5.6.39

5.6.40 will be next. probably not
Fix null pointer deref in qprint-encode filter (bug #77231 )
2026-11-13 04:00:50 +00:00 · 2018-12-05 10:17:04 +01:00 · 2018-12-05 09:13:30 +01:00 · 2018-12-03 10:19:08 -08:00 · 2018-12-03 00:41:46 -08:00 · 2018-12-03 00:00:56 -08:00
289 changed files with 14692 additions and 10740 deletions
@@ -1,3 +1,4 @@
+dist: precise
 language: c
 sudo: false
 addons:
@@ -74,7 +74,7 @@ MAINTENANCE:         Maintained
 STATUS:              Working
 -------------------------------------------------------------------------------
 EXTENSION:           fpm
-PRIMARY MAINTAINER:  Antony Dovgal <tony2001@php.net>, Jerome Loyet <fat@php.net>
+PRIMARY MAINTAINER:  Jakub Zelenka <bukka@php.net>
 MAINTENANCE:         Maintained
 STATUS:              Working
 SINCE:               5.3.3
@@ -1,11 +1,237 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2016, PHP 5.6.27
+06 Dec 2018, PHP 5.6.39
+
+- Core:
+  . Fixed bug #77231 (Segfault when using convert.quoted-printable-encode 
+    filter). (Stas)
+
+- IMAP:
+  . Fixed bug #77020 (null pointer dereference in imap_mail). (cmb)
+  . Fixed bug #77153 (imap_open allows to run arbitrary shell commands via
+    mailbox parameter). (Stas)
+
+- Phar:
+  . Fixed bug #77022 (PharData always creates new files with mode 0666). (Stas)
+  . Fixed bug #77143 (Heap Buffer Overflow (READ: 4) in phar_parse_pharfile).
+    (Stas)
+
+13 Sep 2018, PHP 5.6.38
+
+- Apache2
+  . Fixed bug #76582 (XSS due to the header Transfer-Encoding: chunked). (Stas)
+
+19 Jul 2018, PHP 5.6.37
+
+- Exif:
+  . Fixed bug #76423 (Int Overflow lead to Heap OverFlow in
+    exif_thumbnail_extract of exif.c). (Stas)
+  . Fixed bug #76557 (heap-buffer-overflow (READ of size 48) while reading exif
+    data). (Stas)
+
+- Win32:
+  . Fixed bug #76459 (windows linkinfo lacks openbasedir check). (Anatol)
+
+26 Apr 2018 PHP 5.6.36
+
+- Exif:
+  . Fixed bug #76130 (Heap Buffer Overflow (READ: 1786) in exif_iif_add_value).
+  (Stas)
+
+- iconv:
+  . Fixed bug #76249 (stream filter convert.iconv leads to infinite loop on
+    invalid sequence). (Stas)
+
+- LDAP:
+  . Fixed bug #76248 (Malicious LDAP-Server Response causes Crash). (Stas)
+
+- Phar:
+  . Fixed bug #76129 (fix for CVE-2018-5712 may not be complete). (Stas)
+
+29 Mar 2018, PHP 5.6.35
+
+- FPM:
+  . Fixed bug #75605 (Dumpable FPM child processes allow bypassing opcache
+    access controls). (Jakub Zelenka)
+
+01 Mar 2018, PHP 5.6.34
+
+- Standard:
+  . Fixed bug #75981 (stack-buffer-overflow while parsing HTTP response). (Stas)
+
+04 Jan 2018, PHP 5.6.33
+
+- GD:
+  . Fixed bug #75571 (Potential infinite loop in gdImageCreateFromGifCtx). (cmb)
+
+- Phar:
+  . Fixed bug #74782 (Reflected XSS in .phar 404 page). (Stas)
+
+26 Sep 2017, PHP 5.6.32
+
+- Date:
+  . Fixed bug #75055 (Out-Of-Bounds Read in timelib_meridian()). (Derick)
+
+- mcrypt:
+  . Fixed bug #72535 (arcfour encryption stream filter crashes php). (Leigh)
+
+- PCRE:
+  . Fixed bug #75207 (applied upstream patch for CVE-2016-1283). (Anatol)
+
+06 Jul 2017, PHP 5.6.31
+
+- Core:
+  . Fixed bug #73807 (Performance problem with processing post request over
+    2000000 chars). (Nikita)
+  . Fixed bug #74111 (Heap buffer overread (READ: 1) finish_nested_data from
+    unserialize). (Nikita)
+  . Fixed bug #74603 (PHP INI Parsing Stack Buffer Overflow Vulnerability).
+    (Stas)
+  . Fixed bug #74819 (wddx_deserialize() heap out-of-bound read via
+    php_parse_date()). (Derick)
+
+- GD:
+  . Fixed bug #74435 (Buffer over-read into uninitialized memory). (cmb)
+
+- mbstring:
+  . Add oniguruma upstream fix (CVE-2017-9224, CVE-2017-9226, CVE-2017-9227,
+    CVE-2017-9228, CVE-2017-9229) (Remi, Mamoru TASAKA)
+
+- OpenSSL:
+  . Fixed bug #74651 (negative-size-param (-1) in memcpy in zif_openssl_seal()).
+    (Stas)
+
+- PCRE:
+  . Fixed bug #74087 (Segmentation fault in PHP7.1.1(compiled using the bundled PCRE library)).
+    (Stas)
+
+- WDDX:
+   . Fixed bug #74145 (wddx parsing empty boolean tag leads to SIGSEGV). (Stas)
+
+19 Jan 2017, PHP 5.6.30
+
+- EXIF:
+  . Fixed bug #73737 (FPE when parsing a tag format). (Stas)
+
+- GD:
+  . Fixed bug #73549 (Use after free when stream is passed to imagepng). (cmb)
+  . Fixed bug #73868 (DOS vulnerability in gdImageCreateFromGd2Ctx()). (cmb)
+  . Fixed bug #73869 (Signed Integer Overflow gd_io.c). (cmb)
+
+- Intl:
+  . Fixed bug #68447 (grapheme_extract take an extra trailing character). 
+    (SATŌ Kentarō)
+
+- Phar:
+  . Fixed bug #73764 (Crash while loading hostile phar archive). (Stas)
+  . Fixed bug #73768 (Memory corruption when loading hostile phar). (Stas)
+  . Fixed bug #73773 (Seg fault when loading hostile phar). (Stas)
+
+- SQLite3:
+  . Reverted fix for bug #73530	(Unsetting result set may reset other result
+    set). (cmb)
+
+- Standard:
+  . Fixed bug #70213 (Unserialize context shared on double class lookup).
+    (Taoguang Chen)
+  . Fixed bug #73825 (Heap out of bounds read on unserialize in
+    finish_nested_data()). (Stas)
+
+08 Dec 2016, PHP 5.6.29
+
+- Mbstring:
+  . Fixed bug #73505 (string length overflow in mbfl_memory_device_output
+    function). (Stas)
+
+- Mysqlnd:
+  . Fixed bug #64526 (Add missing mysqlnd.* parameters to php.ini-*). (cmb)
+
+- Opcache:
+  . Fixed bug #73402 (Opcache segfault when using class constant to call a
+    method). (Laruence)
+  . Fixed bug #69090 (check cached files permissions)
+
+- OpenSSL
+  . Fixed bug #72776 (Invalid parameter in memcpy function trough
+    openssl_pbkdf2). (Jakub Zelenka)
+
+- Postgres:
+  . Fixed bug #73498 (Incorrect SQL generated for pg_copy_to()). (Craig Duncan)
+
+- SOAP:
+  . Fixed bug #73452 (Segfault (Regression for #69152)). (Dmitry)
+
+- SQLite3:
+  . Fixed bug #73530 (Unsetting result set may reset other result set). (cmb)
+
+- Standard:
+   . Fixed bug #73297 (HTTP stream wrapper should ignore HTTP 100 Continue).
+     (rowan dot collins at gmail dot com)
+
+- WDDX:
+  . Fixed bug #73631 (Memory leak due to invalid wddx stack processing). 
+    (bughunter at fosec dot vn).
+
+10 Nov 2016, PHP 5.6.28
+
+- Core:
+  . Fixed bug #73337 (try/catch not working with two exceptions inside a same
+    operation). (Dmitry)
+
+- Bz2:
+  . Fixed bug #73356 (crash in bzcompress function). (Stas)
+
+-GD:
+  . Fixed bug #73213 (Integer overflow in imageline() with antialiasing). (cmb)
+  . Fixed bug #73272 (imagescale() is not affected by, but affects
+    imagesetinterpolation()). (cmb)
+  . Fixed bug #73279 (Integer overflow in gdImageScaleBilinearPalette()). (cmb)
+  . Fixed bug #73280 (Stack Buffer Overflow in GD dynamicGetbuf). (cmb)
+  . Fixed bug #72482 (Illegal write/read access caused by gdImageAALine overflow).
+    (cmb)
+  . Fixed bug #72696 (imagefilltoborder stackoverflow on truecolor images). (cmb)
+
+- Imap:
+  . Fixed bug #73418 (Integer Overflow in "_php_imap_mail" leads Heap Overflow).
+    (Anatol)
+
+- SPL:
+  . Fixed bug #73144 (Use-after-free in ArrayObject Deserialization). (Stas)
+
+- SOAP:
+  . Fixed bug #73037 (SoapServer reports Bad Request when gzipped). (Anatol)
+
+- SQLite3:
+  . Fixed bug #73333 (2147483647 is fetched as string). (cmb)
+
+- Standard:
+  . Fixed bug #73203 (passing additional_parameters causes mail to fail). (cmb)
+  . Fixed bug #73188 (use after free in userspace streams). (Sara)
+  . Fixed bug #73192 (parse_url return wrong hostname). (Nikita)
+
+- Wddx:
+  . Fixed bug #73331 (NULL Pointer Dereference in WDDX Packet Deserialization
+    with PDORow). (Stas)
+
+13 Oct 2016, PHP 5.6.27

 - Core:
  . Fixed bug #73025 (Heap Buffer Overflow in virtual_popen of
    zend_virtual_cwd.c). (cmb)
  . Fixed bug #73058 (crypt broken when salt is 'too' long). (Anatol)
+  . Fixed bug #72703 (Out of bounds global memory read in BF_crypt triggered by
+    password_verify). (Anatol)
+  . Fixed bug #73189 (Memcpy negative size parameter php_resolve_path). (Stas)
+  . Fixed bug #73147 (Use After Free in unserialize()). (Stas)
+
+- BCmath:
+  . Fixed bug #73190 (memcpy negative parameter _bc_new_num_ex). (Stas)
+
+- DOM:
+  . Fixed bug #73150 (missing NULL check in dom_document_save_html). (Stas)
+
+- Ereg:
+  . Fixed bug #73284 (heap overflow in php_ereg_replace function). (Stas)

 - Filter:
  . Fixed bug #72972 (Bad filter for the flags FILTER_FLAG_NO_RES_RANGE and
@@ -18,12 +244,34 @@ PHP                                                                        NEWS
 - GD:
  . Fixed bug #67325 (imagetruecolortopalette: white is duplicated in palette).
    (cmb)
+  . Fixed bug #50194 (imagettftext broken on transparent background w/o
+    alphablending). (cmb)
+  . Fixed bug #73003 (Integer Overflow in gdImageWebpCtx of gd_webp.c). (trylab,
+    cmb)
+  . Fixed bug #53504 (imagettfbbox gives incorrect values for bounding box).
+    (Mark Plomer, cmb)
+  . Fixed bug #73157 (imagegd2() ignores 3rd param if 4 are given). (cmb)
+  . Fixed bug #73155 (imagegd2() writes wrong chunk sizes on boundaries). (cmb)
+  . Fixed bug #73159 (imagegd2(): unrecognized formats may result in corrupted
+    files). (cmb)
+  . Fixed bug #73161 (imagecreatefromgd2() may leak memory). (cmb)
+
+- Intl:
+  . Fixed bug #73218 (add mitigation for ICU int overflow). (Stas)
+
+- Imap:
+  . Fixed bug #73208 (integer overflow in imap_8bit caused heap corruption).
+    (Stas)

 - Mbstring:
  . Fixed bug #72994 (mbc_to_code() out of bounds read). (Laruence, cmb)
  . Fixed bug #66964 (mb_convert_variables() cannot detect recursion). (Yasuo)
  . Fixed bug #72992 (mbstring.internal_encoding doesn't inherit default_charset).
    (Yasuo)
+  . Fixed bug #73082 (string length overflow in mb_encode_* function). (Stas)
+
+- PCRE:
+  . Fixed bug #73174 (heap overflow in php_pcre_replace_impl). (Stas)

 - Opcache:
  . Fixed bug #72590 (Opcache restart with kill_all_lockers does not work).
@@ -32,10 +280,29 @@ PHP                                                                        NEWS
 - OpenSSL:
  . Fixed bug #73072 (Invalid path SNI_server_certs causes segfault).
    (Jakub Zelenka)
+  . Fixed bug #73275 (crash in openssl_encrypt function). (Stas)
+  . Fixed bug #73276 (crash in openssl_random_pseudo_bytes function). (Stas)

 - Session:
  . Fixed bug #68015 (Session does not report invalid uid for files save handler).
    (Yasuo)
+  . Fixed bug #73100 (session_destroy null dereference in ps_files_path_create).
+    (cmb)
+
+- SimpleXML:
+  . Fixed bug #73293 (NULL pointer dereference in SimpleXMLElement::asXML()).
+    (Stas)
+
+- SPL:
+  . Fixed bug #73073 (CachingIterator null dereference when convert to string).
+    (Stas)
+
+- Standard:
+  . Fixed bug #73240 (Write out of bounds at number_format). (Stas)
+  . Fixed bug #73017 (memory corruption in wordwrap function). (Stas)
+
+- Stream:
+  . Fixed bug #73069 (readfile() mangles files larger than 2G). (Laruence)

 - Zip:
  . Fixed bug #70752 (Depacking with wrong password leaves 0 length files).
@@ -46,8 +313,6 @@ PHP                                                                        NEWS
 - Core:
  . Fixed bug #72907 (null pointer deref, segfault in gc_remove_zval_from_buffer
    (zend_gc.c:260)). (Laruence)
-  . Fixed bug #72703 (Out of bounds global memory read in BF_crypt triggered by
-    password_verify). (Anatol)

 - Dba:
  . Fixed bug #71514 (Bad dba_replace condition because of wrong API usage).
@@ -55,6 +320,10 @@ PHP                                                                        NEWS
  . Fixed bug #70825 (Cannot fetch multiple values with group in ini file).
    (cmb)

+- EXIF:
+  . Fixed bug #72926 (Uninitialized Thumbail Data Leads To Memory Leakage in
+    exif_process_IFD_in_TIFF). (Stas)
+
 - FTP:
  . Fixed bug #70195 (Cannot upload file using ftp_put to FTPES with
    require_ssl_reuse). (Benedict Singer)
@@ -66,15 +335,29 @@ PHP                                                                        NEWS
    images). (cmb)
  . Fixed bug #68716 (possible resource leaks in _php_image_convert()). (cmb)

+- Intl:
+  . Fixed bug #73007 (add locale length check). (Stas)
+
 - JSON:
  . Fixed bug #72787 (json_decode reads out of bounds). (Jakub Zelenka)

 - mbstring:
  . Fixed bug #66797 (mb_substr only takes 32-bit signed integer). (cmb)
+  . Fixed bug #72910 (Out of bounds heap read in mbc_to_code() / triggered by
+    mb_ereg_match()). (Stas)

 - MSSQL:
  . Fixed bug #72039 (Use of uninitialised value on mssql_guid_string). (Kalle)

+- Mysqlnd:
+  . Fixed bug #72293 (Heap overflow in mysqlnd related to BIT fields). (Stas)
+
+- Phar:
+  . Fixed bug #72928 (Out of bound when verify signature of zip phar in
+    phar_parse_zipfile). (Stas)
+  . Fixed bug #73035 (Out of bound when verify signature of tar phar in
+    phar_parse_tarfile). (Stas)
+
 - PDO:
  . Fixed bug #60665 (call to empty() on NULL result using PDO::FETCH_LAZY
    returns false). (cmb)
@@ -84,6 +367,9 @@ PHP                                                                        NEWS
    specifying a sequence). (Pablo Santiago Sánchez, Matteo)
  . Fixed bug #72759 (Regression in pgo_pgsql). (Anatol)

+- SPL:
+  . Fixed bug #73029 (Missing type check when unserializing SplArray). (Stas)
+
 - Standard:
  . Fixed bug #72823 (strtr out-of-bound access). (cmb)
  . Fixed bug #72278 (getimagesize returning FALSE on valid jpg). (cmb)
@@ -91,12 +377,22 @@ PHP                                                                        NEWS
    (cmb)
  . Fixed bug #71882 (Negative ftruncate() on php://memory exhausts memory).
    (cmb)
+  . Fixed bug #73011 (integer overflow in fgets cause heap corruption). (Stas)
+  . Fixed bug #73017 (memory corruption in wordwrap function). (Stas)
+  . Fixed bug #73045 (integer overflow in fgetcsv caused heap corruption). (Stas)
+  . Fixed bug #73052 (Memory Corruption in During Deserialized-object Destruction)
+    (Stas)

 - Streams:
  . Fixed bug #72853 (stream_set_blocking doesn't work). (Laruence)

+- Wddx:
+  . Fixed bug #72860 (wddx_deserialize use-after-free). (Stas)
+  . Fixed bug #73065 (Out-Of-Bounds Read in php_wddx_push_element). (Stas)
+
 - XML:
  . Fixed bug #72085 (SEGV on unknown address zif_xml_parse). (cmb)
+  . Fixed bug #72927 (integer overflow in xml_utf8_encode). (Stas)

 - ZIP:
  . Fixed bug #68302 (impossible to compile php with zip support). (cmb)
@@ -167,6 +463,8 @@ PHP                                                                        NEWS
  . Fixed bug #72697 (select_colors write out-of-bounds). (Stas)
  . Fixed bug #72709 (imagesetstyle() causes OOB read for empty $styles). (cmb)
  . Fixed bug #72730 (imagegammacorrect allows arbitrary write access). (Stas)
+  . Fixed bug #72494 (imagecropauto out-of-bounds access). (Fernando, Pierre,
+    cmb)

 - Intl:
  . Partially fixed #72506 (idn_to_ascii for UTS #46 incorrect for long domain
@@ -64,6 +64,13 @@ PHP 5.6 UPGRADE NOTES
 - cURL:
  Uploads using the @file syntax are now unsupported by default.

+- IMAP:
+  Starting with 5.6.38, rsh/ssh logins are disabled by default. Use
+  imap.enable_insecure_rsh if you want to enable them. Note that the IMAP
+  library does not filter mailbox names before passing them to rsh/ssh
+  command, thus passing untrusted data to this function with rsh/ssh enabled
+  is insecure.
+
 ========================================
 2. New Features
 ========================================
@@ -0,0 +1,25 @@
+--TEST--
+Next free element may overflow in array literals
+--FILE--
+<?php
+
+$i = PHP_INT_MAX;
+$array = [$i => 42, new stdClass];
+var_dump($array);
+
+const FOO = [PHP_INT_MAX => 42, "foo"];
+var_dump(FOO);
+
+?>
+--EXPECTF--
+Warning: Cannot add element to the array as the next element is already occupied in %s on line %d
+array(1) {
+  [%d]=>
+  int(42)
+}
+
+Warning: Cannot add element to the array as the next element is already occupied in %s on line %d
+array(1) {
+  [%d]=>
+  int(42)
+}
@@ -0,0 +1,12 @@
+--TEST--
+Bug #73337 (try/catch not working with two exceptions inside a same operation)
+--FILE--
+<?php
+class d { function __destruct() { throw new Exception; } }
+try { new d + new d; } catch (Exception $e) { print "Exception properly caught\n"; }
+?>
+--EXPECTF--
+Notice: Object of class d could not be converted to int in %sbug73337.php on line 3
+
+Notice: Object of class d could not be converted to int in %sbug73337.php on line 3
+Exception properly caught
@@ -0,0 +1 @@
+0=0&~2000000000
@@ -0,0 +1,15 @@
+--TEST--
+Bug #74603 (PHP INI Parsing Stack Buffer Overflow Vulnerability)
+--SKIPIF--
+<?php
+if (PHP_INT_MAX !== 2147483647)
+        die('skip for 32-bit only');
+--FILE--
+<?php
+var_dump(parse_ini_file(__DIR__ . "/bug74603.ini", true, INI_SCANNER_NORMAL));
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  string(1) "0"
+}
@@ -0,0 +1,15 @@
+--TEST--
+Constexpr arrays should be able to handle resource keys
+--FILE--
+<?php
+
+const FOO = [STDIN => 42];
+var_dump(FOO);
+
+?>
+--EXPECTF--
+Strict Standards: Resource ID#%d used as offset, casting to integer (%d) in %s on line %d
+array(1) {
+  [%d]=>
+  int(42)
+}
@@ -1,5 +1,7 @@
 --TEST--
 Testing __debugInfo() magic method with bad returns RESOURCE
+--INI--
+allow_url_fopen=1
 --FILE--
 <?php

@@ -1805,6 +1805,12 @@ ZEND_API int zend_startup_module_ex(zend_module_entry *module TSRMLS_DC) /* {{{
 }
 /* }}} */

+static int zend_startup_module_int(zend_module_entry *module TSRMLS_DC) /* {{{ */
+{
+	return (zend_startup_module_ex(module TSRMLS_CC) == SUCCESS) ? ZEND_HASH_APPLY_KEEP : ZEND_HASH_APPLY_REMOVE;
+}
+/* }}} */
+
 static void zend_sort_modules(void *base, size_t count, size_t siz, compare_func_t compare TSRMLS_DC) /* {{{ */
 {
 	Bucket **b1 = base;
@@ -1921,7 +1927,7 @@ ZEND_API void zend_collect_module_handlers(TSRMLS_D) /* {{{ */
 ZEND_API int zend_startup_modules(TSRMLS_D) /* {{{ */
 {
 	zend_hash_sort(&module_registry, zend_sort_modules, NULL, 0 TSRMLS_CC);
-	zend_hash_apply(&module_registry, (apply_func_t)zend_startup_module_ex TSRMLS_CC);
+	zend_hash_apply(&module_registry, (apply_func_t)zend_startup_module_int TSRMLS_CC);
 	return SUCCESS;
 }
 /* }}} */
@@ -3770,6 +3776,30 @@ ZEND_API void zend_update_property(zend_class_entry *scope, zval *object, const
 }
 /* }}} */

+ZEND_API void zend_unset_property(zend_class_entry *scope, zval *object, const char *name, int name_length TSRMLS_DC) /* {{{ */
+{
+	zval *property;
+	zend_class_entry *old_scope = EG(scope);
+
+	EG(scope) = scope;
+
+	if (!Z_OBJ_HT_P(object)->unset_property) {
+		const char *class_name;
+		zend_uint class_name_len;
+
+		zend_get_object_classname(object, &class_name, &class_name_len TSRMLS_CC);
+
+		zend_error(E_CORE_ERROR, "Property %s of class %s cannot be unset", name, class_name);
+	}
+	MAKE_STD_ZVAL(property);
+	ZVAL_STRINGL(property, name, name_length, 1);
+	Z_OBJ_HT_P(object)->unset_property(object, property, 0 TSRMLS_CC);
+	zval_ptr_dtor(&property);
+
+	EG(scope) = old_scope;
+}
+/* }}} */
+
 ZEND_API void zend_update_property_null(zend_class_entry *scope, zval *object, const char *name, int name_length TSRMLS_DC) /* {{{ */
 {
 	zval *tmp;
@@ -330,6 +330,7 @@ ZEND_API void zend_update_property_long(zend_class_entry *scope, zval *object, c
 ZEND_API void zend_update_property_double(zend_class_entry *scope, zval *object, const char *name, int name_length, double value TSRMLS_DC);
 ZEND_API void zend_update_property_string(zend_class_entry *scope, zval *object, const char *name, int name_length, const char *value TSRMLS_DC);
 ZEND_API void zend_update_property_stringl(zend_class_entry *scope, zval *object, const char *name, int name_length, const char *value, int value_length TSRMLS_DC);
+ZEND_API void zend_unset_property(zend_class_entry *scope, zval *object, const char *name, int name_length TSRMLS_DC);

 ZEND_API int zend_update_static_property(zend_class_entry *scope, const char *name, int name_length, zval *value TSRMLS_DC);
 ZEND_API int zend_update_static_property_null(zend_class_entry *scope, const char *name, int name_length TSRMLS_DC);
@@ -664,8 +665,9 @@ END_EXTERN_C()
 		}									\
 		RETURN_FALSE;						\
 	}										\
-	RETVAL_STRINGL((s), __len, (dup)); \
+	RETVAL_STRINGL((s), (int)__len, (dup)); \
 } while (0)
+#define RETURN_STRINGL_CHECK(s, len, dup) { RETVAL_STRINGL_CHECK(s, len, dup); return; }


 #define SET_VAR_STRING(n, v) {																				\
@@ -2735,9 +2735,9 @@ static void alloc_globals_ctor(zend_alloc_globals *alloc_globals TSRMLS_DC)
 		alloc_globals->mm_heap = malloc(sizeof(struct _zend_mm_heap));
 		memset(alloc_globals->mm_heap, 0, sizeof(struct _zend_mm_heap));
 		alloc_globals->mm_heap->use_zend_alloc = 0;
-		alloc_globals->mm_heap->_malloc = malloc;
+		alloc_globals->mm_heap->_malloc = __zend_malloc;
 		alloc_globals->mm_heap->_free = free;
-		alloc_globals->mm_heap->_realloc = realloc;
+		alloc_globals->mm_heap->_realloc = __zend_realloc;
 	} else {
 		alloc_globals->mm_heap = zend_mm_startup();
 	}
@@ -5929,7 +5929,7 @@ void zend_do_add_array_element(znode *result, const znode *expr, const znode *of
 }
 /* }}} */

-void zend_do_add_static_array_element(zval *result, zval *offset, const zval *expr) /* {{{ */
+void zend_do_add_static_array_element(zval *result, zval *offset, zval *expr) /* {{{ */
 {
 	if (offset) {
 		switch (Z_TYPE_P(offset)) {
@@ -5940,6 +5940,9 @@ void zend_do_add_static_array_element(zval *result, zval *offset, const zval *ex
 			case IS_NULL:
 				zend_symtable_update(Z_ARRVAL_P(result), "", 1, &expr, sizeof(zval *), NULL);
 				break;
+			case IS_RESOURCE:
+				zend_error(E_STRICT, "Resource ID#%ld used as offset, casting to integer (%ld)", Z_LVAL_P(offset), Z_LVAL_P(offset));
+				/* break missing intentionally */
 			case IS_LONG:
 			case IS_BOOL:
 				zend_hash_index_update(Z_ARRVAL_P(result), Z_LVAL_P(offset), &expr, sizeof(zval *), NULL);
@@ -5952,7 +5955,10 @@ void zend_do_add_static_array_element(zval *result, zval *offset, const zval *ex
 				break;
 		}
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL_P(result), &expr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL_P(result), &expr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr);
+		}
 	}
 }
 /* }}} */
@@ -598,7 +598,7 @@ void zend_do_shell_exec(znode *result, const znode *cmd TSRMLS_DC);

 void zend_do_init_array(znode *result, const znode *expr, const znode *offset, zend_bool is_ref TSRMLS_DC);
 void zend_do_add_array_element(znode *result, const znode *expr, const znode *offset, zend_bool is_ref TSRMLS_DC);
-void zend_do_add_static_array_element(zval *result, zval *offset, const zval *expr);
+void zend_do_add_static_array_element(zval *result, zval *offset, zval *expr);
 void zend_do_list_init(TSRMLS_D);
 void zend_do_list_end(znode *result, znode *expr TSRMLS_DC);
 void zend_do_add_list_element(const znode *element TSRMLS_DC);
@@ -229,13 +229,9 @@ ZEND_METHOD(exception, __construct)
 /* {{{ proto Exception::__wakeup()
   Exception unserialize checks */
 #define CHECK_EXC_TYPE(name, type) \
-	value = zend_read_property(default_exception_ce, object, name, sizeof(name)-1, 0 TSRMLS_CC); \
+	value = zend_read_property(default_exception_ce, object, name, sizeof(name)-1, 1 TSRMLS_CC); \
 	if (value && Z_TYPE_P(value) != IS_NULL && Z_TYPE_P(value) != type) { \
-		zval *tmp; \
-		MAKE_STD_ZVAL(tmp); \
-		ZVAL_STRINGL(tmp, name, sizeof(name)-1, 1); \
-		Z_OBJ_HANDLER_P(object, unset_property)(object, tmp, 0 TSRMLS_CC); \
-		zval_ptr_dtor(&tmp); \
+		zend_unset_property(default_exception_ce, object, name, sizeof(name)-1 TSRMLS_CC); \
 	}

 ZEND_METHOD(exception, __wakeup)
@@ -248,7 +244,12 @@ ZEND_METHOD(exception, __wakeup)
 	CHECK_EXC_TYPE("file", IS_STRING);
 	CHECK_EXC_TYPE("line", IS_LONG);
 	CHECK_EXC_TYPE("trace", IS_ARRAY);
-	CHECK_EXC_TYPE("previous", IS_OBJECT);
+	value = zend_read_property(default_exception_ce, object, "previous", sizeof("previous")-1, 1 TSRMLS_CC);
+	if (value && Z_TYPE_P(value) != IS_NULL && (Z_TYPE_P(value) != IS_OBJECT ||
+			!instanceof_function(Z_OBJCE_P(value), default_exception_ce TSRMLS_CC) ||
+			value == object)) {
+		zend_unset_property(default_exception_ce, object, "previous", sizeof("previous")-1 TSRMLS_CC);
+	}
 }
 /* }}} */

@@ -727,7 +728,11 @@ ZEND_METHOD(exception, __toString)
 		zval_dtor(&file);
 		zval_dtor(&line);

-		exception = zend_read_property(default_exception_ce, exception, "previous", sizeof("previous")-1, 0 TSRMLS_CC);
+		Z_OBJPROP_P(exception)->nApplyCount++;
+		exception = zend_read_property(default_exception_ce, exception, "previous", sizeof("previous")-1, 1 TSRMLS_CC);
+		if (exception && Z_TYPE_P(exception) == IS_OBJECT && Z_OBJPROP_P(exception)->nApplyCount > 0) {
+			exception = NULL;
+		}

 		if (trace) {
 			zval_ptr_dtor(&trace);
@@ -736,6 +741,17 @@ ZEND_METHOD(exception, __toString)
 	}
 	zval_dtor(&fname);

+	/* Reset apply counts */
+	exception = getThis();
+	while (exception && Z_TYPE_P(exception) == IS_OBJECT && instanceof_function(Z_OBJCE_P(exception), default_exception_ce TSRMLS_CC)) {
+		if(Z_OBJPROP_P(exception)->nApplyCount) {
+			Z_OBJPROP_P(exception)->nApplyCount--;
+		} else {
+			break;
+		}
+		exception = zend_read_property(default_exception_ce, exception, "previous", sizeof("previous")-1, 1 TSRMLS_CC);
+	}
+
 	/* We store the result in the private property string so we can access
 	 * the result in uncaught exception handlers without memleaks. */
 	zend_update_property_string(default_exception_ce, getThis(), "string", sizeof("string")-1, str TSRMLS_CC);
@@ -893,11 +909,10 @@ static void zend_error_va(int type, const char *file, uint lineno, const char *f
 ZEND_API void zend_exception_error(zval *exception, int severity TSRMLS_DC) /* {{{ */
 {
 	zend_class_entry *ce_exception = Z_OBJCE_P(exception);
+	EG(exception) = NULL;
 	if (instanceof_function(ce_exception, default_exception_ce TSRMLS_CC)) {
 		zval *str, *file, *line;

-		EG(exception) = NULL;
-
 		zend_call_method_with_0_params(&exception, ce_exception, NULL, "__tostring", &str);
 		if (!EG(exception)) {
 			if (Z_TYPE_P(str) != IS_STRING) {
@@ -936,6 +951,7 @@ ZEND_API void zend_exception_error(zval *exception, int severity TSRMLS_DC) /* {
 	} else {
 		zend_error(severity, "Uncaught exception '%s'", ce_exception->name);
 	}
+	zval_ptr_dtor(&exception);
 }
 /* }}} */

@@ -826,7 +826,10 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache TS
 		if (EG(active_op_array)->fn_flags & ZEND_ACC_GENERATOR) {
 			*fci->retval_ptr_ptr = zend_generator_create_zval(EG(active_op_array) TSRMLS_CC);
 		} else {
+			const zend_op *current_opline_before_exception = EG(opline_before_exception);
+
 			zend_execute(EG(active_op_array) TSRMLS_CC);
+			EG(opline_before_exception) = current_opline_before_exception;
 		}

 		if (!fci->symbol_table && EG(active_symbol_table)) {
@@ -53,7 +53,7 @@ static void zend_ini_do_op(char type, zval *result, zval *op1, zval *op2)
 {
 	int i_result;
 	int i_op1, i_op2;
-	char str_result[MAX_LENGTH_OF_LONG];
+	char str_result[MAX_LENGTH_OF_LONG+1];

 	i_op1 = atoi(Z_STRVAL_P(op1));
 	free(Z_STRVAL_P(op1));
@@ -1184,6 +1184,10 @@ ZEND_API zend_function *zend_std_get_static_method(zend_class_entry *ce, const c
 	ALLOCA_FLAG(use_heap)

 	if (EXPECTED(key != NULL)) {
+#if (ZEND_GCC_VERSION == 4009) && !(defined(ZTS) && defined(NETWARE)) && !(defined(ZTS) && defined(HPUX)) && !defined(DARWIN)
+		/* This is a workaround for bug in GCC 4.9.2 */
+		use_heap = 0;
+#endif
 		lc_function_name = Z_STRVAL(key->constant);
 		hash_value = key->hash_value;
 	} else {
@@ -3879,7 +3879,10 @@ ZEND_VM_C_LABEL(num_index):
 		}
 		FREE_OP2();
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((OP1_TYPE == IS_VAR || OP1_TYPE == IS_CV) && opline->extended_value) {
 		FREE_OP1_VAR_PTR();
@@ -4119,7 +4119,10 @@ num_index:
 		}

 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {

@@ -5030,7 +5033,10 @@ num_index:
 		}
 		zval_dtor(free_op2.var);
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {

@@ -5894,7 +5900,10 @@ num_index:
 		}
 		zval_ptr_dtor_nogc(&free_op2.var);
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {

@@ -6614,7 +6623,10 @@ num_index:
 		}

 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {

@@ -7547,7 +7559,10 @@ num_index:
 		}

 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {

@@ -9447,7 +9462,10 @@ num_index:
 		}

 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {

@@ -10314,7 +10332,10 @@ num_index:
 		}
 		zval_dtor(free_op2.var);
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {

@@ -11180,7 +11201,10 @@ num_index:
 		}
 		zval_ptr_dtor_nogc(&free_op2.var);
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {

@@ -11775,7 +11799,10 @@ num_index:
 		}

 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {

@@ -12624,7 +12651,10 @@ num_index:
 		}

 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {

@@ -16107,7 +16137,10 @@ num_index:
 		}

 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
 		if (free_op1.var) {zval_ptr_dtor_nogc(&free_op1.var);};
@@ -18387,7 +18420,10 @@ num_index:
 		}
 		zval_dtor(free_op2.var);
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
 		if (free_op1.var) {zval_ptr_dtor_nogc(&free_op1.var);};
@@ -20725,7 +20761,10 @@ num_index:
 		}
 		zval_ptr_dtor_nogc(&free_op2.var);
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
 		if (free_op1.var) {zval_ptr_dtor_nogc(&free_op1.var);};
@@ -22165,7 +22204,10 @@ num_index:
 		}

 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
 		if (free_op1.var) {zval_ptr_dtor_nogc(&free_op1.var);};
@@ -24220,7 +24262,10 @@ num_index:
 		}

 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
 		if (free_op1.var) {zval_ptr_dtor_nogc(&free_op1.var);};
@@ -33574,7 +33619,10 @@ num_index:
 		}

 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {

@@ -35717,7 +35765,10 @@ num_index:
 		}
 		zval_dtor(free_op2.var);
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {

@@ -37917,7 +37968,10 @@ num_index:
 		}
 		zval_ptr_dtor_nogc(&free_op2.var);
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {

@@ -39225,7 +39279,10 @@ num_index:
 		}

 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {

@@ -41125,7 +41182,10 @@ num_index:
 		}

 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
+		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(&expr_ptr);
+		}
 	}
 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {

@@ -2263,7 +2263,7 @@ AC_DEFUN([PHP_SETUP_KERBEROS],[
  fi

  dnl If krb5-config is found try using it
-  if test "$PHP_KERBEROS" = "yes" && test -x "$KRB5_CONFIG"; then
+  if test "$PHP_KERBEROS" != "no" && test -x "$KRB5_CONFIG"; then
    KERBEROS_LIBS=`$KRB5_CONFIG --libs gssapi`
    KERBEROS_CFLAGS=`$KRB5_CONFIG --cflags gssapi`

@@ -119,8 +119,8 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=6
-PHP_RELEASE_VERSION=27
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=39
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -49,7 +49,10 @@ _bc_new_num_ex (length, scale, persistent)
     int length, scale, persistent;
 {
  bc_num temp;
-
+  /* PHP Change:  add length check */
+  if ((size_t)length+(size_t)scale > INT_MAX) {
+   zend_error(E_ERROR, "Result too long, max is %d", INT_MAX);
+  }
  /* PHP Change:  malloc() -> pemalloc(), removed free_list code */
  temp = (bc_num) safe_pemalloc (1, sizeof(bc_struct)+length, scale, persistent);
 #if 0
@@ -41,6 +41,5 @@

 void bc_out_of_memory (void)
 {
-  (void) fprintf (stderr, "bcmath: out of memory!\n");
-  exit (1);
+  zend_error(E_ERROR, "bcmath: out of memory!");
 }
@@ -513,7 +513,7 @@ static PHP_FUNCTION(bzcompress)
 	dest_len   = (unsigned int) (source_len + (0.01 * source_len) + 600);

 	/* Allocate the destination buffer */
-	dest = emalloc(dest_len + 1);
+	dest = safe_emalloc(dest_len, 1, 1);

 	/* Handle the optional arguments */
 	if (argc > 1) {
@@ -533,7 +533,7 @@ static PHP_FUNCTION(bzcompress)
 		   so we erealloc() the buffer to the proper size */
 		dest = erealloc(dest, dest_len + 1);
 		dest[dest_len] = 0;
-		RETURN_STRINGL(dest, dest_len, 0);
+		RETURN_STRINGL_CHECK(dest, dest_len, 0);
 	}
 }
 /* }}} */
@@ -35,7 +35,7 @@ static void curlfile_ctor(INTERNAL_FUNCTION_PARAMETERS)
 	int fname_len, mime_len, postname_len;
 	zval *cf = return_value;

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|ss", &fname, &fname_len, &mime, &mime_len, &postname, &postname_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|ss", &fname, &fname_len, &mime, &mime_len, &postname, &postname_len) == FAILURE) {
 		return;
 	}

@@ -137,7 +137,10 @@ ZEND_METHOD(CURLFile, setPostFilename)
   Unserialization handler */
 ZEND_METHOD(CURLFile, __wakeup)
 {
-	zend_update_property_string(curl_CURLFile_class, getThis(), "name", sizeof("name")-1, "" TSRMLS_CC);
+	zval *_this = getThis();
+
+	zend_unset_property(curl_CURLFile_class, _this, "name", sizeof("name")-1 TSRMLS_CC);
+	zend_update_property_string(curl_CURLFile_class, _this, "name", sizeof("name")-1, "" TSRMLS_CC);
 	zend_throw_exception(NULL, "Unserialization of CURLFile instances is not allowed", 0 TSRMLS_CC);
 }
 /* }}} */
@@ -0,0 +1,20 @@
+--TEST--
+Bug #73147: Use After Free in PHP7 unserialize()
+--SKIPIF--
+<?php
+if (!extension_loaded("curl")) {
+        exit("skip curl extension not loaded");
+}
+?>
+--FILE--
+<?php
+
+$poc = 'a:1:{i:0;O:8:"CURLFile":1:{s:4:"name";R:1;}}';
+try {
+var_dump(unserialize($poc));
+} catch(Exception $e) {
+	echo $e->getMessage();
+}
+?>
+--EXPECT--
+Unserialization of CURLFile instances is not allowed
@@ -394,8 +394,12 @@ static timelib_sll timelib_meridian(char **ptr, timelib_sll h)
 	}
 	++*ptr;
 	if (**ptr == '.') {
-		*ptr += 3;
-	} else {
+		++*ptr;
+	}
+	if (**ptr == 'M' || **ptr == 'm') {
+		++*ptr;
+	}
+	if (**ptr == '.') {
 		++*ptr;
 	}
 	return retval;
@@ -895,7 +899,7 @@ datefull         = day ([ \t.-])* monthtext ([ \t.-])* year;
 datenoday        = monthtext ([ .\t-])* year4;
 datenodayrev     = year4 ([ .\t-])* monthtext;
 datetextual      = monthtext ([ .\t-])* day [,.stndrh\t ]+ year;
-datenoyear       = monthtext ([ .\t-])* day [,.stndrh\t ]*;
+datenoyear       = monthtext ([ .\t-])* day ([,.stndrh\t ]+|[\000]);
 datenoyearrev    = day ([ .\t-])* monthtext;
 datenocolon      = year4 monthlz daylz;

@@ -913,8 +917,8 @@ isoweek          = year4 "-"? "W" weekofyear;
 exif             = year4 ":" monthlz ":" daylz " " hour24lz ":" minutelz ":" secondlz;
 firstdayof       = 'first day of';
 lastdayof        = 'last day of';
-backof           = 'back of ' hour24 space? meridian?;
-frontof          = 'front of ' hour24 space? meridian?;
+backof           = 'back of ' hour24 (space? meridian)?;
+frontof          = 'front of ' hour24 (space? meridian)?;

 /* Common Log Format: 10/Oct/2000:13:55:36 -0700 */
 clf              = day "/" monthabbr "/" year4 ":" hour24lz ":" minutelz ":" secondlz space tzcorrection;
@@ -75,8 +75,8 @@ result = Monday 1983-04-18 01:00:00 CEST
 wanted = Monday            00:00:00

 Asia/Yerevan
-ts     = Monday 2037-10-19 17:17:17 AMT
-result = Monday 2037-10-26 00:00:00 AMT
+ts     = Monday 2037-10-19 17:17:17 +04
+result = Monday 2037-10-26 00:00:00 +04
 wanted = Monday            00:00:00

 America/Curacao
@@ -115,8 +115,8 @@ result = Monday 1971-04-05 00:00:00 AST
 wanted = Monday            00:00:00

 Asia/Baku
-ts     = Friday 1971-01-01 17:17:17 BAKT
-result = Monday 1971-01-04 00:00:00 BAKT
+ts     = Friday 1971-01-01 17:17:17 +04
+result = Monday 1971-01-04 00:00:00 +04
 wanted = Monday            00:00:00

 Europe/Sarajevo
@@ -165,6 +165,6 @@ result = Monday 1980-04-07 00:00:00 CEST
 wanted = Monday            00:00:00

 Asia/Baku
-ts     = Monday 1995-12-25 17:17:17 AZT
-result = Monday 1996-01-01 00:00:00 AZT
+ts     = Monday 1995-12-25 17:17:17 +04
+result = Monday 1996-01-01 00:00:00 +04
 wanted = Monday            00:00:00
@@ -226,8 +226,8 @@ result=Thursday 1980-04-10 00:00:00 CEST 1
 wanted=Thursday             00:00:00

 TZ=Asia/Baku - wrong day.
-tStamp=Sunday 1992-09-20 17:17:17 AZST 1
-result=Monday 1992-09-28 00:00:00 AZT 0
+tStamp=Sunday 1992-09-20 17:17:17 +04 1
+result=Monday 1992-09-28 00:00:00 +04 0
 wanted=Monday              00:00:00

 TZ=America/Noronha - wrong day.
@@ -28,6 +28,6 @@ result=Monday 1990-10-22 00:00:00 WART 0
 wanted=Monday            00:00:00

 TZ=Asia/Tbilisi - Is it OK for this to be 2 AM?
-tStamp=Sunday 2005-03-20 17:17:17 GET 0
-result=Sunday 2005-03-27 00:00:00 GET 0
+tStamp=Sunday 2005-03-20 17:17:17 +03 0
+result=Sunday 2005-03-27 00:00:00 +03 0
 wanted=Sunday            00:00:00
@@ -40,7 +40,7 @@ object(DateInterval)#%d (15) {
  ["special_amount"]=>
  int(-1)
  ["have_weekday_relative"]=>
-  int(9)
+  int(%d)
  ["have_special_relative"]=>
  int(0)
 }
@@ -34,14 +34,14 @@ foreach ( $tests as $start => $data )
 echo "\n";
 ?>
 --EXPECT--
-Sat, 23 Oct 2010 00:00:00 +0000
+Fri, 15 Oct 2010 23:00:00 +0000
 Wed, 15 Dec 2010 16:15:00 +0000
 Mon, 20 Dec 2010 00:00:00 +0000
 Mon, 20 Dec 2010 10:00:00 +0000
 Tue, 21 Dec 2010 12:00:00 +0000
 Mon, 03 Jan 2011 00:00:00 +0000
 Mon, 03 Jan 2011 09:00:00 +0000
-Sat, 23 Oct 2010 00:00:00 +0100
+Fri, 15 Oct 2010 23:00:00 +0100
 Sun, 28 Mar 2010 00:15:00 +0000
 Sun, 28 Mar 2010 02:15:00 +0100
 Sun, 28 Mar 2010 02:15:00 +0100
@@ -1792,7 +1792,7 @@ PHP_FUNCTION(dom_document_savexml)
 		if (options & LIBXML_SAVE_NOEMPTYTAG) {
 			xmlSaveNoEmptyTags = saveempty;
 		}
-		if (!size) {
+		if (!size || !mem) {
 			RETURN_FALSE;
 		}
 		RETVAL_STRINGL(mem, size, 1);
@@ -2327,7 +2327,7 @@ PHP_FUNCTION(dom_document_save_html)
 #else
 		htmlDocDumpMemory(docp, &mem, &size);
 #endif
-		if (!size) {
+		if (!size || !mem) {
 			RETVAL_FALSE;
 		} else {
 			RETVAL_STRINGL((const char*) mem, size, 1);
@@ -14,7 +14,7 @@
   +----------------------------------------------------------------------+
   | Authors: Rasmus Lerdorf <rasmus@php.net>                             |
   |          Jim Winstead <jimw@php.net>                                 |
-   |          Jaakko Hyvätti <jaakko@hyvatti.iki.fi>                      | 
+   |          Jaakko Hyvätti <jaakko@hyvatti.iki.fi>                      |
   +----------------------------------------------------------------------+
 */
 /* $Id$ */
@@ -29,7 +29,7 @@
 /* {{{ arginfo */
 ZEND_BEGIN_ARG_INFO_EX(arginfo_ereg, 0, 0, 2)
 	ZEND_ARG_INFO(0, pattern)
-	ZEND_ARG_INFO(0, string) 
+	ZEND_ARG_INFO(0, string)
 	ZEND_ARG_INFO(1, registers) /* ARRAY_INFO(1, registers, 1) */
 ZEND_END_ARG_INFO()

@@ -41,8 +41,8 @@ ZEND_END_ARG_INFO()

 ZEND_BEGIN_ARG_INFO_EX(arginfo_split, 0, 0, 2)
 	ZEND_ARG_INFO(0, pattern)
-	ZEND_ARG_INFO(0, string) 
-	ZEND_ARG_INFO(0, limit)  
+	ZEND_ARG_INFO(0, string)
+	ZEND_ARG_INFO(0, limit)
 ZEND_END_ARG_INFO()

 ZEND_BEGIN_ARG_INFO(arginfo_sql_regcase, 0)
@@ -204,7 +204,7 @@ static int _php_regcomp(regex_t *preg, const char *pattern, int cflags TSRMLS_DC
 }
 /* }}} */

-static void _free_ereg_cache(reg_cache *rc) 
+static void _free_ereg_cache(reg_cache *rc)
 {
 	regfree(&rc->preg);
 }
@@ -309,7 +309,7 @@ static void php_ereg(INTERNAL_FUNCTION_PARAMETERS, int icase)
 	if (icase) {
 		copts |= REG_ICASE;
 	}
-	
+
 	if (argc == 2) {
 		copts |= REG_NOSUB;
 	}
@@ -337,7 +337,7 @@ static void php_ereg(INTERNAL_FUNCTION_PARAMETERS, int icase)

 	/* allocate storage for (sub-)expression-matches */
 	subs = (regmatch_t *)ecalloc(sizeof(regmatch_t),re.re_nsub+1);
-	
+
 	/* actually execute the regular expression */
 	err = regexec(&re, string, re.re_nsub+1, subs, 0);
 	if (err && err != REG_NOMATCH) {
@@ -409,8 +409,8 @@ PHP_EREG_API char *php_ereg_replace(const char *pattern, const char *replace, co
 		 *nbuf,	/* nbuf is used when we grow the buffer */
 		 *walkbuf; /* used to walk buf when replacing backrefs */
 	const char *walk; /* used to walk replacement string for backrefs */
-	int buf_len;
-	int pos, tmp, string_len, new_l;
+	size_t buf_len, new_l;
+	int pos, tmp, string_len;
 	int err, copts = 0;

 	string_len = strlen(string);
@@ -434,8 +434,8 @@ PHP_EREG_API char *php_ereg_replace(const char *pattern, const char *replace, co

 	/* start with a buffer that is twice the size of the stringo
 	   we're doing replacements in */
+	buf = safe_emalloc(string_len, 2, 1);
 	buf_len = 2 * string_len + 1;
-	buf = safe_emalloc(buf_len, sizeof(char), 0);

 	err = pos = 0;
 	buf[0] = '\0';
@@ -472,8 +472,8 @@ PHP_EREG_API char *php_ereg_replace(const char *pattern, const char *replace, co
 				}
 			}
 			if (new_l + 1 > buf_len) {
+				nbuf = safe_emalloc(new_l + 1, 2, buf_len);
 				buf_len = 1 + buf_len + 2 * new_l;
-				nbuf = emalloc(buf_len);
 				strncpy(nbuf, buf, buf_len - 1);
 				nbuf[buf_len - 1] = '\0';
 				efree(buf);
@@ -491,7 +491,7 @@ PHP_EREG_API char *php_ereg_replace(const char *pattern, const char *replace, co
 					if (subs[walk[1] - '0'].rm_so > -1 && subs[walk[1] - '0'].rm_eo > -1
 						/* this next case shouldn't happen. it does. */
 						&& subs[walk[1] - '0'].rm_so <= subs[walk[1] - '0'].rm_eo) {
-						
+
 						tmp = subs[walk[1] - '0'].rm_eo - subs[walk[1] - '0'].rm_so;
 						memcpy (walkbuf, &string[pos + subs[walk[1] - '0'].rm_so], tmp);
 						walkbuf += tmp;
@@ -510,8 +510,8 @@ PHP_EREG_API char *php_ereg_replace(const char *pattern, const char *replace, co
 				}
 				new_l = strlen (buf) + 1;
 				if (new_l + 1 > buf_len) {
+					nbuf = safe_emalloc(new_l + 1, 2, buf_len);
 					buf_len = 1 + buf_len + 2 * new_l;
-					nbuf = safe_emalloc(buf_len, sizeof(char), 0);
 					strncpy(nbuf, buf, buf_len-1);
 					efree(buf);
 					buf = nbuf;
@@ -526,7 +526,7 @@ PHP_EREG_API char *php_ereg_replace(const char *pattern, const char *replace, co
 			new_l = strlen(buf) + strlen(&string[pos]);
 			if (new_l + 1 > buf_len) {
 				buf_len = new_l + 1; /* now we know exactly how long it is */
-				nbuf = safe_emalloc(buf_len, sizeof(char), 0);
+				nbuf = safe_emalloc(new_l, 1, 1);
 				strncpy(nbuf, buf, buf_len-1);
 				efree(buf);
 				buf = nbuf;
@@ -556,7 +556,7 @@ static void php_do_ereg_replace(INTERNAL_FUNCTION_PARAMETERS, int icase)
 	char *replace;
 	char *ret;
 	int arg_string_len;
-	
+
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ZZs", &arg_pattern, &arg_replace, &arg_string, &arg_string_len) == FAILURE) {
 		return;
 	}
@@ -598,7 +598,7 @@ static void php_do_ereg_replace(INTERNAL_FUNCTION_PARAMETERS, int icase)
 	if (ret == (char *) -1) {
 		RETVAL_FALSE;
 	} else {
-		RETVAL_STRING(ret, 1);
+		RETVAL_STRINGL_CHECK(ret, strlen(ret), 1);
 		STR_FREE(ret);
 	}

@@ -664,9 +664,9 @@ static void php_split(INTERNAL_FUNCTION_PARAMETERS, int icase)
 		} else if (subs[0].rm_so == 0 && subs[0].rm_eo == 0) {
 			/* No more matches */
 			regfree(&re);
-			
+
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid Regular Expression");
-			
+
 			zend_hash_destroy(Z_ARRVAL_P(return_value));
 			efree(Z_ARRVAL_P(return_value));
 			RETURN_FALSE;
@@ -675,7 +675,7 @@ static void php_split(INTERNAL_FUNCTION_PARAMETERS, int icase)

 			/* make a copy of the substring */
 			size = subs[0].rm_so;
-		
+
 			/* add it to the array */
 			add_next_index_stringl(return_value, strp, size, 1);

@@ -701,7 +701,7 @@ static void php_split(INTERNAL_FUNCTION_PARAMETERS, int icase)

 	/* otherwise we just have one last element to add to the array */
 	size = endp - strp;
-	
+
 	add_next_index_stringl(return_value, strp, size, 1);

 	regfree(&re);
@@ -738,9 +738,9 @@ PHP_EREG_API PHP_FUNCTION(sql_regcase)
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &string, &string_len) == FAILURE) {
 		return;
 	}
-	
+
 	tmp = safe_emalloc(string_len, 4, 1);
-	
+
 	for (i = j = 0; i < string_len; i++) {
 		c = (unsigned char) string[i];
 		if ( j >= INT_MAX - 1 || (isalpha(c) && j >= INT_MAX - 4)) {
@@ -1303,7 +1303,7 @@ static size_t exif_convert_any_to_int(void *value, int format, int motorola_inte
 			if (s_den == 0) {
 				return 0;
 			} else {
-				return php_ifd_get32s(value, motorola_intel) / s_den;
+				return (size_t)((double)php_ifd_get32s(value, motorola_intel) / s_den);
 			}

 		case TAG_FMT_SSHORT:    return php_ifd_get16u(value, motorola_intel);
@@ -1710,7 +1710,7 @@ static void exif_iif_add_value(image_info_type *image_info, int section_index, c
 		case TAG_FMT_UNDEFINED:
 			if (value) {
 				if (tag == TAG_MAKER_NOTE) {
-					length = MIN(length, strlen(value));
+					length = (int) php_strnlen(value, length);
 				}

 				/* do not recompute length here */
@@ -2545,7 +2545,10 @@ static void exif_thumbnail_extract(image_info_type *ImageInfo, char *offset, siz
 		return;
 	}
 	/* Check to make sure we are not going to go past the ExifLength */
-	if ((ImageInfo->Thumbnail.offset + ImageInfo->Thumbnail.size) > length) {
+	if (ImageInfo->Thumbnail.size > length
+		|| (ImageInfo->Thumbnail.offset + ImageInfo->Thumbnail.size) > length
+		|| ImageInfo->Thumbnail.offset > length - ImageInfo->Thumbnail.size
+	) {
 		EXIF_ERRLOG_THUMBEOF(ImageInfo)
 		return;
 	}
@@ -2725,6 +2728,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 	int NumDirEntries, old_motorola_intel, offset_diff;
 	const maker_note_type *maker_note;
 	char *dir_start;
+	int data_len;

 	for (i=0; i<=sizeof(maker_note_array)/sizeof(maker_note_type); i++) {
 		if (i==sizeof(maker_note_array)/sizeof(maker_note_type)) {
@@ -2779,6 +2783,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 	switch (maker_note->offset_mode) {
 		case MN_OFFSET_MAKER:
 			offset_base = value_ptr;
+			data_len = value_len;
 			break;
 		case MN_OFFSET_GUESS:
 			if (maker_note->offset + 10 + 4 >= value_len) {
@@ -2795,6 +2800,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 				return FALSE;
 			}
 			offset_base = value_ptr + offset_diff;
+			data_len = value_len - offset_diff;
 			break;
 		default:
 		case MN_OFFSET_NORMAL:
@@ -2808,7 +2814,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu

 	for (de=0;de<NumDirEntries;de++) {
 		if (!exif_process_IFD_TAG(ImageInfo, dir_start + 2 + 12 * de,
-								  offset_base, IFDlength, displacement, section_index, 0, maker_note->tag_table TSRMLS_CC)) {
+								  offset_base, data_len, displacement, section_index, 0, maker_note->tag_table TSRMLS_CC)) {
 			return FALSE;
 		}
 	}
@@ -2855,7 +2861,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 	}

 	if (components < 0) {
-		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal components(%ld)", tag, exif_get_tagname(tag, tagname, -12, tag_table TSRMLS_CC), components);
+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal components(%d)", tag, exif_get_tagname(tag, tagname, -12, tag_table TSRMLS_CC), components);
 		return FALSE;
 	}

@@ -4210,7 +4216,7 @@ PHP_FUNCTION(exif_imagetype)
 	php_stream * stream;
 	int itype = 0;

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &imagefile, &imagefile_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &imagefile, &imagefile_len) == FAILURE) {
 		return;
 	}

@@ -0,0 +1,12 @@
+--TEST--
+Bug #73737 (Crash when parsing a tag format)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+	$exif = exif_thumbnail(__DIR__ . '/bug73737.tiff');
+	var_dump($exif);
+?>
+--EXPECTF--
+Warning: exif_thumbnail(bug73737.tiff): Error in TIFF: filesize(x0030) less than start of IFD dir(x10102) in %s line %d
+bool(false)
@@ -0,0 +1,20 @@
+--TEST--
+Bug #76130 (Heap Buffer Overflow (READ: 1786) in exif_iif_add_value)
+--DESCRIPTION--
+This test is meant to exhibit memory issues with the `-m` option. Since a lot of
+notices and warnings are to be expected anyway, we suppress these, since the are
+not relevant for this test.
+--INI--
+error_reporting=E_ALL & ~E_WARNING & ~E_NOTICE
+--SKIPIF--
+<?php
+if (!extension_loaded('exif')) die('skip exif extension not available');
+?>
+--FILE--
+<?php
+exif_read_data(__DIR__ . '/bug76130_1.jpg');
+exif_read_data(__DIR__ . '/bug76130_2.jpg');
+?>
+===DONE===
+--EXPECT--
+===DONE===
@@ -0,0 +1,19 @@
+--TEST--
+Bug #76423 (Int Overflow lead to Heap OverFlow in exif_thumbnail_extract of exif.c)
+--SKIPIF--
+<?php
+if (!extension_loaded('exif')) die('skip exif extension not available');
+?>
+--FILE--
+<?php
+exif_read_data(__DIR__ . '/bug76423.jpg', 0, true, true);
+?>
+===DONE===
+--EXPECTF--
+
+Warning: exif_read_data(%s.jpg): Thumbnail goes IFD boundary or end of file reached in %s on line %d
+
+Warning: exif_read_data(%s.jpg): File structure corrupted in %s on line %d
+
+Warning: exif_read_data(%s.jpg): Invalid JPEG file in %s on line %d
+===DONE===
@@ -0,0 +1,79 @@
+--TEST--
+Bug 76557 (heap-buffer-overflow (READ of size 48) while reading exif data)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+var_dump(count(exif_read_data(dirname(__FILE__) . "/bug76557.jpg")));
+?>
+DONE
+--EXPECTF--
+Warning: exif_read_data(bug76557.jpg): Process tag(x010F=Make       ): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x8769=Exif_IFD_Po): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x927C=MakerNote  ): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal pointer offset(x30303030 + x30303030 = x60606060 > x00EE) in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): File structure corrupted in %sbug76557.php on line %d
+
+Warning: exif_read_data(bug76557.jpg): Invalid JPEG file in %sbug76557.php on line %d
+int(1)
+DONE
@@ -142,23 +142,23 @@ Warning: exif_imagetype(0.5): failed to open stream: No such file or directory i
 bool(false)
 -- Iteration 10 --

-Warning: exif_imagetype() expects parameter 1 to be string, array given in %s on line %d
+Warning: exif_imagetype() expects parameter 1 to be a valid path, array given in %s on line %d
 NULL
 -- Iteration 11 --

-Warning: exif_imagetype() expects parameter 1 to be string, array given in %s on line %d
+Warning: exif_imagetype() expects parameter 1 to be a valid path, array given in %s on line %d
 NULL
 -- Iteration 12 --

-Warning: exif_imagetype() expects parameter 1 to be string, array given in %s on line %d
+Warning: exif_imagetype() expects parameter 1 to be a valid path, array given in %s on line %d
 NULL
 -- Iteration 13 --

-Warning: exif_imagetype() expects parameter 1 to be string, array given in %s on line %d
+Warning: exif_imagetype() expects parameter 1 to be a valid path, array given in %s on line %d
 NULL
 -- Iteration 14 --

-Warning: exif_imagetype() expects parameter 1 to be string, array given in %s on line %d
+Warning: exif_imagetype() expects parameter 1 to be a valid path, array given in %s on line %d
 NULL
 -- Iteration 15 --

@@ -198,7 +198,7 @@ Warning: exif_imagetype(obj'ct): failed to open stream: No such file or director
 bool(false)
 -- Iteration 24 --

-Warning: exif_imagetype() expects parameter 1 to be string, resource given in %s on line %d
+Warning: exif_imagetype() expects parameter 1 to be a valid path, resource given in %s on line %d
 NULL
 -- Iteration 25 --

@@ -2614,11 +2614,11 @@ static void _php_image_output(INTERNAL_FUNCTION_PARAMETERS, int image_type, char

 	if (argc > 1) {
 		fn = file;
-		if (argc == 3) {
+		if (argc >= 3) {
 			q = quality;
-		}
-		if (argc == 4) {
-			t = type;
+			if (argc == 4) {
+				t = type;
+			}
 		}
 	}

@@ -3854,7 +3854,7 @@ static void php_imagettftext_common(INTERNAL_FUNCTION_PARAMETERS, int mode, int
 {
 	zval *IM, *EXT = NULL;
 	gdImagePtr im=NULL;
-	long col = -1, x = -1, y = -1;
+	long col = -1, x = 0, y = 0;
 	int str_len, fontname_len, i, brect[8];
 	double ptsize, angle;
 	char *str = NULL, *fontname = NULL;
@@ -5175,7 +5175,7 @@ PHP_FUNCTION(imagescale)
 	gdImagePtr im_scaled = NULL;
 	int new_width, new_height;
 	long tmp_w, tmp_h=-1, tmp_m = GD_BILINEAR_FIXED;
-	gdInterpolationMethod method;
+	gdInterpolationMethod method, old_method;

 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rl|ll", &IM, &tmp_w, &tmp_h, &tmp_m) == FAILURE)  {
 		return;
@@ -5202,9 +5202,12 @@ PHP_FUNCTION(imagescale)
 	new_width = tmp_w;
 	new_height = tmp_h;

+	/* gdImageGetInterpolationMethod() is only available as of GD 2.1.1 */
+	old_method = im->interpolation_id;
 	if (gdImageSetInterpolationMethod(im, method)) {
 		im_scaled = gdImageScale(im, new_width, new_height);
 	}
+	gdImageSetInterpolationMethod(im, old_method);

 	if (im_scaled == NULL) {
 		RETURN_FALSE;
@@ -61,6 +61,16 @@ static int _php_image_stream_putbuf(struct gdIOCtx *ctx, const void* buf, int l)
 }

 static void _php_image_stream_ctxfree(struct gdIOCtx *ctx)
+{
+	if(ctx->data) {
+		ctx->data = NULL;
+	}
+	if(ctx) {
+		efree(ctx);
+	}
+} /* }}} */
+
+static void _php_image_stream_ctxfreeandclose(struct gdIOCtx *ctx) /* {{{ */
 {
 	TSRMLS_FETCH();

@@ -87,6 +97,7 @@ static void _php_image_output_ctx(INTERNAL_FUNCTION_PARAMETERS, int image_type,
 	gdIOCtx *ctx = NULL;
 	zval *to_zval = NULL;
 	php_stream *stream;
+	int close_stream = 1;

 	/* The third (quality) parameter for Wbmp stands for the threshold when called from image2wbmp().
 	 * The third (quality) parameter for Wbmp and Xbm stands for the foreground color index when called
@@ -123,6 +134,7 @@ static void _php_image_output_ctx(INTERNAL_FUNCTION_PARAMETERS, int image_type,
 			if (stream == NULL) {
 				RETURN_FALSE;
 			}
+			close_stream = 0;
 		} else if (Z_TYPE_P(to_zval) == IS_STRING) {
 			if (CHECK_ZVAL_NULL_PATH(to_zval)) {
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid 2nd parameter, filename must not contain null bytes");
@@ -159,7 +171,11 @@ static void _php_image_output_ctx(INTERNAL_FUNCTION_PARAMETERS, int image_type,
 		ctx = emalloc(sizeof(gdIOCtx));
 		ctx->putC = _php_image_stream_putc;
 		ctx->putBuf = _php_image_stream_putbuf;
-		ctx->gd_free = _php_image_stream_ctxfree;
+		if (close_stream) {
+			ctx->gd_free = _php_image_stream_ctxfreeandclose;
+		} else {
+			ctx->gd_free = _php_image_stream_ctxfree;
+		}
 		ctx->data = (void *)stream;
 	}

@@ -1117,7 +1117,7 @@ void gdImageLine (gdImagePtr im, int x1, int y1, int x2, int y2, int color)
 	}

 	/* 2.0.10: Nick Atty: clip to edges of drawing rectangle, return if no points need to be drawn */
-	if (!clip_1d(&x1,&y1,&x2,&y2,gdImageSX(im)) || !clip_1d(&y1,&x1,&y2,&x2,gdImageSY(im))) {
+	if (!clip_1d(&x1,&y1,&x2,&y2,gdImageSX(im)-1) || !clip_1d(&y1,&x1,&y2,&x2,gdImageSY(im)-1)) {
 		return;
 	}

@@ -1298,58 +1298,13 @@ inline static void gdImageSetAAPixelColor(gdImagePtr im, int x, int y, int color
 void gdImageAALine (gdImagePtr im, int x1, int y1, int x2, int y2, int col)
 {
 	/* keep them as 32bits */
-	long x, y, inc;
+	long x, y, inc, frac;
 	long dx, dy,tmp;

-	if (y1 < 0 && y2 < 0) {
+	/* 2.0.10: Nick Atty: clip to edges of drawing rectangle, return if no points need to be drawn */
+	if (!clip_1d(&x1,&y1,&x2,&y2,gdImageSX(im)-1) || !clip_1d(&y1,&x1,&y2,&x2,gdImageSY(im)-1)) {
 		return;
 	}
-	if (y1 < 0) {
-		x1 += (y1 * (x1 - x2)) / (y2 - y1);
-		y1 = 0;
-	}
-	if (y2 < 0) {
-		x2 += (y2 * (x1 - x2)) / (y2 - y1);
-		y2 = 0;
-	}
-
-	/* bottom edge */
-	if (y1 >= im->sy && y2 >= im->sy) {
-		return;
-	}
-	if (y1 >= im->sy) {
-		x1 -= ((im->sy - y1) * (x1 - x2)) / (y2 - y1);
-		y1 = im->sy - 1;
-	}
-	if (y2 >= im->sy) {
-		x2 -= ((im->sy - y2) * (x1 - x2)) / (y2 - y1);
-		y2 = im->sy - 1;
-	}
-
-	/* left edge */
-	if (x1 < 0 && x2 < 0) {
-		return;
-	}
-	if (x1 < 0) {
-		y1 += (x1 * (y1 - y2)) / (x2 - x1);
-		x1 = 0;
-	}
-	if (x2 < 0) {
-		y2 += (x2 * (y1 - y2)) / (x2 - x1);
-		x2 = 0;
-	}
-	/* right edge */
-	if (x1 >= im->sx && x2 >= im->sx) {
-		return;
-	}
-	if (x1 >= im->sx) {
-		y1 -= ((im->sx - x1) * (y1 - y2)) / (x2 - x1);
-		x1 = im->sx - 1;
-	}
-	if (x2 >= im->sx) {
-		y2 -= ((im->sx - x2) * (y1 - y2)) / (x2 - x1);
-		x2 = im->sx - 1;
-	}

 	dx = x2 - x1;
 	dy = y2 - y1;
@@ -1368,16 +1323,22 @@ void gdImageAALine (gdImagePtr im, int x1, int y1, int x2, int y2, int col)
 			dx = x2 - x1;
 			dy = y2 - y1;
 		}
-		x = x1 << 16;
-		y = y1 << 16;
+		y = y1;
 		inc = (dy * 65536) / dx;
-		while ((x >> 16) <= x2) {
-			gdImageSetAAPixelColor(im, x >> 16, y >> 16, col, (y >> 8) & 0xFF);
-			if ((y >> 16) + 1 < im->sy) {
-				gdImageSetAAPixelColor(im, x >> 16, (y >> 16) + 1,col, (~y >> 8) & 0xFF);
+		frac = 0;
+		for (x = x1; x <= x2; x++) {
+			gdImageSetAAPixelColor(im, x, y, col, (frac >> 8) & 0xFF);
+			if (y + 1 < im->sy) {
+				gdImageSetAAPixelColor(im, x, y + 1, col, (~frac >> 8) & 0xFF);
+			}
+			frac += inc;
+			if (frac >= 65536) {
+				frac -= 65536;
+				y++;
+			} else if (frac < 0) {
+				frac += 65536;
+				y--;
 			}
-			x += (1 << 16);
-			y += inc;
 		}
 	} else {
 		if (dy < 0) {
@@ -1390,16 +1351,22 @@ void gdImageAALine (gdImagePtr im, int x1, int y1, int x2, int y2, int col)
 			dx = x2 - x1;
 			dy = y2 - y1;
 		}
-		x = x1 << 16;
-		y = y1 << 16;
+		x = x1;
 		inc = (dx * 65536) / dy;
-		while ((y>>16) <= y2) {
-			gdImageSetAAPixelColor(im, x >> 16, y >> 16, col, (x >> 8) & 0xFF);
-			if ((x >> 16) + 1 < im->sx) {
-				gdImageSetAAPixelColor(im, (x >> 16) + 1, (y >> 16),col, (~x >> 8) & 0xFF);
+		frac = 0;
+		for (y = y1; y <= y2; y++) {
+			gdImageSetAAPixelColor(im, x, y, col, (frac >> 8) & 0xFF);
+			if (x + 1 < im->sx) {
+				gdImageSetAAPixelColor(im, x + 1, y, col, (~frac >> 8) & 0xFF);
+			}
+			frac += inc;
+			if (frac >= 65536) {
+				frac -= 65536;
+				x++;
+			} else if (frac < 0) {
+				frac += 65536;
+				x--;
 			}
-			x += inc;
-			y += (1<<16);
 		}
 	}
 }
@@ -1780,7 +1747,7 @@ void gdImageFillToBorder (gdImagePtr im, int x, int y, int border, int color)
 	int leftLimit = -1, rightLimit;
 	int i, restoreAlphaBlending = 0;

-	if (border < 0) {
+	if (border < 0 || color < 0) {
 		/* Refuse to fill to a non-solid border */
 		return;
 	}
@@ -243,6 +243,10 @@ gdImagePtr gdImageCropThreshold(gdImagePtr im, const unsigned int color, const f
 		return NULL;
 	}

+	if (!gdImageTrueColor(im) && color >= gdImageColorsTotal(im)) {
+		return NULL;
+	}
+
 	/* TODO: Add gdImageGetRowPtr and works with ptr at the row level
 	 * for the true color and palette images
 	 * new formats will simply work with ptr
@@ -136,6 +136,10 @@ static int _gd2GetHeader(gdIOCtxPtr in, int *sx, int *sy, int *cs, int *vers, in
 	GD2_DBG(php_gd_error("%d Chunks vertically", *ncy));

 	if (gd2_compressed(*fmt)) {
+		if (*ncx <= 0 || *ncy <= 0 || *ncx > INT_MAX / *ncy) {
+			GD2_DBG(printf ("Illegal chunk counts: %d * %d\n", *ncx, *ncy));
+			goto fail1;
+		}
 		nc = (*ncx) * (*ncy);
 		GD2_DBG(php_gd_error("Reading %d chunk index entries", nc));
 		if (overflow2(sizeof(t_chunk_info), nc)) {
@@ -191,21 +195,21 @@ static gdImagePtr _gd2CreateFromFile (gdIOCtxPtr in, int *sx, int *sy, int *cs,
 	}
 	if (im == NULL) {
 		GD2_DBG(php_gd_error("Could not create gdImage"));
-		goto fail1;
+		goto fail2;
 	}

 	if (!_gdGetColors(in, im, (*vers) == 2)) {
 		GD2_DBG(php_gd_error("Could not read color palette"));
-		goto fail2;
+		goto fail3;
 	}
 	GD2_DBG(php_gd_error("Image palette completed: %d colours", im->colorsTotal));

 	return im;

-fail2:
+fail3:
 	gdImageDestroy(im);
-	return 0;
-
+fail2:
+	gdFree(*cidx);
 fail1:
 	return 0;
 }
@@ -340,12 +344,16 @@ gdImagePtr gdImageCreateFromGd2Ctx (gdIOCtxPtr in)
 					for (x = xlo; x < xhi; x++) {
 						if (im->trueColor) {
 							if (!gdGetInt(&im->tpixels[y][x], in)) {
-								im->tpixels[y][x] = 0;
+								php_gd_error("gd2: EOF while reading\n");
+								gdImageDestroy(im);
+								return NULL;
 							}
 						} else {
 							int ch;
 							if (!gdGetByte(&ch, in)) {
-								ch = 0;
+								php_gd_error("gd2: EOF while reading\n");
+								gdImageDestroy(im);
+								return NULL;
 							}
 							im->pixels[y][x] = ch;
 						}
@@ -670,7 +678,7 @@ static void _gdImageGd2 (gdImagePtr im, gdIOCtx * out, int cs, int fmt)

 	/* Force fmt to a valid value since we don't return anything. */
 	if ((fmt != GD2_FMT_RAW) && (fmt != GD2_FMT_COMPRESSED)) {
-		fmt = im->trueColor ? GD2_FMT_TRUECOLOR_COMPRESSED : GD2_FMT_COMPRESSED;
+		fmt = GD2_FMT_COMPRESSED;
 	}
 	if (im->trueColor) {
 		fmt += 2;
@@ -689,8 +697,8 @@ static void _gdImageGd2 (gdImagePtr im, gdIOCtx * out, int cs, int fmt)
 	}

 	/* Work out number of chunks. */
-	ncx = im->sx / cs + 1;
-	ncy = im->sy / cs + 1;
+	ncx = (im->sx + cs - 1) / cs;
+	ncy = (im->sy + cs - 1) / cs;

 	/* Write the standard header. */
 	_gd2PutHeader (im, out, cs, fmt, ncx, ncy);
@@ -147,6 +147,9 @@ gdImagePtr gdImageCreateFromGifCtx(gdIOCtxPtr fd) /* {{{ */
 	int haveGlobalColormap;
 	gdImagePtr im = 0;

+	memset(ColorMap, 0, 3 * MAXCOLORMAPSIZE);
+	memset(localColorMap, 0, 3 * MAXCOLORMAPSIZE);
+
 	/*1.4//imageNumber = 1; */
 	if (! ReadOK(fd,buf,6)) {
 		return 0;
@@ -258,10 +261,6 @@ terminated:
 	if (!im) {
 		return 0;
 	}
-	if (!im->colorsTotal) {
-		gdImageDestroy(im);
-		return 0;
-	}
 	/* Check for open colors at the end, so
 	   we can reduce colorsTotal and ultimately
 	   BitsPerPixel */
@@ -272,6 +271,10 @@ terminated:
 			break;
 		}
 	}
+	if (!im->colorsTotal) {
+		gdImageDestroy(im);
+		return 0;
+	}
 	return im;
 }
 /* }}} */
@@ -372,7 +375,7 @@ static int
 GetCode_(gdIOCtx *fd, CODE_STATIC_DATA *scd, int code_size, int flag, int *ZeroDataBlockP)
 {
 	int           i, j, ret;
-	unsigned char count;
+	int           count;

 	if (flag) {
 		scd->curbit = 0;
@@ -1331,10 +1331,10 @@ static gdImagePtr gdImageScaleBilinearPalette(gdImagePtr im, const unsigned int
 			f_a4 = gd_itofx(gdTrueColorGetAlpha(pixel4));

 			{
-				const char red = (char) gd_fxtoi(gd_mulfx(f_w1, f_r1) + gd_mulfx(f_w2, f_r2) + gd_mulfx(f_w3, f_r3) + gd_mulfx(f_w4, f_r4));
-				const char green = (char) gd_fxtoi(gd_mulfx(f_w1, f_g1) + gd_mulfx(f_w2, f_g2) + gd_mulfx(f_w3, f_g3) + gd_mulfx(f_w4, f_g4));
-				const char blue = (char) gd_fxtoi(gd_mulfx(f_w1, f_b1) + gd_mulfx(f_w2, f_b2) + gd_mulfx(f_w3, f_b3) + gd_mulfx(f_w4, f_b4));
-				const char alpha = (char) gd_fxtoi(gd_mulfx(f_w1, f_a1) + gd_mulfx(f_w2, f_a2) + gd_mulfx(f_w3, f_a3) + gd_mulfx(f_w4, f_a4));
+				const unsigned char red = (unsigned char) gd_fxtoi(gd_mulfx(f_w1, f_r1) + gd_mulfx(f_w2, f_r2) + gd_mulfx(f_w3, f_r3) + gd_mulfx(f_w4, f_r4));
+				const unsigned char green = (unsigned char) gd_fxtoi(gd_mulfx(f_w1, f_g1) + gd_mulfx(f_w2, f_g2) + gd_mulfx(f_w3, f_g3) + gd_mulfx(f_w4, f_g4));
+				const unsigned char blue = (unsigned char) gd_fxtoi(gd_mulfx(f_w1, f_b1) + gd_mulfx(f_w2, f_b2) + gd_mulfx(f_w3, f_b3) + gd_mulfx(f_w4, f_b4));
+				const unsigned char alpha = (unsigned char) gd_fxtoi(gd_mulfx(f_w1, f_a1) + gd_mulfx(f_w2, f_a2) + gd_mulfx(f_w3, f_a3) + gd_mulfx(f_w4, f_a4));

 				new_img->tpixels[dst_offset_v][dst_offset_h] = gdTrueColorAlpha(red, green, blue, alpha);
 			}
@@ -237,7 +237,7 @@ static int dynamicGetbuf (gdIOCtxPtr ctx, void *buf, int len)
 	if (remain >= len) {
 		rlen = len;
 	} else {
-		if (remain == 0) {
+		if (remain <= 0) {
 			return EOF;
 		}
 		rlen = remain;
@@ -180,6 +180,15 @@ void gdImageWebpCtx (gdImagePtr im, gdIOCtx * outfile, int quantization)
 	/* Conversion to Y,U,V buffer */
    yuv_width = (width + 1) >> 1;
    yuv_height = (height + 1) >> 1;
+
+	if (overflow2(width, height)) {
+		return;
+	}
+	/* simplification possible, because WebP must not be larger than 16384**2 */
+	if (overflow2(width * height, 2 * sizeof(unsigned char))) {
+		return;
+	}
+
    yuv_nbytes = width * height + 2 * yuv_width * yuv_height;

    if ((Y = (unsigned char *)gdCalloc(yuv_nbytes, sizeof(unsigned char))) == NULL) {
@@ -659,6 +659,8 @@ static char * gdft_draw_bitmap (gdCache_head_t *tc_cache, gdImage * im, int fg,
 				} else {
 					return "Unsupported ft_pixel_mode";
 				}
+				if (level == 0)  /* if background */
+					continue;
 				if ((fg >= 0) && (im->trueColor)) {
 					/* Consider alpha in the foreground color itself to be an
 					 * upper bound on how opaque things get, when truecolor is
@@ -748,9 +750,9 @@ static char * gdft_draw_bitmap (gdCache_head_t *tc_cache, gdImage * im, int fg,
 }

 static int
-gdroundupdown (FT_F26Dot6 v1, int updown)
+gdroundupdown (FT_F26Dot6 v1, int roundup)
 {
-	return (!updown) ? (v1 < 0 ? ((v1 - 63) >> 6) : v1 >> 6) : (v1 > 0 ? ((v1 + 63) >> 6) : v1 >> 6);
+	return (!roundup) ? v1 >> 6 : (v1 + 63) >> 6;
 }

 void gdFontCacheShutdown()
@@ -820,8 +822,6 @@ gdImageStringFTEx (gdImage * im, int *brect, int fg, char *fontlist, double ptsi
 	double cos_a = cos (angle);
 	int len, i = 0, ch;
 	int x1 = 0, y1 = 0;
-	int xb = x, yb = y;
-	int yd = 0;
 	font_t *font;
 	fontkey_t fontkey;
 	char *next;
@@ -982,9 +982,6 @@ gdImageStringFTEx (gdImage * im, int *brect, int fg, char *fontlist, double ptsi
 			  penf.y = (penf.y - 32) & -64;		/* round to next pixel row */
 			  x1 = (int)(- penf.y * sin_a + 32) / 64;
 			  y1 = (int)(- penf.y * cos_a + 32) / 64;
-			  xb = x + x1;
-			  yb = y + y1;
-			  yd = 0;
 			  pen.x = pen.y = 0;
 			  previous = 0;		/* clear kerning flag */
 			  continue;
@@ -1074,23 +1071,32 @@ gdImageStringFTEx (gdImage * im, int *brect, int fg, char *fontlist, double ptsi
 		/* retrieve kerning distance and move pen position */
 		if (use_kerning && previous && glyph_index) {
 			FT_Get_Kerning(face, previous, glyph_index, ft_kerning_default, &delta);
-			pen.x += delta.x;
+			pen.x += (int)(delta.x * cos_a);
+			pen.y -= (int)(delta.x * sin_a);
 			penf.x += delta.x;
 		}

-		/* load glyph image into the slot (erase previous one) */
-		if (FT_Load_Glyph(face, glyph_index, render_mode)) {
-			if (tmpstr) {
-				gdFree(tmpstr);
-			}
-			gdCacheDelete(tc_cache);
-			gdMutexUnlock(gdFontCacheMutex);
-			return "Problem loading glyph";
-		}
-
-		/* transform glyph image */
-		FT_Get_Glyph(slot, &image);
 		if (brect) { /* only if need brect */
+			/* load glyph image into the slot (erase previous one) */
+			if (FT_Load_Glyph(face, glyph_index, render_mode | FT_LOAD_IGNORE_TRANSFORM)) {
+				if (tmpstr) {
+					gdFree(tmpstr);
+				}
+				gdCacheDelete(tc_cache);
+				gdMutexUnlock(gdFontCacheMutex);
+				return "Problem loading glyph";
+			}
+
+			/* transform glyph image */
+			if (FT_Get_Glyph(slot, &image)) {
+				if (tmpstr) {
+					gdFree(tmpstr);
+				}
+				gdCacheDelete(tc_cache);
+				gdMutexUnlock(gdFontCacheMutex);
+				return "Problem loading glyph";
+			}
+
 			FT_Glyph_Get_CBox(image, ft_glyph_bbox_gridfit, &glyph_bbox);
 			glyph_bbox.xMin += penf.x;
 			glyph_bbox.yMin += penf.y;
@@ -1100,17 +1106,11 @@ gdImageStringFTEx (gdImage * im, int *brect, int fg, char *fontlist, double ptsi
 				glyph_bbox.xMax += slot->metrics.horiAdvance;
 			}
 			if (!i) { /* if first character, init BB corner values */
-				yd = slot->metrics.height - slot->metrics.horiBearingY;
 				bbox.xMin = glyph_bbox.xMin;
 				bbox.yMin = glyph_bbox.yMin;
 				bbox.xMax = glyph_bbox.xMax;
 				bbox.yMax = glyph_bbox.yMax;
 			} else {
-				FT_Pos desc;
-
-				if ( (desc = (slot->metrics.height - slot->metrics.horiBearingY)) > yd) {
-					yd = desc;
-				}
 				if (bbox.xMin > glyph_bbox.xMin) {
 					bbox.xMin = glyph_bbox.xMin;
 				}
@@ -1127,7 +1127,35 @@ gdImageStringFTEx (gdImage * im, int *brect, int fg, char *fontlist, double ptsi
 			i++;
 		}

+		/* increment (unrotated) pen position */
+		penf.x += slot->metrics.horiAdvance;
+
 		if (render) {
+			if (!brect || angle != 0) {
+				/* reload the rotated glyph (for bbox we needed FT_LOAD_IGNORE_TRANSFORM - bbox is rotated later) */
+				FT_Done_Glyph(image);
+
+				/* load glyph image into the slot (erase previous one) */
+				if (FT_Load_Glyph(face, glyph_index, render_mode)) {
+					if (tmpstr) {
+						gdFree(tmpstr);
+					}
+					gdCacheDelete(tc_cache);
+					gdMutexUnlock(gdFontCacheMutex);
+					return "Problem loading glyph";
+				}
+
+				/* transform glyph image */
+				if (FT_Get_Glyph(slot, &image)) {
+					if (tmpstr) {
+						gdFree(tmpstr);
+					}
+					gdCacheDelete(tc_cache);
+					gdMutexUnlock(gdFontCacheMutex);
+					return "Problem loading glyph";
+				}
+			}
+
 			if (image->format != ft_glyph_format_bitmap && FT_Glyph_To_Bitmap(&image, ft_render_mode_normal, 0, 1)) {
 				FT_Done_Glyph(image);
 				if (tmpstr) {
@@ -1150,8 +1178,6 @@ gdImageStringFTEx (gdImage * im, int *brect, int fg, char *fontlist, double ptsi
 		pen.x += image->advance.x >> 10;
 		pen.y -= image->advance.y >> 10;

-		penf.x += slot->metrics.horiAdvance;
-
 		FT_Done_Glyph(image);
 	}

@@ -1160,36 +1186,25 @@ gdImageStringFTEx (gdImage * im, int *brect, int fg, char *fontlist, double ptsi
 		double d1 = sin (angle + 0.78539816339744830962);
 		double d2 = sin (angle - 0.78539816339744830962);

-		/* make the center of rotation at (0, 0) */
-		FT_BBox normbox;
-
-		normbox.xMin = 0;
-		normbox.yMin = 0;
-		normbox.xMax = bbox.xMax - bbox.xMin;
-		normbox.yMax = bbox.yMax - bbox.yMin;
-
-		brect[0] = brect[2] = brect[4] = brect[6] = (int)  (yd * sin_a);
-		brect[1] = brect[3] = brect[5] = brect[7] = (int)(- yd * cos_a);
-
-		/* rotate bounding rectangle */
-		brect[0] += (int) (normbox.xMin * cos_a - normbox.yMin * sin_a);
-		brect[1] += (int) (normbox.xMin * sin_a + normbox.yMin * cos_a);
-		brect[2] += (int) (normbox.xMax * cos_a - normbox.yMin * sin_a);
-		brect[3] += (int) (normbox.xMax * sin_a + normbox.yMin * cos_a);
-		brect[4] += (int) (normbox.xMax * cos_a - normbox.yMax * sin_a);
-		brect[5] += (int) (normbox.xMax * sin_a + normbox.yMax * cos_a);
-		brect[6] += (int) (normbox.xMin * cos_a - normbox.yMax * sin_a);
-		brect[7] += (int) (normbox.xMin * sin_a + normbox.yMax * cos_a);
+		/* rotate bounding rectangle (at 0, 0) */
+		brect[0] = (int) (bbox.xMin * cos_a - bbox.yMin * sin_a);
+		brect[1] = (int) (bbox.xMin * sin_a + bbox.yMin * cos_a);
+		brect[2] = (int) (bbox.xMax * cos_a - bbox.yMin * sin_a);
+		brect[3] = (int) (bbox.xMax * sin_a + bbox.yMin * cos_a);
+		brect[4] = (int) (bbox.xMax * cos_a - bbox.yMax * sin_a);
+		brect[5] = (int) (bbox.xMax * sin_a + bbox.yMax * cos_a);
+		brect[6] = (int) (bbox.xMin * cos_a - bbox.yMax * sin_a);
+		brect[7] = (int) (bbox.xMin * sin_a + bbox.yMax * cos_a);

 		/* scale, round and offset brect */
-		brect[0] = xb + gdroundupdown(brect[0], d2 > 0);
-		brect[1] = yb - gdroundupdown(brect[1], d1 < 0);
-		brect[2] = xb + gdroundupdown(brect[2], d1 > 0);
-		brect[3] = yb - gdroundupdown(brect[3], d2 > 0);
-		brect[4] = xb + gdroundupdown(brect[4], d2 < 0);
-		brect[5] = yb - gdroundupdown(brect[5], d1 > 0);
-		brect[6] = xb + gdroundupdown(brect[6], d1 < 0);
-		brect[7] = yb - gdroundupdown(brect[7], d2 < 0);
+		brect[0] = x + gdroundupdown(brect[0], d2 > 0);
+		brect[1] = y - gdroundupdown(brect[1], d1 < 0);
+		brect[2] = x + gdroundupdown(brect[2], d1 > 0);
+		brect[3] = y - gdroundupdown(brect[3], d2 > 0);
+		brect[4] = x + gdroundupdown(brect[4], d2 < 0);
+		brect[5] = y - gdroundupdown(brect[5], d1 > 0);
+		brect[6] = x + gdroundupdown(brect[6], d1 < 0);
+		brect[7] = y - gdroundupdown(brect[7], d2 < 0);
 	}

 	if (tmpstr) {
@@ -1,29 +1,53 @@
 --TEST--
-Bug #43073 (TrueType bounding box is wrong for angle<>0) freetype < 2.4.10
+Bug #43073 (TrueType bounding box is wrong for angle<>0)
 --SKIPIF--
 <?php
 	if(!extension_loaded('gd')){ die('skip gd extension not available'); }
 	if(!function_exists('imagettftext')) die('skip imagettftext() not available');
-
-	include dirname(__FILE__) . '/func.inc';
-	if(version_compare(get_freetype_version(), '2.4.10') >= 0) die('skip for freetype < 2.4.10');
 ?>
 --FILE--
 <?php
+$exp = [
+	[501,400, 611,400, 611,376, 501,376],
+	[492,361, 595,319, 586,296, 483,338],
+	[470,329, 549,251, 531,233, 453,312],
+	[439,307, 481,204, 458,195, 416,297],
+	[400,299, 400,189, 376,189, 376,299],
+	[361,307, 319,204, 296,213, 338,316],
+	[329,329, 251,250, 233,267, 311,346],
+	[307,360, 204,318, 195,341, 297,383],
+	[299,400, 189,400, 189,424, 299,424],
+	[307,438, 204,480, 213,503, 316,461],
+	[329,470, 250,548, 267,566, 346,488],
+	[360,492, 318,595, 341,604, 383,502],
+	[400,501, 400,611, 424,611, 424,501],
+	[438,492, 480,595, 503,586, 461,483],
+	[470,470, 548,549, 566,532, 488,453],
+	[492,439, 595,481, 604,458, 502,416]
+];
 $cwd = dirname(__FILE__);
 $font = "$cwd/Tuffy.ttf";
 $delta_t = 360.0 / 16; # Make 16 steps around
 $g = imagecreate(800, 800);
 $bgnd  = imagecolorallocate($g, 255, 255, 255);
 $black = imagecolorallocate($g, 0, 0, 0);
+$red = imagecolorallocate($g, 255, 0, 0);
 $x = 100;
 $y = 0;
 $cos_t = cos(deg2rad($delta_t));
 $sin_t = sin(deg2rad($delta_t));
-for ($angle = 0.0; $angle < 360.0; $angle += $delta_t) {
+for ($angle = 0.0, $i = 0; $angle < 360.0; $angle += $delta_t, $i++) {
  $bbox = imagettftext($g, 24, $angle, 400+$x, 400+$y, $black, $font, 'ABCDEF');
-  $s = vsprintf("(%d, %d), (%d, %d), (%d, %d), (%d, %d)\n", $bbox);
-  echo $s;
+  imagepolygon($g, $bbox, 4, $red);
+  printf("%2d: ", $i);
+  for ($j = 0; $j < 8; $j++) {
+	if ($bbox[$j] >= $exp[$i][$j] - 1 && $bbox[$j] <= $exp[$i][$j] + 1) {
+		echo '.';
+	} else {
+		echo "(expected $exp[$i][$j], got $bbox[$j])";
+	}
+  }
+  echo "\n";
  $temp = $cos_t * $x + $sin_t * $y;
  $y    = $cos_t * $y - $sin_t * $x;
  $x    = $temp;
@@ -32,20 +56,20 @@ imagepng($g, "$cwd/bug43073.png");
 ?>
 --CLEAN--
 <?php @unlink(dirname(__FILE__) . '/bug43073.png'); ?>
--EXPECTF--
-(500, 40%d), (610, 40%d), (610, 376), (500, 376)
-(492, 363), (591, 322), (580, 295), (480, 336)
-(470, 331), (548, 254), (527, 233), (449, 310)
-(439, 309), (483, 202), (461, 193), (416, 299)
-(40%d, 300), (40%d, 183), (38%d, 183), (38%d, 300)
-(362, 307), (316, 195), (291, 205), (337, 318)
-(330, 329), (246, 244), (224, 265), (308, 350)
-(308, 360), (202, 316), (190, 344), (296, 388)
-(300, %d), (18%d, %d), (18%d, 425), (%d, 425)
-(306, 437), (195, 483), (206, 510), (318, 464)
-(328, 469), (240, 557), (260, 578), (349, 491)
-(359, 491), (312, 607), (334, 616), (382, 501)
-(%d, 500), (%d, 618), (41%d, 618), (41%d, 500)
-(436, 493), (483, 607), (507, 597), (461, 482)
-(468, 471), (555, 558), (577, 538), (490, 450)
-(490, 440), (600, 485), (611, 457), (502, 412)
+--EXPECT--
+ 0: ........
+ 1: ........
+ 2: ........
+ 3: ........
+ 4: ........
+ 5: ........
+ 6: ........
+ 7: ........
+ 8: ........
+ 9: ........
+10: ........
+11: ........
+12: ........
+13: ........
+14: ........
+15: ........
@@ -1,51 +0,0 @@
--TEST--
-Bug #43073 (TrueType bounding box is wrong for angle<>0) freetype >= 2.4.10
--SKIPIF--
-<?php
-	if(!extension_loaded('gd')){ die('skip gd extension not available'); }
-	if(!function_exists('imagettftext')) die('skip imagettftext() not available');
-
-	include dirname(__FILE__) . '/func.inc';
-	if(version_compare(get_freetype_version(), '2.4.10') == -1) die('skip for freetype >= 2.4.10');
-?>
--FILE--
-<?php
-$cwd = dirname(__FILE__);
-$font = "$cwd/Tuffy.ttf";
-$delta_t = 360.0 / 16; # Make 16 steps around
-$g = imagecreate(800, 800);
-$bgnd  = imagecolorallocate($g, 255, 255, 255);
-$black = imagecolorallocate($g, 0, 0, 0);
-$x = 100;
-$y = 0;
-$cos_t = cos(deg2rad($delta_t));
-$sin_t = sin(deg2rad($delta_t));
-for ($angle = 0.0; $angle < 360.0; $angle += $delta_t) {
-  $bbox = imagettftext($g, 24, $angle, 400+$x, 400+$y, $black, $font, 'ABCDEF');
-  $s = vsprintf("(%d, %d), (%d, %d), (%d, %d), (%d, %d)\n", $bbox);
-  echo $s;
-  $temp = $cos_t * $x + $sin_t * $y;
-  $y    = $cos_t * $y - $sin_t * $x;
-  $x    = $temp;
-}
-imagepng($g, "$cwd/bug43073.png");
-?>
--CLEAN--
-<?php @unlink(dirname(__FILE__) . '/bug43073.png'); ?>
--EXPECTF--
-(500, 400), (610, 400), (610, 376), (500, 376)
-(492, 363), (591, 322), (580, 295), (480, 336)
-(470, 331), (548, 254), (527, 233), (449, 310)
-(439, 309), (483, 202), (461, 193), (416, 299)
-(400, 300), (400, 183), (380, 183), (380, 300)
-(362, 307), (316, 195), (291, 205), (337, 318)
-(330, 329), (246, 244), (224, 265), (308, 350)
-(308, 360), (202, 316), (190, 344), (296, 388)
-(300, 400), (187, 400), (187, 425), (300, 425)
-(306, 437), (195, 483), (206, 510), (318, 464)
-(328, 469), (240, 557), (260, 578), (349, 491)
-(359, 491), (312, 607), (334, 616), (382, 501)
-(400, 500), (400, 618), (419, 618), (419, 500)
-(436, 493), (483, 607), (507, 597), (461, 482)
-(468, 471), (555, 558), (577, 538), (490, 450)
-(490, 440), (600, 485), (611, 457), (502, 412)
@@ -19,4 +19,4 @@ echo 'Left Bottom: (' . $bbox[0]  . ', ' . $bbox[1] . ')';
 --CLEAN--
 <?php @unlink(dirname(__FILE__) . '/bug48732.png'); ?>
 --EXPECTF--
-Left Bottom: (0, 47)
+Left Bottom: (0, 46)
@@ -1,12 +1,9 @@
 --TEST--
-Bug #48801 (Problem with imagettfbbox) freetype < 2.4.10
+Bug #48801 (Problem with imagettfbbox)
 --SKIPIF--
 <?php
 	if(!extension_loaded('gd')){ die('skip gd extension not available'); }
 	if(!function_exists('imageftbbox')) die('skip imageftbbox() not available');
-
-	include dirname(__FILE__) . '/func.inc';
-	if(version_compare(get_freetype_version(), '2.4.10') >= 0) die('skip for freetype < 2.4.10');
 ?>
 --FILE--
 <?php
@@ -18,8 +15,8 @@ echo '(' . $bbox[2] . ', ' . $bbox[3] . ")\n";
 echo '(' . $bbox[4] . ', ' . $bbox[5] . ")\n";
 echo '(' . $bbox[6] . ', ' . $bbox[7] . ")\n";
 ?>
--EXPECTF--
-(-1, 15)
-(15%d, 15)
-(15%d, -48)
-(-1, -48)
+--EXPECTREGEX--
+\(4, 15\)
+\(16[0-1], 15\)
+\(16[0-1], -4[7-8]\)
+\(4, -4[7-8]\)
@@ -1,25 +0,0 @@
--TEST--
-Bug #48801 (Problem with imagettfbbox) freetype >= 2.4.10
--SKIPIF--
-<?php
-	if(!extension_loaded('gd')){ die('skip gd extension not available'); }
-	if(!function_exists('imageftbbox')) die('skip imageftbbox() not available');
-
-	include dirname(__FILE__) . '/func.inc';
-	if(version_compare(get_freetype_version(), '2.4.10') == -1) die('skip for freetype >= 2.4.10');
-?>
--FILE--
-<?php
-$cwd = dirname(__FILE__);
-$font = "$cwd/Tuffy.ttf";
-$bbox = imageftbbox(50, 0, $font, "image");
-echo '(' . $bbox[0] . ', ' . $bbox[1] . ")\n";
-echo '(' . $bbox[2] . ', ' . $bbox[3] . ")\n";
-echo '(' . $bbox[4] . ', ' . $bbox[5] . ")\n";
-echo '(' . $bbox[6] . ', ' . $bbox[7] . ")\n";
-?>
--EXPECTF--
-(-1, 15)
-(15%d, 15)
-(15%d, -48)
-(-1, -48)
@@ -0,0 +1,38 @@
+--TEST--
+Bug #50194 (imagettftext broken on transparent background w/o alphablending)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!function_exists('imagettftext')) die('skip imagettftext() not available');
+//die('skip freetype issues');
+?>
+--FILE--
+<?php
+require_once __DIR__ . DIRECTORY_SEPARATOR . 'func.inc';
+
+$im = imagecreatetruecolor(240, 55);
+$background = imagecolorallocatealpha($im, 60, 60, 60, 0); // no tranparency
+$black = imagecolorallocate($im, 0, 0, 0);
+imagealphablending($im, false); 
+imagefilledrectangle($im, 0, 0, 239, 54, $background);
+$text = 'Testing ... ';
+$font = __DIR__ . DIRECTORY_SEPARATOR . 'Tuffy.ttf';
+imagettftext($im, 40, 0, 10, 40, $black, $font, $text);
+imagesavealpha($im, true);
+
+ob_start();
+test_image_equals_file(__DIR__ . DIRECTORY_SEPARATOR . 'bug50194.png', $im);
+$output = ob_get_clean();
+assert(preg_match('/The images are equal|The images differ in (\d+) pixels/', $output, $matches));
+if (isset($matches[1]) && $matches[1] > 2000) {
+    echo "The images differ in {$matches[1]} pixels.\n";
+} else {
+    echo "The images are similar.\n";
+}
+
+imagedestroy($im);
+?>
+===DONE===
+--EXPECT--
+The images are similar.
+===DONE===
@@ -0,0 +1,107 @@
+--TEST--
+Bug #53504 imagettfbbox/imageftbbox gives incorrect values for bounding box
+--SKIPIF--
+<?php
+	if(!extension_loaded('gd')){ die('skip gd extension not available'); }
+	if(!function_exists('imageftbbox')) die('skip imageftbbox() not available');
+?>
+--FILE--
+<?php
+$cwd = dirname(__FILE__);
+$font = "$cwd/Tuffy.ttf";
+
+$g = imagecreate(800, 800);
+$bgnd  = imagecolorallocate($g, 255, 255, 255);
+$black = imagecolorallocate($g, 0, 0, 0);
+$red = imagecolorallocate($g, 255, 0, 0);
+$blue = imagecolorallocate($g, 0, 0, 255);
+
+$tests = [
+    // Kerning examples (unfortunately not available in "Tuffy" test font):
+    ['fontSize' => 50, 'angle' => 0, 'x' => 20, 'y' => 70, 'text' => 'AV Teg', 'exp' => [2,15, 208,15, 208,-48, 2,-48]],
+    ['fontSize' => 50, 'angle' => 90, 'x' => 70, 'y' => 350, 'text' => 'AV Teg', 'exp' => [15,-1, 15,-208, -48,-208, -48,-2]],
+    ['fontSize' => 50, 'angle' => 40, 'x' => 130, 'y' => 280, 'text' => 'AV Teg', 'exp' => [11,11, 169,-122, 129,-171, -30,-39]],
+
+    // Shift-Test:
+    ['fontSize' => 100, 'angle' => 0, 'x' => 350, 'y' => 110, 'text' => 'H-Shift', 'exp' => [8,2, 386,2, 386,-97, 8,-97]],
+
+    // Small/single chars:
+    ['fontSize' => 100, 'angle' => 0, 'x' => 350, 'y' => 220, 'text' => '-', 'exp' => [7,-37, 51,-37, 51,-46, 7,-46]],
+    ['fontSize' => 100, 'angle' => 0, 'x' => 430, 'y' => 220, 'text' => ',', 'exp' => [7,15, 21,15, 21,-13, 7,-13]],
+    ['fontSize' => 100, 'angle' => 0, 'x' => 510, 'y' => 220, 'text' => '.', 'exp' => [7,1, 21,1, 21,-13, 7,-13]],
+    ['fontSize' => 100, 'angle' => 0, 'x' => 590, 'y' => 220, 'text' => '|', 'exp' => [8,0, 17,0, 17,-95, 8,-95]],
+    ['fontSize' => 100, 'angle' => 0, 'x' => 670, 'y' => 220, 'text' => 'g', 'exp' => [5,29, 60,29, 60,-72, 5,-72]],
+
+    // Multi-Line + rotation:
+    ['fontSize' => 30, 'angle' => 0, 'x' => 20, 'y' => 400, 'text' => "Multi\nLine\nTest", 'exp' => [2,107, 80,107, 80,-29, 2,-29]],
+    ['fontSize' => 30, 'angle' => 40, 'x' => 150, 'y' => 420, 'text' => "Multi\nLine\nTest", 'exp' => [70,81, 131,31, 43,-74, -18,-24]],
+    ['fontSize' => 30, 'angle' => 90, 'x' => 250, 'y' => 340, 'text' => "Multi\nLine\nTest", 'exp' => [107,-1, 107,-80, -29,-80, -29,-2]],
+
+    // Some edge case glyphs:
+    ['fontSize' => 50, 'angle' => 90, 'x' => 70, 'y' => 750, 'text' => "iiiiiiiiiiii", 'exp' => [0,-4, 0,-165, -47,-165, -47,-4]],
+    ['fontSize' => 50, 'angle' => 90, 'x' => 150, 'y' => 750, 'text' => "~~~~~~~", 'exp' => [-19,-2, -18,-167, -29,-167, -29,-2]],
+    ['fontSize' => 50, 'angle' => 50, 'x' => 210, 'y' => 750, 'text' => "iiiiiiiiiiii", 'exp' => [3,-3, 107,-127, 70,-157, -34,-33]],
+    ['fontSize' => 50, 'angle' => 50, 'x' => 300, 'y' => 750, 'text' => "~~~~~~~", 'exp' => [-13,-13, 93,-141, 85,-147, -21,-20]],
+    ['fontSize' => 50, 'angle' => 0, 'x' => 430, 'y' => 650, 'text' => "iiiiiiiiiiii", 'exp' => [4,0, 165,0, 165,-47, 4,-47]],
+    ['fontSize' => 50, 'angle' => 0, 'x' => 430, 'y' => 750, 'text' => "~~~~~~~", 'exp' => [2,-19, 167,-19, 167,-29, 2,-29]],
+
+    // "Big" test:
+    ['fontSize' => 200, 'angle' => 0, 'x' => 400, 'y' => 500, 'text' => "Big", 'exp' => [16,59, 329,59, 329,-190, 16,-190]],
+];
+
+foreach ($tests as $testnum => $test) {
+    $bbox = imageftbbox($test['fontSize'], $test['angle'], $font, $test['text']);
+	printf('%2d: ', $testnum);
+	for ($i = 0; $i < 8; $i++) {
+		$exp = $test['exp'][$i];
+		if ($bbox[$i] >= $exp - 2 && $bbox[$i] <= $exp + 2) {
+			echo '.';
+		} else {
+			echo "(expected $exp, got $bbox[$i])";
+		}
+	}
+	echo "\n";
+
+    $bboxDrawn = imagefttext($g, $test['fontSize'], $test['angle'],
+        $test['x'], $test['y'], $black, $font, $test['text']);
+
+    // check if both bboxes match when adding x/y offset:
+    for ($i = 0; $i < count($bbox); $i += 2) {
+        if ($bbox[$i] + $test['x'] !== $bboxDrawn[$i]) echo "imageftbbox and imagefttext differ!\n";
+        if ($bbox[$i + 1] + $test['y'] !== $bboxDrawn[$i + 1]) echo "imageftbbox and imagefttext differ!\n";
+    }
+
+    // draw bounding box:
+    imagepolygon($g, $bboxDrawn, 4, $red);
+
+    // draw baseline:
+    $width = sqrt(pow($bboxDrawn[2] - $bboxDrawn[0], 2) + pow($bboxDrawn[3] - $bboxDrawn[1], 2));
+    imageline($g, $test['x'], $test['y'],
+        $test['x'] + $width * cos(deg2rad($test['angle'])),
+        $test['y'] - $width * sin(deg2rad($test['angle'])), $blue);
+}
+
+imagepng($g, "$cwd/bug53504.png");
+?>
+--CLEAN--
+<?php @unlink(dirname(__FILE__) . '/bug53504.png'); ?>
+--EXPECT--
+ 0: ........
+ 1: ........
+ 2: ........
+ 3: ........
+ 4: ........
+ 5: ........
+ 6: ........
+ 7: ........
+ 8: ........
+ 9: ........
+10: ........
+11: ........
+12: ........
+13: ........
+14: ........
+15: ........
+16: ........
+17: ........
+18: ........
@@ -0,0 +1,19 @@
+--TEST--
+Bug #72482 (Ilegal write/read access caused by gdImageAALine overflow)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$img = imagecreatetruecolor(13, 1007);
+imageantialias($img, true);
+imageline($img, 0, 0, 1073745919, 1073745919, 4096);
+
+$img = imagecreatetruecolor(100, 100);
+imageantialias($img, true);
+imageline($img, 1094795585, 0, 2147483647, 255, 0xff);
+?>
+===DONE===
+--EXPECT--
+===DONE===
@@ -0,0 +1,21 @@
+--TEST--
+Bug 72482 (Ilegal write/read access caused by gdImageAALine overflow)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+require_once __DIR__ . DIRECTORY_SEPARATOR . 'func.inc';
+
+$im = imagecreatetruecolor(10, 10);
+imagefilledrectangle($im, 0, 0, 9, 9, imagecolorallocate($im, 255, 255, 255));
+imageantialias($im, true);
+imageline($im, 0, 0, 10, 10, imagecolorallocate($im, 0, 0, 0));
+
+test_image_equals_file(__DIR__ . DIRECTORY_SEPARATOR . 'bug72482_2.png', $im);
+?>
+===DONE===
+--EXPECT--
+The images are equal.
+===DONE===
@@ -0,0 +1,15 @@
+--TEST--
+Bug #72494 (imagecropauto out-of-bounds access)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$im = imagecreate(10,10);
+imagecropauto($im, IMG_CROP_THRESHOLD, 0, 1337);
+?>
+===DONE===
+--EXPECTF--
+Warning: imagecropauto(): Color argument missing with threshold mode in %s on line %d
+===DONE===
@@ -0,0 +1,14 @@
+--TEST--
+Bug #72696 (imagefilltoborder stackoverflow on truecolor images)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$im = imagecreatetruecolor(10, 10);
+imagefilltoborder($im, 0, 0, 1, -2);
+?>
+===DONE===
+--EXPECT--
+===DONE===
@@ -0,0 +1,28 @@
+--TEST--
+Bug #73155 (imagegd2() writes wrong chunk sizes on boundaries)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$im = imagecreate(64, 64);
+imagecolorallocate($im, 0, 0, 0);
+
+ob_start();
+imagegd2($im, null, 64, IMG_GD2_RAW);
+$buffer = ob_get_clean();
+
+$header = unpack('@10/nchunk_size/nformat/nx_count/ny_count', $buffer);
+printf("chunk size: %d\n", $header['chunk_size']);
+printf("x chunk count: %d\n", $header['x_count']);
+printf("y chunk count: %d\n", $header['y_count']);
+printf("file size: %d\n", strlen($buffer));
+?>
+===DONE===
+--EXPECT--
+chunk size: 64
+x chunk count: 1
+y chunk count: 1
+file size: 5145
+===DONE===
@@ -0,0 +1,22 @@
+--TEST--
+Bug #73157 (imagegd2() ignores 3rd param if 4 are given)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$im = imagecreate(8, 8);
+imagecolorallocate($im, 0, 0, 0);
+
+ob_start();
+imagegd2($im, null, 256, IMG_GD2_RAW);
+$buffer = ob_get_clean();
+
+$header = unpack('@10/nchunk_size', $buffer);
+printf("chunk size: %d\n", $header['chunk_size']);
+?>
+===DONE===
+--EXPECT--
+chunk size: 256
+===DONE===
@@ -0,0 +1,21 @@
+--TEST--
+Bug #73159 (imagegd2(): unrecognized formats may result in corrupted files)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$im = imagecreatetruecolor(10, 10);
+
+ob_start();
+imagegd2($im, null, 128, 0);
+$buffer = ob_get_clean();
+
+$header = unpack('@12/nformat', $buffer);
+printf("format: %d\n", $header['format']);
+?>
+===DONE===
+--EXPECT--
+format: 4
+===DONE===
@@ -0,0 +1,18 @@
+--TEST--
+Bug #73161 (imagecreatefromgd2() may leak memory)
+--DESCRIPTION--
+We're testing for a memory leak that might not even show up with valgrind.
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$im = imagecreatefromgd2(__DIR__ . DIRECTORY_SEPARATOR . 'bug73161.gd2');
+var_dump($im);
+?>
+===DONE===
+--EXPECTF--
+Warning: imagecreatefromgd2(): '%s' is not a valid GD2 file in %s on line %d
+bool(false)
+===DONE===
@@ -0,0 +1,22 @@
+--TEST--
+Bug #73213 (Integer overflow in imageline() with antialiasing)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+require_once __DIR__ . DIRECTORY_SEPARATOR . 'func.inc';
+
+$im = imagecreatetruecolor(32768, 1);
+$black = imagecolorallocate($im, 0, 0, 0);
+imageantialias($im, true);
+
+imageline($im, 0,0, 32767,0, $black);
+
+test_image_equals_file(__DIR__ . DIRECTORY_SEPARATOR . 'bug73213.png', $im);
+?>
+===DONE===
+--EXPECT--
+The images are equal.
+===DONE===
@@ -0,0 +1,24 @@
+--TEST--
+Bug #73272 (imagescale() is not affected by, but affects imagesetinterpolation())
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+require_once __DIR__ . DIRECTORY_SEPARATOR . 'func.inc';
+
+$src = imagecreatetruecolor(100, 100);
+imagefilledrectangle($src, 0,0, 99,99, 0xFFFFFF);
+imageellipse($src, 49,49, 40,40, 0x000000);
+
+imagesetinterpolation($src, IMG_NEAREST_NEIGHBOUR);
+imagescale($src, 200, 200, IMG_BILINEAR_FIXED);
+$dst = imagerotate($src, 60, 0xFFFFFF);
+
+test_image_equals_file(__DIR__ . DIRECTORY_SEPARATOR . 'bug73272.png', $dst);
+?>
+===DONE===
+--EXPECT--
+The images are equal.
+===DONE===
@@ -0,0 +1,20 @@
+--TEST--
+Bug #73279 (Integer overflow in gdImageScaleBilinearPalette())
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.4', '<')) {
+    die('skip only for bundled libgd or external libgd >= 2.2.4');
+}
+?>
+--FILE--
+<?php
+$src = imagecreate(100, 100);
+imagecolorallocate($src, 255, 255, 255);
+$dst = imagescale($src, 200, 200, IMG_BILINEAR_FIXED);
+printf("color: %x\n", imagecolorat($dst, 99, 99));
+?>
+===DONE===
+--EXPECT--
+color: ffffff
+===DONE===
@@ -0,0 +1,22 @@
+--TEST--
+Bug #73279 (Integer overflow in gdImageScaleBilinearPalette())
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (GD_BUNDLED || version_compare(GD_VERSION, '2.2.4', '>=')) {
+    die('skip only for external libgd < 2.2.4');
+}
+?>
+--FILE--
+<?php
+$src = imagecreate(100, 100);
+imagecolorallocate($src, 255, 255, 255);
+$dst = imagescale($src, 200, 200, IMG_BILINEAR_FIXED);
+printf("color: %x\n", imagecolorat($dst, 99, 99));
+?>
+===DONE===
+--XFAIL--
+Bug #330 has not yet been fixed
+--EXPECT--
+color: ffffff
+===DONE===
@@ -0,0 +1,22 @@
+--TEST--
+Bug #73549 (Use after free when stream is passed to imagepng)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$stream = fopen(__DIR__ . DIRECTORY_SEPARATOR . 'bug73549.png', 'w');
+$im = imagecreatetruecolor(8, 8);
+var_dump(imagepng($im, $stream));
+var_dump($stream);
+?>
+===DONE===
+--EXPECTF--
+bool(true)
+resource(%d) of type (stream)
+===DONE===
+--CLEAN--
+<?php
+unlink(__DIR__ . DIRECTORY_SEPARATOR . 'bug73549.png');
+?>
@@ -0,0 +1,18 @@
+--TEST--
+Bug 73868 (DOS vulnerability in gdImageCreateFromGd2Ctx())
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+var_dump(imagecreatefromgd2(__DIR__ . DIRECTORY_SEPARATOR . 'bug73868.gd2'));
+?>
+===DONE===
+--EXPECTF--
+Warning: imagecreatefromgd2(): gd2: EOF while reading
+ in %s on line %d
+
+Warning: imagecreatefromgd2(): '%s' is not a valid GD2 file in %s on line %d
+bool(false)
+===DONE===
@@ -0,0 +1,19 @@
+--TEST--
+Bug #73869 (Signed Integer Overflow gd_io.c)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+var_dump(imagecreatefromgd2(__DIR__ . DIRECTORY_SEPARATOR . 'bug73869a.gd2'));
+var_dump(imagecreatefromgd2(__DIR__ . DIRECTORY_SEPARATOR . 'bug73869b.gd2'));
+?>
+===DONE===
+--EXPECTF--
+Warning: imagecreatefromgd2(): '%s' is not a valid GD2 file in %s on line %d
+bool(false)
+
+Warning: imagecreatefromgd2(): '%s' is not a valid GD2 file in %s on line %d
+bool(false)
+===DONE===
@@ -0,0 +1,27 @@
+--TEST--
+Bug #74435 (Buffer over-read into uninitialized memory)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$im = imagecreatefromgif(__DIR__ . DIRECTORY_SEPARATOR . 'bug74435.gif');
+var_dump($im);
+$width = imagesx($im);
+$height = imagesy($im);
+for ($i = 0; $i < $width; $i += 16) {
+    for ($j = 0; $j < $height; $j += 16) {
+        if (($index = imagecolorat($im, $i, $j)) >= 2) {
+            list($red, $green, $blue, $alpha) = array_values(imagecolorsforindex($im, $index));
+            if ($red !== 0 || $green !== 0 || $blue !== 0 || $alpha !== 0) {
+                echo "unexpected color at ($i, $j)\n";
+            }
+        }
+    }
+}
+?>
+===DONE===
+--EXPECTF--
+resource(%d) of type (gd)
+===DONE===
@@ -0,0 +1,15 @@
+--TEST--
+Bug #75571 (Infinite loop in GIF reading causing DoS)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+var_dump(imagecreatefromgif(__DIR__ . '/bug75571.gif'));
+?>
+===DONE===
+--EXPECTF--
+Warning: imagecreatefromgif(): '%s' is not a valid GIF file in %s on line %d
+bool(false)
+===DONE===
@@ -82,7 +82,9 @@ function test_image_equals_file($filename, $actual)
 		save_actual_image($actual);
 		return;
 	}
+	$actual = test_to_truecolor($actual);
 	$expected = imagecreatefrompng($filename);
+	$expected = test_to_truecolor($expected);
 	$exp_x = imagesx($expected);
 	$exp_y = imagesy($expected);
 	$act_x = imagesx($actual);
@@ -90,7 +92,6 @@ function test_image_equals_file($filename, $actual)
 	if ($exp_x != $act_x || $exp_y != $act_y) {
 		echo "The image size differs: expected {$exp_x}x{$exp_y}, got {$act_x}x{$act_y}.\n";
 		save_actual_image($actual);
-		imagedestroy($expected);
 		return;
 	}
 	$pixels_changed = 0;
@@ -109,7 +110,25 @@ function test_image_equals_file($filename, $actual)
 		echo "The images differ in {$pixels_changed} pixels.\n";
 		save_actual_image($actual);
 	}
-	imagedestroy($expected);
+}
+
+/**
+ * Returns the truecolor version of an image.
+ *
+ * @param resource $image
+ * @return resource
+ */
+function test_to_truecolor($image)
+{
+	if (imageistruecolor($image)) {
+		return $image;
+	} else {
+		$width = imagesx($image);
+		$height = imagesy($image);
+		$result = imagecreatetruecolor($width, $height);
+		imagecopy($result, $image, 0,0, 0,0, $width, $height);
+		return $result;
+	}
 }

 /**
@@ -4,6 +4,7 @@ Font charmap order is deterministic based on order in the font, use the selected
 <?php
 	if(!extension_loaded('gd')){ die('skip gd extension not available'); }
 	if(!function_exists('imagettftext')) die('skip imagettftext() not available');
+  if(gd_info()['JIS-mapped Japanese Font Support']) die('skip JIS-mapped Japanese Font Support not supported');
 ?>
 --FILE--
 <?php
@@ -0,0 +1,42 @@
+--TEST--
+test_image_equals_file(): comparing palette images
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+require_once __DIR__ . DIRECTORY_SEPARATOR . 'func.inc';
+
+$im = imagecreate(10, 10);
+imagecolorallocate($im, 255, 255, 255);
+$red = imagecolorallocate($im, 255, 0, 0);
+imagefilledrectangle($im, 3,3, 7,7, $red);
+
+$filename = __DIR__ . DIRECTORY_SEPARATOR . 'test_image_equals_file_palette.png';
+imagepng($im, $filename);
+
+$im = imagecreate(10, 10);
+imagecolorallocate($im, 255, 255, 255);
+$blue = imagecolorallocate($im, 0, 0, 255);
+imagefilledrectangle($im, 3,3, 7,7, $blue);
+
+test_image_equals_file($filename, $im);
+
+$im = imagecreate(10, 10);
+imagecolorallocate($im, 255, 255, 255);
+imagecolorallocate($im, 0, 0, 0);
+$red = imagecolorallocate($im, 255, 0, 0);
+imagefilledrectangle($im, 3,3, 7,7, $red);
+
+test_image_equals_file($filename, $im);
+?>
+===DONE===
+--EXPECT--
+The images differ in 25 pixels.
+The images are equal.
+===DONE===
+--CLEAN--
+<?php
+unlink(__DIR__ . DIRECTORY_SEPARATOR . 'test_image_equals_file_palette.png');
+?>
@@ -2491,7 +2491,7 @@ PHP_NAMED_FUNCTION(php_if_iconv)
 		&out_buffer, &out_len, out_charset, in_charset);
 	_php_iconv_show_error(err, out_charset, in_charset TSRMLS_CC);
 	if (err == PHP_ICONV_ERR_SUCCESS && out_buffer != NULL) {
-		RETVAL_STRINGL(out_buffer, out_len, 0);
+		RETVAL_STRINGL_CHECK(out_buffer, out_len, 0);
 	} else {
 		if (out_buffer != NULL) {
 			efree(out_buffer);
@@ -2672,6 +2672,9 @@ static int php_iconv_stream_filter_append_bucket(
 								tcnt = 0;
 								break;
 							}
+						} else {
+						    php_error_docref(NULL TSRMLS_CC, E_WARNING, "iconv stream filter (\"%s\"=>\"%s\"): invalid multibyte sequence", self->from_charset, self->to_charset);
+						    goto out_failure;
 						}
 						break;

@@ -0,0 +1,20 @@
+--TEST--
+Bug #76249 (stream filter convert.iconv leads to infinite loop on invalid sequence)
+--SKIPIF--
+<?php extension_loaded('iconv') or die('skip iconv extension is not available'); ?>
+--FILE--
+<?php
+$fh = fopen('php://memory', 'rw');
+fwrite($fh, "abc");
+rewind($fh);
+if (false === @stream_filter_append($fh, 'convert.iconv.ucs-2/utf8//IGNORE', STREAM_FILTER_READ, [])) {
+	stream_filter_append($fh, 'convert.iconv.ucs-2/utf-8//IGNORE', STREAM_FILTER_READ, []);
+}
+$a = stream_get_contents($fh);
+var_dump(strlen($a));
+?>
+DONE
+--EXPECTF--
+Warning: stream_get_contents(): iconv stream filter ("ucs-2"=>"utf%A8//IGNORE"): invalid multibyte sequence in %sbug76249.php on line %d
+int(3)
+DONE
@@ -562,6 +562,15 @@ static const zend_module_dep imap_deps[] = {
 };
 /* }}} */

+
+/* {{{ PHP_INI
+ */
+PHP_INI_BEGIN()
+STD_PHP_INI_BOOLEAN("imap.enable_insecure_rsh", "0", PHP_INI_SYSTEM, OnUpdateBool, enable_rsh, zend_imap_globals, imap_globals)
+PHP_INI_END()
+/* }}} */
+
+
 /* {{{ imap_module_entry
 */
 zend_module_entry imap_module_entry = {
@@ -835,6 +844,8 @@ PHP_MINIT_FUNCTION(imap)
 {
 	unsigned long sa_all =	SA_MESSAGES | SA_RECENT | SA_UNSEEN | SA_UIDNEXT | SA_UIDVALIDITY;

+	REGISTER_INI_ENTRIES();
+
 #ifndef PHP_WIN32
 	mail_link(&unixdriver);		/* link in the unix driver */
 	mail_link(&mhdriver);		/* link in the mh driver */
@@ -1052,6 +1063,12 @@ PHP_MINIT_FUNCTION(imap)
 	GC_TEXTS               texts
 	*/

+	if (!IMAPG(enable_rsh)) {
+		/* disable SSH and RSH, see https://bugs.php.net/bug.php?id=77153 */
+		mail_parameters (NIL, SET_RSHTIMEOUT, 0);
+		mail_parameters (NIL, SET_SSHTIMEOUT, 0);
+	}
+
 	le_imap = zend_register_list_destructors_ex(mail_close_it, NULL, "imap", module_number);
 	return SUCCESS;
 }
@@ -1138,6 +1155,8 @@ PHP_MINFO_FUNCTION(imap)
 	php_info_print_table_row(2, "Kerberos Support", "enabled");
 #endif
 	php_info_print_table_end();
+
+	DISPLAY_INI_ENTRIES();
 }
 /* }}} */

@@ -2523,7 +2542,7 @@ PHP_FUNCTION(imap_8bit)
 		RETURN_FALSE;
 	}

-	RETVAL_STRINGL(decode, newlength, 1);
+	RETVAL_STRINGL_CHECK(decode, newlength, 1);
 	fs_give((void**) &decode);
 }
 /* }}} */
@@ -3900,7 +3919,7 @@ int _php_imap_mail(char *to, char *subject, char *message, char *headers, char *
 	char *tsm_errmsg = NULL;
 	ADDRESS *addr;
 	char *bufferTo = NULL, *bufferCc = NULL, *bufferBcc = NULL, *bufferHeader = NULL;
-	int offset, bufferLen = 0;
+	size_t offset, bufferLen = 0;
 	size_t bt_len;

 	if (headers) {
@@ -3916,7 +3935,7 @@ int _php_imap_mail(char *to, char *subject, char *message, char *headers, char *
 #define PHP_IMAP_CLEAN	if (bufferTo) efree(bufferTo); if (bufferCc) efree(bufferCc); if (bufferBcc) efree(bufferBcc); if (bufferHeader) efree(bufferHeader);
 #define PHP_IMAP_BAD_DEST PHP_IMAP_CLEAN; efree(tempMailTo); return (BAD_MSG_DESTINATION);

-	bufferHeader = (char *)emalloc(bufferLen + 1);
+	bufferHeader = (char *)safe_emalloc(bufferLen, 1, 1);
 	memset(bufferHeader, 0, bufferLen);
 	if (to && *to) {
 		strlcat(bufferHeader, "To: ", bufferLen + 1);
@@ -4075,7 +4094,6 @@ PHP_FUNCTION(imap_mail)
 	if (!message_len) {
 		/* this is not really an error, so it is allowed. */
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "No message string in mail command");
-		message = NULL;
 	}

 	if (_php_imap_mail(to, subject, message, headers, cc, bcc, rpath TSRMLS_CC)) {
@@ -214,6 +214,7 @@ ZEND_BEGIN_MODULE_GLOBALS(imap)
 #endif
 	/* php_stream for php_mail_gets() */
 	php_stream *gets_stream;
+	zend_bool enable_rsh;
 ZEND_END_MODULE_GLOBALS(imap)

 #ifdef ZTS