5.4.38

Conflicts:
	ext/date/php_date.c

EXTENSIONS

@@ -385,6 +385,12 @@ MAINTENANCE:         Maintained
 STATUS:              Working
 SINCE:               4.0.4
 -------------------------------------------------------------------------------
+EXTENSION:           hash
+PRIMARY MAINTAINER:  Sara Golemon <pollita@php.net>, Mike Wallner <mike@php.net>, Anatol Belski <ab@php.net>
+MAINTENANCE:         Maintained
+STATUS:              Working
+SINCE:               5.1.2
+-------------------------------------------------------------------------------
 EXTENSION:           iconv
 PRIMARY MAINTAINER:  Moriyoshi Koizumi <moriyoshi@php.net>
 MAINTENANCE:         Maintained

NEWS

@@ -1,12 +1,136 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-07 Aug 2014, PHP 5.4.32
+19 Feb 2015 PHP 5.4.38
 
 - Core:
-  . Fixed bug #67717 (segfault in dns_get_record). (CVE-2014-3597) (Remi) 
+  . Removed support for multi-line headers, as the are deprecated by RFC 7230.
+    (Stas)
+  . Added NULL byte protection to exec, system and passthru. (Yasuo)
+  . Fixed bug #68925 (Mitigation for CVE-2015-0235 – GHOST: glibc gethostbyname
+    buffer overflow). (Stas)
+  . Fixed bug #67827 (broken detection of system crypt sha256/sha512 support).
+    (ncopa at alpinelinux dot org)  
+  . Fixed bug #68942 (Use after free vulnerability in unserialize() with
+    DateTimeZone). (Stas)
+  
+- Enchant: 
+  . Fixed bug #6855 (heap buffer overflow in enchant_broker_request_dict()).
+    (Antony)
+
+- SOAP:
+  . Fixed bug #67427 (SoapServer cannot handle large messages)
+    (brandt at docoloc dot de)
+
+22 Jan 2015 PHP 5.4.37
+- Core:
+  . Fixed bug #68710 (Use After Free Vulnerability in PHP's unserialize()).
+    (CVE-2015-0231) (Stefan Esser)
+
+- CGI:
+  . Fixed bug #68618 (out of bounds read crashes php-cgi). (CVE-2014-9427)
+    (Stas)
+
+- EXIF:
+  . Fixed bug #68799: Free called on unitialized pointer. (CVE-2015-0232) 
+    (Stas)
+
+- Fileinfo:
+  . Removed readelf.c and related code from libmagic sources
+    (Remi, Anatol)
+  . Fixed bug #68735 (fileinfo out-of-bounds memory access).
+    (Anatol)
+
+- OpenSSL:
+  . Fixed bug #55618 (use case-insensitive cert name matching).
+    (Daniel Lowrey)
+
+18 Dec 2014 PHP 5.4.36
+
+- Core:
+  . Upgraded crypt_blowfish to version 1.3. (Leigh)
+  . Fixed bug #68545 (NULL pointer dereference in unserialize.c). (Anatol)
+  . Fixed bug #68594 (Use after free vulnerability in unserialize()).
+    (CVE-2014-8142) (Stefan Esser)
+
+- Mcrypt:
+  . Fixed possible read after end of buffer and use after free. (Dmitry)
+
+13 Nov 2014 PHP 5.4.35
+
+- Core:
+  . Fixed bug #68365 (zend_mm_heap corrupted after memory overflow in
+    zend_hash_copy). (Dmitry)
+
+- Fileinfo:
+  . Fixed bug #68283 (fileinfo: out-of-bounds read in elf note headers).
+    (CVE-2014-3710) (Remi)
+
+- GMP:
+ . Fixed bug #63595 (GMP memory management conflicts with other libraries
+   using GMP). (Remi)
+
+- PDO_pgsql:
+  . Fixed bug #66584 (Segmentation fault on statement deallocation) (Matteo)
+
+16 Oct 2014, PHP 5.4.34
+
+- Fileinfo:
+  . Fixed bug #66242 (libmagic: don't assume char is signed). (ArdB)
+
+- Core:
+  . Fixed bug #67985 (Incorrect last used array index copied to new array after
+    unset). (Tjerk)
+  . Fixed bug #68044 (Integer overflow in unserialize() (32-bits only)). 
+    (CVE-2014-3669) (Stas)
+
+- cURL:
+  . Fixed bug #68089 (NULL byte injection - cURL lib). (Stas)
+
+- EXIF:
+  . Fixed bug #68113 (Heap corruption in exif_thumbnail()). (CVE-2014-3670)
+    (Stas)
+
+- OpenSSL:
+  . Reverted fixes for bug #41631, due to regressions. (Stas) 
+
+- XMLRPC:
+  . Fixed bug #68027 (Global buffer overflow in mkgmtime() function). 
+    (CVE-2014-3668) (Stas)
+
+18 Sep 2014, PHP 5.4.33
+
+- Core:
+  . Fixed bug #47358 (glob returns error, should be empty array()). (Pierre)
+  . Fixed bug #65463 (SIGSEGV during zend_shutdown()). (Keyur Govande)
+  . Fixed bug #66036 (Crash on SIGTERM in apache process). (Keyur Govande)
+
+- OpenSSL:
+  . Fixed bug #41631 (socket timeouts not honored in blocking SSL reads).
+    (Daniel Lowrey)
+
+- Date:
+  . Fixed bug #66091 (memory leaks in DateTime constructor). (Tjerk)
+
+- FPM:
+  . Fixed #67606 (FPM with mod_fastcgi/apache2.4 is broken). (David Zuelke)
+
+- GD:
+  . Made fontFetch's path parser thread-safe. (Sara)
+
+- Wddx:
+  . Fixed bug #67873 (Segfaults in php_wddx_serialize_var). (Anatol, Remi)
+
+- Zlib:
+  . Fixed bug #67724 (chained zlib filters silently fail with large amounts of 
+    data). (Mike)
+  . Fixed bug #67865 (internal corruption phar error). (Mike)
+
+21 Aug 2014, PHP 5.4.32
 
 - COM:
   . Fixed missing type checks in com_event_sink. (Yussuf Khalil, Stas)
+  . Fixed bug #41577 (DOTNET is successful once per server run).
+    (Aidas Kasparas)
 
 - Fileinfo:
   . Fixed bug #67705 (extensive backtracking in rule regular expression).
@@ -15,10 +139,16 @@ PHP                                                                        NEWS
 
 - GD:
   . Fixed bug #66901 (php-gd 'c_color' NULL pointer dereference).
-    (CVE-2014-2497) (Remi)
+    (CVE-2014-2497). (Remi)
   . Fixed bug #67730 (Null byte injection possible with imagexxx functions).
     (CVE-2014-5120) (Ryan Mauger)
 
+- LiteSpeed:
+  . Updated LiteSpeed SAPI code from V5.5 to V6.6 (George Wang)
+
+- Network:
+  . Fixed bug #67717 (segfault in dns_get_record). (CVE-2014-3597) (Remi)
+
 - Milter:
   . Fixed bug #67715 (php-milter does not build and crashes randomly). (Mike)
 
@@ -32,11 +162,11 @@ PHP                                                                        NEWS
     with control-c). (Dmitry Saprykin, Johannes)
 
 - Sessions:
-  . Fixed missing type checks in php_session_create_id (Yussuf Khalil, Stas).
+  . Fixed missing type checks in php_session_create_id. (Yussuf Khalil, Stas).
 
 - SPL:
   . Fixed bug #67539 (ArrayIterator use-after-free due to object change during
-    sorting). (research at insighti dot org, Laruence)
+    sorting). (CVE-2014-4698) (research at insighti dot org, Laruence)
   . Fixed bug #67538 (SPL Iterators use-after-free). (CVE-2014-4670) (Laruence)
 
 - Core:
@@ -46,9 +176,8 @@ PHP                                                                        NEWS
   . Fixed bug #60616 (odbc_fetch_into returns junk data at end of multi-byte
     char fields). (Keyur)
 
-- Zlib:
-  . Fixed bug #67724 (chained zlib filters silently fail with large amounts of 
-    data). (Mike)
+- MySQLi:
+  . Fixed bug #67839 (mysqli does not handle 4-byte floats correctly). (Keyur)
 
 24 Jul 2014, PHP 5.4.31
 

README.GIT-RULES

@@ -45,15 +45,16 @@ Currently we have the following branches in use::
 
   master    The active development branch. 
 
+  PHP-5.6   Is used to release the PHP 5.6.x series. This is a current
+            stable version and is open for bugfixes only.
+
   PHP-5.5   Is used to release the PHP 5.5.x series. This is a current
             stable version and is open for bugfixes only.
 
   PHP-5.4   Is used to release the PHP 5.4.x series. This is a current
             stable version and is open for bugfixes only.
 
-  PHP-5.3   Is used to release the PHP 5.3.x series. This is currently 
-            in extended support and open forsecurity fixes only. Triaged
-            via security@php.net
+  PHP-5.3   This branch is closed.
 
   PHP-5.2   This branch is closed.
 
@@ -61,9 +62,12 @@ Currently we have the following branches in use::
 
   PHP-4.4   This branch is closed.
 
+  PHP-X.Y.Z These branches are used for the release managers for tagging
+            the releases, hence they are closed to the general public.
+
 The next few rules are more of a technical nature::
 
-   1. All changes should first go to the lowest branch (i.e. 5.3) and then 
+   1. All changes should first go to the lowest branch (i.e. 5.4) and then
       get merged up to all other branches. If a change is not needed for
       later branches (i.e. fixes for features which where dropped from later
       branches) an empty merge should be done.

README.RELEASE_PROCESS

@@ -183,11 +183,11 @@ last commit id to web/php.git, then, mirrors will now sync
 Getting the stable release announced
 ------------------------------------
 
-1. Run the bumpRelease script for phpweb on your local checkout
+1. Update phpweb/include/releases.inc with the old release info
+  (updates the download archives)
 
- a. ``php bin/bumpRelease 5`` to create the release file (releases/x_y_z.php)
-    The release announcement file should list in detail security fixes and
-    changes in behavior (whether due to a bug fix or not).
+ a. You can run ``php bin/bumpRelease 5`` if you are making a release for the
+    highest branch, otherwise you have to do this manually, see point 1.b
 
  b. In case multiple PHP minor versions are in active development you have
     to manually copy the old information to include/releases.inc
@@ -207,8 +207,9 @@ Getting the stable release announced
 
  f. if the windows builds aren't ready yet prefix the "windows" key with a dot (".windows")
 
-3. Update phpweb/include/releases.php with the old release info
-  (updates the download archives)
+3. Create the release file (releases/x_y_z.php)
+   Usually we use the same content as for point 6, but included in php template
+   instead of the release xml.
 
 4. Update php-qa/include/release-qa.php and add the next version as an QARELEASE
    (prepare for next RC)

Zend/tests/bug67985.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug #67985 - Last used array index not copied to new array at assignment
+--FILE--
+<?php
+
+$a = ['zero', 'one', 'two'];
+unset($a[2]);
+$b = $a;
+$a[] = 'three';
+$b[] = 'three';
+
+var_dump($a === $b);
+
+?>
+--EXPECT--
+bool(true)

Zend/zend.c

@@ -813,6 +813,20 @@ void zend_shutdown(TSRMLS_D) /* {{{ */
 	zend_shutdown_timeout_thread();
 #endif
 	zend_destroy_rsrc_list(&EG(persistent_list) TSRMLS_CC);
+
+	if (EG(active))
+	{
+		/*
+		 * The order of destruction is important here.
+		 * See bugs #65463 and 66036.
+		 */
+		zend_hash_reverse_apply(GLOBAL_FUNCTION_TABLE, (apply_func_t) zend_cleanup_function_data_full TSRMLS_CC);
+		zend_hash_reverse_apply(GLOBAL_CLASS_TABLE, (apply_func_t) zend_cleanup_user_class_data TSRMLS_CC);
+		zend_cleanup_internal_classes(TSRMLS_C);
+		zend_hash_reverse_apply(GLOBAL_FUNCTION_TABLE, (apply_func_t) clean_non_persistent_function_full TSRMLS_CC);
+		zend_hash_reverse_apply(GLOBAL_CLASS_TABLE, (apply_func_t) clean_non_persistent_class_full TSRMLS_CC);
+	}
+
 	zend_destroy_modules();
 
 	zend_hash_destroy(GLOBAL_FUNCTION_TABLE);

Zend/zend_compile.h

@@ -639,6 +639,8 @@ ZEND_API void zend_cleanup_internal_class_data(zend_class_entry *ce TSRMLS_DC);
 ZEND_API void zend_cleanup_internal_classes(TSRMLS_D);
 ZEND_API int zend_cleanup_function_data(zend_function *function TSRMLS_DC);
 ZEND_API int zend_cleanup_function_data_full(zend_function *function TSRMLS_DC);
+ZEND_API int clean_non_persistent_function_full(zend_function *function TSRMLS_DC);
+ZEND_API int clean_non_persistent_class_full(zend_class_entry **ce TSRMLS_DC);
 
 ZEND_API void destroy_zend_function(zend_function *function TSRMLS_DC);
 ZEND_API void zend_function_dtor(zend_function *function);

Zend/zend_execute_API.c

@@ -108,7 +108,7 @@ static int clean_non_persistent_function(zend_function *function TSRMLS_DC) /* {
 }
 /* }}} */
 
-static int clean_non_persistent_function_full(zend_function *function TSRMLS_DC) /* {{{ */
+ZEND_API int clean_non_persistent_function_full(zend_function *function TSRMLS_DC) /* {{{ */
 {
 	return (function->type == ZEND_INTERNAL_FUNCTION) ? ZEND_HASH_APPLY_KEEP : ZEND_HASH_APPLY_REMOVE;
 }
@@ -120,7 +120,7 @@ static int clean_non_persistent_class(zend_class_entry **ce TSRMLS_DC) /* {{{ */
 }
 /* }}} */
 
-static int clean_non_persistent_class_full(zend_class_entry **ce TSRMLS_DC) /* {{{ */
+ZEND_API int clean_non_persistent_class_full(zend_class_entry **ce TSRMLS_DC) /* {{{ */
 {
 	return ((*ce)->type == ZEND_INTERNAL_CLASS) ? ZEND_HASH_APPLY_KEEP : ZEND_HASH_APPLY_REMOVE;
 }

Zend/zend_variables.c

@@ -135,8 +135,9 @@ ZEND_API void _zval_copy_ctor_func(zval *zvalue ZEND_FILE_LINE_DC)
 				}
 				ALLOC_HASHTABLE_REL(tmp_ht);
 				zend_hash_init(tmp_ht, zend_hash_num_elements(original_ht), NULL, ZVAL_PTR_DTOR, 0);
-				zend_hash_copy(tmp_ht, original_ht, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
 				zvalue->value.ht = tmp_ht;
+				zend_hash_copy(tmp_ht, original_ht, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
+				tmp_ht->nNextFreeElement = original_ht->nNextFreeElement;
 			}
 			break;
 		case IS_OBJECT:

acinclude.m4

@@ -2800,7 +2800,7 @@ AC_DEFUN([PHP_DETECT_ICC],
 
 dnl PHP_DETECT_SUNCC
 dnl Detect if the systems default compiler is suncc.
-dnl We also set some usefull CFLAGS if the user didn't set any
+dnl We also set some useful CFLAGS if the user didn't set any
 AC_DEFUN([PHP_DETECT_SUNCC],[
   SUNCC="no"
   AC_MSG_CHECKING([for suncc])

configure.in

@@ -119,7 +119,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
 
 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=4
-PHP_RELEASE_VERSION=32
+PHP_RELEASE_VERSION=38
 PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

ext/com_dotnet/com_dotnet.c

@@ -198,7 +198,8 @@ PHP_FUNCTION(com_dotnet_create_instance)
 	IUnknown *unk = NULL;
 
 	php_com_initialize(TSRMLS_C);
-	if (COMG(dotnet_runtime_stuff) == NULL) {
+	stuff = (struct dotnet_runtime_stuff*)COMG(dotnet_runtime_stuff);
+	if (stuff == NULL) {
 		hr = dotnet_init(&where TSRMLS_CC);
 		if (FAILED(hr)) {
 			char buf[1024];
@@ -210,9 +211,35 @@ PHP_FUNCTION(com_dotnet_create_instance)
 			ZVAL_NULL(object);
 			return;
 		}
-	}
+		stuff = (struct dotnet_runtime_stuff*)COMG(dotnet_runtime_stuff);
 
-	stuff = (struct dotnet_runtime_stuff*)COMG(dotnet_runtime_stuff);
+	} else if (stuff->dotnet_domain == NULL) {
+		where = "ICorRuntimeHost_GetDefaultDomain";
+		hr = ICorRuntimeHost_GetDefaultDomain(stuff->dotnet_host, &unk);
+		if (FAILED(hr)) {
+			char buf[1024];
+			char *err = php_win32_error_to_msg(hr);
+			snprintf(buf, sizeof(buf), "Failed to re-init .Net domain [%s] %s", where, err);
+			if (err)
+				LocalFree(err);
+			php_com_throw_exception(hr, buf TSRMLS_CC);
+			ZVAL_NULL(object);
+			return;
+		}
+
+		where = "QI: System._AppDomain";
+		hr = IUnknown_QueryInterface(unk, &IID_mscorlib_System_AppDomain, (LPVOID*)&stuff->dotnet_domain);
+		if (FAILED(hr)) {
+			char buf[1024];
+			char *err = php_win32_error_to_msg(hr);
+			snprintf(buf, sizeof(buf), "Failed to re-init .Net domain [%s] %s", where, err);
+			if (err)
+				LocalFree(err);
+			php_com_throw_exception(hr, buf TSRMLS_CC);
+			ZVAL_NULL(object);
+			return;
+		}
+	}
 
 	obj = CDNO_FETCH(object);
 

ext/curl/interface.c

@@ -10,7 +10,7 @@
    | http://www.php.net/license/3_01.txt                                  |
    | If you did not receive a copy of the PHP license and are unable to   |
    | obtain it through the world-wide-web, please send a note to          |
-   | license@php.net so we can mail you 6 copy immediately.               |
+   | license@php.net so we can mail you a copy immediately.               |
    +----------------------------------------------------------------------+
    | Author: Sterling Hughes <sterling@php.net>                           |
    +----------------------------------------------------------------------+
@@ -170,6 +170,12 @@ static int php_curl_option_url(php_curl *ch, const char *url, const int len TSRM
 #if LIBCURL_VERSION_NUM < 0x071100
 	char *copystr = NULL;
 #endif
+
+	if (strlen(url) != len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Curl option contains invalid characters (\\0)");
+		return 0;
+	}
+
 	/* Disable file:// if open_basedir are used */
 	if (PG(open_basedir) && *PG(open_basedir)) {
 #if LIBCURL_VERSION_NUM >= 0x071304

ext/curl/tests/bug68089.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug #68089 (NULL byte injection - cURL lib)
+--SKIPIF--
+<?php 
+include 'skipif.inc';
+
+?>
+--FILE--
+<?php
+$url = "file:///etc/passwd\0http://google.com";
+$ch = curl_init();
+var_dump(curl_setopt($ch, CURLOPT_URL, $url));
+?>
+Done
+--EXPECTF--
+Warning: curl_setopt(): Curl option contains invalid characters (\0) in %s/bug68089.php on line 4
+bool(false)
+Done

ext/curl/tests/skipif.inc

@@ -0,0 +1,7 @@
+<?php
+    if (!extension_loaded("curl")) exit("skip curl extension not loaded");
+    if(false === getenv('PHP_CURL_HTTP_REMOTE_SERVER')) {
+        if (php_sapi_name() != "cli") {
+                die("skip PHP_CURL_HTTP_REMOTE_SERVER env variable is not defined");
+        }
+    }

ext/date/php_date.c

@@ -2398,11 +2398,7 @@ static void date_object_free_storage_period(void *object TSRMLS_DC)
 /* Advanced Interface */
 PHPAPI zval *php_date_instantiate(zend_class_entry *pce, zval *object TSRMLS_DC)
 {
-	Z_TYPE_P(object) = IS_OBJECT;
 	object_init_ex(object, pce);
-	Z_SET_REFCOUNT_P(object, 1);
-	Z_UNSET_ISREF_P(object);
-
 	return object;
 }
 
@@ -2510,14 +2506,19 @@ PHP_FUNCTION(date_create)
 	zval           *timezone_object = NULL;
 	char           *time_str = NULL;
 	int             time_str_len = 0;
+	zval            datetime_object;
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|sO!", &time_str, &time_str_len, &timezone_object, date_ce_timezone) == FAILURE) {
 		RETURN_FALSE;
 	}
 
-	php_date_instantiate(date_ce_date, return_value TSRMLS_CC);
-	if (!php_date_initialize(zend_object_store_get_object(return_value TSRMLS_CC), time_str, time_str_len, NULL, timezone_object, 0 TSRMLS_CC)) {
+	php_date_instantiate(date_ce_date, &datetime_object TSRMLS_CC);
+	if (!php_date_initialize(zend_object_store_get_object(&datetime_object TSRMLS_CC), time_str, time_str_len, NULL, timezone_object, 0 TSRMLS_CC)) {
+		zval_dtor(&datetime_object);
 		RETURN_FALSE;
+	} else {
+		zval *datetime_object_ptr = &datetime_object;
+		RETVAL_ZVAL(datetime_object_ptr, 0, 0);
 	}
 }
 /* }}} */
@@ -2530,14 +2531,19 @@ PHP_FUNCTION(date_create_from_format)
 	zval           *timezone_object = NULL;
 	char           *time_str = NULL, *format_str = NULL;
 	int             time_str_len = 0, format_str_len = 0;
+	zval            datetime_object;
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ss|O", &format_str, &format_str_len, &time_str, &time_str_len, &timezone_object, date_ce_timezone) == FAILURE) {
 		RETURN_FALSE;
 	}
 
-	php_date_instantiate(date_ce_date, return_value TSRMLS_CC);
-	if (!php_date_initialize(zend_object_store_get_object(return_value TSRMLS_CC), time_str, time_str_len, format_str, timezone_object, 0 TSRMLS_CC)) {
+	php_date_instantiate(date_ce_date, &datetime_object TSRMLS_CC);
+	if (!php_date_initialize(zend_object_store_get_object(&datetime_object TSRMLS_CC), time_str, time_str_len, format_str, timezone_object, 0 TSRMLS_CC)) {
+		zval_dtor(&datetime_object);
 		RETURN_FALSE;
+	} else {
+		zval *datetime_object_ptr = &datetime_object;
+		RETVAL_ZVAL(datetime_object_ptr, 0, 0);
 	}
 }
 /* }}} */
@@ -2560,7 +2566,7 @@ PHP_METHOD(DateTime, __construct)
 }
 /* }}} */
 
-static int php_date_initialize_from_hash(zval **return_value, php_date_obj **dateobj, HashTable *myht TSRMLS_DC)
+static int php_date_initialize_from_hash(php_date_obj **dateobj, HashTable *myht TSRMLS_DC)
 {
 	zval            **z_date = NULL;
 	zval            **z_timezone = NULL;
@@ -2569,12 +2575,9 @@ static int php_date_initialize_from_hash(zval **return_value, php_date_obj **dat
 	timelib_tzinfo   *tzi;
 	php_timezone_obj *tzobj;
 
-	if (zend_hash_find(myht, "date", 5, (void**) &z_date) == SUCCESS) {
-		convert_to_string(*z_date);
-		if (zend_hash_find(myht, "timezone_type", 14, (void**) &z_timezone_type) == SUCCESS) {
-			convert_to_long(*z_timezone_type);
-			if (zend_hash_find(myht, "timezone", 9, (void**) &z_timezone) == SUCCESS) {
-				convert_to_string(*z_timezone);
+	if (zend_hash_find(myht, "date", 5, (void**) &z_date) == SUCCESS && Z_TYPE_PP(z_date) == IS_STRING) {
+		if (zend_hash_find(myht, "timezone_type", 14, (void**) &z_timezone_type) == SUCCESS && Z_TYPE_PP(z_timezone_type) == IS_LONG) {
+			if (zend_hash_find(myht, "timezone", 9, (void**) &z_timezone) == SUCCESS && Z_TYPE_PP(z_timezone) == IS_STRING) {
 
 				switch (Z_LVAL_PP(z_timezone_type)) {
 					case TIMELIB_ZONETYPE_OFFSET:
@@ -2589,7 +2592,6 @@ static int php_date_initialize_from_hash(zval **return_value, php_date_obj **dat
 
 					case TIMELIB_ZONETYPE_ID: {
 						int ret;
-						convert_to_string(*z_timezone);
 
 						tzi = php_date_parse_tzfile(Z_STRVAL_PP(z_timezone), DATE_TIMEZONEDB TSRMLS_CC);
 
@@ -2630,7 +2632,7 @@ PHP_METHOD(DateTime, __set_state)
 
 	php_date_instantiate(date_ce_date, return_value TSRMLS_CC);
 	dateobj = (php_date_obj *) zend_object_store_get_object(return_value TSRMLS_CC);
-	if (!php_date_initialize_from_hash(&return_value, &dateobj, myht TSRMLS_CC)) {
+	if (!php_date_initialize_from_hash(&dateobj, myht TSRMLS_CC)) {
 		php_error(E_ERROR, "Invalid serialization data for DateTime object");
 	}
 }
@@ -2648,7 +2650,7 @@ PHP_METHOD(DateTime, __wakeup)
 
 	myht = Z_OBJPROP_P(object);
 
-	if (!php_date_initialize_from_hash(&return_value, &dateobj, myht TSRMLS_CC)) {
+	if (!php_date_initialize_from_hash(&dateobj, myht TSRMLS_CC)) {
 		php_error(E_ERROR, "Invalid serialization data for DateTime object");
 	}
 }

ext/date/tests/bug20382-2.phpt

@@ -95,18 +95,18 @@ result = Monday 2037-10-05 00:00:00 NZDT
 wanted = Monday            00:00:00
 
 Australia/Adelaide
-ts     = Friday 1971-01-01 17:17:17 CST
-result = Monday 1971-01-04 00:00:00 CST
+ts     = Friday 1971-01-01 17:17:17 ACST
+result = Monday 1971-01-04 00:00:00 ACST
 wanted = Monday            00:00:00
 
 Australia/Darwin
-ts     = Monday 1971-03-29 17:17:17 CST
-result = Monday 1971-04-05 00:00:00 CST
+ts     = Monday 1971-03-29 17:17:17 ACST
+result = Monday 1971-04-05 00:00:00 ACST
 wanted = Monday            00:00:00
 
 Australia/Perth
-ts     = Friday 1971-01-01 17:17:17 WST
-result = Monday 1971-01-04 00:00:00 WST
+ts     = Friday 1971-01-01 17:17:17 AWST
+result = Monday 1971-01-04 00:00:00 AWST
 wanted = Monday            00:00:00
 
 America/Aruba

ext/date/tests/bug33415-2.phpt

@@ -233,8 +233,8 @@ result=Saturday 1970-01-03 00:00:00 CAT 0
 wanted=Saturday            00:00:00
 
 TZ=Asia/Kashgar - Is it OK for this to be 3 AM? yes
-tStamp=Thursday 1980-04-24 17:17:17 KAST 0
-result=Thursday 1980-05-01 03:00:00 CST 0
+tStamp=Thursday 1980-04-24 17:17:17 XJT 0
+result=Thursday 1980-05-01 00:00:00 XJT 0
 wanted=Thursday            03:00:00
 
 TZ=Indian/Christmas - Is it OK for this to be 7 AM?  Note: does

ext/date/tests/bug33532.phpt

@@ -39,5 +39,5 @@ datestr  10:00:00 AM July 1 2005 UTC
 
 Setting TZ
 input    10:00:00 AM July 1 2005
-strftime 10:00:00 AM July 1 2005 EST +1000
-datestr  10:00:00 AM July 1 2005 EST
+strftime 10:00:00 AM July 1 2005 AEST +1000
+datestr  10:00:00 AM July 1 2005 AEST

ext/date/tests/bug51866.phpt

@@ -44,7 +44,7 @@ array(4) {
 
 string(6) "Y-m-d+"
 string(19) "2001-11-29 13:20:01"
-object(DateTime)#2 (3) {
+object(DateTime)#%d (3) {
   ["date"]=>
   string(26) "2001-11-29 %d:%d:%d.%d"
   ["timezone_type"]=>
@@ -70,7 +70,7 @@ array(4) {
 
 string(7) "Y-m-d +"
 string(19) "2001-11-29 13:20:01"
-object(DateTime)#3 (3) {
+object(DateTime)#%d (3) {
   ["date"]=>
   string(26) "2001-11-29 %d:%d:%d.%d"
   ["timezone_type"]=>
@@ -96,7 +96,7 @@ array(4) {
 
 string(6) "Y-m-d+"
 string(10) "2001-11-29"
-object(DateTime)#2 (3) {
+object(DateTime)#%d (3) {
   ["date"]=>
   string(26) "2001-11-29 %d:%d:%d.%d"
   ["timezone_type"]=>
@@ -139,7 +139,7 @@ array(4) {
 
 string(7) "Y-m-d +"
 string(11) "2001-11-29 "
-object(DateTime)#2 (3) {
+object(DateTime)#%d (3) {
   ["date"]=>
   string(26) "2001-11-29 %d:%d:%d.%d"
   ["timezone_type"]=>

ext/date/tests/bug68942_2.phpt

@@ -0,0 +1,9 @@
+--TEST--
+Bug #68942 (Use after free vulnerability in unserialize() with DateTime).
+--FILE--
+<?php
+$data = unserialize('a:2:{i:0;O:8:"DateTime":3:{s:4:"date";s:26:"2000-01-01 00:00:00.000000";s:13:"timezone_type";a:2:{i:0;i:1;i:1;i:2;}s:8:"timezone";s:1:"A";}i:1;R:5;}');
+var_dump($data);
+?>
+--EXPECTF--
+Fatal error: Invalid serialization data for DateTime object in %s/bug68942_2.php on line %d

ext/dom/php_dom.c

@@ -518,7 +518,7 @@ static HashTable* dom_get_debug_info_helper(zval *object, int *is_temp TSRMLS_DC
 			value = null_value;
 		} else if (Z_TYPE_P(value) == IS_OBJECT) {
 			/* these are zvalues create on demand, with refcount and is_ref
-			 * status left in an uninitalized stated */
+			 * status left in an uninitialized stated */
 			zval_dtor(value);
 			efree(value);
 

ext/enchant/enchant.c

@@ -550,13 +550,12 @@ PHP_FUNCTION(enchant_broker_request_dict)
 
 	d = enchant_broker_request_dict(pbroker->pbroker, (const char *)tag);
 	if (d) {
+		pos = pbroker->dictcnt++;
 		if (pbroker->dictcnt) {
 			pbroker->dict = (enchant_dict **)erealloc(pbroker->dict, sizeof(enchant_dict *) * pbroker->dictcnt);
-			pos = pbroker->dictcnt++;
 		} else {
 			pbroker->dict = (enchant_dict **)emalloc(sizeof(enchant_dict *));
 			pos = 0;
-			pbroker->dictcnt++;
 		}
 
 		dict = pbroker->dict[pos] = (enchant_dict *)emalloc(sizeof(enchant_dict));
@@ -607,14 +606,14 @@ PHP_FUNCTION(enchant_broker_request_pwl_dict)
 
 	d = enchant_broker_request_pwl_dict(pbroker->pbroker, (const char *)pwl);
 	if (d) {
+		pos = pbroker->dictcnt++;
 		if (pbroker->dictcnt) {
-			pos = pbroker->dictcnt++;
 			pbroker->dict = (enchant_dict **)erealloc(pbroker->dict, sizeof(enchant_dict *) * pbroker->dictcnt);
 		} else {
 			pbroker->dict = (enchant_dict **)emalloc(sizeof(enchant_dict *));
 			pos = 0;
-			pbroker->dictcnt++;
 		}
+
 		dict = pbroker->dict[pos] = (enchant_dict *)emalloc(sizeof(enchant_dict));
 		dict->id = pos;
 		dict->pbroker = pbroker;

ext/ereg/tests/eregi_basic.phpt

@@ -9,7 +9,7 @@ Test eregi() function : basic functionality - confirm case insensitivity
  */
 
 /*
- * Test basic funtionality of eregi()
+ * Test basic functionality of eregi()
  */
 
 echo "*** Testing eregi() : basic functionality ***\n";

ext/exif/exif.c

@@ -2426,11 +2426,11 @@ static void* exif_ifd_make_value(image_info_data *info_data, int motorola_intel
 					data_ptr += 8;
 					break;
 				case TAG_FMT_SINGLE:
-					memmove(data_ptr, &info_data->value.f, byte_count);
+					memmove(data_ptr, &info_value->f, 4);
 					data_ptr += 4;
 					break;
 				case TAG_FMT_DOUBLE:
-					memmove(data_ptr, &info_data->value.d, byte_count);
+					memmove(data_ptr, &info_value->d, 8);
 					data_ptr += 8;
 					break;
 			}
@@ -2702,7 +2702,7 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
 static int exif_process_unicode(image_info_type *ImageInfo, xp_field_type *xp_field, int tag, char *szValuePtr, int ByteCount TSRMLS_DC)
 {
 	xp_field->tag = tag;	
-	
+	xp_field->value = NULL;
 	/* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX   */
 	if (zend_multibyte_encoding_converter(
 			(unsigned char**)&xp_field->value, 

ext/exif/tests/bug68113.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Bug #68113 (Heap corruption in exif_thumbnail())
+--SKIPIF--
+<?php
+extension_loaded("exif") or die("skip need exif");
+?>
+--FILE--
+<?php
+var_dump(exif_thumbnail(__DIR__."/bug68113.jpg"));
+?>
+Done
+--EXPECTF--
+Warning: exif_thumbnail(bug68113.jpg): File structure corrupted in %s/bug68113.php on line 2
+
+Warning: exif_thumbnail(bug68113.jpg): Invalid JPEG file in %s/bug68113.php on line 2
+bool(false)
+Done

ext/exif/tests/bug68799.phpt

@@ -0,0 +1,63 @@
+--TEST--
+Bug #68799 (Free called on unitialized pointer)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+/*
+* Pollute the heap. Helps trigger bug. Sometimes not needed.
+*/
+class A {
+    function __construct() {
+        $a = 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAa';
+        $this->a = $a . $a . $a . $a . $a . $a;
+    }
+};
+
+function doStuff ($limit) {
+
+    $a = new A;
+
+    $b = array();
+    for ($i = 0; $i < $limit; $i++) {
+        $b[$i] = clone $a;
+    }
+
+    unset($a);
+
+    gc_collect_cycles();
+}
+
+$iterations = 3;
+
+doStuff($iterations);
+doStuff($iterations);
+
+gc_collect_cycles();
+
+print_r(exif_read_data(__DIR__.'/bug68799.jpg'));
+
+?>
+--EXPECTF--
+Array
+(
+    [FileName] => bug68799.jpg
+    [FileDateTime] => %d
+    [FileSize] => 735
+    [FileType] => 2
+    [MimeType] => image/jpeg
+    [SectionsFound] => ANY_TAG, IFD0, WINXP
+    [COMPUTED] => Array
+        (
+            [html] => width="1" height="1"
+            [Height] => 1
+            [Width] => 1
+            [IsColor] => 1
+            [ByteOrderMotorola] => 1
+        )
+
+    [XResolution] => 96/1
+    [YResolution] => 96/1
+    [ResolutionUnit] => 2
+    [Author] => 
+)

ext/fileinfo/config.m4

@@ -11,7 +11,7 @@ if test "$PHP_FILEINFO" != "no"; then
     libmagic/cdf.c libmagic/cdf_time.c libmagic/compress.c \
     libmagic/encoding.c libmagic/fsmagic.c libmagic/funcs.c \
     libmagic/is_tar.c libmagic/magic.c libmagic/print.c \
-    libmagic/readcdf.c libmagic/readelf.c libmagic/softmagic.c"
+    libmagic/readcdf.c libmagic/softmagic.c"
 
   PHP_NEW_EXTENSION(fileinfo, fileinfo.c $libmagic_sources, $ext_shared,,-I@ext_srcdir@/libmagic)
   PHP_ADD_BUILD_DIR($ext_builddir/libmagic)

ext/fileinfo/config.w32

@@ -8,7 +8,7 @@ if (PHP_FILEINFO != 'no') {
 			cdf.c cdf_time.c compress.c \
 			encoding.c fsmagic.c funcs.c \
 			is_tar.c magic.c print.c \
-			readcdf.c readelf.c softmagic.c";
+			readcdf.c softmagic.c";
 
 	if (VCVERS < 1500) {
 		ADD_FLAG('CFLAGS', '/Zm1000');

ext/fileinfo/libmagic.patch

@@ -1,6 +1,6 @@
 diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 --- libmagic.orig/apprentice.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/apprentice.c	Mon Apr 14 23:42:51 2014
++++ libmagic/apprentice.c	Sun Jan  4 17:02:29 2015
 @@ -29,6 +29,8 @@
   * apprentice - make one pass through /etc/magic, learning its secrets.
   */
@@ -479,6 +479,15 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  		return NULL;
  	}
  	return map;
+@@ -1233,7 +1269,7 @@
+ 		 * the sign extension must have happened.
+ 		 */
+ 		case FILE_BYTE:
+-			v = (char) v;
++			v = (signed char) v;
+ 			break;
+ 		case FILE_SHORT:
+ 		case FILE_BESHORT:
 @@ -1500,7 +1536,7 @@
  		if (me->cont_count == me->max_count) {
  			struct magic *nm;
@@ -833,7 +842,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  	}
 diff -u libmagic.orig/ascmagic.c libmagic/ascmagic.c
 --- libmagic.orig/ascmagic.c	Wed Oct 31 18:03:01 2012
-+++ libmagic/ascmagic.c	Mon Apr 14 23:42:51 2014
++++ libmagic/ascmagic.c	Sun Jan  4 17:02:29 2015
 @@ -139,7 +139,7 @@
  		/* malloc size is a conservative overestimate; could be
  		   improved, or at least realloced after conversion. */
@@ -872,7 +881,7 @@ diff -u libmagic.orig/ascmagic.c libmagic/ascmagic.c
  }
 diff -u libmagic.orig/cdf.c libmagic/cdf.c
 --- libmagic.orig/cdf.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/cdf.c	Tue Jul  1 09:00:09 2014
++++ libmagic/cdf.c	Sun Jan  4 17:02:29 2015
 @@ -43,7 +43,17 @@
  #include <err.h>
  #endif
@@ -955,7 +964,7 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
  			errno = EFTYPE;
  			return (size_t)-1;
  		}
-@@ -796,7 +812,11 @@
+@@ -796,11 +812,15 @@
  	if (cdf_check_stream_offset(sst, h, e, 0, __LINE__) == -1)
  		goto out;
  	for (i = 0; i < sh.sh_properties; i++) {
@@ -968,6 +977,11 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
  		q = (const uint8_t *)(const void *)
  		    ((const char *)(const void *)p + ofs
  		    - 2 * sizeof(uint32_t));
+-		if (q > e) {
++		if (q < p || q > e) {
+ 			DPRINTF(("Ran of the end %p > %p\n", q, e));
+ 			goto out;
+ 		}
 @@ -810,6 +830,10 @@
  		    i, inp[i].pi_id, inp[i].pi_type, q - p, offs));
  		if (inp[i].pi_type & CDF_VECTOR) {
@@ -1056,7 +1070,7 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
  			} else {
 diff -u libmagic.orig/cdf.h libmagic/cdf.h
 --- libmagic.orig/cdf.h	Wed Oct 31 18:03:01 2012
-+++ libmagic/cdf.h	Mon Apr 14 23:32:55 2014
++++ libmagic/cdf.h	Sun Jan  4 17:02:29 2015
 @@ -35,10 +35,12 @@
  #ifndef _H_CDF_
  #define _H_CDF_
@@ -1099,7 +1113,7 @@ diff -u libmagic.orig/cdf.h libmagic/cdf.h
  void cdf_unpack_header(cdf_header_t *, char *);
 diff -u libmagic.orig/cdf_time.c libmagic/cdf_time.c
 --- libmagic.orig/cdf_time.c	Wed Oct 31 18:03:01 2012
-+++ libmagic/cdf_time.c	Mon Apr 14 23:32:55 2014
++++ libmagic/cdf_time.c	Sun Nov  9 19:16:18 2014
 @@ -96,7 +96,7 @@
  }
  
@@ -1159,7 +1173,7 @@ diff -u libmagic.orig/cdf_time.c libmagic/cdf_time.c
  	static const char *ref = "Sat Apr 23 01:30:00 1977";
 diff -u libmagic.orig/compress.c libmagic/compress.c
 --- libmagic.orig/compress.c	Sun Jan  6 21:35:43 2013
-+++ libmagic/compress.c	Mon Apr 14 23:42:51 2014
++++ libmagic/compress.c	Sun Jan  4 17:02:29 2015
 @@ -32,6 +32,7 @@
   *	uncompress(method, old, n, newch) - uncompress old into new, 
   *					    using method, return sizeof new
@@ -1322,7 +1336,7 @@ diff -u libmagic.orig/compress.c libmagic/compress.c
 +#endif /* if PHP_FILEINFO_UNCOMPRESS */
 diff -u libmagic.orig/file.h libmagic/file.h
 --- libmagic.orig/file.h	Mon Feb 18 16:40:59 2013
-+++ libmagic/file.h	Mon Apr 14 23:42:51 2014
++++ libmagic/file.h	Sun Jan  4 17:02:29 2015
 @@ -33,11 +33,9 @@
  #ifndef __file_h__
  #define __file_h__
@@ -1409,7 +1423,7 @@ diff -u libmagic.orig/file.h libmagic/file.h
  	void *map;			/* internal resources used by entry */
  	struct mlist *next, *prev;
  };
-@@ -411,21 +413,18 @@
+@@ -411,21 +413,16 @@
  protected const char *file_fmttime(uint64_t, int, char *);
  protected struct magic_set *file_ms_alloc(int);
  protected void file_ms_free(struct magic_set *);
@@ -1426,8 +1440,8 @@ diff -u libmagic.orig/file.h libmagic/file.h
 -    __attribute__((__format__(__printf__, 2, 3)));
 +protected int file_printf(struct magic_set *, const char *, ...);
  protected int file_reset(struct magic_set *);
- protected int file_tryelf(struct magic_set *, int, const unsigned char *,
-     size_t);
+-protected int file_tryelf(struct magic_set *, int, const unsigned char *,
+-    size_t);
  protected int file_trycdf(struct magic_set *, int, const unsigned char *,
      size_t);
 -#if HAVE_FORK
@@ -1435,7 +1449,7 @@ diff -u libmagic.orig/file.h libmagic/file.h
  protected int file_zmagic(struct magic_set *, int, const char *,
      const unsigned char *, size_t);
  #endif
-@@ -438,21 +437,18 @@
+@@ -438,21 +435,18 @@
      unichar **, size_t *, const char **, const char **, const char **);
  protected int file_is_tar(struct magic_set *, const unsigned char *, size_t);
  protected int file_softmagic(struct magic_set *, const unsigned char *, size_t,
@@ -1462,7 +1476,7 @@ diff -u libmagic.orig/file.h libmagic/file.h
  protected void file_showstr(FILE *, const char *, size_t);
  protected size_t file_mbswidth(const char *);
  protected const char *file_getbuffer(struct magic_set *);
-@@ -462,16 +458,14 @@
+@@ -462,16 +456,14 @@
      size_t *);
  protected size_t file_pstring_length_size(const struct magic *);
  protected size_t file_pstring_get_length(const struct magic *, const char *);
@@ -1480,7 +1494,7 @@ diff -u libmagic.orig/file.h libmagic/file.h
  
  #ifndef HAVE_STRERROR
  extern int sys_nerr;
-@@ -484,32 +478,16 @@
+@@ -484,32 +476,16 @@
  #define strtoul(a, b, c)	strtol(a, b, c)
  #endif
  
@@ -1515,7 +1529,7 @@ diff -u libmagic.orig/file.h libmagic/file.h
  
  #if defined(HAVE_MMAP) && defined(HAVE_SYS_MMAN_H) && !defined(QUICK)
  #define QUICK
-@@ -531,6 +509,14 @@
+@@ -531,6 +507,14 @@
  #endif
  #else
  #define FILE_RCSID(id)
@@ -1532,7 +1546,7 @@ diff -u libmagic.orig/file.h libmagic/file.h
  #endif /* __file_h__ */
 diff -u libmagic.orig/fsmagic.c libmagic/fsmagic.c
 --- libmagic.orig/fsmagic.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/fsmagic.c	Mon Apr 14 23:42:51 2014
++++ libmagic/fsmagic.c	Sun Jan  4 17:02:29 2015
 @@ -59,27 +59,21 @@
  # define minor(dev)  ((dev) & 0xff)
  #endif
@@ -1899,7 +1913,7 @@ diff -u libmagic.orig/fsmagic.c libmagic/fsmagic.c
  }
 diff -u libmagic.orig/funcs.c libmagic/funcs.c
 --- libmagic.orig/funcs.c	Wed Oct 31 18:03:01 2012
-+++ libmagic/funcs.c	Mon Apr 14 23:42:51 2014
++++ libmagic/funcs.c	Sun Jan  4 17:02:29 2015
 @@ -41,52 +41,42 @@
  #if defined(HAVE_WCTYPE_H)
  #include <wctype.h>
@@ -2193,7 +2207,7 @@ diff -u libmagic.orig/funcs.c libmagic/funcs.c
 +
 diff -u libmagic.orig/magic.c libmagic/magic.c
 --- libmagic.orig/magic.c	Fri Jan 11 17:43:09 2013
-+++ libmagic/magic.c	Mon Apr 14 23:42:51 2014
++++ libmagic/magic.c	Sun Jan  4 17:02:29 2015
 @@ -25,11 +25,6 @@
   * SUCH DAMAGE.
   */
@@ -2537,7 +2551,7 @@ diff -u libmagic.orig/magic.c libmagic/magic.c
  magic_error(struct magic_set *ms)
 diff -u libmagic.orig/magic.h libmagic/magic.h
 --- libmagic.orig/magic.h	Thu Mar 21 18:52:42 2013
-+++ libmagic/magic.h	Mon Apr 14 23:42:51 2014
++++ libmagic/magic.h	Sun Jan  4 17:02:29 2015
 @@ -87,6 +87,7 @@
  
  const char *magic_getpath(const char *, int);
@@ -2556,7 +2570,7 @@ diff -u libmagic.orig/magic.h libmagic/magic.h
  
 diff -u libmagic.orig/print.c libmagic/print.c
 --- libmagic.orig/print.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/print.c	Mon Apr 14 23:42:51 2014
++++ libmagic/print.c	Sun Jan  4 17:02:29 2015
 @@ -29,12 +29,17 @@
   * print.c - debugging printout routines
   */
@@ -2787,7 +2801,7 @@ diff -u libmagic.orig/print.c libmagic/print.c
  	}
 diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
 --- libmagic.orig/readcdf.c	Wed Oct 31 18:03:01 2012
-+++ libmagic/readcdf.c	Tue May 27 22:17:37 2014
++++ libmagic/readcdf.c	Sun Jan  4 17:02:29 2015
 @@ -30,7 +30,11 @@
  #endif
  
@@ -2861,282 +2875,9 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
  		    } else {
  			if (file_printf(ms, "application/CDFV2-corrupt") == -1)
  			    return -1;
-diff -u libmagic.orig/readelf.c libmagic/readelf.c
---- libmagic.orig/readelf.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/readelf.c	Mon Apr 14 23:42:51 2014
-@@ -48,8 +48,8 @@
- private int dophn_exec(struct magic_set *, int, int, int, off_t, int, size_t,
-     off_t, int *, int);
- private int doshn(struct magic_set *, int, int, int, off_t, int, size_t,
--    off_t, int *, int, int);
--private size_t donote(struct magic_set *, void *, size_t, size_t, int,
-+    off_t, int *, int);
-+private size_t donote(struct magic_set *, unsigned char *, size_t, size_t, int,
-     int, size_t, int *);
- 
- #define	ELF_ALIGN(a)	((((a) + align - 1) / align) * align)
-@@ -127,11 +127,17 @@
- 
- #define elf_getu16(swap, value) getu16(swap, value)
- #define elf_getu32(swap, value) getu32(swap, value)
--#define elf_getu64(swap, value) getu64(swap, value)
-+#ifdef USE_ARRAY_FOR_64BIT_TYPES
-+# define elf_getu64(swap, array) \
-+	((swap ? ((uint64_t)elf_getu32(swap, array[0])) << 32 : elf_getu32(swap, array[0])) + \
-+	 (swap ? elf_getu32(swap, array[1]) : ((uint64_t)elf_getu32(swap, array[1]) << 32)))
-+#else
-+# define elf_getu64(swap, value) getu64(swap, value)
-+#endif
- 
- #define xsh_addr	(clazz == ELFCLASS32			\
--			 ? (void *)&sh32			\
--			 : (void *)&sh64)
-+			 ? (void *) &sh32			\
-+			 : (void *) &sh64)
- #define xsh_sizeof	(clazz == ELFCLASS32			\
- 			 ? sizeof(sh32)				\
- 			 : sizeof(sh64))
-@@ -168,8 +174,8 @@
- 			 ? elf_getu32(swap, ph32.p_filesz)	\
- 			 : elf_getu64(swap, ph64.p_filesz)))
- #define xnh_addr	(clazz == ELFCLASS32			\
--			 ? (void *)&nh32			\
--			 : (void *)&nh64)
-+			 ? (void *) &nh32			\
-+			 : (void *) &nh64)
- #define xph_memsz	(size_t)((clazz == ELFCLASS32		\
- 			 ? elf_getu32(swap, ph32.p_memsz)	\
- 			 : elf_getu64(swap, ph64.p_memsz)))
-@@ -189,8 +195,8 @@
- 			 ? prpsoffsets32[i]			\
- 			 : prpsoffsets64[i])
- #define xcap_addr	(clazz == ELFCLASS32			\
--			 ? (void *)&cap32			\
--			 : (void *)&cap64)
-+			 ? (void *) &cap32			\
-+			 : (void *) &cap64)
- #define xcap_sizeof	(clazz == ELFCLASS32			\
- 			 ? sizeof cap32				\
- 			 : sizeof cap64)
-@@ -292,7 +298,7 @@
- {
- 	Elf32_Phdr ph32;
- 	Elf64_Phdr ph64;
--	size_t offset, len;
-+	size_t offset;
- 	unsigned char nbuf[BUFSIZ];
- 	ssize_t bufsize;
- 
-@@ -306,7 +312,11 @@
- 	 * Loop through all the program headers.
- 	 */
- 	for ( ; num; num--) {
--		if (pread(fd, xph_addr, xph_sizeof, off) == -1) {
-+		if (FINFO_LSEEK_FUNC(fd, off, SEEK_SET) == (off_t)-1) {
-+			file_badseek(ms);
-+			return -1;
-+		}
-+		if (FINFO_READ_FUNC(fd, xph_addr, xph_sizeof) == -1) {
- 			file_badread(ms);
- 			return -1;
- 		}
-@@ -324,8 +334,13 @@
- 		 * This is a PT_NOTE section; loop through all the notes
- 		 * in the section.
- 		 */
--		len = xph_filesz < sizeof(nbuf) ? xph_filesz : sizeof(nbuf);
--		if ((bufsize = pread(fd, nbuf, len, xph_offset)) == -1) {
-+		if (FINFO_LSEEK_FUNC(fd, xph_offset, SEEK_SET) == (off_t)-1) {
-+			file_badseek(ms);
-+			return -1;
-+		}
-+		bufsize = FINFO_READ_FUNC(fd, nbuf,
-+		    ((xph_filesz < sizeof(nbuf)) ? xph_filesz : sizeof(nbuf)));
-+		if (bufsize == -1) {
- 			file_badread(ms);
- 			return -1;
- 		}
-@@ -852,24 +867,12 @@
- 		return 0;
- 	}
- 
--	/* Read offset of name section to be able to read section names later */
--	if (pread(fd, xsh_addr, xsh_sizeof, off + size * strtab) == -1) {
--		file_badread(ms);
--		return -1;
--	}
--	name_off = xsh_offset;
--
- 	for ( ; num; num--) {
--		/* Read the name of this section. */
--		if (pread(fd, name, sizeof(name), name_off + xsh_name) == -1) {
--			file_badread(ms);
-+		if (FINFO_LSEEK_FUNC(fd, off, SEEK_SET) == (off_t)-1) {
-+			file_badseek(ms);
- 			return -1;
- 		}
--		name[sizeof(name) - 1] = '\0';
--		if (strcmp(name, ".debug_info") == 0)
--			stripped = 0;
--
--		if (pread(fd, xsh_addr, xsh_sizeof, off) == -1) {
-+		if (FINFO_READ_FUNC(fd, xsh_addr, xsh_sizeof) == -1) {
- 			file_badread(ms);
- 			return -1;
- 		}
-@@ -894,14 +897,17 @@
- 		/* Things we can determine when we seek */
- 		switch (xsh_type) {
- 		case SHT_NOTE:
--			if ((nbuf = malloc(xsh_size)) == NULL) {
--				file_error(ms, errno, "Cannot allocate memory"
--				    " for note");
-+			nbuf = emalloc((size_t)xsh_size);
-+			if ((noff = FINFO_LSEEK_FUNC(fd, (off_t)xsh_offset, SEEK_SET)) ==
-+			    (off_t)-1) {
-+				file_badread(ms);
-+				efree(nbuf);
- 				return -1;
- 			}
--			if (pread(fd, nbuf, xsh_size, xsh_offset) == -1) {
-+			if (FINFO_READ_FUNC(fd, nbuf, (size_t)xsh_size) !=
-+			    (ssize_t)xsh_size) {
-+				efree(nbuf);
- 				file_badread(ms);
--				free(nbuf);
- 				return -1;
- 			}
- 
-@@ -910,25 +916,16 @@
- 				if (noff >= (off_t)xsh_size)
- 					break;
- 				noff = donote(ms, nbuf, (size_t)noff,
--				    xsh_size, clazz, swap, 4, flags);
-+				    (size_t)xsh_size, clazz, swap, 4,
-+				    flags);
- 				if (noff == 0)
- 					break;
- 			}
--			free(nbuf);
-+			efree(nbuf);
- 			break;
- 		case SHT_SUNW_cap:
--			switch (mach) {
--			case EM_SPARC:
--			case EM_SPARCV9:
--			case EM_IA_64:
--			case EM_386:
--			case EM_AMD64:
--				break;
--			default:
--				goto skip;
--			}
--
--			if (lseek(fd, xsh_offset, SEEK_SET) == (off_t)-1) {
-+			if (FINFO_LSEEK_FUNC(fd, (off_t)xsh_offset, SEEK_SET) ==
-+			    (off_t)-1) {
- 				file_badseek(ms);
- 				return -1;
- 			}
-@@ -940,7 +937,7 @@
- 				    MAX(sizeof cap32, sizeof cap64)];
- 				if ((coff += xcap_sizeof) > (off_t)xsh_size)
- 					break;
--				if (read(fd, cbuf, (size_t)xcap_sizeof) !=
-+				if (FINFO_READ_FUNC(fd, cbuf, (size_t)xcap_sizeof) !=
- 				    (ssize_t)xcap_sizeof) {
- 					file_badread(ms);
- 					return -1;
-@@ -966,13 +963,12 @@
- 					break;
- 				}
- 			}
--			/*FALLTHROUGH*/
--		skip:
-+			break;
-+
- 		default:
- 			break;
- 		}
- 	}
--
- 	if (file_printf(ms, ", %sstripped", stripped ? "" : "not ") == -1)
- 		return -1;
- 	if (cap_hw1) {
-@@ -1051,7 +1047,7 @@
- 	const char *shared_libraries = "";
- 	unsigned char nbuf[BUFSIZ];
- 	ssize_t bufsize;
--	size_t offset, align, len;
-+	size_t offset, align;
- 	
- 	if (size != xph_sizeof) {
- 		if (file_printf(ms, ", corrupted program header size") == -1)
-@@ -1060,8 +1056,13 @@
- 	}
- 
-   	for ( ; num; num--) {
--		if (pread(fd, xph_addr, xph_sizeof, off) == -1) {
--			file_badread(ms);
-+		if (FINFO_LSEEK_FUNC(fd, off, SEEK_SET) == (off_t)-1) {
-+			file_badseek(ms);
-+			return -1;
-+		}
-+
-+  		if (FINFO_READ_FUNC(fd, xph_addr, xph_sizeof) == -1) {
-+  			file_badread(ms);
- 			return -1;
- 		}
- 
-@@ -1099,9 +1100,12 @@
- 			 * This is a PT_NOTE section; loop through all the notes
- 			 * in the section.
- 			 */
--			len = xph_filesz < sizeof(nbuf) ? xph_filesz
--			    : sizeof(nbuf);
--			bufsize = pread(fd, nbuf, len, xph_offset);
-+			if (FINFO_LSEEK_FUNC(fd, xph_offset, SEEK_SET) == (off_t)-1) {
-+				file_badseek(ms);
-+				return -1;
-+			}
-+			bufsize = FINFO_READ_FUNC(fd, nbuf, ((xph_filesz < sizeof(nbuf)) ?
-+			    xph_filesz : sizeof(nbuf)));
- 			if (bufsize == -1) {
- 				file_badread(ms);
- 				return -1;
-@@ -1162,7 +1166,7 @@
- 	/*
- 	 * If we cannot seek, it must be a pipe, socket or fifo.
- 	 */
--	if((lseek(fd, (off_t)0, SEEK_SET) == (off_t)-1) && (errno == ESPIPE))
-+	if((FINFO_LSEEK_FUNC(fd, (off_t)0, SEEK_SET) == (off_t)-1) && (errno == ESPIPE))
- 		fd = file_pipe2file(ms, fd, buf, nbytes);
- 
- 	if (fstat(fd, &st) == -1) {
-diff -u libmagic.orig/readelf.h libmagic/readelf.h
---- libmagic.orig/readelf.h	Thu Mar 21 18:45:14 2013
-+++ libmagic/readelf.h	Mon Apr 14 23:42:51 2014
-@@ -44,9 +44,17 @@
- typedef uint32_t	Elf32_Word;
- typedef uint8_t		Elf32_Char;
- 
-+#if SIZEOF_LONG_LONG != 8
-+#define	USE_ARRAY_FOR_64BIT_TYPES
-+typedef	uint32_t 	Elf64_Addr[2];
-+typedef	uint32_t 	Elf64_Off[2];
-+typedef uint32_t 	Elf64_Xword[2];
-+#else
-+#undef USE_ARRAY_FOR_64BIT_TYPES
- typedef	uint64_t 	Elf64_Addr;
- typedef	uint64_t 	Elf64_Off;
- typedef uint64_t 	Elf64_Xword;
-+#endif
- typedef uint16_t	Elf64_Half;
- typedef uint32_t	Elf64_Word;
- typedef uint8_t		Elf64_Char;
 diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 --- libmagic.orig/softmagic.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/softmagic.c	Tue Jul  1 09:00:09 2014
++++ libmagic/softmagic.c	Sun Jan  4 17:02:29 2015
 @@ -41,6 +41,11 @@
  #include <stdlib.h>
  #include <time.h>
@@ -3149,6 +2890,15 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  
  private int match(struct magic_set *, struct magic *, uint32_t,
      const unsigned char *, size_t, size_t, int, int, int, int, int *, int *,
+@@ -53,7 +58,7 @@
+ private int32_t moffset(struct magic_set *, struct magic *);
+ private void mdebug(uint32_t, const char *, size_t);
+ private int mcopy(struct magic_set *, union VALUETYPE *, int, int,
+-    const unsigned char *, uint32_t, size_t, size_t);
++    const unsigned char *, uint32_t, size_t, struct magic *);
+ private int mconvert(struct magic_set *, struct magic *, int);
+ private int print_sep(struct magic_set *, int);
+ private int handle_annotation(struct magic_set *, struct magic *);
 @@ -62,6 +67,8 @@
  private void cvt_32(union VALUETYPE *, const struct magic *);
  private void cvt_64(union VALUETYPE *, const struct magic *);
@@ -3286,7 +3036,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  			break; \
  		} \
  
-@@ -896,10 +881,18 @@
+@@ -896,10 +881,21 @@
  		return 1;
  	}
  	case FILE_PSTRING: {
@@ -3296,21 +3046,87 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  		size_t len = file_pstring_get_length(m, ptr1);
 -		if (len >= sizeof(p->s))
 -			len = sizeof(p->s) - 1;
-+		if (len >= sizeof(p->s)) {
++		sz = sizeof(p->s) - sz; /* maximum length of string */
++		if (len >= sz) {
 +			/*
 +			 * The size of the pascal string length (sz)
 +			 * is 1, 2, or 4. We need at least 1 byte for NUL
 +			 * termination, but we've already truncated the
 +			 * string by p->s, so we need to deduct sz.
++			 * Because we can use one of the bytes of the length
++			 * after we shifted as NUL termination.
 +			 */ 
-+			len = sizeof(p->s) - sz;
++			len = sz;
 +		}
  		while (len--)
  			*ptr1++ = *ptr2++;
  		*ptr1 = '\0';
-@@ -1145,9 +1138,6 @@
- 		    "nbytes=%zu, count=%u)\n", m->type, m->flag, offset, o,
- 		    nbytes, count);
+@@ -1010,7 +1006,7 @@
+ 
+ private int
+ mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
+-    const unsigned char *s, uint32_t offset, size_t nbytes, size_t linecnt)
++    const unsigned char *s, uint32_t offset, size_t nbytes, struct magic *m)
+ {
+ 	/*
+ 	 * Note: FILE_SEARCH and FILE_REGEX do not actually copy
+@@ -1030,15 +1026,24 @@
+ 			const char *last;	/* end of search region */
+ 			const char *buf;	/* start of search region */
+ 			const char *end;
+-			size_t lines;
++			size_t lines, linecnt, bytecnt;
++
++			linecnt = m->str_range;
++			bytecnt = linecnt * 80;
+ 
++			if (bytecnt == 0) {
++				bytecnt = 8192;
++			}
++			if (bytecnt > nbytes) {
++				bytecnt = nbytes;
++			}
+ 			if (s == NULL) {
+ 				ms->search.s_len = 0;
+ 				ms->search.s = NULL;
+ 				return 0;
+ 			}
+ 			buf = RCAST(const char *, s) + offset;
+-			end = last = RCAST(const char *, s) + nbytes;
++			end = last = RCAST(const char *, s) + bytecnt;
+ 			/* mget() guarantees buf <= last */
+ 			for (lines = linecnt, b = buf; lines && b < end &&
+ 			     ((b = CAST(const char *,
+@@ -1051,7 +1056,7 @@
+ 					b++;
+ 			}
+ 			if (lines)
+-				last = RCAST(const char *, s) + nbytes;
++				last = RCAST(const char *, s) + bytecnt;
+ 
+ 			ms->search.s = buf;
+ 			ms->search.s_len = last - buf;
+@@ -1125,7 +1130,6 @@
+     int *need_separator, int *returnval)
+ {
+ 	uint32_t soffset, offset = ms->offset;
+-	uint32_t count = m->str_range;
+ 	int rv, oneed_separator;
+ 	char *sbuf, *rbuf;
+ 	union VALUETYPE *p = &ms->ms_value;
+@@ -1137,17 +1141,13 @@
+ 	}
+ 
+ 	if (mcopy(ms, p, m->type, m->flag & INDIR, s, (uint32_t)(offset + o),
+-	    (uint32_t)nbytes, count) == -1)
++	    (uint32_t)nbytes, m) == -1)
+ 		return -1;
+ 
+ 	if ((ms->flags & MAGIC_DEBUG) != 0) {
+ 		fprintf(stderr, "mget(type=%d, flag=%x, offset=%u, o=%zu, "
+-		    "nbytes=%zu, count=%u)\n", m->type, m->flag, offset, o,
+-		    nbytes, count);
++		    "nbytes=%zu)\n", m->type, m->flag, offset, o, nbytes);
  		mdebug(offset, (char *)(void *)p, sizeof(union VALUETYPE));
 -#ifndef COMPILE_ONLY
 -		file_mdump(m);
@@ -3318,7 +3134,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  	}
  
  	if (m->flag & INDIR) {
-@@ -1191,7 +1181,7 @@
+@@ -1191,7 +1191,7 @@
  		}
  		switch (cvt_flip(m->in_type, flip)) {
  		case FILE_BYTE:
@@ -3327,7 +3143,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  				return 0;
  			if (off) {
  				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1226,7 +1216,7 @@
+@@ -1226,7 +1226,7 @@
  				offset = ~offset;
  			break;
  		case FILE_BESHORT:
@@ -3336,7 +3152,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  				return 0;
  			if (off) {
  				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1278,7 +1268,7 @@
+@@ -1278,7 +1278,7 @@
  				offset = ~offset;
  			break;
  		case FILE_LESHORT:
@@ -3345,7 +3161,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  				return 0;
  			if (off) {
  				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1330,7 +1320,7 @@
+@@ -1330,7 +1330,7 @@
  				offset = ~offset;
  			break;
  		case FILE_SHORT:
@@ -3354,7 +3170,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  				return 0;
  			if (off) {
  				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1367,7 +1357,7 @@
+@@ -1367,7 +1367,7 @@
  			break;
  		case FILE_BELONG:
  		case FILE_BEID3:
@@ -3363,7 +3179,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  				return 0;
  			if (off) {
  				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1438,7 +1428,7 @@
+@@ -1438,7 +1438,7 @@
  			break;
  		case FILE_LELONG:
  		case FILE_LEID3:
@@ -3372,7 +3188,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  				return 0;
  			if (off) {
  				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1508,7 +1498,7 @@
+@@ -1508,7 +1508,7 @@
  				offset = ~offset;
  			break;
  		case FILE_MELONG:
@@ -3381,7 +3197,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  				return 0;
  			if (off) {
  				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1578,7 +1568,7 @@
+@@ -1578,7 +1578,7 @@
  				offset = ~offset;
  			break;
  		case FILE_LONG:
@@ -3390,7 +3206,15 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  				return 0;
  			if (off) {
  				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1644,23 +1634,20 @@
+@@ -1637,30 +1637,27 @@
+ 			if ((ms->flags & MAGIC_DEBUG) != 0)
+ 				fprintf(stderr, "indirect +offs=%u\n", offset);
+ 		}
+-		if (mcopy(ms, p, m->type, 0, s, offset, nbytes, count) == -1)
++		if (mcopy(ms, p, m->type, 0, s, offset, nbytes, m) == -1)
+ 			return -1;
+ 		ms->offset = offset;
+ 
  		if ((ms->flags & MAGIC_DEBUG) != 0) {
  			mdebug(offset, (char *)(void *)p,
  			    sizeof(union VALUETYPE));
@@ -3416,7 +3240,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  			return 0;
  		break;
  
-@@ -1679,38 +1666,40 @@
+@@ -1679,38 +1676,40 @@
  	case FILE_FLOAT:
  	case FILE_BEFLOAT:
  	case FILE_LEFLOAT:
@@ -3463,7 +3287,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  		if ((ms->flags & MAGIC_DEBUG) != 0)
  			fprintf(stderr, "indirect @offs=%u[%d]\n", offset, rv);
  		rbuf = ms->o.buf;
-@@ -1718,16 +1707,26 @@
+@@ -1718,16 +1717,26 @@
  		ms->offset = soffset;
  		if (rv == 1) {
  			if ((ms->flags & (MAGIC_MIME|MAGIC_APPLE)) == 0 &&
@@ -3494,7 +3318,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  			return 0;
  		sbuf = m->value.s;
  		if (*sbuf == '^') {
-@@ -1837,6 +1836,42 @@
+@@ -1837,6 +1846,42 @@
  	return file_strncmp(a, b, len, flags);
  }
  
@@ -3537,7 +3361,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  private int
  magiccheck(struct magic_set *ms, struct magic *m)
  {
-@@ -1996,69 +2031,157 @@
+@@ -1996,69 +2041,157 @@
  		break;
  	}
  	case FILE_REGEX: {
@@ -3608,7 +3432,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 +			zval *retval;
 +			zval *subpats;
 +			char *haystack;
-+			
++
 +			MAKE_STD_ZVAL(retval);
 +			ALLOC_INIT_ZVAL(subpats);
 +			

ext/fileinfo/libmagic/apprentice.c

@@ -1269,7 +1269,7 @@ file_signextend(struct magic_set *ms, struct magic *m, uint64_t v)
 		 * the sign extension must have happened.
 		 */
 		case FILE_BYTE:
-			v = (char) v;
+			v = (signed char) v;
 			break;
 		case FILE_SHORT:
 		case FILE_BESHORT:

ext/fileinfo/libmagic/file.h

@@ -420,8 +420,6 @@ protected int file_pipe2file(struct magic_set *, int, const void *, size_t);
 protected int file_replace(struct magic_set *, const char *, const char *);
 protected int file_printf(struct magic_set *, const char *, ...);
 protected int file_reset(struct magic_set *);
-protected int file_tryelf(struct magic_set *, int, const unsigned char *,
-    size_t);
 protected int file_trycdf(struct magic_set *, int, const unsigned char *,
     size_t);
 #ifdef PHP_FILEINFO_UNCOMPRESS 

ext/fileinfo/libmagic/readelf.h

@@ -1,333 +0,0 @@
-/*
- * Copyright (c) Christos Zoulas 2003.
- * All Rights Reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice immediately at the beginning of the file, without modification,
- *    this list of conditions, and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *  
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
- * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-/*
- * @(#)Id: readelf.h,v 1.9 2002/05/16 18:45:56 christos Exp
- *
- * Provide elf data structures for non-elf machines, allowing file
- * non-elf hosts to determine if an elf binary is stripped.
- * Note: cobbled from the linux header file, with modifications
- */
-#ifndef __fake_elf_h__
-#define	__fake_elf_h__
-
-#if HAVE_STDINT_H
-#include <stdint.h>
-#endif
-
-typedef uint32_t	Elf32_Addr;
-typedef uint32_t	Elf32_Off;
-typedef uint16_t	Elf32_Half;
-typedef uint32_t	Elf32_Word;
-typedef uint8_t		Elf32_Char;
-
-#if SIZEOF_LONG_LONG != 8
-#define	USE_ARRAY_FOR_64BIT_TYPES
-typedef	uint32_t 	Elf64_Addr[2];
-typedef	uint32_t 	Elf64_Off[2];
-typedef uint32_t 	Elf64_Xword[2];
-#else
-#undef USE_ARRAY_FOR_64BIT_TYPES
-typedef	uint64_t 	Elf64_Addr;
-typedef	uint64_t 	Elf64_Off;
-typedef uint64_t 	Elf64_Xword;
-#endif
-typedef uint16_t	Elf64_Half;
-typedef uint32_t	Elf64_Word;
-typedef uint8_t		Elf64_Char;
-
-#define	EI_NIDENT	16
-
-typedef struct {
-    Elf32_Char	e_ident[EI_NIDENT];
-    Elf32_Half	e_type;
-    Elf32_Half	e_machine;
-    Elf32_Word	e_version;
-    Elf32_Addr	e_entry;  /* Entry point */
-    Elf32_Off	e_phoff;
-    Elf32_Off	e_shoff;
-    Elf32_Word	e_flags;
-    Elf32_Half	e_ehsize;
-    Elf32_Half	e_phentsize;
-    Elf32_Half	e_phnum;
-    Elf32_Half	e_shentsize;
-    Elf32_Half	e_shnum;
-    Elf32_Half	e_shstrndx;
-} Elf32_Ehdr;
-
-typedef struct {
-    Elf64_Char	e_ident[EI_NIDENT];
-    Elf64_Half	e_type;
-    Elf64_Half	e_machine;
-    Elf64_Word	e_version;
-    Elf64_Addr	e_entry;  /* Entry point */
-    Elf64_Off	e_phoff;
-    Elf64_Off	e_shoff;
-    Elf64_Word	e_flags;
-    Elf64_Half	e_ehsize;
-    Elf64_Half	e_phentsize;
-    Elf64_Half	e_phnum;
-    Elf64_Half	e_shentsize;
-    Elf64_Half	e_shnum;
-    Elf64_Half	e_shstrndx;
-} Elf64_Ehdr;
-
-/* e_type */
-#define	ET_REL		1
-#define	ET_EXEC		2
-#define	ET_DYN		3
-#define	ET_CORE		4
-
-/* e_machine (used only for SunOS 5.x hardware capabilities) */
-#define	EM_SPARC	2
-#define	EM_386		3
-#define	EM_SPARC32PLUS	18
-#define	EM_SPARCV9	43
-#define	EM_IA_64	50
-#define	EM_AMD64	62
-
-/* sh_type */
-#define	SHT_SYMTAB	2
-#define	SHT_NOTE	7
-#define	SHT_DYNSYM	11
-#define	SHT_SUNW_cap	0x6ffffff5	/* SunOS 5.x hw/sw capabilites */
-
-/* elf type */
-#define	ELFDATANONE	0		/* e_ident[EI_DATA] */
-#define	ELFDATA2LSB	1
-#define	ELFDATA2MSB	2
-
-/* elf class */
-#define	ELFCLASSNONE	0
-#define	ELFCLASS32	1
-#define	ELFCLASS64	2
-
-/* magic number */
-#define	EI_MAG0		0		/* e_ident[] indexes */
-#define	EI_MAG1		1
-#define	EI_MAG2		2
-#define	EI_MAG3		3
-#define	EI_CLASS	4
-#define	EI_DATA		5
-#define	EI_VERSION	6
-#define	EI_PAD		7
-
-#define	ELFMAG0		0x7f		/* EI_MAG */
-#define	ELFMAG1		'E'
-#define	ELFMAG2		'L'
-#define	ELFMAG3		'F'
-#define	ELFMAG		"\177ELF"
-
-#define	OLFMAG1		'O'
-#define	OLFMAG		"\177OLF"
-
-typedef struct {
-    Elf32_Word	p_type;
-    Elf32_Off	p_offset;
-    Elf32_Addr	p_vaddr;
-    Elf32_Addr	p_paddr;
-    Elf32_Word	p_filesz;
-    Elf32_Word	p_memsz;
-    Elf32_Word	p_flags;
-    Elf32_Word	p_align;
-} Elf32_Phdr;
-
-typedef struct {
-    Elf64_Word	p_type;
-    Elf64_Word	p_flags;
-    Elf64_Off	p_offset;
-    Elf64_Addr	p_vaddr;
-    Elf64_Addr	p_paddr;
-    Elf64_Xword	p_filesz;
-    Elf64_Xword	p_memsz;
-    Elf64_Xword	p_align;
-} Elf64_Phdr;
-
-#define	PT_NULL		0		/* p_type */
-#define	PT_LOAD		1
-#define	PT_DYNAMIC	2
-#define	PT_INTERP	3
-#define	PT_NOTE		4
-#define	PT_SHLIB	5
-#define	PT_PHDR		6
-#define	PT_NUM		7
-
-typedef struct {
-    Elf32_Word	sh_name;
-    Elf32_Word	sh_type;
-    Elf32_Word	sh_flags;
-    Elf32_Addr	sh_addr;
-    Elf32_Off	sh_offset;
-    Elf32_Word	sh_size;
-    Elf32_Word	sh_link;
-    Elf32_Word	sh_info;
-    Elf32_Word	sh_addralign;
-    Elf32_Word	sh_entsize;
-} Elf32_Shdr;
-
-typedef struct {
-    Elf64_Word	sh_name;
-    Elf64_Word	sh_type;
-    Elf64_Off	sh_flags;
-    Elf64_Addr	sh_addr;
-    Elf64_Off	sh_offset;
-    Elf64_Off	sh_size;
-    Elf64_Word	sh_link;
-    Elf64_Word	sh_info;
-    Elf64_Off	sh_addralign;
-    Elf64_Off	sh_entsize;
-} Elf64_Shdr;
-
-#define	NT_NETBSD_CORE_PROCINFO		1
-
-/* Note header in a PT_NOTE section */
-typedef struct elf_note {
-    Elf32_Word	n_namesz;	/* Name size */
-    Elf32_Word	n_descsz;	/* Content size */
-    Elf32_Word	n_type;		/* Content type */
-} Elf32_Nhdr;
-
-typedef struct {
-    Elf64_Word	n_namesz;
-    Elf64_Word	n_descsz;
-    Elf64_Word	n_type;
-} Elf64_Nhdr;
-
-/* Notes used in ET_CORE */
-#define	NT_PRSTATUS	1
-#define	NT_PRFPREG	2
-#define	NT_PRPSINFO	3
-#define	NT_PRXREG	4
-#define	NT_TASKSTRUCT	4
-#define	NT_PLATFORM	5
-#define	NT_AUXV		6
-
-/* Note types used in executables */
-/* NetBSD executables (name = "NetBSD") */
-#define	NT_NETBSD_VERSION	1
-#define	NT_NETBSD_EMULATION	2
-#define	NT_FREEBSD_VERSION	1
-#define	NT_OPENBSD_VERSION	1
-#define	NT_DRAGONFLY_VERSION	1
-/*
- * GNU executables (name = "GNU")
- * word[0]: GNU OS tags
- * word[1]: major version
- * word[2]: minor version
- * word[3]: tiny version
- */
-#define	NT_GNU_VERSION		1
-
-/* GNU OS tags */
-#define	GNU_OS_LINUX	0
-#define	GNU_OS_HURD	1
-#define	GNU_OS_SOLARIS	2
-#define	GNU_OS_KFREEBSD	3
-#define	GNU_OS_KNETBSD	4
-
-/*
- * GNU Hardware capability information 
- * word[0]: Number of entries
- * word[1]: Bitmask of enabled entries
- * Followed by a byte id, and a NUL terminated string per entry
- */
-#define	NT_GNU_HWCAP		2
-
-/*
- * GNU Build ID generated by ld
- * 160 bit SHA1 [default] 
- * 128 bit md5 or uuid
- */
-#define	NT_GNU_BUILD_ID		3
-
-/* SunOS 5.x hardware/software capabilities */
-typedef struct {
-	Elf32_Word	c_tag;
-	union {
-		Elf32_Word	c_val;
-		Elf32_Addr	c_ptr;
-	} c_un;
-} Elf32_Cap;
-
-typedef struct {
-	Elf64_Xword	c_tag;
-	union {
-		Elf64_Xword	c_val;
-		Elf64_Addr	c_ptr;
-	} c_un;
-} Elf64_Cap;
-
-/* SunOS 5.x hardware/software capability tags */
-#define	CA_SUNW_NULL	0
-#define	CA_SUNW_HW_1	1
-#define	CA_SUNW_SF_1	2
-
-/* SunOS 5.x software capabilities */
-#define	SF1_SUNW_FPKNWN	0x01
-#define	SF1_SUNW_FPUSED	0x02
-#define	SF1_SUNW_MASK	0x03
-
-/* SunOS 5.x hardware capabilities: sparc */
-#define	AV_SPARC_MUL32		0x0001
-#define	AV_SPARC_DIV32		0x0002
-#define	AV_SPARC_FSMULD		0x0004
-#define	AV_SPARC_V8PLUS		0x0008
-#define	AV_SPARC_POPC		0x0010
-#define	AV_SPARC_VIS		0x0020
-#define	AV_SPARC_VIS2		0x0040
-#define	AV_SPARC_ASI_BLK_INIT	0x0080
-#define	AV_SPARC_FMAF		0x0100
-#define	AV_SPARC_FJFMAU		0x4000
-#define	AV_SPARC_IMA		0x8000
-
-/* SunOS 5.x hardware capabilities: 386 */
-#define	AV_386_FPU		0x00000001
-#define	AV_386_TSC		0x00000002
-#define	AV_386_CX8		0x00000004
-#define	AV_386_SEP		0x00000008
-#define	AV_386_AMD_SYSC		0x00000010
-#define	AV_386_CMOV		0x00000020
-#define	AV_386_MMX		0x00000040
-#define	AV_386_AMD_MMX		0x00000080
-#define	AV_386_AMD_3DNow	0x00000100
-#define	AV_386_AMD_3DNowx	0x00000200
-#define	AV_386_FXSR		0x00000400
-#define	AV_386_SSE		0x00000800
-#define	AV_386_SSE2		0x00001000
-#define	AV_386_PAUSE		0x00002000
-#define	AV_386_SSE3		0x00004000
-#define	AV_386_MON		0x00008000
-#define	AV_386_CX16		0x00010000
-#define	AV_386_AHF		0x00020000
-#define	AV_386_TSCP		0x00040000
-#define	AV_386_AMD_SSE4A	0x00080000
-#define	AV_386_POPCNT		0x00100000
-#define	AV_386_AMD_LZCNT	0x00200000
-#define	AV_386_SSSE3		0x00400000
-#define	AV_386_SSE4_1		0x00800000
-#define	AV_386_SSE4_2		0x01000000
-
-#endif

ext/fileinfo/libmagic/softmagic.c

@@ -884,14 +884,17 @@ mconvert(struct magic_set *ms, struct magic *m, int flip)
 		size_t sz = file_pstring_length_size(m);
 		char *ptr1 = p->s, *ptr2 = ptr1 + sz;
 		size_t len = file_pstring_get_length(m, ptr1);
-		if (len >= sizeof(p->s)) {
+		sz = sizeof(p->s) - sz; /* maximum length of string */
+		if (len >= sz) {
 			/*
 			 * The size of the pascal string length (sz)
 			 * is 1, 2, or 4. We need at least 1 byte for NUL
 			 * termination, but we've already truncated the
 			 * string by p->s, so we need to deduct sz.
+			 * Because we can use one of the bytes of the length
+			 * after we shifted as NUL termination.
 			 */ 
-			len = sizeof(p->s) - sz;
+			len = sz;
 		}
 		while (len--)
 			*ptr1++ = *ptr2++;

ext/fileinfo/tests/bug68735.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug #68735 fileinfo out-of-bounds memory access
+--SKIPIF--
+<?php require_once(dirname(__FILE__) . '/skipif.inc'); ?>
+--FILE--
+<?php
+	$test_file = dirname(__FILE__) . DIRECTORY_SEPARATOR . "bug68735.jpg";
+	$f = new finfo;
+
+	var_dump($f->file($test_file));
+
+?>
+===DONE===
+--EXPECTF--
+string(%d) "JPEG image data, JFIF standard 1.01, comment: "%S""
+===DONE===

ext/gd/libgd/gdft.c

@@ -370,9 +370,10 @@ static void *fontFetch (char **error, void *key)
 	fontlist = gdEstrdup(a->fontlist);
 
 	/*
-	 * Must use gd_strtok_r else pointer corrupted by strtok in nested loop.
+	 * Must use gd_strtok_r becasuse strtok() isn't thread safe
 	 */
 	for (name = gd_strtok_r (fontlist, LISTSEPARATOR, &strtok_ptr); name; name = gd_strtok_r (0, LISTSEPARATOR, &strtok_ptr)) {
+		char *strtok_ptr_path;
 		/* make a fresh copy each time - strtok corrupts it. */
 		path = gdEstrdup (fontsearchpath);
 
@@ -388,7 +389,8 @@ static void *fontFetch (char **error, void *key)
 				break;
 			}
 		}
-		for (dir = strtok (path, PATHSEPARATOR); dir; dir = strtok (0, PATHSEPARATOR)) {
+		for (dir = gd_strtok_r (path, PATHSEPARATOR, &strtok_ptr_path); dir;
+		     dir = gd_strtok_r (0, PATHSEPARATOR, &strtok_ptr_path)) {
 			if (!strcmp(dir, ".")) {
 				TSRMLS_FETCH();
 #if HAVE_GETCWD

ext/gd/tests/bug48801_1.phpt

@@ -20,6 +20,6 @@ echo '(' . $bbox[6] . ', ' . $bbox[7] . ")\n";
 ?>
 --EXPECTF--
 (-1, 15)
-(156, 15)
-(156, -48)
+(15%d, 15)
+(15%d, -48)
 (-1, -48)

ext/gd/tests/imagegd2_nullbyte_injection.phpt

@@ -0,0 +1,31 @@
+--TEST--
+Testing null byte injection in imagegd2
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagegd2 TEST\n";
+imagegd2($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagegd2 TEST
+
+Warning: imagegd2() expects parameter 2 to be a valid path, string given in %s on line %d
+bool(false)
+bool(false)

ext/gd/tests/imagegd_nullbyte_injection.phpt

@@ -0,0 +1,31 @@
+--TEST--
+Testing null byte injection in imagegd
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagegd TEST\n";
+imagegd($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagegd TEST
+
+Warning: imagegd() expects parameter 2 to be a valid path, string given in %s on line %d
+bool(false)
+bool(false)

ext/gd/tests/imagegif_nullbyte_injection.phpt

@@ -0,0 +1,38 @@
+--TEST--
+Testing null byte injection in imagegif
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--SKIPIF--
+<?php
+$support = gd_info();
+if (!isset($support['GIF Create Support']) || $support['GIF Create Support'] === false) {
+	print 'skip gif support not available';
+}
+?>
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagegif TEST\n";
+imagegif($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagegif TEST
+
+Warning: imagegif(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
+bool(false)
+bool(false)

ext/gd/tests/imagejpeg_nullbyte_injection.phpt

@@ -0,0 +1,38 @@
+--TEST--
+Testing null byte injection in imagejpeg
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--SKIPIF--
+<?php
+$support = gd_info();
+if (!isset($support['JPEG Support']) || $support['JPEG Support'] === false) {
+	print 'skip jpeg support not available';
+}
+?>
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagejpeg TEST\n";
+imagejpeg($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagejpeg TEST
+
+Warning: imagejpeg(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
+bool(false)
+bool(false)

ext/gd/tests/imagepng_nullbyte_injection.phpt

@@ -0,0 +1,38 @@
+--TEST--
+Testing null byte injection in imagepng
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--SKIPIF--
+<?php
+$support = gd_info();
+if (!isset($support['PNG Support']) || $support['PNG Support'] === false) {
+	print 'skip png support not available';
+}
+?>
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagepng TEST\n";
+imagepng($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagepng TEST
+
+Warning: imagepng(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
+bool(false)
+bool(false)

ext/gd/tests/imagewbmp_nullbyte_injection.phpt

@@ -0,0 +1,38 @@
+--TEST--
+Testing null byte injection in imagewbmp
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--SKIPIF--
+<?php
+$support = gd_info();
+if (!isset($support['WBMP Support']) || $support['WBMP Support'] === false) {
+	print 'skip wbmp support not available';
+}
+?>
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagewbmp TEST\n";
+imagewbmp($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagewbmp TEST
+
+Warning: imagewbmp(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
+bool(false)
+bool(false)

ext/gd/tests/imagewebp_nullbyte_injection.phpt

@@ -0,0 +1,38 @@
+--TEST--
+Testing null byte injection in imagewebp
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--SKIPIF--
+<?php
+$support = gd_info();
+if (!isset($support['WEBP Support']) || $support['WEBP Support'] === false) {
+	print 'skip webp support not available';
+}
+?>
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagewebp TEST\n";
+imagewebp($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagewbmp TEST
+
+Warning: imagewebp(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
+bool(false)
+bool(false)

ext/gmp/gmp.c

@@ -324,30 +324,6 @@ static void _php_gmpnum_free(zend_rsrc_list_entry *rsrc TSRMLS_DC);
 #	define MAX_BASE 36
 #endif
 
-/* {{{ gmp_emalloc
- */
-static void *gmp_emalloc(size_t size)
-{
-	return emalloc(size);
-}
-/* }}} */
-
-/* {{{ gmp_erealloc
- */
-static void *gmp_erealloc(void *ptr, size_t old_size, size_t new_size)
-{
-	return erealloc(ptr, new_size);
-}
-/* }}} */
-
-/* {{{ gmp_efree
- */
-static void gmp_efree(void *ptr, size_t size)
-{
-	efree(ptr);
-}
-/* }}} */
-
 /* {{{ ZEND_GINIT_FUNCTION
  */
 static ZEND_GINIT_FUNCTION(gmp)
@@ -369,8 +345,6 @@ ZEND_MODULE_STARTUP_D(gmp)
 #endif
 	REGISTER_STRING_CONSTANT("GMP_VERSION", (char *)gmp_version, CONST_CS | CONST_PERSISTENT);
 
-	mp_set_memory_functions(gmp_emalloc, gmp_erealloc, gmp_efree);
-
 	return SUCCESS;
 }
 /* }}} */

ext/json/json.c

@@ -368,7 +368,7 @@ static int json_utf8_to_utf16(unsigned short *utf16, char utf8[], int len) /* {{
 			}
 		}
 	} else {
-		/* Only check if utf8 string is valid, and compute utf16 lenght */
+		/* Only check if utf8 string is valid, and compute utf16 length */
 		for (j=0 ; pos < len ; j++) {
 			us = php_next_utf8_char((const unsigned char *)utf8, len, &pos, &status);
 			if (status != SUCCESS) {

ext/ldap/ldap.c

@@ -385,6 +385,23 @@ static int _get_lderrno(LDAP *ldap)
 }
 /* }}} */
 
+/* {{{ _set_lderrno
+ */
+static void _set_lderrno(LDAP *ldap, int lderr)
+{
+#if !HAVE_NSLDAP
+#if LDAP_API_VERSION > 2000 || HAVE_ORALDAP
+	/* New versions of OpenLDAP do it this way */
+	ldap_set_option(ldap, LDAP_OPT_ERROR_NUMBER, &lderr);
+#else
+	ldap->ld_errno = lderr;
+#endif
+#else
+	ldap_set_lderrno(ldap, lderr, NULL, NULL);
+#endif
+}
+/* }}} */
+
 /* {{{ proto bool ldap_bind(resource link [, string dn [, string password]])
    Bind to LDAP directory */
 PHP_FUNCTION(ldap_bind)
@@ -399,18 +416,20 @@ PHP_FUNCTION(ldap_bind)
 		RETURN_FALSE;
 	}
 
+	ZEND_FETCH_RESOURCE(ld, ldap_linkdata *, &link, -1, "ldap link", le_link);
+
 	if (ldap_bind_dn != NULL && memchr(ldap_bind_dn, '\0', ldap_bind_dnlen) != NULL) {
+		_set_lderrno(ld->link, LDAP_INVALID_CREDENTIALS);
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "DN contains a null byte");
 		RETURN_FALSE;
 	}
 
 	if (ldap_bind_pw != NULL && memchr(ldap_bind_pw, '\0', ldap_bind_pwlen) != NULL) {
+		_set_lderrno(ld->link, LDAP_INVALID_CREDENTIALS);
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Password contains a null byte");
 		RETURN_FALSE;
 	}
 
-	ZEND_FETCH_RESOURCE(ld, ldap_linkdata *, &link, -1, "ldap link", le_link);
-
 	if ((rc = ldap_bind_s(ld->link, ldap_bind_dn, ldap_bind_pw, LDAP_AUTH_SIMPLE)) != LDAP_SUCCESS) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to bind to server: %s", ldap_err2string(rc));
 		RETURN_FALSE;

ext/mbstring/mb_gpc.c

@@ -260,7 +260,7 @@ const mbfl_encoding *_php_mb_encoding_handler_ex(const php_mb_encoding_handler_i
 		goto out;
 	}
 
-	num = n; /* make sure to process initilized vars only */
+	num = n; /* make sure to process initialized vars only */
 	
 	/* initialize converter */
 	if (info->num_from_encodings <= 0) {

ext/mcrypt/mcrypt.c

@@ -619,8 +619,11 @@ PHP_FUNCTION(mcrypt_generic_init)
 
 	if (iv_len != iv_size) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Iv size incorrect; supplied length: %d, needed: %d", iv_len, iv_size);
+		if (iv_len > iv_size) {
+			iv_len = iv_size;
+		}
 	}
-	memcpy(iv_s, iv, iv_size);
+	memcpy(iv_s, iv, iv_len);
 
 	mcrypt_generic_deinit(pm->td);
 	result = mcrypt_generic_init(pm->td, key_s, key_size, iv_s);
@@ -641,8 +644,9 @@ PHP_FUNCTION(mcrypt_generic_init)
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unknown error");
 				break;
 		}
+	} else {
+		pm->init = 1;
 	}
-	pm->init = 1;
 	RETVAL_LONG(result);
 
 	efree(iv_s);

ext/mysqli/tests/010.phpt

@@ -62,18 +62,18 @@ mysqli_close($link);
 --EXPECT--
 array(7) {
   [0]=>
-  float(3.14159274101)
+  float(3.141593)
   [1]=>
-  float(-9.99999997475E-7)
+  float(-1.0E-6)
   [2]=>
   float(0)
   [3]=>
-  float(999999995904)
+  float(1.0E+12)
   [4]=>
-  float(0.564642488956)
+  float(0.5646425)
   [5]=>
   float(1)
   [6]=>
-  float(8.88888914608E+14)
+  float(8.888889E+14)
 }
-done!
+done!

ext/mysqli/tests/011.phpt

@@ -67,7 +67,7 @@ array(8) {
   [3]=>
   int(4999999)
   [4]=>
-  float(2345.60009766)
+  float(2345.6)
   [5]=>
   float(5678.89563)
   [6]=>
@@ -75,4 +75,4 @@ array(8) {
   [7]=>
   %unicode|string%(11) "mysql rulez"
 }
-done!
+done!

ext/mysqli/tests/012.phpt

@@ -66,7 +66,7 @@ array(8) {
   [3]=>
   int(54)
   [4]=>
-  float(2.59999990463)
+  float(2.6)
   [5]=>
   float(58.89)
   [6]=>
@@ -74,4 +74,4 @@ array(8) {
   [7]=>
   %unicode|string%(3) "6.7"
 }
-done!
+done!

ext/mysqli/tests/bug67839.phpt

@@ -0,0 +1,58 @@
+--TEST--
+mysqli_float_handling - ensure 4 byte float is handled correctly
+--SKIPIF--
+<?php
+	require_once('skipif.inc');
+	require_once('skipifemb.inc');
+	require_once('skipifconnectfailure.inc');
+?>
+--FILE--
+<?php
+	require('connect.inc');
+	if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket)) {
+		printf("[001] [%d] %s\n", mysqli_connect_errno(), mysqli_connect_error());
+		die();
+	}
+
+
+	if (!mysqli_query($link, "DROP TABLE IF EXISTS test")) {
+		printf("[002] [%d] %s\n", mysqli_errno($link), mysqli_error($link));
+		die();
+	}
+
+	if (!mysqli_query($link, "CREATE TABLE test(id INT PRIMARY KEY, fp4 FLOAT, fp8 DOUBLE) ENGINE = InnoDB")) {
+		printf("[003] [%d] %s\n", mysqli_errno($link), mysqli_error($link));
+		die();
+	}
+
+	// Insert via string to make sure the real floating number gets to the DB
+	if (!mysqli_query($link, "INSERT INTO test(id, fp4, fp8) VALUES (1, 9.9999, 9.9999)")) {
+		printf("[004] [%d] %s\n", mysqli_errno($link), mysqli_error($link));
+		die();
+	}
+
+	if (!($stmt = mysqli_prepare($link, "SELECT id, fp4, fp8 FROM test"))) {
+		printf("[005] [%d] %s\n", mysqli_errno($link), mysqli_error($link));
+		die();
+	}
+
+	if (!mysqli_stmt_execute($stmt)) {
+		printf("[006] [%d] %s\n", mysqli_errno($link), mysqli_error($link));
+		die();
+	}
+
+
+	if (!($result = mysqli_stmt_get_result($stmt))) {
+		printf("[007] [%d] %s\n", mysqli_errno($link), mysqli_error($link));
+		die();
+	}
+
+	$data = mysqli_fetch_assoc($result);
+	print $data['id'] . ": " . $data['fp4'] . ": " . $data['fp8'] . "\n";
+?>
+--CLEAN--
+<?php
+	require_once("clean_table.inc");
+?>
+--EXPECTF--
+1: 9.9999: 9.9999

ext/mysqli/tests/mysqli_change_user.phpt

@@ -41,6 +41,11 @@ require_once('skipifconnectfailure.inc');
 	if (false !== ($tmp = mysqli_change_user($link, $user, $passwd, $db . '_unknown_really')))
 		printf("[009] Expecting false, got %s/%s\n", gettype($tmp), $tmp);
 
+	// Reconnect because after 3 failed change_user attempts, the server blocks you off.
+	if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
+		printf("[006] Cannot connect to the server using host=%s, user=%s, passwd=***, dbname=%s, port=%s, socket=%s\n",
+			$host, $user, $db, $port, $socket);
+
 	if (!mysqli_query($link, 'SET @mysqli_change_user_test_var=1'))
 		printf("[010] Failed to set test variable: [%d] %s\n", mysqli_errno($link), mysqli_error($link));
 
@@ -109,4 +114,4 @@ require_once('skipifconnectfailure.inc');
 	print "done!";
 ?>
 --EXPECTF--
-done!
+done!

ext/mysqli/tests/mysqli_change_user_oo.phpt

@@ -43,6 +43,11 @@ if (!$IS_MYSQLND && (mysqli_get_server_version($link) < 50118 && mysqli_get_serv
 	if (false !== ($tmp = $mysqli->change_user($user, $passwd, $db . '_unknown_really')))
 		printf("[008] Expecting false, got %s/%s\n", gettype($tmp), $tmp);
 
+	// Reconnect because after 3 failed change_user attempts, the server blocks you off.
+	if (!$mysqli = new my_mysqli($host, $user, $passwd, $db, $port, $socket))
+		printf("[001] Cannot connect to the server using host=%s, user=%s, passwd=***, dbname=%s, port=%s, socket=%s\n",
+			$host, $user, $db, $port, $socket);
+
 	if (!$mysqli->query('SET @mysqli_change_user_test_var=1'))
 		printf("[009] Failed to set test variable: [%d] %s\n", $mysqli->errno, $mysqli->error);
 
@@ -81,4 +86,4 @@ if (!$IS_MYSQLND && (mysqli_get_server_version($link) < 50118 && mysqli_get_serv
 	print "done!";
 ?>
 --EXPECTF--
-done!
+done!

ext/mysqli/tests/mysqli_real_escape_string_gbk.phpt

@@ -36,7 +36,7 @@ $port, $socket, mysqli_connect_errno(), mysqli_connect_error());
 mysqli_error($link));
 	}
 
-	if (!mysqli_query($link, 'CREATE TABLE test(id INT, label CHAR(1), PRIMARY
+	if (!mysqli_query($link, 'CREATE TABLE test(id INT, label CHAR(3), PRIMARY
 KEY(id)) ENGINE=' . $engine . " DEFAULT CHARSET=gbk")) {
 		printf("Failed to create test table: [%d] %s\n", mysqli_errno($link),
 mysqli_error($link));

ext/mysqli/tests/mysqli_stmt_multires.phpt

@@ -0,0 +1,120 @@
+--TEST--
+Multiple result set with PS
+--SKIPIF--
+<?php
+require_once('skipif.inc');
+require_once("connect.inc");
+if (!$IS_MYSQLND) {
+    die("skip mysqlnd only test");
+}
+require_once('skipifconnectfailure.inc');
+?>
+--FILE--
+<?php
+	require_once("connect.inc");
+	require('table.inc');
+
+	$stmt = mysqli_stmt_init($link);
+	if (!$link->query('DROP PROCEDURE IF EXISTS p123')) {
+		printf("[001] [%d] %s\n", $link->error, $link->errno);
+	}
+
+	if (!$link->query("CREATE PROCEDURE p123() BEGIN SELECT id+12, CONCAT_WS('-',label,'ahoi') FROM test ORDER BY id LIMIT 1; SELECT id + 42, CONCAT_WS('---',label, label) FROM test ORDER BY id LIMIT 1; END")) {
+		printf("[002] [%d] %s\n", $link->error, $link->errno);
+	}
+	
+	if (!($stmt = $link->prepare("CALL p123"))) {
+		printf("[003] [%d] %s\n", $stmt->error, $stmt->errno);
+	}
+
+	if (!$stmt->execute()) {
+		printf("[005] [%d] %s\n", $stmt->error, $stmt->errno);
+	}
+
+	$c_id = NULL;
+	$c_label = NULL;
+	if (!$stmt->bind_result($c_id, $c_label)) {
+		printf("[004] [%d] %s\n", $stmt->error, $stmt->errno);
+	}
+	var_dump("pre:",$c_id, $c_label);
+
+	if (!$stmt->fetch()) {
+		printf("[006] [%d] %s\n", $stmt->error, $stmt->errno);
+	}
+
+	var_dump("post:",$c_id, $c_label);
+
+	if ($stmt->fetch()) {
+		printf("[007] Shouldn't have fetched anything\n");
+		var_dump($c_id, $c_label);
+	}
+
+	if ($stmt->fetch()) {
+		printf("[008] No more rows expected\n");
+	}
+
+	if (!$stmt->more_results()) {
+		printf("[009] Expected more results\n");
+	} else {
+		var_dump("[009] next_result:", $stmt->next_result());
+	}
+
+	if (!$stmt->bind_result($c_id, $c_label)) {
+		printf("[010] [%d] %s\n", $stmt->error, $stmt->errno);
+	}
+	var_dump("pre:",$c_id, $c_label);
+
+	if (!$stmt->fetch()) {
+		printf("[011] [%d] %s\n", $stmt->error, $stmt->errno);
+	}
+
+	var_dump("post:",$c_id, $c_label);
+
+	if ($stmt->fetch()) {
+		printf("[012] No more rows expected\n");
+	}
+
+	if (!$stmt->more_results()) {
+		printf("[013] Expected more results\n");
+	} else {
+		var_dump("[013] next_result:", $stmt->next_result());
+	}
+
+	if ($stmt->more_results()) {
+		printf("[014] No more results expected\n");
+	} else {
+		printf("[014] No result, as expected\n");
+	}
+
+	$stmt->close();
+	$link->close();
+
+
+	echo "done";
+?>
+--CLEAN--
+<?php
+	require_once("connect.inc");
+	if (!$link->query('DROP PROCEDURE IF EXISTS p123')) {
+		printf("[001] [%d] %s\n", $link->error, $link->errno);
+	}
+?>
+--EXPECTF--
+string(4) "pre:"
+NULL
+NULL
+string(5) "post:"
+int(13)
+string(6) "a-ahoi"
+string(18) "[009] next_result:"
+bool(true)
+string(4) "pre:"
+int(13)
+string(6) "a-ahoi"
+string(5) "post:"
+int(43)
+string(5) "a---a"
+string(18) "[013] next_result:"
+bool(true)
+[014] No result, as expected
+done

ext/mysqli/tests/table.inc

@@ -12,6 +12,11 @@ if (!mysqli_query($link, 'DROP TABLE IF EXISTS test')) {
 	exit(1);
 }
 
+if (!mysqli_query($link, 'SET SESSION sql_mode=\'\'')) {
+	printf("Failed to drop old test table: [%d] %s\n", mysqli_errno($link), mysqli_error($link));
+	exit(1);
+}
+
 if (!mysqli_query($link, 'CREATE TABLE test(id INT, label CHAR(1), PRIMARY KEY(id)) ENGINE=' . $engine)) {
 	printf("Failed to create test table: [%d] %s\n", mysqli_errno($link), mysqli_error($link));
 	exit(1);
@@ -20,4 +25,4 @@ if (!mysqli_query($link, 'CREATE TABLE test(id INT, label CHAR(1), PRIMARY KEY(i
 if (!mysqli_query($link, "INSERT INTO test(id, label) VALUES (1, 'a'), (2, 'b'), (3, 'c'), (4, 'd'), (5, 'e'), (6, 'f')")) {
 	printf("[%d] %s\n",  mysqli_errno($link), mysqli_error($link));
 }
-?>
+?>

ext/mysqlnd/config9.m4

@@ -51,3 +51,29 @@ if test "$PHP_MYSQLND" != "no" || test "$PHP_MYSQLND_ENABLED" = "yes" || test "$
 #endif
   ])
 fi
+
+dnl
+dnl Check if the compiler supports Decimal32/64/128 types from the IEEE-754 2008 version
+dnl References: http://www.open-std.org/jtc1/sc22/wg14/www/docs/n1657.pdf
+dnl http://speleotrove.com/decimal/
+dnl
+AC_CACHE_CHECK([whether whether compiler supports Decimal32/64/128 types], ac_cv_decimal_fp_supported,[
+AC_TRY_RUN( [
+#include <stdio.h>
+
+int main(int argc, char **argv) {
+	typedef float dec32 __attribute__((mode(SD)));
+	dec32 k = 99.49f;
+	double d2 = (double)k;
+	return 0;
+}
+],[
+  ac_cv_decimal_fp_supported=yes
+],[
+  ac_cv_decimal_fp_supported=no
+],[
+  ac_cv_decimal_fp_supported=no
+])])
+if test "$ac_cv_decimal_fp_supported" = "yes"; then
+  AC_DEFINE(HAVE_DECIMAL_FP_SUPPORT, 1, [Define if the compiler supports Decimal32/64/128 types.])
+fi

ext/mysqlnd/mysqlnd_ps.c

@@ -50,6 +50,7 @@ enum_func_status mysqlnd_fetch_stmt_row_cursor(MYSQLND_RES *result, void *param,
 static void mysqlnd_stmt_separate_result_bind(MYSQLND_STMT * const stmt TSRMLS_DC);
 static void mysqlnd_stmt_separate_one_result_bind(MYSQLND_STMT * const stmt, unsigned int param_no TSRMLS_DC);
 
+static void MYSQLND_METHOD(mysqlnd_stmt, free_stmt_result)(MYSQLND_STMT * const s TSRMLS_DC);
 
 /* {{{ mysqlnd_stmt::store_result */
 static MYSQLND_RES *
@@ -226,7 +227,7 @@ MYSQLND_METHOD(mysqlnd_stmt, next_result)(MYSQLND_STMT * s TSRMLS_DC)
 	DBG_INF_FMT("server_status=%u cursor=%u", stmt->upsert_status->server_status, stmt->upsert_status->server_status & SERVER_STATUS_CURSOR_EXISTS);
 
 	/* Free space for next result */
-	s->m->free_stmt_content(s TSRMLS_CC);
+	MYSQLND_METHOD(mysqlnd_stmt, free_stmt_result)(s TSRMLS_CC);
 	{
 		enum_func_status ret = s->m->parse_execute_response(s TSRMLS_CC);
 		DBG_RETURN(ret);
@@ -2076,6 +2077,37 @@ mysqlnd_stmt_separate_one_result_bind(MYSQLND_STMT * const s, unsigned int param
 /* }}} */
 
 
+/* {{{ mysqlnd_stmt::free_stmt_result */
+static void
+MYSQLND_METHOD(mysqlnd_stmt, free_stmt_result)(MYSQLND_STMT * const s TSRMLS_DC)
+{
+	MYSQLND_STMT_DATA * stmt = s? s->data:NULL;
+	DBG_ENTER("mysqlnd_stmt::free_stmt_result");
+	if (!stmt) {
+		DBG_VOID_RETURN;
+	}
+
+	/*
+	  First separate the bound variables, which point to the result set, then
+	  destroy the set.
+	*/
+	mysqlnd_stmt_separate_result_bind(s TSRMLS_CC);
+	/* Not every statement has a result set attached */
+	if (stmt->result) {
+		stmt->result->m.free_result_internal(stmt->result TSRMLS_CC);
+		stmt->result = NULL;
+	}
+	if (stmt->error_info->error_list) {
+		zend_llist_clean(stmt->error_info->error_list);
+		mnd_pefree(stmt->error_info->error_list, s->persistent);
+		stmt->error_info->error_list = NULL;
+	}
+
+	DBG_VOID_RETURN;
+}
+/* }}} */
+
+
 /* {{{ mysqlnd_stmt::free_stmt_content */
 static void
 MYSQLND_METHOD(mysqlnd_stmt, free_stmt_content)(MYSQLND_STMT * const s TSRMLS_DC)
@@ -2108,22 +2140,7 @@ MYSQLND_METHOD(mysqlnd_stmt, free_stmt_content)(MYSQLND_STMT * const s TSRMLS_DC
 		stmt->param_bind = NULL;
 	}
 
-	/*
-	  First separate the bound variables, which point to the result set, then
-	  destroy the set.
-	*/
-	mysqlnd_stmt_separate_result_bind(s TSRMLS_CC);
-	/* Not every statement has a result set attached */
-	if (stmt->result) {
-		stmt->result->m.free_result_internal(stmt->result TSRMLS_CC);
-		stmt->result = NULL;
-	}
-	if (stmt->error_info->error_list) {
-		zend_llist_clean(stmt->error_info->error_list);
-		mnd_pefree(stmt->error_info->error_list, s->persistent);
-		stmt->error_info->error_list = NULL;
-	}
-
+	MYSQLND_METHOD(mysqlnd_stmt, free_stmt_result)(s TSRMLS_CC);
 	DBG_VOID_RETURN;
 }
 /* }}} */

ext/mysqlnd/mysqlnd_ps_codec.c

@@ -195,12 +195,53 @@ void ps_fetch_float(zval *zv, const MYSQLND_FIELD * const field,
 					unsigned int pack_len, zend_uchar **row,
 					zend_bool as_unicode TSRMLS_DC)
 {
-	float value;
+	float fval;
+	double dval;
 	DBG_ENTER("ps_fetch_float");
-	float4get(value, *row);
-	ZVAL_DOUBLE(zv, value);
+	float4get(fval, *row);
 	(*row)+= 4;
-	DBG_INF_FMT("value=%f", value);
+	DBG_INF_FMT("value=%f", fval);
+
+	/*
+	 * The following is needed to correctly support 4-byte floats.
+	 * Otherwise, a value of 9.99 in a FLOAT column comes out of mysqli
+	 * as 9.9998998641968.
+	 *
+	 * For GCC, we use the built-in decimal support to "up-convert" a
+	 * 4-byte float to a 8-byte double.
+	 * When that is not available, we fall back to converting the float
+	 * to a string and then converting the string to a double. This mimics
+	 * what MySQL does.
+	 */
+#ifdef HAVE_DECIMAL_FP_SUPPORT
+	{
+		typedef float dec32 __attribute__((mode(SD)));
+		dec32 d32val = fval;
+
+		/* The following cast is guaranteed to do the right thing */
+		dval = (double) d32val;
+	}
+#else
+	{
+		char num_buf[2048]; /* Over allocated */
+		char *s;
+
+		/* Convert to string. Ignoring localization, etc.
+		 * Following MySQL's rules. If precision is undefined (NOT_FIXED_DEC i.e. 31)
+		 * or larger than 31, the value is limited to 6 (FLT_DIG).
+		 */
+		s = php_gcvt(fval,
+			     field->decimals >= 31 ? 6 : field->decimals,
+			     '.',
+			     'e',
+			     num_buf);
+
+		/* And now convert back to double */
+		dval = zend_strtod(s, NULL);
+	}
+#endif
+
+	ZVAL_DOUBLE(zv, dval);
 	DBG_VOID_RETURN;
 }
 /* }}} */

ext/mysqlnd/mysqlnd_result.c

@@ -518,7 +518,7 @@ mysqlnd_query_read_result_set_header(MYSQLND_CONN_DATA * conn, MYSQLND_STMT * s
 						conn->current_result = NULL;
 					} else {
 						stmt->result = NULL;
-						memset(stmt, 0, sizeof(MYSQLND_STMT));
+						memset(stmt, 0, sizeof(*stmt));
 						stmt->state = MYSQLND_STMT_INITTED;
 					}
 				} else {
@@ -1182,7 +1182,7 @@ MYSQLND_METHOD(mysqlnd_res, store_result_fetch_data)(MYSQLND_CONN_DATA * const c
 		  No need to FREE_ALLOCA as we can reuse the
 		  'lengths' and 'fields' arrays. For lengths its absolutely safe.
 		  'fields' is reused because the ownership of the strings has been
-		  transfered above. 
+		  transferred above.
 		*/
 	}
 	/* Overflow ? */

ext/openssl/openssl.c

@@ -4556,14 +4556,14 @@ int php_openssl_apply_verification_policy(SSL *ssl, X509 *peer, php_stream *stre
 			return FAILURE;
 		}
 
-		match = strcmp(cnmatch, buf) == 0;
+		match = strcasecmp(cnmatch, buf) == 0;
 		if (!match && strlen(buf) > 3 && buf[0] == '*' && buf[1] == '.') {
 			/* Try wildcard */
 
 			if (strchr(buf+2, '.')) {
 				char *tmp = strstr(cnmatch, buf+1);
 
-				match = tmp && strcmp(tmp, buf+2) && tmp == strchr(cnmatch, '.');
+				match = tmp && strcasecmp(tmp, buf+2) && tmp == strchr(cnmatch, '.');
 			}
 		}
 

ext/pcre/pcrelib/ChangeLog

@@ -4935,7 +4935,7 @@ by an auxiliary program - but can then be edited by hand if required. There are
 now no calls to isalnum(), isspace(), isdigit(), isxdigit(), tolower() or
 toupper() in the code.
 
-7. Turn the malloc/free funtions variables into pcre_malloc and pcre_free and
+7. Turn the malloc/free functions variables into pcre_malloc and pcre_free and
 make them global. Abolish the function for setting them, as the caller can now
 set them directly.
 

ext/pcre/php_pcre.c

@@ -640,7 +640,7 @@ PHPAPI void php_pcre_match_impl(pcre_cache_entry *pce, char *subject, int subjec
 	}
 
 	offsets = (int *)safe_emalloc(size_offsets, sizeof(int), 0);
-
+	memset(offsets, 0, size_offsets*sizeof(int));
 	/* Allocate match sets array and initialize the values. */
 	if (global && subpats && subpats_order == PREG_PATTERN_ORDER) {
 		match_sets = (zval **)safe_emalloc(num_subpats, sizeof(zval *), 0);

ext/pdo_pgsql/pgsql_statement.c

@@ -294,7 +294,7 @@ static int pgsql_stmt_param_hook(pdo_stmt_t *stmt, struct pdo_bound_param_data *
 							sizeof(Oid));
 				}
 				if (param->paramno >= 0) {
-					if (param->paramno > zend_hash_num_elements(stmt->bound_param_map)) {
+					if (param->paramno >= zend_hash_num_elements(stmt->bound_param_map)) {
 						pdo_pgsql_error_stmt(stmt, PGRES_FATAL_ERROR, "HY105");
 						return 0;
 					}

ext/pdo_pgsql/tests/bug66584.phpt

@@ -0,0 +1,66 @@
+--TEST--
+PDO PgSQL Bug #66584 (Segmentation fault on statement deallocation)
+--SKIPIF--
+<?php
+if (!extension_loaded('pdo') || !extension_loaded('pdo_pgsql')) die('skip not loaded');
+require dirname(__FILE__) . '/config.inc';
+require dirname(__FILE__) . '/../../../ext/pdo/tests/pdo_test.inc';
+PDOTest::skip();
+?>
+--FILE--
+<?php
+require dirname(__FILE__) . '/../../../ext/pdo/tests/pdo_test.inc';
+$pdo = PDOTest::test_factory(dirname(__FILE__) . '/common.phpt');
+
+$pdo->setAttribute(\PDO::ATTR_ERRMODE, \PDO::ERRMODE_EXCEPTION);
+
+$pdo->beginTransaction();
+
+$pdo->query("CREATE TABLE b66584 (a int)");
+$pdo->query("INSERT INTO b66584 VALUES (165)");
+
+for ($i = 1; $i >= 0; $i--) {
+	$pdo->setAttribute(\PDO::ATTR_EMULATE_PREPARES, (bool)$i);
+
+	try {
+		run($pdo, [0 => 1, 2 => 165, 5 => 3]);
+	} catch (\Exception $e) {
+		var_dump($e->getMessage());
+	}
+
+	try {
+		run($pdo, json_decode('{"0":234,"1":165,"2":221,"3":207,"4":188,"5":216,"6":1150,"7":916,"8":967,"9":987,"10":951,"11":990,"12":959,"13":896,"14":947,"15":877,"16":1000,"17":1023,"18":904,"19":856,"20":860,"21":866,"22":930,"23":974,"24":1032,"25":1016,"26":1050,"27":1059,"28":1040,"29":1064,"30":1004,"31":214,"32":189,"33":166,"34":1002,"35":167,"36":191,"37":859,"38":204,"39":181,"40":1001,"42":208,"43":198,"44":177,"45":1003,"46":858,"47":190,"48":162,"49":210,"50":171,"51":197,"52":168,"53":194,"54":209,"55":200,"56":192,"57":180,"58":232,"59":222,"60":163,"61":196,"62":217,"64":176,"65":193,"66":172,"67":195,"68":170,"69":173,"70":233,"71":223,"72":218,"73":186,"74":175,"75":224,"76":205,"77":211,"78":235,"79":1101,"80":225,"81":236,"82":1102,"83":1164,"84":1083,"85":1005,"86":861,"87":1179,"88":960,"89":991,"90":1187,"91":880,"92":1149,"93":1033,"94":931,"95":1006,"96":862,"97":1151,"98":917,"99":881,"100":1148,"101":1065,"102":867,"103":952,"104":1152,"105":918,"106":961,"107":1180,"108":992,"109":1188,"110":932,"111":933,"112":968,"113":868,"114":882,"115":1147,"116":1017,"117":1131,"118":1174,"119":1178,"120":1186,"121":869,"122":1051,"123":934,"124":969,"125":975,"126":1066,"127":237,"128":953,"129":1024,"130":1146,"131":883,"132":1145,"133":884,"134":885,"135":1144,"136":886,"137":1143,"138":1025,"139":897,"140":898,"141":899,"142":1026,"143":1142,"144":887,"145":1141,"146":888,"147":889,"148":1140,"149":1189,"150":993,"151":1139,"152":890,"153":1138,"154":891,"155":900,"156":892,"157":1137,"158":1027,"159":901,"160":1136,"161":893,"162":870,"163":1052,"164":954,"165":1041,"166":1018,"167":1165,"168":1084,"169":962,"170":1181,"171":994,"172":1190,"173":1042,"174":935,"175":226,"176":871,"177":1191,"178":995,"179":977,"180":948,"181":1175,"182":1053,"183":955,"184":1182,"185":963,"186":1067,"187":919,"188":1153,"189":920,"190":1154,"191":1055,"192":1054,"193":1056,"194":863,"195":872,"196":1028,"197":921,"198":1155,"199":936,"200":970,"201":1019,"202":1166,"203":1085,"204":1135,"205":894,"206":1034,"207":905,"208":873,"209":937,"210":902,"211":1029,"212":1007,"213":864,"214":1043,"215":1057,"216":956,"217":957,"218":939,"219":1086,"220":1167,"221":1087,"222":1168,"223":1173,"224":1108,"225":978,"226":1044,"227":1183,"228":964,"229":965,"230":1184,"231":1045,"232":874,"233":940,"234":1046,"235":979,"236":903,"237":980,"238":1156,"239":922,"240":1035,"241":906,"242":971,"243":972,"244":878,"245":1134,"246":879,"247":1133,"248":907,"249":1036,"250":908,"251":1132,"252":895,"253":909,"254":1060,"255":981,"256":1068,"257":996,"258":1192,"259":941,"260":865,"261":1008,"262":910,"263":997,"264":1193,"265":982,"266":942,"267":1020,"268":983,"269":1061,"270":949,"271":1176,"272":875,"273":911,"274":1069,"275":1157,"276":923,"277":1158,"278":924,"279":988,"280":984,"281":925,"282":1159,"283":1062,"284":1047,"285":1194,"286":998,"287":1021,"288":1030,"289":1031,"290":1070,"291":1088,"292":1169,"293":958,"294":1195,"295":999,"296":966,"297":1185,"298":944,"299":945,"300":1022,"301":1103,"302":220,"303":1099,"304":1048,"305":927,"306":1161,"307":989,"308":973,"309":1071,"310":1074,"311":1072,"312":1073,"313":912,"314":1037,"315":913,"316":914,"317":1177,"318":950,"319":1049,"320":876,"321":985,"322":915,"323":1038,"324":946,"325":1089,"326":1170,"327":1090,"328":1171,"329":1091,"330":1172,"331":1063,"332":986,"333":928,"334":1162,"335":929,"336":1163,"337":976,"338":231,"339":201,"340":1098,"341":215}', true));
+	} catch (\Exception $e) {
+		var_dump($e->getMessage());
+	}
+}
+
+try {
+	$pdo->query("DROP TABLE b66584");
+	$pdo->rollback();
+} catch (\Exception $e) {
+}
+
+function run($pdo, $data)
+{
+    $bind = join(', ', array_fill(0, count($data), '?'));
+
+    $stmt = $pdo->prepare("SELECT COUNT(*) FROM b66584 WHERE a IN ({$bind})");
+
+	var_dump(count($data));
+
+    $stmt->execute($data);
+
+	var_dump($stmt->fetchColumn());
+}
+
+?>
+--EXPECTF--
+int(3)
+string(%d) "SQLSTATE%s"
+int(340)
+string(%d) "SQLSTATE%s"
+int(3)
+string(%d) "SQLSTATE%s"
+int(340)
+string(%d) "SQLSTATE%s"

ext/simplexml/tests/bug62328.phpt

@@ -1,9 +1,7 @@
 --TEST--
 Bug #62328 (implementing __toString and a cast to string fails)
 --SKIPIF--
-<?php
-require_once("skipif.inc");
-?>
+<?php if (!extension_loaded("simplexml")) print "skip"; ?>
 --FILE--
 <?php
 class UberSimpleXML extends SimpleXMLElement {

ext/soap/interop/client_round2_interop.php

@@ -373,7 +373,7 @@ class Interop_Client
                 }
                 $soap =& $endpoint_info['client'];
 
-                # XXX how do we determine a failure on retreiving/parsing wsdl?
+                # XXX how do we determine a failure on retrieving/parsing wsdl?
                 if ($soap->wsdl->fault) {
                     $fault = $soap->wsdl->fault;
                     $soap_test->setResult(0,'WSDL',

ext/soap/php_xml.c

@@ -100,6 +100,9 @@ xmlDocPtr soap_xmlParseFile(const char *filename TSRMLS_DC)
 		ctxt->sax->warning = NULL;
 		ctxt->sax->error = NULL;
 		/*ctxt->sax->fatalError = NULL;*/
+#if LIBXML_VERSION >= 20703
+		ctxt->options |= XML_PARSE_HUGE;
+#endif
 		old = php_libxml_disable_entity_loader(1 TSRMLS_CC);
 		xmlParseDocument(ctxt);
 		php_libxml_disable_entity_loader(old TSRMLS_CC);

ext/spl/php_spl.c

@@ -326,7 +326,7 @@ PHP_FUNCTION(spl_autoload)
 		RETURN_FALSE;
 	}
 
-	if (file_exts == NULL) { /* autoload_extensions is not intialzed, set to defaults */
+	if (file_exts == NULL) { /* autoload_extensions is not initialized, set to defaults */
 		copy = pos1 = estrndup(SPL_DEFAULT_FILE_EXTENSIONS, sizeof(SPL_DEFAULT_FILE_EXTENSIONS)-1);
 	} else {
 		copy = pos1 = estrndup(file_exts, file_exts_len);

ext/standard/config.m4

@@ -170,7 +170,7 @@ main() {
   ac_cv_crypt_blowfish=no
 ])])
 
-AC_CACHE_CHECK(for SHA512 crypt, ac_cv_crypt_SHA512,[
+AC_CACHE_CHECK(for SHA512 crypt, ac_cv_crypt_sha512,[
 AC_TRY_RUN([
 #if HAVE_UNISTD_H
 #include <unistd.h>
@@ -192,14 +192,14 @@ main() {
 	exit(0);
 #endif
 }],[
-  ac_cv_crypt_SHA512=yes
+  ac_cv_crypt_sha512=yes
 ],[
-  ac_cv_crypt_SHA512=no
+  ac_cv_crypt_sha512=no
 ],[
-  ac_cv_crypt_SHA512=no
+  ac_cv_crypt_sha512=no
 ])])
 
-AC_CACHE_CHECK(for SHA256 crypt, ac_cv_crypt_SHA256,[
+AC_CACHE_CHECK(for SHA256 crypt, ac_cv_crypt_sha256,[
 AC_TRY_RUN([
 #if HAVE_UNISTD_H
 #include <unistd.h>
@@ -221,11 +221,11 @@ main() {
 	exit(0);
 #endif
 }],[
-  ac_cv_crypt_SHA256=yes
+  ac_cv_crypt_sha256=yes
 ],[
-  ac_cv_crypt_SHA256=no
+  ac_cv_crypt_sha256=no
 ],[
-  ac_cv_crypt_SHA256=no
+  ac_cv_crypt_sha256=no
 ])])
 
 

ext/standard/crypt.c

@@ -204,7 +204,7 @@ PHP_FUNCTION(crypt)
 			salt[salt_in_len] = '\0';
 
 			crypt_res = php_sha512_crypt_r(str, salt, output, needed);
-			if (!crypt_res) {
+			if (!crypt_res || (salt[0]=='*' && salt[1]=='0')) {
 				if (salt[0]=='*' && salt[1]=='0') {
 					RETVAL_STRING("*1", 1);
 				} else {
@@ -227,7 +227,7 @@ PHP_FUNCTION(crypt)
 			salt[salt_in_len] = '\0';
 
 			crypt_res = php_sha256_crypt_r(str, salt, output, needed);
-			if (!crypt_res) {
+			if (!crypt_res || (salt[0]=='*' && salt[1]=='0')) {
 				if (salt[0]=='*' && salt[1]=='0') {
 					RETVAL_STRING("*1", 1);
 				} else {
@@ -242,7 +242,6 @@ PHP_FUNCTION(crypt)
 		} else if (
 				salt[0] == '$' &&
 				salt[1] == '2' &&
-				salt[2] >= 'a' && salt[2] <= 'z' &&
 				salt[3] == '$' &&
 				salt[4] >= '0' && salt[4] <= '3' &&
 				salt[5] >= '0' && salt[5] <= '9' &&
@@ -252,7 +251,7 @@ PHP_FUNCTION(crypt)
 			memset(output, 0, PHP_MAX_SALT_LEN + 1);
 
 			crypt_res = php_crypt_blowfish_rn(str, salt, output, sizeof(output));
-			if (!crypt_res) {
+			if (!crypt_res || (salt[0]=='*' && salt[1]=='0')) {
 				if (salt[0]=='*' && salt[1]=='0') {
 					RETVAL_STRING("*1", 1);
 				} else {
@@ -268,7 +267,7 @@ PHP_FUNCTION(crypt)
 			_crypt_extended_init_r();
 
 			crypt_res = _crypt_extended_r(str, salt, &buffer);
-			if (!crypt_res) {
+			if (!crypt_res || (salt[0]=='*' && salt[1]=='0')) {
 				if (salt[0]=='*' && salt[1]=='0') {
 					RETURN_STRING("*1", 1);
 				} else {
@@ -292,7 +291,7 @@ PHP_FUNCTION(crypt)
 #    error Data struct used by crypt_r() is unknown. Please report.
 #  endif
 		crypt_res = crypt_r(str, salt, &buffer);
-		if (!crypt_res) {
+		if (!crypt_res || (salt[0]=='*' && salt[1]=='0')) {
 				if (salt[0]=='*' && salt[1]=='0') {
 					RETURN_STRING("*1", 1);
 				} else {

ext/standard/crypt_blowfish.c

@@ -8,11 +8,11 @@
  * and crypt(3) interfaces added, but optimizations specific to password
  * cracking removed.
  *
- * Written by Solar Designer <solar at openwall.com> in 1998-2011.
+ * Written by Solar Designer <solar at openwall.com> in 1998-2014.
  * No copyright is claimed, and the software is hereby placed in the public
  * domain. In case this attempt to disclaim copyright and place the software
  * in the public domain is deemed null and void, then the software is
- * Copyright (c) 1998-2011 Solar Designer and it is hereby released to the
+ * Copyright (c) 1998-2014 Solar Designer and it is hereby released to the
  * general public under the following terms:
  *
  * Redistribution and use in source and binary forms, with or without
@@ -28,12 +28,12 @@
  * you place this code and any modifications you make under a license
  * of your choice.
  *
- * This implementation is mostly compatible with OpenBSD's bcrypt.c (prefix
- * "$2a$") by Niels Provos <provos at citi.umich.edu>, and uses some of his
- * ideas. The password hashing algorithm was designed by David Mazieres
- * <dm at lcs.mit.edu>. For more information on the level of compatibility,
- * please refer to the comments in BF_set_key() below and to the crypt(3)
- * man page included in the crypt_blowfish tarball.
+ * This implementation is fully compatible with OpenBSD's bcrypt.c for prefix
+ * "$2b$", originally by Niels Provos <provos at citi.umich.edu>, and it uses
+ * some of his ideas. The password hashing algorithm was designed by David
+ * Mazieres <dm at lcs.mit.edu>. For information on the level of
+ * compatibility for bcrypt hash prefixes other than "$2b$", please refer to
+ * the comments in BF_set_key() below and to the included crypt(3) man page.
  *
  * There's a paper on the algorithm that explains its design decisions:
  *
@@ -583,6 +583,7 @@ static void BF_set_key(const char *key, BF_key expanded, BF_key initial,
  * Valid combinations of settings are:
  *
  * Prefix "$2a$": bug = 0, safety = 0x10000
+ * Prefix "$2b$": bug = 0, safety = 0
  * Prefix "$2x$": bug = 1, safety = 0
  * Prefix "$2y$": bug = 0, safety = 0
  */
@@ -646,6 +647,10 @@ static void BF_set_key(const char *key, BF_key expanded, BF_key initial,
 	initial[0] ^= sign;
 }
 
+static const unsigned char flags_by_subtype[26] =
+	{2, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 4, 0};
+
 static char *BF_crypt(const char *key, const char *setting,
 	char *output, int size,
 	BF_word min)
@@ -653,9 +658,6 @@ static char *BF_crypt(const char *key, const char *setting,
 #if BF_ASM
 	extern void _BF_body_r(BF_ctx *ctx);
 #endif
-	static const unsigned char flags_by_subtype[26] =
-		{2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 4, 0};
 	struct {
 		BF_ctx ctx;
 		BF_key expanded_key;
@@ -821,9 +823,10 @@ char *php_crypt_blowfish_rn(const char *key, const char *setting,
 {
 	const char *test_key = "8b \xd0\xc1\xd2\xcf\xcc\xd8";
 	const char *test_setting = "$2a$00$abcdefghijklmnopqrstuu";
-	static const char * const test_hash[2] =
-		{"VUrPmXD6q/nVSSp7pNDhCR9071IfIRe\0\x55", /* $2x$ */
-		"i1D709vfamulimlGcq0qq3UvuUasvEa\0\x55"}; /* $2a$, $2y$ */
+	static const char * const test_hashes[2] =
+		{"i1D709vfamulimlGcq0qq3UvuUasvEa\0\x55", /* 'a', 'b', 'y' */
+		"VUrPmXD6q/nVSSp7pNDhCR9071IfIRe\0\x55"}; /* 'x' */
+	const char *test_hash = test_hashes[0];
 	char *retval;
 	const char *p;
 	int save_errno, ok;
@@ -845,17 +848,19 @@ char *php_crypt_blowfish_rn(const char *key, const char *setting,
  * detected by the self-test.
  */
 	memcpy(buf.s, test_setting, sizeof(buf.s));
-	if (retval)
+	if (retval) {
+		unsigned int flags = flags_by_subtype[
+		    (unsigned int)(unsigned char)setting[2] - 'a'];
+		test_hash = test_hashes[flags & 1];
 		buf.s[2] = setting[2];
+	}
 	memset(buf.o, 0x55, sizeof(buf.o));
 	buf.o[sizeof(buf.o) - 1] = 0;
 	p = BF_crypt(test_key, buf.s, buf.o, sizeof(buf.o) - (1 + 1), 1);
 
 	ok = (p == buf.o &&
 	    !memcmp(p, buf.s, 7 + 22) &&
-	    !memcmp(p + (7 + 22),
-	    test_hash[(unsigned int)(unsigned char)buf.s[2] & 1],
-	    31 + 1 + 1 + 1));
+	    !memcmp(p + (7 + 22), test_hash, 31 + 1 + 1 + 1));
 
 	{
 		const char *k = "\xff\xa3" "34" "\xff\xff\xff\xa3" "345";
@@ -885,7 +890,7 @@ char *_crypt_gensalt_blowfish_rn(const char *prefix, unsigned long count,
 	if (size < 16 || output_size < 7 + 22 + 1 ||
 	    (count && (count < 4 || count > 31)) ||
 	    prefix[0] != '$' || prefix[1] != '2' ||
-	    (prefix[2] != 'a' && prefix[2] != 'y')) {
+	    (prefix[2] != 'a' && prefix[2] != 'b' && prefix[2] != 'y')) {
 		if (output_size > 0) output[0] = '\0';
 		__set_errno((output_size < 7 + 22 + 1) ? ERANGE : EINVAL);
 		return NULL;

ext/standard/dir.c

@@ -491,13 +491,18 @@ PHP_FUNCTION(glob)
 	/* now catch the FreeBSD style of "no matches" */
 	if (!globbuf.gl_pathc || !globbuf.gl_pathv) {
 no_results:
+#ifndef PHP_WIN32
+		/* Paths containing '*', '?' and some other chars are
+		illegal on Windows but legit on other platforms. For
+		this reason the direct basedir check against the glob
+		query is senseless on windows. For instance while *.txt
+		is a pretty valid filename on EXT3, it's invalid on NTFS. */
 		if (PG(open_basedir) && *PG(open_basedir)) {
-			struct stat s;
-
-			if (0 != VCWD_STAT(pattern, &s) || S_IFDIR != (s.st_mode & S_IFMT)) {
+			if (php_check_open_basedir_ex(pattern, 0 TSRMLS_CC)) {
 				RETURN_FALSE;
 			}
 		}
+#endif
 		array_init(return_value);
 		return;
 	}

ext/standard/dns.c

@@ -222,6 +222,11 @@ PHP_FUNCTION(gethostbyname)
 		return;
 	}
 
+	if(hostname_len > MAXFQDNLEN) {
+		/* name too long, protect from CVE-2015-0235 */
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Host name is too long, the limit is %d characters", MAXFQDNLEN);
+		RETURN_STRINGL(hostname, hostname_len, 1);
+	}
 	addr = php_gethostbyname(hostname);
 
 	RETVAL_STRING(addr, 0);
@@ -242,6 +247,12 @@ PHP_FUNCTION(gethostbynamel)
 		return;
 	}
 
+	if(hostname_len > MAXFQDNLEN) {
+		/* name too long, protect from CVE-2015-0235 */
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Host name is too long, the limit is %d characters", MAXFQDNLEN);
+		RETURN_FALSE;
+	}
+
 	hp = gethostbyname(hostname);
 	if (hp == NULL || hp->h_addr_list == NULL) {
 		RETURN_FALSE;

ext/standard/exec.c

@@ -188,6 +188,10 @@ static void php_exec_ex(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot execute a blank command");
 		RETURN_FALSE;
 	}
+	if (strlen(cmd) != cmd_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "NULL byte detected. Possible attack");
+		RETURN_FALSE;
+	}
 
 	if (!ret_array) {
 		ret = php_exec(mode, cmd, NULL, return_value TSRMLS_CC);

ext/standard/strnatcmp.c

@@ -117,11 +117,11 @@ PHPAPI int strnatcmp_ex(char const *a, size_t a_len, char const *b, size_t b_len
 		ca = *ap; cb = *bp;
 
 		/* skip over leading zeros */
-		while (leading && ca == '0' && (ap+1 < aend) && isdigit(*(ap+1))) {
+		while (leading && ca == '0' && (ap+1 < aend) && isdigit((int)(unsigned char)*(ap+1))) {
 			ca = *++ap;
 		}
 
-		while (leading && cb == '0' && (bp+1 < bend) && isdigit(*(bp+1))) {
+		while (leading && cb == '0' && (bp+1 < bend) && isdigit((int)(unsigned char)*(bp+1))) {
 			cb = *++bp;
 		}
 

ext/standard/tests/file/glob_variation3.phpt

@@ -5,15 +5,30 @@ Test glob() function: ensure no platform difference
 $path = dirname(__FILE__);
 
 ini_set('open_basedir', NULL);
-var_dump(glob("$path/*.none"));
 
-ini_set('open_basedir', $path);
 var_dump(glob("$path/*.none"));
+var_dump(glob("$path/?.none"));
+var_dump(glob("$path/*{hello,world}.none"));
+var_dump(glob("$path/*/nothere"));
+var_dump(glob("$path/[aoeu]*.none"));
+var_dump(glob("$path/directly_not_exists"));
 
+$b = ini_get('open_basedir');
+var_dump(empty($b));
 ?>
 ==DONE==
 --EXPECT--
 array(0) {
 }
-bool(false)
+array(0) {
+}
+array(0) {
+}
+array(0) {
+}
+array(0) {
+}
+array(0) {
+}
+bool(true)
 ==DONE==

ext/standard/tests/file/glob_variation4.phpt

@@ -0,0 +1,33 @@
+--TEST--
+Test glob() function: ensure no platform difference, variation 2
+--FILE--
+<?php
+$path = dirname(__FILE__);
+
+ini_set('open_basedir', $path);
+
+var_dump(glob("$path/*.none"));
+var_dump(glob("$path/?.none"));
+var_dump(glob("$path/*{hello,world}.none"));
+var_dump(glob("$path/*/nothere"));
+var_dump(glob("$path/[aoeu]*.none"));
+var_dump(glob("$path/directly_not_exists"));
+
+var_dump($path == ini_get('open_basedir'));
+?>
+==DONE==
+--EXPECT--
+array(0) {
+}
+array(0) {
+}
+array(0) {
+}
+array(0) {
+}
+array(0) {
+}
+array(0) {
+}
+bool(true)
+==DONE==

ext/standard/tests/file/glob_variation5.phpt

@@ -0,0 +1,29 @@
+--TEST--
+Test glob() function: ensure no platform difference, variation 3
+--SKIPIF--
+<?php if( substr(PHP_OS, 0, 3) == "WIN" ) {die('skip not valid on Windows');} ?>
+--FILE--
+<?php
+$path = dirname(__FILE__);
+
+ini_set('open_basedir', '/tmp');
+
+var_dump(glob("$path/*.none"));
+var_dump(glob("$path/?.none"));
+var_dump(glob("$path/*{hello,world}.none"));
+var_dump(glob("$path/*/nothere"));
+var_dump(glob("$path/[aoeu]*.none"));
+var_dump(glob("$path/directly_not_exists"));
+
+var_dump('/tmp' == ini_get('open_basedir'));
+?>
+==DONE==
+--EXPECT--
+bool(false)
+bool(false)
+bool(false)
+bool(false)
+bool(false)
+bool(false)
+bool(true)
+==DONE==

ext/standard/tests/file/glob_variation6.phpt

@@ -0,0 +1,35 @@
+--TEST--
+Test glob() function: ensure no platform difference, variation 4
+--SKIPIF--
+<?php if( substr(PHP_OS, 0, 3) != "WIN" ) {die('skip only valid on Windows');} ?>
+--FILE--
+<?php
+$path = dirname(__FILE__);
+
+ini_set('open_basedir', 'c:\\windows');
+
+var_dump(glob("$path/*.none"));
+var_dump(glob("$path/?.none"));
+var_dump(glob("$path/*{hello,world}.none"));
+var_dump(glob("$path/*/nothere"));
+var_dump(glob("$path/[aoeu]*.none"));
+var_dump(glob("$path/directly_not_exists"));
+
+var_dump('c:\\windows' == ini_get('open_basedir'));
+?>
+==DONE==
+--EXPECT--
+array(0) {
+}
+array(0) {
+}
+array(0) {
+}
+array(0) {
+}
+array(0) {
+}
+array(0) {
+}
+bool(true)
+==DONE==

ext/standard/tests/general_functions/bug60227_2.phpt

@@ -1,14 +1,15 @@
 --TEST--
 Bug #60227 (header() cannot detect the multi-line header with CR), \r before \n
+--INI--
+expose_php=0
 --FILE--
 <?php
 header("X-foo: e\n foo");
-header("X-Foo6: e\rSet-Cookie: ID=123\n d");
 echo 'foo';
 ?>
 --EXPECTF--
+
 Warning: Header may not contain more than a single header, new line detected in %s on line %d
 foo
 --EXPECTHEADERS--
-X-foo: e
-foo
+Content-type: text/html; charset=UTF-8

ext/standard/tests/general_functions/bug60227_3.phpt

@@ -1,8 +1,9 @@
 --TEST--
 Bug #60227 (header() cannot detect the multi-line header with CR), \0 before \n
+--INI--
+expose_php=0
 --FILE--
 <?php
-header("X-foo: e\n foo");
 header("X-Foo6: e\0Set-Cookie: ID=\n123\n d");
 echo 'foo';
 ?>
@@ -10,5 +11,4 @@ echo 'foo';
 Warning: Header may not contain NUL bytes in %s on line %d
 foo
 --EXPECTHEADERS--
-X-foo: e
-foo
+Content-type: text/html; charset=UTF-8

ext/standard/tests/general_functions/bug60227_4.phpt

@@ -1,8 +1,9 @@
 --TEST--
 Bug #60227 (header() cannot detect the multi-line header with CR), CRLF
+--INI--
+expose_php=0
 --FILE--
 <?php
-header("X-foo: e\r\n foo");
 header("X-foo: e\r\nfoo");
 echo 'foo';
 ?>
@@ -10,5 +11,4 @@ echo 'foo';
 Warning: Header may not contain more than a single header, new line detected in %s on line %d
 foo
 --EXPECTHEADERS--
-X-foo: e
- foo
+Content-type: text/html; charset=UTF-8

ext/standard/tests/misc/exec_basic1.phpt

@@ -0,0 +1,25 @@
+--TEST--
+exec, system, passthru  — Basic command execution functions
+--SKIPIF--
+<?php
+// If this does not work for Windows, please uncomment or fix test
+// if(substr(PHP_OS, 0, 3) == "WIN") die("skip not for Windows");
+?>
+--FILE--
+<?php
+$cmd = "echo abc\n\0command";
+var_dump(exec($cmd, $output));
+var_dump($output);
+var_dump(system($cmd));
+var_dump(passthru($cmd));
+?>
+--EXPECTF--
+Warning: exec(): NULL byte detected. Possible attack in %s on line %d
+bool(false)
+NULL
+
+Warning: system(): NULL byte detected. Possible attack in %s on line %d
+bool(false)
+
+Warning: passthru(): NULL byte detected. Possible attack in %s on line %d
+bool(false)

ext/standard/tests/network/bug68925.phpt

@@ -0,0 +1,13 @@
+--TEST--
+Bug #68925 (CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow)
+--FILE--
+<?php
+var_dump(gethostbyname(str_repeat("0", 2501)));
+var_dump(gethostbynamel(str_repeat("0", 2501)));
+?>
+--EXPECTF--
+Warning: gethostbyname(): Host name is too long, the limit is %d characters in %s/bug68925.php on line %d
+string(2501) "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
+
+Warning: gethostbynamel(): Host name is too long, the limit is %d characters in %s/bug68925.php on line %d
+bool(false)

ext/standard/tests/serialize/bug68044.phpt

@@ -0,0 +1,12 @@
+--TEST--
+Bug #68044 Integer overflow in unserialize() (32-bits only)
+--FILE--
+<?php
+	echo unserialize('C:3:"XYZ":18446744075857035259:{}');
+?>
+===DONE==
+--EXPECTF--
+Warning: Insufficient data for unserializing - %d required, 1 present in %s/bug68044.php on line 2
+
+Notice: unserialize(): Error at offset 32 of 33 bytes in %s/bug68044.php on line 2
+===DONE==

ext/standard/tests/serialize/bug68545.phpt

@@ -0,0 +1,11 @@
+--TEST--
+Bug #68545 NULL pointer dereference in unserialize.c:var_push_dtor
+--FILE--
+<?php 
+var_dump(unserialize('a:6:{a:6:{s:3:"322";s:3:"bar";s:3:"bar";s:3:"foo";a:6:{a:6:{s:3:"322";s:3:"bar";s:3:"bar";s:3:"foo";s:3:"bar";a:6:{a:6:{s:3:"322";s:3:"bar";s:3:"bar";s:3:"foo";a:6:{a:6:{s:3:"322";s:3:"bar";s:3:"b22";s:3:"bar";s:3:"bar";s:3:"foo";s:3:"bar";a:6:{a:6:{s:3:"322";s:3:"bar";s:3:"bar";s:3:"foo";s:3:"bar";s:3:"bar";')); 
+?>
+===DONE===
+--EXPECTF--
+Notice: unserialize(): Error at offset %d of %d bytes in %sbug68545.php on line %d
+bool(false)
+===DONE===

ext/standard/tests/serialize/bug68594.phpt

@@ -0,0 +1,23 @@
+--TEST--
+Bug #68545 Use after free vulnerability in unserialize()
+--FILE--
+<?php
+for ($i=4; $i<100; $i++) {
+	$m = new StdClass();
+
+	$u = array(1);
+
+	$m->aaa = array(1,2,&$u,4,5);
+	$m->bbb = 1;
+	$m->ccc = &$u;
+	$m->ddd = str_repeat("A", $i);
+
+	$z = serialize($m);
+	$z = str_replace("bbb", "aaa", $z);
+	$y = unserialize($z);
+	$z = serialize($y);
+}
+?>
+===DONE===
+--EXPECTF--
+===DONE===

ext/standard/tests/strings/bug68710.phpt

@@ -0,0 +1,25 @@
+--TEST--
+Bug #68710 Use after free vulnerability in unserialize() (bypassing the
+CVE-2014-8142 fix)
+--FILE--
+<?php
+for ($i=4; $i<100; $i++) {
+    $m = new StdClass();
+
+    $u = array(1);
+
+    $m->aaa = array(1,2,&$u,4,5);
+    $m->bbb = 1;
+    $m->ccc = &$u;
+    $m->ddd = str_repeat("A", $i);
+
+    $z = serialize($m);
+    $z = str_replace("aaa", "123", $z);
+    $z = str_replace("bbb", "123", $z);
+    $y = unserialize($z);
+    $z = serialize($y);
+}
+?>
+===DONE===
+--EXPECTF--
+===DONE===

ext/standard/tests/strings/crypt_blowfish.phpt

@@ -18,8 +18,10 @@ $tests =array(
 	array('$2x$05$/OK.fbVrR/bpIqNJ5ianF.CE5elHaaO4EbggVDjb8P19RukzXSM3e', "\xff\xff\xa3"),
 	array('$2y$05$/OK.fbVrR/bpIqNJ5ianF.CE5elHaaO4EbggVDjb8P19RukzXSM3e', "\xff\xff\xa3"),
 	array('$2a$05$/OK.fbVrR/bpIqNJ5ianF.nqd1wy.pTMdcvrRWxyiGL2eMz.2a85.', "\xff\xff\xa3"),
+	array('$2b$05$/OK.fbVrR/bpIqNJ5ianF.CE5elHaaO4EbggVDjb8P19RukzXSM3e', "\xff\xff\xa3"),
 	array('$2y$05$/OK.fbVrR/bpIqNJ5ianF.Sa7shbm4.OzKpvFnX1pQLmQW96oUlCq', "\xa3"),
 	array('$2a$05$/OK.fbVrR/bpIqNJ5ianF.Sa7shbm4.OzKpvFnX1pQLmQW96oUlCq', "\xa3"),
+	array('$2b$05$/OK.fbVrR/bpIqNJ5ianF.Sa7shbm4.OzKpvFnX1pQLmQW96oUlCq', "\xa3"),
 	array('$2x$05$/OK.fbVrR/bpIqNJ5ianF.o./n25XVfn6oAPaUvHe.Csk4zRfsYPi', "1\xa3345"),
 	array('$2x$05$/OK.fbVrR/bpIqNJ5ianF.o./n25XVfn6oAPaUvHe.Csk4zRfsYPi', "\xff\xa3345"),
 	array('$2x$05$/OK.fbVrR/bpIqNJ5ianF.o./n25XVfn6oAPaUvHe.Csk4zRfsYPi', "\xff\xa334\xff\xff\xff\xa3345"),
@@ -36,14 +38,35 @@ $tests =array(
 	array('$2a$05$/OK.fbVrR/bpIqNJ5ianF.R9xrDjiycxMbQE2bp.vgqlYpW5wx2yy', "\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55"),
 	array('$2a$05$/OK.fbVrR/bpIqNJ5ianF.9tQZzcJfm3uj2NvJ/n5xkhpqLrMpWCe', "\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff"),
 	array('$2a$05$CCCCCCCCCCCCCCCCCCCCC.7uG0VCzI2bS7j6ymqJi9CdcdxiRTWNy', ''),
-
 );
+
+$tests2 = array(
+	array('$2a$03$CCCCCCCCCCCCCCCCCCCCC.', '*0'),
+	array('$2a$32$CCCCCCCCCCCCCCCCCCCCC.', '*0'),
+	array('$2c$05$CCCCCCCCCCCCCCCCCCCCC.', '*0'),
+	array('$2z$05$CCCCCCCCCCCCCCCCCCCCC.', '*0'),
+	array('$2`$05$CCCCCCCCCCCCCCCCCCCCC.', '*0'),
+	array('$2{$05$CCCCCCCCCCCCCCCCCCCCC.', '*0'),
+	array('*0', '*1'),
+);
+
 $i=0;
 foreach($tests as $test) {
-  if(crypt($test[1], $test[0]) == $test[0]) {
+  $result = crypt($test[1], $test[0]);
+  if($result === $test[0]) {
     echo "$i. OK\n";
   } else {
-    echo "$i. Not OK: $test[0] ".crypt($test[1], $test[0])."\n";
+    echo "$i. Not OK: $test[0] $result\n";
+  }
+  $i++;
+}
+
+foreach($tests2 as $test) {
+  $result = crypt('', $test[0]);
+  if($result === $test[1]) {
+    echo "$i. OK\n";
+  } else {
+    echo "$i. Not OK: $test[0] $result\n";
   }
   $i++;
 }
@@ -76,3 +99,12 @@ foreach($tests as $test) {
 23. OK
 24. OK
 25. OK
+26. OK
+27. OK
+28. OK
+29. OK
+30. OK
+31. OK
+32. OK
+33. OK
+34. OK

ext/standard/tests/strings/dirname_basic.phpt

@@ -1,5 +1,5 @@
 --TEST--
-Test dirname() function : basic funtionality
+Test dirname() function : basic functionality
 --FILE--
 <?php
 /* Prototype: string dirname ( string $path );

ext/standard/url.c

@@ -266,7 +266,7 @@ PHPAPI php_url *php_url_parse_ex(char const *str, int length)
 		p = s;
 	} else {
 		/* memrchr is a GNU specific extension
-		   Emulate for wide compatability */
+		   Emulate for wide compatibility */
 		for(p = e; p >= s && *p != ':'; p--);
 	}
 

ext/standard/var_unserializer.c

@@ -1,4 +1,4 @@
-/* Generated by re2c 0.13.5 on Sat Jun 21 21:27:56 2014 */
+/* Generated by re2c 0.13.7.5 on Thu Jan  1 14:43:18 2015 */
 #line 1 "ext/standard/var_unserializer.re"
 /*
   +----------------------------------------------------------------------+
@@ -61,7 +61,13 @@ static inline void var_push(php_unserialize_data_t *var_hashx, zval **rval)
 
 PHPAPI void var_push_dtor(php_unserialize_data_t *var_hashx, zval **rval)
 {
-	var_entries *var_hash = (*var_hashx)->last_dtor;
+	var_entries *var_hash;
+
+	if (!var_hashx || !*var_hashx) {
+		return;
+	}
+
+	var_hash = (*var_hashx)->last_dtor;
 #if VAR_ENTRIES_DBG
 	fprintf(stderr, "var_push_dtor(%ld): %d\n", var_hash?var_hash->used_slots:-1L, Z_TYPE_PP(rval));
 #endif
@@ -227,7 +233,7 @@ static char *unserialize_str(const unsigned char **p, size_t *len, size_t maxlen
 #define YYMARKER marker
 
 
-#line 235 "ext/standard/var_unserializer.re"
+#line 241 "ext/standard/var_unserializer.re"
 
 
 
@@ -337,6 +343,9 @@ static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, long
 		} else {
 			/* object properties should include no integers */
 			convert_to_string(key);
+			if (zend_hash_find(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, (void **)&old_data)==SUCCESS) {
+				var_push_dtor(var_hash, old_data);
+			}
 			zend_hash_update(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, &data,
 					sizeof data, NULL);
 		}
@@ -372,7 +381,7 @@ static inline int object_custom(UNSERIALIZE_PARAMETER, zend_class_entry *ce)
 
 	(*p) += 2;
 
-	if (datalen < 0 || (*p) + datalen >= max) {
+	if (datalen < 0 || (max - (*p)) <= datalen) {
 		zend_error(E_WARNING, "Insufficient data for unserializing - %ld required, %ld present", datalen, (long)(max - (*p)));
 		return 0;
 	}
@@ -474,7 +483,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 	
 	
 
-#line 478 "ext/standard/var_unserializer.c"
+#line 487 "ext/standard/var_unserializer.c"
 {
 	YYCTYPE yych;
 	static const unsigned char yybm[] = {
@@ -534,9 +543,9 @@ yy2:
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych == ':') goto yy95;
 yy3:
-#line 829 "ext/standard/var_unserializer.re"
+#line 838 "ext/standard/var_unserializer.re"
 	{ return 0; }
-#line 540 "ext/standard/var_unserializer.c"
+#line 549 "ext/standard/var_unserializer.c"
 yy4:
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych == ':') goto yy89;
@@ -579,13 +588,13 @@ yy13:
 	goto yy3;
 yy14:
 	++YYCURSOR;
-#line 823 "ext/standard/var_unserializer.re"
+#line 832 "ext/standard/var_unserializer.re"
 	{
 	/* this is the case where we have less data than planned */
 	php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Unexpected end of serialized data");
 	return 0; /* not sure if it should be 0 or 1 here? */
 }
-#line 589 "ext/standard/var_unserializer.c"
+#line 598 "ext/standard/var_unserializer.c"
 yy16:
 	yych = *++YYCURSOR;
 	goto yy3;
@@ -611,11 +620,12 @@ yy20:
 	if (yybm[0+yych] & 128) {
 		goto yy20;
 	}
-	if (yych != ':') goto yy18;
+	if (yych <= '/') goto yy18;
+	if (yych >= ';') goto yy18;
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 677 "ext/standard/var_unserializer.re"
+#line 686 "ext/standard/var_unserializer.re"
 	{
 	size_t len, len2, len3, maxlen;
 	long elements;
@@ -761,7 +771,7 @@ yy20:
 
 	return object_common2(UNSERIALIZE_PASSTHRU, elements);
 }
-#line 765 "ext/standard/var_unserializer.c"
+#line 775 "ext/standard/var_unserializer.c"
 yy25:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -786,7 +796,7 @@ yy27:
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 669 "ext/standard/var_unserializer.re"
+#line 678 "ext/standard/var_unserializer.re"
 	{
 
 	INIT_PZVAL(*rval);
@@ -794,7 +804,7 @@ yy27:
 	return object_common2(UNSERIALIZE_PASSTHRU,
 			object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR));
 }
-#line 798 "ext/standard/var_unserializer.c"
+#line 808 "ext/standard/var_unserializer.c"
 yy32:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy33;
@@ -815,7 +825,7 @@ yy34:
 	yych = *++YYCURSOR;
 	if (yych != '{') goto yy18;
 	++YYCURSOR;
-#line 649 "ext/standard/var_unserializer.re"
+#line 658 "ext/standard/var_unserializer.re"
 	{
 	long elements = parse_iv(start + 2);
 	/* use iv() not uiv() in order to check data range */
@@ -835,7 +845,7 @@ yy34:
 
 	return finish_nested_data(UNSERIALIZE_PASSTHRU);
 }
-#line 839 "ext/standard/var_unserializer.c"
+#line 849 "ext/standard/var_unserializer.c"
 yy39:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy40;
@@ -856,7 +866,7 @@ yy41:
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 620 "ext/standard/var_unserializer.re"
+#line 629 "ext/standard/var_unserializer.re"
 	{
 	size_t len, maxlen;
 	char *str;
@@ -885,7 +895,7 @@ yy41:
 	ZVAL_STRINGL(*rval, str, len, 0);
 	return 1;
 }
-#line 889 "ext/standard/var_unserializer.c"
+#line 899 "ext/standard/var_unserializer.c"
 yy46:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy47;
@@ -906,7 +916,7 @@ yy48:
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 592 "ext/standard/var_unserializer.re"
+#line 601 "ext/standard/var_unserializer.re"
 	{
 	size_t len, maxlen;
 	char *str;
@@ -934,7 +944,7 @@ yy48:
 	ZVAL_STRINGL(*rval, str, len, 1);
 	return 1;
 }
-#line 938 "ext/standard/var_unserializer.c"
+#line 948 "ext/standard/var_unserializer.c"
 yy53:
 	yych = *++YYCURSOR;
 	if (yych <= '/') {
@@ -1022,7 +1032,7 @@ yy61:
 	}
 yy63:
 	++YYCURSOR;
-#line 582 "ext/standard/var_unserializer.re"
+#line 591 "ext/standard/var_unserializer.re"
 	{
 #if SIZEOF_LONG == 4
 use_double:
@@ -1032,7 +1042,7 @@ use_double:
 	ZVAL_DOUBLE(*rval, zend_strtod((const char *)start + 2, NULL));
 	return 1;
 }
-#line 1036 "ext/standard/var_unserializer.c"
+#line 1046 "ext/standard/var_unserializer.c"
 yy65:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1091,7 +1101,7 @@ yy73:
 	yych = *++YYCURSOR;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 567 "ext/standard/var_unserializer.re"
+#line 576 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
@@ -1106,7 +1116,7 @@ yy73:
 
 	return 1;
 }
-#line 1110 "ext/standard/var_unserializer.c"
+#line 1120 "ext/standard/var_unserializer.c"
 yy76:
 	yych = *++YYCURSOR;
 	if (yych == 'N') goto yy73;
@@ -1133,7 +1143,7 @@ yy79:
 	if (yych <= '9') goto yy79;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 540 "ext/standard/var_unserializer.re"
+#line 549 "ext/standard/var_unserializer.re"
 	{
 #if SIZEOF_LONG == 4
 	int digits = YYCURSOR - start - 3;
@@ -1160,7 +1170,7 @@ yy79:
 	ZVAL_LONG(*rval, parse_iv(start + 2));
 	return 1;
 }
-#line 1164 "ext/standard/var_unserializer.c"
+#line 1174 "ext/standard/var_unserializer.c"
 yy83:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy18;
@@ -1168,24 +1178,24 @@ yy83:
 	yych = *++YYCURSOR;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 533 "ext/standard/var_unserializer.re"
+#line 542 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
 	ZVAL_BOOL(*rval, parse_iv(start + 2));
 	return 1;
 }
-#line 1179 "ext/standard/var_unserializer.c"
+#line 1189 "ext/standard/var_unserializer.c"
 yy87:
 	++YYCURSOR;
-#line 526 "ext/standard/var_unserializer.re"
+#line 535 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
 	ZVAL_NULL(*rval);
 	return 1;
 }
-#line 1189 "ext/standard/var_unserializer.c"
+#line 1199 "ext/standard/var_unserializer.c"
 yy89:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1208,7 +1218,7 @@ yy91:
 	if (yych <= '9') goto yy91;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 503 "ext/standard/var_unserializer.re"
+#line 512 "ext/standard/var_unserializer.re"
 	{
 	long id;
 
@@ -1231,7 +1241,7 @@ yy91:
 	
 	return 1;
 }
-#line 1235 "ext/standard/var_unserializer.c"
+#line 1245 "ext/standard/var_unserializer.c"
 yy95:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1254,7 +1264,7 @@ yy97:
 	if (yych <= '9') goto yy97;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 482 "ext/standard/var_unserializer.re"
+#line 491 "ext/standard/var_unserializer.re"
 	{
 	long id;
 
@@ -1275,9 +1285,9 @@ yy97:
 	
 	return 1;
 }
-#line 1279 "ext/standard/var_unserializer.c"
+#line 1289 "ext/standard/var_unserializer.c"
 }
-#line 831 "ext/standard/var_unserializer.re"
+#line 840 "ext/standard/var_unserializer.re"
 
 
 	return 0;