PHP 5.3.4

which break the Protocol API 
(see http://bugs.mysql.com/bug.php?id=58700)

EXTENSIONS

@@ -73,6 +73,12 @@ PRIMARY MAINTAINER:  Edin Kadribasic <edink@php.net>
 MAINTENANCE:         Maintained
 STATUS:              Working
 -------------------------------------------------------------------------------
+EXTENSION:           fpm
+PRIMARY MAINTAINER:  Antony Dovgal <tony2001@php.net>, Jerome Loyet <fat@php.net>
+MAINTENANCE:         Maintained
+STATUS:              Working
+SINCE:               5.3.3
+-------------------------------------------------------------------------------
 EXTENSION:           isapi
 MAINTENANCE:         Unknown
 STATUS:              Working

INSTALL

@@ -279,7 +279,15 @@ ir if
     it is your first install then you need to "make install" as well)
 
 13. cd ../php-5.x.y
-14. cp php.ini-dist /usr/local/lib/php.ini
+
+14. The PHP distribution provides two sample php.ini files, you can use them
+    by
+      cp php.ini-development /usr/local/lib/php.ini
+    or
+      cp php.ini-production  /usr/local/lib/php.ini
+
+    If you choose one of these php.ini files be certain to read the list
+    of changes within, as they affect how PHP behaves.
 
 15. You can edit /usr/local/lib/php.ini file to set PHP options.
     Edit your httpd.conf or srm.conf file and add:
@@ -451,15 +459,19 @@ Apache 2.0 on Unix systems
 
 13. Setup your php.ini
 
-    cp php.ini-dist /usr/local/lib/php.ini
+    The PHP distribution provides two sample php.ini files, you can use them
+    by
+      cp php.ini-development /usr/local/lib/php.ini
+    or
+      cp php.ini-production  /usr/local/lib/php.ini
+
+    If you choose one of these php.ini files be certain to read the list
+    of changes within, as they affect how PHP behaves.
 
     You may edit your .ini file to set PHP options.  If you prefer having
     php.ini in another location, use --with-config-file-path=/some/path in
     step 10.
 
-    If you instead choose php.ini-recommended, be certain to read the list
-    of changes within, as they affect how PHP behaves.
-
 14. Edit your httpd.conf to load the PHP module.  The path on the right hand
     side of the LoadModule statement must point to the path of the PHP
     module on your system.  The make install from above may have already
@@ -858,7 +870,7 @@ Using Binary Packages
    Example 2-6. OpenBSD Package Install Example
 # pkg_add php4-core-4.3.8.tgz
 # /usr/local/sbin/phpxs -s
-# cp /usr/local/share/doc/php4/php.ini-recommended /var/www/conf/php.ini
+# cp /usr/local/share/doc/php4/php.ini-development /var/www/conf/php.ini
   (add in mysql)
 # pkg_add php4-mysql-4.3.8.tgz
 # /usr/local/sbin/phpxs -a mysql
@@ -1242,10 +1254,10 @@ setenv OPTIM=-O2
        back to the root of the Apache source directory and run the above
        configure command again. That'll bring the link table up to date.
        Run make and make install again.
-    7. Copy and rename the php.ini-dist file to your bin directory from
-       your PHP 4 source directory: cp php.ini-dist /usr/local/bin/php.ini
-       or (if your don't have a local directory) cp php.ini-dist
-       /usr/bin/php.ini.
+    7. Copy and rename the php.ini-development or php.ini-production file to
+       your bin directory from your PHP 4 source directory:
+       cp php.ini-development /usr/local/bin/php.ini or (if your don't have a
+       local directory) cp php.ini-development /usr/bin/php.ini.
      __________________________________________________________________
 
 Compiling for MacOS X Client
@@ -1735,8 +1747,8 @@ cgi error:
    example, set it with something like:
    --with-config-file-path=/etc
 
-   And then you would copy php.ini-dist from the distribution to
-   /etc/php.ini and edit it to make any local changes you want.
+   And then you would copy php.ini-development or php.ini-production from the
+   distribution to /etc/php.ini and edit it to make any local changes you want.
    --with-config-file-scan-dir=PATH
 
    On Windows the default path for the php.ini file is the Windows

LICENSE

@@ -1,6 +1,6 @@
 -------------------------------------------------------------------- 
                   The PHP License, version 3.01
-Copyright (c) 1999 - 2009 The PHP Group. All rights reserved.
+Copyright (c) 1999 - 2010 The PHP Group. All rights reserved.
 -------------------------------------------------------------------- 
 
 Redistribution and use in source and binary forms, with or without

Makefile.gcov

@@ -5,24 +5,7 @@
 
 lcov: lcov-html
 
-lcov-test: all
-	@echo "Running test suite"
-	@find . -name \*.gcda -o -name \*.da -o -name \*.bbg? | xargs rm -f
-	-@if test ! -z "$(PHP_EXECUTABLE)" && test -x "$(PHP_EXECUTABLE)"; then \
-		NO_INTERACTION=1 \
-		TEST_PHP_EXECUTABLE=$(PHP_EXECUTABLE) \
-		TEST_PHP_SRCDIR=$(top_srcdir) \
-		CC="$(CC)" \
-			$(PHP_EXECUTABLE) -d 'open_basedir=' -d 'safe_mode=0' -d 'output_buffering=0' -d 'memory_limit=-1' $(top_srcdir)/run-tests.php -d 'extension_dir=modules/' -d `( . $(PHP_MODULES) ; echo extension=$$dlname)` tests/; \
-	elif test ! -z "$(SAPI_CLI_PATH)" && test -x "$(SAPI_CLI_PATH)"; then \
-		NO_INTERACTION=1 \
-		TEST_PHP_EXECUTABLE=$(top_builddir)/$(SAPI_CLI_PATH) \
-		TEST_PHP_SRCDIR=$(top_srcdir) \
-		CC="$(CC)" \
-			$(top_builddir)/$(SAPI_CLI_PATH) -d 'open_basedir=' -d 'safe_mode=0' -d 'output_buffering=0' -d 'memory_limit=-1' $(top_srcdir)/run-tests.php $(TESTS); \
-	else \
-		echo "ERROR: Cannot run tests without CLI sapi."; \
-	fi
+lcov-test: lcov-clean-data test
 
 php_lcov.info: lcov-test
 	@echo "Generating data for $@"
@@ -77,3 +60,5 @@ lcov-clean:
 	rm -rf lcov_data/
 	rm -rf lcov_html/
 
+lcov-clean-data:
+	@find . -name \*.gcda -o -name \*.da -o -name \*.bbg? | xargs rm -f

Makefile.global

@@ -98,6 +98,7 @@ test: all
 		TEST_PHP_SRCDIR=$(top_srcdir) \
 		CC="$(CC)" \
 			$(PHP_EXECUTABLE) -n -c $(top_builddir)/tmp-php.ini $(PHP_TEST_SETTINGS) $(top_srcdir)/run-tests.php -n -c $(top_builddir)/tmp-php.ini -d extension_dir=$(top_builddir)/modules/ $(PHP_TEST_SHARED_EXTENSIONS) $(TESTS); \
+		rm $(top_builddir)/tmp-php.ini; \
 	else \
 		echo "ERROR: Cannot run tests without CLI sapi."; \
 	fi

NEWS

@@ -1,16 +1,554 @@
-PHP                                                                        NEWS
+PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 20??, PHP 5.3.3
-- Upgraded bundled PCRE to version 8.01. (Ilia)
+09 Dec 2010, PHP 5.3.4
+- Upgraded bundled Sqlite3 to version 3.7.3. (Ilia)
+- Upgraded bundled PCRE to version 8.10. (Ilia)
 
+- Security enhancements:
+  . Fixed crash in zip extract method (possible CWE-170). 
+    (Maksymilian Arciemowicz, Pierre)
+  . Paths with NULL in them (foo\0bar.txt) are now considered as invalid. (Rasmus)
+  . Fixed a possible double free in imap extension (Identified by Mateusz 
+    Kocielski). (CVE-2010-4150). (Ilia)
+  . Fixed NULL pointer dereference in ZipArchive::getArchiveComment.
+    (CVE-2010-3709). (Maksymilian Arciemowicz)
+  . Fixed possible flaw in open_basedir (CVE-2010-3436). (Pierre)
+  . Fixed MOPS-2010-24, fix string validation. (CVE-2010-2950). (Pierre)
+  . Fixed symbolic resolution support when the target is a DFS share. (Pierre)
+  . Fixed bug #52929 (Segfault in filter_var with FILTER_VALIDATE_EMAIL with
+    large amount of data) (CVE-2010-3710). (Adam)
+
+- General improvements:
+  . Added stat support for zip stream. (Pierre)
+  . Added follow_location (enabled by default) option for the http stream 
+    support. (Pierre)
+  . Improved support for is_link and related functions on Windows. (Pierre)
+  . Added a 3rd parameter to get_html_translation_table. It now takes a charset
+    hint, like htmlentities et al. (Gustavo)
+ 
+- Implemented feature requests:
+  . Implemented FR #52348, added new constant ZEND_MULTIBYTE to detect
+    zend multibyte at runtime. (Kalle)
+  . Implemented FR #52173, added functions pcntl_get_last_error() and 
+     pcntl_strerror(). (nick dot telford at gmail dot com, Arnaud)
+  . Implemented symbolic links support for open_basedir checks. (Pierre)
+  . Implemented FR #51804, SplFileInfo::getLinkTarget on Windows. (Pierre)
+  . Implemented FR #50692, not uploaded files don't count towards
+    max_file_uploads limit. As a side improvement, temporary files are not opened
+    for empty uploads and, in debug mode, 0-length uploads. (Gustavo)
+    
+- Improved MySQLnd:
+  . Added new character sets to mysqlnd, which are available in MySQL 5.5
+    (Andrey)
+
+- Improved PHP-FPM SAPI:
+  . Added '-p/--prefix' to php-fpm to use a custom prefix and run multiple
+    instances. (fat)
+  . Added custom process title for FPM. (fat)
+  . Added '-t/--test' to php-fpm to check and validate FPM conf file. (fat)
+  . Added statistics about listening socket queue length for FPM.
+    (andrei dot nigmatulin at gmail dot com, fat)
+    
+- Core:
+  . Fixed extract() to do not overwrite $GLOBALS and $this when using
+    EXTR_OVERWRITE. (jorto at redhat dot com)
+  . Fixed bug in the Windows implementation of dns_get_record, where the two
+    last parameters wouldn't be filled unless the type were DNS_ANY (Gustavo).
+  . Changed the $context parameter on copy() to actually have an effect. (Kalle)
+  . Fixed htmlentities/htmlspecialchars accepting certain ill-formed UTF-8
+    sequences. (Gustavo)
+  . Fixed bug #53409 (sleep() returns NULL on Windows). (Pierre)
+  . Fixed bug #53319 (strip_tags() may strip '<br />' incorrectly). (Felipe)
+  . Fixed bug #53304 (quot_print_decode does not handle lower-case hex digits).
+    (Ilia, daniel dot mueller at inexio dot net)
+  . Fixed bug #53248 (rawurlencode RFC 3986 EBCDIC support misses tilde char).
+    (Justin Martin)  
+  . Fixed bug #53226 (file_exists fails on big filenames). (Adam)
+  . Fixed bug #53198 (changing INI setting "from" with ini_set did not have any
+    effect). (Gustavo)
+  . Fixed bug #53180 (post_max_size=0 not disabling the limit when the content
+    type is application/x-www-form-urlencoded or is not registered with PHP).
+    (gm at tlink dot de, Gustavo)
+  . Fixed bug #53141 (autoload misbehaves if called from closing session).
+    (ladislav at marek dot su)
+  . Fixed bug #53021 (In html_entity_decode, failure to convert numeric entities
+    with ENT_NOQUOTES and ISO-8859-1). Fixed and extended the fix of ENT_NOQUOTES 
+    in html_entity_decode that had introduced the bug (rev #185591) to other
+    encodings. Additionaly, html_entity_decode() now doesn't decode &#34; if
+    ENT_NOQUOTES is given. (Gustavo)
+  . Fixed bug #52931 (strripos not overloaded with function overloading enabled).
+    (Felipe)
+  . Fixed bug #52772 (var_dump() doesn't check for the existence of 
+    get_class_name before calling it). (Kalle, Gustavo)
+  . Fixed bug #52534 (var_export array with negative key). (Felipe)
+  . Fixed bug #52327 (base64_decode() improper handling of leading padding in
+    strict mode). (Ilia)
+  . Fixed bug #52260 (dns_get_record fails with non-existing domain on Windows).
+    (a_jelly_doughnut at phpbb dot com, Pierre)
+  . Fixed bug #50953 (socket will not connect to IPv4 address when the host has
+    both IPv4 and IPv6 addresses, on Windows). (Gustavo, Pierre)
+  . Fixed bug #50524 (proc_open on Windows does not respect cwd as it does on
+    other platforms). (Pierre)
+  . Fixed bug #49687 (utf8_decode vulnerabilities and deficiencies in the number
+    of reported malformed sequences). (CVE-2010-3870) (Gustavo)
+  . Fixed bug #49407 (get_html_translation_table doesn't handle UTF-8). (Gustavo)
+  . Fixed bug #48831 (php -i has different output to php --ini). (Richard, 
+    Pierre)
+  . Fixed bug #47643 (array_diff() takes over 3000 times longer than php 5.2.4).
+    (Felipe)
+  . Fixed bug #47168 (printf of floating point variable prints maximum of 40 
+    decimal places). (Ilia)
+  . Fixed bug #46587 (mt_rand() does not check that max is greater than min).
+    (Ilia)
+  . Fixed bug #29085 (bad default include_path on Windows). (Pierre)
+  . Fixed bug #25927 (get_html_translation_table calls the ' &#39; instead of
+    &#039;). (Gustavo)
+    
+- Zend engine:
+  . Reverted fix for bug #51176 (Static calling in non-static method behaves
+    like $this->). (Felipe)
+  . Changed deprecated ini options on startup from E_WARNING to E_DEPRECATED. 
+    (Kalle)
+  . Fixed NULL dereference in lex_scan on zend multibyte builds where the script
+    had a flex incompatible encoding and there was no converter. (Gustavo)
+  . Fixed covariance of return-by-ref constraints. (Etienne)
+  . Fixed bug #53305 (E_NOTICE when defining a constant starts with
+    __COMPILER_HALT_OFFSET__). (Felipe)
+  . Fixed bug #52939 (zend_call_function does not respect ZEND_SEND_PREFER_REF).
+    (Dmitry)
+  . Fixed bug #52879 (Objects unreferenced in __get, __set, __isset or __unset
+    can be freed too early). (mail_ben_schmidt at yahoo dot com dot au, Dmitry)
+  . Fixed bug #52786 (PHP should reset section to [PHP] after ini sections).
+    (Fedora at famillecollet dot com)
+  . Fixed bug #52508 (newline problem with parse_ini_file+INI_SCANNER_RAW).
+    (Felipe)
+  . Fixed bug #52484 (__set() ignores setting properties with empty names).
+    (Felipe)
+  . Fixed bug #52361 (Throwing an exception in a destructor causes invalid
+    catching). (Dmitry)
+  . Fixed bug #51008 (Zend/tests/bug45877.phpt fails). (Dmitry)
+  
+- Build issues:
+  . Fixed bug #52436 (Compile error if systems do not have stdint.h)
+    (Sriram Natarajan)
+  . Fixed bug #50345 (nanosleep not detected properly on some solaris versions).
+    (Ulf, Tony)
+  . Fixed bug #49215 (make fails on glob_wrapper). (Felipe)
+
+- Calendar extension:
+  . Fixed bug #52744 (cal_days_in_month incorrect for December 1 BCE).
+   (gpap at internet dot gr, Adam)
+    
+- cURL extension:
+  . Fixed bug #52828 (curl_setopt does not accept persistent streams).
+    (Gustavo, Ilia)
+  . Fixed bug #52827 (cURL leaks handle and causes assertion error
+    (CURLOPT_STDERR)). (Gustavo)
+  . Fixed bug #52202 (CURLOPT_PRIVATE gets corrupted). (Ilia)
+  . Fixed bug #50410 (curl extension slows down PHP on Windows). (Pierre)
+    
+- DateTime extension:
+  . Fixed bug #53297 (gettimeofday implementation in php/win32/time.c can return
+    1 million microsecs). (ped at 7gods dot org)
+  . Fixed bug #52668 (Iterating over a dateperiod twice is broken). (Derick)
+  . Fixed bug #52454 (Relative dates and getTimestamp increments by one day).
+    (Derick)
+  . Fixed bug #52430 (date_parse parse 24:xx:xx as valid time). (Derick)
+  . Added support for the ( and ) delimiters/separators to
+    DateTime::createFromFormat(). (Derick)
+
+- DBA extension:
+  . Added Berkeley DB 5.1 support to the DBA extension. (Oracle Corp.)
+
+- DOM extension:
+  . Fixed bug #52656 (DOMCdataSection does not work with splitText). (Ilia)
+
+- Filter extension:
+  . Fixed the filter extension accepting IPv4 octets with a leading 0 as that
+    belongs to the unsupported "dotted octal" representation. (Gustavo)
+  . Fixed bug #53236 (problems in the validation of IPv6 addresses with leading
+    and trailing :: in the filter extension). (Gustavo)
+  . Fixed bug #50117 (problems in the validation of IPv6 addresses with IPv4
+    addresses and ::). (Gustavo)
+
+- GD extension:
+  . Fixed bug #53492 (fix crash if anti-aliasing steps are invalid). (Pierre)
+
+- GMP extension:
+  . Fixed bug #52906 (gmp_mod returns negative result when non-negative is 
+    expected). (Stas)
+  . Fixed bug #52849 (GNU MP invalid version match). (Adam)
+
+- Hash extension:
+  . Fixed bug #51003 (unaligned memory access in ext/hash/hash_tiger.c).
+    (Mike, Ilia)
+
+- Iconv extension:
+  . Fixed bug #52941 (The 'iconv_mime_decode_headers' function is skipping
+    headers). (Adam)
+  . Fixed bug #52599 (iconv output handler outputs incorrect content type
+    when flags are used). (Ilia)
+  . Fixed bug #51250 (iconv_mime_decode() does not ignore malformed Q-encoded 
+    words). (Ilia)
+
+- Intl extension:
+  . Fixed crashes on invalid parameters in intl extension. (CVE-2010-4409). (Stas, Maksymilian
+    Arciemowicz)
+  . Added support for formatting the timestamp stored in a DateTime object.
+    (Stas)
+  . Fixed bug #50590 (IntlDateFormatter::parse result is limited to the integer
+    range). (Stas)
+    
+- Mbstring extension:
+  . Fixed bug #53273 (mb_strcut() returns garbage with the excessive length
+    parameter). (CVE-2010-4156) (Mateusz Kocielski, Pierre, Moriyoshi)
+  . Fixed bug #52981 (Unicode casing table was out-of-date. Updated with
+    UnicodeData-6.0.0d7.txt and included the source of the generator program with
+    the distribution) (Gustavo).
+  . Fixed bug #52681 (mb_send_mail() appends an extra MIME-Version header).
+    (Adam)
+ 
+- MSSQL extension:
+  . Fixed possible crash in mssql_fetch_batch(). (Kalle)
+  . Fixed bug #52843 (Segfault when optional parameters are not passed in to
+    mssql_connect). (Felipe)
+    
+- MySQL extension:
+  . Fixed bug #52636 (php_mysql_fetch_hash writes long value into int). 
+    (Kalle, rein at basefarm dot no)
+    
+- MySQLi extension:
+  . Fixed bug #52891 (Wrong data inserted with mysqli/mysqlnd when using
+    mysqli_stmt_bind_param and value> PHP_INT_MAX). (Andrey)
+  . Fixed bug #52686 (mysql_stmt_attr_[gs]et argument points to incorrect type).
+    (rein at basefarm dot no)
+  . Fixed bug #52654 (mysqli doesn't install headers with structures it uses).
+    (Andrey)
+  . Fixed bug #52433 (Call to undefined method mysqli::poll() - must be static).
+    (Andrey)
+  . Fixed bug #52417 (MySQLi build failure with mysqlnd on MacOS X). (Andrey)
+  . Fixed bug #52413 (MySQLi/libmysql build failure on OS X, FreeBSD). (Andrey)
+  . Fixed bug #52390 (mysqli_report() should be per-request setting). (Kalle)
+  . Fixed bug #52302 (mysqli_fetch_all does not work with MYSQLI_USE_RESULT).
+    (Andrey)
+  . Fixed bug #52221 (Misbehaviour of magic_quotes_runtime (get/set)). (Andrey)
+  . Fixed bug #45921 (Can't initialize character set hebrew). (Andrey)
+  
+- MySQLnd:
+  . Fixed bug #52613 (crash in mysqlnd after hitting memory limit). (Andrey)
+     
+- ODBC extension:
+  - Fixed bug #52512 (Broken error handling in odbc_execute).
+    (mkoegler at auto dot tuwien dot ac dot at)
+
+- Openssl extension:
+  . Fixed possible blocking behavior in openssl_random_pseudo_bytes on Windows.
+    (Pierre)
+  . Fixed bug #53136 (Invalid read on openssl_csr_new()). (Felipe)
+  . Fixed bug #52947 (segfault when ssl stream option capture_peer_cert_chain
+    used). (Felipe)
+
+- Oracle Database extension (OCI8):
+  . Fixed bug #53284 (Valgrind warnings in oci_set_* functions) (Oracle Corp.)
+  . Fixed bug #51610 (Using oci_connect causes PHP to take a long time to
+    exit).  Requires Oracle 11.2.0.2 client libraries (or Oracle bug fix
+    9891199) for this patch to have an effect. (Oracle Corp.)
+      
+- PCNTL extension:
+  . Fixed bug #52784 (Race condition when handling many concurrent signals).
+    (nick dot telford at gmail dot com, Arnaud)
+    
+- PCRE extension:
+  . Fixed bug #52971 (PCRE-Meta-Characters not working with utf-8). (Felipe)
+  . Fixed bug #52732 (Docs say preg_match() returns FALSE on error, but it
+    returns int(0)). (slugonamission at gmail dot com)
+
+- PHAR extension:
+  . Fixed bug #50987 (unaligned memory access in phar.c).
+    (geissert at debian dot org, Ilia)
+
+- PHP-FPM SAPI:
+  . Fixed bug #53412 (segfault when using -y). (fat)
+  . Fixed inconsistent backlog default value (-1) in FPM on many systems. (fat)
+  . Fixed bug #52501 (libevent made FPM crashed when forking -- libevent has
+    been removed). (fat)
+  . Fixed bug #52725 (gcc builtin atomic functions were sometimes used when they
+    were not available). (fat)
+  . Fixed bug #52693 (configuration file errors are not logged to stderr). (fat)
+  . Fixed bug #52674 (FPM Status page returns inconsistent Content-Type headers).
+    (fat)
+  . Fixed bug #52498 (libevent was not only linked to php-fpm). (fat)
+
+- PDO:
+  . Fixed bug #52699 (PDO bindValue writes long int 32bit enum).
+    (rein at basefarm dot no) 
+  . Fixed bug #52487 (PDO::FETCH_INTO leaks memory). (Felipe)
+  
+- PDO DBLib driver:
+  . Fixed bug #52546 (pdo_dblib segmentation fault when iterating MONEY values).
+    (Felipe)
+    
+- PDO Firebird driver:
+  . Restored firebird support (VC9 builds only). (Pierre)
+  . Fixed bug #53335 (pdo_firebird did not implement rowCount()).
+    (preeves at ibphoenix dot com)
+  . Fixed bug #53323 (pdo_firebird getAttribute() crash).
+    (preeves at ibphoenix dot com)
+    
+- PDO MySQL driver:
+  . Fixed bug #52745 (Binding params doesn't work when selecting a date inside a
+    CASE-WHEN). (Andrey)
+    
+- PostgreSQL extension:
+  . Fixed bug #47199 (pg_delete() fails on NULL). (ewgraf at gmail dot com)
+  
+- Reflection extension:
+  . Fixed ReflectionProperty::isDefault() giving a wrong result for properties
+    obtained with ReflectionClass::getProperties(). (Gustavo)
+- Reflection extension:
+  . Fixed bug #53366 (Reflection doesnt get dynamic property value from
+    getProperty()). (Felipe)
+  . Fixed bug #52854 (ReflectionClass::newInstanceArgs does not work for classes
+    without constructors). (Johannes)
+  
+- SOAP extension:
+  . Fixed bug #44248 (RFC2616 transgression while HTTPS request through proxy
+    with SoapClient object). (Dmitry)
+    
+- SPL extension:
+  . Fixed bug #53362 (Segmentation fault when extending SplFixedArray). (Felipe)
+  . Fixed bug #53279 (SplFileObject doesn't initialise default CSV escape
+    character). (Adam)
+  . Fixed bug #53144 (Segfault in SplObjectStorage::removeAll()). (Felipe)
+  . Fixed bug #53071 (SPLObjectStorage defeats gc_collect_cycles). (Gustavo)
+  . Fixed bug #52573 (SplFileObject::fscanf Segmentation fault). (Felipe)
+  . Fixed bug #51763 (SplFileInfo::getType() does not work symbolic link 
+    and directory). (Pierre)
+  . Fixed bug #50481 (Storing many SPLFixedArray in an array crashes). (Felipe)
+  . Fixed bug #50579 (RegexIterator::REPLACE doesn't work). (Felipe)
+
+- SQLite3 extension:
+  . Fixed bug #53463 (sqlite3 columnName() segfaults on bad column_number).
+    (Felipe)
+    
+- Streams:
+  . Fixed forward stream seeking emulation in streams that don't support seeking
+    in situations where the read operation gives back less data than requested
+    and when there was data in the buffer before the emulation started. Also made
+    more consistent its behavior -- should return failure every time less data
+    than was requested was skipped. (Gustavo)
+  . Fixed bug #53241 (stream casting that relies on fdopen/fopencookie fails
+    with streams opened with, inter alia, the 'xb' mode). (Gustavo)
+  . Fixed bug #53006 (stream_get_contents has an unpredictable behavior when the
+    underlying stream does not support seeking). (Gustavo)
+  . Fixed bug #52944 (Invalid write on second and subsequent reads with an
+    inflate filter fed invalid data). (Gustavo)
+  . Fixed bug #52820 (writes to fopencookie FILE* not commited when seeking the
+    stream). (Gustavo)
+
+- WDDX extension:
+  . Fixed bug #52468 (wddx_deserialize corrupts integer field value when left
+    empty). (Felipe)
+     
+- Zlib extension:
+  . Fixed bug #52926 (zlib fopen wrapper does not use context). (Gustavo)
+
+22 Jul 2010, PHP 5.3.3
+- Upgraded bundled sqlite to version 3.6.23.1. (Ilia)
+- Upgraded bundled PCRE to version 8.02. (Ilia)
+
+- Added support for JSON_NUMERIC_CHECK option in json_encode() that converts 
+  numeric strings to integers. (Ilia)
+- Added stream_set_read_buffer, allows to set the buffer for read operation.
+  (Pierre)
 - Added stream filter support to mcrypt extension (ported from 
   mcrypt_filter). (Stas)
+- Added full_special_chars filter to ext/filter. (Rasmus)
+- Added backlog socket context option for stream_socket_server(). (Mike)
+- Added fifth parameter to openssl_encrypt()/openssl_decrypt()
+  (string $iv) to use non-NULL IV.
+  Made implicit use of NULL IV a warning. (Sara)
+- Added openssl_cipher_iv_length(). (Sara)
+- Added FastCGI Process Manager (FPM) SAPI. (Tony)
+- Added recent Windows versions to php_uname and fix undefined windows 
+  version support. (Pierre)
+- Added Berkeley DB 5 support to the DBA extension. (Johannes, Chris Jones)
+- Added support for copy to/from array/file for pdo_pgsql extension. 
+  (Denis Gasparin, Ilia)
+- Added inTransaction() method to PDO, with specialized support for Postgres.
+  (Ilia, Denis Gasparin)
 
+- Changed namespaced classes so that the ctor can only be named
+  __construct now. (Stas)
+- Reset error state in PDO::beginTransaction() reset error state. (Ilia)
+
+- Implemented FR#51295 (SQLite3::busyTimeout not existing). (Mark)
+- Implemented FR#35638 (Adding udate to imap_fetch_overview results).
+  (Charles_Duffy at dell dot com )
+- Rewrote var_export() to use smart_str rather than output buffering, prevents
+  data disclosure if a fatal error occurs (CVE-2010-2531). (Scott)
+- Fixed possible buffer overflows in mysqlnd_list_fields,  mysqlnd_change_user.
+  (Andrey)
+- Fixed possible buffer overflows when handling error packets in mysqlnd.
+  Reported by Stefan Esser. (Andrey)
+- Fixed very rare memory leak in mysqlnd, when binding thousands of columns.
+  (Andrey)
+- Fixed a crash when calling an inexistent method of a class that inherits 
+  PDOStatement if instantiated directly instead of doing by the PDO methods.
+  (Felipe)
+
+- Fixed memory leak on error in mcrypt_create_iv on Windows. (Pierre)
+- Fixed a possible crash because of recursive GC invocation. (Dmitry)
+- Fixed a possible resource destruction issues in shm_put_var().
+  Reported by Stefan Esser. (Dmitry)
+- Fixed a possible information leak because of interruption of XOR operator.
+  Reported by Stefan Esser. (Dmitry)
+- Fixed a possible memory corruption because of unexpected call-time pass by
+  refernce and following memory clobbering through callbacks.
+  Reported by Stefan Esser. (Dmitry)
+- Fixed a possible memory corruption in ArrayObject::uasort(). Reported by
+  Stefan Esser. (Dmitry)
+- Fixed a possible memory corruption in parse_str(). Reported by Stefan Esser.
+  (Dmitry)
+- Fixed a possible memory corruption in pack(). Reported by Stefan Esser.
+  (Dmitry)
+- Fixed a possible memory corruption in substr_replace(). Reported by Stefan    
+  Esser. (Dmitry)
+- Fixed a possible memory corruption in addcslashes(). Reported by Stefan    
+  Esser. (Dmitry)
+- Fixed a possible stack exhaustion inside fnmatch(). Reported by Stefan    
+  Esser. (Ilia)
+- Fixed a possible dechunking filter buffer overflow. Reported by Stefan Esser.
+  (Pierre)
+- Fixed a possible arbitrary memory access inside sqlite extension. Reported 
+  by Mateusz Kocielski. (Ilia)
+- Fixed string format validation inside phar extension. Reported by Stefan
+  Esser. (Ilia)
+- Fixed handling of session variable serialization on certain prefix
+  characters. Reported by Stefan Esser. (Ilia)
 - Fixed a NULL pointer dereference when processing invalid XML-RPC
   requests (Fixes CVE-2010-0397, bug #51288). (Raphael Geissert)
+- Fixed 64-bit integer overflow in mhash_keygen_s2k(). (Clément LECIGNE, Stas)
+- Fixed SplObjectStorage unserialization problems (CVE-2010-2225). (Stas)
+- Fixed the mail.log ini setting when no filename was given. (Johannes)
 
+- Fixed bug #52317 (Segmentation fault when using mail() on a rhel 4.x (only 64
+  bit)). (Adam)
+- Fixed bug #52262 (json_decode() shows no errors on invalid UTF-8).
+  (Scott)
+- Fixed bug #52240 (hash_copy() does not copy the HMAC key, causes wrong
+  results and PHP crashes). (Felipe)
+- Fixed bug #52238 (Crash when an Exception occured in iterator_to_array).
+  (Johannes)
+- Fixed bug #52193 (converting closure to array yields empty array). (Felipe)
+- Fixed bug #52183 (Reflectionfunction reports invalid number of arguments for
+  function aliases). (Felipe)
+- Fixed bug #52162 (custom request header variables with numbers are removed). 
+  (Sriram Natarajan)
+- Fixed bug #52160 (Invalid E_STRICT redefined constructor error). (Felipe)
+- Fixed bug #52138 (Constants are parsed into the ini file for section names).
+  (Felipe)
+- Fixed bug #52115 (mysqli_result::fetch_all returns null, not an empty array).
+  (Andrey)
+- Fixed bug #52101 (dns_get_record() garbage in 'ipv6' field on Windows).
+  (Pierre)
+- Fixed bug #52082 (character_set_client & character_set_connection reset after
+  mysqli_change_user()). (Andrey)
+- Fixed bug #52043 (GD doesn't recognize latest libJPEG versions).
+  (php at group dot apple dot com, Pierre) 
+- Fixed bug #52041 (Memory leak when writing on uninitialized variable returned
+  from function). (Dmitry)
+- Fixed bug #52060 (Memory leak when passing a closure to method_exists()).
+  (Felipe)
+- Fixed bug #52057 (ReflectionClass fails on Closure class). (Felipe)
+- Fixed bug #52051 (handling of case sensitivity of old-style constructors 
+  changed in 5.3+). (Felipe)
+- Fixed bug #52037 (Concurrent builds fail in install-programs). (seanius at 
+  debian dot org, Kalle)
+- Fixed bug #52019 (make lcov doesn't support TESTS variable anymore). (Patrick)
+- Fixed bug #52010 (open_basedir restrictions mismatch on vacuum command).
+  (Ilia)
+- Fixed bug #52001 (Memory allocation problems after using variable variables).
+  (Dmitry)
+- Fixed bug #51991 (spl_autoload and *nix support with namespace). (Felipe)
+- Fixed bug #51943 (AIX: Several files are out of ANSI spec). (Kalle, 
+  coreystup at gmail dot com)
+- Fixed bug #51911 (ReflectionParameter::getDefaultValue() memory leaks with
+  constant array). (Felipe)
+- Fixed bug #51905 (ReflectionParameter fails if default value is an array
+  with an access to self::). (Felipe)
+- Fixed bug #51899 (Parse error in parse_ini_file() function when empy value
+  followed by no newline). (Felipe)
+- Fixed bug #51844 (checkdnsrr does not support types other than MX). (Pierre)
+- Fixed bug #51827 (Bad warning when register_shutdown_function called with
+  wrong num of parameters). (Felipe)
+- Fixed bug #51822 (Segfault with strange __destruct() for static class
+  variables). (Dmitry)
+- Fixed bug #51791 (constant() aborts execution when fail to check undefined
+  constant). (Felipe)
+- Fixed bug #51732 (Fileinfo __construct or open does not work with NULL).
+  (Pierre)
+- Fixed bug #51725 (xmlrpc_get_type() returns true on invalid dates). (Mike)
+- Fixed bug #51723 (Content-length header is limited to 32bit integer with
+  Apache2 on Windows). (Pierre)
+- Fixed bug #51721 (mark DOMNodeList and DOMNamedNodeMap as Traversable).
+  (David Zuelke)
+- Fixed bug #51712 (Test mysql_mysqlnd_read_timeout_long must fail on MySQL4).
+  (Andrey)
+- Fixed bug #51697 (Unsafe operations in free_storage of SPL iterators,
+  causes crash during shutdown). (Etienne)
+- Fixed bug #51690 (Phar::setStub looks for case-sensitive
+  __HALT_COMPILER()). (Ilia)
+- Fixed bug #51688 (ini per dir crashes when invalid document root  are given).
+  (Pierre)
+- Fixed bug #51671 (imagefill does not work correctly for small images).
+  (Pierre)
+- Fixed bug #51670 (getColumnMeta causes segfault when re-executing query
+  after calling nextRowset). (Pierrick)
+- Fixed bug #51647 Certificate file without private key (pk in another file)
+  doesn't work. (Andrey)
+- Fixed bug #51629 (CURLOPT_FOLLOWLOCATION error message is misleading).
+  (Pierre)
+- Fixed bug #51627 (script path not correctly evaluated).
+  (russell dot tempero at rightnow dot com)
+- Fixed bug #51624 (Crash when calling mysqli_options()). (Felipe)
+- Fixed bug #51615 (PHP crash with wrong HTML in SimpleXML). (Felipe)
+- Fixed bug #51609 (pg_copy_to: Invalid results when using fourth parameter).
+  (Felipe)
+- Fixed bug #51608 (pg_copy_to: WARNING: nonstandard use of \\ in a string
+  literal). (cbandy at jbandy dot com)
+- Fixed bug #51607 (pg_copy_from does not allow schema in the tablename
+  argument). (cbandy at jbandy dot com)
+- Fixed bug #51605 (Mysqli - zombie links). (Andrey)
+- Fixed bug #51604 (newline in end of header is shown in start of message).
+  (Daniel Egeberg)
+- Fixed bug #51590 (JSON_ERROR_UTF8 is undefined). (Felipe)
+- Fixed bug #51583 (Bus error due to wrong alignment in mysqlnd). (Rainer Jung)
+- Fixed bug #51582 (Don't assume UINT64_C it's ever available).
+  (reidrac at usebox dot net, Pierre)
+- Fixed bug #51577 (Uninitialized memory reference with oci_bind_array_by_name)
+  (Oracle Corp.)
+- Fixed bug #51562 (query timeout in mssql can not be changed per query).
+  (ejsmont dot artur at gmail dot com)
+- Fixed bug #51552 (debug_backtrace() causes segmentation fault and/or memory
+  issues). (Dmitry)
+- Fixed bug #51445 (var_dump() invalid/slow *RECURSION* detection). (Felipe)
+- Fixed bug #51435 (Missing ifdefs / logic bug in crypt code cause compile
+  errors). (Felipe)
+- Fixed bug #51424 (crypt() function hangs after 3rd call). (Pierre, Sriram)
+- Fixed bug #51394 (Error line reported incorrectly if error handler throws an 
+  exception). (Stas)
+- Fixed bug #51393 (DateTime::createFromFormat() fails if format string contains
+  timezone). (Adam)
+- Fixed bug #51347 (mysqli_close / connection memory leak). (Andrey, Johannes)
 - Fixed bug #51338 (URL-Rewriter is still enabled if use_only_cookies is
   on). (Ilia, j dot jeising at gmail dot com)
+- Fixed bug #51291 (oci_error doesn't report last error when called two times)
+  (Oracle Corp.)
+- Fixed bug #51276 (php_load_extension() is missing when HAVE_LIBDL is
+  undefined). (Tony)
+- Fixed bug #51273 (Faultstring property does not exist when the faultstring is
+  empty) (Ilia, dennis at transip dot nl)
 - Fixed bug #51269 (zlib.output_compression Overwrites Vary Header). (Adam)
 - Fixed bug #51257 (CURL_VERSION_LARGEFILE incorrectly used after libcurl
   version 7.10.1). (aron dot ujvari at microsec dot hu)
@@ -21,39 +559,95 @@ PHP                                                                        NEWS
   alexr at oplot dot com)
 - Fixed bug #51190 (ftp_put() returns false when transfer was successful).  
   (Ilia)
+- Fixed bug #51183 (ext/date/php_date.c fails to compile with Sun Studio).
+  (Sriram Natarajan)
 - Fixed bug #51176 (Static calling in non-static method behaves like $this->).
   (Felipe)
 - Fixed bug #51171 (curl_setopt() doesn't output any errors or warnings when    
   an invalid option is provided). (Ilia)
+- Fixed bug #51128 (imagefill() doesn't work with large images). (Pierre)
 - Fixed bug #51096 ('last day' and 'first day' are handled incorrectly when
   parsing date strings). (Derick)
 - Fixed bug #51086 (DBA DB4 doesn't work with Berkeley DB 4.8). (Chris Jones)
-- Fixed bug #51062 (DBA DB4 uses mismatched headers and libraries). (Chris Jones)
+- Fixed bug #51062 (DBA DB4 uses mismatched headers and libraries). (Chris
+  Jones)
+- Fixed bug #51026 (mysqli_ssl_set not working). (Andrey)
 - Fixed bug #51023 (filter doesn't detect int overflows with GCC 4.4).
   (Raphael Geissert)
 - Fixed bug #50999 (unaligned memory access in dba_fetch()). (Felipe)
+- Fixed bug #50976 (Soap headers Authorization not allowed).
+  (Brain France, Dmitry)
+- Fixed bug #50828 (DOMNotation is not subclass of DOMNode). (Rob)
 - Fixed bug #50810 (property_exists does not work for private). (Felipe)
+- Fixed bug #50762 (in WSDL mode Soap Header handler function only being called
+  if defined in WSDL). (mephius at gmail dot com)
 - Fixed bug #50731 (Inconsistent namespaces sent to functions registered with
   spl_autoload_register). (Felipe)
-- Fixed bug #50555 (DateTime::sub() allows 'relative' time modifications). (Derick)
+- Fixed bug #50563 (removing E_WARNING from parse_url). (ralph at smashlabs dot 
+  com, Pierre)
+- Fixed bug #50578 (incorrect shebang in phar.phar). (Fedora at FamilleCollet
+  dot com)
 - Fixed bug #50392 (date_create_from_format enforces 6 digits for 'u' format
   character). (Derick)
 - Fixed bug #50383 (Exceptions thrown in __call / __callStatic do not include
   file and line in trace). (Felipe)
 - Fixed bug #50358 (Compile failure compiling ext/phar/util.lo). (Felipe)
+- Fixed bug #50101 (name clash between global and local variable).
+  (patch by yoarvi at gmail dot com)
+- Fixed bug #50055 (DateTime::sub() allows 'relative' time modifications).
+  (Derick)
+- Fixed bug #51002 (fix possible memory corruption with very long names).
+  (Pierre)
+- Fixed bug #49893 (Crash while creating an instance of Zend_Mail_Storage_Pop3).
+  (Dmitry)
+- Fixed bug #49819 (STDOUT losing data with posix_isatty()). (Mike)
 - Fixed bug #49778 (DateInterval::format("%a") is always zero when an interval
   is created from an ISO string). (Derick)
+- Fixed bug #49700 (memory leaks in php_date.c if garbage collector is
+  enabled). (Dmitry)
+- Fixed bug #49576 (FILTER_VALIDATE_EMAIL filter needs updating) (Rasmus)
+- Fixed bug #49490 (XPath namespace prefix conflict). (Rob)
 - Fixed bug #49429 (odbc_autocommit doesn't work). (Felipe)
+- Fixed bug #49320 (PDO returns null when SQLite connection fails). (Felipe)
+- Fixed bug #49234 (mysqli_ssl_set not found). (Andrey)
+- Fixed bug #49216 (Reflection doesn't seem to work properly on MySqli).
+  (Andrey)
+- Fixed bug #49192 (PHP crashes when GC invoked on COM object). (Stas)
+- Fixed bug #49081 (DateTime::diff() mistake if start in January and interval >
+  28 days). (Derick)
 - Fixed bug #49059 (DateTime::diff() repeats previous sub() operation).
   (yoarvi@gmail.com, Derick)
+- Fixed bug #48983 (DomDocument : saveHTMLFile wrong charset). (Rob)
+- Fixed bug #48930 (__COMPILER_HALT_OFFSET__ incorrect in PHP >= 5.3). (Felipe)
 - Fixed bug #48902 (Timezone database fallback map is outdated). (Derick)
+- Fixed bug #48781 (Cyclical garbage collector memory leak). (Dmitry)
+- Fixed bug #48601 (xpath() returns FALSE for legitimate query). (Rob)
+- Fixed bug #48361 (SplFileInfo::getPathInfo should return the
+  parent dir). (Etienne)
+- Fixed bug #48289 (iconv_mime_encode() quoted-printable scheme is broken).
+  (Adam, patch from hiroaki dot kawai at gmail dot com).
+- Fixed bug #47842 (sscanf() does not support 64-bit values). (Mike)
 - Fixed bug #46111 (Some timezone identifiers can not be parsed). (Derick)
+- Fixed bug #45808 (stream_socket_enable_crypto() blocks and eats CPU).
+  (vincent at optilian dot com)
+- Fixed bug #43233 (sasl support for ldap on Windows). (Pierre)
+- Fixed bug #35673 (formatOutput does not work with saveHTML). (Rob)
+- Fixed bug #33210 (getimagesize() fails to detect width/height on certain 
+  JPEGs). (Ilia)
 
+04 Mar 2010, PHP 5.3.2
 
-?? ??? 20??, PHP 5.3.2
 - Upgraded bundled sqlite to version 3.6.22. (Ilia)
 - Upgraded bundled libmagic to version 5.03. (Mikko)
 - Upgraded bundled PCRE to version 8.00. (Scott)
+- Updated timezone database to version 2010.3. (Derick)
+
+- Improved LCG entropy. (Rasmus, Samy Kamkar)
+- Improved crypt support for edge cases (UFC compatibility). (Solar Designer,
+  Joey, Pierre)
+
+- Reverted fix for bug #49521 (PDO fetchObject sets values before calling
+  constructor). (Pierrick, Johannes)
 
 - Changed gmp_strval() to use full range from 2 to 62, and -2 to -36. FR #50283
   (David Soria Parra)
@@ -85,12 +679,8 @@ PHP                                                                        NEWS
   (Linus Nielsen Feltzing <linus@haxx.se>)
 - Added client-side server name indication support in openssl. (Arnaud)
 
-- Improved crypt support for edge cases (UFC compatibility). (Solar Designer,
-  Joey, Pierre)
 - Improved fix for bug #50006 (Segfault caused by uksort()). (Stas)
 
-- Fixed crypt's blowfish sanity check of the "setting" string, to reject iteration
-  counts encoded as 36 through 39. (Solar Designer, Joey, Pierre)
 - Fixed mysqlnd hang when queries exactly 16777214 bytes long are sent. (Andrey)
 - Fixed incorrect decoding of 5-byte BIT sequences in mysqlnd. (Andrey)
 - Fixed error_log() to be binary safe when using message_type 3. (Jani)
@@ -111,6 +701,8 @@ PHP                                                                        NEWS
 - Fixed memory leaks in the ACL function on Windows. (Pierre)
 - Fixed memory leak in the realpath cache on Windows. (Pierre)
 - Fixed memory leak in zip_close. (Pierre)
+- Fixed crypt's blowfish sanity check of the "setting" string, to reject
+  iteration counts encoded as 36 through 39. (Solar Designer, Joey, Pierre)
 
 - Fixed bug #51059 (crypt crashes when invalid salt are given). (Pierre)
 - Fixed bug #50952 (allow underscore _ in constants parsed in php.ini files).
@@ -149,25 +741,6 @@ PHP                                                                        NEWS
 - Fixed bug #50632 (filter_input() does not return default value if the
   variable does not exist). (Ilia)
 - Fixed bug #50576 (XML_OPTION_SKIP_TAGSTART option has no effect). (Pierrick)
-- Fixed bug #50416 (PROCEDURE db.myproc can't return a result set in the given
-  context). (Andrey)
-- Fixed bug #49600 (imageTTFText text shifted right). (Takeshi Abe)
-- Fixed bug #49585 (date_format buffer not long enough for >4 digit years).
-  (Derick, Adam)
-- Fixed bug #49560 (oci8: using LOBs causes slow PHP shutdown). (Oracle Corp.)
-- Fixed bug #49463 (setAttributeNS fails setting default namespace). (Rob)
-- Fixed bug #48811 (Directives in PATH section do not get applied to
-  subdirectories). (Patch by: ct at swin dot edu dot au)
-- Fixed bug #48590 (SoapClient does not honor max_redirects). (Sriram)
-- Fixed bug #48190 (Content-type parameter "boundary" is not case-insensitive
-  in HTTP uploads). (Ilia)
-- Fixed bug #47409 (extract() problem with array containing word "this").
-  (Ilia, chrisstocktonaz at gmail dot com)
-- Fixed bug #47281 ($php_errormsg is limited in size of characters)
-  (Oracle Corp.)
-- Fixed bug #44827 (define() allows :: in constant names). (Ilia)
-- Fixed bug #44098 (imap_utf8() returns only capital letters).
-  (steffen at dislabs dot de, Pierre)
 - Fixed bug #50558 (Broken object model when extending tidy). (Pierrick)
 - Fixed bug #50540 (Crash while running ldap_next_reference test cases).
   (Sriram)
@@ -182,6 +755,8 @@ PHP                                                                        NEWS
 - Fixed bug #50458 (PDO::FETCH_FUNC fails with Closures). (Felipe, Pierrick)
 - Fixed bug #50445 (PDO-ODBC stored procedure call from Solaris 64-bit causes
   seg fault). (davbrown4 at yahoo dot com, Felipe)
+- Fixed bug #50416 (PROCEDURE db.myproc can't return a result set in the given
+  context). (Andrey)
 - Fixed bug #50394 (Reference argument converted to value in __call). (Stas)
 - Fixed bug #50351 (performance regression handling objects, ten times slower
   in 5.3 than in 5.2). (Dmitry)
@@ -262,26 +837,41 @@ PHP                                                                        NEWS
 - Fixed bug #49660 (libxml 2.7.3+ limits text nodes to 10MB). (Felipe)
 - Fixed bug #49647 (DOMUserData does not exist). (Rob)
 - Fixed bug #49600 (imageTTFText text shifted right). (Takeshi Abe)
+- Fixed bug #49585 (date_format buffer not long enough for >4 digit years).
+  (Derick, Adam)
+- Fixed bug #49560 (oci8: using LOBs causes slow PHP shutdown). (Oracle Corp.)
 - Fixed bug #49521 (PDO fetchObject sets values before calling constructor).
   (Pierrick)
 - Fixed bug #49472 (Constants defined in Interfaces can be overridden).
   (Felipe)
+- Fixed bug #49463 (setAttributeNS fails setting default namespace). (Rob)
 - Fixed bug #49244 (Floating point NaN cause garbage characters). (Sjoerd)
 - Fixed bug #49224 (Compile error due to old DNS functions on AIX systems).
   (Scott)
 - Fixed bug #49174 (crash when extending PDOStatement and trying to set
   queryString property). (Felipe)
+- Fixed bug #48811 (Directives in PATH section do not get applied to
+  subdirectories). (Patch by: ct at swin dot edu dot au)
+- Fixed bug #48590 (SoapClient does not honor max_redirects). (Sriram)
+- Fixed bug #48190 (Content-type parameter "boundary" is not case-insensitive
+  in HTTP uploads). (Ilia)
 - Fixed bug #47848 (importNode doesn't preserve attribute namespaces). (Rob)
+- Fixed bug #47409 (extract() problem with array containing word "this").
+  (Ilia, chrisstocktonaz at gmail dot com)
+- Fixed bug #47281 ($php_errormsg is limited in size of characters)
+  (Oracle Corp.)
 - Fixed bug #46478 (htmlentities() uses obsolete mapping table for character
   entity references). (Moriyoshi)
 - Fixed bug #45599 (strip_tags() truncates rest of string with invalid
   attribute). (Ilia, hradtke)
 - Fixed bug #45120 (PDOStatement->execute() returns true then false for same
   statement). (Pierrick)
+- Fixed bug #44827 (define() allows :: in constant names). (Ilia)
+- Fixed bug #44098 (imap_utf8() returns only capital letters).
+  (steffen at dislabs dot de, Pierre)
 - Fixed bug #34852 (Failure in odbc_exec() using oracle-supplied odbc
   driver). (tim dot tassonis at trivadis dot com)
 
-
 19 Nov 2009, PHP 5.3.1
 - Upgraded bundled sqlite to version 3.6.19. (Scott)
 - Updated timezone database to version 2009.17 (2009q). (Derick)

README.QNX

@@ -1,57 +0,0 @@
-QNX4 Installation Notes
------------------------
-
-NOTE: General installation instructions are in the INSTALL file 
-
-
-1. To compile and test PHP3 you have to grab, compile and install:
-	- GNU dbm library or another db library;
-	- GNU bison (1.25 or later; 1.25 tested);
-	- GNU flex (any version supporting -o and -P options; 2.5.4 tested);
-	- GNU diffutils (any version supporting -w option; 2.7 tested);
-
-2. To use CVS version you may need also:
-	- GNU CVS (1.9 tested);
-	- GNU autoconf (2.12 tested);
-	- GNU m4 (1.3 or later preferable; 1.4 tested);
-
-3. To run configure define -lunix in command line:
-	LDFLAGS=-lunix ./configure
-
-4. To use Sybase SQL Anywhere define ODBC_QNX and CUSTOM_ODBC_LIBS in
-	command line and run configure with --with-custom-odbc:
-	CFLAGS=-DODBC_QNX LDFLAGS=-lunix CUSTOM_ODBC_LIBS="-ldblib -lodbc" ./configure --with-custom-odbc=/usr/lib/sqlany50
-   If you have SQL Anywhere version 5.5.00, then you have to add 
-	CFLAGS=-DSQLANY_BUG
-   to workaround its SQLFreeEnv() bug. Other versions has not been tested,
-   so try without this flag first.
-
-5. To build the Apache module, you may have to hardcode an include path for 
-   alloc.h in your Apache base directory:
-	- APACHE_DIRECTORY/src/httpd.h: 
-		change	#include "alloc.h"
-		to 		#include "APACHE_DIRECTORY/src/alloc.h"
-   Unless you want to use system regex library, you have to hardcode also
-   a path to regex.h:
-	- APACHE_DIRECTORY/src/conf.h:  
-		change  #include <regex.h>
-		to		#include "APACHE_DIRECTORY/src/regex/regex.h"
-   I don't know so far why this required for QNX, may be it is Watcom 
-   compiler problem.
-
-  If you building Apache module with SQL Anywhere support, you'll get
-  symbol conflict with BOOL. It is defined in Apache (httpd.h) and in 
-  SQL Anywhere (odbc.h). This has nothing to do with PHP, so you have to 
-  fix it yourself someway.
-
-6. With above precautions, it should compile as is and pass regression
-	tests completely:
-		make
-		make check
-		make install
-
-	Don't bother me unless you really sure you made	that all but it 
-	still doesn't work.
-
-June 28, 1998
-Igor Kovalenko -- owl@infomarket.ru

README.SUBMITTING_PATCH

@@ -1,74 +1,134 @@
-Submitting Patches to PHP
-=========================
+Submitting Enhancements and Patches to PHP
+==========================================
 
-This document describes how to submit a patch for PHP. Creating a
-patch for PHP is easy!
+This document describes how to submit an enhancement or patch for PHP.
+It's easy!
 
 You don't need any login accounts or special access to download,
-build, debug and begin submitting PHP code, tests or documentation for
-inclusion in PHP. Once you've followed this README and had several
-patches accepted, PHP commit privileges are often quickly granted.
+build, debug and begin submitting PHP, PECL or PEAR code, tests or
+documentation.  Once you've followed this README and had several
+patches accepted, commit privileges are often quickly granted.
 
 An excellent article to read first is:
 http://phpadvent.org/2008/less-whining-more-coding-by-elizabeth-smith
 
 
-Prework
--------
-If you are fixing broken functionality then create a bug or identify
-an existing bug at http://bugs.php.net/. This can be used to track
-the patch progress and prevent your changes getting lost in the PHP
-mail archives.
+Online Forums
+-------------
+There are several IRC channels where PHP developers are often
+available to discuss questions.  They include #php.pecl, #php.doc and
+#pear on the EFNet network and #php-dev-win on FreeNode.
 
-If your code change is large, then first discuss it with the extension
-maintainer and/or a development mail list. Extension maintainers can
-be found in the EXTENSIONS file in the PHP source. Use the
-internals@lists.php.net mail list to discuss changes to the base PHP
-code. Use pecl-dev@lists.php.net for changes to code that is only
-available from PECL (http://pecl.php.net/). Use pear-dev@lists.php.net
-for PEAR modules (http://pear.php.net/). Use phpdoc@lists.php.net for
-PHP documentation questions. Mail list subscription is explained on
-http://www.php.net/mailing-lists.php.
 
-If a PHP or PECL patch affects user functionality or makes significant
-internal changes then create a simple Request For Comment (RFC) page
-on http://wiki.php.net/rfc before starting discussion. This RFC can be
-used for initial discussion and later for documentation. Wiki accounts
-can be requested on http://wiki.php.net/start?do=register
+PHP Patches
+-----------
+If you are fixing broken functionality in PHP C source code first
+create a bug or identify an existing bug at http://bugs.php.net/.  A
+bug can be used to track the patch progress and prevent your changes
+getting lost in the PHP mail archives.
 
-Online information on PHP internal C functions is at
-http://www.php.net/internals, though this is considered
-incomplete. Various external resources can be found on the web. A
-standard reference is the book "Extending and Embedding PHP" by Sara
+If your change is large then create a Request For Comment (RFC) page
+on http://wiki.php.net/rfc, discuss it with the extension maintainer,
+and discuss it on the development mail list internals@lists.php.net.
+RFC Wiki accounts can be requested on
+http://wiki.php.net/start?do=register.  PHP extension maintainers can
+be found in the EXTENSIONS file in the PHP source.  Mail list
+subscription is explained on http://www.php.net/mailing-lists.php.
+
+Information on PHP internal C functions is at
+http://www.php.net/internals, though this is considered incomplete.
+Various external resources can be found on the web.  A standard
+printed reference is the book "Extending and Embedding PHP" by Sara
 Golemon.
 
-Information on contributing to PEAR is available at
-http://pear.php.net/manual/en/guide-developers.php
+Attach the patch to the PHP bug and consider sending a notification
+email about the change to internals@lists.php.net.  Also CC the
+extension maintainer.  Explain what has been changed by your patch.
+Test scripts should be included.
+
+Please make the mail subject prefix "[PATCH]".  If attaching a patch,
+ensure it has a file extension of ".txt".  This is because only MIME
+attachments of type 'text/*' are accepted.
+
+
+PHP Documentation Patches
+-------------------------
+If you are fixing incorrect PHP documentation first create a bug or
+identify an existing bug at http://bugs.php.net/.  A bug can be used
+to track the patch progress and prevent your changes getting lost in
+the PHP mail archives.
+
+If your change is large, then first discuss it with the mail list
+phpdoc@lists.php.net.  Subscription is explained on
+http://www.php.net/mailing-lists.php.
 
 Information on contributing to PHP documentation is at
 http://php.net/dochowto and http://wiki.php.net/doc/howto
 
-There are several IRC channels where PHP developers are often
-available to discuss questions. They include #php.pecl and #php.doc
-on the EFNet network and #php-dev-win on FreeNode.
+Attach the patch to the PHP bug and consider sending a notification
+email about the change to phpdoc@lists.php.net.  Explain what has been
+fixed/added/changed by your patch.
+
+Please make the mail subject prefix "[PATCH]".  Include the bug id(s)
+which can be closed by your patch.  If attaching a patch, ensure it
+has a file extension of ".txt".  This is because only MIME attachments
+of type 'text/*' are accepted.
 
 
-How to create your patch
-------------------------
-PHP uses Subversion (SVN) for revision control. Read
+PECL Extension Patches: http://pecl.php.net/
+--------------------------------------------
+If you are fixing broken functionality in a PECL extension then create
+a bug or identify an existing bug at http://pecl.php.net/bugs/.  A bug
+can be used to track the patch progress and prevent your changes
+getting lost in the PHP mail archives.
+
+If your change is large then create a Request For Comment (RFC) page
+on http://wiki.php.net/rfc, discuss it with the extension maintainer,
+and discuss it on the development mail list pecl-dev@lists.php.net.
+PECL mail list subscription is explained on
+http://pecl.php.net/support.php.  RFC Wiki accounts can be requested
+on http://wiki.php.net/start?do=register
+
+Information on PHP internal C functions is at
+http://www.php.net/internals, though this is considered incomplete.
+Various external resources can be found on the web.  A standard
+printed reference is the book "Extending and Embedding PHP" by Sara
+Golemon.
+
+Update any open bugs and add a link to the source of your patch.  Send
+the patch or pointer to the bug to pecl-dev@lists.php.net.  Also CC
+the extension maintainer.  Explain what has been changed by your
+patch.  Test scripts should be included.
+
+Please make the mail subject prefix "[PATCH] ...".  Include the patch
+as an attachment with a file extension of ".txt".  This is because
+only MIME attachments of type 'text/*' are accepted.
+
+
+PEAR Package Patches: http://pear.php.net/
+------------------------------------------
+Information on contributing to PEAR is available at
+http://pear.php.net/manual/en/developers-newmaint.php and
+http://pear.php.net/manual/en/guide-developers.php
+
+
+How to create your PHP, PHP Documentation or PECL patch
+-------------------------------------------------------
+PHP and PECL use Subversion (SVN) for revision control.  Read
 http://www.php.net/svn.php for help on using SVN to get and build PHP
-source code. We recommend using a Sparse Directory checkout described
-in http://wiki.php.net/vcs/svnfaq. If you are new to SVN, read
+source code.  We recommend using a Sparse Directory checkout described
+in http://wiki.php.net/vcs/svnfaq.  If you are new to SVN, read
 http://svnbook.red-bean.com.
 
-Generally we ask that patches work on the current stable PHP
-development branch and on "trunk".
+Generally we ask that bug fix patches work on the current stable PHP
+development branches and on "trunk".  New PHP features only need to
+work on "trunk".
 
 Read CODING_STANDARDS before you start working.
 
 After modifying the source see README.TESTING and
-http://qa.php.net/write-test.php for how to test. Submitting test
-scripts helps us to understand what functionality has changed. It is
+http://qa.php.net/write-test.php for how to test.  Submitting test
+scripts helps us to understand what functionality has changed.  It is
 important for the stability and maintainability of PHP that tests are
 comprehensive.
 
@@ -80,73 +140,43 @@ For ease of review and later troubleshooting, submit individual
 patches for each bug or feature.
 
 
-Checklist for submitting your patch
------------------------------------
+Checklist for submitting your PHP or PECL code patch
+----------------------------------------------------
  - Update SVN source just before running your final 'diff' and
    before testing.
+ - Add in-line comments and/or have external documentation ready.
+   Use only "/* */" style comments, not "//".
+ - Create test scripts for use with "make test".
  - Run "make test" to check your patch doesn't break other features.
  - Rebuild PHP with --enable-debug (which will show some kinds of
    memory errors) and check the PHP and web server error logs after
-   running the PHP tests.
- - Rebuild PHP with --enable-maintainer-zts to check your patch compiles
-   on multi-threaded web servers.
- - Create test scripts for use with "make test".
- - Add in-line comments and/or have external documentation ready.
+   running your PHP tests.
+ - Rebuild PHP with --enable-maintainer-zts to check your patch
+   compiles on multi-threaded web servers.
  - Review the patch once more just before submitting it.
 
 
-Where to send your patch
-------------------------
-If you are patching PHP C source then email the patch to
-internals@lists.php.net
-
-If you patching a PECL extension then send the patch to
-pecl-dev@lists.php.net
-
-If you are patching PEAR then send the patch to
-pear-dev@lists.php.net
-
-If you are patching PHP's documentation then send the patch to
-phpdoc@lists.php.net
-
-The mail can be CC'd to the extension maintainer (see EXTENSIONS).
-
-Please make the subject prefix "[PATCH]", for example "[PATCH] Fix
-return value of all array functions"
-
-Include the patch as an attachment with a file extension of ".txt".
-This is because only MIME attachments of type 'text/*' are accepted.
-
-Explain what has been fixed/added/changed by your patch. Test scripts
-should be included in the email.
-
-Include the bug id(s) which can be closed by your patch.
-
-Finally, update any open bugs and add a link to the source of your
-patch.
-
-
-What happens after you submit your patch
-----------------------------------------
+What happens after submitting your PHP, PHP Documentation or PECL patch
+-----------------------------------------------------------------------
 If your patch is easy to review and obviously has no side-effects,
 it might be committed relatively quickly.
 
 Because PHP is a volunteer-driven effort more complex patches will
-require patience on your side. If you do not receive feedback in a few
-days, consider resubmitting the patch. Before doing this think about
-these questions:
+require patience on your side.  If you do not receive feedback in a
+few days, consider resubmitting the patch.  Before doing this think
+about these questions:
 
+ - Did I send the patch to the right mail list?
  - Did I review the mail list archives to see if these kind of
    changes had been discussed before?
  - Did I explain my patch clearly?
- - Is my patch too hard to review? Because of which factors?
- - Are there any unwanted white space changes?
+ - Is my patch too hard to review? Because of what factors?
 
 
-What happens when your patch is applied
----------------------------------------
-Your name will be included in the SVN commit log. If your patch
-affects end users, a brief description and your name might be added to
-the NEWS file.
+What happens when your PHP or PECL patch is applied
+---------------------------------------------------
+Your name will likely be included in the SVN commit log.  If your
+patch affects end users, a brief description and your name might be
+added to the NEWS file.
 
 Thank you for patching PHP!

TSRM/config.w32

@@ -1,10 +1,5 @@
 // vim:ft=javascript
 // $Id$
 
-if (CHECK_HEADER_ADD_INCLUDE("NewAPIs.h", "CFLAGS_PHP", php_usual_include_suspects)) {
-	// Need to add the flag directly, since TSRM doesn't include the config
-	// header
-	ADD_FLAG("CFLAGS_PHP", "/DHAVE_NEWAPIS_H=1");
-}
 ADD_SOURCES("TSRM", "TSRM.c tsrm_strtok_r.c tsrm_virtual_cwd.c tsrm_win32.c");
 

TSRM/tsrm_virtual_cwd.c

@@ -14,6 +14,7 @@
    +----------------------------------------------------------------------+
    | Authors: Andi Gutmans <andi@zend.com>                                |
    |          Sascha Schumann <sascha@schumann.cx>                        |
+   |          Pierre Joye <pierre@php.net>                                |
    +----------------------------------------------------------------------+
 */
 
@@ -38,6 +39,18 @@
 # ifndef IO_REPARSE_TAG_SYMLINK
 #  define IO_REPARSE_TAG_SYMLINK 0xA000000C
 # endif
+
+# ifndef VOLUME_NAME_NT
+#  define VOLUME_NAME_NT 0x2
+# endif
+
+# ifndef VOLUME_NAME_DOS
+#  define VOLUME_NAME_DOS 0x0
+# endif
+#endif
+
+#ifndef S_IFLNK
+# define S_IFLNK 0120000
 #endif
 
 #ifdef NETWARE
@@ -83,14 +96,14 @@ cwd_state main_cwd_state; /* True global */
 #include <tchar.h>
 #define tsrm_strtok_r(a,b,c) _tcstok((a),(b))
 #define TOKENIZER_STRING "/\\"
-	
-static int php_check_dots(const char *element, int n) 
+
+static int php_check_dots(const char *element, int n)
 {
 	while (n-- > 0) if (element[n] != '.') break;
 
 	return (n != -1);
 }
-	
+
 #define IS_DIRECTORY_UP(element, len) \
 	(len >= 2 && !php_check_dots(element, len))
 
@@ -124,7 +137,7 @@ static int php_check_dots(const char *element, int n)
 
 /* define this to check semantics */
 #define IS_DIR_OK(s) (1)
-	
+
 #ifndef IS_DIR_OK
 #define IS_DIR_OK(state) (php_is_dir_ok(state) == 0)
 #endif
@@ -137,7 +150,7 @@ static int php_check_dots(const char *element, int n)
 
 #define CWD_STATE_FREE(s)			\
 	free((s)->cwd);
-	
+
 #ifdef TSRM_WIN32
 
 #ifdef CTL_CODE
@@ -202,21 +215,98 @@ static inline time_t FileTimeToUnixTime(const FILETIME FileTime)
 	return (time_t)UnixTime;
 }
 
+CWD_API int php_sys_readlink(const char *link, char *target, size_t target_len){ /* {{{ */
+	HINSTANCE kernel32;
+	HANDLE hFile;
+	DWORD dwRet;
+
+	typedef BOOL (WINAPI *gfpnh_func)(HANDLE, LPTSTR, DWORD, DWORD);
+	gfpnh_func pGetFinalPathNameByHandle;
+
+	kernel32 = LoadLibrary("kernel32.dll");
+
+	if (kernel32) {
+		pGetFinalPathNameByHandle = (gfpnh_func)GetProcAddress(kernel32, "GetFinalPathNameByHandleA");
+		if (pGetFinalPathNameByHandle == NULL) {
+			return -1;
+		}
+	} else {
+		return -1;
+	}
+
+	hFile = CreateFile(link,            // file to open
+				 GENERIC_READ,          // open for reading
+				 FILE_SHARE_READ,       // share for reading
+				 NULL,                  // default security
+				 OPEN_EXISTING,         // existing file only
+				 FILE_FLAG_BACKUP_SEMANTICS, // normal file
+				 NULL);                 // no attr. template
+
+	if( hFile == INVALID_HANDLE_VALUE) {
+			return -1;
+	}
+
+	dwRet = pGetFinalPathNameByHandle(hFile, target, MAXPATHLEN, VOLUME_NAME_DOS);
+	if(dwRet >= MAXPATHLEN) {
+		return -1;
+	}
+
+	CloseHandle(hFile);
+
+	if(dwRet > 4) {
+		/* Skip first 4 characters if they are "\??\" */
+		if(target[0] == '\\' && target[1] == '\\' && target[2] == '?' && target[3] ==  '\\') {
+			char tmp[MAXPATHLEN];
+			unsigned int offset = 4;
+			dwRet -= 4;
+
+			/* \??\UNC\ */
+			if (dwRet > 7 && target[4] == 'U' && target[5] == 'N' && target[6] == 'C') {
+				offset += 2;
+				dwRet -= 2;
+				target[offset] = '\\';
+			}
+
+			memcpy(tmp, target + offset, dwRet);
+			memcpy(target, tmp, dwRet);
+		}
+	}
+
+	target[dwRet] = '\0';
+	return dwRet;
+}
+/* }}} */
+
 CWD_API int php_sys_stat(const char *path, struct stat *buf) /* {{{ */
+{
+	return php_sys_stat_ex(path, buf, 0);
+}
+/* }}} */
+
+CWD_API int php_sys_lstat(const char *path, struct stat *buf) /* {{{ */
+{
+	return php_sys_stat_ex(path, buf, 1);
+}
+/* }}} */
+
+CWD_API int php_sys_stat_ex(const char *path, struct stat *buf, int lstat) /* {{{ */
 {
 	WIN32_FILE_ATTRIBUTE_DATA data;
 	__int64 t;
+	const size_t path_len = strlen(path);
 
 	if (!GetFileAttributesEx(path, GetFileExInfoStandard, &data)) {
 		return stat(path, buf);
 	}
 
-	if (path[1] == ':') {
+	if (path_len >= 1 && path[1] == ':') {
 		if (path[0] >= 'A' && path[0] <= 'Z') {
 			buf->st_dev = buf->st_rdev = path[0] - 'A';
 		} else {
 			buf->st_dev = buf->st_rdev = path[0] - 'a';
 		}
+	} else if (IS_UNC_PATH(path, path_len)) {
+		buf->st_dev = buf->st_rdev = 0;
 	} else {
 		char  cur_path[MAXPATHLEN+1];
 		DWORD len = sizeof(cur_path);
@@ -245,19 +335,56 @@ CWD_API int php_sys_stat(const char *path, struct stat *buf) /* {{{ */
 		}
 		if (tmp != cur_path) {
 			free(tmp);
-		}		    	
+		}
 	}
+
 	buf->st_uid = buf->st_gid = buf->st_ino = 0;
-	buf->st_mode = (data.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) ? (S_IFDIR|S_IEXEC|(S_IEXEC>>3)|(S_IEXEC>>6)) : S_IFREG;
-	buf->st_mode |= (data.dwFileAttributes & FILE_ATTRIBUTE_READONLY) ? (S_IREAD|(S_IREAD>>3)|(S_IREAD>>6)) : (S_IREAD|(S_IREAD>>3)|(S_IREAD>>6)|S_IWRITE|(S_IWRITE>>3)|(S_IWRITE>>6));
+
+	if (lstat && data.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT) {
+		/* File is a reparse point. Get the target */
+		HANDLE hLink = NULL;
+		REPARSE_DATA_BUFFER * pbuffer;
+		unsigned int retlength = 0;
+		TSRM_ALLOCA_FLAG(use_heap_large);
+
+		hLink = CreateFile(path, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_FLAG_OPEN_REPARSE_POINT|FILE_FLAG_BACKUP_SEMANTICS, NULL);
+		if(hLink == INVALID_HANDLE_VALUE) {
+			return -1;
+		}
+
+		pbuffer = (REPARSE_DATA_BUFFER *)tsrm_do_alloca(MAXIMUM_REPARSE_DATA_BUFFER_SIZE, use_heap_large);
+		if(!DeviceIoControl(hLink, FSCTL_GET_REPARSE_POINT, NULL, 0, pbuffer,  MAXIMUM_REPARSE_DATA_BUFFER_SIZE, &retlength, NULL)) {
+			tsrm_free_alloca(pbuffer, use_heap_large);
+			CloseHandle(hLink);
+			return -1;
+		}
+
+		CloseHandle(hLink);
+
+		if(pbuffer->ReparseTag == IO_REPARSE_TAG_SYMLINK) {
+			buf->st_mode = S_IFLNK;
+			buf->st_mode |= (data.dwFileAttributes & FILE_ATTRIBUTE_READONLY) ? (S_IREAD|(S_IREAD>>3)|(S_IREAD>>6)) : (S_IREAD|(S_IREAD>>3)|(S_IREAD>>6)|S_IWRITE|(S_IWRITE>>3)|(S_IWRITE>>6));
+		}
+
+#if 0 /* Not used yet */
+		else if(pbuffer->ReparseTag == IO_REPARSE_TAG_MOUNT_POINT) {
+			buf->st_mode |=;
+		}
+#endif
+		tsrm_free_alloca(pbuffer, use_heap_large);
+	} else {
+		buf->st_mode = (data.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) ? (S_IFDIR|S_IEXEC|(S_IEXEC>>3)|(S_IEXEC>>6)) : S_IFREG;
+		buf->st_mode |= (data.dwFileAttributes & FILE_ATTRIBUTE_READONLY) ? (S_IREAD|(S_IREAD>>3)|(S_IREAD>>6)) : (S_IREAD|(S_IREAD>>3)|(S_IREAD>>6)|S_IWRITE|(S_IWRITE>>3)|(S_IWRITE>>6));
+	}
+
 	if ((data.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) == 0) {
 		int len = strlen(path);
 
 		if (path[len-4] == '.') {
 			if (_memicmp(path+len-3, "exe", 3) == 0 ||
-			    _memicmp(path+len-3, "com", 3) == 0 ||
-			    _memicmp(path+len-3, "bat", 3) == 0 ||
-			    _memicmp(path+len-3, "cmd", 3) == 0) {
+				_memicmp(path+len-3, "com", 3) == 0 ||
+				_memicmp(path+len-3, "bat", 3) == 0 ||
+				_memicmp(path+len-3, "cmd", 3) == 0) {
 				buf->st_mode  |= (S_IEXEC|(S_IEXEC>>3)|(S_IEXEC>>6));
 			}
 		}
@@ -298,19 +425,19 @@ static int php_is_file_ok(const cwd_state *state)  /* {{{ */
 }
 /* }}} */
 
-static void cwd_globals_ctor(virtual_cwd_globals *cwd_globals TSRMLS_DC) /* {{{ */
+static void cwd_globals_ctor(virtual_cwd_globals *cwd_g TSRMLS_DC) /* {{{ */
 {
-	CWD_STATE_COPY(&cwd_globals->cwd, &main_cwd_state);
-	cwd_globals->realpath_cache_size = 0;
-	cwd_globals->realpath_cache_size_limit = REALPATH_CACHE_SIZE;
-	cwd_globals->realpath_cache_ttl = REALPATH_CACHE_TTL;
-	memset(cwd_globals->realpath_cache, 0, sizeof(cwd_globals->realpath_cache));
+	CWD_STATE_COPY(&cwd_g->cwd, &main_cwd_state);
+	cwd_g->realpath_cache_size = 0;
+	cwd_g->realpath_cache_size_limit = REALPATH_CACHE_SIZE;
+	cwd_g->realpath_cache_ttl = REALPATH_CACHE_TTL;
+	memset(cwd_g->realpath_cache, 0, sizeof(cwd_g->realpath_cache));
 }
 /* }}} */
 
-static void cwd_globals_dtor(virtual_cwd_globals *cwd_globals TSRMLS_DC) /* {{{ */
+static void cwd_globals_dtor(virtual_cwd_globals *cwd_g TSRMLS_DC) /* {{{ */
 {
-	CWD_STATE_FREE(&cwd_globals->cwd);
+	CWD_STATE_FREE(&cwd_g->cwd);
 	realpath_cache_clean(TSRMLS_C);
 }
 /* }}} */
@@ -332,7 +459,7 @@ CWD_API void virtual_cwd_startup(void) /* {{{ */
 		}
 	}
 #else
-	result = getcwd(cwd, sizeof(cwd));	
+	result = getcwd(cwd, sizeof(cwd));
 #endif
 	if (!result) {
 		cwd[0] = '\0';
@@ -383,7 +510,7 @@ CWD_API char *virtual_getcwd_ex(size_t *length TSRMLS_DC) /* {{{ */
 		*length = 1;
 		retval = (char *) malloc(2);
 		retval[0] = DEFAULT_SLASH;
-		retval[1] = '\0';	
+		retval[1] = '\0';
 		return retval;
 	}
 
@@ -493,7 +620,7 @@ CWD_API void realpath_cache_del(const char *path, int path_len TSRMLS_DC) /* {{{
 
 	while (*bucket != NULL) {
 		if (key == (*bucket)->key && path_len == (*bucket)->path_len &&
-		           memcmp(path, (*bucket)->path, path_len) == 0) {
+					memcmp(path, (*bucket)->path, path_len) == 0) {
 			realpath_cache_bucket *r = *bucket;
 			*bucket = (*bucket)->next;
 			CWDG(realpath_cache_size) -= sizeof(realpath_cache_bucket) + r->path_len + 1 + r->realpath_len + 1;
@@ -510,9 +637,9 @@ static inline void realpath_cache_add(const char *path, int path_len, const char
 {
 	long size = sizeof(realpath_cache_bucket) + path_len + 1;
 	int same = 1;
-	
+
 	if (realpath_len != path_len ||
-	    memcmp(path, realpath, path_len) != 0) {
+		memcmp(path, realpath, path_len) != 0) {
 		size += realpath_len + 1;
 		same = 0;
 	}
@@ -570,7 +697,7 @@ static inline realpath_cache_bucket* realpath_cache_find(const char *path, int p
 			CWDG(realpath_cache_size) -= sizeof(realpath_cache_bucket) + r->path_len + 1 + r->realpath_len + 1;
 			free(r);
 		} else if (key == (*bucket)->key && path_len == (*bucket)->path_len &&
-		           memcmp(path, (*bucket)->path, path_len) == 0) {
+					memcmp(path, (*bucket)->path, path_len) == 0) {
 			return *bucket;
 		} else {
 			bucket = &(*bucket)->next;
@@ -582,21 +709,21 @@ static inline realpath_cache_bucket* realpath_cache_find(const char *path, int p
 
 CWD_API realpath_cache_bucket* realpath_cache_lookup(const char *path, int path_len, time_t t TSRMLS_DC) /* {{{ */
 {
-    return realpath_cache_find(path, path_len, t TSRMLS_CC);
+	return realpath_cache_find(path, path_len, t TSRMLS_CC);
 }
 /* }}} */
 
-CWD_API int realpath_cache_size(TSRMLS_D) 
+CWD_API int realpath_cache_size(TSRMLS_D)
 {
 	return CWDG(realpath_cache_size);
 }
 
-CWD_API int realpath_cache_max_buckets(TSRMLS_D) 
+CWD_API int realpath_cache_max_buckets(TSRMLS_D)
 {
 	return (sizeof(CWDG(realpath_cache)) / sizeof(CWDG(realpath_cache)[0]));
 }
 
-CWD_API realpath_cache_bucket** realpath_cache_get_buckets(TSRMLS_D) 
+CWD_API realpath_cache_bucket** realpath_cache_get_buckets(TSRMLS_D)
 {
 	return CWDG(realpath_cache);
 }
@@ -650,14 +777,14 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 				if (!start) {
 					/* leading '..' must not be removed in case of relative path */
 					if (j == 0 && path[0] == '.' && path[1] == '.' &&
-					    IS_SLASH(path[2])) {
+							IS_SLASH(path[2])) {
 						path[3] = '.';
 						path[4] = '.';
 						path[5] = DEFAULT_SLASH;
 						j = 5;
-					} else if (j > 0 && 
-				               path[j+1] == '.' && path[j+2] == '.' &&
-				               IS_SLASH(path[j+3])) {
+					} else if (j > 0 &&
+							path[j+1] == '.' && path[j+2] == '.' &&
+							IS_SLASH(path[j+3])) {
 						j += 4;
 						path[j++] = '.';
 						path[j++] = '.';
@@ -673,7 +800,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 			}
 			return j;
 		}
-	
+
 		path[len] = 0;
 
 		save = (use_realpath != CWD_EXPAND);
@@ -683,18 +810,18 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 			if (!*t) {
 				*t = time(0);
 			}
-		    if ((bucket = realpath_cache_find(path, len, *t TSRMLS_CC)) != NULL) {
-		    	if (is_dir && !bucket->is_dir) {
+			if ((bucket = realpath_cache_find(path, len, *t TSRMLS_CC)) != NULL) {
+				if (is_dir && !bucket->is_dir) {
 					/* not a directory */
 					return -1;
-		    	} else {
-		    		if (link_is_dir) {
-		    			*link_is_dir = bucket->is_dir;
-		    		}
+				} else {
+					if (link_is_dir) {
+						*link_is_dir = bucket->is_dir;
+					}
 					memcpy(path, bucket->realpath, bucket->realpath_len + 1);
-				    return bucket->realpath_len;
+					return bucket->realpath_len;
 				}
-	    	}
+			}
 		}
 
 #ifdef TSRM_WIN32
@@ -706,7 +833,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 			/* continue resolution anyway but don't save result in the cache */
 			save = 0;
 		}
-		
+
 		if (save) {
 			FindClose(hFind);
 		}
@@ -714,9 +841,9 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 		tmp = tsrm_do_alloca(len+1, use_heap);
 		memcpy(tmp, path, len+1);
 
-		if(save && 
-		!(IS_UNC_PATH(path, len) && len >= 3 && path[2] != '?') &&
-		(data.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT)) {
+		if(save &&
+				!(IS_UNC_PATH(path, len) && len >= 3 && path[2] != '?') &&
+				(data.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT)) {
 			/* File is a reparse point. Get the target */
 			HANDLE hLink = NULL;
 			REPARSE_DATA_BUFFER * pbuffer;
@@ -751,7 +878,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 				reparsetarget = pbuffer->SymbolicLinkReparseBuffer.ReparseTarget;
 				printname_len = pbuffer->MountPointReparseBuffer.PrintNameLength / sizeof(WCHAR);
 				isabsolute = (pbuffer->SymbolicLinkReparseBuffer.Flags == 0) ? 1 : 0;
-				if (!WideCharToMultiByte(CP_THREAD_ACP, 0, 
+				if (!WideCharToMultiByte(CP_THREAD_ACP, 0,
 					reparsetarget + pbuffer->MountPointReparseBuffer.PrintNameOffset  / sizeof(WCHAR),
 					printname_len + 1,
 					printname, MAX_PATH, NULL, NULL
@@ -763,7 +890,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 				printname[printname_len] = 0;
 
 				substitutename_len = pbuffer->MountPointReparseBuffer.SubstituteNameLength / sizeof(WCHAR);
-				if (!WideCharToMultiByte(CP_THREAD_ACP, 0, 
+				if (!WideCharToMultiByte(CP_THREAD_ACP, 0,
 					reparsetarget + pbuffer->MountPointReparseBuffer.SubstituteNameOffset / sizeof(WCHAR),
 					substitutename_len + 1,
 					substitutename, MAX_PATH, NULL, NULL
@@ -777,7 +904,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 				isabsolute = 1;
 				reparsetarget = pbuffer->MountPointReparseBuffer.ReparseTarget;
 				printname_len = pbuffer->MountPointReparseBuffer.PrintNameLength / sizeof(WCHAR);
-				if (!WideCharToMultiByte(CP_THREAD_ACP, 0, 
+				if (!WideCharToMultiByte(CP_THREAD_ACP, 0,
 					reparsetarget + pbuffer->MountPointReparseBuffer.PrintNameOffset  / sizeof(WCHAR),
 					printname_len + 1,
 					printname, MAX_PATH, NULL, NULL
@@ -788,7 +915,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 				printname[pbuffer->MountPointReparseBuffer.PrintNameLength / sizeof(WCHAR)] = 0;
 
 				substitutename_len = pbuffer->MountPointReparseBuffer.SubstituteNameLength / sizeof(WCHAR);
-				if (!WideCharToMultiByte(CP_THREAD_ACP, 0, 
+				if (!WideCharToMultiByte(CP_THREAD_ACP, 0,
 					reparsetarget + pbuffer->MountPointReparseBuffer.SubstituteNameOffset / sizeof(WCHAR),
 					substitutename_len + 1,
 					substitutename, MAX_PATH, NULL, NULL
@@ -803,20 +930,22 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 			}
 
 			if(isabsolute && substitutename_len > 4) {
-				/* Do not resolve volumes (for now). A mounted point can 
+				/* Do not resolve volumes (for now). A mounted point can
 				   target a volume without a drive, it is not certain that
-				   all IO functions we use in php and its deps support 
+				   all IO functions we use in php and its deps support
 				   path with volume GUID instead of the DOS way, like:
 				   d:\test\mnt\foo
 				   \\?\Volume{62d1c3f8-83b9-11de-b108-806e6f6e6963}\foo
 				*/
-				if (strncmp(substitutename, "\\??\\Volume{",11) == 0 
-					|| strncmp(substitutename, "\\\\?\\Volume{",11) == 0) {
-					isVolume = TRUE;					
+				if (strncmp(substitutename, "\\??\\Volume{",11) == 0
+					|| strncmp(substitutename, "\\\\?\\Volume{",11) == 0
+					|| strncmp(substitutename, "\\??\\UNC\\", 8) == 0
+					) {
+					isVolume = TRUE;
 					substitutename_off = 0;
 				} else
 					/* do not use the \??\ and \\?\ prefix*/
-					if (strncmp(substitutename, "\\??\\", 4) == 0 
+					if (strncmp(substitutename, "\\??\\", 4) == 0
 						|| strncmp(substitutename, "\\\\?\\", 4) == 0) {
 					substitutename_off = 4;
 				}
@@ -887,7 +1016,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 		tmp = tsrm_do_alloca(len+1, use_heap);
 		memcpy(tmp, path, len+1);
 #else
-		if (save && lstat(path, &st) < 0) {
+		if (save && php_sys_lstat(path, &st) < 0) {
 			if (use_realpath == CWD_REALPATH) {
 				/* file not found */
 				return -1;
@@ -900,8 +1029,8 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 		memcpy(tmp, path, len+1);
 
 		if (save && S_ISLNK(st.st_mode)) {
-			if (++(*ll) > LINK_MAX || (j = readlink(tmp, path, MAXPATHLEN)) < 0) {
-			    /* too many links or broken symlinks */
+			if (++(*ll) > LINK_MAX || (j = php_sys_readlink(tmp, path, MAXPATHLEN)) < 0) {
+				/* too many links or broken symlinks */
 				tsrm_free_alloca(tmp, use_heap);
 				return -1;
 			}
@@ -913,10 +1042,10 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 					return -1;
 				}
 			} else {
-			    if (i + j >= MAXPATHLEN-1) {
+				if (i + j >= MAXPATHLEN-1) {
 					tsrm_free_alloca(tmp, use_heap);
 					return -1; /* buffer overflow */
-			    }
+				}
 				memmove(path+i, path, j+1);
 				memcpy(path, tmp, i-1);
 				path[i-1] = DEFAULT_SLASH;
@@ -1038,18 +1167,18 @@ CWD_API int virtual_file_ex(cwd_state *state, const char *path, verify_path_func
 					state_cwd_length = 2;
 					while (IS_SLASH(state->cwd[state_cwd_length])) {
 						state_cwd_length++;
-					}						 
+					}
 					while (state->cwd[state_cwd_length] &&
-					       !IS_SLASH(state->cwd[state_cwd_length])) {
+							!IS_SLASH(state->cwd[state_cwd_length])) {
 						state_cwd_length++;
-					}						 
+					}
 					while (IS_SLASH(state->cwd[state_cwd_length])) {
 						state_cwd_length++;
-					}						 
+					}
 					while (state->cwd[state_cwd_length] &&
-					       !IS_SLASH(state->cwd[state_cwd_length])) {
+							!IS_SLASH(state->cwd[state_cwd_length])) {
 						state_cwd_length++;
-					}						 
+					}
 				}
 			}
 #endif
@@ -1061,7 +1190,7 @@ CWD_API int virtual_file_ex(cwd_state *state, const char *path, verify_path_func
 			memcpy(resolved_path + state_cwd_length + 1, path, path_length + 1);
 			path_length += state_cwd_length + 1;
 		}
-	} else {		
+	} else {
 #ifdef TSRM_WIN32
 		if (path_length > 2 && path[1] == ':' && !IS_SLASH(path[2])) {
 			resolved_path[0] = path[0];
@@ -1072,11 +1201,11 @@ CWD_API int virtual_file_ex(cwd_state *state, const char *path, verify_path_func
 		} else
 #endif
 		memcpy(resolved_path, path, path_length + 1);
-	} 
+	}
 
 #ifdef TSRM_WIN32
 	if (memchr(resolved_path, '*', path_length) ||
-	    memchr(resolved_path, '?', path_length)) {
+		memchr(resolved_path, '?', path_length)) {
 		return 1;
 	}
 #endif
@@ -1126,12 +1255,12 @@ CWD_API int virtual_file_ex(cwd_state *state, const char *path, verify_path_func
 	add_slash = (use_realpath != CWD_REALPATH) && path_length > 0 && IS_SLASH(resolved_path[path_length-1]);
 	t = CWDG(realpath_cache_ttl) ? 0 : -1;
 	path_length = tsrm_realpath_r(resolved_path, start, path_length, &ll, &t, use_realpath, 0, NULL TSRMLS_CC);
-	
+
 	if (path_length < 0) {
 		errno = ENOENT;
 		return 1;
 	}
-	
+
 	if (!start && !path_length) {
 		resolved_path[path_length++] = '.';
 	}
@@ -1184,7 +1313,7 @@ verify:
 		memcpy(state->cwd, resolved_path, state->cwd_length+1);
 		ret = 0;
 	}
-	
+
 #if VIRTUAL_CWD_DEBUG
 	fprintf (stderr, "virtual_file_ex() = %s\n",state->cwd);
 #endif
@@ -1207,7 +1336,7 @@ CWD_API int virtual_chdir_file(const char *path, int (*p_chdir)(const char *path
 
 	if (length == 0) {
 		return 1; /* Can't cd to empty string */
-	}	
+	}
 	while(--length >= 0 && !IS_SLASH(path[length])) {
 	}
 
@@ -1242,16 +1371,16 @@ CWD_API char *virtual_realpath(const char *path, char *real_path TSRMLS_DC) /* {
 	if (!*path) {
 		new_state.cwd = (char*)malloc(1);
 		new_state.cwd[0] = '\0';
-		new_state.cwd_length = 0;		
-	    if (VCWD_GETCWD(cwd, MAXPATHLEN)) {
-		    path = cwd;
+		new_state.cwd_length = 0;
+		if (VCWD_GETCWD(cwd, MAXPATHLEN)) {
+			path = cwd;
 		}
 	} else if (!IS_ABSOLUTE_PATH(path, strlen(path))) {
 		CWD_STATE_COPY(&new_state, &CWDG(cwd));
 	} else {
 		new_state.cwd = (char*)malloc(1);
 		new_state.cwd[0] = '\0';
-		new_state.cwd_length = 0;		
+		new_state.cwd_length = 0;
 	}
 
 	if (virtual_file_ex(&new_state, path, NULL, CWD_REALPATH)==0) {
@@ -1317,7 +1446,7 @@ CWD_API int virtual_access(const char *pathname, int mode TSRMLS_DC) /* {{{ */
 {
 	cwd_state new_state;
 	int ret;
-	
+
 	CWD_STATE_COPY(&new_state, &CWDG(cwd));
 	if (virtual_file_ex(&new_state, pathname, NULL, CWD_REALPATH)) {
 		CWD_STATE_FREE(&new_state);
@@ -1329,9 +1458,9 @@ CWD_API int virtual_access(const char *pathname, int mode TSRMLS_DC) /* {{{ */
 #else
 	ret = access(new_state.cwd, mode);
 #endif
-	
+
 	CWD_STATE_FREE(&new_state);
-	
+
 	return ret;
 }
 /* }}} */
@@ -1352,12 +1481,12 @@ static void UnixTimeToFileTime(time_t t, LPFILETIME pft) /* {{{ */
 TSRM_API int win32_utime(const char *filename, struct utimbuf *buf) /* {{{ */
 {
 	FILETIME mtime, atime;
-	HANDLE hFile; 
+	HANDLE hFile;
 
 	hFile = CreateFile(filename, GENERIC_WRITE, FILE_SHARE_WRITE|FILE_SHARE_READ, NULL,
 				 OPEN_ALWAYS, FILE_FLAG_BACKUP_SEMANTICS, NULL);
 
-	/* OPEN_ALWAYS mode sets the last error to ERROR_ALREADY_EXISTS but 
+	/* OPEN_ALWAYS mode sets the last error to ERROR_ALREADY_EXISTS but
 	   the CreateFile operation succeeds */
 	if (GetLastError() == ERROR_ALREADY_EXISTS) {
 		SetLastError(0);
@@ -1477,7 +1606,7 @@ CWD_API int virtual_open(const char *path TSRMLS_DC, int flags, ...) /* {{{ */
 		f = open(new_state.cwd, flags, mode);
 	} else {
 		f = open(new_state.cwd, flags);
-	}	
+	}
 	CWD_STATE_FREE(&new_state);
 	return f;
 }
@@ -1556,7 +1685,6 @@ CWD_API int virtual_stat(const char *path, struct stat *buf TSRMLS_DC) /* {{{ */
 }
 /* }}} */
 
-#if !defined(TSRM_WIN32)
 CWD_API int virtual_lstat(const char *path, struct stat *buf TSRMLS_DC) /* {{{ */
 {
 	cwd_state new_state;
@@ -1568,13 +1696,12 @@ CWD_API int virtual_lstat(const char *path, struct stat *buf TSRMLS_DC) /* {{{ *
 		return -1;
 	}
 
-	retval = lstat(new_state.cwd, buf);
+	retval = php_sys_lstat(new_state.cwd, buf);
 
 	CWD_STATE_FREE(&new_state);
 	return retval;
 }
 /* }}} */
-#endif
 
 CWD_API int virtual_unlink(const char *path TSRMLS_DC) /* {{{ */
 {
@@ -1738,7 +1865,7 @@ CWD_API FILE *virtual_popen(const char *command, const char *type TSRMLS_DC) /*
 		}
 		*ptr++ = '\'';
 	}
-	
+
 	*ptr++ = ' ';
 	*ptr++ = ';';
 	*ptr++ = ' ';
@@ -1761,18 +1888,18 @@ CWD_API char *tsrm_realpath(const char *path, char *real_path TSRMLS_DC) /* {{{
 	if (!*path) {
 		new_state.cwd = (char*)malloc(1);
 		new_state.cwd[0] = '\0';
-		new_state.cwd_length = 0;		
-	    if (VCWD_GETCWD(cwd, MAXPATHLEN)) {
-		    path = cwd;
+		new_state.cwd_length = 0;
+		if (VCWD_GETCWD(cwd, MAXPATHLEN)) {
+			path = cwd;
 		}
 	} else if (!IS_ABSOLUTE_PATH(path, strlen(path)) &&
-	    VCWD_GETCWD(cwd, MAXPATHLEN)) {
+					VCWD_GETCWD(cwd, MAXPATHLEN)) {
 		new_state.cwd = strdup(cwd);
 		new_state.cwd_length = strlen(cwd);
 	} else {
 		new_state.cwd = (char*)malloc(1);
 		new_state.cwd[0] = '\0';
-		new_state.cwd_length = 0;		
+		new_state.cwd_length = 0;
 	}
 
 	if (virtual_file_ex(&new_state, path, NULL, CWD_REALPATH)) {

TSRM/tsrm_virtual_cwd.h

@@ -14,6 +14,7 @@
    +----------------------------------------------------------------------+
    | Authors: Andi Gutmans <andi@zend.com>                                |
    |          Sascha Schumann <sascha@schumann.cx>                        |
+   |          Pierre Joye <pierre@php.net>                                |
    +----------------------------------------------------------------------+
 */
 
@@ -107,7 +108,7 @@ typedef unsigned short mode_t;
 #define COPY_WHEN_ABSOLUTE(path) 0
 #endif
 
-#ifndef IS_ABSOLUTE_PATH	
+#ifndef IS_ABSOLUTE_PATH
 #define IS_ABSOLUTE_PATH(path, len) \
 	(IS_SLASH(path[0]))
 #endif
@@ -129,9 +130,16 @@ typedef unsigned short mode_t;
 #endif
 
 #ifdef TSRM_WIN32
+CWD_API int php_sys_stat_ex(const char *path, struct stat *buf, int lstat);
 CWD_API int php_sys_stat(const char *path, struct stat *buf);
+CWD_API int php_sys_lstat(const char *path, struct stat *buf);
+CWD_API int php_sys_readlink(const char *link, char *target, size_t target_len);
 #else
 # define php_sys_stat stat
+# define php_sys_lstat lstat
+# ifdef HAVE_SYMLINK
+# define php_sys_readlink(link, target, target_len) readlink(link, target, target_len)
+# endif
 #endif
 
 typedef struct _cwd_state {
@@ -155,9 +163,7 @@ CWD_API int virtual_open(const char *path TSRMLS_DC, int flags, ...);
 CWD_API int virtual_creat(const char *path, mode_t mode TSRMLS_DC);
 CWD_API int virtual_rename(char *oldname, char *newname TSRMLS_DC);
 CWD_API int virtual_stat(const char *path, struct stat *buf TSRMLS_DC);
-#if !defined(TSRM_WIN32)
 CWD_API int virtual_lstat(const char *path, struct stat *buf TSRMLS_DC);
-#endif
 CWD_API int virtual_unlink(const char *path TSRMLS_DC);
 CWD_API int virtual_mkdir(const char *pathname, mode_t mode TSRMLS_DC);
 CWD_API int virtual_rmdir(const char *pathname TSRMLS_DC);
@@ -188,7 +194,7 @@ CWD_API int virtual_chmod(const char *filename, mode_t mode TSRMLS_DC);
 CWD_API int virtual_chown(const char *filename, uid_t owner, gid_t group, int link TSRMLS_DC);
 #endif
 
-/* One of the following constants must be used as the last argument 
+/* One of the following constants must be used as the last argument
    in virtual_file_ex() call. */
 
 #define CWD_EXPAND   0 /* expand "." and ".." but dont resolve symlinks      */
@@ -216,7 +222,7 @@ typedef struct _realpath_cache_bucket {
 	unsigned char                  is_wvalid;
 	unsigned char                  is_writable;
 #endif
-	struct _realpath_cache_bucket *next;	
+	struct _realpath_cache_bucket *next;
 } realpath_cache_bucket;
 
 typedef struct _virtual_cwd_globals {
@@ -244,7 +250,7 @@ CWD_API realpath_cache_bucket** realpath_cache_get_buckets(TSRMLS_D);
 
 /* The actual macros to be used in programs using TSRM
  * If the program defines VIRTUAL_DIR it will use the
- * virtual_* functions 
+ * virtual_* functions
  */
 
 #ifdef VIRTUAL_DIR
@@ -261,9 +267,7 @@ CWD_API realpath_cache_bucket** realpath_cache_get_buckets(TSRMLS_D);
 #define VCWD_REALPATH(path, real_path) virtual_realpath(path, real_path TSRMLS_CC)
 #define VCWD_RENAME(oldname, newname) virtual_rename(oldname, newname TSRMLS_CC)
 #define VCWD_STAT(path, buff) virtual_stat(path, buff TSRMLS_CC)
-#if !defined(TSRM_WIN32)
-# define VCWD_LSTAT(path, buff) virtual_lstat(path, buff TSRMLS_CC)
-#endif
+#define VCWD_LSTAT(path, buff) virtual_lstat(path, buff TSRMLS_CC)
 #define VCWD_UNLINK(path) virtual_unlink(path TSRMLS_CC)
 #define VCWD_MKDIR(pathname, mode) virtual_mkdir(pathname, mode TSRMLS_CC)
 #define VCWD_RMDIR(pathname) virtual_rmdir(pathname TSRMLS_CC)

UPGRADING

@@ -40,6 +40,9 @@ UPGRADE NOTES - PHP 5.3
 2. Changes made to existing functions
 =====================================
 
+- Paths containing NULL (like /some/path\0foo.txt) are now considered invalid. 
+  See http://news.php.net/php.internals/50191
+
 - The HTTP stream wrapper now considers all status codes from 200 to 399 to be
   successful.
 
@@ -273,6 +276,8 @@ UPGRADE NOTES - PHP 5.3
         - MySQLi: Now supports persistent connections by prepending the hostname 
           with "p:".
 
+        - imagepstext now rejects invalid antialiasing steps and raises a warning.
+
      d. no longer possible to disable
 
         - PCRE
@@ -457,6 +462,14 @@ UPGRADE NOTES - PHP 5.3
 - Firebird and SNMP support are no longer available on Windows. Firebird support
   may be reintroduced in the future.
 
+=====================
+11.1 New in PHP 5.3.4
+=====================
+
+- open_basedir supports now symbolic links (checks the target).
+- is_link and SplFileInfo symbolic links related method are now fully supported
+  (on Windows Vista or later).
+
 ===================
 12. New in PHP 5.3:
 ===================

UPGRADING.INTERNALS

@@ -0,0 +1,23 @@
+$Id$
+
+UPGRADE NOTES - PHP 5.3.4
+
+1. Internal API changes
+
+========================
+1. Internal API changes
+========================
+
+	a. stat/lstat support
+
+lstat is now available on all platforms. On unix-like platform
+php_sys_lstat is an alias to lstat (when avaible). On Windows it is now 
+available using php_sys_lstat. php_sys_stat and php_sys_lstat usage is recommended 
+instead of calling lstat directly, to ensure portability.
+
+	b. readlink support
+
+readlink is now available on all platforms. On unix-like platform
+php_sys_readlink is an alias to readlink (when avaible). On Windows it is now 
+available using php_sys_readlink. php_sys_readlink usage is recommended 
+instead of calling readlink directly, to ensure portability.

Zend/acinclude.m4

@@ -4,7 +4,7 @@ dnl This file contains local autoconf functions.
 
 AC_DEFUN([LIBZEND_BISON_CHECK],[
   # we only support certain bison versions
-  bison_version_list="1.28 1.35 1.75 1.875 2.0 2.1 2.2 2.3 2.4 2.4.1"
+  bison_version_list="1.28 1.35 1.75 1.875 2.0 2.1 2.2 2.3 2.4 2.4.1 2.4.2 2.4.3"
 
   # for standalone build of Zend Engine
   test -z "$SED" && SED=sed

Zend/tests/bug35163.phpt

@@ -17,22 +17,8 @@ array(1) {
     [0]=>
     int(2)
     [1]=>
-    &array(3) {
-      [0]=>
-      int(2)
-      [1]=>
-      *RECURSION*
-      [2]=>
-      *RECURSION*
-    }
+    *RECURSION*
     [2]=>
-    &array(3) {
-      [0]=>
-      int(2)
-      [1]=>
-      *RECURSION*
-      [2]=>
-      *RECURSION*
-    }
+    *RECURSION*
   }
 }

Zend/tests/bug35163_2.phpt

@@ -20,46 +20,17 @@ array(3) {
     [0]=>
     int(2)
     [1]=>
-    &array(3) {
-      [0]=>
-      int(2)
-      [1]=>
-      *RECURSION*
-      [2]=>
-      *RECURSION*
-    }
+    *RECURSION*
     [2]=>
-    &array(3) {
-      [0]=>
-      int(2)
-      [1]=>
-      *RECURSION*
-      [2]=>
-      *RECURSION*
-    }
+    *RECURSION*
   }
   [2]=>
   &array(3) {
     [0]=>
     int(2)
     [1]=>
-    &array(3) {
-      [0]=>
-      int(2)
-      [1]=>
-      *RECURSION*
-      [2]=>
-      *RECURSION*
-    }
+    *RECURSION*
     [2]=>
-    &array(3) {
-      [0]=>
-      int(2)
-      [1]=>
-      *RECURSION*
-      [2]=>
-      *RECURSION*
-    }
+    *RECURSION*
   }
 }
-

Zend/tests/bug35163_3.phpt

@@ -11,29 +11,15 @@ var_dump($a);
 $a->b = null;
 $a = null;
 ?>
---EXPECT--
-object(stdClass)#1 (1) {
+--EXPECTF--
+object(stdClass)#%d (1) {
   ["b"]=>
   &array(3) {
     [0]=>
     int(2)
     [1]=>
-    &array(3) {
-      [0]=>
-      int(2)
-      [1]=>
-      *RECURSION*
-      [2]=>
-      *RECURSION*
-    }
+    *RECURSION*
     [2]=>
-    &array(3) {
-      [0]=>
-      int(2)
-      [1]=>
-      *RECURSION*
-      [2]=>
-      *RECURSION*
-    }
+    *RECURSION*
   }
 }

Zend/tests/bug35239.phpt

@@ -12,30 +12,16 @@ var_dump($a);
 $a->x0->y1 = "ok\n";
 echo $a->x0;
 ?>
---EXPECT--
-object(stdClass)#1 (1) {
+--EXPECTF--
+object(stdClass)#%d (1) {
   ["x0"]=>
-  &object(stdClass)#2 (3) {
+  &object(stdClass)#%d (3) {
     ["y0"]=>
     string(1) "b"
     ["y1"]=>
-    &object(stdClass)#2 (3) {
-      ["y0"]=>
-      string(1) "b"
-      ["y1"]=>
-      *RECURSION*
-      ["y2"]=>
-      *RECURSION*
-    }
+    *RECURSION*
     ["y2"]=>
-    &object(stdClass)#2 (3) {
-      ["y0"]=>
-      string(1) "b"
-      ["y1"]=>
-      *RECURSION*
-      ["y2"]=>
-      *RECURSION*
-    }
+    *RECURSION*
   }
 }
 ok

Zend/tests/bug35634.phpt

@@ -30,7 +30,9 @@ if (defined("pass3")) {
   set_error_handler('errorHandler');
   define("pass2", 1);
   include(__FILE__);
+  print "ok\n";
 }
+
 ?>
---EXPECTF--
-Error: Redefining already defined constructor for class TestClass (%sbug35634.php:12)
+--EXPECT--
+ok

Zend/tests/bug45180.phpt

@@ -43,11 +43,11 @@ __call:
 string(3) "ABC"
 __call:
 string(3) "ABC"
-__callstatic:
+__call:
 string(3) "XYZ"
-__callstatic:
+__call:
 string(3) "WWW"
-__callstatic:
+__call:
 string(3) "ABC"
 __callstatic:
 string(1) "A"
@@ -58,4 +58,4 @@ string(1) "C"
 __callstatic:
 string(3) "FOO"
 __callstatic:
-string(3) "FOO"
+string(3) "FOO"

Zend/tests/bug45186.phpt

@@ -35,17 +35,17 @@ call_user_func('self::y');
 
 ?>
 --EXPECTF--
-__callstatic:
+__call:
 string(3) "ABC"
-__callstatic:
+__call:
 string(3) "ABC"
 __call:
 string(3) "xyz"
-__callstatic:
+__call:
 string(3) "www"
 __call:
 string(1) "y"
-__callstatic:
+__call:
 string(1) "y"
 ok
 __callstatic:

Zend/tests/bug48215.phpt

@@ -29,8 +29,6 @@ $b->A();
 ?>
 ===DONE===
 --EXPECTF--
-
-Strict Standards: Redefining already defined constructor for class A in %s on line %d
 B::__construct
 A::__construct
 B::A

Zend/tests/bug48215_2.phpt

@@ -16,7 +16,4 @@ $c = new c();
 ?>
 ===DONE===
 --EXPECTF--
-
-Strict Standards: Redefining already defined constructor for class a in %s on line %d
-
 Fatal error: Call to undefined method b::b() in %s on line %d

Zend/tests/bug48930.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug #48930 (__COMPILER_HALT_OFFSET__ incorrect in PHP>=5.3)
+--FILE--
+#!php
+<?php
+
+/*
+ * Test
+ */
+printf("__COMPILER_HALT_OFFSET__ is %d\n",__COMPILER_HALT_OFFSET__);
+
+__halt_compiler();
+
+?>
+--EXPECT--
+__COMPILER_HALT_OFFSET__ is 116

Zend/tests/bug49893.phpt

@@ -0,0 +1,28 @@
+--TEST--
+Bug #49893 (Crash while creating an instance of Zend_Mail_Storage_Pop3)
+--FILE--
+<?php
+class A {
+	function __destruct() {
+		try {
+			throw new Exception("2");
+		} catch (Exception $e) {
+			echo $e->getMessage() . "\n";
+		}
+	}
+}
+class B {
+	function __construct() {
+		$this->a = new A();
+		throw new Exception("1");
+	}
+}
+try {
+	$b = new B();
+} catch(Exception $e) {
+	echo $e->getMessage() . "\n";;
+}
+?>
+--EXPECT--
+2
+1

Zend/tests/bug51176.phpt

@@ -27,6 +27,6 @@ $foo->start();
 
 ?>
 --EXPECT--
-static
-static
-static
+instance
+instance
+instance

Zend/tests/bug51394.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug #51394 (Error line reported incorrectly if error handler throws an exception)
+--INI--
+error_reporting=-1
+--FILE--
+<?php
+function eh()
+{
+	throw new Exception("error!");
+	return false;
+}
+
+set_error_handler("eh");
+$a = $empty($b);
+--EXPECTF--
+Fatal error: Function name must be a string in %sbug51394.php on line 9

Zend/tests/bug51791.phpt

@@ -0,0 +1,14 @@
+--TEST--
+Bug #51791 (constant() failed to check undefined constant and php interpreter stoped)
+--FILE--
+<?php
+
+class A  {
+    const B = 1;
+}
+var_dump(constant('A::B1'));
+
+?>
+--EXPECTF--
+Warning: constant(): Couldn't find constant A::B1 in %s on line %d
+NULL

Zend/tests/bug51822.phpt

@@ -0,0 +1,40 @@
+--TEST--
+Bug #51822 (Segfault with strange __destruct() for static class variables)
+--FILE--
+<?php
+class DestructableObject
+{
+	public function __destruct()
+	{
+		echo "2\n";
+	}	
+}
+
+class DestructorCreator
+{
+	public function __destruct()
+	{
+		$this->test = new DestructableObject;	
+		echo "1\n";
+	}
+}
+
+class Test
+{
+	public static $mystatic;
+}
+
+// Uncomment this to avoid segfault
+//Test::$mystatic = new DestructorCreator();
+
+$x = new Test();
+
+if (!isset(Test::$mystatic))
+	Test::$mystatic = new DestructorCreator();
+
+echo "bla\n";
+?>
+--EXPECT--
+bla
+1
+2

Zend/tests/bug51827.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Bug #51827 (Bad warning when register_shutdown_function called with wrong num of parameters)
+--FILE--
+<?php
+
+
+function abc() {
+	var_dump(1);
+}
+
+register_shutdown_function('timE');
+register_shutdown_function('ABC');
+register_shutdown_function('exploDe');
+
+?>
+--EXPECTF--
+int(1)
+
+Warning: explode() expects at least 2 parameters, 0 given in Unknown on line %d

Zend/tests/bug52001.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Bug #52001 (Memory allocation problems after using variable variables)
+--FILE--
+<?php
+a(0,$$var);
+
+$temp1=1;
+$temp2=2;
+var_dump($temp1);
+
+function a($b,$c) {}
+?>
+--EXPECTF--
+Notice: Undefined variable: var in %sbug52001.php on line 2
+
+Notice: Undefined variable:  in %sbug52001.php on line 2
+int(1)

Zend/tests/bug52041.phpt

@@ -0,0 +1,50 @@
+--TEST--
+Bug #52041 (Memory leak when writing on uninitialized variable returned from function)
+--FILE--
+<?php
+function foo() {
+	return $x;
+}
+
+foo()->a = 1;
+foo()->a->b = 2;
+foo()->a++;
+foo()->a->b++;
+foo()->a += 2;
+foo()->a->b += 2;
+
+//foo()[0] = 1;
+//foo()[0][0] = 2;
+//foo()[0]++;
+//foo()[0][0]++;
+//foo()[0] += 2;
+//foo()[0][0] += 2;
+var_dump(foo());
+?>
+--EXPECTF--
+Notice: Undefined variable: x in %sbug52041.php on line 3
+
+Strict Standards: Creating default object from empty value in %sbug52041.php on line 6
+
+Notice: Undefined variable: x in %sbug52041.php on line 3
+
+Strict Standards: Creating default object from empty value in %sbug52041.php on line 7
+
+Notice: Undefined variable: x in %sbug52041.php on line 3
+
+Strict Standards: Creating default object from empty value in %sbug52041.php on line 8
+
+Notice: Undefined variable: x in %sbug52041.php on line 3
+
+Strict Standards: Creating default object from empty value in %sbug52041.php on line 9
+
+Notice: Undefined variable: x in %sbug52041.php on line 3
+
+Strict Standards: Creating default object from empty value in %sbug52041.php on line 10
+
+Notice: Undefined variable: x in %sbug52041.php on line 3
+
+Strict Standards: Creating default object from empty value in %sbug52041.php on line 11
+
+Notice: Undefined variable: x in %sbug52041.php on line 3
+NULL

Zend/tests/bug52051.phpt

@@ -0,0 +1,27 @@
+--TEST--
+Bug #52051 (handling of case sensitivity of old-style constructors changed in 5.3+)
+--FILE--
+<?php
+
+class AA {
+    function AA() { echo "foo\n"; }
+}
+class bb extends AA {}
+class CC extends bb {
+   function CC() { parent::bb(); }
+}
+new CC();
+
+class A {
+    function A() { echo "bar\n"; }
+}
+class B extends A {}
+class C extends B {
+   function C() { parent::B(); }
+}
+new C();
+
+?>
+--EXPECT--
+foo
+bar

Zend/tests/bug52060.phpt

@@ -0,0 +1,12 @@
+--TEST--
+Bug #52060 (Memory leak when passing a closure to method_exists())
+--FILE--
+<?php
+
+$closure = function($a) { echo $a; };
+
+var_dump(method_exists($closure, '__invoke')); // true
+
+?>
+--EXPECT--
+bool(true)

Zend/tests/bug52160.phpt

@@ -0,0 +1,34 @@
+--TEST--
+Bug #52160 (Invalid E_STRICT redefined constructor error)
+--FILE--
+<?php
+
+class bar {
+	function __construct() { }
+	static function bar() {
+		var_dump(1);
+	}
+}
+
+bar::bar();
+
+class foo {
+	static function foo() {
+		var_dump(2);
+	}
+	function __construct() { }
+}
+
+foo::foo();
+
+class baz {
+	static function baz() {
+		var_dump(3);
+	}
+}
+
+?>
+--EXPECTF--
+Strict Standards: Redefining already defined constructor for class foo in %s on line %d
+
+Fatal error: Constructor baz::baz() cannot be static in %s on line %d

Zend/tests/bug52193.phpt

@@ -0,0 +1,78 @@
+--TEST--
+Bug #52193 (converting closure to array yields empty array)
+--FILE--
+<?php
+
+var_dump((array) 1);
+var_dump((array) NULL);
+var_dump((array) new stdclass);
+var_dump($h = (array) function () { return 2; });
+var_dump($h[0]());
+
+$i = function () use (&$h) {
+	return $h;
+};
+
+var_dump($x = (array)$i);
+var_dump($y = $x[0]);
+var_dump($y());
+
+$items = range(1, 5);
+$func = function(){ return 'just a test'; };
+
+array_splice($items, 0 , 4, $func);
+var_dump($items);
+
+?>
+--EXPECTF--
+array(1) {
+  [0]=>
+  int(1)
+}
+array(0) {
+}
+array(0) {
+}
+array(1) {
+  [0]=>
+  object(Closure)#%d (0) {
+  }
+}
+int(2)
+array(1) {
+  [0]=>
+  object(Closure)#%d (1) {
+    ["static"]=>
+    array(1) {
+      ["h"]=>
+      &array(1) {
+        [0]=>
+        object(Closure)#%d (0) {
+        }
+      }
+    }
+  }
+}
+object(Closure)#%d (1) {
+  ["static"]=>
+  array(1) {
+    ["h"]=>
+    &array(1) {
+      [0]=>
+      object(Closure)#%d (0) {
+      }
+    }
+  }
+}
+array(1) {
+  [0]=>
+  object(Closure)#%d (0) {
+  }
+}
+array(2) {
+  [0]=>
+  object(Closure)#%d (0) {
+  }
+  [1]=>
+  int(5)
+}

Zend/tests/bug52237.phpt

@@ -0,0 +1,11 @@
+--TEST--
+Bug #52237 (Crash when passing the reference of the property of a non-object)
+--FILE--
+<?php
+$data = 'test';
+preg_match('//', '', $data->info);
+var_dump($data);
+?>
+--EXPECTF--
+Warning: Attempt to modify property of non-object in %sbug52237.php on line 3
+string(4) "test"

Zend/tests/bug52361.phpt

@@ -0,0 +1,35 @@
+--TEST--
+Bug #52361 (Throwing an exception in a destructor causes invalid catching)
+--FILE--
+<?php
+class aaa {
+	public function __destruct() {
+		try {
+			throw new Exception(__CLASS__);
+		} catch(Exception $ex) {
+			echo "1. $ex\n";
+		}
+	}
+}
+function bbb() {
+	$a = new aaa();
+	throw new Exception(__FUNCTION__);
+}
+try {
+	bbb();
+	echo "must be skipped !!!";
+} catch(Exception $ex) {
+	echo "2. $ex\n";
+}
+?>
+--EXPECTF--
+1. exception 'Exception' with message 'aaa' in %sbug52361.php:5
+Stack trace:
+#0 %sbug52361.php(16): aaa->__destruct()
+#1 %sbug52361.php(16): bbb()
+#2 {main}
+2. exception 'Exception' with message 'bbb' in %sbug52361.php:13
+Stack trace:
+#0 %sbug52361.php(16): bbb()
+#1 {main}
+

Zend/tests/bug52484.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Bug #52484 (__set() ignores setting properties with empty names)
+--FILE--
+<?php
+
+class A {	
+	function __unset($prop) {
+		unset($this->$prop);
+	}
+}
+
+$a = new A();
+$prop = null;
+
+unset($a->$prop);
+
+?>
+--EXPECTF--
+Fatal error: Cannot access empty property in %s on line %d

Zend/tests/bug52484_2.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Bug #52484.2 (__set() ignores setting properties with empty names)
+--FILE--
+<?php
+
+class A {
+	function __set($prop, $val) {
+		$this->$prop = $val;
+	}
+}
+
+$a = new A();
+$prop = null;
+
+$a->$prop = 2;
+
+?>
+--EXPECTF--
+Fatal error: Cannot access empty property in %s on line %d

Zend/tests/bug52484_3.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Bug #52484.3 (__set() ignores setting properties with empty names)
+--FILE--
+<?php
+
+class A {	
+	function __get($prop) {
+		var_dump($this->$prop);
+	}
+}
+
+$a = new A();
+$prop = null;
+
+var_dump($a->$prop);
+
+?>
+--EXPECTF--
+Fatal error: Cannot access empty property in %s on line %d

Zend/tests/bug52508.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #52508 (newline problem with parse_ini_file+INI_SCANNER_RAW)
+--FILE--
+<?php
+
+$file = dirname(__FILE__) .'/bug52508.ini';
+
+file_put_contents($file, "a = 1");
+
+$ini_array = parse_ini_file($file, true, INI_SCANNER_RAW);
+var_dump($ini_array);
+
+unlink($file);
+
+?>
+--EXPECT--
+array(1) {
+  ["a"]=>
+  string(1) "1"
+}

Zend/tests/bug52879.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug #52879 (Objects unreferenced in __get, __set, __isset or __unset can be freed too early)
+--FILE--
+<?php
+class MyClass {
+	public $myRef;
+	public function __set($property,$value) {
+		$this->myRef = $value;
+	}
+}
+$myGlobal=new MyClass($myGlobal);
+$myGlobal->myRef=&$myGlobal;
+$myGlobal->myNonExistentProperty="ok\n";
+echo $myGlobal;
+--EXPECT--
+ok

Zend/tests/bug52939.phpt

@@ -0,0 +1,40 @@
+--TEST--
+Bug #52939 (zend_call_function_array does not respect ZEND_SEND_PREFER_REF)
+--FILE--
+<?php
+$ar1 = array("row1" => 2, "row2" => 1);
+var_dump(array_multisort($ar1));
+var_dump($ar1);
+
+$ar1 = array("row1" => 2, "row2" => 1);
+$args = array(&$ar1);
+var_dump(call_user_func_array("array_multisort", $args));
+var_dump($ar1);
+
+$ar1 = array("row1" => 2, "row2" => 1);
+$args = array($ar1);
+var_dump(call_user_func_array("array_multisort", $args));
+var_dump($ar1);
+?>
+--EXPECT--
+bool(true)
+array(2) {
+  ["row2"]=>
+  int(1)
+  ["row1"]=>
+  int(2)
+}
+bool(true)
+array(2) {
+  ["row2"]=>
+  int(1)
+  ["row1"]=>
+  int(2)
+}
+bool(true)
+array(2) {
+  ["row1"]=>
+  int(2)
+  ["row2"]=>
+  int(1)
+}

Zend/tests/bug53305.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Bug #53305 (E_NOTICE when defining a constant starts with __COMPILER_HALT_OFFSET__)
+--FILE--
+<?php
+error_reporting(E_ALL);
+
+define('__COMPILER_HALT_OFFSET__1', 1);
+define('__COMPILER_HALT_OFFSET__2', 2);
+define('__COMPILER_HALT_OFFSET__', 3);
+define('__COMPILER_HALT_OFFSET__1'.chr(0), 4);
+
+var_dump(__COMPILER_HALT_OFFSET__1);
+var_dump(constant('__COMPILER_HALT_OFFSET__1'.chr(0)));
+
+?>
+--EXPECTF--
+Notice: Constant __COMPILER_HALT_OFFSET__ already defined in %s on line %d
+int(1)
+int(4)

Zend/tests/call_static_003.phpt

@@ -28,9 +28,9 @@ foo::BAZ();
 --EXPECT--
 nonstatic
 string(6) "fOoBaR"
-static
+nonstatic
 string(6) "foOBAr"
-static
+nonstatic
 string(6) "fOOBAr"
 static
 string(3) "bAr"

Zend/tests/call_static_007.phpt

@@ -30,5 +30,5 @@ a::Foo();
 --EXPECT--
 __callstatic: Test
 __call: Test
-__callstatic: Bar
+__call: Bar
 __callstatic: Foo

Zend/tests/closure_020.phpt

@@ -31,18 +31,7 @@ object(foo)#%d (%d) {
     ["static"]=>
     array(1) {
       ["a"]=>
-      &object(foo)#%d (2) {
-        ["test":"foo":private]=>
-        int(3)
-        ["a"]=>
-        object(Closure)#%d (1) {
-          ["static"]=>
-          array(1) {
-            ["a"]=>
-            *RECURSION*
-          }
-        }
-      }
+      *RECURSION*
     }
   }
 }

Zend/tests/closure_034.phpt

@@ -9,17 +9,11 @@ var_dump($a);
 ?>
 ===DONE===
 --EXPECTF--
-object(Closure)#1 (1) {
+object(Closure)#%d (1) {
   ["static"]=>
   array(1) {
     ["a"]=>
-    &object(Closure)#1 (1) {
-      ["static"]=>
-      array(1) {
-        ["a"]=>
-        *RECURSION*
-      }
-    }
+    *RECURSION*
   }
 }
 ===DONE===

Zend/tests/closure_035.phpt

@@ -18,14 +18,8 @@ var_dump($x());
 object(Closure)#%d (1) {
   ["static"]=>
   array(1) {
-    [%u|b%"x"]=>
-    &object(Closure)#%d (1) {
-      ["static"]=>
-      array(1) {
-        [%u|b%"x"]=>
-        *RECURSION*
-      }
-    }
+    ["x"]=>
+    *RECURSION*
   }
 }
 int(1)

Zend/tests/declare_001.phpt

@@ -1,5 +1,11 @@
 --TEST--
 Testing declare statement with several type values
+--SKIPIF--
+<?php
+if (in_array("detect_unicode", array_keys(ini_get_all()))) {
+  die("skip");
+}
+?>
 --FILE--
 <?php
 

Zend/tests/foreach_002.phpt

@@ -15,9 +15,6 @@ array(1) {
   ["a"]=>
   &array(1) {
     ["a"]=>
-    &array(1) {
-      ["a"]=>
-      *RECURSION*
-    }
+    *RECURSION*
   }
 }

Zend/tests/gc_004.phpt

@@ -16,10 +16,7 @@ array(1) {
   [0]=>
   &array(1) {
     [0]=>
-    &array(1) {
-      [0]=>
-      *RECURSION*
-    }
+    *RECURSION*
   }
 }
 int(1)

Zend/tests/gc_005.phpt

@@ -11,13 +11,10 @@ unset($a);
 var_dump(gc_collect_cycles());
 echo "ok\n"
 ?>
---EXPECT--
-object(stdClass)#1 (1) {
+--EXPECTF--
+object(stdClass)#%d (1) {
   ["a"]=>
-  object(stdClass)#1 (1) {
-    ["a"]=>
-    *RECURSION*
-  }
+  *RECURSION*
 }
 int(1)
 ok

Zend/tests/gc_006.phpt

@@ -12,18 +12,12 @@ unset($a);
 var_dump(gc_collect_cycles());
 echo "ok\n"
 ?>
---EXPECT--
-object(stdClass)#1 (1) {
+--EXPECTF--
+object(stdClass)#%d (1) {
   ["a"]=>
   array(1) {
     [0]=>
-    &object(stdClass)#1 (1) {
-      ["a"]=>
-      array(1) {
-        [0]=>
-        *RECURSION*
-      }
-    }
+    *RECURSION*
   }
 }
 int(2)

Zend/tests/gc_007.phpt

@@ -17,10 +17,7 @@ array(1) {
   [0]=>
   &array(1) {
     [0]=>
-    &array(1) {
-      [0]=>
-      *RECURSION*
-    }
+    *RECURSION*
   }
 }
 int(0)

Zend/tests/gc_008.phpt

@@ -13,13 +13,10 @@ unset($a);
 var_dump(gc_collect_cycles());
 echo "ok\n"
 ?>
---EXPECT--
-object(stdClass)#2 (1) {
+--EXPECTF--
+object(stdClass)#%d (1) {
   ["a"]=>
-  object(stdClass)#2 (1) {
-    ["a"]=>
-    *RECURSION*
-  }
+  *RECURSION*
 }
 int(0)
 int(1)

Zend/tests/gc_009.phpt

@@ -14,18 +14,12 @@ unset($a);
 var_dump(gc_collect_cycles());
 echo "ok\n"
 ?>
---EXPECT--
-object(stdClass)#1 (1) {
+--EXPECTF--
+object(stdClass)#%d (1) {
   ["a"]=>
   array(1) {
     [0]=>
-    &object(stdClass)#1 (1) {
-      ["a"]=>
-      array(1) {
-        [0]=>
-        *RECURSION*
-      }
-    }
+    *RECURSION*
   }
 }
 int(0)

Zend/tests/gc_010.phpt

@@ -17,10 +17,7 @@ array(1) {
   [0]=>
   &array(1) {
     [0]=>
-    &array(1) {
-      [0]=>
-      *RECURSION*
-    }
+    *RECURSION*
   }
 }
 int(1)

Zend/tests/gc_011.phpt

@@ -17,13 +17,10 @@ unset($a);
 var_dump(gc_collect_cycles());
 echo "ok\n"
 ?>
---EXPECT--
-object(Foo)#1 (1) {
+--EXPECTF--
+object(Foo)#%d (1) {
   ["a"]=>
-  object(Foo)#1 (1) {
-    ["a"]=>
-    *RECURSION*
-  }
+  *RECURSION*
 }
 __destruct
 int(1)

Zend/tests/gc_032.phpt

@@ -0,0 +1,40 @@
+--TEST--
+GC 032: Crash in GC because of invalid reference counting
+--FILE--
+<?php
+$a = array();
+$b =& $a;
+$a[0] = $a;
+debug_zval_dump($a);
+$a = array(array());
+$b =& $a;
+$a[0][0] = $a;
+debug_zval_dump($a);
+?>
+--EXPECT--
+array(1) refcount(1){
+  [0]=>
+  array(1) refcount(3){
+    [0]=>
+    array(1) refcount(3){
+      [0]=>
+      *RECURSION*
+    }
+  }
+}
+array(1) refcount(1){
+  [0]=>
+  array(1) refcount(3){
+    [0]=>
+    array(1) refcount(1){
+      [0]=>
+      array(1) refcount(3){
+        [0]=>
+        array(1) refcount(1){
+          [0]=>
+          *RECURSION*
+        }
+      }
+    }
+  }
+}

Zend/tests/ns_063.phpt

@@ -1,5 +1,5 @@
 --TEST--
-063: Support for old-style constructors in namesapces
+063: Old-style constructors in namesapces (not supported!)
 --FILE--
 <?php
 namespace Foo;
@@ -9,5 +9,6 @@ class Bar {
 	}
 }
 new Bar();
+echo "ok\n";
 --EXPECT--
 ok

Zend/tests/objects_011.phpt

@@ -14,6 +14,5 @@ class test {
 
 echo "Done\n";
 ?>
---EXPECTF--	
-Strict Standards: Redefining already defined constructor for class test in %s on line %d
+--EXPECT--
 Done

Zend/tests/objects_020.phpt

@@ -13,18 +13,10 @@ $$test->a->b[] = 2;
 var_dump($$test);
 
 ?>
---EXPECT--
-object(stdClass)#1 (2) {
+--EXPECTF--
+object(stdClass)#%d (2) {
   ["a"]=>
-  &object(stdClass)#1 (2) {
-    ["a"]=>
-    *RECURSION*
-    ["b"]=>
-    array(1) {
-      [0]=>
-      int(2)
-    }
-  }
+  *RECURSION*
   ["b"]=>
   array(1) {
     [0]=>

Zend/tests/objects_032.phpt

@@ -0,0 +1,40 @@
+--TEST--
+Covariant return-by-ref constraints
+--FILE--
+<?php
+
+class A implements ArrayAccess {
+    public $foo = array();
+
+    public function &offsetGet($n) {
+        return $this->foo[$n];
+    }
+
+    public function offsetSet($n, $v) {
+    }
+    public function offsetUnset($n) {
+    }
+    public function offsetExists($n) {
+    }
+}
+
+$a = new A;
+
+$a['foo']['bar'] = 2;
+
+var_dump($a);
+
+?>
+==DONE==
+--EXPECTF--
+object(A)#1 (1) {
+  ["foo"]=>
+  array(1) {
+    ["foo"]=>
+    array(1) {
+      ["bar"]=>
+      int(2)
+    }
+  }
+}
+==DONE==

Zend/tests/unset_cv05.phpt

@@ -19,7 +19,7 @@ echo $HTTP_SESSION_VARS;
 echo "\nok\n";
 ?>
 --EXPECTF--
-Warning: Directive 'register_long_arrays' is deprecated in PHP %d.%d and greater in Unknown on line 0
+Deprecated: Directive 'register_long_arrays' is deprecated in PHP %d.%d and greater in Unknown on line 0
 ok
 
 Warning: session_start(): Cannot send session cookie - headers already sent by (output started at %sunset_cv05.php on line %d

Zend/tests/unset_cv06.phpt

@@ -19,7 +19,7 @@ echo $x;
 echo "ok\n";
 ?>
 --EXPECTF--
-Warning: Directive 'register_globals' is deprecated in PHP %d.%d and greater in Unknown on line 0
+Deprecated: Directive 'register_globals' is deprecated in PHP %d.%d and greater in Unknown on line 0
 1
 
 Deprecated: Function session_register() is deprecated in %s on line %d

Zend/zend_API.c

@@ -251,22 +251,18 @@ ZEND_API int zend_get_object_classname(const zval *object, char **class_name, ze
 }
 /* }}} */
 
-static int parse_arg_object_to_string(zval **arg, char **p, int *pl, int type TSRMLS_DC) /* {{{ */
+static int parse_arg_object_to_string(zval **arg TSRMLS_DC) /* {{{ */
 {
 	if (Z_OBJ_HANDLER_PP(arg, cast_object)) {
 		SEPARATE_ZVAL_IF_NOT_REF(arg);
-		if (Z_OBJ_HANDLER_PP(arg, cast_object)(*arg, *arg, type TSRMLS_CC) == SUCCESS) {
-			*pl = Z_STRLEN_PP(arg);
-			*p = Z_STRVAL_PP(arg);
+		if (Z_OBJ_HANDLER_PP(arg, cast_object)(*arg, *arg, IS_STRING TSRMLS_CC) == SUCCESS) {
 			return SUCCESS;
 		}
 	}
 	/* Standard PHP objects */
 	if (Z_OBJ_HT_PP(arg) == &std_object_handlers || !Z_OBJ_HANDLER_PP(arg, cast_object)) {
 		SEPARATE_ZVAL_IF_NOT_REF(arg);
-		if (zend_std_cast_object_tostring(*arg, *arg, type TSRMLS_CC) == SUCCESS) {
-			*pl = Z_STRLEN_PP(arg);
-			*p = Z_STRVAL_PP(arg);
+		if (zend_std_cast_object_tostring(*arg, *arg, IS_STRING TSRMLS_CC) == SUCCESS) {
 			return SUCCESS;
 		}
 	}
@@ -281,8 +277,6 @@ static int parse_arg_object_to_string(zval **arg, char **p, int *pl, int type TS
 			if (!use_copy) {
 				ZVAL_ZVAL(*arg, z, 1, 1);
 			}
-			*pl = Z_STRLEN_PP(arg);
-			*p = Z_STRVAL_PP(arg);
 			return SUCCESS;
 		}
 		zval_ptr_dtor(&z);
@@ -418,15 +412,17 @@ static char *zend_parse_arg_impl(int arg_num, zval **arg, va_list *va, char **sp
 					case IS_DOUBLE:
 					case IS_BOOL:
 						convert_to_string_ex(arg);
+						if (UNEXPECTED(Z_ISREF_PP(arg) != 0)) {
+							/* it's dangerous to return pointers to string
+							   buffer of referenced variable, because it can
+							   be clobbered throug magic callbacks */
+							SEPARATE_ZVAL(arg);
+						}
 						*p = Z_STRVAL_PP(arg);
 						*pl = Z_STRLEN_PP(arg);
 						break;
 
 					case IS_OBJECT:
-						if (parse_arg_object_to_string(arg, p, pl, IS_STRING TSRMLS_CC) == SUCCESS) {
-							break;
-						}
-
 					case IS_ARRAY:
 					case IS_RESOURCE:
 					default:
@@ -680,7 +676,7 @@ static int zend_parse_va_args(int num_args, char *type_spec, va_list *va, int fl
 	int max_num_args = 0;
 	int post_varargs = 0;
 	zval **arg;
-	int arg_count;
+	int arg_count = (int)(zend_uintptr_t) *(zend_vm_stack_top(TSRMLS_C) - 1);
 	int quiet = flags & ZEND_PARSE_PARAMS_QUIET;
 	zend_bool have_varargs = 0;
 	zval ****varargs = NULL;
@@ -689,14 +685,21 @@ static int zend_parse_va_args(int num_args, char *type_spec, va_list *va, int fl
 	for (spec_walk = type_spec; *spec_walk; spec_walk++) {
 		c = *spec_walk;
 		switch (c) {
+			case 's':
+				if (max_num_args < arg_count) {
+					arg = (zval **) (zend_vm_stack_top(TSRMLS_C) - 1 - (arg_count - max_num_args));
+					if (Z_TYPE_PP(arg) == IS_OBJECT) {
+						parse_arg_object_to_string(arg TSRMLS_CC);
+					}
+				}
+				/* break missing intentionally */
 			case 'l': case 'd':
-			case 's': case 'b':
+			case 'H': case 'b':
 			case 'r': case 'a':
 			case 'o': case 'O':
 			case 'z': case 'Z':
 			case 'C': case 'h':
 			case 'f': case 'A':
-			case 'H':
 				max_num_args++;
 				break;
 
@@ -718,7 +721,7 @@ static int zend_parse_va_args(int num_args, char *type_spec, va_list *va, int fl
 						zend_error(E_WARNING, "%s%s%s(): only one varargs specifier (* or +) is permitted",
 								class_name,
 								class_name[0] ? "::" : "",
-								get_active_function_name(TSRMLS_C));
+								active_function->common.function_name);
 					}
 					return FAILURE;
 				}
@@ -738,7 +741,7 @@ static int zend_parse_va_args(int num_args, char *type_spec, va_list *va, int fl
 					zend_error(E_WARNING, "%s%s%s(): bad type specifier while parsing parameters",
 							class_name,
 							class_name[0] ? "::" : "",
-							get_active_function_name(TSRMLS_C));
+							active_function->common.function_name);
 				}
 				return FAILURE;
 		}
@@ -761,7 +764,7 @@ static int zend_parse_va_args(int num_args, char *type_spec, va_list *va, int fl
 			zend_error(E_WARNING, "%s%s%s() expects %s %d parameter%s, %d given",
 					class_name,
 					class_name[0] ? "::" : "",
-					get_active_function_name(TSRMLS_C),
+					active_function->common.function_name,
 					min_num_args == max_num_args ? "exactly" : num_args < min_num_args ? "at least" : "at most",
 					num_args < min_num_args ? min_num_args : max_num_args,
 					(num_args < min_num_args ? min_num_args : max_num_args) == 1 ? "" : "s",
@@ -770,8 +773,6 @@ static int zend_parse_va_args(int num_args, char *type_spec, va_list *va, int fl
 		return FAILURE;
 	}
 
-	arg_count = (int)(zend_uintptr_t) *(zend_vm_stack_top(TSRMLS_C) - 1);
-
 	if (num_args > arg_count) {
 		zend_error(E_WARNING, "%s(): could not obtain parameters for parsing",
 			get_active_function_name(TSRMLS_C));
@@ -1081,7 +1082,7 @@ ZEND_API int _object_and_properties_init(zval *arg, zend_class_entry *class_type
 		} else {
 			ALLOC_HASHTABLE_REL(object->properties);
 			zend_hash_init(object->properties, zend_hash_num_elements(&class_type->default_properties), NULL, ZVAL_PTR_DTOR, 0);
-			zend_hash_copy(object->properties, &class_type->default_properties, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
+			zend_hash_copy(object->properties, &class_type->default_properties, zval_copy_property_ctor(class_type), (void *) &tmp, sizeof(zval *));
 		}
 	} else {
 		Z_OBJVAL_P(arg) = class_type->create_object(class_type TSRMLS_CC);

Zend/zend_alloc.c

@@ -1115,7 +1115,7 @@ ZEND_API zend_mm_heap *zend_mm_startup_ex(const zend_mm_mem_handlers *handlers,
 				mm_heap->large_free_buckets[i]->parent = &mm_heap->large_free_buckets[i];
 			}
 		}
-		mm_heap->rest_buckets[0]->next_free_block = mm_heap->rest_buckets[1]->prev_free_block = ZEND_MM_REST_BUCKET(mm_heap);
+		mm_heap->rest_buckets[0] = mm_heap->rest_buckets[1] = ZEND_MM_REST_BUCKET(mm_heap);
 
 		free(heap);
 		heap = mm_heap;

Zend/zend_builtin_functions.c

@@ -26,6 +26,7 @@
 #include "zend_ini.h"
 #include "zend_exceptions.h"
 #include "zend_extensions.h"
+#include "zend_closures.h"
 
 #undef ZEND_TEST_EXCEPTIONS
 
@@ -179,7 +180,7 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_class_alias, 0, 0, 2)
 ZEND_END_ARG_INFO()
 
 ZEND_BEGIN_ARG_INFO_EX(arginfo_trigger_error, 0, 0, 1)
-	ZEND_ARG_INFO(0, messsage)
+	ZEND_ARG_INFO(0, message)
 	ZEND_ARG_INFO(0, error_type)
 ZEND_END_ARG_INFO()
 
@@ -1098,22 +1099,29 @@ ZEND_FUNCTION(method_exists)
 		RETURN_TRUE;
 	} else {
 		union _zend_function *func = NULL;
-		efree(lcname);
 
 		if (Z_TYPE_P(klass) == IS_OBJECT 
 		&& Z_OBJ_HT_P(klass)->get_method != NULL
 		&& (func = Z_OBJ_HT_P(klass)->get_method(&klass, method_name, method_len TSRMLS_CC)) != NULL
 		) {
 			if (func->type == ZEND_INTERNAL_FUNCTION 
-			&& ((zend_internal_function*)func)->handler == zend_std_call_user_call
+			&& (func->common.fn_flags & ZEND_ACC_CALL_VIA_HANDLER) != 0
 			) {
+				/* Returns true to the fake Closure's __invoke */
+				RETVAL_BOOL((func->common.scope == zend_ce_closure
+					&& (method_len == sizeof(ZEND_INVOKE_FUNC_NAME)-1)
+					&& memcmp(lcname, ZEND_INVOKE_FUNC_NAME, sizeof(ZEND_INVOKE_FUNC_NAME)-1) == 0) ? 1 : 0);
+
+				efree(lcname);
 				efree(((zend_internal_function*)func)->function_name);
 				efree(func);
-				RETURN_FALSE;
+				return;
 			}
+			efree(lcname);
 			RETURN_TRUE;
 		}
 	}
+	efree(lcname);
 	RETURN_FALSE;
 }
 /* }}} */
@@ -1384,7 +1392,7 @@ ZEND_FUNCTION(get_included_files)
 /* }}} */
 
 
-/* {{{ proto void trigger_error(string messsage [, int error_type])
+/* {{{ proto void trigger_error(string message [, int error_type])
    Generates a user-level error/warning/notice message */
 ZEND_FUNCTION(trigger_error)
 {

Zend/zend_compile.c

@@ -1270,25 +1270,14 @@ void zend_do_begin_function_declaration(znode *function_token, znode *function_n
 				}
 			}
 		} else {
-			char *short_class_name;
-			int short_class_name_length;
-			char *short_class_lcname;
-
-			if ((short_class_name = zend_memrchr(CG(active_class_entry)->name, '\\', CG(active_class_entry)->name_length))) {
-				short_class_name_length = CG(active_class_entry)->name_length - (short_class_name - CG(active_class_entry)->name) - 1;
-				++short_class_name;
-			} else {
-				short_class_name = CG(active_class_entry)->name;
-				short_class_name_length = CG(active_class_entry)->name_length;
-			}
-			short_class_lcname = do_alloca(short_class_name_length + 1, use_heap);
-			zend_str_tolower_copy(short_class_lcname, short_class_name, short_class_name_length);
+			char *class_lcname;
+			
+			class_lcname = do_alloca(CG(active_class_entry)->name_length + 1, use_heap);
+			zend_str_tolower_copy(class_lcname, CG(active_class_entry)->name, CG(active_class_entry)->name_length);
 			/* Improve after RC: cache the lowercase class name */
 
-			if ((short_class_name_length == name_len) && (!memcmp(short_class_lcname, lcname, name_len))) {
-				if (CG(active_class_entry)->constructor) {
-					zend_error(E_STRICT, "Redefining already defined constructor for class %s", CG(active_class_entry)->name);
-				} else {
+			if ((CG(active_class_entry)->name_length == name_len) && (!memcmp(class_lcname, lcname, name_len))) {
+				if (!CG(active_class_entry)->constructor) {
 					CG(active_class_entry)->constructor = (zend_function *) CG(active_op_array);
 				}
 			} else if ((name_len == sizeof(ZEND_CONSTRUCTOR_FUNC_NAME)-1) && (!memcmp(lcname, ZEND_CONSTRUCTOR_FUNC_NAME, sizeof(ZEND_CONSTRUCTOR_FUNC_NAME)))) {
@@ -1338,7 +1327,7 @@ void zend_do_begin_function_declaration(znode *function_token, znode *function_n
 			} else if (!(fn_flags & ZEND_ACC_STATIC)) {
 				CG(active_op_array)->fn_flags |= ZEND_ACC_ALLOW_STATIC;
 			}
-			free_alloca(short_class_lcname, use_heap);
+			free_alloca(class_lcname, use_heap);
 		}
 
 		efree(lcname);
@@ -2543,13 +2532,16 @@ static zend_bool zend_do_perform_implementation_check(const zend_function *fe, c
 {
 	zend_uint i;
 
-	/* If it's a user function then arg_info == NULL means we don't have any parameters but we still need to do the arg number checks.  We are only willing to ignore this for internal functions because extensions don't always define arg_info. */
+	/* If it's a user function then arg_info == NULL means we don't have any parameters but
+	 * we still need to do the arg number checks.  We are only willing to ignore this for internal
+	 * functions because extensions don't always define arg_info.
+	 */
 	if (!proto || (!proto->common.arg_info && proto->common.type != ZEND_USER_FUNCTION)) {
 		return 1;
 	}
 
 	/* Checks for constructors only if they are declared in an interface */
-	if ((fe->common.fn_flags & ZEND_ACC_CTOR) && !(proto->common.scope->ce_flags & ZEND_ACC_INTERFACE)) {
+	if ((fe->common.fn_flags & ZEND_ACC_CTOR) && (proto->common.scope->ce_flags & ZEND_ACC_INTERFACE) == 0) {
 		return 1;
 	}
 
@@ -2559,12 +2551,14 @@ static zend_bool zend_do_perform_implementation_check(const zend_function *fe, c
 		return 0;
 	}
 
-	if (proto->common.pass_rest_by_reference
+	if (fe->common.type != ZEND_USER_FUNCTION
+		&& proto->common.pass_rest_by_reference
 		&& !fe->common.pass_rest_by_reference) {
 		return 0;
 	}
 
-	if (fe->common.return_reference != proto->common.return_reference) {
+	/* by-ref constraints on return values are covariant */
+	if (proto->common.return_reference && !fe->common.return_reference) {
 		return 0;
 	}
 
@@ -2588,6 +2582,8 @@ static zend_bool zend_do_perform_implementation_check(const zend_function *fe, c
 			/* Only one has an array type hint and the other one doesn't */
 			return 0;
 		}
+
+		/* by-ref constraints on arguments are invariant */
 		if (fe->common.arg_info[i].pass_by_reference != proto->common.arg_info[i].pass_by_reference) {
 			return 0;
 		}
@@ -2825,6 +2821,9 @@ static int inherit_static_prop(zval **p TSRMLS_DC, int num_args, va_list args, c
 }
 /* }}} */
 
+#define zval_property_ctor(parent_ce, ce) \
+	((copy_ctor_func_t) (((parent_ce)->type != (ce)->type) ? zval_shared_property_ctor : zval_add_ref))
+
 ZEND_API void zend_do_inheritance(zend_class_entry *ce, zend_class_entry *parent_ce TSRMLS_DC) /* {{{ */
 {
 	if ((ce->ce_flags & ZEND_ACC_INTERFACE)
@@ -2848,7 +2847,7 @@ ZEND_API void zend_do_inheritance(zend_class_entry *ce, zend_class_entry *parent
 	zend_do_inherit_interfaces(ce, parent_ce TSRMLS_CC);
 
 	/* Inherit properties */
-	zend_hash_merge(&ce->default_properties, &parent_ce->default_properties, (void (*)(void *)) zval_add_ref, NULL, sizeof(zval *), 0);
+	zend_hash_merge(&ce->default_properties, &parent_ce->default_properties, zval_property_ctor(parent_ce, ce), NULL, sizeof(zval *), 0);
 	if (parent_ce->type != ce->type) {
 		/* User class extends internal class */
 		zend_update_class_constants(parent_ce  TSRMLS_CC);
@@ -2858,7 +2857,7 @@ ZEND_API void zend_do_inheritance(zend_class_entry *ce, zend_class_entry *parent
 	}
 	zend_hash_merge_ex(&ce->properties_info, &parent_ce->properties_info, (copy_ctor_func_t) (ce->type & ZEND_INTERNAL_CLASS ? zend_duplicate_property_info_internal : zend_duplicate_property_info), sizeof(zend_property_info), (merge_checker_func_t) do_inherit_property_access_check, ce);
 
-	zend_hash_merge(&ce->constants_table, &parent_ce->constants_table, (void (*)(void *)) zval_add_ref, NULL, sizeof(zval *), 0);
+	zend_hash_merge(&ce->constants_table, &parent_ce->constants_table, zval_property_ctor(parent_ce, ce), NULL, sizeof(zval *), 0);
 	zend_hash_merge_ex(&ce->function_table, &parent_ce->function_table, (copy_ctor_func_t) do_inherit_method, sizeof(zend_function), (merge_checker_func_t) do_inherit_method_check, ce);
 	do_inherit_parent_constructor(ce);
 

Zend/zend_compile.h

@@ -687,9 +687,9 @@ int zendlex(znode *zendlval TSRMLS_DC);
 #define ZEND_CT	(1<<0)
 #define ZEND_RT (1<<1)
 
-#define ZEND_FETCH_STANDARD		0
-#define ZEND_FETCH_ADD_LOCK		(1<<0)
-#define ZEND_FETCH_MAKE_REF		(1<<1)
+#define ZEND_FETCH_STANDARD	    0x00000000
+#define ZEND_FETCH_ADD_LOCK	    0x08000000
+#define ZEND_FETCH_MAKE_REF	    0x04000000
 
 #define ZEND_FE_FETCH_BYREF	1
 #define ZEND_FE_FETCH_WITH_KEY	2

Zend/zend_constants.c

@@ -434,8 +434,16 @@ ZEND_API int zend_register_constant(zend_constant *c TSRMLS_DC)
 		}
 	}
 
-	if ((strncmp(name, "__COMPILER_HALT_OFFSET__", sizeof("__COMPILER_HALT_OFFSET__") - 1) == 0) ||
-			zend_hash_add(EG(zend_constants), name, c->name_len, (void *) c, sizeof(zend_constant), NULL)==FAILURE) {
+	/* Check if the user is trying to define the internal pseudo constant name __COMPILER_HALT_OFFSET__ */
+	if ((c->name_len == sizeof("__COMPILER_HALT_OFFSET__")
+		&& !memcmp(name, "__COMPILER_HALT_OFFSET__", sizeof("__COMPILER_HALT_OFFSET__")-1))
+		|| zend_hash_add(EG(zend_constants), name, c->name_len, (void *) c, sizeof(zend_constant), NULL)==FAILURE) {
+		
+		/* The internal __COMPILER_HALT_OFFSET__ is prefixed by NULL byte */
+		if (c->name[0] == '\0' && c->name_len > sizeof("\0__COMPILER_HALT_OFFSET__")
+			&& memcmp(name, "\0__COMPILER_HALT_OFFSET__", sizeof("\0__COMPILER_HALT_OFFSET__")) == 0) {
+			name++;
+		}
 		zend_error(E_NOTICE,"Constant %s already defined", name);
 		free(c->name);
 		if (!(c->flags & CONST_PERSISTENT)) {

Zend/zend_exceptions.c

@@ -137,7 +137,7 @@ static zend_object_value zend_default_exception_new_ex(zend_class_entry *class_t
 
 	ALLOC_HASHTABLE(object->properties);
 	zend_hash_init(object->properties, 0, NULL, ZVAL_PTR_DTOR, 0);
-	zend_hash_copy(object->properties, &class_type->default_properties, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
+	zend_hash_copy(object->properties, &class_type->default_properties, zval_copy_property_ctor(class_type), (void *) &tmp, sizeof(zval *));
 
 	ALLOC_ZVAL(trace);
 	Z_UNSET_ISREF_P(trace);
@@ -572,6 +572,7 @@ ZEND_METHOD(exception, __toString)
 		zend_call_function(&fci, NULL TSRMLS_CC);
 
 		if (Z_TYPE_P(trace) != IS_STRING) {
+			zval_ptr_dtor(&trace);
 			trace = NULL;
 		}
 
@@ -592,6 +593,10 @@ ZEND_METHOD(exception, __toString)
 		zval_dtor(&line);
 
 		exception = zend_read_property(default_exception_ce, exception, "previous", sizeof("previous")-1, 0 TSRMLS_CC);
+
+		if (trace) {
+			zval_ptr_dtor(&trace);
+		}
 	}
 	zval_dtor(&fname);
 
@@ -599,10 +604,6 @@ ZEND_METHOD(exception, __toString)
 	 * the result in uncaught exception handlers without memleaks. */
 	zend_update_property_string(default_exception_ce, getThis(), "string", sizeof("string")-1, str TSRMLS_CC);
 
-	if (trace) {
-		zval_ptr_dtor(&trace);
-	}
-
 	RETURN_STRINGL(str, len, 0);
 }
 /* }}} */

Zend/zend_execute.c

@@ -708,13 +708,14 @@ static inline zval* zend_assign_to_variable(zval **variable_ptr_ptr, zval *value
 				return variable_ptr;
 			}
 		} else { /* we need to split */
+			GC_ZVAL_CHECK_POSSIBLE_ROOT(*variable_ptr_ptr);
 			if (!is_tmp_var) {
 				if (PZVAL_IS_REF(value) && Z_REFCOUNT_P(value) > 0) {
 					ALLOC_ZVAL(variable_ptr);
 					*variable_ptr_ptr = variable_ptr;
 					*variable_ptr = *value;
-					zval_copy_ctor(variable_ptr);
 					Z_SET_REFCOUNT_P(variable_ptr, 1);
+					zval_copy_ctor(variable_ptr);
 				} else {
 					*variable_ptr_ptr = value;
 					Z_ADDREF_P(value);

Zend/zend_execute.h

@@ -135,6 +135,8 @@ static inline int i_zend_is_true(zval *op)
 }
 
 ZEND_API int zval_update_constant(zval **pp, void *arg TSRMLS_DC);
+ZEND_API int zval_update_constant_inline_change(zval **pp, void *arg TSRMLS_DC);
+ZEND_API int zval_update_constant_no_inline_change(zval **pp, void *arg TSRMLS_DC);
 ZEND_API int zval_update_constant_ex(zval **pp, void *arg, zend_class_entry *scope TSRMLS_DC);
 
 /* dedicated Zend executor functions - do not use! */

Zend/zend_execute_API.c

@@ -411,6 +411,10 @@ ZEND_API char *zend_get_executed_filename(TSRMLS_D) /* {{{ */
 
 ZEND_API uint zend_get_executed_lineno(TSRMLS_D) /* {{{ */
 {
+	if(EG(exception) && EG(opline_ptr) && active_opline->opcode == ZEND_HANDLE_EXCEPTION && 
+		active_opline->lineno == 0 && EG(opline_before_exception)) {
+		return EG(opline_before_exception)->lineno;
+	}
 	if (EG(opline_ptr)) {
 		return active_opline->lineno;
 	} else {
@@ -680,13 +684,25 @@ ZEND_API int zval_update_constant_ex(zval **pp, void *arg, zend_class_entry *sco
 			}
 			zval_dtor(&const_value);
 		}
-		zend_hash_apply_with_argument(Z_ARRVAL_P(p), (apply_func_arg_t) zval_update_constant, (void *) 1 TSRMLS_CC);
+		zend_hash_apply_with_argument(Z_ARRVAL_P(p), (apply_func_arg_t) zval_update_constant_inline_change, (void *) scope TSRMLS_CC);
 		zend_hash_internal_pointer_reset(Z_ARRVAL_P(p));
 	}
 	return 0;
 }
 /* }}} */
 
+ZEND_API int zval_update_constant_inline_change(zval **pp, void *scope TSRMLS_DC) /* {{{ */
+{
+	return zval_update_constant_ex(pp, (void*)1, scope TSRMLS_CC);
+}
+/* }}} */
+
+ZEND_API int zval_update_constant_no_inline_change(zval **pp, void *scope TSRMLS_DC) /* {{{ */
+{
+	return zval_update_constant_ex(pp, (void*)0, scope TSRMLS_CC);
+}
+/* }}} */
+
 ZEND_API int zval_update_constant(zval **pp, void *arg TSRMLS_DC) /* {{{ */
 {
 	return zval_update_constant_ex(pp, arg, NULL TSRMLS_CC);
@@ -854,7 +870,8 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache TS
 			if (Z_REFCOUNT_PP(fci->params[i]) > 1) {
 				zval *new_zval;
 
-				if (fci->no_separation) {
+				if (fci->no_separation &&
+				    !ARG_MAY_BE_SENT_BY_REF(EX(function_state).function, i + 1)) {
 					if(i) {
 						/* hack to clean up the stack */
 						zend_vm_stack_push_nocheck((void *) (zend_uintptr_t)i TSRMLS_CC);

Zend/zend_float.h

@@ -78,7 +78,9 @@ extern ZEND_API void zend_ensure_fpu_mode(TSRMLS_D);
 #  define HAVE__CONTROLFP
 # endif /* MSC_VER >= 1500 */
   /* Tell MSVC optimizer that we access FP environment */
-# pragma fenv_access (on)
+# if _MSC_VER >= 1500
+#  pragma fenv_access (on)
+# endif
 #endif /* _MSC_VER */
 
 #ifdef HAVE__CONTROLFP_S

Zend/zend_gc.c

@@ -282,7 +282,11 @@ tail_call:
 			GC_SET_BLACK(obj->buffered);
 			if (EXPECTED(EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(pz)].valid &&
 			             Z_OBJ_HANDLER_P(pz, get_properties) != NULL)) {
-				p = Z_OBJPROP_P(pz)->pListHead;
+				HashTable *props = Z_OBJPROP_P(pz);
+				if(!props) {
+					return;
+				}
+				p = props->pListHead;
 			}
 		}
 	} else if (Z_TYPE_P(pz) == IS_ARRAY) {
@@ -313,7 +317,11 @@ static void zobj_scan_black(struct _store_object *obj, zval *pz TSRMLS_DC)
 	GC_SET_BLACK(obj->buffered);
 	if (EXPECTED(EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(pz)].valid &&
 	             Z_OBJ_HANDLER_P(pz, get_properties) != NULL)) {
-		p = Z_OBJPROP_P(pz)->pListHead;
+		HashTable *props = Z_OBJPROP_P(pz);
+		if(!props) {
+			return;
+		}
+		p = props->pListHead;
 		while (p != NULL) {
 			pz = *(zval**)p->pData;
 			if (Z_TYPE_P(pz) != IS_ARRAY || Z_ARRVAL_P(pz) != &EG(symbol_table)) {
@@ -346,7 +354,11 @@ tail_call:
 				GC_SET_COLOR(obj->buffered, GC_GREY);
 				if (EXPECTED(EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(pz)].valid &&
 				             Z_OBJ_HANDLER_P(pz, get_properties) != NULL)) {
-					p = Z_OBJPROP_P(pz)->pListHead;
+					HashTable *props = Z_OBJPROP_P(pz);
+					if(!props) {
+						return;
+					}
+					p = props->pListHead;
 				}
 			}
 		} else if (Z_TYPE_P(pz) == IS_ARRAY) {
@@ -380,7 +392,11 @@ static void zobj_mark_grey(struct _store_object *obj, zval *pz TSRMLS_DC)
 		GC_SET_COLOR(obj->buffered, GC_GREY);
 		if (EXPECTED(EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(pz)].valid &&
 		             Z_OBJ_HANDLER_P(pz, get_properties) != NULL)) {
-			p = Z_OBJPROP_P(pz)->pListHead;
+			HashTable *props = Z_OBJPROP_P(pz);
+			if(!props) {
+				return;
+			}
+			p = props->pListHead;
 			while (p != NULL) {
 				pz = *(zval**)p->pData;
 				if (Z_TYPE_P(pz) != IS_ARRAY || Z_ARRVAL_P(pz) != &EG(symbol_table)) {
@@ -398,19 +414,21 @@ static void gc_mark_roots(TSRMLS_D)
 	gc_root_buffer *current = GC_G(roots).next;
 
 	while (current != &GC_G(roots)) {
-		if (current->handle && EG(objects_store).object_buckets) {
-			struct _store_object *obj = &EG(objects_store).object_buckets[current->handle].bucket.obj;
+		if (current->handle) {
+			if (EG(objects_store).object_buckets) {
+				struct _store_object *obj = &EG(objects_store).object_buckets[current->handle].bucket.obj;
 
-			if (GC_GET_COLOR(obj->buffered) == GC_PURPLE) {
-				zval z;
+				if (GC_GET_COLOR(obj->buffered) == GC_PURPLE) {
+					zval z;
 
-				INIT_PZVAL(&z);
-				Z_OBJ_HANDLE(z) = current->handle;
-				Z_OBJ_HT(z) = current->u.handlers;
-				zobj_mark_grey(obj, &z TSRMLS_CC);
-			} else {
-				GC_SET_ADDRESS(obj->buffered, NULL);
-				GC_REMOVE_FROM_BUFFER(current);
+					INIT_PZVAL(&z);
+					Z_OBJ_HANDLE(z) = current->handle;
+					Z_OBJ_HT(z) = current->u.handlers;
+					zobj_mark_grey(obj, &z TSRMLS_CC);
+				} else {
+					GC_SET_ADDRESS(obj->buffered, NULL);
+					GC_REMOVE_FROM_BUFFER(current);
+				}
 			}
 		} else {
 			if (GC_ZVAL_GET_COLOR(current->u.pz) == GC_PURPLE) {
@@ -445,7 +463,11 @@ tail_call:
 						GC_SET_COLOR(obj->buffered, GC_WHITE);
 						if (EXPECTED(EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(pz)].valid &&
 						             Z_OBJ_HANDLER_P(pz, get_properties) != NULL)) {
-							p = Z_OBJPROP_P(pz)->pListHead;
+							HashTable *props = Z_OBJPROP_P(pz);
+							if(!props) {
+								return 0;
+							}
+							p = props->pListHead;
 						}
 					}
 				}
@@ -484,7 +506,11 @@ static void zobj_scan(zval *pz TSRMLS_DC)
 				GC_SET_COLOR(obj->buffered, GC_WHITE);
 				if (EXPECTED(EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(pz)].valid &&
 				             Z_OBJ_HANDLER_P(pz, get_properties) != NULL)) {
-					p = Z_OBJPROP_P(pz)->pListHead;
+					HashTable *props = Z_OBJPROP_P(pz);
+					if(!props) {
+						return;
+					}
+					p = props->pListHead;
 					while (p != NULL) {
 						zval_scan(*(zval**)p->pData TSRMLS_CC);
 						p = p->pListNext;
@@ -531,7 +557,11 @@ tail_call:
 
 				if (EXPECTED(EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(pz)].valid &&
 				             Z_OBJ_HANDLER_P(pz, get_properties) != NULL)) {
-					p = Z_OBJPROP_P(pz)->pListHead;
+					HashTable *props = Z_OBJPROP_P(pz);
+					if(!props) {
+						return;
+					}
+					p = props->pListHead;
 				}
 			}
 		} else {
@@ -572,7 +602,11 @@ static void zobj_collect_white(zval *pz TSRMLS_DC)
 
 			if (EXPECTED(EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(pz)].valid &&
 			             Z_OBJ_HANDLER_P(pz, get_properties) != NULL)) {
-				p = Z_OBJPROP_P(pz)->pListHead;
+				HashTable *props = Z_OBJPROP_P(pz);
+				if(!props) {
+					return;
+				}
+				p = props->pListHead;
 				while (p != NULL) {
 					pz = *(zval**)p->pData;
 					if (Z_TYPE_P(pz) != IS_ARRAY || Z_ARRVAL_P(pz) != &EG(symbol_table)) {
@@ -591,15 +625,17 @@ static void gc_collect_roots(TSRMLS_D)
 	gc_root_buffer *current = GC_G(roots).next;
 
 	while (current != &GC_G(roots)) {
-		if (current->handle && EG(objects_store).object_buckets) {
-			struct _store_object *obj = &EG(objects_store).object_buckets[current->handle].bucket.obj;
-			zval z;
+		if (current->handle) {
+			if (EG(objects_store).object_buckets) {
+				struct _store_object *obj = &EG(objects_store).object_buckets[current->handle].bucket.obj;
+				zval z;
 
-			GC_SET_ADDRESS(obj->buffered, NULL);
-			INIT_PZVAL(&z);
-			Z_OBJ_HANDLE(z) = current->handle;
-			Z_OBJ_HT(z) = current->u.handlers;
-			zobj_collect_white(&z TSRMLS_CC);
+				GC_SET_ADDRESS(obj->buffered, NULL);
+				INIT_PZVAL(&z);
+				Z_OBJ_HANDLE(z) = current->handle;
+				Z_OBJ_HT(z) = current->u.handlers;
+				zobj_collect_white(&z TSRMLS_CC);
+			}
 		} else {
 			GC_ZVAL_SET_ADDRESS(current->u.pz, NULL);
 			zval_collect_white(current->u.pz TSRMLS_CC);

Zend/zend_hash.c

@@ -63,6 +63,9 @@ static void _zend_is_inconsistent(const HashTable *ht, const char *file, int lin
 		case HT_CLEANING:
 			zend_output_debug_string(1, "%s(%d) : ht=%p is being cleaned", file, line, ht);
 			break;
+		default:
+			zend_output_debug_string(1, "%s(%d) : ht=%p is inconsistent", file, line, ht);
+			break;
 	}
 	zend_bailout();
 }
@@ -1455,7 +1458,7 @@ ZEND_API int zend_hash_compare(HashTable *ht1, HashTable *ht2, compare_func_t co
 					return 1;
 				}
 			} else { /* string index */
-				if (zend_hash_find(ht2, p1->arKey, p1->nKeyLength, &pData2)==FAILURE) {
+				if (zend_hash_quick_find(ht2, p1->arKey, p1->nKeyLength, p1->h, &pData2)==FAILURE) {
 					HASH_UNPROTECT_RECURSION(ht1); 
 					HASH_UNPROTECT_RECURSION(ht2); 
 					return 1;

Zend/zend_hash.h

@@ -312,7 +312,7 @@ END_EXTERN_C()
 	}																		\
 	if (*tmp >= '0' && *tmp <= '9') { /* possibly a numeric index */		\
 		const char *end = key + length - 1;									\
-		long idx;															\
+		ulong idx;															\
 																			\
 		if ((*end != '\0') /* not a null terminated string */				\
 		 || (*tmp == '0' && length > 2) /* numbers with leading zeros */	\
@@ -328,11 +328,11 @@ END_EXTERN_C()
 		}																	\
 		if (tmp == end) {													\
 			if (*key == '-') {												\
-				idx = -idx;													\
-				if (idx > 0) { /* overflow */								\
+				if (idx-1 > LONG_MAX) { /* overflow */						\
 					break;													\
 				}															\
-			} else if (idx < 0) { /* overflow */							\
+				idx = (ulong)(-(long)idx);									\
+			} else if (idx > LONG_MAX) { /* overflow */						\
 				break;														\
 			}																\
 			return func;													\

Zend/zend_ini_parser.y

@@ -304,7 +304,7 @@ statement:
 ;
 
 section_string_or_value:
-		var_string_list					{ $$ = $1; }
+		var_string_list_section			{ $$ = $1; }
 	|	/* empty */						{ zend_ini_init_string(&$$); }
 ;
 
@@ -326,6 +326,15 @@ encapsed_list:
 	|	/* empty */						{ zend_ini_init_string(&$$); }
 ;
 
+var_string_list_section:
+		cfg_var_ref						{ $$ = $1; }
+	|	constant_literal				{ $$ = $1; }
+	|	'"' encapsed_list '"'			{ $$ = $2; }
+	|	var_string_list_section cfg_var_ref 	{ zend_ini_add_string(&$$, &$1, &$2); free(Z_STRVAL($2)); }
+	|	var_string_list_section constant_literal	{ zend_ini_add_string(&$$, &$1, &$2); free(Z_STRVAL($2)); }
+	|	var_string_list_section '"' encapsed_list '"'  { zend_ini_add_string(&$$, &$1, &$3); free(Z_STRVAL($3)); }
+;
+
 var_string_list:
 		cfg_var_ref						{ $$ = $1; }
 	|	constant_string					{ $$ = $1; }
@@ -348,6 +357,14 @@ cfg_var_ref:
 		TC_DOLLAR_CURLY TC_VARNAME '}'	{ zend_ini_get_var(&$$, &$2 TSRMLS_CC); free(Z_STRVAL($2)); }
 ;
 
+constant_literal:
+		TC_CONSTANT						{ $$ = $1; }
+	|	TC_RAW							{ $$ = $1; /*printf("TC_RAW: '%s'\n", Z_STRVAL($1));*/ }
+	|	TC_NUMBER						{ $$ = $1; /*printf("TC_NUMBER: '%s'\n", Z_STRVAL($1));*/ }
+	|	TC_STRING						{ $$ = $1; /*printf("TC_STRING: '%s'\n", Z_STRVAL($1));*/ }
+	|	TC_WHITESPACE					{ $$ = $1; /*printf("TC_WHITESPACE: '%s'\n", Z_STRVAL($1));*/ }
+;
+
 constant_string:
 		TC_CONSTANT						{ zend_ini_get_constant(&$$, &$1 TSRMLS_CC); }
 	|	TC_RAW							{ $$ = $1; /*printf("TC_RAW: '%s'\n", Z_STRVAL($1));*/ }

Zend/zend_ini_scanner.l

@@ -315,7 +315,7 @@ restart:
 	if (YYCURSOR >= YYLIMIT) {
 		if (YYSTATE == STATE(ST_VALUE) || YYSTATE == STATE(ST_RAW)) {
 			BEGIN(INITIAL);
-			return 0;
+			return END_OF_LINE;
 		}
 		return 0;
 	}
@@ -344,7 +344,7 @@ DOLLAR_CURLY "${"
 
 SECTION_RAW_CHARS [^\]\n\r]
 SINGLE_QUOTED_CHARS [^']
-RAW_VALUE_CHARS [^\n\r;]
+RAW_VALUE_CHARS [^\n\r;\000]
 
 LITERAL_DOLLAR ("$"([^{\000]|("\\"{ANY_CHAR})))
 VALUE_CHARS         ([^$= \t\n\r;&|~()!"'\000]|{LITERAL_DOLLAR})

Zend/zend_ini_scanner_defs.h

@@ -1,4 +1,4 @@
-/* Generated by re2c 0.13.5 on Sun Feb  7 13:25:37 2010 */
+/* Generated by re2c 0.13.5 on Sun Aug  1 12:07:43 2010 */
 #line 3 "Zend/zend_ini_scanner_defs.h"
 
 enum YYCONDTYPE {

Zend/zend_language_scanner.l

@@ -139,8 +139,10 @@ static void yy_pop_state(TSRMLS_D)
 static void yy_scan_buffer(char *str, unsigned int len TSRMLS_DC)
 {
 	YYCURSOR       = (YYCTYPE*)str;
-	SCNG(yy_start) = YYCURSOR;
 	YYLIMIT        = YYCURSOR + len;
+	if (!SCNG(yy_start)) {
+		SCNG(yy_start) = YYCURSOR;
+	}
 }
 
 void startup_scanner(TSRMLS_D)
@@ -241,7 +243,14 @@ ZEND_API void zend_destroy_file_handle(zend_file_handle *file_handle TSRMLS_DC)
 ZEND_API int open_file_for_scanning(zend_file_handle *file_handle TSRMLS_DC)
 {
 	char *file_path = NULL, *buf;
-	size_t size;
+	size_t size, offset = 0;
+	
+	/* The shebang line was read, get the current position to obtain the buffer start */
+	if (CG(start_lineno) == 2 && file_handle->type == ZEND_HANDLE_FP && file_handle->handle.fp) {
+		if ((offset = ftell(file_handle->handle.fp)) == -1) {
+			offset = 0;
+		}
+	}
 
 	if (zend_stream_fixup(file_handle, &buf, &size TSRMLS_CC) == FAILURE) {
 		return FAILURE;
@@ -257,6 +266,7 @@ ZEND_API int open_file_for_scanning(zend_file_handle *file_handle TSRMLS_DC)
 
 	/* Reset the scanner for scanning the new file */
 	SCNG(yy_in) = file_handle;
+	SCNG(yy_start) = NULL;
 
 	if (size != -1) {
 #ifdef ZEND_MULTIBYTE
@@ -274,10 +284,15 @@ ZEND_API int open_file_for_scanning(zend_file_handle *file_handle TSRMLS_DC)
 			SCNG(script_filtered_size) = SCNG(script_org_size);
 		} else {
 			SCNG(input_filter)(&SCNG(script_filtered), &SCNG(script_filtered_size), SCNG(script_org), SCNG(script_org_size) TSRMLS_CC);
+			if (SCNG(script_filtered) == NULL) {
+				zend_error_noreturn(E_COMPILE_ERROR, "Could not convert the script from the detected "
+						"encoding \"%s\" to a compatible encoding", LANG_SCNG(script_encoding)->name);
+			}
 		}
-
+		SCNG(yy_start) = SCNG(script_filtered) - offset;
 		yy_scan_buffer((char *)SCNG(script_filtered), SCNG(script_filtered_size) TSRMLS_CC);
 #else /* !ZEND_MULTIBYTE */
+		SCNG(yy_start) = buf - offset;
 		yy_scan_buffer(buf, size TSRMLS_CC);
 #endif /* ZEND_MULTIBYTE */
 	} else {
@@ -413,6 +428,7 @@ ZEND_API int zend_prepare_string_for_scanning(zval *str, char *filename TSRMLS_D
 	memset(str->value.str.val + str->value.str.len, 0, ZEND_MMAP_AHEAD);
 
 	SCNG(yy_in)=NULL;
+	SCNG(yy_start) = NULL;
 
 #ifdef ZEND_MULTIBYTE
 	SCNG(script_org) = (unsigned char *)estrdup(str->value.str.val);

Zend/zend_language_scanner_defs.h

@@ -1,4 +1,4 @@
-/* Generated by re2c 0.13.5 on Mon Jan 11 14:20:20 2010 */
+/* Generated by re2c 0.13.5 on Tue Jun 29 08:18:52 2010 */
 #line 3 "Zend/zend_language_scanner_defs.h"
 
 enum YYCONDTYPE {

Zend/zend_object_handlers.c

@@ -340,13 +340,16 @@ zval *zend_std_read_property(zval *object, zval *member, int type TSRMLS_DC) /*
 	property_info = zend_get_property_info(zobj->ce, member, (zobj->ce->__get != NULL) TSRMLS_CC);
 
 	if (!property_info || zend_hash_quick_find(zobj->properties, property_info->name, property_info->name_length+1, property_info->h, (void **) &retval) == FAILURE) {
-		zend_guard *guard;
+		zend_guard *guard = NULL;
 
 		if (zobj->ce->__get &&
 		    zend_get_property_guard(zobj, property_info, member, &guard) == SUCCESS &&
 		    !guard->in_get) {
 			/* have getter - try with it! */
 			Z_ADDREF_P(object);
+			if (PZVAL_IS_REF(object)) {
+				SEPARATE_ZVAL(&object);
+			}
 			guard->in_get = 1; /* prevent circular getting */
 			rv = zend_std_call_getter(object, member TSRMLS_CC);
 			guard->in_get = 0;
@@ -373,6 +376,15 @@ zval *zend_std_read_property(zval *object, zval *member, int type TSRMLS_DC) /*
 			}
 			zval_ptr_dtor(&object);
 		} else {
+			if (zobj->ce->__get && guard && guard->in_get == 1) {
+				if (Z_STRVAL_P(member)[0] == '\0') {
+					if (Z_STRLEN_P(member) == 0) {
+						zend_error(E_ERROR, "Cannot access empty property");
+					} else {
+						zend_error(E_ERROR, "Cannot access property started with '\\0'");
+					}
+				}
+			}
 			if (!silent) {
 				zend_error(E_NOTICE,"Undefined property: %s::$%s", zobj->ce->name, Z_STRVAL_P(member));
 			}
@@ -436,22 +448,22 @@ static void zend_std_write_property(zval *object, zval *member, zval *value TSRM
 			}
 		}
 	} else {
-		int setter_done = 0;
-		zend_guard *guard;
+		zend_guard *guard = NULL;
 
 		if (zobj->ce->__set &&
 		    zend_get_property_guard(zobj, property_info, member, &guard) == SUCCESS &&
 		    !guard->in_set) {
 			Z_ADDREF_P(object);
+			if (PZVAL_IS_REF(object)) {
+				SEPARATE_ZVAL(&object);
+			}
 			guard->in_set = 1; /* prevent circular setting */
 			if (zend_std_call_setter(object, member, value TSRMLS_CC) != SUCCESS) {
 				/* for now, just ignore it - __set should take care of warnings, etc. */
 			}
-			setter_done = 1;
 			guard->in_set = 0;
 			zval_ptr_dtor(&object);
-		}
-		if (!setter_done && property_info) {
+		} else if (property_info) {
 			zval **foo;
 
 			/* if we assign referenced variable, we should separate it */
@@ -460,6 +472,14 @@ static void zend_std_write_property(zval *object, zval *member, zval *value TSRM
 				SEPARATE_ZVAL(&value);
 			}
 			zend_hash_quick_update(zobj->properties, property_info->name, property_info->name_length+1, property_info->h, &value, sizeof(zval *), (void **) &foo);
+		} else if (zobj->ce->__set && guard && guard->in_set == 1) {
+			if (Z_STRVAL_P(member)[0] == '\0') {
+				if (Z_STRLEN_P(member) == 0) {
+					zend_error(E_ERROR, "Cannot access empty property");
+				} else {
+					zend_error(E_ERROR, "Cannot access property started with '\\0'");
+				}
+			}
 		}
 	}
 
@@ -619,17 +639,28 @@ static void zend_std_unset_property(zval *object, zval *member TSRMLS_DC) /* {{{
 	property_info = zend_get_property_info(zobj->ce, member, (zobj->ce->__unset != NULL) TSRMLS_CC);
 
 	if (!property_info || zend_hash_quick_del(zobj->properties, property_info->name, property_info->name_length+1, property_info->h) == FAILURE) {
-		zend_guard *guard;
+		zend_guard *guard = NULL;
 
 		if (zobj->ce->__unset &&
 		    zend_get_property_guard(zobj, property_info, member, &guard) == SUCCESS &&
 		    !guard->in_unset) {
 			/* have unseter - try with it! */
 			Z_ADDREF_P(object);
+			if (PZVAL_IS_REF(object)) {
+				SEPARATE_ZVAL(&object);
+			}
 			guard->in_unset = 1; /* prevent circular unsetting */
 			zend_std_call_unsetter(object, member TSRMLS_CC);
 			guard->in_unset = 0;
 			zval_ptr_dtor(&object);
+		} else if (zobj->ce->__unset && guard && guard->in_unset == 1) {
+			if (Z_STRVAL_P(member)[0] == '\0') {
+				if (Z_STRLEN_P(member) == 0) {
+					zend_error(E_ERROR, "Cannot access empty property");
+				} else {
+					zend_error(E_ERROR, "Cannot access property started with '\\0'");
+				}
+			}
 		}
 	}
 
@@ -945,7 +976,7 @@ ZEND_API zend_function *zend_std_get_static_method(zend_class_entry *ce, char *f
 		/* Only change the method to the constructor if the constructor isn't called __construct
 		 * we check for __ so we can be binary safe for lowering, we should use ZEND_CONSTRUCTOR_FUNC_NAME
 		 */
-		if (!memcmp(lc_class_name, function_name_strval, function_name_strlen) && memcmp(ce->constructor->common.function_name, "__", sizeof("__") - 1)) {
+		if (!memcmp(lc_class_name, lc_function_name, function_name_strlen) && memcmp(ce->constructor->common.function_name, "__", sizeof("__") - 1)) {
 			fbc = ce->constructor;
 		}
 		efree(lc_class_name);
@@ -953,13 +984,13 @@ ZEND_API zend_function *zend_std_get_static_method(zend_class_entry *ce, char *f
 	if (!fbc && zend_hash_find(&ce->function_table, lc_function_name, function_name_strlen+1, (void **) &fbc)==FAILURE) {
 		efree(lc_function_name);
 
-		if (ce->__callstatic) {
-			return zend_get_user_callstatic_function(ce, function_name_strval, function_name_strlen);
-		} else if (ce->__call &&
+		if (ce->__call &&
 		    EG(This) &&
 		    Z_OBJ_HT_P(EG(This))->get_class_entry &&
 		    instanceof_function(Z_OBJCE_P(EG(This)), ce TSRMLS_CC)) {
 			return zend_get_user_call_function(ce, function_name_strval, function_name_strlen);
+		} else if (ce->__callstatic) {
+			return zend_get_user_callstatic_function(ce, function_name_strval, function_name_strlen);
 		} else {
 	   		return NULL;
 		}
@@ -1144,6 +1175,9 @@ static int zend_std_has_property(zval *object, zval *member, int has_set_exists
 
 			/* have issetter - try with it! */
 			Z_ADDREF_P(object);
+			if (PZVAL_IS_REF(object)) {
+				SEPARATE_ZVAL(&object);
+			}
 			guard->in_isset = 1; /* prevent circular getting */
 			rv = zend_std_call_issetter(object, member TSRMLS_CC);
 			if (rv) {

Zend/zend_objects.c

@@ -52,6 +52,7 @@ ZEND_API void zend_objects_destroy_object(zend_object *object, zend_object_handl
 	zend_function *destructor = object ? object->ce->destructor : NULL;
 
 	if (destructor) {
+		zval *old_exception;
 		zval *obj;
 		zend_object_store_bucket *obj_bucket;
 
@@ -99,12 +100,23 @@ ZEND_API void zend_objects_destroy_object(zend_object *object, zend_object_handl
 		 * For example, if an exception was thrown in a function and when the function's
 		 * local variable destruction results in a destructor being called.
 		 */
-		if (EG(exception) && Z_OBJ_HANDLE_P(EG(exception)) == handle) {
-			zend_error(E_ERROR, "Attempt to destruct pending exception");
+		old_exception = NULL;
+		if (EG(exception)) {
+			if (Z_OBJ_HANDLE_P(EG(exception)) == handle) {
+				zend_error(E_ERROR, "Attempt to destruct pending exception");
+			} else {
+				old_exception = EG(exception);
+				EG(exception) = NULL;
+			}
 		}
-		zend_exception_save(TSRMLS_C);
 		zend_call_method_with_0_params(&obj, object->ce, &destructor, ZEND_DESTRUCTOR_FUNC_NAME, NULL);
-		zend_exception_restore(TSRMLS_C);
+		if (old_exception) {
+			if (EG(exception)) {
+				zend_exception_set_previous(EG(exception), old_exception TSRMLS_CC);
+			} else {
+				EG(exception) = old_exception;
+			}
+		}
 		zval_ptr_dtor(&obj);
 	}
 }
@@ -134,7 +146,7 @@ ZEND_API zend_object *zend_objects_get_address(const zval *zobject TSRMLS_DC)
 
 ZEND_API void zend_objects_clone_members(zend_object *new_object, zend_object_value new_obj_val, zend_object *old_object, zend_object_handle handle TSRMLS_DC)
 {
-	zend_hash_copy(new_object->properties, old_object->properties, (copy_ctor_func_t) zval_add_ref, (void *) NULL /* Not used anymore */, sizeof(zval *));
+	zend_hash_copy(new_object->properties, old_object->properties, zval_copy_property_ctor(old_object->ce), (void *) NULL /* Not used anymore */, sizeof(zval *));
 
 	if (old_object->ce->clone) {
 		zval *new_obj;

Zend/zend_opcode.c

@@ -159,7 +159,10 @@ ZEND_API int zend_cleanup_class_data(zend_class_entry **pce TSRMLS_DC)
 		/* Note that only run-time accessed data need to be cleaned up, pre-defined data can
 		   not contain objects and thus are not probelmatic */
 		zend_hash_apply(&(*pce)->function_table, (apply_func_t) zend_cleanup_function_data_full TSRMLS_CC);
-		(*pce)->static_members = NULL;
+		if ((*pce)->static_members) {
+			zend_hash_clean((*pce)->static_members);
+			(*pce)->static_members = NULL;
+		}
 	} else if (CE_STATIC_MEMBERS(*pce)) {
 		zend_hash_destroy(CE_STATIC_MEMBERS(*pce));
 		FREE_HASHTABLE(CE_STATIC_MEMBERS(*pce));

Zend/zend_operators.c

@@ -30,6 +30,7 @@
 #include "zend_multiply.h"
 #include "zend_strtod.h"
 #include "zend_exceptions.h"
+#include "zend_closures.h"
 
 #define LONG_SIGN_MASK (1L << (8*sizeof(long)-1))
 
@@ -646,7 +647,14 @@ ZEND_API void convert_to_array(zval *op) /* {{{ */
 
 				ALLOC_HASHTABLE(ht);
 				zend_hash_init(ht, 0, NULL, ZVAL_PTR_DTOR, 0);
-				if (Z_OBJ_HT_P(op)->get_properties) {
+				if (Z_OBJCE_P(op) == zend_ce_closure) {
+					convert_scalar_to_array(op, IS_ARRAY TSRMLS_CC);
+					if (Z_TYPE_P(op) == IS_ARRAY) {
+						zend_hash_destroy(ht);
+						FREE_HASHTABLE(ht);
+						return;
+					}
+				} else if (Z_OBJ_HT_P(op)->get_properties) {
 					HashTable *obj_ht = Z_OBJ_HT_P(op)->get_properties(op TSRMLS_CC);
 					if (obj_ht) {
 						zend_hash_copy(ht, obj_ht, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
@@ -965,8 +973,10 @@ ZEND_API int div_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{{ *
 ZEND_API int mod_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{{ */
 {
 	zval op1_copy, op2_copy;
+	long op1_lval;
 
 	zendi_convert_to_long(op1, op1_copy, result);
+	op1_lval = Z_LVAL_P(op1);
 	zendi_convert_to_long(op2, op2_copy, result);
 
 	if (Z_LVAL_P(op2) == 0) {
@@ -981,7 +991,7 @@ ZEND_API int mod_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{{ *
 		return SUCCESS;
 	}
 
-	ZVAL_LONG(result, Z_LVAL_P(op1) % Z_LVAL_P(op2));
+	ZVAL_LONG(result, op1_lval % Z_LVAL_P(op2));
 	return SUCCESS;
 }
 /* }}} */
@@ -989,10 +999,12 @@ ZEND_API int mod_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{{ *
 ZEND_API int boolean_xor_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{{ */
 {
 	zval op1_copy, op2_copy;
+	long op1_lval;
 
 	zendi_convert_to_boolean(op1, op1_copy, result);
+	op1_lval = Z_LVAL_P(op1);
 	zendi_convert_to_boolean(op2, op2_copy, result);
-	ZVAL_BOOL(result, Z_LVAL_P(op1) ^ Z_LVAL_P(op2));
+	ZVAL_BOOL(result, op1_lval ^ Z_LVAL_P(op2));
 	return SUCCESS;
 }
 /* }}} */
@@ -1038,6 +1050,7 @@ ZEND_API int bitwise_not_function(zval *result, zval *op1 TSRMLS_DC) /* {{{ */
 ZEND_API int bitwise_or_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{{ */
 {
 	zval op1_copy, op2_copy;
+	long op1_lval;
 
 	if (Z_TYPE_P(op1) == IS_STRING && Z_TYPE_P(op2) == IS_STRING) {
 		zval *longer, *shorter;
@@ -1066,9 +1079,10 @@ ZEND_API int bitwise_or_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /
 		return SUCCESS;
 	}
 	zendi_convert_to_long(op1, op1_copy, result);
+	op1_lval = Z_LVAL_P(op1);
 	zendi_convert_to_long(op2, op2_copy, result);
 
-	ZVAL_LONG(result, Z_LVAL_P(op1) | Z_LVAL_P(op2));
+	ZVAL_LONG(result, op1_lval | Z_LVAL_P(op2));
 	return SUCCESS;
 }
 /* }}} */
@@ -1076,6 +1090,7 @@ ZEND_API int bitwise_or_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /
 ZEND_API int bitwise_and_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{{ */
 {
 	zval op1_copy, op2_copy;
+	long op1_lval;
 
 	if (Z_TYPE_P(op1) == IS_STRING && Z_TYPE_P(op2) == IS_STRING) {
 		zval *longer, *shorter;
@@ -1106,9 +1121,10 @@ ZEND_API int bitwise_and_function(zval *result, zval *op1, zval *op2 TSRMLS_DC)
 
 
 	zendi_convert_to_long(op1, op1_copy, result);
+	op1_lval = Z_LVAL_P(op1);
 	zendi_convert_to_long(op2, op2_copy, result);
 
-	ZVAL_LONG(result, Z_LVAL_P(op1) & Z_LVAL_P(op2));
+	ZVAL_LONG(result, op1_lval & Z_LVAL_P(op2));
 	return SUCCESS;
 }
 /* }}} */
@@ -1116,6 +1132,7 @@ ZEND_API int bitwise_and_function(zval *result, zval *op1, zval *op2 TSRMLS_DC)
 ZEND_API int bitwise_xor_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{{ */
 {
 	zval op1_copy, op2_copy;
+	long op1_lval;
 
 	if (Z_TYPE_P(op1) == IS_STRING && Z_TYPE_P(op2) == IS_STRING) {
 		zval *longer, *shorter;
@@ -1145,9 +1162,10 @@ ZEND_API int bitwise_xor_function(zval *result, zval *op1, zval *op2 TSRMLS_DC)
 	}
 
 	zendi_convert_to_long(op1, op1_copy, result);
+	op1_lval = Z_LVAL_P(op1);
 	zendi_convert_to_long(op2, op2_copy, result);
 
-	ZVAL_LONG(result, Z_LVAL_P(op1) ^ Z_LVAL_P(op2));
+	ZVAL_LONG(result, op1_lval ^ Z_LVAL_P(op2));
 	return SUCCESS;
 }
 /* }}} */
@@ -1155,10 +1173,12 @@ ZEND_API int bitwise_xor_function(zval *result, zval *op1, zval *op2 TSRMLS_DC)
 ZEND_API int shift_left_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{{ */
 {
 	zval op1_copy, op2_copy;
+	long op1_lval;
 
 	zendi_convert_to_long(op1, op1_copy, result);
+	op1_lval = Z_LVAL_P(op1);
 	zendi_convert_to_long(op2, op2_copy, result);
-	ZVAL_LONG(result, Z_LVAL_P(op1) << Z_LVAL_P(op2));
+	ZVAL_LONG(result, op1_lval << Z_LVAL_P(op2));
 	return SUCCESS;
 }
 /* }}} */
@@ -1166,10 +1186,12 @@ ZEND_API int shift_left_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /
 ZEND_API int shift_right_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{{ */
 {
 	zval op1_copy, op2_copy;
+	long op1_lval;
 
 	zendi_convert_to_long(op1, op1_copy, result);
+	op1_lval = Z_LVAL_P(op1);
 	zendi_convert_to_long(op2, op2_copy, result);
-	ZVAL_LONG(result, Z_LVAL_P(op1) >> Z_LVAL_P(op2));
+	ZVAL_LONG(result, op1_lval >> Z_LVAL_P(op2));
 	return SUCCESS;
 }
 /* }}} */