This commit was manufactured by cvs2svn to create tag 'php_4_4_4'.

session_regenerate_id()).

NEWS

@@ -1,26 +1,46 @@
 PHP 4                                                                      NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-04 Jul 2006, Version 4.4.3RC2
+17 Aug 2006, Version 4.4.4
+- Fixed memory_limit on 64bit systems. (Stefan E.)
+- Fixed overflow on 64bit systems in str_repeat() and wordwrap(). (Stefan E.)
+- Disabled CURLOPT_FOLLOWLOCATION in curl when open_basedir or safe_mode are
+  enabled. (Stefan E.)
+- Fixed a memory corruption error with an invalid foreach() call. (Stefan E.,
+  Dmitry, Derick)
+- Fixed bug #38431 (xmlrpc_get_type() crashes PHP on objects). (Tony)
+- Fixed bug #38377 (session_destroy() gives warning after
+  session_regenerate_id()). (Ilia)
+- Fixed bug #38322 (reading past array in sscanf() leads to arbitary code 
+  execution). (Tony)
+- Fixed bug #38278 (session_cache_expire()'s value does not match phpinfo's 
+  session.cache_expire). (Tony)
+- Fixed bug #38251 (socket_select() and invalid arguments). (Tony)
+- Fixed bug #38183 (disable_classes=Foobar causes disabled class to be
+  called Foo). (Jani)
+- Fixed bug #38112 (corrupted gif segfaults) (Pierre)
+- Fixed bug #37265 (Added missing safe_mode & open_basedir checks to
+  imap_body()). (Ilia)
+- Fixed bug #29538 (number_format and problem with 0). (Matthew Wilmas)
+
+03 Aug 2006, Version 4.4.3
+- Added control character checks for cURL extension's open_basedir/safe_mode
+  checks. (Ilia)
+- Added overflow checks to wordwrap() function. (Ilia)
+- Added a check for special characters in the session name. (Ilia)
 - Improved safe_mode check for the error_log() function. (Ilia)
+- Updated PCRE to version 6.6. (Andrei)
 - Fixed handling of extremely long paths inside tempnam() function. (Ilia)
 - Fixed XSS inside phpinfo() with long inputs. (Ilia)
+- Fixed a possible buffer overflow inside create_named_pipe() for Win32 systems
+  in libmysql.c. (Ilia)
 - Fixed bug #37720 (merge_php_config scrambles values). (Mike,
   pumuckel at metropolis dot de)
 - Fixed bug #37569 (WDDX incorrectly encodes high-ascii characters). (Ilia)
-
-21 May 2006, Version 4.4.3RC1
-- Added control character checks for cURL extension's open_basedir/safe_mode
-  checks. (Ilia)
-- Fixed a possible buffer overflow inside create_named_pipe() for Win32 systems
-  in libmysql.c. (Ilia)
-- Updated PCRE to version 6.6. (Andrei)
-- Added overflow checks to wordwrap() function. (Ilia)
-- Added a check for special characters in the session name. (Ilia)
-- Fixed bug #37510 session_regenerate_id changes session_id() even on failure).
+- Fixed bug #37510 (session_regenerate_id changes session_id() even on failure).
   (Hannes)
-- Fixed bug #34360 (bad gif size) (Pierre)
-- Fixed bug #37348 (make PEAR install ignore open_basedir). (Ilia)
-- Fixed bug #37346 (invalid colormap format) (Pierre)
+- Fixed bug #37360 (Memory errors with a corrupt GIF file) (Pierre)
+- Fixed bug #37348 (Make PEAR install ignore open_basedir). (Ilia)
+- Fixed bug #37346 (Crashes when using an invalid colormap format). (Pierre)
 - Fixed bug #37162 (wddx does not build as a shared extension).  
   (jdolecek at NetBSD dot org, Ilia)
 - Fixed bug #37046 (foreach breaks static scope). (Dmitry)

configure.in

@@ -40,8 +40,8 @@ AC_CONFIG_HEADER(main/php_config.h)
 
 MAJOR_VERSION=4
 MINOR_VERSION=4
-RELEASE_VERSION=3
-EXTRA_VERSION="RC2"
+RELEASE_VERSION=4
+EXTRA_VERSION=""
 VERSION="$MAJOR_VERSION.$MINOR_VERSION.$RELEASE_VERSION$EXTRA_VERSION"
 
 dnl Define where extension directories are located in the configure context

ext/curl/curl.c

@@ -924,7 +924,6 @@ PHP_FUNCTION(curl_setopt)
 		case CURLOPT_FTPLISTONLY:
 		case CURLOPT_FTPAPPEND:
 		case CURLOPT_NETRC:
-		case CURLOPT_FOLLOWLOCATION:
 		case CURLOPT_PUT:
 #if CURLOPT_MUTE != 0
 		 case CURLOPT_MUTE:
@@ -961,6 +960,16 @@ PHP_FUNCTION(curl_setopt)
 			convert_to_long_ex(zvalue);
 			error = curl_easy_setopt(ch->cp, option, Z_LVAL_PP(zvalue));
 			break;
+		case CURLOPT_FOLLOWLOCATION:
+			convert_to_long_ex(zvalue);
+			if ((PG(open_basedir) && *PG(open_basedir)) || PG(safe_mode)) {
+				if (Z_LVAL_PP(zvalue) != 0) {
+					php_error_docref(NULL TSRMLS_CC, E_WARNING, "CURLOPT_FOLLOWLOCATION cannot be activated when in safe_mode or an open_basedir is set");
+					RETURN_FALSE;
+				}
+			}
+			error = curl_easy_setopt(ch->cp, option, Z_LVAL_PP(zvalue));
+			break;
 		case CURLOPT_URL:
 		case CURLOPT_PROXY:
 		case CURLOPT_USERPWD:

ext/curl/curlstreams.c

@@ -297,7 +297,11 @@ PHPAPI php_stream *php_curl_stream_opener(php_stream_wrapper *wrapper, char *fil
 	curl_easy_setopt(curlstream->curl, CURLOPT_WRITEHEADER, stream);
 
 	/* currently buggy (bug is in curl) */
-	curl_easy_setopt(curlstream->curl, CURLOPT_FOLLOWLOCATION, 1);
+	if ((PG(open_basedir) && *PG(open_basedir)) || PG(safe_mode)) {
+		curl_easy_setopt(curlstream->curl, CURLOPT_FOLLOWLOCATION, 0);
+	} else {
+		curl_easy_setopt(curlstream->curl, CURLOPT_FOLLOWLOCATION, 1);
+	}
 	
 	curl_easy_setopt(curlstream->curl, CURLOPT_ERRORBUFFER, curlstream->errstr);
 	curl_easy_setopt(curlstream->curl, CURLOPT_VERBOSE, 0);

ext/gd/libgd/gd_gif_in.c

@@ -216,6 +216,12 @@ terminated:
        if (!im) {
 		return 0;
        }
+
+		if (!im->colorsTotal) {
+			gdImageDestroy(im);
+			return 0;
+		}
+
        /* Check for open colors at the end, so
           we can reduce colorsTotal and ultimately
           BitsPerPixel */
@@ -506,6 +512,19 @@ ReadImage(gdImagePtr im, gdIOCtx *fd, int len, int height, unsigned char (*cmap)
        int             v;
        int             xpos = 0, ypos = 0, pass = 0;
        int i;
+
+	   /*
+		**  Initialize the Compression routines
+		*/
+	   if (! ReadOK(fd,&c,1)) {
+		   return;
+	   }
+
+	   if (c > MAX_LWZ_BITS) {
+		   return;	
+	   }
+
+
        /* Stash the color map into the image */
        for (i=0; (i<gdMaxColors); i++) {
                im->red[i] = cmap[CM_RED][i];	
@@ -515,12 +534,7 @@ ReadImage(gdImagePtr im, gdIOCtx *fd, int len, int height, unsigned char (*cmap)
        }
        /* Many (perhaps most) of these colors will remain marked open. */
        im->colorsTotal = gdMaxColors;
-       /*
-       **  Initialize the Compression routines
-       */
-       if (! ReadOK(fd,&c,1)) {
-               return; 
-       }
+
        if (LWZReadByte(fd, TRUE, c) < 0) {
                return;
        }

ext/gd/tests/bug38112.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Bug #38112 (GIF Invalid Code size ).
+--SKIPIF--
+<?php 
+	if (!extension_loaded('gd')) {	
+		die("skip gd extension not available\n");
+	}
+	if (!GD_BUNDLED) {
+		die('skip external GD libraries may fail');
+	}
+?>
+--FILE--
+<?php
+$im = imagecreatefromgif(dirname(__FILE__) . '/bug38112.gif');
+?>
+--EXPECTF--
+Warning: imagecreatefromgif() [%s]: '%sbug38112.gif' is not a valid GIF file in %sbug38112.php on line %d

ext/imap/php_imap.c

@@ -731,6 +731,13 @@ static void php_imap_do_open(INTERNAL_FUNCTION_PARAMETERS, int persistent)
 		efree(IMAPG(imap_password));
 	}
 
+	/* local filename, need to perform open_basedir and safe_mode checks */
+	if (Z_STRVAL_PP(mailbox)[0] != '{' && 
+			(php_check_open_basedir(Z_STRVAL_PP(mailbox) TSRMLS_CC) || 
+			(PG(safe_mode) && !php_checkuid(Z_STRVAL_PP(mailbox), NULL, CHECKUID_CHECK_FILE_AND_DIR)))) {
+		RETURN_FALSE;
+	}
+
 	IMAPG(imap_user)     = estrndup(Z_STRVAL_PP(user), Z_STRLEN_PP(user));
 	IMAPG(imap_password) = estrndup(Z_STRVAL_PP(passwd), Z_STRLEN_PP(passwd));
 
@@ -787,6 +794,14 @@ PHP_FUNCTION(imap_reopen)
 		}
 		imap_le_struct->flags = cl_flags;	
 	}
+
+	/* local filename, need to perform open_basedir and safe_mode checks */
+	if (Z_STRVAL_PP(mailbox)[0] != '{' && 
+			(php_check_open_basedir(Z_STRVAL_PP(mailbox) TSRMLS_CC) || 
+			(PG(safe_mode) && !php_checkuid(Z_STRVAL_PP(mailbox), NULL, CHECKUID_CHECK_FILE_AND_DIR)))) {
+		RETURN_FALSE;
+	}
+
 	imap_stream = mail_open(imap_le_struct->imap_stream, Z_STRVAL_PP(mailbox), flags);
 	if (imap_stream == NIL) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Couldn't re-open stream");

ext/mbstring/tests/mb_strlen.phpt

@@ -21,35 +21,35 @@ $ascii  = 'abcdefghijklmnopqrstuvwxyz;]=#0123456789';
 
 // ASCII
 echo "== ASCII ==\n";
-print  strlen($ascii,'ASCII') . "\n";
+print  mb_strlen($ascii,'ASCII') . "\n";
 print  strlen($ascii) . "\n";
 
 // EUC-JP
 echo "== EUC-JP ==\n";
-print  strlen($euc_jp,'EUC-JP') . "\n";
+print  mb_strlen($euc_jp,'EUC-JP') . "\n";
 mb_internal_encoding('EUC-JP') or print("mb_internal_encoding() failed\n");
 print  strlen($euc_jp) . "\n";
 
 // SJIS
 echo "== SJIS ==\n";
-$sjis = mb_convert_encoding($euc_jp, 'SJIS');
-print  strlen($sjis,'SJIS') . "\n";
+$sjis = mb_convert_encoding($euc_jp, 'SJIS','EUC-JP');
+print  mb_strlen($sjis,'SJIS') . "\n";
 mb_internal_encoding('SJIS') or print("mb_internal_encoding() failed\n");
 print  strlen($sjis) . "\n";
 
 // JIS
 // Note: either convert_encoding or strlen has problem
 echo "== JIS ==\n";
-$jis = mb_convert_encoding($euc_jp, 'JIS');
-print  strlen($jis,'JIS') . "\n";
+$jis = mb_convert_encoding($euc_jp, 'JIS','EUC-JP');
+print  mb_strlen($jis,'JIS') . "\n";
 mb_internal_encoding('JIS')  or print("mb_internal_encoding() failed\n");
 print  strlen($jis) . "\n"; 
 
 // UTF-8
 // Note: either convert_encoding or strlen has problem
 echo "== UTF-8 ==\n";
-$utf8 = mb_convert_encoding($euc_jp, 'UTF-8');
-print  strlen($utf8,'UTF-8') . "\n";
+$utf8 = mb_convert_encoding($euc_jp, 'UTF-8','EUC-JP');
+print  mb_strlen($utf8,'UTF-8') . "\n";
 mb_internal_encoding('UTF-8')  or print("mb_internal_encoding() failed\n");
 print  strlen($utf8) . "\n";  
 
@@ -66,7 +66,7 @@ $r = strlen($t_obj);
 echo $r."\n";
 // Wrong encoding
 mb_internal_encoding('EUC-JP');
-$r = strlen($euc_jp, 'BAD_NAME');
+$r = mb_strlen($euc_jp, 'BAD_NAME');
 echo $r."\n";
 
 
@@ -76,28 +76,24 @@ echo $r."\n";
 
 --EXPECT--
 == ASCII ==
-ERR: Warning
-
+40
 40
 == EUC-JP ==
-ERR: Warning
-
+43
 72
 == SJIS ==
-ERR: Warning
-
+43
 72
 == JIS ==
-ERR: Warning
-
-121
+43
+90
 == UTF-8 ==
-ERR: Warning
-
-174
+43
+101
 == WRONG PARAMETERS ==
 ERR: Notice
 5
+ERR: Catchable fatal error
 ERR: Notice
 6
 ERR: Warning

ext/mbstring/tests/mb_substr.phpt

@@ -4,6 +4,7 @@ mb_substr()
 <?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
 --INI--
 output_handler=
+mbstring.func_overload=0
 --FILE--
 <?php
 // TODO: Add more encodings

ext/session/mod_files.c

@@ -368,7 +368,13 @@ PS_DESTROY_FUNC(files)
 		ps_files_close(data);
 	
 		if (VCWD_UNLINK(buf) == -1) {
-			return FAILURE;
+			/* This is a little safety check for instances when we are dealing with a regenerated session
+			 * that was not yet written to disk
+			 */
+#ifndef PHP_WIN32
+			if (!VCWD_ACCESS(buf, F_OK))
+#endif
+				return FAILURE;
 		}
 	}
 

ext/session/session.c

@@ -1405,8 +1405,8 @@ PHP_FUNCTION(session_cache_expire)
 		WRONG_PARAM_COUNT;
 
 	if (ac == 1) {
-		convert_to_long_ex(p_cache_expire);
-		PS(cache_expire) = Z_LVAL_PP(p_cache_expire);
+		convert_to_string_ex(p_cache_expire);
+		zend_alter_ini_entry("session.cache_expire", sizeof("session.cache_expire"), Z_STRVAL_PP(p_cache_expire), Z_STRLEN_PP(p_cache_expire), ZEND_INI_USER, ZEND_INI_STAGE_RUNTIME);
 	}
 
 	RETVAL_LONG(old);

ext/session/tests/bug36459.phpt

@@ -2,14 +2,14 @@
 bug #31454 (Incorrect adding PHPSESSID to links, which contains \r\n)
 --SKIPIF--
 <?php include('skipif.inc'); ?>
+--INI--
+session.use_trans_sid=1
+session.use_cookies=0
+session.name=sid
 --FILE--
 <?php
 error_reporting(E_ALL);
 
-ini_set('session.use_trans_sid', 1);
-ini_set('session.use_cookies', 0);
-ini_set('session.name', 'sid');
-
 session_start();
 
 # Do not remove \r from this tests, they are essential!

ext/session/tests/bug38377.phpt

@@ -0,0 +1,13 @@
+--TEST--
+bug #38377 (session_destroy() gives warning after session_regenerate_id())
+--SKIPIF--
+<?php include('skipif.inc'); ?>
+--FILE--
+<?php
+session_start();
+session_regenerate_id();
+session_destroy();
+echo "Done\n";
+?>
+--EXPECT--
+Done

ext/sockets/sockets.c

@@ -515,6 +515,7 @@ PHP_RSHUTDOWN_FUNCTION(sockets)
 int php_sock_array_to_fd_set(zval *sock_array, fd_set *fds, SOCKET *max_fd TSRMLS_DC) {
 	zval		**element;
 	php_socket	*php_sock;
+	int			num = 0;
 	
 	if (Z_TYPE_P(sock_array) != IS_ARRAY) return 0;
 
@@ -529,9 +530,10 @@ int php_sock_array_to_fd_set(zval *sock_array, fd_set *fds, SOCKET *max_fd TSRML
 		if (php_sock->bsd_socket > *max_fd) {
 			*max_fd = php_sock->bsd_socket;
 		}
+		num++;
 	}
 
-	return 1;
+	return num ? 1 : 0;
 }
 
 int php_sock_array_from_fd_set(zval *sock_array, fd_set *fds TSRMLS_DC) {
@@ -539,6 +541,8 @@ int php_sock_array_from_fd_set(zval *sock_array, fd_set *fds TSRMLS_DC) {
 	zval		**dest_element;
 	php_socket	*php_sock;
 	HashTable	*new_hash;
+	int			num = 0;
+
 	if (Z_TYPE_P(sock_array) != IS_ARRAY) return 0;
 
 	ALLOC_HASHTABLE(new_hash);
@@ -555,6 +559,7 @@ int php_sock_array_from_fd_set(zval *sock_array, fd_set *fds TSRMLS_DC) {
 			zend_hash_next_index_insert(new_hash, (void *)element, sizeof(zval *), (void **)&dest_element);
 			if (dest_element) zval_add_ref(dest_element);
 		}
+		num++;
 	}
 
 	/* Destroy old array, add new one */
@@ -564,7 +569,7 @@ int php_sock_array_from_fd_set(zval *sock_array, fd_set *fds TSRMLS_DC) {
 	zend_hash_internal_pointer_reset(new_hash);
 	Z_ARRVAL_P(sock_array) = new_hash;
 
-	return 1;
+	return num ? 1 : 0;
 }
 
 

ext/standard/math.c

@@ -1015,13 +1015,8 @@ PHPAPI char *_php_math_number_format(double d, int dec, char dec_point, char tho
 		is_negative = 1;
 		d = -d;
 	}
-	if (!dec_point && dec > 0) {
-		d *= pow(10, dec);
-		dec = 0;
-	} else {
-		dec = MAX(0, dec);
-	}
 
+	dec = MAX(0, dec);
 	PHP_ROUND_WITH_FUZZ(d, dec);
 
 	tmplen = spprintf(&tmpbuf, 0, "%.*f", dec, d);
@@ -1030,8 +1025,10 @@ PHPAPI char *_php_math_number_format(double d, int dec, char dec_point, char tho
 		return tmpbuf;
 	}
 
+	/* find decimal point, if expected */
+	dp = dec ? strchr(tmpbuf, '.') : NULL;
+
 	/* calculate the length of the return buffer */
-	dp = strchr(tmpbuf, '.');
 	if (dp) {
 		integral = dp - tmpbuf;
 	} else {
@@ -1047,7 +1044,11 @@ PHPAPI char *_php_math_number_format(double d, int dec, char dec_point, char tho
 	reslen = integral;
 
 	if (dec) {
-		reslen += 1 + dec;
+		reslen += dec;
+
+		if (dec_point) {
+			reslen++;
+		}
 	}
 
 	/* add a byte for minus sign */
@@ -1064,29 +1065,29 @@ PHPAPI char *_php_math_number_format(double d, int dec, char dec_point, char tho
 	 * Take care, as the sprintf implementation may return less places than
 	 * we requested due to internal buffer limitations */
 	if (dec) {
-		int declen = dp ? strlen(dp+1) : 0;
-		int topad = declen > 0 ? dec - declen : 0;
+		int declen = dp ? s - dp : 0;
+		int topad = dec > declen ? dec - declen : 0;
 
 		/* pad with '0's */
-
 		while (topad--) {
 			*t-- = '0';
 		}
 
 		if (dp) {
-			/* now copy the chars after the point */
-			memcpy(t - declen + 1, dp + 1, declen);
-
+			s -= declen + 1; /* +1 to skip the point */
 			t -= declen;
-			s -= declen;
+
+			/* now copy the chars after the point */
+			memcpy(t + 1, dp + 1, declen);
 		}
 
 		/* add decimal point */
-		*t-- = dec_point;
-		s--;
+		if (dec_point) {
+			*t-- = dec_point;
+		}
 	}
 
-	/* copy the numbers before the decimal place, adding thousand
+	/* copy the numbers before the decimal point, adding thousand
 	 * separator every three digits */
 	while(s >= tmpbuf) {
 		*t-- = *s--;

ext/standard/scanf.c

@@ -732,7 +732,7 @@ PHPAPI int php_sscanf_internal(	char *string, char *format,
                 if (*end == '$') {
                     format = end+1;
                     ch = format++;
-                    objIndex = varStart + value;
+                    objIndex = varStart + value - 1;
                 }
          }
 
@@ -762,8 +762,10 @@ PHPAPI int php_sscanf_internal(	char *string, char *format,
         switch (*ch) {
             case 'n':
                 if (!(flags & SCAN_SUPPRESS)) {
-                    if (numVars) {
-						current = args[objIndex++];
+                    if (numVars && objIndex >= argCount) {
+                        break;
+                    } else if (numVars) {
+                        current = args[objIndex++];
                         zval_dtor( *current );
                         ZVAL_LONG( *current, (long)(string - baseString) );
                     } else {
@@ -883,8 +885,10 @@ PHPAPI int php_sscanf_internal(	char *string, char *format,
                 }
             }
             if (!(flags & SCAN_SUPPRESS)) {
-                if (numVars) {
-                    current = args[objIndex++];
+                if (numVars && objIndex >= argCount) {
+                    break;
+                } else if (numVars) {
+					current = args[objIndex++];
 					zval_dtor( *current );
 					ZVAL_STRINGL( *current, string, end-string, 1);
                 } else {
@@ -922,7 +926,9 @@ PHPAPI int php_sscanf_internal(	char *string, char *format,
                 goto done;
             }
             if (!(flags & SCAN_SUPPRESS)) {
-                if (numVars) {
+                if (numVars && objIndex >= argCount) {
+                    break;
+                } else if (numVars) {
                     current = args[objIndex++];
                     zval_dtor( *current );
                     ZVAL_STRINGL( *current, string, end-string, 1);
@@ -1079,8 +1085,10 @@ PHPAPI int php_sscanf_internal(	char *string, char *format,
 		    value = (int) (*fn)(buf, NULL, base);
 		    if ((flags & SCAN_UNSIGNED) && (value < 0)) {
                 sprintf(buf, "%u", value); /* INTL: ISO digit */
-                if (numVars) {
-                  /* change passed value type to string */
+                if (numVars && objIndex >= argCount) {
+                   break;
+                } else if (numVars) {
+                   /* change passed value type to string */
                    current = args[objIndex++];
                    convert_to_string( *current );
                    ZVAL_STRING( *current, buf, 1 );
@@ -1088,7 +1096,9 @@ PHPAPI int php_sscanf_internal(	char *string, char *format,
                     add_index_string(*return_value, objIndex++, buf, 1);
                 }
             } else {
-                if (numVars) {
+                if (numVars && objIndex >= argCount) {
+                    break;
+                } else if (numVars) {
                     current = args[objIndex++];
                     convert_to_long( *current );
                     Z_LVAL(**current) = value;
@@ -1196,7 +1206,9 @@ PHPAPI int php_sscanf_internal(	char *string, char *format,
 		    double dvalue;
 		    *end = '\0';
 		    dvalue = zend_strtod(buf, NULL);
-            if (numVars) {
+            if (numVars && objIndex >= argCount) {
+                break;
+            } else if (numVars) {
                 current = args[objIndex++];
                 convert_to_double( *current );
                 Z_DVAL_PP( current ) = dvalue;

ext/standard/string.c

@@ -628,7 +628,8 @@ PHP_FUNCTION(wordwrap)
 {
 	const char *text, *breakchar = "\n";
 	char *newtext;
-	int textlen, breakcharlen = 1, newtextlen, alloced, chk;
+	int textlen, breakcharlen = 1, newtextlen, chk;
+	size_t alloced;
 	long current = 0, laststart = 0, lastspace = 0;
 	long linelength = 75;
 	zend_bool docut = 0;
@@ -3518,7 +3519,7 @@ PHP_FUNCTION(str_repeat)
 	zval		**input_str;		/* Input string */
 	zval		**mult;			/* Multiplier */
 	char		*result;		/* Resulting string */
-	int		result_len;		/* Length of the resulting string */
+	size_t		result_len;		/* Length of the resulting string */
 	
 	if (ZEND_NUM_ARGS() != 2 || zend_get_parameters_ex(2, &input_str, &mult) == FAILURE) {
 		WRONG_PARAM_COUNT;
@@ -3543,11 +3544,7 @@ PHP_FUNCTION(str_repeat)
 	
 	/* Initialize the result string */	
 	result_len = Z_STRLEN_PP(input_str) * Z_LVAL_PP(mult);
-	if (result_len < 1) {
-		php_error_docref(NULL TSRMLS_CC, E_WARNING, "You may not create strings longer than 2147483647 bytes");
-		RETURN_FALSE;
-	}
-	result = (char *)emalloc(result_len + 1);
+	result = (char *)safe_emalloc(Z_STRLEN_PP(input_str), Z_LVAL_PP(mult), 1);
 	
 	/* Heavy optimization for situations where input string is 1 byte long */
 	if (Z_STRLEN_PP(input_str) == 1) {

ext/standard/tests/file/bug22414.phpt

@@ -17,7 +17,6 @@ output_handler=
 	echo "\n";
 
 	/* Binary Data Test */
-	@unlink($pwd . '/passthru_test');
 	
 	$cmd = $php . ' -n -r \"readfile(@getenv(\'TEST_PHP_EXECUTABLE\')); \"';
 	$cmd = $php . ' -n -r \' passthru("'.$cmd.'"); \' > '.$tmpfile ;

ext/standard/tests/strings/bug29538.phpt

@@ -0,0 +1,10 @@
+--TEST--
+Bug #29538 (number_format and problem with 0)
+--FILE--
+<?php
+	echo number_format(0.25, 2, '', ''), "\n";
+	echo number_format(1234, 2, '', ',');
+?>
+--EXPECT--
+025
+1,23400

ext/standard/tests/strings/bug38322.phpt

@@ -0,0 +1,13 @@
+--TEST--
+Bug #38322 (reading past array in sscanf() leads to segfault/arbitary code execution)
+--FILE--
+<?php
+
+$str = "a b c d e";
+var_dump(sscanf("a ",'%1$s',$str));
+
+echo "Done\n";
+?>
+--EXPECTF--	
+int(1)
+Done

ext/xmlrpc/xmlrpc-epi-php.c

@@ -1492,7 +1492,7 @@ PHP_FUNCTION(xmlrpc_get_type)
 
    type = get_zval_xmlrpc_type(arg, 0);
    if (type == xmlrpc_vector) {
-      vtype = determine_vector_type(Z_ARRVAL_P(arg));
+      vtype = determine_vector_type((Z_TYPE_P(arg) == IS_OBJECT) ? Z_OBJPROP_P(arg) : Z_ARRVAL_P(arg));
    }
    
    RETURN_STRING((char*) xmlrpc_type_as_str(type, vtype), 1);

main/php_version.h

@@ -2,6 +2,6 @@
 /* edit configure.in to change version number */
 #define PHP_MAJOR_VERSION 4
 #define PHP_MINOR_VERSION 4
-#define PHP_RELEASE_VERSION 3
-#define PHP_EXTRA_VERSION "RC2"
-#define PHP_VERSION "4.4.3RC2"
+#define PHP_RELEASE_VERSION 4
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "4.4.4"

sapi/cli/php.1.in

@@ -25,7 +25,7 @@ php - PHP Command Line Interface 'CLI'
 .B PHP
 is a widely\-used general\-purpose scripting language that is especially suited for 
 Web development and can be embedded into HTML. This is the command line interface
-that enables you to the following:
+that enables you to do the following:
 .P
 You can parse and execute files by using parameter \-f followed by the name of the 
 .IR file 

tests/lang/bug35239.phpt

@@ -10,16 +10,16 @@ $a->x0->y2 =& $a->x0;
 $a->x0->y0 = 'b';
 var_dump($a);
 $a->x0->y1 = "ok\n";
-echo $a->x0;
+var_dump($a->x0);
 ?>
 --EXPECT--
-object(stdClass)#1 (1) {
+object(stdClass)(1) {
   ["x0"]=>
-  &object(stdClass)#2 (3) {
+  &object(stdClass)(3) {
     ["y0"]=>
     string(1) "b"
     ["y1"]=>
-    &object(stdClass)#2 (3) {
+    &object(stdClass)(3) {
       ["y0"]=>
       string(1) "b"
       ["y1"]=>
@@ -28,7 +28,7 @@ object(stdClass)#1 (1) {
       *RECURSION*
     }
     ["y2"]=>
-    &object(stdClass)#2 (3) {
+    &object(stdClass)(3) {
       ["y0"]=>
       string(1) "b"
       ["y1"]=>
@@ -38,4 +38,4 @@ object(stdClass)#1 (1) {
     }
   }
 }
-ok
+string(2) "ok"