5.4.6

* 5.3:
  Limit test to ICU 49
  Remove executable bit from files

NEWS

@@ -1,6 +1,65 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2012, PHP 5.4.5
+16 Aug 2012, PHP 5.4.6
+
+- CLI Server:
+  . Implemented FR #62700 (have the console output 'Listening on 
+    http://localhost:8000'). (pascal.chevrel@free.fr)
+
+- Core:
+  . Fixed bug #62661 (Interactive php-cli crashes if include() is used in
+    auto_prepend_file). (Laruence)
+  . Fixed bug #62653: (unset($array[$float]) causes a crash). (Nikita Popov,
+    Laruence)
+  . Fixed bug #62565 (Crashes due non-initialized internal properties_table).
+    (Felipe)
+  . Fixed bug #60194 (--with-zend-multibyte and --enable-debug reports LEAK
+    with run-test.php). (Laruence)
+
+- CURL:
+  . Fixed bug #62499 (curl_setopt($ch, CURLOPT_COOKIEFILE, "") returns false).
+    (r.hampartsumyan@gmail.com, Laruence)
+
+- DateTime:
+  . Fixed Bug #62500 (Segfault in DateInterval class when extended). (Laruence)
+  
+- Fileinfo:
+  . Fixed bug #61964 (finfo_open with directory causes invalid free). 
+    (reeze.xia@gmail.com)
+
+- Intl:
+  . Fixed bug #62564 (Extending MessageFormatter and adding property causes 
+    crash). (Felipe)
+
+- MySQLnd:
+  . Fixed bug #62594 (segfault in mysqlnd_res_meta::set_mode). (Laruence)
+
+- readline:
+  . Fixed bug #62612 (readline extension compilation fails with
+    sapi/cli/cli.h: No such file). (Johannes)
+
+- Reflection:
+  . Implemented FR #61602 (Allow access to name of constant used as default 
+    value). (reeze.xia@gmail.com)
+  
+- SimpleXML:
+  . Implemented FR #55218 Get namespaces from current node. (Lonny)
+
+- SPL:
+  . Fixed bug #62616 (ArrayIterator::count() from IteratorIterator instance
+    gives Segmentation fault). (Laruence, Gustavo)
+  . Fixed bug #61527 (ArrayIterator gives misleading notice on next() when 
+    moved to the end). (reeze.xia@gmail.com)
+
+- Streams:
+  . Fixed bug #62597 (segfault in php_stream_wrapper_log_error with ZTS build).
+    (Laruence)
+
+- Zlib:
+  . Fixed bug #55544 (ob_gzhandler always conflicts with
+    zlib.output_compression). (Laruence)
+
+19 Jul 2012, PHP 5.4.5
 
 - Core:
   . Fixed bug #62443 (Crypt SHA256/512 Segfaults With Malformed 

UPGRADING

@@ -343,6 +343,10 @@ PHP 5.4 UPGRADE NOTES
 
 - Since 5.4.5, resourcebundle_create() accepts null for the first two arguments.
 
+- Since 5.4.6, SimpleXMLElement::getDocNamespaces() has and extra parameter which
+  allows for toggling if the list of namespaces starts from the document root
+  or from the node you call the method on
+
 ==============================
 5. Changes to existing classes
 ==============================

Zend/tests/bug55509.phpt

@@ -5,6 +5,12 @@ Bug #55509 (segfault on x86_64 using more than 2G memory)
 if (PHP_INT_SIZE == 4) {
   die('skip Not for 32-bits OS');
 }
+
+$zend_mm_enabled = getenv("USE_ZEND_ALLOC");
+if ($zend_mm_enabled === "0") {
+    die("skip Zend MM disabled");
+}
+
 if (getenv("SKIP_SLOW_TESTS")) die("skip slow test");
 // check the available memory
 if (PHP_OS == 'Linux') {

Zend/tests/bug62653.phpt

@@ -0,0 +1,33 @@
+--TEST--
+Bug #62653: unset($array[$float]) causes a crash
+--FILE--
+<?php
+$array = array("5"=>"bar");
+$foo = "10.0000"; // gettype($foo) = "string"
+$foo /= 2; //Makes $foo = 5 but still gettype($foo) = "double"
+unset($array[$foo]);
+print_r($array);
+
+$array = array("5"=>"bar");
+$foo = "5";
+unset($array[(float)$foo]);
+print_r($array);
+
+$array = array("5"=>"bar");
+$foo = "10.0000";
+$foo /= 2; //Makes $foo = 5 but still gettype($foo) = "double"
+$name = "foo";
+unset($array[$$name]);
+print_r($array);
+
+?>
+--EXPECT--
+Array
+(
+)
+Array
+(
+)
+Array
+(
+)

Zend/tests/bug62680.phpt

@@ -0,0 +1,11 @@
+--TEST--
+Bug #62680 (Function isset() throws fatal error on set array if non-existent key depth >= 3)
+--FILE--
+<?php
+$array = array("");
+var_dump(isset($array[0]["a"]["b"]));
+var_dump(isset($array[0]["a"]["b"]["c"]));
+?>
+--EXPECT--
+bool(false)
+bool(false)

Zend/zend.c

@@ -1261,6 +1261,7 @@ ZEND_API int zend_execute_scripts(int type TSRMLS_DC, zval **retval, int file_co
 	zend_file_handle *file_handle;
 	zend_op_array *orig_op_array = EG(active_op_array);
 	zval **orig_retval_ptr_ptr = EG(return_value_ptr_ptr);
+    long orig_interactive = CG(interactive);
 
 	va_start(files, file_count);
 	for (i = 0; i < file_count; i++) {
@@ -1268,6 +1269,15 @@ ZEND_API int zend_execute_scripts(int type TSRMLS_DC, zval **retval, int file_co
 		if (!file_handle) {
 			continue;
 		}
+
+        if (orig_interactive) {
+            if (file_handle->filename[0] != '-' || file_handle->filename[1]) {
+                CG(interactive) = 0;
+            } else {
+                CG(interactive) = 1;
+            }
+        }
+       
 		EG(active_op_array) = zend_compile_file(file_handle, type TSRMLS_CC);
 		if (file_handle->opened_path) {
 			int dummy = 1;
@@ -1309,12 +1319,14 @@ ZEND_API int zend_execute_scripts(int type TSRMLS_DC, zval **retval, int file_co
 			va_end(files);
 			EG(active_op_array) = orig_op_array;
 			EG(return_value_ptr_ptr) = orig_retval_ptr_ptr;
+            CG(interactive) = orig_interactive;
 			return FAILURE;
 		}
 	}
 	va_end(files);
 	EG(active_op_array) = orig_op_array;
 	EG(return_value_ptr_ptr) = orig_retval_ptr_ptr;
+    CG(interactive) = orig_interactive;
 
 	return SUCCESS;
 }

Zend/zend_hash.h

@@ -330,7 +330,7 @@ END_EXTERN_C()
 				if (idx-1 > LONG_MAX) { /* overflow */						\
 					break;													\
 				}															\
-				idx = -idx;               									\
+				idx = 0 - idx;               									\
 			} else if (idx > LONG_MAX) { /* overflow */						\
 				break;														\
 			}																\

Zend/zend_string.h

@@ -23,12 +23,14 @@
 
 #include "zend.h"
 
+BEGIN_EXTERN_C()
 ZEND_API extern const char *(*zend_new_interned_string)(const char *str, int len, int free_src TSRMLS_DC);
 ZEND_API extern void (*zend_interned_strings_snapshot)(TSRMLS_D);
 ZEND_API extern void (*zend_interned_strings_restore)(TSRMLS_D);
 
 void zend_interned_strings_init(TSRMLS_D);
 void zend_interned_strings_dtor(TSRMLS_D);
+END_EXTERN_C()
 
 #ifndef ZTS
 

Zend/zend_vm_def.h

@@ -3947,7 +3947,8 @@ ZEND_VM_HANDLER(75, ZEND_UNSET_DIM, VAR|UNUSED|CV, CONST|TMP|VAR|CV)
 				switch (Z_TYPE_P(offset)) {
 					case IS_DOUBLE:
 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
-						ZEND_VM_C_GOTO(num_index_dim);
+						zend_hash_index_del(ht, hval);
+						break;
 					case IS_RESOURCE:
 					case IS_BOOL:
 					case IS_LONG:

Zend/zend_vm_execute.h

@@ -13917,7 +13917,8 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HAND
 				switch (Z_TYPE_P(offset)) {
 					case IS_DOUBLE:
 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
-						goto num_index_dim;
+						zend_hash_index_del(ht, hval);
+						break;
 					case IS_RESOURCE:
 					case IS_BOOL:
 					case IS_LONG:
@@ -15919,7 +15920,8 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLE
 				switch (Z_TYPE_P(offset)) {
 					case IS_DOUBLE:
 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
-						goto num_index_dim;
+						zend_hash_index_del(ht, hval);
+						break;
 					case IS_RESOURCE:
 					case IS_BOOL:
 					case IS_LONG:
@@ -18131,7 +18133,8 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLE
 				switch (Z_TYPE_P(offset)) {
 					case IS_DOUBLE:
 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
-						goto num_index_dim;
+						zend_hash_index_del(ht, hval);
+						break;
 					case IS_RESOURCE:
 					case IS_BOOL:
 					case IS_LONG:
@@ -21166,7 +21169,8 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER
 				switch (Z_TYPE_P(offset)) {
 					case IS_DOUBLE:
 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
-						goto num_index_dim;
+						zend_hash_index_del(ht, hval);
+						break;
 					case IS_RESOURCE:
 					case IS_BOOL:
 					case IS_LONG:
@@ -22504,7 +22508,8 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_H
 				switch (Z_TYPE_P(offset)) {
 					case IS_DOUBLE:
 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
-						goto num_index_dim;
+						zend_hash_index_del(ht, hval);
+						break;
 					case IS_RESOURCE:
 					case IS_BOOL:
 					case IS_LONG:
@@ -23662,7 +23667,8 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_UNUSED_TMP_HANDLER(ZEND_OPCODE_HAN
 				switch (Z_TYPE_P(offset)) {
 					case IS_DOUBLE:
 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
-						goto num_index_dim;
+						zend_hash_index_del(ht, hval);
+						break;
 					case IS_RESOURCE:
 					case IS_BOOL:
 					case IS_LONG:
@@ -24820,7 +24826,8 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_UNUSED_VAR_HANDLER(ZEND_OPCODE_HAN
 				switch (Z_TYPE_P(offset)) {
 					case IS_DOUBLE:
 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
-						goto num_index_dim;
+						zend_hash_index_del(ht, hval);
+						break;
 					case IS_RESOURCE:
 					case IS_BOOL:
 					case IS_LONG:
@@ -26244,7 +26251,8 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HAND
 				switch (Z_TYPE_P(offset)) {
 					case IS_DOUBLE:
 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
-						goto num_index_dim;
+						zend_hash_index_del(ht, hval);
+						break;
 					case IS_RESOURCE:
 					case IS_BOOL:
 					case IS_LONG:
@@ -29498,7 +29506,8 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDL
 				switch (Z_TYPE_P(offset)) {
 					case IS_DOUBLE:
 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
-						goto num_index_dim;
+						zend_hash_index_del(ht, hval);
+						break;
 					case IS_RESOURCE:
 					case IS_BOOL:
 					case IS_LONG:
@@ -31371,7 +31380,8 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER
 				switch (Z_TYPE_P(offset)) {
 					case IS_DOUBLE:
 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
-						goto num_index_dim;
+						zend_hash_index_del(ht, hval);
+						break;
 					case IS_RESOURCE:
 					case IS_BOOL:
 					case IS_LONG:
@@ -33453,7 +33463,8 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER
 				switch (Z_TYPE_P(offset)) {
 					case IS_DOUBLE:
 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
-						goto num_index_dim;
+						zend_hash_index_del(ht, hval);
+						break;
 					case IS_RESOURCE:
 					case IS_BOOL:
 					case IS_LONG:
@@ -36219,7 +36230,8 @@ static int ZEND_FASTCALL  ZEND_UNSET_DIM_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_
 				switch (Z_TYPE_P(offset)) {
 					case IS_DOUBLE:
 						hval = zend_dval_to_lval(Z_DVAL_P(offset));
-						goto num_index_dim;
+						zend_hash_index_del(ht, hval);
+						break;
 					case IS_RESOURCE:
 					case IS_BOOL:
 					case IS_LONG:

configure.in

@@ -119,8 +119,8 @@ int zend_sprintf(char *buffer, const char *format, ...);
 
 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=4
-PHP_RELEASE_VERSION=5
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=6
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
 

ext/curl/interface.c

@@ -2177,7 +2177,7 @@ string_copy:
 
 			convert_to_string_ex(zvalue);
 
-			if (!Z_STRLEN_PP(zvalue) || php_check_open_basedir(Z_STRVAL_PP(zvalue) TSRMLS_CC)) {
+			if (Z_STRLEN_PP(zvalue) && php_check_open_basedir(Z_STRVAL_PP(zvalue) TSRMLS_CC)) {
 				RETVAL_FALSE;
 				return 1;
 			}

ext/curl/tests/bug61948.phpt

@@ -16,7 +16,7 @@ open_basedir="/tmp"
   curl_close($ch);
 ?>
 --EXPECTF--
-bool(false)
+bool(true)
 bool(true)
 
 Warning: curl_setopt(): open_basedir restriction in effect. File(/xxx/bar) is not within the allowed path(s): (/tmp) in %sbug61948.php on line %d

ext/date/php_date.c

@@ -3430,10 +3430,19 @@ zval *date_interval_read_property(zval *object, zval *member, int type, const ze
 		zval_copy_ctor(&tmp_member);
 		convert_to_string(&tmp_member);
 		member = &tmp_member;
+		key = NULL;
 	}
 
 	obj = (php_interval_obj *)zend_objects_get_address(object TSRMLS_CC);
 
+	if (!obj->initialized) {
+		retval = (zend_get_std_object_handlers())->read_property(object, member, type, key TSRMLS_CC);
+		if (member == &tmp_member) {
+			zval_dtor(member);
+		}
+		return retval;
+	}
+
 #define GET_VALUE_FROM_STRUCT(n,m)            \
 	if (strcmp(Z_STRVAL_P(member), m) == 0) { \
 		value = obj->diff->n;                 \
@@ -3482,9 +3491,19 @@ void date_interval_write_property(zval *object, zval *member, zval *value, const
 		zval_copy_ctor(&tmp_member);
 		convert_to_string(&tmp_member);
 		member = &tmp_member;
+		key = NULL;
 	}
+
 	obj = (php_interval_obj *)zend_objects_get_address(object TSRMLS_CC);
 
+	if (!obj->initialized) {
+		(zend_get_std_object_handlers())->write_property(object, member, value, key TSRMLS_CC);
+		if (member == &tmp_member) {
+			zval_dtor(member);
+		}
+		return;
+	}
+
 #define SET_VALUE_FROM_STRUCT(n,m)            \
 	if (strcmp(Z_STRVAL_P(member), m) == 0) { \
 		if (value->type != IS_LONG) {         \

ext/date/tests/bug62500.phpt

@@ -0,0 +1,28 @@
+--TEST--
+Bug #62500 (Segfault in DateInterval class when extended)
+--INI--
+date.timezone=GMT
+--FILE--
+<?php
+class Crasher extends DateInterval {
+    public $foo;
+    public function __construct($time_spec) {
+        var_dump($this->foo);
+        $this->foo = 3;
+        var_dump($this->foo);
+        var_dump($this->{2});
+        parent::__construct($time_spec);
+    }
+}
+try {
+    $c = new Crasher('blah');
+} catch (Exception $e) {
+    var_dump($e->getMessage());
+}
+--EXPECTF--
+NULL
+int(3)
+
+Notice: Undefined property: Crasher::$2 in %sbug62500.php on line %d
+NULL
+string(%s) "DateInterval::__construct(): Unknown or bad format (blah)"

ext/dom/xpath.c

@@ -321,6 +321,7 @@ int dom_xpath_document_read(dom_object *obj, zval **retval TSRMLS_DC)
 	xmlDoc *docp = NULL;
 	xmlXPathContextPtr ctx;
 	int ret;
+	zval *tmp;
 
 	ctx = (xmlXPathContextPtr) obj->ptr;
 
@@ -329,10 +330,16 @@ int dom_xpath_document_read(dom_object *obj, zval **retval TSRMLS_DC)
 	}
 
 	ALLOC_ZVAL(*retval);
+	tmp = *retval;
+
 	if (NULL == (*retval = php_dom_create_object((xmlNodePtr) docp, &ret, *retval, obj TSRMLS_CC))) {
+		FREE_ZVAL(tmp);
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot create required DOM object");
 		return FAILURE;
 	}
+	if (tmp != *retval) {
+		FREE_ZVAL(tmp);
+	}
 	return SUCCESS;
 }
 /* }}} */

ext/fileinfo/fileinfo.c

@@ -270,7 +270,7 @@ ZEND_GET_MODULE(fileinfo)
 PHP_MINFO_FUNCTION(fileinfo)
 {
 	php_info_print_table_start();
-	php_info_print_table_header(2, "fileinfo support", "enabled");
+	php_info_print_table_row(2, "fileinfo support", "enabled");
 	php_info_print_table_row(2, "version", PHP_FILEINFO_VERSION);
 	php_info_print_table_end();
 }

ext/fileinfo/libmagic.patch

@@ -1,6 +1,6 @@
-diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
---- libmagic.orig/apprentice.c	2012-05-29 14:40:41.710960045 +0200
-+++ libmagic/apprentice.c	2012-04-22 18:57:16.215980866 +0200
+diff -u libmagic.origin/apprentice.c libmagic/apprentice.c
+--- libmagic.origin/apprentice.c	2012-07-15 18:17:24.802087661 +0800
++++ libmagic/apprentice.c	2012-07-15 18:22:49.650087425 +0800
 @@ -29,6 +29,8 @@
   * apprentice - make one pass through /etc/magic, learning its secrets.
   */
@@ -271,7 +271,9 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 +	size_t lineno = 0;
 +
 +	php_stream *stream;
-+
+ 
+-	FILE *f = fopen(ms->file = fn, "r");
+-	if (f == NULL) {
 +	TSRMLS_FETCH();
 +
 +#if PHP_API_VERSION < 20100412
@@ -279,9 +281,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 +#else
 +	stream = php_stream_open_wrapper((char *)fn, "rb", REPORT_ERRORS, NULL);
 +#endif
- 
--	FILE *f = fopen(ms->file = fn, "r");
--	if (f == NULL) {
++
 +	if (stream == NULL) {
  		if (errno != ENOENT)
  			file_error(ms, errno, "cannot read magic file `%s'",
@@ -312,8 +312,12 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  }
  
  /*
-@@ -757,20 +756,16 @@
- 	int errs = 0;
+@@ -754,23 +753,19 @@
+ apprentice_load(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp,
+     const char *fn, int action)
+ {
+-	int errs = 0;
++	int errs = 0, mflen = 0;
  	struct magic_entry *marray;
  	uint32_t marraycount, i, mentrycount = 0, starttest;
 -	size_t slen, files = 0, maxfiles = 0;
@@ -352,7 +356,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  		}
  		while ((d = readdir(dir)) != NULL) {
 -			if (asprintf(&mfn, "%s/%s", fn, d->d_name) < 0) {
-+			if (snprintf(mfn, sizeof(mfn), "%s/%s", fn, d->d_name) < 0) {
++			if ((mflen = snprintf(mfn, sizeof(mfn), "%s/%s", fn, d->d_name)) < 0) {
  				file_oomem(ms,
  				    strlen(fn) + strlen(d->d_name) + 2);
  				errs++;
@@ -364,7 +368,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  				continue;
  			}
  			if (files >= maxfiles) {
-@@ -803,7 +799,6 @@
+@@ -803,20 +799,19 @@
  				if ((filearr = CAST(char **,
  				    realloc(filearr, mlen))) == NULL) {
  					file_oomem(ms, mlen);
@@ -372,6 +376,21 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  					closedir(dir);
  					errs++;
  					goto out;
+ 				}
+ 			}
+-			filearr[files++] = mfn;
++			filearr[files++] = estrndup(mfn, mflen);
+ 		}
+ 		closedir(dir);
+ 		qsort(filearr, files, sizeof(*filearr), cmpstrp);
+ 		for (i = 0; i < files; i++) {
+ 			load_1(ms, action, filearr[i], &errs, &marray,
+ 			    &marraycount);
+-			free(filearr[i]);
++			efree(filearr[i]);
+ 		}
+ 		free(filearr);
+ 	} else
 @@ -882,12 +877,7 @@
  	for (i = 0; i < marraycount; i++)
  		mentrycount += marray[i].cont_count;
@@ -386,18 +405,31 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  
  	mentrycount = 0;
  	for (i = 0; i < marraycount; i++) {
-@@ -897,8 +887,8 @@
+@@ -896,9 +886,14 @@
+ 		mentrycount += marray[i].cont_count;
  	}
  out:
- 	for (i = 0; i < marraycount; i++)
+-	for (i = 0; i < marraycount; i++)
 -		free(marray[i].mp);
 -	free(marray);
-+		efree(marray[i].mp);
-+	efree(marray);
++	for (i = 0; i < marraycount; i++) {
++		if (marray[i].mp) {
++			efree(marray[i].mp);
++		}
++	}
++	if (marray) {
++		efree(marray);
++	}
  	if (errs) {
  		*magicp = NULL;
  		*nmagicp = 0;
-@@ -1178,11 +1168,7 @@
+@@ -1175,14 +1170,13 @@
+ 			return -1;
+ 		}
+ 		me = &(*mentryp)[*nmentryp - 1];
++		if (me->mp == NULL) {
++			return -1;
++		}
  		if (me->cont_count == me->max_count) {
  			struct magic *nm;
  			size_t cnt = me->max_count + ALLOC_CHUNK;
@@ -410,7 +442,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  			me->mp = m = nm;
  			me->max_count = CAST(uint32_t, cnt);
  		}
-@@ -1194,23 +1180,13 @@
+@@ -1194,23 +1188,13 @@
  			struct magic_entry *mp;
  
  			maxmagic += ALLOC_INCR;
@@ -437,7 +469,18 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  			me->mp = m;
  			me->max_count = ALLOC_CHUNK;
  		} else
-@@ -1361,7 +1337,7 @@
+@@ -1353,6 +1337,10 @@
+ 	if (m->type == FILE_INVALID) {
+ 		if (ms->flags & MAGIC_CHECK)
+ 			file_magwarn(ms, "type `%s' invalid", l);
++		if (me->mp) {
++			efree(me->mp);
++			me->mp = NULL;
++		}
+ 		return -1;
+ 	}
+ 
+@@ -1361,7 +1349,7 @@
  
  	m->mask_op = 0;
  	if (*l == '~') {
@@ -446,7 +489,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  			m->mask_op |= FILE_OPINVERSE;
  		else if (ms->flags & MAGIC_CHECK)
  			file_magwarn(ms, "'~' invalid for string types");
-@@ -1370,7 +1346,7 @@
+@@ -1370,7 +1358,7 @@
  	m->str_range = 0;
  	m->str_flags = m->type == FILE_PSTRING ? PSTRING_1_LE : 0;
  	if ((op = get_op(*l)) != -1) {
@@ -455,7 +498,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  			uint64_t val;
  			++l;
  			m->mask_op |= op;
-@@ -1558,11 +1534,6 @@
+@@ -1558,11 +1546,6 @@
  		if (check_format(ms, m) == -1)
  			return -1;
  	}
@@ -467,7 +510,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  	m->mimetype[0] = '\0';		/* initialise MIME type to none */
  	if (m->cont_level == 0)
  		++(*nmentryp);		/* make room for next */
-@@ -2195,56 +2166,68 @@
+@@ -2195,56 +2178,69 @@
  
  /*
   * handle a compiled file.
@@ -542,6 +585,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 +	mm = emalloc((size_t)st.sb.st_size);
 +	if (php_stream_read(stream, mm, (size_t)st.sb.st_size) != (size_t)st.sb.st_size) {
  		file_badread(ms);
++		ret = 1;
  		goto error1;
  	}
 -#define RET	1
@@ -559,7 +603,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  	ptr = (uint32_t *)(void *)*magicp;
  	if (*ptr != MAGICNO) {
  		if (swap4(*ptr) != MAGICNO) {
-@@ -2259,35 +2242,55 @@
+@@ -2259,35 +2255,55 @@
  	else
  		version = ptr[1];
  	if (version != VERSIONNO) {
@@ -631,7 +675,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  	return -1;
  }
  
-@@ -2301,42 +2304,49 @@
+@@ -2301,42 +2317,49 @@
  apprentice_compile(struct magic_set *ms, struct magic **magicp,
      uint32_t *nmagicp, const char *fn)
  {
@@ -639,10 +683,10 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  	char *dbname;
  	int rv = -1;
 +	php_stream *stream;
++
++	TSRMLS_FETCH();
  
 -	dbname = mkdbname(ms, fn, 1);
-+	TSRMLS_FETCH();
-+
 +	dbname = mkdbname(ms, fn, 0);
  
  	if (dbname == NULL) 
@@ -692,7 +736,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  	return rv;
  }
  
-@@ -2349,6 +2359,7 @@
+@@ -2349,6 +2372,7 @@
  {
  	const char *p, *q;
  	char *buf;
@@ -700,7 +744,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  
  	if (strip) {
  		if ((p = strrchr(fn, '/')) != NULL)
-@@ -2370,14 +2381,14 @@
+@@ -2370,14 +2394,14 @@
  	q++;
  	/* Compatibility with old code that looked in .mime */
  	if (ms->flags & MAGIC_MIME) {
@@ -719,7 +763,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  
  	/* Compatibility with old code that looked in .mime */
  	if (strstr(p, ".mime") != NULL)
-@@ -2467,7 +2478,7 @@
+@@ -2467,7 +2491,7 @@
  	m->offset = swap4((uint32_t)m->offset);
  	m->in_offset = swap4((uint32_t)m->in_offset);
  	m->lineno = swap4((uint32_t)m->lineno);
@@ -728,9 +772,9 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  		m->str_range = swap4(m->str_range);
  		m->str_flags = swap4(m->str_flags);
  	}
-diff -u libmagic.orig/ascmagic.c libmagic/ascmagic.c
---- libmagic.orig/ascmagic.c	2012-05-29 14:40:41.710960045 +0200
-+++ libmagic/ascmagic.c	2012-04-22 18:57:16.215980866 +0200
+diff -u libmagic.origin/ascmagic.c libmagic/ascmagic.c
+--- libmagic.origin/ascmagic.c	2012-07-15 18:17:24.762087659 +0800
++++ libmagic/ascmagic.c	2012-07-15 18:20:42.730087520 +0800
 @@ -139,10 +139,8 @@
  		/* malloc size is a conservative overestimate; could be
  		   improved, or at least realloced after conversion. */
@@ -754,9 +798,9 @@ diff -u libmagic.orig/ascmagic.c libmagic/ascmagic.c
  
  	return rv;
  }
-diff -u libmagic.orig/cdf.c libmagic/cdf.c
---- libmagic.orig/cdf.c	2012-05-29 14:40:41.710960045 +0200
-+++ libmagic/cdf.c	2012-04-22 18:57:16.219978162 +0200
+diff -u libmagic.origin/cdf.c libmagic/cdf.c
+--- libmagic.origin/cdf.c	2012-07-15 18:17:24.822087659 +0800
++++ libmagic/cdf.c	2012-07-15 18:20:42.730087520 +0800
 @@ -43,7 +43,17 @@
  #include <err.h>
  #endif
@@ -818,9 +862,9 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
  				cdf_print_elapsed_time(buf, sizeof(buf), tp);
  				(void)fprintf(stderr, "timestamp %s\n", buf);
  			} else {
-diff -u libmagic.orig/cdf.h libmagic/cdf.h
---- libmagic.orig/cdf.h	2012-05-29 14:40:41.710960045 +0200
-+++ libmagic/cdf.h	2012-04-22 18:57:16.219978162 +0200
+diff -u libmagic.origin/cdf.h libmagic/cdf.h
+--- libmagic.origin/cdf.h	2012-07-15 18:17:25.046087660 +0800
++++ libmagic/cdf.h	2012-07-15 18:20:42.730087520 +0800
 @@ -35,7 +35,7 @@
  #ifndef _H_CDF_
  #define _H_CDF_
@@ -856,9 +900,9 @@ diff -u libmagic.orig/cdf.h libmagic/cdf.h
  int cdf_read_header(const cdf_info_t *, cdf_header_t *);
  void cdf_swap_header(cdf_header_t *);
  void cdf_unpack_header(cdf_header_t *, char *);
-diff -u libmagic.orig/cdf_time.c libmagic/cdf_time.c
---- libmagic.orig/cdf_time.c	2012-05-29 14:40:41.710960045 +0200
-+++ libmagic/cdf_time.c	2012-04-22 18:57:16.219978162 +0200
+diff -u libmagic.origin/cdf_time.c libmagic/cdf_time.c
+--- libmagic.origin/cdf_time.c	2012-07-15 18:17:24.734087660 +0800
++++ libmagic/cdf_time.c	2012-07-15 18:20:42.734087519 +0800
 @@ -96,7 +96,7 @@
  }
  
@@ -915,9 +959,9 @@ diff -u libmagic.orig/cdf_time.c libmagic/cdf_time.c
  	static const cdf_timestamp_t tst = 0x01A5E403C2D59C00ULL;
  	static const char *ref = "Sat Apr 23 01:30:00 1977";
  	char *p, *q;
-diff -u libmagic.orig/compress.c libmagic/compress.c
---- libmagic.orig/compress.c	2012-05-29 14:40:41.710960045 +0200
-+++ libmagic/compress.c	2012-04-22 18:57:16.219978162 +0200
+diff -u libmagic.origin/compress.c libmagic/compress.c
+--- libmagic.origin/compress.c	2012-07-15 18:17:24.730087657 +0800
++++ libmagic/compress.c	2012-07-15 18:20:42.734087519 +0800
 @@ -32,6 +32,7 @@
   *	uncompress(method, old, n, newch) - uncompress old into new, 
   *					    using method, return sizeof new
@@ -1078,9 +1122,9 @@ diff -u libmagic.orig/compress.c libmagic/compress.c
  }
 -#endif
 +#endif /* if PHP_FILEINFO_UNCOMPRESS */
-diff -u libmagic.orig/file.h libmagic/file.h
---- libmagic.orig/file.h	2012-05-29 14:40:41.710960045 +0200
-+++ libmagic/file.h	2012-04-22 18:57:16.219978162 +0200
+diff -u libmagic.origin/file.h libmagic/file.h
+--- libmagic.origin/file.h	2012-07-15 18:17:25.046087660 +0800
++++ libmagic/file.h	2012-07-15 18:20:42.734087519 +0800
 @@ -33,11 +33,9 @@
  #ifndef __file_h__
  #define __file_h__
@@ -1251,9 +1295,9 @@ diff -u libmagic.orig/file.h libmagic/file.h
 +#endif
 +
  #endif /* __file_h__ */
-diff -u libmagic.orig/fsmagic.c libmagic/fsmagic.c
---- libmagic.orig/fsmagic.c	2012-05-29 14:40:41.710960045 +0200
-+++ libmagic/fsmagic.c	2012-04-22 18:57:16.219978162 +0200
+diff -u libmagic.origin/fsmagic.c libmagic/fsmagic.c
+--- libmagic.origin/fsmagic.c	2012-07-15 18:17:24.730087657 +0800
++++ libmagic/fsmagic.c	2012-07-15 18:20:42.734087519 +0800
 @@ -59,27 +59,21 @@
  # define minor(dev)  ((dev) & 0xff)
  #endif
@@ -1576,9 +1620,9 @@ diff -u libmagic.orig/fsmagic.c libmagic/fsmagic.c
  	}
  
  	/*
-diff -u libmagic.orig/funcs.c libmagic/funcs.c
---- libmagic.orig/funcs.c	2012-05-29 14:40:41.710960045 +0200
-+++ libmagic/funcs.c	2012-04-22 18:57:16.219978162 +0200
+diff -u libmagic.origin/funcs.c libmagic/funcs.c
+--- libmagic.origin/funcs.c	2012-07-15 18:17:25.046087660 +0800
++++ libmagic/funcs.c	2012-07-15 18:20:42.734087519 +0800
 @@ -41,52 +41,42 @@
  #if defined(HAVE_WCTYPE_H)
  #include <wctype.h>
@@ -1872,9 +1916,10 @@ diff -u libmagic.orig/funcs.c libmagic/funcs.c
 +	return rep_cnt;
  }
 +
-diff -u libmagic.orig/magic.c libmagic/magic.c
---- libmagic.orig/magic.c	2012-05-29 14:40:41.710960045 +0200
-+++ libmagic/magic.c	2012-04-22 18:57:16.219978162 +0200
+Common subdirectories: libmagic.origin/.libs and libmagic/.libs
+diff -u libmagic.origin/magic.c libmagic/magic.c
+--- libmagic.origin/magic.c	2012-07-15 18:17:25.046087660 +0800
++++ libmagic/magic.c	2012-07-15 18:20:42.734087519 +0800
 @@ -25,11 +25,6 @@
   * SUCH DAMAGE.
   */
@@ -2250,9 +2295,9 @@ diff -u libmagic.orig/magic.c libmagic/magic.c
  
  public const char *
  magic_error(struct magic_set *ms)
-diff -u libmagic.orig/magic.h libmagic/magic.h
---- libmagic.orig/magic.h	2012-05-29 14:40:41.710960045 +0200
-+++ libmagic/magic.h	2012-04-22 18:57:16.219978162 +0200
+diff -u libmagic.origin/magic.h libmagic/magic.h
+--- libmagic.origin/magic.h	2012-07-15 18:17:24.734087660 +0800
++++ libmagic/magic.h	2012-07-15 18:20:42.734087519 +0800
 @@ -85,6 +85,7 @@
  
  const char *magic_getpath(const char *, int);
@@ -2269,20 +2314,20 @@ diff -u libmagic.orig/magic.h libmagic/magic.h
  int magic_list(magic_t, const char *);
  int magic_errno(magic_t);
  
-diff -u libmagic.orig/print.c libmagic/print.c
---- libmagic.orig/print.c	2012-05-29 14:40:41.710960045 +0200
-+++ libmagic/print.c	2012-05-29 14:34:03.770376387 +0200
+diff -u libmagic.origin/print.c libmagic/print.c
+--- libmagic.origin/print.c	2012-07-15 18:21:02.846087501 +0800
++++ libmagic/print.c	2012-07-15 18:20:42.734087519 +0800
 @@ -29,6 +29,9 @@
   * print.c - debugging printout routines
   */
  
++#define _GNU_SOURCE
 +#include "php.h"
-+#include "main/snprintf.h"
 +
  #include "file.h"
  
  #ifndef lint
-@@ -45,174 +48,21 @@
+@@ -46,174 +49,21 @@
  
  #define SZOF(a)	(sizeof(a) / sizeof(a[0]))
  
@@ -2464,9 +2509,206 @@ diff -u libmagic.orig/print.c libmagic/print.c
  }
  
  protected const char *
-diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
---- libmagic.orig/readcdf.c	2012-05-29 14:40:41.710960045 +0200
-+++ libmagic/readcdf.c	2012-04-22 18:57:16.219978162 +0200
+diff -u libmagic.origin/print.c.rej libmagic/print.c.rej
+--- libmagic.origin/print.c.rej	2012-07-15 18:17:24.762087659 +0800
++++ libmagic/print.c.rej	2012-07-15 18:20:27.186087168 +0800
+@@ -1,12 +1,184 @@
+---- libmagic/print.c	2012-05-29 14:34:03.770376387 +0200
+-+++ libmagic.orig/print.c	2012-05-29 14:40:41.710960045 +0200
+-@@ -29,9 +29,6 @@
+-  * print.c - debugging printout routines
+-  */
++--- libmagic.orig/print.c	2012-05-29 14:40:41.710960045 +0200
+++++ libmagic/print.c	2012-05-29 14:34:03.770376387 +0200
++@@ -48,174 +51,21 @@
+  
+--#include "php.h"
+--#include "main/snprintf.h"
++ #define SZOF(a)	(sizeof(a) / sizeof(a[0]))
++ 
++-#ifndef COMPILE_ONLY
++-protected void
++-file_mdump(struct magic *m)
++-{
++-	private const char optyp[] = { FILE_OPS };
++-
++-	(void) fprintf(stderr, "%u: %.*s %u", m->lineno,
++-	    (m->cont_level & 7) + 1, ">>>>>>>>", m->offset);
++-
++-	if (m->flag & INDIR) {
++-		(void) fprintf(stderr, "(%s,",
++-			       /* Note: type is unsigned */
++-			       (m->in_type < file_nnames) ? 
++-					file_names[m->in_type] : "*bad*");
++-		if (m->in_op & FILE_OPINVERSE)
++-			(void) fputc('~', stderr);
++-		(void) fprintf(stderr, "%c%u),",
++-			       ((size_t)(m->in_op & FILE_OPS_MASK) <
++-			       SZOF(optyp)) ? 
++-					optyp[m->in_op & FILE_OPS_MASK] : '?',
++-				m->in_offset);
++-	}
++-	(void) fprintf(stderr, " %s%s", (m->flag & UNSIGNED) ? "u" : "",
++-		       /* Note: type is unsigned */
++-		       (m->type < file_nnames) ? file_names[m->type] : "*bad*");
++-	if (m->mask_op & FILE_OPINVERSE)
++-		(void) fputc('~', stderr);
++-
++-	if (IS_STRING(m->type)) {
++-		if (m->str_flags) {
++-			(void) fputc('/', stderr);
++-			if (m->str_flags & STRING_COMPACT_WHITESPACE) 
++-				(void) fputc(CHAR_COMPACT_WHITESPACE, stderr);
++-			if (m->str_flags & STRING_COMPACT_OPTIONAL_WHITESPACE) 
++-				(void) fputc(CHAR_COMPACT_OPTIONAL_WHITESPACE,
++-				    stderr);
++-			if (m->str_flags & STRING_IGNORE_LOWERCASE) 
++-				(void) fputc(CHAR_IGNORE_LOWERCASE, stderr);
++-			if (m->str_flags & STRING_IGNORE_UPPERCASE) 
++-				(void) fputc(CHAR_IGNORE_UPPERCASE, stderr);
++-			if (m->str_flags & REGEX_OFFSET_START) 
++-				(void) fputc(CHAR_REGEX_OFFSET_START, stderr);
++-			if (m->str_flags & STRING_TEXTTEST)
++-				(void) fputc(CHAR_TEXTTEST, stderr);
++-			if (m->str_flags & STRING_BINTEST)
++-				(void) fputc(CHAR_BINTEST, stderr);
++-			if (m->str_flags & PSTRING_1_BE)
++-				(void) fputc(CHAR_PSTRING_1_BE, stderr);
++-			if (m->str_flags & PSTRING_2_BE)
++-				(void) fputc(CHAR_PSTRING_2_BE, stderr);
++-			if (m->str_flags & PSTRING_2_LE)
++-				(void) fputc(CHAR_PSTRING_2_LE, stderr);
++-			if (m->str_flags & PSTRING_4_BE)
++-				(void) fputc(CHAR_PSTRING_4_BE, stderr);
++-			if (m->str_flags & PSTRING_4_LE)
++-				(void) fputc(CHAR_PSTRING_4_LE, stderr);
++-			if (m->str_flags & PSTRING_LENGTH_INCLUDES_ITSELF)
++-				(void) fputc(
++-				    CHAR_PSTRING_LENGTH_INCLUDES_ITSELF,
++-				    stderr);
++-		}
++-		if (m->str_range)
++-			(void) fprintf(stderr, "/%u", m->str_range);
++-	}
++-	else {
++-		if ((size_t)(m->mask_op & FILE_OPS_MASK) < SZOF(optyp))
++-			(void) fputc(optyp[m->mask_op & FILE_OPS_MASK], stderr);
++-		else
++-			(void) fputc('?', stderr);
++-			
++-		if (m->num_mask) {
++-			(void) fprintf(stderr, "%.8llx",
++-			    (unsigned long long)m->num_mask);
++-		}
++-	}
++-	(void) fprintf(stderr, ",%c", m->reln);
++-
++-	if (m->reln != 'x') {
++-		switch (m->type) {
++-		case FILE_BYTE:
++-		case FILE_SHORT:
++-		case FILE_LONG:
++-		case FILE_LESHORT:
++-		case FILE_LELONG:
++-		case FILE_MELONG:
++-		case FILE_BESHORT:
++-		case FILE_BELONG:
++-			(void) fprintf(stderr, "%d", m->value.l);
++-			break;
++-		case FILE_BEQUAD:
++-		case FILE_LEQUAD:
++-		case FILE_QUAD:
++-			(void) fprintf(stderr, "%" INT64_T_FORMAT "d",
++-			    (unsigned long long)m->value.q);
++-			break;
++-		case FILE_PSTRING:
++-		case FILE_STRING:
++-		case FILE_REGEX:
++-		case FILE_BESTRING16:
++-		case FILE_LESTRING16:
++-		case FILE_SEARCH:
++-			file_showstr(stderr, m->value.s, (size_t)m->vallen);
++-			break;
++-		case FILE_DATE:
++-		case FILE_LEDATE:
++-		case FILE_BEDATE:
++-		case FILE_MEDATE:
++-			(void)fprintf(stderr, "%s,",
++-			    file_fmttime(m->value.l, 1));
++-			break;
++-		case FILE_LDATE:
++-		case FILE_LELDATE:
++-		case FILE_BELDATE:
++-		case FILE_MELDATE:
++-			(void)fprintf(stderr, "%s,",
++-			    file_fmttime(m->value.l, 0));
++-			break;
++-		case FILE_QDATE:
++-		case FILE_LEQDATE:
++-		case FILE_BEQDATE:
++-			(void)fprintf(stderr, "%s,",
++-			    file_fmttime((uint32_t)m->value.q, 1));
++-			break;
++-		case FILE_QLDATE:
++-		case FILE_LEQLDATE:
++-		case FILE_BEQLDATE:
++-			(void)fprintf(stderr, "%s,",
++-			    file_fmttime((uint32_t)m->value.q, 0));
++-			break;
++-		case FILE_FLOAT:
++-		case FILE_BEFLOAT:
++-		case FILE_LEFLOAT:
++-			(void) fprintf(stderr, "%G", m->value.f);
++-			break;
++-		case FILE_DOUBLE:
++-		case FILE_BEDOUBLE:
++-		case FILE_LEDOUBLE:
++-			(void) fprintf(stderr, "%G", m->value.d);
++-			break;
++-		case FILE_DEFAULT:
++-			/* XXX - do anything here? */
++-			break;
++-		default:
++-			(void) fputs("*bad*", stderr);
++-			break;
++-		}
++-	}
++-	(void) fprintf(stderr, ",\"%s\"]\n", m->desc);
++-}
++-#endif
++-
++ /*VARARGS*/
++ protected void
++ file_magwarn(struct magic_set *ms, const char *f, ...)
++ {
++ 	va_list va;
+++	char *expanded_format;
+++	TSRMLS_FETCH();
++ 
++-	/* cuz we use stdout for most, stderr here */
++-	(void) fflush(stdout); 
+ -
+- #include "file.h"
++-	if (ms->file)
++-		(void) fprintf(stderr, "%s, %lu: ", ms->file,
++-		    (unsigned long)ms->line);
++-	(void) fprintf(stderr, "Warning: ");
++ 	va_start(va, f);
++-	(void) vfprintf(stderr, f, va);
+++	vasprintf(&expanded_format, f, va);
++ 	va_end(va);
++-	(void) fputc('\n', stderr);
+++	
+++	php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Warning: %s", expanded_format);
+++
+++	free(expanded_format);
++ }
+  
+- #ifndef lint
++ protected const char *
+diff -u libmagic.origin/readcdf.c libmagic/readcdf.c
+--- libmagic.origin/readcdf.c	2012-07-15 18:17:24.734087660 +0800
++++ libmagic/readcdf.c	2012-07-15 18:20:42.734087519 +0800
 @@ -30,7 +30,11 @@
  #endif
  
@@ -2512,9 +2754,9 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
                                          c = cdf_ctime(&ts.tv_sec);
                                          if ((ec = strchr(c, '\n')) != NULL)
                                                  *ec = '\0';
-diff -u libmagic.orig/readelf.c libmagic/readelf.c
---- libmagic.orig/readelf.c	2012-05-29 14:40:41.710960045 +0200
-+++ libmagic/readelf.c	2012-04-22 18:57:16.219978162 +0200
+diff -u libmagic.origin/readelf.c libmagic/readelf.c
+--- libmagic.origin/readelf.c	2012-07-15 18:17:25.046087660 +0800
++++ libmagic/readelf.c	2012-07-15 18:20:42.734087519 +0800
 @@ -49,7 +49,7 @@
      off_t, int *, int);
  private int doshn(struct magic_set *, int, int, int, off_t, int, size_t,
@@ -2669,9 +2911,9 @@ diff -u libmagic.orig/readelf.c libmagic/readelf.c
  		fd = file_pipe2file(ms, fd, buf, nbytes);
  
  	if (fstat(fd, &st) == -1) {
-diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
---- libmagic.orig/softmagic.c	2012-05-29 14:40:41.710960045 +0200
-+++ libmagic/softmagic.c	2012-05-29 14:34:31.900417647 +0200
+diff -u libmagic.origin/softmagic.c libmagic/softmagic.c
+--- libmagic.origin/softmagic.c	2012-07-15 18:17:24.722087658 +0800
++++ libmagic/softmagic.c	2012-07-15 18:20:42.734087519 +0800
 @@ -41,6 +41,11 @@
  #include <stdlib.h>
  #include <time.h>

ext/fileinfo/libmagic/apprentice.c

@@ -753,7 +753,7 @@ private int
 apprentice_load(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp,
     const char *fn, int action)
 {
-	int errs = 0;
+	int errs = 0, mflen = 0;
 	struct magic_entry *marray;
 	uint32_t marraycount, i, mentrycount = 0, starttest;
 	size_t files = 0, maxfiles = 0;
@@ -782,7 +782,7 @@ apprentice_load(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp,
 			goto out;
 		}
 		while ((d = readdir(dir)) != NULL) {
-			if (snprintf(mfn, sizeof(mfn), "%s/%s", fn, d->d_name) < 0) {
+			if ((mflen = snprintf(mfn, sizeof(mfn), "%s/%s", fn, d->d_name)) < 0) {
 				file_oomem(ms,
 				    strlen(fn) + strlen(d->d_name) + 2);
 				errs++;
@@ -804,14 +804,14 @@ apprentice_load(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp,
 					goto out;
 				}
 			}
-			filearr[files++] = mfn;
+			filearr[files++] = estrndup(mfn, mflen);
 		}
 		closedir(dir);
 		qsort(filearr, files, sizeof(*filearr), cmpstrp);
 		for (i = 0; i < files; i++) {
 			load_1(ms, action, filearr[i], &errs, &marray,
 			    &marraycount);
-			free(filearr[i]);
+			efree(filearr[i]);
 		}
 		free(filearr);
 	} else
@@ -886,9 +886,14 @@ apprentice_load(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp,
 		mentrycount += marray[i].cont_count;
 	}
 out:
-	for (i = 0; i < marraycount; i++)
-		efree(marray[i].mp);
-	efree(marray);
+	for (i = 0; i < marraycount; i++) {
+		if (marray[i].mp) {
+			efree(marray[i].mp);
+		}
+	}
+	if (marray) {
+		efree(marray);
+	}
 	if (errs) {
 		*magicp = NULL;
 		*nmagicp = 0;
@@ -1165,6 +1170,9 @@ parse(struct magic_set *ms, struct magic_entry **mentryp, uint32_t *nmentryp,
 			return -1;
 		}
 		me = &(*mentryp)[*nmentryp - 1];
+		if (me->mp == NULL) {
+			return -1;
+		}
 		if (me->cont_count == me->max_count) {
 			struct magic *nm;
 			size_t cnt = me->max_count + ALLOC_CHUNK;
@@ -1329,6 +1337,10 @@ parse(struct magic_set *ms, struct magic_entry **mentryp, uint32_t *nmentryp,
 	if (m->type == FILE_INVALID) {
 		if (ms->flags & MAGIC_CHECK)
 			file_magwarn(ms, "type `%s' invalid", l);
+		if (me->mp) {
+			efree(me->mp);
+			me->mp = NULL;
+		}
 		return -1;
 	}
 
@@ -2219,6 +2231,7 @@ apprentice_map(struct magic_set *ms, struct magic **magicp, uint32_t *nmagicp,
 	mm = emalloc((size_t)st.sb.st_size);
 	if (php_stream_read(stream, mm, (size_t)st.sb.st_size) != (size_t)st.sb.st_size) {
 		file_badread(ms);
+		ret = 1;
 		goto error1;
 	}
 	ret = 1;

ext/fileinfo/tests/bug61964.phpt

@@ -0,0 +1,69 @@
+--TEST--
+Bug #61964 (finfo_open with directory cause invalid free)
+--SKIPIF--
+<?php require_once(dirname(__FILE__) . '/skipif.inc'); ?>
+--FILE--
+<?php
+
+$magic_file = dirname(__FILE__) . DIRECTORY_SEPARATOR . 'magic';
+
+$ret = @finfo_open(FILEINFO_NONE, $magic_file . ".non-exits");
+var_dump($ret);
+
+$dir = __DIR__ . "/test-folder";
+@mkdir($dir);
+
+$magic_file_copy = $dir . "/magic.copy";
+$magic_file_copy2 = $magic_file_copy . "2";
+copy($magic_file, $magic_file_copy);
+copy($magic_file, $magic_file_copy2);
+
+$ret = finfo_open(FILEINFO_NONE, $dir);
+var_dump($ret);
+
+$ret = @finfo_open(FILEINFO_NONE, $dir);
+var_dump($ret);
+
+$ret = @finfo_open(FILEINFO_NONE, $dir. "/non-exits-dir");
+var_dump($ret);
+
+// write some test files to test folder
+file_put_contents($dir . "/test1.txt", "string\n> Core\n> Me");
+file_put_contents($dir . "/test2.txt", "a\nb\n");
+@mkdir($dir . "/test-inner-folder");
+
+finfo_open(FILEINFO_NONE, $dir);
+echo "DONE: testing dir with files\n";
+
+rmdir($dir . "/test-inner-folder");
+unlink($dir . "/test1.txt");
+unlink($dir . "/test2.txt");
+
+unlink($magic_file_copy);
+unlink($magic_file_copy2);
+rmdir($dir);
+?>
+===DONE===
+--EXPECTF--
+bool(false)
+resource(%d) of type (file_info)
+resource(%d) of type (file_info)
+bool(false)
+
+Notice: finfo_open(): Warning: offset `string' invalid in %sbug61964.php on line %d
+
+Notice: finfo_open(): Warning: offset ` Core' invalid in %sbug61964.php on line %d
+
+Notice: finfo_open(): Warning: type `Core' invalid in %sbug61964.php on line %d
+
+Notice: finfo_open(): Warning: offset `a' invalid in %sbug61964.php on line %d
+
+Notice: finfo_open(): Warning: type `a' invalid in %sbug61964.php on line %d
+
+Notice: finfo_open(): Warning: offset `b' invalid in %sbug61964.php on line %d
+
+Notice: finfo_open(): Warning: type `b' invalid in %sbug61964.php on line %d
+
+Warning: finfo_open(): Failed to load magic database at '%stest-folder'. in %sbug61964.php on line %d
+DONE: testing dir with files
+===DONE===

ext/fileinfo/tests/finfo_open_error-win32.phpt

@@ -43,13 +43,7 @@ bool(false)
 
 Warning: finfo_open() expects at most 2 parameters, 3 given in %sfinfo_open_error-win32.php on line %d
 bool(false)
-
-Warning: finfo_open(%smagic): failed to open stream: No such file or directory in %sfinfo_open_error-win32.php on line %d
-
-Warning: finfo_open(%smagic): failed to open stream: No such file or directory in %sfinfo_open_error-win32.php on line %d
-
-Warning: finfo_open(): Failed to load magic database at '%smagic'. in %sfinfo_open_error-win32.php on line %d
-bool(false)
+resource(6) of type (file_info)
 
 Warning: finfo_open() expects parameter 1 to be long, string given in %sfinfo_open_error-win32.php on line %d
 bool(false)

ext/intl/collator/collator_class.c

@@ -67,6 +67,7 @@ zend_object_value Collator_object_create(
 	intern = ecalloc( 1, sizeof(Collator_object) );
 	intl_error_init( COLLATOR_ERROR_P( intern ) TSRMLS_CC );
 	zend_object_std_init( &intern->zo, ce TSRMLS_CC );
+	object_properties_init(&intern->zo, ce);
 
 	retval.handle = zend_objects_store_put(
 		intern,

ext/intl/dateformat/dateformat_class.c

@@ -63,6 +63,7 @@ zend_object_value IntlDateFormatter_object_create(zend_class_entry *ce TSRMLS_DC
 	intern = ecalloc( 1, sizeof(IntlDateFormatter_object) );
 	dateformat_data_init( &intern->datef_data TSRMLS_CC );
 	zend_object_std_init( &intern->zo, ce TSRMLS_CC );
+	object_properties_init(&intern->zo, ce);
 	intern->date_type = 0;
 	intern->time_type = 0;
 	intern->calendar  = 1;		/* Gregorian calendar */

ext/intl/formatter/formatter_class.c

@@ -62,6 +62,7 @@ zend_object_value NumberFormatter_object_create(zend_class_entry *ce TSRMLS_DC)
 	intern = ecalloc( 1, sizeof(NumberFormatter_object) );
 	formatter_data_init( &intern->nf_data TSRMLS_CC );
 	zend_object_std_init( &intern->zo, ce TSRMLS_CC );
+	object_properties_init(&intern->zo, ce);
 
 	retval.handle = zend_objects_store_put(
 		intern,