5.5.23

Fix bug #69253 - ZIP Integer Overflow leads to writing past heap boundary
Fix bug #69248 - heap overflow vulnerability in regcomp.c
2026-11-09 10:10:50 +00:00 · 2015-03-18 10:45:50 +01:00 · 2015-03-18 10:39:34 +01:00 · 2015-03-18 10:39:08 +01:00 · 2015-03-18 10:38:54 +01:00 · 2015-03-18 10:38:20 +01:00
70 changed files with 1030 additions and 266 deletions
@@ -1,17 +1,91 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+19 Mar 2015, PHP 5.5.23
+
+- Core:
+  . Fixed bug #69174 (leaks when unused inner class use traits precedence).
+    (Laruence)
+  . Fixed bug #69139 (Crash in gc_zval_possible_root on unserialize).
+    (Laruence)
+  . Fixed bug #69121 (Segfault in get_current_user when script owner is not
+    in passwd with ZTS build). (dan at syneto dot net)
+  . Fixed bug #65593 (Segfault when calling ob_start from output buffering 
+    callback). (Mike)
+  . Fixed bug #69017 (Fail to push to the empty array with the constant value
+    defined in class scope). (Laruence)
+  . Fixed bug #68986 (pointer returned by php_stream_fopen_temporary_file
+    not validated in memory.c). (nayana at ddproperty dot com)
+  . Fixed bug #68166 (Exception with invalid character causes segv). (Rasmus)
+  . Fixed bug #69141 (Missing arguments in reflection info for some builtin
+    functions). (kostyantyn dot lysyy at oracle dot com)
+  . Fixed bug #68976 (Use After Free Vulnerability in unserialize()). (Stas)
+  . Fixed bug #69134 (Per Directory Values overrides PHP_INI_SYSTEM
+    configuration options). (Anatol Belski)
+  . Fixed bug #69207 (move_uploaded_file allows nulls in path). (Stas)
+
+- CGI:
+  . Fixed bug #69015 (php-cgi's getopt does not see $argv). (Laruence)
+
+- CLI:
+  . Fixed bug #67741 (auto_prepend_file messes up __LINE__). (Reeze Xia)
+
+- cURL:
+  . Fixed bug #69088 (PHP_MINIT_FUNCTION does not fully initialize cURL on
+    Win32). (Grant Pannell)
+  . Add CURLPROXY_SOCKS4A and CURLPROXY_SOCKS5_HOSTNAME constants if supported
+    by libcurl. (Linus Unneback)
+
+- Ereg:
+  . Fixed bug #69248 (heap overflow vulnerability in regcomp.c). (Stas)
+
+- FPM:
+  . Fixed bug #68822 (request time is reset too early). (honghu069 at 163 dot com)
+
+- ODBC:
+  . Fixed bug #68964 (Allowed memory size exhausted with odbc_exec). (Anatol)
+
+- Opcache:
+  . Fixed bug #69125 (Array numeric string as key). (Laruence)
+  . Fixed bug #69038 (switch(SOMECONSTANT) misbehaves). (Laruence)
+
+- OpenSSL:
+  . Fixed bugs #61285, #68329, #68046, #41631 (encrypted streams don't observe
+    socket timeouts). (Brad Broerman)
+
+- pgsql:
+  . Fixed bug #68638 (pg_update() fails to store infinite values).
+    (william dot welter at 4linux dot com dot br, Laruence)
+
+- Readline:
+  . Fixed bug #69054 (Null dereference in readline_(read|write)_history() without
+    parameters). (Laruence)
+
+- SOAP:
+  . Fixed bug #69085 (SoapClient's __call() type confusion through
+    unserialize()). (andrea dot palazzo at truel dot it, Laruence)
+
+- SPL:
+  . Fixed bug #69108 ("Segmentation fault" when (de)serializing
+    SplObjectStorage). (Laruence)
+  . Fixed bug #68557 (RecursiveDirectoryIterator::seek(0) broken after 
+    calling getChildren()). (Julien)
+
+- ZIP:
+  . Fixed bug #69253 (ZIP Integer Overflow leads to writing past heap
+    boundary) (CVE-2015-2331). (Stas)
+
 19 Feb 2015, PHP 5.5.22

 - Core:
-  . Fixed bug #67068 (getClosure returns somethings that's not a closure). 
-    (Danack at basereality dot com)
-  . Fixed bug #68925 (Mitigation for CVE-2015-0235 – GHOST: glibc gethostbyname
-    buffer overflow). (Stas)
-  . Fixed bug #68942 (Use after free vulnerability in unserialize() with
-    DateTimeZone). (CVE-2015-0273) (Stas)
-  . Added NULL byte protection to exec, system and passthru. (Yasuo)
  . Removed support for multi-line headers, as the are deprecated by RFC 7230.
    (Stas)
+  . Fixed bug #67068 (getClosure returns somethings that's not a closure). 
+    (Danack at basereality dot com)
+  . Fixed bug #68942 (Use after free vulnerability in unserialize() with
+    DateTimeZone). (CVE-2015-0273) (Stas)
+  . Fixed bug #68925 (Mitigation for CVE-2015-0235 – GHOST: glibc gethostbyname
+    buffer overflow). (Stas)
+  . Added NULL byte protection to exec, system and passthru. (Yasuo)

 - Date:
  . Fixed bug #45081 (strtotime incorrectly interprets SGT time zone). (Derick)
@@ -20,7 +94,7 @@ PHP                                                                        NEWS
  . Fixed bug #68711 (useless comparisons). (bugreports at internot dot info)

 - Enchant: 
-  . Fixed bug #6855 (heap buffer overflow in enchant_broker_request_dict()).
+  . Fixed bug #68552 (heap buffer overflow in enchant_broker_request_dict()).
    (Antony)

 - Fileinfo:
@@ -35,13 +109,9 @@ PHP                                                                        NEWS
  . Fixed bug #64938 (libxml_disable_entity_loader setting is shared
    between threads). (Martin Jansen)

- OpenSSL:
-  . Fixed bug #55618 (use case-insensitive cert name matching).
-    (Daniel Lowrey)
-
 - PDO_mysql:
  . Fixed bug #68750 (PDOMysql with mysqlnd does not allow the usage of
-    named pipes). (steffenb198@aol.com)
+    named pipes). (steffenb198 at aol dot com)

 - Phar:
  . Fixed bug #68901 (use after free). (bugreports at internot dot info)
@@ -68,7 +138,7 @@ PHP                                                                        NEWS
  . Fixed bug #65272 (flock() out parameter not set correctly in windows).
    (Daniel Lowrey)
  . Fixed bug #69033 (Request may get env. variables from previous requests
-    if PHP works as FastCGI)
+    if PHP works as FastCGI). (Anatol)

 - Streams:
  . Fixed bug which caused call after final close on streams filter. (Bob)
@@ -89,7 +159,7 @@ PHP                                                                        NEWS
  . Fixed bug #66764 (configure doesn't define EXPANDED_DATADIR / PHP_DATADIR
    correctly). (Ferenc)
  . Fixed bug #68583 (Crash in timeout thread). (Anatol)
-  . Fixed bug #68676 (Explicit Double Free). (Kalle)
+  . Fixed bug #68676 (Explicit Double Free). (CVE-2014-9425) (Kalle)
  . Fixed bug #68710 (Use After Free Vulnerability in PHP's unserialize()).
    (CVE-2015-0231) (Stefan Esser)

@@ -105,7 +175,8 @@ PHP                                                                        NEWS
    CURLOPT_RETURNTRANSFER isn't set). (Jille Timmermans)

 - EXIF:
-  . Fixed bug #68799: Free called on unitialized pointer. (CVE-2015-0232) (Stas)
+  . Fixed bug #68799 (Free called on unitialized pointer). (CVE-2015-0232)
+    (Stas)

 - Fileinfo:
  . Fixed bug #68671 (incorrect expression in libmagic).
@@ -132,6 +203,9 @@ PHP                                                                        NEWS
  . Fixed bug #67111 (Memory leak when using "continue 2" inside two foreach
    loops). (Nikita)

+- OpenSSL:
+  . Fixed bug #55618 (use case-insensitive cert name matching). (Daniel Lowrey)
+
 - Pcntl:
  . Fixed bug #60509 (pcntl_signal doesn't decrease ref-count of old handler
    when setting SIG_DFL). (Julien)
@@ -207,6 +281,10 @@ PHP                                                                        NEWS
  . Fixed bug #68351 (PDO::PARAM_BOOL and ATTR_EMULATE_PREPARES misbehaving)
  (Matteo)

+- SOAP:
+  . Fixed bug #68361 (Segmentation fault on SoapClient::__getTypes).
+    (Laruence)
+
 - zlib:
  . Fixed bug #53829 (Compiling PHP with large file support will replace
    function gzopen by gzopen64) (Sascha Kettler, Matteo)
@@ -231,6 +309,10 @@ PHP                                                                        NEWS
  . Fixed bug #68283 (fileinfo: out-of-bounds read in elf note headers).
    (CVE-2014-3710) (Remi)

+- FPM:
+  . Implemented FR #55508 (listen and listen.allowed_clients should take IPv6
+    addresses). (Robin Gloster)
+
 - GD:
  . Fixed bug #65171 (imagescale() fails without height param). (Remi)

@@ -246,10 +328,6 @@ PHP                                                                        NEWS
  . Fixed bug #68087 (ODBC not correctly reading DATE column when preceded by
    a VARCHAR column) (Keyur Govande)

- SOAP:
-  . Fixed bug #68361 (Segmentation fault on SoapClient::__getTypes).
-    (Laruence)
-
 - SPL:
  . Fixed bug #68128 (Regression in RecursiveRegexIterator) (Tjerk)

@@ -263,12 +341,22 @@ PHP                                                                        NEWS
  . Fixed bug #67633 (A foreach on an array returned from a function not doing
    copy-on-write). (Nikita)
  . Fixed bug #51800 (proc_open on Windows hangs forever). (Anatol)
+  . Fixed bug #68044 (Integer overflow in unserialize() (32-bits only)).
+    (CVE-2014-3669) (Stas)
+
+- cURL:
+  . Fixed bug #68089 (NULL byte injection - cURL lib). (Stas)
+
+- EXIF:
+  . Fixed bug #68113 (Heap corruption in exif_thumbnail()). (CVE-2014-3670)
+    (Stas)

 - FPM:
  . Fixed bug #65641 (PHP-FPM incorrectly defines the SCRIPT_NAME variable
    when using Apache, mod_proxy-fcgi and ProxyPass). (Remi)
-  . Implemented FR #55508 (listen and listen.allowed_clients should take IPv6
-    addresses). (Robin Gloster)
+
+- OpenSSL:
+  . Revert regression introduced by fix of bug #41631

 - Reflection:
  . Fixed bug #68103 (Duplicate entry in Reflection for class alias). (Remi)
@@ -276,6 +364,10 @@ PHP                                                                        NEWS
 - Session:
  . Fixed bug #67972 (SessionHandler Invalid memory read create_sid()). (Adam)

+- XMLRPC:
+  . Fixed bug #68027 (Global buffer overflow in mkgmtime() function).
+    (CVE-2014-3668) (Stas)
+
 18 Sep 2014, PHP 5.5.17

 - Core:
@@ -331,7 +423,7 @@ PHP                                                                        NEWS

 - FPM:
  . Fixed bug #67635 (php links to systemd libraries without using pkg-config).
-    (pacho@gentoo.org, Remi)
+    (pacho at gentoo dot org, Remi)

 - GD:
  . Fixed bug #66901 (php-gd 'c_color' NULL pointer dereference).
@@ -569,6 +661,8 @@ PHP                                                                        NEWS
 - JSON:
  . Fixed bug #66021 (Blank line inside empty array/object when
    JSON_PRETTY_PRINT is set). (Kevin Israel)
+  . Fixed bug #64695 (JSON_NUMERIC_CHECK has issues with strings that are 
+    numbers plus the letter e). (Jakub Zelenka)

 - LDAP:
  . Fixed issue with null bytes in LDAP bindings. (Matthew Daley)
@@ -9,7 +9,7 @@ error_reporting=

 spl_autoload_register(function($classname) {
 	if (in_array($classname, array('a','b','c'))) {
-		require_once ($classname . '.php');
+		require_once __DIR__ . "/{$classname}.php";
 	}
 });

@@ -9,7 +9,7 @@ error_reporting=-1

 spl_autoload_register(function($classname) {
 	if (in_array($classname, array('a','b','c'))) {
-		require_once ($classname . '.php');
+		require_once __DIR__ . "/{$classname}.php";
 	}
 });

@@ -0,0 +1,42 @@
+--TEST--
+#69017 (Fail to push to the empty array with the constant value defined in class scope)
+--FILE--
+<?php
+
+class c1
+{
+	const ZERO = 0;
+	const ONE = 1;
+	const MAX = PHP_INT_MAX;
+	public static $a1 = array(self::ONE => 'one');
+	public static $a2 = array(self::ZERO => 'zero');
+	public static $a3 = array(self::MAX => 'zero');
+}
+
+
+c1::$a1[] = 1;
+c1::$a2[] = 1;
+c1::$a3[] = 1;
+
+var_dump(c1::$a1);
+var_dump(c1::$a2);
+var_dump(c1::$a3);
+?>
+--EXPECTF--
+Warning: Cannot add element to the array as the next element is already occupied in %sbug69017.php on line %d
+array(2) {
+  [1]=>
+  string(3) "one"
+  [2]=>
+  int(1)
+}
+array(2) {
+  [0]=>
+  string(4) "zero"
+  [1]=>
+  int(1)
+}
+array(1) {
+  [%d]=>
+  string(4) "zero"
+}
@@ -0,0 +1,16 @@
+--TEST--
+Bug #69174 (leaks when unused inner class use traits precedence)
+--FILE--
+<?php
+function test() {
+	class C1 {
+		use T1, T2 {
+			T1::foo insteadof T2;
+			T1::bar insteadof T2;
+		}
+	}
+}
+?>
+==DONE==
+--EXPECT--
+==DONE==
@@ -4072,6 +4072,7 @@ static void zend_check_trait_usage(zend_class_entry *ce, zend_class_entry *trait
 static void zend_traits_init_trait_structures(zend_class_entry *ce TSRMLS_DC) /* {{{ */
 {
 	size_t i, j = 0;
+	zend_trait_precedence **precedences;
 	zend_trait_precedence *cur_precedence;
 	zend_trait_method_reference *cur_method_ref;
 	char *lcname;
@@ -4080,7 +4081,9 @@ static void zend_traits_init_trait_structures(zend_class_entry *ce TSRMLS_DC) /*
 	/* resolve class references */
 	if (ce->trait_precedences) {
 		i = 0;
-		while ((cur_precedence = ce->trait_precedences[i])) {
+		precedences = ce->trait_precedences;
+		ce->trait_precedences = NULL;
+		while ((cur_precedence = precedences[i])) {
 			/** Resolve classes for all precedence operations. */
 			if (cur_precedence->exclude_from_classes) {
 				cur_method_ref = cur_precedence->trait_method;
@@ -4137,6 +4140,7 @@ static void zend_traits_init_trait_structures(zend_class_entry *ce TSRMLS_DC) /*
 			}
 			i++;
 		}
+		ce->trait_precedences = precedences;
 	}

 	if (ce->trait_aliases) {
@@ -4204,16 +4208,20 @@ static void zend_do_traits_method_binding(zend_class_entry *ce TSRMLS_DC) /* {{{
 	for (i = 0; i < ce->num_traits; i++) {
 		if (ce->trait_precedences) {
 			HashTable exclude_table;
+			zend_trait_precedence **precedences;

 			/* TODO: revisit this start size, may be its not optimal */
 			zend_hash_init_ex(&exclude_table, 2, NULL, NULL, 0, 0);

-			zend_traits_compile_exclude_table(&exclude_table, ce->trait_precedences, ce->traits[i]);
+			precedences = ce->trait_precedences;
+			ce->trait_precedences = NULL;
+			zend_traits_compile_exclude_table(&exclude_table, precedences, ce->traits[i]);

 			/* copies functions, applies defined aliasing, and excludes unused trait methods */
 			zend_hash_apply_with_arguments(&ce->traits[i]->function_table TSRMLS_CC, (apply_func_args_t)zend_traits_copy_functions, 3, ce, &overriden, &exclude_table);

 			zend_hash_destroy(&exclude_table);
+			ce->trait_precedences = precedences;
 		} else {
 			zend_hash_apply_with_arguments(&ce->traits[i]->function_table TSRMLS_CC, (apply_func_args_t)zend_traits_copy_functions, 3, ce, &overriden, NULL);
 		}
@@ -4221,6 +4229,17 @@ static void zend_do_traits_method_binding(zend_class_entry *ce TSRMLS_DC) /* {{{

    zend_hash_apply_with_argument(&ce->function_table, (apply_func_arg_t)zend_fixup_trait_method, ce TSRMLS_CC);

+	if (ce->trait_precedences) {
+		i = 0;
+		while (ce->trait_precedences[i]) {
+			if (ce->trait_precedences[i]->exclude_from_classes) {
+				efree(ce->trait_precedences[i]->exclude_from_classes);
+				ce->trait_precedences[i]->exclude_from_classes = NULL;
+			}
+			i++;
+		}
+	}
+
 	if (overriden) {
 		zend_hash_destroy(overriden);
 		FREE_HASHTABLE(overriden);
@@ -1415,6 +1415,9 @@ ZEND_API int zend_hash_update_current_key_ex(HashTable *ht, int key_type, const

 		if (key_type == HASH_KEY_IS_LONG) {
 			p->h = num_index;
+			if ((long)num_index >= (long)ht->nNextFreeElement) {
+				ht->nNextFreeElement = num_index < LONG_MAX ? num_index + 1 : LONG_MAX;
+			}
 		} else {
 			p->h = h;
 			p->nKeyLength = str_length;
@@ -256,9 +256,14 @@ void _destroy_zend_class_traits_info(zend_class_entry *ce)
 			efree(ce->trait_precedences[i]->trait_method);

 			if (ce->trait_precedences[i]->exclude_from_classes) {
+				zend_uint j = 0;
+				zend_trait_precedence *cur_precedence = ce->trait_precedences[i];
+				while (cur_precedence->exclude_from_classes[j]) {
+					efree(cur_precedence->exclude_from_classes[j]);
+					j++;
+				}
 				efree(ce->trait_precedences[i]->exclude_from_classes);
 			}
-
 			efree(ce->trait_precedences[i]);
 			i++;
 		}
@@ -78,8 +78,8 @@ void zend_signal_handler_defer(int signo, siginfo_t *siginfo, void *context)

 	if (SIGG(active)) {
 		if (SIGG(depth) == 0) { /* try to handle signal */
-			if (SIGG(blocked) != -1) { /* inverse */
-				SIGG(blocked) = -1; /* signal is not blocked */
+			if (SIGG(blocked) != 0) { /* inverse */
+				SIGG(blocked) = 0; /* signal is not blocked */
 			}
 			if (SIGG(running) == 0) {
 				SIGG(running) = 1;
@@ -99,7 +99,7 @@ void zend_signal_handler_defer(int signo, siginfo_t *siginfo, void *context)
 				SIGG(running) = 0;
 			}
 		} else { /* delay signal handling */
-			SIGG(blocked) = 0; /* signal is blocked */
+			SIGG(blocked) = 1; /* signal is blocked */

 			if ((queue = SIGG(pavail))) { /* if none available it's simply forgotton */
 				SIGG(pavail) = queue->next;
@@ -314,7 +314,7 @@ void zend_signal_deactivate(TSRMLS_D)
 	SIGNAL_BEGIN_CRITICAL();
 	SIGG(active) = 0;
 	SIGG(running) = 0;
-	SIGG(blocked) = -1;
+	SIGG(blocked) = 0;
 	SIGG(depth) = 0;
 	SIGNAL_END_CRITICAL();
 }
@@ -119,7 +119,7 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=5
-PHP_RELEASE_VERSION=22
+PHP_RELEASE_VERSION=23
 PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
@@ -845,6 +845,11 @@ PHP_MINIT_FUNCTION(curl)
 	REGISTER_CURL_CONSTANT(CURLPROXY_SOCKS4);
 	REGISTER_CURL_CONSTANT(CURLPROXY_SOCKS5);

+#if LIBCURL_VERSION_NUM >= 0x071200 /* Available since 7.18.0 */
+	REGISTER_CURL_CONSTANT(CURLPROXY_SOCKS4A);
+	REGISTER_CURL_CONSTANT(CURLPROXY_SOCKS5_HOSTNAME);
+#endif
+
 	/* Curl Share constants */
 	REGISTER_CURL_CONSTANT(CURLSHOPT_NONE);
 	REGISTER_CURL_CONSTANT(CURLSHOPT_SHARE);
@@ -1240,7 +1245,7 @@ PHP_MINIT_FUNCTION(curl)
 	gcry_control(GCRYCTL_SET_THREAD_CBS, &php_curl_gnutls_tsl);
 #endif

-	if (curl_global_init(CURL_GLOBAL_SSL) != CURLE_OK) {
+	if (curl_global_init(CURL_GLOBAL_DEFAULT) != CURLE_OK) {
 		return FAILURE;
 	}

@@ -85,6 +85,7 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_mktime, 0, 0, 0)
 	ZEND_ARG_INFO(0, mon)
 	ZEND_ARG_INFO(0, day)
 	ZEND_ARG_INFO(0, year)
+	ZEND_ARG_INFO(0, is_dst)
 ZEND_END_ARG_INFO()

 ZEND_BEGIN_ARG_INFO_EX(arginfo_gmmktime, 0, 0, 0)
@@ -94,6 +95,7 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_gmmktime, 0, 0, 0)
 	ZEND_ARG_INFO(0, mon)
 	ZEND_ARG_INFO(0, day)
 	ZEND_ARG_INFO(0, year)
+	ZEND_ARG_INFO(0, is_dst)
 ZEND_END_ARG_INFO()

 ZEND_BEGIN_ARG_INFO(arginfo_checkdate, 0)
@@ -3713,7 +3715,7 @@ static int php_date_timezone_initialize_from_hash(zval **return_value, php_timez
 	zval            **z_timezone_type = NULL;

 	if (zend_hash_find(myht, "timezone_type", 14, (void**) &z_timezone_type) == SUCCESS && Z_TYPE_PP(z_timezone_type) == IS_LONG) {
-		if (zend_hash_find(myht, "timezone", 9, (void**) &z_timezone) == SUCCESS) {
+		if (zend_hash_find(myht, "timezone", 9, (void**) &z_timezone) == SUCCESS && Z_TYPE_PP(z_timezone) == IS_STRING) {
 			if (SUCCESS == timezone_initialize(*tzobj, Z_STRVAL_PP(z_timezone) TSRMLS_CC)) {
 				return SUCCESS;
 			}
@@ -117,7 +117,15 @@ int cflags;
 							(NC-1)*sizeof(cat_t));
 	if (g == NULL)
 		return(REG_ESPACE);
-	p->ssize = len/(size_t)2*(size_t)3 + (size_t)1;	/* ugh */
+	{
+		/* Patched for CERT Vulnerability Note VU#695940, Feb 2015. */
+		size_t new_ssize = len/(size_t)2*(size_t)3 + (size_t)1; /* ugh */
+		if (new_ssize < len || new_ssize > LONG_MAX / sizeof(sop)) {
+			free((char *) g);
+			return REG_INVARG;
+		}
+		p->ssize = new_ssize;
+	}
 	p->strip = (sop *)malloc(p->ssize * sizeof(sop));
 	p->slen = 0;
 	if (p->strip == NULL) {
@@ -9,6 +9,7 @@ if (PHP_GD != "no") {
 	if (
 		CHECK_LIB("libjpeg_a.lib;libjpeg.lib", "gd", PHP_GD) &&
 		CHECK_LIB("freetype_a.lib;freetype.lib", "gd", PHP_GD) &&
+		CHECK_HEADER_ADD_INCLUDE("ft2build.h", "CFLAGS_GD", PHP_GD + ";" + PHP_PHP_BUILD + "\\include" + ";" + PHP_PHP_BUILD + "\\include\\freetype") &&
 		CHECK_LIB("libpng_a.lib;libpng.lib", "gd", PHP_GD) &&
 		CHECK_HEADER_ADD_INCLUDE("gd.h", "CFLAGS_GD", PHP_GD + ";ext\\gd\\libgd") &&
 		(CHECK_HEADER_ADD_INCLUDE("png.h", "CFLAGS_GD", PHP_GD +  ";" + PHP_PHP_BUILD + "\\include\\libpng15") ||
@@ -418,18 +418,14 @@ static void json_escape_string(smart_str *buf, char *s, int len, int options TSR
 		if ((type = is_numeric_string(s, len, &p, &d, 0)) != 0) {
 			if (type == IS_LONG) {
 				smart_str_append_long(buf, p);
-			} else if (type == IS_DOUBLE) {
-				if (!zend_isinf(d) && !zend_isnan(d)) {
-					char *tmp;
-					int l = spprintf(&tmp, 0, "%.*k", (int) EG(precision), d);
-					smart_str_appendl(buf, tmp, l);
-					efree(tmp);
-				} else {
-					JSON_G(error_code) = PHP_JSON_ERROR_INF_OR_NAN;
-					smart_str_appendc(buf, '0');
-				}
+				return;
+			} else if (type == IS_DOUBLE && !zend_isinf(d) && !zend_isnan(d)) {
+				char *tmp;
+				int l = spprintf(&tmp, 0, "%.*k", (int) EG(precision), d);
+				smart_str_appendl(buf, tmp, l);
+				efree(tmp);
+				return;
 			}
-			return;
 		}

 	}
@@ -0,0 +1,14 @@
+--TEST--
+Bug #64695 JSON_NUMERIC_CHECK has issues with strings that are numbers plus the letter e
+--SKIPIF--
+<?php if (!extension_loaded("json")) print "skip"; ?>
+--FILE--
+<?php
+$t = array('test' => '123343e871700');
+var_dump(json_encode($t, JSON_NUMERIC_CHECK));
+
+echo "Done\n";
+?>
+--EXPECT--
+string(24) "{"test":"123343e871700"}"
+Done
@@ -99,6 +99,11 @@ AC_DEFUN([PHP_ODBC_FIND_EMPRESS_BCS_LIBS],[
 dnl
 dnl configure options
 dnl
+
+PHP_ARG_WITH(odbcver,,
+[  --with-odbcver[=HEX]      Force support for the passed ODBC version. A hex number is expected, default 0x0300.
+                             Use the special value of 0 to prevent an explicit ODBCVER to be defined. ], 0x0300)
+
 if test -z "$ODBC_TYPE"; then
 PHP_ARG_WITH(adabas,,
 [  --with-adabas[=DIR]       Include Adabas D support [/usr/local]])
@@ -490,6 +495,15 @@ PHP_ARG_WITH(dbmaker,,
  fi
 fi

+if test "no" != "$PHP_ODBCVER"; then
+  if test "$PHP_ODBCVER" != "0"; then
+    AC_DEFINE_UNQUOTED(ODBCVER, $PHP_ODBCVER, [ The highest supported ODBC version ])
+  fi
+else
+  AC_DEFINE(ODBCVER, 0x300, [ The highest supported ODBC version ])
+fi
+
+
 dnl
 dnl Extension setup
 dnl
@@ -2,6 +2,7 @@
 // vim:ft=javascript

 ARG_ENABLE("odbc", "ODBC support", "yes");
+ARG_WITH("odbcver", "Force support for the passed ODBC version. A hex number is expected, default 0x0300. Use the special value of 0 to prevent an explicit ODBCVER to be defined.", "0x0300");

 if (PHP_ODBC == "yes") {
 	if (CHECK_LIB("odbc32.lib", "odbc") && CHECK_LIB("odbccp32.lib", "odbc")
@@ -9,8 +10,13 @@ if (PHP_ODBC == "yes") {
 	&& CHECK_HEADER_ADD_INCLUDE("sqlext.h", "CFLAGS_ODBC")) {
 		EXTENSION("odbc", "php_odbc.c");
 		AC_DEFINE("HAVE_UODBC", 1, "ODBC support");
+		if ("no" == PHP_ODBCVER) {
+			AC_DEFINE("ODBCVER", "0x0300", "The highest supported ODBC version", false);
+		} else if ("0" != PHP_ODBCVER) {
+			AC_DEFINE("ODBCVER", PHP_ODBCVER, "The highest supported ODBC version", false);
+		}
 	} else {
 		WARNING("odbc support can't be enabled, libraries or header are missing (SDK)")
 		PHP_ODBC = "no"
 	}
-}
+}
@@ -24,7 +24,6 @@
 #define PHP_ODBC_H

 #if HAVE_UODBC
-#define ODBCVER 0x0250

 #ifdef ZTS
 #include "TSRM.h"
@@ -25,12 +25,6 @@

 #if HAVE_UODBC

-#define ODBCVER 0x0250
-/*#ifndef MSVC5
-#define FAR
-#endif
-*/
-
 /* checking in the same order as in configure.in */

 #if defined(HAVE_SOLID) || defined(HAVE_SOLID_30) || defined(HAVE_SOLID_35) /* Solid Server */
@@ -241,6 +241,7 @@ static void update_op2_const(zend_op_array *op_array,
 			case ZEND_ISSET_ISEMPTY_DIM_OBJ:
 			case ZEND_ADD_ARRAY_ELEMENT:
 			case ZEND_INIT_ARRAY:
+			case ZEND_ASSIGN_DIM:
 			case ZEND_UNSET_DIM:
 			case ZEND_FETCH_DIM_R:
 			case ZEND_FETCH_DIM_W:
@@ -290,18 +291,47 @@ static void replace_tmp_by_const(zend_op_array *op_array,
 			 * and allows its reuse. The number of ZEND_CASE instructions
 			 * usually terminated by ZEND_FREE that finally kills the value.
 			 */
-			if (opline->opcode == ZEND_CASE) {
-				zval old_val;
-				old_val = *val;
-				zval_copy_ctor(val);
-				update_op1_const(op_array, opline, val TSRMLS_CC);
-				*val = old_val;
-			} else if (opline->opcode == ZEND_FREE) {
-				MAKE_NOP(opline);
+			if (opline->opcode == ZEND_CASE || opline->opcode == ZEND_FREE) {
+				zend_op *m, *n;
+				int brk = op_array->last_brk_cont;
+				zend_bool in_switch = 0;
+				while (brk--) {
+					if (op_array->brk_cont_array[brk].start <= (opline - op_array->opcodes) &&
+							op_array->brk_cont_array[brk].brk > (opline - op_array->opcodes)) {
+						in_switch = 1;
+						break;
+					}
+				}
+
+				if (!in_switch) {
+					MAKE_NOP(opline);
+					zval_dtor(val);
+					break;
+				}
+
+				m = opline;
+				n = op_array->opcodes + op_array->brk_cont_array[brk].brk + 1;
+				while (m < n) {
+					if (ZEND_OP1_TYPE(m) == IS_TMP_VAR &&
+							ZEND_OP1(m).var == var) {
+						if (m->opcode == ZEND_CASE) {
+							zval old_val;
+							old_val = *val;
+							zval_copy_ctor(val);
+							update_op1_const(op_array, m, val TSRMLS_CC);
+							*val = old_val;
+						} else if (m->opcode == ZEND_FREE) {
+							MAKE_NOP(m);
+						} else {
+							ZEND_ASSERT(0);
+						}
+					}
+					m++;
+				}
+				zval_dtor(val);
 				break;
 			} else {				
 				update_op1_const(op_array, opline, val TSRMLS_CC);
-				val = NULL;
 				break;
 			}
 		}
@@ -311,14 +341,10 @@ static void replace_tmp_by_const(zend_op_array *op_array,

 			update_op2_const(op_array, opline, val TSRMLS_CC);
 			/* TMP_VAR may be used only once */
-			val = NULL;
 			break;
 		}
 		opline++;
 	}
-	if (val) {
-		zval_dtor(val);
-	}
 }

 #include "Optimizer/nop_removal.c"
@@ -573,7 +573,7 @@ static inline void kill_all_lockers(struct flock *mem_usage_check)
 	ZCSG(force_restart_time) = 0;
 	while (mem_usage_check->l_pid > 0) {
 		while (tries--) {
-			zend_accel_error(ACCEL_LOG_INFO, "Killed locker %d", mem_usage_check->l_pid);
+			zend_accel_error(ACCEL_LOG_ERROR, "Killed locker %d", mem_usage_check->l_pid);
 			if (kill(mem_usage_check->l_pid, SIGKILL)) {
 				break;
 			}
@@ -586,7 +586,7 @@ static inline void kill_all_lockers(struct flock *mem_usage_check)
 			usleep(10000);
 		}
 		if (!tries) {
-			zend_accel_error(ACCEL_LOG_INFO, "Can't kill %d after 20 tries!", mem_usage_check->l_pid);
+			zend_accel_error(ACCEL_LOG_ERROR, "Can't kill %d after 20 tries!", mem_usage_check->l_pid);
 			ZCSG(force_restart_time) = time(NULL); /* restore forced restart request */
 		}

@@ -0,0 +1,55 @@
+--TEST--
+Bug #69038 (switch(SOMECONSTANT) misbehaves)
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.optimization_level=-1
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+function a($a = "bad") {
+	
+	switch (PHP_OS) {
+	case "LALALALA" : return "LALALAL";
+	case PHP_OS: return "okey";
+	default:   break;
+	}
+
+	return $a;
+}
+
+var_dump(a());
+
+
+function b($b = "bad") {
+	switch (PHP_OS) {
+	case "LALALAL": return "bad";
+	case PHP_OS:
+		switch (PHP_OS) {
+		case "FOO": break;
+		case PHP_OS: return "okey";
+		default :
+			break;
+		}
+		break;
+	default:
+		break;
+	}
+	return $b;
+}
+var_dump(b());
+
+function c() {
+	switch (PHP_OS) {
+		default: return "bad";
+		case PHP_OS: return "okey";
+	}
+}
+
+var_dump(c());
+?>
+--EXPECT--
+string(4) "okey"
+string(4) "okey"
+string(4) "okey"
@@ -0,0 +1,22 @@
+--TEST--
+Bug #69125 (Array numeric string as key)
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+
+const SZERO = '0';
+const SONE = '1';
+
+$array[SZERO] = "okey";
+$array[1] = "okey";
+
+var_dump($array[SZERO]);
+var_dump($array[SONE]);
+?>
+--EXPECT--
+string(4) "okey"
+string(4) "okey"
@@ -775,7 +775,7 @@ static ZEND_FUNCTION(opcache_compile_file)
 		op_array = persistent_compile_file(&handle, ZEND_INCLUDE TSRMLS_CC);
 	} zend_catch {
 		EG(current_execute_data) = orig_execute_data;
-		zend_error(E_WARNING, ACCELERATOR_PRODUCT_NAME " could not compile file %s" TSRMLS_CC, handle.filename);
+		zend_error(E_WARNING, ACCELERATOR_PRODUCT_NAME " could not compile file %s", handle.filename);
 	} zend_end_try();

 	if(op_array != NULL) {
@@ -91,7 +91,7 @@ typedef struct _handler_entry {

 typedef struct _zend_shared_memory_state {
 	int *positions;   /* current positions for each segment */
-	int  shared_free; /* amount of free shared memory */
+	size_t shared_free; /* amount of free shared memory */
 } zend_shared_memory_state;

 typedef struct _zend_smm_shared_globals {
@@ -40,6 +40,9 @@
 int php_openssl_apply_verification_policy(SSL *ssl, X509 *peer, php_stream *stream TSRMLS_DC);
 SSL *php_SSL_new_from_context(SSL_CTX *ctx, php_stream *stream TSRMLS_DC);
 int php_openssl_get_x509_list_id(void);
+static struct timeval subtract_timeval( struct timeval a, struct timeval b );
+static int compare_timeval( struct timeval a, struct timeval b );
+static size_t php_openssl_sockop_io(int read, php_stream *stream, char *buf, size_t count TSRMLS_DC);

 /* This implementation is very closely tied to the that of the native
 * sockets implemented in the core.
@@ -171,69 +174,159 @@ static int handle_ssl_error(php_stream *stream, int nr_bytes, zend_bool is_init
 	return retry;
 }

+static size_t php_openssl_sockop_read(php_stream *stream, char *buf, size_t count TSRMLS_DC)
+{
+	return php_openssl_sockop_io(1, stream, buf, count TSRMLS_CC);
+}

 static size_t php_openssl_sockop_write(php_stream *stream, const char *buf, size_t count TSRMLS_DC)
 {
-	php_openssl_netstream_data_t *sslsock = (php_openssl_netstream_data_t*)stream->abstract;
-	int didwrite;
-	
-	if (sslsock->ssl_active) {
-		int retry = 1;
-
-		do {
-			didwrite = SSL_write(sslsock->ssl_handle, buf, count);
-
-			if (didwrite <= 0) {
-				retry = handle_ssl_error(stream, didwrite, 0 TSRMLS_CC);
-			} else {
-				break;
-			}
-		} while(retry);
-
-		if (didwrite > 0) {
-			php_stream_notify_progress_increment(stream->context, didwrite, 0);
-		}
-	} else {
-		didwrite = php_stream_socket_ops.write(stream, buf, count TSRMLS_CC);
-	}
-
-	if (didwrite < 0) {
-		didwrite = 0;
-	}
-	
-	return didwrite;
+	return php_openssl_sockop_io(0, stream, (char*)buf, count TSRMLS_CC);
 }

-static size_t php_openssl_sockop_read(php_stream *stream, char *buf, size_t count TSRMLS_DC)
+/**
+ * Factored out common functionality (blocking, timeout, loop management) for read and write.
+ * Perform IO (read or write) to an SSL socket. If we have a timeout, we switch to non-blocking mode
+ * for the duration of the operation, using select to do our waits. If we time out, or we have an error
+ * report that back to PHP
+ *
+ */
+static size_t php_openssl_sockop_io(int read, php_stream *stream, char *buf, size_t count TSRMLS_DC)
 {
 	php_openssl_netstream_data_t *sslsock = (php_openssl_netstream_data_t*)stream->abstract;
 	int nr_bytes = 0;
-
+	
+	/* Only do this if SSL is active. */
 	if (sslsock->ssl_active) {
 		int retry = 1;
+		struct timeval start_time;
+		struct timeval *timeout;
+		int blocked = sslsock->s.is_blocked;
+		int has_timeout = 0;

+		/* Begin by making the socket non-blocking. This allows us to check the timeout. */
+		if (SUCCESS == php_set_sock_blocking(sslsock->s.socket, 0 TSRMLS_CC)) {
+			sslsock->s.is_blocked = 0;
+		}
+
+		/* Get the timeout value (and make sure we are to check it. */
+		timeout = sslsock->is_client ? &sslsock->connect_timeout : &sslsock->s.timeout;
+		has_timeout = !sslsock->s.is_blocked && (timeout->tv_sec || timeout->tv_usec);
+
+		/* gettimeofday is not monotonic; using it here is not strictly correct */
+		if (has_timeout) {
+			gettimeofday(&start_time, NULL);
+		}
+
+		/* Main IO loop. */
 		do {
-			nr_bytes = SSL_read(sslsock->ssl_handle, buf, count);
+			struct timeval cur_time, elapsed_time, left_time;
+	
+			/* If we have a timeout to check, figure out how much time has elapsed since we started. */
+			if (has_timeout) {
+				gettimeofday(&cur_time, NULL);

-			if (nr_bytes <= 0) {
-				retry = handle_ssl_error(stream, nr_bytes, 0 TSRMLS_CC);
-				stream->eof = (retry == 0 && errno != EAGAIN && !SSL_pending(sslsock->ssl_handle));
-				
-			} else {
-				/* we got the data */
-				break;
+				/* Determine how much time we've taken so far. */
+				elapsed_time = subtract_timeval( cur_time, start_time );
+
+				/* and return an error if we've taken too long. */
+				if (compare_timeval( elapsed_time, *timeout) > 0 ) {
+					/* If the socket was originally blocking, set it back. */
+					if (blocked) {
+						php_set_sock_blocking(sslsock->s.socket, 1 TSRMLS_CC);
+						sslsock->s.is_blocked = 1;
+					}
+					return -1;
+				}
 			}
+
+			/* Now, do the IO operation. Don't block if we can't complete... */
+			if (read) {
+				nr_bytes = SSL_read(sslsock->ssl_handle, buf, count);
+			} else {
+				nr_bytes = SSL_write(sslsock->ssl_handle, buf, count);
+			}
+
+			/* Now, how much time until we time out? */
+			if (has_timeout) {
+				left_time = subtract_timeval( *timeout, elapsed_time );
+			}
+
+			/* If we didn't do anything on the last loop (or an error) check to see if we should retry or exit. */
+			if (nr_bytes <= 0) {
+
+				/* Get the error code from SSL, and check to see if it's an error or not. */
+				int err = SSL_get_error(sslsock->ssl_handle, nr_bytes );
+				retry = handle_ssl_error(stream, nr_bytes, 0 TSRMLS_CC);
+
+				/* If we get this (the above doesn't check) then we'll retry as well. */
+				if (errno == EAGAIN && err == SSL_ERROR_WANT_READ && read) {
+					retry = 1;
+				}
+				if (errno == EAGAIN && err == SSL_ERROR_WANT_WRITE && read == 0) {
+					retry = 1;
+				}
+
+				/* Also, on reads, we may get this condition on an EOF. We should check properly. */
+				if (read) {
+				stream->eof = (retry == 0 && errno != EAGAIN && !SSL_pending(sslsock->ssl_handle));
+				}
+				
+				/* Now, if we have to wait some time, and we're supposed to be blocking, wait for the socket to become
+				 * available. Now, php_pollfd_for uses select to wait up to our time_left value only...
+				 */
+				if (retry && blocked) {
+					if (read) {
+						php_pollfd_for(sslsock->s.socket, (err == SSL_ERROR_WANT_WRITE) ?
+							(POLLOUT|POLLPRI) : (POLLIN|POLLPRI), has_timeout ? &left_time : NULL);
+					} else {
+						php_pollfd_for(sslsock->s.socket, (err == SSL_ERROR_WANT_READ) ?
+							(POLLIN|POLLPRI) : (POLLOUT|POLLPRI), has_timeout ? &left_time : NULL);
+					}
+				}
+			} else {
+				/* Else, if we got bytes back, check for possible errors. */
+				int err = SSL_get_error(sslsock->ssl_handle, nr_bytes );
+
+				/* If we didn't get any error, then let's return it to PHP. */
+				if (err == SSL_ERROR_NONE) {
+					break;
+				}
+
+				/* Otherwise, we need to wait again (up to time_left or we get an error) */
+				if (blocked) {
+					if (read) {
+						php_pollfd_for(sslsock->s.socket, (err == SSL_ERROR_WANT_WRITE) ?
+							(POLLOUT|POLLPRI) : (POLLIN|POLLPRI), has_timeout ? &left_time : NULL);
+					} else {
+						php_pollfd_for(sslsock->s.socket, (err == SSL_ERROR_WANT_READ) ?
+							(POLLIN|POLLPRI) : (POLLOUT|POLLPRI), has_timeout ? &left_time : NULL);
+					}
+				}
+			}
+		/* Finally, we keep going until we got data, and an SSL_ERROR_NONE, unless we had an error. */
 		} while (retry);

+		/* Tell PHP if we read / wrote bytes. */
 		if (nr_bytes > 0) {
 			php_stream_notify_progress_increment(stream->context, nr_bytes, 0);
 		}
-	}
-	else
-	{
-		nr_bytes = php_stream_socket_ops.read(stream, buf, count TSRMLS_CC);
+
+		/* And if we were originally supposed to be blocking, let's reset the socket to that. */
+		if (blocked) {
+			php_set_sock_blocking(sslsock->s.socket, 1 TSRMLS_CC);
+			sslsock->s.is_blocked = 1;
+		}
+	} else {
+		/* This block is if we had no timeout... We will just sit and wait forever on the IO operation. */
+		if (read) {
+			nr_bytes = php_stream_socket_ops.read(stream, buf, count TSRMLS_CC);
+		} else {
+			nr_bytes = php_stream_socket_ops.write(stream, buf, count TSRMLS_CC);
+		}
 	}

+	/* PHP doesn't expect a negative return. */
 	if (nr_bytes < 0) {
 		nr_bytes = 0;
 	}
@@ -241,6 +334,31 @@ static size_t php_openssl_sockop_read(php_stream *stream, char *buf, size_t coun
 	return nr_bytes;
 }

+struct timeval subtract_timeval( struct timeval a, struct timeval b )
+{
+	struct timeval difference;
+
+	difference.tv_sec  = a.tv_sec  - b.tv_sec;
+	difference.tv_usec = a.tv_usec - b.tv_usec;
+
+	if (a.tv_usec < b.tv_usec) {
+	  	b.tv_sec  -= 1L;
+	   	b.tv_usec += 1000000L;
+	}
+
+	return difference;
+}
+
+int compare_timeval( struct timeval a, struct timeval b )
+{
+	if (a.tv_sec > b.tv_sec || (a.tv_sec == b.tv_sec && a.tv_usec > b.tv_usec) ) {
+		return 1;
+	} else if( a.tv_sec == b.tv_sec && a.tv_usec == b.tv_usec ) {
+		return 0;
+	} else {
+		return -1;
+	}
+}

 static int php_openssl_sockop_close(php_stream *stream, int close_handle TSRMLS_DC)
 {
@@ -492,16 +610,9 @@ static inline int php_openssl_enable_crypto(php_stream *stream,

 			if (has_timeout) {
 				gettimeofday(&cur_time, NULL);
-				elapsed_time.tv_sec  = cur_time.tv_sec  - start_time.tv_sec;
-				elapsed_time.tv_usec = cur_time.tv_usec - start_time.tv_usec;
-				if (cur_time.tv_usec < start_time.tv_usec) {
-					elapsed_time.tv_sec  -= 1L;
-					elapsed_time.tv_usec += 1000000L;
-				}
+				elapsed_time = subtract_timeval( cur_time, start_time );
 			
-				if (elapsed_time.tv_sec > timeout->tv_sec ||
-						(elapsed_time.tv_sec == timeout->tv_sec &&
-						elapsed_time.tv_usec > timeout->tv_usec)) {
+				if (compare_timeval( elapsed_time, *timeout) > 0) {
 					php_error_docref(NULL TSRMLS_CC, E_WARNING, "SSL: crypto enabling timeout");
 					return -1;
 				}
@@ -517,12 +628,7 @@ static inline int php_openssl_enable_crypto(php_stream *stream,
 					struct timeval left_time;
 					
 					if (has_timeout) {
-						left_time.tv_sec  = timeout->tv_sec  - elapsed_time.tv_sec;
-						left_time.tv_usec =	timeout->tv_usec - elapsed_time.tv_usec;
-						if (timeout->tv_usec < elapsed_time.tv_usec) {
-							left_time.tv_sec  -= 1L;
-							left_time.tv_usec += 1000000L;
-						}
+						left_time = subtract_timeval( *timeout, elapsed_time );
 					}
 					php_pollfd_for(sslsock->s.socket, (err == SSL_ERROR_WANT_READ) ?
 						(POLLIN|POLLPRI) : POLLOUT, has_timeout ? &left_time : NULL);
@@ -5357,9 +5357,6 @@ static int php_pgsql_convert_match(const char *str, size_t str_len, const char *

 	regerr = regexec(&re, str, re.re_nsub+1, subs, 0);
 	if (regerr == REG_NOMATCH) {
-#ifdef PHP_DEBUG
-		php_error_docref(NULL TSRMLS_CC, E_NOTICE, "'%s' does not match with '%s'", str, regex);
-#endif
 		ret = FAILURE;
 	}
 	else if (regerr) {
@@ -5608,7 +5605,12 @@ PHP_PGSQL_API int php_pgsql_convert(PGconn *pg_link, const char *table_name, con
 						else {
 							/* FIXME: better regex must be used */
 							if (php_pgsql_convert_match(Z_STRVAL_PP(val), Z_STRLEN_PP(val), "^([+-]{0,1}[0-9]+)|([+-]{0,1}[0-9]*[\\.][0-9]+)|([+-]{0,1}[0-9]+[\\.][0-9]*)$", 0 TSRMLS_CC) == FAILURE) {
-								err = 1;
+								if (php_pgsql_convert_match(Z_STRVAL_PP(val), Z_STRLEN_PP(val), "^[+-]{0,1}(inf)(inity){0,1}$", 1 TSRMLS_CC) == FAILURE) {
+									err = 1;
+								} else {
+									ZVAL_STRING(new_val, Z_STRVAL_PP(val), 1);
+									php_pgsql_add_quotes(new_val, 1 TSRMLS_CC);
+								}
 							}
 							else {
 								ZVAL_STRING(new_val, Z_STRVAL_PP(val), 1);
@@ -0,0 +1,53 @@
+--TEST--
+Bug #68638 pg_update() fails to store infinite values
+--SKIPIF--
+<?php include("skipif.inc"); ?>
+--FILE--
+<?php
+
+include('config.inc');
+
+$conn = pg_connect($conn_str);
+
+$table='test_68638';
+
+pg_query("CREATE TABLE $table (id INT, value FLOAT)");
+
+pg_insert($conn,$table, array('id' => 1, 'value' => 1.2));
+pg_insert($conn,$table, array('id' => 2, 'value' => 10));
+pg_insert($conn,$table, array('id' => 3, 'value' => 15));
+
+var_dump(pg_update($conn,$table, array('value' => 'inf'), array('id' => 1), PGSQL_DML_STRING));
+
+pg_update($conn,$table, array('value' => 'inf'), array('id' => 1));
+pg_update($conn,$table, array('value' => '-inf'), array('id' => 2));
+pg_update($conn,$table, array('value' => '+inf'), array('id' => 3));
+
+$rs = pg_query("SELECT * FROM $table");
+while ($row = pg_fetch_assoc($rs)) {
+        var_dump($row);
+}
+
+pg_query("DROP TABLE $table");
+
+?>
+--EXPECT--
+string(52) "UPDATE "test_68638" SET "value"=E'inf' WHERE "id"=1;"
+array(2) {
+  ["id"]=>
+  string(1) "1"
+  ["value"]=>
+  string(8) "Infinity"
+}
+array(2) {
+  ["id"]=>
+  string(1) "2"
+  ["value"]=>
+  string(9) "-Infinity"
+}
+array(2) {
+  ["id"]=>
+  string(1) "3"
+  ["value"]=>
+  string(8) "Infinity"
+}
@@ -400,12 +400,13 @@ PHP_FUNCTION(readline_read_history)
 		return;
 	}

-	if (php_check_open_basedir(arg TSRMLS_CC)) {
+	if (arg && php_check_open_basedir(arg TSRMLS_CC)) {
 		RETURN_FALSE;
 	}

 	/* XXX from & to NYI */
 	if (read_history(arg)) {
+		/* If filename is NULL, then read from `~/.history' */
 		RETURN_FALSE;
 	} else {
 		RETURN_TRUE;
@@ -424,7 +425,7 @@ PHP_FUNCTION(readline_write_history)
 		return;
 	}

-	if (php_check_open_basedir(arg TSRMLS_CC)) {
+	if (arg && php_check_open_basedir(arg TSRMLS_CC)) {
 		RETURN_FALSE;
 	}

@@ -0,0 +1,11 @@
+--TEST--
+Bug #69054 (Null dereference in readline_(read|write)_history() without parameters)
+--SKIPIF--
+<?php if (!extension_loaded("readline") || !function_exists('readline_add_history')) die("skip"); ?>
+--INI--
+open_basedir=/tmp
+--FILE--
+<?php readline_read_history(); ?>
+==DONE==
+--EXPECT--
+==DONE==
@@ -404,12 +404,15 @@ static xmlNodePtr master_to_xml_int(encodePtr encode, zval *data, int style, xml
 		encodePtr enc = NULL;
 		HashTable *ht = Z_OBJPROP_P(data);

-		if (zend_hash_find(ht, "enc_type", sizeof("enc_type"), (void **)&ztype) == FAILURE) {
+		if (zend_hash_find(ht, "enc_type", sizeof("enc_type"), (void **)&ztype) == FAILURE ||
+		    Z_TYPE_PP(ztype) != IS_LONG) {
 			soap_error0(E_ERROR, "Encoding: SoapVar has no 'enc_type' property");
 		}

-		if (zend_hash_find(ht, "enc_stype", sizeof("enc_stype"), (void **)&zstype) == SUCCESS) {
-			if (zend_hash_find(ht, "enc_ns", sizeof("enc_ns"), (void **)&zns) == SUCCESS) {
+		if (zend_hash_find(ht, "enc_stype", sizeof("enc_stype"), (void **)&zstype) == SUCCESS &&
+		    Z_TYPE_PP(zstype) == IS_STRING) {
+			if (zend_hash_find(ht, "enc_ns", sizeof("enc_ns"), (void **)&zns) == SUCCESS &&
+			    Z_TYPE_PP(zns) == IS_STRING) {
 				enc = get_encoder(SOAP_GLOBAL(sdl), Z_STRVAL_PP(zns), Z_STRVAL_PP(zstype));
 			} else {
 				zns = NULL;
@@ -445,8 +448,10 @@ static xmlNodePtr master_to_xml_int(encodePtr encode, zval *data, int style, xml
 		}

 		if (style == SOAP_ENCODED || (SOAP_GLOBAL(sdl) && encode != enc)) {
-			if (zend_hash_find(ht, "enc_stype", sizeof("enc_stype"), (void **)&zstype) == SUCCESS) {
-				if (zend_hash_find(ht, "enc_ns", sizeof("enc_ns"), (void **)&zns) == SUCCESS) {
+			if (zend_hash_find(ht, "enc_stype", sizeof("enc_stype"), (void **)&zstype) == SUCCESS &&
+			    Z_TYPE_PP(zstype) == IS_STRING) {
+				if (zend_hash_find(ht, "enc_ns", sizeof("enc_ns"), (void **)&zns) == SUCCESS &&
+				    Z_TYPE_PP(zns) == IS_STRING) {
 					set_ns_and_type_ex(node, Z_STRVAL_PP(zns), Z_STRVAL_PP(zstype));
 				} else {
 					set_ns_and_type_ex(node, NULL, Z_STRVAL_PP(zstype));
@@ -454,10 +459,12 @@ static xmlNodePtr master_to_xml_int(encodePtr encode, zval *data, int style, xml
 			}
 		}

-		if (zend_hash_find(ht, "enc_name", sizeof("enc_name"), (void **)&zname) == SUCCESS) {
+		if (zend_hash_find(ht, "enc_name", sizeof("enc_name"), (void **)&zname) == SUCCESS &&
+		    Z_TYPE_PP(zname) == IS_STRING) {
 			xmlNodeSetName(node, BAD_CAST(Z_STRVAL_PP(zname)));
 		}
-		if (zend_hash_find(ht, "enc_namens", sizeof("enc_namens"), (void **)&znamens) == SUCCESS) {
+		if (zend_hash_find(ht, "enc_namens", sizeof("enc_namens"), (void **)&znamens) == SUCCESS &&
+		    Z_TYPE_PP(zname) == IS_STRING) {
 			xmlNsPtr nsp = encode_add_ns(node, Z_STRVAL_PP(znamens));
 			xmlSetNs(node, nsp);
 		}
@@ -3640,18 +3647,21 @@ static encodePtr get_array_type(xmlNodePtr node, zval *array, smart_str *type TS
 		    Z_OBJCE_PP(tmp) == soap_var_class_entry) {
 			zval **ztype;

-			if (zend_hash_find(Z_OBJPROP_PP(tmp), "enc_type", sizeof("enc_type"), (void **)&ztype) == FAILURE) {
+			if (zend_hash_find(Z_OBJPROP_PP(tmp), "enc_type", sizeof("enc_type"), (void **)&ztype) == FAILURE ||
+			    Z_TYPE_PP(ztype) != IS_LONG) {
 				soap_error0(E_ERROR,  "Encoding: SoapVar has no 'enc_type' property");
 			}
 			cur_type = Z_LVAL_PP(ztype);

-			if (zend_hash_find(Z_OBJPROP_PP(tmp), "enc_stype", sizeof("enc_stype"), (void **)&ztype) == SUCCESS) {
+			if (zend_hash_find(Z_OBJPROP_PP(tmp), "enc_stype", sizeof("enc_stype"), (void **)&ztype) == SUCCESS &&
+			    Z_TYPE_PP(ztype) == IS_STRING) {
 				cur_stype = Z_STRVAL_PP(ztype);
 			} else {
 				cur_stype = NULL;
 			}

-			if (zend_hash_find(Z_OBJPROP_PP(tmp), "enc_ns", sizeof("enc_ns"), (void **)&ztype) == SUCCESS) {
+			if (zend_hash_find(Z_OBJPROP_PP(tmp), "enc_ns", sizeof("enc_ns"), (void **)&ztype) == SUCCESS &&
+			    Z_TYPE_PP(ztype) == IS_STRING) {
 				cur_ns = Z_STRVAL_PP(ztype);
 			} else {
 				cur_ns = NULL;
@@ -36,14 +36,16 @@ int proxy_authentication(zval* this_ptr, smart_str* soap_headers TSRMLS_DC)
 {
 	zval **login, **password;

-	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_proxy_login", sizeof("_proxy_login"), (void **)&login) == SUCCESS) {
+	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_proxy_login", sizeof("_proxy_login"), (void **)&login) == SUCCESS &&
+	    Z_TYPE_PP(login) == IS_STRING) {
 		unsigned char* buf;
 		int len;
 		smart_str auth = {0};

 		smart_str_appendl(&auth, Z_STRVAL_PP(login), Z_STRLEN_PP(login));
 		smart_str_appendc(&auth, ':');
-		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_proxy_password", sizeof("_proxy_password"), (void **)&password) == SUCCESS) {
+		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_proxy_password", sizeof("_proxy_password"), (void **)&password) == SUCCESS &&
+		    Z_TYPE_PP(password) == IS_STRING) {
 			smart_str_appendl(&auth, Z_STRVAL_PP(password), Z_STRLEN_PP(password));
 		}
 		smart_str_0(&auth);
@@ -64,14 +66,16 @@ int basic_authentication(zval* this_ptr, smart_str* soap_headers TSRMLS_DC)
 	zval **login, **password;

 	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_login", sizeof("_login"), (void **)&login) == SUCCESS &&
-			!zend_hash_exists(Z_OBJPROP_P(this_ptr), "_digest", sizeof("_digest"))) {
+	    Z_TYPE_PP(login) == IS_STRING &&
+	    !zend_hash_exists(Z_OBJPROP_P(this_ptr), "_digest", sizeof("_digest"))) {
 		unsigned char* buf;
 		int len;
 		smart_str auth = {0};

 		smart_str_appendl(&auth, Z_STRVAL_PP(login), Z_STRLEN_PP(login));
 		smart_str_appendc(&auth, ':');
-		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_password", sizeof("_password"), (void **)&password) == SUCCESS) {
+		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_password", sizeof("_password"), (void **)&password) == SUCCESS &&
+		    Z_TYPE_PP(password) == IS_STRING) {
 			smart_str_appendl(&auth, Z_STRVAL_PP(password), Z_STRLEN_PP(password));
 		}
 		smart_str_0(&auth);
@@ -571,6 +575,7 @@ try_again:
 		}
 		if (!http_1_1 ||
 			(zend_hash_find(Z_OBJPROP_P(this_ptr), "_keep_alive", sizeof("_keep_alive"), (void **)&tmp) == SUCCESS &&
+			 (Z_TYPE_PP(tmp) == IS_BOOL || Z_TYPE_PP(tmp) == IS_LONG) &&
 			 Z_LVAL_PP(tmp) == 0)) {
 			smart_str_append_const(&soap_headers, "\r\n"
 				"Connection: close\r\n");
@@ -804,7 +809,8 @@ try_again:
 		}

 		/* Send cookies along with request */
-		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_cookies", sizeof("_cookies"), (void **)&cookies) == SUCCESS) {
+		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_cookies", sizeof("_cookies"), (void **)&cookies) == SUCCESS &&
+		    Z_TYPE_PP(cookies) == IS_ARRAY) {
 			zval **data;
 			char *key;
 			int i, n;
@@ -847,7 +853,7 @@ try_again:
 		smart_str_append_const(&soap_headers, "\r\n");
 		smart_str_0(&soap_headers);
 		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "trace", sizeof("trace"), (void **) &trace) == SUCCESS &&
-		    Z_LVAL_PP(trace) > 0) {
+		    (Z_TYPE_PP(trace) == IS_BOOL || Z_TYPE_PP(trace) == IS_LONG) && Z_LVAL_PP(trace) != 0) {
 			add_property_stringl(this_ptr, "__last_request_headers", soap_headers.c, soap_headers.len, 1);
 		}
 		smart_str_appendl(&soap_headers, request, request_size);
@@ -892,7 +898,7 @@ try_again:
 		}

 		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "trace", sizeof("trace"), (void **) &trace) == SUCCESS &&
-		    Z_LVAL_PP(trace) > 0) {
+		    (Z_TYPE_PP(trace) == IS_BOOL || Z_TYPE_PP(trace) == IS_LONG) && Z_LVAL_PP(trace) != 0) {
 			add_property_stringl(this_ptr, "__last_response_headers", http_headers, http_header_size, 1);
 		}

@@ -941,7 +947,8 @@ try_again:
 		char *eqpos, *sempos;
 		zval **cookies;

-		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_cookies", sizeof("_cookies"), (void **)&cookies) == FAILURE) {
+		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_cookies", sizeof("_cookies"), (void **)&cookies) == FAILURE ||
+		    Z_TYPE_PP(cookies) != IS_ARRAY) {
 			zval *tmp_cookies;
 			MAKE_STD_ZVAL(tmp_cookies);
 			array_init(tmp_cookies);
@@ -100,6 +100,9 @@ xmlDocPtr soap_xmlParseFile(const char *filename TSRMLS_DC)
 		ctxt->sax->warning = NULL;
 		ctxt->sax->error = NULL;
 		/*ctxt->sax->fatalError = NULL;*/
+#if LIBXML_VERSION >= 20703
+		ctxt->options |= XML_PARSE_HUGE;
+#endif
 		old = php_libxml_disable_entity_loader(1 TSRMLS_CC);
 		xmlParseDocument(ctxt);
 		php_libxml_disable_entity_loader(old TSRMLS_CC);
@@ -2071,8 +2071,7 @@ static void soap_server_fault_ex(sdlFunctionPtr function, zval* fault, soapHeade

 	xmlDocDumpMemory(doc_return, &buf, &size);

-	zend_is_auto_global("_SERVER", sizeof("_SERVER") - 1 TSRMLS_CC);
-	if (PG(http_globals)[TRACK_VARS_SERVER] &&
+	if ((PG(http_globals)[TRACK_VARS_SERVER] || zend_is_auto_global("_SERVER", sizeof("_SERVER") - 1 TSRMLS_CC)) &&
 		zend_hash_find(PG(http_globals)[TRACK_VARS_SERVER]->value.ht, "HTTP_USER_AGENT", sizeof("HTTP_USER_AGENT"), (void **) &agent_name) == SUCCESS &&
 		Z_TYPE_PP(agent_name) == IS_STRING) {
 		if (strncmp(Z_STRVAL_PP(agent_name), "Shockwave Flash", sizeof("Shockwave Flash")-1) == 0) {
@@ -2565,7 +2564,7 @@ static int do_request(zval *this_ptr, xmlDoc *request, char *location, char *act
 	}

 	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "trace", sizeof("trace"), (void **) &trace) == SUCCESS &&
-	    Z_LVAL_PP(trace) > 0) {
+	    (Z_LVAL_PP(trace) == IS_BOOL || Z_LVAL_PP(trace) == IS_LONG) && Z_LVAL_PP(trace) != 0) {
 		add_property_stringl(this_ptr, "__last_request", buf, buf_size, 1);
 	}

@@ -2600,7 +2599,7 @@ static int do_request(zval *this_ptr, xmlDoc *request, char *location, char *act
 		}
 		ret = FALSE;
 	} else if (zend_hash_find(Z_OBJPROP_P(this_ptr), "trace", sizeof("trace"), (void **) &trace) == SUCCESS &&
-	    Z_LVAL_PP(trace) > 0) {
+	           (Z_LVAL_PP(trace) == IS_BOOL || Z_LVAL_PP(trace) == IS_LONG) && Z_LVAL_PP(trace) != 0) {
 		add_property_stringl(this_ptr, "__last_response", Z_STRVAL_P(response), Z_STRLEN_P(response), 1);
 	}
 	zval_ptr_dtor(&params[4]);
@@ -2644,13 +2643,13 @@ static void do_soap_call(zval* this_ptr,

 	SOAP_CLIENT_BEGIN_CODE();

-	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "trace", sizeof("trace"), (void **) &trace) == SUCCESS
-		&& Z_LVAL_PP(trace) > 0) {
+	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "trace", sizeof("trace"), (void **) &trace) == SUCCESS &&
+	    (Z_LVAL_PP(trace) == IS_BOOL || Z_LVAL_PP(trace) == IS_LONG) && Z_LVAL_PP(trace) != 0) {
 		zend_hash_del(Z_OBJPROP_P(this_ptr), "__last_request", sizeof("__last_request"));
 		zend_hash_del(Z_OBJPROP_P(this_ptr), "__last_response", sizeof("__last_response"));
 	}
-	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_soap_version", sizeof("_soap_version"), (void **) &tmp) == SUCCESS
-		&& Z_LVAL_PP(tmp) == SOAP_1_2) {
+	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_soap_version", sizeof("_soap_version"), (void **) &tmp) == SUCCESS &&
+		Z_TYPE_PP(tmp) == IS_LONG && Z_LVAL_PP(tmp) == SOAP_1_2) {
 		soap_version = SOAP_1_2;
 	} else {
 		soap_version = SOAP_1_1;
@@ -2747,7 +2746,7 @@ static void do_soap_call(zval* this_ptr,
 			zval **uri;
 			smart_str action = {0};

-			if (zend_hash_find(Z_OBJPROP_P(this_ptr), "uri", sizeof("uri"), (void *)&uri) == FAILURE) {
+			if (zend_hash_find(Z_OBJPROP_P(this_ptr), "uri", sizeof("uri"), (void *)&uri) == FAILURE || Z_TYPE_PP(uri) != IS_STRING) {
 				add_soap_fault(this_ptr, "Client", "Error finding \"uri\" property", NULL, NULL TSRMLS_CC);
 			} else if (location == NULL) {
 				add_soap_fault(this_ptr, "Client", "Error could not find \"location\" property", NULL, NULL TSRMLS_CC);
@@ -2905,7 +2904,7 @@ PHP_METHOD(SoapClient, __call)
 	}

 	/* Add default headers */
-	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__default_headers", sizeof("__default_headers"), (void **) &tmp)==SUCCESS) {
+	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__default_headers", sizeof("__default_headers"), (void **) &tmp) == SUCCESS && Z_TYPE_PP(tmp) == IS_ARRAY) {
 		HashTable *default_headers = Z_ARRVAL_P(*tmp);
 		if (soap_headers) {
 			if (!free_soap_headers) {
@@ -3026,7 +3025,8 @@ PHP_METHOD(SoapClient, __getLastRequest)
 		return;
 	}

-	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__last_request", sizeof("__last_request"), (void **)&tmp) == SUCCESS) {
+	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__last_request", sizeof("__last_request"), (void **)&tmp) == SUCCESS &&
+	    Z_TYPE_PP(tmp) == IS_STRING) {
 		RETURN_STRINGL(Z_STRVAL_PP(tmp), Z_STRLEN_PP(tmp), 1);
 	}
 	RETURN_NULL();
@@ -3044,7 +3044,8 @@ PHP_METHOD(SoapClient, __getLastResponse)
 		return;
 	}
 	
-	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__last_response", sizeof("__last_response"), (void **)&tmp) == SUCCESS) {
+	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__last_response", sizeof("__last_response"), (void **)&tmp) == SUCCESS &&
+	    Z_TYPE_PP(tmp) == IS_STRING) {
 		RETURN_STRINGL(Z_STRVAL_PP(tmp), Z_STRLEN_PP(tmp), 1);
 	}
 	RETURN_NULL();
@@ -3062,7 +3063,8 @@ PHP_METHOD(SoapClient, __getLastRequestHeaders)
 		return;
 	}
 	
-	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__last_request_headers", sizeof("__last_request_headers"), (void **)&tmp) == SUCCESS) {
+	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__last_request_headers", sizeof("__last_request_headers"), (void **)&tmp) == SUCCESS &&
+	    Z_TYPE_PP(tmp) == IS_STRING) {
 		RETURN_STRINGL(Z_STRVAL_PP(tmp), Z_STRLEN_PP(tmp), 1);
 	}
 	RETURN_NULL();
@@ -3080,7 +3082,8 @@ PHP_METHOD(SoapClient, __getLastResponseHeaders)
 		return;
 	}

-	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__last_response_headers", sizeof("__last_response_headers"), (void **)&tmp) == SUCCESS) {
+	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__last_response_headers", sizeof("__last_response_headers"), (void **)&tmp) == SUCCESS &&
+	    Z_TYPE_PP(tmp) == IS_STRING) {
 		RETURN_STRINGL(Z_STRVAL_PP(tmp), Z_STRLEN_PP(tmp), 1);
 	}
 	RETURN_NULL();
@@ -3136,13 +3139,15 @@ PHP_METHOD(SoapClient, __setCookie)
 	}

 	if (val == NULL) {
-		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_cookies", sizeof("_cookies"), (void **)&cookies) == SUCCESS) {
+		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_cookies", sizeof("_cookies"), (void **)&cookies) == SUCCESS &&
+		    Z_TYPE_PP(cookies) == IS_ARRAY) {
 			zend_hash_del(Z_ARRVAL_PP(cookies), name, name_len+1);
 		}
 	} else {
 		zval *zcookie;

-		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_cookies", sizeof("_cookies"), (void **)&cookies) == FAILURE) {
+		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_cookies", sizeof("_cookies"), (void **)&cookies) == FAILURE ||
+		    Z_TYPE_PP(cookies) != IS_ARRAY) {
 			zval *tmp_cookies;

 			MAKE_STD_ZVAL(tmp_cookies);
@@ -3170,7 +3175,8 @@ PHP_METHOD(SoapClient, __getCookies)

 	array_init(return_value);

-	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_cookies", sizeof("_cookies"), (void **)&cookies) != FAILURE) {
+	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_cookies", sizeof("_cookies"), (void **)&cookies) != FAILURE &&
+	    Z_TYPE_PP(cookies) == IS_ARRAY) {
 		zend_hash_copy(Z_ARRVAL_P(return_value), Z_ARRVAL_P(*cookies), (copy_ctor_func_t) zval_add_ref, (void *)&tmp, sizeof(zval*));
 	}
 }
@@ -3992,7 +3998,8 @@ static xmlDocPtr serialize_response_call(sdlFunctionPtr function, char *function
 		}

 		if (version == SOAP_1_1) {
-			if (zend_hash_find(prop, "faultcode", sizeof("faultcode"), (void**)&tmp) == SUCCESS) {
+			if (zend_hash_find(prop, "faultcode", sizeof("faultcode"), (void**)&tmp) == SUCCESS &&
+			    Z_TYPE_PP(tmp) == IS_STRING) {
 				size_t new_len;
 				xmlNodePtr node = xmlNewNode(NULL, BAD_CAST("faultcode"));
 				char *str = php_escape_html_entities((unsigned char*)Z_STRVAL_PP(tmp), Z_STRLEN_PP(tmp), &new_len, 0, 0, NULL TSRMLS_CC);
@@ -4017,7 +4024,8 @@ static xmlDocPtr serialize_response_call(sdlFunctionPtr function, char *function
 			}
 			detail_name = "detail";
 		} else {
-			if (zend_hash_find(prop, "faultcode", sizeof("faultcode"), (void**)&tmp) == SUCCESS) {
+			if (zend_hash_find(prop, "faultcode", sizeof("faultcode"), (void**)&tmp) == SUCCESS &&
+			    Z_TYPE_PP(tmp) == IS_STRING) {
 				size_t new_len;
 				xmlNodePtr node = xmlNewChild(param, ns, BAD_CAST("Code"), NULL);
 				char *str = php_escape_html_entities((unsigned char*)Z_STRVAL_PP(tmp), Z_STRLEN_PP(tmp), &new_len, 0, 0, NULL TSRMLS_CC);
@@ -4257,7 +4265,8 @@ static xmlDocPtr serialize_function_call(zval *this_ptr, sdlFunctionPtr function
 			}
 		}
 	} else {
-		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "style", sizeof("style"), (void **)&zstyle) == SUCCESS) {
+		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "style", sizeof("style"), (void **)&zstyle) == SUCCESS &&
+		    Z_TYPE_PP(zstyle) == IS_LONG) {
 			style = Z_LVAL_PP(zstyle);
 		} else {
 			style = SOAP_RPC;
@@ -4280,7 +4289,7 @@ static xmlDocPtr serialize_function_call(zval *this_ptr, sdlFunctionPtr function
 		}

 		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "use", sizeof("use"), (void **)&zuse) == SUCCESS &&
-			  Z_LVAL_PP(zuse) == SOAP_LITERAL) {
+		    Z_TYPE_PP(zuse) == IS_LONG && Z_LVAL_PP(zuse) == SOAP_LITERAL) {
 			use = SOAP_LITERAL;
 		} else {
 			use = SOAP_ENCODED;
@@ -4410,6 +4419,7 @@ static xmlNodePtr serialize_parameter(sdlParamPtr param, zval *param_val, int in
 		zval **param_data;

 		if (zend_hash_find(Z_OBJPROP_P(param_val), "param_name", sizeof("param_name"), (void **)&param_name) == SUCCESS &&
+		    Z_TYPE_PP(param_name) == IS_STRING &&
 		    zend_hash_find(Z_OBJPROP_P(param_val), "param_data", sizeof("param_data"), (void **)&param_data) == SUCCESS) {
 			param_val = *param_data;
 			name = Z_STRVAL_PP(param_name);
@@ -0,0 +1,17 @@
+--TEST--
+Bug #69085 (SoapClient's __call() type confusion through unserialize())
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--INI--
+soap.wsdl_cache_enabled=0
+--FILE--
+<?php
+
+$dummy = unserialize('O:10:"SoapClient":5:{s:3:"uri";s:1:"a";s:8:"location";s:22:"http://localhost/a.xml";s:17:"__default_headers";i:1337;s:15:"__last_response";s:1:"a";s:5:"trace";s:1:"x";}');
+try {
+	$dummy->whatever();
+} catch (Exception $e) {
+	echo "okey";
+}
+--EXPECT--
+okey
@@ -902,6 +902,8 @@ ZEND_END_ARG_INFO()

 ZEND_BEGIN_ARG_INFO_EX(arginfo_spl_autoload_register, 0, 0, 0)
 	ZEND_ARG_INFO(0, autoload_function)
+	ZEND_ARG_INFO(0, throw)
+	ZEND_ARG_INFO(0, prepend)
 ZEND_END_ARG_INFO()

 ZEND_BEGIN_ARG_INFO_EX(arginfo_spl_autoload_unregister, 0, 0, 1)
@@ -202,18 +202,21 @@ static inline void spl_filesystem_object_get_file_name(spl_filesystem_object *in
 {
 	char slash = SPL_HAS_FLAG(intern->flags, SPL_FILE_DIR_UNIXPATHS) ? '/' : DEFAULT_SLASH;

-	if (!intern->file_name) {
-		switch (intern->type) {
+	switch (intern->type) {
 		case SPL_FS_INFO:
 		case SPL_FS_FILE:
-			php_error_docref(NULL TSRMLS_CC, E_ERROR, "Object not initialized");
+			if (!intern->file_name) {
+				php_error_docref(NULL TSRMLS_CC, E_ERROR, "Object not initialized");
+			}
 			break;
 		case SPL_FS_DIR:
+			if (intern->file_name) {
+				efree(intern->file_name);
+			}
 			intern->file_name_len = spprintf(&intern->file_name, 0, "%s%c%s",
 			                                 spl_filesystem_object_get_path(intern, NULL TSRMLS_CC),
 			                                 slash, intern->u.dir.entry.d_name);
 			break;
-		}
 	}
 } /* }}} */

@@ -782,6 +782,7 @@ SPL_METHOD(SplObjectStorage, serialize)
 	INIT_PZVAL(&members);
 	Z_ARRVAL(members) = zend_std_get_properties(getThis() TSRMLS_CC);
 	Z_TYPE(members) = IS_ARRAY;
+	zend_hash_del(Z_ARRVAL(members), "\x00gcdata", sizeof("\x00gcdata"));
 	pmembers = &members;
 	php_var_serialize(&buf, &pmembers, &var_hash TSRMLS_CC); /* finishes the string */

@@ -0,0 +1,42 @@
+--TEST--
+Bug #68557 (SplFileInfo::getPathname() may be broken)
+--FILE--
+<?php
+mkdir(__DIR__ . DIRECTORY_SEPARATOR . 'tmp');
+touch(__DIR__ . DIRECTORY_SEPARATOR . 'tmp' . DIRECTORY_SEPARATOR . 'a');
+touch(__DIR__ . DIRECTORY_SEPARATOR . 'tmp' . DIRECTORY_SEPARATOR . 'b');
+
+$d = new DirectoryIterator(__DIR__ . DIRECTORY_SEPARATOR . 'tmp');
+
+$d->seek(0);
+$path0 = $d->current()->getPathname();
+
+$d->seek(1);
+$path1 = $d->current()->getPathname();
+
+$d->seek(2);
+$path2 = $d->current()->getPathname();
+
+$d->seek(0);
+var_dump($path0 === $d->current()->getPathname());
+
+$d->seek(1);
+var_dump($path1 === $d->current()->getPathname());
+
+$d->seek(2);
+var_dump($path2 === $d->current()->getPathname());
+
+$d->seek(0);
+var_dump($path0 === $d->current()->getPathname());
+?>
+--CLEAN--
+<?php
+unlink(__DIR__ . DIRECTORY_SEPARATOR . 'tmp' . DIRECTORY_SEPARATOR . 'a');
+unlink(__DIR__ . DIRECTORY_SEPARATOR . 'tmp' . DIRECTORY_SEPARATOR . 'b');
+rmdir(__DIR__ . DIRECTORY_SEPARATOR . 'tmp');
+?>
+--EXPECTF--
+bool(true)
+bool(true)
+bool(true)
+bool(true)
@@ -0,0 +1,22 @@
+--TEST--
+Bug #69108 ("Segmentation fault" when (de)serializing SplObjectStorage)
+--INI--
+zend.enable_gc=1
+--FILE--
+<?php
+$a = array();
+$b = new SplObjectStorage();
+for ($i = 10000; $i > 0; $i--) {
+	    $object = new StdClass();
+		    $a[] = $object;
+		    $b->attach($object);
+}
+
+$c = serialize(array($a, $b));
+$d = unserialize($c);
+
+unset($d);
+echo "ok";
+?>
+--EXPECT--
+ok
@@ -976,11 +976,6 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_scandir, 0, 0, 1)
 	ZEND_ARG_INFO(0, context)
 ZEND_END_ARG_INFO()
 /* }}} */
-/* {{{ arginfo ext/standard/dl.c */
-ZEND_BEGIN_ARG_INFO(arginfo_dl, 0)
-	ZEND_ARG_INFO(0, extension_filename)
-ZEND_END_ARG_INFO()
-/* }}} */
 /* {{{ dns.c */
 ZEND_BEGIN_ARG_INFO(arginfo_gethostbyaddr, 0)
 	ZEND_ARG_INFO(0, ip_address)
@@ -1465,6 +1460,7 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_setcookie, 0, 0, 1)
 	ZEND_ARG_INFO(0, path)
 	ZEND_ARG_INFO(0, domain)
 	ZEND_ARG_INFO(0, secure)
+	ZEND_ARG_INFO(0, httponly)
 ZEND_END_ARG_INFO()

 ZEND_BEGIN_ARG_INFO_EX(arginfo_setrawcookie, 0, 0, 1)
@@ -1474,6 +1470,7 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_setrawcookie, 0, 0, 1)
 	ZEND_ARG_INFO(0, path)
 	ZEND_ARG_INFO(0, domain)
 	ZEND_ARG_INFO(0, secure)
+	ZEND_ARG_INFO(0, httponly)
 ZEND_END_ARG_INFO()

 ZEND_BEGIN_ARG_INFO_EX(arginfo_headers_sent, 0, 0, 0)
@@ -1579,12 +1576,14 @@ ZEND_BEGIN_ARG_INFO(arginfo_iptcparse, 0)
 	ZEND_ARG_INFO(0, iptcdata)
 ZEND_END_ARG_INFO()
 /* }}} */
+
 /* {{{ lcg.c */
 ZEND_BEGIN_ARG_INFO(arginfo_lcg_value, 0)
 ZEND_END_ARG_INFO()
 /* }}} */
+
 /* {{{ levenshtein.c */
-ZEND_BEGIN_ARG_INFO(arginfo_levenshtein, 0)
+ZEND_BEGIN_ARG_INFO_EX(arginfo_levenshtein, 0, 0, 2)
 	ZEND_ARG_INFO(0, str1)
 	ZEND_ARG_INFO(0, str2)
 	ZEND_ARG_INFO(0, cost_ins)
@@ -4263,8 +4262,8 @@ PHP_FUNCTION(getopt)
 	/* Get argv from the global symbol table. We calculate argc ourselves
 	 * in order to be on the safe side, even though it is also available
 	 * from the symbol table. */
-	if (PG(http_globals)[TRACK_VARS_SERVER] &&
-		(zend_hash_find(HASH_OF(PG(http_globals)[TRACK_VARS_SERVER]), "argv", sizeof("argv"), (void **) &args) != FAILURE ||
+	if ((PG(http_globals)[TRACK_VARS_SERVER] || zend_is_auto_global(ZEND_STRL("_SERVER") TSRMLS_CC)) &&
+		(zend_hash_find(Z_ARRVAL_P((PG(http_globals))[TRACK_VARS_SERVER]), "argv", sizeof("argv"), (void **) &args) != FAILURE ||
 		zend_hash_find(&EG(symbol_table), "argv", sizeof("argv"), (void **) &args) != FAILURE) && Z_TYPE_PP(args) == IS_ARRAY
 	) {
 		int pos = 0;
@@ -5834,7 +5833,7 @@ PHP_FUNCTION(move_uploaded_file)
 		RETURN_FALSE;
 	}

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ss", &path, &path_len, &new_path, &new_path_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "sp", &path, &path_len, &new_path, &new_path_len) == FAILURE) {
 		return;
 	}

@@ -170,7 +170,7 @@ main() {
  ac_cv_crypt_blowfish=no
 ])])

-AC_CACHE_CHECK(for SHA512 crypt, ac_cv_crypt_SHA512,[
+AC_CACHE_CHECK(for SHA512 crypt, ac_cv_crypt_sha512,[
 AC_TRY_RUN([
 #if HAVE_UNISTD_H
 #include <unistd.h>
@@ -192,14 +192,14 @@ main() {
 	exit(0);
 #endif
 }],[
-  ac_cv_crypt_SHA512=yes
+  ac_cv_crypt_sha512=yes
 ],[
-  ac_cv_crypt_SHA512=no
+  ac_cv_crypt_sha512=no
 ],[
-  ac_cv_crypt_SHA512=no
+  ac_cv_crypt_sha512=no
 ])])

-AC_CACHE_CHECK(for SHA256 crypt, ac_cv_crypt_SHA256,[
+AC_CACHE_CHECK(for SHA256 crypt, ac_cv_crypt_sha256,[
 AC_TRY_RUN([
 #if HAVE_UNISTD_H
 #include <unistd.h>
@@ -222,11 +222,11 @@ main() {
 	exit(0);
 #endif
 }],[
-  ac_cv_crypt_SHA256=yes
+  ac_cv_crypt_sha256=yes
 ],[
-  ac_cv_crypt_SHA256=no
+  ac_cv_crypt_sha256=no
 ],[
-  ac_cv_crypt_SHA256=no
+  ac_cv_crypt_sha256=no
 ])])


@@ -356,11 +356,7 @@ PHP_FUNCTION(flock)
 	/* flock_values contains all possible actions if (operation & 4) we won't block on the lock */
 	act = flock_values[act - 1] | (operation & PHP_LOCK_NB ? LOCK_NB : 0);
 	if (php_stream_lock(stream, act)) {
-#ifdef PHP_WIN32
-		if (operation && errno == ERROR_INVALID_BLOCK && arg3 && PZVAL_IS_REF(arg3)) {
-#else
 		if (operation && errno == EWOULDBLOCK && arg3 && PZVAL_IS_REF(arg3)) {
-#endif
 			Z_LVAL_P(arg3) = 1;
 		}
 		RETURN_FALSE;
@@ -125,8 +125,12 @@ PHPAPI int php_flock(int fd, int operation)
    DWORD low = 1, high = 0;
    OVERLAPPED offset =
    {0, 0, 0, 0, NULL};
-    if (hdl < 0)
+	DWORD err;
+
+    if (hdl < 0) {
+		_set_errno(EBADF);
        return -1;              /* error in file descriptor */
+	}
    /* bug for bug compatible with Unix */
    UnlockFileEx(hdl, 0, low, high, &offset);
    switch (operation & ~LOCK_NB) {    /* translate to LockFileEx() op */
@@ -146,12 +150,14 @@ PHPAPI int php_flock(int fd, int operation)
        default:                /* default */
            break;
    }
-	/* Under Win32 MT library, errno is not a variable but a function call,
-	 * which cannot be assigned to.
-	 */
-#if !defined(PHP_WIN32)
-    errno = EINVAL;             /* bad call */
-#endif
+
+	err = GetLastError();
+	if (ERROR_LOCK_VIOLATION == err || ERROR_SHARING_VIOLATION == err) {
+		_set_errno(EWOULDBLOCK);
+	} else {
+		_set_errno(EINVAL);             /* bad call */
+	}
+
    return -1;
 }
 /* }}} */
@@ -277,9 +277,6 @@ PHP_FUNCTION(headers_list)
 		return;
 	}

-	if (!&SG(sapi_headers).headers) {
-		RETURN_FALSE;
-	}
 	array_init(return_value);
 	zend_llist_apply_with_argument(&SG(sapi_headers).headers, php_head_apply_header_list_to_hash, return_value TSRMLS_CC);
 }
@@ -6,8 +6,8 @@ var_dump(gethostbyname(str_repeat("0", 2501)));
 var_dump(gethostbynamel(str_repeat("0", 2501)));
 ?>
 --EXPECTF--
-Warning: gethostbyname(): Host name is too long, the limit is %d characters in %s/bug68925.php on line %d
+Warning: gethostbyname(): Host name is too long, the limit is %d characters in %s%ebug68925.php on line %d
 string(2501) "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"

-Warning: gethostbynamel(): Host name is too long, the limit is %d characters in %s/bug68925.php on line %d
+Warning: gethostbynamel(): Host name is too long, the limit is %d characters in %s%ebug68925.php on line %d
 bool(false)
@@ -3,16 +3,22 @@ http-stream test
 --SKIPIF--
 <?php
 if (getenv("SKIP_SLOW_TESTS")) die("skip slow test");
-if (getenv("SKIP_ONLINE_TESTS")) die("skip online test");
 if (!extension_loaded("dom")) die("skip dom extension is not present");
+require __DIR__.'/../http/server.inc';
+http_server_skipif('tcp://127.0.0.1:12342');
 ?>
 --INI--
 allow_url_fopen=1
 --FILE--
 <?php
+require __DIR__.'/../http/server.inc';
+
+$pid = http_server("tcp://127.0.0.1:12342", [__DIR__."/news.rss"]);
+
 $d = new DomDocument;
-$e = $d->load("http://php.net/news.rss");
+$e = $d->load("http://127.0.0.1:12342/news.rss");
 echo "ALIVE\n";
+http_server_kill($pid);
 ?>
 --EXPECTF--
 ALIVE
@@ -0,0 +1,28 @@
+HTTP/1.1 200 OK
+Content-Type: text/xml
+
+<?xml version="1.0" encoding="utf-8"?>
+<rdf:RDF
+	xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+	xmlns="http://purl.org/rss/1.0/"
+	xmlns:dc="http://purl.org/dc/elements/1.1/"
+>
+<channel rdf:about="http://php.net/">
+	<title>PHP: Hypertext Preprocessor</title>
+	<link>http://php.net/</link>
+	<description>The PHP scripting language web site</description>
+	<items>
+		<rdf:Seq>
+			<rdf:li rdf:resource="http://php.net/index.php#id2015-01-22-3" />
+		</rdf:Seq>
+	</items>
+</channel>
+
+<item rdf:about="http://php.net/index.php#id2015-01-22-3">
+	<title>PHP 5.4.37 Released</title>
+	<link>http://php.net/index.php#id2015-01-22-3</link>
+	<description>The PHP development team announces the immediate availability of PHP 5.4.37. Six security-related bugs were fixed in this release, including CVE-2015-0231, CVE-2014-9427 and CVE-2015-0232. All PHP 5.4 users are encouraged to upgrade to this version. For source downloads of PHP 5.4.37 please visit our downloads page, Windows binaries can be found on windows.php.net/download/. The list of changes is recorded in the ChangeLog.</description>
+	<dc:date>2015-01-22</dc:date>
+</item>
+
+</rdf:RDF>
@@ -0,0 +1,37 @@
+--TEST--
+Bug #68976 Use After Free Vulnerability in unserialize()
+--FILE--
+<?php
+class evilClass {
+	public $name;
+	function __wakeup() {
+		unset($this->name);
+	}
+}
+
+$fakezval = pack(
+    'IIII',
+    0x00100000,
+    0x00000400,
+    0x00000000,
+    0x00000006 
+);
+
+$data = unserialize('a:2:{i:0;O:9:"evilClass":1:{s:4:"name";a:2:{i:0;i:1;i:1;i:2;}}i:1;R:4;}');
+
+for($i = 0; $i < 5; $i++) {
+    $v[$i] = $fakezval.$i;
+}
+
+var_dump($data);
+?>
+===DONE===
+--EXPECTF--
+array(2) {
+  [0]=>
+  object(evilClass)#1 (0) {
+  }
+  [1]=>
+  int(1)
+}
+===DONE===
@@ -0,0 +1,10 @@
+--TEST--
+Bug #69139 (Crash in gc_zval_possible_root on unserialize)
+--FILE--
+<?php
+$str = 'a:1126666:{i:0;r:1;i:-09610;r:1;i:-0;i:0;i:0;O:1:"A":2119X:i:0;i:0;i:0;i:0;i:0;O:1:"A":2116:{i:0;r:5;i:-096766610;r:1;i:-610;r:1;i:0;i:0;';
+@unserialize($str);
+echo "Alive";
+?>
+--EXPECT--
+Alive
@@ -1,4 +1,4 @@
-/* Generated by re2c 0.13.7.5 on Thu Jan  1 14:43:18 2015 */
+/* Generated by re2c 0.13.5 */
 #line 1 "ext/standard/var_unserializer.re"
 /*
  +----------------------------------------------------------------------+
@@ -320,8 +320,7 @@ static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, long
 		if (!php_var_unserialize(&data, p, max, var_hash TSRMLS_CC)) {
 			zval_dtor(key);
 			FREE_ZVAL(key);
-			zval_dtor(data);
-			FREE_ZVAL(data);
+			zval_ptr_dtor(&data);
 			return 0;
 		}

@@ -349,6 +348,7 @@ static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, long
 			zend_hash_update(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, &data,
 					sizeof data, NULL);
 		}
+		var_push_dtor(var_hash, &data);
 		
 		zval_dtor(key);
 		FREE_ZVAL(key);
@@ -620,8 +620,7 @@ yy20:
 	if (yybm[0+yych] & 128) {
 		goto yy20;
 	}
-	if (yych <= '/') goto yy18;
-	if (yych >= ';') goto yy18;
+	if (yych != ':') goto yy18;
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
@@ -771,7 +770,7 @@ yy20:

 	return object_common2(UNSERIALIZE_PASSTHRU, elements);
 }
-#line 775 "ext/standard/var_unserializer.c"
+#line 774 "ext/standard/var_unserializer.c"
 yy25:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -804,7 +803,7 @@ yy27:
 	return object_common2(UNSERIALIZE_PASSTHRU,
 			object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR));
 }
-#line 808 "ext/standard/var_unserializer.c"
+#line 807 "ext/standard/var_unserializer.c"
 yy32:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy33;
@@ -845,7 +844,7 @@ yy34:

 	return finish_nested_data(UNSERIALIZE_PASSTHRU);
 }
-#line 849 "ext/standard/var_unserializer.c"
+#line 848 "ext/standard/var_unserializer.c"
 yy39:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy40;
@@ -895,7 +894,7 @@ yy41:
 	ZVAL_STRINGL(*rval, str, len, 0);
 	return 1;
 }
-#line 899 "ext/standard/var_unserializer.c"
+#line 898 "ext/standard/var_unserializer.c"
 yy46:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy47;
@@ -944,7 +943,7 @@ yy48:
 	ZVAL_STRINGL(*rval, str, len, 1);
 	return 1;
 }
-#line 948 "ext/standard/var_unserializer.c"
+#line 947 "ext/standard/var_unserializer.c"
 yy53:
 	yych = *++YYCURSOR;
 	if (yych <= '/') {
@@ -1042,7 +1041,7 @@ use_double:
 	ZVAL_DOUBLE(*rval, zend_strtod((const char *)start + 2, NULL));
 	return 1;
 }
-#line 1046 "ext/standard/var_unserializer.c"
+#line 1045 "ext/standard/var_unserializer.c"
 yy65:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1116,7 +1115,7 @@ yy73:

 	return 1;
 }
-#line 1120 "ext/standard/var_unserializer.c"
+#line 1119 "ext/standard/var_unserializer.c"
 yy76:
 	yych = *++YYCURSOR;
 	if (yych == 'N') goto yy73;
@@ -1170,7 +1169,7 @@ yy79:
 	ZVAL_LONG(*rval, parse_iv(start + 2));
 	return 1;
 }
-#line 1174 "ext/standard/var_unserializer.c"
+#line 1173 "ext/standard/var_unserializer.c"
 yy83:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy18;
@@ -1185,7 +1184,7 @@ yy83:
 	ZVAL_BOOL(*rval, parse_iv(start + 2));
 	return 1;
 }
-#line 1189 "ext/standard/var_unserializer.c"
+#line 1188 "ext/standard/var_unserializer.c"
 yy87:
 	++YYCURSOR;
 #line 535 "ext/standard/var_unserializer.re"
@@ -1195,7 +1194,7 @@ yy87:
 	ZVAL_NULL(*rval);
 	return 1;
 }
-#line 1199 "ext/standard/var_unserializer.c"
+#line 1198 "ext/standard/var_unserializer.c"
 yy89:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1241,7 +1240,7 @@ yy91:
 	
 	return 1;
 }
-#line 1245 "ext/standard/var_unserializer.c"
+#line 1244 "ext/standard/var_unserializer.c"
 yy95:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1285,7 +1284,7 @@ yy97:
 	
 	return 1;
 }
-#line 1289 "ext/standard/var_unserializer.c"
+#line 1288 "ext/standard/var_unserializer.c"
 }
 #line 840 "ext/standard/var_unserializer.re"

@@ -324,8 +324,7 @@ static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, long
 		if (!php_var_unserialize(&data, p, max, var_hash TSRMLS_CC)) {
 			zval_dtor(key);
 			FREE_ZVAL(key);
-			zval_dtor(data);
-			FREE_ZVAL(data);
+			zval_ptr_dtor(&data);
 			return 0;
 		}

@@ -353,6 +352,7 @@ static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, long
 			zend_hash_update(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, &data,
 					sizeof data, NULL);
 		}
+		var_push_dtor(var_hash, &data);
 		
 		zval_dtor(key);
 		FREE_ZVAL(key);
@@ -101,7 +101,7 @@ _zip_cdir_new(int nentry, struct zip_error *error)
 	return NULL;
    }

-    if ((cd->entry=(struct zip_dirent *)malloc(sizeof(*(cd->entry))*nentry))
+    if ( nentry > ((size_t)-1)/sizeof(*(cd->entry)) || (cd->entry=(struct zip_dirent *)malloc(sizeof(*(cd->entry))*(size_t)nentry))
 	== NULL) {
 	_zip_error_set(error, ZIP_ER_MEMORY, 0);
 	free(cd);
@@ -82,8 +82,8 @@ static int php_zlib_output_encoding(TSRMLS_D)
 	zval **enc;

 	if (!ZLIBG(compression_coding)) {
-		zend_is_auto_global(ZEND_STRL("_SERVER") TSRMLS_CC);
-		if (PG(http_globals)[TRACK_VARS_SERVER] && SUCCESS == zend_hash_find(Z_ARRVAL_P(PG(http_globals)[TRACK_VARS_SERVER]), "HTTP_ACCEPT_ENCODING", sizeof("HTTP_ACCEPT_ENCODING"), (void *) &enc)) {
+		if ((PG(http_globals)[TRACK_VARS_SERVER]  || zend_is_auto_global(ZEND_STRL("_SERVER") TSRMLS_CC)) && 
+				SUCCESS == zend_hash_find(Z_ARRVAL_P(PG(http_globals)[TRACK_VARS_SERVER]), "HTTP_ACCEPT_ENCODING", sizeof("HTTP_ACCEPT_ENCODING"), (void *) &enc)) {
 			convert_to_string(*enc);
 			if (strstr(Z_STRVAL_PP(enc), "gzip")) {
 				ZLIBG(compression_coding) = PHP_ZLIB_ENCODING_GZIP;
@@ -2,7 +2,7 @@
  +----------------------------------------------------------------------+
  | PHP Version 5                                                        |
  +----------------------------------------------------------------------+
-  | Copyright (c) 1997-2014 The PHP Group                                |
+  | Copyright (c) 1997-2015 The PHP Group                                |
  +----------------------------------------------------------------------+
  | This source file is subject to version 3.01 of the PHP license,      |
  | that is bundled with this package in the file LICENSE, and is        |
@@ -1087,7 +1087,7 @@ static void php_error_cb(int type, const char *error_filename, const uint error_
 						size_t len;
 						char *buf = php_escape_html_entities(buffer, buffer_len, &len, 0, ENT_COMPAT, NULL TSRMLS_CC);
 						php_printf("%s<br />\n<b>%s</b>:  %s in <b>%s</b> on line <b>%d</b><br />\n%s", STR_PRINT(prepend_string), error_type_str, buf, error_filename, error_lineno, STR_PRINT(append_string));
-						efree(buf);
+						str_efree(buf);
 					} else {
 						php_printf("%s<br />\n<b>%s</b>:  %s in <b>%s</b> on line <b>%d</b><br />\n%s", STR_PRINT(prepend_string), error_type_str, buffer, error_filename, error_lineno, STR_PRINT(append_string));
 					}
@@ -1246,6 +1246,10 @@ PHPAPI char *php_get_current_user(TSRMLS_D)
 			efree(pwbuf);
 			return "";
 		}
+		if (retpwptr == NULL) {
+			efree(pwbuf);
+			return "";
+		}
 		pwd = &_pw;
 #else
 		if ((pwd=getpwuid(pstat->st_uid))==NULL) {
@@ -2503,8 +2507,23 @@ PHPAPI int php_execute_script(zend_file_handle *primary_file TSRMLS_DC)
 #endif
 			zend_set_timeout(INI_INT("max_execution_time"), 0);
 		}
-		retval = (zend_execute_scripts(ZEND_REQUIRE TSRMLS_CC, NULL, 3, prepend_file_p, primary_file, append_file_p) == SUCCESS);

+		/*
+		   If cli primary file has shabang line and there is a prepend file,
+		   the `start_lineno` will be used by prepend file but not primary file,
+		   save it and restore after prepend file been executed.
+		 */
+		if (CG(start_lineno) && prepend_file_p) {
+			int orig_start_lineno = CG(start_lineno);
+
+			CG(start_lineno) = 0;
+			if (zend_execute_scripts(ZEND_REQUIRE TSRMLS_CC, NULL, 1, prepend_file_p) == SUCCESS) {
+				CG(start_lineno) = orig_start_lineno;
+				retval = (zend_execute_scripts(ZEND_REQUIRE TSRMLS_CC, NULL, 2, primary_file, append_file_p) == SUCCESS);
+			}
+		} else {
+			retval = (zend_execute_scripts(ZEND_REQUIRE TSRMLS_CC, NULL, 3, prepend_file_p, primary_file, append_file_p) == SUCCESS);
+		}
 	} zend_end_try();

 #if HAVE_BROKEN_GETCWD
@@ -172,21 +172,22 @@ PHPAPI void php_output_deactivate(TSRMLS_D)
 {
 	php_output_handler **handler = NULL;

-	php_output_header(TSRMLS_C);
+	if ((OG(flags) & PHP_OUTPUT_ACTIVATED)) {
+		php_output_header(TSRMLS_C);

-	OG(flags) ^= PHP_OUTPUT_ACTIVATED;
-	OG(active) = NULL;
-	OG(running) = NULL;
+		OG(flags) ^= PHP_OUTPUT_ACTIVATED;
+		OG(active) = NULL;
+		OG(running) = NULL;

-	/* release all output handlers */
-	if (OG(handlers).elements) {
-		while (SUCCESS == zend_stack_top(&OG(handlers), (void *) &handler)) {
-			php_output_handler_free(handler TSRMLS_CC);
-			zend_stack_del_top(&OG(handlers));
+		/* release all output handlers */
+		if (OG(handlers).elements) {
+			while (SUCCESS == zend_stack_top(&OG(handlers), (void *) &handler)) {
+				php_output_handler_free(handler TSRMLS_CC);
+				zend_stack_del_top(&OG(handlers));
+			}
+			zend_stack_destroy(&OG(handlers));
 		}
-		zend_stack_destroy(&OG(handlers));
 	}
-
 }
 /* }}} */

@@ -2,7 +2,7 @@
 /* edit configure.in to change version number */
 #define PHP_MAJOR_VERSION 5
 #define PHP_MINOR_VERSION 5
-#define PHP_RELEASE_VERSION 22
+#define PHP_RELEASE_VERSION 23
 #define PHP_EXTRA_VERSION ""
-#define PHP_VERSION "5.5.22"
-#define PHP_VERSION_ID 50522
+#define PHP_VERSION "5.5.23"
+#define PHP_VERSION_ID 50523
@@ -374,6 +374,10 @@ static size_t php_stream_temp_write(php_stream *stream, const char *buf, size_t

 		if (memsize + count >= ts->smax) {
 			php_stream *file = php_stream_fopen_tmpfile();
+			if (file == NULL) {
+				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to create temporary file, Check permissions in temporary files directory.");
+				return 0;
+			}
 			php_stream_write(file, membuf, memsize);
 			php_stream_free_enclosed(ts->innerstream, PHP_STREAM_FREE_CLOSE);
 			ts->innerstream = file;
@@ -276,12 +276,12 @@ php_apache_sapi_register_variables(zval *track_vars_array TSRMLS_DC)
 		if (!val) {
 			val = "";
 		}
-		if (sapi_module.input_filter(PARSE_SERVER, key, &val, strlen(val), &new_val_len TSRMLS_CC)) {
+		if (sapi_module.input_filter(PARSE_SERVER, key, &val, strlen(val), (unsigned int *)&new_val_len TSRMLS_CC)) {
 			php_register_variable_safe(key, val, new_val_len, track_vars_array TSRMLS_CC);
 		}
 	APR_ARRAY_FOREACH_CLOSE()

-	if (sapi_module.input_filter(PARSE_SERVER, "PHP_SELF", &ctx->r->uri, strlen(ctx->r->uri), &new_val_len TSRMLS_CC)) {
+	if (sapi_module.input_filter(PARSE_SERVER, "PHP_SELF", &ctx->r->uri, strlen(ctx->r->uri), (unsigned int *)&new_val_len TSRMLS_CC)) {
 		php_register_variable_safe("PHP_SELF", ctx->r->uri, new_val_len, track_vars_array TSRMLS_CC);
 	}
 }
@@ -1826,7 +1826,7 @@ int main(int argc, char *argv[])
 		unsigned char *p;
 		decoded_query_string = strdup(query_string);
 		php_url_decode(decoded_query_string, strlen(decoded_query_string));
-		for (p = decoded_query_string; *p &&  *p <= ' '; p++) {
+		for (p = (unsigned char *)decoded_query_string; *p &&  *p <= ' '; p++) {
 			/* skip all leading spaces */
 		}
 		if(*p == '-') {
@@ -0,0 +1,17 @@
+--TEST--
+Bug #67741 (auto_prepend_file messes up __LINE__)
+--INI--
+include_path={PWD}
+auto_prepend_file=bug67741_stub.inc
+--SKIPIF--
+<?php
+include "skipif.inc";
+?>
+--FILE--
+#!/bin/env php
+<?php
+echo "primary lineno: ", __LINE__, "\n";
+?>
+--EXPECT--
+prepend lineno: 2
+primary lineno: 3
@@ -0,0 +1,3 @@
+<?php
+echo "prepend lineno: ", __LINE__, "\n";
+?>
@@ -221,8 +221,6 @@ void fpm_request_finished() /* {{{ */

 	proc->request_stage = FPM_REQUEST_FINISHED;
 	proc->tv = now;
-	memset(&proc->accepted, 0, sizeof(proc->accepted));
-	proc->accepted_epoch = 0;
 	fpm_scoreboard_proc_release(proc);
 }
 /* }}} */
@@ -489,7 +489,7 @@ static sapi_module_struct lsapi_sapi_module =
 };
 /* }}} */

-static int init_request_info( TSRMLS_D )
+static void init_request_info( TSRMLS_D )
 {
    char * pContentType = LSAPI_GetHeader( H_CONTENT_TYPE );
    char * pAuth;
@@ -1390,10 +1390,12 @@ char * LSAPI_GetHeader_r( LSAPI_Request * pReq, int headerIndex )
    off = pReq->m_pHeaderIndex->m_headerOff[ headerIndex ];
    if ( !off )
        return NULL;
-        if ( *(pReq->m_pHttpHeader + off + 
-                 pReq->m_pHeaderIndex->m_headerLen[ headerIndex ]) )
-                *( pReq->m_pHttpHeader + off + 
-                        pReq->m_pHeaderIndex->m_headerLen[ headerIndex ]) = 0;
+    if ( *(pReq->m_pHttpHeader + off 
+        + pReq->m_pHeaderIndex->m_headerLen[ headerIndex ]) )
+    {
+        *( pReq->m_pHttpHeader + off 
+            + pReq->m_pHeaderIndex->m_headerLen[ headerIndex ]) = 0;
+    }
    return pReq->m_pHttpHeader + off;
 }

@@ -1830,12 +1832,21 @@ ssize_t LSAPI_Write_Stderr_r( LSAPI_Request * pReq, const char * pBuf, size_t le
 static char * GetHeaderVar( LSAPI_Request * pReq, const char * name )
 {
    int i;
+    char * pValue;
    for( i = 0; i < H_TRANSFER_ENCODING; ++i )
    {
        if ( pReq->m_pHeaderIndex->m_headerOff[i] )
        {
            if ( strcmp( name, CGI_HEADERS[i] ) == 0 )
-                return pReq->m_pHttpHeader + pReq->m_pHeaderIndex->m_headerOff[i];
+            {
+                pValue = pReq->m_pHttpHeader 
+                         + pReq->m_pHeaderIndex->m_headerOff[i];
+                if ( *(pValue + pReq->m_pHeaderIndex->m_headerLen[i]) != '\0')
+                {
+                    *(pValue + pReq->m_pHeaderIndex->m_headerLen[i]) = '\0';
+                }
+                return pValue;
+            }
        }
    }
    if ( pReq->m_pHeader->m_cntUnknownHeaders > 0 )
@@ -1862,7 +1873,15 @@ static char * GetHeaderVar( LSAPI_Request * pReq, const char * name )
                ++p; ++pKey;
            }
            if (( pKey == pKeyEnd )&& (!*p ))
-                return pReq->m_pHttpHeader + pCur->valueOff;
+            {
+                pValue = pReq->m_pHttpHeader + pCur->valueOff;
+                
+                if ( *(pValue + pCur->valueLen) != '\0')
+                {
+                    *(pValue + pCur->valueLen) = '\0';
+                }
+                return pValue;
+            }
            ++pCur;
        }
    }
@@ -0,0 +1,13 @@
+--TEST--
+Bug #65593 (ob_start(function(){ob_start();});)
+--FILE--
+<?php 
+echo "Test\n";
+
+ob_start(function(){ob_start();});
+?>
+===DONE===
+--EXPECTF--
+Test
+
+Fatal error: Cannot destroy active lambda function in %sbug65593.php on line %d
@@ -49,4 +49,5 @@ $TS \
 --with-openssl \
 --with-gmp \
 --enable-bcmath
-make --quiet
+make -j2 --quiet
+sudo make install
@@ -261,7 +261,7 @@ void UpdateIniFromRegistry(char *path TSRMLS_DC)
 			     zend_hash_get_current_data_ex(ht, (void**)&data, &pos) == SUCCESS &&
 			     zend_hash_get_current_key_ex(ht, &index, &index_len, &num, 0, &pos) == HASH_KEY_IS_STRING;
 			     zend_hash_move_forward_ex(ht, &pos)) {
-				zend_alter_ini_entry(index, index_len, Z_STRVAL_PP(data), Z_STRLEN_PP(data), PHP_INI_SYSTEM, PHP_INI_STAGE_ACTIVATE);
+				zend_alter_ini_entry(index, index_len, Z_STRVAL_PP(data), Z_STRLEN_PP(data), PHP_INI_USER, PHP_INI_STAGE_ACTIVATE);
 			}
 			break;
 		}
Author	SHA1	Message	Date
Julien Pauli	7fb06ce4d3	5.5.23	2015-03-18 10:45:50 +01:00
Stanislav Malyshev	4a8d8b4154	Fix bug #69253 - ZIP Integer Overflow leads to writing past heap boundary	2015-03-18 10:39:34 +01:00
Stanislav Malyshev	94e7638d9a	Fix bug #69248 - heap overflow vulnerability in regcomp.c Merged from https://github.com/garyhouston/regex/commit/70bc2965604b6b8aaf260049e64c708dddf85334	2015-03-18 10:39:08 +01:00
Stanislav Malyshev	2256ee4fa7	add test for bug #68976	2015-03-18 10:38:54 +01:00
Stanislav Malyshev	b690be4d22	Fixed bug #68976 - Use After Free Vulnerability in unserialize() Conflicts: ext/standard/var_unserializer.c	2015-03-18 10:38:20 +01:00
Stanislav Malyshev	048e0d58bf	Fixed bug #69134 (Per Directory Values overrides PHP_INI_SYSTEM configuration options)	2015-03-18 10:32:56 +01:00
Stanislav Malyshev	93b8970b33	Fix bug #69207 - move_uploaded_file allows nulls in path	2015-03-18 10:17:56 +01:00
Remi Collet	10d61a3a3e	Fix odbc build as shared Broken since `a41aa46759`	2015-03-09 10:26:10 +01:00
Julien Pauli	e14401deca	5.5.23RC1	2015-03-05 14:16:36 +01:00
Xinchen Hui	869f8bd24b	Error also maybe happened here	2015-03-05 21:05:26 +08:00
Xinchen Hui	f039225597	Fixed bug #69174 (leaks when unused inner class use traits precedence)	2015-03-05 18:39:50 +08:00
nathan r. hruby	837eeefee9	Make killing a locker an ERROR event At least in apache, killing a locker with SIGKILL from inside opcache prevents the child process from emitting a corresponding log event to the access or error logs, therefore requests are termed with no record. This makes is incredibly difficult to debug problems espically on systems with high counts of cache restarts. Since INFO level is far too noisy for production use, switch the killing to a higher level so we can see it easier.	2015-03-03 23:16:45 +08:00
Reeze Xia	304fb7a3d6	Merge branch 'PHP-5.5' of git.php.net:/php-src into PHP-5.5 * 'PHP-5.5' of git.php.net:/php-src: Added type checks Added type checks	2015-03-03 16:27:04 +08:00
Reeze Xia	860fc3947f	Improve fix for bug 67741 Thanks to laruence.	2015-03-03 16:25:43 +08:00
Dmitry Stogov	b3ac352253	Merge branch 'PHP-5.4' into PHP-5.5 * PHP-5.4: Added type checks	2015-03-03 10:45:07 +03:00
Dmitry Stogov	c8eaca013a	Added type checks	2015-03-03 10:43:48 +03:00
Dmitry Stogov	5c03e05692	Merge branch 'PHP-5.5' of git.php.net:php-src into PHP-5.5 * 'PHP-5.5' of git.php.net:php-src: Update NEWS	2015-03-03 10:20:21 +03:00
Dmitry Stogov	035d80523f	Merge branch 'PHP-5.4' into PHP-5.5 * PHP-5.4: Added type checks Conflicts: ext/soap/soap.c	2015-03-03 09:52:21 +03:00
Dmitry Stogov	0c136a2abd	Added type checks	2015-03-03 09:44:46 +03:00
Reeze Xia	bb466d57ae	Update NEWS	2015-03-03 14:22:03 +08:00
Reeze Xia	34f09b6240	Fixed bug #67741 (auto_prepend_file messes up __LINE__) This also fixes bug #54081	2015-03-03 11:25:30 +08:00
Dmitry Stogov	fc1f24b7a6	Merge branch 'PHP-5.4' into PHP-5.5 * PHP-5.4: Check variable type before its usage as IS_ARRAY. Fixed a bug that header value is not terminated by '\0' when accessed through getenv().	2015-03-02 12:30:38 +03:00
Dmitry Stogov	d5248f67b5	Check variable type before its usage as IS_ARRAY.	2015-03-02 12:27:36 +03:00
Xinchen Hui	caebb76131	Fixed bug #69139 (Crash in gc_zval_possible_root on unserialize)	2015-03-01 23:16:15 +08:00
Lior Kaplan	55f7747bff	Align entries format for 5.5.23	2015-03-01 11:32:09 +02:00
Reeze Xia	c98eb695b5	Bump header year	2015-03-01 15:03:21 +08:00
Reeze Xia	8b0cf0d7fa	Update NEWS	2015-02-28 16:45:26 +08:00
Reeze Xia	f824f91ac9	Fixed bug #69141 Missing arguments in reflection info for some builtin functions This include: - setcookie (missing "httponly") - setrawcookie (missing "httponly") - spl_autoload_register (missing 2 optional params) - mktime (missing "is_dst") - gmmktime (missing "is_dst")	2015-02-28 16:37:14 +08:00
Дмитрий Пацура	e9c6798721	Fix ARG_INFO for levenshtein This can work with 2 parameters (require) refs http://php.net/manual/ru/function.levenshtein.php refs https://github.com/phalcon/zephir/issues/753	2015-02-27 23:23:24 +01:00
Xinchen Hui	997b7e5630	Fixed bug #69085 (SoapClient's __call() type confusion through unserialize()).	2015-02-27 23:32:32 +08:00
Xinchen Hui	4eb830b212	Reorder	2015-02-27 12:02:42 +08:00
Xinchen Hui	ebfc49aa91	Fixed bug #69121 (Segfault in get_current_user when script owner is not in passwd with ZTS build)	2015-02-27 12:00:52 +08:00
Xinchen Hui	3e82816ba1	Fixed bug #69125 (Array numeric string as key)	2015-02-27 11:42:36 +08:00
Taoguang Chen	e441d71baa	fix bug#68942's patch Fix type confusion bug in unserialize() with DateTimeZone. https://bugs.php.net/bug.php?id=68942	2015-02-27 10:41:53 +08:00
George Wang	f13a88ac13	Fixed a bug that header value is not terminated by '\0' when accessed through getenv().	2015-02-25 11:23:36 -05:00
George Wang	8584cc010a	Fixed a bug that header value is not terminated by '\0' when accessed through getenv().	2015-02-25 10:48:19 -05:00
Xinchen Hui	34d397e267	better name	2015-02-25 20:49:07 +08:00
Xinchen Hui	d508ff9640	Improve fix for #69038	2015-02-25 20:07:02 +08:00
Xinchen Hui	ffdc5728c8	Fixed bug #69108 ("Segmentation fault" when (de)serializing SplObjectStorage)	2015-02-25 18:21:59 +08:00
Julien Pauli	1bfbb546f7	updated NEWS	2015-02-23 11:22:44 +01:00
Linus Unnebäck	63ab6d8249	curl: add new proxy constants	2015-02-23 11:19:36 +01:00
Xinchen Hui	d5a1a3342b	Fixed test fails for bug68557	2015-02-23 10:35:16 +01:00
Jakub Zelenka	591dbcabe5	Fix bug #64695 (JSON_NUMERIC_CHECK has issues with strings that are numbers plus the letter e)	2015-02-22 20:22:47 +00:00
Rasmus Lerdorf	7ea5b3f71c	NEWS entry	2015-02-22 08:32:32 -08:00
Rasmus Lerdorf	a9ba407ce1	Fix bug #68166 We can't always efree here php_escape_html_entities can return an interned_empty_string	2015-02-22 08:25:56 -08:00
Anatol Belski	8f6a013c97	updated NEWS	2015-02-22 16:46:39 +01:00
Anatol Belski	68afd75ecd	Merge branch 'pull-request/1112' into PHP-5.5	2015-02-22 16:26:02 +01:00
Grant Pannell	7988f703f8	Fix Win32 SSPI initialization for digest authentication in cURL	2015-02-22 23:34:55 +10:30
Anatol Belski	6751f8b314	revisit fix for bug #65272	2015-02-21 14:10:59 +01:00
Anatol Belski	3082177bee	split test for bug #68557 for windows	2015-02-20 16:01:34 +01:00
Julien Pauli	6393556a5d	Updated NEWS	2015-02-20 15:43:38 +01:00
Julien Pauli	c111d1cd70	fix #68557	2015-02-20 15:09:35 +01:00
Dmitry Stogov	9fb48edf3c	Fixed type mismatch	2015-02-20 10:31:24 +03:00
Ferenc Kovacs	3d777c8068	update NEWS to match the actual stuff in 5.5.22	2015-02-18 20:08:46 +01:00
Ferenc Kovacs	24be46323b	Merge branch 'PHP-5.4' into PHP-5.5 * PHP-5.4: fix typo in bug# add CVE 5.4.39 next Conflicts: configure.in main/php_version.h	2015-02-18 19:48:50 +01:00
Ferenc Kovacs	c17a17e44b	fix typo in bug#	2015-02-18 19:47:07 +01:00
Ferenc Kovacs	08b6fe9ef1	Fix bug #69033 (Request may get env. variables from previous requests if PHP works as FastCGI)	2015-02-18 16:24:09 +01:00
Michael Wallner	83dda66aac	fix test	2015-02-18 14:06:32 +01:00
Michael Wallner	8b6919c77c	fix test	2015-02-18 14:04:53 +01:00
Michael Wallner	225af964c0	Fixed bug #65593 (Segfault when calling ob_start from output buffering callback)	2015-02-18 13:58:31 +01:00
Julien Pauli	73c2e9153a	Updated NEWS	2015-02-18 12:40:38 +01:00
Remi Collet	c6a26cb39d	add CVE	2015-02-18 06:44:41 +01:00
Xinchen Hui	97f8c78b09	Merge branch 'PHP-5.5' of https://git.php.net/repository/php-src into PHP-5.5	2015-02-17 21:17:06 +08:00
Stanislav Malyshev	213725057e	fix TS build	2015-02-17 07:47:12 +01:00
Stanislav Malyshev	24f8a68d0a	5.4.39 next	2015-02-17 07:34:00 +01:00
Stanislav Malyshev	2e8cd42974	update news	2015-02-17 06:58:14 +01:00
Stanislav Malyshev	cf7d8eabcc	Merge branch 'PHP-5.4' into PHP-5.5 * PHP-5.4: Port for for bug #68552 Fix bug #68942 (Use after free vulnerability in unserialize() with DateTimeZone) - BFN	2015-02-17 06:53:48 +01:00
Stanislav Malyshev	29a4e710de	Fix bug #68942 (Use after free vulnerability in unserialize() with DateTimeZone)	2015-02-17 06:53:27 +01:00
Stanislav Malyshev	bdfe457a2c	Port for for bug #68552	2015-02-17 06:53:02 +01:00
Stanislav Malyshev	7b18981830	Fix bug #68942 (Use after free vulnerability in unserialize() with DateTimeZone) Conflicts: ext/date/php_date.c	2015-02-17 06:43:51 +01:00
Xinchen Hui	66d3095993	Fixed bug #69038 (switch(SOMECONSTANT) misbehaves)	2015-02-17 11:34:57 +08:00
Felipe Pena	82d347a477	- BFN	2015-02-17 01:14:05 -02:00
Felipe Pena	94742054a8	Merge branch 'PHP-5.4' into PHP-5.5 * PHP-5.4: - Fixed bug #67827 (broken detection of system crypt sha256/sha512 support) - Fixed bug #67427 (SoapServer cannot handle large messages) patch by: brandt at docoloc dot de Update NEWS	2015-02-17 01:08:07 -02:00
Felipe Pena	8f9ab04d93	- Fixed bug #67827 (broken detection of system crypt sha256/sha512 support)	2015-02-17 00:23:47 -02:00
Felipe Pena	35a68c276d	- Fix merge	2015-02-16 13:09:40 -02:00
Felipe Pena	e08bef442c	- Fixed bug #67427 (SoapServer cannot handle large messages) patch by: brandt at docoloc dot de	2015-02-16 13:07:26 -02:00
Antony Dovgal	dbf7d525a5	BFN	2015-02-16 15:23:13 +03:00
Antony Dovgal	1d94cd4bfa	Merge branch 'pull-request/995' into PHP-5.5 * pull-request/995: fix bug #68822 (request time is reset too early)	2015-02-16 15:20:39 +03:00
redfoxli	3664345aba	fix bug #68822 (request time is reset too early) this caused wrong time in the logs	2015-02-16 15:10:09 +03:00
Xinchen Hui	a620b79040	Fixed bug #69054 (Null dereference in readline_(read\|write)_history() without parameters)	2015-02-15 22:54:05 +08:00
Xinchen Hui	7667f8efc6	Fixed bug #68638 (pg_update() fails to store infinite values)	2015-02-14 22:17:01 +08:00
Xinchen Hui	40a94597ae	Merge branch 'PHP-5.4' of https://github.com/wfelipew/php-src into PHP-5.5	2015-02-14 22:03:53 +08:00
Yasuo Ohgaki	c0dd221a3a	Update NEWS	2015-02-14 05:41:04 +09:00
Yasuo Ohgaki	5b6269a253	Update NEWS	2015-02-14 05:34:57 +09:00
Yasuo Ohgaki	3ea76a768c	Merge branch 'PHP-5.4' into PHP-5.5 * PHP-5.4: Add NULL byte protection to exec, system and passthru	2015-02-14 05:26:54 +09:00
Yasuo Ohgaki	a8722f5330	Add NULL byte protection to exec, system and passthru	2015-02-14 05:25:04 +09:00
Anatol Belski	5ff77b005b	fix condition	2015-02-13 13:39:46 +01:00
Xinchen Hui	3a71fa36a2	Micro opt	2015-02-13 13:09:56 +08:00
Xinchen Hui	371c016986	Merge branch 'PHP-5.5' of https://git.php.net/repository/php-src into PHP-5.5	2015-02-13 12:54:04 +08:00
Xinchen Hui	68ab716f18	Fixed #69015 (php-cgi's getopt does not see $argv) No test script is added because of complicated	2015-02-13 12:53:34 +08:00
William Felipe Welter	0421404b73	Fixed bug #68638 pg_update() fails to store infinite values Fix indent	2015-02-12 23:39:54 -02:00
Anatol Belski	b5aca81de1	backport gd config.w32 to support freetype 2.5	2015-02-12 20:27:48 +01:00
Xinchen Hui	c2062ca470	Added test for #69017	2015-02-12 11:28:16 +08:00
Xinchen Hui	f2940b7120	Fixed bug #69017 (Fail to push to the empty array with the constant value defined in class scope)	2015-02-12 10:59:28 +08:00
Lior Kaplan	e6d8bad618	Bug #55508 was fixed in 5.5.19 with `15ba757a`, not in 5.5.18 See https://github.com/php/php-src/pull/631#issuecomment-61969527	2015-02-11 13:20:44 +02:00
Lior Kaplan	1ebf6fba42	Add missing NEWS entry for revert of bug #41631	2015-02-11 13:15:18 +02:00
Lior Kaplan	b582aa9a44	Add missing NEWS entry for bug #68027	2015-02-11 13:13:03 +02:00
Lior Kaplan	bb16a6b2c2	Align format for bug #68799	2015-02-11 13:11:55 +02:00
Lior Kaplan	f0b329df50	Bug #68361 was fixed in 5.5.20 using `327d4f9a`, not in 5.5.19	2015-02-11 13:08:19 +02:00
Lior Kaplan	7bcf62a05b	Bug #55618 was fixed in 5.5.21 using `eaf107c0`	2015-02-11 13:04:32 +02:00
Lior Kaplan	0d68d0a69b	Add security bugs fixed in 5.5.18	2015-02-11 12:02:39 +02:00
Lior Kaplan	e06da17931	Add CVE ID to bug #68676	2015-02-11 12:00:19 +02:00
Lior Kaplan	e7c7788e20	Align email format for recent NEWS entries	2015-02-11 11:05:02 +02:00
Anatol Belski	bc3e88b9af	fix dir separator in test	2015-02-10 16:58:59 +01:00
Ferenc Kovacs	bf9fb65001	oops, forgot sudo for make install	2015-02-10 11:18:19 +01:00
Ferenc Kovacs	a8d001aedf	add make install	2015-02-10 10:34:52 +01:00
William Felipe Welter	60d5cdf137	Fixed bug #68638 pg_update() fails to store infinite values Check if value is "infinity" with strcasestr() to add quotes	2015-02-09 20:35:18 -02:00
Daniel Lowrey	f2b12424c0	NEWS	2015-02-09 11:42:40 -05:00
Daniel Lowrey	1eef4f2a0c	Miscellaneous cleanup	2015-02-09 11:42:17 -05:00
Daniel Lowrey	a8cb1d2b85	Merge branch 'PHP-5.5' of github.com:bbroerman30/php-src into PHP-5.5	2015-02-09 11:40:04 -05:00
Xinchen Hui	d078c59ed9	Merge branch 'improve-bug67436' of https://github.com/reeze/php-src into PHP-5.5	2015-02-09 11:31:59 +08:00
Bob Weinand	fc444fbc70	Shut up, my lovely compiler; I do not like your warnings Conflicts: Zend/zend_object_handlers.c	2015-02-09 11:23:35 +08:00
George Wang	c892127f76	Fixed #68790 (Missing return)	2015-02-07 12:18:42 -05:00
George Wang	5e3f0f5671	Fixed #68790 (Missing return)	2015-02-07 12:16:54 -05:00
Reeze Xia	4d034b1a1e	Improve tests for bug 67436 I always use a.php or b.php for local testing, this diff makes the test more stable	2015-02-07 14:11:09 +08:00
William Felipe Welter	bb3a81c4b4	Fixed bug #68638 pg_update() fails to store infinite values. Add quotes only if "infinity" values are received.	2015-02-07 01:26:12 -02:00
Anatol Belski	9bf95d8291	fix setting default ODBCVER value in config.w32	2015-02-06 19:59:14 +01:00
Anatol Belski	f4319a4f73	updated NEWS	2015-02-06 19:37:01 +01:00
Anatol Belski	a41aa46759	Fixed bug #68964 Allowed memory size exhausted with odbc_exec This is done in two steps: - the ODBCVER has to be rased to 0x0300 which corresponds to Sql Server 9, otherwise the client will not recognize several SQL datatypes - additionally the config scripts was tweaked so then ODBCVER can be overridden, that still allows enabling compatibility with lower versions Bug #67437 might be fixed by this as well.	2015-02-06 19:00:27 +01:00
Anatol Belski	9ef0c39b2b	Removed erroneous condition This condition is always false. Furthermore headers_list() is documented to always return an array.	2015-02-06 09:41:02 +01:00
Stanislav Malyshev	928fdbea08	fix tests	2015-02-05 21:54:47 -08:00
Stanislav Malyshev	067340bbc8	Merge branch 'PHP-5.4' into PHP-5.5 * PHP-5.4: Update header handling to RFC 7230	2015-02-05 20:09:13 -08:00
Stanislav Malyshev	f001c63073	Update header handling to RFC 7230	2015-02-05 20:08:12 -08:00
William Felipe Welter	b64f149176	Test case Bug #68638 pg_update() fails to store infinite values	2015-02-05 13:19:52 -02:00
Stanislav Malyshev	10b15f0f8b	Merge branch 'PHP-5.5' of git.php.net:php-src into PHP-5.5 * 'PHP-5.5' of git.php.net:php-src: Conflicts: main/streams/memory.c	2015-02-05 00:41:35 -08:00
Nayana Hettiarachchi	5446377c6b	Conflicts: main/streams/memory.c	2015-02-05 16:32:30 +08:00
Stanislav Malyshev	ee864f3301	fix test to not hit php.net	2015-02-05 00:11:44 -08:00
Brad Broerman	dddbe0fc33	Update xp_ssl.c Added TSRMLS_CC to php_openssl_sockop_io calls.	2015-02-04 10:13:36 -05:00
William Felipe Welter	cb3833a3be	Fixed bug #68638 pg_update() fails to store infinite values. Regex to check float values changed to accept "infinity" values and ignore case. Quotes are added to prevent syntax error on PostgreSQL.	2015-02-03 22:47:05 -02:00
Brad Broerman	1482ed2d56	reneg and should_close are not yet members of sslsock. Removing...	2015-01-28 22:36:41 -05:00
Brad Broerman	fd4641696c	Updated with SSL fixes (backported from trunk)	2015-01-28 00:04:20 -05:00