NEWS for GA

Merge branch 'PHP-5.5' into PHP-5.5.27
* PHP-5.5: Better fix for bug #69958 update news Fix bug #69669 (mysqlnd is vulnerable to BACKRONYM) Fix bug #69923 - Buffer overflow and stack smashing error in phar_fix_filepath Fix bug #69958 - Segfault in Phar::convertToData on invalid file add missing second argument for ucfirst to the proto Better fix for bug #69958 Better fix for bug #69958 update news Fix bug #69669 (mysqlnd is vulnerable to BACKRONYM) Fix bug #69923 - Buffer overflow and stack smashing error in phar_fix_filepath Fix bug #69958 - Segfault in Phar::convertToData on invalid file fix unknown size of void error 5.5.28 now - Security Only Move strlen() check to php_mail_detect_multiple_crlf() Fixed Bug #69874 : Can't set empty additional_headers for mail() Conflicts: configure.in main/php_version.h
2026-11-09 10:10:50 +00:00 · 2015-07-08 16:55:35 +02:00 · 2015-07-08 16:41:46 +02:00 · 2015-07-07 10:09:34 -07:00 · 2015-07-07 10:08:37 -07:00 · 2015-07-07 09:38:31 -07:00
340 changed files with 109197 additions and 26483 deletions
@@ -3,6 +3,11 @@ language: c
 notifications:
    email: 
       on_failure: change
+    irc:
+      channels:
+        - "irc.efnet.org#php.pecl"
+      on_success: change
+      on_failure: always

 cache: 
    - apt
@@ -1,5 +1,257 @@
-PHP                                                                        NEWS
+PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+09 Jul 2015, PHP 5.5.27
+
+- Core:
+  . Fixed bug #69768 (escapeshell*() doesn't cater to !). (cmb)
+  . Fixed bug #69703 (Use __builtin_clzl on PowerPC).
+    (dja at axtens dot net, Kalle)
+  . Fixed bug #69732 (can induce segmentation fault with basic php code).
+    (Dmitry)
+  . Fixed bug #69642 (Windows 10 reported as Windows 8).
+    (Christian Wenz, Anatol Belski)
+  . Fixed bug #69551 (parse_ini_file() and parse_ini_string() segmentation
+    fault). (Christoph M. Becker)
+  . Fixed bug #69781 (phpinfo() reports Professional Editions of Windows
+    7/8/8.1/10 as "Business"). (Christian Wenz)
+  . Fixed bug #69835 (phpinfo() does not report many Windows SKUs).
+    (Christian Wenz)
+  . Fixed bug #69892 (Different arrays compare indentical due to integer key
+    truncation). (Nikita)
+  . Fixed bug #69874 (Can't set empty additional_headers for mail()), regression
+    from fix to bug #68776. (Yasuo)
+
+- GD:
+  . Fixed bug #61221 (imagegammacorrect function loses alpha channel). (cmb)
+
+- Mysqlnd:
+  . Fixed bug #69669 (mysqlnd is vulnerable to BACKRONYM) (CVE-2015-3152).
+    (Andrey)
+
+- PCRE:
+  . Fixed Bug #53823 (preg_replace: * qualifier on unicode replace garbles the
+    string). (cmb)
+  . Fixed bug #69864 (Segfault in preg_replace_callback) (cmb, ab)
+
+- PDO_pgsql:
+  . Fixed bug #69752 (PDOStatement::execute() leaks memory with DML
+    Statements when closeCuror() is u). (Philip Hofstetter)
+  . Fixed bug #69362 (PDO-pgsql fails to connect if password contains a
+    leading single quote). (Matteo)
+  . Fixed bug #69344 (PDO PgSQL Incorrect binding numeric array with gaps).
+    (Matteo)
+
+- Phar:
+  . Fixed bug #69958 (Segfault in Phar::convertToData on invalid file). (Stas)
+  . Fixed bug #69923 (Buffer overflow and stack smashing error in 
+    phar_fix_filepath). (Stas)
+
+- SimpleXML:
+  . Refactored the fix for bug #66084 (simplexml_load_string() mangles empty
+    node name). (Christoph Michael Becker)
+
+- SPL:
+  . Fixed bug #69737 (Segfault when SplMinHeap::compare produces fatal error).
+    (Stas)
+  . Fixed bug #67805 (SplFileObject setMaxLineLength). (Willian Gustavo Veiga).
+
+11 Jun 2015, PHP 5.5.26
+
+- Core:
+  . Fixed bug #69566 (Conditional jump or move depends on uninitialised value
+    in extension trait). (jbboehr at gmail dot com)
+  . Fixed bug #66048 (temp. directory is cached during multiple requests).
+    (Julien)
+  . Fixed bug #69628 (complex GLOB_BRACE fails on Windows).
+    (Christoph M. Becker)
+  . Improved fix for bug #69545 (Integer overflow in ftp_genlist() resulting in
+    heap overflow). (CVE-2015-4643) (Max Spelsberg)
+  . Fixed bug #69646 (OS command injection vulnerability in escapeshellarg).
+    (CVE-2015-4642) (Anatol Belski)
+  . Fixed bug #69719 (Incorrect handling of paths with NULs). (Stas)
+
+- GD:
+  . Fixed bug #69479 (GD fails to build with newer libvpx). (Remi)
+
+- Iconv:
+  . Fixed bug #48147 (iconv with //IGNORE cuts the string). (Stas)
+
+- Litespeed SAPI:
+  . Fixed bug #68812 (Unchecked return value). (George Wang)
+
+- Mail:
+  . Fixed bug #68776 (mail() does not have mail header injection prevention for
+    additional headers). (Yasuo)
+
+- MCrypt:
+  . Added file descriptor caching to mcrypt_create_iv() (Leigh)
+
+- PCRE:
+  . Upgraded pcrelib to 8.37. (CVE-2015-2325, CVE-2015-2326)
+
+- Phar:
+  . Fixed bug #69680 (phar symlink in binary directory broken).
+    (Matteo Bernardini, Remi)
+
+- Postgres:
+  . Fixed bug #69667 (segfault in php_pgsql_meta_data). (CVE-2015-4644) (Remi)
+
+- Opcache
+  . Fixed bug #69549 (Memory leak with opcache.optimization_level=0xFFFFFFFF).
+    (Laruence, Dmitry)
+
+- Sqlite3:
+  . Upgrade bundled sqlite to 3.8.10.2. (CVE-2015-3414, CVE-2015-3415,
+    CVE-2015-3416) (Kaplan)
+
+14 May 2015, PHP 5.5.25
+
+- Core:
+  . Fixed bug #69364 (PHP Multipart/form-data remote dos Vulnerability).
+    (CVE-2015-4024) (Stas)
+  . Fixed bug #69403 (str_repeat() sign mismatch based memory corruption). 
+    (Stas)
+  . Fixed bug #69418 (CVE-2006-7243 fix regressions in 5.4+). (CVE-2015-4025)
+    (Stas)
+  . Fixed bug #69522 (heap buffer overflow in unpack()). (Stas)
+  . Fixed bug #69467 (Wrong checked for the interface by using Trait). 
+    (Laruence)
+  . Fixed bug #69420 (Invalid read in zend_std_get_method). (Laruence)
+  . Fixed bug #60022 ("use statement [...] has no effect" depends on leading
+    backslash). (Nikita)
+  . Fixed bug #67314 (Segmentation fault in gc_remove_zval_from_buffer).
+    (Dmitry)
+  . Fixed bug #68652 (segmentation fault in destructor). (Dmitry)
+  . Fixed bug #69419 (Returning compatible sub generator produces a warning).
+    (Nikita)
+  . Fixed bug #69472 (php_sys_readlink ignores misc errors from 
+    GetFinalPathNameByHandleA). (Jan Starke)
+
+- FTP:
+  . Fixed bug #69545 (Integer overflow in ftp_genlist() resulting in heap
+    overflow). (CVE-2015-4022) (Stas)
+
+- ODBC:
+  . Fixed bug #69354 (Incorrect use of SQLColAttributes with ODBC 3.0).
+    (Anatol)
+  . Fixed bug #69474 (ODBC: Query with same field name from two tables returns
+    incorrect result). (Anatol)
+  . Fixed bug #69381 (out of memory with sage odbc driver). (Frederic Marchall,
+    Anatol Belski)
+
+- OpenSSL:
+  . Fixed bug #69402 (Reading empty SSL stream hangs until timeout).
+    (Daniel Lowrey)
+
+- PCNTL:
+  . Fixed bug #68598 (pcntl_exec() should not allow null char). (CVE-2015-4026)
+    (Stas)
+
+- Phar:
+  . Fixed bug #69453 (Memory Corruption in phar_parse_tarfile when entry
+    filename starts with null). (CVE-2015-4021) (Stas)
+
+16 Apr 2015, PHP 5.5.24
+
+- Apache2handler:
+  . Fixed bug #69218 (potential remote code execution with apache 2.4
+    apache2handler). (Gerrit Venema)
+
+- Core:
+  . Fixed bug #66609 (php crashes with __get() and ++ operator in some cases).
+    (Dmitry, Laruence)
+  . Fixed bug #67626 (User exceptions not properly handled in streams). 
+    (Julian)
+  . Fixed bug #68021 (get_browser() browser_name_regex returns non-utf-8
+    characters). (Tjerk)
+  . Fixed bug #68917 (parse_url fails on some partial urls). (Wei Dai)
+  . Fixed bug #69134 (Per Directory Values overrides PHP_INI_SYSTEM
+    configuration options). (Anatol Belski)
+  . Additional fix for bug #69152 (Type confusion vulnerability in
+    exception::getTraceAsString). (Stas)
+  . Fixed bug #69212 (Leaking VIA_HANDLER func when exception thrown in
+    __call/... arg passing). (Nikita)
+  . Fixed bug #69221 (Segmentation fault when using a generator in combination
+    with an Iterator). (Nikita)
+  . Fixed bug #69337 (php_stream_url_wrap_http_ex() type-confusion
+    vulnerability). (Stas)
+  . Fixed bug #69353 (Missing null byte checks for paths in various PHP
+    extensions). (Stas)
+
+- cURL:
+  . Implemented FR#69278 (HTTP2 support). (Masaki Kagaya)
+  . Fixed bug #68739 (Missing break / control flow). (Laruence)
+  . Fixed bug #69316 (Use-after-free in php_curl related to
+    CURLOPT_FILE/_INFILE/_WRITEHEADER). (Laruence)
+
+- Date:
+  . Export date_get_immutable_ce so that it can be used by extensions. (Derick
+    Rethans)
+  . Fixed bug #69336 (Issues with "last day of <monthname>"). (Derick Rethans)
+
+- Enchant:
+  . Fixed bug #65406 (Enchant broker plugins are in the wrong place in windows
+    builds). (Anatol)
+
+- Ereg:
+  . Fixed bug #68740 (NULL Pointer Dereference). (Laruence)
+
+- Fileinfo:
+  . Fixed bug #68819 (Fileinfo on specific file causes spurious OOM and/or
+    segfault). (Anatol Belski)
+
+- Filter:
+  . Fixed bug #69202 (FILTER_FLAG_STRIP_BACKTICK ignored unless other
+    flags are used). (Jeff Welch)
+  . Fixed bug #69203 (FILTER_FLAG_STRIP_HIGH doesn't strip ASCII 127). (Jeff
+    Welch)
+
+- Mbstring:
+  . Fixed bug #68846 (False detection of CJK Unified Ideographs Extension E).
+    (Masaki Kagaya)
+
+- ODBC:
+  . Fixed bug #69354 (Incorrect use of SQLColAttributes with ODBC 3.0).
+    (Anatol)
+
+- OPCache:
+  . Fixed bug #69281 (opcache_is_script_cached no longer works). (danack)
+  . Fixed bug #68677 (Use After Free). (CVE-2015-1351) (Laruence)
+
+- OpenSSL:
+  . Fixed bug #67403 (Add signatureType to openssl_x509_parse).
+  . Add a check for RAND_egd to allow compiling against LibreSSL (Leigh)
+
+- Phar:
+  . Fixed bug #64343 (PharData::extractTo fails for tarball created by BSD tar).
+    (Mike)
+  . Fixed bug #64931 (phar_add_file is too restrictive on filename). (Mike)
+  . Fixed bug #65467 (Call to undefined method cli_arg_typ_string). (Mike)
+  . Fixed bug #67761 (Phar::mapPhar fails for Phars inside a path containing 
+    ".tar"). (Mike)
+  . Fixed bug #69324 (Buffer Over-read in unserialize when parsing Phar). (Stas)
+  . Fixed bug #69441 (Buffer Overflow when parsing tar/zip/phar in
+    phar_set_inode). (Stas)
+
+- Postgres:
+  . Fixed bug #68741 (Null pointer dereference). (CVE-2015-1352) (Laruence)
+
+- SOAP:
+  . Fixed bug #69152 (Type Confusion Infoleak Vulnerability in unserialize()
+    with SoapFault). (Dmitry)
+  . Fixed bug #69293 (NEW segfault when using SoapClient::__setSoapHeader 
+     (bisected, regression)). (thomas at shadowweb dot org, Laruence)
+
+- SPL:
+  . Fixed bug #69227 (Use after free in zval_scan caused by
+     spl_object_storage_get_gc). (adam dot scarr at 99designs dot com)
+
+- Sqlite3:
+  . Fixed bug #68760 (SQLITE segfaults if custom collator throws an exception).
+     (Dan Ackroyd)
+  . Fixed bug #69287 (Upgrade bundled sqlite to 3.8.8.3). (Anatol)
+  . Fixed bug #66550 (SQLite prepared statement use-after-free). (Sean Heelan)
+
 19 Mar 2015, PHP 5.5.23

 - Core:
@@ -18,10 +270,12 @@ PHP                                                                        NEWS
  . Fixed bug #68166 (Exception with invalid character causes segv). (Rasmus)
  . Fixed bug #69141 (Missing arguments in reflection info for some builtin
    functions). (kostyantyn dot lysyy at oracle dot com)
-  . Fixed bug #68976 (Use After Free Vulnerability in unserialize()). (Stas)
+  . Fixed bug #68976 (Use After Free Vulnerability in unserialize()).
+    (CVE-2015-2787) (Stas)
  . Fixed bug #69134 (Per Directory Values overrides PHP_INI_SYSTEM
    configuration options). (Anatol Belski)
-  . Fixed bug #69207 (move_uploaded_file allows nulls in path). (Stas)
+  . Fixed bug #69207 (move_uploaded_file allows nulls in path). (CVE-2015-2348)
+    (Stas)

 - CGI:
  . Fixed bug #69015 (php-cgi's getopt does not see $argv). (Laruence)
@@ -36,7 +290,7 @@ PHP                                                                        NEWS
    by libcurl. (Linus Unneback)

 - Ereg:
-  . Fixed bug #69248 (heap overflow vulnerability in regcomp.c). (Stas)
+  . Fixed bug #69248 (heap overflow vulnerability in regcomp.c). (CVE-2015-2305) (Stas)

 - FPM:
  . Fixed bug #68822 (request time is reset too early). (honghu069 at 163 dot com)
@@ -72,7 +326,7 @@ PHP                                                                        NEWS

 - ZIP:
  . Fixed bug #69253 (ZIP Integer Overflow leads to writing past heap
-    boundary) (CVE-2015-2331). (Stas)
+    boundary). (CVE-2015-2331) (Stas)

 19 Feb 2015, PHP 5.5.22

@@ -95,7 +349,7 @@ PHP                                                                        NEWS

 - Enchant: 
  . Fixed bug #68552 (heap buffer overflow in enchant_broker_request_dict()).
-    (Antony)
+    (CVE-2014-9705) (Antony)

 - Fileinfo:
  . Fixed bug #68827 (Double free with disabled ZMM). (Joshua Rogers)
@@ -114,7 +368,8 @@ PHP                                                                        NEWS
    named pipes). (steffenb198 at aol dot com)

 - Phar:
-  . Fixed bug #68901 (use after free). (bugreports at internot dot info)
+  . Fixed bug #68901 (use after free). (CVE-2015-2301)
+    (bugreports at internot dot info)

 - Pgsql:
  . Fixed Bug #65199 'pg_copy_from() modifies input array variable). (Yasuo)
@@ -175,7 +430,7 @@ PHP                                                                        NEWS
    CURLOPT_RETURNTRANSFER isn't set). (Jille Timmermans)

 - EXIF:
-  . Fixed bug #68799 (Free called on unitialized pointer). (CVE-2015-0232)
+  . Fixed bug #68799 (Free called on uninitialized pointer). (CVE-2015-0232)
    (Stas)

 - Fileinfo:
@@ -183,14 +438,15 @@ PHP                                                                        NEWS
    (Joshua Rogers, Anatol Belski)
  . Removed readelf.c and related code from libmagic sources
    (Remi, Anatol)
-  . Fixed bug #68735 (fileinfo out-of-bounds memory access).
+  . Fixed bug #68735 (fileinfo out-of-bounds memory access). (CVE-2014-9652)
    (Anatol)

 - FPM:
  . Fixed bug #68751 (listen.allowed_clients is broken). (Remi)

 - GD:
-  . Fixed bug #68601 (buffer read overflow in gd_gif_in.c). (Jan Bee, Remi)
+  . Fixed bug #68601 (buffer read overflow in gd_gif_in.c). (CVE-2014-9709)
+    (Jan Bee, Remi)

 - Mbstring:
  . Fixed bug #68504 (--with-libmbfl configure option not present on Windows).
@@ -213,12 +213,14 @@ Getting the stable release announced

 c. ``$PHP_X_MD5`` array and update all the md5 sums

- d. set ``$PHP_X_RC`` to false!
+ d. ``$PHP_X_SHA256`` array and update all the SHA256 sums

- e. Make sure there are no outdated "notes" or edited "date" keys in the
+ e. set ``$PHP_X_RC`` to false!
+
+ f. Make sure there are no outdated "notes" or edited "date" keys in the
 ``$RELEASES[X][$PHP_X_VERSION]["source"]`` array

- f. if the windows builds aren't ready yet prefix the "windows" key with a dot (".windows")
+ g. if the windows builds aren't ready yet prefix the "windows" key with a dot (".windows")

 3. Create the release file (releases/x_y_z.php)
   Usually we use the same content as for point 6, but included in php template
@@ -267,6 +269,9 @@ to upgrade.
 9. Wait an hour or two, then send a mail to php-announce@lists.php.net,
 php-general@lists.php.net and internals@lists.php.net with a text similar to
 http://news.php.net/php.internals/17222.
+Please make sure that the mail to php-announce@ is its own completely seperate email.
+This is to make sure that repiles to the announcement on php-general@ or internals@
+will not accidentally hit the php-announce@ mailinglist.

 Re-releasing the same version (or -pl)
 --------------------------------------
@@ -283,7 +288,9 @@ Re-releasing the same version (or -pl)

 d. ``$PHP_X_MD5`` array and update all the md5 sums

- e. Make sure there are no outdated "notes" or edited "date" keys in the
+ e. ``$PHP_X_SHA256`` array and update all the SHA256 sums
+
+ f. Make sure there are no outdated "notes" or edited "date" keys in the
 ``$RELEASES[X][$PHP_X_VERSION]["source"]`` array

 3. Add a short notice to phpweb stating that there is a new release, and
@@ -300,3 +307,6 @@ to upgrade.
 5. Wait an hour or two, then send a mail to php-announce@lists.php.net,
 php-general@lists.php.net and internals@lists.php.net with a text similar to
 the news entry.
+Please make sure that the mail to php-announce@ is its own completely seperate email.
+This is to make sure that repiles to the announcement on php-general@ or internals@
+will not accidentally hit the php-announce@ mailinglist.
@@ -251,7 +251,7 @@ CWD_API int php_sys_readlink(const char *link, char *target, size_t target_len){
 	}

 	dwRet = pGetFinalPathNameByHandle(hFile, target, MAXPATHLEN, VOLUME_NAME_DOS);
-	if(dwRet >= MAXPATHLEN) {
+	if(dwRet >= MAXPATHLEN || dwRet == 0) {
 		return -1;
 	}

@@ -408,6 +408,7 @@ None
 - cURL:
  - Added CURLOPT_SAFE_UPLOAD to be used with curl_setopt().
  - Added CURL_WRAPPERS_ENABLED to reflect --with-curlwrappers.
+  - Added CURL_HTTP_VERSION_2_0 and CURL_VERSION_HTTP2 in 5.5.24+.

 - GD
  - Added constants for imageflip:
@@ -1,5 +1,5 @@
 --TEST--
-Bug #43201 (Crash on using unitialized vals and __get/__set)
+Bug #43201 (Crash on using uninitialized vals and __get/__set)
 --FILE--
 <?php
 class Foo {
@@ -1,7 +1,5 @@
 --TEST--
 Bug #63336 (invalid E_NOTICE error occur)
--XFAIL--
-Bug is not fixed yet
 --FILE--
 <?php
 error_reporting(E_ALL | E_NOTICE );
@@ -18,7 +16,7 @@ class Child extends Base {
    public function bar($var, $more=self::DUMMY) { return true; }
 }
 ?>
--EXPECT--
-Strict Standards: Declaration of Child::foo() should be compatible with Base::foo($var = '123', $more = NULL) in %sbug63336.php on line %d
+--EXPECTF--
+Strict Standards: Declaration of Child::foo() should be compatible with Base::foo($var = TEST, $more = NULL) in %sbug63336.php on line %d

-Strict Standards: Declaration of Child::bar() should be compatible with Base::bar($var, $more = 'XXX') in %sbug63336.php on line %d
+Strict Standards: Declaration of Child::bar() should be compatible with Base::bar($more = self::DUMMY) in %sbug63336.php on line %d
@@ -0,0 +1,28 @@
+--TEST--
+Bug #66609 (php crashes with __get() and ++ operator in some cases)
+--FILE--
+<?php
+$bar = new Bar;
+$foo = new Foo;
+class Bar {
+	public function __get($x) {
+		global $foo;
+		return $foo->foo;
+	}
+}
+class Foo {
+	public function __get($x) {
+		global $bar;
+		return $bar->bar;
+	}
+}
+$foo->blah += 1; //crash
++$foo->blah;    //crash
+$foo->blah++;    //crash
+$foo->blah--;    //crash
+--$foo->blah;    //crash
+echo "okey";
+?>
+--EXPECTF--
+Notice: Undefined property: Bar::$bar in %sbug66609.php on line %d
+okey
@@ -0,0 +1,22 @@
+--TEST--
+Bug #67314 (Segmentation fault in gc_remove_zval_from_buffer)
+--FILE--
+<?php
+function crash()
+{
+    $notDefined[$i] = 'test';
+}
+
+function error_handler() { return false; }
+
+set_error_handler('error_handler');
+crash();
+echo "made it once\n";
+crash();
+echo "ok\n";
+--EXPECTF--
+Notice: Undefined variable: i in %sbug67314.php on line 4
+made it once
+
+Notice: Undefined variable: i in %sbug67314.php on line 4
+ok
@@ -2,7 +2,7 @@
 bug67436: Autoloader isn't called if user defined error handler is present

 --INI--
-error_reporting=
+error_reporting=-1

 --FILE--
 <?php
@@ -0,0 +1,40 @@
+--TEST--
+Bug #68652 (segmentation fault in destructor)
+--FILE--
+<?php
+class Foo {
+
+    private static $instance;
+    public static function getInstance() {
+        if (isset(self::$instance)) {
+            return self::$instance;
+        }
+        return self::$instance = new self();
+    }
+
+    public function __destruct() {
+        Bar::getInstance();
+    }
+}
+
+class Bar {
+
+    private static $instance;
+    public static function getInstance() {
+        if (isset(self::$instance)) {
+            return self::$instance;
+        }
+        return self::$instance = new self();
+    }
+
+    public function __destruct() {
+        Foo::getInstance();
+    }
+}
+
+
+$foo = new Foo();
+?>
+--EXPECTF--
+Fatal error: Access to undeclared static property: Bar::$instance in %sbug68652.php on line %d
+
@@ -0,0 +1,43 @@
+--TEST--
+Bug #69212: Leaking VIA_HANDLER func when exception thrown in __call/... arg passing
+--FILE--
+<?php
+
+class Test {
+    public static function __callStatic($method, $args) {}
+    public function __call($method, $args) {}
+}
+
+function do_throw() { throw new Exception; }
+
+try {
+    Test::foo(do_throw());
+} catch (Exception $e) {
+    echo "Caught!\n";
+}
+try {
+    (new Test)->bar(do_throw());
+} catch (Exception $e) {
+    echo "Caught!\n";
+}
+
+try {
+	$f = function () {};
+	$f->__invoke(do_throw());
+} catch (Exception $e) {
+	echo "Caught!\n";
+}
+
+try {
+	$t = new Test;
+	$f->__invoke($t->bar(Test::foo(do_throw())));
+} catch (Exception $e) {
+	echo "Caught!\n";
+}
+
+?>
+--EXPECT--
+Caught!
+Caught!
+Caught!
+Caught!
@@ -0,0 +1,24 @@
+--TEST--
+Bug #69221: Segmentation fault when using a generator in combination with an Iterator
+--FILE--
+<?php
+
+function gen() {
+	yield 1;
+};
+
+$gen1 = gen();
+$gen2 = (object) $gen1;
+
+foreach ($gen1 as $v1) {
+    foreach ($gen2 as $v2) {
+        break 2;
+    }
+}
+
+unset($gen1);
+foreach ($gen2 as $v) { var_dump($v); }
+
+?>
+--EXPECTF--
+int(1)
@@ -0,0 +1,20 @@
+--TEST--
+Bug #69221: Segmentation fault when using a generator in combination with an Iterator (2)
+--FILE--
+<?php
+
+$gen = function() {
+    yield 1;
+};
+
+$iter = new IteratorIterator($gen());
+$ngen = $iter->getInnerIterator();
+
+var_dump(iterator_to_array($ngen, false));
+
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  int(1)
+}
@@ -0,0 +1,30 @@
+--TEST--
+Bug #69420 (Invalid read in zend_std_get_method)
+--FILE--
+<?php
+
+trait T {
+	protected function test() {
+		echo "okey";
+	}
+}
+
+
+class A {
+	protected function test() {
+	}
+}
+
+class B extends A {
+	use T;
+	public function foo() {
+		$this->test();
+	}
+}
+
+
+$b = new B();
+$b->foo();
+?>
+--EXPECT--
+okey
@@ -0,0 +1,21 @@
+--TEST--
+Bug #69467 (Wrong checked for the interface by using Trait)
+--FILE--
+<?php
+interface Baz {
+    public function bad();
+}
+
+trait Bar{
+    protected function bad(){}
+}
+
+class Foo implements Baz{
+    use Bar;
+}
+
+$test = new Foo();
+var_dump($test instanceof Baz);
+?>
+--EXPECTF--
+Fatal error: Access level to Bar::bad() must be public (as in class Baz) in %sbug69467.php on line %d
@@ -0,0 +1,16 @@
+--TEST--
+Bug #69551 - parse_ini_file() and parse_ini_string() segmentation fault
+--FILE--
+<?php
+$ini = <<<INI
+[Network.eth0]
+SubnetMask = "
+"
+INI;
+$settings = parse_ini_string($ini, false, INI_SCANNER_RAW);
+var_dump($settings);
+?>
+--EXPECTF--
+Warning: syntax error, unexpected '"' in Unknown on line %d
+ in %s on line %d
+bool(false)
@@ -0,0 +1,30 @@
+--TEST--
+Bug #69732 (can induce segmentation fault with basic php code)
+--FILE--
+<?php
+class wpq {
+    private $unreferenced;
+ 
+    public function __get($name) {
+        return $this->$name . "XXX";
+    }
+}
+ 
+function ret_assoc() {
+	$x = "XXX";
+    return array('foo' => 'bar', $x);
+}
+ 
+$wpq = new wpq;
+$wpq->interesting =& ret_assoc();
+$x = $wpq->interesting;
+printf("%s\n", $x);
+--EXPECTF--
+Notice: Undefined property: wpq::$interesting in %sbug69732.php on line 6
+
+Notice: Indirect modification of overloaded property wpq::$interesting has no effect in %sbug69732.php on line 16
+
+Strict Standards: Only variables should be assigned by reference in %sbug69732.php on line 16
+
+Notice: Undefined property: wpq::$interesting in %sbug69732.php on line 6
+XXX
@@ -0,0 +1,10 @@
+--TEST--
+Bug #69892: Different arrays compare indentical due to integer key truncation
+--SKIPIF--
+<?php if (PHP_INT_SIZE != 8) die("skip this test is for 64bit platforms only"); ?>
+--FILE--
+<?php
+var_dump([0 => 0] === [0x100000000 => 0]);
+?>
+--EXPECT--
+bool(false)
@@ -0,0 +1,22 @@
+--TEST--
+Bug #69419: Returning compatible sub generator produces a warning
+--FILE--
+<?php
+
+function & genRefInner() {
+    $var = 1;
+    yield $var;
+}
+
+function & genRefOuter() {
+    return genRefInner();
+}
+
+foreach(genRefOuter() as $i) {
+    var_dump($i);
+}
+
+?>
+--EXPECTF--
+Notice: Only variable references should be returned by reference in %s on line %d
+int(1)
@@ -3,6 +3,8 @@
 --FILE--
 <?php
 use A;
+use \B;
 --EXPECTF--
 Warning: The use statement with non-compound name 'A' has no effect in %sns_033.php on line 2

+Warning: The use statement with non-compound name 'B' has no effect in %sns_033.php on line 3
@@ -678,7 +678,7 @@ static inline unsigned int zend_mm_high_bit(size_t _size)
 	__asm {
 		bsr eax, _size
 	}
-#elif defined(__GNUC__) && (defined(__arm__) ||  defined(__aarch64__))
+#elif defined(__GNUC__) && (defined(__arm__) || defined(__aarch64__) || defined(__powerpc__))
 	return (8 * SIZEOF_SIZE_T - 1) - __builtin_clzl(_size);
 #else
 	unsigned int n = 0;
@@ -706,7 +706,7 @@ static inline unsigned int zend_mm_low_bit(size_t _size)
 	__asm {
 		bsf eax, _size
   }
-#elif defined(__GNUC__) && (defined(__arm__) || defined(__aarch64__))
+#elif defined(__GNUC__) && (defined(__arm__) || defined(__aarch64__) || defined(__powerpc__))
 	return __builtin_ctzl(_size);
 #else
 	static const int offset[16] = {4,0,1,0,2,0,1,0,3,0,1,0,2,0,1,0};
@@ -984,7 +984,7 @@ static void zend_mm_random(unsigned char *buf, size_t size) /* {{{ */
 	int has_context = 0;

 	if (!CryptAcquireContext(&hCryptProv, NULL, NULL, PROV_RSA_FULL, 0)) {
-		/* Could mean that the key container does not exist, let try 
+		/* Could mean that the key container does not exist, let try
 		   again by asking for a new one */
 		if (GetLastError() == NTE_BAD_KEYSET) {
 			if (CryptAcquireContext(&hCryptProv, NULL, NULL, PROV_RSA_FULL, CRYPT_NEWKEYSET)) {
@@ -1348,7 +1348,7 @@ static int zend_mm_check_ptr(zend_mm_heap *heap, void *ptr, int silent ZEND_FILE
 	}
 	if (!silent) {
 		TSRMLS_FETCH();
-		
+
 		zend_message_dispatcher(ZMSG_LOG_SCRIPT_NAME, NULL TSRMLS_CC);
 		zend_debug_alloc_output("---------------------------------------\n");
 		zend_debug_alloc_output("%s(%d) : Block "PTR_FMT" status:\n" ZEND_FILE_LINE_RELAY_CC, ptr);
@@ -2175,7 +2175,7 @@ static void *_zend_mm_realloc_int(zend_mm_heap *heap, void *p, size_t size ZEND_
 #if ZEND_MM_CACHE
 	if (ZEND_MM_SMALL_SIZE(true_size)) {
 		size_t index = ZEND_MM_BUCKET_INDEX(true_size);
-		
+
 		if (heap->cache[index] != NULL) {
 			zend_mm_free_block *best_fit;
 			zend_mm_free_block **cache;
@@ -2188,7 +2188,7 @@ static void *_zend_mm_realloc_int(zend_mm_heap *heap, void *p, size_t size ZEND_
 			heap->cache[index] = best_fit->prev_free_block;
 			ZEND_MM_CHECK_MAGIC(best_fit, MEM_BLOCK_CACHED);
 			ZEND_MM_SET_DEBUG_INFO(best_fit, size, 1, 0);
-	
+
 			ptr = ZEND_MM_DATA_OF(best_fit);

 #if ZEND_DEBUG || ZEND_MM_HEAP_PROTECTION
@@ -2470,7 +2470,7 @@ static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
 	     : "%0"(res),
 	       "rm"(size),
 	       "rm"(offset));
-	
+
 	if (UNEXPECTED(overflow)) {
 		zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
 		return 0;
@@ -2619,7 +2619,7 @@ ZEND_API void *_ecalloc(size_t nmemb, size_t size ZEND_FILE_LINE_DC ZEND_FILE_LI

 ZEND_API char *_estrdup(const char *s ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)
 {
-	int length;
+	size_t length;
 	char *p;
 #ifdef ZEND_SIGNALS
 	TSRMLS_FETCH();
@@ -2627,13 +2627,13 @@ ZEND_API char *_estrdup(const char *s ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)

 	HANDLE_BLOCK_INTERRUPTIONS();

-	length = strlen(s)+1;
-	p = (char *) _emalloc(length ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
+	length = strlen(s);
+	p = (char *) _emalloc(safe_address(length, 1, 1) ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
 	if (UNEXPECTED(p == NULL)) {
 		HANDLE_UNBLOCK_INTERRUPTIONS();
 		return p;
 	}
-	memcpy(p, s, length);
+	memcpy(p, s, length+1);
 	HANDLE_UNBLOCK_INTERRUPTIONS();
 	return p;
 }
@@ -2647,7 +2647,7 @@ ZEND_API char *_estrndup(const char *s, uint length ZEND_FILE_LINE_DC ZEND_FILE_

 	HANDLE_BLOCK_INTERRUPTIONS();

-	p = (char *) _emalloc(length+1 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
+	p = (char *) _emalloc(safe_address(length, 1, 1) ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
 	if (UNEXPECTED(p == NULL)) {
 		HANDLE_UNBLOCK_INTERRUPTIONS();
 		return p;
@@ -2668,7 +2668,7 @@ ZEND_API char *zend_strndup(const char *s, uint length)

 	HANDLE_BLOCK_INTERRUPTIONS();

-	p = (char *) malloc(length+1);
+	p = (char *) malloc(safe_address(length, 1, 1));
 	if (UNEXPECTED(p == NULL)) {
 		HANDLE_UNBLOCK_INTERRUPTIONS();
 		return p;
@@ -3912,7 +3912,8 @@ static void zend_add_trait_method(zend_class_entry *ce, const char *name, const
 			}
 			zend_hash_quick_update(*overriden, arKey, nKeyLength, h, fn, sizeof(zend_function), (void**)&fn);
 			return;
-		} else if (existing_fn->common.fn_flags & ZEND_ACC_ABSTRACT) {
+		} else if (existing_fn->common.fn_flags & ZEND_ACC_ABSTRACT &&
+				(existing_fn->common.scope->ce_flags & ZEND_ACC_INTERFACE) == 0) {
 			/* Make sure the trait method is compatible with previosly declared abstract method */
 			if (!zend_traits_method_compatibility_check(fn, existing_fn TSRMLS_CC)) {
 				zend_error(E_COMPILE_ERROR, "Declaration of %s must be compatible with %s",
@@ -3942,6 +3943,7 @@ static void zend_add_trait_method(zend_class_entry *ce, const char *name, const
 			/* inherited members are overridden by members inserted by traits */
 			/* check whether the trait method fulfills the inheritance requirements */
 			do_inheritance_check_on_method(fn, existing_fn TSRMLS_CC);
+			fn->common.prototype = NULL;
 		}
 	}

@@ -3960,7 +3962,7 @@ static int zend_fixup_trait_method(zend_function *fn, zend_class_entry *ce TSRML
 		if (fn->common.fn_flags & ZEND_ACC_ABSTRACT) {
 			ce->ce_flags |= ZEND_ACC_IMPLICIT_ABSTRACT_CLASS;
 		}
-		if (fn->op_array.static_variables) {
+		if (fn->type == ZEND_USER_FUNCTION && fn->op_array.static_variables) {
 			ce->ce_flags |= ZEND_HAS_STATIC_IN_METHODS;
 		}
 	}
@@ -7014,7 +7016,7 @@ void zend_do_begin_namespace(const znode *name, zend_bool with_bracket TSRMLS_DC
 }
 /* }}} */

-void zend_do_use(znode *ns_name, znode *new_name, int is_global TSRMLS_DC) /* {{{ */
+void zend_do_use(znode *ns_name, znode *new_name TSRMLS_DC) /* {{{ */
 {
 	char *lcname;
 	zval *name, *ns, tmp;
@@ -7042,7 +7044,7 @@ void zend_do_use(znode *ns_name, znode *new_name, int is_global TSRMLS_DC) /* {{
 		} else {
 			*name = *ns;
 			zval_copy_ctor(name);
-			warn = !is_global && !CG(current_namespace);
+			warn = !CG(current_namespace);
 		}
 	}

@@ -635,7 +635,7 @@ void zend_do_build_namespace_name(znode *result, znode *prefix, znode *name TSRM
 void zend_do_begin_namespace(const znode *name, zend_bool with_brackets TSRMLS_DC);
 void zend_do_end_namespace(TSRMLS_D);
 void zend_verify_namespace(TSRMLS_D);
-void zend_do_use(znode *name, znode *new_name, int is_global TSRMLS_DC);
+void zend_do_use(znode *name, znode *new_name TSRMLS_DC);
 void zend_do_end_compilation(TSRMLS_D);

 void zend_do_resolve_class_name(znode *result, znode *class_name, int is_static TSRMLS_DC);
@@ -587,10 +587,14 @@ ZEND_METHOD(exception, getTraceAsString)

 	DEFAULT_0_PARAMS;
 	
+	trace = zend_read_property(default_exception_ce, getThis(), "trace", sizeof("trace")-1, 1 TSRMLS_CC);
+	if (Z_TYPE_P(trace) != IS_ARRAY) {
+		RETURN_FALSE;
+	}
+
 	res = estrdup("");
 	str = &res;

-	trace = zend_read_property(default_exception_ce, getThis(), "trace", sizeof("trace")-1, 1 TSRMLS_CC);
 	zend_hash_apply_with_arguments(Z_ARRVAL_P(trace) TSRMLS_CC, (apply_func_args_t)_build_trace_string, 3, str, len, &num);

 	s_tmp = emalloc(1 + MAX_LENGTH_OF_LONG + 7 + 1);
@@ -1690,6 +1690,10 @@ ZEND_API void zend_rebuild_symbol_table(TSRMLS_D) /* {{{ */
 			ex->symbol_table = EG(active_symbol_table);
 			for (i = 0; i < ex->op_array->last_var; i++) {
 				if (*EX_CV_NUM(ex, i)) {
+					if (UNEXPECTED(**EX_CV_NUM(ex, i) == &EG(uninitialized_zval))) {
+						Z_DELREF(EG(uninitialized_zval));
+						ALLOC_INIT_ZVAL(**EX_CV_NUM(ex, i));
+					}
 					zend_hash_quick_update(EG(active_symbol_table),
 						ex->op_array->vars[i].name,
 						ex->op_array->vars[i].name_len + 1,
@@ -147,8 +147,6 @@ ZEND_API void gc_zval_possible_root(zval *zv TSRMLS_DC)
 	GC_BENCH_INC(zval_possible_root);

 	if (GC_ZVAL_GET_COLOR(zv) != GC_PURPLE) {
-		GC_ZVAL_SET_PURPLE(zv);
-
 		if (!GC_ZVAL_ADDRESS(zv)) {
 			gc_root_buffer *newRoot = GC_G(unused);

@@ -159,7 +157,6 @@ ZEND_API void gc_zval_possible_root(zval *zv TSRMLS_DC)
 				GC_G(first_unused)++;
 			} else {
 				if (!GC_G(gc_enabled)) {
-					GC_ZVAL_SET_BLACK(zv);
 					return;
 				}
 				zv->refcount__gc++;
@@ -169,10 +166,10 @@ ZEND_API void gc_zval_possible_root(zval *zv TSRMLS_DC)
 				if (!newRoot) {
 					return;
 				}
-				GC_ZVAL_SET_PURPLE(zv);
 				GC_G(unused) = newRoot->prev;
 			}

+			GC_ZVAL_SET_PURPLE(zv);
 			newRoot->next = GC_G(roots).next;
 			newRoot->prev = &GC_G(roots);
 			GC_G(roots).next->prev = newRoot;
@@ -203,7 +200,6 @@ ZEND_API void gc_zobj_possible_root(zval *zv TSRMLS_DC)

 	obj = &EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(zv)].bucket.obj;
 	if (GC_GET_COLOR(obj->buffered) != GC_PURPLE) {
-		GC_SET_PURPLE(obj->buffered);
 		if (!GC_ADDRESS(obj->buffered)) {
 			gc_root_buffer *newRoot = GC_G(unused);

@@ -214,7 +210,6 @@ ZEND_API void gc_zobj_possible_root(zval *zv TSRMLS_DC)
 				GC_G(first_unused)++;
 			} else {
 				if (!GC_G(gc_enabled)) {
-					GC_ZVAL_SET_BLACK(zv);
 					return;
 				}
 				zv->refcount__gc++;
@@ -225,10 +220,10 @@ ZEND_API void gc_zobj_possible_root(zval *zv TSRMLS_DC)
 					return;
 				}
 				obj = &EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(zv)].bucket.obj;
-				GC_SET_PURPLE(obj->buffered);
 				GC_G(unused) = newRoot->prev;
 			}

+			GC_SET_PURPLE(obj->buffered);
 			newRoot->next = GC_G(roots).next;
 			newRoot->prev = &GC_G(roots);
 			GC_G(roots).next->prev = newRoot;
@@ -605,9 +605,9 @@ ZEND_METHOD(Generator, __wakeup)

 static void zend_generator_iterator_dtor(zend_object_iterator *iterator TSRMLS_DC) /* {{{ */
 {
-	zval *object = ((zend_generator_iterator *) iterator)->object;
+	zend_generator_iterator *iter = (zend_generator_iterator *) iterator;

-	zval_ptr_dtor(&object);
+	zend_objects_store_del_ref_by_handle(iter->handle TSRMLS_CC);
 }
 /* }}} */

@@ -699,8 +699,8 @@ zend_object_iterator *zend_generator_get_iterator(zend_class_entry *ce, zval *ob

 	/* We have to keep a reference to the generator object zval around,
 	 * otherwise the generator may be destroyed during iteration. */
-	Z_ADDREF_P(object);
-	iterator->object = object;
+	iterator->handle = Z_OBJ_HANDLE_P(object);
+	zend_objects_store_add_ref_by_handle(iterator->handle TSRMLS_CC);

 	return (zend_object_iterator *) iterator;
 }
@@ -28,9 +28,9 @@ extern ZEND_API zend_class_entry *zend_ce_generator;
 typedef struct _zend_generator_iterator {
 	zend_object_iterator intern;

-	/* The generator object zval has to be stored, because the iterator is
-	 * holding a ref to it, which has to be dtored. */
-	zval *object;
+	/* The generator object handle has to be stored, because the
+	 * iterator is holding a ref to it, which has to be dtored. */
+	zend_object_handle handle;
 } zend_generator_iterator;

 typedef struct _zend_generator {
@@ -1534,11 +1534,10 @@ ZEND_API int zend_hash_compare(HashTable *ht1, HashTable *ht2, compare_func_t co
 		}
 		if (ordered) {
 			if (p1->nKeyLength==0 && p2->nKeyLength==0) { /* numeric indices */
-				result = p1->h - p2->h;
-				if (result!=0) {
+				if (p1->h != p2->h) {
 					HASH_UNPROTECT_RECURSION(ht1); 
 					HASH_UNPROTECT_RECURSION(ht2); 
-					return result;
+					return p1->h > p2->h ? 1 : -1;
 				}
 			} else { /* string indices */
 				result = p1->nKeyLength - p2->nKeyLength;
@@ -1926,7 +1926,7 @@ end_raw_value_chars:
 	}

 	/* Eat leading and trailing double quotes */
-	if (yytext[0] == '"' && yytext[yyleng - 1] == '"') {
+	if (yyleng > 1 && yytext[0] == '"' && yytext[yyleng - 1] == '"') {
 		SCNG(yy_text)++;
 		yyleng = yyleng - 2;
 	} else if (sc) {
@@ -472,7 +472,7 @@ end_raw_value_chars:
 	}

 	/* Eat leading and trailing double quotes */
-	if (yytext[0] == '"' && yytext[yyleng - 1] == '"') {
+	if (yyleng > 1 && yytext[0] == '"' && yytext[yyleng - 1] == '"') {
 		SCNG(yy_text)++;
 		yyleng = yyleng - 2;
 	} else if (sc) {
@@ -249,10 +249,10 @@ use_declarations:
 ;

 use_declaration:
-		namespace_name 			{ zend_do_use(&$1, NULL, 0 TSRMLS_CC); }
-	|	namespace_name T_AS T_STRING	{ zend_do_use(&$1, &$3, 0 TSRMLS_CC); }
-	|	T_NS_SEPARATOR namespace_name { zend_do_use(&$2, NULL, 1 TSRMLS_CC); }
-	|	T_NS_SEPARATOR namespace_name T_AS T_STRING { zend_do_use(&$2, &$4, 1 TSRMLS_CC); }
+		namespace_name 			{ zend_do_use(&$1, NULL TSRMLS_CC); }
+	|	namespace_name T_AS T_STRING	{ zend_do_use(&$1, &$3 TSRMLS_CC); }
+	|	T_NS_SEPARATOR namespace_name { zend_do_use(&$2, NULL TSRMLS_CC); }
+	|	T_NS_SEPARATOR namespace_name T_AS T_STRING { zend_do_use(&$2, &$4 TSRMLS_CC); }
 ;

 constant_declaration:
@@ -162,16 +162,16 @@ static inline void cleanup_user_class_data(zend_class_entry *ce TSRMLS_DC)
 		zend_hash_apply(&ce->function_table, (apply_func_t) zend_cleanup_function_data_full TSRMLS_CC);
 	}
 	if (ce->static_members_table) {
+		zval **static_members = ce->static_members_table;
+		int count = ce->default_static_members_count;
 		int i;

-		for (i = 0; i < ce->default_static_members_count; i++) {
-			if (ce->static_members_table[i]) {
-				zval *p = ce->static_members_table[i];
-				ce->static_members_table[i] = NULL;
-				zval_ptr_dtor(&p);
-			}
+		ce->default_static_members_count = 0;
+		ce->default_static_members_table = ce->static_members_table = NULL;
+		for (i = 0; i < count; i++) {
+			zval_ptr_dtor(&static_members[i]);
 		}
-		ce->static_members_table = NULL;
+		efree(static_members);
 	}
 }

@@ -1319,14 +1319,19 @@ ZEND_API int concat_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{
 			zend_error(E_ERROR, "String size overflow");
 		}

-		Z_STRVAL_P(result) = erealloc(Z_STRVAL_P(result), res_len+1);
+		Z_STRVAL_P(result) = safe_erealloc(Z_STRVAL_P(result), res_len, 1, 1);

 		memcpy(Z_STRVAL_P(result)+Z_STRLEN_P(result), Z_STRVAL_P(op2), Z_STRLEN_P(op2));
 		Z_STRVAL_P(result)[res_len]=0;
 		Z_STRLEN_P(result) = res_len;
 	} else {
 		int length = Z_STRLEN_P(op1) + Z_STRLEN_P(op2);
-		char *buf = (char *) emalloc(length + 1);
+		char *buf;
+
+		if (Z_STRLEN_P(op1) < 0 || Z_STRLEN_P(op2) < 0 || (int) (Z_STRLEN_P(op1) + Z_STRLEN_P(op2)) < 0) {
+			zend_error(E_ERROR, "String size overflow");
+		}
+		buf = (char *) safe_emalloc(length, 1, 1);

 		memcpy(buf, Z_STRVAL_P(op1), Z_STRLEN_P(op1));
 		memcpy(buf + Z_STRLEN_P(op1), Z_STRVAL_P(op2), Z_STRLEN_P(op2));
@@ -380,6 +380,7 @@ ZEND_VM_HELPER_EX(zend_binary_assign_op_obj_helper, VAR|UNUSED|CV, CONST|TMP|VAR
 		if (!have_get_ptr) {
 			zval *z = NULL;

+			Z_ADDREF_P(object);
 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
 				if (Z_OBJ_HT_P(object)->read_property) {
 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
@@ -422,6 +423,7 @@ ZEND_VM_HELPER_EX(zend_binary_assign_op_obj_helper, VAR|UNUSED|CV, CONST|TMP|VAR
 					EX_T(opline->result.var).var.ptr_ptr = NULL;
 				}
 			}
+			zval_ptr_dtor(&object);
 		}

 		if (IS_OP2_TMP_FREE()) {
@@ -640,7 +642,10 @@ ZEND_VM_HELPER_EX(zend_pre_incdec_property_helper, VAR|UNUSED|CV, CONST|TMP|VAR|

 	if (!have_get_ptr) {
 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
-			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval *z;
+			
+			Z_ADDREF_P(object);
+			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);

 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
@@ -657,6 +662,7 @@ ZEND_VM_HELPER_EX(zend_pre_incdec_property_helper, VAR|UNUSED|CV, CONST|TMP|VAR|
 			incdec_op(z);
 			*retval = z;
 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval_ptr_dtor(&object);
 			SELECTIVE_PZVAL_LOCK(*retval, opline);
 			zval_ptr_dtor(&z);
 		} else {
@@ -741,9 +747,10 @@ ZEND_VM_HELPER_EX(zend_post_incdec_property_helper, VAR|UNUSED|CV, CONST|TMP|VAR

 	if (!have_get_ptr) {
 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
-			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
-			zval *z_copy;
+			zval *z, *z_copy;

+			Z_ADDREF_P(object);
+			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);

@@ -762,6 +769,7 @@ ZEND_VM_HELPER_EX(zend_post_incdec_property_helper, VAR|UNUSED|CV, CONST|TMP|VAR
 			incdec_op(z_copy);
 			Z_ADDREF_P(z);
 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval_ptr_dtor(&object);
 			zval_ptr_dtor(&z_copy);
 			zval_ptr_dtor(&z);
 		} else {
@@ -1754,7 +1762,9 @@ ZEND_VM_HANDLER(38, ZEND_ASSIGN, VAR|CV, CONST|TMP|VAR|CV)
 		}
 	}

-	FREE_OP1_VAR_PTR();
+	if (OP1_TYPE == IS_VAR && OP1_FREE) {
+		zval_ptr_dtor(&value);
+	}

 	/* zend_assign_to_variable() always takes care of op2, never free it! */
 	FREE_OP2_IF_VAR();
@@ -1988,13 +1998,12 @@ ZEND_VM_HELPER(zend_do_fcall_common_helper, ANY, ANY)
 			EX_T(opline->result.var).var.ptr = NULL;
 		}
 	} else if (fbc->type == ZEND_USER_FUNCTION) {
+		temp_variable *ret = &EX_T(opline->result.var);
 		EX(original_return_value) = EG(return_value_ptr_ptr);
 		EG(active_symbol_table) = NULL;
 		EG(active_op_array) = &fbc->op_array;
 		EG(return_value_ptr_ptr) = NULL;
 		if (RETURN_VALUE_USED(opline)) {
-			temp_variable *ret = &EX_T(opline->result.var);
-
 			ret->var.ptr = NULL;
 			EG(return_value_ptr_ptr) = &ret->var.ptr;
 			ret->var.ptr_ptr = &ret->var.ptr;
@@ -2003,7 +2012,8 @@ ZEND_VM_HELPER(zend_do_fcall_common_helper, ANY, ANY)

 		if (UNEXPECTED((EG(active_op_array)->fn_flags & ZEND_ACC_GENERATOR) != 0)) {
 			if (RETURN_VALUE_USED(opline)) {
-				EX_T(opline->result.var).var.ptr = zend_generator_create_zval(EG(active_op_array) TSRMLS_CC);
+				ret->var.ptr = zend_generator_create_zval(EG(active_op_array) TSRMLS_CC);
+				ret->var.fcall_returned_reference = 0;
 			}
 		} else if (EXPECTED(zend_execute_ex == execute_ex)) {
 			if (EXPECTED(EG(exception) == NULL)) {
@@ -5034,6 +5044,10 @@ ZEND_VM_HANDLER(149, ZEND_HANDLE_EXCEPTION, ANY, ANY)
 				}
 				zval_ptr_dtor(&call->object);
 			}
+			if (call->fbc->common.fn_flags & ZEND_ACC_CALL_VIA_HANDLER) {
+				efree((char *) call->fbc->common.function_name);
+				efree(call->fbc);
+			}
 			call--;
 		} while (call >= EX(call_slots));
 		EX(call) = NULL;
@@ -5179,7 +5193,6 @@ ZEND_VM_HANDLER(153, ZEND_DECLARE_LAMBDA_FUNCTION, CONST, UNUSED)
 {
 	USE_OPLINE
 	zend_function *op_array;
-	int closure_is_static, closure_is_being_defined_inside_static_context;

 	SAVE_OPLINE();

@@ -5188,9 +5201,9 @@ ZEND_VM_HANDLER(153, ZEND_DECLARE_LAMBDA_FUNCTION, CONST, UNUSED)
 		zend_error_noreturn(E_ERROR, "Base lambda function for closure not found");
 	}

-	closure_is_static = op_array->common.fn_flags & ZEND_ACC_STATIC;
-	closure_is_being_defined_inside_static_context = EX(prev_execute_data) && EX(prev_execute_data)->function_state.function->common.fn_flags & ZEND_ACC_STATIC;
-	if (closure_is_static || closure_is_being_defined_inside_static_context) {
+	if (UNEXPECTED((op_array->common.fn_flags & ZEND_ACC_STATIC) || 
+			(EX(prev_execute_data) &&
+			 EX(prev_execute_data)->function_state.function->common.fn_flags & ZEND_ACC_STATIC))) {
 		zend_create_closure(&EX_T(opline->result.var).tmp_var, (zend_function *) op_array,  EG(called_scope), NULL TSRMLS_CC);
 	} else {
 		zend_create_closure(&EX_T(opline->result.var).tmp_var, (zend_function *) op_array,  EG(scope), EG(This) TSRMLS_CC);
@@ -559,13 +559,12 @@ static int ZEND_FASTCALL zend_do_fcall_common_helper_SPEC(ZEND_OPCODE_HANDLER_AR
 			EX_T(opline->result.var).var.ptr = NULL;
 		}
 	} else if (fbc->type == ZEND_USER_FUNCTION) {
+		temp_variable *ret = &EX_T(opline->result.var);
 		EX(original_return_value) = EG(return_value_ptr_ptr);
 		EG(active_symbol_table) = NULL;
 		EG(active_op_array) = &fbc->op_array;
 		EG(return_value_ptr_ptr) = NULL;
 		if (RETURN_VALUE_USED(opline)) {
-			temp_variable *ret = &EX_T(opline->result.var);
-
 			ret->var.ptr = NULL;
 			EG(return_value_ptr_ptr) = &ret->var.ptr;
 			ret->var.ptr_ptr = &ret->var.ptr;
@@ -574,7 +573,8 @@ static int ZEND_FASTCALL zend_do_fcall_common_helper_SPEC(ZEND_OPCODE_HANDLER_AR

 		if (UNEXPECTED((EG(active_op_array)->fn_flags & ZEND_ACC_GENERATOR) != 0)) {
 			if (RETURN_VALUE_USED(opline)) {
-				EX_T(opline->result.var).var.ptr = zend_generator_create_zval(EG(active_op_array) TSRMLS_CC);
+				ret->var.ptr = zend_generator_create_zval(EG(active_op_array) TSRMLS_CC);
+				ret->var.fcall_returned_reference = 0;
 			}
 		} else if (EXPECTED(zend_execute_ex == execute_ex)) {
 			if (EXPECTED(EG(exception) == NULL)) {
@@ -1022,6 +1022,10 @@ static int ZEND_FASTCALL  ZEND_HANDLE_EXCEPTION_SPEC_HANDLER(ZEND_OPCODE_HANDLER
 				}
 				zval_ptr_dtor(&call->object);
 			}
+			if (call->fbc->common.fn_flags & ZEND_ACC_CALL_VIA_HANDLER) {
+				efree((char *) call->fbc->common.function_name);
+				efree(call->fbc);
+			}
 			call--;
 		} while (call >= EX(call_slots));
 		EX(call) = NULL;
@@ -6490,7 +6494,6 @@ static int ZEND_FASTCALL  ZEND_DECLARE_LAMBDA_FUNCTION_SPEC_CONST_UNUSED_HANDLER
 {
 	USE_OPLINE
 	zend_function *op_array;
-	int closure_is_static, closure_is_being_defined_inside_static_context;

 	SAVE_OPLINE();

@@ -6499,9 +6502,9 @@ static int ZEND_FASTCALL  ZEND_DECLARE_LAMBDA_FUNCTION_SPEC_CONST_UNUSED_HANDLER
 		zend_error_noreturn(E_ERROR, "Base lambda function for closure not found");
 	}

-	closure_is_static = op_array->common.fn_flags & ZEND_ACC_STATIC;
-	closure_is_being_defined_inside_static_context = EX(prev_execute_data) && EX(prev_execute_data)->function_state.function->common.fn_flags & ZEND_ACC_STATIC;
-	if (closure_is_static || closure_is_being_defined_inside_static_context) {
+	if (UNEXPECTED((op_array->common.fn_flags & ZEND_ACC_STATIC) ||
+			(EX(prev_execute_data) &&
+			 EX(prev_execute_data)->function_state.function->common.fn_flags & ZEND_ACC_STATIC))) {
 		zend_create_closure(&EX_T(opline->result.var).tmp_var, (zend_function *) op_array,  EG(called_scope), NULL TSRMLS_CC);
 	} else {
 		zend_create_closure(&EX_T(opline->result.var).tmp_var, (zend_function *) op_array,  EG(scope), EG(This) TSRMLS_CC);
@@ -14156,6 +14159,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_CONST(int (*b
 		if (!have_get_ptr) {
 			zval *z = NULL;

+			Z_ADDREF_P(object);
 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
 				if (Z_OBJ_HT_P(object)->read_property) {
 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
@@ -14198,6 +14202,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_CONST(int (*b
 					EX_T(opline->result.var).var.ptr_ptr = NULL;
 				}
 			}
+			zval_ptr_dtor(&object);
 		}

 		if (0) {
@@ -14415,7 +14420,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_CONST(incdec_t

 	if (!have_get_ptr) {
 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
-			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval *z;
+
+			Z_ADDREF_P(object);
+			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);

 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
@@ -14432,6 +14440,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_CONST(incdec_t
 			incdec_op(z);
 			*retval = z;
 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval_ptr_dtor(&object);
 			SELECTIVE_PZVAL_LOCK(*retval, opline);
 			zval_ptr_dtor(&z);
 		} else {
@@ -14516,9 +14525,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_CONST(incdec_

 	if (!have_get_ptr) {
 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
-			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
-			zval *z_copy;
+			zval *z, *z_copy;

+			Z_ADDREF_P(object);
+			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);

@@ -14537,6 +14547,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_CONST(incdec_
 			incdec_op(z_copy);
 			Z_ADDREF_P(z);
 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval_ptr_dtor(&object);
 			zval_ptr_dtor(&z_copy);
 			zval_ptr_dtor(&z);
 		} else {
@@ -15296,7 +15307,9 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER
 		}
 	}

-	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
+	if (IS_VAR == IS_VAR && (free_op1.var != NULL)) {
+		zval_ptr_dtor(&value);
+	}

 	/* zend_assign_to_variable() always takes care of op2, never free it! */

@@ -16665,6 +16678,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_TMP(int (*bin
 		if (!have_get_ptr) {
 			zval *z = NULL;

+			Z_ADDREF_P(object);
 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
 				if (Z_OBJ_HT_P(object)->read_property) {
 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
@@ -16707,6 +16721,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_TMP(int (*bin
 					EX_T(opline->result.var).var.ptr_ptr = NULL;
 				}
 			}
+			zval_ptr_dtor(&object);
 		}

 		if (1) {
@@ -16925,7 +16940,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_TMP(incdec_t i

 	if (!have_get_ptr) {
 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
-			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval *z;
+
+			Z_ADDREF_P(object);
+			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);

 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
@@ -16942,6 +16960,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_TMP(incdec_t i
 			incdec_op(z);
 			*retval = z;
 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval_ptr_dtor(&object);
 			SELECTIVE_PZVAL_LOCK(*retval, opline);
 			zval_ptr_dtor(&z);
 		} else {
@@ -17026,9 +17045,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_TMP(incdec_t

 	if (!have_get_ptr) {
 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
-			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
-			zval *z_copy;
+			zval *z, *z_copy;

+			Z_ADDREF_P(object);
+			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);

@@ -17047,6 +17067,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_TMP(incdec_t
 			incdec_op(z_copy);
 			Z_ADDREF_P(z);
 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval_ptr_dtor(&object);
 			zval_ptr_dtor(&z_copy);
 			zval_ptr_dtor(&z);
 		} else {
@@ -17643,7 +17664,9 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_A
 		}
 	}

-	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
+	if (IS_VAR == IS_VAR && (free_op1.var != NULL)) {
+		zval_ptr_dtor(&value);
+	}

 	/* zend_assign_to_variable() always takes care of op2, never free it! */

@@ -18754,6 +18777,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_VAR(int (*bin
 		if (!have_get_ptr) {
 			zval *z = NULL;

+			Z_ADDREF_P(object);
 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
 				if (Z_OBJ_HT_P(object)->read_property) {
 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
@@ -18796,6 +18820,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_VAR(int (*bin
 					EX_T(opline->result.var).var.ptr_ptr = NULL;
 				}
 			}
+			zval_ptr_dtor(&object);
 		}

 		if (0) {
@@ -19014,7 +19039,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_VAR(incdec_t i

 	if (!have_get_ptr) {
 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
-			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval *z;
+
+			Z_ADDREF_P(object);
+			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);

 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
@@ -19031,6 +19059,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_VAR(incdec_t i
 			incdec_op(z);
 			*retval = z;
 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval_ptr_dtor(&object);
 			SELECTIVE_PZVAL_LOCK(*retval, opline);
 			zval_ptr_dtor(&z);
 		} else {
@@ -19115,9 +19144,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_VAR(incdec_t

 	if (!have_get_ptr) {
 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
-			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
-			zval *z_copy;
+			zval *z, *z_copy;

+			Z_ADDREF_P(object);
+			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);

@@ -19136,6 +19166,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_VAR(incdec_t
 			incdec_op(z_copy);
 			Z_ADDREF_P(z);
 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval_ptr_dtor(&object);
 			zval_ptr_dtor(&z_copy);
 			zval_ptr_dtor(&z);
 		} else {
@@ -19896,7 +19927,9 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_A
 		}
 	}

-	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
+	if (IS_VAR == IS_VAR && (free_op1.var != NULL)) {
+		zval_ptr_dtor(&value);
+	}

 	/* zend_assign_to_variable() always takes care of op2, never free it! */
 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};
@@ -20950,6 +20983,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_UNUSED(int (*
 		if (!have_get_ptr) {
 			zval *z = NULL;

+			Z_ADDREF_P(object);
 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
 				if (Z_OBJ_HT_P(object)->read_property) {
 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
@@ -20992,6 +21026,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_UNUSED(int (*
 					EX_T(opline->result.var).var.ptr_ptr = NULL;
 				}
 			}
+			zval_ptr_dtor(&object);
 		}

 		if (0) {
@@ -22382,6 +22417,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_CV(int (*bina
 		if (!have_get_ptr) {
 			zval *z = NULL;

+			Z_ADDREF_P(object);
 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
 				if (Z_OBJ_HT_P(object)->read_property) {
 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
@@ -22424,6 +22460,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_CV(int (*bina
 					EX_T(opline->result.var).var.ptr_ptr = NULL;
 				}
 			}
+			zval_ptr_dtor(&object);
 		}

 		if (0) {
@@ -22641,7 +22678,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_CV(incdec_t in

 	if (!have_get_ptr) {
 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
-			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval *z;
+
+			Z_ADDREF_P(object);
+			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);

 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
@@ -22658,6 +22698,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_CV(incdec_t in
 			incdec_op(z);
 			*retval = z;
 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval_ptr_dtor(&object);
 			SELECTIVE_PZVAL_LOCK(*retval, opline);
 			zval_ptr_dtor(&z);
 		} else {
@@ -22742,9 +22783,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_CV(incdec_t i

 	if (!have_get_ptr) {
 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
-			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
-			zval *z_copy;
+			zval *z, *z_copy;

+			Z_ADDREF_P(object);
+			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);

@@ -22763,6 +22805,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_CV(incdec_t i
 			incdec_op(z_copy);
 			Z_ADDREF_P(z);
 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval_ptr_dtor(&object);
 			zval_ptr_dtor(&z_copy);
 			zval_ptr_dtor(&z);
 		} else {
@@ -23358,7 +23401,9 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_AR
 		}
 	}

-	if (free_op1.var) {zval_ptr_dtor(&free_op1.var);};
+	if (IS_VAR == IS_VAR && (free_op1.var != NULL)) {
+		zval_ptr_dtor(&value);
+	}

 	/* zend_assign_to_variable() always takes care of op2, never free it! */

@@ -24332,6 +24377,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_CONST(int
 		if (!have_get_ptr) {
 			zval *z = NULL;

+			Z_ADDREF_P(object);
 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
 				if (Z_OBJ_HT_P(object)->read_property) {
 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
@@ -24374,6 +24420,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_CONST(int
 					EX_T(opline->result.var).var.ptr_ptr = NULL;
 				}
 			}
+			zval_ptr_dtor(&object);
 		}

 		if (0) {
@@ -24590,7 +24637,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_CONST(incde

 	if (!have_get_ptr) {
 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
-			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval *z;
+
+			Z_ADDREF_P(object);
+			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);

 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
@@ -24607,6 +24657,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_CONST(incde
 			incdec_op(z);
 			*retval = z;
 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval_ptr_dtor(&object);
 			SELECTIVE_PZVAL_LOCK(*retval, opline);
 			zval_ptr_dtor(&z);
 		} else {
@@ -24691,9 +24742,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_CONST(incd

 	if (!have_get_ptr) {
 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
-			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
-			zval *z_copy;
+			zval *z, *z_copy;

+			Z_ADDREF_P(object);
+			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);

@@ -24712,6 +24764,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_CONST(incd
 			incdec_op(z_copy);
 			Z_ADDREF_P(z);
 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval_ptr_dtor(&object);
 			zval_ptr_dtor(&z_copy);
 			zval_ptr_dtor(&z);
 		} else {
@@ -25746,6 +25799,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_TMP(int (*
 		if (!have_get_ptr) {
 			zval *z = NULL;

+			Z_ADDREF_P(object);
 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
 				if (Z_OBJ_HT_P(object)->read_property) {
 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
@@ -25788,6 +25842,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_TMP(int (*
 					EX_T(opline->result.var).var.ptr_ptr = NULL;
 				}
 			}
+			zval_ptr_dtor(&object);
 		}

 		if (1) {
@@ -26005,7 +26060,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_TMP(incdec_

 	if (!have_get_ptr) {
 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
-			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval *z;
+
+			Z_ADDREF_P(object);
+			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);

 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
@@ -26022,6 +26080,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_TMP(incdec_
 			incdec_op(z);
 			*retval = z;
 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval_ptr_dtor(&object);
 			SELECTIVE_PZVAL_LOCK(*retval, opline);
 			zval_ptr_dtor(&z);
 		} else {
@@ -26106,9 +26165,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_TMP(incdec

 	if (!have_get_ptr) {
 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
-			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
-			zval *z_copy;
+			zval *z, *z_copy;

+			Z_ADDREF_P(object);
+			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);

@@ -26127,6 +26187,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_TMP(incdec
 			incdec_op(z_copy);
 			Z_ADDREF_P(z);
 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval_ptr_dtor(&object);
 			zval_ptr_dtor(&z_copy);
 			zval_ptr_dtor(&z);
 		} else {
@@ -27064,6 +27125,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_VAR(int (*
 		if (!have_get_ptr) {
 			zval *z = NULL;

+			Z_ADDREF_P(object);
 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
 				if (Z_OBJ_HT_P(object)->read_property) {
 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
@@ -27106,6 +27168,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_VAR(int (*
 					EX_T(opline->result.var).var.ptr_ptr = NULL;
 				}
 			}
+			zval_ptr_dtor(&object);
 		}

 		if (0) {
@@ -27323,7 +27386,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_VAR(incdec_

 	if (!have_get_ptr) {
 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
-			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval *z;
+
+			Z_ADDREF_P(object);
+			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);

 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
@@ -27340,6 +27406,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_VAR(incdec_
 			incdec_op(z);
 			*retval = z;
 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval_ptr_dtor(&object);
 			SELECTIVE_PZVAL_LOCK(*retval, opline);
 			zval_ptr_dtor(&z);
 		} else {
@@ -27424,9 +27491,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_VAR(incdec

 	if (!have_get_ptr) {
 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
-			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
-			zval *z_copy;
+			zval *z, *z_copy;

+			Z_ADDREF_P(object);
+			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);

@@ -27445,6 +27513,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_VAR(incdec
 			incdec_op(z_copy);
 			Z_ADDREF_P(z);
 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval_ptr_dtor(&object);
 			zval_ptr_dtor(&z_copy);
 			zval_ptr_dtor(&z);
 		} else {
@@ -28383,6 +28452,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_UNUSED(int
 		if (!have_get_ptr) {
 			zval *z = NULL;

+			Z_ADDREF_P(object);
 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
 				if (Z_OBJ_HT_P(object)->read_property) {
 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
@@ -28425,6 +28495,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_UNUSED(int
 					EX_T(opline->result.var).var.ptr_ptr = NULL;
 				}
 			}
+			zval_ptr_dtor(&object);
 		}

 		if (0) {
@@ -28809,6 +28880,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_CV(int (*b
 		if (!have_get_ptr) {
 			zval *z = NULL;

+			Z_ADDREF_P(object);
 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
 				if (Z_OBJ_HT_P(object)->read_property) {
 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
@@ -28851,6 +28923,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_CV(int (*b
 					EX_T(opline->result.var).var.ptr_ptr = NULL;
 				}
 			}
+			zval_ptr_dtor(&object);
 		}

 		if (0) {
@@ -29067,7 +29140,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_CV(incdec_t

 	if (!have_get_ptr) {
 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
-			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval *z;
+
+			Z_ADDREF_P(object);
+			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);

 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
@@ -29084,6 +29160,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_CV(incdec_t
 			incdec_op(z);
 			*retval = z;
 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval_ptr_dtor(&object);
 			SELECTIVE_PZVAL_LOCK(*retval, opline);
 			zval_ptr_dtor(&z);
 		} else {
@@ -29168,9 +29245,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_CV(incdec_

 	if (!have_get_ptr) {
 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
-			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
-			zval *z_copy;
+			zval *z, *z_copy;

+			Z_ADDREF_P(object);
+			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);

@@ -29189,6 +29267,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_CV(incdec_
 			incdec_op(z_copy);
 			Z_ADDREF_P(z);
 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval_ptr_dtor(&object);
 			zval_ptr_dtor(&z_copy);
 			zval_ptr_dtor(&z);
 		} else {
@@ -31615,6 +31694,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_CONST(int (*bi
 		if (!have_get_ptr) {
 			zval *z = NULL;

+			Z_ADDREF_P(object);
 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
 				if (Z_OBJ_HT_P(object)->read_property) {
 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
@@ -31657,6 +31737,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_CONST(int (*bi
 					EX_T(opline->result.var).var.ptr_ptr = NULL;
 				}
 			}
+			zval_ptr_dtor(&object);
 		}

 		if (0) {
@@ -31873,7 +31954,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_CONST(incdec_t

 	if (!have_get_ptr) {
 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
-			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval *z;
+
+			Z_ADDREF_P(object);
+			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);

 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
@@ -31890,6 +31974,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_CONST(incdec_t
 			incdec_op(z);
 			*retval = z;
 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval_ptr_dtor(&object);
 			SELECTIVE_PZVAL_LOCK(*retval, opline);
 			zval_ptr_dtor(&z);
 		} else {
@@ -31974,9 +32059,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_CONST(incdec_t

 	if (!have_get_ptr) {
 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
-			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
-			zval *z_copy;
+			zval *z, *z_copy;

+			Z_ADDREF_P(object);
+			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);

@@ -31995,6 +32081,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_CONST(incdec_t
 			incdec_op(z_copy);
 			Z_ADDREF_P(z);
 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval_ptr_dtor(&object);
 			zval_ptr_dtor(&z_copy);
 			zval_ptr_dtor(&z);
 		} else {
@@ -32749,6 +32836,10 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_
 		}
 	}

+	if (IS_CV == IS_VAR && 0) {
+		zval_ptr_dtor(&value);
+	}
+
 	/* zend_assign_to_variable() always takes care of op2, never free it! */

 	CHECK_EXCEPTION();
@@ -33889,6 +33980,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_TMP(int (*bina
 		if (!have_get_ptr) {
 			zval *z = NULL;

+			Z_ADDREF_P(object);
 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
 				if (Z_OBJ_HT_P(object)->read_property) {
 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
@@ -33931,6 +34023,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_TMP(int (*bina
 					EX_T(opline->result.var).var.ptr_ptr = NULL;
 				}
 			}
+			zval_ptr_dtor(&object);
 		}

 		if (1) {
@@ -34148,7 +34241,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_TMP(incdec_t in

 	if (!have_get_ptr) {
 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
-			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval *z;
+
+			Z_ADDREF_P(object);
+			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);

 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
@@ -34165,6 +34261,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_TMP(incdec_t in
 			incdec_op(z);
 			*retval = z;
 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval_ptr_dtor(&object);
 			SELECTIVE_PZVAL_LOCK(*retval, opline);
 			zval_ptr_dtor(&z);
 		} else {
@@ -34249,9 +34346,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_TMP(incdec_t i

 	if (!have_get_ptr) {
 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
-			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
-			zval *z_copy;
+			zval *z, *z_copy;

+			Z_ADDREF_P(object);
+			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);

@@ -34270,6 +34368,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_TMP(incdec_t i
 			incdec_op(z_copy);
 			Z_ADDREF_P(z);
 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval_ptr_dtor(&object);
 			zval_ptr_dtor(&z_copy);
 			zval_ptr_dtor(&z);
 		} else {
@@ -34861,6 +34960,10 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_AR
 		}
 	}

+	if (IS_CV == IS_VAR && 0) {
+		zval_ptr_dtor(&value);
+	}
+
 	/* zend_assign_to_variable() always takes care of op2, never free it! */

 	CHECK_EXCEPTION();
@@ -35840,6 +35943,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_VAR(int (*bina
 		if (!have_get_ptr) {
 			zval *z = NULL;

+			Z_ADDREF_P(object);
 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
 				if (Z_OBJ_HT_P(object)->read_property) {
 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
@@ -35882,6 +35986,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_VAR(int (*bina
 					EX_T(opline->result.var).var.ptr_ptr = NULL;
 				}
 			}
+			zval_ptr_dtor(&object);
 		}

 		if (0) {
@@ -36099,7 +36204,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_VAR(incdec_t in

 	if (!have_get_ptr) {
 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
-			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval *z;
+
+			Z_ADDREF_P(object);
+			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);

 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
@@ -36116,6 +36224,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_VAR(incdec_t in
 			incdec_op(z);
 			*retval = z;
 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval_ptr_dtor(&object);
 			SELECTIVE_PZVAL_LOCK(*retval, opline);
 			zval_ptr_dtor(&z);
 		} else {
@@ -36200,9 +36309,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_VAR(incdec_t i

 	if (!have_get_ptr) {
 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
-			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
-			zval *z_copy;
+			zval *z, *z_copy;

+			Z_ADDREF_P(object);
+			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);

@@ -36221,6 +36331,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_VAR(incdec_t i
 			incdec_op(z_copy);
 			Z_ADDREF_P(z);
 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval_ptr_dtor(&object);
 			zval_ptr_dtor(&z_copy);
 			zval_ptr_dtor(&z);
 		} else {
@@ -36976,6 +37087,10 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_AR
 		}
 	}

+	if (IS_CV == IS_VAR && 0) {
+		zval_ptr_dtor(&value);
+	}
+
 	/* zend_assign_to_variable() always takes care of op2, never free it! */
 	if (free_op2.var) {zval_ptr_dtor(&free_op2.var);};

@@ -37897,6 +38012,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_UNUSED(int (*b
 		if (!have_get_ptr) {
 			zval *z = NULL;

+			Z_ADDREF_P(object);
 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
 				if (Z_OBJ_HT_P(object)->read_property) {
 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
@@ -37939,6 +38055,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_UNUSED(int (*b
 					EX_T(opline->result.var).var.ptr_ptr = NULL;
 				}
 			}
+			zval_ptr_dtor(&object);
 		}

 		if (0) {
@@ -39181,6 +39298,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_CV(int (*binar
 		if (!have_get_ptr) {
 			zval *z = NULL;

+			Z_ADDREF_P(object);
 			if (opline->extended_value == ZEND_ASSIGN_OBJ) {
 				if (Z_OBJ_HT_P(object)->read_property) {
 					z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
@@ -39223,6 +39341,7 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_CV(int (*binar
 					EX_T(opline->result.var).var.ptr_ptr = NULL;
 				}
 			}
+			zval_ptr_dtor(&object);
 		}

 		if (0) {
@@ -39439,7 +39558,10 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_CV(incdec_t inc

 	if (!have_get_ptr) {
 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
-			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval *z;
+
+			Z_ADDREF_P(object);
+			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);

 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);
@@ -39456,6 +39578,7 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_CV(incdec_t inc
 			incdec_op(z);
 			*retval = z;
 			Z_OBJ_HT_P(object)->write_property(object, property, z, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval_ptr_dtor(&object);
 			SELECTIVE_PZVAL_LOCK(*retval, opline);
 			zval_ptr_dtor(&z);
 		} else {
@@ -39540,9 +39663,10 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_CV(incdec_t in

 	if (!have_get_ptr) {
 		if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
-			zval *z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
-			zval *z_copy;
+			zval *z, *z_copy;

+			Z_ADDREF_P(object);
+			z = Z_OBJ_HT_P(object)->read_property(object, property, BP_VAR_R, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (UNEXPECTED(Z_TYPE_P(z) == IS_OBJECT) && Z_OBJ_HT_P(z)->get) {
 				zval *value = Z_OBJ_HT_P(z)->get(z TSRMLS_CC);

@@ -39561,6 +39685,7 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_CV(incdec_t in
 			incdec_op(z_copy);
 			Z_ADDREF_P(z);
 			Z_OBJ_HT_P(object)->write_property(object, property, z_copy, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
+			zval_ptr_dtor(&object);
 			zval_ptr_dtor(&z_copy);
 			zval_ptr_dtor(&z);
 		} else {
@@ -40151,6 +40276,10 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARG
 		}
 	}

+	if (IS_CV == IS_VAR && 0) {
+		zval_ptr_dtor(&value);
+	}
+
 	/* zend_assign_to_variable() always takes care of op2, never free it! */

 	CHECK_EXCEPTION();
@@ -119,7 +119,7 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=5
-PHP_RELEASE_VERSION=23
+PHP_RELEASE_VERSION=27
 PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
@@ -858,6 +858,9 @@ PHP_MINIT_FUNCTION(curl)
 	/* Curl Http Version constants (CURLOPT_HTTP_VERSION) */
 	REGISTER_CURL_CONSTANT(CURL_HTTP_VERSION_1_0);
 	REGISTER_CURL_CONSTANT(CURL_HTTP_VERSION_1_1);
+#if LIBCURL_VERSION_NUM >= 0x072100 /* 7.33.0 */
+	REGISTER_CURL_CONSTANT(CURL_HTTP_VERSION_2_0);
+#endif
 	REGISTER_CURL_CONSTANT(CURL_HTTP_VERSION_NONE);

 	/* Curl Lock constants */
@@ -887,6 +890,9 @@ PHP_MINIT_FUNCTION(curl)
 	REGISTER_CURL_CONSTANT(CURL_VERSION_KERBEROS4);
 	REGISTER_CURL_CONSTANT(CURL_VERSION_LIBZ);
 	REGISTER_CURL_CONSTANT(CURL_VERSION_SSL);
+#if LIBCURL_VERSION_NUM >= 0x072100 /* 7.33.0 */
+	REGISTER_CURL_CONSTANT(CURL_VERSION_HTTP2);
+#endif

 #if LIBCURL_VERSION_NUM >= 0x070a06 /* Available since 7.10.6 */
 	REGISTER_CURL_CONSTANT(CURLOPT_HTTPAUTH);
@@ -1348,6 +1354,7 @@ static size_t curl_write(char *data, size_t size, size_t nmemb, void *ctx)
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not call the CURLOPT_WRITEFUNCTION");
 				length = -1;
 			} else if (retval_ptr) {
+				_php_curl_verify_handlers(ch, 1 TSRMLS_CC);
 				if (Z_TYPE_P(retval_ptr) != IS_LONG) {
 					convert_to_long_ex(&retval_ptr);
 				}
@@ -1413,6 +1420,7 @@ static int curl_fnmatch(void *ctx, const char *pattern, const char *string)
 			if (error == FAILURE) {
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot call the CURLOPT_FNMATCH_FUNCTION");
 			} else if (retval_ptr) {
+				_php_curl_verify_handlers(ch, 1 TSRMLS_CC);
 				if (Z_TYPE_P(retval_ptr) != IS_LONG) {
 					convert_to_long_ex(&retval_ptr);
 				}
@@ -1491,6 +1499,7 @@ static size_t curl_progress(void *clientp, double dltotal, double dlnow, double
 			if (error == FAILURE) {
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot call the CURLOPT_PROGRESSFUNCTION");
 			} else if (retval_ptr) {
+				_php_curl_verify_handlers(ch, 1 TSRMLS_CC);
 				if (Z_TYPE_P(retval_ptr) != IS_LONG) {
 					convert_to_long_ex(&retval_ptr);
 				}
@@ -1568,6 +1577,7 @@ static size_t curl_read(char *data, size_t size, size_t nmemb, void *ctx)
 				length = CURL_READFUNC_ABORT;
 #endif
 			} else if (retval_ptr) {
+				_php_curl_verify_handlers(ch, 1 TSRMLS_CC);
 				if (Z_TYPE_P(retval_ptr) == IS_STRING) {
 					length = MIN((int) (size * nmemb), Z_STRLEN_P(retval_ptr));
 					memcpy(data, Z_STRVAL_P(retval_ptr), length);
@@ -1642,6 +1652,7 @@ static size_t curl_write_header(char *data, size_t size, size_t nmemb, void *ctx
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not call the CURLOPT_HEADERFUNCTION");
 				length = -1;
 			} else if (retval_ptr) {
+				_php_curl_verify_handlers(ch, 1 TSRMLS_CC);
 				if (Z_TYPE_P(retval_ptr) != IS_LONG) {
 					convert_to_long_ex(&retval_ptr);
 				}
@@ -2845,6 +2856,7 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue TSRMLS_DC)
 					curl_easy_setopt(ch->cp, CURLOPT_SHARE, sh->share);
 				}
 			}
+			break;

 #if LIBCURL_VERSION_NUM >= 0x071500 /* Available since 7.21.0 */
 		case CURLOPT_FNMATCH_FUNCTION:
@@ -0,0 +1,45 @@
+--TEST--
+Bug #69316: Use-after-free in php_curl related to CURLOPT_FILE/_INFILE/_WRITEHEADER
+--SKIPIF--
+<?php include 'skipif.inc'; ?>
+--FILE--
+<?php
+  function hdr_callback($ch, $data) {
+      // close the stream, causing the FILE structure to be free()'d
+      if($GLOBALS['f_file']) {
+          fclose($GLOBALS['f_file']); $GLOBALS['f_file'] = 0;
+
+          // cause an allocation of approx the same size as a FILE structure, size varies a bit depending on platform/libc
+          $FILE_size = (PHP_INT_SIZE == 4 ? 0x160 : 0x238);
+          curl_setopt($ch, CURLOPT_COOKIE, str_repeat("a", $FILE_size - 1));
+      }
+      return strlen($data);
+  }
+
+  include 'server.inc';
+  $host = curl_cli_server_start();
+  $temp_file = dirname(__FILE__) . '/body.tmp';
+  $url = "{$host}/get.php?test=getpost";
+  $ch = curl_init();
+  $f_file = fopen($temp_file, "w") or die("failed to open file\n");
+  curl_setopt($ch, CURLOPT_BUFFERSIZE, 10);
+  curl_setopt($ch, CURLOPT_HEADERFUNCTION, "hdr_callback");
+  curl_setopt($ch, CURLOPT_FILE, $f_file);
+  curl_setopt($ch, CURLOPT_URL, $url);
+  curl_exec($ch);
+  curl_close($ch);
+?>
+===DONE===
+--CLEAN--
+<?php
+unlink(dirname(__FILE__) . '/body.tmp');
+?>
+--EXPECTF--
+Warning: curl_exec(): CURLOPT_FILE resource has gone away, resetting to default in %s on line %d
+array(1) {
+  ["test"]=>
+  string(7) "getpost"
+}
+array(0) {
+}
+===DONE===
@@ -115,7 +115,7 @@ static double astro_GMST0(double d)
 	/* time, imposing no runtime or code overhead.               */
 	sidtim0 = astro_revolution((180.0 + 356.0470 + 282.9404) + (0.9856002585 + 4.70935E-5) * d);
 	return sidtim0;
-} 
+}

 /* This function computes the Sun's position at any instant */

@@ -177,32 +177,32 @@ static void astro_sun_RA_dec(double d, double *RA, double *dec, double *r)

 /**
 * Note: timestamp = unixtimestamp (NEEDS to be 00:00:00 UT)
- *       Eastern longitude positive, Western longitude negative       
- *       Northern latitude positive, Southern latitude negative       
- *       The longitude value IS critical in this function!            
- *       altit = the altitude which the Sun should cross              
- *               Set to -35/60 degrees for rise/set, -6 degrees       
- *               for civil, -12 degrees for nautical and -18          
- *               degrees for astronomical twilight.                   
- *         upper_limb: non-zero -> upper limb, zero -> center         
- *               Set to non-zero (e.g. 1) when computing rise/set     
- *               times, and to zero when computing start/end of       
- *               twilight.                                            
- *        *rise = where to store the rise time                        
- *        *set  = where to store the set  time                        
- *                Both times are relative to the specified altitude,  
- *                and thus this function can be used to compute       
- *                various twilight times, as well as rise/set times   
- * Return value:  0 = sun rises/sets this day, times stored at        
- *                    *trise and *tset.                               
- *               +1 = sun above the specified "horizon" 24 hours.     
- *                    *trise set to time when the sun is at south,    
- *                    minus 12 hours while *tset is set to the south  
- *                    time plus 12 hours. "Day" length = 24 hours     
- *               -1 = sun is below the specified "horizon" 24 hours   
- *                    "Day" length = 0 hours, *trise and *tset are    
- *                    both set to the time when the sun is at south.  
- *                                                                    
+ *       Eastern longitude positive, Western longitude negative
+ *       Northern latitude positive, Southern latitude negative
+ *       The longitude value IS critical in this function!
+ *       altit = the altitude which the Sun should cross
+ *               Set to -35/60 degrees for rise/set, -6 degrees
+ *               for civil, -12 degrees for nautical and -18
+ *               degrees for astronomical twilight.
+ *         upper_limb: non-zero -> upper limb, zero -> center
+ *               Set to non-zero (e.g. 1) when computing rise/set
+ *               times, and to zero when computing start/end of
+ *               twilight.
+ *        *rise = where to store the rise time
+ *        *set  = where to store the set  time
+ *                Both times are relative to the specified altitude,
+ *                and thus this function can be used to compute
+ *                various twilight times, as well as rise/set times
+ * Return value:  0 = sun rises/sets this day, times stored at
+ *                    *trise and *tset.
+ *               +1 = sun above the specified "horizon" 24 hours.
+ *                    *trise set to time when the sun is at south,
+ *                    minus 12 hours while *tset is set to the south
+ *                    time plus 12 hours. "Day" length = 24 hours
+ *               -1 = sun is below the specified "horizon" 24 hours
+ *                    "Day" length = 0 hours, *trise and *tset are
+ *                    both set to the time when the sun is at south.
+ *
 */
 int timelib_astro_rise_set_altitude(timelib_time *t_loc, double lon, double lat, double altit, int upper_limb, double *h_rise, double *h_set, timelib_sll *ts_rise, timelib_sll *ts_set, timelib_sll *ts_transit)
 {
@@ -136,7 +136,7 @@ void timelib_isoweek_from_date(timelib_sll y, timelib_sll m, timelib_sll d, time
 timelib_sll timelib_daynr_from_weeknr(timelib_sll y, timelib_sll w, timelib_sll d)
 {
 	timelib_sll dow, day;
-	
+
 	/* Figure out the dayofweek for y-1-1 */
 	dow = timelib_day_of_week(y, 1, 1);
 	/* then use that to figure out the offset for day 1 of week 1 */
@@ -1,4 +1,4 @@
-/* Generated by re2c 0.13.5 on Mon Aug 18 18:28:27 2014 */
+/* Generated by re2c 0.13.5 on Tue Mar 31 16:32:03 2015 */
 #line 1 "ext/date/lib/parse_date.re"
 /*
   +----------------------------------------------------------------------+
@@ -19864,9 +19864,9 @@ yy1315:

 		/* skip "last day of" or "first day of" */
 		if (*ptr == 'l' || *ptr == 'L') {
-			s->time->relative.first_last_day_of = 2;
+			s->time->relative.first_last_day_of = TIMELIB_SPECIAL_LAST_DAY_OF_MONTH;
 		} else {
-			s->time->relative.first_last_day_of = 1;
+			s->time->relative.first_last_day_of = TIMELIB_SPECIAL_FIRST_DAY_OF_MONTH;
 		}

 		TIMELIB_DEINIT;
@@ -677,7 +677,7 @@ const static timelib_tz_lookup_table* abbr_search(const char *word, long gmtoffs
 	if (strcasecmp("utc", word) == 0 || strcasecmp("gmt", word) == 0) {
 		return timelib_timezone_utc;
 	}
-	
+
 	for (tp = timelib_timezone_lookup; tp->name; tp++) {
 		if (strcasecmp(word, tp->name) == 0) {
 			if (!first_found) {
@@ -808,7 +808,7 @@ static int scan(Scanner *s, timelib_tz_get_wrapper tz_get_wrapper)
 {
 	uchar *cursor = s->cur;
 	char *str, *ptr = NULL;
-		
+
 std:
 	s->tok = cursor;
 	s->len = 0;
@@ -1030,9 +1030,9 @@ weekdayof        = (reltextnumber|reltexttext) space (dayfull|dayabbr) space 'of

 		/* skip "last day of" or "first day of" */
 		if (*ptr == 'l' || *ptr == 'L') {
-			s->time->relative.first_last_day_of = 2;
+			s->time->relative.first_last_day_of = TIMELIB_SPECIAL_LAST_DAY_OF_MONTH;
 		} else {
-			s->time->relative.first_last_day_of = 1;
+			s->time->relative.first_last_day_of = TIMELIB_SPECIAL_FIRST_DAY_OF_MONTH;
 		}

 		TIMELIB_DEINIT;
@@ -1437,7 +1437,7 @@ weekdayof        = (reltextnumber|reltexttext) space (dayfull|dayabbr) space 'of
 		TIMELIB_INIT;
 		TIMELIB_HAVE_DATE();
 		TIMELIB_HAVE_RELATIVE();
-		
+
 		s->time->y = timelib_get_nr((char **) &ptr, 4);
 		w = timelib_get_nr((char **) &ptr, 2);
 		d = timelib_get_nr((char **) &ptr, 1);
@@ -1456,7 +1456,7 @@ weekdayof        = (reltextnumber|reltexttext) space (dayfull|dayabbr) space 'of
 		TIMELIB_INIT;
 		TIMELIB_HAVE_DATE();
 		TIMELIB_HAVE_RELATIVE();
-		
+
 		s->time->y = timelib_get_nr((char **) &ptr, 4);
 		w = timelib_get_nr((char **) &ptr, 2);
 		d = 1;
@@ -1560,7 +1560,7 @@ weekdayof        = (reltextnumber|reltexttext) space (dayfull|dayabbr) space 'of
 		if (s->time->relative.weekday_behavior != 2) {
 			s->time->relative.weekday_behavior = 1;
 		}
-		
+
 		TIMELIB_DEINIT;
 		return TIMELIB_WEEKDAY;
 	}
@@ -1877,7 +1877,7 @@ timelib_time *timelib_parse_from_format(char *format, char *string, int len, tim
 						add_pbf_error(s, "A textual day could not be found", string, begin);
 						break;
 					} else {
-						in.time->have_relative = 1; 
+						in.time->have_relative = 1;
 						in.time->relative.have_weekday_relative = 1;
 						in.time->relative.weekday = tmprel->multiplier;
 						in.time->relative.weekday_behavior = 1;
@@ -2148,13 +2148,13 @@ timelib_time *timelib_parse_from_format(char *format, char *string, int len, tim

 	/* do funky checking whether the parsed time was valid time */
 	if (s->time->h != TIMELIB_UNSET && s->time->i != TIMELIB_UNSET &&
-		s->time->s != TIMELIB_UNSET && 
+		s->time->s != TIMELIB_UNSET &&
 		!timelib_valid_time( s->time->h, s->time->i, s->time->s)) {
 		add_pbf_warning(s, "The parsed time was invalid", string, ptr);
 	}
 	/* do funky checking whether the parsed date was valid date */
 	if (s->time->y != TIMELIB_UNSET && s->time->m != TIMELIB_UNSET &&
-		s->time->d != TIMELIB_UNSET && 
+		s->time->d != TIMELIB_UNSET &&
 		!timelib_valid_date( s->time->y, s->time->m, s->time->d)) {
 		add_pbf_warning(s, "The parsed date was invalid", string, ptr);
 	}
@@ -2227,7 +2227,7 @@ int main(void)
 	printf ("%04d-%02d-%02d %02d:%02d:%02d.%-5d %+04d %1d",
 		time.y, time.m, time.d, time.h, time.i, time.s, time.f, time.z, time.dst);
 	if (time.have_relative) {
-		printf ("%3dY %3dM %3dD / %3dH %3dM %3dS", 
+		printf ("%3dY %3dM %3dD / %3dH %3dM %3dS",
 			time.relative.y, time.relative.m, time.relative.d, time.relative.h, time.relative.i, time.relative.s);
 	}
 	if (time.have_weekday_relative) {
@@ -2236,7 +2236,7 @@ int main(void)
 	if (time.have_weeknr_day) {
 		printf(" / %dW%d", time.relative.weeknr_day.weeknr, time.relative.weeknr_day.dayofweek);
 	}
-	return 0;				
+	return 0;
 }
 #endif

@@ -242,7 +242,7 @@ static int scan(Scanner *s)
 {
 	uchar *cursor = s->cur;
 	char *str, *ptr = NULL;
-		
+
 std:
 	s->tok = cursor;
 	s->len = 0;
@@ -336,11 +336,11 @@ isoweek          = year4 "-"? "W" weekofyear;
 				case 'D': s->period->d = nr; break;
 				case 'H': s->period->h = nr; break;
 				case 'S': s->period->s = nr; break;
-				case 'M': 
+				case 'M':
 					if (in_time) {
 						s->period->i = nr;
 					} else {
-						s->period->m = nr; 
+						s->period->m = nr;
 					}
 					break;
 				default:
@@ -398,9 +398,9 @@ isoweek          = year4 "-"? "W" weekofyear;

 /*!max:re2c */

-void timelib_strtointerval(char *s, int len, 
-                           timelib_time **begin, timelib_time **end, 
-						   timelib_rel_time **period, int *recurrences, 
+void timelib_strtointerval(char *s, int len,
+                           timelib_time **begin, timelib_time **end,
+						   timelib_rel_time **period, int *recurrences,
 						   struct timelib_error_container **errors)
 {
 	Scanner in;
@@ -36,7 +36,7 @@
 #if (defined(__APPLE__) || defined(__APPLE_CC__)) && (defined(__BIG_ENDIAN__) || defined(__LITTLE_ENDIAN__))
 # if defined(__LITTLE_ENDIAN__)
 #  undef WORDS_BIGENDIAN
-# else 
+# else
 #  if defined(__BIG_ENDIAN__)
 #   define WORDS_BIGENDIAN
 #  endif
@@ -49,11 +49,14 @@
 #define timelib_conv_int(l) ((l & 0x000000ff) << 24) + ((l & 0x0000ff00) << 8) + ((l & 0x00ff0000) >> 8) + ((l & 0xff000000) >> 24)
 #endif

-static void read_preamble(const unsigned char **tzf, timelib_tzinfo *tz)
+static int read_preamble(const unsigned char **tzf, timelib_tzinfo *tz)
 {
-	/* skip ID */
+	uint32_t version;
+
+	/* read ID */
+	version = (*tzf)[3] - '0';
 	*tzf += 4;
-	
+
 	/* read BC flag */
 	tz->bc = (**tzf == '\1');
 	*tzf += 1;
@@ -63,8 +66,10 @@ static void read_preamble(const unsigned char **tzf, timelib_tzinfo *tz)
 	tz->location.country_code[2] = '\0';
 	*tzf += 2;

-	/* skip read of preamble */
+	/* skip rest of preamble */
 	*tzf += 13;
+
+	return version;
 }

 static void read_header(const unsigned char **tzf, timelib_tzinfo *tz)
@@ -72,65 +77,88 @@ static void read_header(const unsigned char **tzf, timelib_tzinfo *tz)
 	uint32_t buffer[6];

 	memcpy(&buffer, *tzf, sizeof(buffer));
-	tz->ttisgmtcnt = timelib_conv_int(buffer[0]);
-	tz->ttisstdcnt = timelib_conv_int(buffer[1]);
-	tz->leapcnt    = timelib_conv_int(buffer[2]);
-	tz->timecnt    = timelib_conv_int(buffer[3]);
-	tz->typecnt    = timelib_conv_int(buffer[4]);
-	tz->charcnt    = timelib_conv_int(buffer[5]);
+	tz->bit32.ttisgmtcnt = timelib_conv_int(buffer[0]);
+	tz->bit32.ttisstdcnt = timelib_conv_int(buffer[1]);
+	tz->bit32.leapcnt    = timelib_conv_int(buffer[2]);
+	tz->bit32.timecnt    = timelib_conv_int(buffer[3]);
+	tz->bit32.typecnt    = timelib_conv_int(buffer[4]);
+	tz->bit32.charcnt    = timelib_conv_int(buffer[5]);
 	*tzf += sizeof(buffer);
 }

+static void skip_64bit_transistions(const unsigned char **tzf, timelib_tzinfo *tz)
+{
+	if (tz->bit64.timecnt) {
+		*tzf += (sizeof(int64_t) * tz->bit64.timecnt);
+		*tzf += (sizeof(unsigned char) * tz->bit64.timecnt);
+	}
+}
+
 static void read_transistions(const unsigned char **tzf, timelib_tzinfo *tz)
 {
 	int32_t *buffer = NULL;
 	uint32_t i;
 	unsigned char *cbuffer = NULL;

-	if (tz->timecnt) {
-		buffer = (int32_t*) malloc(tz->timecnt * sizeof(int32_t));
+	if (tz->bit32.timecnt) {
+		buffer = (int32_t*) malloc(tz->bit32.timecnt * sizeof(int32_t));
 		if (!buffer) {
 			return;
 		}
-		memcpy(buffer, *tzf, sizeof(int32_t) * tz->timecnt);
-		*tzf += (sizeof(int32_t) * tz->timecnt);
-		for (i = 0; i < tz->timecnt; i++) {
+		memcpy(buffer, *tzf, sizeof(int32_t) * tz->bit32.timecnt);
+		*tzf += (sizeof(int32_t) * tz->bit32.timecnt);
+		for (i = 0; i < tz->bit32.timecnt; i++) {
 			buffer[i] = timelib_conv_int(buffer[i]);
 		}

-		cbuffer = (unsigned char*) malloc(tz->timecnt * sizeof(unsigned char));
+		cbuffer = (unsigned char*) malloc(tz->bit32.timecnt * sizeof(unsigned char));
 		if (!cbuffer) {
 			free(buffer);
 			return;
 		}
-		memcpy(cbuffer, *tzf, sizeof(unsigned char) * tz->timecnt);
-		*tzf += sizeof(unsigned char) * tz->timecnt;
+		memcpy(cbuffer, *tzf, sizeof(unsigned char) * tz->bit32.timecnt);
+		*tzf += sizeof(unsigned char) * tz->bit32.timecnt;
 	}
-	
+
 	tz->trans = buffer;
 	tz->trans_idx = cbuffer;
 }

+static void skip_64bit_types(const unsigned char **tzf, timelib_tzinfo *tz)
+{
+	*tzf += sizeof(unsigned char) * 6 * tz->bit64.typecnt;
+	*tzf += sizeof(char) * tz->bit64.charcnt;
+	if (tz->bit64.leapcnt) {
+		*tzf += sizeof(int64_t) * tz->bit64.leapcnt * 2;
+	}
+	if (tz->bit64.ttisstdcnt) {
+		*tzf += sizeof(unsigned char) * tz->bit64.ttisstdcnt;
+	}
+	if (tz->bit64.ttisgmtcnt) {
+		*tzf += sizeof(unsigned char) * tz->bit64.ttisgmtcnt;
+	}
+}
+
 static void read_types(const unsigned char **tzf, timelib_tzinfo *tz)
 {
 	unsigned char *buffer;
 	int32_t *leap_buffer;
 	unsigned int i, j;

-	buffer = (unsigned char*) malloc(tz->typecnt * sizeof(unsigned char) * 6);
+	buffer = (unsigned char*) malloc(tz->bit32.typecnt * sizeof(unsigned char) * 6);
 	if (!buffer) {
 		return;
 	}
-	memcpy(buffer, *tzf, sizeof(unsigned char) * 6 * tz->typecnt);
-	*tzf += sizeof(unsigned char) * 6 * tz->typecnt;
+	memcpy(buffer, *tzf, sizeof(unsigned char) * 6 * tz->bit32.typecnt);
+	*tzf += sizeof(unsigned char) * 6 * tz->bit32.typecnt;

-	tz->type = (ttinfo*) malloc(tz->typecnt * sizeof(struct ttinfo));
+	tz->type = (ttinfo*) malloc(tz->bit32.typecnt * sizeof(struct ttinfo));
 	if (!tz->type) {
 		free(buffer);
 		return;
 	}

-	for (i = 0; i < tz->typecnt; i++) {
+	for (i = 0; i < tz->bit32.typecnt; i++) {
 		j = i * 6;
 		tz->type[i].offset = (buffer[j] * 16777216) + (buffer[j + 1] * 65536) + (buffer[j + 2] * 256) + buffer[j + 3];
 		tz->type[i].isdst = buffer[j + 4];
@@ -138,62 +166,74 @@ static void read_types(const unsigned char **tzf, timelib_tzinfo *tz)
 	}
 	free(buffer);

-	tz->timezone_abbr = (char*) malloc(tz->charcnt);
+	tz->timezone_abbr = (char*) malloc(tz->bit32.charcnt);
 	if (!tz->timezone_abbr) {
 		return;
 	}
-	memcpy(tz->timezone_abbr, *tzf, sizeof(char) * tz->charcnt);
-	*tzf += sizeof(char) * tz->charcnt;
+	memcpy(tz->timezone_abbr, *tzf, sizeof(char) * tz->bit32.charcnt);
+	*tzf += sizeof(char) * tz->bit32.charcnt;

-	if (tz->leapcnt) {
-		leap_buffer = (int32_t *) malloc(tz->leapcnt * 2 * sizeof(int32_t));
+	if (tz->bit32.leapcnt) {
+		leap_buffer = (int32_t *) malloc(tz->bit32.leapcnt * 2 * sizeof(int32_t));
 		if (!leap_buffer) {
 			return;
 		}
-		memcpy(leap_buffer, *tzf, sizeof(int32_t) * tz->leapcnt * 2);
-		*tzf += sizeof(int32_t) * tz->leapcnt * 2;
+		memcpy(leap_buffer, *tzf, sizeof(int32_t) * tz->bit32.leapcnt * 2);
+		*tzf += sizeof(int32_t) * tz->bit32.leapcnt * 2;

-		tz->leap_times = (tlinfo*) malloc(tz->leapcnt * sizeof(tlinfo));
+		tz->leap_times = (tlinfo*) malloc(tz->bit32.leapcnt * sizeof(tlinfo));
 		if (!tz->leap_times) {
 			free(leap_buffer);
 			return;
 		}
-		for (i = 0; i < tz->leapcnt; i++) {
+		for (i = 0; i < tz->bit32.leapcnt; i++) {
 			tz->leap_times[i].trans = timelib_conv_int(leap_buffer[i * 2]);
 			tz->leap_times[i].offset = timelib_conv_int(leap_buffer[i * 2 + 1]);
 		}
 		free(leap_buffer);
 	}

-	if (tz->ttisstdcnt) {
-		buffer = (unsigned char*) malloc(tz->ttisstdcnt * sizeof(unsigned char));
+	if (tz->bit32.ttisstdcnt) {
+		buffer = (unsigned char*) malloc(tz->bit32.ttisstdcnt * sizeof(unsigned char));
 		if (!buffer) {
 			return;
 		}
-		memcpy(buffer, *tzf, sizeof(unsigned char) * tz->ttisstdcnt);
-		*tzf += sizeof(unsigned char) * tz->ttisstdcnt;
+		memcpy(buffer, *tzf, sizeof(unsigned char) * tz->bit32.ttisstdcnt);
+		*tzf += sizeof(unsigned char) * tz->bit32.ttisstdcnt;

-		for (i = 0; i < tz->ttisstdcnt; i++) {
+		for (i = 0; i < tz->bit32.ttisstdcnt; i++) {
 			tz->type[i].isstdcnt = buffer[i];
 		}
 		free(buffer);
 	}

-	if (tz->ttisgmtcnt) {
-		buffer = (unsigned char*) malloc(tz->ttisgmtcnt * sizeof(unsigned char));
+	if (tz->bit32.ttisgmtcnt) {
+		buffer = (unsigned char*) malloc(tz->bit32.ttisgmtcnt * sizeof(unsigned char));
 		if (!buffer) {
 			return;
 		}
-		memcpy(buffer, *tzf, sizeof(unsigned char) * tz->ttisgmtcnt);
-		*tzf += sizeof(unsigned char) * tz->ttisgmtcnt;
+		memcpy(buffer, *tzf, sizeof(unsigned char) * tz->bit32.ttisgmtcnt);
+		*tzf += sizeof(unsigned char) * tz->bit32.ttisgmtcnt;

-		for (i = 0; i < tz->ttisgmtcnt; i++) {
+		for (i = 0; i < tz->bit32.ttisgmtcnt; i++) {
 			tz->type[i].isgmtcnt = buffer[i];
 		}
 		free(buffer);
 	}
 }

+static void skip_posix_string(const unsigned char **tzf, timelib_tzinfo *tz)
+{
+	int n_count = 0;
+
+	do {
+		if (*tzf[0] == '\n') {
+			n_count++;
+		}
+		(*tzf)++;
+	} while (n_count < 2);
+}
+
 static void read_location(const unsigned char **tzf, timelib_tzinfo *tz)
 {
 	uint32_t buffer[3];
@@ -221,12 +261,12 @@ void timelib_dump_tzinfo(timelib_tzinfo *tz)
 	printf("Geo Location:      %f,%f\n", tz->location.latitude, tz->location.longitude);
 	printf("Comments:\n%s\n",          tz->location.comments);
 	printf("BC:                %s\n",  tz->bc ? "" : "yes");
-	printf("UTC/Local count:   %lu\n", (unsigned long) tz->ttisgmtcnt);
-	printf("Std/Wall count:    %lu\n", (unsigned long) tz->ttisstdcnt);
-	printf("Leap.sec. count:   %lu\n", (unsigned long) tz->leapcnt);
-	printf("Trans. count:      %lu\n", (unsigned long) tz->timecnt);
-	printf("Local types count: %lu\n", (unsigned long) tz->typecnt);
-	printf("Zone Abbr. count:  %lu\n", (unsigned long) tz->charcnt);
+	printf("UTC/Local count:   %lu\n", (unsigned long) tz->bit32.ttisgmtcnt);
+	printf("Std/Wall count:    %lu\n", (unsigned long) tz->bit32.ttisstdcnt);
+	printf("Leap.sec. count:   %lu\n", (unsigned long) tz->bit32.leapcnt);
+	printf("Trans. count:      %lu\n", (unsigned long) tz->bit32.timecnt);
+	printf("Local types count: %lu\n", (unsigned long) tz->bit32.typecnt);
+	printf("Zone Abbr. count:  %lu\n", (unsigned long) tz->bit32.charcnt);

 	printf ("%8s (%12s) = %3d [%5ld %1d %3d '%s' (%d,%d)]\n",
 		"", "", 0,
@@ -237,7 +277,7 @@ void timelib_dump_tzinfo(timelib_tzinfo *tz)
 		tz->type[0].isstdcnt,
 		tz->type[0].isgmtcnt
 		);
-	for (i = 0; i < tz->timecnt; i++) {
+	for (i = 0; i < tz->bit32.timecnt; i++) {
 		printf ("%08X (%12d) = %3d [%5ld %1d %3d '%s' (%d,%d)]\n",
 			tz->trans[i], tz->trans[i], tz->trans_idx[i],
 			(long int) tz->type[tz->trans_idx[i]].offset,
@@ -248,7 +288,7 @@ void timelib_dump_tzinfo(timelib_tzinfo *tz)
 			tz->type[tz->trans_idx[i]].isgmtcnt
 			);
 	}
-	for (i = 0; i < tz->leapcnt; i++) {
+	for (i = 0; i < tz->bit32.leapcnt; i++) {
 		printf ("%08X (%12ld) = %d\n",
 			tz->leap_times[i].trans,
 			(long) tz->leap_times[i].trans,
@@ -267,7 +307,7 @@ static int seek_to_tz_position(const unsigned char **tzf, char *timezone, const
 		cur_locale = strdup(tmp);
 	}
 	setlocale(LC_CTYPE, "C");
-#endif	
+#endif

 	do {
 		int mid = ((unsigned)left + right) >> 1;
@@ -282,7 +322,7 @@ static int seek_to_tz_position(const unsigned char **tzf, char *timezone, const
 #ifdef HAVE_SETLOCALE
 			setlocale(LC_CTYPE, cur_locale);
 			if (cur_locale) free(cur_locale);
-#endif	
+#endif
 			return 1;
 		}

@@ -291,7 +331,7 @@ static int seek_to_tz_position(const unsigned char **tzf, char *timezone, const
 #ifdef HAVE_SETLOCALE
 	setlocale(LC_CTYPE, cur_locale);
 	if (cur_locale) free(cur_locale);
-#endif	
+#endif
 	return 0;
 }

@@ -312,18 +352,45 @@ int timelib_timezone_id_is_valid(char *timezone, const timelib_tzdb *tzdb)
 	return (seek_to_tz_position(&tzf, timezone, tzdb));
 }

+static void skip_64bit_preamble(const unsigned char **tzf, timelib_tzinfo *tz)
+{
+	*tzf += 20;
+}
+
+static void read_64bit_header(const unsigned char **tzf, timelib_tzinfo *tz)
+{
+	uint32_t buffer[6];
+
+	memcpy(&buffer, *tzf, sizeof(buffer));
+	tz->bit64.ttisgmtcnt = timelib_conv_int(buffer[0]);
+	tz->bit64.ttisstdcnt = timelib_conv_int(buffer[1]);
+	tz->bit64.leapcnt    = timelib_conv_int(buffer[2]);
+	tz->bit64.timecnt    = timelib_conv_int(buffer[3]);
+	tz->bit64.typecnt    = timelib_conv_int(buffer[4]);
+	tz->bit64.charcnt    = timelib_conv_int(buffer[5]);
+	*tzf += sizeof(buffer);
+}
+
 timelib_tzinfo *timelib_parse_tzfile(char *timezone, const timelib_tzdb *tzdb)
 {
 	const unsigned char *tzf;
 	timelib_tzinfo *tmp;
+	int version;

 	if (seek_to_tz_position(&tzf, timezone, tzdb)) {
 		tmp = timelib_tzinfo_ctor(timezone);

-		read_preamble(&tzf, tmp);
+		version = read_preamble(&tzf, tmp);
 		read_header(&tzf, tmp);
 		read_transistions(&tzf, tmp);
 		read_types(&tzf, tmp);
+		if (version == 2) {
+			skip_64bit_preamble(&tzf, tmp);
+			read_64bit_header(&tzf, tmp);
+			skip_64bit_transistions(&tzf, tmp);
+			skip_64bit_types(&tzf, tmp);
+			skip_posix_string(&tzf, tmp);
+		}
 		read_location(&tzf, tmp);
 	} else {
 		tmp = NULL;
@@ -336,18 +403,18 @@ static ttinfo* fetch_timezone_offset(timelib_tzinfo *tz, timelib_sll ts, timelib
 {
 	uint32_t i;

-	/* If there is no transistion time, we pick the first one, if that doesn't
+	/* If there is no transition time, we pick the first one, if that doesn't
 	 * exist we return NULL */
-	if (!tz->timecnt || !tz->trans) {
+	if (!tz->bit32.timecnt || !tz->trans) {
 		*transition_time = 0;
-		if (tz->typecnt == 1) {
+		if (tz->bit32.typecnt == 1) {
 			return &(tz->type[0]);
 		}
 		return NULL;
 	}

-	/* If the TS is lower than the first transistion time, then we scan over
-	 * all the transistion times to find the first non-DST one, or the first
+	/* If the TS is lower than the first transition time, then we scan over
+	 * all the transition times to find the first non-DST one, or the first
 	 * one in case there are only DST entries. Not sure which smartass came up
 	 * with this idea in the first though :) */
 	if (ts < tz->trans[0]) {
@@ -355,10 +422,10 @@ static ttinfo* fetch_timezone_offset(timelib_tzinfo *tz, timelib_sll ts, timelib

 		*transition_time = 0;
 		j = 0;
-		while (j < tz->timecnt && tz->type[j].isdst) {
+		while (j < tz->bit32.timecnt && tz->type[j].isdst) {
 			++j;
 		}
-		if (j == tz->timecnt) {
+		if (j == tz->bit32.timecnt) {
 			j = 0;
 		}
 		return &(tz->type[j]);
@@ -366,25 +433,25 @@ static ttinfo* fetch_timezone_offset(timelib_tzinfo *tz, timelib_sll ts, timelib

 	/* In all other cases we loop through the available transtion times to find
 	 * the correct entry */
-	for (i = 0; i < tz->timecnt; i++) {
+	for (i = 0; i < tz->bit32.timecnt; i++) {
 		if (ts < tz->trans[i]) {
 			*transition_time = tz->trans[i - 1];
 			return &(tz->type[tz->trans_idx[i - 1]]);
 		}
 	}
-	*transition_time = tz->trans[tz->timecnt - 1];
-	return &(tz->type[tz->trans_idx[tz->timecnt - 1]]);
+	*transition_time = tz->trans[tz->bit32.timecnt - 1];
+	return &(tz->type[tz->trans_idx[tz->bit32.timecnt - 1]]);
 }

 static tlinfo* fetch_leaptime_offset(timelib_tzinfo *tz, timelib_sll ts)
 {
 	int i;

-	if (!tz->leapcnt || !tz->leap_times) {
+	if (!tz->bit32.leapcnt || !tz->leap_times) {
 		return NULL;
 	}

-	for (i = tz->leapcnt - 1; i > 0; i--) {
+	for (i = tz->bit32.leapcnt - 1; i > 0; i--) {
 		if (ts > tz->leap_times[i].trans) {
 			return &(tz->leap_times[i]);
 		}
@@ -396,7 +463,7 @@ int timelib_timestamp_is_in_dst(timelib_sll ts, timelib_tzinfo *tz)
 {
 	ttinfo *to;
 	timelib_sll dummy;
-	
+
 	if ((to = fetch_timezone_offset(tz, ts, &dummy))) {
 		return to->isdst;
 	}
@@ -439,12 +506,12 @@ timelib_sll timelib_get_current_offset(timelib_time *t)
 {
 	timelib_time_offset *gmt_offset;
 	timelib_sll retval;
-			
+
 	switch (t->zone_type) {
 		case TIMELIB_ZONETYPE_ABBR:
 		case TIMELIB_ZONETYPE_OFFSET:
 			return (t->z + t->dst) * -60;
-			
+
 		case TIMELIB_ZONETYPE_ID:
 			gmt_offset = timelib_get_time_zone_info(t->sse, t->tz_info);
 			retval = gmt_offset->offset;
@@ -116,26 +116,26 @@ timelib_tzinfo* timelib_tzinfo_ctor(char *name)
 timelib_tzinfo *timelib_tzinfo_clone(timelib_tzinfo *tz)
 {
 	timelib_tzinfo *tmp = timelib_tzinfo_ctor(tz->name);
-	tmp->ttisgmtcnt = tz->ttisgmtcnt;
-	tmp->ttisstdcnt = tz->ttisstdcnt;
-	tmp->leapcnt = tz->leapcnt;
-	tmp->timecnt = tz->timecnt;
-	tmp->typecnt = tz->typecnt;
-	tmp->charcnt = tz->charcnt;
-	
-	tmp->trans = (int32_t *) malloc(tz->timecnt * sizeof(int32_t));
-	tmp->trans_idx = (unsigned char*) malloc(tz->timecnt * sizeof(unsigned char));
-	memcpy(tmp->trans, tz->trans, tz->timecnt * sizeof(int32_t));
-	memcpy(tmp->trans_idx, tz->trans_idx, tz->timecnt * sizeof(unsigned char));
+	tmp->bit32.ttisgmtcnt = tz->bit32.ttisgmtcnt;
+	tmp->bit32.ttisstdcnt = tz->bit32.ttisstdcnt;
+	tmp->bit32.leapcnt = tz->bit32.leapcnt;
+	tmp->bit32.timecnt = tz->bit32.timecnt;
+	tmp->bit32.typecnt = tz->bit32.typecnt;
+	tmp->bit32.charcnt = tz->bit32.charcnt;

-	tmp->type = (ttinfo*) malloc(tz->typecnt * sizeof(struct ttinfo));
-	memcpy(tmp->type, tz->type, tz->typecnt * sizeof(struct ttinfo));
+	tmp->trans = (int32_t *) malloc(tz->bit32.timecnt * sizeof(int32_t));
+	tmp->trans_idx = (unsigned char*) malloc(tz->bit32.timecnt * sizeof(unsigned char));
+	memcpy(tmp->trans, tz->trans, tz->bit32.timecnt * sizeof(int32_t));
+	memcpy(tmp->trans_idx, tz->trans_idx, tz->bit32.timecnt * sizeof(unsigned char));

-	tmp->timezone_abbr = (char*) malloc(tz->charcnt);
-	memcpy(tmp->timezone_abbr, tz->timezone_abbr, tz->charcnt);
+	tmp->type = (ttinfo*) malloc(tz->bit32.typecnt * sizeof(struct ttinfo));
+	memcpy(tmp->type, tz->type, tz->bit32.typecnt * sizeof(struct ttinfo));

-	tmp->leap_times = (tlinfo*) malloc(tz->leapcnt * sizeof(tlinfo));
-	memcpy(tmp->leap_times, tz->leap_times, tz->leapcnt * sizeof(tlinfo));
+	tmp->timezone_abbr = (char*) malloc(tz->bit32.charcnt);
+	memcpy(tmp->timezone_abbr, tz->timezone_abbr, tz->bit32.charcnt);
+
+	tmp->leap_times = (tlinfo*) malloc(tz->bit32.leapcnt * sizeof(tlinfo));
+	memcpy(tmp->leap_times, tz->leap_times, tz->bit32.leapcnt * sizeof(tlinfo));

 	return tmp;
 }
@@ -236,7 +236,7 @@ void timelib_dump_date(timelib_time *d, int options)

 	if ((options & 1) == 1) {
 		if (d->have_relative) {
-			printf("%3lldY %3lldM %3lldD / %3lldH %3lldM %3lldS", 
+			printf("%3lldY %3lldM %3lldD / %3lldH %3lldM %3lldS",
 				d->relative.y, d->relative.m, d->relative.d, d->relative.h, d->relative.i, d->relative.s);
 			if (d->relative.first_last_day_of != 0) {
 				switch (d->relative.first_last_day_of) {
@@ -271,7 +271,7 @@ void timelib_dump_date(timelib_time *d, int options)

 void timelib_dump_rel_time(timelib_rel_time *d)
 {
-	printf("%3lldY %3lldM %3lldD / %3lldH %3lldM %3lldS (days: %lld)%s", 
+	printf("%3lldY %3lldM %3lldD / %3lldH %3lldM %3lldS (days: %lld)%s",
 		d->y, d->m, d->d, d->h, d->i, d->s, d->days, d->invert ? " inverted" : "");
 	if (d->first_last_day_of != 0) {
 		switch (d->first_last_day_of) {
@@ -38,6 +38,9 @@
 #define TIMELIB_SPECIAL_DAY_OF_WEEK_IN_MONTH      0x02
 #define TIMELIB_SPECIAL_LAST_DAY_OF_WEEK_IN_MONTH 0x03

+#define TIMELIB_SPECIAL_FIRST_DAY_OF_MONTH        0x01
+#define TIMELIB_SPECIAL_LAST_DAY_OF_MONTH         0x02
+
 #ifndef LONG_MAX
 #define LONG_MAX 2147483647L
 #endif
@@ -77,8 +80,8 @@ long timelib_parse_tz_cor(char**);

 /* From parse_iso_intervals.re */
 void timelib_strtointerval(char *s, int len, 
-                           timelib_time **begin, timelib_time **end, 
-						   timelib_rel_time **period, int *recurrences, 
+                           timelib_time **begin, timelib_time **end,
+						   timelib_rel_time **period, int *recurrences,
 						   struct timelib_error_container **errors);


@@ -104,12 +104,22 @@ typedef struct tlocinfo
 typedef struct timelib_tzinfo
 {
 	char    *name;
-	uint32_t ttisgmtcnt;
-	uint32_t ttisstdcnt;
-	uint32_t leapcnt;
-	uint32_t timecnt;
-	uint32_t typecnt;
-	uint32_t charcnt;
+	struct {
+		uint32_t ttisgmtcnt;
+		uint32_t ttisstdcnt;
+		uint32_t leapcnt;
+		uint32_t timecnt;
+		uint32_t typecnt;
+		uint32_t charcnt;
+	} bit32;
+	struct {
+		uint64_t ttisgmtcnt;
+		uint64_t ttisstdcnt;
+		uint64_t leapcnt;
+		uint64_t timecnt;
+		uint64_t typecnt;
+		uint64_t charcnt;
+	} bit64;

 	int32_t *trans;
 	unsigned char *trans_idx;
@@ -106,7 +106,7 @@ static int do_range_limit_days(timelib_sll *y, timelib_sll *m, timelib_sll *d)
 	timelib_sll days_this_month;
 	timelib_sll last_month, last_year;
 	timelib_sll days_last_month;
-	
+
 	/* can jump an entire leap year period quickly */
 	if (*d >= DAYS_PER_LYEAR_PERIOD || *d <= -DAYS_PER_LYEAR_PERIOD) {
 		*y += YEARS_PER_LYEAR_PERIOD * (*d / DAYS_PER_LYEAR_PERIOD);
@@ -205,15 +205,17 @@ static void do_adjust_relative(timelib_time* time)
 		time->m += time->relative.m;
 		time->y += time->relative.y;
 	}
+
 	switch (time->relative.first_last_day_of) {
-		case 1: /* first */
+		case TIMELIB_SPECIAL_FIRST_DAY_OF_MONTH: /* first */
 			time->d = 1;
 			break;
-		case 2: /* last */
+		case TIMELIB_SPECIAL_LAST_DAY_OF_MONTH: /* last */
 			time->d = 0;
 			time->m++;
 			break;
 	}
+
 	timelib_do_normalize(time);
 }

@@ -296,6 +298,15 @@ static void do_adjust_special_early(timelib_time* time)
 				break;
 		}
 	}
+	switch (time->relative.first_last_day_of) {
+		case TIMELIB_SPECIAL_FIRST_DAY_OF_MONTH: /* first */
+			time->d = 1;
+			break;
+		case TIMELIB_SPECIAL_LAST_DAY_OF_MONTH: /* last */
+			time->d = 0;
+			time->m++;
+			break;
+	}
 	timelib_do_normalize(time);
 }

@@ -385,7 +396,7 @@ static timelib_sll do_adjust_timezone(timelib_time *tz, timelib_tzinfo *tzi)
 				timelib_time_offset *before, *after;
 				timelib_sll          tmp;
 				int                  in_transistion;
-				
+
 				tz->is_localtime = 1;
 				before = timelib_get_time_zone_info(tz->sse, tzi);
 				after = timelib_get_time_zone_info(tz->sse - before->offset, tzi);
@@ -395,7 +406,7 @@ static timelib_sll do_adjust_timezone(timelib_time *tz, timelib_tzinfo *tzi)
 					((tz->sse - after->offset) >= (after->transistion_time + (before->offset - after->offset))) &&
 					((tz->sse - after->offset) < after->transistion_time)
 				);
-				
+
 				if ((before->offset != after->offset) && !in_transistion) {
 					tmp = -after->offset;
 				} else {
@@ -453,7 +464,7 @@ int main(void)
 	printf ("%04d-%02d-%02d %02d:%02d:%02d.%-5d %+04d %1d",
 		time.y, time.m, time.d, time.h, time.i, time.s, time.f, time.z, time.dst);
 	if (time.have_relative) {
-		printf ("%3dY %3dM %3dD / %3dH %3dM %3dS", 
+		printf ("%3dY %3dM %3dD / %3dH %3dM %3dS",
 			time.relative.y, time.relative.m, time.relative.d, time.relative.h, time.relative.i, time.relative.s);
 	}
 	if (time.have_weekday_relative) {
@@ -141,7 +141,7 @@ void timelib_update_from_sse(timelib_time *tm)
 	signed int dst = tm->dst;

 	sse = tm->sse;
-	
+
 	switch (tm->zone_type) {
 		case TIMELIB_ZONETYPE_ABBR:
 		case TIMELIB_ZONETYPE_OFFSET: {
@@ -152,11 +152,11 @@ void timelib_update_from_sse(timelib_time *tm)

 		case TIMELIB_ZONETYPE_ID: {
 			timelib_time_offset *gmt_offset;
-			
+
 			gmt_offset = timelib_get_time_zone_info(tm->sse, tm->tz_info);
 			timelib_unixtime2gmt(tm, tm->sse + gmt_offset->offset);
 			timelib_time_offset_dtor(gmt_offset);
-			
+
 			goto cleanup;
 		}

@@ -182,7 +182,7 @@ void timelib_unixtime2local(timelib_time *tm, timelib_sll ts)
 		case TIMELIB_ZONETYPE_OFFSET: {
 			int z = tm->z;
 			signed int dst = tm->dst;
-			
+
 			timelib_unixtime2gmt(tm, ts - (tm->z * 60) + (tm->dst * 3600));

 			tm->z = z;
@@ -195,7 +195,7 @@ void timelib_unixtime2local(timelib_time *tm, timelib_sll ts)
 			timelib_unixtime2gmt(tm, ts + gmt_offset->offset);

 			/* we need to reset the sse here as unixtime2gmt modifies it */
-			tm->sse = ts; 
+			tm->sse = ts;
 			tm->dst = gmt_offset->is_dst;
 			tm->z = gmt_offset->offset;
 			tm->tz_info = tz;
@@ -877,6 +877,10 @@ PHP_MSHUTDOWN_FUNCTION(date)
 		timelib_error_container_dtor(DATEG(last_errors));
 	}

+#ifndef ZTS
+	DATEG(default_timezone) = NULL;
+#endif
+
 	return SUCCESS;
 }
 /* }}} */
@@ -2989,7 +2993,7 @@ void php_date_do_return_parsed_time(INTERNAL_FUNCTION_PARAMETERS, timelib_time *
 			add_assoc_long(element, "weekdays", parsed_time->relative.special.amount);
 		}
 		if (parsed_time->relative.first_last_day_of) {
-			add_assoc_bool(element, parsed_time->relative.first_last_day_of == 1 ? "first_day_of_month" : "last_day_of_month", 1);
+			add_assoc_bool(element, parsed_time->relative.first_last_day_of == TIMELIB_SPECIAL_FIRST_DAY_OF_MONTH ? "first_day_of_month" : "last_day_of_month", 1);
 		}
 		add_assoc_zval(return_value, "relative", element);
 	}
@@ -3898,7 +3902,7 @@ PHP_FUNCTION(timezone_transitions_get)
 		add_assoc_string(element, "abbr", &tzobj->tzi.tz->timezone_abbr[tzobj->tzi.tz->type[tzobj->tzi.tz->trans_idx[i]].abbr_idx], 1); \
 		add_next_index_zval(return_value, element);

-#define add_last() add(tzobj->tzi.tz->timecnt - 1, timestamp_begin)
+#define add_last() add(tzobj->tzi.tz->bit32.timecnt - 1, timestamp_begin)

 	array_init(return_value);

@@ -3909,7 +3913,7 @@ PHP_FUNCTION(timezone_transitions_get)
 	} else {
 		begin = 0;
 		found = 0;
-		if (tzobj->tzi.tz->timecnt > 0) {
+		if (tzobj->tzi.tz->bit32.timecnt > 0) {
 			do {
 				if (tzobj->tzi.tz->trans[begin] > timestamp_begin) {
 					if (begin > 0) {
@@ -3921,18 +3925,18 @@ PHP_FUNCTION(timezone_transitions_get)
 					break;
 				}
 				begin++;
-			} while (begin < tzobj->tzi.tz->timecnt);
+			} while (begin < tzobj->tzi.tz->bit32.timecnt);
 		}
 	}

 	if (!found) {
-		if (tzobj->tzi.tz->timecnt > 0) {
+		if (tzobj->tzi.tz->bit32.timecnt > 0) {
 			add_last();
 		} else {
 			add_nominal();
 		}
 	} else {
-		for (i = begin; i < tzobj->tzi.tz->timecnt; ++i) {
+		for (i = begin; i < tzobj->tzi.tz->bit32.timecnt; ++i) {
 			if (tzobj->tzi.tz->trans[i] < timestamp_end) {
 				add(i, tzobj->tzi.tz->trans[i]);
 			}
@@ -193,6 +193,7 @@ PHPAPI timelib_tzinfo *get_timezone_info(TSRMLS_D);

 /* Grabbing CE's so that other exts can use the date objects too */
 PHPAPI zend_class_entry *php_date_get_date_ce(void);
+PHPAPI zend_class_entry *php_date_get_immutable_ce(void);
 PHPAPI zend_class_entry *php_date_get_timezone_ce(void);

 /* Functions for creating DateTime objects, and initializing them from a string */
@@ -16,7 +16,7 @@ date_default_timezone_set("Europe/London");
 // Create a DateTimeZone object
 $tz = new DateTimeZone("Europe/London");

-$tran = $tz->getTransitions();
+$tran = $tz->getTransitions(-306972000, -37241999);

 if (!is_array($tran)) {
 	echo "TEST FAILED: Expected an array\n";
@@ -25,14 +25,14 @@ if (!is_array($tran)) {
 echo "\n-- Total number of transitions: " . count($tran). " --\n"; 

 echo "\n-- Format a sample entry for Spring 1963 --\n";
-var_dump( $tran[97] );	
+var_dump( $tran[6] );

 ?>
 ===DONE===
 --EXPECT--
 *** Testing DateTimeZone::getTransitions() : basic functionality ***

-- Total number of transitions: 243 --
+-- Total number of transitions: 18 --

 -- Format a sample entry for Spring 1963 --
 array(5) {
@@ -10,6 +10,6 @@ define('PHPT_DATETIME_SHOW', PHPT_DATETIME_SHOW_ADD);
 require 'DateTime_data-massive.inc';

 ?>
--EXPECT--
-test_massive_positive: ADD: -333333-01-01 16:18:02 EST + P+666666Y0M0DT0H0M0S = **333333-01-01 16:18:02 EST**
-test_massive_negative: ADD: 333333-01-01 16:18:02 EST + P-666666Y0M0DT0H0M0S = **-333333-01-01 16:18:02 EST**
+--EXPECTF--
+test_massive_positive: ADD: -333333-01-01 16:18:02 %s + P+666666Y0M0DT0H0M0S = **333333-01-01 16:18:02 %s**
+test_massive_negative: ADD: 333333-01-01 16:18:02 %s + P-666666Y0M0DT0H0M0S = **-333333-01-01 16:18:02 %s**
@@ -10,6 +10,6 @@ define('PHPT_DATETIME_SHOW', PHPT_DATETIME_SHOW_DIFF);
 require 'DateTime_data-massive.inc';

 ?>
--EXPECT--
-test_massive_positive: DIFF: 333333-01-01 16:18:02 EST - -333333-01-01 16:18:02 EST = **P+666666Y0M0DT0H0M0S**
-test_massive_negative: DIFF: -333333-01-01 16:18:02 EST - 333333-01-01 16:18:02 EST = **P-666666Y0M0DT0H0M0S**
+--EXPECTF--
+test_massive_positive: DIFF: 333333-01-01 16:18:02 %s - -333333-01-01 16:18:02 %s = **P+666666Y0M0DT0H%s**
+test_massive_negative: DIFF: -333333-01-01 16:18:02 %s - 333333-01-01 16:18:02 %s = **P-666666Y0M0DT0H%s**
@@ -10,6 +10,6 @@ define('PHPT_DATETIME_SHOW', PHPT_DATETIME_SHOW_SUB);
 require 'DateTime_data-massive.inc';

 ?>
--EXPECT--
-test_massive_positive: SUB: 333333-01-01 16:18:02 EST - P+666666Y0M0DT0H0M0S = **-333333-01-01 16:18:02 EST**
-test_massive_negative: SUB: -333333-01-01 16:18:02 EST - P-666666Y0M0DT0H0M0S = **333333-01-01 16:18:02 EST**
+--EXPECTF--
+test_massive_positive: SUB: 333333-01-01 16:18:02 %s - P+666666Y0M0DT0H0M0S = **-333333-01-01 16:18:02 %s**
+test_massive_negative: SUB: -333333-01-01 16:18:02 %s - P-666666Y0M0DT0H0M0S = **333333-01-01 16:18:02 %s**
@@ -46,7 +46,7 @@ array(12) {
 bool(false)
 object(DateTime)#1 (3) {
  ["date"]=>
-  string(20) "-0001-11-30 00:00:00.000000"
+  string(27) "-0001-11-30 00:00:00.000000"
  ["timezone_type"]=>
  int(3)
  ["timezone"]=>
@@ -20,10 +20,10 @@ array(5) {
  ["time"]=>
  string(%d) "%s"
  ["offset"]=>
-  int(3600)
+  int(%s)
  ["isdst"]=>
-  bool(true)
+  bool(%s)
  ["abbr"]=>
-  string(3) "BST"
+  string(%d) "%s"
 }
 10000002008-02-28T12:00:00+0000
@@ -0,0 +1,20 @@
+--TEST--
+Bug #69336 (Issues with "last day of <monthname>")
+--INI--
+date.timezone=UTC
+--FILE--
+<?php
+var_dump(date('d.m.Y',strtotime('last day of april')));
+var_dump(date('d.m.Y',strtotime('last tuesday of march 2015')));
+var_dump(date('d.m.Y',strtotime('last wednesday of march 2015')));
+var_dump(date('d.m.Y',strtotime('last wednesday of april 2015')));
+var_dump(date('d.m.Y',strtotime('last wednesday of march 2014')));
+var_dump(date('d.m.Y',strtotime('last wednesday of april 2014')));
+?>
+--EXPECTF--
+string(10) "30.04.%d"
+string(10) "31.03.2015"
+string(10) "25.03.2015"
+string(10) "29.04.2015"
+string(10) "26.03.2014"
+string(10) "30.04.2014"
@@ -27,7 +27,7 @@ var_dump( getdate($timestamp) );
 -- Testing getdate\(\) function by passing float 12.3456789000e10 value to timestamp --
 array\(11\) {
  \["seconds"\]=>
-  int\((36|0)\)
+  int\((.+)\)
  \["minutes"\]=>
  int\((43|0)\)
  \["hours"\]=>
@@ -53,7 +53,7 @@ array\(11\) {
 -- Testing getdate\(\) function by passing float -12.3456789000e10 value to timestamp --
 array\(11\) {
  \["seconds"\]=>
-  int\((44|12|20)\)
+  int\((.+)\)
  \["minutes"\]=>
  int\((39|23)\)
  \["hours"\]=>
@@ -61,7 +61,7 @@ array\(11\) {
  \["mday"\]=>
  int\((9|14|23)\)
  \["wday"\]=>
-  int\(0\)
+  int\((0|6)\)
  \["mon"\]=>
  int\((10|12)\)
  \["year"\]=>
@@ -69,7 +69,7 @@ array\(11\) {
  \["yday"\]=>
  int\((282|347|295)\)
  \["weekday"\]=>
-  string\(6\) "Sunday"
+  string\((6|8)\) "(Sunday|Saturday)"
  \["month"\]=>
  string\((7|8)\) "(October|December)"
  \[0\]=>
@@ -87,7 +87,7 @@ array\(9\) {
  \[5\]=>
  int\((104|1|-3843)\)
  \[6\]=>
-  int\(6\)
+  int\((5|6)\)
  \[7\]=>
  int\((281|346|294)\)
  \[8\]=>
@@ -107,7 +107,7 @@ array\(9\) {
  \["tm_year"\]=>
  int\((104|1|-3843)\)
  \["tm_wday"\]=>
-  int\(6\)
+  int\((5|6)\)
  \["tm_yday"\]=>
  int\((281|346|294)\)
  \["tm_isdst"\]=>
@@ -24,7 +24,7 @@ foreach ($tzs as $tz) {
 	echo "\n";
 }
 ?>
--EXPECT--
+--EXPECTF--
 America/Toronto
 Y:    0 - January 2000-01-01T01:01:01-0500
 Y:   69 - January 2069-01-01T01:01:01-0500
@@ -32,11 +32,11 @@ Y:   70 - January 1970-01-01T01:01:01-0500
 Y:   71 - January 1971-01-01T01:01:01-0500
 Y:   99 - January 1999-01-01T01:01:01-0500
 Y:  100 - January 2000-01-01T01:01:01-0500
-Y:  101 - January 0101-01-01T01:01:01-0500
-Y:  105 - January 0105-01-01T01:01:01-0500
-Y:  110 - January 0110-01-01T01:01:01-0500
-Y: 1900 - January 1900-01-01T01:01:01-0500
-Y: 1901 - January 1901-01-01T01:01:01-0500
+Y:  101 - January 0101-01-01T01:01:01-0%d
+Y:  105 - January 0105-01-01T01:01:01-0%d
+Y:  110 - January 0110-01-01T01:01:01-0%d
+Y: 1900 - January 1900-01-01T01:01:01-0%d
+Y: 1901 - January 1901-01-01T01:01:01-0%d
 Y: 1902 - January 1902-01-01T01:01:01-0500
 Y: 1999 - January 1999-01-01T01:01:01-0500
 Y: 2000 - January 2000-01-01T01:01:01-0500
@@ -49,11 +49,11 @@ Y:   70 - January 1970-01-01T01:01:01+0100
 Y:   71 - January 1971-01-01T01:01:01+0100
 Y:   99 - January 1999-01-01T01:01:01+0100
 Y:  100 - January 2000-01-01T01:01:01+0100
-Y:  101 - January 0101-01-01T01:01:01+0100
-Y:  105 - January 0105-01-01T01:01:01+0100
-Y:  110 - January 0110-01-01T01:01:01+0100
-Y: 1900 - January 1900-01-01T01:01:01+0100
-Y: 1901 - January 1901-01-01T01:01:01+0100
+Y:  101 - January 0101-01-01T01:01:01+0%d
+Y:  105 - January 0105-01-01T01:01:01+0%d
+Y:  110 - January 0110-01-01T01:01:01+0%d
+Y: 1900 - January 1900-01-01T01:01:01+0%d
+Y: 1901 - January 1901-01-01T01:01:01+0%d
 Y: 1902 - January 1902-01-01T01:01:01+0100
 Y: 1999 - January 1999-01-01T01:01:01+0100
 Y: 2000 - January 2000-01-01T01:01:01+0100
@@ -18,24 +18,24 @@ $tz = timezone_open("Europe/London");

 $tran = timezone_transitions_get($tz);

-echo "\n-- Get all transitions --\n"; 
-$tran = timezone_transitions_get($tz);
+echo "\n-- Get all 60s transitions --\n";
+$tran = timezone_transitions_get($tz, -306972000, -37241999);
 var_dump( gettype($tran) );

 echo "\n-- Total number of transitions: " . count($tran). " --\n"; 

 echo "\n-- Format a sample entry pfor Spring 1963 --\n";
-var_dump( $tran[97] );	
+var_dump( $tran[6] );

 ?>
 ===DONE===
 --EXPECT--
 *** Testing timezone_transitions_get() : basic functionality ***

-- Get all transitions --
+-- Get all 60s transitions --
 string(5) "array"

-- Total number of transitions: 243 --
+-- Total number of transitions: 18 --

 -- Format a sample entry pfor Spring 1963 --
 array(5) {
@@ -914,7 +914,7 @@ static void php_dba_open(INTERNAL_FUNCTION_PARAMETERS, int persistent)
 				RETURN_FALSE;
 #ifdef F_SETFL
 			} else if (modenr == DBA_CREAT) {
-				int flags = fcntl(info->fd, F_SETFL);
+				int flags = fcntl(info->fd, F_GETFL);
 				fcntl(info->fd, F_SETFL, flags & ~O_APPEND);
 #endif
 			}
@@ -187,10 +187,10 @@ ZEND_END_ARG_INFO();
 /* }}} */

 /*
-* class DOMDocument extends DOMNode 
+* class DOMDocument extends DOMNode
 *
 * URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-i-Document
-* Since: 
+* Since:
 */

 const zend_function_entry php_dom_document_class_functions[] = { /* {{{ */
@@ -235,10 +235,10 @@ const zend_function_entry php_dom_document_class_functions[] = { /* {{{ */
 };
 /* }}} */

-/* {{{ docType	DOMDocumentType	
-readonly=yes 
+/* {{{ docType	DOMDocumentType
+readonly=yes
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-B63ED1A31
-Since: 
+Since:
 */
 int dom_document_doctype_read(dom_object *obj, zval **retval TSRMLS_DC)
 {
@@ -266,15 +266,15 @@ int dom_document_doctype_read(dom_object *obj, zval **retval TSRMLS_DC)
 		return FAILURE;
 	}
 	return SUCCESS;
-	
+
 }

 /* }}} */

-/* {{{ implementation	DOMImplementation	
-readonly=yes 
+/* {{{ implementation	DOMImplementation
+readonly=yes
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-1B793EBA
-Since: 
+Since:
 */
 int dom_document_implementation_read(dom_object *obj, zval **retval TSRMLS_DC)
 {
@@ -285,10 +285,10 @@ int dom_document_implementation_read(dom_object *obj, zval **retval TSRMLS_DC)

 /* }}} */

-/* {{{ documentElement	DOMElement	
-readonly=yes 
+/* {{{ documentElement	DOMElement
+readonly=yes
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-87CD092
-Since: 
+Since:
 */
 int dom_document_document_element_read(dom_object *obj, zval **retval TSRMLS_DC)
 {
@@ -391,8 +391,8 @@ int dom_document_encoding_write(dom_object *obj, zval *newval TSRMLS_DC)

 /* }}} */

-/* {{{ standalone	boolean	
-readonly=no 
+/* {{{ standalone	boolean
+readonly=no
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-Document3-standalone
 Since: DOM Level 3
 */
@@ -455,7 +455,7 @@ int dom_document_standalone_write(dom_object *obj, zval *newval TSRMLS_DC)

 /* }}} */

-/* {{{ version	string	
+/* {{{ version	string
 readonly=no
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-Document3-version
 Since: DOM Level 3
@@ -520,8 +520,8 @@ int dom_document_version_write(dom_object *obj, zval *newval TSRMLS_DC)

 /* }}} */

-/* {{{ strictErrorChecking	boolean	
-readonly=no 
+/* {{{ strictErrorChecking	boolean
+readonly=no
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-Document3-strictErrorChecking
 Since: DOM Level 3
 */
@@ -565,7 +565,7 @@ int dom_document_strict_error_checking_write(dom_object *obj, zval *newval TSRML

 /* }}} */

-/* {{{ formatOutput	boolean	
+/* {{{ formatOutput	boolean
 readonly=no
 */
 int dom_document_format_output_read(dom_object *obj, zval **retval TSRMLS_DC)
@@ -607,7 +607,7 @@ int dom_document_format_output_write(dom_object *obj, zval *newval TSRMLS_DC)
 }
 /* }}} */

-/* {{{ validateOnParse	boolean	
+/* {{{ validateOnParse	boolean
 readonly=no
 */
 int	dom_document_validate_on_parse_read(dom_object *obj, zval **retval TSRMLS_DC)
@@ -649,7 +649,7 @@ int dom_document_validate_on_parse_write(dom_object *obj, zval *newval TSRMLS_DC
 }
 /* }}} */

-/* {{{ resolveExternals	boolean	
+/* {{{ resolveExternals	boolean
 readonly=no
 */
 int dom_document_resolve_externals_read(dom_object *obj, zval **retval TSRMLS_DC)
@@ -691,7 +691,7 @@ int dom_document_resolve_externals_write(dom_object *obj, zval *newval TSRMLS_DC
 }
 /* }}} */

-/* {{{ preserveWhiteSpace	boolean	
+/* {{{ preserveWhiteSpace	boolean
 readonly=no
 */
 int dom_document_preserve_whitespace_read(dom_object *obj, zval **retval TSRMLS_DC)
@@ -733,7 +733,7 @@ int dom_document_preserve_whitespace_write(dom_object *obj, zval *newval TSRMLS_
 }
 /* }}} */

-/* {{{ recover	boolean	
+/* {{{ recover	boolean
 readonly=no
 */
 int dom_document_recover_read(dom_object *obj, zval **retval TSRMLS_DC)
@@ -775,7 +775,7 @@ int dom_document_recover_write(dom_object *obj, zval *newval TSRMLS_DC)
 }
 /* }}} */

-/* {{{ substituteEntities	boolean	
+/* {{{ substituteEntities	boolean
 readonly=no
 */
 int dom_document_substitue_entities_read(dom_object *obj, zval **retval TSRMLS_DC)
@@ -817,8 +817,8 @@ int dom_document_substitue_entities_write(dom_object *obj, zval *newval TSRMLS_D
 }
 /* }}} */

-/* {{{ documentURI	string	
-readonly=no 
+/* {{{ documentURI	string
+readonly=no
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-Document3-documentURI
 Since: DOM Level 3
 */
@@ -881,8 +881,8 @@ int dom_document_document_uri_write(dom_object *obj, zval *newval TSRMLS_DC)

 /* }}} */

-/* {{{ config	DOMConfiguration	
-readonly=yes 
+/* {{{ config	DOMConfiguration
+readonly=yes
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-Document3-config
 Since: DOM Level 3
 */
@@ -897,7 +897,7 @@ int dom_document_config_read(dom_object *obj, zval **retval TSRMLS_DC)

 /* {{{ proto DOMElement dom_document_create_element(string tagName [, string value]);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-2141741547
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_element)
 {
@@ -930,7 +930,7 @@ PHP_FUNCTION(dom_document_create_element)

 /* {{{ proto DOMDocumentFragment dom_document_create_document_fragment();
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-35CB04B5
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_document_fragment)
 {
@@ -957,7 +957,7 @@ PHP_FUNCTION(dom_document_create_document_fragment)

 /* {{{ proto DOMText dom_document_create_text_node(string data);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-1975348127
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_text_node)
 {
@@ -985,7 +985,7 @@ PHP_FUNCTION(dom_document_create_text_node)

 /* {{{ proto DOMComment dom_document_create_comment(string data);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-1334481328
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_comment)
 {
@@ -1013,7 +1013,7 @@ PHP_FUNCTION(dom_document_create_comment)

 /* {{{ proto DOMCdataSection dom_document_create_cdatasection(string data);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-D26C0AF8
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_cdatasection)
 {
@@ -1041,7 +1041,7 @@ PHP_FUNCTION(dom_document_create_cdatasection)

 /* {{{ proto DOMProcessingInstruction dom_document_create_processing_instruction(string target, string data);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-135944439
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_processing_instruction)
 {
@@ -1076,7 +1076,7 @@ PHP_FUNCTION(dom_document_create_processing_instruction)

 /* {{{ proto DOMAttr dom_document_create_attribute(string name);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-1084891198
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_attribute)
 {
@@ -1110,7 +1110,7 @@ PHP_FUNCTION(dom_document_create_attribute)

 /* {{{ proto DOMEntityReference dom_document_create_entity_reference(string name);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-392B75AE
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_entity_reference)
 {
@@ -1143,7 +1143,7 @@ PHP_FUNCTION(dom_document_create_entity_reference)

 /* {{{ proto DOMNodeList dom_document_get_elements_by_tag_name(string tagname);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-A6C9094
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_get_elements_by_tag_name)
 {
@@ -1177,7 +1177,7 @@ PHP_FUNCTION(dom_document_import_node)
 	xmlDocPtr docp;
 	xmlNodePtr nodep, retnodep;
 	dom_object *intern, *nodeobj;
-	int ret; 
+	int ret;
 	long recursive = 0;

 	if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "OO|l", &id, dom_document_class_entry, &node, dom_node_class_entry, &recursive) == FAILURE) {
@@ -1188,7 +1188,7 @@ PHP_FUNCTION(dom_document_import_node)

 	DOM_GET_OBJ(nodep, node, xmlNodePtr, nodeobj);

-	if (nodep->type == XML_HTML_DOCUMENT_NODE || nodep->type == XML_DOCUMENT_NODE 
+	if (nodep->type == XML_HTML_DOCUMENT_NODE || nodep->type == XML_DOCUMENT_NODE
 		|| nodep->type == XML_DOCUMENT_TYPE_NODE) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot import: Node Type Not Supported");
 		RETURN_FALSE;
@@ -1278,7 +1278,7 @@ PHP_FUNCTION(dom_document_create_element_ns)
 		RETURN_FALSE;
 	}

-	
+
 	nodep->ns = nsptr;

 	DOM_RET_OBJ(nodep, &ret, intern);
@@ -1580,11 +1580,15 @@ static xmlDocPtr dom_document_parser(zval *id, int mode, char *source, int sourc
 	xmlInitParser();

 	if (mode == DOM_LOAD_FILE) {
-		char *file_dest = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN  TSRMLS_CC);
+		char *file_dest;
+		if (CHECK_NULL_PATH(source, source_len)) {
+			return NULL;
+		}
+		file_dest = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN  TSRMLS_CC);
 		if (file_dest) {
 			ctxt = xmlCreateFileParserCtxt(file_dest);
 		}
-		
+
 	} else {
 		ctxt = xmlCreateMemoryParserCtxt(source, source_len);
 	}
@@ -1757,7 +1761,7 @@ PHP_FUNCTION(dom_document_save)
 	char *file;
 	long options = 0;

-	if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os|l", &id, dom_document_class_entry, &file, &file_len, &options) == FAILURE) {
+	if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op|l", &id, dom_document_class_entry, &file, &file_len, &options) == FAILURE) {
 		return;
 	}

@@ -1906,7 +1910,7 @@ PHP_FUNCTION(dom_document_xinclude)
 	zval *id;
 	xmlDoc *docp;
 	xmlNodePtr root;
-	long flags = 0; 
+	long flags = 0;
 	int err;
 	dom_object *intern;

@@ -1919,7 +1923,7 @@ PHP_FUNCTION(dom_document_xinclude)
 	err = xmlXIncludeProcessFlags(docp, flags);

 	/* XML_XINCLUDE_START and XML_XINCLUDE_END nodes need to be removed as these
-	are added via xmlXIncludeProcess to mark beginning and ending of xincluded document 
+	are added via xmlXIncludeProcess to mark beginning and ending of xincluded document
 	but are not wanted in resulting document - must be done even if err as it could fail after
 	having processed some xincludes */
 	root = (xmlNodePtr) docp->children;
@@ -1935,7 +1939,7 @@ PHP_FUNCTION(dom_document_xinclude)
 	} else {
 		RETVAL_FALSE;
 	}
-    
+
 }
 /* }}} */

@@ -1956,19 +1960,19 @@ PHP_FUNCTION(dom_document_validate)
 	DOM_GET_OBJ(docp, id, xmlDocPtr, intern);

 	cvp = xmlNewValidCtxt();
-	
+
 	cvp->userData = NULL;
 	cvp->error    = (xmlValidityErrorFunc) php_libxml_error_handler;
 	cvp->warning  = (xmlValidityErrorFunc) php_libxml_error_handler;
-	
+
 	if (xmlValidateDocument(cvp, docp)) {
 		RETVAL_TRUE;
 	} else {
 		RETVAL_FALSE;
 	}
-	
+
 	xmlFreeValidCtxt(cvp);
-	
+
 }
 /* }}} */

@@ -1987,7 +1991,7 @@ static void _dom_document_schema_validate(INTERNAL_FUNCTION_PARAMETERS, int type
 	int                     is_valid;
 	char resolved_path[MAXPATHLEN + 1];

-	if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op|l", &id, dom_document_class_entry, &source, &source_len, &flags) == FAILURE) {
+	if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os|l", &id, dom_document_class_entry, &source, &source_len, &flags) == FAILURE) {
 		return;
 	}

@@ -2000,6 +2004,10 @@ static void _dom_document_schema_validate(INTERNAL_FUNCTION_PARAMETERS, int type

 	switch (type) {
 	case DOM_LOAD_FILE:
+		if (CHECK_NULL_PATH(source, source_len)) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid Schema file source");
+			RETURN_FALSE;
+		}
 		valid_file = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN  TSRMLS_CC);
 		if (!valid_file) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid Schema file source");
@@ -2009,7 +2017,7 @@ static void _dom_document_schema_validate(INTERNAL_FUNCTION_PARAMETERS, int type
 		break;
 	case DOM_LOAD_STRING:
 		parser = xmlSchemaNewMemParserCtxt(source, source_len);
-		/* If loading from memory, we need to set the base directory for the document 
+		/* If loading from memory, we need to set the base directory for the document
 		   but it is not apparent how to do that for schema's */
 		break;
 	default:
@@ -2083,7 +2091,7 @@ static void _dom_document_relaxNG_validate(INTERNAL_FUNCTION_PARAMETERS, int typ
 	int                     is_valid;
 	char resolved_path[MAXPATHLEN + 1];

-	if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op", &id, dom_document_class_entry, &source, &source_len) == FAILURE) {
+	if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os", &id, dom_document_class_entry, &source, &source_len) == FAILURE) {
 		return;
 	}

@@ -2096,6 +2104,10 @@ static void _dom_document_relaxNG_validate(INTERNAL_FUNCTION_PARAMETERS, int typ

 	switch (type) {
 	case DOM_LOAD_FILE:
+		if (CHECK_NULL_PATH(source, source_len)) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid RelaxNG file source");
+			RETURN_FALSE;
+		}
 		valid_file = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN  TSRMLS_CC);
 		if (!valid_file) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid RelaxNG file source");
@@ -2105,7 +2117,7 @@ static void _dom_document_relaxNG_validate(INTERNAL_FUNCTION_PARAMETERS, int typ
 		break;
 	case DOM_LOAD_STRING:
 		parser = xmlRelaxNGNewMemParserCtxt(source, source_len);
-		/* If loading from memory, we need to set the base directory for the document 
+		/* If loading from memory, we need to set the base directory for the document
 		   but it is not apparent how to do that for schema's */
 		break;
 	default:
@@ -2173,7 +2185,7 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */
 	int source_len, refcount, ret;
 	long options = 0;
 	htmlParserCtxtPtr ctxt;
-	
+
 	id = getThis();

 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|l", &source, &source_len, &options) == FAILURE) {
@@ -2186,6 +2198,10 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */
 	}

 	if (mode == DOM_LOAD_FILE) {
+		if (CHECK_NULL_PATH(source, source_len)) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid file source");
+			RETURN_FALSE;
+		}
 		ctxt = htmlCreateFileParserCtxt(source, NULL);
 	} else {
 		source_len = xmlStrlen(source);
@@ -2209,7 +2225,7 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */
 	htmlParseDocument(ctxt);
 	newdoc = ctxt->myDoc;
 	htmlFreeParserCtxt(ctxt);
-	
+
 	if (!newdoc)
 		RETURN_FALSE;

@@ -2274,7 +2290,7 @@ PHP_FUNCTION(dom_document_save_html_file)
 	char *file;
 	const char *encoding;

-	if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os", &id, dom_document_class_entry, &file, &file_len) == FAILURE) {
+	if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op", &id, dom_document_class_entry, &file, &file_len) == FAILURE) {
 		return;
 	}

@@ -2331,13 +2347,13 @@ PHP_FUNCTION(dom_document_save_html)
 			php_dom_throw_error(WRONG_DOCUMENT_ERR, dom_get_strict_error(intern->document) TSRMLS_CC);
 			RETURN_FALSE;
 		}
-		
+
 		buf = xmlBufferCreate();
 		if (!buf) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not fetch buffer");
 			RETURN_FALSE;
 		}
-		
+
 		if (node->type == XML_DOCUMENT_FRAG_NODE) {
 			int one_size;

@@ -13,6 +13,11 @@ assert.bail=true
 $doc = new DOMDocument();
 $result = $doc->loadHTMLFile("");
 assert('$result === false');
+$doc = new DOMDocument();
+$result = $doc->loadHTMLFile("text.html\0something");
+assert('$result === false');
 ?>
 --EXPECTF--
 %r(PHP ){0,1}%rWarning: DOMDocument::loadHTMLFile(): Empty string supplied as input %s
+
+%r(PHP ){0,1}%rWarning: DOMDocument::loadHTMLFile(): Invalid file source %s
@@ -1284,6 +1284,10 @@ int c;
 	register int ncols = (g->ncsets+(CHAR_BIT-1)) / CHAR_BIT;
 	register unsigned uc = (unsigned char)c;

+	if (!g->setbits) {
+		return(0);
+	}
+
 	for (i = 0, col = g->setbits; i < ncols; i++, col += g->csetsize)
 		if (col[uc] != 0)
 			return(1);
@@ -1,5 +1,5 @@
 --TEST--
-Bug #68799 (Free called on unitialized pointer)
+Bug #68799 (Free called on uninitialized pointer)
 --SKIPIF--
 <?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
 --FILE--
@@ -506,6 +506,11 @@ static void _php_finfo_get_type(INTERNAL_FUNCTION_PARAMETERS, int mode, int mime
 				RETVAL_FALSE;
 				goto clean;
 			}
+			if (CHECK_NULL_PATH(buffer, buffer_len)) {
+				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+				RETVAL_FALSE;
+				goto clean;
+			}

 			wrap = php_stream_locate_url_wrapper(buffer, &tmp2, 0 TSRMLS_CC);

@@ -1037,6 +1037,9 @@ mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
 			if (bytecnt > nbytes) {
 				bytecnt = nbytes;
 			}
+			if (offset > bytecnt) {
+				offset = bytecnt;
+			}
 			if (s == NULL) {
 				ms->search.s_len = 0;
 				ms->search.s = NULL;
@@ -0,0 +1,18 @@
+--TEST--
+Bug #68819 Fileinfo on specific file causes spurious OOM and/or segfault, var 1
+--SKIPIF--
+<?php require_once(dirname(__FILE__) . '/skipif.inc'); ?>
+--FILE--
+<?php
+
+$string = <<<HERE
+----a-----'''---------a---------------a--------a-----a-----a---------a-----as-------a----a--a-------------a--as-----s---------------a---------a---a--s-a-----a-----------asy---------a-----a-----------a----s--------a-------------a-------a--------a----s------------a-----a----------------a----s-----------------\r\n-------------------a-------a-a-------a-----a----a----s----s--------a-----------------------a----a----s-------------a------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-------------------a-------a-a-------a-----a----a----s----s--------a----------a----------------------a----a----s-------------a----------------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n------a-------a-a-------a-----a----a---a-----a-----------------------a----a---a-----a------------------s-------a----a---a-----a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s------\r\n-------------------a-------a-a-------a-----a----a---a-------a------------------------a----a---a-----''--a-------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-------------------a-------a-a-------a-----a----a-------s-----a---a-------------------------a----a-------------a---a-------------------s-------a----a-------------a---a-----as-a--------------a-----a--s----s---------y------------a-----a-s---a-------''----a---s--a-''------''----s------------a-y----------------s------a-----y--a-s--a-s------s--a-s----------''----------------------------a---s--a----a---------a-s---a-s--------s--------a---------s--a-y-------------as----a----a-------------a------a---s--a-s------a--------a----s----y--as--a----a-s---------------a-----a--------------------------------------\r\n-------------------a-------a-a-------a-----a----a-----------s--------a-----------------------a----a--------------------a------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-------------------a-------a-a-------a-----a----a-----------s--------a----------a----------------------a----a--------------------a------------------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-------------------a-------a-a-------a-----a----a---a-----------------------a----a---a------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-------------------a-------a-a-------a-----a----a---a----------a----------------------a----a---a------------------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-----a-a-----------a-------a-a-------a-----a----a----a---s-----a-----------------------a----a----a---------a-----------------s-------a----a----a---------a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-------------------a-------a-a-------a-----a----a--------a----a-----------------------a----a----------a----a------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-----a-------------a-------a-a-------a-----a----a--------s-----a---a-------------------------a----a--------------a---a-------------------s-------------a---------------a----a---a---a-----as-a--------------a-----a--s----s---------y------------a-----a-s---a-------''----a---s--a-''------''----s------------a-y----------------s------a-----y--a-s--a-s------s--a-s----------''----------------------------a---s--a----a---------a-s---a-s--------s--------a---------s--a-y-------------as----a----a-------------a------a---s--a-s------a--------a----s----y--as--a----a-s---------------a-----a-----------Line truncated
+HERE;
+
+$finfo = new finfo();
+$type = $finfo->buffer($string);
+
+var_dump($type);
+?>
+--EXPECT--
+string(60) "ASCII text, with very long lines, with CRLF line terminators"
@@ -0,0 +1,26 @@
+--TEST--
+Bug #68819 Fileinfo on specific file causes spurious OOM and/or segfault, var 2
+--SKIPIF--
+<?php require_once(dirname(__FILE__) . '/skipif.inc'); ?>
+--FILE--
+<?php
+
+$string = '';
+
+// These two in any order
+$string .= "\r\n";
+$string .= "''''";
+
+// Total string length > 8192
+$string .= str_repeat(chr(rand(32, 127)), 8184);
+
+// Ending in this string
+$string .= "say";
+
+$finfo = new finfo();
+$type = $finfo->buffer($string);
+var_dump($type);
+
+?>
+--EXPECT--
+string(60) "ASCII text, with very long lines, with CRLF line terminators"
@@ -19,6 +19,7 @@ echo "*** Testing finfo_file() : basic functionality ***\n";
 var_dump( finfo_file( $finfo, __FILE__) );
 var_dump( finfo_file( $finfo, __FILE__, FILEINFO_CONTINUE ) );
 var_dump( finfo_file( $finfo, $magicFile ) );
+var_dump( finfo_file( $finfo, $magicFile.chr(0).$magicFile) );

 ?>
 ===DONE===
@@ -27,4 +28,7 @@ var_dump( finfo_file( $finfo, $magicFile ) );
 string(28) "text/x-php; charset=us-ascii"
 string(22) "PHP script, ASCII text"
 string(25) "text/plain; charset=utf-8"
+
+Warning: finfo_file(): Invalid path in %s%efinfo_file_basic.php on line %d
+bool(false)
 ===DONE===
@@ -113,7 +113,7 @@ static void php_filter_strip(zval *value, long flags)
 	int   i, c;
 	
 	/* Optimization for if no strip flags are set */
-	if (! ((flags & FILTER_FLAG_STRIP_LOW) || (flags & FILTER_FLAG_STRIP_HIGH)) ) {
+	if (!(flags & (FILTER_FLAG_STRIP_LOW | FILTER_FLAG_STRIP_HIGH | FILTER_FLAG_STRIP_BACKTICK))) {
 		return;
 	}

@@ -121,7 +121,7 @@ static void php_filter_strip(zval *value, long flags)
 	buf = safe_emalloc(1, Z_STRLEN_P(value) + 1, 1);
 	c = 0;
 	for (i = 0; i < Z_STRLEN_P(value); i++) {
-		if ((str[i] > 127) && (flags & FILTER_FLAG_STRIP_HIGH)) {
+		if ((str[i] >= 127) && (flags & FILTER_FLAG_STRIP_HIGH)) {
 		} else if ((str[i] < 32) && (flags & FILTER_FLAG_STRIP_LOW)) {
 		} else if ((str[i] == '`') && (flags & FILTER_FLAG_STRIP_BACKTICK)) {
 		} else {
@@ -0,0 +1,16 @@
+--TEST--
+Bug #69202 (FILTER_FLAG_STRIP_BACKTICK ignored unless other flags are used)
+--SKIPIF--
+<?php if (!extension_loaded("filter")) die("skip"); ?>
+--FILE--
+<?php
+var_dump(filter_var("``a`b`c``", FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_BACKTICK));
+var_dump(filter_var("``a`b`c``", FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW | FILTER_FLAG_STRIP_BACKTICK));
+var_dump(filter_var("``a`b`c``", FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_HIGH | FILTER_FLAG_STRIP_BACKTICK));
+var_dump(filter_var("``a`b`c``", FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_LOW | FILTER_FLAG_STRIP_HIGH));
+?>
+--EXPECT--
+string(3) "abc"
+string(3) "abc"
+string(3) "abc"
+string(9) "``a`b`c``"
@@ -0,0 +1,16 @@
+--TEST--
+Bug #69203 (FILTER_FLAG_STRIP_HIGH doesn't strip ASCII 127)
+--SKIPIF--
+<?php if (!extension_loaded("filter")) die("skip"); ?>
+--FILE--
+<?php
+var_dump(filter_var("\x7f", FILTER_SANITIZE_STRING, FILTER_FLAG_STRIP_HIGH));
+var_dump(filter_var("\x7f", FILTER_UNSAFE_RAW, FILTER_FLAG_STRIP_HIGH));
+var_dump(filter_var("\x7f", FILTER_SANITIZE_ENCODED, FILTER_FLAG_STRIP_HIGH));
+var_dump(filter_var("\x7f", FILTER_SANITIZE_SPECIAL_CHARS, FILTER_FLAG_STRIP_HIGH));
+?>
+--EXPECT--
+string(0) ""
+string(0) ""
+string(0) ""
+string(0) ""
@@ -188,9 +188,9 @@ ftp_close(ftpbuf_t *ftp)
 			SSL_shutdown(ftp->ssl_handle);
 			SSL_free(ftp->ssl_handle);
 		}
-#endif		
+#endif
 		closesocket(ftp->fd);
-	}	
+	}
 	ftp_gc(ftp);
 	efree(ftp);
 	return NULL;
@@ -262,7 +262,7 @@ ftp_login(ftpbuf_t *ftp, const char *user, const char *pass TSRMLS_DC)
 		if (!ftp_getresp(ftp)) {
 			return 0;
 		}
-			
+
 		if (ftp->resp != 234) {
 			if (!ftp_putcmd(ftp, "AUTH", "SSL")) {
 				return 0;
@@ -270,7 +270,7 @@ ftp_login(ftpbuf_t *ftp, const char *user, const char *pass TSRMLS_DC)
 			if (!ftp_getresp(ftp)) {
 				return 0;
 			}
-				
+
 			if (ftp->resp != 334) {
 				return 0;
 			} else {
@@ -278,7 +278,7 @@ ftp_login(ftpbuf_t *ftp, const char *user, const char *pass TSRMLS_DC)
 				ftp->use_ssl_for_data = 1;
 			}
 		}
-		
+
 		ctx = SSL_CTX_new(SSLv23_client_method());
 		if (ctx == NULL) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "failed to create the SSL context");
@@ -325,8 +325,8 @@ ftp_login(ftpbuf_t *ftp, const char *user, const char *pass TSRMLS_DC)
 			if (!ftp_getresp(ftp)) {
 				return 0;
 			}
-			
-			ftp->use_ssl_for_data = (ftp->resp >= 200 && ftp->resp <=299);		
+
+			ftp->use_ssl_for_data = (ftp->resp >= 200 && ftp->resp <=299);
 		}
 	}
 #endif
@@ -360,7 +360,7 @@ ftp_reinit(ftpbuf_t *ftp)
 {
 	if (ftp == NULL) {
 		return 0;
-	}	
+	}

 	ftp_gc(ftp);

@@ -395,7 +395,7 @@ ftp_syst(ftpbuf_t *ftp)
 	if (!ftp_putcmd(ftp, "SYST", NULL)) {
 		return NULL;
 	}
-	if (!ftp_getresp(ftp) || ftp->resp != 215) { 
+	if (!ftp_getresp(ftp) || ftp->resp != 215) {
 		return NULL;
 	}
 	syst = ftp->inbuf;
@@ -431,14 +431,14 @@ ftp_pwd(ftpbuf_t *ftp)
 	if (!ftp_putcmd(ftp, "PWD", NULL)) {
 		return NULL;
 	}
-	if (!ftp_getresp(ftp) || ftp->resp != 257) { 
+	if (!ftp_getresp(ftp) || ftp->resp != 257) {
 		return NULL;
 	}
 	/* copy out the pwd from response */
-	if ((pwd = strchr(ftp->inbuf, '"')) == NULL) { 
+	if ((pwd = strchr(ftp->inbuf, '"')) == NULL) {
 		return NULL;
 	}
-	if ((end = strrchr(++pwd, '"')) == NULL) { 
+	if ((end = strrchr(++pwd, '"')) == NULL) {
 		return NULL;
 	}
 	ftp->pwd = estrndup(pwd, end - pwd);
@@ -608,7 +608,7 @@ ftp_chmod(ftpbuf_t *ftp, const int mode, const char *filename, const int filenam
 	if (!ftp_getresp(ftp) || ftp->resp != 200) {
 		return 0;
 	}
-	
+
 	return 1;
 }
 /* }}} */
@@ -625,7 +625,7 @@ ftp_alloc(ftpbuf_t *ftp, const long size, char **response)
 	}

 	snprintf(buffer, sizeof(buffer) - 1, "%ld", size);
-    
+
 	if (!ftp_putcmd(ftp, "ALLO", buffer)) {
 		return 0;
 	}
@@ -642,7 +642,7 @@ ftp_alloc(ftpbuf_t *ftp, const long size, char **response)
 		return 0;
 	}

-	return 1;	
+	return 1;
 }
 /* }}} */

@@ -674,7 +674,7 @@ ftp_type(ftpbuf_t *ftp, ftptype_t type)
 	if (ftp == NULL) {
 		return 0;
 	}
-	if (type == ftp->type) { 
+	if (type == ftp->type) {
 		return 1;
 	}
 	if (type == FTPTYPE_ASCII) {
@@ -765,7 +765,7 @@ ftp_pasv(ftpbuf_t *ftp, int pasv)
 	if (!ftp_putcmd(ftp, "PASV", NULL)) {
 		return 0;
 	}
-	if (!ftp_getresp(ftp) || ftp->resp != 227) { 
+	if (!ftp_getresp(ftp) || ftp->resp != 227) {
 		return 0;
 	}
 	/* parse out the IP and port */
@@ -807,7 +807,7 @@ ftp_get(ftpbuf_t *ftp, php_stream *outstream, const char *path, ftptype_t type,
 	if ((data = ftp_getdata(ftp TSRMLS_CC)) == NULL) {
 		goto bail;
 	}
-	
+
 	ftp->data = data;

 	if (resumepos > 0) {
@@ -900,7 +900,7 @@ ftp_put(ftpbuf_t *ftp, const char *path, php_stream *instream, ftptype_t type, l
 	if ((data = ftp_getdata(ftp TSRMLS_CC)) == NULL) {
 		goto bail;
 	}
-	ftp->data = data;	
+	ftp->data = data;

 	if (startpos > 0) {
 		snprintf(arg, sizeof(arg), "%ld", startpos);
@@ -1101,7 +1101,7 @@ ftp_putcmd(ftpbuf_t *ftp, const char *cmd, const char *args)

 	if (strpbrk(cmd, "\r\n")) {
 		return 0;
-	} 
+	}
 	/* build the output buffer */
 	if (args && args[0]) {
 		/* "cmd args\r\n\0" */
@@ -1247,7 +1247,7 @@ my_send(ftpbuf_t *ftp, php_socket_t s, void *buf, size_t len)
 #if HAVE_OPENSSL_EXT
 		if (ftp->use_ssl && ftp->fd == s && ftp->ssl_active) {
 			sent = SSL_write(ftp->ssl_handle, buf, size);
-		} else if (ftp->use_ssl && ftp->fd != s && ftp->use_ssl_for_data && ftp->data->ssl_active) {	
+		} else if (ftp->use_ssl && ftp->fd != s && ftp->use_ssl_for_data && ftp->data->ssl_active) {
 			sent = SSL_write(ftp->data->ssl_handle, buf, size);
 		} else {
 #endif
@@ -1287,14 +1287,14 @@ my_recv(ftpbuf_t *ftp, php_socket_t s, void *buf, size_t len)
 #if HAVE_OPENSSL_EXT
 	if (ftp->use_ssl && ftp->fd == s && ftp->ssl_active) {
 		nr_bytes = SSL_read(ftp->ssl_handle, buf, len);
-	} else if (ftp->use_ssl && ftp->fd != s && ftp->use_ssl_for_data && ftp->data->ssl_active) {	
+	} else if (ftp->use_ssl && ftp->fd != s && ftp->use_ssl_for_data && ftp->data->ssl_active) {
 		nr_bytes = SSL_read(ftp->data->ssl_handle, buf, len);
 	} else {
 #endif
 		nr_bytes = recv(s, buf, len, 0);
 #if HAVE_OPENSSL_EXT
 	}
-#endif	
+#endif
 	return (nr_bytes);
 }
 /* }}} */
@@ -1511,7 +1511,7 @@ data_accept(databuf_t *data, ftpbuf_t *ftp TSRMLS_DC)

 data_accepted:
 #if HAVE_OPENSSL_EXT
-	
+
 	/* now enable ssl if we need to */
 	if (ftp->use_ssl && ftp->use_ssl_for_data) {
 		ctx = SSL_CTX_new(SSLv23_client_method());
@@ -1531,23 +1531,23 @@ data_accepted:
 			SSL_CTX_free(ctx);
 			return 0;
 		}
-			
-		
+
+
 		SSL_set_fd(data->ssl_handle, data->fd);

 		if (ftp->old_ssl) {
 			SSL_copy_session_id(data->ssl_handle, ftp->ssl_handle);
 		}
-			
+
 		if (SSL_connect(data->ssl_handle) <= 0) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "data_accept: SSL/TLS handshake failed");
 			SSL_shutdown(data->ssl_handle);
 			SSL_free(data->ssl_handle);
 			return 0;
 		}
-			
+
 		data->ssl_active = 1;
-	}	
+	}

 #endif

@@ -1562,14 +1562,14 @@ data_close(ftpbuf_t *ftp, databuf_t *data)
 {
 #if HAVE_OPENSSL_EXT
 	SSL_CTX		*ctx;
-#endif				
+#endif
 	if (data == NULL) {
 		return NULL;
 	}
 	if (data->listener != -1) {
 #if HAVE_OPENSSL_EXT
 		if (data->ssl_active) {
-		
+
 			ctx = SSL_get_SSL_CTX(data->ssl_handle);
 			SSL_CTX_free(ctx);

@@ -1577,9 +1577,9 @@ data_close(ftpbuf_t *ftp, databuf_t *data)
 			SSL_free(data->ssl_handle);
 			data->ssl_active = 0;
 		}
-#endif				
+#endif
 		closesocket(data->listener);
-	}	
+	}
 	if (data->fd != -1) {
 #if HAVE_OPENSSL_EXT
 		if (data->ssl_active) {
@@ -1590,9 +1590,9 @@ data_close(ftpbuf_t *ftp, databuf_t *data)
 			SSL_free(data->ssl_handle);
 			data->ssl_active = 0;
 		}
-#endif				
+#endif
 		closesocket(data->fd);
-	}	
+	}
 	if (ftp) {
 		ftp->data = NULL;
 	}
@@ -1610,8 +1610,8 @@ ftp_genlist(ftpbuf_t *ftp, const char *cmd, const char *path TSRMLS_DC)
 	databuf_t	*data = NULL;
 	char		*ptr;
 	int		ch, lastch;
-	int		size, rcvd;
-	int		lines;
+	size_t		size, rcvd;
+	size_t		lines;
 	char		**ret = NULL;
 	char		**entry;
 	char		*text;
@@ -1629,7 +1629,7 @@ ftp_genlist(ftpbuf_t *ftp, const char *cmd, const char *path TSRMLS_DC)
 	if ((data = ftp_getdata(ftp TSRMLS_CC)) == NULL) {
 		goto bail;
 	}
-	ftp->data = data;	
+	ftp->data = data;

 	if (!ftp_putcmd(ftp, cmd, path)) {
 		goto bail;
@@ -1653,7 +1653,7 @@ ftp_genlist(ftpbuf_t *ftp, const char *cmd, const char *path TSRMLS_DC)
 	lines = 0;
 	lastch = 0;
 	while ((rcvd = my_recv(ftp, data->fd, data->buf, FTP_BUFSIZE))) {
-		if (rcvd == -1) {
+		if (rcvd == -1 || rcvd > ((size_t)(-1))-size) {
 			goto bail;
 		}

@@ -1663,8 +1663,6 @@ ftp_genlist(ftpbuf_t *ftp, const char *cmd, const char *path TSRMLS_DC)
 		for (ptr = data->buf; rcvd; rcvd--, ptr++) {
 			if (*ptr == '\n' && lastch == '\r') {
 				lines++;
-			} else {
-				size++;
 			}
 			lastch = *ptr;
 		}
@@ -1858,7 +1856,7 @@ ftp_nb_put(ftpbuf_t *ftp, const char *path, php_stream *instream, ftptype_t type
 	if (!ftp_getresp(ftp) || (ftp->resp != 150 && ftp->resp != 125)) {
 		goto bail;
 	}
-	if ((data = data_accept(data, ftp TSRMLS_CC)) == NULL) { 
+	if ((data = data_accept(data, ftp TSRMLS_CC)) == NULL) {
 		goto bail;
 	}
 	ftp->data = data;
@@ -1914,7 +1912,7 @@ ftp_nb_continue_write(ftpbuf_t *ftp TSRMLS_DC)
 		goto bail;
 	}
 	ftp->data = data_close(ftp, ftp->data);
- 
+
 	if (!ftp_getresp(ftp) || (ftp->resp != 226 && ftp->resp != 250)) {
 		goto bail;
 	}
@@ -1417,7 +1417,7 @@ PHP_FUNCTION(imageloadfont)
 	gdFontPtr font;
 	php_stream *stream;

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &file, &file_name) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &file, &file_name) == FAILURE) {
 		return;
 	}

@@ -1735,7 +1735,7 @@ PHP_FUNCTION(imagefilledarc)
 	long cx, cy, w, h, ST, E, col, style;
 	gdImagePtr im;
 	int e, st;
-	
+
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rllllllll", &IM, &cx, &cy, &w, &h, &ST, &E, &col, &style) == FAILURE) {
 		return;
 	}
@@ -1976,7 +1976,7 @@ PHP_FUNCTION(imagegrabwindow)
 	if ( handle == 0 ) {
 		goto clean;
 	}
-	pPrintWindow = (tPrintWindow) GetProcAddress(handle, "PrintWindow");  
+	pPrintWindow = (tPrintWindow) GetProcAddress(handle, "PrintWindow");

 	if ( pPrintWindow )  {
 		pPrintWindow(window, memDC, (UINT) client_area);
@@ -2354,7 +2354,7 @@ static void _php_image_create_from(INTERNAL_FUNCTION_PARAMETERS, int image_type,
 	long ignore_warning;

 	if (image_type == PHP_GDIMG_TYPE_GD2PART) {
-		if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "sllll", &file, &file_len, &srcx, &srcy, &width, &height) == FAILURE) {
+		if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "pllll", &file, &file_len, &srcx, &srcy, &width, &height) == FAILURE) {
 			return;
 		}
 		if (width < 1 || height < 1) {
@@ -2362,7 +2362,7 @@ static void _php_image_create_from(INTERNAL_FUNCTION_PARAMETERS, int image_type,
 			RETURN_FALSE;
 		}
 	} else {
-		if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &file, &file_len) == FAILURE) {
+		if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &file, &file_len) == FAILURE) {
 			return;
 		}
 	}
@@ -3045,10 +3045,11 @@ PHP_FUNCTION(imagegammacorrect)
 			for (x = 0; x < gdImageSX(im); x++)	{
 				c = gdImageGetPixel(im, x, y);
 				gdImageSetPixel(im, x, y,
-					gdTrueColor(
+					gdTrueColorAlpha(
 						(int) ((pow((pow((gdTrueColorGetRed(c)   / 255.0), input)), 1.0 / output) * 255) + .5),
 						(int) ((pow((pow((gdTrueColorGetGreen(c) / 255.0), input)), 1.0 / output) * 255) + .5),
-						(int) ((pow((pow((gdTrueColorGetBlue(c)  / 255.0), input)), 1.0 / output) * 255) + .5)
+						(int) ((pow((pow((gdTrueColorGetBlue(c)  / 255.0), input)), 1.0 / output) * 255) + .5),
+						gdTrueColorGetAlpha(c)
 					)
 				);
 			}
@@ -3845,7 +3846,7 @@ static void php_imagettftext_common(INTERNAL_FUNCTION_PARAMETERS, int mode, int
 			if (zend_hash_get_current_data_ex(HASH_OF(EXT), (void **) &item, &pos) == FAILURE) {
 				continue;
 			}
-		
+
 			if (strcmp("linespacing", key) == 0) {
 				convert_to_double_ex(item);
 				strex.flags |= gdFTEX_LINESPACE;
@@ -3924,7 +3925,7 @@ PHP_FUNCTION(imagepsloadfont)
 	struct stat st;
 #endif

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &file, &file_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &file, &file_len) == FAILURE) {
 		return;
 	}

@@ -4031,7 +4032,7 @@ PHP_FUNCTION(imagepsencodefont)
 	char *enc, **enc_vector;
 	int enc_len, *f_ind;

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rs", &fnt, &enc, &enc_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rp", &fnt, &enc, &enc_len) == FAILURE) {
 		return;
 	}

@@ -4264,11 +4265,11 @@ PHP_FUNCTION(imagepsbbox)
 	if (argc != 3 && argc != 6) {
 		ZEND_WRONG_PARAM_COUNT();
 	}
-	
+
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "srl|lld", &str, &str_len, &fnt, &sz, &sp, &wd, &angle) == FAILURE) {
 		return;
 	}
-	
+
 	if (argc == 6) {
 		space = sp;
 		add_width = wd;
@@ -706,14 +706,14 @@ static WebPResult VPXEncode(const uint8* Y,
    codec_ctl(&enc, VP8E_SET_STATIC_THRESHOLD, 0);
    codec_ctl(&enc, VP8E_SET_TOKEN_PARTITIONS, 2);

-    vpx_img_wrap(&img, IMG_FMT_I420,
+    vpx_img_wrap(&img, VPX_IMG_FMT_I420,
                 y_width, y_height, 16, (uint8*)(Y));
-    img.planes[PLANE_Y] = (uint8*)(Y);
-    img.planes[PLANE_U] = (uint8*)(U);
-    img.planes[PLANE_V] = (uint8*)(V);
-    img.stride[PLANE_Y] = y_stride;
-    img.stride[PLANE_U] = uv_stride;
-    img.stride[PLANE_V] = uv_stride;
+    img.planes[VPX_PLANE_Y] = (uint8*)(Y);
+    img.planes[VPX_PLANE_U] = (uint8*)(U);
+    img.planes[VPX_PLANE_V] = (uint8*)(V);
+    img.stride[VPX_PLANE_Y] = y_stride;
+    img.stride[VPX_PLANE_U] = uv_stride;
+    img.stride[VPX_PLANE_V] = uv_stride;

    res = vpx_codec_encode(&enc, &img, 0, 1, 0, VPX_DL_BEST_QUALITY);

@@ -0,0 +1,23 @@
+--TEST--
+Bug #61221 - imagegammacorrect function loses alpha channel
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$imagew = 50;
+$imageh = 50;
+$img = imagecreatetruecolor($imagew, $imageh);
+$blacktransparent = imagecolorallocatealpha($img, 0, 0, 0, 127);
+$redsolid = imagecolorallocate($img, 255, 0, 0);
+imagefill($img, 0, 0, $blacktransparent);
+imageline($img, $imagew / 2, 0, $imagew / 2, $imageh - 1, $redsolid);
+imageline($img, 0, $imageh / 2, $imagew - 1, $imageh / 2, $redsolid);
+imagegammacorrect($img, 1, 1);
+$color = imagecolorat($img, 0, 0);
+var_dump($color === $blacktransparent);
+imagedestroy($img);
+?>
+--EXPECT--
+bool(true)
@@ -3,7 +3,7 @@ Testing that imageloadfont() breaks on non-string first parameter
 --CREDITS--
 Neveo Harrison <neveoo [at] gmail [dot] com> #testfest #tek11
 --SKIPIF--
-<?php 
+<?php
 	if (!extension_loaded("gd")) die("skip GD not present");
 ?>
 --FILE--
@@ -11,5 +11,5 @@ Neveo Harrison <neveoo [at] gmail [dot] com> #testfest #tek11
 var_dump( imageloadfont(array()) );
 ?>
 --EXPECTF--
-Warning: imageloadfont() expects parameter 1 to be string, array given in %s on line %d
-NULL
+Warning: imageloadfont() expects parameter 1 to be a valid path, array given in %s on line %d
+NULL
@@ -143,6 +143,7 @@ static void php_hash_do_hash(INTERNAL_FUNCTION_PARAMETERS, int isfilename, zend_
 	}
 	if (isfilename) {
 		if (CHECK_NULL_PATH(data, data_len)) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
 			RETURN_FALSE;
 		}
 		stream = php_stream_open_wrapper_ex(data, "rb", REPORT_ERRORS, NULL, DEFAULT_CONTEXT);
@@ -258,6 +259,10 @@ static void php_hash_do_hash_hmac(INTERNAL_FUNCTION_PARAMETERS, int isfilename,
 		RETURN_FALSE;
 	}
 	if (isfilename) {
+		if (CHECK_NULL_PATH(data, data_len)) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+			RETURN_FALSE;
+		}
 		stream = php_stream_open_wrapper_ex(data, "rb", REPORT_ERRORS, NULL, DEFAULT_CONTEXT);
 		if (!stream) {
 			/* Stream will report errors opening file */
@@ -462,7 +467,7 @@ PHP_FUNCTION(hash_update_file)
 	char *filename, buf[1024];
 	int filename_len, n;

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rs|r", &zhash, &filename, &filename_len, &zcontext) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rp|r", &zhash, &filename, &filename_len, &zcontext) == FAILURE) {
 		return;
 	}

@@ -28,6 +28,9 @@ hash_hmac_file('crc32', $file, $key, TRUE, $extra_arg);
 echo "\n-- Testing hash_hmac_file() function with invalid hash algorithm --\n";
 hash_hmac_file('foo', $file, $key, TRUE);

+echo "\n-- Testing hash_hmac_file() function with bad path --\n";
+hash_hmac_file('crc32', $file.chr(0).$file, $key, TRUE);
+
 ?>
 ===Done===
 --EXPECTF--
@@ -51,4 +54,8 @@ Warning: hash_hmac_file() expects at most 4 parameters, 5 given in %s on line %d
 -- Testing hash_hmac_file() function with invalid hash algorithm --

 Warning: hash_hmac_file(): Unknown hashing algorithm: foo in %s on line %d
+
+-- Testing hash_hmac_file() function with bad path --
+
+Warning: hash_hmac_file(): Invalid path in %s on line %d
 ===Done===
@@ -35,7 +35,7 @@ if test "$PHP_ICONV" != "no"; then
      PHP_ICONV_H_PATH="$PHP_ICONV_PREFIX/include/giconv.h"
    else
      PHP_ICONV_H_PATH="$PHP_ICONV_PREFIX/include/iconv.h"
-    fi 
+	fi

    AC_MSG_CHECKING([if iconv is glibc's])
    AC_TRY_LINK([#include <gnu/libc-version.h>],[gnu_get_libc_version();],
@@ -53,8 +53,8 @@ if test "$PHP_ICONV" != "no"; then
      AC_TRY_RUN([
 #include <$PHP_ICONV_H_PATH>
 int main() {
-	printf("%d", _libiconv_version);
-	return 0;
+  printf("%d", _libiconv_version);
+  return 0;
 }
      ],[
        AC_MSG_RESULT(yes)
@@ -138,7 +138,7 @@ int main() {
  if (cd == (iconv_t)(-1)) {
    if (errno == EINVAL) {
      return 0;
-	} else {
+  } else {
      return 1;
    }
  }
@@ -159,6 +159,37 @@ int main() {
      AC_DEFINE([ICONV_SUPPORTS_ERRNO],0,[Whether iconv supports error no or not])
    ])

+    AC_MSG_CHECKING([if iconv supports //IGNORE])
+    AC_TRY_RUN([
+#include <$PHP_ICONV_H_PATH>
+#include <stdlib.h>
+
+int main() {
+  iconv_t cd = iconv_open( "UTF-8//IGNORE", "UTF-8" );
+  char *in_p = "\xC3\xC3\xC3\xB8";
+  size_t in_left = 4, out_left = 4096;
+  char *out = malloc(out_left);
+  char *out_p = out;
+  size_t result = iconv(cd, (char **) &in_p, &in_left, (char **) &out_p, &out_left);
+  if(result == (size_t)-1) {
+    return 1;
+  }
+  return 0;
+}
+   ],[
+      AC_MSG_RESULT(yes)
+      PHP_DEFINE([ICONV_BROKEN_IGNORE],0,[ext/iconv])
+      AC_DEFINE([ICONV_BROKEN_IGNORE],0,[Whether iconv supports IGNORE])
+    ],[
+      AC_MSG_RESULT(no)
+      PHP_DEFINE([ICONV_BROKEN_IGNORE],1,[ext/iconv])
+      AC_DEFINE([ICONV_BROKEN_IGNORE],1,[Whether iconv supports IGNORE])
+    ],[
+      AC_MSG_RESULT(no, cross-compiling)
+      PHP_DEFINE([ICONV_BROKEN_IGNORE],0,[ext/iconv])
+      AC_DEFINE([ICONV_BROKEN_IGNORE],0,[Whether iconv supports IGNORE])
+    ])
+
    AC_MSG_CHECKING([if your cpp allows macro usage in include lines])
    AC_TRY_COMPILE([
 #define FOO <$PHP_ICONV_H_PATH>
@@ -464,6 +464,24 @@ static php_iconv_err_t _php_iconv_appendc(smart_str *d, const char c, iconv_t cd
 }
 /* }}} */

+/* {{{ */
+#if ICONV_BROKEN_IGNORE
+static int _php_check_ignore(const char *charset)
+{
+  size_t clen = strlen(charset);
+  if (clen >= 9 && strcmp("//IGNORE", charset+clen-8) == 0) {
+    return 1;
+  }
+  if (clen >= 19 && strcmp("//IGNORE//TRANSLIT", charset+clen-18) == 0) {
+    return 1;
+  }
+  return 0;
+}
+#else
+#define _php_check_ignore(x) (0)
+#endif
+/* }}} */
+
 /* {{{ php_iconv_string()
 */
 PHP_ICONV_API php_iconv_err_t php_iconv_string(const char *in_p, size_t in_len,
@@ -545,6 +563,7 @@ PHP_ICONV_API php_iconv_err_t php_iconv_string(const char *in_p, size_t in_len,
 	char *out_p, *out_buf, *tmp_buf;
 	size_t bsz, result = 0;
 	php_iconv_err_t retval = PHP_ICONV_ERR_SUCCESS;
+	int ignore_ilseq = _php_check_ignore(out_charset);

 	*out = NULL;
 	*out_len = 0;
@@ -569,6 +588,17 @@ PHP_ICONV_API php_iconv_err_t php_iconv_string(const char *in_p, size_t in_len,
 		result = iconv(cd, (char **) &in_p, &in_left, (char **) &out_p, &out_left);
 		out_size = bsz - out_left;
 		if (result == (size_t)(-1)) {
+			if (ignore_ilseq && errno == EILSEQ) {
+				if (in_left <= 1) {
+					result = 0;
+				} else {
+					errno = 0;
+					in_p++;
+					in_left--;
+					continue;
+				}
+			}
+
 			if (errno == E2BIG && in_left > 0) {
 				/* converted string is longer than out buffer */
 				bsz += in_len;
@@ -0,0 +1,27 @@
+--TEST--
+Bug #48147 (iconv with //IGNORE cuts the string)
+--SKIPIF--
+<?php extension_loaded('iconv') or die('skip iconv extension is not available'); ?>
+--FILE--
+<?php
+$text = "aa\xC3\xC3\xC3\xB8aa";
+var_dump(iconv("UTF-8", "UTF-8", $text));
+var_dump(urlencode(iconv("UTF-8", "UTF-8//IGNORE", $text)));
+// only invalid
+var_dump(urlencode(iconv("UTF-8", "UTF-8//IGNORE", "\xC3")));
+// start invalid
+var_dump(urlencode(iconv("UTF-8", "UTF-8//IGNORE", "\xC3\xC3\xC3\xB8aa")));
+// finish invalid
+var_dump(urlencode(iconv("UTF-8", "UTF-8//IGNORE", "aa\xC3\xC3\xC3")));
+?>
+--EXPECTF--
+Notice: iconv(): Detected an illegal character in input string in %s on line %d
+bool(false)
+string(10) "aa%C3%B8aa"
+
+Notice: iconv(): Detected an incomplete multibyte character in input string in %s on line %d
+string(0) ""
+string(8) "%C3%B8aa"
+
+Notice: iconv(): Detected an incomplete multibyte character in input string in %s on line %d
+string(0) ""
@@ -1194,14 +1194,12 @@ static int strToMatch(const char* str ,char *retstr)
 	char* 	anchor 	= NULL;
 	const char* 	anchor1 = NULL;
 	int 	result 	= 0;
-	int 	len 	= 0;

    if( (!str) || str[0] == '\0'){
        return result;
    } else {
 	anchor = retstr;
 	anchor1 = str;
-        len = strlen(str);
        while( (*str)!='\0' ){
 		if( *str == '-' ){
 			*retstr =  '_';
@@ -305,6 +305,21 @@ static void *php_libxml_streams_IO_open_wrapper(const char *filename, const char
 			(xmlStrncmp(BAD_CAST uri->scheme, BAD_CAST "file", 4) == 0))) {
 		resolved_path = xmlURIUnescapeString(filename, 0, NULL);
 		isescaped = 1;
+#if LIBXML_VERSION >= 20902 && defined(PHP_WIN32)
+		/* Libxml 2.9.2 prefixes local paths with file:/ instead of file://,
+			thus the php stream wrapper will fail on a valid case. For this
+			reason the prefix is rather better cut off. */
+		{
+			size_t pre_len = sizeof("file:/") - 1;
+
+			if (strncasecmp(resolved_path, "file:/", pre_len) == 0
+				&& '/' != resolved_path[pre_len]) {
+					xmlChar *tmp = xmlStrdup(resolved_path + pre_len);
+					xmlFree(resolved_path);
+					resolved_path = tmp;
+			}
+		}
+#endif
 	} else {
 		resolved_path = (char *)filename;
 	}
@@ -239,7 +239,7 @@ mbfl_filt_conv_gb18030_wchar(int c, mbfl_convert_filter *filter)
 		if (((c1 >= 0x81 && c1 <= 0x84) || (c1 >= 0x90 && c1 <= 0xe3)) &&
 			c2 >= 0x30 && c2 <= 0x39 && c3 >= 0x81 && c3 <= 0xfe && c >= 0x30 && c <= 0x39) {
 			if (c1 >= 0x90 && c1 <= 0xe3) {
-				w = ((c1 - 0x90)*10 + (c2 - 0x30)*126 + (c3 - 0x81))*10 + (c - 0x30) + 0x10000;
+				w = ((((c1 - 0x90)*10 + (c2 - 0x30))*126 + (c3 - 0x81)))*10 + (c - 0x30) + 0x10000;
 			} else { /* Unicode BMP */
 				w = (((c1 - 0x81)*10 + (c2 - 0x30))*126 + (c3 - 0x81))*10 + (c - 0x30);
 				if (w >= 0 && w <= 39419) {
@@ -0,0 +1,12 @@
+--TEST--
+Bug #68846	False detection of CJK Unified Ideographs Extension E
+--SKIPIF--
+<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+--FILE--
+<?php
+var_dump(
+    "\x00\x02\x0b\xb7" === mb_convert_encoding("\x95\x34\xb2\x35", 'UTF-32', 'GB18030')
+);
+?>
+--EXPECT--
+bool(true)
@@ -415,7 +415,13 @@ static void php_mcrypt_module_dtor(zend_rsrc_list_entry *rsrc TSRMLS_DC) /* {{{
 	}
 }
 /* }}} */
-    
+
+typedef enum {
+	RANDOM = 0,
+	URANDOM,
+	RAND
+} iv_source;
+
 static PHP_MINIT_FUNCTION(mcrypt) /* {{{ */
 {
 	le_mcrypt = zend_register_list_destructors_ex(php_mcrypt_module_dtor, NULL, "mcrypt", module_number);
@@ -473,6 +479,9 @@ static PHP_MINIT_FUNCTION(mcrypt) /* {{{ */
 	php_stream_filter_register_factory("mcrypt.*", &php_mcrypt_filter_factory TSRMLS_CC);
 	php_stream_filter_register_factory("mdecrypt.*", &php_mcrypt_filter_factory TSRMLS_CC);

+	MCG(fd[RANDOM]) = -1;
+	MCG(fd[URANDOM]) = -1;
+
 	return SUCCESS;
 }
 /* }}} */
@@ -482,6 +491,14 @@ static PHP_MSHUTDOWN_FUNCTION(mcrypt) /* {{{ */
 	php_stream_filter_unregister_factory("mcrypt.*" TSRMLS_CC);
 	php_stream_filter_unregister_factory("mdecrypt.*" TSRMLS_CC);

+	if (MCG(fd[RANDOM]) > 0) {
+		close(MCG(fd[RANDOM]));
+	}
+
+	if (MCG(fd[URANDOM]) > 0) {
+		close(MCG(fd[URANDOM]));
+	}
+
 	UNREGISTER_INI_ENTRIES();
 	return SUCCESS;
 }
@@ -536,12 +553,6 @@ PHP_MINFO_FUNCTION(mcrypt) /* {{{ */
 }
 /* }}} */

-typedef enum {
-	RANDOM = 0,
-	URANDOM,
-	RAND
-} iv_source;
-
 /* {{{ proto resource mcrypt_module_open(string cipher, string cipher_directory, string mode, string mode_directory)
   Opens the module of the algorithm and the mode to be used */
 PHP_FUNCTION(mcrypt_module_open)
@@ -1403,24 +1414,27 @@ PHP_FUNCTION(mcrypt_create_iv)
 		}
 		n = size;
 #else
-		int    fd;
+		int    *fd = &MCG(fd[source]);
 		size_t read_bytes = 0;

-		fd = open(source == RANDOM ? "/dev/random" : "/dev/urandom", O_RDONLY);
-		if (fd < 0) {
-			efree(iv);
-			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot open source device");
-			RETURN_FALSE;
+		if (*fd < 0) {
+			*fd = open(source == RANDOM ? "/dev/random" : "/dev/urandom", O_RDONLY);
+			if (*fd < 0) {
+				efree(iv);
+				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot open source device");
+				RETURN_FALSE;
+			}
 		}
+
 		while (read_bytes < size) {
-			n = read(fd, iv + read_bytes, size - read_bytes);
+			n = read(*fd, iv + read_bytes, size - read_bytes);
 			if (n < 0) {
 				break;
 			}
 			read_bytes += n;
 		}
 		n = read_bytes;
-		close(fd);
+
 		if (n < size) {
 			efree(iv);
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not gather sufficient random data");
@@ -77,6 +77,7 @@ ZEND_BEGIN_MODULE_GLOBALS(mcrypt)
 	int le_h;
 	char *modes_dir;
 	char *algorithms_dir;
+	int fd[2]; // RANDOM = 0, URANDOM = 1
 ZEND_END_MODULE_GLOBALS(mcrypt)

 #ifdef ZTS
@@ -199,7 +199,6 @@ mysqli_close($link);
 	if (!mysqli_query($link, 'DROP TABLE IF EXISTS test')) {
 		printf("[008] %s [%d] %s\n", $column_def,
 			mysqli_errno($link), mysqli_error($link));
-		continue;
 	}

 	$column_def = array('col1 CHAR(1)', 'col2 CHAR(2)','INDEX idx_col1_col2(col1, col2)');
@@ -220,7 +219,6 @@ mysqli_close($link);
 		while ($field = mysqli_fetch_field($res)) {
 			if (!isset($expected_flags[$field->name])) {
 				printf("[010] Found unexpected field '%s'\n", $field->name);
-				continue;
 			}
 			list($missing_flags, $unexpected_flags, $flags_found) = checkFlags($field->flags, $expected_flags[$field->name], $flags);
 			if ($unexpected_flags)
@@ -400,7 +400,7 @@ MYSQLND_METHOD(mysqlnd_conn_data, set_server_option)(MYSQLND_CONN_DATA * const c

 		int2store(buffer, (unsigned int) option);
 		ret = conn->m->simple_command(conn, COM_SET_OPTION, buffer, sizeof(buffer), PROT_EOF_PACKET, FALSE, TRUE TSRMLS_CC);
-	
+
 		conn->m->local_tx_end(conn, this_func, ret TSRMLS_CC);
 	}
 	DBG_RETURN(ret);
@@ -464,27 +464,41 @@ mysqlnd_switch_to_ssl_if_needed(
 	}

 #ifdef MYSQLND_SSL_SUPPORTED
-	if ((greet_packet->server_capabilities & CLIENT_SSL) && (mysql_flags & CLIENT_SSL)) {
-		zend_bool verify = mysql_flags & CLIENT_SSL_VERIFY_SERVER_CERT? TRUE:FALSE;
-		DBG_INF("Switching to SSL");
-		if (!PACKET_WRITE(auth_packet, conn)) {
-			CONN_SET_STATE(conn, CONN_QUIT_SENT);
-			conn->m->send_close(conn TSRMLS_CC);
-			SET_CLIENT_ERROR(*conn->error_info, CR_SERVER_GONE_ERROR, UNKNOWN_SQLSTATE, mysqlnd_server_gone);
-			goto end;
-		}
+	if (mysql_flags & CLIENT_SSL) {
+		zend_bool server_has_ssl = (greet_packet->server_capabilities & CLIENT_SSL)? TRUE:FALSE;
+		if (server_has_ssl == FALSE) {
+			goto close_conn;
+		} else {
+			zend_bool verify = mysql_flags & CLIENT_SSL_VERIFY_SERVER_CERT? TRUE:FALSE;
+			DBG_INF("Switching to SSL");
+			if (!PACKET_WRITE(auth_packet, conn)) {
+				goto close_conn;
+			}

-		conn->net->data->m.set_client_option(conn->net, MYSQL_OPT_SSL_VERIFY_SERVER_CERT, (const char *) &verify TSRMLS_CC);
+			conn->net->data->m.set_client_option(conn->net, MYSQL_OPT_SSL_VERIFY_SERVER_CERT, (const char *) &verify TSRMLS_CC);

-		if (FAIL == conn->net->data->m.enable_ssl(conn->net TSRMLS_CC)) {
-			goto end;
+			if (FAIL == conn->net->data->m.enable_ssl(conn->net TSRMLS_CC)) {
+				goto end;
+			}
 		}
 	}
+#else
+	auth_packet->client_flags &= ~CLIENT_SSL;
+	if (!PACKET_WRITE(auth_packet, conn)) {
+		goto close_conn;
+	}
 #endif
 	ret = PASS;
 end:
 	PACKET_FREE(auth_packet);
 	DBG_RETURN(ret);
+
+close_conn:
+	CONN_SET_STATE(conn, CONN_QUIT_SENT);
+	conn->m->send_close(conn TSRMLS_CC);
+	SET_CLIENT_ERROR(*conn->error_info, CR_SERVER_GONE_ERROR, UNKNOWN_SQLSTATE, mysqlnd_server_gone);
+	PACKET_FREE(auth_packet);
+	DBG_RETURN(ret);
 }
 /* }}} */

@@ -1563,7 +1577,7 @@ MYSQLND_METHOD(mysqlnd_conn_data, sqlstate)(const MYSQLND_CONN_DATA * const conn


 /* {{{ mysqlnd_old_escape_string */
-PHPAPI ulong 
+PHPAPI ulong
 mysqlnd_old_escape_string(char * newstr, const char * escapestr, size_t escapestr_len TSRMLS_DC)
 {
 	DBG_ENTER("mysqlnd_old_escape_string");
@@ -1725,7 +1739,7 @@ MYSQLND_METHOD(mysqlnd_conn_data, statistic)(MYSQLND_CONN_DATA * conn, char **me

 			if (PASS == (ret = PACKET_READ(stats_header, conn))) {
 				/* will be freed by Zend, thus don't use the mnd_ allocator */
-				*message = estrndup(stats_header->message, stats_header->message_len); 
+				*message = estrndup(stats_header->message, stats_header->message_len);
 				*message_len = stats_header->message_len;
 				DBG_INF(*message);
 			}
@@ -1851,7 +1865,7 @@ MYSQLND_METHOD(mysqlnd_conn_data, shutdown)(MYSQLND_CONN_DATA * const conn, uint

 		conn->m->local_tx_end(conn, this_func, ret TSRMLS_CC);
 	}
-	DBG_RETURN(ret);	
+	DBG_RETURN(ret);
 }
 /* }}} */

@@ -2350,7 +2364,7 @@ MYSQLND_METHOD(mysqlnd_conn_data, set_client_option)(MYSQLND_CONN_DATA * const c
 				ret = FAIL;
 				break;
 			}
-				
+
 			new_charset_name = mnd_pestrdup(value, conn->persistent);
 			if (!new_charset_name) {
 				goto oom;
@@ -2429,11 +2443,11 @@ MYSQLND_METHOD(mysqlnd_conn_data, set_client_option)(MYSQLND_CONN_DATA * const c
 		default:
 			ret = FAIL;
 	}
-	conn->m->local_tx_end(conn, this_func, ret TSRMLS_CC);	
+	conn->m->local_tx_end(conn, this_func, ret TSRMLS_CC);
 	DBG_RETURN(ret);
 oom:
 	SET_OOM_ERROR(*conn->error_info);
-	conn->m->local_tx_end(conn, this_func, FAIL TSRMLS_CC);	
+	conn->m->local_tx_end(conn, this_func, FAIL TSRMLS_CC);
 end:
 	DBG_RETURN(FAIL);
 }
@@ -2510,7 +2524,7 @@ MYSQLND_METHOD(mysqlnd_conn_data, set_client_option_2d)(MYSQLND_CONN_DATA * cons
 	DBG_RETURN(ret);
 oom:
 	SET_OOM_ERROR(*conn->error_info);
-	conn->m->local_tx_end(conn, this_func, FAIL TSRMLS_CC);	
+	conn->m->local_tx_end(conn, this_func, FAIL TSRMLS_CC);
 end:
 	DBG_RETURN(FAIL);
 }
@@ -2551,7 +2565,7 @@ MYSQLND_METHOD(mysqlnd_conn_data, use_result)(MYSQLND_CONN_DATA * const conn TSR
 			conn->current_result = NULL;
 		} while (0);

-		conn->m->local_tx_end(conn, this_func, result == NULL? FAIL:PASS TSRMLS_CC);	
+		conn->m->local_tx_end(conn, this_func, result == NULL? FAIL:PASS TSRMLS_CC);
 	}

 	DBG_RETURN(result);
@@ -2591,7 +2605,7 @@ MYSQLND_METHOD(mysqlnd_conn_data, store_result)(MYSQLND_CONN_DATA * const conn T
 			conn->current_result = NULL;
 		} while (0);

-		conn->m->local_tx_end(conn, this_func, result == NULL? FAIL:PASS TSRMLS_CC);	
+		conn->m->local_tx_end(conn, this_func, result == NULL? FAIL:PASS TSRMLS_CC);
 	}
 	DBG_RETURN(result);
 }
@@ -2620,7 +2634,7 @@ MYSQLND_METHOD(mysqlnd_conn_data, set_autocommit)(MYSQLND_CONN_DATA * conn, unsi

 	if (PASS == conn->m->local_tx_start(conn, this_func TSRMLS_CC)) {
 		ret = conn->m->query(conn, (mode) ? "SET AUTOCOMMIT=1":"SET AUTOCOMMIT=0", sizeof("SET AUTOCOMMIT=1") - 1 TSRMLS_CC);
-		conn->m->local_tx_end(conn, this_func, ret TSRMLS_CC);	
+		conn->m->local_tx_end(conn, this_func, ret TSRMLS_CC);
 	}

 	DBG_RETURN(ret);
@@ -108,8 +108,8 @@ if test -z "$ODBC_TYPE"; then
 PHP_ARG_WITH(adabas,,
 [  --with-adabas[=DIR]       Include Adabas D support [/usr/local]])

+  AC_MSG_CHECKING([for Adabas support])
  if test "$PHP_ADABAS" != "no"; then
-    AC_MSG_CHECKING([for Adabas support])
    if test "$PHP_ADABAS" = "yes"; then
      PHP_ADABAS=/usr/local
    fi
@@ -128,6 +128,8 @@ PHP_ARG_WITH(adabas,,
    PHP_ODBC_CHECK_HEADER(sqlext.h)
    AC_DEFINE(HAVE_ADABAS,1,[ ])
    AC_MSG_RESULT([$ext_output])
+  else
+    AC_MSG_RESULT(no)
  fi
 fi

@@ -135,8 +137,8 @@ if test -z "$ODBC_TYPE"; then
 PHP_ARG_WITH(sapdb,,
 [  --with-sapdb[=DIR]        Include SAP DB support [/usr/local]])

+  AC_MSG_CHECKING([for SAP DB support])
  if test "$PHP_SAPDB" != "no"; then
-    AC_MSG_CHECKING([for SAP DB support])
    if test "$PHP_SAPDB" = "yes"; then
      PHP_SAPDB=/usr/local
    fi
@@ -146,6 +148,8 @@ PHP_ARG_WITH(sapdb,,
    ODBC_TYPE=sapdb
    AC_DEFINE(HAVE_SAPDB,1,[ ])
    AC_MSG_RESULT([$ext_output])
+  else
+    AC_MSG_RESULT(no)
  fi
 fi

@@ -153,8 +157,8 @@ if test -z "$ODBC_TYPE"; then
 PHP_ARG_WITH(solid,,
 [  --with-solid[=DIR]        Include Solid support [/usr/local/solid]])

+  AC_MSG_CHECKING(for Solid support)
  if test "$PHP_SOLID" != "no"; then
-    AC_MSG_CHECKING(for Solid support)
    if test "$PHP_SOLID" = "yes"; then
      PHP_SOLID=/usr/local/solid
    fi
@@ -171,6 +175,8 @@ PHP_ARG_WITH(solid,,
    fi
    AC_MSG_RESULT([$ext_output])
    PHP_ODBC_FIND_SOLID_LIBS($ODBC_LIBDIR)
+  else
+    AC_MSG_RESULT(no)
  fi
 fi

@@ -178,8 +184,8 @@ if test -z "$ODBC_TYPE"; then
 PHP_ARG_WITH(ibm-db2,,
 [  --with-ibm-db2[=DIR]      Include IBM DB2 support [/home/db2inst1/sqllib]])

+  AC_MSG_CHECKING(for IBM DB2 support)
  if test "$PHP_IBM_DB2" != "no"; then
-    AC_MSG_CHECKING(for IBM DB2 support)
    if test "$PHP_IBM_DB2" = "yes"; then
      ODBC_INCDIR=/home/db2inst1/sqllib/include
      ODBC_LIBDIR=/home/db2inst1/sqllib/lib
@@ -208,6 +214,8 @@ You need to source your DB2 environment before running PHP configure:
    ], [
      $ODBC_LFLAGS $ODBC_LIBS
    ])
+  else
+    AC_MSG_RESULT(no)
  fi
 fi

@@ -215,8 +223,8 @@ if test -z "$ODBC_TYPE"; then
 PHP_ARG_WITH(ODBCRouter,,
 [  --with-ODBCRouter[=DIR]   Include ODBCRouter.com support [/usr]])

+  AC_MSG_CHECKING(for ODBCRouter.com support)
  if test "$PHP_ODBCROUTER" != "no"; then
-    AC_MSG_CHECKING(for ODBCRouter.com support)
    if test "$PHP_ODBCROUTER" = "yes"; then
      PHP_ODBCROUTER=/usr
    fi
@@ -228,6 +236,8 @@ PHP_ARG_WITH(ODBCRouter,,
    ODBC_TYPE=ODBCRouter
    AC_DEFINE(HAVE_ODBC_ROUTER,1,[ ])
    AC_MSG_RESULT([$ext_output])
+  else
+    AC_MSG_RESULT(no)
  fi
 fi

@@ -236,8 +246,8 @@ PHP_ARG_WITH(empress,,
 [  --with-empress[=DIR]      Include Empress support [\$EMPRESSPATH]
                          (Empress Version >= 8.60 required)])

+  AC_MSG_CHECKING(for Empress support)
  if test "$PHP_EMPRESS" != "no"; then
-    AC_MSG_CHECKING(for Empress support)
    if test "$PHP_EMPRESS" = "yes"; then
      ODBC_INCDIR=$EMPRESSPATH/include/odbc
      ODBC_LIBDIR=$EMPRESSPATH/shlib
@@ -251,6 +261,8 @@ PHP_ARG_WITH(empress,,
    AC_DEFINE(HAVE_EMPRESS,1,[ ])
    AC_MSG_RESULT([$ext_output])
    PHP_ODBC_FIND_EMPRESS_LIBS($ODBC_LIBDIR)
+  else
+    AC_MSG_RESULT(no)
  fi
 fi

@@ -260,8 +272,8 @@ PHP_ARG_WITH(empress-bcs,,
                          Include Empress Local Access support [\$EMPRESSPATH]
                          (Empress Version >= 8.60 required)])

+  AC_MSG_CHECKING(for Empress local access support)
  if test "$PHP_EMPRESS_BCS" != "no"; then
-    AC_MSG_CHECKING(for Empress local access support)
    if test "$PHP_EMPRESS_BCS" = "yes"; then
      ODBC_INCDIR=$EMPRESSPATH/include/odbc
      ODBC_LIBDIR=$EMPRESSPATH/shlib
@@ -291,6 +303,8 @@ PHP_ARG_WITH(empress-bcs,,
    AC_DEFINE(HAVE_EMPRESS,1,[ ])
    AC_MSG_RESULT([$ext_output])
    PHP_ODBC_FIND_EMPRESS_BCS_LIBS($ODBC_LIBDIR)
+  else
+    AC_MSG_RESULT(no)
  fi
 fi

@@ -298,8 +312,8 @@ if test -z "$ODBC_TYPE"; then
 PHP_ARG_WITH(birdstep,,
 [  --with-birdstep[=DIR]     Include Birdstep support [/usr/local/birdstep]])
  
+  AC_MSG_CHECKING(for Birdstep support)
  if test "$PHP_BIRDSTEP" != "no"; then
-    AC_MSG_CHECKING(for Birdstep support)
    if test "$PHP_BIRDSTEP" = "yes"; then
        ODBC_INCDIR=/usr/local/birdstep/include
        ODBC_LIBDIR=/usr/local/birdstep/lib
@@ -338,6 +352,8 @@ PHP_ARG_WITH(birdstep,,

    AC_DEFINE(HAVE_BIRDSTEP,1,[ ])
    AC_MSG_RESULT([$ext_output])
+  else
+    AC_MSG_RESULT(no)
  fi
 fi

@@ -352,8 +368,8 @@ PHP_ARG_WITH(custom-odbc,,
                            LDFLAGS=-lunix
                            CUSTOM_ODBC_LIBS=\"-ldblib -lodbc\"])

+  AC_MSG_CHECKING(for a custom ODBC support)
  if test "$PHP_CUSTOM_ODBC" != "no"; then
-    AC_MSG_CHECKING(for a custom ODBC support)
    if test "$PHP_CUSTOM_ODBC" = "yes"; then
      PHP_CUSTOM_ODBC=/usr/local
    fi
@@ -365,6 +381,8 @@ PHP_ARG_WITH(custom-odbc,,
    ODBC_TYPE=custom-odbc
    AC_DEFINE(HAVE_CODBC,1,[ ])
    AC_MSG_RESULT([$ext_output])
+  else
+    AC_MSG_RESULT(no)
  fi
 fi

@@ -372,8 +390,8 @@ if test -z "$ODBC_TYPE"; then
 PHP_ARG_WITH(iodbc,,
 [  --with-iodbc[=DIR]        Include iODBC support [/usr/local]])

+  AC_MSG_CHECKING(for iODBC support)
  if test "$PHP_IODBC" != "no"; then
-    AC_MSG_CHECKING(for iODBC support)
    if test -z "$PKG_CONFIG"; then
      AC_PATH_PROG(PKG_CONFIG, pkg-config, no)
    fi 
@@ -401,6 +419,8 @@ PHP_ARG_WITH(iodbc,,
      AC_DEFINE(HAVE_ODBC2,1,[ ])
      AC_MSG_RESULT([$ext_output])
    fi
+  else
+    AC_MSG_RESULT(no)
  fi
 fi

@@ -408,8 +428,8 @@ if test -z "$ODBC_TYPE"; then
 PHP_ARG_WITH(esoob,,
 [  --with-esoob[=DIR]        Include Easysoft OOB support [/usr/local/easysoft/oob/client]])

+  AC_MSG_CHECKING(for Easysoft ODBC-ODBC Bridge support)
  if test "$PHP_ESOOB" != "no"; then
-    AC_MSG_CHECKING(for Easysoft ODBC-ODBC Bridge support)
    if test "$PHP_ESOOB" = "yes"; then
      PHP_ESOOB=/usr/local/easysoft/oob/client
    fi
@@ -421,6 +441,8 @@ PHP_ARG_WITH(esoob,,
    ODBC_TYPE=esoob
    AC_DEFINE(HAVE_ESOOB,1,[ ])
    AC_MSG_RESULT([$ext_output])
+  else
+    AC_MSG_RESULT(no)
  fi
 fi

@@ -428,8 +450,8 @@ if test -z "$ODBC_TYPE"; then
 PHP_ARG_WITH(unixODBC,,
 [  --with-unixODBC[=DIR]     Include unixODBC support [/usr/local]])

+  AC_MSG_CHECKING(for unixODBC support)
  if test "$PHP_UNIXODBC" != "no"; then
-    AC_MSG_CHECKING(for unixODBC support)
    if test "$PHP_UNIXODBC" = "yes"; then
      PHP_UNIXODBC=/usr/local
    fi
@@ -442,6 +464,8 @@ PHP_ARG_WITH(unixODBC,,
    PHP_ODBC_CHECK_HEADER(sqlext.h)
    AC_DEFINE(HAVE_UNIXODBC,1,[ ])
    AC_MSG_RESULT([$ext_output])
+  else
+    AC_MSG_RESULT(no)
  fi
 fi

@@ -449,8 +473,8 @@ if test -z "$ODBC_TYPE"; then
 PHP_ARG_WITH(dbmaker,,
 [  --with-dbmaker[=DIR]      Include DBMaker support])

+  AC_MSG_CHECKING(for DBMaker support)
  if test "$PHP_DBMAKER" != "no"; then
-    AC_MSG_CHECKING(for DBMaker support)
    if test "$PHP_DBMAKER" = "yes"; then
      # find dbmaker's home directory
      DBMAKER_HOME=`grep "^dbmaker:" /etc/passwd | $AWK -F: '{print $6}'`
@@ -492,6 +516,8 @@ PHP_ARG_WITH(dbmaker,,
      PHP_ADD_INCLUDE($ODBC_INCDIR)
      ODBC_STATIC="libphpext_odbc.la"
    fi
+  else
+    AC_MSG_RESULT(no)
  fi
 fi

@@ -500,7 +526,7 @@ if test "no" != "$PHP_ODBCVER"; then
    AC_DEFINE_UNQUOTED(ODBCVER, $PHP_ODBCVER, [ The highest supported ODBC version ])
  fi
 else
-  AC_DEFINE(ODBCVER, 0x300, [ The highest supported ODBC version ])
+  AC_DEFINE(ODBCVER, 0x0300, [ The highest supported ODBC version ])
 fi


@@ -525,4 +551,7 @@ if test -n "$ODBC_TYPE"; then
  PHP_SUBST_OLD(ODBC_TYPE)

  PHP_NEW_EXTENSION(odbc, php_odbc.c, $ext_shared,, $ODBC_INCLUDE)
+else
+  AC_MSG_CHECKING([for any ODBC driver support])
+  AC_MSG_RESULT(no)
 fi
@@ -960,9 +960,9 @@ int odbc_bindcols(odbc_result *result TSRMLS_DC)
 		charextraalloc = 0;
 		colfieldid = SQL_COLUMN_DISPLAY_SIZE;

-		rc = SQLColAttributes(result->stmt, (SQLUSMALLINT)(i+1), SQL_COLUMN_NAME, 
+		rc = PHP_ODBC_SQLCOLATTRIBUTE(result->stmt, (SQLUSMALLINT)(i+1), PHP_ODBC_SQL_DESC_NAME,
 				result->values[i].name, sizeof(result->values[i].name), &colnamelen, 0);
-		rc = SQLColAttributes(result->stmt, (SQLUSMALLINT)(i+1), SQL_COLUMN_TYPE, 
+		rc = PHP_ODBC_SQLCOLATTRIBUTE(result->stmt, (SQLUSMALLINT)(i+1), SQL_COLUMN_TYPE, 
 				NULL, 0, NULL, &result->values[i].coltype);
 		
 		/* Don't bind LONG / BINARY columns, so that fetch behaviour can
@@ -997,8 +997,17 @@ int odbc_bindcols(odbc_result *result TSRMLS_DC)
 				charextraalloc = 1;
 #endif
 			default:
-				rc = SQLColAttributes(result->stmt, (SQLUSMALLINT)(i+1), colfieldid,
+				rc = PHP_ODBC_SQLCOLATTRIBUTE(result->stmt, (SQLUSMALLINT)(i+1), colfieldid,
 								NULL, 0, NULL, &displaysize);
+#if defined(ODBCVER) && (ODBCVER >= 0x0300)
+				if (rc != SQL_SUCCESS && rc != SQL_SUCCESS_WITH_INFO && colfieldid == SQL_DESC_OCTET_LENGTH) {
+					 /* This is  a quirk for ODBC 2.0 compatibility for broken driver implementations.
+					  */
+					charextraalloc = 1;
+					rc = SQLColAttributes(result->stmt, (SQLUSMALLINT)(i+1), SQL_COLUMN_DISPLAY_SIZE,
+								NULL, 0, NULL, &displaysize);
+				}
+#endif
 				/* Workaround for Oracle ODBC Driver bug (#50162) when fetching TIMESTAMP column */
 				if (result->values[i].coltype == SQL_TIMESTAMP) {
 					displaysize += 3;
@@ -1091,7 +1100,7 @@ void odbc_column_lengths(INTERNAL_FUNCTION_PARAMETERS, int type)
 		RETURN_FALSE;
 	}

-	SQLColAttributes(result->stmt, (SQLUSMALLINT)pv_num, (SQLUSMALLINT) (type?SQL_COLUMN_SCALE:SQL_COLUMN_PRECISION), NULL, 0, NULL, &len);
+	PHP_ODBC_SQLCOLATTRIBUTE(result->stmt, (SQLUSMALLINT)pv_num, (SQLUSMALLINT) (type?SQL_COLUMN_SCALE:SQL_COLUMN_PRECISION), NULL, 0, NULL, &len);

 	RETURN_LONG(len);
 }
@@ -1181,7 +1190,7 @@ PHP_FUNCTION(odbc_prepare)
 	
 	result->numparams = 0;
 	
-	rc = SQLAllocStmt(conn->hdbc, &(result->stmt));
+	rc = PHP_ODBC_SQLALLOCSTMT(conn->hdbc, &(result->stmt));
 	if (rc == SQL_INVALID_HANDLE) {
 		efree(result);
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "SQLAllocStmt error 'Invalid Handle'");
@@ -1609,7 +1618,7 @@ PHP_FUNCTION(odbc_exec)
 		
 	result = (odbc_result *)ecalloc(1, sizeof(odbc_result));

-	rc = SQLAllocStmt(conn->hdbc, &(result->stmt));
+	rc = PHP_ODBC_SQLALLOCSTMT(conn->hdbc, &(result->stmt));
 	if (rc == SQL_INVALID_HANDLE) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "SQLAllocStmt error 'Invalid Handle'");
 		efree(result);
@@ -2135,7 +2144,7 @@ PHP_FUNCTION(odbc_result)
 				   fieldsize = result->longreadlen;
 				}
 			} else {
-			   SQLColAttributes(result->stmt, (SQLUSMALLINT)(field_ind + 1), 
+			   PHP_ODBC_SQLCOLATTRIBUTE(result->stmt, (SQLUSMALLINT)(field_ind + 1), 
 					   			(SQLUSMALLINT)((sql_c_type == SQL_C_BINARY) ? SQL_COLUMN_LENGTH :
 					   			SQL_COLUMN_DISPLAY_SIZE),
 					   			NULL, 0, NULL, &fieldsize);
@@ -2871,7 +2880,7 @@ PHP_FUNCTION(odbc_field_type)
 		RETURN_FALSE;
 	}

-	SQLColAttributes(result->stmt, (SQLUSMALLINT)pv_num, SQL_COLUMN_TYPE_NAME, tmp, 31, &tmplen, NULL);
+	PHP_ODBC_SQLCOLATTRIBUTE(result->stmt, (SQLUSMALLINT)pv_num, SQL_COLUMN_TYPE_NAME, tmp, 31, &tmplen, NULL);
 	RETURN_STRING(tmp,1)
 }
 /* }}} */
@@ -3110,7 +3119,7 @@ PHP_FUNCTION(odbc_tables)

 	result = (odbc_result *)ecalloc(1, sizeof(odbc_result));
 	
-	rc = SQLAllocStmt(conn->hdbc, &(result->stmt));
+	rc = PHP_ODBC_SQLALLOCSTMT(conn->hdbc, &(result->stmt));
 	if (rc == SQL_INVALID_HANDLE) {
 		efree(result);
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "SQLAllocStmt error 'Invalid Handle'");
@@ -3177,7 +3186,7 @@ PHP_FUNCTION(odbc_columns)

 	result = (odbc_result *)ecalloc(1, sizeof(odbc_result));
 	
-	rc = SQLAllocStmt(conn->hdbc, &(result->stmt));
+	rc = PHP_ODBC_SQLALLOCSTMT(conn->hdbc, &(result->stmt));
 	if (rc == SQL_INVALID_HANDLE) {
 		efree(result);
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "SQLAllocStmt error 'Invalid Handle'");
@@ -3247,7 +3256,7 @@ PHP_FUNCTION(odbc_columnprivileges)

 	result = (odbc_result *)ecalloc(1, sizeof(odbc_result));
 	
-	rc = SQLAllocStmt(conn->hdbc, &(result->stmt));
+	rc = PHP_ODBC_SQLALLOCSTMT(conn->hdbc, &(result->stmt));
 	if (rc == SQL_INVALID_HANDLE) {
 		efree(result);
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "SQLAllocStmt error 'Invalid Handle'");
@@ -3323,7 +3332,7 @@ PHP_FUNCTION(odbc_foreignkeys)

 	result = (odbc_result *)ecalloc(1, sizeof(odbc_result));
 	
-	rc = SQLAllocStmt(conn->hdbc, &(result->stmt));
+	rc = PHP_ODBC_SQLALLOCSTMT(conn->hdbc, &(result->stmt));
 	if (rc == SQL_INVALID_HANDLE) {
 		efree(result);
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "SQLAllocStmt error 'Invalid Handle'");
@@ -3389,7 +3398,7 @@ PHP_FUNCTION(odbc_gettypeinfo)

 	result = (odbc_result *)ecalloc(1, sizeof(odbc_result));
 	
-	rc = SQLAllocStmt(conn->hdbc, &(result->stmt));
+	rc = PHP_ODBC_SQLALLOCSTMT(conn->hdbc, &(result->stmt));
 	if (rc == SQL_INVALID_HANDLE) {
 		efree(result);
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "SQLAllocStmt error 'Invalid Handle'");
@@ -3446,7 +3455,7 @@ PHP_FUNCTION(odbc_primarykeys)

 	result = (odbc_result *)ecalloc(1, sizeof(odbc_result));
 	
-	rc = SQLAllocStmt(conn->hdbc, &(result->stmt));
+	rc = PHP_ODBC_SQLALLOCSTMT(conn->hdbc, &(result->stmt));
 	if (rc == SQL_INVALID_HANDLE) {
 		efree(result);
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "SQLAllocStmt error 'Invalid Handle'");
@@ -3512,7 +3521,7 @@ PHP_FUNCTION(odbc_procedurecolumns)

 	result = (odbc_result *)ecalloc(1, sizeof(odbc_result));
 	
-	rc = SQLAllocStmt(conn->hdbc, &(result->stmt));
+	rc = PHP_ODBC_SQLALLOCSTMT(conn->hdbc, &(result->stmt));
 	if (rc == SQL_INVALID_HANDLE) {
 		efree(result);
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "SQLAllocStmt error 'Invalid Handle'");
@@ -3579,7 +3588,7 @@ PHP_FUNCTION(odbc_procedures)

 	result = (odbc_result *)ecalloc(1, sizeof(odbc_result));
 	
-	rc = SQLAllocStmt(conn->hdbc, &(result->stmt));
+	rc = PHP_ODBC_SQLALLOCSTMT(conn->hdbc, &(result->stmt));
 	if (rc == SQL_INVALID_HANDLE) {
 		efree(result);
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "SQLAllocStmt error 'Invalid Handle'");
@@ -3647,7 +3656,7 @@ PHP_FUNCTION(odbc_specialcolumns)

 	result = (odbc_result *)ecalloc(1, sizeof(odbc_result));
 	
-	rc = SQLAllocStmt(conn->hdbc, &(result->stmt));
+	rc = PHP_ODBC_SQLALLOCSTMT(conn->hdbc, &(result->stmt));
 	if (rc == SQL_INVALID_HANDLE) {
 		efree(result);
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "SQLAllocStmt error 'Invalid Handle'");
@@ -3716,7 +3725,7 @@ PHP_FUNCTION(odbc_statistics)

 	result = (odbc_result *)ecalloc(1, sizeof(odbc_result));
 	
-	rc = SQLAllocStmt(conn->hdbc, &(result->stmt));
+	rc = PHP_ODBC_SQLALLOCSTMT(conn->hdbc, &(result->stmt));
 	if (rc == SQL_INVALID_HANDLE) {
 		efree(result);
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "SQLAllocStmt error 'Invalid Handle'");
@@ -3779,7 +3788,7 @@ PHP_FUNCTION(odbc_tableprivileges)

 	result = (odbc_result *)ecalloc(1, sizeof(odbc_result));
 	
-	rc = SQLAllocStmt(conn->hdbc, &(result->stmt));
+	rc = PHP_ODBC_SQLALLOCSTMT(conn->hdbc, &(result->stmt));
 	if (rc == SQL_INVALID_HANDLE) {
 		efree(result);
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "SQLAllocStmt error 'Invalid Handle'");
@@ -281,8 +281,18 @@ void odbc_sql_error(ODBC_SQL_ERROR_PARAMS);

 #if defined(ODBCVER) && (ODBCVER >= 0x0300)
 #define IS_SQL_LONG(x) (x == SQL_LONGVARBINARY || x == SQL_LONGVARCHAR || x == SQL_WLONGVARCHAR)
+
+#define PHP_ODBC_SQLCOLATTRIBUTE SQLColAttribute
+#define PHP_ODBC_SQLALLOCSTMT(hdbc, phstmt) SQLAllocHandle(SQL_HANDLE_STMT, hdbc, phstmt)
+
+#define PHP_ODBC_SQL_DESC_NAME SQL_DESC_NAME
 #else
 #define IS_SQL_LONG(x) (x == SQL_LONGVARBINARY || x == SQL_LONGVARCHAR)
+
+#define PHP_ODBC_SQLCOLATTRIBUTE SQLColAttributes
+#define PHP_ODBC_SQLALLOCSTMT SQLAllocStmt
+
+#define PHP_ODBC_SQL_DESC_NAME SQL_COLUMN_NAME
 #endif
 #define IS_SQL_BINARY(x) (x == SQL_BINARY || x == SQL_VARBINARY || x == SQL_LONGVARBINARY)

@@ -2,6 +2,11 @@
 odbc_exec(): Getting accurate unicode data from query
 --SKIPIF--
 <?php include 'skipif.inc'; ?>
+<?php 
+	if ("unixODBC" != ODBC_TYPE) {
+		die("skip ODBC_TYPE != unixODBC");
+	}
+?>
 --FILE--
 <?php