Update Git rules

Left out all file headers

Makefile.global

@@ -98,7 +98,9 @@ test: all
 		TEST_PHP_SRCDIR=$(top_srcdir) \
 		CC="$(CC)" \
 			$(PHP_EXECUTABLE) -n -c $(top_builddir)/tmp-php.ini $(PHP_TEST_SETTINGS) $(top_srcdir)/run-tests.php -n -c $(top_builddir)/tmp-php.ini -d extension_dir=$(top_builddir)/modules/ $(PHP_TEST_SHARED_EXTENSIONS) $(TESTS); \
+		TEST_RESULT_EXIT_CODE=$$?; \
 		rm $(top_builddir)/tmp-php.ini; \
+		exit $$TEST_RESULT_EXIT_CODE; \
 	else \
 		echo "ERROR: Cannot run tests without CLI sapi."; \
 	fi

NEWS

@@ -1,6 +1,83 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2013, PHP 5.3.27
+?? ??? 20??, PHP 5.3.30
+
+You should not add anything to this tree. PHP 5.3 reached EOL.
+
+14 Aug 2014, PHP 5.3.29
+
+- Core:
+  . Fixed bug #66127 (Segmentation fault with ArrayObject unset). (Stas)
+  . Fixed bug #67247 (spl_fixedarray_resize integer overflow). (Stas)
+  . Fixed bug #67249 (printf out-of-bounds read). (Stas)
+  . Fixed bug #67250 (iptcparse out-of-bounds read). (Stas)
+  . Fixed bug #67252 (convert_uudecode out-of-bounds read). (Stas)
+  . Fixed bug #67359 (Segfault in recursiveDirectoryIterator). (Laruence)
+  . Fixed bug #67390 (insecure temporary file use in the configure script).
+    (Remi) (CVE-2014-3981)
+  . Fixed bug #67399 (putenv with empty variable may lead to crash). (Stas)
+  . Fixed bug #67492 (unserialize() SPL ArrayObject / SPLObjectStorage Type 
+    Confusion) (CVE-2014-3515). (Stefan Esser)
+  . Fixed bug #67498 (phpinfo() Type Confusion Information Leak Vulnerability).
+    (Stefan Esser)
+
+- COM:
+  . Fixed missing type checks in com_event_sink (Yussuf Khalil, Stas).
+
+- Date:
+  . Fixed bug #66060 (Heap buffer over-read in DateInterval). (CVE-2013-6712)
+    (Remi)
+  . Fixed bug #67251 (date_parse_from_format out-of-bounds read). (Stas)
+  . Fixed bug #67253 (timelib_meridian_with_check out-of-bounds read). (Stas)
+
+- Exif:
+  . Fixed bug #65873 (Integer overflow in exif_read_data()). (Stas)
+
+- Fileinfo:
+  . Fixed bug #66307 (Fileinfo crashes with powerpoint files). (Anatol)
+  . Fixed bug #67326 (fileinfo: cdf_read_short_sector insufficient boundary
+    check). (CVE-2014-0207)
+  . Fixed bug #67327 (fileinfo: CDF infinite loop in nelements DoS).
+    (CVE-2014-0238)
+  . Fixed bug #67328 (fileinfo: fileinfo: numerous file_printf calls resulting
+    in performance degradation). (CVE-2014-0237)
+  . Fixed bug #67410 (fileinfo: mconvert incorrect handling of truncated pascal
+    string size). (Francisco Alonso, Jan Kaluza, Remi)
+  . Fixed bug #67411 (fileinfo: cdf_check_stream_offset insufficient boundary
+    check). (Francisco Alonso, Jan Kaluza, Remi)
+  . Fixed bug #67412 (fileinfo: cdf_count_chain insufficient boundary check).
+    (Francisco Alonso, Jan Kaluza, Remi)
+  . Fixed bug #67413 (fileinfo: cdf_read_property_info insufficient boundary
+    check). (Francisco Alonso, Jan Kaluza, Remi)
+
+- Intl:
+  . Fixed bug #67349 (Locale::parseLocale Double Free). (Stas)
+  . Fixed bug #67397 (Buffer overflow in locale_get_display_name and
+    uloc_getDisplayName (libicu 4.8.1)). (Stas)
+
+- Network:
+  . Fixed bug #67432 (Fix potential segfault in dns_check_record()).
+    (CVE-2014-4049). (Sara)
+
+- OpenSSL:
+  . Fixed missing type checks in OpenSSL options (Yussuf Khalil, Stas).
+
+- Session:
+  . Fixed missing type checks in php_session_create_id (Yussuf Khalil, Stas).
+
+12 Dec 2013, PHP 5.3.28
+
+- Openssl:
+  . Fixed handling null bytes in subjectAltName (CVE-2013-4073).
+    (Christian Heimes)
+  . Fixed memory corruption in openssl_x509_parse() (CVE-2013-6420).
+    (Stefan Esser).
+
+- FPM:
+  . Fixed bug #67060 (sapi/fpm: possible privilege escalation due to insecure
+    default configuration) (CVE-2014-0185). (Stas)
+
+11 Jul 2013, PHP 5.3.27
 
 - Core:
   . Fixed bug #64966 (segfault in zend_do_fcall_common_helper_SPEC). (Laruence)
@@ -28,6 +105,9 @@ PHP                                                                        NEWS
   . Fixed bug #64997 (Segfault while using RecursiveIteratorIterator on 
     64-bits systems). (Laruence)
 
+- XML:
+  . Fixed bug #65236 (heap corruption in xml parser). (Rob)
+
 06 Jun 2013, PHP 5.3.26
 
 - Core:

README.GIT-RULES

@@ -45,14 +45,15 @@ Currently we have the following branches in use::
 
   master    The active development branch. 
 
-  PHP-5.4   Is used to release the PHP 5.4.x series. It still allows for
-            larger enhancements.
-
-  PHP-5.3   Is used to release the PHP 5.3.x series. This is current 
+  PHP-5.5   Is used to release the PHP 5.5.x series. This is a current
             stable version and is open for bugfixes only.
 
-  PHP-5.2   Is used to release the PHP 5.2.x series. It is closed for 
-            changes now.
+  PHP-5.4   Is used to release the PHP 5.4.x series. This is a current
+            stable version and is open for bugfixes only.
+
+  PHP-5.3   This branch is closed.
+
+  PHP-5.2   This branch is closed.
 
   PHP-5.1   This branch is closed.
 
@@ -60,7 +61,7 @@ Currently we have the following branches in use::
 
 The next few rules are more of a technical nature::
 
-   1. All changes should first go to the lowest branch (i.e. 5.3) and then 
+   1. All changes should first go to the lowest branch (i.e. 5.4) and then
       get merged up to all other branches. If a change is not needed for
       later branches (i.e. fixes for features which where dropped from later
       branches) an empty merge should be done.

README.RELEASE_PROCESS

@@ -8,15 +8,16 @@ General notes and tips
 1. Do not release on Fridays, Saturdays or Sundays
 because the sysadmins can not upgrade stuff then.
 
-2. Package the day before a release. So if the release is to be on Thursday,
-package on Wednesday.
+2. Package two days before a release. So if the release is to be on Thursday,
+package on Tuesday. Think about timezones as well.
 
 3. Ensure that Windows builds will work before packaging
 
-4. Follow all steps to the letter. When unclear ask previous RM's (Derick/Ilia)
-before proceeding. Ideally make sure that for the first releases one of the
-previous RM's is around to answer questions. For the steps related to the
-php/QA/bug websites try to have someone from the webmaster team (Bjori) on hand.
+4. Follow all steps to the letter. When unclear ask previous RM's (David/Julien/
+Johannes/Stas/Derick/Ilia) before proceeding. Ideally make sure that for the
+first releases one of the previous RM's is around to answer questions. For the
+steps related to the php/QA/bug websites try to have someone from the webmaster
+team (Bjori) on hand.
 
 5. Verify the tags to be extra sure everything was tagged properly.
 
@@ -50,38 +51,44 @@ Rolling a non stable release (alpha/beta/RC)
 2. run the "scripts/dev/credits" script in php-src and commit the changes in the
 credits files in ext/standard.
 
-3. Bump the version numbers in ``main/php_version.h``, ``configure.in`` and possibly ``NEWS``.
-Do not use abbreviations for alpha and beta.
+3. Checkout the release branch for this release (e.g., PHP-5.4.2) from the main branch.
 
-4. Commit those changes and note the revision id.
+4. Bump the version numbers in ``main/php_version.h``, ``configure.in`` and possibly ``NEWS``.
+Do not use abbreviations for alpha and beta. Do not use dashes, you should
+``#define PHP_VERSION "5.4.22RC1"`` and not ``#define PHP_VERSION "5.4.22-RC1"``
 
-5. tag the repository with the version. To do the tag in a fast way do a svn copy on the server using full URLs. You should use the revision id from the above commit to prevent mistakes in case there was a commit in between. f.e. "``svn cp https://svn.php.net/repository/php/php-src/branches/PHP_5_3@308399  https://svn.php.net/repository/php/php-src/tags/php_5_3_6RC1``"
-(of course, you need to change that to the version you're rolling an RC for). Mail php-internals to announce the tag so tests/validation/check can be done prior to package it. It is especially important for RCs.
+5. Compile and make test, with and without ZTS, using the right Bison version
+(for example, for 5.5, Bison 2.4.1 is used)
 
-6. Bump up the version numbers in ``main/php_version.h``, ``configure.in``
-and possibly ``NEWS`` again, to the **next** version. F.e. if the release
-candidate was "4.4.1RC1" then the new one should be "4.4.1RC2-dev" - regardless
-if we get a new RC or not. This is to make sure ``version_compare()`` can
-correctly work.
+6. Check ./sapi/cli/php -v output for version matching.
 
-7. Commit those changes
+7. If all is right, commit the changes to the release branch with ``git commit -a``.
 
-8. Log in onto the snaps box and go into the correct tree (f.e. the PHP_4_4
-branch if you're rolling 4.4.x releases).
+8. Tag the repository release branch with the version, e.g.: 
+``git tag -u YOURKEYID php-5.4.2RC2``
 
-9. You do not have to update the tree, but of course you can with "``svn up``".
+9. Bump the version numbers in ``main/php_version.h``, ``configure.in`` and ``NEWS``
+in the *main* branch (PHP-5.4 for example) to prepare for the **next** version.
+F.e. if the RC is "5.4.1RC1" then the new one should be "5.4.2-dev" - regardless if we get
+a new RC or not. This is to make sure ``version_compare()`` can correctly work.
+Commit the changes to the main branch.
 
-10. run: ``./makedist php 4.4.1RC1``, this will export the tree, create configure
-and build two tarballs (one gz and one bz2).
+10. Push the changes to the main repo, the tag, the main branch and the release branch :
+``git push --tags origin HEAD``
+``git push origin {main branch}``
+``git push origin {release branch}``
 
-11. Copy those two tarballs to www.php.net, in your homedir there should be a
+11. run: ``PHPROOT=. ./makedist 5.4.2RC2``, this will export the tree, create configure
+and build three tarballs (gz, bz2 and xz).
+
+12. Copy those tarballs (scp, rsync) to downloads.php.net, in your homedir there should be a
 directory "downloads/". Copy them into there, so that the system can generate
-MD5 sums. If you do not have this directory, talk to Derick.
+MD5 sums. If you do not have this directory, talk to Derick or Dan.
 
-12. Now the RC can be found on http://downloads.php.net/yourname,
+13. Now the RC can be found on http://downloads.php.net/yourname,
 f.e. http://downloads.php.net/derick/
 
-13. Once the release has been tagged, contact the PHP Windows development team
+14. Once the release has been tagged, contact the PHP Windows development team
 (internals-win@lists.php.net) so that Windows binaries can be created. Once
 those are made, they should be placed into the same directory as the source snapshots.
 
@@ -94,10 +101,10 @@ pointing out "the location of the release" and "the possible release date of
 either the next RC, or the final release".
 
 2. Send an email (see example here http://news.php.net/php.pear.qa/5201) **To**
-``php-qa@lists.php.net`` and ``primary-qa-tests@lists.php.net``.
+``php-qa@lists.php.net`` and ``primary-qa-tester@lists.php.net``.
 This email is to notify the selected projects about a new release so that they
 can make sure their projects keep working. Make sure that you have been setup
-as a moderator for ``primary-qa-tests@lists.php.net`` by having someone (Wez,
+as a moderator for ``primary-qa-tester@lists.php.net`` by having someone (Hannes, Dan,
 Derick) run the following commands for you:
 
 ``ssh lists.php.net``
@@ -113,9 +120,9 @@ Derick) run the following commands for you:
 
    Note: Remember to update the MD5 checksum information.
 
-4. Update ``php.git/include/version.inc`` (x=major version number)
+4. Update ``web/php.git/include/version.inc`` (x=major version number)
 
- a. ``$PHP_x_RC`` = "5.3.0RC1"
+ a. ``$PHP_x_RC`` = "5.4.0RC1"  (should be set to "false" before)
 
  b. ``$PHP_x_RC_DATE`` = "06 September 2007"
 
@@ -126,67 +133,61 @@ Derick) run the following commands for you:
 6. For the first RC, write the doc team (phpdoc@lists.php.net) about updating the
 INSTALL and win32/install.txt files which are generated from the PHP manual sources.
 
-7. Publish the announce on www.php.net as well (for all releases, alpha, RCs or other)
-
 Rolling a stable release
 ------------------------
 
-1. Check windows snapshot builder logs (http://snaps.php.net/win32/snapshot-STABLE.log f.e.)
+1. Checkout your release branch, you should have created when releasing previous RC
+and bump the version numbers in ``main/php_version.h``, ``configure.in`` and possibly ``NEWS``.
 
-2. Bump the version numbers in ``main/php_version.h``, ``configure.in`` and possibly ``NEWS``.
+2. If a CVE commit needs to be merged to the release, then have it commited to
+the base branches and merged upwards as usual (f.e commit the CVE fix to 5.3,
+merge to 5.4, 5.5 etc...). Then you can cherry-pick it in your release branch.
+Don't forget to update NEWS manually in an extra commit then.
 
-3. **Merge** all related sections in NEWS (f.e. merge the 5.4.1RC1 and 5.4.0 sections)
+3. Commit those changes
 
-4. Commit those changes
-
-5. run the "scripts/dev/credits" script in php-src and commit the changes in the
+4. run the "scripts/dev/credits" script in php-src and commit the changes in the
 credits files in ext/standard.
 
-6. tag the repository with the version f.e. "``git tag -s php-5.4.1``"
-(of course, you need to change that to the version you're rolling an RC for).
-When making 5.X release, you need to tag the Zend directory separately!!
+5. Compile and make test, with and without ZTS, using the right Bison version
+(for example, for 5.5, Bison 2.4.1 is used)
 
-7. Bump up the version numbers in ``main/php_version.h``, ``configure.in`` and
-possibly ``NEWS`` again, to the **next** version. F.e. if the release candidate
-was "5.4.1RC1" then the new one should be "5.4.1RC2-dev" - regardless if we get
-a new RC or not. This is to make sure ``version_compare()`` can correctly work.
+6. Check ./sapi/cli/php -v output for version matching.
 
-8. Commit those changes
+7. tag the repository with the version f.e. "``git tag -s php-5.4.1``"
 
-9. Log in onto the snaps box and go into the correct tree (f.e. the PHP-5.4
-branch if you're rolling 5.5.x releases).
+8. Push the tag f.e. "``git push origin php-5.4.1``"
 
-10. You do not have to update the tree, but of course you can with "``git pull
-origin <branch>``".
+9. run: ``PHPROOT=. ./makedist php 5.4.1``, this will export the tag, create configure
+and build three tarballs (gz, bz2 and xz).
+Check if the pear files are updated (phar).
 
-11. run: ``./makedist php 5.4.1``, this will export the tree, create configure
-and build two tarballs (one gz and one bz2).
+10. Generate the GPG signature files for the archives.
+  ``gpg -u YOUREMAIL --armor --detach-sign php-X.Y.Z.tar.xxx``
 
-12. Commit those two tarballs to web/php-distributions.git, then update the git
-    submodule reference in web/php.git: 
-    git submodule init;
+11. Commit and push all the tarballs and signature files to web/php-distributions.git,
+    then update the git submodule reference in web/php.git: 
+    ``git submodule init;
     git submodule update;
     cd distributions;
     git pull origin master;
     cd ..;
     git commit distributions;
-    git push;
+    git push;``
+This is to fetch the last commit id from php-distributions.git and commit this
+last commit id to web/php.git, then, mirrors will now sync
 
-13. Once the release has been tagged, contact the PHP Windows development team
-(internals-win@lists.php.net) so that Windows binaries can be created. Once
-those are made, they should be committed to SVN too.
-
-14. Check if the pear files are updated (phar for 5.1+ or run pear/make-pear-bundle.php with 4.4)
-
-15. When making a final release, also remind the PHP Windows development team
-(internals-win@lists.php.net) to prepare the installer packages for Win32.
+12. Once the release has been tagged, contact the PHP Windows development team
+(internals-win@lists.php.net) so that Windows binaries can be created.
 
 Getting the stable release announced
 ------------------------------------
 
 1. Run the bumpRelease script for phpweb on your local checkout
 
- a. ``php bin/bumpRelease 5`` (or ``php bin/bumpRelease 4`` for PHP4)
+ a. ``php bin/bumpRelease 5`` to create the release file (releases/x_y_z.php)
+    The release announcement file should list in detail security fixes and
+    changes in behavior (whether due to a bug fix or not).
 
  b. In case multiple PHP minor versions are in active development you have
     to manually copy the old information to include/releases.inc
@@ -206,7 +207,13 @@ Getting the stable release announced
 
  f. if the windows builds aren't ready yet prefix the "windows" key with a dot (".windows")
 
-3. Update the ChangeLog file for the given major version
+3. Update phpweb/include/releases.php with the old release info
+  (updates the download archives)
+
+4. Update php-qa/include/release-qa.php and add the next version as an QARELEASE
+   (prepare for next RC)
+
+5. Update the ChangeLog file for the given major version
 f.e. ``ChangeLog-5.php`` from the NEWS file
 
  a. go over the list and put every element on one line
@@ -226,19 +233,10 @@ f.e. ``ChangeLog-5.php`` from the NEWS file
   IV. ``s/Fixed PECL bug #\([0-9]\+\)/<?php peclbugfix(\1); ?>/``
 
   V. ``s/FR #\([0-9]\+\)/FR <?php bugl(\1); ?>/``
+  
+  e. You may want to try php-web/bin/news2html to automate this task
 
-4. ``cp releases/5_4_0.php releases/5_4_1.php``
-
-5. ``git add releases/5_4_1.php``
-
-6. Update the ``releases/*.php`` file with relevant data. The release
-announcement file should list in detail:
-
- a. security fixes,
-
- b. changes in behavior (whether due to a bug fix or not)
-
-7. Add a short notice to phpweb stating that there is a new release, and
+6. Add a short notice to phpweb stating that there is a new release, and
 highlight the major important things (security fixes) and when it is important
 to upgrade.
 
@@ -246,7 +244,11 @@ to upgrade.
 
  b. Add the content for the news entry
 
-8. Commit all the changes.
+7. **Check mirrors have been synced before announcing or pushing news**
+  Try, f.e. http://www.php.net/get/php-5.5.1.tar.bz2/from/a/mirror
+  Try several mirrors, mirrors may update slowly (may take an hour)
+
+8. Commit all the changes to their respective git repos
 
 9. Wait an hour or two, then send a mail to php-announce@lists.php.net,
 php-general@lists.php.net and internals@lists.php.net with a text similar to

Zend/acinclude.m4

@@ -4,7 +4,7 @@ dnl This file contains local autoconf functions.
 
 AC_DEFUN([LIBZEND_BISON_CHECK],[
   # we only support certain bison versions
-  bison_version_list="1.28 1.35 1.75 1.875 2.0 2.1 2.2 2.3 2.4 2.4.1 2.4.2 2.4.3 2.5 2.5.1 2.6 2.6.1 2.6.2"
+  bison_version_list="1.28 1.35 1.75 1.875 2.0 2.1 2.2 2.3 2.4 2.4.1 2.4.2 2.4.3 2.5 2.5.1 2.6 2.6.1 2.6.2 2.6.4"
 
   # for standalone build of Zend Engine
   test -z "$SED" && SED=sed

Zend/zend.c

@@ -114,7 +114,7 @@ ZEND_API zval zval_used_for_init; /* True global variable */
 /* version information */
 static char *zend_version_info;
 static uint zend_version_info_length;
-#define ZEND_CORE_VERSION_INFO	"Zend Engine v" ZEND_VERSION ", Copyright (c) 1998-2013 Zend Technologies\n"
+#define ZEND_CORE_VERSION_INFO	"Zend Engine v" ZEND_VERSION ", Copyright (c) 1998-2014 Zend Technologies\n"
 #define PRINT_ZVAL_INDENT 4
 
 static void print_hash(zend_write_func_t write_func, HashTable *ht, int indent, zend_bool is_object TSRMLS_DC) /* {{{ */

Zend/zend_alloc.c

@@ -2386,7 +2386,7 @@ static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
 	size_t res = nmemb;
 	unsigned long overflow = 0;
 
-	__asm__ ("mull %3\n\taddl %4,%0\n\tadcl %1,%1"
+	__asm__ ("mull %3\n\taddl %4,%0\n\tadcl $0,%1"
 	     : "=&a"(res), "=&d" (overflow)
 	     : "%0"(res),
 	       "rm"(size),
@@ -2406,7 +2406,7 @@ static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
         size_t res = nmemb;
         unsigned long overflow = 0;
 
-        __asm__ ("mulq %3\n\taddq %4,%0\n\tadcq %1,%1"
+        __asm__ ("mulq %3\n\taddq %4,%0\n\tadcq $0,%1"
              : "=&a"(res), "=&d" (overflow)
              : "%0"(res),
                "rm"(size),

acinclude.m4

@@ -1700,7 +1700,7 @@ int main(int argc, char *argv[])
 {
   FILE *fp;
   long position;
-  char *filename = "/tmp/phpglibccheck";
+  char *filename = tmpnam(NULL);
   
   fp = fopen(filename, "w");
   if (fp == NULL) {

configure.in

@@ -41,7 +41,7 @@ AC_CONFIG_HEADER(main/php_config.h)
 
 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=3
-PHP_RELEASE_VERSION=27
+PHP_RELEASE_VERSION=30
 PHP_EXTRA_VERSION="-dev"
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

ext/com_dotnet/com_com.c

@@ -698,9 +698,9 @@ PHP_FUNCTION(com_event_sink)
 		/* 0 => typelibname, 1 => dispname */
 		zval **tmp;
 
-		if (zend_hash_index_find(Z_ARRVAL_P(sink), 0, (void**)&tmp) == SUCCESS)
+		if (zend_hash_index_find(Z_ARRVAL_P(sink), 0, (void**)&tmp) == SUCCESS && Z_TYPE_PP(tmp) == IS_STRING)
 			typelibname = Z_STRVAL_PP(tmp);
-		if (zend_hash_index_find(Z_ARRVAL_P(sink), 1, (void**)&tmp) == SUCCESS)
+		if (zend_hash_index_find(Z_ARRVAL_P(sink), 1, (void**)&tmp) == SUCCESS && Z_TYPE_PP(tmp) == IS_STRING)
 			dispname = Z_STRVAL_PP(tmp);
 	} else if (sink != NULL) {
 		convert_to_string(sink);

ext/date/lib/parse_date.c

@@ -1,4 +1,4 @@
-/* Generated by re2c 0.13.5 on Mon Dec  5 22:02:41 2011 */
+/* Generated by re2c 0.13.5 on Fri Jul 18 16:11:36 2014 */
 #line 1 "ext/date/lib/parse_date.re"
 /*
    +----------------------------------------------------------------------+
@@ -403,9 +403,12 @@ static timelib_sll timelib_meridian_with_check(char **ptr, timelib_sll h)
 {
 	timelib_sll retval = 0;
 
-	while (!strchr("AaPp", **ptr)) {
+	while (**ptr && !strchr("AaPp", **ptr)) {
 		++*ptr;
 	}
+    if(!**ptr) {
+        return TIMELIB_UNSET;
+    }
 	if (**ptr == 'a' || **ptr == 'A') {
 		if (h == 12) {
 			retval = -12;
@@ -871,11 +874,11 @@ static int scan(Scanner *s, timelib_tz_get_wrapper tz_get_wrapper)
 std:
 	s->tok = cursor;
 	s->len = 0;
-#line 997 "ext/date/lib/parse_date.re"
+#line 1000 "ext/date/lib/parse_date.re"
 
 
 
-#line 879 "ext/date/lib/parse_date.c"
+#line 882 "ext/date/lib/parse_date.c"
 {
 	YYCTYPE yych;
 	unsigned int yyaccept = 0;
@@ -995,7 +998,7 @@ std:
 	}
 yy2:
 	YYDEBUG(2, *YYCURSOR);
-#line 1082 "ext/date/lib/parse_date.re"
+#line 1085 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("firstdayof | lastdayof");
 		TIMELIB_INIT;
@@ -1011,7 +1014,7 @@ yy2:
 		TIMELIB_DEINIT;
 		return TIMELIB_LF_DAY_OF_MONTH;
 	}
-#line 1015 "ext/date/lib/parse_date.c"
+#line 1018 "ext/date/lib/parse_date.c"
 yy3:
 	YYDEBUG(3, *YYCURSOR);
 	++YYCURSOR;
@@ -1034,7 +1037,7 @@ yy3:
 	}
 yy4:
 	YYDEBUG(4, *YYCURSOR);
-#line 1676 "ext/date/lib/parse_date.re"
+#line 1679 "ext/date/lib/parse_date.re"
 	{
 		int tz_not_found;
 		DEBUG_OUTPUT("tzcorrection | tz");
@@ -1047,7 +1050,7 @@ yy4:
 		TIMELIB_DEINIT;
 		return TIMELIB_TIMEZONE;
 	}
-#line 1051 "ext/date/lib/parse_date.c"
+#line 1054 "ext/date/lib/parse_date.c"
 yy5:
 	YYDEBUG(5, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -1358,12 +1361,12 @@ yy12:
 	if (yych <= '9') goto yy1385;
 yy13:
 	YYDEBUG(13, *YYCURSOR);
-#line 1771 "ext/date/lib/parse_date.re"
+#line 1774 "ext/date/lib/parse_date.re"
 	{
 		add_error(s, "Unexpected character");
 		goto std;
 	}
-#line 1367 "ext/date/lib/parse_date.c"
+#line 1370 "ext/date/lib/parse_date.c"
 yy14:
 	YYDEBUG(14, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -2420,11 +2423,11 @@ yy49:
 	if (yych <= '9') goto yy55;
 yy50:
 	YYDEBUG(50, *YYCURSOR);
-#line 1760 "ext/date/lib/parse_date.re"
+#line 1763 "ext/date/lib/parse_date.re"
 	{
 		goto std;
 	}
-#line 2428 "ext/date/lib/parse_date.c"
+#line 2431 "ext/date/lib/parse_date.c"
 yy51:
 	YYDEBUG(51, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -2433,12 +2436,12 @@ yy52:
 	YYDEBUG(52, *YYCURSOR);
 	++YYCURSOR;
 	YYDEBUG(53, *YYCURSOR);
-#line 1765 "ext/date/lib/parse_date.re"
+#line 1768 "ext/date/lib/parse_date.re"
 	{
 		s->pos = cursor; s->line++;
 		goto std;
 	}
-#line 2442 "ext/date/lib/parse_date.c"
+#line 2445 "ext/date/lib/parse_date.c"
 yy54:
 	YYDEBUG(54, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -2825,7 +2828,7 @@ yy72:
 	if (yych == 's') goto yy74;
 yy73:
 	YYDEBUG(73, *YYCURSOR);
-#line 1744 "ext/date/lib/parse_date.re"
+#line 1747 "ext/date/lib/parse_date.re"
 	{
 		timelib_ull i;
 		DEBUG_OUTPUT("relative");
@@ -2840,7 +2843,7 @@ yy73:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 2844 "ext/date/lib/parse_date.c"
+#line 2847 "ext/date/lib/parse_date.c"
 yy74:
 	YYDEBUG(74, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -3602,7 +3605,7 @@ yy166:
 	}
 yy167:
 	YYDEBUG(167, *YYCURSOR);
-#line 1607 "ext/date/lib/parse_date.re"
+#line 1610 "ext/date/lib/parse_date.re"
 	{
 		const timelib_relunit* relunit;
 		DEBUG_OUTPUT("daytext");
@@ -3619,7 +3622,7 @@ yy167:
 		TIMELIB_DEINIT;
 		return TIMELIB_WEEKDAY;
 	}
-#line 3623 "ext/date/lib/parse_date.c"
+#line 3626 "ext/date/lib/parse_date.c"
 yy168:
 	YYDEBUG(168, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -4139,7 +4142,7 @@ yy193:
 	}
 yy194:
 	YYDEBUG(194, *YYCURSOR);
-#line 1666 "ext/date/lib/parse_date.re"
+#line 1669 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("monthtext");
 		TIMELIB_INIT;
@@ -4148,7 +4151,7 @@ yy194:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_TEXT;
 	}
-#line 4152 "ext/date/lib/parse_date.c"
+#line 4155 "ext/date/lib/parse_date.c"
 yy195:
 	YYDEBUG(195, *YYCURSOR);
 	++YYCURSOR;
@@ -4199,7 +4202,7 @@ yy198:
 	}
 yy199:
 	YYDEBUG(199, *YYCURSOR);
-#line 1412 "ext/date/lib/parse_date.re"
+#line 1415 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("datetextual | datenoyear");
@@ -4212,7 +4215,7 @@ yy199:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_TEXT;
 	}
-#line 4216 "ext/date/lib/parse_date.c"
+#line 4219 "ext/date/lib/parse_date.c"
 yy200:
 	YYDEBUG(200, *YYCURSOR);
 	yyaccept = 6;
@@ -4481,7 +4484,7 @@ yy222:
 	}
 yy223:
 	YYDEBUG(223, *YYCURSOR);
-#line 1714 "ext/date/lib/parse_date.re"
+#line 1717 "ext/date/lib/parse_date.re"
 	{
 		int tz_not_found;
 		DEBUG_OUTPUT("dateshortwithtimeshort | dateshortwithtimelong | dateshortwithtimelongtz");
@@ -4510,7 +4513,7 @@ yy223:
 		TIMELIB_DEINIT;
 		return TIMELIB_SHORTDATE_WITH_TIME;
 	}
-#line 4514 "ext/date/lib/parse_date.c"
+#line 4517 "ext/date/lib/parse_date.c"
 yy224:
 	YYDEBUG(224, *YYCURSOR);
 	yyaccept = 7;
@@ -5208,7 +5211,7 @@ yy278:
 	YYDEBUG(278, *YYCURSOR);
 	++YYCURSOR;
 	YYDEBUG(279, *YYCURSOR);
-#line 1690 "ext/date/lib/parse_date.re"
+#line 1693 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("dateshortwithtimeshort12 | dateshortwithtimelong12");
 		TIMELIB_INIT;
@@ -5231,7 +5234,7 @@ yy278:
 		TIMELIB_DEINIT;
 		return TIMELIB_SHORTDATE_WITH_TIME;
 	}
-#line 5235 "ext/date/lib/parse_date.c"
+#line 5238 "ext/date/lib/parse_date.c"
 yy280:
 	YYDEBUG(280, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -5409,7 +5412,7 @@ yy294:
 	++YYCURSOR;
 yy295:
 	YYDEBUG(295, *YYCURSOR);
-#line 1384 "ext/date/lib/parse_date.re"
+#line 1387 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("datenoday");
@@ -5422,7 +5425,7 @@ yy295:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_NO_DAY;
 	}
-#line 5426 "ext/date/lib/parse_date.c"
+#line 5429 "ext/date/lib/parse_date.c"
 yy296:
 	YYDEBUG(296, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -6642,7 +6645,7 @@ yy362:
 	if (yych <= '9') goto yy365;
 yy364:
 	YYDEBUG(364, *YYCURSOR);
-#line 1528 "ext/date/lib/parse_date.re"
+#line 1531 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("pgtextshort");
@@ -6655,7 +6658,7 @@ yy364:
 		TIMELIB_DEINIT;
 		return TIMELIB_PG_TEXT;
 	}
-#line 6659 "ext/date/lib/parse_date.c"
+#line 6662 "ext/date/lib/parse_date.c"
 yy365:
 	YYDEBUG(365, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -7293,7 +7296,7 @@ yy392:
 	}
 yy393:
 	YYDEBUG(393, *YYCURSOR);
-#line 1586 "ext/date/lib/parse_date.re"
+#line 1589 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("ago");
 		TIMELIB_INIT;
@@ -7313,7 +7316,7 @@ yy393:
 		TIMELIB_DEINIT;
 		return TIMELIB_AGO;
 	}
-#line 7317 "ext/date/lib/parse_date.c"
+#line 7320 "ext/date/lib/parse_date.c"
 yy394:
 	YYDEBUG(394, *YYCURSOR);
 	yyaccept = 5;
@@ -9063,7 +9066,7 @@ yy454:
 	++YYCURSOR;
 yy455:
 	YYDEBUG(455, *YYCURSOR);
-#line 1289 "ext/date/lib/parse_date.re"
+#line 1292 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("iso8601date4 | iso8601date2 | iso8601dateslash | dateslash");
 		TIMELIB_INIT;
@@ -9074,7 +9077,7 @@ yy455:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_DATE;
 	}
-#line 9078 "ext/date/lib/parse_date.c"
+#line 9081 "ext/date/lib/parse_date.c"
 yy456:
 	YYDEBUG(456, *YYCURSOR);
 	yyaccept = 0;
@@ -9634,7 +9637,7 @@ yy475:
 	}
 yy476:
 	YYDEBUG(476, *YYCURSOR);
-#line 1426 "ext/date/lib/parse_date.re"
+#line 1429 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("datenoyearrev");
 		TIMELIB_INIT;
@@ -9645,7 +9648,7 @@ yy476:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_TEXT;
 	}
-#line 9649 "ext/date/lib/parse_date.c"
+#line 9652 "ext/date/lib/parse_date.c"
 yy477:
 	YYDEBUG(477, *YYCURSOR);
 	yyaccept = 10;
@@ -9786,7 +9789,7 @@ yy488:
 	YYDEBUG(488, *YYCURSOR);
 	++YYCURSOR;
 	YYDEBUG(489, *YYCURSOR);
-#line 1144 "ext/date/lib/parse_date.re"
+#line 1147 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("timetiny12 | timeshort12 | timelong12");
 		TIMELIB_INIT;
@@ -9802,7 +9805,7 @@ yy488:
 		TIMELIB_DEINIT;
 		return TIMELIB_TIME12;
 	}
-#line 9806 "ext/date/lib/parse_date.c"
+#line 9809 "ext/date/lib/parse_date.c"
 yy490:
 	YYDEBUG(490, *YYCURSOR);
 	yyaccept = 11;
@@ -9815,7 +9818,7 @@ yy490:
 	}
 yy491:
 	YYDEBUG(491, *YYCURSOR);
-#line 1181 "ext/date/lib/parse_date.re"
+#line 1184 "ext/date/lib/parse_date.re"
 	{
 		int tz_not_found;
 		DEBUG_OUTPUT("timeshort24 | timelong24 | iso8601long");
@@ -9840,7 +9843,7 @@ yy491:
 		TIMELIB_DEINIT;
 		return TIMELIB_TIME24_WITH_ZONE;
 	}
-#line 9844 "ext/date/lib/parse_date.c"
+#line 9847 "ext/date/lib/parse_date.c"
 yy492:
 	YYDEBUG(492, *YYCURSOR);
 	yyaccept = 11;
@@ -10150,7 +10153,7 @@ yy523:
 	YYDEBUG(523, *YYCURSOR);
 	++YYCURSOR;
 	YYDEBUG(524, *YYCURSOR);
-#line 1161 "ext/date/lib/parse_date.re"
+#line 1164 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("mssqltime");
 		TIMELIB_INIT;
@@ -10169,7 +10172,7 @@ yy523:
 		TIMELIB_DEINIT;
 		return TIMELIB_TIME24_WITH_ZONE;
 	}
-#line 10173 "ext/date/lib/parse_date.c"
+#line 10176 "ext/date/lib/parse_date.c"
 yy525:
 	YYDEBUG(525, *YYCURSOR);
 	yyaccept = 11;
@@ -10275,7 +10278,7 @@ yy534:
 	if (yych <= '9') goto yy541;
 yy535:
 	YYDEBUG(535, *YYCURSOR);
-#line 1343 "ext/date/lib/parse_date.re"
+#line 1346 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("datefull");
@@ -10289,7 +10292,7 @@ yy535:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_FULL;
 	}
-#line 10293 "ext/date/lib/parse_date.c"
+#line 10296 "ext/date/lib/parse_date.c"
 yy536:
 	YYDEBUG(536, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -11026,7 +11029,7 @@ yy605:
 	YYDEBUG(606, *YYCURSOR);
 	++YYCURSOR;
 	YYDEBUG(607, *YYCURSOR);
-#line 1358 "ext/date/lib/parse_date.re"
+#line 1361 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("pointed date YYYY");
 		TIMELIB_INIT;
@@ -11037,7 +11040,7 @@ yy605:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_FULL_POINTED;
 	}
-#line 11041 "ext/date/lib/parse_date.c"
+#line 11044 "ext/date/lib/parse_date.c"
 yy608:
 	YYDEBUG(608, *YYCURSOR);
 	yyaccept = 11;
@@ -11073,7 +11076,7 @@ yy611:
 	if (yych <= '9') goto yy605;
 yy612:
 	YYDEBUG(612, *YYCURSOR);
-#line 1370 "ext/date/lib/parse_date.re"
+#line 1373 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("pointed date YY");
@@ -11086,7 +11089,7 @@ yy612:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_FULL_POINTED;
 	}
-#line 11090 "ext/date/lib/parse_date.c"
+#line 11093 "ext/date/lib/parse_date.c"
 yy613:
 	YYDEBUG(613, *YYCURSOR);
 	yyaccept = 11;
@@ -11727,7 +11730,7 @@ yy656:
 	}
 yy657:
 	YYDEBUG(657, *YYCURSOR);
-#line 1329 "ext/date/lib/parse_date.re"
+#line 1332 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("gnudateshort");
@@ -11740,7 +11743,7 @@ yy657:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_DATE;
 	}
-#line 11744 "ext/date/lib/parse_date.c"
+#line 11747 "ext/date/lib/parse_date.c"
 yy658:
 	YYDEBUG(658, *YYCURSOR);
 	yyaccept = 13;
@@ -11846,7 +11849,7 @@ yy666:
 	}
 yy667:
 	YYDEBUG(667, *YYCURSOR);
-#line 1273 "ext/date/lib/parse_date.re"
+#line 1276 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("americanshort | american");
@@ -11861,7 +11864,7 @@ yy667:
 		TIMELIB_DEINIT;
 		return TIMELIB_AMERICAN;
 	}
-#line 11865 "ext/date/lib/parse_date.c"
+#line 11868 "ext/date/lib/parse_date.c"
 yy668:
 	YYDEBUG(668, *YYCURSOR);
 	yyaccept = 14;
@@ -12094,7 +12097,7 @@ yy700:
 	if (yych <= ':') goto yy704;
 yy701:
 	YYDEBUG(701, *YYCURSOR);
-#line 1556 "ext/date/lib/parse_date.re"
+#line 1559 "ext/date/lib/parse_date.re"
 	{
 		int tz_not_found;
 		DEBUG_OUTPUT("clf");
@@ -12114,7 +12117,7 @@ yy701:
 		TIMELIB_DEINIT;
 		return TIMELIB_CLF;
 	}
-#line 12118 "ext/date/lib/parse_date.c"
+#line 12121 "ext/date/lib/parse_date.c"
 yy702:
 	YYDEBUG(702, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -12666,7 +12669,7 @@ yy763:
 	}
 yy764:
 	YYDEBUG(764, *YYCURSOR);
-#line 1301 "ext/date/lib/parse_date.re"
+#line 1304 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("iso8601date2");
@@ -12679,7 +12682,7 @@ yy764:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_DATE;
 	}
-#line 12683 "ext/date/lib/parse_date.c"
+#line 12686 "ext/date/lib/parse_date.c"
 yy765:
 	YYDEBUG(765, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -12718,7 +12721,7 @@ yy771:
 	YYDEBUG(771, *YYCURSOR);
 	++YYCURSOR;
 	YYDEBUG(772, *YYCURSOR);
-#line 1542 "ext/date/lib/parse_date.re"
+#line 1545 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("pgtextreverse");
@@ -12731,7 +12734,7 @@ yy771:
 		TIMELIB_DEINIT;
 		return TIMELIB_PG_TEXT;
 	}
-#line 12735 "ext/date/lib/parse_date.c"
+#line 12738 "ext/date/lib/parse_date.c"
 yy773:
 	YYDEBUG(773, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -12869,7 +12872,7 @@ yy783:
 	}
 yy784:
 	YYDEBUG(784, *YYCURSOR);
-#line 1577 "ext/date/lib/parse_date.re"
+#line 1580 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("year4");
 		TIMELIB_INIT;
@@ -12877,7 +12880,7 @@ yy784:
 		TIMELIB_DEINIT;
 		return TIMELIB_CLF;
 	}
-#line 12881 "ext/date/lib/parse_date.c"
+#line 12884 "ext/date/lib/parse_date.c"
 yy785:
 	YYDEBUG(785, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -13028,7 +13031,7 @@ yy793:
 	}
 yy794:
 	YYDEBUG(794, *YYCURSOR);
-#line 1398 "ext/date/lib/parse_date.re"
+#line 1401 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("datenodayrev");
@@ -13041,7 +13044,7 @@ yy794:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_NO_DAY;
 	}
-#line 13045 "ext/date/lib/parse_date.c"
+#line 13048 "ext/date/lib/parse_date.c"
 yy795:
 	YYDEBUG(795, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -13256,7 +13259,7 @@ yy814:
 	if (yych <= '7') goto yy817;
 yy815:
 	YYDEBUG(815, *YYCURSOR);
-#line 1509 "ext/date/lib/parse_date.re"
+#line 1512 "ext/date/lib/parse_date.re"
 	{
 		timelib_sll w, d;
 		DEBUG_OUTPUT("isoweek");
@@ -13274,7 +13277,7 @@ yy815:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_WEEK;
 	}
-#line 13278 "ext/date/lib/parse_date.c"
+#line 13281 "ext/date/lib/parse_date.c"
 yy816:
 	YYDEBUG(816, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -13284,7 +13287,7 @@ yy817:
 	YYDEBUG(817, *YYCURSOR);
 	++YYCURSOR;
 	YYDEBUG(818, *YYCURSOR);
-#line 1490 "ext/date/lib/parse_date.re"
+#line 1493 "ext/date/lib/parse_date.re"
 	{
 		timelib_sll w, d;
 		DEBUG_OUTPUT("isoweekday");
@@ -13302,7 +13305,7 @@ yy817:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_WEEK;
 	}
-#line 13306 "ext/date/lib/parse_date.c"
+#line 13309 "ext/date/lib/parse_date.c"
 yy819:
 	YYDEBUG(819, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -13366,7 +13369,7 @@ yy821:
 	}
 yy822:
 	YYDEBUG(822, *YYCURSOR);
-#line 1476 "ext/date/lib/parse_date.re"
+#line 1479 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("pgydotd");
@@ -13379,7 +13382,7 @@ yy822:
 		TIMELIB_DEINIT;
 		return TIMELIB_PG_YEARDAY;
 	}
-#line 13383 "ext/date/lib/parse_date.c"
+#line 13386 "ext/date/lib/parse_date.c"
 yy823:
 	YYDEBUG(823, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -13482,7 +13485,7 @@ yy842:
 	++YYCURSOR;
 yy843:
 	YYDEBUG(843, *YYCURSOR);
-#line 1450 "ext/date/lib/parse_date.re"
+#line 1453 "ext/date/lib/parse_date.re"
 	{
 		int tz_not_found;
 		DEBUG_OUTPUT("xmlrpc | xmlrpcnocolon | soap | wddx | exif");
@@ -13507,7 +13510,7 @@ yy843:
 		TIMELIB_DEINIT;
 		return TIMELIB_XMLRPC_SOAP;
 	}
-#line 13511 "ext/date/lib/parse_date.c"
+#line 13514 "ext/date/lib/parse_date.c"
 yy844:
 	YYDEBUG(844, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -13769,7 +13772,7 @@ yy848:
 	}
 yy849:
 	YYDEBUG(849, *YYCURSOR);
-#line 1438 "ext/date/lib/parse_date.re"
+#line 1441 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("datenocolon");
 		TIMELIB_INIT;
@@ -13780,7 +13783,7 @@ yy849:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_NOCOLON;
 	}
-#line 13784 "ext/date/lib/parse_date.c"
+#line 13787 "ext/date/lib/parse_date.c"
 yy850:
 	YYDEBUG(850, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -14700,7 +14703,7 @@ yy973:
 	if (yych <= '9') goto yy996;
 yy974:
 	YYDEBUG(974, *YYCURSOR);
-#line 1315 "ext/date/lib/parse_date.re"
+#line 1318 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("gnudateshorter");
@@ -14713,7 +14716,7 @@ yy974:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_DATE;
 	}
-#line 14717 "ext/date/lib/parse_date.c"
+#line 14720 "ext/date/lib/parse_date.c"
 yy975:
 	YYDEBUG(975, *YYCURSOR);
 	yyaccept = 22;
@@ -15722,7 +15725,7 @@ yy1066:
 	}
 yy1068:
 	YYDEBUG(1068, *YYCURSOR);
-#line 1207 "ext/date/lib/parse_date.re"
+#line 1210 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("gnunocolon");
 		TIMELIB_INIT;
@@ -15744,7 +15747,7 @@ yy1068:
 		TIMELIB_DEINIT;
 		return TIMELIB_GNU_NOCOLON;
 	}
-#line 15748 "ext/date/lib/parse_date.c"
+#line 15751 "ext/date/lib/parse_date.c"
 yy1069:
 	YYDEBUG(1069, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -15836,7 +15839,7 @@ yy1075:
 	}
 yy1076:
 	YYDEBUG(1076, *YYCURSOR);
-#line 1253 "ext/date/lib/parse_date.re"
+#line 1256 "ext/date/lib/parse_date.re"
 	{
 		int tz_not_found;
 		DEBUG_OUTPUT("iso8601nocolon");
@@ -15855,7 +15858,7 @@ yy1076:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_NOCOLON;
 	}
-#line 15859 "ext/date/lib/parse_date.c"
+#line 15862 "ext/date/lib/parse_date.c"
 yy1077:
 	YYDEBUG(1077, *YYCURSOR);
 	yyaccept = 25;
@@ -16753,7 +16756,7 @@ yy1117:
 	}
 yy1118:
 	YYDEBUG(1118, *YYCURSOR);
-#line 1649 "ext/date/lib/parse_date.re"
+#line 1652 "ext/date/lib/parse_date.re"
 	{
 		timelib_sll i;
 		int         behavior = 0;
@@ -16769,7 +16772,7 @@ yy1118:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 16773 "ext/date/lib/parse_date.c"
+#line 16776 "ext/date/lib/parse_date.c"
 yy1119:
 	YYDEBUG(1119, *YYCURSOR);
 	++YYCURSOR;
@@ -16820,7 +16823,7 @@ yy1126:
 	YYDEBUG(1126, *YYCURSOR);
 	++YYCURSOR;
 	YYDEBUG(1127, *YYCURSOR);
-#line 1122 "ext/date/lib/parse_date.re"
+#line 1125 "ext/date/lib/parse_date.re"
 	{
 		timelib_sll i;
 		int         behavior = 0;
@@ -16841,7 +16844,7 @@ yy1126:
 		TIMELIB_DEINIT;
 		return TIMELIB_WEEK_DAY_OF_MONTH;
 	}
-#line 16845 "ext/date/lib/parse_date.c"
+#line 16848 "ext/date/lib/parse_date.c"
 yy1128:
 	YYDEBUG(1128, *YYCURSOR);
 	yyaccept = 26;
@@ -16949,7 +16952,7 @@ yy1141:
 	}
 yy1142:
 	YYDEBUG(1142, *YYCURSOR);
-#line 1625 "ext/date/lib/parse_date.re"
+#line 1628 "ext/date/lib/parse_date.re"
 	{
 		timelib_sll i;
 		int         behavior = 0;
@@ -16972,7 +16975,7 @@ yy1142:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 16976 "ext/date/lib/parse_date.c"
+#line 16979 "ext/date/lib/parse_date.c"
 yy1143:
 	YYDEBUG(1143, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -19649,7 +19652,7 @@ yy1294:
 	goto yy1298;
 yy1295:
 	YYDEBUG(1295, *YYCURSOR);
-#line 1099 "ext/date/lib/parse_date.re"
+#line 1102 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("backof | frontof");
 		TIMELIB_INIT;
@@ -19671,7 +19674,7 @@ yy1295:
 		TIMELIB_DEINIT;
 		return TIMELIB_LF_DAY_OF_MONTH;
 	}
-#line 19675 "ext/date/lib/parse_date.c"
+#line 19678 "ext/date/lib/parse_date.c"
 yy1296:
 	YYDEBUG(1296, *YYCURSOR);
 	yyaccept = 28;
@@ -21362,7 +21365,7 @@ yy1385:
 	if (yych <= '9') goto yy1385;
 yy1387:
 	YYDEBUG(1387, *YYCURSOR);
-#line 1057 "ext/date/lib/parse_date.re"
+#line 1060 "ext/date/lib/parse_date.re"
 	{
 		timelib_ull i;
 
@@ -21386,7 +21389,7 @@ yy1387:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 21390 "ext/date/lib/parse_date.c"
+#line 21393 "ext/date/lib/parse_date.c"
 yy1388:
 	YYDEBUG(1388, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -21822,7 +21825,7 @@ yy1416:
 	++YYCURSOR;
 yy1417:
 	YYDEBUG(1417, *YYCURSOR);
-#line 1045 "ext/date/lib/parse_date.re"
+#line 1048 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("tomorrow");
 		TIMELIB_INIT;
@@ -21833,7 +21836,7 @@ yy1417:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 21837 "ext/date/lib/parse_date.c"
+#line 21840 "ext/date/lib/parse_date.c"
 yy1418:
 	YYDEBUG(1418, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -21868,7 +21871,7 @@ yy1419:
 	}
 yy1420:
 	YYDEBUG(1420, *YYCURSOR);
-#line 1035 "ext/date/lib/parse_date.re"
+#line 1038 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("midnight | today");
 		TIMELIB_INIT;
@@ -21877,7 +21880,7 @@ yy1420:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 21881 "ext/date/lib/parse_date.c"
+#line 21884 "ext/date/lib/parse_date.c"
 yy1421:
 	YYDEBUG(1421, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -23889,7 +23892,7 @@ yy1499:
 	}
 yy1500:
 	YYDEBUG(1500, *YYCURSOR);
-#line 1014 "ext/date/lib/parse_date.re"
+#line 1017 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("now");
 		TIMELIB_INIT;
@@ -23897,7 +23900,7 @@ yy1500:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 23901 "ext/date/lib/parse_date.c"
+#line 23904 "ext/date/lib/parse_date.c"
 yy1501:
 	YYDEBUG(1501, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -24036,7 +24039,7 @@ yy1507:
 	}
 yy1508:
 	YYDEBUG(1508, *YYCURSOR);
-#line 1023 "ext/date/lib/parse_date.re"
+#line 1026 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("noon");
 		TIMELIB_INIT;
@@ -24047,7 +24050,7 @@ yy1508:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 24051 "ext/date/lib/parse_date.c"
+#line 24054 "ext/date/lib/parse_date.c"
 yy1509:
 	YYDEBUG(1509, *YYCURSOR);
 	yyaccept = 0;
@@ -24580,7 +24583,7 @@ yy1530:
 	++YYCURSOR;
 yy1531:
 	YYDEBUG(1531, *YYCURSOR);
-#line 1002 "ext/date/lib/parse_date.re"
+#line 1005 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("yesterday");
 		TIMELIB_INIT;
@@ -24591,7 +24594,7 @@ yy1531:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 24595 "ext/date/lib/parse_date.c"
+#line 24598 "ext/date/lib/parse_date.c"
 yy1532:
 	YYDEBUG(1532, *YYCURSOR);
 	yyaccept = 0;
@@ -24764,7 +24767,7 @@ yy1537:
 		goto yy1531;
 	}
 }
-#line 1775 "ext/date/lib/parse_date.re"
+#line 1778 "ext/date/lib/parse_date.re"
 
 }
 
@@ -25121,7 +25124,11 @@ timelib_time *timelib_parse_from_format(char *format, char *string, int len, tim
 				break;
 
 			case '\\': /* escaped char */
-				*fptr++;
+                if(!fptr[1]) {
+				    add_pbf_error(s, "Escaped character expected", string, begin);
+                    break;
+                }
+				fptr++;
 				if (*ptr == *fptr) {
 					++ptr;
 				} else {

ext/date/lib/parse_date.re

@@ -401,9 +401,12 @@ static timelib_sll timelib_meridian_with_check(char **ptr, timelib_sll h)
 {
 	timelib_sll retval = 0;
 
-	while (!strchr("AaPp", **ptr)) {
+	while (**ptr && !strchr("AaPp", **ptr)) {
 		++*ptr;
 	}
+    if(!**ptr) {
+        return TIMELIB_UNSET;
+    }
 	if (**ptr == 'a' || **ptr == 'A') {
 		if (h == 12) {
 			retval = -12;
@@ -2128,7 +2131,11 @@ timelib_time *timelib_parse_from_format(char *format, char *string, int len, tim
 				break;
 
 			case '\\': /* escaped char */
-				*fptr++;
+                if(!fptr[1]) {
+				    add_pbf_error(s, "Escaped character expected", string, begin);
+                    break;
+                }
+				fptr++;
 				if (*ptr == *fptr) {
 					++ptr;
 				} else {

ext/date/lib/parse_iso_intervals.c

@@ -1,4 +1,4 @@
-/* Generated by re2c 0.13.5 on Mon Dec  5 22:02:31 2011 */
+/* Generated by re2c 0.13.5 on Fri Jul 18 16:11:41 2014 */
 #line 1 "ext/date/lib/parse_iso_intervals.re"
 /*
    +----------------------------------------------------------------------+
@@ -415,7 +415,7 @@ yy6:
 					break;
 			}
 			ptr++;
-		} while (*ptr);
+		} while (!s->errors->error_count && *ptr);
 		s->have_period = 1;
 		TIMELIB_DEINIT;
 		return TIMELIB_PERIOD;

ext/date/lib/parse_iso_intervals.re

@@ -383,7 +383,7 @@ isoweek          = year4 "-"? "W" weekofyear;
 					break;
 			}
 			ptr++;
-		} while (*ptr);
+		} while (!s->errors->error_count && *ptr);
 		s->have_period = 1;
 		TIMELIB_DEINIT;
 		return TIMELIB_PERIOD;

ext/date/tests/bug67251.phpt

@@ -0,0 +1,38 @@
+--TEST--
+Bug #67251 (date_parse_from_format out-of-bounds read)
+--INI--
+date.timezone=Europe/Berlin
+--FILE--
+<?php
+var_dump(date_parse_from_format("\\","AAAABBBB"));
+--EXPECT--
+array(12) {
+  ["year"]=>
+  bool(false)
+  ["month"]=>
+  bool(false)
+  ["day"]=>
+  bool(false)
+  ["hour"]=>
+  bool(false)
+  ["minute"]=>
+  bool(false)
+  ["second"]=>
+  bool(false)
+  ["fraction"]=>
+  bool(false)
+  ["warning_count"]=>
+  int(0)
+  ["warnings"]=>
+  array(0) {
+  }
+  ["error_count"]=>
+  int(2)
+  ["errors"]=>
+  array(1) {
+    [0]=>
+    string(13) "Trailing data"
+  }
+  ["is_localtime"]=>
+  bool(false)
+}

ext/date/tests/bug67253.phpt

@@ -0,0 +1,44 @@
+--TEST--
+Bug #67253 (timelib_meridian_with_check out-of-bounds read)
+--INI--
+date.timezone=Europe/Berlin
+--FILE--
+<?php
+$z = '';
+var_dump(date_parse_from_format("aHa0", "0=G{$z}9UCNnF"));
+--EXPECT--
+array(12) {
+  ["year"]=>
+  bool(false)
+  ["month"]=>
+  bool(false)
+  ["day"]=>
+  bool(false)
+  ["hour"]=>
+  int(0)
+  ["minute"]=>
+  int(0)
+  ["second"]=>
+  int(0)
+  ["fraction"]=>
+  bool(false)
+  ["warning_count"]=>
+  int(0)
+  ["warnings"]=>
+  array(0) {
+  }
+  ["error_count"]=>
+  int(3)
+  ["errors"]=>
+  array(3) {
+    [0]=>
+    string(51) "Meridian can only come after an hour has been found"
+    [1]=>
+    string(29) "A meridian could not be found"
+    [9]=>
+    string(12) "Data missing"
+  }
+  ["is_localtime"]=>
+  bool(false)
+}
+

ext/exif/exif.c

@@ -2874,7 +2874,12 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 		offset_val = php_ifd_get32u(dir_entry+8, ImageInfo->motorola_intel);
 		/* If its bigger than 4 bytes, the dir entry contains an offset. */
 		value_ptr = offset_base+offset_val;
-		if (byte_count > IFDlength || offset_val > IFDlength-byte_count || value_ptr < dir_entry) {
+        /* 
+            dir_entry is ImageInfo->file.list[sn].data+2+i*12
+            offset_base is ImageInfo->file.list[sn].data-dir_offset 
+            dir_entry - offset_base is dir_offset+2+i*12
+        */
+		if (byte_count > IFDlength || offset_val > IFDlength-byte_count || value_ptr < dir_entry || offset_val < (size_t)(dir_entry-offset_base)) {
 			/* It is important to check for IMAGE_FILETYPE_TIFF
 			 * JPEG does not use absolute pointers instead its pointers are
 			 * relative to the start of the TIFF header in APP1 section. */

ext/fileinfo/libmagic/cdf.c

@@ -277,13 +277,15 @@ cdf_check_stream_offset(const cdf_stream_t *sst, const cdf_header_t *h,
 {
 	const char *b = (const char *)sst->sst_tab;
 	const char *e = ((const char *)p) + tail;
+	size_t ss = sst->sst_dirlen < h->h_min_size_standard_stream ?
+	    CDF_SHORT_SEC_SIZE(h) : CDF_SEC_SIZE(h);
 	(void)&line;
-	if (e >= b && (size_t)(e - b) < CDF_SEC_SIZE(h) * sst->sst_len)
+	if (e >= b && (size_t)(e - b) <= ss * sst->sst_len)
 		return 0;
 	DPRINTF(("%d: offset begin %p end %p %" SIZE_T_FORMAT "u"
 	    " >= %" SIZE_T_FORMAT "u [%" SIZE_T_FORMAT "u %"
 	    SIZE_T_FORMAT "u]\n", line, b, e, (size_t)(e - b),
-	    CDF_SEC_SIZE(h) * sst->sst_len, CDF_SEC_SIZE(h), sst->sst_len));
+	    ss * sst->sst_len, ss, sst->sst_len));
 	errno = EFTYPE;
 	return -1;
 }
@@ -365,10 +367,10 @@ cdf_read_short_sector(const cdf_stream_t *sst, void *buf, size_t offs,
 	size_t ss = CDF_SHORT_SEC_SIZE(h);
 	size_t pos = CDF_SHORT_SEC_POS(h, id);
 	assert(ss == len);
-	if (pos > CDF_SEC_SIZE(h) * sst->sst_len) {
+	if (pos + len > CDF_SEC_SIZE(h) * sst->sst_len) {
 		DPRINTF(("Out of bounds read %" SIZE_T_FORMAT "u > %"
 		    SIZE_T_FORMAT "u\n",
-		    pos, CDF_SEC_SIZE(h) * sst->sst_len));
+		    pos + len, CDF_SEC_SIZE(h) * sst->sst_len));
 		return -1;
 	}
 	(void)memcpy(((char *)buf) + offs,
@@ -468,7 +470,8 @@ size_t
 cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size)
 {
 	size_t i, j;
-	cdf_secid_t maxsector = (cdf_secid_t)(sat->sat_len * size);
+	cdf_secid_t maxsector = (cdf_secid_t)((sat->sat_len * size)
+	    / sizeof(maxsector));
 
 	DPRINTF(("Chain:"));
 	for (j = i = 0; sid >= 0; i++, j++) {
@@ -478,8 +481,8 @@ cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size)
 			errno = EFTYPE;
 			return (size_t)-1;
 		}
-		if (sid > maxsector) {
-			DPRINTF(("Sector %d > %d\n", sid, maxsector));
+		if (sid >= maxsector) {
+			DPRINTF(("Sector %d >= %d\n", sid, maxsector));
 			errno = EFTYPE;
 			return (size_t)-1;
 		}
@@ -809,7 +812,11 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 	if (cdf_check_stream_offset(sst, h, e, 0, __LINE__) == -1)
 		goto out;
 	for (i = 0; i < sh.sh_properties; i++) {
-		size_t ofs = CDF_GETUINT32(p, (i << 1) + 1);
+		size_t ofs, tail = (i << 1) + 1;
+		if (cdf_check_stream_offset(sst, h, p, tail * sizeof(uint32_t),
+		    __LINE__) == -1)
+			goto out;
+		ofs = CDF_GETUINT32(p, tail);
 		q = (const uint8_t *)(const void *)
 		    ((const char *)(const void *)p + ofs
 		    - 2 * sizeof(uint32_t));
@@ -823,6 +830,10 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 		    i, inp[i].pi_id, inp[i].pi_type, q - p, offs));
 		if (inp[i].pi_type & CDF_VECTOR) {
 			nelements = CDF_GETUINT32(q, 1);
+			if (nelements == 0) {
+				DPRINTF(("CDF_VECTOR with nelements == 0\n"));
+				goto out;
+			}
 			o = 2;
 		} else {
 			nelements = 1;
@@ -897,7 +908,9 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 			}
 			DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n",
 			    nelements));
-			for (j = 0; j < nelements; j++, i++) {
+			for (j = 0; j < nelements && i < sh.sh_properties; 
+			    j++, i++) 
+			{
 				uint32_t l = CDF_GETUINT32(q, o);
 				inp[i].pi_str.s_len = l;
 				inp[i].pi_str.s_buf = (const char *)
@@ -942,7 +955,7 @@ int
 cdf_unpack_summary_info(const cdf_stream_t *sst, const cdf_header_t *h,
     cdf_summary_info_header_t *ssi, cdf_property_info_t **info, size_t *count)
 {
-	size_t i, maxcount;
+	size_t maxcount;
 	const cdf_summary_info_header_t *si =
 	    CAST(const cdf_summary_info_header_t *, sst->sst_tab);
 	const cdf_section_declaration_t *sd =
@@ -957,21 +970,13 @@ cdf_unpack_summary_info(const cdf_stream_t *sst, const cdf_header_t *h,
 	ssi->si_os = CDF_TOLE2(si->si_os);
 	ssi->si_class = si->si_class;
 	cdf_swap_class(&ssi->si_class);
-	ssi->si_count = CDF_TOLE2(si->si_count);
+	ssi->si_count = CDF_TOLE4(si->si_count);
 	*count = 0;
 	maxcount = 0;
 	*info = NULL;
-	for (i = 0; i < CDF_TOLE4(si->si_count); i++) {
-		if (i >= CDF_LOOP_LIMIT) {
-			DPRINTF(("Unpack summary info loop limit"));
-			errno = EFTYPE;
+	if (cdf_read_property_info(sst, h, CDF_TOLE4(sd->sd_offset), info,
+		count, &maxcount) == -1) 
 			return -1;
-		}
-		if (cdf_read_property_info(sst, h, CDF_TOLE4(sd->sd_offset),
-		    info, count, &maxcount) == -1) {
-			return -1;
-		}
-	}
 	return 0;
 }
 

ext/fileinfo/libmagic/readcdf.c

@@ -56,6 +56,8 @@ cdf_file_property_info(struct magic_set *ms, const cdf_property_info_t *info,
         const char *s;
         int len;
 
+	memset(&ts, 0, sizeof(ts));
+
         for (i = 0; i < count; i++) {
                 cdf_print_property_name(buf, sizeof(buf), info[i].pi_id);
                 switch (info[i].pi_type) {
@@ -142,11 +144,13 @@ cdf_file_property_info(struct magic_set *ms, const cdf_property_info_t *info,
                                                 return -1;
                                 } else {
                                         char *c, *ec;
+                                        const time_t sec = ts.tv_sec;
                                         if (cdf_timestamp_to_timespec(&ts, tp) == -1) {
 											return -1;
 										}
-                                        c = cdf_ctime(&ts.tv_sec);
-                                        if ((ec = strchr(c, '\n')) != NULL)
+                                        c = cdf_ctime(&sec);
+                                        if (c != NULL &&
+					    (ec = strchr(c, '\n')) != NULL)
                                                 *ec = '\0';
 
                                         if (NOTMIME(ms) && file_printf(ms,

ext/fileinfo/libmagic/softmagic.c

@@ -777,10 +777,18 @@ mconvert(struct magic_set *ms, struct magic *m)
 		return 1;
 	}
 	case FILE_PSTRING: {
-		char *ptr1 = p->s, *ptr2 = ptr1 + file_pstring_length_size(m);
+		size_t sz = file_pstring_length_size(m);
+		char *ptr1 = p->s, *ptr2 = ptr1 + sz;
 		size_t len = file_pstring_get_length(m, ptr1);
-		if (len >= sizeof(p->s))
-			len = sizeof(p->s) - 1;
+		if (len >= sizeof(p->s)) {
+			/*
+			 * The size of the pascal string length (sz)
+			 * is 1, 2, or 4. We need at least 1 byte for NUL
+			 * termination, but we've already truncated the
+			 * string by p->s, so we need to deduct sz.
+			 */ 
+			len = sizeof(p->s) - sz;
+		}
 		while (len--)
 			*ptr1++ = *ptr2++;
 		*ptr1 = '\0';

ext/fileinfo/tests/finfo_file_002.phpt

@@ -18,7 +18,7 @@ ksort($results);
 var_dump($results);
 ?>
 --EXPECTF--
-array(7) {
+array(8) {
   ["%s/resources/dir.zip"]=>
   string(15) "application/zip"
   ["%s/resources/test.awk"]=>
@@ -33,4 +33,6 @@ array(7) {
   string(15) "application/pdf"
   ["%s/resources/test.png"]=>
   string(9) "image/png"
+  ["%s/resources/test.ppt"]=>
+  string(29) "application/vnd.ms-powerpoint"
 }

ext/intl/locale/locale_methods.c

@@ -269,8 +269,7 @@ static char* get_icu_value_internal( char* loc_name , char* tag_name, int* resul
 		grOffset =  findOffset( LOC_GRANDFATHERED , loc_name );
 		if( grOffset >= 0 ){
 			if( strcmp(tag_name , LOC_LANG_TAG)==0 ){
-				tag_value = estrdup(loc_name);
-				return tag_value;
+				return estrdup(loc_name);
 			} else {
 				/* Since Grandfathered , no value , do nothing , retutn NULL */
 				return NULL;
@@ -280,8 +279,8 @@ static char* get_icu_value_internal( char* loc_name , char* tag_name, int* resul
 	if( fromParseLocale==1 ){
 		/* Handle singletons */
 		if( strcmp(tag_name , LOC_LANG_TAG)==0 ){
-			if( strlen(loc_name)>1 && (isIDPrefix(loc_name) ==1 ) ){
-				return loc_name;
+			if( strlen(loc_name)>1 && isIDPrefix(loc_name) ){
+				return estrdup(loc_name);
 			}
 		}
 
@@ -498,8 +497,16 @@ static void get_icu_disp_value_src_php( char* tag_name, INTERNAL_FUNCTION_PARAME
 		RETURN_FALSE;
 	}
 
+    if(loc_name_len > ULOC_FULLNAME_CAPACITY) {
+        /* See bug 67397: overlong locale names cause trouble in uloc_getDisplayName */
+		spprintf(&msg , 0, "locale_get_display_%s : name too long", tag_name );
+		intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR,  msg , 1 TSRMLS_CC );
+		efree(msg);
+		RETURN_FALSE;
+    }
+
 	if(loc_name_len == 0) {
-	loc_name = INTL_G(default_locale);
+        loc_name = INTL_G(default_locale);
 	}
 
 	if( strcmp(tag_name, DISP_NAME) != 0 ){

ext/intl/tests/bug62082.phpt

@@ -10,6 +10,7 @@ var_dump(locale_get_display_name(str_repeat("a", 300), null));
 var_dump(locale_get_display_name(str_repeat("a", 512), null));
 var_dump(locale_get_display_name(str_repeat("a", 600), null));
 --EXPECT--
-string(300) "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-string(512) "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-string(600) "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+bool(false)
+bool(false)
+bool(false)
+

ext/intl/tests/bug67397.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Bug #67397 (Buffer overflow in locale_get_display_name->uloc_getDisplayName (libicu 4.8.1))
+--SKIPIF--
+<?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?>
+--FILE--
+<?php
+
+function ut_main()
+{
+    $ret = var_export(ut_loc_get_display_name(str_repeat('*', 256), 'en_us'), true);
+    $ret .= "\n";
+    $ret .= var_export(intl_get_error_message(), true);
+    return $ret;
+}
+
+include_once( 'ut_common.inc' );
+ut_run();
+?>
+--EXPECTF--
+false
+'locale_get_display_name : name too long: U_ILLEGAL_ARGUMENT_ERROR'

ext/intl/tests/locale_parse_locale2.phpt

@@ -63,7 +63,8 @@ function ut_main()
 //Some Invalid Tags:
         'de-419-DE',
         'a-DE',
-        'ar-a-aaa-b-bbb-a-ccc'
+        'ar-a-aaa-b-bbb-a-ccc',
+	'x-AAAAAA',
     );
 
 
@@ -201,3 +202,6 @@ No values found from Locale parsing.
 ---------------------
 ar-a-aaa-b-bbb-a-ccc:
 language : 'ar' ,
+---------------------
+x-AAAAAA:
+private0 : 'AAAAAA' ,

ext/odbc/php_odbc.c

@@ -1317,7 +1317,7 @@ PHP_FUNCTION(odbc_execute)
 			if (Z_STRLEN_PP(tmp) > 2 &&
 				Z_STRVAL_PP(tmp)[0] == '\'' &&
 				Z_STRVAL_PP(tmp)[Z_STRLEN_PP(tmp) - 1] == '\'') {
-				if (strlen(tmp) != Z_STRLEN_PP(tmp)) {
+				if (strlen(Z_STRVAL_PP(tmp)) != Z_STRLEN_PP(tmp)) {
 					RETURN_FALSE;
 				}
 

ext/openssl/openssl.c

@@ -644,18 +644,28 @@ static time_t asn1_time_to_time_t(ASN1_UTCTIME * timestr TSRMLS_DC) /* {{{ */
 	char * thestr;
 	long gmadjust = 0;
 
-	if (timestr->length < 13) {
-		php_error_docref(NULL TSRMLS_CC, E_WARNING, "extension author too lazy to parse %s correctly", timestr->data);
+	if (ASN1_STRING_type(timestr) != V_ASN1_UTCTIME) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "illegal ASN1 data type for timestamp");
 		return (time_t)-1;
 	}
 
-	strbuf = estrdup((char *)timestr->data);
+	if (ASN1_STRING_length(timestr) != strlen((char*)ASN1_STRING_data(timestr))) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "illegal length in timestamp");
+		return (time_t)-1;
+	}
+
+	if (ASN1_STRING_length(timestr) < 13) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "unable to parse time string %s correctly", timestr->data);
+		return (time_t)-1;
+	}
+
+	strbuf = estrdup((char *)ASN1_STRING_data(timestr));
 
 	memset(&thetime, 0, sizeof(thetime));
 
 	/* we work backwards so that we can use atoi more easily */
 
-	thestr = strbuf + timestr->length - 3;
+	thestr = strbuf + ASN1_STRING_length(timestr) - 3;
 
 	thetime.tm_sec = atoi(thestr);
 	*thestr = '\0';
@@ -755,13 +765,13 @@ static int add_oid_section(struct php_x509_request * req TSRMLS_DC) /* {{{ */
 			req->config_filename, req->var, req->req_config TSRMLS_CC) == FAILURE) return FAILURE
 
 #define SET_OPTIONAL_STRING_ARG(key, varname, defval)	\
-	if (optional_args && zend_hash_find(Z_ARRVAL_P(optional_args), key, sizeof(key), (void**)&item) == SUCCESS) \
+	if (optional_args && zend_hash_find(Z_ARRVAL_P(optional_args), key, sizeof(key), (void**)&item) == SUCCESS && Z_TYPE_PP(item) == IS_STRING) \
 		varname = Z_STRVAL_PP(item); \
 	else \
 		varname = defval
 
 #define SET_OPTIONAL_LONG_ARG(key, varname, defval)	\
-	if (optional_args && zend_hash_find(Z_ARRVAL_P(optional_args), key, sizeof(key), (void**)&item) == SUCCESS) \
+	if (optional_args && zend_hash_find(Z_ARRVAL_P(optional_args), key, sizeof(key), (void**)&item) == SUCCESS && Z_TYPE_PP(item) == IS_LONG) \
 		varname = Z_LVAL_PP(item); \
 	else \
 		varname = defval
@@ -803,7 +813,7 @@ static int php_openssl_parse_config(struct php_x509_request * req, zval * option
 
 	SET_OPTIONAL_LONG_ARG("private_key_type", req->priv_key_type, OPENSSL_KEYTYPE_DEFAULT);
 
-	if (optional_args && zend_hash_find(Z_ARRVAL_P(optional_args), "encrypt_key", sizeof("encrypt_key"), (void**)&item) == SUCCESS) {
+	if (optional_args && zend_hash_find(Z_ARRVAL_P(optional_args), "encrypt_key", sizeof("encrypt_key"), (void**)&item) == SUCCESS && Z_TYPE_PP(item) == IS_BOOL) {
 		req->priv_key_encrypt = Z_BVAL_PP(item);
 	} else {
 		str = CONF_get_string(req->req_config, req->section_name, "encrypt_rsa_key");
@@ -1326,6 +1336,74 @@ PHP_FUNCTION(openssl_x509_check_private_key)
 }
 /* }}} */
 
+/* Special handling of subjectAltName, see CVE-2013-4073
+ * Christian Heimes
+ */
+
+static int openssl_x509v3_subjectAltName(BIO *bio, X509_EXTENSION *extension)
+{
+	GENERAL_NAMES *names;
+	const X509V3_EXT_METHOD *method = NULL;
+	long i, length, num;
+	const unsigned char *p;
+
+	method = X509V3_EXT_get(extension);
+	if (method == NULL) {
+		return -1;
+	}
+
+	p = extension->value->data;
+	length = extension->value->length;
+	if (method->it) {
+		names = (GENERAL_NAMES*)(ASN1_item_d2i(NULL, &p, length,
+						       ASN1_ITEM_ptr(method->it)));
+	} else {
+		names = (GENERAL_NAMES*)(method->d2i(NULL, &p, length));
+	}
+	if (names == NULL) {
+		return -1;
+	}
+
+	num = sk_GENERAL_NAME_num(names);
+	for (i = 0; i < num; i++) {
+			GENERAL_NAME *name;
+			ASN1_STRING *as;
+			name = sk_GENERAL_NAME_value(names, i);
+			switch (name->type) {
+				case GEN_EMAIL:
+					BIO_puts(bio, "email:");
+					as = name->d.rfc822Name;
+					BIO_write(bio, ASN1_STRING_data(as),
+						  ASN1_STRING_length(as));
+					break;
+				case GEN_DNS:
+					BIO_puts(bio, "DNS:");
+					as = name->d.dNSName;
+					BIO_write(bio, ASN1_STRING_data(as),
+						  ASN1_STRING_length(as));
+					break;
+				case GEN_URI:
+					BIO_puts(bio, "URI:");
+					as = name->d.uniformResourceIdentifier;
+					BIO_write(bio, ASN1_STRING_data(as),
+						  ASN1_STRING_length(as));
+					break;
+				default:
+					/* use builtin print for GEN_OTHERNAME, GEN_X400,
+					 * GEN_EDIPARTY, GEN_DIRNAME, GEN_IPADD and GEN_RID
+					 */
+					GENERAL_NAME_print(bio, name);
+			}
+			/* trailing ', ' except for last element */
+			if (i < (num - 1)) {
+				BIO_puts(bio, ", ");
+			}
+	}
+	sk_GENERAL_NAME_pop_free(names, GENERAL_NAME_free);
+
+	return 0;
+}
+
 /* {{{ proto array openssl_x509_parse(mixed x509 [, bool shortnames=true])
    Returns an array of the fields/values of the CERT */
 PHP_FUNCTION(openssl_x509_parse)
@@ -1422,15 +1500,30 @@ PHP_FUNCTION(openssl_x509_parse)
 
 
 	for (i = 0; i < X509_get_ext_count(cert); i++) {
+		int nid;
 		extension = X509_get_ext(cert, i);
-		if (OBJ_obj2nid(X509_EXTENSION_get_object(extension)) != NID_undef) {
+		nid = OBJ_obj2nid(X509_EXTENSION_get_object(extension));
+		if (nid != NID_undef) {
 			extname = (char *)OBJ_nid2sn(OBJ_obj2nid(X509_EXTENSION_get_object(extension)));
 		} else {
 			OBJ_obj2txt(buf, sizeof(buf)-1, X509_EXTENSION_get_object(extension), 1);
 			extname = buf;
 		}
 		bio_out = BIO_new(BIO_s_mem());
-		if (X509V3_EXT_print(bio_out, extension, 0, 0)) {
+		if (nid == NID_subject_alt_name) {
+			if (openssl_x509v3_subjectAltName(bio_out, extension) == 0) {
+				BIO_get_mem_ptr(bio_out, &bio_buf);
+				add_assoc_stringl(subitem, extname, bio_buf->data, bio_buf->length, 1);
+			} else {
+				zval_dtor(return_value);
+				if (certresource == -1 && cert) {
+					X509_free(cert);
+				}
+				BIO_free(bio_out);
+				RETURN_FALSE;
+			}
+		}
+		else if (X509V3_EXT_print(bio_out, extension, 0, 0)) {
 			BIO_get_mem_ptr(bio_out, &bio_buf);
 			add_assoc_stringl(subitem, extname, bio_buf->data, bio_buf->length, 1);
 		} else {
@@ -1796,7 +1889,7 @@ PHP_FUNCTION(openssl_pkcs12_export_to_file)
 	}
 
 	/* parse extra config from args array, promote this to an extra function */
-	if (args && zend_hash_find(Z_ARRVAL_P(args), "friendly_name", sizeof("friendly_name"), (void**)&item) == SUCCESS)
+	if (args && zend_hash_find(Z_ARRVAL_P(args), "friendly_name", sizeof("friendly_name"), (void**)&item) == SUCCESS && Z_TYPE_PP(item) == IS_STRING)
 		friendly_name = Z_STRVAL_PP(item);
 	/* certpbe (default RC2-40)
 	   keypbe (default 3DES)
@@ -1874,7 +1967,7 @@ PHP_FUNCTION(openssl_pkcs12_export)
 	}
 
 	/* parse extra config from args array, promote this to an extra function */
-	if (args && zend_hash_find(Z_ARRVAL_P(args), "friendly_name", sizeof("friendly_name"), (void**)&item) == SUCCESS)
+	if (args && zend_hash_find(Z_ARRVAL_P(args), "friendly_name", sizeof("friendly_name"), (void**)&item) == SUCCESS && Z_TYPE_PP(item) == IS_STRING)
 		friendly_name = Z_STRVAL_PP(item);
 
 	if (args && zend_hash_find(Z_ARRVAL_P(args), "extracerts", sizeof("extracerts"), (void**)&item) == SUCCESS)

ext/openssl/tests/026.phpt

@@ -0,0 +1,12 @@
+--TEST--
+Options type checks
+--SKIPIF--
+<?php if (!extension_loaded("openssl")) print "skip"; ?>
+--FILE--
+<?php
+$x = openssl_pkey_new();
+$csr = openssl_csr_new(["countryName" => "DE"], $x, ["x509_extensions" => 0xDEADBEEF]);
+?>
+DONE
+--EXPECT--
+DONE

ext/openssl/tests/cve-2013-6420.crt

@@ -0,0 +1,29 @@
+-----BEGIN CERTIFICATE-----
+MIIEpDCCA4ygAwIBAgIJAJzu8r6u6eBcMA0GCSqGSIb3DQEBBQUAMIHDMQswCQYD
+VQQGEwJERTEcMBoGA1UECAwTTm9yZHJoZWluLVdlc3RmYWxlbjEQMA4GA1UEBwwH
+S8ODwrZsbjEUMBIGA1UECgwLU2VrdGlvbkVpbnMxHzAdBgNVBAsMFk1hbGljaW91
+cyBDZXJ0IFNlY3Rpb24xITAfBgNVBAMMGG1hbGljaW91cy5zZWt0aW9uZWlucy5k
+ZTEqMCgGCSqGSIb3DQEJARYbc3RlZmFuLmVzc2VyQHNla3Rpb25laW5zLmRlMHUY
+ZDE5NzAwMTAxMDAwMDAwWgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+AAAAAAAXDTE0MTEyODExMzkzNVowgcMxCzAJBgNVBAYTAkRFMRwwGgYDVQQIDBNO
+b3JkcmhlaW4tV2VzdGZhbGVuMRAwDgYDVQQHDAdLw4PCtmxuMRQwEgYDVQQKDAtT
+ZWt0aW9uRWluczEfMB0GA1UECwwWTWFsaWNpb3VzIENlcnQgU2VjdGlvbjEhMB8G
+A1UEAwwYbWFsaWNpb3VzLnNla3Rpb25laW5zLmRlMSowKAYJKoZIhvcNAQkBFhtz
+dGVmYW4uZXNzZXJAc2VrdGlvbmVpbnMuZGUwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+DwAwggEKAoIBAQDDAf3hl7JY0XcFniyEJpSSDqn0OqBr6QP65usJPRt/8PaDoqBu
+wEYT/Na+6fsgPjC0uK9DZgWg2tHWWoanSblAMoz5PH6Z+S4SHRZ7e2dDIjPjdhjh
+0mLg2UMO5yp0V797Ggs9lNt6JRfH81MN2obXWs4NtztLMuD6egqpr8dDbr34aOs8
+pkdui5UawTZksy5pLPHq5cMhFGm06v65CLo0V2Pd9+KAokPrPcN5KLKebz7mLpk6
+SMeEXOKP4idEqxyQ7O7fBuHMedsQhu+prY3si3BUyKfQtP5CZnX2bp0wKHxX12DX
+1nfFIt9DbGvHTcyOuN+nZLPBm3vWxntyIIvVAgMBAAGjQjBAMAkGA1UdEwQCMAAw
+EQYJYIZIAYb4QgEBBAQDAgeAMAsGA1UdDwQEAwIFoDATBgNVHSUEDDAKBggrBgEF
+BQcDAjANBgkqhkiG9w0BAQUFAAOCAQEAG0fZYYCTbdj1XYc+1SnoaPR+vI8C8CaD
+8+0UYhdnyU4gga0BAcDrY9e94eEAu6ZqycF6FjLqXXdAboppWocr6T6GD1x33Ckl
+VArzG/KxQohGD2JeqkhIMlDomxHO7ka39+Oa8i2vWLVyjU8AZvWMAruHa4EENyG7
+lW2AagaFKFCr9TnXTfrdxGVEbv7KVQ6bdhg5p5SjpWH1+Mq03uR3ZXPBYdyV8319
+o0lVj1KFI2DCL/liWisJRoof+1cR35Ctd0wYBcpB6TZslMcOPl76dwKwJgeJo2Qg
+Zsfmc2vC1/qOlNuNq/0TzzkVGv8ETT3CgaU+UXe4XOVvkccebJn2dg==
+-----END CERTIFICATE-----
+
+

ext/openssl/tests/cve-2013-6420.phpt

@@ -0,0 +1,18 @@
+--TEST--
+CVE-2013-6420
+--SKIPIF--
+<?php 
+if (!extension_loaded("openssl")) die("skip"); 
+?>
+--FILE--
+<?php
+$crt = substr(__FILE__, 0, -4).'.crt';
+$info = openssl_x509_parse("file://$crt");
+var_dump($info['issuer']['emailAddress'], $info["validFrom_time_t"]);
+?>
+Done
+--EXPECTF--
+%s openssl_x509_parse(): illegal ASN1 data type for timestamp in %s%ecve-2013-6420.php on line 3
+string(27) "stefan.esser@sektioneins.de"
+int(-1)
+Done

ext/openssl/tests/cve2013_4073.pem

@@ -0,0 +1,28 @@
+-----BEGIN CERTIFICATE-----
+MIIE2DCCA8CgAwIBAgIBADANBgkqhkiG9w0BAQUFADCBxTELMAkGA1UEBhMCVVMx
+DzANBgNVBAgMBk9yZWdvbjESMBAGA1UEBwwJQmVhdmVydG9uMSMwIQYDVQQKDBpQ
+eXRob24gU29mdHdhcmUgRm91bmRhdGlvbjEgMB4GA1UECwwXUHl0aG9uIENvcmUg
+RGV2ZWxvcG1lbnQxJDAiBgNVBAMMG251bGwucHl0aG9uLm9yZwBleGFtcGxlLm9y
+ZzEkMCIGCSqGSIb3DQEJARYVcHl0aG9uLWRldkBweXRob24ub3JnMB4XDTEzMDgw
+NzEzMTE1MloXDTEzMDgwNzEzMTI1MlowgcUxCzAJBgNVBAYTAlVTMQ8wDQYDVQQI
+DAZPcmVnb24xEjAQBgNVBAcMCUJlYXZlcnRvbjEjMCEGA1UECgwaUHl0aG9uIFNv
+ZnR3YXJlIEZvdW5kYXRpb24xIDAeBgNVBAsMF1B5dGhvbiBDb3JlIERldmVsb3Bt
+ZW50MSQwIgYDVQQDDBtudWxsLnB5dGhvbi5vcmcAZXhhbXBsZS5vcmcxJDAiBgkq
+hkiG9w0BCQEWFXB5dGhvbi1kZXZAcHl0aG9uLm9yZzCCASIwDQYJKoZIhvcNAQEB
+BQADggEPADCCAQoCggEBALXq7cn7Rn1vO3aA3TrzA5QLp6bb7B3f/yN0CJ2XFj+j
+pHs+Gw6WWSUDpybiiKnPec33BFawq3kyblnBMjBU61ioy5HwQqVkJ8vUVjGIUq3P
+vX/wBmQfzCe4o4uM89gpHyUL9UYGG8oCRa17dgqcv7u5rg0Wq2B1rgY+nHwx3JIv
+KRrgSwyRkGzpN8WQ1yrXlxWjgI9de0mPVDDUlywcWze1q2kwaEPTM3hLAmD1PESA
+oY/n8A/RXoeeRs9i/Pm/DGUS8ZPINXk/yOzsR/XvvkTVroIeLZqfmFpnZeF0cHzL
+08LODkVJJ9zjLdT7SA4vnne4FEbAxDbKAq5qkYzaL4UCAwEAAaOB0DCBzTAMBgNV
+HRMBAf8EAjAAMB0GA1UdDgQWBBSIWlXAUv9hzVKjNQ/qWpwkOCL3XDALBgNVHQ8E
+BAMCBeAwgZAGA1UdEQSBiDCBhYIeYWx0bnVsbC5weXRob24ub3JnAGV4YW1wbGUu
+Y29tgSBudWxsQHB5dGhvbi5vcmcAdXNlckBleGFtcGxlLm9yZ4YpaHR0cDovL251
+bGwucHl0aG9uLm9yZwBodHRwOi8vZXhhbXBsZS5vcmeHBMAAAgGHECABDbgAAAAA
+AAAAAAAAAAEwDQYJKoZIhvcNAQEFBQADggEBAKxPRe99SaghcI6IWT7UNkJw9aO9
+i9eo0Fj2MUqxpKbdb9noRDy2CnHWf7EIYZ1gznXPdwzSN4YCjV5d+Q9xtBaowT0j
+HPERs1ZuytCNNJTmhyqZ8q6uzMLoht4IqH/FBfpvgaeC5tBTnTT0rD5A/olXeimk
+kX4LxlEx5RAvpGB2zZVRGr6LobD9rVK91xuHYNIxxxfEGE8tCCWjp0+3ksri9SXx
+VHWBnbM9YaL32u3hxm8sYB/Yb8WSBavJCWJJqRStVRHM1koZlJmXNx2BX4vPo6iW
+RFEIPQsFZRLrtnCAiEhyT8bC2s/Njlu6ly9gtJZWSV46Q3ZjBL4q9sHKqZQ=
+-----END CERTIFICATE-----

ext/openssl/tests/cve2013_4073.phpt

@@ -0,0 +1,19 @@
+--TEST--
+CVE 2013-4073: Null-byte certificate handling
+--SKIPIF--
+<?php 
+if (!extension_loaded("openssl")) die("skip");
+--FILE--
+<?php
+$cert = file_get_contents(__DIR__ . '/cve2013_4073.pem');
+$info = openssl_x509_parse($cert);
+var_export($info['extensions']);
+
+--EXPECTF--
+array (
+  'basicConstraints' => 'CA:FALSE',
+  'subjectKeyIdentifier' => '88:5A:55:C0:52:FF:61:CD:52:A3:35:0F:EA:5A:9C:24:38:22:F7:5C',
+  'keyUsage' => 'Digital Signature, Non Repudiation, Key Encipherment',
+  'subjectAltName' => 'DNS:altnull.python.org' . "\0" . 'example.com, email:null@python.org' . "\0" . 'user@example.org, URI:http://null.python.org' . "\0" . 'http://example.org, IP Address:192.0.2.1, IP Address:2001:DB8:0:0:0:0:0:1
+',
+)

ext/session/session.c

@@ -362,7 +362,8 @@ PHPAPI char *php_session_create_id(PS_CREATE_SID_ARGS) /* {{{ */
 
 	if (zend_hash_find(&EG(symbol_table), "_SERVER", sizeof("_SERVER"), (void **) &array) == SUCCESS &&
 		Z_TYPE_PP(array) == IS_ARRAY &&
-		zend_hash_find(Z_ARRVAL_PP(array), "REMOTE_ADDR", sizeof("REMOTE_ADDR"), (void **) &token) == SUCCESS
+		zend_hash_find(Z_ARRVAL_PP(array), "REMOTE_ADDR", sizeof("REMOTE_ADDR"), (void **) &token) == SUCCESS &&
+		Z_TYPE_PP(token) == IS_STRING
 	) {
 		remote_addr = Z_STRVAL_PP(token);
 	}

ext/spl/spl_array.c

@@ -408,7 +408,7 @@ static zval *spl_array_read_dimension_ex(int check_inherited, zval *object, zval
 	/* When in a write context,
 	 * ZE has to be fooled into thinking this is in a reference set
 	 * by separating (if necessary) and returning as an is_ref=1 zval (even if refcount == 1) */
-	if ((type == BP_VAR_W || type == BP_VAR_RW || type == BP_VAR_UNSET) && !Z_ISREF_PP(ret)) {
+	if ((type == BP_VAR_W || type == BP_VAR_RW || type == BP_VAR_UNSET) && !Z_ISREF_PP(ret) && ret != &EG(uninitialized_zval_ptr)) {
 		if (Z_REFCOUNT_PP(ret) > 1) {
 			zval *newval;
 
@@ -1816,7 +1816,7 @@ void spl_array_unserialize_helper(spl_array_object *intern, const unsigned char
 	++p;
 
 	ALLOC_INIT_ZVAL(pmembers);
-	if (!php_var_unserialize(&pmembers, &p, s + buf_len, var_hash_p TSRMLS_CC)) {
+	if (!php_var_unserialize(&pmembers, &p, s + buf_len, var_hash_p TSRMLS_CC) || Z_TYPE_P(pmembers) != IS_ARRAY) {
 		zval_ptr_dtor(&pmembers);
 		goto outexcept;
 	}

ext/spl/spl_directory.c

@@ -819,6 +819,7 @@ SPL_METHOD(DirectoryIterator, seek)
 		zend_call_method_with_0_params(&this_ptr, Z_OBJCE_P(getThis()), &intern->u.dir.func_rewind, "rewind", &retval);
 		if (retval) {
 			zval_ptr_dtor(&retval);
+			retval = NULL;
 		}
 	}
 
@@ -828,6 +829,7 @@ SPL_METHOD(DirectoryIterator, seek)
 		if (retval) {
 			valid = zend_is_true(retval);
 			zval_ptr_dtor(&retval);
+			retval = NULL;
 		}
 		if (!valid) {
 			break;

ext/spl/spl_fixedarray.c

@@ -116,7 +116,7 @@ static void spl_fixedarray_resize(spl_fixedarray *array, long size TSRMLS_DC) /*
 			array->elements = NULL;
 		}
 	} else if (size > array->size) {
-		array->elements = erealloc(array->elements, sizeof(zval *) * size);
+		array->elements = safe_erealloc(array->elements, size, sizeof(zval *), 0);
 		memset(array->elements + array->size, '\0', sizeof(zval *) * (size - array->size));
 	} else { /* size < array->size */
 		long i;

ext/spl/spl_iterators.c

@@ -858,6 +858,8 @@ static union _zend_function *spl_recursive_it_get_method(zval **object_ptr, char
 				*object_ptr = zobj;
 				function_handler = Z_OBJ_HT_P(*object_ptr)->get_method(object_ptr, method, method_len TSRMLS_CC);
 			}
+		} else {
+			*object_ptr = zobj;
 		}
 	}
 	return function_handler;

ext/spl/spl_observer.c

@@ -801,7 +801,7 @@ SPL_METHOD(SplObjectStorage, unserialize)
 	++p;
 
 	ALLOC_INIT_ZVAL(pmembers);
-	if (!php_var_unserialize(&pmembers, &p, s + buf_len, &var_hash TSRMLS_CC)) {
+	if (!php_var_unserialize(&pmembers, &p, s + buf_len, &var_hash TSRMLS_CC) || Z_TYPE_P(pmembers) != IS_ARRAY) {
 		zval_ptr_dtor(&pmembers);
 		goto outexcept;
 	}

ext/spl/tests/SplObjectStorage_unserialize_bad.phpt

@@ -5,8 +5,9 @@ SPL: Test that serialized blob contains unique elements (CVE-2010-2225)
 
 $badblobs = array(
 'x:i:2;i:0;,i:1;;i:0;,i:2;;m:a:0:{}',
-'x:i:3;O:8:"stdClass":0:{},O:8:"stdClass":0:{};R:1;,i:1;;O:8:"stdClass":0:{},r:2;;m:a:0:{}',
-'x:i:3;O:8:"stdClass":0:{},O:8:"stdClass":0:{};r:1;,i:1;;O:8:"stdClass":0:{},r:2;;m:a:0:{}',
+'x:i:3;O:8:"stdClass":0:{},O:8:"stdClass":0:{};R:2;,i:1;;O:8:"stdClass":0:{},r:2;;m:a:0:{}',
+'x:i:3;O:8:"stdClass":0:{},O:8:"stdClass":0:{};r:2;,i:1;;O:8:"stdClass":0:{},r:2;;m:a:0:{}',
+'x:i:1;O:8:"stdClass":0:{},N;;m:s:40:"1234567890123456789012345678901234567890"',
 );
 foreach($badblobs as $blob) {
 try {
@@ -17,6 +18,7 @@ try {
 	echo $e->getMessage()."\n";
 }
 }
+echo "DONE\n";
 --EXPECTF--
 Error at offset 6 of 34 bytes
 Error at offset 46 of 89 bytes
@@ -42,4 +44,5 @@ object(SplObjectStorage)#2 (1) {
     }
   }
 }
-
+Error at offset 79 of 78 bytes
+DONE

ext/spl/tests/bug66127.phpt

@@ -0,0 +1,25 @@
+--TEST--
+Bug #66127 (Segmentation fault with ArrayObject unset)
+--INI--
+error_reporting = E_ALL & ~E_NOTICE
+--FILE--
+<?php
+function crash()
+{
+    set_error_handler(function () {});
+    $var = 1;
+    trigger_error('error');
+    $var2 = $var;
+    $var3 = $var;
+    trigger_error('error');
+}
+
+$items = new ArrayObject();
+
+unset($items[0]);
+unset($items[0][0]);
+crash();
+echo "Worked!\n";
+?>
+--EXPECT--
+Worked!

ext/spl/tests/bug67247.phpt

@@ -0,0 +1,13 @@
+--TEST--
+Bug #67247 (spl_fixedarray_resize integer overflow)
+--FILE--
+<?php
+$ar = new SplFixedArray(1);
+echo "size: ".$ar->getSize()."\n";
+$ar->setSize((PHP_INT_SIZE==8)?0x2000000000000001:0x40000001);
+echo "size: ".$ar->getSize()."\n";
+?>
+--EXPECTF--
+size: 1
+
+Fatal error: Possible integer overflow in memory allocation (%d * %d + 0) in %s on line %d 

ext/spl/tests/bug67359.phpt

@@ -0,0 +1,28 @@
+--TEST--
+Bug #67359 (Segfault in recursiveDirectoryIterator)
+--FILE--
+<?php
+try
+{
+	$rdi = new recursiveDirectoryIterator(dirname(__FILE__),  FilesystemIterator::SKIP_DOTS | FilesystemIterator::UNIX_PATHS);
+	$it = new recursiveIteratorIterator( $rdi );
+	$it->seek(1);
+	while( $it->valid())
+	{
+		if( $it->isFile() )
+		{
+			$it->current();
+		}
+
+		$it->next();
+	}
+
+	$it->current();
+}
+catch(Exception $e)
+{
+}
+echo "okey"
+?>
+--EXPECTF--
+okey

ext/spl/tests/iterator_035.phpt

@@ -12,4 +12,6 @@ $a[] = &$tmp;
 echo "Done\n";
 ?>
 --EXPECTF--	
+Notice: Indirect modification of overloaded element of ArrayIterator has no effect in %s on line %d
+
 Fatal error: Cannot assign by reference to overloaded object in %s on line %d

ext/standard/basic_functions.c

@@ -4050,39 +4050,42 @@ PHP_FUNCTION(putenv)
 {
 	char *setting;
 	int setting_len;
+	char *p, **env;
+	putenv_entry pe;
+#ifdef PHP_WIN32
+	char *value = NULL;
+	int equals = 0;
+	int error_code;
+#endif
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &setting, &setting_len) == FAILURE) {
 		return;
 	}
+    
+    if(setting_len == 0 || setting[0] == '=') {
+    	php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid parameter syntax");
+    	RETURN_FALSE;
+    }
 
-	if (setting_len) {
-		char *p, **env;
-		putenv_entry pe;
+	pe.putenv_string = estrndup(setting, setting_len);
+	pe.key = estrndup(setting, setting_len);
+	if ((p = strchr(pe.key, '='))) {	/* nullify the '=' if there is one */
+		*p = '\0';
 #ifdef PHP_WIN32
-		char *value = NULL;
-		int equals = 0;
-		int error_code;
+		equals = 1;
 #endif
+	}
 
-		pe.putenv_string = estrndup(setting, setting_len);
-		pe.key = estrndup(setting, setting_len);
-		if ((p = strchr(pe.key, '='))) {	/* nullify the '=' if there is one */
-			*p = '\0';
+	pe.key_len = strlen(pe.key);
 #ifdef PHP_WIN32
-			equals = 1;
-#endif
-		}
-
-		pe.key_len = strlen(pe.key);
-#ifdef PHP_WIN32
-		if (equals) {
-			if (pe.key_len < setting_len - 1) {
-				value = p + 1;
-			} else {
-				/* empty string*/
-				value = p;
-			}
+	if (equals) {
+		if (pe.key_len < setting_len - 1) {
+			value = p + 1;
+		} else {
+			/* empty string*/
+			value = p;
 		}
+	}
 #endif
 
 		if (PG(safe_mode)) {
@@ -4120,55 +4123,51 @@ PHP_FUNCTION(putenv)
 
 		zend_hash_del(&BG(putenv_ht), pe.key, pe.key_len+1);
 
-		/* find previous value */
-		pe.previous_value = NULL;
-		for (env = environ; env != NULL && *env != NULL; env++) {
-			if (!strncmp(*env, pe.key, pe.key_len) && (*env)[pe.key_len] == '=') {	/* found it */
+	/* find previous value */
+	pe.previous_value = NULL;
+	for (env = environ; env != NULL && *env != NULL; env++) {
+		if (!strncmp(*env, pe.key, pe.key_len) && (*env)[pe.key_len] == '=') {	/* found it */
 #if defined(PHP_WIN32)
-				/* must copy previous value because MSVCRT's putenv can free the string without notice */
-				pe.previous_value = estrdup(*env);
+			/* must copy previous value because MSVCRT's putenv can free the string without notice */
+			pe.previous_value = estrdup(*env);
 #else
-				pe.previous_value = *env;
+			pe.previous_value = *env;
 #endif
-				break;
-			}
-		}
-
-#if HAVE_UNSETENV
-		if (!p) { /* no '=' means we want to unset it */
-			unsetenv(pe.putenv_string);
-		}
-		if (!p || putenv(pe.putenv_string) == 0) { /* success */
-#else
-# ifndef PHP_WIN32
-		if (putenv(pe.putenv_string) == 0) { /* success */
-# else
-		error_code = SetEnvironmentVariable(pe.key, value);
-#  if _MSC_VER < 1500
-		/* Yet another VC6 bug, unset may return env not found */
-		if (error_code != 0 || 
-			(error_code == 0 && GetLastError() == ERROR_ENVVAR_NOT_FOUND)) {
-#  else
-		if (error_code != 0) { /* success */
-#  endif
-# endif
-#endif
-			zend_hash_add(&BG(putenv_ht), pe.key, pe.key_len + 1, (void **) &pe, sizeof(putenv_entry), NULL);
-#ifdef HAVE_TZSET
-			if (!strncmp(pe.key, "TZ", pe.key_len)) {
-				tzset();
-			}
-#endif
-			RETURN_TRUE;
-		} else {
-			efree(pe.putenv_string);
-			efree(pe.key);
-			RETURN_FALSE;
+			break;
 		}
 	}
 
-	php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid parameter syntax");
-	RETURN_FALSE;
+#if HAVE_UNSETENV
+	if (!p) { /* no '=' means we want to unset it */
+		unsetenv(pe.putenv_string);
+	}
+	if (!p || putenv(pe.putenv_string) == 0) { /* success */
+#else
+# ifndef PHP_WIN32
+	if (putenv(pe.putenv_string) == 0) { /* success */
+# else
+	error_code = SetEnvironmentVariable(pe.key, value);
+#  if _MSC_VER < 1500
+	/* Yet another VC6 bug, unset may return env not found */
+	if (error_code != 0 || 
+		(error_code == 0 && GetLastError() == ERROR_ENVVAR_NOT_FOUND)) {
+#  else
+	if (error_code != 0) { /* success */
+#  endif
+# endif
+#endif
+		zend_hash_add(&BG(putenv_ht), pe.key, pe.key_len + 1, (void **) &pe, sizeof(putenv_entry), NULL);
+#ifdef HAVE_TZSET
+		if (!strncmp(pe.key, "TZ", pe.key_len)) {
+			tzset();
+		}
+#endif
+		RETURN_TRUE;
+	} else {
+		efree(pe.putenv_string);
+		efree(pe.key);
+		RETURN_FALSE;
+	}
 }
 /* }}} */
 #endif

ext/standard/dns.c

@@ -507,6 +507,10 @@ static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int
 				
 				while (ll < dlen) {
 					n = cp[ll];
+					if ((ll + n) >= dlen) {
+						// Invalid chunk length, truncate
+						n = dlen - (ll + 1);
+					}
 					memcpy(tp + ll , cp + ll + 1, n);
 					add_next_index_stringl(entries, cp + ll + 1, n, 1);
 					ll = ll + n + 1;

ext/standard/formatted_print.c

@@ -379,6 +379,7 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC
 	int alignment, currarg, adjusting, argnum, width, precision;
 	char *format, *result, padding;
 	int always_sign;
+	int format_len;
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "+", &args, &argc) == FAILURE) {
 		return NULL;
@@ -417,11 +418,12 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC
 	
 	convert_to_string_ex(args[format_offset]);
 	format = Z_STRVAL_PP(args[format_offset]);
+	format_len = Z_STRLEN_PP(args[format_offset]);
 	result = emalloc(size);
 
 	currarg = 1;
 
-	while (inpos<Z_STRLEN_PP(args[format_offset])) {
+	while (inpos<format_len) {
 		int expprec = 0, multiuse = 0;
 		zval *tmp;
 
@@ -476,7 +478,7 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC
 						/* space padding, the default */
 					} else if (format[inpos] == '+') {
 						always_sign = 1;
-					} else if (format[inpos] == '\'') {
+					} else if (format[inpos] == '\'' && inpos+1<format_len) {
 						padding = format[++inpos];
 					} else {
 						PRINTF_DEBUG(("sprintf: end of modifiers\n"));

ext/standard/info.c

@@ -972,16 +972,16 @@ PHPAPI void php_print_info(int flag TSRMLS_DC)
 
 		php_info_print_table_start();
 		php_info_print_table_header(2, "Variable", "Value");
-		if (zend_hash_find(&EG(symbol_table), "PHP_SELF", sizeof("PHP_SELF"), (void **) &data) != FAILURE) {
+		if (zend_hash_find(&EG(symbol_table), "PHP_SELF", sizeof("PHP_SELF"), (void **) &data) != FAILURE && Z_TYPE_PP(data) == IS_STRING) {
 			php_info_print_table_row(2, "PHP_SELF", Z_STRVAL_PP(data));
 		}
-		if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_TYPE", sizeof("PHP_AUTH_TYPE"), (void **) &data) != FAILURE) {
+		if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_TYPE", sizeof("PHP_AUTH_TYPE"), (void **) &data) != FAILURE && Z_TYPE_PP(data) == IS_STRING) {
 			php_info_print_table_row(2, "PHP_AUTH_TYPE", Z_STRVAL_PP(data));
 		}
-		if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_USER", sizeof("PHP_AUTH_USER"), (void **) &data) != FAILURE) {
+		if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_USER", sizeof("PHP_AUTH_USER"), (void **) &data) != FAILURE && Z_TYPE_PP(data) == IS_STRING) {
 			php_info_print_table_row(2, "PHP_AUTH_USER", Z_STRVAL_PP(data));
 		}
-		if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_PW", sizeof("PHP_AUTH_PW"), (void **) &data) != FAILURE) {
+		if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_PW", sizeof("PHP_AUTH_PW"), (void **) &data) != FAILURE && Z_TYPE_PP(data) == IS_STRING) {
 			php_info_print_table_row(2, "PHP_AUTH_PW", Z_STRVAL_PP(data));
 		}
 		php_print_gpcse_array("_REQUEST", sizeof("_REQUEST")-1 TSRMLS_CC);

ext/standard/iptc.c

@@ -335,6 +335,9 @@ PHP_FUNCTION(iptcparse)
 		recnum = buffer[ inx++ ];
 
 		if (buffer[ inx ] & (unsigned char) 0x80) { /* long tag */
+            if((inx+6) >= str_len) {
+                break;
+            }
 			len = (((long) buffer[ inx + 2 ]) << 24) + (((long) buffer[ inx + 3 ]) << 16) + 
 				  (((long) buffer[ inx + 4 ]) <<  8) + (((long) buffer[ inx + 5 ]));
 			inx += 6;

ext/standard/tests/general_functions/bug67498.phpt

@@ -0,0 +1,15 @@
+--TEST--
+phpinfo() Type Confusion Information Leak Vulnerability
+--FILE--
+<?php
+$PHP_SELF = 1;
+phpinfo(INFO_VARIABLES);
+
+?>
+==DONE==
+--EXPECTF--
+phpinfo()
+
+PHP Variables
+%A
+==DONE==

ext/standard/tests/general_functions/putenv.phpt

@@ -15,6 +15,9 @@ var_dump(getenv($var_name));
 var_dump(putenv($var_name));
 var_dump(getenv($var_name));
 
+var_dump(putenv("=123"));
+var_dump(putenv(""));
+
 echo "Done\n";
 ?>
 --EXPECTF--	
@@ -25,4 +28,10 @@ bool(true)
 string(0) ""
 bool(true)
 bool(false)
+
+Warning: putenv(): Invalid parameter syntax in %s on line %d
+bool(false)
+
+Warning: putenv(): Invalid parameter syntax in %s on line %d
+bool(false)
 Done

ext/standard/tests/image/bug67250.phpt

@@ -0,0 +1,8 @@
+--TEST--
+Bug #67250 (iptcparse out-of-bounds read)
+--FILE--
+<?php
+var_dump(iptcparse("\x1C\x02_\x80___"));
+?>
+--EXPECT--
+bool(false)

ext/standard/tests/strings/bug67249.phpt

@@ -0,0 +1,8 @@
+--TEST--
+Bug #67249 (printf out-of-bounds read)
+--FILE--
+<?php
+var_dump(sprintf("%'", "foo"));
+?>
+--EXPECT--
+string(0) ""

ext/standard/tests/strings/bug67252.phpt

@@ -0,0 +1,13 @@
+--TEST--
+Bug #67252 (convert_uudecode out-of-bounds read)
+--FILE--
+<?php
+
+$a = "M86%A86%A86%A86%A86%A86%A86%A86%A86%A86%A86%A86%A86%A86%A86%A"."\n"."a.";
+var_dump(convert_uudecode($a));
+
+?>
+--EXPECTF--	
+
+Warning: convert_uudecode(): The given parameter is not a valid uuencoded string in %s on line %d
+bool(false)

ext/standard/uuencode.c

@@ -151,6 +151,9 @@ PHPAPI int php_uudecode(char *src, int src_len, char **dest) /* {{{ */
 		}
 
 		while (s < ee) {
+			if(s+4 > e) {
+				goto err;
+			} 
 			*p++ = PHP_UU_DEC(*s) << 2 | PHP_UU_DEC(*(s + 1)) >> 4;
 			*p++ = PHP_UU_DEC(*(s + 1)) << 4 | PHP_UU_DEC(*(s + 2)) >> 2;
 			*p++ = PHP_UU_DEC(*(s + 2)) << 6 | PHP_UU_DEC(*(s + 3));

ext/xml/tests/bug65236.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Bug #65236 (heap corruption in xml parser)
+--SKIPIF--
+<?php
+require_once("skipif.inc");
+?>
+--FILE--
+<?php
+xml_parse_into_struct(xml_parser_create_ns(), str_repeat("<blah>", 1000), $a);
+
+echo "Done\n";
+?>
+--EXPECTF--
+Warning: xml_parse_into_struct(): Maximum depth exceeded - Results truncated in %s on line %d
+Done

ext/xml/xml.c

@@ -427,7 +427,7 @@ static void xml_parser_dtor(zend_rsrc_list_entry *rsrc TSRMLS_DC)
 	}
 	if (parser->ltags) {
 		int inx;
-		for (inx = 0; inx < parser->level; inx++)
+		for (inx = 0; ((inx < parser->level) && (inx < XML_MAXLEVEL)); inx++)
 			efree(parser->ltags[ inx ]);
 		efree(parser->ltags);
 	}
@@ -905,45 +905,50 @@ void _xml_startElementHandler(void *userData, const XML_Char *name, const XML_Ch
 		} 
 
 		if (parser->data) {
-			zval *tag, *atr;
-			int atcnt = 0;
+			if (parser->level <= XML_MAXLEVEL)  {
+				zval *tag, *atr;
+				int atcnt = 0;
 
-			MAKE_STD_ZVAL(tag);
-			MAKE_STD_ZVAL(atr);
+				MAKE_STD_ZVAL(tag);
+				MAKE_STD_ZVAL(atr);
 
-			array_init(tag);
-			array_init(atr);
+				array_init(tag);
+				array_init(atr);
 
-			_xml_add_to_info(parser,((char *) tag_name) + parser->toffset);
+				_xml_add_to_info(parser,((char *) tag_name) + parser->toffset);
 
-			add_assoc_string(tag,"tag",((char *) tag_name) + parser->toffset,1); /* cast to avoid gcc-warning */
-			add_assoc_string(tag,"type","open",1);
-			add_assoc_long(tag,"level",parser->level);
+				add_assoc_string(tag,"tag",((char *) tag_name) + parser->toffset,1); /* cast to avoid gcc-warning */
+				add_assoc_string(tag,"type","open",1);
+				add_assoc_long(tag,"level",parser->level);
 
-			parser->ltags[parser->level-1] = estrdup(tag_name);
-			parser->lastwasopen = 1;
+				parser->ltags[parser->level-1] = estrdup(tag_name);
+				parser->lastwasopen = 1;
 
-			attributes = (const XML_Char **) attrs;
+				attributes = (const XML_Char **) attrs;
 
-			while (attributes && *attributes) {
-				att = _xml_decode_tag(parser, attributes[0]);
-				val = xml_utf8_decode(attributes[1], strlen(attributes[1]), &val_len, parser->target_encoding);
-				
-				add_assoc_stringl(atr,att,val,val_len,0);
+				while (attributes && *attributes) {
+					att = _xml_decode_tag(parser, attributes[0]);
+					val = xml_utf8_decode(attributes[1], strlen(attributes[1]), &val_len, parser->target_encoding);
 
-				atcnt++;
-				attributes += 2;
+					add_assoc_stringl(atr,att,val,val_len,0);
 
-				efree(att);
+					atcnt++;
+					attributes += 2;
+
+					efree(att);
+				}
+
+				if (atcnt) {
+					zend_hash_add(Z_ARRVAL_P(tag),"attributes",sizeof("attributes"),&atr,sizeof(zval*),NULL);
+				} else {
+					zval_ptr_dtor(&atr);
+				}
+
+				zend_hash_next_index_insert(Z_ARRVAL_P(parser->data),&tag,sizeof(zval*),(void *) &parser->ctag);
+			} else if (parser->level == (XML_MAXLEVEL + 1)) {
+				TSRMLS_FETCH();
+				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Maximum depth exceeded - Results truncated");
 			}
-
-			if (atcnt) {
-				zend_hash_add(Z_ARRVAL_P(tag),"attributes",sizeof("attributes"),&atr,sizeof(zval*),NULL);
-			} else {
-				zval_ptr_dtor(&atr);
-			}
-
-			zend_hash_next_index_insert(Z_ARRVAL_P(parser->data),&tag,sizeof(zval*),(void *) &parser->ctag);
 		}
 
 		efree(tag_name);
@@ -995,7 +1000,7 @@ void _xml_endElementHandler(void *userData, const XML_Char *name)
 
 		efree(tag_name);
 
-		if (parser->ltags) {
+		if ((parser->ltags) && (parser->level <= XML_MAXLEVEL)) {
 			efree(parser->ltags[parser->level-1]);
 		}
 
@@ -1079,18 +1084,23 @@ void _xml_characterDataHandler(void *userData, const XML_Char *s, int len)
 						}
 					}
 
-					MAKE_STD_ZVAL(tag);
-					
-					array_init(tag);
-					
-					_xml_add_to_info(parser,parser->ltags[parser->level-1] + parser->toffset);
+					if (parser->level <= XML_MAXLEVEL) {
+						MAKE_STD_ZVAL(tag);
 
-					add_assoc_string(tag,"tag",parser->ltags[parser->level-1] + parser->toffset,1);
-					add_assoc_string(tag,"value",decoded_value,0);
-					add_assoc_string(tag,"type","cdata",1);
-					add_assoc_long(tag,"level",parser->level);
+						array_init(tag);
 
-					zend_hash_next_index_insert(Z_ARRVAL_P(parser->data),&tag,sizeof(zval*),NULL);
+						_xml_add_to_info(parser,parser->ltags[parser->level-1] + parser->toffset);
+
+						add_assoc_string(tag,"tag",parser->ltags[parser->level-1] + parser->toffset,1);
+						add_assoc_string(tag,"value",decoded_value,0);
+						add_assoc_string(tag,"type","cdata",1);
+						add_assoc_long(tag,"level",parser->level);
+
+						zend_hash_next_index_insert(Z_ARRVAL_P(parser->data),&tag,sizeof(zval*),NULL);
+					} else if (parser->level == (XML_MAXLEVEL + 1)) {
+						TSRMLS_FETCH();
+						php_error_docref(NULL TSRMLS_CC, E_WARNING, "Maximum depth exceeded - Results truncated");
+					}
 				}
 			} else {
 				efree(decoded_value);

main/php_version.h

@@ -2,7 +2,7 @@
 /* edit configure.in to change version number */
 #define PHP_MAJOR_VERSION 5
 #define PHP_MINOR_VERSION 3
-#define PHP_RELEASE_VERSION 27
+#define PHP_RELEASE_VERSION 30
 #define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "5.3.27-dev"
-#define PHP_VERSION_ID 50327
+#define PHP_VERSION "5.3.30-dev"
+#define PHP_VERSION_ID 50330

sapi/cgi/cgi_main.c

@@ -1956,9 +1956,9 @@ consult the installation file that came with this distribution, or visit \n\
 								SG(request_info).no_headers = 1;
 							}
 #if ZEND_DEBUG
-							php_printf("PHP %s (%s) (built: %s %s) (DEBUG)\nCopyright (c) 1997-2013 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version());
+							php_printf("PHP %s (%s) (built: %s %s) (DEBUG)\nCopyright (c) 1997-2014 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version());
 #else
-							php_printf("PHP %s (%s) (built: %s %s)\nCopyright (c) 1997-2013 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version());
+							php_printf("PHP %s (%s) (built: %s %s)\nCopyright (c) 1997-2014 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version());
 #endif
 							php_request_shutdown((void *) 0);
 							fcgi_shutdown();

sapi/cli/php.1.in

@@ -1,4 +1,4 @@
-.TH PHP 1 "2013" "The PHP Group" "Scripting Language"
+.TH PHP 1 "2014" "The PHP Group" "Scripting Language"
 .SH NAME
 php \- PHP Command Line Interface 'CLI'
 .SH SYNOPSIS
@@ -425,7 +425,7 @@ contributors all around the world.
 .SH VERSION INFORMATION
 This manpage describes \fBphp\fP, version @PHP_VERSION@.
 .SH COPYRIGHT
-Copyright \(co 1997\-2013 The PHP Group
+Copyright \(co 1997\-2014 The PHP Group
 .LP
 This source file is subject to version 3.01 of the PHP license,
 that is bundled with this package in the file LICENSE, and is

sapi/cli/php_cli.c

@@ -826,7 +826,7 @@ int main(int argc, char *argv[])
 				}
 
 				request_started = 1;
-				php_printf("PHP %s (%s) (built: %s %s) %s\nCopyright (c) 1997-2013 The PHP Group\n%s",
+				php_printf("PHP %s (%s) (built: %s %s) %s\nCopyright (c) 1997-2014 The PHP Group\n%s",
 					PHP_VERSION, sapi_module.name, __DATE__, __TIME__,
 #if ZEND_DEBUG && defined(HAVE_GCOV)
 					"(DEBUG GCOV)",

sapi/fpm/fpm/fpm_main.c

@@ -1721,9 +1721,9 @@ int main(int argc, char *argv[])
 				SG(request_info).no_headers = 1;
 
 #if ZEND_DEBUG
-				php_printf("PHP %s (%s) (built: %s %s) (DEBUG)\nCopyright (c) 1997-2013 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__,        __TIME__, get_zend_version());
+				php_printf("PHP %s (%s) (built: %s %s) (DEBUG)\nCopyright (c) 1997-2014 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__,        __TIME__, get_zend_version());
 #else
-				php_printf("PHP %s (%s) (built: %s %s)\nCopyright (c) 1997-2013 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__,      get_zend_version());
+				php_printf("PHP %s (%s) (built: %s %s)\nCopyright (c) 1997-2014 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__,      get_zend_version());
 #endif
 				php_request_shutdown((void *) 0);
 				fcgi_shutdown();

sapi/fpm/fpm/fpm_unix.c

@@ -35,7 +35,7 @@ int fpm_unix_resolve_socket_premissions(struct fpm_worker_pool_s *wp) /* {{{ */
 	/* uninitialized */
 	wp->socket_uid = -1;
 	wp->socket_gid = -1;
-	wp->socket_mode = 0666;
+	wp->socket_mode = 0660;
 
 	if (!c) {
 		return 0;

sapi/fpm/php-fpm.conf.in

@@ -158,10 +158,10 @@ listen = 127.0.0.1:9000
 ; permissions must be set in order to allow connections from a web server. Many
 ; BSD-derived systems allow connections regardless of permissions. 
 ; Default Values: user and group are set as the running user
-;                 mode is set to 0666
+;                 mode is set to 0660
 ;listen.owner = @php_fpm_user@
 ;listen.group = @php_fpm_group@
-;listen.mode = 0666
+;listen.mode = 0660
  
 ; List of ipv4 addresses of FastCGI clients which are allowed to connect.
 ; Equivalent to the FCGI_WEB_SERVER_ADDRS environment variable in the original

sapi/litespeed/lsapi_main.c

@@ -719,9 +719,9 @@ static int cli_main( int argc, char * argv[] )
             case 'v':
                 if (php_request_startup(TSRMLS_C) != FAILURE) {
 #if ZEND_DEBUG
-                    php_printf("PHP %s (%s) (built: %s %s) (DEBUG)\nCopyright (c) 1997-2013 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version());
+                    php_printf("PHP %s (%s) (built: %s %s) (DEBUG)\nCopyright (c) 1997-2014 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version());
 #else
-                    php_printf("PHP %s (%s) (built: %s %s)\nCopyright (c) 1997-2013 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version());
+                    php_printf("PHP %s (%s) (built: %s %s)\nCopyright (c) 1997-2014 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version());
 #endif
 #ifdef PHP_OUTPUT_NEWAPI
                     php_output_end_all(TSRMLS_C);

sapi/milter/php_milter.c

@@ -1111,7 +1111,7 @@ int main(int argc, char *argv[])
 				}
 				SG(headers_sent) = 1;
 				SG(request_info).no_headers = 1;
-				php_printf("PHP %s (%s) (built: %s %s)\nCopyright (c) 1997-2013 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version());
+				php_printf("PHP %s (%s) (built: %s %s)\nCopyright (c) 1997-2014 The PHP Group\n%s", PHP_VERSION, sapi_module.name, __DATE__, __TIME__, get_zend_version());
 				php_end_ob_buffers(1 TSRMLS_CC);
 				exit(1);
 				break;

win32/build/template.rc

@@ -65,7 +65,7 @@ BEGIN
 #endif
             VALUE "FileVersion", EXT_VERSION
             VALUE "InternalName", INTERNAL_NAME
-            VALUE "LegalCopyright", "Copyright © 1997-2013 The PHP Group"
+            VALUE "LegalCopyright", "Copyright © 1997-2014 The PHP Group"
             VALUE "LegalTrademarks", "PHP"
             VALUE "OriginalFilename", FILE_NAME
             VALUE "ProductName", "PHP"