set versions

* PHP-7.0:
  Fixed bug #72535 arcfour encryption stream filter crashes php

.appveyor.yml

@@ -24,7 +24,7 @@ environment:
         PHP_BUILD_CACHE_BASE_DIR: c:\build-cache  
         PHP_BUILD_OBJ_DIR: c:\obj
         PHP_BUILD_CACHE_SDK_DIR: c:\build-cache\sdk
-        PHP_BUILD_SDK_BRANCH: php-sdk-2.0.9
+        PHP_BUILD_SDK_BRANCH: php-sdk-2.0.11
         # ext and env setup for tests
         #MYSQL_TEST_PASSWD: Password12!
         #MYSQL_TEST_USER: root

.gitattributes

@@ -15,11 +15,8 @@ ext/dba/libflatfile/flatfile.c  ident
 ext/dba/libcdb/cdb_make.c       ident
 ext/dba/libcdb/cdb.c            ident
 ext/filter/filter.c             ident
-ext/zip/php_zip.c               ident
 README.input_filter             ident
 run-tests.php                   ident
-sapi/nsapi/nsapi.c              ident
-sapi/continuity/capi.c          ident
 Zend/RFCs/002.txt               ident
 Zend/RFCs/003.txt               ident
 ext/exif/exif.c                 ident
@@ -32,7 +29,6 @@ UPGRADING.INTERNALS             merge=NEWS
 /ext/bz2/tests/with_strings.phpt	-crlf
 /ext/dom/tests/bug40836.phpt	-crlf
 /ext/dom/tests/domelement.phpt	-crlf
-/ext/ereg/tests/eregi_basic_002.phpt	-crlf
 /ext/iconv/tests/iconv004.phpt	-crlf
 /ext/iconv/tests/iconv_basic.phpt	-crlf
 /ext/iconv/tests/iconv_strpos.phpt	-crlf

.gitignore

@@ -262,9 +262,7 @@ pear/phpize
 pear/run-tests
 pear/php-config
 pear/scripts
-sapi/apache/libphp7.module
 sapi/apache2handler/libphp7.module
-sapi/apache_hooks/libphp7.module
 sapi/cgi/php-cgi
 sapi/cgi/php-cgi.1
 sapi/cli/php.1

Makefile.global

@@ -5,7 +5,7 @@ INSTALL_DATA = $(INSTALL) -m 644
 DEFS = -DPHP_ATOM_INC -I$(top_builddir)/include -I$(top_builddir)/main -I$(top_srcdir)
 COMMON_FLAGS = $(DEFS) $(INCLUDES) $(EXTRA_INCLUDES) $(CPPFLAGS) $(PHP_FRAMEWORKPATH)
 
-all: $(all_targets) 
+all: $(all_targets)
 	@echo
 	@echo "Build complete."
 	@echo "Don't forget to run 'make test'."
@@ -112,13 +112,13 @@ test: all
 clean:
 	find . -name \*.gcno -o -name \*.gcda | xargs rm -f
 	find . -name \*.lo -o -name \*.o | xargs rm -f
-	find . -name \*.la -o -name \*.a | xargs rm -f 
+	find . -name \*.la -o -name \*.a | xargs rm -f
 	find . -name \*.so | xargs rm -f
 	find . -name .libs -a -type d|xargs rm -rf
 	rm -f libphp$(PHP_MAJOR_VERSION).la $(SAPI_CLI_PATH) $(SAPI_CGI_PATH) $(SAPI_MILTER_PATH) $(SAPI_LITESPEED_PATH) $(SAPI_FPM_PATH) $(OVERALL_TARGET) modules/* libs/*
 
 distclean: clean
-	rm -f Makefile config.cache config.log config.status Makefile.objects Makefile.fragments libtool main/php_config.h main/internal_functions_cli.c main/internal_functions.c stamp-h sapi/apache/libphp$(PHP_MAJOR_VERSION).module sapi/apache_hooks/libphp$(PHP_MAJOR_VERSION).module buildmk.stamp Zend/zend_dtrace_gen.h Zend/zend_dtrace_gen.h.bak Zend/zend_config.h TSRM/tsrm_config.h
+	rm -f Makefile config.cache config.log config.status Makefile.objects Makefile.fragments libtool main/php_config.h main/internal_functions_cli.c main/internal_functions.c stamp-h buildmk.stamp Zend/zend_dtrace_gen.h Zend/zend_dtrace_gen.h.bak Zend/zend_config.h TSRM/tsrm_config.h
 	rm -f php7.spec main/build-defs.h scripts/phpize
 	rm -f ext/date/lib/timelib_config.h ext/mbstring/oniguruma/config.h ext/mbstring/libmbfl/config.h ext/oci8/oci8_dtrace_gen.h ext/oci8/oci8_dtrace_gen.h.bak
 	rm -f scripts/man1/phpize.1 scripts/php-config scripts/man1/php-config.1 sapi/cli/php.1 sapi/cgi/php-cgi.1 ext/phar/phar.1 ext/phar/phar.phar.1
@@ -135,7 +135,7 @@ prof-gen:
 
 prof-clean:
 	find . -name \*.lo -o -name \*.o | xargs rm -f
-	find . -name \*.la -o -name \*.a | xargs rm -f 
+	find . -name \*.la -o -name \*.a | xargs rm -f
 	find . -name \*.so | xargs rm -f
 	rm -f libphp$(PHP_MAJOR_VERSION).la $(SAPI_CLI_PATH) $(SAPI_CGI_PATH) $(SAPI_MILTER_PATH) $(SAPI_LITESPEED_PATH) $(SAPI_FPM_PATH) $(OVERALL_TARGET) modules/* libs/*
 

NEWS

@@ -1,12 +1,111 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? ????, PHP 7.1.9
+26 Oct 2017, PHP 7.1.11
+
+- Core:
+  . Fixed bug #75241 (Null pointer dereference in zend_mm_alloc_small()).
+    (Laruence)
+  . Fixed bug #75236 (infinite loop when printing an error-message). (Andrea)
+  . Fixed bug #75252 (Incorrect token formatting on two parse errors in one
+    request). (Nikita)
+  . Fixed bug #75220 (Segfault when calling is_callable on parent). 
+    (andrewnester)
+  . Fixed bug #75290 (debug info of Closures of internal functions contain
+    garbage argument names). (Andrea)
+
+- Date:
+  . Fixed bug #75055 (Out-Of-Bounds Read in timelib_meridian()). (Derick)
+
+- Apache2Handler:
+  . Fixed bug #75311 (error: 'zend_hash_key' has no member named 'arKey' in
+    apache2handler). (mcarbonneaux)
+
+- Hash:
+  . Fixed bug #75303 (sha3 hangs on bigendian). (Remi)
+
+- Intl:
+  . Fixed bug #75318 (The parameter of UConverter::getAliases() is not
+    optional). (cmb)
+
+- litespeed:
+  . Fixed bug #75248 (Binary directory doesn't get created when building 
+    only litespeed SAPI). (petk)
+  . Fixed bug #75251 (Missing program prefix and suffix). (petk)
+
+- mcrypt:
+  . Fixed bug #72535 (arcfour encryption stream filter crashes php). (Leigh)
+
+- MySQLi:
+  . Fixed bug #75018 (Data corruption when reading fields of bit type). (Anatol)
+
+- OCI8:
+  . Fixed incorrect reference counting. (Dmitry, Tianfang Yang)
+
+- Opcache
+  . Fixed bug #75255 (Request hangs and not finish). (Dmitry)
+
+- PCRE:
+  . Fixed bug #75207 (applied upstream patch for CVE-2016-1283). (Anatol)
+
+- PDO_mysql:
+  . Fixed bug #75177 (Type 'bit' is fetched as unexpected string). (Anatol)
+
+- SPL:
+  . Fixed bug #73629 (SplDoublyLinkedList::setIteratorMode masks intern flags).
+    (J. Jeising, cmb)
+
+28 Sep 2017, PHP 7.1.10
+
+- Core:
+  . Fixed bug #75042 (run-tests.php issues with EXTENSION block). (John Boehr)
+
+- BCMath:
+  . Fixed bug #44995 (bcpowmod() fails if scale != 0). (cmb)
+  . Fixed bug #46781 (BC math handles minus zero incorrectly). (cmb)
+  . Fixed bug #54598 (bcpowmod() may return 1 if modulus is 1). (okano1220, cmb)
+  . Fixed bug #75178 (bcpowmod() misbehaves for non-integer base or modulus). (cmb)
+
+- CLI server:
+  . Fixed bug #70470 (Built-in server truncates headers spanning over TCP
+    packets). (bouk)
+
+- CURL:
+  . Fixed bug #75093 (OpenSSL support not detected). (Remi)
+
+- GD:
+  . Fixed bug #75124 (gdImageGrayScale() may produce colors). (cmb)
+  . Fixed bug #75139 (libgd/gd_interpolation.c:1786: suspicious if ?). (cmb)
+
+- Gettext:
+  . Fixed bug #73730 (textdomain(null) throws in strict mode). (cmb)
+
+- Intl:
+  . Fixed bug #75090 (IntlGregorianCalendar doesn't have constants from parent
+    class). (tpunt)
+  . Fixed bug #75193 (segfault in collator_convert_object_to_string). (Remi)
+
+- PDO_OCI:
+  . Fixed bug #74631 (PDO_PCO with PHP-FPM: OCI environment initialized
+    before PHP-FPM sets it up). (Ingmar Runge)
+
+- SPL:
+  . Fixed bug #75155 (AppendIterator::append() is broken when appending another
+    AppendIterator). (Nikita)
+  . Fixed bug #75173 (incorrect behavior of AppendIterator::append in foreach loop).
+    (jhdxr)
+
+- Standard:
+  . Fixed bug #75152 (signed integer overflow in parse_iv). (Laruence)
+  . Fixed bug #75097 (gethostname fails if your host name is 64 chars long). (Andrea)
+
+31 Aug 2017, PHP 7.1.9
 
 - Core:
   . Fixed bug #74947 (Segfault in scanner on INF number). (Laruence)
   . Fixed bug #74954 (null deref and segfault in zend_generator_resume()). (Bob)
   . Fixed bug #74725 (html_errors=1 breaks unhandled exceptions). (Andrea)
   . Fixed bug #75063 (Main CWD initialized with wrong codepage). (Anatol)
+  . Fixed bug #75349 (NAN comparison). (Sara)
 
 - cURL:
   . Fixed bug #74125 (Fixed finding CURL on systems with multiarch support).

Zend/tests/bug75241.phpt

@@ -0,0 +1,13 @@
+--TEST--
+Bug #75241 (Null pointer dereference in zend_mm_alloc_small())
+--FILE--
+<?php
+function eh(){}
+
+set_error_handler('eh');
+
+$d->d = &$d + $d->d/=0;
+var_dump($d);
+?>
+--EXPECT--
+float(INF)

Zend/tests/bug75252.phpt

@@ -0,0 +1,28 @@
+--TEST--
+Bug #75252: Incorrect token formatting on two parse errors in one request
+--FILE--
+<?php
+
+$code = <<<'CODE'
+function test_missing_semicolon() : string {
+     $x = []
+     FOO
+}
+CODE;
+
+try {
+    eval($code);
+} catch (ParseError $e) {
+    var_dump($e->getMessage());
+}
+
+try {
+    eval($code);
+} catch (ParseError $e) {
+    var_dump($e->getMessage());
+}
+
+?>
+--EXPECT--
+string(41) "syntax error, unexpected 'FOO' (T_STRING)"
+string(41) "syntax error, unexpected 'FOO' (T_STRING)"

Zend/tests/bug75290.phpt

@@ -0,0 +1,26 @@
+--TEST--
+Bug #75290 (debug info of Closures of internal functions contain garbage argument names)
+--FILE--
+<?php
+
+var_dump((new ReflectionFunction('sin'))->getClosure());
+
+var_dump(function ($someThing) {});
+
+?>
+--EXPECT--
+object(Closure)#2 (1) {
+  ["parameter"]=>
+  array(1) {
+    ["$number"]=>
+    string(10) "<required>"
+  }
+}
+object(Closure)#2 (1) {
+  ["parameter"]=>
+  array(1) {
+    ["$someThing"]=>
+    string(10) "<required>"
+  }
+}
+

Zend/zend.c

@@ -916,6 +916,8 @@ void zend_set_utility_values(zend_utility_values *utility_values) /* {{{ */
 /* this should be compatible with the standard zenderror */
 ZEND_COLD void zenderror(const char *error) /* {{{ */
 {
+	CG(parse_error) = 0;
+
 	if (EG(exception)) {
 		/* An exception was thrown in the lexer, don't throw another in the parser. */
 		return;

Zend/zend.h

@@ -279,7 +279,6 @@ ZEND_COLD void zenderror(const char *error);
 #define ZEND_STANDARD_CLASS_DEF_PTR zend_standard_class_def
 extern ZEND_API zend_class_entry *zend_standard_class_def;
 extern ZEND_API zend_utility_values zend_uv;
-extern ZEND_API zval zval_used_for_init;
 
 /* If DTrace is available and enabled */
 extern ZEND_API zend_bool zend_dtrace_enabled;

Zend/zend_API.c

@@ -3068,7 +3068,8 @@ get_function_via_handler:
 					    (!fcc->function_handler->common.scope ||
 					     !instanceof_function(ce_org, fcc->function_handler->common.scope))) {
 						if (fcc->function_handler->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
-							if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION) {
+							if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION && 
+								fcc->function_handler->common.function_name) {
 								zend_string_release(fcc->function_handler->common.function_name);
 							}
 							zend_free_trampoline(fcc->function_handler);
@@ -3240,7 +3241,8 @@ again:
 				((fcc->function_handler->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) ||
 			     fcc->function_handler->type == ZEND_OVERLOADED_FUNCTION_TEMPORARY ||
 			     fcc->function_handler->type == ZEND_OVERLOADED_FUNCTION)) {
-				if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION) {
+				if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION && 
+					fcc->function_handler->common.function_name) {
 					zend_string_release(fcc->function_handler->common.function_name);
 				}
 				zend_free_trampoline(fcc->function_handler);
@@ -3327,7 +3329,8 @@ again:
 						((fcc->function_handler->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) ||
 					     fcc->function_handler->type == ZEND_OVERLOADED_FUNCTION_TEMPORARY ||
 					     fcc->function_handler->type == ZEND_OVERLOADED_FUNCTION)) {
-						if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION) {
+						if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION && 
+							fcc->function_handler->common.function_name) {
 							zend_string_release(fcc->function_handler->common.function_name);
 						}
 						zend_free_trampoline(fcc->function_handler);

Zend/zend_alloc.c

@@ -283,7 +283,7 @@ struct _zend_mm_chunk {
 	uint32_t           free_pages;				/* number of free pages */
 	uint32_t           free_tail;               /* number of free pages at the end of chunk */
 	uint32_t           num;
-	char               reserve[64 - (sizeof(void*) * 3 + sizeof(int) * 3)];
+	char               reserve[64 - (sizeof(void*) * 3 + sizeof(uint32_t) * 3)];
 	zend_mm_heap       heap_slot;               /* used only in main chunk */
 	zend_mm_page_map   free_map;                /* 512 bits or 64 bytes */
 	zend_mm_page_info  map[ZEND_MM_PAGES];      /* 2 KB = 512 * 4 */

Zend/zend_builtin_functions.c

@@ -220,6 +220,10 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_set_exception_handler, 0, 0, 1)
 	ZEND_ARG_INFO(0, exception_handler)
 ZEND_END_ARG_INFO()
 
+ZEND_BEGIN_ARG_INFO_EX(arginfo_get_defined_functions, 0, 0, 1)
+	ZEND_ARG_INFO(0, exclude_disabled)
+ZEND_END_ARG_INFO()
+
 ZEND_BEGIN_ARG_INFO_EX(arginfo_create_function, 0, 0, 2)
 	ZEND_ARG_INFO(0, args)
 	ZEND_ARG_INFO(0, code)
@@ -366,7 +370,7 @@ static const zend_function_entry builtin_functions[] = { /* {{{ */
 	ZEND_FE(get_declared_classes, 		arginfo_zend__void)
 	ZEND_FE(get_declared_traits, 		arginfo_zend__void)
 	ZEND_FE(get_declared_interfaces, 	arginfo_zend__void)
-	ZEND_FE(get_defined_functions, 		arginfo_zend__void)
+	ZEND_FE(get_defined_functions, 		arginfo_get_defined_functions)
 	ZEND_FE(get_defined_vars,		arginfo_zend__void)
 	ZEND_FE(create_function,		arginfo_create_function)
 	ZEND_FE(get_resource_type,		arginfo_get_resource_type)
@@ -1280,7 +1284,7 @@ ZEND_FUNCTION(get_object_vars)
 						zend_unmangle_property_name_ex(key, &class_name, &prop_name, &prop_len);
 						zend_hash_str_add_new(Z_ARRVAL_P(return_value), prop_name, prop_len, value);
 					} else {
-						zend_symbtable_add_new(Z_ARRVAL_P(return_value), key, value);
+						zend_symtable_add_new(Z_ARRVAL_P(return_value), key, value);
 					}
 				}
 			}

Zend/zend_closures.c

@@ -503,6 +503,7 @@ static HashTable *zend_closure_get_debug_info(zval *object, int *is_temp) /* {{{
 	zval val;
 	struct _zend_arg_info *arg_info = closure->func.common.arg_info;
 	HashTable *debug_info;
+	zend_bool zstr_args = (closure->func.type == ZEND_USER_FUNCTION) || (closure->func.common.fn_flags & ZEND_ACC_USER_ARG_INFO);
 
 	*is_temp = 1;
 
@@ -535,9 +536,15 @@ static HashTable *zend_closure_get_debug_info(zval *object, int *is_temp) /* {{{
 			zend_string *name;
 			zval info;
 			if (arg_info->name) {
-				name = zend_strpprintf(0, "%s$%s",
-						arg_info->pass_by_reference ? "&" : "",
-						ZSTR_VAL(arg_info->name));
+				if (zstr_args) {
+					name = zend_strpprintf(0, "%s$%s",
+							arg_info->pass_by_reference ? "&" : "",
+							ZSTR_VAL(arg_info->name));
+				} else {
+					name = zend_strpprintf(0, "%s$%s",
+							arg_info->pass_by_reference ? "&" : "",
+							((zend_internal_arg_info*)arg_info)->name);
+				}
 			} else {
 				name = zend_strpprintf(0, "%s$param%d",
 						arg_info->pass_by_reference ? "&" : "",

Zend/zend_hash.h

@@ -337,7 +337,7 @@ static zend_always_inline int zend_hash_str_exists_ind(const HashTable *ht, cons
 			Z_TYPE_P(Z_INDIRECT_P(zv)) != IS_UNDEF);
 }
 
-static zend_always_inline zval *zend_symbtable_add_new(HashTable *ht, zend_string *key, zval *pData)
+static zend_always_inline zval *zend_symtable_add_new(HashTable *ht, zend_string *key, zval *pData)
 {
 	zend_ulong idx;
 
@@ -348,6 +348,10 @@ static zend_always_inline zval *zend_symbtable_add_new(HashTable *ht, zend_strin
 	}
 }
 
+/* This typo snuck into 7.0.17 and 7.1.3, this define exists for BC */
+#define zend_symbtable_add_new(ht, key, pData) \
+        zend_symtable_add_new(ht, key, pData)
+
 static zend_always_inline zval *zend_symtable_update(HashTable *ht, zend_string *key, zval *pData)
 {
 	zend_ulong idx;

Zend/zend_operators.c

@@ -222,8 +222,10 @@ ZEND_API void ZEND_FASTCALL convert_scalar_to_number(zval *op) /* {{{ */
 					if (Z_TYPE(holder) == IS_LONG) {				\
 						if (op == result) {							\
 							zval_ptr_dtor(op);						\
+							ZVAL_LONG(op, Z_LVAL(holder));			\
+						} else {									\
+							(op) = &(holder);						\
 						}											\
-						(op) = &(holder);							\
 					}												\
 					break;											\
 			}														\

Zend/zend_variables.c

@@ -167,8 +167,10 @@ ZEND_API void ZEND_FASTCALL _zval_copy_ctor_func(zval *zvalue ZEND_FILE_LINE_DC)
 {
 	if (EXPECTED(Z_TYPE_P(zvalue) == IS_ARRAY)) {
 		ZVAL_ARR(zvalue, zend_array_dup(Z_ARRVAL_P(zvalue)));
-	} else if (EXPECTED(Z_TYPE_P(zvalue) == IS_STRING) ||
-	           EXPECTED(Z_TYPE_P(zvalue) == IS_CONSTANT)) {
+	} else if (EXPECTED(Z_TYPE_P(zvalue) == IS_STRING)) {
+		CHECK_ZVAL_STRING_REL(Z_STR_P(zvalue));
+		ZVAL_NEW_STR(zvalue, zend_string_dup(Z_STR_P(zvalue), 0));
+	} else if (EXPECTED(Z_TYPE_P(zvalue) == IS_CONSTANT)) {
 		CHECK_ZVAL_STRING_REL(Z_STR_P(zvalue));
 		Z_STR_P(zvalue) = zend_string_dup(Z_STR_P(zvalue), 0);
 	} else if (EXPECTED(Z_TYPE_P(zvalue) == IS_CONSTANT_AST)) {

configure.in

@@ -119,8 +119,8 @@ int zend_sprintf(char *buffer, const char *format, ...);
 
 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=1
-PHP_RELEASE_VERSION=9
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=11
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
 

ext/bcmath/libbcmath/src/divmod.c

@@ -59,7 +59,7 @@ bc_divmod (bc_num num1, bc_num num2, bc_num *quot, bc_num *rem, int scale)
   bc_init_num(&temp);
 
   /* Calculate it. */
-  bc_divide (num1, num2, &temp, scale);
+  bc_divide (num1, num2, &temp, 0);
   if (quot)
     quotient = bc_copy_num (temp);
   bc_multiply (temp, num2, &temp, rscale);

ext/bcmath/libbcmath/src/raisemod.c

@@ -45,7 +45,7 @@
 int
 bc_raisemod (bc_num base, bc_num expo, bc_num mod, bc_num *result, int scale)
 {
-  bc_num power, exponent, parity, temp;
+  bc_num power, exponent, modulus, parity, temp;
   int rscale;
 
   /* Check for correct numbers. */
@@ -55,12 +55,16 @@ bc_raisemod (bc_num base, bc_num expo, bc_num mod, bc_num *result, int scale)
   /* Set initial values.  */
   power = bc_copy_num (base);
   exponent = bc_copy_num (expo);
+  modulus = bc_copy_num (mod);
   temp = bc_copy_num (BCG(_one_));
   bc_init_num(&parity);
 
   /* Check the base for scale digits. */
-  if (base->n_scale != 0)
+  if (power->n_scale != 0)
+    {
       bc_rt_warn ("non-zero scale in base");
+      bc_divide (power, BCG(_one_), &power, 0); /*truncate */
+    }
 
   /* Check the exponent for scale digits. */
   if (exponent->n_scale != 0)
@@ -70,27 +74,38 @@ bc_raisemod (bc_num base, bc_num expo, bc_num mod, bc_num *result, int scale)
     }
 
   /* Check the modulus for scale digits. */
-  if (mod->n_scale != 0)
+  if (modulus->n_scale != 0)
+    {
       bc_rt_warn ("non-zero scale in modulus");
+      bc_divide (modulus, BCG(_one_), &modulus, 0); /*truncate */
+    }
 
   /* Do the calculation. */
-  rscale = MAX(scale, base->n_scale);
-  while ( !bc_is_zero(exponent) )
+  rscale = MAX(scale, power->n_scale);
+  if ( !bc_compare(modulus, BCG(_one_)) )
     {
-      (void) bc_divmod (exponent, BCG(_two_), &exponent, &parity, 0);
-      if ( !bc_is_zero(parity) )
+      temp = bc_new_num (1, scale);
+    }
+  else
+    {
+      while ( !bc_is_zero(exponent) )
 	{
-	  bc_multiply (temp, power, &temp, rscale);
-	  (void) bc_modulo (temp, mod, &temp, scale);
-	}
+	  (void) bc_divmod (exponent, BCG(_two_), &exponent, &parity, 0);
+	  if ( !bc_is_zero(parity) )
+	    {
+	      bc_multiply (temp, power, &temp, rscale);
+	      (void) bc_modulo (temp, modulus, &temp, scale);
+	    }
 
-      bc_multiply (power, power, &power, rscale);
-      (void) bc_modulo (power, mod, &power, scale);
+	  bc_multiply (power, power, &power, rscale);
+	  (void) bc_modulo (power, modulus, &power, scale);
+	}
     }
 
   /* Assign the value. */
   bc_free_num (&power);
   bc_free_num (&exponent);
+  bc_free_num (&modulus);
   bc_free_num (result);
   bc_free_num (&parity);
   *result = temp;

ext/bcmath/libbcmath/src/str2num.c

@@ -105,5 +105,8 @@ bc_str2num (bc_num *num, char *str, int scale)
       for (;strscale > 0; strscale--)
 	*nptr++ = CH_VAL(*ptr++);
     }
+
+  if (bc_is_zero (*num))
+    (*num)->n_sign = PLUS;
 }
 

ext/bcmath/tests/bug44995.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug #44995 (bcpowmod() fails if scale != 0)
+--SKIPIF--
+<?php
+if (!extension_loaded('bcmath')) die('skip bcmath extension not available');
+?>
+--FILE--
+<?php
+var_dump(bcpowmod('4', '4', '3', 1));
+var_dump(bcpowmod('3234', '32345', '22345', 1));
+?>
+===DONE===
+--EXPECT--
+string(3) "1.0"
+string(7) "17334.0"
+===DONE===

ext/bcmath/tests/bug46781.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug #46781 (BC math handles minus zero incorrectly)
+--SKIPIF--
+<?php
+if (!extension_loaded('bcmath')) die('skip bcmath extension is not available');
+?>
+--FILE--
+<?php
+var_dump(bcadd('-0.0', '-0.0', 1));
+var_dump(bccomp('-0.0', '0', 1));
+?>
+===DONE===
+--EXPECT--
+string(3) "0.0"
+int(0)
+===DONE===

ext/bcmath/tests/bug54598.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug #54598 (bcpowmod() may return 1 if modulus is 1)
+--SKIPIF--
+<?php
+if (!extension_loaded('bcmath')) die('skip bcmath extension is not available');
+?>
+--FILE--
+<?php
+var_dump(bcpowmod(5, 0, 1));
+var_dump(bcpowmod(5, 0, 1, 3));
+?>
+===DONE===
+--EXPECT--
+string(1) "0"
+string(5) "0.000"
+===DONE===

ext/bcmath/tests/bug75178-win32.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Bug #75178 (bcpowmod() misbehaves for non-integer base or modulus)
+--SKIPIF--
+<?php
+if (!extension_loaded('bcmath')) die('skip bcmath extension is not available');
+if (substr(PHP_OS, 0, 3) != 'WIN') {
+    die('skip valid only for windows');
+}
+?>
+--FILE--
+<?php
+var_dump(bcpowmod('4.1', '4', '3', 3));
+var_dump(bcpowmod('4', '4', '3.1', 3));
+?>
+===DONE===
+--EXPECT--
+string(5) "1.000"
+string(5) "1.000"
+===DONE===
+bc math warning: non-zero scale in base
+bc math warning: non-zero scale in modulus

ext/bcmath/tests/bug75178.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Bug #75178 (bcpowmod() misbehaves for non-integer base or modulus)
+--SKIPIF--
+<?php
+if (!extension_loaded('bcmath')) die('skip bcmath extension is not available');
+if (substr(PHP_OS, 0, 3) == 'WIN') {
+    die('skip Not valid for windows');
+}
+?>
+--FILE--
+<?php
+var_dump(bcpowmod('4.1', '4', '3', 3));
+var_dump(bcpowmod('4', '4', '3.1', 3));
+?>
+===DONE===
+--EXPECT--
+bc math warning: non-zero scale in base
+string(5) "1.000"
+bc math warning: non-zero scale in modulus
+string(5) "1.000"
+===DONE===

ext/curl/config.m4

@@ -73,6 +73,8 @@ if test "$PHP_CURL" != "no"; then
    
     save_CFLAGS="$CFLAGS"
     CFLAGS="`$CURL_CONFIG --cflags`"
+    save_LDFLAGS="$LDFLAGS"
+    LDFLAGS="`$CURL_CONFIG --libs`"
    
     AC_PROG_CPP
     AC_MSG_CHECKING([for openssl support in libcurl])
@@ -130,6 +132,7 @@ int main(int argc, char *argv[])
     ])
    
     CFLAGS="$save_CFLAGS"
+    LDFLAGS="$save_LDFLAGS"
   else
     AC_MSG_RESULT([no])
   fi

ext/date/lib/parse_date.re

@@ -931,8 +931,8 @@ isoweek          = year4 "-"? "W" weekofyear;
 exif             = year4 ":" monthlz ":" daylz " " hour24lz ":" minutelz ":" secondlz;
 firstdayof       = 'first day of';
 lastdayof        = 'last day of';
-backof           = 'back of ' hour24 space? meridian?;
-frontof          = 'front of ' hour24 space? meridian?;
+backof           = 'back of ' hour24 (space? meridian)?;
+frontof          = 'front of ' hour24 (space? meridian)?;
 
 /* Common Log Format: 10/Oct/2000:13:55:36 -0700 */
 clf              = day "/" monthabbr "/" year4 ":" hour24lz ":" minutelz ":" secondlz space tzcorrection;

ext/date/lib/parse_iso_intervals.c

@@ -1,4 +1,4 @@
-/* Generated by re2c 0.13.5 on Thu Aug 13 10:30:12 2015 */
+/* Generated by re2c 0.15.3 on Wed Aug 16 15:55:55 2017 */
 #line 1 "ext/date/lib/parse_iso_intervals.re"
 /*
  * The MIT License (MIT)
@@ -258,45 +258,45 @@ std:
 
 
 
-#line 262 "ext/date/lib/parse_iso_intervals.c"
+#line 262 "<stdout>"
 {
 	YYCTYPE yych;
 	unsigned int yyaccept = 0;
 	static const unsigned char yybm[] = {
-		  0,   0,   0,   0,   0,   0,   0,   0,
-		  0,   0,   0,   0,   0,   0,   0,   0,
-		  0,   0,   0,   0,   0,   0,   0,   0,
-		  0,   0,   0,   0,   0,   0,   0,   0,
-		  0,   0,   0,   0,   0,   0,   0,   0,
-		  0,   0,   0,   0,   0,   0,   0,   0,
-		128, 128, 128, 128, 128, 128, 128, 128,
-		128, 128,   0,   0,   0,   0,   0,   0,
-		  0,   0,   0,   0,   0,   0,   0,   0,
-		  0,   0,   0,   0,   0,   0,   0,   0,
-		  0,   0,   0,   0,   0,   0,   0,   0,
-		  0,   0,   0,   0,   0,   0,   0,   0,
-		  0,   0,   0,   0,   0,   0,   0,   0,
-		  0,   0,   0,   0,   0,   0,   0,   0,
-		  0,   0,   0,   0,   0,   0,   0,   0,
-		  0,   0,   0,   0,   0,   0,   0,   0,
-		  0,   0,   0,   0,   0,   0,   0,   0,
-		  0,   0,   0,   0,   0,   0,   0,   0,
-		  0,   0,   0,   0,   0,   0,   0,   0,
-		  0,   0,   0,   0,   0,   0,   0,   0,
-		  0,   0,   0,   0,   0,   0,   0,   0,
-		  0,   0,   0,   0,   0,   0,   0,   0,
-		  0,   0,   0,   0,   0,   0,   0,   0,
-		  0,   0,   0,   0,   0,   0,   0,   0,
-		  0,   0,   0,   0,   0,   0,   0,   0,
-		  0,   0,   0,   0,   0,   0,   0,   0,
-		  0,   0,   0,   0,   0,   0,   0,   0,
-		  0,   0,   0,   0,   0,   0,   0,   0,
-		  0,   0,   0,   0,   0,   0,   0,   0,
-		  0,   0,   0,   0,   0,   0,   0,   0,
-		  0,   0,   0,   0,   0,   0,   0,   0,
-		  0,   0,   0,   0,   0,   0,   0,   0,
+		  0,   0,   0,   0,   0,   0,   0,   0, 
+		  0,   0,   0,   0,   0,   0,   0,   0, 
+		  0,   0,   0,   0,   0,   0,   0,   0, 
+		  0,   0,   0,   0,   0,   0,   0,   0, 
+		  0,   0,   0,   0,   0,   0,   0,   0, 
+		  0,   0,   0,   0,   0,   0,   0,   0, 
+		128, 128, 128, 128, 128, 128, 128, 128, 
+		128, 128,   0,   0,   0,   0,   0,   0, 
+		  0,   0,   0,   0,   0,   0,   0,   0, 
+		  0,   0,   0,   0,   0,   0,   0,   0, 
+		  0,   0,   0,   0,   0,   0,   0,   0, 
+		  0,   0,   0,   0,   0,   0,   0,   0, 
+		  0,   0,   0,   0,   0,   0,   0,   0, 
+		  0,   0,   0,   0,   0,   0,   0,   0, 
+		  0,   0,   0,   0,   0,   0,   0,   0, 
+		  0,   0,   0,   0,   0,   0,   0,   0, 
+		  0,   0,   0,   0,   0,   0,   0,   0, 
+		  0,   0,   0,   0,   0,   0,   0,   0, 
+		  0,   0,   0,   0,   0,   0,   0,   0, 
+		  0,   0,   0,   0,   0,   0,   0,   0, 
+		  0,   0,   0,   0,   0,   0,   0,   0, 
+		  0,   0,   0,   0,   0,   0,   0,   0, 
+		  0,   0,   0,   0,   0,   0,   0,   0, 
+		  0,   0,   0,   0,   0,   0,   0,   0, 
+		  0,   0,   0,   0,   0,   0,   0,   0, 
+		  0,   0,   0,   0,   0,   0,   0,   0, 
+		  0,   0,   0,   0,   0,   0,   0,   0, 
+		  0,   0,   0,   0,   0,   0,   0,   0, 
+		  0,   0,   0,   0,   0,   0,   0,   0, 
+		  0,   0,   0,   0,   0,   0,   0,   0, 
+		  0,   0,   0,   0,   0,   0,   0,   0, 
+		  0,   0,   0,   0,   0,   0,   0,   0, 
 	};
-
+	YYDEBUG(0, *YYCURSOR);
 	if ((YYLIMIT - YYCURSOR) < 20) YYFILL(20);
 	yych = *YYCURSOR;
 	if (yych <= ',') {
@@ -321,29 +321,34 @@ std:
 			if (yych != 'R') goto yy11;
 		}
 	}
+	YYDEBUG(2, *YYCURSOR);
 	++YYCURSOR;
 	if ((yych = *YYCURSOR) <= '/') goto yy3;
 	if (yych <= '9') goto yy98;
 yy3:
+	YYDEBUG(3, *YYCURSOR);
 #line 395 "ext/date/lib/parse_iso_intervals.re"
 	{
 		add_error(s, "Unexpected character");
 		goto std;
 	}
-#line 334 "ext/date/lib/parse_iso_intervals.c"
+#line 336 "<stdout>"
 yy4:
+	YYDEBUG(4, *YYCURSOR);
 	yyaccept = 0;
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych <= '/') goto yy3;
 	if (yych <= '9') goto yy59;
 	goto yy3;
 yy5:
+	YYDEBUG(5, *YYCURSOR);
 	yyaccept = 1;
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych <= '/') goto yy6;
 	if (yych <= '9') goto yy12;
 	if (yych == 'T') goto yy14;
 yy6:
+	YYDEBUG(6, *YYCURSOR);
 #line 322 "ext/date/lib/parse_iso_intervals.re"
 	{
 		timelib_sll nr;
@@ -385,26 +390,32 @@ yy6:
 		TIMELIB_DEINIT;
 		return TIMELIB_PERIOD;
 	}
-#line 389 "ext/date/lib/parse_iso_intervals.c"
+#line 394 "<stdout>"
 yy7:
+	YYDEBUG(7, *YYCURSOR);
 	++YYCURSOR;
+	YYDEBUG(8, *YYCURSOR);
 #line 384 "ext/date/lib/parse_iso_intervals.re"
 	{
 		goto std;
 	}
-#line 396 "ext/date/lib/parse_iso_intervals.c"
+#line 403 "<stdout>"
 yy9:
+	YYDEBUG(9, *YYCURSOR);
 	++YYCURSOR;
+	YYDEBUG(10, *YYCURSOR);
 #line 389 "ext/date/lib/parse_iso_intervals.re"
 	{
 		s->pos = cursor; s->line++;
 		goto std;
 	}
-#line 404 "ext/date/lib/parse_iso_intervals.c"
+#line 413 "<stdout>"
 yy11:
+	YYDEBUG(11, *YYCURSOR);
 	yych = *++YYCURSOR;
 	goto yy3;
 yy12:
+	YYDEBUG(12, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= 'L') {
 		if (yych <= '9') {
@@ -421,13 +432,15 @@ yy12:
 		}
 	}
 yy13:
+	YYDEBUG(13, *YYCURSOR);
 	YYCURSOR = YYMARKER;
-	if (yyaccept <= 0) {
+	if (yyaccept == 0) {
 		goto yy3;
 	} else {
 		goto yy6;
 	}
 yy14:
+	YYDEBUG(14, *YYCURSOR);
 	yyaccept = 1;
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yybm[0+yych] & 128) {
@@ -435,9 +448,11 @@ yy14:
 	}
 	goto yy6;
 yy15:
+	YYDEBUG(15, *YYCURSOR);
 	++YYCURSOR;
 	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
 	yych = *YYCURSOR;
+	YYDEBUG(16, *YYCURSOR);
 	if (yybm[0+yych] & 128) {
 		goto yy15;
 	}
@@ -449,23 +464,28 @@ yy15:
 		if (yych != 'S') goto yy13;
 	}
 yy17:
+	YYDEBUG(17, *YYCURSOR);
 	yych = *++YYCURSOR;
 	goto yy6;
 yy18:
+	YYDEBUG(18, *YYCURSOR);
 	yyaccept = 1;
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych <= '/') goto yy6;
 	if (yych <= '9') goto yy22;
 	goto yy6;
 yy19:
+	YYDEBUG(19, *YYCURSOR);
 	yyaccept = 1;
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych <= '/') goto yy6;
 	if (yych >= ':') goto yy6;
 yy20:
+	YYDEBUG(20, *YYCURSOR);
 	++YYCURSOR;
 	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
 	yych = *YYCURSOR;
+	YYDEBUG(21, *YYCURSOR);
 	if (yych <= 'L') {
 		if (yych <= '/') goto yy13;
 		if (yych <= '9') goto yy20;
@@ -476,18 +496,22 @@ yy20:
 		goto yy13;
 	}
 yy22:
+	YYDEBUG(22, *YYCURSOR);
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
+	YYDEBUG(23, *YYCURSOR);
 	if (yych <= '/') goto yy13;
 	if (yych <= '9') goto yy22;
 	if (yych == 'S') goto yy17;
 	goto yy13;
 yy24:
+	YYDEBUG(24, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych == 'T') goto yy14;
 	goto yy6;
 yy25:
+	YYDEBUG(25, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= 'L') {
 		if (yych <= '9') {
@@ -507,6 +531,7 @@ yy25:
 		}
 	}
 yy26:
+	YYDEBUG(26, *YYCURSOR);
 	yyaccept = 1;
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych <= '/') goto yy6;
@@ -514,6 +539,7 @@ yy26:
 	if (yych == 'T') goto yy14;
 	goto yy6;
 yy27:
+	YYDEBUG(27, *YYCURSOR);
 	yyaccept = 1;
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych <= '/') goto yy6;
@@ -521,6 +547,7 @@ yy27:
 	if (yych == 'T') goto yy14;
 	goto yy6;
 yy28:
+	YYDEBUG(28, *YYCURSOR);
 	yyaccept = 1;
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych <= '/') goto yy6;
@@ -528,9 +555,11 @@ yy28:
 	if (yych == 'T') goto yy14;
 	goto yy6;
 yy29:
+	YYDEBUG(29, *YYCURSOR);
 	++YYCURSOR;
 	if ((YYLIMIT - YYCURSOR) < 3) YYFILL(3);
 	yych = *YYCURSOR;
+	YYDEBUG(30, *YYCURSOR);
 	if (yych <= 'D') {
 		if (yych <= '/') goto yy13;
 		if (yych <= '9') goto yy29;
@@ -546,9 +575,11 @@ yy29:
 		}
 	}
 yy31:
+	YYDEBUG(31, *YYCURSOR);
 	++YYCURSOR;
 	if ((YYLIMIT - YYCURSOR) < 3) YYFILL(3);
 	yych = *YYCURSOR;
+	YYDEBUG(32, *YYCURSOR);
 	if (yych <= 'C') {
 		if (yych <= '/') goto yy13;
 		if (yych <= '9') goto yy31;
@@ -559,14 +590,17 @@ yy31:
 		goto yy13;
 	}
 yy33:
+	YYDEBUG(33, *YYCURSOR);
 	++YYCURSOR;
 	if ((YYLIMIT - YYCURSOR) < 3) YYFILL(3);
 	yych = *YYCURSOR;
+	YYDEBUG(34, *YYCURSOR);
 	if (yych <= '/') goto yy13;
 	if (yych <= '9') goto yy33;
 	if (yych == 'D') goto yy24;
 	goto yy13;
 yy35:
+	YYDEBUG(35, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= 'L') {
 		if (yych <= '9') {
@@ -585,18 +619,22 @@ yy35:
 			goto yy13;
 		}
 	}
+	YYDEBUG(36, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych != '-') goto yy39;
+	YYDEBUG(37, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych <= '0') goto yy40;
 	if (yych <= '1') goto yy41;
 	goto yy13;
 yy38:
+	YYDEBUG(38, *YYCURSOR);
 	++YYCURSOR;
 	if ((YYLIMIT - YYCURSOR) < 3) YYFILL(3);
 	yych = *YYCURSOR;
 yy39:
+	YYDEBUG(39, *YYCURSOR);
 	if (yych <= 'L') {
 		if (yych <= '9') {
 			if (yych <= '/') goto yy13;
@@ -616,17 +654,21 @@ yy39:
 		}
 	}
 yy40:
+	YYDEBUG(40, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych <= '9') goto yy42;
 	goto yy13;
 yy41:
+	YYDEBUG(41, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych >= '3') goto yy13;
 yy42:
+	YYDEBUG(42, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych != '-') goto yy13;
+	YYDEBUG(43, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych <= '0') goto yy44;
@@ -634,54 +676,69 @@ yy42:
 	if (yych <= '3') goto yy46;
 	goto yy13;
 yy44:
+	YYDEBUG(44, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych <= '9') goto yy47;
 	goto yy13;
 yy45:
+	YYDEBUG(45, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych <= '9') goto yy47;
 	goto yy13;
 yy46:
+	YYDEBUG(46, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych >= '2') goto yy13;
 yy47:
+	YYDEBUG(47, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych != 'T') goto yy13;
+	YYDEBUG(48, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych <= '1') goto yy49;
 	if (yych <= '2') goto yy50;
 	goto yy13;
 yy49:
+	YYDEBUG(49, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych <= '9') goto yy51;
 	goto yy13;
 yy50:
+	YYDEBUG(50, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych >= '5') goto yy13;
 yy51:
+	YYDEBUG(51, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych != ':') goto yy13;
+	YYDEBUG(52, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych >= '6') goto yy13;
+	YYDEBUG(53, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych >= ':') goto yy13;
+	YYDEBUG(54, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych != ':') goto yy13;
+	YYDEBUG(55, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych >= '6') goto yy13;
+	YYDEBUG(56, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych >= ':') goto yy13;
+	YYDEBUG(57, *YYCURSOR);
 	++YYCURSOR;
+	YYDEBUG(58, *YYCURSOR);
 #line 364 "ext/date/lib/parse_iso_intervals.re"
 	{
 		DEBUG_OUTPUT("combinedrep");
@@ -701,14 +758,17 @@ yy51:
 		TIMELIB_DEINIT;
 		return TIMELIB_PERIOD;
 	}
-#line 705 "ext/date/lib/parse_iso_intervals.c"
+#line 762 "<stdout>"
 yy59:
+	YYDEBUG(59, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych >= ':') goto yy13;
+	YYDEBUG(60, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych >= ':') goto yy13;
+	YYDEBUG(61, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') {
 		if (yych == '-') goto yy64;
@@ -719,33 +779,40 @@ yy59:
 		goto yy13;
 	}
 yy62:
+	YYDEBUG(62, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '0') goto yy13;
 	if (yych <= '9') goto yy85;
 	goto yy13;
 yy63:
+	YYDEBUG(63, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych <= '2') goto yy85;
 	goto yy13;
 yy64:
+	YYDEBUG(64, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych <= '0') goto yy65;
 	if (yych <= '1') goto yy66;
 	goto yy13;
 yy65:
+	YYDEBUG(65, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '0') goto yy13;
 	if (yych <= '9') goto yy67;
 	goto yy13;
 yy66:
+	YYDEBUG(66, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych >= '3') goto yy13;
 yy67:
+	YYDEBUG(67, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych != '-') goto yy13;
+	YYDEBUG(68, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych <= '0') goto yy69;
@@ -753,57 +820,73 @@ yy67:
 	if (yych <= '3') goto yy71;
 	goto yy13;
 yy69:
+	YYDEBUG(69, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '0') goto yy13;
 	if (yych <= '9') goto yy72;
 	goto yy13;
 yy70:
+	YYDEBUG(70, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych <= '9') goto yy72;
 	goto yy13;
 yy71:
+	YYDEBUG(71, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych >= '2') goto yy13;
 yy72:
+	YYDEBUG(72, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych != 'T') goto yy13;
+	YYDEBUG(73, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych <= '1') goto yy74;
 	if (yych <= '2') goto yy75;
 	goto yy13;
 yy74:
+	YYDEBUG(74, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych <= '9') goto yy76;
 	goto yy13;
 yy75:
+	YYDEBUG(75, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych >= '5') goto yy13;
 yy76:
+	YYDEBUG(76, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych != ':') goto yy13;
+	YYDEBUG(77, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych >= '6') goto yy13;
+	YYDEBUG(78, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych >= ':') goto yy13;
+	YYDEBUG(79, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych != ':') goto yy13;
+	YYDEBUG(80, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych >= '6') goto yy13;
+	YYDEBUG(81, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych >= ':') goto yy13;
+	YYDEBUG(82, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych != 'Z') goto yy13;
 yy83:
+	YYDEBUG(83, *YYCURSOR);
 	++YYCURSOR;
+	YYDEBUG(84, *YYCURSOR);
 #line 298 "ext/date/lib/parse_iso_intervals.re"
 	{
 		timelib_time *current;
@@ -827,8 +910,9 @@ yy83:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_DATE;
 	}
-#line 831 "ext/date/lib/parse_iso_intervals.c"
+#line 914 "<stdout>"
 yy85:
+	YYDEBUG(85, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych <= '0') goto yy86;
@@ -836,59 +920,74 @@ yy85:
 	if (yych <= '3') goto yy88;
 	goto yy13;
 yy86:
+	YYDEBUG(86, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '0') goto yy13;
 	if (yych <= '9') goto yy89;
 	goto yy13;
 yy87:
+	YYDEBUG(87, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych <= '9') goto yy89;
 	goto yy13;
 yy88:
+	YYDEBUG(88, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych >= '2') goto yy13;
 yy89:
+	YYDEBUG(89, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych != 'T') goto yy13;
+	YYDEBUG(90, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych <= '1') goto yy91;
 	if (yych <= '2') goto yy92;
 	goto yy13;
 yy91:
+	YYDEBUG(91, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych <= '9') goto yy93;
 	goto yy13;
 yy92:
+	YYDEBUG(92, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych >= '5') goto yy13;
 yy93:
+	YYDEBUG(93, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych >= '6') goto yy13;
+	YYDEBUG(94, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych >= ':') goto yy13;
+	YYDEBUG(95, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych >= '6') goto yy13;
+	YYDEBUG(96, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy13;
 	if (yych >= ':') goto yy13;
+	YYDEBUG(97, *YYCURSOR);
 	yych = *++YYCURSOR;
 	if (yych == 'Z') goto yy83;
 	goto yy13;
 yy98:
+	YYDEBUG(98, *YYCURSOR);
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
+	YYDEBUG(99, *YYCURSOR);
 	if (yych <= '/') goto yy100;
 	if (yych <= '9') goto yy98;
 yy100:
+	YYDEBUG(100, *YYCURSOR);
 #line 287 "ext/date/lib/parse_iso_intervals.re"
 	{
 		DEBUG_OUTPUT("recurrences");
@@ -899,7 +998,7 @@ yy100:
 		s->have_recurrences = 1;
 		return TIMELIB_PERIOD;
 	}
-#line 903 "ext/date/lib/parse_iso_intervals.c"
+#line 1002 "<stdout>"
 }
 #line 399 "ext/date/lib/parse_iso_intervals.re"
 

ext/date/php_date.c

@@ -658,6 +658,7 @@ static HashTable *date_object_get_gc_timezone(zval *object, zval **table, int *n
 
 zval *date_interval_read_property(zval *object, zval *member, int type, void **cache_slot, zval *rv);
 void date_interval_write_property(zval *object, zval *member, zval *value, void **cache_slot);
+static zval *date_interval_get_property_ptr_ptr(zval *object, zval *member, int type, void **cache_slot);
 static zval *date_period_read_property(zval *object, zval *member, int type, void **cache_slot, zval *rv);
 static void date_period_write_property(zval *object, zval *member, zval *value, void **cache_slot);
 
@@ -921,6 +922,7 @@ PHP_MINFO_FUNCTION(date)
 
 	php_info_print_table_start();
 	php_info_print_table_row(2, "date/time support", "enabled");
+	php_info_print_table_row(2, "timelib version", TIMELIB_ASCII_VERSION);
 	php_info_print_table_row(2, "\"Olson\" Timezone Database Version", tzdb->version);
 	php_info_print_table_row(2, "Timezone Database", php_date_global_timezone_db_enabled ? "external" : "internal");
 	php_info_print_table_row(2, "Default timezone", guess_timezone(tzdb));
@@ -2128,7 +2130,7 @@ static void date_register_classes(void) /* {{{ */
 	date_object_handlers_interval.read_property = date_interval_read_property;
 	date_object_handlers_interval.write_property = date_interval_write_property;
 	date_object_handlers_interval.get_properties = date_object_get_properties_interval;
-	date_object_handlers_interval.get_property_ptr_ptr = NULL;
+	date_object_handlers_interval.get_property_ptr_ptr = date_interval_get_property_ptr_ptr;
 	date_object_handlers_interval.get_gc = date_object_get_gc_interval;
 
 	INIT_CLASS_ENTRY(ce_period, "DatePeriod", date_funcs_period);
@@ -4214,6 +4216,40 @@ void date_interval_write_property(zval *object, zval *member, zval *value, void
 }
 /* }}} */
 
+/* {{{ date_interval_get_property_ptr_ptr */
+static zval *date_interval_get_property_ptr_ptr(zval *object, zval *member, int type, void **cache_slot)
+{
+	zval tmp_member, *ret;
+
+	if (Z_TYPE_P(member) != IS_STRING) {
+		tmp_member = *member;
+		zval_copy_ctor(&tmp_member);
+		convert_to_string(&tmp_member);
+		member = &tmp_member;
+		cache_slot = NULL;
+	}
+
+	if(zend_binary_strcmp("y", sizeof("y") - 1, Z_STRVAL_P(member), Z_STRLEN_P(member)) == 0 ||
+		zend_binary_strcmp("m", sizeof("m") - 1, Z_STRVAL_P(member), Z_STRLEN_P(member)) == 0 ||
+		zend_binary_strcmp("d", sizeof("d") - 1, Z_STRVAL_P(member), Z_STRLEN_P(member)) == 0 ||
+		zend_binary_strcmp("h", sizeof("h") - 1, Z_STRVAL_P(member), Z_STRLEN_P(member)) == 0 ||
+		zend_binary_strcmp("i", sizeof("i") - 1, Z_STRVAL_P(member), Z_STRLEN_P(member)) == 0 ||
+		zend_binary_strcmp("s", sizeof("s") - 1, Z_STRVAL_P(member), Z_STRLEN_P(member)) == 0 ||
+		zend_binary_strcmp("days", sizeof("days") - 1, Z_STRVAL_P(member), Z_STRLEN_P(member)) == 0 ||
+		zend_binary_strcmp("invert", sizeof("invert") - 1, Z_STRVAL_P(member), Z_STRLEN_P(member)) == 0) {
+		/* Fallback to read_property. */
+		ret = NULL;
+	} else {
+		ret = (zend_get_std_object_handlers())->get_property_ptr_ptr(object, member, type, cache_slot);
+	}
+
+	if (member == &tmp_member) {
+		zval_dtor(member);
+	}
+
+	return ret;
+}
+/* }}} */
 
 /* {{{ proto DateInterval::__construct([string interval_spec])
    Creates new DateInterval object.

ext/date/tests/bug53437_var3.phpt

@@ -40,7 +40,7 @@ object(DateInterval)#%d (16) {
   ["special_amount"]=>
   int(-1)
   ["have_weekday_relative"]=>
-  int(9)
+  int(0)
   ["have_special_relative"]=>
   int(0)
   ["f"]=>

ext/date/tests/date_interval_prop_dim.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Test DateInterval props with dimension handling
+--FILE--
+<?php
+class Z extends DateInterval{}
+$z = new Z('P2Y4DT6H8M');
+$i = 0;
+$z->prop[1]=10;
+while ($i < 1026) {
+	$z->prop[$i] = $i;
+	$i++;
+}
+?>
+==NOCRASH==
+--EXPECT--
+==NOCRASH==

ext/dom/tests/dom005.phpt

@@ -5,7 +5,7 @@ Test 5: HTML Test
 --FILE--
 <?php
 $dom = new domdocument;
-$dom->loadHTMLFile(dirname(__FILE__)."/test.html");
+$dom->loadHTMLFile(dirname(__FILE__)."/test.html", LIBXML_NOBLANKS);
 print  "--- save as XML\n";
 
 print adjustDoctype($dom->saveXML());

ext/gd/libgd/gd_filter.c

@@ -53,12 +53,17 @@ int gdImageGrayScale(gdImagePtr src)
 	int new_pxl, pxl;
 	typedef int (*FuncPtr)(gdImagePtr, int, int);
 	FuncPtr f;
+	int alpha_blending;
+
 	f = GET_PIXEL_FUNCTION(src);
 
 	if (src==NULL) {
 		return 0;
 	}
 
+	alpha_blending = src->alphaBlendingFlag;
+	gdImageAlphaBlending(src, gdEffectReplace);
+
 	for (y=0; y<src->sy; ++y) {
 		for (x=0; x<src->sx; ++x) {
 			pxl = f (src, x, y);
@@ -75,6 +80,8 @@ int gdImageGrayScale(gdImagePtr src)
 			gdImageSetPixel (src, x, y, new_pxl);
 		}
 	}
+	gdImageAlphaBlending(src, alpha_blending);
+
 	return 1;
 }
 

ext/gd/libgd/gd_interpolation.c

@@ -1783,8 +1783,8 @@ gdImagePtr gdImageRotateGeneric(gdImagePtr src, const float degrees, const int b
 
 	const gdFixed f_slop_y = f_sin;
 	const gdFixed f_slop_x = f_cos;
-	const gdFixed f_slop = f_slop_x > 0 && f_slop_x > 0 ?
-							f_slop_x > f_slop_y ? gd_divfx(f_slop_y, f_slop_x) : gd_divfx(f_slop_x, f_slop_y)
+	const gdFixed f_slop = f_slop_x > 0 && f_slop_y > 0 ?
+							(f_slop_x > f_slop_y ? gd_divfx(f_slop_y, f_slop_x) : gd_divfx(f_slop_x, f_slop_y))
 						: 0;
 
 

ext/gd/tests/bug75124.phpt

@@ -0,0 +1,31 @@
+--TEST--
+Bug #75124 (gdImageGrayScale() may produce colors)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('gd extension not available');
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.5', '<')) {
+    die('skip only for bundled libgd or external libgd >= 2.2.5');
+}
+?>
+--FILE--
+<?php
+$im = imagecreatefrompng(__DIR__ . '/bug75124.png');
+var_dump(imageistruecolor($im));
+imagefilter($im, IMG_FILTER_GRAYSCALE);
+for ($i = 0, $width = imagesx($im); $i < $width; $i ++) {
+    for ($j = 0, $height = imagesy($im); $j < $height; $j++) {
+        $color = imagecolorat($im, $i, $j);
+        $red = ($color >> 16) & 0xff;
+        $green = ($color >> 8) & 0xff;
+        $blue = $color & 0xff;
+        if ($red != $green || $green != $blue) {
+            echo "non grayscale pixel detected\n";
+            break 2;
+        }
+    }
+}
+?>
+===DONE===
+--EXPECT--
+bool(true)
+===DONE===

ext/gettext/gettext.c

@@ -161,16 +161,16 @@ PHP_MINFO_FUNCTION(php_gettext)
    Set the textdomain to "domain". Returns the current domain */
 PHP_NAMED_FUNCTION(zif_textdomain)
 {
-	char *domain, *domain_name, *retval;
-	size_t domain_len;
+	char *domain = NULL, *domain_name, *retval;
+	size_t domain_len = 0;
 
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "s", &domain, &domain_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS(), "s!", &domain, &domain_len) == FAILURE) {
 		return;
 	}
 
 	PHP_GETTEXT_DOMAIN_LENGTH_CHECK
 
-	if (strcmp(domain, "") && strcmp(domain, "0")) {
+	if (domain != NULL && strcmp(domain, "") && strcmp(domain, "0")) {
 		domain_name = domain;
 	} else {
 		domain_name = NULL;

ext/gettext/tests/bug73730.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug #73730 (textdomain(null) throws in strict mode)
+--SKIPIF--
+<?php
+if (!extension_loaded('gettext')) die('skip gettext extension is not available');
+?>
+--FILE--
+<?php
+declare(strict_types=1);
+
+var_dump(textdomain(null));
+?>
+===DONE===
+--EXPECT--
+string(8) "messages"
+===DONE===

ext/hash/hash_sha3.c

@@ -39,7 +39,7 @@ static inline unsigned char idx(unsigned char x, unsigned char y) {
 
 #ifdef WORDS_BIGENDIAN
 static inline uint64_t load64(const unsigned char* x) {
-	char i;
+	signed char i;
 	uint64_t ret = 0;
 	for (i = 7; i >= 0; --i) {
 		ret <<= 8;

ext/intl/calendar/calendar_class.cpp

@@ -469,17 +469,6 @@ void calendar_register_IntlCalendar_class(void)
 	Calendar_handlers.get_debug_info = Calendar_get_debug_info;
 	Calendar_handlers.free_obj = Calendar_objects_free;
 
-	/* Create and register 'IntlGregorianCalendar' class. */
-	INIT_CLASS_ENTRY(ce, "IntlGregorianCalendar", GregorianCalendar_class_functions);
-	GregorianCalendar_ce_ptr = zend_register_internal_class_ex(&ce,
-		Calendar_ce_ptr);
-	if (!GregorianCalendar_ce_ptr) {
-		//can't happen know without bigger problems before
-		php_error_docref0(NULL, E_ERROR,
-			"IntlGregorianCalendar: class registration has failed.");
-		return;
-	}
-
 	/* Declare 'IntlCalendar' class constants */
 #define CALENDAR_DECL_LONG_CONST(name, val) \
 	zend_declare_class_constant_long(Calendar_ce_ptr, name, sizeof(name) - 1, \
@@ -531,5 +520,16 @@ void calendar_register_IntlCalendar_class(void)
 	CALENDAR_DECL_LONG_CONST("WALLTIME_LAST",				UCAL_WALLTIME_LAST);
 	CALENDAR_DECL_LONG_CONST("WALLTIME_NEXT_VALID",			UCAL_WALLTIME_NEXT_VALID);
 #endif
+
+	/* Create and register 'IntlGregorianCalendar' class. */
+	INIT_CLASS_ENTRY(ce, "IntlGregorianCalendar", GregorianCalendar_class_functions);
+	GregorianCalendar_ce_ptr = zend_register_internal_class_ex(&ce,
+		Calendar_ce_ptr);
+	if (!GregorianCalendar_ce_ptr) {
+		//can't happen know without bigger problems before
+		php_error_docref0(NULL, E_ERROR,
+			"IntlGregorianCalendar: class registration has failed.");
+		return;
+	}
 }
 /* }}} */

ext/intl/collator/collator_sort.c

@@ -59,8 +59,12 @@ static int collator_regular_compare_function(zval *result, zval *op1, zval *op2)
 	zval norm1, norm2;
 	zval *num1_p = NULL, *num2_p = NULL;
 	zval *norm1_p = NULL, *norm2_p = NULL;
-	zval* str1_p  = collator_convert_object_to_string( op1, &str1 );
-	zval* str2_p  = collator_convert_object_to_string( op2, &str2 );
+	zval *str1_p, *str2_p;
+
+	ZVAL_NULL(&str1);
+	str1_p  = collator_convert_object_to_string( op1, &str1 );
+	ZVAL_NULL(&str2);
+	str2_p  = collator_convert_object_to_string( op2, &str2 );
 
 	/* If both args are strings AND either of args is not numeric string
 	 * then use ICU-compare. Otherwise PHP-compare. */

ext/intl/converter/converter.c

@@ -897,7 +897,7 @@ static PHP_METHOD(UConverter, getAvailable) {
 /* }}} */
 
 /* {{{ proto array UConverter::getAliases(string name) */
-ZEND_BEGIN_ARG_INFO_EX(php_converter_getaliases_arginfo, 0, ZEND_RETURN_VALUE, 0)
+ZEND_BEGIN_ARG_INFO_EX(php_converter_getaliases_arginfo, 0, ZEND_RETURN_VALUE, 1)
 	ZEND_ARG_INFO(0, name)
 ZEND_END_ARG_INFO();
 static PHP_METHOD(UConverter, getAliases) {

ext/intl/tests/bug75090.phpt

@@ -0,0 +1,22 @@
+--TEST--
+Bug #75090 Constants of parent IntlCalendar class not inherited
+--SKIPIF--
+<?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?>
+--FILE--
+<?php
+class Foo extends IntlCalendar {}
+
+$fooRef = new ReflectionClass(Foo::class);
+$intlGregorianCalendarRef = new ReflectionClass(IntlGregorianCalendar::class);
+$intlCalendarRef = new ReflectionClass(IntlCalendar::class);
+
+var_dump(
+    count($fooRef->getConstants()) === count($intlCalendarRef->getConstants()),
+    count($intlGregorianCalendarRef->getConstants()) === count($intlCalendarRef->getConstants())
+);
+?>
+===DONE===
+--EXPECT--
+bool(true)
+bool(true)
+===DONE===

ext/intl/tests/bug75193.phpt

@@ -0,0 +1,14 @@
+--TEST--
+Bug #75193 segfault in collator_convert_object_to_string
+--SKIPIF--
+<?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?>
+--FILE--
+<?php
+$a = new \Collator('en_US');
+$b = [new stdclass, new stdclass];
+var_dump($a->sort($b));
+?>
+===DONE===
+--EXPECT--
+bool(true)
+===DONE===

ext/intl/tests/bug75318.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Bug #75318 (The parameter of UConverter::getAliases() is not optional)
+--SKIP--
+<?php
+if (!extension_loaded('intl')) die('skip intl extension is not available');
+?>
+--FILE--
+<?php
+$rm = new ReflectionMethod('UConverter', 'getAliases');
+var_dump($rm->getNumberOfRequiredParameters());
+?>
+===DONE===
+--EXPECT--
+int(1)
+===DONE===

ext/libxml/php_libxml2.def

@@ -1546,3 +1546,4 @@ xmlXPtrRangeToFunction
 xmlXPtrWrapLocationSet
 xmlBufContent
 xmlBufUse
+xmlBufferDetach

ext/mcrypt/mcrypt_filter.c

@@ -89,7 +89,7 @@ static php_stream_filter_status_t php_mcrypt_filter(
 			php_stream_bucket_delref(bucket);
 		} else {
 			/* Stream cipher */
-			php_stream_bucket_make_writeable(bucket);
+			bucket = php_stream_bucket_make_writeable(bucket);
 			if (data->encrypt) {
 				mcrypt_generic(data->module, bucket->buf, (int)bucket->buflen);
 			} else {

ext/mcrypt/tests/bug72535.phpt

@@ -0,0 +1,24 @@
+--TEST--
+Bug #72535 arcfour encryption stream filter crashes php
+--SKIPIF--
+<?php if (!extension_loaded("mcrypt")) print "skip"; ?>
+--FILE--
+<?php
+$passphrase = 'My secret';
+$plaintext = 'Secret secret secret data';
+
+$iv = substr(md5('iv' . $passphrase, true), 0, 8);
+$key = substr(md5('pass1' . $passphrase, true) .
+	              md5('pass2' . $passphrase, true), 0, 24);
+$opts = array('iv' => $iv, 'key' => $key, 'mode' => 'stream');
+
+$expected = substr($plaintext . $plaintext, 0, 48);
+
+$fp = fopen('php://memory', 'wb+');
+stream_filter_append($fp, 'mcrypt.arcfour', STREAM_FILTER_WRITE, $opts);
+fwrite($fp, $plaintext);
+?>
+==NOCRASH==
+--EXPECTF--
+Deprecated: stream_filter_append(): mcrypt and mdecrypt stream filters have been deprecated in %s on line %d
+==NOCRASH==

ext/mysqli/tests/bug75018.phpt

@@ -0,0 +1,38 @@
+--TEST--
+Bug #75018 Data corruption when reading fields of bit type
+--SKIPIF--
+<?php
+require_once('skipif.inc');
+require_once('skipifconnectfailure.inc');
+?>
+--FILE--
+<?php
+require_once("connect.inc");
+
+$mysqli = new mysqli("$host:$port", $user, $passwd, $db);
+
+$tbl = "test_bug75018";
+$sql = "DROP TABLE IF EXISTS $tbl";
+$mysqli->query($sql);
+
+$sql = "CREATE TABLE $tbl (bit_column_1 bit(16) NOT NULL) DEFAULT CHARSET=utf8";
+$mysqli->query($sql);
+
+$sql = "INSERT INTO $tbl (bit_column_1) VALUES (0)";
+$mysqli->query($sql);
+$sql = "INSERT INTO $tbl (bit_column_1) VALUES (0b10101010101)";
+$mysqli->query($sql);
+
+$sql = "SELECT bit_column_1 FROM $tbl";
+$result = $mysqli->query($sql);
+
+while ($row = $result->fetch_assoc()) {
+	var_dump($row['bit_column_1']);
+}
+
+?>
+==DONE==
+--EXPECT--
+string(1) "0"
+string(4) "1365"
+==DONE==

ext/mysqlnd/mysqlnd_wireprotocol.c

@@ -1761,7 +1761,7 @@ php_mysqlnd_rowp_read_text_protocol_aux(MYSQLND_MEMORY_POOL_CHUNK * row_buffer,
 				if (Z_TYPE_P(current_field) == IS_LONG && !as_int_or_float) {
 					/* we are using the text protocol, so convert to string */
 					char tmp[22];
-					const size_t tmp_len = sprintf((char *)&tmp, MYSQLND_LLU_SPEC, Z_LVAL_P(current_field));
+					const size_t tmp_len = sprintf((char *)&tmp, MYSQLND_LLU_SPEC, (uint64_t) Z_LVAL_P(current_field));
 					ZVAL_STRINGL(current_field, tmp, tmp_len);
 				} else if (Z_TYPE_P(current_field) == IS_STRING) {
 					/* nothing to do here, as we want a string and ps_fetch_from_1_to_8_bytes() has given us one */

ext/oci8/oci8.c

@@ -1402,6 +1402,8 @@ void php_oci_define_hash_dtor(zval *data)
 		define->name = NULL;
 	}
 
+	zval_ptr_dtor(&define->val);
+
     efree(define);
 }
 /* }}} */
@@ -1414,9 +1416,9 @@ void php_oci_bind_hash_dtor(zval *data)
 {
 	php_oci_bind *bind = (php_oci_bind *) Z_PTR_P(data);
 
-	if (!Z_ISUNDEF(bind->parameter)) {
-		zval_ptr_dtor(&bind->parameter);
-		ZVAL_UNDEF(&bind->parameter);
+	if (!Z_ISUNDEF(bind->val)) {
+		zval_ptr_dtor(&bind->val);
+		ZVAL_UNDEF(&bind->val);
 	}
 
 	if (bind->array.elements) {
@@ -2642,7 +2644,7 @@ void php_oci_fetch_row (INTERNAL_FUNCTION_PARAMETERS, int mode, int expected_arg
 	if (placeholder == NULL) {
 		placeholder = return_value;
 	} else {
-		zval_dtor(placeholder);
+		zval_ptr_dtor(placeholder);
 	}
 
 	array_init(placeholder);

ext/oci8/oci8_failover.c

@@ -75,10 +75,10 @@ sb4 callback_fn(void *svchp, void *envhp, void *fo_ctx, ub4 fo_type, ub4 fo_even
 	ZVAL_NULL(&params[0]);
 
 	/* Cleanup */
-	zval_dtor(&retval);
-	zval_dtor(&params[0]);
-	zval_dtor(&params[1]);
-	zval_dtor(&params[2]);
+	zval_ptr_dtor(&retval);
+	zval_ptr_dtor(&params[0]);
+	zval_ptr_dtor(&params[1]);
+	zval_ptr_dtor(&params[2]);
 
 	return returnValue;
 }

ext/oci8/oci8_interface.c

@@ -117,7 +117,7 @@ PHP_FUNCTION(oci_define_by_name)
 	php_oci_define *define;
 	zend_string *zvtmp;
 
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "rsz/|l", &stmt, &name, &name_len, &var, &type) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS(), "rsz|l", &stmt, &name, &name_len, &var, &type) == FAILURE) {
 		return;
 	}
 
@@ -153,7 +153,8 @@ PHP_FUNCTION(oci_define_by_name)
 	define->name[name_len] = '\0';
 	define->name_len = (ub4) name_len;
 	define->type = (ub4) type;
-	define->zval = var;
+	ZEND_ASSERT(Z_ISREF_P(var));
+	ZVAL_COPY(&define->val, var);
 
 	RETURN_TRUE;
 }
@@ -202,7 +203,7 @@ PHP_FUNCTION(oci_bind_array_by_name)
 	zval *bind_var = NULL;
 	php_oci_statement *statement;
 	
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "rsz/l|ll", &z_statement, &name, &name_len, &bind_var, &max_array_len, &max_item_len, &type) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS(), "rszl|ll", &z_statement, &name, &name_len, &bind_var, &max_array_len, &max_item_len, &type) == FAILURE) {
 		return;
 	}
 
@@ -1439,7 +1440,7 @@ PHP_FUNCTION(oci_fetch_all)
 
 	PHP_OCI_ZVAL_TO_STATEMENT(z_statement, statement);
 
-	zval_dtor(array);
+	zval_ptr_dtor(array);
 
 	while (skip--) {
 		if (php_oci_statement_fetch(statement, nrows)) {

ext/oci8/oci8_statement.c

@@ -364,8 +364,10 @@ int php_oci_statement_fetch(php_oci_statement *statement, ub4 nrows)
 				continue;
 			}
 			
-			zval_dtor(column->define->zval);
-			php_oci_column_to_zval(column, column->define->zval, 0);
+			ZEND_ASSERT(Z_ISREF(column->define->val));
+			zval_ptr_dtor(Z_REFVAL(column->define->val));
+			ZVAL_NULL(Z_REFVAL(column->define->val));
+			php_oci_column_to_zval(column, Z_REFVAL(column->define->val), 0);
 		}
 
 		return 0;
@@ -910,10 +912,12 @@ void php_oci_statement_free(php_oci_statement *statement)
 int php_oci_bind_pre_exec(zval *data, void *result)
 {
 	php_oci_bind *bind = (php_oci_bind *) Z_PTR_P(data);
+	zval *zv = &bind->val;
 
 	*(int *)result = 0;
 
-	if (Z_TYPE_P(bind->zval) == IS_ARRAY) {
+	ZVAL_DEREF(zv);
+	if (Z_TYPE_P(zv) == IS_ARRAY) {
 		/* These checks are currently valid for oci_bind_by_name, not
 		 * oci_bind_array_by_name.  Also bind->type and
 		 * bind->indicator are not used for oci_bind_array_by_name.
@@ -927,7 +931,7 @@ int php_oci_bind_pre_exec(zval *data, void *result)
 		case SQLT_CLOB:
 		case SQLT_BLOB:
 		case SQLT_RDD:
-			if (Z_TYPE_P(bind->zval) != IS_OBJECT) {
+			if (Z_TYPE_P(zv) != IS_OBJECT) {
 				php_error_docref(NULL, E_WARNING, "Invalid variable used for bind");
 				*(int *)result = 1;
 			}
@@ -943,14 +947,14 @@ int php_oci_bind_pre_exec(zval *data, void *result)
 		case SQLT_LBI:
 		case SQLT_BIN:
 		case SQLT_LNG:
-			if (Z_TYPE_P(bind->zval) == IS_RESOURCE || Z_TYPE_P(bind->zval) == IS_OBJECT) {
+			if (Z_TYPE_P(zv) == IS_RESOURCE || Z_TYPE_P(zv) == IS_OBJECT) {
 				php_error_docref(NULL, E_WARNING, "Invalid variable used for bind");
 				*(int *)result = 1;
 			}
 			break;
 
 		case SQLT_RSET:
-			if (Z_TYPE_P(bind->zval) != IS_RESOURCE) {
+			if (Z_TYPE_P(zv) != IS_RESOURCE) {
 				php_error_docref(NULL, E_WARNING, "Invalid variable used for bind");
 				*(int *)result = 1;
 			}
@@ -971,30 +975,34 @@ int php_oci_bind_post_exec(zval *data)
 	php_oci_bind *bind = (php_oci_bind *) Z_PTR_P(data);
 	php_oci_connection *connection = bind->parent_statement->connection;
 	sword errstatus;
+	zval *zv = &bind->val;
 
+	ZVAL_DEREF(zv);
 	if (bind->indicator == -1) { /* NULL */
-		zval *val = bind->zval;
-		if (Z_TYPE_P(val) == IS_STRING) {
-			*Z_STRVAL_P(val) = '\0'; /* XXX avoid warning in debug mode */
+		if (Z_TYPE_P(zv) == IS_STRING) {
+			*Z_STRVAL_P(zv) = '\0'; /* XXX avoid warning in debug mode */
 		}
-		zval_dtor(val);
-		ZVAL_NULL(val);
-	} else if (Z_TYPE_P(bind->zval) == IS_STRING
-			   && Z_STRLEN_P(bind->zval) > 0
-			   && Z_STRVAL_P(bind->zval)[ Z_STRLEN_P(bind->zval) ] != '\0') {
+		zval_ptr_dtor(zv);
+		ZVAL_NULL(zv);
+	} else if (Z_TYPE_P(zv) == IS_STRING
+			   && Z_STRLEN_P(zv) > 0
+			   && Z_STRVAL_P(zv)[ Z_STRLEN_P(zv) ] != '\0') {
 		/* The post- PHP 5.3 feature for "interned" strings disallows
 		 * their reallocation but (i) any IN binds either interned or
 		 * not should already be null terminated and (ii) for OUT
 		 * binds, php_oci_bind_out_callback() should have allocated a
 		 * new string that we can modify here.
 		 */
-		Z_STR_P(bind->zval) = zend_string_extend(Z_STR_P(bind->zval), Z_STRLEN_P(bind->zval)+1, 0);
-		Z_STRVAL_P(bind->zval)[ Z_STRLEN_P(bind->zval) ] = '\0';
-	} else if (Z_TYPE_P(bind->zval) == IS_ARRAY) {
+		SEPARATE_STRING(zv);
+		Z_STR_P(zv) = zend_string_extend(Z_STR_P(zv), Z_STRLEN_P(zv)+1, 0);
+		Z_STRVAL_P(zv)[ Z_STRLEN_P(zv) ] = '\0';
+	} else if (Z_TYPE_P(zv) == IS_ARRAY) {
 		int i;
 		zval *entry = NULL;
-		HashTable *hash = HASH_OF(bind->zval);
-	
+		HashTable *hash;
+
+		SEPARATE_ARRAY(zv);
+		hash = HASH_OF(zv);
 		zend_hash_internal_pointer_reset(hash);
 
 		switch (bind->array.type) {
@@ -1003,22 +1011,22 @@ int php_oci_bind_post_exec(zval *data)
 			case SQLT_LNG:
 				for (i = 0; i < (int) bind->array.current_length; i++) {
 					if ((i < (int) bind->array.old_length) && (entry = zend_hash_get_current_data(hash)) != NULL) {
-						zval_dtor(entry);
+						zval_ptr_dtor(entry);
 						ZVAL_LONG(entry, ((oci_phpsized_int *)(bind->array.elements))[i]);
 						zend_hash_move_forward(hash);
 					} else {
-						add_next_index_long(bind->zval, ((oci_phpsized_int *)(bind->array.elements))[i]);
+						add_next_index_long(zv, ((oci_phpsized_int *)(bind->array.elements))[i]);
 					}
 				}
 				break;
 			case SQLT_FLT:
 				for (i = 0; i < (int) bind->array.current_length; i++) {
 					if ((i < (int) bind->array.old_length) && (entry = zend_hash_get_current_data(hash)) != NULL) {
-						zval_dtor(entry);
+						zval_ptr_dtor(entry);
 						ZVAL_DOUBLE(entry, ((double *)(bind->array.elements))[i]);
 						zend_hash_move_forward(hash);
 					} else {
-						add_next_index_double(bind->zval, ((double *)(bind->array.elements))[i]);
+						add_next_index_double(zv, ((double *)(bind->array.elements))[i]);
 					}
 				}
 				break;
@@ -1031,7 +1039,7 @@ int php_oci_bind_post_exec(zval *data)
 							
 					if ((i < (int) bind->array.old_length) && (entry = zend_hash_get_current_data(hash)) != NULL) {
 						PHP_OCI_CALL_RETURN(errstatus, OCIDateToText, (connection->err, &(((OCIDate *)(bind->array.elements))[i]), 0, 0, 0, 0, &buff_len, buff));
-						zval_dtor(entry);
+						zval_ptr_dtor(entry);
 
 						if (errstatus != OCI_SUCCESS) {
 							connection->errcode = php_oci_error(connection->err, errstatus);
@@ -1047,10 +1055,10 @@ int php_oci_bind_post_exec(zval *data)
 						if (errstatus != OCI_SUCCESS) {
 							connection->errcode = php_oci_error(connection->err, errstatus);
 							PHP_OCI_HANDLE_ERROR(connection, connection->errcode);
-							add_next_index_null(bind->zval);
+							add_next_index_null(zv);
 						} else {
 							connection->errcode = 0; /* retain backwards compat with OCI8 1.4 */
-							add_next_index_stringl(bind->zval, (char *)buff, buff_len);
+							add_next_index_stringl(zv, (char *)buff, buff_len);
 						}
 					}
 				}
@@ -1066,20 +1074,21 @@ int php_oci_bind_post_exec(zval *data)
 					/* int curr_element_length = strlen(((text *)bind->array.elements)+i*bind->array.max_length); */
 					int curr_element_length = bind->array.element_lengths[i];
 					if ((i < (int) bind->array.old_length) && (entry = zend_hash_get_current_data(hash)) != NULL) {
-						zval_dtor(entry);
+						zval_ptr_dtor(entry);
 						ZVAL_STRINGL(entry, (char *)(((text *)bind->array.elements)+i*bind->array.max_length), curr_element_length);
 						zend_hash_move_forward(hash);
 					} else {
-						add_next_index_stringl(bind->zval, (char *)(((text *)bind->array.elements)+i*bind->array.max_length), curr_element_length);
+						add_next_index_stringl(zv, (char *)(((text *)bind->array.elements)+i*bind->array.max_length), curr_element_length);
 					}
 				}
 				break;
 		}
-	} else if ((Z_TYPE_P(bind->zval) == IS_TRUE) || (Z_TYPE_P(bind->zval) == IS_FALSE)) {
-		if (Z_LVAL_P(bind->zval) == 0)
-			ZVAL_BOOL(bind->zval, FALSE);
-		else if (Z_LVAL_P(bind->zval) == 1)
-			ZVAL_BOOL(bind->zval, TRUE);
+	} else if ((Z_TYPE_P(zv) == IS_TRUE) || (Z_TYPE_P(zv) == IS_FALSE)) {
+		/* This convetrsion is done on purpose (ext/oci8 uses LVAL as a temorary value) */
+		if (Z_LVAL_P(zv) == 0)
+			ZVAL_BOOL(zv, FALSE);
+		else if (Z_LVAL_P(zv) == 1)
+			ZVAL_BOOL(zv, TRUE);
 	}
 
 	return 0;
@@ -1103,11 +1112,8 @@ int php_oci_bind_by_name(php_oci_statement *statement, char *name, size_t name_l
 	sword errstatus;
 	zval *param = NULL;
 
-	if (!Z_ISREF_P(var)) {
-		param = var;
-	} else {
-		param = Z_REFVAL_P(var);
-	}
+	ZEND_ASSERT(Z_ISREF_P(var));
+	param = Z_REFVAL_P(var);
 
 	switch (type) {
 		case SQLT_NTY:
@@ -1242,9 +1248,9 @@ int php_oci_bind_by_name(php_oci_statement *statement, char *name, size_t name_l
 
 	if ((old_bind = zend_hash_str_find_ptr(statement->binds, name, name_len)) != NULL) {
 		bindp = old_bind;
-		if (!Z_ISUNDEF(bindp->parameter)) {
-			zval_ptr_dtor(&bindp->parameter);
-			ZVAL_UNDEF(&bindp->parameter);
+		if (!Z_ISUNDEF(bindp->val)) {
+			zval_ptr_dtor(&bindp->val);
+			ZVAL_UNDEF(&bindp->val);
 		}
 	} else {
 		zend_string *zvtmp;
@@ -1254,9 +1260,6 @@ int php_oci_bind_by_name(php_oci_statement *statement, char *name, size_t name_l
 		zend_string_release(zvtmp);
 	}
 
-	/* Keep a copy of bound variable in the bind hash */
-	ZVAL_COPY(&bindp->parameter, var);
-
 	/* Make sure the minimum of value_sz is 1 to avoid ORA-3149 
 	 * when both in/out parameters are bound with empty strings
 	 */
@@ -1266,7 +1269,7 @@ int php_oci_bind_by_name(php_oci_statement *statement, char *name, size_t name_l
 	bindp->descriptor = oci_desc;
 	bindp->statement = oci_stmt;
 	bindp->parent_statement = statement;
-	bindp->zval = param;
+	ZVAL_COPY(&bindp->val, var);
 	bindp->type = type;
 	/* Storing max length set in OCIBindByName() to check it later in
 	 * php_oci_bind_in_callback() function to avoid ORA-1406 error while
@@ -1360,11 +1363,14 @@ sb4 php_oci_bind_in_callback(
 	php_oci_bind *phpbind;
 	zval *val;
 
-	if (!(phpbind=(php_oci_bind *)ictxp) || !(val = phpbind->zval)) {
+	if (!(phpbind=(php_oci_bind *)ictxp) || Z_ISUNDEF(phpbind->val)) {
 		php_error_docref(NULL, E_WARNING, "Invalid phpbind pointer value");
 		return OCI_ERROR;
 	}
 
+	val = &phpbind->val;
+	ZVAL_DEREF(val);
+
 	if (Z_ISNULL_P(val)) {
 		/* we're going to insert a NULL column */
 		phpbind->indicator = -1;
@@ -1421,11 +1427,14 @@ sb4 php_oci_bind_out_callback(
 	zval *val;
 	sb4 retval = OCI_ERROR;
 
-	if (!(phpbind=(php_oci_bind *)octxp) || !(val = phpbind->zval)) {
+	if (!(phpbind=(php_oci_bind *)octxp) || Z_ISUNDEF(phpbind->val)) {
 		php_error_docref(NULL, E_WARNING, "Invalid phpbind pointer value");
 		return retval;
 	}
 
+	val = &phpbind->val;
+	ZVAL_DEREF(val);
+
 	if (Z_TYPE_P(val) == IS_RESOURCE) {
 		/* Processing for ref-cursor out binds */
 		if (phpbind->statement != NULL) {
@@ -1463,7 +1472,7 @@ sb4 php_oci_bind_out_callback(
 		retval = OCI_CONTINUE;
 	} else {
 		convert_to_string(val);
-		zval_dtor(val);
+		zval_ptr_dtor(val);
 
 		{
 			char *p = ecalloc(1, PHP_OCI_PIECE_SIZE);
@@ -1474,12 +1483,12 @@ sb4 php_oci_bind_out_callback(
 		Z_STRLEN_P(val) = PHP_OCI_PIECE_SIZE; /* 64K-1 is max XXX */
 		Z_STRVAL_P(val) = ecalloc(1, Z_STRLEN_P(val) + 1);
 		/* XXX is this right? */
-		ZVAL_STRINGL(val, NULL, Z_STRLEN(phpbind->zval) + 1);
+		ZVAL_STRINGL(val, NULL, Z_STRLEN(val) + 1);
 #endif		
 
 		/* XXX we assume that zend-zval len has 4 bytes */
-		*alenpp = (ub4*) &Z_STRLEN_P(phpbind->zval);
-		*bufpp = Z_STRVAL_P(phpbind->zval);
+		*alenpp = (ub4*) &Z_STRLEN_P(val);
+		*bufpp = Z_STRVAL_P(val);
 		*piecep = OCI_ONE_PIECE;
 		*rcodepp = &phpbind->retcode;
 		*indpp = &phpbind->indicator;
@@ -1527,10 +1536,10 @@ php_oci_out_column *php_oci_statement_get_column_helper(INTERNAL_FUNCTION_PARAME
 		column = php_oci_statement_get_column(statement, Z_LVAL(tmp), NULL, 0);
 		if (!column) {
 			php_error_docref(NULL, E_WARNING, "Invalid column index \"" ZEND_LONG_FMT "\"", Z_LVAL(tmp));
-			zval_dtor(&tmp);
+			zval_ptr_dtor(&tmp);
 			return NULL;
 		}
-		zval_dtor(&tmp);
+		zval_ptr_dtor(&tmp);
 	}
 	return column;
 }
@@ -1586,11 +1595,15 @@ int php_oci_statement_get_numrows(php_oci_statement *statement, ub4 *numrows)
  Bind arrays to PL/SQL types */
 int php_oci_bind_array_by_name(php_oci_statement *statement, char *name, size_t name_len, zval *var, zend_long max_table_length, zend_long maxlength, zend_long type)
 {
-	php_oci_bind *bind, *bindp;
+	php_oci_bind *bind;
 	sword errstatus;
 	zend_string *zvtmp;
+	zval *val;
 
-	convert_to_array(var);
+	ZEND_ASSERT(Z_ISREF_P(var));
+	val = Z_REFVAL_P(var);
+	SEPARATE_ZVAL_NOREF(val);
+	convert_to_array(val);
 
 	if (maxlength < -1) {
 		php_error_docref(NULL, E_WARNING, "Invalid max length value (" ZEND_LONG_FMT ")", maxlength);
@@ -1601,11 +1614,11 @@ int php_oci_bind_array_by_name(php_oci_statement *statement, char *name, size_t
 		case SQLT_NUM:
 		case SQLT_INT:
 		case SQLT_LNG:
-			bind = php_oci_bind_array_helper_number(var, max_table_length);
+			bind = php_oci_bind_array_helper_number(val, max_table_length);
 			break;
 
 		case SQLT_FLT:
-			bind = php_oci_bind_array_helper_double(var, max_table_length);
+			bind = php_oci_bind_array_helper_double(val, max_table_length);
 			break;
 			
 		case SQLT_AFC:
@@ -1614,14 +1627,14 @@ int php_oci_bind_array_by_name(php_oci_statement *statement, char *name, size_t
 		case SQLT_AVC:
 		case SQLT_STR:
 		case SQLT_LVC:
-			if (maxlength == -1 && zend_hash_num_elements(Z_ARRVAL_P(var)) == 0) {
+			if (maxlength == -1 && zend_hash_num_elements(Z_ARRVAL_P(val)) == 0) {
 				php_error_docref(NULL, E_WARNING, "You must provide max length value for empty arrays");
 				return 1;
 			}
-			bind = php_oci_bind_array_helper_string(var, max_table_length, maxlength);
+			bind = php_oci_bind_array_helper_string(val, max_table_length, maxlength);
 			break;
 		case SQLT_ODT:
-			bind = php_oci_bind_array_helper_date(var, max_table_length, statement->connection);
+			bind = php_oci_bind_array_helper_date(val, max_table_length, statement->connection);
 			break;
 		default:
 			php_error_docref(NULL, E_WARNING, "Unknown or unsupported datatype given: " ZEND_LONG_FMT, type);
@@ -1638,7 +1651,7 @@ int php_oci_bind_array_by_name(php_oci_statement *statement, char *name, size_t
 	bind->statement = NULL;
 	bind->parent_statement = statement;
 	bind->bind = NULL;
-	bind->zval = var;
+	ZVAL_COPY(&bind->val, var);
 	bind->array.type = type;
 	bind->indicator = 0;  		/* not used for array binds */
 	bind->type = 0; 			/* not used for array binds */
@@ -1677,6 +1690,8 @@ int php_oci_bind_array_by_name(php_oci_statement *statement, char *name, size_t
 			efree(bind->array.indicators);
 		}
 
+		zval_ptr_dtor(&bind->val);
+
 		efree(bind);
 
 		statement->errcode = php_oci_error(statement->err, errstatus);
@@ -1690,7 +1705,7 @@ int php_oci_bind_array_by_name(php_oci_statement *statement, char *name, size_t
 	}
 
 	zvtmp = zend_string_init(name, name_len, 0);
-	bindp = zend_hash_update_ptr(statement->binds, zvtmp, bind);
+	zend_hash_update_ptr(statement->binds, zvtmp, bind);
 	zend_string_release(zvtmp);
 
 	statement->errcode = 0; /* retain backwards compat with OCI8 1.4 */
@@ -1707,6 +1722,7 @@ php_oci_bind *php_oci_bind_array_helper_string(zval *var, zend_long max_table_le
 	HashTable *hash;
 	zval *entry;
 
+	SEPARATE_ARRAY(var); /* TODO: may be use new HashTable iteration and prevent inplace modification */
 	hash = HASH_OF(var);
 
 	if (maxlength == -1) {
@@ -1723,7 +1739,7 @@ php_oci_bind *php_oci_bind_array_helper_string(zval *var, zend_long max_table_le
 	}
 	
 	bind = emalloc(sizeof(php_oci_bind));
-	ZVAL_UNDEF(&bind->parameter);
+	ZVAL_UNDEF(&bind->val);
 	bind->array.elements		= (text *)safe_emalloc(max_table_length * (maxlength + 1), sizeof(text), 0);
 	memset(bind->array.elements, 0, max_table_length * (maxlength + 1) * sizeof(text));
 	bind->array.current_length	= zend_hash_num_elements(Z_ARRVAL_P(var));
@@ -1780,10 +1796,11 @@ php_oci_bind *php_oci_bind_array_helper_number(zval *var, zend_long max_table_le
 	HashTable *hash;
 	zval *entry;
 
+	SEPARATE_ARRAY(var); /* TODO: may be use new HashTable iteration and prevent inplace modification */
 	hash = HASH_OF(var);
 
 	bind = emalloc(sizeof(php_oci_bind));
-	ZVAL_UNDEF(&bind->parameter);
+	ZVAL_UNDEF(&bind->val);
 	bind->array.elements		= (oci_phpsized_int *)safe_emalloc(max_table_length, sizeof(oci_phpsized_int), 0);
 	bind->array.current_length	= zend_hash_num_elements(Z_ARRVAL_P(var));
 	bind->array.old_length		= bind->array.current_length;
@@ -1820,10 +1837,11 @@ php_oci_bind *php_oci_bind_array_helper_double(zval *var, zend_long max_table_le
 	HashTable *hash;
 	zval *entry;
 
+	SEPARATE_ARRAY(var); /* TODO: may be use new HashTable iteration and prevent inplace modification */
 	hash = HASH_OF(var);
 
 	bind = emalloc(sizeof(php_oci_bind));
-	ZVAL_UNDEF(&bind->parameter);
+	ZVAL_UNDEF(&bind->val);
 	bind->array.elements		= (double *)safe_emalloc(max_table_length, sizeof(double), 0);
 	bind->array.current_length	= zend_hash_num_elements(Z_ARRVAL_P(var));
 	bind->array.old_length		= bind->array.current_length;
@@ -1861,10 +1879,11 @@ php_oci_bind *php_oci_bind_array_helper_date(zval *var, zend_long max_table_leng
 	zval *entry;
 	sword errstatus;
 
+	SEPARATE_ARRAY(var); /* TODO: may be use new HashTable iteration and prevent inplace modification */
 	hash = HASH_OF(var);
 
 	bind = emalloc(sizeof(php_oci_bind));
-	ZVAL_UNDEF(&bind->parameter);
+	ZVAL_UNDEF(&bind->val);
 	bind->array.elements		= (OCIDate *)safe_emalloc(max_table_length, sizeof(OCIDate), 0);
 	bind->array.current_length	= zend_hash_num_elements(Z_ARRVAL_P(var));
 	bind->array.old_length		= bind->array.current_length;

ext/oci8/php_oci8.h

@@ -43,7 +43,7 @@
  */
 #undef PHP_OCI8_VERSION
 #endif
-#define PHP_OCI8_VERSION "2.1.7"
+#define PHP_OCI8_VERSION "2.1.8"
 
 extern zend_module_entry oci8_module_entry;
 #define phpext_oci8_ptr &oci8_module_entry

ext/oci8/php_oci8_int.h

@@ -209,7 +209,7 @@ typedef struct {
 
 /* {{{ php_oci_define */
 typedef struct { 
-	zval		*zval;			/* zval used in define */
+	zval		 val;			/* zval used in define */
 	text		*name;			/* placeholder's name */
 	ub4			 name_len;		/* placeholder's name length */
 	ub4			 type;			/* define type */
@@ -244,8 +244,7 @@ typedef struct {
 /* {{{ php_oci_bind */
 typedef struct { 
 	OCIBind				*bind;					/* bind handle */
-	zval				*zval;					/* value */
-	zval				parameter;				/* a copy of bound variable used for oci_bind_by_name */
+	zval				val;					/* value */
 	dvoid				*descriptor;			/* used for binding of LOBS etc */
 	OCIStmt				*statement;				/* used for binding REFCURSORs */
 	php_oci_statement	*parent_statement;		/* pointer to the parent statement */

ext/opcache/Optimizer/zend_dump.c

@@ -690,7 +690,7 @@ static void zend_dump_block_info(const zend_cfg *cfg, int n, uint32_t dump_flags
 	if (b->flags & ZEND_BB_KILL_VAR) {
 		fprintf(stderr, " kill_var");
 	}
-	if (!(dump_flags & ZEND_DUMP_HIDE_UNREACHABLE) & !(b->flags & ZEND_BB_REACHABLE)) {
+	if (!(dump_flags & ZEND_DUMP_HIDE_UNREACHABLE) && !(b->flags & ZEND_BB_REACHABLE)) {
 		fprintf(stderr, " unreachable");
 	}
 	if (b->flags & ZEND_BB_LOOP_HEADER) {

ext/opcache/Optimizer/zend_inference.c

@@ -1708,6 +1708,10 @@ static int zend_infer_ranges(const zend_op_array *op_array, zend_ssa *ssa) /* {{
 			for (j = scc_var[scc]; j >= 0; j = next_scc_var[j]) {
 				if (!ssa->var_info[j].has_range) {
 					zend_inference_init_range(op_array, ssa, j, 1, ZEND_LONG_MIN, ZEND_LONG_MAX, 1);
+				} else if (ssa->vars[j].definition_phi &&
+				           ssa->vars[j].definition_phi->pi < 0) {
+					/* narrowing Phi functions first */
+					zend_ssa_range_narrowing(op_array, ssa, j, scc);
 				}
 				zend_bitset_incl(worklist, j);
 			}
@@ -2331,12 +2335,14 @@ static int zend_update_type_info(const zend_op_array *op_array,
 				}
 			} else if (opline->extended_value == ZEND_ASSIGN_OBJ) {
 				if (opline->op1_type == IS_CV) {
-					if (orig & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) {
-						orig &= (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE);
-						orig |= MAY_BE_OBJECT | MAY_BE_RC1 | MAY_BE_RCN;
-					}
-					if (orig & MAY_BE_OBJECT) {
-						orig |= (MAY_BE_RC1|MAY_BE_RCN);
+					if (!(orig & MAY_BE_REF)) {
+						if (orig & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) {
+							orig &= ~(MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE);
+							orig |= MAY_BE_OBJECT | MAY_BE_RC1 | MAY_BE_RCN;
+						}
+						if (orig & MAY_BE_OBJECT) {
+							orig |= (MAY_BE_RC1|MAY_BE_RCN);
+						}
 					}
 					UPDATE_SSA_TYPE(orig, ssa_ops[i].op1_def);
 					COPY_SSA_OBJ_TYPE(ssa_ops[i].op1_use, ssa_ops[i].op1_def);

ext/opcache/Optimizer/zend_optimizer.c

@@ -1027,6 +1027,19 @@ int zend_optimize_script(zend_script *script, zend_long optimization_level, zend
 			ZEND_SET_FUNC_INFO(call_graph.op_arrays[i], NULL);
 		}
 
+		ZEND_HASH_FOREACH_PTR(&script->class_table, ce) {
+			ZEND_HASH_FOREACH_STR_KEY_PTR(&ce->function_table, name, op_array) {
+				if (op_array->scope != ce) {
+					zend_op_array *orig_op_array;
+					if ((orig_op_array = zend_hash_find_ptr(&op_array->scope->function_table, name)) != NULL) {
+						HashTable *ht = op_array->static_variables;
+						*op_array = *orig_op_array;
+						op_array->static_variables = ht;
+					}
+				}
+			} ZEND_HASH_FOREACH_END();
+		} ZEND_HASH_FOREACH_END();
+
 		zend_arena_release(&ctx.arena, checkpoint);
 	} else
 #endif

ext/opcache/tests/bug75255.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug #75255 (Request hangs and not finish)
+--FILE--
+<?php
+function generatePlanImage() {
+    if ($abc > 5) {
+        $abc = 5;
+    }
+    for ($row = 0; $row < $abc; $row++) {
+        for ($col = 0; $col < $numCols; $col++) {
+            getPossibleRatio($abc);
+        }
+    }
+}
+?>
+DONE
+--EXPECT--
+DONE

ext/pcre/pcrelib/pcre_compile.c

@@ -7272,7 +7272,12 @@ for (;; ptr++)
           so far in order to get the number. If the name is not found, leave
           the value of recno as 0 for a forward reference. */
 
-          else
+          /* This patch (removing "else") fixes a problem when a reference is
+          to multiple identically named nested groups from within the nest.
+          Once again, it is not the "proper" fix, and it results in an
+          over-allocation of memory. */
+
+          /* else */
             {
             ng = cd->named_groups;
             for (i = 0; i < cd->names_found; i++, ng++)

ext/pcre/tests/bug75207.phpt

@@ -0,0 +1,10 @@
+--TEST--
+CVE-2016-1283, see bug #75207
+--FILE--
+<?php
+preg_match("/š(?:F?+(?:^(?(R)a+\"){99}-))(?J)(?'R'(?'R'<((?'RR'(?'R'\){97)?J)?J)(?'R'(?'R'\){99|(:(?|(?'R')(\k'R')|((?'R')))H'R'R)(H'R))))))/", "*b\dc");
+?>
+==DONE==
+--EXPECTF--
+Warning: preg_match(): Compilation failed: unmatched parentheses at offset %d in %s on line %d
+==DONE==

ext/pdo_mysql/tests/bug75177.phpt

@@ -0,0 +1,33 @@
+--TEST--
+PDO MySQL Bug #75177 Type 'bit' is fetched as unexpected string
+--SKIPIF--
+<?php
+require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'skipif.inc');
+require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'mysql_pdo_test.inc');
+MySQLPDOTest::skip();
+?>
+--FILE--
+<?php
+require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'mysql_pdo_test.inc');
+$pdo = MySQLPDOTest::factory();
+
+$tbl = "tbl_bug75177";
+$pdo->query("DROP TABLE IF EXISTS $tbl");
+$pdo->query("CREATE TABLE $tbl (`bit` bit(8)) ENGINE=InnoDB");
+$pdo->query("INSERT INTO $tbl (`bit`) VALUES (1)");
+$pdo->query("INSERT INTO $tbl (`bit`) VALUES (0b011)");
+$pdo->query("INSERT INTO $tbl (`bit`) VALUES (0b01100)");
+
+$ret = $pdo->query("SELECT * FROM $tbl")->fetchAll();
+
+foreach ($ret as $i) {
+	var_dump($i["bit"]);
+}
+
+?>
+==DONE==
+--EXPECT--
+string(1) "1"
+string(1) "3"
+string(2) "12"
+==DONE==

ext/pdo_oci/pdo_oci.c

@@ -29,6 +29,9 @@
 #include "pdo/php_pdo_driver.h"
 #include "php_pdo_oci.h"
 #include "php_pdo_oci_int.h"
+#ifdef ZTS
+#include <TSRM/TSRM.h>
+#endif
 
 /* {{{ pdo_oci_functions[] */
 const zend_function_entry pdo_oci_functions[] = {
@@ -50,7 +53,7 @@ zend_module_entry pdo_oci_module_entry = {
 	pdo_oci_functions,
 	PHP_MINIT(pdo_oci),
 	PHP_MSHUTDOWN(pdo_oci),
-	NULL,
+	PHP_RINIT(pdo_oci),
 	NULL,
 	PHP_MINFO(pdo_oci),
 	PHP_PDO_OCI_VERSION,
@@ -80,29 +83,67 @@ const ub4 PDO_OCI_INIT_MODE =
 /* true global environment */
 OCIEnv *pdo_oci_Env = NULL;
 
+#ifdef ZTS
+/* lock for pdo_oci_Env initialization */
+static MUTEX_T pdo_oci_env_mutex;
+#endif
+
 /* {{{ PHP_MINIT_FUNCTION
  */
 PHP_MINIT_FUNCTION(pdo_oci)
 {
 	php_pdo_register_driver(&pdo_oci_driver);
 
-#if HAVE_OCIENVCREATE
-	OCIEnvCreate(&pdo_oci_Env, PDO_OCI_INIT_MODE, NULL, NULL, NULL, NULL, 0, NULL);
-#else
-	OCIInitialize(PDO_OCI_INIT_MODE, NULL, NULL, NULL, NULL);
-	OCIEnvInit(&pdo_oci_Env, OCI_DEFAULT, 0, NULL);
+	// Defer OCI init to PHP_RINIT_FUNCTION because with php-fpm,
+	// NLS_LANG is not yet available here.
+
+#ifdef ZTS
+	pdo_oci_env_mutex = tsrm_mutex_alloc();
 #endif
 
 	return SUCCESS;
 }
 /* }}} */
 
+/* {{{ PHP_RINIT_FUNCTION
+ */
+PHP_RINIT_FUNCTION(pdo_oci)
+{
+	if (!pdo_oci_Env) {
+#ifdef ZTS
+		tsrm_mutex_lock(pdo_oci_env_mutex);
+		if (!pdo_oci_Env) { // double-checked locking idiom
+#endif
+#if HAVE_OCIENVCREATE
+		OCIEnvCreate(&pdo_oci_Env, PDO_OCI_INIT_MODE, NULL, NULL, NULL, NULL, 0, NULL);
+#else
+		OCIInitialize(PDO_OCI_INIT_MODE, NULL, NULL, NULL, NULL);
+		OCIEnvInit(&pdo_oci_Env, OCI_DEFAULT, 0, NULL);
+#endif
+#ifdef ZTS
+		}
+		tsrm_mutex_unlock(pdo_oci_env_mutex);
+#endif
+	}
+
+	return SUCCESS;
+}
+/* }}} */
+
 /* {{{ PHP_MSHUTDOWN_FUNCTION
  */
 PHP_MSHUTDOWN_FUNCTION(pdo_oci)
 {
 	php_pdo_unregister_driver(&pdo_oci_driver);
-	OCIHandleFree((dvoid*)pdo_oci_Env, OCI_HTYPE_ENV);
+
+	if (pdo_oci_Env) {
+		OCIHandleFree((dvoid*)pdo_oci_Env, OCI_HTYPE_ENV);
+	}
+
+#ifdef ZTS
+	tsrm_mutex_free(pdo_oci_env_mutex);
+#endif
+
 	return SUCCESS;
 }
 /* }}} */

ext/reflection/tests/026.phpt

@@ -20,6 +20,7 @@ Version => %s
 date
 
 date/time support => enabled
+timelib version => %s
 "Olson" Timezone Database Version => %s
 Timezone Database => %s
 Default timezone => %s

ext/simplexml/tests/008.phpt

@@ -42,7 +42,5 @@ array(1) {
 array(0) {
 }
 
-Warning: SimpleXMLElement::xpath(): Invalid expression in %s on line %d
-
-Warning: SimpleXMLElement::xpath(): xmlXPathEval: evaluation failed in %s on line %d
+Warning: SimpleXMLElement::xpath(): Invalid expression in %s on line %d%A
 bool(false)

ext/spl/spl_dllist.c

@@ -733,7 +733,7 @@ SPL_METHOD(SplDoublyLinkedList, setIteratorMode)
 		return;
 	}
 
-	intern->flags = value & SPL_DLLIST_IT_MASK;
+	intern->flags = (value & SPL_DLLIST_IT_MASK) | (intern->flags & SPL_DLLIST_IT_FIX);
 
 	RETURN_LONG(intern->flags);
 }

ext/spl/spl_iterators.c

@@ -3367,7 +3367,7 @@ SPL_METHOD(AppendIterator, __construct)
    Append an iterator */
 SPL_METHOD(AppendIterator, append)
 {
-	spl_dual_it_object   *intern, *appender;
+	spl_dual_it_object   *intern;
 	zval *it;
 
 	SPL_FETCH_AND_CHECK_DUAL_IT(intern, getThis());
@@ -3375,15 +3375,10 @@ SPL_METHOD(AppendIterator, append)
 	if (zend_parse_parameters_ex(ZEND_PARSE_PARAMS_QUIET, ZEND_NUM_ARGS(), "O", &it, zend_ce_iterator) == FAILURE) {
 		return;
 	}
-	if (intern->u.append.iterator->funcs->valid(intern->u.append.iterator) == SUCCESS) {
+	if (intern->u.append.iterator->funcs->valid(intern->u.append.iterator) == SUCCESS && spl_dual_it_valid(intern) != SUCCESS) {
 		spl_array_iterator_append(&intern->u.append.zarrayit, it);
 		intern->u.append.iterator->funcs->move_forward(intern->u.append.iterator);
 	}else{
-		appender = Z_SPLDUAL_IT_P(it);
-		if (appender->dit_type == DIT_AppendIterator) {
-			spl_array_iterator_append(&intern->u.append.zarrayit, &appender->u.append.zarrayit);
-			return;
-		}
 		spl_array_iterator_append(&intern->u.append.zarrayit, it);
 	}
 

ext/spl/tests/bug73629.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #73629 (SplDoublyLinkedList::setIteratorMode masks intern flags)
+--FILE--
+<?php
+$q = new SplQueue();
+try {
+    $q->setIteratorMode(SplDoublyLinkedList::IT_MODE_FIFO);
+} catch (Exception $e) {
+    echo 'unexpected exception: ' . $e->getMessage() . "\n";
+}
+try {
+    $q->setIteratorMode(SplDoublyLinkedList::IT_MODE_LIFO);
+} catch (Exception $e) {
+    echo 'expected exception: ' . $e->getMessage() . "\n";
+}
+?>
+===DONE===
+--EXPECTF--
+expected exception: Iterators' LIFO/FIFO modes for SplStack/SplQueue objects are frozen
+===DONE===

ext/spl/tests/bug74977.phpt

@@ -1,13 +0,0 @@
---TEST--
-Bug #74977:	Recursion leads to crash
---FILE--
-<?php
-
-$iterator = new AppendIterator(array("A","A","A"));
-$iterator->append($iterator);
-var_dump($iterator);
-?>
---EXPECTF--
-object(AppendIterator)#1 (0) {
-}
-

ext/spl/tests/bug75155.phpt

@@ -0,0 +1,22 @@
+--TEST--
+Bug #75155: AppendIterator::append() is broken when appending another AppendIterator
+--FILE--
+<?php
+
+$array_a = new ArrayIterator(array('a', 'b', 'c'));
+$array_b = new ArrayIterator(array('d', 'e', 'f'));
+
+$iterator = new AppendIterator;
+$iterator->append($array_a);
+
+$iterator2 = new AppendIterator;
+$iterator2->append($iterator);
+$iterator2->append($array_b);
+
+foreach ($iterator2 as $current) {
+    echo $current;
+}
+
+?>
+--EXPECT--
+abcdef

ext/spl/tests/bug75173.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug #75173 incorrect behavior of AppendIterator::append in foreach loop
+--FILE--
+<?php
+
+$it = new \AppendIterator();
+$it->append(new ArrayIterator(['foo']));
+
+foreach ($it as $item) {
+    var_dump($item);
+    
+    if ('foo' === $item) {
+        $it->append(new ArrayIterator(['bar']));
+    }
+}
+--EXPECT--
+string(3) "foo"
+string(3) "bar"	

ext/sqlite3/config0.m4

@@ -85,11 +85,11 @@ if test $PHP_SQLITE3 != "no"; then
       other_flags="$other_flags -DSQLITE_ENABLE_ICU=1"
     fi
 
+    AC_DEFINE(HAVE_SQLITE3_ERRSTR, 1, [have sqlite3_errstr function])
     PHP_SQLITE3_CFLAGS="-I@ext_srcdir@/libsqlite $other_flags $threadsafe_flags $debug_flags"
     PHP_INSTALL_HEADERS([ext/sqlite3/libsqlite/sqlite3.h])
   fi
 
-  AC_DEFINE(HAVE_SQLITE3_ERRSTR, 1, [have sqlite3_errstr function])
   AC_DEFINE(HAVE_SQLITE3,1,[ ])
 
   sqlite3_sources="sqlite3.c $sqlite3_extra_sources"

ext/standard/dns.c

@@ -131,13 +131,13 @@ static zend_string *php_gethostbyname(char *name);
    Get the host name of the current machine */
 PHP_FUNCTION(gethostname)
 {
-	char buf[HOST_NAME_MAX];
+	char buf[HOST_NAME_MAX + 1];
 
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
 
-	if (gethostname(buf, sizeof(buf) - 1)) {
+	if (gethostname(buf, sizeof(buf))) {
 		php_error_docref(NULL, E_WARNING, "unable to fetch host [%d]: %s", errno, strerror(errno));
 		RETURN_FALSE;
 	}

ext/standard/streamsfuncs.c

@@ -314,7 +314,7 @@ PHP_FUNCTION(stream_socket_get_name)
 		RETURN_FALSE;
 	}
 
-	if (!ZSTR_LEN(name)) {
+	if ((ZSTR_LEN(name) == 0) || (ZSTR_VAL(name)[0] == 0)) {
 		zend_string_release(name);
 		RETURN_FALSE;
 	}

ext/standard/tests/bug75220.phpt

@@ -0,0 +1,28 @@
+--TEST--
+Bug #75220 (is_callable crash for 'parent')
+--FILE--
+<?php
+
+$a = new A();
+$a->bar('foo');
+
+class B {};
+class A extends B
+{
+	function bar($func)
+	{
+		var_dump('foo');
+		var_dump(is_callable('parent::foo'));
+		var_dump(is_callable(array('parent', 'foo')));
+	}
+	
+	function __call($func, $args)
+	{
+	}
+};
+
+?>
+--EXPECT--
+string(3) "foo"
+bool(false)
+bool(false)

ext/standard/tests/file/windows_mb_path/test_long_path_mkdir.phpt

@@ -0,0 +1,60 @@
+--TEST--
+Mkdir with path length < 260 and > 248 has be a long path 
+--SKIPIF--
+<?php
+include dirname(__FILE__) . DIRECTORY_SEPARATOR . "util.inc";
+
+skip_if_not_win();
+
+$start = realpath(dirname(__FILE__));
+if (strlen($start) > 260 || strlen($start) > 248) {
+	die("skip the starting path length is unsuitable for this test");
+}
+
+?>
+--FILE--
+<?php
+
+$p = ""; 
+$s = str_repeat('a', 50);
+$how_many = 32;
+
+for ($i = 0; $i < $how_many; $i++) {
+	$p .= "$s\\";
+} 
+
+$start = realpath(dirname(__FILE__));
+if (strlen($start) <= 248) {
+	// create the exact length
+	$start = $start . "\\" . str_repeat('a', 251 - strlen($start) - 1);
+}
+
+var_dump($start);
+$p = $start . "\\" . $p;
+
+var_dump($p);
+var_dump(mkdir($p, 0777, true));
+var_dump(file_exists($p));
+
+$p7 = $p . "hello.txt";
+
+var_dump(file_put_contents($p7, "hello"));
+var_dump(file_get_contents($p7));
+
+// cleanup
+unlink($p7);
+for ($i = 0; $i < $how_many; $i++) {
+	$p0 = substr($p, 0, strlen($p) - $i*51);
+	rmdir($p0);
+}
+
+?>
+===DONE===
+--EXPECTF--
+string(251) "%s"
+string(1884) "%s"
+bool(true)
+bool(true)
+int(5)
+string(5) "hello"
+===DONE===

ext/standard/tests/serialize/bug68044.phpt

@@ -6,6 +6,8 @@ Bug #68044 Integer overflow in unserialize() (32-bits only)
 ?>
 ===DONE==
 --EXPECTF--
+Warning: unserialize(): %s in %sbug68044.php on line %d
+
 Warning: Insufficient data for unserializing - %d required, 1 present in %s%ebug68044.php on line 2
 
 Notice: unserialize(): Error at offset 32 of 33 bytes in %s%ebug68044.php on line 2

ext/standard/tests/serialize/bug74101.phpt

@@ -6,5 +6,7 @@ $s = 'O:9:"Exception":799999999999999999999999999997:0i:0;a:0:{}i:2;i:0;i:0;R:2;
 var_dump(unserialize($s));
 ?>
 --EXPECTF--
-Notice: unserialize(): Error at offset 48 of 74 bytes in %s on line %d
+Warning: unserialize(): %s in %sbug74101.php on line %d
+
+Notice: unserialize(): Error at offset 48 of 74 bytes in %sbug74101.php on line %d
 bool(false)

ext/standard/tests/serialize/bug74103.phpt

@@ -5,5 +5,5 @@ Bug #74103: heap-use-after-free when unserializing invalid array size
 var_dump(unserialize('a:7:{i:0;i:04;s:1:"a";i:2;i:9617006;i:4;s:1:"a";i:4;s:1:"a";R:5;s:1:"7";R:3;s:1:"a";R:5;;s:18;}}'));
 ?>
 --EXPECTF--
-Notice: unserialize(): Error at offset 64 of 96 bytes in %s on line %d
+Notice: unserialize(): Error at offset %d of %d bytes in %s on line %d
 bool(false)

ext/standard/tests/serialize/bug74614.phpt

@@ -7,4 +7,6 @@ unserialize('a:3020000000000000000000000000000001:{i:0;a:0:{}i:1;i:2;i:2;i:3;i:3
 
 ?>
 --EXPECTF--
+Warning: unserialize(): %s in %sbug74614.php on line %d
+
 Notice: unserialize(): Error at offset %d of 113 bytes in %s on line %d

ext/standard/tests/strings/substr_compare.phpt

@@ -7,15 +7,15 @@ var_dump(substr_compare("abcde", "df", -2) < 0);
 var_dump(substr_compare("abcde", "bc", 1, 2));
 var_dump(substr_compare("abcde", "bcg", 1, 2));
 var_dump(substr_compare("abcde", "BC", 1, 2, true));
-var_dump(substr_compare("abcde", "bc", 1, 3));
-var_dump(substr_compare("abcde", "cd", 1, 2));
+var_dump(substr_compare("abcde", "bc", 1, 3) > 0);
+var_dump(substr_compare("abcde", "cd", 1, 2) < 0);
 var_dump(substr_compare("abcde", "abc", 5, 1));
-var_dump(substr_compare("abcde", "abcdef", -10, 10));
+var_dump(substr_compare("abcde", "abcdef", -10, 10) < 0);
 var_dump(substr_compare("abcde", "abc", 0, 0));
 var_dump(substr_compare("abcde", -1, 0, NULL, new stdClass));
 echo "Test\n";
 var_dump(substr_compare("abcde", "abc", 0, -1));
-var_dump(substr_compare("abcde", "abc", -1, NULL, -5));
+var_dump(substr_compare("abcde", "abc", -1, NULL, -5) > 0);
 var_dump(substr_compare("abcde", -1, 0, "str", new stdClass));
 
 echo "Done\n";
@@ -25,12 +25,12 @@ bool(true)
 int(0)
 int(0)
 int(0)
-int(1)
-int(-1)
+bool(true)
+bool(true)
 
 Warning: substr_compare(): The start position cannot exceed initial string length in %s on line %d
 bool(false)
-int(-1)
+bool(true)
 int(0)
 
 Warning: substr_compare() expects parameter 5 to be boolean, object given in %s on line %d
@@ -39,7 +39,7 @@ Test
 
 Warning: substr_compare(): The length must be greater than or equal to zero in %s on line %d
 bool(false)
-int(4)
+bool(true)
 
 Warning: substr_compare() expects parameter 4 to be integer, string given in %s on line %d
 bool(false)

ext/standard/var_unserializer.c

@@ -323,29 +323,21 @@ static inline int unserialize_allowed_class(
 
 static inline zend_long parse_iv2(const unsigned char *p, const unsigned char **q)
 {
-	char cursor;
 	zend_long result = 0;
-	int neg = 0;
+	char *end;
 
-	switch (*p) {
-		case '-':
-			neg++;
-			/* fall-through */
-		case '+':
-			p++;
+	errno = 0;
+	result = ZEND_STRTOL((const char*)p, &end, 0);
+
+	if (q) {
+		*q = (const unsigned char *)end;
 	}
 
-	while (1) {
-		cursor = (char)*p;
-		if (cursor >= '0' && cursor <= '9') {
-			result = result * 10 + (size_t)(cursor - (unsigned char)'0');
-		} else {
-			break;
-		}
-		p++;
+	if (errno) {
+		php_error_docref(NULL, E_WARNING, "%s", strerror(errno));
+		return result;
 	}
-	if (q) *q = p;
-	if (neg) return -result;
+
 	return result;
 }
 
@@ -611,7 +603,7 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)
 	start = cursor;
 
 
-#line 615 "ext/standard/var_unserializer.c"
+#line 607 "ext/standard/var_unserializer.c"
 {
 	YYCTYPE yych;
 	static const unsigned char yybm[] = {
@@ -669,9 +661,9 @@ static int php_var_unserialize_internal(UNSERIALIZE_PARAMETER)
 yy2:
 	++YYCURSOR;
 yy3:
-#line 990 "ext/standard/var_unserializer.re"
+#line 982 "ext/standard/var_unserializer.re"
 	{ return 0; }
-#line 675 "ext/standard/var_unserializer.c"
+#line 667 "ext/standard/var_unserializer.c"
 yy4:
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych == ':') goto yy17;
@@ -718,13 +710,13 @@ yy14:
 	goto yy3;
 yy15:
 	++YYCURSOR;
-#line 984 "ext/standard/var_unserializer.re"
+#line 976 "ext/standard/var_unserializer.re"
 	{
 	/* this is the case where we have less data than planned */
 	php_error_docref(NULL, E_NOTICE, "Unexpected end of serialized data");
 	return 0; /* not sure if it should be 0 or 1 here? */
 }
-#line 728 "ext/standard/var_unserializer.c"
+#line 720 "ext/standard/var_unserializer.c"
 yy17:
 	yych = *++YYCURSOR;
 	if (yybm[0+yych] & 128) {
@@ -736,13 +728,13 @@ yy18:
 	goto yy3;
 yy19:
 	++YYCURSOR;
-#line 668 "ext/standard/var_unserializer.re"
+#line 660 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 	ZVAL_NULL(rval);
 	return 1;
 }
-#line 746 "ext/standard/var_unserializer.c"
+#line 738 "ext/standard/var_unserializer.c"
 yy21:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -992,7 +984,7 @@ yy62:
 	goto yy18;
 yy63:
 	++YYCURSOR;
-#line 619 "ext/standard/var_unserializer.re"
+#line 611 "ext/standard/var_unserializer.re"
 	{
 	zend_long id;
 
@@ -1017,7 +1009,7 @@ yy63:
 
 	return 1;
 }
-#line 1021 "ext/standard/var_unserializer.c"
+#line 1013 "ext/standard/var_unserializer.c"
 yy65:
 	yych = *++YYCURSOR;
 	if (yych == '"') goto yy84;
@@ -1028,13 +1020,13 @@ yy66:
 	goto yy18;
 yy67:
 	++YYCURSOR;
-#line 674 "ext/standard/var_unserializer.re"
+#line 666 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 	ZVAL_BOOL(rval, parse_iv(start + 2));
 	return 1;
 }
-#line 1038 "ext/standard/var_unserializer.c"
+#line 1030 "ext/standard/var_unserializer.c"
 yy69:
 	++YYCURSOR;
 	if ((YYLIMIT - YYCURSOR) < 4) YYFILL(4);
@@ -1054,7 +1046,7 @@ yy69:
 	}
 yy71:
 	++YYCURSOR;
-#line 722 "ext/standard/var_unserializer.re"
+#line 714 "ext/standard/var_unserializer.re"
 	{
 #if SIZEOF_ZEND_LONG == 4
 use_double:
@@ -1063,7 +1055,7 @@ use_double:
 	ZVAL_DOUBLE(rval, zend_strtod((const char *)start + 2, NULL));
 	return 1;
 }
-#line 1067 "ext/standard/var_unserializer.c"
+#line 1059 "ext/standard/var_unserializer.c"
 yy73:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1085,7 +1077,7 @@ yy75:
 	goto yy18;
 yy76:
 	++YYCURSOR;
-#line 680 "ext/standard/var_unserializer.re"
+#line 672 "ext/standard/var_unserializer.re"
 	{
 #if SIZEOF_ZEND_LONG == 4
 	int digits = YYCURSOR - start - 3;
@@ -1111,14 +1103,14 @@ yy76:
 	ZVAL_LONG(rval, parse_iv(start + 2));
 	return 1;
 }
-#line 1115 "ext/standard/var_unserializer.c"
+#line 1107 "ext/standard/var_unserializer.c"
 yy78:
 	yych = *++YYCURSOR;
 	if (yych == '"') goto yy92;
 	goto yy18;
 yy79:
 	++YYCURSOR;
-#line 644 "ext/standard/var_unserializer.re"
+#line 636 "ext/standard/var_unserializer.re"
 	{
 	zend_long id;
 
@@ -1142,14 +1134,14 @@ yy79:
 
 	return 1;
 }
-#line 1146 "ext/standard/var_unserializer.c"
+#line 1138 "ext/standard/var_unserializer.c"
 yy81:
 	yych = *++YYCURSOR;
 	if (yych == '"') goto yy94;
 	goto yy18;
 yy82:
 	++YYCURSOR;
-#line 832 "ext/standard/var_unserializer.re"
+#line 824 "ext/standard/var_unserializer.re"
 	{
 	size_t len, len2, len3, maxlen;
 	zend_long elements;
@@ -1301,10 +1293,10 @@ yy82:
 
 	return object_common2(UNSERIALIZE_PASSTHRU, elements);
 }
-#line 1305 "ext/standard/var_unserializer.c"
+#line 1297 "ext/standard/var_unserializer.c"
 yy84:
 	++YYCURSOR;
-#line 763 "ext/standard/var_unserializer.re"
+#line 755 "ext/standard/var_unserializer.re"
 	{
 	size_t len, maxlen;
 	zend_string *str;
@@ -1338,10 +1330,10 @@ yy84:
 	ZVAL_STR(rval, str);
 	return 1;
 }
-#line 1342 "ext/standard/var_unserializer.c"
+#line 1334 "ext/standard/var_unserializer.c"
 yy86:
 	++YYCURSOR;
-#line 797 "ext/standard/var_unserializer.re"
+#line 789 "ext/standard/var_unserializer.re"
 	{
 	zend_long elements = parse_iv(start + 2);
 	/* use iv() not uiv() in order to check data range */
@@ -1365,7 +1357,7 @@ yy86:
 
 	return finish_nested_data(UNSERIALIZE_PASSTHRU);
 }
-#line 1369 "ext/standard/var_unserializer.c"
+#line 1361 "ext/standard/var_unserializer.c"
 yy88:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1390,7 +1382,7 @@ yy91:
 	goto yy18;
 yy92:
 	++YYCURSOR;
-#line 821 "ext/standard/var_unserializer.re"
+#line 813 "ext/standard/var_unserializer.re"
 	{
 	zend_long elements;
     if (!var_hash) return 0;
@@ -1401,10 +1393,10 @@ yy92:
 	}
 	return object_common2(UNSERIALIZE_PASSTHRU, elements);
 }
-#line 1405 "ext/standard/var_unserializer.c"
+#line 1397 "ext/standard/var_unserializer.c"
 yy94:
 	++YYCURSOR;
-#line 731 "ext/standard/var_unserializer.re"
+#line 723 "ext/standard/var_unserializer.re"
 	{
 	size_t len, maxlen;
 	char *str;
@@ -1436,7 +1428,7 @@ yy94:
 	ZVAL_STRINGL(rval, str, len);
 	return 1;
 }
-#line 1440 "ext/standard/var_unserializer.c"
+#line 1432 "ext/standard/var_unserializer.c"
 yy96:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy18;
@@ -1444,7 +1436,7 @@ yy96:
 	goto yy18;
 yy97:
 	++YYCURSOR;
-#line 706 "ext/standard/var_unserializer.re"
+#line 698 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 
@@ -1460,9 +1452,9 @@ yy97:
 
 	return 1;
 }
-#line 1464 "ext/standard/var_unserializer.c"
+#line 1456 "ext/standard/var_unserializer.c"
 }
-#line 992 "ext/standard/var_unserializer.re"
+#line 984 "ext/standard/var_unserializer.re"
 
 
 	return 0;

ext/standard/var_unserializer.re

@@ -327,29 +327,21 @@ object = [OC];
 
 static inline zend_long parse_iv2(const unsigned char *p, const unsigned char **q)
 {
-	char cursor;
 	zend_long result = 0;
-	int neg = 0;
+	char *end;
 
-	switch (*p) {
-		case '-':
-			neg++;
-			/* fall-through */
-		case '+':
-			p++;
+	errno = 0;
+	result = ZEND_STRTOL((const char*)p, &end, 0);
+
+	if (q) {
+		*q = (const unsigned char *)end;
 	}
 
-	while (1) {
-		cursor = (char)*p;
-		if (cursor >= '0' && cursor <= '9') {
-			result = result * 10 + (size_t)(cursor - (unsigned char)'0');
-		} else {
-			break;
-		}
-		p++;
+	if (errno) {
+		php_error_docref(NULL, E_WARNING, "%s", strerror(errno));
+		return result;
 	}
-	if (q) *q = p;
-	if (neg) return -result;
+
 	return result;
 }
 

ext/wddx/tests/bug75055.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #75055 Out-Of-Bounds Read in timelib_meridian()
+--SKIPIF--
+<?php if (!extension_loaded("wddx")) print "skip"; ?>
+--FILE--
+<?php
+
+$file_str = dirname(__FILE__) . "/bug75055.wddx";
+
+$wddx_str = file_get_contents($file_str);
+print strlen($wddx_str) . " bytes read.\n";
+
+var_dump(wddx_deserialize($wddx_str));
+?>
+--EXPECT--
+323 bytes read.
+array(1) {
+  ["aDateTime"]=>
+  string(12) "frONt of 0 0"
+}

ext/wddx/tests/bug75055.wddx

@@ -0,0 +1,13 @@
+<?xml version='1.0'?>
+<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
+<wddxPacket version='1.0'>
+<header/>
+	<data>
+        	<struct>
+                    <var name='aDateTime'>
+                         <dateTime>frONt of 0 0</dateTime>
+                     </var>
+                </struct>
+	</data>
+</wddxPacket>
+

ext/xmlreader/tests/bug64230.phpt

@@ -38,11 +38,11 @@ Done
 --EXPECTF--
 Test
 Internal errors TRUE
-Internal: Specification mandate value for attribute att
+Internal: Specification mandate%A value for attribute att
 
 Internal errors FALSE
 
-Warning: XMLReader::read(): %s: parser error : Specification mandate value for attribute att in %s on line %d
+Warning: XMLReader::read(): %s: parser error : Specification mandate%A value for attribute att in %s on line %d
 
 Warning: XMLReader::read(): <root att/> in %s on line %d
 

ext/xsl/tests/xslt010.phpt

@@ -6,6 +6,7 @@ require_once dirname(__FILE__) .'/skipif.inc';
 $proc = new xsltprocessor;
 if (!$proc->hasExsltSupport()) die('skip EXSLT support not available');
 if (LIBXSLT_VERSION < 10117) die('skip too old libxsl');
+if (LIBXSLT_VERSION > 10129) die('skip for libxsl < 10130');
 ?>
 --FILE--
 <?php

ext/xsl/tests/xslt010_gt10129.phpt

@@ -0,0 +1,206 @@
+--TEST--
+Test 10: EXSLT Support
+--SKIPIF--
+<?php 
+require_once dirname(__FILE__) .'/skipif.inc';
+$proc = new xsltprocessor;
+if (!$proc->hasExsltSupport()) die('skip EXSLT support not available');
+if (LIBXSLT_VERSION < 10130) die('skip too old libxsl');
+?>
+--FILE--
+<?php
+echo "Test 10: EXSLT Support";
+
+$dom = new domDocument();
+  $dom->load(dirname(__FILE__)."/exslt.xsl");
+  $proc = new xsltprocessor;
+  $xsl = $proc->importStylesheet($dom);
+  
+  $xml = new DomDocument();
+  $xml->load(dirname(__FILE__)."/exslt.xml");
+  
+  print $proc->transformToXml($xml);
+--EXPECT--
+Test 10: EXSLT Support
+  
+  
+  Test Date : 0001-12-31Z
+    year                 : 1
+    leap-year            : false
+    month-in-year        : 12
+    month-name           : December
+    month-abbreviation   : Dec
+    week-in-year         : 1
+    day-in-year          : 365
+    day-in-month         : 31
+    day-of-week-in-month : 5
+    day-in-week          : 2
+    day-name             : Monday
+    day-abbreviation     : Mon
+    time                 : 
+    hour-in-day          : NaN
+    minute-in-hour       : NaN
+    second-in-minute     : NaN
+  
+  Test Date : 3000-01-31
+    year                 : 3000
+    leap-year            : false
+    month-in-year        : 1
+    month-name           : January
+    month-abbreviation   : Jan
+    week-in-year         : 5
+    day-in-year          : 31
+    day-in-month         : 31
+    day-of-week-in-month : 5
+    day-in-week          : 6
+    day-name             : Friday
+    day-abbreviation     : Fri
+    time                 : 
+    hour-in-day          : NaN
+    minute-in-hour       : NaN
+    second-in-minute     : NaN
+  
+  Test Date : 2000-02-29
+    year                 : 2000
+    leap-year            : true
+    month-in-year        : 2
+    month-name           : February
+    month-abbreviation   : Feb
+    week-in-year         : 9
+    day-in-year          : 60
+    day-in-month         : 29
+    day-of-week-in-month : 5
+    day-in-week          : 3
+    day-name             : Tuesday
+    day-abbreviation     : Tue
+    time                 : 
+    hour-in-day          : NaN
+    minute-in-hour       : NaN
+    second-in-minute     : NaN
+  
+  Test Date : 9990001-12-31Z
+    year                 : 9990001
+    leap-year            : false
+    month-in-year        : 12
+    month-name           : December
+    month-abbreviation   : Dec
+    week-in-year         : 1
+    day-in-year          : 365
+    day-in-month         : 31
+    day-of-week-in-month : 5
+    day-in-week          : 2
+    day-name             : Monday
+    day-abbreviation     : Mon
+    time                 : 
+    hour-in-day          : NaN
+    minute-in-hour       : NaN
+    second-in-minute     : NaN
+  
+  Test Date : -0004-02-29
+    year                 : NaN
+    leap-year            : NaN
+    month-in-year        : NaN
+    month-name           : 
+    month-abbreviation   : 
+    week-in-year         : NaN
+    day-in-year          : NaN
+    day-in-month         : NaN
+    day-of-week-in-month : NaN
+    day-in-week          : NaN
+    day-name             : 
+    day-abbreviation     : 
+    time                 : 
+    hour-in-day          : NaN
+    minute-in-hour       : NaN
+    second-in-minute     : NaN
+  
+  Test Date : 1999-01-02
+    year                 : 1999
+    leap-year            : false
+    month-in-year        : 1
+    month-name           : January
+    month-abbreviation   : Jan
+    week-in-year         : 53
+    day-in-year          : 2
+    day-in-month         : 2
+    day-of-week-in-month : 1
+    day-in-week          : 7
+    day-name             : Saturday
+    day-abbreviation     : Sat
+    time                 : 
+    hour-in-day          : NaN
+    minute-in-hour       : NaN
+    second-in-minute     : NaN
+  
+  Test Date : 1999-01-03
+    year                 : 1999
+    leap-year            : false
+    month-in-year        : 1
+    month-name           : January
+    month-abbreviation   : Jan
+    week-in-year         : 53
+    day-in-year          : 3
+    day-in-month         : 3
+    day-of-week-in-month : 1
+    day-in-week          : 1
+    day-name             : Sunday
+    day-abbreviation     : Sun
+    time                 : 
+    hour-in-day          : NaN
+    minute-in-hour       : NaN
+    second-in-minute     : NaN
+  
+  Test Date : 2004-01-01
+    year                 : 2004
+    leap-year            : true
+    month-in-year        : 1
+    month-name           : January
+    month-abbreviation   : Jan
+    week-in-year         : 1
+    day-in-year          : 1
+    day-in-month         : 1
+    day-of-week-in-month : 1
+    day-in-week          : 5
+    day-name             : Thursday
+    day-abbreviation     : Thu
+    time                 : 
+    hour-in-day          : NaN
+    minute-in-hour       : NaN
+    second-in-minute     : NaN
+  
+  Test Date : 2006-01-01
+    year                 : 2006
+    leap-year            : false
+    month-in-year        : 1
+    month-name           : January
+    month-abbreviation   : Jan
+    week-in-year         : 52
+    day-in-year          : 1
+    day-in-month         : 1
+    day-of-week-in-month : 1
+    day-in-week          : 1
+    day-name             : Sunday
+    day-abbreviation     : Sun
+    time                 : 
+    hour-in-day          : NaN
+    minute-in-hour       : NaN
+    second-in-minute     : NaN
+  
+  Test Date : 2007-12-31
+    year                 : 2007
+    leap-year            : false
+    month-in-year        : 12
+    month-name           : December
+    month-abbreviation   : Dec
+    week-in-year         : 1
+    day-in-year          : 365
+    day-in-month         : 31
+    day-of-week-in-month : 5
+    day-in-week          : 2
+    day-name             : Monday
+    day-abbreviation     : Mon
+    time                 : 
+    hour-in-day          : NaN
+    minute-in-hour       : NaN
+    second-in-minute     : NaN
+

main/main.c

@@ -92,6 +92,8 @@
 #include "SAPI.h"
 #include "rfc1867.h"
 
+#include "ext/standard/html_tables.h"
+
 #if HAVE_MMAP || defined(PHP_WIN32)
 # if HAVE_UNISTD_H
 #  include <unistd.h>
@@ -124,6 +126,31 @@ PHPAPI int core_globals_id;
 
 #define SAFE_FILENAME(f) ((f)?(f):"-")
 
+static char *get_safe_charset_hint(void) {
+	ZEND_TLS char *lastHint = NULL;
+	ZEND_TLS char *lastCodeset = NULL;
+	char *hint = SG(default_charset);
+	size_t len = strlen(hint);
+	size_t i = 0;
+
+	if (lastHint == SG(default_charset)) {
+		return lastCodeset;
+	}
+
+	lastHint = hint;
+	lastCodeset = NULL;
+
+	for (i = 0; i < sizeof(charset_map)/sizeof(charset_map[0]); i++) {
+		if (len == charset_map[i].codeset_len
+			&& zend_binary_strcasecmp(hint, len, charset_map[i].codeset, len) == 0) {
+			lastCodeset = (char*)charset_map[i].codeset;
+			break;
+		}
+	}
+
+	return lastCodeset;
+}
+
 /* {{{ PHP_INI_MH
  */
 static PHP_INI_MH(OnSetPrecision)
@@ -762,10 +789,10 @@ PHPAPI ZEND_COLD void php_verror(const char *docref, const char *params, int typ
 	buffer_len = (int)vspprintf(&buffer, 0, format, args);
 
 	if (PG(html_errors)) {
-		replace_buffer = php_escape_html_entities((unsigned char*)buffer, buffer_len, 0, ENT_COMPAT, SG(default_charset));
+		replace_buffer = php_escape_html_entities((unsigned char*)buffer, buffer_len, 0, ENT_COMPAT, get_safe_charset_hint());
 		/* Retry with substituting invalid chars on fail. */
 		if (!replace_buffer || ZSTR_LEN(replace_buffer) < 1) {
-			replace_buffer = php_escape_html_entities((unsigned char*)buffer, buffer_len, 0, ENT_COMPAT | ENT_HTML_SUBSTITUTE_ERRORS, SG(default_charset));
+			replace_buffer = php_escape_html_entities((unsigned char*)buffer, buffer_len, 0, ENT_COMPAT | ENT_HTML_SUBSTITUTE_ERRORS, get_safe_charset_hint());
 		}
 
 		efree(buffer);
@@ -832,7 +859,7 @@ PHPAPI ZEND_COLD void php_verror(const char *docref, const char *params, int typ
 	}
 
 	if (PG(html_errors)) {
-		replace_origin = php_escape_html_entities((unsigned char*)origin, origin_len, 0, ENT_COMPAT, SG(default_charset));
+		replace_origin = php_escape_html_entities((unsigned char*)origin, origin_len, 0, ENT_COMPAT, get_safe_charset_hint());
 		efree(origin);
 		origin = ZSTR_VAL(replace_origin);
 	}
@@ -1154,7 +1181,7 @@ static ZEND_COLD void php_error_cb(int type, const char *error_filename, const u
 
 				if (PG(html_errors)) {
 					if (type == E_ERROR || type == E_PARSE) {
-						zend_string *buf = php_escape_html_entities((unsigned char*)buffer, buffer_len, 0, ENT_COMPAT, SG(default_charset));
+						zend_string *buf = php_escape_html_entities((unsigned char*)buffer, buffer_len, 0, ENT_COMPAT, get_safe_charset_hint());
 						php_printf("%s<br />\n<b>%s</b>:  %s in <b>%s</b> on line <b>%d</b><br />\n%s", STR_PRINT(prepend_string), error_type_str, ZSTR_VAL(buf), error_filename, error_lineno, STR_PRINT(append_string));
 						zend_string_free(buf);
 					} else {
@@ -1221,9 +1248,7 @@ static ZEND_COLD void php_error_cb(int type, const char *error_filename, const u
 					sapi_header_op(SAPI_HEADER_REPLACE, &ctr);
 				}
 				/* the parser would return 1 (failure), we can bail out nicely */
-				if (type == E_PARSE) {
-					CG(parse_error) = 0;
-				} else {
+				if (type != E_PARSE) {
 					/* restore memory limit */
 					zend_set_memory_limit(PG(memory_limit));
 					efree(buffer);

main/php_version.h

@@ -2,7 +2,7 @@
 /* edit configure.in to change version number */
 #define PHP_MAJOR_VERSION 7
 #define PHP_MINOR_VERSION 1
-#define PHP_RELEASE_VERSION 9
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "7.1.9-dev"
-#define PHP_VERSION_ID 70109
+#define PHP_RELEASE_VERSION 11
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "7.1.11"
+#define PHP_VERSION_ID 70111

run-tests.php

@@ -1504,15 +1504,19 @@ TEST $file
 
 	// Additional required extensions
 	if (array_key_exists('EXTENSIONS', $section_text)) {
-		$ext_dir=`$php -r 'echo ini_get("extension_dir");'`;
+		$ext_params = array();
+		settings2array($ini_overwrites, $ext_params);
+		settings2params($ext_params);
+		$ext_dir=`$php $pass_options $ext_params -d display_errors=0 -r "echo ini_get('extension_dir');"`;
 		$extensions = preg_split("/[\n\r]+/", trim($section_text['EXTENSIONS']));
-		$loaded = explode(",", `$php -n -r 'echo join(",", get_loaded_extensions());'`);
+		$loaded = explode(",", `$php $pass_options $ext_params -d display_errors=0 -r "echo implode(',', get_loaded_extensions());"`);
+		$ext_prefix = substr(PHP_OS, 0, 3) === "WIN" ? "php_" : "";
 		foreach ($extensions as $req_ext) {
 			if (!in_array($req_ext, $loaded)) {
 				if ($req_ext == 'opcache') {
-					$ini_settings['zend_extension'][] = $ext_dir . DIRECTORY_SEPARATOR . $req_ext . '.' . PHP_SHLIB_SUFFIX;
+					$ini_settings['zend_extension'][] = $ext_dir . DIRECTORY_SEPARATOR . $ext_prefix . $req_ext . '.' . PHP_SHLIB_SUFFIX;
 				} else {
-					$ini_settings['extension'][] = $ext_dir . DIRECTORY_SEPARATOR . $req_ext . '.' . PHP_SHLIB_SUFFIX;
+					$ini_settings['extension'][] = $ext_dir . DIRECTORY_SEPARATOR . $ext_prefix . $req_ext . '.' . PHP_SHLIB_SUFFIX;
 				}
 			}
 		}

sapi/apache2handler/apache_config.c

@@ -128,7 +128,7 @@ static zend_bool should_overwrite_per_dir_entry(HashTable *target_ht, zval *zv,
 
 	if (new_per_dir_entry->status >= orig_per_dir_entry->status) {
 		/* use new entry */
-		phpapdebug((stderr, "ADDING/OVERWRITING %s (%d vs. %d)\n", hash_key->arKey, new_per_dir_entry->status, orig_per_dir_entry->status));
+		phpapdebug((stderr, "ADDING/OVERWRITING %s (%d vs. %d)\n", ZSTR_VAL(hash_key->key), new_per_dir_entry->status, orig_per_dir_entry->status));
 		return 1;
 	} else {
 		return 0;
@@ -176,7 +176,7 @@ void apply_config(void *dummy)
 	php_dir_entry *data;
 
 	ZEND_HASH_FOREACH_STR_KEY_PTR(&d->config, str, data) {
-		phpapdebug((stderr, "APPLYING (%s)(%s)\n", str, data->value));
+		phpapdebug((stderr, "APPLYING (%s)(%s)\n", ZSTR_VAL(str), data->value));
 		if (zend_alter_ini_entry_chars(str, data->value, data->value_len, data->status, data->htaccess?PHP_INI_STAGE_HTACCESS:PHP_INI_STAGE_ACTIVATE) == FAILURE) {
 			phpapdebug((stderr, "..FAILED\n"));
 		}

sapi/cgi/config9.m4

@@ -27,9 +27,9 @@ if test "$PHP_CGI" != "no"; then
 
     AC_MSG_CHECKING([whether cross-process locking is required by accept()])
     case "`uname -sr`" in
-      IRIX\ 5.* | SunOS\ 5.* | UNIX_System_V\ 4.0)	
+      IRIX\ 5.* | SunOS\ 5.* | UNIX_System_V\ 4.0)
         AC_MSG_RESULT([yes])
-        AC_DEFINE([USE_LOCKING], [1], 
+        AC_DEFINE([USE_LOCKING], [1],
           [Define if cross-process locking is required by accept()])
       ;;
       *)
@@ -74,5 +74,5 @@ if test "$PHP_CGI" != "no"; then
 
     PHP_OUTPUT(sapi/cgi/php-cgi.1)
 else
-  AC_MSG_RESULT(yes)
+  AC_MSG_RESULT(no)
 fi

sapi/cli/php_cli_server.c

@@ -172,6 +172,9 @@ typedef struct php_cli_server_client {
 	char *current_header_name;
 	size_t current_header_name_len;
 	unsigned int current_header_name_allocated:1;
+	char *current_header_value;
+	size_t current_header_value_len;
+	enum { HEADER_NONE=0, HEADER_FIELD, HEADER_VALUE } last_header_element;
 	size_t post_read_offset;
 	php_cli_server_request request;
 	unsigned int content_sender_initialized:1;
@@ -1487,7 +1490,7 @@ static void normalize_vpath(char **retval, size_t *retval_len, const char *vpath
 #ifdef PHP_WIN32
 	{
 		char *p = decoded_vpath;
-		
+
 		do {
 			if (*p == '\\') {
 				*p = '/';
@@ -1590,50 +1593,103 @@ static int php_cli_server_client_read_request_on_fragment(php_http_parser *parse
 	return 0;
 }
 
-static int php_cli_server_client_read_request_on_header_field(php_http_parser *parser, const char *at, size_t length)
+static void php_cli_server_client_save_header(php_cli_server_client *client)
 {
-	php_cli_server_client *client = parser->data;
+	/* strip off the colon */
+	zend_string *orig_header_name = zend_string_init(client->current_header_name, client->current_header_name_len, 1);
+	char *lc_header_name = zend_str_tolower_dup(client->current_header_name, client->current_header_name_len);
+	zend_hash_str_add_ptr(&client->request.headers, lc_header_name, client->current_header_name_len, client->current_header_value);
+	zend_hash_add_ptr(&client->request.headers_original_case, orig_header_name, client->current_header_value);
+	efree(lc_header_name);
+	zend_string_release(orig_header_name);
+
 	if (client->current_header_name_allocated) {
 		pefree(client->current_header_name, 1);
 		client->current_header_name_allocated = 0;
 	}
-	client->current_header_name = (char *)at;
-	client->current_header_name_len = length;
+	client->current_header_name = NULL;
+	client->current_header_name_len = 0;
+	client->current_header_value = NULL;
+	client->current_header_value_len = 0;
+}
+
+static int php_cli_server_client_read_request_on_header_field(php_http_parser *parser, const char *at, size_t length)
+{
+	php_cli_server_client *client = parser->data;
+	switch (client->last_header_element) {
+	case HEADER_VALUE:
+		php_cli_server_client_save_header(client);
+		/* break missing intentionally */
+	case HEADER_NONE:
+		client->current_header_name = (char *)at;
+		client->current_header_name_len = length;
+		break;
+	case HEADER_FIELD:
+		if (client->current_header_name_allocated) {
+			size_t new_length = client->current_header_name_len + length;
+			client->current_header_name = perealloc(client->current_header_name, new_length + 1, 1);
+			memcpy(client->current_header_name + client->current_header_name_len, at, length);
+			client->current_header_name[new_length] = '\0';
+			client->current_header_name_len = new_length;
+		} else {
+			size_t new_length = client->current_header_name_len + length;
+			char* field = pemalloc(new_length + 1, 1);
+			memcpy(field, client->current_header_name, client->current_header_name_len);
+			memcpy(field + client->current_header_name_len, at, length);
+			field[new_length] = '\0';
+			client->current_header_name = field;
+			client->current_header_name_len = new_length;
+			client->current_header_name_allocated = 1;
+		}
+		break;
+	}
+
+	client->last_header_element = HEADER_FIELD;
 	return 0;
 }
 
 static int php_cli_server_client_read_request_on_header_value(php_http_parser *parser, const char *at, size_t length)
 {
 	php_cli_server_client *client = parser->data;
-	char *value = pestrndup(at, length, 1);
-	if (!value) {
-		return 1;
-	}
-	{
-		/* strip off the colon */
-		zend_string *orig_header_name = zend_string_init(client->current_header_name, client->current_header_name_len, 1);
-		char *lc_header_name = zend_str_tolower_dup(client->current_header_name, client->current_header_name_len);
-		zend_hash_str_add_ptr(&client->request.headers, lc_header_name, client->current_header_name_len, value);
-		zend_hash_add_ptr(&client->request.headers_original_case, orig_header_name, value);
-		efree(lc_header_name);
-		zend_string_release(orig_header_name);
-	}
-
-	if (client->current_header_name_allocated) {
-		pefree(client->current_header_name, 1);
-		client->current_header_name_allocated = 0;
+	switch (client->last_header_element) {
+	case HEADER_FIELD:
+		client->current_header_value = pestrndup(at, length, 1);
+		client->current_header_value_len = length;
+		break;
+	case HEADER_VALUE:
+		{
+			size_t new_length = client->current_header_value_len + length;
+			client->current_header_value = perealloc(client->current_header_value, new_length + 1, 1);
+			memcpy(client->current_header_value + client->current_header_value_len, at, length);
+			client->current_header_value[new_length] = '\0';
+			client->current_header_value_len = new_length;
+		}
+		break;
+	case HEADER_NONE:
+		// can't happen
+		assert(0);
+		break;
 	}
+	client->last_header_element = HEADER_VALUE;
 	return 0;
 }
 
 static int php_cli_server_client_read_request_on_headers_complete(php_http_parser *parser)
 {
 	php_cli_server_client *client = parser->data;
-	if (client->current_header_name_allocated) {
-		pefree(client->current_header_name, 1);
-		client->current_header_name_allocated = 0;
+	switch (client->last_header_element) {
+	case HEADER_NONE:
+		break;
+	case HEADER_FIELD:
+		client->current_header_value = pemalloc(1, 1);
+		*client->current_header_value = '\0';
+		client->current_header_value_len = 0;
+		/* break missing intentionally */
+	case HEADER_VALUE:
+		php_cli_server_client_save_header(client);
+		break;
 	}
-	client->current_header_name = NULL;
+	client->last_header_element = HEADER_NONE;
 	return 0;
 }
 
@@ -1809,9 +1865,14 @@ static int php_cli_server_client_ctor(php_cli_server_client *client, php_cli_ser
 	}
 	php_http_parser_init(&client->parser, PHP_HTTP_REQUEST);
 	client->request_read = 0;
+
+	client->last_header_element = HEADER_NONE;
 	client->current_header_name = NULL;
 	client->current_header_name_len = 0;
 	client->current_header_name_allocated = 0;
+	client->current_header_value = NULL;
+	client->current_header_value_len = 0;
+
 	client->post_read_offset = 0;
 	if (FAILURE == php_cli_server_request_ctor(&client->request)) {
 		return FAILURE;

sapi/cli/tests/bug70470.phpt

@@ -4,8 +4,6 @@ Bug #70470 (Built-in server truncates headers spanning over TCP packets)
 <?php
 include "skipif.inc";
 ?>
---XFAIL--
-bug is not fixed yet
 --FILE--
 <?php
 include "php_cli_server.inc";

sapi/cli/tests/cli_process_title_windows.phpt

@@ -20,19 +20,7 @@ if (shell_exec('PowerShell -Help') === NULL)
 // Hence on Windows 8, we don't verify that the title is actually set by
 // cli_set_process_title(). We're only making the API calls to ensure there are
 // no warnings/errors.
-
-$is_windows8_or_above = false;
-$ps_output = shell_exec("PowerShell -NoProfile \"(Get-Host).UI.RawUI.WindowTitle\"");
-if ($ps_output === null)
-{
-  echo "Get-Host failed\n";
-  die();
-}
-
-$ps_output = trim($ps_output);
-$end_title_windows8 = ": Windows PowerShell";
-if (($ps_output == "Windows PowerShell") || (strlen($ps_output) > strlen($end_title_windows8) && substr($ps_output,-strlen($end_title_windows8)) === $end_title_windows8) || PHP_WINDOWS_VERSION_MAJOR >= 10)
-  $is_windows8_or_above = true;
+$is_windows8_or_above = PHP_WINDOWS_VERSION_MAJOR >= 10 || PHP_WINDOWS_VERSION_MAJOR >= 6 && PHP_WINDOWS_VERSION_MINOR >= 2;
 
 echo "*** Testing setting the process title ***\n";
 

sapi/cli/tests/emptyheader.phpt

@@ -0,0 +1,35 @@
+--TEST--
+Correctly handle split and empty header
+--SKIPIF--
+<?php
+include "skipif.inc";
+?>
+--FILE--
+<?php
+include "php_cli_server.inc";
+php_cli_server_start("var_dump(getAllheaders());");
+
+$fp = fsockopen(PHP_CLI_SERVER_HOSTNAME, PHP_CLI_SERVER_PORT, $errno, $errmsg, 0.5);
+
+if (!$fp) {
+	die("connect failed: " . $errmsg);
+}
+
+fwrite($fp, "GET / HTTP/1.1\r\nUser-Agent\r\nAccept: */*\r\nReferer:\r\nHi\r\n\r\n");
+fflush($fp);
+while (!feof($fp)) {
+	echo fgets($fp);
+}
+fclose($fp);
+?>
+--EXPECTF--
+HTTP/1.1 200 OK
+%a
+array(3) {
+  ["User-AgentAccept"]=>
+  string(3) "*/*"
+  ["Referer"]=>
+  string(0) ""
+  ["Hi"]=>
+  string(0) ""
+}