5.4.28

Fix CVE-2013-6420 - memory corruption in openssl_x509_parse
Merge branch 'PHP-5.3' of https://git.php.net/repository/php-src into PHP-5.3
2026-11-11 19:20:50 +00:00 · 2013-12-10 11:04:57 -08:00 · 2013-12-10 11:03:49 -08:00 · 2013-08-19 10:53:41 -07:00 · 2013-08-19 01:02:12 -07:00 · 2013-08-13 22:24:11 -07:00
79 changed files with 2037 additions and 290 deletions
@@ -1,20 +1,89 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2013, PHP 5.3.25
+12 Dec 2013, PHP 5.3.28
+
+- Openssl:
+  . Fixed handling null bytes in subjectAltName (CVE-2013-4073).
+    (Christian Heimes)
+  . Fixed memory corruption in openssl_x509_parse() (CVE-2013-6420).
+    (Stefan Esser).
+
+11 Jul 2013, PHP 5.3.27
+
+- Core:
+  . Fixed bug #64966 (segfault in zend_do_fcall_common_helper_SPEC). (Laruence)
+  . Fixed bug #64960 (Segfault in gc_zval_possible_root). (Laruence)
+  . Fixed bug #64934 (Apache2 TS crash with get_browser()). (Anatol)
+  . Fixed bug #63186 (compile failure on netbsd). (Matteo)
+
+- DateTime:
+  . Fixed bug #53437 (Crash when using unserialized DatePeriod instance).
+    (Gustavo, Derick, Anatol)
+
+- PDO_firebird:
+  . Fixed bug #64037 (Firebird return wrong value for numeric field).
+    (Matheus Degiovani, Matteo)
+  . Fixed bug #62024 (Cannot insert second row with null using parametrized
+    query). (patch by james@kenjim.com, Matheus Degiovani, Matteo)
+
+- PDO_pgsql:
+  . Fixed bug #64949 (Buffer overflow in _pdo_pgsql_error). (Remi)
+
+- pgsql:
+  . Fixed bug #64609 (pg_convert enum type support). (Matteo)
+
+- SPL:
+  . Fixed bug #64997 (Segfault while using RecursiveIteratorIterator on 
+    64-bits systems). (Laruence)
+
+- XML:
+  . Fixed bug #65236 (heap corruption in xml parser). (Rob)
+
+06 Jun 2013, PHP 5.3.26
+
+- Core:
+  . Fixed bug #64879 (Heap based buffer overflow in quoted_printable_encode,
+    CVE 2013-2110). (Stas)
+
+- Calendar:
+  . Fixed bug #64895 (Integer overflow in SndToJewish). (Remi)
+
+- FPM:
+  . Fixed some possible memory or resource leaks and possible null dereference
+    detected by code coverity scan. (Remi)
+  . Log a warning when a syscall fails. (Remi)
+
+- MySQLi:
+  . Fixed bug #64726 (Segfault when calling fetch_object on a use_result and DB
+    pointer has closed). (Laruence)
+
+- Phar
+  . Fixed bug #64214 (PHAR PHPTs intermittently crash when run on DFS, SMB or 
+    with non std tmp dir). (Pierre)
+
+- Streams:
+  . Fixed bug #64770 (stream_select() fails with pipes returned by proc_open()
+    on Windows x64). (Anatol)
+
+- Zend Engine:
+  . Fixed bug #64821 (Custom Exception crash when internal properties
+    overridden). (Anatol)
+
+09 May 2013, PHP 5.3.25

 - Core:
  . Fixed bug #64578 (debug_backtrace in set_error_handler corrupts zend heap: 
    segfault). (Laruence)
  . Fixed bug #64458 (dns_get_record result with string of length -1). (Stas)
-  . Fixed bugs #47675 and #64577 (fd leak on Solaris)
+  . Fixed bugs #47675 and #64577 (fd leak on Solaris). (Rasmus)
+
+- Streams:
+  . Fixed Windows x64 version of stream_socket_pair() and improved error
+    handling. (Anatol Belski)

 - Zip:
  . Fixed bug #64342 (ZipArchive::addFile() has to check for file existence).
-  (Anatol)
-
- Streams:
-  . Fixed Windows x64 version of stream_socket_pair() and improved error handling
-  (Anatol Belski)
+    (Anatol)

 11 Apr 2013, PHP 5.3.24

@@ -45,14 +45,17 @@ Currently we have the following branches in use::

  master    The active development branch. 

-  PHP-5.4   Is used to release the PHP 5.4.x series. It still allows for
-            larger enhancements.
-
-  PHP-5.3   Is used to release the PHP 5.3.x series. This is current 
+  PHP-5.5   Is used to release the PHP 5.5.x series. This is a current
            stable version and is open for bugfixes only.

-  PHP-5.2   Is used to release the PHP 5.2.x series. It is closed for 
-            changes now.
+  PHP-5.4   Is used to release the PHP 5.4.x series. This is a current
+            stable version and is open for bugfixes only.
+
+  PHP-5.3   Is used to release the PHP 5.3.x series. This is currently 
+            in extended support and open forsecurity fixes only. Triaged
+            via security@php.net
+
+  PHP-5.2   This branch is closed.

  PHP-5.1   This branch is closed.

@@ -4,7 +4,7 @@ dnl This file contains local autoconf functions.

 AC_DEFUN([LIBZEND_BISON_CHECK],[
  # we only support certain bison versions
-  bison_version_list="1.28 1.35 1.75 1.875 2.0 2.1 2.2 2.3 2.4 2.4.1 2.4.2 2.4.3 2.5 2.5.1 2.6 2.6.1 2.6.2"
+  bison_version_list="1.28 1.35 1.75 1.875 2.0 2.1 2.2 2.3 2.4 2.4.1 2.4.2 2.4.3 2.5 2.5.1 2.6 2.6.1 2.6.2 2.6.4"

  # for standalone build of Zend Engine
  test -z "$SED" && SED=sed
@@ -0,0 +1,22 @@
+--TEST--
+Bug #64821 Custom Exceptions crash when internal properties overridden (variation 1)
+--FILE--
+<?php
+
+class a extends exception {
+	public function __construct() {
+		$this->message = NULL;
+		$this->string  = NULL;
+		$this->code    = array();
+		$this->line = "hello";
+	}
+}
+
+throw new a;
+
+?>
+--EXPECTF--
+Fatal error: Uncaught exception 'a' in %s:0
+Stack trace:
+#0 {main}
+  thrown in %s on line %d
@@ -0,0 +1,19 @@
+--TEST--
+Bug #64821 Custom Exceptions crash when internal properties overridden (variation 2)
+--FILE--
+<?php
+
+class a extends exception {
+	public function __construct() {
+		$this->line = array();
+	}
+}
+
+throw new a;
+
+?>
+--EXPECTF--
+Fatal error: Uncaught exception 'a' in %s:0
+Stack trace:
+#0 {main}
+  thrown in %s on line %d
@@ -0,0 +1,20 @@
+--TEST--
+Bug #64821 Custom Exceptions crash when internal properties overridden (variation 3)
+--FILE--
+<?php
+
+class a extends exception {
+	public function __construct() {
+		$this->line = array();
+		$this->file = NULL;
+	}
+}
+
+throw new a;
+
+?>
+--EXPECTF--
+Fatal error: Uncaught exception 'a' in :0
+Stack trace:
+#0 {main}
+  thrown in Unknown on line %d
@@ -0,0 +1,40 @@
+--TEST--
+Bug #64960 (Segfault in gc_zval_possible_root)
+--FILE--
+<?php
+// this makes ob_end_clean raise an error
+ob_end_flush();
+
+class ExceptionHandler {
+	public function __invoke (Exception $e)
+	{
+		// this triggers the custom error handler
+		ob_end_clean();
+	}
+}
+
+// this must be a class, closure does not trigger segfault
+set_exception_handler(new ExceptionHandler());
+
+// exception must be throwed from error handler.
+set_error_handler(function()
+{
+	$e = new Exception;
+	$e->_trace = debug_backtrace();
+	
+	throw $e;
+});
+
+// trigger error handler
+$a['waa'];
+?>
+--EXPECTF--
+Notice: ob_end_flush(): failed to delete and flush buffer. No buffer to delete or flush in %sbug64960.php on line 3
+
+Fatal error: Uncaught exception 'Exception' in %sbug64960.php:19
+Stack trace:
+#0 [internal function]: {closure}(8, 'ob_end_clean():...', '%s', 9, Array)
+#1 %sbug64960.php(9): ob_end_clean()
+#2 [internal function]: ExceptionHandler->__invoke(Object(Exception))
+#3 {main}
+  thrown in %sbug64960.php on line 19
@@ -0,0 +1,30 @@
+--TEST--
+Bug #64966 (segfault in zend_do_fcall_common_helper_SPEC)
+--FILE--
+<?php
+error_reporting(E_ALL);
+set_error_handler(function($error) { throw new Exception(); }, E_RECOVERABLE_ERROR);
+
+function test($func) {
+	$a = $func("");
+	return true;
+}
+class A {
+	public function b() {
+		test("strlen");
+		test("iterator_apply");
+	}
+}
+
+$a = new A();
+$a->b();
+?>
+--EXPECTF--
+Fatal error: Uncaught exception 'Exception' in %sbug64966.php:3
+Stack trace:
+#0 [internal function]: {closure}(4096, 'Argument 1 pass...', '%s', 6, Array)
+#1 %sbug64966.php(6): iterator_apply('')
+#2 %sbug64966.php(12): test('iterator_apply')
+#3 %sbug64966.php(17): A->b()
+#4 {main}
+  thrown in %sbug64966.php on line 3
@@ -90,7 +90,7 @@ typedef struct _zend_fcall_info_cache {
 #define ZEND_NS_RAW_FENTRY(ns, zend_name, name, arg_info, flags)	ZEND_RAW_FENTRY(ZEND_NS_NAME(ns, zend_name), name, arg_info, flags)
 #define ZEND_NS_RAW_NAMED_FE(ns, zend_name, name, arg_info)			ZEND_NS_RAW_FENTRY(ns, #zend_name, name, arg_info, 0)

-#define ZEND_NS_NAMED_FE(ns, zend_name, name, arg_info)	ZEND_NS_FENTRY(ns, #zend_name, name, arg_info, 0)
+#define ZEND_NS_NAMED_FE(ns, zend_name, name, arg_info)	ZEND_NS_FENTRY(ns, zend_name, name, arg_info, 0)
 #define ZEND_NS_FE(ns, name, arg_info)					ZEND_NS_FENTRY(ns, name, ZEND_FN(name), arg_info, 0)
 #define ZEND_NS_DEP_FE(ns, name, arg_info)				ZEND_NS_FENTRY(ns, name, ZEND_FN(name), arg_info, ZEND_ACC_DEPRECATED)
 #define ZEND_NS_FALIAS(ns, name, alias, arg_info)		ZEND_NS_FENTRY(ns, name, ZEND_FN(alias), arg_info, 0)
@@ -2386,7 +2386,7 @@ static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
 	size_t res = nmemb;
 	unsigned long overflow = 0;

-	__asm__ ("mull %3\n\taddl %4,%0\n\tadcl %1,%1"
+	__asm__ ("mull %3\n\taddl %4,%0\n\tadcl $0,%1"
 	     : "=&a"(res), "=&d" (overflow)
 	     : "%0"(res),
 	       "rm"(size),
@@ -2406,7 +2406,7 @@ static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
        size_t res = nmemb;
        unsigned long overflow = 0;

-        __asm__ ("mulq %3\n\taddq %4,%0\n\tadcq %1,%1"
+        __asm__ ("mulq %3\n\taddq %4,%0\n\tadcq $0,%1"
             : "=&a"(res), "=&d" (overflow)
             : "%0"(res),
               "rm"(size),
@@ -4019,7 +4019,7 @@ void zend_do_shell_exec(znode *result, const znode *cmd TSRMLS_DC) /* {{{ */
 			break;
 	}
 	opline->op1 = *cmd;
-	opline->op2.u.opline_num = 0;
+	opline->op2.u.opline_num = 1;
 	opline->extended_value = ZEND_DO_FCALL;
 	SET_UNUSED(opline->op2);

@@ -803,6 +803,10 @@ ZEND_API void zend_exception_error(zval *exception, int severity TSRMLS_DC) /* {
 			if (instanceof_function(ce_exception, default_exception_ce TSRMLS_CC)) {
 				file = zend_read_property(default_exception_ce, EG(exception), "file", sizeof("file")-1, 1 TSRMLS_CC);
 				line = zend_read_property(default_exception_ce, EG(exception), "line", sizeof("line")-1, 1 TSRMLS_CC);
+
+				convert_to_string(file);
+				file = (Z_STRLEN_P(file) > 0) ? file : NULL;
+				line = (Z_TYPE_P(line) == IS_LONG) ? line : NULL;
 			} else {
 				file = NULL;
 				line = NULL;
@@ -814,7 +818,11 @@ ZEND_API void zend_exception_error(zval *exception, int severity TSRMLS_DC) /* {
 		file = zend_read_property(default_exception_ce, exception, "file", sizeof("file")-1, 1 TSRMLS_CC);
 		line = zend_read_property(default_exception_ce, exception, "line", sizeof("line")-1, 1 TSRMLS_CC);

-		zend_error_va(severity, Z_STRVAL_P(file), Z_LVAL_P(line), "Uncaught %s\n  thrown", Z_STRVAL_P(str));
+		convert_to_string(str);
+		convert_to_string(file);
+		convert_to_long(line);
+
+		zend_error_va(severity, (Z_STRLEN_P(file) > 0) ? Z_STRVAL_P(file) : NULL, Z_LVAL_P(line), "Uncaught %s\n  thrown", Z_STRVAL_P(str));
 	} else {
 		zend_error(severity, "Uncaught exception '%s'", ce_exception->name);
 	}
@@ -263,15 +263,13 @@ void shutdown_executor(TSRMLS_D) /* {{{ */
 		if (EG(user_error_handler)) {
 			zeh = EG(user_error_handler);
 			EG(user_error_handler) = NULL;
-			zval_dtor(zeh);
-			FREE_ZVAL(zeh);
+			zval_ptr_dtor(&zeh);
 		}

 		if (EG(user_exception_handler)) {
 			zeh = EG(user_exception_handler);
 			EG(user_exception_handler) = NULL;
-			zval_dtor(zeh);
-			FREE_ZVAL(zeh);
+			zval_ptr_dtor(&zeh);
 		}

 		zend_stack_destroy(&EG(user_error_handlers_error_reporting));
@@ -2327,6 +2327,8 @@ ZEND_VM_HELPER(zend_do_fcall_common_helper, ANY, ANY)
 			if (!RETURN_VALUE_USED(opline)) {
 				zval_ptr_dtor(&EX_T(opline->result.u.var).var.ptr);
 			}
+		} else if (RETURN_VALUE_USED(opline)) {
+			EX_T(opline->result.u.var).var.ptr = NULL;
 		}
 	} else if (EX(function_state).function->type == ZEND_USER_FUNCTION) {
 		EX(original_return_value) = EG(return_value_ptr_ptr);
@@ -327,6 +327,8 @@ static int ZEND_FASTCALL zend_do_fcall_common_helper_SPEC(ZEND_OPCODE_HANDLER_AR
 			if (!RETURN_VALUE_USED(opline)) {
 				zval_ptr_dtor(&EX_T(opline->result.u.var).var.ptr);
 			}
+		} else if (RETURN_VALUE_USED(opline)) {
+			EX_T(opline->result.u.var).var.ptr = NULL;
 		}
 	} else if (EX(function_state).function->type == ZEND_USER_FUNCTION) {
 		EX(original_return_value) = EG(return_value_ptr_ptr);
@@ -41,8 +41,8 @@ AC_CONFIG_HEADER(main/php_config.h)

 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=3
-PHP_RELEASE_VERSION=25
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=28
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -272,6 +272,7 @@
 #define HALAKIM_PER_METONIC_CYCLE (HALAKIM_PER_LUNAR_CYCLE * (12 * 19 + 7))

 #define JEWISH_SDN_OFFSET 347997
+#define JEWISH_SDN_MAX 324542846L /* 12/13/887605, greater value raises interger overflow */
 #define NEW_MOON_OF_CREATION 31524

 #define SUNDAY    0
@@ -519,7 +520,7 @@ void SdnToJewish(
 	int tishri1After;
 	int yearLength;

-	if (sdn <= JEWISH_SDN_OFFSET) {
+	if (sdn <= JEWISH_SDN_OFFSET || sdn > JEWISH_SDN_MAX) {
 		*pYear = 0;
 		*pMonth = 0;
 		*pDay = 0;
@@ -0,0 +1,19 @@
+--TEST--
+Bug #64895: Integer overflow in SndToJewish
+--SKIPIF--
+<?php 
+include 'skipif.inc';
+if (PHP_INT_SIZE == 4) {
+        die("skip this test is for 64bit platform only");
+}
+?>
+--FILE--
+<?php
+$a = array(38245310, 324542846, 324542847, 9223372036854743639);
+
+foreach ($a as $x) var_dump(jdtojewish($x));
+--EXPECTF--
+string(11) "2/22/103759"
+string(12) "12/13/887605"
+string(5) "0/0/0"
+string(5) "0/0/0"
@@ -39,6 +39,20 @@ static __inline __int64_t php_date_llabs( __int64_t i ) { return i >= 0 ? i : -i
 static inline long long php_date_llabs( long long i ) { return i >= 0 ? i : -i; }
 #endif

+#ifdef PHP_WIN32
+#define DATE_I64_BUF_LEN 65
+# define DATE_I64A(i, s, len) _i64toa_s(i, s, len, 10)
+# define DATE_A64I(i, s) i = _atoi64(s)
+#else
+#define DATE_I64_BUF_LEN 65
+# define DATE_I64A(i, s, len) \
+	do { \
+		int st = snprintf(s, len, "%lld", i); \
+		s[st] = '\0'; \
+	} while (0);
+# define DATE_A64I(i, s) i = atoll(s)
+#endif
+
 /* {{{ arginfo */
 ZEND_BEGIN_ARG_INFO_EX(arginfo_date, 0, 0, 1)
 	ZEND_ARG_INFO(0, format)
@@ -472,6 +486,8 @@ const zend_function_entry date_funcs_interval[] = {

 const zend_function_entry date_funcs_period[] = {
 	PHP_ME(DatePeriod,                __construct,                 arginfo_date_period_construct, ZEND_ACC_CTOR|ZEND_ACC_PUBLIC)
+	PHP_ME(DatePeriod,                __wakeup,                    NULL, ZEND_ACC_PUBLIC)
+	PHP_ME(DatePeriod,                __set_state,                 NULL, ZEND_ACC_PUBLIC|ZEND_ACC_STATIC)
 	PHP_FE_END
 };

@@ -565,9 +581,12 @@ static zend_object_value date_object_clone_period(zval *this_ptr TSRMLS_DC);
 static int date_object_compare_date(zval *d1, zval *d2 TSRMLS_DC);
 static HashTable *date_object_get_properties(zval *object TSRMLS_DC);
 static HashTable *date_object_get_properties_interval(zval *object TSRMLS_DC);
+static HashTable *date_object_get_properties_period(zval *object TSRMLS_DC);

 zval *date_interval_read_property(zval *object, zval *member, int type TSRMLS_DC);
 void date_interval_write_property(zval *object, zval *member, zval *value TSRMLS_DC);
+static zval *date_period_read_property(zval *object, zval *member, int type TSRMLS_DC);
+static void date_period_write_property(zval *object, zval *member, zval *value TSRMLS_DC);

 /* {{{ Module struct */
 zend_module_entry date_module_entry = {
@@ -2015,6 +2034,10 @@ static void date_register_classes(TSRMLS_D)
 	zend_class_implements(date_ce_period TSRMLS_CC, 1, zend_ce_traversable);
 	memcpy(&date_object_handlers_period, zend_get_std_object_handlers(), sizeof(zend_object_handlers));
 	date_object_handlers_period.clone_obj = date_object_clone_period;
+	date_object_handlers_period.get_properties = date_object_get_properties_period;
+	date_object_handlers_period.get_property_ptr_ptr = NULL;
+	date_object_handlers_period.read_property = date_period_read_property;
+	date_object_handlers_period.write_property = date_period_write_property;

 #define REGISTER_PERIOD_CLASS_CONST_STRING(const_name, value) \
 	zend_declare_class_constant_long(date_ce_period, const_name, sizeof(const_name)-1, value TSRMLS_CC);
@@ -2250,7 +2273,6 @@ static HashTable *date_object_get_properties_interval(zval *object TSRMLS_DC)
 	zval *zv;
 	php_interval_obj     *intervalobj;

-
 	intervalobj = (php_interval_obj *) zend_object_store_get_object(object TSRMLS_CC);

 	props = zend_std_get_properties(object TSRMLS_CC);
@@ -2261,7 +2283,7 @@ static HashTable *date_object_get_properties_interval(zval *object TSRMLS_DC)

 #define PHP_DATE_INTERVAL_ADD_PROPERTY(n,f) \
 	MAKE_STD_ZVAL(zv); \
-	ZVAL_LONG(zv, intervalobj->diff->f); \
+	ZVAL_LONG(zv, (long)intervalobj->diff->f); \
 	zend_hash_update(props, n, strlen(n) + 1, &zv, sizeof(zval), NULL);

 	PHP_DATE_INTERVAL_ADD_PROPERTY("y", y);
@@ -2270,6 +2292,9 @@ static HashTable *date_object_get_properties_interval(zval *object TSRMLS_DC)
 	PHP_DATE_INTERVAL_ADD_PROPERTY("h", h);
 	PHP_DATE_INTERVAL_ADD_PROPERTY("i", i);
 	PHP_DATE_INTERVAL_ADD_PROPERTY("s", s);
+	PHP_DATE_INTERVAL_ADD_PROPERTY("weekday", weekday);
+	PHP_DATE_INTERVAL_ADD_PROPERTY("weekday_behavior", weekday_behavior);
+	PHP_DATE_INTERVAL_ADD_PROPERTY("first_last_day_of", first_last_day_of);
 	PHP_DATE_INTERVAL_ADD_PROPERTY("invert", invert);
 	if (intervalobj->diff->days != -99999) {
 		PHP_DATE_INTERVAL_ADD_PROPERTY("days", days);
@@ -2278,6 +2303,10 @@ static HashTable *date_object_get_properties_interval(zval *object TSRMLS_DC)
 		ZVAL_FALSE(zv);
 		zend_hash_update(props, "days", 5, &zv, sizeof(zval), NULL);
 	}
+	PHP_DATE_INTERVAL_ADD_PROPERTY("special_type", special.type);
+	PHP_DATE_INTERVAL_ADD_PROPERTY("special_amount", special.amount);
+	PHP_DATE_INTERVAL_ADD_PROPERTY("have_weekday_relative", have_weekday_relative);
+	PHP_DATE_INTERVAL_ADD_PROPERTY("have_special_relative", have_special_relative);

 	return props;
 }
@@ -2380,6 +2409,7 @@ PHPAPI zval *php_date_instantiate(zend_class_entry *pce, zval *object TSRMLS_DC)
 	object_init_ex(object, pce);
 	Z_SET_REFCOUNT_P(object, 1);
 	Z_UNSET_ISREF_P(object);
+
 	return object;
 }

@@ -3649,30 +3679,48 @@ PHP_METHOD(DateInterval, __construct)
 }
 /* }}} */

-static long php_date_long_from_hash_element(HashTable *myht, char *element, size_t size)
-{
-	zval            **z_arg = NULL;
-
-	if (zend_hash_find(myht, element, size + 1, (void**) &z_arg) == SUCCESS) {
-		convert_to_long(*z_arg);
-		return Z_LVAL_PP(z_arg);
-	} else {
-		return -1;
-	}
-}

 static int php_date_interval_initialize_from_hash(zval **return_value, php_interval_obj **intobj, HashTable *myht TSRMLS_DC)
 {
 	(*intobj)->diff = timelib_rel_time_ctor();

-	(*intobj)->diff->y = php_date_long_from_hash_element(myht, "y", 1);
-	(*intobj)->diff->m = php_date_long_from_hash_element(myht, "m", 1);
-	(*intobj)->diff->d = php_date_long_from_hash_element(myht, "d", 1);
-	(*intobj)->diff->h = php_date_long_from_hash_element(myht, "h", 1);
-	(*intobj)->diff->i = php_date_long_from_hash_element(myht, "i", 1);
-	(*intobj)->diff->s = php_date_long_from_hash_element(myht, "s", 1);
-	(*intobj)->diff->invert = php_date_long_from_hash_element(myht, "invert", 6);
-	(*intobj)->diff->days = php_date_long_from_hash_element(myht, "days", 4);
+#define PHP_DATE_INTERVAL_READ_PROPERTY(element, member, itype, def) \
+	do { \
+		zval **z_arg = NULL; \
+		if (zend_hash_find(myht, element, strlen(element) + 1, (void**) &z_arg) == SUCCESS) { \
+			convert_to_long(*z_arg); \
+			(*intobj)->diff->member = (itype)Z_LVAL_PP(z_arg); \
+		} else { \
+			(*intobj)->diff->member = (itype)def; \
+		} \
+	} while (0);
+
+#define PHP_DATE_INTERVAL_READ_PROPERTY_I64(element, member) \
+	do { \
+		zval **z_arg = NULL; \
+		if (zend_hash_find(myht, element, strlen(element) + 1, (void**) &z_arg) == SUCCESS) { \
+			convert_to_string(*z_arg); \
+			DATE_A64I((*intobj)->diff->member, Z_STRVAL_PP(z_arg)); \
+		} else { \
+			(*intobj)->diff->member = -1LL; \
+		} \
+	} while (0);
+
+	PHP_DATE_INTERVAL_READ_PROPERTY("y", y, timelib_sll, -1)
+	PHP_DATE_INTERVAL_READ_PROPERTY("m", m, timelib_sll, -1)
+	PHP_DATE_INTERVAL_READ_PROPERTY("d", d, timelib_sll, -1)
+	PHP_DATE_INTERVAL_READ_PROPERTY("h", h, timelib_sll, -1)
+	PHP_DATE_INTERVAL_READ_PROPERTY("i", i, timelib_sll, -1)
+	PHP_DATE_INTERVAL_READ_PROPERTY("s", s, timelib_sll, -1)
+	PHP_DATE_INTERVAL_READ_PROPERTY("weekday", weekday, int, -1)
+	PHP_DATE_INTERVAL_READ_PROPERTY("weekday_behavior", weekday_behavior, int, -1)
+	PHP_DATE_INTERVAL_READ_PROPERTY("first_last_day_of", first_last_day_of, int, -1)
+	PHP_DATE_INTERVAL_READ_PROPERTY("invert", invert, int, 0);
+	PHP_DATE_INTERVAL_READ_PROPERTY_I64("days", days);
+	PHP_DATE_INTERVAL_READ_PROPERTY("special_type", special.type, unsigned int, 0);
+	PHP_DATE_INTERVAL_READ_PROPERTY_I64("special_amount", special.amount);
+	PHP_DATE_INTERVAL_READ_PROPERTY("have_weekday_relative", have_weekday_relative, unsigned int, 0);
+	PHP_DATE_INTERVAL_READ_PROPERTY("have_special_relative", have_special_relative, unsigned int, 0);
 	(*intobj)->initialized = 1;

 	return 0;
@@ -4276,6 +4324,223 @@ PHP_FUNCTION(date_sun_info)
 	timelib_time_dtor(t2);
 }
 /* }}} */
+
+
+static HashTable *date_object_get_properties_period(zval *object TSRMLS_DC)
+{
+	HashTable		*props;
+	zval			*zv;
+	php_period_obj	*period_obj;
+
+	period_obj = zend_object_store_get_object(object TSRMLS_CC);
+
+	props = zend_std_get_properties(object TSRMLS_CC);
+
+	if (!period_obj->start) {
+		return props;
+	}
+
+	MAKE_STD_ZVAL(zv);
+	if (period_obj->start) {
+		php_date_obj *date_obj;
+		object_init_ex(zv, date_ce_date);
+		date_obj = zend_object_store_get_object(zv TSRMLS_CC);
+		date_obj->time = timelib_time_clone(period_obj->start);
+	} else {
+		ZVAL_NULL(zv);
+	}
+	zend_hash_update(props, "start", sizeof("start"), &zv, sizeof(zv), NULL);
+
+	MAKE_STD_ZVAL(zv);
+	if (period_obj->current) {
+		php_date_obj *date_obj;
+		object_init_ex(zv, date_ce_date);
+		date_obj = zend_object_store_get_object(zv TSRMLS_CC);
+		date_obj->time = timelib_time_clone(period_obj->current);
+	} else {
+		ZVAL_NULL(zv);
+	}
+	zend_hash_update(props, "current", sizeof("current"), &zv, sizeof(zv), NULL);
+
+	MAKE_STD_ZVAL(zv);
+	if (period_obj->end) {
+		php_date_obj *date_obj;
+		object_init_ex(zv, date_ce_date);
+		date_obj = zend_object_store_get_object(zv TSRMLS_CC);
+		date_obj->time = timelib_time_clone(period_obj->end);
+	} else {
+		ZVAL_NULL(zv);
+	}
+	zend_hash_update(props, "end", sizeof("end"), &zv, sizeof(zv), NULL);
+
+	MAKE_STD_ZVAL(zv);
+	if (period_obj->interval) {
+		php_interval_obj *interval_obj;
+		object_init_ex(zv, date_ce_interval);
+		interval_obj = zend_object_store_get_object(zv TSRMLS_CC);
+		interval_obj->diff = timelib_rel_time_clone(period_obj->interval);
+		interval_obj->initialized = 1;
+	} else {
+		ZVAL_NULL(zv);
+	}
+	zend_hash_update(props, "interval", sizeof("interval"), &zv, sizeof(zv), NULL);
+	
+	/* converted to larger type (int->long); must check when unserializing */
+	MAKE_STD_ZVAL(zv);
+	ZVAL_LONG(zv, (long) period_obj->recurrences);
+	zend_hash_update(props, "recurrences", sizeof("recurrences"), &zv, sizeof(zv), NULL);
+
+	MAKE_STD_ZVAL(zv);
+	ZVAL_BOOL(zv, period_obj->include_start_date);
+	zend_hash_update(props, "include_start_date", sizeof("include_start_date"), &zv, sizeof(zv), NULL);
+
+	return props;
+}
+
+static int php_date_period_initialize_from_hash(php_period_obj *period_obj, HashTable *myht TSRMLS_DC)
+{
+	zval **ht_entry;
+
+	/* this function does no rollback on error */
+
+	if (zend_hash_find(myht, "start", sizeof("start"), (void**) &ht_entry) == SUCCESS) {
+		if (Z_TYPE_PP(ht_entry) == IS_OBJECT && Z_OBJCE_PP(ht_entry) == date_ce_date) {
+			php_date_obj *date_obj;
+			date_obj = zend_object_store_get_object(*ht_entry TSRMLS_CC);
+			period_obj->start = timelib_time_clone(date_obj->time);
+		} else if (Z_TYPE_PP(ht_entry) != IS_NULL) {
+			return 0;
+		}
+	} else {
+		return 0;
+	}
+
+	if (zend_hash_find(myht, "end", sizeof("end"), (void**) &ht_entry) == SUCCESS) {
+		if (Z_TYPE_PP(ht_entry) == IS_OBJECT && Z_OBJCE_PP(ht_entry) == date_ce_date) {
+			php_date_obj *date_obj;
+			date_obj = zend_object_store_get_object(*ht_entry TSRMLS_CC);
+			period_obj->end = timelib_time_clone(date_obj->time);
+		} else if (Z_TYPE_PP(ht_entry) != IS_NULL) {
+			return 0;
+		}
+	} else {
+		return 0;
+	}
+
+	if (zend_hash_find(myht, "current", sizeof("current"), (void**) &ht_entry) == SUCCESS) {
+		if (Z_TYPE_PP(ht_entry) == IS_OBJECT && Z_OBJCE_PP(ht_entry) == date_ce_date) {
+			php_date_obj *date_obj;
+			date_obj = zend_object_store_get_object(*ht_entry TSRMLS_CC);
+			period_obj->current = timelib_time_clone(date_obj->time);
+		} else if (Z_TYPE_PP(ht_entry) != IS_NULL)  {
+			return 0;
+		}
+	} else {
+		return 0;
+	}
+
+	if (zend_hash_find(myht, "interval", sizeof("interval"), (void**) &ht_entry) == SUCCESS) {
+		if (Z_TYPE_PP(ht_entry) == IS_OBJECT && Z_OBJCE_PP(ht_entry) == date_ce_interval) {
+			php_interval_obj *interval_obj;
+			interval_obj = zend_object_store_get_object(*ht_entry TSRMLS_CC);
+			period_obj->interval = timelib_rel_time_clone(interval_obj->diff);
+		} else { /* interval is required */
+			return 0;
+		}
+	} else {
+		return 0;
+	}
+
+	if (zend_hash_find(myht, "recurrences", sizeof("recurrences"), (void**) &ht_entry) == SUCCESS &&
+			Z_TYPE_PP(ht_entry) == IS_LONG && Z_LVAL_PP(ht_entry) >= 0 && Z_LVAL_PP(ht_entry) <= INT_MAX) {
+		period_obj->recurrences = Z_LVAL_PP(ht_entry);
+	} else {
+		return 0;
+	}
+
+	if (zend_hash_find(myht, "include_start_date", sizeof("include_start_date"), (void**) &ht_entry) == SUCCESS &&
+			Z_TYPE_PP(ht_entry) == IS_BOOL) {
+		period_obj->include_start_date = Z_BVAL_PP(ht_entry);
+	} else {
+		return 0;
+	}
+
+	period_obj->initialized = 1;
+	
+	return 1;
+}
+
+/* {{{ proto DatePeriod::__set_state()
+*/
+PHP_METHOD(DatePeriod, __set_state)
+{
+	php_period_obj   *period_obj;
+	zval             *array;
+	HashTable        *myht;
+
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "a", &array) == FAILURE) {
+		RETURN_FALSE;
+	}
+
+	myht = Z_ARRVAL_P(array);
+	
+	object_init_ex(return_value, date_ce_period);
+	period_obj = zend_object_store_get_object(return_value TSRMLS_CC);
+	if (!php_date_period_initialize_from_hash(period_obj, myht TSRMLS_CC)) {
+		php_error(E_ERROR, "Invalid serialization data for DatePeriod object");
+	}
+}
+/* }}} */
+
+/* {{{ proto DatePeriod::__wakeup()
+*/
+PHP_METHOD(DatePeriod, __wakeup)
+{
+	zval             *object = getThis();
+	php_period_obj   *period_obj;
+	HashTable        *myht;
+
+	period_obj = zend_object_store_get_object(object TSRMLS_CC);
+
+	myht = Z_OBJPROP_P(object);
+
+	if (!php_date_period_initialize_from_hash(period_obj, myht TSRMLS_CC)) {
+		php_error(E_ERROR, "Invalid serialization data for DatePeriod object");
+	}
+}
+/* }}} */
+
+/* {{{ date_period_read_property */
+static zval *date_period_read_property(zval *object, zval *member, int type TSRMLS_DC)
+{
+	zval *zv;
+	if (type != BP_VAR_IS && type != BP_VAR_R) {
+		php_error_docref(NULL TSRMLS_CC, E_ERROR, "Retrieval of DatePeriod properties for modification is unsupported");
+	}
+
+	Z_OBJPROP_P(object); /* build properties hash table */
+
+	zv = std_object_handlers.read_property(object, member, type TSRMLS_CC);
+	if (Z_TYPE_P(zv) == IS_OBJECT && Z_OBJ_HANDLER_P(zv, clone_obj)) {
+		/* defensive copy */
+		zend_object_value zov = Z_OBJ_HANDLER_P(zv, clone_obj)(zv TSRMLS_CC);
+		MAKE_STD_ZVAL(zv);
+		Z_TYPE_P(zv) = IS_OBJECT;
+		Z_OBJVAL_P(zv) = zov;
+	}
+
+	return zv;
+}
+/* }}} */
+
+/* {{{ date_period_write_property */
+static void date_period_write_property(zval *object, zval *member, zval *value TSRMLS_DC)
+{
+	php_error_docref(NULL TSRMLS_CC, E_ERROR, "Writing to DatePeriod properties is unsupported");
+}
+/* }}} */
+
+
 /*
 * Local variables:
 * tab-width: 4
@@ -88,6 +88,8 @@ PHP_FUNCTION(date_interval_format);
 PHP_FUNCTION(date_interval_create_from_date_string);

 PHP_METHOD(DatePeriod, __construct);
+PHP_METHOD(DatePeriod, __wakeup);
+PHP_METHOD(DatePeriod, __set_state);

 /* Options and Configuration */
 PHP_FUNCTION(date_default_timezone_set);
@@ -11,8 +11,8 @@ $other = new DateTime("31-July-2008");
 $diff = date_diff($date, $other);

 var_dump($diff);
--EXPECT--
-object(DateInterval)#3 (8) {
+--EXPECTF--
+object(DateInterval)#%d (15) {
  ["y"]=>
  int(0)
  ["m"]=>
@@ -25,8 +25,22 @@ object(DateInterval)#3 (8) {
  int(0)
  ["s"]=>
  int(0)
+  ["weekday"]=>
+  int(0)
+  ["weekday_behavior"]=>
+  int(0)
+  ["first_last_day_of"]=>
+  int(0)
  ["invert"]=>
  int(0)
  ["days"]=>
  int(3)
+  ["special_type"]=>
+  int(0)
+  ["special_amount"]=>
+  int(0)
+  ["have_weekday_relative"]=>
+  int(0)
+  ["have_special_relative"]=>
+  int(0)
 }
@@ -15,8 +15,15 @@ DateInterval Object
    [h] => 12
    [i] => 30
    [s] => 5
+    [weekday] => 0
+    [weekday_behavior] => 0
+    [first_last_day_of] => 0
    [invert] => 0
-    [days] =>%s
+    [days] => 
+    [special_type] => 0
+    [special_amount] => 0
+    [have_weekday_relative] => 0
+    [have_special_relative] => 0
 )
 DateInterval Object
 (
@@ -26,6 +33,13 @@ DateInterval Object
    [h] => 12
    [i] => 30
    [s] => 5
+    [weekday] => 0
+    [weekday_behavior] => 0
+    [first_last_day_of] => 0
    [invert] => 0
-    [days] =>%s
+    [days] => 0
+    [special_type] => 0
+    [special_amount] => 0
+    [have_weekday_relative] => 0
+    [have_special_relative] => 0
 )
@@ -17,6 +17,13 @@ DateInterval Object
    [h] => 4
    [i] => 0
    [s] => 0
+    [weekday] => 0
+    [weekday_behavior] => 0
+    [first_last_day_of] => 0
    [invert] => 0
    [days] => 30
+    [special_type] => 0
+    [special_amount] => 0
+    [have_weekday_relative] => 0
+    [have_special_relative] => 0
 )
@@ -8,7 +8,7 @@ echo $i->format("%d"), "\n";
 echo $i->format("%a"), "\n";
 ?>
 --EXPECT--
-object(DateInterval)#1 (8) {
+object(DateInterval)#1 (15) {
  ["y"]=>
  int(0)
  ["m"]=>
@@ -21,10 +21,24 @@ object(DateInterval)#1 (8) {
  int(0)
  ["s"]=>
  int(0)
+  ["weekday"]=>
+  int(0)
+  ["weekday_behavior"]=>
+  int(0)
+  ["first_last_day_of"]=>
+  int(0)
  ["invert"]=>
  int(0)
  ["days"]=>
  bool(false)
+  ["special_type"]=>
+  int(0)
+  ["special_amount"]=>
+  int(0)
+  ["have_weekday_relative"]=>
+  int(0)
+  ["have_special_relative"]=>
+  int(0)
 }
 7
 (unknown)
@@ -32,7 +32,7 @@ var_dump($unser, $p);

 ?>
 --EXPECT--
-object(DateInterval)#3 (8) {
+object(DateInterval)#3 (15) {
  ["y"]=>
  int(0)
  ["m"]=>
@@ -45,12 +45,26 @@ object(DateInterval)#3 (8) {
  int(0)
  ["s"]=>
  int(0)
+  ["weekday"]=>
+  int(0)
+  ["weekday_behavior"]=>
+  int(0)
+  ["first_last_day_of"]=>
+  int(0)
  ["invert"]=>
  int(0)
  ["days"]=>
  int(0)
+  ["special_type"]=>
+  int(0)
+  ["special_amount"]=>
+  int(0)
+  ["have_weekday_relative"]=>
+  int(0)
+  ["have_special_relative"]=>
+  int(0)
 }
-string(128) "O:12:"DateInterval":8:{s:1:"y";i:0;s:1:"m";i:0;s:1:"d";i:0;s:1:"h";i:4;s:1:"i";i:0;s:1:"s";i:0;s:6:"invert";i:0;s:4:"days";i:0;}"
+string(320) "O:12:"DateInterval":15:{s:1:"y";i:0;s:1:"m";i:0;s:1:"d";i:0;s:1:"h";i:4;s:1:"i";i:0;s:1:"s";i:0;s:7:"weekday";i:0;s:16:"weekday_behavior";i:0;s:17:"first_last_day_of";i:0;s:6:"invert";i:0;s:4:"days";i:0;s:12:"special_type";i:0;s:14:"special_amount";i:0;s:21:"have_weekday_relative";i:0;s:21:"have_special_relative";i:0;}"
 DateInterval::__set_state(array(
   'y' => 0,
   'm' => 0,
@@ -58,9 +72,16 @@ DateInterval::__set_state(array(
   'h' => 4,
   'i' => 0,
   's' => 0,
+   'weekday' => 0,
+   'weekday_behavior' => 0,
+   'first_last_day_of' => 0,
   'invert' => 0,
   'days' => 0,
-))object(DateInterval)#5 (8) {
+   'special_type' => 0,
+   'special_amount' => 0,
+   'have_weekday_relative' => 0,
+   'have_special_relative' => 0,
+))object(DateInterval)#5 (15) {
  ["y"]=>
  int(0)
  ["m"]=>
@@ -73,14 +94,78 @@ DateInterval::__set_state(array(
  int(0)
  ["s"]=>
  int(0)
+  ["weekday"]=>
+  int(0)
+  ["weekday_behavior"]=>
+  int(0)
+  ["first_last_day_of"]=>
+  int(0)
  ["invert"]=>
  int(0)
  ["days"]=>
  int(0)
+  ["special_type"]=>
+  int(0)
+  ["special_amount"]=>
+  int(0)
+  ["have_weekday_relative"]=>
+  int(0)
+  ["have_special_relative"]=>
+  int(0)
 }
-object(DatePeriod)#6 (0) {
+object(DatePeriod)#6 (6) {
+  ["start"]=>
+  object(DateTime)#4 (3) {
+    ["date"]=>
+    string(19) "2003-01-02 08:00:00"
+    ["timezone_type"]=>
+    int(3)
+    ["timezone"]=>
+    string(3) "UTC"
+  }
+  ["current"]=>
+  NULL
+  ["end"]=>
+  NULL
+  ["interval"]=>
+  object(DateInterval)#7 (15) {
+    ["y"]=>
+    int(0)
+    ["m"]=>
+    int(0)
+    ["d"]=>
+    int(0)
+    ["h"]=>
+    int(4)
+    ["i"]=>
+    int(0)
+    ["s"]=>
+    int(0)
+    ["weekday"]=>
+    int(0)
+    ["weekday_behavior"]=>
+    int(0)
+    ["first_last_day_of"]=>
+    int(0)
+    ["invert"]=>
+    int(0)
+    ["days"]=>
+    int(0)
+    ["special_type"]=>
+    int(0)
+    ["special_amount"]=>
+    int(0)
+    ["have_weekday_relative"]=>
+    int(0)
+    ["have_special_relative"]=>
+    int(0)
+  }
+  ["recurrences"]=>
+  int(3)
+  ["include_start_date"]=>
+  bool(true)
 }
-object(DateInterval)#4 (8) {
+object(DateInterval)#8 (15) {
  ["y"]=>
  int(7)
  ["m"]=>
@@ -93,10 +178,74 @@ object(DateInterval)#4 (8) {
  int(3)
  ["s"]=>
  int(2)
+  ["weekday"]=>
+  int(-1)
+  ["weekday_behavior"]=>
+  int(-1)
+  ["first_last_day_of"]=>
+  int(-1)
  ["invert"]=>
  int(1)
  ["days"]=>
  int(2400)
+  ["special_type"]=>
+  int(0)
+  ["special_amount"]=>
+  int(-1)
+  ["have_weekday_relative"]=>
+  int(0)
+  ["have_special_relative"]=>
+  int(0)
 }
-object(DatePeriod)#7 (0) {
+object(DatePeriod)#9 (6) {
+  ["start"]=>
+  object(DateTime)#6 (3) {
+    ["date"]=>
+    string(19) "2003-01-02 08:00:00"
+    ["timezone_type"]=>
+    int(3)
+    ["timezone"]=>
+    string(3) "UTC"
+  }
+  ["current"]=>
+  NULL
+  ["end"]=>
+  NULL
+  ["interval"]=>
+  object(DateInterval)#7 (15) {
+    ["y"]=>
+    int(0)
+    ["m"]=>
+    int(0)
+    ["d"]=>
+    int(0)
+    ["h"]=>
+    int(4)
+    ["i"]=>
+    int(0)
+    ["s"]=>
+    int(0)
+    ["weekday"]=>
+    int(0)
+    ["weekday_behavior"]=>
+    int(0)
+    ["first_last_day_of"]=>
+    int(0)
+    ["invert"]=>
+    int(0)
+    ["days"]=>
+    int(0)
+    ["special_type"]=>
+    int(0)
+    ["special_amount"]=>
+    int(0)
+    ["have_weekday_relative"]=>
+    int(0)
+    ["have_special_relative"]=>
+    int(0)
+  }
+  ["recurrences"]=>
+  int(3)
+  ["include_start_date"]=>
+  bool(true)
 }
@@ -27,6 +27,13 @@ di Object
    [h] => 0
    [i] => 0
    [s] => 0
+    [weekday] => 0
+    [weekday_behavior] => 0
+    [first_last_day_of] => 0
    [invert] => 0
    [days] => 
+    [special_type] => 0
+    [special_amount] => 0
+    [have_weekday_relative] => 0
+    [have_special_relative] => 0
 )
@@ -25,7 +25,7 @@ foreach($intervals as $iv) {
 echo "==DONE==\n";
 ?>
 --EXPECTF--
-object(DateInterval)#%d (8) {
+object(DateInterval)#%d (15) {
  ["y"]=>
  int(1)
  ["m"]=>
@@ -38,12 +38,26 @@ object(DateInterval)#%d (8) {
  int(30)
  ["s"]=>
  int(0)
+  ["weekday"]=>
+  int(0)
+  ["weekday_behavior"]=>
+  int(0)
+  ["first_last_day_of"]=>
+  int(0)
  ["invert"]=>
  int(1)
  ["days"]=>
  int(437)
+  ["special_type"]=>
+  int(0)
+  ["special_amount"]=>
+  int(0)
+  ["have_weekday_relative"]=>
+  int(0)
+  ["have_special_relative"]=>
+  int(0)
 }
-object(DateInterval)#%d (8) {
+object(DateInterval)#%d (15) {
  ["y"]=>
  int(0)
  ["m"]=>
@@ -56,12 +70,26 @@ object(DateInterval)#%d (8) {
  int(30)
  ["s"]=>
  int(0)
+  ["weekday"]=>
+  int(0)
+  ["weekday_behavior"]=>
+  int(0)
+  ["first_last_day_of"]=>
+  int(0)
  ["invert"]=>
  int(0)
  ["days"]=>
  int(294)
+  ["special_type"]=>
+  int(0)
+  ["special_amount"]=>
+  int(0)
+  ["have_weekday_relative"]=>
+  int(0)
+  ["have_special_relative"]=>
+  int(0)
 }
-object(DateInterval)#%d (8) {
+object(DateInterval)#%d (15) {
  ["y"]=>
  int(0)
  ["m"]=>
@@ -74,10 +102,24 @@ object(DateInterval)#%d (8) {
  int(30)
  ["s"]=>
  int(0)
+  ["weekday"]=>
+  int(0)
+  ["weekday_behavior"]=>
+  int(0)
+  ["first_last_day_of"]=>
+  int(0)
  ["invert"]=>
  int(0)
  ["days"]=>
  int(294)
+  ["special_type"]=>
+  int(0)
+  ["special_amount"]=>
+  int(0)
+  ["have_weekday_relative"]=>
+  int(0)
+  ["have_special_relative"]=>
+  int(0)
 }
 DateInterval::__construct(): Failed to parse interval (2007-05-11T15:30:00Z/)
 DateInterval::__construct(): Failed to parse interval (2007-05-11T15:30:00Z)
@@ -1,7 +1,5 @@
 --TEST--
-Bug #53437 (Crash when using unserialized DatePeriod instance)
--XFAIL--
-Bug #53437 Not fixed yet
+Bug #53437 (Crash when using unserialized DatePeriod instance), variation 1
 --FILE--
 <?php
 $dp = new DatePeriod(new DateTime('2010-01-01 UTC'), new DateInterval('P1D'), 2);
@@ -20,9 +18,137 @@ $dpu = unserialize($ser); // $dpu has invalid values???
 var_dump($dpu);

 echo "Unserialized:\r\n";
-// ???which leads to CRASH:
 foreach($dpu as $dt) {
        echo $dt->format('Y-m-d H:i:s')."\r\n";
 }
 ?>
+==DONE==
 --EXPECT--
+Original:
+2010-01-01 00:00:00
+2010-01-02 00:00:00
+2010-01-03 00:00:00
+
+object(DatePeriod)#1 (6) {
+  ["start"]=>
+  object(DateTime)#2 (3) {
+    ["date"]=>
+    string(19) "2010-01-01 00:00:00"
+    ["timezone_type"]=>
+    int(3)
+    ["timezone"]=>
+    string(3) "UTC"
+  }
+  ["current"]=>
+  object(DateTime)#4 (3) {
+    ["date"]=>
+    string(19) "2010-01-04 00:00:00"
+    ["timezone_type"]=>
+    int(3)
+    ["timezone"]=>
+    string(3) "UTC"
+  }
+  ["end"]=>
+  NULL
+  ["interval"]=>
+  object(DateInterval)#5 (15) {
+    ["y"]=>
+    int(0)
+    ["m"]=>
+    int(0)
+    ["d"]=>
+    int(1)
+    ["h"]=>
+    int(0)
+    ["i"]=>
+    int(0)
+    ["s"]=>
+    int(0)
+    ["weekday"]=>
+    int(0)
+    ["weekday_behavior"]=>
+    int(0)
+    ["first_last_day_of"]=>
+    int(0)
+    ["invert"]=>
+    int(0)
+    ["days"]=>
+    bool(false)
+    ["special_type"]=>
+    int(0)
+    ["special_amount"]=>
+    int(0)
+    ["have_weekday_relative"]=>
+    int(0)
+    ["have_special_relative"]=>
+    int(0)
+  }
+  ["recurrences"]=>
+  int(3)
+  ["include_start_date"]=>
+  bool(true)
+}
+object(DatePeriod)#5 (6) {
+  ["start"]=>
+  object(DateTime)#10 (3) {
+    ["date"]=>
+    string(19) "2010-01-01 00:00:00"
+    ["timezone_type"]=>
+    int(3)
+    ["timezone"]=>
+    string(3) "UTC"
+  }
+  ["current"]=>
+  object(DateTime)#7 (3) {
+    ["date"]=>
+    string(19) "2010-01-04 00:00:00"
+    ["timezone_type"]=>
+    int(3)
+    ["timezone"]=>
+    string(3) "UTC"
+  }
+  ["end"]=>
+  NULL
+  ["interval"]=>
+  object(DateInterval)#8 (15) {
+    ["y"]=>
+    int(0)
+    ["m"]=>
+    int(0)
+    ["d"]=>
+    int(1)
+    ["h"]=>
+    int(0)
+    ["i"]=>
+    int(0)
+    ["s"]=>
+    int(0)
+    ["weekday"]=>
+    int(0)
+    ["weekday_behavior"]=>
+    int(0)
+    ["first_last_day_of"]=>
+    int(0)
+    ["invert"]=>
+    int(0)
+    ["days"]=>
+    int(0)
+    ["special_type"]=>
+    int(0)
+    ["special_amount"]=>
+    int(0)
+    ["have_weekday_relative"]=>
+    int(0)
+    ["have_special_relative"]=>
+    int(0)
+  }
+  ["recurrences"]=>
+  int(3)
+  ["include_start_date"]=>
+  bool(true)
+}
+Unserialized:
+2010-01-01 00:00:00
+2010-01-02 00:00:00
+2010-01-03 00:00:00
+==DONE==
@@ -0,0 +1,13 @@
+--TEST--
+Bug #53437 (Crash when using unserialized DatePeriod instance), variation 2
+--FILE--
+<?php
+$s = 'O:10:"DatePeriod":0:{}';
+
+$dp = unserialize($s);
+
+var_dump($dp);
+?>
+==DONE==
+--EXPECTF--
+Fatal error: Invalid serialization data for DatePeriod object in %sbug53437_var1.php on line %d
@@ -0,0 +1,80 @@
+--TEST--
+Bug #53437 DateInterval basic serialization
+--FILE--
+<?php
+$di0 = new DateInterval('P2Y4DT6H8M');
+
+$s = serialize($di0);
+
+$di1 = unserialize($s);
+
+var_dump($di0, $di1);
+
+?>
+==DONE==
+--EXPECT--
+object(DateInterval)#1 (15) {
+  ["y"]=>
+  int(2)
+  ["m"]=>
+  int(0)
+  ["d"]=>
+  int(4)
+  ["h"]=>
+  int(6)
+  ["i"]=>
+  int(8)
+  ["s"]=>
+  int(0)
+  ["weekday"]=>
+  int(0)
+  ["weekday_behavior"]=>
+  int(0)
+  ["first_last_day_of"]=>
+  int(0)
+  ["invert"]=>
+  int(0)
+  ["days"]=>
+  bool(false)
+  ["special_type"]=>
+  int(0)
+  ["special_amount"]=>
+  int(0)
+  ["have_weekday_relative"]=>
+  int(0)
+  ["have_special_relative"]=>
+  int(0)
+}
+object(DateInterval)#2 (15) {
+  ["y"]=>
+  int(2)
+  ["m"]=>
+  int(0)
+  ["d"]=>
+  int(4)
+  ["h"]=>
+  int(6)
+  ["i"]=>
+  int(8)
+  ["s"]=>
+  int(0)
+  ["weekday"]=>
+  int(0)
+  ["weekday_behavior"]=>
+  int(0)
+  ["first_last_day_of"]=>
+  int(0)
+  ["invert"]=>
+  int(0)
+  ["days"]=>
+  int(0)
+  ["special_type"]=>
+  int(0)
+  ["special_amount"]=>
+  int(0)
+  ["have_weekday_relative"]=>
+  int(0)
+  ["have_special_relative"]=>
+  int(0)
+}
+==DONE==
@@ -0,0 +1,47 @@
+--TEST--
+Bug #53437 DateInterval unserialize bad data, 32 bit
+--SKIPIF--
+<?php if (PHP_INT_SIZE != 4) { die('skip 32 bit only'); } ?>
+--FILE--
+<?php
+$s = 'O:12:"DateInterval":15:{s:1:"y";s:1:"2";s:1:"m";s:1:"0";s:1:"d";s:3:"bla";s:1:"h";s:1:"6";s:1:"i";s:1:"8";s:1:"s";s:1:"0";s:7:"weekday";i:10;s:16:"weekday_behavior";i:10;s:17:"first_last_day_of";i:0;s:6:"invert";i:0;s:4:"days";s:4:"aoeu";s:12:"special_type";i:0;s:14:"special_amount";s:21:"234523452345234532455";s:21:"have_weekday_relative";i:21474836489;s:21:"have_special_relative";s:3:"bla";}';
+
+$di = unserialize($s);
+var_dump($di);
+
+?>
+==DONE==
+--EXPECTF--
+object(DateInterval)#%d (15) {
+  ["y"]=>
+  int(2)
+  ["m"]=>
+  int(0)
+  ["d"]=>
+  int(0)
+  ["h"]=>
+  int(6)
+  ["i"]=>
+  int(8)
+  ["s"]=>
+  int(0)
+  ["weekday"]=>
+  int(10)
+  ["weekday_behavior"]=>
+  int(10)
+  ["first_last_day_of"]=>
+  int(0)
+  ["invert"]=>
+  int(0)
+  ["days"]=>
+  int(0)
+  ["special_type"]=>
+  int(0)
+  ["special_amount"]=>
+  int(-1)
+  ["have_weekday_relative"]=>
+  int(9)
+  ["have_special_relative"]=>
+  int(0)
+}
+==DONE==
@@ -0,0 +1,64 @@
+--TEST--
+Bug #53437 (Check that var_dump out is the same using the whole object or it's single properties), variation 4
+--INI--
+date.timezone = Europe/Berlin
+--FILE--
+<?php
+$dt = new DateTime('2009-10-11');
+
+$df = $dt->diff(new DateTime('2009-10-13'));
+
+var_dump($df,
+	$df->y,
+	$df->m,
+	$df->d,
+	$df->h,
+	$df->i,
+	$df->s,
+	$df->invert,
+	$df->days);
+
+?>
+==DONE==
+--EXPECTF--
+object(DateInterval)#%d (15) {
+  ["y"]=>
+  int(0)
+  ["m"]=>
+  int(0)
+  ["d"]=>
+  int(2)
+  ["h"]=>
+  int(0)
+  ["i"]=>
+  int(0)
+  ["s"]=>
+  int(0)
+  ["weekday"]=>
+  int(0)
+  ["weekday_behavior"]=>
+  int(0)
+  ["first_last_day_of"]=>
+  int(0)
+  ["invert"]=>
+  int(0)
+  ["days"]=>
+  int(2)
+  ["special_type"]=>
+  int(0)
+  ["special_amount"]=>
+  int(0)
+  ["have_weekday_relative"]=>
+  int(0)
+  ["have_special_relative"]=>
+  int(0)
+}
+int(0)
+int(0)
+int(2)
+int(0)
+int(0)
+int(0)
+int(0)
+int(2)
+==DONE==
@@ -0,0 +1,47 @@
+--TEST--
+Bug #53437 DateInterval unserialize bad data, 64 bit
+--SKIPIF--
+<?php if (PHP_INT_SIZE != 8) { die('skip true 64 bit only'); } ?>
+--FILE--
+<?php
+$s = 'O:12:"DateInterval":15:{s:1:"y";s:1:"2";s:1:"m";s:1:"0";s:1:"d";s:3:"bla";s:1:"h";s:1:"6";s:1:"i";s:1:"8";s:1:"s";s:1:"0";s:7:"weekday";i:10;s:16:"weekday_behavior";i:10;s:17:"first_last_day_of";i:0;s:6:"invert";i:0;s:4:"days";s:4:"aoeu";s:12:"special_type";i:0;s:14:"special_amount";s:21:"234523452345234532455";s:21:"have_weekday_relative";i:21474836489;s:21:"have_special_relative";s:3:"bla";}';
+
+$di = unserialize($s);
+var_dump($di);
+
+?>
+==DONE==
+--EXPECTF--
+object(DateInterval)#%d (15) {
+  ["y"]=>
+  int(2)
+  ["m"]=>
+  int(0)
+  ["d"]=>
+  int(0)
+  ["h"]=>
+  int(6)
+  ["i"]=>
+  int(8)
+  ["s"]=>
+  int(0)
+  ["weekday"]=>
+  int(10)
+  ["weekday_behavior"]=>
+  int(10)
+  ["first_last_day_of"]=>
+  int(0)
+  ["invert"]=>
+  int(0)
+  ["days"]=>
+  int(0)
+  ["special_type"]=>
+  int(0)
+  ["special_amount"]=>
+  int(9223372036854775807)
+  ["have_weekday_relative"]=>
+  int(9)
+  ["have_special_relative"]=>
+  int(0)
+}
+==DONE==
@@ -28,7 +28,7 @@ object(DateTime)#2 (3) {
  ["timezone"]=>
  string(3) "EDT"
 }
-object(DateInterval)#3 (8) {
+object(DateInterval)#3 (15) {
  ["y"]=>
  int(0)
  ["m"]=>
@@ -41,8 +41,22 @@ object(DateInterval)#3 (8) {
  int(19)
  ["s"]=>
  int(40)
+  ["weekday"]=>
+  int(0)
+  ["weekday_behavior"]=>
+  int(0)
+  ["first_last_day_of"]=>
+  int(0)
  ["invert"]=>
  int(0)
  ["days"]=>
  int(33)
+  ["special_type"]=>
+  int(0)
+  ["special_amount"]=>
+  int(0)
+  ["have_weekday_relative"]=>
+  int(0)
+  ["have_special_relative"]=>
+  int(0)
 }
@@ -690,7 +690,7 @@ PHP_MINFO_FUNCTION(mysql)
 static void php_mysql_do_connect(INTERNAL_FUNCTION_PARAMETERS, int persistent)
 {
 	char *user=NULL, *passwd=NULL, *host_and_port=NULL, *socket=NULL, *tmp=NULL, *host=NULL;
-	int  user_len, passwd_len, host_len;
+	int  user_len = 0, passwd_len = 0, host_len = 0;
 	char *hashed_details=NULL;
 	int hashed_details_length, port = MYSQL_PORT;
 	long client_flags = 0;
@@ -1259,7 +1259,7 @@ void php_mysqli_fetch_into_hash(INTERNAL_FUNCTION_PARAMETERS, int override_flags

 #endif

-	if (into_object && Z_TYPE_P(return_value) != IS_NULL) {
+	if (into_object && Z_TYPE_P(return_value) == IS_ARRAY) {
 		zval dataset = *return_value;
 		zend_fcall_info fci;
 		zend_fcall_info_cache fcc;
@@ -0,0 +1,23 @@
+--TEST--
+Bug #63398 (Memleak when calling fetch_object on a use_result and DB pointer has closed)
+--SKIPIF--
+<?php
+require_once('skipif.inc');
+require_once("connect.inc");
+if (!$IS_MYSQLND) {
+    die("skip mysqlnd only test");
+}
+require_once('skipifconnectfailure.inc');
+?>
+--FILE--
+<?php
+require 'connect.inc';
+$db = new my_mysqli($host, $user, $passwd, $db, $port, $socket);
+
+$result = $db->query('SELECT 1', MYSQLI_USE_RESULT);
+$db->close();
+var_dump($result->fetch_object());
+?>
+--EXPECTF--
+Warning: mysqli_result::fetch_object(): Error while reading a row in %sbug64726.php on line %d
+bool(false)
@@ -1547,6 +1547,7 @@ MYSQLND_METHOD(mysqlnd_res, fetch_into)(MYSQLND_RES * result, unsigned int flags
 	mysqlnd_array_init(return_value, mysqlnd_num_fields(result) * 2);
 	if (FAIL == result->m.fetch_row(result, (void *)return_value, flags, &fetched_anything TSRMLS_CC)) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Error while reading a row");
+		zval_dtor(return_value);
 		RETVAL_FALSE;
 	} else if (fetched_anything == FALSE) {
 		zval_dtor(return_value);
@@ -644,18 +644,28 @@ static time_t asn1_time_to_time_t(ASN1_UTCTIME * timestr TSRMLS_DC) /* {{{ */
 	char * thestr;
 	long gmadjust = 0;

-	if (timestr->length < 13) {
-		php_error_docref(NULL TSRMLS_CC, E_WARNING, "extension author too lazy to parse %s correctly", timestr->data);
+	if (ASN1_STRING_type(timestr) != V_ASN1_UTCTIME) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "illegal ASN1 data type for timestamp");
 		return (time_t)-1;
 	}

-	strbuf = estrdup((char *)timestr->data);
+	if (ASN1_STRING_length(timestr) != strlen(ASN1_STRING_data(timestr))) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "illegal length in timestamp");
+		return (time_t)-1;
+	}
+
+	if (ASN1_STRING_length(timestr) < 13) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "unable to parse time string %s correctly", timestr->data);
+		return (time_t)-1;
+	}
+
+	strbuf = estrdup((char *)ASN1_STRING_data(timestr));

 	memset(&thetime, 0, sizeof(thetime));

 	/* we work backwards so that we can use atoi more easily */

-	thestr = strbuf + timestr->length - 3;
+	thestr = strbuf + ASN1_STRING_length(timestr) - 3;

 	thetime.tm_sec = atoi(thestr);
 	*thestr = '\0';
@@ -1326,6 +1336,74 @@ PHP_FUNCTION(openssl_x509_check_private_key)
 }
 /* }}} */

+/* Special handling of subjectAltName, see CVE-2013-4073
+ * Christian Heimes
+ */
+
+static int openssl_x509v3_subjectAltName(BIO *bio, X509_EXTENSION *extension)
+{
+	GENERAL_NAMES *names;
+	const X509V3_EXT_METHOD *method = NULL;
+	long i, length, num;
+	const unsigned char *p;
+
+	method = X509V3_EXT_get(extension);
+	if (method == NULL) {
+		return -1;
+	}
+
+	p = extension->value->data;
+	length = extension->value->length;
+	if (method->it) {
+		names = (GENERAL_NAMES*)(ASN1_item_d2i(NULL, &p, length,
+						       ASN1_ITEM_ptr(method->it)));
+	} else {
+		names = (GENERAL_NAMES*)(method->d2i(NULL, &p, length));
+	}
+	if (names == NULL) {
+		return -1;
+	}
+
+	num = sk_GENERAL_NAME_num(names);
+	for (i = 0; i < num; i++) {
+			GENERAL_NAME *name;
+			ASN1_STRING *as;
+			name = sk_GENERAL_NAME_value(names, i);
+			switch (name->type) {
+				case GEN_EMAIL:
+					BIO_puts(bio, "email:");
+					as = name->d.rfc822Name;
+					BIO_write(bio, ASN1_STRING_data(as),
+						  ASN1_STRING_length(as));
+					break;
+				case GEN_DNS:
+					BIO_puts(bio, "DNS:");
+					as = name->d.dNSName;
+					BIO_write(bio, ASN1_STRING_data(as),
+						  ASN1_STRING_length(as));
+					break;
+				case GEN_URI:
+					BIO_puts(bio, "URI:");
+					as = name->d.uniformResourceIdentifier;
+					BIO_write(bio, ASN1_STRING_data(as),
+						  ASN1_STRING_length(as));
+					break;
+				default:
+					/* use builtin print for GEN_OTHERNAME, GEN_X400,
+					 * GEN_EDIPARTY, GEN_DIRNAME, GEN_IPADD and GEN_RID
+					 */
+					GENERAL_NAME_print(bio, name);
+			}
+			/* trailing ', ' except for last element */
+			if (i < (num - 1)) {
+				BIO_puts(bio, ", ");
+			}
+	}
+	sk_GENERAL_NAME_pop_free(names, GENERAL_NAME_free);
+
+	return 0;
+}
+
 /* {{{ proto array openssl_x509_parse(mixed x509 [, bool shortnames=true])
   Returns an array of the fields/values of the CERT */
 PHP_FUNCTION(openssl_x509_parse)
@@ -1422,15 +1500,30 @@ PHP_FUNCTION(openssl_x509_parse)


 	for (i = 0; i < X509_get_ext_count(cert); i++) {
+		int nid;
 		extension = X509_get_ext(cert, i);
-		if (OBJ_obj2nid(X509_EXTENSION_get_object(extension)) != NID_undef) {
+		nid = OBJ_obj2nid(X509_EXTENSION_get_object(extension));
+		if (nid != NID_undef) {
 			extname = (char *)OBJ_nid2sn(OBJ_obj2nid(X509_EXTENSION_get_object(extension)));
 		} else {
 			OBJ_obj2txt(buf, sizeof(buf)-1, X509_EXTENSION_get_object(extension), 1);
 			extname = buf;
 		}
 		bio_out = BIO_new(BIO_s_mem());
-		if (X509V3_EXT_print(bio_out, extension, 0, 0)) {
+		if (nid == NID_subject_alt_name) {
+			if (openssl_x509v3_subjectAltName(bio_out, extension) == 0) {
+				BIO_get_mem_ptr(bio_out, &bio_buf);
+				add_assoc_stringl(subitem, extname, bio_buf->data, bio_buf->length, 1);
+			} else {
+				zval_dtor(return_value);
+				if (certresource == -1 && cert) {
+					X509_free(cert);
+				}
+				BIO_free(bio_out);
+				RETURN_FALSE;
+			}
+		}
+		else if (X509V3_EXT_print(bio_out, extension, 0, 0)) {
 			BIO_get_mem_ptr(bio_out, &bio_buf);
 			add_assoc_stringl(subitem, extname, bio_buf->data, bio_buf->length, 1);
 		} else {
@@ -0,0 +1,29 @@
+-----BEGIN CERTIFICATE-----
+MIIEpDCCA4ygAwIBAgIJAJzu8r6u6eBcMA0GCSqGSIb3DQEBBQUAMIHDMQswCQYD
+VQQGEwJERTEcMBoGA1UECAwTTm9yZHJoZWluLVdlc3RmYWxlbjEQMA4GA1UEBwwH
+S8ODwrZsbjEUMBIGA1UECgwLU2VrdGlvbkVpbnMxHzAdBgNVBAsMFk1hbGljaW91
+cyBDZXJ0IFNlY3Rpb24xITAfBgNVBAMMGG1hbGljaW91cy5zZWt0aW9uZWlucy5k
+ZTEqMCgGCSqGSIb3DQEJARYbc3RlZmFuLmVzc2VyQHNla3Rpb25laW5zLmRlMHUY
+ZDE5NzAwMTAxMDAwMDAwWgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+AAAAAAAXDTE0MTEyODExMzkzNVowgcMxCzAJBgNVBAYTAkRFMRwwGgYDVQQIDBNO
+b3JkcmhlaW4tV2VzdGZhbGVuMRAwDgYDVQQHDAdLw4PCtmxuMRQwEgYDVQQKDAtT
+ZWt0aW9uRWluczEfMB0GA1UECwwWTWFsaWNpb3VzIENlcnQgU2VjdGlvbjEhMB8G
+A1UEAwwYbWFsaWNpb3VzLnNla3Rpb25laW5zLmRlMSowKAYJKoZIhvcNAQkBFhtz
+dGVmYW4uZXNzZXJAc2VrdGlvbmVpbnMuZGUwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+DwAwggEKAoIBAQDDAf3hl7JY0XcFniyEJpSSDqn0OqBr6QP65usJPRt/8PaDoqBu
+wEYT/Na+6fsgPjC0uK9DZgWg2tHWWoanSblAMoz5PH6Z+S4SHRZ7e2dDIjPjdhjh
+0mLg2UMO5yp0V797Ggs9lNt6JRfH81MN2obXWs4NtztLMuD6egqpr8dDbr34aOs8
+pkdui5UawTZksy5pLPHq5cMhFGm06v65CLo0V2Pd9+KAokPrPcN5KLKebz7mLpk6
+SMeEXOKP4idEqxyQ7O7fBuHMedsQhu+prY3si3BUyKfQtP5CZnX2bp0wKHxX12DX
+1nfFIt9DbGvHTcyOuN+nZLPBm3vWxntyIIvVAgMBAAGjQjBAMAkGA1UdEwQCMAAw
+EQYJYIZIAYb4QgEBBAQDAgeAMAsGA1UdDwQEAwIFoDATBgNVHSUEDDAKBggrBgEF
+BQcDAjANBgkqhkiG9w0BAQUFAAOCAQEAG0fZYYCTbdj1XYc+1SnoaPR+vI8C8CaD
+8+0UYhdnyU4gga0BAcDrY9e94eEAu6ZqycF6FjLqXXdAboppWocr6T6GD1x33Ckl
+VArzG/KxQohGD2JeqkhIMlDomxHO7ka39+Oa8i2vWLVyjU8AZvWMAruHa4EENyG7
+lW2AagaFKFCr9TnXTfrdxGVEbv7KVQ6bdhg5p5SjpWH1+Mq03uR3ZXPBYdyV8319
+o0lVj1KFI2DCL/liWisJRoof+1cR35Ctd0wYBcpB6TZslMcOPl76dwKwJgeJo2Qg
+Zsfmc2vC1/qOlNuNq/0TzzkVGv8ETT3CgaU+UXe4XOVvkccebJn2dg==
+-----END CERTIFICATE-----
+
+
@@ -0,0 +1,18 @@
+--TEST--
+CVE-2013-6420
+--SKIPIF--
+<?php 
+if (!extension_loaded("openssl")) die("skip"); 
+?>
+--FILE--
+<?php
+$crt = substr(__FILE__, 0, -4).'.crt';
+$info = openssl_x509_parse("file://$crt");
+var_dump($info['issuer']['emailAddress'], $info["validFrom_time_t"]);
+?>
+Done
+--EXPECTF--
+%s openssl_x509_parse(): illegal ASN1 data type for timestamp in %s/cve-2013-6420.php on line 3
+string(27) "stefan.esser@sektioneins.de"
+int(-1)
+Done
@@ -0,0 +1,28 @@
+-----BEGIN CERTIFICATE-----
+MIIE2DCCA8CgAwIBAgIBADANBgkqhkiG9w0BAQUFADCBxTELMAkGA1UEBhMCVVMx
+DzANBgNVBAgMBk9yZWdvbjESMBAGA1UEBwwJQmVhdmVydG9uMSMwIQYDVQQKDBpQ
+eXRob24gU29mdHdhcmUgRm91bmRhdGlvbjEgMB4GA1UECwwXUHl0aG9uIENvcmUg
+RGV2ZWxvcG1lbnQxJDAiBgNVBAMMG251bGwucHl0aG9uLm9yZwBleGFtcGxlLm9y
+ZzEkMCIGCSqGSIb3DQEJARYVcHl0aG9uLWRldkBweXRob24ub3JnMB4XDTEzMDgw
+NzEzMTE1MloXDTEzMDgwNzEzMTI1MlowgcUxCzAJBgNVBAYTAlVTMQ8wDQYDVQQI
+DAZPcmVnb24xEjAQBgNVBAcMCUJlYXZlcnRvbjEjMCEGA1UECgwaUHl0aG9uIFNv
+ZnR3YXJlIEZvdW5kYXRpb24xIDAeBgNVBAsMF1B5dGhvbiBDb3JlIERldmVsb3Bt
+ZW50MSQwIgYDVQQDDBtudWxsLnB5dGhvbi5vcmcAZXhhbXBsZS5vcmcxJDAiBgkq
+hkiG9w0BCQEWFXB5dGhvbi1kZXZAcHl0aG9uLm9yZzCCASIwDQYJKoZIhvcNAQEB
+BQADggEPADCCAQoCggEBALXq7cn7Rn1vO3aA3TrzA5QLp6bb7B3f/yN0CJ2XFj+j
+pHs+Gw6WWSUDpybiiKnPec33BFawq3kyblnBMjBU61ioy5HwQqVkJ8vUVjGIUq3P
+vX/wBmQfzCe4o4uM89gpHyUL9UYGG8oCRa17dgqcv7u5rg0Wq2B1rgY+nHwx3JIv
+KRrgSwyRkGzpN8WQ1yrXlxWjgI9de0mPVDDUlywcWze1q2kwaEPTM3hLAmD1PESA
+oY/n8A/RXoeeRs9i/Pm/DGUS8ZPINXk/yOzsR/XvvkTVroIeLZqfmFpnZeF0cHzL
+08LODkVJJ9zjLdT7SA4vnne4FEbAxDbKAq5qkYzaL4UCAwEAAaOB0DCBzTAMBgNV
+HRMBAf8EAjAAMB0GA1UdDgQWBBSIWlXAUv9hzVKjNQ/qWpwkOCL3XDALBgNVHQ8E
+BAMCBeAwgZAGA1UdEQSBiDCBhYIeYWx0bnVsbC5weXRob24ub3JnAGV4YW1wbGUu
+Y29tgSBudWxsQHB5dGhvbi5vcmcAdXNlckBleGFtcGxlLm9yZ4YpaHR0cDovL251
+bGwucHl0aG9uLm9yZwBodHRwOi8vZXhhbXBsZS5vcmeHBMAAAgGHECABDbgAAAAA
+AAAAAAAAAAEwDQYJKoZIhvcNAQEFBQADggEBAKxPRe99SaghcI6IWT7UNkJw9aO9
+i9eo0Fj2MUqxpKbdb9noRDy2CnHWf7EIYZ1gznXPdwzSN4YCjV5d+Q9xtBaowT0j
+HPERs1ZuytCNNJTmhyqZ8q6uzMLoht4IqH/FBfpvgaeC5tBTnTT0rD5A/olXeimk
+kX4LxlEx5RAvpGB2zZVRGr6LobD9rVK91xuHYNIxxxfEGE8tCCWjp0+3ksri9SXx
+VHWBnbM9YaL32u3hxm8sYB/Yb8WSBavJCWJJqRStVRHM1koZlJmXNx2BX4vPo6iW
+RFEIPQsFZRLrtnCAiEhyT8bC2s/Njlu6ly9gtJZWSV46Q3ZjBL4q9sHKqZQ=
+-----END CERTIFICATE-----
@@ -0,0 +1,19 @@
+--TEST--
+CVE 2013-4073: Null-byte certificate handling
+--SKIPIF--
+<?php 
+if (!extension_loaded("openssl")) die("skip");
+--FILE--
+<?php
+$cert = file_get_contents(__DIR__ . '/cve2013_4073.pem');
+$info = openssl_x509_parse($cert);
+var_export($info['extensions']);
+
+--EXPECTF--
+array (
+  'basicConstraints' => 'CA:FALSE',
+  'subjectKeyIdentifier' => '88:5A:55:C0:52:FF:61:CD:52:A3:35:0F:EA:5A:9C:24:38:22:F7:5C',
+  'keyUsage' => 'Digital Signature, Non Repudiation, Key Encipherment',
+  'subjectAltName' => 'DNS:altnull.python.org' . "\0" . 'example.com, email:null@python.org' . "\0" . 'user@example.org, URI:http://null.python.org' . "\0" . 'http://example.org, IP Address:192.0.2.1, IP Address:2001:DB8:0:0:0:0:0:1
+',
+)
@@ -344,7 +344,7 @@ static int firebird_stmt_get_col(pdo_stmt_t *stmt, int colno, char **ptr,  /* {{
 			if (n >= 0) {
 				*len = slprintf(*ptr, CHAR_BUF_LEN, "%" LL_MASK "d.%0*" LL_MASK "d", 
 					n / f, -var->sqlscale, n % f);
-			} else if (n < -f) {
+			} else if (n <= -f) {
 				*len = slprintf(*ptr, CHAR_BUF_LEN, "%" LL_MASK "d.%0*" LL_MASK "d",
 					n / f, -var->sqlscale, -n % f);				
 			 } else {
@@ -535,12 +535,14 @@ static int firebird_stmt_param_hook(pdo_stmt_t *stmt, struct pdo_bound_param_dat
 				int force_null;
 				
 				case IS_LONG:
-					var->sqltype = sizeof(long) == 8 ? SQL_INT64 : SQL_LONG;
+					/* keep the allow-NULL flag */
+					var->sqltype = (sizeof(long) == 8 ? SQL_INT64 : SQL_LONG) | (var->sqltype & 1);
 					var->sqldata = (void*)&Z_LVAL_P(param->parameter);
 					var->sqllen = sizeof(long);
 					break;
 				case IS_DOUBLE:
-					var->sqltype = SQL_DOUBLE;
+					/* keep the allow-NULL flag */
+					var->sqltype = SQL_DOUBLE | (var->sqltype & 1);
 					var->sqldata = (void*)&Z_DVAL_P(param->parameter);
 					var->sqllen = sizeof(double);
 					break;
@@ -560,7 +562,8 @@ static int firebird_stmt_param_hook(pdo_stmt_t *stmt, struct pdo_bound_param_dat
 							force_null = (Z_STRLEN_P(param->parameter) == 0);
 					}
 					if (!force_null) {
-						var->sqltype = SQL_TEXT;
+						/* keep the allow-NULL flag */
+						var->sqltype = SQL_TEXT | (var->sqltype & 1);
 						var->sqldata = Z_STRVAL_P(param->parameter);
 						var->sqllen	 = Z_STRLEN_P(param->parameter);
 						break;
@@ -0,0 +1,51 @@
+--TEST--
+Bug #62024 Cannot insert second row with null using parametrized query (Firebird PDO)
+--SKIPIF--
+<?php extension_loaded("pdo_firebird") or die("skip"); ?>
+<?php function_exists("ibase_query") or die("skip"); ?>
+--FILE--
+<?php
+
+require("testdb.inc");
+
+$dbh = new PDO("firebird:dbname=$test_base",$user,$password) or die;
+$dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_WARNING);
+$value = '2';
+@$dbh->exec('DROP TABLE test_insert');
+$dbh->exec("CREATE TABLE test_insert (ID INTEGER NOT NULL, TEXT VARCHAR(10))");
+
+$dbh->commit();
+
+//start actual test
+
+$sql = "insert into test_insert (id, text) values (?, ?)";
+$sttmt = $dbh->prepare($sql);
+
+$args_ok = array(1, "test1");
+$args_err = array(2, null);
+
+$res = $sttmt->execute($args_ok);
+var_dump($res);
+
+$res = $sttmt->execute($args_err);
+var_dump($res);
+
+$dbh->commit();
+
+
+//teardown test data
+$sttmt = $dbh->prepare('DELETE FROM test_insert');
+$sttmt->execute();
+
+$dbh->commit();
+
+$dbh->exec('DROP TABLE test_insert');
+
+unset($sttmt);
+unset($dbh);
+
+?>
+--EXPECT--
+bool(true)
+bool(true)
+
@@ -0,0 +1,45 @@
+--TEST--
+Bug #64037 Firebird return wrong value for numeric field
+--SKIPIF--
+<?php extension_loaded("pdo_firebird") or die("skip"); ?>
+<?php function_exists("ibase_query") or die("skip"); ?>
+--FILE--
+<?php
+
+require("testdb.inc");
+
+$dbh = new PDO("firebird:dbname=$test_base",$user,$password) or die;
+$dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_WARNING);
+$value = '2';
+@$dbh->exec('DROP TABLE price');
+$dbh->exec("CREATE TABLE PRICE (ID INTEGER NOT NULL, TEXT VARCHAR(10), COST NUMERIC(15, 2))");
+$dbh->exec("INSERT INTO PRICE (ID, TEXT, COST) VALUES (1, 'test', -1.0)");
+$dbh->exec("INSERT INTO PRICE (ID, TEXT, COST) VALUES (2, 'test', -0.99)");
+$dbh->exec("INSERT INTO PRICE (ID, TEXT, COST) VALUES (3, 'test', -1.01)");
+
+$dbh->commit();
+
+$query = "SELECT * from price order by ID";
+$stmt = $dbh->prepare($query);
+$stmt->execute();
+$rows = $stmt->fetchAll();
+var_dump($rows[0]['COST']);
+var_dump($rows[1]['COST']);
+var_dump($rows[2]['COST']);
+
+
+$stmt = $dbh->prepare('DELETE FROM price');
+$stmt->execute();
+
+$dbh->commit();
+
+$dbh->exec('DROP TABLE price');
+
+unset($stmt);
+unset($dbh);
+
+?>
+--EXPECT--
+string(5) "-1.00"
+string(5) "-0.99"
+string(5) "-1.01"
@@ -76,7 +76,7 @@ int _pdo_pgsql_error(pdo_dbh_t *dbh, pdo_stmt_t *stmt, int errcode, const char *
 		einfo->errmsg = NULL;
 	}

-	if (sqlstate == NULL) {
+	if (sqlstate == NULL || strlen(sqlstate) >= sizeof(pdo_error_type)) {
 		strcpy(*pdo_err, "HY000");
 	}
 	else {
@@ -110,8 +110,10 @@ $db->rollback();
 	echo "Exception! at line ", $e->getLine(), "\n";
 	var_dump($e->getMessage());
 }
-if(isset($filename)) {
-	@unlink($filename);
+
+// Clean up 
+foreach (array($filename, $filenameWithDifferentNullValues, $filenameWithDifferentNullValuesAndSelectedFields) as $f) {
+	@unlink($f);
 }
 ?>
 --EXPECT--
@@ -383,4 +385,4 @@ array(6) {
  NULL
 }
 Testing pgsqlCopyFromFile() with error
-bool(false)
+bool(false)
@@ -4875,7 +4875,7 @@ PHP_PGSQL_API int php_pgsql_meta_data(PGconn *pg_link, const char *table_name, z
 	}

 	smart_str_appends(&querystr, 
-			"SELECT a.attname, a.attnum, t.typname, a.attlen, a.attnotNULL, a.atthasdef, a.attndims "
+			"SELECT a.attname, a.attnum, t.typname, a.attlen, a.attnotnull, a.atthasdef, a.attndims, t.typtype = 'e' "
 			"FROM pg_class as c, pg_attribute a, pg_type t, pg_namespace n "
 			"WHERE a.attnum > 0 AND a.attrelid = c.oid AND c.relname = '");
 	tmp_name2 = php_addslashes(tmp_name2, strlen(tmp_name2), &new_len, 0 TSRMLS_CC);
@@ -4921,6 +4921,12 @@ PHP_PGSQL_API int php_pgsql_meta_data(PGconn *pg_link, const char *table_name, z
 			add_assoc_bool(elem, "has default", 0);
 		}
 		add_assoc_long(elem, "array dims", atoi(PQgetvalue(pg_result,i,6)));
+		if (!strcmp(PQgetvalue(pg_result,i,7), "t")) {
+			add_assoc_bool(elem, "is enum", 1);
+		}
+		else {
+			add_assoc_bool(elem, "is enum", 0);
+		}
 		name = PQgetvalue(pg_result,i,0);
 		add_assoc_zval(meta, name, elem);
 	}
@@ -4954,7 +4960,18 @@ PHP_FUNCTION(pg_meta_data)
 		zval_dtor(return_value); /* destroy array */
 		RETURN_FALSE;
 	}
-} 
+	else {
+		HashPosition pos;
+		zval **val;
+
+		for (zend_hash_internal_pointer_reset_ex(Z_ARRVAL_P(return_value), &pos);
+			zend_hash_get_current_data_ex(Z_ARRVAL_P(return_value), (void **)&val, &pos) == SUCCESS;
+			zend_hash_move_forward_ex(Z_ARRVAL_P(return_value), &pos)) {
+			/* delete newly added entry, in order to keep BC */
+			zend_hash_del_key_or_index(Z_ARRVAL_PP(val), "is enum", sizeof("is enum"), 0, HASH_DEL_KEY);
+		}
+	}
+}
 /* }}} */

 /* {{{ php_pgsql_get_data_type
@@ -5136,8 +5153,9 @@ PHP_PGSQL_API int php_pgsql_convert(PGconn *pg_link, const char *table_name, con
 	char *field = NULL;
 	uint field_len = -1;
 	ulong num_idx = -1;
-	zval *meta, **def, **type, **not_null, **has_default, **val, *new_val;
+	zval *meta, **def, **type, **not_null, **has_default, **is_enum, **val, *new_val;
 	int new_len, key_type, err = 0, skip_field;
+	php_pgsql_data_type data_type;
 	
 	assert(pg_link != NULL);
 	assert(Z_TYPE_P(values) == IS_ARRAY);
@@ -5188,17 +5206,30 @@ PHP_PGSQL_API int php_pgsql_convert(PGconn *pg_link, const char *table_name, con
 			php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Detected broken meta data. Missing 'has default'");
 			err = 1;
 		}
+		if (!err && zend_hash_find(Z_ARRVAL_PP(def), "is enum", sizeof("is enum"), (void **)&is_enum) == FAILURE) {
+			php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Detected broken meta data. Missing 'is enum'");
+			err = 1;
+		}
 		if (!err && (Z_TYPE_PP(val) == IS_ARRAY ||
 			 Z_TYPE_PP(val) == IS_OBJECT ||
 			 Z_TYPE_PP(val) == IS_CONSTANT_ARRAY)) {
-			php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Expects scaler values as field values");
+			php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Expects scalar values as field values");
 			err = 1;
 		}
 		if (err) {
 			break; /* break out for() */
 		}
 		ALLOC_INIT_ZVAL(new_val);
-		switch(php_pgsql_get_data_type(Z_STRVAL_PP(type), Z_STRLEN_PP(type)))
+
+		if (Z_BVAL_PP(is_enum)) {
+			/* enums need to be treated like strings */
+			data_type = PG_TEXT;
+		}
+		else {
+			data_type = php_pgsql_get_data_type(Z_STRVAL_PP(type), Z_STRLEN_PP(type));
+		}
+
+		switch(data_type)
 		{
 			case PG_BOOL:
 				switch (Z_TYPE_PP(val)) {
@@ -12,6 +12,7 @@ error_reporting(E_ALL);
 include 'config.inc';

 $db = pg_connect($conn_str);
+pg_query($db, "SET standard_conforming_strings = 0");

 $fields = array('num'=>'1234', 'str'=>'AAA', 'bin'=>'BBB');
 $converted = pg_convert($db, $table_name, $fields);
@@ -12,6 +12,8 @@ error_reporting(E_ALL);
 include 'config.inc';

 $db = pg_connect($conn_str);
+pg_query($db, "SET standard_conforming_strings = 0");
+
 $fields = array('num'=>'1234', 'str'=>'AAA', 'bin'=>'BBB');

 pg_insert($db, $table_name, $fields) or print "Error in test 1\n";
@@ -12,6 +12,8 @@ error_reporting(E_ALL);
 include 'config.inc';

 $db = pg_connect($conn_str);
+pg_query($db, "SET standard_conforming_strings = 0");
+
 $fields = array('num'=>'1234', 'str'=>'ABC', 'bin'=>'XYZ');
 $ids = array('num'=>'1234');

@@ -8,10 +8,11 @@ PostgreSQL pg_escape_bytea() functions

 include('config.inc');

+$db = pg_connect($conn_str);
+
 $image = file_get_contents(dirname(__FILE__) . '/php.gif');
 $esc_image = pg_escape_bytea($image);

-$db = pg_connect($conn_str);
 pg_query($db, 'INSERT INTO '.$table_name.' (num, bin) VALUES (9876, \''.$esc_image.'\');');
 $result = pg_query($db, 'SELECT * FROM '.$table_name.' WHERE num = 9876');
 $rows = pg_fetch_all($result);
@@ -0,0 +1,30 @@
+--TEST--
+Bug #64609 (pg_convert enum type support)
+--SKIPIF--
+<?php
+include("skipif.inc");
+skip_server_version('8.3', '<');
+?>
+--FILE--
+<?php
+error_reporting(E_ALL);
+
+include 'config.inc';
+
+$db = pg_connect($conn_str);
+pg_query("BEGIN");
+pg_query("CREATE TYPE t_enum AS ENUM ('ok', 'ko')");
+pg_query("CREATE TABLE test_enum (a t_enum)");
+
+$fields = array('a' => 'ok');
+$converted = pg_convert($db, 'test_enum', $fields);
+
+pg_query("ROLLBACK");
+
+var_dump($converted);
+?>
+--EXPECT--
+array(1) {
+  ["a"]=>
+  string(4) "'ok'"
+}
@@ -1897,6 +1897,10 @@ PHP_METHOD(Phar, buildFromDirectory)
 	pass.count = 0;
 	pass.ret = return_value;
 	pass.fp = php_stream_fopen_tmpfile();
+	if (pass.fp == NULL) {
+		zend_throw_exception_ex(phar_ce_PharException, 0 TSRMLS_CC, "phar \"%s\" unable to create temporary file", phar_obj->arc.archive->fname);
+		return;
+	}

 	if (phar_obj->arc.archive->is_persistent && FAILURE == phar_copy_on_write(&(phar_obj->arc.archive) TSRMLS_CC)) {
 		zval_ptr_dtor(&iteriter);
@@ -1977,6 +1981,10 @@ PHP_METHOD(Phar, buildFromIterator)
 	pass.ret = return_value;
 	pass.count = 0;
 	pass.fp = php_stream_fopen_tmpfile();
+	if (pass.fp == NULL) {
+		zend_throw_exception_ex(phar_ce_PharException, 0 TSRMLS_CC, "phar \"%s\": unable to create temporary file", phar_obj->arc.archive->fname);
+		return;
+	}

 	if (SUCCESS == spl_iterator_apply(obj, (spl_iterator_apply_func_t) phar_build, (void *) &pass TSRMLS_CC)) {
 		phar_obj->arc.archive->ufp = pass.fp;
@@ -2308,6 +2316,10 @@ static zval *phar_convert_to_other(phar_archive_data *source, int convert, char
 		zend_get_hash_value, NULL, 0);

 	phar->fp = php_stream_fopen_tmpfile();
+	if (phar->fp == NULL) {
+		zend_throw_exception_ex(phar_ce_PharException, 0 TSRMLS_CC, "unable to create temporary file");
+		return NULL;
+	}
 	phar->fname = source->fname;
 	phar->fname_len = source->fname_len;
 	phar->is_temporary_alias = source->is_temporary_alias;
@@ -847,7 +847,10 @@ int phar_tar_setmetadata(zval *metadata, phar_entry_info *entry, char **error TS
 	entry->is_modified = 1;
 	entry->fp = php_stream_fopen_tmpfile();
 	entry->offset = entry->offset_abs = 0;
-
+	if (entry->fp == NULL) {
+		spprintf(error, 0, "phar error: unable to create temporary file");
+		return -1;
+	}
 	if (entry->metadata_str.len != php_stream_write(entry->fp, entry->metadata_str.c, entry->metadata_str.len)) {
 		spprintf(error, 0, "phar tar error: unable to write metadata to magic metadata file \"%s\"", entry->filename);
 		zend_hash_del(&(entry->phar->manifest), entry->filename, entry->filename_len);
@@ -949,7 +952,10 @@ int phar_tar_flush(phar_archive_data *phar, char *user_stub, long len, int defau
 		entry.filename = estrndup(".phar/alias.txt", sizeof(".phar/alias.txt")-1);
 		entry.filename_len = sizeof(".phar/alias.txt")-1;
 		entry.fp = php_stream_fopen_tmpfile();
-
+		if (entry.fp == NULL) {
+			spprintf(error, 0, "phar error: unable to create temporary file");
+			return -1;
+		}
 		if (phar->alias_len != (int)php_stream_write(entry.fp, phar->alias, phar->alias_len)) {
 			if (error) {
 				spprintf(error, 0, "unable to set alias in tar-based phar \"%s\"", phar->fname);
@@ -1014,6 +1020,10 @@ int phar_tar_flush(phar_archive_data *phar, char *user_stub, long len, int defau

 		len = pos - user_stub + 18;
 		entry.fp = php_stream_fopen_tmpfile();
+		if (entry.fp == NULL) {
+			spprintf(error, 0, "phar error: unable to create temporary file");
+			return EOF;
+		}
 		entry.uncompressed_filesize = len + 5;

 		if ((size_t)len != php_stream_write(entry.fp, user_stub, len)
@@ -1038,7 +1048,10 @@ int phar_tar_flush(phar_archive_data *phar, char *user_stub, long len, int defau
 	} else {
 		/* Either this is a brand new phar (add the stub), or the default stub is required (overwrite the stub) */
 		entry.fp = php_stream_fopen_tmpfile();
-
+		if (entry.fp == NULL) {
+			spprintf(error, 0, "phar error: unable to create temporary file");
+			return EOF;
+		}
 		if (sizeof(newstub)-1 != php_stream_write(entry.fp, newstub, sizeof(newstub)-1)) {
 			php_stream_close(entry.fp);
 			if (error) {
@@ -1087,7 +1100,6 @@ nostub:
 	}

 	newfile = php_stream_fopen_tmpfile();
-
 	if (!newfile) {
 		if (error) {
 			spprintf(error, 0, "unable to create temporary file");
@@ -1174,7 +1186,10 @@ nostub:
 		entry.filename = ".phar/signature.bin";
 		entry.filename_len = sizeof(".phar/signature.bin")-1;
 		entry.fp = php_stream_fopen_tmpfile();
-
+		if (entry.fp == NULL) {
+			spprintf(error, 0, "phar error: unable to create temporary file");
+			return EOF;
+		}
 #ifdef WORDS_BIGENDIAN
 # define PHAR_SET_32(var, buffer) \
 	*(php_uint32 *)(var) = (((((unsigned char*)&(buffer))[3]) << 24) \
@@ -890,6 +890,10 @@ int phar_copy_entry_fp(phar_entry_info *source, phar_entry_info *dest, char **er
 	dest->offset = 0;
 	dest->is_modified = 1;
 	dest->fp = php_stream_fopen_tmpfile();
+	if (dest->fp == NULL) {
+		spprintf(error, 0, "phar error: unable to create temporary file");
+		return EOF;
+	}
 	phar_seek_efp(source, 0, SEEK_SET, 0, 1 TSRMLS_CC);
 	link = phar_get_link_source(source TSRMLS_CC);

@@ -1130,6 +1134,10 @@ int phar_separate_entry_fp(phar_entry_info *entry, char **error TSRMLS_DC) /* {{
 	}

 	fp = php_stream_fopen_tmpfile();
+	if (fp == NULL) {
+		spprintf(error, 0, "phar error: unable to create temporary file");
+		return FAILURE;
+	}
 	phar_seek_efp(entry, 0, SEEK_SET, 0, 1 TSRMLS_CC);
 	link = phar_get_link_source(entry TSRMLS_CC);

@@ -937,10 +937,11 @@ is_compressed:
 		PHAR_SET_32(local.uncompsize, entry->uncompressed_filesize);
 		PHAR_SET_32(central.compsize, entry->compressed_filesize);
 		PHAR_SET_32(local.compsize, entry->compressed_filesize);
-
-		if (-1 == php_stream_seek(p->old, entry->offset_abs, SEEK_SET)) {
-			spprintf(p->error, 0, "unable to seek to start of file \"%s\" while creating zip-based phar \"%s\"", entry->filename, entry->phar->fname);
-			return ZEND_HASH_APPLY_STOP;
+		if (p->old) {
+			if (-1 == php_stream_seek(p->old, entry->offset_abs, SEEK_SET)) {
+				spprintf(p->error, 0, "unable to seek to start of file \"%s\" while creating zip-based phar \"%s\"", entry->filename, entry->phar->fname);
+				return ZEND_HASH_APPLY_STOP;
+			}
 		}
 	}
 not_compressed:
@@ -1095,6 +1096,10 @@ static int phar_zip_applysignature(phar_archive_data *phar, struct _phar_zip_pas
 		off_t tell, st;

 		newfile = php_stream_fopen_tmpfile();
+		if (newfile == NULL) {
+			spprintf(pass->error, 0, "phar error: unable to create temporary file for the signature file");
+			return FAILURE;
+		}
 		st = tell = php_stream_tell(pass->filefp);
 		/* copy the local files, central directory, and the zip comment to generate the hash */
 		php_stream_seek(pass->filefp, 0, SEEK_SET);
@@ -1122,6 +1127,10 @@ static int phar_zip_applysignature(phar_archive_data *phar, struct _phar_zip_pas
 		entry.fp = php_stream_fopen_tmpfile();
 		entry.fp_type = PHAR_MOD;
 		entry.is_modified = 1;
+		if (entry.fp == NULL) {
+			spprintf(pass->error, 0, "phar error: unable to create temporary file for signature");
+			return FAILURE;
+		}

 		PHAR_SET_32(sigbuf, phar->sig_flags);
 		PHAR_SET_32(sigbuf + 4, signature_length);
@@ -1192,7 +1201,10 @@ int phar_zip_flush(phar_archive_data *phar, char *user_stub, long len, int defau
 	/* set alias */
 	if (!phar->is_temporary_alias && phar->alias_len) {
 		entry.fp = php_stream_fopen_tmpfile();
-
+		if (entry.fp == NULL) {
+			spprintf(error, 0, "phar error: unable to create temporary file");
+			return EOF;
+		}
 		if (phar->alias_len != (int)php_stream_write(entry.fp, phar->alias, phar->alias_len)) {
 			if (error) {
 				spprintf(error, 0, "unable to set alias in zip-based phar \"%s\"", phar->fname);
@@ -1267,6 +1279,10 @@ int phar_zip_flush(phar_archive_data *phar, char *user_stub, long len, int defau

 		len = pos - user_stub + 18;
 		entry.fp = php_stream_fopen_tmpfile();
+		if (entry.fp == NULL) {
+			spprintf(error, 0, "phar error: unable to create temporary file");
+			return EOF;
+		}
 		entry.uncompressed_filesize = len + 5;

 		if ((size_t)len != php_stream_write(entry.fp, user_stub, len)
@@ -1300,7 +1316,10 @@ int phar_zip_flush(phar_archive_data *phar, char *user_stub, long len, int defau
 	} else {
 		/* Either this is a brand new phar (add the stub), or the default stub is required (overwrite the stub) */
 		entry.fp = php_stream_fopen_tmpfile();
-
+		if (entry.fp == NULL) {
+			spprintf(error, 0, "phar error: unable to create temporary file");
+			return EOF;
+		}
 		if (sizeof(newstub)-1 != php_stream_write(entry.fp, newstub, sizeof(newstub)-1)) {
 			php_stream_close(entry.fp);
 			if (error) {
@@ -4142,7 +4142,7 @@ static xmlDocPtr serialize_response_call(sdlFunctionPtr function, char *function

 		if (version == SOAP_1_1) {
 			if (zend_hash_find(prop, "faultcode", sizeof("faultcode"), (void**)&tmp) == SUCCESS) {
-				int new_len;
+				size_t new_len;
 				xmlNodePtr node = xmlNewNode(NULL, BAD_CAST("faultcode"));
 				char *str = php_escape_html_entities((unsigned char*)Z_STRVAL_PP(tmp), Z_STRLEN_PP(tmp), &new_len, 0, 0, NULL TSRMLS_CC);
 				xmlAddChild(param, node);
@@ -4152,7 +4152,7 @@ static xmlDocPtr serialize_response_call(sdlFunctionPtr function, char *function
 					xmlNodeSetContent(node, code);
 					xmlFree(code);
 				} else {	
-					xmlNodeSetContentLen(node, BAD_CAST(str), new_len);
+					xmlNodeSetContentLen(node, BAD_CAST(str), (int)new_len);
 				}
 				efree(str);
 			}
@@ -4167,7 +4167,7 @@ static xmlDocPtr serialize_response_call(sdlFunctionPtr function, char *function
 			detail_name = "detail";
 		} else {
 			if (zend_hash_find(prop, "faultcode", sizeof("faultcode"), (void**)&tmp) == SUCCESS) {
-				int new_len;
+				size_t new_len;
 				xmlNodePtr node = xmlNewChild(param, ns, BAD_CAST("Code"), NULL);
 				char *str = php_escape_html_entities((unsigned char*)Z_STRVAL_PP(tmp), Z_STRLEN_PP(tmp), &new_len, 0, 0, NULL TSRMLS_CC);
 				node = xmlNewChild(node, ns, BAD_CAST("Value"), NULL);
@@ -4177,7 +4177,7 @@ static xmlDocPtr serialize_response_call(sdlFunctionPtr function, char *function
 					xmlNodeSetContent(node, code);
 					xmlFree(code);
 				} else {	
-					xmlNodeSetContentLen(node, BAD_CAST(str), new_len);
+					xmlNodeSetContentLen(node, BAD_CAST(str), (int)new_len);
 				}
 				efree(str);
 			}
@@ -1025,12 +1025,12 @@ static void spl_recursive_tree_iterator_get_entry(spl_recursive_it_object * obje
 	zend_replace_error_handling(EH_THROW, spl_ce_UnexpectedValueException, &error_handling TSRMLS_CC);
 	if (data && *data) {
 		RETVAL_ZVAL(*data, 1, 0);
-	}
-	if (Z_TYPE_P(return_value) == IS_ARRAY) {
-		zval_dtor(return_value);
-		ZVAL_STRINGL(return_value, "Array", sizeof("Array")-1, 1);
-	} else {
-		convert_to_string(return_value);
+		if (Z_TYPE_P(return_value) == IS_ARRAY) {
+			zval_dtor(return_value);
+			ZVAL_STRINGL(return_value, "Array", sizeof("Array")-1, 1);
+		} else {
+			convert_to_string(return_value);
+		}
 	}
 	zend_restore_error_handling(&error_handling TSRMLS_CC);
 }
@@ -1131,8 +1131,15 @@ SPL_METHOD(RecursiveTreeIterator, current)
 		}
 	}

+	INIT_ZVAL(prefix);
+	INIT_ZVAL(entry);
 	spl_recursive_tree_iterator_get_prefix(object, &prefix TSRMLS_CC);
 	spl_recursive_tree_iterator_get_entry(object, &entry TSRMLS_CC);
+	if (Z_TYPE(entry) != IS_STRING) {
+		zval_dtor(&prefix);
+		zval_dtor(&entry);
+		RETURN_NULL();
+	}
 	spl_recursive_tree_iterator_get_postfix(object, &postfix TSRMLS_CC);

 	str_len = Z_STRLEN(prefix) + Z_STRLEN(entry) + Z_STRLEN(postfix);
@@ -451,6 +451,19 @@ static int browser_reg_compare(zval **browser TSRMLS_DC, int num_args, va_list a
 }
 /* }}} */

+static void browscap_zval_copy_ctor(zval **p) /* {{{ */
+{
+	zval *new;
+
+	ALLOC_ZVAL(new);
+	*new = **p;
+
+	zval_copy_ctor(new);
+
+	INIT_PZVAL(new);
+	*p = new;
+} /* }}} */
+
 /* {{{ proto mixed get_browser([string browser_name [, bool return_array]])
   Get information about the capabilities of a browser. If browser_name is omitted or null, HTTP_USER_AGENT is used. Returns an object by default; if return_array is true, returns an array. */
 PHP_FUNCTION(get_browser)
@@ -511,11 +524,11 @@ PHP_FUNCTION(get_browser)

 	if (return_array) {
 		array_init(return_value);
-		zend_hash_copy(Z_ARRVAL_P(return_value), Z_ARRVAL_PP(agent), (copy_ctor_func_t) zval_add_ref, (void *) &tmp_copy, sizeof(zval *));
+		zend_hash_copy(Z_ARRVAL_P(return_value), Z_ARRVAL_PP(agent), (copy_ctor_func_t) browscap_zval_copy_ctor, (void *) &tmp_copy, sizeof(zval *));
 	}
 	else {
 		object_init(return_value);
-		zend_hash_copy(Z_OBJPROP_P(return_value), Z_ARRVAL_PP(agent), (copy_ctor_func_t) zval_add_ref, (void *) &tmp_copy, sizeof(zval *));
+		zend_hash_copy(Z_OBJPROP_P(return_value), Z_ARRVAL_PP(agent), (copy_ctor_func_t) browscap_zval_copy_ctor, (void *) &tmp_copy, sizeof(zval *));
 	}

 	while (zend_hash_find(Z_ARRVAL_PP(agent), "parent", sizeof("parent"), (void **) &z_agent_name) == SUCCESS) {
@@ -524,10 +537,10 @@ PHP_FUNCTION(get_browser)
 		}

 		if (return_array) {
-			zend_hash_merge(Z_ARRVAL_P(return_value), Z_ARRVAL_PP(agent), (copy_ctor_func_t) zval_add_ref, (void *) &tmp_copy, sizeof(zval *), 0);
+			zend_hash_merge(Z_ARRVAL_P(return_value), Z_ARRVAL_PP(agent), (copy_ctor_func_t) browscap_zval_copy_ctor, (void *) &tmp_copy, sizeof(zval *), 0);
 		}
 		else {
-			zend_hash_merge(Z_OBJPROP_P(return_value), Z_ARRVAL_PP(agent), (copy_ctor_func_t) zval_add_ref, (void *) &tmp_copy, sizeof(zval *), 0);
+			zend_hash_merge(Z_OBJPROP_P(return_value), Z_ARRVAL_PP(agent), (copy_ctor_func_t) browscap_zval_copy_ctor, (void *) &tmp_copy, sizeof(zval *), 0);
 		}
 	}

@@ -151,7 +151,7 @@ PHPAPI unsigned char *php_quot_print_encode(const unsigned char *str, size_t len
 	unsigned char c, *ret, *d;
 	char *hex = "0123456789ABCDEF";

-	ret = safe_emalloc(1, 3 * length + 3 * (((3 * length)/PHP_QPRINT_MAXL) + 1), 0);
+	ret = safe_emalloc(3, length + (((3 * length)/(PHP_QPRINT_MAXL-9)) + 1), 1);
 	d = ret;

 	while (length--) {
@@ -611,7 +611,6 @@ static int stream_array_to_fd_set(zval *stream_array, fd_set *fds, php_socket_t
 {
 	zval **elem;
 	php_stream *stream;
-	php_socket_t this_fd;
 	int cnt = 0;

 	if (Z_TYPE_P(stream_array) != IS_ARRAY) {
@@ -621,6 +620,11 @@ static int stream_array_to_fd_set(zval *stream_array, fd_set *fds, php_socket_t
 		 zend_hash_get_current_data(Z_ARRVAL_P(stream_array), (void **) &elem) == SUCCESS;
 		 zend_hash_move_forward(Z_ARRVAL_P(stream_array))) {

+		/* Temporary int fd is needed for the STREAM data type on windows, passing this_fd directly to php_stream_cast()
+		   would eventually bring a wrong result on x64. php_stream_cast() casts to int internally, and this will leave
+		   the higher bits of a SOCKET variable uninitialized on systems with little endian. */
+		int tmp_fd;
+
 		php_stream_from_zval_no_verify(stream, elem);
 		if (stream == NULL) {
 			continue;
@@ -630,7 +634,9 @@ static int stream_array_to_fd_set(zval *stream_array, fd_set *fds, php_socket_t
 		 * when casting.  It is only used here so that the buffered data warning
 		 * is not displayed.
 		 * */
-		if (SUCCESS == php_stream_cast(stream, PHP_STREAM_AS_FD_FOR_SELECT | PHP_STREAM_CAST_INTERNAL, (void*)&this_fd, 1) && this_fd != -1) {
+		if (SUCCESS == php_stream_cast(stream, PHP_STREAM_AS_FD_FOR_SELECT | PHP_STREAM_CAST_INTERNAL, (void*)&tmp_fd, 1) && tmp_fd != -1) {
+
+			php_socket_t this_fd = (php_socket_t)tmp_fd;

 			PHP_SAFE_FD_SET(this_fd, fds);

@@ -648,7 +654,6 @@ static int stream_array_from_fd_set(zval *stream_array, fd_set *fds TSRMLS_DC)
 	zval **elem, **dest_elem;
 	php_stream *stream;
 	HashTable *new_hash;
-	php_socket_t this_fd;
 	int ret = 0;

 	if (Z_TYPE_P(stream_array) != IS_ARRAY) {
@@ -661,6 +666,11 @@ static int stream_array_from_fd_set(zval *stream_array, fd_set *fds TSRMLS_DC)
 		 zend_hash_get_current_data(Z_ARRVAL_P(stream_array), (void **) &elem) == SUCCESS;
 		 zend_hash_move_forward(Z_ARRVAL_P(stream_array))) {

+		/* Temporary int fd is needed for the STREAM data type on windows, passing this_fd directly to php_stream_cast()
+		   would eventually bring a wrong result on x64. php_stream_cast() casts to int internally, and this will leave
+		   the higher bits of a SOCKET variable uninitialized on systems with little endian. */
+		int tmp_fd;
+
 		php_stream_from_zval_no_verify(stream, elem);
 		if (stream == NULL) {
 			continue;
@@ -670,7 +680,10 @@ static int stream_array_from_fd_set(zval *stream_array, fd_set *fds TSRMLS_DC)
 		 * when casting.  It is only used here so that the buffered data warning
 		 * is not displayed.
 		 */
-		if (SUCCESS == php_stream_cast(stream, PHP_STREAM_AS_FD_FOR_SELECT | PHP_STREAM_CAST_INTERNAL, (void*)&this_fd, 1) && this_fd != -1) {
+		if (SUCCESS == php_stream_cast(stream, PHP_STREAM_AS_FD_FOR_SELECT | PHP_STREAM_CAST_INTERNAL, (void*)&tmp_fd, 1) && tmp_fd != -1) {
+
+			php_socket_t this_fd = (php_socket_t)tmp_fd;
+
 			if (PHP_SAFE_FD_ISSET(this_fd, fds)) {
 				zend_hash_next_index_insert(new_hash, (void *)elem, sizeof(zval *), (void **)&dest_elem);
 				if (dest_elem) {
@@ -1,5 +1,7 @@
 --TEST--
 Bug #31158 (array_splice on $GLOBALS crashes)
+--INI--
+error_reporting = E_ALL
 --FILE--
 <?php
 function __(){
@@ -8,6 +8,11 @@ if (!function_exists("glob")) {
 ?>
 --FILE--
 <?php
+
+// run this test in ext/standard/tests (see bug #64714)
+chdir(__DIR__); // ensure in ext/standard/tests/file
+chdir('..'); // move up to ext/standard/tests
+
 $globdirs = glob("*", GLOB_ONLYDIR);

 $dirs = array();
@@ -0,0 +1,52 @@
+--TEST--
+Bug #64770 stream_select() fails with pipes from proc_open() 
+--FILE--
+<?php
+
+$descs = array(
+	0 => array('pipe', 'r'), // stdin
+	1 => array('pipe', 'w'), // stdout
+	2 => array('pipe', 'w'), // strerr
+);
+
+$other_opts = array('suppress_errors' => false, 'binary_pipes' => true);
+
+$cmd = (substr(PHP_OS, 0, 3) == 'WIN') ? 'dir' : 'ls';
+$p = proc_open($cmd, $descs, $pipes, '.', NULL, $other_opts);
+
+if (is_resource($p)) {
+	$data = '';
+
+	while (1) {	
+		$w = $e = NULL;
+		$n = stream_select($pipes, $w, $e, 300);
+
+		if ($n === false) {
+			echo "no streams \n";
+			break;
+		} else if ($n === 0) {
+			echo "process timed out\n";
+			proc_terminate($p, 9);
+			break;
+		} else if ($n > 0) {
+			$line = fread($pipes[1], 8192);
+			if (strlen($line) == 0) {
+				/* EOF */
+				break;
+			}
+			$data .= $line;
+		}
+	}
+	var_dump(strlen($data));
+
+	$ret = proc_close($p);
+	var_dump($ret);
+} else {
+	echo "no process\n";
+}
+?>
+==DONE==
+--EXPECTF--
+int(%d)
+int(0)
+==DONE==
@@ -0,0 +1,12 @@
+--TEST--
+Bug #64879: quoted_printable_encode() wrong size calculation (CVE-2013-2110)
+--FILE--
+<?php
+
+quoted_printable_encode(str_repeat("\xf4", 1000)); 
+quoted_printable_encode(str_repeat("\xf4", 100000)); 
+
+echo "Done\n";
+?>
+--EXPECTF--	
+Done
@@ -0,0 +1,15 @@
+--TEST--
+Bug #65236 (heap corruption in xml parser)
+--SKIPIF--
+<?php
+require_once("skipif.inc");
+?>
+--FILE--
+<?php
+xml_parse_into_struct(xml_parser_create_ns(), str_repeat("<blah>", 1000), $a);
+
+echo "Done\n";
+?>
+--EXPECTF--
+Warning: xml_parse_into_struct(): Maximum depth exceeded - Results truncated in %s on line %d
+Done
@@ -427,7 +427,7 @@ static void xml_parser_dtor(zend_rsrc_list_entry *rsrc TSRMLS_DC)
 	}
 	if (parser->ltags) {
 		int inx;
-		for (inx = 0; inx < parser->level; inx++)
+		for (inx = 0; ((inx < parser->level) && (inx < XML_MAXLEVEL)); inx++)
 			efree(parser->ltags[ inx ]);
 		efree(parser->ltags);
 	}
@@ -905,45 +905,50 @@ void _xml_startElementHandler(void *userData, const XML_Char *name, const XML_Ch
 		} 

 		if (parser->data) {
-			zval *tag, *atr;
-			int atcnt = 0;
+			if (parser->level <= XML_MAXLEVEL)  {
+				zval *tag, *atr;
+				int atcnt = 0;

-			MAKE_STD_ZVAL(tag);
-			MAKE_STD_ZVAL(atr);
+				MAKE_STD_ZVAL(tag);
+				MAKE_STD_ZVAL(atr);

-			array_init(tag);
-			array_init(atr);
+				array_init(tag);
+				array_init(atr);

-			_xml_add_to_info(parser,((char *) tag_name) + parser->toffset);
+				_xml_add_to_info(parser,((char *) tag_name) + parser->toffset);

-			add_assoc_string(tag,"tag",((char *) tag_name) + parser->toffset,1); /* cast to avoid gcc-warning */
-			add_assoc_string(tag,"type","open",1);
-			add_assoc_long(tag,"level",parser->level);
+				add_assoc_string(tag,"tag",((char *) tag_name) + parser->toffset,1); /* cast to avoid gcc-warning */
+				add_assoc_string(tag,"type","open",1);
+				add_assoc_long(tag,"level",parser->level);

-			parser->ltags[parser->level-1] = estrdup(tag_name);
-			parser->lastwasopen = 1;
+				parser->ltags[parser->level-1] = estrdup(tag_name);
+				parser->lastwasopen = 1;

-			attributes = (const XML_Char **) attrs;
+				attributes = (const XML_Char **) attrs;

-			while (attributes && *attributes) {
-				att = _xml_decode_tag(parser, attributes[0]);
-				val = xml_utf8_decode(attributes[1], strlen(attributes[1]), &val_len, parser->target_encoding);
-				
-				add_assoc_stringl(atr,att,val,val_len,0);
+				while (attributes && *attributes) {
+					att = _xml_decode_tag(parser, attributes[0]);
+					val = xml_utf8_decode(attributes[1], strlen(attributes[1]), &val_len, parser->target_encoding);

-				atcnt++;
-				attributes += 2;
+					add_assoc_stringl(atr,att,val,val_len,0);

-				efree(att);
+					atcnt++;
+					attributes += 2;
+
+					efree(att);
+				}
+
+				if (atcnt) {
+					zend_hash_add(Z_ARRVAL_P(tag),"attributes",sizeof("attributes"),&atr,sizeof(zval*),NULL);
+				} else {
+					zval_ptr_dtor(&atr);
+				}
+
+				zend_hash_next_index_insert(Z_ARRVAL_P(parser->data),&tag,sizeof(zval*),(void *) &parser->ctag);
+			} else if (parser->level == (XML_MAXLEVEL + 1)) {
+				TSRMLS_FETCH();
+				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Maximum depth exceeded - Results truncated");
 			}
-
-			if (atcnt) {
-				zend_hash_add(Z_ARRVAL_P(tag),"attributes",sizeof("attributes"),&atr,sizeof(zval*),NULL);
-			} else {
-				zval_ptr_dtor(&atr);
-			}
-
-			zend_hash_next_index_insert(Z_ARRVAL_P(parser->data),&tag,sizeof(zval*),(void *) &parser->ctag);
 		}

 		efree(tag_name);
@@ -995,7 +1000,7 @@ void _xml_endElementHandler(void *userData, const XML_Char *name)

 		efree(tag_name);

-		if (parser->ltags) {
+		if ((parser->ltags) && (parser->level <= XML_MAXLEVEL)) {
 			efree(parser->ltags[parser->level-1]);
 		}

@@ -1079,18 +1084,23 @@ void _xml_characterDataHandler(void *userData, const XML_Char *s, int len)
 						}
 					}

-					MAKE_STD_ZVAL(tag);
-					
-					array_init(tag);
-					
-					_xml_add_to_info(parser,parser->ltags[parser->level-1] + parser->toffset);
+					if (parser->level <= XML_MAXLEVEL) {
+						MAKE_STD_ZVAL(tag);

-					add_assoc_string(tag,"tag",parser->ltags[parser->level-1] + parser->toffset,1);
-					add_assoc_string(tag,"value",decoded_value,0);
-					add_assoc_string(tag,"type","cdata",1);
-					add_assoc_long(tag,"level",parser->level);
+						array_init(tag);

-					zend_hash_next_index_insert(Z_ARRVAL_P(parser->data),&tag,sizeof(zval*),NULL);
+						_xml_add_to_info(parser,parser->ltags[parser->level-1] + parser->toffset);
+
+						add_assoc_string(tag,"tag",parser->ltags[parser->level-1] + parser->toffset,1);
+						add_assoc_string(tag,"value",decoded_value,0);
+						add_assoc_string(tag,"type","cdata",1);
+						add_assoc_long(tag,"level",parser->level);
+
+						zend_hash_next_index_insert(Z_ARRVAL_P(parser->data),&tag,sizeof(zval*),NULL);
+					} else if (parser->level == (XML_MAXLEVEL + 1)) {
+						TSRMLS_FETCH();
+						php_error_docref(NULL TSRMLS_CC, E_WARNING, "Maximum depth exceeded - Results truncated");
+					}
 				}
 			} else {
 				efree(decoded_value);
@@ -2,7 +2,7 @@
 /* edit configure.in to change version number */
 #define PHP_MAJOR_VERSION 5
 #define PHP_MINOR_VERSION 3
-#define PHP_RELEASE_VERSION 25
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "5.3.25-dev"
-#define PHP_VERSION_ID 50325
+#define PHP_RELEASE_VERSION 28
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "5.3.28"
+#define PHP_VERSION_ID 50328
@@ -31,10 +31,18 @@

 /* Under BSD, emulate fopencookie using funopen */
 #if defined(HAVE_FUNOPEN) && !defined(HAVE_FOPENCOOKIE)
+
+/* NetBSD 6.0+ uses off_t instead of fpos_t in funopen */
+# if defined(__NetBSD__) && (__NetBSD_Version__ > 600000000)
+#  define PHP_FPOS_T off_t
+# else
+#  define PHP_FPOS_T fpos_t
+# endif
+
 typedef struct {
 	int (*reader)(void *, char *, int);
 	int (*writer)(void *, const char *, int);
-	fpos_t (*seeker)(void *, fpos_t, int);
+	PHP_FPOS_T (*seeker)(void *, PHP_FPOS_T, int);
 	int (*closer)(void *);
 } COOKIE_IO_FUNCTIONS_T;

@@ -68,11 +76,11 @@ static int stream_cookie_writer(void *cookie, const char *buffer, int size)
 	return php_stream_write((php_stream *)cookie, (char *)buffer, size);
 }

-static fpos_t stream_cookie_seeker(void *cookie, off_t position, int whence)
+static PHP_FPOS_T stream_cookie_seeker(void *cookie, off_t position, int whence)
 {
 	TSRMLS_FETCH();

-	return (fpos_t)php_stream_seek((php_stream *)cookie, position, whence);
+	return (PHP_FPOS_T)php_stream_seek((php_stream *)cookie, position, whence);
 }

 static int stream_cookie_closer(void *cookie)
@@ -540,12 +540,17 @@ static char *fpm_conf_set_array(zval *key, zval *value, void **config, int conve
 	kv->key = strdup(Z_STRVAL_P(key));

 	if (!kv->key) {
+		free(kv);
 		return "fpm_conf_set_array: strdup(key) failed";
 	}

 	if (convert_to_bool) {
 		char *err = fpm_conf_set_boolean(value, &subconf, 0);
-		if (err) return err;
+		if (err) {
+			free(kv->key);
+			free(kv);
+			return err;
+		}
 		kv->value = strdup(b ? "1" : "0");
 	} else {
 		kv->value = strdup(Z_STRVAL_P(value));
@@ -556,6 +561,7 @@ static char *fpm_conf_set_array(zval *key, zval *value, void **config, int conve

 	if (!kv->value) {
 		free(kv->key);
+		free(kv);
 		return "fpm_conf_set_array: strdup(value) failed";
 	}

@@ -578,6 +584,7 @@ static void *fpm_worker_pool_config_alloc() /* {{{ */
 	wp->config = malloc(sizeof(struct fpm_worker_pool_config_s));

 	if (!wp->config) { 
+		fpm_worker_pool_free(wp);
 		return 0;
 	}

@@ -1002,7 +1009,7 @@ static int fpm_conf_process_all_pools() /* {{{ */
 			nb_ext = 0;

 			/* find the number of extensions */
-			while ((ext = strtok(limit_extensions, " \t"))) {
+			while (strtok(limit_extensions, " \t")) {
 				limit_extensions = NULL;
 				nb_ext++;
 			}
@@ -1024,8 +1031,8 @@ static int fpm_conf_process_all_pools() /* {{{ */
 				nb_ext = 0;

 				/* parse the string and save the extension in the array */
-				while ((ext = strtok(security_limit_extensions, " \t"))) {
-					security_limit_extensions = NULL;
+				while ((ext = strtok(limit_extensions, " \t"))) {
+					limit_extensions = NULL;
 					wp->limit_extensions[nb_ext++] = strdup(ext);
 				}

@@ -1107,6 +1114,7 @@ int fpm_conf_write_pid() /* {{{ */

 		if (len != write(fd, buf, len)) {
 			zlog(ZLOG_SYSERROR, "Unable to write to the PID file.");
+			close(fd);
 			return -1;
 		}
 		close(fd);
@@ -1460,6 +1468,7 @@ int fpm_conf_load_ini_file(char *filename TSRMLS_DC) /* {{{ */

 	if (ini_recursion++ > 4) {
 		zlog(ZLOG_ERROR, "failed to include more than 5 files recusively");
+		close(fd);
 		return -1;
 	}

@@ -57,7 +57,9 @@ int fpm_log_open(int reopen) /* {{{ */
 			wp->log_fd = fd;
 		}

-		fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC);
+		if (0 > fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC)) {
+			zlog(ZLOG_WARNING, "failed to change attribute of access_log");
+		}
 	}

 	return ret;
@@ -237,7 +239,7 @@ int fpm_log_write(char *log_format TSRMLS_DC) /* {{{ */

 				case 'f': /* script */
 					if (!test) {
-						len2 = snprintf(b, FPM_LOG_BUFFER - len, "%s",  proc.script_filename && *proc.script_filename ? proc.script_filename : "-");
+						len2 = snprintf(b, FPM_LOG_BUFFER - len, "%s",  *proc.script_filename ? proc.script_filename : "-");
 					}
 					break;

@@ -249,7 +251,7 @@ int fpm_log_write(char *log_format TSRMLS_DC) /* {{{ */

 				case 'm': /* method */
 					if (!test) {
-						len2 = snprintf(b, FPM_LOG_BUFFER - len, "%s", proc.request_method && *proc.request_method ? proc.request_method : "-");
+						len2 = snprintf(b, FPM_LOG_BUFFER - len, "%s", *proc.request_method ? proc.request_method : "-");
 					}
 					break;

@@ -347,19 +349,19 @@ int fpm_log_write(char *log_format TSRMLS_DC) /* {{{ */

 				case 'q': /* query_string */
 					if (!test) {
-						len2 = snprintf(b, FPM_LOG_BUFFER - len, "%s", proc.query_string ? proc.query_string : "");
+						len2 = snprintf(b, FPM_LOG_BUFFER - len, "%s", proc.query_string);
 					}
 					break;

 				case 'Q': /* '?' */
 					if (!test) {
-						len2 = snprintf(b, FPM_LOG_BUFFER - len, "%s", proc.query_string && *proc.query_string  ? "?" : "");
+						len2 = snprintf(b, FPM_LOG_BUFFER - len, "%s", *proc.query_string  ? "?" : "");
 					}
 					break;

 				case 'r': /* request URI */
 					if (!test) {
-						len2 = snprintf(b, FPM_LOG_BUFFER - len, "%s", proc.request_uri ? proc.request_uri : "-");
+						len2 = snprintf(b, FPM_LOG_BUFFER - len, "%s", proc.request_uri);
 					}
 					break;

@@ -397,7 +399,7 @@ int fpm_log_write(char *log_format TSRMLS_DC) /* {{{ */

 				case 'u': /* remote user */
 					if (!test) {
-						len2 = snprintf(b, FPM_LOG_BUFFER - len, "%s", proc.auth_user ? proc.auth_user : "-");
+						len2 = snprintf(b, FPM_LOG_BUFFER - len, "%s", proc.auth_user);
 					}
 					break;

@@ -1179,119 +1179,123 @@ static void init_request_info(TSRMLS_D)
 				int len = script_path_translated_len;
 				char *ptr;

-				while ((ptr = strrchr(pt, '/')) || (ptr = strrchr(pt, '\\'))) {
-					*ptr = 0;
-					if (stat(pt, &st) == 0 && S_ISREG(st.st_mode)) {
-						/*
-						 * okay, we found the base script!
-						 * work out how many chars we had to strip off;
-						 * then we can modify PATH_INFO
-						 * accordingly
-						 *
-						 * we now have the makings of
-						 * PATH_INFO=/test
-						 * SCRIPT_FILENAME=/docroot/info.php
-						 *
-						 * we now need to figure out what docroot is.
-						 * if DOCUMENT_ROOT is set, this is easy, otherwise,
-						 * we have to play the game of hide and seek to figure
-						 * out what SCRIPT_NAME should be
-						 */
-						int ptlen = strlen(pt);
-						int slen = len - ptlen;
-						int pilen = env_path_info ? strlen(env_path_info) : 0;
-						int tflag = 0;
-						char *path_info;
-						if (apache_was_here) {
-							/* recall that PATH_INFO won't exist */
-							path_info = script_path_translated + ptlen;
-							tflag = (slen != 0 && (!orig_path_info || strcmp(orig_path_info, path_info) != 0));
-						} else {
-							path_info = env_path_info ? env_path_info + pilen - slen : NULL;
-							tflag = (orig_path_info != path_info);
-						}
-
-						if (tflag) {
-							if (orig_path_info) {
-								char old;
-
-								_sapi_cgibin_putenv("ORIG_PATH_INFO", orig_path_info TSRMLS_CC);
-								old = path_info[0];
-								path_info[0] = 0;
-								if (!orig_script_name ||
-									strcmp(orig_script_name, env_path_info) != 0) {
-									if (orig_script_name) {
-										_sapi_cgibin_putenv("ORIG_SCRIPT_NAME", orig_script_name TSRMLS_CC);
-									}
-									SG(request_info).request_uri = _sapi_cgibin_putenv("SCRIPT_NAME", env_path_info TSRMLS_CC);
-								} else {
-									SG(request_info).request_uri = orig_script_name;
-								}
-								path_info[0] = old;
-							}
-							env_path_info = _sapi_cgibin_putenv("PATH_INFO", path_info TSRMLS_CC);
-						}
-						if (!orig_script_filename ||
-							strcmp(orig_script_filename, pt) != 0) {
-							if (orig_script_filename) {
-								_sapi_cgibin_putenv("ORIG_SCRIPT_FILENAME", orig_script_filename TSRMLS_CC);
-							}
-							script_path_translated = _sapi_cgibin_putenv("SCRIPT_FILENAME", pt TSRMLS_CC);
-						}
-						TRANSLATE_SLASHES(pt);
-
-						/* figure out docroot
-						 * SCRIPT_FILENAME minus SCRIPT_NAME
-						 */
-						if (env_document_root) {
-							int l = strlen(env_document_root);
-							int path_translated_len = 0;
-							char *path_translated = NULL;
-
-							if (l && env_document_root[l - 1] == '/') {
-								--l;
-							}
-
-							/* we have docroot, so we should have:
-							 * DOCUMENT_ROOT=/docroot
+				if (pt) {
+					while ((ptr = strrchr(pt, '/')) || (ptr = strrchr(pt, '\\'))) {
+						*ptr = 0;
+						if (stat(pt, &st) == 0 && S_ISREG(st.st_mode)) {
+							/*
+							 * okay, we found the base script!
+							 * work out how many chars we had to strip off;
+							 * then we can modify PATH_INFO
+							 * accordingly
+							 *
+							 * we now have the makings of
+							 * PATH_INFO=/test
 							 * SCRIPT_FILENAME=/docroot/info.php
+							 *
+							 * we now need to figure out what docroot is.
+							 * if DOCUMENT_ROOT is set, this is easy, otherwise,
+							 * we have to play the game of hide and seek to figure
+							 * out what SCRIPT_NAME should be
 							 */
+							int ptlen = strlen(pt);
+							int slen = len - ptlen;
+							int pilen = env_path_info ? strlen(env_path_info) : 0;
+							int tflag = 0;
+							char *path_info;
+							if (apache_was_here) {
+								/* recall that PATH_INFO won't exist */
+								path_info = script_path_translated + ptlen;
+								tflag = (slen != 0 && (!orig_path_info || strcmp(orig_path_info, path_info) != 0));
+							} else {
+								path_info = env_path_info ? env_path_info + pilen - slen : NULL;
+								tflag = (orig_path_info != path_info);
+							}

-							/* PATH_TRANSLATED = DOCUMENT_ROOT + PATH_INFO */
-							path_translated_len = l + (env_path_info ? strlen(env_path_info) : 0);
-							path_translated = (char *) emalloc(path_translated_len + 1);
-							memcpy(path_translated, env_document_root, l);
-							if (env_path_info) {
-								memcpy(path_translated + l, env_path_info, (path_translated_len - l));
-							}
-							path_translated[path_translated_len] = '\0';
-							if (orig_path_translated) {
-								_sapi_cgibin_putenv("ORIG_PATH_TRANSLATED", orig_path_translated TSRMLS_CC);
-							}
-							env_path_translated = _sapi_cgibin_putenv("PATH_TRANSLATED", path_translated TSRMLS_CC);
-							efree(path_translated);
-						} else if (	env_script_name &&
-									strstr(pt, env_script_name)
-						) {
-							/* PATH_TRANSLATED = PATH_TRANSLATED - SCRIPT_NAME + PATH_INFO */
-							int ptlen = strlen(pt) - strlen(env_script_name);
-							int path_translated_len = ptlen + (env_path_info ? strlen(env_path_info) : 0);
-							char *path_translated = NULL;
+							if (tflag) {
+								if (orig_path_info) {
+									char old;

-							path_translated = (char *) emalloc(path_translated_len + 1);
-							memcpy(path_translated, pt, ptlen);
-							if (env_path_info) {
-								memcpy(path_translated + ptlen, env_path_info, path_translated_len - ptlen);
+									_sapi_cgibin_putenv("ORIG_PATH_INFO", orig_path_info TSRMLS_CC);
+									old = path_info[0];
+									path_info[0] = 0;
+									if (!orig_script_name ||
+										strcmp(orig_script_name, env_path_info) != 0) {
+										if (orig_script_name) {
+											_sapi_cgibin_putenv("ORIG_SCRIPT_NAME", orig_script_name TSRMLS_CC);
+										}
+										SG(request_info).request_uri = _sapi_cgibin_putenv("SCRIPT_NAME", env_path_info TSRMLS_CC);
+									} else {
+										SG(request_info).request_uri = orig_script_name;
+									}
+									path_info[0] = old;
+								}
+								env_path_info = _sapi_cgibin_putenv("PATH_INFO", path_info TSRMLS_CC);
 							}
-							path_translated[path_translated_len] = '\0';
-							if (orig_path_translated) {
-								_sapi_cgibin_putenv("ORIG_PATH_TRANSLATED", orig_path_translated TSRMLS_CC);
+							if (!orig_script_filename ||
+								strcmp(orig_script_filename, pt) != 0) {
+								if (orig_script_filename) {
+									_sapi_cgibin_putenv("ORIG_SCRIPT_FILENAME", orig_script_filename TSRMLS_CC);
+								}
+								script_path_translated = _sapi_cgibin_putenv("SCRIPT_FILENAME", pt TSRMLS_CC);
 							}
-							env_path_translated = _sapi_cgibin_putenv("PATH_TRANSLATED", path_translated TSRMLS_CC);
-							efree(path_translated);
+							TRANSLATE_SLASHES(pt);
+
+							/* figure out docroot
+							 * SCRIPT_FILENAME minus SCRIPT_NAME
+							 */
+							if (env_document_root) {
+								int l = strlen(env_document_root);
+								int path_translated_len = 0;
+								char *path_translated = NULL;
+
+								if (l && env_document_root[l - 1] == '/') {
+									--l;
+								}
+
+								/* we have docroot, so we should have:
+								 * DOCUMENT_ROOT=/docroot
+								 * SCRIPT_FILENAME=/docroot/info.php
+								 */
+
+								/* PATH_TRANSLATED = DOCUMENT_ROOT + PATH_INFO */
+								path_translated_len = l + (env_path_info ? strlen(env_path_info) : 0);
+								path_translated = (char *) emalloc(path_translated_len + 1);
+								memcpy(path_translated, env_document_root, l);
+								if (env_path_info) {
+									memcpy(path_translated + l, env_path_info, (path_translated_len - l));
+								}
+								path_translated[path_translated_len] = '\0';
+								if (orig_path_translated) {
+									_sapi_cgibin_putenv("ORIG_PATH_TRANSLATED", orig_path_translated TSRMLS_CC);
+								}
+								env_path_translated = _sapi_cgibin_putenv("PATH_TRANSLATED", path_translated TSRMLS_CC);
+								efree(path_translated);
+							} else if (	env_script_name &&
+										strstr(pt, env_script_name)
+							) {
+								/* PATH_TRANSLATED = PATH_TRANSLATED - SCRIPT_NAME + PATH_INFO */
+								int ptlen = strlen(pt) - strlen(env_script_name);
+								int path_translated_len = ptlen + (env_path_info ? strlen(env_path_info) : 0);
+								char *path_translated = NULL;
+
+								path_translated = (char *) emalloc(path_translated_len + 1);
+								memcpy(path_translated, pt, ptlen);
+								if (env_path_info) {
+									memcpy(path_translated + ptlen, env_path_info, path_translated_len - ptlen);
+								}
+								path_translated[path_translated_len] = '\0';
+								if (orig_path_translated) {
+									_sapi_cgibin_putenv("ORIG_PATH_TRANSLATED", orig_path_translated TSRMLS_CC);
+								}
+								env_path_translated = _sapi_cgibin_putenv("PATH_TRANSLATED", path_translated TSRMLS_CC);
+								efree(path_translated);
+							}
+							break;
 						}
-						break;
 					}
+				} else {
+					ptr = NULL;
 				}
 				if (!ptr) {
 					/*
@@ -145,7 +145,9 @@ static void sig_soft_quit(int signo) /* {{{ */

 	/* closing fastcgi listening socket will force fcgi_accept() exit immediately */
 	close(0);
-	socket(AF_UNIX, SOCK_STREAM, 0);
+	if (0 > socket(AF_UNIX, SOCK_STREAM, 0)) {
+		zlog(ZLOG_WARNING, "failed to create a new socket");
+	}
 	fpm_php_soft_quit();
 	errno = saved_errno;
 }
@@ -167,7 +167,7 @@ static int fpm_sockets_new_listening_socket(struct fpm_worker_pool_s *wp, struct
 {
 	int flags = 1;
 	int sock;
-	mode_t saved_umask;
+	mode_t saved_umask = 0;

 	sock = socket(sa->sa_family, SOCK_STREAM, 0);

@@ -176,11 +176,14 @@ static int fpm_sockets_new_listening_socket(struct fpm_worker_pool_s *wp, struct
 		return -1;
 	}

-	setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &flags, sizeof(flags));
+	if (0 > setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &flags, sizeof(flags))) {
+		zlog(ZLOG_WARNING, "failed to change socket attribute");
+	}

 	if (wp->listen_address_domain == FPM_AF_UNIX) {
 		if (fpm_socket_unix_test_connect((struct sockaddr_un *)sa, socklen) == 0) {
 			zlog(ZLOG_ERROR, "An another FPM instance seems to already listen on %s", ((struct sockaddr_un *) sa)->sun_path);
+			close(sock);
 			return -1;
 		}
 		unlink( ((struct sockaddr_un *) sa)->sun_path);
@@ -192,6 +195,7 @@ static int fpm_sockets_new_listening_socket(struct fpm_worker_pool_s *wp, struct
 		if (wp->listen_address_domain == FPM_AF_UNIX) {
 			umask(saved_umask);
 		}
+		close(sock);
 		return -1;
 	}

@@ -203,6 +207,7 @@ static int fpm_sockets_new_listening_socket(struct fpm_worker_pool_s *wp, struct
 		if (wp->socket_uid != -1 || wp->socket_gid != -1) {
 			if (0 > chown(path, wp->socket_uid, wp->socket_gid)) {
 				zlog(ZLOG_SYSERROR, "failed to chown() the socket '%s'", wp->config->listen_address);
+				close(sock);
 				return -1;
 			}
 		}
@@ -210,6 +215,7 @@ static int fpm_sockets_new_listening_socket(struct fpm_worker_pool_s *wp, struct

 	if (0 > listen(sock, wp->config->listen_backlog)) {
 		zlog(ZLOG_SYSERROR, "failed to listen to address '%s'", wp->config->listen_address);
+		close(sock);
 		return -1;
 	}

@@ -34,6 +34,7 @@ int fpm_stdio_init_main() /* {{{ */

 	if (0 > dup2(fd, STDIN_FILENO) || 0 > dup2(fd, STDOUT_FILENO)) {
 		zlog(ZLOG_SYSERROR, "failed to init stdio: dup2()");
+		close(fd);
 		return -1;
 	}
 	close(fd);
@@ -294,7 +295,9 @@ int fpm_stdio_open_error_log(int reopen) /* {{{ */
 			zlog_set_fd(fpm_globals.error_log_fd);
 		}
 	}
-	fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC);
+	if (0 > fcntl(fd, F_SETFD, fcntl(fd, F_GETFD) | FD_CLOEXEC)) {
+		zlog(ZLOG_WARNING, "failed to change attribute of error_log");
+	}
 	return 0;
 }
 /* }}} */
@@ -18,6 +18,21 @@

 struct fpm_worker_pool_s *fpm_worker_all_pools;

+void fpm_worker_pool_free(struct fpm_worker_pool_s *wp) /* {{{ */
+{
+	if (wp->config) {
+		free(wp->config);
+	}
+	if (wp->user) {
+		free(wp->user);
+	}
+	if (wp->home) {
+		free(wp->home);
+	}
+	free(wp);
+}
+/* }}} */
+
 static void fpm_worker_pool_cleanup(int which, void *arg) /* {{{ */
 {
 	struct fpm_worker_pool_s *wp, *wp_next;
@@ -29,10 +44,7 @@ static void fpm_worker_pool_cleanup(int which, void *arg) /* {{{ */
 		if ((which & FPM_CLEANUP_CHILD) == 0 && fpm_globals.parent_pid == getpid()) {
 			fpm_scoreboard_free(wp->scoreboard);
 		}
-		free(wp->config);
-		free(wp->user);
-		free(wp->home);
-		free(wp);
+		fpm_worker_pool_free(wp);
 	}
 	fpm_worker_all_pools = NULL;
 }
@@ -45,6 +45,7 @@ struct fpm_worker_pool_s {
 };

 struct fpm_worker_pool_s *fpm_worker_pool_alloc();
+void fpm_worker_pool_free(struct fpm_worker_pool_s *wp);
 int fpm_worker_pool_init_main();

 extern struct fpm_worker_pool_s *fpm_worker_all_pools;
Author	SHA1	Message	Date
Stanislav Malyshev	fabcd658d1	5.4.28	2013-12-10 11:04:57 -08:00
Stanislav Malyshev	c1224573c7	Fix CVE-2013-6420 - memory corruption in openssl_x509_parse	2013-12-10 11:03:49 -08:00
Christopher Jones	32873cd0dd	Merge branch 'PHP-5.3' of https://git.php.net/repository/php-src into PHP-5.3 * 'PHP-5.3' of https://git.php.net/repository/php-src: fix using wrong buffer pointer	2013-08-19 10:53:41 -07:00
Stanislav Malyshev	c1c49d6e39	fix using wrong buffer pointer	2013-08-19 01:02:12 -07:00
Stanislav Malyshev	dcea4ec698	Fix CVE-2013-4073 - handling of certs with null bytes	2013-08-13 22:24:11 -07:00
Christopher Jones	7c9bb87edd	Merge branch 'PHP-5.3' of https://git.php.net/repository/php-src into PHP-5.3 # By Johannes Schlüter # Via Christopher Jones (1) and Johannes Schlüter (1) * 'PHP-5.3' of https://git.php.net/repository/php-src: Merge PHP 5.3.27 NEWS add test for bug #65236	2013-07-22 10:58:52 -07:00
Christopher Jones	e2e002d4ea	Merge branch 'PHP-5.3' of https://git.php.net/repository/php-src into PHP-5.3 * 'PHP-5.3' of https://git.php.net/repository/php-src: Merge PHP 5.3.27 NEWS add test for bug #65236	2013-07-10 11:13:15 -07:00
Johannes Schlüter	9c4ef50146	Merge PHP 5.3.27 NEWS	2013-07-10 19:45:45 +02:00
Johannes Schlüter	710eee5555	add test for bug #65236	2013-07-10 19:35:18 +02:00
Rob Richards	7d163e8a08	truncate results at depth of 255 to prevent corruption	2013-07-06 07:53:07 -04:00
Nuno Lopes	e964817b24	fix assembly of safe_address() for x86 and x86_64	2013-07-03 18:02:28 -04:00
Sebastian Bergmann	50ac53e1b1	Add bison 2.6.4 to the list of supported versions	2013-07-03 06:36:54 +02:00
Johannes Schlüter	e4ee921b7e	Update git rules (5.5 is stable, 5.3 sec only)	2013-06-20 11:51:21 +02:00
Johannes Schlüter	f0eaa02f6f	This will be PHP 5.3.28	2013-06-19 15:08:02 +02:00
Matteo Beccati	6238dd6f32	Fixed bug #63186 (compile failure on netbsd)	2013-06-14 16:51:54 +02:00
Anatol Belski	cd1b44c4b6	ensure the error_reporting level to get expected notice	2013-06-12 13:13:48 +02:00
Anatol Belski	eccc05fc44	fixed tests	2013-06-11 12:38:49 +02:00
Anatol Belski	f16143f5ac	missing tests for bug #53437	2013-06-11 11:19:57 +02:00
Anatol Belski	18403e496d	missing colon	2013-06-10 19:54:29 +02:00
Anatol Belski	88c2dbe5fc	Backported the fix for bug #53437	2013-06-10 19:48:18 +02:00
Dmitry Stogov	f5f6404260	Fixed test script	2013-06-10 12:53:19 +04:00
Xinchen Hui	75c57122e3	Fixed bug #64997 (Segfault while using RecursiveIteratorIterator on 64-bits systems)	2013-06-09 22:24:48 +08:00
Xinchen Hui	e8f004d542	Fixed bug #64966 (segfault in zend_do_fcall_common_helper_SPEC)	2013-06-09 13:20:40 +08:00
Anatol Belski	1aee7ad636	Fixed bug #64934 Apache2 TS crash with get_browser() In favour of reading the browscap.ini into a true global var only once in MINIT, the price for that is to deep copy the any data from it.	2013-06-06 18:49:04 +02:00
Johannes Schlüter	ec3bcbcb5a	Add NEWS for PHP 5.3.26	2013-06-05 16:34:18 +02:00
Xinchen Hui	3c87945c95	Fixed bug #64960 (Segfault in gc_zval_possible_root)	2013-06-05 17:25:00 +08:00
Stanislav Malyshev	93e0d78ec6	fix CVE-2013-2110 - use correct formula to calculate string size	2013-06-04 21:56:33 -07:00
Matteo Beccati	2463e89794	Clean up leftover test files	2013-06-02 13:38:43 +02:00
Matteo Beccati	25aae37229	Fixed bug #64609 (pg_convert enum type support)	2013-06-02 06:29:35 +02:00
Matteo Beccati	79803bebde	Fixed bug #62857 (bytea test failures) Postgres 9.1+ test fixes. Tests were failing due to the default standard_conforming_strings GUC being changed to on. Also the pg_escape_bytea test was encoding the data before estabilishing a connection, thus falling back to the old escaping type which isn't properly handled by the backend when using a default configuration. I haven't updated the NEWS file as it's just test fixes.	2013-06-01 23:15:48 +02:00
Matteo Beccati	598e2690b8	Merge branch 'pull-request/309' into PHP-5.3	2013-05-31 16:26:38 +02:00
Matteo Beccati	bf4a034e3e	NEWS	2013-05-31 16:26:06 +02:00
Matteo Beccati	510498947e	Slightly edited tests and fix for bug #62024	2013-05-31 16:19:58 +02:00
Matheus Degiovani	df6ca450ce	Fixed bug #62024 (unable to run consecutive prepared querys with null values) Credits to james@kenjim.com for the patch.	2013-05-31 14:30:57 +02:00
Matheus Degiovani	65d233f06c	Fixed bug #64037 (wrong value returned when using a negative numeric field equal to the scale)	2013-05-31 14:30:51 +02:00
Remi Collet	1c623e3b07	Fixed Bug #64949 (Buffer overflow in _pdo_pgsql_error) There is a lot of call such as: pdo_pgsql_error(dbh, PGRES_FATAL_ERROR, "Copy command failed"); Where the 3rd paramater is a error message string where a sqlstate (5 chars) is expected. This cause a segfault in copy_from.phpt and copy_to.phpt. This is only a sanity check to avoid buffer overflow, but obviously this calls need to be fixed (using NULL or a correct sqlstate).	2013-05-31 08:39:32 +02:00
Dmitry Stogov	13e5c97ffd	Fixed incorrect argument number	2013-05-29 11:09:55 +04:00
Johannes Schlüter	4cb25d25f1	This will be PHP 5.3.27	2013-05-22 17:13:17 +02:00
Remi Collet	c50cef1dc5	Fixed bug #64895 Integer overflow in SndToJewish	2013-05-22 08:30:50 +02:00
Stanislav Malyshev	d4ad889824	fix order	2013-05-21 23:25:35 -07:00
Sara Golemon	2d5695cbc5	Don't double-quote name of namespaced function. ZEND_NS_NAMED_FE(ns, zend_name, name, arg_info) was resulting in a function declaration of: ns\"zend_name"() including the errant quotes. This diff corrects that. There are currently no uses of ZEND_NS_NAMED_FE in core and reason to believe that there are no uses in the wild either.	2013-05-19 13:32:17 -07:00
Remi Collet	4828f7343b	Integer overflow in SndToJewish leads to php hang AT least in (inputDay is long, metonicCycle is int): metonicCycle = (inputDay + 310) / 6940; So large value give strange (negative) results or php hangs. This is patch already applied in some linux distro.	2013-05-21 18:04:17 +02:00
Pierre Joye	46b05bc57a	entry for #64214	2013-05-17 11:49:13 +02:00
Pierre Joye	3eb1745643	other fix for #64214 , unmodified file may not have old fp set, causing other possible crashes	2013-05-17 11:45:13 +02:00
Anatol Belski	86db5fb4c2	Fix unitialized vars when sql.safe_mode=1 which can break the subsequent mysqlnd_connect() call	2013-05-15 11:12:17 +02:00
Pierre Joye	ba1af29805	more check for php_stream_fopen_tmpfile failure	2013-05-14 16:45:11 +02:00
Pierre Joye	533e636a62	php_stream_fopen_tmpfile may file, causing any following stream usage to crash	2013-05-14 09:20:53 +02:00
Anatol Belski	fe21accfb4	fix heap overflow warnings on win x64 debug crt	2013-05-13 14:24:21 +02:00
Anatol Belski	d6505acbf5	Fixed bug #64821 Custom Exceptions crash when internal properties overridden If user inherits Exception and overrides the properties to arbitrary data types, or simply doesn't run parent::__construct(), here we go. Just convert everything to the appropriate data type, like Exception::__toString() does.	2013-05-12 14:00:32 +02:00
Johannes Schlüter	1cc2162b83	PHP 5.3.25 NEWS	2013-05-08 18:01:39 +02:00
Anatol Belski	5c701d19ac	better fix for bug #64770	2013-05-04 12:16:38 +02:00
Boris Lytochkin	f1269d80c5	Merge branch 'PHP-5.3' of https://git.php.net/push/php-src into PHP-5.3 * 'PHP-5.3' of https://git.php.net/push/php-src: Fixed bug #64770 stream_select() fails with pipes	2013-05-03 19:23:46 +04:00
Anatol Belski	b1ea0b7a7a	Fixed bug #64770 stream_select() fails with pipes returned by proc_open() on Windows x64	2013-05-03 17:01:33 +02:00
Boris Lytochkin	aa448adc83	Merge branch 'PHP-5.3' of https://git.php.net/push/php-src into PHP-5.3 * 'PHP-5.3' of https://git.php.net/push/php-src: (39 commits) NEWS From code coverity scan, syscall return value must be check. fix more resource leaks From code coverity scan - fix some memory leak - fix some resources leak (fd) - create fpm_worker_pool_free (shared use) - possible null dref (wp->user and wp->home can be null) fixed size array cannot be null use limit_extensions as we use security_limit_extensions later (free) unused variable fix possible null deref (detected by code coverity scan) Also fixed bug #64726 in 5.3 Fix memory realted to #64726 Fix Test Bug #64714 PHP 5.3.26 this will be Fix NEWS Fix bug #64458 (dns_get_record result with string of length -1) Fixed incorrect check. SEND_REF may be executed before DO_FCALL when EX(function_state).function is not yet set to the calling function. Fixed stream_socket_pair() on Windows x64 and - Updated to version 2013.3 (2013c) lower the limit, should fit in a byte updated lib versions allow lcov 1.10 ...	2013-05-03 11:21:48 +04:00
Remi Collet	4a34d4a83c	NEWS	2013-05-03 08:29:56 +02:00
Remi Collet	0549e55d82	From code coverity scan, syscall return value must be check. To not alter current behaviour, we simply log the problem, so, if it occurs, the message will give explanation. This are only warning as they don't block the server, but such fail can explain strange (not expected) behaviour later.	2013-05-03 08:19:14 +02:00
Remi Collet	444e59eb20	fix more resource leaks	2013-05-02 13:47:24 +02:00
Remi Collet	331540d20c	From code coverity scan - fix some memory leak - fix some resources leak (fd) - create fpm_worker_pool_free (shared use) - possible null dref (wp->user and wp->home can be null)	2013-05-02 13:27:16 +02:00
Remi Collet	d0c40220d1	fixed size array cannot be null	2013-05-02 10:32:45 +02:00
Remi Collet	8492bbefbb	use limit_extensions as we use security_limit_extensions later (free)	2013-05-02 10:15:12 +02:00
Remi Collet	a7d6cb2360	unused variable	2013-05-02 10:15:05 +02:00
Remi Collet	ab117573cd	fix possible null deref (detected by code coverity scan)	2013-05-02 09:38:00 +02:00
Xinchen Hui	15b554cd9b	Also fixed bug #64726 in 5.3	2013-04-27 23:49:43 +08:00
Xinchen Hui	c7b8368ed5	Fix memory realted to #64726	2013-04-27 23:38:00 +08:00
Matt Ficken	bf5506f511	Fix Test Bug #64714	2013-04-25 11:34:57 -07:00
Johannes Schlüter	63434524f8	PHP 5.3.26 this will be	2013-04-25 18:02:53 +02:00
Johannes Schlüter	671ef9fda7	Fix NEWS	2013-04-25 17:58:02 +02:00