This commit was manufactured by cvs2svn to create tag 'php_5_1_5'.

# part 2

NEWS

@@ -1,8 +1,34 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2006, PHP 5.?.?
+17 Aug 2006, PHP 5.1.5
+- Fixed memory_limit on 64bit systems. (Stefan E.)
+- Fixed overflow on 64bit systems in str_repeat() and wordwrap(). (Stefan E.)
+- Disabled CURLOPT_FOLLOWLOCATION in curl when open_basedir or safe_mode are
+  enabled. (Stefan E., Ilia)
+- Fixed bug #38322 (reading past array in sscanf() leads to arbitrary code
+  execution). (Tony)
+- Fixed bug #38125 (undefined reference to spl_dual_it_free_storage). (Marcus)
+- Fixed bug #38112 (corrupted gif segfaults) (Pierre)
+- Fixed bug #37587 (var without attribute causes segfault). (Marcus)
+- Fixed bug #37576 (FastCGI env (cgi vars) table overflow). (Piotr)
+- Fixed bug #37496 (FastCGI output buffer overrun). (Piotr, Dmitry)
+- Fixed bug #37487 (oci_fetch_array() array-type should always default to
+  OCI_BOTH). (Tony)
+- Fixed bug #37416 (iterator_to_array() hides exceptions thrown in rewind() 
+  method). (Tony) 
+- Fixed bug #37392 (Unnecessary call to OCITransRollback() at the end of 
+  request). (Tony)
+- Fixed bug #37341 ($_SERVER in included file is shortened to two entries,
+  if $_ENV gets used). (Dmitry)
 - Fixed bug #37313 (sigemptyset() used without including <signal.h>).
   (jdolecek)
+- Fixed bug #37346 (invalid colormap format) (Pierre)
+- Fixed bug #37360 (invalid gif size) (Pierre)
+- Fixed bug #37306 (max_execution_time = max_input_time). (Dmitry)
+- Fixed Bug #37278 (SOAP not respecting uri in __soapCall). (Dmitry)
+- Fixed bug #37265 (Added missing safe_mode & open_basedir checks to
+  imap_body()). (Ilia)
+- Fixed bug #37256 (php-fastcgi dosen't handle connection abort). (Dmitry)
 
 04 May 2006, PHP 5.1.4
 - Added "capture_peer_cert" and "capture_peer_cert_chain" context options

README.CVS-RULES

@@ -29,14 +29,22 @@ Having said that, here are the organizational rules:
    5. If you don't know how to do something, ask first!
 
    6. Test your changes before committing them. We mean it. Really.
+      To do so use "make test".
+   
+   7. For development use the --enable-maintainer-zts switch to ensure your
+      code handles TSRM correctly and doesn't break for thos who need that.
 
 Currently we have the following branches in use:
 HEAD     Will become PHP 6.0. This CVS branch is for active development.
-PHP_5_1  Is used to release the PHP 5.1.x series. Only minor feature
-		 enhancements may go in here, but please keep that as infrequent as
-		 possible.
+PHP_5_2  Is used to release the PHP 5.2.x series. Only minor feature
+         enhancements may go in here, but please keep that as infrequent as
+         possible.
+PHP_5_1  Is used to release the PHP 5.1.x series. Only bugfixes are permitted
+         on this branch (Consult the releasemaster prior to commit).
+PHP_5_0  This branch is closed.
 PHP_4_4  Is used to release the PHP 4.4.x series. Only bugfixes are permitted
-         on this branch.
+         on this branch (Consult the releasemaster prior to commit).
+PHP_4_3  This branch is closed.
 
 The next few rules are more of a technical nature.
 

Zend/tests/bug34873.phpt

@@ -1,5 +1,5 @@
 --TEST--
-Bug #34873 (Segmentation Fault on foreach in object)
+bug #34873 (Segmentation Fault on foreach in object)
 --FILE--
 <?php
 class pwa {

Zend/tests/bug36513.phpt

@@ -1,22 +0,0 @@
---TEST--
-Bug #36513 (comment will be outputed in last line)
---FILE--
-<?php 
-function test($s) {
-  echo "'".trim(str_replace("&nbsp;", " ", htmlspecialchars_decode(strip_tags(highlight_string($s,1)))))."'\n";
-}
-
-eval('echo "1";//2');
-eval('echo 3; //{ 4?>5');
-echo "\n";
-
-//test('<?php echo "1";//');
-test('<?php echo "1";//2');
-test('<?php echo "1";//22');
-test('<?php echo 3; // 4 ?>5');
-?>
---EXPECT--
-135
-'<?php echo "1";//2'
-'<?php echo "1";//22'
-'<?php echo 3; // 4 ?>5'

Zend/tests/bug37046.phpt

@@ -1,23 +0,0 @@
---TEST--
-Bug #37046 (foreach breaks static scope)
---FILE--
-<?php
-function s() {
-  static $storage = array(array('x', 'y'));
-  return $storage[0];
-}
-
-foreach (s() as $k => $function) {
-  echo "op1 $k\n";
-  if ($k == 0) {
-    foreach (s() as $k => $function) {
-      echo "op2 $k\n";
-    }
-  }
-}
-?>
---EXPECT--
-op1 0
-op2 0
-op2 1
-op1 1

Zend/tests/bug37138.phpt

@@ -1,21 +0,0 @@
---TEST--
-Bug #37138 (__autoload tries to load callback'ed self and parent)
---FILE--
-<?php
-function __autoload ($CN) {var_dump ($CN);}
-class st {
-	public static function e () {echo ("EHLO\n");}
-	public static function e2 () {call_user_func (array ('self', 'e'));}
-}
-class stch extends st {
-	public static function g () {call_user_func (array ('parent', 'e'));}
-}
-st::e ();
-st::e2 ();
-stch::g ();
-?>
---EXPECT--
-EHLO
-EHLO
-EHLO
-

Zend/zend_API.c

@@ -2039,16 +2039,18 @@ static int zend_is_callable_check_func(int check_flags, zval ***zobj_ptr_ptr, ze
 	if ((colon = strstr(Z_STRVAL_P(callable), "::")) != NULL) {
 		clen = colon - Z_STRVAL_P(callable);
 		mlen = Z_STRLEN_P(callable) - clen - 2;
-		lcname = zend_str_tolower_dup(Z_STRVAL_P(callable), clen);
-		/* caution: lcname is not '\0' terminated */
-		if (clen == sizeof("self") - 1 && memcmp(lcname, "self", sizeof("self") - 1) == 0) {
-			*ce_ptr = EG(scope);
-		} else if (clen == sizeof("parent") - 1 && memcmp(lcname, "parent", sizeof("parent") - 1) == 0 && EG(active_op_array)->scope) {
-			*ce_ptr = EG(scope) ? EG(scope)->parent : NULL;
-		} else if (zend_lookup_class(Z_STRVAL_P(callable), clen, &pce TSRMLS_CC) == SUCCESS) {
+		if (zend_lookup_class(Z_STRVAL_P(callable), clen, &pce TSRMLS_CC) == SUCCESS) {
 			*ce_ptr = *pce;
+		} else {
+			lcname = zend_str_tolower_dup(Z_STRVAL_P(callable), clen);
+			/* caution: lcname is not '\0' terminated */
+			if (clen == sizeof("self") - 1 && memcmp(lcname, "self", sizeof("self") - 1) == 0) {
+				*ce_ptr = EG(scope);
+			} else if (clen == sizeof("parent") - 1 && memcmp(lcname, "parent", sizeof("parent") - 1) == 0 && EG(active_op_array)->scope) {
+				*ce_ptr = EG(scope) ? EG(scope)->parent : NULL;
+			}
+			efree(lcname);
 		}
-		efree(lcname);
 		if (!*ce_ptr) {
 			return 0;
 		}
@@ -2177,15 +2179,17 @@ ZEND_API zend_bool zend_is_callable_ex(zval *callable, uint check_flags, char **
 							return 1;
 						}
 
-						lcname = zend_str_tolower_dup(Z_STRVAL_PP(obj), Z_STRLEN_PP(obj));
-						if (Z_STRLEN_PP(obj) == sizeof("self") - 1 && memcmp(lcname, "self", sizeof("self")) == 0) {
-							ce = EG(active_op_array)->scope;
-						} else if (Z_STRLEN_PP(obj) == sizeof("parent") - 1 && memcmp(lcname, "parent", sizeof("parent")) == 0 && EG(active_op_array)->scope) {
-							ce = EG(active_op_array)->scope->parent;
-						} else if (zend_lookup_class(Z_STRVAL_PP(obj), Z_STRLEN_PP(obj), &pce TSRMLS_CC) == SUCCESS) {
+						if (zend_lookup_class(Z_STRVAL_PP(obj), Z_STRLEN_PP(obj), &pce TSRMLS_CC) == SUCCESS) {
 							ce = *pce;
+						} else if (EG(active_op_array)) {
+							lcname = zend_str_tolower_dup(Z_STRVAL_PP(obj), Z_STRLEN_PP(obj));
+							if (Z_STRLEN_PP(obj) == sizeof("self") - 1 && memcmp(lcname, "self", sizeof("self")) == 0) {
+								ce = EG(active_op_array)->scope;
+							} else if (Z_STRLEN_PP(obj) == sizeof("parent") - 1 && memcmp(lcname, "parent", sizeof("parent")) == 0 && EG(active_op_array)->scope) {
+								ce = EG(active_op_array)->scope->parent;
+							}
+							efree(lcname);
 						}
-						efree(lcname);
 					} else {
 						ce = Z_OBJCE_PP(obj); /* TBFixed: what if it's overloaded? */
 						

Zend/zend_compile.c

@@ -154,7 +154,6 @@ void zend_init_compiler_data_structures(TSRMLS_D)
 
 void init_compiler(TSRMLS_D)
 {
-	CG(active_op_array) = NULL;
 	zend_init_compiler_data_structures(TSRMLS_C);
 	zend_init_rsrc_list(TSRMLS_C);
 	zend_hash_init(&CG(filenames_table), 5, NULL, (dtor_func_t) free_estring, 0);

Zend/zend_execute_API.c

@@ -819,7 +819,7 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache TS
 	
 	if (EX(function_state).function->common.fn_flags & (ZEND_ACC_ABSTRACT|ZEND_ACC_DEPRECATED)) {
 		if (EX(function_state).function->common.fn_flags & ZEND_ACC_ABSTRACT) {
-			zend_error_noreturn(E_ERROR, "Cannot call abstract method %s::%s()", EX(function_state).function->common.scope->name, EX(function_state).function->common.function_name);
+			zend_error_noreturn(E_ERROR, "Cannot call abstract method %v::%v()", EX(function_state).function->common.scope->name, EX(function_state).function->common.function_name);
 		}
 		if (EX(function_state).function->common.fn_flags & ZEND_ACC_DEPRECATED) {
 			zend_error(E_STRICT, "Function %s%s%s() is deprecated",

Zend/zend_ini_parser.y

@@ -249,26 +249,25 @@ string_or_value:
 		expr { $$ = $1; }
 	|	CFG_TRUE { $$ = $1; }
 	|	CFG_FALSE { $$ = $1; }
+	|   var_string_list { $$ = $1; }
 	|	'\n' { zend_ini_init_string(&$$); }
 	|	/* empty */ { zend_ini_init_string(&$$); }
 ;
 
 
 var_string_list:
-		cfg_var_ref { $$ = $1; }
-	|	TC_ENCAPSULATED_STRING { $$ = $1; }
-	|	constant_string { $$ = $1; }
-	|	var_string_list cfg_var_ref { zend_ini_add_string(&$$, &$1, &$2); free($2.value.str.val); }
+		var_string_list cfg_var_ref { zend_ini_add_string(&$$, &$1, &$2); free($2.value.str.val); }
 	|	var_string_list TC_ENCAPSULATED_STRING { zend_ini_add_string(&$$, &$1, &$2); free($2.value.str.val); }
-	|	var_string_list constant_string { zend_ini_add_string(&$$, &$1, &$2); free($2.value.str.val); }
+	|	var_string_list constant_string { zend_ini_add_string(&$$, &$1, &$2); }
+	|	/* empty */ { zend_ini_init_string(&$$); }
 ;
 
 cfg_var_ref:
-		TC_DOLLAR_CURLY TC_STRING '}' { zend_ini_get_var(&$$, &$2); free($2.value.str.val); }
+		TC_DOLLAR_CURLY TC_STRING '}' { zend_ini_get_var(&$$, &$2); }
 ;
 
 expr:
-		var_string_list			{ $$ = $1; }
+		constant_string			{ $$ = $1; }
 	|	expr '|' expr			{ zend_ini_do_op('|', &$$, &$1, &$3); }
 	|	expr '&' expr			{ zend_ini_do_op('&', &$$, &$1, &$3); }
 	|	'~' expr				{ zend_ini_do_op('~', &$$, &$2, NULL); }

Zend/zend_interfaces.c

@@ -287,7 +287,7 @@ static zend_object_iterator *zend_user_it_get_new_iterator(zend_class_entry *ce,
 	if (!ce || !ce_it || !ce_it->get_iterator || (ce_it->get_iterator == zend_user_it_get_new_iterator && iterator == object)) {
 		if (!EG(exception))
 		{
-			zend_throw_exception_ex(NULL, 0 TSRMLS_CC, "Objects returned by %s::getIterator() must be traversable or implement interface Iterator", ce ? ce->name : Z_OBJCE_P(object)->name);
+			zend_throw_exception_ex(NULL, 0 TSRMLS_CC, "Objects returned by %s::getIterator() must be traversable or implement interface Iterator", ce->name);
 		}
 		if (iterator)
 		{

Zend/zend_language_scanner.l

@@ -1461,7 +1461,7 @@ NEWLINE ("\r"|"\n"|"\r\n")
 	yymore();
 }
 
-<ST_ONE_LINE_COMMENT>[^\n\r?%>]*{ANY_CHAR} {
+<ST_ONE_LINE_COMMENT>[^\n\r?%>]+{ANY_CHAR} {
 	switch (yytext[yyleng-1]) {
 		case '?': case '%': case '>':
 			yyless(yyleng-1);
@@ -1491,7 +1491,7 @@ NEWLINE ("\r"|"\n"|"\r\n")
 <ST_ONE_LINE_COMMENT>"?>"|"%>" {
     if (CG(asp_tags) || yytext[yyleng-2] != '%') { /* asp comment? */
 		zendlval->value.str.val = yytext; /* no copying - intentional */
-		zendlval->value.str.len = yyleng-2;
+		zendlval->value.str.len = yyleng;
 		zendlval->type = IS_STRING;
 		yyless(yyleng-2);
 		BEGIN(ST_IN_SCRIPTING);

Zend/zend_opcode.c

@@ -367,10 +367,8 @@ int pass_two(zend_op_array *op_array TSRMLS_DC)
 		zend_llist_apply_with_argument(&zend_extensions, (llist_apply_with_arg_func_t) zend_extension_op_array_handler, op_array TSRMLS_CC);
 	}
 
-	if (!CG(interactive) && op_array->size != op_array->last) {
-		op_array->opcodes = (zend_op *) erealloc(op_array->opcodes, sizeof(zend_op)*op_array->last);
-		op_array->size = op_array->last;
-	}
+	op_array->opcodes = (zend_op *) erealloc(op_array->opcodes, sizeof(zend_op)*op_array->last);
+	op_array->size = op_array->last;
 
 	opline = op_array->opcodes;
 	end = opline + op_array->last;

Zend/zend_strtod.c

@@ -130,7 +130,6 @@ typedef unsigned long int uint32_t;
  * but the word order is big endian.
  */
 #define IEEE_BIG_ENDIAN
-#undef IEEE_LITTLE_ENDIAN
 #endif
 
 #ifdef __vax__

Zend/zend_vm_def.h

@@ -3017,20 +3017,7 @@ ZEND_VM_HANDLER(77, ZEND_FE_RESET, CONST|TMP|VAR|CV, ANY)
 		} else if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
 			ce = Z_OBJCE_P(array_ptr);
 		} else {
-			if (OP1_TYPE == IS_VAR &&
-				free_op1.var == NULL &&
-			    !array_ptr->is_ref &&
-			    array_ptr->refcount > 1) {
-				/* non-separated return value from function */
-				zval *tmp;
-
-				ALLOC_ZVAL(tmp);
-				INIT_PZVAL_COPY(tmp, array_ptr);
-				zval_copy_ctor(tmp);
-				array_ptr = tmp;
-			} else {
-				array_ptr->refcount++;
-			}
+			array_ptr->refcount++;
 		}
 	}
 
@@ -3236,9 +3223,7 @@ ZEND_VM_HANDLER(78, ZEND_FE_FETCH, VAR, ANY)
 				key->value.lval = int_key;
 				key->type = IS_LONG;
 				break;
-			default:
-				ZVAL_NULL(key);
-				break;
+			EMPTY_SWITCH_DEFAULT_CASE()
 		}
 	}
 

Zend/zend_vm_execute.h

@@ -2059,7 +2059,7 @@ static int ZEND_UNSET_VAR_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 static int ZEND_FE_RESET_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 {
 	zend_op *opline = EX(opline);
-	zend_free_op free_op1;
+	
 	zval *array_ptr, **array_ptr_ptr;
 	HashTable *fe_ht;
 	zend_object_iterator *iter = NULL;
@@ -2100,20 +2100,7 @@ static int ZEND_FE_RESET_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 		} else if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
 			ce = Z_OBJCE_P(array_ptr);
 		} else {
-			if (IS_CONST == IS_VAR &&
-				free_op1.var == NULL &&
-			    !array_ptr->is_ref &&
-			    array_ptr->refcount > 1) {
-				/* non-separated return value from function */
-				zval *tmp;
-
-				ALLOC_ZVAL(tmp);
-				INIT_PZVAL_COPY(tmp, array_ptr);
-				zval_copy_ctor(tmp);
-				array_ptr = tmp;
-			} else {
-				array_ptr->refcount++;
-			}
+			array_ptr->refcount++;
 		}
 	}
 
@@ -4531,20 +4518,7 @@ static int ZEND_FE_RESET_SPEC_TMP_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 		} else if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
 			ce = Z_OBJCE_P(array_ptr);
 		} else {
-			if (IS_TMP_VAR == IS_VAR &&
-				free_op1.var == NULL &&
-			    !array_ptr->is_ref &&
-			    array_ptr->refcount > 1) {
-				/* non-separated return value from function */
-				zval *tmp;
-
-				ALLOC_ZVAL(tmp);
-				INIT_PZVAL_COPY(tmp, array_ptr);
-				zval_copy_ctor(tmp);
-				array_ptr = tmp;
-			} else {
-				array_ptr->refcount++;
-			}
+			array_ptr->refcount++;
 		}
 	}
 
@@ -7544,20 +7518,7 @@ static int ZEND_FE_RESET_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 		} else if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
 			ce = Z_OBJCE_P(array_ptr);
 		} else {
-			if (IS_VAR == IS_VAR &&
-				free_op1.var == NULL &&
-			    !array_ptr->is_ref &&
-			    array_ptr->refcount > 1) {
-				/* non-separated return value from function */
-				zval *tmp;
-
-				ALLOC_ZVAL(tmp);
-				INIT_PZVAL_COPY(tmp, array_ptr);
-				zval_copy_ctor(tmp);
-				array_ptr = tmp;
-			} else {
-				array_ptr->refcount++;
-			}
+			array_ptr->refcount++;
 		}
 	}
 
@@ -7763,9 +7724,7 @@ static int ZEND_FE_FETCH_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 				key->value.lval = int_key;
 				key->type = IS_LONG;
 				break;
-			default:
-				ZVAL_NULL(key);
-				break;
+			EMPTY_SWITCH_DEFAULT_CASE()
 		}
 	}
 
@@ -19615,7 +19574,7 @@ static int ZEND_UNSET_VAR_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 static int ZEND_FE_RESET_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 {
 	zend_op *opline = EX(opline);
-	zend_free_op free_op1;
+	
 	zval *array_ptr, **array_ptr_ptr;
 	HashTable *fe_ht;
 	zend_object_iterator *iter = NULL;
@@ -19656,20 +19615,7 @@ static int ZEND_FE_RESET_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 		} else if (Z_TYPE_P(array_ptr) == IS_OBJECT) {
 			ce = Z_OBJCE_P(array_ptr);
 		} else {
-			if (IS_CV == IS_VAR &&
-				free_op1.var == NULL &&
-			    !array_ptr->is_ref &&
-			    array_ptr->refcount > 1) {
-				/* non-separated return value from function */
-				zval *tmp;
-
-				ALLOC_ZVAL(tmp);
-				INIT_PZVAL_COPY(tmp, array_ptr);
-				zval_copy_ctor(tmp);
-				array_ptr = tmp;
-			} else {
-				array_ptr->refcount++;
-			}
+			array_ptr->refcount++;
 		}
 	}
 

configure.in

@@ -42,7 +42,7 @@ AC_CONFIG_HEADER(main/php_config.h)
 MAJOR_VERSION=5
 MINOR_VERSION=1
 RELEASE_VERSION=5
-EXTRA_VERSION="-dev"
+EXTRA_VERSION=""
 VERSION="$MAJOR_VERSION.$MINOR_VERSION.$RELEASE_VERSION$EXTRA_VERSION"
 
 dnl Define where extension directories are located in the configure context

ext/curl/interface.c

@@ -161,11 +161,16 @@ static void _php_curl_close(zend_rsrc_list_entry *rsrc TSRMLS_DC);
 	    strncasecmp(str, "file:", sizeof("file:") - 1) == 0)								\
 	{ 																							\
 		php_url *tmp_url; 																		\
-																								\
+															\
 		if (!(tmp_url = php_url_parse_ex(str, len))) {											\
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid url '%s'", str);				\
 			RETURN_FALSE; 																		\
 		} 																						\
+															\
+		if (php_memnstr(str, tmp_url->path, strlen(tmp_url->path), str + len)) {				\
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Url '%s' contains unencoded control characters.", str);	\
+			RETURN_FALSE;											\
+		}													\
 																								\
 		if (tmp_url->query || tmp_url->fragment || php_check_open_basedir(tmp_url->path TSRMLS_CC) || 									\
 			(PG(safe_mode) && !php_checkuid(tmp_url->path, "rb+", CHECKUID_CHECK_MODE_PARAM))	\
@@ -1065,7 +1070,6 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue, zval *retu
 		case CURLOPT_FTPLISTONLY:
 		case CURLOPT_FTPAPPEND:
 		case CURLOPT_NETRC:
-		case CURLOPT_FOLLOWLOCATION:
 		case CURLOPT_PUT:
 #if CURLOPT_MUTE != 0
 		 case CURLOPT_MUTE:
@@ -1116,6 +1120,16 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue, zval *retu
 			convert_to_long_ex(zvalue);
 			error = curl_easy_setopt(ch->cp, option, Z_LVAL_PP(zvalue));
 			break;
+		case CURLOPT_FOLLOWLOCATION:
+			convert_to_long_ex(zvalue);
+			if ((PG(open_basedir) && *PG(open_basedir)) || PG(safe_mode)) {
+				if (Z_LVAL_PP(zvalue) != 0) {
+					php_error_docref(NULL TSRMLS_CC, E_WARNING, "CURLOPT_FOLLOWLOCATION cannot be activated when in safe_mode or an open_basedir is set");
+					RETURN_FALSE;
+				}
+			}
+			error = curl_easy_setopt(ch->cp, option, Z_LVAL_PP(zvalue));
+			break;
 		case CURLOPT_URL:
 		case CURLOPT_PROXY:
 		case CURLOPT_USERPWD:

ext/curl/streams.c

@@ -289,7 +289,11 @@ php_stream *php_curl_stream_opener(php_stream_wrapper *wrapper, char *filename,
 	curl_easy_setopt(curlstream->curl, CURLOPT_WRITEHEADER, stream);
 
 	/* currently buggy (bug is in curl) */
-	curl_easy_setopt(curlstream->curl, CURLOPT_FOLLOWLOCATION, 1);
+	if ((PG(open_basedir) && *PG(open_basedir)) || PG(safe_mode)) {
+		curl_easy_setopt(curlstream->curl, CURLOPT_FOLLOWLOCATION, 0);
+	} else {
+		curl_easy_setopt(curlstream->curl, CURLOPT_FOLLOWLOCATION, 1);
+	}
 	
 	curl_easy_setopt(curlstream->curl, CURLOPT_ERRORBUFFER, curlstream->errstr);
 	curl_easy_setopt(curlstream->curl, CURLOPT_VERBOSE, 0);

ext/fbsql/php_fbsql.c

@@ -58,6 +58,10 @@
 
 #define HAVE_FBSQL 1
 
+#ifndef min
+# define min(a,b) ((a)<(b)?(a):(b))
+#endif
+
 #if HAVE_FBSQL
 #include "php_fbsql.h"
 #include <signal.h>
@@ -379,6 +383,7 @@ PHP_INI_BEGIN()
 	STD_PHP_INI_BOOLEAN  ("fbsql.allow_persistent",				"1",		PHP_INI_SYSTEM, OnUpdateBool,	allowPersistent,  zend_fbsql_globals, fbsql_globals)
 	STD_PHP_INI_BOOLEAN  ("fbsql.generate_warnings",			"0",		PHP_INI_SYSTEM, OnUpdateBool,	generateWarnings, zend_fbsql_globals, fbsql_globals)
 	STD_PHP_INI_BOOLEAN  ("fbsql.autocommit",					"1",		PHP_INI_SYSTEM, OnUpdateBool,	autoCommit,	      zend_fbsql_globals, fbsql_globals)
+	STD_PHP_INI_BOOLEAN  ("fbsql.show_timestamp_decimals",		"0",		PHP_INI_SYSTEM,	OnUpdateBool,	showTimestampDecimals,	zend_fbsql_globals,	fbsql_globals)
 	STD_PHP_INI_ENTRY_EX ("fbsql.max_persistent",				"-1",		PHP_INI_SYSTEM, OnUpdateLong,	maxPersistent,    zend_fbsql_globals, fbsql_globals, display_link_numbers)
 	STD_PHP_INI_ENTRY_EX ("fbsql.max_links",					"128",		PHP_INI_SYSTEM, OnUpdateLong,	maxLinks,         zend_fbsql_globals, fbsql_globals, display_link_numbers)
 	STD_PHP_INI_ENTRY_EX ("fbsql.max_connections",				"128",		PHP_INI_SYSTEM, OnUpdateLong,	maxConnections,   zend_fbsql_globals, fbsql_globals, display_link_numbers)
@@ -540,7 +545,26 @@ static void php_fbsql_do_connect(INTERNAL_FUNCTION_PARAMETERS, int persistent)
 	if (persistent) {
 		if (zend_hash_find(&EG(persistent_list), name, strlen(name) + 1, (void **)&lep) == SUCCESS)
 		{
+			FBCMetaData *md;
 			phpLink = (PHPFBLink*)lep->ptr;
+			// Check if connection still there.
+			md = fbcdcRollback(phpLink->connection);
+			if ( !mdOk(phpLink, md, "Rollback;") ) {
+				if (FB_SQL_G(generateWarnings)) {
+					php_error_docref(NULL TSRMLS_CC, E_WARNING, "FrontBase link is not connected, ty to reconnect.");
+				}
+				// Make sure select_db will reconnect.
+				fbcmdRelease(md);
+				fbcdcClose(phpLink->connection);
+				fbcdcRelease(phpLink->connection);
+				free(phpLink->connection);
+				phpLink->connection = NULL;
+				if (phpLink->databaseName) free(phpLink->databaseName);
+				phpLink->databaseName = NULL;
+			}
+			else {
+				fbcmdRelease(md);
+			}
 		}
 		else {
 			zend_rsrc_list_entry le;
@@ -2509,8 +2533,6 @@ void phpfbColumnAsString(PHPFBResult* result, int column, void* data , int* leng
 		case FB_Float:
 		case FB_Real:
 		case FB_Double:
-		case FB_Numeric:
-		case FB_Decimal:
 		{
 			double v = *((double*)data);
 			char b[128];
@@ -2519,6 +2541,18 @@ void phpfbColumnAsString(PHPFBResult* result, int column, void* data , int* leng
 		}
 		break;
 
+		case FB_Numeric:
+		case FB_Decimal:
+		{
+ 			unsigned precision = fbcdmdPrecision(dtmd);
+ 			unsigned scale = fbcdmdScale(dtmd);
+  			double v = *((double*)data);
+  			char b[128];
+ 			snprintf(b, sizeof(b), "%.*f", scale, v);
+  			phpfbestrdup(b, length, value);
+		}
+		break;
+		
 		case FB_Character:
 		case FB_VCharacter:
 		{
@@ -2589,7 +2623,6 @@ void phpfbColumnAsString(PHPFBResult* result, int column, void* data , int* leng
 		case FB_Date:
 		case FB_Time:
 		case FB_TimeTZ:
-		case FB_Timestamp:
 		case FB_TimestampTZ:
 		{
 			char* v = (char*)data;
@@ -2597,6 +2630,27 @@ void phpfbColumnAsString(PHPFBResult* result, int column, void* data , int* leng
 		}
 		break;
 
+		case FB_Timestamp:
+		{
+			char* v = (char*)data;
+			if (FB_SQL_G(showTimestampDecimals)) {
+				phpfbestrdup(v, length, value);
+			}
+			// Copy only YYYY-MM-DD HH:MM:SS
+			else {
+				int stringLength = strlen(v);
+				stringLength = min(stringLength, 19);
+ 				if (value) {
+					char* r = emalloc(stringLength+1);
+					memcpy(r, v, stringLength);
+					r[stringLength] = 0;
+					*value = r;
+				}
+				*length = stringLength;
+			}
+		}
+		break;
+		
 		case FB_YearMonth:
 		{
 			char b[128];

ext/fbsql/php_fbsql.h

@@ -108,23 +108,23 @@ static void php_fbsql_fetch_hash(INTERNAL_FUNCTION_PARAMETERS, int result_type,
 static void php_fbsql_do_connect(INTERNAL_FUNCTION_PARAMETERS, int persistent);
 
 ZEND_BEGIN_MODULE_GLOBALS(fbsql)
-   zend_bool allowPersistent;
-   zend_bool generateWarnings;
-   zend_bool autoCommit;
-   long maxPersistent;
-   long maxLinks;
-   long maxConnections;
-   long maxResults;
-   long batchSize;
-   char *hostName;
-   char *databaseName;
-   char *databasePassword;
-   char *userName;
-   char *userPassword;
-   long persistentCount;
-   long linkCount;
-   long linkIndex;
-
+	zend_bool allowPersistent;
+	zend_bool generateWarnings;
+	zend_bool autoCommit;
+	zend_bool showTimestampDecimals;
+	long maxPersistent;
+	long maxLinks;
+	long maxConnections;
+	long maxResults;
+	long batchSize;
+	char *hostName;
+	char *databaseName;
+	char *databasePassword;
+	char *userName;
+	char *userPassword;
+	long persistentCount;
+	long linkCount;
+	long linkIndex;
 ZEND_END_MODULE_GLOBALS(fbsql)
 
 #ifdef ZTS

ext/gd/libgd/gd.c

@@ -2161,7 +2161,7 @@ void gdImageCopy (gdImagePtr dst, gdImagePtr src, int dstX, int dstY, int srcX,
 				for (x = 0; (x < w); x++) {
 					int c = gdImageGetPixel (src, srcX + x, srcY + y);
 					if (c != src->transparent) {
-						gdImageSetPixel (dst, dstX + x, dstY + y, gdTrueColor(src->red[c], src->green[c], src->blue[c]));
+						gdImageSetPixel(dst, dstX + x, dstY + y, gdTrueColorAlpha(src->red[c], src->green[c], src->blue[c], src->alpha[c]));
 					}
 				}
 			}

ext/gd/libgd/gd_gd2.c

@@ -430,6 +430,10 @@ gdImagePtr gdImageCreateFromGd2PartCtx (gdIOCtx * in, int srcx, int srcy, int w,
 
 	gdImagePtr im;
 
+	if (w<1 || h <1) {
+		return 0;
+	}
+
 	/* The next few lines are basically copied from gd2CreateFromFile
 	 * we change the file size, so don't want to use the code directly.
 	 * but we do need to know the file size.

ext/gd/libgd/gd_gif_in.c

@@ -44,7 +44,7 @@ static int set_verbose(void)
 #define LOCALCOLORMAP  0x80
 #define BitSet(byte, bit)      (((byte) & (bit)) == (bit))
 
-#define        ReadOK(file,buffer,len) (gdGetBuf(buffer, len, file) != 0)
+#define        ReadOK(file,buffer,len) (gdGetBuf(buffer, len, file) > 0)
 
 #define LM_to_uint(a,b)                        (((b)<<8)|(a))
 
@@ -147,6 +147,9 @@ gdImageCreateFromGifCtx(gdIOCtxPtr fd)
        Background      = buf[5];
        AspectRatio     = buf[6];
 
+		imw = LM_to_uint(buf[0],buf[1]);
+		imh = LM_to_uint(buf[2],buf[3]);
+
        if (BitSet(buf[4], LOCALCOLORMAP)) {    /* Global Colormap */
                if (ReadColorMap(fd, BitPixel, ColorMap)) {
 			return 0;
@@ -182,14 +185,13 @@ gdImageCreateFromGifCtx(gdIOCtxPtr fd)
 
                bitPixel = 1<<((buf[8]&0x07)+1);
 
-               imw = LM_to_uint(buf[4],buf[5]);
-               imh = LM_to_uint(buf[6],buf[7]);
-	       if (!(im = gdImageCreate(imw, imh))) {
-			 return 0;
-	       }
+		if (!(im = gdImageCreate(imw, imh))) {
+			return 0;
+		}
+
                im->interlace = BitSet(buf[8], INTERLACE);
                if (! useGlobalColormap) {
-                       if (ReadColorMap(fd, bitPixel, localColorMap)) {
+		       if (ReadColorMap(fd, bitPixel, localColorMap)) {
                                  return 0;
                        }
                        ReadImage(im, fd, imw, imh, localColorMap,
@@ -212,6 +214,10 @@ terminated:
        if (!im) {
 		return 0;
        }
+	if (!im->colorsTotal) {
+		gdImageDestroy(im);
+		return 0;
+	}
        /* Check for open colors at the end, so
           we can reduce colorsTotal and ultimately
           BitsPerPixel */
@@ -502,6 +508,18 @@ ReadImage(gdImagePtr im, gdIOCtx *fd, int len, int height, unsigned char (*cmap)
        int             v;
        int             xpos = 0, ypos = 0, pass = 0;
        int i;
+
+       /*
+       **  Initialize the Compression routines
+       */
+       if (! ReadOK(fd,&c,1)) {
+               return;
+       }
+
+	if (c > MAX_LWZ_BITS) {
+		return;
+	}
+
        /* Stash the color map into the image */
        for (i=0; (i<gdMaxColors); i++) {
                im->red[i] = cmap[CM_RED][i];
@@ -511,12 +529,7 @@ ReadImage(gdImagePtr im, gdIOCtx *fd, int len, int height, unsigned char (*cmap)
        }
        /* Many (perhaps most) of these colors will remain marked open. */
        im->colorsTotal = gdMaxColors;
-       /*
-       **  Initialize the Compression routines
-       */
-       if (! ReadOK(fd,&c,1)) {
-               return;
-       }
+
        if (LWZReadByte(fd, TRUE, c) < 0) {
                return;
        }

ext/gd/libgd/gd_gif_out.c

@@ -265,9 +265,11 @@ GIFEncode(gdIOCtxPtr fp, int GWidth, int GHeight, int GInterlace, int Background
         int InitCodeSize;
         int i;
 	GifCtx ctx;
+	
+	memset(&ctx, 0, sizeof(ctx));
         ctx.Interlace = GInterlace;
 	ctx.in_count = 1;
-	memset(&ctx, 0, sizeof(ctx));
+
         ColorMapSize = 1 << BitsPerPixel;
 
         RWidth = ctx.Width = GWidth;

ext/gd/tests/bug37346.gif

@@ -0,0 +1,4 @@
+GIF89a
+<
+
+看吧, 我都说过滤不严了

ext/gd/tests/bug37346.phpt

@@ -0,0 +1,13 @@
+--TEST--
+Bug #37346 (gdimagecreatefromgif, bad colormap)
+--SKIPIF--
+<?php 
+	if (!extension_loaded('gd')) die("skip gd extension not available\n"); 
+	if (!GD_BUNDLED) die('skip external GD libraries always fail');
+?>
+--FILE--
+<?php
+$im = imagecreatefromgif(dirname(__FILE__) . '/bug37346.gif');
+?>
+--EXPECTF--
+Warning: imagecreatefromgif(): '%sbug37346.gif' is not a valid GIF file in %sbug37346.php on line %d

ext/gd/tests/bug37360.phpt

@@ -0,0 +1,14 @@
+--TEST--
+Bug #37360 (gdimagecreatefromgif, bad image sizes)
+--SKIPIF--
+<?php 
+	if (!extension_loaded('gd')) die("skip gd extension not available\n"); 
+	if (!GD_BUNDLED) die('skip external GD libraries always fail');
+?>
+--FILE--
+<?php
+$im = imagecreatefromgif(dirname(__FILE__) . '/bug37360.gif');
+var_dump($im);
+?>
+--EXPECTF--
+resource(%d) of type (gd)

ext/imap/php_imap.c

@@ -761,6 +761,13 @@ static void php_imap_do_open(INTERNAL_FUNCTION_PARAMETERS, int persistent)
 		efree(IMAPG(imap_password));
 	}
 
+	/* local filename, need to perform open_basedir and safe_mode checks */
+	if (Z_STRVAL_PP(mailbox)[0] != '{' && 
+			(php_check_open_basedir(Z_STRVAL_PP(mailbox) TSRMLS_CC) || 
+			(PG(safe_mode) && !php_checkuid(Z_STRVAL_PP(mailbox), NULL, CHECKUID_CHECK_FILE_AND_DIR)))) {
+		RETURN_FALSE;
+	}
+
 	IMAPG(imap_user)     = estrndup(Z_STRVAL_PP(user), Z_STRLEN_PP(user));
 	IMAPG(imap_password) = estrndup(Z_STRVAL_PP(passwd), Z_STRLEN_PP(passwd));
 
@@ -817,6 +824,14 @@ PHP_FUNCTION(imap_reopen)
 		}
 		imap_le_struct->flags = cl_flags;	
 	}
+
+	/* local filename, need to perform open_basedir and safe_mode checks */
+	if (Z_STRVAL_PP(mailbox)[0] != '{' && 
+			(php_check_open_basedir(Z_STRVAL_PP(mailbox) TSRMLS_CC) || 
+			(PG(safe_mode) && !php_checkuid(Z_STRVAL_PP(mailbox), NULL, CHECKUID_CHECK_FILE_AND_DIR)))) {
+		RETURN_FALSE;
+	}
+
 	imap_stream = mail_open(imap_le_struct->imap_stream, Z_STRVAL_PP(mailbox), flags);
 	if (imap_stream == NIL) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Couldn't re-open stream");

ext/mbstring/mbstring.c

@@ -694,14 +694,18 @@ static PHP_INI_MH(OnUpdate_mbstring_substitute_character)
 	if (new_value != NULL) {
 		if (strcasecmp("none", new_value) == 0) {
 			MBSTRG(filter_illegal_mode) = MBFL_OUTPUTFILTER_ILLEGAL_MODE_NONE;
+			MBSTRG(current_filter_illegal_mode) = MBFL_OUTPUTFILTER_ILLEGAL_MODE_NONE;
 		} else if (strcasecmp("long", new_value) == 0) {
 			MBSTRG(filter_illegal_mode) = MBFL_OUTPUTFILTER_ILLEGAL_MODE_LONG;
+			MBSTRG(current_filter_illegal_mode) = MBFL_OUTPUTFILTER_ILLEGAL_MODE_LONG;
 		} else {
 			MBSTRG(filter_illegal_mode) = MBFL_OUTPUTFILTER_ILLEGAL_MODE_CHAR;
+			MBSTRG(current_filter_illegal_mode) = MBFL_OUTPUTFILTER_ILLEGAL_MODE_CHAR;
 			if (new_value_length >0) {
 				c = strtol(new_value, &endptr, 0);
 				if (*endptr == '\0') {
 					MBSTRG(filter_illegal_substchar) = c;
+					MBSTRG(current_filter_illegal_substchar) = c;
 				}
 			}
 		}
@@ -3347,11 +3351,15 @@ PHP_FUNCTION(mb_send_mail)
 PHP_FUNCTION(mb_get_info)
 {
 	char *typ = NULL;
-	int typ_len;
+	int typ_len, n;
 	char *name;
 	const struct mb_overload_def *over_func;
-	zval *row;
+	zval *row1, *row2;
 	const mbfl_language *lang = mbfl_no2language(MBSTRG(current_language));
+	enum mbfl_no_encoding *entry;
+#ifdef ZEND_MULTIBYTE
+	zval *row3;
+#endif /* ZEND_MULTIBYTE */
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|s", &typ, &typ_len) == FAILURE) {
 		RETURN_FALSE;
@@ -3370,15 +3378,15 @@ PHP_FUNCTION(mb_get_info)
 		}
 		if (MBSTRG(func_overload)){
 			over_func = &(mb_ovld[0]);
-			MAKE_STD_ZVAL(row);
-			array_init(row);
+			MAKE_STD_ZVAL(row1);
+			array_init(row1);
 			while (over_func->type > 0) {
 				if ((MBSTRG(func_overload) & over_func->type) == over_func->type ) {
-					add_assoc_string(row, over_func->orig_func, over_func->ovld_func, 1);
+					add_assoc_string(row1, over_func->orig_func, over_func->ovld_func, 1);
 				}
 				over_func++;
 			}
-			add_assoc_zval(return_value, "func_overload", row);
+			add_assoc_zval(return_value, "func_overload", row1);
 		} else {
 			add_assoc_string(return_value, "func_overload", "no overload", 1);
  		}
@@ -3393,6 +3401,57 @@ PHP_FUNCTION(mb_get_info)
 				add_assoc_string(return_value, "mail_body_encoding", name, 1);
 			}
 		}
+		add_assoc_long(return_value, "illegal_chars", MBSTRG(illegalchars));
+		if (MBSTRG(encoding_translation)) {
+			add_assoc_string(return_value, "encoding_translation", "On", 1);
+		} else {
+			add_assoc_string(return_value, "encoding_translation", "Off", 1);
+		}
+		if ((name = (char *)mbfl_no_language2name(MBSTRG(current_language))) != NULL) {
+			add_assoc_string(return_value, "language", name, 1);
+		}		
+		n = MBSTRG(current_detect_order_list_size);
+		entry = MBSTRG(current_detect_order_list);
+		if(n > 0) {
+			MAKE_STD_ZVAL(row2);
+			array_init(row2);
+			while (n > 0) {
+				if ((name = (char *)mbfl_no_encoding2name(*entry)) != NULL) {
+					add_next_index_string(row2, name, 1);
+				}
+				entry++;
+				n--;
+			}
+			add_assoc_zval(return_value, "detect_order", row2);
+		}
+		if (MBSTRG(current_filter_illegal_mode) == MBFL_OUTPUTFILTER_ILLEGAL_MODE_NONE) {
+			add_assoc_string(return_value, "substitute_character", "none", 1);
+		} else if (MBSTRG(current_filter_illegal_mode) == MBFL_OUTPUTFILTER_ILLEGAL_MODE_LONG) {
+			add_assoc_string(return_value, "substitute_character", "long", 1);
+		} else {
+			add_assoc_long(return_value, "substitute_character", MBSTRG(current_filter_illegal_substchar));
+		}
+		if (MBSTRG(strict_detection)) {
+			add_assoc_string(return_value, "strict_detection", "On", 1);
+		} else {
+			add_assoc_string(return_value, "strict_detection", "Off", 1);
+		}
+#ifdef ZEND_MULTIBYTE
+		entry = MBSTRG(script_encoding_list);
+		n = MBSTRG(script_encoding_list_size);
+		if(n > 0) {
+			MAKE_STD_ZVAL(row3);
+			array_init(row3);
+			while (n > 0) {
+				if ((name = (char *)mbfl_no_encoding2name(*entry)) != NULL) {
+					add_next_index_string(row3, name, 1);
+				}
+				entry++;
+				n--;
+			}
+			add_assoc_zval(return_value, "script_encoding", row3);
+		}
+#endif /* ZEND_MULTIBYTE */
 	} else if (!strcasecmp("internal_encoding", typ)) {
 		if ((name = (char *)mbfl_no_encoding2name(MBSTRG(current_internal_encoding))) != NULL) {
 			RETVAL_STRING(name, 1);
@@ -3432,7 +3491,63 @@ PHP_FUNCTION(mb_get_info)
 		}
 	} else if (!strcasecmp("illegal_chars", typ)) {
 		RETVAL_LONG(MBSTRG(illegalchars));
+	} else if (!strcasecmp("encoding_translation", typ)) {
+		if (MBSTRG(encoding_translation)) {
+			RETVAL_STRING("On", 1);
+		} else {
+			RETVAL_STRING("Off", 1);
+		}
+	} else if (!strcasecmp("language", typ)) {
+		if ((name = (char *)mbfl_no_language2name(MBSTRG(current_language))) != NULL) {
+			RETVAL_STRING(name, 1);
+		}		
+	} else if (!strcasecmp("detect_order", typ)) {
+		n = MBSTRG(current_detect_order_list_size);
+		entry = MBSTRG(current_detect_order_list);
+		if(n > 0) {
+			array_init(return_value);
+			while (n > 0) {
+				name = (char *)mbfl_no_encoding2name(*entry);
+				if (name) {
+					add_next_index_string(return_value, name, 1);
+				}
+				entry++;
+				n--;
+			}
+		}
+	} else if (!strcasecmp("substitute_character", typ)) {
+		if (MBSTRG(current_filter_illegal_mode) == MBFL_OUTPUTFILTER_ILLEGAL_MODE_NONE) {
+			RETVAL_STRING("none", 1);
+		} else if (MBSTRG(current_filter_illegal_mode) == MBFL_OUTPUTFILTER_ILLEGAL_MODE_LONG) {
+			RETVAL_STRING("long", 1);
+		} else {
+			RETVAL_LONG(MBSTRG(current_filter_illegal_substchar));
+		}
+	} else if (!strcasecmp("strict_detection", typ)) {
+		if (MBSTRG(strict_detection)) {
+			RETVAL_STRING("On", 1);
+		} else {
+			RETVAL_STRING("Off", 1);
+		}
 	} else {
+#ifdef ZEND_MULTIBYTE
+	if (!strcasecmp("script_encoding", typ)) {
+		entry = MBSTRG(script_encoding_list);
+		n = MBSTRG(script_encoding_list_size);
+		if(n > 0) {
+			array_init(return_value);
+			while (n > 0) {
+				name = (char *)mbfl_no_encoding2name(*entry);
+				if (name) {
+					add_next_index_string(return_value, name, 1);
+				}
+				entry++;
+				n--;
+			}
+		}
+		return;
+	}
+#endif /* ZEND_MULTIBYTE */
 		RETURN_FALSE;
 	}
 }

ext/oci8/oci8.c

@@ -1643,6 +1643,16 @@ void php_oci_fetch_row (INTERNAL_FUNCTION_PARAMETERS, int mode, int expected_arg
 		fetch_mode = mode;
 	}
 
+	if (!(fetch_mode & PHP_OCI_NUM) && !(fetch_mode & PHP_OCI_ASSOC)) {
+		/* none of the modes present, use the default one */
+		if (mode & PHP_OCI_ASSOC) {
+			fetch_mode |= PHP_OCI_ASSOC;
+		} 
+		if (mode & PHP_OCI_NUM) {
+			fetch_mode |= PHP_OCI_NUM;
+		}
+	}
+
 	PHP_OCI_ZVAL_TO_STATEMENT(z_statement, statement);
 
 	if (php_oci_statement_fetch(statement, nrows TSRMLS_CC)) {
@@ -1718,7 +1728,9 @@ static int php_oci_persistent_helper(zend_rsrc_list_entry *le TSRMLS_DC)
 				connection->descriptors = NULL;
 			}
 			
-			php_oci_connection_rollback(connection TSRMLS_CC);
+			if (connection->needs_commit) {
+				php_oci_connection_rollback(connection TSRMLS_CC);
+			}
 			
 			if (OCI_G(persistent_timeout) > 0) {
 				connection->idle_expiry = timestamp + OCI_G(persistent_timeout);

ext/oci8/tests/fetch_array.phpt

@@ -209,58 +209,100 @@ array(4) {
   ["VALUE"]=>
   string(1) "1"
 }
-array(2) {
+array(4) {
   [0]=>
   string(1) "1"
+  ["ID"]=>
+  string(1) "1"
   [1]=>
   string(1) "1"
+  ["VALUE"]=>
+  string(1) "1"
 }
-array(2) {
+array(4) {
   [0]=>
   string(1) "1"
+  ["ID"]=>
+  string(1) "1"
   [1]=>
   string(1) "1"
+  ["VALUE"]=>
+  string(1) "1"
 }
-array(2) {
+array(4) {
   [0]=>
   string(1) "1"
+  ["ID"]=>
+  string(1) "1"
   [1]=>
   string(1) "1"
+  ["VALUE"]=>
+  string(1) "1"
 }
-array(5) {
+array(10) {
   [0]=>
   string(1) "1"
+  ["ID"]=>
+  string(1) "1"
   [1]=>
   string(1) "1"
+  ["VALUE"]=>
+  string(1) "1"
   [2]=>
   NULL
+  ["BLOB"]=>
+  NULL
   [3]=>
   NULL
+  ["CLOB"]=>
+  NULL
   [4]=>
   NULL
+  ["STRING"]=>
+  NULL
 }
-array(5) {
+array(10) {
   [0]=>
   string(1) "1"
+  ["ID"]=>
+  string(1) "1"
   [1]=>
   string(1) "1"
+  ["VALUE"]=>
+  string(1) "1"
   [2]=>
   NULL
+  ["BLOB"]=>
+  NULL
   [3]=>
   NULL
+  ["CLOB"]=>
+  NULL
   [4]=>
   NULL
+  ["STRING"]=>
+  NULL
 }
-array(5) {
+array(10) {
   [0]=>
   string(1) "1"
+  ["ID"]=>
+  string(1) "1"
   [1]=>
   string(1) "1"
+  ["VALUE"]=>
+  string(1) "1"
   [2]=>
   NULL
+  ["BLOB"]=>
+  NULL
   [3]=>
   NULL
+  ["CLOB"]=>
+  NULL
   [4]=>
   NULL
+  ["STRING"]=>
+  NULL
 }
 Done

ext/oci8/tests/field_funcs.phpt

@@ -34,7 +34,7 @@ if (!oci_execute($s)) {
 	die("oci_execute(select) failed!\n");
 }
 
-$row = oci_fetch_array($s, OCI_RETURN_NULLS + OCI_RETURN_LOBS);
+$row = oci_fetch_array($s, OCI_NUM + OCI_RETURN_NULLS + OCI_RETURN_LOBS);
 var_dump($row);
 
 foreach ($row as $num => $field) {

ext/oci8/tests/field_funcs1.phpt

@@ -34,7 +34,7 @@ if (!oci_execute($s)) {
 	die("oci_execute(select) failed!\n");
 }
 
-$row = oci_fetch_array($s, OCI_RETURN_NULLS + OCI_RETURN_LOBS);
+$row = oci_fetch_array($s, OCI_NUM + OCI_RETURN_NULLS + OCI_RETURN_LOBS);
 var_dump($row);
 
 var_dump(oci_field_is_null($s, -1));

ext/oci8/tests/lob_011.phpt

@@ -69,8 +69,10 @@ echo "Done\n";
 int(32)
 bool(true)
 string(32) "some string here. string, I said"
-array(1) {
+array(2) {
   [0]=>
   string(32) "some string here. string, I said"
+  ["BLOB"]=>
+  string(32) "some string here. string, I said"
 }
 Done

ext/oci8/tests/select_null.phpt

@@ -16,8 +16,10 @@ var_dump(oci_fetch_array($stmt, OCI_RETURN_NULLS));
 echo "Done\n";
 ?>
 --EXPECT--	
-array(1) {
+array(2) {
   [0]=>
   NULL
+  ["NULL"]=>
+  NULL
 }
 Done

ext/pdo/tests/pdo_014.phpt

@@ -3,7 +3,7 @@ PDO Common: PDOStatement SPL iterator
 --SKIPIF--
 <?php # vim:ft=php
 if (!extension_loaded('pdo')) die('skip');
-if (!extension_loaded('SPL')) print 'skip SPL not available';
+if (!extension_loaded('SPL')) die('skip SPL not available');
 if (!class_exists('IteratorIterator', false)) die('skip IteratorIterator class not present');
 $dir = getenv('REDIR_TEST_DIR');
 if (false == $dir) die('skip no driver');

ext/pdo/tests/pdo_031.phpt

@@ -3,7 +3,7 @@ PDO Common: PDOStatement SPL iterator
 --SKIPIF--
 <?php # vim:ft=php
 if (!extension_loaded('pdo')) die('skip');
-if (!extension_loaded('SPL')) print 'skip SPL not available';
+if (!extension_loaded('SPL')) die ('skip SPL not available');
 $dir = getenv('REDIR_TEST_DIR');
 if (false == $dir) die('skip no driver');
 require_once $dir . 'pdo_test.inc';

ext/session/tests/bug36459.phpt

@@ -2,14 +2,14 @@
 bug #31454 (Incorrect adding PHPSESSID to links, which contains \r\n)
 --SKIPIF--
 <?php include('skipif.inc'); ?>
+--INI--
+session.use_trans_sid=1
+session.use_cookies=0
+session.name=sid
 --FILE--
 <?php
 error_reporting(E_ALL);
 
-ini_set('session.use_trans_sid', 1);
-ini_set('session.use_cookies', 0);
-ini_set('session.name', 'sid');
-
 session_start();
 
 # Do not remove \r from this tests, they are essential!

ext/soap/soap.c

@@ -2671,7 +2671,7 @@ PHP_METHOD(SoapClient, __call)
 
 			if (zend_hash_find(ht, "uri", sizeof("uri"), (void**)&tmp) == SUCCESS &&
 			    Z_TYPE_PP(tmp) == IS_STRING) {
-				soap_action = Z_STRVAL_PP(tmp);
+				uri = Z_STRVAL_PP(tmp);
 			}
 		} else if (Z_TYPE_P(options) != IS_NULL) {
 			php_error_docref(NULL TSRMLS_CC, E_ERROR, "first parameter must be string or null");

ext/soap/tests/bugs/bug37278.phpt

@@ -0,0 +1,24 @@
+--TEST--
+Bug #37278 (SOAP not respecting uri in __soapCall)
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+$options = array(
+  "location" => "test://",
+  "uri"      => "http://bricolage.sourceforge.net/Bric/SOAP/Auth",
+  "trace"    => 1);
+
+$client = new SoapClient(null, $options);
+
+$newNS = "http://bricolage.sourceforge.net/Bric/SOAP/Story";
+
+try {
+  $client->__soapCall("list_ids", array(), array("uri" => $newNS));
+} catch (Exception $e) {
+  print $client->__getLastRequest();
+}
+?>
+--EXPECT--
+<?xml version="1.0" encoding="UTF-8"?>
+<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns1="http://bricolage.sourceforge.net/Bric/SOAP/Story" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><ns1:list_ids/></SOAP-ENV:Body></SOAP-ENV:Envelope>

ext/spl/spl_iterators.c

@@ -1253,7 +1253,7 @@ SPL_METHOD(ParentIterator, getChildren)
 } /* }}} */
 
 /* {{{ spl_dual_it_free_storage */
-static inline void spl_dual_it_free_storage(void *_object TSRMLS_DC)
+static void spl_dual_it_free_storage(void *_object TSRMLS_DC)
 {
 	spl_dual_it_object        *object = (spl_dual_it_object *)_object;
 
@@ -1641,7 +1641,7 @@ SPL_METHOD(CachingIterator, __toString)
 	}
 	if (intern->u.caching.flags & CIT_TOSTRING_USE_KEY) {
 		if (intern->current.key_type == HASH_KEY_IS_STRING) {
-			RETURN_STRINGL(intern->current.str_key, intern->current.str_key_len, 1);
+			RETURN_STRINGL(intern->current.str_key, intern->current.str_key_len-1, 1);
 		} else {
 			RETVAL_LONG(intern->current.int_key);
 			convert_to_string(return_value);
@@ -2063,11 +2063,20 @@ PHP_FUNCTION(iterator_to_array)
 	if (iter->funcs->rewind) {
 		iter->funcs->rewind(iter TSRMLS_CC);
 	}
+	if (EG(exception)) {
+		return;
+	}
 	while (iter->funcs->valid(iter TSRMLS_CC) == SUCCESS) {
 		iter->funcs->get_current_data(iter, &data TSRMLS_CC);
+		if (EG(exception)) {
+			return;
+		}
 		(*data)->refcount++;
 		if (iter->funcs->get_current_key) {
 			key_type = iter->funcs->get_current_key(iter, &str_key, &str_key_len, &int_key TSRMLS_CC);
+			if (EG(exception)) {
+				return;
+			}
 			switch(key_type) {
 				case HASH_KEY_IS_STRING:
 					add_assoc_zval_ex(return_value, str_key, str_key_len, *data);
@@ -2081,8 +2090,14 @@ PHP_FUNCTION(iterator_to_array)
 			add_next_index_zval(return_value, *data);
 		}
 		iter->funcs->move_forward(iter TSRMLS_CC);
+		if (EG(exception)) {
+			return;
+		}
 	}
 	iter->funcs->dtor(iter TSRMLS_CC);
+	if (EG(exception)) {
+		return;
+	}
 }
 /* }}} */
 
@@ -2103,11 +2118,23 @@ PHP_FUNCTION(iterator_count)
 	if (iter->funcs->rewind) {
 		iter->funcs->rewind(iter TSRMLS_CC);
 	}
+	if (EG(exception)) {
+		return;
+	}
 	while (iter->funcs->valid(iter TSRMLS_CC) == SUCCESS) {
+		if (EG(exception)) {
+			return;
+		}
 		count++;
 		iter->funcs->move_forward(iter TSRMLS_CC);
+		if (EG(exception)) {
+			return;
+		}
 	}
 	iter->funcs->dtor(iter TSRMLS_CC);
+	if (EG(exception)) {
+		return;
+	}
 	
 	RETURN_LONG(count);
 }

ext/standard/array.c

@@ -92,6 +92,8 @@
 
 #define DOUBLE_DRIFT_FIX	0.000000000000001
 
+ZEND_DECLARE_MODULE_GLOBALS(array)
+
 /* {{{ php_array_init_globals
  */
 static void php_array_init_globals(zend_array_globals *array_globals)

ext/standard/basic_functions.c

@@ -2034,7 +2034,7 @@ PHPAPI int _php_error_log(int opt_err, char *message, char *opt, char *headers T
 			break;
 
 		case 3:		/*save to a file */
-			stream = php_stream_open_wrapper(opt, "a", IGNORE_URL | ENFORCE_SAFE_MODE | REPORT_ERRORS, NULL);
+			stream = php_stream_open_wrapper(opt, "a", IGNORE_URL_WIN | ENFORCE_SAFE_MODE | REPORT_ERRORS, NULL);
 			if (!stream)
 				return FAILURE;
 			php_stream_write(stream, message, strlen(message));

ext/standard/filestat.c

@@ -634,7 +634,7 @@ PHPAPI void php_stat(const char *filename, php_stat_len filename_length, int typ
 	}
 
 	if ((wrapper = php_stream_locate_url_wrapper(filename, &local, 0 TSRMLS_CC)) == &php_plain_files_wrapper) {
-		if (php_check_open_basedir(local TSRMLS_CC)) {
+		if (php_check_open_basedir(local TSRMLS_CC) || (PG(safe_mode) && !php_checkuid_ex(filename, NULL, CHECKUID_ALLOW_FILE_NOT_EXISTS, CHECKUID_NO_ERRORS))) {
 			RETURN_FALSE;
 		}
 	}

ext/standard/php_array.h

@@ -108,8 +108,6 @@ ZEND_BEGIN_MODULE_GLOBALS(array)
 	int (*compare_func)(zval *result, zval *op1, zval *op2 TSRMLS_DC);
 ZEND_END_MODULE_GLOBALS(array) 
 
-ZEND_DECLARE_MODULE_GLOBALS(array)
-
 #ifdef ZTS
 #define ARRAYG(v) TSRMG(array_globals_id, zend_array_globals *, v)
 #else

ext/standard/scanf.c

@@ -732,7 +732,7 @@ PHPAPI int php_sscanf_internal(	char *string, char *format,
 			if (*end == '$') {
 				format = end+1;
 				ch = format++;
-				objIndex = varStart + value;
+				objIndex = varStart + value - 1;
 			}
 		}
 
@@ -762,7 +762,9 @@ PHPAPI int php_sscanf_internal(	char *string, char *format,
 		switch (*ch) {
 			case 'n':
 				if (!(flags & SCAN_SUPPRESS)) {
-					if (numVars) {
+					if (numVars && objIndex >= argCount) {
+						break;
+					} else if (numVars) {
 						zend_uint refcount;
 
 						current = args[objIndex++];
@@ -888,7 +890,9 @@ PHPAPI int php_sscanf_internal(	char *string, char *format,
 					}
 				}
 				if (!(flags & SCAN_SUPPRESS)) {
-					if (numVars) {
+					if (numVars && objIndex >= argCount) {
+						break;
+					} else if (numVars) {
 						zend_uint refcount;
 
 						current = args[objIndex++];
@@ -932,7 +936,9 @@ PHPAPI int php_sscanf_internal(	char *string, char *format,
 					goto done;
 				}
 				if (!(flags & SCAN_SUPPRESS)) {
-					if (numVars) {
+					if (numVars && objIndex >= argCount) {
+						break;
+					} else if (numVars) {
 						current = args[objIndex++];
 						zval_dtor( *current );
 						ZVAL_STRINGL( *current, string, end-string, 1);
@@ -1089,7 +1095,9 @@ PHPAPI int php_sscanf_internal(	char *string, char *format,
 					value = (int) (*fn)(buf, NULL, base);
 					if ((flags & SCAN_UNSIGNED) && (value < 0)) {
 						sprintf(buf, "%u", value); /* INTL: ISO digit */
-						if (numVars) {
+						if (numVars && objIndex >= argCount) {
+							break;
+						} else if (numVars) {
 						  /* change passed value type to string */
 						   current = args[objIndex++];
 						   convert_to_string( *current );
@@ -1098,7 +1106,9 @@ PHPAPI int php_sscanf_internal(	char *string, char *format,
 							add_index_string(*return_value, objIndex++, buf, 1);
 						}
 					} else {
-						if (numVars) {
+						if (numVars && objIndex >= argCount) {
+							break;
+						} else if (numVars) {
 							current = args[objIndex++];
 							convert_to_long( *current );
 							Z_LVAL(**current) = value;
@@ -1206,7 +1216,9 @@ PHPAPI int php_sscanf_internal(	char *string, char *format,
 					double dvalue;
 					*end = '\0';
 					dvalue = zend_strtod(buf, NULL);
-					if (numVars) {
+					if (numVars && objIndex >= argCount) {
+						break;
+					} else if (numVars) {
 						current = args[objIndex++];
 						convert_to_double( *current );
 						Z_DVAL_PP( current ) = dvalue;

ext/standard/string.c

@@ -632,7 +632,8 @@ PHP_FUNCTION(wordwrap)
 {
 	const char *text, *breakchar = "\n";
 	char *newtext;
-	int textlen, breakcharlen = 1, newtextlen, alloced, chk;
+	int textlen, breakcharlen = 1, newtextlen, chk;
+	size_t alloced;
 	long current = 0, laststart = 0, lastspace = 0;
 	long linelength = 75;
 	zend_bool docut = 0;
@@ -1612,10 +1613,18 @@ PHP_FUNCTION(stripos)
 		RETURN_FALSE;
 	}
 
+	if (haystack_len == 0) { 
+		RETURN_FALSE; 
+	}
+
 	haystack_dup = estrndup(haystack, haystack_len);
 	php_strtolower(haystack_dup, haystack_len);
 
 	if (Z_TYPE_P(needle) == IS_STRING) {
+		if (Z_STRLEN_P(needle) == 0 || Z_STRLEN_P(needle) > haystack_len) {
+			efree(haystack_dup); 
+			RETURN_FALSE; 
+		} 
 		needle_dup = estrndup(Z_STRVAL_P(needle), Z_STRLEN_P(needle));
 		php_strtolower(needle_dup, Z_STRLEN_P(needle));
 		found = php_memnstr(haystack_dup + offset, needle_dup, Z_STRLEN_P(needle), haystack_dup + haystack_len);
@@ -4194,7 +4203,7 @@ PHP_FUNCTION(str_repeat)
 	zval		**input_str;		/* Input string */
 	zval		**mult;			/* Multiplier */
 	char		*result;		/* Resulting string */
-	int		result_len;		/* Length of the resulting string */
+	size_t		result_len;		/* Length of the resulting string */
 	
 	if (ZEND_NUM_ARGS() != 2 || zend_get_parameters_ex(2, &input_str, &mult) == FAILURE) {
 		WRONG_PARAM_COUNT;
@@ -4219,11 +4228,7 @@ PHP_FUNCTION(str_repeat)
 	
 	/* Initialize the result string */	
 	result_len = Z_STRLEN_PP(input_str) * Z_LVAL_PP(mult);
-	if (result_len < 1 || result_len > 2147483647) {
-		php_error_docref(NULL TSRMLS_CC, E_WARNING, "You may not create strings longer than 2147483647 bytes");
-		RETURN_FALSE;
-	}
-	result = (char *)emalloc(result_len + 1);
+	result = (char *)safe_emalloc(Z_STRLEN_PP(input_str), Z_LVAL_PP(mult), 1);
 	
 	/* Heavy optimization for situations where input string is 1 byte long */
 	if (Z_STRLEN_PP(input_str) == 1) {
@@ -4894,7 +4899,7 @@ PHP_FUNCTION(substr_compare)
 		offset = (offset < 0) ? 0 : offset;
 	}
 
-	if ((offset + len) >= s1_len) {
+	if ((offset + len) > s1_len) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "The start position cannot exceed initial string length");
 		RETURN_FALSE;
 	}

ext/standard/tests/array/array_chunk2.phpt

@@ -0,0 +1,146 @@
+--TEST--
+basic array_chunk test
+--FILE--
+<?php
+$input_array = array('a', 'b', 'c', 'd', 'e');
+var_dump(array_chunk($input_array, 0));
+var_dump(array_chunk($input_array, 0, true));
+var_dump(array_chunk($input_array, 1));
+var_dump(array_chunk($input_array, 1, true));	
+var_dump(array_chunk($input_array, 2));
+var_dump(array_chunk($input_array, 2, true));	
+var_dump(array_chunk($input_array, 10));
+var_dump(array_chunk($input_array, 10, true));	
+?>
+--EXPECTF--
+Warning: array_chunk(): Size parameter expected to be greater than 0 in %s on line %d
+NULL
+
+Warning: array_chunk(): Size parameter expected to be greater than 0 in %s on line %d
+NULL
+array(5) {
+  [0]=>
+  array(1) {
+    [0]=>
+    string(1) "a"
+  }
+  [1]=>
+  array(1) {
+    [0]=>
+    string(1) "b"
+  }
+  [2]=>
+  array(1) {
+    [0]=>
+    string(1) "c"
+  }
+  [3]=>
+  array(1) {
+    [0]=>
+    string(1) "d"
+  }
+  [4]=>
+  array(1) {
+    [0]=>
+    string(1) "e"
+  }
+}
+array(5) {
+  [0]=>
+  array(1) {
+    [0]=>
+    string(1) "a"
+  }
+  [1]=>
+  array(1) {
+    [1]=>
+    string(1) "b"
+  }
+  [2]=>
+  array(1) {
+    [2]=>
+    string(1) "c"
+  }
+  [3]=>
+  array(1) {
+    [3]=>
+    string(1) "d"
+  }
+  [4]=>
+  array(1) {
+    [4]=>
+    string(1) "e"
+  }
+}
+array(3) {
+  [0]=>
+  array(2) {
+    [0]=>
+    string(1) "a"
+    [1]=>
+    string(1) "b"
+  }
+  [1]=>
+  array(2) {
+    [0]=>
+    string(1) "c"
+    [1]=>
+    string(1) "d"
+  }
+  [2]=>
+  array(1) {
+    [0]=>
+    string(1) "e"
+  }
+}
+array(3) {
+  [0]=>
+  array(2) {
+    [0]=>
+    string(1) "a"
+    [1]=>
+    string(1) "b"
+  }
+  [1]=>
+  array(2) {
+    [2]=>
+    string(1) "c"
+    [3]=>
+    string(1) "d"
+  }
+  [2]=>
+  array(1) {
+    [4]=>
+    string(1) "e"
+  }
+}
+array(1) {
+  [0]=>
+  array(5) {
+    [0]=>
+    string(1) "a"
+    [1]=>
+    string(1) "b"
+    [2]=>
+    string(1) "c"
+    [3]=>
+    string(1) "d"
+    [4]=>
+    string(1) "e"
+  }
+}
+array(1) {
+  [0]=>
+  array(5) {
+    [0]=>
+    string(1) "a"
+    [1]=>
+    string(1) "b"
+    [2]=>
+    string(1) "c"
+    [3]=>
+    string(1) "d"
+    [4]=>
+    string(1) "e"
+  }
+}

ext/standard/tests/array/array_combine.phpt

@@ -0,0 +1,122 @@
+--TEST--
+basic array_combine test
+--FILE--
+<?php
+	$array1 = array('green', 'red', 'yellow');
+	$array2 = array('1', '2', '3');
+	$array3 = array(0, 1, 2);
+	$array4 = array(TRUE, FALSE, NULL);
+	$a = array_combine($array1, $array1);
+	$b = array_combine($array1, $array2);
+	$c = array_combine($array1, $array3);
+	$d = array_combine($array1, $array4);
+	$e = array_combine($array2, $array1);
+	$f = array_combine($array2, $array2);
+	$g = array_combine($array2, $array3);
+	$h = array_combine($array2, $array4);
+	$i = array_combine($array3, $array1);
+	$j = array_combine($array3, $array2);
+	$k = array_combine($array3, $array3);
+	$l = array_combine($array3, $array4);
+	$m = array_combine($array4, $array1);
+	$n = array_combine($array4, $array2);
+	$o = array_combine($array4, $array3);
+	$p = array_combine($array4, $array4);
+	for($letter = "a"; $letter <= "p"; $letter++)
+	{
+	 print_r($$letter);
+	}
+?>
+--EXPECT--
+Array
+(
+    [green] => green
+    [red] => red
+    [yellow] => yellow
+)
+Array
+(
+    [green] => 1
+    [red] => 2
+    [yellow] => 3
+)
+Array
+(
+    [green] => 0
+    [red] => 1
+    [yellow] => 2
+)
+Array
+(
+    [green] => 1
+    [red] => 
+    [yellow] => 
+)
+Array
+(
+    [1] => green
+    [2] => red
+    [3] => yellow
+)
+Array
+(
+    [1] => 1
+    [2] => 2
+    [3] => 3
+)
+Array
+(
+    [1] => 0
+    [2] => 1
+    [3] => 2
+)
+Array
+(
+    [1] => 1
+    [2] => 
+    [3] => 
+)
+Array
+(
+    [0] => green
+    [1] => red
+    [2] => yellow
+)
+Array
+(
+    [0] => 1
+    [1] => 2
+    [2] => 3
+)
+Array
+(
+    [0] => 0
+    [1] => 1
+    [2] => 2
+)
+Array
+(
+    [0] => 1
+    [1] => 
+    [2] => 
+)
+Array
+(
+    [1] => green
+    [] => yellow
+)
+Array
+(
+    [1] => 1
+    [] => 3
+)
+Array
+(
+    [1] => 0
+    [] => 2
+)
+Array
+(
+    [1] => 1
+    [] => 
+)

ext/standard/tests/array/array_count_values2.phpt

@@ -0,0 +1,43 @@
+--TEST--
+basic array_count_values test
+--FILE--
+<?php
+$array1 = array(1, 
+				"hello", 
+				1, 
+				"world", 
+				"hello", 
+				"", 
+				"rabbit", 
+				"foo", 
+				"Foo", 
+				TRUE, 
+				FALSE, 
+				NULL, 
+				0);
+var_dump(array_count_values($array1));
+?>
+--EXPECTF--
+Warning: array_count_values(): Can only count STRING and INTEGER values! in %s on line %s
+
+Warning: array_count_values(): Can only count STRING and INTEGER values! in %s on line %s
+
+Warning: array_count_values(): Can only count STRING and INTEGER values! in %s on line %s
+array(8) {
+  [1]=>
+  int(2)
+  ["hello"]=>
+  int(2)
+  ["world"]=>
+  int(1)
+  [""]=>
+  int(1)
+  ["rabbit"]=>
+  int(1)
+  ["foo"]=>
+  int(1)
+  ["Foo"]=>
+  int(1)
+  [0]=>
+  int(1)
+}

ext/standard/tests/array/array_diff_assoc.phpt

@@ -0,0 +1,49 @@
+--TEST--
+basic array_diff_assoc test
+--FILE--	
+<?php
+$array1 = array("a" => "green", "b" => "brown", "c" => "blue", "red", "");
+$array2 = array("a" => "green", "yellow", "red", TRUE);
+$array3 = array("red", "a"=>"brown", "");
+$result[] = array_diff_assoc($array1, $array2);
+$result[] = array_diff_assoc($array1, $array3);
+$result[] = array_diff_assoc($array2, $array3);
+$result[] = array_diff_assoc($array1, $array2, $array3);
+print_r($result)
+?>
+--EXPECT--
+Array
+(
+    [0] => Array
+        (
+            [b] => brown
+            [c] => blue
+            [0] => red
+            [1] => 
+        )
+
+    [1] => Array
+        (
+            [a] => green
+            [b] => brown
+            [c] => blue
+        )
+
+    [2] => Array
+        (
+            [a] => green
+            [0] => yellow
+            [1] => red
+            [2] => 1
+        )
+
+    [3] => Array
+        (
+            [b] => brown
+            [c] => blue
+        )
+
+)
+
+
+

ext/standard/tests/array/array_diff_key2.phpt

@@ -0,0 +1,44 @@
+--TEST--
+basic array_diff_key test
+--FILE--
+<?php
+$array1 = array("a" => "green", "b" => "brown", "c" => "blue", "red", "");
+$array2 = array("a" => "green", "yellow", "red", TRUE);
+$array3 = array("red", "a"=>"brown", "");
+$result[] = array_diff_key($array1, $array2);
+$result[] = array_diff_key($array1, $array3);
+$result[] = array_diff_key($array2, $array3);
+$result[] = array_diff_key($array1, $array2, $array3);
+
+var_dump($result);
+
+?>
+--EXPECT--
+array(4) {
+  [0]=>
+  array(2) {
+    ["b"]=>
+    string(5) "brown"
+    ["c"]=>
+    string(4) "blue"
+  }
+  [1]=>
+  array(2) {
+    ["b"]=>
+    string(5) "brown"
+    ["c"]=>
+    string(4) "blue"
+  }
+  [2]=>
+  array(1) {
+    [2]=>
+    bool(true)
+  }
+  [3]=>
+  array(2) {
+    ["b"]=>
+    string(5) "brown"
+    ["c"]=>
+    string(4) "blue"
+  }
+}

ext/wddx/wddx.c

@@ -751,7 +751,7 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
 	} else if (!strcmp(name, EL_CHAR)) {
 		int i;
 		
-		for (i = 0; atts[i]; i++) {
+		if (atts) for (i = 0; atts[i]; i++) {
 			if (!strcmp(atts[i], EL_CHAR_CODE) && atts[++i] && atts[i][0]) {
 				char tmp_buf[2];
 
@@ -771,7 +771,7 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
 	} else if (!strcmp(name, EL_BOOLEAN)) {
 		int i;
 
-		for (i = 0; atts[i]; i++) {
+		if (atts) for (i = 0; atts[i]; i++) {
 			if (!strcmp(atts[i], EL_VALUE) && atts[++i] && atts[i][0]) {
 				ent.type = ST_BOOLEAN;
 				SET_STACK_VARNAME;
@@ -812,7 +812,7 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
 	} else if (!strcmp(name, EL_VAR)) {
 		int i;
 		
-		for (i = 0; atts[i]; i++) {
+		if (atts) for (i = 0; atts[i]; i++) {
 			if (!strcmp(atts[i], EL_NAME) && atts[++i] && atts[i][0]) {
 				char *decoded;
 				int decoded_len;
@@ -829,7 +829,7 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
 		MAKE_STD_ZVAL(ent.data);
 		array_init(ent.data);
 
-		for (i = 0; atts[i]; i++) {
+		if (atts) for (i = 0; atts[i]; i++) {
 			if (!strcmp(atts[i], "fieldNames") && atts[++i] && atts[i][0]) {
 				zval *tmp;
 				char *key;
@@ -869,7 +869,7 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
 		ent.varname = NULL;
 		ent.data = NULL;
 
-		for (i = 0; atts[i]; i++) {
+		if (atts) for (i = 0; atts[i]; i++) {
 			if (!strcmp(atts[i], EL_NAME) && atts[++i] && atts[i][0]) {
 				char *decoded;
 				int decoded_len;

ext/xmlrpc/tests/bug38431.phpt

@@ -0,0 +1,25 @@
+--TEST--
+Bug #38431 (xmlrpc_get_type() crashes PHP on objects)
+--SKIPIF--
+<?php if (!extension_loaded("xmlrpc")) print "skip"; ?>
+--FILE--
+<?php
+
+var_dump(xmlrpc_get_type(new stdclass));
+var_dump(xmlrpc_get_type(array()));
+$var = array(1,2,3);
+var_dump(xmlrpc_get_type($var));
+$var = array("test"=>1,2,3);
+var_dump(xmlrpc_get_type($var));
+$var = array("test"=>1,"test2"=>2);
+var_dump(xmlrpc_get_type($var));
+
+echo "Done\n";
+?>
+--EXPECTF--	
+string(5) "array"
+string(5) "array"
+string(5) "array"
+string(5) "mixed"
+string(6) "struct"
+Done

ext/xsl/xsltprocessor.c

@@ -231,8 +231,7 @@ static void xsl_ext_function_php(xmlXPathParserContextPtr ctxt, int nargs, int t
 				}
 				break;
 			default:
-			php_error_docref(NULL TSRMLS_CC, E_WARNING, "php:function object type %d is not supported yet", obj->type);
-			ZVAL_STRING(args[i], "", 0);
+			ZVAL_STRING(args[i], xmlXPathCastToString(obj), 1);
 		}
 		xmlXPathFreeObject(obj);
 		fci.params[i] = &args[i];

main/config.w32.h

@@ -72,9 +72,13 @@
 #define HAVE_DOM 1
 #define HAVE_SIMPLEXML 1
 #define HAVE_XML 1
+#define HAVE_XMLREADER 1
+#define HAVE_XMLWRITER 1
+#define HAVE_LIBXML_PARSER_H 1
 
 /* Enable / Disable ZLIB extension (default: enabled) */
 #define HAVE_ZLIB 1
+#define HAVE_ZLIB_H 1
 
 /* Enable / Disable SQLite extension (default: enabled) */
 #define HAVE_SQLITE 1
@@ -190,7 +194,6 @@
 #define HAVE_SQLDATASOURCES
 #define POSIX_MALLOC_THRESHOLD 10
 
-
 /*
  * defining HAVE_SOCKLEN_T prevents PHP from building with the latest platform SDK...
  * #define HAVE_SOCKLEN_T
@@ -203,3 +206,44 @@
 #define PHP_CAN_SUPPORT_PROC_OPEN 1
 
 #define HAVE_MBLEN
+
+#undef HAVE_ATOF_ACCEPTS_NAN
+#undef HAVE_ATOF_ACCEPTS_INF
+#define HAVE_HUGE_VAL_NAN 1
+
+/* vs.net 2005 has a 64-bit time_t.  This will likely break
+ * 3rdParty libs that were built with older compilers; switch
+ * back to 32-bit */
+#define _USE_32BIT_TIME_T 1
+#define HAVE_STDLIB_H 1
+/* have the arpa\nameser.h header file */
+#define HAVE_ARPA_NAMESER_H 1
+
+/* undefined */
+#define PHP_FASTCGI 1
+
+/* Have COM_DOTNET support */
+#define HAVE_COM_DOTNET 1
+
+/* Have date/time support */
+#define HAVE_DATE 1
+
+/* GD support */
+#define HAVE_LIBGD 1
+/* undefined */
+#define HAVE_HASH_EXT 1
+
+/* Define if iconv extension is enabled */
+#define HAVE_ICONV 1
+
+/* Define if libiconv is available */
+#define HAVE_LIBICONV 1
+
+/* Which iconv implementation to use */
+#define PHP_ICONV_IMPL "\"libiconv\""
+
+/* Whether iconv supports errno or not */
+#define ICONV_SUPPORTS_ERRNO 1
+
+/* SPL support */
+#define HAVE_SPL 1

main/internal_functions_win32.c

@@ -48,6 +48,7 @@
 #include "ext/standard/php_lcg.h"
 #include "ext/standard/php_array.h"
 #include "ext/standard/php_assert.h"
+#include "ext/reflection/php_reflection.h"
 #if HAVE_BCMATH
 #include "ext/bcmath/php_bcmath.h"
 #endif
@@ -57,9 +58,15 @@
 #if HAVE_CTYPE
 #include "ext/ctype/php_ctype.h"
 #endif
+#if HAVE_DATE
+#include "ext/date/php_date.h"
+#endif
 #if HAVE_FTP
 #include "ext/ftp/php_ftp.h"
 #endif
+#if HAVE_ICONV
+#include "ext/iconv/php_iconv.h"
+#endif
 #include "ext/standard/reg.h"
 #if HAVE_PCRE || HAVE_BUNDLED_PCRE
 #include "ext/pcre/php_pcre.h"
@@ -98,6 +105,15 @@
 #include "ext/sqlite/php_sqlite.h"
 #endif
 #include "ext/com_dotnet/php_com_dotnet.h"
+#ifdef HAVE_SPL
+#include "ext/spl/php_spl.h"
+#endif
+#if HAVE_XML && HAVE_XMLREADER
+#include "ext/xmlreader/php_xmlreader.h"
+#endif
+#if HAVE_XML && HAVE_XMLWRITER
+#include "ext/xmlwriter/php_xmlwriter.h"
+#endif
 /* }}} */
 
 /* {{{ php_builtin_extensions[]
@@ -114,9 +130,18 @@ zend_module_entry *php_builtin_extensions[] = {
 #if HAVE_CTYPE
 	,phpext_ctype_ptr
 #endif
+#if HAVE_DATE
+	,phpext_date_ptr
+#endif
 #if HAVE_FTP
 	,phpext_ftp_ptr
 #endif
+#if HAVE_HASH
+	,phpext_hash_ptr
+#endif
+#if HAVE_ICONV
+	,phpext_iconv_ptr
+#endif
 #if HAVE_MBSTRING
 	,phpext_mbstring_ptr
 #endif
@@ -126,6 +151,7 @@ zend_module_entry *php_builtin_extensions[] = {
 #if HAVE_PCRE || HAVE_BUNDLED_PCRE
 	,phpext_pcre_ptr
 #endif
+	,phpext_reflection_ptr
 #if HAVE_PHP_SESSION
 	,phpext_session_ptr
 #endif
@@ -153,6 +179,15 @@ zend_module_entry *php_builtin_extensions[] = {
 #if HAVE_SQLITE
 	,phpext_sqlite_ptr
 #endif
+#if HAVE_SPL
+	,phpext_spl_ptr
+#endif
+#if HAVE_XML && HAVE_XMLREADER
+	,phpext_xmlreader_ptr
+#endif
+#if HAVE_XML && HAVE_XMLWRITER
+	,phpext_xmlwriter_ptr
+#endif
 };
 /* }}} */
 

main/main.c

@@ -1091,6 +1091,11 @@ int php_request_startup(TSRMLS_D)
 			zend_set_timeout(PG(max_input_time));
 		}
 
+		/* Disable realpath cache if safe_mode or open_basedir are set */
+		if (PG(safe_mode) || (PG(open_basedir) && *PG(open_basedir))) {
+			CWDG(realpath_cache_size_limit) = 0;
+		}
+
 		if (PG(expose_php)) {
 			sapi_add_header(SAPI_PHP_VERSION_HEADER, sizeof(SAPI_PHP_VERSION_HEADER)-1, 1);
 		}
@@ -1723,11 +1728,11 @@ PHPAPI int php_execute_script(zend_file_handle *primary_file TSRMLS_DC)
 		} else {
 			append_file_p = NULL;
 		}
-		if (PG(max_input_time) == -1) {
+		if (PG(max_input_time) != -1) {
 #ifdef PHP_WIN32
 			zend_unset_timeout(TSRMLS_C);
 #endif
-			zend_set_timeout(EG(timeout_seconds));
+			zend_set_timeout(INI_INT("max_execution_time"));
 		}
 		retval = (zend_execute_scripts(ZEND_REQUIRE TSRMLS_CC, NULL, 3, prepend_file_p, primary_file, append_file_p) == SUCCESS);
 		

main/php_open_temporary_file.c

@@ -114,17 +114,16 @@ static int php_do_open_temporary_file(const char *path, const char *pfx, char **
 
 	path_len = strlen(path);
 
-	if (!(opened_path = emalloc(MAXPATHLEN))) {
-		return -1;
-	}
-
 	if (!path_len || IS_SLASH(path[path_len - 1])) {
 		trailing_slash = "";
 	} else {
 		trailing_slash = "/";
 	}
 
-	(void)snprintf(opened_path, MAXPATHLEN, "%s%s%sXXXXXX", path, trailing_slash, pfx);
+	if (spprintf(&opened_path, 0, "%s%s%sXXXXXX", path, trailing_slash, pfx) >= MAXPATHLEN) {
+		efree(opened_path);
+		return -1;
+	}
 
 #ifdef PHP_WIN32
 	if (GetTempFileName(path, pfx, 0, opened_path)) {

main/php_version.h

@@ -3,5 +3,5 @@
 #define PHP_MAJOR_VERSION 5
 #define PHP_MINOR_VERSION 1
 #define PHP_RELEASE_VERSION 5
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "5.1.5-dev"
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "5.1.5"

main/streams/filter.c

@@ -251,7 +251,7 @@ PHPAPI void php_stream_bucket_unlink(php_stream_bucket *bucket TSRMLS_DC)
 PHPAPI php_stream_filter *php_stream_filter_create(const char *filtername, zval *filterparams, int persistent TSRMLS_DC)
 {
 	HashTable *filter_hash = (FG(stream_filters) ? FG(stream_filters) : &stream_filters_hash);
-	php_stream_filter_factory *factory;
+	php_stream_filter_factory *factory = NULL;
 	php_stream_filter *filter = NULL;
 	int n;
 	char *period;

makedist

@@ -122,6 +122,15 @@ for i in $LT_TARGETS; do
   test -f "$i" && mv $i.bak $i
 done
 
+# download pear 
+$ECHO_N "makedist: Attempting to download PEAR's phar archive"
+if test ! -x wget; then
+	wget http://pear.php.net/install-pear-nozlib.phar -nd -P pear/
+else
+	$ECHO_N "Missing wget binary needed for pear download";
+	exit 0;
+fi
+
 cd $MY_OLDPWD
 $ECHO_N "makedist: making gzipped tar archive...$ECHO_C"
 rm -f $ARCHIVE.gz

php.ini-dist

@@ -1148,6 +1148,7 @@ pfpro.defaulttimeout = 30
 [FrontBase]
 ;fbsql.allow_persistent = On
 ;fbsql.autocommit = On
+;fbsql.show_timestamp_decimals = Off
 ;fbsql.default_database =
 ;fbsql.default_database_password =
 ;fbsql.default_host =

php.ini-recommended

@@ -1206,6 +1206,7 @@ pfpro.defaulttimeout = 30
 [FrontBase]
 ;fbsql.allow_persistent = On
 ;fbsql.autocommit = On
+;fbsql.show_timestamp_decimals = Off
 ;fbsql.default_database =
 ;fbsql.default_database_password =
 ;fbsql.default_host =

sapi/apache/mod_php5.c

@@ -127,7 +127,7 @@ static void sapi_apache_flush(void *server_context)
  */
 static int sapi_apache_read_post(char *buffer, uint count_bytes TSRMLS_DC)
 {
-	uint total_read_bytes=0, read_bytes;
+	int total_read_bytes=0, read_bytes;
 	request_rec *r = (request_rec *) SG(server_context);
 	void (*handler)(int);
 

sapi/apache2filter/apache_config.c

@@ -128,28 +128,31 @@ static const char *php_apache_phpini_set(cmd_parms *cmd, void *mconfig,
 
 void *merge_php_config(apr_pool_t *p, void *base_conf, void *new_conf)
 {
-	php_conf_rec *d = base_conf, *e = new_conf;
+	php_conf_rec *d = base_conf, *e = new_conf, *n = NULL;
 	php_dir_entry *pe;
 	php_dir_entry *data;
 	char *str;
 	uint str_len;
 	ulong num_index;
 
-	phpapdebug((stderr, "Merge dir (%p) (%p)\n", base_conf, new_conf));
+	n = create_php_config(p, "merge_php_config");
+	zend_hash_copy(&n->config, &e->config, NULL, NULL, sizeof(php_dir_entry));
+
+	phpapdebug((stderr, "Merge dir (%p)+(%p)=(%p)\n", base_conf, new_conf, n));
 	for (zend_hash_internal_pointer_reset(&d->config);
 			zend_hash_get_current_key_ex(&d->config, &str, &str_len, 
 				&num_index, 0, NULL) == HASH_KEY_IS_STRING;
 			zend_hash_move_forward(&d->config)) {
 		pe = NULL;
 		zend_hash_get_current_data(&d->config, (void **) &data);
-		if (zend_hash_find(&e->config, str, str_len, (void **) &pe) == SUCCESS) {
+		if (zend_hash_find(&n->config, str, str_len, (void **) &pe) == SUCCESS) {
 			if (pe->status >= data->status) continue;
 		}
-		zend_hash_update(&e->config, str, str_len, data, sizeof(*data), NULL);
-		phpapdebug((stderr, "ADDING/OVERWRITING %s (%d vs. %d)\n", str, 
-					data->status, pe?pe->status:-1));
+		zend_hash_update(&n->config, str, str_len, data, sizeof(*data), NULL);
+		phpapdebug((stderr, "ADDING/OVERWRITING %s (%d vs. %d)\n", str, data->status, pe?pe->status:-1));
 	}
-	return new_conf;
+
+	return n;
 }
 
 char *get_php_config(void *conf, char *name, size_t name_len)

sapi/apache2handler/apache_config.c

@@ -118,27 +118,31 @@ static const char *php_apache_phpini_set(cmd_parms *cmd, void *mconfig, const ch
 
 void *merge_php_config(apr_pool_t *p, void *base_conf, void *new_conf)
 {
-	php_conf_rec *d = base_conf, *e = new_conf;
+	php_conf_rec *d = base_conf, *e = new_conf, *n = NULL;
 	php_dir_entry *pe;
 	php_dir_entry *data;
 	char *str;
 	uint str_len;
 	ulong num_index;
 
-	phpapdebug((stderr, "Merge dir (%p) (%p)\n", base_conf, new_conf));
+	n = create_php_config(p, "merge_php_config");
+	zend_hash_copy(&n->config, &e->config, NULL, NULL, sizeof(php_dir_entry));
+
+	phpapdebug((stderr, "Merge dir (%p)+(%p)=(%p)\n", base_conf, new_conf, n));
 	for (zend_hash_internal_pointer_reset(&d->config);
 			zend_hash_get_current_key_ex(&d->config, &str, &str_len, 
 				&num_index, 0, NULL) == HASH_KEY_IS_STRING;
 			zend_hash_move_forward(&d->config)) {
 		pe = NULL;
 		zend_hash_get_current_data(&d->config, (void **) &data);
-		if (zend_hash_find(&e->config, str, str_len, (void **) &pe) == SUCCESS) {
+		if (zend_hash_find(&n->config, str, str_len, (void **) &pe) == SUCCESS) {
 			if (pe->status >= data->status) continue;
 		}
-		zend_hash_update(&e->config, str, str_len, data, sizeof(*data), NULL);
+		zend_hash_update(&n->config, str, str_len, data, sizeof(*data), NULL);
 		phpapdebug((stderr, "ADDING/OVERWRITING %s (%d vs. %d)\n", str, data->status, pe?pe->status:-1));
 	}
-	return new_conf;
+
+	return n;
 }
 
 char *get_php_config(void *conf, char *name, size_t name_len)

sapi/apache2handler/sapi_apache2.c

@@ -459,12 +459,12 @@ static void php_apache_ini_dtor(request_rec *r, request_rec *p TSRMLS_DC)
 
 static int php_handler(request_rec *r)
 {
-	php_struct *ctx;
+	php_struct * volatile ctx;
 	void *conf;
-	apr_bucket_brigade *brigade;
+	apr_bucket_brigade * volatile brigade;
 	apr_bucket *bucket;
 	apr_status_t rv;
-	request_rec *parent_req = NULL;
+	request_rec * volatile parent_req = NULL;
 	TSRMLS_FETCH();
 
 #define PHPAP_INI_OFF php_apache_ini_dtor(r, parent_req TSRMLS_CC);

sapi/cgi/cgi_main.c

@@ -432,14 +432,18 @@ static char *sapi_cgi_read_cookies(TSRMLS_D)
 void cgi_php_import_environment_variables(zval *array_ptr TSRMLS_DC)
 {
 	if (PG(http_globals)[TRACK_VARS_ENV] &&
-	    array_ptr != PG(http_globals)[TRACK_VARS_ENV]) {
+	    array_ptr != PG(http_globals)[TRACK_VARS_ENV] &&
+	    Z_TYPE_P(PG(http_globals)[TRACK_VARS_ENV]) == IS_ARRAY &&
+	    zend_hash_num_elements(Z_ARRVAL_P(PG(http_globals)[TRACK_VARS_ENV])) > 0) {
 	    zval_dtor(array_ptr);
 	    *array_ptr = *PG(http_globals)[TRACK_VARS_ENV];
 	    INIT_PZVAL(array_ptr);
 	    zval_copy_ctor(array_ptr);
 	    return;
 	} else if (PG(http_globals)[TRACK_VARS_SERVER] &&
-		array_ptr != PG(http_globals)[TRACK_VARS_SERVER]) {
+		array_ptr != PG(http_globals)[TRACK_VARS_SERVER] &&
+	    Z_TYPE_P(PG(http_globals)[TRACK_VARS_SERVER]) == IS_ARRAY &&
+	    zend_hash_num_elements(Z_ARRVAL_P(PG(http_globals)[TRACK_VARS_SERVER])) > 0) {
 	    zval_dtor(array_ptr);
 	    *array_ptr = *PG(http_globals)[TRACK_VARS_SERVER];
 	    INIT_PZVAL(array_ptr);

sapi/cgi/fastcgi.c

@@ -401,7 +401,7 @@ static int fcgi_get_params(fcgi_request *req, unsigned char *p, unsigned char *e
 	int name_len, val_len;
 	char *s;
 
-	while (p < end) {
+	while (p < end && n < FCGI_MAX_ENV_VARS - 1) {
 		name_len = *p++;
 		if (name_len >= 128) {
 			name_len = ((name_len & 0x7f) << 24);
@@ -424,10 +424,6 @@ static int fcgi_get_params(fcgi_request *req, unsigned char *p, unsigned char *e
 		p += val_len;
 		s[name_len+1+val_len] = '\0';
 		n++;
-		if (n > sizeof(req->env)/sizeof(req->env[0])) {
-			/* TODO: to many environment variables */
-			return n;
-		}
 	}
 	return n;
 }
@@ -669,12 +665,14 @@ int fcgi_accept_request(fcgi_request *req)
 				}
 				FCGI_UNLOCK(req->listen_socket);
 #else
+				{
 				sa_t sa;
 				socklen_t len = sizeof(sa);
 
 				FCGI_LOCK(req->listen_socket);
 				req->fd = accept(req->listen_socket, (struct sockaddr *)&sa, &len);
 				FCGI_UNLOCK(req->listen_socket);
+				}
 #endif
 
 				if (req->fd < 0 && (in_shutdown || errno != EINTR)) {
@@ -769,15 +767,17 @@ int fcgi_write(fcgi_request *req, fcgi_request_type type, const char *str, int l
 	if (req->out_hdr && req->out_hdr->type != type) {
 		close_packet(req);
 	}
-	rest = len;
 #if 0
-	/* Unoptinmzed, but clear version */
+	/* Unoptimized, but clear version */
+	rest = len;
 	while (rest > 0) {
 		limit = sizeof(req->out_buf) - (req->out_pos - req->out_buf);
 
 		if (!req->out_hdr) {
 			if (limit < sizeof(fcgi_header)) {
-				fcgi_flush(req, 0);
+				if (!fcgi_flush(req, 0)) {
+					return -1;
+				}	
 			}
 			open_packet(req, type);
 		}
@@ -791,32 +791,41 @@ int fcgi_write(fcgi_request *req, fcgi_request_type type, const char *str, int l
 			req->out_pos += limit;
 			rest -= limit;
 			str += limit;
-			fcgi_flush(req, 0);
+			if (!fcgi_flush(req, 0)) {
+				return -1;
+			}
 		}
 	}
 #else
-	/* Optinmzed version */
-	if (!req->out_hdr) {
-		rest += sizeof(fcgi_header);
-	}
+	/* Optimized version */
 	limit = sizeof(req->out_buf) - (req->out_pos - req->out_buf);
+	if (!req->out_hdr) {
+		limit -= sizeof(fcgi_header);
+		if (limit < 0) limit = 0;
+	}
 
-	if (rest < limit) {
+	if (len < limit) {
 		if (!req->out_hdr) {
 			open_packet(req, type);
 		}
 		memcpy(req->out_pos, str, len);
 		req->out_pos += len;
-	} else if (rest - limit < sizeof(req->out_buf) - sizeof(fcgi_header)) {
+	} else if (len - limit < sizeof(req->out_buf) - sizeof(fcgi_header)) {
 		if (!req->out_hdr) {
 			open_packet(req, type);
 		}
-		memcpy(req->out_pos, str, limit);
-		req->out_pos += limit;
-		fcgi_flush(req, 0);
-		open_packet(req, type);
-		memcpy(req->out_pos, str + limit, len - limit);
-		req->out_pos += len - limit;
+		if (limit > 0) {
+			memcpy(req->out_pos, str, limit);
+			req->out_pos += limit;
+		}
+		if (!fcgi_flush(req, 0)) {
+			return -1;
+		}
+		if (len > limit) {
+			open_packet(req, type);
+			memcpy(req->out_pos, str + limit, len - limit);
+			req->out_pos += len - limit;
+		}
 	} else {
 		int pos = 0;
 		int pad;
@@ -826,7 +835,9 @@ int fcgi_write(fcgi_request *req, fcgi_request_type type, const char *str, int l
 			open_packet(req, type);
 			fcgi_make_header(req->out_hdr, type, req->id, 0xfff8);
 			req->out_hdr = NULL;
-			fcgi_flush(req, 0);
+			if (!fcgi_flush(req, 0)) {
+				return -1;
+			}
 			if (safe_write(req, str + pos, 0xfff8) != 0xfff8) {
 				req->keep = 0;
 				return -1;
@@ -840,7 +851,9 @@ int fcgi_write(fcgi_request *req, fcgi_request_type type, const char *str, int l
 		open_packet(req, type);
 		fcgi_make_header(req->out_hdr, type, req->id, (len - pos) - rest);
 		req->out_hdr = NULL;
-		fcgi_flush(req, 0);
+		if (!fcgi_flush(req, 0)) {
+			return -1;
+		}
 		if (safe_write(req, str + pos, (len - pos) - rest) != (len - pos) - rest) {
 			req->keep = 0;
 			return -1;
@@ -900,7 +913,9 @@ void fcgi_putenv(fcgi_request *req, char* var, int var_len)
 			}
 			env++;
 		}
-		*env = fcgi_strndup(var, var_len);
+		if (env != &req->env[FCGI_MAX_ENV_VARS - 1]) {
+			*env = fcgi_strndup(var, var_len);
+		}
 	}
 }
 

sapi/cgi/fastcgi.h

@@ -26,6 +26,8 @@
 
 #define FCGI_KEEP_CONN  1
 
+#define FCGI_MAX_ENV_VARS 256
+
 typedef enum _fcgi_role {
 	FCGI_RESPONDER	= 1,
 	FCGI_AUTHORIZER	= 2,
@@ -105,7 +107,7 @@ typedef struct _fcgi_request {
 	unsigned char  out_buf[1024*8];
 	unsigned char  reserved[sizeof(fcgi_end_request_rec)];
 
-	char          *env[128];
+	char          *env[FCGI_MAX_ENV_VARS];
 } fcgi_request;
 
 int fcgi_init(void);
@@ -160,7 +162,7 @@ typedef struct _FCGX_Request {
 
 #define FCGX_PutStr(str, len, stream)		fcgi_write((stream).req, (stream).type, str, len)
 #define FCGX_PutS(str, len, stream)			fcgi_write((stream).req, (stream).type, str, len)
-#define FCGX_FFlush(stream)                 fcgi_flush((stream).req, 0)
+#define FCGX_FFlush(stream)                 (fcgi_flush((stream).req, 0)?0:-1)
 #define FCGX_GetStr(str, len, stream)       fcgi_read((stream).req, str, len)
 
 #define FCGX_GetParam(var, envp)			fcgi_getenv_helper(envp, var, strlen(var));

sapi/cli/php_cli.c

@@ -708,6 +708,7 @@ int main(int argc, char *argv[])
 		INI_HARDCODED("implicit_flush", "1");
 		INI_HARDCODED("output_buffering", "0");
 		INI_HARDCODED("max_execution_time", "0");
+		INI_HARDCODED("max_input_time", "-1");
 
 		while ((c = php_getopt(argc, argv, OPTIONS, &php_optarg, &php_optind, 0)) != -1) {
 			switch (c) {

tests/basic/021.phpt

@@ -1,7 +1,7 @@
 --TEST--
 Bug #37276 (problems witch $_POST array)
 --SKIPIF--
-<?php if (php_sapi_name()=='cli') echo 'skip'; ?>
+<?php if (php_sapi_name()=='cli') die('skip'); ?>
 --POST_RAW--
 Content-Type: multipart/form-data; boundary=---------------------------20896060251896012921717172737
 -----------------------------20896060251896012921717172737
@@ -29,7 +29,7 @@ array(1) {
     ["type"]=>
     string(10) "text/plain"
     ["tmp_name"]=>
-    string(14) "%s"
+    string(%d) "%s"
     ["error"]=>
     int(0)
     ["size"]=>

win32/php5dllts.dsp

@@ -213,6 +213,10 @@ SOURCE=..\main\php_scandir.c
 # End Source File
 # Begin Source File
 
+SOURCE=..\main\php_sprintf.c
+# End Source File
+# Begin Source File
+
 SOURCE=..\main\php_ticks.c
 # End Source File
 # Begin Source File
@@ -388,28 +392,83 @@ SOURCE=..\main\win95nt.h
 # PROP Default_Filter ".c"
 # Begin Source File
 
-SOURCE=..\ext\pcre\pcrelib\chartables.c
-# ADD CPP /D "STATIC" /D "SUPPORT_UTF8"
+SOURCE=..\ext\pcre\pcrelib\pcre_chartables.c
+# ADD CPP /D "SUPPORT_UTF8" /D LINK_SIZE=2 /D MATCH_LIMIT=10000000 /D MATCH_LIMIT_RECURSION=10000000 /D NEWLINE=10 /D "SUPPORT_UCP"
 # End Source File
 # Begin Source File
 
-SOURCE=..\ext\pcre\pcrelib\get.c
-# ADD CPP /D "STATIC" /D "SUPPORT_UTF8" /D LINK_SIZE=2
+SOURCE=..\ext\pcre\pcrelib\pcre_compile.c
+# ADD CPP /D "SUPPORT_UTF8" /D LINK_SIZE=2 /D MATCH_LIMIT=10000000 /D MATCH_LIMIT_RECURSION=10000000 /D NEWLINE=10 /D "SUPPORT_UCP"
 # End Source File
 # Begin Source File
 
-SOURCE=..\ext\pcre\pcrelib\maketables.c
-# ADD CPP /D "STATIC" /D "SUPPORT_UTF8" /D LINK_SIZE=2
+SOURCE=..\ext\pcre\pcrelib\pcre_exec.c
+# ADD CPP /D "SUPPORT_UTF8" /D LINK_SIZE=2 /D MATCH_LIMIT=10000000 /D MATCH_LIMIT_RECURSION=10000000 /D NEWLINE=10 /D "SUPPORT_UCP"
 # End Source File
 # Begin Source File
 
-SOURCE=..\ext\pcre\pcrelib\pcre.c
-# ADD CPP /D "STATIC" /D "SUPPORT_UTF8" /D LINK_SIZE=2
+SOURCE=..\ext\pcre\pcrelib\pcre_fullinfo.c
+# ADD CPP /D "SUPPORT_UTF8" /D LINK_SIZE=2 /D MATCH_LIMIT=10000000 /D MATCH_LIMIT_RECURSION=10000000 /D NEWLINE=10 /D "SUPPORT_UCP"
 # End Source File
 # Begin Source File
 
-SOURCE=..\ext\pcre\pcrelib\study.c
-# ADD CPP /D "STATIC" /D "SUPPORT_UTF8" /D LINK_SIZE=2
+SOURCE=..\ext\pcre\pcrelib\pcre_get.c
+# ADD CPP /D "SUPPORT_UTF8" /D LINK_SIZE=2 /D MATCH_LIMIT=10000000 /D MATCH_LIMIT_RECURSION=10000000 /D NEWLINE=10 /D "SUPPORT_UCP"
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\pcre\pcrelib\pcre_globals.c
+# ADD CPP /D "SUPPORT_UTF8" /D LINK_SIZE=2 /D MATCH_LIMIT=10000000 /D MATCH_LIMIT_RECURSION=10000000 /D NEWLINE=10 /D "SUPPORT_UCP"
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\pcre\pcrelib\pcre_info.c
+# ADD CPP /D "SUPPORT_UTF8" /D LINK_SIZE=2 /D MATCH_LIMIT=10000000 /D MATCH_LIMIT_RECURSION=10000000 /D NEWLINE=10 /D "SUPPORT_UCP"
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\pcre\pcrelib\pcre_maketables.c
+# ADD CPP /D "SUPPORT_UTF8" /D LINK_SIZE=2 /D MATCH_LIMIT=10000000 /D MATCH_LIMIT_RECURSION=10000000 /D NEWLINE=10 /D "SUPPORT_UCP"
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\pcre\pcrelib\pcre_ord2utf8.c
+# ADD CPP /D "SUPPORT_UTF8" /D LINK_SIZE=2 /D MATCH_LIMIT=10000000 /D MATCH_LIMIT_RECURSION=10000000 /D NEWLINE=10 /D "SUPPORT_UCP"
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\pcre\pcrelib\pcre_study.c
+# ADD CPP /D "SUPPORT_UTF8" /D LINK_SIZE=2 /D MATCH_LIMIT=10000000 /D MATCH_LIMIT_RECURSION=10000000 /D NEWLINE=10 /D "SUPPORT_UCP"
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\pcre\pcrelib\pcre_tables.c
+# ADD CPP /D "SUPPORT_UTF8" /D LINK_SIZE=2 /D MATCH_LIMIT=10000000 /D MATCH_LIMIT_RECURSION=10000000 /D NEWLINE=10 /D "SUPPORT_UCP"
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\pcre\pcrelib\pcre_try_flipped.c
+# ADD CPP /D "SUPPORT_UTF8" /D LINK_SIZE=2 /D MATCH_LIMIT=10000000 /D MATCH_LIMIT_RECURSION=10000000 /D NEWLINE=10 /D "SUPPORT_UCP"
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\pcre\pcrelib\pcre_ucp_searchfuncs.c
+# ADD CPP /D "SUPPORT_UTF8" /D LINK_SIZE=2 /D MATCH_LIMIT=10000000 /D MATCH_LIMIT_RECURSION=10000000 /D NEWLINE=10 /D "SUPPORT_UCP"
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\pcre\pcrelib\pcre_valid_utf8.c
+# ADD CPP /D "SUPPORT_UTF8" /D LINK_SIZE=2 /D MATCH_LIMIT=10000000 /D MATCH_LIMIT_RECURSION=10000000 /D NEWLINE=10 /D "SUPPORT_UCP"
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\pcre\pcrelib\pcre_version.c
+# ADD CPP /D "SUPPORT_UTF8" /D LINK_SIZE=2 /D MATCH_LIMIT=10000000 /D MATCH_LIMIT_RECURSION=10000000 /D NEWLINE=10 /D "SUPPORT_UCP"
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\pcre\pcrelib\pcre_xclass.c
+# ADD CPP /D "SUPPORT_UTF8" /D LINK_SIZE=2 /D MATCH_LIMIT=10000000 /D MATCH_LIMIT_RECURSION=10000000 /D NEWLINE=10 /D "SUPPORT_UCP"
 # End Source File
 # End Group
 # Begin Group "Header Files No. 3"
@@ -705,58 +764,6 @@ SOURCE=..\ext\ftp\php_ftp.h
 # End Source File
 # End Group
 # End Group
-# Begin Group "Calendar"
-
-# PROP Default_Filter ""
-# Begin Group "Source Files No. 7"
-
-# PROP Default_Filter ".c"
-# Begin Source File
-
-SOURCE=..\ext\calendar\cal_unix.c
-# End Source File
-# Begin Source File
-
-SOURCE=..\ext\calendar\calendar.c
-# End Source File
-# Begin Source File
-
-SOURCE=..\ext\calendar\dow.c
-# End Source File
-# Begin Source File
-
-SOURCE=..\ext\calendar\easter.c
-# End Source File
-# Begin Source File
-
-SOURCE=..\ext\calendar\french.c
-# End Source File
-# Begin Source File
-
-SOURCE=..\ext\calendar\gregor.c
-# End Source File
-# Begin Source File
-
-SOURCE=..\ext\calendar\jewish.c
-# End Source File
-# Begin Source File
-
-SOURCE=..\ext\calendar\julian.c
-# End Source File
-# End Group
-# Begin Group "Header Files No. 7"
-
-# PROP Default_Filter ".h"
-# Begin Source File
-
-SOURCE=..\ext\calendar\php_calendar.h
-# End Source File
-# Begin Source File
-
-SOURCE=..\ext\calendar\sdncal.h
-# End Source File
-# End Group
-# End Group
 # Begin Group "bcmath"
 
 # PROP Default_Filter ""
@@ -1753,10 +1760,6 @@ SOURCE=..\ext\standard\strnatcmp.c
 # End Source File
 # Begin Source File
 
-SOURCE=..\ext\standard\sunfuncs.c
-# End Source File
-# Begin Source File
-
 SOURCE=..\ext\standard\syslog.c
 # End Source File
 # Begin Source File
@@ -2023,6 +2026,302 @@ SOURCE=..\ext\libxml\libxml.c
 # End Source File
 # End Group
 # End Group
+# Begin Group "Date"
+
+# PROP Default_Filter ""
+# Begin Group "Source Files No. 10"
+
+# PROP Default_Filter ""
+# Begin Source File
+
+SOURCE=..\ext\date\lib\astro.c
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\date\lib\dow.c
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\date\lib\parse_date.c
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\date\lib\parse_tz.c
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\date\php_date.c
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\date\lib\timelib.c
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\date\lib\tm2unixtime.c
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\date\lib\unixtime2tm.c
+# End Source File
+# End Group
+# Begin Group "Header Files No. 7"
+
+# PROP Default_Filter ""
+# Begin Source File
+
+SOURCE=..\ext\date\lib\astro.h
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\date\lib\fallbackmap.h
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\date\php_date.h
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\date\lib\timelib_config.h
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\date\lib\timelib_structs.h
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\date\lib\timezonedb.h
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\date\lib\timezonemap.h
+# End Source File
+# End Group
+# End Group
+# Begin Group "Calendar"
+
+# PROP Default_Filter ""
+# Begin Group "Source Files No. 7"
+
+# PROP Default_Filter ""
+# Begin Source File
+
+SOURCE=..\ext\calendar\cal_unix.c
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\calendar\calendar.c
+# PROP Intermediate_Dir "calendar"
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\calendar\dow.c
+# PROP Intermediate_Dir "calendar"
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\calendar\easter.c
+# PROP Intermediate_Dir "calendar"
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\calendar\french.c
+# PROP Intermediate_Dir "calendar"
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\calendar\gregor.c
+# PROP Intermediate_Dir "calendar"
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\calendar\jewish.c
+# PROP Intermediate_Dir "calendar"
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\calendar\julian.c
+# PROP Intermediate_Dir "calendar"
+# End Source File
+# End Group
+# Begin Group "Header Files No. 11"
+
+# PROP Default_Filter ""
+# Begin Source File
+
+SOURCE=..\ext\calendar\php_calendar.h
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\calendar\sdncal.h
+# End Source File
+# End Group
+# End Group
+# Begin Group "SPL"
+
+# PROP Default_Filter ""
+# Begin Group "Source Files No. 11"
+
+# PROP Default_Filter ""
+# Begin Source File
+
+SOURCE=..\ext\spl\php_spl.c
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\spl\spl_array.c
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\spl\spl_directory.c
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\spl\spl_engine.c
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\spl\spl_exceptions.c
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\spl\spl_functions.c
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\spl\spl_iterators.c
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\spl\spl_observer.c
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\spl\spl_sxe.c
+# End Source File
+# End Group
+# Begin Group "Header Files No. 12"
+
+# PROP Default_Filter ""
+# Begin Source File
+
+SOURCE=..\ext\spl\php_spl.h
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\spl\spl_array.h
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\spl\spl_directory.h
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\spl\spl_engine.h
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\spl\spl_exceptions.h
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\spl\spl_functions.h
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\spl\spl_iterators.h
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\spl\spl_observer.h
+# End Source File
+# Begin Source File
+
+SOURCE=..\ext\spl\spl_sxe.h
+# End Source File
+# End Group
+# End Group
+# Begin Group "Reflection"
+
+# PROP Default_Filter ""
+# Begin Group "Source Files No. 12"
+
+# PROP Default_Filter ""
+# Begin Source File
+
+SOURCE=..\ext\reflection\php_reflection.c
+# End Source File
+# End Group
+# Begin Group "Header Files No. 13"
+
+# PROP Default_Filter ""
+# Begin Source File
+
+SOURCE=..\ext\reflection\php_reflection.h
+# End Source File
+# End Group
+# End Group
+# Begin Group "XMLReader"
+
+# PROP Default_Filter ""
+# Begin Group "Source Files No. 13"
+
+# PROP Default_Filter ""
+# Begin Source File
+
+SOURCE=..\ext\xmlreader\php_xmlreader.c
+# End Source File
+# End Group
+# Begin Group "Header Files No. 14"
+
+# PROP Default_Filter ""
+# Begin Source File
+
+SOURCE=..\ext\xmlreader\php_xmlreader.h
+# End Source File
+# End Group
+# End Group
+# Begin Group "XMLwriter"
+
+# PROP Default_Filter ""
+# Begin Group "Source Files No. 14"
+
+# PROP Default_Filter ""
+# Begin Source File
+
+SOURCE=..\ext\xmlwriter\php_xmlwriter.c
+# End Source File
+# End Group
+# Begin Group "Header Files No. 15"
+
+# PROP Default_Filter ""
+# Begin Source File
+
+SOURCE=..\ext\xmlwriter\php_xmlwriter.h
+# End Source File
+# End Group
+# End Group
+# Begin Group "IConv"
+
+# PROP Default_Filter ""
+# Begin Group "Source Files No. 15"
+
+# PROP Default_Filter ""
+# Begin Source File
+
+SOURCE=..\ext\iconv\iconv.c
+# ADD CPP /D "PHP_ICONV_EXPORTS"
+# End Source File
+# End Group
+# Begin Group "Header Files No. 16"
+
+# PROP Default_Filter ""
+# Begin Source File
+
+SOURCE=..\ext\iconv\php_iconv.h
+# End Source File
+# End Group
+# End Group
 # End Group
 # Begin Group "Win32"
 
@@ -2081,6 +2380,21 @@ SOURCE=..\win32\winutil.c
 # Begin Source File
 
 SOURCE=..\win32\wsyslog.c
+# End Source File
+# Begin Source File
+
+SOURCE=.\build\wsyslog.mc
+
+# Begin Custom Build
+InputDir=.\build
+IntDir=.\Release_TSDbg
+InputPath=.\build\wsyslog.mc
+
+"wsyslog.h" : $(SOURCE) "$(INTDIR)" "$(OUTDIR)"
+	mc -h $(InputDir)/.. -r $(InputDir) -x $(IntDir) $(InputPath)
+
+# End Custom Build
+
 # End Source File
 # End Group
 # Begin Group "Header Files No. 2"