Correct release date for 7.2.25

Update CREDITS for PHP 7.2.25RC1
Update NEWS for PHP 7.2.25RC1
2026-11-11 11:10:49 +00:00 · 2019-11-20 09:46:00 -05:00 · 2019-11-05 15:09:44 +00:00 · 2019-11-05 15:09:44 +00:00 · 2019-11-05 12:13:46 +01:00 · 2019-10-31 16:07:34 +01:00
146 changed files with 3158 additions and 281 deletions
@@ -16,7 +16,7 @@ environment:
        PHP_BUILD_CACHE_BASE_DIR: c:\build-cache
        PHP_BUILD_OBJ_DIR: c:\obj
        PHP_BUILD_CACHE_SDK_DIR: c:\build-cache\sdk
-        PHP_BUILD_SDK_BRANCH: php-sdk-2.2.0beta6
+        PHP_BUILD_SDK_BRANCH: php-sdk-2.2.0
        PHP_BUILD_CRT: vc15
        # ext and env setup for tests
        #MYSQL_TEST_PASSWD: Password12!
@@ -1,6 +1,116 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2019, PHP 7.2.22
+21 Nov 2019, PHP 7.2.25
+
+- Core:
+  . Fixed bug #78656 (Parse errors classified as highest log-level). (Erik
+    Lundin)
+  . Fixed bug #78752 (Segfault if GC triggered while generator stack frame is
+    being destroyed). (Nikita)
+  . Fixed bug #78689 (Closure::fromCallable() doesn't handle
+    [Closure, '__invoke']). (Nikita)
+
+- COM:
+  . Fixed bug #78694 (Appending to a variant array causes segfault). (cmb)
+
+- Date:
+  . Fixed bug #70153 (\DateInterval incorrectly unserialized). (Maksim Iakunin)
+  . Fixed bug #78751 (Serialising DatePeriod converts DateTimeImmutable). (cmb)
+
+- Iconv:
+  . Fixed bug #78642 (Wrong libiconv version displayed). (gedas at martynas,
+    cmb).
+
+- OpCache:
+  . Fixed bug #78654 (Incorrectly computed opcache checksum on files with 
+    non-ascii characters). (mhagstrand)
+  . Fixed bug #78747 (OpCache corrupts custom extension result). (Nikita)
+
+- OpenSSL:
+  . Fixed bug #78775 (TLS issues from HTTP request affecting other encrypted
+    connections). (Nikita)
+
+- Reflection:
+  . Fixed bug #78697 (ReflectionClass::ImplementsInterface - inaccurate error 
+    message with traits). (villfa)
+
+- Sockets:
+  . Fixed bug #78665 (Multicasting may leak memory). (cmb)
+
+24 Oct 2019, PHP 7.2.24
+
+- Core:
+  . Fixed bug #78535 (auto_detect_line_endings value not parsed as bool).
+    (bugreportuser)
+  . Fixed bug #78620 (Out of memory error). (cmb, Nikita)
+
+- Exif:
+  . Fixed bug #78442 ('Illegal component' on exif_read_data since PHP7)
+	(Kalle)
+
+- FPM:
+  . Fixed bug #78599 (env_path_info underflow in fpm_main.c can lead to RCE).
+    (CVE-2019-11043) (Jakub Zelenka)
+
+- MBString:
+  . Fixed bug #78579 (mb_decode_numericentity: args number inconsistency).
+    (cmb)
+  . Fixed bug #78609 (mb_check_encoding() no longer supports stringable
+    objects). (cmb)
+
+- MySQLi:
+  . Fixed bug #76809 (SSL settings aren't respected when persistent connections 
+    are used). (fabiomsouto)
+
+- PDO_MySQL:
+  . Fixed bug #78623 (Regression caused by "SP call yields additional empty
+    result set"). (cmb)
+
+- Session:
+  . Fixed bug #78624 (session_gc return value for user defined session 
+    handlers). (bshaffer)
+
+- Standard:
+  . Fixed bug #76342 (file_get_contents waits twice specified timeout).
+    (Thomas Calvet)
+  . Fixed bug #78612 (strtr leaks memory when integer keys are used and the
+    subject string shorter). (Nikita)
+  . Fixed bug #76859 (stream_get_line skips data if used with data-generating 
+    filter). (kkopachev)
+
+- Zip:
+  . Fixed bug #78641 (addGlob can modify given remove_path value). (cmb)
+
+26 Sep 2019, PHP 7.2.23
+
+- Core:
+  . Fixed bug #78220 (Can't access OneDrive folder). (cmb, ab)
+  . Fixed bug #78412 (Generator incorrectly reports non-releasable $this as GC
+    child). (Nikita)
+
+- FastCGI:
+  . Fixed bug #78469 (FastCGI on_accept hook is not called when using named
+    pipes on Windows). (Sergei Turchanov)
+
+- MySQLnd:
+  . Fixed connect_attr issues and added the _server_host connection attribute.
+    (Qianqian Bu)
+
+- ODBC:
+  . Fixed bug #78473 (odbc_close() closes arbitrary resources). (cmb)
+
+- PDO_MySQL:
+  . Fixed bug #41997 (SP call yields additional empty result set). (cmb)
+
+- sodium:
+  . Fixed bug #78510 (Partially uninitialized buffer returned by
+    sodium_crypto_generichash_init()). (Frank Denis, cmb)
+
+- SPL:
+  . Fixed bug #72884 (SplObject isCloneable() returns true but errs on clone).
+    (Chu Zhaowei)
+
+29 Aug 2019, PHP 7.2.22

 - Core:
  . Fixed bug #78363 (Buffer overflow in zendparse). (Nikita)
@@ -136,6 +246,10 @@ PHP                                                                        NEWS

 30 May 2019, PHP 7.2.19

+- Date:
+  . Fixed bug #77909 (DatePeriod::__construct() with invalid recurrence count
+    value). (Ignace Nyamagana Butera)
+
 - EXIF:
  . Fixed bug #77988 (heap-buffer-overflow on php_jpg_get16).
    (CVE-2019-11040) (Stas)
@@ -182,10 +296,6 @@ PHP                                                                        NEWS
  . Fixed bug #77794 (Incorrect Date header format in built-in server).
    (kelunik)

- Date:
-  . Fixed bug #77909 (DatePeriod::__construct() with invalid recurrence count
-    value). (Ignace Nyamagana Butera)
-
 - EXIF
  . Fixed bug #77950 (Heap-buffer-overflow in _estrndup via exif_process_IFD_TAG).
    (CVE-2019-11036) (Stas)
@@ -140,6 +140,7 @@ assert(0 && ($a = function () {
    if ($a) {
    } elseif ($b) {
    }
+    if ($a); else;
 }));

 ?>
@@ -292,4 +293,7 @@ Warning: assert(): assert(0 && ($a = function () {
    if ($a) {
    } elseif ($b) {
    }
+    if ($a) {
+    } else {
+    }
 })) failed in %sexpect_015.php on line %d
@@ -0,0 +1,13 @@
+--TEST--
+Bug #78689: Closure::fromCallable() doesn't handle [Closure, '__invoke']
+--FILE--
+<?php
+$a = [function () { echo "123\n"; }, '__invoke'];
+$a();
+
+$b = Closure::fromCallable($a);
+$b();
+?>
+--EXPECT--
+123
+123
@@ -0,0 +1,24 @@
+--TEST--
+Bug #78752: Segfault if GC triggered while generator stack frame is being destroyed
+--FILE--
+<?php
+
+function gen(&$gen) {
+    $a = new stdClass;
+    $a->a = $a;
+    $b = new stdClass;
+    $b->b = $b;
+    yield 1;
+}
+
+$gen = gen($gen);
+var_dump($gen->current());
+for ($i = 0; $i < 9999; $i++) {
+    $a = new stdClass;
+    $a->a = $a;
+}
+$gen->next();
+
+?>
+--EXPECT--
+int(1)
@@ -0,0 +1,11 @@
+--TEST--
+Immediately invoked closure with extra args
+--FILE--
+<?php
+
+(function() {})(new stdClass);
+
+?>
+===DONE===
+--EXPECT--
+===DONE===
@@ -0,0 +1,26 @@
+--TEST--
+Object properties HT may need to be removed from nested data
+--FILE--
+<?php
+
+class Test {
+    public function __destruct() {
+        $GLOBALS['x'] = $this;
+    }
+}
+
+$t = new Test;
+$t->x = new stdClass;
+$t->x->t = $t;
+$a = (array) $t->x;
+unset($t, $a);
+gc_collect_cycles();
+var_dump($x);
+
+// TODO: The destructor *should* be running here, but doesn't.
+// This works in PHP >= 7.3 though.
+
+?>
+--EXPECTF--
+Notice: Undefined variable: x in %s on line %d
+NULL
@@ -0,0 +1,8 @@
+--TEST--
+Using __COMPILER_HALF_OFFSET__ with trailing {} (OSS-Fuzz #17895)
+--FILE--
+<?php
+__COMPILER_HALT_OFFSET__;
+{}
+--EXPECTF--
+Warning: Use of undefined constant __COMPILER_HALT_OFFSET__ - assumed '__COMPILER_HALT_OFFSET__' (this will throw an Error in a future version of PHP) in %s on line %d
@@ -0,0 +1,17 @@
+--TEST--
+Memory leak on ** with result==op1 array
+--FILE--
+<?php
+
+$x = [0];
+$x **= 1;
+var_dump($x);
+
+$x = [0];
+$x **= $x;
+var_dump($x);
+
+?>
+--EXPECT--
+int(0)
+int(0)
@@ -0,0 +1,15 @@
+--TEST--
+Calling a static method on a non-existing class
+--FILE--
+<?php
+
+$str = "foo";
+try {
+    Test::{$str . "bar"}();
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+Class 'Test' not found
@@ -980,7 +980,7 @@ get_chunk:
 				heap->cached_chunks = chunk->next;
 			} else {
 #if ZEND_MM_LIMIT
-				if (UNEXPECTED(heap->real_size + ZEND_MM_CHUNK_SIZE > heap->limit)) {
+				if (UNEXPECTED(ZEND_MM_CHUNK_SIZE > heap->limit - heap->real_size)) {
 					if (zend_mm_gc(heap)) {
 						goto get_chunk;
 					} else if (heap->overflow == 0) {
@@ -1484,8 +1484,8 @@ static void *zend_mm_realloc_heap(zend_mm_heap *heap, void *ptr, size_t size, si
 				}
 			} else /* if (new_size > old_size) */ {
 #if ZEND_MM_LIMIT
-				if (UNEXPECTED(heap->real_size + (new_size - old_size) > heap->limit)) {
-					if (zend_mm_gc(heap) && heap->real_size + (new_size - old_size) <= heap->limit) {
+				if (UNEXPECTED(new_size - old_size > heap->limit - heap->real_size)) {
+					if (zend_mm_gc(heap) && new_size - old_size <= heap->limit - heap->real_size) {
 						/* pass */
 					} else if (heap->overflow == 0) {
 #if ZEND_DEBUG
@@ -1723,15 +1723,20 @@ static void *zend_mm_alloc_huge(zend_mm_heap *heap, size_t size ZEND_FILE_LINE_D
 	 * We allocate them with 2MB size granularity, to avoid many
 	 * reallocations when they are extended by small pieces
 	 */
-	size_t new_size = ZEND_MM_ALIGNED_SIZE_EX(size, MAX(REAL_PAGE_SIZE, ZEND_MM_CHUNK_SIZE));
+	size_t alignment = MAX(REAL_PAGE_SIZE, ZEND_MM_CHUNK_SIZE);
 #else
-	size_t new_size = ZEND_MM_ALIGNED_SIZE_EX(size, REAL_PAGE_SIZE);
+	size_t alignment = REAL_PAGE_SIZE;
 #endif
+	size_t new_size = ZEND_MM_ALIGNED_SIZE_EX(size, alignment);
 	void *ptr;

+	if (UNEXPECTED(new_size < size)) {
+		zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu + %zu)", size, alignment);
+	}
+
 #if ZEND_MM_LIMIT
-	if (UNEXPECTED(heap->real_size + new_size > heap->limit)) {
-		if (zend_mm_gc(heap) && heap->real_size + new_size <= heap->limit) {
+	if (UNEXPECTED(new_size > heap->limit - heap->real_size)) {
+		if (zend_mm_gc(heap) && new_size <= heap->limit - heap->real_size) {
 			/* pass */
 		} else if (heap->overflow == 0) {
 #if ZEND_DEBUG
@@ -894,7 +894,7 @@ tail_call:
 		} else {
 			zend_ast_export_indent(str, indent);
 			smart_str_appends(str, "} else ");
-			if (ast->child[1]->kind == ZEND_AST_IF) {
+			if (ast->child[1] && ast->child[1]->kind == ZEND_AST_IF) {
 				list = (zend_ast_list*)ast->child[1];
 				goto tail_call;
 			} else {
@@ -268,8 +268,16 @@ static int zend_create_closure_from_callable(zval *return_value, zval *callable,

 	mptr = fcc.function_handler;
 	if (mptr->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
-		memset(&call, 0, sizeof(zend_internal_function));
+		/* For Closure::fromCallable([$closure, "__invoke"]) return $closure. */
+		if (fcc.object && fcc.object->ce == zend_ce_closure
+				&& zend_string_equals_literal(mptr->common.function_name, "__invoke")) {
+			ZVAL_OBJ(return_value, fcc.object);
+			GC_REFCOUNT(fcc.object)++;
+			zend_free_trampoline(mptr);
+			return SUCCESS;
+		}

+		memset(&call, 0, sizeof(zend_internal_function));
 		call.type = ZEND_INTERNAL_FUNCTION;
 		call.handler = zend_closure_call_magic;
 		call.function_name = mptr->common.function_name;
@@ -7676,6 +7676,9 @@ void zend_compile_const(znode *result, zend_ast *ast) /* {{{ */

 		while (last && last->kind == ZEND_AST_STMT_LIST) {
 			zend_ast_list *list = zend_ast_get_list(last);
+			if (list->children == 0) {
+				break;
+			}
 			last = list->child[list->children-1];
 		}
 		if (last && last->kind == ZEND_AST_HALT_COMPILER) {
@@ -1007,6 +1007,10 @@ tail_call:
 					ref = Z_COUNTED_P(zv);
 					goto tail_call;
 				}
+				if (GC_ADDRESS(GC_INFO(ht)) != 0 && GC_REF_GET_COLOR(ht) == GC_BLACK) {
+					GC_TRACE_REF(ht, "removing from buffer");
+					GC_REMOVE_FROM_BUFFER(ht);
+				}
 			} else {
 				return;
 			}
@@ -97,16 +97,18 @@ ZEND_API zend_execute_data* zend_generator_freeze_call_stack(zend_execute_data *
 /* }}} */

 static void zend_generator_cleanup_unfinished_execution(
-		zend_generator *generator, uint32_t catch_op_num) /* {{{ */
+		zend_generator *generator, zend_execute_data *execute_data, uint32_t catch_op_num) /* {{{ */
 {
-	zend_execute_data *execute_data = generator->execute_data;
-
 	if (execute_data->opline != execute_data->func->op_array.opcodes) {
 		/* -1 required because we want the last run opcode, not the next to-be-run one. */
 		uint32_t op_num = execute_data->opline - execute_data->func->op_array.opcodes - 1;

 		if (UNEXPECTED(generator->frozen_call_stack)) {
+			/* Temporarily restore generator->execute_data if it has been NULLed out already. */
+			zend_execute_data *save_ex = generator->execute_data;
+			generator->execute_data = execute_data;
 			zend_generator_restore_call_stack(generator);
+			generator->execute_data = save_ex;
 		}
 		zend_cleanup_unfinished_execution(execute_data, op_num, catch_op_num);
 	}
@@ -117,6 +119,9 @@ ZEND_API void zend_generator_close(zend_generator *generator, zend_bool finished
 {
 	if (EXPECTED(generator->execute_data)) {
 		zend_execute_data *execute_data = generator->execute_data;
+		/* Null out execute_data early, to prevent double frees if GC runs while we're
+		 * already cleaning up execute_data. */
+		generator->execute_data = NULL;

 		if (EX_CALL_INFO() & ZEND_CALL_HAS_SYMBOL_TABLE) {
 			zend_clean_and_cache_symbol_table(execute_data->symbol_table);
@@ -135,12 +140,12 @@ ZEND_API void zend_generator_close(zend_generator *generator, zend_bool finished
 			return;
 		}

-		zend_vm_stack_free_extra_args(generator->execute_data);
+		zend_vm_stack_free_extra_args(execute_data);

 		/* Some cleanups are only necessary if the generator was closed
 		 * before it could finish execution (reach a return statement). */
 		if (UNEXPECTED(!finished_execution)) {
-			zend_generator_cleanup_unfinished_execution(generator, 0);
+			zend_generator_cleanup_unfinished_execution(generator, execute_data, 0);
 		}

 		/* Free closure object */
@@ -154,8 +159,7 @@ ZEND_API void zend_generator_close(zend_generator *generator, zend_bool finished
 			generator->gc_buffer = NULL;
 		}

-		efree(generator->execute_data);
-		generator->execute_data = NULL;
+		efree(execute_data);
 	}
 }
 /* }}} */
@@ -216,7 +220,7 @@ static void zend_generator_dtor_storage(zend_object *object) /* {{{ */
 	if (finally_op_num) {
 		zval *fast_call;

-		zend_generator_cleanup_unfinished_execution(generator, finally_op_num);
+		zend_generator_cleanup_unfinished_execution(generator, ex, finally_op_num);

 		fast_call = ZEND_CALL_VAR(ex, ex->func->op_array.opcodes[finally_op_end].op1.var);
 		Z_OBJ_P(fast_call) = EG(exception);
@@ -271,7 +275,7 @@ static uint32_t calc_gc_buffer_size(zend_generator *generator) /* {{{ */
 		if (EX_CALL_INFO() & ZEND_CALL_FREE_EXTRA_ARGS) {
 			size += EX_NUM_ARGS() - op_array->num_args;
 		}
-		size += Z_TYPE(execute_data->This) == IS_OBJECT; /* $this */
+		size += (EX_CALL_INFO() & ZEND_CALL_RELEASE_THIS) != 0; /* $this */
 		size += (EX_CALL_INFO() & ZEND_CALL_CLOSURE) != 0; /* Closure object */

 		/* Live vars */
@@ -352,7 +356,7 @@ static HashTable *zend_generator_get_gc(zval *object, zval **table, int *n) /* {
 		}
 	}

-	if (Z_TYPE(execute_data->This) == IS_OBJECT) {
+	if (EX_CALL_INFO() & ZEND_CALL_RELEASE_THIS) {
 		ZVAL_OBJ(gc_buffer++, Z_OBJ(execute_data->This));
 	}
 	if (EX_CALL_INFO() & ZEND_CALL_CLOSURE) {
@@ -1128,12 +1128,18 @@ ZEND_API int ZEND_FASTCALL pow_function(zval *result, zval *op1, zval *op2) /* {

 					if (EXPECTED(op1 != op2)) {
 						if (Z_TYPE_P(op1) == IS_ARRAY) {
+							if (op1 == result) {
+								zval_ptr_dtor(result);
+							}
 							ZVAL_LONG(result, 0);
 							return SUCCESS;
 						} else {
 							zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
 						}
 						if (Z_TYPE_P(op2) == IS_ARRAY) {
+							if (op1 == result) {
+								zval_ptr_dtor(result);
+							}
 							ZVAL_LONG(result, 1L);
 							return SUCCESS;
 						} else {
@@ -1141,6 +1147,9 @@ ZEND_API int ZEND_FASTCALL pow_function(zval *result, zval *op1, zval *op2) /* {
 						}
 					} else {
 						if (Z_TYPE_P(op1) == IS_ARRAY) {
+							if (op1 == result) {
+								zval_ptr_dtor(result);
+							}
 							ZVAL_LONG(result, 0);
 							return SUCCESS;
 						} else {
@@ -91,10 +91,10 @@ ZEND_API const char* ZEND_FASTCALL zend_memnstr_ex(const char *haystack, const c
 ZEND_API const char* ZEND_FASTCALL zend_memnrstr_ex(const char *haystack, const char *needle, size_t needle_len, const char *end);

 #if SIZEOF_ZEND_LONG == 4
-#	define ZEND_DOUBLE_FITS_LONG(d) (!((d) > ZEND_LONG_MAX || (d) < ZEND_LONG_MIN))
+#	define ZEND_DOUBLE_FITS_LONG(d) (!((d) > (double)ZEND_LONG_MAX || (d) < (double)ZEND_LONG_MIN))
 #else
 	/* >= as (double)ZEND_LONG_MAX is outside signed range */
-#	define ZEND_DOUBLE_FITS_LONG(d) (!((d) >= ZEND_LONG_MAX || (d) < ZEND_LONG_MIN))
+#	define ZEND_DOUBLE_FITS_LONG(d) (!((d) >= (double)ZEND_LONG_MAX || (d) < (double)ZEND_LONG_MIN))
 #endif

 #if ZEND_DVAL_TO_LVAL_CAST_OK
@@ -91,6 +91,8 @@ cwd_state main_cwd_state; /* True global */
 #include <unistd.h>
 #else
 #include <direct.h>
+#include "zend_globals.h"
+#include "zend_globals_macros.h"
 #endif

 #define CWD_STATE_COPY(d, s)				\
@@ -855,6 +857,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 		tmp = do_alloca(len+1, use_heap);
 		memcpy(tmp, path, len+1);

+retry:
 		if(save &&
 				!(IS_UNC_PATH(path, len) && len >= 3 && path[2] != '?') &&
                               (dataw.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT)
@@ -895,7 +898,21 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 				return -1;
 			}
 			if(!DeviceIoControl(hLink, FSCTL_GET_REPARSE_POINT, NULL, 0, pbuffer,  MAXIMUM_REPARSE_DATA_BUFFER_SIZE, &retlength, NULL)) {
+				BY_HANDLE_FILE_INFORMATION fileInformation;
+
 				free_alloca(pbuffer, use_heap_large);
+				if ((dataw.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT) &&
+						(dataw.dwReserved0 & ~IO_REPARSE_TAG_CLOUD_MASK) == IO_REPARSE_TAG_CLOUD &&
+						EG(windows_version_info).dwMajorVersion >= 10 &&
+						EG(windows_version_info).dwMinorVersion == 0 &&
+						EG(windows_version_info).dwBuildNumber >= 18362 &&
+						GetFileInformationByHandle(hLink, &fileInformation) &&
+						!(fileInformation.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT)) {
+					dataw.dwFileAttributes = fileInformation.dwFileAttributes;
+					CloseHandle(hLink);
+					(*ll)--;
+					goto retry;
+				}
 				free_alloca(tmp, use_heap);
 				CloseHandle(hLink);
 				FREE_PATHW()
@@ -975,8 +992,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 			}
 			else if (pbuffer->ReparseTag == IO_REPARSE_TAG_DEDUP ||
 					/* Starting with 1709. */
-					(pbuffer->ReparseTag & IO_REPARSE_TAG_CLOUD_MASK) != 0 && 0x90001018L != pbuffer->ReparseTag ||
-					IO_REPARSE_TAG_CLOUD == pbuffer->ReparseTag ||
+					(pbuffer->ReparseTag & ~IO_REPARSE_TAG_CLOUD_MASK) == IO_REPARSE_TAG_CLOUD ||
 					IO_REPARSE_TAG_ONEDRIVE == pbuffer->ReparseTag) {
 				isabsolute = 1;
 				substitutename = malloc((len + 1) * sizeof(char));
@@ -2398,6 +2398,11 @@ ZEND_VM_HELPER(zend_leave_helper, ANY, ANY)
 			zend_clean_and_cache_symbol_table(EX(symbol_table));
 		}
 		EG(current_execute_data) = EX(prev_execute_data);
+
+		/* Free extra args before releasing the closure,
+		 * as that may free the op_array. */
+		zend_vm_stack_free_extra_args_ex(call_info, execute_data);
+
 		if (UNEXPECTED(call_info & ZEND_CALL_RELEASE_THIS)) {
 			zend_object *object = Z_OBJ(execute_data->This);
 #if 0
@@ -2413,7 +2418,6 @@ ZEND_VM_HELPER(zend_leave_helper, ANY, ANY)
 			OBJ_RELEASE((zend_object*)execute_data->func->op_array.prototype);
 		}

-		zend_vm_stack_free_extra_args_ex(call_info, execute_data);
 		old_execute_data = execute_data;
 		execute_data = EX(prev_execute_data);
 		zend_vm_stack_free_call_frame_ex(call_info, old_execute_data);
@@ -3094,6 +3098,7 @@ ZEND_VM_HANDLER(113, ZEND_INIT_STATIC_METHOD_CALL, UNUSED|CLASS_FETCH|CONST|VAR,
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+				FREE_UNFETCHED_OP2();
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -468,6 +468,11 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_leave_helper_SPEC(ZEND_OPCODE_
 			zend_clean_and_cache_symbol_table(EX(symbol_table));
 		}
 		EG(current_execute_data) = EX(prev_execute_data);
+
+		/* Free extra args before releasing the closure,
+		 * as that may free the op_array. */
+		zend_vm_stack_free_extra_args_ex(call_info, execute_data);
+
 		if (UNEXPECTED(call_info & ZEND_CALL_RELEASE_THIS)) {
 			zend_object *object = Z_OBJ(execute_data->This);
 #if 0
@@ -483,7 +488,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_leave_helper_SPEC(ZEND_OPCODE_
 			OBJ_RELEASE((zend_object*)execute_data->func->op_array.prototype);
 		}

-		zend_vm_stack_free_extra_args_ex(call_info, execute_data);
 		old_execute_data = execute_data;
 		execute_data = EX(prev_execute_data);
 		zend_vm_stack_free_call_frame_ex(call_info, old_execute_data);
@@ -5413,6 +5417,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_C
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -7374,6 +7379,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_C
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -9462,6 +9468,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_C
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -11484,6 +11491,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_C
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+				zval_ptr_dtor_nogc(EX_VAR(opline->op2.var));
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -19456,6 +19464,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_V
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -21255,6 +21264,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_V
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -23855,6 +23865,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_V
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -26355,6 +26366,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_V
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+				zval_ptr_dtor_nogc(EX_VAR(opline->op2.var));
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -28274,6 +28286,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_U
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -29051,6 +29064,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_U
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -30883,6 +30897,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_U
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -32598,6 +32613,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_U
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+				zval_ptr_dtor_nogc(EX_VAR(opline->op2.var));
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -398,6 +398,8 @@ AC_DEFUN([PHP_EVAL_LIBLINE],[
        $2="[$]$2 -pthread"
      else
        PHP_RUN_ONCE(EXTRA_LDFLAGS, [$ac_i], [EXTRA_LDFLAGS="$EXTRA_LDFLAGS $ac_i"])
+        PHP_RUN_ONCE(EXTRA_LDFLAGS_PROGRAM, [$ac_i],
+            [EXTRA_LDFLAGS_PROGRAM="$EXTRA_LDFLAGS_PROGRAM $ac_i"])
      fi
    ;;
    -l*[)]
@@ -2207,7 +2209,7 @@ AC_DEFUN([PHP_SETUP_ICU],[

  dnl If pkg-config is found try using it
  if test "$PHP_ICU_DIR" = "DEFAULT" && test -x "$PKG_CONFIG" && $PKG_CONFIG --exists icu-uc icu-io icu-i18n; then
-    if $PKG_CONFIG --atleast-version=40 icu-uc; then
+    if $PKG_CONFIG --atleast-version=4.0 icu-uc; then
      found_icu=yes
      icu_version_full=`$PKG_CONFIG --modversion icu-uc`
      ac_IFS=$IFS
@@ -2219,7 +2221,8 @@ AC_DEFUN([PHP_SETUP_ICU],[

      ICU_LIBS=`$PKG_CONFIG --libs icu-uc icu-io icu-i18n`
      ICU_INCS=`$PKG_CONFIG --cflags-only-I icu-uc icu-io icu-i18n`
-      ICU_CXXFLAGS="-DU_USING_ICU_NAMESPACE=1"
+      ICU_CXXFLAGS=`$PKG_CONFIG --variable=CXXFLAGS icu-uc`
+      ICU_CXXFLAGS="$ICU_CXXFLAGS -DU_USING_ICU_NAMESPACE=1"

      AC_MSG_RESULT([found $ICU_VERSION])

@@ -107,7 +107,7 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=2
-PHP_RELEASE_VERSION=22
+PHP_RELEASE_VERSION=25
 PHP_EXTRA_VERSION="-dev"
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
@@ -127,6 +127,11 @@ static void com_write_dimension(zval *object, zval *offset, zval *value)

 	obj = CDNO_FETCH(object);

+	if (offset == NULL) {
+		php_com_throw_exception(DISP_E_BADINDEX, "appending to variants is not supported");
+		return;
+	}
+
 	if (V_VT(&obj->v) == VT_DISPATCH) {
 		ZVAL_COPY_VALUE(&args[0], offset);
 		ZVAL_COPY_VALUE(&args[1], value);
@@ -0,0 +1,19 @@
+--TEST--
+Bug #78694 (Appending to a variant array causes segfault)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+?>
+--FILE--
+<?php
+foreach ([new com('WScript.Shell'), new variant([])] as $var) {
+    try {
+        $var[] = 42;
+    } catch (com_exception $ex) {
+        var_dump($ex->getMessage());
+    }
+}
+?>
+--EXPECT--
+string(38) "appending to variants is not supported"
+string(38) "appending to variants is not supported"
@@ -0,0 +1,34 @@
+--TEST--
+Bug #78775: TLS issues from HTTP request affecting other encrypted connections
+--SKIPIF--
+<?php
+if (!extension_loaded('curl')) die('skip Requires curl');
+if (getenv('SKIP_ONLINE_TESTS')) die('skip Online test');
+?>
+--FILE--
+<?php
+
+$sock = fsockopen("tls://google.com", 443);
+
+var_dump($sock);
+
+$handle = curl_init('https://self-signed.badssl.com/');
+curl_setopt_array(
+    $handle,
+    [
+        CURLOPT_RETURNTRANSFER => true,
+        CURLOPT_SSL_VERIFYPEER => true,
+    ]
+);
+
+var_dump(curl_exec($handle));
+curl_close($handle);
+
+fwrite($sock, "GET / HTTP/1.0\n\n");
+var_dump(fread($sock, 8));
+
+?>
+--EXPECTF--
+resource(%d) of type (stream)
+bool(false)
+string(8) "HTTP/1.0"
@@ -2925,7 +2925,7 @@ static int php_date_initialize_from_hash(php_date_obj **dateobj, HashTable *myht
 	timelib_tzinfo   *tzi;
 	php_timezone_obj *tzobj;

-	z_date = zend_hash_str_find(myht, "date", sizeof("data")-1);
+	z_date = zend_hash_str_find(myht, "date", sizeof("date")-1);
 	if (z_date && Z_TYPE_P(z_date) == IS_STRING) {
 		z_timezone_type = zend_hash_str_find(myht, "timezone_type", sizeof("timezone_type")-1);
 		if (z_timezone_type && Z_TYPE_P(z_timezone_type) == IS_LONG) {
@@ -4364,6 +4364,20 @@ static int php_date_interval_initialize_from_hash(zval **return_value, php_inter
 		} \
 	} while (0);

+#define PHP_DATE_INTERVAL_READ_PROPERTY_DAYS(member) \
+	do { \
+		zval *z_arg = zend_hash_str_find(myht, "days", sizeof("days") - 1); \
+		if (z_arg && Z_TYPE_P(z_arg) == IS_FALSE) { \
+			(*intobj)->diff->member = -99999; \
+		} else if (z_arg && Z_TYPE_P(z_arg) <= IS_STRING) { \
+			zend_string *str = zval_get_string(z_arg); \
+			DATE_A64I((*intobj)->diff->member, ZSTR_VAL(str)); \
+			zend_string_release(str); \
+		} else { \
+			(*intobj)->diff->member = -1LL; \
+		} \
+	} while (0);
+
 #define PHP_DATE_INTERVAL_READ_PROPERTY_DOUBLE(element, member, def) \
 	do { \
 		zval *z_arg = zend_hash_str_find(myht, element, sizeof(element) - 1); \
@@ -4392,7 +4406,7 @@ static int php_date_interval_initialize_from_hash(zval **return_value, php_inter
 	PHP_DATE_INTERVAL_READ_PROPERTY("weekday_behavior", weekday_behavior, int, -1)
 	PHP_DATE_INTERVAL_READ_PROPERTY("first_last_day_of", first_last_day_of, int, -1)
 	PHP_DATE_INTERVAL_READ_PROPERTY("invert", invert, int, 0);
-	PHP_DATE_INTERVAL_READ_PROPERTY_I64("days", days);
+	PHP_DATE_INTERVAL_READ_PROPERTY_DAYS(days);
 	PHP_DATE_INTERVAL_READ_PROPERTY("special_type", special.type, unsigned int, 0);
 	PHP_DATE_INTERVAL_READ_PROPERTY_I64("special_amount", special.amount);
 	PHP_DATE_INTERVAL_READ_PROPERTY("have_weekday_relative", have_weekday_relative, unsigned int, 0);
@@ -5157,7 +5171,7 @@ static HashTable *date_object_get_properties_period(zval *object) /* {{{ */

 	if (period_obj->start) {
 		php_date_obj *date_obj;
-		object_init_ex(&zv, date_ce_date);
+		object_init_ex(&zv, period_obj->start_ce);
 		date_obj = Z_PHPDATE_P(&zv);
 		date_obj->time = timelib_time_clone(period_obj->start);
 	} else {
@@ -5167,7 +5181,7 @@ static HashTable *date_object_get_properties_period(zval *object) /* {{{ */

 	if (period_obj->current) {
 		php_date_obj *date_obj;
-		object_init_ex(&zv, date_ce_date);
+		object_init_ex(&zv, period_obj->start_ce);
 		date_obj = Z_PHPDATE_P(&zv);
 		date_obj->time = timelib_time_clone(period_obj->current);
 	} else {
@@ -5177,7 +5191,7 @@ static HashTable *date_object_get_properties_period(zval *object) /* {{{ */

 	if (period_obj->end) {
 		php_date_obj *date_obj;
-		object_init_ex(&zv, date_ce_date);
+		object_init_ex(&zv, period_obj->start_ce);
 		date_obj = Z_PHPDATE_P(&zv);
 		date_obj->time = timelib_time_clone(period_obj->end);
 	} else {
@@ -5214,7 +5228,7 @@ static int php_date_period_initialize_from_hash(php_period_obj *period_obj, Hash

 	ht_entry = zend_hash_str_find(myht, "start", sizeof("start")-1);
 	if (ht_entry) {
-		if (Z_TYPE_P(ht_entry) == IS_OBJECT && Z_OBJCE_P(ht_entry) == date_ce_date) {
+		if (Z_TYPE_P(ht_entry) == IS_OBJECT && instanceof_function(Z_OBJCE_P(ht_entry), date_ce_interface)) {
 			php_date_obj *date_obj;
 			date_obj = Z_PHPDATE_P(ht_entry);
 			period_obj->start = timelib_time_clone(date_obj->time);
@@ -5228,7 +5242,7 @@ static int php_date_period_initialize_from_hash(php_period_obj *period_obj, Hash

 	ht_entry = zend_hash_str_find(myht, "end", sizeof("end")-1);
 	if (ht_entry) {
-		if (Z_TYPE_P(ht_entry) == IS_OBJECT && Z_OBJCE_P(ht_entry) == date_ce_date) {
+		if (Z_TYPE_P(ht_entry) == IS_OBJECT && instanceof_function(Z_OBJCE_P(ht_entry), date_ce_interface)) {
 			php_date_obj *date_obj;
 			date_obj = Z_PHPDATE_P(ht_entry);
 			period_obj->end = timelib_time_clone(date_obj->time);
@@ -5241,7 +5255,7 @@ static int php_date_period_initialize_from_hash(php_period_obj *period_obj, Hash

 	ht_entry = zend_hash_str_find(myht, "current", sizeof("current")-1);
 	if (ht_entry) {
-		if (Z_TYPE_P(ht_entry) == IS_OBJECT && Z_OBJCE_P(ht_entry) == date_ce_date) {
+		if (Z_TYPE_P(ht_entry) == IS_OBJECT && instanceof_function(Z_OBJCE_P(ht_entry), date_ce_interface)) {
 			php_date_obj *date_obj;
 			date_obj = Z_PHPDATE_P(ht_entry);
 			period_obj->current = timelib_time_clone(date_obj->time);
@@ -39,7 +39,7 @@ DateInterval Object
    [weekday_behavior] => 0
    [first_last_day_of] => 0
    [invert] => 0
-    [days] => 0
+    [days] => 
    [special_type] => 0
    [special_amount] => 0
    [have_weekday_relative] => 0
@@ -136,7 +136,7 @@ object(DatePeriod)#5 (6) {
    ["invert"]=>
    int(0)
    ["days"]=>
-    int(0)
+    bool(false)
    ["special_type"]=>
    int(0)
    ["special_amount"]=>
@@ -71,7 +71,7 @@ object(DateInterval)#2 (16) {
  ["invert"]=>
  int(0)
  ["days"]=>
-  int(0)
+  bool(false)
  ["special_type"]=>
  int(0)
  ["special_amount"]=>
@@ -0,0 +1,14 @@
+--TEST--
+Bug #70153 (\DateInterval incorrectly unserialized)
+--FILE--
+<?php
+$i1 = \DateInterval::createFromDateString('+1 month');
+$i2 = unserialize(serialize($i1));
+var_dump($i1->days, $i2->days);
+var_dump($i2->special_amount, $i2->special_amount);
+?>
+--EXPECT--
+bool(false)
+bool(false)
+int(0)
+int(0)
@@ -0,0 +1,16 @@
+--TEST--
+Bug #78751 (Serialising DatePeriod converts DateTimeImmutable)
+--FILE--
+<?php
+$oDay = new DateTimeImmutable('2019-10-25');
+$oDateInterval = DateInterval::createFromDateString('1 day');
+$oDays = new DatePeriod($oDay, $oDateInterval, $oDay->modify('+1 day'));
+$oDays = unserialize(serialize($oDays));
+var_dump(
+    $oDays->start instanceof DateTimeImmutable,
+    $oDays->end instanceof DateTimeImmutable
+);
+?>
+--EXPECT--
+bool(true)
+bool(true)
@@ -21,6 +21,6 @@ domdocumentloadxml_test_method.php
 --EXPECTF--
 Warning: DOMDocument::load%r(XML){0,1}%r(): Opening and ending tag mismatch: title line 5 and book %s

-Warning: DOMDocument::load%r(XML){0,1}%r(): expected '>' %s
+Warning: DOMDocument::load%r(XML){0,1}%r(): %rexpected '>'|Opening and ending tag mismatch: book line 5 and books%r %s

-Warning: DOMDocument::load%r(XML){0,1}%r(): Premature end of data in tag books %s
+Warning: DOMDocument::load%r(XML){0,1}%r(): %rPremature end of data in tag books|EndTag: '<\/' not found in Entity, line: 13%r %s
@@ -21,6 +21,6 @@ domdocumentload_test_method.php
 --EXPECTF--
 Warning: DOMDocument::load%r(XML){0,1}%r(): Opening and ending tag mismatch: title line 5 and book %s

-Warning: DOMDocument::load%r(XML){0,1}%r(): expected '>' %s
+Warning: DOMDocument::load%r(XML){0,1}%r(): %rexpected '>'|Opening and ending tag mismatch: book line 5 and books%r %s

-Warning: DOMDocument::load%r(XML){0,1}%r(): Premature end of data in tag books %s
+Warning: DOMDocument::load%r(XML){0,1}%r(): %rPremature end of data in tag books|EndTag: '<\/' not found%r %s
@@ -1002,7 +1002,6 @@ static tag_info_array tag_table_VND_PANASONIC = {
  { 0x0001, "Quality"},
  { 0x0002, "FirmwareVersion"},
  { 0x0003, "WhiteBalance"},
-  { 0x0004, "0x0004"},
  { 0x0007, "FocusMode"},
  { 0x000f, "AFMode"},
  { 0x001a, "ImageStabilization"},
@@ -1010,12 +1009,10 @@ static tag_info_array tag_table_VND_PANASONIC = {
  { 0x001f, "ShootingMode"},
  { 0x0020, "Audio"},
  { 0x0021, "DataDump"},
-  { 0x0022, "0x0022"},
  { 0x0023, "WhiteBalanceBias"},
  { 0x0024, "FlashBias"},
  { 0x0025, "InternalSerialNumber"},
  { 0x0026, "ExifVersion"},
-  { 0x0027, "0x0027"},
  { 0x0028, "ColorEffect"},
  { 0x0029, "TimeSincePowerOn"},
  { 0x002a, "BurstMode"},
@@ -1023,7 +1020,6 @@ static tag_info_array tag_table_VND_PANASONIC = {
  { 0x002c, "Contrast"},
  { 0x002d, "NoiseReduction"},
  { 0x002e, "SelfTimer"},
-  { 0x002f, "0x002f"},
  { 0x0030, "Rotation"},
  { 0x0031, "AFAssistLamp"},
  { 0x0032, "ColorMode"},
@@ -1090,7 +1086,6 @@ static tag_info_array tag_table_VND_PANASONIC = {
  { 0x00a3, "ClearRetouchValue"},
  { 0x00ab, "TouchAE"},
  { 0x0e00, "PrintIM"},
-  { 0x4449, "0x4449"},
  { 0x8000, "MakerNoteVersion"},
  { 0x8001, "SceneMode"},
  { 0x8004, "WBRedLevel"},
@@ -1125,22 +1120,20 @@ static tag_info_array tag_table_VND_SONY = {
  { 0x0112, "WhiteBalanceFineTune"},
  { 0x0114, "CameraSettings"},
  { 0x0115, "WhiteBalance"},
-  { 0x0116, "0x0116"},
+  { 0x0116, "ExtraInfo"},
  { 0x0e00, "PrintIM"},
  { 0x1000, "MultiBurstMode"},
  { 0x1001, "MultiBurstImageWidth"},
  { 0x1002, "MultiBurstImageHeight"},
  { 0x1003, "Panorama"},
-  { 0x2000, "0x2000"},
  { 0x2001, "PreviewImage"},
-  { 0x2002, "0x2002"},
-  { 0x2003, "0x2003"},
+  { 0x2002, "Rating"},
  { 0x2004, "Contrast"},
  { 0x2005, "Saturation"},
-  { 0x2006, "0x2006"},
-  { 0x2007, "0x2007"},
-  { 0x2008, "0x2008"},
-  { 0x2009, "0x2009"},
+  { 0x2006, "Sharpness"},
+  { 0x2007, "Brightness"},
+  { 0x2008, "LongExposureNoiseReduction"},
+  { 0x2009, "HighISONoiseReduction"},
  { 0x200a, "AutoHDR"},
  { 0x3000, "ShotInfo"},
  { 0xb000, "FileFormat"},
@@ -1167,8 +1160,9 @@ static tag_info_array tag_table_VND_SONY = {
  { 0xb049, "ReleaseMode"},
  { 0xb04a, "SequenceNumber"},
  { 0xb04b, "AntiBlur"},
-  { 0xb04e, "LongExposureNoiseReduction"},
+  { 0xb04e, "FocusMode"},
  { 0xb04f, "DynamicRangeOptimizer"},
+  { 0xb050, "HighISONoiseReduction2"},
  { 0xb052, "IntelligentAuto"},
  { 0xb054, "WhiteBalance2"},
  TAG_TABLE_END
@@ -1273,7 +1267,6 @@ static tag_info_array tag_table_VND_MINOLTA = {
  { 0x0100, "SceneMode"},
  { 0x0101, "ColorMode"},
  { 0x0102, "Quality"},
-  { 0x0103, "0x0103"},
  { 0x0104, "FlashExposureComp"},
  { 0x0105, "Teleconverter"},
  { 0x0107, "ImageStabilization"},
@@ -1369,6 +1362,7 @@ static const maker_note_type maker_note_array[] = {
  { tag_table_VND_PANASONIC, "Panasonic",               NULL, "Panasonic\x00\x00\x00",			 12, 12, MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
  { tag_table_VND_DJI,       "DJI",                     NULL, NULL,								 0, 0,   MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
  { tag_table_VND_SONY,      "SONY",                    NULL, "SONY DSC \x00\x00\x00",	         12, 12, MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
+  { tag_table_VND_SONY,      "SONY",                    NULL,								     0, 0,   MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
  { tag_table_VND_PENTAX,    "PENTAX",                  NULL, "AOC\x00",						 6,  6,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
  { tag_table_VND_MINOLTA,   "Minolta, KONICA MINOLTA", NULL, NULL,								 0,  0,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
  { tag_table_VND_SIGMA,     "SIGMA, FOVEON",           NULL, "SIGMA\x00\x00\x00",				 10, 10, MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
@@ -2328,14 +2322,11 @@ static void exif_iif_free(image_info_type *image_info, int section_index) {
 				efree(f);
 			}
 			switch(image_info->info_list[section_index].list[i].format) {
-				case TAG_FMT_SBYTE:
-				case TAG_FMT_BYTE:
-					/* in contrast to strings bytes do not need to allocate buffer for NULL if length==0 */
-					if (image_info->info_list[section_index].list[i].length<1)
-						break;
-				default:
 				case TAG_FMT_UNDEFINED:
 				case TAG_FMT_STRING:
+				case TAG_FMT_SBYTE:
+				case TAG_FMT_BYTE:
+				default:
 					if ((f=image_info->info_list[section_index].list[i].value.s) != NULL) {
 						efree(f);
 					}
@@ -3262,6 +3253,14 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 }
 /* }}} */

+#define REQUIRE_NON_EMPTY() do { \
+	if (byte_count == 0) { \
+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Cannot be empty", tag, exif_get_tagname(tag, tagname, -12, tag_table)); \
+		return FALSE; \
+	} \
+} while (0)
+
+
 /* {{{ exif_process_IFD_TAG
 * Process one of the nested IFDs directories. */
 static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, char *offset_base, size_t IFDlength, size_t displacement, int section_index, int ReadNextIFD, tag_table_type tag_table)
@@ -3295,11 +3294,6 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 		/*return TRUE;*/
 	}

-	if (components <= 0) {
-		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal components(%d)", tag, exif_get_tagname(tag, tagname, -12, tag_table), components);
-		return FALSE;
-	}
-
 	byte_count_signed = (int64_t)components * php_tiff_bytes_per_format[format];

 	if (byte_count_signed < 0 || (byte_count_signed > INT32_MAX)) {
@@ -3379,8 +3373,12 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 	}
 #endif

+	/* NB: The following code may not assume that there is at least one component!
+	 * byte_count may be zero! */
+
 	if (section_index==SECTION_THUMBNAIL) {
 		if (!ImageInfo->Thumbnail.data) {
+			REQUIRE_NON_EMPTY();
 			switch(tag) {
 				case TAG_IMAGEWIDTH:
 				case TAG_COMP_IMAGE_WIDTH:
@@ -3424,6 +3422,9 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				if (byte_count>1 && (length=php_strnlen(value_ptr, byte_count)) > 0) {
 					if (length<byte_count-1) {
 						/* When there are any characters after the first NUL */
+						EFREE_IF(ImageInfo->CopyrightPhotographer);
+						EFREE_IF(ImageInfo->CopyrightEditor);
+						EFREE_IF(ImageInfo->Copyright);
 						ImageInfo->CopyrightPhotographer  = estrdup(value_ptr);
 						ImageInfo->CopyrightEditor        = estrndup(value_ptr+length+1, byte_count-length-1);
 						spprintf(&ImageInfo->Copyright, 0, "%s, %s", ImageInfo->CopyrightPhotographer, ImageInfo->CopyrightEditor);
@@ -3431,6 +3432,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 						/* but we are not supposed to change this                   */
 						/* keep in mind that image_info does not store editor value */
 					} else {
+						EFREE_IF(ImageInfo->Copyright);
 						ImageInfo->Copyright = estrndup(value_ptr, byte_count);
 					}
 				}
@@ -3459,6 +3461,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 			case TAG_FNUMBER:
 				/* Simplest way of expressing aperture, so I trust it the most.
 				   (overwrite previously computed value if there is one) */
+				REQUIRE_NON_EMPTY();
 				ImageInfo->ApertureFNumber = (float)exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel);
 				break;

@@ -3467,6 +3470,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				/* More relevant info always comes earlier, so only use this field if we don't
 				   have appropriate aperture information yet. */
 				if (ImageInfo->ApertureFNumber == 0) {
+					REQUIRE_NON_EMPTY();
 					ImageInfo->ApertureFNumber
 						= (float)exp(exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel)*log(2)*0.5);
 				}
@@ -3478,6 +3482,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				   SHUTTERSPEED comes after EXPOSURE TIME
 				  */
 				if (ImageInfo->ExposureTime == 0) {
+					REQUIRE_NON_EMPTY();
 					ImageInfo->ExposureTime
 						= (float)(1/exp(exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel)*log(2)));
 				}
@@ -3487,20 +3492,24 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				break;

 			case TAG_COMP_IMAGE_WIDTH:
+				REQUIRE_NON_EMPTY();
 				ImageInfo->ExifImageWidth = exif_convert_any_to_int(value_ptr, exif_rewrite_tag_format_to_unsigned(format), ImageInfo->motorola_intel);
 				break;

 			case TAG_FOCALPLANE_X_RES:
+				REQUIRE_NON_EMPTY();
 				ImageInfo->FocalplaneXRes = exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel);
 				break;

 			case TAG_SUBJECT_DISTANCE:
 				/* Inidcates the distacne the autofocus camera is focused to.
 				   Tends to be less accurate as distance increases. */
+				REQUIRE_NON_EMPTY();
 				ImageInfo->Distance = (float)exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel);
 				break;

 			case TAG_FOCALPLANE_RESOLUTION_UNIT:
+				REQUIRE_NON_EMPTY();
 				switch((int)exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel)) {
 					case 1: ImageInfo->FocalplaneUnits = 25.4; break; /* inch */
 					case 2:
@@ -3526,9 +3535,11 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				break;

 			case TAG_MAKE:
+				EFREE_IF(ImageInfo->make);
 				ImageInfo->make = estrndup(value_ptr, byte_count);
 				break;
 			case TAG_MODEL:
+				EFREE_IF(ImageInfo->model);
 				ImageInfo->model = estrndup(value_ptr, byte_count);
 				break;

@@ -3543,6 +3554,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 			case TAG_GPS_IFD_POINTER:
 			case TAG_INTEROP_IFD_POINTER:
 				if (ReadNextIFD) {
+					REQUIRE_NON_EMPTY();
 					char *Subdir_start;
 					int sub_section_index = 0;
 					switch(tag) {
@@ -3571,9 +3583,11 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 					Subdir_start = offset_base + php_ifd_get32u(value_ptr, ImageInfo->motorola_intel);
 					if (Subdir_start < offset_base || Subdir_start > offset_base+IFDlength) {
 						exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD Pointer");
+						EFREE_IF(outside);
 						return FALSE;
 					}
 					if (!exif_process_IFD_in_JPEG(ImageInfo, Subdir_start, offset_base, IFDlength, displacement, sub_section_index, tag)) {
+						EFREE_IF(outside);
 						return FALSE;
 					}
 #ifdef EXIF_DEBUG
@@ -4584,8 +4598,9 @@ PHP_FUNCTION(exif_read_data)
 		exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "CCDWidth", "%dmm", (int)ImageInfo.CCDWidth);
 	}
 	if(ImageInfo.ExposureTime>0) {
-		if(ImageInfo.ExposureTime <= 0.5) {
-			exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "ExposureTime", "%0.3F s (1/%d)", ImageInfo.ExposureTime, (int)(0.5 + 1/ImageInfo.ExposureTime));
+		float recip_exposure_time = 0.5f + 1.0f/ImageInfo.ExposureTime;
+		if (ImageInfo.ExposureTime <= 0.5 && recip_exposure_time < INT_MAX) {
+			exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "ExposureTime", "%0.3F s (1/%d)", ImageInfo.ExposureTime, (int) recip_exposure_time);
 		} else {
 			exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "ExposureTime", "%0.3F s", ImageInfo.ExposureTime);
 		}
@@ -4,9 +4,48 @@ Bug #68547 (Exif Header component value check error)
 <?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
 --FILE--
 <?php
-exif_read_data(__DIR__ . DIRECTORY_SEPARATOR . 'bug68547.jpg');
+var_dump(exif_read_data(__DIR__ . DIRECTORY_SEPARATOR . 'bug68547.jpg'));
 ?>
 ===DONE===
 --EXPECTF--
-Warning: exif_read_data(bug68547.jpg): Process tag(x9C9E=Keywords   ): Illegal components(%d) in %sbug68547.php on line %d
+array(12) {
+  ["FileName"]=>
+  string(12) "bug68547.jpg"
+  ["FileDateTime"]=>
+  int(%d)
+  ["FileSize"]=>
+  int(713)
+  ["FileType"]=>
+  int(2)
+  ["MimeType"]=>
+  string(10) "image/jpeg"
+  ["SectionsFound"]=>
+  string(20) "ANY_TAG, IFD0, WINXP"
+  ["COMPUTED"]=>
+  array(5) {
+    ["html"]=>
+    string(20) "width="1" height="1""
+    ["Height"]=>
+    int(1)
+    ["Width"]=>
+    int(1)
+    ["IsColor"]=>
+    int(1)
+    ["ByteOrderMotorola"]=>
+    int(0)
+  }
+  ["Subject"]=>
+  string(10) "Subjec??.."
+  ["Keywords"]=>
+  string(0) ""
+  ["Author"]=>
+  string(9) "Rui Carmo"
+  ["Comments"]=>
+  string(29) "Comments
+Line2
+Line3
+Line4"
+  ["Title"]=>
+  string(8) "Title..."
+}
 ===DONE===
@@ -39,7 +39,6 @@ print_r(exif_read_data(__DIR__.'/bug68799.jpg'));

 ?>
 --EXPECTF--
-Warning: exif_read_data(bug68799.jpg): Process tag(x9C9D=Author     ): Illegal components(%d) in %s on line %d
 Array
 (
    [FileName] => bug68799.jpg
@@ -47,7 +46,7 @@ Array
    [FileSize] => 735
    [FileType] => 2
    [MimeType] => image/jpeg
-    [SectionsFound] => ANY_TAG, IFD0
+    [SectionsFound] => ANY_TAG, IFD0, WINXP
    [COMPUTED] => Array
        (
            [html] => width="1" height="1"
@@ -60,4 +59,5 @@ Array
    [XResolution] => 96/1
    [YResolution] => 96/1
    [ResolutionUnit] => 2
+    [Author] => 
 )
@@ -47,7 +47,7 @@ Warning: exif_read_data(bug72094_3.jpg): Process tag(x3030=UndefinedTa): Illegal

 Warning: exif_read_data(bug72094_3.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d

-Warning: exif_read_data(bug72094_3.jpg): Process tag(x3030=UndefinedTa): Illegal components(%d) in %s%ebug72094.php on line %d
+Warning: exif_read_data(bug72094_3.jpg): Illegal IFD size in %s%ebug72094.php on line %d

 Warning: exif_read_data(bug72094_3.jpg): File structure corrupted in %s%ebug72094.php on line %d

@@ -8,7 +8,7 @@ Bug #73737 (Crash when parsing a tag format)
 	var_dump($exif);
 ?>
 --EXPECTF--
-Warning: exif_thumbnail(bug73737.tiff): Process tag(x0100=ImageWidth ): Illegal components(0) in %s on line %d
+Warning: exif_thumbnail(bug73737.tiff): Process tag(x0100=ImageWidth ): Cannot be empty in %s on line %d

 Warning: exif_thumbnail(bug73737.tiff): Error in TIFF: filesize(x0030) less than start of IFD dir(x10102) in %s line %d
 bool(false)
@@ -0,0 +1,18 @@
+--TEST--
+OSS-Fuzz #17474: Memory leak on duplicate Copyright tags
+--SKIPIF--
+<?php
+if (!extension_loaded('exif')) {
+    die('skip exif extension not available');
+}
+?>
+--FILE--
+<?php
+
+// Only checking for an absence of leaks here.
+@exif_read_data(__DIR__ . '/duplicate_copyright_tag_leak.tiff');
+
+?>
+===DONE===
+--EXPECTF--
+===DONE===
@@ -0,0 +1,21 @@
+--TEST--
+OSS-Fuzz #17163: Out-of-bounds read due to tag with zero components
+--SKIPIF--
+<?php
+if (!extension_loaded('exif')) {
+    die('skip exif extension not available');
+}
+?>
+--FILE--
+<?php
+
+var_dump(exif_read_data(__DIR__ . '/tag_with_illegal_zero_components.jpeg'));
+
+?>
+--EXPECTF--
+Warning: exif_read_data(tag_with_illegal_zero_components.jpeg): Process tag(x0202=JPEGInterch): Cannot be empty in %s on line %d
+
+Warning: exif_read_data(tag_with_illegal_zero_components.jpeg): File structure corrupted in %s on line %d
+
+Warning: exif_read_data(tag_with_illegal_zero_components.jpeg): Invalid JPEG file in %s on line %d
+bool(false)
@@ -0,0 +1,16 @@
+--TEST--
+OSS-Fuzz: Temporary buffer leak in tag reading
+--SKIPIF--
+<?php
+if (!extension_loaded('exif')) {
+    die('skip exif extension not available');
+}
+?>
+--FILE--
+<?php
+
+var_dump(@exif_read_data(__DIR__ . '/temporary_buffer_leak.jpg'));
+
+?>
+--EXPECT--
+bool(false)
@@ -0,0 +1,17 @@
+--TEST--
+OSS-Fuzz: Memory leak for zero-length MAKERNOTE
+--SKIPIF--
+<?php
+if (!extension_loaded('exif')) {
+    die('skip exif extension not available');
+}
+?>
+--FILE--
+<?php
+
+@exif_read_data(__DIR__ . '/zero_length_makernote_leak.tiff');
+
+?>
+===DONE===
+--EXPECT--
+===DONE===
@@ -1011,8 +1011,9 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 				goto out;
 			}
 			nelements = CDF_GETUINT32(q, 1);
-			if (nelements == 0) {
-				DPRINTF(("CDF_VECTOR with nelements == 0\n"));
+			if (nelements > CDF_ELEMENT_LIMIT || nelements == 0) {
+				DPRINTF(("CDF_VECTOR with nelements == %"
+				    SIZE_T_FORMAT "u\n", nelements));
 				goto out;
 			}
 			slen = 2;
@@ -1054,8 +1055,6 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 					goto out;
 				inp += nelem;
 			}
-			DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n",
-			    nelements));
 			for (j = 0; j < nelements && i < sh.sh_properties;
 			    j++, i++)
 			{
@@ -50,6 +50,7 @@
 typedef int32_t cdf_secid_t;

 #define CDF_LOOP_LIMIT					10000
+#define CDF_ELEMENT_LIMIT				100000

 #define CDF_SECID_NULL					0
 #define CDF_SECID_FREE					-1
@@ -3,7 +3,7 @@ Bug #77198 (auto cropping has insufficient precision)
 --SKIPIF--
 <?php
 if (!extension_loaded('gd')) die('skip gd extension not available');
-if (!GD_BUNDLED) die('upstream bugfix has not been released');
+if (!GD_BUNDLED) die('skip upstream bugfix has not been released');
 ?>
 --FILE--
 <?php
@@ -3,7 +3,7 @@ Bug #77198 (threshold cropping has insufficient precision)
 --SKIPIF--
 <?php
 if (!extension_loaded('gd')) die('skip gd extension not available');
-if (!GD_BUNDLED) die('upstream bugfix has not been released');
+if (!GD_BUNDLED) die('skip upstream bugfix has not been released');
 ?>
 --FILE--
 <?php
@@ -3,7 +3,7 @@ Bug #77200 (imagecropauto(…, GD_CROP_SIDES) crops left but not right)
 --SKIPIF--
 <?php
 if (!extension_loaded('gd')) die('skip gd extension not available');
-if (!GD_BUNDLED) die('upstream bugfix has not been released');
+if (!GD_BUNDLED) die('skip upstream bugfix has not been released');
 ?>
 --FILE--
 <?php
@@ -286,7 +286,7 @@ PHP_MINIT_FUNCTION(miconv)
 	{
 		static char buf[16];
 		snprintf(buf, sizeof(buf), "%d.%d",
-		    ((_libiconv_version >> 8) & 0x0f), (_libiconv_version & 0x0f));
+			_libiconv_version >> 8, _libiconv_version & 0xff);
 		version = buf;
 	}
 #elif HAVE_GLIBC_ICONV
@@ -223,11 +223,23 @@ static void php_intl_idn_to(INTERNAL_FUNCTION_PARAMETERS,
 		UParseError parse_error;

 		status = U_ZERO_ERROR;
+#if defined(__clang__)
+# pragma clang diagnostic push
+# pragma clang diagnostic ignored "-Wdeprecated-declarations"
+#elif ZEND_GCC_VERSION >= 4008
+# pragma GCC diagnostic push
+# pragma GCC diagnostic ignored "-Wdeprecated-declarations"
+#endif
 		if (mode == INTL_IDN_TO_ASCII) {
 			converted_ret_len = uidna_IDNToASCII(ustring, ustring_len, converted, MAXPATHLEN, (int32_t)option, &parse_error, &status);
 		} else {
 			converted_ret_len = uidna_IDNToUnicode(ustring, ustring_len, converted, MAXPATHLEN, (int32_t)option, &parse_error, &status);
 		}
+#if defined(__clang__)
+# pragma clang diagnostic pop
+#elif ZEND_GCC_VERSION >= 4008
+# pragma GCC diagnostic pop
+#endif
 		efree(ustring);

 		if (U_FAILURE(status)) {
@@ -185,10 +185,10 @@ static HashTable *umsg_parse_format(MessageFormatter_object *mfo,

 		if (name_part.getType() == UMSGPAT_PART_TYPE_ARG_NAME) {
 			UnicodeString argName = mp.getSubstring(name_part);
-			if ((storedType = (Formattable::Type*)zend_hash_str_find_ptr(ret, (char*)argName.getBuffer(), argName.length())) == NULL) {
+			if ((storedType = (Formattable::Type*)zend_hash_str_find_ptr(ret, (char*)argName.getBuffer(), argName.length() * sizeof(UChar))) == NULL) {
 				/* not found already; create new entry in HT */
 				Formattable::Type bogusType = Formattable::kObject;
-				if ((storedType = (Formattable::Type*)zend_hash_str_update_mem(ret, (char*)argName.getBuffer(), argName.length(),
+				if ((storedType = (Formattable::Type*)zend_hash_str_update_mem(ret, (char*)argName.getBuffer(), argName.length() * sizeof(UChar),
 						(void*)&bogusType, sizeof(bogusType))) == NULL) {
 					intl_errors_set(&err, U_MEMORY_ALLOCATION_ERROR,
 						"Write to argument types hash table failed", 0);
@@ -450,7 +450,7 @@ U_CFUNC void umsg_format_helper(MessageFormatter_object *mfo,
 				continue;
 			}

-			storedArgType = (Formattable::Type*)zend_hash_str_find_ptr(types, (char*)key.getBuffer(), key.length());
+			storedArgType = (Formattable::Type*)zend_hash_str_find_ptr(types, (char*)key.getBuffer(), key.length() * sizeof(UChar));
 		}

 		if (storedArgType != NULL) {
@@ -2,6 +2,7 @@
 grapheme()
 --SKIPIF--
 <?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?>
+<?php if (version_compare(INTL_ICU_VERSION, '65.0') >= 0) die('skip for ICU < 65.0'); ?>
 --FILE--
 <?php

@@ -3,6 +3,7 @@ locale_get_display_name() icu >= 64.0
 --SKIPIF--
 <?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?>
 <?php if (version_compare(INTL_ICU_VERSION, '64.0') < 0) die('skip for ICU >= 64.0'); ?>
+<?php if (version_compare(INTL_ICU_VERSION, '65.0') >= 0) die('skip for ICU < 65.0'); ?>
 --FILE--
 <?php

@@ -0,0 +1,342 @@
+--TEST--
+locale_get_display_name() icu >= 64.0
+--SKIPIF--
+<?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?>
+<?php if (version_compare(INTL_ICU_VERSION, '65.0') < 0) die('skip for ICU >= 65.0'); ?>
+--FILE--
+<?php
+
+/*
+ * Try getting the display_name for different locales
+ * with Procedural and Object methods.
+ */
+
+function ut_main()
+{
+    $res_str='';
+
+	$disp_locales=array('en','fr','de');
+
+    $locales = array(
+        'sl_IT_nedis_KIRTI',
+        'sl_IT_nedis-a-kirti-x-xyz',
+        'sl_IT_rozaj',
+        'sl_IT_NEDIS_ROJAZ_1901',
+        'i-enochian',
+        'zh-hakka',
+        'zh-wuu',
+        'i-tay',
+        'sgn-BE-nl',
+        'sgn-CH-de',
+        'sl_IT_rozaj@currency=EUR',
+        'uk-ua_CALIFORNIA@currency=;currency=GRN',
+        'root',
+        'uk@currency=EURO',
+        'Hindi',
+//Simple language subtag
+        'de',
+        'fr',
+        'ja',
+        'i-enochian', //(example of a grandfathered tag)
+//Language subtag plus Script subtag:
+        'zh-Hant',
+        'zh-Hans',
+        'sr-Cyrl',
+        'sr-Latn',
+//Language-Script-Region
+        'zh-Hans-CN',
+        'sr-Latn-CS',
+//Language-Variant
+        'sl-rozaj',
+        'sl-nedis',
+//Language-Region-Variant
+        'de-CH-1901',
+        'sl-IT-nedis',
+//Language-Script-Region-Variant
+        'sl-Latn-IT-nedis',
+//Language-Region:
+        'de-DE',
+        'en-US',
+        'es-419',
+//Private use subtags:
+        'de-CH-x-phonebk',
+        'az-Arab-x-AZE-derbend',
+//Extended language subtags
+        'zh-min',
+        'zh-min-nan-Hant-CN',
+//Private use registry values
+        'x-whatever',
+        'qaa-Qaaa-QM-x-southern',
+        'sr-Latn-QM',
+        'sr-Qaaa-CS',
+/*Tags that use extensions (examples ONLY: extensions MUST be defined
+   by revision or update to this document or by RFC): */
+        'en-US-u-islamCal',
+        'zh-CN-a-myExt-x-private',
+        'en-a-myExt-b-another',
+//Some Invalid Tags:
+        'de-419-DE',
+        'a-DE',
+        'ar-a-aaa-b-bbb-a-ccc'
+    );
+
+
+    $res_str = '';
+
+   	foreach( $locales as $locale )
+    {
+       	$res_str .= "locale='$locale'\n";
+   		foreach( $disp_locales as $disp_locale )
+    	{
+        	$scr = ut_loc_get_display_name( $locale ,$disp_locale );
+		$scr = str_replace(array('(', ')'), '#', $scr);
+        	$res_str .= "disp_locale=$disp_locale :  display_name=$scr";
+        	$res_str .= "\n";
+		}
+        $res_str .= "-----------------\n";
+    }
+
+    return $res_str;
+
+}
+
+include_once( 'ut_common.inc' );
+ut_run();
+
+?>
+--EXPECTREGEX--
+locale='sl_IT_nedis_KIRTI'
+disp_locale=en :  display_name=Slovenian #Italy, NEDIS_KIRTI#
+disp_locale=fr :  display_name=slovène #Italie, NEDIS_KIRTI#
+disp_locale=de :  display_name=Slowenisch #Italien, NEDIS_KIRTI#
+-----------------
+locale='sl_IT_nedis-a-kirti-x-xyz'
+disp_locale=en :  display_name=Slovenian #Italy, NEDIS_A_KIRTI_X_XYZ#
+disp_locale=fr :  display_name=slovène #Italie, NEDIS_A_KIRTI_X_XYZ#
+disp_locale=de :  display_name=Slowenisch #Italien, NEDIS_A_KIRTI_X_XYZ#
+-----------------
+locale='sl_IT_rozaj'
+disp_locale=en :  display_name=Slovenian #Italy, Resian#
+disp_locale=fr :  display_name=slovène #Italie, dialecte de Resia#
+disp_locale=de :  display_name=Slowenisch #Italien, (ROZAJ|Resianisch)#
+-----------------
+locale='sl_IT_NEDIS_ROJAZ_1901'
+disp_locale=en :  display_name=Slovenian #Italy, NEDIS_ROJAZ_1901#
+disp_locale=fr :  display_name=slovène #Italie, NEDIS_ROJAZ_1901#
+disp_locale=de :  display_name=Slowenisch #Italien, NEDIS_ROJAZ_1901#
+-----------------
+locale='i-enochian'
+disp_locale=en :  display_name=i-enochian #Private-Use=i-enochian#
+disp_locale=fr :  display_name=i-enochian #usage privé=i-enochian#
+disp_locale=de :  display_name=i-enochian #Privatnutzung=i-enochian#
+-----------------
+locale='zh-hakka'
+disp_locale=en :  display_name=Chinese( #HAKKA#)?
+disp_locale=fr :  display_name=chinois( #HAKKA#)?
+disp_locale=de :  display_name=Chinesisch( #HAKKA#)?
+-----------------
+locale='zh-wuu'
+disp_locale=en :  display_name=Chinese #WUU#
+disp_locale=fr :  display_name=chinois #WUU#
+disp_locale=de :  display_name=Chinesisch #WUU#
+-----------------
+locale='i-tay'
+disp_locale=en :  display_name=i-tay
+disp_locale=fr :  display_name=i-tay
+disp_locale=de :  display_name=i-tay
+-----------------
+locale='sgn-BE-nl'
+disp_locale=en :  display_name=sgn #Belgium, NL#
+disp_locale=fr :  display_name=sgn #Belgique, NL#
+disp_locale=de :  display_name=sgn #Belgien, NL#
+-----------------
+locale='sgn-CH-de'
+disp_locale=en :  display_name=sgn #Switzerland, DE#
+disp_locale=fr :  display_name=sgn #Suisse, DE#
+disp_locale=de :  display_name=sgn #Schweiz, DE#
+-----------------
+locale='sl_IT_rozaj@currency=EUR'
+disp_locale=en :  display_name=Slovenian #Italy, Resian, [Cc]urrency=Euro#
+disp_locale=fr :  display_name=slovène #Italie, dialecte de Resia, [Dd]evise=euro#
+disp_locale=de :  display_name=Slowenisch #Italien, (ROZAJ|Resianisch), Währung=Euro#
+-----------------
+locale='uk-ua_CALIFORNIA@currency=;currency=GRN'
+disp_locale=en :  display_name=
+disp_locale=fr :  display_name=
+disp_locale=de :  display_name=
+-----------------
+locale='root'
+disp_locale=en :  display_name=Unknown language
+disp_locale=fr :  display_name=langue indéterminée
+disp_locale=de :  display_name=Unbekannte Sprache
+-----------------
+locale='uk@currency=EURO'
+disp_locale=en :  display_name=Ukrainian #[Cc]urrency=EURO#
+disp_locale=fr :  display_name=ukrainien #[Dd]evise=EURO#
+disp_locale=de :  display_name=Ukrainisch #Währung=EURO#
+-----------------
+locale='Hindi'
+disp_locale=en :  display_name=hindi
+disp_locale=fr :  display_name=hindi
+disp_locale=de :  display_name=hindi
+-----------------
+locale='de'
+disp_locale=en :  display_name=German
+disp_locale=fr :  display_name=allemand
+disp_locale=de :  display_name=Deutsch
+-----------------
+locale='fr'
+disp_locale=en :  display_name=French
+disp_locale=fr :  display_name=français
+disp_locale=de :  display_name=Französisch
+-----------------
+locale='ja'
+disp_locale=en :  display_name=Japanese
+disp_locale=fr :  display_name=japonais
+disp_locale=de :  display_name=Japanisch
+-----------------
+locale='i-enochian'
+disp_locale=en :  display_name=i-enochian #Private-Use=i-enochian#
+disp_locale=fr :  display_name=i-enochian #usage privé=i-enochian#
+disp_locale=de :  display_name=i-enochian #Privatnutzung=i-enochian#
+-----------------
+locale='zh-Hant'
+disp_locale=en :  display_name=Chinese #Traditional#
+disp_locale=fr :  display_name=chinois #traditionnel#
+disp_locale=de :  display_name=Chinesisch #Traditionell#
+-----------------
+locale='zh-Hans'
+disp_locale=en :  display_name=Chinese #Simplified#
+disp_locale=fr :  display_name=chinois #simplifié#
+disp_locale=de :  display_name=Chinesisch #Vereinfacht#
+-----------------
+locale='sr-Cyrl'
+disp_locale=en :  display_name=Serbian #Cyrillic#
+disp_locale=fr :  display_name=serbe #cyrillique#
+disp_locale=de :  display_name=Serbisch #Kyrillisch#
+-----------------
+locale='sr-Latn'
+disp_locale=en :  display_name=Serbian #Latin#
+disp_locale=fr :  display_name=serbe #latin#
+disp_locale=de :  display_name=Serbisch #Lateinisch#
+-----------------
+locale='zh-Hans-CN'
+disp_locale=en :  display_name=Chinese #Simplified, China#
+disp_locale=fr :  display_name=chinois #simplifié, Chine#
+disp_locale=de :  display_name=Chinesisch #Vereinfacht, China#
+-----------------
+locale='sr-Latn-CS'
+disp_locale=en :  display_name=Serbian #Latin, Serbia#
+disp_locale=fr :  display_name=serbe #latin, Serbie#
+disp_locale=de :  display_name=Serbisch #Lateinisch, Serbien#
+-----------------
+locale='sl-rozaj'
+disp_locale=en :  display_name=Slovenian #Resian#
+disp_locale=fr :  display_name=slovène #dialecte de Resia#
+disp_locale=de :  display_name=Slowenisch( #(ROZAJ|Resianisch)#)?
+-----------------
+locale='sl-nedis'
+disp_locale=en :  display_name=Slovenian #Natisone dialect#
+disp_locale=fr :  display_name=slovène #dialecte de Natisone#
+disp_locale=de :  display_name=Slowenisch #Natisone-Dialekt#
+-----------------
+locale='de-CH-1901'
+disp_locale=en :  display_name=German #Switzerland, Traditional German orthography#
+disp_locale=fr :  display_name=allemand #Suisse, orthographe allemande traditionnelle#
+disp_locale=de :  display_name=Deutsch #Schweiz, (1901|[aA]lte deutsche Rechtschreibung)#
+-----------------
+locale='sl-IT-nedis'
+disp_locale=en :  display_name=Slovenian #Italy, Natisone dialect#
+disp_locale=fr :  display_name=slovène #Italie, dialecte de Natisone#
+disp_locale=de :  display_name=Slowenisch #Italien, (NEDIS|Natisone-Dialekt)#
+-----------------
+locale='sl-Latn-IT-nedis'
+disp_locale=en :  display_name=Slovenian #Latin, Italy, Natisone dialect#
+disp_locale=fr :  display_name=slovène #latin, Italie, dialecte de Natisone#
+disp_locale=de :  display_name=Slowenisch #Lateinisch, Italien, (NEDIS|Natisone-Dialekt)#
+-----------------
+locale='de-DE'
+disp_locale=en :  display_name=German #Germany#
+disp_locale=fr :  display_name=allemand #Allemagne#
+disp_locale=de :  display_name=Deutsch #Deutschland#
+-----------------
+locale='en-US'
+disp_locale=en :  display_name=English #United States#
+disp_locale=fr :  display_name=anglais #États-Unis#
+disp_locale=de :  display_name=Englisch #Vereinigte Staaten#
+-----------------
+locale='es-419'
+disp_locale=en :  display_name=Spanish #Latin America#
+disp_locale=fr :  display_name=espagnol #Amérique latine#
+disp_locale=de :  display_name=Spanisch #Lateinamerika#
+-----------------
+locale='de-CH-x-phonebk'
+disp_locale=en :  display_name=German #Switzerland, Private-Use=phonebk#
+disp_locale=fr :  display_name=allemand #Suisse, usage privé=phonebk#
+disp_locale=de :  display_name=Deutsch #Schweiz, Privatnutzung=phonebk#
+-----------------
+locale='az-Arab-x-AZE-derbend'
+disp_locale=en :  display_name=Azerbaijani #Arabic, Private-Use=aze-derbend#
+disp_locale=fr :  display_name=azéri #arabe, usage privé=aze-derbend#
+disp_locale=de :  display_name=Aserbaidschanisch #Arabisch, Privatnutzung=aze-derbend#
+-----------------
+locale='zh-min'
+disp_locale=en :  display_name=Chinese #MIN#
+disp_locale=fr :  display_name=chinois #MIN#
+disp_locale=de :  display_name=Chinesisch #MIN#
+-----------------
+locale='zh-min-nan-Hant-CN'
+disp_locale=en :  display_name=Chinese #MIN, NAN_HANT_CN#
+disp_locale=fr :  display_name=chinois #MIN, NAN_HANT_CN#
+disp_locale=de :  display_name=Chinesisch #MIN, NAN_HANT_CN#
+-----------------
+locale='x-whatever'
+disp_locale=en :  display_name=x-whatever #Private-Use=whatever#
+disp_locale=fr :  display_name=x-whatever #usage privé=whatever#
+disp_locale=de :  display_name=x-whatever #Privatnutzung=whatever#
+-----------------
+locale='qaa-Qaaa-QM-x-southern'
+disp_locale=en :  display_name=qaa #Qaaa, QM, Private-Use=southern#
+disp_locale=fr :  display_name=qaa #Qaaa, QM, usage privé=southern#
+disp_locale=de :  display_name=qaa #Qaaa, QM, Privatnutzung=southern#
+-----------------
+locale='sr-Latn-QM'
+disp_locale=en :  display_name=Serbian #Latin, QM#
+disp_locale=fr :  display_name=serbe #latin, QM#
+disp_locale=de :  display_name=Serbisch #Lateinisch, QM#
+-----------------
+locale='sr-Qaaa-CS'
+disp_locale=en :  display_name=Serbian #Qaaa, Serbia#
+disp_locale=fr :  display_name=serbe #Qaaa, Serbie#
+disp_locale=de :  display_name=Serbisch #Qaaa, Serbien#
+-----------------
+locale='en-US-u-islamCal'
+disp_locale=en :  display_name=English #United States, attribute=islamcal#
+disp_locale=fr :  display_name=anglais #États-Unis, attribute=islamcal#
+disp_locale=de :  display_name=Englisch #Vereinigte Staaten, attribute=islamcal#
+-----------------
+locale='zh-CN-a-myExt-x-private'
+disp_locale=en :  display_name=Chinese #China, a=myext, Private-Use=private#
+disp_locale=fr :  display_name=chinois #Chine, a=myext, usage privé=private#
+disp_locale=de :  display_name=Chinesisch #China, a=myext, Privatnutzung=private#
+-----------------
+locale='en-a-myExt-b-another'
+disp_locale=en :  display_name=English #a=myext, b=another#
+disp_locale=fr :  display_name=anglais #a=myext, b=another#
+disp_locale=de :  display_name=Englisch #a=myext, b=another#
+-----------------
+locale='de-419-DE'
+disp_locale=en :  display_name=German #Latin America, DE#
+disp_locale=fr :  display_name=allemand #Amérique latine, DE#
+disp_locale=de :  display_name=Deutsch #Lateinamerika, DE#
+-----------------
+locale='a-DE'
+disp_locale=en :  display_name=a #Germany#
+disp_locale=fr :  display_name=a #Allemagne#
+disp_locale=de :  display_name=a #Deutschland#
+-----------------
+locale='ar-a-aaa-b-bbb-a-ccc'
+disp_locale=en :  display_name=Arabic #a=aaa, b=bbb#
+disp_locale=fr :  display_name=arabe #a=aaa, b=bbb#
+disp_locale=de :  display_name=Arabisch #a=aaa, b=bbb#
+-----------------
@@ -3,6 +3,7 @@ Bug #76777 (first parameter of libxml_set_external_entity_loader callback undefi
 --SKIPIF--
 <?php
 if (!extension_loaded('libxml')) die('skip');
+if (!extension_loaded('dom')) die('skip dom extension not available');
 if (getenv("SKIP_ONLINE_TESTS")) die('skip online test');
 ?>
 --FILE--
@@ -414,6 +414,7 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_mb_decode_numericentity, 0, 0, 2)
 	ZEND_ARG_INFO(0, string)
 	ZEND_ARG_INFO(0, convmap)
 	ZEND_ARG_INFO(0, encoding)
+	ZEND_ARG_INFO(0, is_hex)
 ZEND_END_ARG_INFO()

 ZEND_BEGIN_ARG_INFO_EX(arginfo_mb_send_mail, 0, 0, 3)
@@ -5026,27 +5027,15 @@ PHP_FUNCTION(mb_check_encoding)
 		RETURN_FALSE;
 	}

-	switch(Z_TYPE_P(input)) {
-		case IS_LONG:
-		case IS_DOUBLE:
-		case IS_NULL:
-		case IS_TRUE:
-		case IS_FALSE:
-			RETURN_TRUE;
-			break;
-		case IS_STRING:
-			if (!php_mb_check_encoding(Z_STRVAL_P(input), Z_STRLEN_P(input), enc ? ZSTR_VAL(enc): NULL)) {
-				RETURN_FALSE;
-			}
-			break;
-		case IS_ARRAY:
-			if (!php_mb_check_encoding_recursive(HASH_OF(input), enc)) {
-				RETURN_FALSE;
-			}
-			break;
-		default:
-			php_error_docref(NULL, E_WARNING, "Input is something other than scalar or array");
+	if (Z_TYPE_P(input) == IS_ARRAY) {
+		if (!php_mb_check_encoding_recursive(HASH_OF(input), enc)) {
 			RETURN_FALSE;
+		}
+	} else {
+		convert_to_string(input);
+		if (!php_mb_check_encoding(Z_STRVAL_P(input), Z_STRLEN_P(input), enc ? ZSTR_VAL(enc): NULL)) {
+			RETURN_FALSE;
+		}
 	}
 	RETURN_TRUE;
 }
@@ -29,6 +29,7 @@

 #include "regint.h"

+#if 0
 static void
 conv_ext0be32(const UChar* s, const UChar* end, UChar* conv)
 {
@@ -158,6 +159,7 @@ conv_encoding(OnigEncoding from, OnigEncoding to, const UChar* s, const UChar* e

  return ONIGERR_NOT_SUPPORTED_ENCODING_COMBINATION;
 }
+#endif

 extern int
 onig_new_deluxe(regex_t** reg, const UChar* pattern, const UChar* pattern_end,
@@ -169,9 +171,7 @@ onig_new_deluxe(regex_t** reg, const UChar* pattern, const UChar* pattern_end,
  if (IS_NOT_NULL(einfo)) einfo->par = (UChar* )NULL;

  if (ci->pattern_enc != ci->target_enc) {
-    r = conv_encoding(ci->pattern_enc, ci->target_enc, pattern, pattern_end,
-                      &cpat, &cpat_end);
-    if (r) return r;
+    return ONIGERR_NOT_SUPPORTED_ENCODING_COMBINATION;
  }
  else {
    cpat     = (UChar* )pattern;
@@ -0,0 +1,20 @@
+--TEST--
+Bug #78609 (mb_check_encoding() no longer supports stringable objects)
+--SKIPIF--
+<?php
+if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
+?>
+--FILE--
+<?php
+class Foo
+{
+    public function __toString()
+    {
+        return 'string_representation';
+    }
+}
+
+var_dump(mb_check_encoding(new Foo, 'UTF-8'));
+?>
+--EXPECT--
+bool(true)
@@ -61,10 +61,12 @@ void mysqli_common_connect(INTERNAL_FUNCTION_PARAMETERS, zend_bool is_real_conne
 	MY_MYSQL			*mysql = NULL;
 	MYSQLI_RESOURCE		*mysqli_resource = NULL;
 	zval				*object = getThis();
-	char				*hostname = NULL, *username=NULL, *passwd=NULL, *dbname=NULL, *socket=NULL;
-	size_t					hostname_len = 0, username_len = 0, passwd_len = 0, dbname_len = 0, socket_len = 0;
-	zend_bool			persistent = FALSE;
-	zend_long				port = 0, flags = 0;
+	char				*hostname = NULL, *username=NULL, *passwd=NULL, *dbname=NULL, *socket=NULL,
+						*ssl_key = NULL, *ssl_cert = NULL, *ssl_ca = NULL, *ssl_capath = NULL,
+						*ssl_cipher = NULL;
+	size_t				hostname_len = 0, username_len = 0, passwd_len = 0, dbname_len = 0, socket_len = 0;
+	zend_bool			persistent = FALSE, ssl = FALSE;
+	zend_long			port = 0, flags = 0;
 	zend_string			*hash_key = NULL;
 	zend_bool			new_connection = FALSE;
 	zend_resource		*le;
@@ -189,6 +191,33 @@ void mysqli_common_connect(INTERNAL_FUNCTION_PARAMETERS, zend_bool is_real_conne

 								goto end;
 							} else {
+#ifdef MYSQLI_USE_MYSQLND
+								if (mysql->mysql->data->vio->data->ssl) {
+									/* copy over pre-existing ssl settings so we can reuse them when reconnecting */
+									ssl = TRUE;
+
+									ssl_key = my_estrdup(mysql->mysql->data->vio->data->options.ssl_key);
+									ssl_cert = my_estrdup(mysql->mysql->data->vio->data->options.ssl_cert);
+									ssl_ca = my_estrdup(mysql->mysql->data->vio->data->options.ssl_ca);
+									ssl_capath = my_estrdup(mysql->mysql->data->vio->data->options.ssl_capath);
+									ssl_cipher = my_estrdup(mysql->mysql->data->vio->data->options.ssl_cipher);
+								}
+#else
+								if (mysql->mysql->options.ssl_key
+										|| mysql->mysql->options.ssl_cert
+										|| mysql->mysql->options.ssl_ca
+										|| mysql->mysql->options.ssl_capath
+										|| mysql->mysql->options.ssl_cipher) {
+									/* copy over pre-existing ssl settings so we can reuse them when reconnecting */
+									ssl = TRUE;
+
+									ssl_key = my_estrdup(mysql->mysql->options.ssl_key);
+									ssl_cert = my_estrdup(mysql->mysql->options.ssl_cert);
+									ssl_ca = my_estrdup(mysql->mysql->options.ssl_ca);
+									ssl_capath = my_estrdup(mysql->mysql->options.ssl_capath);
+									ssl_cipher = my_estrdup(mysql->mysql->options.ssl_cipher);
+								}
+#endif
 								mysqli_close(mysql->mysql, MYSQLI_CLOSE_IMPLICIT);
 								mysql->mysql = NULL;
 							}
@@ -241,8 +270,28 @@ void mysqli_common_connect(INTERNAL_FUNCTION_PARAMETERS, zend_bool is_real_conne
 	/* BC for prior to bug fix #53425 */
 	flags |= CLIENT_MULTI_RESULTS;

+	if (ssl) {
+		/* if we're here, this means previous conn was ssl, repopulate settings */
+		mysql_ssl_set(mysql->mysql, ssl_key, ssl_cert, ssl_ca, ssl_capath, ssl_cipher);
+
+		my_efree(ssl_key);
+		my_efree(ssl_cert);
+		my_efree(ssl_ca);
+		my_efree(ssl_capath);
+		my_efree(ssl_cipher);
+	}
 	if (mysql_real_connect(mysql->mysql, hostname, username, passwd, dbname, port, socket, flags) == NULL)
 #else
+	if (ssl) {
+		/* if we're here, this means previous conn was ssl, repopulate settings */
+		mysql_ssl_set(mysql->mysql, ssl_key, ssl_cert, ssl_ca, ssl_capath, ssl_cipher);
+
+		my_efree(ssl_key);
+		my_efree(ssl_cert);
+		my_efree(ssl_ca);
+		my_efree(ssl_capath);
+		my_efree(ssl_cipher);
+	}
 	if (mysqlnd_connect(mysql->mysql, hostname, username, passwd, passwd_len, dbname, dbname_len,
 						port, socket, flags, MYSQLND_CLIENT_KNOWS_RSET_COPY_DATA) == NULL)
 #endif
@@ -7,10 +7,10 @@ mysqli autocommit/commit/rollback with innodb

 	require_once('connect.inc');
 	if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
-		die(sprintf("Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));
+		die(sprintf("skip Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));

 	if (!have_innodb($link))
-		die(sprintf("Needs InnoDB support, [%d] %s", $link->errno, $link->error));
+		die(sprintf("skip Needs InnoDB support, [%d] %s", $link->errno, $link->error));
 ?>
 --FILE--
 <?php
@@ -97,7 +97,7 @@ object(mysqli_stmt)#%d (%d) {
  ["sqlstate"]=>
  string(5) "00000"
  ["id"]=>
-  int(3)
+  int(%d)
 }
 bool(true)
 bool(false)
@@ -13,7 +13,7 @@ mysqli_autocommit()
 	}

 	if (!have_innodb($link))
-		die(sprintf("Needs InnoDB support, [%d] %s", $link->errno, $link->error));
+		die(sprintf("skip Needs InnoDB support, [%d] %s", $link->errno, $link->error));
 ?>
 --FILE--
 <?php
@@ -14,7 +14,7 @@ mysqli->autocommit()
 	}

 	if (!have_innodb($link))
-		die(sprintf("Needs InnoDB support, [%d] %s", $link->errno, $link->error));
+		die(sprintf("skip Needs InnoDB support, [%d] %s", $link->errno, $link->error));
 ?>
 --FILE--
 <?php
@@ -8,10 +8,10 @@ require_once('skipifconnectfailure.inc');

 require_once('connect.inc');
 if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
-	die(sprintf("Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));
+	die(sprintf("skip Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));

 if (!have_innodb($link))
-	die(sprintf("Needs InnoDB support, [%d] %s", $link->errno, $link->error));
+	die(sprintf("skip Needs InnoDB support, [%d] %s", $link->errno, $link->error));
 ?>
 --FILE--
 <?php
@@ -7,10 +7,10 @@ require_once('skipifemb.inc');
 require_once('skipifconnectfailure.inc');
 require_once('connect.inc');
 if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
-	die(sprintf("Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));
+	die(sprintf("skip Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));

 if (!have_innodb($link))
-	die(sprintf("Needs InnoDB support, [%d] %s", $link->errno, $link->error));
+	die(sprintf("skip Needs InnoDB support, [%d] %s", $link->errno, $link->error));
 ?>
 --FILE--
 <?php
@@ -8,10 +8,10 @@ require_once('skipifconnectfailure.inc');

 require_once('connect.inc');
 if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
-	die(sprintf("Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));
+	die(sprintf("skip Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));

 if (!have_innodb($link))
-	die(sprintf("Needs InnoDB support, [%d] %s", $link->errno, $link->error));
+	die(sprintf("skip Needs InnoDB support, [%d] %s", $link->errno, $link->error));
 ?>
 --FILE--
 <?php
@@ -8,10 +8,10 @@ require_once('skipifconnectfailure.inc');

 require_once('connect.inc');
 if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
-	die(sprintf("Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));
+	die(sprintf("skip Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));

 if (!have_innodb($link))
-	die(sprintf("Needs InnoDB support, [%d] %s", $link->errno, $link->error));
+	die(sprintf("skip Needs InnoDB support, [%d] %s", $link->errno, $link->error));
 ?>
 --FILE--
 <?php
@@ -0,0 +1,78 @@
+--TEST--
+mysqli check the session_connect_attrs table for connection attributes
+--SKIPIF--
+<?php
+require_once('skipif.inc');
+require_once('skipifconnectfailure.inc');
+
+if (!$IS_MYSQLND)
+	die("skip: test applies only to mysqlnd");
+
+if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
+	die("skip Cannot connect to the server");
+
+/* skip test if the server version does not have session_connect_attrs table yet*/
+if (!$res = mysqli_query($link, "select count(*) as count from information_schema.tables where table_schema='performance_schema' and table_name='session_connect_attrs';"))
+    die("skip select from information_schema.tables for session_connect_attrs  query failed");
+
+$tmp = mysqli_fetch_assoc($res);
+mysqli_free_result($res);
+if($tmp['count'] == "0") {
+    mysqli_close($link);
+    die("skip mysql does not support session_connect_attrs table yet");
+}
+
+/* skip test if performance_schema is OFF*/
+if (!$res = mysqli_query($link, "show variables like 'performance_schema';"))
+    die("skip show variables like 'performance_schema' failed");
+
+$tmp = mysqli_fetch_assoc($res);
+mysqli_free_result($res);
+if($tmp['Value'] == "OFF") {
+    mysqli_close($link);
+    die("skip performance_schema is OFF");
+}
+
+mysqli_close($link);
+?>
+--FILE--
+<?php
+	require_once("connect.inc");
+
+	$tmp    = NULL;
+	$link   = NULL;
+    $res    = NULL;
+	if (!$link = mysqli_connect($host, $user, $passwd, $db, $port, $socket))
+		printf("[001] Cannot connect to the server using host=%s, user=%s, passwd=***, dbname=%s, port=%s, socket=%s\n",$host, $user, $db, $port, $socket);
+
+    //in case $host is empty, do not test for _server_host field
+    if (isset($host) && trim($host) != '') {
+        if (!$res = mysqli_query($link, "select * from performance_schema.session_connect_attrs where ATTR_NAME='_server_host' and processlist_id = connection_id()")) {
+            printf("[002] [%d] %s\n", mysqli_errno($link), mysqli_error($link));
+        } else {
+            $tmp = mysqli_fetch_assoc($res);
+            if (!$tmp || !isset($tmp['ATTR_NAME'])) {
+                echo "[003] _server_host missing\n";
+            } elseif ($tmp['ATTR_VALUE'] !== $host) {
+                printf("[004] _server_host value mismatch\n") ;
+            }
+            mysqli_free_result($res);
+        }
+    }
+
+    if (!$res = mysqli_query($link, "select * from performance_schema.session_connect_attrs where ATTR_NAME='_client_name' and processlist_id = connection_id()")) {
+        printf("[005] [%d] %s\n", mysqli_errno($link), mysqli_error($link));
+    } else {
+        $tmp = mysqli_fetch_assoc($res);
+        if (!$tmp || !isset($tmp['ATTR_NAME'])) {
+            echo "[006] _client_name missing\n";
+        } elseif ($tmp['ATTR_VALUE'] !== "mysqlnd") {
+            printf("[007] _client_name value mismatch\n") ;
+        }
+        mysqli_free_result($res);
+    }
+
+    printf("done!");
+?>
+--EXPECTF--
+done!
@@ -14,10 +14,10 @@ if (!function_exists('posix_getpid'))

 require_once('connect.inc');
 if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
-	die(sprintf("Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));
+	die(sprintf("skip Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));

 if (!have_innodb($link))
-	die(sprintf("Needs InnoDB support, [%d] %s", $link->errno, $link->error));
+	die(sprintf("skip Needs InnoDB support, [%d] %s", $link->errno, $link->error));
 ?>
 --FILE--
 <?php
@@ -8,10 +8,10 @@ require_once('skipifconnectfailure.inc');

 require_once('connect.inc');
 if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
-	die(sprintf("Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));
+	die(sprintf("skip Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));

 if (!have_innodb($link))
-	die(sprintf("Needs InnoDB support, [%d] %s", $link->errno, $link->error));
+	die(sprintf("skip Needs InnoDB support, [%d] %s", $link->errno, $link->error));
 ?>
 --FILE--
 <?php
@@ -10,10 +10,10 @@ mysqli_rollback()

 	require_once('connect.inc');
 	if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
-		die(sprintf("Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));
+		die(sprintf("skip Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));

 	if (!have_innodb($link))
-		die(sprintf("Needs InnoDB support, [%d] %s", $link->errno, $link->error));
+		die(sprintf("skip Needs InnoDB support, [%d] %s", $link->errno, $link->error));
 ?>
 --FILE--
 <?php
@@ -8,10 +8,10 @@ require_once('skipifconnectfailure.inc');

 require_once('connect.inc');
 if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
-	die(sprintf("Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));
+	die(sprintf("skip Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));

 if (!have_innodb($link))
-	die(sprintf("Needs InnoDB support, [%d] %s", $link->errno, $link->error));
+	die(sprintf("skip Needs InnoDB support, [%d] %s", $link->errno, $link->error));
 ?>
 --FILE--
 <?php
@@ -97,7 +97,7 @@ memory_limit=256M
 	require_once("clean_table.inc");
 ?>
 --EXPECTF--
-int(1)
+int(%d)
 executing
 bool(true)
 done!
@@ -425,6 +425,9 @@ mysqlnd_auth_change_user(MYSQLND_CONN_DATA * const conn,
 		auth_packet->auth_data_len = auth_plugin_data_len;
 		auth_packet->auth_plugin_name = auth_protocol;

+        if (conn->server_capabilities & CLIENT_CONNECT_ATTRS) {
+			auth_packet->connect_attr = conn->options->connect_attr;
+        }

 		if (conn->m->get_server_version(conn) >= 50123) {
 			auth_packet->charset_no	= conn->charset->nr;
@@ -519,6 +519,10 @@ MYSQLND_METHOD(mysqlnd_conn_data, get_updated_connect_flags)(MYSQLND_CONN_DATA *
 	}
 #endif

+    if (conn->options->connect_attr && zend_hash_num_elements(conn->options->connect_attr)) {
+		mysql_flags |= CLIENT_CONNECT_ATTRS;
+	}
+
 	DBG_RETURN(mysql_flags);
 }
 /* }}} */
@@ -665,7 +669,7 @@ MYSQLND_METHOD(mysqlnd_conn_data, connect)(MYSQLND_CONN_DATA * conn,
 		password.s = "";
 		password.l = 0;
 	}
-	if (!database.s) {
+	if (!database.s || !database.s[0]) {
 		DBG_INF_FMT("no db given, using empty string");
 		database.s = "";
 		database.l = 0;
@@ -833,6 +837,9 @@ MYSQLND_METHOD(mysqlnd_conn, connect)(MYSQLND * conn_handle,

 	if (PASS == conn->m->local_tx_start(conn, this_func)) {
 		mysqlnd_options4(conn_handle, MYSQL_OPT_CONNECT_ATTR_ADD, "_client_name", "mysqlnd");
+        if (hostname.l > 0) {
+            mysqlnd_options4(conn_handle, MYSQL_OPT_CONNECT_ATTR_ADD, "_server_host", hostname.s);
+        }
 		ret = conn->m->connect(conn, hostname, username, password, database, port, socket_or_pipe, mysql_flags);

 		conn->m->local_tx_end(conn, this_func, FAIL);
@@ -552,7 +552,7 @@ size_t php_mysqlnd_auth_write(void * _packet)
 			p+= packet->auth_data_len;
 		}

-		if (packet->db) {
+		if (packet->db_len > 0) {
 			/* CLIENT_CONNECT_WITH_DB should have been set */
 			size_t real_db_len = MIN(MYSQLND_MAX_ALLOWED_DB_LEN, packet->db_len);
 			memcpy(p, packet->db, real_db_len);
@@ -2752,7 +2752,10 @@ PHP_FUNCTION(odbc_close)
 		return;
 	}

-	conn = (odbc_connection *)zend_fetch_resource2(Z_RES_P(pv_conn), "ODBC-Link", le_conn, le_pconn);
+	if (!(conn = (odbc_connection *)zend_fetch_resource2(Z_RES_P(pv_conn), "ODBC-Link", le_conn, le_pconn))) {
+		RETURN_FALSE;
+	}
+
 	if (Z_RES_P(pv_conn)->type == le_pconn) {
 		is_pconn = 1;
 	}
@@ -0,0 +1,14 @@
+--TEST--
+Bug #78473 (odbc_close() closes arbitrary resources)
+--SKIPIF--
+<?php
+if (!extension_loaded('odbc')) die('skip odbc extension not available');
+?>
+--FILE--
+<?php
+odbc_close(STDIN);
+var_dump(STDIN);
+?>
+--EXPECTF--
+Warning: odbc_close(): supplied resource is not a valid ODBC-Link resource in %s on line %d
+resource(%d) of type (stream)
@@ -302,7 +302,8 @@ static inline zend_bool can_elide_return_type_check(
 		return 0;
 	}

-	if (ZEND_TYPE_CODE(info->type) == IS_CALLABLE) {
+	/* These types are not represented exactly */
+	if (ZEND_TYPE_CODE(info->type) == IS_CALLABLE || ZEND_TYPE_CODE(info->type) == IS_ITERABLE) {
 		return 0;
 	}

@@ -277,7 +277,7 @@ static const func_info_t func_infos[] = {
 	F0("sleep",                        MAY_BE_FALSE | MAY_BE_LONG),
 	F0("usleep",                       MAY_BE_NULL | MAY_BE_FALSE),
 #if HAVE_NANOSLEEP
-	F0("time_nanosleep",               MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_TRUE),
+	F0("time_nanosleep",               MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_TRUE | MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_STRING | MAY_BE_ARRAY_OF_LONG),
 	F0("time_sleep_until",             MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_TRUE),
 #endif
 #if HAVE_STRPTIME
@@ -404,7 +404,7 @@ static const func_info_t func_infos[] = {
 	F1("system",                       MAY_BE_FALSE | MAY_BE_STRING),
 	F1("escapeshellcmd",               MAY_BE_NULL | MAY_BE_STRING),
 	F1("escapeshellarg",               MAY_BE_NULL | MAY_BE_STRING),
-	F1("passthru",                     MAY_BE_FALSE | MAY_BE_STRING),
+	F1("passthru",                     MAY_BE_NULL | MAY_BE_FALSE),
 	F1("shell_exec",                   MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_STRING),
 #ifdef PHP_CAN_SUPPORT_PROC_OPEN
 	F1("proc_open",                    MAY_BE_FALSE | MAY_BE_RESOURCE),
@@ -685,7 +685,7 @@ static const func_info_t func_infos[] = {
 	F1("stream_get_transports",        MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_LONG | MAY_BE_ARRAY_OF_STRING),
 	F1("stream_resolve_include_path",  MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_STRING),
 	F0("stream_is_local",              MAY_BE_FALSE | MAY_BE_TRUE),
-	F1("get_headers",                  MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_LONG | MAY_BE_ARRAY_OF_STRING | MAY_BE_ARRAY_OF_ARRAY),
+	F1("get_headers",                  MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_STRING | MAY_BE_ARRAY_OF_ARRAY),
 #if HAVE_SYS_TIME_H || defined(PHP_WIN32)
 	F0("stream_set_timeout",           MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_TRUE),
 	F0("socket_set_timeout",           MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_TRUE),
@@ -1192,7 +1192,7 @@ static const func_info_t func_infos[] = {
 	F1("hash_hmac_file",                        MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_STRING),
 	F1("hash_init",                             MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_OBJECT),
 	F0("hash_update",                           MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_TRUE),
-	F0("hash_update_stream",                    MAY_BE_NULL | MAY_BE_LONG),
+	F0("hash_update_stream",                    MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_LONG),
 	F0("hash_update_file",                      MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_TRUE),
 	F1("hash_final",                            MAY_BE_NULL | MAY_BE_STRING),
 	F1("hash_copy",                             MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_OBJECT),
@@ -1215,7 +1215,7 @@ uint32_t zend_get_func_info(const zend_call_info *call_info, const zend_ssa *ssa
 	if (call_info->callee_func->type == ZEND_INTERNAL_FUNCTION) {
 		func_info_t *info;

-		if ((info = zend_hash_find_ptr(&func_info, Z_STR_P(CRT_CONSTANT_EX(call_info->caller_op_array, call_info->caller_init_opline->op2, ssa->rt_constants)))) != NULL) {
+		if (!call_info->callee_func->common.scope && (info = zend_hash_find_ptr(&func_info, Z_STR_P(CRT_CONSTANT_EX(call_info->caller_op_array, call_info->caller_init_opline->op2, ssa->rt_constants)))) != NULL) {
 			if (UNEXPECTED(zend_optimizer_is_disabled_func(info->name, info->name_len))) {
 				ret = MAY_BE_NULL;
 			} else if (info->info_func) {
@@ -0,0 +1,14 @@
+--TEST--
+Internal static methods should not be confused with global functions
+--SKIPIF--
+<?php
+if (!extension_loaded('zend-test')) die('skip requires zend-test');
+?>
+--FILE--
+<?php
+
+var_dump(is_bool(_ZendTestClass::is_object()));
+
+?>
+--EXPECT--
+bool(false)
@@ -0,0 +1,17 @@
+--TEST--
+Don't optimize object -> iterable
+--FILE--
+<?php
+
+function test(object $arg): iterable {
+    return $arg;
+}
+test(new stdClass);
+
+?>
+--EXPECTF--
+Fatal error: Uncaught TypeError: Return value of test() must be iterable, object returned in %s:%d
+Stack trace:
+#0 %s(%d): test(Object(stdClass))
+#1 {main}
+  thrown in %s on line %d
@@ -735,11 +735,11 @@ zend_op_array* zend_accel_load_script(zend_persistent_script *persistent_script,
 #define ADLER32_DO8(buf, i)     ADLER32_DO4(buf, i); ADLER32_DO4(buf, i + 4);
 #define ADLER32_DO16(buf)       ADLER32_DO8(buf, 0); ADLER32_DO8(buf, 8);

-unsigned int zend_adler32(unsigned int checksum, signed char *buf, uint32_t len)
+unsigned int zend_adler32(unsigned int checksum, unsigned char *buf, uint32_t len)
 {
 	unsigned int s1 = checksum & 0xffff;
 	unsigned int s2 = (checksum >> 16) & 0xffff;
-	signed char *end;
+	unsigned char *end;

 	while (len >= ADLER32_NMAX) {
 		len -= ADLER32_NMAX;
@@ -777,15 +777,15 @@ unsigned int zend_adler32(unsigned int checksum, signed char *buf, uint32_t len)

 unsigned int zend_accel_script_checksum(zend_persistent_script *persistent_script)
 {
-	signed char *mem = (signed char*)persistent_script->mem;
+	unsigned char *mem = (unsigned char*)persistent_script->mem;
 	size_t size = persistent_script->size;
 	size_t persistent_script_check_block_size = ((char *)&(persistent_script->dynamic_members)) - (char *)persistent_script;
 	unsigned int checksum = ADLER32_INIT;

-	if (mem < (signed char*)persistent_script) {
-		checksum = zend_adler32(checksum, mem, (signed char*)persistent_script - mem);
-		size -= (signed char*)persistent_script - mem;
-		mem  += (signed char*)persistent_script - mem;
+	if (mem < (unsigned char*)persistent_script) {
+		checksum = zend_adler32(checksum, mem, (unsigned char*)persistent_script - mem);
+		size -= (unsigned char*)persistent_script - mem;
+		mem  += (unsigned char*)persistent_script - mem;
 	}

 	zend_adler32(checksum, mem, persistent_script_check_block_size);
@@ -37,7 +37,7 @@ zend_op_array* zend_accel_load_script(zend_persistent_script *persistent_script,

 #define ADLER32_INIT 1     /* initial Adler-32 value */

-unsigned int zend_adler32(unsigned int checksum, signed char *buf, uint32_t len);
+unsigned int zend_adler32(unsigned int checksum, unsigned char *buf, uint32_t len);

 unsigned int zend_accel_script_checksum(zend_persistent_script *persistent_script);

@@ -868,7 +868,7 @@ int zend_file_cache_script_store(zend_persistent_script *script, int in_shm)
 	zend_shared_alloc_destroy_xlat_table();

 	info.checksum = zend_adler32(ADLER32_INIT, buf, script->size);
-	info.checksum = zend_adler32(info.checksum, (signed char*)ZSTR_VAL((zend_string*)ZCG(mem)), info.str_size);
+	info.checksum = zend_adler32(info.checksum, (unsigned char*)ZSTR_VAL((zend_string*)ZCG(mem)), info.str_size);

 #ifdef HAVE_SYS_UIO_H
 	vec[0].iov_base = &info;
@@ -1371,6 +1371,7 @@ zend_persistent_script *zend_file_cache_script_load(zend_file_handle *file_handl
 	zend_accel_hash_entry *bucket;
 	void *mem, *checkpoint, *buf;
 	int cache_it = 1;
+	unsigned int actual_checksum;
 	int ok;

 	if (!full_path) {
@@ -1458,8 +1459,8 @@ zend_persistent_script *zend_file_cache_script_load(zend_file_handle *file_handl

 	/* verify checksum */
 	if (ZCG(accel_directives).file_cache_consistency_checks &&
-	    zend_adler32(ADLER32_INIT, mem, info.mem_size + info.str_size) != info.checksum) {
-		zend_accel_error(ACCEL_LOG_WARNING, "corrupted file '%s'\n", filename);
+	    (actual_checksum = zend_adler32(ADLER32_INIT, mem, info.mem_size + info.str_size)) != info.checksum) {
+		zend_accel_error(ACCEL_LOG_WARNING, "corrupted file '%s' excepted checksum: 0x%08x actual checksum: 0x%08x\n", filename, info.checksum, actual_checksum);
 		unlink(filename);
 		zend_arena_release(&CG(arena), checkpoint);
 		efree(filename);
@@ -1545,6 +1546,8 @@ use_process_mem:
 		zend_accel_hash_update(&ZCSG(hash), ZSTR_VAL(script->script.filename), ZSTR_LEN(script->script.filename), 0, script);

 		zend_shared_alloc_unlock();
+		zend_accel_error(ACCEL_LOG_INFO, "File cached script loaded into memory '%s'", ZSTR_VAL(script->script.filename));
+
 		zend_arena_release(&CG(arena), checkpoint);
 	}
 	efree(filename);
@@ -1873,6 +1873,7 @@ static int php_openssl_enable_crypto(php_stream *stream,
 		do {
 			struct timeval cur_time, elapsed_time;

+			ERR_clear_error();
 			if (sslsock->is_client) {
 				n = SSL_connect(sslsock->ssl_handle);
 			} else {
@@ -2045,6 +2046,7 @@ static size_t php_openssl_sockop_io(int read, php_stream *stream, char *buf, siz
 			}

 			/* Now, do the IO operation. Don't block if we can't complete... */
+			ERR_clear_error();
 			if (read) {
 				nr_bytes = SSL_read(sslsock->ssl_handle, buf, (int)count);

@@ -322,7 +322,7 @@ static zend_always_inline int calculate_unit_length(pcre_cache_entry *pce, char

 /* {{{ pcre_get_compiled_regex_cache
 */
-PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(zend_string *regex)
+PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache_ex(zend_string *regex, int locale_aware)
 {
 	pcre				*re = NULL;
 	pcre_extra			*extra;
@@ -344,7 +344,7 @@ PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(zend_string *regex)
 	zend_string 		*key;

 #if HAVE_SETLOCALE
-	if (BG(locale_string) &&
+	if (locale_aware && BG(locale_string) &&
 		(ZSTR_LEN(BG(locale_string)) != 1 && ZSTR_VAL(BG(locale_string))[0] != 'C')) {
 		key = zend_string_alloc(ZSTR_LEN(regex) + ZSTR_LEN(BG(locale_string)) + 1, 0);
 		memcpy(ZSTR_VAL(key), ZSTR_VAL(BG(locale_string)), ZSTR_LEN(BG(locale_string)) + 1);
@@ -636,6 +636,14 @@ PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(zend_string *regex)
 }
 /* }}} */

+/* {{{ pcre_get_compiled_regex_cache
+ */
+PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(zend_string *regex)
+{
+	return pcre_get_compiled_regex_cache_ex(regex, 1);
+}
+/* }}} */
+
 /* {{{ pcre_get_compiled_regex
 */
 PHPAPI pcre* pcre_get_compiled_regex(zend_string *regex, pcre_extra **extra, int *preg_options)
@@ -57,6 +57,7 @@ typedef struct {
 } pcre_cache_entry;

 PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(zend_string *regex);
+PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache_ex(zend_string *regex, int locale_aware);

 PHPAPI void  php_pcre_match_impl(  pcre_cache_entry *pce, char *subject, int subject_len, zval *return_value,
 	zval *subpats, int global, int use_flags, zend_long flags, zend_long start_offset);
@@ -0,0 +1,10 @@
+--TEST--
+Bug #75457 (heap-use-after-free in php7.0.25)
+--FILE--
+<?php
+$pattern = "/(((?(?C)0?=))(?!()0|.(?0)0)())/";
+var_dump(preg_match($pattern, "hello"));
+?>
+--EXPECTF--
+Warning: preg_match(): Compilation failed: assertion expected after (?( or (?(?C) at offset 4 in %sbug75457.php on line %d
+bool(false)
@@ -0,0 +1,58 @@
+--TEST--
+PDO_MYSQL: check the session_connect_attrs table for connection attributes
+--SKIPIF--
+<?php
+require_once(__DIR__ . DIRECTORY_SEPARATOR . 'skipif.inc');
+require_once(__DIR__ . DIRECTORY_SEPARATOR . 'mysql_pdo_test.inc');
+MySQLPDOTest::skip();
+if (!MySQLPDOTest::isPDOMySQLnd()) die('skip only for mysqlnd');
+
+$pdo = MySQLPDOTest::factory();
+
+$stmt = $pdo->query("select count(*) from information_schema.tables where table_schema='performance_schema' and table_name='session_connect_attrs'");
+if (!$stmt || !$stmt->fetchColumn()) {
+    die("skip mysql does not support session_connect_attrs table yet");
+}
+
+$stmt = $pdo->query("show variables like 'performance_schema'");
+if (!$stmt || $stmt->fetchColumn(1) !== 'ON') {
+    die("skip performance_schema is OFF");
+}
+
+?>
+--FILE--
+<?php
+
+require_once(__DIR__ . DIRECTORY_SEPARATOR . 'mysql_pdo_test.inc');
+$pdo = MySQLPDOTest::factory();
+
+if (preg_match('/host=([^;]+)/', PDO_MYSQL_TEST_DSN, $m)) {
+    $host = $m[1];
+}
+
+//in case $host is empty, do not test for _server_host field
+if (isset($host) && $host !== '') {
+    $stmt = $pdo->query("select * from performance_schema.session_connect_attrs where ATTR_NAME='_server_host' and processlist_id = connection_id()");
+
+    $row = $stmt->fetch(PDO::FETCH_ASSOC);
+
+    if (!$row || !isset($row['attr_name'])) {
+        echo "_server_host missing\n";
+    } elseif ($row['attr_value'] !== $host) {
+        printf("_server_host mismatch (expected '%s', got '%s')\n", $host, $row['attr_value']);
+    }
+}
+
+$stmt = $pdo->query("select * from performance_schema.session_connect_attrs where ATTR_NAME='_client_name' and processlist_id = connection_id()");
+
+$row = $stmt->fetch(PDO::FETCH_ASSOC);
+if (!$row || !isset($row['attr_name'])) {
+    echo "_client_name missing\n";
+} elseif ($row['attr_value'] !== 'mysqlnd') {
+    printf("_client_name mismatch (expected 'mysqlnd', got '%s')\n", $row['attr_value']);
+}
+
+printf("done!");
+?>
+--EXPECT--
+done!
@@ -1386,6 +1386,7 @@ int phar_create_or_parse_filename(char *fname, int fname_len, char *alias, int a
 	mydata = ecalloc(1, sizeof(phar_archive_data));
 	mydata->fname = expand_filepath(fname, NULL);
 	if (mydata->fname == NULL) {
+		efree(mydata);
 		return FAILURE;
 	}
 	fname_len = strlen(mydata->fname);
@@ -5,11 +5,11 @@ Bug #77396 Relative filename exceeding maximum path length causes null pointer d
 --FILE--
 <?php
 $path = '../' . str_repeat("x", PHP_MAXPATHLEN) . '.tar';
-$phar = new PharData($path);
+try {
+    $phar = new PharData($path);
+} catch (UnexpectedValueException $e) {
+    echo $e->getMessage(), "\n";
+}
 ?>
--EXPECTF--
-Fatal error: Uncaught UnexpectedValueException: Phar creation or opening failed in %s%ebug77396.php:%d
-Stack trace:
-#0 %s%ebug77396.php(%d): PharData->__construct(%s)
-#1 {main}
-  thrown in %s%ebug77396.php on line %d
+--EXPECT--
+Phar creation or opening failed
@@ -5140,7 +5140,7 @@ ZEND_METHOD(reflection_class, implementsInterface)

 	if (!(interface_ce->ce_flags & ZEND_ACC_INTERFACE)) {
 		zend_throw_exception_ex(reflection_exception_ptr, 0,
-				"Interface %s is a Class", ZSTR_VAL(interface_ce->name));
+				"%s is not an interface", ZSTR_VAL(interface_ce->name));
 		return;
 	}
 	RETURN_BOOL(instanceof_function(ce, interface_ce));
@@ -67,14 +67,14 @@ try {
 ?>
 --EXPECTF--
 Does A implement A? 
-   - Using object argument: Interface A is a Class
-   - Using string argument: Interface A is a Class
+   - Using object argument: A is not an interface
+   - Using string argument: A is not an interface
 Does A implement B? 
-   - Using object argument: Interface B is a Class
-   - Using string argument: Interface B is a Class
+   - Using object argument: B is not an interface
+   - Using string argument: B is not an interface
 Does A implement C? 
-   - Using object argument: Interface C is a Class
-   - Using string argument: Interface C is a Class
+   - Using object argument: C is not an interface
+   - Using string argument: C is not an interface
 Does A implement I1? 
   - Using object argument: bool(true)
   - Using string argument: bool(true)
@@ -82,14 +82,14 @@ Does A implement I2?
   - Using object argument: bool(false)
   - Using string argument: bool(false)
 Does B implement A? 
-   - Using object argument: Interface A is a Class
-   - Using string argument: Interface A is a Class
+   - Using object argument: A is not an interface
+   - Using string argument: A is not an interface
 Does B implement B? 
-   - Using object argument: Interface B is a Class
-   - Using string argument: Interface B is a Class
+   - Using object argument: B is not an interface
+   - Using string argument: B is not an interface
 Does B implement C? 
-   - Using object argument: Interface C is a Class
-   - Using string argument: Interface C is a Class
+   - Using object argument: C is not an interface
+   - Using string argument: C is not an interface
 Does B implement I1? 
   - Using object argument: bool(true)
   - Using string argument: bool(true)
@@ -97,14 +97,14 @@ Does B implement I2?
   - Using object argument: bool(false)
   - Using string argument: bool(false)
 Does C implement A? 
-   - Using object argument: Interface A is a Class
-   - Using string argument: Interface A is a Class
+   - Using object argument: A is not an interface
+   - Using string argument: A is not an interface
 Does C implement B? 
-   - Using object argument: Interface B is a Class
-   - Using string argument: Interface B is a Class
+   - Using object argument: B is not an interface
+   - Using string argument: B is not an interface
 Does C implement C? 
-   - Using object argument: Interface C is a Class
-   - Using string argument: Interface C is a Class
+   - Using object argument: C is not an interface
+   - Using string argument: C is not an interface
 Does C implement I1? 
   - Using object argument: bool(true)
   - Using string argument: bool(true)
@@ -112,14 +112,14 @@ Does C implement I2?
   - Using object argument: bool(true)
   - Using string argument: bool(true)
 Does I1 implement A? 
-   - Using object argument: Interface A is a Class
-   - Using string argument: Interface A is a Class
+   - Using object argument: A is not an interface
+   - Using string argument: A is not an interface
 Does I1 implement B? 
-   - Using object argument: Interface B is a Class
-   - Using string argument: Interface B is a Class
+   - Using object argument: B is not an interface
+   - Using string argument: B is not an interface
 Does I1 implement C? 
-   - Using object argument: Interface C is a Class
-   - Using string argument: Interface C is a Class
+   - Using object argument: C is not an interface
+   - Using string argument: C is not an interface
 Does I1 implement I1? 
   - Using object argument: bool(true)
   - Using string argument: bool(true)
@@ -127,14 +127,14 @@ Does I1 implement I2?
   - Using object argument: bool(false)
   - Using string argument: bool(false)
 Does I2 implement A? 
-   - Using object argument: Interface A is a Class
-   - Using string argument: Interface A is a Class
+   - Using object argument: A is not an interface
+   - Using string argument: A is not an interface
 Does I2 implement B? 
-   - Using object argument: Interface B is a Class
-   - Using string argument: Interface B is a Class
+   - Using object argument: B is not an interface
+   - Using string argument: B is not an interface
 Does I2 implement C? 
-   - Using object argument: Interface C is a Class
-   - Using string argument: Interface C is a Class
+   - Using object argument: C is not an interface
+   - Using string argument: C is not an interface
 Does I2 implement I1? 
   - Using object argument: bool(true)
   - Using string argument: bool(true)
@@ -0,0 +1,14 @@
+--TEST--
+Bug #78697: ReflectionClass::implementsInterface - inaccurate error message with traits
+--FILE--
+<?php
+trait T {}
+
+try {
+    (new ReflectionClass(new stdClass))->implementsInterface(T::class);
+} catch (ReflectionException $e) {
+    echo $e->getMessage();
+}
+?>
+--EXPECT--
+T is not an interface
Author	SHA1	Message	Date
Sara Golemon	d95fdd0394	Correct release date for 7.2.25	2019-11-20 09:46:00 -05:00
Sara Golemon	ca9842a0da	Update CREDITS for PHP 7.2.25RC1	2019-11-05 15:09:44 +00:00
Sara Golemon	cbbceb5e20	Update NEWS for PHP 7.2.25RC1	2019-11-05 15:09:44 +00:00
Nikita Popov	4f984a2fdb	Fixed bug #78775 Clear the OpenSSL error queue before performing SSL stream operations. As we don't control all code that could possibly be using OpenSSL, we can't rely on the error queue being empty.	2019-11-05 12:13:46 +01:00
Christoph M. Becker	e29922f054	Fix test cases for libxml2 2.9.10 Since the error reporting has been slightly changed, we have to adapt the two affected test cases.	2019-10-31 16:07:34 +01:00
Nikita Popov	5f6eaf355c	Add missing refcount increment	2019-10-30 09:22:20 +01:00
Nikita Popov	f9895b4bf5	Fixed bug #78689	2019-10-29 15:06:16 +01:00
Stanislav Malyshev	2bdb13a1f7	Merge branch 'PHP-7.1' into PHP-7.2 * PHP-7.1: Fix libmagic buffer overflow issue (CVE-2019-18218) bump version set versions for release	2019-10-28 20:47:30 -07:00
Christoph M. Becker	89c327f884	Fix #78751 : Serialising DatePeriod converts DateTimeImmutable When getting the properties of a DatePeriod instance we have to retain the proper classes, and when restoring a DatePeriod instance we have to cater to DateTimeImmutable instances as well.	2019-10-28 13:07:28 +01:00
Nikita Popov	16c4910876	Fix bug #78752 NULL out the execute_data before destroying it, otherwise GC may trigger while the execute_data is partially destroyed, resulting in double-frees. The handling of call stack unfreezing is a bit awkward because it's a ZEND_API function, so we can't change the signature.	2019-10-28 10:27:32 +01:00
Stanislav Malyshev	469820048d	Fix libmagic buffer overflow issue (CVE-2019-18218) Ported from https://github.com/file/file/commit/46a8443f76cec4b41ec736eca396984c74664f84	2019-10-27 16:30:38 -07:00
Nikita Popov	5249993814	Fixed bug #78747	2019-10-25 12:47:18 +02:00
Ryan Schmidt	8daf96cef3	Use ICU's CXXFLAGS when using pkg-config This mirrors how ICU's CXXFLAGS are already used when using icu-config.	2019-10-23 11:17:37 +02:00
Nikita Popov	fa89c41f37	Add "-pthread" to EXTRA_LDFLAGS_PROGRAM as well This is a backport of `c518932c03` from the PHP 7.4 branch.	2019-10-23 11:06:51 +02:00
Joe Watkins	52f049879a	bump version	2019-10-22 18:58:39 +02:00
Joe Watkins	326cd05dae	set versions for release	2019-10-22 18:56:55 +02:00
Remi Collet	2213bd36fd	add NEWS entry	2019-10-22 09:37:35 +02:00
Stanislav Malyshev	4b5cdda0c7	Merge branch 'PHP-7.1' into PHP-7.2 * PHP-7.1: Fix bug #78599 (env_path_info underflow can lead to RCE) (CVE-2019-11043) bump versions after release set versions for release	2019-10-21 13:17:09 -07:00
Fabien Villepinte	bea2ff88c9	Fix bug #78697 : inaccurate error message	2019-10-21 09:22:09 +02:00
Jakub Zelenka	ab061f95ca	Fix bug #78599 (env_path_info underflow can lead to RCE) (CVE-2019-11043)	2019-10-20 22:50:04 -07:00
Christoph M. Becker	45a7723267	Fix #78694 : Appending to a variant array causes segfault `write_dimension` object handlers have to be able to handle `NULL` `offset`s; for now we simply throw an exception instead of following the `NULL` pointer.	2019-10-19 11:47:00 +02:00
m.yakunin	d2cde0bfd3	Fix #70153 \DateInterval incorrectly unserialized Added a separate macro for reading 'days' property, so that bool(false) is correctly converted to the proper internal representation.	2019-10-18 15:31:14 +02:00
Mitch Hagstrand	e2a6bf482f	Fix checksum calculation for opcache	2019-10-14 16:46:42 +02:00
Christoph M. Becker	900bdcbd03	Fix #78665 : Multicasting may leak memory	2019-10-12 14:43:43 +02:00
Nikita Popov	46561dab6a	Fix leak in phar open	2019-10-10 16:14:21 +02:00
Nikita Popov	96c84b7bc1	Fix leak on static method call on non-existent class	2019-10-10 11:40:49 +02:00
Nikita Popov	daf1fc6e31	Avoid float to int cast UB in exif	2019-10-09 17:33:29 +02:00
Erik Lundin	3164186d53	Fix #78656 : Parse errors classified as highest log-level	2019-10-09 17:27:32 +02:00
Nikita Popov	d6ca174d5b	Remove redundant components < 0 check components is an unsigned number, it cannot be smaller than zero.	2019-10-09 14:57:24 +02:00
Sergei Turchanov	a8f60ac9dd	Add pcre_get_compiled_regex_cache_ex() with local_aware flag A new function `pcre_get_compiled_regex_cache_ex()` is introduced, which allows to compile regexp pattern using the "C" locale instead of a current locale. This will be needed to replace setlocale() usage in fileinfo, which is not thread-safe.	2019-10-08 16:11:55 +02:00
Fabien Villepinte	46894580b0	Add missing SKIPIFs in exif tests	2019-10-08 14:11:32 +02:00
Christoph M. Becker	195c2008e8	Fix #78642 : Wrong libiconv version displayed The high byte of `_libiconv_version` specifies the major version; the low byte the minor version.	2019-10-08 12:09:11 +02:00
Remi Collet	05d6878b3b	next is 7.2.25	2019-10-08 11:36:10 +02:00
Christoph M. Becker	fd3118ffb0	Fix #78641 : addGlob can modify given remove_path value `remove_path` points to the given string, so we must not modify it. Instead we use a duplicate, if we need the modification. We may want to switch to `zend_string`s in master.	2019-10-08 09:45:05 +02:00
Nikita Popov	19e6abebc7	Check for object_init_ex() failure in user filter factory	2019-10-07 17:52:29 +02:00
Nikita Popov	7d19668f60	Set session.gc_probability=0 in bug78624.phpt We only want to test manually triggered session GC. Avoid spurious output due to automatic GC.	2019-10-07 16:43:19 +02:00
Christoph M. Becker	114c03b9a6	Fix #78623 : Regression caused by "SP call yields additional empty result set" This reverts commit `41a4379cb4`.	2019-10-07 09:15:51 +02:00
Christoph M. Becker	545412a6cd	Split intl tests for ICU 65	2019-10-04 13:53:22 +02:00
Christoph M. Becker	abaf9a76dc	Fix #78620 : Out of memory error The integer addition in `ZEND_MM_ALIGNED_SIZE_EX` can overflow, what we have to catch early.	2019-10-04 09:08:01 +02:00
Brent Shaffer	a6d219630c	fix #78624 : session_gc return value for user defined session handlers	2019-10-04 06:12:02 +02:00
Fábio Souto	9a2b42a5c1	Fix bug #76809 (SSL settings aren't respected when persistent connection is reused)	2019-10-03 06:56:21 +02:00
Konstantin Kopachev	05560b67bc	Fix #76859 stream_get_line skips data if used with data-generating filter stream_get-line repeatedly calls php_stream_fill_read_buffer until enough data is accumulated in buffer. However, when stream contains filters attached to it, then each call to fill buffer essentially resets buffer read/write pointers and new data is written over old. This causes stream_get_line to skip parts of data from stream This patch fixes such behavior, so fill buffer call will append.	2019-10-03 06:50:43 +02:00
Christoph M. Becker	f2fb37a772	Revert "Fix #78620 : Out of memory error" This reverts commit `8ce04df7e0`. Cf. <https://github.com/php/php-src/pull/4766#discussion_r330658679>.	2019-10-02 19:01:35 +02:00
Christoph M. Becker	8ce04df7e0	Fix #78620 : Out of memory error If the integer addition in `ZEND_MM_ALIGNED_SIZE_EX` overflows, the macro evaluates to `0`, what we should catch early.	2019-10-02 18:18:52 +02:00
Nikita Popov	a5d3620d93	Fix segfault with __COMPILER_HALT_OFFSET__ and trailing {} Fixes OSS-Fuzz #17895.	2019-10-02 12:07:15 +02:00
Dmitry Stogov	3124129ca8	Fixed test that "fails" from time to time	2019-10-02 00:54:59 +03:00
Dmitry Stogov	2fcb5eadbb	Fixed test that "fails" from time to time	2019-10-02 00:48:42 +03:00
Fabien Villepinte	209e37db7d	Add missing skip keyword in tests	2019-10-01 11:13:36 +02:00
Nikita Popov	6fcde56b03	Fixed bug #78612	2019-09-30 15:06:07 +02:00
Christoph M. Becker	45db6fa567	Fix #78609 : mb_check_encoding() no longer supports stringable objects We apply type juggling for other types than array.	2019-09-30 12:42:04 +02:00
Christoph M. Becker	f6bfbe9553	Fix build for libzip < 0.11.2 We must not define method entries, if the actual method definitions or the arginfo structures are not defined.	2019-09-29 13:33:18 +02:00
Fabien Villepinte	37d27e666a	Fix SKIPIF in ext/mysqli	2019-09-27 16:03:20 +02:00
Christoph M. Becker	115f6effec	Fix skipif.inc	2019-09-27 12:50:04 +02:00
Nikita Popov	ab938d7bbc	Fix memory leak with ** on array operands	2019-09-26 13:45:45 +02:00
Nikita Popov	8a9df88597	Fix null-pointer deref in if stmt printing Fixes OSS-Fuzz #17721.	2019-09-26 10:24:49 +02:00
Jinesh Patel	d2331cc3f2	Fix hash key length in umsg_parse_format() Fix array length passed to zend_hash_str_find_ptr() casting from UChar array to char array requires mul by sizeof(UChar).	2019-09-25 10:30:33 +02:00
Christoph M. Becker	ed099ab186	Fix NEWS entry Cf. <https://bugs.php.net/78590>.	2019-09-23 22:59:55 +02:00
Nikita Popov	3ddb63dce1	Fix skipif condition	2019-09-23 17:17:52 +02:00
Nikita Popov	bc4c4c658c	Skip test on 32-bit	2019-09-23 16:42:24 +02:00
Nikita Popov	8509970e6a	Fix signed integer overflow in SplObjectStorage unserialization If count is ZEND_LONG_MIN the count-- loop underflows. This is ultimately harmless, but results in a ubsan warning. Fix this by adding a sanity check that the count isn't negative, because that doesn't make sense...	2019-09-23 13:18:27 +02:00
Christoph M. Becker	697945aa89	Fix test to be skipped if dom is not available	2019-09-22 18:42:02 +02:00
Nikita Popov	f989a4cd44	Fix leak of temporary buffer during exif tag reading	2019-09-22 12:10:17 +02:00
Nikita Popov	0701835c01	Fix multiple leaks in exif_read_data() This fixes two leaks related to duplicate tags, as well as a leak of zero-length FMT_(S)BYTE with non-null value. This can show up for MAKERNOTE values where the original length is non-zero, but the first character is a null byte.	2019-09-21 20:40:03 +02:00
Jinesh Patel	0d6c2448a7	Fix length of key passed to zend_hash_str_find_ptr	2019-09-21 18:11:21 +02:00
Christoph M. Becker	398b308316	Fix #78579 : mb_decode_numericentity: args number inconsistency mb_decode_numericentity() accepts a fourth optional parameter, which is unused, however. Since this parameter doesn't do any harm, and to avoid the small BC break, we're keeping this parameter for PHP 7, but adjust the arginfo. For PHP 8, we will remove this parameter.	2019-09-21 16:15:23 +02:00
Nikita Popov	0fa13028cb	Fix out-of-bounds read in exif tag reading This issue was recently introduced in `c739023a50`, when the restriction that components>0 has been relaxed. We now need to make sure that any tags that expect at least one component check that this is the case.	2019-09-19 21:11:57 +02:00
Nikita Popov	003c13d7bc	Fix iterable return type optimization	2019-09-19 17:21:00 +02:00
Nikita Popov	3e139a4653	Fix exif leak on duplicate copyright tags	2019-09-19 14:19:31 +02:00
CJDennis	e3255a4f49	Fix typo `sizeof("data")-1` and `sizeof("date")-1` are both 4, so no change in behaviour	2019-09-19 11:36:00 +02:00
Nikita Popov	175f4f24ae	Increase timeout in test	2019-09-17 17:33:46 +02:00
fancyweb	e691a98c1f	Fix #76342 : file_get_contents waits twice specified timeout	2019-09-17 15:42:29 +02:00
Drakano	252ebce0d7	Add tilde to allowed status/ping path Because of user specific webdirs it should be possible to set a status/ping path like "/~username/status". Closes GH-4698.	2019-09-17 12:19:21 +02:00
Tyson Andre	29bced9521	Fix opcache return type for get_headers in zend_func_info https://www.php.net/manual/en/function.get-headers.php#refsect1-function.get-headers-examples shows that it will return string keys when the second argument is non-zero. I've verified that this is the case. This bug was there since the initial commit in `c88ffa9a56`. Closes GH-4702.	2019-09-17 12:08:29 +02:00
Nikita Popov	2f6efd835d	Fixed bug #78545 By using an explicit (double) cast.	2019-09-16 15:00:20 +02:00
Nikita Popov	8873df8e86	Fix leak in SplObjectStorage unserialization The result of php_var_unserialize always needs to be destroyed, even if the call failed.	2019-09-16 13:02:32 +02:00
Christoph M. Becker	81cefab7b0	Stick with zend_long for ABI compatibility Cf. <https://github.com/php/php-src/pull/4700#issuecomment-531515689>.	2019-09-15 15:11:25 +02:00
bugreportuser	fdcca93056	Fix #78535 : auto_detect_line_endings value not parsed as bool	2019-09-14 18:46:09 +02:00
Kalle Sommer Nielsen	716518373f	NEWS	2019-09-12 06:50:53 +03:00
Kalle Sommer Nielsen	2823e938d4	Fixed bug #78442 ('Illegal component' on exif_read_data since PHP7)	2019-09-12 06:21:39 +03:00
Sara Golemon	a270eb1911	Bump for 7.2.24	2019-09-10 13:04:01 -04:00
Remi Collet	c43fc204b1	Raise minimal GCC version, Test with 4.8 is OK With 4.4: error: #pragma GCC diagnostic not allowed inside functions	2019-09-10 16:28:35 +02:00
Christoph M. Becker	bca66002f1	Drop regression test The state returned by `sodium_crypto_generichash_init()` has to be regarded as opaque byte string; neither its size nor its exact structure are fixed, and actually vary for diffent libsodium versions. Therefore we drop the test altogether.	2019-09-10 10:07:39 +02:00
CHU Zhaowei	1ac6b0251b	Fix bug #72884 isCloneable() on SplFileObject should return false	2019-09-09 17:27:17 +02:00
Christoph M. Becker	8ead77936e	Fix #78510 : Partially uninitialized buffer returned by sodium_crypto_generichash_init() Backport jedisct1/libsodium.php@28d13bf437.	2019-09-09 15:30:28 +02:00
Christoph M. Becker	41a4379cb4	Fix #41997 : SP call yields additional empty result set When stored procedures are called, the "final result set is a status result that includes no result set". Calling `::nextRowset()` on the actual last result set should return FALSE, since there is actually no further result set to be processed.	2019-09-03 13:29:30 +02:00
Tyson Andre	9c3b7ccda5	Fix opcache return type for hash_update_stream It can return false if the resource type is wrong. ``` php > var_export(hash_update_stream(hash_init('md5'), imagecreate(1,1))); Warning: hash_update_stream(): supplied resource is not a valid stream resource in php shell code on line 1 false ``` The return types were initially added in `c88ffa9a56`	2019-09-03 09:23:39 +02:00
Christoph M. Becker	cd63908ab8	Fix #76577 : outdated documentation concerning track_errors	2019-09-02 15:05:01 +02:00
Nikita Popov	5a0980f1d9	Fix pkg-config version constraint for ICU On PHP 7.2 our minimum ICU version is 4.0, not 40.	2019-09-02 09:36:20 +02:00
Sergei Turchanov	8f564e5308	Fixed bug #78469 fcgi_accept_request function is supposed to call a FastCGI implementation's on_accept hook when entering an "accepting" stage (that is right before calling "accept"). This hook implementation (fpm_request_accepting) updates a worker state to an "accepting" state which is effectively an "Idle" state, and updates counters on the scoreboard of the corresponding pool (idle++, active--). But this is not done when listening for client connections on a named pipe on Windows platform. In that case a combination of ConnectNamedPipe/WaitForSingleObject is used (to be able to catch in_shutdown as far as I understand), but it is nonetheless functionally equivalent to "accept" call. Also by not calling on_hook neither a worker's state is updated to "accepting" state nor scoreboard counters are updated.	2019-08-30 16:06:50 +02:00
Nikita Popov	ed749edd47	Fix use-after-free of immediately invoked closure with extra args	2019-08-29 12:32:03 +02:00
Christoph M. Becker	b557265816	Fix #78473 : odbc_close() closes arbitrary resources We have to bail out, if an invalid resource is given. For consistency with the other `zend_fetch_resource(2)` calls, we return `FALSE`.	2019-08-28 17:55:15 +02:00
Joe Watkins	fadd7f0f1e	bump versions after release	2019-08-28 09:08:23 +02:00
Joe Watkins	481520d381	set versions for release	2019-08-28 09:06:38 +02:00
Christoph M. Becker	88ab374627	Update SDK version for AppVeyor	2019-08-27 13:34:35 +02:00
Nikita Popov	589542f50c	Remove properties HT from nested GC data The properties HT may be a GC root itself, so we need to remove it. I'm not sure this issue actually applies to PHP 7.2, but committing it there to be safe. As seen from the test case, the handling here is rather buggy on 7.2.	2019-08-26 17:49:37 +02:00
Tyson Andre	1e82a2d659	Also fix signature for passthru Backported from `a1a8d14485` https://www.php.net/manual/en/function.passthru.php#refsect1-function.passthru-returnvalues `passthru()` is false with invalid args `passthru('command')` is null.	2019-08-26 11:13:26 +02:00
Tyson Andre	f5bccc0eb5	Fix opcache optimizer info for time_nanosleep This can also return an array. See https://www.php.net/manual/en/function.time-nanosleep.php#refsect1-function.time-nanosleep-returnvalues > If the delay was interrupted by a signal, an associative array will be returned with the components: > > - seconds - number of seconds remaining in the delay > - nanoseconds - number of nanoseconds remaining in the delay Sending a SIGUSR1 to the below program would trigger this behavior. ``` pcntl_signal(\SIGUSR1, function ($signo, $signinfo) { echo "Handling a signal $signo\n"; }); echo "Sleeping for 100 seconds\n"; var_export(time_nanosleep(100, 0)); ``` The incomplete signature existed since `c88ffa9a5`. No phpt tests existed for time_nanosleep returning an array	2019-08-26 11:13:26 +02:00
Nikita Popov	16d35eb643	Fix overflow in memory limit checks Due to overflows in the memory limit checks, we were missing cases where the allocation size was close to the address space size, and caused an OOM condition rather than a memory limit error.	2019-08-26 10:25:30 +02:00
Stanislav Malyshev	4b4a656d9e	Merge branch 'PHP-7.1' into PHP-7.2 * PHP-7.1: Fix #75457: heap-use-after-free in php7.0.25	2019-08-25 19:20:59 -07:00
Christoph M. Becker	7bf1f9d561	Fix #75457 : heap-use-after-free in php7.0.25 Backport <https://vcs.pcre.org/pcre?view=revision&revision=1638>.	2019-08-25 19:19:50 -07:00
Stanislav Malyshev	087cb7bab2	Merge branch 'PHP-7.1' into PHP-7.2 * PHP-7.1: Fix CVE-2019-13224: don't allow different encodings for onig_new_deluxe() set version for release	2019-08-24 23:15:36 -07:00
Stanislav Malyshev	1258303e66	Fix CVE-2019-13224: don't allow different encodings for onig_new_deluxe() Backport from https://github.com/kkos/oniguruma/commit/0f7f61ed1b7b697e283e37bd2d731d0bd57adb55	2019-08-24 23:11:45 -07:00
Christoph M. Becker	ff7029b65b	Suppress deprecation warning on IDNA2003 ICU methods for clang	2019-08-23 12:18:58 +02:00
Qianqian Bu	cdf16c010a	fix the problem for connect_attr, set db condition, and add a new attribute _server_host	2019-08-20 13:31:58 +02:00
Christoph M. Becker	81f52158b4	Fix #78220 : Can't access OneDrive folder As of Windows 1903, when the OneDrive on-demand feature is enabled, the OneDrive folder is reported as reparse point by `FindFirstFile()`, but trying to get information about the reparse point using `DeviceIoControl()` fails with `ERROR_NOT_A_REPARSE_POINT`. We work around this problem by falling back to `GetFileInformationByHandle()` if that happens, but only if the reparse point is reported as cloud reparse point, and only if PHP is running on Windows 1903 or later. The patch has been developed in collaboration with ab@php.net. We should keep an eye on the somewhat quirky OneDrive behavior, since it might change again in a future Windows release.	2019-08-19 19:55:35 +02:00
Sara Golemon	725f439778	Suppress deprecation warning on IDNA2003 ICU methods	2019-08-16 12:40:20 -04:00
Nikita Popov	fcabe7e5e4	Fixed bug #78412 $this should only be included in the generator GC buffer, if it will be released on destruction.	2019-08-14 17:50:58 +02:00
Sara Golemon	4b64d47c99	Bump for 7.2.23	2019-08-13 19:32:12 -04:00
Joe Watkins	1c01a1579e	set version for release	2019-07-31 08:21:39 +02:00