5.6.40

5.6.41 will be next. not really
Fix bug #77418 - Heap overflow in utf32be_mbc_to_code
2026-11-13 20:20:50 +00:00 · 2019-01-09 10:54:13 +01:00 · 2019-01-09 09:57:53 +01:00 · 2019-01-06 23:31:15 -08:00 · 2019-01-06 13:03:38 -08:00 · 2019-01-06 11:34:27 -08:00
279 changed files with 14303 additions and 10547 deletions
@@ -1,3 +1,4 @@
+dist: precise
 language: c
 sudo: false
 addons:
@@ -74,7 +74,7 @@ MAINTENANCE:         Maintained
 STATUS:              Working
 -------------------------------------------------------------------------------
 EXTENSION:           fpm
-PRIMARY MAINTAINER:  Antony Dovgal <tony2001@php.net>, Jerome Loyet <fat@php.net>
+PRIMARY MAINTAINER:  Jakub Zelenka <bukka@php.net>
 MAINTENANCE:         Maintained
 STATUS:              Working
 SINCE:               5.3.3
@@ -1,6 +1,244 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2016, PHP 5.6.27
+10 Jan 2019, PHP 5.6.40
+
+- GD:
+  . Fixed bug #77269 (efree() on uninitialized Heap data in imagescale leads to
+    use-after-free). (cmb)
+  . Fixed bug #77270 (imagecolormatch Out Of Bounds Write on Heap). (cmb)
+
+- Mbstring:
+  . Fixed bug #77370 (Buffer overflow on mb regex functions - fetch_token). (Stas)
+  . Fixed bug #77371 (heap buffer overflow in mb regex functions
+    - compile_string_node). (Stas)
+  . Fixed bug #77381 (heap buffer overflow in multibyte match_at). (Stas)
+  . Fixed bug #77382 (heap buffer overflow due to incorrect length in
+    expand_case_fold_string). (Stas)
+  . Fixed bug #77385 (buffer overflow in fetch_token). (Stas)
+  . Fixed bug #77394 (Buffer overflow in multibyte case folding - unicode). (Stas)
+  . Fixed bug #77418 (Heap overflow in utf32be_mbc_to_code). (Stas)
+
+- Phar:
+  . Fixed bug #77247 (heap buffer overflow in phar_detect_phar_fname_ext). (Stas)
+
+- Xmlrpc:
+  . Fixed bug #77242 (heap out of bounds read in xmlrpc_decode()). (cmb)
+  . Fixed bug #77380 (Global out of bounds read in xmlrpc base64 code). (Stas)
+
+06 Dec 2018, PHP 5.6.39
+
+- Core:
+  . Fixed bug #77231 (Segfault when using convert.quoted-printable-encode 
+    filter). (Stas)
+
+- IMAP:
+  . Fixed bug #77020 (null pointer dereference in imap_mail). (cmb)
+  . Fixed bug #77153 (imap_open allows to run arbitrary shell commands via
+    mailbox parameter). (Stas)
+
+- Phar:
+  . Fixed bug #77022 (PharData always creates new files with mode 0666). (Stas)
+  . Fixed bug #77143 (Heap Buffer Overflow (READ: 4) in phar_parse_pharfile).
+    (Stas)
+
+13 Sep 2018, PHP 5.6.38
+
+- Apache2
+  . Fixed bug #76582 (XSS due to the header Transfer-Encoding: chunked). (Stas)
+
+19 Jul 2018, PHP 5.6.37
+
+- Exif:
+  . Fixed bug #76423 (Int Overflow lead to Heap OverFlow in
+    exif_thumbnail_extract of exif.c). (Stas)
+  . Fixed bug #76557 (heap-buffer-overflow (READ of size 48) while reading exif
+    data). (Stas)
+
+- Win32:
+  . Fixed bug #76459 (windows linkinfo lacks openbasedir check). (Anatol)
+
+26 Apr 2018 PHP 5.6.36
+
+- Exif:
+  . Fixed bug #76130 (Heap Buffer Overflow (READ: 1786) in exif_iif_add_value).
+  (Stas)
+
+- iconv:
+  . Fixed bug #76249 (stream filter convert.iconv leads to infinite loop on
+    invalid sequence). (Stas)
+
+- LDAP:
+  . Fixed bug #76248 (Malicious LDAP-Server Response causes Crash). (Stas)
+
+- Phar:
+  . Fixed bug #76129 (fix for CVE-2018-5712 may not be complete). (Stas)
+
+29 Mar 2018, PHP 5.6.35
+
+- FPM:
+  . Fixed bug #75605 (Dumpable FPM child processes allow bypassing opcache
+    access controls). (Jakub Zelenka)
+
+01 Mar 2018, PHP 5.6.34
+
+- Standard:
+  . Fixed bug #75981 (stack-buffer-overflow while parsing HTTP response). (Stas)
+
+04 Jan 2018, PHP 5.6.33
+
+- GD:
+  . Fixed bug #75571 (Potential infinite loop in gdImageCreateFromGifCtx). (cmb)
+
+- Phar:
+  . Fixed bug #74782 (Reflected XSS in .phar 404 page). (Stas)
+
+26 Sep 2017, PHP 5.6.32
+
+- Date:
+  . Fixed bug #75055 (Out-Of-Bounds Read in timelib_meridian()). (Derick)
+
+- mcrypt:
+  . Fixed bug #72535 (arcfour encryption stream filter crashes php). (Leigh)
+
+- PCRE:
+  . Fixed bug #75207 (applied upstream patch for CVE-2016-1283). (Anatol)
+
+06 Jul 2017, PHP 5.6.31
+
+- Core:
+  . Fixed bug #73807 (Performance problem with processing post request over
+    2000000 chars). (Nikita)
+  . Fixed bug #74111 (Heap buffer overread (READ: 1) finish_nested_data from
+    unserialize). (Nikita)
+  . Fixed bug #74603 (PHP INI Parsing Stack Buffer Overflow Vulnerability).
+    (Stas)
+  . Fixed bug #74819 (wddx_deserialize() heap out-of-bound read via
+    php_parse_date()). (Derick)
+
+- GD:
+  . Fixed bug #74435 (Buffer over-read into uninitialized memory). (cmb)
+
+- mbstring:
+  . Add oniguruma upstream fix (CVE-2017-9224, CVE-2017-9226, CVE-2017-9227,
+    CVE-2017-9228, CVE-2017-9229) (Remi, Mamoru TASAKA)
+
+- OpenSSL:
+  . Fixed bug #74651 (negative-size-param (-1) in memcpy in zif_openssl_seal()).
+    (Stas)
+
+- PCRE:
+  . Fixed bug #74087 (Segmentation fault in PHP7.1.1(compiled using the bundled PCRE library)).
+    (Stas)
+
+- WDDX:
+   . Fixed bug #74145 (wddx parsing empty boolean tag leads to SIGSEGV). (Stas)
+
+19 Jan 2017, PHP 5.6.30
+
+- EXIF:
+  . Fixed bug #73737 (FPE when parsing a tag format). (Stas)
+
+- GD:
+  . Fixed bug #73549 (Use after free when stream is passed to imagepng). (cmb)
+  . Fixed bug #73868 (DOS vulnerability in gdImageCreateFromGd2Ctx()). (cmb)
+  . Fixed bug #73869 (Signed Integer Overflow gd_io.c). (cmb)
+
+- Intl:
+  . Fixed bug #68447 (grapheme_extract take an extra trailing character). 
+    (SATŌ Kentarō)
+
+- Phar:
+  . Fixed bug #73764 (Crash while loading hostile phar archive). (Stas)
+  . Fixed bug #73768 (Memory corruption when loading hostile phar). (Stas)
+  . Fixed bug #73773 (Seg fault when loading hostile phar). (Stas)
+
+- SQLite3:
+  . Reverted fix for bug #73530	(Unsetting result set may reset other result
+    set). (cmb)
+
+- Standard:
+  . Fixed bug #70213 (Unserialize context shared on double class lookup).
+    (Taoguang Chen)
+  . Fixed bug #73825 (Heap out of bounds read on unserialize in
+    finish_nested_data()). (Stas)
+
+08 Dec 2016, PHP 5.6.29
+
+- Mbstring:
+  . Fixed bug #73505 (string length overflow in mbfl_memory_device_output
+    function). (Stas)
+
+- Mysqlnd:
+  . Fixed bug #64526 (Add missing mysqlnd.* parameters to php.ini-*). (cmb)
+
+- Opcache:
+  . Fixed bug #73402 (Opcache segfault when using class constant to call a
+    method). (Laruence)
+  . Fixed bug #69090 (check cached files permissions)
+
+- OpenSSL
+  . Fixed bug #72776 (Invalid parameter in memcpy function trough
+    openssl_pbkdf2). (Jakub Zelenka)
+
+- Postgres:
+  . Fixed bug #73498 (Incorrect SQL generated for pg_copy_to()). (Craig Duncan)
+
+- SOAP:
+  . Fixed bug #73452 (Segfault (Regression for #69152)). (Dmitry)
+
+- SQLite3:
+  . Fixed bug #73530 (Unsetting result set may reset other result set). (cmb)
+
+- Standard:
+   . Fixed bug #73297 (HTTP stream wrapper should ignore HTTP 100 Continue).
+     (rowan dot collins at gmail dot com)
+
+- WDDX:
+  . Fixed bug #73631 (Memory leak due to invalid wddx stack processing). 
+    (bughunter at fosec dot vn).
+
+10 Nov 2016, PHP 5.6.28
+
+- Core:
+  . Fixed bug #73337 (try/catch not working with two exceptions inside a same
+    operation). (Dmitry)
+
+- Bz2:
+  . Fixed bug #73356 (crash in bzcompress function). (Stas)
+
+-GD:
+  . Fixed bug #73213 (Integer overflow in imageline() with antialiasing). (cmb)
+  . Fixed bug #73272 (imagescale() is not affected by, but affects
+    imagesetinterpolation()). (cmb)
+  . Fixed bug #73279 (Integer overflow in gdImageScaleBilinearPalette()). (cmb)
+  . Fixed bug #73280 (Stack Buffer Overflow in GD dynamicGetbuf). (cmb)
+  . Fixed bug #72482 (Illegal write/read access caused by gdImageAALine overflow).
+    (cmb)
+  . Fixed bug #72696 (imagefilltoborder stackoverflow on truecolor images). (cmb)
+
+- Imap:
+  . Fixed bug #73418 (Integer Overflow in "_php_imap_mail" leads Heap Overflow).
+    (Anatol)
+
+- SPL:
+  . Fixed bug #73144 (Use-after-free in ArrayObject Deserialization). (Stas)
+
+- SOAP:
+  . Fixed bug #73037 (SoapServer reports Bad Request when gzipped). (Anatol)
+
+- SQLite3:
+  . Fixed bug #73333 (2147483647 is fetched as string). (cmb)
+
+- Standard:
+  . Fixed bug #73203 (passing additional_parameters causes mail to fail). (cmb)
+  . Fixed bug #73188 (use after free in userspace streams). (Sara)
+  . Fixed bug #73192 (parse_url return wrong hostname). (Nikita)
+
+- Wddx:
+  . Fixed bug #73331 (NULL Pointer Dereference in WDDX Packet Deserialization
+    with PDORow). (Stas)
+
+13 Oct 2016, PHP 5.6.27

 - Core:
  . Fixed bug #73025 (Heap Buffer Overflow in virtual_popen of
@@ -8,6 +246,17 @@ PHP                                                                        NEWS
  . Fixed bug #73058 (crypt broken when salt is 'too' long). (Anatol)
  . Fixed bug #72703 (Out of bounds global memory read in BF_crypt triggered by
    password_verify). (Anatol)
+  . Fixed bug #73189 (Memcpy negative size parameter php_resolve_path). (Stas)
+  . Fixed bug #73147 (Use After Free in unserialize()). (Stas)
+
+- BCmath:
+  . Fixed bug #73190 (memcpy negative parameter _bc_new_num_ex). (Stas)
+
+- DOM:
+  . Fixed bug #73150 (missing NULL check in dom_document_save_html). (Stas)
+
+- Ereg:
+  . Fixed bug #73284 (heap overflow in php_ereg_replace function). (Stas)

 - Filter:
  . Fixed bug #72972 (Bad filter for the flags FILTER_FLAG_NO_RES_RANGE and
@@ -32,11 +281,22 @@ PHP                                                                        NEWS
    files). (cmb)
  . Fixed bug #73161 (imagecreatefromgd2() may leak memory). (cmb)

+- Intl:
+  . Fixed bug #73218 (add mitigation for ICU int overflow). (Stas)
+
+- Imap:
+  . Fixed bug #73208 (integer overflow in imap_8bit caused heap corruption).
+    (Stas)
+
 - Mbstring:
  . Fixed bug #72994 (mbc_to_code() out of bounds read). (Laruence, cmb)
  . Fixed bug #66964 (mb_convert_variables() cannot detect recursion). (Yasuo)
  . Fixed bug #72992 (mbstring.internal_encoding doesn't inherit default_charset).
    (Yasuo)
+  . Fixed bug #73082 (string length overflow in mb_encode_* function). (Stas)
+
+- PCRE:
+  . Fixed bug #73174 (heap overflow in php_pcre_replace_impl). (Stas)

 - Opcache:
  . Fixed bug #72590 (Opcache restart with kill_all_lockers does not work).
@@ -45,6 +305,8 @@ PHP                                                                        NEWS
 - OpenSSL:
  . Fixed bug #73072 (Invalid path SNI_server_certs causes segfault).
    (Jakub Zelenka)
+  . Fixed bug #73275 (crash in openssl_encrypt function). (Stas)
+  . Fixed bug #73276 (crash in openssl_random_pseudo_bytes function). (Stas)

 - Session:
  . Fixed bug #68015 (Session does not report invalid uid for files save handler).
@@ -52,6 +314,18 @@ PHP                                                                        NEWS
  . Fixed bug #73100 (session_destroy null dereference in ps_files_path_create).
    (cmb)

+- SimpleXML:
+  . Fixed bug #73293 (NULL pointer dereference in SimpleXMLElement::asXML()).
+    (Stas)
+
+- SPL:
+  . Fixed bug #73073 (CachingIterator null dereference when convert to string).
+    (Stas)
+
+- Standard:
+  . Fixed bug #73240 (Write out of bounds at number_format). (Stas)
+  . Fixed bug #73017 (memory corruption in wordwrap function). (Stas)
+
 - Stream:
  . Fixed bug #73069 (readfile() mangles files larger than 2G). (Laruence)

@@ -214,6 +488,8 @@ PHP                                                                        NEWS
  . Fixed bug #72697 (select_colors write out-of-bounds). (Stas)
  . Fixed bug #72709 (imagesetstyle() causes OOB read for empty $styles). (cmb)
  . Fixed bug #72730 (imagegammacorrect allows arbitrary write access). (Stas)
+  . Fixed bug #72494 (imagecropauto out-of-bounds access). (Fernando, Pierre,
+    cmb)

 - Intl:
  . Partially fixed #72506 (idn_to_ascii for UTS #46 incorrect for long domain
@@ -64,6 +64,13 @@ PHP 5.6 UPGRADE NOTES
 - cURL:
  Uploads using the @file syntax are now unsupported by default.

+- IMAP:
+  Starting with 5.6.38, rsh/ssh logins are disabled by default. Use
+  imap.enable_insecure_rsh if you want to enable them. Note that the IMAP
+  library does not filter mailbox names before passing them to rsh/ssh
+  command, thus passing untrusted data to this function with rsh/ssh enabled
+  is insecure.
+
 ========================================
 2. New Features
 ========================================
@@ -0,0 +1,25 @@
+--TEST--
+Next free element may overflow in array literals
+--FILE--
+<?php
+
+$i = PHP_INT_MAX;
+$array = [$i => 42, new stdClass];
+var_dump($array);
+
+const FOO = [PHP_INT_MAX => 42, "foo"];
+var_dump(FOO);
+
+?>
+--EXPECTF--
+Warning: Cannot add element to the array as the next element is already occupied in %s on line %d
+array(1) {
+  [%d]=>
+  int(42)
+}
+
+Warning: Cannot add element to the array as the next element is already occupied in %s on line %d
+array(1) {
+  [%d]=>
+  int(42)
+}
@@ -0,0 +1,12 @@
+--TEST--
+Bug #73337 (try/catch not working with two exceptions inside a same operation)
+--FILE--
+<?php
+class d { function __destruct() { throw new Exception; } }
+try { new d + new d; } catch (Exception $e) { print "Exception properly caught\n"; }
+?>
+--EXPECTF--
+Notice: Object of class d could not be converted to int in %sbug73337.php on line 3
+
+Notice: Object of class d could not be converted to int in %sbug73337.php on line 3
+Exception properly caught
@@ -0,0 +1 @@
+0=0&~2000000000
@@ -0,0 +1,15 @@
+--TEST--
+Bug #74603 (PHP INI Parsing Stack Buffer Overflow Vulnerability)
+--SKIPIF--
+<?php
+if (PHP_INT_MAX !== 2147483647)
+        die('skip for 32-bit only');
+--FILE--
+<?php
+var_dump(parse_ini_file(__DIR__ . "/bug74603.ini", true, INI_SCANNER_NORMAL));
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  string(1) "0"
+}
@@ -0,0 +1,15 @@
+--TEST--
+Constexpr arrays should be able to handle resource keys
+--FILE--
+<?php
+
+const FOO = [STDIN => 42];
+var_dump(FOO);
+
+?>
+--EXPECTF--
+Strict Standards: Resource ID#%d used as offset, casting to integer (%d) in %s on line %d
+array(1) {
+  [%d]=>
+  int(42)
+}
@@ -1,5 +1,7 @@
 --TEST--
 Testing __debugInfo() magic method with bad returns RESOURCE
+--INI--
+allow_url_fopen=1
 --FILE--
 <?php

@@ -3776,6 +3776,30 @@ ZEND_API void zend_update_property(zend_class_entry *scope, zval *object, const
 }
 /* }}} */

+ZEND_API void zend_unset_property(zend_class_entry *scope, zval *object, const char *name, int name_length TSRMLS_DC) /* {{{ */
+{
+	zval *property;
+	zend_class_entry *old_scope = EG(scope);
+
+	EG(scope) = scope;
+
+	if (!Z_OBJ_HT_P(object)->unset_property) {
+		const char *class_name;
+		zend_uint class_name_len;
+
+		zend_get_object_classname(object, &class_name, &class_name_len TSRMLS_CC);
+
+		zend_error(E_CORE_ERROR, "Property %s of class %s cannot be unset", name, class_name);
+	}
+	MAKE_STD_ZVAL(property);
+	ZVAL_STRINGL(property, name, name_length, 1);
+	Z_OBJ_HT_P(object)->unset_property(object, property, 0 TSRMLS_CC);
+	zval_ptr_dtor(&property);
+
+	EG(scope) = old_scope;
+}
+/* }}} */
+
 ZEND_API void zend_update_property_null(zend_class_entry *scope, zval *object, const char *name, int name_length TSRMLS_DC) /* {{{ */
 {
 	zval *tmp;
@@ -330,6 +330,7 @@ ZEND_API void zend_update_property_long(zend_class_entry *scope, zval *object, c
 ZEND_API void zend_update_property_double(zend_class_entry *scope, zval *object, const char *name, int name_length, double value TSRMLS_DC);
 ZEND_API void zend_update_property_string(zend_class_entry *scope, zval *object, const char *name, int name_length, const char *value TSRMLS_DC);
 ZEND_API void zend_update_property_stringl(zend_class_entry *scope, zval *object, const char *name, int name_length, const char *value, int value_length TSRMLS_DC);
+ZEND_API void zend_unset_property(zend_class_entry *scope, zval *object, const char *name, int name_length TSRMLS_DC);

 ZEND_API int zend_update_static_property(zend_class_entry *scope, const char *name, int name_length, zval *value TSRMLS_DC);
 ZEND_API int zend_update_static_property_null(zend_class_entry *scope, const char *name, int name_length TSRMLS_DC);
@@ -664,8 +665,9 @@ END_EXTERN_C()
 		}									\
 		RETURN_FALSE;						\
 	}										\
-	RETVAL_STRINGL((s), __len, (dup)); \
+	RETVAL_STRINGL((s), (int)__len, (dup)); \
 } while (0)
+#define RETURN_STRINGL_CHECK(s, len, dup) { RETVAL_STRINGL_CHECK(s, len, dup); return; }


 #define SET_VAR_STRING(n, v) {																				\
@@ -5929,7 +5929,7 @@ void zend_do_add_array_element(znode *result, const znode *expr, const znode *of
 }
 /* }}} */

-void zend_do_add_static_array_element(zval *result, zval *offset, const zval *expr) /* {{{ */
+void zend_do_add_static_array_element(zval *result, zval *offset, zval *expr) /* {{{ */
 {
 	if (offset) {
 		switch (Z_TYPE_P(offset)) {
@@ -5940,6 +5940,9 @@ void zend_do_add_static_array_element(zval *result, zval *offset, const zval *ex
 			case IS_NULL:
 				zend_symtable_update(Z_ARRVAL_P(result), "", 1, &expr, sizeof(zval *), NULL);
 				break;
+			case IS_RESOURCE:
+				zend_error(E_STRICT, "Resource ID#%ld used as offset, casting to integer (%ld)", Z_LVAL_P(offset), Z_LVAL_P(offset));
+				/* break missing intentionally */
 			case IS_LONG:
 			case IS_BOOL:
 				zend_hash_index_update(Z_ARRVAL_P(result), Z_LVAL_P(offset), &expr, sizeof(zval *), NULL);
@@ -5952,7 +5955,10 @@ void zend_do_add_static_array_element(zval *result, zval *offset, const zval *ex
 				break;
 		}
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL_P(result), &expr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL_P(result), &expr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr);
+		}
 	}
 }
 /* }}} */
@@ -598,7 +598,7 @@ void zend_do_shell_exec(znode *result, const znode *cmd TSRMLS_DC);

 void zend_do_init_array(znode *result, const znode *expr, const znode *offset, zend_bool is_ref TSRMLS_DC);
 void zend_do_add_array_element(znode *result, const znode *expr, const znode *offset, zend_bool is_ref TSRMLS_DC);
-void zend_do_add_static_array_element(zval *result, zval *offset, const zval *expr);
+void zend_do_add_static_array_element(zval *result, zval *offset, zval *expr);
 void zend_do_list_init(TSRMLS_D);
 void zend_do_list_end(znode *result, znode *expr TSRMLS_DC);
 void zend_do_add_list_element(const znode *element TSRMLS_DC);
@@ -229,13 +229,9 @@ ZEND_METHOD(exception, __construct)
 /* {{{ proto Exception::__wakeup()
   Exception unserialize checks */
 #define CHECK_EXC_TYPE(name, type) \
-	value = zend_read_property(default_exception_ce, object, name, sizeof(name)-1, 0 TSRMLS_CC); \
+	value = zend_read_property(default_exception_ce, object, name, sizeof(name)-1, 1 TSRMLS_CC); \
 	if (value && Z_TYPE_P(value) != IS_NULL && Z_TYPE_P(value) != type) { \
-		zval *tmp; \
-		MAKE_STD_ZVAL(tmp); \
-		ZVAL_STRINGL(tmp, name, sizeof(name)-1, 1); \
-		Z_OBJ_HANDLER_P(object, unset_property)(object, tmp, 0 TSRMLS_CC); \
-		zval_ptr_dtor(&tmp); \
+		zend_unset_property(default_exception_ce, object, name, sizeof(name)-1 TSRMLS_CC); \
 	}

 ZEND_METHOD(exception, __wakeup)
@@ -248,7 +244,12 @@ ZEND_METHOD(exception, __wakeup)
 	CHECK_EXC_TYPE("file", IS_STRING);
 	CHECK_EXC_TYPE("line", IS_LONG);
 	CHECK_EXC_TYPE("trace", IS_ARRAY);
-	CHECK_EXC_TYPE("previous", IS_OBJECT);
+	value = zend_read_property(default_exception_ce, object, "previous", sizeof("previous")-1, 1 TSRMLS_CC);
+	if (value && Z_TYPE_P(value) != IS_NULL && (Z_TYPE_P(value) != IS_OBJECT ||
+			!instanceof_function(Z_OBJCE_P(value), default_exception_ce TSRMLS_CC) ||
+			value == object)) {
+		zend_unset_property(default_exception_ce, object, "previous", sizeof("previous")-1 TSRMLS_CC);
+	}
 }
 /* }}} */

@@ -727,7 +728,11 @@ ZEND_METHOD(exception, __toString)
 		zval_dtor(&file);
 		zval_dtor(&line);

-		exception = zend_read_property(default_exception_ce, exception, "previous", sizeof("previous")-1, 0 TSRMLS_CC);
+		Z_OBJPROP_P(exception)->nApplyCount++;
+		exception = zend_read_property(default_exception_ce, exception, "previous", sizeof("previous")-1, 1 TSRMLS_CC);
+		if (exception && Z_TYPE_P(exception) == IS_OBJECT && Z_OBJPROP_P(exception)->nApplyCount > 0) {
+			exception = NULL;
+		}

 		if (trace) {
 			zval_ptr_dtor(&trace);
@@ -736,6 +741,17 @@ ZEND_METHOD(exception, __toString)
 	}
 	zval_dtor(&fname);

+	/* Reset apply counts */
+	exception = getThis();
+	while (exception && Z_TYPE_P(exception) == IS_OBJECT && instanceof_function(Z_OBJCE_P(exception), default_exception_ce TSRMLS_CC)) {
+		if(Z_OBJPROP_P(exception)->nApplyCount) {
+			Z_OBJPROP_P(exception)->nApplyCount--;
+		} else {
+			break;
+		}
+		exception = zend_read_property(default_exception_ce, exception, "previous", sizeof("previous")-1, 1 TSRMLS_CC);
+	}
+
 	/* We store the result in the private property string so we can access
 	 * the result in uncaught exception handlers without memleaks. */
 	zend_update_property_string(default_exception_ce, getThis(), "string", sizeof("string")-1, str TSRMLS_CC);
@@ -893,11 +909,10 @@ static void zend_error_va(int type, const char *file, uint lineno, const char *f
 ZEND_API void zend_exception_error(zval *exception, int severity TSRMLS_DC) /* {{{ */
 {
 	zend_class_entry *ce_exception = Z_OBJCE_P(exception);
+	EG(exception) = NULL;
 	if (instanceof_function(ce_exception, default_exception_ce TSRMLS_CC)) {
 		zval *str, *file, *line;

-		EG(exception) = NULL;
-
 		zend_call_method_with_0_params(&exception, ce_exception, NULL, "__tostring", &str);
 		if (!EG(exception)) {
 			if (Z_TYPE_P(str) != IS_STRING) {
@@ -936,6 +951,7 @@ ZEND_API void zend_exception_error(zval *exception, int severity TSRMLS_DC) /* {
 	} else {
 		zend_error(severity, "Uncaught exception '%s'", ce_exception->name);
 	}
+	zval_ptr_dtor(&exception);
 }
 /* }}} */

@@ -826,7 +826,10 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache TS
 		if (EG(active_op_array)->fn_flags & ZEND_ACC_GENERATOR) {
 			*fci->retval_ptr_ptr = zend_generator_create_zval(EG(active_op_array) TSRMLS_CC);
 		} else {
+			const zend_op *current_opline_before_exception = EG(opline_before_exception);
+
 			zend_execute(EG(active_op_array) TSRMLS_CC);
+			EG(opline_before_exception) = current_opline_before_exception;
 		}

 		if (!fci->symbol_table && EG(active_symbol_table)) {
@@ -53,7 +53,7 @@ static void zend_ini_do_op(char type, zval *result, zval *op1, zval *op2)
 {
 	int i_result;
 	int i_op1, i_op2;
-	char str_result[MAX_LENGTH_OF_LONG];
+	char str_result[MAX_LENGTH_OF_LONG+1];

 	i_op1 = atoi(Z_STRVAL_P(op1));
 	free(Z_STRVAL_P(op1));
@@ -1184,6 +1184,10 @@ ZEND_API zend_function *zend_std_get_static_method(zend_class_entry *ce, const c
 	ALLOCA_FLAG(use_heap)

 	if (EXPECTED(key != NULL)) {
+#if (ZEND_GCC_VERSION == 4009) && !(defined(ZTS) && defined(NETWARE)) && !(defined(ZTS) && defined(HPUX)) && !defined(DARWIN)
+		/* This is a workaround for bug in GCC 4.9.2 */
+		use_heap = 0;
+#endif
 		lc_function_name = Z_STRVAL(key->constant);
 		hash_value = key->hash_value;
 	} else {
@@ -3879,7 +3879,10 @@ ZEND_VM_C_LABEL(num_index):
 		}
 		FREE_OP2();
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((OP1_TYPE == IS_VAR || OP1_TYPE == IS_CV) && opline->extended_value) {
 		FREE_OP1_VAR_PTR();
@@ -4119,7 +4119,10 @@ num_index:
 		}

 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {

@@ -5030,7 +5033,10 @@ num_index:
 		}
 		zval_dtor(free_op2.var);
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {

@@ -5894,7 +5900,10 @@ num_index:
 		}
 		zval_ptr_dtor_nogc(&free_op2.var);
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {

@@ -6614,7 +6623,10 @@ num_index:
 		}

 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {

@@ -7547,7 +7559,10 @@ num_index:
 		}

 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {

@@ -9447,7 +9462,10 @@ num_index:
 		}

 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {

@@ -10314,7 +10332,10 @@ num_index:
 		}
 		zval_dtor(free_op2.var);
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {

@@ -11180,7 +11201,10 @@ num_index:
 		}
 		zval_ptr_dtor_nogc(&free_op2.var);
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {

@@ -11775,7 +11799,10 @@ num_index:
 		}

 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {

@@ -12624,7 +12651,10 @@ num_index:
 		}

 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {

@@ -16107,7 +16137,10 @@ num_index:
 		}

 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
 		if (free_op1.var) {zval_ptr_dtor_nogc(&free_op1.var);};
@@ -18387,7 +18420,10 @@ num_index:
 		}
 		zval_dtor(free_op2.var);
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
 		if (free_op1.var) {zval_ptr_dtor_nogc(&free_op1.var);};
@@ -20725,7 +20761,10 @@ num_index:
 		}
 		zval_ptr_dtor_nogc(&free_op2.var);
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
 		if (free_op1.var) {zval_ptr_dtor_nogc(&free_op1.var);};
@@ -22165,7 +22204,10 @@ num_index:
 		}

 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
 		if (free_op1.var) {zval_ptr_dtor_nogc(&free_op1.var);};
@@ -24220,7 +24262,10 @@ num_index:
 		}

 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
 		if (free_op1.var) {zval_ptr_dtor_nogc(&free_op1.var);};
@@ -33574,7 +33619,10 @@ num_index:
 		}

 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {

@@ -35717,7 +35765,10 @@ num_index:
 		}
 		zval_dtor(free_op2.var);
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {

@@ -37917,7 +37968,10 @@ num_index:
 		}
 		zval_ptr_dtor_nogc(&free_op2.var);
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {

@@ -39225,7 +39279,10 @@ num_index:
 		}

 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {

@@ -41125,7 +41182,10 @@ num_index:
 		}

 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {

@@ -2263,7 +2263,7 @@ AC_DEFUN([PHP_SETUP_KERBEROS],[
  fi

  dnl If krb5-config is found try using it
-  if test "$PHP_KERBEROS" = "yes" && test -x "$KRB5_CONFIG"; then
+  if test "$PHP_KERBEROS" != "no" && test -x "$KRB5_CONFIG"; then
    KERBEROS_LIBS=`$KRB5_CONFIG --libs gssapi`
    KERBEROS_CFLAGS=`$KRB5_CONFIG --cflags gssapi`

@@ -119,8 +119,8 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=6
-PHP_RELEASE_VERSION=27
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=40
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -49,7 +49,10 @@ _bc_new_num_ex (length, scale, persistent)
     int length, scale, persistent;
 {
  bc_num temp;
-
+  /* PHP Change:  add length check */
+  if ((size_t)length+(size_t)scale > INT_MAX) {
+   zend_error(E_ERROR, "Result too long, max is %d", INT_MAX);
+  }
  /* PHP Change:  malloc() -> pemalloc(), removed free_list code */
  temp = (bc_num) safe_pemalloc (1, sizeof(bc_struct)+length, scale, persistent);
 #if 0
@@ -41,6 +41,5 @@

 void bc_out_of_memory (void)
 {
-  (void) fprintf (stderr, "bcmath: out of memory!\n");
-  exit (1);
+  zend_error(E_ERROR, "bcmath: out of memory!");
 }
@@ -513,7 +513,7 @@ static PHP_FUNCTION(bzcompress)
 	dest_len   = (unsigned int) (source_len + (0.01 * source_len) + 600);

 	/* Allocate the destination buffer */
-	dest = emalloc(dest_len + 1);
+	dest = safe_emalloc(dest_len, 1, 1);

 	/* Handle the optional arguments */
 	if (argc > 1) {
@@ -533,7 +533,7 @@ static PHP_FUNCTION(bzcompress)
 		   so we erealloc() the buffer to the proper size */
 		dest = erealloc(dest, dest_len + 1);
 		dest[dest_len] = 0;
-		RETURN_STRINGL(dest, dest_len, 0);
+		RETURN_STRINGL_CHECK(dest, dest_len, 0);
 	}
 }
 /* }}} */
@@ -35,7 +35,7 @@ static void curlfile_ctor(INTERNAL_FUNCTION_PARAMETERS)
 	int fname_len, mime_len, postname_len;
 	zval *cf = return_value;

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|ss", &fname, &fname_len, &mime, &mime_len, &postname, &postname_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|ss", &fname, &fname_len, &mime, &mime_len, &postname, &postname_len) == FAILURE) {
 		return;
 	}

@@ -137,7 +137,10 @@ ZEND_METHOD(CURLFile, setPostFilename)
   Unserialization handler */
 ZEND_METHOD(CURLFile, __wakeup)
 {
-	zend_update_property_string(curl_CURLFile_class, getThis(), "name", sizeof("name")-1, "" TSRMLS_CC);
+	zval *_this = getThis();
+
+	zend_unset_property(curl_CURLFile_class, _this, "name", sizeof("name")-1 TSRMLS_CC);
+	zend_update_property_string(curl_CURLFile_class, _this, "name", sizeof("name")-1, "" TSRMLS_CC);
 	zend_throw_exception(NULL, "Unserialization of CURLFile instances is not allowed", 0 TSRMLS_CC);
 }
 /* }}} */
@@ -0,0 +1,20 @@
+--TEST--
+Bug #73147: Use After Free in PHP7 unserialize()
+--SKIPIF--
+<?php
+if (!extension_loaded("curl")) {
+        exit("skip curl extension not loaded");
+}
+?>
+--FILE--
+<?php
+
+$poc = 'a:1:{i:0;O:8:"CURLFile":1:{s:4:"name";R:1;}}';
+try {
+var_dump(unserialize($poc));
+} catch(Exception $e) {
+	echo $e->getMessage();
+}
+?>
+--EXPECT--
+Unserialization of CURLFile instances is not allowed
@@ -394,8 +394,12 @@ static timelib_sll timelib_meridian(char **ptr, timelib_sll h)
 	}
 	++*ptr;
 	if (**ptr == '.') {
-		*ptr += 3;
-	} else {
+		++*ptr;
+	}
+	if (**ptr == 'M' || **ptr == 'm') {
+		++*ptr;
+	}
+	if (**ptr == '.') {
 		++*ptr;
 	}
 	return retval;
@@ -895,7 +899,7 @@ datefull         = day ([ \t.-])* monthtext ([ \t.-])* year;
 datenoday        = monthtext ([ .\t-])* year4;
 datenodayrev     = year4 ([ .\t-])* monthtext;
 datetextual      = monthtext ([ .\t-])* day [,.stndrh\t ]+ year;
-datenoyear       = monthtext ([ .\t-])* day [,.stndrh\t ]*;
+datenoyear       = monthtext ([ .\t-])* day ([,.stndrh\t ]+|[\000]);
 datenoyearrev    = day ([ .\t-])* monthtext;
 datenocolon      = year4 monthlz daylz;

@@ -913,8 +917,8 @@ isoweek          = year4 "-"? "W" weekofyear;
 exif             = year4 ":" monthlz ":" daylz " " hour24lz ":" minutelz ":" secondlz;
 firstdayof       = 'first day of';
 lastdayof        = 'last day of';
-backof           = 'back of ' hour24 space? meridian?;
-frontof          = 'front of ' hour24 space? meridian?;
+backof           = 'back of ' hour24 (space? meridian)?;
+frontof          = 'front of ' hour24 (space? meridian)?;

 /* Common Log Format: 10/Oct/2000:13:55:36 -0700 */
 clf              = day "/" monthabbr "/" year4 ":" hour24lz ":" minutelz ":" secondlz space tzcorrection;
@@ -75,8 +75,8 @@ result = Monday 1983-04-18 01:00:00 CEST
 wanted = Monday            00:00:00

 Asia/Yerevan
-ts     = Monday 2037-10-19 17:17:17 AMT
-result = Monday 2037-10-26 00:00:00 AMT
+ts     = Monday 2037-10-19 17:17:17 +04
+result = Monday 2037-10-26 00:00:00 +04
 wanted = Monday            00:00:00

 America/Curacao
@@ -115,8 +115,8 @@ result = Monday 1971-04-05 00:00:00 AST
 wanted = Monday            00:00:00

 Asia/Baku
-ts     = Friday 1971-01-01 17:17:17 BAKT
-result = Monday 1971-01-04 00:00:00 BAKT
+ts     = Friday 1971-01-01 17:17:17 +04
+result = Monday 1971-01-04 00:00:00 +04
 wanted = Monday            00:00:00

 Europe/Sarajevo
@@ -165,6 +165,6 @@ result = Monday 1980-04-07 00:00:00 CEST
 wanted = Monday            00:00:00

 Asia/Baku
-ts     = Monday 1995-12-25 17:17:17 AZT
-result = Monday 1996-01-01 00:00:00 AZT
+ts     = Monday 1995-12-25 17:17:17 +04
+result = Monday 1996-01-01 00:00:00 +04
 wanted = Monday            00:00:00
@@ -226,8 +226,8 @@ result=Thursday 1980-04-10 00:00:00 CEST 1
 wanted=Thursday             00:00:00

 TZ=Asia/Baku - wrong day.
-tStamp=Sunday 1992-09-20 17:17:17 AZST 1
-result=Monday 1992-09-28 00:00:00 AZT 0
+tStamp=Sunday 1992-09-20 17:17:17 +04 1
+result=Monday 1992-09-28 00:00:00 +04 0
 wanted=Monday              00:00:00

 TZ=America/Noronha - wrong day.
@@ -28,6 +28,6 @@ result=Monday 1990-10-22 00:00:00 WART 0
 wanted=Monday            00:00:00

 TZ=Asia/Tbilisi - Is it OK for this to be 2 AM?
-tStamp=Sunday 2005-03-20 17:17:17 GET 0
-result=Sunday 2005-03-27 00:00:00 GET 0
+tStamp=Sunday 2005-03-20 17:17:17 +03 0
+result=Sunday 2005-03-27 00:00:00 +03 0
 wanted=Sunday            00:00:00
@@ -40,7 +40,7 @@ object(DateInterval)#%d (15) {
  ["special_amount"]=>
  int(-1)
  ["have_weekday_relative"]=>
-  int(9)
+  int(%d)
  ["have_special_relative"]=>
  int(0)
 }
@@ -34,14 +34,14 @@ foreach ( $tests as $start => $data )
 echo "\n";
 ?>
 --EXPECT--
-Sat, 23 Oct 2010 00:00:00 +0000
+Fri, 15 Oct 2010 23:00:00 +0000
 Wed, 15 Dec 2010 16:15:00 +0000
 Mon, 20 Dec 2010 00:00:00 +0000
 Mon, 20 Dec 2010 10:00:00 +0000
 Tue, 21 Dec 2010 12:00:00 +0000
 Mon, 03 Jan 2011 00:00:00 +0000
 Mon, 03 Jan 2011 09:00:00 +0000
-Sat, 23 Oct 2010 00:00:00 +0100
+Fri, 15 Oct 2010 23:00:00 +0100
 Sun, 28 Mar 2010 00:15:00 +0000
 Sun, 28 Mar 2010 02:15:00 +0100
 Sun, 28 Mar 2010 02:15:00 +0100
@@ -1792,7 +1792,7 @@ PHP_FUNCTION(dom_document_savexml)
 		if (options & LIBXML_SAVE_NOEMPTYTAG) {
 			xmlSaveNoEmptyTags = saveempty;
 		}
-		if (!size) {
+		if (!size || !mem) {
 			RETURN_FALSE;
 		}
 		RETVAL_STRINGL(mem, size, 1);
@@ -2327,7 +2327,7 @@ PHP_FUNCTION(dom_document_save_html)
 #else
 		htmlDocDumpMemory(docp, &mem, &size);
 #endif
-		if (!size) {
+		if (!size || !mem) {
 			RETVAL_FALSE;
 		} else {
 			RETVAL_STRINGL((const char*) mem, size, 1);
@@ -14,7 +14,7 @@
   +----------------------------------------------------------------------+
   | Authors: Rasmus Lerdorf <rasmus@php.net>                             |
   |          Jim Winstead <jimw@php.net>                                 |
-   |          Jaakko Hyvätti <jaakko@hyvatti.iki.fi>                      | 
+   |          Jaakko Hyvätti <jaakko@hyvatti.iki.fi>                      |
   +----------------------------------------------------------------------+
 */
 /* $Id$ */
@@ -29,7 +29,7 @@
 /* {{{ arginfo */
 ZEND_BEGIN_ARG_INFO_EX(arginfo_ereg, 0, 0, 2)
 	ZEND_ARG_INFO(0, pattern)
-	ZEND_ARG_INFO(0, string) 
+	ZEND_ARG_INFO(0, string)
 	ZEND_ARG_INFO(1, registers) /* ARRAY_INFO(1, registers, 1) */
 ZEND_END_ARG_INFO()

@@ -41,8 +41,8 @@ ZEND_END_ARG_INFO()

 ZEND_BEGIN_ARG_INFO_EX(arginfo_split, 0, 0, 2)
 	ZEND_ARG_INFO(0, pattern)
-	ZEND_ARG_INFO(0, string) 
-	ZEND_ARG_INFO(0, limit)  
+	ZEND_ARG_INFO(0, string)
+	ZEND_ARG_INFO(0, limit)
 ZEND_END_ARG_INFO()

 ZEND_BEGIN_ARG_INFO(arginfo_sql_regcase, 0)
@@ -204,7 +204,7 @@ static int _php_regcomp(regex_t *preg, const char *pattern, int cflags TSRMLS_DC
 }
 /* }}} */

-static void _free_ereg_cache(reg_cache *rc) 
+static void _free_ereg_cache(reg_cache *rc)
 {
 	regfree(&rc->preg);
 }
@@ -309,7 +309,7 @@ static void php_ereg(INTERNAL_FUNCTION_PARAMETERS, int icase)
 	if (icase) {
 		copts |= REG_ICASE;
 	}
-	
+
 	if (argc == 2) {
 		copts |= REG_NOSUB;
 	}
@@ -337,7 +337,7 @@ static void php_ereg(INTERNAL_FUNCTION_PARAMETERS, int icase)

 	/* allocate storage for (sub-)expression-matches */
 	subs = (regmatch_t *)ecalloc(sizeof(regmatch_t),re.re_nsub+1);
-	
+
 	/* actually execute the regular expression */
 	err = regexec(&re, string, re.re_nsub+1, subs, 0);
 	if (err && err != REG_NOMATCH) {
@@ -409,8 +409,8 @@ PHP_EREG_API char *php_ereg_replace(const char *pattern, const char *replace, co
 		 *nbuf,	/* nbuf is used when we grow the buffer */
 		 *walkbuf; /* used to walk buf when replacing backrefs */
 	const char *walk; /* used to walk replacement string for backrefs */
-	int buf_len;
-	int pos, tmp, string_len, new_l;
+	size_t buf_len, new_l;
+	int pos, tmp, string_len;
 	int err, copts = 0;

 	string_len = strlen(string);
@@ -434,8 +434,8 @@ PHP_EREG_API char *php_ereg_replace(const char *pattern, const char *replace, co

 	/* start with a buffer that is twice the size of the stringo
 	   we're doing replacements in */
+	buf = safe_emalloc(string_len, 2, 1);
 	buf_len = 2 * string_len + 1;
-	buf = safe_emalloc(buf_len, sizeof(char), 0);

 	err = pos = 0;
 	buf[0] = '\0';
@@ -472,8 +472,8 @@ PHP_EREG_API char *php_ereg_replace(const char *pattern, const char *replace, co
 				}
 			}
 			if (new_l + 1 > buf_len) {
+				nbuf = safe_emalloc(new_l + 1, 2, buf_len);
 				buf_len = 1 + buf_len + 2 * new_l;
-				nbuf = emalloc(buf_len);
 				strncpy(nbuf, buf, buf_len - 1);
 				nbuf[buf_len - 1] = '\0';
 				efree(buf);
@@ -491,7 +491,7 @@ PHP_EREG_API char *php_ereg_replace(const char *pattern, const char *replace, co
 					if (subs[walk[1] - '0'].rm_so > -1 && subs[walk[1] - '0'].rm_eo > -1
 						/* this next case shouldn't happen. it does. */
 						&& subs[walk[1] - '0'].rm_so <= subs[walk[1] - '0'].rm_eo) {
-						
+
 						tmp = subs[walk[1] - '0'].rm_eo - subs[walk[1] - '0'].rm_so;
 						memcpy (walkbuf, &string[pos + subs[walk[1] - '0'].rm_so], tmp);
 						walkbuf += tmp;
@@ -510,8 +510,8 @@ PHP_EREG_API char *php_ereg_replace(const char *pattern, const char *replace, co
 				}
 				new_l = strlen (buf) + 1;
 				if (new_l + 1 > buf_len) {
+					nbuf = safe_emalloc(new_l + 1, 2, buf_len);
 					buf_len = 1 + buf_len + 2 * new_l;
-					nbuf = safe_emalloc(buf_len, sizeof(char), 0);
 					strncpy(nbuf, buf, buf_len-1);
 					efree(buf);
 					buf = nbuf;
@@ -526,7 +526,7 @@ PHP_EREG_API char *php_ereg_replace(const char *pattern, const char *replace, co
 			new_l = strlen(buf) + strlen(&string[pos]);
 			if (new_l + 1 > buf_len) {
 				buf_len = new_l + 1; /* now we know exactly how long it is */
-				nbuf = safe_emalloc(buf_len, sizeof(char), 0);
+				nbuf = safe_emalloc(new_l, 1, 1);
 				strncpy(nbuf, buf, buf_len-1);
 				efree(buf);
 				buf = nbuf;
@@ -556,7 +556,7 @@ static void php_do_ereg_replace(INTERNAL_FUNCTION_PARAMETERS, int icase)
 	char *replace;
 	char *ret;
 	int arg_string_len;
-	
+
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ZZs", &arg_pattern, &arg_replace, &arg_string, &arg_string_len) == FAILURE) {
 		return;
 	}
@@ -598,7 +598,7 @@ static void php_do_ereg_replace(INTERNAL_FUNCTION_PARAMETERS, int icase)
 	if (ret == (char *) -1) {
 		RETVAL_FALSE;
 	} else {
-		RETVAL_STRING(ret, 1);
+		RETVAL_STRINGL_CHECK(ret, strlen(ret), 1);
 		STR_FREE(ret);
 	}

@@ -664,9 +664,9 @@ static void php_split(INTERNAL_FUNCTION_PARAMETERS, int icase)
 		} else if (subs[0].rm_so == 0 && subs[0].rm_eo == 0) {
 			/* No more matches */
 			regfree(&re);
-			
+
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid Regular Expression");
-			
+
 			zend_hash_destroy(Z_ARRVAL_P(return_value));
 			efree(Z_ARRVAL_P(return_value));
 			RETURN_FALSE;
@@ -675,7 +675,7 @@ static void php_split(INTERNAL_FUNCTION_PARAMETERS, int icase)

 			/* make a copy of the substring */
 			size = subs[0].rm_so;
-		
+
 			/* add it to the array */
 			add_next_index_stringl(return_value, strp, size, 1);

@@ -701,7 +701,7 @@ static void php_split(INTERNAL_FUNCTION_PARAMETERS, int icase)

 	/* otherwise we just have one last element to add to the array */
 	size = endp - strp;
-	
+
 	add_next_index_stringl(return_value, strp, size, 1);

 	regfree(&re);
@@ -738,9 +738,9 @@ PHP_EREG_API PHP_FUNCTION(sql_regcase)
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &string, &string_len) == FAILURE) {
 		return;
 	}
-	
+
 	tmp = safe_emalloc(string_len, 4, 1);
-	
+
 	for (i = j = 0; i < string_len; i++) {
 		c = (unsigned char) string[i];
 		if ( j >= INT_MAX - 1 || (isalpha(c) && j >= INT_MAX - 4)) {
@@ -1303,7 +1303,7 @@ static size_t exif_convert_any_to_int(void *value, int format, int motorola_inte
 			if (s_den == 0) {
 				return 0;
 			} else {
-				return php_ifd_get32s(value, motorola_intel) / s_den;
+				return (size_t)((double)php_ifd_get32s(value, motorola_intel) / s_den);
 			}

 		case TAG_FMT_SSHORT:    return php_ifd_get16u(value, motorola_intel);
@@ -1710,7 +1710,7 @@ static void exif_iif_add_value(image_info_type *image_info, int section_index, c
 		case TAG_FMT_UNDEFINED:
 			if (value) {
 				if (tag == TAG_MAKER_NOTE) {
-					length = MIN(length, strlen(value));
+					length = (int) php_strnlen(value, length);
 				}

 				/* do not recompute length here */
@@ -2545,7 +2545,10 @@ static void exif_thumbnail_extract(image_info_type *ImageInfo, char *offset, siz
 		return;
 	}
 	/* Check to make sure we are not going to go past the ExifLength */
-	if ((ImageInfo->Thumbnail.offset + ImageInfo->Thumbnail.size) > length) {
+	if (ImageInfo->Thumbnail.size > length
+		|| (ImageInfo->Thumbnail.offset + ImageInfo->Thumbnail.size) > length
+		|| ImageInfo->Thumbnail.offset > length - ImageInfo->Thumbnail.size
+	) {
 		EXIF_ERRLOG_THUMBEOF(ImageInfo)
 		return;
 	}
@@ -2725,6 +2728,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 	int NumDirEntries, old_motorola_intel, offset_diff;
 	const maker_note_type *maker_note;
 	char *dir_start;
+	int data_len;

 	for (i=0; i<=sizeof(maker_note_array)/sizeof(maker_note_type); i++) {
 		if (i==sizeof(maker_note_array)/sizeof(maker_note_type)) {
@@ -2779,6 +2783,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 	switch (maker_note->offset_mode) {
 		case MN_OFFSET_MAKER:
 			offset_base = value_ptr;
+			data_len = value_len;
 			break;
 		case MN_OFFSET_GUESS:
 			if (maker_note->offset + 10 + 4 >= value_len) {
@@ -2795,6 +2800,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 				return FALSE;
 			}
 			offset_base = value_ptr + offset_diff;
+			data_len = value_len - offset_diff;
 			break;
 		default:
 		case MN_OFFSET_NORMAL:
@@ -2808,7 +2814,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu

 	for (de=0;de<NumDirEntries;de++) {
 		if (!exif_process_IFD_TAG(ImageInfo, dir_start + 2 + 12 * de,
-								  offset_base, IFDlength, displacement, section_index, 0, maker_note->tag_table TSRMLS_CC)) {
+								  offset_base, data_len, displacement, section_index, 0, maker_note->tag_table TSRMLS_CC)) {
 			return FALSE;
 		}
 	}
@@ -2855,7 +2861,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 	}

 	if (components < 0) {
-		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal components(%ld)", tag, exif_get_tagname(tag, tagname, -12, tag_table TSRMLS_CC), components);
+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal components(%d)", tag, exif_get_tagname(tag, tagname, -12, tag_table TSRMLS_CC), components);
 		return FALSE;
 	}

@@ -4210,7 +4216,7 @@ PHP_FUNCTION(exif_imagetype)
 	php_stream * stream;
 	int itype = 0;

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &imagefile, &imagefile_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &imagefile, &imagefile_len) == FAILURE) {
 		return;
 	}

@@ -0,0 +1,12 @@
+--TEST--
+Bug #73737 (Crash when parsing a tag format)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+	$exif = exif_thumbnail(__DIR__ . '/bug73737.tiff');
+	var_dump($exif);
+?>
+--EXPECTF--
+Warning: exif_thumbnail(bug73737.tiff): Error in TIFF: filesize(x0030) less than start of IFD dir(x10102) in %s line %d
+bool(false)
@@ -0,0 +1,20 @@
+--TEST--
+Bug #76130 (Heap Buffer Overflow (READ: 1786) in exif_iif_add_value)
+--DESCRIPTION--
+This test is meant to exhibit memory issues with the `-m` option. Since a lot of
+notices and warnings are to be expected anyway, we suppress these, since the are
+not relevant for this test.
+--INI--
+error_reporting=E_ALL & ~E_WARNING & ~E_NOTICE
+--SKIPIF--
+<?php
+if (!extension_loaded('exif')) die('skip exif extension not available');
+?>
+--FILE--
+<?php
+exif_read_data(__DIR__ . '/bug76130_1.jpg');
+exif_read_data(__DIR__ . '/bug76130_2.jpg');
+?>
+===DONE===
+--EXPECT--
+===DONE===
@@ -0,0 +1,19 @@
+--TEST--
+Bug #76423 (Int Overflow lead to Heap OverFlow in exif_thumbnail_extract of exif.c)
+--SKIPIF--
+<?php
+if (!extension_loaded('exif')) die('skip exif extension not available');
+?>
+--FILE--
+<?php
+exif_read_data(__DIR__ . '/bug76423.jpg', 0, true, true);
+?>
+===DONE===
+--EXPECTF--
+
+Warning: exif_read_data(%s.jpg): Thumbnail goes IFD boundary or end of file reached in %s on line %d
+
+Warning: exif_read_data(%s.jpg): File structure corrupted in %s on line %d
+
+Warning: exif_read_data(%s.jpg): Invalid JPEG file in %s on line %d
+===DONE===
@@ -0,0 +1,79 @@
+--TEST--
+Bug 76557 (heap-buffer-overflow (READ of size 48) while reading exif data)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+var_dump(count(exif_read_data(dirname(__FILE__) . "/bug76557.jpg")));
+?>
+DONE
+--EXPECTF--
+Warning: exif_read_data(bug76557.jpg): Process tag(x010F=Make       ): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x8769=Exif_IFD_Po): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x927C=MakerNote  ): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal pointer offset(x30303030 + x30303030 = x60606060 > x00EE) in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): File structure corrupted in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Invalid JPEG file in %sbug76557.php on line %d
+int(1)
+DONE
@@ -142,23 +142,23 @@ Warning: exif_imagetype(0.5): failed to open stream: No such file or directory i
 bool(false)
 -- Iteration 10 --

-Warning: exif_imagetype() expects parameter 1 to be string, array given in %s on line %d
+Warning: exif_imagetype() expects parameter 1 to be a valid path, array given in %s on line %d
 NULL
 -- Iteration 11 --

-Warning: exif_imagetype() expects parameter 1 to be string, array given in %s on line %d
+Warning: exif_imagetype() expects parameter 1 to be a valid path, array given in %s on line %d
 NULL
 -- Iteration 12 --

-Warning: exif_imagetype() expects parameter 1 to be string, array given in %s on line %d
+Warning: exif_imagetype() expects parameter 1 to be a valid path, array given in %s on line %d
 NULL
 -- Iteration 13 --

-Warning: exif_imagetype() expects parameter 1 to be string, array given in %s on line %d
+Warning: exif_imagetype() expects parameter 1 to be a valid path, array given in %s on line %d
 NULL
 -- Iteration 14 --

-Warning: exif_imagetype() expects parameter 1 to be string, array given in %s on line %d
+Warning: exif_imagetype() expects parameter 1 to be a valid path, array given in %s on line %d
 NULL
 -- Iteration 15 --

@@ -198,7 +198,7 @@ Warning: exif_imagetype(obj'ct): failed to open stream: No such file or director
 bool(false)
 -- Iteration 24 --

-Warning: exif_imagetype() expects parameter 1 to be string, resource given in %s on line %d
+Warning: exif_imagetype() expects parameter 1 to be a valid path, resource given in %s on line %d
 NULL
 -- Iteration 25 --

@@ -5175,7 +5175,7 @@ PHP_FUNCTION(imagescale)
 	gdImagePtr im_scaled = NULL;
 	int new_width, new_height;
 	long tmp_w, tmp_h=-1, tmp_m = GD_BILINEAR_FIXED;
-	gdInterpolationMethod method;
+	gdInterpolationMethod method, old_method;

 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rl|ll", &IM, &tmp_w, &tmp_h, &tmp_m) == FAILURE)  {
 		return;
@@ -5202,9 +5202,12 @@ PHP_FUNCTION(imagescale)
 	new_width = tmp_w;
 	new_height = tmp_h;

+	/* gdImageGetInterpolationMethod() is only available as of GD 2.1.1 */
+	old_method = im->interpolation_id;
 	if (gdImageSetInterpolationMethod(im, method)) {
 		im_scaled = gdImageScale(im, new_width, new_height);
 	}
+	gdImageSetInterpolationMethod(im, old_method);

 	if (im_scaled == NULL) {
 		RETURN_FALSE;
@@ -61,6 +61,16 @@ static int _php_image_stream_putbuf(struct gdIOCtx *ctx, const void* buf, int l)
 }

 static void _php_image_stream_ctxfree(struct gdIOCtx *ctx)
+{
+	if(ctx->data) {
+		ctx->data = NULL;
+	}
+	if(ctx) {
+		efree(ctx);
+	}
+} /* }}} */
+
+static void _php_image_stream_ctxfreeandclose(struct gdIOCtx *ctx) /* {{{ */
 {
 	TSRMLS_FETCH();

@@ -87,6 +97,7 @@ static void _php_image_output_ctx(INTERNAL_FUNCTION_PARAMETERS, int image_type,
 	gdIOCtx *ctx = NULL;
 	zval *to_zval = NULL;
 	php_stream *stream;
+	int close_stream = 1;

 	/* The third (quality) parameter for Wbmp stands for the threshold when called from image2wbmp().
 	 * The third (quality) parameter for Wbmp and Xbm stands for the foreground color index when called
@@ -123,6 +134,7 @@ static void _php_image_output_ctx(INTERNAL_FUNCTION_PARAMETERS, int image_type,
 			if (stream == NULL) {
 				RETURN_FALSE;
 			}
+			close_stream = 0;
 		} else if (Z_TYPE_P(to_zval) == IS_STRING) {
 			if (CHECK_ZVAL_NULL_PATH(to_zval)) {
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid 2nd parameter, filename must not contain null bytes");
@@ -159,7 +171,11 @@ static void _php_image_output_ctx(INTERNAL_FUNCTION_PARAMETERS, int image_type,
 		ctx = emalloc(sizeof(gdIOCtx));
 		ctx->putC = _php_image_stream_putc;
 		ctx->putBuf = _php_image_stream_putbuf;
-		ctx->gd_free = _php_image_stream_ctxfree;
+		if (close_stream) {
+			ctx->gd_free = _php_image_stream_ctxfreeandclose;
+		} else {
+			ctx->gd_free = _php_image_stream_ctxfree;
+		}
 		ctx->data = (void *)stream;
 	}

@@ -1117,7 +1117,7 @@ void gdImageLine (gdImagePtr im, int x1, int y1, int x2, int y2, int color)
 	}

 	/* 2.0.10: Nick Atty: clip to edges of drawing rectangle, return if no points need to be drawn */
-	if (!clip_1d(&x1,&y1,&x2,&y2,gdImageSX(im)) || !clip_1d(&y1,&x1,&y2,&x2,gdImageSY(im))) {
+	if (!clip_1d(&x1,&y1,&x2,&y2,gdImageSX(im)-1) || !clip_1d(&y1,&x1,&y2,&x2,gdImageSY(im)-1)) {
 		return;
 	}

@@ -1298,58 +1298,13 @@ inline static void gdImageSetAAPixelColor(gdImagePtr im, int x, int y, int color
 void gdImageAALine (gdImagePtr im, int x1, int y1, int x2, int y2, int col)
 {
 	/* keep them as 32bits */
-	long x, y, inc;
+	long x, y, inc, frac;
 	long dx, dy,tmp;

-	if (y1 < 0 && y2 < 0) {
+	/* 2.0.10: Nick Atty: clip to edges of drawing rectangle, return if no points need to be drawn */
+	if (!clip_1d(&x1,&y1,&x2,&y2,gdImageSX(im)-1) || !clip_1d(&y1,&x1,&y2,&x2,gdImageSY(im)-1)) {
 		return;
 	}
-	if (y1 < 0) {
-		x1 += (y1 * (x1 - x2)) / (y2 - y1);
-		y1 = 0;
-	}
-	if (y2 < 0) {
-		x2 += (y2 * (x1 - x2)) / (y2 - y1);
-		y2 = 0;
-	}
-
-	/* bottom edge */
-	if (y1 >= im->sy && y2 >= im->sy) {
-		return;
-	}
-	if (y1 >= im->sy) {
-		x1 -= ((im->sy - y1) * (x1 - x2)) / (y2 - y1);
-		y1 = im->sy - 1;
-	}
-	if (y2 >= im->sy) {
-		x2 -= ((im->sy - y2) * (x1 - x2)) / (y2 - y1);
-		y2 = im->sy - 1;
-	}
-
-	/* left edge */
-	if (x1 < 0 && x2 < 0) {
-		return;
-	}
-	if (x1 < 0) {
-		y1 += (x1 * (y1 - y2)) / (x2 - x1);
-		x1 = 0;
-	}
-	if (x2 < 0) {
-		y2 += (x2 * (y1 - y2)) / (x2 - x1);
-		x2 = 0;
-	}
-	/* right edge */
-	if (x1 >= im->sx && x2 >= im->sx) {
-		return;
-	}
-	if (x1 >= im->sx) {
-		y1 -= ((im->sx - x1) * (y1 - y2)) / (x2 - x1);
-		x1 = im->sx - 1;
-	}
-	if (x2 >= im->sx) {
-		y2 -= ((im->sx - x2) * (y1 - y2)) / (x2 - x1);
-		x2 = im->sx - 1;
-	}

 	dx = x2 - x1;
 	dy = y2 - y1;
@@ -1368,16 +1323,22 @@ void gdImageAALine (gdImagePtr im, int x1, int y1, int x2, int y2, int col)
 			dx = x2 - x1;
 			dy = y2 - y1;
 		}
-		x = x1 << 16;
-		y = y1 << 16;
+		y = y1;
 		inc = (dy * 65536) / dx;
-		while ((x >> 16) <= x2) {
-			gdImageSetAAPixelColor(im, x >> 16, y >> 16, col, (y >> 8) & 0xFF);
-			if ((y >> 16) + 1 < im->sy) {
-				gdImageSetAAPixelColor(im, x >> 16, (y >> 16) + 1,col, (~y >> 8) & 0xFF);
+		frac = 0;
+		for (x = x1; x <= x2; x++) {
+			gdImageSetAAPixelColor(im, x, y, col, (frac >> 8) & 0xFF);
+			if (y + 1 < im->sy) {
+				gdImageSetAAPixelColor(im, x, y + 1, col, (~frac >> 8) & 0xFF);
+			}
+			frac += inc;
+			if (frac >= 65536) {
+				frac -= 65536;
+				y++;
+			} else if (frac < 0) {
+				frac += 65536;
+				y--;
 			}
-			x += (1 << 16);
-			y += inc;
 		}
 	} else {
 		if (dy < 0) {
@@ -1390,16 +1351,22 @@ void gdImageAALine (gdImagePtr im, int x1, int y1, int x2, int y2, int col)
 			dx = x2 - x1;
 			dy = y2 - y1;
 		}
-		x = x1 << 16;
-		y = y1 << 16;
+		x = x1;
 		inc = (dx * 65536) / dy;
-		while ((y>>16) <= y2) {
-			gdImageSetAAPixelColor(im, x >> 16, y >> 16, col, (x >> 8) & 0xFF);
-			if ((x >> 16) + 1 < im->sx) {
-				gdImageSetAAPixelColor(im, (x >> 16) + 1, (y >> 16),col, (~x >> 8) & 0xFF);
+		frac = 0;
+		for (y = y1; y <= y2; y++) {
+			gdImageSetAAPixelColor(im, x, y, col, (frac >> 8) & 0xFF);
+			if (x + 1 < im->sx) {
+				gdImageSetAAPixelColor(im, x + 1, y, col, (~frac >> 8) & 0xFF);
+			}
+			frac += inc;
+			if (frac >= 65536) {
+				frac -= 65536;
+				x++;
+			} else if (frac < 0) {
+				frac += 65536;
+				x--;
 			}
-			x += inc;
-			y += (1<<16);
 		}
 	}
 }
@@ -1780,7 +1747,7 @@ void gdImageFillToBorder (gdImagePtr im, int x, int y, int border, int color)
 	int leftLimit = -1, rightLimit;
 	int i, restoreAlphaBlending = 0;

-	if (border < 0) {
+	if (border < 0 || color < 0) {
 		/* Refuse to fill to a non-solid border */
 		return;
 	}
@@ -33,8 +33,8 @@ int gdImageColorMatch (gdImagePtr im1, gdImagePtr im2)
 		return -4; /* At least 1 color must be allocated */
 	}

-	buf = (unsigned long *)safe_emalloc(sizeof(unsigned long), 5 * im2->colorsTotal, 0);
-	memset( buf, 0, sizeof(unsigned long) * 5 * im2->colorsTotal );
+	buf = (unsigned long *)safe_emalloc(sizeof(unsigned long), 5 * gdMaxColors, 0);
+	memset( buf, 0, sizeof(unsigned long) * 5 * gdMaxColors );

 	for (x=0; x<im1->sx; x++) {
 		for( y=0; y<im1->sy; y++ ) {
@@ -243,6 +243,10 @@ gdImagePtr gdImageCropThreshold(gdImagePtr im, const unsigned int color, const f
 		return NULL;
 	}

+	if (!gdImageTrueColor(im) && color >= gdImageColorsTotal(im)) {
+		return NULL;
+	}
+
 	/* TODO: Add gdImageGetRowPtr and works with ptr at the row level
 	 * for the true color and palette images
 	 * new formats will simply work with ptr
@@ -136,6 +136,10 @@ static int _gd2GetHeader(gdIOCtxPtr in, int *sx, int *sy, int *cs, int *vers, in
 	GD2_DBG(php_gd_error("%d Chunks vertically", *ncy));

 	if (gd2_compressed(*fmt)) {
+		if (*ncx <= 0 || *ncy <= 0 || *ncx > INT_MAX / *ncy) {
+			GD2_DBG(printf ("Illegal chunk counts: %d * %d\n", *ncx, *ncy));
+			goto fail1;
+		}
 		nc = (*ncx) * (*ncy);
 		GD2_DBG(php_gd_error("Reading %d chunk index entries", nc));
 		if (overflow2(sizeof(t_chunk_info), nc)) {
@@ -340,12 +344,16 @@ gdImagePtr gdImageCreateFromGd2Ctx (gdIOCtxPtr in)
 					for (x = xlo; x < xhi; x++) {
 						if (im->trueColor) {
 							if (!gdGetInt(&im->tpixels[y][x], in)) {
-								im->tpixels[y][x] = 0;
+								php_gd_error("gd2: EOF while reading\n");
+								gdImageDestroy(im);
+								return NULL;
 							}
 						} else {
 							int ch;
 							if (!gdGetByte(&ch, in)) {
-								ch = 0;
+								php_gd_error("gd2: EOF while reading\n");
+								gdImageDestroy(im);
+								return NULL;
 							}
 							im->pixels[y][x] = ch;
 						}
@@ -147,6 +147,9 @@ gdImagePtr gdImageCreateFromGifCtx(gdIOCtxPtr fd) /* {{{ */
 	int haveGlobalColormap;
 	gdImagePtr im = 0;

+	memset(ColorMap, 0, 3 * MAXCOLORMAPSIZE);
+	memset(localColorMap, 0, 3 * MAXCOLORMAPSIZE);
+
 	/*1.4//imageNumber = 1; */
 	if (! ReadOK(fd,buf,6)) {
 		return 0;
@@ -258,10 +261,6 @@ terminated:
 	if (!im) {
 		return 0;
 	}
-	if (!im->colorsTotal) {
-		gdImageDestroy(im);
-		return 0;
-	}
 	/* Check for open colors at the end, so
 	   we can reduce colorsTotal and ultimately
 	   BitsPerPixel */
@@ -272,6 +271,10 @@ terminated:
 			break;
 		}
 	}
+	if (!im->colorsTotal) {
+		gdImageDestroy(im);
+		return 0;
+	}
 	return im;
 }
 /* }}} */
@@ -372,7 +375,7 @@ static int
 GetCode_(gdIOCtx *fd, CODE_STATIC_DATA *scd, int code_size, int flag, int *ZeroDataBlockP)
 {
 	int           i, j, ret;
-	unsigned char count;
+	int           count;

 	if (flag) {
 		scd->curbit = 0;
@@ -880,8 +880,13 @@ static inline LineContribType * _gdContributionsAlloc(unsigned int line_length,
 {
 	unsigned int u = 0;
 	LineContribType *res;
-	int overflow_error = 0;
+	size_t weights_size;

+	if (overflow2(windows_size, sizeof(double))) {
+		return NULL;
+	} else {
+		weights_size = windows_size * sizeof(double);
+	}
 	res = (LineContribType *) gdMalloc(sizeof(LineContribType));
 	if (!res) {
 		return NULL;
@@ -898,15 +903,10 @@ static inline LineContribType * _gdContributionsAlloc(unsigned int line_length,
 		return NULL;
 	}
 	for (u = 0 ; u < line_length ; u++) {
-		if (overflow2(windows_size, sizeof(double))) {
-			overflow_error = 1;
-		} else {
-			res->ContribRow[u].Weights = (double *) gdMalloc(windows_size * sizeof(double));
-		}
-		if (overflow_error == 1 || res->ContribRow[u].Weights == NULL) {
+		res->ContribRow[u].Weights = (double *) gdMalloc(weights_size);
+		if (res->ContribRow[u].Weights == NULL) {
 			unsigned int i;
-			u--;
-			for (i=0;i<=u;i++) {
+			for (i=0;i<u;i++) {
 				gdFree(res->ContribRow[i].Weights);
 			}
 			gdFree(res->ContribRow);
@@ -1331,10 +1331,10 @@ static gdImagePtr gdImageScaleBilinearPalette(gdImagePtr im, const unsigned int
 			f_a4 = gd_itofx(gdTrueColorGetAlpha(pixel4));

 			{
-				const char red = (char) gd_fxtoi(gd_mulfx(f_w1, f_r1) + gd_mulfx(f_w2, f_r2) + gd_mulfx(f_w3, f_r3) + gd_mulfx(f_w4, f_r4));
-				const char green = (char) gd_fxtoi(gd_mulfx(f_w1, f_g1) + gd_mulfx(f_w2, f_g2) + gd_mulfx(f_w3, f_g3) + gd_mulfx(f_w4, f_g4));
-				const char blue = (char) gd_fxtoi(gd_mulfx(f_w1, f_b1) + gd_mulfx(f_w2, f_b2) + gd_mulfx(f_w3, f_b3) + gd_mulfx(f_w4, f_b4));
-				const char alpha = (char) gd_fxtoi(gd_mulfx(f_w1, f_a1) + gd_mulfx(f_w2, f_a2) + gd_mulfx(f_w3, f_a3) + gd_mulfx(f_w4, f_a4));
+				const unsigned char red = (unsigned char) gd_fxtoi(gd_mulfx(f_w1, f_r1) + gd_mulfx(f_w2, f_r2) + gd_mulfx(f_w3, f_r3) + gd_mulfx(f_w4, f_r4));
+				const unsigned char green = (unsigned char) gd_fxtoi(gd_mulfx(f_w1, f_g1) + gd_mulfx(f_w2, f_g2) + gd_mulfx(f_w3, f_g3) + gd_mulfx(f_w4, f_g4));
+				const unsigned char blue = (unsigned char) gd_fxtoi(gd_mulfx(f_w1, f_b1) + gd_mulfx(f_w2, f_b2) + gd_mulfx(f_w3, f_b3) + gd_mulfx(f_w4, f_b4));
+				const unsigned char alpha = (unsigned char) gd_fxtoi(gd_mulfx(f_w1, f_a1) + gd_mulfx(f_w2, f_a2) + gd_mulfx(f_w3, f_a3) + gd_mulfx(f_w4, f_a4));

 				new_img->tpixels[dst_offset_v][dst_offset_h] = gdTrueColorAlpha(red, green, blue, alpha);
 			}
@@ -237,7 +237,7 @@ static int dynamicGetbuf (gdIOCtxPtr ctx, void *buf, int len)
 	if (remain >= len) {
 		rlen = len;
 	} else {
-		if (remain == 0) {
+		if (remain <= 0) {
 			return EOF;
 		}
 		rlen = remain;
@@ -0,0 +1,19 @@
+--TEST--
+Bug #72482 (Ilegal write/read access caused by gdImageAALine overflow)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$img = imagecreatetruecolor(13, 1007);
+imageantialias($img, true);
+imageline($img, 0, 0, 1073745919, 1073745919, 4096);
+
+$img = imagecreatetruecolor(100, 100);
+imageantialias($img, true);
+imageline($img, 1094795585, 0, 2147483647, 255, 0xff);
+?>
+===DONE===
+--EXPECT--
+===DONE===
@@ -0,0 +1,21 @@
+--TEST--
+Bug 72482 (Ilegal write/read access caused by gdImageAALine overflow)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+require_once __DIR__ . DIRECTORY_SEPARATOR . 'func.inc';
+
+$im = imagecreatetruecolor(10, 10);
+imagefilledrectangle($im, 0, 0, 9, 9, imagecolorallocate($im, 255, 255, 255));
+imageantialias($im, true);
+imageline($im, 0, 0, 10, 10, imagecolorallocate($im, 0, 0, 0));
+
+test_image_equals_file(__DIR__ . DIRECTORY_SEPARATOR . 'bug72482_2.png', $im);
+?>
+===DONE===
+--EXPECT--
+The images are equal.
+===DONE===
@@ -0,0 +1,15 @@
+--TEST--
+Bug #72494 (imagecropauto out-of-bounds access)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$im = imagecreate(10,10);
+imagecropauto($im, IMG_CROP_THRESHOLD, 0, 1337);
+?>
+===DONE===
+--EXPECTF--
+Warning: imagecropauto(): Color argument missing with threshold mode in %s on line %d
+===DONE===
@@ -0,0 +1,14 @@
+--TEST--
+Bug #72696 (imagefilltoborder stackoverflow on truecolor images)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$im = imagecreatetruecolor(10, 10);
+imagefilltoborder($im, 0, 0, 1, -2);
+?>
+===DONE===
+--EXPECT--
+===DONE===
@@ -0,0 +1,22 @@
+--TEST--
+Bug #73213 (Integer overflow in imageline() with antialiasing)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+require_once __DIR__ . DIRECTORY_SEPARATOR . 'func.inc';
+
+$im = imagecreatetruecolor(32768, 1);
+$black = imagecolorallocate($im, 0, 0, 0);
+imageantialias($im, true);
+
+imageline($im, 0,0, 32767,0, $black);
+
+test_image_equals_file(__DIR__ . DIRECTORY_SEPARATOR . 'bug73213.png', $im);
+?>
+===DONE===
+--EXPECT--
+The images are equal.
+===DONE===
@@ -0,0 +1,24 @@
+--TEST--
+Bug #73272 (imagescale() is not affected by, but affects imagesetinterpolation())
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+require_once __DIR__ . DIRECTORY_SEPARATOR . 'func.inc';
+
+$src = imagecreatetruecolor(100, 100);
+imagefilledrectangle($src, 0,0, 99,99, 0xFFFFFF);
+imageellipse($src, 49,49, 40,40, 0x000000);
+
+imagesetinterpolation($src, IMG_NEAREST_NEIGHBOUR);
+imagescale($src, 200, 200, IMG_BILINEAR_FIXED);
+$dst = imagerotate($src, 60, 0xFFFFFF);
+
+test_image_equals_file(__DIR__ . DIRECTORY_SEPARATOR . 'bug73272.png', $dst);
+?>
+===DONE===
+--EXPECT--
+The images are equal.
+===DONE===
@@ -0,0 +1,20 @@
+--TEST--
+Bug #73279 (Integer overflow in gdImageScaleBilinearPalette())
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.4', '<')) {
+    die('skip only for bundled libgd or external libgd >= 2.2.4');
+}
+?>
+--FILE--
+<?php
+$src = imagecreate(100, 100);
+imagecolorallocate($src, 255, 255, 255);
+$dst = imagescale($src, 200, 200, IMG_BILINEAR_FIXED);
+printf("color: %x\n", imagecolorat($dst, 99, 99));
+?>
+===DONE===
+--EXPECT--
+color: ffffff
+===DONE===
@@ -0,0 +1,22 @@
+--TEST--
+Bug #73279 (Integer overflow in gdImageScaleBilinearPalette())
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (GD_BUNDLED || version_compare(GD_VERSION, '2.2.4', '>=')) {
+    die('skip only for external libgd < 2.2.4');
+}
+?>
+--FILE--
+<?php
+$src = imagecreate(100, 100);
+imagecolorallocate($src, 255, 255, 255);
+$dst = imagescale($src, 200, 200, IMG_BILINEAR_FIXED);
+printf("color: %x\n", imagecolorat($dst, 99, 99));
+?>
+===DONE===
+--XFAIL--
+Bug #330 has not yet been fixed
+--EXPECT--
+color: ffffff
+===DONE===
@@ -0,0 +1,22 @@
+--TEST--
+Bug #73549 (Use after free when stream is passed to imagepng)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$stream = fopen(__DIR__ . DIRECTORY_SEPARATOR . 'bug73549.png', 'w');
+$im = imagecreatetruecolor(8, 8);
+var_dump(imagepng($im, $stream));
+var_dump($stream);
+?>
+===DONE===
+--EXPECTF--
+bool(true)
+resource(%d) of type (stream)
+===DONE===
+--CLEAN--
+<?php
+unlink(__DIR__ . DIRECTORY_SEPARATOR . 'bug73549.png');
+?>
@@ -0,0 +1,18 @@
+--TEST--
+Bug 73868 (DOS vulnerability in gdImageCreateFromGd2Ctx())
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+var_dump(imagecreatefromgd2(__DIR__ . DIRECTORY_SEPARATOR . 'bug73868.gd2'));
+?>
+===DONE===
+--EXPECTF--
+Warning: imagecreatefromgd2(): gd2: EOF while reading
+ in %s on line %d
+
+Warning: imagecreatefromgd2(): '%s' is not a valid GD2 file in %s on line %d
+bool(false)
+===DONE===
@@ -0,0 +1,19 @@
+--TEST--
+Bug #73869 (Signed Integer Overflow gd_io.c)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+var_dump(imagecreatefromgd2(__DIR__ . DIRECTORY_SEPARATOR . 'bug73869a.gd2'));
+var_dump(imagecreatefromgd2(__DIR__ . DIRECTORY_SEPARATOR . 'bug73869b.gd2'));
+?>
+===DONE===
+--EXPECTF--
+Warning: imagecreatefromgd2(): '%s' is not a valid GD2 file in %s on line %d
+bool(false)
+
+Warning: imagecreatefromgd2(): '%s' is not a valid GD2 file in %s on line %d
+bool(false)
+===DONE===
@@ -0,0 +1,27 @@
+--TEST--
+Bug #74435 (Buffer over-read into uninitialized memory)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$im = imagecreatefromgif(__DIR__ . DIRECTORY_SEPARATOR . 'bug74435.gif');
+var_dump($im);
+$width = imagesx($im);
+$height = imagesy($im);
+for ($i = 0; $i < $width; $i += 16) {
+    for ($j = 0; $j < $height; $j += 16) {
+        if (($index = imagecolorat($im, $i, $j)) >= 2) {
+            list($red, $green, $blue, $alpha) = array_values(imagecolorsforindex($im, $index));
+            if ($red !== 0 || $green !== 0 || $blue !== 0 || $alpha !== 0) {
+                echo "unexpected color at ($i, $j)\n";
+            }
+        }
+    }
+}
+?>
+===DONE===
+--EXPECTF--
+resource(%d) of type (gd)
+===DONE===
@@ -0,0 +1,15 @@
+--TEST--
+Bug #75571 (Infinite loop in GIF reading causing DoS)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+var_dump(imagecreatefromgif(__DIR__ . '/bug75571.gif'));
+?>
+===DONE===
+--EXPECTF--
+Warning: imagecreatefromgif(): '%s' is not a valid GIF file in %s on line %d
+bool(false)
+===DONE===
@@ -0,0 +1,21 @@
+--TEST--
+Bug #77269 (Potential unsigned underflow in gdImageScale)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (getenv("SKIP_SLOW_TESTS")) die("skip slow test");
+?>
+--INI--
+memory_limit=2G
+--FILE--
+<?php
+$im = imagecreate(2**28, 1);
+if(is_resource($im)) {
+	imagescale($im, 1, 1, IMG_TRIANGLE);
+}
+?>
+===DONE===
+--EXPECTF--
+Warning: imagecreate():%S product of memory allocation multiplication would exceed INT_MAX, failing operation gracefully
+ in %s on line %d
+===DONE===
@@ -0,0 +1,18 @@
+--TEST--
+Bug #77270 (imagecolormatch Out Of Bounds Write on Heap)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.5', '<=')) die('skip upstream bugfix has not been released');
+?>
+--FILE--
+<?php
+$img1 = imagecreatetruecolor(0xfff, 0xfff);
+$img2 = imagecreate(0xfff, 0xfff);
+imagecolorallocate($img2, 0, 0, 0);
+imagesetpixel($img2, 0, 0, 255);
+imagecolormatch($img1, $img2);
+?>
+===DONE===
+--EXPECT--
+===DONE===
@@ -4,6 +4,7 @@ Font charmap order is deterministic based on order in the font, use the selected
 <?php
 	if(!extension_loaded('gd')){ die('skip gd extension not available'); }
 	if(!function_exists('imagettftext')) die('skip imagettftext() not available');
+  if(gd_info()['JIS-mapped Japanese Font Support']) die('skip JIS-mapped Japanese Font Support not supported');
 ?>
 --FILE--
 <?php
@@ -2491,7 +2491,7 @@ PHP_NAMED_FUNCTION(php_if_iconv)
 		&out_buffer, &out_len, out_charset, in_charset);
 	_php_iconv_show_error(err, out_charset, in_charset TSRMLS_CC);
 	if (err == PHP_ICONV_ERR_SUCCESS && out_buffer != NULL) {
-		RETVAL_STRINGL(out_buffer, out_len, 0);
+		RETVAL_STRINGL_CHECK(out_buffer, out_len, 0);
 	} else {
 		if (out_buffer != NULL) {
 			efree(out_buffer);
@@ -2672,6 +2672,9 @@ static int php_iconv_stream_filter_append_bucket(
 								tcnt = 0;
 								break;
 							}
+						} else {
+						    php_error_docref(NULL TSRMLS_CC, E_WARNING, "iconv stream filter (\"%s\"=>\"%s\"): invalid multibyte sequence", self->from_charset, self->to_charset);
+						    goto out_failure;
 						}
 						break;

@@ -0,0 +1,20 @@
+--TEST--
+Bug #76249 (stream filter convert.iconv leads to infinite loop on invalid sequence)
+--SKIPIF--
+<?php extension_loaded('iconv') or die('skip iconv extension is not available'); ?>
+--FILE--
+<?php
+$fh = fopen('php://memory', 'rw');
+fwrite($fh, "abc");
+rewind($fh);
+if (false === @stream_filter_append($fh, 'convert.iconv.ucs-2/utf8//IGNORE', STREAM_FILTER_READ, [])) {
+	stream_filter_append($fh, 'convert.iconv.ucs-2/utf-8//IGNORE', STREAM_FILTER_READ, []);
+}
+$a = stream_get_contents($fh);
+var_dump(strlen($a));
+?>
+DONE
+--EXPECTF--
+Warning: stream_get_contents(): iconv stream filter ("ucs-2"=>"utf%A8//IGNORE"): invalid multibyte sequence in %sbug76249.php on line %d
+int(3)
+DONE
@@ -562,6 +562,15 @@ static const zend_module_dep imap_deps[] = {
 };
 /* }}} */

+
+/* {{{ PHP_INI
+ */
+PHP_INI_BEGIN()
+STD_PHP_INI_BOOLEAN("imap.enable_insecure_rsh", "0", PHP_INI_SYSTEM, OnUpdateBool, enable_rsh, zend_imap_globals, imap_globals)
+PHP_INI_END()
+/* }}} */
+
+
 /* {{{ imap_module_entry
 */
 zend_module_entry imap_module_entry = {
@@ -835,6 +844,8 @@ PHP_MINIT_FUNCTION(imap)
 {
 	unsigned long sa_all =	SA_MESSAGES | SA_RECENT | SA_UNSEEN | SA_UIDNEXT | SA_UIDVALIDITY;

+	REGISTER_INI_ENTRIES();
+
 #ifndef PHP_WIN32
 	mail_link(&unixdriver);		/* link in the unix driver */
 	mail_link(&mhdriver);		/* link in the mh driver */
@@ -1052,6 +1063,12 @@ PHP_MINIT_FUNCTION(imap)
 	GC_TEXTS               texts
 	*/

+	if (!IMAPG(enable_rsh)) {
+		/* disable SSH and RSH, see https://bugs.php.net/bug.php?id=77153 */
+		mail_parameters (NIL, SET_RSHTIMEOUT, 0);
+		mail_parameters (NIL, SET_SSHTIMEOUT, 0);
+	}
+
 	le_imap = zend_register_list_destructors_ex(mail_close_it, NULL, "imap", module_number);
 	return SUCCESS;
 }
@@ -1138,6 +1155,8 @@ PHP_MINFO_FUNCTION(imap)
 	php_info_print_table_row(2, "Kerberos Support", "enabled");
 #endif
 	php_info_print_table_end();
+
+	DISPLAY_INI_ENTRIES();
 }
 /* }}} */

@@ -2523,7 +2542,7 @@ PHP_FUNCTION(imap_8bit)
 		RETURN_FALSE;
 	}

-	RETVAL_STRINGL(decode, newlength, 1);
+	RETVAL_STRINGL_CHECK(decode, newlength, 1);
 	fs_give((void**) &decode);
 }
 /* }}} */
@@ -3900,7 +3919,7 @@ int _php_imap_mail(char *to, char *subject, char *message, char *headers, char *
 	char *tsm_errmsg = NULL;
 	ADDRESS *addr;
 	char *bufferTo = NULL, *bufferCc = NULL, *bufferBcc = NULL, *bufferHeader = NULL;
-	int offset, bufferLen = 0;
+	size_t offset, bufferLen = 0;
 	size_t bt_len;

 	if (headers) {
@@ -3916,7 +3935,7 @@ int _php_imap_mail(char *to, char *subject, char *message, char *headers, char *
 #define PHP_IMAP_CLEAN	if (bufferTo) efree(bufferTo); if (bufferCc) efree(bufferCc); if (bufferBcc) efree(bufferBcc); if (bufferHeader) efree(bufferHeader);
 #define PHP_IMAP_BAD_DEST PHP_IMAP_CLEAN; efree(tempMailTo); return (BAD_MSG_DESTINATION);

-	bufferHeader = (char *)emalloc(bufferLen + 1);
+	bufferHeader = (char *)safe_emalloc(bufferLen, 1, 1);
 	memset(bufferHeader, 0, bufferLen);
 	if (to && *to) {
 		strlcat(bufferHeader, "To: ", bufferLen + 1);
@@ -4075,7 +4094,6 @@ PHP_FUNCTION(imap_mail)
 	if (!message_len) {
 		/* this is not really an error, so it is allowed. */
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "No message string in mail command");
-		message = NULL;
 	}

 	if (_php_imap_mail(to, subject, message, headers, cc, bcc, rpath TSRMLS_CC)) {
@@ -214,6 +214,7 @@ ZEND_BEGIN_MODULE_GLOBALS(imap)
 #endif
 	/* php_stream for php_mail_gets() */
 	php_stream *gets_stream;
+	zend_bool enable_rsh;
 ZEND_END_MODULE_GLOBALS(imap)

 #ifdef ZTS
@@ -0,0 +1,15 @@
+--TEST--
+Bug #77020 (null pointer dereference in imap_mail)
+--SKIPIF--
+<?php
+if (!extension_loaded('imap')) die('skip imap extension not available');
+?>
+--FILE--
+<?php
+imap_mail('1', 1, NULL);
+?>
+===DONE===
+--EXPECTF--
+Warning: imap_mail(): No message string in mail command in %s on line %d
+%s
+===DONE===
@@ -0,0 +1,24 @@
+--TEST--                                 
+Bug #77153 (imap_open allows to run arbitrary shell commands via mailbox parameter)
+--SKIPIF--
+<?php
+        if (!extension_loaded("imap")) { 
+                die("skip imap extension not available");  
+        }
+?>
+--FILE--
+<?php
+$payload = "echo 'BUG'> " . __DIR__ . '/__bug';
+$payloadb64 = base64_encode($payload);
+$server = "x -oProxyCommand=echo\t$payloadb64|base64\t-d|sh}";
+@imap_open('{'.$server.':143/imap}INBOX', '', '');
+// clean
+imap_errors();
+var_dump(file_exists(__DIR__ . '/__bug'));
+?>
+--EXPECT--
+bool(false)
+--CLEAN--
+<?php
+if(file_exists(__DIR__ . '/__bug')) unlink(__DIR__ . '/__bug');
+?>
@@ -182,7 +182,7 @@ static void _breakiterator_parts_move_forward(zend_object_iterator *iter TSRMLS_
 	}
 	assert(next <= slen && next >= cur);
 	len = next - cur;
-	res = static_cast<char*>(emalloc(len + 1));
+	res = static_cast<char*>(safe_emalloc(len, 1, 1));

 	memcpy(res, &s[cur], len);
 	res[len] = '\0';
@@ -16,7 +16,7 @@
 */

 #ifndef COLLATOR_COLLATOR_H
-#define CCOLLATOR_COLLATOR_H
+#define COLLATOR_COLLATOR_H

 #include <php.h>

@@ -702,8 +702,10 @@ PHP_FUNCTION(grapheme_stristr)
 static inline int32_t
 grapheme_extract_charcount_iter(UBreakIterator *bi, int32_t csize, unsigned char *pstr, int32_t str_len)
 {
-	int pos = 0, prev_pos = 0;
-	int ret_pos = 0, prev_ret_pos = 0;
+	int pos = 0;
+	int ret_pos = 0;
+	int break_pos, prev_break_pos;
+	int count = 0;

 	while ( 1 ) {
 		pos = ubrk_next(bi);
@@ -712,23 +714,24 @@ grapheme_extract_charcount_iter(UBreakIterator *bi, int32_t csize, unsigned char
 			break;
 		}

+		for ( break_pos = ret_pos; break_pos < pos; ) {
+			count++;
+			prev_break_pos = break_pos;
+			U8_FWD_1(pstr, break_pos, str_len);
+
+			if ( prev_break_pos == break_pos ) {
+				/* something wrong - malformed utf8? */
+				csize = 0;
+				break;
+			}
+		}
+
 		/* if we are beyond our limit, then the loop is done */
-		if ( pos > csize ) {
+		if ( count > csize ) {
 			break;
 		}

-		/* update our pointer in the original UTF-8 buffer by as many characters
-		   as ubrk_next iterated over */
-
-		prev_ret_pos = ret_pos;
-		U8_FWD_N(pstr, ret_pos, str_len, pos - prev_pos);
-
-		if ( prev_ret_pos == ret_pos ) {
-			/* something wrong - malformed utf8? */
-			break;
-		}
-
-		prev_pos = pos;
+		ret_pos = break_pos;
 	}

 	return ret_pos;
@@ -739,8 +742,8 @@ grapheme_extract_charcount_iter(UBreakIterator *bi, int32_t csize, unsigned char
 static inline int32_t
 grapheme_extract_bytecount_iter(UBreakIterator *bi, int32_t bsize, unsigned char *pstr, int32_t str_len)
 {
-	int pos = 0, prev_pos = 0;
-	int ret_pos = 0, prev_ret_pos = 0;
+	int pos = 0;
+	int ret_pos = 0;

 	while ( 1 ) {
 		pos = ubrk_next(bi);
@@ -749,20 +752,11 @@ grapheme_extract_bytecount_iter(UBreakIterator *bi, int32_t bsize, unsigned char
 			break;
 		}

-		prev_ret_pos = ret_pos;
-		U8_FWD_N(pstr, ret_pos, str_len, pos - prev_pos);
-
-		if ( ret_pos > bsize ) {
-			ret_pos = prev_ret_pos;
+		if ( pos > bsize ) {
 			break;
 		}

-		if ( prev_ret_pos == ret_pos ) {
-			/* something wrong - malformed utf8? */
-			break;
-		}
-
-		prev_pos = pos;
+		ret_pos = pos;
 	}

 	return ret_pos;
@@ -773,7 +767,7 @@ grapheme_extract_bytecount_iter(UBreakIterator *bi, int32_t bsize, unsigned char
 static inline int32_t
 grapheme_extract_count_iter(UBreakIterator *bi, int32_t size, unsigned char *pstr, int32_t str_len)
 {
-	int pos = 0, next_pos = 0;
+	int next_pos = 0;
 	int ret_pos = 0;

 	while ( size ) {
@@ -782,16 +776,10 @@ grapheme_extract_count_iter(UBreakIterator *bi, int32_t size, unsigned char *pst
 		if ( UBRK_DONE == next_pos ) {
 			break;
 		}
-		pos = next_pos;
+		ret_pos = next_pos;
 		size--;
 	}

-	/* pos is one past the last UChar - and represent the number of code units to
-		advance in the utf-8 buffer
-	*/
-
-	U8_FWD_N(pstr, ret_pos, str_len, pos);
-
 	return ret_pos;
 }
 /* }}} */
@@ -810,9 +798,9 @@ static grapheme_extract_iter grapheme_extract_iters[] = {
 	Function to extract a sequence of default grapheme clusters */
 PHP_FUNCTION(grapheme_extract)
 {
-	unsigned char *str, *pstr;
-	UChar *ustr;
-	int str_len, ustr_len;
+	char *str, *pstr;
+	UText ut = UTEXT_INITIALIZER;
+	int str_len;
 	long size; /* maximum number of grapheme clusters, bytes, or characters (based on extract_type) to return */
 	long lstart = 0; /* starting position in str in bytes */
 	int32_t start = 0;
@@ -900,21 +888,15 @@ PHP_FUNCTION(grapheme_extract)
 		RETURN_STRINGL(((char *)pstr), nsize, 1);
 	}

-	/* convert the strings to UTF-16. */
-	ustr = NULL;
-	ustr_len = 0;
 	status = U_ZERO_ERROR;
-	intl_convert_utf8_to_utf16(&ustr, &ustr_len, (char *)pstr, str_len, &status );
+	utext_openUTF8(&ut, pstr, str_len, &status);

 	if ( U_FAILURE( status ) ) {
 		/* Set global error code. */
 		intl_error_set_code( NULL, status TSRMLS_CC );

 		/* Set error messages. */
-		intl_error_set_custom_msg( NULL, "Error converting input string to UTF-16", 0 TSRMLS_CC );
-
-		if ( NULL != ustr )
-			efree( ustr );
+		intl_error_set_custom_msg( NULL, "Error opening UTF-8 text", 0 TSRMLS_CC );

 		RETURN_FALSE;
 	}
@@ -923,8 +905,7 @@ PHP_FUNCTION(grapheme_extract)
 	status = U_ZERO_ERROR;
 	bi = grapheme_get_break_iterator(u_break_iterator_buffer, &status TSRMLS_CC );

-	ubrk_setText(bi, ustr, ustr_len, &status);
-
+	ubrk_setUText(bi, &ut, &status);
 	/* if the caller put us in the middle of a grapheme, we can't detect it in all cases since we
 		can't back up. So, we will not do anything. */

@@ -932,9 +913,7 @@ PHP_FUNCTION(grapheme_extract)

 	ret_pos = (*grapheme_extract_iters[extract_type])(bi, size, pstr, str_len);

-	if (ustr) {
-		efree(ustr);
-	}
+	utext_close(&ut);
 	ubrk_close(bi);

 	if ( NULL != next ) {
@@ -49,7 +49,7 @@ void intl_convert_utf8_to_utf16(
 	UErrorCode* status )
 {
 	UChar*      dst_buf = NULL;
-	int32_t     dst_len = 0;
+	uint32_t    dst_len = 0;

 	/* If *target is NULL determine required destination buffer size (pre-flighting).
 	 * Otherwise, attempt to convert source string; if *target buffer is not large enough
@@ -263,6 +263,9 @@ static char* get_icu_value_internal( const char* loc_name , char* tag_name, int*
 	int32_t     	buflen          = 512;
 	UErrorCode  	status          = U_ZERO_ERROR;

+	if (strlen(loc_name) > INTL_MAX_LOCALE_LEN) {
+		return NULL;
+	}

 	if( strcmp(tag_name, LOC_CANONICALIZE_TAG) != 0 ){
 		/* Handle  grandfathered languages */
@@ -396,6 +399,8 @@ static void get_icu_value_src_php( char* tag_name, INTERNAL_FUNCTION_PARAMETERS)
 		loc_name = intl_locale_get_default(TSRMLS_C);
 	}

+	INTL_CHECK_LOCALE_LEN(strlen(loc_name));
+
 	/* Call ICU get */
 	tag_value = get_icu_value_internal( loc_name , tag_name , &result ,0);

@@ -700,6 +705,8 @@ PHP_FUNCTION( locale_get_keywords )
        RETURN_FALSE;
    }

+	INTL_CHECK_LOCALE_LEN(strlen(loc_name));
+
    if(loc_name_len == 0) {
        loc_name = intl_locale_get_default(TSRMLS_C);
    }
@@ -1107,6 +1114,8 @@ PHP_FUNCTION(locale_parse)
        RETURN_FALSE;
    }

+    INTL_CHECK_LOCALE_LEN(strlen(loc_name));
+
    if(loc_name_len == 0) {
        loc_name = intl_locale_get_default(TSRMLS_C);
    }
@@ -1159,6 +1168,7 @@ PHP_FUNCTION(locale_get_all_variants)
 		loc_name = intl_locale_get_default(TSRMLS_C);
 	}

+	INTL_CHECK_LOCALE_LEN(strlen(loc_name));

 	array_init( return_value );

@@ -1267,6 +1277,9 @@ PHP_FUNCTION(locale_filter_matches)
 		RETURN_TRUE;
 	}

+	INTL_CHECK_LOCALE_LEN(strlen(loc_range));
+	INTL_CHECK_LOCALE_LEN(strlen(lang_tag));
+
 	if( boolCanonical ){
 		/* canonicalize loc_range */
 		can_loc_range=get_icu_value_internal( loc_range , LOC_CANONICALIZE_TAG , &result , 0);
@@ -1549,6 +1562,8 @@ PHP_FUNCTION(locale_lookup)
 		loc_range = intl_locale_get_default(TSRMLS_C);
 	}

+	INTL_CHECK_LOCALE_LEN(strlen(loc_range));
+
 	hash_arr = HASH_OF(arr);

 	if( !hash_arr || zend_hash_num_elements( hash_arr ) == 0 ) {
@@ -80,10 +80,10 @@ msgformat_data* msgformat_data_create( TSRMLS_D )
 /* }}} */

 #ifdef MSG_FORMAT_QUOTE_APOS
-int msgformat_fix_quotes(UChar **spattern, uint32_t *spattern_len, UErrorCode *ec) 
+int msgformat_fix_quotes(UChar **spattern, uint32_t *spattern_len, UErrorCode *ec)
 {
 	if(*spattern && *spattern_len && u_strchr(*spattern, (UChar)'\'')) {
-		UChar *npattern = emalloc(sizeof(UChar)*(2*(*spattern_len)+1));
+		UChar *npattern = safe_emalloc(sizeof(UChar)*2, *spattern_len, sizeof(UChar));
 		uint32_t npattern_len;
 		npattern_len = umsg_autoQuoteApostrophe(*spattern, *spattern_len, npattern, 2*(*spattern_len)+1, ec);
 		efree(*spattern);
@@ -77,7 +77,7 @@ static zend_object_value ResourceBundle_object_create( zend_class_entry *ce TSRM
 /* }}} */

 /* {{{ ResourceBundle_ctor */
-static void resourcebundle_ctor(INTERNAL_FUNCTION_PARAMETERS) 
+static void resourcebundle_ctor(INTERNAL_FUNCTION_PARAMETERS)
 {
 	const char	*bundlename;
 	int			bundlename_len = 0;
@@ -90,7 +90,7 @@ static void resourcebundle_ctor(INTERNAL_FUNCTION_PARAMETERS)

 	intl_error_reset( NULL TSRMLS_CC );

-	if( zend_parse_parameters( ZEND_NUM_ARGS() TSRMLS_CC, "s!s!|b", 
+	if( zend_parse_parameters( ZEND_NUM_ARGS() TSRMLS_CC, "s!s!|b",
 		&locale, &locale_len, &bundlename, &bundlename_len, &fallback ) == FAILURE )
 	{
 		intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR,
@@ -100,11 +100,18 @@ static void resourcebundle_ctor(INTERNAL_FUNCTION_PARAMETERS)
 	}

 	INTL_CHECK_LOCALE_LEN_OBJ(locale_len, return_value);
-	
+
 	if (locale == NULL) {
 		locale = intl_locale_get_default(TSRMLS_C);
 	}

+	if (bundlename_len >= MAXPATHLEN) {
+		intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR,	"Bundle name too long", 0 TSRMLS_CC );
+		zval_dtor(return_value);
+		ZVAL_NULL(return_value);
+		RETURN_NULL();
+	}
+
 	if (fallback) {
 		rb->me = ures_open(bundlename, locale, &INTL_DATA_ERROR_CODE(rb));
 	} else {
@@ -151,7 +158,7 @@ PHP_METHOD( ResourceBundle, __construct )
 /* {{{ proto ResourceBundle ResourceBundle::create( string $locale [, string $bundlename [, bool $fallback = true ]] )
 proto ResourceBundle resourcebundle_create( string $locale [, string $bundlename [, bool $fallback = true ]] )
 */
-PHP_FUNCTION( resourcebundle_create ) 
+PHP_FUNCTION( resourcebundle_create )
 {
 	object_init_ex( return_value, ResourceBundle_ce_ptr );
 	resourcebundle_ctor(INTERNAL_FUNCTION_PARAM_PASSTHRU);
@@ -159,7 +166,7 @@ PHP_FUNCTION( resourcebundle_create )
 /* }}} */

 /* {{{ resourcebundle_array_fetch */
-static void resourcebundle_array_fetch(zval *object, zval *offset, zval *return_value, int fallback TSRMLS_DC) 
+static void resourcebundle_array_fetch(zval *object, zval *offset, zval *return_value, int fallback TSRMLS_DC)
 {
 	int32_t     meindex = 0;
 	char *      mekey = NULL;
@@ -167,7 +174,7 @@ static void resourcebundle_array_fetch(zval *object, zval *offset, zval *return_
 	char         *pbuf;
 	ResourceBundle_object *rb;

-	intl_error_reset( NULL TSRMLS_CC );	
+	intl_error_reset( NULL TSRMLS_CC );
 	RESOURCEBUNDLE_METHOD_FETCH_OBJECT;

 	if(Z_TYPE_P(offset) == IS_LONG) {
@@ -178,12 +185,12 @@ static void resourcebundle_array_fetch(zval *object, zval *offset, zval *return_
 		mekey = Z_STRVAL_P(offset);
 		rb->child = ures_getByKey(rb->me, mekey, rb->child, &INTL_DATA_ERROR_CODE(rb) );
 	} else {
-		intl_errors_set(INTL_DATA_ERROR_P(rb), U_ILLEGAL_ARGUMENT_ERROR,	
+		intl_errors_set(INTL_DATA_ERROR_P(rb), U_ILLEGAL_ARGUMENT_ERROR,
 			"resourcebundle_get: index should be integer or string", 0 TSRMLS_CC);
 		RETURN_NULL();
 	}

-	intl_error_set_code( NULL, INTL_DATA_ERROR_CODE(rb) TSRMLS_CC );	
+	intl_error_set_code( NULL, INTL_DATA_ERROR_CODE(rb) TSRMLS_CC );
 	if (U_FAILURE(INTL_DATA_ERROR_CODE(rb))) {
 		if (is_numeric) {
 			spprintf( &pbuf, 0, "Cannot load resource element %d", meindex );
@@ -213,7 +220,7 @@ static void resourcebundle_array_fetch(zval *object, zval *offset, zval *return_
 /* }}} */

 /* {{{ resourcebundle_array_get */
-zval *resourcebundle_array_get(zval *object, zval *offset, int type TSRMLS_DC) 
+zval *resourcebundle_array_get(zval *object, zval *offset, int type TSRMLS_DC)
 {
 	zval *retval;

@@ -246,7 +253,7 @@ PHP_FUNCTION( resourcebundle_get )
 	zval *      object;

 	if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Oz|b",	&object, ResourceBundle_ce_ptr, &offset, &fallback ) == FAILURE) {
-		intl_error_set(NULL, U_ILLEGAL_ARGUMENT_ERROR,	
+		intl_error_set(NULL, U_ILLEGAL_ARGUMENT_ERROR,
 			"resourcebundle_get: unable to parse input params", 0 TSRMLS_CC);
 		RETURN_FALSE;
 	}
@@ -256,7 +263,7 @@ PHP_FUNCTION( resourcebundle_get )
 /* }}} */

 /* {{{ resourcebundle_array_count */
-int resourcebundle_array_count(zval *object, long *count TSRMLS_DC) 
+int resourcebundle_array_count(zval *object, long *count TSRMLS_DC)
 {
 	ResourceBundle_object *rb;
 	RESOURCEBUNDLE_METHOD_FETCH_OBJECT_NO_CHECK;
@@ -288,7 +295,7 @@ PHP_FUNCTION( resourcebundle_count )
 	RESOURCEBUNDLE_METHOD_INIT_VARS;

 	if( zend_parse_method_parameters( ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "O", &object, ResourceBundle_ce_ptr ) == FAILURE ) {
-		intl_error_set(NULL, U_ILLEGAL_ARGUMENT_ERROR,	
+		intl_error_set(NULL, U_ILLEGAL_ARGUMENT_ERROR,
 			"resourcebundle_count: unable to parse input params", 0 TSRMLS_CC);
 		RETURN_FALSE;
 	}
@@ -322,21 +329,26 @@ PHP_FUNCTION( resourcebundle_locales )

 	if( zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &bundlename, &bundlename_len ) == FAILURE )
 	{
-		intl_error_set(NULL, U_ILLEGAL_ARGUMENT_ERROR,	
+		intl_error_set(NULL, U_ILLEGAL_ARGUMENT_ERROR,
 			"resourcebundle_locales: unable to parse input params", 0 TSRMLS_CC);
 		RETURN_FALSE;
 	}

+	if (bundlename_len >= MAXPATHLEN) {
+		intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR,	"resourcebundle_locales: bundle name too long", 0 TSRMLS_CC );
+		RETURN_FALSE;
+	}
+
 	if(bundlename_len == 0) {
 		// fetch default locales list
 		bundlename = NULL;
 	}

 	icuenum = ures_openAvailableLocales( bundlename, &icuerror );
-	INTL_CHECK_STATUS(icuerror, "Cannot fetch locales list");		
+	INTL_CHECK_STATUS(icuerror, "Cannot fetch locales list");

 	uenum_reset( icuenum, &icuerror );
-	INTL_CHECK_STATUS(icuerror, "Cannot iterate locales list");		
+	INTL_CHECK_STATUS(icuerror, "Cannot iterate locales list");

 	array_init( return_value );
 	while ((entry = uenum_next( icuenum, &entry_len, &icuerror ))) {
@@ -0,0 +1,28 @@
+--TEST--
+Bug #68447: grapheme_extract take an extra trailing character
+--SKIPIF--
+<?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?>
+--FILE--
+<?php
+$katsushikaku = "葛󠄁飾区";
+echo grapheme_extract($katsushikaku, 1) . "\n";
+
+$haiyore = "這󠄀いよれ";
+echo grapheme_extract($haiyore, 1, GRAPHEME_EXTR_COUNT) . "\n";
+echo grapheme_extract($haiyore, 2, GRAPHEME_EXTR_COUNT) . "\n";
+echo grapheme_extract($haiyore, 6, GRAPHEME_EXTR_MAXBYTES) . "\n";
+echo grapheme_extract($haiyore, 9, GRAPHEME_EXTR_MAXBYTES) . "\n";
+echo grapheme_extract($haiyore, 12, GRAPHEME_EXTR_MAXBYTES) . "\n";
+echo grapheme_extract($haiyore, 1, GRAPHEME_EXTR_MAXCHARS) . "\n";
+echo grapheme_extract($haiyore, 2, GRAPHEME_EXTR_MAXCHARS) . "\n";
+echo grapheme_extract($haiyore, 3, GRAPHEME_EXTR_MAXCHARS) . "\n";
+--EXPECT--
+葛󠄁
+這󠄀
+這󠄀い
+
+這󠄀
+這󠄀い
+
+這󠄀
+這󠄀い
@@ -9,6 +9,4 @@ $out = locale_get_primary_language($var1);
 echo strlen($out) . PHP_EOL;
 echo unpack('H*', $out)[1] . PHP_EOL;
 --EXPECT--
-1000
-61616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161
-
+0
@@ -1103,7 +1103,11 @@ PHP_FUNCTION(ldap_get_entries)

 		add_assoc_long(tmp1, "count", num_attrib);
 		dn = ldap_get_dn(ldap, ldap_result_entry);
-		add_assoc_string(tmp1, "dn", dn, 1);
+		if (dn) {
+			add_assoc_string(tmp1, "dn", dn, 1);
+		} else {
+			add_assoc_null(tmp1, "dn");
+		}
 #if (LDAP_API_VERSION > 2000) || HAVE_NSLDAP || HAVE_ORALDAP || WINDOWS
 		ldap_memfree(dn);
 #else
@@ -0,0 +1,40 @@
+--TEST--
+Bug #76248 (Malicious LDAP-Server Response causes Crash)
+--SKIPIF--
+<?php
+require_once('skipif.inc');
+if (!function_exists('pcntl_fork')) die('skip fork not available');
+?>
+--FILE--
+<?php
+$pid = pcntl_fork();
+const PORT = 12345;
+if ($pid == 0) {
+	// child
+    $server = stream_socket_server("tcp://127.0.0.1:12345");
+	$socket = stream_socket_accept($server, 3);
+	fwrite($socket, base64_decode("MAwCAQFhBwoBAAQABAAweQIBAmR0BJljbj1yb290LGRjPWV4YW1wbGUsZGM9Y29tMFcwIwQLb2JqZWN0Q2xhc3MxFAQSb3JnYW5pemF0aW9uYWxSb2xlMAwEAmNuMQYEBHJvb3QwIgQLZGVzY3JpcHRpb24xEwQRRGlyZWN0b3J5IE1hbmFnZXIwDAIBAmUHCgEABAAEADB5AgEDZHQEmWNuPXJvb3QsZGM9ZXhhbXBsZSxkYz1jb20wVzAjBAtvYmplY3RDbGFzczEUBBJvcmdhbml6YXRpb25hbFJvbGUwDAQCY24xBgQEcm9vdDAiBAtkZXNjcmlwdGlvbjETBBFEaXJlY3RvcnkgTWFuYWdlcjAMAgEDZQcKAQAEAAQA"));
+	fflush($socket);	
+} else {
+	// parent
+	$ds = ldap_connect("127.0.0.1", PORT);
+	ldap_set_option($ds, LDAP_OPT_PROTOCOL_VERSION, 3);
+	$b = ldap_bind($ds, "cn=root,dc=example,dc=com", "secret");
+
+	$s = ldap_search($ds, "dc=example,dc=com", "(cn=root)"); 
+	$tt = ldap_get_entries($ds, $s);
+	var_dump($tt);
+}
+?>
+--EXPECT--
+array(2) {
+  ["count"]=>
+  int(1)
+  [0]=>
+  array(2) {
+    ["count"]=>
+    int(0)
+    ["dn"]=>
+    NULL
+  }
+}
@@ -5,7 +5,7 @@
 * LICENSE NOTICES
 *
 * This file is part of "streamable kanji code filter and converter",
- * which is distributed under the terms of GNU Lesser General Public 
+ * which is distributed under the terms of GNU Lesser General Public
 * License (version 2) as published by the Free Software Foundation.
 *
 * This software is distributed in the hope that it will be useful,
@@ -146,6 +146,10 @@ mbfl_memory_device_output(int c, void *data)
 		unsigned char *tmp;

 		newlen = device->length + device->allocsz;
+		if (newlen <= 0) {
+			/* overflow */
+			return -1;
+		}
 		tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char));
 		if (tmp == NULL) {
 			return -1;
@@ -169,6 +173,10 @@ mbfl_memory_device_output2(int c, void *data)
 		unsigned char *tmp;

 		newlen = device->length + device->allocsz;
+		if (newlen <= 0) {
+			/* overflow */
+			return -1;
+		}
 		tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char));
 		if (tmp == NULL) {
 			return -1;
@@ -194,6 +202,10 @@ mbfl_memory_device_output4(int c, void* data)
 		unsigned char *tmp;

 		newlen = device->length + device->allocsz;
+		if (newlen <= 0) {
+			/* overflow */
+			return -1;
+		}
 		tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char));
 		if (tmp == NULL) {
 			return -1;
@@ -227,7 +239,12 @@ mbfl_memory_device_strcat(mbfl_memory_device *device, const char *psrc)
 	if ((device->pos + len) >= device->length) {
 		/* reallocate buffer */
 		int newlen = device->length + (len + MBFL_MEMORY_DEVICE_ALLOC_SIZE)*sizeof(unsigned char);
-		unsigned char *tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char));
+		unsigned char *tmp;
+		if (newlen <= 0) {
+			/* overflow */
+			return -1;
+		}
+		tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char));
 		if (tmp == NULL) {
 			return -1;
 		}
@@ -254,7 +271,12 @@ mbfl_memory_device_strncat(mbfl_memory_device *device, const char *psrc, int len
 	if ((device->pos + len) >= device->length) {
 		/* reallocate buffer */
 		int newlen = device->length + len + MBFL_MEMORY_DEVICE_ALLOC_SIZE;
-		unsigned char *tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char));
+		unsigned char *tmp;
+		if (newlen <= 0) {
+			/* overflow */
+			return -1;
+		}
+		tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char));
 		if (tmp == NULL) {
 			return -1;
 		}
@@ -281,7 +303,12 @@ mbfl_memory_device_devcat(mbfl_memory_device *dest, mbfl_memory_device *src)
 	if ((dest->pos + src->pos) >= dest->length) {
 		/* reallocate buffer */
 		int newlen = dest->length + src->pos + MBFL_MEMORY_DEVICE_ALLOC_SIZE;
-		unsigned char *tmp = (unsigned char *)mbfl_realloc((void *)dest->buffer, newlen*sizeof(unsigned char));
+		unsigned char *tmp;
+		if (newlen <= 0) {
+			/* overflow */
+			return -1;
+		}
+		tmp = (unsigned char *)mbfl_realloc((void *)dest->buffer, newlen*sizeof(unsigned char));
 		if (tmp == NULL) {
 			return -1;
 		}
@@ -336,6 +363,10 @@ mbfl_wchar_device_output(int c, void *data)
 		unsigned int *tmp;

 		newlen = device->length + device->allocsz;
+		if (newlen <= 0) {
+			/* overflow */
+			return -1;
+		}
 		tmp = (unsigned int *)mbfl_realloc((void *)device->buffer, newlen*sizeof(int));
 		if (tmp == NULL) {
 			return -1;
@@ -213,7 +213,7 @@ static const struct mb_overload_def mb_ovld[] = {
 	{MB_OVERLOAD_REGEX, "split", "mb_split", "mb_orig_split"},
 #endif
 	{0, NULL, NULL, NULL}
-}; 
+};
 /* }}} */

 /* {{{ arginfo */
@@ -648,7 +648,7 @@ static void *_php_mb_allocators_calloc(unsigned int nelems, unsigned int szelem)
 static void _php_mb_allocators_free(void *ptr)
 {
 	efree(ptr);
-} 
+}

 static void *_php_mb_allocators_pmalloc(unsigned int sz)
 {
@@ -663,7 +663,7 @@ static void *_php_mb_allocators_prealloc(void *ptr, unsigned int sz)
 static void _php_mb_allocators_pfree(void *ptr)
 {
 	pefree(ptr, 1);
-} 
+}

 static mbfl_allocators _php_mb_allocators = {
 	_php_mb_allocators_malloc,
@@ -686,7 +686,7 @@ static sapi_post_entry mbstr_post_entries[] = {

 /* {{{ static int php_mb_parse_encoding_list()
 *  Return 0 if input contains any illegal encoding, otherwise 1.
- *  Even if any illegal encoding is detected the result may contain a list 
+ *  Even if any illegal encoding is detected the result may contain a list
 *  of parsed encodings.
 */
 static int
@@ -805,7 +805,7 @@ php_mb_parse_encoding_list(const char *value, size_t value_length, const mbfl_en

 /* {{{ static int php_mb_parse_encoding_array()
 *  Return 0 if input contains any illegal encoding, otherwise 1.
- *  Even if any illegal encoding is detected the result may contain a list 
+ *  Even if any illegal encoding is detected the result may contain a list
 *  of parsed encodings.
 */
 static int
@@ -960,7 +960,7 @@ static size_t php_mb_zend_encoding_converter(unsigned char **to, size_t *to_leng
 	if (!mbfl_buffer_converter_result(convd, &result)) {
 		mbfl_buffer_converter_delete(convd);
 		return (size_t)-1;
-	}	
+	}

 	*to = result.val;
 	*to_length = result.len;
@@ -1192,7 +1192,7 @@ static char *php_mb_rfc1867_basename(const zend_encoding *encoding, char *filena
 	 * to nill or problem is fixed this code must remain enabled for all systems. */
 	s = php_mb_safe_strrchr_ex(filename, '\\', filename_len, (const mbfl_encoding *)encoding);
 	s2 = php_mb_safe_strrchr_ex(filename, '/', filename_len, (const mbfl_encoding *)encoding);
-	
+
 	if (s && s2) {
 		if (s > s2) {
 			return ++s;
@@ -1476,13 +1476,13 @@ PHP_INI_BEGIN()
 	PHP_INI_ENTRY("mbstring.http_output", NULL, PHP_INI_ALL, OnUpdate_mbstring_http_output)
 	STD_PHP_INI_ENTRY("mbstring.internal_encoding", NULL, PHP_INI_ALL, OnUpdate_mbstring_internal_encoding, internal_encoding_name, zend_mbstring_globals, mbstring_globals)
 	PHP_INI_ENTRY("mbstring.substitute_character", NULL, PHP_INI_ALL, OnUpdate_mbstring_substitute_character)
-	STD_PHP_INI_ENTRY("mbstring.func_overload", "0", 
+	STD_PHP_INI_ENTRY("mbstring.func_overload", "0",
 	PHP_INI_SYSTEM, OnUpdateLong, func_overload, zend_mbstring_globals, mbstring_globals)

 	STD_PHP_INI_BOOLEAN("mbstring.encoding_translation", "0",
 		PHP_INI_SYSTEM | PHP_INI_PERDIR,
-		OnUpdate_mbstring_encoding_translation, 
-		encoding_translation, zend_mbstring_globals, mbstring_globals)					 
+		OnUpdate_mbstring_encoding_translation,
+		encoding_translation, zend_mbstring_globals, mbstring_globals)
 	PHP_INI_ENTRY("mbstring.http_output_conv_mimetypes",
 		"^(text/|application/xhtml\\+xml)",
 		PHP_INI_ALL,
@@ -1624,21 +1624,21 @@ PHP_RINIT_FUNCTION(mbstring)
 	/* override original function. */
 	if (MBSTRG(func_overload)){
 		p = &(mb_ovld[0]);
-		
+
 		while (p->type > 0) {
-			if ((MBSTRG(func_overload) & p->type) == p->type && 
+			if ((MBSTRG(func_overload) & p->type) == p->type &&
 				zend_hash_find(EG(function_table), p->save_func,
 					strlen(p->save_func)+1, (void **)&orig) != SUCCESS) {

 				zend_hash_find(EG(function_table), p->ovld_func, strlen(p->ovld_func)+1 , (void **)&func);
-				
+
 				if (zend_hash_find(EG(function_table), p->orig_func, strlen(p->orig_func)+1, (void **)&orig) != SUCCESS) {
 					php_error_docref("ref.mbstring" TSRMLS_CC, E_WARNING, "mbstring couldn't find function %s.", p->orig_func);
 					return FAILURE;
 				} else {
 					zend_hash_add(EG(function_table), p->save_func, strlen(p->save_func)+1, orig, sizeof(zend_function), NULL);

-					if (zend_hash_update(EG(function_table), p->orig_func, strlen(p->orig_func)+1, func, sizeof(zend_function), 
+					if (zend_hash_update(EG(function_table), p->orig_func, strlen(p->orig_func)+1, func, sizeof(zend_function),
 						NULL) == FAILURE) {
 						php_error_docref("ref.mbstring" TSRMLS_CC, E_WARNING, "mbstring couldn't replace function %s.", p->orig_func);
 						return FAILURE;
@@ -1685,10 +1685,10 @@ PHP_RSHUTDOWN_FUNCTION(mbstring)
 	if (MBSTRG(func_overload)){
 		p = &(mb_ovld[0]);
 		while (p->type > 0) {
-			if ((MBSTRG(func_overload) & p->type) == p->type && 
+			if ((MBSTRG(func_overload) & p->type) == p->type &&
 				zend_hash_find(EG(function_table), p->save_func,
 							   strlen(p->save_func)+1, (void **)&orig) == SUCCESS) {
-				
+
 				zend_hash_update(EG(function_table), p->orig_func, strlen(p->orig_func)+1, orig, sizeof(zend_function), NULL);
 				zend_hash_del(EG(function_table), p->save_func, strlen(p->save_func)+1);
 			}
@@ -1710,7 +1710,7 @@ PHP_MINFO_FUNCTION(mbstring)
 	php_info_print_table_start();
 	php_info_print_table_row(2, "Multibyte Support", "enabled");
 	php_info_print_table_row(2, "Multibyte string engine", "libmbfl");
-	php_info_print_table_row(2, "HTTP input encoding translation", MBSTRG(encoding_translation) ? "enabled": "disabled");	
+	php_info_print_table_row(2, "HTTP input encoding translation", MBSTRG(encoding_translation) ? "enabled": "disabled");
 	{
 		char tmp[256];
 		snprintf(tmp, sizeof(tmp), "%d.%d.%d", MBFL_VERSION_MAJOR, MBFL_VERSION_MINOR, MBFL_VERSION_TEENY);
@@ -1846,7 +1846,7 @@ PHP_FUNCTION(mb_http_input)
 						temp = list;
 						spprintf(&list, 0, "%s,%s", temp, (*entry)->name);
 						efree(temp);
-						if (!list) { 
+						if (!list) {
 							break;
 						}
 					} else {
@@ -2078,12 +2078,12 @@ PHP_FUNCTION(mb_parse_str)
 	encstr = estrndup(encstr, encstr_len);

 	info.data_type              = PARSE_STRING;
-	info.separator              = PG(arg_separator).input; 
+	info.separator              = PG(arg_separator).input;
 	info.report_errors          = 1;
 	info.to_encoding            = MBSTRG(current_internal_encoding);
 	info.to_language            = MBSTRG(language);
 	info.from_encodings         = MBSTRG(http_input_list);
-	info.num_from_encodings     = MBSTRG(http_input_list_size); 
+	info.num_from_encodings     = MBSTRG(http_input_list_size);
 	info.from_language          = MBSTRG(language);

 	if (track_vars_array != NULL) {
@@ -2093,8 +2093,8 @@ PHP_FUNCTION(mb_parse_str)
 		if (!EG(active_symbol_table)) {
 			zend_rebuild_symbol_table(TSRMLS_C);
 		}
-		Z_ARRVAL(tmp) = EG(active_symbol_table);		
-		detected = _php_mb_encoding_handler_ex(&info, &tmp, encstr TSRMLS_CC);		
+		Z_ARRVAL(tmp) = EG(active_symbol_table);
+		detected = _php_mb_encoding_handler_ex(&info, &tmp, encstr TSRMLS_CC);
 	}

 	MBSTRG(http_input_identify) = detected;
@@ -2158,7 +2158,7 @@ PHP_FUNCTION(mb_output_handler)
 		if (SG(sapi_headers).send_default_content_type || send_text_mimetype) {
 			charset = encoding->mime_name;
 			if (charset) {
-				len = spprintf( &p, 0, "Content-Type: %s; charset=%s",  mimetype, charset ); 
+				len = spprintf( &p, 0, "Content-Type: %s; charset=%s",  mimetype, charset );
 				if (sapi_add_header(p, len, 0) != FAILURE) {
 					SG(sapi_headers).send_default_content_type = 0;
 				}
@@ -2181,7 +2181,7 @@ PHP_FUNCTION(mb_output_handler)
 	/* mode */
 	mbfl_buffer_converter_illegal_mode(MBSTRG(outconv), MBSTRG(current_filter_illegal_mode));
 	mbfl_buffer_converter_illegal_substchar(MBSTRG(outconv), MBSTRG(current_filter_illegal_substchar));
- 
+
 	/* feed the string */
 	mbfl_string_init(&string);
 	/* these are not needed. convd has encoding info.
@@ -2193,11 +2193,11 @@ PHP_FUNCTION(mb_output_handler)
 	mbfl_buffer_converter_feed(MBSTRG(outconv), &string);
 	if (last_feed) {
 		mbfl_buffer_converter_flush(MBSTRG(outconv));
-	} 
+	}
 	/* get the converter output, and return it */
 	mbfl_buffer_converter_result(MBSTRG(outconv), &result);
 	RETVAL_STRINGL((char *)result.val, result.len, 0);		/* the string is already strdup()'ed */
- 
+
 	/* delete the converter if it is the last feed. */
 	if (last_feed) {
 		MBSTRG(illegalchars) += mbfl_buffer_illegalchars(MBSTRG(outconv));
@@ -3156,7 +3156,7 @@ PHP_FUNCTION(mb_convert_case)

 	if (newstr) {
 		RETVAL_STRINGL(newstr, ret_len, 0);
-	}	
+	}
 }
 /* }}} */

@@ -3380,7 +3380,7 @@ PHP_FUNCTION(mb_encode_mimeheader)
 	mbfl_string_init(&result);
 	ret = mbfl_mime_header_encode(&string, &result, charset, transenc, linefeed, indent);
 	if (ret != NULL) {
-		RETVAL_STRINGL((char *)ret->val, ret->len, 0);	/* the string is already strdup()'ed */
+		RETVAL_STRINGL_CHECK((char *)ret->val, ret->len, 0);	/* the string is already strdup()'ed */
 	} else {
 		RETVAL_FALSE;
 	}
@@ -3507,7 +3507,7 @@ PHP_FUNCTION(mb_convert_kana)

 	ret = mbfl_ja_jp_hantozen(&string, &result, opt);
 	if (ret != NULL) {
-		RETVAL_STRINGL((char *)ret->val, ret->len, 0);		/* the string is already strdup()'ed */
+		RETVAL_STRINGL_CHECK((char *)ret->val, ret->len, 0);		/* the string is already strdup()'ed */
 	} else {
 		RETVAL_FALSE;
 	}
@@ -3841,7 +3841,7 @@ php_mb_numericentity_exec(INTERNAL_FUNCTION_PARAMETERS, int type)

 	ret = mbfl_html_numeric_entity(&string, &result, convmap, mapsize, type);
 	if (ret != NULL) {
-		RETVAL_STRINGL((char *)ret->val, ret->len, 0);
+		RETVAL_STRINGL_CHECK((char *)ret->val, ret->len, 0);
 	} else {
 		RETVAL_FALSE;
 	}
@@ -3929,12 +3929,12 @@ static int _php_mbstr_parse_mail_headers(HashTable *ht, const char *str, size_t

 	/*
 	 *             C o n t e n t - T y p e :   t e x t / h t m l \r\n
-	 *             ^ ^^^^^^^^^^^^^^^^^^^^^ ^^^ ^^^^^^^^^^^^^^^^^ ^^^^ 
-	 *      state  0            1           2          3          
+	 *             ^ ^^^^^^^^^^^^^^^^^^^^^ ^^^ ^^^^^^^^^^^^^^^^^ ^^^^
+	 *      state  0            1           2          3
 	 *
 	 *             C o n t e n t - T y p e :   t e x t / h t m l \r\n
-	 *             ^ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^ 
-	 * crlf_state -1                       0                     1 -1  
+	 *             ^ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^
+	 * crlf_state -1                       0                     1 -1
 	 *
 	 */

@@ -4000,7 +4000,7 @@ static int _php_mbstr_parse_mail_headers(HashTable *ht, const char *str, size_t
 						token.a = 0;
 						state = 1;
 						break;
-					
+
 					case 2:
 						if (crlf_state != -1) {
 							token.c = (char *)ps;
@@ -4177,14 +4177,14 @@ PHP_FUNCTION(mb_send_mail)
 				if ((param_name = php_strtok_r(p, "= ", &tmp)) != NULL) {
 					if (strcasecmp(param_name, "charset") == 0) {
 						enum mbfl_no_encoding _tran_cs = tran_cs;
-						
+
 						charset = php_strtok_r(NULL, "= \"", &tmp);
 						if (charset != NULL) {
 							_tran_cs = mbfl_name2no_encoding(charset);
 						}

 						if (_tran_cs == mbfl_no_encoding_invalid) {
-							php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unsupported charset \"%s\" - will be regarded as ascii", charset); 
+							php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unsupported charset \"%s\" - will be regarded as ascii", charset);
 							_tran_cs = mbfl_no_encoding_ascii;
 						}
 						tran_cs = _tran_cs;
@@ -4209,7 +4209,7 @@ PHP_FUNCTION(mb_send_mail)
 				break;

 			default:
-				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unsupported transfer encoding \"%s\" - will be regarded as 8bit", s->c); 
+				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unsupported transfer encoding \"%s\" - will be regarded as 8bit", s->c);
 				body_enc =	mbfl_no_encoding_8bit;
 				break;
 		}
@@ -4342,7 +4342,7 @@ PHP_FUNCTION(mb_send_mail)
 		extra_cmd = php_escape_shell_cmd(force_extra_parameters);
 	} else if (extra_cmd) {
 		extra_cmd = php_escape_shell_cmd(extra_cmd);
-	} 
+	}

 	if (!err && php_mail(to_r, subject, message, headers, extra_cmd TSRMLS_CC)) {
 		RETVAL_TRUE;
@@ -4441,7 +4441,7 @@ PHP_FUNCTION(mb_get_info)
 		}
 		if ((name = (char *)mbfl_no_language2name(MBSTRG(language))) != NULL) {
 			add_assoc_string(return_value, "language", name, 1);
-		}		
+		}
 		n = MBSTRG(current_detect_order_list_size);
 		entry = MBSTRG(current_detect_order_list);
 		if (n > 0) {
@@ -4471,15 +4471,15 @@ PHP_FUNCTION(mb_get_info)
 	} else if (!strcasecmp("internal_encoding", typ)) {
 		if (MBSTRG(current_internal_encoding)) {
 			RETVAL_STRING((char *)MBSTRG(current_internal_encoding)->name, 1);
-		}		
+		}
 	} else if (!strcasecmp("http_input", typ)) {
 		if (MBSTRG(http_input_identify)) {
 			RETVAL_STRING((char *)MBSTRG(http_input_identify)->name, 1);
-		}		
+		}
 	} else if (!strcasecmp("http_output", typ)) {
 		if (MBSTRG(current_http_output_encoding)) {
 			RETVAL_STRING((char *)MBSTRG(current_http_output_encoding)->name, 1);
-		}		
+		}
 	} else if (!strcasecmp("http_output_conv_mimetypes", typ)) {
 		if ((name = (char *)zend_ini_string("mbstring.http_output_conv_mimetypes", sizeof("mbstring.http_output_conv_mimetypes"), 0)) != NULL) {
 			RETVAL_STRING(name, 1);
@@ -4522,7 +4522,7 @@ PHP_FUNCTION(mb_get_info)
 	} else if (!strcasecmp("language", typ)) {
 		if ((name = (char *)mbfl_no_language2name(MBSTRG(language))) != NULL) {
 			RETVAL_STRING(name, 1);
-		}		
+		}
 	} else if (!strcasecmp("detect_order", typ)) {
 		n = MBSTRG(current_detect_order_list_size);
 		entry = MBSTRG(current_detect_order_list);
@@ -4589,9 +4589,9 @@ PHP_FUNCTION(mb_check_encoding)
 	if (convd == NULL) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to create converter");
 		RETURN_FALSE;
-	}	
+	}
 	mbfl_buffer_converter_illegal_mode(convd, MBFL_OUTPUTFILTER_ILLEGAL_MODE_NONE);
-	mbfl_buffer_converter_illegal_substchar(convd, 0);	
+	mbfl_buffer_converter_illegal_substchar(convd, 0);

 	/* initialize string */
 	mbfl_string_init_set(&string, mbfl_no_language_neutral, encoding->no_encoding);
@@ -4642,7 +4642,7 @@ static void php_mb_populate_current_detect_order_list(TSRMLS_D)
 }

 /* {{{ static int php_mb_encoding_translation() */
-static int php_mb_encoding_translation(TSRMLS_D) 
+static int php_mb_encoding_translation(TSRMLS_D)
 {
 	return MBSTRG(encoding_translation);
 }
@@ -4768,7 +4768,7 @@ MBSTRING_API int php_mb_stripos(int mode, const char *old_haystack, unsigned int

 		{
 			int haystack_char_len = mbfl_strlen(&haystack);
- 
+
 			if (mode) {
 				if ((offset > 0 && offset > haystack_char_len) ||
 					(offset < 0 && -offset > haystack_char_len)) {