5.4.35

Fixed bug #66584 Segmentation fault on statement deallocation
update NEWS
2026-11-09 10:10:50 +00:00 · 2014-11-11 16:29:14 -08:00 · 2014-11-11 16:25:31 -08:00 · 2014-11-12 00:18:13 +01:00 · 2014-11-07 09:46:49 +03:00 · 2014-11-03 11:43:15 -08:00
193 changed files with 18859 additions and 15096 deletions
@@ -22,6 +22,10 @@ sapi/nsapi/nsapi.c              ident
 sapi/continuity/capi.c          ident
 Zend/RFCs/002.txt               ident
 Zend/RFCs/003.txt               ident
+ext/exif/exif.c                 ident
+ext/ldap/ldap.c                 ident
+ext/pdo_pgsql/pdo_pgsql.c       ident
+ext/tidy/tidy.c                 ident
 NEWS                            merge=NEWS
 /ext/bz2/tests/with_strings.phpt	-crlf
 /ext/dom/tests/bug40836.phpt	-crlf
@@ -385,6 +385,12 @@ MAINTENANCE:         Maintained
 STATUS:              Working
 SINCE:               4.0.4
 -------------------------------------------------------------------------------
+EXTENSION:           hash
+PRIMARY MAINTAINER:  Sara Golemon <pollita@php.net>, Mike Wallner <mike@php.net>, Anatol Belski <ab@php.net>
+MAINTENANCE:         Maintained
+STATUS:              Working
+SINCE:               5.1.2
+-------------------------------------------------------------------------------
 EXTENSION:           iconv
 PRIMARY MAINTAINER:  Moriyoshi Koizumi <moriyoshi@php.net>
 MAINTENANCE:         Maintained
@@ -1,5 +1,168 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+13 Nov 2014 PHP 5.4.35
+
+- Core:
+  . Fixed bug #68365 (zend_mm_heap corrupted after memory overflow in
+    zend_hash_copy). (Dmitry)
+
+- Fileinfo:
+  . Fixed bug #68283 (fileinfo: out-of-bounds read in elf note headers).
+    (CVE-2014-3710) (Remi)
+
+- GMP:
+ . Fixed bug #63595 (GMP memory management conflicts with other libraries
+   using GMP). (Remi)
+
+- PDO_pgsql:
+  . Fixed bug #66584 (Segmentation fault on statement deallocation) (Matteo)
+
+16 Oct 2014, PHP 5.4.34
+
+- Fileinfo:
+  . Fixed bug #66242 (libmagic: don't assume char is signed). (ArdB)
+
+- Core:
+  . Fixed bug #67985 (Incorrect last used array index copied to new array after
+    unset). (Tjerk)
+  . Fixed bug #68044 (Integer overflow in unserialize() (32-bits only)). 
+    (CVE-2014-3669) (Stas)
+
+- cURL:
+  . Fixed bug #68089 (NULL byte injection - cURL lib). (Stas)
+
+- EXIF:
+  . Fixed bug #68113 (Heap corruption in exif_thumbnail()). (CVE-2014-3670)
+    (Stas)
+
+- OpenSSL:
+  . Reverted fixes for bug #41631, due to regressions. (Stas) 
+
+- XMLRPC:
+  . Fixed bug #68027 (Global buffer overflow in mkgmtime() function). 
+    (CVE-2014-3668) (Stas)
+
+18 Sep 2014, PHP 5.4.33
+
+- Core:
+  . Fixed bug #47358 (glob returns error, should be empty array()). (Pierre)
+  . Fixed bug #65463 (SIGSEGV during zend_shutdown()). (Keyur Govande)
+  . Fixed bug #66036 (Crash on SIGTERM in apache process). (Keyur Govande)
+
+- OpenSSL:
+  . Fixed bug #41631 (socket timeouts not honored in blocking SSL reads).
+    (Daniel Lowrey)
+
+- Date:
+  . Fixed bug #66091 (memory leaks in DateTime constructor). (Tjerk)
+
+- FPM:
+  . Fixed #67606 (FPM with mod_fastcgi/apache2.4 is broken). (David Zuelke)
+
+- GD:
+  . Made fontFetch's path parser thread-safe. (Sara)
+
+- Wddx:
+  . Fixed bug #67873 (Segfaults in php_wddx_serialize_var). (Anatol, Remi)
+
+- Zlib:
+  . Fixed bug #67724 (chained zlib filters silently fail with large amounts of 
+    data). (Mike)
+  . Fixed bug #67865 (internal corruption phar error). (Mike)
+
+21 Aug 2014, PHP 5.4.32
+
+- COM:
+  . Fixed missing type checks in com_event_sink. (Yussuf Khalil, Stas)
+  . Fixed bug #41577 (DOTNET is successful once per server run).
+    (Aidas Kasparas)
+
+- Fileinfo:
+  . Fixed bug #67705 (extensive backtracking in rule regular expression).
+    (CVE-2014-3538) (Remi)
+  . Fixed bug #67716 (Segfault in cdf.c). (CVE-2014-3587) (Remi)
+
+- GD:
+  . Fixed bug #66901 (php-gd 'c_color' NULL pointer dereference).
+    (CVE-2014-2497). (Remi)
+  . Fixed bug #67730 (Null byte injection possible with imagexxx functions).
+    (CVE-2014-5120) (Ryan Mauger)
+
+- Network:
+  . Fixed bug #67717 (segfault in dns_get_record). (CVE-2014-3597) (Remi)
+
+- Milter:
+  . Fixed bug #67715 (php-milter does not build and crashes randomly). (Mike)
+
+- OpenSSL:
+  . Fixed missing type checks in OpenSSL options (Yussuf Khalil, Stas).
+
+- Readline:
+  . Fixed bug #55496 (Interactive mode doesn't force a newline before the
+    prompt). (Bob, Johannes)
+  . Fixed bug #67496 (Save command history when exiting interactive shell
+    with control-c). (Dmitry Saprykin, Johannes)
+
+- Sessions:
+  . Fixed missing type checks in php_session_create_id. (Yussuf Khalil, Stas).
+
+- SPL:
+  . Fixed bug #67539 (ArrayIterator use-after-free due to object change during
+    sorting). (CVE-2014-4698) (research at insighti dot org, Laruence)
+  . Fixed bug #67538 (SPL Iterators use-after-free). (CVE-2014-4670) (Laruence)
+
+- Core:
+  . Fixed bug #67693 (incorrect push to the empty array) (Tjerk)
+
+- ODBC:
+  . Fixed bug #60616 (odbc_fetch_into returns junk data at end of multi-byte
+    char fields). (Keyur)
+
+- MySQLi:
+  . Fixed bug #67839 (mysqli does not handle 4-byte floats correctly). (Keyur)
+
+24 Jul 2014, PHP 5.4.31
+
+- Core:
+  . Fixed bug #67428 (header('Location: foo') will override a 308-399 response
+    code). (Adam)
+  . Fixed bug #67436 (Autoloader isn't called if two method definitions don't
+    match). (Bob)
+  . Fixed bug #67091 (make install fails to install libphp5.so on FreeBSD 10.0).
+    (Ferenc)
+  . Fixed bug #67151 (strtr with empty array crashes). (Nikita)
+  . Fixed bug #67407 (Windows 8.1/Server 2012 R2 reported as Windows 8/Server
+    2012). (Christian Wenz)
+  . Implemented FR #34407 (ucwords and Title Case). (Tjerk)
+
+- CLI server:
+  . Implemented FR #67429 (CLI server is missing some new HTTP response codes).
+    (Adam)
+  . Fixed bug #66830 (Empty header causes PHP built-in web server to hang).
+    (Adam)
+
+- FPM:
+  . Fixed bug #67530 (error_log=syslog ignored). (Remi)
+  . Fixed bug #67531 (syslog cannot be set in pool configuration). (Remi)
+
+- Intl:
+  . Fixed bug #67052 (NumberFormatter::parse() resets LC_NUMERIC setting). 
+    (Stas)
+
+- pgsql:
+  . Fixed bug #67550 (Error in code "form" instead of "from", pgsql.c, line 756),
+    which affected builds against libpq < 7.3. (Adam)
+
+- Phar:
+  . Fixed bug #67587 (Redirection loop on nginx with FPM). (Christian Weiske)
+
+- Streams:
+  . Fixed bug #67430 (http:// wrapper doesn't follow 308 redirects). (Adam)
+
+- Session:
+  . Fixed bug #66827 (Session raises E_NOTICE when session name variable is array).
+    (Yasuo)
+
 26 Jun 2014, PHP 5.4.30

 - Core:
@@ -7,7 +170,7 @@ PHP                                                                        NEWS
  . Fixed bug #66622 (Closures do not correctly capture the late bound class 
    (static::) in some cases). (Levi Morrison)
  . Fixed bug #67390 (insecure temporary file use in the configure script).
-    (CVE-2014-3981) (Remi)
+    (Remi) (CVE-2014-3981)
  . Fixed bug #67399 (putenv with empty variable may lead to crash). (Stas)
  . Fixed bug #67498 (phpinfo() Type Confusion Information Leak Vulnerability). 
    (Stefan Esser)
@@ -45,15 +45,16 @@ Currently we have the following branches in use::

  master    The active development branch. 

+  PHP-5.6   Is used to release the PHP 5.6.x series. This is a current
+            stable version and is open for bugfixes only.
+
  PHP-5.5   Is used to release the PHP 5.5.x series. This is a current
            stable version and is open for bugfixes only.

  PHP-5.4   Is used to release the PHP 5.4.x series. This is a current
            stable version and is open for bugfixes only.

-  PHP-5.3   Is used to release the PHP 5.3.x series. This is currently 
-            in extended support and open forsecurity fixes only. Triaged
-            via security@php.net
+  PHP-5.3   This branch is closed.

  PHP-5.2   This branch is closed.

@@ -61,9 +62,12 @@ Currently we have the following branches in use::

  PHP-4.4   This branch is closed.

+  PHP-X.Y.Z These branches are used for the release managers for tagging
+            the releases, hence they are closed to the general public.
+
 The next few rules are more of a technical nature::

-   1. All changes should first go to the lowest branch (i.e. 5.3) and then 
+   1. All changes should first go to the lowest branch (i.e. 5.4) and then
      get merged up to all other branches. If a change is not needed for
      later branches (i.e. fixes for features which where dropped from later
      branches) an empty merge should be done.
@@ -10,6 +10,7 @@ PHP 5.4 UPGRADE NOTES
 2. Changes to reserved words and classes
 3. Changes to engine behavior
 4. Changes to existing functions
+   a. unserialize() change
 5. Changes to existing classes
 6. Changes to existing methods
 7. Deprecated Functionality
@@ -311,7 +312,7 @@ PHP 5.4 UPGRADE NOTES
  to limit the amount of stack frames returned.

 - Fixed crypt_blowfish handling of 8-bit characters. crypt() in Blowfish mode
-  now supports hashes marked $2a$, $2x$, $2y$ and $2z$.
+  now supports hashes marked $2a$, $2x$ and $2y$.

 - mbstring now supports following encodings: Shift_JIS/UTF-8 Emoji,
  JIS X0213:2004 (Shift_JIS-2004, EUC-JP-2004, ISO-2022-JP-2004),
@@ -350,8 +351,46 @@ PHP 5.4 UPGRADE NOTES
 - Since 5.4.7, ctor is always called when new user stream wrapper object is created.
  Before, it was called only when stream_open was called.

- Manipulated serialization strings for objects implementing Serializable by
-  replacing "C:" with "O:" at the start will now produce an error.
+4a. unserialize() change
+------------------------
+
+- Starting PHP 5.4.29, the bug fix for bug #67072 introduces a change to 
+  unserialize() function, detailed below:
+
+    If the string looking like 'O:..:"ClassName":...' is unserialized, and
+    the class named is an internal class that declares custom unserializer
+    function, or extends such class, unserialize would fail.
+
+    Using O: for user classes not extending internal classes (including
+    those implementing Serializable) is still supported in 5.4, though
+    it is deprecated and may not be supported in 5.6 for classes that do not 
+    originally serialize to O:. Same for using O: for internal classes 
+    implementing Serializable (like ArrayObject) and classes that extend 
+    them.
+
+    The reason for that is that O: format is meant to be used with classes
+    that do not define custom handlers, and was never intended for the use
+    with classes that do. When used with the class that relies on custom
+    unserializer, it can leave the object of such internal class in an
+    inconsistent state which has been observed to result in crashes and may
+    also lead to memory corruption and ultimately even arbitrary code
+    execution. This was never the intended use of unserializer, and mere
+    possibility of doing this constitutes a bug, since the data passed to
+    unserialize() is not a valid serialization of any object. Since there
+    are many applications applying unserialize() to untrusted data, this
+    presents a potential security vulnerability. Thus, keeping such bug in
+    the code base was considered too dangerous.
+
+    We are aware that some applications use O: format as a way to
+    instantiate classes. This was never the intended usage of serializer,
+    and ReflectionClass methods such as newInstance or
+    newInstanceWithoutConstructor can be used for that. We're working on
+    providing more comprehensive solution for such use cases in PHP 5.6 and
+    welcome the ideas in this area.
+
+    We note also that using unserialize() on any data that is not the result
+    of serialize() call continues to be an unsupported scenario and should
+    not be relied on to produce any specific result.

 ==============================
 5. Changes to existing classes
@@ -0,0 +1,10 @@
+<?php
+
+class a {
+	public function test($arg = c::TESTCONSTANT) {
+		echo __METHOD__ . "($arg)\n";
+	}
+
+	static public function staticTest() {
+  	}
+}
@@ -0,0 +1,8 @@
+<?php
+
+class b extends a {
+	public function test() {
+		echo __METHOD__ . "()\n";
+		parent::test();
+	}
+}
@@ -0,0 +1,26 @@
+--TEST--
+bug67436: Autoloader isn't called if user defined error handler is present
+
+--INI--
+error_reporting=
+
+--FILE--
+<?php
+
+spl_autoload_register(function($classname) {
+	if (in_array($classname, array('a','b','c'))) {
+		require_once ($classname . '.php');
+	}
+});
+
+set_error_handler(function ($errno, $errstr, $errfile, $errline) {
+}, error_reporting());
+
+a::staticTest();
+
+$b = new b();
+$b->test();
+
+--EXPECT--
+b::test()
+a::test(c::TESTCONSTANT)
@@ -0,0 +1,24 @@
+--TEST--
+bug67436: E_STRICT instead of custom error handler
+
+--INI--
+error_reporting=-1
+
+--FILE--
+<?php
+
+spl_autoload_register(function($classname) {
+	if (in_array($classname, array('a','b','c'))) {
+		require_once ($classname . '.php');
+	}
+});
+
+a::staticTest();
+
+$b = new b();
+$b->test();
+
+--EXPECTF--
+Strict Standards: Declaration of b::test() should be compatible with a::test($arg = c::TESTCONSTANT) in %s/bug67436/b.php on line %d
+b::test()
+a::test(c::TESTCONSTANT)
@@ -0,0 +1,5 @@
+<?php
+
+class c {
+	const TESTCONSTANT = "c::TESTCONSTANT";
+}
@@ -0,0 +1,16 @@
+--TEST--
+Bug #67985 - Last used array index not copied to new array at assignment
+--FILE--
+<?php
+
+$a = ['zero', 'one', 'two'];
+unset($a[2]);
+$b = $a;
+$a[] = 'three';
+$b[] = 'three';
+
+var_dump($a === $b);
+
+?>
+--EXPECT--
+bool(true)
@@ -813,6 +813,20 @@ void zend_shutdown(TSRMLS_D) /* {{{ */
 	zend_shutdown_timeout_thread();
 #endif
 	zend_destroy_rsrc_list(&EG(persistent_list) TSRMLS_CC);
+
+	if (EG(active))
+	{
+		/*
+		 * The order of destruction is important here.
+		 * See bugs #65463 and 66036.
+		 */
+		zend_hash_reverse_apply(GLOBAL_FUNCTION_TABLE, (apply_func_t) zend_cleanup_function_data_full TSRMLS_CC);
+		zend_hash_reverse_apply(GLOBAL_CLASS_TABLE, (apply_func_t) zend_cleanup_user_class_data TSRMLS_CC);
+		zend_cleanup_internal_classes(TSRMLS_C);
+		zend_hash_reverse_apply(GLOBAL_FUNCTION_TABLE, (apply_func_t) clean_non_persistent_function_full TSRMLS_CC);
+		zend_hash_reverse_apply(GLOBAL_CLASS_TABLE, (apply_func_t) clean_non_persistent_class_full TSRMLS_CC);
+	}
+
 	zend_destroy_modules();

 	zend_hash_destroy(GLOBAL_FUNCTION_TABLE);
@@ -3150,8 +3150,11 @@ static char * zend_get_function_declaration(zend_function *fptr TSRMLS_DC) /* {{
 						*zv = *precv->op2.zv;
 						zval_copy_ctor(zv);
 						INIT_PZVAL(zv);
-						zval_update_constant_ex(&zv, (void*)1, fptr->common.scope TSRMLS_CC);
-						if (Z_TYPE_P(zv) == IS_BOOL) {
+						if ((Z_TYPE_P(zv) & IS_CONSTANT_TYPE_MASK) == IS_CONSTANT) {
+							REALLOC_BUF_IF_EXCEED(buf, offset, length, Z_STRLEN_P(zv));
+							memcpy(offset, Z_STRVAL_P(zv), Z_STRLEN_P(zv));
+							offset += Z_STRLEN_P(zv);
+						} else if (Z_TYPE_P(zv) == IS_BOOL) {
 							if (Z_LVAL_P(zv)) {
 								memcpy(offset, "true", 4);
 								offset += 4;
@@ -3173,7 +3176,7 @@ static char * zend_get_function_declaration(zend_function *fptr TSRMLS_DC) /* {{
 								*(offset++) = '.';
 							}
 							*(offset++) = '\'';
-						} else if (Z_TYPE_P(zv) == IS_ARRAY) {
+						} else if (Z_TYPE_P(zv) == IS_ARRAY || (Z_TYPE_P(zv) & IS_CONSTANT_TYPE_MASK) == IS_CONSTANT_ARRAY) {
 							memcpy(offset, "Array", 5);
 							offset += 5;
 						} else {
@@ -639,6 +639,8 @@ ZEND_API void zend_cleanup_internal_class_data(zend_class_entry *ce TSRMLS_DC);
 ZEND_API void zend_cleanup_internal_classes(TSRMLS_D);
 ZEND_API int zend_cleanup_function_data(zend_function *function TSRMLS_DC);
 ZEND_API int zend_cleanup_function_data_full(zend_function *function TSRMLS_DC);
+ZEND_API int clean_non_persistent_function_full(zend_function *function TSRMLS_DC);
+ZEND_API int clean_non_persistent_class_full(zend_class_entry **ce TSRMLS_DC);

 ZEND_API void destroy_zend_function(zend_function *function TSRMLS_DC);
 ZEND_API void zend_function_dtor(zend_function *function);
@@ -108,7 +108,7 @@ static int clean_non_persistent_function(zend_function *function TSRMLS_DC) /* {
 }
 /* }}} */

-static int clean_non_persistent_function_full(zend_function *function TSRMLS_DC) /* {{{ */
+ZEND_API int clean_non_persistent_function_full(zend_function *function TSRMLS_DC) /* {{{ */
 {
 	return (function->type == ZEND_INTERNAL_FUNCTION) ? ZEND_HASH_APPLY_KEEP : ZEND_HASH_APPLY_REMOVE;
 }
@@ -120,7 +120,7 @@ static int clean_non_persistent_class(zend_class_entry **ce TSRMLS_DC) /* {{{ */
 }
 /* }}} */

-static int clean_non_persistent_class_full(zend_class_entry **ce TSRMLS_DC) /* {{{ */
+ZEND_API int clean_non_persistent_class_full(zend_class_entry **ce TSRMLS_DC) /* {{{ */
 {
 	return ((*ce)->type == ZEND_INTERNAL_CLASS) ? ZEND_HASH_APPLY_KEEP : ZEND_HASH_APPLY_REMOVE;
 }
@@ -135,8 +135,9 @@ ZEND_API void _zval_copy_ctor_func(zval *zvalue ZEND_FILE_LINE_DC)
 				}
 				ALLOC_HASHTABLE_REL(tmp_ht);
 				zend_hash_init(tmp_ht, zend_hash_num_elements(original_ht), NULL, ZVAL_PTR_DTOR, 0);
-				zend_hash_copy(tmp_ht, original_ht, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
 				zvalue->value.ht = tmp_ht;
+				zend_hash_copy(tmp_ht, original_ht, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
+				tmp_ht->nNextFreeElement = original_ht->nNextFreeElement;
 			}
 			break;
 		case IS_OBJECT:
@@ -1210,7 +1210,7 @@ function gen_vm($def, $skel) {
 		fputs($f,"#define $op $code\n");
 	}

-	fputs($f, "\n#endif");
+	fputs($f, "\n#endif\n");
 	fclose($f);
 	echo "zend_vm_opcodes.h generated successfully.\n";

@@ -165,4 +165,4 @@ ZEND_API const char *zend_get_opcode_name(zend_uchar opcode);
 #define ZEND_QM_ASSIGN_VAR                   157
 #define ZEND_JMP_SET_VAR                     158

-#endif
+#endif
@@ -2800,7 +2800,7 @@ AC_DEFUN([PHP_DETECT_ICC],

 dnl PHP_DETECT_SUNCC
 dnl Detect if the systems default compiler is suncc.
-dnl We also set some usefull CFLAGS if the user didn't set any
+dnl We also set some useful CFLAGS if the user didn't set any
 AC_DEFUN([PHP_DETECT_SUNCC],[
  SUNCC="no"
  AC_MSG_CHECKING([for suncc])
@@ -1532,10 +1532,6 @@ dgux*)
  shlibpath_var=LD_LIBRARY_PATH
  ;;

-freebsd1*)
-  dynamic_linker=no
-  ;;
-
 freebsd* | dragonfly*)
  # DragonFly does not have aout.  When/if they implement a new
  # versioning mechanism, adjust this.
@@ -5842,10 +5838,6 @@ _LT_EOF
      _LT_AC_TAGVAR(hardcode_shlibpath_var, $1)=no
      ;;

-    freebsd1*)
-      _LT_AC_TAGVAR(ld_shlibs, $1)=no
-      ;;
-
    # FreeBSD 2.2.[012] allows us to include c++rt0.o to get C++ constructor
    # support.  Future versions do this automatically, but an explicit c++rt0.o
    # does not break anything, and helps significantly (at the cost of a little
@@ -119,7 +119,7 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=4
-PHP_RELEASE_VERSION=30
+PHP_RELEASE_VERSION=35
 PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
@@ -698,9 +698,9 @@ PHP_FUNCTION(com_event_sink)
 		/* 0 => typelibname, 1 => dispname */
 		zval **tmp;

-		if (zend_hash_index_find(Z_ARRVAL_P(sink), 0, (void**)&tmp) == SUCCESS)
+		if (zend_hash_index_find(Z_ARRVAL_P(sink), 0, (void**)&tmp) == SUCCESS && Z_TYPE_PP(tmp) == IS_STRING)
 			typelibname = Z_STRVAL_PP(tmp);
-		if (zend_hash_index_find(Z_ARRVAL_P(sink), 1, (void**)&tmp) == SUCCESS)
+		if (zend_hash_index_find(Z_ARRVAL_P(sink), 1, (void**)&tmp) == SUCCESS && Z_TYPE_PP(tmp) == IS_STRING)
 			dispname = Z_STRVAL_PP(tmp);
 	} else if (sink != NULL) {
 		convert_to_string(sink);
@@ -198,7 +198,8 @@ PHP_FUNCTION(com_dotnet_create_instance)
 	IUnknown *unk = NULL;

 	php_com_initialize(TSRMLS_C);
-	if (COMG(dotnet_runtime_stuff) == NULL) {
+	stuff = (struct dotnet_runtime_stuff*)COMG(dotnet_runtime_stuff);
+	if (stuff == NULL) {
 		hr = dotnet_init(&where TSRMLS_CC);
 		if (FAILED(hr)) {
 			char buf[1024];
@@ -210,9 +211,35 @@ PHP_FUNCTION(com_dotnet_create_instance)
 			ZVAL_NULL(object);
 			return;
 		}
-	}
+		stuff = (struct dotnet_runtime_stuff*)COMG(dotnet_runtime_stuff);

-	stuff = (struct dotnet_runtime_stuff*)COMG(dotnet_runtime_stuff);
+	} else if (stuff->dotnet_domain == NULL) {
+		where = "ICorRuntimeHost_GetDefaultDomain";
+		hr = ICorRuntimeHost_GetDefaultDomain(stuff->dotnet_host, &unk);
+		if (FAILED(hr)) {
+			char buf[1024];
+			char *err = php_win32_error_to_msg(hr);
+			snprintf(buf, sizeof(buf), "Failed to re-init .Net domain [%s] %s", where, err);
+			if (err)
+				LocalFree(err);
+			php_com_throw_exception(hr, buf TSRMLS_CC);
+			ZVAL_NULL(object);
+			return;
+		}
+
+		where = "QI: System._AppDomain";
+		hr = IUnknown_QueryInterface(unk, &IID_mscorlib_System_AppDomain, (LPVOID*)&stuff->dotnet_domain);
+		if (FAILED(hr)) {
+			char buf[1024];
+			char *err = php_win32_error_to_msg(hr);
+			snprintf(buf, sizeof(buf), "Failed to re-init .Net domain [%s] %s", where, err);
+			if (err)
+				LocalFree(err);
+			php_com_throw_exception(hr, buf TSRMLS_CC);
+			ZVAL_NULL(object);
+			return;
+		}
+	}

 	obj = CDNO_FETCH(object);

@@ -170,6 +170,12 @@ static int php_curl_option_url(php_curl *ch, const char *url, const int len TSRM
 #if LIBCURL_VERSION_NUM < 0x071100
 	char *copystr = NULL;
 #endif
+
+	if (strlen(url) != len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Curl option contains invalid characters (\\0)");
+		return 0;
+	}
+
 	/* Disable file:// if open_basedir are used */
 	if (PG(open_basedir) && *PG(open_basedir)) {
 #if LIBCURL_VERSION_NUM >= 0x071304
@@ -0,0 +1,18 @@
+--TEST--
+Bug #68089 (NULL byte injection - cURL lib)
+--SKIPIF--
+<?php 
+include 'skipif.inc';
+
+?>
+--FILE--
+<?php
+$url = "file:///etc/passwd\0http://google.com";
+$ch = curl_init();
+var_dump(curl_setopt($ch, CURLOPT_URL, $url));
+?>
+Done
+--EXPECTF--
+Warning: curl_setopt(): Curl option contains invalid characters (\0) in %s/bug68089.php on line 4
+bool(false)
+Done
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | PHP Version 5                                                        |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1997-2013 The PHP Group                                |
+   | Copyright (c) 1997-2014 The PHP Group                                |
   +----------------------------------------------------------------------+
   | This source file is subject to version 3.01 of the PHP license,      |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -966,8 +966,8 @@ mssqltime        = hour12 ":" minutelz ":" secondlz [:.] [0-9]+ meridian;
 isoweekday       = year4 "-"? "W" weekofyear "-"? [0-7];
 isoweek          = year4 "-"? "W" weekofyear;
 exif             = year4 ":" monthlz ":" daylz " " hour24lz ":" minutelz ":" secondlz;
-firstdayof       = 'first day of'?;
-lastdayof        = 'last day of'?;
+firstdayof       = 'first day of';
+lastdayof        = 'last day of';
 backof           = 'back of ' hour24 space? meridian?;
 frontof          = 'front of ' hour24 space? meridian?;

@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | PHP Version 5                                                        |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1997-2013 The PHP Group                                |
+   | Copyright (c) 1997-2014 The PHP Group                                |
   +----------------------------------------------------------------------+
   | This source file is subject to version 3.01 of the PHP license,      |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -50,7 +50,11 @@ static inline long long php_date_llabs( long long i ) { return i >= 0 ? i : -i;
 		int st = snprintf(s, len, "%lld", i); \
 		s[st] = '\0'; \
 	} while (0);
+#ifdef HAVE_ATOLL
 # define DATE_A64I(i, s) i = atoll(s)
+#else
+# define DATE_A64I(i, s) i = strtoll(s, NULL, 10)
+#endif
 #endif

 /* {{{ arginfo */
@@ -2394,11 +2398,7 @@ static void date_object_free_storage_period(void *object TSRMLS_DC)
 /* Advanced Interface */
 PHPAPI zval *php_date_instantiate(zend_class_entry *pce, zval *object TSRMLS_DC)
 {
-	Z_TYPE_P(object) = IS_OBJECT;
 	object_init_ex(object, pce);
-	Z_SET_REFCOUNT_P(object, 1);
-	Z_UNSET_ISREF_P(object);
-
 	return object;
 }

@@ -2506,14 +2506,19 @@ PHP_FUNCTION(date_create)
 	zval           *timezone_object = NULL;
 	char           *time_str = NULL;
 	int             time_str_len = 0;
+	zval            datetime_object;

 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|sO!", &time_str, &time_str_len, &timezone_object, date_ce_timezone) == FAILURE) {
 		RETURN_FALSE;
 	}

-	php_date_instantiate(date_ce_date, return_value TSRMLS_CC);
-	if (!php_date_initialize(zend_object_store_get_object(return_value TSRMLS_CC), time_str, time_str_len, NULL, timezone_object, 0 TSRMLS_CC)) {
+	php_date_instantiate(date_ce_date, &datetime_object TSRMLS_CC);
+	if (!php_date_initialize(zend_object_store_get_object(&datetime_object TSRMLS_CC), time_str, time_str_len, NULL, timezone_object, 0 TSRMLS_CC)) {
+		zval_dtor(&datetime_object);
 		RETURN_FALSE;
+	} else {
+		zval *datetime_object_ptr = &datetime_object;
+		RETVAL_ZVAL(datetime_object_ptr, 0, 0);
 	}
 }
 /* }}} */
@@ -2526,14 +2531,19 @@ PHP_FUNCTION(date_create_from_format)
 	zval           *timezone_object = NULL;
 	char           *time_str = NULL, *format_str = NULL;
 	int             time_str_len = 0, format_str_len = 0;
+	zval            datetime_object;

 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ss|O", &format_str, &format_str_len, &time_str, &time_str_len, &timezone_object, date_ce_timezone) == FAILURE) {
 		RETURN_FALSE;
 	}

-	php_date_instantiate(date_ce_date, return_value TSRMLS_CC);
-	if (!php_date_initialize(zend_object_store_get_object(return_value TSRMLS_CC), time_str, time_str_len, format_str, timezone_object, 0 TSRMLS_CC)) {
+	php_date_instantiate(date_ce_date, &datetime_object TSRMLS_CC);
+	if (!php_date_initialize(zend_object_store_get_object(&datetime_object TSRMLS_CC), time_str, time_str_len, format_str, timezone_object, 0 TSRMLS_CC)) {
+		zval_dtor(&datetime_object);
 		RETURN_FALSE;
+	} else {
+		zval *datetime_object_ptr = &datetime_object;
+		RETVAL_ZVAL(datetime_object_ptr, 0, 0);
 	}
 }
 /* }}} */
@@ -2556,7 +2566,7 @@ PHP_METHOD(DateTime, __construct)
 }
 /* }}} */

-static int php_date_initialize_from_hash(zval **return_value, php_date_obj **dateobj, HashTable *myht TSRMLS_DC)
+static int php_date_initialize_from_hash(php_date_obj **dateobj, HashTable *myht TSRMLS_DC)
 {
 	zval            **z_date = NULL;
 	zval            **z_timezone = NULL;
@@ -2626,7 +2636,7 @@ PHP_METHOD(DateTime, __set_state)

 	php_date_instantiate(date_ce_date, return_value TSRMLS_CC);
 	dateobj = (php_date_obj *) zend_object_store_get_object(return_value TSRMLS_CC);
-	if (!php_date_initialize_from_hash(&return_value, &dateobj, myht TSRMLS_CC)) {
+	if (!php_date_initialize_from_hash(&dateobj, myht TSRMLS_CC)) {
 		php_error(E_ERROR, "Invalid serialization data for DateTime object");
 	}
 }
@@ -2644,7 +2654,7 @@ PHP_METHOD(DateTime, __wakeup)

 	myht = Z_OBJPROP_P(object);

-	if (!php_date_initialize_from_hash(&return_value, &dateobj, myht TSRMLS_CC)) {
+	if (!php_date_initialize_from_hash(&dateobj, myht TSRMLS_CC)) {
 		php_error(E_ERROR, "Invalid serialization data for DateTime object");
 	}
 }
@@ -95,18 +95,18 @@ result = Monday 2037-10-05 00:00:00 NZDT
 wanted = Monday            00:00:00

 Australia/Adelaide
-ts     = Friday 1971-01-01 17:17:17 CST
-result = Monday 1971-01-04 00:00:00 CST
+ts     = Friday 1971-01-01 17:17:17 ACST
+result = Monday 1971-01-04 00:00:00 ACST
 wanted = Monday            00:00:00

 Australia/Darwin
-ts     = Monday 1971-03-29 17:17:17 CST
-result = Monday 1971-04-05 00:00:00 CST
+ts     = Monday 1971-03-29 17:17:17 ACST
+result = Monday 1971-04-05 00:00:00 ACST
 wanted = Monday            00:00:00

 Australia/Perth
-ts     = Friday 1971-01-01 17:17:17 WST
-result = Monday 1971-01-04 00:00:00 WST
+ts     = Friday 1971-01-01 17:17:17 AWST
+result = Monday 1971-01-04 00:00:00 AWST
 wanted = Monday            00:00:00

 America/Aruba
@@ -233,8 +233,8 @@ result=Saturday 1970-01-03 00:00:00 CAT 0
 wanted=Saturday            00:00:00

 TZ=Asia/Kashgar - Is it OK for this to be 3 AM? yes
-tStamp=Thursday 1980-04-24 17:17:17 KAST 0
-result=Thursday 1980-05-01 03:00:00 CST 0
+tStamp=Thursday 1980-04-24 17:17:17 XJT 0
+result=Thursday 1980-05-01 00:00:00 XJT 0
 wanted=Thursday            03:00:00

 TZ=Indian/Christmas - Is it OK for this to be 7 AM?  Note: does
@@ -39,5 +39,5 @@ datestr  10:00:00 AM July 1 2005 UTC

 Setting TZ
 input    10:00:00 AM July 1 2005
-strftime 10:00:00 AM July 1 2005 EST +1000
-datestr  10:00:00 AM July 1 2005 EST
+strftime 10:00:00 AM July 1 2005 AEST +1000
+datestr  10:00:00 AM July 1 2005 AEST
@@ -44,7 +44,7 @@ array(4) {

 string(6) "Y-m-d+"
 string(19) "2001-11-29 13:20:01"
-object(DateTime)#2 (3) {
+object(DateTime)#%d (3) {
  ["date"]=>
  string(26) "2001-11-29 %d:%d:%d.%d"
  ["timezone_type"]=>
@@ -70,7 +70,7 @@ array(4) {

 string(7) "Y-m-d +"
 string(19) "2001-11-29 13:20:01"
-object(DateTime)#3 (3) {
+object(DateTime)#%d (3) {
  ["date"]=>
  string(26) "2001-11-29 %d:%d:%d.%d"
  ["timezone_type"]=>
@@ -96,7 +96,7 @@ array(4) {

 string(6) "Y-m-d+"
 string(10) "2001-11-29"
-object(DateTime)#2 (3) {
+object(DateTime)#%d (3) {
  ["date"]=>
  string(26) "2001-11-29 %d:%d:%d.%d"
  ["timezone_type"]=>
@@ -139,7 +139,7 @@ array(4) {

 string(7) "Y-m-d +"
 string(11) "2001-11-29 "
-object(DateTime)#2 (3) {
+object(DateTime)#%d (3) {
  ["date"]=>
  string(26) "2001-11-29 %d:%d:%d.%d"
  ["timezone_type"]=>
@@ -518,7 +518,7 @@ static HashTable* dom_get_debug_info_helper(zval *object, int *is_temp TSRMLS_DC
 			value = null_value;
 		} else if (Z_TYPE_P(value) == IS_OBJECT) {
 			/* these are zvalues create on demand, with refcount and is_ref
-			 * status left in an uninitalized stated */
+			 * status left in an uninitialized stated */
 			zval_dtor(value);
 			efree(value);

@@ -9,7 +9,7 @@ Test eregi() function : basic functionality - confirm case insensitivity
 */

 /*
- * Test basic funtionality of eregi()
+ * Test basic functionality of eregi()
 */

 echo "*** Testing eregi() : basic functionality ***\n";
@@ -2426,11 +2426,11 @@ static void* exif_ifd_make_value(image_info_data *info_data, int motorola_intel
 					data_ptr += 8;
 					break;
 				case TAG_FMT_SINGLE:
-					memmove(data_ptr, &info_data->value.f, byte_count);
+					memmove(data_ptr, &info_value->f, 4);
 					data_ptr += 4;
 					break;
 				case TAG_FMT_DOUBLE:
-					memmove(data_ptr, &info_data->value.d, byte_count);
+					memmove(data_ptr, &info_value->d, 8);
 					data_ptr += 8;
 					break;
 			}
@@ -0,0 +1,17 @@
+--TEST--
+Bug #68113 (Heap corruption in exif_thumbnail())
+--SKIPIF--
+<?php
+extension_loaded("exif") or die("skip need exif");
+?>
+--FILE--
+<?php
+var_dump(exif_thumbnail(__DIR__."/bug68113.jpg"));
+?>
+Done
+--EXPECTF--
+Warning: exif_thumbnail(bug68113.jpg): File structure corrupted in %s/bug68113.php on line 2
+
+Warning: exif_thumbnail(bug68113.jpg): Invalid JPEG file in %s/bug68113.php on line 2
+bool(false)
+Done
@@ -115198,7 +115198,7 @@ const unsigned char php_magic_database[2606480] = {
 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
 0x00, 0x00, 0x40, 0x00, 0x3D, 0x1B, 0x11, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
-0x00, 0x00, 0x00, 0x00, 0x34, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+0x00, 0x00, 0x00, 0x00, 0x34, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
 0x5E, 0x5C, 0x73, 0x7B, 0x30, 0x2C, 0x31, 0x30, 0x30, 0x7D, 0x42, 0x45, 0x47, 0x49, 0x4E, 0x5C, 
 0x73, 0x7B, 0x30, 0x2C, 0x31, 0x30, 0x30, 0x7D, 0x5B, 0x7B, 0x5D, 0x00, 0x00, 0x00, 0x00, 0x00, 
 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
@@ -1,6 +1,6 @@
 diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 --- libmagic.orig/apprentice.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/apprentice.c	Fri Apr 11 12:36:52 2014
+++ libmagic/apprentice.c	Mon Apr 14 23:42:51 2014
@@ -29,6 +29,8 @@
  * apprentice - make one pass through /etc/magic, learning its secrets.
  */
@@ -833,7 +833,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 	}
 diff -u libmagic.orig/ascmagic.c libmagic/ascmagic.c
 --- libmagic.orig/ascmagic.c	Wed Oct 31 18:03:01 2012
-+++ libmagic/ascmagic.c	Mon Mar 10 16:40:55 2014
+++ libmagic/ascmagic.c	Mon Apr 14 23:42:51 2014
@@ -139,7 +139,7 @@
 		/* malloc size is a conservative overestimate; could be
 		   improved, or at least realloced after conversion. */
@@ -872,7 +872,7 @@ diff -u libmagic.orig/ascmagic.c libmagic/ascmagic.c
 }
 diff -u libmagic.orig/cdf.c libmagic/cdf.c
 --- libmagic.orig/cdf.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/cdf.c	Tue May 27 22:22:35 2014
+++ libmagic/cdf.c	Tue Jul  1 09:00:09 2014
@@ -43,7 +43,17 @@
 #include <err.h>
 #endif
@@ -891,7 +891,25 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
 #include <string.h>
 #include <time.h>
 #include <ctype.h>
-@@ -296,7 +306,10 @@
+@@ -267,13 +277,15 @@
+ {
+ 	const char *b = (const char *)sst->sst_tab;
+ 	const char *e = ((const char *)p) + tail;
+	size_t ss = sst->sst_dirlen < h->h_min_size_standard_stream ?
+	    CDF_SHORT_SEC_SIZE(h) : CDF_SEC_SIZE(h);
+ 	(void)&line;
+-	if (e >= b && (size_t)(e - b) <= CDF_SEC_SIZE(h) * sst->sst_len)
+	if (e >= b && (size_t)(e - b) <= ss * sst->sst_len)
+ 		return 0;
+ 	DPRINTF(("%d: offset begin %p < end %p || %" SIZE_T_FORMAT "u"
+ 	    " > %" SIZE_T_FORMAT "u [%" SIZE_T_FORMAT "u %"
+ 	    SIZE_T_FORMAT "u]\n", line, b, e, (size_t)(e - b),
+-	    CDF_SEC_SIZE(h) * sst->sst_len, CDF_SEC_SIZE(h), sst->sst_len));
+	    ss * sst->sst_len, ss, sst->sst_len));
+ 	errno = EFTYPE;
+ 	return -1;
+ }
+@@ -296,7 +308,10 @@
 	if (info->i_fd == -1)
 		return -1;
 
@@ -903,7 +921,54 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
 		return -1;
 
 	return (ssize_t)len;
-@@ -810,6 +823,10 @@
+@@ -352,10 +367,10 @@
+ 	size_t ss = CDF_SHORT_SEC_SIZE(h);
+ 	size_t pos = CDF_SHORT_SEC_POS(h, id);
+ 	assert(ss == len);
+-	if (pos > CDF_SEC_SIZE(h) * sst->sst_len) {
+	if (pos + len > CDF_SEC_SIZE(h) * sst->sst_len) {
+ 		DPRINTF(("Out of bounds read %" SIZE_T_FORMAT "u > %"
+ 		    SIZE_T_FORMAT "u\n",
+-		    pos, CDF_SEC_SIZE(h) * sst->sst_len));
+		    pos + len, CDF_SEC_SIZE(h) * sst->sst_len));
+ 		return -1;
+ 	}
+ 	(void)memcpy(((char *)buf) + offs,
+@@ -455,7 +470,8 @@
+ cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size)
+ {
+ 	size_t i, j;
+-	cdf_secid_t maxsector = (cdf_secid_t)(sat->sat_len * size);
+	cdf_secid_t maxsector = (cdf_secid_t)((sat->sat_len * size)
+	    / sizeof(maxsector));
+ 
+ 	DPRINTF(("Chain:"));
+ 	for (j = i = 0; sid >= 0; i++, j++) {
+@@ -465,8 +481,8 @@
+ 			errno = EFTYPE;
+ 			return (size_t)-1;
+ 		}
+-		if (sid > maxsector) {
+-			DPRINTF(("Sector %d > %d\n", sid, maxsector));
+		if (sid >= maxsector) {
+			DPRINTF(("Sector %d >= %d\n", sid, maxsector));
+ 			errno = EFTYPE;
+ 			return (size_t)-1;
+ 		}
+@@ -796,7 +812,11 @@
+ 	if (cdf_check_stream_offset(sst, h, e, 0, __LINE__) == -1)
+ 		goto out;
+ 	for (i = 0; i < sh.sh_properties; i++) {
+-		size_t ofs = CDF_GETUINT32(p, (i << 1) + 1);
+		size_t ofs, tail = (i << 1) + 1;
+		if (cdf_check_stream_offset(sst, h, p, tail * sizeof(uint32_t),
+		    __LINE__) == -1)
+			goto out;
+		ofs = CDF_GETUINT32(p, tail);
+ 		q = (const uint8_t *)(const void *)
+ 		    ((const char *)(const void *)p + ofs
+ 		    - 2 * sizeof(uint32_t));
+@@ -810,6 +830,10 @@
 		    i, inp[i].pi_id, inp[i].pi_type, q - p, offs));
 		if (inp[i].pi_type & CDF_VECTOR) {
 			nelements = CDF_GETUINT32(q, 1);
@@ -914,7 +979,7 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
 			o = 2;
 		} else {
 			nelements = 1;
-@@ -884,7 +901,9 @@
+@@ -884,7 +908,9 @@
 			}
 			DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n",
 			    nelements));
@@ -925,7 +990,7 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
 				uint32_t l = CDF_GETUINT32(q, o);
 				inp[i].pi_str.s_len = l;
 				inp[i].pi_str.s_buf = (const char *)
-@@ -929,7 +948,7 @@
+@@ -929,7 +955,7 @@
 cdf_unpack_summary_info(const cdf_stream_t *sst, const cdf_header_t *h,
     cdf_summary_info_header_t *ssi, cdf_property_info_t **info, size_t *count)
 {
@@ -934,7 +999,7 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
 	const cdf_summary_info_header_t *si =
 	    CAST(const cdf_summary_info_header_t *, sst->sst_tab);
 	const cdf_section_declaration_t *sd =
-@@ -944,21 +963,13 @@
+@@ -944,21 +970,13 @@
 	ssi->si_os = CDF_TOLE2(si->si_os);
 	ssi->si_class = si->si_class;
 	cdf_swap_class(&ssi->si_class);
@@ -959,7 +1024,7 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
 	return 0;
 }
 
-@@ -1132,7 +1143,7 @@
+@@ -1132,7 +1150,7 @@
 	cdf_directory_t *d;
 	char name[__arraycount(d->d_name)];
 	cdf_stream_t scn;
@@ -968,7 +1033,7 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
 
 	static const char *types[] = { "empty", "user storage",
 	    "user stream", "lockbytes", "property", "root storage" };
-@@ -1185,7 +1196,7 @@
+@@ -1185,7 +1203,7 @@
 cdf_dump_property_info(const cdf_property_info_t *info, size_t count)
 {
 	cdf_timestamp_t tp;
@@ -977,7 +1042,7 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
 	char buf[64];
 	size_t i, j;
 
-@@ -1229,7 +1240,11 @@
+@@ -1229,7 +1247,11 @@
 			break;
 		case CDF_FILETIME:
 			tp = info[i].pi_tp;
@@ -991,7 +1056,7 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
 			} else {
 diff -u libmagic.orig/cdf.h libmagic/cdf.h
 --- libmagic.orig/cdf.h	Wed Oct 31 18:03:01 2012
-+++ libmagic/cdf.h	Mon Dec  2 15:25:29 2013
+++ libmagic/cdf.h	Mon Apr 14 23:32:55 2014
@@ -35,10 +35,12 @@
 #ifndef _H_CDF_
 #define _H_CDF_
@@ -1034,7 +1099,7 @@ diff -u libmagic.orig/cdf.h libmagic/cdf.h
 void cdf_unpack_header(cdf_header_t *, char *);
 diff -u libmagic.orig/cdf_time.c libmagic/cdf_time.c
 --- libmagic.orig/cdf_time.c	Wed Oct 31 18:03:01 2012
-+++ libmagic/cdf_time.c	Mon Dec  2 15:25:29 2013
+++ libmagic/cdf_time.c	Mon Apr 14 23:32:55 2014
@@ -96,7 +96,7 @@
 }
 
@@ -1094,7 +1159,7 @@ diff -u libmagic.orig/cdf_time.c libmagic/cdf_time.c
 	static const char *ref = "Sat Apr 23 01:30:00 1977";
 diff -u libmagic.orig/compress.c libmagic/compress.c
 --- libmagic.orig/compress.c	Sun Jan  6 21:35:43 2013
-+++ libmagic/compress.c	Mon Dec  2 15:25:29 2013
+++ libmagic/compress.c	Mon Apr 14 23:42:51 2014
@@ -32,6 +32,7 @@
  *	uncompress(method, old, n, newch) - uncompress old into new, 
  *					    using method, return sizeof new
@@ -1257,7 +1322,7 @@ diff -u libmagic.orig/compress.c libmagic/compress.c
 +#endif /* if PHP_FILEINFO_UNCOMPRESS */
 diff -u libmagic.orig/file.h libmagic/file.h
 --- libmagic.orig/file.h	Mon Feb 18 16:40:59 2013
-+++ libmagic/file.h	Mon Mar 10 16:40:55 2014
+++ libmagic/file.h	Mon Apr 14 23:42:51 2014
@@ -33,11 +33,9 @@
 #ifndef __file_h__
 #define __file_h__
@@ -1467,7 +1532,7 @@ diff -u libmagic.orig/file.h libmagic/file.h
 #endif /* __file_h__ */
 diff -u libmagic.orig/fsmagic.c libmagic/fsmagic.c
 --- libmagic.orig/fsmagic.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/fsmagic.c	Mon Dec  2 15:25:29 2013
+++ libmagic/fsmagic.c	Mon Apr 14 23:42:51 2014
@@ -59,27 +59,21 @@
 # define minor(dev)  ((dev) & 0xff)
 #endif
@@ -1834,7 +1899,7 @@ diff -u libmagic.orig/fsmagic.c libmagic/fsmagic.c
 }
 diff -u libmagic.orig/funcs.c libmagic/funcs.c
 --- libmagic.orig/funcs.c	Wed Oct 31 18:03:01 2012
-+++ libmagic/funcs.c	Mon Mar 10 16:40:55 2014
+++ libmagic/funcs.c	Mon Apr 14 23:42:51 2014
@@ -41,52 +41,42 @@
 #if defined(HAVE_WCTYPE_H)
 #include <wctype.h>
@@ -2128,7 +2193,7 @@ diff -u libmagic.orig/funcs.c libmagic/funcs.c
 +
 diff -u libmagic.orig/magic.c libmagic/magic.c
 --- libmagic.orig/magic.c	Fri Jan 11 17:43:09 2013
-+++ libmagic/magic.c	Mon Dec  2 15:29:02 2013
+++ libmagic/magic.c	Mon Apr 14 23:42:51 2014
@@ -25,11 +25,6 @@
  * SUCH DAMAGE.
  */
@@ -2472,7 +2537,7 @@ diff -u libmagic.orig/magic.c libmagic/magic.c
 magic_error(struct magic_set *ms)
 diff -u libmagic.orig/magic.h libmagic/magic.h
 --- libmagic.orig/magic.h	Thu Mar 21 18:52:42 2013
-+++ libmagic/magic.h	Mon Dec  2 15:25:29 2013
+++ libmagic/magic.h	Mon Apr 14 23:42:51 2014
@@ -87,6 +87,7 @@
 
 const char *magic_getpath(const char *, int);
@@ -2491,14 +2556,14 @@ diff -u libmagic.orig/magic.h libmagic/magic.h
 
 diff -u libmagic.orig/print.c libmagic/print.c
 --- libmagic.orig/print.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/print.c	Mon Dec  2 15:29:02 2013
-@@ -28,13 +28,17 @@
- /*
+++ libmagic/print.c	Mon Apr 14 23:42:51 2014
+@@ -29,12 +29,17 @@
  * print.c - debugging printout routines
  */
+ 
 +#define _GNU_SOURCE
 +#include "php.h"
- 
+
 #include "file.h"
 +#include "cdf.h"
 
@@ -2510,7 +2575,7 @@ diff -u libmagic.orig/print.c libmagic/print.c
 #include <string.h>
 #include <stdarg.h>
 #include <stdlib.h>
-@@ -43,188 +47,28 @@
+@@ -43,188 +48,28 @@
 #endif
 #include <time.h>
 
@@ -2711,7 +2776,7 @@ diff -u libmagic.orig/print.c libmagic/print.c
 }
 
 protected const char *
-@@ -235,7 +79,7 @@
+@@ -235,7 +80,7 @@
 	struct tm *tm;
 
 	if (flags & FILE_T_WINDOWS) {
@@ -2722,7 +2787,7 @@ diff -u libmagic.orig/print.c libmagic/print.c
 	}
 diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
 --- libmagic.orig/readcdf.c	Wed Oct 31 18:03:01 2012
-+++ libmagic/readcdf.c	Thu Apr 24 19:54:40 2014
+++ libmagic/readcdf.c	Tue May 27 22:17:37 2014
@@ -30,7 +30,11 @@
 #endif
 
@@ -2798,7 +2863,7 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
 			    return -1;
 diff -u libmagic.orig/readelf.c libmagic/readelf.c
 --- libmagic.orig/readelf.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/readelf.c	Mon Dec  2 15:25:29 2013
+++ libmagic/readelf.c	Mon Apr 14 23:42:51 2014
@@ -48,8 +48,8 @@
 private int dophn_exec(struct magic_set *, int, int, int, off_t, int, size_t,
     off_t, int *, int);
@@ -3050,7 +3115,7 @@ diff -u libmagic.orig/readelf.c libmagic/readelf.c
 	if (fstat(fd, &st) == -1) {
 diff -u libmagic.orig/readelf.h libmagic/readelf.h
 --- libmagic.orig/readelf.h	Thu Mar 21 18:45:14 2013
-+++ libmagic/readelf.h	Mon Dec  2 15:25:29 2013
+++ libmagic/readelf.h	Mon Apr 14 23:42:51 2014
@@ -44,9 +44,17 @@
 typedef uint32_t	Elf32_Word;
 typedef uint8_t		Elf32_Char;
@@ -3071,7 +3136,7 @@ diff -u libmagic.orig/readelf.h libmagic/readelf.h
 typedef uint8_t		Elf64_Char;
 diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 --- libmagic.orig/softmagic.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/softmagic.c	Mon Mar 10 16:40:55 2014
+++ libmagic/softmagic.c	Tue Jul  1 09:00:09 2014
@@ -41,6 +41,11 @@
 #include <stdlib.h>
 #include <time.h>
@@ -3221,7 +3286,29 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 			break; \
 		} \
 
-@@ -1145,9 +1130,6 @@
+@@ -896,10 +881,18 @@
+ 		return 1;
+ 	}
+ 	case FILE_PSTRING: {
+-		char *ptr1 = p->s, *ptr2 = ptr1 + file_pstring_length_size(m);
+		size_t sz = file_pstring_length_size(m);
+		char *ptr1 = p->s, *ptr2 = ptr1 + sz;
+ 		size_t len = file_pstring_get_length(m, ptr1);
+-		if (len >= sizeof(p->s))
+-			len = sizeof(p->s) - 1;
+		if (len >= sizeof(p->s)) {
+			/*
+			 * The size of the pascal string length (sz)
+			 * is 1, 2, or 4. We need at least 1 byte for NUL
+			 * termination, but we've already truncated the
+			 * string by p->s, so we need to deduct sz.
+			 */ 
+			len = sizeof(p->s) - sz;
+		}
+ 		while (len--)
+ 			*ptr1++ = *ptr2++;
+ 		*ptr1 = '\0';
+@@ -1145,9 +1138,6 @@
 		    "nbytes=%zu, count=%u)\n", m->type, m->flag, offset, o,
 		    nbytes, count);
 		mdebug(offset, (char *)(void *)p, sizeof(union VALUETYPE));
@@ -3231,7 +3318,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 	}
 
 	if (m->flag & INDIR) {
-@@ -1191,7 +1173,7 @@
+@@ -1191,7 +1181,7 @@
 		}
 		switch (cvt_flip(m->in_type, flip)) {
 		case FILE_BYTE:
@@ -3240,7 +3327,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1226,7 +1208,7 @@
+@@ -1226,7 +1216,7 @@
 				offset = ~offset;
 			break;
 		case FILE_BESHORT:
@@ -3249,7 +3336,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1278,7 +1260,7 @@
+@@ -1278,7 +1268,7 @@
 				offset = ~offset;
 			break;
 		case FILE_LESHORT:
@@ -3258,7 +3345,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1330,7 +1312,7 @@
+@@ -1330,7 +1320,7 @@
 				offset = ~offset;
 			break;
 		case FILE_SHORT:
@@ -3267,7 +3354,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1367,7 +1349,7 @@
+@@ -1367,7 +1357,7 @@
 			break;
 		case FILE_BELONG:
 		case FILE_BEID3:
@@ -3276,7 +3363,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1438,7 +1420,7 @@
+@@ -1438,7 +1428,7 @@
 			break;
 		case FILE_LELONG:
 		case FILE_LEID3:
@@ -3285,7 +3372,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1508,7 +1490,7 @@
+@@ -1508,7 +1498,7 @@
 				offset = ~offset;
 			break;
 		case FILE_MELONG:
@@ -3294,7 +3381,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1578,7 +1560,7 @@
+@@ -1578,7 +1568,7 @@
 				offset = ~offset;
 			break;
 		case FILE_LONG:
@@ -3303,7 +3390,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1644,23 +1626,20 @@
+@@ -1644,23 +1634,20 @@
 		if ((ms->flags & MAGIC_DEBUG) != 0) {
 			mdebug(offset, (char *)(void *)p,
 			    sizeof(union VALUETYPE));
@@ -3329,7 +3416,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 			return 0;
 		break;
 
-@@ -1679,38 +1658,40 @@
+@@ -1679,38 +1666,40 @@
 	case FILE_FLOAT:
 	case FILE_BEFLOAT:
 	case FILE_LEFLOAT:
@@ -3376,7 +3463,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 		if ((ms->flags & MAGIC_DEBUG) != 0)
 			fprintf(stderr, "indirect @offs=%u[%d]\n", offset, rv);
 		rbuf = ms->o.buf;
-@@ -1718,16 +1699,26 @@
+@@ -1718,16 +1707,26 @@
 		ms->offset = soffset;
 		if (rv == 1) {
 			if ((ms->flags & (MAGIC_MIME|MAGIC_APPLE)) == 0 &&
@@ -3407,7 +3494,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 			return 0;
 		sbuf = m->value.s;
 		if (*sbuf == '^') {
-@@ -1837,6 +1828,42 @@
+@@ -1837,6 +1836,42 @@
 	return file_strncmp(a, b, len, flags);
 }
 
@@ -3450,7 +3537,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 private int
 magiccheck(struct magic_set *ms, struct magic *m)
 {
-@@ -1996,69 +2023,157 @@
+@@ -1996,69 +2031,157 @@
 		break;
 	}
 	case FILE_REGEX: {
@@ -3663,4 +3750,3 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 	default:
 		file_magerror(ms, "invalid type %d in magiccheck()", m->type);
 		return -1;
-
@@ -1269,7 +1269,7 @@ file_signextend(struct magic_set *ms, struct magic *m, uint64_t v)
 		 * the sign extension must have happened.
 		 */
 		case FILE_BYTE:
-			v = (char) v;
+			v = (signed char) v;
 			break;
 		case FILE_SHORT:
 		case FILE_BESHORT:
@@ -820,7 +820,7 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 		q = (const uint8_t *)(const void *)
 		    ((const char *)(const void *)p + ofs
 		    - 2 * sizeof(uint32_t));
-		if (q > e) {
+		if (q < p || q > e) {
 			DPRINTF(("Ran of the end %p > %p\n", q, e));
 			goto out;
 		}
@@ -372,6 +372,13 @@ donote(struct magic_set *ms, void *vbuf, size_t offset, size_t size,
 	uint32_t namesz, descsz;
 	unsigned char *nbuf = CAST(unsigned char *, vbuf);

+	if (xnh_sizeof + offset > size) {
+		/*
+		 * We're out of note headers.
+		 */
+		return xnh_sizeof + offset;
+	}
+
 	(void)memcpy(xnh_addr, &nbuf[offset], xnh_sizeof);
 	offset += xnh_sizeof;

@@ -58,7 +58,7 @@ private int32_t mprint(struct magic_set *, struct magic *);
 private int32_t moffset(struct magic_set *, struct magic *);
 private void mdebug(uint32_t, const char *, size_t);
 private int mcopy(struct magic_set *, union VALUETYPE *, int, int,
-    const unsigned char *, uint32_t, size_t, size_t);
+    const unsigned char *, uint32_t, size_t, struct magic *);
 private int mconvert(struct magic_set *, struct magic *, int);
 private int print_sep(struct magic_set *, int);
 private int handle_annotation(struct magic_set *, struct magic *);
@@ -1003,7 +1003,7 @@ mdebug(uint32_t offset, const char *str, size_t len)

 private int
 mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
-    const unsigned char *s, uint32_t offset, size_t nbytes, size_t linecnt)
+    const unsigned char *s, uint32_t offset, size_t nbytes, struct magic *m)
 {
 	/*
 	 * Note: FILE_SEARCH and FILE_REGEX do not actually copy
@@ -1023,15 +1023,24 @@ mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
 			const char *last;	/* end of search region */
 			const char *buf;	/* start of search region */
 			const char *end;
-			size_t lines;
+			size_t lines, linecnt, bytecnt;

+			linecnt = m->str_range;
+			bytecnt = linecnt * 80;
+
+			if (bytecnt == 0) {
+				bytecnt = 8192;
+			}
+			if (bytecnt > nbytes) {
+				bytecnt = nbytes;
+			}
 			if (s == NULL) {
 				ms->search.s_len = 0;
 				ms->search.s = NULL;
 				return 0;
 			}
 			buf = RCAST(const char *, s) + offset;
-			end = last = RCAST(const char *, s) + nbytes;
+			end = last = RCAST(const char *, s) + bytecnt;
 			/* mget() guarantees buf <= last */
 			for (lines = linecnt, b = buf; lines && b < end &&
 			     ((b = CAST(const char *,
@@ -1044,7 +1053,7 @@ mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
 					b++;
 			}
 			if (lines)
-				last = RCAST(const char *, s) + nbytes;
+				last = RCAST(const char *, s) + bytecnt;

 			ms->search.s = buf;
 			ms->search.s_len = last - buf;
@@ -1118,7 +1127,6 @@ mget(struct magic_set *ms, const unsigned char *s, struct magic *m,
    int *need_separator, int *returnval)
 {
 	uint32_t soffset, offset = ms->offset;
-	uint32_t count = m->str_range;
 	int rv, oneed_separator;
 	char *sbuf, *rbuf;
 	union VALUETYPE *p = &ms->ms_value;
@@ -1130,13 +1138,12 @@ mget(struct magic_set *ms, const unsigned char *s, struct magic *m,
 	}

 	if (mcopy(ms, p, m->type, m->flag & INDIR, s, (uint32_t)(offset + o),
-	    (uint32_t)nbytes, count) == -1)
+	    (uint32_t)nbytes, m) == -1)
 		return -1;

 	if ((ms->flags & MAGIC_DEBUG) != 0) {
 		fprintf(stderr, "mget(type=%d, flag=%x, offset=%u, o=%zu, "
-		    "nbytes=%zu, count=%u)\n", m->type, m->flag, offset, o,
-		    nbytes, count);
+		    "nbytes=%zu)\n", m->type, m->flag, offset, o, nbytes);
 		mdebug(offset, (char *)(void *)p, sizeof(union VALUETYPE));
 	}

@@ -1627,7 +1634,7 @@ mget(struct magic_set *ms, const unsigned char *s, struct magic *m,
 			if ((ms->flags & MAGIC_DEBUG) != 0)
 				fprintf(stderr, "indirect +offs=%u\n", offset);
 		}
-		if (mcopy(ms, p, m->type, 0, s, offset, nbytes, count) == -1)
+		if (mcopy(ms, p, m->type, 0, s, offset, nbytes, m) == -1)
 			return -1;
 		ms->offset = offset;

@@ -2057,7 +2064,7 @@ magiccheck(struct magic_set *ms, struct magic *m)
 			zval *retval;
 			zval *subpats;
 			char *haystack;
-			
+
 			MAKE_STD_ZVAL(retval);
 			ALLOC_INIT_ZVAL(subpats);
 			
@@ -1,4 +1,4 @@
-Patches applied to file sources tree before generating magic.mgc
+Patches applied to file 5.14 sources tree before generating magic.mgc
 and before running create_data_file.php to create data_file.c.


@@ -17,14 +17,6 @@ diff --git a/magic/Magdir/commands b/magic/Magdir/commands
 index 67c3eee..4a7d8dd 100644
 --- a/magic/Magdir/commands
 +++ b/magic/Magdir/commands
-@@ -1,6 +1,6 @@
- 
- #------------------------------------------------------------------------------
-# $File: commands,v 1.44 2013/02/05 15:20:47 christos Exp $
-+# $File: commands,v 1.45 2013/02/06 14:18:52 christos Exp $
- # commands:  file(1) magic for various shells and interpreters
- #
- #0	string/w	:			shell archive or script for antique kernel text
@@ -49,7 +49,7 @@
 !:mime	text/x-awk
 0	string/wt	#!\ /usr/bin/awk	awk script text executable
@@ -36,4 +28,56 @@ index 67c3eee..4a7d8dd 100644
 0	string/wt	#!\ /bin/rc	Plan 9 rc shell script text executable
 -- 
 1.8.5.5
+From 0b478f445b6b7540b58af5d1fe583fa9e48fd745 Mon Sep 17 00:00:00 2001
+From: Christos Zoulas <christos@zoulas.com>
+Date: Wed, 28 May 2014 19:52:36 +0000
+Subject: [PATCH] further optimize awk by not looking for the BEGIN regex until
+ we found the BEGIN (Jan Kaluza)
+
+---
+ magic/Magdir/commands | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/magic/Magdir/commands b/magic/Magdir/commands
+index bfffdef..26b2869 100644
+--- a/magic/Magdir/commands
+++ b/magic/Magdir/commands
+@@ -49,7 +49,8 @@
+ !:mime	text/x-awk
+ 0	string/wt	#!\ /usr/bin/awk	awk script text executable
+ !:mime	text/x-awk
+-0	regex		=^\\s{0,100}BEGIN\\s{0,100}[{]	awk script text
+0       search/16384    BEGIN
+>0	regex		=^\\s{0,100}BEGIN\\s{0,100}[{]	awk script text
+ 
+ # AT&T Bell Labs' Plan 9 shell
+ 0	string/wt	#!\ /bin/rc	Plan 9 rc shell script text executable
+-- 
+2.0.3
+
+From 71a8b6c0d758acb0f73e2e51421a711b5e9d6668 Mon Sep 17 00:00:00 2001
+From: Christos Zoulas <christos@zoulas.com>
+Date: Fri, 30 May 2014 16:48:44 +0000
+Subject: [PATCH] Limit regex search for BEGIN to the first 4K of the file.
+
+---
+ magic/Magdir/commands | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/magic/Magdir/commands b/magic/Magdir/commands
+index 26b2869..bcd0f43 100644
+--- a/magic/Magdir/commands
+++ b/magic/Magdir/commands
+@@ -49,8 +49,7 @@
+ !:mime	text/x-awk
+ 0	string/wt	#!\ /usr/bin/awk	awk script text executable
+ !:mime	text/x-awk
+-0       search/16384    BEGIN
+->0	regex		=^\\s{0,100}BEGIN\\s{0,100}[{]	awk script text
+0	regex/4096	=^\\s{0,100}BEGIN\\s{0,100}[{]	awk script text
+ 
+ # AT&T Bell Labs' Plan 9 shell
+ 0	string/wt	#!\ /bin/rc	Plan 9 rc shell script text executable
+-- 
+2.0.3

@@ -0,0 +1,35 @@
+--TEST--
+Bug #66731: file: extensive backtraking
+--SKIPIF--
+<?php
+if (!class_exists('finfo'))
+	die('skip no fileinfo extension');
+--FILE--
+<?php
+$fd = __DIR__.'/cve-2014-3538.data';
+
+file_put_contents($fd,
+  'try:' .
+  str_repeat("\n", 1000000));
+
+$fi = finfo_open(FILEINFO_NONE);
+$t = microtime(true);
+var_dump(finfo_file($fi, $fd));
+$t = microtime(true) - $t;
+finfo_close($fi);
+if ($t < 1) {
+	echo "Ok\n";
+} else {
+	printf("Failed, time=%.2f\n", $t);
+}
+
+?>
+Done
+--CLEAN--
+<?php
+@unlink(__DIR__.'/cve-2014-3538.data');
+?>
+--EXPECTF--
+string(%d) "%s"
+Ok
+Done
@@ -0,0 +1,22 @@
+--TEST--
+Bug #67296 (filter_input doesn't validate variables)
+--XFAIL--
+See Bug #49184
+--SKIPIF--
+<?php if (!extension_loaded("filter")) die("skip needs filter ext"); ?>
+--ENV--
+return <<<END
+HTTP_X_FORWARDED_FOR=example.com
+END;
+--FILE--
+<?php
+  var_dump(filter_input(INPUT_SERVER, "HTTP_X_FORWARDED_FOR", FILTER_UNSAFE_RAW));
+  var_dump($_SERVER["HTTP_X_FORWARDED_FOR"]);
+  var_dump(getenv("HTTP_X_FORWARDED_FOR"));
+  var_dump("done");
+?>
+--EXPECT--
+string(11) "example.com"
+string(11) "example.com"
+string(11) "example.com"
+string(4) "done"
@@ -18,5 +18,5 @@ var_dump(ftp_login($ftp, 'user', 'pass'));
 ftp_close($ftp);
 ?>
 --EXPECTF--
-Warning: ftp_login(): bogus msg in %sbug37799.php on line 8
+Warning: ftp_login(): %rdummy|bogus msg%r in %sbug37799.php on line 8
 bool(false)
@@ -124,6 +124,11 @@ static void _php_image_output_ctx(INTERNAL_FUNCTION_PARAMETERS, int image_type,
 				RETURN_FALSE;
 			}
 		} else if (Z_TYPE_P(to_zval) == IS_STRING) {
+			if (CHECK_ZVAL_NULL_PATH(to_zval)) {
+				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid 2nd parameter, filename must not contain null bytes");
+				RETURN_FALSE;
+			}
+
 			stream = php_stream_open_wrapper(Z_STRVAL_P(to_zval), "wb", REPORT_ERRORS|IGNORE_PATH|IGNORE_URL_WIN, NULL);
 			if (stream == NULL) {
 				RETURN_FALSE;
@@ -370,9 +370,10 @@ static void *fontFetch (char **error, void *key)
 	fontlist = gdEstrdup(a->fontlist);

 	/*
-	 * Must use gd_strtok_r else pointer corrupted by strtok in nested loop.
+	 * Must use gd_strtok_r becasuse strtok() isn't thread safe
 	 */
 	for (name = gd_strtok_r (fontlist, LISTSEPARATOR, &strtok_ptr); name; name = gd_strtok_r (0, LISTSEPARATOR, &strtok_ptr)) {
+		char *strtok_ptr_path;
 		/* make a fresh copy each time - strtok corrupts it. */
 		path = gdEstrdup (fontsearchpath);

@@ -388,7 +389,8 @@ static void *fontFetch (char **error, void *key)
 				break;
 			}
 		}
-		for (dir = strtok (path, PATHSEPARATOR); dir; dir = strtok (0, PATHSEPARATOR)) {
+		for (dir = gd_strtok_r (path, PATHSEPARATOR, &strtok_ptr_path); dir;
+		     dir = gd_strtok_r (0, PATHSEPARATOR, &strtok_ptr_path)) {
 			if (!strcmp(dir, ".")) {
 				TSRMLS_FETCH();
 #if HAVE_GETCWD
@@ -31,12 +31,17 @@ gdImagePtr gdImageCreateFromXpm (char *filename)
 	if (ret != XpmSuccess) {
 		return 0;
 	}
+	number = image.ncolors;
+	for(i = 0; i < number; i++) {
+		if (!image.colorTable[i].c_color) {
+			goto done;
+		}
+	}

 	if (!(im = gdImageCreate(image.width, image.height))) {
 		goto done;
 	}

-	number = image.ncolors;
 	colors = (int *) safe_emalloc(number, sizeof(int), 0);
 	for (i = 0; i < number; i++) {
 		switch (strlen (image.colorTable[i].c_color)) {
@@ -20,6 +20,6 @@ echo '(' . $bbox[6] . ', ' . $bbox[7] . ")\n";
 ?>
 --EXPECTF--
 (-1, 15)
-(156, 15)
-(156, -48)
+(15%d, 15)
+(15%d, -48)
 (-1, -48)
@@ -0,0 +1,31 @@
+--TEST--
+Testing null byte injection in imagegd2
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagegd2 TEST\n";
+imagegd2($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagegd2 TEST
+
+Warning: imagegd2() expects parameter 2 to be a valid path, string given in %s on line %d
+bool(false)
+bool(false)
@@ -0,0 +1,31 @@
+--TEST--
+Testing null byte injection in imagegd
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagegd TEST\n";
+imagegd($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagegd TEST
+
+Warning: imagegd() expects parameter 2 to be a valid path, string given in %s on line %d
+bool(false)
+bool(false)
@@ -0,0 +1,38 @@
+--TEST--
+Testing null byte injection in imagegif
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--SKIPIF--
+<?php
+$support = gd_info();
+if (!isset($support['GIF Create Support']) || $support['GIF Create Support'] === false) {
+	print 'skip gif support not available';
+}
+?>
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagegif TEST\n";
+imagegif($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagegif TEST
+
+Warning: imagegif(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
+bool(false)
+bool(false)
@@ -0,0 +1,38 @@
+--TEST--
+Testing null byte injection in imagejpeg
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--SKIPIF--
+<?php
+$support = gd_info();
+if (!isset($support['JPEG Support']) || $support['JPEG Support'] === false) {
+	print 'skip jpeg support not available';
+}
+?>
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagejpeg TEST\n";
+imagejpeg($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagejpeg TEST
+
+Warning: imagejpeg(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
+bool(false)
+bool(false)
@@ -0,0 +1,38 @@
+--TEST--
+Testing null byte injection in imagepng
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--SKIPIF--
+<?php
+$support = gd_info();
+if (!isset($support['PNG Support']) || $support['PNG Support'] === false) {
+	print 'skip png support not available';
+}
+?>
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagepng TEST\n";
+imagepng($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagepng TEST
+
+Warning: imagepng(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
+bool(false)
+bool(false)
@@ -0,0 +1,38 @@
+--TEST--
+Testing null byte injection in imagewbmp
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--SKIPIF--
+<?php
+$support = gd_info();
+if (!isset($support['WBMP Support']) || $support['WBMP Support'] === false) {
+	print 'skip wbmp support not available';
+}
+?>
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagewbmp TEST\n";
+imagewbmp($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagewbmp TEST
+
+Warning: imagewbmp(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
+bool(false)
+bool(false)
@@ -0,0 +1,38 @@
+--TEST--
+Testing null byte injection in imagewebp
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--SKIPIF--
+<?php
+$support = gd_info();
+if (!isset($support['WEBP Support']) || $support['WEBP Support'] === false) {
+	print 'skip webp support not available';
+}
+?>
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagewebp TEST\n";
+imagewebp($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagewbmp TEST
+
+Warning: imagewebp(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
+bool(false)
+bool(false)
@@ -324,30 +324,6 @@ static void _php_gmpnum_free(zend_rsrc_list_entry *rsrc TSRMLS_DC);
 #	define MAX_BASE 36
 #endif

-/* {{{ gmp_emalloc
- */
-static void *gmp_emalloc(size_t size)
-{
-	return emalloc(size);
-}
-/* }}} */
-
-/* {{{ gmp_erealloc
- */
-static void *gmp_erealloc(void *ptr, size_t old_size, size_t new_size)
-{
-	return erealloc(ptr, new_size);
-}
-/* }}} */
-
-/* {{{ gmp_efree
- */
-static void gmp_efree(void *ptr, size_t size)
-{
-	efree(ptr);
-}
-/* }}} */
-
 /* {{{ ZEND_GINIT_FUNCTION
 */
 static ZEND_GINIT_FUNCTION(gmp)
@@ -369,8 +345,6 @@ ZEND_MODULE_STARTUP_D(gmp)
 #endif
 	REGISTER_STRING_CONSTANT("GMP_VERSION", (char *)gmp_version, CONST_CS | CONST_PERSISTENT);

-	mp_set_memory_functions(gmp_emalloc, gmp_erealloc, gmp_efree);
-
 	return SUCCESS;
 }
 /* }}} */
@@ -73,7 +73,9 @@ PHP_FUNCTION( numfmt_parse )
 	}

 #if ICU_LOCALE_BUG && defined(LC_NUMERIC)
-	oldlocale = setlocale(LC_NUMERIC, "C");
+	/* need to copy here since setlocale may change it later */
+	oldlocale = estrdup(setlocale(LC_NUMERIC, NULL));
+	setlocale(LC_NUMERIC, "C");
 #endif

 	switch(type) {
@@ -100,6 +102,7 @@ PHP_FUNCTION( numfmt_parse )
 	}
 #if ICU_LOCALE_BUG && defined(LC_NUMERIC)
 	setlocale(LC_NUMERIC, oldlocale);
+	efree(oldlocale);
 #endif
 	if(zposition) {
 		zval_dtor(zposition);
@@ -15,6 +15,7 @@ function ut_main()
 	setlocale(LC_ALL, $de_locale);
 	$fmt = new NumberFormatter("de", NumberFormatter::DECIMAL );
 	$numeric = $fmt->parse("1234,56");
+	setlocale(LC_ALL, "C"); // reset for printing
 	$res_str .= "$numeric\n";
    	return $res_str;
 }
@@ -0,0 +1,25 @@
+--TEST--
+Bug #67052 - NumberFormatter::parse() resets LC_NUMERIC setting
+--SKIPIF--
+<?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?>
+--FILE--
+<?php
+
+function ut_main()
+{
+	setlocale(LC_ALL, 'de_DE');
+
+	$fmt = new NumberFormatter( 'sl_SI.UTF-8', NumberFormatter::DECIMAL);
+	$num = "1.234.567,891";
+	$res_str =  $fmt->parse($num)."\n";
+	$res_str .=  setlocale(LC_NUMERIC, 0);
+    	return $res_str;
+}
+
+include_once( 'ut_common.inc' );
+ut_run();
+
+?>
+--EXPECT--
+1234567,891
+de_DE
@@ -368,7 +368,7 @@ static int json_utf8_to_utf16(unsigned short *utf16, char utf8[], int len) /* {{
 			}
 		}
 	} else {
-		/* Only check if utf8 string is valid, and compute utf16 lenght */
+		/* Only check if utf8 string is valid, and compute utf16 length */
 		for (j=0 ; pos < len ; j++) {
 			us = php_next_utf8_char((const unsigned char *)utf8, len, &pos, &status);
 			if (status != SUCCESS) {
@@ -385,6 +385,23 @@ static int _get_lderrno(LDAP *ldap)
 }
 /* }}} */

+/* {{{ _set_lderrno
+ */
+static void _set_lderrno(LDAP *ldap, int lderr)
+{
+#if !HAVE_NSLDAP
+#if LDAP_API_VERSION > 2000 || HAVE_ORALDAP
+	/* New versions of OpenLDAP do it this way */
+	ldap_set_option(ldap, LDAP_OPT_ERROR_NUMBER, &lderr);
+#else
+	ldap->ld_errno = lderr;
+#endif
+#else
+	ldap_set_lderrno(ldap, lderr, NULL, NULL);
+#endif
+}
+/* }}} */
+
 /* {{{ proto bool ldap_bind(resource link [, string dn [, string password]])
   Bind to LDAP directory */
 PHP_FUNCTION(ldap_bind)
@@ -399,18 +416,20 @@ PHP_FUNCTION(ldap_bind)
 		RETURN_FALSE;
 	}

+	ZEND_FETCH_RESOURCE(ld, ldap_linkdata *, &link, -1, "ldap link", le_link);
+
 	if (ldap_bind_dn != NULL && memchr(ldap_bind_dn, '\0', ldap_bind_dnlen) != NULL) {
+		_set_lderrno(ld->link, LDAP_INVALID_CREDENTIALS);
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "DN contains a null byte");
 		RETURN_FALSE;
 	}

 	if (ldap_bind_pw != NULL && memchr(ldap_bind_pw, '\0', ldap_bind_pwlen) != NULL) {
+		_set_lderrno(ld->link, LDAP_INVALID_CREDENTIALS);
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Password contains a null byte");
 		RETURN_FALSE;
 	}

-	ZEND_FETCH_RESOURCE(ld, ldap_linkdata *, &link, -1, "ldap link", le_link);
-
 	if ((rc = ldap_bind_s(ld->link, ldap_bind_dn, ldap_bind_pw, LDAP_AUTH_SIMPLE)) != LDAP_SUCCESS) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to bind to server: %s", ldap_err2string(rc));
 		RETURN_FALSE;
@@ -260,7 +260,7 @@ const mbfl_encoding *_php_mb_encoding_handler_ex(const php_mb_encoding_handler_i
 		goto out;
 	}

-	num = n; /* make sure to process initilized vars only */
+	num = n; /* make sure to process initialized vars only */
 	
 	/* initialize converter */
 	if (info->num_from_encodings <= 0) {
@@ -30,7 +30,7 @@ require_once("clean_table.inc");
 ?>
 --EXPECTF--
 I don\'t mind character sets, do I?\n
-Warning: mysql_query(): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'BOGUS_SQL' at line 1 in %s on line %d
+Warning: mysql_query(): You have an error in your SQL syntax; check the manual that corresponds to your %s server version for the right syntax to use near 'BOGUS_SQL' at line 1 in %s on line %d
 done!

 Warning: Unknown: 1 result set(s) not freed. Use mysql_free_result to free result sets which were requested using mysql_query() in %s on line %d
@@ -62,18 +62,18 @@ mysqli_close($link);
 --EXPECT--
 array(7) {
  [0]=>
-  float(3.14159274101)
+  float(3.141593)
  [1]=>
-  float(-9.99999997475E-7)
+  float(-1.0E-6)
  [2]=>
  float(0)
  [3]=>
-  float(999999995904)
+  float(1.0E+12)
  [4]=>
-  float(0.564642488956)
+  float(0.5646425)
  [5]=>
  float(1)
  [6]=>
-  float(8.88888914608E+14)
+  float(8.888889E+14)
 }
-done!
+done!
@@ -67,7 +67,7 @@ array(8) {
  [3]=>
  int(4999999)
  [4]=>
-  float(2345.60009766)
+  float(2345.6)
  [5]=>
  float(5678.89563)
  [6]=>
@@ -75,4 +75,4 @@ array(8) {
  [7]=>
  %unicode|string%(11) "mysql rulez"
 }
-done!
+done!
@@ -66,7 +66,7 @@ array(8) {
  [3]=>
  int(54)
  [4]=>
-  float(2.59999990463)
+  float(2.6)
  [5]=>
  float(58.89)
  [6]=>
@@ -74,4 +74,4 @@ array(8) {
  [7]=>
  %unicode|string%(3) "6.7"
 }
-done!
+done!
@@ -12,6 +12,9 @@ require_once('skipifconnectfailure.inc');
 	/*** test mysqli_connect 127.0.0.1 ***/
 	$mysql = new my_mysqli($host, $user, $passwd, $db, $port, $socket);

+	if (!mysqli_query($mysql, "SET sql_mode=''"))
+		printf("[002] Cannot set SQL-Mode, [%d] %s\n", mysqli_errno($mysql), mysqli_error($mysql));
+
 	$mysql->query("DROP TABLE IF EXISTS test_warnings");

 	$mysql->query("CREATE TABLE test_warnings (a int not null) ENGINE=myisam");
@@ -0,0 +1,58 @@
+--TEST--
+mysqli_float_handling - ensure 4 byte float is handled correctly
+--SKIPIF--
+<?php
+	require_once('skipif.inc');
+	require_once('skipifemb.inc');
+	require_once('skipifconnectfailure.inc');
+?>
+--FILE--
+<?php
+	require('connect.inc');
+	if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket)) {
+		printf("[001] [%d] %s\n", mysqli_connect_errno(), mysqli_connect_error());
+		die();
+	}
+
+
+	if (!mysqli_query($link, "DROP TABLE IF EXISTS test")) {
+		printf("[002] [%d] %s\n", mysqli_errno($link), mysqli_error($link));
+		die();
+	}
+
+	if (!mysqli_query($link, "CREATE TABLE test(id INT PRIMARY KEY, fp4 FLOAT, fp8 DOUBLE) ENGINE = InnoDB")) {
+		printf("[003] [%d] %s\n", mysqli_errno($link), mysqli_error($link));
+		die();
+	}
+
+	// Insert via string to make sure the real floating number gets to the DB
+	if (!mysqli_query($link, "INSERT INTO test(id, fp4, fp8) VALUES (1, 9.9999, 9.9999)")) {
+		printf("[004] [%d] %s\n", mysqli_errno($link), mysqli_error($link));
+		die();
+	}
+
+	if (!($stmt = mysqli_prepare($link, "SELECT id, fp4, fp8 FROM test"))) {
+		printf("[005] [%d] %s\n", mysqli_errno($link), mysqli_error($link));
+		die();
+	}
+
+	if (!mysqli_stmt_execute($stmt)) {
+		printf("[006] [%d] %s\n", mysqli_errno($link), mysqli_error($link));
+		die();
+	}
+
+
+	if (!($result = mysqli_stmt_get_result($stmt))) {
+		printf("[007] [%d] %s\n", mysqli_errno($link), mysqli_error($link));
+		die();
+	}
+
+	$data = mysqli_fetch_assoc($result);
+	print $data['id'] . ": " . $data['fp4'] . ": " . $data['fp8'] . "\n";
+?>
+--CLEAN--
+<?php
+	require_once("clean_table.inc");
+?>
+--EXPECTF--
+1: 9.9999: 9.9999
@@ -41,6 +41,11 @@ require_once('skipifconnectfailure.inc');
 	if (false !== ($tmp = mysqli_change_user($link, $user, $passwd, $db . '_unknown_really')))
 		printf("[009] Expecting false, got %s/%s\n", gettype($tmp), $tmp);

+	// Reconnect because after 3 failed change_user attempts, the server blocks you off.
+	if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
+		printf("[006] Cannot connect to the server using host=%s, user=%s, passwd=***, dbname=%s, port=%s, socket=%s\n",
+			$host, $user, $db, $port, $socket);
+
 	if (!mysqli_query($link, 'SET @mysqli_change_user_test_var=1'))
 		printf("[010] Failed to set test variable: [%d] %s\n", mysqli_errno($link), mysqli_error($link));

@@ -109,4 +114,4 @@ require_once('skipifconnectfailure.inc');
 	print "done!";
 ?>
 --EXPECTF--
-done!
+done!
@@ -43,6 +43,11 @@ if (!$IS_MYSQLND && (mysqli_get_server_version($link) < 50118 && mysqli_get_serv
 	if (false !== ($tmp = $mysqli->change_user($user, $passwd, $db . '_unknown_really')))
 		printf("[008] Expecting false, got %s/%s\n", gettype($tmp), $tmp);

+	// Reconnect because after 3 failed change_user attempts, the server blocks you off.
+	if (!$mysqli = new my_mysqli($host, $user, $passwd, $db, $port, $socket))
+		printf("[001] Cannot connect to the server using host=%s, user=%s, passwd=***, dbname=%s, port=%s, socket=%s\n",
+			$host, $user, $db, $port, $socket);
+
 	if (!$mysqli->query('SET @mysqli_change_user_test_var=1'))
 		printf("[009] Failed to set test variable: [%d] %s\n", $mysqli->errno, $mysqli->error);

@@ -81,4 +86,4 @@ if (!$IS_MYSQLND && (mysqli_get_server_version($link) < 50118 && mysqli_get_serv
 	print "done!";
 ?>
 --EXPECTF--
-done!
+done!
@@ -110,5 +110,5 @@ require_once('skipifconnectfailure.inc');
 	print "done!";
 ?>
 --EXPECTF--
-Warning: mysqli_query(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'NO_SQL' at line 1 in %s on line %d
+Warning: mysqli_query(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your %s server version for the right syntax to use near 'NO_SQL' at line 1 in %s on line %d
 done!
@@ -36,7 +36,7 @@ $port, $socket, mysqli_connect_errno(), mysqli_connect_error());
 mysqli_error($link));
 	}

-	if (!mysqli_query($link, 'CREATE TABLE test(id INT, label CHAR(1), PRIMARY
+	if (!mysqli_query($link, 'CREATE TABLE test(id INT, label CHAR(3), PRIMARY
 KEY(id)) ENGINE=' . $engine . " DEFAULT CHARSET=gbk")) {
 		printf("Failed to create test table: [%d] %s\n", mysqli_errno($link),
 mysqli_error($link));
@@ -287,21 +287,21 @@ require_once('skipifconnectfailure.inc');
 	require_once("clean_table.inc");
 ?>
 --EXPECTF--
-Warning: mysqli_multi_query(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'BAR; FOO' at line 1 in %s on line %d
+Warning: mysqli_multi_query(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your %s server version for the right syntax to use near 'BAR; FOO' at line 1 in %s on line %d

-Warning: mysqli_query(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'FOO' at line 1 in %s on line %d
+Warning: mysqli_query(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your %s server version for the right syntax to use near 'FOO' at line 1 in %s on line %d

 Warning: mysqli_change_user(): (%d/%d): Access denied for user '%s'@'%s' (using password: %s) in %s on line %d

 Warning: mysqli_kill(): processid should have positive value in %s on line %d

-Warning: mysqli_prepare(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'FOO' at line 1 in %s on line %d
+Warning: mysqli_prepare(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your %s server version for the right syntax to use near 'FOO' at line 1 in %s on line %d

-Warning: mysqli_real_query(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'FOO' at line 1 in %s on line %d
+Warning: mysqli_real_query(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your %s server version for the right syntax to use near 'FOO' at line 1 in %s on line %d

 Warning: mysqli_kill(): processid should have positive value in %s on line %d

-Warning: mysqli_stmt_prepare(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'FOO' at line 1 in %s on line %d
+Warning: mysqli_stmt_prepare(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your %s server version for the right syntax to use near 'FOO' at line 1 in %s on line %d
 [013] Access denied for user '%s'@'%s' (using password: YES)
 [016] Access denied for user '%s'@'%s' (using password: YES)
 done!
@@ -97,15 +97,15 @@ require_once('skipifconnectfailure.inc');
 	require_once("clean_table.inc");
 ?>
 --EXPECTF--
-Warning: mysqli_multi_query(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'BAR; FOO' at line 1 in %s on line %d
+Warning: mysqli_multi_query(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your %s server version for the right syntax to use near 'BAR; FOO' at line 1 in %s on line %d

-Warning: mysqli_query(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'FOO' at line 1 in %s on line %d
+Warning: mysqli_query(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your %s server version for the right syntax to use near 'FOO' at line 1 in %s on line %d

 Warning: mysqli_change_user(): (%d/%d): Access denied for user '%s'@'%s' (using password: %s) in %s on line %d

 Warning: mysqli_kill(): processid should have positive value in %s on line %d

-Warning: mysqli_real_query(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'FOO' at line 1 in %s on line %d
+Warning: mysqli_real_query(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your %s server version for the right syntax to use near 'FOO' at line 1 in %s on line %d

 Warning: mysqli_kill(): processid should have positive value in %s on line %d
 [011] Access denied for user '%s'@'%s' (using password: YES)
@@ -0,0 +1,120 @@
+--TEST--
+Multiple result set with PS
+--SKIPIF--
+<?php
+require_once('skipif.inc');
+require_once("connect.inc");
+if (!$IS_MYSQLND) {
+    die("skip mysqlnd only test");
+}
+require_once('skipifconnectfailure.inc');
+?>
+--FILE--
+<?php
+	require_once("connect.inc");
+	require('table.inc');
+
+	$stmt = mysqli_stmt_init($link);
+	if (!$link->query('DROP PROCEDURE IF EXISTS p123')) {
+		printf("[001] [%d] %s\n", $link->error, $link->errno);
+	}
+
+	if (!$link->query("CREATE PROCEDURE p123() BEGIN SELECT id+12, CONCAT_WS('-',label,'ahoi') FROM test ORDER BY id LIMIT 1; SELECT id + 42, CONCAT_WS('---',label, label) FROM test ORDER BY id LIMIT 1; END")) {
+		printf("[002] [%d] %s\n", $link->error, $link->errno);
+	}
+	
+	if (!($stmt = $link->prepare("CALL p123"))) {
+		printf("[003] [%d] %s\n", $stmt->error, $stmt->errno);
+	}
+
+	if (!$stmt->execute()) {
+		printf("[005] [%d] %s\n", $stmt->error, $stmt->errno);
+	}
+
+	$c_id = NULL;
+	$c_label = NULL;
+	if (!$stmt->bind_result($c_id, $c_label)) {
+		printf("[004] [%d] %s\n", $stmt->error, $stmt->errno);
+	}
+	var_dump("pre:",$c_id, $c_label);
+
+	if (!$stmt->fetch()) {
+		printf("[006] [%d] %s\n", $stmt->error, $stmt->errno);
+	}
+
+	var_dump("post:",$c_id, $c_label);
+
+	if ($stmt->fetch()) {
+		printf("[007] Shouldn't have fetched anything\n");
+		var_dump($c_id, $c_label);
+	}
+
+	if ($stmt->fetch()) {
+		printf("[008] No more rows expected\n");
+	}
+
+	if (!$stmt->more_results()) {
+		printf("[009] Expected more results\n");
+	} else {
+		var_dump("[009] next_result:", $stmt->next_result());
+	}
+
+	if (!$stmt->bind_result($c_id, $c_label)) {
+		printf("[010] [%d] %s\n", $stmt->error, $stmt->errno);
+	}
+	var_dump("pre:",$c_id, $c_label);
+
+	if (!$stmt->fetch()) {
+		printf("[011] [%d] %s\n", $stmt->error, $stmt->errno);
+	}
+
+	var_dump("post:",$c_id, $c_label);
+
+	if ($stmt->fetch()) {
+		printf("[012] No more rows expected\n");
+	}
+
+	if (!$stmt->more_results()) {
+		printf("[013] Expected more results\n");
+	} else {
+		var_dump("[013] next_result:", $stmt->next_result());
+	}
+
+	if ($stmt->more_results()) {
+		printf("[014] No more results expected\n");
+	} else {
+		printf("[014] No result, as expected\n");
+	}
+
+	$stmt->close();
+	$link->close();
+
+
+	echo "done";
+?>
+--CLEAN--
+<?php
+	require_once("connect.inc");
+	if (!$link->query('DROP PROCEDURE IF EXISTS p123')) {
+		printf("[001] [%d] %s\n", $link->error, $link->errno);
+	}
+?>
+--EXPECTF--
+string(4) "pre:"
+NULL
+NULL
+string(5) "post:"
+int(13)
+string(6) "a-ahoi"
+string(18) "[009] next_result:"
+bool(true)
+string(4) "pre:"
+int(13)
+string(6) "a-ahoi"
+string(5) "post:"
+int(43)
+string(5) "a---a"
+string(18) "[013] next_result:"
+bool(true)
+[014] No result, as expected
+done
@@ -12,6 +12,11 @@ if (!mysqli_query($link, 'DROP TABLE IF EXISTS test')) {
 	exit(1);
 }

+if (!mysqli_query($link, 'SET SESSION sql_mode=\'\'')) {
+	printf("Failed to drop old test table: [%d] %s\n", mysqli_errno($link), mysqli_error($link));
+	exit(1);
+}
+
 if (!mysqli_query($link, 'CREATE TABLE test(id INT, label CHAR(1), PRIMARY KEY(id)) ENGINE=' . $engine)) {
 	printf("Failed to create test table: [%d] %s\n", mysqli_errno($link), mysqli_error($link));
 	exit(1);
@@ -20,4 +25,4 @@ if (!mysqli_query($link, 'CREATE TABLE test(id INT, label CHAR(1), PRIMARY KEY(i
 if (!mysqli_query($link, "INSERT INTO test(id, label) VALUES (1, 'a'), (2, 'b'), (3, 'c'), (4, 'd'), (5, 'e'), (6, 'f')")) {
 	printf("[%d] %s\n",  mysqli_errno($link), mysqli_error($link));
 }
-?>
+?>
@@ -51,3 +51,29 @@ if test "$PHP_MYSQLND" != "no" || test "$PHP_MYSQLND_ENABLED" = "yes" || test "$
 #endif
  ])
 fi
+
+dnl
+dnl Check if the compiler supports Decimal32/64/128 types from the IEEE-754 2008 version
+dnl References: http://www.open-std.org/jtc1/sc22/wg14/www/docs/n1657.pdf
+dnl http://speleotrove.com/decimal/
+dnl
+AC_CACHE_CHECK([whether whether compiler supports Decimal32/64/128 types], ac_cv_decimal_fp_supported,[
+AC_TRY_RUN( [
+#include <stdio.h>
+
+int main(int argc, char **argv) {
+	typedef float dec32 __attribute__((mode(SD)));
+	dec32 k = 99.49f;
+	double d2 = (double)k;
+	return 0;
+}
+],[
+  ac_cv_decimal_fp_supported=yes
+],[
+  ac_cv_decimal_fp_supported=no
+],[
+  ac_cv_decimal_fp_supported=no
+])])
+if test "$ac_cv_decimal_fp_supported" = "yes"; then
+  AC_DEFINE(HAVE_DECIMAL_FP_SUPPORT, 1, [Define if the compiler supports Decimal32/64/128 types.])
+fi
@@ -50,6 +50,7 @@ enum_func_status mysqlnd_fetch_stmt_row_cursor(MYSQLND_RES *result, void *param,
 static void mysqlnd_stmt_separate_result_bind(MYSQLND_STMT * const stmt TSRMLS_DC);
 static void mysqlnd_stmt_separate_one_result_bind(MYSQLND_STMT * const stmt, unsigned int param_no TSRMLS_DC);

+static void MYSQLND_METHOD(mysqlnd_stmt, free_stmt_result)(MYSQLND_STMT * const s TSRMLS_DC);

 /* {{{ mysqlnd_stmt::store_result */
 static MYSQLND_RES *
@@ -226,7 +227,7 @@ MYSQLND_METHOD(mysqlnd_stmt, next_result)(MYSQLND_STMT * s TSRMLS_DC)
 	DBG_INF_FMT("server_status=%u cursor=%u", stmt->upsert_status->server_status, stmt->upsert_status->server_status & SERVER_STATUS_CURSOR_EXISTS);

 	/* Free space for next result */
-	s->m->free_stmt_content(s TSRMLS_CC);
+	MYSQLND_METHOD(mysqlnd_stmt, free_stmt_result)(s TSRMLS_CC);
 	{
 		enum_func_status ret = s->m->parse_execute_response(s TSRMLS_CC);
 		DBG_RETURN(ret);
@@ -2076,6 +2077,37 @@ mysqlnd_stmt_separate_one_result_bind(MYSQLND_STMT * const s, unsigned int param
 /* }}} */


+/* {{{ mysqlnd_stmt::free_stmt_result */
+static void
+MYSQLND_METHOD(mysqlnd_stmt, free_stmt_result)(MYSQLND_STMT * const s TSRMLS_DC)
+{
+	MYSQLND_STMT_DATA * stmt = s? s->data:NULL;
+	DBG_ENTER("mysqlnd_stmt::free_stmt_result");
+	if (!stmt) {
+		DBG_VOID_RETURN;
+	}
+
+	/*
+	  First separate the bound variables, which point to the result set, then
+	  destroy the set.
+	*/
+	mysqlnd_stmt_separate_result_bind(s TSRMLS_CC);
+	/* Not every statement has a result set attached */
+	if (stmt->result) {
+		stmt->result->m.free_result_internal(stmt->result TSRMLS_CC);
+		stmt->result = NULL;
+	}
+	if (stmt->error_info->error_list) {
+		zend_llist_clean(stmt->error_info->error_list);
+		mnd_pefree(stmt->error_info->error_list, s->persistent);
+		stmt->error_info->error_list = NULL;
+	}
+
+	DBG_VOID_RETURN;
+}
+/* }}} */
+
+
 /* {{{ mysqlnd_stmt::free_stmt_content */
 static void
 MYSQLND_METHOD(mysqlnd_stmt, free_stmt_content)(MYSQLND_STMT * const s TSRMLS_DC)
@@ -2108,22 +2140,7 @@ MYSQLND_METHOD(mysqlnd_stmt, free_stmt_content)(MYSQLND_STMT * const s TSRMLS_DC
 		stmt->param_bind = NULL;
 	}

-	/*
-	  First separate the bound variables, which point to the result set, then
-	  destroy the set.
-	*/
-	mysqlnd_stmt_separate_result_bind(s TSRMLS_CC);
-	/* Not every statement has a result set attached */
-	if (stmt->result) {
-		stmt->result->m.free_result_internal(stmt->result TSRMLS_CC);
-		stmt->result = NULL;
-	}
-	if (stmt->error_info->error_list) {
-		zend_llist_clean(stmt->error_info->error_list);
-		mnd_pefree(stmt->error_info->error_list, s->persistent);
-		stmt->error_info->error_list = NULL;
-	}
-
+	MYSQLND_METHOD(mysqlnd_stmt, free_stmt_result)(s TSRMLS_CC);
 	DBG_VOID_RETURN;
 }
 /* }}} */
@@ -195,12 +195,53 @@ void ps_fetch_float(zval *zv, const MYSQLND_FIELD * const field,
 					unsigned int pack_len, zend_uchar **row,
 					zend_bool as_unicode TSRMLS_DC)
 {
-	float value;
+	float fval;
+	double dval;
 	DBG_ENTER("ps_fetch_float");
-	float4get(value, *row);
-	ZVAL_DOUBLE(zv, value);
+	float4get(fval, *row);
 	(*row)+= 4;
-	DBG_INF_FMT("value=%f", value);
+	DBG_INF_FMT("value=%f", fval);
+
+	/*
+	 * The following is needed to correctly support 4-byte floats.
+	 * Otherwise, a value of 9.99 in a FLOAT column comes out of mysqli
+	 * as 9.9998998641968.
+	 *
+	 * For GCC, we use the built-in decimal support to "up-convert" a
+	 * 4-byte float to a 8-byte double.
+	 * When that is not available, we fall back to converting the float
+	 * to a string and then converting the string to a double. This mimics
+	 * what MySQL does.
+	 */
+#ifdef HAVE_DECIMAL_FP_SUPPORT
+	{
+		typedef float dec32 __attribute__((mode(SD)));
+		dec32 d32val = fval;
+
+		/* The following cast is guaranteed to do the right thing */
+		dval = (double) d32val;
+	}
+#else
+	{
+		char num_buf[2048]; /* Over allocated */
+		char *s;
+
+		/* Convert to string. Ignoring localization, etc.
+		 * Following MySQL's rules. If precision is undefined (NOT_FIXED_DEC i.e. 31)
+		 * or larger than 31, the value is limited to 6 (FLT_DIG).
+		 */
+		s = php_gcvt(fval,
+			     field->decimals >= 31 ? 6 : field->decimals,
+			     '.',
+			     'e',
+			     num_buf);
+
+		/* And now convert back to double */
+		dval = zend_strtod(s, NULL);
+	}
+#endif
+
+	ZVAL_DOUBLE(zv, dval);
 	DBG_VOID_RETURN;
 }
 /* }}} */
@@ -1182,7 +1182,7 @@ MYSQLND_METHOD(mysqlnd_res, store_result_fetch_data)(MYSQLND_CONN_DATA * const c
 		  No need to FREE_ALLOCA as we can reuse the
 		  'lengths' and 'fields' arrays. For lengths its absolutely safe.
 		  'fields' is reused because the ownership of the strings has been
-		  transfered above. 
+		  transferred above.
 		*/
 	}
 	/* Overflow ? */
@@ -780,6 +780,9 @@ PHP_MINIT_FUNCTION(odbc)
 	REGISTER_LONG_CONSTANT("SQL_TYPE_DATE", SQL_TYPE_DATE, CONST_PERSISTENT | CONST_CS);
 	REGISTER_LONG_CONSTANT("SQL_TYPE_TIME", SQL_TYPE_TIME, CONST_PERSISTENT | CONST_CS);
 	REGISTER_LONG_CONSTANT("SQL_TYPE_TIMESTAMP", SQL_TYPE_TIMESTAMP, CONST_PERSISTENT | CONST_CS);
+	REGISTER_LONG_CONSTANT("SQL_WCHAR", SQL_WCHAR, CONST_PERSISTENT | CONST_CS);
+	REGISTER_LONG_CONSTANT("SQL_WVARCHAR", SQL_WVARCHAR, CONST_PERSISTENT | CONST_CS);
+	REGISTER_LONG_CONSTANT("SQL_WLONGVARCHAR", SQL_WLONGVARCHAR, CONST_PERSISTENT | CONST_CS);

 	/*
 	 * SQLSpecialColumns values
@@ -943,9 +946,13 @@ int odbc_bindcols(odbc_result *result TSRMLS_DC)
 {
 	RETCODE rc;
 	int i;
-	SQLSMALLINT colnamelen; /* Not used */
-	SQLLEN      displaysize;
+	SQLSMALLINT 	colnamelen; /* Not used */
+	SQLLEN      	displaysize;
+	SQLUSMALLINT	colfieldid;
+	int		charextraalloc;

+	colfieldid = SQL_COLUMN_DISPLAY_SIZE;
+	charextraalloc = 0;
 	result->values = (odbc_result_value *) safe_emalloc(sizeof(odbc_result_value), result->numcols, 0);

 	result->longreadlen = ODBCG(defaultlrl);
@@ -966,6 +973,9 @@ int odbc_bindcols(odbc_result *result TSRMLS_DC)
 			case SQL_VARBINARY:
 			case SQL_LONGVARBINARY:
 			case SQL_LONGVARCHAR:
+#if defined(ODBCVER) && (ODBCVER >= 0x0300)
+			case SQL_WLONGVARCHAR:
+#endif
 				result->values[i].value = NULL;
 				break;
 				
@@ -976,15 +986,27 @@ int odbc_bindcols(odbc_result *result TSRMLS_DC)
 							27, &result->values[i].vallen);
 				break;
 #endif /* HAVE_ADABAS */
+			case SQL_CHAR:
+			case SQL_VARCHAR:
+#if defined(ODBCVER) && (ODBCVER >= 0x0300)
+			case SQL_WCHAR:
+			case SQL_WVARCHAR:
+				colfieldid = SQL_DESC_OCTET_LENGTH;
+#else
+				charextraalloc = 1;
+#endif
 			default:
-				rc = SQLColAttributes(result->stmt, (SQLUSMALLINT)(i+1), SQL_COLUMN_DISPLAY_SIZE,
-									NULL, 0, NULL, &displaysize);
-				displaysize = displaysize <= result->longreadlen ? displaysize : 
-								result->longreadlen;
+				rc = SQLColAttributes(result->stmt, (SQLUSMALLINT)(i+1), colfieldid,
+								NULL, 0, NULL, &displaysize);
 				/* Workaround for Oracle ODBC Driver bug (#50162) when fetching TIMESTAMP column */
 				if (result->values[i].coltype == SQL_TIMESTAMP) {
 					displaysize += 3;
 				}
+
+				if (charextraalloc) {
+					/* Since we don't know the exact # of bytes, allocate extra */
+					displaysize *= 4;
+				}
 				result->values[i].value = (char *)emalloc(displaysize + 1);
 				rc = SQLBindCol(result->stmt, (SQLUSMALLINT)(i+1), SQL_C_CHAR, result->values[i].value,
 							displaysize + 1, &result->values[i].vallen);
@@ -1725,6 +1747,9 @@ static void php_odbc_fetch_hash(INTERNAL_FUNCTION_PARAMETERS, int result_type)
 					sql_c_type = SQL_C_BINARY;
 				}
 			case SQL_LONGVARCHAR:
+#if defined(ODBCVER) && (ODBCVER >= 0x0300)
+			case SQL_WLONGVARCHAR:
+#endif
 				if (IS_SQL_LONG(result->values[i].coltype) && result->longreadlen <= 0) {
 					Z_STRVAL_P(tmp) = STR_EMPTY_ALLOC();
 					break;
@@ -1876,7 +1901,11 @@ PHP_FUNCTION(odbc_fetch_into)
 					break;
 				}
 				if (result->binmode == 1) sql_c_type = SQL_C_BINARY; 
+
 			case SQL_LONGVARCHAR:
+#if defined(ODBCVER) && (ODBCVER >= 0x0300)
+			case SQL_WLONGVARCHAR:
+#endif
 				if (IS_SQL_LONG(result->values[i].coltype) && result->longreadlen <= 0) {
 					Z_STRVAL_P(tmp) = STR_EMPTY_ALLOC();
 					break;
@@ -2095,6 +2124,9 @@ PHP_FUNCTION(odbc_result)
 				break; 
 			}
 		case SQL_LONGVARCHAR:
+#if defined(ODBCVER) && (ODBCVER >= 0x0300)
+		case SQL_WLONGVARCHAR:
+#endif
 			if (IS_SQL_LONG(result->values[field_ind].coltype)) {
 				if (result->longreadlen <= 0) {
 				   break;
@@ -2132,7 +2164,11 @@ PHP_FUNCTION(odbc_result)
 			}
 			/* Reduce fieldlen by 1 if we have char data. One day we might 
 			   have binary strings... */
-			if (result->values[field_ind].coltype == SQL_LONGVARCHAR) {
+			if ((result->values[field_ind].coltype == SQL_LONGVARCHAR)
+#if defined(ODBCVER) && (ODBCVER >= 0x0300)
+			    || (result->values[field_ind].coltype == SQL_WLONGVARCHAR)
+#endif
+			) {
 				fieldsize -= 1;
 			}
 			/* Don't duplicate result, saves one emalloc.
@@ -2248,6 +2284,9 @@ PHP_FUNCTION(odbc_result_all)
 					}
 					if (result->binmode <= 1) sql_c_type = SQL_C_BINARY; 
 				case SQL_LONGVARCHAR:
+#if defined(ODBCVER) && (ODBCVER >= 0x0300)
+				case SQL_WLONGVARCHAR:
+#endif
 					if (IS_SQL_LONG(result->values[i].coltype) && 
 						result->longreadlen <= 0) {
 						php_printf("<td>Not printable</td>"); 
@@ -115,6 +115,7 @@ PHP_FUNCTION(solid_fetch_prev);
 #endif

 #define ODBC_TYPE "unixODBC"
+#undef ODBCVER
 #include <sql.h>
 #include <sqlext.h>
 #define HAVE_SQL_EXTENDED_FETCH 1
@@ -284,7 +285,11 @@ int odbc_bindcols(odbc_result *result TSRMLS_DC);

 void odbc_sql_error(ODBC_SQL_ERROR_PARAMS);

+#if defined(ODBCVER) && (ODBCVER >= 0x0300)
+#define IS_SQL_LONG(x) (x == SQL_LONGVARBINARY || x == SQL_LONGVARCHAR || x == SQL_WLONGVARCHAR)
+#else
 #define IS_SQL_LONG(x) (x == SQL_LONGVARBINARY || x == SQL_LONGVARCHAR)
+#endif
 #define IS_SQL_BINARY(x) (x == SQL_BINARY || x == SQL_VARBINARY || x == SQL_LONGVARBINARY)

 #ifdef ZTS
@@ -0,0 +1,69 @@
+--TEST--
+odbc_exec(): Getting accurate unicode data from query
+--SKIPIF--
+<?php include 'skipif.inc'; ?>
+--FILE--
+<?php
+
+// Test strings
+mb_internal_encoding("EUC_JP");
+$euc_jp_base64 = 'pdal6aWkpcCl676uyqo=';
+$euc_jp = base64_decode($euc_jp_base64);
+$ascii = 'abcdefghijklmnopqrstuvwxyz;]=#0123456789';
+
+include 'config.inc';
+ini_set("odbc.defaultlrl", 4); // Set artifically low
+
+$conn = odbc_connect($dsn, $user, $pass);
+
+odbc_exec($conn, 'CREATE DATABASE odbcTEST ENCODING=\'EUC_JP\'');
+
+odbc_exec($conn, 'CREATE TABLE FOO (ID INT, CHAR_COL CHAR(200), VARCHAR_COL VARCHAR(200), TEXT_COL TEXT)');
+
+odbc_exec($conn, "INSERT INTO FOO(ID, CHAR_COL, VARCHAR_COL, TEXT_COL) VALUES (1, '$euc_jp', '$euc_jp', '$euc_jp')");
+odbc_exec($conn, "INSERT INTO FOO(ID, CHAR_COL, VARCHAR_COL, TEXT_COL) VALUES (2, '$ascii', '$ascii', '$ascii')");
+
+$res = odbc_exec($conn, 'SELECT * FROM FOO ORDER BY ID ASC');
+
+while(odbc_fetch_row($res)) {
+	$char_col = odbc_result($res, "CHAR_COL");
+	$varchar_col = odbc_result($res, "VARCHAR_COL");
+	$id = odbc_result($res, "ID");
+	$text_col = "";
+	while (($chunk=odbc_result($res, "TEXT_COL")) !== false) {
+		$text_col .= $chunk;
+	}
+
+	if ($id == 1) {
+		$euc_jp_check = $euc_jp . str_repeat(" ", (200 - mb_strlen($euc_jp)));
+		if (strcmp($char_col, $euc_jp_check) == 0 && strcmp($varchar_col, $euc_jp) == 0 &&
+			strcmp($text_col, $euc_jp) == 0) {
+			print "EUC-JP matched\n";
+		} else {
+			print "EUC-JP mismatched\n";
+		}
+	} else {
+		$ascii_check = $ascii . str_repeat(" ", (200 - strlen($ascii)));
+		if (strcmp($char_col, $ascii_check) == 0 && strcmp($varchar_col, $ascii) == 0 &&
+			strcmp($text_col, $ascii) == 0) {
+			print "ASCII matched\n";
+		} else {
+			print "ASCII mismatched\n";
+		}
+	}
+}
+
+?>
+--EXPECT--
+EUC-JP matched
+ASCII matched
+--CLEAN--
+<?php
+include 'config.inc';
+
+$conn = odbc_connect($dsn, $user, $pass);
+
+odbc_exec($conn, 'DROP TABLE FOO');
+odbc_exec($conn, 'DROP DATABASE odbcTEST');
+
+?>
@@ -24,9 +24,5 @@ resource(%d) of type (odbc result)
 bool(false)
 resource(%d) of type (odbc result)
 bool(false)
-
-Warning: odbc_columns(): SQL error: Failed to fetch error message, SQL state HY000 in SQLColumns in %s on line %d
+resource(%d) of type (odbc result)
 bool(false)
-
-Warning: odbc_fetch_row() expects parameter 1 to be resource, boolean given in %s on line %d
-NULL
@@ -12,7 +12,7 @@ $conn = odbc_connect($dsn, $user, $pass);
 odbc_exec($conn, 'CREATE DATABASE odbcTEST');

 odbc_exec($conn, 'CREATE TABLE FOO (TEST INT)');
-odbc_exec($conn, 'ALTER TABLE FOO ADD PRIMARY KEY FOO(TEST)');
+odbc_exec($conn, 'ALTER TABLE FOO ADD PRIMARY KEY (TEST)');

 odbc_exec($conn, 'INSERT INTO FOO VALUES (1)');
 odbc_exec($conn, 'INSERT INTO FOO VALUES (2)');
@@ -654,7 +654,7 @@ static time_t asn1_time_to_time_t(ASN1_UTCTIME * timestr TSRMLS_DC) /* {{{ */
 		return (time_t)-1;
 	}

-	if (ASN1_STRING_length(timestr) != strlen(ASN1_STRING_data(timestr))) {
+	if (ASN1_STRING_length(timestr) != strlen((char *)ASN1_STRING_data(timestr))) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "illegal length in timestamp");
 		return (time_t)-1;
 	}
@@ -782,13 +782,13 @@ static int add_oid_section(struct php_x509_request * req TSRMLS_DC) /* {{{ */
 			req->config_filename, req->var, req->req_config TSRMLS_CC) == FAILURE) return FAILURE

 #define SET_OPTIONAL_STRING_ARG(key, varname, defval)	\
-	if (optional_args && zend_hash_find(Z_ARRVAL_P(optional_args), key, sizeof(key), (void**)&item) == SUCCESS) \
+	if (optional_args && zend_hash_find(Z_ARRVAL_P(optional_args), key, sizeof(key), (void**)&item) == SUCCESS && Z_TYPE_PP(item) == IS_STRING) \
 		varname = Z_STRVAL_PP(item); \
 	else \
 		varname = defval

 #define SET_OPTIONAL_LONG_ARG(key, varname, defval)	\
-	if (optional_args && zend_hash_find(Z_ARRVAL_P(optional_args), key, sizeof(key), (void**)&item) == SUCCESS) \
+	if (optional_args && zend_hash_find(Z_ARRVAL_P(optional_args), key, sizeof(key), (void**)&item) == SUCCESS && Z_TYPE_PP(item) == IS_LONG) \
 		varname = Z_LVAL_PP(item); \
 	else \
 		varname = defval
@@ -847,7 +847,8 @@ static int php_openssl_parse_config(struct php_x509_request * req, zval * option
 		}
 	}

-	if (req->priv_key_encrypt && optional_args && zend_hash_find(Z_ARRVAL_P(optional_args), "encrypt_key_cipher", sizeof("encrypt_key_cipher"), (void**)&item) == SUCCESS) {
+	if (req->priv_key_encrypt && optional_args && zend_hash_find(Z_ARRVAL_P(optional_args), "encrypt_key_cipher", sizeof("encrypt_key_cipher"), (void**)&item) == SUCCESS 
+		&& Z_TYPE_PP(item) == IS_LONG) {
 		long cipher_algo = Z_LVAL_PP(item);
 		const EVP_CIPHER* cipher = php_openssl_get_evp_cipher_from_algo(cipher_algo);
 		if (cipher == NULL) {
@@ -1962,7 +1963,7 @@ PHP_FUNCTION(openssl_pkcs12_export_to_file)
 	}

 	/* parse extra config from args array, promote this to an extra function */
-	if (args && zend_hash_find(Z_ARRVAL_P(args), "friendly_name", sizeof("friendly_name"), (void**)&item) == SUCCESS)
+	if (args && zend_hash_find(Z_ARRVAL_P(args), "friendly_name", sizeof("friendly_name"), (void**)&item) == SUCCESS && Z_TYPE_PP(item) == IS_STRING)
 		friendly_name = Z_STRVAL_PP(item);
 	/* certpbe (default RC2-40)
 	   keypbe (default 3DES)
@@ -2040,7 +2041,7 @@ PHP_FUNCTION(openssl_pkcs12_export)
 	}

 	/* parse extra config from args array, promote this to an extra function */
-	if (args && zend_hash_find(Z_ARRVAL_P(args), "friendly_name", sizeof("friendly_name"), (void**)&item) == SUCCESS)
+	if (args && zend_hash_find(Z_ARRVAL_P(args), "friendly_name", sizeof("friendly_name"), (void**)&item) == SUCCESS && Z_TYPE_PP(item) == IS_STRING)
 		friendly_name = Z_STRVAL_PP(item);

 	if (args && zend_hash_find(Z_ARRVAL_P(args), "extracerts", sizeof("extracerts"), (void**)&item) == SUCCESS)
@@ -0,0 +1,12 @@
+--TEST--
+Options type checks
+--SKIPIF--
+<?php if (!extension_loaded("openssl")) print "skip"; ?>
+--FILE--
+<?php
+$x = openssl_pkey_new();
+$csr = openssl_csr_new(["countryName" => "DE"], $x, ["x509_extensions" => 0xDEADBEEF]);
+?>
+DONE
+--EXPECT--
+DONE
@@ -4935,7 +4935,7 @@ by an auxiliary program - but can then be edited by hand if required. There are
 now no calls to isalnum(), isspace(), isdigit(), isxdigit(), tolower() or
 toupper() in the code.

-7. Turn the malloc/free funtions variables into pcre_malloc and pcre_free and
+7. Turn the malloc/free functions variables into pcre_malloc and pcre_free and
 make them global. Abolish the function for setting them, as the caller can now
 set them directly.

@@ -640,7 +640,7 @@ PHPAPI void php_pcre_match_impl(pcre_cache_entry *pce, char *subject, int subjec
 	}

 	offsets = (int *)safe_emalloc(size_offsets, sizeof(int), 0);
-
+	memset(offsets, 0, size_offsets*sizeof(int));
 	/* Allocate match sets array and initialize the values. */
 	if (global && subpats && subpats_order == PREG_PATTERN_ORDER) {
 		match_sets = (zval **)safe_emalloc(num_subpats, sizeof(zval *), 0);
@@ -2,7 +2,7 @@
  +----------------------------------------------------------------------+
  | PHP Version 5                                                        |
  +----------------------------------------------------------------------+
-  | Copyright (c) 1997-2013 The PHP Group                                |
+  | Copyright (c) 1997-2014 The PHP Group                                |
  +----------------------------------------------------------------------+
  | This source file is subject to version 3.01 of the PHP license,      |
  | that is bundled with this package in the file LICENSE, and is        |
@@ -47,14 +47,14 @@ array(1) {
  string(3) "foo"
 }

-Warning: PDOStatement::execute(): SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '--'' at line 1 in %s on line %d
+Warning: PDOStatement::execute(): SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your %s server version for the right syntax to use near '--'' at line 1 in %s on line %d
 array(3) {
  [0]=>
  string(5) "42000"
  [1]=>
  int(1064)
  [2]=>
-  string(149) "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '--'' at line 1"
+  string(149) "You have an error in your SQL syntax; check the manual that corresponds to your %s server version for the right syntax to use near '--'' at line 1"
 }
 array(1) {
  ["f1"]=>
@@ -31,7 +31,7 @@ var_dump($quotedInput2);
 ?>
 done
 --EXPECTF--
-Warning: PDO::query(): SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'something that throws an exception' at line %d in %s on line %d
+Warning: PDO::query(): SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your %s server version for the right syntax to use near 'something that throws an exception' at line %d in %s on line %d
 string(50) "'Something\', 1 as one, 2 as two  FROM dual; -- f'"
 string(50) "'Something'', 1 as one, 2 as two  FROM dual; -- f'"
 string(50) "'Something'', 1 as one, 2 as two  FROM dual; -- f'"
@@ -161,6 +161,6 @@ error_reporting=E_ALL
 --EXPECTF--
 [003] Maybe PDO could indicate that this is not a proper way of setting the ERRMODE...true

-Warning: PDO::query(): SQLSTATE[42000]: Syntax error or access violation: %d You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '%s' at line %d in %s on line %d
+Warning: PDO::query(): SQLSTATE[42000]: Syntax error or access violation: %d You have an error in your SQL syntax; check the manual that corresponds to your %s server version for the right syntax to use near '%s' at line %d in %s on line %d

 end of execution
@@ -179,7 +179,7 @@ $db = MySQLPDOTest::factory();
@$db->exec('DROP TABLE IF EXISTS test');
 ?>
 --EXPECTF--
-Warning: PDO::exec(): SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'THIS IS NOT VALID SQL, I HOPE' at line 1 in %s on line %d
-[016] [42000] 42000 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'THIS IS NOT VALID SQL, I HOPE' at line %d
+Warning: PDO::exec(): SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your %s server version for the right syntax to use near 'THIS IS NOT VALID SQL, I HOPE' at line 1 in %s on line %d
+[016] [42000] 42000 1064 You have an error in your SQL syntax; check the manual that corresponds to your %s server version for the right syntax to use near 'THIS IS NOT VALID SQL, I HOPE' at line %d
 [035] With emulated PS it works but makes no sense given that exec() returns sort of affected rows...
 done!
@@ -97,6 +97,6 @@ array(1) {
 }
 Native Prepared Statements...

-Warning: PDO::query(): SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '%SSELECT label FROM test ORDER BY id ASC LIMIT 1' at line %d in %s on line %d
+Warning: PDO::query(): SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your %s server version for the right syntax to use near '%SSELECT label FROM test ORDER BY id ASC LIMIT 1' at line %d in %s on line %d

 Fatal error: Call to a member function errorInfo() on a non-object in %s on line %d