Prepare 7.3.22 tag

Prepare for 7.3.22RC1
Fix HTTP response status code
2026-11-12 11:40:50 +00:00 · 2020-09-01 10:33:15 +02:00 · 2020-08-18 09:19:25 +02:00 · 2020-08-18 08:33:45 +02:00 · 2020-08-14 15:51:31 +02:00 · 2020-08-11 17:12:48 +02:00
203 changed files with 3546 additions and 1706 deletions
@@ -1,6 +1,231 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? ????, PHP 7.3.17
+03 Sep 2020, PHP 7.3.22
+
+- Core:
+  . Fixed bug #79884 (PHP_CONFIG_FILE_PATH is meaningless). (cmb)
+  . Fixed bug #77932 (File extensions are case-sensitive). (cmb)
+  . Fixed bug #79806 (realpath() erroneously resolves link to link). (cmb)
+  . Fixed bug #79895 (PHP_CHECK_GCC_ARG does not allow flags with equal sign).
+    (Santiago M. Mola)
+  . Fixed bug #79919 (Stack use-after-scope in define()). (cmb)
+  . Fixed bug #79934 (CRLF-only line in heredoc causes parsing error).
+    (Pieter van den Ham)
+
+- COM:
+  . Fixed bug #48585 (com_load_typelib holds reference, fails on second call).
+    (cmb)
+
+- Exif:
+  . Fixed bug #75785 (Many errors from exif_read_data).
+    (Níckolas Daniel da Silva)
+
+- Gettext:
+  . Fixed bug #70574 (Tests fail due to relying on Linux fallback behavior for
+    gettext()). (Florian Engelhardt)
+
+- LDAP:
+  . Fixed memory leaks. (ptomulik)
+
+- OPcache:
+  . Fixed bug #73060 (php failed with error after temp folder cleaned up).
+    (cmb)
+
+- PDO:
+  . Fixed bug #64705 (errorInfo property of PDOException is null when
+    PDO::__construct() fails). (Ahmed Abdou)
+
+- Standard:
+  . Fixed bug #79930 (array_merge_recursive() crashes when called with array
+    with single reference). (Nikita)
+  . Fixed bug #79944 (getmxrr always returns true on Alpine linux). (Nikita)
+  . Fixed bug #79951 (Memory leak in str_replace of empty string). (Nikita)
+
+- XML:
+  . Fixed bug #79922 (Crash after multiple calls to xml_parser_free()). (cmb)
+
+06 Aug 2020, PHP 7.3.21
+
+- Apache:
+  . Fixed bug #79030 (Upgrade apache2handler's php_apache_sapi_get_request_time
+    to return usec). (Herbert256)
+
+- Core:
+  . Fixed bug #79877 (getimagesize function silently truncates after a null 
+    byte) (cmb)
+  . Fixed bug #79778 (Assertion failure if dumping closure with unresolved
+    static variable). (Nikita)
+  . Fixed bug #79792 (HT iterators not removed if empty array is destroyed).
+    (Nikita)
+
+- COM:
+  . Fixed bug #63208 (BSTR to PHP string conversion not binary safe). (cmb)
+  . Fixed bug #63527 (DCOM does not work with Username, Password parameter).
+    (cmb)
+
+- Curl:
+  . Fixed bug #79741 (curl_setopt CURLOPT_POSTFIELDS asserts on object with
+    declared properties). (Nikita)
+
+- Fileinfo:
+  . Fixed bug #79756 (finfo_file crash (FILEINFO_MIME)). (cmb)
+
+- FTP:
+  . Fixed bug #55857 (ftp_size on large files). (cmb)
+
+- Mbstring:
+  . Fixed bug #79787 (mb_strimwidth does not trim string). (XXiang)
+
+- Phar:
+  . Fixed bug #79797 (Use of freed hash key in the phar_parse_zipfile
+    function). (CVE-2020-7068) (cmb)
+
+- Standard:
+  . Fixed bug #70362 (Can't copy() large 'data://' with open_basedir). (cmb)
+  . Fixed bug #79817 (str_replace() does not handle INDIRECT elements). (Nikita)
+  . Fixed bug #78008 (dns_check_record() always return true on Alpine).
+    (Andy Postnikov)
+
+09 Jul 2020, PHP 7.3.20
+
+- Core:
+  . Fixed bug #79650 (php-win.exe 100% cpu lockup). (cmb)
+  . Fixed bug #79668 (get_defined_functions(true) may miss functions). (cmb,
+    Nikita)
+  . Fixed possibly unsupported timercmp() usage. (cmb)
+
+- Exif:
+  . Fixed bug #79687 (Sony picture - PHP Warning - Make, Model, MakerNotes). 
+    (cmb)
+
+- Filter:
+  . Fixed bug #73527 (Invalid memory access in php_filter_strip). (cmb)
+
+- GD:
+  . Fixed bug #79676 (imagescale adds black border with IMG_BICUBIC). (cmb)
+
+- OpenSSL:
+  . Fixed bug #62890 (default_socket_timeout=-1 causes connection to timeout).
+    (cmb)
+
+- PDO SQLite:
+  . Fixed bug #79664 (PDOStatement::getColumnMeta fails on empty result set).
+    (cmb)
+
+- SPL:
+  . Fixed bug #79710 (Reproducible segfault in error_handler during GC
+    involved an SplFileObject). (Nikita)
+
+- Standard:
+  . Fixed bug #74267 (segfault with streams and invalid data). (cmb)
+  . Fixed bug #79579 (ZTS build of PHP 7.3.17 doesn't handle ERANGE for
+    posix_getgrgid and others). (Böszörményi Zoltán)
+
+11 Jun 2020, PHP 7.3.19
+
+- Core:
+  . Fixed bug #79566 (Private SHM is not private on Windows). (cmb)
+  . Fixed bug #79489 (.user.ini does not inherit). (cmb)
+
+- GD:
+  . Fixed bug #79615 (Wrong GIF header written in GD GIFEncode). (sageptr, cmb)
+
+- MySQLnd:
+  . Fixed bug #79596 (MySQL FLOAT truncates to int some locales). (cmb)
+
+- Opcache:
+  . Fixed bug #79535 (PHP crashes with specific opcache.optimization_level).
+    (Nikita)
+  . Fixed bug #79588 (Boolean opcache settings ignore on/off values). (cmb)
+
+- Standard:
+  . Fixed bug #79561 (dns_get_record() fails with DNS_ALL). (cmb)
+
+14 May 2020, PHP 7.3.18
+
+- Core:
+  . Fixed bug #78875 (Long filenames cause OOM and temp files are not cleaned). 
+    (CVE-2019-11048) (cmb)
+  . Fixed bug #78876 (Long variables in multipart/form-data cause OOM and temp 
+    files are not cleaned). (CVE-2019-11048) (cmb)
+  . Fixed bug #79434 (PHP 7.3 and PHP-7.4 crash with NULL-pointer dereference
+    on !CS constant). (Nikita)
+  . Fixed bug #79477 (casting object into array creates references). (Nikita)
+  . Fixed bug #79470 (PHP incompatible with 3rd party file system on demand).
+    (cmb)
+  . Fixed bug #78784 (Unable to interact with files inside a VFS for Git
+    repository). (cmb)
+
+- DOM:
+  . Fixed bug #78221 (DOMNode::normalize() doesn't remove empty text nodes).
+    (cmb)
+
+- FCGI:
+  . Fixed bug #79491 (Search for .user.ini extends up to root dir). (cmb)
+
+- MBString:
+  . Fixed bug #79441 (Segfault in mb_chr() if internal encoding is unsupported).
+    (Girgias)
+
+- OpenSSL:
+  . Fixed bug #79497 (stream_socket_client() throws an unknown error sometimes
+    with <1s timeout). (Joe Cai)
+
+- Phar:
+  . Fix bug #79503 (Memory leak on duplicate metadata). (cmb)
+
+- SimpleXML:
+  . Fixed bug #79528 (Different object of the same xml between 7.4.5 and
+    7.4.4). (cmb)
+
+- Standard:
+  . Fixed bug #79468 (SIGSEGV when closing stream handle with a stream filter
+    appended). (dinosaur)
+
+16 Apr 2020, PHP 7.3.17
+
+- Core:
+  . Fixed bug #79364 (When copy empty array, next key is unspecified). (cmb)
+  . Fixed bug #78210 (Invalid pointer address). (cmb, Nikita)
+
+- CURL:
+  . Fixed bug #79199 (curl_copy_handle() memory leak). (cmb)
+
+- Date:
+  . Fixed bug #79396 (DateTime hour incorrect during DST jump forward). (Nate
+    Brunette)
+
+- Iconv:
+  . Fixed bug #79200 (Some iconv functions cut Windows-1258). (cmb)
+
+- OPcache:
+  . Fixed bug #79412 (Opcache chokes and uses 100% CPU on specific script).
+    (Dmitry)
+
+- Session:
+  . Fixed bug #79413 (session_create_id() fails for active sessions). (cmb)
+
+- Shmop:
+  . Fixed bug #79427 (Integer Overflow in shmop_open()). (cmb)
+
+- SimpleXML:
+  . Fixed bug #61597 (SXE properties may lack attributes and content). (cmb)
+
+- Spl:
+  . Fixed bug #75673 (SplStack::unserialize() behavior). (cmb)
+  . Fixed bug #79393 (Null coalescing operator failing with SplFixedArray).
+    (cmb)
+
+- Standard:
+  . Fixed bug #79330 (shell_exec() silently truncates after a null byte). (stas)
+  . Fixed bug #79465 (OOB Read in urldecode()). (CVE-2020-7067) (stas)
+  . Fixed bug #79410 (system() swallows last chunk if it is exactly 4095 bytes
+    without newline). (Christian Schneider)
+
+- Zip:
+  . Fixed Bug #79296 (ZipArchive::open fails on empty file). (Remi)
+  . Fixed bug #79424 (php_zip_glob uses gl_pathc after call to globfree).
+    (Max Rees)

 19 Mar 2020, PHP 7.3.16

@@ -28,6 +253,14 @@ PHP                                                                        NEWS
  . Fixed bug #79311 (enchant_dict_suggest() fails on big endian architecture).
    (cmb)

+- EXIF:
+  . Fixed bug #79282 (Use-of-uninitialized-value in exif). (CVE-2020-7064)
+    (Nikita)
+
+- MBstring:
+  . Fixed bug #79371 (mb_strtolower (UTF-32LE): stack-buffer-overflow at 
+    php_unicode_tolower_full). (CVE-2020-7065) (cmb)
+
 - MySQLi:
  . Fixed bug #64032 (mysqli reports different client_version). (cmb)

@@ -46,6 +279,8 @@ PHP                                                                        NEWS
  . Fixed bug #79294 (::columnType() may fail after SQLite3Stmt::reset()). (cmb)

 - Standard:
+  . Fixed bug #79329 (get_headers() silently truncates after a null byte). 
+    (CVE-2020-7066) (cmb)
  . Fixed bug #79254 (getenv() w/o arguments not showing changes). (cmb)
  . Fixed bug #79265 (Improper injection of Host header when using fopen for
    http requests). (Miguel Xavier Penha Neto)
@@ -616,14 +616,16 @@ TSRM_API int shmget(key_t key, size_t size, int flags)
 {/*{{{*/
 	shm_pair *shm;
 	char shm_segment[26], shm_info[29];
-	HANDLE shm_handle, info_handle;
+	HANDLE shm_handle = NULL, info_handle = NULL;
 	BOOL created = FALSE;

-	snprintf(shm_segment, sizeof(shm_segment), "TSRM_SHM_SEGMENT:%d", key);
-	snprintf(shm_info, sizeof(shm_info), "TSRM_SHM_DESCRIPTOR:%d", key);
+	if (key != IPC_PRIVATE) {
+		snprintf(shm_segment, sizeof(shm_segment), "TSRM_SHM_SEGMENT:%d", key);
+		snprintf(shm_info, sizeof(shm_info), "TSRM_SHM_DESCRIPTOR:%d", key);

-	shm_handle  = OpenFileMapping(FILE_MAP_ALL_ACCESS, FALSE, shm_segment);
-	info_handle = OpenFileMapping(FILE_MAP_ALL_ACCESS, FALSE, shm_info);
+		shm_handle  = OpenFileMapping(FILE_MAP_ALL_ACCESS, FALSE, shm_segment);
+		info_handle = OpenFileMapping(FILE_MAP_ALL_ACCESS, FALSE, shm_info);
+	}

 	if (!shm_handle && !info_handle) {
 		if (flags & IPC_CREAT) {
@@ -634,8 +636,8 @@ TSRM_API int shmget(key_t key, size_t size, int flags)
 			DWORD high = 0;
 			DWORD low = size;
 #endif
-			shm_handle	= CreateFileMapping(INVALID_HANDLE_VALUE, NULL, PAGE_READWRITE, high, low, shm_segment);
-			info_handle	= CreateFileMapping(INVALID_HANDLE_VALUE, NULL, PAGE_READWRITE, 0, sizeof(shm->descriptor), shm_info);
+			shm_handle	= CreateFileMapping(INVALID_HANDLE_VALUE, NULL, PAGE_READWRITE, high, low, key == IPC_PRIVATE ? NULL : shm_segment);
+			info_handle	= CreateFileMapping(INVALID_HANDLE_VALUE, NULL, PAGE_READWRITE, 0, sizeof(shm->descriptor), key == IPC_PRIVATE ? NULL : shm_info);
 			created		= TRUE;
 		}
 		if (!shm_handle || !info_handle) {
@@ -26,7 +26,7 @@ namespace N2 {
    echo $a->hello(), PHP_EOL;
    echo $a->foo(), PHP_EOL;
    try {
-    } catch(namespace \Foo $e)
+    } catch(namespace\Foo $e)
    {
    }
 }
@@ -0,0 +1,22 @@
+--TEST--
+Bug #79364 (When copy empty array, next key is unspecified)
+--FILE--
+<?php
+$a = [1, 2];
+unset($a[1], $a[0]);
+$b = $a;
+
+$a[] = 3;
+$b[] = 4;
+
+var_dump($a, $b);
+?>
+--EXPECT--
+array(1) {
+  [2]=>
+  int(3)
+}
+array(1) {
+  [2]=>
+  int(4)
+}
@@ -0,0 +1,20 @@
+--TEST--
+Bug #79477: casting object into array creates references
+--FILE--
+<?php
+
+class Test {
+	public $prop = 'default value';
+}
+
+$obj = new Test;
+$obj->{1} = null;
+
+$arr = (array) $obj;
+$arr['prop'] = 'new value';
+
+echo $obj->prop, "\n";
+
+?>
+--EXPECT--
+default value
@@ -0,0 +1,16 @@
+--TEST--
+Bug #79668 (get_defined_functions(true) may miss functions)
+--INI--
+disable_functions=sha1_file,password_hash
+--FILE--
+<?php
+$df = get_defined_functions(true);
+foreach (['sha1', 'sha1_file', 'hash', 'password_hash'] as $funcname) {
+    var_dump(in_array($funcname, $df['internal'], true));
+}
+?>
+--EXPECT--
+bool(true)
+bool(false)
+bool(true)
+bool(false)
@@ -0,0 +1,26 @@
+--TEST--
+Bug #79778: Assertion failure if dumping closure with unresolved static variable
+--FILE--
+<?php
+$closure1 = function() {
+    static $var = CONST_REF;
+};
+var_dump($closure1);
+print_r($closure1);
+?>
+--EXPECT--
+object(Closure)#1 (1) {
+  ["static"]=>
+  array(1) {
+    ["var"]=>
+    string(14) "<constant ast>"
+  }
+}
+Closure Object
+(
+    [static] => Array
+        (
+            [var] => <constant ast>
+        )
+
+)
@@ -0,0 +1,16 @@
+--TEST--
+Bug #79792: HT iterators not removed if empty array is destroyed
+--FILE--
+<?php
+$a = [42];
+foreach ($a as &$c) {
+    // Make the array empty.
+    unset($a[0]);
+    // Destroy the array.
+    $a = null;
+}
+?>
+===DONE===
+--EXPECTF--
+Warning: Invalid argument supplied for foreach() in %s on line %d
+===DONE===
@@ -0,0 +1,14 @@
+--TEST--
+Bug #79919 (Stack use-after-scope in define())
+--SKIPIF--
+<?php
+if (!extension_loaded('simplexml')) die('skip simplexml extension not available');
+?>
+--FILE--
+<?php
+$b = error_log(0);
+$b = simplexml_load_string('<xml/>', null, $b);
+define(0, $b);
+?>
+--EXPECT--
+0
@@ -0,0 +1,29 @@
+--TEST--
+Bug #79934: CRLF-only line in heredoc causes parsing error
+--DESCRIPTION--
+This test covers different variations of whitespace-only lines in heredoc strings.
+These whitespace-only lines should be ignored when stripping indentation.
+--FILE--
+<?php
+// lines with only CRLF should not cause a parse error
+eval("\$s1 = <<<HEREDOC\r\n    a\r\n\r\n    b\r\n    HEREDOC;");
+var_dump(addcslashes($s1, "\r\n"));
+
+// lines with only a LF should not cause a parse error
+eval("\$s2 = <<<HEREDOC\n    a\n\n    b\n    HEREDOC;");
+var_dump(addcslashes($s2, "\n"));
+
+// lines with only a CR should not cause a parse error
+eval("\$s3 = <<<HEREDOC\r    a\r\r    b\r    HEREDOC;");
+var_dump(addcslashes($s3, "\r"));
+
+// lines with only whitespace should not cause a parse error
+eval("\$s4 = <<<HEREDOC\r    a\r\n  \r\n    b\r    HEREDOC;");
+var_dump(addcslashes($s4, "\n\r"));
+
+?>
+--EXPECT--
+string(10) "a\r\n\r\nb"
+string(6) "a\n\nb"
+string(6) "a\r\rb"
+string(10) "a\r\n\r\nb"
@@ -9,6 +9,7 @@ namespace {

    var_dump(FOO); // Ok
    var_dump(foo); // Deprecated
+    var_dump(\foo); // Deprecated

    var_dump(NS\FOO); // Ok
    var_dump(ns\FOO); // Ok
@@ -72,10 +73,13 @@ int(42)

 Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 8
 int(42)
+
+Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 9
+int(42)
 int(24)
 int(24)

-Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "NS\FOO" in %s on line 12
+Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "NS\FOO" in %s on line 13
 int(24)
 bool(true)
 bool(true)
@@ -84,24 +88,24 @@ bool(true)
 bool(true)
 int(42)

-Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 21
+Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 22
 int(42)
 int(24)
 int(24)

-Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "NS\FOO" in %s on line 24
+Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "NS\FOO" in %s on line 25
 int(24)
 int(24)

-Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "NS\FOO" in %s on line 29
+Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "NS\FOO" in %s on line 30
 int(24)
 int(24)

-Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "NS\FOO" in %s on line 34
+Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "NS\FOO" in %s on line 35
 int(24)
 int(42)

-Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 39
+Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 40
 int(42)
 bool(true)
 bool(true)
@@ -110,18 +114,18 @@ bool(true)
 bool(true)
 int(42)

-Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 48
+Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 49
 int(42)
 int(24)
 int(24)

-Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "NS\FOO" in %s on line 51
+Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "NS\FOO" in %s on line 52
 int(24)
 int(42)

-Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 55
+Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 56
 int(42)
 int(43)

-Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 59
+Deprecated: Case-insensitive constants are deprecated. The correct casing for this constant is "FOO" in %s on line 60
 int(43)
@@ -0,0 +1,20 @@
+--TEST--
+Leak when setting recursive previous exception in finally handling
+--FILE--
+<?php
+
+try {
+    try {
+        throw new Exception("Test");
+    } catch (Exception $e) {
+        throw $e;
+    } finally {
+        throw $e;
+    }
+} catch (Exception $e2) {
+    echo $e2->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+Test
@@ -20,7 +20,7 @@
 #ifndef ZEND_H
 #define ZEND_H

-#define ZEND_VERSION "3.3.17-dev"
+#define ZEND_VERSION "3.3.22"

 #define ZEND_ENGINE_3

@@ -882,9 +882,7 @@ repeat:
 		case IS_OBJECT:
 			if (Z_TYPE(val_free) == IS_UNDEF) {
 				if (Z_OBJ_HT_P(val)->get) {
-					zval rv;
-					val = Z_OBJ_HT_P(val)->get(val, &rv);
-					ZVAL_COPY_VALUE(&val_free, val);
+					val = Z_OBJ_HT_P(val)->get(val, &val_free);
 					goto repeat;
 				} else if (Z_OBJ_HT_P(val)->cast_object) {
 					if (Z_OBJ_HT_P(val)->cast_object(val, &val_free, IS_STRING) == SUCCESS) {
@@ -1847,16 +1845,9 @@ static int copy_function_name(zval *zv, int num_args, va_list args, zend_hash_ke
 		return 0;
 	}

-	if (func->type == ZEND_INTERNAL_FUNCTION) {
-		char *disable_functions = INI_STR("disable_functions");
-
-		if ((*exclude_disabled == 1) && (disable_functions != NULL)) {
-			if (strstr(disable_functions, func->common.function_name->val) == NULL) {
-				add_next_index_str(internal_ar, zend_string_copy(hash_key->key));
-			}
-		} else {
-			add_next_index_str(internal_ar, zend_string_copy(hash_key->key));
-		}
+	if (func->type == ZEND_INTERNAL_FUNCTION
+		&& (!*exclude_disabled || func->internal_function.handler != ZEND_FN(display_disabled_function))) {
+		add_next_index_str(internal_ar, zend_string_copy(hash_key->key));
 	} else if (func->type == ZEND_USER_FUNCTION) {
 		add_next_index_str(user_ar, zend_string_copy(hash_key->key));
 	}
@@ -506,9 +506,16 @@ static HashTable *zend_closure_get_debug_info(zval *object, int *is_temp) /* {{{
 	debug_info = zend_new_array(8);

 	if (closure->func.type == ZEND_USER_FUNCTION && closure->func.op_array.static_variables) {
+		zval *var;
 		HashTable *static_variables = closure->func.op_array.static_variables;
 		ZVAL_ARR(&val, zend_array_dup(static_variables));
 		zend_hash_update(debug_info, ZSTR_KNOWN(ZEND_STR_STATIC), &val);
+		ZEND_HASH_FOREACH_VAL(Z_ARRVAL(val), var) {
+			if (Z_TYPE_P(var) == IS_CONSTANT_AST) {
+				zval_ptr_dtor(var);
+				ZVAL_STRING(var, "<constant ast>");
+			}
+		} ZEND_HASH_FOREACH_END();
 	}

 	if (Z_TYPE(closure->this_ptr) != IS_UNDEF) {
@@ -76,9 +76,15 @@ void zend_exception_set_previous(zend_object *exception, zend_object *add_previo
 	zval  pv, zv, rv;
 	zend_class_entry *base_ce;

-	if (exception == add_previous || !add_previous || !exception) {
+	if (!exception || !add_previous) {
 		return;
 	}
+
+	if (exception == add_previous) {
+		OBJ_RELEASE(add_previous);
+		return;
+	}
+
 	ZVAL_OBJ(&pv, add_previous);
 	if (!instanceof_function(Z_OBJCE(pv), zend_ce_throwable)) {
 		zend_error_noreturn(E_CORE_ERROR, "Previous exception must implement Throwable");
@@ -3364,11 +3364,15 @@ static zend_always_inline int _zend_quick_get_constant(
 				is_deprecated = !zend_string_equals(c->name, Z_STR_P(access_key));
 			} else {
 check_short_name:
-				ns_sep = zend_memrchr(ZSTR_VAL(c->name), '\\', ZSTR_LEN(c->name));
-				ZEND_ASSERT(ns_sep);
 				/* Namespaces are always case-insensitive. Only compare shortname. */
-				shortname_offset = ns_sep - ZSTR_VAL(c->name) + 1;
-				shortname_len = ZSTR_LEN(c->name) - shortname_offset;
+				ns_sep = zend_memrchr(ZSTR_VAL(c->name), '\\', ZSTR_LEN(c->name));
+				if (ns_sep) {
+					shortname_offset = ns_sep - ZSTR_VAL(c->name) + 1;
+					shortname_len = ZSTR_LEN(c->name) - shortname_offset;
+				} else {
+					shortname_offset = 0;
+					shortname_len = ZSTR_LEN(c->name);
+				}

 				is_deprecated = memcmp(ZSTR_VAL(c->name) + shortname_offset, Z_STRVAL_P(orig_key - 1) + shortname_offset, shortname_len) != 0;
 			}
@@ -253,10 +253,6 @@ static void zend_generator_free_storage(zend_object *object) /* {{{ */
 	}

 	zend_object_std_dtor(&generator->std);
-
-	if (generator->iterator) {
-		zend_iterator_dtor(generator->iterator);
-	}
 }
 /* }}} */

@@ -1504,11 +1504,11 @@ ZEND_API void ZEND_FASTCALL zend_array_destroy(HashTable *ht)
 				}
 			} while (++p != end);
 		}
-		zend_hash_iterators_remove(ht);
-		SET_INCONSISTENT(HT_DESTROYED);
 	} else if (EXPECTED(!(HT_FLAGS(ht) & HASH_FLAG_INITIALIZED))) {
 		goto free_ht;
 	}
+	zend_hash_iterators_remove(ht);
+	SET_INCONSISTENT(HT_DESTROYED);
 	efree(HT_GET_DATA_ADDR(ht));
 free_ht:
 	FREE_HASHTABLE(ht);
@@ -1934,7 +1934,7 @@ ZEND_API HashTable* ZEND_FASTCALL zend_array_dup(HashTable *source)
 		target->nTableMask = HT_MIN_MASK;
 		target->nNumUsed = 0;
 		target->nNumOfElements = 0;
-		target->nNextFreeElement = 0;
+		target->nNextFreeElement = source->nNextFreeElement;
 		target->nInternalPointer = 0;
 		HT_SET_DATA_ADDR(target, &uninitialized_bucket);
 	} else if (GC_FLAGS(source) & IS_ARRAY_IMMUTABLE) {
@@ -2722,7 +2722,7 @@ convert:
 	{
 		HashTable *new_ht = zend_new_array(zend_hash_num_elements(ht));

-		ZEND_HASH_FOREACH_KEY_VAL(ht, num_key, str_key, zv) {
+		ZEND_HASH_FOREACH_KEY_VAL_IND(ht, num_key, str_key, zv) {
 			do {
 				if (Z_OPT_REFCOUNTED_P(zv)) {
 					if (Z_ISREF_P(zv) && Z_REFCOUNT_P(zv) == 1) {
@@ -1112,6 +1112,7 @@ static const char *next_newline(const char *str, const char *end, size_t *newlin
 	for (; str < end; str++) {
 		if (*str == '\r') {
 			*newline_len = str + 1 < end && *(str + 1) == '\n' ? 2 : 1;
+			return str;
 		} else if (*str == '\n') {
 			*newline_len = 1;
 			return str;
@@ -1,5 +1,4 @@
-/* Generated by re2c 1.0.1 */
-#line 3 "Zend/zend_language_scanner_defs.h"
+/* Generated by re2c 1.3 */

 enum YYCONDTYPE {
 	yycST_IN_SCRIPTING,
@@ -55,6 +55,14 @@
 #define IO_REPARSE_TAG_ONEDRIVE   (0x80000021L)
 #endif

+# ifndef IO_REPARSE_TAG_ACTIVISION_HSM
+#  define IO_REPARSE_TAG_ACTIVISION_HSM (0x00000047L)
+# endif
+
+# ifndef IO_REPARSE_TAG_PROJFS
+#  define IO_REPARSE_TAG_PROJFS (0x9000001CL)
+# endif
+
 # ifndef VOLUME_NAME_NT
 #  define VOLUME_NAME_NT 0x2
 # endif
@@ -837,6 +845,7 @@ static size_t tsrm_realpath_r(char *path, size_t start, size_t len, int *ll, tim
 		}

 #ifdef ZEND_WIN32
+retry_reparse_point:
 		if (save) {
 			pathw = php_win32_ioutil_any_to_w(path);
 			if (!pathw) {
@@ -859,7 +868,7 @@ static size_t tsrm_realpath_r(char *path, size_t start, size_t len, int *ll, tim
 		tmp = do_alloca(len+1, use_heap);
 		memcpy(tmp, path, len+1);

-retry:
+retry_reparse_tag_cloud:
 		if(save &&
 				!(IS_UNC_PATH(path, len) && len >= 3 && path[2] != '?') &&
                               (dataw.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT)
@@ -920,7 +929,7 @@ retry:
 					dataw.dwFileAttributes = fileInformation.dwFileAttributes;
 					CloseHandle(hLink);
 					(*ll)--;
-					goto retry;
+					goto retry_reparse_tag_cloud;
 				}
 				free_alloca(tmp, use_heap);
 				CloseHandle(hLink);
@@ -1002,7 +1011,9 @@ retry:
 			else if (pbuffer->ReparseTag == IO_REPARSE_TAG_DEDUP ||
 					/* Starting with 1709. */
 					(pbuffer->ReparseTag & ~IO_REPARSE_TAG_CLOUD_MASK) == IO_REPARSE_TAG_CLOUD ||
-					IO_REPARSE_TAG_ONEDRIVE == pbuffer->ReparseTag) {
+					IO_REPARSE_TAG_ONEDRIVE == pbuffer->ReparseTag ||
+					IO_REPARSE_TAG_ACTIVISION_HSM == pbuffer->ReparseTag ||
+					IO_REPARSE_TAG_PROJFS == pbuffer->ReparseTag) {
 				isabsolute = 1;
 				substitutename = malloc((len + 1) * sizeof(char));
 				if (!substitutename) {
@@ -1065,6 +1076,22 @@ retry:
 			free_alloca(pbuffer, use_heap_large);
 			free(substitutename);

+			{
+				DWORD attrs;
+
+				FREE_PATHW()
+				pathw = php_win32_ioutil_any_to_w(path);
+				if (!pathw) {
+					return (size_t)-1;
+				}
+				attrs = GetFileAttributesW(pathw);
+				if (!isVolume && attrs != INVALID_FILE_ATTRIBUTES && (attrs & FILE_ATTRIBUTE_REPARSE_POINT)) {
+					free_alloca(tmp, use_heap);
+					FREE_PATHW()
+					goto retry_reparse_point;
+				}
+			}
+
 			if(isabsolute == 1) {
 				if (!((j == 3) && (path[1] == ':') && (path[2] == '\\'))) {
 					/* use_realpath is 0 in the call below coz path is absolute*/
@@ -8879,10 +8879,10 @@ ZEND_VM_DEFINE_OP(137, ZEND_OP_DATA);
 ZEND_VM_HELPER(zend_interrupt_helper, ANY, ANY)
 {
 	EG(vm_interrupt) = 0;
+	SAVE_OPLINE();
 	if (EG(timed_out)) {
 		zend_timeout(0);
 	} else if (zend_interrupt_function) {
-		SAVE_OPLINE();
 		zend_interrupt_function(execute_data);
 		ZEND_VM_ENTER();
 	}
@@ -2054,10 +2054,10 @@ static ZEND_VM_HOT ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_JMP_FORWARD_SPEC_H
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_interrupt_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS)
 {
 	EG(vm_interrupt) = 0;
+	SAVE_OPLINE();
 	if (EG(timed_out)) {
 		zend_timeout(0);
 	} else if (zend_interrupt_function) {
-		SAVE_OPLINE();
 		zend_interrupt_function(execute_data);
 		ZEND_VM_ENTER();
 	}
@@ -329,8 +329,8 @@ dnl
 dnl PHP_CHECK_GCC_ARG(arg, action-if-found, action-if-not-found)
 dnl
 AC_DEFUN([PHP_CHECK_GCC_ARG],[
-  gcc_arg_name=[ac_cv_gcc_arg]translit($1,A-Z-,a-z_)
-  AC_CACHE_CHECK([whether $CC supports $1], [ac_cv_gcc_arg]translit($1,A-Z-,a-z_), [
+  gcc_arg_name=[ac_cv_gcc_arg]translit($1,A-Z=-,a-z__)
+  AC_CACHE_CHECK([whether $CC supports $1], [ac_cv_gcc_arg]translit($1,A-Z=-,a-z__), [
  echo 'void somefunc() { };' > conftest.c
  cmd='$CC $1 -c conftest.c'
  if eval $cmd 2>&1 | $EGREP -e $1 >/dev/null ; then
@@ -2084,7 +2084,7 @@ dnl Search for the sendmail binary
 dnl
 AC_DEFUN([PHP_PROG_SENDMAIL], [
  PHP_ALT_PATH=/usr/bin:/usr/sbin:/usr/etc:/etc:/usr/ucblib:/usr/lib
-  AC_PATH_PROG(PROG_SENDMAIL, sendmail,[], $PATH:$PHP_ALT_PATH)
+  AC_PATH_PROG(PROG_SENDMAIL, sendmail, /usr/sbin/sendmail, $PATH:$PHP_ALT_PATH)
  PHP_SUBST(PROG_SENDMAIL)
 ])

@@ -107,8 +107,8 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=3
-PHP_RELEASE_VERSION=17
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=22
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -133,7 +133,7 @@ PHP_FUNCTION(com_create_instance)
 		info.pwszName = php_com_string_to_olestring(server_name, server_name_len, obj->code_page);

 		if (user_name) {
-			authid.User = php_com_string_to_olestring(user_name, -1, obj->code_page);
+			authid.User = (OLECHAR*)user_name;
 			authid.UserLength = (ULONG)user_name_len;

 			if (password) {
@@ -248,7 +248,7 @@ PHP_FUNCTION(com_create_instance)
 		TL = php_com_load_typelib_via_cache(typelib_name, obj->code_page, &cached);

 		if (TL) {
-			if (COMG(autoreg_on) && !cached) {
+			if (COMG(autoreg_on)) {
 				php_com_import_typelib(TL, mode, obj->code_page);
 			}

@@ -838,9 +838,7 @@ PHP_FUNCTION(com_load_typelib)
 	php_com_initialize();
 	pTL = php_com_load_typelib_via_cache(name, codepage, &cached);
 	if (pTL) {
-		if (cached) {
-			RETVAL_TRUE;
-		} else if (php_com_import_typelib(pTL, cs ? CONST_CS : 0, codepage) == SUCCESS) {
+		if (php_com_import_typelib(pTL, cs ? CONST_CS : 0, codepage) == SUCCESS) {
 			RETVAL_TRUE;
 		}

@@ -252,9 +252,7 @@ static PHP_INI_MH(OnTypeLibFileUpdate)
 		}

 		if ((pTL = php_com_load_typelib_via_cache(typelib_name, COMG(code_page), &cached)) != NULL) {
-			if (!cached) {
-				php_com_import_typelib(pTL, mode, COMG(code_page));
-			}
+			php_com_import_typelib(pTL, mode, COMG(code_page));
 			ITypeLib_Release(pTL);
 		}
 	}
@@ -103,3 +103,58 @@ PHP_COM_DOTNET_API char *php_com_olestring_to_string(OLECHAR *olestring, size_t

 	return string;
 }
+
+BSTR php_com_string_to_bstr(zend_string *string, int codepage)
+{
+	BSTR bstr = NULL;
+	DWORD flags = codepage == CP_UTF8 ? 0 : MB_PRECOMPOSED | MB_ERR_INVALID_CHARS;
+	size_t mb_len = ZSTR_LEN(string);
+	int wc_len;
+
+	if ((wc_len = MultiByteToWideChar(codepage, flags, ZSTR_VAL(string), (int)mb_len + 1, NULL, 0)) <= 0) {
+		goto fail;
+	}
+	if ((bstr = SysAllocStringLen(NULL, (UINT)(wc_len - 1))) == NULL) {
+		goto fail;
+	}
+	if ((wc_len = MultiByteToWideChar(codepage, flags, ZSTR_VAL(string), (int)mb_len + 1, bstr, wc_len)) <= 0) {
+		goto fail;
+	}
+	return bstr;
+
+fail:
+	char *msg = php_win32_error_to_msg(GetLastError());
+	php_error_docref(NULL, E_WARNING,
+		"Could not convert string to unicode: `%s'", msg);
+	LocalFree(msg);
+	SysFreeString(bstr);
+	return SysAllocString(L"");
+}
+
+zend_string *php_com_bstr_to_string(BSTR bstr, int codepage)
+{
+	zend_string *string = NULL;
+	UINT wc_len = SysStringLen(bstr);
+	int mb_len;
+
+	mb_len = WideCharToMultiByte(codepage, 0, bstr, wc_len + 1, NULL, 0, NULL, NULL);
+	if (mb_len > 0) {
+		string = zend_string_alloc(mb_len - 1, 0);
+		mb_len = WideCharToMultiByte(codepage, 0, bstr, wc_len + 1, ZSTR_VAL(string), mb_len, NULL, NULL);
+	}
+
+	if (mb_len <= 0) {
+		char *msg = php_win32_error_to_msg(GetLastError());
+
+		php_error_docref(NULL, E_WARNING,
+			"Could not convert string from unicode: `%s'", msg);
+		LocalFree(msg);
+
+		if (string != NULL) {
+			zend_string_release(string);
+		}
+		string = ZSTR_EMPTY_ALLOC();
+	}
+
+	return string;
+}
@@ -96,7 +96,6 @@ bogus:

 PHP_COM_DOTNET_API void php_com_variant_from_zval(VARIANT *v, zval *z, int codepage)
 {
-	OLECHAR *olestring;
 	php_com_dotnet_object *obj;
 	zend_uchar ztype = IS_NULL;

@@ -164,13 +163,7 @@ PHP_COM_DOTNET_API void php_com_variant_from_zval(VARIANT *v, zval *z, int codep

 		case IS_STRING:
 			V_VT(v) = VT_BSTR;
-			olestring = php_com_string_to_olestring(Z_STRVAL_P(z), Z_STRLEN_P(z), codepage);
-			if (CP_UTF8 == codepage) {
-				V_BSTR(v) = SysAllocStringByteLen((char*)olestring, (UINT)(wcslen(olestring) * sizeof(OLECHAR)));
-			} else {
-				V_BSTR(v) = SysAllocStringByteLen((char*)olestring, (UINT)(Z_STRLEN_P(z) * sizeof(OLECHAR)));
-			}
-			efree(olestring);
+			V_BSTR(v) = php_com_string_to_bstr(Z_STR_P(z), codepage);
 			break;

 		case IS_RESOURCE:
@@ -236,12 +229,8 @@ PHP_COM_DOTNET_API int php_com_zval_from_variant(zval *z, VARIANT *v, int codepa
 		case VT_BSTR:
 			olestring = V_BSTR(v);
 			if (olestring) {
-				size_t len;
-				char *str = php_com_olestring_to_string(olestring,
-					&len, codepage);
-				ZVAL_STRINGL(z, str, len);
-				// TODO: avoid reallocation???
-				efree(str);
+				zend_string *str = php_com_bstr_to_string(olestring, codepage);
+				ZVAL_STR(z, str);
 				olestring = NULL;
 			}
 			break;
@@ -89,6 +89,8 @@ PHP_COM_DOTNET_API char *php_com_olestring_to_string(OLECHAR *olestring,
 		size_t *string_len, int codepage);
 PHP_COM_DOTNET_API OLECHAR *php_com_string_to_olestring(char *string,
 		size_t string_len, int codepage);
+BSTR php_com_string_to_bstr(zend_string *string, int codepage);
+zend_string *php_com_bstr_to_string(BSTR bstr, int codepage);


 /* com_com.c */
@@ -0,0 +1,17 @@
+--TEST--
+Bug #63208 (BSTR to PHP string conversion not binary safe)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+?>
+--FILE--
+<?php
+$string = "\u{0905}b\0cd";
+$variant = new VARIANT($string, VT_ARRAY | VT_UI1, CP_UTF8); // Array of bytes
+$converted = (string) $variant;
+var_dump(bin2hex($string));
+var_dump(bin2hex($converted));
+?>
+--EXPECT--
+string(14) "e0a48562006364"
+string(14) "e0a48562006364"
@@ -2,7 +2,7 @@
 Bug #79332 (php_istreams are never freed)
 --SKIPIF--
 <?php
-if (!extension_loaded('com_dotnet')) die('com_dotnet extension not available');
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
 ?>
 --FILE--
 <?php
@@ -2167,8 +2167,6 @@ PHP_FUNCTION(curl_copy_handle)

 	_php_setup_easy_copy_handlers(dupch, ch);

-	Z_ADDREF_P(zid);
-
 	ZVAL_RES(return_value, zend_register_resource(dupch, le_curl));
 	dupch->res = Z_RES_P(return_value);
 }
@@ -2721,7 +2719,7 @@ static int _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue) /* {{{
 				return FAILURE;
 			}

-			ZEND_HASH_FOREACH_VAL(ph, current) {
+			ZEND_HASH_FOREACH_VAL_IND(ph, current) {
 				ZVAL_DEREF(current);
 				val = zval_get_tmp_string(current, &tmp_val);
 				slist = curl_slist_append(slist, ZSTR_VAL(val));
@@ -2799,7 +2797,7 @@ static int _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue) /* {{{
 				}
 #endif

-				ZEND_HASH_FOREACH_KEY_VAL(postfields, num_key, string_key, current) {
+				ZEND_HASH_FOREACH_KEY_VAL_IND(postfields, num_key, string_key, current) {
 					zend_string *postval, *tmp_postval;
 					/* Pretend we have a string_key here */
 					if (!string_key) {
@@ -0,0 +1,24 @@
+--TEST--
+Bug #79199 (curl_copy_handle() memory leak)
+--SKIPIF--
+<?php
+if (!extension_loaded('curl')) die('skip curl extension not available');
+?>
+--FILE--
+<?php
+$mem_old = 0;
+for($i = 0; $i < 50; ++$i) {
+    $c1 = curl_init();
+    $c2 = curl_copy_handle($c1);
+    curl_close($c2);
+    curl_close($c1);
+    $mem_new = memory_get_usage();
+    if ($mem_new <= $mem_old) {
+        break;
+    }
+    $mem_old = $mem_new;
+}
+echo $i < 50 ? "okay" : "leak", PHP_EOL;
+?>
+--EXPECT--
+okay
@@ -0,0 +1,16 @@
+--TEST--
+Bug #79741: curl_setopt CURLOPT_POSTFIELDS asserts on object with declared properties
+--FILE--
+<?php
+
+class Test {
+	public $prop = "value";
+}
+
+$ch = curl_init();
+curl_setopt($ch, CURLOPT_POSTFIELDS, new Test);
+
+?>
+===DONE===
+--EXPECT--
+===DONE===
@@ -3562,6 +3562,7 @@ static void php_date_time_set(zval *object, zend_long h, zend_long i, zend_long
 	dateobj->time->s = s;
 	dateobj->time->us = ms;
 	timelib_update_ts(dateobj->time, NULL);
+	timelib_update_from_sse(dateobj->time);
 } /* }}} */

 /* {{{ proto DateTime date_time_set(DateTime object, int hour, int minute[, int second[, int microseconds]])
@@ -0,0 +1,24 @@
+--TEST--
+Test for setting Date/Time during a forward DST transition
+--FILE--
+<?php
+date_default_timezone_set('America/Chicago');
+
+$date = new DateTime('2020-03-08 01:30:00');
+echo $date->setTime(2, 0)->format('Y-m-d H:i:s T/e - U') . "\n";
+
+$date = new DateTime('2020-03-08 01:30:00');
+echo $date->setTime(2, 30)->format('Y-m-d H:i:s T/e - U') . "\n";
+
+$date = new DateTime('2020-03-08 01:30:00');
+echo $date->setTime(3, 0)->format('Y-m-d H:i:s T/e - U') . "\n";
+
+$date = new DateTime('2020-03-08 01:30:00');
+echo $date->setTime(1, 59, 59)->format('Y-m-d H:i:s T/e - U') . "\n";
+
+?>
+--EXPECT--
+2020-03-08 03:00:00 CDT/America/Chicago - 1583654400
+2020-03-08 03:30:00 CDT/America/Chicago - 1583656200
+2020-03-08 03:00:00 CDT/America/Chicago - 1583654400
+2020-03-08 01:59:59 CST/America/Chicago - 1583654399
@@ -1358,6 +1358,14 @@ xmlNode *dom_get_elements_by_tag_name_ns_raw(xmlNodePtr nodep, char *ns, char *l
 /* }}} */
 /* }}} end dom_element_get_elements_by_tag_name_ns_raw */

+static inline zend_bool is_empty_node(xmlNodePtr nodep)
+{
+	xmlChar	*strContent = xmlNodeGetContent(nodep);
+	zend_bool ret = strContent == NULL || *strContent == '\0';
+	xmlFree(strContent);
+	return ret;
+}
+
 /* {{{ void dom_normalize (xmlNodePtr nodep) */
 void dom_normalize (xmlNodePtr nodep)
 {
@@ -1383,6 +1391,13 @@ void dom_normalize (xmlNodePtr nodep)
 						break;
 					}
 				}
+				if (is_empty_node(child)) {
+					nextp = child->next;
+					xmlUnlinkNode(child);
+					php_libxml_node_free_resource(child);
+					child = nextp;
+					continue;
+				}
 				break;
 			case XML_ELEMENT_NODE:
 				dom_normalize (child);
@@ -0,0 +1,17 @@
+--TEST--
+Bug #78221 (DOMNode::normalize() doesn't remove empty text nodes)
+--SKIPIF--
+<?php
+if (!extension_loaded('dom')) die('skip dom extension not available');
+?>
+--FILE--
+<?php
+$doc = new DOMDocument();
+$doc->loadHTML('<p id=x>foo</p>');
+$p = $doc->getElementById('x');
+$p->childNodes[0]->textContent = '';
+$p->normalize();
+var_dump($p->childNodes->length);
+?>
+--EXPECT--
+int(0)
@@ -66,7 +66,7 @@ typedef unsigned char uchar;

 #define EFREE_IF(ptr)	if (ptr) efree(ptr)

-#define MAX_IFD_NESTING_LEVEL 150
+#define MAX_IFD_NESTING_LEVEL 200

 /* {{{ arginfo */
 ZEND_BEGIN_ARG_INFO(arginfo_exif_tagname, 0)
@@ -3147,7 +3147,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 	if (value_len < 2 || maker_note->offset >= value_len - 1) {
 		/* Do not go past the value end */
 		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "IFD data too short: 0x%04X offset 0x%04X", value_len, maker_note->offset);
-		return FALSE;
+		return TRUE;
 	}

 	dir_start = value_ptr + maker_note->offset;
@@ -3173,6 +3173,23 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu

 	NumDirEntries = php_ifd_get16u(dir_start, ImageInfo->motorola_intel);

+	/* It can be that motorola_intel is wrongly mapped, let's try inverting it */
+	if ((2+NumDirEntries*12) > value_len) {
+		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Potentially invalid endianess, trying again with different endianness before imminent failure.");
+
+		ImageInfo->motorola_intel = ImageInfo->motorola_intel == 0 ? 1 : 0;
+		NumDirEntries = php_ifd_get16u(dir_start, ImageInfo->motorola_intel);
+	}
+
+	if ((2+NumDirEntries*12) > value_len) {
+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 2 + 0x%04X*12 = 0x%04X > 0x%04X", NumDirEntries, 2+NumDirEntries*12, value_len);
+		return FALSE;
+	}
+	if ((dir_start - value_ptr) > value_len - (2+NumDirEntries*12)) {
+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 0x%04X > 0x%04X", (dir_start - value_ptr) + (2+NumDirEntries*12), value_len);
+		return FALSE;
+	}
+
 	switch (maker_note->offset_mode) {
 		case MN_OFFSET_MAKER:
 			offset_base = value_ptr;
@@ -3203,15 +3220,6 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 			break;
 	}

-	if ((2+NumDirEntries*12) > value_len) {
-		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 2 + 0x%04X*12 = 0x%04X > 0x%04X", NumDirEntries, 2+NumDirEntries*12, value_len);
-		return FALSE;
-	}
-	if ((dir_start - value_ptr) > value_len - (2+NumDirEntries*12)) {
-		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 0x%04X > 0x%04X", (dir_start - value_ptr) + (2+NumDirEntries*12), value_len);
-		return FALSE;
-	}
-
 	for (de=0;de<NumDirEntries;de++) {
 		size_t offset = 2 + 12 * de;
 		if (!exif_process_IFD_TAG(ImageInfo, dir_start + offset,
@@ -3665,6 +3673,11 @@ static void exif_process_TIFF_in_JPEG(image_info_type *ImageInfo, char *CharBuf,
 {
 	unsigned exif_value_2a, offset_of_ifd;

+	if (length < 2) {
+		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Missing TIFF alignment marker");
+		return;
+	}
+
 	/* set the thumbnail stuff to nothing so we can test to see if they get set up */
 	if (memcmp(CharBuf, "II", 2) == 0) {
 		ImageInfo->motorola_intel = 0;
@@ -3817,7 +3830,7 @@ static int exif_scan_JPEG_header(image_info_type *ImageInfo)
 			return FALSE;
 		}

-		sn = exif_file_sections_add(ImageInfo, marker, itemlen+1, NULL);
+		sn = exif_file_sections_add(ImageInfo, marker, itemlen, NULL);
 		Data = ImageInfo->file.list[sn].data;

 		/* Store first two pre-read bytes. */
@@ -0,0 +1,17 @@
+--TEST--
+Bug #75785 fix corrupt EXIF header issues; Related to mixed endianness. (Thank you @Richard Matzinger for providing the test photo)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+$mixedEndiannessFile = dirname(__FILE__).'/P1000506.JPG';
+$tags = exif_read_data($mixedEndiannessFile, 'EXIF', true, false);
+
+echo $tags['GPS']['GPSLatitude'][0] . PHP_EOL;
+echo $tags['GPS']['GPSLongitude'][0] . PHP_EOL;
+?>
+===DONE===
+--EXPECTF--
+38/1
+122/1
+===DONE===
@@ -10,6 +10,8 @@ DONE
 --EXPECTF--
 Warning: exif_thumbnail(bug77563.jpg): IFD data too short: 0x0009 offset 0x0008 in %s%ebug77563.php on line %d

+Warning: exif_thumbnail(bug77563.jpg): Illegal IFD offset in %s%ebug77563.php on line %d
+
 Warning: exif_thumbnail(bug77563.jpg): File structure corrupted in %s%ebug77563.php on line %d

 Warning: exif_thumbnail(bug77563.jpg): Invalid JPEG file in %s%ebug77563.php on line %d
@@ -13,5 +13,32 @@ Warning: exif_read_data(): Process tag(x927C=MakerNote  ): Illegal format code 0

 Warning: exif_read_data(): IFD data too short: 0x0000 offset 0x000C in %s on line %d

-Warning: exif_read_data(): Invalid TIFF file in %s on line %d
-bool(false)
+Warning: exif_read_data(): Error in TIFF: filesize(x002A) less than start of IFD dir(x46494C4F) in %s on line %d
+array(8) {
+  ["FileDateTime"]=>
+  int(0)
+  ["FileSize"]=>
+  int(42)
+  ["FileType"]=>
+  int(8)
+  ["MimeType"]=>
+  string(10) "image/tiff"
+  ["SectionsFound"]=>
+  string(13) "ANY_TAG, IFD0"
+  ["COMPUTED"]=>
+  array(2) {
+    ["IsColor"]=>
+    int(0)
+    ["ByteOrderMotorola"]=>
+    int(1)
+  }
+  ["Make"]=>
+  array(2) {
+    [0]=>
+    int(1179994697)
+    [1]=>
+    int(1179208781)
+  }
+  ["MakerNote"]=>
+  NULL
+}
@@ -0,0 +1,15 @@
+--TEST--
+Bug #79282: Use-of-uninitialized-value in exif
+--FILE--
+<?php
+
+var_dump(exif_read_data('data://image/jpeg;base64,/9jhAAlFeGlmAAAg'));
+
+?>
+--EXPECTF--
+Warning: exif_read_data(): Missing TIFF alignment marker in %s on line %d
+
+Warning: exif_read_data(): File structure corrupted in %s on line %d
+
+Warning: exif_read_data(): Invalid JPEG file in %s on line %d
+bool(false)
@@ -0,0 +1,16 @@
+--TEST--
+Bug #79756 (finfo_file crash (FILEINFO_MIME))
+--SKIPIF--
+<?php
+if (!extension_loaded('fileinfo')) die('skip fileinfo extension not available');
+?>
+--FILE--
+<?php
+$filename = __DIR__ . '/bug79756.xls';
+$finfo = finfo_open(FILEINFO_MIME);
+$mime = finfo_file($finfo, $filename);
+finfo_close($finfo);
+echo $mime;
+?>
+--EXPECT--
+application/vnd.ms-excel; charset=binary
@@ -110,7 +110,7 @@ static void php_filter_strip(zval *value, zend_long flags)
 {
 	unsigned char *str;
 	size_t i;
-	int c;
+	size_t c;
 	zend_string *buf;

 	/* Optimization for if no strip flags are set */
@@ -119,7 +119,7 @@ static void php_filter_strip(zval *value, zend_long flags)
 	}

 	str = (unsigned char *)Z_STRVAL_P(value);
-	buf = zend_string_alloc(Z_STRLEN_P(value) + 1, 0);
+	buf = zend_string_alloc(Z_STRLEN_P(value), 0);
 	c = 0;
 	for (i = 0; i < Z_STRLEN_P(value); i++) {
 		if ((str[i] >= 127) && (flags & FILTER_FLAG_STRIP_HIGH)) {
@@ -161,7 +161,7 @@ static void filter_map_apply(zval *value, filter_map *map)
 	zend_string *buf;

 	str = (unsigned char *)Z_STRVAL_P(value);
-	buf = zend_string_alloc(Z_STRLEN_P(value) + 1, 0);
+	buf = zend_string_alloc(Z_STRLEN_P(value), 0);
 	c = 0;
 	for (i = 0; i < Z_STRLEN_P(value); i++) {
 		if ((*map)[str[i]]) {
@@ -1133,6 +1133,8 @@ bail:
 zend_long
 ftp_size(ftpbuf_t *ftp, const char *path, const size_t path_len)
 {
+	zend_long res;
+
 	if (ftp == NULL) {
 		return -1;
 	}
@@ -1145,7 +1147,8 @@ ftp_size(ftpbuf_t *ftp, const char *path, const size_t path_len)
 	if (!ftp_getresp(ftp) || ftp->resp != 213) {
 		return -1;
 	}
-	return atol(ftp->inbuf);
+	ZEND_ATOL(res, ftp->inbuf);
+	return res;
 }
 /* }}} */

@@ -319,7 +319,7 @@ GIFEncode(gdIOCtxPtr fp, int GWidth, int GHeight, int GInterlace, int Background
        /*
         * OR in the resolution
         */
-        B |= (Resolution - 1) << 5;
+        B |= (Resolution - 1) << 4;

        /*
         * OR in the Bits per Pixel
@@ -931,7 +931,7 @@ static inline void _gdScaleRow(gdImagePtr pSrc,  unsigned int src_width, gdImage
    int *p_dst_row = dst->tpixels[row];
 	unsigned int x;

-    for (x = 0; x < dst_width - 1; x++) {
+    for (x = 0; x < dst_width; x++) {
 		register unsigned char r = 0, g = 0, b = 0, a = 0;
        const int left = contrib->ContribRow[x].Left;
        const int right = contrib->ContribRow[x].Right;
@@ -967,7 +967,7 @@ static inline int _gdScaleHoriz(gdImagePtr pSrc, unsigned int src_width, unsigne
 		return 0;
 	}
 	/* Scale each row */
-	for (u = 0; u < dst_height - 1; u++) {
+	for (u = 0; u < dst_height; u++) {
 		_gdScaleRow(pSrc, src_width, pDst, dst_width, u, contrib);
 	}
 	_gdContributionsFree (contrib);
@@ -977,7 +977,7 @@ static inline int _gdScaleHoriz(gdImagePtr pSrc, unsigned int src_width, unsigne
 static inline void _gdScaleCol (gdImagePtr pSrc,  unsigned int src_width, gdImagePtr pRes, unsigned int dst_width, unsigned int dst_height, unsigned int uCol, LineContribType *contrib)
 {
 	unsigned int y;
-	for (y = 0; y < dst_height - 1; y++) {
+	for (y = 0; y < dst_height; y++) {
 		register unsigned char r = 0, g = 0, b = 0, a = 0;
 		const int iLeft = contrib->ContribRow[y].Left;
 		const int iRight = contrib->ContribRow[y].Right;
@@ -1014,7 +1014,7 @@ static inline int _gdScaleVert (const gdImagePtr pSrc, const unsigned int src_wi
 		return 0;
 	}
 	/* scale each column */
-	for (u = 0; u < dst_width - 1; u++) {
+	for (u = 0; u < dst_width; u++) {
 		_gdScaleCol(pSrc, src_width, pDst, dst_width, dst_height, u, contrib);
 	}
 	_gdContributionsFree(contrib);
@@ -0,0 +1,20 @@
+--TEST--
+Bug #79615 (Wrong GIF header written in GD GIFEncode)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$im = imagecreate(3, 3); // 3x3, 9 colors, 4 bits per pixel
+for ($x = 0; $x < 3; $x++) {
+    for ($y = 0; $y < 3; $y++) {
+        imagesetpixel($im, $x, $y, imagecolorallocate($im, $x, $y, 0));
+    }
+}
+ob_start();
+imagegif($im);
+echo decbin(ord(ob_get_clean()[0xA]));
+?>
+--EXPECT--
+10110011
@@ -0,0 +1,31 @@
+--TEST--
+Bug #79676 (imagescale adds black border with IMG_BICUBIC)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+function test($image, $desc)
+{
+    echo "$desc - Test Result: ",
+        (imagecolorat($image, imagesx($image) - 1 , imagesy($image) - 1) != 0x000000 ? 'pass' : 'fail'),
+        PHP_EOL;
+}
+
+$size = 32;
+$src = imagecreatetruecolor($size, $size);
+imagefilledrectangle($src, 0, 0, $size - 1 , $size - 1, 0xff00ff);
+
+test($src, 'No scaling');
+test(imagescale($src, $size * 2, $size * 2), 'Scale 200%, default mode');
+test(imagescale($src, $size / 2, $size / 2), 'Scale 50%, default mode');
+test(imagescale($src, $size * 2, $size * 2, IMG_BICUBIC), 'Scale 200%, IMG_BICUBIC mode');
+test(imagescale($src, $size / 2, $size / 2, IMG_BICUBIC), 'Scale 50%, IMG_BICUBIC mode');
+?>
+--EXPECT--
+No scaling - Test Result: pass
+Scale 200%, default mode - Test Result: pass
+Scale 50%, default mode - Test Result: pass
+Scale 200%, IMG_BICUBIC mode - Test Result: pass
+Scale 50%, IMG_BICUBIC mode - Test Result: pass
@@ -739,6 +739,7 @@ static php_iconv_err_t _php_iconv_strlen(size_t *pretval, const char *str, size_
 	size_t out_left;

 	size_t cnt;
+	int more;

 	*pretval = (size_t)-1;

@@ -758,25 +759,23 @@ static php_iconv_err_t _php_iconv_strlen(size_t *pretval, const char *str, size_

 	errno = 0;
 	out_left = 0;
+	more = nbytes > 0;

-	for (in_p = str, in_left = nbytes, cnt = 0; in_left > 0; cnt+=2) {
-		size_t prev_in_left;
+	for (in_p = str, in_left = nbytes, cnt = 0; more;) {
 		out_p = buf;
 		out_left = sizeof(buf);

-		prev_in_left = in_left;
+		more = in_left > 0;

-		if (iconv(cd, (char **)&in_p, &in_left, (char **) &out_p, &out_left) == (size_t)-1) {
-			if (prev_in_left == in_left) {
-				break;
-			}
+		iconv(cd, more ? (char **)&in_p : NULL, more ? &in_left : NULL, (char **) &out_p, &out_left);
+		if (out_left == sizeof(buf)) {
+			break;
+		} else {
+			ZEND_ASSERT((sizeof(buf) - out_left) % GENERIC_SUPERSET_NBYTES == 0);
+			cnt += (sizeof(buf) - out_left) / GENERIC_SUPERSET_NBYTES;
 		}
 	}

-	if (out_left > 0) {
-		cnt -= out_left / GENERIC_SUPERSET_NBYTES;
-	}
-
 #if ICONV_SUPPORTS_ERRNO
 	switch (errno) {
 		case EINVAL:
@@ -825,6 +824,7 @@ static php_iconv_err_t _php_iconv_substr(smart_str *pretval,

 	size_t cnt;
 	size_t total_len;
+	int more;

 	err = _php_iconv_strlen(&total_len, str, nbytes, enc);
 	if (err != PHP_ICONV_ERR_SUCCESS) {
@@ -879,18 +879,17 @@ static php_iconv_err_t _php_iconv_substr(smart_str *pretval,

 	cd2 = (iconv_t)NULL;
 	errno = 0;
+	more = nbytes > 0 && len > 0;

-	for (in_p = str, in_left = nbytes, cnt = 0; in_left > 0 && len > 0; ++cnt) {
-		size_t prev_in_left;
+	for (in_p = str, in_left = nbytes, cnt = 0; more; ++cnt) {
 		out_p = buf;
 		out_left = sizeof(buf);

-		prev_in_left = in_left;
+		more = in_left > 0 && len > 0;

-		if (iconv(cd1, (char **)&in_p, &in_left, (char **) &out_p, &out_left) == (size_t)-1) {
-			if (prev_in_left == in_left) {
-				break;
-			}
+		iconv(cd1, more ? (char **)&in_p : NULL, more ? &in_left : NULL, (char **) &out_p, &out_left);
+		if (out_left == sizeof(buf)) {
+			break;
 		}

 		if ((zend_long)cnt >= offset) {
@@ -978,6 +977,8 @@ static php_iconv_err_t _php_iconv_strpos(size_t *pretval,
 	size_t ndl_buf_left;

 	size_t match_ofs;
+	int more;
+	size_t iconv_ret;

 	*pretval = (size_t)-1;

@@ -1010,37 +1011,38 @@ static php_iconv_err_t _php_iconv_strpos(size_t *pretval,
 	ndl_buf_p = ZSTR_VAL(ndl_buf);
 	ndl_buf_left = ZSTR_LEN(ndl_buf);
 	match_ofs = (size_t)-1;
+	more = haystk_nbytes > 0;

-	for (in_p = haystk, in_left = haystk_nbytes, cnt = 0; in_left > 0; ++cnt) {
-		size_t prev_in_left;
+	for (in_p = haystk, in_left = haystk_nbytes, cnt = 0; more; ++cnt) {
 		out_p = buf;
 		out_left = sizeof(buf);

-		prev_in_left = in_left;
+		more = in_left > 0;

-		if (iconv(cd, (char **)&in_p, &in_left, (char **) &out_p, &out_left) == (size_t)-1) {
-			if (prev_in_left == in_left) {
+		iconv_ret = iconv(cd, more ? (char **)&in_p : NULL, more ? &in_left : NULL, (char **) &out_p, &out_left);
+		if (out_left == sizeof(buf)) {
+			break;
+		}
 #if ICONV_SUPPORTS_ERRNO
-				switch (errno) {
-					case EINVAL:
-						err = PHP_ICONV_ERR_ILLEGAL_CHAR;
-						break;
+		if (iconv_ret == (size_t)-1) {
+			switch (errno) {
+				case EINVAL:
+					err = PHP_ICONV_ERR_ILLEGAL_CHAR;
+					break;

-					case EILSEQ:
-						err = PHP_ICONV_ERR_ILLEGAL_SEQ;
-						break;
+				case EILSEQ:
+					err = PHP_ICONV_ERR_ILLEGAL_SEQ;
+					break;

-					case E2BIG:
-						break;
+				case E2BIG:
+					break;

-					default:
-						err = PHP_ICONV_ERR_UNKNOWN;
-						break;
-				}
-#endif
-				break;
+				default:
+					err = PHP_ICONV_ERR_UNKNOWN;
+					break;
 			}
 		}
+#endif
 		if (offset >= 0) {
 			if (cnt >= (size_t)offset) {
 				if (_php_iconv_memequal(buf, ndl_buf_p, sizeof(buf))) {
@@ -2012,6 +2014,13 @@ static php_iconv_err_t _php_iconv_mime_decode(smart_str *pretval, const char *st
 		*next_pos = p1;
 	}

+	if (cd != (iconv_t)(-1)) {
+		_php_iconv_appendl(pretval, NULL, 0, cd);
+	}
+	if (cd_pl != (iconv_t)(-1)) {
+		_php_iconv_appendl(pretval, NULL, 0, cd_pl);
+	}
+
 	smart_str_0(pretval);
 out:
 	if (cd != (iconv_t)(-1)) {
@@ -0,0 +1,18 @@
+--TEST--
+Bug #79200 (Some iconv functions cut Windows-1258)
+--SKIPIF--
+<?php
+if (!extension_loaded('iconv')) die('skip iconv extension not available');
+?>
+--FILE--
+<?php
+var_dump(iconv_mime_decode('=?windows-1258?Q?test=20test?=', 0, 'UTF-8'));
+var_dump(iconv_strlen('test test', 'WINDOWS-1258'));
+var_dump(iconv_strpos('test test', 'test test', 0, 'WINDOWS-1258'));
+var_dump(iconv_substr('test test', 0 , 9, 'WINDOWS-1258'));
+?>
+--EXPECT--
+string(9) "test test"
+int(9)
+int(0)
+string(9) "test test"
@@ -167,15 +167,17 @@ static void _php_ldap_control_to_array(LDAP *ld, LDAPControl* ctrl, zval* array,
 		}
 	} else if (strcmp(ctrl->ldctl_oid, LDAP_CONTROL_PAGEDRESULTS) == 0) {
 		int lestimated, rc;
-		struct berval lcookie;
+		struct berval lcookie = { 0L, NULL };
 		zval value;

 		if (ctrl->ldctl_value.bv_len) {
+			/* ldap_parse_pageresponse_control() allocates lcookie.bv_val */
 			rc = ldap_parse_pageresponse_control(ld, ctrl, &lestimated, &lcookie);
 		} else {
 			/* ldap_parse_pageresponse_control will crash if value is empty */
 			rc = -1;
 		}
+
 		if ( rc == LDAP_SUCCESS ) {
 			array_init(&value);
 			add_assoc_long(&value, "size", lestimated);
@@ -184,6 +186,10 @@ static void _php_ldap_control_to_array(LDAP *ld, LDAPControl* ctrl, zval* array,
 		} else {
 			add_assoc_null(array, "value");
 		}
+
+		if (lcookie.bv_val) {
+			ldap_memfree(lcookie.bv_val);
+		}
 	} else if ((strcmp(ctrl->ldctl_oid, LDAP_CONTROL_PRE_READ) == 0) || (strcmp(ctrl->ldctl_oid, LDAP_CONTROL_POST_READ) == 0)) {
 		BerElement *ber;
 		struct berval bv;
@@ -283,7 +289,8 @@ static int _php_ldap_control_from_array(LDAP *ld, LDAPControl** ctrl, zval* arra
 	int control_iscritical = 0, rc = LDAP_SUCCESS;
 	char** ldap_attrs = NULL;
 	LDAPSortKey** sort_keys = NULL;
-	zend_string *tmpstring = NULL;
+	zend_string *tmpstring = NULL, **tmpstrings1 = NULL, **tmpstrings2 = NULL;
+	size_t num_tmpstrings1 = 0, num_tmpstrings2 = 0;

 	if ((val = zend_hash_str_find(Z_ARRVAL_P(array), "oid", sizeof("oid") - 1)) == NULL) {
 		php_error_docref(NULL, E_WARNING, "Control must have an oid key");
@@ -301,27 +308,23 @@ static int _php_ldap_control_from_array(LDAP *ld, LDAPControl** ctrl, zval* arra
 		control_iscritical = 0;
 	}

-	struct berval *control_value = NULL;
+	BerElement *ber = NULL;
+	struct berval control_value = { 0L, NULL };
+	int control_value_alloc = 0;

 	if ((val = zend_hash_str_find(Z_ARRVAL_P(array), "value", sizeof("value") - 1)) != NULL) {
 		if (Z_TYPE_P(val) != IS_ARRAY) {
-			control_value = ber_memalloc(sizeof * control_value);
-			if (control_value == NULL) {
+			tmpstring = zval_get_string(val);
+			if (EG(exception)) {
 				rc = -1;
-				php_error_docref(NULL, E_WARNING, "Failed to allocate control value");
-			} else {
-				tmpstring = zval_get_string(val);
-				if (EG(exception)) {
-					rc = -1;
-					goto failure;
-				}
-				control_value->bv_val = ZSTR_VAL(tmpstring);
-				control_value->bv_len = ZSTR_LEN(tmpstring);
+				goto failure;
 			}
+			control_value.bv_val = ZSTR_VAL(tmpstring);
+			control_value.bv_len = ZSTR_LEN(tmpstring);
 		} else if (strcmp(ZSTR_VAL(control_oid), LDAP_CONTROL_PAGEDRESULTS) == 0) {
 			zval* tmp;
 			int pagesize = 1;
-			struct berval cookie = { 0, NULL };
+			struct berval cookie = { 0L, NULL };
 			if ((tmp = zend_hash_str_find(Z_ARRVAL_P(val), "size", sizeof("size") - 1)) != NULL) {
 				pagesize = zval_get_long(tmp);
 			}
@@ -334,15 +337,11 @@ static int _php_ldap_control_from_array(LDAP *ld, LDAPControl** ctrl, zval* arra
 				cookie.bv_val = ZSTR_VAL(tmpstring);
 				cookie.bv_len = ZSTR_LEN(tmpstring);
 			}
-			control_value = ber_memalloc(sizeof * control_value);
-			if (control_value == NULL) {
-				rc = -1;
-				php_error_docref(NULL, E_WARNING, "Failed to allocate control value");
-			} else {
-				rc = ldap_create_page_control_value(ld, pagesize, &cookie, control_value);
-				if (rc != LDAP_SUCCESS) {
-					php_error_docref(NULL, E_WARNING, "Failed to create paged result control value: %s (%d)", ldap_err2string(rc), rc);
-				}
+			/* ldap_create_page_control_value() allocates memory for control_value.bv_val */
+			control_value_alloc = 1;
+			rc = ldap_create_page_control_value(ld, pagesize, &cookie, &control_value);
+			if (rc != LDAP_SUCCESS) {
+				php_error_docref(NULL, E_WARNING, "Failed to create paged result control value: %s (%d)", ldap_err2string(rc), rc);
 			}
 		} else if (strcmp(ZSTR_VAL(control_oid), LDAP_CONTROL_ASSERT) == 0) {
 			zval* tmp;
@@ -356,19 +355,15 @@ static int _php_ldap_control_from_array(LDAP *ld, LDAPControl** ctrl, zval* arra
 					rc = -1;
 					goto failure;
 				}
-				control_value = ber_memalloc(sizeof * control_value);
-				if (control_value == NULL) {
-					rc = -1;
-					php_error_docref(NULL, E_WARNING, "Failed to allocate control value");
-				} else {
-					/* ldap_create_assertion_control_value does not reset ld_errno, we need to do it ourselves
-					   See http://www.openldap.org/its/index.cgi/Incoming?id=8674 */
-					int success = LDAP_SUCCESS;
-					ldap_set_option(ld, LDAP_OPT_RESULT_CODE, &success);
-					rc = ldap_create_assertion_control_value(ld, ZSTR_VAL(assert), control_value);
-					if (rc != LDAP_SUCCESS) {
-						php_error_docref(NULL, E_WARNING, "Failed to create assert control value: %s (%d)", ldap_err2string(rc), rc);
-					}
+				/* ldap_create_assertion_control_value does not reset ld_errno, we need to do it ourselves
+					 See http://www.openldap.org/its/index.cgi/Incoming?id=8674 */
+				int success = LDAP_SUCCESS;
+				ldap_set_option(ld, LDAP_OPT_RESULT_CODE, &success);
+				/* ldap_create_assertion_control_value() allocates memory for control_value.bv_val */
+				control_value_alloc = 1;
+				rc = ldap_create_assertion_control_value(ld, ZSTR_VAL(assert), &control_value);
+				if (rc != LDAP_SUCCESS) {
+					php_error_docref(NULL, E_WARNING, "Failed to create assert control value: %s (%d)", ldap_err2string(rc), rc);
 				}
 				zend_string_release(assert);
 			}
@@ -378,9 +373,8 @@ static int _php_ldap_control_from_array(LDAP *ld, LDAPControl** ctrl, zval* arra
 				rc = -1;
 				php_error_docref(NULL, E_WARNING, "Filter missing from control value array");
 			} else {
-				BerElement *vrber = ber_alloc_t(LBER_USE_DER);
-				control_value = ber_memalloc(sizeof * control_value);
-				if ((control_value == NULL) || (vrber == NULL)) {
+				ber = ber_alloc_t(LBER_USE_DER);
+				if (ber == NULL) {
 					rc = -1;
 					php_error_docref(NULL, E_WARNING, "Failed to allocate control value");
 				} else {
@@ -389,15 +383,11 @@ static int _php_ldap_control_from_array(LDAP *ld, LDAPControl** ctrl, zval* arra
 						rc = -1;
 						goto failure;
 					}
-					if (ldap_put_vrFilter(vrber, ZSTR_VAL(tmpstring)) == -1) {
-						ber_free(vrber, 1);
+					if (ldap_put_vrFilter(ber, ZSTR_VAL(tmpstring)) == -1) {
 						rc = -1;
 						php_error_docref(NULL, E_WARNING, "Failed to create control value: Bad ValuesReturnFilter: %s", ZSTR_VAL(tmpstring));
-					} else {
-						if (ber_flatten2(vrber, control_value, 0) == -1) {
-							rc = -1;
-						}
-						ber_free(vrber, 1);
+					} else if (ber_flatten2(ber, &control_value, control_value_alloc) == -1) {
+						rc = -1;
 					}
 				}
 			}
@@ -407,10 +397,9 @@ static int _php_ldap_control_from_array(LDAP *ld, LDAPControl** ctrl, zval* arra
 				rc = -1;
 				php_error_docref(NULL, E_WARNING, "Attributes list missing from control value array");
 			} else {
-				BerElement *ber = ber_alloc_t(LBER_USE_DER);
+				ber = ber_alloc_t(LBER_USE_DER);

-				control_value = ber_memalloc(sizeof * control_value);
-				if ((control_value == NULL) || (ber == NULL)) {
+				if (ber == NULL) {
 					rc = -1;
 					php_error_docref(NULL, E_WARNING, "Failed to allocate control value");
 				} else {
@@ -419,6 +408,8 @@ static int _php_ldap_control_from_array(LDAP *ld, LDAPControl** ctrl, zval* arra

 					num_attribs = zend_hash_num_elements(Z_ARRVAL_P(tmp));
 					ldap_attrs = safe_emalloc((num_attribs+1), sizeof(char *), 0);
+					tmpstrings1 = safe_emalloc(num_attribs, sizeof(zend_string*), 0);
+					num_tmpstrings1 = 0;

 					for (i = 0; i<num_attribs; i++) {
 						if ((attr = zend_hash_index_find(Z_ARRVAL_P(tmp), i)) == NULL) {
@@ -427,12 +418,13 @@ static int _php_ldap_control_from_array(LDAP *ld, LDAPControl** ctrl, zval* arra
 							goto failure;
 						}

-						tmpstring = zval_get_string(attr);
+						tmpstrings1[num_tmpstrings1] = zval_get_string(attr);
 						if (EG(exception)) {
 							rc = -1;
 							goto failure;
 						}
-						ldap_attrs[i] = ZSTR_VAL(tmpstring);
+						ldap_attrs[i] = ZSTR_VAL(tmpstrings1[num_tmpstrings1]);
+						++num_tmpstrings1;
 					}
 					ldap_attrs[num_attribs] = NULL;

@@ -443,7 +435,7 @@ static int _php_ldap_control_from_array(LDAP *ld, LDAPControl** ctrl, zval* arra
 						php_error_docref(NULL, E_WARNING, "Failed to encode attribute list");
 					} else {
 						int err;
-						err = ber_flatten2(ber, control_value, 0);
+						err = ber_flatten2(ber, &control_value, control_value_alloc);
 						if (err < 0) {
 							rc = -1;
 							php_error_docref(NULL, E_WARNING, "Failed to encode control value (%d)", err);
@@ -457,6 +449,10 @@ static int _php_ldap_control_from_array(LDAP *ld, LDAPControl** ctrl, zval* arra

 			num_keys = zend_hash_num_elements(Z_ARRVAL_P(val));
 			sort_keys = safe_emalloc((num_keys+1), sizeof(LDAPSortKey*), 0);
+			tmpstrings1 = safe_emalloc(num_keys, sizeof(zend_string*), 0);
+			tmpstrings2 = safe_emalloc(num_keys, sizeof(zend_string*), 0);
+			num_tmpstrings1 = 0;
+			num_tmpstrings2 = 0;

 			for (i = 0; i<num_keys; i++) {
 				if ((sortkey = zend_hash_index_find(Z_ARRVAL_P(val), i)) == NULL) {
@@ -471,20 +467,22 @@ static int _php_ldap_control_from_array(LDAP *ld, LDAPControl** ctrl, zval* arra
 					goto failure;
 				}
 				sort_keys[i] = emalloc(sizeof(LDAPSortKey));
-				tmpstring = zval_get_string(tmp);
+				tmpstrings1[num_tmpstrings1] = zval_get_string(tmp);
 				if (EG(exception)) {
 					rc = -1;
 					goto failure;
 				}
-				sort_keys[i]->attributeType = ZSTR_VAL(tmpstring);
+				sort_keys[i]->attributeType = ZSTR_VAL(tmpstrings1[num_tmpstrings1]);
+				++num_tmpstrings1;

 				if ((tmp = zend_hash_str_find(Z_ARRVAL_P(sortkey), "oid", sizeof("oid") - 1)) != NULL) {
-					tmpstring = zval_get_string(tmp);
+					tmpstrings2[num_tmpstrings2] = zval_get_string(tmp);
 					if (EG(exception)) {
 						rc = -1;
 						goto failure;
 					}
-					sort_keys[i]->orderingRule = ZSTR_VAL(tmpstring);
+					sort_keys[i]->orderingRule = ZSTR_VAL(tmpstrings2[num_tmpstrings2]);
+					++num_tmpstrings2;
 				} else {
 					sort_keys[i]->orderingRule = NULL;
 				}
@@ -496,15 +494,11 @@ static int _php_ldap_control_from_array(LDAP *ld, LDAPControl** ctrl, zval* arra
 				}
 			}
 			sort_keys[num_keys] = NULL;
-			control_value = ber_memalloc(sizeof * control_value);
-			if (control_value == NULL) {
-				rc = -1;
-				php_error_docref(NULL, E_WARNING, "Failed to allocate control value");
-			} else {
-				rc = ldap_create_sort_control_value(ld, sort_keys, control_value);
-				if (rc != LDAP_SUCCESS) {
-					php_error_docref(NULL, E_WARNING, "Failed to create sort control value: %s (%d)", ldap_err2string(rc), rc);
-				}
+			/* ldap_create_sort_control_value() allocates memory for control_value.bv_val */
+			control_value_alloc = 1;
+			rc = ldap_create_sort_control_value(ld, sort_keys, &control_value);
+			if (rc != LDAP_SUCCESS) {
+				php_error_docref(NULL, E_WARNING, "Failed to create sort control value: %s (%d)", ldap_err2string(rc), rc);
 			}
 		} else if (strcmp(ZSTR_VAL(control_oid), LDAP_CONTROL_VLVREQUEST) == 0) {
 			zval* tmp;
@@ -566,15 +560,11 @@ static int _php_ldap_control_from_array(LDAP *ld, LDAPControl** ctrl, zval* arra
 				vlvInfo.ldvlv_context = NULL;
 			}

-			control_value = ber_memalloc(sizeof * control_value);
-			if (control_value == NULL) {
-				rc = -1;
-				php_error_docref(NULL, E_WARNING, "Failed to allocate control value");
-			} else {
-				rc = ldap_create_vlv_control_value(ld, &vlvInfo, control_value);
-				if (rc != LDAP_SUCCESS) {
-					php_error_docref(NULL, E_WARNING, "Failed to create VLV control value: %s (%d)", ldap_err2string(rc), rc);
-				}
+			/* ldap_create_vlv_control_value() allocates memory for control_value.bv_val */
+			control_value_alloc = 1;
+			rc = ldap_create_vlv_control_value(ld, &vlvInfo, &control_value);
+			if (rc != LDAP_SUCCESS) {
+				php_error_docref(NULL, E_WARNING, "Failed to create VLV control value: %s (%d)", ldap_err2string(rc), rc);
 			}
 		} else {
 			php_error_docref(NULL, E_WARNING, "Control OID %s does not expect an array as value", ZSTR_VAL(control_oid));
@@ -583,7 +573,7 @@ static int _php_ldap_control_from_array(LDAP *ld, LDAPControl** ctrl, zval* arra
 	}

 	if (rc == LDAP_SUCCESS) {
-		rc = ldap_control_create(ZSTR_VAL(control_oid), control_iscritical, control_value, 1, ctrl);
+		rc = ldap_control_create(ZSTR_VAL(control_oid), control_iscritical, &control_value, 1, ctrl);
 	}

 failure:
@@ -591,9 +581,25 @@ failure:
 	if (tmpstring != NULL) {
 		zend_string_release(tmpstring);
 	}
-	if (control_value != NULL) {
-		ber_memfree(control_value);
-		control_value = NULL;
+	if (tmpstrings1 != NULL) {
+		int i;
+		for (i = 0; i < num_tmpstrings1; ++i) {
+			zend_string_release(tmpstrings1[i]);
+		}
+		efree(tmpstrings1);
+	}
+	if (tmpstrings2 != NULL) {
+		int i;
+		for (i = 0; i < num_tmpstrings2; ++i) {
+			zend_string_release(tmpstrings2[i]);
+		}
+		efree(tmpstrings2);
+	}
+	if (control_value.bv_val != NULL && control_value_alloc != 0) {
+		ber_memfree(control_value.bv_val);
+	}
+	if (ber != NULL) {
+		ber_free(ber, 1);
 	}
 	if (ldap_attrs != NULL) {
 		efree(ldap_attrs);
@@ -1465,7 +1471,7 @@ static void php_ldap_do_search(INTERNAL_FUNCTION_PARAMETERS, int scope)
 	zend_string *ldap_filter = NULL, *ldap_base_dn = NULL;
 	char **ldap_attrs = NULL;
 	ldap_linkdata *ld = NULL;
-	LDAPMessage *ldap_res;
+	LDAPMessage *ldap_res = NULL;
 	LDAPControl **lserverctrls = NULL;
 	int ldap_attrsonly = 0, ldap_sizelimit = -1, ldap_timelimit = -1, ldap_deref = -1;
 	int old_ldap_sizelimit = -1, old_ldap_timelimit = -1, old_ldap_deref = -1;
@@ -1665,6 +1671,11 @@ cleanup_parallel:
 			&& errno != LDAP_REFERRAL
 #endif
 		) {
+			/* ldap_res should be freed regardless of return value of ldap_search_ext_s()
+			 * see: https://linux.die.net/man/3/ldap_search_ext_s */
+			if (ldap_res != NULL) {
+				ldap_msgfree(ldap_res);
+			}
 			php_error_docref(NULL, E_WARNING, "Search: %s", ldap_err2string(errno));
 			ret = 0;
 		} else {
@@ -3438,6 +3449,7 @@ PHP_FUNCTION(ldap_parse_result)
 	/* Reverse -> fall through */
 	switch (myargcount) {
 		case 7:
+			zval_ptr_dtor(serverctrls);
 			_php_ldap_controls_to_array(ld->link, lserverctrls, serverctrls, 0);
 		case 6:
 			zval_ptr_dtor(referrals);
@@ -3992,7 +4004,7 @@ PHP_FUNCTION(ldap_control_paged_result)
 	zval *link;
 	char *cookie = NULL;
 	size_t cookie_len = 0;
-	struct berval lcookie = { 0, NULL };
+	struct berval lcookie = { 0L, NULL };
 	ldap_linkdata *ld;
 	LDAP *ldap;
 	BerElement *ber = NULL;
@@ -4287,38 +4299,31 @@ PHP_FUNCTION(ldap_exop)
 PHP_FUNCTION(ldap_exop_passwd)
 {
 	zval *link, *serverctrls;
-	struct berval luser, loldpw, lnewpw, lgenpasswd;
-	LDAPControl **lserverctrls = NULL, **requestctrls = NULL;
-	LDAPControl *ctrl, **ctrlp;
-	LDAPMessage* ldap_res;
+	struct berval luser = { 0L, NULL };
+	struct berval loldpw = { 0L, NULL };
+	struct berval lnewpw = { 0L, NULL };
+	struct berval lgenpasswd = { 0L, NULL };
+	LDAPControl *ctrl, **lserverctrls = NULL, *requestctrls[2] = { NULL, NULL };
+	LDAPMessage* ldap_res = NULL;
 	ldap_linkdata *ld;
 	int rc, myargcount = ZEND_NUM_ARGS(), msgid, err;
-	char* errmsg;
-
-	luser.bv_len = 0;
-	loldpw.bv_len = 0;
-	lnewpw.bv_len = 0;
+	char* errmsg = NULL;

 	if (zend_parse_parameters(myargcount, "r|sssz/", &link, &luser.bv_val, &luser.bv_len, &loldpw.bv_val, &loldpw.bv_len, &lnewpw.bv_val, &lnewpw.bv_len, &serverctrls) == FAILURE) {
 		return;
 	}

 	if ((ld = (ldap_linkdata *)zend_fetch_resource(Z_RES_P(link), "ldap link", le_link)) == NULL) {
-		RETURN_FALSE;
+		RETVAL_FALSE;
+		goto cleanup;
 	}

 	switch (myargcount) {
 		case 5:
-			requestctrls = safe_emalloc(2, sizeof(*requestctrls), 0);
-			*requestctrls = NULL;
-			ctrlp = requestctrls;
-
+			/* ldap_create_passwordpolicy_control() allocates ctrl */
 			if (ldap_create_passwordpolicy_control(ld->link, &ctrl) == LDAP_SUCCESS) {
-				*ctrlp = ctrl;
-				++ctrlp;
+				requestctrls[0] = ctrl;
 			}
-
-			*ctrlp = NULL;
 	}

 	/* asynchronous call to get result and controls */
@@ -4327,31 +4332,45 @@ PHP_FUNCTION(ldap_exop_passwd)
 		lnewpw.bv_len > 0 ? &lnewpw : NULL,
 		requestctrls,
 		NULL, &msgid);
+
+	if (requestctrls[0] != NULL) {
+		ldap_control_free(requestctrls[0]);
+	}
+
 	if (rc != LDAP_SUCCESS ) {
 		php_error_docref(NULL, E_WARNING, "Passwd modify extended operation failed: %s (%d)", ldap_err2string(rc), rc);
-		RETURN_FALSE;
+		RETVAL_FALSE;
+		goto cleanup;
 	}

 	rc = ldap_result(ld->link, msgid, 1 /* LDAP_MSG_ALL */, NULL, &ldap_res);
 	if ((rc < 0) || !ldap_res) {
 		rc = _get_lderrno(ld->link);
 		php_error_docref(NULL, E_WARNING, "Passwd modify extended operation failed: %s (%d)", ldap_err2string(rc), rc);
-		RETURN_FALSE;
+		RETVAL_FALSE;
+		goto cleanup;
 	}

 	rc = ldap_parse_passwd(ld->link, ldap_res, &lgenpasswd);
 	if( rc != LDAP_SUCCESS ) {
 		php_error_docref(NULL, E_WARNING, "Passwd modify extended operation failed: %s (%d)", ldap_err2string(rc), rc);
-		ldap_msgfree(ldap_res);
-		RETURN_FALSE;
+		RETVAL_FALSE;
+		goto cleanup;
 	}

-	rc = ldap_parse_result(ld->link, ldap_res, &err, NULL, &errmsg, NULL, (myargcount > 4 ? &lserverctrls : NULL), 1);
+	rc = ldap_parse_result(ld->link, ldap_res, &err, NULL, &errmsg, NULL, (myargcount > 4 ? &lserverctrls : NULL), 0);
 	if( rc != LDAP_SUCCESS ) {
 		php_error_docref(NULL, E_WARNING, "Passwd modify extended operation failed: %s (%d)", ldap_err2string(rc), rc);
-		RETURN_FALSE;
+		RETVAL_FALSE;
+		goto cleanup;
 	}

+	if (myargcount > 4) {
+		zval_ptr_dtor(serverctrls);
+		_php_ldap_controls_to_array(ld->link, lserverctrls, serverctrls, 0);
+	}
+
+	/* return */
 	if (lnewpw.bv_len == 0) {
 		if (lgenpasswd.bv_len == 0) {
 			RETVAL_EMPTY_STRING();
@@ -4365,11 +4384,16 @@ PHP_FUNCTION(ldap_exop_passwd)
 		RETVAL_FALSE;
 	}

-	if (myargcount > 4) {
-		_php_ldap_controls_to_array(ld->link, lserverctrls, serverctrls, 0);
+cleanup:
+	if (lgenpasswd.bv_val != NULL) {
+		ldap_memfree(lgenpasswd.bv_val);
+	}
+	if (ldap_res != NULL) {
+		ldap_msgfree(ldap_res);
+	}
+	if (errmsg != NULL) {
+		ldap_memfree(errmsg);
 	}
-
-	ldap_memfree(lgenpasswd.bv_val);
 }
 /* }}} */
 #endif
@@ -1734,13 +1734,17 @@ mbfl_strimwidth(
 		mbfl_convert_filter_flush(encoder);
 		if (pc.status != 0 && mkwidth > 0) {
 			pc.width += mkwidth;
-			while (n > 0) {
-				if ((*encoder->filter_function)(*p++, encoder) < 0) {
-					break;
+			if (n > 0) {
+				while (n > 0) {
+					if ((*encoder->filter_function)(*p++, encoder) < 0) {
+						break;
+					}
+					n--;
 				}
-				n--;
+				mbfl_convert_filter_flush(encoder);
+			} else if (pc.outwidth > pc.width) {
+				pc.status++;
 			}
-			mbfl_convert_filter_flush(encoder);
 			if (pc.status != 1) {
 				pc.status = 10;
 				pc.device.pos = pc.endpos;
@@ -4931,7 +4931,7 @@ static inline zend_string *php_mb_chr(zend_long cp, const char *enc_name)

 	no_enc = enc->no_encoding;
 	if (php_mb_is_unsupported_no_encoding(no_enc)) {
-		php_error_docref(NULL, E_WARNING, "Unsupported encoding \"%s\"", enc_name);
+		php_error_docref(NULL, E_WARNING, "Unsupported encoding \"%s\"", enc->name);
 		return NULL;
 	}

@@ -315,7 +315,7 @@ static int convert_case_filter(int c, void *void_data)

 	/* Handle invalid characters early, as we assign special meaning to
 	 * codepoints above 0xffffff. */
-	if (UNEXPECTED(c > 0xffffff)) {
+	if (UNEXPECTED((unsigned) c > 0xffffff)) {
 		(*data->next_filter->filter_function)(c, data->next_filter);
 		return 0;
 	}
@@ -0,0 +1,14 @@
+--TEST--
+Bug #79371 (mb_strtolower (UTF-32LE): stack-buffer-overflow)
+--SKIPIF--
+<?php
+if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
+?>
+--FILE--
+<?php
+$bytes = array(0xef, 0xbf, 0xbd, 0xef);
+$str = implode(array_map("chr", $bytes));
+var_dump(bin2hex(mb_strtolower($str, "UTF-32LE")));
+?>
+--EXPECT--
+string(8) "3f000000"
@@ -0,0 +1,13 @@
+--TEST--
+Bug #79441 Segfault in mb_chr() if internal encoding is unsupported
+--SKIPIF--
+<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+--FILE--
+<?php
+
+mb_internal_encoding("utf-7");
+mb_chr(0xd800);
+
+?>
+--EXPECTF--
+Warning: mb_chr(): Unsupported encoding "UTF-7" in %s on line %d
@@ -0,0 +1,20 @@
+--TEST--
+Bug #79787 mb_strimwidth does not trim string
+--SKIPIF--
+<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+--FILE--
+<?php
+echo mb_strimwidth("一二三", 0, 4, '.', 'UTF-8')."\n";
+echo mb_strimwidth("一二三", 0, 5, '.', 'UTF-8')."\n";
+echo mb_strimwidth("一二三", 0, 6, '.', 'UTF-8')."\n";
+echo mb_strimwidth("abcdef", 0, 4, '.', 'UTF-8')."\n";
+echo mb_strimwidth("abcdef", 0, 5, '.', 'UTF-8')."\n";
+echo mb_strimwidth("abcdef", 0, 6, '.', 'UTF-8')."\n";
+?>
+--EXPECT--
+一.
+一二.
+一二三
+abc.
+abcd.
+abcdef
@@ -30,11 +30,11 @@ Warning: mb_chr(): Unknown encoding "typo" in %s on line %d

 Warning: mb_chr(): Unsupported encoding "pass" in %s on line %d

-Warning: mb_chr(): Unsupported encoding "jis" in %s on line %d
+Warning: mb_chr(): Unsupported encoding "JIS" in %s on line %d

-Warning: mb_chr(): Unsupported encoding "cp50222" in %s on line %d
+Warning: mb_chr(): Unsupported encoding "CP50222" in %s on line %d

-Warning: mb_chr(): Unsupported encoding "utf-7" in %s on line %d
+Warning: mb_chr(): Unsupported encoding "UTF-7" in %s on line %d
 bool(false)
 bool(false)
 bool(false)
@@ -2327,7 +2327,7 @@ PHP_FUNCTION(mysqli_stmt_attr_set)
 #if MYSQL_VERSION_ID >= 50107
 	my_bool	mode_b;
 #endif
-	zend_ulong	mode;
+	unsigned long	mode;
 	zend_long	attr;
 	void	*mode_p;

@@ -2370,7 +2370,7 @@ PHP_FUNCTION(mysqli_stmt_attr_get)
 {
 	MY_STMT	*stmt;
 	zval	*mysql_stmt;
-	zend_ulong	value = 0;
+	unsigned long	value = 0;
 	zend_long	attr;
 	int		rc;

@@ -2387,7 +2387,7 @@ PHP_FUNCTION(mysqli_stmt_attr_get)
 	if (attr == STMT_ATTR_UPDATE_MAX_LENGTH)
 		value = *((my_bool *)&value);
 #endif
-	RETURN_LONG((zend_ulong)value);
+	RETURN_LONG((unsigned long)value);
 }
 /* }}} */

@@ -305,8 +305,8 @@ void mysqli_common_connect(INTERNAL_FUNCTION_PARAMETERS, zend_bool is_real_conne
 #if !defined(MYSQLI_USE_MYSQLND)
 	mysql->mysql->reconnect = MyG(reconnect);
 #endif
-
-	mysql_options(mysql->mysql, MYSQL_OPT_LOCAL_INFILE, (char *)&MyG(allow_local_infile));
+	unsigned int allow_local_infile = MyG(allow_local_infile);
+	mysql_options(mysql->mysql, MYSQL_OPT_LOCAL_INFILE, (char *)&allow_local_infile);

 end:
 	if (!mysqli_resource) {
@@ -89,7 +89,7 @@ if (!$IS_MYSQLND)
 	// F - file name
 	$trace = try_control_string($link, 't:O,' . $trace_file . ':F', $trace_file, 50);
 	// hopefully we'll never see a file name that's not covered by this regular expression...
-	if (!preg_match("@^\s*[/\w\\\\d\.\-]+\.[ch]@ismU", $trace))
+	if (!preg_match("@^\s*[/\w\\\\d\.:\-]+\.[ch]@ismU", $trace))
 		printf("[055] File names seem to be missing, first characters from trace are '%s'\n", substr($trace, 0, 80));

 	// -n - print function nesting depth
@@ -7,7 +7,7 @@ require_once('skipifemb.inc');
 require_once('skipifconnectfailure.inc');
 ?>
 --INI--
-mysqlnd.debug=d:t:O,{TMP}/mysqlnd.trace
+mysqlnd.debug="d:t:O,{TMP}/mysqlnd.trace"
 --FILE--
 <?php
 	require_once("connect.inc");
@@ -10,7 +10,7 @@ if (!$IS_MYSQLND) {
 }
 ?>
 --INI--
-mysqlnd.debug=d:t:O,{TMP}/mysqlnd.trace
+mysqlnd.debug="d:t:O,{TMP}/mysqlnd.trace"
 mysqlnd.net_read_buffer_size=1
 mysqlnd.mempool_default_size=1
 mysqlnd.fetch_data_copy=0
@@ -31,7 +31,7 @@

 /*
 * Convert from a 4-byte float to a 8-byte decimal by first converting
- * the float to a string, and then the string to a double.
+ * the float to a string (ignoring localization), and then the string to a double.
 * The decimals argument specifies the precision of the output. If decimals
 * is less than zero, then a gcvt(3) like logic is used with the significant
 * digits set to FLT_DIG i.e. 6.
@@ -42,7 +42,7 @@ static inline double mysql_float_to_double(float fp4, int decimals) {
 	if (decimals < 0) {
 		php_gcvt(fp4, FLT_DIG, '.', 'e', num_buf);
 	} else {
-		php_sprintf(num_buf, "%.*f", decimals, fp4);
+		snprintf(num_buf, MAX_CHAR_BUF_LEN, "%.*F", decimals, fp4);
 	}

 	return zend_strtod(num_buf, NULL);
@@ -481,7 +481,7 @@ mysqlnd_auth_change_user(MYSQLND_CONN_DATA * const conn,
 		conn->password.s = tmp;

 		if (conn->last_message.s) {
-			mnd_pefree(conn->last_message.s, conn->persistent);
+			mnd_efree(conn->last_message.s);
 			conn->last_message.s = NULL;
 		}
 		UPSERT_STATUS_RESET(conn->upsert_status);
@@ -1899,8 +1899,8 @@ MYSQLND_METHOD(mysqlnd_stmt, attr_set)(MYSQLND_STMT * const s,
 			break;
 		}
 		case STMT_ATTR_CURSOR_TYPE: {
-			unsigned int ival = *(unsigned int *) value;
-			if (ival > (zend_ulong) CURSOR_TYPE_READ_ONLY) {
+			unsigned long ival = *(unsigned long *) value;
+			if (ival > (unsigned long) CURSOR_TYPE_READ_ONLY) {
 				SET_CLIENT_ERROR(stmt->error_info, CR_NOT_IMPLEMENTED, UNKNOWN_SQLSTATE, "Not implemented");
 				DBG_INF("FAIL");
 				DBG_RETURN(FAIL);
@@ -1909,7 +1909,7 @@ MYSQLND_METHOD(mysqlnd_stmt, attr_set)(MYSQLND_STMT * const s,
 			break;
 		}
 		case STMT_ATTR_PREFETCH_ROWS: {
-			unsigned int ival = *(unsigned int *) value;
+			unsigned long ival = *(unsigned long *) value;
 			if (ival == 0) {
 				ival = MYSQLND_DEFAULT_PREFETCH_ROWS;
 			} else if (ival > 1) {
@@ -1948,10 +1948,10 @@ MYSQLND_METHOD(mysqlnd_stmt, attr_get)(const MYSQLND_STMT * const s,
 			*(zend_bool *) value= stmt->update_max_length;
 			break;
 		case STMT_ATTR_CURSOR_TYPE:
-			*(zend_ulong *) value= stmt->flags;
+			*(unsigned long *) value= stmt->flags;
 			break;
 		case STMT_ATTR_PREFETCH_ROWS:
-			*(zend_ulong *) value= stmt->prefetch_rows;
+			*(unsigned long *) value= stmt->prefetch_rows;
 			break;
 		default:
 			DBG_RETURN(FAIL);
@@ -993,6 +993,9 @@ int odbc_bindcols(odbc_result *result)
 			default:
 				rc = PHP_ODBC_SQLCOLATTRIBUTE(result->stmt, (SQLUSMALLINT)(i+1), colfieldid,
 								NULL, 0, NULL, &displaysize);
+				if (rc != SQL_SUCCESS) {
+					displaysize = 0;
+				}
 #if defined(ODBCVER) && (ODBCVER >= 0x0300)
 				if (rc != SQL_SUCCESS && rc != SQL_SUCCESS_WITH_INFO && colfieldid == SQL_DESC_OCTET_LENGTH) {
 					SQLINTEGER err;
@@ -1012,6 +1015,9 @@ int odbc_bindcols(odbc_result *result)
 					charextraalloc = 1;
 					rc = SQLColAttributes(result->stmt, (SQLUSMALLINT)(i+1), SQL_COLUMN_DISPLAY_SIZE,
 								NULL, 0, NULL, &displaysize);
+					if (rc != SQL_SUCCESS) {
+						displaysize = 0;
+					}
 				}

 				/* Workaround for drivers that report NVARCHAR(MAX) columns as SQL_WVARCHAR with size 0 (bug #69975) */
@@ -125,7 +125,7 @@ void zend_optimizer_compact_literals(zend_op_array *op_array, zend_optimizer_ctx
 	int l_false = -1;
 	int l_true = -1;
 	int l_empty_arr = -1;
-	HashTable hash;
+	HashTable hash, double_hash;
 	zend_string *key = NULL;
 	void *checkpoint = zend_arena_checkpoint(ctx->arena);
 	int *const_slot, *class_slot, *func_slot, *bind_var_slot, *property_slot, *method_slot;
@@ -223,6 +223,9 @@ void zend_optimizer_compact_literals(zend_op_array *op_array, zend_optimizer_ctx
 				case ZEND_POST_INC_OBJ:
 				case ZEND_POST_DEC_OBJ:
 				case ZEND_ISSET_ISEMPTY_PROP_OBJ:
+					if (opline->op1_type == IS_CONST) {
+						LITERAL_INFO(opline->op1.constant, LITERAL_VALUE, 1);
+					}
 					if (opline->op2_type == IS_CONST) {
 						LITERAL_INFO(opline->op2.constant, LITERAL_PROPERTY, 1);
 					}
@@ -329,6 +332,8 @@ void zend_optimizer_compact_literals(zend_op_array *op_array, zend_optimizer_ctx
 		/* Merge equal constants */
 		j = 0;
 		zend_hash_init(&hash, op_array->last_literal, NULL, NULL, 0);
+		/* Use separate hashtable for doubles stored as string keys, to avoid collisions. */
+		zend_hash_init(&double_hash, 0, NULL, NULL, 0);
 		map = (int*)zend_arena_alloc(&ctx->arena, op_array->last_literal * sizeof(int));
 		memset(map, 0, op_array->last_literal * sizeof(int));
 		for (i = 0; i < op_array->last_literal; i++) {
@@ -411,12 +416,12 @@ void zend_optimizer_compact_literals(zend_op_array *op_array, zend_optimizer_ctx
 					}
 					break;
 				case IS_DOUBLE:
-					if ((pos = zend_hash_str_find(&hash, (char*)&Z_DVAL(op_array->literals[i]), sizeof(double))) != NULL) {
+					if ((pos = zend_hash_str_find(&double_hash, (char*)&Z_DVAL(op_array->literals[i]), sizeof(double))) != NULL) {
 						map[i] = Z_LVAL_P(pos);
 					} else {
 						map[i] = j;
 						ZVAL_LONG(&zv, j);
-						zend_hash_str_add(&hash, (char*)&Z_DVAL(op_array->literals[i]), sizeof(double), &zv);
+						zend_hash_str_add(&double_hash, (char*)&Z_DVAL(op_array->literals[i]), sizeof(double), &zv);
 						if (i != j) {
 							op_array->literals[j] = op_array->literals[i];
 							info[j] = info[i];
@@ -494,7 +499,10 @@ void zend_optimizer_compact_literals(zend_op_array *op_array, zend_optimizer_ctx
 					break;
 			}
 		}
+
+		/* Only clean "hash", as it will be reused in the loop below. */
 		zend_hash_clean(&hash);
+		zend_hash_destroy(&double_hash);
 		op_array->last_literal = j;

 		const_slot = zend_arena_alloc(&ctx->arena, j * 6 * sizeof(int));
@@ -301,8 +301,10 @@ static void zend_ssa_remove_nops(zend_op_array *op_array, zend_ssa *ssa, zend_op
 			while (call_info) {
 				call_info->caller_init_opline -=
 					shiftlist[call_info->caller_init_opline - op_array->opcodes];
-				call_info->caller_call_opline -=
-					shiftlist[call_info->caller_call_opline - op_array->opcodes];
+				if (call_info->caller_call_opline) {
+					call_info->caller_call_opline -=
+						shiftlist[call_info->caller_call_opline - op_array->opcodes];
+				}
 				call_info = call_info->next_callee;
 			}
 		}
@@ -388,7 +390,8 @@ int zend_dfa_optimize_calls(zend_op_array *op_array, zend_ssa *ssa)
 		zend_call_info *call_info = func_info->callee_info;

 		do {
-			if (call_info->caller_call_opline->opcode == ZEND_DO_ICALL
+			if (call_info->caller_call_opline
+			 && call_info->caller_call_opline->opcode == ZEND_DO_ICALL
 			 && call_info->callee_func
 			 && ZSTR_LEN(call_info->callee_func->common.function_name) == sizeof("in_array")-1
 			 && memcmp(ZSTR_VAL(call_info->callee_func->common.function_name), "in_array", sizeof("in_array")-1) == 0
@@ -1251,7 +1251,8 @@ static void sccp_visit_instr(scdf_ctx *scdf, zend_op *opline, zend_ssa_op *ssa_o
 			}

 			call = ctx->call_map[opline - ctx->scdf.op_array->opcodes];
-			if (IS_TOP(op1) || !call || call->caller_call_opline->opcode != ZEND_DO_ICALL) {
+			if (IS_TOP(op1) || !call || !call->caller_call_opline
+					|| call->caller_call_opline->opcode != ZEND_DO_ICALL) {
 				return;
 			}

@@ -171,6 +171,10 @@ int zend_analyze_calls(zend_arena **arena, zend_script *script, uint32_t build_f
 					call_info->num_args = -1;
 				}
 				break;
+			case ZEND_EXIT:
+				/* In this case the DO_CALL opcode may have been dropped
+				 * and caller_call_opline will be NULL. */
+				break;
 		}
 		opline++;
 	}
@@ -280,7 +284,9 @@ zend_call_info **zend_build_call_map(zend_arena **arena, zend_func_info *info, z
 	for (call = info->callee_info; call; call = call->next_callee) {
 		int i;
 		map[call->caller_init_opline - op_array->opcodes] = call;
-		map[call->caller_call_opline - op_array->opcodes] = call;
+		if (call->caller_call_opline) {
+			map[call->caller_call_opline - op_array->opcodes] = call;
+		}
 		for (i = 0; i < call->num_args; i++) {
 			if (call->arg_info[i].opline) {
 				map[call->arg_info[i].opline - op_array->opcodes] = call;
@@ -1807,12 +1807,25 @@ static int zend_infer_ranges(const zend_op_array *op_array, zend_ssa *ssa) /* {{
 				}
 			} WHILE_WORKLIST_END();

-			/* Add all SCC entry variables into worklist for narrowing */
+			/* initialize missing ranges */
 			for (j = scc_var[scc]; j >= 0; j = next_scc_var[j]) {
 				if (!ssa->var_info[j].has_range) {
 					zend_inference_init_range(op_array, ssa, j, 1, ZEND_LONG_MIN, ZEND_LONG_MAX, 1);
-				} else if (ssa->vars[j].definition_phi &&
-				           ssa->vars[j].definition_phi->pi < 0) {
+					FOR_EACH_VAR_USAGE(j, ADD_SCC_VAR);
+				}
+			}
+
+			/* widening (second round) */
+			WHILE_WORKLIST(worklist, worklist_len, j) {
+				if (zend_ssa_range_widening(op_array, ssa, j, scc)) {
+					FOR_EACH_VAR_USAGE(j, ADD_SCC_VAR);
+				}
+			} WHILE_WORKLIST_END();
+
+			/* Add all SCC entry variables into worklist for narrowing */
+			for (j = scc_var[scc]; j >= 0; j = next_scc_var[j]) {
+				if (ssa->vars[j].definition_phi
+				 && ssa->vars[j].definition_phi->pi < 0) {
 					/* narrowing Phi functions first */
 					zend_ssa_range_narrowing(op_array, ssa, j, scc);
 				}
@@ -4145,7 +4158,7 @@ void zend_inference_check_recursive_dependencies(zend_op_array *op_array)
 	memset(worklist, 0, sizeof(zend_ulong) * worklist_len);
 	call_info = info->callee_info;
 	while (call_info) {
-		if (call_info->recursive &&
+		if (call_info->recursive && call_info->caller_call_opline &&
 		    info->ssa.ops[call_info->caller_call_opline - op_array->opcodes].result_def >= 0) {
 			zend_bitset_incl(worklist, info->ssa.ops[call_info->caller_call_opline - op_array->opcodes].result_def);
 		}
@@ -391,13 +391,7 @@ int zend_optimizer_update_op2_const(zend_op_array *op_array,
 				(opline + 1)->op2.var == opline->result.var) {
 				return 0;
 			}
-		case ZEND_ADD_INTERFACE:
-		case ZEND_ADD_TRAIT:
-			REQUIRES_STRING(val);
-			drop_leading_backslash(val);
-			opline->op2.constant = zend_optimizer_add_literal(op_array, val);
-			zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
-			break;
+			/* break missing intentionally */
 		case ZEND_INSTANCEOF:
 			REQUIRES_STRING(val);
 			drop_leading_backslash(val);
@@ -405,6 +399,13 @@ int zend_optimizer_update_op2_const(zend_op_array *op_array,
 			zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
 			opline->extended_value = alloc_cache_slots(op_array, 1);
 			break;
+		case ZEND_ADD_INTERFACE:
+		case ZEND_ADD_TRAIT:
+			REQUIRES_STRING(val);
+			drop_leading_backslash(val);
+			opline->op2.constant = zend_optimizer_add_literal(op_array, val);
+			zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
+			break;
 		case ZEND_INIT_FCALL_BY_NAME:
 			REQUIRES_STRING(val);
 			drop_leading_backslash(val);
@@ -31,10 +31,11 @@

 #define ACCEL_FILEMAP_NAME "ZendOPcache.SharedMemoryArea"
 #define ACCEL_MUTEX_NAME "ZendOPcache.SharedMemoryMutex"
-#define ACCEL_FILEMAP_BASE_DEFAULT 0x01000000
-#define ACCEL_FILEMAP_BASE "ZendOPcache.MemoryBase"
 #define ACCEL_EVENT_SOURCE "Zend OPcache"

+/* address of mapping base and address of execute_ex */
+#define ACCEL_BASE_POINTER_SIZE (2 * sizeof(void*))
+
 static HANDLE memfile = NULL, memory_mutex = NULL;
 static void *mapping_base;

@@ -93,28 +94,6 @@ static char *create_name_with_username(char *name)
 	return newname;
 }

-static char *get_mmap_base_file(void)
-{
-	static char windir[MAXPATHLEN+UNLEN + 3 + sizeof("\\\\@") + 1 + 32 + 21];
-	char *uname;
-	int l;
-
-	uname = php_win32_get_username();
-	if (!uname) {
-		return NULL;
-	}
-	GetTempPath(MAXPATHLEN, windir);
-	l = strlen(windir);
-	if ('\\' == windir[l-1]) {
-		l--;
-	}
-	snprintf(windir + l, sizeof(windir) - l - 1, "\\%s@%s@%.20s@%.32s", ACCEL_FILEMAP_BASE, uname, sapi_module.name, ZCG(system_id));
-
-	free(uname);
-
-	return windir;
-}
-
 void zend_shared_alloc_create_lock(void)
 {
 	memory_mutex = CreateMutex(NULL, FALSE, create_name_with_username(ACCEL_MUTEX_NAME));
@@ -143,39 +122,20 @@ static int zend_shared_alloc_reattach(size_t requested_size, char **error_in)
 {
 	int err;
 	void *wanted_mapping_base;
-	char *mmap_base_file = get_mmap_base_file();
-	FILE *fp = fopen(mmap_base_file, "r");
 	MEMORY_BASIC_INFORMATION info;
 	void *execute_ex_base;
 	int execute_ex_moved;

-	if (!fp) {
-		err = GetLastError();
-		zend_win_error_message(ACCEL_LOG_WARNING, mmap_base_file, err);
-		zend_win_error_message(ACCEL_LOG_FATAL, "Unable to open base address file", err);
-		*error_in="fopen";
-		return ALLOC_FAILURE;
-	}
-	if (!fscanf(fp, "%p", &wanted_mapping_base)) {
+	mapping_base = MapViewOfFileEx(memfile, FILE_MAP_ALL_ACCESS, 0, 0, ACCEL_BASE_POINTER_SIZE, NULL);
+	if (mapping_base == NULL) {
 		err = GetLastError();
 		zend_win_error_message(ACCEL_LOG_FATAL, "Unable to read base address", err);
 		*error_in="read mapping base";
-		fclose(fp);
 		return ALLOC_FAILURE;
 	}
-	if (!fscanf(fp, "%p", &execute_ex_base)) {
-		err = GetLastError();
-		zend_win_error_message(ACCEL_LOG_FATAL, "Unable to read execute_ex base address", err);
-		*error_in="read execute_ex base";
-		fclose(fp);
-		return ALLOC_FAILURE;
-	}
-	fclose(fp);
-
-	if (0 > win32_utime(mmap_base_file, NULL)) {
-		err = GetLastError();
-		zend_win_error_message(ACCEL_LOG_WARNING, mmap_base_file, err);
-	}
+	wanted_mapping_base = ((void**)mapping_base)[0];
+	execute_ex_base = ((void**)mapping_base)[1];
+	UnmapViewOfFile(mapping_base);

 	execute_ex_moved = (void *)execute_ex != execute_ex_base;

@@ -231,7 +191,7 @@ static int zend_shared_alloc_reattach(size_t requested_size, char **error_in)
 		}
 		return ALLOC_FAIL_MAPPING;
 	}
-	smm_shared_globals = (zend_smm_shared_globals *) mapping_base;
+	smm_shared_globals = (zend_smm_shared_globals *) ((char*)mapping_base + ACCEL_BASE_POINTER_SIZE);

 	return SUCCESSFULLY_REATTACHED;
 }
@@ -349,23 +309,12 @@ static int create_segments(size_t requested_size, zend_shared_segment ***shared_
 		*error_in = "MapViewOfFile";
 		return ALLOC_FAILURE;
 	} else {
-		char *mmap_base_file = get_mmap_base_file();
-		void *execute_ex_base = (void *)execute_ex;
-		FILE *fp = fopen(mmap_base_file, "w");
-		if (!fp) {
-			err = GetLastError();
-			zend_shared_alloc_unlock_win32();
-			zend_win_error_message(ACCEL_LOG_WARNING, mmap_base_file, err);
-			zend_win_error_message(ACCEL_LOG_FATAL, "Unable to write base address", err);
-			return ALLOC_FAILURE;
-		}
-		fprintf(fp, "%p\n", mapping_base);
-		fprintf(fp, "%p\n", execute_ex_base);
-		fclose(fp);
+		((void**)mapping_base)[0] = mapping_base;
+		((void**)mapping_base)[1] = (void*)execute_ex;
 	}

-	shared_segment->pos = 0;
-	shared_segment->size = requested_size;
+	shared_segment->pos = ACCEL_BASE_POINTER_SIZE;
+	shared_segment->size = requested_size - ACCEL_BASE_POINTER_SIZE;

 	zend_shared_alloc_unlock_win32();

@@ -3,7 +3,7 @@ Bug #71443 (Segfault using built-in webserver with intl using symfony)
 --INI--
 opcache.enable=1
 opcache.enable_cli=1
-opcache.file_cache={TMP}
+opcache.file_cache="{TMP}"
 opcache.file_cache_only=1
 --SKIPIF--
 <?php require_once('skipif.inc'); ?>