_pos;
+		U8_FWD_N(pstr, ret_pos, str_len, pos - prev_pos);
+
+		if ( prev_ret_pos == ret_pos ) {
+			/* something wrong - malformed utf8? */
+			break;
+		}
+
+		prev_pos = pos;
 	}

 	return ret_pos;
@@ -742,8 +739,8 @@ grapheme_extract_charcount_iter(UBreakIterator *bi, int32_t csize, unsigned char
 static inline int32_t
 grapheme_extract_bytecount_iter(UBreakIterator *bi, int32_t bsize, unsigned char *pstr, int32_t str_len)
 {
-	int pos = 0;
-	int ret_pos = 0;
+	int pos = 0, prev_pos = 0;
+	int ret_pos = 0, prev_ret_pos = 0;

 	while ( 1 ) {
 		pos = ubrk_next(bi);
@@ -752,11 +749,20 @@ grapheme_extract_bytecount_iter(UBreakIterator *bi, int32_t bsize, unsigned char
 			break;
 		}

-		if ( pos > bsize ) {
+		prev_ret_pos = ret_pos;
+		U8_FWD_N(pstr, ret_pos, str_len, pos - prev_pos);
+
+		if ( ret_pos > bsize ) {
+			ret_pos = prev_ret_pos;
 			break;
 		}

-		ret_pos = pos;
+		if ( prev_ret_pos == ret_pos ) {
+			/* something wrong - malformed utf8? */
+			break;
+		}
+
+		prev_pos = pos;
 	}

 	return ret_pos;
@@ -767,7 +773,7 @@ grapheme_extract_bytecount_iter(UBreakIterator *bi, int32_t bsize, unsigned char
 static inline int32_t
 grapheme_extract_count_iter(UBreakIterator *bi, int32_t size, unsigned char *pstr, int32_t str_len)
 {
-	int next_pos = 0;
+	int pos = 0, next_pos = 0;
 	int ret_pos = 0;

 	while ( size ) {
@@ -776,10 +782,16 @@ grapheme_extract_count_iter(UBreakIterator *bi, int32_t size, unsigned char *pst
 		if ( UBRK_DONE == next_pos ) {
 			break;
 		}
-		ret_pos = next_pos;
+		pos = next_pos;
 		size--;
 	}

+	/* pos is one past the last UChar - and represent the number of code units to
+		advance in the utf-8 buffer
+	*/
+
+	U8_FWD_N(pstr, ret_pos, str_len, pos);
+
 	return ret_pos;
 }
 /* }}} */
@@ -798,9 +810,9 @@ static grapheme_extract_iter grapheme_extract_iters[] = {
 	Function to extract a sequence of default grapheme clusters */
 PHP_FUNCTION(grapheme_extract)
 {
-	char *str, *pstr;
-	UText ut = UTEXT_INITIALIZER;
-	int str_len;
+	unsigned char *str, *pstr;
+	UChar *ustr;
+	int str_len, ustr_len;
 	long size; /* maximum number of grapheme clusters, bytes, or characters (based on extract_type) to return */
 	long lstart = 0; /* starting position in str in bytes */
 	int32_t start = 0;
@@ -888,15 +900,21 @@ PHP_FUNCTION(grapheme_extract)
 		RETURN_STRINGL(((char *)pstr), nsize, 1);
 	}

+	/* convert the strings to UTF-16. */
+	ustr = NULL;
+	ustr_len = 0;
 	status = U_ZERO_ERROR;
-	utext_openUTF8(&ut, pstr, str_len, &status);
+	intl_convert_utf8_to_utf16(&ustr, &ustr_len, (char *)pstr, str_len, &status );

 	if ( U_FAILURE( status ) ) {
 		/* Set global error code. */
 		intl_error_set_code( NULL, status TSRMLS_CC );

 		/* Set error messages. */
-		intl_error_set_custom_msg( NULL, "Error opening UTF-8 text", 0 TSRMLS_CC );
+		intl_error_set_custom_msg( NULL, "Error converting input string to UTF-16", 0 TSRMLS_CC );
+
+		if ( NULL != ustr )
+			efree( ustr );

 		RETURN_FALSE;
 	}
@@ -905,7 +923,8 @@ PHP_FUNCTION(grapheme_extract)
 	status = U_ZERO_ERROR;
 	bi = grapheme_get_break_iterator(u_break_iterator_buffer, &status TSRMLS_CC );

-	ubrk_setUText(bi, &ut, &status);
+	ubrk_setText(bi, ustr, ustr_len, &status);
+
 	/* if the caller put us in the middle of a grapheme, we can't detect it in all cases since we
 		can't back up. So, we will not do anything. */

@@ -913,7 +932,9 @@ PHP_FUNCTION(grapheme_extract)

 	ret_pos = (*grapheme_extract_iters[extract_type])(bi, size, pstr, str_len);

-	utext_close(&ut);
+	if (ustr) {
+		efree(ustr);
+	}
 	ubrk_close(bi);

 	if ( NULL != next ) {
@@ -49,7 +49,7 @@ void intl_convert_utf8_to_utf16(
 	UErrorCode* status )
 {
 	UChar*      dst_buf = NULL;
-	uint32_t    dst_len = 0;
+	int32_t     dst_len = 0;

 	/* If *target is NULL determine required destination buffer size (pre-flighting).
 	 * Otherwise, attempt to convert source string; if *target buffer is not large enough
@@ -263,9 +263,6 @@ static char* get_icu_value_internal( const char* loc_name , char* tag_name, int*
 	int32_t     	buflen          = 512;
 	UErrorCode  	status          = U_ZERO_ERROR;

-	if (strlen(loc_name) > INTL_MAX_LOCALE_LEN) {
-		return NULL;
-	}

 	if( strcmp(tag_name, LOC_CANONICALIZE_TAG) != 0 ){
 		/* Handle  grandfathered languages */
@@ -399,8 +396,6 @@ static void get_icu_value_src_php( char* tag_name, INTERNAL_FUNCTION_PARAMETERS)
 		loc_name = intl_locale_get_default(TSRMLS_C);
 	}

-	INTL_CHECK_LOCALE_LEN(strlen(loc_name));
-
 	/* Call ICU get */
 	tag_value = get_icu_value_internal( loc_name , tag_name , &result ,0);

@@ -705,8 +700,6 @@ PHP_FUNCTION( locale_get_keywords )
        RETURN_FALSE;
    }

-	INTL_CHECK_LOCALE_LEN(strlen(loc_name));
-
    if(loc_name_len == 0) {
        loc_name = intl_locale_get_default(TSRMLS_C);
    }
@@ -1114,8 +1107,6 @@ PHP_FUNCTION(locale_parse)
        RETURN_FALSE;
    }

-    INTL_CHECK_LOCALE_LEN(strlen(loc_name));
-
    if(loc_name_len == 0) {
        loc_name = intl_locale_get_default(TSRMLS_C);
    }
@@ -1168,7 +1159,6 @@ PHP_FUNCTION(locale_get_all_variants)
 		loc_name = intl_locale_get_default(TSRMLS_C);
 	}

-	INTL_CHECK_LOCALE_LEN(strlen(loc_name));

 	array_init( return_value );

@@ -1277,9 +1267,6 @@ PHP_FUNCTION(locale_filter_matches)
 		RETURN_TRUE;
 	}

-	INTL_CHECK_LOCALE_LEN(strlen(loc_range));
-	INTL_CHECK_LOCALE_LEN(strlen(lang_tag));
-
 	if( boolCanonical ){
 		/* canonicalize loc_range */
 		can_loc_range=get_icu_value_internal( loc_range , LOC_CANONICALIZE_TAG , &result , 0);
@@ -1562,8 +1549,6 @@ PHP_FUNCTION(locale_lookup)
 		loc_range = intl_locale_get_default(TSRMLS_C);
 	}

-	INTL_CHECK_LOCALE_LEN(strlen(loc_range));
-
 	hash_arr = HASH_OF(arr);

 	if( !hash_arr || zend_hash_num_elements( hash_arr ) == 0 ) {
@@ -80,10 +80,10 @@ msgformat_data* msgformat_data_create( TSRMLS_D )
 /* }}} */

 #ifdef MSG_FORMAT_QUOTE_APOS
-int msgformat_fix_quotes(UChar **spattern, uint32_t *spattern_len, UErrorCode *ec)
+int msgformat_fix_quotes(UChar **spattern, uint32_t *spattern_len, UErrorCode *ec) 
 {
 	if(*spattern && *spattern_len && u_strchr(*spattern, (UChar)'\'')) {
-		UChar *npattern = safe_emalloc(sizeof(UChar)*2, *spattern_len, sizeof(UChar));
+		UChar *npattern = emalloc(sizeof(UChar)*(2*(*spattern_len)+1));
 		uint32_t npattern_len;
 		npattern_len = umsg_autoQuoteApostrophe(*spattern, *spattern_len, npattern, 2*(*spattern_len)+1, ec);
 		efree(*spattern);
@@ -77,7 +77,7 @@ static zend_object_value ResourceBundle_object_create( zend_class_entry *ce TSRM
 /* }}} */

 /* {{{ ResourceBundle_ctor */
-static void resourcebundle_ctor(INTERNAL_FUNCTION_PARAMETERS)
+static void resourcebundle_ctor(INTERNAL_FUNCTION_PARAMETERS) 
 {
 	const char	*bundlename;
 	int			bundlename_len = 0;
@@ -90,7 +90,7 @@ static void resourcebundle_ctor(INTERNAL_FUNCTION_PARAMETERS)

 	intl_error_reset( NULL TSRMLS_CC );

-	if( zend_parse_parameters( ZEND_NUM_ARGS() TSRMLS_CC, "s!s!|b",
+	if( zend_parse_parameters( ZEND_NUM_ARGS() TSRMLS_CC, "s!s!|b", 
 		&locale, &locale_len, &bundlename, &bundlename_len, &fallback ) == FAILURE )
 	{
 		intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR,
@@ -100,18 +100,11 @@ static void resourcebundle_ctor(INTERNAL_FUNCTION_PARAMETERS)
 	}

 	INTL_CHECK_LOCALE_LEN_OBJ(locale_len, return_value);
-
+	
 	if (locale == NULL) {
 		locale = intl_locale_get_default(TSRMLS_C);
 	}

-	if (bundlename_len >= MAXPATHLEN) {
-		intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR,	"Bundle name too long", 0 TSRMLS_CC );
-		zval_dtor(return_value);
-		ZVAL_NULL(return_value);
-		RETURN_NULL();
-	}
-
 	if (fallback) {
 		rb->me = ures_open(bundlename, locale, &INTL_DATA_ERROR_CODE(rb));
 	} else {
@@ -158,7 +151,7 @@ PHP_METHOD( ResourceBundle, __construct )
 /* {{{ proto ResourceBundle ResourceBundle::create( string $locale [, string $bundlename [, bool $fallback = true ]] )
 proto ResourceBundle resourcebundle_create( string $locale [, string $bundlename [, bool $fallback = true ]] )
 */
-PHP_FUNCTION( resourcebundle_create )
+PHP_FUNCTION( resourcebundle_create ) 
 {
 	object_init_ex( return_value, ResourceBundle_ce_ptr );
 	resourcebundle_ctor(INTERNAL_FUNCTION_PARAM_PASSTHRU);
@@ -166,7 +159,7 @@ PHP_FUNCTION( resourcebundle_create )
 /* }}} */

 /* {{{ resourcebundle_array_fetch */
-static void resourcebundle_array_fetch(zval *object, zval *offset, zval *return_value, int fallback TSRMLS_DC)
+static void resourcebundle_array_fetch(zval *object, zval *offset, zval *return_value, int fallback TSRMLS_DC) 
 {
 	int32_t     meindex = 0;
 	char *      mekey = NULL;
@@ -174,7 +167,7 @@ static void resourcebundle_array_fetch(zval *object, zval *offset, zval *return_
 	char         *pbuf;
 	ResourceBundle_object *rb;

-	intl_error_reset( NULL TSRMLS_CC );
+	intl_error_reset( NULL TSRMLS_CC );	
 	RESOURCEBUNDLE_METHOD_FETCH_OBJECT;

 	if(Z_TYPE_P(offset) == IS_LONG) {
@@ -185,12 +178,12 @@ static void resourcebundle_array_fetch(zval *object, zval *offset, zval *return_
 		mekey = Z_STRVAL_P(offset);
 		rb->child = ures_getByKey(rb->me, mekey, rb->child, &INTL_DATA_ERROR_CODE(rb) );
 	} else {
-		intl_errors_set(INTL_DATA_ERROR_P(rb), U_ILLEGAL_ARGUMENT_ERROR,
+		intl_errors_set(INTL_DATA_ERROR_P(rb), U_ILLEGAL_ARGUMENT_ERROR,	
 			"resourcebundle_get: index should be integer or string", 0 TSRMLS_CC);
 		RETURN_NULL();
 	}

-	intl_error_set_code( NULL, INTL_DATA_ERROR_CODE(rb) TSRMLS_CC );
+	intl_error_set_code( NULL, INTL_DATA_ERROR_CODE(rb) TSRMLS_CC );	
 	if (U_FAILURE(INTL_DATA_ERROR_CODE(rb))) {
 		if (is_numeric) {
 			spprintf( &pbuf, 0, "Cannot load resource element %d", meindex );
@@ -220,7 +213,7 @@ static void resourcebundle_array_fetch(zval *object, zval *offset, zval *return_
 /* }}} */

 /* {{{ resourcebundle_array_get */
-zval *resourcebundle_array_get(zval *object, zval *offset, int type TSRMLS_DC)
+zval *resourcebundle_array_get(zval *object, zval *offset, int type TSRMLS_DC) 
 {
 	zval *retval;

@@ -253,7 +246,7 @@ PHP_FUNCTION( resourcebundle_get )
 	zval *      object;

 	if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Oz|b",	&object, ResourceBundle_ce_ptr, &offset, &fallback ) == FAILURE) {
-		intl_error_set(NULL, U_ILLEGAL_ARGUMENT_ERROR,
+		intl_error_set(NULL, U_ILLEGAL_ARGUMENT_ERROR,	
 			"resourcebundle_get: unable to parse input params", 0 TSRMLS_CC);
 		RETURN_FALSE;
 	}
@@ -263,7 +256,7 @@ PHP_FUNCTION( resourcebundle_get )
 /* }}} */

 /* {{{ resourcebundle_array_count */
-int resourcebundle_array_count(zval *object, long *count TSRMLS_DC)
+int resourcebundle_array_count(zval *object, long *count TSRMLS_DC) 
 {
 	ResourceBundle_object *rb;
 	RESOURCEBUNDLE_METHOD_FETCH_OBJECT_NO_CHECK;
@@ -295,7 +288,7 @@ PHP_FUNCTION( resourcebundle_count )
 	RESOURCEBUNDLE_METHOD_INIT_VARS;

 	if( zend_parse_method_parameters( ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "O", &object, ResourceBundle_ce_ptr ) == FAILURE ) {
-		intl_error_set(NULL, U_ILLEGAL_ARGUMENT_ERROR,
+		intl_error_set(NULL, U_ILLEGAL_ARGUMENT_ERROR,	
 			"resourcebundle_count: unable to parse input params", 0 TSRMLS_CC);
 		RETURN_FALSE;
 	}
@@ -329,26 +322,21 @@ PHP_FUNCTION( resourcebundle_locales )

 	if( zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &bundlename, &bundlename_len ) == FAILURE )
 	{
-		intl_error_set(NULL, U_ILLEGAL_ARGUMENT_ERROR,
+		intl_error_set(NULL, U_ILLEGAL_ARGUMENT_ERROR,	
 			"resourcebundle_locales: unable to parse input params", 0 TSRMLS_CC);
 		RETURN_FALSE;
 	}

-	if (bundlename_len >= MAXPATHLEN) {
-		intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR,	"resourcebundle_locales: bundle name too long", 0 TSRMLS_CC );
-		RETURN_FALSE;
-	}
-
 	if(bundlename_len == 0) {
 		// fetch default locales list
 		bundlename = NULL;
 	}

 	icuenum = ures_openAvailableLocales( bundlename, &icuerror );
-	INTL_CHECK_STATUS(icuerror, "Cannot fetch locales list");
+	INTL_CHECK_STATUS(icuerror, "Cannot fetch locales list");		

 	uenum_reset( icuenum, &icuerror );
-	INTL_CHECK_STATUS(icuerror, "Cannot iterate locales list");
+	INTL_CHECK_STATUS(icuerror, "Cannot iterate locales list");		

 	array_init( return_value );
 	while ((entry = uenum_next( icuenum, &entry_len, &icuerror ))) {
@@ -1,28 +0,0 @@
--TEST--
-Bug #68447: grapheme_extract take an extra trailing character
--SKIPIF--
-<?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?>
--FILE--
-<?php
-$katsushikaku = "葛󠄁飾区";
-echo grapheme_extract($katsushikaku, 1) . "\n";
-
-$haiyore = "這󠄀いよれ";
-echo grapheme_extract($haiyore, 1, GRAPHEME_EXTR_COUNT) . "\n";
-echo grapheme_extract($haiyore, 2, GRAPHEME_EXTR_COUNT) . "\n";
-echo grapheme_extract($haiyore, 6, GRAPHEME_EXTR_MAXBYTES) . "\n";
-echo grapheme_extract($haiyore, 9, GRAPHEME_EXTR_MAXBYTES) . "\n";
-echo grapheme_extract($haiyore, 12, GRAPHEME_EXTR_MAXBYTES) . "\n";
-echo grapheme_extract($haiyore, 1, GRAPHEME_EXTR_MAXCHARS) . "\n";
-echo grapheme_extract($haiyore, 2, GRAPHEME_EXTR_MAXCHARS) . "\n";
-echo grapheme_extract($haiyore, 3, GRAPHEME_EXTR_MAXCHARS) . "\n";
--EXPECT--
-葛󠄁
-這󠄀
-這󠄀い
-
-這󠄀
-這󠄀い
-
-這󠄀
-這󠄀い
@@ -9,4 +9,6 @@ $out = locale_get_primary_language($var1);
 echo strlen($out) . PHP_EOL;
 echo unpack('H*', $out)[1] . PHP_EOL;
 --EXPECT--
-0
+1000
+61616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161
+
@@ -1103,11 +1103,7 @@ PHP_FUNCTION(ldap_get_entries)

 		add_assoc_long(tmp1, "count", num_attrib);
 		dn = ldap_get_dn(ldap, ldap_result_entry);
-		if (dn) {
-			add_assoc_string(tmp1, "dn", dn, 1);
-		} else {
-			add_assoc_null(tmp1, "dn");
-		}
+		add_assoc_string(tmp1, "dn", dn, 1);
 #if (LDAP_API_VERSION > 2000) || HAVE_NSLDAP || HAVE_ORALDAP || WINDOWS
 		ldap_memfree(dn);
 #else
@@ -1,40 +0,0 @@
--TEST--
-Bug #76248 (Malicious LDAP-Server Response causes Crash)
--SKIPIF--
-<?php
-require_once('skipif.inc');
-if (!function_exists('pcntl_fork')) die('skip fork not available');
-?>
--FILE--
-<?php
-$pid = pcntl_fork();
-const PORT = 12345;
-if ($pid == 0) {
-	// child
-    $server = stream_socket_server("tcp://127.0.0.1:12345");
-	$socket = stream_socket_accept($server, 3);
-	fwrite($socket, base64_decode("MAwCAQFhBwoBAAQABAAweQIBAmR0BJljbj1yb290LGRjPWV4YW1wbGUsZGM9Y29tMFcwIwQLb2JqZWN0Q2xhc3MxFAQSb3JnYW5pemF0aW9uYWxSb2xlMAwEAmNuMQYEBHJvb3QwIgQLZGVzY3JpcHRpb24xEwQRRGlyZWN0b3J5IE1hbmFnZXIwDAIBAmUHCgEABAAEADB5AgEDZHQEmWNuPXJvb3QsZGM9ZXhhbXBsZSxkYz1jb20wVzAjBAtvYmplY3RDbGFzczEUBBJvcmdhbml6YXRpb25hbFJvbGUwDAQCY24xBgQEcm9vdDAiBAtkZXNjcmlwdGlvbjETBBFEaXJlY3RvcnkgTWFuYWdlcjAMAgEDZQcKAQAEAAQA"));
-	fflush($socket);	
-} else {
-	// parent
-	$ds = ldap_connect("127.0.0.1", PORT);
-	ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 3);
-	$b = ldap_bind($ds, "cn=root,dc=example,dc=com", "secret");
-
-	$s = ldap_search($ds, "dc=example,dc=com", "(cn=root)"); 
-	$tt = ldap_get_entries($ds, $s);
-	var_dump($tt);
-}
-?>
--EXPECT--
-array(2) {
-  ["count"]=>
-  int(1)
-  [0]=>
-  array(2) {
-    ["count"]=>
-    int(0)
-    ["dn"]=>
-    NULL
-  }
-}
@@ -5,7 +5,7 @@
 * LICENSE NOTICES
 *
 * This file is part of "streamable kanji code filter and converter",
- * which is distributed under the terms of GNU Lesser General Public
+ * which is distributed under the terms of GNU Lesser General Public 
 * License (version 2) as published by the Free Software Foundation.
 *
 * This software is distributed in the hope that it will be useful,
@@ -146,10 +146,6 @@ mbfl_memory_device_output(int c, void *data)
 		unsigned char *tmp;

 		newlen = device->length + device->allocsz;
-		if (newlen <= 0) {
-			/* overflow */
-			return -1;
-		}
 		tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char));
 		if (tmp == NULL) {
 			return -1;
@@ -173,10 +169,6 @@ mbfl_memory_device_output2(int c, void *data)
 		unsigned char *tmp;

 		newlen = device->length + device->allocsz;
-		if (newlen <= 0) {
-			/* overflow */
-			return -1;
-		}
 		tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char));
 		if (tmp == NULL) {
 			return -1;
@@ -202,10 +194,6 @@ mbfl_memory_device_output4(int c, void* data)
 		unsigned char *tmp;

 		newlen = device->length + device->allocsz;
-		if (newlen <= 0) {
-			/* overflow */
-			return -1;
-		}
 		tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char));
 		if (tmp == NULL) {
 			return -1;
@@ -239,12 +227,7 @@ mbfl_memory_device_strcat(mbfl_memory_device *device, const char *psrc)
 	if ((device->pos + len) >= device->length) {
 		/* reallocate buffer */
 		int newlen = device->length + (len + MBFL_MEMORY_DEVICE_ALLOC_SIZE)*sizeof(unsigned char);
-		unsigned char *tmp;
-		if (newlen <= 0) {
-			/* overflow */
-			return -1;
-		}
-		tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char));
+		unsigned char *tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char));
 		if (tmp == NULL) {
 			return -1;
 		}
@@ -271,12 +254,7 @@ mbfl_memory_device_strncat(mbfl_memory_device *device, const char *psrc, int len
 	if ((device->pos + len) >= device->length) {
 		/* reallocate buffer */
 		int newlen = device->length + len + MBFL_MEMORY_DEVICE_ALLOC_SIZE;
-		unsigned char *tmp;
-		if (newlen <= 0) {
-			/* overflow */
-			return -1;
-		}
-		tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char));
+		unsigned char *tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char));
 		if (tmp == NULL) {
 			return -1;
 		}
@@ -303,12 +281,7 @@ mbfl_memory_device_devcat(mbfl_memory_device *dest, mbfl_memory_device *src)
 	if ((dest->pos + src->pos) >= dest->length) {
 		/* reallocate buffer */
 		int newlen = dest->length + src->pos + MBFL_MEMORY_DEVICE_ALLOC_SIZE;
-		unsigned char *tmp;
-		if (newlen <= 0) {
-			/* overflow */
-			return -1;
-		}
-		tmp = (unsigned char *)mbfl_realloc((void *)dest->buffer, newlen*sizeof(unsigned char));
+		unsigned char *tmp = (unsigned char *)mbfl_realloc((void *)dest->buffer, newlen*sizeof(unsigned char));
 		if (tmp == NULL) {
 			return -1;
 		}
@@ -363,10 +336,6 @@ mbfl_wchar_device_output(int c, void *data)
 		unsigned int *tmp;

 		newlen = device->length + device->allocsz;
-		if (newlen <= 0) {
-			/* overflow */
-			return -1;
-		}
 		tmp = (unsigned int *)mbfl_realloc((void *)device->buffer, newlen*sizeof(int));
 		if (tmp == NULL) {
 			return -1;
@@ -213,7 +213,7 @@ static const struct mb_overload_def mb_ovld[] = {
 	{MB_OVERLOAD_REGEX, "split", "mb_split", "mb_orig_split"},
 #endif
 	{0, NULL, NULL, NULL}
-};
+}; 
 /* }}} */

 /* {{{ arginfo */
@@ -648,7 +648,7 @@ static void *_php_mb_allocators_calloc(unsigned int nelems, unsigned int szelem)
 static void _php_mb_allocators_free(void *ptr)
 {
 	efree(ptr);
-}
+} 

 static void *_php_mb_allocators_pmalloc(unsigned int sz)
 {
@@ -663,7 +663,7 @@ static void *_php_mb_allocators_prealloc(void *ptr, unsigned int sz)
 static void _php_mb_allocators_pfree(void *ptr)
 {
 	pefree(ptr, 1);
-}
+} 

 static mbfl_allocators _php_mb_allocators = {
 	_php_mb_allocators_malloc,
@@ -686,7 +686,7 @@ static sapi_post_entry mbstr_post_entries[] = {

 /* {{{ static int php_mb_parse_encoding_list()
 *  Return 0 if input contains any illegal encoding, otherwise 1.
- *  Even if any illegal encoding is detected the result may contain a list
+ *  Even if any illegal encoding is detected the result may contain a list 
 *  of parsed encodings.
 */
 static int
@@ -805,7 +805,7 @@ php_mb_parse_encoding_list(const char *value, size_t value_length, const mbfl_en

 /* {{{ static int php_mb_parse_encoding_array()
 *  Return 0 if input contains any illegal encoding, otherwise 1.
- *  Even if any illegal encoding is detected the result may contain a list
+ *  Even if any illegal encoding is detected the result may contain a list 
 *  of parsed encodings.
 */
 static int
@@ -960,7 +960,7 @@ static size_t php_mb_zend_encoding_converter(unsigned char **to, size_t *to_leng
 	if (!mbfl_buffer_converter_result(convd, &result)) {
 		mbfl_buffer_converter_delete(convd);
 		return (size_t)-1;
-	}
+	}	

 	*to = result.val;
 	*to_length = result.len;
@@ -1192,7 +1192,7 @@ static char *php_mb_rfc1867_basename(const zend_encoding *encoding, char *filena
 	 * to nill or problem is fixed this code must remain enabled for all systems. */
 	s = php_mb_safe_strrchr_ex(filename, '\\', filename_len, (const mbfl_encoding *)encoding);
 	s2 = php_mb_safe_strrchr_ex(filename, '/', filename_len, (const mbfl_encoding *)encoding);
-
+	
 	if (s && s2) {
 		if (s > s2) {
 			return ++s;
@@ -1476,13 +1476,13 @@ PHP_INI_BEGIN()
 	PHP_INI_ENTRY("mbstring.http_output", NULL, PHP_INI_ALL, OnUpdate_mbstring_http_output)
 	STD_PHP_INI_ENTRY("mbstring.internal_encoding", NULL, PHP_INI_ALL, OnUpdate_mbstring_internal_encoding, internal_encoding_name, zend_mbstring_globals, mbstring_globals)
 	PHP_INI_ENTRY("mbstring.substitute_character", NULL, PHP_INI_ALL, OnUpdate_mbstring_substitute_character)
-	STD_PHP_INI_ENTRY("mbstring.func_overload", "0",
+	STD_PHP_INI_ENTRY("mbstring.func_overload", "0", 
 	PHP_INI_SYSTEM, OnUpdateLong, func_overload, zend_mbstring_globals, mbstring_globals)

 	STD_PHP_INI_BOOLEAN("mbstring.encoding_translation", "0",
 		PHP_INI_SYSTEM | PHP_INI_PERDIR,
-		OnUpdate_mbstring_encoding_translation,
-		encoding_translation, zend_mbstring_globals, mbstring_globals)
+		OnUpdate_mbstring_encoding_translation, 
+		encoding_translation, zend_mbstring_globals, mbstring_globals)					 
 	PHP_INI_ENTRY("mbstring.http_output_conv_mimetypes",
 		"^(text/|application/xhtml\\+xml)",
 		PHP_INI_ALL,
@@ -1624,21 +1624,21 @@ PHP_RINIT_FUNCTION(mbstring)
 	/* override original function. */
 	if (MBSTRG(func_overload)){
 		p = &(mb_ovld[0]);
-
+		
 		while (p->type > 0) {
-			if ((MBSTRG(func_overload) & p->type) == p->type &&
+			if ((MBSTRG(func_overload) & p->type) == p->type && 
 				zend_hash_find(EG(function_table), p->save_func,
 					strlen(p->save_func)+1, (void **)&orig) != SUCCESS) {

 				zend_hash_find(EG(function_table), p->ovld_func, strlen(p->ovld_func)+1 , (void **)&func);
-
+				
 				if (zend_hash_find(EG(function_table), p->orig_func, strlen(p->orig_func)+1, (void **)&orig) != SUCCESS) {
 					php_error_docref("ref.mbstring" TSRMLS_CC, E_WARNING, "mbstring couldn't find function %s.", p->orig_func);
 					return FAILURE;
 				} else {
 					zend_hash_add(EG(function_table), p->save_func, strlen(p->save_func)+1, orig, sizeof(zend_function), NULL);

-					if (zend_hash_update(EG(function_table), p->orig_func, strlen(p->orig_func)+1, func, sizeof(zend_function),
+					if (zend_hash_update(EG(function_table), p->orig_func, strlen(p->orig_func)+1, func, sizeof(zend_function), 
 						NULL) == FAILURE) {
 						php_error_docref("ref.mbstring" TSRMLS_CC, E_WARNING, "mbstring couldn't replace function %s.", p->orig_func);
 						return FAILURE;
@@ -1685,10 +1685,10 @@ PHP_RSHUTDOWN_FUNCTION(mbstring)
 	if (MBSTRG(func_overload)){
 		p = &(mb_ovld[0]);
 		while (p->type > 0) {
-			if ((MBSTRG(func_overload) & p->type) == p->type &&
+			if ((MBSTRG(func_overload) & p->type) == p->type && 
 				zend_hash_find(EG(function_table), p->save_func,
 							   strlen(p->save_func)+1, (void **)&orig) == SUCCESS) {
-
+				
 				zend_hash_update(EG(function_table), p->orig_func, strlen(p->orig_func)+1, orig, sizeof(zend_function), NULL);
 				zend_hash_del(EG(function_table), p->save_func, strlen(p->save_func)+1);
 			}
@@ -1710,7 +1710,7 @@ PHP_MINFO_FUNCTION(mbstring)
 	php_info_print_table_start();
 	php_info_print_table_row(2, "Multibyte Support", "enabled");
 	php_info_print_table_row(2, "Multibyte string engine", "libmbfl");
-	php_info_print_table_row(2, "HTTP input encoding translation", MBSTRG(encoding_translation) ? "enabled": "disabled");
+	php_info_print_table_row(2, "HTTP input encoding translation", MBSTRG(encoding_translation) ? "enabled": "disabled");	
 	{
 		char tmp[256];
 		snprintf(tmp, sizeof(tmp), "%d.%d.%d", MBFL_VERSION_MAJOR, MBFL_VERSION_MINOR, MBFL_VERSION_TEENY);
@@ -1846,7 +1846,7 @@ PHP_FUNCTION(mb_http_input)
 						temp = list;
 						spprintf(&list, 0, "%s,%s", temp, (*entry)->name);
 						efree(temp);
-						if (!list) {
+						if (!list) { 
 							break;
 						}
 					} else {
@@ -2078,12 +2078,12 @@ PHP_FUNCTION(mb_parse_str)
 	encstr = estrndup(encstr, encstr_len);

 	info.data_type              = PARSE_STRING;
-	info.separator              = PG(arg_separator).input;
+	info.separator              = PG(arg_separator).input; 
 	info.report_errors          = 1;
 	info.to_encoding            = MBSTRG(current_internal_encoding);
 	info.to_language            = MBSTRG(language);
 	info.from_encodings         = MBSTRG(http_input_list);
-	info.num_from_encodings     = MBSTRG(http_input_list_size);
+	info.num_from_encodings     = MBSTRG(http_input_list_size); 
 	info.from_language          = MBSTRG(language);

 	if (track_vars_array != NULL) {
@@ -2093,8 +2093,8 @@ PHP_FUNCTION(mb_parse_str)
 		if (!EG(active_symbol_table)) {
 			zend_rebuild_symbol_table(TSRMLS_C);
 		}
-		Z_ARRVAL(tmp) = EG(active_symbol_table);
-		detected = _php_mb_encoding_handler_ex(&info, &tmp, encstr TSRMLS_CC);
+		Z_ARRVAL(tmp) = EG(active_symbol_table);		
+		detected = _php_mb_encoding_handler_ex(&info, &tmp, encstr TSRMLS_CC);		
 	}

 	MBSTRG(http_input_identify) = detected;
@@ -2158,7 +2158,7 @@ PHP_FUNCTION(mb_output_handler)
 		if (SG(sapi_headers).send_default_content_type || send_text_mimetype) {
 			charset = encoding->mime_name;
 			if (charset) {
-				len = spprintf( &p, 0, "Content-Type: %s; charset=%s",  mimetype, charset );
+				len = spprintf( &p, 0, "Content-Type: %s; charset=%s",  mimetype, charset ); 
 				if (sapi_add_header(p, len, 0) != FAILURE) {
 					SG(sapi_headers).send_default_content_type = 0;
 				}
@@ -2181,7 +2181,7 @@ PHP_FUNCTION(mb_output_handler)
 	/* mode */
 	mbfl_buffer_converter_illegal_mode(MBSTRG(outconv), MBSTRG(current_filter_illegal_mode));
 	mbfl_buffer_converter_illegal_substchar(MBSTRG(outconv), MBSTRG(current_filter_illegal_substchar));
-
+ 
 	/* feed the string */
 	mbfl_string_init(&string);
 	/* these are not needed. convd has encoding info.
@@ -2193,11 +2193,11 @@ PHP_FUNCTION(mb_output_handler)
 	mbfl_buffer_converter_feed(MBSTRG(outconv), &string);
 	if (last_feed) {
 		mbfl_buffer_converter_flush(MBSTRG(outconv));
-	}
+	} 
 	/* get the converter output, and return it */
 	mbfl_buffer_converter_result(MBSTRG(outconv), &result);
 	RETVAL_STRINGL((char *)result.val, result.len, 0);		/* the string is already strdup()'ed */
-
+ 
 	/* delete the converter if it is the last feed. */
 	if (last_feed) {
 		MBSTRG(illegalchars) += mbfl_buffer_illegalchars(MBSTRG(outconv));
@@ -3156,7 +3156,7 @@ PHP_FUNCTION(mb_convert_case)

 	if (newstr) {
 		RETVAL_STRINGL(newstr, ret_len, 0);
-	}
+	}	
 }
 /* }}} */

@@ -3380,7 +3380,7 @@ PHP_FUNCTION(mb_encode_mimeheader)
 	mbfl_string_init(&result);
 	ret = mbfl_mime_header_encode(&string, &result, charset, transenc, linefeed, indent);
 	if (ret != NULL) {
-		RETVAL_STRINGL_CHECK((char *)ret->val, ret->len, 0);	/* the string is already strdup()'ed */
+		RETVAL_STRINGL((char *)ret->val, ret->len, 0);	/* the string is already strdup()'ed */
 	} else {
 		RETVAL_FALSE;
 	}
@@ -3507,7 +3507,7 @@ PHP_FUNCTION(mb_convert_kana)

 	ret = mbfl_ja_jp_hantozen(&string, &result, opt);
 	if (ret != NULL) {
-		RETVAL_STRINGL_CHECK((char *)ret->val, ret->len, 0);		/* the string is already strdup()'ed */
+		RETVAL_STRINGL((char *)ret->val, ret->len, 0);		/* the string is already strdup()'ed */
 	} else {
 		RETVAL_FALSE;
 	}
@@ -3841,7 +3841,7 @@ php_mb_numericentity_exec(INTERNAL_FUNCTION_PARAMETERS, int type)

 	ret = mbfl_html_numeric_entity(&string, &result, convmap, mapsize, type);
 	if (ret != NULL) {
-		RETVAL_STRINGL_CHECK((char *)ret->val, ret->len, 0);
+		RETVAL_STRINGL((char *)ret->val, ret->len, 0);
 	} else {
 		RETVAL_FALSE;
 	}
@@ -3929,12 +3929,12 @@ static int _php_mbstr_parse_mail_headers(HashTable *ht, const char *str, size_t

 	/*
 	 *             C o n t e n t - T y p e :   t e x t / h t m l \r\n
-	 *             ^ ^^^^^^^^^^^^^^^^^^^^^ ^^^ ^^^^^^^^^^^^^^^^^ ^^^^
-	 *      state  0            1           2          3
+	 *             ^ ^^^^^^^^^^^^^^^^^^^^^ ^^^ ^^^^^^^^^^^^^^^^^ ^^^^ 
+	 *      state  0            1           2          3          
 	 *
 	 *             C o n t e n t - T y p e :   t e x t / h t m l \r\n
-	 *             ^ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^
-	 * crlf_state -1                       0                     1 -1
+	 *             ^ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^ 
+	 * crlf_state -1                       0                     1 -1  
 	 *
 	 */

@@ -4000,7 +4000,7 @@ static int _php_mbstr_parse_mail_headers(HashTable *ht, const char *str, size_t
 						token.a = 0;
 						state = 1;
 						break;
-
+					
 					case 2:
 						if (crlf_state != -1) {
 							token.c = (char *)ps;
@@ -4177,14 +4177,14 @@ PHP_FUNCTION(mb_send_mail)
 				if ((param_name = php_strtok_r(p, "= ", &tmp)) != NULL) {
 					if (strcasecmp(param_name, "charset") == 0) {
 						enum mbfl_no_encoding _tran_cs = tran_cs;
-
+						
 						charset = php_strtok_r(NULL, "= \"", &tmp);
 						if (charset != NULL) {
 							_tran_cs = mbfl_name2no_encoding(charset);
 						}

 						if (_tran_cs == mbfl_no_encoding_invalid) {
-							php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unsupported charset \"%s\" - will be regarded as ascii", charset);
+							php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unsupported charset \"%s\" - will be regarded as ascii", charset); 
 							_tran_cs = mbfl_no_encoding_ascii;
 						}
 						tran_cs = _tran_cs;
@@ -4209,7 +4209,7 @@ PHP_FUNCTION(mb_send_mail)
 				break;

 			default:
-				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unsupported transfer encoding \"%s\" - will be regarded as 8bit", s->c);
+				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unsupported transfer encoding \"%s\" - will be regarded as 8bit", s->c); 
 				body_enc =	mbfl_no_encoding_8bit;
 				break;
 		}
@@ -4342,7 +4342,7 @@ PHP_FUNCTION(mb_send_mail)
 		extra_cmd = php_escape_shell_cmd(force_extra_parameters);
 	} else if (extra_cmd) {
 		extra_cmd = php_escape_shell_cmd(extra_cmd);
-	}
+	} 

 	if (!err && php_mail(to_r, subject, message, headers, extra_cmd TSRMLS_CC)) {
 		RETVAL_TRUE;
@@ -4441,7 +4441,7 @@ PHP_FUNCTION(mb_get_info)
 		}
 		if ((name = (char *)mbfl_no_language2name(MBSTRG(language))) != NULL) {
 			add_assoc_string(return_value, "language", name, 1);
-		}
+		}		
 		n = MBSTRG(current_detect_order_list_size);
 		entry = MBSTRG(current_detect_order_list);
 		if (n > 0) {
@@ -4471,15 +4471,15 @@ PHP_FUNCTION(mb_get_info)
 	} else if (!strcasecmp("internal_encoding", typ)) {
 		if (MBSTRG(current_internal_encoding)) {
 			RETVAL_STRING((char *)MBSTRG(current_internal_encoding)->name, 1);
-		}
+		}		
 	} else if (!strcasecmp("http_input", typ)) {
 		if (MBSTRG(http_input_identify)) {
 			RETVAL_STRING((char *)MBSTRG(http_input_identify)->name, 1);
-		}
+		}		
 	} else if (!strcasecmp("http_output", typ)) {
 		if (MBSTRG(current_http_output_encoding)) {
 			RETVAL_STRING((char *)MBSTRG(current_http_output_encoding)->name, 1);
-		}
+		}		
 	} else if (!strcasecmp("http_output_conv_mimetypes", typ)) {
 		if ((name = (char *)zend_ini_string("mbstring.http_output_conv_mimetypes", sizeof("mbstring.http_output_conv_mimetypes"), 0)) != NULL) {
 			RETVAL_STRING(name, 1);
@@ -4522,7 +4522,7 @@ PHP_FUNCTION(mb_get_info)
 	} else if (!strcasecmp("language", typ)) {
 		if ((name = (char *)mbfl_no_language2name(MBSTRG(language))) != NULL) {
 			RETVAL_STRING(name, 1);
-		}
+		}		
 	} else if (!strcasecmp("detect_order", typ)) {
 		n = MBSTRG(current_detect_order_list_size);
 		entry = MBSTRG(current_detect_order_list);
@@ -4589,9 +4589,9 @@ PHP_FUNCTION(mb_check_encoding)
 	if (convd == NULL) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to create converter");
 		RETURN_FALSE;
-	}
+	}	
 	mbfl_buffer_converter_illegal_mode(convd, MBFL_OUTPUTFILTER_ILLEGAL_MODE_NONE);
-	mbfl_buffer_converter_illegal_substchar(convd, 0);
+	mbfl_buffer_converter_illegal_substchar(convd, 0);	

 	/* initialize string */
 	mbfl_string_init_set(&string, mbfl_no_language_neutral, encoding->no_encoding);
@@ -4642,7 +4642,7 @@ static void php_mb_populate_current_detect_order_list(TSRMLS_D)
 }

 /* {{{ static int php_mb_encoding_translation() */
-static int php_mb_encoding_translation(TSRMLS_D)
+static int php_mb_encoding_translation(TSRMLS_D) 
 {
 	return MBSTRG(encoding_translation);
 }
@@ -4768,7 +4768,7 @@ MBSTRING_API int php_mb_stripos(int mode, const char *old_haystack, unsigned int

 		{
 			int haystack_char_len = mbfl_strlen(&haystack);
-
+ 
 			if (mode) {
 				if ((offset > 0 && offset > haystack_char_len) ||
 					(offset < 0 && -offset > haystack_char_len)) {
@@ -1425,9 +1425,14 @@ match_at(regex_t* reg, const UChar* str, const UChar* end,
      break;

    case OP_EXACT1:  MOP_IN(OP_EXACT1);
+#if 0
      DATA_ENSURE(1);
      if (*p != *s) goto fail;
      p++; s++;
+#endif
+      if (*p != *s++) goto fail;
+      DATA_ENSURE(0);
+      p++;
      MOP_OUT;
      break;

@@ -3123,8 +3128,6 @@ forward_search_range(regex_t* reg, const UChar* str, const UChar* end, UChar* s,
    }
    else {
      UChar *q = p + reg->dmin;
-
-      if (q >= end) return 0; /* fail */
      while (p < q) p += enclen(reg->enc, p);
    }
  }
@@ -3205,13 +3208,7 @@ forward_search_range(regex_t* reg, const UChar* str, const UChar* end, UChar* s,
    else {
      if (reg->dmax != ONIG_INFINITE_DISTANCE) {
 	*low = p - reg->dmax;
-	if (p - str < reg->dmax) {
-	  *low = (UChar* )str;
-	  if (low_prev)
-	    *low_prev = onigenc_get_prev_char_head(reg->enc, str, *low);
-	}
-	else {
- 	if (*low > s) {
+	if (*low > s) {
 	  *low = onigenc_get_right_adjust_char_head_with_prev(reg->enc, s,
 							      *low, (const UChar** )low_prev);
 	  if (low_prev && IS_NULL(*low_prev))
@@ -3224,7 +3221,6 @@ forward_search_range(regex_t* reg, const UChar* str, const UChar* end, UChar* s,
 					       (pprev ? pprev : str), *low);
 	}
      }
-      }
    }
    /* no needs to adjust *high, *high is used as range check only */
    *high = p - reg->dmin;
@@ -3064,7 +3064,7 @@ fetch_token_in_cc(OnigToken* tok, UChar** src, UChar* end, ScanEnv* env)
 	PUNFETCH;
 	prev = p;
 	num = scan_unsigned_octal_number(&p, end, 3, enc);
-	if (num < 0 || num >= 256) return ONIGERR_TOO_BIG_NUMBER;
+	if (num < 0) return ONIGERR_TOO_BIG_NUMBER;
 	if (p == prev) {  /* can't read nothing. */
 	  num = 0; /* but, it's not error */
 	}
@@ -3436,7 +3436,7 @@ fetch_token(OnigToken* tok, UChar** src, UChar* end, ScanEnv* env)
      if (IS_SYNTAX_OP(syn, ONIG_SYN_OP_ESC_OCTAL3)) {
 	prev = p;
 	num = scan_unsigned_octal_number(&p, end, (c == '0' ? 2:3), enc);
-	if (num < 0 || num >= 256) return ONIGERR_TOO_BIG_NUMBER;
+	if (num < 0) return ONIGERR_TOO_BIG_NUMBER;
 	if (p == prev) {  /* can't read nothing. */
 	  num = 0; /* but, it's not error */
 	}
@@ -4068,9 +4068,7 @@ next_state_class(CClassNode* cc, OnigCodePoint* vs, enum CCVALTYPE* type,
    }
  }

-  if (*state != CCS_START)
-    *state = CCS_VALUE;
-
+  *state = CCS_VALUE;
  *type  = CCV_CLASS;
  return 0;
 }
@@ -4086,11 +4084,7 @@ next_state_val(CClassNode* cc, OnigCodePoint *vs, OnigCodePoint v,
  switch (*state) {
  case CCS_VALUE:
    if (*type == CCV_SB)
-    {
-    if (*vs > 0xff)
-      return ONIGERR_INVALID_CODE_POINT_VALUE;
      BITSET_SET_BIT(cc->bs, (int )(*vs));
-    }
    else if (*type == CCV_CODE_POINT) {
      r = add_code_range(&(cc->mbuf), env, *vs, *vs);
      if (r < 0) return r;
@@ -1310,7 +1310,6 @@ static void php_mcrypt_do_crypt(char* cipher, const char *key, int key_len, cons
 	}

 	if (mcrypt_generic_init(td, (void *) key, key_len, (void *) iv) < 0) {
-		efree(data_s);
 		php_error_docref(NULL TSRMLS_CC, E_RECOVERABLE_ERROR, "Mcrypt initialisation failed");
 		mcrypt_module_close(td);
 		RETURN_FALSE;
@@ -89,7 +89,7 @@ static php_stream_filter_status_t php_mcrypt_filter(
 			php_stream_bucket_delref(bucket TSRMLS_CC);
 		} else {
 			/* Stream cipher */
-			bucket = php_stream_bucket_make_writeable(bucket TSRMLS_CC);
+			php_stream_bucket_make_writeable(bucket TSRMLS_CC);
 			if (data->encrypt) {
 				mcrypt_generic(data->module, bucket->buf, bucket->buflen);
 			} else {
@@ -1,23 +0,0 @@
--TEST--
-Bug #72535 arcfour encryption stream filter crashes php
--SKIPIF--
-<?php if (!extension_loaded("mcrypt")) print "skip"; ?>
--FILE--
-<?php
-$passphrase = 'My secret';
-$plaintext = 'Secret secret secret data';
-
-$iv = substr(md5('iv' . $passphrase, true), 0, 8);
-$key = substr(md5('pass1' . $passphrase, true) .
-	              md5('pass2' . $passphrase, true), 0, 24);
-$opts = array('iv' => $iv, 'key' => $key, 'mode' => 'stream');
-
-$expected = substr($plaintext . $plaintext, 0, 48);
-
-$fp = fopen('php://memory', 'wb+');
-stream_filter_append($fp, 'mcrypt.arcfour', STREAM_FILTER_WRITE, $opts);
-fwrite($fp, $plaintext);
-?>
-==NOCRASH==
--EXPECT--
-==NOCRASH==
@@ -157,7 +157,7 @@ static void update_op1_const(zend_op_array *op_array,
 					opline->op1.constant = zend_optimizer_add_literal(op_array, val TSRMLS_CC);
 					Z_HASH_P(&ZEND_OP1_LITERAL(opline)) = zend_hash_func(Z_STRVAL(ZEND_OP1_LITERAL(opline)), Z_STRLEN(ZEND_OP1_LITERAL(opline)) + 1);
 					op_array->literals[opline->op1.constant].cache_slot = op_array->last_cache_slot++;
-					Z_STRVAL_P(val) = zend_str_tolower_dup(Z_STRVAL_P(val), Z_STRLEN_P(val));
+					zend_str_tolower(Z_STRVAL_P(val), Z_STRLEN_P(val));
 					zend_optimizer_add_literal(op_array, val TSRMLS_CC);
 					op_array->literals[opline->op1.constant+1].hash_value = zend_hash_func(Z_STRVAL(op_array->literals[opline->op1.constant+1].constant), Z_STRLEN(op_array->literals[opline->op1.constant+1].constant) + 1);
 					break;
@@ -205,13 +205,13 @@ static void update_op2_const(zend_op_array *op_array,
 			case ZEND_ADD_INTERFACE:
 			case ZEND_ADD_TRAIT:
 				op_array->literals[opline->op2.constant].cache_slot = op_array->last_cache_slot++;
-				Z_STRVAL_P(val) = zend_str_tolower_dup(Z_STRVAL_P(val), Z_STRLEN_P(val));
+				zend_str_tolower(Z_STRVAL_P(val), Z_STRLEN_P(val));
 				zend_optimizer_add_literal(op_array, val TSRMLS_CC);
 				op_array->literals[opline->op2.constant+1].hash_value = zend_hash_func(Z_STRVAL(op_array->literals[opline->op2.constant+1].constant), Z_STRLEN(op_array->literals[opline->op2.constant+1].constant) + 1);
 				break;
 			case ZEND_INIT_METHOD_CALL:
 			case ZEND_INIT_STATIC_METHOD_CALL:
-				Z_STRVAL_P(val) = zend_str_tolower_dup(Z_STRVAL_P(val), Z_STRLEN_P(val));
+				zend_str_tolower(Z_STRVAL_P(val), Z_STRLEN_P(val));
 				zend_optimizer_add_literal(op_array, val TSRMLS_CC);
 				op_array->literals[opline->op2.constant+1].hash_value = zend_hash_func(Z_STRVAL(op_array->literals[opline->op2.constant+1].constant), Z_STRLEN(op_array->literals[opline->op2.constant+1].constant) + 1);
 				/* break missing intentionally */						
@@ -102,16 +102,6 @@ opcache.validate_timestamps (default "1")
 	The frequency of the check is controlled by the directive
 	"opcache.revalidate_freq".

-opcache.validate_permission (default "0")
-	Leads OPcache to check file readability on each access to cached file.
-	This directive should be enabled in shared hosting environment, when few
-	users (PHP-FPM pools) reuse the common OPcache shared memory.
-
-opcache.validate_root (default "0")
-	This directive prevents file name collisions in different "chroot"
-	environments. It should be enabled for sites that may serve requests in
-	different "chroot" environments.
-
 opcache.revalidate_freq (default "2")
 	How often (in seconds) to check file timestamps for changes to the shared
 	memory storage allocation. ("1" means validate once per second, but only
@@ -1592,28 +1592,6 @@ zend_op_array *persistent_compile_file(zend_file_handle *file_handle, int type T
 		persistent_script = NULL;
 	}

-	/* Revalidate acessibility of cached file */
-	if (EXPECTED(persistent_script != NULL) &&
-	    UNEXPECTED(ZCG(accel_directives).validate_permission) &&
-	    file_handle->type == ZEND_HANDLE_FILENAME &&
-	    UNEXPECTED(access(persistent_script->full_path, R_OK) != 0)) {
-		if (type == ZEND_REQUIRE) {
-#if ZEND_EXTENSION_API_NO < PHP_5_3_X_API_NO
-			zend_message_dispatcher(ZMSG_FAILED_REQUIRE_FOPEN, file_handle->filename);
-#else
-			zend_message_dispatcher(ZMSG_FAILED_REQUIRE_FOPEN, file_handle->filename TSRMLS_CC);
-#endif
-			zend_bailout();
-		} else {
-#if ZEND_EXTENSION_API_NO < PHP_5_3_X_API_NO
-			zend_message_dispatcher(ZMSG_FAILED_INCLUDE_FOPEN, file_handle->filename);
-#else
-			zend_message_dispatcher(ZMSG_FAILED_INCLUDE_FOPEN, file_handle->filename TSRMLS_CC);
-#endif
-		}
-		return NULL;
-	}
-
 	SHM_UNPROTECT();

 	/* If script is found then validate_timestamps if option is enabled */
@@ -2148,27 +2126,6 @@ static void accel_activate(void)
 		return;
 	}

-#ifndef ZEND_WIN32
-	if (ZCG(accel_directives).validate_root) {
-		struct stat buf;
-
-		if (stat("/", &buf) != 0) {
-			ZCG(root_hash) = 0;
-		} else {
-			ZCG(root_hash) = buf.st_ino;
-			if (sizeof(buf.st_ino) > sizeof(ZCG(root_hash))) {
-				if (ZCG(root_hash) != buf.st_ino) {
-					zend_alter_ini_entry("opcache.enable", sizeof("opcache.enable"), "0", 1, ZEND_INI_SYSTEM, ZEND_INI_STAGE_RUNTIME);
-					zend_accel_error(ACCEL_LOG_WARNING, "Can't cache files in chroot() directory with too big inode");
-					return;
-				}
-			}
-		}
-	} else {
-		ZCG(root_hash) = 0;
-	}
-#endif
-
 	SHM_UNPROTECT();
 	/* PHP-5.4 and above return "double", but we use 1 sec precision */
 	ZCG(request_time) = (time_t)sapi_get_request_time(TSRMLS_C);
@@ -230,10 +230,6 @@ typedef struct _zend_accel_directives {
 	zend_bool      file_override_enabled;
 	zend_bool      inherited_hack;
 	zend_bool      enable_cli;
-	zend_bool      validate_permission;
-#ifndef ZEND_WIN32
-	zend_bool      validate_root;
-#endif
 	unsigned long  revalidate_freq;
 	unsigned long  file_update_protection;
 	char          *error_log;
@@ -268,9 +264,6 @@ typedef struct _zend_accel_globals {
 	int                     include_path_len; /* "include_path" string length */
 	int                     include_path_check;
 	time_t                  request_time;
-#ifndef ZEND_WIN32
-	unsigned long           root_hash;
-#endif
 	/* preallocated shared-memory block to save current script */
 	void                   *mem;
 	/* cache to save hash lookup on the same INCLUDE opcode */
@@ -1,29 +0,0 @@
--TEST--
-Bug #73402 (Opcache segfault when using class constant to call a method)
--INI--
-opcache.enable=1
-opcache.enable_cli=1
--SKIPIF--
-<?php require_once('skipif.inc'); ?>
--FILE--
-<?php
-class Logger {
-	public function info($msg) {
-		echo $msg;
-	}
-}
-
-class B
-{
-	const LOG_LEVEL = 'Info';
-	public function test()
-	{
-		$logger = new \Logger();
-		$logger->{self::LOG_LEVEL}('test');
-	}
-}
-
-$b = new B;
-$b->test();
--EXPECT--
-test
@@ -77,9 +77,6 @@ zend_accel_hash_entry* zend_accel_hash_update(zend_accel_hash *accel_hash, char
 	zend_ulong index;
 	zend_accel_hash_entry *entry;
 	zend_accel_hash_entry *indirect_bucket = NULL;
-#ifndef ZEND_WIN32
-	TSRMLS_FETCH();
-#endif

 	if (indirect) {
 		indirect_bucket = (zend_accel_hash_entry*)data;
@@ -89,9 +86,6 @@ zend_accel_hash_entry* zend_accel_hash_update(zend_accel_hash *accel_hash, char
 	}

 	hash_value = zend_inline_hash_func(key, key_length);
-#ifndef ZEND_WIN32
-	hash_value ^= ZCG(root_hash);
-#endif
 	index = hash_value % accel_hash->max_num_entries;

 	/* try to see if the element already exists in the hash */
@@ -151,14 +145,8 @@ void* zend_accel_hash_find(zend_accel_hash *accel_hash, char *key, zend_uint key
 	zend_ulong hash_value;
 	zend_ulong index;
 	zend_accel_hash_entry *entry;
-#ifndef ZEND_WIN32
-	TSRMLS_FETCH();
-#endif

 	hash_value = zend_inline_hash_func(key, key_length);
-#ifndef ZEND_WIN32
-	hash_value ^= ZCG(root_hash);
-#endif
 	index = hash_value % accel_hash->max_num_entries;

 	entry = accel_hash->hash_table[index];
@@ -185,14 +173,8 @@ zend_accel_hash_entry* zend_accel_hash_find_entry(zend_accel_hash *accel_hash, c
 	zend_ulong hash_value;
 	zend_ulong index;
 	zend_accel_hash_entry *entry;
-#ifndef ZEND_WIN32
-	TSRMLS_FETCH();
-#endif

 	hash_value = zend_inline_hash_func(key, key_length);
-#ifndef ZEND_WIN32
-	hash_value ^= ZCG(root_hash);
-#endif
 	index = hash_value % accel_hash->max_num_entries;

 	entry = accel_hash->hash_table[index];
@@ -216,14 +198,8 @@ int zend_accel_hash_unlink(zend_accel_hash *accel_hash, char *key, zend_uint key
 	zend_ulong hash_value;
    zend_ulong index;
    zend_accel_hash_entry *entry, *last_entry=NULL;
-#ifndef ZEND_WIN32
-	TSRMLS_FETCH();
-#endif

 	hash_value = zend_inline_hash_func(key, key_length);
-#ifndef ZEND_WIN32
-	hash_value ^= ZCG(root_hash);
-#endif
 	index = hash_value % accel_hash->max_num_entries;

 	entry = accel_hash->hash_table[index];
@@ -255,10 +255,6 @@ ZEND_INI_BEGIN()
    STD_PHP_INI_BOOLEAN("opcache.enable"             , "1", PHP_INI_ALL,    OnEnable,     enabled                             , zend_accel_globals, accel_globals)
 	STD_PHP_INI_BOOLEAN("opcache.use_cwd"            , "1", PHP_INI_SYSTEM, OnUpdateBool, accel_directives.use_cwd            , zend_accel_globals, accel_globals)
 	STD_PHP_INI_BOOLEAN("opcache.validate_timestamps", "1", PHP_INI_ALL   , OnUpdateBool, accel_directives.validate_timestamps, zend_accel_globals, accel_globals)
-	STD_PHP_INI_BOOLEAN("opcache.validate_permission", "0", PHP_INI_SYSTEM, OnUpdateBool, accel_directives.validate_permission, zend_accel_globals, accel_globals)
-#ifndef ZEND_WIN32
-	STD_PHP_INI_BOOLEAN("opcache.validate_root"      , "0", PHP_INI_SYSTEM, OnUpdateBool, accel_directives.validate_root      , zend_accel_globals, accel_globals)
-#endif
 	STD_PHP_INI_BOOLEAN("opcache.inherited_hack"     , "1", PHP_INI_SYSTEM, OnUpdateBool, accel_directives.inherited_hack     , zend_accel_globals, accel_globals)
 	STD_PHP_INI_BOOLEAN("opcache.dups_fix"           , "0", PHP_INI_ALL   , OnUpdateBool, accel_directives.ignore_dups        , zend_accel_globals, accel_globals)
 	STD_PHP_INI_BOOLEAN("opcache.revalidate_path"    , "0", PHP_INI_ALL   , OnUpdateBool, accel_directives.revalidate_path    , zend_accel_globals, accel_globals)
@@ -667,10 +663,6 @@ static ZEND_FUNCTION(opcache_get_configuration)
 	add_assoc_bool(directives, "opcache.enable_cli",          ZCG(accel_directives).enable_cli);
 	add_assoc_bool(directives, "opcache.use_cwd",             ZCG(accel_directives).use_cwd);
 	add_assoc_bool(directives, "opcache.validate_timestamps", ZCG(accel_directives).validate_timestamps);
-	add_assoc_bool(directives, "opcache.validate_permission", ZCG(accel_directives).validate_permission);
-#ifndef ZEND_WIN32
-	add_assoc_bool(directives, "opcache.validate_root",       ZCG(accel_directives).validate_root);
-#endif
 	add_assoc_bool(directives, "opcache.inherited_hack",      ZCG(accel_directives).inherited_hack);
 	add_assoc_bool(directives, "opcache.dups_fix",            ZCG(accel_directives).ignore_dups);
 	add_assoc_bool(directives, "opcache.revalidate_path",     ZCG(accel_directives).revalidate_path);
@@ -4059,7 +4059,7 @@ PHP_FUNCTION(openssl_pbkdf2)
 		return;
 	}

-	if (key_length <= 0 || key_length > INT_MAX) {
+	if (key_length <= 0) {
 		RETURN_FALSE;
 	}

@@ -4982,15 +4982,15 @@ PHP_FUNCTION(openssl_seal)
 	buf = emalloc(data_len + EVP_CIPHER_CTX_block_size(&ctx));
 	EVP_CIPHER_CTX_cleanup(&ctx);

-	if (EVP_SealInit(&ctx, cipher, eks, eksl, NULL, pkeys, nkeys) <= 0 ||
-			!EVP_SealUpdate(&ctx, buf, &len1, (unsigned char *)data, data_len) ||
-			!EVP_SealFinal(&ctx, buf + len1, &len2)) {
+	if (!EVP_SealInit(&ctx, cipher, eks, eksl, NULL, pkeys, nkeys) || !EVP_SealUpdate(&ctx, buf, &len1, (unsigned char *)data, data_len)) {
 		RETVAL_FALSE;
 		efree(buf);
 		EVP_CIPHER_CTX_cleanup(&ctx);
 		goto clean_exit;
 	}

+	EVP_SealFinal(&ctx, buf + len1, &len2);
+
 	if (len1 + len2 > 0) {
 		zval_dtor(sealdata);
 		buf[len1 + len2] = '\0';
@@ -5260,7 +5260,7 @@ PHP_FUNCTION(openssl_encrypt)
 	free_iv = php_openssl_validate_iv(&iv, &iv_len, max_iv_len TSRMLS_CC);

 	outlen = data_len + EVP_CIPHER_block_size(cipher_type);
-	outbuf = safe_emalloc(outlen, 1, 1);
+	outbuf = emalloc(outlen + 1);

 	EVP_EncryptInit(&cipher_ctx, cipher_type, NULL, NULL);
 	if (password_len > keylen) {
@@ -5278,18 +5278,14 @@ PHP_FUNCTION(openssl_encrypt)
 		outlen += i;
 		if (options & OPENSSL_RAW_DATA) {
 			outbuf[outlen] = '\0';
-			RETVAL_STRINGL_CHECK((char *)outbuf, outlen, 0);
+			RETVAL_STRINGL((char *)outbuf, outlen, 0);
 		} else {
 			int base64_str_len;
 			char *base64_str;

 			base64_str = (char*)php_base64_encode(outbuf, outlen, &base64_str_len);
 			efree(outbuf);
-			if (!base64_str) {
-				RETVAL_FALSE;
-			} else {
-				RETVAL_STRINGL(base64_str, base64_str_len, 0);
-			}
+			RETVAL_STRINGL(base64_str, base64_str_len, 0);
 		}
 	} else {
 		efree(outbuf);
@@ -5466,16 +5462,16 @@ PHP_FUNCTION(openssl_random_pseudo_bytes)
 		return;
 	}

+	if (buffer_length <= 0) {
+		RETURN_FALSE;
+	}
+
 	if (zstrong_result_returned) {
 		zval_dtor(zstrong_result_returned);
 		ZVAL_BOOL(zstrong_result_returned, 0);
 	}

-	if (buffer_length <= 0 || buffer_length > INT_MAX) {
-		RETURN_FALSE;
-	}
-
-	buffer = safe_emalloc(buffer_length, 1, 1);
+	buffer = emalloc(buffer_length + 1);

 #ifdef PHP_WIN32
 	/* random/urandom equivalent on Windows */
Author	SHA1	Message	Date
Ferenc Kovacs	211f30c2c8	Revert "Updated to version 2016.7 (2016g)" This reverts commit `6a544f2d1e`.	2016-09-29 01:34:45 +02:00
Ferenc Kovacs	2119b0d41d	5.6.27RC1	2016-09-29 01:06:51 +02:00