prep for 5.4.41

Add test for bug #69522
Update tests
2026-11-14 04:30:50 +00:00 · 2015-05-12 12:38:38 -07:00 · 2015-05-11 01:10:35 -07:00 · 2015-05-11 00:12:39 -07:00 · 2015-05-10 23:06:08 -07:00 · 2015-05-10 02:24:29 -07:00
259 changed files with 66550 additions and 12388 deletions
@@ -385,6 +385,12 @@ MAINTENANCE:         Maintained
 STATUS:              Working
 SINCE:               4.0.4
 -------------------------------------------------------------------------------
+EXTENSION:           hash
+PRIMARY MAINTAINER:  Sara Golemon <pollita@php.net>, Mike Wallner <mike@php.net>, Anatol Belski <ab@php.net>
+MAINTENANCE:         Maintained
+STATUS:              Working
+SINCE:               5.1.2
+-------------------------------------------------------------------------------
 EXTENSION:           iconv
 PRIMARY MAINTAINER:  Moriyoshi Koizumi <moriyoshi@php.net>
 MAINTENANCE:         Maintained
@@ -1,28 +1,241 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2014, PHP 5.4.33
+14 May 2015 PHP 5.4.41
+
+- Core: 
+  . Fixed bug #69364 (PHP Multipart/form-data remote dos Vulnerability). (Stas)
+  . Fixed bug #69403 (str_repeat() sign mismatch based memory corruption). 
+    (Stas)
+  . Fixed bug #69418 (CVE-2006-7243 fix regressions in 5.4+). (Stas)
+  . Fixed bug #69522 (heap buffer overflow in unpack()). (Stas)
+  
+- FTP:
+  . Fixed bug #69545 (Integer overflow in ftp_genlist() resulting in heap
+    overflow). (Stas)
+
+- PCNTL:
+  . Fixed bug #68598 (pcntl_exec() should not allow null char). (Stas)
+
+- PCRE
+  . Upgraded pcrelib to 8.37.
+
+- Phar:
+  . Fixed bug #69453 (Memory Corruption in phar_parse_tarfile when entry
+    filename starts with null). (Stas)
+
+16 Apr 2015 PHP 5.4.40
+
+- Apache2handler:
+  . Fixed bug #69218 (potential remote code execution with apache 2.4
+    apache2handler). (Gerrit Venema)
+
+- Core:
+  . Additional fix for bug #69152 (Type confusion vulnerability in
+    exception::getTraceAsString). (Stas)
+  . Fixed bug #69337 (php_stream_url_wrap_http_ex() type-confusion
+    vulnerability). (Stas)
+  . Fixed bug #69353 (Missing null byte checks for paths in various PHP
+    extensions). (Stas)
+
+- cURL:
+  . Fixed bug #69316 (Use-after-free in php_curl related to
+    CURLOPT_FILE/_INFILE/_WRITEHEADER). (Laruence)
+
+- Ereg:
+  . Fixed bug #68740 (NULL Pointer Dereference). (Laruence)
+
+- Fileinfo:
+  . Fixed bug #68819 (Fileinfo on specific file causes spurious OOM and/or
+    segfault). (Anatol Belski)
+
+- GD:
+  . Fixed bug #68601 (buffer read overflow in gd_gif_in.c). (Remi)
+
+- Phar:
+  . Fixed bug #68901 (use after free). (bugreports at internot dot info)
+  . Fixed bug #69324 (Buffer Over-read in unserialize when parsing Phar). (Stas)
+  . Fixed bug #69441 (Buffer Overflow when parsing tar/zip/phar in
+    phar_set_inode). (Stas)
+
+- Postgres:
+  . Fixed bug #68741 (Null pointer deference) (CVE-2015-1352). (Xinchen Hui)
+
+- SOAP:
+  . Fixed bug #69152 (Type Confusion Infoleak Vulnerability in unserialize()
+    with SoapFault). (Dmitry)
+
+- Sqlite3:
+  . Fixed bug #66550 (SQLite prepared statement use-after-free). (Sean Heelan)
+
+19 Mar 2015 PHP 5.4.39
+
+- Core:
+  . Fixed bug #68976 (Use After Free Vulnerability in unserialize())
+    (CVE-2015-2787). (Stas)
+  . Fixed bug #69134 (Per Directory Values overrides PHP_INI_SYSTEM
+    configuration options). (Anatol Belski)
+  . Fixed bug #69207 (move_uploaded_file allows nulls in path). (Stas)
+
+- Ereg:
+  . Fixed bug #69248 (heap overflow vulnerability in regcomp.c) (CVE-2015-2305).
+    (Stas)
+
+- SOAP:
+  . Fixed bug #69085 (SoapClient's __call() type confusion through
+    unserialize()). (Dmitry)
+
+- ZIP:
+  . Fixed bug #69253 (ZIP Integer Overflow leads to writing past heap
+    boundary) (CVE-2015-2331). (Stas)
+
+19 Feb 2015 PHP 5.4.38
+
+- Core:
+  . Removed support for multi-line headers, as the are deprecated by RFC 7230.
+    (Stas)
+  . Added NULL byte protection to exec, system and passthru. (Yasuo)
+  . Fixed bug #68925 (Mitigation for CVE-2015-0235 – GHOST: glibc gethostbyname
+    buffer overflow). (Stas)
+  . Fixed bug #67827 (broken detection of system crypt sha256/sha512 support).
+    (ncopa at alpinelinux dot org)  
+  . Fixed bug #68942 (Use after free vulnerability in unserialize() with
+    DateTimeZone). (CVE-2015-0273) (Stas)
+  
+- Enchant: 
+  . Fixed bug #68552 (heap buffer overflow in enchant_broker_request_dict()).
+    (Antony)
+
+- SOAP:
+  . Fixed bug #67427 (SoapServer cannot handle large messages)
+    (brandt at docoloc dot de)
+
+22 Jan 2015 PHP 5.4.37
+- Core:
+  . Fixed bug #68710 (Use After Free Vulnerability in PHP's unserialize()).
+    (CVE-2015-0231) (Stefan Esser)
+
+- CGI:
+  . Fixed bug #68618 (out of bounds read crashes php-cgi). (CVE-2014-9427)
+    (Stas)
+
+- EXIF:
+  . Fixed bug #68799: Free called on unitialized pointer. (CVE-2015-0232) 
+    (Stas)
+
+- Fileinfo:
+  . Removed readelf.c and related code from libmagic sources
+    (Remi, Anatol)
+  . Fixed bug #68735 (fileinfo out-of-bounds memory access).
+    (Anatol)

 - OpenSSL:
-  . Fixed bug #41631 (socket timeouts not honored in blocking SSL reads)
-    (Daniel Lowrey).
+  . Fixed bug #55618 (use case-insensitive cert name matching).
+    (Daniel Lowrey)
+
+18 Dec 2014 PHP 5.4.36
+
+- Core:
+  . Upgraded crypt_blowfish to version 1.3. (Leigh)
+  . Fixed bug #68545 (NULL pointer dereference in unserialize.c). (Anatol)
+  . Fixed bug #68594 (Use after free vulnerability in unserialize()).
+    (CVE-2014-8142) (Stefan Esser)
+
+- Mcrypt:
+  . Fixed possible read after end of buffer and use after free. (Dmitry)
+
+13 Nov 2014 PHP 5.4.35
+
+- Core:
+  . Fixed bug #68365 (zend_mm_heap corrupted after memory overflow in
+    zend_hash_copy). (Dmitry)
+
+- Fileinfo:
+  . Fixed bug #68283 (fileinfo: out-of-bounds read in elf note headers).
+    (CVE-2014-3710) (Remi)
+
+- GMP:
+ . Fixed bug #63595 (GMP memory management conflicts with other libraries
+   using GMP). (Remi)
+
+- PDO_pgsql:
+  . Fixed bug #66584 (Segmentation fault on statement deallocation) (Matteo)
+
+16 Oct 2014, PHP 5.4.34
+
+- Fileinfo:
+  . Fixed bug #66242 (libmagic: don't assume char is signed). (ArdB)
+
+- Core:
+  . Fixed bug #67985 (Incorrect last used array index copied to new array after
+    unset). (Tjerk)
+  . Fixed bug #68044 (Integer overflow in unserialize() (32-bits only)). 
+    (CVE-2014-3669) (Stas)
+
+- cURL:
+  . Fixed bug #68089 (NULL byte injection - cURL lib). (Stas)
+
+- EXIF:
+  . Fixed bug #68113 (Heap corruption in exif_thumbnail()). (CVE-2014-3670)
+    (Stas)
+
+- OpenSSL:
+  . Reverted fixes for bug #41631, due to regressions. (Stas) 
+
+- XMLRPC:
+  . Fixed bug #68027 (Global buffer overflow in mkgmtime() function). 
+    (CVE-2014-3668) (Stas)
+
+18 Sep 2014, PHP 5.4.33
+
+- Core:
+  . Fixed bug #47358 (glob returns error, should be empty array()). (Pierre)
+  . Fixed bug #65463 (SIGSEGV during zend_shutdown()). (Keyur Govande)
+  . Fixed bug #66036 (Crash on SIGTERM in apache process). (Keyur Govande)
+
+- OpenSSL:
+  . Fixed bug #41631 (socket timeouts not honored in blocking SSL reads).
+    (Daniel Lowrey)

 - Date:
-  . Fixed bug #66091 (memory leaks in DateTime constructor) (Tjerk).
+  . Fixed bug #66091 (memory leaks in DateTime constructor). (Tjerk)

-?? ??? 2014, PHP 5.4.32
+- FPM:
+  . Fixed #67606 (FPM with mod_fastcgi/apache2.4 is broken). (David Zuelke)
+
+- GD:
+  . Made fontFetch's path parser thread-safe. (Sara)
+
+- Wddx:
+  . Fixed bug #67873 (Segfaults in php_wddx_serialize_var). (Anatol, Remi)
+
+- Zlib:
+  . Fixed bug #67724 (chained zlib filters silently fail with large amounts of 
+    data). (Mike)
+  . Fixed bug #67865 (internal corruption phar error). (Mike)
+
+21 Aug 2014, PHP 5.4.32

 - COM:
-  . Fixed missing type checks in com_event_sink (Yussuf Khalil, Stas).
-  . Fixed bug #41577 (DOTNET is successful once per server run)
+  . Fixed missing type checks in com_event_sink. (Yussuf Khalil, Stas)
+  . Fixed bug #41577 (DOTNET is successful once per server run).
    (Aidas Kasparas)

 - Fileinfo:
  . Fixed bug #67705 (extensive backtracking in rule regular expression).
    (CVE-2014-3538) (Remi)
+  . Fixed bug #67716 (Segfault in cdf.c). (CVE-2014-3587) (Remi)

 - GD:
  . Fixed bug #66901 (php-gd 'c_color' NULL pointer dereference).
-    (CVE-2014-2497) (Remi)
+    (CVE-2014-2497). (Remi)
+  . Fixed bug #67730 (Null byte injection possible with imagexxx functions).
+    (CVE-2014-5120) (Ryan Mauger)
+
+- LiteSpeed:
+  . Updated LiteSpeed SAPI code from V5.5 to V6.6 (George Wang)
+
+- Network:
+  . Fixed bug #67717 (segfault in dns_get_record). (CVE-2014-3597) (Remi)

 - Milter:
  . Fixed bug #67715 (php-milter does not build and crashes randomly). (Mike)
@@ -37,11 +250,11 @@ PHP                                                                        NEWS
    with control-c). (Dmitry Saprykin, Johannes)

 - Sessions:
-  . Fixed missing type checks in php_session_create_id (Yussuf Khalil, Stas).
+  . Fixed missing type checks in php_session_create_id. (Yussuf Khalil, Stas).

 - SPL:
  . Fixed bug #67539 (ArrayIterator use-after-free due to object change during
-    sorting). (research at insighti dot org, Laruence)
+    sorting). (CVE-2014-4698) (research at insighti dot org, Laruence)
  . Fixed bug #67538 (SPL Iterators use-after-free). (CVE-2014-4670) (Laruence)

 - Core:
@@ -51,9 +264,8 @@ PHP                                                                        NEWS
  . Fixed bug #60616 (odbc_fetch_into returns junk data at end of multi-byte
    char fields). (Keyur)

- Zlib:
-  . Fixed bug #67724 (chained zlib filters silently fail with large amounts of 
-    data). (Mike)
+- MySQLi:
+  . Fixed bug #67839 (mysqli does not handle 4-byte floats correctly). (Keyur)

 24 Jul 2014, PHP 5.4.31

@@ -45,15 +45,16 @@ Currently we have the following branches in use::

  master    The active development branch. 

+  PHP-5.6   Is used to release the PHP 5.6.x series. This is a current
+            stable version and is open for bugfixes only.
+
  PHP-5.5   Is used to release the PHP 5.5.x series. This is a current
            stable version and is open for bugfixes only.

  PHP-5.4   Is used to release the PHP 5.4.x series. This is a current
            stable version and is open for bugfixes only.

-  PHP-5.3   Is used to release the PHP 5.3.x series. This is currently 
-            in extended support and open forsecurity fixes only. Triaged
-            via security@php.net
+  PHP-5.3   This branch is closed.

  PHP-5.2   This branch is closed.

@@ -61,9 +62,12 @@ Currently we have the following branches in use::

  PHP-4.4   This branch is closed.

+  PHP-X.Y.Z These branches are used for the release managers for tagging
+            the releases, hence they are closed to the general public.
+
 The next few rules are more of a technical nature::

-   1. All changes should first go to the lowest branch (i.e. 5.3) and then 
+   1. All changes should first go to the lowest branch (i.e. 5.4) and then
      get merged up to all other branches. If a change is not needed for
      later branches (i.e. fixes for features which where dropped from later
      branches) an empty merge should be done.
@@ -183,11 +183,11 @@ last commit id to web/php.git, then, mirrors will now sync
 Getting the stable release announced
 ------------------------------------

-1. Run the bumpRelease script for phpweb on your local checkout
+1. Update phpweb/include/releases.inc with the old release info
+  (updates the download archives)

- a. ``php bin/bumpRelease 5`` to create the release file (releases/x_y_z.php)
-    The release announcement file should list in detail security fixes and
-    changes in behavior (whether due to a bug fix or not).
+ a. You can run ``php bin/bumpRelease 5`` if you are making a release for the
+    highest branch, otherwise you have to do this manually, see point 1.b

 b. In case multiple PHP minor versions are in active development you have
    to manually copy the old information to include/releases.inc
@@ -200,15 +200,18 @@ Getting the stable release announced

 c. ``$PHP_X_MD5`` array and update all the md5 sums

- d. set ``$PHP_X_RC`` to false!
+ d. ``$PHP_X_SHA256`` array and update all the SHA256 sums

- e. Make sure there are no outdated "notes" or edited "date" keys in the
+ e. set ``$PHP_X_RC`` to false!
+
+ f. Make sure there are no outdated "notes" or edited "date" keys in the
 ``$RELEASES[X][$PHP_X_VERSION]["source"]`` array

- f. if the windows builds aren't ready yet prefix the "windows" key with a dot (".windows")
+ g. if the windows builds aren't ready yet prefix the "windows" key with a dot (".windows")

-3. Update phpweb/include/releases.php with the old release info
-  (updates the download archives)
+3. Create the release file (releases/x_y_z.php)
+   Usually we use the same content as for point 6, but included in php template
+   instead of the release xml.

 4. Update php-qa/include/release-qa.php and add the next version as an QARELEASE
   (prepare for next RC)
@@ -253,6 +256,9 @@ to upgrade.
 9. Wait an hour or two, then send a mail to php-announce@lists.php.net,
 php-general@lists.php.net and internals@lists.php.net with a text similar to
 http://news.php.net/php.internals/17222.
+Please make sure that the mail to php-announce@ is its own completely seperate email.
+This is to make sure that repiles to the announcement on php-general@ or internals@
+will not accidentally hit the php-announce@ mailinglist.

 Re-releasing the same version (or -pl)
 --------------------------------------
@@ -269,7 +275,9 @@ Re-releasing the same version (or -pl)

 d. ``$PHP_X_MD5`` array and update all the md5 sums

- e. Make sure there are no outdated "notes" or edited "date" keys in the
+ e. ``$PHP_X_SHA256`` array and update all the SHA256 sums
+
+ f. Make sure there are no outdated "notes" or edited "date" keys in the
 ``$RELEASES[X][$PHP_X_VERSION]["source"]`` array

 3. Add a short notice to phpweb stating that there is a new release, and
@@ -286,3 +294,6 @@ to upgrade.
 5. Wait an hour or two, then send a mail to php-announce@lists.php.net,
 php-general@lists.php.net and internals@lists.php.net with a text similar to
 the news entry.
+Please make sure that the mail to php-announce@ is its own completely seperate email.
+This is to make sure that repiles to the announcement on php-general@ or internals@
+will not accidentally hit the php-announce@ mailinglist.
@@ -0,0 +1,16 @@
+--TEST--
+Bug #67985 - Last used array index not copied to new array at assignment
+--FILE--
+<?php
+
+$a = ['zero', 'one', 'two'];
+unset($a[2]);
+$b = $a;
+$a[] = 'three';
+$b[] = 'three';
+
+var_dump($a === $b);
+
+?>
+--EXPECT--
+bool(true)
@@ -813,6 +813,20 @@ void zend_shutdown(TSRMLS_D) /* {{{ */
 	zend_shutdown_timeout_thread();
 #endif
 	zend_destroy_rsrc_list(&EG(persistent_list) TSRMLS_CC);
+
+	if (EG(active))
+	{
+		/*
+		 * The order of destruction is important here.
+		 * See bugs #65463 and 66036.
+		 */
+		zend_hash_reverse_apply(GLOBAL_FUNCTION_TABLE, (apply_func_t) zend_cleanup_function_data_full TSRMLS_CC);
+		zend_hash_reverse_apply(GLOBAL_CLASS_TABLE, (apply_func_t) zend_cleanup_user_class_data TSRMLS_CC);
+		zend_cleanup_internal_classes(TSRMLS_C);
+		zend_hash_reverse_apply(GLOBAL_FUNCTION_TABLE, (apply_func_t) clean_non_persistent_function_full TSRMLS_CC);
+		zend_hash_reverse_apply(GLOBAL_CLASS_TABLE, (apply_func_t) clean_non_persistent_class_full TSRMLS_CC);
+	}
+
 	zend_destroy_modules();

 	zend_hash_destroy(GLOBAL_FUNCTION_TABLE);
@@ -980,7 +980,7 @@ static void zend_mm_random(unsigned char *buf, size_t size) /* {{{ */
 	int has_context = 0;

 	if (!CryptAcquireContext(&hCryptProv, NULL, NULL, PROV_RSA_FULL, 0)) {
-		/* Could mean that the key container does not exist, let try 
+		/* Could mean that the key container does not exist, let try
 		   again by asking for a new one */
 		if (GetLastError() == NTE_BAD_KEYSET) {
 			if (CryptAcquireContext(&hCryptProv, NULL, NULL, PROV_RSA_FULL, CRYPT_NEWKEYSET)) {
@@ -1344,7 +1344,7 @@ static int zend_mm_check_ptr(zend_mm_heap *heap, void *ptr, int silent ZEND_FILE
 	}
 	if (!silent) {
 		TSRMLS_FETCH();
-		
+
 		zend_message_dispatcher(ZMSG_LOG_SCRIPT_NAME, NULL TSRMLS_CC);
 		zend_debug_alloc_output("---------------------------------------\n");
 		zend_debug_alloc_output("%s(%d) : Block "PTR_FMT" status:\n" ZEND_FILE_LINE_RELAY_CC, ptr);
@@ -2171,7 +2171,7 @@ static void *_zend_mm_realloc_int(zend_mm_heap *heap, void *p, size_t size ZEND_
 #if ZEND_MM_CACHE
 	if (ZEND_MM_SMALL_SIZE(true_size)) {
 		size_t index = ZEND_MM_BUCKET_INDEX(true_size);
-		
+
 		if (heap->cache[index] != NULL) {
 			zend_mm_free_block *best_fit;
 			zend_mm_free_block **cache;
@@ -2184,7 +2184,7 @@ static void *_zend_mm_realloc_int(zend_mm_heap *heap, void *p, size_t size ZEND_
 			heap->cache[index] = best_fit->prev_free_block;
 			ZEND_MM_CHECK_MAGIC(best_fit, MEM_BLOCK_CACHED);
 			ZEND_MM_SET_DEBUG_INFO(best_fit, size, 1, 0);
-	
+
 			ptr = ZEND_MM_DATA_OF(best_fit);

 #if ZEND_DEBUG || ZEND_MM_HEAP_PROTECTION
@@ -2466,7 +2466,7 @@ static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
 	     : "%0"(res),
 	       "rm"(size),
 	       "rm"(offset));
-	
+
 	if (UNEXPECTED(overflow)) {
 		zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
 		return 0;
@@ -2575,7 +2575,7 @@ ZEND_API void *_ecalloc(size_t nmemb, size_t size ZEND_FILE_LINE_DC ZEND_FILE_LI

 ZEND_API char *_estrdup(const char *s ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)
 {
-	int length;
+	size_t length;
 	char *p;
 #ifdef ZEND_SIGNALS
 	TSRMLS_FETCH();
@@ -2583,13 +2583,13 @@ ZEND_API char *_estrdup(const char *s ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)

 	HANDLE_BLOCK_INTERRUPTIONS();

-	length = strlen(s)+1;
-	p = (char *) _emalloc(length ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
+	length = strlen(s);
+	p = (char *) _emalloc(safe_address(length, 1, 1) ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
 	if (UNEXPECTED(p == NULL)) {
 		HANDLE_UNBLOCK_INTERRUPTIONS();
 		return p;
 	}
-	memcpy(p, s, length);
+	memcpy(p, s, length+1);
 	HANDLE_UNBLOCK_INTERRUPTIONS();
 	return p;
 }
@@ -2603,7 +2603,7 @@ ZEND_API char *_estrndup(const char *s, uint length ZEND_FILE_LINE_DC ZEND_FILE_

 	HANDLE_BLOCK_INTERRUPTIONS();

-	p = (char *) _emalloc(length+1 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
+	p = (char *) _emalloc(safe_address(length, 1, 1) ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
 	if (UNEXPECTED(p == NULL)) {
 		HANDLE_UNBLOCK_INTERRUPTIONS();
 		return p;
@@ -2624,7 +2624,7 @@ ZEND_API char *zend_strndup(const char *s, uint length)

 	HANDLE_BLOCK_INTERRUPTIONS();

-	p = (char *) malloc(length+1);
+	p = (char *) malloc(safe_address(length, 1, 1));
 	if (UNEXPECTED(p == NULL)) {
 		HANDLE_UNBLOCK_INTERRUPTIONS();
 		return p;
@@ -639,6 +639,8 @@ ZEND_API void zend_cleanup_internal_class_data(zend_class_entry *ce TSRMLS_DC);
 ZEND_API void zend_cleanup_internal_classes(TSRMLS_D);
 ZEND_API int zend_cleanup_function_data(zend_function *function TSRMLS_DC);
 ZEND_API int zend_cleanup_function_data_full(zend_function *function TSRMLS_DC);
+ZEND_API int clean_non_persistent_function_full(zend_function *function TSRMLS_DC);
+ZEND_API int clean_non_persistent_class_full(zend_class_entry **ce TSRMLS_DC);

 ZEND_API void destroy_zend_function(zend_function *function TSRMLS_DC);
 ZEND_API void zend_function_dtor(zend_function *function);
@@ -587,10 +587,14 @@ ZEND_METHOD(exception, getTraceAsString)

 	DEFAULT_0_PARAMS;
 	
+	trace = zend_read_property(default_exception_ce, getThis(), "trace", sizeof("trace")-1, 1 TSRMLS_CC);
+	if(Z_TYPE_P(trace) != IS_ARRAY) {
+		RETURN_FALSE;
+	}
+
 	res = estrdup("");
 	str = &res;

-	trace = zend_read_property(default_exception_ce, getThis(), "trace", sizeof("trace")-1, 1 TSRMLS_CC);
 	zend_hash_apply_with_arguments(Z_ARRVAL_P(trace) TSRMLS_CC, (apply_func_args_t)_build_trace_string, 3, str, len, &num);

 	s_tmp = emalloc(1 + MAX_LENGTH_OF_LONG + 7 + 1);
@@ -108,7 +108,7 @@ static int clean_non_persistent_function(zend_function *function TSRMLS_DC) /* {
 }
 /* }}} */

-static int clean_non_persistent_function_full(zend_function *function TSRMLS_DC) /* {{{ */
+ZEND_API int clean_non_persistent_function_full(zend_function *function TSRMLS_DC) /* {{{ */
 {
 	return (function->type == ZEND_INTERNAL_FUNCTION) ? ZEND_HASH_APPLY_KEEP : ZEND_HASH_APPLY_REMOVE;
 }
@@ -120,7 +120,7 @@ static int clean_non_persistent_class(zend_class_entry **ce TSRMLS_DC) /* {{{ */
 }
 /* }}} */

-static int clean_non_persistent_class_full(zend_class_entry **ce TSRMLS_DC) /* {{{ */
+ZEND_API int clean_non_persistent_class_full(zend_class_entry **ce TSRMLS_DC) /* {{{ */
 {
 	return ((*ce)->type == ZEND_INTERNAL_CLASS) ? ZEND_HASH_APPLY_KEEP : ZEND_HASH_APPLY_REMOVE;
 }
@@ -1264,14 +1264,19 @@ ZEND_API int concat_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{
 			zend_error(E_ERROR, "String size overflow");
 		}

-		Z_STRVAL_P(result) = erealloc(Z_STRVAL_P(result), res_len+1);
+		Z_STRVAL_P(result) = safe_erealloc(Z_STRVAL_P(result), res_len, 1, 1);

 		memcpy(Z_STRVAL_P(result)+Z_STRLEN_P(result), Z_STRVAL_P(op2), Z_STRLEN_P(op2));
 		Z_STRVAL_P(result)[res_len]=0;
 		Z_STRLEN_P(result) = res_len;
 	} else {
 		int length = Z_STRLEN_P(op1) + Z_STRLEN_P(op2);
-		char *buf = (char *) emalloc(length + 1);
+		char *buf;
+
+		if (Z_STRLEN_P(op1) < 0 || Z_STRLEN_P(op2) < 0 || (int) (Z_STRLEN_P(op1) + Z_STRLEN_P(op2)) < 0) {
+			zend_error(E_ERROR, "String size overflow");
+		}
+		buf = (char *) safe_emalloc(length, 1, 1);

 		memcpy(buf, Z_STRVAL_P(op1), Z_STRLEN_P(op1));
 		memcpy(buf + Z_STRLEN_P(op1), Z_STRVAL_P(op2), Z_STRLEN_P(op2));
@@ -2067,7 +2072,7 @@ ZEND_API void zendi_smart_strcmp(zval *result, zval *s1, zval *s2) /* {{{ */
 			} else if (ret2!=IS_DOUBLE) {
 				if (oflow1) {
 					ZVAL_LONG(result, oflow1);
-					return; 
+					return;
 				}
 				dval2 = (double) lval2;
 			} else if (dval1 == dval2 && !zend_finite(dval1)) {
@@ -135,8 +135,9 @@ ZEND_API void _zval_copy_ctor_func(zval *zvalue ZEND_FILE_LINE_DC)
 				}
 				ALLOC_HASHTABLE_REL(tmp_ht);
 				zend_hash_init(tmp_ht, zend_hash_num_elements(original_ht), NULL, ZVAL_PTR_DTOR, 0);
-				zend_hash_copy(tmp_ht, original_ht, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
 				zvalue->value.ht = tmp_ht;
+				zend_hash_copy(tmp_ht, original_ht, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
+				tmp_ht->nNextFreeElement = original_ht->nNextFreeElement;
 			}
 			break;
 		case IS_OBJECT:
@@ -2800,7 +2800,7 @@ AC_DEFUN([PHP_DETECT_ICC],

 dnl PHP_DETECT_SUNCC
 dnl Detect if the systems default compiler is suncc.
-dnl We also set some usefull CFLAGS if the user didn't set any
+dnl We also set some useful CFLAGS if the user didn't set any
 AC_DEFUN([PHP_DETECT_SUNCC],[
  SUNCC="no"
  AC_MSG_CHECKING([for suncc])
@@ -119,8 +119,8 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=4
-PHP_RELEASE_VERSION=33
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=41
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -10,7 +10,7 @@
   | http://www.php.net/license/3_01.txt                                  |
   | If you did not receive a copy of the PHP license and are unable to   |
   | obtain it through the world-wide-web, please send a note to          |
-   | license@php.net so we can mail you 6 copy immediately.               |
+   | license@php.net so we can mail you a copy immediately.               |
   +----------------------------------------------------------------------+
   | Author: Sterling Hughes <sterling@php.net>                           |
   +----------------------------------------------------------------------+
@@ -170,6 +170,12 @@ static int php_curl_option_url(php_curl *ch, const char *url, const int len TSRM
 #if LIBCURL_VERSION_NUM < 0x071100
 	char *copystr = NULL;
 #endif
+
+	if (strlen(url) != len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Curl option contains invalid characters (\\0)");
+		return 0;
+	}
+
 	/* Disable file:// if open_basedir are used */
 	if (PG(open_basedir) && *PG(open_basedir)) {
 #if LIBCURL_VERSION_NUM >= 0x071304
@@ -1045,6 +1051,7 @@ static size_t curl_write(char *data, size_t size, size_t nmemb, void *ctx)
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not call the CURLOPT_WRITEFUNCTION");
 				length = -1;
 			} else if (retval_ptr) {
+				_php_curl_verify_handlers(ch, 1 TSRMLS_CC);
 				if (Z_TYPE_P(retval_ptr) != IS_LONG) {
 					convert_to_long_ex(&retval_ptr);
 				}
@@ -1118,6 +1125,7 @@ static size_t curl_progress(void *clientp, double dltotal, double dlnow, double
 			if (error == FAILURE) {
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot call the CURLOPT_PROGRESSFUNCTION");
 			} else if (retval_ptr) {
+				_php_curl_verify_handlers(ch, 1 TSRMLS_CC);
 				if (Z_TYPE_P(retval_ptr) != IS_LONG) {
 					convert_to_long_ex(&retval_ptr);
 				}
@@ -1194,6 +1202,7 @@ static size_t curl_read(char *data, size_t size, size_t nmemb, void *ctx)
 				length = CURL_READFUNC_ABORT;
 #endif
 			} else if (retval_ptr) {
+				_php_curl_verify_handlers(ch, 1 TSRMLS_CC);
 				if (Z_TYPE_P(retval_ptr) == IS_STRING) {
 					length = MIN((int) (size * nmemb), Z_STRLEN_P(retval_ptr));
 					memcpy(data, Z_STRVAL_P(retval_ptr), length);
@@ -1268,6 +1277,7 @@ static size_t curl_write_header(char *data, size_t size, size_t nmemb, void *ctx
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not call the CURLOPT_HEADERFUNCTION");
 				length = -1;
 			} else if (retval_ptr) {
+				_php_curl_verify_handlers(ch, 1 TSRMLS_CC);
 				if (Z_TYPE_P(retval_ptr) != IS_LONG) {
 					convert_to_long_ex(&retval_ptr);
 				}
@@ -0,0 +1,18 @@
+--TEST--
+Bug #68089 (NULL byte injection - cURL lib)
+--SKIPIF--
+<?php 
+include 'skipif.inc';
+
+?>
+--FILE--
+<?php
+$url = "file:///etc/passwd\0http://google.com";
+$ch = curl_init();
+var_dump(curl_setopt($ch, CURLOPT_URL, $url));
+?>
+Done
+--EXPECTF--
+Warning: curl_setopt(): Curl option contains invalid characters (\0) in %s/bug68089.php on line 4
+bool(false)
+Done
@@ -0,0 +1,41 @@
+--TEST--
+Bug #69316: Use-after-free in php_curl related to CURLOPT_FILE/_INFILE/_WRITEHEADER
+--SKIPIF--
+<?php 
+if (!extension_loaded("curl")) exit("skip curl extension not loaded");
+if (false === getenv('PHP_CURL_HTTP_REMOTE_SERVER'))  exit("skip PHP_CURL_HTTP_REMOTE_SERVER env variable is not defined");
+?>
+--FILE--
+<?php
+  function hdr_callback($ch, $data) {
+      // close the stream, causing the FILE structure to be free()'d
+      if($GLOBALS['f_file']) {
+          fclose($GLOBALS['f_file']); $GLOBALS['f_file'] = 0;
+
+          // cause an allocation of approx the same size as a FILE structure, size varies a bit depending on platform/libc
+          $FILE_size = (PHP_INT_SIZE == 4 ? 0x160 : 0x238);
+          curl_setopt($ch, CURLOPT_COOKIE, str_repeat("a", $FILE_size - 1));
+      }
+      return strlen($data);
+  }
+  $host = getenv('PHP_CURL_HTTP_REMOTE_SERVER');
+  
+  $temp_file = dirname(__FILE__) . '/body.tmp';
+  $url = "{$host}/get.php?test=getpost";
+  $ch = curl_init();
+  $f_file = fopen($temp_file, "w") or die("failed to open file\n");
+  curl_setopt($ch, CURLOPT_BUFFERSIZE, 10);
+  curl_setopt($ch, CURLOPT_HEADERFUNCTION, "hdr_callback");
+  curl_setopt($ch, CURLOPT_FILE, $f_file);
+  curl_setopt($ch, CURLOPT_URL, $url);
+  curl_exec($ch);
+  curl_close($ch);
+?>
+===DONE===
+--CLEAN--
+<?php
+unlink(dirname(__FILE__) . '/body.tmp');
+?>
+--EXPECTF--
+Warning: curl_exec(): CURLOPT_FILE resource has gone away, resetting to default in %s on line %d
+===DONE===
@@ -0,0 +1,7 @@
+<?php
+    if (!extension_loaded("curl")) exit("skip curl extension not loaded");
+    if(false === getenv('PHP_CURL_HTTP_REMOTE_SERVER')) {
+        if (php_sapi_name() != "cli") {
+                die("skip PHP_CURL_HTTP_REMOTE_SERVER env variable is not defined");
+        }
+    }
@@ -2575,12 +2575,9 @@ static int php_date_initialize_from_hash(php_date_obj **dateobj, HashTable *myht
 	timelib_tzinfo   *tzi;
 	php_timezone_obj *tzobj;

-	if (zend_hash_find(myht, "date", 5, (void**) &z_date) == SUCCESS) {
-		convert_to_string(*z_date);
-		if (zend_hash_find(myht, "timezone_type", 14, (void**) &z_timezone_type) == SUCCESS) {
-			convert_to_long(*z_timezone_type);
-			if (zend_hash_find(myht, "timezone", 9, (void**) &z_timezone) == SUCCESS) {
-				convert_to_string(*z_timezone);
+	if (zend_hash_find(myht, "date", 5, (void**) &z_date) == SUCCESS && Z_TYPE_PP(z_date) == IS_STRING) {
+		if (zend_hash_find(myht, "timezone_type", 14, (void**) &z_timezone_type) == SUCCESS && Z_TYPE_PP(z_timezone_type) == IS_LONG) {
+			if (zend_hash_find(myht, "timezone", 9, (void**) &z_timezone) == SUCCESS && Z_TYPE_PP(z_timezone) == IS_STRING) {

 				switch (Z_LVAL_PP(z_timezone_type)) {
 					case TIMELIB_ZONETYPE_OFFSET:
@@ -2595,7 +2592,6 @@ static int php_date_initialize_from_hash(php_date_obj **dateobj, HashTable *myht

 					case TIMELIB_ZONETYPE_ID: {
 						int ret;
-						convert_to_string(*z_timezone);

 						tzi = php_date_parse_tzfile(Z_STRVAL_PP(z_timezone), DATE_TIMEZONEDB TSRMLS_CC);

@@ -0,0 +1,9 @@
+--TEST--
+Bug #68942 (Use after free vulnerability in unserialize() with DateTime).
+--FILE--
+<?php
+$data = unserialize('a:2:{i:0;O:8:"DateTime":3:{s:4:"date";s:26:"2000-01-01 00:00:00.000000";s:13:"timezone_type";a:2:{i:0;i:1;i:1;i:2;}s:8:"timezone";s:1:"A";}i:1;R:5;}');
+var_dump($data);
+?>
+--EXPECTF--
+Fatal error: Invalid serialization data for DateTime object in %s/bug68942_2.php on line %d
@@ -187,10 +187,10 @@ ZEND_END_ARG_INFO();
 /* }}} */

 /*
-* class DOMDocument extends DOMNode 
+* class DOMDocument extends DOMNode
 *
 * URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-i-Document
-* Since: 
+* Since:
 */

 const zend_function_entry php_dom_document_class_functions[] = { /* {{{ */
@@ -235,10 +235,10 @@ const zend_function_entry php_dom_document_class_functions[] = { /* {{{ */
 };
 /* }}} */

-/* {{{ docType	DOMDocumentType	
-readonly=yes 
+/* {{{ docType	DOMDocumentType
+readonly=yes
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-B63ED1A31
-Since: 
+Since:
 */
 int dom_document_doctype_read(dom_object *obj, zval **retval TSRMLS_DC)
 {
@@ -266,15 +266,15 @@ int dom_document_doctype_read(dom_object *obj, zval **retval TSRMLS_DC)
 		return FAILURE;
 	}
 	return SUCCESS;
-	
+
 }

 /* }}} */

-/* {{{ implementation	DOMImplementation	
-readonly=yes 
+/* {{{ implementation	DOMImplementation
+readonly=yes
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-1B793EBA
-Since: 
+Since:
 */
 int dom_document_implementation_read(dom_object *obj, zval **retval TSRMLS_DC)
 {
@@ -285,10 +285,10 @@ int dom_document_implementation_read(dom_object *obj, zval **retval TSRMLS_DC)

 /* }}} */

-/* {{{ documentElement	DOMElement	
-readonly=yes 
+/* {{{ documentElement	DOMElement
+readonly=yes
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-87CD092
-Since: 
+Since:
 */
 int dom_document_document_element_read(dom_object *obj, zval **retval TSRMLS_DC)
 {
@@ -391,8 +391,8 @@ int dom_document_encoding_write(dom_object *obj, zval *newval TSRMLS_DC)

 /* }}} */

-/* {{{ standalone	boolean	
-readonly=no 
+/* {{{ standalone	boolean
+readonly=no
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-Document3-standalone
 Since: DOM Level 3
 */
@@ -455,7 +455,7 @@ int dom_document_standalone_write(dom_object *obj, zval *newval TSRMLS_DC)

 /* }}} */

-/* {{{ version	string	
+/* {{{ version	string
 readonly=no
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-Document3-version
 Since: DOM Level 3
@@ -520,8 +520,8 @@ int dom_document_version_write(dom_object *obj, zval *newval TSRMLS_DC)

 /* }}} */

-/* {{{ strictErrorChecking	boolean	
-readonly=no 
+/* {{{ strictErrorChecking	boolean
+readonly=no
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-Document3-strictErrorChecking
 Since: DOM Level 3
 */
@@ -565,7 +565,7 @@ int dom_document_strict_error_checking_write(dom_object *obj, zval *newval TSRML

 /* }}} */

-/* {{{ formatOutput	boolean	
+/* {{{ formatOutput	boolean
 readonly=no
 */
 int dom_document_format_output_read(dom_object *obj, zval **retval TSRMLS_DC)
@@ -607,7 +607,7 @@ int dom_document_format_output_write(dom_object *obj, zval *newval TSRMLS_DC)
 }
 /* }}} */

-/* {{{ validateOnParse	boolean	
+/* {{{ validateOnParse	boolean
 readonly=no
 */
 int	dom_document_validate_on_parse_read(dom_object *obj, zval **retval TSRMLS_DC)
@@ -649,7 +649,7 @@ int dom_document_validate_on_parse_write(dom_object *obj, zval *newval TSRMLS_DC
 }
 /* }}} */

-/* {{{ resolveExternals	boolean	
+/* {{{ resolveExternals	boolean
 readonly=no
 */
 int dom_document_resolve_externals_read(dom_object *obj, zval **retval TSRMLS_DC)
@@ -691,7 +691,7 @@ int dom_document_resolve_externals_write(dom_object *obj, zval *newval TSRMLS_DC
 }
 /* }}} */

-/* {{{ preserveWhiteSpace	boolean	
+/* {{{ preserveWhiteSpace	boolean
 readonly=no
 */
 int dom_document_preserve_whitespace_read(dom_object *obj, zval **retval TSRMLS_DC)
@@ -733,7 +733,7 @@ int dom_document_preserve_whitespace_write(dom_object *obj, zval *newval TSRMLS_
 }
 /* }}} */

-/* {{{ recover	boolean	
+/* {{{ recover	boolean
 readonly=no
 */
 int dom_document_recover_read(dom_object *obj, zval **retval TSRMLS_DC)
@@ -775,7 +775,7 @@ int dom_document_recover_write(dom_object *obj, zval *newval TSRMLS_DC)
 }
 /* }}} */

-/* {{{ substituteEntities	boolean	
+/* {{{ substituteEntities	boolean
 readonly=no
 */
 int dom_document_substitue_entities_read(dom_object *obj, zval **retval TSRMLS_DC)
@@ -817,8 +817,8 @@ int dom_document_substitue_entities_write(dom_object *obj, zval *newval TSRMLS_D
 }
 /* }}} */

-/* {{{ documentURI	string	
-readonly=no 
+/* {{{ documentURI	string
+readonly=no
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-Document3-documentURI
 Since: DOM Level 3
 */
@@ -881,8 +881,8 @@ int dom_document_document_uri_write(dom_object *obj, zval *newval TSRMLS_DC)

 /* }}} */

-/* {{{ config	DOMConfiguration	
-readonly=yes 
+/* {{{ config	DOMConfiguration
+readonly=yes
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-Document3-config
 Since: DOM Level 3
 */
@@ -897,7 +897,7 @@ int dom_document_config_read(dom_object *obj, zval **retval TSRMLS_DC)

 /* {{{ proto DOMElement dom_document_create_element(string tagName [, string value]);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-2141741547
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_element)
 {
@@ -930,7 +930,7 @@ PHP_FUNCTION(dom_document_create_element)

 /* {{{ proto DOMDocumentFragment dom_document_create_document_fragment();
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-35CB04B5
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_document_fragment)
 {
@@ -957,7 +957,7 @@ PHP_FUNCTION(dom_document_create_document_fragment)

 /* {{{ proto DOMText dom_document_create_text_node(string data);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-1975348127
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_text_node)
 {
@@ -985,7 +985,7 @@ PHP_FUNCTION(dom_document_create_text_node)

 /* {{{ proto DOMComment dom_document_create_comment(string data);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-1334481328
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_comment)
 {
@@ -1013,7 +1013,7 @@ PHP_FUNCTION(dom_document_create_comment)

 /* {{{ proto DOMCdataSection dom_document_create_cdatasection(string data);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-D26C0AF8
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_cdatasection)
 {
@@ -1041,7 +1041,7 @@ PHP_FUNCTION(dom_document_create_cdatasection)

 /* {{{ proto DOMProcessingInstruction dom_document_create_processing_instruction(string target, string data);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-135944439
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_processing_instruction)
 {
@@ -1076,7 +1076,7 @@ PHP_FUNCTION(dom_document_create_processing_instruction)

 /* {{{ proto DOMAttr dom_document_create_attribute(string name);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-1084891198
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_attribute)
 {
@@ -1110,7 +1110,7 @@ PHP_FUNCTION(dom_document_create_attribute)

 /* {{{ proto DOMEntityReference dom_document_create_entity_reference(string name);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-392B75AE
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_entity_reference)
 {
@@ -1143,7 +1143,7 @@ PHP_FUNCTION(dom_document_create_entity_reference)

 /* {{{ proto DOMNodeList dom_document_get_elements_by_tag_name(string tagname);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-A6C9094
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_get_elements_by_tag_name)
 {
@@ -1177,7 +1177,7 @@ PHP_FUNCTION(dom_document_import_node)
 	xmlDocPtr docp;
 	xmlNodePtr nodep, retnodep;
 	dom_object *intern, *nodeobj;
-	int ret; 
+	int ret;
 	long recursive = 0;

 	if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "OO|l", &id, dom_document_class_entry, &node, dom_node_class_entry, &recursive) == FAILURE) {
@@ -1188,7 +1188,7 @@ PHP_FUNCTION(dom_document_import_node)

 	DOM_GET_OBJ(nodep, node, xmlNodePtr, nodeobj);

-	if (nodep->type == XML_HTML_DOCUMENT_NODE || nodep->type == XML_DOCUMENT_NODE 
+	if (nodep->type == XML_HTML_DOCUMENT_NODE || nodep->type == XML_DOCUMENT_NODE
 		|| nodep->type == XML_DOCUMENT_TYPE_NODE) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot import: Node Type Not Supported");
 		RETURN_FALSE;
@@ -1278,7 +1278,7 @@ PHP_FUNCTION(dom_document_create_element_ns)
 		RETURN_FALSE;
 	}

-	
+
 	nodep->ns = nsptr;

 	DOM_RET_OBJ(nodep, &ret, intern);
@@ -1580,11 +1580,15 @@ static xmlDocPtr dom_document_parser(zval *id, int mode, char *source, int sourc
 	xmlInitParser();

 	if (mode == DOM_LOAD_FILE) {
-		char *file_dest = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN  TSRMLS_CC);
+		char *file_dest;
+		if (CHECK_NULL_PATH(source, source_len)) {
+			return NULL;
+		}
+		file_dest = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN  TSRMLS_CC);
 		if (file_dest) {
 			ctxt = xmlCreateFileParserCtxt(file_dest);
 		}
-		
+
 	} else {
 		ctxt = xmlCreateMemoryParserCtxt(source, source_len);
 	}
@@ -1906,7 +1910,7 @@ PHP_FUNCTION(dom_document_xinclude)
 	zval *id;
 	xmlDoc *docp;
 	xmlNodePtr root;
-	long flags = 0; 
+	long flags = 0;
 	int err;
 	dom_object *intern;

@@ -1919,7 +1923,7 @@ PHP_FUNCTION(dom_document_xinclude)
 	err = xmlXIncludeProcessFlags(docp, flags);

 	/* XML_XINCLUDE_START and XML_XINCLUDE_END nodes need to be removed as these
-	are added via xmlXIncludeProcess to mark beginning and ending of xincluded document 
+	are added via xmlXIncludeProcess to mark beginning and ending of xincluded document
 	but are not wanted in resulting document - must be done even if err as it could fail after
 	having processed some xincludes */
 	root = (xmlNodePtr) docp->children;
@@ -1935,7 +1939,7 @@ PHP_FUNCTION(dom_document_xinclude)
 	} else {
 		RETVAL_FALSE;
 	}
-    
+
 }
 /* }}} */

@@ -1956,19 +1960,19 @@ PHP_FUNCTION(dom_document_validate)
 	DOM_GET_OBJ(docp, id, xmlDocPtr, intern);

 	cvp = xmlNewValidCtxt();
-	
+
 	cvp->userData = NULL;
 	cvp->error    = (xmlValidityErrorFunc) php_libxml_error_handler;
 	cvp->warning  = (xmlValidityErrorFunc) php_libxml_error_handler;
-	
+
 	if (xmlValidateDocument(cvp, docp)) {
 		RETVAL_TRUE;
 	} else {
 		RETVAL_FALSE;
 	}
-	
+
 	xmlFreeValidCtxt(cvp);
-	
+
 }
 /* }}} */

@@ -2008,7 +2012,7 @@ static void _dom_document_schema_validate(INTERNAL_FUNCTION_PARAMETERS, int type
 		break;
 	case DOM_LOAD_STRING:
 		parser = xmlSchemaNewMemParserCtxt(source, source_len);
-		/* If loading from memory, we need to set the base directory for the document 
+		/* If loading from memory, we need to set the base directory for the document
 		   but it is not apparent how to do that for schema's */
 		break;
 	default:
@@ -2097,7 +2101,7 @@ static void _dom_document_relaxNG_validate(INTERNAL_FUNCTION_PARAMETERS, int typ
 		break;
 	case DOM_LOAD_STRING:
 		parser = xmlRelaxNGNewMemParserCtxt(source, source_len);
-		/* If loading from memory, we need to set the base directory for the document 
+		/* If loading from memory, we need to set the base directory for the document
 		   but it is not apparent how to do that for schema's */
 		break;
 	default:
@@ -2165,10 +2169,10 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */
 	int source_len, refcount, ret;
 	long options = 0;
 	htmlParserCtxtPtr ctxt;
-	
+
 	id = getThis();

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|l", &source, &source_len, &options) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|l", &source, &source_len, &options) == FAILURE) {
 		return;
 	}

@@ -2201,7 +2205,7 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */
 	htmlParseDocument(ctxt);
 	newdoc = ctxt->myDoc;
 	htmlFreeParserCtxt(ctxt);
-	
+
 	if (!newdoc)
 		RETURN_FALSE;

@@ -2323,13 +2327,13 @@ PHP_FUNCTION(dom_document_save_html)
 			php_dom_throw_error(WRONG_DOCUMENT_ERR, dom_get_strict_error(intern->document) TSRMLS_CC);
 			RETURN_FALSE;
 		}
-		
+
 		buf = xmlBufferCreate();
 		if (!buf) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not fetch buffer");
 			RETURN_FALSE;
 		}
-		
+
 		if (node->type == XML_DOCUMENT_FRAG_NODE) {
 			int one_size;

@@ -518,7 +518,7 @@ static HashTable* dom_get_debug_info_helper(zval *object, int *is_temp TSRMLS_DC
 			value = null_value;
 		} else if (Z_TYPE_P(value) == IS_OBJECT) {
 			/* these are zvalues create on demand, with refcount and is_ref
-			 * status left in an uninitalized stated */
+			 * status left in an uninitialized stated */
 			zval_dtor(value);
 			efree(value);

@@ -13,6 +13,11 @@ assert.bail=true
 $doc = new DOMDocument();
 $result = $doc->loadHTMLFile("");
 assert('$result === false');
+$doc = new DOMDocument();
+$result = $doc->loadHTMLFile("text.html\0something");
+assert('$result === null');
 ?>
 --EXPECTF--
 %r(PHP ){0,1}%rWarning: DOMDocument::loadHTMLFile(): Empty string supplied as input %s
+
+%r(PHP ){0,1}%rWarning: DOMDocument::loadHTMLFile() expects parameter 1 to be a valid path, string given %s
@@ -550,13 +550,12 @@ PHP_FUNCTION(enchant_broker_request_dict)

 	d = enchant_broker_request_dict(pbroker->pbroker, (const char *)tag);
 	if (d) {
+		pos = pbroker->dictcnt++;
 		if (pbroker->dictcnt) {
 			pbroker->dict = (enchant_dict **)erealloc(pbroker->dict, sizeof(enchant_dict *) * pbroker->dictcnt);
-			pos = pbroker->dictcnt++;
 		} else {
 			pbroker->dict = (enchant_dict **)emalloc(sizeof(enchant_dict *));
 			pos = 0;
-			pbroker->dictcnt++;
 		}

 		dict = pbroker->dict[pos] = (enchant_dict *)emalloc(sizeof(enchant_dict));
@@ -607,14 +606,14 @@ PHP_FUNCTION(enchant_broker_request_pwl_dict)

 	d = enchant_broker_request_pwl_dict(pbroker->pbroker, (const char *)pwl);
 	if (d) {
+		pos = pbroker->dictcnt++;
 		if (pbroker->dictcnt) {
-			pos = pbroker->dictcnt++;
 			pbroker->dict = (enchant_dict **)erealloc(pbroker->dict, sizeof(enchant_dict *) * pbroker->dictcnt);
 		} else {
 			pbroker->dict = (enchant_dict **)emalloc(sizeof(enchant_dict *));
 			pos = 0;
-			pbroker->dictcnt++;
 		}
+
 		dict = pbroker->dict[pos] = (enchant_dict *)emalloc(sizeof(enchant_dict));
 		dict->id = pos;
 		dict->pbroker = pbroker;
@@ -117,7 +117,15 @@ int cflags;
 							(NC-1)*sizeof(cat_t));
 	if (g == NULL)
 		return(REG_ESPACE);
-	p->ssize = len/(size_t)2*(size_t)3 + (size_t)1;	/* ugh */
+	{
+		/* Patched for CERT Vulnerability Note VU#695940, Feb 2015. */
+		size_t new_ssize = len/(size_t)2*(size_t)3 + (size_t)1; /* ugh */
+		if (new_ssize < len || new_ssize > LONG_MAX / sizeof(sop)) {
+			free((char *) g);
+			return REG_INVARG;
+		}
+		p->ssize = new_ssize;
+	}
 	p->strip = (sop *)malloc(p->ssize * sizeof(sop));
 	p->slen = 0;
 	if (p->strip == NULL) {
@@ -1276,6 +1284,10 @@ int c;
 	register int ncols = (g->ncsets+(CHAR_BIT-1)) / CHAR_BIT;
 	register unsigned uc = (unsigned char)c;

+	if (!g->setbits) {
+		return(0);
+	}
+
 	for (i = 0, col = g->setbits; i < ncols; i++, col += g->csetsize)
 		if (col[uc] != 0)
 			return(1);
@@ -9,7 +9,7 @@ Test eregi() function : basic functionality - confirm case insensitivity
 */

 /*
- * Test basic funtionality of eregi()
+ * Test basic functionality of eregi()
 */

 echo "*** Testing eregi() : basic functionality ***\n";
@@ -2426,11 +2426,11 @@ static void* exif_ifd_make_value(image_info_data *info_data, int motorola_intel
 					data_ptr += 8;
 					break;
 				case TAG_FMT_SINGLE:
-					memmove(data_ptr, &info_data->value.f, byte_count);
+					memmove(data_ptr, &info_value->f, 4);
 					data_ptr += 4;
 					break;
 				case TAG_FMT_DOUBLE:
-					memmove(data_ptr, &info_data->value.d, byte_count);
+					memmove(data_ptr, &info_value->d, 8);
 					data_ptr += 8;
 					break;
 			}
@@ -2702,7 +2702,7 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
 static int exif_process_unicode(image_info_type *ImageInfo, xp_field_type *xp_field, int tag, char *szValuePtr, int ByteCount TSRMLS_DC)
 {
 	xp_field->tag = tag;	
-	
+	xp_field->value = NULL;
 	/* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX   */
 	if (zend_multibyte_encoding_converter(
 			(unsigned char**)&xp_field->value, 
@@ -0,0 +1,17 @@
+--TEST--
+Bug #68113 (Heap corruption in exif_thumbnail())
+--SKIPIF--
+<?php
+extension_loaded("exif") or die("skip need exif");
+?>
+--FILE--
+<?php
+var_dump(exif_thumbnail(__DIR__."/bug68113.jpg"));
+?>
+Done
+--EXPECTF--
+Warning: exif_thumbnail(bug68113.jpg): File structure corrupted in %s/bug68113.php on line 2
+
+Warning: exif_thumbnail(bug68113.jpg): Invalid JPEG file in %s/bug68113.php on line 2
+bool(false)
+Done
@@ -0,0 +1,63 @@
+--TEST--
+Bug #68799 (Free called on unitialized pointer)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+/*
+* Pollute the heap. Helps trigger bug. Sometimes not needed.
+*/
+class A {
+    function __construct() {
+        $a = 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAa';
+        $this->a = $a . $a . $a . $a . $a . $a;
+    }
+};
+
+function doStuff ($limit) {
+
+    $a = new A;
+
+    $b = array();
+    for ($i = 0; $i < $limit; $i++) {
+        $b[$i] = clone $a;
+    }
+
+    unset($a);
+
+    gc_collect_cycles();
+}
+
+$iterations = 3;
+
+doStuff($iterations);
+doStuff($iterations);
+
+gc_collect_cycles();
+
+print_r(exif_read_data(__DIR__.'/bug68799.jpg'));
+
+?>
+--EXPECTF--
+Array
+(
+    [FileName] => bug68799.jpg
+    [FileDateTime] => %d
+    [FileSize] => 735
+    [FileType] => 2
+    [MimeType] => image/jpeg
+    [SectionsFound] => ANY_TAG, IFD0, WINXP
+    [COMPUTED] => Array
+        (
+            [html] => width="1" height="1"
+            [Height] => 1
+            [Width] => 1
+            [IsColor] => 1
+            [ByteOrderMotorola] => 1
+        )
+
+    [XResolution] => 96/1
+    [YResolution] => 96/1
+    [ResolutionUnit] => 2
+    [Author] => 
+)
@@ -11,7 +11,7 @@ if test "$PHP_FILEINFO" != "no"; then
    libmagic/cdf.c libmagic/cdf_time.c libmagic/compress.c \
    libmagic/encoding.c libmagic/fsmagic.c libmagic/funcs.c \
    libmagic/is_tar.c libmagic/magic.c libmagic/print.c \
-    libmagic/readcdf.c libmagic/readelf.c libmagic/softmagic.c"
+    libmagic/readcdf.c libmagic/softmagic.c"

  PHP_NEW_EXTENSION(fileinfo, fileinfo.c $libmagic_sources, $ext_shared,,-I@ext_srcdir@/libmagic)
  PHP_ADD_BUILD_DIR($ext_builddir/libmagic)
@@ -8,7 +8,7 @@ if (PHP_FILEINFO != 'no') {
 			cdf.c cdf_time.c compress.c \
 			encoding.c fsmagic.c funcs.c \
 			is_tar.c magic.c print.c \
-			readcdf.c readelf.c softmagic.c";
+			readcdf.c softmagic.c";

 	if (VCVERS < 1500) {
 		ADD_FLAG('CFLAGS', '/Zm1000');
@@ -506,6 +506,11 @@ static void _php_finfo_get_type(INTERNAL_FUNCTION_PARAMETERS, int mode, int mime
 				RETVAL_FALSE;
 				goto clean;
 			}
+			if (CHECK_NULL_PATH(buffer, buffer_len)) {
+				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+				RETVAL_FALSE;
+				goto clean;
+			}

 			wrap = php_stream_locate_url_wrapper(buffer, &tmp2, 0 TSRMLS_CC);

@@ -1,6 +1,6 @@
 diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 --- libmagic.orig/apprentice.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/apprentice.c	Mon Apr 14 23:42:51 2014
+++ libmagic/apprentice.c	Sun Jan  4 17:02:29 2015
@@ -29,6 +29,8 @@
  * apprentice - make one pass through /etc/magic, learning its secrets.
  */
@@ -479,6 +479,15 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 		return NULL;
 	}
 	return map;
+@@ -1233,7 +1269,7 @@
+ 		 * the sign extension must have happened.
+ 		 */
+ 		case FILE_BYTE:
+-			v = (char) v;
+			v = (signed char) v;
+ 			break;
+ 		case FILE_SHORT:
+ 		case FILE_BESHORT:
@@ -1500,7 +1536,7 @@
 		if (me->cont_count == me->max_count) {
 			struct magic *nm;
@@ -833,7 +842,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 	}
 diff -u libmagic.orig/ascmagic.c libmagic/ascmagic.c
 --- libmagic.orig/ascmagic.c	Wed Oct 31 18:03:01 2012
-+++ libmagic/ascmagic.c	Mon Apr 14 23:42:51 2014
+++ libmagic/ascmagic.c	Sun Jan  4 17:02:29 2015
@@ -139,7 +139,7 @@
 		/* malloc size is a conservative overestimate; could be
 		   improved, or at least realloced after conversion. */
@@ -872,7 +881,7 @@ diff -u libmagic.orig/ascmagic.c libmagic/ascmagic.c
 }
 diff -u libmagic.orig/cdf.c libmagic/cdf.c
 --- libmagic.orig/cdf.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/cdf.c	Tue Jul  1 09:00:09 2014
+++ libmagic/cdf.c	Sun Jan  4 17:02:29 2015
@@ -43,7 +43,17 @@
 #include <err.h>
 #endif
@@ -955,7 +964,7 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
 			errno = EFTYPE;
 			return (size_t)-1;
 		}
-@@ -796,7 +812,11 @@
+@@ -796,11 +812,15 @@
 	if (cdf_check_stream_offset(sst, h, e, 0, __LINE__) == -1)
 		goto out;
 	for (i = 0; i < sh.sh_properties; i++) {
@@ -968,6 +977,11 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
 		q = (const uint8_t *)(const void *)
 		    ((const char *)(const void *)p + ofs
 		    - 2 * sizeof(uint32_t));
+-		if (q > e) {
+		if (q < p || q > e) {
+ 			DPRINTF(("Ran of the end %p > %p\n", q, e));
+ 			goto out;
+ 		}
@@ -810,6 +830,10 @@
 		    i, inp[i].pi_id, inp[i].pi_type, q - p, offs));
 		if (inp[i].pi_type & CDF_VECTOR) {
@@ -1056,7 +1070,7 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
 			} else {
 diff -u libmagic.orig/cdf.h libmagic/cdf.h
 --- libmagic.orig/cdf.h	Wed Oct 31 18:03:01 2012
-+++ libmagic/cdf.h	Mon Apr 14 23:32:55 2014
+++ libmagic/cdf.h	Sun Jan  4 17:02:29 2015
@@ -35,10 +35,12 @@
 #ifndef _H_CDF_
 #define _H_CDF_
@@ -1099,7 +1113,7 @@ diff -u libmagic.orig/cdf.h libmagic/cdf.h
 void cdf_unpack_header(cdf_header_t *, char *);
 diff -u libmagic.orig/cdf_time.c libmagic/cdf_time.c
 --- libmagic.orig/cdf_time.c	Wed Oct 31 18:03:01 2012
-+++ libmagic/cdf_time.c	Mon Apr 14 23:32:55 2014
+++ libmagic/cdf_time.c	Sun Nov  9 19:16:18 2014
@@ -96,7 +96,7 @@
 }
 
@@ -1159,7 +1173,7 @@ diff -u libmagic.orig/cdf_time.c libmagic/cdf_time.c
 	static const char *ref = "Sat Apr 23 01:30:00 1977";
 diff -u libmagic.orig/compress.c libmagic/compress.c
 --- libmagic.orig/compress.c	Sun Jan  6 21:35:43 2013
-+++ libmagic/compress.c	Mon Apr 14 23:42:51 2014
+++ libmagic/compress.c	Sun Jan  4 17:02:29 2015
@@ -32,6 +32,7 @@
  *	uncompress(method, old, n, newch) - uncompress old into new, 
  *					    using method, return sizeof new
@@ -1322,7 +1336,7 @@ diff -u libmagic.orig/compress.c libmagic/compress.c
 +#endif /* if PHP_FILEINFO_UNCOMPRESS */
 diff -u libmagic.orig/file.h libmagic/file.h
 --- libmagic.orig/file.h	Mon Feb 18 16:40:59 2013
-+++ libmagic/file.h	Mon Apr 14 23:42:51 2014
+++ libmagic/file.h	Sun Jan  4 17:02:29 2015
@@ -33,11 +33,9 @@
 #ifndef __file_h__
 #define __file_h__
@@ -1409,7 +1423,7 @@ diff -u libmagic.orig/file.h libmagic/file.h
 	void *map;			/* internal resources used by entry */
 	struct mlist *next, *prev;
 };
-@@ -411,21 +413,18 @@
+@@ -411,21 +413,16 @@
 protected const char *file_fmttime(uint64_t, int, char *);
 protected struct magic_set *file_ms_alloc(int);
 protected void file_ms_free(struct magic_set *);
@@ -1426,8 +1440,8 @@ diff -u libmagic.orig/file.h libmagic/file.h
 -    __attribute__((__format__(__printf__, 2, 3)));
 +protected int file_printf(struct magic_set *, const char *, ...);
 protected int file_reset(struct magic_set *);
- protected int file_tryelf(struct magic_set *, int, const unsigned char *,
-     size_t);
+-protected int file_tryelf(struct magic_set *, int, const unsigned char *,
+-    size_t);
 protected int file_trycdf(struct magic_set *, int, const unsigned char *,
     size_t);
 -#if HAVE_FORK
@@ -1435,7 +1449,7 @@ diff -u libmagic.orig/file.h libmagic/file.h
 protected int file_zmagic(struct magic_set *, int, const char *,
     const unsigned char *, size_t);
 #endif
-@@ -438,21 +437,18 @@
+@@ -438,21 +435,18 @@
     unichar **, size_t *, const char **, const char **, const char **);
 protected int file_is_tar(struct magic_set *, const unsigned char *, size_t);
 protected int file_softmagic(struct magic_set *, const unsigned char *, size_t,
@@ -1462,7 +1476,7 @@ diff -u libmagic.orig/file.h libmagic/file.h
 protected void file_showstr(FILE *, const char *, size_t);
 protected size_t file_mbswidth(const char *);
 protected const char *file_getbuffer(struct magic_set *);
-@@ -462,16 +458,14 @@
+@@ -462,16 +456,14 @@
     size_t *);
 protected size_t file_pstring_length_size(const struct magic *);
 protected size_t file_pstring_get_length(const struct magic *, const char *);
@@ -1480,7 +1494,7 @@ diff -u libmagic.orig/file.h libmagic/file.h
 
 #ifndef HAVE_STRERROR
 extern int sys_nerr;
-@@ -484,32 +478,16 @@
+@@ -484,32 +476,16 @@
 #define strtoul(a, b, c)	strtol(a, b, c)
 #endif
 
@@ -1515,7 +1529,7 @@ diff -u libmagic.orig/file.h libmagic/file.h
 
 #if defined(HAVE_MMAP) && defined(HAVE_SYS_MMAN_H) && !defined(QUICK)
 #define QUICK
-@@ -531,6 +509,14 @@
+@@ -531,6 +507,14 @@
 #endif
 #else
 #define FILE_RCSID(id)
@@ -1532,7 +1546,7 @@ diff -u libmagic.orig/file.h libmagic/file.h
 #endif /* __file_h__ */
 diff -u libmagic.orig/fsmagic.c libmagic/fsmagic.c
 --- libmagic.orig/fsmagic.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/fsmagic.c	Mon Apr 14 23:42:51 2014
+++ libmagic/fsmagic.c	Sun Jan  4 17:02:29 2015
@@ -59,27 +59,21 @@
 # define minor(dev)  ((dev) & 0xff)
 #endif
@@ -1899,7 +1913,7 @@ diff -u libmagic.orig/fsmagic.c libmagic/fsmagic.c
 }
 diff -u libmagic.orig/funcs.c libmagic/funcs.c
 --- libmagic.orig/funcs.c	Wed Oct 31 18:03:01 2012
-+++ libmagic/funcs.c	Mon Apr 14 23:42:51 2014
+++ libmagic/funcs.c	Sun Jan  4 17:02:29 2015
@@ -41,52 +41,42 @@
 #if defined(HAVE_WCTYPE_H)
 #include <wctype.h>
@@ -2193,7 +2207,7 @@ diff -u libmagic.orig/funcs.c libmagic/funcs.c
 +
 diff -u libmagic.orig/magic.c libmagic/magic.c
 --- libmagic.orig/magic.c	Fri Jan 11 17:43:09 2013
-+++ libmagic/magic.c	Mon Apr 14 23:42:51 2014
+++ libmagic/magic.c	Sun Jan  4 17:02:29 2015
@@ -25,11 +25,6 @@
  * SUCH DAMAGE.
  */
@@ -2537,7 +2551,7 @@ diff -u libmagic.orig/magic.c libmagic/magic.c
 magic_error(struct magic_set *ms)
 diff -u libmagic.orig/magic.h libmagic/magic.h
 --- libmagic.orig/magic.h	Thu Mar 21 18:52:42 2013
-+++ libmagic/magic.h	Mon Apr 14 23:42:51 2014
+++ libmagic/magic.h	Sun Jan  4 17:02:29 2015
@@ -87,6 +87,7 @@
 
 const char *magic_getpath(const char *, int);
@@ -2556,7 +2570,7 @@ diff -u libmagic.orig/magic.h libmagic/magic.h
 
 diff -u libmagic.orig/print.c libmagic/print.c
 --- libmagic.orig/print.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/print.c	Mon Apr 14 23:42:51 2014
+++ libmagic/print.c	Sun Jan  4 17:02:29 2015
@@ -29,12 +29,17 @@
  * print.c - debugging printout routines
  */
@@ -2787,7 +2801,7 @@ diff -u libmagic.orig/print.c libmagic/print.c
 	}
 diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
 --- libmagic.orig/readcdf.c	Wed Oct 31 18:03:01 2012
-+++ libmagic/readcdf.c	Tue May 27 22:17:37 2014
+++ libmagic/readcdf.c	Sun Jan  4 17:02:29 2015
@@ -30,7 +30,11 @@
 #endif
 
@@ -2861,282 +2875,9 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
 		    } else {
 			if (file_printf(ms, "application/CDFV2-corrupt") == -1)
 			    return -1;
-diff -u libmagic.orig/readelf.c libmagic/readelf.c
--- libmagic.orig/readelf.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/readelf.c	Mon Apr 14 23:42:51 2014
-@@ -48,8 +48,8 @@
- private int dophn_exec(struct magic_set *, int, int, int, off_t, int, size_t,
-     off_t, int *, int);
- private int doshn(struct magic_set *, int, int, int, off_t, int, size_t,
-    off_t, int *, int, int);
-private size_t donote(struct magic_set *, void *, size_t, size_t, int,
-+    off_t, int *, int);
-+private size_t donote(struct magic_set *, unsigned char *, size_t, size_t, int,
-     int, size_t, int *);
- 
- #define	ELF_ALIGN(a)	((((a) + align - 1) / align) * align)
-@@ -127,11 +127,17 @@
- 
- #define elf_getu16(swap, value) getu16(swap, value)
- #define elf_getu32(swap, value) getu32(swap, value)
-#define elf_getu64(swap, value) getu64(swap, value)
-+#ifdef USE_ARRAY_FOR_64BIT_TYPES
-+# define elf_getu64(swap, array) \
-+	((swap ? ((uint64_t)elf_getu32(swap, array[0])) << 32 : elf_getu32(swap, array[0])) + \
-+	 (swap ? elf_getu32(swap, array[1]) : ((uint64_t)elf_getu32(swap, array[1]) << 32)))
-+#else
-+# define elf_getu64(swap, value) getu64(swap, value)
-+#endif
- 
- #define xsh_addr	(clazz == ELFCLASS32			\
-			 ? (void *)&sh32			\
-			 : (void *)&sh64)
-+			 ? (void *) &sh32			\
-+			 : (void *) &sh64)
- #define xsh_sizeof	(clazz == ELFCLASS32			\
- 			 ? sizeof(sh32)				\
- 			 : sizeof(sh64))
-@@ -168,8 +174,8 @@
- 			 ? elf_getu32(swap, ph32.p_filesz)	\
- 			 : elf_getu64(swap, ph64.p_filesz)))
- #define xnh_addr	(clazz == ELFCLASS32			\
-			 ? (void *)&nh32			\
-			 : (void *)&nh64)
-+			 ? (void *) &nh32			\
-+			 : (void *) &nh64)
- #define xph_memsz	(size_t)((clazz == ELFCLASS32		\
- 			 ? elf_getu32(swap, ph32.p_memsz)	\
- 			 : elf_getu64(swap, ph64.p_memsz)))
-@@ -189,8 +195,8 @@
- 			 ? prpsoffsets32[i]			\
- 			 : prpsoffsets64[i])
- #define xcap_addr	(clazz == ELFCLASS32			\
-			 ? (void *)&cap32			\
-			 : (void *)&cap64)
-+			 ? (void *) &cap32			\
-+			 : (void *) &cap64)
- #define xcap_sizeof	(clazz == ELFCLASS32			\
- 			 ? sizeof cap32				\
- 			 : sizeof cap64)
-@@ -292,7 +298,7 @@
- {
- 	Elf32_Phdr ph32;
- 	Elf64_Phdr ph64;
-	size_t offset, len;
-+	size_t offset;
- 	unsigned char nbuf[BUFSIZ];
- 	ssize_t bufsize;
- 
-@@ -306,7 +312,11 @@
- 	 * Loop through all the program headers.
- 	 */
- 	for ( ; num; num--) {
-		if (pread(fd, xph_addr, xph_sizeof, off) == -1) {
-+		if (FINFO_LSEEK_FUNC(fd, off, SEEK_SET) == (off_t)-1) {
-+			file_badseek(ms);
-+			return -1;
-+		}
-+		if (FINFO_READ_FUNC(fd, xph_addr, xph_sizeof) == -1) {
- 			file_badread(ms);
- 			return -1;
- 		}
-@@ -324,8 +334,13 @@
- 		 * This is a PT_NOTE section; loop through all the notes
- 		 * in the section.
- 		 */
-		len = xph_filesz < sizeof(nbuf) ? xph_filesz : sizeof(nbuf);
-		if ((bufsize = pread(fd, nbuf, len, xph_offset)) == -1) {
-+		if (FINFO_LSEEK_FUNC(fd, xph_offset, SEEK_SET) == (off_t)-1) {
-+			file_badseek(ms);
-+			return -1;
-+		}
-+		bufsize = FINFO_READ_FUNC(fd, nbuf,
-+		    ((xph_filesz < sizeof(nbuf)) ? xph_filesz : sizeof(nbuf)));
-+		if (bufsize == -1) {
- 			file_badread(ms);
- 			return -1;
- 		}
-@@ -852,24 +867,12 @@
- 		return 0;
- 	}
- 
-	/* Read offset of name section to be able to read section names later */
-	if (pread(fd, xsh_addr, xsh_sizeof, off + size * strtab) == -1) {
-		file_badread(ms);
-		return -1;
-	}
-	name_off = xsh_offset;
-
- 	for ( ; num; num--) {
-		/* Read the name of this section. */
-		if (pread(fd, name, sizeof(name), name_off + xsh_name) == -1) {
-			file_badread(ms);
-+		if (FINFO_LSEEK_FUNC(fd, off, SEEK_SET) == (off_t)-1) {
-+			file_badseek(ms);
- 			return -1;
- 		}
-		name[sizeof(name) - 1] = '\0';
-		if (strcmp(name, ".debug_info") == 0)
-			stripped = 0;
-
-		if (pread(fd, xsh_addr, xsh_sizeof, off) == -1) {
-+		if (FINFO_READ_FUNC(fd, xsh_addr, xsh_sizeof) == -1) {
- 			file_badread(ms);
- 			return -1;
- 		}
-@@ -894,14 +897,17 @@
- 		/* Things we can determine when we seek */
- 		switch (xsh_type) {
- 		case SHT_NOTE:
-			if ((nbuf = malloc(xsh_size)) == NULL) {
-				file_error(ms, errno, "Cannot allocate memory"
-				    " for note");
-+			nbuf = emalloc((size_t)xsh_size);
-+			if ((noff = FINFO_LSEEK_FUNC(fd, (off_t)xsh_offset, SEEK_SET)) ==
-+			    (off_t)-1) {
-+				file_badread(ms);
-+				efree(nbuf);
- 				return -1;
- 			}
-			if (pread(fd, nbuf, xsh_size, xsh_offset) == -1) {
-+			if (FINFO_READ_FUNC(fd, nbuf, (size_t)xsh_size) !=
-+			    (ssize_t)xsh_size) {
-+				efree(nbuf);
- 				file_badread(ms);
-				free(nbuf);
- 				return -1;
- 			}
- 
-@@ -910,25 +916,16 @@
- 				if (noff >= (off_t)xsh_size)
- 					break;
- 				noff = donote(ms, nbuf, (size_t)noff,
-				    xsh_size, clazz, swap, 4, flags);
-+				    (size_t)xsh_size, clazz, swap, 4,
-+				    flags);
- 				if (noff == 0)
- 					break;
- 			}
-			free(nbuf);
-+			efree(nbuf);
- 			break;
- 		case SHT_SUNW_cap:
-			switch (mach) {
-			case EM_SPARC:
-			case EM_SPARCV9:
-			case EM_IA_64:
-			case EM_386:
-			case EM_AMD64:
-				break;
-			default:
-				goto skip;
-			}
-
-			if (lseek(fd, xsh_offset, SEEK_SET) == (off_t)-1) {
-+			if (FINFO_LSEEK_FUNC(fd, (off_t)xsh_offset, SEEK_SET) ==
-+			    (off_t)-1) {
- 				file_badseek(ms);
- 				return -1;
- 			}
-@@ -940,7 +937,7 @@
- 				    MAX(sizeof cap32, sizeof cap64)];
- 				if ((coff += xcap_sizeof) > (off_t)xsh_size)
- 					break;
-				if (read(fd, cbuf, (size_t)xcap_sizeof) !=
-+				if (FINFO_READ_FUNC(fd, cbuf, (size_t)xcap_sizeof) !=
- 				    (ssize_t)xcap_sizeof) {
- 					file_badread(ms);
- 					return -1;
-@@ -966,13 +963,12 @@
- 					break;
- 				}
- 			}
-			/*FALLTHROUGH*/
-		skip:
-+			break;
-+
- 		default:
- 			break;
- 		}
- 	}
-
- 	if (file_printf(ms, ", %sstripped", stripped ? "" : "not ") == -1)
- 		return -1;
- 	if (cap_hw1) {
-@@ -1051,7 +1047,7 @@
- 	const char *shared_libraries = "";
- 	unsigned char nbuf[BUFSIZ];
- 	ssize_t bufsize;
-	size_t offset, align, len;
-+	size_t offset, align;
- 	
- 	if (size != xph_sizeof) {
- 		if (file_printf(ms, ", corrupted program header size") == -1)
-@@ -1060,8 +1056,13 @@
- 	}
- 
-   	for ( ; num; num--) {
-		if (pread(fd, xph_addr, xph_sizeof, off) == -1) {
-			file_badread(ms);
-+		if (FINFO_LSEEK_FUNC(fd, off, SEEK_SET) == (off_t)-1) {
-+			file_badseek(ms);
-+			return -1;
-+		}
-+
-+  		if (FINFO_READ_FUNC(fd, xph_addr, xph_sizeof) == -1) {
-+  			file_badread(ms);
- 			return -1;
- 		}
- 
-@@ -1099,9 +1100,12 @@
- 			 * This is a PT_NOTE section; loop through all the notes
- 			 * in the section.
- 			 */
-			len = xph_filesz < sizeof(nbuf) ? xph_filesz
-			    : sizeof(nbuf);
-			bufsize = pread(fd, nbuf, len, xph_offset);
-+			if (FINFO_LSEEK_FUNC(fd, xph_offset, SEEK_SET) == (off_t)-1) {
-+				file_badseek(ms);
-+				return -1;
-+			}
-+			bufsize = FINFO_READ_FUNC(fd, nbuf, ((xph_filesz < sizeof(nbuf)) ?
-+			    xph_filesz : sizeof(nbuf)));
- 			if (bufsize == -1) {
- 				file_badread(ms);
- 				return -1;
-@@ -1162,7 +1166,7 @@
- 	/*
- 	 * If we cannot seek, it must be a pipe, socket or fifo.
- 	 */
-	if((lseek(fd, (off_t)0, SEEK_SET) == (off_t)-1) && (errno == ESPIPE))
-+	if((FINFO_LSEEK_FUNC(fd, (off_t)0, SEEK_SET) == (off_t)-1) && (errno == ESPIPE))
- 		fd = file_pipe2file(ms, fd, buf, nbytes);
- 
- 	if (fstat(fd, &st) == -1) {
-diff -u libmagic.orig/readelf.h libmagic/readelf.h
--- libmagic.orig/readelf.h	Thu Mar 21 18:45:14 2013
-+++ libmagic/readelf.h	Mon Apr 14 23:42:51 2014
-@@ -44,9 +44,17 @@
- typedef uint32_t	Elf32_Word;
- typedef uint8_t		Elf32_Char;
- 
-+#if SIZEOF_LONG_LONG != 8
-+#define	USE_ARRAY_FOR_64BIT_TYPES
-+typedef	uint32_t 	Elf64_Addr[2];
-+typedef	uint32_t 	Elf64_Off[2];
-+typedef uint32_t 	Elf64_Xword[2];
-+#else
-+#undef USE_ARRAY_FOR_64BIT_TYPES
- typedef	uint64_t 	Elf64_Addr;
- typedef	uint64_t 	Elf64_Off;
- typedef uint64_t 	Elf64_Xword;
-+#endif
- typedef uint16_t	Elf64_Half;
- typedef uint32_t	Elf64_Word;
- typedef uint8_t		Elf64_Char;
 diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 --- libmagic.orig/softmagic.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/softmagic.c	Tue Jul  1 09:00:09 2014
+++ libmagic/softmagic.c	Sun Jan  4 17:02:29 2015
@@ -41,6 +41,11 @@
 #include <stdlib.h>
 #include <time.h>
@@ -3149,6 +2890,15 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 
 private int match(struct magic_set *, struct magic *, uint32_t,
     const unsigned char *, size_t, size_t, int, int, int, int, int *, int *,
+@@ -53,7 +58,7 @@
+ private int32_t moffset(struct magic_set *, struct magic *);
+ private void mdebug(uint32_t, const char *, size_t);
+ private int mcopy(struct magic_set *, union VALUETYPE *, int, int,
+-    const unsigned char *, uint32_t, size_t, size_t);
+    const unsigned char *, uint32_t, size_t, struct magic *);
+ private int mconvert(struct magic_set *, struct magic *, int);
+ private int print_sep(struct magic_set *, int);
+ private int handle_annotation(struct magic_set *, struct magic *);
@@ -62,6 +67,8 @@
 private void cvt_32(union VALUETYPE *, const struct magic *);
 private void cvt_64(union VALUETYPE *, const struct magic *);
@@ -3286,7 +3036,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 			break; \
 		} \
 
-@@ -896,10 +881,18 @@
+@@ -896,10 +881,21 @@
 		return 1;
 	}
 	case FILE_PSTRING: {
@@ -3296,21 +3046,87 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 		size_t len = file_pstring_get_length(m, ptr1);
 -		if (len >= sizeof(p->s))
 -			len = sizeof(p->s) - 1;
-+		if (len >= sizeof(p->s)) {
+		sz = sizeof(p->s) - sz; /* maximum length of string */
+		if (len >= sz) {
 +			/*
 +			 * The size of the pascal string length (sz)
 +			 * is 1, 2, or 4. We need at least 1 byte for NUL
 +			 * termination, but we've already truncated the
 +			 * string by p->s, so we need to deduct sz.
+			 * Because we can use one of the bytes of the length
+			 * after we shifted as NUL termination.
 +			 */ 
-+			len = sizeof(p->s) - sz;
+			len = sz;
 +		}
 		while (len--)
 			*ptr1++ = *ptr2++;
 		*ptr1 = '\0';
-@@ -1145,9 +1138,6 @@
- 		    "nbytes=%zu, count=%u)\n", m->type, m->flag, offset, o,
- 		    nbytes, count);
+@@ -1010,7 +1006,7 @@
+ 
+ private int
+ mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
+-    const unsigned char *s, uint32_t offset, size_t nbytes, size_t linecnt)
+    const unsigned char *s, uint32_t offset, size_t nbytes, struct magic *m)
+ {
+ 	/*
+ 	 * Note: FILE_SEARCH and FILE_REGEX do not actually copy
+@@ -1030,15 +1026,24 @@
+ 			const char *last;	/* end of search region */
+ 			const char *buf;	/* start of search region */
+ 			const char *end;
+-			size_t lines;
+			size_t lines, linecnt, bytecnt;
+
+			linecnt = m->str_range;
+			bytecnt = linecnt * 80;
+ 
+			if (bytecnt == 0) {
+				bytecnt = 8192;
+			}
+			if (bytecnt > nbytes) {
+				bytecnt = nbytes;
+			}
+ 			if (s == NULL) {
+ 				ms->search.s_len = 0;
+ 				ms->search.s = NULL;
+ 				return 0;
+ 			}
+ 			buf = RCAST(const char *, s) + offset;
+-			end = last = RCAST(const char *, s) + nbytes;
+			end = last = RCAST(const char *, s) + bytecnt;
+ 			/* mget() guarantees buf <= last */
+ 			for (lines = linecnt, b = buf; lines && b < end &&
+ 			     ((b = CAST(const char *,
+@@ -1051,7 +1056,7 @@
+ 					b++;
+ 			}
+ 			if (lines)
+-				last = RCAST(const char *, s) + nbytes;
+				last = RCAST(const char *, s) + bytecnt;
+ 
+ 			ms->search.s = buf;
+ 			ms->search.s_len = last - buf;
+@@ -1125,7 +1130,6 @@
+     int *need_separator, int *returnval)
+ {
+ 	uint32_t soffset, offset = ms->offset;
+-	uint32_t count = m->str_range;
+ 	int rv, oneed_separator;
+ 	char *sbuf, *rbuf;
+ 	union VALUETYPE *p = &ms->ms_value;
+@@ -1137,17 +1141,13 @@
+ 	}
+ 
+ 	if (mcopy(ms, p, m->type, m->flag & INDIR, s, (uint32_t)(offset + o),
+-	    (uint32_t)nbytes, count) == -1)
+	    (uint32_t)nbytes, m) == -1)
+ 		return -1;
+ 
+ 	if ((ms->flags & MAGIC_DEBUG) != 0) {
+ 		fprintf(stderr, "mget(type=%d, flag=%x, offset=%u, o=%zu, "
+-		    "nbytes=%zu, count=%u)\n", m->type, m->flag, offset, o,
+-		    nbytes, count);
+		    "nbytes=%zu)\n", m->type, m->flag, offset, o, nbytes);
 		mdebug(offset, (char *)(void *)p, sizeof(union VALUETYPE));
 -#ifndef COMPILE_ONLY
 -		file_mdump(m);
@@ -3318,7 +3134,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 	}
 
 	if (m->flag & INDIR) {
-@@ -1191,7 +1181,7 @@
+@@ -1191,7 +1191,7 @@
 		}
 		switch (cvt_flip(m->in_type, flip)) {
 		case FILE_BYTE:
@@ -3327,7 +3143,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1226,7 +1216,7 @@
+@@ -1226,7 +1226,7 @@
 				offset = ~offset;
 			break;
 		case FILE_BESHORT:
@@ -3336,7 +3152,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1278,7 +1268,7 @@
+@@ -1278,7 +1278,7 @@
 				offset = ~offset;
 			break;
 		case FILE_LESHORT:
@@ -3345,7 +3161,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1330,7 +1320,7 @@
+@@ -1330,7 +1330,7 @@
 				offset = ~offset;
 			break;
 		case FILE_SHORT:
@@ -3354,7 +3170,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1367,7 +1357,7 @@
+@@ -1367,7 +1367,7 @@
 			break;
 		case FILE_BELONG:
 		case FILE_BEID3:
@@ -3363,7 +3179,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1438,7 +1428,7 @@
+@@ -1438,7 +1438,7 @@
 			break;
 		case FILE_LELONG:
 		case FILE_LEID3:
@@ -3372,7 +3188,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1508,7 +1498,7 @@
+@@ -1508,7 +1508,7 @@
 				offset = ~offset;
 			break;
 		case FILE_MELONG:
@@ -3381,7 +3197,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1578,7 +1568,7 @@
+@@ -1578,7 +1578,7 @@
 				offset = ~offset;
 			break;
 		case FILE_LONG:
@@ -3390,7 +3206,15 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1644,23 +1634,20 @@
+@@ -1637,30 +1637,27 @@
+ 			if ((ms->flags & MAGIC_DEBUG) != 0)
+ 				fprintf(stderr, "indirect +offs=%u\n", offset);
+ 		}
+-		if (mcopy(ms, p, m->type, 0, s, offset, nbytes, count) == -1)
+		if (mcopy(ms, p, m->type, 0, s, offset, nbytes, m) == -1)
+ 			return -1;
+ 		ms->offset = offset;
+ 
 		if ((ms->flags & MAGIC_DEBUG) != 0) {
 			mdebug(offset, (char *)(void *)p,
 			    sizeof(union VALUETYPE));
@@ -3416,7 +3240,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 			return 0;
 		break;
 
-@@ -1679,38 +1666,40 @@
+@@ -1679,38 +1676,40 @@
 	case FILE_FLOAT:
 	case FILE_BEFLOAT:
 	case FILE_LEFLOAT:
@@ -3463,7 +3287,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 		if ((ms->flags & MAGIC_DEBUG) != 0)
 			fprintf(stderr, "indirect @offs=%u[%d]\n", offset, rv);
 		rbuf = ms->o.buf;
-@@ -1718,16 +1707,26 @@
+@@ -1718,16 +1717,26 @@
 		ms->offset = soffset;
 		if (rv == 1) {
 			if ((ms->flags & (MAGIC_MIME|MAGIC_APPLE)) == 0 &&
@@ -3494,7 +3318,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 			return 0;
 		sbuf = m->value.s;
 		if (*sbuf == '^') {
-@@ -1837,6 +1836,42 @@
+@@ -1837,6 +1846,42 @@
 	return file_strncmp(a, b, len, flags);
 }
 
@@ -3537,7 +3361,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 private int
 magiccheck(struct magic_set *ms, struct magic *m)
 {
-@@ -1996,69 +2031,157 @@
+@@ -1996,69 +2041,157 @@
 		break;
 	}
 	case FILE_REGEX: {
@@ -3608,7 +3432,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 +			zval *retval;
 +			zval *subpats;
 +			char *haystack;
-+			
+
 +			MAKE_STD_ZVAL(retval);
 +			ALLOC_INIT_ZVAL(subpats);
 +			
@@ -1269,7 +1269,7 @@ file_signextend(struct magic_set *ms, struct magic *m, uint64_t v)
 		 * the sign extension must have happened.
 		 */
 		case FILE_BYTE:
-			v = (char) v;
+			v = (signed char) v;
 			break;
 		case FILE_SHORT:
 		case FILE_BESHORT:
@@ -820,7 +820,7 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 		q = (const uint8_t *)(const void *)
 		    ((const char *)(const void *)p + ofs
 		    - 2 * sizeof(uint32_t));
-		if (q > e) {
+		if (q < p || q > e) {
 			DPRINTF(("Ran of the end %p > %p\n", q, e));
 			goto out;
 		}
@@ -420,8 +420,6 @@ protected int file_pipe2file(struct magic_set *, int, const void *, size_t);
 protected int file_replace(struct magic_set *, const char *, const char *);
 protected int file_printf(struct magic_set *, const char *, ...);
 protected int file_reset(struct magic_set *);
-protected int file_tryelf(struct magic_set *, int, const unsigned char *,
-    size_t);
 protected int file_trycdf(struct magic_set *, int, const unsigned char *,
    size_t);
 #ifdef PHP_FILEINFO_UNCOMPRESS 
@@ -1,333 +0,0 @@
-/*
- * Copyright (c) Christos Zoulas 2003.
- * All Rights Reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice immediately at the beginning of the file, without modification,
- *    this list of conditions, and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *  
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
- * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-/*
- * @(#)Id: readelf.h,v 1.9 2002/05/16 18:45:56 christos Exp
- *
- * Provide elf data structures for non-elf machines, allowing file
- * non-elf hosts to determine if an elf binary is stripped.
- * Note: cobbled from the linux header file, with modifications
- */
-#ifndef __fake_elf_h__
-#define	__fake_elf_h__
-
-#if HAVE_STDINT_H
-#include <stdint.h>
-#endif
-
-typedef uint32_t	Elf32_Addr;
-typedef uint32_t	Elf32_Off;
-typedef uint16_t	Elf32_Half;
-typedef uint32_t	Elf32_Word;
-typedef uint8_t		Elf32_Char;
-
-#if SIZEOF_LONG_LONG != 8
-#define	USE_ARRAY_FOR_64BIT_TYPES
-typedef	uint32_t 	Elf64_Addr[2];
-typedef	uint32_t 	Elf64_Off[2];
-typedef uint32_t 	Elf64_Xword[2];
-#else
-#undef USE_ARRAY_FOR_64BIT_TYPES
-typedef	uint64_t 	Elf64_Addr;
-typedef	uint64_t 	Elf64_Off;
-typedef uint64_t 	Elf64_Xword;
-#endif
-typedef uint16_t	Elf64_Half;
-typedef uint32_t	Elf64_Word;
-typedef uint8_t		Elf64_Char;
-
-#define	EI_NIDENT	16
-
-typedef struct {
-    Elf32_Char	e_ident[EI_NIDENT];
-    Elf32_Half	e_type;
-    Elf32_Half	e_machine;
-    Elf32_Word	e_version;
-    Elf32_Addr	e_entry;  /* Entry point */
-    Elf32_Off	e_phoff;
-    Elf32_Off	e_shoff;
-    Elf32_Word	e_flags;
-    Elf32_Half	e_ehsize;
-    Elf32_Half	e_phentsize;
-    Elf32_Half	e_phnum;
-    Elf32_Half	e_shentsize;
-    Elf32_Half	e_shnum;
-    Elf32_Half	e_shstrndx;
-} Elf32_Ehdr;
-
-typedef struct {
-    Elf64_Char	e_ident[EI_NIDENT];
-    Elf64_Half	e_type;
-    Elf64_Half	e_machine;
-    Elf64_Word	e_version;
-    Elf64_Addr	e_entry;  /* Entry point */
-    Elf64_Off	e_phoff;
-    Elf64_Off	e_shoff;
-    Elf64_Word	e_flags;
-    Elf64_Half	e_ehsize;
-    Elf64_Half	e_phentsize;
-    Elf64_Half	e_phnum;
-    Elf64_Half	e_shentsize;
-    Elf64_Half	e_shnum;
-    Elf64_Half	e_shstrndx;
-} Elf64_Ehdr;
-
-/* e_type */
-#define	ET_REL		1
-#define	ET_EXEC		2
-#define	ET_DYN		3
-#define	ET_CORE		4
-
-/* e_machine (used only for SunOS 5.x hardware capabilities) */
-#define	EM_SPARC	2
-#define	EM_386		3
-#define	EM_SPARC32PLUS	18
-#define	EM_SPARCV9	43
-#define	EM_IA_64	50
-#define	EM_AMD64	62
-
-/* sh_type */
-#define	SHT_SYMTAB	2
-#define	SHT_NOTE	7
-#define	SHT_DYNSYM	11
-#define	SHT_SUNW_cap	0x6ffffff5	/* SunOS 5.x hw/sw capabilites */
-
-/* elf type */
-#define	ELFDATANONE	0		/* e_ident[EI_DATA] */
-#define	ELFDATA2LSB	1
-#define	ELFDATA2MSB	2
-
-/* elf class */
-#define	ELFCLASSNONE	0
-#define	ELFCLASS32	1
-#define	ELFCLASS64	2
-
-/* magic number */
-#define	EI_MAG0		0		/* e_ident[] indexes */
-#define	EI_MAG1		1
-#define	EI_MAG2		2
-#define	EI_MAG3		3
-#define	EI_CLASS	4
-#define	EI_DATA		5
-#define	EI_VERSION	6
-#define	EI_PAD		7
-
-#define	ELFMAG0		0x7f		/* EI_MAG */
-#define	ELFMAG1		'E'
-#define	ELFMAG2		'L'
-#define	ELFMAG3		'F'
-#define	ELFMAG		"\177ELF"
-
-#define	OLFMAG1		'O'
-#define	OLFMAG		"\177OLF"
-
-typedef struct {
-    Elf32_Word	p_type;
-    Elf32_Off	p_offset;
-    Elf32_Addr	p_vaddr;
-    Elf32_Addr	p_paddr;
-    Elf32_Word	p_filesz;
-    Elf32_Word	p_memsz;
-    Elf32_Word	p_flags;
-    Elf32_Word	p_align;
-} Elf32_Phdr;
-
-typedef struct {
-    Elf64_Word	p_type;
-    Elf64_Word	p_flags;
-    Elf64_Off	p_offset;
-    Elf64_Addr	p_vaddr;
-    Elf64_Addr	p_paddr;
-    Elf64_Xword	p_filesz;
-    Elf64_Xword	p_memsz;
-    Elf64_Xword	p_align;
-} Elf64_Phdr;
-
-#define	PT_NULL		0		/* p_type */
-#define	PT_LOAD		1
-#define	PT_DYNAMIC	2
-#define	PT_INTERP	3
-#define	PT_NOTE		4
-#define	PT_SHLIB	5
-#define	PT_PHDR		6
-#define	PT_NUM		7
-
-typedef struct {
-    Elf32_Word	sh_name;
-    Elf32_Word	sh_type;
-    Elf32_Word	sh_flags;
-    Elf32_Addr	sh_addr;
-    Elf32_Off	sh_offset;
-    Elf32_Word	sh_size;
-    Elf32_Word	sh_link;
-    Elf32_Word	sh_info;
-    Elf32_Word	sh_addralign;
-    Elf32_Word	sh_entsize;
-} Elf32_Shdr;
-
-typedef struct {
-    Elf64_Word	sh_name;
-    Elf64_Word	sh_type;
-    Elf64_Off	sh_flags;
-    Elf64_Addr	sh_addr;
-    Elf64_Off	sh_offset;
-    Elf64_Off	sh_size;
-    Elf64_Word	sh_link;
-    Elf64_Word	sh_info;
-    Elf64_Off	sh_addralign;
-    Elf64_Off	sh_entsize;
-} Elf64_Shdr;
-
-#define	NT_NETBSD_CORE_PROCINFO		1
-
-/* Note header in a PT_NOTE section */
-typedef struct elf_note {
-    Elf32_Word	n_namesz;	/* Name size */
-    Elf32_Word	n_descsz;	/* Content size */
-    Elf32_Word	n_type;		/* Content type */
-} Elf32_Nhdr;
-
-typedef struct {
-    Elf64_Word	n_namesz;
-    Elf64_Word	n_descsz;
-    Elf64_Word	n_type;
-} Elf64_Nhdr;
-
-/* Notes used in ET_CORE */
-#define	NT_PRSTATUS	1
-#define	NT_PRFPREG	2
-#define	NT_PRPSINFO	3
-#define	NT_PRXREG	4
-#define	NT_TASKSTRUCT	4
-#define	NT_PLATFORM	5
-#define	NT_AUXV		6
-
-/* Note types used in executables */
-/* NetBSD executables (name = "NetBSD") */
-#define	NT_NETBSD_VERSION	1
-#define	NT_NETBSD_EMULATION	2
-#define	NT_FREEBSD_VERSION	1
-#define	NT_OPENBSD_VERSION	1
-#define	NT_DRAGONFLY_VERSION	1
-/*
- * GNU executables (name = "GNU")
- * word[0]: GNU OS tags
- * word[1]: major version
- * word[2]: minor version
- * word[3]: tiny version
- */
-#define	NT_GNU_VERSION		1
-
-/* GNU OS tags */
-#define	GNU_OS_LINUX	0
-#define	GNU_OS_HURD	1
-#define	GNU_OS_SOLARIS	2
-#define	GNU_OS_KFREEBSD	3
-#define	GNU_OS_KNETBSD	4
-
-/*
- * GNU Hardware capability information 
- * word[0]: Number of entries
- * word[1]: Bitmask of enabled entries
- * Followed by a byte id, and a NUL terminated string per entry
- */
-#define	NT_GNU_HWCAP		2
-
-/*
- * GNU Build ID generated by ld
- * 160 bit SHA1 [default] 
- * 128 bit md5 or uuid
- */
-#define	NT_GNU_BUILD_ID		3
-
-/* SunOS 5.x hardware/software capabilities */
-typedef struct {
-	Elf32_Word	c_tag;
-	union {
-		Elf32_Word	c_val;
-		Elf32_Addr	c_ptr;
-	} c_un;
-} Elf32_Cap;
-
-typedef struct {
-	Elf64_Xword	c_tag;
-	union {
-		Elf64_Xword	c_val;
-		Elf64_Addr	c_ptr;
-	} c_un;
-} Elf64_Cap;
-
-/* SunOS 5.x hardware/software capability tags */
-#define	CA_SUNW_NULL	0
-#define	CA_SUNW_HW_1	1
-#define	CA_SUNW_SF_1	2
-
-/* SunOS 5.x software capabilities */
-#define	SF1_SUNW_FPKNWN	0x01
-#define	SF1_SUNW_FPUSED	0x02
-#define	SF1_SUNW_MASK	0x03
-
-/* SunOS 5.x hardware capabilities: sparc */
-#define	AV_SPARC_MUL32		0x0001
-#define	AV_SPARC_DIV32		0x0002
-#define	AV_SPARC_FSMULD		0x0004
-#define	AV_SPARC_V8PLUS		0x0008
-#define	AV_SPARC_POPC		0x0010
-#define	AV_SPARC_VIS		0x0020
-#define	AV_SPARC_VIS2		0x0040
-#define	AV_SPARC_ASI_BLK_INIT	0x0080
-#define	AV_SPARC_FMAF		0x0100
-#define	AV_SPARC_FJFMAU		0x4000
-#define	AV_SPARC_IMA		0x8000
-
-/* SunOS 5.x hardware capabilities: 386 */
-#define	AV_386_FPU		0x00000001
-#define	AV_386_TSC		0x00000002
-#define	AV_386_CX8		0x00000004
-#define	AV_386_SEP		0x00000008
-#define	AV_386_AMD_SYSC		0x00000010
-#define	AV_386_CMOV		0x00000020
-#define	AV_386_MMX		0x00000040
-#define	AV_386_AMD_MMX		0x00000080
-#define	AV_386_AMD_3DNow	0x00000100
-#define	AV_386_AMD_3DNowx	0x00000200
-#define	AV_386_FXSR		0x00000400
-#define	AV_386_SSE		0x00000800
-#define	AV_386_SSE2		0x00001000
-#define	AV_386_PAUSE		0x00002000
-#define	AV_386_SSE3		0x00004000
-#define	AV_386_MON		0x00008000
-#define	AV_386_CX16		0x00010000
-#define	AV_386_AHF		0x00020000
-#define	AV_386_TSCP		0x00040000
-#define	AV_386_AMD_SSE4A	0x00080000
-#define	AV_386_POPCNT		0x00100000
-#define	AV_386_AMD_LZCNT	0x00200000
-#define	AV_386_SSSE3		0x00400000
-#define	AV_386_SSE4_1		0x00800000
-#define	AV_386_SSE4_2		0x01000000
-
-#endif
@@ -884,14 +884,17 @@ mconvert(struct magic_set *ms, struct magic *m, int flip)
 		size_t sz = file_pstring_length_size(m);
 		char *ptr1 = p->s, *ptr2 = ptr1 + sz;
 		size_t len = file_pstring_get_length(m, ptr1);
-		if (len >= sizeof(p->s)) {
+		sz = sizeof(p->s) - sz; /* maximum length of string */
+		if (len >= sz) {
 			/*
 			 * The size of the pascal string length (sz)
 			 * is 1, 2, or 4. We need at least 1 byte for NUL
 			 * termination, but we've already truncated the
 			 * string by p->s, so we need to deduct sz.
+			 * Because we can use one of the bytes of the length
+			 * after we shifted as NUL termination.
 			 */ 
-			len = sizeof(p->s) - sz;
+			len = sz;
 		}
 		while (len--)
 			*ptr1++ = *ptr2++;
@@ -1034,6 +1037,9 @@ mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
 			if (bytecnt > nbytes) {
 				bytecnt = nbytes;
 			}
+			if (offset > bytecnt) {
+				offset = bytecnt;
+			}
 			if (s == NULL) {
 				ms->search.s_len = 0;
 				ms->search.s = NULL;
@@ -0,0 +1,16 @@
+--TEST--
+Bug #68735 fileinfo out-of-bounds memory access
+--SKIPIF--
+<?php require_once(dirname(__FILE__) . '/skipif.inc'); ?>
+--FILE--
+<?php
+	$test_file = dirname(__FILE__) . DIRECTORY_SEPARATOR . "bug68735.jpg";
+	$f = new finfo;
+
+	var_dump($f->file($test_file));
+
+?>
+===DONE===
+--EXPECTF--
+string(%d) "JPEG image data, JFIF standard 1.01, comment: "%S""
+===DONE===
@@ -0,0 +1,18 @@
+--TEST--
+Bug #68819 Fileinfo on specific file causes spurious OOM and/or segfault, var 1
+--SKIPIF--
+<?php require_once(dirname(__FILE__) . '/skipif.inc'); ?>
+--FILE--
+<?php
+
+$string = <<<HERE
+----a-----'''---------a---------------a--------a-----a-----a---------a-----as-------a----a--a-------------a--as-----s---------------a---------a---a--s-a-----a-----------asy---------a-----a-----------a----s--------a-------------a-------a--------a----s------------a-----a----------------a----s-----------------\r\n-------------------a-------a-a-------a-----a----a----s----s--------a-----------------------a----a----s-------------a------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-------------------a-------a-a-------a-----a----a----s----s--------a----------a----------------------a----a----s-------------a----------------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n------a-------a-a-------a-----a----a---a-----a-----------------------a----a---a-----a------------------s-------a----a---a-----a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s------\r\n-------------------a-------a-a-------a-----a----a---a-------a------------------------a----a---a-----''--a-------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-------------------a-------a-a-------a-----a----a-------s-----a---a-------------------------a----a-------------a---a-------------------s-------a----a-------------a---a-----as-a--------------a-----a--s----s---------y------------a-----a-s---a-------''----a---s--a-''------''----s------------a-y----------------s------a-----y--a-s--a-s------s--a-s----------''----------------------------a---s--a----a---------a-s---a-s--------s--------a---------s--a-y-------------as----a----a-------------a------a---s--a-s------a--------a----s----y--as--a----a-s---------------a-----a--------------------------------------\r\n-------------------a-------a-a-------a-----a----a-----------s--------a-----------------------a----a--------------------a------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-------------------a-------a-a-------a-----a----a-----------s--------a----------a----------------------a----a--------------------a------------------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-------------------a-------a-a-------a-----a----a---a-----------------------a----a---a------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-------------------a-------a-a-------a-----a----a---a----------a----------------------a----a---a------------------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-----a-a-----------a-------a-a-------a-----a----a----a---s-----a-----------------------a----a----a---------a-----------------s-------a----a----a---------a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-------------------a-------a-a-------a-----a----a--------a----a-----------------------a----a----------a----a------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-----a-------------a-------a-a-------a-----a----a--------s-----a---a-------------------------a----a--------------a---a-------------------s-------------a---------------a----a---a---a-----as-a--------------a-----a--s----s---------y------------a-----a-s---a-------''----a---s--a-''------''----s------------a-y----------------s------a-----y--a-s--a-s------s--a-s----------''----------------------------a---s--a----a---------a-s---a-s--------s--------a---------s--a-y-------------as----a----a-------------a------a---s--a-s------a--------a----s----y--as--a----a-s---------------a-----a-----------Line truncated
+HERE;
+
+$finfo = new finfo();
+$type = $finfo->buffer($string);
+
+var_dump($type);
+?>
+--EXPECT--
+string(60) "ASCII text, with very long lines, with CRLF line terminators"
@@ -0,0 +1,26 @@
+--TEST--
+Bug #68819 Fileinfo on specific file causes spurious OOM and/or segfault, var 2
+--SKIPIF--
+<?php require_once(dirname(__FILE__) . '/skipif.inc'); ?>
+--FILE--
+<?php
+
+$string = '';
+
+// These two in any order
+$string .= "\r\n";
+$string .= "''''";
+
+// Total string length > 8192
+$string .= str_repeat(chr(rand(32, 127)), 8184);
+
+// Ending in this string
+$string .= "say";
+
+$finfo = new finfo();
+$type = $finfo->buffer($string);
+var_dump($type);
+
+?>
+--EXPECT--
+string(60) "ASCII text, with very long lines, with CRLF line terminators"
@@ -19,6 +19,7 @@ echo "*** Testing finfo_file() : basic functionality ***\n";
 var_dump( finfo_file( $finfo, __FILE__) );
 var_dump( finfo_file( $finfo, __FILE__, FILEINFO_CONTINUE ) );
 var_dump( finfo_file( $finfo, $magicFile ) );
+var_dump( finfo_file( $finfo, $magicFile.chr(0).$magicFile) );

 ?>
 ===DONE===
@@ -27,4 +28,7 @@ var_dump( finfo_file( $finfo, $magicFile ) );
 string(28) "text/x-php; charset=us-ascii"
 string(22) "PHP script, ASCII text"
 string(25) "text/plain; charset=utf-8"
+
+Warning: finfo_file(): Invalid path in %s/finfo_file_basic.php on line %d
+bool(false)
 ===DONE===
@@ -188,9 +188,9 @@ ftp_close(ftpbuf_t *ftp)
 			SSL_shutdown(ftp->ssl_handle);
 			SSL_free(ftp->ssl_handle);
 		}
-#endif		
+#endif
 		closesocket(ftp->fd);
-	}	
+	}
 	ftp_gc(ftp);
 	efree(ftp);
 	return NULL;
@@ -262,7 +262,7 @@ ftp_login(ftpbuf_t *ftp, const char *user, const char *pass TSRMLS_DC)
 		if (!ftp_getresp(ftp)) {
 			return 0;
 		}
-			
+
 		if (ftp->resp != 234) {
 			if (!ftp_putcmd(ftp, "AUTH", "SSL")) {
 				return 0;
@@ -270,7 +270,7 @@ ftp_login(ftpbuf_t *ftp, const char *user, const char *pass TSRMLS_DC)
 			if (!ftp_getresp(ftp)) {
 				return 0;
 			}
-				
+
 			if (ftp->resp != 334) {
 				return 0;
 			} else {
@@ -278,7 +278,7 @@ ftp_login(ftpbuf_t *ftp, const char *user, const char *pass TSRMLS_DC)
 				ftp->use_ssl_for_data = 1;
 			}
 		}
-		
+
 		ctx = SSL_CTX_new(SSLv23_client_method());
 		if (ctx == NULL) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "failed to create the SSL context");
@@ -325,8 +325,8 @@ ftp_login(ftpbuf_t *ftp, const char *user, const char *pass TSRMLS_DC)
 			if (!ftp_getresp(ftp)) {
 				return 0;
 			}
-			
-			ftp->use_ssl_for_data = (ftp->resp >= 200 && ftp->resp <=299);		
+
+			ftp->use_ssl_for_data = (ftp->resp >= 200 && ftp->resp <=299);
 		}
 	}
 #endif
@@ -360,7 +360,7 @@ ftp_reinit(ftpbuf_t *ftp)
 {
 	if (ftp == NULL) {
 		return 0;
-	}	
+	}

 	ftp_gc(ftp);

@@ -395,7 +395,7 @@ ftp_syst(ftpbuf_t *ftp)
 	if (!ftp_putcmd(ftp, "SYST", NULL)) {
 		return NULL;
 	}
-	if (!ftp_getresp(ftp) || ftp->resp != 215) { 
+	if (!ftp_getresp(ftp) || ftp->resp != 215) {
 		return NULL;
 	}
 	syst = ftp->inbuf;
@@ -431,14 +431,14 @@ ftp_pwd(ftpbuf_t *ftp)
 	if (!ftp_putcmd(ftp, "PWD", NULL)) {
 		return NULL;
 	}
-	if (!ftp_getresp(ftp) || ftp->resp != 257) { 
+	if (!ftp_getresp(ftp) || ftp->resp != 257) {
 		return NULL;
 	}
 	/* copy out the pwd from response */
-	if ((pwd = strchr(ftp->inbuf, '"')) == NULL) { 
+	if ((pwd = strchr(ftp->inbuf, '"')) == NULL) {
 		return NULL;
 	}
-	if ((end = strrchr(++pwd, '"')) == NULL) { 
+	if ((end = strrchr(++pwd, '"')) == NULL) {
 		return NULL;
 	}
 	ftp->pwd = estrndup(pwd, end - pwd);
@@ -608,7 +608,7 @@ ftp_chmod(ftpbuf_t *ftp, const int mode, const char *filename, const int filenam
 	if (!ftp_getresp(ftp) || ftp->resp != 200) {
 		return 0;
 	}
-	
+
 	return 1;
 }
 /* }}} */
@@ -625,7 +625,7 @@ ftp_alloc(ftpbuf_t *ftp, const long size, char **response)
 	}

 	snprintf(buffer, sizeof(buffer) - 1, "%ld", size);
-    
+
 	if (!ftp_putcmd(ftp, "ALLO", buffer)) {
 		return 0;
 	}
@@ -642,7 +642,7 @@ ftp_alloc(ftpbuf_t *ftp, const long size, char **response)
 		return 0;
 	}

-	return 1;	
+	return 1;
 }
 /* }}} */

@@ -674,7 +674,7 @@ ftp_type(ftpbuf_t *ftp, ftptype_t type)
 	if (ftp == NULL) {
 		return 0;
 	}
-	if (type == ftp->type) { 
+	if (type == ftp->type) {
 		return 1;
 	}
 	if (type == FTPTYPE_ASCII) {
@@ -765,7 +765,7 @@ ftp_pasv(ftpbuf_t *ftp, int pasv)
 	if (!ftp_putcmd(ftp, "PASV", NULL)) {
 		return 0;
 	}
-	if (!ftp_getresp(ftp) || ftp->resp != 227) { 
+	if (!ftp_getresp(ftp) || ftp->resp != 227) {
 		return 0;
 	}
 	/* parse out the IP and port */
@@ -808,7 +808,7 @@ ftp_get(ftpbuf_t *ftp, php_stream *outstream, const char *path, ftptype_t type,
 	if ((data = ftp_getdata(ftp TSRMLS_CC)) == NULL) {
 		goto bail;
 	}
-	
+
 	ftp->data = data;

 	if (resumepos > 0) {
@@ -902,7 +902,7 @@ ftp_put(ftpbuf_t *ftp, const char *path, php_stream *instream, ftptype_t type, l
 	if ((data = ftp_getdata(ftp TSRMLS_CC)) == NULL) {
 		goto bail;
 	}
-	ftp->data = data;	
+	ftp->data = data;

 	if (startpos > 0) {
 		snprintf(arg, sizeof(arg), "%ld", startpos);
@@ -1103,7 +1103,7 @@ ftp_putcmd(ftpbuf_t *ftp, const char *cmd, const char *args)

 	if (strpbrk(cmd, "\r\n")) {
 		return 0;
-	} 
+	}
 	/* build the output buffer */
 	if (args && args[0]) {
 		/* "cmd args\r\n\0" */
@@ -1252,7 +1252,7 @@ my_send(ftpbuf_t *ftp, php_socket_t s, void *buf, size_t len)
 #if HAVE_OPENSSL_EXT
 		if (ftp->use_ssl && ftp->fd == s && ftp->ssl_active) {
 			sent = SSL_write(ftp->ssl_handle, buf, size);
-		} else if (ftp->use_ssl && ftp->fd != s && ftp->use_ssl_for_data && ftp->data->ssl_active) {	
+		} else if (ftp->use_ssl && ftp->fd != s && ftp->use_ssl_for_data && ftp->data->ssl_active) {
 			sent = SSL_write(ftp->data->ssl_handle, buf, size);
 		} else {
 #endif
@@ -1292,14 +1292,14 @@ my_recv(ftpbuf_t *ftp, php_socket_t s, void *buf, size_t len)
 #if HAVE_OPENSSL_EXT
 	if (ftp->use_ssl && ftp->fd == s && ftp->ssl_active) {
 		nr_bytes = SSL_read(ftp->ssl_handle, buf, len);
-	} else if (ftp->use_ssl && ftp->fd != s && ftp->use_ssl_for_data && ftp->data->ssl_active) {	
+	} else if (ftp->use_ssl && ftp->fd != s && ftp->use_ssl_for_data && ftp->data->ssl_active) {
 		nr_bytes = SSL_read(ftp->data->ssl_handle, buf, len);
 	} else {
 #endif
 		nr_bytes = recv(s, buf, len, 0);
 #if HAVE_OPENSSL_EXT
 	}
-#endif	
+#endif
 	return (nr_bytes);
 }
 /* }}} */
@@ -1516,7 +1516,7 @@ data_accept(databuf_t *data, ftpbuf_t *ftp TSRMLS_DC)

 data_accepted:
 #if HAVE_OPENSSL_EXT
-	
+
 	/* now enable ssl if we need to */
 	if (ftp->use_ssl && ftp->use_ssl_for_data) {
 		ctx = SSL_CTX_new(SSLv23_client_method());
@@ -1536,23 +1536,23 @@ data_accepted:
 			SSL_CTX_free(ctx);
 			return 0;
 		}
-			
-		
+
+
 		SSL_set_fd(data->ssl_handle, data->fd);

 		if (ftp->old_ssl) {
 			SSL_copy_session_id(data->ssl_handle, ftp->ssl_handle);
 		}
-			
+
 		if (SSL_connect(data->ssl_handle) <= 0) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "data_accept: SSL/TLS handshake failed");
 			SSL_shutdown(data->ssl_handle);
 			SSL_free(data->ssl_handle);
 			return 0;
 		}
-			
+
 		data->ssl_active = 1;
-	}	
+	}

 #endif

@@ -1567,14 +1567,14 @@ data_close(ftpbuf_t *ftp, databuf_t *data)
 {
 #if HAVE_OPENSSL_EXT
 	SSL_CTX		*ctx;
-#endif				
+#endif
 	if (data == NULL) {
 		return NULL;
 	}
 	if (data->listener != -1) {
 #if HAVE_OPENSSL_EXT
 		if (data->ssl_active) {
-		
+
 			ctx = SSL_get_SSL_CTX(data->ssl_handle);
 			SSL_CTX_free(ctx);

@@ -1582,9 +1582,9 @@ data_close(ftpbuf_t *ftp, databuf_t *data)
 			SSL_free(data->ssl_handle);
 			data->ssl_active = 0;
 		}
-#endif				
+#endif
 		closesocket(data->listener);
-	}	
+	}
 	if (data->fd != -1) {
 #if HAVE_OPENSSL_EXT
 		if (data->ssl_active) {
@@ -1595,9 +1595,9 @@ data_close(ftpbuf_t *ftp, databuf_t *data)
 			SSL_free(data->ssl_handle);
 			data->ssl_active = 0;
 		}
-#endif				
+#endif
 		closesocket(data->fd);
-	}	
+	}
 	if (ftp) {
 		ftp->data = NULL;
 	}
@@ -1615,8 +1615,8 @@ ftp_genlist(ftpbuf_t *ftp, const char *cmd, const char *path TSRMLS_DC)
 	databuf_t	*data = NULL;
 	char		*ptr;
 	int		ch, lastch;
-	int		size, rcvd;
-	int		lines;
+	size_t		size, rcvd;
+	size_t		lines;
 	char		**ret = NULL;
 	char		**entry;
 	char		*text;
@@ -1634,7 +1634,7 @@ ftp_genlist(ftpbuf_t *ftp, const char *cmd, const char *path TSRMLS_DC)
 	if ((data = ftp_getdata(ftp TSRMLS_CC)) == NULL) {
 		goto bail;
 	}
-	ftp->data = data;	
+	ftp->data = data;

 	if (!ftp_putcmd(ftp, cmd, path)) {
 		goto bail;
@@ -1658,7 +1658,7 @@ ftp_genlist(ftpbuf_t *ftp, const char *cmd, const char *path TSRMLS_DC)
 	lines = 0;
 	lastch = 0;
 	while ((rcvd = my_recv(ftp, data->fd, data->buf, FTP_BUFSIZE))) {
-		if (rcvd == -1) {
+		if (rcvd == -1 || rcvd > ((size_t)(-1))-size) {
 			goto bail;
 		}

@@ -1863,7 +1863,7 @@ ftp_nb_put(ftpbuf_t *ftp, const char *path, php_stream *instream, ftptype_t type
 	if (!ftp_getresp(ftp) || (ftp->resp != 150 && ftp->resp != 125)) {
 		goto bail;
 	}
-	if ((data = data_accept(data, ftp TSRMLS_CC)) == NULL) { 
+	if ((data = data_accept(data, ftp TSRMLS_CC)) == NULL) {
 		goto bail;
 	}
 	ftp->data = data;
@@ -1919,7 +1919,7 @@ ftp_nb_continue_write(ftpbuf_t *ftp TSRMLS_DC)
 		goto bail;
 	}
 	ftp->data = data_close(ftp, ftp->data);
- 
+
 	if (!ftp_getresp(ftp) || (ftp->resp != 226 && ftp->resp != 250)) {
 		goto bail;
 	}
@@ -1495,7 +1495,7 @@ PHP_FUNCTION(imageloadfont)
 	gdFontPtr font;
 	php_stream *stream;

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &file, &file_name) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &file, &file_name) == FAILURE) {
 		return;
 	}

@@ -2438,7 +2438,7 @@ static void _php_image_create_from(INTERNAL_FUNCTION_PARAMETERS, int image_type,
 	long ignore_warning;
 #endif
 	if (image_type == PHP_GDIMG_TYPE_GD2PART) {
-		if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "sllll", &file, &file_len, &srcx, &srcy, &width, &height) == FAILURE) {
+		if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "pllll", &file, &file_len, &srcx, &srcy, &width, &height) == FAILURE) {
 			return;
 		}
 		if (width < 1 || height < 1) {
@@ -2446,7 +2446,7 @@ static void _php_image_create_from(INTERNAL_FUNCTION_PARAMETERS, int image_type,
 			RETURN_FALSE;
 		}
 	} else {
-		if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &file, &file_len) == FAILURE) {
+		if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &file, &file_len) == FAILURE) {
 			return;
 		}
 	}
@@ -4178,7 +4178,7 @@ PHP_FUNCTION(imagepsencodefont)
 	char *enc, **enc_vector;
 	int enc_len, *f_ind;

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rs", &fnt, &enc, &enc_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rp", &fnt, &enc, &enc_len) == FAILURE) {
 		return;
 	}

@@ -124,6 +124,11 @@ static void _php_image_output_ctx(INTERNAL_FUNCTION_PARAMETERS, int image_type,
 				RETURN_FALSE;
 			}
 		} else if (Z_TYPE_P(to_zval) == IS_STRING) {
+			if (CHECK_ZVAL_NULL_PATH(to_zval)) {
+				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid 2nd parameter, filename must not contain null bytes");
+				RETURN_FALSE;
+			}
+
 			stream = php_stream_open_wrapper(Z_STRVAL_P(to_zval), "wb", REPORT_ERRORS|IGNORE_PATH|IGNORE_URL_WIN, NULL);
 			if (stream == NULL) {
 				RETURN_FALSE;
@@ -72,8 +72,10 @@ static struct {

 #define STACK_SIZE ((1<<(MAX_LWZ_BITS))*2)

+#define CSD_BUF_SIZE 280
+
 typedef struct {
-	unsigned char    buf[280];
+	unsigned char    buf[CSD_BUF_SIZE];
 	int              curbit, lastbit, done, last_byte;
 } CODE_STATIC_DATA;

@@ -398,9 +400,14 @@ GetCode_(gdIOCtx *fd, CODE_STATIC_DATA *scd, int code_size, int flag, int *ZeroD
 		scd->lastbit = (2+count)*8 ;
 	}

-	ret = 0;
-	for (i = scd->curbit, j = 0; j < code_size; ++i, ++j)
-		ret |= ((scd->buf[ i / 8 ] & (1 << (i % 8))) != 0) << j;
+	if ((scd->curbit + code_size - 1) >= (CSD_BUF_SIZE * 8)) {
+		ret = -1;
+	} else {
+		ret = 0;
+		for (i = scd->curbit, j = 0; j < code_size; ++i, ++j) {
+			ret |= ((scd->buf[i / 8] & (1 << (i % 8))) != 0) << j;
+		}
+	}

 	scd->curbit += code_size;
 	return ret;
@@ -370,9 +370,10 @@ static void *fontFetch (char **error, void *key)
 	fontlist = gdEstrdup(a->fontlist);

 	/*
-	 * Must use gd_strtok_r else pointer corrupted by strtok in nested loop.
+	 * Must use gd_strtok_r becasuse strtok() isn't thread safe
 	 */
 	for (name = gd_strtok_r (fontlist, LISTSEPARATOR, &strtok_ptr); name; name = gd_strtok_r (0, LISTSEPARATOR, &strtok_ptr)) {
+		char *strtok_ptr_path;
 		/* make a fresh copy each time - strtok corrupts it. */
 		path = gdEstrdup (fontsearchpath);

@@ -388,7 +389,8 @@ static void *fontFetch (char **error, void *key)
 				break;
 			}
 		}
-		for (dir = strtok (path, PATHSEPARATOR); dir; dir = strtok (0, PATHSEPARATOR)) {
+		for (dir = gd_strtok_r (path, PATHSEPARATOR, &strtok_ptr_path); dir;
+		     dir = gd_strtok_r (0, PATHSEPARATOR, &strtok_ptr_path)) {
 			if (!strcmp(dir, ".")) {
 				TSRMLS_FETCH();
 #if HAVE_GETCWD
@@ -20,6 +20,6 @@ echo '(' . $bbox[6] . ', ' . $bbox[7] . ")\n";
 ?>
 --EXPECTF--
 (-1, 15)
-(156, 15)
-(156, -48)
+(15%d, 15)
+(15%d, -48)
 (-1, -48)
@@ -0,0 +1,31 @@
+--TEST--
+Testing null byte injection in imagegd2
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagegd2 TEST\n";
+imagegd2($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagegd2 TEST
+
+Warning: imagegd2() expects parameter 2 to be a valid path, string given in %s on line %d
+bool(false)
+bool(false)
@@ -0,0 +1,31 @@
+--TEST--
+Testing null byte injection in imagegd
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagegd TEST\n";
+imagegd($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagegd TEST
+
+Warning: imagegd() expects parameter 2 to be a valid path, string given in %s on line %d
+bool(false)
+bool(false)
@@ -0,0 +1,38 @@
+--TEST--
+Testing null byte injection in imagegif
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--SKIPIF--
+<?php
+$support = gd_info();
+if (!isset($support['GIF Create Support']) || $support['GIF Create Support'] === false) {
+	print 'skip gif support not available';
+}
+?>
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagegif TEST\n";
+imagegif($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagegif TEST
+
+Warning: imagegif(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
+bool(false)
+bool(false)
@@ -0,0 +1,38 @@
+--TEST--
+Testing null byte injection in imagejpeg
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--SKIPIF--
+<?php
+$support = gd_info();
+if (!isset($support['JPEG Support']) || $support['JPEG Support'] === false) {
+	print 'skip jpeg support not available';
+}
+?>
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagejpeg TEST\n";
+imagejpeg($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagejpeg TEST
+
+Warning: imagejpeg(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
+bool(false)
+bool(false)
@@ -3,7 +3,7 @@ Testing that imageloadfont() breaks on non-string first parameter
 --CREDITS--
 Neveo Harrison <neveoo [at] gmail [dot] com> #testfest #tek11
 --SKIPIF--
-<?php 
+<?php
 	if (!extension_loaded("gd")) die("skip GD not present");
 ?>
 --FILE--
@@ -11,5 +11,5 @@ Neveo Harrison <neveoo [at] gmail [dot] com> #testfest #tek11
 var_dump( imageloadfont(array()) );
 ?>
 --EXPECTF--
-Warning: imageloadfont() expects parameter 1 to be string, array given in %s on line %d
-NULL
+Warning: imageloadfont() expects parameter 1 to be a valid path, array given in %s on line %d
+NULL
@@ -0,0 +1,38 @@
+--TEST--
+Testing null byte injection in imagepng
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--SKIPIF--
+<?php
+$support = gd_info();
+if (!isset($support['PNG Support']) || $support['PNG Support'] === false) {
+	print 'skip png support not available';
+}
+?>
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagepng TEST\n";
+imagepng($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagepng TEST
+
+Warning: imagepng(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
+bool(false)
+bool(false)
@@ -0,0 +1,38 @@
+--TEST--
+Testing null byte injection in imagewbmp
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--SKIPIF--
+<?php
+$support = gd_info();
+if (!isset($support['WBMP Support']) || $support['WBMP Support'] === false) {
+	print 'skip wbmp support not available';
+}
+?>
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagewbmp TEST\n";
+imagewbmp($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagewbmp TEST
+
+Warning: imagewbmp(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
+bool(false)
+bool(false)
@@ -0,0 +1,38 @@
+--TEST--
+Testing null byte injection in imagewebp
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--SKIPIF--
+<?php
+$support = gd_info();
+if (!isset($support['WEBP Support']) || $support['WEBP Support'] === false) {
+	print 'skip webp support not available';
+}
+?>
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagewebp TEST\n";
+imagewebp($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagewbmp TEST
+
+Warning: imagewebp(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
+bool(false)
+bool(false)
@@ -324,30 +324,6 @@ static void _php_gmpnum_free(zend_rsrc_list_entry *rsrc TSRMLS_DC);
 #	define MAX_BASE 36
 #endif

-/* {{{ gmp_emalloc
- */
-static void *gmp_emalloc(size_t size)
-{
-	return emalloc(size);
-}
-/* }}} */
-
-/* {{{ gmp_erealloc
- */
-static void *gmp_erealloc(void *ptr, size_t old_size, size_t new_size)
-{
-	return erealloc(ptr, new_size);
-}
-/* }}} */
-
-/* {{{ gmp_efree
- */
-static void gmp_efree(void *ptr, size_t size)
-{
-	efree(ptr);
-}
-/* }}} */
-
 /* {{{ ZEND_GINIT_FUNCTION
 */
 static ZEND_GINIT_FUNCTION(gmp)
@@ -369,8 +345,6 @@ ZEND_MODULE_STARTUP_D(gmp)
 #endif
 	REGISTER_STRING_CONSTANT("GMP_VERSION", (char *)gmp_version, CONST_CS | CONST_PERSISTENT);

-	mp_set_memory_functions(gmp_emalloc, gmp_erealloc, gmp_efree);
-
 	return SUCCESS;
 }
 /* }}} */
@@ -142,6 +142,7 @@ static void php_hash_do_hash(INTERNAL_FUNCTION_PARAMETERS, int isfilename, zend_
 	}
 	if (isfilename) {
 		if (CHECK_NULL_PATH(data, data_len)) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
 			RETURN_FALSE;
 		}
 		stream = php_stream_open_wrapper_ex(data, "rb", REPORT_ERRORS, NULL, DEFAULT_CONTEXT);
@@ -222,6 +223,10 @@ static void php_hash_do_hash_hmac(INTERNAL_FUNCTION_PARAMETERS, int isfilename,
 		RETURN_FALSE;
 	}
 	if (isfilename) {
+		if (CHECK_NULL_PATH(data, data_len)) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+			RETURN_FALSE;
+		}
 		stream = php_stream_open_wrapper_ex(data, "rb", REPORT_ERRORS, NULL, DEFAULT_CONTEXT);
 		if (!stream) {
 			/* Stream will report errors opening file */
@@ -449,7 +454,7 @@ PHP_FUNCTION(hash_update_file)
 	char *filename, buf[1024];
 	int filename_len, n;

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rs|r", &zhash, &filename, &filename_len, &zcontext) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rp|r", &zhash, &filename, &filename_len, &zcontext) == FAILURE) {
 		return;
 	}

@@ -28,6 +28,9 @@ hash_hmac_file('crc32', $file, $key, TRUE, $extra_arg);
 echo "\n-- Testing hash_hmac_file() function with invalid hash algorithm --\n";
 hash_hmac_file('foo', $file, $key, TRUE);

+echo "\n-- Testing hash_hmac_file() function with bad path --\n";
+hash_hmac_file('crc32', $file.chr(0).$file, $key, TRUE);
+
 ?>
 ===Done===
 --EXPECTF--
@@ -51,4 +54,8 @@ Warning: hash_hmac_file() expects at most 4 parameters, 5 given in %s on line %d
 -- Testing hash_hmac_file() function with invalid hash algorithm --

 Warning: hash_hmac_file(): Unknown hashing algorithm: foo in %s on line %d
+
+-- Testing hash_hmac_file() function with bad path --
+
+Warning: hash_hmac_file(): Invalid path in %s on line %d
 ===Done===
@@ -368,7 +368,7 @@ static int json_utf8_to_utf16(unsigned short *utf16, char utf8[], int len) /* {{
 			}
 		}
 	} else {
-		/* Only check if utf8 string is valid, and compute utf16 lenght */
+		/* Only check if utf8 string is valid, and compute utf16 length */
 		for (j=0 ; pos < len ; j++) {
 			us = php_next_utf8_char((const unsigned char *)utf8, len, &pos, &status);
 			if (status != SUCCESS) {
@@ -385,6 +385,23 @@ static int _get_lderrno(LDAP *ldap)
 }
 /* }}} */

+/* {{{ _set_lderrno
+ */
+static void _set_lderrno(LDAP *ldap, int lderr)
+{
+#if !HAVE_NSLDAP
+#if LDAP_API_VERSION > 2000 || HAVE_ORALDAP
+	/* New versions of OpenLDAP do it this way */
+	ldap_set_option(ldap, LDAP_OPT_ERROR_NUMBER, &lderr);
+#else
+	ldap->ld_errno = lderr;
+#endif
+#else
+	ldap_set_lderrno(ldap, lderr, NULL, NULL);
+#endif
+}
+/* }}} */
+
 /* {{{ proto bool ldap_bind(resource link [, string dn [, string password]])
   Bind to LDAP directory */
 PHP_FUNCTION(ldap_bind)
@@ -399,18 +416,20 @@ PHP_FUNCTION(ldap_bind)
 		RETURN_FALSE;
 	}

+	ZEND_FETCH_RESOURCE(ld, ldap_linkdata *, &link, -1, "ldap link", le_link);
+
 	if (ldap_bind_dn != NULL && memchr(ldap_bind_dn, '\0', ldap_bind_dnlen) != NULL) {
+		_set_lderrno(ld->link, LDAP_INVALID_CREDENTIALS);
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "DN contains a null byte");
 		RETURN_FALSE;
 	}

 	if (ldap_bind_pw != NULL && memchr(ldap_bind_pw, '\0', ldap_bind_pwlen) != NULL) {
+		_set_lderrno(ld->link, LDAP_INVALID_CREDENTIALS);
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Password contains a null byte");
 		RETURN_FALSE;
 	}

-	ZEND_FETCH_RESOURCE(ld, ldap_linkdata *, &link, -1, "ldap link", le_link);
-
 	if ((rc = ldap_bind_s(ld->link, ldap_bind_dn, ldap_bind_pw, LDAP_AUTH_SIMPLE)) != LDAP_SUCCESS) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to bind to server: %s", ldap_err2string(rc));
 		RETURN_FALSE;
@@ -260,7 +260,7 @@ const mbfl_encoding *_php_mb_encoding_handler_ex(const php_mb_encoding_handler_i
 		goto out;
 	}

-	num = n; /* make sure to process initilized vars only */
+	num = n; /* make sure to process initialized vars only */
 	
 	/* initialize converter */
 	if (info->num_from_encodings <= 0) {
@@ -619,8 +619,11 @@ PHP_FUNCTION(mcrypt_generic_init)

 	if (iv_len != iv_size) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Iv size incorrect; supplied length: %d, needed: %d", iv_len, iv_size);
+		if (iv_len > iv_size) {
+			iv_len = iv_size;
+		}
 	}
-	memcpy(iv_s, iv, iv_size);
+	memcpy(iv_s, iv, iv_len);

 	mcrypt_generic_deinit(pm->td);
 	result = mcrypt_generic_init(pm->td, key_s, key_size, iv_s);
@@ -641,8 +644,9 @@ PHP_FUNCTION(mcrypt_generic_init)
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unknown error");
 				break;
 		}
+	} else {
+		pm->init = 1;
 	}
-	pm->init = 1;
 	RETVAL_LONG(result);

 	efree(iv_s);
@@ -62,18 +62,18 @@ mysqli_close($link);
 --EXPECT--
 array(7) {
  [0]=>
-  float(3.14159274101)
+  float(3.141593)
  [1]=>
-  float(-9.99999997475E-7)
+  float(-1.0E-6)
  [2]=>
  float(0)
  [3]=>
-  float(999999995904)
+  float(1.0E+12)
  [4]=>
-  float(0.564642488956)
+  float(0.5646425)
  [5]=>
  float(1)
  [6]=>
-  float(8.88888914608E+14)
+  float(8.888889E+14)
 }
-done!
+done!
@@ -67,7 +67,7 @@ array(8) {
  [3]=>
  int(4999999)
  [4]=>
-  float(2345.60009766)
+  float(2345.6)
  [5]=>
  float(5678.89563)
  [6]=>
@@ -75,4 +75,4 @@ array(8) {
  [7]=>
  %unicode|string%(11) "mysql rulez"
 }
-done!
+done!
@@ -66,7 +66,7 @@ array(8) {
  [3]=>
  int(54)
  [4]=>
-  float(2.59999990463)
+  float(2.6)
  [5]=>
  float(58.89)
  [6]=>
@@ -74,4 +74,4 @@ array(8) {
  [7]=>
  %unicode|string%(3) "6.7"
 }
-done!
+done!
@@ -0,0 +1,58 @@
+--TEST--
+mysqli_float_handling - ensure 4 byte float is handled correctly
+--SKIPIF--
+<?php
+	require_once('skipif.inc');
+	require_once('skipifemb.inc');
+	require_once('skipifconnectfailure.inc');
+?>
+--FILE--
+<?php
+	require('connect.inc');
+	if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket)) {
+		printf("[001] [%d] %s\n", mysqli_connect_errno(), mysqli_connect_error());
+		die();
+	}
+
+
+	if (!mysqli_query($link, "DROP TABLE IF EXISTS test")) {
+		printf("[002] [%d] %s\n", mysqli_errno($link), mysqli_error($link));
+		die();
+	}
+
+	if (!mysqli_query($link, "CREATE TABLE test(id INT PRIMARY KEY, fp4 FLOAT, fp8 DOUBLE) ENGINE = InnoDB")) {
+		printf("[003] [%d] %s\n", mysqli_errno($link), mysqli_error($link));
+		die();
+	}
+
+	// Insert via string to make sure the real floating number gets to the DB
+	if (!mysqli_query($link, "INSERT INTO test(id, fp4, fp8) VALUES (1, 9.9999, 9.9999)")) {
+		printf("[004] [%d] %s\n", mysqli_errno($link), mysqli_error($link));
+		die();
+	}
+
+	if (!($stmt = mysqli_prepare($link, "SELECT id, fp4, fp8 FROM test"))) {
+		printf("[005] [%d] %s\n", mysqli_errno($link), mysqli_error($link));
+		die();
+	}
+
+	if (!mysqli_stmt_execute($stmt)) {
+		printf("[006] [%d] %s\n", mysqli_errno($link), mysqli_error($link));
+		die();
+	}
+
+
+	if (!($result = mysqli_stmt_get_result($stmt))) {
+		printf("[007] [%d] %s\n", mysqli_errno($link), mysqli_error($link));
+		die();
+	}
+
+	$data = mysqli_fetch_assoc($result);
+	print $data['id'] . ": " . $data['fp4'] . ": " . $data['fp8'] . "\n";
+?>
+--CLEAN--
+<?php
+	require_once("clean_table.inc");
+?>
+--EXPECTF--
+1: 9.9999: 9.9999
@@ -41,6 +41,11 @@ require_once('skipifconnectfailure.inc');
 	if (false !== ($tmp = mysqli_change_user($link, $user, $passwd, $db . '_unknown_really')))
 		printf("[009] Expecting false, got %s/%s\n", gettype($tmp), $tmp);

+	// Reconnect because after 3 failed change_user attempts, the server blocks you off.
+	if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
+		printf("[006] Cannot connect to the server using host=%s, user=%s, passwd=***, dbname=%s, port=%s, socket=%s\n",
+			$host, $user, $db, $port, $socket);
+
 	if (!mysqli_query($link, 'SET @mysqli_change_user_test_var=1'))
 		printf("[010] Failed to set test variable: [%d] %s\n", mysqli_errno($link), mysqli_error($link));

@@ -109,4 +114,4 @@ require_once('skipifconnectfailure.inc');
 	print "done!";
 ?>
 --EXPECTF--
-done!
+done!
@@ -43,6 +43,11 @@ if (!$IS_MYSQLND && (mysqli_get_server_version($link) < 50118 && mysqli_get_serv
 	if (false !== ($tmp = $mysqli->change_user($user, $passwd, $db . '_unknown_really')))
 		printf("[008] Expecting false, got %s/%s\n", gettype($tmp), $tmp);

+	// Reconnect because after 3 failed change_user attempts, the server blocks you off.
+	if (!$mysqli = new my_mysqli($host, $user, $passwd, $db, $port, $socket))
+		printf("[001] Cannot connect to the server using host=%s, user=%s, passwd=***, dbname=%s, port=%s, socket=%s\n",
+			$host, $user, $db, $port, $socket);
+
 	if (!$mysqli->query('SET @mysqli_change_user_test_var=1'))
 		printf("[009] Failed to set test variable: [%d] %s\n", $mysqli->errno, $mysqli->error);

@@ -81,4 +86,4 @@ if (!$IS_MYSQLND && (mysqli_get_server_version($link) < 50118 && mysqli_get_serv
 	print "done!";
 ?>
 --EXPECTF--
-done!
+done!
@@ -36,7 +36,7 @@ $port, $socket, mysqli_connect_errno(), mysqli_connect_error());
 mysqli_error($link));
 	}

-	if (!mysqli_query($link, 'CREATE TABLE test(id INT, label CHAR(1), PRIMARY
+	if (!mysqli_query($link, 'CREATE TABLE test(id INT, label CHAR(3), PRIMARY
 KEY(id)) ENGINE=' . $engine . " DEFAULT CHARSET=gbk")) {
 		printf("Failed to create test table: [%d] %s\n", mysqli_errno($link),
 mysqli_error($link));
@@ -12,6 +12,11 @@ if (!mysqli_query($link, 'DROP TABLE IF EXISTS test')) {
 	exit(1);
 }

+if (!mysqli_query($link, 'SET SESSION sql_mode=\'\'')) {
+	printf("Failed to drop old test table: [%d] %s\n", mysqli_errno($link), mysqli_error($link));
+	exit(1);
+}
+
 if (!mysqli_query($link, 'CREATE TABLE test(id INT, label CHAR(1), PRIMARY KEY(id)) ENGINE=' . $engine)) {
 	printf("Failed to create test table: [%d] %s\n", mysqli_errno($link), mysqli_error($link));
 	exit(1);
@@ -20,4 +25,4 @@ if (!mysqli_query($link, 'CREATE TABLE test(id INT, label CHAR(1), PRIMARY KEY(i
 if (!mysqli_query($link, "INSERT INTO test(id, label) VALUES (1, 'a'), (2, 'b'), (3, 'c'), (4, 'd'), (5, 'e'), (6, 'f')")) {
 	printf("[%d] %s\n",  mysqli_errno($link), mysqli_error($link));
 }
-?>
+?>
@@ -51,3 +51,29 @@ if test "$PHP_MYSQLND" != "no" || test "$PHP_MYSQLND_ENABLED" = "yes" || test "$
 #endif
  ])
 fi
+
+dnl
+dnl Check if the compiler supports Decimal32/64/128 types from the IEEE-754 2008 version
+dnl References: http://www.open-std.org/jtc1/sc22/wg14/www/docs/n1657.pdf
+dnl http://speleotrove.com/decimal/
+dnl
+AC_CACHE_CHECK([whether whether compiler supports Decimal32/64/128 types], ac_cv_decimal_fp_supported,[
+AC_TRY_RUN( [
+#include <stdio.h>
+
+int main(int argc, char **argv) {
+	typedef float dec32 __attribute__((mode(SD)));
+	dec32 k = 99.49f;
+	double d2 = (double)k;
+	return 0;
+}
+],[
+  ac_cv_decimal_fp_supported=yes
+],[
+  ac_cv_decimal_fp_supported=no
+],[
+  ac_cv_decimal_fp_supported=no
+])])
+if test "$ac_cv_decimal_fp_supported" = "yes"; then
+  AC_DEFINE(HAVE_DECIMAL_FP_SUPPORT, 1, [Define if the compiler supports Decimal32/64/128 types.])
+fi
@@ -195,12 +195,53 @@ void ps_fetch_float(zval *zv, const MYSQLND_FIELD * const field,
 					unsigned int pack_len, zend_uchar **row,
 					zend_bool as_unicode TSRMLS_DC)
 {
-	float value;
+	float fval;
+	double dval;
 	DBG_ENTER("ps_fetch_float");
-	float4get(value, *row);
-	ZVAL_DOUBLE(zv, value);
+	float4get(fval, *row);
 	(*row)+= 4;
-	DBG_INF_FMT("value=%f", value);
+	DBG_INF_FMT("value=%f", fval);
+
+	/*
+	 * The following is needed to correctly support 4-byte floats.
+	 * Otherwise, a value of 9.99 in a FLOAT column comes out of mysqli
+	 * as 9.9998998641968.
+	 *
+	 * For GCC, we use the built-in decimal support to "up-convert" a
+	 * 4-byte float to a 8-byte double.
+	 * When that is not available, we fall back to converting the float
+	 * to a string and then converting the string to a double. This mimics
+	 * what MySQL does.
+	 */
+#ifdef HAVE_DECIMAL_FP_SUPPORT
+	{
+		typedef float dec32 __attribute__((mode(SD)));
+		dec32 d32val = fval;
+
+		/* The following cast is guaranteed to do the right thing */
+		dval = (double) d32val;
+	}
+#else
+	{
+		char num_buf[2048]; /* Over allocated */
+		char *s;
+
+		/* Convert to string. Ignoring localization, etc.
+		 * Following MySQL's rules. If precision is undefined (NOT_FIXED_DEC i.e. 31)
+		 * or larger than 31, the value is limited to 6 (FLT_DIG).
+		 */
+		s = php_gcvt(fval,
+			     field->decimals >= 31 ? 6 : field->decimals,
+			     '.',
+			     'e',
+			     num_buf);
+
+		/* And now convert back to double */
+		dval = zend_strtod(s, NULL);
+	}
+#endif
+
+	ZVAL_DOUBLE(zv, dval);
 	DBG_VOID_RETURN;
 }
 /* }}} */
@@ -518,7 +518,7 @@ mysqlnd_query_read_result_set_header(MYSQLND_CONN_DATA * conn, MYSQLND_STMT * s
 						conn->current_result = NULL;
 					} else {
 						stmt->result = NULL;
-						memset(stmt, 0, sizeof(MYSQLND_STMT));
+						memset(stmt, 0, sizeof(*stmt));
 						stmt->state = MYSQLND_STMT_INITTED;
 					}
 				} else {
@@ -1182,7 +1182,7 @@ MYSQLND_METHOD(mysqlnd_res, store_result_fetch_data)(MYSQLND_CONN_DATA * const c
 		  No need to FREE_ALLOCA as we can reuse the
 		  'lengths' and 'fields' arrays. For lengths its absolutely safe.
 		  'fields' is reused because the ownership of the strings has been
-		  transfered above. 
+		  transferred above.
 		*/
 	}
 	/* Overflow ? */
@@ -4556,14 +4556,14 @@ int php_openssl_apply_verification_policy(SSL *ssl, X509 *peer, php_stream *stre
 			return FAILURE;
 		}

-		match = strcmp(cnmatch, buf) == 0;
+		match = strcasecmp(cnmatch, buf) == 0;
 		if (!match && strlen(buf) > 3 && buf[0] == '*' && buf[1] == '.') {
 			/* Try wildcard */

 			if (strchr(buf+2, '.')) {
 				char *tmp = strstr(cnmatch, buf+1);

-				match = tmp && strcmp(tmp, buf+2) && tmp == strchr(cnmatch, '.');
+				match = tmp && strcasecmp(tmp, buf+2) && tmp == strchr(cnmatch, '.');
 			}
 		}

@@ -204,59 +204,13 @@ static size_t php_openssl_sockop_write(php_stream *stream, const char *buf, size
 	return didwrite;
 }

-static void php_openssl_stream_wait_for_data(php_netstream_data_t *sock)
-{
-	int retval;
-	struct timeval *ptimeout;
-
-	if (sock->socket == -1) {
-		return;
-	}
-	
-	sock->timeout_event = 0;
-
-	if (sock->timeout.tv_sec == -1)
-		ptimeout = NULL;
-	else
-		ptimeout = &sock->timeout;
-
-	while(1) {
-		retval = php_pollfd_for(sock->socket, PHP_POLLREADABLE, ptimeout);
-
-		if (retval == 0)
-			sock->timeout_event = 1;
-
-		if (retval >= 0)
-			break;
-
-		if (php_socket_errno() != EINTR)
-			break;
-	}
-}
-
 static size_t php_openssl_sockop_read(php_stream *stream, char *buf, size_t count TSRMLS_DC)
 {
 	php_openssl_netstream_data_t *sslsock = (php_openssl_netstream_data_t*)stream->abstract;
-	php_netstream_data_t *sock;
 	int nr_bytes = 0;

 	if (sslsock->ssl_active) {
 		int retry = 1;
-		sock = (php_netstream_data_t*)stream->abstract;
-
-		/* The SSL_read() function will block indefinitely waiting for data on a blocking
-		   socket. If we don't poll for readability first this operation has the potential
-		   to hang forever. To avoid this scenario we poll with a timeout before performing
-		   the actual read. If it times out we're finished.
-		*/
-		if (sock->is_blocked) {
-			php_openssl_stream_wait_for_data(sock);
-			if (sock->timeout_event) {
-				stream->eof = 1;
-				php_error_docref(NULL TSRMLS_CC, E_WARNING, "SSL read operation timed out");
-				return nr_bytes;
-			}
-		}

 		do {
 			nr_bytes = SSL_read(sslsock->ssl_handle, buf, count);
@@ -198,7 +198,7 @@ ZEND_GET_MODULE(pcntl)

 static void pcntl_signal_handler(int);
 static void pcntl_signal_dispatch();
-  
+
 void php_register_signal_constants(INIT_FUNC_ARGS)
 {

@@ -234,7 +234,7 @@ void php_register_signal_constants(INIT_FUNC_ARGS)
 	REGISTER_LONG_CONSTANT("SIGTERM",  (long) SIGTERM, CONST_CS | CONST_PERSISTENT);
 #ifdef SIGSTKFLT
 	REGISTER_LONG_CONSTANT("SIGSTKFLT",(long) SIGSTKFLT, CONST_CS | CONST_PERSISTENT);
-#endif 
+#endif
 #ifdef SIGCLD
 	REGISTER_LONG_CONSTANT("SIGCLD",   (long) SIGCLD, CONST_CS | CONST_PERSISTENT);
 #endif
@@ -484,7 +484,7 @@ static void php_pcntl_register_errno_constants(INIT_FUNC_ARGS)
 }

 static PHP_GINIT_FUNCTION(pcntl)
-{ 
+{
 	memset(pcntl_globals, 0, sizeof(*pcntl_globals));
 }

@@ -547,7 +547,7 @@ PHP_FUNCTION(pcntl_fork)
 		PCNTL_G(last_error) = errno;
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Error %d", errno);
 	}
-	
+
 	RETURN_LONG((long) id);
 }
 /* }}} */
@@ -560,7 +560,7 @@ PHP_FUNCTION(pcntl_alarm)

 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "l", &seconds) == FAILURE)
 		return;
-	
+
 	RETURN_LONG ((long) alarm(seconds));
 }
 /* }}} */
@@ -576,7 +576,7 @@ PHP_FUNCTION(pcntl_waitpid)

 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "lz|l", &pid, &z_status, &options) == FAILURE)
 		return;
-	
+
 	convert_to_long_ex(&z_status);

 	status = Z_LVAL_P(z_status);
@@ -604,7 +604,7 @@ PHP_FUNCTION(pcntl_wait)

 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "z|l", &z_status, &options) == FAILURE)
 		return;
-	
+
 	convert_to_long_ex(&z_status);

 	status = Z_LVAL_P(z_status);
@@ -628,7 +628,7 @@ PHP_FUNCTION(pcntl_wait)
 }
 /* }}} */

-/* {{{ proto bool pcntl_wifexited(int status) 
+/* {{{ proto bool pcntl_wifexited(int status)
   Returns true if the child status code represents a successful exit */
 PHP_FUNCTION(pcntl_wifexited)
 {
@@ -646,7 +646,7 @@ PHP_FUNCTION(pcntl_wifexited)
 }
 /* }}} */

-/* {{{ proto bool pcntl_wifstopped(int status) 
+/* {{{ proto bool pcntl_wifstopped(int status)
   Returns true if the child status code represents a stopped process (WUNTRACED must have been used with waitpid) */
 PHP_FUNCTION(pcntl_wifstopped)
 {
@@ -664,7 +664,7 @@ PHP_FUNCTION(pcntl_wifstopped)
 }
 /* }}} */

-/* {{{ proto bool pcntl_wifsignaled(int status) 
+/* {{{ proto bool pcntl_wifsignaled(int status)
   Returns true if the child status code represents a process that was terminated due to a signal */
 PHP_FUNCTION(pcntl_wifsignaled)
 {
@@ -682,7 +682,7 @@ PHP_FUNCTION(pcntl_wifsignaled)
 }
 /* }}} */

-/* {{{ proto int pcntl_wexitstatus(int status) 
+/* {{{ proto int pcntl_wexitstatus(int status)
   Returns the status code of a child's exit */
 PHP_FUNCTION(pcntl_wexitstatus)
 {
@@ -700,7 +700,7 @@ PHP_FUNCTION(pcntl_wexitstatus)
 }
 /* }}} */

-/* {{{ proto int pcntl_wtermsig(int status) 
+/* {{{ proto int pcntl_wtermsig(int status)
   Returns the number of the signal that terminated the process who's status code is passed  */
 PHP_FUNCTION(pcntl_wtermsig)
 {
@@ -718,7 +718,7 @@ PHP_FUNCTION(pcntl_wtermsig)
 }
 /* }}} */

-/* {{{ proto int pcntl_wstopsig(int status) 
+/* {{{ proto int pcntl_wstopsig(int status)
   Returns the number of the signal that caused the process to stop who's status code is passed */
 PHP_FUNCTION(pcntl_wstopsig)
 {
@@ -754,19 +754,19 @@ PHP_FUNCTION(pcntl_exec)
 	char *path;
 	int path_len;
 	ulong key_num;
-		
-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|aa", &path, &path_len, &args, &envs) == FAILURE) {
+
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|aa", &path, &path_len, &args, &envs) == FAILURE) {
 		return;
 	}
-	
+
 	if (ZEND_NUM_ARGS() > 1) {
 		/* Build argument list */
 		args_hash = HASH_OF(args);
 		argc = zend_hash_num_elements(args_hash);
-		
+
 		argv = safe_emalloc((argc + 2), sizeof(char *), 0);
 		*argv = path;
-		for ( zend_hash_internal_pointer_reset(args_hash), current_arg = argv+1; 
+		for ( zend_hash_internal_pointer_reset(args_hash), current_arg = argv+1;
 			(argi < argc && (zend_hash_get_current_data(args_hash, (void **) &element) == SUCCESS));
 			(argi++, current_arg++, zend_hash_move_forward(args_hash)) ) {

@@ -784,9 +784,9 @@ PHP_FUNCTION(pcntl_exec)
 		/* Build environment pair list */
 		envs_hash = HASH_OF(envs);
 		envc = zend_hash_num_elements(envs_hash);
-		
+
 		envp = safe_emalloc((envc + 1), sizeof(char *), 0);
-		for ( zend_hash_internal_pointer_reset(envs_hash), pair = envp; 
+		for ( zend_hash_internal_pointer_reset(envs_hash), pair = envp;
 			(envi < envc && (zend_hash_get_current_data(envs_hash, (void **) &element) == SUCCESS));
 			(envi++, pair++, zend_hash_move_forward(envs_hash)) ) {
 			switch (return_val = zend_hash_get_current_key_ex(envs_hash, &key, &key_length, &key_num, 0, NULL)) {
@@ -802,13 +802,13 @@ PHP_FUNCTION(pcntl_exec)

 			convert_to_string_ex(element);

-			/* Length of element + equal sign + length of key + null */ 
+			/* Length of element + equal sign + length of key + null */
 			pair_length = Z_STRLEN_PP(element) + key_length + 2;
 			*pair = emalloc(pair_length);
-			strlcpy(*pair, key, key_length); 
+			strlcpy(*pair, key, key_length);
 			strlcat(*pair, "=", pair_length);
 			strlcat(*pair, Z_STRVAL_PP(element), pair_length);
-			
+
 			/* Cleanup */
 			if (return_val == HASH_KEY_IS_LONG) efree(key);
 		}
@@ -818,7 +818,7 @@ PHP_FUNCTION(pcntl_exec)
 			PCNTL_G(last_error) = errno;
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Error has occurred: (errno %d) %s", errno, strerror(errno));
 		}
-	
+
 		/* Cleanup */
 		for (pair = envp; *pair != NULL; pair++) efree(*pair);
 		efree(envp);
@@ -831,7 +831,7 @@ PHP_FUNCTION(pcntl_exec)
 	}

 	efree(argv);
-	
+
 	RETURN_FALSE;
 }
 /* }}} */
@@ -880,7 +880,7 @@ PHP_FUNCTION(pcntl_signal)
 		}
 		RETURN_TRUE;
 	}
-	
+
 	if (!zend_is_callable(handle, 0, &func_name TSRMLS_CC)) {
 		PCNTL_G(last_error) = EINVAL;
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "%s is not a callable function name error", func_name);
@@ -888,11 +888,11 @@ PHP_FUNCTION(pcntl_signal)
 		RETURN_FALSE;
 	}
 	efree(func_name);
-	
+
 	/* Add the function name to our signal table */
 	zend_hash_index_update(&PCNTL_G(php_signal_table), signo, (void **) &handle, sizeof(zval *), (void **) &dest_handle);
 	if (dest_handle) zval_add_ref(dest_handle);
-	
+
 	if (php_signal4(signo, pcntl_signal_handler, (int) restart_syscalls, 1) == SIG_ERR) {
 		PCNTL_G(last_error) = errno;
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Error assigning signal");
@@ -1029,7 +1029,7 @@ static void pcntl_sigwaitinfo(INTERNAL_FUNCTION_PARAMETERS, int timedwait) /* {{
 	}

 	/*
-	 * sigtimedwait and sigwaitinfo can return 0 on success on some 
+	 * sigtimedwait and sigwaitinfo can return 0 on success on some
 	 * platforms, e.g. NetBSD
 	 */
 	if (!signo && siginfo.si_signo) {
@@ -1077,7 +1077,7 @@ static void pcntl_sigwaitinfo(INTERNAL_FUNCTION_PARAMETERS, int timedwait) /* {{
 			EMPTY_SWITCH_DEFAULT_CASE();
 		}
 	}
-	
+
 	RETURN_LONG(signo);
 }
 /* }}} */
@@ -1107,12 +1107,12 @@ PHP_FUNCTION(pcntl_getpriority)
 	long who = PRIO_PROCESS;
 	long pid = getpid();
 	int pri;
-	
+
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|ll", &pid, &who) == FAILURE) {
 		RETURN_FALSE;
 	}

-	/* needs to be cleared, since any returned value is valid */ 
+	/* needs to be cleared, since any returned value is valid */
 	errno = 0;

 	pri = getpriority(who, pid);
@@ -1172,7 +1172,7 @@ PHP_FUNCTION(pcntl_setpriority)
 		}
 		RETURN_FALSE;
 	}
-	
+
 	RETURN_TRUE;
 }
 /* }}} */
@@ -1205,7 +1205,7 @@ static void pcntl_signal_handler(int signo)
 {
 	struct php_pcntl_pending_signal *psig;
 	TSRMLS_FETCH();
-	
+
 	psig = PCNTL_G(spares);
 	if (!psig) {
 		/* oops, too many signals for us to track, so we'll forget about this one */
@@ -1233,7 +1233,7 @@ void pcntl_signal_dispatch()
 	sigset_t mask;
 	sigset_t old_mask;
 	TSRMLS_FETCH();
-		
+
 	/* Mask all signals */
 	sigfillset(&mask);
 	sigprocmask(SIG_BLOCK, &mask, &old_mask);
@@ -1249,7 +1249,7 @@ void pcntl_signal_dispatch()

 	queue = PCNTL_G(head);
 	PCNTL_G(head) = NULL; /* simple stores are atomic */
-	
+
 	/* Allocate */

 	while (queue) {
@@ -1274,7 +1274,7 @@ void pcntl_signal_dispatch()

 	/* Re-enable queue */
 	PCNTL_G(processing_signal_queue) = 0;
-	
+
 	/* return signal mask to previous state */
 	sigprocmask(SIG_SETMASK, &old_mask, NULL);
 }
@@ -3,7 +3,7 @@

 EXTENSION("pcre", "php_pcre.c", false /* never shared */,
 		"-Iext/pcre/pcrelib");
-ADD_SOURCES("ext/pcre/pcrelib", "pcre_chartables.c pcre_ucd.c pcre_compile.c pcre_config.c pcre_exec.c pcre_fullinfo.c pcre_get.c pcre_globals.c pcre_maketables.c pcre_newline.c pcre_ord2utf8.c pcre_refcount.c pcre_study.c pcre_tables.c pcre_valid_utf8.c pcre_version.c pcre_xclass.c", "pcre");
+ADD_SOURCES("ext/pcre/pcrelib", "pcre_chartables.c pcre_ucd.c pcre_compile.c pcre_config.c pcre_exec.c pcre_fullinfo.c pcre_get.c pcre_globals.c pcre_maketables.c pcre_newline.c pcre_ord2utf8.c pcre_refcount.c pcre_study.c pcre_tables.c pcre_valid_utf8.c pcre_version.c pcre_xclass.c pcre_jit_compile.c", "pcre");
 ADD_DEF_FILE("ext\\pcre\\php_pcre.def");

 AC_DEFINE('HAVE_BUNDLED_PCRE', 1, 'Using bundled PCRE library');
@@ -58,7 +58,8 @@ PHP_ARG_WITH(pcre-regex,,
    				 pcrelib/pcre_maketables.c pcrelib/pcre_newline.c \
    				 pcrelib/pcre_ord2utf8.c pcrelib/pcre_refcount.c pcrelib/pcre_study.c \
    				 pcrelib/pcre_tables.c pcrelib/pcre_valid_utf8.c \
-    				 pcrelib/pcre_version.c pcrelib/pcre_xclass.c"
+    				 pcrelib/pcre_version.c pcrelib/pcre_xclass.c \
+    				 pcrelib/pcre_jit_compile.c"
    PHP_PCRE_CFLAGS="-DHAVE_CONFIG_H -I@ext_srcdir@/pcrelib"
    PHP_NEW_EXTENSION(pcre, $pcrelib_sources php_pcre.c, no,,$PHP_PCRE_CFLAGS)
    PHP_ADD_BUILD_DIR($ext_builddir/pcrelib)
@@ -8,7 +8,7 @@ Email domain:     cam.ac.uk
 University of Cambridge Computing Service,
 Cambridge, England.

-Copyright (c) 1997-2012 University of Cambridge
+Copyright (c) 1997-2015 University of Cambridge
 All rights reserved


@@ -19,7 +19,7 @@ Written by:       Zoltan Herczeg
 Email local part: hzmester
 Emain domain:     freemail.hu

-Copyright(c) 2010-2012 Zoltan Herczeg
+Copyright(c) 2010-2015 Zoltan Herczeg
 All rights reserved.


@@ -30,7 +30,7 @@ Written by:       Zoltan Herczeg
 Email local part: hzmester
 Emain domain:     freemail.hu

-Copyright(c) 2009-2012 Zoltan Herczeg
+Copyright(c) 2009-2015 Zoltan Herczeg
 All rights reserved.


@@ -1,6 +1,766 @@
 ChangeLog for PCRE
 ------------------

+Version 8.37 28-April-2015
+--------------------------
+
+1.  When an (*ACCEPT) is triggered inside capturing parentheses, it arranges
+    for those parentheses to be closed with whatever has been captured so far.
+    However, it was failing to mark any other groups between the hightest
+    capture so far and the currrent group as "unset". Thus, the ovector for
+    those groups contained whatever was previously there. An example is the
+    pattern /(x)|((*ACCEPT))/ when matched against "abcd".
+
+2.  If an assertion condition was quantified with a minimum of zero (an odd
+    thing to do, but it happened), SIGSEGV or other misbehaviour could occur.
+
+3.  If a pattern in pcretest input had the P (POSIX) modifier followed by an
+    unrecognized modifier, a crash could occur.
+
+4.  An attempt to do global matching in pcretest with a zero-length ovector
+    caused a crash.
+
+5.  Fixed a memory leak during matching that could occur for a subpattern
+    subroutine call (recursive or otherwise) if the number of captured groups
+    that had to be saved was greater than ten.
+
+6.  Catch a bad opcode during auto-possessification after compiling a bad UTF
+    string with NO_UTF_CHECK. This is a tidyup, not a bug fix, as passing bad
+    UTF with NO_UTF_CHECK is documented as having an undefined outcome.
+
+7.  A UTF pattern containing a "not" match of a non-ASCII character and a
+    subroutine reference could loop at compile time. Example: /[^\xff]((?1))/.
+
+8. When a pattern is compiled, it remembers the highest back reference so that
+   when matching, if the ovector is too small, extra memory can be obtained to
+   use instead. A conditional subpattern whose condition is a check on a
+   capture having happened, such as, for example in the pattern
+   /^(?:(a)|b)(?(1)A|B)/, is another kind of back reference, but it was not
+   setting the highest backreference number. This mattered only if pcre_exec()
+   was called with an ovector that was too small to hold the capture, and there
+   was no other kind of back reference (a situation which is probably quite
+   rare). The effect of the bug was that the condition was always treated as
+   FALSE when the capture could not be consulted, leading to a incorrect
+   behaviour by pcre_exec(). This bug has been fixed.
+
+9. A reference to a duplicated named group (either a back reference or a test
+   for being set in a conditional) that occurred in a part of the pattern where
+   PCRE_DUPNAMES was not set caused the amount of memory needed for the pattern
+   to be incorrectly calculated, leading to overwriting.
+
+10. A mutually recursive set of back references such as (\2)(\1) caused a
+    segfault at study time (while trying to find the minimum matching length).
+    The infinite loop is now broken (with the minimum length unset, that is,
+    zero).
+
+11. If an assertion that was used as a condition was quantified with a minimum
+    of zero, matching went wrong. In particular, if the whole group had
+    unlimited repetition and could match an empty string, a segfault was
+    likely. The pattern (?(?=0)?)+ is an example that caused this. Perl allows
+    assertions to be quantified, but not if they are being used as conditions,
+    so the above pattern is faulted by Perl. PCRE has now been changed so that
+    it also rejects such patterns.
+
+12. A possessive capturing group such as (a)*+ with a minimum repeat of zero
+    failed to allow the zero-repeat case if pcre2_exec() was called with an
+    ovector too small to capture the group.
+
+13. Fixed two bugs in pcretest that were discovered by fuzzing and reported by
+    Red Hat Product Security:
+
+    (a) A crash if /K and /F were both set with the option to save the compiled
+    pattern.
+
+    (b) Another crash if the option to print captured substrings in a callout
+    was combined with setting a null ovector, for example \O\C+ as a subject
+    string.
+
+14. A pattern such as "((?2){0,1999}())?", which has a group containing a
+    forward reference repeated a large (but limited) number of times within a
+    repeated outer group that has a zero minimum quantifier, caused incorrect
+    code to be compiled, leading to the error "internal error:
+    previously-checked referenced subpattern not found" when an incorrect
+    memory address was read. This bug was reported as "heap overflow",
+    discovered by Kai Lu of Fortinet's FortiGuard Labs and given the CVE number
+    CVE-2015-2325.
+
+23. A pattern such as "((?+1)(\1))/" containing a forward reference subroutine
+    call within a group that also contained a recursive back reference caused
+    incorrect code to be compiled. This bug was reported as "heap overflow",
+    discovered by Kai Lu of Fortinet's FortiGuard Labs, and given the CVE
+    number CVE-2015-2326.
+
+24. Computing the size of the JIT read-only data in advance has been a source
+    of various issues, and new ones are still appear unfortunately. To fix
+    existing and future issues, size computation is eliminated from the code,
+    and replaced by on-demand memory allocation.
+
+25. A pattern such as /(?i)[A-`]/, where characters in the other case are
+    adjacent to the end of the range, and the range contained characters with
+    more than one other case, caused incorrect behaviour when compiled in UTF
+    mode. In that example, the range a-j was left out of the class.
+
+26. Fix JIT compilation of conditional blocks, which assertion
+    is converted to (*FAIL). E.g: /(?(?!))/.
+
+27. The pattern /(?(?!)^)/ caused references to random memory. This bug was
+    discovered by the LLVM fuzzer.
+
+28. The assertion (?!) is optimized to (*FAIL). This was not handled correctly
+    when this assertion was used as a condition, for example (?(?!)a|b). In
+    pcre2_match() it worked by luck; in pcre2_dfa_match() it gave an incorrect
+    error about an unsupported item.
+
+29. For some types of pattern, for example /Z*(|d*){216}/, the auto-
+    possessification code could take exponential time to complete. A recursion
+    depth limit of 1000 has been imposed to limit the resources used by this
+    optimization.
+
+30. A pattern such as /(*UTF)[\S\V\H]/, which contains a negated special class
+    such as \S in non-UCP mode, explicit wide characters (> 255) can be ignored
+    because \S ensures they are all in the class. The code for doing this was
+    interacting badly with the code for computing the amount of space needed to
+    compile the pattern, leading to a buffer overflow. This bug was discovered
+    by the LLVM fuzzer.
+
+31. A pattern such as /((?2)+)((?1))/ which has mutual recursion nested inside
+    other kinds of group caused stack overflow at compile time. This bug was
+    discovered by the LLVM fuzzer.
+
+32. A pattern such as /(?1)(?#?'){8}(a)/ which had a parenthesized comment
+    between a subroutine call and its quantifier was incorrectly compiled,
+    leading to buffer overflow or other errors. This bug was discovered by the
+    LLVM fuzzer.
+
+33. The illegal pattern /(?(?<E>.*!.*)?)/ was not being diagnosed as missing an
+    assertion after (?(. The code was failing to check the character after
+    (?(?< for the ! or = that would indicate a lookbehind assertion. This bug
+    was discovered by the LLVM fuzzer.
+
+34. A pattern such as /X((?2)()*+){2}+/ which has a possessive quantifier with
+    a fixed maximum following a group that contains a subroutine reference was
+    incorrectly compiled and could trigger buffer overflow. This bug was
+    discovered by the LLVM fuzzer.
+
+35. A mutual recursion within a lookbehind assertion such as (?<=((?2))((?1)))
+    caused a stack overflow instead of the diagnosis of a non-fixed length
+    lookbehind assertion. This bug was discovered by the LLVM fuzzer.
+
+36. The use of \K in a positive lookbehind assertion in a non-anchored pattern
+    (e.g. /(?<=\Ka)/) could make pcregrep loop.
+
+37. There was a similar problem to 36 in pcretest for global matches.
+
+38. If a greedy quantified \X was preceded by \C in UTF mode (e.g. \C\X*),
+    and a subsequent item in the pattern caused a non-match, backtracking over
+    the repeated \X did not stop, but carried on past the start of the subject,
+    causing reference to random memory and/or a segfault. There were also some
+    other cases where backtracking after \C could crash. This set of bugs was
+    discovered by the LLVM fuzzer.
+
+39. The function for finding the minimum length of a matching string could take
+    a very long time if mutual recursion was present many times in a pattern,
+    for example, /((?2){73}(?2))((?1))/. A better mutual recursion detection
+    method has been implemented. This infelicity was discovered by the LLVM
+    fuzzer.
+
+40. Static linking against the PCRE library using the pkg-config module was
+    failing on missing pthread symbols.
+
+
+Version 8.36 26-September-2014
+------------------------------
+
+1.  Got rid of some compiler warnings in the C++ modules that were shown up by
+    -Wmissing-field-initializers and -Wunused-parameter.
+
+2.  The tests for quantifiers being too big (greater than 65535) were being
+    applied after reading the number, and stupidly assuming that integer
+    overflow would give a negative number. The tests are now applied as the
+    numbers are read.
+
+3.  Tidy code in pcre_exec.c where two branches that used to be different are
+    now the same.
+
+4.  The JIT compiler did not generate match limit checks for certain
+    bracketed expressions with quantifiers. This may lead to exponential
+    backtracking, instead of returning with PCRE_ERROR_MATCHLIMIT. This
+    issue should be resolved now.
+
+5.  Fixed an issue, which occures when nested alternatives are optimized
+    with table jumps.
+
+6.  Inserted two casts and changed some ints to size_t in the light of some
+    reported 64-bit compiler warnings (Bugzilla 1477).
+
+7.  Fixed a bug concerned with zero-minimum possessive groups that could match
+    an empty string, which sometimes were behaving incorrectly in the
+    interpreter (though correctly in the JIT matcher). This pcretest input is
+    an example:
+
+      '\A(?:[^"]++|"(?:[^"]*+|"")*+")++'
+      NON QUOTED "QUOT""ED" AFTER "NOT MATCHED
+
+    the interpreter was reporting a match of 'NON QUOTED ' only, whereas the
+    JIT matcher and Perl both matched 'NON QUOTED "QUOT""ED" AFTER '. The test
+    for an empty string was breaking the inner loop and carrying on at a lower
+    level, when possessive repeated groups should always return to a higher
+    level as they have no backtrack points in them. The empty string test now
+    occurs at the outer level.
+
+8.  Fixed a bug that was incorrectly auto-possessifying \w+ in the pattern
+    ^\w+(?>\s*)(?<=\w) which caused it not to match "test test".
+
+9.  Give a compile-time error for \o{} (as Perl does) and for \x{} (which Perl
+    doesn't).
+
+10. Change 8.34/15 introduced a bug that caused the amount of memory needed
+    to hold a pattern to be incorrectly computed (too small) when there were
+    named back references to duplicated names. This could cause "internal
+    error: code overflow" or "double free or corruption" or other memory
+    handling errors.
+
+11. When named subpatterns had the same prefixes, back references could be
+    confused. For example, in this pattern:
+
+      /(?P<Name>a)?(?P<Name2>b)?(?(<Name>)c|d)*l/
+
+    the reference to 'Name' was incorrectly treated as a reference to a
+    duplicate name.
+
+12. A pattern such as /^s?c/mi8 where the optional character has more than
+    one "other case" was incorrectly compiled such that it would only try to
+    match starting at "c".
+
+13. When a pattern starting with \s was studied, VT was not included in the
+    list of possible starting characters; this should have been part of the
+    8.34/18 patch.
+
+14. If a character class started [\Qx]... where x is any character, the class
+    was incorrectly terminated at the ].
+
+15. If a pattern that started with a caseless match for a character with more
+    than one "other case" was studied, PCRE did not set up the starting code
+    unit bit map for the list of possible characters. Now it does. This is an
+    optimization improvement, not a bug fix.
+
+16. The Unicode data tables have been updated to Unicode 7.0.0.
+
+17. Fixed a number of memory leaks in pcregrep.
+
+18. Avoid a compiler warning (from some compilers) for a function call with
+    a cast that removes "const" from an lvalue by using an intermediate
+    variable (to which the compiler does not object).
+
+19. Incorrect code was compiled if a group that contained an internal recursive
+    back reference was optional (had quantifier with a minimum of zero). This
+    example compiled incorrect code: /(((a\2)|(a*)\g<-1>))*/ and other examples
+    caused segmentation faults because of stack overflows at compile time.
+
+20. A pattern such as /((?(R)a|(?1)))+/, which contains a recursion within a
+    group that is quantified with an indefinite repeat, caused a compile-time
+    loop which used up all the system stack and provoked a segmentation fault.
+    This was not the same bug as 19 above.
+
+21. Add PCRECPP_EXP_DECL declaration to operator<< in pcre_stringpiece.h.
+    Patch by Mike Frysinger.
+
+
+Version 8.35 04-April-2014
+--------------------------
+
+1.  A new flag is set, when property checks are present in an XCLASS.
+    When this flag is not set, PCRE can perform certain optimizations
+    such as studying these XCLASS-es.
+
+2.  The auto-possessification of character sets were improved: a normal
+    and an extended character set can be compared now. Furthermore
+    the JIT compiler optimizes more character set checks.
+
+3.  Got rid of some compiler warnings for potentially uninitialized variables
+    that show up only when compiled with -O2.
+
+4.  A pattern such as (?=ab\K) that uses \K in an assertion can set the start
+    of a match later then the end of the match. The pcretest program was not
+    handling the case sensibly - it was outputting from the start to the next
+    binary zero. It now reports this situation in a message, and outputs the
+    text from the end to the start.
+
+5.  Fast forward search is improved in JIT. Instead of the first three
+    characters, any three characters with fixed position can be searched.
+    Search order: first, last, middle.
+
+6.  Improve character range checks in JIT. Characters are read by an inprecise
+    function now, which returns with an unknown value if the character code is
+    above a certain threshold (e.g: 256). The only limitation is that the value
+    must be bigger than the threshold as well. This function is useful when
+    the characters above the threshold are handled in the same way.
+
+7.  The macros whose names start with RAWUCHAR are placeholders for a future
+    mode in which only the bottom 21 bits of 32-bit data items are used. To
+    make this more memorable for those maintaining the code, the names have
+    been changed to start with UCHAR21, and an extensive comment has been added
+    to their definition.
+
+8.  Add missing (new) files sljitNativeTILEGX.c and sljitNativeTILEGX-encoder.c
+    to the export list in Makefile.am (they were accidentally omitted from the
+    8.34 tarball).
+
+9.  The informational output from pcretest used the phrase "starting byte set"
+    which is inappropriate for the 16-bit and 32-bit libraries. As the output
+    for "first char" and "need char" really means "non-UTF-char", I've changed
+    "byte" to "char", and slightly reworded the output. The documentation about
+    these values has also been (I hope) clarified.
+
+10. Another JIT related optimization: use table jumps for selecting the correct
+    backtracking path, when more than four alternatives are present inside a
+    bracket.
+
+11. Empty match is not possible, when the minimum length is greater than zero,
+    and there is no \K in the pattern. JIT should avoid empty match checks in
+    such cases.
+
+12. In a caseless character class with UCP support, when a character with more
+    than one alternative case was not the first character of a range, not all
+    the alternative cases were added to the class. For example, s and \x{17f}
+    are both alternative cases for S: the class [RST] was handled correctly,
+    but [R-T] was not.
+
+13. The configure.ac file always checked for pthread support when JIT was
+    enabled. This is not used in Windows, so I have put this test inside a
+    check for the presence of windows.h (which was already tested for).
+
+14. Improve pattern prefix search by a simplified Boyer-Moore algorithm in JIT.
+    The algorithm provides a way to skip certain starting offsets, and usually
+    faster than linear prefix searches.
+
+15. Change 13 for 8.20 updated RunTest to check for the 'fr' locale as well
+    as for 'fr_FR' and 'french'. For some reason, however, it then used the
+    Windows-specific input and output files, which have 'french' screwed in.
+    So this could never have worked. One of the problems with locales is that
+    they aren't always the same. I have now updated RunTest so that it checks
+    the output of the locale test (test 3) against three different output
+    files, and it allows the test to pass if any one of them matches. With luck
+    this should make the test pass on some versions of Solaris where it was
+    failing. Because of the uncertainty, the script did not used to stop if
+    test 3 failed; it now does. If further versions of a French locale ever
+    come to light, they can now easily be added.
+
+16. If --with-pcregrep-bufsize was given a non-integer value such as "50K",
+    there was a message during ./configure, but it did not stop. This now
+    provokes an error. The invalid example in README has been corrected.
+    If a value less than the minimum is given, the minimum value has always
+    been used, but now a warning is given.
+
+17. If --enable-bsr-anycrlf was set, the special 16/32-bit test failed. This
+    was a bug in the test system, which is now fixed. Also, the list of various
+    configurations that are tested for each release did not have one with both
+    16/32 bits and --enable-bar-anycrlf. It now does.
+
+18. pcretest was missing "-C bsr" for displaying the \R default setting.
+
+19. Little endian PowerPC systems are supported now by the JIT compiler.
+
+20. The fast forward newline mechanism could enter to an infinite loop on
+    certain invalid UTF-8 input. Although we don't support these cases
+    this issue can be fixed by a performance optimization.
+
+21. Change 33 of 8.34 is not sufficient to ensure stack safety because it does
+    not take account if existing stack usage. There is now a new global
+    variable called pcre_stack_guard that can be set to point to an external
+    function to check stack availability. It is called at the start of
+    processing every parenthesized group.
+
+22. A typo in the code meant that in ungreedy mode the max/min qualifier
+    behaved like a min-possessive qualifier, and, for example, /a{1,3}b/U did
+    not match "ab".
+
+23. When UTF was disabled, the JIT program reported some incorrect compile
+    errors. These messages are silenced now.
+
+24. Experimental support for ARM-64 and MIPS-64 has been added to the JIT
+    compiler.
+
+25. Change all the temporary files used in RunGrepTest to be different to those
+    used by RunTest so that the tests can be run simultaneously, for example by
+    "make -j check".
+
+
+Version 8.34 15-December-2013
+-----------------------------
+
+1.  Add pcre[16|32]_jit_free_unused_memory to forcibly free unused JIT
+    executable memory. Patch inspired by Carsten Klein.
+
+2.  ./configure --enable-coverage defined SUPPORT_GCOV in config.h, although
+    this macro is never tested and has no effect, because the work to support
+    coverage involves only compiling and linking options and special targets in
+    the Makefile. The comment in config.h implied that defining the macro would
+    enable coverage support, which is totally false. There was also support for
+    setting this macro in the CMake files (my fault, I just copied it from
+    configure). SUPPORT_GCOV has now been removed.
+
+3.  Make a small performance improvement in strlen16() and strlen32() in
+    pcretest.
+
+4.  Change 36 for 8.33 left some unreachable statements in pcre_exec.c,
+    detected by the Solaris compiler (gcc doesn't seem to be able to diagnose
+    these cases). There was also one in pcretest.c.
+
+5.  Cleaned up a "may be uninitialized" compiler warning in pcre_exec.c.
+
+6.  In UTF mode, the code for checking whether a group could match an empty
+    string (which is used for indefinitely repeated groups to allow for
+    breaking an infinite loop) was broken when the group contained a repeated
+    negated single-character class with a character that occupied more than one
+    data item and had a minimum repetition of zero (for example, [^\x{100}]* in
+    UTF-8 mode). The effect was undefined: the group might or might not be
+    deemed as matching an empty string, or the program might have crashed.
+
+7.  The code for checking whether a group could match an empty string was not
+    recognizing that \h, \H, \v, \V, and \R must match a character.
+
+8.  Implemented PCRE_INFO_MATCH_EMPTY, which yields 1 if the pattern can match
+    an empty string. If it can, pcretest shows this in its information output.
+
+9.  Fixed two related bugs that applied to Unicode extended grapheme clusters
+    that were repeated with a maximizing qualifier (e.g. \X* or \X{2,5}) when
+    matched by pcre_exec() without using JIT:
+
+    (a) If the rest of the pattern did not match after a maximal run of
+        grapheme clusters, the code for backing up to try with fewer of them
+        did not always back up over a full grapheme when characters that do not
+        have the modifier quality were involved, e.g. Hangul syllables.
+
+    (b) If the match point in a subject started with modifier character, and
+        there was no match, the code could incorrectly back up beyond the match
+        point, and potentially beyond the first character in the subject,
+        leading to a segfault or an incorrect match result.
+
+10. A conditional group with an assertion condition could lead to PCRE
+    recording an incorrect first data item for a match if no other first data
+    item was recorded. For example, the pattern (?(?=ab)ab) recorded "a" as a
+    first data item, and therefore matched "ca" after "c" instead of at the
+    start.
+
+11. Change 40 for 8.33 (allowing pcregrep to find empty strings) showed up a
+    bug that caused the command "echo a | ./pcregrep -M '|a'" to loop.
+
+12. The source of pcregrep now includes z/OS-specific code so that it can be
+    compiled for z/OS as part of the special z/OS distribution.
+
+13. Added the -T and -TM options to pcretest.
+
+14. The code in pcre_compile.c for creating the table of named capturing groups
+    has been refactored. Instead of creating the table dynamically during the
+    actual compiling pass, the information is remembered during the pre-compile
+    pass (on the stack unless there are more than 20 named groups, in which
+    case malloc() is used) and the whole table is created before the actual
+    compile happens. This has simplified the code (it is now nearly 150 lines
+    shorter) and prepared the way for better handling of references to groups
+    with duplicate names.
+
+15. A back reference to a named subpattern when there is more than one of the
+    same name now checks them in the order in which they appear in the pattern.
+    The first one that is set is used for the reference. Previously only the
+    first one was inspected. This change makes PCRE more compatible with Perl.
+
+16. Unicode character properties were updated from Unicode 6.3.0.
+
+17. The compile-time code for auto-possessification has been refactored, based
+    on a patch by Zoltan Herczeg. It now happens after instead of during
+    compilation. The code is cleaner, and more cases are handled. The option
+    PCRE_NO_AUTO_POSSESS is added for testing purposes, and the -O and /O
+    options in pcretest are provided to set it. It can also be set by
+    (*NO_AUTO_POSSESS) at the start of a pattern.
+
+18. The character VT has been added to the default ("C" locale) set of
+    characters that match \s and are generally treated as white space,
+    following this same change in Perl 5.18. There is now no difference between
+    "Perl space" and "POSIX space". Whether VT is treated as white space in
+    other locales depends on the locale.
+
+19. The code for checking named groups as conditions, either for being set or
+    for being recursed, has been refactored (this is related to 14 and 15
+    above). Processing unduplicated named groups should now be as fast at
+    numerical groups, and processing duplicated groups should be faster than
+    before.
+
+20. Two patches to the CMake build system, by Alexander Barkov:
+
+      (1) Replace the "source" command by "." in CMakeLists.txt because
+          "source" is a bash-ism.
+
+      (2) Add missing HAVE_STDINT_H and HAVE_INTTYPES_H to config-cmake.h.in;
+          without these the CMake build does not work on Solaris.
+
+21. Perl has changed its handling of \8 and \9. If there is no previously
+    encountered capturing group of those numbers, they are treated as the
+    literal characters 8 and 9 instead of a binary zero followed by the
+    literals. PCRE now does the same.
+
+22. Following Perl, added \o{} to specify codepoints in octal, making it
+    possible to specify values greater than 0777 and also making them
+    unambiguous.
+
+23. Perl now gives an error for missing closing braces after \x{... instead of
+    treating the string as literal. PCRE now does the same.
+
+24. RunTest used to grumble if an inappropriate test was selected explicitly,
+    but just skip it when running all tests. This make it awkward to run ranges
+    of tests when one of them was inappropriate. Now it just skips any
+    inappropriate tests, as it always did when running all tests.
+
+25. If PCRE_AUTO_CALLOUT and PCRE_UCP were set for a pattern that contained
+    character types such as \d or \w, too many callouts were inserted, and the
+    data that they returned was rubbish.
+
+26. In UCP mode, \s was not matching two of the characters that Perl matches,
+    namely NEL (U+0085) and MONGOLIAN VOWEL SEPARATOR (U+180E), though they
+    were matched by \h. The code has now been refactored so that the lists of
+    the horizontal and vertical whitespace characters used for \h and \v (which
+    are defined only in one place) are now also used for \s.
+
+27. Add JIT support for the 64 bit TileGX architecture.
+    Patch by Jiong Wang (Tilera Corporation).
+
+28. Possessive quantifiers for classes (both explicit and automatically
+    generated) now use special opcodes instead of wrapping in ONCE brackets.
+
+29. Whereas an item such as A{4}+ ignored the possessivenes of the quantifier
+    (because it's meaningless), this was not happening when PCRE_CASELESS was
+    set. Not wrong, but inefficient.
+
+30. Updated perltest.pl to add /u (force Unicode mode) when /W (use Unicode
+    properties for \w, \d, etc) is present in a test regex. Otherwise if the
+    test contains no characters greater than 255, Perl doesn't realise it
+    should be using Unicode semantics.
+
+31. Upgraded the handling of the POSIX classes [:graph:], [:print:], and
+    [:punct:] when PCRE_UCP is set so as to include the same characters as Perl
+    does in Unicode mode.
+
+32. Added the "forbid" facility to pcretest so that putting tests into the
+    wrong test files can sometimes be quickly detected.
+
+33. There is now a limit (default 250) on the depth of nesting of parentheses.
+    This limit is imposed to control the amount of system stack used at compile
+    time. It can be changed at build time by --with-parens-nest-limit=xxx or
+    the equivalent in CMake.
+
+34. Character classes such as [A-\d] or [a-[:digit:]] now cause compile-time
+    errors. Perl warns for these when in warning mode, but PCRE has no facility
+    for giving warnings.
+
+35. Change 34 for 8.13 allowed quantifiers on assertions, because Perl does.
+    However, this was not working for (?!) because it is optimized to (*FAIL),
+    for which PCRE does not allow quantifiers. The optimization is now disabled
+    when a quantifier follows (?!). I can't see any use for this, but it makes
+    things uniform.
+
+36. Perl no longer allows group names to start with digits, so I have made this
+    change also in PCRE. It simplifies the code a bit.
+
+37. In extended mode, Perl ignores spaces before a + that indicates a
+    possessive quantifier. PCRE allowed a space before the quantifier, but not
+    before the possessive +. It now does.
+
+38. The use of \K (reset reported match start) within a repeated possessive
+    group such as (a\Kb)*+ was not working.
+
+40. Document that the same character tables must be used at compile time and
+    run time, and that the facility to pass tables to pcre_exec() and
+    pcre_dfa_exec() is for use only with saved/restored patterns.
+
+41. Applied Jeff Trawick's patch CMakeLists.txt, which "provides two new
+    features for Builds with MSVC:
+
+    1. Support pcre.rc and/or pcreposix.rc (as is already done for MinGW
+       builds). The .rc files can be used to set FileDescription and many other
+       attributes.
+
+    2. Add an option (-DINSTALL_MSVC_PDB) to enable installation of .pdb files.
+       This allows higher-level build scripts which want .pdb files to avoid
+       hard-coding the exact files needed."
+
+42. Added support for [[:<:]] and [[:>:]] as used in the BSD POSIX library to
+    mean "start of word" and "end of word", respectively, as a transition aid.
+
+43. A minimizing repeat of a class containing codepoints greater than 255 in
+    non-UTF 16-bit or 32-bit modes caused an internal error when PCRE was
+    compiled to use the heap for recursion.
+
+44. Got rid of some compiler warnings for unused variables when UTF but not UCP
+    is configured.
+
+
+Version 8.33 28-May-2013
+------------------------
+
+1.  Added 'U' to some constants that are compared to unsigned integers, to
+    avoid compiler signed/unsigned warnings. Added (int) casts to unsigned
+    variables that are added to signed variables, to ensure the result is
+    signed and can be negated.
+
+2.  Applied patch by Daniel Richard G for quashing MSVC warnings to the
+    CMake config files.
+
+3.  Revise the creation of config.h.generic so that all boolean macros are
+    #undefined, whereas non-boolean macros are #ifndef/#endif-ed. This makes
+    overriding via -D on the command line possible.
+
+4.  Changing the definition of the variable "op" in pcre_exec.c from pcre_uchar
+    to unsigned int is reported to make a quite noticeable speed difference in
+    a specific Windows environment. Testing on Linux did also appear to show
+    some benefit (and it is clearly not harmful). Also fixed the definition of
+    Xop which should be unsigned.
+
+5.  Related to (4), changing the definition of the intermediate variable cc
+    in repeated character loops from pcre_uchar to pcre_uint32 also gave speed
+    improvements.
+
+6.  Fix forward search in JIT when link size is 3 or greater. Also removed some
+    unnecessary spaces.
+
+7.  Adjust autogen.sh and configure.ac to lose warnings given by automake 1.12
+    and later.
+
+8.  Fix two buffer over read issues in 16 and 32 bit modes. Affects JIT only.
+
+9.  Optimizing fast_forward_start_bits in JIT.
+
+10. Adding support for callouts in JIT, and fixing some issues revealed
+    during this work. Namely:
+
+    (a) Unoptimized capturing brackets incorrectly reset on backtrack.
+
+    (b) Minimum length was not checked before the matching is started.
+
+11. The value of capture_last that is passed to callouts was incorrect in some
+    cases when there was a capture on one path that was subsequently abandoned
+    after a backtrack. Also, the capture_last value is now reset after a
+    recursion, since all captures are also reset in this case.
+
+12. The interpreter no longer returns the "too many substrings" error in the
+    case when an overflowing capture is in a branch that is subsequently
+    abandoned after a backtrack.
+
+13. In the pathological case when an offset vector of size 2 is used, pcretest
+    now prints out the matched string after a yield of 0 or 1.
+
+14. Inlining subpatterns in recursions, when certain conditions are fulfilled.
+    Only supported by the JIT compiler at the moment.
+
+15. JIT compiler now supports 32 bit Macs thanks to Lawrence Velazquez.
+
+16. Partial matches now set offsets[2] to the "bumpalong" value, that is, the
+    offset of the starting point of the matching process, provided the offsets
+    vector is large enough.
+
+17. The \A escape now records a lookbehind value of 1, though its execution
+    does not actually inspect the previous character. This is to ensure that,
+    in partial multi-segment matching, at least one character from the old
+    segment is retained when a new segment is processed. Otherwise, if there
+    are no lookbehinds in the pattern, \A might match incorrectly at the start
+    of a new segment.
+
+18. Added some #ifdef __VMS code into pcretest.c to help VMS implementations.
+
+19. Redefined some pcre_uchar variables in pcre_exec.c as pcre_uint32; this
+    gives some modest performance improvement in 8-bit mode.
+
+20. Added the PCRE-specific property \p{Xuc} for matching characters that can
+    be expressed in certain programming languages using Universal Character
+    Names.
+
+21. Unicode validation has been updated in the light of Unicode Corrigendum #9,
+    which points out that "non characters" are not "characters that may not
+    appear in Unicode strings" but rather "characters that are reserved for
+    internal use and have only local meaning".
+
+22. When a pattern was compiled with automatic callouts (PCRE_AUTO_CALLOUT) and
+    there was a conditional group that depended on an assertion, if the
+    assertion was false, the callout that immediately followed the alternation
+    in the condition was skipped when pcre_exec() was used for matching.
+
+23. Allow an explicit callout to be inserted before an assertion that is the
+    condition for a conditional group, for compatibility with automatic
+    callouts, which always insert a callout at this point.
+
+24. In 8.31, (*COMMIT) was confined to within a recursive subpattern. Perl also
+    confines (*SKIP) and (*PRUNE) in the same way, and this has now been done.
+
+25. (*PRUNE) is now supported by the JIT compiler.
+
+26. Fix infinite loop when /(?<=(*SKIP)ac)a/ is matched against aa.
+
+27. Fix the case where there are two or more SKIPs with arguments that may be
+    ignored.
+
+28. (*SKIP) is now supported by the JIT compiler.
+
+29. (*THEN) is now supported by the JIT compiler.
+
+30. Update RunTest with additional test selector options.
+
+31. The way PCRE handles backtracking verbs has been changed in two ways.
+
+    (1) Previously, in something like (*COMMIT)(*SKIP), COMMIT would override
+    SKIP. Now, PCRE acts on whichever backtracking verb is reached first by
+    backtracking. In some cases this makes it more Perl-compatible, but Perl's
+    rather obscure rules do not always do the same thing.
+
+    (2) Previously, backtracking verbs were confined within assertions. This is
+    no longer the case for positive assertions, except for (*ACCEPT). Again,
+    this sometimes improves Perl compatibility, and sometimes does not.
+
+32. A number of tests that were in test 2 because Perl did things differently
+    have been moved to test 1, because either Perl or PCRE has changed, and
+    these tests are now compatible.
+
+32. Backtracking control verbs are now handled in the same way in JIT and
+    interpreter.
+
+33. An opening parenthesis in a MARK/PRUNE/SKIP/THEN name in a pattern that
+    contained a forward subroutine reference caused a compile error.
+
+34. Auto-detect and optimize limited repetitions in JIT.
+
+35. Implement PCRE_NEVER_UTF to lock out the use of UTF, in particular,
+    blocking (*UTF) etc.
+
+36. In the interpreter, maximizing pattern repetitions for characters and
+    character types now use tail recursion, which reduces stack usage.
+
+37. The value of the max lookbehind was not correctly preserved if a compiled
+    and saved regex was reloaded on a host of different endianness.
+
+38. Implemented (*LIMIT_MATCH) and (*LIMIT_RECURSION). As part of the extension
+    of the compiled pattern block, expand the flags field from 16 to 32 bits
+    because it was almost full.
+
+39. Try madvise first before posix_madvise.
+
+40. Change 7 for PCRE 7.9 made it impossible for pcregrep to find empty lines
+    with a pattern such as ^$. It has taken 4 years for anybody to notice! The
+    original change locked out all matches of empty strings. This has been
+    changed so that one match of an empty string per line is recognized.
+    Subsequent searches on the same line (for colouring or for --only-matching,
+    for example) do not recognize empty strings.
+
+41. Applied a user patch to fix a number of spelling mistakes in comments.
+
+42. Data lines longer than 65536 caused pcretest to crash.
+
+43. Clarified the data type for length and startoffset arguments for pcre_exec
+    and pcre_dfa_exec in the function-specific man pages, where they were
+    explicitly stated to be in bytes, never having been updated. I also added
+    some clarification to the pcreapi man page.
+
+44. A call to pcre_dfa_exec() with an output vector size less than 2 caused
+    a segmentation fault.
+
+
 Version 8.32 30-November-2012
 -----------------------------

@@ -1508,7 +2268,8 @@ Version 7.9 11-Apr-09
 7.  A pattern that could match an empty string could cause pcregrep to loop; it
    doesn't make sense to accept an empty string match in pcregrep, so I have
    locked it out (using PCRE's PCRE_NOTEMPTY option). By experiment, this
-    seems to be how GNU grep behaves.
+    seems to be how GNU grep behaves. [But see later change 40 for release
+    8.33.]

 8.  The pattern (?(?=.*b)b|^) was incorrectly compiled as "match must be at
    start or after a newline", because the conditional assertion was not being
@@ -54,12 +54,12 @@ Support for 16-bit and 32-bit data strings

 From release 8.30, PCRE supports 16-bit as well as 8-bit data strings; and from
 release 8.32, PCRE supports 32-bit data strings. The library can be compiled
-in any combination of 8-bit, 16-bit or 32-bit modes, creating different
-libraries. In the description that follows, the word "short" is 
-used for a 16-bit data quantity, and the word "unit" is used for a quantity
-that is a byte in 8-bit mode, a short in 16-bit mode and a 32-bit unsigned
-integer in 32-bit mode. However, so as not to over-complicate the text, the
-names of PCRE functions are given in 8-bit form only.
+in any combination of 8-bit, 16-bit or 32-bit modes, creating up to three
+different libraries. In the description that follows, the word "short" is used
+for a 16-bit data quantity, and the word "unit" is used for a quantity that is
+a byte in 8-bit mode, a short in 16-bit mode and a 32-bit word in 32-bit mode.
+However, so as not to over-complicate the text, the names of PCRE functions are
+given in 8-bit form only.


 Computing the memory requirement: how it was
@@ -94,6 +94,11 @@ runs more slowly than before (30% or more, depending on the pattern) because it
 is doing a full analysis of the pattern. My hope was that this would not be a
 big issue, and in the event, nobody has commented on it.

+At release 8.34, a limit on the nesting depth of parentheses was re-introduced
+(default 250, settable at build time) so as to put a limit on the amount of 
+system stack used by pcre_compile(). This is a safety feature for environments 
+with small stacks where the patterns are provided by users.
+

 Traditional matching function
 -----------------------------
@@ -120,29 +125,30 @@ facilities are available, and those that are do not always work in quite the
 same way. See the user documentation for details.

 The algorithm that is used for pcre_dfa_exec() is not a traditional FSM, 
-because it may have a number of states active at one time. More work would be 
-needed at compile time to produce a traditional FSM where only one state is 
-ever active at once. I believe some other regex matchers work this way.
+because it may have a number of states active at one time. More work would be
+needed at compile time to produce a traditional FSM where only one state is
+ever active at once. I believe some other regex matchers work this way. JIT
+support is not available for this kind of matching.


 Changeable options
 ------------------

-The /i, /m, or /s options (PCRE_CASELESS, PCRE_MULTILINE, PCRE_DOTALL) may
-change in the middle of patterns. From PCRE 8.13, their processing is handled
-entirely at compile time by generating different opcodes for the different
-settings. The runtime functions do not need to keep track of an options state 
-any more.
+The /i, /m, or /s options (PCRE_CASELESS, PCRE_MULTILINE, PCRE_DOTALL, and some 
+others) may change in the middle of patterns. From PCRE 8.13, their processing
+is handled entirely at compile time by generating different opcodes for the
+different settings. The runtime functions do not need to keep track of an
+options state any more.


 Format of compiled patterns
 ---------------------------

-The compiled form of a pattern is a vector of units (bytes in 8-bit mode, or
-shorts in 16-bit mode, 32-bit unsigned integers in 32-bit mode), containing
-items of variable length. The first unit in an item contains an opcode, and
-the length of the item is either implicit in the opcode or contained in the
-data that follows it.
+The compiled form of a pattern is a vector of unsigned units (bytes in 8-bit
+mode, shorts in 16-bit mode, 32-bit words in 32-bit mode), containing items of
+variable length. The first unit in an item contains an opcode, and the length
+of the item is either implicit in the opcode or contained in the data that
+follows it.

 In many cases listed below, LINK_SIZE data values are specified for offsets
 within the compiled pattern. LINK_SIZE always specifies a number of bytes. The
@@ -151,8 +157,10 @@ default value for LINK_SIZE is 2, but PCRE can be compiled to use 3-byte or
 LINK_SIZE values are available only in 8-bit mode.) Specifing a LINK_SIZE
 larger than 2 is necessary only when patterns whose compiled length is greater
 than 64K are going to be processed. In this description, we assume the "normal"
-compilation options. Data values that are counts (e.g. for quantifiers) are
-always just two bytes long (one short in 16-bit mode).
+compilation options. Data values that are counts (e.g. quantifiers) are two
+bytes long in 8-bit mode (most significant byte first), or one unit in 16-bit
+and 32-bit modes.
+

 Opcodes with no following data
 ------------------------------
@@ -162,7 +170,7 @@ These items are all just one unit long
  OP_END                 end of pattern
  OP_ANY                 match any one character other than newline
  OP_ALLANY              match any one character, including newline
-  OP_ANYBYTE             match any single byte, even in UTF-8 mode
+  OP_ANYBYTE             match any single unit, even in UTF-8/16 mode
  OP_SOD                 match start of data: \A
  OP_SOM,                start of match (subject + offset): \G
  OP_SET_SOM,            set start of match (\K) 
@@ -180,28 +188,33 @@ These items are all just one unit long
  OP_VSPACE              \v  
  OP_NOT_WORDCHAR        \W
  OP_WORDCHAR            \w
-  OP_EODN                match end of data or \n at end: \Z
+  OP_EODN                match end of data or newline at end: \Z
  OP_EOD                 match end of data: \z
  OP_DOLL                $ (end of data, or before final newline)
  OP_DOLLM               $ multiline mode (end of data or before newline)
-  OP_EXTUNI              match an extended Unicode character 
+  OP_EXTUNI              match an extended Unicode grapheme cluster 
  OP_ANYNL               match any Unicode newline sequence 
  
+  OP_ASSERT_ACCEPT       )
  OP_ACCEPT              ) These are Perl 5.10's "backtracking control   
  OP_COMMIT              ) verbs". If OP_ACCEPT is inside capturing
  OP_FAIL                ) parentheses, it may be preceded by one or more
-  OP_PRUNE               ) OP_CLOSE, followed by a 2-byte number,
-  OP_SKIP                ) indicating which parentheses must be closed.
+  OP_PRUNE               ) OP_CLOSE, each followed by a count that
+  OP_SKIP                ) indicates which parentheses must be closed.
+  OP_THEN                )
+  
+OP_ASSERT_ACCEPT is used when (*ACCEPT) is encountered within an assertion. 
+This ends the assertion, not the entire pattern match.  
  

-Backtracking control verbs with (optional) data
-----------------------------------------------
+Backtracking control verbs with optional data
+---------------------------------------------

 (*THEN) without an argument generates the opcode OP_THEN and no following data.
 OP_MARK is followed by the mark name, preceded by a one-unit length, and
 followed by a binary zero. For (*PRUNE), (*SKIP), and (*THEN) with arguments,
 the opcodes OP_PRUNE_ARG, OP_SKIP_ARG, and OP_THEN_ARG are used, with the name
-following in the same format.
+following in the same format as OP_MARK.
  

 Matching literal characters
@@ -212,6 +225,10 @@ casefully. For caseless matching, OP_CHARI is used. In UTF-8 or UTF-16 modes,
 the character may be more than one unit long. In UTF-32 mode, characters
 are always exactly one unit long.

+If there is only one character in a character class, OP_CHAR or OP_CHARI is
+used for a positive class, and OP_NOT or OP_NOTI for a negative one (that is,
+for something like [^a]).
+

 Repeating single characters
 ---------------------------
@@ -232,10 +249,9 @@ following opcodes, which come in caseful and caseless versions:

 Each opcode is followed by the character that is to be repeated. In ASCII mode,
 these are two-unit items; in UTF-8 or UTF-16 modes, the length is variable; in
-UTF-32 mode these are one-unit items.
-Those with "MIN" in their names are the minimizing versions. Those with "POS"
-in their names are possessive versions. Other repeats make use of these
-opcodes:
+UTF-32 mode these are one-unit items. Those with "MIN" in their names are the
+minimizing versions. Those with "POS" in their names are possessive versions.
+Other repeats make use of these opcodes:

  Caseful         Caseless
  OP_UPTO         OP_UPTOI    
@@ -243,10 +259,15 @@ opcodes:
  OP_POSUPTO      OP_POSUPTOI 
  OP_EXACT        OP_EXACTI   

-Each of these is followed by a two-byte (one short) count (most significant
-byte first in 8-bit mode) and then the repeated character. OP_UPTO matches from
-0 to the given number. A repeat with a non-zero minimum and a fixed maximum is
-coded as an OP_EXACT followed by an OP_UPTO (or OP_MINUPTO or OPT_POSUPTO).
+Each of these is followed by a count and then the repeated character. OP_UPTO
+matches from 0 to the given number. A repeat with a non-zero minimum and a
+fixed maximum is coded as an OP_EXACT followed by an OP_UPTO (or OP_MINUPTO or
+OPT_POSUPTO).
+
+Another set of matching repeating opcodes (called OP_NOTSTAR, OP_NOTSTARI,
+etc.) are used for repeated, negated, single-character classes such as [^a]*.
+The normal single-character opcodes (OP_STAR, etc.) are used for repeated
+positive single-character classes.


 Repeating character types
@@ -277,7 +298,10 @@ Match by Unicode property
 OP_PROP and OP_NOTPROP are used for positive and negative matches of a 
 character by testing its Unicode property (the \p and \P escape sequences).
 Each is followed by two units that encode the desired property as a type and a
-value.
+value. The types are a set of #defines of the form PT_xxx, and the values are
+enumerations of the form ucp_xx, defined in the ucp.h source file. The value is
+relevant only for PT_GC (General Category), PT_PC (Particular Category), and
+PT_SC (Script).

 Repeats of these items use the OP_TYPESTAR etc. set of opcodes, followed by
 three units: OP_PROP or OP_NOTPROP, and then the desired property type and
@@ -287,67 +311,88 @@ value.
 Character classes
 -----------------

-If there is only one character in the class, OP_CHAR or OP_CHARI is used for a
+If there is only one character in a class, OP_CHAR or OP_CHARI is used for a
 positive class, and OP_NOT or OP_NOTI for a negative one (that is, for
 something like [^a]). 

-Another set of 13 repeating opcodes (called OP_NOTSTAR etc.) are used for
-repeated, negated, single-character classes. The normal single-character
-opcodes (OP_STAR, etc.) are used for repeated positive single-character
-classes.
+A set of repeating opcodes (called OP_NOTSTAR etc.) are used for repeated,
+negated, single-character classes. The normal single-character opcodes
+(OP_STAR, etc.) are used for repeated positive single-character classes.

-When there is more than one character in a class and all the characters are
+When there is more than one character in a class, and all the code points are
 less than 256, OP_CLASS is used for a positive class, and OP_NCLASS for a
-negative one. In either case, the opcode is followed by a 32-byte (16-short)
-bit map containing a 1 bit for every character that is acceptable. The bits are
-counted from the least significant end of each unit. In caseless mode, bits for
-both cases are set.
+negative one. In either case, the opcode is followed by a 32-byte (16-short, 
+8-word) bit map containing a 1 bit for every character that is acceptable. The
+bits are counted from the least significant end of each unit. In caseless mode,
+bits for both cases are set.

-The reason for having both OP_CLASS and OP_NCLASS is so that, in UTF-8/16/32 mode,
-subject characters with values greater than 255 can be handled correctly. For
-OP_CLASS they do not match, whereas for OP_NCLASS they do.
+The reason for having both OP_CLASS and OP_NCLASS is so that, in UTF-8/16/32
+mode, subject characters with values greater than 255 can be handled correctly.
+For OP_CLASS they do not match, whereas for OP_NCLASS they do.

-For classes containing characters with values greater than 255, OP_XCLASS is
-used. It optionally uses a bit map (if any characters lie within it), followed
-by a list of pairs (for a range) and single characters. In caseless mode, both
-cases are explicitly listed. There is a flag character than indicates whether
-it is a positive or a negative class.
+For classes containing characters with values greater than 255 or that contain 
+\p or \P, OP_XCLASS is used. It optionally uses a bit map if any code points
+are less than 256, followed by a list of pairs (for a range) and single
+characters. In caseless mode, both cases are explicitly listed.
+
+OP_XCLASS is followed by a unit containing flag bits: XCL_NOT indicates that 
+this is a negative class, and XCL_MAP indicates that a bit map is present.
+There follows the bit map, if XCL_MAP is set, and then a sequence of items
+coded as follows:
+
+  XCL_END      marks the end of the list
+  XCL_SINGLE   one character follows
+  XCL_RANGE    two characters follow
+  XCL_PROP     a Unicode property (type, value) follows   
+  XCL_NOTPROP  a Unicode property (type, value) follows   
+
+If a range starts with a code point less than 256 and ends with one greater 
+than 256, an XCL_RANGE item is used, without setting any bits in the bit map. 
+This means that if no other items in the class set bits in the map, a map is 
+not needed.


 Back references
 ---------------

-OP_REF (caseful) or OP_REFI (caseless) is followed by two bytes (one short)
-containing the reference number.
+OP_REF (caseful) or OP_REFI (caseless) is followed by a count containing the
+reference number if the reference is to a unique capturing group (either by
+number or by name). When named groups are used, there may be more than one
+group with the same name. In this case, a reference by name generates OP_DNREF
+or OP_DNREFI. These are followed by two counts: the index (not the byte offset) 
+in the group name table of the first entry for the requred name, followed by
+the number of groups with the same name.


 Repeating character classes and back references
 -----------------------------------------------

 Single-character classes are handled specially (see above). This section
-applies to OP_CLASS and OP_REF[I]. In both cases, the repeat information
-follows the base item. The matching code looks at the following opcode to see
-if it is one of
+applies to other classes and also to back references. In both cases, the repeat
+information follows the base item. The matching code looks at the following
+opcode to see if it is one of

  OP_CRSTAR
  OP_CRMINSTAR
+  OP_CRPOSSTAR 
  OP_CRPLUS
  OP_CRMINPLUS
+  OP_CRPOSPLUS 
  OP_CRQUERY
  OP_CRMINQUERY
+  OP_CRPOSQUERY 
  OP_CRRANGE
  OP_CRMINRANGE
+  OP_CRPOSRANGE 

-All but the last two are just single-unit items. The others are followed by
-four bytes (two shorts) of data, comprising the minimum and maximum repeat
-counts. There are no special possessive opcodes for these repeats; a possessive
-repeat is compiled into an atomic group.
+All but the last three are single-unit items, with no data. The others are
+followed by the minimum and maximum repeat counts.


 Brackets and alternation
 ------------------------

-A pair of non-capturing (round) brackets is wrapped round each expression at
+A pair of non-capturing round brackets is wrapped round each expression at
 compile time, so alternation always happens in the context of brackets.

 [Note for North Americans: "bracket" to some English speakers, including
@@ -364,20 +409,20 @@ A bracket opcode is followed by LINK_SIZE bytes which give the offset to the
 next alternative OP_ALT or, if there aren't any branches, to the matching
 OP_KET opcode. Each OP_ALT is followed by LINK_SIZE bytes giving the offset to
 the next one, or to the OP_KET opcode. For capturing brackets, the bracket 
-number immediately follows the offset, always as a 2-byte (one short) item.
+number is a count that immediately follows the offset.

-OP_KET is used for subpatterns that do not repeat indefinitely, and
-OP_KETRMIN and OP_KETRMAX are used for indefinite repetitions, minimally or
-maximally respectively (see below for possessive repetitions). All three are
-followed by LINK_SIZE bytes giving (as a positive number) the offset back to
-the matching bracket opcode.
+OP_KET is used for subpatterns that do not repeat indefinitely, and OP_KETRMIN
+and OP_KETRMAX are used for indefinite repetitions, minimally or maximally
+respectively (see below for possessive repetitions). All three are followed by
+LINK_SIZE bytes giving (as a positive number) the offset back to the matching
+bracket opcode.

 If a subpattern is quantified such that it is permitted to match zero times, it
 is preceded by one of OP_BRAZERO, OP_BRAMINZERO, or OP_SKIPZERO. These are
 single-unit opcodes that tell the matcher that skipping the following
 subpattern entirely is a valid branch. In the case of the first two, not 
 skipping the pattern is also valid (greedy and non-greedy). The third is used 
-when a pattern has the quantifier {0,0}. It cannot be entirely discarded, 
+when a pattern has the quantifier {0,0}. It cannot be entirely discarded,
 because it may be called as a subroutine from elsewhere in the regex.

 A subpattern with an indefinite maximum repetition is replicated in the
@@ -397,6 +442,7 @@ final replication is changed to OP_SBRA or OP_SCBRA. This tells the matcher
 that it needs to check for matching an empty string when it hits OP_KETRMIN or
 OP_KETRMAX, and if so, to break the loop.

+
 Possessive brackets
 -------------------

@@ -407,26 +453,34 @@ of OP_SCBRA. The end of such a group is marked by OP_KETRPOS. If the minimum
 repetition is zero, the group is preceded by OP_BRAPOSZERO.


+Once-only (atomic) groups
+-------------------------
+
+These are just like other subpatterns, but they start with the opcode
+OP_ONCE or OP_ONCE_NC. The former is used when there are no capturing brackets 
+within the atomic group; the latter when there are. The distinction is needed 
+for when there is a backtrack to before the group - any captures within the 
+group must be reset, so it is necessary to retain backtracking points inside
+the group even after it is complete in order to do this. When there are no 
+captures in an atomic group, all the backtracking can be discarded when it is 
+complete. This is more efficient, and also uses less stack.
+
+The check for matching an empty string in an unbounded repeat is handled
+entirely at runtime, so there are just these two opcodes for atomic groups.
+
+
 Assertions
 ----------

-Forward assertions are just like other subpatterns, but starting with one of
-the opcodes OP_ASSERT or OP_ASSERT_NOT. Backward assertions use the opcodes
+Forward assertions are also just like other subpatterns, but starting with one
+of the opcodes OP_ASSERT or OP_ASSERT_NOT. Backward assertions use the opcodes
 OP_ASSERTBACK and OP_ASSERTBACK_NOT, and the first opcode inside the assertion
-is OP_REVERSE, followed by a two byte (one short) count of the number of
-characters to move back the pointer in the subject string. In ASCII mode, the 
-count is a number of units, but in UTF-8/16 mode each character may occupy more
-than one unit; in UTF-32 mode each character occupies exactly one unit.
-A separate count is present in each alternative of a lookbehind
-assertion, allowing them to have different fixed lengths.
-
-
-Once-only (atomic) subpatterns
------------------------------
-
-These are also just like other subpatterns, but they start with the opcode
-OP_ONCE. The check for matching an empty string in an unbounded repeat is 
-handled entirely at runtime, so there is just this one opcode.
+is OP_REVERSE, followed by a count of the number of characters to move back the
+pointer in the subject string. In ASCII mode, the count is a number of units,
+but in UTF-8/16 mode each character may occupy more than one unit; in UTF-32
+mode each character occupies exactly one unit. A separate count is present in
+each alternative of a lookbehind assertion, allowing them to have different
+fixed lengths.


 Conditional subpatterns
@@ -435,28 +489,29 @@ Conditional subpatterns
 These are like other subpatterns, but they start with the opcode OP_COND, or
 OP_SCOND for one that might match an empty string in an unbounded repeat. If
 the condition is a back reference, this is stored at the start of the
-subpattern using the opcode OP_CREF followed by two bytes (one short)
-containing the reference number. OP_NCREF is used instead if the reference was
-generated by name (so that the runtime code knows to check for duplicate
-names).
+subpattern using the opcode OP_CREF followed by a count containing the
+reference number, provided that the reference is to a unique capturing group.
+If the reference was by name and there is more than one group with that name, 
+OP_DNCREF is used instead. It is followed by two counts: the index in the group 
+names table, and the number of groups with the same name.

 If the condition is "in recursion" (coded as "(?(R)"), or "in recursion of
 group x" (coded as "(?(Rx)"), the group number is stored at the start of the
-subpattern using the opcode OP_RREF or OP_NRREF (cf OP_NCREF), and a value of
-zero for "the whole pattern". For a DEFINE condition, just the single unit
-OP_DEF is used (it has no associated data). Otherwise, a conditional subpattern
-always starts with one of the assertions.
+subpattern using the opcode OP_RREF (with a value of zero for "the whole
+pattern") or OP_DNRREF (with data as for OP_DNCREF). For a DEFINE condition,
+just the single unit OP_DEF is used (it has no associated data). Otherwise, a
+conditional subpattern always starts with one of the assertions.


 Recursion
 ---------

 Recursion either matches the current regex, or some subexpression. The opcode
-OP_RECURSE is followed by an value which is the offset to the starting bracket
-from the start of the whole pattern. From release 6.5, OP_RECURSE is 
-automatically wrapped inside OP_ONCE brackets (because otherwise some patterns 
-broke it). OP_RECURSE is also used for "subroutine" calls, even though they 
-are not strictly a recursion.
+OP_RECURSE is followed by aLINK_SIZE value that is the offset to the starting
+bracket from the start of the whole pattern. From release 6.5, OP_RECURSE is
+automatically wrapped inside OP_ONCE brackets, because otherwise some patterns
+broke it. OP_RECURSE is also used for "subroutine" calls, even though they are
+not strictly a recursion.


 Callout
@@ -464,10 +519,10 @@ Callout

 OP_CALLOUT is followed by one unit of data that holds a callout number in the
 range 0 to 254 for manual callouts, or 255 for an automatic callout. In both 
-cases there follows a two-byte (one short) value giving the offset in the
-pattern to the start of the following item, and another two-byte (one short)
-item giving the length of the next item.
-
+cases there follows a count giving the offset in the pattern string to the
+start of the following item, and another count giving the length of this item.
+These values make is possible for pcretest to output useful tracing information 
+using automatic callouts.

 Philip Hazel
-February 2012
+November 2013
@@ -6,7 +6,8 @@ and semantics are as close as possible to those of the Perl 5 language.

 Release 8 of PCRE is distributed under the terms of the "BSD" licence, as
 specified below. The documentation for PCRE, supplied in the "doc"
-directory, is distributed under the same terms as the software itself.
+directory, is distributed under the same terms as the software itself. The data
+in the testdata directory is not copyrighted and is in the public domain.

 The basic library functions are written in C and are freestanding. Also
 included in the distribution is a set of C++ wrapper functions, and a
@@ -24,7 +25,7 @@ Email domain:     cam.ac.uk
 University of Cambridge Computing Service,
 Cambridge, England.

-Copyright (c) 1997-2012 University of Cambridge
+Copyright (c) 1997-2015 University of Cambridge
 All rights reserved.


@@ -35,7 +36,7 @@ Written by:       Zoltan Herczeg
 Email local part: hzmester
 Emain domain:     freemail.hu

-Copyright(c) 2010-2012 Zoltan Herczeg
+Copyright(c) 2010-2015 Zoltan Herczeg
 All rights reserved.


@@ -46,7 +47,7 @@ Written by:       Zoltan Herczeg
 Email local part: hzmester
 Emain domain:     freemail.hu

-Copyright(c) 2009-2012 Zoltan Herczeg
+Copyright(c) 2009-2015 Zoltan Herczeg
 All rights reserved.


@@ -1,6 +1,103 @@
 News about PCRE releases
 ------------------------

+Release 8.37 28-April-2015
+--------------------------
+
+This is bug-fix release. Note that this library (now called PCRE1) is now being
+maintained for bug fixes only. New projects are advised to use the new PCRE2
+libraries.
+
+
+Release 8.36 26-September-2014
+------------------------------
+
+This is primarily a bug-fix release. However, in addition, the Unicode data
+tables have been updated to Unicode 7.0.0.
+
+
+Release 8.35 04-April-2014
+--------------------------
+
+There have been performance improvements for classes containing non-ASCII
+characters and the "auto-possessification" feature has been extended. Other
+minor improvements have been implemented and bugs fixed. There is a new callout
+feature to enable applications to do detailed stack checks at compile time, to
+avoid running out of stack for deeply nested parentheses. The JIT compiler has
+been extended with experimental support for ARM-64, MIPS-64, and PPC-LE.
+
+
+Release 8.34 15-December-2013
+-----------------------------
+
+As well as fixing the inevitable bugs, performance has been improved by
+refactoring and extending the amount of "auto-possessification" that PCRE does.
+Other notable changes:
+
+.  Implemented PCRE_INFO_MATCH_EMPTY, which yields 1 if the pattern can match
+   an empty string. If it can, pcretest shows this in its information output.
+
+.  A back reference to a named subpattern when there is more than one of the
+   same name now checks them in the order in which they appear in the pattern.
+   The first one that is set is used for the reference. Previously only the
+   first one was inspected. This change makes PCRE more compatible with Perl.
+
+.  Unicode character properties were updated from Unicode 6.3.0.
+
+.  The character VT has been added to the set of characters that match \s and
+   are generally treated as white space, following this same change in Perl
+   5.18. There is now no difference between "Perl space" and "POSIX space".
+
+.  Perl has changed its handling of \8 and \9. If there is no previously
+   encountered capturing group of those numbers, they are treated as the
+   literal characters 8 and 9 instead of a binary zero followed by the
+   literals. PCRE now does the same.
+
+.  Following Perl, added \o{} to specify codepoints in octal, making it
+   possible to specify values greater than 0777 and also making them
+   unambiguous.
+
+.  In UCP mode, \s was not matching two of the characters that Perl matches,
+   namely NEL (U+0085) and MONGOLIAN VOWEL SEPARATOR (U+180E), though they
+   were matched by \h.
+
+.  Add JIT support for the 64 bit TileGX architecture.
+
+.  Upgraded the handling of the POSIX classes [:graph:], [:print:], and
+   [:punct:] when PCRE_UCP is set so as to include the same characters as Perl
+   does in Unicode mode.
+
+.  Perl no longer allows group names to start with digits, so I have made this
+   change also in PCRE.
+
+.  Added support for [[:<:]] and [[:>:]] as used in the BSD POSIX library to
+   mean "start of word" and "end of word", respectively, as a transition aid.
+
+
+Release 8.33 28-May-2013
+--------------------------
+
+A number of bugs are fixed, and some performance improvements have been made.
+There are also some new features, of which these are the most important:
+
+.  The behaviour of the backtracking verbs has been rationalized and
+   documented in more detail.
+
+.  JIT now supports callouts and all of the backtracking verbs.
+
+.  Unicode validation has been updated in the light of Unicode Corrigendum #9,
+   which points out that "non characters" are not "characters that may not
+   appear in Unicode strings" but rather "characters that are reserved for
+   internal use and have only local meaning".
+
+.  (*LIMIT_MATCH=d) and (*LIMIT_RECURSION=d) have been added so that the
+   creator of a pattern can specify lower (but not higher) limits for the
+   matching process.
+
+.  The PCRE_NEVER_UTF option is available to prevent pattern-writers from using
+   the (*UTF) feature, as this could be a security issue.
+
+
 Release 8.32 30-November-2012
 -----------------------------

@@ -1,7 +1,16 @@
 README file for PCRE (Perl-compatible regular expression library)
 -----------------------------------------------------------------

-The latest release of PCRE is always available in three alternative formats
+NOTE: This set of files relates to PCRE releases that use the original API,
+with library names libpcre, libpcre16, and libpcre32. January 2015 saw the
+first release of a new API, known as PCRE2, with release numbers starting at
+10.00 and library names libpcre2-8, libpcre2-16, and libpcre2-32. The old
+libraries (now called PCRE1) are still being maintained for bug fixes, but
+there will be no new development. New projects are advised to use the new PCRE2
+libraries.
+
+
+The latest release of PCRE1 is always available in three alternative formats
 from:

  ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/pcre-xxx.tar.gz
@@ -9,8 +18,10 @@ from:
  ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/pcre-xxx.zip

 There is a mailing list for discussion about the development of PCRE at
+pcre-dev@exim.org. You can access the archives and subscribe or manage your
+subscription here:

-  pcre-dev@exim.org
+   https://lists.exim.org/mailman/listinfo/pcre-dev

 Please read the NEWS file if you are upgrading from a previous release.
 The contents of this README file are:
@@ -25,6 +36,8 @@ The contents of this README file are:
  Shared libraries
  Cross-compiling using autotools
  Using HP's ANSI C++ compiler (aCC)
+  Compiling in Tru64 using native compilers
+  Using Sun's compilers for Solaris
  Using PCRE from MySQL
  Making new tarballs
  Testing PCRE
@@ -35,20 +48,22 @@ The contents of this README file are:
 The PCRE APIs
 -------------

-PCRE is written in C, and it has its own API. There are three sets of functions,
-one for the 8-bit library, which processes strings of bytes, one for the
-16-bit library, which processes strings of 16-bit values, and one for the 32-bit
-library, which processes strings of 32-bit values. The distribution also
+PCRE is written in C, and it has its own API. There are three sets of
+functions, one for the 8-bit library, which processes strings of bytes, one for
+the 16-bit library, which processes strings of 16-bit values, and one for the
+32-bit library, which processes strings of 32-bit values. The distribution also
 includes a set of C++ wrapper functions (see the pcrecpp man page for details),
 courtesy of Google Inc., which can be used to call the 8-bit PCRE library from
-C++.
+C++. Other C++ wrappers have been created from time to time. See, for example:
+https://github.com/YasserAsmi/regexp, which aims to be simple and similar in
+style to the C API.

-In addition, there is a set of C wrapper functions (again, just for the 8-bit
-library) that are based on the POSIX regular expression API (see the pcreposix
-man page). These end up in the library called libpcreposix. Note that this just
-provides a POSIX calling interface to PCRE; the regular expressions themselves
-still follow Perl syntax and semantics. The POSIX API is restricted, and does
-not give full access to all of PCRE's facilities.
+The distribution also contains a set of C wrapper functions (again, just for
+the 8-bit library) that are based on the POSIX regular expression API (see the
+pcreposix man page). These end up in the library called libpcreposix. Note that
+this just provides a POSIX calling interface to PCRE; the regular expressions
+themselves still follow Perl syntax and semantics. The POSIX API is restricted,
+and does not give full access to all of PCRE's facilities.

 The header file for the POSIX-style functions is called pcreposix.h. The
 official POSIX name is regex.h, but I did not want to risk possible problems
@@ -81,11 +96,12 @@ documentation is supplied in two other forms:
  1. There are files called doc/pcre.txt, doc/pcregrep.txt, and
     doc/pcretest.txt in the source distribution. The first of these is a
     concatenation of the text forms of all the section 3 man pages except
-     those that summarize individual functions. The other two are the text
-     forms of the section 1 man pages for the pcregrep and pcretest commands.
-     These text forms are provided for ease of scanning with text editors or
-     similar tools. They are installed in <prefix>/share/doc/pcre, where
-     <prefix> is the installation prefix (defaulting to /usr/local).
+     the listing of pcredemo.c and those that summarize individual functions.
+     The other two are the text forms of the section 1 man pages for the
+     pcregrep and pcretest commands. These text forms are provided for ease of
+     scanning with text editors or similar tools. They are installed in
+     <prefix>/share/doc/pcre, where <prefix> is the installation prefix
+     (defaulting to /usr/local).

  2. A set of files containing all the documentation in HTML form, hyperlinked
     in various ways, and rooted in a file called index.html, is distributed in
@@ -110,6 +126,11 @@ contributions provided support for compiling PCRE on various flavours of
 Windows (I myself do not use Windows). Nowadays there is more Windows support
 in the standard distribution, so these contibutions have been archived.

+A PCRE user maintains downloadable Windows binaries of the pcregrep and
+pcretest programs here:
+
+  http://www.rexegg.com/pcregrep-pcretest.html
+

 Building PCRE on non-Unix-like systems
 --------------------------------------
@@ -260,9 +281,17 @@ library. They are also documented in the pcrebuild man page.

  on the "configure" command.

-. PCRE has a counter that can be set to limit the amount of resources it uses.
-  If the limit is exceeded during a match, the match fails. The default is ten
-  million. You can change the default by setting, for example,
+. PCRE has a counter that limits the depth of nesting of parentheses in a
+  pattern. This limits the amount of system stack that a pattern uses when it
+  is compiled. The default is 250, but you can change it by setting, for
+  example,
+
+  --with-parens-nest-limit=500
+
+. PCRE has a counter that can be set to limit the amount of resources it uses
+  when matching a pattern. If the limit is exceeded during a match, the match
+  fails. The default is ten million. You can change the default by setting, for
+  example,

  --with-match-limit=500000

@@ -342,7 +371,8 @@ library. They are also documented in the pcrebuild man page.
  report is generated by running "make coverage". If ccache is installed on
  your system, it must be disabled when building PCRE for coverage reporting.
  You can do this by setting the environment variable CCACHE_DISABLE=1 before
-  running "make" to build PCRE.
+  running "make" to build PCRE. There is more information about coverage
+  reporting in the "pcrebuild" documentation.

 . The pcregrep program currently supports only 8-bit data files, and so
  requires the 8-bit PCRE library. It is possible to compile pcregrep to use
@@ -354,12 +384,12 @@ library. They are also documented in the pcrebuild man page.

  Of course, the relevant libraries must be installed on your system.

-. The default size of internal buffer used by pcregrep can be set by, for
-  example:
+. The default size (in bytes) of the internal buffer used by pcregrep can be
+  set by, for example:

-  --with-pcregrep-bufsize=50K
+  --with-pcregrep-bufsize=51200

-  The default value is 20K.
+  The value must be a plain integer. The default is 20480.

 . It is possible to compile pcretest so that it links with the libreadline
  or libedit libraries, by specifying, respectively,
@@ -575,6 +605,27 @@ running the "configure" script:
  CXXLDFLAGS="-lstd_v2 -lCsup_v2"


+Compiling in Tru64 using native compilers
+-----------------------------------------
+
+The following error may occur when compiling with native compilers in the Tru64
+operating system:
+
+  CXX    libpcrecpp_la-pcrecpp.lo
+cxx: Error: /usr/lib/cmplrs/cxx/V7.1-006/include/cxx/iosfwd, line 58: #error
+          directive: "cannot include iosfwd -- define __USE_STD_IOSTREAM to
+          override default - see section 7.1.2 of the C++ Using Guide"
+#error "cannot include iosfwd -- define __USE_STD_IOSTREAM to override default
+- see section 7.1.2 of the C++ Using Guide"
+
+This may be followed by other errors, complaining that 'namespace "std" has no
+member'. The solution to this is to add the line
+
+#define __USE_STD_IOSTREAM 1
+
+to the config.h file.
+
+
 Using Sun's compilers for Solaris
 ---------------------------------

@@ -624,27 +675,40 @@ NON-AUTOTOOLS-BUILD.
 The RunTest script runs the pcretest test program (which is documented in its
 own man page) on each of the relevant testinput files in the testdata
 directory, and compares the output with the contents of the corresponding
-testoutput files. Some tests are relevant only when certain build-time options
-were selected. For example, the tests for UTF-8/16/32 support are run only if
--enable-utf was used. RunTest outputs a comment when it skips a test.
+testoutput files. RunTest uses a file called testtry to hold the main output
+from pcretest. Other files whose names begin with "test" are used as working
+files in some tests.
+
+Some tests are relevant only when certain build-time options were selected. For
+example, the tests for UTF-8/16/32 support are run only if --enable-utf was
+used. RunTest outputs a comment when it skips a test.

 Many of the tests that are not skipped are run up to three times. The second
 run forces pcre_study() to be called for all patterns except for a few in some
 tests that are marked "never study" (see the pcretest program for how this is
 done). If JIT support is available, the non-DFA tests are run a third time,
 this time with a forced pcre_study() with the PCRE_STUDY_JIT_COMPILE option.
+This testing can be suppressed by putting "nojit" on the RunTest command line.

 The entire set of tests is run once for each of the 8-bit, 16-bit and 32-bit
 libraries that are enabled. If you want to run just one set of tests, call
 RunTest with either the -8, -16 or -32 option.

-RunTest uses a file called testtry to hold the main output from pcretest.
-Other files whose names begin with "test" are used as working files in some
-tests. To run pcretest on just one or more specific test files, give their
-numbers as arguments to RunTest, for example:
+If valgrind is installed, you can run the tests under it by putting "valgrind"
+on the RunTest command line. To run pcretest on just one or more specific test
+files, give their numbers as arguments to RunTest, for example:

  RunTest 2 7 11

+You can also specify ranges of tests such as 3-6 or 3- (meaning 3 to the
+end), or a number preceded by ~ to exclude a test. For example:
+
+  Runtest 3-15 ~10
+
+This runs tests 3 to 15, excluding test 10, and just ~13 runs all the tests
+except test 13. Whatever order the arguments are in, the tests are always run
+in numerical order.
+
 You can also call RunTest with the single argument "list" to cause it to output
 a list of tests.

@@ -704,21 +768,24 @@ test is run only when JIT support is not available. They test some JIT-specific
 features such as information output from pcretest about JIT compilation.

 The fourteenth, fifteenth, and sixteenth tests are run only in 8-bit mode, and
-the seventeenth, eighteenth, and nineteenth tests are run only in 16/32-bit mode.
-These are tests that generate different output in the two modes. They are for
-general cases, UTF-8/16/32 support, and Unicode property support, respectively.
+the seventeenth, eighteenth, and nineteenth tests are run only in 16/32-bit
+mode. These are tests that generate different output in the two modes. They are
+for general cases, UTF-8/16/32 support, and Unicode property support,
+respectively.

 The twentieth test is run only in 16/32-bit mode. It tests some specific
 16/32-bit features of the DFA matching engine.

-The twenty-first and twenty-second tests are run only in 16/32-bit mode, when the
-link size is set to 2 for the 16-bit library. They test reloading pre-compiled patterns.
+The twenty-first and twenty-second tests are run only in 16/32-bit mode, when
+the link size is set to 2 for the 16-bit library. They test reloading
+pre-compiled patterns.

-The twenty-third and twenty-fourth tests are run only in 16-bit mode. They are for
-general cases, and UTF-16 support, respectively.
+The twenty-third and twenty-fourth tests are run only in 16-bit mode. They are
+for general cases, and UTF-16 support, respectively.
+
+The twenty-fifth and twenty-sixth tests are run only in 32-bit mode. They are
+for general cases, and UTF-32 support, respectively.

-The twenty-fifth and twenty-sixth tests are run only in 32-bit mode. They are for
-general cases, and UTF-32 support, respectively.

 Character tables
 ----------------
@@ -784,11 +851,11 @@ pcre_xxx, one with the name pcre16_xx, and a third with the name pcre32_xxx.
 (A) Source files of the PCRE library functions and their headers:

  dftables.c              auxiliary program for building pcre_chartables.c
-                            when --enable-rebuild-chartables is specified
+                          when --enable-rebuild-chartables is specified

  pcre_chartables.c.dist  a default set of character tables that assume ASCII
-                            coding; used, unless --enable-rebuild-chartables is
-                            specified, by copying to pcre[16]_chartables.c
+                          coding; used, unless --enable-rebuild-chartables is
+                          specified, by copying to pcre[16]_chartables.c

  pcreposix.c                )
  pcre[16|32]_byte_order.c   )
@@ -932,4 +999,4 @@ pcre_xxx, one with the name pcre16_xx, and a third with the name pcre32_xxx.
 Philip Hazel
 Email local part: ph10
 Email domain: cam.ac.uk
-Last updated: 27 October 2012
+Last updated: 10 February 2015
@@ -312,7 +312,7 @@ them both to 0; an emulation function will be used. */
 #define PACKAGE_NAME "PCRE"

 /* Define to the full name and version of this package. */
-#define PACKAGE_STRING "PCRE 8.32"
+#define PACKAGE_STRING "PCRE 8.36"

 /* Define to the one symbol short name of this package. */
 #define PACKAGE_TARNAME "pcre"
@@ -321,7 +321,7 @@ them both to 0; an emulation function will be used. */
 #define PACKAGE_URL ""

 /* Define to the version of this package. */
-#define PACKAGE_VERSION "8.32"
+#define PACKAGE_VERSION "8.36"

 /* to make a symbol visible */
 /* #undef PCRECPP_EXP_DECL */
@@ -329,6 +329,13 @@ them both to 0; an emulation function will be used. */
 /* to make a symbol visible */
 /* #undef PCRECPP_EXP_DEFN */

+/* The value of PARENS_NEST_LIMIT specifies the maximum depth of nested
+   parentheses (of any kind) in a pattern. This limits the amount of system
+   stack that is used while compiling a pattern. */
+#ifndef PARENS_NEST_LIMIT
+#define PARENS_NEST_LIMIT 250
+#endif
+
 /* The value of PCREGREP_BUFSIZE determines the size of buffer used by
   pcregrep to hold parts of the file it is searching. This is also the
   minimum value. The actual amount of memory used by pcregrep is three times
@@ -388,7 +395,7 @@ them both to 0; an emulation function will be used. */
 #undef SUPPORT_GCOV

 /* Define to any value to enable support for Just-In-Time compiling. */
-#undef SUPPORT_JIT
+#define SUPPORT_JIT

 /* Define to any value to allow pcregrep to be linked with libbz2, so that it
   is able to handle .bz2 files. */
@@ -430,7 +437,7 @@ them both to 0; an emulation function will be used. */

 /* Version number of package */
 #ifndef VERSION
-#define VERSION "8.32"
+#define VERSION "8.36"
 #endif

 /* Define to empty if `const' does not conform to ANSI C. */
@@ -442,3 +449,4 @@ them both to 0; an emulation function will be used. */

 /* Define to `unsigned int' if <sys/types.h> does not define. */
 /* #undef size_t */
+
@@ -5,7 +5,7 @@
 /* This is the public header file for the PCRE library, to be #included by
 applications that call the PCRE functions.

-           Copyright (c) 1997-2012 University of Cambridge
+           Copyright (c) 1997-2014 University of Cambridge

 -----------------------------------------------------------------------------
 Redistribution and use in source and binary forms, with or without
@@ -42,9 +42,9 @@ POSSIBILITY OF SUCH DAMAGE.
 /* The current PCRE version information. */

 #define PCRE_MAJOR          8
-#define PCRE_MINOR          32
+#define PCRE_MINOR          36
 #define PCRE_PRERELEASE     
-#define PCRE_DATE           2012-11-30
+#define PCRE_DATE           2014-09-26

 /* When an application links to a PCRE DLL in Windows, the symbols that are
 imported have to be identified as such. When building PCRE, the appropriate
@@ -96,11 +96,14 @@ extern "C" {
 #endif

 /* Public options. Some are compile-time only, some are run-time only, and some
-are both, so we keep them all distinct. However, almost all the bits in the
-options word are now used. In the long run, we may have to re-use some of the
-compile-time only bits for runtime options, or vice versa. Any of the
-compile-time options may be inspected during studying (and therefore JIT
-compiling).
+are both. Most of the compile-time options are saved with the compiled regex so
+that they can be inspected during studying (and therefore JIT compiling). Note
+that pcre_study() has its own set of options. Originally, all the options
+defined here used distinct bits. However, almost all the bits in a 32-bit word
+are now used, so in order to conserve them, option bits that were previously
+only recognized at matching time (i.e. by pcre_exec() or pcre_dfa_exec()) may
+also be used for compile-time options that affect only compiling and are not
+relevant for studying or JIT compiling.

 Some options for pcre_compile() change its behaviour but do not affect the
 behaviour of the execution functions. Other options are passed through to the
@@ -142,8 +145,15 @@ with J. */
 #define PCRE_AUTO_CALLOUT       0x00004000  /* C1       */
 #define PCRE_PARTIAL_SOFT       0x00008000  /*    E D J  ) Synonyms */
 #define PCRE_PARTIAL            0x00008000  /*    E D J  )          */
-#define PCRE_DFA_SHORTEST       0x00010000  /*      D   */
-#define PCRE_DFA_RESTART        0x00020000  /*      D   */
+
+/* This pair use the same bit. */
+#define PCRE_NEVER_UTF          0x00010000  /* C1        ) Overlaid */
+#define PCRE_DFA_SHORTEST       0x00010000  /*      D    ) Overlaid */
+
+/* This pair use the same bit. */
+#define PCRE_NO_AUTO_POSSESS    0x00020000  /* C1        ) Overlaid */
+#define PCRE_DFA_RESTART        0x00020000  /*      D    ) Overlaid */
+
 #define PCRE_FIRSTLINE          0x00040000  /* C3       */
 #define PCRE_DUPNAMES           0x00080000  /* C1       */
 #define PCRE_NEWLINE_CR         0x00100000  /* C3 E D   */
@@ -199,6 +209,7 @@ with J. */
 #define PCRE_ERROR_DFA_BADRESTART  (-30)
 #define PCRE_ERROR_JIT_BADOPTION   (-31)
 #define PCRE_ERROR_BADLENGTH       (-32)
+#define PCRE_ERROR_UNSET           (-33)

 /* Specific error codes for UTF-8 validity checks */

@@ -224,7 +235,7 @@ with J. */
 #define PCRE_UTF8_ERR19             19
 #define PCRE_UTF8_ERR20             20
 #define PCRE_UTF8_ERR21             21
-#define PCRE_UTF8_ERR22             22
+#define PCRE_UTF8_ERR22             22  /* Unused (was non-character) */

 /* Specific error codes for UTF-16 validity checks */

@@ -232,13 +243,13 @@ with J. */
 #define PCRE_UTF16_ERR1              1
 #define PCRE_UTF16_ERR2              2
 #define PCRE_UTF16_ERR3              3
-#define PCRE_UTF16_ERR4              4
+#define PCRE_UTF16_ERR4              4  /* Unused (was non-character) */

 /* Specific error codes for UTF-32 validity checks */

 #define PCRE_UTF32_ERR0              0
 #define PCRE_UTF32_ERR1              1
-#define PCRE_UTF32_ERR2              2
+#define PCRE_UTF32_ERR2              2  /* Unused (was non-character) */
 #define PCRE_UTF32_ERR3              3

 /* Request types for pcre_fullinfo() */
@@ -263,10 +274,13 @@ with J. */
 #define PCRE_INFO_JIT               16
 #define PCRE_INFO_JITSIZE           17
 #define PCRE_INFO_MAXLOOKBEHIND     18
-#define PCRE_INFO_FIRSTCHARACTER      19
-#define PCRE_INFO_FIRSTCHARACTERFLAGS   20
+#define PCRE_INFO_FIRSTCHARACTER    19
+#define PCRE_INFO_FIRSTCHARACTERFLAGS 20
 #define PCRE_INFO_REQUIREDCHAR      21
-#define PCRE_INFO_REQUIREDCHARFLAGS   22
+#define PCRE_INFO_REQUIREDCHARFLAGS 22
+#define PCRE_INFO_MATCHLIMIT        23
+#define PCRE_INFO_RECURSIONLIMIT    24
+#define PCRE_INFO_MATCH_EMPTY       25

 /* Request types for pcre_config(). Do not re-arrange, in order to remain
 compatible. */
@@ -284,6 +298,7 @@ compatible. */
 #define PCRE_CONFIG_UTF16                  10
 #define PCRE_CONFIG_JITTARGET              11
 #define PCRE_CONFIG_UTF32                  12
+#define PCRE_CONFIG_PARENS_LIMIT           13

 /* Request types for pcre_study(). Do not re-arrange, in order to remain
 compatible. */
@@ -476,36 +491,42 @@ PCRE_EXP_DECL void  (*pcre_free)(void *);
 PCRE_EXP_DECL void *(*pcre_stack_malloc)(size_t);
 PCRE_EXP_DECL void  (*pcre_stack_free)(void *);
 PCRE_EXP_DECL int   (*pcre_callout)(pcre_callout_block *);
+PCRE_EXP_DECL int   (*pcre_stack_guard)(void);

 PCRE_EXP_DECL void *(*pcre16_malloc)(size_t);
 PCRE_EXP_DECL void  (*pcre16_free)(void *);
 PCRE_EXP_DECL void *(*pcre16_stack_malloc)(size_t);
 PCRE_EXP_DECL void  (*pcre16_stack_free)(void *);
 PCRE_EXP_DECL int   (*pcre16_callout)(pcre16_callout_block *);
+PCRE_EXP_DECL int   (*pcre16_stack_guard)(void);

 PCRE_EXP_DECL void *(*pcre32_malloc)(size_t);
 PCRE_EXP_DECL void  (*pcre32_free)(void *);
 PCRE_EXP_DECL void *(*pcre32_stack_malloc)(size_t);
 PCRE_EXP_DECL void  (*pcre32_stack_free)(void *);
 PCRE_EXP_DECL int   (*pcre32_callout)(pcre32_callout_block *);
+PCRE_EXP_DECL int   (*pcre32_stack_guard)(void);
 #else   /* VPCOMPAT */
 PCRE_EXP_DECL void *pcre_malloc(size_t);
 PCRE_EXP_DECL void  pcre_free(void *);
 PCRE_EXP_DECL void *pcre_stack_malloc(size_t);
 PCRE_EXP_DECL void  pcre_stack_free(void *);
 PCRE_EXP_DECL int   pcre_callout(pcre_callout_block *);
+PCRE_EXP_DECL int   pcre_stack_guard(void);

 PCRE_EXP_DECL void *pcre16_malloc(size_t);
 PCRE_EXP_DECL void  pcre16_free(void *);
 PCRE_EXP_DECL void *pcre16_stack_malloc(size_t);
 PCRE_EXP_DECL void  pcre16_stack_free(void *);
 PCRE_EXP_DECL int   pcre16_callout(pcre16_callout_block *);
+PCRE_EXP_DECL int   pcre16_stack_guard(void);

 PCRE_EXP_DECL void *pcre32_malloc(size_t);
 PCRE_EXP_DECL void  pcre32_free(void *);
 PCRE_EXP_DECL void *pcre32_stack_malloc(size_t);
 PCRE_EXP_DECL void  pcre32_stack_free(void *);
 PCRE_EXP_DECL int   pcre32_callout(pcre32_callout_block *);
+PCRE_EXP_DECL int   pcre32_stack_guard(void);
 #endif  /* VPCOMPAT */

 /* User defined callback which provides a stack just before the match starts. */
@@ -645,6 +666,9 @@ PCRE_EXP_DECL void pcre16_assign_jit_stack(pcre16_extra *,
                  pcre16_jit_callback, void *);
 PCRE_EXP_DECL void pcre32_assign_jit_stack(pcre32_extra *,
                  pcre32_jit_callback, void *);
+PCRE_EXP_DECL void pcre_jit_free_unused_memory(void);
+PCRE_EXP_DECL void pcre16_jit_free_unused_memory(void);
+PCRE_EXP_DECL void pcre32_jit_free_unused_memory(void);

 #ifdef __cplusplus
 }  /* extern "C" */
@@ -163,7 +163,7 @@ graph, print, punct, and cntrl. Other classes are built from combinations. */
 */

  0x80,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*   0-  7 */
-  0x00,0x01,0x01,0x00,0x01,0x01,0x00,0x00, /*   8- 15 */
+  0x00,0x01,0x01,0x01,0x01,0x01,0x00,0x00, /*   8- 15 */
  0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  16- 23 */
  0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /*  24- 31 */
  0x01,0x00,0x00,0x00,0x80,0x00,0x00,0x00, /*    - '  */
@@ -161,6 +161,10 @@ switch (what)
  *((int *)where) = POSIX_MALLOC_THRESHOLD;
  break;

+  case PCRE_CONFIG_PARENS_LIMIT:
+  *((unsigned long int *)where) = PARENS_NEST_LIMIT;
+  break;
+
  case PCRE_CONFIG_MATCH_LIMIT:
  *((unsigned long int *)where) = MATCH_LIMIT;
  break;
@@ -6,7 +6,7 @@
 and semantics are as close as possible to those of the Perl 5 language.

                       Written by Philip Hazel
-           Copyright (c) 1997-2012 University of Cambridge
+           Copyright (c) 1997-2013 University of Cambridge

 -----------------------------------------------------------------------------
 Redistribution and use in source and binary forms, with or without
@@ -222,6 +222,20 @@ switch (what)
  *((int *)where) = re->max_lookbehind;
  break;

+  case PCRE_INFO_MATCHLIMIT:
+  if ((re->flags & PCRE_MLSET) == 0) return PCRE_ERROR_UNSET;
+  *((pcre_uint32 *)where) = re->limit_match;
+  break;
+
+  case PCRE_INFO_RECURSIONLIMIT:
+  if ((re->flags & PCRE_RLSET) == 0) return PCRE_ERROR_UNSET;
+  *((pcre_uint32 *)where) = re->limit_recursion;
+  break;
+
+  case PCRE_INFO_MATCH_EMPTY:
+  *((int *)where) = (re->flags & PCRE_MATCH_EMPTY) != 0;
+  break;
+
  default: return PCRE_ERROR_BADOPTION;
  }

@@ -6,7 +6,7 @@
 and semantics are as close as possible to those of the Perl 5 language.

                       Written by Philip Hazel
-           Copyright (c) 1997-2012 University of Cambridge
+           Copyright (c) 1997-2014 University of Cambridge

 -----------------------------------------------------------------------------
 Redistribution and use in source and binary forms, with or without
@@ -72,6 +72,7 @@ PCRE_EXP_DATA_DEFN void  (*PUBL(free))(void *) = LocalPcreFree;
 PCRE_EXP_DATA_DEFN void *(*PUBL(stack_malloc))(size_t) = LocalPcreMalloc;
 PCRE_EXP_DATA_DEFN void  (*PUBL(stack_free))(void *) = LocalPcreFree;
 PCRE_EXP_DATA_DEFN int   (*PUBL(callout))(PUBL(callout_block) *) = NULL;
+PCRE_EXP_DATA_DEFN int   (*PUBL(stack_guard))(void) = NULL;

 #elif !defined VPCOMPAT
 PCRE_EXP_DATA_DEFN void *(*PUBL(malloc))(size_t) = malloc;
@@ -79,6 +80,7 @@ PCRE_EXP_DATA_DEFN void  (*PUBL(free))(void *) = free;
 PCRE_EXP_DATA_DEFN void *(*PUBL(stack_malloc))(size_t) = malloc;
 PCRE_EXP_DATA_DEFN void  (*PUBL(stack_free))(void *) = free;
 PCRE_EXP_DATA_DEFN int   (*PUBL(callout))(PUBL(callout_block) *) = NULL;
+PCRE_EXP_DATA_DEFN int   (*PUBL(stack_guard))(void) = NULL;
 #endif

 /* End of pcre_globals.c */
@@ -7,7 +7,7 @@
 and semantics are as close as possible to those of the Perl 5 language.

                       Written by Philip Hazel
-           Copyright (c) 1997-2012 University of Cambridge
+           Copyright (c) 1997-2014 University of Cambridge

 -----------------------------------------------------------------------------
 Redistribution and use in source and binary forms, with or without
@@ -194,23 +194,31 @@ preprocessor time in standard C environments. */
 typedef unsigned char pcre_uint8;

 #if USHRT_MAX == 65535
-  typedef unsigned short pcre_uint16;
-  typedef short pcre_int16;
+typedef unsigned short pcre_uint16;
+typedef short pcre_int16;
+#define PCRE_UINT16_MAX USHRT_MAX
+#define PCRE_INT16_MAX SHRT_MAX
 #elif UINT_MAX == 65535
-  typedef unsigned int pcre_uint16;
-  typedef int pcre_int16;
+typedef unsigned int pcre_uint16;
+typedef int pcre_int16;
+#define PCRE_UINT16_MAX UINT_MAX
+#define PCRE_INT16_MAX INT_MAX
 #else
-# error Cannot determine a type for 16-bit unsigned integers
+#error Cannot determine a type for 16-bit integers
 #endif

-#if UINT_MAX == 4294967295
-  typedef unsigned int pcre_uint32;
-  typedef int pcre_int32;
-#elif ULONG_MAX == 4294967295
-  typedef unsigned long int pcre_uint32;
-  typedef long int pcre_int32;
+#if UINT_MAX == 4294967295U
+typedef unsigned int pcre_uint32;
+typedef int pcre_int32;
+#define PCRE_UINT32_MAX UINT_MAX
+#define PCRE_INT32_MAX INT_MAX
+#elif ULONG_MAX == 4294967295UL
+typedef unsigned long int pcre_uint32;
+typedef long int pcre_int32;
+#define PCRE_UINT32_MAX ULONG_MAX
+#define PCRE_INT32_MAX LONG_MAX
 #else
-# error Cannot determine a type for 32-bit unsigned integers
+#error Cannot determine a type for 32-bit integers
 #endif

 /* When checking for integer overflow in pcre_compile(), we need to handle
@@ -223,11 +231,13 @@ by "configure". */

 #ifdef PHP_WIN32
 #include "win32/php_stdint.h"
-#elif HAVE_STDINT_H
+#else
+#if defined HAVE_STDINT_H
 #include <stdint.h>
-#elif HAVE_INTTYPES_H
+#elif defined HAVE_INTTYPES_H
 #include <inttypes.h>
 #endif
+#endif

 #if defined INT64_MAX || defined int64_t
 #define INT64_OR_DOUBLE int64_t
@@ -310,8 +320,8 @@ start/end of string field names are. */
       &(NLBLOCK->nllen), utf)) \
    : \
    ((p) <= NLBLOCK->PSEND - NLBLOCK->nllen && \
-     RAWUCHARTEST(p) == NLBLOCK->nl[0] && \
-     (NLBLOCK->nllen == 1 || RAWUCHARTEST(p+1) == NLBLOCK->nl[1])       \
+     UCHAR21TEST(p) == NLBLOCK->nl[0] && \
+     (NLBLOCK->nllen == 1 || UCHAR21TEST(p+1) == NLBLOCK->nl[1])       \
    ) \
  )

@@ -324,8 +334,8 @@ start/end of string field names are. */
       &(NLBLOCK->nllen), utf)) \
    : \
    ((p) >= NLBLOCK->PSSTART + NLBLOCK->nllen && \
-     RAWUCHARTEST(p - NLBLOCK->nllen) == NLBLOCK->nl[0] &&              \
-     (NLBLOCK->nllen == 1 || RAWUCHARTEST(p - NLBLOCK->nllen + 1) == NLBLOCK->nl[1]) \
+     UCHAR21TEST(p - NLBLOCK->nllen) == NLBLOCK->nl[0] &&              \
+     (NLBLOCK->nllen == 1 || UCHAR21TEST(p - NLBLOCK->nllen + 1) == NLBLOCK->nl[1]) \
    ) \
  )

@@ -576,12 +586,27 @@ changed in future to be a fixed number of bytes or to depend on LINK_SIZE. */
 #define MAX_MARK ((1u << 8) - 1)
 #endif

+/* There is a proposed future special "UTF-21" mode, in which only the lowest
+21 bits of a 32-bit character are interpreted as UTF, with the remaining 11
+high-order bits available to the application for other uses. In preparation for
+the future implementation of this mode, there are macros that load a data item
+and, if in this special mode, mask it to 21 bits. These macros all have names
+starting with UCHAR21. In all other modes, including the normal 32-bit
+library, the macros all have the same simple definitions. When the new mode is
+implemented, it is expected that these definitions will be varied appropriately
+using #ifdef when compiling the library that supports the special mode. */
+
+#define UCHAR21(eptr)        (*(eptr))
+#define UCHAR21TEST(eptr)    (*(eptr))
+#define UCHAR21INC(eptr)     (*(eptr)++)
+#define UCHAR21INCTEST(eptr) (*(eptr)++)
+
 /* When UTF encoding is being used, a character is no longer just a single
-byte. The macros for character handling generate simple sequences when used in
-character-mode, and more complicated ones for UTF characters. GETCHARLENTEST
-and other macros are not used when UTF is not supported, so they are not
-defined. To make sure they can never even appear when UTF support is omitted,
-we don't even define them. */
+byte in 8-bit mode or a single short in 16-bit mode. The macros for character
+handling generate simple sequences when used in the basic mode, and more
+complicated ones for UTF characters. GETCHARLENTEST and other macros are not
+used when UTF is not supported. To make sure they can never even appear when
+UTF support is omitted, we don't even define them. */

 #ifndef SUPPORT_UTF

@@ -594,10 +619,6 @@ we don't even define them. */
 #define GETCHARINC(c, eptr) c = *eptr++;
 #define GETCHARINCTEST(c, eptr) c = *eptr++;
 #define GETCHARLEN(c, eptr, len) c = *eptr;
-#define RAWUCHAR(eptr) (*(eptr))
-#define RAWUCHARINC(eptr) (*(eptr)++)
-#define RAWUCHARTEST(eptr) (*(eptr))
-#define RAWUCHARINCTEST(eptr) (*(eptr)++)
 /* #define GETCHARLENTEST(c, eptr, len) */
 /* #define BACKCHAR(eptr) */
 /* #define FORWARDCHAR(eptr) */
@@ -770,30 +791,6 @@ do not know if we are in UTF-8 mode. */
  c = *eptr; \
  if (utf && c >= 0xc0) GETUTF8LEN(c, eptr, len);

-/* Returns the next uchar, not advancing the pointer. This is called when
-we know we are in UTF mode. */
-
-#define RAWUCHAR(eptr) \
-  (*(eptr))
-
-/* Returns the next uchar, advancing the pointer. This is called when
-we know we are in UTF mode. */
-
-#define RAWUCHARINC(eptr) \
-  (*((eptr)++))
-
-/* Returns the next uchar, testing for UTF mode, and not advancing the
-pointer. */
-
-#define RAWUCHARTEST(eptr) \
-  (*(eptr))
-
-/* Returns the next uchar, testing for UTF mode, advancing the
-pointer. */
-
-#define RAWUCHARINCTEST(eptr) \
-  (*((eptr)++))
-
 /* If the pointer is not at the start of a character, move it back until
 it is. This is called only in UTF-8 mode - we don't put a test within the macro
 because almost all calls are already within a block of UTF-8 only code. */
@@ -889,30 +886,6 @@ we do not know if we are in UTF-16 mode. */
  c = *eptr; \
  if (utf && (c & 0xfc00) == 0xd800) GETUTF16LEN(c, eptr, len);

-/* Returns the next uchar, not advancing the pointer. This is called when
-we know we are in UTF mode. */
-
-#define RAWUCHAR(eptr) \
-  (*(eptr))
-
-/* Returns the next uchar, advancing the pointer. This is called when
-we know we are in UTF mode. */
-
-#define RAWUCHARINC(eptr) \
-  (*((eptr)++))
-
-/* Returns the next uchar, testing for UTF mode, and not advancing the
-pointer. */
-
-#define RAWUCHARTEST(eptr) \
-  (*(eptr))
-
-/* Returns the next uchar, testing for UTF mode, advancing the
-pointer. */
-
-#define RAWUCHARINCTEST(eptr) \
-  (*((eptr)++))
-
 /* If the pointer is not at the start of a character, move it back until
 it is. This is called only in UTF-16 mode - we don't put a test within the
 macro because almost all calls are already within a block of UTF-16 only
@@ -974,30 +947,6 @@ This is called when we do not know if we are in UTF-32 mode. */
 #define GETCHARLENTEST(c, eptr, len) \
  GETCHARTEST(c, eptr)

-/* Returns the next uchar, not advancing the pointer. This is called when
-we know we are in UTF mode. */
-
-#define RAWUCHAR(eptr) \
-  (*(eptr))
-
-/* Returns the next uchar, advancing the pointer. This is called when
-we know we are in UTF mode. */
-
-#define RAWUCHARINC(eptr) \
-  (*((eptr)++))
-
-/* Returns the next uchar, testing for UTF mode, and not advancing the
-pointer. */
-
-#define RAWUCHARTEST(eptr) \
-  (*(eptr))
-
-/* Returns the next uchar, testing for UTF mode, advancing the
-pointer. */
-
-#define RAWUCHARINCTEST(eptr) \
-  (*((eptr)++))
-
 /* If the pointer is not at the start of a character, move it back until
 it is. This is called only in UTF-32 mode - we don't put a test within the
 macro because almost all calls are already within a block of UTF-32 only
@@ -1123,23 +1072,27 @@ other. NOTE: The values also appear in pcre_jit_compile.c. */


 /* Private flags containing information about the compiled regex. They used to
-live at the top end of the options word, but that got almost full, so now they
-are in a 16-bit flags word. From release 8.00, PCRE_NOPARTIAL is unused, as
-the restrictions on partial matching have been lifted. It remains for backwards
+live at the top end of the options word, but that got almost full, so they were
+moved to a 16-bit flags word - which got almost full, so now they are in a
+32-bit flags word. From release 8.00, PCRE_NOPARTIAL is unused, as the
+restrictions on partial matching have been lifted. It remains for backwards
 compatibility. */

-#define PCRE_MODE8         0x0001  /* compiled in 8 bit mode */
-#define PCRE_MODE16        0x0002  /* compiled in 16 bit mode */
-#define PCRE_MODE32        0x0004  /* compiled in 32 bit mode */
-#define PCRE_FIRSTSET      0x0010  /* first_char is set */
-#define PCRE_FCH_CASELESS  0x0020  /* caseless first char */
-#define PCRE_REQCHSET      0x0040  /* req_byte is set */
-#define PCRE_RCH_CASELESS  0x0080  /* caseless requested char */
-#define PCRE_STARTLINE     0x0100  /* start after \n for multiline */
-#define PCRE_NOPARTIAL     0x0200  /* can't use partial with this regex */
-#define PCRE_JCHANGED      0x0400  /* j option used in regex */
-#define PCRE_HASCRORLF     0x0800  /* explicit \r or \n in pattern */
-#define PCRE_HASTHEN       0x1000  /* pattern contains (*THEN) */
+#define PCRE_MODE8         0x00000001  /* compiled in 8 bit mode */
+#define PCRE_MODE16        0x00000002  /* compiled in 16 bit mode */
+#define PCRE_MODE32        0x00000004  /* compiled in 32 bit mode */
+#define PCRE_FIRSTSET      0x00000010  /* first_char is set */
+#define PCRE_FCH_CASELESS  0x00000020  /* caseless first char */
+#define PCRE_REQCHSET      0x00000040  /* req_byte is set */
+#define PCRE_RCH_CASELESS  0x00000080  /* caseless requested char */
+#define PCRE_STARTLINE     0x00000100  /* start after \n for multiline */
+#define PCRE_NOPARTIAL     0x00000200  /* can't use partial with this regex */
+#define PCRE_JCHANGED      0x00000400  /* j option used in regex */
+#define PCRE_HASCRORLF     0x00000800  /* explicit \r or \n in pattern */
+#define PCRE_HASTHEN       0x00001000  /* pattern contains (*THEN) */
+#define PCRE_MLSET         0x00002000  /* match limit set by regex */
+#define PCRE_RLSET         0x00004000  /* recursion limit set by regex */
+#define PCRE_MATCH_EMPTY   0x00008000  /* pattern can match empty string */

 #if defined COMPILE_PCRE8
 #define PCRE_MODE          PCRE_MODE8
@@ -1164,9 +1117,10 @@ time, run time, or study time, respectively. */
 #define PUBLIC_COMPILE_OPTIONS \
  (PCRE_CASELESS|PCRE_EXTENDED|PCRE_ANCHORED|PCRE_MULTILINE| \
   PCRE_DOTALL|PCRE_DOLLAR_ENDONLY|PCRE_EXTRA|PCRE_UNGREEDY|PCRE_UTF8| \
-   PCRE_NO_AUTO_CAPTURE|PCRE_NO_UTF8_CHECK|PCRE_AUTO_CALLOUT|PCRE_FIRSTLINE| \
+   PCRE_NO_AUTO_CAPTURE|PCRE_NO_AUTO_POSSESS| \
+   PCRE_NO_UTF8_CHECK|PCRE_AUTO_CALLOUT|PCRE_FIRSTLINE| \
   PCRE_DUPNAMES|PCRE_NEWLINE_BITS|PCRE_BSR_ANYCRLF|PCRE_BSR_UNICODE| \
-   PCRE_JAVASCRIPT_COMPAT|PCRE_UCP|PCRE_NO_START_OPTIMIZE)
+   PCRE_JAVASCRIPT_COMPAT|PCRE_UCP|PCRE_NO_START_OPTIMIZE|PCRE_NEVER_UTF)

 #define PUBLIC_EXEC_OPTIONS \
  (PCRE_ANCHORED|PCRE_NOTBOL|PCRE_NOTEOL|PCRE_NOTEMPTY|PCRE_NOTEMPTY_ATSTART| \
@@ -1522,20 +1476,25 @@ a positive value. */
 #define STRING_xdigit               "xdigit"

 #define STRING_DEFINE               "DEFINE"
+#define STRING_WEIRD_STARTWORD      "[:<:]]"
+#define STRING_WEIRD_ENDWORD        "[:>:]]"

-#define STRING_CR_RIGHTPAR             "CR)"
-#define STRING_LF_RIGHTPAR             "LF)"
-#define STRING_CRLF_RIGHTPAR           "CRLF)"
-#define STRING_ANY_RIGHTPAR            "ANY)"
-#define STRING_ANYCRLF_RIGHTPAR        "ANYCRLF)"
-#define STRING_BSR_ANYCRLF_RIGHTPAR    "BSR_ANYCRLF)"
-#define STRING_BSR_UNICODE_RIGHTPAR    "BSR_UNICODE)"
-#define STRING_UTF8_RIGHTPAR           "UTF8)"
-#define STRING_UTF16_RIGHTPAR          "UTF16)"
-#define STRING_UTF32_RIGHTPAR          "UTF32)"
-#define STRING_UTF_RIGHTPAR            "UTF)"
-#define STRING_UCP_RIGHTPAR            "UCP)"
-#define STRING_NO_START_OPT_RIGHTPAR   "NO_START_OPT)"
+#define STRING_CR_RIGHTPAR              "CR)"
+#define STRING_LF_RIGHTPAR              "LF)"
+#define STRING_CRLF_RIGHTPAR            "CRLF)"
+#define STRING_ANY_RIGHTPAR             "ANY)"
+#define STRING_ANYCRLF_RIGHTPAR         "ANYCRLF)"
+#define STRING_BSR_ANYCRLF_RIGHTPAR     "BSR_ANYCRLF)"
+#define STRING_BSR_UNICODE_RIGHTPAR     "BSR_UNICODE)"
+#define STRING_UTF8_RIGHTPAR            "UTF8)"
+#define STRING_UTF16_RIGHTPAR           "UTF16)"
+#define STRING_UTF32_RIGHTPAR           "UTF32)"
+#define STRING_UTF_RIGHTPAR             "UTF)"
+#define STRING_UCP_RIGHTPAR             "UCP)"
+#define STRING_NO_AUTO_POSSESS_RIGHTPAR "NO_AUTO_POSSESS)"
+#define STRING_NO_START_OPT_RIGHTPAR    "NO_START_OPT)"
+#define STRING_LIMIT_MATCH_EQ           "LIMIT_MATCH="
+#define STRING_LIMIT_RECURSION_EQ       "LIMIT_RECURSION="

 #else  /* SUPPORT_UTF */

@@ -1783,20 +1742,25 @@ only. */
 #define STRING_xdigit               STR_x STR_d STR_i STR_g STR_i STR_t

 #define STRING_DEFINE               STR_D STR_E STR_F STR_I STR_N STR_E
+#define STRING_WEIRD_STARTWORD      STR_LEFT_SQUARE_BRACKET STR_COLON STR_LESS_THAN_SIGN STR_COLON STR_RIGHT_SQUARE_BRACKET STR_RIGHT_SQUARE_BRACKET
+#define STRING_WEIRD_ENDWORD        STR_LEFT_SQUARE_BRACKET STR_COLON STR_GREATER_THAN_SIGN STR_COLON STR_RIGHT_SQUARE_BRACKET STR_RIGHT_SQUARE_BRACKET

-#define STRING_CR_RIGHTPAR             STR_C STR_R STR_RIGHT_PARENTHESIS
-#define STRING_LF_RIGHTPAR             STR_L STR_F STR_RIGHT_PARENTHESIS
-#define STRING_CRLF_RIGHTPAR           STR_C STR_R STR_L STR_F STR_RIGHT_PARENTHESIS
-#define STRING_ANY_RIGHTPAR            STR_A STR_N STR_Y STR_RIGHT_PARENTHESIS
-#define STRING_ANYCRLF_RIGHTPAR        STR_A STR_N STR_Y STR_C STR_R STR_L STR_F STR_RIGHT_PARENTHESIS
-#define STRING_BSR_ANYCRLF_RIGHTPAR    STR_B STR_S STR_R STR_UNDERSCORE STR_A STR_N STR_Y STR_C STR_R STR_L STR_F STR_RIGHT_PARENTHESIS
-#define STRING_BSR_UNICODE_RIGHTPAR    STR_B STR_S STR_R STR_UNDERSCORE STR_U STR_N STR_I STR_C STR_O STR_D STR_E STR_RIGHT_PARENTHESIS
-#define STRING_UTF8_RIGHTPAR           STR_U STR_T STR_F STR_8 STR_RIGHT_PARENTHESIS
-#define STRING_UTF16_RIGHTPAR          STR_U STR_T STR_F STR_1 STR_6 STR_RIGHT_PARENTHESIS
-#define STRING_UTF32_RIGHTPAR          STR_U STR_T STR_F STR_3 STR_2 STR_RIGHT_PARENTHESIS
-#define STRING_UTF_RIGHTPAR            STR_U STR_T STR_F STR_RIGHT_PARENTHESIS
-#define STRING_UCP_RIGHTPAR            STR_U STR_C STR_P STR_RIGHT_PARENTHESIS
-#define STRING_NO_START_OPT_RIGHTPAR   STR_N STR_O STR_UNDERSCORE STR_S STR_T STR_A STR_R STR_T STR_UNDERSCORE STR_O STR_P STR_T STR_RIGHT_PARENTHESIS
+#define STRING_CR_RIGHTPAR              STR_C STR_R STR_RIGHT_PARENTHESIS
+#define STRING_LF_RIGHTPAR              STR_L STR_F STR_RIGHT_PARENTHESIS
+#define STRING_CRLF_RIGHTPAR            STR_C STR_R STR_L STR_F STR_RIGHT_PARENTHESIS
+#define STRING_ANY_RIGHTPAR             STR_A STR_N STR_Y STR_RIGHT_PARENTHESIS
+#define STRING_ANYCRLF_RIGHTPAR         STR_A STR_N STR_Y STR_C STR_R STR_L STR_F STR_RIGHT_PARENTHESIS
+#define STRING_BSR_ANYCRLF_RIGHTPAR     STR_B STR_S STR_R STR_UNDERSCORE STR_A STR_N STR_Y STR_C STR_R STR_L STR_F STR_RIGHT_PARENTHESIS
+#define STRING_BSR_UNICODE_RIGHTPAR     STR_B STR_S STR_R STR_UNDERSCORE STR_U STR_N STR_I STR_C STR_O STR_D STR_E STR_RIGHT_PARENTHESIS
+#define STRING_UTF8_RIGHTPAR            STR_U STR_T STR_F STR_8 STR_RIGHT_PARENTHESIS
+#define STRING_UTF16_RIGHTPAR           STR_U STR_T STR_F STR_1 STR_6 STR_RIGHT_PARENTHESIS
+#define STRING_UTF32_RIGHTPAR           STR_U STR_T STR_F STR_3 STR_2 STR_RIGHT_PARENTHESIS
+#define STRING_UTF_RIGHTPAR             STR_U STR_T STR_F STR_RIGHT_PARENTHESIS
+#define STRING_UCP_RIGHTPAR             STR_U STR_C STR_P STR_RIGHT_PARENTHESIS
+#define STRING_NO_AUTO_POSSESS_RIGHTPAR STR_N STR_O STR_UNDERSCORE STR_A STR_U STR_T STR_O STR_UNDERSCORE STR_P STR_O STR_S STR_S STR_E STR_S STR_S STR_RIGHT_PARENTHESIS
+#define STRING_NO_START_OPT_RIGHTPAR    STR_N STR_O STR_UNDERSCORE STR_S STR_T STR_A STR_R STR_T STR_UNDERSCORE STR_O STR_P STR_T STR_RIGHT_PARENTHESIS
+#define STRING_LIMIT_MATCH_EQ           STR_L STR_I STR_M STR_I STR_T STR_UNDERSCORE STR_M STR_A STR_T STR_C STR_H STR_EQUALS_SIGN
+#define STRING_LIMIT_RECURSION_EQ       STR_L STR_I STR_M STR_I STR_T STR_UNDERSCORE STR_R STR_E STR_C STR_U STR_R STR_S STR_I STR_O STR_N STR_EQUALS_SIGN

 #endif  /* SUPPORT_UTF */

@@ -1837,12 +1801,25 @@ only. */
 #define PT_PXSPACE    7    /* POSIX space - Z plus 9,10,11,12,13 */
 #define PT_WORD       8    /* Word - L plus N plus underscore */
 #define PT_CLIST      9    /* Pseudo-property: match character list */
+#define PT_UCNC      10    /* Universal Character nameable character */
+#define PT_TABSIZE   11    /* Size of square table for autopossessify tests */
+
+/* The following special properties are used only in XCLASS items, when POSIX
+classes are specified and PCRE_UCP is set - in other words, for Unicode
+handling of these classes. They are not available via the \p or \P escapes like
+those in the above list, and so they do not take part in the autopossessifying
+table. */
+
+#define PT_PXGRAPH   11    /* [:graph:] - characters that mark the paper */
+#define PT_PXPRINT   12    /* [:print:] - [:graph:] plus non-control spaces */
+#define PT_PXPUNCT   13    /* [:punct:] - punctuation characters */

 /* Flag bits and data types for the extended class (OP_XCLASS) for classes that
 contain characters with values greater than 255. */

-#define XCL_NOT    0x01    /* Flag: this is a negative class */
-#define XCL_MAP    0x02    /* Flag: a 32-byte map is present */
+#define XCL_NOT       0x01    /* Flag: this is a negative class */
+#define XCL_MAP       0x02    /* Flag: a 32-byte map is present */
+#define XCL_HASPROP   0x04    /* Flag: property checks are present. */

 #define XCL_END       0    /* Marks end of individual items */
 #define XCL_SINGLE    1    /* Single item (one multibyte char) follows */
@@ -1851,9 +1828,9 @@ contain characters with values greater than 255. */
 #define XCL_NOTPROP   4    /* Unicode inverted property (ditto) */

 /* These are escaped items that aren't just an encoding of a particular data
-value such as \n. They must have non-zero values, as check_escape() returns
-0 for a data character.  Also, they must appear in the same order as in the opcode
-definitions below, up to ESC_z. There's a dummy for OP_ALLANY because it
+value such as \n. They must have non-zero values, as check_escape() returns 0
+for a data character.  Also, they must appear in the same order as in the
+opcode definitions below, up to ESC_z. There's a dummy for OP_ALLANY because it
 corresponds to "." in DOTALL mode rather than an escape sequence. It is also
 used for [^] in JavaScript compatibility mode, and for \C in non-utf mode. In
 non-DOTALL mode, "." behaves like \N.
@@ -1876,12 +1853,31 @@ enum { ESC_A = 1, ESC_G, ESC_K, ESC_B, ESC_b, ESC_D, ESC_d, ESC_S, ESC_s,
       ESC_E, ESC_Q, ESC_g, ESC_k,
       ESC_DU, ESC_du, ESC_SU, ESC_su, ESC_WU, ESC_wu };

-/* Opcode table: Starting from 1 (i.e. after OP_END), the values up to
-OP_EOD must correspond in order to the list of escapes immediately above.

-*** NOTE NOTE NOTE *** Whenever this list is updated, the two macro definitions
-that follow must also be updated to match. There are also tables called
-"coptable" and "poptable" in pcre_dfa_exec.c that must be updated. */
+/********************** Opcode definitions ******************/
+
+/****** NOTE NOTE NOTE ******
+
+Starting from 1 (i.e. after OP_END), the values up to OP_EOD must correspond in
+order to the list of escapes immediately above. Furthermore, values up to
+OP_DOLLM must not be changed without adjusting the table called autoposstab in
+pcre_compile.c
+
+Whenever this list is updated, the two macro definitions that follow must be
+updated to match. The possessification table called "opcode_possessify" in
+pcre_compile.c must also be updated, and also the tables called "coptable"
+and "poptable" in pcre_dfa_exec.c.
+
+****** NOTE NOTE NOTE ******/
+
+
+/* The values between FIRST_AUTOTAB_OP and LAST_AUTOTAB_RIGHT_OP, inclusive,
+are used in a table for deciding whether a repeated character type can be
+auto-possessified. */
+
+#define FIRST_AUTOTAB_OP       OP_NOT_DIGIT
+#define LAST_AUTOTAB_LEFT_OP   OP_EXTUNI
+#define LAST_AUTOTAB_RIGHT_OP  OP_DOLLM

 enum {
  OP_END,            /* 0 End of pattern */
@@ -1914,10 +1910,15 @@ enum {
  OP_EODN,           /* 23 End of data or \n at end of data (\Z) */
  OP_EOD,            /* 24 End of data (\z) */

-  OP_CIRC,           /* 25 Start of line - not multiline */
-  OP_CIRCM,          /* 26 Start of line - multiline */
-  OP_DOLL,           /* 27 End of line - not multiline */
-  OP_DOLLM,          /* 28 End of line - multiline */
+  /* Line end assertions */
+
+  OP_DOLL,           /* 25 End of line - not multiline */
+  OP_DOLLM,          /* 26 End of line - multiline */
+  OP_CIRC,           /* 27 Start of line - not multiline */
+  OP_CIRCM,          /* 28 Start of line - multiline */
+
+  /* Single characters; caseful must precede the caseless ones */
+
  OP_CHAR,           /* 29 Match one character, casefully */
  OP_CHARI,          /* 30 Match one character, caselessly */
  OP_NOT,            /* 31 Match one character, not the given one, casefully */
@@ -1926,7 +1927,7 @@ enum {
  /* The following sets of 13 opcodes must always be kept in step because
  the offset from the first one is used to generate the others. */

-  /**** Single characters, caseful, must precede the caseless ones ****/
+  /* Repeated characters; caseful must precede the caseless ones */

  OP_STAR,           /* 33 The maximizing and minimizing versions of */
  OP_MINSTAR,        /* 34 these six opcodes must come in pairs, with */
@@ -1944,7 +1945,7 @@ enum {
  OP_POSQUERY,       /* 44 Posesssified query, caseful */
  OP_POSUPTO,        /* 45 Possessified upto, caseful */

-  /**** Single characters, caseless, must follow the caseful ones */
+  /* Repeated characters; caseless must follow the caseful ones */

  OP_STARI,          /* 46 */
  OP_MINSTARI,       /* 47 */
@@ -1962,8 +1963,8 @@ enum {
  OP_POSQUERYI,      /* 57 Posesssified query, caseless */
  OP_POSUPTOI,       /* 58 Possessified upto, caseless */

-  /**** The negated ones must follow the non-negated ones, and match them ****/
-  /**** Negated single character, caseful; must precede the caseless ones ****/
+  /* The negated ones must follow the non-negated ones, and match them */
+  /* Negated repeated character, caseful; must precede the caseless ones */

  OP_NOTSTAR,        /* 59 The maximizing and minimizing versions of */
  OP_NOTMINSTAR,     /* 60 these six opcodes must come in pairs, with */
@@ -1981,7 +1982,7 @@ enum {
  OP_NOTPOSQUERY,    /* 70 */
  OP_NOTPOSUPTO,     /* 71 */

-  /**** Negated single character, caseless; must follow the caseful ones ****/
+  /* Negated repeated character, caseless; must follow the caseful ones */

  OP_NOTSTARI,       /* 72 */
  OP_NOTMINSTARI,    /* 73 */
@@ -1999,7 +2000,7 @@ enum {
  OP_NOTPOSQUERYI,   /* 83 */
  OP_NOTPOSUPTOI,    /* 84 */

-  /**** Character types ****/
+  /* Character types */

  OP_TYPESTAR,       /* 85 The maximizing and minimizing versions of */
  OP_TYPEMINSTAR,    /* 86 these six opcodes must come in pairs, with */
@@ -2030,89 +2031,96 @@ enum {
  OP_CRRANGE,        /* 104 These are different to the three sets above. */
  OP_CRMINRANGE,     /* 105 */

+  OP_CRPOSSTAR,      /* 106 Possessified versions */
+  OP_CRPOSPLUS,      /* 107 */
+  OP_CRPOSQUERY,     /* 108 */
+  OP_CRPOSRANGE,     /* 109 */
+
  /* End of quantifier opcodes */

-  OP_CLASS,          /* 106 Match a character class, chars < 256 only */
-  OP_NCLASS,         /* 107 Same, but the bitmap was created from a negative
+  OP_CLASS,          /* 110 Match a character class, chars < 256 only */
+  OP_NCLASS,         /* 111 Same, but the bitmap was created from a negative
                              class - the difference is relevant only when a
                              character > 255 is encountered. */
-  OP_XCLASS,         /* 108 Extended class for handling > 255 chars within the
+  OP_XCLASS,         /* 112 Extended class for handling > 255 chars within the
                              class. This does both positive and negative. */
-  OP_REF,            /* 109 Match a back reference, casefully */
-  OP_REFI,           /* 110 Match a back reference, caselessly */
-  OP_RECURSE,        /* 111 Match a numbered subpattern (possibly recursive) */
-  OP_CALLOUT,        /* 112 Call out to external function if provided */
+  OP_REF,            /* 113 Match a back reference, casefully */
+  OP_REFI,           /* 114 Match a back reference, caselessly */
+  OP_DNREF,          /* 115 Match a duplicate name backref, casefully */
+  OP_DNREFI,         /* 116 Match a duplicate name backref, caselessly */
+  OP_RECURSE,        /* 117 Match a numbered subpattern (possibly recursive) */
+  OP_CALLOUT,        /* 118 Call out to external function if provided */

-  OP_ALT,            /* 113 Start of alternation */
-  OP_KET,            /* 114 End of group that doesn't have an unbounded repeat */
-  OP_KETRMAX,        /* 115 These two must remain together and in this */
-  OP_KETRMIN,        /* 116 order. They are for groups the repeat for ever. */
-  OP_KETRPOS,        /* 117 Possessive unlimited repeat. */
+  OP_ALT,            /* 119 Start of alternation */
+  OP_KET,            /* 120 End of group that doesn't have an unbounded repeat */
+  OP_KETRMAX,        /* 121 These two must remain together and in this */
+  OP_KETRMIN,        /* 122 order. They are for groups the repeat for ever. */
+  OP_KETRPOS,        /* 123 Possessive unlimited repeat. */

  /* The assertions must come before BRA, CBRA, ONCE, and COND, and the four
  asserts must remain in order. */

-  OP_REVERSE,        /* 118 Move pointer back - used in lookbehind assertions */
-  OP_ASSERT,         /* 119 Positive lookahead */
-  OP_ASSERT_NOT,     /* 120 Negative lookahead */
-  OP_ASSERTBACK,     /* 121 Positive lookbehind */
-  OP_ASSERTBACK_NOT, /* 122 Negative lookbehind */
+  OP_REVERSE,        /* 124 Move pointer back - used in lookbehind assertions */
+  OP_ASSERT,         /* 125 Positive lookahead */
+  OP_ASSERT_NOT,     /* 126 Negative lookahead */
+  OP_ASSERTBACK,     /* 127 Positive lookbehind */
+  OP_ASSERTBACK_NOT, /* 128 Negative lookbehind */

  /* ONCE, ONCE_NC, BRA, BRAPOS, CBRA, CBRAPOS, and COND must come immediately
  after the assertions, with ONCE first, as there's a test for >= ONCE for a
  subpattern that isn't an assertion. The POS versions must immediately follow
  the non-POS versions in each case. */

-  OP_ONCE,           /* 123 Atomic group, contains captures */
-  OP_ONCE_NC,        /* 124 Atomic group containing no captures */
-  OP_BRA,            /* 125 Start of non-capturing bracket */
-  OP_BRAPOS,         /* 126 Ditto, with unlimited, possessive repeat */
-  OP_CBRA,           /* 127 Start of capturing bracket */
-  OP_CBRAPOS,        /* 128 Ditto, with unlimited, possessive repeat */
-  OP_COND,           /* 129 Conditional group */
+  OP_ONCE,           /* 129 Atomic group, contains captures */
+  OP_ONCE_NC,        /* 130 Atomic group containing no captures */
+  OP_BRA,            /* 131 Start of non-capturing bracket */
+  OP_BRAPOS,         /* 132 Ditto, with unlimited, possessive repeat */
+  OP_CBRA,           /* 133 Start of capturing bracket */
+  OP_CBRAPOS,        /* 134 Ditto, with unlimited, possessive repeat */
+  OP_COND,           /* 135 Conditional group */

  /* These five must follow the previous five, in the same order. There's a
  check for >= SBRA to distinguish the two sets. */

-  OP_SBRA,           /* 130 Start of non-capturing bracket, check empty  */
-  OP_SBRAPOS,        /* 131 Ditto, with unlimited, possessive repeat */
-  OP_SCBRA,          /* 132 Start of capturing bracket, check empty */
-  OP_SCBRAPOS,       /* 133 Ditto, with unlimited, possessive repeat */
-  OP_SCOND,          /* 134 Conditional group, check empty */
+  OP_SBRA,           /* 136 Start of non-capturing bracket, check empty  */
+  OP_SBRAPOS,        /* 137 Ditto, with unlimited, possessive repeat */
+  OP_SCBRA,          /* 138 Start of capturing bracket, check empty */
+  OP_SCBRAPOS,       /* 139 Ditto, with unlimited, possessive repeat */
+  OP_SCOND,          /* 140 Conditional group, check empty */

  /* The next two pairs must (respectively) be kept together. */

-  OP_CREF,           /* 135 Used to hold a capture number as condition */
-  OP_NCREF,          /* 136 Same, but generated by a name reference*/
-  OP_RREF,           /* 137 Used to hold a recursion number as condition */
-  OP_NRREF,          /* 138 Same, but generated by a name reference*/
-  OP_DEF,            /* 139 The DEFINE condition */
+  OP_CREF,           /* 141 Used to hold a capture number as condition */
+  OP_DNCREF,         /* 142 Used to point to duplicate names as a condition */
+  OP_RREF,           /* 143 Used to hold a recursion number as condition */
+  OP_DNRREF,         /* 144 Used to point to duplicate names as a condition */
+  OP_DEF,            /* 145 The DEFINE condition */

-  OP_BRAZERO,        /* 140 These two must remain together and in this */
-  OP_BRAMINZERO,     /* 141 order. */
-  OP_BRAPOSZERO,     /* 142 */
+  OP_BRAZERO,        /* 146 These two must remain together and in this */
+  OP_BRAMINZERO,     /* 147 order. */
+  OP_BRAPOSZERO,     /* 148 */

  /* These are backtracking control verbs */

-  OP_MARK,           /* 143 always has an argument */
-  OP_PRUNE,          /* 144 */
-  OP_PRUNE_ARG,      /* 145 same, but with argument */
-  OP_SKIP,           /* 146 */
-  OP_SKIP_ARG,       /* 147 same, but with argument */
-  OP_THEN,           /* 148 */
-  OP_THEN_ARG,       /* 149 same, but with argument */
-  OP_COMMIT,         /* 150 */
+  OP_MARK,           /* 149 always has an argument */
+  OP_PRUNE,          /* 150 */
+  OP_PRUNE_ARG,      /* 151 same, but with argument */
+  OP_SKIP,           /* 152 */
+  OP_SKIP_ARG,       /* 153 same, but with argument */
+  OP_THEN,           /* 154 */
+  OP_THEN_ARG,       /* 155 same, but with argument */
+  OP_COMMIT,         /* 156 */

  /* These are forced failure and success verbs */

-  OP_FAIL,           /* 151 */
-  OP_ACCEPT,         /* 152 */
-  OP_ASSERT_ACCEPT,  /* 153 Used inside assertions */
-  OP_CLOSE,          /* 154 Used before OP_ACCEPT to close open captures */
+  OP_FAIL,           /* 157 */
+  OP_ACCEPT,         /* 158 */
+  OP_ASSERT_ACCEPT,  /* 159 Used inside assertions */
+  OP_CLOSE,          /* 160 Used before OP_ACCEPT to close open captures */

  /* This is used to skip a subpattern with a {0} quantifier */

-  OP_SKIPZERO,       /* 155 */
+  OP_SKIPZERO,       /* 161 */

  /* This is not an opcode, but is used to check that tables indexed by opcode
  are the correct length, in order to catch updating errors - there have been
@@ -2123,7 +2131,8 @@ enum {

 /* *** NOTE NOTE NOTE *** Whenever the list above is updated, the two macro
 definitions that follow must also be updated to match. There are also tables
-called "coptable" and "poptable" in pcre_dfa_exec.c that must be updated. */
+called "opcode_possessify" in pcre_compile.c and "coptable" and "poptable" in
+pcre_dfa_exec.c that must be updated. */


 /* This macro defines textual names for all the opcodes. These are used only
@@ -2136,7 +2145,7 @@ some cases doesn't actually use these names at all). */
  "\\S", "\\s", "\\W", "\\w", "Any", "AllAny", "Anybyte",         \
  "notprop", "prop", "\\R", "\\H", "\\h", "\\V", "\\v",           \
  "extuni",  "\\Z", "\\z",                                        \
-  "^", "^", "$", "$", "char", "chari", "not", "noti",             \
+  "$", "$", "^", "^", "char", "chari", "not", "noti",             \
  "*", "*?", "+", "+?", "?", "??",                                \
  "{", "{", "{",                                                  \
  "*+","++", "?+", "{",                                           \
@@ -2152,7 +2161,8 @@ some cases doesn't actually use these names at all). */
  "*", "*?", "+", "+?", "?", "??", "{", "{", "{",                 \
  "*+","++", "?+", "{",                                           \
  "*", "*?", "+", "+?", "?", "??", "{", "{",                      \
-  "class", "nclass", "xclass", "Ref", "Refi",                     \
+  "*+","++", "?+", "{",                                           \
+  "class", "nclass", "xclass", "Ref", "Refi", "DnRef", "DnRefi",  \
  "Recurse", "Callout",                                           \
  "Alt", "Ket", "KetRmax", "KetRmin", "KetRpos",                  \
  "Reverse", "Assert", "Assert not", "AssertB", "AssertB not",    \
@@ -2161,7 +2171,7 @@ some cases doesn't actually use these names at all). */
  "Cond",                                                         \
  "SBra", "SBraPos", "SCBra", "SCBraPos",                         \
  "SCond",                                                        \
-  "Cond ref", "Cond nref", "Cond rec", "Cond nrec", "Cond def",   \
+  "Cond ref", "Cond dnref", "Cond rec", "Cond dnrec", "Cond def", \
  "Brazero", "Braminzero", "Braposzero",                          \
  "*MARK", "*PRUNE", "*PRUNE", "*SKIP", "*SKIP",                  \
  "*THEN", "*THEN", "*COMMIT", "*FAIL",                           \
@@ -2186,7 +2196,7 @@ in UTF-8 mode. The code that uses this table must know about such things. */
  3, 3,                          /* \P, \p                                 */ \
  1, 1, 1, 1, 1,                 /* \R, \H, \h, \V, \v                     */ \
  1,                             /* \X                                     */ \
-  1, 1, 1, 1, 1, 1,              /* \Z, \z, ^, ^M, $, $M                   */ \
+  1, 1, 1, 1, 1, 1,              /* \Z, \z, $, $M ^, ^M                    */ \
  2,                             /* Char  - the minimum length             */ \
  2,                             /* Chari  - the minimum length            */ \
  2,                             /* not                                    */ \
@@ -2217,11 +2227,14 @@ in UTF-8 mode. The code that uses this table must know about such things. */
  /* Character class & ref repeats                                         */ \
  1, 1, 1, 1, 1, 1,              /* *, *?, +, +?, ?, ??                    */ \
  1+2*IMM2_SIZE, 1+2*IMM2_SIZE,  /* CRRANGE, CRMINRANGE                    */ \
+  1, 1, 1, 1+2*IMM2_SIZE,        /* Possessive *+, ++, ?+, CRPOSRANGE      */ \
  1+(32/sizeof(pcre_uchar)),     /* CLASS                                  */ \
  1+(32/sizeof(pcre_uchar)),     /* NCLASS                                 */ \
  0,                             /* XCLASS - variable length               */ \
  1+IMM2_SIZE,                   /* REF                                    */ \
  1+IMM2_SIZE,                   /* REFI                                   */ \
+  1+2*IMM2_SIZE,                 /* DNREF                                  */ \
+  1+2*IMM2_SIZE,                 /* DNREFI                                 */ \
  1+LINK_SIZE,                   /* RECURSE                                */ \
  2+2*LINK_SIZE,                 /* CALLOUT                                */ \
  1+LINK_SIZE,                   /* Alt                                    */ \
@@ -2246,8 +2259,8 @@ in UTF-8 mode. The code that uses this table must know about such things. */
  1+LINK_SIZE+IMM2_SIZE,         /* SCBRA                                  */ \
  1+LINK_SIZE+IMM2_SIZE,         /* SCBRAPOS                               */ \
  1+LINK_SIZE,                   /* SCOND                                  */ \
-  1+IMM2_SIZE, 1+IMM2_SIZE,      /* CREF, NCREF                            */ \
-  1+IMM2_SIZE, 1+IMM2_SIZE,      /* RREF, NRREF                            */ \
+  1+IMM2_SIZE, 1+2*IMM2_SIZE,    /* CREF, DNCREF                           */ \
+  1+IMM2_SIZE, 1+2*IMM2_SIZE,    /* RREF, DNRREF                           */ \
  1,                             /* DEF                                    */ \
  1, 1, 1,                       /* BRAZERO, BRAMINZERO, BRAPOSZERO        */ \
  3, 1, 3,                       /* MARK, PRUNE, PRUNE_ARG                 */ \
@@ -2256,8 +2269,7 @@ in UTF-8 mode. The code that uses this table must know about such things. */
  1, 1, 1, 1,                    /* COMMIT, FAIL, ACCEPT, ASSERT_ACCEPT    */ \
  1+IMM2_SIZE, 1                 /* CLOSE, SKIPZERO                        */

-/* A magic value for OP_RREF and OP_NRREF to indicate the "any recursion"
-condition. */
+/* A magic value for OP_RREF to indicate the "any recursion" condition. */

 #define RREF_ANY  0xffff

@@ -2272,9 +2284,11 @@ enum { ERR0,  ERR1,  ERR2,  ERR3,  ERR4,  ERR5,  ERR6,  ERR7,  ERR8,  ERR9,
       ERR40, ERR41, ERR42, ERR43, ERR44, ERR45, ERR46, ERR47, ERR48, ERR49,
       ERR50, ERR51, ERR52, ERR53, ERR54, ERR55, ERR56, ERR57, ERR58, ERR59,
       ERR60, ERR61, ERR62, ERR63, ERR64, ERR65, ERR66, ERR67, ERR68, ERR69,
-       ERR70, ERR71, ERR72, ERR73, ERR74, ERR75, ERR76, ERR77, ERRCOUNT };
+       ERR70, ERR71, ERR72, ERR73, ERR74, ERR75, ERR76, ERR77, ERR78, ERR79,
+       ERR80, ERR81, ERR82, ERR83, ERR84, ERR85, ERR86, ERRCOUNT };

 /* JIT compiling modes. The function list is indexed by them. */
+
 enum { JIT_COMPILE, JIT_PARTIAL_SOFT_COMPILE, JIT_PARTIAL_HARD_COMPILE,
       JIT_NUMBER_OF_COMPILE_MODES };

@@ -2282,48 +2296,49 @@ enum { JIT_COMPILE, JIT_PARTIAL_SOFT_COMPILE, JIT_PARTIAL_HARD_COMPILE,
 code vector run on as long as necessary after the end. We store an explicit
 offset to the name table so that if a regex is compiled on one host, saved, and
 then run on another where the size of pointers is different, all might still
-be well. For the case of compiled-on-4 and run-on-8, we include an extra
-pointer that is always NULL. For future-proofing, a few dummy fields were
-originally included - even though you can never get this planning right - but
-there is only one left now.
+be well.

-NOTE NOTE NOTE:
-Because people can now save and re-use compiled patterns, any additions to this
-structure should be made at the end, and something earlier (e.g. a new
-flag in the options or one of the dummy fields) should indicate that the new
-fields are present. Currently PCRE always sets the dummy fields to zero.
-NOTE NOTE NOTE
+The size of the structure must be a multiple of 8 bytes. For the case of
+compiled-on-4 and run-on-8, we include an extra pointer that is always NULL so
+that there are an even number of pointers which therefore are a multiple of 8
+bytes.
+
+It is necessary to fork the struct for the 32 bit library, since it needs to
+use pcre_uint32 for first_char and req_char. We can't put an ifdef inside the
+typedef because pcretest needs access to the struct of the 8-, 16- and 32-bit
+variants.
+
+*** WARNING ***
+When new fields are added to these structures, remember to adjust the code in
+pcre_byte_order.c that is concerned with swapping the byte order of the fields
+when a compiled regex is reloaded on a host with different endianness.
+*** WARNING ***
+There is also similar byte-flipping code in pcretest.c, which is used for
+testing the byte-flipping features. It must also be kept in step.
+*** WARNING ***
 */

-#if defined COMPILE_PCRE8
-#define REAL_PCRE real_pcre
-#elif defined COMPILE_PCRE16
-#define REAL_PCRE real_pcre16
-#elif defined COMPILE_PCRE32
-#define REAL_PCRE real_pcre32
-#endif
-
-/* It is necessary to fork the struct for 32 bit, since it needs to use
- * pcre_uchar for first_char and req_char. Can't put an ifdef inside the
- * typedef since pcretest needs access to  the struct of the 8-, 16-
- * and 32-bit variants. */
-
 typedef struct real_pcre8_or_16 {
  pcre_uint32 magic_number;
  pcre_uint32 size;               /* Total that was malloced */
  pcre_uint32 options;            /* Public options */
-  pcre_uint16 flags;              /* Private flags */
+  pcre_uint32 flags;              /* Private flags */
+  pcre_uint32 limit_match;        /* Limit set from regex */
+  pcre_uint32 limit_recursion;    /* Limit set from regex */
+  pcre_uint16 first_char;         /* Starting character */
+  pcre_uint16 req_char;           /* This character must be seen */
  pcre_uint16 max_lookbehind;     /* Longest lookbehind (characters) */
  pcre_uint16 top_bracket;        /* Highest numbered group */
  pcre_uint16 top_backref;        /* Highest numbered back reference */
-  pcre_uint16 first_char;         /* Starting character */
-  pcre_uint16 req_char;           /* This character must be seen */
  pcre_uint16 name_table_offset;  /* Offset to name table that follows */
  pcre_uint16 name_entry_size;    /* Size of any name items */
  pcre_uint16 name_count;         /* Number of name items */
  pcre_uint16 ref_count;          /* Reference count */
+  pcre_uint16 dummy1;             /* To ensure size is a multiple of 8 */
+  pcre_uint16 dummy2;             /* To ensure size is a multiple of 8 */
+  pcre_uint16 dummy3;             /* To ensure size is a multiple of 8 */
  const pcre_uint8 *tables;       /* Pointer to tables or NULL for std */
-  const pcre_uint8 *nullpad;      /* NULL padding */
+  void             *nullpad;      /* NULL padding */
 } real_pcre8_or_16;

 typedef struct real_pcre8_or_16 real_pcre;
@@ -2333,22 +2348,31 @@ typedef struct real_pcre32 {
  pcre_uint32 magic_number;
  pcre_uint32 size;               /* Total that was malloced */
  pcre_uint32 options;            /* Public options */
-  pcre_uint16 flags;              /* Private flags */
+  pcre_uint32 flags;              /* Private flags */
+  pcre_uint32 limit_match;        /* Limit set from regex */
+  pcre_uint32 limit_recursion;    /* Limit set from regex */
+  pcre_uint32 first_char;         /* Starting character */
+  pcre_uint32 req_char;           /* This character must be seen */
  pcre_uint16 max_lookbehind;     /* Longest lookbehind (characters) */
  pcre_uint16 top_bracket;        /* Highest numbered group */
  pcre_uint16 top_backref;        /* Highest numbered back reference */
-  pcre_uint32 first_char;         /* Starting character */
-  pcre_uint32 req_char;           /* This character must be seen */
  pcre_uint16 name_table_offset;  /* Offset to name table that follows */
  pcre_uint16 name_entry_size;    /* Size of any name items */
  pcre_uint16 name_count;         /* Number of name items */
  pcre_uint16 ref_count;          /* Reference count */
-  pcre_uint16 dummy1;             /* for later expansion */
-  pcre_uint16 dummy2;             /* for later expansion */
+  pcre_uint16 dummy;              /* To ensure size is a multiple of 8 */
  const pcre_uint8 *tables;       /* Pointer to tables or NULL for std */
-  void *nullpad;                  /* for later expansion */
+  void             *nullpad;      /* NULL padding */
 } real_pcre32;

+#if defined COMPILE_PCRE8
+#define REAL_PCRE real_pcre
+#elif defined COMPILE_PCRE16
+#define REAL_PCRE real_pcre16
+#elif defined COMPILE_PCRE32
+#define REAL_PCRE real_pcre32
+#endif
+
 /* Assert that the size of REAL_PCRE is divisible by 8 */
 typedef int __assert_real_pcre_size_divisible_8[(sizeof(REAL_PCRE) % 8) == 0 ? 1 : -1];

@@ -2382,6 +2406,15 @@ typedef struct open_capitem {
  pcre_uint16 flag;             /* Set TRUE if recursive back ref */
 } open_capitem;

+/* Structure for building a list of named groups during the first pass of
+compiling. */
+
+typedef struct named_group {
+  const pcre_uchar  *name;          /* Points to the name in the pattern */
+  int                length;        /* Length of the name */
+  pcre_uint32        number;        /* Group number */
+} named_group;
+
 /* Structure for passing "static" information around between the functions
 doing the compiling, so that they are thread-safe. */

@@ -2394,24 +2427,30 @@ typedef struct compile_data {
  const pcre_uchar *start_code;     /* The start of the compiled code */
  const pcre_uchar *start_pattern;  /* The start of the pattern */
  const pcre_uchar *end_pattern;    /* The end of the pattern */
-  open_capitem *open_caps;          /* Chain of open capture items */
  pcre_uchar *hwm;                  /* High watermark of workspace */
+  open_capitem *open_caps;          /* Chain of open capture items */
+  named_group *named_groups;        /* Points to vector in pre-compile */
  pcre_uchar *name_table;           /* The name/number table */
  int  names_found;                 /* Number of entries so far */
  int  name_entry_size;             /* Size of each entry */
+  int  named_group_list_size;       /* Number of entries in the list */
  int  workspace_size;              /* Size of workspace */
-  unsigned int  bracount;           /* Count of capturing parens as we compile */
+  unsigned int bracount;            /* Count of capturing parens as we compile */
  int  final_bracount;              /* Saved value after first pass */
  int  max_lookbehind;              /* Maximum lookbehind (characters) */
  int  top_backref;                 /* Maximum back reference */
  unsigned int backref_map;         /* Bitmap of low back refs */
+  unsigned int namedrefcount;       /* Number of backreferences by name */
+  int  parens_depth;                /* Depth of nested parentheses */
  int  assert_depth;                /* Depth of nested assertions */
-  int  external_options;            /* External (initial) options */
-  int  external_flags;              /* External flag bits to be set */
+  pcre_uint32 external_options;     /* External (initial) options */
+  pcre_uint32 external_flags;       /* External flag bits to be set */
  int  req_varyopt;                 /* "After variable item" flag for reqbyte */
  BOOL had_accept;                  /* (*ACCEPT) encountered */
  BOOL had_pruneorskip;             /* (*PRUNE) or (*SKIP) encountered */
  BOOL check_lookbehind;            /* Lookbehinds need later checking */
+  BOOL dupnames;                    /* Duplicate names exist */
+  BOOL iscondassert;                /* Next assert is a condition */
  int  nltype;                      /* Newline type */
  int  nllen;                       /* Newline string length */
  pcre_uchar nl[4];                 /* Newline string when fixed length */
@@ -2425,6 +2464,13 @@ typedef struct branch_chain {
  pcre_uchar *current_branch;
 } branch_chain;

+/* Structure for mutual recursion detection. */
+
+typedef struct recurse_check {
+  struct recurse_check *prev;
+  const pcre_uchar *group;
+} recurse_check;
+
 /* Structure for items in a linked list that represents an explicit recursive
 call within the pattern; used by pcre_exec(). */

@@ -2433,6 +2479,7 @@ typedef struct recursion_info {
  unsigned int group_num;         /* Number of group that was called */
  int *offset_save;               /* Pointer to start of saved offsets */
  int saved_max;                  /* Number of saved offsets */
+  int saved_capture_last;         /* Last capture number */
  PCRE_PUCHAR subject_position;   /* Position at start of recursion */
 } recursion_info;

@@ -2469,12 +2516,13 @@ typedef struct match_data {
  int    nllen;                   /* Newline string length */
  int    name_count;              /* Number of names in name table */
  int    name_entry_size;         /* Size of entry in names table */
+  unsigned int skip_arg_count;    /* For counting SKIP_ARGs */
+  unsigned int ignore_skip_arg;   /* For re-run when SKIP arg name not found */
  pcre_uchar *name_table;         /* Table of names */
  pcre_uchar nl[4];               /* Newline string when fixed */
  const  pcre_uint8 *lcc;         /* Points to lower casing table */
  const  pcre_uint8 *fcc;         /* Points to case-flipping table */
  const  pcre_uint8 *ctypes;      /* Points to table of type maps */
-  BOOL   offset_overflow;         /* Set if too many extractions */
  BOOL   notbol;                  /* NOTBOL flag */
  BOOL   noteol;                  /* NOTEOL flag */
  BOOL   utf;                     /* UTF-8 / UTF-16 flag */
@@ -2486,7 +2534,6 @@ typedef struct match_data {
  BOOL   hitend;                  /* Hit the end of the subject at some point */
  BOOL   bsr_anycrlf;             /* \R is just any CRLF, not full Unicode */
  BOOL   hasthen;                 /* Pattern contains (*THEN) */
-  BOOL   ignore_skip_arg;         /* For re-run when SKIP name not found */
  const  pcre_uchar *start_code;  /* For use when recursing */
  PCRE_PUCHAR start_subject;      /* Start of the subject string */
  PCRE_PUCHAR end_subject;        /* End of the subject string */
@@ -2495,7 +2542,7 @@ typedef struct match_data {
  PCRE_PUCHAR start_used_ptr;     /* Earliest consulted character */
  int    partial;                 /* PARTIAL options */
  int    end_offset_top;          /* Highwater mark at end of match */
-  int    capture_last;            /* Most recent capture number */
+  pcre_int32 capture_last;        /* Most recent capture number + overflow flag */
  int    start_offset;            /* The start offset value */
  int    match_function_type;     /* Set for certain special calls of MATCH() */
  eptrblock *eptrchain;           /* Chain of eptrblocks for tail recursions */