5.2.11

Fix SKIPIF sections
2026-11-15 05:00:49 +00:00 · 2009-09-16 12:55:12 +00:00 · 2009-09-16 12:54:51 +00:00 · 2009-09-15 21:44:08 +00:00 · 2009-09-15 20:34:54 +00:00 · 2009-09-15 00:09:13 +00:00
1984 changed files with 98663 additions and 16235 deletions
@@ -12,6 +12,25 @@ document ____executor_globals
 	ZTS detection is automatically based on ext/standard module struct
 end

+define print_cvs
+	____executor_globals
+	set $p = $eg.current_execute_data.CVs
+	set $c = $eg.current_execute_data.op_array.last_var
+	set $v = $eg.current_execute_data.op_array.vars
+	set $i = 0
+
+	printf "Compiled variables count: %d\n", $c
+	while $i < $c
+		printf "%d = %s\n", $i, $v[$i].name
+		if $p[$i] != 0
+			printzv *$p[$i]
+		else
+			printf "*uninitialized*\n"
+		end
+		set $i = $i + 1
+	end
+end
+
 define dump_bt
 	set $t = $arg0
 	while $t
@@ -1,11 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<projectDescription>
-	<name>php-5.2</name>
-	<comment></comment>
-	<projects>
-	</projects>
-	<buildSpec>
-	</buildSpec>
-	<natures>
-	</natures>
-</projectDescription>
@@ -58,8 +58,8 @@ Exceptions:
    calling.

 [7] When commenting out code using a #if statement, do NOT use 0 only. Instead
-    use "<cvs username here>_0". For example, #if FOO_0, where FOO is your
-    cvs user foo.  This allows easier tracking of why code was commented out, 
+    use "<svn username here>_0". For example, #if FOO_0, where FOO is your
+    svn user foo.  This allows easier tracking of why code was commented out, 
    especially in bundled libraries.  

 [8] Do not define functions that are not available.  For instance, if a
@@ -386,7 +386,7 @@ Apache 2.0 on Unix systems
       http://snaps.php.net/php5-latest.tar.gz or download binaries for
       Windows http://snaps.php.net/win32/php5-win32-latest.zip.
     * a prerelease version downloadable from http://qa.php.net/.
-     * you have always the option to obtain PHP through anonymous CVS.
+     * you have always the option to obtain PHP through SVN.

     These versions of PHP are compatible to Apache 2.0.40 and later.

@@ -1303,8 +1303,8 @@ Introduction to PECL Installations

   When building PHP modules, it's important to have known-good versions
   of the required tools (autoconf, automake, libtool, etc.) See the
-   Anonymous CVS Instructions for details on the required tools, and
-   required versions.
+   SVN Instructions for details on the required tools, and required
+   versions.
     __________________________________________________________________

 Downloading PECL extensions
@@ -1320,14 +1320,11 @@ Downloading PECL extensions
       PECL extensions that have releases listed on the PECL web site are
       available for download and installation using the pecl command.
       Specific revisions may also be specified.
-     * CVS
-       Most PECL extensions also reside in CVS. A web-based view may be
-       seen at http://cvs.php.net/pecl/. To download straight from CVS,
-       the following sequence of commands may be used. Note that phpfi is
-       the password for user cvsread:
+     * SVN
+       All PECL files reside in SVN. A web-based view may be seen at
+       http://svn.php.net/pecl/. To download straight from SVN, use:

-$ cvs -d:pserver:cvsread@cvs.php.net:/repository login
-$ cvs -d:pserver:cvsread@cvs.php.net:/repository co pecl/extname
+$ svn co http://svn.php.net/repository/pecl/<extname>/trunk <extname>

     * Windows downloads
       Windows users may find compiled PECL binaries by downloading the
@@ -115,9 +115,8 @@ clean:
 	rm -f libphp$(PHP_MAJOR_VERSION).la $(SAPI_CLI_PATH) $(OVERALL_TARGET) modules/* libs/*

 distclean: clean
-	rm -f config.cache config.log config.status Makefile.objects Makefile.fragments libtool main/php_config.h stamp-h php5.spec sapi/apache/libphp$(PHP_MAJOR_VERSION).module buildmk.stamp
+	rm -f Makefile config.cache config.log config.status Makefile.objects Makefile.fragments libtool main/php_config.h stamp-h php5.spec sapi/apache/libphp$(PHP_MAJOR_VERSION).module buildmk.stamp
 	$(EGREP) define'.*include/php' $(top_srcdir)/configure | $(SED) 's/.*>//'|xargs rm -f
-	find . -name Makefile | xargs rm -f

 .PHONY: all clean install distclean test
 .NOEXPORT:
@@ -1,18 +1,328 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-12 Feb 2009, PHP 5.2.9RC2
- Fixed bug #47353 (crash when creating a lot of objects in object destructor).
-  (Tony)
- Fixed bug #47322 (sscanf %d doesn't work). (Felipe)
- Fixed bug #46026 (bz2.decompress/zlib.inflate filter tries to decompress after
-  end of stream). (Greg)
+17 Sep 2009, PHP 5.2.11
+- Fixed certificate validation inside php_openssl_apply_verification_policy.
+  (Ryan Sleevi, Ilia)

-02 Feb 2009, PHP 5.2.9RC1
+
+10 Sep 2009, PHP 5.2.11RC3
+- Updated timezone database to version 2009.13 (2009m) (Derick)
+
+- Fixed bug #49470 (FILTER_SANITIZE_EMAIL allows disallowed characters). (Ilia)
+- Fixed bug #49447 (php engine needs to correctly check for socket API return
+  status on windows). (Sriram Natarajan)
+- Fixed bug #48060 (pdo_pgsql - large objects are returned as empty). (Matteo)
+
+
+03 Sep 2009, PHP 5.2.11RC2
+- Added missing sanity checks around exif processing. (Ilia)
+
+- Fixed sanity check for the color index in imagecolortransparent. (Pierre)
+- Fixed zlib.deflate compress filter to actually accept level parameter. (Jani)
+- Fixed leak on error in popen/exec (and related functions) on Windows.
+  (Pierre)
+
+- Fixed bug #49361 (wordwrap() wraps incorrectly on end of line boundaries). 
+  (Ilia, code-it at mail dot ru)
+- Fixed bug #49289 (bcmath module doesn't compile with phpize configure).
+  (Jani)
+- Fixed bug #49286 (php://input (php_stream_input_read) is broken). (Jani)
+- Fixed bug #49269 (Ternary operator fails on Iterator object when used inside
+  foreach declaration). (Etienne, Dmitry)
+- Fixed bug #49236 (Missing PHP_SUBST(PDO_MYSQL_SHARED_LIBADD)). (Jani)
+- Fixed bug #49144 (Import of schema from different host transmits original
+  authentication details). (Dmitry)
+- Fixed bug #49000 (PHP CLI in Interactive mode (php -a) crashes when including
+  files from function). (Stas)
+- Fixed bug #48696 (ldap_read() segfaults with invalid parameters). (Felipe)
+- Fixed bug #47273 (Encoding bug in SoapServer->fault). (Dmitry)
+- Fixed bug #28038 (Sent incorrect RCPT TO commands to SMTP server) (Garrett)
+
+
+13 Aug 2009, PHP 5.2.11RC1
+- Fixed regression in cURL extension that prevented flush of data to output
+  defined as a file handle. (Ilia)
+- Fixed memory leak in stream_is_local(). (Felipe, Tony)
+
+- Fixed bug #49372 (segfault in php_curl_option_curl). (Pierre)
+- Fixed bug #49132 (posix_times returns false without error).
+  (phpbugs at gunnu dot us)
+- Fixed bug #49125 (Error in dba_exists C code). (jdornan at stanford dot edu)
+- Fixed bug #49095 (proc_get_status['exitcode'] fails on win32). (Felipe)
+- Fixed bug #49074 (private class static fields can be modified by using
+  reflection). (Jani)
+- Fixed bug #49072 (feof never returns true for damaged file in zip). (Pierre)
+- Fixed bug #49052 (context option headers freed too early when using
+  --with-curlwrappers). (Jani)
+- Fixed bug #49032 (SplFileObject::fscanf() variables passed by reference).
+  (Jani)
+- Fixed bug #49026 (proc_open() can bypass safe_mode_protected_env_vars
+  restrictions). (Ilia)
+- Fixed bug #48994 (zlib.output_compression does not output HTTP headers when
+  set to a string value). (Jani)
+- Fixed bug #48980 (Crash when compiling with pdo_firebird). (Felipe)
+- Fixed bug #48962 (cURL does not upload files with specified filename).
+  (Ilia)
+- Fixed bug #48929 (Double \r\n after HTTP headers when "header" context
+  option is an array). (David Zülke)
+- Fixed bug #48913 (Too long error code strings in pdo_odbc driver).
+  (naf at altlinux dot ru, Felipe)
+- Fixed bug #48802 (printf() returns incorrect outputted length). (Jani)
+- Fixed bug #48801 (Problem with imagettfbbox). (Takeshi Abe)
+- Fixed bug #48788 (RecursiveDirectoryIterator doesn't descend into symlinked
+  directories). (Ilia)
+- Fixed bug #48774 (SIGSEGVs when using curl_copy_handle()).
+  (Sriram Natarajan)
+- Fixed bug #48763 (ZipArchive produces corrupt archive). (dani dot church at 
+  gmail dot com, Pierre)
+- Fixed bug #48762 (IPv6 address filter still rejects valid address). (Felipe)
+- Fixed bug #48733 (CURLOPT_WRITEHEADER|CURLOPT_FILE|CURLOPT_STDERR warns on
+  files that have been opened with r+). (Ilia)
+- Fixed bug #48732 (TTF Bounding box wrong for letters below baseline).
+  (Takeshi Abe)
+- Fixed bug #48718 (FILTER_VALIDATE_EMAIL does not allow numbers in domain
+  components). (Ilia)
+- Fixed bug #48709 (metaphone and 'wh'). (brettz9 at yahoo dot com, Felipe)
+- Fixed bug #48697 (mb_internal_encoding() value gets reset by parse_str()).
+  (Moriyoshi)
+- Fixed bug #48693 (Double declaration of __lambda_func when lambda wrongly
+  formatted). (peter at lvp-media dot com, Felipe)
+- Fixed bug #48661 (phpize is broken with non-bash shells). (Jani)
+- Fixed bug #48645 (mb_convert_encoding() doesn't understand hexadecimal
+  html-entities). (Moriyoshi)
+- Fixed bug #48637 ("file" fopen wrapper is overwritten when using
+  --with-curlwrappers). (Jani)
+- Fixed bug #48636 (Error compiling of ext/date on netware). (guenter at
+  php.net, Ilia)
+- Fixed bug #48629 (get_defined_constants() ignores categorize parameter).
+  (Felipe)
+- Fixed bug #48619 (imap_search ALL segfaults). (Pierre)
+- Fixed bug #48608 (Invalid libreadline version not detected during configure).
+  (Jani)
+- Fixed bug #48555 (ImageFTBBox() differs from previous versions for texts
+  with new lines) (Takeshi Abe)
+- Fixed bug #48539 (pdo_dblib fails to connect, throws empty PDOException
+  "SQLSTATE[] (null)"). (Felipe)
+- Fixed bug #48465 (sys_get_temp_dir() possibly inconsistent when using
+  TMPDIR). (Ilia)
+- Fixed bug #48450 (Compile failure under IRIX 6.5.30 building gd.c). (Kalle)
+- Fixed bug #48400 (imap crashes when closing stream opened with
+  OP_PROTOTYPE flag). (Jani)
+- Fixed bug #48284 (hash "adler32" byte order is reversed). (Scott)
+- Fixed bug #48276 (date("Y") on big endian machines produces the
+  wrong result). (Scott)
+- Fixed bug #48247 (Infinite loop and possible crash during startup with
+  errors when errors are logged). (Jani)
+- Fixed bug #48116 (Fixed build with Openssl 1.0). (Pierre, 
+  Al dot Smith at aeschi dot ch dot eu dot org)
+- Fixed bug #48182 (ssl handshake fails during asynchronous socket connection).
+  (Sriram Natarajan)
+- Fixed bug #48057 (Only the date fields of the first row are fetched,
+  others are empty). (info at programmiernutte dot net)
+- Fixed bug #47481 (natcasesort() does not sort extended ASCII characters
+  correctly). (Herman Radtke)
+- Fixed bug #47351 (Memory leak in DateTime). (Derick, Tobias John)
+- Fixed bug #46020 (with Sun Java System Web Server 7.0 on HPUX, #define HPUX).
+  (Uwe Schindler)
+- Fixed bug #45905 (imagefilledrectangle() clipping error).
+  (markril at hotmail dot com, Pierre)
+- Fixed bug #45280 (Reflection of instantiated COM classes causes PHP to crash) 
+  (Paul Richards, Kalle)
+- Fixed bug #45141 (setcookie will output expires years of >4 digits). (Ilia)
+- Fixed bug #44683 (popen crashes when an invalid mode is passed). (Pierre)
+- Fixed bug #44144 (spl_autoload_functions() should return object instance
+  when appropriate). (Hannes, Etienne)
+- Fixed bug #43510 (stream_get_meta_data() does not return same mode as used
+  in fopen). (Jani)
+- Fixed bug #42434 (ImageLine w/ antialias = 1px shorter). (wojjie at gmail dot 
+  com, Kalle)
+
+17 Jun 2009, PHP 5.2.10
+- Updated timezone database to version 2009.9 (2009i) (Derick)
+
+- Added "ignore_errors" option to http fopen wrapper. (David Zulke, Sara)
+- Added new CURL options CURLOPT_REDIR_PROTOCOLS, CURLOPT_PROTOCOLS,
+  and CURLPROTO_* for redirect fixes in CURL 7.19.4. (Yoram Bar Haim, Stas)
+- Added support for Sun CC (FR #46595 and FR #46513). (David Soria Parra)
+
+- Changed default value of array_unique()'s optional sorting type parameter
+  back to SORT_STRING to fix backwards compatibility breakage introduced in 
+  PHP 5.2.9. (Moriyoshi)
+
+- Fixed memory corruptions while reading properties of zip files. (Ilia)
+- Fixed memory leak in ob_get_clean/ob_get_flush. (Christian)
+- Fixed segfault on invalid session.save_path. (Hannes)
+- Fixed leaks in imap when a mail_criteria is used. (Pierre)
+- Fixed missing erealloc() in fix for Bug #40091 in spl_autoload_register. (Greg)
+
+- Fixed bug #48562 (Reference recursion causes segfault when used in
+  wddx_serialize_vars()). (Felipe)
+- Fixed bug #48557 (Numeric string keys in Apache Hashmaps are not cast to
+  integers). (David Zuelke)
+- Fixed bug #48518 (curl crashes when writing into invalid file handle). (Tony)
+- Fixed bug #48514 (cURL extension uses same resource name for simple and
+  multi APIs). (Felipe)
+- Fixed bug #48469 (ldap_get_entries() leaks memory on empty search
+  results). (Patrick)
+- Fixed bug #48456 (CPPFLAGS not restored properly in phpize.m4). (Jani,
+  spisek at kerio dot com)
+- Fixed bug #48448 (Compile failure under IRIX 6.5.30 building cast.c).
+  (Kalle)
+- Fixed bug #48441 (ldap_search() sizelimit, timelimit and deref options
+  persist). (Patrick)
+- Fixed bug #48434 (Improve memory_get_usage() accuracy). (Arnaud)
+- Fixed bug #48416 (Force a cache limit in ereg() to stop excessive memory
+  usage). (Scott)
+- Fixed bug #48409 (Crash when exception is thrown while passing function
+  arguments). (Arnaud)
+- Fixed bug #48378 (exif_read_data() segfaults on certain corrupted .jpeg
+  files). (Pierre)
+- Fixed bug #48359 (Script hangs on snmprealwalk if OID is not increasing).
+  (Ilia, simonov at gmail dot com)
+- Fixed bug #48336 (ReflectionProperty::getDeclaringClass() does not work 
+  with redeclared property).
+  (patch by Markus dot Lidel at shadowconnect dot com)
+- Fixed bug #48326 (constant MSG_DONTWAIT not defined). (Arnaud)
+- Fixed bug #48313 (fgetcsv() does not return null for empty rows). (Ilia)
+- Fixed bug #48309 (stream_copy_to_stream() and fpasstru() do not update
+  stream position of plain files). (Arnaud)
+- Fixed bug #48307 (stream_copy_to_stream() copies 0 bytes when $source is a
+  socket). (Arnaud)
+- Fixed bug #48273 (snmp*_real_walk() returns SNMP errors as values).
+  (Ilia, lytboris at gmail dot com)
+- Fixed bug #48256 (Crash due to double-linking of history.o).
+  (tstarling at wikimedia dot org)
+- Fixed bug #48248 (SIGSEGV when access to private property via &__get).
+  (Felipe)
+- Fixed bug #48247 (Crash on errors during startup). (Stas)
+- Fixed bug #48240 (DBA Segmentation fault dba_nextkey). (Felipe)
+- Fixed bug #48224 (Incorrect shuffle in array_rand). (Etienne)
+- Fixed bug #48221 (memory leak when passing invalid xslt parameter).
+  (Felipe)
+- Fixed bug #48207 (CURLOPT_(FILE|WRITEHEADER options do not error out when
+  working with a non-writable stream). (Ilia)
+- Fixed bug #48206 (Iterating over an invalid data structure with
+  RecursiveIteratorIterator leads to a segfault). (Scott)
+- Fixed bug #48204 (xmlwriter_open_uri() does not emit warnings on invalid
+  paths). (Ilia)
+- Fixed bug #48203 (Crash when CURLOPT_STDERR is set to regular file). (Jani)
+- Fixed bug #48202 (Out of Memory error message when passing invalid file
+  path) (Pierre)
+- Fixed bug #48156 (Added support for lcov v1.7). (Ilia)
+- Fixed bug #48132 (configure check for curl ssl support fails with
+  --disable-rpath). (Jani)
+- Fixed bug #48131 (Don't try to bind ipv4 addresses to ipv6 ips via bindto).
+  (Ilia)
+- Fixed bug #48070 (PDO_OCI: Segfault when using persistent connection).
+  (Pierre, Matteo, jarismar dot php at gmail dot com)
+- Fixed bug #48058 (Year formatter goes wrong with out-of-int range). (Derick)
+- Fixed bug #48038 (odbc_execute changes variables used to form params array).
+  (Felipe)
+- Fixed bug #47997 (stream_copy_to_stream returns 1 on empty streams). (Arnaud)
+- Fixed bug #47991 (SSL streams fail if error stack contains items). (Mikko)
+- Fixed bug #47981 (error handler not called regardless). (Hannes)
+- Fixed bug #47969 (ezmlm_hash() returns different values depend on OS). (Ilia)
+- Fixed bug #47946 (ImageConvolution overwrites background). (Ilia)
+- Fixed bug #47940 (memory leaks in imap_body). (Pierre, Jake Levitt)
+- Fixed bug #47937 (system() calls sapi_flush() regardless of output 
+  buffering). (Ilia)
+- Fixed bug #47903 ("@" operator does not work with string offsets). (Felipe)
+- Fixed bug #47893 (CLI aborts on non blocking stdout). (Arnaud)
+- Fixed bug #47849 (Non-deep import loses the namespace). (Rob)
+- Fixed bug #47845 (PDO_Firebird omits first row from query). (Lars W)
+- Fixed bug #47836 (array operator [] inconsistency when the array has
+  PHP_INT_MAX index value). (Matt)
+- Fixed bug #47831 (Compile warning for strnlen() in main/spprintf.c).
+  (Ilia, rainer dot jung at kippdata dot de)
+- Fixed bug #47828 (openssl_x509_parse() segfaults when a UTF-8 conversion
+  fails). (Scott, Kees Cook, Pierre)
+- Fixed bug #47818 (Segfault due to bound callback param). (Felipe)
+- Fixed bug #47801 (__call() accessed via parent:: operator is provided
+  incorrect method name). (Felipe)
+- Fixed bug #47769 (Strange extends PDO). (Felipe)
+- Fixed bug #47745 (FILTER_VALIDATE_INT doesn't allow minimum integer).
+  (Dmitry)
+- Fixed bug #47721 (Alignment issues in mbstring and sysvshm extension).
+  (crrodriguez at opensuse dot org, Ilia)
+- Fixed bug #47704 (PHP crashes on some "bad" operations with string
+  offsets). (Dmitry)
+- Fixed bug #47695 (build error when xmlrpc and iconv are compiled against
+  different iconv versions). (Scott)
+- Fixed bug #47667 (ZipArchive::OVERWRITE seems to have no effect).
+  (Mikko, Pierre)
+- Fixed bug #47644 (Valid integers are truncated with json_decode()). (Scott)
+- Fixed bug #47639 (pg_copy_from() WARNING: nonstandard use of \\ in a
+  string literal). (Ilia)
+- Fixed bug #47616 (curl keeps crashing). (Felipe)
+- Fixed bug #47598 (FILTER_VALIDATE_EMAIL is locale aware). (Ilia)
+- Fixed bug #47566 (pcntl_wexitstatus() returns signed status).
+  (patch by james at jamesreno dot com)
+- Fixed bug #47564 (unpacking unsigned long 32bit bit endian returns wrong
+  result). (Ilia)
+- Fixed bug #47487 (performance degraded when reading large chunks after
+  fix of bug #44607). (Arnaud)
+- Fixed bug #47468 (enable cli|cgi-only extensions for embed sapi). (Jani)
+- Fixed bug #47435 (FILTER_FLAG_NO_PRIV_RANGE does not work with ipv6
+  addresses in the filter extension). (Ilia)
+- Fixed bug #47430 (Errors after writing to nodeValue parameter of an absent
+  previousSibling). (Rob)
+- Fixed bug #47365 (ip2long() may allow some invalid values on certain 64bit
+   systems). (Ilia)
+- Fixed bug #47254 (Wrong Reflection for extends class). (Felipe)
+- Fixed bug #47042 (cgi sapi is incorrectly removing SCRIPT_FILENAME).
+  (Sriram Natarajan, David Soria Parra)
+- Fixed bug #46882 (Serialize / Unserialize misbehaviour under OS with
+  different bit numbers). (Matt)
+- Fixed bug #46812 (get_class_vars() does not include visible private variable
+  looking at subclass). (Arnaud)
+- Fixed bug #46386 (Digest authentication with SOAP module fails against MSSQL
+  SOAP services). (Ilia, lordelph at gmail dot com)
+- Fixed bug #46109 (Memory leak when mysqli::init() is called multiple times).
+  (Andrey)
+- Fixed bug #45997 (safe_mode bypass with exec/system/passthru (windows only)).
+  (Pierre)
+- Fixed bug #45877 (Array key '2147483647' left as string). (Matt)
+- Fixed bug #45822 (Near infinite-loops while parsing huge relative offsets).
+  (Derick, Mike Sullivan)
+- Fixed bug #45799 (imagepng() crashes on empty image).
+  (Martin McNickle, Takeshi Abe)
+- Fixed bug #45622 (isset($arrayObject->p) misbehaves with
+  ArrayObject::ARRAY_AS_PROPS set). (robin_fernandes at uk dot ibm dot com, Arnaud)
+- Fixed bug #45614 (ArrayIterator::current(), ::key() can show 1st private prop
+  of wrapped object). (robin_fernandes at uk dot ibm dot com, Arnaud)
+- Fixed bug #45540 (stream_context_create creates bad http request). (Arnaud)
+- Fixed bug #45202 (zlib.output_compression can not be set with ini_set()).
+  (Jani)
+- Fixed bug #45191 (error_log ignores date.timezone php.ini val when setting
+  logging timestamps). (Derick)
+- Fixed bug #45092 (header HTTP context option not being used when compiled
+  using --with-curlwrappers). (Jani)
+- Fixed bug #44996 (xmlrpc_decode() ignores time zone on iso8601.datetime).
+  (Ilia, kawai at apache dot org) 
+- Fixed bug #44827 (define() is missing error checks for class constants).
+  (Ilia)
+- Fixed bug #44214 (Crash using preg_replace_callback() and global variables).
+  (Nuno, Scott)
+- Fixed bug #43073 (TrueType bounding box is wrong for angle<>0).
+  (Martin McNickle)
+- Fixed bug #42663 (gzinflate() try to allocate all memory with truncated
+  data). (Arnaud)
+- Fixed bug #42414 (some odbc_*() functions incompatible with Oracle ODBC
+  driver). (jhml at gmx dot net)
+- Fixed bug #42362 (HTTP status codes 204 and 304 should not be gzipped).
+  (Scott, Edward Z. Yang)
+- Fixed bug #42143 (The constant NAN is reported as 0 on Windows)
+  (Kanwaljeet Singla, Venkat Raman Don)
+- Fixed bug #38805 (PDO truncates text from SQL Server text data type field).
+  (Steph)
+
+
+26 Feb 2009, PHP 5.2.9
 - Changed __call() to be invoked on private/protected method access, similar to
  properties and __get(). (Andrei)

 - Added optional sorting type flag parameter to array_unique(). Default is
-  SORT_STRING. (Andrei)
+  SORT_REGULAR. (Andrei)

 - Fixed a crash on extract in zip when files or directories entry names contain 
  a relative path. (Pierre)
@@ -26,11 +336,17 @@ PHP                                                                        NEWS
 - Fixed bug in xml_error_string() which resulted in messages being
  off by one. (Scott)

+- Fixed bug #47422 (modulus operator returns incorrect results on 64 bit
+  linux). (Matt)
+- Fixed bug #47399 (mb_check_encoding() returns true for some illegal SJIS
+  characters). (for-bugs at hnw dot jp, Moriyoshi)
+- Fixed bug #47353 (crash when creating a lot of objects in object
+  destructor). (Tony)
+- Fixed bug #47322 (sscanf %d doesn't work). (Felipe)
 - Fixed bug #47282 (FILTER_VALIDATE_EMAIL is marking valid email addresses
  as invalid). (Ilia)
 - Fixed bug #47220 (segfault in dom_document_parser in recovery mode). (Rob)
- Fixed bug #47217 (content-type is not set properly for file uploads).
-  (Ilia)
+- Fixed bug #47217 (content-type is not set properly for file uploads). (Ilia)
 - Fixed bug #47174 (base64_decode() interprets pad char in mid string as
  terminator). (Ilia)
 - Fixed bug #47165 (Possible memory corruption when passing return value by
@@ -38,55 +354,66 @@ PHP                                                                        NEWS
 - Fixed bug #47152 (gzseek/fseek using SEEK_END produces strange results).
  (Felipe)
 - Fixed bug #47131 (SOAP Extension ignores "user_agent" ini setting). (Ilia)
- Fixed bug #47104 (Linking shared extensions fails with icc). (Jani)
 - Fixed bug #47109 (Memory leak on $a->{"a"."b"} when $a is not an object).
  (Etienne, Dmitry)
+- Fixed bug #47104 (Linking shared extensions fails with icc). (Jani)
+- Fixed bug #47049 (SoapClient::__soapCall causes a segmentation fault).
+  (Dmitry)
 - Fixed bug #47048 (Segfault with new pg_meta_data). (Felipe)
- Fixed bug #47042 (PHP cgi sapi is removing SCRIPT_FILENAME for non apache).
-  (Sriram Natarajan)
- Fixed bug #47037 (No error when using fopen with empty string). 
-  (Cristian Rodriguez R., Felipe)
- Fixed bug #47035 (dns_get_record returns a garbage byte at the end of a TXT 
-  record). (Felipe)
+- Fixed bug #47042 (PHP cgi sapi is removing SCRIPT_FILENAME for non
+  apache). (Sriram Natarajan)
+- Fixed bug #47037 (No error when using fopen with empty string). (Cristian
+  Rodriguez R., Felipe)
+- Fixed bug #47035 (dns_get_record returns a garbage byte at the end of a
+  TXT record). (Felipe)
 - Fixed bug #47027 (var_export doesn't show numeric indices on ArrayObject).
  (Derick)
- Fixed bug #46985 (OVERWRITE and binary mode does not work, regression introduced in
-  5.2.8). (Pierre)
+- Fixed bug #46985 (OVERWRITE and binary mode does not work, regression
+  introduced in 5.2.8). (Pierre)
 - Fixed bug #46973 (IPv6 address filter rejects valid address). (Felipe)
 - Fixed bug #46964 (Fixed pdo_mysql build with older version of MySQL). (Ilia)
 - Fixed bug #46959 (Unable to disable PCRE). (Scott)
- Fixed bug #46918 (imap_rfc822_parse_adrlist host part not filled in correctly).
-  (Felipe)
+- Fixed bug #46918 (imap_rfc822_parse_adrlist host part not filled in
+  correctly). (Felipe)
 - Fixed bug #46889 (Memory leak in strtotime()). (Derick)
- Fixed bug #46887 (Invalid calls to php_error_docref()).
-  (oeriksson at mandriva dot com, Ilia)
+- Fixed bug #46887 (Invalid calls to php_error_docref()). (oeriksson at
+  mandriva dot com, Ilia)
 - Fixed bug #46873 (extract($foo) crashes if $foo['foo'] exists). (Arnaud)
- Fixed bug #46843 (CP936 euro symbol is not converted properly).
-  (ty_c at cybozuy dot co dot jp, Moriyoshi)
+- Fixed bug #46843 (CP936 euro symbol is not converted properly). (ty_c at
+  cybozuy dot co dot jp, Moriyoshi)
 - Fixed bug #46798 (Crash in mssql extension when retrieving a NULL value
  inside a binary or image column type). (Ilia)
 - Fixed bug #46782 (fastcgi.c parse error). (Matt)
 - Fixed bug #46760 (SoapClient doRequest fails when proxy is used). (Felipe)
- Fixed bug #46748 (Segfault when an SSL error has more than one error). (Scott)
- Fixed bug #46739 (array returned by curl_getinfo should contain content_type key). 
-  (Mikko)
- Fixed bug #46701 (Creating associative array with long values in the key fails
-  on 32bit linux). (Shire)
+- Fixed bug #46748 (Segfault when an SSL error has more than one error).
+  (Scott)
+- Fixed bug #46739 (array returned by curl_getinfo should contain
+  content_type key). (Mikko)
 - Fixed bug #46699 (xml_parse crash when parser is namespace aware). (Rob)
- Fixed bug #46419 (Elements of associative arrays with NULL value are lost).
-  (Dmitry)
+- Fixed bug #46419 (Elements of associative arrays with NULL value are
+  lost). (Dmitry)
 - Fixed bug #46282 (Corrupt DBF When Using DATE). (arne at bukkie dot nl)
- Fixed bug #46005 (User not consistently logged under Apache2). 
-  (admorten at umich dot edu, Stas)
- Fixed bug #45996 (libxml2 2.7 causes breakage with character data 
-  in xml_parse()). (Rob)
+- Fixed bug #46026 (bz2.decompress/zlib.inflate filter tries to decompress
+  after end of stream). (Greg)
+- Fixed bug #46005 (User not consistently logged under Apache2). (admorten
+  at umich dot edu, Stas)
+- Fixed bug #45996 (libxml2 2.7 causes breakage with character data in
+  xml_parse()). (Rob)
+- Fixed bug #45940 (MySQLI OO does not populate connect_error property on
+  failed connect). (Johannes)
+- Fixed bug #45923 (mb_st[r]ripos() offset not handled correctly). (Moriyoshi)
+- Fixed bug #45327 (memory leak if offsetGet throws exception). (Greg)
 - Fixed bug #45239 (Encoding detector hangs with mbstring.strict_detection
  enabled). (Moriyoshi)
 - Fixed bug #45161 (Reusing a curl handle leaks memory). (Mark Karpeles, Jani)
- Fixed bug #44336 (Improve pcre UTF-8 string matching performance).
-  (frode at coretrek dot com, Nuno)
- Fixed bug #35975 (Session cookie expires date format isn't the most compatible.
-  Now matches that of setcookie()). (Scott)
+- Fixed bug #44336 (Improve pcre UTF-8 string matching performance). (frode
+  at coretrek dot com, Nuno)
+- Fixed bug #43841 (mb_strrpos() offset is byte count for negative values).
+  (Moriyoshi)
+- Fixed bug #37209 (mssql_execute with non fatal errors). (Kalle)
+- Fixed bug #35975 (Session cookie expires date format isn't the most
+  compatible. Now matches that of setcookie()). (Scott)
+

 08 Dec 2008, PHP 5.2.8
 - Reverted bug fix #42718 that broke magic_quotes_gpc (Scott)
@@ -103,6 +430,9 @@ PHP                                                                        NEWS
  either disable or change the compile time ini scan directory (FR #45114).
  (Jani)

+- Reverted fix for bug #44197 due to behaviour change in minor version.
+  (Felipe)
+
 - Fixed missing initialization of BG(page_uid) and BG(page_gid), 
  reported by Maksymilian Arciemowicz. (Stas)
 - Fixed memory leak inside sqlite_create_aggregate(). (Felipe)
@@ -148,8 +478,6 @@ PHP                                                                        NEWS
  attribute.(Scott)
 - Fixed a crash on invalid method in ReflectionParameter constructor.
  (Christian Seiler)
- Reverted fix for bug #44197 due to behaviour change in minor version.
-  (Felipe)

 - Fixed bug #46732 (mktime.year description is wrong). (Derick)
 - Fixed bug #46696 (cURL fails in upload files with specified content-type).
@@ -282,7 +610,6 @@ PHP                                                                        NEWS
  (Kalle, oleg dot grenrus at dynamoid dot com)
 - Fixed bug #45405 (snmp extension memory leak).
  (Federico Cuello, Rodrigo Campos)
- Fixed bug #45392 (ob_start()/ob_end_clean() and memory_limit). (Arnaud)
 - Fixed bug #45382 (timeout bug in stream_socket_enable_crypto). (Ilia)
 - Fixed bug #45373 (php crash on query with errors in params). (Felipe)
 - Fixed bug #45352 (Segmentation fault because of tick function on second
@@ -398,6 +725,8 @@ PHP                                                                        NEWS


 01 May 2008, PHP 5.2.6
+- Upgraded PCRE to version 7.6 (Nuno)
+
 - Fixed two possible crashes inside posix extension (Tony)
 - Fixed incorrect heredoc handling when label is used within the block. 
  (Matt)
@@ -417,7 +746,6 @@ PHP                                                                        NEWS
 - Fixed segfault in filter extension when using callbacks. (Arnar Mar Sig,
  Felipe)
 - Fixed faulty fix for bug #40189 (endless loop in zlib.inflate stream filter). (Greg)
- Upgraded PCRE to version 7.6 (Nuno)

 - Fixed bug #44742 (timezone_offset_get() causes segmentation faults). (Derick)
 - Fixed bug #44720 (Prevent crash within session_register()). (Scott)
@@ -8,11 +8,11 @@ part is making it acceptable for inclusion into our repository. :-)

 How to create patch?  
 -------------------- 
-We are working with CVS. You need to get CVS source to create a patch
-that we accept.  Visit http://www.php.net/anoncvs.php to get CVS
-source. You can check out older versions, but make sure you get
-the default branch (i.e. Do not use -r option when you check out the 
-CVS source)
+We use Subversion (SVN) for revision control.  You need to get the
+source from SVN in order to create a patch.  Read
+http://www.php.net/svn.php for help on using SVN.  You can check out
+older branches, but make sure you get trunk as well and make your
+patch work there.

 Read CODING_STANDARDS file before you start working.

@@ -21,7 +21,7 @@ add a new feature to PHP. After you finished editing, please test your
 patch. Read README.TESTING for testing.

 After you finish testing your patch, take diff file using 
-"cvs diff > your.patch" command.
+"svn diff > your.patch" command.

 Read README.TESTING for submitting a test script for your patch. This is
 not strictly required, but it is preferred to submit a test script along
@@ -41,25 +41,8 @@ maintainer and/or internals@lists.php.net, or pear-dev@lists.php.net if
 you are patching PEAR. Official module maintainers can be found in
 EXTENSIONS file in PHP source.

-If you are new to CVS (Concurrent Versions System), visit 
-http://cvshome.org/ for details.
-
-
-Recommended CVS client settings for creating patch file
------------------------------------------------------
-Recommended ~/.cvsrc file setting is:
------
-cvs -z3
-update -d -P
-checkout -P
-diff -u
-
------
-diff -u means:
- -u     Use the unified output format.
-
-With this CVS setting, you don't have to worry about adding/deleting
-newlines and spaces.
+If you are new to SVN (Subversion), visit
+http://svnbook.red-bean.com/ for details.


 Check list for submitting patch
@@ -70,10 +53,7 @@ Check list for submitting patch
   web server error logs when you test your patch?
 - Did you build PHP for multi-threaded web servers. (Optional)
 - Did you create test script for "make test"? (Recommended)
- - Did you check your patch is unified format and it does not 
-   contain white space changes? (If you are not using recommended 
-   cvs setting)
- - Did you update CVS source before you take final patch?
+ - Did you update SVN source before you take final patch?
 - Did you read the patch again?


@@ -118,7 +98,7 @@ these questions:

 What happens when your patch is applied?
 ---------------------------------------- 
-Your name will be included together with your email address in the CVS 
+Your name will be included together with your email address in the SVN 
 commit log. If your patch affects end-users, a brief description
 and your name might be added to the NEWS file.

@@ -1,24 +1,31 @@
-This is the first file you should be reading after you get your CVS account.
-We'll assume you're basically familiar with CVS, but feel free to post
-your questions on the mailing list. Please have a look at 
-http://cvsbook.red-bean.com/ for more detailed information on CVS.
+====================
+  SVN Commit Rules
+====================
+
+This is the first file you should be reading after you get your SVN account.
+We'll assume you're basically familiar with SVN, but feel free to post
+your questions on the mailing list. Please have a look at
+http://svnbook.red-bean.com/ for more detailed information on SVN.

 PHP is developed through the efforts of a large number of people.
-Collaboration is a Good Thing(tm), and CVS lets us do this. Thus, following
-some basic rules with regards to CVS usage will:
+Collaboration is a Good Thing(tm), and SVN lets us do this. Thus, following
+some basic rules with regards to SVN usage will::

   a. Make everybody happier, especially those responsible for maintaining
-      the CVS itself.
+      the SVN itself.
+
   b. Keep the changes consistently well documented and easily trackable.
+
   c. Prevent some of those 'Oops' moments.
+
   d. Increase the general level of good will on planet Earth.

-
-Having said that, here are the organizational rules:
+Having said that, here are the organizational rules::

   1. Respect other people working on the project.

-   2. Discuss any significant changes on the list before committing. 
+   2. Discuss any significant changes on the list before committing and get
+      confirmation from the release manager for the given branch.

   3. Look at EXTENSIONS file to see who is the primary maintainer of
      the code you want to contribute to.
@@ -30,45 +37,54 @@ Having said that, here are the organizational rules:

   6. Test your changes before committing them. We mean it. Really.
      To do so use "make test".
-   
+
   7. For development use the --enable-maintainer-zts switch to ensure your
      code handles TSRM correctly and doesn't break for thos who need that.

-Currently we have the following branches in use:
-HEAD     Will become PHP 6.0. This CVS branch is for active development.
-PHP_5_2  Is used to release the PHP 5.2.x series. Only minor feature
-         enhancements may go in here, but please keep that as infrequent as
-         possible.
-PHP_5_1  This branch is closed.
-PHP_4_4  Is used to release the PHP 4.4.x series. Only bugfixes are permitted
-         on this branch (Consult the releasemaster prior to commit).
-PHP_4_3  This branch is closed.
+Currently we have the following branches in use::

-The next few rules are more of a technical nature.
+  trunk             Will become PHP 6.0. This CVS branch is for active development.

-   1. DO NOT TOUCH ChangeLog! It is automagically updated from the commit
+  branches/PHP_5_3  Is used to release the PHP 5.3.x series. It still allows for
+                    larger enhancements.
+
+  branches/PHP_5_2  Is used to release the PHP 5.2.x series. Only bugfixes are permitted
+                    on this branch (Consult the releasemaster prior to commit).
+
+  branches/PHP_5_1  This branch is closed.
+
+  branches/PHP_4_4  This branch is closed.
+
+The next few rules are more of a technical nature::
+
+   1. All changes should first go to trunk and then get merged from trunk
+      (aka MFH'ed) to all other relevant branches.
+
+   2. DO NOT TOUCH ChangeLog! It is automagically updated from the commit
      messages every day. Woe be to those who attempt to mess with it.

-   2. All news updates intended for public viewing, such as new features,
-      bug fixes, improvements, etc., should go into the NEWS file. 
-	  
+   3. All news updates intended for public viewing, such as new features,
+      bug fixes, improvements, etc., should go into the NEWS file of the
+      *first* to be released version with the given change. In other words
+      any NEWS file change only needs to done in one branch.
+
      NB! Lines, starting with @ will go automagically into NEWS file, but
-      this is NOT recommended, though. Please, add news entries directly to 
+      this is NOT recommended, though. Please, add news entries directly to
      NEWS file and don't forget to keep them adjusted and sorted.

-   3. Do not commit multiple file and dump all messages in one commit. If you
+   4. Do not commit multiple file and dump all messages in one commit. If you
      modified several unrelated files, commit each group separately and
      provide a nice commit message for each one. See example below.

-   4. Do write your commit message in such a way that it makes sense even
+   5. Do write your commit message in such a way that it makes sense even
      without the corresponding diff. One should be able to look at it, and
      immediately know what was modified. Definitely include the function name
      in the message as shown below.

-   5. In your commit messages, keep each line shorter than 80 characters. And
+   6. In your commit messages, keep each line shorter than 80 characters. And
      try to align your lines vertically, if they wrap. It looks bad otherwise.

-   6. If you modified a function that is callable from PHP, prepend PHP to
+   7. If you modified a function that is callable from PHP, prepend PHP to
      the function name as shown below.


@@ -80,7 +96,7 @@ If a line begins with #, it is taken to be a comment and will not appear
 in the ChangeLog. Everything else goes into the ChangeLog.

 It is important to note that if your comment or news logline spans multiple
-lines, you have to put # at the beginning of _every_ such line. 
+lines, you have to put # at the beginning of **every** such line.

 Example. Say you modified two files, datetime.c and string.c. In datetime.c you
 added a new format option for the date() function, and in string.c you fixed a
@@ -88,13 +104,15 @@ memory leak in php_trim(). Don't commit both of these at once. Commit them
 separately and try to make sure your commit messages look something like the
 following.

-For datetime.c:
- Added new 'K' format modifier to date() for printing out number of days until
-  New Year's Eve.
+For datetime.c::

-For string.c:
- Fixed a memory leak in php_trim() resulting from improper use of zval_dtor().
-#- Man, that thing was leaking all over the place!
+  - Added new 'K' format modifier to date() for printing out number of days
+    until New Year's Eve.
+
+For string.c::
+
+  - Fixed a memory leak in php_trim() resulting from improper use of zval_dtor().
+  #- Man, that thing was leaking all over the place!

 The # lines will be omitted from the ChangeLog automagically.

@@ -106,16 +124,19 @@ If you fix some bugs, you should note the bug ID numbers in your
 commit message. Bug ID should be prefixed by "#" for easier access to
 bug report when developers are browsing CVS via LXR or Bonsai.

-Example:
+Example::

-Fixed bug #14016 (pgsql notice handler double free crash bug.)
+  Fixed bug #14016 (pgsql notice handler double free crash bug.)

 If you don't see your messages in ChangeLog right away, don't worry!
 These files are updated once a day, so your stuff will not show up until
-somewhat later. 
+somewhat later.
+
+When you change the NEWS file for a bug fix, then please keep the bugs
+sorted in decreasing order under the fixed version.

 You can use LXR (http://lxr.php.net/) and Bonsai (http://bonsai.php.net/)
-to look at PHP CVS repository in various ways.
+to look at PHP SVN repository in various ways.

 To receive daily updates to ChangeLog and NEWS, send an empty message to
 php-cvs-daily-subscribe@lists.php.net.
@@ -32,11 +32,12 @@ sapi/cli/php [-c /path/to/php.ini] run-tests.php [ext/foo/tests/GLOB]

 [Which "php" executable "make test" look for]
 ---------------------------------------------
- You must use TEST_PHP_EXECUTABLE environment variable to explicitly
-select the php executable to be used to run the tests. That can either
-be the CLI or CGI executable.
+If you are running the run-tests.php script from the command line (as above)
+you must set the TEST_PHP_EXECUTABLE environment variable to explicitly
+select the PHP executable that is to be tested, that is, used to run the test scripts.

- "make test" executes "run-tests.php" script with "php" binary.  Some
+If you run the tests using make test, the PHP CLI and CGI executables are 
+automatically set for you. "make test" executes "run-tests.php" script with the CLI binary.  Some
 test scripts such as session must be executed by CGI SAPI. Therefore,
 you must build PHP with CGI SAPI to perform all tests.

@@ -179,20 +179,39 @@ TSRM_API FILE *popen(const char *command, const char *type)
 TSRM_API FILE *popen_ex(const char *command, const char *type, const char *cwd, char *env)
 {
 	FILE *stream = NULL;
-	int fno, str_len = strlen(type), read, mode;
+	int fno, type_len = strlen(type), read, mode;
 	STARTUPINFO startup;
 	PROCESS_INFORMATION process;
 	SECURITY_ATTRIBUTES security;
 	HANDLE in, out;
-	char *cmd;
 	process_pair *proc;
+	char *cmd;
+	int i;
+	char *ptype = (char *)type;
 	TSRMLS_FETCH();

+	if (!type) {
+		return NULL;
+	}
+
+	/*The following two checks can be removed once we drop XP support */
+	type_len = strlen(type);
+	if (type_len <1 || type_len > 2) {
+		return NULL;
+	}
+
+	for (i=0; i < type_len; i++) {
+		if (!(*ptype == 'r' || *ptype == 'w' || *ptype == 'b' || *ptype == 't')) {
+			return NULL;
+		}
+		ptype++;
+	}
+
 	security.nLength				= sizeof(SECURITY_ATTRIBUTES);
 	security.bInheritHandle			= TRUE;
 	security.lpSecurityDescriptor	= NULL;

-	if (!str_len || !CreatePipe(&in, &out, &security, 2048L)) {
+	if (!type_len || !CreatePipe(&in, &out, &security, 2048L)) {
 		return NULL;
 	}

@@ -204,7 +223,7 @@ TSRM_API FILE *popen_ex(const char *command, const char *type, const char *cwd,
 	startup.hStdError	= GetStdHandle(STD_ERROR_HANDLE);

 	read = (type[0] == 'r') ? TRUE : FALSE;
-	mode = ((str_len == 2) && (type[1] == 'b')) ? O_BINARY : O_TEXT;
+	mode = ((type_len == 2) && (type[1] == 'b')) ? O_BINARY : O_TEXT;


 	if (read) {
@@ -220,6 +239,7 @@ TSRM_API FILE *popen_ex(const char *command, const char *type, const char *cwd,
 	cmd = (char*)malloc(strlen(command)+strlen(TWG(comspec))+sizeof(" /c "));
 	sprintf(cmd, "%s /c %s", TWG(comspec), command);
 	if (!CreateProcess(NULL, cmd, &security, &security, security.bInheritHandle, NORMAL_PRIORITY_CLASS|CREATE_NO_WINDOW, env, cwd, &startup, &process)) {
+		free(cmd);
 		return NULL;
 	}
 	free(cmd);
@@ -381,12 +381,12 @@ ext/pfpro           not actively maintained
 ext/w32api          pecl/ffi
 ext/yp              not actively maintained
 sapi/activescript   http://pecl4win.php.net/ext.php/php5activescript.dll (PECL package)
-                    or pecl/activescript (CVS)
+                    or pecl/activescript (SVN)

 Modules in PECL that are not actively maintained (i.e. have not been supported
 for some time, have no active maintainer working on them currently, and do not
-have any PECL package releases), are still available in CVS at
-http://cvs.php.net/pecl/. However, unreleased PHP modules are by their nature
+have any PECL package releases), are still available in SVN at
+http://svn.php.net/pecl/. However, unreleased PHP modules are by their nature
 unsupported, and your mileage may vary when attempting to install or use them.

 9b. Class constants in new PHP 5.1 extensions
@@ -4,7 +4,7 @@ dnl This file contains local autoconf functions.

 AC_DEFUN([LIBZEND_BISON_CHECK],[
  # we only support certain bison versions
-  bison_version_list="1.28 1.35 1.75 1.875 2.0 2.1 2.2 2.3 2.4"
+  bison_version_list="1.28 1.35 1.75 1.875 2.0 2.1 2.2 2.3 2.4 2.4.1"

  # for standalone build of Zend Engine
  test -z "$SED" && SED=sed
@@ -60,7 +60,7 @@ int(%d)
 Warning: get_loaded_extensions() expects at most 1 parameter, 2 given in %s on line %d
 NULL

-Warning: Wrong parameter count for get_defined_constants() in %s on line %d
+Warning: get_defined_constants() expects at most 1 parameter, 2 given in %s on line %d
 NULL
 string(5) "array"
 string(5) "array"
@@ -359,7 +359,8 @@ var_dump($global_var);

 //Note: No error conditions relating to passing arugments can be tested
 // because these are not functions but statements, it will result in syntax error.
-echo "Done\n";
+?>
+===DONE===
 --EXPECTF--
 *** Testing unset(), empty() & isset() with scalar variables ***
 -- Iteration 1 --
@@ -1185,11 +1186,11 @@ bool(true)

 *** Testing unset(), emtpy() & isset() with resource variables ***
 -- Iteration 1 --
-resource(5) of type (stream)
+resource(%d) of type (stream)
 bool(true)
 bool(false)
 bool(true)
-resource(5) of type (stream)
+resource(%d) of type (stream)
 bool(false)
 bool(true)
 bool(false)
@@ -1198,11 +1199,11 @@ bool(false)
 Notice: Undefined variable: resource in %s on line %d
 NULL
 -- Iteration 2 --
-resource(6) of type (stream)
+resource(%d) of type (stream)
 bool(true)
 bool(false)
 bool(true)
-resource(6) of type (stream)
+resource(%d) of type (stream)
 bool(false)
 bool(true)
 bool(false)
@@ -1217,7 +1218,7 @@ bool(false)
 bool(true)

 *** Testing unset(), empty() & isset() with objects ***
-object(Point)#1 (3) {
+object(Point)#%d (3) {
  ["x"]=>
  int(30)
  ["y"]=>
@@ -1239,7 +1240,7 @@ bool(false)

 Notice: Undefined variable: lable in %s on line %d
 bool(true)
-object(Point)#1 (3) {
+object(Point)#%d (3) {
  ["x"]=>
  int(30)
  ["y"]=>
@@ -1247,7 +1248,7 @@ object(Point)#1 (3) {
  ["lable"]=>
  string(6) "Point1"
 }
-object(Point)#1 (2) {
+object(Point)#%d (2) {
  ["y"]=>
  int(40)
  ["lable"]=>
@@ -1255,7 +1256,7 @@ object(Point)#1 (2) {
 }
 bool(false)
 bool(true)
-object(Point)#1 (0) {
+object(Point)#%d (0) {
 }
 bool(true)
 bool(false)
@@ -1276,7 +1277,7 @@ array(3) {
  [2]=>
  string(9) "testPoint"
 }
-object(Point)#1 (3) {
+object(Point)#%d (3) {
  ["x"]=>
  int(5)
  ["y"]=>
@@ -1329,4 +1330,4 @@ bool(false)
 bool(false)
 bool(true)
 int(10)
-Done
+===DONE===
@@ -41,12 +41,14 @@ $db = new hariCow;

 var_dump($db);
 ?>
+===DONE===
 --EXPECTF--
 Notice: Undefined variable: db in %sbug30162.php on line 35
 NULL
-object(hariCow)#1 (2) {
+object(hariCow)#%d (2) {
  ["x"]=>
  string(1) "x"
  ["y"]=>
  string(1) "y"
 }
+===DONE===
@@ -0,0 +1,82 @@
+--TEST--
+Bug #39018 (Error control operator '@' fails to suppress "Uninitialized string offset")
+--FILE--
+<?php
+
+error_reporting(E_ALL);
+
+$a = 'foo';
+$a[11111111111];
+
+$a = '';
+
+$a[0];
+
+print $a[0]; // 12
+
+$a[-11111111111111111111111];
+
+print $a[-11111111111111111111111]; // 16
+
+$a[-0];
+
+$x = 'test';
+
+@$x[4];
+
+@$y = $x[4];
+
+@('a' == $x[4]);
+
+$x[4] == 'a'; // 28
+
+@$x[4] == 'a';
+
+(@$x[4]) == 'a';
+
+($x[4]) == 'a'; // 34
+
+(@($x[4])) == 'a';
+
+(($x[4])) == 'a'; // 38
+
+@($x[4]) == 'a';
+
+($x[4]) == 'a'; // 42
+
+@($x[4] == 'a');
+
+($x[4] == 'a'); // 46
+
+$y = 'foobar';
+
+$y[12.2];
+
+print $y[12.2]; // 52
+
+$y[3.5];
+
+print $y[3.5]; // 56
+
+print "\nDone\n";
+
+?>
+--EXPECTF--
+
+Notice: Uninitialized string offset: 0 in %s on line 12
+
+Notice: Uninitialized string offset: -%d in %s on line 16
+
+Notice: Uninitialized string offset: 4 in %s on line 28
+
+Notice: Uninitialized string offset: 4 in %s on line 34
+
+Notice: Uninitialized string offset: 4 in %s on line 38
+
+Notice: Uninitialized string offset: 4 in %s on line 42
+
+Notice: Uninitialized string offset: 4 in %s on line 46
+
+Notice: Uninitialized string offset: 12 in %s on line 52
+b
+Done
@@ -0,0 +1,18 @@
+--TEST--
+Bug #39018 [2] (Error control operator '@' fails to suppress "Uninitialized string offset")
+--FILE--
+<?php
+
+error_reporting(E_ALL);
+
+$foo = 'test';
+$x = @$foo[6];
+
+print @($foo[100] + $foo[130]);
+
+print "\nDone\n";
+
+?>
+--EXPECT--
+0
+Done
@@ -6,4 +6,6 @@ Bug #39304 (Segmentation fault with list unpacking of string offset)
  list($a, $b) = $s[0];
 ?>
 --EXPECTF--
-Fatal error: Cannot use string offset as an array in %sbug39304.php on line 3
+Notice: Uninitialized string offset: 0 in %s on line %d
+
+Fatal error: Cannot use string offset as an array in %sbug39304.php on line %d
@@ -8,4 +8,6 @@ $foo[3]->bar[1] = "bang";
 echo "ok\n";
 ?>
 --EXPECTF--
+Notice: Uninitialized string offset: 3 in %s on line %d
+
 Fatal error: Cannot use string offset as an object in %sbug41919.php on line %d
@@ -0,0 +1,38 @@
+--TEST--
+bug #42143 (The constant NAN is reported as 0 on Windows build)
+--CREDITS--
+Venkat Raman Don
+--FILE--
+<?php
+echo "Testing NAN:\n";
+echo "NAN= ";
+var_dump(NAN);
+var_dump(tan(-1) == 123);
+var_dump(cos(-100) == "PHP String");
+var_dump(deg2rad(-5.6) == null);
+var_dump(sqrt(-0.1) == false);
+var_dump(sqrt(cos(M_PI)) == 0.1);
+var_dump(NAN);
+var_dump(is_nan(sqrt(-1.005)) == false);
+var_dump(is_nan(floor(1)) == true);
+var_dump(log10(-1) == log(-1));
+var_dump(log10(-1) != log10(-1));
+var_dump(is_finite(log10(-1)) == false);
+var_dump(NAN == NAN);
+?>
+--EXPECT--
+Testing NAN:
+NAN= float(NAN)
+bool(false)
+bool(false)
+bool(false)
+bool(false)
+bool(false)
+float(NAN)
+bool(false)
+bool(false)
+bool(false)
+bool(true)
+bool(true)
+bool(false)
+
@@ -1,7 +1,7 @@
 --TEST--
 Bug #45805 (Crash on throwing exception from error handler)
 --SKIPIF--
-<?php extension_loaded('reflection') or die('skip'); ?>
+<?php if (!extension_loaded('reflection') || !extension_loaded('spl')) print "skip"; ?>
 --FILE--
 <?php
 class PHPUnit_Util_ErrorHandler
@@ -0,0 +1,23 @@
+--TEST--
+Bug #45877 (Array key '2147483647' left as string)
+--INI--
+precision=20
+--FILE--
+<?php
+$keys = array(PHP_INT_MAX,
+	(string) PHP_INT_MAX,
+	(string) (-PHP_INT_MAX - 1),
+	-PHP_INT_MAX - 1,
+	(string) (PHP_INT_MAX + 1));
+
+var_dump(array_fill_keys($keys, 1));
+?>
+--EXPECTF--
+array(3) {
+  [%d7]=>
+  int(1)
+  [-%d8]=>
+  int(1)
+  ["%d8"]=>
+  int(1)
+}
@@ -1,7 +1,7 @@
 --TEST--
 Bug #46701 (Creating associative array with long values in the key fails on 32bit linux)
 --SKIPIF--
-<?php if (PHP_INT_MAX != 4) die('skip this test is for 32bit platforms only'); ?>
+<?php if (PHP_INT_SIZE != 4) die('skip this test is for 32bit platforms only'); ?>
 --FILE--
 <?php

@@ -27,16 +27,12 @@ new foo;

 ?>
 --EXPECT--
-array(3) {
-  [-866368000]=>
-  int(1)
-  [-835511808]=>
-  int(2)
-  [-835350528]=>
-  int(3)
-}
-int(2)
 array(1) {
-  [-835350528]=>
+  [-2147483648]=>
+  int(3)
+}
+int(3)
+array(1) {
+  [-2147483648]=>
  int(3)
 }
@@ -0,0 +1,9 @@
+--TEST--
+Bug #47704 (crashes on some "bad" operations with string offsets)
+--FILE--
+<?php
+$s = "abd";
+$s[0]->a += 1;
+?>
+--EXPECTF--
+Fatal error: Cannot use string offset as an object in %sbug47704.php on line %d
@@ -0,0 +1,31 @@
+--TEST--
+Bug #47801 (__call() accessed via parent:: operator is provided incorrect method name)
+--FILE--
+<?php
+
+class A
+{
+  function __call($name, $args)
+  {
+    echo("magic method called: $name\n");
+  }
+}
+
+class B extends A
+{
+  function getFoo()
+  {
+    parent::getFoo();
+  }
+}
+
+$a = new A();
+$a->getFoo();
+
+$b = new B();
+$b->getFoo();
+
+?>
+--EXPECT--
+magic method called: getFoo
+magic method called: getFoo
@@ -0,0 +1,16 @@
+--TEST--
+Bug #47836 (array operator [] inconsistency when the array has PHP_INT_MAX index value)
+--FILE--
+<?php
+
+$arr[PHP_INT_MAX] = 1;
+$arr[] = 2;
+
+var_dump($arr);
+?>
+--EXPECTF--
+Warning: Cannot add element to the array as the next element is already occupied in %s on line 4
+array(1) {
+  [%d]=>
+  int(1)
+}
@@ -0,0 +1,19 @@
+--TEST--
+Bug #47981 (error handler not called regardless)
+--INI--
+error_reporting=0
+--FILE--
+<?php
+function errh($errno, $errstr) {
+	var_dump($errstr);
+}
+set_error_handler("errh");
+
+interface a{}
+class b implements a { function f($a=1) {}}
+class c extends b {function f() {}}
+?>
+--EXPECTF--
+string(62) "Declaration of c::f() should be compatible with that of b::f()"
+
+
@@ -0,0 +1,32 @@
+--TEST--
+Bug #48228 (crash when exception is thrown while passing function arguments)
+--FILE--
+<?php
+
+function do_throw() {
+	throw new Exception();
+}
+
+class aa 
+{
+	function check()
+	{
+	}
+
+	function dosome()
+	{
+		$this->check(do_throw());
+	}
+}
+$l_aa=new aa();
+
+$l_aa->dosome();
+?>
+--EXPECTF--
+
+Fatal error: Uncaught exception 'Exception' in %s
+Stack trace:
+#0 %s(%d): do_throw()
+#1 %s(%d): aa->dosome()
+#2 {main}
+  thrown in %s
@@ -0,0 +1,27 @@
+--TEST--
+Bug #48248 (SIGSEGV when access to private property via &__get)
+--FILE--
+<?php
+
+class A
+{
+    public function & __get($name)
+    {
+        return $this->test;
+    }
+}
+
+class B extends A
+{
+    private $test;
+}
+
+$b = new B;
+var_dump($b->test);
+
+?>
+--EXPECTF--
+Notice: Undefined property: B::$test in %s on line %d
+
+Notice: Only variable references should be returned by reference in %s on line %d
+NULL
@@ -0,0 +1,30 @@
+--TEST--
+Bug #48408 (crash when exception is thrown while passing function arguments)
+--FILE--
+<?php
+class B{
+	public function process($x){
+		return $x;
+	}
+}
+class C{
+	public function generate($x){
+		throw new Exception;
+	}
+}
+$b = new B;
+$c = new C;
+try{
+	$b->process($c->generate(0));
+}
+catch(Exception $e){
+	$c->generate(0);
+}
+?>
+--EXPECTF--
+
+Fatal error: Uncaught exception 'Exception' in %s
+Stack trace:
+#0 %s(%d): C->generate(0)
+#1 {main}
+  thrown in %s
@@ -0,0 +1,67 @@
+--TEST--
+Bug #48409 (crash when exception is thrown while passing function arguments)
+--FILE--
+<?php
+
+class ABCException extends Exception {}
+
+class BBB
+{
+	public function xyz($d, $x)
+	{
+		if ($x == 34) {
+			throw new ABCException;
+		}
+		return array('foo' => 'xyz');
+	}
+}
+	
+class CCC
+{
+	public function process($p)
+	{
+		return $p;
+	}
+}
+
+class AAA
+{
+	public function func()
+	{
+		$b = new BBB;
+		$c = new CCC;
+		$i = 34;
+		$item = array('foo' => 'bar');
+		try {
+			$c->process($b->xyz($item['foo'], $i));
+		}
+		catch(ABCException $e) {
+			$b->xyz($item['foo'], $i);
+		}
+	} // end func();
+}
+
+class Runner
+{
+	public function run($x)
+	{
+		try {
+			$x->func();
+		}
+		catch(ABCException $e) {
+			throw new Exception;
+		}
+	}
+}
+
+try {
+	$runner = new Runner;
+	$runner->run(new AAA);
+}
+catch(Exception $e) {
+	die('Exception thrown');
+}
+
+?>
+--EXPECT--
+Exception thrown
@@ -0,0 +1,13 @@
+--TEST--
+Bug #48428 (crash when exception is thrown while passing function arguments)
+--FILE--
+<?php
+try {
+		function x() { throw new Exception("ERROR"); }
+				x(x());
+} catch(Exception $e) {
+		echo($e -> getMessage());
+}
+?>
+--EXPECT--
+ERROR
@@ -0,0 +1,28 @@
+--TEST--
+Bug #48693 (Double declaration of __lambda_func when lambda wrongly formatted)
+--FILE--
+<?php
+
+$x = create_function('', 'return 1; }');
+$y = create_function('', 'function a() { }; return 2;');
+$z = create_function('', '{');
+$w = create_function('', 'return 3;');
+
+var_dump(
+	$x,
+	$y(),
+	$z,
+	$w(),
+	$y != $z
+);
+
+?>
+--EXPECTF--
+Parse error: syntax error, unexpected '}' in %s(%d) : runtime-created function on line 1
+
+Parse error: syntax error, unexpected $end in %s(%d) : runtime-created function on line 1
+bool(false)
+int(2)
+bool(false)
+int(3)
+bool(true)
@@ -0,0 +1,51 @@
+--TEST--
+Bug #48770 (call_user_func_array() fails to call parent from inheriting class)
+--FILE--
+<?php
+ 
+class A {
+	public function func($str) {
+		var_dump(__METHOD__ .': '. $str);
+	}
+	private function func2($str) {
+		var_dump(__METHOD__ .': '. $str);
+	}
+	protected function func3($str) {
+		var_dump(__METHOD__ .': '. $str);		
+	}
+	private function func22($str) {
+		var_dump(__METHOD__ .': '. $str);		
+	}
+}
+
+class B extends A {
+	public function func($str) {
+		static $avoid_crash = 0;
+		
+		if ($avoid_crash++ == 1) {
+			print "This method shouldn't be called when using parent::func!\n";
+			return;
+		}
+				
+		call_user_func_array(array($this, 'parent::func'), array($str));
+	}
+	private function func2($str) {
+		var_dump(__METHOD__ .': '. $str);
+	}
+	protected function func3($str) {
+		var_dump(__METHOD__ .': '. $str);
+	}
+}
+
+class C extends B {
+	public function func($str) {
+		parent::func($str);
+	}
+}
+
+$c = new C;
+$c->func('This should work!');
+
+?>
+--EXPECTF--
+%unicode|string%(26) "A::func: This should work!"
@@ -0,0 +1,26 @@
+--TEST--
+Bug #49269 (Ternary operator fails on Iterator object when used inside foreach declaration).
+--FILE--
+<?php
+class TestObject implements Iterator
+{
+    public $n = 0;
+    function valid()
+    {
+        return ($this->n < 3);
+    }
+    function current() {return $this->n;}
+    function next() {$this->n++;}
+    function key() { }
+    function rewind() {$this->n = 0;}
+}
+
+
+$array_object = new TestObject();
+
+foreach ((true ? $array_object : $array_object) as $item) echo "$item\n";
+?>
+--EXPECT--
+0
+1
+2
@@ -0,0 +1,30 @@
+--TEST--
+Testing Exception's methods
+--FILE--
+<?php
+
+$x = new Exception;
+$x->gettraceasstring(1);
+$x->gettraceasstring();
+$x->__tostring(1);
+$x->gettrace(1);
+$x->getline(1);
+$x->getfile(1);
+$x->getmessage(1);
+$x->getcode(1);
+
+?>
+--EXPECTF--
+Warning: Wrong parameter count for Exception::getTraceAsString() in %s on line %d
+
+Warning: Wrong parameter count for Exception::__toString() in %s on line %d
+
+Warning: Wrong parameter count for Exception::getTrace() in %s on line %d
+
+Warning: Wrong parameter count for Exception::getLine() in %s on line %d
+
+Warning: Wrong parameter count for Exception::getFile() in %s on line %d
+
+Warning: Wrong parameter count for Exception::getMessage() in %s on line %d
+
+Warning: Wrong parameter count for Exception::getCode() in %s on line %d
@@ -0,0 +1,39 @@
+--TEST--
+function_exists function : basic functionality 
+--FILE--
+<?php
+/* 
+ * proto bool function_exists(string function_name)
+ * Function is implemented in Zend/zend_builtin_functions.c
+*/ 
+
+echo "*** Testing function_exists() : basic functionality ***\n";
+
+echo "Internal function: ";
+var_dump(function_exists('function_exists'));
+
+echo "User defined function: ";
+function f() {}
+var_dump(function_exists('f'));
+
+echo "Case sensitivity: ";
+var_dump(function_exists('F'));
+
+echo "Non existent function: ";
+var_dump(function_exists('g'));
+
+echo "Method: ";
+Class C {
+	static function f() {}
+}
+var_dump(function_exists('C::f'));
+?>
+===Done===
+--EXPECT--
+*** Testing function_exists() : basic functionality ***
+Internal function: bool(true)
+User defined function: bool(true)
+Case sensitivity: bool(true)
+Non existent function: bool(false)
+Method: bool(false)
+===Done===
@@ -0,0 +1,36 @@
+--TEST--
+Test function_exists() function : error conditions 
+--FILE--
+<?php
+/* 
+ * proto bool function_exists(string function_name)
+ * Function is implemented in Zend/zend_builtin_functions.c
+*/ 
+
+echo "*** Testing function_exists() : error conditions ***\n";
+
+$arg_0 = "ABC";
+$extra_arg = 1;
+
+echo "\nToo many arguments\n";
+var_dump(function_exists($arg_0, $extra_arg));
+
+echo "\nToo few arguments\n";
+var_dump(function_exists());
+
+?>
+===Done===
+--EXPECTF--
+*** Testing function_exists() : error conditions ***
+
+Too many arguments
+
+Warning: Wrong parameter count for function_exists() in %s on line %d
+NULL
+
+Too few arguments
+
+Warning: Wrong parameter count for function_exists() in %s on line %d
+NULL
+===Done===
+
@@ -0,0 +1,135 @@
+--TEST--
+Test function_exists() function : usage variations - test values for $str argument
+--FILE--
+<?php
+
+/* 
+ * proto bool function_exists(string function_name)
+ * Function is implemented in Zend/zend_builtin_functions.c
+*/ 
+
+echo "*** Testing function_exists() function: with unexpected inputs for 'str' argument ***\n";
+
+//get an unset variable
+$unset_var = 'string_val';
+unset($unset_var);
+
+//defining a class
+class sample  {
+  public function __toString() {
+    return "sample object";
+  } 
+}
+
+//getting the resource
+$file_handle = fopen(__FILE__, "r");
+
+// array with different values for $str
+$inputs =  array (
+
+  // integer values
+  0,
+  1,
+  255,
+  256,
+  PHP_INT_MAX,
+  -PHP_INT_MAX,
+
+  // float values
+  10.5,
+  -20.5,
+  10.1234567e10,
+
+  // array values
+  array(),
+  array(0),
+  array(1, 2),
+
+  // boolean values
+  true,
+  false,
+  TRUE,
+  FALSE,
+
+  // null values
+  NULL,
+  null,
+
+  // objects
+  new sample(),
+
+  // resource
+  $file_handle,
+
+  // undefined variable
+  @$undefined_var,
+
+  // unset variable
+  @$unset_var
+);
+
+// loop through with each element of the $inputs array to test function_exists() function
+$count = 1;
+foreach($inputs as $input) {
+  echo "-- Iteration $count --\n";
+  var_dump( function_exists($input) );
+  $count ++;
+}
+
+fclose($file_handle);  //closing the file handle
+
+?>
+===Done===
+--EXPECTF--
+*** Testing function_exists() function: with unexpected inputs for 'str' argument ***
+-- Iteration 1 --
+bool(false)
+-- Iteration 2 --
+bool(false)
+-- Iteration 3 --
+bool(false)
+-- Iteration 4 --
+bool(false)
+-- Iteration 5 --
+bool(false)
+-- Iteration 6 --
+bool(false)
+-- Iteration 7 --
+bool(false)
+-- Iteration 8 --
+bool(false)
+-- Iteration 9 --
+bool(false)
+-- Iteration 10 --
+
+Notice: Array to string conversion in %s on line %d
+bool(false)
+-- Iteration 11 --
+
+Notice: Array to string conversion in %s on line %d
+bool(false)
+-- Iteration 12 --
+
+Notice: Array to string conversion in %s on line %d
+bool(false)
+-- Iteration 13 --
+bool(false)
+-- Iteration 14 --
+bool(false)
+-- Iteration 15 --
+bool(false)
+-- Iteration 16 --
+bool(false)
+-- Iteration 17 --
+bool(false)
+-- Iteration 18 --
+bool(false)
+-- Iteration 19 --
+bool(false)
+-- Iteration 20 --
+bool(false)
+-- Iteration 21 --
+bool(false)
+-- Iteration 22 --
+bool(false)
+===Done===
@@ -33,7 +33,7 @@ new C;

 ?>
 --EXPECT--
-array(5) {
+array(6) {
  ["aaa"]=>
  int(7)
  ["ccc"]=>
@@ -42,6 +42,8 @@ array(5) {
  int(1)
  ["aa"]=>
  int(4)
+  ["bb"]=>
+  int(5)
  ["cc"]=>
  int(6)
 }
@@ -44,5 +44,7 @@ array(1) {
  ["a"]=>
  int(1)
 }
-array(0) {
+array(1) {
+  ["a"]=>
+  int(1)
 }
@@ -0,0 +1,59 @@
+--TEST--
+get_defined_functions() function : basic functionality 
+--FILE--
+<?php
+
+/* Prototype  : array get_defined_functions  ( void  )
+ * Description: Gets an array of all defined functions.
+ * Source code: Zend/zend_builtin_functions.c
+*/
+
+echo "*** Testing get_defined_functions() : basic functionality ***\n";
+
+function foo() {}
+
+// mixed case function
+function HelloWorld() {}
+
+Class C {
+	function f1() {}
+	static function f2() {}
+}
+
+$func = get_defined_functions();
+
+if (!is_array($func)) {
+	echo "TEST FAILED: return type not an array\n";
+}
+
+
+if (!is_array($func["internal"])) {
+ 	echo "TEST FAILED: no element in result array with key 'internal'\n";
+} 	
+
+$internal = $func["internal"];
+
+//check for a few core functions
+if (!in_array("cos", $internal) || !in_array("strlen", $internal)) {
+ 	echo "TEST FAILED: missing elements from 'internal' array\n";
+ 	var_dump($internal);
+} 
+
+if (!is_array($func["user"])) {
+ 	echo "TEST FAILED: no element in result array with key 'user'\n";
+}
+
+$user = $func["user"];
+if (count($user) == 2 && in_array("foo", $user) && in_array("helloworld", $user)) {
+	echo "TEST PASSED\n";
+} else {
+	echo "TEST FAILED: missing elements from 'user' array\n";
+	var_dump($user);
+}	
+
+?>
+===Done===
+--EXPECT--
+*** Testing get_defined_functions() : basic functionality ***
+TEST PASSED
+===Done===
@@ -0,0 +1,29 @@
+--TEST--
+Test get_defined_functions() function : error conditions 
+--FILE--
+<?php
+
+/* Prototype  : array get_defined_functions  ( void  )
+ * Description: Gets an array of all defined functions.
+ * Source code: Zend/zend_builtin_functions.c
+*/
+
+
+echo "*** Testing get_defined_functions() : error conditions ***\n";
+
+
+echo "\n-- Testing get_defined_functions() function with more than expected no. of arguments --\n";
+$extra_arg = 10;
+var_dump( get_defined_functions($extra_arg) );
+
+?> 
+===Done===
+--EXPECTF--
+*** Testing get_defined_functions() : error conditions ***
+
+-- Testing get_defined_functions() function with more than expected no. of arguments --
+
+Warning: Wrong parameter count for get_defined_functions() in %s on line %d
+NULL
+ 
+===Done===
@@ -0,0 +1,16 @@
+--TEST--
+Check if get_required_files works
+--CREDITS--
+Sebastian Schürmann
+sschuermann@chip.de
+Testfest 2009 Munich
+--FILE--
+<?php
+$files = get_required_files();
+var_dump($files);
+?>
+--EXPECTF--
+array(1) {
+  [0]=>
+  %string|unicode%(%d)%s
+}
@@ -0,0 +1,18 @@
+--TEST--
+Crash when function parameter modified via unexpected reference
+--FILE--
+<?php
+function my_errorhandler($errno,$errormsg) {
+  global $my_var;
+  $my_var = 0;
+  return true;
+}
+set_error_handler("my_errorhandler");
+$my_var = str_repeat("A",64);
+$data = call_user_func_array("explode",array(new StdClass(), &$my_var));
+$my_var=array(1,2,3);
+$data = call_user_func_array("implode",array(&$my_var, new StdClass()));
+echo "Done.\n";
+?>
+--EXPECTF--
+Done.
@@ -1,7 +1,5 @@
 --TEST--
 unset() CV 7 (indirect unset() of global variable in import_request_variables())
--SKIPIF--
-<?php if (php_sapi_name()=='cli') echo 'skip'; ?>
 --GET--
 x=2
 --FILE--
@@ -835,7 +835,7 @@ void zend_deactivate_modules(TSRMLS_D)
 	EG(opline_ptr) = NULL; /* we're no longer executing anything */

 	zend_try {
-		zend_hash_apply(&module_registry, (apply_func_t) module_registry_cleanup TSRMLS_CC);
+		zend_hash_reverse_apply(&module_registry, (apply_func_t) module_registry_cleanup TSRMLS_CC);
 	} zend_end_try();
 }

@@ -1078,7 +1078,7 @@ ZEND_API void zend_error(int type, const char *format, ...)
 	}
 }

-#if defined(__GNUC__) && !defined(__INTEL_COMPILER) && !defined(DARWIN) && !defined(__hpux) && !defined(_AIX) && !defined(__osf__)
+#if defined(__GNUC__) && __GNUC__ >= 3 && !defined(__INTEL_COMPILER) && !defined(DARWIN) && !defined(__hpux) && !defined(_AIX) && !defined(__osf__)
 void zend_error_noreturn(int type, const char *format, ...) __attribute__ ((alias("zend_error"),noreturn));
 #endif

@@ -178,6 +178,12 @@ char *alloca ();
 #endif


+#if defined(__GNUC__) && ZEND_GCC_VERSION >= 3400
+#else
+# define __restrict__
+#endif
+#define restrict __restrict__
+
 #if (HAVE_ALLOCA || (defined (__GNUC__) && __GNUC__ >= 2)) && !(defined(ZTS) && defined(ZEND_WIN32)) && !(defined(ZTS) && defined(NETWARE)) && !(defined(ZTS) && defined(HPUX)) && !defined(DARWIN)
 # define do_alloca(p) alloca(p)
 # define free_alloca(p)
@@ -249,6 +255,18 @@ char *alloca ();
 #define LONG_MIN (- LONG_MAX - 1)
 #endif

+#if SIZEOF_LONG == 4
+#define MAX_LENGTH_OF_LONG 11
+static const char long_min_digits[] = "2147483648";
+#elif SIZEOF_LONG == 8
+#define MAX_LENGTH_OF_LONG 20
+static const char long_min_digits[] = "9223372036854775808";
+#else
+#error "Unknown SIZEOF_LONG"
+#endif
+
+#define MAX_LENGTH_OF_DOUBLE 32
+
 #undef SUCCESS
 #undef FAILURE
 #define SUCCESS 0
@@ -262,7 +280,7 @@ char *alloca ();
 #define INTERNAL_FUNCTION_PARAMETERS int ht, zval *return_value, zval **return_value_ptr, zval *this_ptr, int return_value_used TSRMLS_DC
 #define INTERNAL_FUNCTION_PARAM_PASSTHRU ht, return_value, return_value_ptr, this_ptr, return_value_used TSRMLS_CC

-#if defined(__GNUC__) && !defined(__INTEL_COMPILER) && !defined(DARWIN) && !defined(__hpux) && !defined(_AIX) && !defined(__osf__)
+#if defined(__GNUC__) && __GNUC__ >= 3 && !defined(__INTEL_COMPILER) && !defined(DARWIN) && !defined(__hpux) && !defined(_AIX) && !defined(__osf__) && __GNUC__ >= 3
 #  define ZEND_VM_ALWAYS_INLINE  __attribute__ ((always_inline))
 void zend_error_noreturn(int type, const char *format, ...) __attribute__ ((noreturn));
 #else
@@ -901,21 +901,21 @@ ZEND_API void zend_update_class_constants(zend_class_entry *class_type TSRMLS_DC

 				zend_hash_get_current_key_ex(&class_type->default_static_members, &str_index, &str_length, &num_index, 0, &pos);
 				if ((*p)->is_ref &&
-				    class_type->parent &&
-				    zend_hash_find(&class_type->parent->default_static_members, str_index, str_length, (void**)&q) == SUCCESS &&
-				    *p == *q &&
-				    zend_hash_find(CE_STATIC_MEMBERS(class_type->parent), str_index, str_length, (void**)&q) == SUCCESS) {
+					class_type->parent &&
+					zend_hash_find(&class_type->parent->default_static_members, str_index, str_length, (void**)&q) == SUCCESS &&
+					*p == *q &&
+					zend_hash_find(CE_STATIC_MEMBERS(class_type->parent), str_index, str_length, (void**)&q) == SUCCESS) {
 					(*q)->refcount++;
 					(*q)->is_ref = 1;
 					zend_hash_add(CE_STATIC_MEMBERS(class_type), str_index, str_length, (void**)q, sizeof(zval*), NULL);
 				} else {
-					zval *q;
+					zval *r;

-					ALLOC_ZVAL(q);
-					*q = **p;
-					INIT_PZVAL(q);
-					zval_copy_ctor(q);
-					zend_hash_add(CE_STATIC_MEMBERS(class_type), str_index, str_length, (void**)&q, sizeof(zval*), NULL);
+					ALLOC_ZVAL(r);
+					*r = **p;
+					INIT_PZVAL(r);
+					zval_copy_ctor(r);
+					zend_hash_add(CE_STATIC_MEMBERS(class_type), str_index, str_length, (void**)&r, sizeof(zval*), NULL);
 				}
 				zend_hash_move_forward_ex(&class_type->default_static_members, &pos);
 			}
@@ -1782,7 +1782,6 @@ ZEND_API int zend_register_functions(zend_class_entry *scope, zend_function_entr
 			fname_len = strlen(ptr->fname);
 			lowercase_name = zend_str_tolower_dup(ptr->fname, fname_len);
 			if (zend_hash_exists(target_function_table, lowercase_name, fname_len+1)) {
-				efree(lowercase_name);
 				zend_error(error_type, "Function registration failed - duplicate name - %s%s%s", scope ? scope->name : "", scope ? "::" : "", ptr->fname);
 			}
 			efree(lowercase_name);
@@ -148,7 +148,12 @@ static zend_mm_segment* zend_mm_mem_mmap_realloc(zend_mm_storage *storage, zend_
 {
 	zend_mm_segment *ret;
 #ifdef HAVE_MREMAP
+#if defined(__NetBSD__)
+	/* NetBSD 5 supports mremap but takes an extra newp argument */
+	ret = (zend_mm_segment*)mremap(segment, segment->size, segment, size, MREMAP_MAYMOVE);
+#else
 	ret = (zend_mm_segment*)mremap(segment, segment->size, size, MREMAP_MAYMOVE);
+#endif
 	if (ret == MAP_FAILED) {
 #endif
 		ret = storage->handlers->_alloc(storage, size);
@@ -2472,7 +2477,11 @@ ZEND_API size_t zend_memory_usage(int real_usage TSRMLS_DC)
 	if (real_usage) {
 		return AG(mm_heap)->real_size;
 	} else {
-		return AG(mm_heap)->size;
+		size_t usage = AG(mm_heap)->size;
+#if ZEND_MM_CACHE
+		usage -= AG(mm_heap)->cached;
+#endif
+		return usage;
 	}
 }

@@ -89,7 +89,7 @@ inline static void * __zend_malloc(size_t len)
 inline static void * __zend_calloc(size_t nmemb, size_t len)
 {
 	void *tmp = _safe_malloc(nmemb, len, 0);
-	memset(tmp, 0, len);
+	memset(tmp, 0, nmemb * len);
 	return tmp;
 }

@@ -33,7 +33,7 @@ static ZEND_FUNCTION(zend_version);
 static ZEND_FUNCTION(func_num_args);
 static ZEND_FUNCTION(func_get_arg);
 static ZEND_FUNCTION(func_get_args);
-static ZEND_NAMED_FUNCTION(zend_if_strlen);
+static ZEND_FUNCTION(strlen);
 static ZEND_FUNCTION(strcmp);
 static ZEND_FUNCTION(strncmp);
 static ZEND_FUNCTION(strcasecmp);
@@ -93,7 +93,7 @@ static zend_function_entry builtin_functions[] = {
 	ZEND_FE(func_num_args,		NULL)
 	ZEND_FE(func_get_arg,		NULL)
 	ZEND_FE(func_get_args,		NULL)
-	{ "strlen", zend_if_strlen, NULL },
+	ZEND_FE(strlen,				NULL)
 	ZEND_FE(strcmp,				NULL)
 	ZEND_FE(strncmp,			NULL)
 	ZEND_FE(strcasecmp,			NULL)
@@ -275,7 +275,7 @@ ZEND_FUNCTION(func_get_args)

 /* {{{ proto int strlen(string str)
   Get string length */
-ZEND_NAMED_FUNCTION(zend_if_strlen)
+ZEND_FUNCTION(strlen)
 {
 	zval **str;

@@ -461,6 +461,7 @@ ZEND_FUNCTION(define)
 	zend_bool non_cs = 0;
 	int case_sensitive = CONST_CS;
 	zend_constant c;
+	char *p;

 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "sz|b", &name, &name_len, &val, &non_cs) == FAILURE) {
 		return;
@@ -470,6 +471,34 @@ ZEND_FUNCTION(define)
 		case_sensitive = 0;
 	}

+	/* class constant, check if there is name and make sure class is valid & exists */
+	if ((p = zend_memnstr(name, "::", sizeof("::") - 1, name + name_len))) {
+		char *class_name;
+		int found;
+		zend_class_entry **ce;
+		ALLOCA_FLAG(use_heap)
+
+		if (p == (name + name_len - sizeof("::") + 1)) {
+			zend_error(E_WARNING, "Class constant must have a name");
+			RETURN_FALSE;
+		} else if (p == name) {
+			zend_error(E_WARNING, "Missing class name");
+			RETURN_FALSE;
+		}
+
+		class_name = do_alloca_with_limit((p - name + 1), use_heap);
+		zend_str_tolower_copy(class_name, name, (p - name));
+
+		found = zend_hash_find(EG(class_table), class_name, p - name + 1, (void **) &ce);
+
+		if (found != SUCCESS) {
+			zend_error(E_WARNING, "Class '%s' does not exist", class_name);
+			free_alloca_with_limit(class_name, use_heap);
+			RETURN_FALSE;
+		}
+		free_alloca_with_limit(class_name, use_heap);
+	}
+
 repeat:
 	switch (Z_TYPE_P(val)) {
 		case IS_LONG:
@@ -706,27 +735,22 @@ static void add_class_vars(zend_class_entry *ce, HashTable *properties, zval *re
 		while (zend_hash_get_current_data_ex(properties, (void **) &prop, &pos) == SUCCESS) {
 			char *key, *class_name, *prop_name;
 			uint key_len;
-			ulong num_index, h;
+			ulong num_index;
 			int prop_name_len = 0;			
 			zval *prop_copy;
 			zend_property_info *property_info;
+			zval zprop_name;

 			zend_hash_get_current_key_ex(properties, &key, &key_len, &num_index, 0, &pos);
 			zend_hash_move_forward_ex(properties, &pos);

 			zend_unmangle_property_name(key, key_len-1, &class_name, &prop_name);
 			prop_name_len = strlen(prop_name);
-			
-			h = zend_get_hash_value(prop_name, prop_name_len+1);
-			if (zend_hash_quick_find(&ce->properties_info, prop_name, prop_name_len+1, h, (void **) &property_info) == FAILURE) {
-				continue;
-			}
-			
-			if (property_info->flags & ZEND_ACC_SHADOW) {
-				continue;
-			} else if ((property_info->flags & ZEND_ACC_PRIVATE) && EG(scope) != ce) {
-				continue;
-			} else if ((property_info->flags & ZEND_ACC_PROTECTED) && zend_check_protected(ce, EG(scope)) == 0) {
+
+			ZVAL_STRINGL(&zprop_name, prop_name, prop_name_len, 0);
+			property_info = zend_get_property_info(ce, &zprop_name, 1 TSRMLS_CC);
+
+			if (!property_info || property_info == &EG(std_property_info)) {
 				continue;
 			}

@@ -1492,6 +1516,7 @@ ZEND_FUNCTION(create_function)
 		zend_hash_del(EG(function_table), LAMBDA_TEMP_FUNCNAME, sizeof(LAMBDA_TEMP_FUNCNAME));
 		RETURN_STRINGL(function_name, function_name_length, 0);
 	} else {
+		zend_hash_del(EG(function_table), LAMBDA_TEMP_FUNCNAME, sizeof(LAMBDA_TEMP_FUNCNAME));
 		RETURN_FALSE;
 	}
 }
@@ -1594,15 +1619,15 @@ ZEND_FUNCTION(get_loaded_extensions)
   Return an array containing the names and values of all defined constants */
 ZEND_FUNCTION(get_defined_constants)
 {
-	int argc = ZEND_NUM_ARGS();
+	zend_bool categorize = 0;

-	if (argc != 0 && argc != 1) {
-		ZEND_WRONG_PARAM_COUNT();
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|b", &categorize) == FAILURE) {
+		return;
 	}

 	array_init(return_value);

-	if (argc) {
+	if (categorize) {
 		HashPosition pos;
 		zend_constant *val;
 		int module_number;
@@ -1617,7 +1642,8 @@ ZEND_FUNCTION(get_defined_constants)
 		module_names[0] = "internal";
 		zend_hash_internal_pointer_reset_ex(&module_registry, &pos);
 		while (zend_hash_get_current_data_ex(&module_registry, (void *) &module, &pos) != FAILURE) {
-			module_names[i++] = module->name;
+			module_names[module->module_number] = module->name;
+			i++;
 			zend_hash_move_forward_ex(&module_registry, &pos);
 		}
 		module_names[i] = "user";
@@ -1536,11 +1536,8 @@ void zend_do_begin_class_member_function_call(znode *class_name, znode *method_n
 		    memcmp(lcname, ZEND_CONSTRUCTOR_FUNC_NAME, sizeof(ZEND_CONSTRUCTOR_FUNC_NAME)-1) == 0) {
 			zval_dtor(&opline->op2.u.constant);
 			SET_UNUSED(opline->op2);
-			efree(lcname);
-		} else {
-			efree(opline->op2.u.constant.value.str.val);
-			opline->op2.u.constant.value.str.val = lcname;
 		}
+		efree(lcname);
 	}

 	zend_stack_push(&CG(function_call_stack), (void *) &ptr, sizeof(zend_function *));
@@ -2138,7 +2135,7 @@ static zend_bool do_inherit_method_check(HashTable *child_function_table, zend_f
 		if (!zend_do_perform_implementation_check(child, child->common.prototype)) {
 			zend_error(E_COMPILE_ERROR, "Declaration of %s::%s() must be compatible with that of %s::%s()", ZEND_FN_SCOPE_NAME(child), child->common.function_name, ZEND_FN_SCOPE_NAME(child->common.prototype), child->common.prototype->common.function_name);
 		}
-	} else if (EG(error_reporting) & E_STRICT) { /* Check E_STRICT before the check so that we save some time */
+	} else if (EG(error_reporting) & E_STRICT || EG(user_error_handler)) { /* Check E_STRICT (or custom error handler) before the check so that we save some time */
 		if (!zend_do_perform_implementation_check(child, parent)) {
 			zend_error(E_STRICT, "Declaration of %s::%s() should be compatible with that of %s::%s()", ZEND_FN_SCOPE_NAME(child), child->common.function_name, ZEND_FN_SCOPE_NAME(parent), parent->common.function_name);
 		}
@@ -4195,8 +4192,6 @@ again:
 		case T_END_HEREDOC:
 			efree(Z_STRVAL(zendlval->u.constant));
 			break;
-		case EOF:
-			return EOF;
 	}

 	INIT_PZVAL(&zendlval->u.constant);
@@ -428,9 +428,14 @@ static int _build_trace_string(zval **frame, int num_args, va_list args, zend_ha
 ZEND_METHOD(exception, getTraceAsString)
 {
 	zval *trace;
-	char *res = estrdup(""), **str = &res, *s_tmp;
+	char *res, **str, *s_tmp;
 	int res_len = 0, *len = &res_len, num = 0;

+	DEFAULT_0_PARAMS;
+	
+	res = estrdup("");
+	str = &res;
+
 	trace = zend_read_property(default_exception_ce, getThis(), "trace", sizeof("trace")-1, 1 TSRMLS_CC);
 	zend_hash_apply_with_arguments(Z_ARRVAL_P(trace), (apply_func_args_t)_build_trace_string, 3, str, len, &num);

@@ -465,6 +470,8 @@ ZEND_METHOD(exception, __toString)
 	int len;
 	zend_fcall_info fci;
 	zval fname;
+	
+	DEFAULT_0_PARAMS;

 	_default_exception_get_entry(getThis(), "message", sizeof("message")-1, &message TSRMLS_CC);
 	_default_exception_get_entry(getThis(), "file", sizeof("file")-1, &file TSRMLS_CC);
@@ -183,7 +183,6 @@ static inline zval *_get_zval_ptr_var(znode *node, temp_variable *Ts, zend_free_
 		if (T->str_offset.str->type != IS_STRING
 			|| ((int)T->str_offset.offset < 0)
 			|| (T->str_offset.str->value.str.len <= (int)T->str_offset.offset)) {
-			zend_error(E_NOTICE, "Uninitialized string offset:  %d", T->str_offset.offset);
 			ptr->value.str.val = STR_EMPTY_ALLOC();
 			ptr->value.str.len = 0;
 		} else {
@@ -979,7 +978,7 @@ fetch_string_dim:
 				long index;

 				if (Z_TYPE_P(dim) == IS_DOUBLE) {
-					DVAL_TO_LVAL(Z_DVAL_P(dim), index);
+					index = (long)Z_DVAL_P(dim);
 				} else {
 					index = Z_LVAL_P(dim);
 				}
@@ -1133,6 +1132,9 @@ static void zend_fetch_dimension_address(temp_variable *result, zval **container
 						break;
 				}
 				if (result) {
+					if (Z_LVAL_P(dim) < 0 || Z_STRLEN_P(container) <= Z_LVAL_P(dim)) {
+						zend_error(E_NOTICE, "Uninitialized string offset: %ld", Z_LVAL_P(dim));
+					}
 					container = *container_ptr;
 					result->str_offset.str = container;
 					PZVAL_LOCK(container);
@@ -169,6 +169,27 @@ static inline int zend_ptr_stack_get_arg(int requested_arg, void **data TSRMLS_D
 	return SUCCESS;
 }

+static inline void zend_arg_types_stack_2_pop(zend_ptr_stack *stack, zval **object, zend_function **fbc)
+{
+	void *a, *b;
+
+	zend_ptr_stack_2_pop(stack, &a, &b);
+
+	*object =  (zval *) a;
+	*fbc = (zend_function *) b;
+}
+
+static inline void zend_arg_types_stack_3_pop(zend_ptr_stack *stack, zend_class_entry **called_scope, zval **object, zend_function **fbc)
+{
+	void *a, *b, *c;
+
+	zend_ptr_stack_3_pop(stack, &a, &b, &c);
+
+	*called_scope = (zend_class_entry *) a;
+	*object = (zval *) b;
+	*fbc = (zend_function *) c;
+}
+
 void execute_new_code(TSRMLS_D);


@@ -835,11 +835,8 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache TS
 				efree(function_name_lc);
 			}
 		} else if (calling_scope) {
-			char *function_name_lc = zend_str_tolower_dup(fname, fname_len);
+			EX(function_state).function = zend_std_get_static_method(calling_scope, fname, fname_len TSRMLS_CC);

-			EX(function_state).function = 
-				zend_std_get_static_method(calling_scope, function_name_lc, fname_len TSRMLS_CC);
-			efree(function_name_lc);
 			if (check_scope_or_static && EX(function_state).function
 			&& !(EX(function_state).function->common.fn_flags & ZEND_ACC_STATIC)
 			&& !instanceof_function(check_scope_or_static, calling_scope TSRMLS_CC)) {
@@ -924,6 +921,12 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache TS
 	for (i=0; i<fci->param_count; i++) {
 		zval *param;

+		if (EX(function_state).function->type == ZEND_INTERNAL_FUNCTION
+			&& !ARG_SHOULD_BE_SENT_BY_REF(EX(function_state).function, i + 1)
+			&& PZVAL_IS_REF(*fci->params[i])) {
+			SEPARATE_ZVAL(fci->params[i]);
+		}
+
 		if (ARG_SHOULD_BE_SENT_BY_REF(EX(function_state).function, i+1)
 			&& !PZVAL_IS_REF(*fci->params[i])) {
 			if ((*fci->params[i])->refcount>1) {
@@ -1209,13 +1212,16 @@ ZEND_API int zend_eval_string(char *str, zval *retval_ptr, char *string_name TSR
 		zval *local_retval_ptr=NULL;
 		zval **original_return_value_ptr_ptr = EG(return_value_ptr_ptr);
 		zend_op **original_opline_ptr = EG(opline_ptr);
+		int orig_interactive = CG(interactive);

 		EG(return_value_ptr_ptr) = &local_retval_ptr;
 		EG(active_op_array) = new_op_array;
 		EG(no_extensions)=1;
+		CG(interactive) = 0;

 		zend_execute(new_op_array TSRMLS_CC);

+		CG(interactive) = orig_interactive;
 		if (local_retval_ptr) {
 			if (retval_ptr) {
 				COPY_PZVAL_TO_ZVAL(*retval_ptr, local_retval_ptr);
@@ -1262,6 +1268,7 @@ void execute_new_code(TSRMLS_D)
 	zend_op *opline, *end;
 	zend_op *ret_opline;
 	zval *local_retval=NULL;
+	int orig_interactive;

 	if (!(CG(active_op_array)->fn_flags & ZEND_ACC_INTERACTIVE)
 		|| CG(active_op_array)->backpatch_count>0
@@ -1311,7 +1318,10 @@ void execute_new_code(TSRMLS_D)

 	EG(return_value_ptr_ptr) = &local_retval;
 	EG(active_op_array) = CG(active_op_array);
+	orig_interactive = CG(interactive);
+	CG(interactive) = 0;
 	zend_execute(CG(active_op_array) TSRMLS_CC);
+	CG(interactive) = orig_interactive;
 	if (local_retval) {
 		zval_ptr_dtor(&local_retval);
 	}
@@ -376,7 +376,7 @@ ZEND_API int _zend_hash_index_update_or_next_insert(HashTable *ht, ulong h, void
 			UPDATE_DATA(ht, p, pData, nDataSize);
 			HANDLE_UNBLOCK_INTERRUPTIONS();
 			if ((long)h >= (long)ht->nNextFreeElement) {
-				ht->nNextFreeElement = h + 1;
+				ht->nNextFreeElement = h < LONG_MAX ? h + 1 : LONG_MAX;
 			}
 			if (pDest) {
 				*pDest = p->pData;
@@ -404,7 +404,7 @@ ZEND_API int _zend_hash_index_update_or_next_insert(HashTable *ht, ulong h, void
 	HANDLE_UNBLOCK_INTERRUPTIONS();

 	if ((long)h >= (long)ht->nNextFreeElement) {
-		ht->nNextFreeElement = h + 1;
+		ht->nNextFreeElement = h < LONG_MAX ? h + 1 : LONG_MAX;
 	}
 	ht->nNumOfElements++;
 	ZEND_HASH_IF_FULL_DO_RESIZE(ht);
@@ -298,40 +298,41 @@ END_EXTERN_C()
 	zend_hash_init(ht, n, NULL, ZVAL_PTR_DTOR, persistent)


-#define HANDLE_NUMERIC(key, length, func) {												\
-	register char *tmp=key;																\
-																						\
-	if (*tmp=='-') {																	\
-		tmp++;																			\
-	}																					\
-	if ((*tmp>='0' && *tmp<='9')) do { /* possibly a numeric index */					\
-		char *end=key+length-1;															\
-		long idx;																		\
-																						\
-		if (*tmp++=='0' && length>2) { /* don't accept numbers with leading zeros */	\
-			break;																		\
-		}																				\
-		while (tmp<end) {																\
-			if (!(*tmp>='0' && *tmp<='9')) {											\
-				break;																	\
-			}																			\
-			tmp++;																		\
-		}																				\
-		if (tmp==end && *tmp=='\0') { /* a numeric index */								\
-			if (*key=='-') {															\
-				idx = strtol(key, NULL, 10);											\
-				if (idx!=LONG_MIN) {													\
-					return func;														\
-				}																		\
-			} else {																	\
-				idx = strtol(key, NULL, 10);											\
-				if (idx!=LONG_MAX) {													\
-					return func;														\
-				}																		\
-			}																			\
-		}																				\
-	} while (0);																		\
-}
+#define HANDLE_NUMERIC(key, length, func) do {								\
+	register const char *tmp = key;											\
+																			\
+	if (*tmp == '-') {														\
+		tmp++;																\
+	}																		\
+	if (*tmp >= '0' && *tmp <= '9') { /* possibly a numeric index */		\
+		const char *end = key + length - 1;									\
+		long idx;															\
+																			\
+		if ((*end != '\0') /* not a null terminated string */				\
+		 || (*tmp == '0' && length > 2) /* numbers with leading zeros */	\
+		 || (end - tmp > MAX_LENGTH_OF_LONG - 1) /* number too long */		\
+		 || (SIZEOF_LONG == 4 &&											\
+		     end - tmp == MAX_LENGTH_OF_LONG - 1 &&							\
+		     *tmp > '2')) { /* overflow */									\
+			break;															\
+		}																	\
+		idx = (*tmp - '0');													\
+		while (++tmp != end && *tmp >= '0' && *tmp <= '9') {				\
+			idx = (idx * 10) + (*tmp - '0');								\
+		}																	\
+		if (tmp == end) {													\
+			if (*key == '-') {												\
+				idx = -idx;													\
+				if (idx > 0) { /* overflow */								\
+					break;													\
+				}															\
+			} else if (idx < 0) { /* overflow */							\
+				break;														\
+			}																\
+			return func;													\
+		}																	\
+	}																		\
+} while (0)


 static inline int zend_symtable_update(HashTable *ht, char *arKey, uint nKeyLength, void *pData, uint nDataSize, void **pDest)					\
@@ -343,7 +344,7 @@ static inline int zend_symtable_update(HashTable *ht, char *arKey, uint nKeyLeng

 static inline int zend_symtable_del(HashTable *ht, char *arKey, uint nKeyLength)
 {
-	HANDLE_NUMERIC(arKey, nKeyLength, zend_hash_index_del(ht, idx))
+	HANDLE_NUMERIC(arKey, nKeyLength, zend_hash_index_del(ht, idx));
 	return zend_hash_del(ht, arKey, nKeyLength);
 }

@@ -148,19 +148,11 @@ ZEND_API void zend_highlight(zend_syntax_highlighter_ini *syntax_highlighter_ini
 				zend_printf("<span style=\"color: %s\">", last_color);
 			}
 		}
-		switch (token_type) {
-			case T_END_HEREDOC:
-				zend_html_puts(token.value.str.val, token.value.str.len TSRMLS_CC);
-				break;
-			default:
-				zend_html_puts(LANG_SCNG(yy_text), LANG_SCNG(yy_leng) TSRMLS_CC);
-				break;
-		}
+
+		zend_html_puts(LANG_SCNG(yy_text), LANG_SCNG(yy_leng) TSRMLS_CC);

 		if (token.type == IS_STRING) {
 			switch (token_type) {
-				case EOF:
-					goto done;
 				case T_OPEN_TAG:
 				case T_OPEN_TAG_WITH_ECHO:
 				case T_CLOSE_TAG:
@@ -178,19 +170,6 @@ ZEND_API void zend_highlight(zend_syntax_highlighter_ini *syntax_highlighter_ini
 		token.type = 0;
 	}

-	/* handler for trailing comments, see bug #42767 */
-	if (LANG_SCNG(yy_leng) && LANG_SCNG(_yy_more_len)) {
-		if (last_color != syntax_highlighter_ini->highlight_comment) {
-			if (last_color != syntax_highlighter_ini->highlight_html) {
-				zend_printf("</span>");
-			}
-			if (syntax_highlighter_ini->highlight_comment != syntax_highlighter_ini->highlight_html) {
-				zend_printf("<span style=\"color: %s\">", syntax_highlighter_ini->highlight_comment);
-			}
-		}
-		zend_html_puts(LANG_SCNG(yy_text), LANG_SCNG(_yy_more_len) TSRMLS_CC);
-	}
-done:
 	if (last_color != syntax_highlighter_ini->highlight_html) {
 		zend_printf("</span>\n");
 	}
@@ -46,15 +46,21 @@ static int zend_remove_ini_entries(zend_ini_entry *ini_entry, int *module_number

 static int zend_restore_ini_entry_cb(zend_ini_entry *ini_entry, int stage TSRMLS_DC) /* {{{ */
 {
+	int result = FAILURE;
+
 	if (ini_entry->modified) {
 		if (ini_entry->on_modify) {
 			zend_try {
 			/* even if on_modify bails out, we have to continue on with restoring,
 				since there can be allocated variables that would be freed on MM shutdown
 				and would lead to memory corruption later ini entry is modified again */
-				ini_entry->on_modify(ini_entry, ini_entry->orig_value, ini_entry->orig_value_length, ini_entry->mh_arg1, ini_entry->mh_arg2, ini_entry->mh_arg3, stage TSRMLS_CC);
+				result = ini_entry->on_modify(ini_entry, ini_entry->orig_value, ini_entry->orig_value_length, ini_entry->mh_arg1, ini_entry->mh_arg2, ini_entry->mh_arg3, stage TSRMLS_CC);
 			} zend_end_try();
 		}
+		if (stage == ZEND_INI_STAGE_RUNTIME && result == FAILURE) {
+			/* runtime failure is OK */
+			return 1;
+		}
 		if (ini_entry->value != ini_entry->orig_value) {
 			efree(ini_entry->value);
 		}
@@ -310,8 +316,11 @@ ZEND_API int zend_restore_ini_entry(char *name, uint name_length, int stage) /*
 	}

 	if (EG(modified_ini_directives)) {
-		zend_restore_ini_entry_cb(ini_entry, stage TSRMLS_CC);
-		zend_hash_del(EG(modified_ini_directives), name, name_length);
+		if (zend_restore_ini_entry_cb(ini_entry, stage TSRMLS_CC) == 0) {
+			zend_hash_del(EG(modified_ini_directives), name, name_length);
+		} else {
+			return FAILURE;
+		}
 	}

 	return SUCCESS;
@@ -2033,7 +2033,9 @@ wrong_label:

 <ST_COMMENT,ST_DOC_COMMENT><<EOF>> {
 	zend_error(E_COMPILE_WARNING,"Unterminated comment starting line %d", CG(comment_start_line));
-	return 0;
+	yyless(yyleng - 1);
+	BEGIN(ST_IN_SCRIPTING);
+	return T_COMMENT;
 }


@@ -37,8 +37,8 @@ static zend_encoding* zend_multibyte_detect_utf_encoding(char *script, int scrip
 /*
 * encodings
 */
-const char *ucs2_aliases[] = {"ISO-10646-UCS-2", "UCS2" , "UNICODE", NULL};
-zend_encoding encoding_ucs2 = {
+static const char *ucs2_aliases[] = {"ISO-10646-UCS-2", "UCS2" , "UNICODE", NULL};
+static zend_encoding encoding_ucs2 = {
 	NULL,
 	NULL,
 	"UCS-2",
@@ -46,7 +46,7 @@ zend_encoding encoding_ucs2 = {
 	0
 };

-zend_encoding encoding_ucs2be = {
+static zend_encoding encoding_ucs2be = {
 	NULL,
 	NULL,
 	"UCS-2BE",
@@ -54,7 +54,7 @@ zend_encoding encoding_ucs2be = {
 	0
 };

-zend_encoding encoding_ucs2le = {
+static zend_encoding encoding_ucs2le = {
 	NULL,
 	NULL,
 	"UCS-2LE",
@@ -62,8 +62,8 @@ zend_encoding encoding_ucs2le = {
 	0
 };

-const char *ucs4_aliases[] = {"ISO-10646-UCS-4", "UCS4", NULL};
-zend_encoding encoding_ucs4 = {
+static const char *ucs4_aliases[] = {"ISO-10646-UCS-4", "UCS4", NULL};
+static zend_encoding encoding_ucs4 = {
 	NULL,
 	NULL,
 	"UCS-4",
@@ -71,7 +71,7 @@ zend_encoding encoding_ucs4 = {
 	0
 };

-zend_encoding encoding_ucs4be = {
+static zend_encoding encoding_ucs4be = {
 	NULL,
 	NULL,
 	"UCS-4BE",
@@ -79,7 +79,7 @@ zend_encoding encoding_ucs4be = {
 	0
 };

-zend_encoding encoding_ucs4le = {
+static zend_encoding encoding_ucs4le = {
 	NULL,
 	NULL,
 	"UCS-4LE",
@@ -87,8 +87,8 @@ zend_encoding encoding_ucs4le = {
 	0
 };

-const char *utf32_aliases[] = {"utf32", NULL};
-zend_encoding encoding_utf32 = {
+static const char *utf32_aliases[] = {"utf32", NULL};
+static zend_encoding encoding_utf32 = {
 	NULL,
 	NULL,
 	"UTF-32",
@@ -96,7 +96,7 @@ zend_encoding encoding_utf32 = {
 	0
 };

-zend_encoding encoding_utf32be = {
+static zend_encoding encoding_utf32be = {
 	NULL,
 	NULL,
 	"UTF-32BE",
@@ -104,7 +104,7 @@ zend_encoding encoding_utf32be = {
 	0
 };

-zend_encoding encoding_utf32le = {
+static zend_encoding encoding_utf32le = {
 	NULL,
 	NULL,
 	"UTF-32LE",
@@ -112,8 +112,8 @@ zend_encoding encoding_utf32le = {
 	0
 };

-const char *utf16_aliases[] = {"utf16", NULL};
-zend_encoding encoding_utf16 = {
+static const char *utf16_aliases[] = {"utf16", NULL};
+static zend_encoding encoding_utf16 = {
 	NULL,
 	NULL,
 	"UTF-16",
@@ -121,7 +121,7 @@ zend_encoding encoding_utf16 = {
 	0
 };

-zend_encoding encoding_utf16be = {
+static zend_encoding encoding_utf16be = {
 	NULL,
 	NULL,
 	"UTF-16BE",
@@ -129,7 +129,7 @@ zend_encoding encoding_utf16be = {
 	0
 };

-zend_encoding encoding_utf16le = {
+static zend_encoding encoding_utf16le = {
 	NULL,
 	NULL,
 	"UTF-16LE",
@@ -137,8 +137,8 @@ zend_encoding encoding_utf16le = {
 	0
 };

-const char *utf8_aliases[] = {"utf8", NULL};
-zend_encoding encoding_utf8 = {
+static const char *utf8_aliases[] = {"utf8", NULL};
+static zend_encoding encoding_utf8 = {
 	NULL,
 	NULL,
 	"UTF-8",
@@ -146,8 +146,8 @@ zend_encoding encoding_utf8 = {
 	1
 };

-const char *ascii_aliases[] = {"ANSI_X3.4-1968", "iso-ir-6", "ANSI_X3.4-1986", "ISO_646.irv:1991", "US-ASCII", "ISO646-US", "us", "IBM367", "cp367", "csASCII", NULL};
-zend_encoding encoding_ascii = {
+static const char *ascii_aliases[] = {"ANSI_X3.4-1968", "iso-ir-6", "ANSI_X3.4-1986", "ISO_646.irv:1991", "US-ASCII", "ISO646-US", "us", "IBM367", "cp367", "csASCII", NULL};
+static zend_encoding encoding_ascii = {
 	NULL,
 	NULL,
 	"ASCII",
@@ -155,8 +155,8 @@ zend_encoding encoding_ascii = {
 	1
 };

-const char *euc_jp_aliases[] = {"EUC", "EUC_JP", "eucJP", "x-euc-jp", NULL};
-zend_encoding encoding_euc_jp = {
+static const char *euc_jp_aliases[] = {"EUC", "EUC_JP", "eucJP", "x-euc-jp", NULL};
+static zend_encoding encoding_euc_jp = {
 	NULL,
 	NULL,
 	"EUC-JP",
@@ -164,8 +164,8 @@ zend_encoding encoding_euc_jp = {
 	1
 };

-const char *sjis_aliases[] = {"x-sjis", "SJIS", "SHIFT-JIS", NULL};
-zend_encoding encoding_sjis = {
+static const char *sjis_aliases[] = {"x-sjis", "SJIS", "SHIFT-JIS", NULL};
+static zend_encoding encoding_sjis = {
 	sjis_input_filter,
 	sjis_output_filter,
 	"Shift_JIS",
@@ -173,8 +173,8 @@ zend_encoding encoding_sjis = {
 	0
 };

-const char *eucjp_win_aliases[] = {"eucJP-open", NULL};
-zend_encoding encoding_eucjp_win = {
+static const char *eucjp_win_aliases[] = {"eucJP-open", NULL};
+static zend_encoding encoding_eucjp_win = {
 	NULL,
 	NULL,
 	"eucJP-win",
@@ -182,8 +182,8 @@ zend_encoding encoding_eucjp_win = {
 	1
 };

-const char *sjis_win_aliases[] = {"SJIS-open", "MS_Kanji", "Windows-31J", "CP932", NULL};
-zend_encoding encoding_sjis_win = {
+static const char *sjis_win_aliases[] = {"SJIS-open", "MS_Kanji", "Windows-31J", "CP932", NULL};
+static zend_encoding encoding_sjis_win = {
 	/* sjis-filters does not care about diffs of Shift_JIS and CP932 */
 	sjis_input_filter,
 	sjis_output_filter,
@@ -192,8 +192,8 @@ zend_encoding encoding_sjis_win = {
 	0
 };

-const char *jis_aliases[] = {"ISO-2022-JP", NULL};
-zend_encoding encoding_jis = {
+static const char *jis_aliases[] = {"ISO-2022-JP", NULL};
+static zend_encoding encoding_jis = {
 	NULL,
 	NULL,
 	"JIS",
@@ -201,8 +201,8 @@ zend_encoding encoding_jis = {
 	0
 };

-const char *euc_cn_aliases[] = {"CN-GB", "EUC_CN", "eucCN", "x-euc-cn", "gb2312", NULL};
-zend_encoding encoding_euc_cn = {
+static const char *euc_cn_aliases[] = {"CN-GB", "EUC_CN", "eucCN", "x-euc-cn", "gb2312", NULL};
+static zend_encoding encoding_euc_cn = {
 	NULL,
 	NULL,
 	"EUC-CN",
@@ -210,8 +210,8 @@ zend_encoding encoding_euc_cn = {
 	1
 };

-const char *cp936_aliases[] = {"CP-936", NULL};
-zend_encoding encoding_cp936 = {
+static const char *cp936_aliases[] = {"CP-936", NULL};
+static zend_encoding encoding_cp936 = {
 	NULL,
 	NULL,
 	"CP936",
@@ -219,8 +219,8 @@ zend_encoding encoding_cp936 = {
 	0
 };

-const char *hz_aliases[] = {"HZ-GB-2312", NULL};
-zend_encoding encoding_hz = {
+static const char *hz_aliases[] = {"HZ-GB-2312", NULL};
+static zend_encoding encoding_hz = {
 	NULL,
 	NULL,
 	"HZ",
@@ -228,8 +228,8 @@ zend_encoding encoding_hz = {
 	0
 };

-const char *euc_tw_aliases[] = {"EUC_TW", "eucTW", "x-euc-tw", NULL};
-zend_encoding encoding_euc_tw = {
+static const char *euc_tw_aliases[] = {"EUC_TW", "eucTW", "x-euc-tw", NULL};
+static zend_encoding encoding_euc_tw = {
 	NULL,
 	NULL,
 	"EUC-TW",
@@ -237,8 +237,8 @@ zend_encoding encoding_euc_tw = {
 	1
 };

-const char *big5_aliases[] = {"BIG5", "CN-BIG5", "BIG-FIVE", "BIGFIVE", "CP950", NULL};
-zend_encoding encoding_big5 = {
+static const char *big5_aliases[] = {"BIG5", "CN-BIG5", "BIG-FIVE", "BIGFIVE", "CP950", NULL};
+static zend_encoding encoding_big5 = {
 	NULL,
 	NULL,
 	"BIG-5",
@@ -246,8 +246,8 @@ zend_encoding encoding_big5 = {
 	0
 };

-const char *euc_kr_aliases[] = {"EUC_KR", "eucKR", "x-euc-kr", NULL};
-zend_encoding encoding_euc_kr = {
+static const char *euc_kr_aliases[] = {"EUC_KR", "eucKR", "x-euc-kr", NULL};
+static zend_encoding encoding_euc_kr = {
 	NULL,
 	NULL,
 	"EUC-KR",
@@ -255,8 +255,8 @@ zend_encoding encoding_euc_kr = {
 	1
 };

-const char *uhc_aliases[] = {"CP949", NULL};
-zend_encoding encoding_uhc = {
+static const char *uhc_aliases[] = {"CP949", NULL};
+static zend_encoding encoding_uhc = {
 	NULL,
 	NULL,
 	"UHC",
@@ -264,7 +264,7 @@ zend_encoding encoding_uhc = {
 	1
 };

-zend_encoding encoding_2022kr = {
+static zend_encoding encoding_2022kr = {
 	NULL,
 	NULL,
 	"ISO-2022-KR",
@@ -272,8 +272,8 @@ zend_encoding encoding_2022kr = {
 	0
 };

-const char *cp1252_aliases[] = {"cp1252", NULL};
-zend_encoding encoding_cp1252 = {
+static const char *cp1252_aliases[] = {"cp1252", NULL};
+static zend_encoding encoding_cp1252 = {
 	NULL,
 	NULL,
 	"Windows-1252",
@@ -281,8 +281,8 @@ zend_encoding encoding_cp1252 = {
 	1
 };

-const char *iso_8859_1_aliases[] = {"ISO_8859-1", "latin1", NULL};
-zend_encoding encoding_8859_1 = {
+static const char *iso_8859_1_aliases[] = {"ISO_8859-1", "latin1", NULL};
+static zend_encoding encoding_8859_1 = {
 	NULL,
 	NULL,
 	"ISO-8859-1",
@@ -290,8 +290,8 @@ zend_encoding encoding_8859_1 = {
 	1
 };

-const char *iso_8859_2_aliases[] = {"ISO_8859-2", "latin2", NULL};
-zend_encoding encoding_8859_2 = {
+static const char *iso_8859_2_aliases[] = {"ISO_8859-2", "latin2", NULL};
+static zend_encoding encoding_8859_2 = {
 	NULL,
 	NULL,
 	"ISO-8859-2",
@@ -299,8 +299,8 @@ zend_encoding encoding_8859_2 = {
 	1
 };

-const char *iso_8859_3_aliases[] = {"ISO_8859-3", "latin3", NULL};
-zend_encoding encoding_8859_3 = {
+static const char *iso_8859_3_aliases[] = {"ISO_8859-3", "latin3", NULL};
+static zend_encoding encoding_8859_3 = {
 	NULL,
 	NULL,
 	"ISO-8859-3",
@@ -308,8 +308,8 @@ zend_encoding encoding_8859_3 = {
 	1
 };

-const char *iso_8859_4_aliases[] = {"ISO_8859-4", "latin4", NULL};
-zend_encoding encoding_8859_4 = {
+static const char *iso_8859_4_aliases[] = {"ISO_8859-4", "latin4", NULL};
+static zend_encoding encoding_8859_4 = {
 	NULL,
 	NULL,
 	"ISO-8859-4",
@@ -317,8 +317,8 @@ zend_encoding encoding_8859_4 = {
 	1
 };

-const char *iso_8859_5_aliases[] = {"ISO_8859-5", "cyrillic", NULL};
-zend_encoding encoding_8859_5 = {
+static const char *iso_8859_5_aliases[] = {"ISO_8859-5", "cyrillic", NULL};
+static zend_encoding encoding_8859_5 = {
 	NULL,
 	NULL,
 	"ISO-8859-5",
@@ -326,8 +326,8 @@ zend_encoding encoding_8859_5 = {
 	1
 };

-const char *iso_8859_6_aliases[] = {"ISO_8859-6", "arabic", NULL};
-zend_encoding encoding_8859_6 = {
+static const char *iso_8859_6_aliases[] = {"ISO_8859-6", "arabic", NULL};
+static zend_encoding encoding_8859_6 = {
 	NULL,
 	NULL,
 	"ISO-8859-6",
@@ -335,8 +335,8 @@ zend_encoding encoding_8859_6 = {
 	1
 };

-const char *iso_8859_7_aliases[] = {"ISO_8859-7", "greek", NULL};
-zend_encoding encoding_8859_7 = {
+static const char *iso_8859_7_aliases[] = {"ISO_8859-7", "greek", NULL};
+static zend_encoding encoding_8859_7 = {
 	NULL,
 	NULL,
 	"ISO-8859-7",
@@ -344,8 +344,8 @@ zend_encoding encoding_8859_7 = {
 	1
 };

-const char *iso_8859_8_aliases[] = {"ISO_8859-8", "hebrew", NULL};
-zend_encoding encoding_8859_8 = {
+static const char *iso_8859_8_aliases[] = {"ISO_8859-8", "hebrew", NULL};
+static zend_encoding encoding_8859_8 = {
 	NULL,
 	NULL,
 	"ISO-8859-8",
@@ -353,8 +353,8 @@ zend_encoding encoding_8859_8 = {
 	1
 };

-const char *iso_8859_9_aliases[] = {"ISO_8859-9", "latin5", NULL};
-zend_encoding encoding_8859_9 = {
+static const char *iso_8859_9_aliases[] = {"ISO_8859-9", "latin5", NULL};
+static zend_encoding encoding_8859_9 = {
 	NULL,
 	NULL,
 	"ISO-8859-9",
@@ -362,8 +362,8 @@ zend_encoding encoding_8859_9 = {
 	1
 };

-const char *iso_8859_10_aliases[] = {"ISO_8859-10", "latin6", NULL};
-zend_encoding encoding_8859_10 = {
+static const char *iso_8859_10_aliases[] = {"ISO_8859-10", "latin6", NULL};
+static zend_encoding encoding_8859_10 = {
 	NULL,
 	NULL,
 	"ISO-8859-10",
@@ -371,8 +371,8 @@ zend_encoding encoding_8859_10 = {
 	1
 };

-const char *iso_8859_13_aliases[] = {"ISO_8859-13", NULL};
-zend_encoding encoding_8859_13 = {
+static const char *iso_8859_13_aliases[] = {"ISO_8859-13", NULL};
+static zend_encoding encoding_8859_13 = {
 	NULL,
 	NULL,
 	"ISO-8859-13",
@@ -380,8 +380,8 @@ zend_encoding encoding_8859_13 = {
 	1
 };

-const char *iso_8859_14_aliases[] = {"ISO_8859-14", "latin8", NULL};
-zend_encoding encoding_8859_14 = {
+static const char *iso_8859_14_aliases[] = {"ISO_8859-14", "latin8", NULL};
+static zend_encoding encoding_8859_14 = {
 	NULL,
 	NULL,
 	"ISO-8859-14",
@@ -389,8 +389,8 @@ zend_encoding encoding_8859_14 = {
 	1
 };

-const char *iso_8859_15_aliases[] = {"ISO_8859-15", NULL};
-zend_encoding encoding_8859_15 = {
+static const char *iso_8859_15_aliases[] = {"ISO_8859-15", NULL};
+static zend_encoding encoding_8859_15 = {
 	NULL,
 	NULL,
 	"ISO-8859-15",
@@ -398,8 +398,8 @@ zend_encoding encoding_8859_15 = {
 	1
 };

-const char *cp1251_aliases[] = {"CP1251", "CP-1251", "WINDOWS-1251", NULL};
-zend_encoding encoding_cp1251 = {
+static const char *cp1251_aliases[] = {"CP1251", "CP-1251", "WINDOWS-1251", NULL};
+static zend_encoding encoding_cp1251 = {
 	NULL,
 	NULL,
 	"Windows-1251",
@@ -407,8 +407,8 @@ zend_encoding encoding_cp1251 = {
 	1
 };

-const char *cp866_aliases[] = {"CP866", "CP-866", "IBM-866", NULL};
-zend_encoding encoding_cp866 = {
+static const char *cp866_aliases[] = {"CP866", "CP-866", "IBM-866", NULL};
+static zend_encoding encoding_cp866 = {
 	NULL,
 	NULL,
 	"CP866",
@@ -416,8 +416,8 @@ zend_encoding encoding_cp866 = {
 	1
 };

-const char *koi8r_aliases[] = {"KOI8-R", "KOI8R", NULL};
-zend_encoding encoding_koi8r = {
+static const char *koi8r_aliases[] = {"KOI8-R", "KOI8R", NULL};
+static zend_encoding encoding_koi8r = {
 	NULL,
 	NULL,
 	"KOI8-R",
@@ -425,7 +425,7 @@ zend_encoding encoding_koi8r = {
 	1
 };

-zend_encoding *zend_encoding_table[] = {
+static zend_encoding *zend_encoding_table[] = {
 	&encoding_ucs4,
 	&encoding_ucs4be,
 	&encoding_ucs4le,
@@ -472,6 +472,10 @@ zval *zend_std_read_dimension(zval *object, zval *offset, int type TSRMLS_DC)
 			}
 			return 0;
 		}
+		if (EG(exception)) {
+			zval_ptr_dtor(&retval);
+			return 0;
+		}

 		/* Undo PZVAL_LOCK() */
 		retval->refcount--;
@@ -560,8 +564,8 @@ static zval **zend_std_get_property_ptr_ptr(zval *object, zval *member TSRMLS_DC
 		zend_guard *guard;

 		if (!zobj->ce->__get ||
-		    zend_get_property_guard(zobj, property_info, member, &guard) != SUCCESS ||
-		    guard->in_get) {
+			zend_get_property_guard(zobj, property_info, member, &guard) != SUCCESS ||
+			(property_info && guard->in_get)) {
 			/* we don't have access controls - will just add it */
 			new_zval = &EG(uninitialized_zval);

@@ -758,15 +762,15 @@ static inline zend_class_entry * zend_get_function_root_class(zend_function *fbc
 }


-static inline union _zend_function *zend_get_user_call_function(zend_object *zobj, char *method_name, int method_len) /* {{{ */
+static inline union _zend_function *zend_get_user_call_function(zend_class_entry *ce, const char *method_name, int method_len) /* {{{ */
 {
 	zend_internal_function *call_user_call = emalloc(sizeof(zend_internal_function));
 	call_user_call->type = ZEND_INTERNAL_FUNCTION;
-	call_user_call->module = zobj->ce->module;
+	call_user_call->module = ce->module;
 	call_user_call->handler = zend_std_call_user_call;
 	call_user_call->arg_info = NULL;
 	call_user_call->num_args = 0;
-	call_user_call->scope = zobj->ce;
+	call_user_call->scope = ce;
 	call_user_call->fn_flags = 0;
 	call_user_call->function_name = estrndup(method_name, method_len);
 	call_user_call->pass_rest_by_reference = 0;
@@ -792,7 +796,7 @@ static union _zend_function *zend_std_get_method(zval **object_ptr, char *method
 	if (zend_hash_find(&zobj->ce->function_table, lc_method_name, method_len+1, (void **)&fbc) == FAILURE) {
 		free_alloca_with_limit(lc_method_name, use_heap);
 		if (zobj->ce->__call) {
-			return zend_get_user_call_function(zobj, method_name, method_len);
+			return zend_get_user_call_function(zobj->ce, method_name, method_len);
 		} else {
 			return NULL;
 		}
@@ -810,7 +814,7 @@ static union _zend_function *zend_std_get_method(zval **object_ptr, char *method
 			fbc = updated_fbc;
 		} else {
 			if (zobj->ce->__call) {
-				fbc = zend_get_user_call_function(zobj, method_name, method_len);
+				fbc = zend_get_user_call_function(zobj->ce, method_name, method_len);
 			} else {
 				zend_error(E_ERROR, "Call to %s method %s::%s() from context '%s'", zend_visibility_string(fbc->common.fn_flags), ZEND_FN_SCOPE_NAME(fbc), method_name, EG(scope) ? EG(scope)->name : "");
 			}
@@ -836,7 +840,7 @@ static union _zend_function *zend_std_get_method(zval **object_ptr, char *method
 			 */
 			if (!zend_check_protected(zend_get_function_root_class(fbc), EG(scope))) {
 				if (zobj->ce->__call) {
-					fbc = zend_get_user_call_function(zobj, method_name, method_len);
+					fbc = zend_get_user_call_function(zobj->ce, method_name, method_len);
 				} else {
 					zend_error(E_ERROR, "Call to %s method %s::%s() from context '%s'", zend_visibility_string(fbc->common.fn_flags), ZEND_FN_SCOPE_NAME(fbc), method_name, EG(scope) ? EG(scope)->name : "");
 				}
@@ -852,27 +856,19 @@ static union _zend_function *zend_std_get_method(zval **object_ptr, char *method
 /* This is not (yet?) in the API, but it belongs in the built-in objects callbacks */
 ZEND_API zend_function *zend_std_get_static_method(zend_class_entry *ce, char *function_name_strval, int function_name_strlen TSRMLS_DC)
 {
-	zend_function *fbc;
+	char *lc_function_name;
+	zend_function *fbc;	
+	
+	lc_function_name = zend_str_tolower_dup(function_name_strval, function_name_strlen);
+
+	if (zend_hash_find(&ce->function_table, lc_function_name, function_name_strlen+1, (void **) &fbc)==FAILURE) {
+		efree(lc_function_name);

-	if (zend_hash_find(&ce->function_table, function_name_strval, function_name_strlen+1, (void **) &fbc)==FAILURE) {
 		if (ce->__call &&
 		    EG(This) &&
 		    Z_OBJ_HT_P(EG(This))->get_class_entry &&
 		    instanceof_function(Z_OBJCE_P(EG(This)), ce TSRMLS_CC)) {
-			zend_internal_function *call_user_call = emalloc(sizeof(zend_internal_function));
-
-			call_user_call->type = ZEND_INTERNAL_FUNCTION;
-			call_user_call->module = ce->module;
-			call_user_call->handler = zend_std_call_user_call;
-			call_user_call->arg_info = NULL;
-			call_user_call->num_args = 0;
-			call_user_call->scope = ce;
-			call_user_call->fn_flags = 0;
-			call_user_call->function_name = estrndup(function_name_strval, function_name_strlen);
-			call_user_call->pass_rest_by_reference = 0;
-			call_user_call->return_reference = ZEND_RETURN_VALUE;
-
-			return (union _zend_function *)call_user_call;
+			return zend_get_user_call_function(ce, function_name_strval, function_name_strlen);
 		} else {
 			char *class_name = ce->name;

@@ -882,6 +878,8 @@ ZEND_API zend_function *zend_std_get_static_method(zend_class_entry *ce, char *f
 			zend_error(E_ERROR, "Call to undefined method %s::%s()", class_name, function_name_strval);
 		}
 	}
+	efree(lc_function_name);
+
 	if (fbc->op_array.fn_flags & ZEND_ACC_PUBLIC) {
 		/* No further checks necessary, most common case */
 	} else if (fbc->op_array.fn_flags & ZEND_ACC_PRIVATE) {
@@ -186,6 +186,22 @@ ZEND_API void convert_scalar_to_number(zval *op TSRMLS_DC)
 		}																	\
 	}

+#ifdef _WIN64
+# define DVAL_TO_LVAL(d, l) \
+	if ((d) > LONG_MAX) { \
+		(l) = (long)(unsigned long)(__int64) (d); \
+	} else { \
+		(l) = (long) (d); \
+	}
+#else
+# define DVAL_TO_LVAL(d, l) \
+	if ((d) > LONG_MAX) { \
+		(l) = (unsigned long) (d); \
+	} else { \
+		(l) = (long) (d); \
+	}
+#endif
+
 #define zendi_convert_to_long(op, holder, result)					\
 	if (op == result) {												\
 		convert_to_long(op);										\
@@ -920,7 +936,8 @@ ZEND_API int mod_function(zval *result, zval *op1, zval *op2 TSRMLS_DC)
 		return FAILURE;			/* modulus by zero */
 	}

-	if (abs(op2->value.lval) == 1) {
+	if (op2->value.lval == -1) {
+		/* Prevent overflow error/crash if op1==LONG_MIN */
 		ZVAL_LONG(result, 0);
 		return SUCCESS;
 	}
@@ -36,18 +36,6 @@
 #include "ext/bcmath/libbcmath/src/bcmath.h"
 #endif

-#if SIZEOF_LONG == 4
-#define MAX_LENGTH_OF_LONG 11
-static const char long_min_digits[] = "2147483648";
-#elif SIZEOF_LONG == 8
-#define MAX_LENGTH_OF_LONG 20
-static const char long_min_digits[] = "9223372036854775808";
-#else
-#error "Unknown SIZEOF_LONG"
-#endif
-
-#define MAX_LENGTH_OF_DOUBLE 32
-
 BEGIN_EXTERN_C()
 ZEND_API int add_function(zval *result, zval *op1, zval *op2 TSRMLS_DC);
 ZEND_API int sub_function(zval *result, zval *op1, zval *op2 TSRMLS_DC);
@@ -75,22 +63,6 @@ ZEND_API zend_bool instanceof_function_ex(zend_class_entry *instance_ce, zend_cl
 ZEND_API zend_bool instanceof_function(zend_class_entry *instance_ce, zend_class_entry *ce TSRMLS_DC);
 END_EXTERN_C()

-#ifdef _WIN64
-# define DVAL_TO_LVAL(d, l) \
-      if ((d) > LONG_MAX) { \
-              (l) = (long)(unsigned long)(__int64) (d); \
-      } else { \
-              (l) = (long) (d); \
-      }
-#else
-# define DVAL_TO_LVAL(d, l) \
-      if ((d) > LONG_MAX) { \
-              (l) = (unsigned long) (d); \
-      } else { \
-              (l) = (long) (d); \
-      }
-#endif
-
 #define ZEND_IS_DIGIT(c) ((c) >= '0' && (c) <= '9')
 #define ZEND_IS_XDIGIT(c) (((c) >= 'A' && (c) <= 'F') || ((c) >= 'a'  && (c) <= 'f'))

@@ -26,8 +26,7 @@
 #include "zend_constants.h"
 #include "zend_list.h"

-
-ZEND_API void _zval_dtor_func(zval *zvalue ZEND_FILE_LINE_DC)
+ZEND_API void _zval_dtor_func(zval *zvalue ZEND_FILE_LINE_DC) /* {{{ */
 {
 	switch (zvalue->type & ~IS_CONSTANT_INDEX) {
 		case IS_STRING:
@@ -69,9 +68,9 @@ ZEND_API void _zval_dtor_func(zval *zvalue ZEND_FILE_LINE_DC)
 			break;
 	}
 }
+/* }}} */

-
-ZEND_API void _zval_internal_dtor(zval *zvalue ZEND_FILE_LINE_DC)
+ZEND_API void _zval_internal_dtor(zval *zvalue ZEND_FILE_LINE_DC) /* {{{ */
 {
 	switch (zvalue->type & ~IS_CONSTANT_INDEX) {
 		case IS_STRING:
@@ -93,15 +92,15 @@ ZEND_API void _zval_internal_dtor(zval *zvalue ZEND_FILE_LINE_DC)
 			break;
 	}
 }
+/* }}} */

-
-ZEND_API void zval_add_ref(zval **p)
+ZEND_API void zval_add_ref(zval **p) /* {{{ */
 {
 	(*p)->refcount++;
 }
+/* }}} */

-
-ZEND_API void _zval_copy_ctor_func(zval *zvalue ZEND_FILE_LINE_DC)
+ZEND_API void _zval_copy_ctor_func(zval *zvalue ZEND_FILE_LINE_DC) /* {{{ */
 {
 	switch (zvalue->type) {
 		case IS_RESOURCE: {
@@ -143,43 +142,44 @@ ZEND_API void _zval_copy_ctor_func(zval *zvalue ZEND_FILE_LINE_DC)
 			break;
 	}
 }
+/* }}} */

-
-ZEND_API int zend_print_variable(zval *var) 
+ZEND_API int zend_print_variable(zval *var) /* {{{ */
 {
 	return zend_print_zval(var, 0);
 }
-
+/* }}} */

 #if ZEND_DEBUG
-ZEND_API void _zval_copy_ctor_wrapper(zval *zvalue)
+ZEND_API void _zval_copy_ctor_wrapper(zval *zvalue) /* {{{ */
 {
 	zval_copy_ctor(zvalue);
 }
+/* }}} */

-
-ZEND_API void _zval_dtor_wrapper(zval *zvalue)
+ZEND_API void _zval_dtor_wrapper(zval *zvalue) /* {{{ */
 {
 	zval_dtor(zvalue);
 }
+/* }}} */

-
-ZEND_API void _zval_internal_dtor_wrapper(zval *zvalue)
+ZEND_API void _zval_internal_dtor_wrapper(zval *zvalue) /* {{{ */
 {
 	zval_internal_dtor(zvalue);
 }
+/* }}} */

-
-ZEND_API void _zval_ptr_dtor_wrapper(zval **zval_ptr)
+ZEND_API void _zval_ptr_dtor_wrapper(zval **zval_ptr) /* {{{ */
 {
 	zval_ptr_dtor(zval_ptr);
 }
+/* }}} */

-
-ZEND_API void _zval_internal_ptr_dtor_wrapper(zval **zval_ptr)
+ZEND_API void _zval_internal_ptr_dtor_wrapper(zval **zval_ptr) /* {{{ */
 {
 	zval_internal_ptr_dtor(zval_ptr);
 }
+/* }}} */
 #endif

 /*
@@ -29,20 +29,20 @@ ZEND_API void _zval_dtor_func(zval *zvalue ZEND_FILE_LINE_DC);

 static inline void _zval_dtor(zval *zvalue ZEND_FILE_LINE_DC)
 {
-        if (zvalue->type <= IS_BOOL) {
-                return;
-        }
-	_zval_dtor_func(zvalue ZEND_FILE_LINE_CC);
+	if (zvalue->type <= IS_BOOL) {
+		return;
+	}
+	_zval_dtor_func(zvalue ZEND_FILE_LINE_RELAY_CC);
 }

 ZEND_API void _zval_copy_ctor_func(zval *zvalue ZEND_FILE_LINE_DC);

 static inline void _zval_copy_ctor(zval *zvalue ZEND_FILE_LINE_DC)
 {
-        if (zvalue->type <= IS_BOOL) {
-                return;
-        }
-	_zval_copy_ctor_func(zvalue ZEND_FILE_LINE_CC);
+	if (zvalue->type <= IS_BOOL) {
+		return;
+	}
+	_zval_copy_ctor_func(zvalue ZEND_FILE_LINE_RELAY_CC);
 }


@@ -294,6 +294,10 @@ ZEND_VM_HELPER_EX(zend_binary_assign_op_obj_helper, VAR|UNUSED|CV, CONST|TMP|VAR
 	zval **retval = &EX_T(result->u.var).var.ptr;
 	int have_get_ptr = 0;

+	if (OP1_TYPE == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
+	}
+
 	EX_T(result->u.var).var.ptr_ptr = NULL;
 	make_real_object(object_ptr TSRMLS_CC);
 	object = *object_ptr;
@@ -545,6 +549,10 @@ ZEND_VM_HELPER_EX(zend_pre_incdec_property_helper, VAR|UNUSED|CV, CONST|TMP|VAR|
 	zval **retval = &EX_T(opline->result.u.var).var.ptr;
 	int have_get_ptr = 0;

+	if (OP1_TYPE == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
+	}
+
 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
 	object = *object_ptr;

@@ -637,6 +645,10 @@ ZEND_VM_HELPER_EX(zend_post_incdec_property_helper, VAR|UNUSED|CV, CONST|TMP|VAR
 	zval *retval = &EX_T(opline->result.u.var).tmp_var;
 	int have_get_ptr = 0;

+	if (OP1_TYPE == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
+	}
+
 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
 	object = *object_ptr;

@@ -1783,7 +1795,7 @@ ZEND_VM_HANDLER(113, ZEND_INIT_STATIC_METHOD_CALL, ANY, CONST|TMP|VAR|UNUSED|CV)

 	ce = EX_T(opline->op1.u.var).class_entry;
 	if(OP2_TYPE != IS_UNUSED) {
-		char *function_name_strval;
+		char *function_name_strval = NULL;
 		int function_name_strlen;
 		zend_bool is_const = (OP2_TYPE == IS_CONST);
 		zend_free_op free_op2;
@@ -1796,15 +1808,17 @@ ZEND_VM_HANDLER(113, ZEND_INIT_STATIC_METHOD_CALL, ANY, CONST|TMP|VAR|UNUSED|CV)

 			if (Z_TYPE_P(function_name) != IS_STRING) {
 				zend_error_noreturn(E_ERROR, "Function name must be a string");
+			} else {
+				function_name_strval = Z_STRVAL_P(function_name);
+				function_name_strlen = Z_STRLEN_P(function_name);
 			}
-			function_name_strval = zend_str_tolower_dup(function_name->value.str.val, function_name->value.str.len);
-			function_name_strlen = function_name->value.str.len;
 		}

-		EX(fbc) = zend_std_get_static_method(ce, function_name_strval, function_name_strlen TSRMLS_CC);
+		if (function_name_strval) {
+			EX(fbc) = zend_std_get_static_method(ce, function_name_strval, function_name_strlen TSRMLS_CC);
+		}

 		if (!is_const) {
-			efree(function_name_strval);
 			FREE_OP2();
 		}
 	} else {
@@ -2070,7 +2084,7 @@ ZEND_VM_HELPER(zend_do_fcall_common_helper, ANY, ANY)
 		EG(This) = current_this;
 		EG(scope) = current_scope;
 	}
-	zend_ptr_stack_2_pop(&EG(arg_types_stack), (void**)&EX(object), (void**)&EX(fbc));
+	zend_arg_types_stack_2_pop(&EG(arg_types_stack), &EX(object), &EX(fbc));

 	zend_ptr_stack_clear_multiple(TSRMLS_C);

@@ -2357,6 +2371,10 @@ ZEND_VM_HANDLER(67, ZEND_SEND_REF, VAR|CV, ANY)
 		zend_error_noreturn(E_ERROR, "Only variables can be passed by reference");
 	}

+      	if (EX(function_state).function->type == ZEND_INTERNAL_FUNCTION && !ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), opline->op2.u.opline_num)) {
+               ZEND_VM_DISPATCH_TO_HELPER(zend_send_by_var_helper);
+        }
+
 	SEPARATE_ZVAL_TO_MAKE_IS_REF(varptr_ptr);
 	varptr = *varptr_ptr;
 	varptr->refcount++;
@@ -2726,11 +2744,9 @@ ZEND_VM_HANDLER(72, ZEND_ADD_ARRAY_ELEMENT, CONST|TMP|VAR|CV, CONST|TMP|VAR|UNUS
 		}
 	}
 	if (offset) {
-	  	long l;
 		switch (Z_TYPE_P(offset)) {
 			case IS_DOUBLE:
-			  	DVAL_TO_LVAL(Z_DVAL_P(offset), l);
-				zend_hash_index_update(Z_ARRVAL_P(array_ptr), l, &expr_ptr, sizeof(zval *), NULL);
+				zend_hash_index_update(Z_ARRVAL_P(array_ptr), (long) Z_DVAL_P(offset), &expr_ptr, sizeof(zval *), NULL);
 				break;
 			case IS_LONG:
 			case IS_BOOL:
@@ -3184,15 +3200,22 @@ ZEND_VM_HANDLER(77, ZEND_FE_RESET, CONST|TMP|VAR|CV, ANY)
 			ALLOC_ZVAL(tmp);
 			INIT_PZVAL_COPY(tmp, array_ptr);
 			array_ptr = tmp;
+			if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
+				ce = Z_OBJCE_P(array_ptr);
+				if (ce && ce->get_iterator) {
+					array_ptr->refcount--;
+				}
+			}
 		} else if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
 			ce = Z_OBJCE_P(array_ptr);
 			if (!ce || !ce->get_iterator) {
 				array_ptr->refcount++;
 			}
 		} else {
-			if ((OP1_TYPE == IS_CV || OP1_TYPE == IS_VAR) &&
+			if (OP1_TYPE == IS_CONST ||
+			    ((OP1_TYPE == IS_CV || OP1_TYPE == IS_VAR) &&
 			    !array_ptr->is_ref &&
-			    array_ptr->refcount > 1) {
+			    array_ptr->refcount > 1)) {
 				zval *tmp;

 				ALLOC_ZVAL(tmp);
@@ -3205,7 +3228,7 @@ ZEND_VM_HANDLER(77, ZEND_FE_RESET, CONST|TMP|VAR|CV, ANY)
 		}
 	}

-	if (OP1_TYPE != IS_TMP_VAR && ce && ce->get_iterator) {
+	if (ce && ce->get_iterator) {
 		iter = ce->get_iterator(ce, array_ptr, opline->extended_value & ZEND_FE_RESET_REFERENCE TSRMLS_CC);

 		if (iter && !EG(exception)) {
@@ -3844,7 +3867,7 @@ ZEND_VM_HANDLER(149, ZEND_HANDLE_EXCEPTION, ANY, ANY)
 			}
 			zval_ptr_dtor(&EX(object));
 		}
-		zend_ptr_stack_2_pop(&EG(arg_types_stack), (void**)&EX(object), (void**)&EX(fbc));
+		zend_arg_types_stack_2_pop(&EG(arg_types_stack), &EX(object), &EX(fbc));
 	}

 	for (i=0; i<EX(op_array)->last_brk_cont; i++) {
@@ -302,7 +302,7 @@ static int zend_do_fcall_common_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS)
 		EG(This) = current_this;
 		EG(scope) = current_scope;
 	}
-	zend_ptr_stack_2_pop(&EG(arg_types_stack), (void**)&EX(object), (void**)&EX(fbc));
+	zend_arg_types_stack_2_pop(&EG(arg_types_stack), &EX(object), &EX(fbc));

 	zend_ptr_stack_clear_multiple(TSRMLS_C);

@@ -562,7 +562,7 @@ static int ZEND_HANDLE_EXCEPTION_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 			}
 			zval_ptr_dtor(&EX(object));
 		}
-		zend_ptr_stack_2_pop(&EG(arg_types_stack), (void**)&EX(object), (void**)&EX(fbc));
+		zend_arg_types_stack_2_pop(&EG(arg_types_stack), &EX(object), &EX(fbc));
 	}

 	for (i=0; i<EX(op_array)->last_brk_cont; i++) {
@@ -667,7 +667,7 @@ static int ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_A

 	ce = EX_T(opline->op1.u.var).class_entry;
 	if(IS_CONST != IS_UNUSED) {
-		char *function_name_strval;
+		char *function_name_strval = NULL;
 		int function_name_strlen;
 		zend_bool is_const = (IS_CONST == IS_CONST);

@@ -680,15 +680,17 @@ static int ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_A

 			if (Z_TYPE_P(function_name) != IS_STRING) {
 				zend_error_noreturn(E_ERROR, "Function name must be a string");
+			} else {
+				function_name_strval = Z_STRVAL_P(function_name);
+				function_name_strlen = Z_STRLEN_P(function_name);
 			}
-			function_name_strval = zend_str_tolower_dup(function_name->value.str.val, function_name->value.str.len);
-			function_name_strlen = function_name->value.str.len;
 		}

-		EX(fbc) = zend_std_get_static_method(ce, function_name_strval, function_name_strlen TSRMLS_CC);
+		if (function_name_strval) {
+			EX(fbc) = zend_std_get_static_method(ce, function_name_strval, function_name_strlen TSRMLS_CC);
+		}

 		if (!is_const) {
-			efree(function_name_strval);

 		}
 	} else {
@@ -878,7 +880,7 @@ static int ZEND_INIT_STATIC_METHOD_CALL_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARG

 	ce = EX_T(opline->op1.u.var).class_entry;
 	if(IS_TMP_VAR != IS_UNUSED) {
-		char *function_name_strval;
+		char *function_name_strval = NULL;
 		int function_name_strlen;
 		zend_bool is_const = (IS_TMP_VAR == IS_CONST);
 		zend_free_op free_op2;
@@ -891,15 +893,17 @@ static int ZEND_INIT_STATIC_METHOD_CALL_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARG

 			if (Z_TYPE_P(function_name) != IS_STRING) {
 				zend_error_noreturn(E_ERROR, "Function name must be a string");
+			} else {
+				function_name_strval = Z_STRVAL_P(function_name);
+				function_name_strlen = Z_STRLEN_P(function_name);
 			}
-			function_name_strval = zend_str_tolower_dup(function_name->value.str.val, function_name->value.str.len);
-			function_name_strlen = function_name->value.str.len;
 		}

-		EX(fbc) = zend_std_get_static_method(ce, function_name_strval, function_name_strlen TSRMLS_CC);
+		if (function_name_strval) {
+			EX(fbc) = zend_std_get_static_method(ce, function_name_strval, function_name_strlen TSRMLS_CC);
+		}

 		if (!is_const) {
-			efree(function_name_strval);
 			zval_dtor(free_op2.var);
 		}
 	} else {
@@ -1049,7 +1053,7 @@ static int ZEND_INIT_STATIC_METHOD_CALL_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARG

 	ce = EX_T(opline->op1.u.var).class_entry;
 	if(IS_VAR != IS_UNUSED) {
-		char *function_name_strval;
+		char *function_name_strval = NULL;
 		int function_name_strlen;
 		zend_bool is_const = (IS_VAR == IS_CONST);
 		zend_free_op free_op2;
@@ -1062,15 +1066,17 @@ static int ZEND_INIT_STATIC_METHOD_CALL_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARG

 			if (Z_TYPE_P(function_name) != IS_STRING) {
 				zend_error_noreturn(E_ERROR, "Function name must be a string");
+			} else {
+				function_name_strval = Z_STRVAL_P(function_name);
+				function_name_strlen = Z_STRLEN_P(function_name);
 			}
-			function_name_strval = zend_str_tolower_dup(function_name->value.str.val, function_name->value.str.len);
-			function_name_strlen = function_name->value.str.len;
 		}

-		EX(fbc) = zend_std_get_static_method(ce, function_name_strval, function_name_strlen TSRMLS_CC);
+		if (function_name_strval) {
+			EX(fbc) = zend_std_get_static_method(ce, function_name_strval, function_name_strlen TSRMLS_CC);
+		}

 		if (!is_const) {
-			efree(function_name_strval);
 			if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
 		}
 	} else {
@@ -1219,7 +1225,7 @@ static int ZEND_INIT_STATIC_METHOD_CALL_SPEC_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_

 	ce = EX_T(opline->op1.u.var).class_entry;
 	if(IS_UNUSED != IS_UNUSED) {
-		char *function_name_strval;
+		char *function_name_strval = NULL;
 		int function_name_strlen;
 		zend_bool is_const = (IS_UNUSED == IS_CONST);

@@ -1232,15 +1238,17 @@ static int ZEND_INIT_STATIC_METHOD_CALL_SPEC_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_

 			if (Z_TYPE_P(function_name) != IS_STRING) {
 				zend_error_noreturn(E_ERROR, "Function name must be a string");
+			} else {
+				function_name_strval = Z_STRVAL_P(function_name);
+				function_name_strlen = Z_STRLEN_P(function_name);
 			}
-			function_name_strval = zend_str_tolower_dup(function_name->value.str.val, function_name->value.str.len);
-			function_name_strlen = function_name->value.str.len;
 		}

-		EX(fbc) = zend_std_get_static_method(ce, function_name_strval, function_name_strlen TSRMLS_CC);
+		if (function_name_strval) {
+			EX(fbc) = zend_std_get_static_method(ce, function_name_strval, function_name_strlen TSRMLS_CC);
+		}

 		if (!is_const) {
-			efree(function_name_strval);

 		}
 	} else {
@@ -1322,7 +1330,7 @@ static int ZEND_INIT_STATIC_METHOD_CALL_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS

 	ce = EX_T(opline->op1.u.var).class_entry;
 	if(IS_CV != IS_UNUSED) {
-		char *function_name_strval;
+		char *function_name_strval = NULL;
 		int function_name_strlen;
 		zend_bool is_const = (IS_CV == IS_CONST);

@@ -1335,15 +1343,17 @@ static int ZEND_INIT_STATIC_METHOD_CALL_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS

 			if (Z_TYPE_P(function_name) != IS_STRING) {
 				zend_error_noreturn(E_ERROR, "Function name must be a string");
+			} else {
+				function_name_strval = Z_STRVAL_P(function_name);
+				function_name_strlen = Z_STRLEN_P(function_name);
 			}
-			function_name_strval = zend_str_tolower_dup(function_name->value.str.val, function_name->value.str.len);
-			function_name_strlen = function_name->value.str.len;
 		}

-		EX(fbc) = zend_std_get_static_method(ce, function_name_strval, function_name_strlen TSRMLS_CC);
+		if (function_name_strval) {
+			EX(fbc) = zend_std_get_static_method(ce, function_name_strval, function_name_strlen TSRMLS_CC);
+		}

 		if (!is_const) {
-			efree(function_name_strval);

 		}
 	} else {
@@ -2220,15 +2230,22 @@ static int ZEND_FE_RESET_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 			ALLOC_ZVAL(tmp);
 			INIT_PZVAL_COPY(tmp, array_ptr);
 			array_ptr = tmp;
+			if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
+				ce = Z_OBJCE_P(array_ptr);
+				if (ce && ce->get_iterator) {
+					array_ptr->refcount--;
+				}
+			}
 		} else if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
 			ce = Z_OBJCE_P(array_ptr);
 			if (!ce || !ce->get_iterator) {
 				array_ptr->refcount++;
 			}
 		} else {
-			if ((IS_CONST == IS_CV || IS_CONST == IS_VAR) &&
+			if (IS_CONST == IS_CONST ||
+			    ((IS_CONST == IS_CV || IS_CONST == IS_VAR) &&
 			    !array_ptr->is_ref &&
-			    array_ptr->refcount > 1) {
+			    array_ptr->refcount > 1)) {
 				zval *tmp;

 				ALLOC_ZVAL(tmp);
@@ -2241,7 +2258,7 @@ static int ZEND_FE_RESET_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 		}
 	}

-	if (IS_CONST != IS_TMP_VAR && ce && ce->get_iterator) {
+	if (ce && ce->get_iterator) {
 		iter = ce->get_iterator(ce, array_ptr, opline->extended_value & ZEND_FE_RESET_REFERENCE TSRMLS_CC);

 		if (iter && !EG(exception)) {
@@ -2810,11 +2827,9 @@ static int ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_A
 		}
 	}
 	if (offset) {
-	  	long l;
 		switch (Z_TYPE_P(offset)) {
 			case IS_DOUBLE:
-			  	DVAL_TO_LVAL(Z_DVAL_P(offset), l);
-				zend_hash_index_update(Z_ARRVAL_P(array_ptr), l, &expr_ptr, sizeof(zval *), NULL);
+				zend_hash_index_update(Z_ARRVAL_P(array_ptr), (long) Z_DVAL_P(offset), &expr_ptr, sizeof(zval *), NULL);
 				break;
 			case IS_LONG:
 			case IS_BOOL:
@@ -3171,11 +3186,9 @@ static int ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARG
 		}
 	}
 	if (offset) {
-	  	long l;
 		switch (Z_TYPE_P(offset)) {
 			case IS_DOUBLE:
-			  	DVAL_TO_LVAL(Z_DVAL_P(offset), l);
-				zend_hash_index_update(Z_ARRVAL_P(array_ptr), l, &expr_ptr, sizeof(zval *), NULL);
+				zend_hash_index_update(Z_ARRVAL_P(array_ptr), (long) Z_DVAL_P(offset), &expr_ptr, sizeof(zval *), NULL);
 				break;
 			case IS_LONG:
 			case IS_BOOL:
@@ -3532,11 +3545,9 @@ static int ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARG
 		}
 	}
 	if (offset) {
-	  	long l;
 		switch (Z_TYPE_P(offset)) {
 			case IS_DOUBLE:
-			  	DVAL_TO_LVAL(Z_DVAL_P(offset), l);
-				zend_hash_index_update(Z_ARRVAL_P(array_ptr), l, &expr_ptr, sizeof(zval *), NULL);
+				zend_hash_index_update(Z_ARRVAL_P(array_ptr), (long) Z_DVAL_P(offset), &expr_ptr, sizeof(zval *), NULL);
 				break;
 			case IS_LONG:
 			case IS_BOOL:
@@ -3627,11 +3638,9 @@ static int ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_
 		}
 	}
 	if (offset) {
-	  	long l;
 		switch (Z_TYPE_P(offset)) {
 			case IS_DOUBLE:
-			  	DVAL_TO_LVAL(Z_DVAL_P(offset), l);
-				zend_hash_index_update(Z_ARRVAL_P(array_ptr), l, &expr_ptr, sizeof(zval *), NULL);
+				zend_hash_index_update(Z_ARRVAL_P(array_ptr), (long) Z_DVAL_P(offset), &expr_ptr, sizeof(zval *), NULL);
 				break;
 			case IS_LONG:
 			case IS_BOOL:
@@ -3987,11 +3996,9 @@ static int ZEND_ADD_ARRAY_ELEMENT_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS
 		}
 	}
 	if (offset) {
-	  	long l;
 		switch (Z_TYPE_P(offset)) {
 			case IS_DOUBLE:
-			  	DVAL_TO_LVAL(Z_DVAL_P(offset), l);
-				zend_hash_index_update(Z_ARRVAL_P(array_ptr), l, &expr_ptr, sizeof(zval *), NULL);
+				zend_hash_index_update(Z_ARRVAL_P(array_ptr), (long) Z_DVAL_P(offset), &expr_ptr, sizeof(zval *), NULL);
 				break;
 			case IS_LONG:
 			case IS_BOOL:
@@ -4805,15 +4812,22 @@ static int ZEND_FE_RESET_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 			ALLOC_ZVAL(tmp);
 			INIT_PZVAL_COPY(tmp, array_ptr);
 			array_ptr = tmp;
+			if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
+				ce = Z_OBJCE_P(array_ptr);
+				if (ce && ce->get_iterator) {
+					array_ptr->refcount--;
+				}
+			}
 		} else if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
 			ce = Z_OBJCE_P(array_ptr);
 			if (!ce || !ce->get_iterator) {
 				array_ptr->refcount++;
 			}
 		} else {
-			if ((IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) &&
+			if (IS_TMP_VAR == IS_CONST ||
+			    ((IS_TMP_VAR == IS_CV || IS_TMP_VAR == IS_VAR) &&
 			    !array_ptr->is_ref &&
-			    array_ptr->refcount > 1) {
+			    array_ptr->refcount > 1)) {
 				zval *tmp;

 				ALLOC_ZVAL(tmp);
@@ -4826,7 +4840,7 @@ static int ZEND_FE_RESET_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 		}
 	}

-	if (IS_TMP_VAR != IS_TMP_VAR && ce && ce->get_iterator) {
+	if (ce && ce->get_iterator) {
 		iter = ce->get_iterator(ce, array_ptr, opline->extended_value & ZEND_FE_RESET_REFERENCE TSRMLS_CC);

 		if (iter && !EG(exception)) {
@@ -5450,11 +5464,9 @@ static int ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARG
 		}
 	}
 	if (offset) {
-	  	long l;
 		switch (Z_TYPE_P(offset)) {
 			case IS_DOUBLE:
-			  	DVAL_TO_LVAL(Z_DVAL_P(offset), l);
-				zend_hash_index_update(Z_ARRVAL_P(array_ptr), l, &expr_ptr, sizeof(zval *), NULL);
+				zend_hash_index_update(Z_ARRVAL_P(array_ptr), (long) Z_DVAL_P(offset), &expr_ptr, sizeof(zval *), NULL);
 				break;
 			case IS_LONG:
 			case IS_BOOL:
@@ -5897,11 +5909,9 @@ static int ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 		}
 	}
 	if (offset) {
-	  	long l;
 		switch (Z_TYPE_P(offset)) {
 			case IS_DOUBLE:
-			  	DVAL_TO_LVAL(Z_DVAL_P(offset), l);
-				zend_hash_index_update(Z_ARRVAL_P(array_ptr), l, &expr_ptr, sizeof(zval *), NULL);
+				zend_hash_index_update(Z_ARRVAL_P(array_ptr), (long) Z_DVAL_P(offset), &expr_ptr, sizeof(zval *), NULL);
 				break;
 			case IS_LONG:
 			case IS_BOOL:
@@ -6344,11 +6354,9 @@ static int ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 		}
 	}
 	if (offset) {
-	  	long l;
 		switch (Z_TYPE_P(offset)) {
 			case IS_DOUBLE:
-			  	DVAL_TO_LVAL(Z_DVAL_P(offset), l);
-				zend_hash_index_update(Z_ARRVAL_P(array_ptr), l, &expr_ptr, sizeof(zval *), NULL);
+				zend_hash_index_update(Z_ARRVAL_P(array_ptr), (long) Z_DVAL_P(offset), &expr_ptr, sizeof(zval *), NULL);
 				break;
 			case IS_LONG:
 			case IS_BOOL:
@@ -6439,11 +6447,9 @@ static int ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_AR
 		}
 	}
 	if (offset) {
-	  	long l;
 		switch (Z_TYPE_P(offset)) {
 			case IS_DOUBLE:
-			  	DVAL_TO_LVAL(Z_DVAL_P(offset), l);
-				zend_hash_index_update(Z_ARRVAL_P(array_ptr), l, &expr_ptr, sizeof(zval *), NULL);
+				zend_hash_index_update(Z_ARRVAL_P(array_ptr), (long) Z_DVAL_P(offset), &expr_ptr, sizeof(zval *), NULL);
 				break;
 			case IS_LONG:
 			case IS_BOOL:
@@ -6883,11 +6889,9 @@ static int ZEND_ADD_ARRAY_ELEMENT_SPEC_TMP_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 		}
 	}
 	if (offset) {
-	  	long l;
 		switch (Z_TYPE_P(offset)) {
 			case IS_DOUBLE:
-			  	DVAL_TO_LVAL(Z_DVAL_P(offset), l);
-				zend_hash_index_update(Z_ARRVAL_P(array_ptr), l, &expr_ptr, sizeof(zval *), NULL);
+				zend_hash_index_update(Z_ARRVAL_P(array_ptr), (long) Z_DVAL_P(offset), &expr_ptr, sizeof(zval *), NULL);
 				break;
 			case IS_LONG:
 			case IS_BOOL:
@@ -7580,6 +7584,10 @@ static int ZEND_SEND_REF_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 		zend_error_noreturn(E_ERROR, "Only variables can be passed by reference");
 	}

+      	if (EX(function_state).function->type == ZEND_INTERNAL_FUNCTION && !ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), opline->op2.u.opline_num)) {
+               return zend_send_by_var_helper_SPEC_VAR(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
+        }
+
 	SEPARATE_ZVAL_TO_MAKE_IS_REF(varptr_ptr);
 	varptr = *varptr_ptr;
 	varptr->refcount++;
@@ -7964,15 +7972,22 @@ static int ZEND_FE_RESET_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 			ALLOC_ZVAL(tmp);
 			INIT_PZVAL_COPY(tmp, array_ptr);
 			array_ptr = tmp;
+			if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
+				ce = Z_OBJCE_P(array_ptr);
+				if (ce && ce->get_iterator) {
+					array_ptr->refcount--;
+				}
+			}
 		} else if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
 			ce = Z_OBJCE_P(array_ptr);
 			if (!ce || !ce->get_iterator) {
 				array_ptr->refcount++;
 			}
 		} else {
-			if ((IS_VAR == IS_CV || IS_VAR == IS_VAR) &&
+			if (IS_VAR == IS_CONST ||
+			    ((IS_VAR == IS_CV || IS_VAR == IS_VAR) &&
 			    !array_ptr->is_ref &&
-			    array_ptr->refcount > 1) {
+			    array_ptr->refcount > 1)) {
 				zval *tmp;

 				ALLOC_ZVAL(tmp);
@@ -7985,7 +8000,7 @@ static int ZEND_FE_RESET_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 		}
 	}

-	if (IS_VAR != IS_TMP_VAR && ce && ce->get_iterator) {
+	if (ce && ce->get_iterator) {
 		iter = ce->get_iterator(ce, array_ptr, opline->extended_value & ZEND_FE_RESET_REFERENCE TSRMLS_CC);

 		if (iter && !EG(exception)) {
@@ -8573,6 +8588,10 @@ static int zend_binary_assign_op_obj_helper_SPEC_VAR_CONST(int (*binary_op)(zval
 	zval **retval = &EX_T(result->u.var).var.ptr;
 	int have_get_ptr = 0;

+	if (IS_VAR == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
+	}
+
 	EX_T(result->u.var).var.ptr_ptr = NULL;
 	make_real_object(object_ptr TSRMLS_CC);
 	object = *object_ptr;
@@ -8823,6 +8842,10 @@ static int zend_pre_incdec_property_helper_SPEC_VAR_CONST(incdec_t incdec_op, ZE
 	zval **retval = &EX_T(opline->result.u.var).var.ptr;
 	int have_get_ptr = 0;

+	if (IS_VAR == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
+	}
+
 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
 	object = *object_ptr;

@@ -8915,6 +8938,10 @@ static int zend_post_incdec_property_helper_SPEC_VAR_CONST(incdec_t incdec_op, Z
 	zval *retval = &EX_T(opline->result.u.var).tmp_var;
 	int have_get_ptr = 0;

+	if (IS_VAR == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
+	}
+
 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
 	object = *object_ptr;

@@ -9535,11 +9562,9 @@ static int ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARG
 		}
 	}
 	if (offset) {
-	  	long l;
 		switch (Z_TYPE_P(offset)) {
 			case IS_DOUBLE:
-			  	DVAL_TO_LVAL(Z_DVAL_P(offset), l);
-				zend_hash_index_update(Z_ARRVAL_P(array_ptr), l, &expr_ptr, sizeof(zval *), NULL);
+				zend_hash_index_update(Z_ARRVAL_P(array_ptr), (long) Z_DVAL_P(offset), &expr_ptr, sizeof(zval *), NULL);
 				break;
 			case IS_LONG:
 			case IS_BOOL:
@@ -10092,6 +10117,10 @@ static int zend_binary_assign_op_obj_helper_SPEC_VAR_TMP(int (*binary_op)(zval *
 	zval **retval = &EX_T(result->u.var).var.ptr;
 	int have_get_ptr = 0;

+	if (IS_VAR == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
+	}
+
 	EX_T(result->u.var).var.ptr_ptr = NULL;
 	make_real_object(object_ptr TSRMLS_CC);
 	object = *object_ptr;
@@ -10343,6 +10372,10 @@ static int zend_pre_incdec_property_helper_SPEC_VAR_TMP(incdec_t incdec_op, ZEND
 	zval **retval = &EX_T(opline->result.u.var).var.ptr;
 	int have_get_ptr = 0;

+	if (IS_VAR == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
+	}
+
 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
 	object = *object_ptr;

@@ -10435,6 +10468,10 @@ static int zend_post_incdec_property_helper_SPEC_VAR_TMP(incdec_t incdec_op, ZEN
 	zval *retval = &EX_T(opline->result.u.var).tmp_var;
 	int have_get_ptr = 0;

+	if (IS_VAR == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
+	}
+
 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
 	object = *object_ptr;

@@ -11058,11 +11095,9 @@ static int ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 		}
 	}
 	if (offset) {
-	  	long l;
 		switch (Z_TYPE_P(offset)) {
 			case IS_DOUBLE:
-			  	DVAL_TO_LVAL(Z_DVAL_P(offset), l);
-				zend_hash_index_update(Z_ARRVAL_P(array_ptr), l, &expr_ptr, sizeof(zval *), NULL);
+				zend_hash_index_update(Z_ARRVAL_P(array_ptr), (long) Z_DVAL_P(offset), &expr_ptr, sizeof(zval *), NULL);
 				break;
 			case IS_LONG:
 			case IS_BOOL:
@@ -11615,6 +11650,10 @@ static int zend_binary_assign_op_obj_helper_SPEC_VAR_VAR(int (*binary_op)(zval *
 	zval **retval = &EX_T(result->u.var).var.ptr;
 	int have_get_ptr = 0;

+	if (IS_VAR == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
+	}
+
 	EX_T(result->u.var).var.ptr_ptr = NULL;
 	make_real_object(object_ptr TSRMLS_CC);
 	object = *object_ptr;
@@ -11866,6 +11905,10 @@ static int zend_pre_incdec_property_helper_SPEC_VAR_VAR(incdec_t incdec_op, ZEND
 	zval **retval = &EX_T(opline->result.u.var).var.ptr;
 	int have_get_ptr = 0;

+	if (IS_VAR == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
+	}
+
 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
 	object = *object_ptr;

@@ -11958,6 +12001,10 @@ static int zend_post_incdec_property_helper_SPEC_VAR_VAR(incdec_t incdec_op, ZEN
 	zval *retval = &EX_T(opline->result.u.var).tmp_var;
 	int have_get_ptr = 0;

+	if (IS_VAR == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
+	}
+
 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
 	object = *object_ptr;

@@ -12629,11 +12676,9 @@ static int ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 		}
 	}
 	if (offset) {
-	  	long l;
 		switch (Z_TYPE_P(offset)) {
 			case IS_DOUBLE:
-			  	DVAL_TO_LVAL(Z_DVAL_P(offset), l);
-				zend_hash_index_update(Z_ARRVAL_P(array_ptr), l, &expr_ptr, sizeof(zval *), NULL);
+				zend_hash_index_update(Z_ARRVAL_P(array_ptr), (long) Z_DVAL_P(offset), &expr_ptr, sizeof(zval *), NULL);
 				break;
 			case IS_LONG:
 			case IS_BOOL:
@@ -12952,6 +12997,10 @@ static int zend_binary_assign_op_obj_helper_SPEC_VAR_UNUSED(int (*binary_op)(zva
 	zval **retval = &EX_T(result->u.var).var.ptr;
 	int have_get_ptr = 0;

+	if (IS_VAR == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
+	}
+
 	EX_T(result->u.var).var.ptr_ptr = NULL;
 	make_real_object(object_ptr TSRMLS_CC);
 	object = *object_ptr;
@@ -13340,11 +13389,9 @@ static int ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_AR
 		}
 	}
 	if (offset) {
-	  	long l;
 		switch (Z_TYPE_P(offset)) {
 			case IS_DOUBLE:
-			  	DVAL_TO_LVAL(Z_DVAL_P(offset), l);
-				zend_hash_index_update(Z_ARRVAL_P(array_ptr), l, &expr_ptr, sizeof(zval *), NULL);
+				zend_hash_index_update(Z_ARRVAL_P(array_ptr), (long) Z_DVAL_P(offset), &expr_ptr, sizeof(zval *), NULL);
 				break;
 			case IS_LONG:
 			case IS_BOOL:
@@ -13635,6 +13682,10 @@ static int zend_binary_assign_op_obj_helper_SPEC_VAR_CV(int (*binary_op)(zval *r
 	zval **retval = &EX_T(result->u.var).var.ptr;
 	int have_get_ptr = 0;

+	if (IS_VAR == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
+	}
+
 	EX_T(result->u.var).var.ptr_ptr = NULL;
 	make_real_object(object_ptr TSRMLS_CC);
 	object = *object_ptr;
@@ -13885,6 +13936,10 @@ static int zend_pre_incdec_property_helper_SPEC_VAR_CV(incdec_t incdec_op, ZEND_
 	zval **retval = &EX_T(opline->result.u.var).var.ptr;
 	int have_get_ptr = 0;

+	if (IS_VAR == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
+	}
+
 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
 	object = *object_ptr;

@@ -13977,6 +14032,10 @@ static int zend_post_incdec_property_helper_SPEC_VAR_CV(incdec_t incdec_op, ZEND
 	zval *retval = &EX_T(opline->result.u.var).tmp_var;
 	int have_get_ptr = 0;

+	if (IS_VAR == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
+	}
+
 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
 	object = *object_ptr;

@@ -14643,11 +14702,9 @@ static int ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 		}
 	}
 	if (offset) {
-	  	long l;
 		switch (Z_TYPE_P(offset)) {
 			case IS_DOUBLE:
-			  	DVAL_TO_LVAL(Z_DVAL_P(offset), l);
-				zend_hash_index_update(Z_ARRVAL_P(array_ptr), l, &expr_ptr, sizeof(zval *), NULL);
+				zend_hash_index_update(Z_ARRVAL_P(array_ptr), (long) Z_DVAL_P(offset), &expr_ptr, sizeof(zval *), NULL);
 				break;
 			case IS_LONG:
 			case IS_BOOL:
@@ -15047,6 +15104,10 @@ static int zend_binary_assign_op_obj_helper_SPEC_UNUSED_CONST(int (*binary_op)(z
 	zval **retval = &EX_T(result->u.var).var.ptr;
 	int have_get_ptr = 0;

+	if (IS_UNUSED == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
+	}
+
 	EX_T(result->u.var).var.ptr_ptr = NULL;
 	make_real_object(object_ptr TSRMLS_CC);
 	object = *object_ptr;
@@ -15296,6 +15357,10 @@ static int zend_pre_incdec_property_helper_SPEC_UNUSED_CONST(incdec_t incdec_op,
 	zval **retval = &EX_T(opline->result.u.var).var.ptr;
 	int have_get_ptr = 0;

+	if (IS_UNUSED == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
+	}
+
 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
 	object = *object_ptr;

@@ -15388,6 +15453,10 @@ static int zend_post_incdec_property_helper_SPEC_UNUSED_CONST(incdec_t incdec_op
 	zval *retval = &EX_T(opline->result.u.var).tmp_var;
 	int have_get_ptr = 0;

+	if (IS_UNUSED == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
+	}
+
 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
 	object = *object_ptr;

@@ -16071,6 +16140,10 @@ static int zend_binary_assign_op_obj_helper_SPEC_UNUSED_TMP(int (*binary_op)(zva
 	zval **retval = &EX_T(result->u.var).var.ptr;
 	int have_get_ptr = 0;

+	if (IS_UNUSED == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
+	}
+
 	EX_T(result->u.var).var.ptr_ptr = NULL;
 	make_real_object(object_ptr TSRMLS_CC);
 	object = *object_ptr;
@@ -16321,6 +16394,10 @@ static int zend_pre_incdec_property_helper_SPEC_UNUSED_TMP(incdec_t incdec_op, Z
 	zval **retval = &EX_T(opline->result.u.var).var.ptr;
 	int have_get_ptr = 0;

+	if (IS_UNUSED == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
+	}
+
 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
 	object = *object_ptr;

@@ -16413,6 +16490,10 @@ static int zend_post_incdec_property_helper_SPEC_UNUSED_TMP(incdec_t incdec_op,
 	zval *retval = &EX_T(opline->result.u.var).tmp_var;
 	int have_get_ptr = 0;

+	if (IS_UNUSED == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
+	}
+
 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
 	object = *object_ptr;

@@ -17052,6 +17133,10 @@ static int zend_binary_assign_op_obj_helper_SPEC_UNUSED_VAR(int (*binary_op)(zva
 	zval **retval = &EX_T(result->u.var).var.ptr;
 	int have_get_ptr = 0;

+	if (IS_UNUSED == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
+	}
+
 	EX_T(result->u.var).var.ptr_ptr = NULL;
 	make_real_object(object_ptr TSRMLS_CC);
 	object = *object_ptr;
@@ -17302,6 +17387,10 @@ static int zend_pre_incdec_property_helper_SPEC_UNUSED_VAR(incdec_t incdec_op, Z
 	zval **retval = &EX_T(opline->result.u.var).var.ptr;
 	int have_get_ptr = 0;

+	if (IS_UNUSED == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
+	}
+
 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
 	object = *object_ptr;

@@ -17394,6 +17483,10 @@ static int zend_post_incdec_property_helper_SPEC_UNUSED_VAR(incdec_t incdec_op,
 	zval *retval = &EX_T(opline->result.u.var).tmp_var;
 	int have_get_ptr = 0;

+	if (IS_UNUSED == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
+	}
+
 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
 	object = *object_ptr;

@@ -18033,6 +18126,10 @@ static int zend_binary_assign_op_obj_helper_SPEC_UNUSED_UNUSED(int (*binary_op)(
 	zval **retval = &EX_T(result->u.var).var.ptr;
 	int have_get_ptr = 0;

+	if (IS_UNUSED == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
+	}
+
 	EX_T(result->u.var).var.ptr_ptr = NULL;
 	make_real_object(object_ptr TSRMLS_CC);
 	object = *object_ptr;
@@ -18299,6 +18396,10 @@ static int zend_binary_assign_op_obj_helper_SPEC_UNUSED_CV(int (*binary_op)(zval
 	zval **retval = &EX_T(result->u.var).var.ptr;
 	int have_get_ptr = 0;

+	if (IS_UNUSED == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
+	}
+
 	EX_T(result->u.var).var.ptr_ptr = NULL;
 	make_real_object(object_ptr TSRMLS_CC);
 	object = *object_ptr;
@@ -18548,6 +18649,10 @@ static int zend_pre_incdec_property_helper_SPEC_UNUSED_CV(incdec_t incdec_op, ZE
 	zval **retval = &EX_T(opline->result.u.var).var.ptr;
 	int have_get_ptr = 0;

+	if (IS_UNUSED == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
+	}
+
 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
 	object = *object_ptr;

@@ -18640,6 +18745,10 @@ static int zend_post_incdec_property_helper_SPEC_UNUSED_CV(incdec_t incdec_op, Z
 	zval *retval = &EX_T(opline->result.u.var).tmp_var;
 	int have_get_ptr = 0;

+	if (IS_UNUSED == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
+	}
+
 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
 	object = *object_ptr;

@@ -19904,6 +20013,10 @@ static int ZEND_SEND_REF_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 		zend_error_noreturn(E_ERROR, "Only variables can be passed by reference");
 	}

+      	if (EX(function_state).function->type == ZEND_INTERNAL_FUNCTION && !ARG_SHOULD_BE_SENT_BY_REF(EX(fbc), opline->op2.u.opline_num)) {
+               return zend_send_by_var_helper_SPEC_CV(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);
+        }
+
 	SEPARATE_ZVAL_TO_MAKE_IS_REF(varptr_ptr);
 	varptr = *varptr_ptr;
 	varptr->refcount++;
@@ -20280,15 +20393,22 @@ static int ZEND_FE_RESET_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 			ALLOC_ZVAL(tmp);
 			INIT_PZVAL_COPY(tmp, array_ptr);
 			array_ptr = tmp;
+			if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
+				ce = Z_OBJCE_P(array_ptr);
+				if (ce && ce->get_iterator) {
+					array_ptr->refcount--;
+				}
+			}
 		} else if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
 			ce = Z_OBJCE_P(array_ptr);
 			if (!ce || !ce->get_iterator) {
 				array_ptr->refcount++;
 			}
 		} else {
-			if ((IS_CV == IS_CV || IS_CV == IS_VAR) &&
+			if (IS_CV == IS_CONST ||
+			    ((IS_CV == IS_CV || IS_CV == IS_VAR) &&
 			    !array_ptr->is_ref &&
-			    array_ptr->refcount > 1) {
+			    array_ptr->refcount > 1)) {
 				zval *tmp;

 				ALLOC_ZVAL(tmp);
@@ -20301,7 +20421,7 @@ static int ZEND_FE_RESET_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 		}
 	}

-	if (IS_CV != IS_TMP_VAR && ce && ce->get_iterator) {
+	if (ce && ce->get_iterator) {
 		iter = ce->get_iterator(ce, array_ptr, opline->extended_value & ZEND_FE_RESET_REFERENCE TSRMLS_CC);

 		if (iter && !EG(exception)) {
@@ -20741,6 +20861,10 @@ static int zend_binary_assign_op_obj_helper_SPEC_CV_CONST(int (*binary_op)(zval
 	zval **retval = &EX_T(result->u.var).var.ptr;
 	int have_get_ptr = 0;

+	if (IS_CV == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
+	}
+
 	EX_T(result->u.var).var.ptr_ptr = NULL;
 	make_real_object(object_ptr TSRMLS_CC);
 	object = *object_ptr;
@@ -20990,6 +21114,10 @@ static int zend_pre_incdec_property_helper_SPEC_CV_CONST(incdec_t incdec_op, ZEN
 	zval **retval = &EX_T(opline->result.u.var).var.ptr;
 	int have_get_ptr = 0;

+	if (IS_CV == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
+	}
+
 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
 	object = *object_ptr;

@@ -21082,6 +21210,10 @@ static int zend_post_incdec_property_helper_SPEC_CV_CONST(incdec_t incdec_op, ZE
 	zval *retval = &EX_T(opline->result.u.var).tmp_var;
 	int have_get_ptr = 0;

+	if (IS_CV == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
+	}
+
 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
 	object = *object_ptr;

@@ -21699,11 +21831,9 @@ static int ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS
 		}
 	}
 	if (offset) {
-	  	long l;
 		switch (Z_TYPE_P(offset)) {
 			case IS_DOUBLE:
-			  	DVAL_TO_LVAL(Z_DVAL_P(offset), l);
-				zend_hash_index_update(Z_ARRVAL_P(array_ptr), l, &expr_ptr, sizeof(zval *), NULL);
+				zend_hash_index_update(Z_ARRVAL_P(array_ptr), (long) Z_DVAL_P(offset), &expr_ptr, sizeof(zval *), NULL);
 				break;
 			case IS_LONG:
 			case IS_BOOL:
@@ -22252,6 +22382,10 @@ static int zend_binary_assign_op_obj_helper_SPEC_CV_TMP(int (*binary_op)(zval *r
 	zval **retval = &EX_T(result->u.var).var.ptr;
 	int have_get_ptr = 0;

+	if (IS_CV == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
+	}
+
 	EX_T(result->u.var).var.ptr_ptr = NULL;
 	make_real_object(object_ptr TSRMLS_CC);
 	object = *object_ptr;
@@ -22502,6 +22636,10 @@ static int zend_pre_incdec_property_helper_SPEC_CV_TMP(incdec_t incdec_op, ZEND_
 	zval **retval = &EX_T(opline->result.u.var).var.ptr;
 	int have_get_ptr = 0;

+	if (IS_CV == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
+	}
+
 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
 	object = *object_ptr;

@@ -22594,6 +22732,10 @@ static int zend_post_incdec_property_helper_SPEC_CV_TMP(incdec_t incdec_op, ZEND
 	zval *retval = &EX_T(opline->result.u.var).tmp_var;
 	int have_get_ptr = 0;

+	if (IS_CV == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
+	}
+
 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
 	object = *object_ptr;

@@ -23214,11 +23356,9 @@ static int ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 		}
 	}
 	if (offset) {
-	  	long l;
 		switch (Z_TYPE_P(offset)) {
 			case IS_DOUBLE:
-			  	DVAL_TO_LVAL(Z_DVAL_P(offset), l);
-				zend_hash_index_update(Z_ARRVAL_P(array_ptr), l, &expr_ptr, sizeof(zval *), NULL);
+				zend_hash_index_update(Z_ARRVAL_P(array_ptr), (long) Z_DVAL_P(offset), &expr_ptr, sizeof(zval *), NULL);
 				break;
 			case IS_LONG:
 			case IS_BOOL:
@@ -23767,6 +23907,10 @@ static int zend_binary_assign_op_obj_helper_SPEC_CV_VAR(int (*binary_op)(zval *r
 	zval **retval = &EX_T(result->u.var).var.ptr;
 	int have_get_ptr = 0;

+	if (IS_CV == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
+	}
+
 	EX_T(result->u.var).var.ptr_ptr = NULL;
 	make_real_object(object_ptr TSRMLS_CC);
 	object = *object_ptr;
@@ -24017,6 +24161,10 @@ static int zend_pre_incdec_property_helper_SPEC_CV_VAR(incdec_t incdec_op, ZEND_
 	zval **retval = &EX_T(opline->result.u.var).var.ptr;
 	int have_get_ptr = 0;

+	if (IS_CV == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
+	}
+
 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
 	object = *object_ptr;

@@ -24109,6 +24257,10 @@ static int zend_post_incdec_property_helper_SPEC_CV_VAR(incdec_t incdec_op, ZEND
 	zval *retval = &EX_T(opline->result.u.var).tmp_var;
 	int have_get_ptr = 0;

+	if (IS_CV == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
+	}
+
 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
 	object = *object_ptr;

@@ -24776,11 +24928,9 @@ static int ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 		}
 	}
 	if (offset) {
-	  	long l;
 		switch (Z_TYPE_P(offset)) {
 			case IS_DOUBLE:
-			  	DVAL_TO_LVAL(Z_DVAL_P(offset), l);
-				zend_hash_index_update(Z_ARRVAL_P(array_ptr), l, &expr_ptr, sizeof(zval *), NULL);
+				zend_hash_index_update(Z_ARRVAL_P(array_ptr), (long) Z_DVAL_P(offset), &expr_ptr, sizeof(zval *), NULL);
 				break;
 			case IS_LONG:
 			case IS_BOOL:
@@ -25095,6 +25245,10 @@ static int zend_binary_assign_op_obj_helper_SPEC_CV_UNUSED(int (*binary_op)(zval
 	zval **retval = &EX_T(result->u.var).var.ptr;
 	int have_get_ptr = 0;

+	if (IS_CV == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
+	}
+
 	EX_T(result->u.var).var.ptr_ptr = NULL;
 	make_real_object(object_ptr TSRMLS_CC);
 	object = *object_ptr;
@@ -25482,11 +25636,9 @@ static int ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARG
 		}
 	}
 	if (offset) {
-	  	long l;
 		switch (Z_TYPE_P(offset)) {
 			case IS_DOUBLE:
-			  	DVAL_TO_LVAL(Z_DVAL_P(offset), l);
-				zend_hash_index_update(Z_ARRVAL_P(array_ptr), l, &expr_ptr, sizeof(zval *), NULL);
+				zend_hash_index_update(Z_ARRVAL_P(array_ptr), (long) Z_DVAL_P(offset), &expr_ptr, sizeof(zval *), NULL);
 				break;
 			case IS_LONG:
 			case IS_BOOL:
@@ -25777,6 +25929,10 @@ static int zend_binary_assign_op_obj_helper_SPEC_CV_CV(int (*binary_op)(zval *re
 	zval **retval = &EX_T(result->u.var).var.ptr;
 	int have_get_ptr = 0;

+	if (IS_CV == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot use string offset as an object");
+	}
+
 	EX_T(result->u.var).var.ptr_ptr = NULL;
 	make_real_object(object_ptr TSRMLS_CC);
 	object = *object_ptr;
@@ -26026,6 +26182,10 @@ static int zend_pre_incdec_property_helper_SPEC_CV_CV(incdec_t incdec_op, ZEND_O
 	zval **retval = &EX_T(opline->result.u.var).var.ptr;
 	int have_get_ptr = 0;

+	if (IS_CV == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
+	}
+
 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
 	object = *object_ptr;

@@ -26118,6 +26278,10 @@ static int zend_post_incdec_property_helper_SPEC_CV_CV(incdec_t incdec_op, ZEND_
 	zval *retval = &EX_T(opline->result.u.var).tmp_var;
 	int have_get_ptr = 0;

+	if (IS_CV == IS_VAR && !object_ptr) {
+		zend_error_noreturn(E_ERROR, "Cannot increment/decrement overloaded objects nor string offsets");
+	}
+
 	make_real_object(object_ptr TSRMLS_CC); /* this should modify object only if it's empty */
 	object = *object_ptr;

@@ -26780,11 +26944,9 @@ static int ZEND_ADD_ARRAY_ELEMENT_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 		}
 	}
 	if (offset) {
-	  	long l;
 		switch (Z_TYPE_P(offset)) {
 			case IS_DOUBLE:
-			  	DVAL_TO_LVAL(Z_DVAL_P(offset), l);
-				zend_hash_index_update(Z_ARRVAL_P(array_ptr), l, &expr_ptr, sizeof(zval *), NULL);
+				zend_hash_index_update(Z_ARRVAL_P(array_ptr), (long) Z_DVAL_P(offset), &expr_ptr, sizeof(zval *), NULL);
 				break;
 			case IS_LONG:
 			case IS_BOOL:
@@ -920,7 +920,7 @@ AC_DEFUN([PHP_GEN_BUILD_DIRS],[
 ])

 dnl
-dnl PHP_NEW_EXTENSION(extname, sources [, shared [,sapi_class[, extra-cflags[, cxx[, zend_ext]]]]])
+dnl PHP_NEW_EXTENSION(extname, sources [, shared [, sapi_class [, extra-cflags [, cxx [, zend_ext]]]]])
 dnl
 dnl Includes an extension in the build.
 dnl
@@ -968,12 +968,15 @@ dnl ---------------------------------------------- Shared module
  if test "$3" != "shared" && test "$3" != "yes" && test "$4" = "cli"; then
 dnl ---------------------------------------------- CLI static module
    [PHP_]translit($1,a-z_-,A-Z__)[_SHARED]=no
-    if test "$PHP_SAPI" = "cgi"; then
-      PHP_ADD_SOURCES(PHP_EXT_DIR($1),$2,$ac_extra,)
-      EXT_STATIC="$EXT_STATIC $1"
-    else
-      PHP_ADD_SOURCES(PHP_EXT_DIR($1),$2,$ac_extra,cli)
-    fi
+    case "$PHP_SAPI" in
+      cgi|embed[)]
+        PHP_ADD_SOURCES(PHP_EXT_DIR($1),$2,$ac_extra,)
+        EXT_STATIC="$EXT_STATIC $1"
+        ;;
+      *[)]
+        PHP_ADD_SOURCES(PHP_EXT_DIR($1),$2,$ac_extra,cli)
+        ;;
+    esac
    EXT_CLI_STATIC="$EXT_CLI_STATIC $1"
  fi
  PHP_ADD_BUILD_DIR($ext_builddir)
@@ -2766,6 +2769,23 @@ AC_DEFUN([PHP_DETECT_ICC],
  )
 ])

+dnl PHP_DETECT_SUNCC
+dnl Detect if the systems default compiler is suncc.
+dnl We also set some usefull CFLAGS if the user didn't set any
+AC_DEFUN([PHP_DETECT_SUNCC],[
+  SUNCC="no"
+  AC_MSG_CHECKING([for suncc])
+  AC_EGREP_CPP([^__SUNPRO_C], [__SUNPRO_C],
+    SUNCC="no"
+    AC_MSG_RESULT([no]),
+    SUNCC="yes"
+    GCC="no"
+    test -n "$auto_cflags" && CFLAGS="-O -xs -xstrconst -zlazyload"
+    GCC=""
+    AC_MSG_RESULT([yes])
+  )
+])
+
 dnl
 dnl PHP_CRYPT_R_STYLE
 dnl detect the style of crypt_r() is any is available
@@ -1,7 +1,7 @@
 #  +----------------------------------------------------------------------+
 #  | PHP Version 5                                                        |
 #  +----------------------------------------------------------------------+
-#  | Copyright (c) 1997-2007 The PHP Group                                |
+#  | Copyright (c) 1997-2006 The PHP Group                                |
 #  +----------------------------------------------------------------------+
 #  | This source file is subject to version 3.01 of the PHP license,      |
 #  | that is bundled with this package in the file LICENSE, and is        |
@@ -20,9 +20,7 @@
 # Makefile to generate build tools
 #

-ZENDDIR = Zend
-
-SUBDIRS = $(ZENDDIR) TSRM
+SUBDIRS = Zend TSRM

 STAMP = buildmk.stamp

@@ -33,11 +31,10 @@ all: $(STAMP) $(ALWAYS)
 	@$(MAKE) -s -f build/build2.mk

 generated_lists:
-	@echo makefile_am_files = $(ZENDDIR)/Makefile.am \
-		TSRM/Makefile.am > $@
-	@echo config_h_files = $(ZENDDIR)/acconfig.h TSRM/acconfig.h >> $@
-	@echo config_m4_files = $(ZENDDIR)/Zend.m4 TSRM/tsrm.m4 TSRM/threads.m4 \
-		$(ZENDDIR)/acinclude.m4 ext/*/config*.m4 sapi/*/config.m4 >> $@
+	@echo makefile_am_files = Zend/Makefile.am TSRM/Makefile.am > $@
+	@echo config_h_files = Zend/acconfig.h TSRM/acconfig.h >> $@
+	@echo config_m4_files = Zend/Zend.m4 TSRM/tsrm.m4 TSRM/threads.m4 \
+		Zend/acinclude.m4 ext/*/config*.m4 sapi/*/config.m4 >> $@

 $(STAMP): build/buildcheck.sh
 	@build/buildcheck.sh $(STAMP)
@@ -67,7 +64,18 @@ snapshot:

 cvsclean-work:
 	@for i in `find . -name .cvsignore`; do \
-		(cd `dirname $$i` 2>/dev/null && rm -rf `cat .cvsignore | grep -v config.nice | sed 's/[\r\n]/ /g'` *.o *.a .libs || true); \
+		(cd `dirname $$i` 2>/dev/null && rm -rf `cat .cvsignore | grep -v config.nice | sed 's/[[:space:]]/ /g'` *.o *.a *.lo *.la *.gcno *.gcda .libs || true); \
 	done

+svnclean-work:
+	@for i in `find . -type d -not -path '*/.svn/*' | grep -v '.svn'`; do \
+		(cd $$i 2>/dev/null && rm -rf `svn propget svn:ignore . | grep -v config.nice` *.o *.a *.lo *.la *.gcno *.gcda .libs || true); \
+	done
+
+gitclean-work:
+	@if (test ! -f '.git/info/exclude' || grep -s "git-ls-files" .git/info/exclude); then \
+		(echo "Rebuild .git/info/exclude" && echo '*.o' > .git/info/exclude && git svn propget svn:ignore | grep -v config.nice >> .git/info/exclude); \
+	fi; \
+	git clean -X -f -d;
+
 .PHONY: $(ALWAYS) snapshot
@@ -48,9 +48,9 @@ fi

 if test "$1" = "2" && test "$2" -ge "50"; then
  echo "buildconf: Your version of autoconf likely contains buggy cache code."
-  echo "           Running cvsclean for you."
+  echo "           Running vcsclean for you."
  echo "           To avoid this, install autoconf-2.13."
-  ./cvsclean
+  ./vcsclean
  stamp=
 fi

@@ -51,8 +51,6 @@ function do_deps(mod_idx,        module_name, mod_name_len, dep, ext, val, depid
 			do_deps(depidx);
 		}
 	}
-
-	#printf("	phpext_%s_ptr,\n", module_name);
 	printf("	phpext_%s_ptr,@NEWLINE@", module_name);
 	delete mods[mod_idx];
 }
@@ -79,8 +77,7 @@ END {
 	out_count = 0;
 	
 	while (count(mods)) {
-		# count down, since we need to assemble it in reverse order
-		for (i = mod_count-1; i >= 0; --i) {
+		for (i = 0; i <= mod_count - 1; i++) {
 			if (i in mods) {
 				do_deps(i);
 			}
@@ -32,38 +32,11 @@ if test "$dev" = "0" -a "$devok" = "0"; then
  echo "use buildconf --force to override this check."
  exit 1
 fi
-
-if test -z "$ZENDDIR"; then
-  if grep "PHP_MAJOR_VERSION 5" main/php_version.h >/dev/null; then
-    v=5
-  else
-    v=4
-  fi
-
-  if test "$v" = "5"; then
-    if test -r "Zend/OBJECTS2_HOWTO"; then
-      :
-    else
-      mv Zend ZendEngine1 2>/dev/null
-      mv ZendEngine2 Zend
-    fi
-  else
-    if test -r "Zend/zend_execute_globals.h"; then
-      :
-    else
-      mv Zend ZendEngine2 2>/dev/null
-      mv ZendEngine1 Zend
-    fi
-  fi
-
-  ZENDDIR=Zend
-  echo "using default Zend directory"
-fi
 
 rm -f generated_lists

 if test "$debug" = "yes"; then
-  ${MAKE:-make} -s -f build/build.mk ZENDDIR="$ZENDDIR" SUPPRESS_WARNINGS=""
+  ${MAKE:-make} -s -f build/build.mk SUPPRESS_WARNINGS=""
 else
-  ${MAKE:-make} -s -f build/build.mk ZENDDIR="$ZENDDIR"
+  ${MAKE:-make} -s -f build/build.mk
 fi
@@ -31,7 +31,7 @@ dnl Basic autoconf + automake initialization, generation of config.nice.
 dnl -------------------------------------------------------------------------

 AC_PREREQ(2.13)
-AC_INIT(README.CVS-RULES)
+AC_INIT(README.SVN-RULES)

 PHP_CONFIG_NICE(config.nice)

@@ -41,8 +41,8 @@ AC_CONFIG_HEADER(main/php_config.h)

 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=2
-PHP_RELEASE_VERSION=9
-PHP_EXTRA_VERSION="RC2"
+PHP_RELEASE_VERSION=11
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -140,8 +140,9 @@ esac
 dnl Checks for programs.
 dnl -------------------------------------------------------------------------

-AC_PROG_CC
+AC_PROG_CC([cc gcc])
 PHP_DETECT_ICC
+PHP_DETECT_SUNCC
 AC_PROG_CC_C_O
 dnl Change to AC_PROG_CC_STDC when we start requiring a post-2.13 autoconf
 dnl AC_PROG_CC_STDC
@@ -170,7 +171,7 @@ dnl Check if bison generated files exist when bison does not..
 case $php_cv_bison_version in
  ""|invalid[)]
    if ! test -f "$abs_srcdir/Zend/zend_language_parser.h" || ! test -f "$abs_srcdir/Zend/zend_language_parser.c" ; then
-      AC_MSG_ERROR([bison is required to build PHP/Zend when building a CVS checkout!])
+      AC_MSG_ERROR([bison is required to build PHP/Zend when building a SVN checkout!])
    fi
    ;;
 esac
@@ -187,6 +188,10 @@ case $host_cpu in
      CFLAGS="$CFLAGS -ieee"
    fi
    ;;
+  sparc*)
+    if test "$SUNCC" = "yes"; then
+      CFLAGS="$CFLAGS -xmemalign=8s"
+    fi
 esac

 case $host_alias in
@@ -685,7 +690,7 @@ if test "$PHP_GCOV" = "yes"; then
    AC_MSG_ERROR([ccache must be disabled when --enable-gcov option is used. You can disable ccache by setting environment variable CCACHE_DISABLE=1.])
  fi
  
-  ltp_version_list="1.5 1.6"
+  ltp_version_list="1.5 1.6 1.7"

  AC_CHECK_PROG(LTP, lcov, lcov)
  AC_CHECK_PROG(LTP_GENHTML, genhtml, genhtml)
@@ -731,6 +736,15 @@ if test "$PHP_GCOV" = "yes"; then
  dnl Add the special gcc flags
  CFLAGS="$CFLAGS -O0 -fprofile-arcs -ftest-coverage"
  CXXFLAGS="$CXXFLAGS -O0 -fprofile-arcs -ftest-coverage"
+  if test "$SUNCC" = "yes"; then
+    if test -n "$auto_cflags"; then
+      CFLAGS="-g"
+      CXXFLAGS="-g"
+    else
+      CFLAGS="$CFLAGS -g"
+      CXXFLAGS="$CFLAGS -g"
+    fi
+  fi
 fi

 PHP_ARG_ENABLE(debug, whether to include debugging symbols,
@@ -1542,13 +1556,18 @@ X
    fi

    if test "$PHP_SIGCHILD" != "yes"; then
+      if test "$PHP_OCI8_INSTANT_CLIENT" = "no"; then
 cat <<X
 +--------------------------------------------------------------------+
 | Notice:                                                            |
-| If you encounter <defunc> processes when using a local Oracle-DB   |
-| please recompile PHP and specify --enable-sigchild when configuring|
-| (This problem has been reported under Linux using Oracle >= 8.1.5) |
+| If you encounter <defunc> processes when using a local Oracle      |
+| database, set the value BEQUEATH_DETACH=YES in Oracle Net's        |
+| sqlnet.ora file on the PHP host, or set the environment variable   |
+| BEQUEATH_DETACH to YES before starting Apache.  If the problem     |
+| still occurs, then recompile PHP and specify --enable-sigchild     |
+| when configuring.                                                  |
 X
+      fi
    fi
  fi

@@ -1,3 +0,0 @@
-#! /bin/sh
-
-${MAKE:-make} -f build/build.mk cvsclean-work
@@ -21,8 +21,6 @@
 #ifndef PHP_BCMATH_H
 #define PHP_BCMATH_H

-#if HAVE_BCMATH
-
 #include "libbcmath/src/bcmath.h"

 extern zend_module_entry bcmath_module_entry;
@@ -50,18 +48,12 @@ ZEND_BEGIN_MODULE_GLOBALS(bcmath)
 	long bc_precision;
 ZEND_END_MODULE_GLOBALS(bcmath)
 	
-#if ZTS
-#define BCG(v) TSRMG(bcmath_globals_id, zend_bcmath_globals *, v)
+#ifdef ZTS
+# define BCG(v) TSRMG(bcmath_globals_id, zend_bcmath_globals *, v)
 #else
-#define BCG(v) (bcmath_globals.v)
+# define BCG(v) (bcmath_globals.v)
 #endif

 ZEND_EXTERN_MODULE_GLOBALS(bcmath)

-#else
-
-#define phpext_bcmath_ptr NULL
-
-#endif
-
 #endif /* PHP_BCMATH_H */
@@ -0,0 +1,14 @@
+--TEST--
+bcdiv — Divide two arbitrary precision numbers
+--CREDITS--
+TestFest2009
+Antoni Torrents
+antoni@solucionsinternet.com
+--SKIPIF--
+<?php if(!extension_loaded("bcmath")) print "skip"; ?>
+--FILE--
+<?php
+echo bcdiv('10.99', '0');
+?>
+--EXPECTF--
+Warning: bcdiv(): Division by zero in %s.php on line %d
@@ -0,0 +1,13 @@
+--TEST--
+bcdiv — Divide two arbitrary precision numbers
+--CREDITS--
+Antoni Torrents
+antoni@solucionsinternet.com
+--SKIPIF--
+<?php if(!extension_loaded("bcmath")) print "skip"; ?>
+--FILE--
+<?php
+echo bcdiv('1', '2', '3', '4');
+?>
+--EXPECTF--
+Warning: Wrong parameter count for bcdiv() in %s.php on line %d
@@ -0,0 +1,13 @@
+--TEST--
+bcmod — Get modulus of an arbitrary precision number
+--CREDITS--
+Antoni Torrents
+antoni@solucionsinternet.com
+--SKIPIF--
+<?php if(!extension_loaded("bcmath")) print "skip"; ?>
+--FILE--
+<?php
+echo bcmod('1', '2', '3');
+?>
+--EXPECTF--
+Warning: Wrong parameter count for bcmod() in %s.php on line %d
@@ -0,0 +1,13 @@
+--TEST--
+bcpowmod — Raise an arbitrary precision number to another, reduced by a specified modulus
+--CREDITS--
+Antoni Torrents
+antoni@solucionsinternet.com
+--SKIPIF--
+<?php if(!extension_loaded("bcmath")) print "skip"; ?>
+--FILE--
+<?php
+echo bcpowmod('1');
+?>
+--EXPECTF--
+Warning: bcpowmod() expects at least 3 parameters, 1 given in %s.php on line %d
@@ -0,0 +1,13 @@
+--TEST--
+bcpowmod — Raise an arbitrary precision number to another, reduced by a specified modulus
+--CREDITS--
+Antoni Torrents
+antoni@solucionsinternet.com
+--SKIPIF--
+<?php if(!extension_loaded("bcmath")) print "skip"; ?>
+--FILE--
+<?php
+echo bcpowmod('1', '2');
+?>
+--EXPECTF--
+Warning: bcpowmod() expects at least 3 parameters, 2 given in %s.php on line %d
@@ -0,0 +1,13 @@
+--TEST--
+bcpowmod — Raise an arbitrary precision number to another, reduced by a specified modulus
+--CREDITS--
+Antoni Torrents
+antoni@solucionsinternet.com
+--SKIPIF--
+<?php if(!extension_loaded("bcmath")) print "skip"; ?>
+--FILE--
+<?php
+echo bcpowmod('1', '2', '3', '4', '5');
+?>
+--EXPECTF--
+Warning: bcpowmod() expects at most 4 parameters, 5 given in %s.php on line %d
@@ -0,0 +1,13 @@
+--TEST--
+bcsqrt — Get the square root of an arbitrary precision number
+--CREDITS--
+Antoni Torrents
+antoni@solucionsinternet.com
+--SKIPIF--
+<?php if(!extension_loaded("bcmath")) print "skip"; ?>
+--FILE--
+<?php
+echo bcsqrt('-9');
+?>
+--EXPECTF--
+Warning: bcsqrt(): Square root of negative number in %s.php on line %d
@@ -0,0 +1,19 @@
+--TEST--
+Bug #45280 (Reflection of instantiated COM classes causes PHP to crash)
+--SKIPIF--
+<?php
+if (!extension_loaded("reflection")){ echo "skip, no reflection support present"; }
+if (!extension_loaded("com_dotnet")){ echo "skip COM/.Net support not present"; }
+?>
+--FILE--
+<?php
+$dict = new COM("Scripting.Dictionary");
+
+ob_start();
+ReflectionObject::export($dict);
+ob_get_clean();
+
+echo 'done';
+?>
+--EXPECT--
+done
@@ -7,7 +7,7 @@ PHP_ARG_WITH(curl, for cURL support,

 dnl Temporary option while we develop this aspect of the extension
 PHP_ARG_WITH(curlwrappers, if we should use cURL for url streams,
-[  --with-curlwrappers     Use cURL for url streams], no, no)
+[  --with-curlwrappers     EXPERIMENTAL: Use cURL for url streams], no, no)

 if test "$PHP_CURL" != "no"; then
  if test -r $PHP_CURL/include/curl/easy.h; then
@@ -48,74 +48,79 @@ if test "$PHP_CURL" != "no"; then
  else
    AC_MSG_ERROR(cURL version 7.10.5 or later is required to compile php with cURL support)
  fi
-  
-  AC_MSG_CHECKING([for SSL support in libcurl])
-  CURL_SSL=`$CURL_CONFIG --feature | $EGREP SSL`
-  if test "$CURL_SSL" = "SSL"; then
-   AC_MSG_RESULT([yes])
-   AC_DEFINE([HAVE_CURL_SSL], [1], [Have cURL with  SSL support])
-   
-   save_CFLAGS="$CFLAGS"
-   CFLAGS="`$CURL_CONFIG --cflags`"
-   save_LDFLAGS="$LDFLAGS"
-   LDFLAGS="`$CURL_CONFIG --libs` $ld_runpath_switch$CURL_DIR/$PHP_LIBDIR"
-   
-   AC_PROG_CPP
-   AC_MSG_CHECKING([for openssl support in libcurl])
-   AC_TRY_RUN([
-    #include <curl/curl.h>
-    int main(int argc, char *argv[]) {
-     curl_version_info_data *data = curl_version_info(CURLVERSION_NOW);
-     if (data && data->ssl_version && *data->ssl_version) {
-      const char *ptr = data->ssl_version;
-      while(*ptr == ' ') ++ptr;
-      return strncasecmp(ptr, "OpenSSL", sizeof("OpenSSL")-1);
-     }
-     return 1;
-    }
-   ],[
-    AC_MSG_RESULT([yes])
-    AC_CHECK_HEADERS([openssl/crypto.h], [
-     AC_DEFINE([HAVE_CURL_OPENSSL], [1], [Have cURL with OpenSSL support])
-    ])
-   ], [
-    AC_MSG_RESULT([no])
-   ], [
-    AC_MSG_RESULT([no])
-   ])
-   
-   AC_MSG_CHECKING([for gnutls support in libcurl])
-   AC_TRY_RUN([
-    #include <curl/curl.h>
-    int main(int argc, char *argv[]) {
-     curl_version_info_data *data = curl_version_info(CURLVERSION_NOW);
-     if (data && data->ssl_version && *data->ssl_version) {
-      const char *ptr = data->ssl_version;
-      while(*ptr == ' ') ++ptr;
-      return strncasecmp(ptr, "GnuTLS", sizeof("GnuTLS")-1);
-     }
-     return 1;
-    }
-   ], [
-    AC_MSG_RESULT([yes])
-    AC_CHECK_HEADER([gcrypt.h], [
-     AC_DEFINE([HAVE_CURL_GNUTLS], [1], [Have cURL with GnuTLS support])
-    ])
-   ], [
-    AC_MSG_RESULT([no])
-   ], [
-    AC_MSG_RESULT([no])
-   ])
-   
-   CFLAGS="$save_CFLAGS"
-   LDFLAGS="$save_LDFLAGS"
-  else
-   AC_MSG_RESULT([no])
-  fi

  PHP_ADD_INCLUDE($CURL_DIR/include)
  PHP_EVAL_LIBLINE($CURL_LIBS, CURL_SHARED_LIBADD)
  PHP_ADD_LIBRARY_WITH_PATH(curl, $CURL_DIR/$PHP_LIBDIR, CURL_SHARED_LIBADD)
+  
+  AC_MSG_CHECKING([for SSL support in libcurl])
+  CURL_SSL=`$CURL_CONFIG --feature | $EGREP SSL`
+  if test "$CURL_SSL" = "SSL"; then
+    AC_MSG_RESULT([yes])
+    AC_DEFINE([HAVE_CURL_SSL], [1], [Have cURL with  SSL support])
+   
+    save_CFLAGS="$CFLAGS"
+    CFLAGS="`$CURL_CONFIG --cflags`"
+   
+    AC_PROG_CPP
+    AC_MSG_CHECKING([for openssl support in libcurl])
+    AC_TRY_RUN([
+#include <curl/curl.h>
+
+int main(int argc, char *argv[])
+{
+  curl_version_info_data *data = curl_version_info(CURLVERSION_NOW);
+
+  if (data && data->ssl_version && *data->ssl_version) {
+    const char *ptr = data->ssl_version;
+
+    while(*ptr == ' ') ++ptr;
+    return strncasecmp(ptr, "OpenSSL", sizeof("OpenSSL")-1);
+  }
+  return 1;
+}
+    ],[
+      AC_MSG_RESULT([yes])
+      AC_CHECK_HEADERS([openssl/crypto.h], [
+        AC_DEFINE([HAVE_CURL_OPENSSL], [1], [Have cURL with OpenSSL support])
+      ])
+    ], [
+      AC_MSG_RESULT([no])
+    ], [
+      AC_MSG_RESULT([no])
+    ])
+   
+    AC_MSG_CHECKING([for gnutls support in libcurl])
+    AC_TRY_RUN([
+#include <curl/curl.h>
+
+int main(int argc, char *argv[])
+{
+  curl_version_info_data *data = curl_version_info(CURLVERSION_NOW);
+  
+  if (data && data->ssl_version && *data->ssl_version) {
+    const char *ptr = data->ssl_version;
+
+    while(*ptr == ' ') ++ptr;
+    return strncasecmp(ptr, "GnuTLS", sizeof("GnuTLS")-1);
+  }
+  return 1;
+}
+], [
+      AC_MSG_RESULT([yes])
+      AC_CHECK_HEADER([gcrypt.h], [
+        AC_DEFINE([HAVE_CURL_GNUTLS], [1], [Have cURL with GnuTLS support])
+      ])
+    ], [
+      AC_MSG_RESULT([no])
+    ], [
+      AC_MSG_RESULT([no])
+    ])
+   
+    CFLAGS="$save_CFLAGS"
+  else
+    AC_MSG_RESULT([no])
+  fi

  PHP_CHECK_LIBRARY(curl,curl_easy_perform, 
  [ 
@@ -147,6 +147,7 @@ static struct gcry_thread_cbs php_curl_gnutls_tsl = {
 #endif
 /* }}} */

+static void _php_curl_close_ex(php_curl *ch TSRMLS_DC);
 static void _php_curl_close(zend_rsrc_list_entry *rsrc TSRMLS_DC);

 #define SAVE_CURL_ERROR(__handle, __err) (__handle)->err.no = (int) __err;
@@ -157,36 +158,51 @@ static void _php_curl_close(zend_rsrc_list_entry *rsrc TSRMLS_DC);
 #define CAAZ(s, v) add_assoc_zval_ex(return_value, s, sizeof(s), (zval *) v);

 #if defined(PHP_WIN32) || defined(__GNUC__)
- #define php_curl_ret(__ret) RETVAL_FALSE; return __ret;
+# define php_curl_ret(__ret) RETVAL_FALSE; return __ret;
 #else
- #define php_curl_ret(__ret) RETVAL_FALSE; return;
+# define php_curl_ret(__ret) RETVAL_FALSE; return;
 #endif

-#define PHP_CURL_CHECK_OPEN_BASEDIR(str, len, __ret)													\
-	if (((PG(open_basedir) && *PG(open_basedir)) || PG(safe_mode)) &&                                                \
-	    strncasecmp(str, "file:", sizeof("file:") - 1) == 0)								\
-	{ 																							\
-		php_url *tmp_url; 																		\
-															\
-		if (!(tmp_url = php_url_parse_ex(str, len))) {											\
-			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid URL '%s'", str);				\
-			php_curl_ret(__ret);											\
-		} 													\
-															\
-		if (tmp_url->host || !php_memnstr(str, tmp_url->path, strlen(tmp_url->path), str + len)) {				\
-			php_error_docref(NULL TSRMLS_CC, E_WARNING, "URL '%s' contains unencoded control characters", str);	\
-			php_url_free(tmp_url); 																\
-			php_curl_ret(__ret);											\
-		}													\
-																								\
-		if (tmp_url->query || tmp_url->fragment || php_check_open_basedir(tmp_url->path TSRMLS_CC) || 									\
-			(PG(safe_mode) && !php_checkuid(tmp_url->path, "rb+", CHECKUID_CHECK_MODE_PARAM))	\
-		) { 																					\
-			php_url_free(tmp_url); 																\
-			php_curl_ret(__ret);											\
-		} 																						\
-		php_url_free(tmp_url); 																	\
+static int php_curl_option_url(php_curl *ch, const char *url, const int len) /* {{{ */
+{
+	CURLcode error = CURLE_OK;
+#if LIBCURL_VERSION_NUM < 0x071100
+	char *copystr = NULL;
+#endif
+	TSRMLS_FETCH();
+
+	/* Disable file:// if open_basedir or safe_mode are used */
+	if ((PG(open_basedir) && *PG(open_basedir)) || PG(safe_mode)) {
+#if LIBCURL_VERSION_NUM >= 0x071304
+		error = curl_easy_setopt(ch->cp, CURLOPT_PROTOCOLS, CURLPROTO_ALL & ~CURLPROTO_FILE);
+#else
+		php_url *uri;
+
+		if (!(uri = php_url_parse_ex(url, len))) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid URL '%s'", url);
+			return 0;
+		}
+
+		if (uri->scheme && !strncasecmp("file", uri->scheme, sizeof("file"))) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Protocol 'file' disabled in cURL");
+			php_url_free(uri);
+			return 0;
+		}
+		php_url_free(uri);
+#endif
 	}
+	/* Strings passed to libcurl as 'char *' arguments, are copied by the library... NOTE: before 7.17.0 strings were not copied. */
+#if LIBCURL_VERSION_NUM >= 0x071100
+	error = curl_easy_setopt(ch->cp, CURLOPT_URL, url);
+#else
+	copystr = estrndup(url, len);
+	error = curl_easy_setopt(ch->cp, CURLOPT_URL, copystr);
+	zend_llist_add_element(&ch->to_free.str, &copystr);
+#endif
+
+	return (error == CURLE_OK ? 1 : 0);
+}
+/* }}} */

 /* {{{ arginfo */
 static
@@ -279,14 +295,13 @@ ZEND_END_ARG_INFO()
 static
 ZEND_BEGIN_ARG_INFO_EX(arginfo_curl_multi_info_read, 0, 0, 1)
 	ZEND_ARG_INFO(0, mh)
-	ZEND_ARG_INFO(0, msgs_in_queue)
+	ZEND_ARG_INFO(1, msgs_in_queue)
 ZEND_END_ARG_INFO()

 static
 ZEND_BEGIN_ARG_INFO(arginfo_curl_multi_close, 0)
 	ZEND_ARG_INFO(0, mh)
 ZEND_END_ARG_INFO()
-
 /* }}} */

 /* {{{ curl_functions[]
@@ -352,8 +367,12 @@ PHP_MINFO_FUNCTION(curl)
 PHP_MINIT_FUNCTION(curl)
 {
 	le_curl = zend_register_list_destructors_ex(_php_curl_close, NULL, "curl", module_number);
-	le_curl_multi_handle = zend_register_list_destructors_ex(_php_curl_multi_close, NULL, "curl", module_number);
-	
+	le_curl_multi_handle = zend_register_list_destructors_ex(_php_curl_multi_close, NULL, "curl_multi", module_number);
+
+	/* See http://curl.haxx.se/lxr/source/docs/libcurl/symbols-in-versions
+	   or curl src/docs/libcurl/symbols-in-versions for a (almost) complete list
+	   of options and which version they were introduced */
+
 	/* Constants for curl_setopt() */
 	REGISTER_CURL_CONSTANT(CURLOPT_DNS_USE_GLOBAL_CACHE);
 	REGISTER_CURL_CONSTANT(CURLOPT_DNS_CACHE_TIMEOUT);
@@ -421,7 +440,7 @@ PHP_MINIT_FUNCTION(curl)
 	REGISTER_CURL_CONSTANT(CURLOPT_FILETIME);
 	REGISTER_CURL_CONSTANT(CURLOPT_WRITEFUNCTION);
 	REGISTER_CURL_CONSTANT(CURLOPT_READFUNCTION);
-#if CURLOPT_PASSWDFUNCTION != 0 
+#if CURLOPT_PASSWDFUNCTION != 0
 	REGISTER_CURL_CONSTANT(CURLOPT_PASSWDFUNCTION);
 #endif
 	REGISTER_CURL_CONSTANT(CURLOPT_HEADERFUNCTION);
@@ -467,14 +486,14 @@ PHP_MINIT_FUNCTION(curl)
 	REGISTER_CURL_CONSTANT(CURL_TIMECOND_LASTMOD);

 #if LIBCURL_VERSION_NUM > 0x070a05 /* CURLOPT_HTTPAUTH is available since curl 7.10.6 */
- 	REGISTER_CURL_CONSTANT(CURLOPT_HTTPAUTH);
- 	/* http authentication options */
- 	REGISTER_CURL_CONSTANT(CURLAUTH_BASIC);
- 	REGISTER_CURL_CONSTANT(CURLAUTH_DIGEST);
- 	REGISTER_CURL_CONSTANT(CURLAUTH_GSSNEGOTIATE);
- 	REGISTER_CURL_CONSTANT(CURLAUTH_NTLM);
- 	REGISTER_CURL_CONSTANT(CURLAUTH_ANY);
- 	REGISTER_CURL_CONSTANT(CURLAUTH_ANYSAFE);
+	REGISTER_CURL_CONSTANT(CURLOPT_HTTPAUTH);
+	/* http authentication options */
+	REGISTER_CURL_CONSTANT(CURLAUTH_BASIC);
+	REGISTER_CURL_CONSTANT(CURLAUTH_DIGEST);
+	REGISTER_CURL_CONSTANT(CURLAUTH_GSSNEGOTIATE);
+	REGISTER_CURL_CONSTANT(CURLAUTH_NTLM);
+	REGISTER_CURL_CONSTANT(CURLAUTH_ANY);
+	REGISTER_CURL_CONSTANT(CURLAUTH_ANYSAFE);
 #endif

 #if LIBCURL_VERSION_NUM > 0x070a06 /* CURLOPT_PROXYAUTH & CURLOPT_FTP_CREATE_MISSING_DIRS are available since curl 7.10.7 */
@@ -520,7 +539,7 @@ PHP_MINIT_FUNCTION(curl)
 	REGISTER_CURL_CONSTANT(CURL_VERSION_KERBEROS4);
 	REGISTER_CURL_CONSTANT(CURL_VERSION_SSL);
 	REGISTER_CURL_CONSTANT(CURL_VERSION_LIBZ);
-	
+
 	/* version constants */
 	REGISTER_CURL_CONSTANT(CURLVERSION_NOW);

@@ -594,8 +613,8 @@ PHP_MINIT_FUNCTION(curl)
 #if LIBCURL_VERSION_NUM >= 0x070b00
 	REGISTER_CURL_CONSTANT(CURLE_FTP_SSL_FAILED);
 #endif
-
 	REGISTER_CURL_CONSTANT(CURLPROXY_HTTP);
+	REGISTER_CURL_CONSTANT(CURLPROXY_SOCKS4);
 	REGISTER_CURL_CONSTANT(CURLPROXY_SOCKS5);

 	REGISTER_CURL_CONSTANT(CURL_NETRC_OPTIONAL);
@@ -605,7 +624,7 @@ PHP_MINIT_FUNCTION(curl)
 	REGISTER_CURL_CONSTANT(CURL_HTTP_VERSION_NONE);
 	REGISTER_CURL_CONSTANT(CURL_HTTP_VERSION_1_0);
 	REGISTER_CURL_CONSTANT(CURL_HTTP_VERSION_1_1);
-	
+
 	REGISTER_CURL_CONSTANT(CURLM_CALL_MULTI_PERFORM);
 	REGISTER_CURL_CONSTANT(CURLM_OK);
 	REGISTER_CURL_CONSTANT(CURLM_BAD_HANDLE);
@@ -630,16 +649,34 @@ PHP_MINIT_FUNCTION(curl)
 	REGISTER_CURL_CONSTANT(CURLFTPSSL_ALL);
 #endif

+#if LIBCURL_VERSION_NUM >= 0x071304
+	REGISTER_CURL_CONSTANT(CURLOPT_REDIR_PROTOCOLS);
+	REGISTER_CURL_CONSTANT(CURLOPT_PROTOCOLS);
+	REGISTER_CURL_CONSTANT(CURLPROTO_HTTP);
+	REGISTER_CURL_CONSTANT(CURLPROTO_HTTPS);
+	REGISTER_CURL_CONSTANT(CURLPROTO_FTP);
+	REGISTER_CURL_CONSTANT(CURLPROTO_FTPS);
+	REGISTER_CURL_CONSTANT(CURLPROTO_SCP);
+	REGISTER_CURL_CONSTANT(CURLPROTO_SFTP);
+	REGISTER_CURL_CONSTANT(CURLPROTO_TELNET);
+	REGISTER_CURL_CONSTANT(CURLPROTO_LDAP);
+	REGISTER_CURL_CONSTANT(CURLPROTO_LDAPS);
+	REGISTER_CURL_CONSTANT(CURLPROTO_DICT);
+	REGISTER_CURL_CONSTANT(CURLPROTO_FILE);
+	REGISTER_CURL_CONSTANT(CURLPROTO_TFTP);
+	REGISTER_CURL_CONSTANT(CURLPROTO_ALL);
+#endif
+
 #ifdef PHP_CURL_NEED_OPENSSL_TSL
 	if (!CRYPTO_get_id_callback()) {
 		int i, c = CRYPTO_num_locks();
-		
+
 		php_curl_openssl_tsl = malloc(c * sizeof(MUTEX_T));
-		
+
 		for (i = 0; i < c; ++i) {
 			php_curl_openssl_tsl[i] = tsrm_mutex_alloc();
 		}
-		
+
 		CRYPTO_set_id_callback(php_curl_ssl_id);
 		CRYPTO_set_locking_callback(php_curl_ssl_lock);
 	}
@@ -647,7 +684,7 @@ PHP_MINIT_FUNCTION(curl)
 #ifdef PHP_CURL_NEED_GNUTLS_TSL
 	gcry_control(GCRYCTL_SET_THREAD_CBS, &php_curl_gnutls_tsl);
 #endif
-	
+
 	if (curl_global_init(CURL_GLOBAL_SSL) != CURLE_OK) {
 		return FAILURE;
 	}
@@ -659,17 +696,28 @@ PHP_MINIT_FUNCTION(curl)
 		char **p = (char **)info->protocols;

 		while (*p != NULL) {
-			php_register_url_stream_wrapper(*p++, &php_curl_wrapper TSRMLS_CC);
+			/* Do not enable cURL "file" protocol and make sure cURL is always used when --with-curlwrappers is enabled */
+			if (strncasecmp(*p, "file", sizeof("file")-1) != 0) {
+				php_unregister_url_stream_wrapper(*p TSRMLS_CC);
+				php_register_url_stream_wrapper(*p, &php_curl_wrapper TSRMLS_CC);
+			}
+			(void) *p++;
 		}
 	}
 # else
+	php_unregister_url_stream_wrapper("http");
 	php_register_url_stream_wrapper("http", &php_curl_wrapper TSRMLS_CC);
+	php_unregister_url_stream_wrapper("https");
 	php_register_url_stream_wrapper("https", &php_curl_wrapper TSRMLS_CC);
+	php_unregister_url_stream_wrapper("ftp");
 	php_register_url_stream_wrapper("ftp", &php_curl_wrapper TSRMLS_CC);
+	php_unregister_url_stream_wrapper("ftps");
+	php_register_url_stream_wrapper("ftps", &php_curl_wrapper TSRMLS_CC);
+	php_unregister_url_stream_wrapper("ldap");
 	php_register_url_stream_wrapper("ldap", &php_curl_wrapper TSRMLS_CC);
 # endif
 #endif
-	
+
 	return SUCCESS;
 }
 /* }}} */
@@ -688,14 +736,14 @@ PHP_MSHUTDOWN_FUNCTION(curl)
 #ifdef PHP_CURL_NEED_OPENSSL_TSL
 	if (php_curl_openssl_tsl) {
 		int i, c = CRYPTO_num_locks();
-		
+
 		CRYPTO_set_id_callback(NULL);
 		CRYPTO_set_locking_callback(NULL);
-			
+
 		for (i = 0; i < c; ++i) {
 			tsrm_mutex_free(php_curl_openssl_tsl[i]);
 		}
-			
+
 		free(php_curl_openssl_tsl);
 		php_curl_openssl_tsl = NULL;
 	}
@@ -717,7 +765,7 @@ static size_t curl_write(char *data, size_t size, size_t nmemb, void *ctx)
 	fprintf(stderr, "curl_write() called\n");
 	fprintf(stderr, "data = %s, size = %d, nmemb = %d, ctx = %x\n", data, size, nmemb, ctx);
 #endif
-	
+
 	switch (t->method) {
 		case PHP_CURL_STDOUT:
 			PHPWRITE(data, length);
@@ -741,7 +789,7 @@ static size_t curl_write(char *data, size_t size, size_t nmemb, void *ctx)
 			ZVAL_RESOURCE(handle, ch->id);
 			zend_list_addref(ch->id);
 			argv[0] = &handle;
-	
+
 			MAKE_STD_ZVAL(zdata);
 			ZVAL_STRINGL(zdata, data, length, 1);
 			argv[1] = &zdata;
@@ -832,7 +880,7 @@ static size_t curl_read(char *data, size_t size, size_t nmemb, void *ctx)
 			error = zend_call_function(&fci, &t->fci_cache TSRMLS_CC);
 			ch->in_callback = 0;
 			if (error == FAILURE) {
-				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot call the CURLOPT_READFUNCTION"); 
+				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot call the CURLOPT_READFUNCTION");
 #if LIBCURL_VERSION_NUM >= 0x070c01 /* 7.12.1 */
 				length = CURL_READFUNC_ABORT;
 #endif
@@ -863,7 +911,7 @@ static size_t curl_write_header(char *data, size_t size, size_t nmemb, void *ctx
 	php_curl_write *t   = ch->handlers->write_header;
 	size_t          length = size * nmemb;
 	TSRMLS_FETCH_FROM_CTX(ch->thread_ctx);
-	
+
 	switch (t->method) {
 		case PHP_CURL_STDOUT:
 			/* Handle special case write when we're returning the entire transfer
@@ -939,7 +987,7 @@ static int curl_debug(CURL *cp, curl_infotype type, char *buf, size_t buf_len, v

 	if (type == CURLINFO_HEADER_OUT) {
 		if (ch->header.str_len) {
-			efree(ch->header.str);		
+			efree(ch->header.str);
 		}
 		if (buf_len > 0) {
 			ch->header.str = estrndup(buf, buf_len);
@@ -985,7 +1033,7 @@ static size_t curl_passwd(void *ctx, char *prompt, char *buf, int buflen)
 	} else {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "User handler '%s' did not return a string", Z_STRVAL_P(func));
 	}
-	
+
 	zval_ptr_dtor(&argv[0]);
 	zval_ptr_dtor(&argv[1]);
 	zval_ptr_dtor(&argv[2]);
@@ -1002,7 +1050,7 @@ static size_t curl_passwd(void *ctx, char *prompt, char *buf, int buflen)
 static void curl_free_string(void **string)
 {
 	efree(*string);
-}	
+}
 /* }}} */
 #endif

@@ -1027,7 +1075,7 @@ static void curl_free_slist(void **slist)
 PHP_FUNCTION(curl_version)
 {
 	curl_version_info_data *d;
-	long                    uversion = CURLVERSION_NOW;
+	long uversion = CURLVERSION_NOW;

 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|l", &uversion) == FAILURE) {
 		return;
@@ -1057,7 +1105,8 @@ PHP_FUNCTION(curl_version)
 		array_init(protocol_list);

 		while (*p != NULL) {
-			add_next_index_string(protocol_list,  *p++, 1);
+			add_next_index_string(protocol_list,  *p, 1);
+			p++;
 		}
 		CAAZ("protocols", protocol_list);
 	}
@@ -1076,9 +1125,9 @@ static void alloc_curl_handle(php_curl **ch)

 	(*ch)->in_callback = 0;
 	(*ch)->header.str_len = 0;
-		
+
 	memset(&(*ch)->err, 0, sizeof((*ch)->err));
-	
+
 #if LIBCURL_VERSION_NUM < 0x071101
 	zend_llist_init(&(*ch)->to_free.str,   sizeof(char *),            (llist_dtor_func_t) curl_free_string, 0);
 #endif
@@ -1091,10 +1140,11 @@ static void alloc_curl_handle(php_curl **ch)
   Initialize a cURL session */
 PHP_FUNCTION(curl_init)
 {
-	zval       **url;
-	php_curl    *ch;
-	CURL        *cp;
-	int          argc = ZEND_NUM_ARGS();
+	php_curl	*ch;
+	zval		**url;
+	zval		*clone;
+	CURL		*cp;
+	int			argc = ZEND_NUM_ARGS();

 	if (argc < 0 || argc > 1 || zend_get_parameters_ex(argc, &url) == FAILURE) {
 		WRONG_PARAM_COUNT;
@@ -1102,7 +1152,6 @@ PHP_FUNCTION(curl_init)

 	if (argc > 0) {
 		convert_to_string_ex(url);
-		PHP_CURL_CHECK_OPEN_BASEDIR(Z_STRVAL_PP(url), Z_STRLEN_PP(url), (void) NULL);
 	}

 	cp = curl_easy_init();
@@ -1115,7 +1164,7 @@ PHP_FUNCTION(curl_init)
 	TSRMLS_SET_CTX(ch->thread_ctx);

 	ch->cp = cp;
-	
+
 	ch->handlers->write->method = PHP_CURL_STDOUT;
 	ch->handlers->write->type   = PHP_CURL_ASCII;
 	ch->handlers->read->method  = PHP_CURL_DIRECT;
@@ -1123,6 +1172,9 @@ PHP_FUNCTION(curl_init)

 	ch->uses = 0;

+	MAKE_STD_ZVAL(clone);
+	ch->clone = clone;
+
 	curl_easy_setopt(ch->cp, CURLOPT_NOPROGRESS,        1);
 	curl_easy_setopt(ch->cp, CURLOPT_VERBOSE,           0);
 	curl_easy_setopt(ch->cp, CURLOPT_ERRORBUFFER,       ch->err.str);
@@ -1140,15 +1192,10 @@ PHP_FUNCTION(curl_init)
 #endif

 	if (argc > 0) {
-#if LIBCURL_VERSION_NUM >= 0x071100
-		curl_easy_setopt(ch->cp, CURLOPT_URL, Z_STRVAL_PP(url));
-#else
-		char *urlcopy;
-
-		urlcopy = estrndup(Z_STRVAL_PP(url), Z_STRLEN_PP(url));
-		curl_easy_setopt(ch->cp, CURLOPT_URL, urlcopy);
-		zend_llist_add_element(&ch->to_free.str, &urlcopy);
-#endif
+		if (!php_curl_option_url(ch, Z_STRVAL_PP(url), Z_STRLEN_PP(url))) {
+			_php_curl_close_ex(ch TSRMLS_CC);
+			RETURN_FALSE;
+		}
 	}

 	ZEND_REGISTER_RESOURCE(return_value, ch, le_curl);
@@ -1160,14 +1207,14 @@ PHP_FUNCTION(curl_init)
   Copy a cURL handle along with all of it's preferences */
 PHP_FUNCTION(curl_copy_handle)
 {
-	zval     **zid;
-	CURL      *cp;
-	php_curl  *ch;
-	php_curl  *dupch;
+	CURL		*cp;
+	zval		**zid;
+	php_curl	*ch, *dupch;

 	if (ZEND_NUM_ARGS() != 1 || zend_get_parameters_ex(1, &zid) == FAILURE) {
 		WRONG_PARAM_COUNT;
 	}
+
 	ZEND_FETCH_RESOURCE(ch, php_curl *, zid, -1, le_curl_name, le_curl);

 	cp = curl_easy_duphandle(ch->cp);
@@ -1180,6 +1227,7 @@ PHP_FUNCTION(curl_copy_handle)
 	TSRMLS_SET_CTX(dupch->thread_ctx);

 	dupch->cp = cp;
+	dupch->uses = 0;
 	dupch->handlers->write->method = ch->handlers->write->method;
 	dupch->handlers->write->type   = ch->handlers->write->type;
 	dupch->handlers->read->method  = ch->handlers->read->method;
@@ -1222,6 +1270,10 @@ PHP_FUNCTION(curl_copy_handle)
 	zend_llist_copy(&dupch->to_free.slist, &ch->to_free.slist);
 	zend_llist_copy(&dupch->to_free.post, &ch->to_free.post);

+	/* Keep track of cloned copies to avoid invoking curl destructors for every clone */
+	ch->clone->refcount++;
+	dupch->clone = ch->clone;
+
 	ZEND_REGISTER_RESOURCE(return_value, dupch, le_curl);
 	dupch->id = Z_LVAL_P(return_value);
 }
@@ -1302,8 +1354,19 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue, zval *retu
 		case CURLOPT_COOKIESESSION:
 #if LIBCURL_VERSION_NUM > 0x070b01 /* CURLOPT_TCP_NODELAY is available since curl 7.11.2 */
 		case CURLOPT_TCP_NODELAY:
+#endif
+#if LIBCURL_VERSION_NUM >= 0x71304
+		case CURLOPT_REDIR_PROTOCOLS:
+		case CURLOPT_PROTOCOLS:
 #endif
 			convert_to_long_ex(zvalue);
+#if LIBCURL_VERSION_NUM >= 0x71304
+			if (((PG(open_basedir) && *PG(open_basedir)) || PG(safe_mode)) && (Z_LVAL_PP(zvalue) & CURLPROTO_FILE)) {
+					php_error_docref(NULL TSRMLS_CC, E_WARNING, "CURLPROTO_FILE cannot be activated when in safe_mode or an open_basedir is set");
+					RETVAL_FALSE;
+					return 1;
+			}
+#endif
 			error = curl_easy_setopt(ch->cp, option, Z_LVAL_PP(zvalue));
 			break;
 		case CURLOPT_FOLLOWLOCATION:
@@ -1329,47 +1392,50 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue, zval *retu
 		case CURLOPT_COOKIE:
 		case CURLOPT_REFERER:
 		case CURLOPT_INTERFACE:
-		case CURLOPT_KRB4LEVEL: 
+		case CURLOPT_KRB4LEVEL:
 		case CURLOPT_EGDSOCKET:
-		case CURLOPT_CAINFO: 
+		case CURLOPT_CAINFO:
 		case CURLOPT_CAPATH:
-		case CURLOPT_SSL_CIPHER_LIST: 
+		case CURLOPT_SSL_CIPHER_LIST:
 		case CURLOPT_SSLKEY:
-		case CURLOPT_SSLKEYTYPE: 
-		case CURLOPT_SSLKEYPASSWD: 
-		case CURLOPT_SSLENGINE: 
+		case CURLOPT_SSLKEYTYPE:
+		case CURLOPT_SSLKEYPASSWD:
+		case CURLOPT_SSLENGINE:
 		case CURLOPT_SSLENGINE_DEFAULT:
 		case CURLOPT_SSLCERTTYPE:
-		case CURLOPT_ENCODING: {
+		case CURLOPT_ENCODING:
+		{
 #if LIBCURL_VERSION_NUM < 0x071100
 			char *copystr = NULL;
 #endif
-	
+
 			convert_to_string_ex(zvalue);

 			if (option == CURLOPT_URL) {
-				PHP_CURL_CHECK_OPEN_BASEDIR(Z_STRVAL_PP(zvalue), Z_STRLEN_PP(zvalue), 1);
-			}
-
+				if (!php_curl_option_url(ch, Z_STRVAL_PP(zvalue), Z_STRLEN_PP(zvalue))) {
+					RETVAL_FALSE;
+					return 1;
+				}
+			} else {
 #if LIBCURL_VERSION_NUM >= 0x071100
-			/* Strings passed to libcurl as ’char *’ arguments, are copied by the library... NOTE: before 7.17.0 strings were not copied. */
-			error = curl_easy_setopt(ch->cp, option, Z_STRVAL_PP(zvalue));
+				/* Strings passed to libcurl as ’char *’ arguments, are copied by the library... NOTE: before 7.17.0 strings were not copied. */
+				error = curl_easy_setopt(ch->cp, option, Z_STRVAL_PP(zvalue));
 #else
-			copystr = estrndup(Z_STRVAL_PP(zvalue), Z_STRLEN_PP(zvalue));
-			error = curl_easy_setopt(ch->cp, option, copystr);
-			zend_llist_add_element(&ch->to_free.str, &copystr);
+				copystr = estrndup(Z_STRVAL_PP(zvalue), Z_STRLEN_PP(zvalue));
+				error = curl_easy_setopt(ch->cp, option, copystr);
+				zend_llist_add_element(&ch->to_free.str, &copystr);
 #endif
-
+			}
 			break;
 		}
 		case CURLOPT_FILE:
-		case CURLOPT_INFILE: 
+		case CURLOPT_INFILE:
 		case CURLOPT_WRITEHEADER:
 		case CURLOPT_STDERR: {
 			FILE *fp = NULL;
 			int type;
 			void * what;
-		
+
 			what = zend_fetch_resource(zvalue TSRMLS_CC, -1, "File-Handle", &type, 1, php_file_le_stream());
 			if (!what) {
 				RETVAL_FALSE;
@@ -1389,18 +1455,46 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue, zval *retu
 			error = CURLE_OK;
 			switch (option) {
 				case CURLOPT_FILE:
-					ch->handlers->write->fp = fp;
-					ch->handlers->write->method = PHP_CURL_FILE;
+					if (((php_stream *) what)->mode[0] != 'r' || ((php_stream *) what)->mode[1] == '+') {
+						zend_list_addref(Z_LVAL_PP(zvalue));
+						ch->handlers->write->fp = fp;
+						ch->handlers->write->method = PHP_CURL_FILE;
+					} else {
+						php_error_docref(NULL TSRMLS_CC, E_WARNING, "the provided file handle is not writable");
+						RETVAL_FALSE;
+						return 1;
+					}
 					break;
 				case CURLOPT_WRITEHEADER:
-					ch->handlers->write_header->fp = fp;
-					ch->handlers->write_header->method = PHP_CURL_FILE;
+					if (((php_stream *) what)->mode[0] != 'r' || ((php_stream *) what)->mode[1] == '+') {
+						zend_list_addref(Z_LVAL_PP(zvalue));
+						ch->handlers->write_header->fp = fp;
+						ch->handlers->write_header->method = PHP_CURL_FILE;
+					} else {
+						php_error_docref(NULL TSRMLS_CC, E_WARNING, "the provided file handle is not writable");
+						RETVAL_FALSE;
+						return 1;
+					}
 					break;
 				case CURLOPT_INFILE:
 					zend_list_addref(Z_LVAL_PP(zvalue));
 					ch->handlers->read->fp = fp;
 					ch->handlers->read->fd = Z_LVAL_PP(zvalue);
 					break;
+				case CURLOPT_STDERR:
+					if (((php_stream *) what)->mode[0] != 'r' || ((php_stream *) what)->mode[1] == '+') {
+						if (ch->handlers->std_err) {
+							zval_ptr_dtor(&ch->handlers->std_err);
+						}
+						zval_add_ref(zvalue);
+						ch->handlers->std_err = *zvalue;
+						zend_list_addref(Z_LVAL_PP(zvalue));
+					} else {
+						php_error_docref(NULL TSRMLS_CC, E_WARNING, "the provided file handle is not writable");
+						RETVAL_FALSE;
+						return 1;
+					}
+					/* break omitted intentionally */
 				default:
 					error = curl_easy_setopt(ch->cp, option, fp);
 					break;
@@ -1418,7 +1512,7 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue, zval *retu
 			}
 			break;
 		case CURLOPT_BINARYTRANSFER:
-			convert_to_long_ex(zvalue);	
+			convert_to_long_ex(zvalue);

 			if (Z_LVAL_PP(zvalue)) {
 				ch->handlers->write->type = PHP_CURL_BINARY;
@@ -1476,8 +1570,8 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue, zval *retu
 				uint              string_key_len;

 				postfields = HASH_OF(*zvalue);
-				if (! postfields) {
-					php_error_docref(NULL TSRMLS_CC, E_WARNING, "Couldn't get HashTable in CURLOPT_POSTFIELDS"); 
+				if (!postfields) {
+					php_error_docref(NULL TSRMLS_CC, E_WARNING, "Couldn't get HashTable in CURLOPT_POSTFIELDS");
 					RETVAL_FALSE;
 					return 1;
 				}
@@ -1491,48 +1585,45 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue, zval *retu
 					convert_to_string_ex(current);

 					zend_hash_get_current_key_ex(postfields, &string_key, &string_key_len, &num_key, 0, NULL);
-				
+
 					postval = Z_STRVAL_PP(current);

 					/* The arguments after _NAMELENGTH and _CONTENTSLENGTH
 					 * must be explicitly cast to long in curl_formadd
 					 * use since curl needs a long not an int. */
 					if (*postval == '@') {
-						char *type;
+						char *type, *filename;
 						++postval;

-						if ((type = php_memnstr(postval, ";type=", sizeof(";type=") - 1, postval + strlen(postval)))) {
+						if ((type = php_memnstr(postval, ";type=", sizeof(";type=") - 1, postval + Z_STRLEN_PP(current)))) {
 							*type = '\0';
 						}
+						if ((filename = php_memnstr(postval, ";filename=", sizeof(";filename=") - 1, postval + Z_STRLEN_PP(current)))) {
+							*filename = '\0';
+						}
 						/* safe_mode / open_basedir check */
 						if (php_check_open_basedir(postval TSRMLS_CC) || (PG(safe_mode) && !php_checkuid(postval, "rb+", CHECKUID_CHECK_MODE_PARAM))) {
-							if (type) {
-								*type = ';';
-							}
 							RETVAL_FALSE;
 							return 1;
 						}
+						error = curl_formadd(&first, &last,
+										CURLFORM_COPYNAME, string_key,
+										CURLFORM_NAMELENGTH, (long)string_key_len - 1,
+										CURLFORM_FILENAME, filename ? filename : postval,
+										CURLFORM_CONTENTTYPE, type ? type + sizeof(";type=") - 1 : "application/octet-stream",
+										CURLFORM_FILE, postval,
+										CURLFORM_END);
 						if (type) {
-							error = curl_formadd(&first, &last, 
-											 CURLFORM_COPYNAME, string_key,
-											 CURLFORM_NAMELENGTH, (long)string_key_len - 1,
-											 CURLFORM_FILE, postval,
-											 CURLFORM_CONTENTTYPE, type + sizeof(";type=") - 1,
-											 CURLFORM_END);
 							*type = ';';
-						} else {
-							error = curl_formadd(&first, &last, 
-											 CURLFORM_COPYNAME, string_key,
-											 CURLFORM_NAMELENGTH, (long)string_key_len - 1,
-											 CURLFORM_FILE, postval,
-											 CURLFORM_END);
-
+						}
+						if (filename) {
+							*filename = ';';
 						}
 					} else {
-						error = curl_formadd(&first, &last, 
+						error = curl_formadd(&first, &last,
 											 CURLFORM_COPYNAME, string_key,
 											 CURLFORM_NAMELENGTH, (long)string_key_len - 1,
-											 CURLFORM_COPYCONTENTS, postval, 
+											 CURLFORM_COPYCONTENTS, postval,
 											 CURLFORM_CONTENTSLENGTH, (long)Z_STRLEN_PP(current),
 											 CURLFORM_END);
 					}
@@ -1549,6 +1640,7 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue, zval *retu

 			} else {
 #if LIBCURL_VERSION_NUM >= 0x071101
+				convert_to_string_ex(zvalue);
 				/* with curl 7.17.0 and later, we can use COPYPOSTFIELDS, but we have to provide size before */
 				error = curl_easy_setopt(ch->cp, CURLOPT_POSTFIELDSIZE, Z_STRLEN_PP(zvalue));
 				error = curl_easy_setopt(ch->cp, CURLOPT_COPYPOSTFIELDS, Z_STRVAL_PP(zvalue));
@@ -1564,7 +1656,7 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue, zval *retu
 #endif
 			}
 			break;
-		case CURLOPT_HTTPHEADER: 
+		case CURLOPT_HTTPHEADER:
 		case CURLOPT_QUOTE:
 		case CURLOPT_HTTP200ALIASES:
 		case CURLOPT_POSTQUOTE: {
@@ -1588,7 +1680,7 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue, zval *retu

 				slist = curl_slist_append(slist, Z_STRVAL_PP(current));
 				if (!slist) {
-					php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not build curl_slist"); 
+					php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not build curl_slist");
 					RETVAL_FALSE;
 					return 1;
 				}
@@ -1655,7 +1747,7 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue, zval *retu
 PHP_FUNCTION(curl_setopt)
 {
 	zval       **zid, **zoption, **zvalue;
-	php_curl    *ch;
+	php_curl   *ch;

 	if (ZEND_NUM_ARGS() != 3 || zend_get_parameters_ex(3, &zid, &zoption, &zvalue) == FAILURE) {
 		WRONG_PARAM_COUNT;
@@ -1679,24 +1771,24 @@ PHP_FUNCTION(curl_setopt_array)
 {
 	zval		*zid, *arr, **entry;
 	php_curl	*ch;
-	long		option;
+	ulong		option;
 	HashPosition	pos;
-	char 		*string_key;
-	int 		str_key_len;
+	char		*string_key;
+	uint		str_key_len;

 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "za", &zid, &arr) == FAILURE) {
-		RETURN_FALSE;
+		return;
 	}

 	ZEND_FETCH_RESOURCE(ch, php_curl *, &zid, -1, le_curl_name, le_curl);

 	zend_hash_internal_pointer_reset_ex(Z_ARRVAL_P(arr), &pos);
 	while (zend_hash_get_current_data_ex(Z_ARRVAL_P(arr), (void **)&entry, &pos) == SUCCESS) {
-		if (zend_hash_get_current_key_ex(Z_ARRVAL_P(arr), &string_key, &str_key_len, &option, 0, &pos) == HASH_KEY_IS_STRING) {
-			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Array keys must be CURLOPT constants or equivalent integer values"); 
+		if (zend_hash_get_current_key_ex(Z_ARRVAL_P(arr), &string_key, &str_key_len, &option, 0, &pos) != HASH_KEY_IS_LONG) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Array keys must be CURLOPT constants or equivalent integer values");
 			RETURN_FALSE;
 		}
-		if (_php_curl_setopt(ch, option, entry, return_value TSRMLS_CC)) {
+		if (_php_curl_setopt(ch, (long) option, entry, return_value TSRMLS_CC)) {
 			RETURN_FALSE;
 		}
 		zend_hash_move_forward_ex(Z_ARRVAL_P(arr), &pos);
@@ -1705,7 +1797,7 @@ PHP_FUNCTION(curl_setopt_array)
 }
 /* }}} */

-/* {{{ _php_curl_cleanup_handle(ch) 
+/* {{{ _php_curl_cleanup_handle(ch)
   Cleanup an execution phase */
 void _php_curl_cleanup_handle(php_curl *ch)
 {
@@ -1726,9 +1818,9 @@ void _php_curl_cleanup_handle(php_curl *ch)
   Perform a cURL session */
 PHP_FUNCTION(curl_exec)
 {
-	zval      **zid;
-	php_curl   *ch;
-	CURLcode    error;
+	CURLcode	error;
+	zval		**zid;
+	php_curl	*ch;

 	if (ZEND_NUM_ARGS() != 1 || zend_get_parameters_ex(1, &zid) == FAILURE) {
 		WRONG_PARAM_COUNT;
@@ -1737,7 +1829,7 @@ PHP_FUNCTION(curl_exec)
 	ZEND_FETCH_RESOURCE(ch, php_curl *, zid, -1, le_curl_name, le_curl);

 	_php_curl_cleanup_handle(ch);
-	
+
 	error = curl_easy_perform(ch->cp);
 	SAVE_CURL_ERROR(ch, error);
 	/* CURLE_PARTIAL_FILE is returned by HEAD requests */
@@ -1748,14 +1840,19 @@ PHP_FUNCTION(curl_exec)
 		RETURN_FALSE;
 	}

-	ch->uses++;
-
 	if (ch->handlers->write->method == PHP_CURL_RETURN && ch->handlers->write->buf.len > 0) {
-		--ch->uses;
 		smart_str_0(&ch->handlers->write->buf);
 		RETURN_STRINGL(ch->handlers->write->buf.c, ch->handlers->write->buf.len, 1);
 	}
-	--ch->uses;
+
+	/* flush the file handle, so any remaining data is synched to disk */
+	if (ch->handlers->write->method == PHP_CURL_FILE && ch->handlers->write->fp) {
+		fflush(ch->handlers->write->fp);
+	}
+	if (ch->handlers->write_header->method == PHP_CURL_FILE && ch->handlers->write_header->fp) {
+		fflush(ch->handlers->write_header->fp);
+	}
+
 	if (ch->handlers->write->method == PHP_CURL_RETURN) {
 		RETURN_EMPTY_STRING();
 	} else {
@@ -1768,10 +1865,9 @@ PHP_FUNCTION(curl_exec)
   Get information regarding a specific transfer */
 PHP_FUNCTION(curl_getinfo)
 {
-	zval       **zid, 
-	           **zoption;
-	php_curl    *ch;
-	int          option, argc = ZEND_NUM_ARGS();
+	zval		**zid, **zoption;
+	php_curl	*ch;
+	int			option, argc = ZEND_NUM_ARGS();

 	if (argc < 1 || argc > 2 || zend_get_parameters_ex(argc, &zid, &zoption) == FAILURE) {
 		WRONG_PARAM_COUNT;
@@ -1860,22 +1956,22 @@ PHP_FUNCTION(curl_getinfo)
 		option = Z_LVAL_PP(zoption);
 		switch (option) {
 			case CURLINFO_PRIVATE:
-			case CURLINFO_EFFECTIVE_URL: 
+			case CURLINFO_EFFECTIVE_URL:
 			case CURLINFO_CONTENT_TYPE: {
- 				char *s_code = NULL;
+				char *s_code = NULL;

- 				if (curl_easy_getinfo(ch->cp, option, &s_code) == CURLE_OK && s_code) {
- 					RETURN_STRING(s_code, 1);
- 				} else {
- 					RETURN_FALSE;
- 				}
+				if (curl_easy_getinfo(ch->cp, option, &s_code) == CURLE_OK && s_code) {
+					RETURN_STRING(s_code, 1);
+				} else {
+					RETURN_FALSE;
+				}
 				break;
 			}
-			case CURLINFO_HTTP_CODE: 
-			case CURLINFO_HEADER_SIZE: 
-			case CURLINFO_REQUEST_SIZE: 
-			case CURLINFO_FILETIME: 
-			case CURLINFO_SSL_VERIFYRESULT: 
+			case CURLINFO_HTTP_CODE:
+			case CURLINFO_HEADER_SIZE:
+			case CURLINFO_REQUEST_SIZE:
+			case CURLINFO_FILETIME:
+			case CURLINFO_SSL_VERIFYRESULT:
 			case CURLINFO_REDIRECT_COUNT: {
 				long code = 0;

@@ -1886,16 +1982,16 @@ PHP_FUNCTION(curl_getinfo)
 				}
 				break;
 			}
-			case CURLINFO_TOTAL_TIME: 
-			case CURLINFO_NAMELOOKUP_TIME: 
+			case CURLINFO_TOTAL_TIME:
+			case CURLINFO_NAMELOOKUP_TIME:
 			case CURLINFO_CONNECT_TIME:
-			case CURLINFO_PRETRANSFER_TIME: 
-			case CURLINFO_SIZE_UPLOAD: 
+			case CURLINFO_PRETRANSFER_TIME:
+			case CURLINFO_SIZE_UPLOAD:
 			case CURLINFO_SIZE_DOWNLOAD:
-			case CURLINFO_SPEED_DOWNLOAD: 
-			case CURLINFO_SPEED_UPLOAD: 
+			case CURLINFO_SPEED_DOWNLOAD:
+			case CURLINFO_SPEED_UPLOAD:
 			case CURLINFO_CONTENT_LENGTH_DOWNLOAD:
-			case CURLINFO_CONTENT_LENGTH_UPLOAD: 
+			case CURLINFO_CONTENT_LENGTH_UPLOAD:
 			case CURLINFO_STARTTRANSFER_TIME:
 			case CURLINFO_REDIRECT_TIME: {
 				double code = 0.0;
@@ -1922,9 +2018,9 @@ PHP_FUNCTION(curl_getinfo)
   Return a string contain the last error for the current session */
 PHP_FUNCTION(curl_error)
 {
-	zval      **zid;
-	php_curl   *ch;
-	
+	zval		**zid;
+	php_curl	*ch;
+
 	if (ZEND_NUM_ARGS() != 1 || zend_get_parameters_ex(1, &zid) == FAILURE) {
 		WRONG_PARAM_COUNT;
 	}
@@ -1940,8 +2036,8 @@ PHP_FUNCTION(curl_error)
   Return an integer containing the last error number */
 PHP_FUNCTION(curl_errno)
 {
-	zval      **zid;
-	php_curl   *ch;
+	zval		**zid;
+	php_curl	*ch;

 	if (ZEND_NUM_ARGS() != 1 || zend_get_parameters_ex(1, &zid) == FAILURE) {
 		WRONG_PARAM_COUNT;
@@ -1957,8 +2053,8 @@ PHP_FUNCTION(curl_errno)
   Close a cURL session */
 PHP_FUNCTION(curl_close)
 {
-	zval      **zid;
-	php_curl   *ch;
+	zval		**zid;
+	php_curl	*ch;

 	if (ZEND_NUM_ARGS() != 1 || zend_get_parameters_ex(1, &zid) == FAILURE) {
 		WRONG_PARAM_COUNT;
@@ -1970,8 +2066,8 @@ PHP_FUNCTION(curl_close)
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Attempt to close cURL handle from a callback");
 		return;
 	}
-	
-	if (ch->uses) {	
+
+	if (ch->uses) {
 		ch->uses--;
 	} else {
 		zend_list_delete(Z_LVAL_PP(zid));
@@ -1981,20 +2077,34 @@ PHP_FUNCTION(curl_close)

 /* {{{ _php_curl_close()
   List destructor for curl handles */
-static void _php_curl_close(zend_rsrc_list_entry *rsrc TSRMLS_DC)
+static void _php_curl_close_ex(php_curl *ch TSRMLS_DC)
 {
-	php_curl *ch = (php_curl *) rsrc->ptr;
-
 #if PHP_CURL_DEBUG
 	fprintf(stderr, "DTOR CALLED, ch = %x\n", ch);
 #endif
-	
+
+	/* Prevent crash inside cURL if passed file has already been closed */
+	if (ch->handlers->std_err && ch->handlers->std_err->refcount <= 0) {
+		curl_easy_setopt(ch->cp, CURLOPT_STDERR, stderr);
+	}
+
 	curl_easy_cleanup(ch->cp);
 #if LIBCURL_VERSION_NUM < 0x071101
 	zend_llist_clean(&ch->to_free.str);
 #endif
-	zend_llist_clean(&ch->to_free.slist);
-	zend_llist_clean(&ch->to_free.post);
+
+	/* cURL destructors should be invoked only by last curl handle */
+	if (ch->clone->refcount <= 1) {
+		zend_llist_clean(&ch->to_free.slist);
+		zend_llist_clean(&ch->to_free.post);
+		FREE_ZVAL(ch->clone);
+	} else {
+		ch->clone->refcount--;
+		ch->to_free.slist.dtor = NULL;
+		ch->to_free.post.dtor = NULL;
+		zend_llist_clean(&ch->to_free.slist);
+		zend_llist_clean(&ch->to_free.post);
+	}

 	if (ch->handlers->write->buf.len > 0) {
 		smart_str_free(&ch->handlers->write->buf);
@@ -2011,16 +2121,28 @@ static void _php_curl_close(zend_rsrc_list_entry *rsrc TSRMLS_DC)
 	if (ch->handlers->passwd) {
 		zval_ptr_dtor(&ch->handlers->passwd);
 	}
+	if (ch->handlers->std_err) {
+		zval_ptr_dtor(&ch->handlers->std_err);
+	}
 	if (ch->header.str_len > 0) {
 		efree(ch->header.str);
 	}
-	
+
 	efree(ch->handlers->write);
 	efree(ch->handlers->write_header);
 	efree(ch->handlers->read);
 	efree(ch->handlers);
 	efree(ch);
-}	
+}
+/* }}} */
+
+/* {{{ _php_curl_close()
+   List destructor for curl handles */
+static void _php_curl_close(zend_rsrc_list_entry *rsrc TSRMLS_DC)
+{
+	php_curl *ch = (php_curl *) rsrc->ptr;
+	_php_curl_close_ex(ch TSRMLS_CC);
+}
 /* }}} */

 #endif /* HAVE_CURL */
@@ -101,6 +101,7 @@ typedef struct {
 	php_curl_write *write_header;
 	php_curl_read  *read;
 	zval           *passwd;
+	zval           *std_err;
 } php_curl_handlers;

 struct _php_curl_error  {
@@ -131,6 +132,7 @@ typedef struct {
 	long                     id;
 	unsigned int             uses;
 	zend_bool                in_callback;
+	zval                     *clone;
 } php_curl;

 typedef struct {
@@ -48,6 +48,7 @@
 #include "ext/standard/php_smart_str.h"
 #include "ext/standard/info.h"
 #include "ext/standard/file.h"
+#include "ext/standard/php_string.h"
 #include "php_curl.h"

 static size_t on_data_available(char *data, size_t size, size_t nmemb, void *ctx)
@@ -128,7 +129,7 @@ static int on_progress_avail(php_stream *stream, double dltotal, double dlnow, d

 	/* our notification system only works in a single direction; we should detect which
 	 * direction is important and use the correct values in this call */
-	php_stream_notify_progress(stream->context, dlnow, dltotal);
+	php_stream_notify_progress(stream->context, (size_t) dlnow, (size_t) dltotal);
 	return 0;
 }

@@ -166,7 +167,8 @@ static size_t php_curl_stream_read(php_stream *stream, char *buf, size_t count T
 			tv.tv_sec = 15; /* TODO: allow this to be configured from the script */

 			/* wait for data */
-			switch (select(curlstream->maxfd + 1, &curlstream->readfds, &curlstream->writefds, &curlstream->excfds, &tv)) {
+			switch ((curlstream->maxfd < 0) ? 1 : 
+					select(curlstream->maxfd + 1, &curlstream->readfds, &curlstream->writefds, &curlstream->excfds, &tv)) {
 				case -1:
 					/* error */
 					return 0;
@@ -179,7 +181,8 @@ static size_t php_curl_stream_read(php_stream *stream, char *buf, size_t count T
 						curlstream->mcode = curl_multi_perform(curlstream->multi, &curlstream->pending);
 					} while (curlstream->mcode == CURLM_CALL_MULTI_PERFORM);
 			}
-		} while (curlstream->readbuffer.readpos >= curlstream->readbuffer.writepos && curlstream->pending > 0);
+		} while (curlstream->maxfd >= 0 &&
+				curlstream->readbuffer.readpos >= curlstream->readbuffer.writepos && curlstream->pending > 0);

 	}

@@ -258,6 +261,7 @@ php_stream *php_curl_stream_opener(php_stream_wrapper *wrapper, char *filename,
 	php_stream *stream;
 	php_curl_stream *curlstream;
 	zval *tmp, **ctx_opt = NULL;
+	struct curl_slist *slist = NULL;

 	curlstream = emalloc(sizeof(php_curl_stream));
 	memset(curlstream, 0, sizeof(php_curl_stream));
@@ -306,6 +310,15 @@ php_stream *php_curl_stream_opener(php_stream_wrapper *wrapper, char *filename,
 	
 	/* TODO: read cookies and options from context */
 	if (context && !strncasecmp(filename, "http", sizeof("http")-1)) {
+		/* Protocol version */
+		if (SUCCESS == php_stream_context_get_option(context, "http", "protocol_version", &ctx_opt) && Z_TYPE_PP(ctx_opt) == IS_DOUBLE) {
+			if (Z_DVAL_PP(ctx_opt) == 1.1) {
+				curl_easy_setopt(curlstream->curl, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_1);
+			} else {
+				curl_easy_setopt(curlstream->curl, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_1_0);
+			}
+		}
+
 		if (SUCCESS == php_stream_context_get_option(context, "http", "curl_verify_ssl_host", &ctx_opt) && Z_TYPE_PP(ctx_opt) == IS_BOOL && Z_LVAL_PP(ctx_opt) == 1) {
 			curl_easy_setopt(curlstream->curl, CURLOPT_SSL_VERIFYHOST, 1);
 		} else {
@@ -321,20 +334,34 @@ php_stream *php_curl_stream_opener(php_stream_wrapper *wrapper, char *filename,
 		if (SUCCESS == php_stream_context_get_option(context, "http", "user_agent", &ctx_opt) && Z_TYPE_PP(ctx_opt) == IS_STRING) {
 			curl_easy_setopt(curlstream->curl, CURLOPT_USERAGENT, Z_STRVAL_PP(ctx_opt));
 		}
-		if (SUCCESS == php_stream_context_get_option(context, "http", "header", &ctx_opt) && Z_TYPE_PP(ctx_opt) == IS_ARRAY) {
-			HashPosition pos;
-			zval **header = NULL;
-			struct curl_slist *hl = NULL;
+		if (SUCCESS == php_stream_context_get_option(context, "http", "header", &ctx_opt)) {
+			if (Z_TYPE_PP(ctx_opt) == IS_ARRAY) {
+				HashPosition pos;
+				zval **header = NULL;
 			
-			for (zend_hash_internal_pointer_reset_ex(Z_ARRVAL_PP(ctx_opt), &pos);
-				SUCCESS == zend_hash_get_current_data_ex(Z_ARRVAL_PP(ctx_opt), (void *)&header, &pos);
-				zend_hash_move_forward_ex(Z_ARRVAL_PP(ctx_opt), &pos)) {
-				if (Z_TYPE_PP(header) == IS_STRING) {
-					hl = curl_slist_append(hl, Z_STRVAL_PP(header));
+				for (zend_hash_internal_pointer_reset_ex(Z_ARRVAL_PP(ctx_opt), &pos);
+					SUCCESS == zend_hash_get_current_data_ex(Z_ARRVAL_PP(ctx_opt), (void *)&header, &pos);
+					zend_hash_move_forward_ex(Z_ARRVAL_PP(ctx_opt), &pos)
+				) {
+					if (Z_TYPE_PP(header) == IS_STRING) {
+						slist = curl_slist_append(slist, Z_STRVAL_PP(header));
+					}
 				}
+			} else if (Z_TYPE_PP(ctx_opt) == IS_STRING && Z_STRLEN_PP(ctx_opt)) {
+				char *p, *token, *trimmed, *copy_ctx_opt;
+
+				copy_ctx_opt = php_trim(Z_STRVAL_PP(ctx_opt), Z_STRLEN_PP(ctx_opt), NULL, 0, NULL, 3 TSRMLS_CC);
+				p = php_strtok_r(copy_ctx_opt, "\r\n", &token);
+				while (p) {
+					trimmed = php_trim(p, strlen(p), NULL, 0, NULL, 3 TSRMLS_CC);
+					slist = curl_slist_append(slist, trimmed);
+					efree(trimmed);
+					p = php_strtok_r(NULL, "\r\n", &token);
+				}
+				efree(copy_ctx_opt);
 			}
-			if (hl) {
-				curl_easy_setopt(curlstream->curl, CURLOPT_HTTPHEADER, hl);
+			if (slist) {
+				curl_easy_setopt(curlstream->curl, CURLOPT_HTTPHEADER, slist);
 			}
 		}
 		if (SUCCESS == php_stream_context_get_option(context, "http", "method", &ctx_opt) && Z_TYPE_PP(ctx_opt) == IS_STRING) {
@@ -444,8 +471,7 @@ php_stream *php_curl_stream_opener(php_stream_wrapper *wrapper, char *filename,
 #else 
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "There was an error mcode=%d", m);
 #endif
-			php_stream_close(stream);
-			return NULL;
+			goto exit_fail;
 		}
 		
 		/* we have only one curl handle here, even though we use multi syntax, 
@@ -463,12 +489,23 @@ php_stream *php_curl_stream_opener(php_stream_wrapper *wrapper, char *filename,
 			}
 		}
 		if (msg_found) {
-			php_stream_close(stream);
-			return NULL;
+			goto exit_fail;
 		}
 	}
-	
+
+	/* context headers are not needed anymore */
+	if (slist) {
+		curl_easy_setopt(curlstream->curl, CURLOPT_HTTPHEADER, NULL);
+		curl_slist_free_all(slist);
+	}
 	return stream;
+
+exit_fail:
+	php_stream_close(stream);
+	if (slist) {
+		curl_slist_free_all(slist);
+	}
+	return NULL;
 }

 static php_stream_wrapper_ops php_curl_wrapper_ops = {
@@ -1,5 +1,21 @@
 --TEST--
 Bug #45161 (Reusing a curl handle leaks memory)
+--SKIPIF--
+<?php 
+if (substr(PHP_OS, 0, 3) == 'WIN') {
+	exit("skip not for Windows");
+}
+if (!extension_loaded("curl")) {
+	exit("skip curl extension not loaded");
+}
+if (false === getenv('PHP_CURL_HTTP_REMOTE_SERVER'))  {
+	exit("skip PHP_CURL_HTTP_REMOTE_SERVER env variable is not defined");
+}
+$curl_version = curl_version(); 
+if ($curl_version['version_number'] < 0x071100) {
+	exit("skip: test works only with curl >= 7.17.0");
+}
+?>
 --FILE--
 <?php

@@ -0,0 +1,36 @@
+--TEST--
+Bug #46711 (lost memory when foreach is used for values passed to curl_setopt())
+--SKIPIF--
+<?php 
+if (!extension_loaded("curl")) {
+	exit("skip curl extension not loaded");
+}
+if (false === getenv('PHP_CURL_HTTP_REMOTE_SERVER'))  {
+	exit("skip PHP_CURL_HTTP_REMOTE_SERVER env variable is not defined");
+}
+?>
+--FILE--
+<?php
+$ch = curl_init();
+
+$opt = array(
+	CURLOPT_AUTOREFERER  => TRUE,
+	CURLOPT_BINARYTRANSFER => TRUE
+);
+
+curl_setopt( $ch, CURLOPT_AUTOREFERER  , TRUE );
+
+foreach( $opt as $option => $value ) {
+	curl_setopt( $ch, $option, $value );
+}
+
+var_dump($opt); // with this bug, $opt[58] becomes NULL
+
+?>
+--EXPECT--
+array(2) {
+  [58]=>
+  bool(true)
+  [19914]=>
+  bool(true)
+}
@@ -1,5 +1,11 @@
 --TEST--
 Bug #46739 (array returned by curl_getinfo should contain content_type key)
+--SKIPIF--
+<?php 
+if (!extension_loaded("curl")) {
+	exit("skip curl extension not loaded");
+}
+?>
 --FILE--
 <?php
 $ch = curl_init('http://127.0.0.1:9/');
@@ -0,0 +1,33 @@
+--TEST--
+Bug #48203 (Crash when CURLOPT_STDERR is set to regular file)
+--SKIPIF--
+<?php 
+if (!extension_loaded("curl")) {
+	exit("skip curl extension not loaded");
+}
+if (false === getenv('PHP_CURL_HTTP_REMOTE_SERVER'))  {
+	exit("skip PHP_CURL_HTTP_REMOTE_SERVER env variable is not defined");
+}
+?>
+--FILE--
+<?php
+
+$fp = fopen(dirname(__FILE__) . '/bug48203.tmp', 'w');
+
+$ch = curl_init();
+
+curl_setopt($ch, CURLOPT_VERBOSE, 1);
+curl_setopt($ch, CURLOPT_STDERR, $fp);
+curl_setopt($ch, CURLOPT_URL, "");
+
+fclose($fp); // <-- premature close of $fp caused a crash!
+
+curl_exec($ch);
+
+echo "Ok\n";
+
+?>
+--CLEAN--
+<?php @unlink(dirname(__FILE__) . '/bug48203.tmp'); ?>
+--EXPECT--
+Ok
@@ -0,0 +1,47 @@
+--TEST--
+Test curl_setopt() CURLOPT_FILE readonly file handle
+--CREDITS--
+Mark van der Velden
+#testfest Utrecht 2009
+--SKIPIF--
+<?php if (!extension_loaded("curl")) print "skip"; ?>
+--FILE--
+<?php
+/*
+ * Description       : Adds a file which stores the received data from curl_exec();
+ * Source code       : ext/curl/multi.c
+ * Test documentation: http://wiki.php.net/qa/temp/ext/curl
+ */
+
+// Figure out what handler to use
+$host = getenv('PHP_CURL_HTTP_REMOTE_SERVER');
+if(!empty($host)) {
+
+    // Use the set Environment variable
+    $url = "$host/get.php";
+
+} else {
+
+    // Create a temporary file for the test
+    $tempname = tempnam(sys_get_temp_dir(), 'CURL_HANDLE');
+    $url = 'file://'. $tempname;
+
+    // add the test data to the file
+    file_put_contents($tempname, "Hello World!\nHello World!");
+}
+
+
+$tempfile	= tempnam(sys_get_temp_dir(), 'CURL_FILE_HANDLE');
+
+$ch = curl_init($url);
+$fp = fopen($tempfile, "r"); // Opening 'fubar' with the incorrect readonly flag
+curl_setopt($ch, CURLOPT_FILE, $fp);
+curl_exec($ch);
+curl_close($ch);
+is_file($tempfile) and @unlink($tempfile);
+isset($tempname) and is_file($tempname) and @unlink($tempname);
+?>
+--EXPECTF--
+Warning: curl_setopt(): the provided file handle is not writable in %s on line %d
+Hello World!
+Hello World!
@@ -0,0 +1,27 @@
+--TEST--
+Bug #48514 (cURL extension uses same resource name for simple and multi APIs)
+--SKIPIF--
+<?php
+
+if (!extension_loaded('curl')) {
+	exit("skip curl extension not loaded");
+}
+
+?>
+--FILE--
+<?php
+
+$ch1 = curl_init();
+var_dump($ch1);
+var_dump(get_resource_type($ch1));
+
+$ch2 = curl_multi_init();
+var_dump($ch2);
+var_dump(get_resource_type($ch2));
+
+?>
+--EXPECTF--
+resource(%d) of type (curl)
+%string|unicode%(4) "curl"
+resource(%d) of type (curl_multi)
+%string|unicode%(10) "curl_multi"
@@ -0,0 +1,44 @@
+--TEST--
+Test CURLOPT_READDATA without a callback function
+--CREDITS--
+Mattijs Hoitink mattijshoitink@gmail.com
+#Testfest Utrecht 2009
+--SKIPIF--
+<?php if (!extension_loaded("curl") || false === getenv('PHP_CURL_HTTP_REMOTE_SERVER')) print "skip"; ?>
+--FILE--
+<?php
+
+// The URL to POST to
+$url = getenv('PHP_CURL_HTTP_REMOTE_SERVER') . '/get.php?test=post';
+
+// Create a temporary file to read the data from
+$tempname = tempnam(sys_get_temp_dir(), 'CURL_DATA');
+$datalen = file_put_contents($tempname, "hello=world&smurf=blue");
+
+ob_start();
+
+$ch = curl_init($url);
+curl_setopt($ch, CURLOPT_URL, $url);
+curl_setopt($ch, CURLOPT_POST, true);
+curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+curl_setopt($ch, CURLOPT_READDATA, fopen($tempname, 'rb'));
+curl_setopt($ch, CURLOPT_HTTPHEADER, array('Expect:', "Content-Length: {$datalen}"));
+
+if (false === $response = curl_exec($ch)) {
+    echo 'Error #' . curl_errno($ch) . ': ' . curl_error($ch);
+} else {
+    echo $response;
+}
+
+curl_close($ch);
+
+// Clean the temporary file
+@unlink($tempname);
+
+--EXPECT--
+array(2) {
+  ["hello"]=>
+  string(5) "world"
+  ["smurf"]=>
+  string(4) "blue"
+}
@@ -0,0 +1,45 @@
+--TEST--
+Test curl_exec() function with basic functionality 
+--CREDITS--
+Sebastian Deutsch <sebastian.deutsch@9elements.com>
+TestFest 2009 - AFUP - Jean-Marc Fontaine <jmf@durcommefaire.net>
+--SKIPIF--
+<?php 
+if (!extension_loaded("curl")) exit("skip curl extension not loaded");
+if (false === getenv('PHP_CURL_HTTP_REMOTE_SERVER'))  exit("skip PHP_CURL_HTTP_REMOTE_SERVER env variable is not defined");
+?>
+--FILE--
+<?php
+/* Prototype  : bool curl_exec(resource ch)
+ * Description: Perform a cURL session 
+ * Source code: ext/curl/interface.c
+ * Alias to functions: 
+ */
+	
+  $host = getenv('PHP_CURL_HTTP_REMOTE_SERVER');
+
+  // start testing
+  echo "*** Testing curl_exec() : basic functionality ***\n";
+
+  $url = "{$host}/get.php?test=get";
+  $ch = curl_init();
+
+  ob_start(); // start output buffering
+  curl_setopt($ch, CURLOPT_URL, $url); //set the url we want to use
+  $ok = curl_exec($ch);
+  curl_close($ch);
+  $curl_content = ob_get_contents();
+  ob_end_clean();
+
+  if($ok) {
+    var_dump( $curl_content );
+  } else {
+    echo "curl_exec returned false";
+  }
+?>
+===DONE===
+--EXPECTF--
+*** Testing curl_exec() : basic functionality ***
+string(25) "Hello World!
+Hello World!"
+===DONE===
@@ -0,0 +1,41 @@
+--TEST--
+Test curl_opt() function with CURLOPT_RETURNTRANSFER parameter set to 1
+--CREDITS--
+Sebastian Deutsch <sebastian.deutsch@9elements.com>
+TestFest 2009 - AFUP - Jean-Marc Fontaine <jmf@durcommefaire.net>
+--SKIPIF--
+<?php 
+if (!extension_loaded("curl")) exit("skip curl extension not loaded");
+if (false === getenv('PHP_CURL_HTTP_REMOTE_SERVER'))  exit("skip PHP_CURL_HTTP_REMOTE_SERVER env variable is not defined");
+?>
+--FILE--
+<?php
+/* Prototype  : bool curl_setopt(resource ch, int option, mixed value)
+ * Description: Set an option for a cURL transfer
+ * Source code: ext/curl/interface.c
+ * Alias to functions:
+ */
+
+  $host = getenv('PHP_CURL_HTTP_REMOTE_SERVER');
+
+  // start testing
+  echo '*** Testing curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); ***' . "\n";
+
+  $url = "{$host}/get.php?test=get";
+  $ch = curl_init();
+
+  ob_start(); // start output buffering
+  curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
+  curl_setopt($ch, CURLOPT_URL, $url); //set the url we want to use
+  
+  $curl_content = curl_exec($ch);
+  curl_close($ch);
+
+  var_dump( $curl_content );
+?>
+===DONE===
+--EXPECTF--
+*** Testing curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); ***
+string(25) "Hello World!
+Hello World!"
+===DONE===
@@ -0,0 +1,56 @@
+--TEST--
+Test curl_opt() function with POST parameters
+--CREDITS--
+Sebastian Deutsch <sebastian.deutsch@9elements.com>
+TestFest 2009 - AFUP - Jean-Marc Fontaine <jmf@durcommefaire.net>
+--SKIPIF--
+<?php 
+if (!extension_loaded("curl")) exit("skip curl extension not loaded");
+if (false === getenv('PHP_CURL_HTTP_REMOTE_SERVER'))  exit("skip PHP_CURL_HTTP_REMOTE_SERVER env variable is not defined");
+?>
+--FILE--
+<?php
+/* Prototype  : bool curl_setopt(resource ch, int option, mixed value)
+ * Description: Set an option for a cURL transfer
+ * Source code: ext/curl/interface.c
+ * Alias to functions:
+ */
+
+  $host = getenv('PHP_CURL_HTTP_REMOTE_SERVER');
+
+  // start testing
+  echo '*** Testing curl sending through GET an POST ***' . "\n";
+
+  $url = "{$host}/get.php?test=getpost&get_param=Hello%20World";
+  $ch = curl_init();
+
+  ob_start(); // start output buffering
+  curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
+  curl_setopt($ch, CURLOPT_POST, 1);
+  curl_setopt($ch, CURLOPT_POSTFIELDS, "Hello=World&Foo=Bar&Person=John%20Doe");
+  curl_setopt($ch, CURLOPT_URL, $url); //set the url we want to use
+  
+  $curl_content = curl_exec($ch);
+  curl_close($ch);
+
+  var_dump( $curl_content );
+?>
+===DONE===
+--EXPECTF--
+*** Testing curl sending through GET an POST ***
+string(208) "array(2) {
+  ["test"]=>
+  string(7) "getpost"
+  ["get_param"]=>
+  string(11) "Hello World"
+}
+array(3) {
+  ["Hello"]=>
+  string(5) "World"
+  ["Foo"]=>
+  string(3) "Bar"
+  ["Person"]=>
+  string(8) "John Doe"
+}
+"
+===DONE===