Updated NEWS

* PHP-5.4:
  update for LiteSpeed

.gitignore

@@ -19,6 +19,7 @@
 *.tgz
 *.tar.gz
 *.tar.bz2
+*.tar.xz
 .FBCIndex
 .FBCLockFolder
 .deps

.travis.yml

@@ -39,4 +39,4 @@ before_script:
     - . ./travis/ext/pdo_pgsql/setup.sh
 
 # Run PHPs run-tests.php 
-script: ./sapi/cli/php run-tests.php -p `pwd`/sapi/cli/php -g "FAIL,XFAIL,BORK,WARN,LEAK,SKIP" --show-diff --set-timeout 120
+script: ./sapi/cli/php run-tests.php -p `pwd`/sapi/cli/php -g "FAIL,XFAIL,BORK,WARN,LEAK,SKIP" --show-diff --set-timeout 120 -s

EXTENSIONS

@@ -385,6 +385,12 @@ MAINTENANCE:         Maintained
 STATUS:              Working
 SINCE:               4.0.4
 -------------------------------------------------------------------------------
+EXTENSION:           hash
+PRIMARY MAINTAINER:  Sara Golemon <pollita@php.net>, Mike Wallner <mike@php.net>, Anatol Belski <ab@php.net>
+MAINTENANCE:         Maintained
+STATUS:              Working
+SINCE:               5.1.2
+-------------------------------------------------------------------------------
 EXTENSION:           iconv
 PRIMARY MAINTAINER:  Moriyoshi Koizumi <moriyoshi@php.net>
 MAINTENANCE:         Maintained
@@ -438,6 +444,12 @@ PRIMARY MAINTAINER:  Frank M. Kromann
 MAINTENANCE:         Unknown
 STATUS:              Experimental
 -------------------------------------------------------------------------------
+EXTENSION:           opcache
+PRIMARY MAINTAINER:  Dmitry Stogov <dmitry@zend.com>, Xinchen Hui <laruence@php.net>
+MAINTENANCE:         Maintained
+STATUS:              Working
+SINCE:               5.5.0
+-------------------------------------------------------------------------------
 EXTENSION:           openssl
 PRIMARY MAINTAINER:  Wez Furlong <wez@php.net>, Pierre-Alain Joye <pajoye@php.net>
 MAINTENANCE:         Maintained

NEWS

@@ -1,16 +1,188 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2014, PHP 5.5.16
+17 Dec 2014, PHP 5.5.20
+
+- Core:
+  . Fixed bug #68091 (Some Zend headers lack appropriate extern "C" blocks).
+    (Adam)
+  . Fixed bug #68185 ("Inconsistent insteadof definition."- incorrectly 
+    triggered). (Julien)
+  . Fixed bug #68370 ("unset($this)" can make the program crash). (Laruence)
+  . Fixed bug #68545 (NULL pointer dereference in unserialize.c). (Anatol)
+  . Fixed bug #68594 (Use after free vulnerability in unserialize()).
+    (CVE-2014-8142) (Stefan Esser)
+
+- Date:
+  . Fixed day_of_week function as it could sometimes return negative values
+    internally. (Derick)
+
+- FPM:
+  . Fixed bug #68381 (fpm_unix_init_main ignores log_level).
+    (David Zuelke, Remi)
+  . Fixed bug #68420 (listen=9000 listens to ipv6 localhost instead of all
+    addresses). (Remi)
+  . Fixed bug #68421 (access.format='%R' doesn't log ipv6 address). (Remi)
+  . Fixed bug #68423 (PHP-FPM will no longer load all pools). (Remi)
+  . Fixed bug #68428 (listen.allowed_clients is IPv4 only). (Remi)
+  . Fixed bug #68452 (php-fpm man page is oudated). (Remi)
+  . Fixed request #68458 (Change pm.start_servers default warning to
+    notice). (David Zuelke, Remi)
+  . Fixed bug #68463 (listen.allowed_clients can silently result
+    in no allowed access). (Remi)
+  . Fixed request #68391 (php-fpm conf files loading order).
+    (Florian Margaine, Remi)
+  . Fixed bug #68478 (access.log don't use prefix). (Remi)
+
+- Mcrypt:
+  . Fixed possible read after end of buffer and use after free. (Dmitry)
+
+- PDO_pgsql:
+  . Fixed bug #66584 (Segmentation fault on statement deallocation) (Matteo)
+  . Fixed bug #67462 (PDO_PGSQL::beginTransaction() wrongly throws exception
+  when not in transaction) (Matteo)
+  . Fixed bug #68351 (PDO::PARAM_BOOL and ATTR_EMULATE_PREPARES misbehaving)
+  (Matteo)
+
+- zlib:
+  . Fixed bug #53829 (Compiling PHP with large file support will replace
+    function gzopen by gzopen64) (Sascha Kettler, Matteo)
+
+13 Nov 2014, PHP 5.5.19
+
+- Core:
+  . Fixed bug #68095 (AddressSanitizer reports a heap buffer overflow in 
+    php_getopt()). (Stas)
+  . Fixed bug #68118 ($a->foo .= 'test'; can leave $a->foo undefined). (Nikita)
+  . Fixed bug #68129 (parse_url() - incomplete support for empty usernames
+    and passwords) (Tjerk)
+  . Fixed bug #68365 (zend_mm_heap corrupted after memory overflow in
+    zend_hash_copy). (Dmitry)
+
+- CURL:
+  . Add CURL_SSLVERSION_TLSv1_0, CURL_SSLVERSION_TLSv1_1, and 
+    CURL_SSLVERSION_TLSv1_2 constants if supported by libcurl (Rasmus)
+
+- Fileinfo:
+  . Fixed bug #66242 (libmagic: don't assume char is signed). (ArdB)
+  . Fixed bug #68283 (fileinfo: out-of-bounds read in elf note headers).
+    (CVE-2014-3710) (Remi)
+
+- GD:
+  . Fixed bug #65171 (imagescale() fails without height param). (Remi)
+
+- GMP:
+  . Fixed bug #63595 (GMP memory management conflicts with other libraries
+    using GMP). (Remi)
+
+- Mysqli:
+  . Fixed bug #68114 (linker error on some OS X machines with fixed width
+    decimal support) (Keyur Govande)
+
+- ODBC:
+  . Fixed bug #68087 (ODBC not correctly reading DATE column when preceded by
+    a VARCHAR column) (Keyur Govande)
+
+- SOAP:
+  . Fixed bug #68361 (Segmentation fault on SoapClient::__getTypes).
+    (Laruence)
+
+- SPL:
+  . Fixed bug #68128 (Regression in RecursiveRegexIterator) (Tjerk)
+
+16 Oct 2014, PHP 5.5.18
+
+- Core:
+  . Fixed bug #67985 (Incorrect last used array index copied to new array after
+    unset). (Tjerk)
+  . Fixed bug #67739 (Windows 8.1/Server 2012 R2 OS build number reported
+    as 6.2 (instead of 6.3)). (Christian Wenz)
+  . Fixed bug #67633 (A foreach on an array returned from a function not doing
+    copy-on-write). (Nikita)
+  . Fixed bug #51800 (proc_open on Windows hangs forever). (Anatol)
+
+- FPM:
+  . Fixed bug #65641 (PHP-FPM incorrectly defines the SCRIPT_NAME variable
+    when using Apache, mod_proxy-fcgi and ProxyPass). (Remi)
+  . Implemented FR #55508 (listen and listen.allowed_clients should take IPv6
+    addresses). (Robin Gloster)
+
+- Reflection:
+  . Fixed bug #68103 (Duplicate entry in Reflection for class alias). (Remi)
+
+- Session:
+  . Fixed bug #67972 (SessionHandler Invalid memory read create_sid()). (Adam)
+
+18 Sep 2014, PHP 5.5.17
+
+- Core:
+  . Fixed bug #47358 (glob returns error, should be empty array()). (Pierre)
+  . Fixed bug #65463 (SIGSEGV during zend_shutdown()). (Keyur Govande)
+  . Fixed bug #66036 (Crash on SIGTERM in apache process). (Keyur Govande)
+  . Fixed bug #67878 (program_prefix not honoured in man pages). (Remi)
+
+- COM:
+  . Fixed bug #41577 (DOTNET is successful once per server run)
+    (Aidas Kasparas)
+
+- FPM:
+  . Fixed #67606 (FPM with mod_fastcgi/apache2.4 is broken). (David Zuelke)
+
+- OpenSSL:
+  . Fixed bug #41631 (socket timeouts not honored in blocking SSL reads).
+    (Daniel Lowrey)
+  . Fixed bug #67850 (extension won't build if openssl compiled without SSLv3)
+    (Daniel Lowrey)
+
+- SPL:
+  . Fixed bug #67813 (CachingIterator::__construct InvalidArgumentException
+    wrong message). (tim_siebels_aurich at yahoo dot de)
+
+- Date:
+  . Fixed bug #66091 (memory leaks in DateTime constructor). (Tjerk)
+  . Fixed bug #66985 (Some timezones are no longer valid in PHP 5.5.10).
+    (Derick)
+  . Fixed bug #67109 (First uppercase letter breaks date string parsing).
+    (Derick)
+
+- GD
+  . Made fontFetch's path parser thread-safe. (Sara).
+
+- MySQLi:
+  . Fixed bug #67839 (mysqli does not handle 4-byte floats correctly). (Keyur)
+
+- Zlib:
+  . Fixed bug #67724 (chained zlib filters silently fail with large amounts of 
+    data). (Mike)
+  . Fixed bug #67865 (internal corruption phar error). Mike
+
+21 Aug 2014, PHP 5.5.16
 
 - COM:
   . Fixed missing type checks in com_event_sink (Yussuf Khalil, Stas).
 
+- Fileinfo:
+  . Fixed bug #67705 (extensive backtracking in rule regular expression).
+    (CVE-2014-3538) (Remi)
+  . Fixed bug #67716 (Segfault in cdf.c). (CVE-2014-3587) (Remi)
+
 - FPM:
   . Fixed bug #67635 (php links to systemd libraries without using pkg-config).
     (pacho@gentoo.org, Remi)
 
+- GD:
+  . Fixed bug #66901 (php-gd 'c_color' NULL pointer dereference).
+    (CVE-2014-2497) (Remi)
+  . Fixed bug #67730 (Null byte injection possible with imagexxx functions).
+    (CVE-2014-5120) (Ryan Mauger)
+
+- Milter:
+  . Fixed bug #67715 (php-milter does not build and crashes randomly). (Mike)
+  
+- Network:
+  . Fixed bug #67717 (segfault in dns_get_record). (CVE-2014-3597) (Remi)
+
 - OpenSSL:
-  . Fixed missing type checks in OpenSSL options (Yussuf Khalil, Stas).
+  . Fixed missing type checks in OpenSSL options. (Yussuf Khalil, Stas)
 
 - readline:
   . Fixed bug #55496 (Interactive mode doesn't force a newline before the
@@ -21,6 +193,13 @@ PHP                                                                        NEWS
 - Sessions:
   . Fixed missing type checks in php_session_create_id (Yussuf Khalil, Stas).
 
+- Core:
+  . Fixed bug #67693 (incorrect push to the empty array) (Tjerk)
+
+- ODBC:
+  . Fixed bug #60616 (odbc_fetch_into returns junk data at end of multi-byte
+    char fields). (Keyur)
+
 24 Jul 2014, PHP 5.5.15
 
 - Core:
@@ -110,6 +289,9 @@ PHP                                                                        NEWS
   . Fixed bug #67413 (fileinfo: cdf_read_property_info insufficient boundary
     check). (Francisco Alonso, Jan Kaluza, Remi)
 
+- LiteSpeed:
+  . Updated LiteSpeed SAPI code from V5.5 to V6.6 (George Wang)
+
 - Network:
   . Fixed bug #67432 (Fix potential segfault in dns_get_record()).
     (CVE-2014-4049). (Sara)
@@ -133,6 +315,8 @@ PHP                                                                        NEWS
   . Fixed bug #66127 (Segmentation fault with ArrayObject unset). (Stas)
   . Fixed bug #67359 (Segfault in recursiveDirectoryIterator). (Laruence)
   . Fixed bug #67360 (Missing element after ArrayObject::getIterator). (Adam)
+  . Fixed bug #67492 (unserialize() SPL ArrayObject / SPLObjectStorage Type
+    Confusion). (CVE-2014-3515) (Stefan Esser)
 
 29 May 2014, PHP 5.5.13
 

README.GIT-RULES

@@ -45,15 +45,16 @@ Currently we have the following branches in use::
 
   master    The active development branch. 
 
+  PHP-5.6   Is used to release the PHP 5.6.x series. This is a current
+            stable version and is open for bugfixes only.
+
   PHP-5.5   Is used to release the PHP 5.5.x series. This is a current
             stable version and is open for bugfixes only.
 
   PHP-5.4   Is used to release the PHP 5.4.x series. This is a current
             stable version and is open for bugfixes only.
 
-  PHP-5.3   Is used to release the PHP 5.3.x series. This is currently 
-            in extended support and open forsecurity fixes only. Triaged
-            via security@php.net
+  PHP-5.3   This branch is closed.
 
   PHP-5.2   This branch is closed.
 
@@ -61,9 +62,12 @@ Currently we have the following branches in use::
 
   PHP-4.4   This branch is closed.
 
+  PHP-X.Y.Z These branches are used for the release managers for tagging
+            the releases, hence they are closed to the general public.
+
 The next few rules are more of a technical nature::
 
-   1. All changes should first go to the lowest branch (i.e. 5.3) and then 
+   1. All changes should first go to the lowest branch (i.e. 5.4) and then
       get merged up to all other branches. If a change is not needed for
       later branches (i.e. fixes for features which where dropped from later
       branches) an empty merge should be done.

Zend/tests/bug67633.phpt

@@ -0,0 +1,44 @@
+--TEST--
+Bug #67633: A foreach on an array returned from a function not doing copy-on-write
+--FILE--
+<?php
+
+function id($x) {
+    return $x;
+}
+
+function &ref_id(&$x) {
+    return $x;
+}
+
+$c = 'c';
+$array = ['a', 'b', $c];
+
+foreach(id($array) as &$v) {
+    $v .= 'q';
+}
+var_dump($array);
+
+foreach(ref_id($array) as &$v) {
+    $v .= 'q';
+}
+var_dump($array);
+
+?>
+--EXPECT--
+array(3) {
+  [0]=>
+  string(1) "a"
+  [1]=>
+  string(1) "b"
+  [2]=>
+  string(1) "c"
+}
+array(3) {
+  [0]=>
+  string(2) "aq"
+  [1]=>
+  string(2) "bq"
+  [2]=>
+  &string(2) "cq"
+}

Zend/tests/bug67985.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug #67985 - Last used array index not copied to new array at assignment
+--FILE--
+<?php
+
+$a = ['zero', 'one', 'two'];
+unset($a[2]);
+$b = $a;
+$a[] = 'three';
+$b[] = 'three';
+
+var_dump($a === $b);
+
+?>
+--EXPECT--
+bool(true)

Zend/tests/bug68118.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Bug #68118: $a->foo .= 'test'; can leave $a->foo undefined
+--FILE--
+<?php
+
+set_error_handler(function() {
+    $obj = new stdClass;
+    $obj->test = 'meow';
+    return true;
+});
+ 
+$a = new stdClass;
+$a->undefined .= 'test';
+var_dump($a);
+
+?>
+--EXPECT--
+object(stdClass)#2 (1) {
+  ["undefined"]=>
+  string(4) "test"
+}

Zend/tests/bug68370.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug #68370 "unset($this)" can make the program crash
+--FILE--
+<?php
+class C {
+	public function test() {
+		unset($this);
+		return get_defined_vars();
+	}
+}
+$c = new C();
+$x = $c->test();
+print_r($x);
+unset($c, $x);
+--EXPECTF--
+Array
+(
+)

Zend/zend.c

@@ -814,6 +814,20 @@ void zend_shutdown(TSRMLS_D) /* {{{ */
 	zend_shutdown_timeout_thread();
 #endif
 	zend_destroy_rsrc_list(&EG(persistent_list) TSRMLS_CC);
+
+	if (EG(active))
+	{
+		/*
+		 * The order of destruction is important here.
+		 * See bugs #65463 and 66036.
+		 */
+		zend_hash_reverse_apply(GLOBAL_FUNCTION_TABLE, (apply_func_t) zend_cleanup_function_data_full TSRMLS_CC);
+		zend_hash_reverse_apply(GLOBAL_CLASS_TABLE, (apply_func_t) zend_cleanup_user_class_data TSRMLS_CC);
+		zend_cleanup_internal_classes(TSRMLS_C);
+		zend_hash_reverse_apply(GLOBAL_FUNCTION_TABLE, (apply_func_t) clean_non_persistent_function_full TSRMLS_CC);
+		zend_hash_reverse_apply(GLOBAL_CLASS_TABLE, (apply_func_t) clean_non_persistent_class_full TSRMLS_CC);
+	}
+
 	zend_destroy_modules();
 
 	zend_hash_destroy(GLOBAL_FUNCTION_TABLE);

Zend/zend_compile.c

@@ -4116,7 +4116,7 @@ static void zend_traits_init_trait_structures(zend_class_entry *ce TSRMLS_DC) /*
 
 					/* make sure that the trait method is not from a class mentioned in
 					 exclude_from_classes, for consistency */
-					if (cur_precedence->trait_method->ce == cur_precedence->exclude_from_classes[i]) {
+					if (cur_precedence->trait_method->ce == cur_precedence->exclude_from_classes[j]) {
 						zend_error(E_COMPILE_ERROR,
 								   "Inconsistent insteadof definition. "
 								   "The method %s is to be used from %s, but %s is also on the exclude list",
@@ -6231,6 +6231,15 @@ void zend_do_foreach_begin(znode *foreach_token, znode *open_brackets_token, zno
 		/* save the location of FETCH_W instruction(s) */
 		open_brackets_token->u.op.opline_num = get_next_op_number(CG(active_op_array));
 		zend_do_end_variable_parse(array, BP_VAR_W, 0 TSRMLS_CC);
+
+		if (zend_is_function_or_method_call(array)) {
+			opline = get_next_op(CG(active_op_array) TSRMLS_CC);
+			opline->opcode = ZEND_SEPARATE;
+			SET_NODE(opline->op1, array);
+			SET_UNUSED(opline->op2);
+			opline->result_type = IS_VAR;
+			opline->result.var = opline->op1.var;
+		}
 	} else {
 		is_variable = 0;
 		open_brackets_token->u.op.opline_num = get_next_op_number(CG(active_op_array));

Zend/zend_compile.h

@@ -666,6 +666,8 @@ ZEND_API void zend_cleanup_internal_class_data(zend_class_entry *ce TSRMLS_DC);
 ZEND_API void zend_cleanup_internal_classes(TSRMLS_D);
 ZEND_API int zend_cleanup_function_data(zend_function *function TSRMLS_DC);
 ZEND_API int zend_cleanup_function_data_full(zend_function *function TSRMLS_DC);
+ZEND_API int clean_non_persistent_function_full(zend_function *function TSRMLS_DC);
+ZEND_API int clean_non_persistent_class_full(zend_class_entry **ce TSRMLS_DC);
 
 ZEND_API void destroy_zend_function(zend_function *function TSRMLS_DC);
 ZEND_API void zend_function_dtor(zend_function *function);

Zend/zend_execute_API.c

@@ -109,7 +109,7 @@ static int clean_non_persistent_function(zend_function *function TSRMLS_DC) /* {
 }
 /* }}} */
 
-static int clean_non_persistent_function_full(zend_function *function TSRMLS_DC) /* {{{ */
+ZEND_API int clean_non_persistent_function_full(zend_function *function TSRMLS_DC) /* {{{ */
 {
 	return (function->type == ZEND_INTERNAL_FUNCTION) ? ZEND_HASH_APPLY_KEEP : ZEND_HASH_APPLY_REMOVE;
 }
@@ -121,7 +121,7 @@ static int clean_non_persistent_class(zend_class_entry **ce TSRMLS_DC) /* {{{ */
 }
 /* }}} */
 
-static int clean_non_persistent_class_full(zend_class_entry **ce TSRMLS_DC) /* {{{ */
+ZEND_API int clean_non_persistent_class_full(zend_class_entry **ce TSRMLS_DC) /* {{{ */
 {
 	return ((*ce)->type == ZEND_INTERNAL_CLASS) ? ZEND_HASH_APPLY_KEEP : ZEND_HASH_APPLY_REMOVE;
 }
@@ -1341,6 +1341,10 @@ ZEND_API void zend_timeout(int dummy) /* {{{ */
 #ifdef ZEND_WIN32
 static LRESULT CALLBACK zend_timeout_WndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam) /* {{{ */
 {
+#ifdef ZTS
+	THREAD_T thread_id = (THREAD_T)wParam;
+#endif
+
 	switch (message) {
 		case WM_DESTROY:
 			PostQuitMessage(0);
@@ -1355,7 +1359,7 @@ static LRESULT CALLBACK zend_timeout_WndProc(HWND hWnd, UINT message, WPARAM wPa
 #endif
 				SetTimer(timeout_window, wParam, lParam*1000, NULL);
 #ifdef ZTS
-				tsrm_ls = ts_resource_ex(0, &wParam);
+				tsrm_ls = ts_resource_ex(0, &thread_id);
 				if (!tsrm_ls) {
 					/* shouldn't normally happen */
 					break;
@@ -1372,7 +1376,7 @@ static LRESULT CALLBACK zend_timeout_WndProc(HWND hWnd, UINT message, WPARAM wPa
 #ifdef ZTS
 				void ***tsrm_ls;
 
-				tsrm_ls = ts_resource_ex(0, &wParam);
+				tsrm_ls = ts_resource_ex(0, &thread_id);
 				if (!tsrm_ls) {
 					/* Thread died before receiving its timeout? */
 					break;
@@ -1761,13 +1765,6 @@ ZEND_API void zend_rebuild_symbol_table(TSRMLS_D) /* {{{ */
 				/*printf("Cache miss!  Initialized %x\n", EG(active_symbol_table));*/
 			}
 			ex->symbol_table = EG(active_symbol_table);
-
-			if (ex->op_array->this_var != -1 &&
-			    !*EX_CV_NUM(ex, ex->op_array->this_var) &&
-			    EG(This)) {
-			    *EX_CV_NUM(ex, ex->op_array->this_var) = (zval**)EX_CV_NUM(ex, ex->op_array->last_var + ex->op_array->this_var);
-				**EX_CV_NUM(ex, ex->op_array->this_var) = EG(This);
- 			}
 			for (i = 0; i < ex->op_array->last_var; i++) {
 				if (*EX_CV_NUM(ex, i)) {
 					zend_hash_quick_update(EG(active_symbol_table),

Zend/zend_float.h

@@ -21,6 +21,8 @@
 #ifndef ZEND_FLOAT_H
 #define ZEND_FLOAT_H
 
+BEGIN_EXTERN_C()
+
 /*
   Define functions for FP initialization and de-initialization.
 */
@@ -28,6 +30,8 @@ extern ZEND_API void zend_init_fpu(TSRMLS_D);
 extern ZEND_API void zend_shutdown_fpu(TSRMLS_D);
 extern ZEND_API void zend_ensure_fpu_mode(TSRMLS_D);
 
+END_EXTERN_C()
+
 /* Copy of the contents of xpfpa.h (which is under public domain)
    See http://wiki.php.net/rfc/rounding for details.
 

Zend/zend_object_handlers.c

@@ -754,9 +754,6 @@ static zval **zend_std_get_property_ptr_ptr(zval *object, zval *member, int type
 			/* we don't have access controls - will just add it */
 			new_zval = &EG(uninitialized_zval);
 
-			if(UNEXPECTED(type == BP_VAR_RW || type == BP_VAR_R)) {
-				zend_error(E_NOTICE, "Undefined property: %s::$%s", zobj->ce->name, Z_STRVAL_P(member));
-			}
 			Z_ADDREF_P(new_zval);
 			if (EXPECTED((property_info->flags & ZEND_ACC_STATIC) == 0) &&
 			    property_info->offset >= 0) {
@@ -776,6 +773,12 @@ static zval **zend_std_get_property_ptr_ptr(zval *object, zval *member, int type
 				}
 				zend_hash_quick_update(zobj->properties, property_info->name, property_info->name_length+1, property_info->h, &new_zval, sizeof(zval *), (void **) &retval);
 			}
+
+			/* Notice is thrown after creation of the property, to avoid EG(std_property_info)
+			 * being overwritten in an error handler. */
+			if (UNEXPECTED(type == BP_VAR_RW || type == BP_VAR_R)) {
+				zend_error(E_NOTICE, "Undefined property: %s::$%s", zobj->ce->name, Z_STRVAL_P(member));
+			}
 		} else {
 			/* we do have getter - fail and let it try again with usual get/set */
 			retval = NULL;

Zend/zend_variables.c

@@ -135,8 +135,9 @@ ZEND_API void _zval_copy_ctor_func(zval *zvalue ZEND_FILE_LINE_DC)
 				}
 				ALLOC_HASHTABLE_REL(tmp_ht);
 				zend_hash_init(tmp_ht, zend_hash_num_elements(original_ht), NULL, ZVAL_PTR_DTOR, 0);
-				zend_hash_copy(tmp_ht, original_ht, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
 				zvalue->value.ht = tmp_ht;
+				zend_hash_copy(tmp_ht, original_ht, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
+				tmp_ht->nNextFreeElement = original_ht->nNextFreeElement;
 			}
 			break;
 		case IS_OBJECT:

Zend/zend_vm.h

@@ -21,9 +21,13 @@
 #ifndef ZEND_VM_H
 #define ZEND_VM_H
 
+BEGIN_EXTERN_C()
+
 ZEND_API void zend_vm_use_old_executor(void);
 ZEND_API void zend_vm_set_opcode_handler(zend_op* opcode);
 
+END_EXTERN_C()
+
 #define ZEND_VM_SET_OPCODE_HANDLER(opline) zend_vm_set_opcode_handler(opline)
 
 #endif

Zend/zend_vm_gen.php

@@ -1181,7 +1181,9 @@ function gen_vm($def, $skel) {
 	out($f, $GLOBALS['header_text']);
 
 	fputs($f, "#ifndef ZEND_VM_OPCODES_H\n#define ZEND_VM_OPCODES_H\n\n");
+	fputs($f, "BEGIN_EXTERN_C()\n\n");
 	fputs($f, "ZEND_API const char *zend_get_opcode_name(zend_uchar opcode);\n\n");
+	fputs($f, "END_EXTERN_C()\n\n");
 	
 	foreach ($opcodes as $code => $dsc) {
 		$code = str_pad((string)$code,$code_len," ",STR_PAD_LEFT);

Zend/zend_vm_opcodes.h

@@ -21,8 +21,12 @@
 #ifndef ZEND_VM_OPCODES_H
 #define ZEND_VM_OPCODES_H
 
+BEGIN_EXTERN_C()
+
 ZEND_API const char *zend_get_opcode_name(zend_uchar opcode);
 
+END_EXTERN_C()
+
 #define ZEND_NOP                               0
 #define ZEND_ADD                               1
 #define ZEND_SUB                               2

acinclude.m4

@@ -2800,7 +2800,7 @@ AC_DEFUN([PHP_DETECT_ICC],
 
 dnl PHP_DETECT_SUNCC
 dnl Detect if the systems default compiler is suncc.
-dnl We also set some usefull CFLAGS if the user didn't set any
+dnl We also set some useful CFLAGS if the user didn't set any
 AC_DEFUN([PHP_DETECT_SUNCC],[
   SUNCC="no"
   AC_MSG_CHECKING([for suncc])

build/libtool.m4

@@ -615,7 +615,7 @@ ia64-*-hpux*)
   rm -rf conftest*
   ;;
 
-x86_64-*kfreebsd*-gnu|x86_64-*linux*|ppc*-*linux*|powerpc*-*linux*| \
+x86_64-*kfreebsd*-gnu|x86_64-*linux*|powerpc*-*linux*| \
 s390*-*linux*|sparc*-*linux*)
   # Find out which ABI we are using.
   echo 'int i;' > conftest.$ac_ext
@@ -629,7 +629,10 @@ s390*-*linux*|sparc*-*linux*)
         x86_64-*linux*)
           LD="${LD-ld} -m elf_i386"
           ;;
-        ppc64-*linux*|powerpc64-*linux*)
+        powerpc64le-*linux*)
+          LD="${LD-ld} -m elf32lppclinux"
+          ;;
+        powerpc64-*linux*)
           LD="${LD-ld} -m elf32ppclinux"
           ;;
         s390x-*linux*)
@@ -648,7 +651,10 @@ s390*-*linux*|sparc*-*linux*)
         x86_64-*linux*)
           LD="${LD-ld} -m elf_x86_64"
           ;;
-        ppc*-*linux*|powerpc*-*linux*)
+        powerpcle-*linux*)
+          LD="${LD-ld} -m elf64lppc"
+          ;;
+        powerpc-*linux*)
           LD="${LD-ld} -m elf64ppc"
           ;;
         s390*-*linux*)

config.guess

@@ -982,6 +982,12 @@ EOF
     ppc:Linux:*:*)
 	echo powerpc-unknown-linux-gnu
 	exit ;;
+    ppc64le:Linux:*:*)
+	echo powerpc64le-unknown-linux-gnu
+	exit ;;
+    ppcle:Linux:*:*)
+	echo powerpcle-unknown-linux-gnu
+	exit ;;
     s390:Linux:*:* | s390x:Linux:*:*)
 	echo ${UNAME_MACHINE}-ibm-linux
 	exit ;;

configure.in

@@ -119,8 +119,8 @@ int zend_sprintf(char *buffer, const char *format, ...);
 
 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=5
-PHP_RELEASE_VERSION=15
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=20
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
 
@@ -784,7 +784,12 @@ if test "$PHP_GCOV" = "yes"; then
     AC_MSG_ERROR([ccache must be disabled when --enable-gcov option is used. You can disable ccache by setting environment variable CCACHE_DISABLE=1.])
   fi
   
-  ltp_version_list="1.5 1.6 1.7 1.9 1.10"
+  dnl min: 1.5 (i.e. 105, major * 100 + minor for easier comparison)
+  ltp_version_min="105"
+  dnl non-working versions, e.g. "1.8 1.18";
+  dnl remove "none" when introducing the first incompatible LTP version an 
+  dnl separate any following additions by spaces
+  ltp_version_exclude="1.8"
 
   AC_CHECK_PROG(LTP, lcov, lcov)
   AC_CHECK_PROG(LTP_GENHTML, genhtml, genhtml)
@@ -794,21 +799,30 @@ if test "$PHP_GCOV" = "yes"; then
   if test "$LTP"; then
     AC_CACHE_CHECK([for ltp version], php_cv_ltp_version, [
       php_cv_ltp_version=invalid
-      ltp_version=`$LTP -v 2>/dev/null | $SED -e 's/^.* //'`
-      for ltp_check_version in $ltp_version_list; do
-        if test "$ltp_version" = "$ltp_check_version"; then
-          php_cv_ltp_version="$ltp_check_version (ok)"
+      ltp_version_vars=`$LTP -v 2>/dev/null | $SED -e 's/^.* //' -e 's/\./ /g' | tr -d a-z`
+      if test -n "$ltp_version_vars"; then
+        set $ltp_version_vars
+        ltp_version="${1}.${2}"
+        ltp_version_num="`expr ${1} \* 100 + ${2}`"
+        if test $ltp_version_num -ge $ltp_version_min; then
+          php_cv_ltp_version="$ltp_version (ok)"
+          for ltp_check_version in $ltp_version_exclude; do
+            if test "$ltp_version" = "$ltp_check_version"; then
+              php_cv_ltp_version=invalid
+              break
+            fi
+          done
         fi
-      done
+      fi
     ])
   else
-    ltp_msg="To enable code coverage reporting you must have one of the following LTP versions installed: $ltp_version_list"      
+    ltp_msg="To enable code coverage reporting you must have LTP installed"      
     AC_MSG_ERROR([$ltp_msg])
   fi
 
   case $php_cv_ltp_version in
     ""|invalid[)]
-      ltp_msg="You must have one of the following versions of LTP: $ltp_version_list (found: $ltp_version)."
+      ltp_msg="This LTP version is not supported (found: $ltp_version, min: $ltp_version_min, excluded: $ltp_version_exclude)."
       AC_MSG_ERROR([$ltp_msg])
       LTP="exit 0;"
       ;;

ext/com_dotnet/com_dotnet.c

@@ -198,7 +198,8 @@ PHP_FUNCTION(com_dotnet_create_instance)
 	IUnknown *unk = NULL;
 
 	php_com_initialize(TSRMLS_C);
-	if (COMG(dotnet_runtime_stuff) == NULL) {
+	stuff = (struct dotnet_runtime_stuff*)COMG(dotnet_runtime_stuff);
+	if (stuff == NULL) {
 		hr = dotnet_init(&where TSRMLS_CC);
 		if (FAILED(hr)) {
 			char buf[1024];
@@ -210,9 +211,35 @@ PHP_FUNCTION(com_dotnet_create_instance)
 			ZVAL_NULL(object);
 			return;
 		}
-	}
+		stuff = (struct dotnet_runtime_stuff*)COMG(dotnet_runtime_stuff);
 
-	stuff = (struct dotnet_runtime_stuff*)COMG(dotnet_runtime_stuff);
+	} else if (stuff->dotnet_domain == NULL) {
+		where = "ICorRuntimeHost_GetDefaultDomain";
+		hr = ICorRuntimeHost_GetDefaultDomain(stuff->dotnet_host, &unk);
+		if (FAILED(hr)) {
+			char buf[1024];
+			char *err = php_win32_error_to_msg(hr);
+			snprintf(buf, sizeof(buf), "Failed to re-init .Net domain [%s] %s", where, err);
+			if (err)
+				LocalFree(err);
+			php_com_throw_exception(hr, buf TSRMLS_CC);
+			ZVAL_NULL(object);
+			return;
+		}
+
+		where = "QI: System._AppDomain";
+		hr = IUnknown_QueryInterface(unk, &IID_mscorlib_System_AppDomain, (LPVOID*)&stuff->dotnet_domain);
+		if (FAILED(hr)) {
+			char buf[1024];
+			char *err = php_win32_error_to_msg(hr);
+			snprintf(buf, sizeof(buf), "Failed to re-init .Net domain [%s] %s", where, err);
+			if (err)
+				LocalFree(err);
+			php_com_throw_exception(hr, buf TSRMLS_CC);
+			ZVAL_NULL(object);
+			return;
+		}
+	}
 
 	obj = CDNO_FETCH(object);
 

ext/curl/interface.c

@@ -169,6 +169,11 @@ static int php_curl_option_str(php_curl *ch, long option, const char *str, const
 {
 	CURLcode error = CURLE_OK;
 
+	if (strlen(str) != len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Curl option contains invalid characters (\\0)");
+		return FAILURE;
+	}
+
 #if LIBCURL_VERSION_NUM >= 0x071100
 	if (make_copy) {
 #endif
@@ -1197,6 +1202,12 @@ PHP_MINIT_FUNCTION(curl)
 	REGISTER_CURL_CONSTANT(CURLSSLOPT_ALLOW_BEAST);
 #endif
 
+#if LIBCURL_VERSION_NUM >= 0x072200 /* Available since 7.34.0 */
+	REGISTER_CURL_CONSTANT(CURL_SSLVERSION_TLSv1_0);
+	REGISTER_CURL_CONSTANT(CURL_SSLVERSION_TLSv1_1);
+	REGISTER_CURL_CONSTANT(CURL_SSLVERSION_TLSv1_2);
+#endif
+
 #if CURLOPT_FTPASCII != 0
 	REGISTER_CURL_CONSTANT(CURLOPT_FTPASCII);
 #endif

ext/curl/tests/bug68089.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug #68089 (NULL byte injection - cURL lib)
+--SKIPIF--
+<?php 
+include 'skipif.inc';
+
+?>
+--FILE--
+<?php
+$url = "file:///etc/passwd\0http://google.com";
+$ch = curl_init();
+var_dump(curl_setopt($ch, CURLOPT_URL, $url));
+?>
+Done
+--EXPECTF--
+Warning: curl_setopt(): Curl option contains invalid characters (\0) in %s%ebug68089.php on line 4
+bool(false)
+Done

ext/curl/tests/check_win_config.phpt

@@ -28,7 +28,7 @@ Features
 AsynchDNS => Yes
 CharConv => No
 Debug => No
-GSS-Negotiate => Yes
+GSS-Negotiate => No
 IDN => Yes
 IPv6 => Yes
 krb4 => No

ext/curl/tests/curl_multi_init_param.phpt

@@ -0,0 +1,27 @@
+--TEST--
+Test curl_multi_init() fail if any parameter is passed
+--CREDITS--
+Paulo Eduardo <pauloelr [at] gmail [dot] com>
+#testfest SP 2014
+--SKIPIF--
+<?php if (!extension_loaded("curl")) print "skip"; ?>
+--FILE--
+<?php
+/* Prototype         : resource curl_multi_init(void)
+ * Description       : Returns a new cURL multi handle
+ * Source code       : ext/curl/multi.c
+ * Test documentation:  http://wiki.php.net/qa/temp/ext/curl
+ */
+
+// start testing
+
+//create the multiple cURL handle
+$mh = curl_multi_init('test');
+var_dump($mh);
+
+?>
+===DONE===
+--EXPECTF--
+Warning: curl_multi_init() expects exactly 0 parameters, %d given in %s on line %d
+NULL
+===DONE===

ext/date/lib/dow.c

@@ -23,9 +23,21 @@
 static int m_table_common[13] = { -1, 0, 3, 3, 6, 1, 4, 6, 2, 5, 0, 3, 5 }; /* 1 = jan */
 static int m_table_leap[13] =   { -1, 6, 2, 3, 6, 1, 4, 6, 2, 5, 0, 3, 5 }; /* 1 = jan */
 
+static timelib_sll positive_mod(timelib_sll x, timelib_sll y)
+{
+	timelib_sll tmp;
+
+	tmp = x % y;
+	if (tmp < 0) {
+		tmp += y;
+	}
+
+	return tmp;
+}
+
 static timelib_sll century_value(timelib_sll j)
 {
-	return 6 - (j % 4) * 2;
+	return 6 - positive_mod(j, 4) * 2;
 }
 
 static timelib_sll timelib_day_of_week_ex(timelib_sll y, timelib_sll m, timelib_sll d, int iso)
@@ -36,9 +48,9 @@ static timelib_sll timelib_day_of_week_ex(timelib_sll y, timelib_sll m, timelib_
 	 * Julian calendar. We just return the 'wrong' day of week to be
 	 * consistent. */
 	c1 = century_value(y / 100);
-	y1 = (y % 100);
+	y1 = positive_mod(y, 100);
 	m1 = timelib_is_leap(y) ? m_table_leap[m] : m_table_common[m];
-	dow = (c1 + y1 + m1 + (y1 / 4) + d) % 7;
+	dow = positive_mod((c1 + y1 + m1 + (y1 / 4) + d), 7);
 	if (iso) {
 		if (dow == 0) {
 			dow = 7;

ext/date/lib/parse_date.re

@@ -668,7 +668,7 @@ static void timelib_set_relative(char **ptr, timelib_sll amount, int behavior, S
 	}
 }
 
-const static timelib_tz_lookup_table* zone_search(const char *word, long gmtoffset, int isdst)
+const static timelib_tz_lookup_table* abbr_search(const char *word, long gmtoffset, int isdst)
 {
 	int first_found = 0;
 	const timelib_tz_lookup_table  *tp, *first_found_elem = NULL;
@@ -696,25 +696,6 @@ const static timelib_tz_lookup_table* zone_search(const char *word, long gmtoffs
 		return first_found_elem;
 	}
 
-	for (tp = timelib_timezone_lookup; tp->name; tp++) {
-		if (tp->full_tz_name && strcasecmp(word, tp->full_tz_name) == 0) {
-			if (!first_found) {
-				first_found = 1;
-				first_found_elem = tp;
-				if (gmtoffset == -1) {
-					return tp;
-				}
-			}
-			if (tp->gmtoffset == gmtoffset) {
-				return tp;
-			}
-		}
-	}
-	if (first_found) {
-		return first_found_elem;
-	}
-
-
 	/* Still didn't find anything, let's find the zone solely based on
 	 * offset/isdst then */
 	for (fmp = timelib_timezone_fallbackmap; fmp->name; fmp++) {
@@ -725,7 +706,7 @@ const static timelib_tz_lookup_table* zone_search(const char *word, long gmtoffs
 	return NULL;
 }
 
-static long timelib_lookup_zone(char **ptr, int *dst, char **tz_abbr, int *found)
+static long timelib_lookup_abbr(char **ptr, int *dst, char **tz_abbr, int *found)
 {
 	char *word;
 	char *begin = *ptr, *end;
@@ -739,7 +720,7 @@ static long timelib_lookup_zone(char **ptr, int *dst, char **tz_abbr, int *found
 	word = calloc(1, end - begin + 1);
 	memcpy(word, begin, end - begin);
 
-	if ((tp = zone_search(word, -1, 0))) {
+	if ((tp = abbr_search(word, -1, 0))) {
 		value = -tp->gmtoffset / 60;
 		*dst = tp->type;
 		value += tp->type * 60;
@@ -783,33 +764,26 @@ long timelib_parse_zone(char **ptr, int *dst, timelib_time *t, int *tz_not_found
 		retval = timelib_parse_tz_cor(ptr);
 	} else {
 		int found = 0;
-		long offset;
+		long offset = 0;
 		char *tz_abbr;
 
 		t->is_localtime = 1;
 
-		offset = timelib_lookup_zone(ptr, dst, &tz_abbr, &found);
+		/* First, we lookup by abbreviation only */
+		offset = timelib_lookup_abbr(ptr, dst, &tz_abbr, &found);
 		if (found) {
 			t->zone_type = TIMELIB_ZONETYPE_ABBR;
+			timelib_time_tz_abbr_update(t, tz_abbr);
 		}
-#if 0
-		/* If we found a TimeZone identifier, use it */
-		if (tz_name) {
-			t->tz_info = timelib_parse_tzfile(tz_name);
-			t->zone_type = TIMELIB_ZONETYPE_ID;
-		}
-#endif
-		/* If we have a TimeZone identifier to start with, use it */
-		if (strstr(tz_abbr, "/") || strcmp(tz_abbr, "UTC") == 0) {
+
+		/* Otherwise, we look if we have a TimeZone identifier */
+		if (!found || strcmp("UTC", tz_abbr) == 0) {
 			if ((res = tz_wrapper(tz_abbr, tzdb)) != NULL) {
 				t->tz_info = res;
 				t->zone_type = TIMELIB_ZONETYPE_ID;
 				found++;
 			}
 		}
-		if (found && t->zone_type != TIMELIB_ZONETYPE_ID) {
-			timelib_time_tz_abbr_update(t, tz_abbr);
-		}
 		free(tz_abbr);
 		*tz_not_found = (found == 0);
 		retval = offset;
@@ -931,8 +905,8 @@ mssqltime        = hour12 ":" minutelz ":" secondlz [:.] [0-9]+ meridian;
 isoweekday       = year4 "-"? "W" weekofyear "-"? [0-7];
 isoweek          = year4 "-"? "W" weekofyear;
 exif             = year4 ":" monthlz ":" daylz " " hour24lz ":" minutelz ":" secondlz;
-firstdayof       = 'first day of'?;
-lastdayof        = 'last day of'?;
+firstdayof       = 'first day of';
+lastdayof        = 'last day of';
 backof           = 'back of ' hour24 space? meridian?;
 frontof          = 'front of ' hour24 space? meridian?;
 
@@ -1055,7 +1029,7 @@ weekdayof        = (reltextnumber|reltexttext) space (dayfull|dayabbr) space 'of
 		TIMELIB_HAVE_RELATIVE();
 
 		/* skip "last day of" or "first day of" */
-		if (*ptr == 'l') {
+		if (*ptr == 'l' || *ptr == 'L') {
 			s->time->relative.first_last_day_of = 2;
 		} else {
 			s->time->relative.first_last_day_of = 1;
@@ -2232,7 +2206,7 @@ char *timelib_timezone_id_from_abbr(const char *abbr, long gmtoffset, int isdst)
 {
 	const timelib_tz_lookup_table *tp;
 
-	tp = zone_search(abbr, gmtoffset, isdst);
+	tp = abbr_search(abbr, gmtoffset, isdst);
 	if (tp) {
 		return (tp->full_tz_name);
 	} else {

ext/date/php_date.c

@@ -326,7 +326,7 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_timezone_offset_get, 0, 0, 2)
 ZEND_END_ARG_INFO()
 
 ZEND_BEGIN_ARG_INFO_EX(arginfo_timezone_method_offset_get, 0, 0, 1)
-	ZEND_ARG_INFO(0, datetime)
+	ZEND_ARG_INFO(0, object)
 ZEND_END_ARG_INFO()
 
 ZEND_BEGIN_ARG_INFO_EX(arginfo_timezone_transitions_get, 0, 0, 1)
@@ -2534,11 +2534,7 @@ static void date_object_free_storage_period(void *object TSRMLS_DC)
 /* Advanced Interface */
 PHPAPI zval *php_date_instantiate(zend_class_entry *pce, zval *object TSRMLS_DC)
 {
-	Z_TYPE_P(object) = IS_OBJECT;
 	object_init_ex(object, pce);
-	Z_SET_REFCOUNT_P(object, 1);
-	Z_UNSET_ISREF_P(object);
-
 	return object;
 }
 
@@ -2646,14 +2642,19 @@ PHP_FUNCTION(date_create)
 	zval           *timezone_object = NULL;
 	char           *time_str = NULL;
 	int             time_str_len = 0;
+	zval            datetime_object;
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|sO!", &time_str, &time_str_len, &timezone_object, date_ce_timezone) == FAILURE) {
 		RETURN_FALSE;
 	}
 
-	php_date_instantiate(date_ce_date, return_value TSRMLS_CC);
-	if (!php_date_initialize(zend_object_store_get_object(return_value TSRMLS_CC), time_str, time_str_len, NULL, timezone_object, 0 TSRMLS_CC)) {
+	php_date_instantiate(date_ce_date, &datetime_object TSRMLS_CC);
+	if (!php_date_initialize(zend_object_store_get_object(&datetime_object TSRMLS_CC), time_str, time_str_len, NULL, timezone_object, 0 TSRMLS_CC)) {
+		zval_dtor(&datetime_object);
 		RETURN_FALSE;
+	} else {
+		zval *datetime_object_ptr = &datetime_object;
+		RETVAL_ZVAL(datetime_object_ptr, 0, 0);
 	}
 }
 /* }}} */
@@ -2666,14 +2667,19 @@ PHP_FUNCTION(date_create_immutable)
 	zval           *timezone_object = NULL;
 	char           *time_str = NULL;
 	int             time_str_len = 0;
+	zval            datetime_object;
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|sO!", &time_str, &time_str_len, &timezone_object, date_ce_timezone) == FAILURE) {
 		RETURN_FALSE;
 	}
 
-	php_date_instantiate(date_ce_immutable, return_value TSRMLS_CC);
-	if (!php_date_initialize(zend_object_store_get_object(return_value TSRMLS_CC), time_str, time_str_len, NULL, timezone_object, 0 TSRMLS_CC)) {
+	php_date_instantiate(date_ce_immutable, &datetime_object TSRMLS_CC);
+	if (!php_date_initialize(zend_object_store_get_object(&datetime_object TSRMLS_CC), time_str, time_str_len, NULL, timezone_object, 0 TSRMLS_CC)) {
+		zval_dtor(&datetime_object);
 		RETURN_FALSE;
+	} else {
+		zval *datetime_object_ptr = &datetime_object;
+		RETVAL_ZVAL(datetime_object_ptr, 0, 0);
 	}
 }
 /* }}} */
@@ -2686,14 +2692,19 @@ PHP_FUNCTION(date_create_from_format)
 	zval           *timezone_object = NULL;
 	char           *time_str = NULL, *format_str = NULL;
 	int             time_str_len = 0, format_str_len = 0;
+	zval            datetime_object;
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ss|O", &format_str, &format_str_len, &time_str, &time_str_len, &timezone_object, date_ce_timezone) == FAILURE) {
 		RETURN_FALSE;
 	}
 
-	php_date_instantiate(date_ce_date, return_value TSRMLS_CC);
-	if (!php_date_initialize(zend_object_store_get_object(return_value TSRMLS_CC), time_str, time_str_len, format_str, timezone_object, 0 TSRMLS_CC)) {
+	php_date_instantiate(date_ce_date, &datetime_object TSRMLS_CC);
+	if (!php_date_initialize(zend_object_store_get_object(&datetime_object TSRMLS_CC), time_str, time_str_len, format_str, timezone_object, 0 TSRMLS_CC)) {
+		zval_dtor(&datetime_object);
 		RETURN_FALSE;
+	} else {
+		zval *datetime_object_ptr = &datetime_object;
+		RETVAL_ZVAL(datetime_object_ptr, 0, 0);
 	}
 }
 /* }}} */
@@ -2706,14 +2717,19 @@ PHP_FUNCTION(date_create_immutable_from_format)
 	zval           *timezone_object = NULL;
 	char           *time_str = NULL, *format_str = NULL;
 	int             time_str_len = 0, format_str_len = 0;
+	zval            datetime_object;
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ss|O", &format_str, &format_str_len, &time_str, &time_str_len, &timezone_object, date_ce_timezone) == FAILURE) {
 		RETURN_FALSE;
 	}
 
-	php_date_instantiate(date_ce_immutable, return_value TSRMLS_CC);
-	if (!php_date_initialize(zend_object_store_get_object(return_value TSRMLS_CC), time_str, time_str_len, format_str, timezone_object, 0 TSRMLS_CC)) {
+	php_date_instantiate(date_ce_immutable, &datetime_object TSRMLS_CC);
+	if (!php_date_initialize(zend_object_store_get_object(&datetime_object TSRMLS_CC), time_str, time_str_len, format_str, timezone_object, 0 TSRMLS_CC)) {
+		zval_dtor(&datetime_object);
 		RETURN_FALSE;
+	} else {
+		zval *datetime_object_ptr = &datetime_object;
+		RETVAL_ZVAL(datetime_object_ptr, 0, 0);
 	}
 }
 /* }}} */
@@ -2754,7 +2770,7 @@ PHP_METHOD(DateTimeImmutable, __construct)
 }
 /* }}} */
 
-static int php_date_initialize_from_hash(zval **return_value, php_date_obj **dateobj, HashTable *myht TSRMLS_DC)
+static int php_date_initialize_from_hash(php_date_obj **dateobj, HashTable *myht TSRMLS_DC)
 {
 	zval            **z_date = NULL;
 	zval            **z_timezone = NULL;
@@ -2824,7 +2840,7 @@ PHP_METHOD(DateTime, __set_state)
 
 	php_date_instantiate(date_ce_date, return_value TSRMLS_CC);
 	dateobj = (php_date_obj *) zend_object_store_get_object(return_value TSRMLS_CC);
-	if (!php_date_initialize_from_hash(&return_value, &dateobj, myht TSRMLS_CC)) {
+	if (!php_date_initialize_from_hash(&dateobj, myht TSRMLS_CC)) {
 		php_error(E_ERROR, "Invalid serialization data for DateTime object");
 	}
 }
@@ -2846,7 +2862,7 @@ PHP_METHOD(DateTimeImmutable, __set_state)
 
 	php_date_instantiate(date_ce_immutable, return_value TSRMLS_CC);
 	dateobj = (php_date_obj *) zend_object_store_get_object(return_value TSRMLS_CC);
-	if (!php_date_initialize_from_hash(&return_value, &dateobj, myht TSRMLS_CC)) {
+	if (!php_date_initialize_from_hash(&dateobj, myht TSRMLS_CC)) {
 		php_error(E_ERROR, "Invalid serialization data for DateTimeImmutable object");
 	}
 }
@@ -2864,7 +2880,7 @@ PHP_METHOD(DateTime, __wakeup)
 
 	myht = Z_OBJPROP_P(object);
 
-	if (!php_date_initialize_from_hash(&return_value, &dateobj, myht TSRMLS_CC)) {
+	if (!php_date_initialize_from_hash(&dateobj, myht TSRMLS_CC)) {
 		php_error(E_ERROR, "Invalid serialization data for DateTime object");
 	}
 }
@@ -3807,7 +3823,7 @@ PHP_FUNCTION(timezone_name_from_abbr)
 }
 /* }}} */
 
-/* {{{ proto long timezone_offset_get(DateTimeZone object, DateTime object)
+/* {{{ proto long timezone_offset_get(DateTimeZone object, DateTimeInterface object)
    Returns the timezone offset.
 */
 PHP_FUNCTION(timezone_offset_get)
@@ -3817,13 +3833,13 @@ PHP_FUNCTION(timezone_offset_get)
 	php_date_obj        *dateobj;
 	timelib_time_offset *offset;
 
-	if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "OO", &object, date_ce_timezone, &dateobject, date_ce_date) == FAILURE) {
+	if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "OO", &object, date_ce_timezone, &dateobject, date_ce_interface) == FAILURE) {
 		RETURN_FALSE;
 	}
 	tzobj = (php_timezone_obj *) zend_object_store_get_object(object TSRMLS_CC);
 	DATE_CHECK_INITIALIZED(tzobj->initialized, DateTimeZone);
 	dateobj = (php_date_obj *) zend_object_store_get_object(dateobject TSRMLS_CC);
-	DATE_CHECK_INITIALIZED(dateobj->time, DateTime);
+	DATE_CHECK_INITIALIZED(dateobj->time, DateTimeInterface);
 
 	switch (tzobj->type) {
 		case TIMELIB_ZONETYPE_ID:

ext/date/tests/68062.phpt

@@ -0,0 +1,13 @@
+--TEST--
+DateTimeZone::getOffset() accepts a DateTimeInterface object
+--FILE--
+<?php
+
+$tz = new DateTimeZone('Europe/London');
+$dt = new DateTimeImmutable('2014-09-20', $tz);
+
+echo $tz->getOffset($dt);
+echo $tz->getOffset(1);
+--EXPECTF--
+3600
+Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTimeInterface, integer given in %s

ext/date/tests/DateTimeZone_getOffset_variation1.phpt

@@ -112,141 +112,141 @@ fclose( $file_handle );
 
 -- int 0 --
 
-Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTime, integer given in %s on line %d
+Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTimeInterface, integer given in %s on line %d
 bool(false)
 
 -- int 1 --
 
-Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTime, integer given in %s on line %d
+Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTimeInterface, integer given in %s on line %d
 bool(false)
 
 -- int 12345 --
 
-Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTime, integer given in %s on line %d
+Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTimeInterface, integer given in %s on line %d
 bool(false)
 
 -- int -12345 --
 
-Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTime, integer given in %s on line %d
+Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTimeInterface, integer given in %s on line %d
 bool(false)
 
 -- float 10.5 --
 
-Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTime, double given in %s on line %d
+Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTimeInterface, double given in %s on line %d
 bool(false)
 
 -- float -10.5 --
 
-Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTime, double given in %s on line %d
+Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTimeInterface, double given in %s on line %d
 bool(false)
 
 -- float .5 --
 
-Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTime, double given in %s on line %d
+Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTimeInterface, double given in %s on line %d
 bool(false)
 
 -- empty array --
 
-Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTime, array given in %s on line %d
+Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTimeInterface, array given in %s on line %d
 bool(false)
 
 -- int indexed array --
 
-Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTime, array given in %s on line %d
+Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTimeInterface, array given in %s on line %d
 bool(false)
 
 -- associative array --
 
-Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTime, array given in %s on line %d
+Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTimeInterface, array given in %s on line %d
 bool(false)
 
 -- nested arrays --
 
-Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTime, array given in %s on line %d
+Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTimeInterface, array given in %s on line %d
 bool(false)
 
 -- uppercase NULL --
 
-Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTime, null given in %s on line %d
+Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTimeInterface, null given in %s on line %d
 bool(false)
 
 -- lowercase null --
 
-Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTime, null given in %s on line %d
+Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTimeInterface, null given in %s on line %d
 bool(false)
 
 -- lowercase true --
 
-Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTime, boolean given in %s on line %d
+Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTimeInterface, boolean given in %s on line %d
 bool(false)
 
 -- lowercase false --
 
-Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTime, boolean given in %s on line %d
+Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTimeInterface, boolean given in %s on line %d
 bool(false)
 
 -- uppercase TRUE --
 
-Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTime, boolean given in %s on line %d
+Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTimeInterface, boolean given in %s on line %d
 bool(false)
 
 -- uppercase FALSE --
 
-Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTime, boolean given in %s on line %d
+Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTimeInterface, boolean given in %s on line %d
 bool(false)
 
 -- empty string DQ --
 
-Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTime, string given in %s on line %d
+Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTimeInterface, string given in %s on line %d
 bool(false)
 
 -- empty string SQ --
 
-Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTime, string given in %s on line %d
+Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTimeInterface, string given in %s on line %d
 bool(false)
 
 -- string DQ --
 
-Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTime, string given in %s on line %d
+Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTimeInterface, string given in %s on line %d
 bool(false)
 
 -- string SQ --
 
-Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTime, string given in %s on line %d
+Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTimeInterface, string given in %s on line %d
 bool(false)
 
 -- mixed case string --
 
-Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTime, string given in %s on line %d
+Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTimeInterface, string given in %s on line %d
 bool(false)
 
 -- heredoc --
 
-Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTime, string given in %s on line %d
+Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTimeInterface, string given in %s on line %d
 bool(false)
 
 -- instance of classWithToString --
 
-Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTime, object given in %s on line %d
+Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTimeInterface, object given in %s on line %d
 bool(false)
 
 -- instance of classWithoutToString --
 
-Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTime, object given in %s on line %d
+Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTimeInterface, object given in %s on line %d
 bool(false)
 
 -- undefined var --
 
-Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTime, null given in %s on line %d
+Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTimeInterface, null given in %s on line %d
 bool(false)
 
 -- unset var --
 
-Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTime, null given in %s on line %d
+Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTimeInterface, null given in %s on line %d
 bool(false)
 
 -- resource --
 
-Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTime, resource given in %s on line %d
+Warning: DateTimeZone::getOffset() expects parameter 1 to be DateTimeInterface, resource given in %s on line %d
 bool(false)
 ===DONE===

ext/date/tests/DateTime_setISODate_variation1.phpt

@@ -145,7 +145,7 @@ object(DateTime)#%d (3) {
 -- int -12345 --
 object(DateTime)#%d (3) {
   ["date"]=>
-  string(28) "-12345-02-15 08:34:10.000000"
+  string(28) "-12345-02-11 08:34:10.000000"
   ["timezone_type"]=>
   int(3)
   ["timezone"]=>
@@ -165,7 +165,7 @@ object(DateTime)#%d (3) {
 -- float -10.5 --
 object(DateTime)#%d (3) {
   ["date"]=>
-  string(27) "-0010-02-19 08:34:10.000000"
+  string(27) "-0010-02-14 08:34:10.000000"
   ["timezone_type"]=>
   int(3)
   ["timezone"]=>

ext/date/tests/bug20382-2.phpt

@@ -95,18 +95,18 @@ result = Monday 2037-10-05 00:00:00 NZDT
 wanted = Monday            00:00:00
 
 Australia/Adelaide
-ts     = Friday 1971-01-01 17:17:17 CST
-result = Monday 1971-01-04 00:00:00 CST
+ts     = Friday 1971-01-01 17:17:17 ACST
+result = Monday 1971-01-04 00:00:00 ACST
 wanted = Monday            00:00:00
 
 Australia/Darwin
-ts     = Monday 1971-03-29 17:17:17 CST
-result = Monday 1971-04-05 00:00:00 CST
+ts     = Monday 1971-03-29 17:17:17 ACST
+result = Monday 1971-04-05 00:00:00 ACST
 wanted = Monday            00:00:00
 
 Australia/Perth
-ts     = Friday 1971-01-01 17:17:17 WST
-result = Monday 1971-01-04 00:00:00 WST
+ts     = Friday 1971-01-01 17:17:17 AWST
+result = Monday 1971-01-04 00:00:00 AWST
 wanted = Monday            00:00:00
 
 America/Aruba

ext/date/tests/bug33415-2.phpt

@@ -233,8 +233,8 @@ result=Saturday 1970-01-03 00:00:00 CAT 0
 wanted=Saturday            00:00:00
 
 TZ=Asia/Kashgar - Is it OK for this to be 3 AM? yes
-tStamp=Thursday 1980-04-24 17:17:17 KAST 0
-result=Thursday 1980-05-01 03:00:00 CST 0
+tStamp=Thursday 1980-04-24 17:17:17 XJT 0
+result=Thursday 1980-05-01 00:00:00 XJT 0
 wanted=Thursday            03:00:00
 
 TZ=Indian/Christmas - Is it OK for this to be 7 AM?  Note: does

ext/date/tests/bug33532.phpt

@@ -39,5 +39,5 @@ datestr  10:00:00 AM July 1 2005 UTC
 
 Setting TZ
 input    10:00:00 AM July 1 2005
-strftime 10:00:00 AM July 1 2005 EST +1000
-datestr  10:00:00 AM July 1 2005 EST
+strftime 10:00:00 AM July 1 2005 AEST +1000
+datestr  10:00:00 AM July 1 2005 AEST

ext/date/tests/bug49585.phpt

@@ -10,7 +10,8 @@ var_dump($date->format('r'));
 $date->setDate(-2147483648, 1, 1);
 var_dump($date->format('r'));
 var_dump($date->format('c'));
+?>
 --EXPECT--
-string(32) "Sat, 01 Jan -1500 00:00:00 +0000"
-string(42) "Unknown, 01 Jan -2147483648 00:00:00 +0000"
+string(32) "Fri, 01 Jan -1500 00:00:00 +0000"
+string(38) "Mon, 01 Jan -2147483648 00:00:00 +0000"
 string(32) "-2147483648-01-01T00:00:00+00:00"

ext/date/tests/bug51866.phpt

@@ -44,7 +44,7 @@ array(4) {
 
 string(6) "Y-m-d+"
 string(19) "2001-11-29 13:20:01"
-object(DateTime)#2 (3) {
+object(DateTime)#%d (3) {
   ["date"]=>
   string(26) "2001-11-29 %d:%d:%d.%d"
   ["timezone_type"]=>
@@ -70,7 +70,7 @@ array(4) {
 
 string(7) "Y-m-d +"
 string(19) "2001-11-29 13:20:01"
-object(DateTime)#3 (3) {
+object(DateTime)#%d (3) {
   ["date"]=>
   string(26) "2001-11-29 %d:%d:%d.%d"
   ["timezone_type"]=>
@@ -96,7 +96,7 @@ array(4) {
 
 string(6) "Y-m-d+"
 string(10) "2001-11-29"
-object(DateTime)#2 (3) {
+object(DateTime)#%d (3) {
   ["date"]=>
   string(26) "2001-11-29 %d:%d:%d.%d"
   ["timezone_type"]=>
@@ -139,7 +139,7 @@ array(4) {
 
 string(7) "Y-m-d +"
 string(11) "2001-11-29 "
-object(DateTime)#2 (3) {
+object(DateTime)#%d (3) {
   ["date"]=>
   string(26) "2001-11-29 %d:%d:%d.%d"
   ["timezone_type"]=>

ext/date/tests/bug66985.phpt

@@ -0,0 +1,175 @@
+--TEST--
+Bug #66986 (Some timezones are no longer valid in PHP 5.5.10)
+--FILE--
+<?php
+$zones = array(
+	"CST6CDT", "Cuba", "Egypt", "Eire", "EST5EDT", "Factory", "GB-Eire",
+	"GMT0", "Greenwich", "Hongkong", "Iceland", "Iran", "Israel", "Jamaica",
+	"Japan", "Kwajalein", "Libya", "MST7MDT", "Navajo", "NZ-CHAT", "Poland",
+	"Portugal", "PST8PDT", "Singapore", "Turkey", "Universal", "W-SU",
+
+	"UTC", "GMT", "GMT+0100", "-0230",
+);
+
+foreach ( $zones as $zone )
+{
+	$d = new DateTimeZone( $zone );
+	print_r($d);
+}
+?>
+--EXPECT--
+DateTimeZone Object
+(
+    [timezone_type] => 3
+    [timezone] => CST6CDT
+)
+DateTimeZone Object
+(
+    [timezone_type] => 3
+    [timezone] => Cuba
+)
+DateTimeZone Object
+(
+    [timezone_type] => 3
+    [timezone] => Egypt
+)
+DateTimeZone Object
+(
+    [timezone_type] => 3
+    [timezone] => Eire
+)
+DateTimeZone Object
+(
+    [timezone_type] => 3
+    [timezone] => EST5EDT
+)
+DateTimeZone Object
+(
+    [timezone_type] => 3
+    [timezone] => Factory
+)
+DateTimeZone Object
+(
+    [timezone_type] => 3
+    [timezone] => GB-Eire
+)
+DateTimeZone Object
+(
+    [timezone_type] => 3
+    [timezone] => GMT0
+)
+DateTimeZone Object
+(
+    [timezone_type] => 3
+    [timezone] => Greenwich
+)
+DateTimeZone Object
+(
+    [timezone_type] => 3
+    [timezone] => Hongkong
+)
+DateTimeZone Object
+(
+    [timezone_type] => 3
+    [timezone] => Iceland
+)
+DateTimeZone Object
+(
+    [timezone_type] => 3
+    [timezone] => Iran
+)
+DateTimeZone Object
+(
+    [timezone_type] => 3
+    [timezone] => Israel
+)
+DateTimeZone Object
+(
+    [timezone_type] => 3
+    [timezone] => Jamaica
+)
+DateTimeZone Object
+(
+    [timezone_type] => 3
+    [timezone] => Japan
+)
+DateTimeZone Object
+(
+    [timezone_type] => 3
+    [timezone] => Kwajalein
+)
+DateTimeZone Object
+(
+    [timezone_type] => 3
+    [timezone] => Libya
+)
+DateTimeZone Object
+(
+    [timezone_type] => 3
+    [timezone] => MST7MDT
+)
+DateTimeZone Object
+(
+    [timezone_type] => 3
+    [timezone] => Navajo
+)
+DateTimeZone Object
+(
+    [timezone_type] => 3
+    [timezone] => NZ-CHAT
+)
+DateTimeZone Object
+(
+    [timezone_type] => 3
+    [timezone] => Poland
+)
+DateTimeZone Object
+(
+    [timezone_type] => 3
+    [timezone] => Portugal
+)
+DateTimeZone Object
+(
+    [timezone_type] => 3
+    [timezone] => PST8PDT
+)
+DateTimeZone Object
+(
+    [timezone_type] => 3
+    [timezone] => Singapore
+)
+DateTimeZone Object
+(
+    [timezone_type] => 3
+    [timezone] => Turkey
+)
+DateTimeZone Object
+(
+    [timezone_type] => 3
+    [timezone] => Universal
+)
+DateTimeZone Object
+(
+    [timezone_type] => 3
+    [timezone] => W-SU
+)
+DateTimeZone Object
+(
+    [timezone_type] => 3
+    [timezone] => UTC
+)
+DateTimeZone Object
+(
+    [timezone_type] => 2
+    [timezone] => GMT
+)
+DateTimeZone Object
+(
+    [timezone_type] => 1
+    [timezone] => +01:00
+)
+DateTimeZone Object
+(
+    [timezone_type] => 1
+    [timezone] => -02:30
+)

ext/date/tests/bug67109.phpt

@@ -0,0 +1,14 @@
+--TEST--
+Bug #67109 (First uppercase letter breaks date string parsing)
+--INI--
+date.timezone=UTC
+--FILE--
+<?php
+var_dump(date('d.m.Y',strtotime('last day of april')));
+var_dump(date('d.m.Y',strtotime('Last day of april')));
+var_dump(date('d.m.Y',strtotime('lAst Day of April')));
+?>
+--EXPECTF--
+string(10) "30.04.%d"
+string(10) "30.04.%d"
+string(10) "30.04.%d"

ext/date/tests/date_interval_create_from_date_string.phpt

@@ -0,0 +1,34 @@
+--TEST--
+Test date_interval_create_from_date_string() function : basic functionality 
+--CREDITS--
+Rodrigo Prado de Jesus <royopa [at] gmail [dot] com>
+--FILE--
+<?php
+$string = '1 day'; //P1D
+$i = date_interval_create_from_date_string($string);
+var_dump($i->d);
+
+$string = '2 weeks'; //14 days
+$i = date_interval_create_from_date_string($string);
+var_dump($i->d);
+
+$string = '3 months';
+$i = date_interval_create_from_date_string($string);
+var_dump($i->m);
+
+$string = '4 years';
+$i = date_interval_create_from_date_string($string);
+var_dump($i->y);
+
+$string = '1 year + 1 day';
+$i = date_interval_create_from_date_string($string);
+var_dump($i->y);
+var_dump($i->d);
+?>
+--EXPECTF--
+int(1)
+int(14)
+int(3)
+int(4)
+int(1)
+int(1)

ext/date/tests/date_interval_create_from_date_string_nullparam.phpt

@@ -0,0 +1,42 @@
+--TEST--
+Test date_interval_create_from_date_string() function : null parameter 
+--CREDITS--
+Rodrigo Prado de Jesus <royopa [at] gmail [dot] com>
+--FILE--
+<?php
+$i = date_interval_create_from_date_string(null); //returns a empty object
+var_dump($i);
+?>
+--EXPECTF--
+object(DateInterval)#1 (15) {
+  ["y"]=>
+  int(0)
+  ["m"]=>
+  int(0)
+  ["d"]=>
+  int(0)
+  ["h"]=>
+  int(0)
+  ["i"]=>
+  int(0)
+  ["s"]=>
+  int(0)
+  ["weekday"]=>
+  int(0)
+  ["weekday_behavior"]=>
+  int(0)
+  ["first_last_day_of"]=>
+  int(0)
+  ["invert"]=>
+  int(0)
+  ["days"]=>
+  int(0)
+  ["special_type"]=>
+  int(0)
+  ["special_amount"]=>
+  int(0)
+  ["have_weekday_relative"]=>
+  int(0)
+  ["have_special_relative"]=>
+  int(0)
+}

ext/date/tests/date_interval_create_from_date_string_wrongparam_001.phpt

@@ -0,0 +1,11 @@
+--TEST--
+Test date_interval_create_from_date_string() function : wrong parameter (array)
+--CREDITS--
+Rodrigo Prado de Jesus <royopa [at] gmail [dot] com>
+--FILE--
+<?php
+$wrong_parameter = array();
+$i = date_interval_create_from_date_string($wrong_parameter);
+?>
+--EXPECTF--
+Warning: date_interval_create_from_date_string() expects parameter 1 to be string, array given in %s on line %d

ext/date/tests/date_interval_create_from_date_string_wrongparam_002.phpt

@@ -0,0 +1,9 @@
+--TEST--
+Test date_interval_create_from_date_string() function : with 2 parameters (wrong).
+Rodrigo Prado de Jesus <royopa [at] gmail [dot] com>
+--FILE--
+<?php
+$i = date_interval_create_from_date_string('1 year', 'wrong');
+?>
+--EXPECTF--
+Warning: date_interval_create_from_date_string() expects exactly 1 parameter, 2 given in %s on line %d

ext/date/tests/date_isodate_set_variation2.phpt

@@ -145,7 +145,7 @@ object(DateTime)#%d (3) {
 -- int -12345 --
 object(DateTime)#%d (3) {
   ["date"]=>
-  string(28) "-12345-02-15 08:34:10.000000"
+  string(28) "-12345-02-11 08:34:10.000000"
   ["timezone_type"]=>
   int(3)
   ["timezone"]=>
@@ -165,7 +165,7 @@ object(DateTime)#%d (3) {
 -- float -10.5 --
 object(DateTime)#%d (3) {
   ["date"]=>
-  string(27) "-0010-02-19 08:34:10.000000"
+  string(27) "-0010-02-14 08:34:10.000000"
   ["timezone_type"]=>
   int(3)
   ["timezone"]=>

ext/date/tests/date_timestamp_set.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Test the basics to function date_timestamp_set().
+--CREDITS--
+Rodrigo Prado de Jesus <royopa [at] gmail [dot] com>
+--INI--
+date.timezone = UTC;
+date_default_timezone_set("America/Sao_Paulo"); 
+--FILE--
+<?php
+$dftz021 = date_default_timezone_get(); //UTC
+
+$dtms021 = date_create(); 
+
+date_timestamp_set($dtms021, 1234567890); 
+
+var_dump(date_format($dtms021, 'B => (U) => T Y-M-d H:i:s'));
+?>
+--EXPECTF--
+string(47) "021 => (1234567890) => UTC 2009-Feb-13 23:31:30"

ext/date/tests/date_timestamp_set_nullparam.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Test the function date_timestamp_set() with first null parameter.
+--CREDITS--
+Rodrigo Prado de Jesus <royopa [at] gmail [dot] com>
+--INI--
+date.timezone = UTC;
+date_default_timezone_set("America/Sao_Paulo"); 
+--FILE--
+<?php
+$dftz021 = date_default_timezone_get(); //UTC
+
+$dtms021 = date_create(); 
+
+date_timestamp_set(null, 1234567890); 
+?>
+--EXPECTF--
+Warning: date_timestamp_set() expects parameter 1 to be DateTime, null given in %s on line %d

ext/date/tests/date_timestamp_set_nullparam2.phpt

@@ -0,0 +1,24 @@
+--TEST--
+Test the function date_timestamp_set() with second null parameter.
+--CREDITS--
+Rodrigo Prado de Jesus <royopa [at] gmail [dot] com>
+--INI--
+date.timezone = UTC;
+date_default_timezone_set("America/Sao_Paulo"); 
+--FILE--
+<?php
+$dftz021 = date_default_timezone_get(); //UTC
+
+$dtms021 = date_create(); 
+
+var_dump(date_timestamp_set($dtms021, null));
+?>
+--EXPECTF--
+object(DateTime)#1 (3) {
+  ["date"]=>
+  string(26) "1970-01-01 00:00:00.000000"
+  ["timezone_type"]=>
+  int(3)
+  ["timezone"]=>
+  string(3) "UTC"
+}

ext/date/tests/date_timestamp_set_wrongparam_001.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Check the function date_timestamp_set() with first parameter wrong (array).
+--CREDITS--
+Rodrigo Prado de Jesus <royopa [at] gmail [dot] com>
+--INI--
+date.timezone = UTC;
+date_default_timezone_set("America/Sao_Paulo"); 
+--FILE--
+<?php
+$dftz021 = date_default_timezone_get(); //UTC
+
+$dtms021 = array(); 
+
+date_timestamp_set($dtms021, 123456789);
+?>
+--EXPECTF--
+Warning: date_timestamp_set() expects parameter 1 to be DateTime, array given in %s on line %d

ext/date/tests/date_timestamp_set_wrongparam_002.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Check the function date_timestamp_set() with first parameter wrong (integer).
+--CREDITS--
+Rodrigo Prado de Jesus <royopa [at] gmail [dot] com>
+--INI--
+date.timezone = UTC;
+date_default_timezone_set("America/Sao_Paulo"); 
+--FILE--
+<?php
+$dftz021 = date_default_timezone_get(); //UTC
+
+date_timestamp_set(987654321, 123456789);
+?>
+--EXPECTF--
+Warning: date_timestamp_set() expects parameter 1 to be DateTime, integer given in %s on line %d

ext/date/tests/date_timestamp_set_wrongparam_003.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Check the function date_timestamp_set() with second parameter wrong (array).
+--CREDITS--
+Rodrigo Prado de Jesus <royopa [at] gmail [dot] com>
+--INI--
+date.timezone = UTC;
+date_default_timezone_set("America/Sao_Paulo"); 
+--FILE--
+<?php
+$dftz021 = date_default_timezone_get(); //UTC
+
+$dtms021 = new DateTime(); 
+
+$wrong_parameter = array();
+
+date_timestamp_set($dtms021, $wrong_parameter);
+?>
+--EXPECTF--
+Warning: date_timestamp_set() expects parameter 2 to be long, array given in %s on line %d

ext/date/tests/date_timestamp_set_wrongparam_004.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Check the function date_timestamp_set() with 3 parameters.
+--CREDITS--
+Rodrigo Prado de Jesus <royopa [at] gmail [dot] com>
+--INI--
+date.timezone = UTC;
+date_default_timezone_set("America/Sao_Paulo"); 
+--FILE--
+<?php
+$dftz021 = date_default_timezone_get(); //UTC
+
+$dtms021 = new DateTime(); 
+
+date_timestamp_set($dtms021, 123456789, 'error');
+?>
+--EXPECTF--
+Warning: date_timestamp_set() expects exactly 2 parameters, 3 given in %s on line %d

ext/date/tests/getdate_variation7.phpt

@@ -61,7 +61,7 @@ array\(11\) {
   \["mday"\]=>
   int\((9|14|23)\)
   \["wday"\]=>
-  int\((6|-4)\)
+  int\(0\)
   \["mon"\]=>
   int\((10|12)\)
   \["year"\]=>
@@ -69,7 +69,7 @@ array\(11\) {
   \["yday"\]=>
   int\((282|347|295)\)
   \["weekday"\]=>
-  string\((8|7)\) "(Saturday|Unknown)"
+  string\(6\) "Sunday"
   \["month"\]=>
   string\((7|8)\) "(October|December)"
   \[0\]=>

ext/date/tests/localtime_variation3.phpt

@@ -87,7 +87,7 @@ array\(9\) {
   \[5\]=>
   int\((104|1|-3843)\)
   \[6\]=>
-  int\((5|-5)\)
+  int\(6\)
   \[7\]=>
   int\((281|346|294)\)
   \[8\]=>
@@ -107,7 +107,7 @@ array\(9\) {
   \["tm_year"\]=>
   int\((104|1|-3843)\)
   \["tm_wday"\]=>
-  int\((5|-5)\)
+  int\(6\)
   \["tm_yday"\]=>
   int\((281|346|294)\)
   \["tm_isdst"\]=>

ext/date/tests/timezone_offset_get_error.phpt

@@ -73,12 +73,12 @@ bool(false)
 
 -- Testing timezone_offset_get() function with an invalid values for $datetime argument --
 
-Warning: timezone_offset_get() expects parameter 2 to be DateTime, object given in %s on line %d
+Warning: timezone_offset_get() expects parameter 2 to be DateTimeInterface, object given in %s on line %d
 bool(false)
 
-Warning: timezone_offset_get() expects parameter 2 to be DateTime, integer given in %s on line %d
+Warning: timezone_offset_get() expects parameter 2 to be DateTimeInterface, integer given in %s on line %d
 bool(false)
 
-Warning: timezone_offset_get() expects parameter 2 to be DateTime, null given in %s on line %d
+Warning: timezone_offset_get() expects parameter 2 to be DateTimeInterface, null given in %s on line %d
 bool(false)
 ===DONE===

ext/date/tests/timezone_offset_get_variation2.phpt

@@ -112,141 +112,141 @@ fclose( $file_handle );
 
 -- int 0 --
 
-Warning: timezone_offset_get() expects parameter 2 to be DateTime, integer given in %s on line %d
+Warning: timezone_offset_get() expects parameter 2 to be DateTimeInterface, integer given in %s on line %d
 bool(false)
 
 -- int 1 --
 
-Warning: timezone_offset_get() expects parameter 2 to be DateTime, integer given in %s on line %d
+Warning: timezone_offset_get() expects parameter 2 to be DateTimeInterface, integer given in %s on line %d
 bool(false)
 
 -- int 12345 --
 
-Warning: timezone_offset_get() expects parameter 2 to be DateTime, integer given in %s on line %d
+Warning: timezone_offset_get() expects parameter 2 to be DateTimeInterface, integer given in %s on line %d
 bool(false)
 
 -- int -12345 --
 
-Warning: timezone_offset_get() expects parameter 2 to be DateTime, integer given in %s on line %d
+Warning: timezone_offset_get() expects parameter 2 to be DateTimeInterface, integer given in %s on line %d
 bool(false)
 
 -- float 10.5 --
 
-Warning: timezone_offset_get() expects parameter 2 to be DateTime, double given in %s on line %d
+Warning: timezone_offset_get() expects parameter 2 to be DateTimeInterface, double given in %s on line %d
 bool(false)
 
 -- float -10.5 --
 
-Warning: timezone_offset_get() expects parameter 2 to be DateTime, double given in %s on line %d
+Warning: timezone_offset_get() expects parameter 2 to be DateTimeInterface, double given in %s on line %d
 bool(false)
 
 -- float .5 --
 
-Warning: timezone_offset_get() expects parameter 2 to be DateTime, double given in %s on line %d
+Warning: timezone_offset_get() expects parameter 2 to be DateTimeInterface, double given in %s on line %d
 bool(false)
 
 -- empty array --
 
-Warning: timezone_offset_get() expects parameter 2 to be DateTime, array given in %s on line %d
+Warning: timezone_offset_get() expects parameter 2 to be DateTimeInterface, array given in %s on line %d
 bool(false)
 
 -- int indexed array --
 
-Warning: timezone_offset_get() expects parameter 2 to be DateTime, array given in %s on line %d
+Warning: timezone_offset_get() expects parameter 2 to be DateTimeInterface, array given in %s on line %d
 bool(false)
 
 -- associative array --
 
-Warning: timezone_offset_get() expects parameter 2 to be DateTime, array given in %s on line %d
+Warning: timezone_offset_get() expects parameter 2 to be DateTimeInterface, array given in %s on line %d
 bool(false)
 
 -- nested arrays --
 
-Warning: timezone_offset_get() expects parameter 2 to be DateTime, array given in %s on line %d
+Warning: timezone_offset_get() expects parameter 2 to be DateTimeInterface, array given in %s on line %d
 bool(false)
 
 -- uppercase NULL --
 
-Warning: timezone_offset_get() expects parameter 2 to be DateTime, null given in %s on line %d
+Warning: timezone_offset_get() expects parameter 2 to be DateTimeInterface, null given in %s on line %d
 bool(false)
 
 -- lowercase null --
 
-Warning: timezone_offset_get() expects parameter 2 to be DateTime, null given in %s on line %d
+Warning: timezone_offset_get() expects parameter 2 to be DateTimeInterface, null given in %s on line %d
 bool(false)
 
 -- lowercase true --
 
-Warning: timezone_offset_get() expects parameter 2 to be DateTime, boolean given in %s on line %d
+Warning: timezone_offset_get() expects parameter 2 to be DateTimeInterface, boolean given in %s on line %d
 bool(false)
 
 -- lowercase false --
 
-Warning: timezone_offset_get() expects parameter 2 to be DateTime, boolean given in %s on line %d
+Warning: timezone_offset_get() expects parameter 2 to be DateTimeInterface, boolean given in %s on line %d
 bool(false)
 
 -- uppercase TRUE --
 
-Warning: timezone_offset_get() expects parameter 2 to be DateTime, boolean given in %s on line %d
+Warning: timezone_offset_get() expects parameter 2 to be DateTimeInterface, boolean given in %s on line %d
 bool(false)
 
 -- uppercase FALSE --
 
-Warning: timezone_offset_get() expects parameter 2 to be DateTime, boolean given in %s on line %d
+Warning: timezone_offset_get() expects parameter 2 to be DateTimeInterface, boolean given in %s on line %d
 bool(false)
 
 -- empty string DQ --
 
-Warning: timezone_offset_get() expects parameter 2 to be DateTime, string given in %s on line %d
+Warning: timezone_offset_get() expects parameter 2 to be DateTimeInterface, string given in %s on line %d
 bool(false)
 
 -- empty string SQ --
 
-Warning: timezone_offset_get() expects parameter 2 to be DateTime, string given in %s on line %d
+Warning: timezone_offset_get() expects parameter 2 to be DateTimeInterface, string given in %s on line %d
 bool(false)
 
 -- string DQ --
 
-Warning: timezone_offset_get() expects parameter 2 to be DateTime, string given in %s on line %d
+Warning: timezone_offset_get() expects parameter 2 to be DateTimeInterface, string given in %s on line %d
 bool(false)
 
 -- string SQ --
 
-Warning: timezone_offset_get() expects parameter 2 to be DateTime, string given in %s on line %d
+Warning: timezone_offset_get() expects parameter 2 to be DateTimeInterface, string given in %s on line %d
 bool(false)
 
 -- mixed case string --
 
-Warning: timezone_offset_get() expects parameter 2 to be DateTime, string given in %s on line %d
+Warning: timezone_offset_get() expects parameter 2 to be DateTimeInterface, string given in %s on line %d
 bool(false)
 
 -- heredoc --
 
-Warning: timezone_offset_get() expects parameter 2 to be DateTime, string given in %s on line %d
+Warning: timezone_offset_get() expects parameter 2 to be DateTimeInterface, string given in %s on line %d
 bool(false)
 
 -- instance of classWithToString --
 
-Warning: timezone_offset_get() expects parameter 2 to be DateTime, object given in %s on line %d
+Warning: timezone_offset_get() expects parameter 2 to be DateTimeInterface, object given in %s on line %d
 bool(false)
 
 -- instance of classWithoutToString --
 
-Warning: timezone_offset_get() expects parameter 2 to be DateTime, object given in %s on line %d
+Warning: timezone_offset_get() expects parameter 2 to be DateTimeInterface, object given in %s on line %d
 bool(false)
 
 -- undefined var --
 
-Warning: timezone_offset_get() expects parameter 2 to be DateTime, null given in %s on line %d
+Warning: timezone_offset_get() expects parameter 2 to be DateTimeInterface, null given in %s on line %d
 bool(false)
 
 -- unset var --
 
-Warning: timezone_offset_get() expects parameter 2 to be DateTime, null given in %s on line %d
+Warning: timezone_offset_get() expects parameter 2 to be DateTimeInterface, null given in %s on line %d
 bool(false)
 
 -- resource --
 
-Warning: timezone_offset_get() expects parameter 2 to be DateTime, resource given in %s on line %d
+Warning: timezone_offset_get() expects parameter 2 to be DateTimeInterface, resource given in %s on line %d
 bool(false)
 ===DONE===

ext/date/tests/timezone_version_get.phpt

@@ -0,0 +1,13 @@
+--TEST--
+Test the basics to function timezone_version_get().
+--CREDITS--
+Rodrigo Prado de Jesus <royopa [at] gmail [dot] com>
+--INI--
+date.timezone = UTC;
+date_default_timezone_set("America/Sao_Paulo"); 
+--FILE--
+<?php
+var_dump(timezone_version_get());
+?>
+--EXPECTREGEX--
+string\([6-7]\) \"20[0-9][0-9]\.[1-9][0-9]?\"

ext/date/tests/timezone_version_get_basic1.phpt

@@ -0,0 +1,12 @@
+--TEST--
+timezone_version_get: Test that timezone_location_get returns a date concatenated with a dot and a version number 
+--CREDITS--
+Rodrigo Wanderley de Melo Cardoso <rodrigogepem@gmail.com>
+#PHPTestFest2014 São Paulo 2014-07-05
+--INI--
+date.timezone=UTC
+--FILE--
+<?php $versionTimezone = timezone_version_get(); 
+echo $versionTimezone; ?>
+--EXPECTREGEX--
+^[12][0-9]{3}.[0-9]+$

ext/dom/php_dom.c

@@ -518,7 +518,7 @@ static HashTable* dom_get_debug_info_helper(zval *object, int *is_temp TSRMLS_DC
 			value = null_value;
 		} else if (Z_TYPE_P(value) == IS_OBJECT) {
 			/* these are zvalues create on demand, with refcount and is_ref
-			 * status left in an uninitalized stated */
+			 * status left in an uninitialized stated */
 			zval_dtor(value);
 			efree(value);
 

ext/ereg/tests/eregi_basic.phpt

@@ -9,7 +9,7 @@ Test eregi() function : basic functionality - confirm case insensitivity
  */
 
 /*
- * Test basic funtionality of eregi()
+ * Test basic functionality of eregi()
  */
 
 echo "*** Testing eregi() : basic functionality ***\n";

ext/exif/exif.c

@@ -2426,11 +2426,11 @@ static void* exif_ifd_make_value(image_info_data *info_data, int motorola_intel
 					data_ptr += 8;
 					break;
 				case TAG_FMT_SINGLE:
-					memmove(data_ptr, &info_data->value.f, byte_count);
+					memmove(data_ptr, &info_value->f, 4);
 					data_ptr += 4;
 					break;
 				case TAG_FMT_DOUBLE:
-					memmove(data_ptr, &info_data->value.d, byte_count);
+					memmove(data_ptr, &info_value->d, 8);
 					data_ptr += 8;
 					break;
 			}

ext/exif/tests/bug68113.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Bug #68113 (Heap corruption in exif_thumbnail())
+--SKIPIF--
+<?php
+extension_loaded("exif") or die("skip need exif");
+?>
+--FILE--
+<?php
+var_dump(exif_thumbnail(__DIR__."/bug68113.jpg"));
+?>
+Done
+--EXPECTF--
+Warning: exif_thumbnail(bug68113.jpg): File structure corrupted in %s%ebug68113.php on line 2
+
+Warning: exif_thumbnail(bug68113.jpg): Invalid JPEG file in %s%ebug68113.php on line 2
+bool(false)
+Done

ext/ext_skel

@@ -156,12 +156,12 @@ if test "\$PHP_$EXTNAME" != "no"; then
 
   dnl PHP_CHECK_LIBRARY(\$LIBNAME,\$LIBSYMBOL,
   dnl [
-  dnl   PHP_ADD_LIBRARY_WITH_PATH(\$LIBNAME, \$${EXTNAME}_DIR/lib, ${EXTNAME}_SHARED_LIBADD)
+  dnl   PHP_ADD_LIBRARY_WITH_PATH(\$LIBNAME, \$${EXTNAME}_DIR/\$PHP_LIBDIR, ${EXTNAME}_SHARED_LIBADD)
   dnl   AC_DEFINE(HAVE_${EXTNAME}LIB,1,[ ])
   dnl ],[
   dnl   AC_MSG_ERROR([wrong $extname lib version or lib not found])
   dnl ],[
-  dnl   -L\$${EXTNAME}_DIR/lib -lm
+  dnl   -L\$${EXTNAME}_DIR/\$PHP_LIBDIR -lm
   dnl ])
   dnl
   dnl PHP_SUBST(${EXTNAME}_SHARED_LIBADD)

ext/fileinfo/data_file.c

@@ -115198,7 +115198,7 @@ const unsigned char php_magic_database[2606480] = {
 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
 0x00, 0x00, 0x40, 0x00, 0x3D, 0x1B, 0x11, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
-0x00, 0x00, 0x00, 0x00, 0x34, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
+0x00, 0x00, 0x00, 0x00, 0x34, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
 0x5E, 0x5C, 0x73, 0x7B, 0x30, 0x2C, 0x31, 0x30, 0x30, 0x7D, 0x42, 0x45, 0x47, 0x49, 0x4E, 0x5C, 
 0x73, 0x7B, 0x30, 0x2C, 0x31, 0x30, 0x30, 0x7D, 0x5B, 0x7B, 0x5D, 0x00, 0x00, 0x00, 0x00, 0x00, 
 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 

ext/fileinfo/libmagic.patch

@@ -1,6 +1,6 @@
 diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 --- libmagic.orig/apprentice.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/apprentice.c	Mon Apr 14 23:42:51 2014
++++ libmagic/apprentice.c	Mon Sep 29 10:53:07 2014
 @@ -29,6 +29,8 @@
   * apprentice - make one pass through /etc/magic, learning its secrets.
   */
@@ -479,6 +479,15 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  		return NULL;
  	}
  	return map;
+@@ -1233,7 +1269,7 @@
+ 		 * the sign extension must have happened.
+ 		 */
+ 		case FILE_BYTE:
+-			v = (char) v;
++			v = (signed char) v;
+ 			break;
+ 		case FILE_SHORT:
+ 		case FILE_BESHORT:
 @@ -1500,7 +1536,7 @@
  		if (me->cont_count == me->max_count) {
  			struct magic *nm;
@@ -833,7 +842,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  	}
 diff -u libmagic.orig/ascmagic.c libmagic/ascmagic.c
 --- libmagic.orig/ascmagic.c	Wed Oct 31 18:03:01 2012
-+++ libmagic/ascmagic.c	Mon Apr 14 23:42:51 2014
++++ libmagic/ascmagic.c	Mon Mar 10 16:40:55 2014
 @@ -139,7 +139,7 @@
  		/* malloc size is a conservative overestimate; could be
  		   improved, or at least realloced after conversion. */
@@ -872,7 +881,7 @@ diff -u libmagic.orig/ascmagic.c libmagic/ascmagic.c
  }
 diff -u libmagic.orig/cdf.c libmagic/cdf.c
 --- libmagic.orig/cdf.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/cdf.c	Tue Jul  1 09:00:09 2014
++++ libmagic/cdf.c	Wed Aug 20 21:20:34 2014
 @@ -43,7 +43,17 @@
  #include <err.h>
  #endif
@@ -955,7 +964,7 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
  			errno = EFTYPE;
  			return (size_t)-1;
  		}
-@@ -796,7 +812,11 @@
+@@ -796,11 +812,15 @@
  	if (cdf_check_stream_offset(sst, h, e, 0, __LINE__) == -1)
  		goto out;
  	for (i = 0; i < sh.sh_properties; i++) {
@@ -968,6 +977,11 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
  		q = (const uint8_t *)(const void *)
  		    ((const char *)(const void *)p + ofs
  		    - 2 * sizeof(uint32_t));
+-		if (q > e) {
++		if (q < p || q > e) {
+ 			DPRINTF(("Ran of the end %p > %p\n", q, e));
+ 			goto out;
+ 		}
 @@ -810,6 +830,10 @@
  		    i, inp[i].pi_id, inp[i].pi_type, q - p, offs));
  		if (inp[i].pi_type & CDF_VECTOR) {
@@ -1056,7 +1070,7 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
  			} else {
 diff -u libmagic.orig/cdf.h libmagic/cdf.h
 --- libmagic.orig/cdf.h	Wed Oct 31 18:03:01 2012
-+++ libmagic/cdf.h	Mon Apr 14 23:32:55 2014
++++ libmagic/cdf.h	Mon Dec  2 15:25:29 2013
 @@ -35,10 +35,12 @@
  #ifndef _H_CDF_
  #define _H_CDF_
@@ -1099,7 +1113,7 @@ diff -u libmagic.orig/cdf.h libmagic/cdf.h
  void cdf_unpack_header(cdf_header_t *, char *);
 diff -u libmagic.orig/cdf_time.c libmagic/cdf_time.c
 --- libmagic.orig/cdf_time.c	Wed Oct 31 18:03:01 2012
-+++ libmagic/cdf_time.c	Mon Apr 14 23:32:55 2014
++++ libmagic/cdf_time.c	Mon Dec  2 15:25:29 2013
 @@ -96,7 +96,7 @@
  }
  
@@ -1159,7 +1173,7 @@ diff -u libmagic.orig/cdf_time.c libmagic/cdf_time.c
  	static const char *ref = "Sat Apr 23 01:30:00 1977";
 diff -u libmagic.orig/compress.c libmagic/compress.c
 --- libmagic.orig/compress.c	Sun Jan  6 21:35:43 2013
-+++ libmagic/compress.c	Mon Apr 14 23:42:51 2014
++++ libmagic/compress.c	Mon Dec  2 15:25:29 2013
 @@ -32,6 +32,7 @@
   *	uncompress(method, old, n, newch) - uncompress old into new, 
   *					    using method, return sizeof new
@@ -1322,7 +1336,7 @@ diff -u libmagic.orig/compress.c libmagic/compress.c
 +#endif /* if PHP_FILEINFO_UNCOMPRESS */
 diff -u libmagic.orig/file.h libmagic/file.h
 --- libmagic.orig/file.h	Mon Feb 18 16:40:59 2013
-+++ libmagic/file.h	Mon Apr 14 23:42:51 2014
++++ libmagic/file.h	Mon Mar 10 16:40:55 2014
 @@ -33,11 +33,9 @@
  #ifndef __file_h__
  #define __file_h__
@@ -1532,7 +1546,7 @@ diff -u libmagic.orig/file.h libmagic/file.h
  #endif /* __file_h__ */
 diff -u libmagic.orig/fsmagic.c libmagic/fsmagic.c
 --- libmagic.orig/fsmagic.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/fsmagic.c	Mon Apr 14 23:42:51 2014
++++ libmagic/fsmagic.c	Mon Dec  2 15:25:29 2013
 @@ -59,27 +59,21 @@
  # define minor(dev)  ((dev) & 0xff)
  #endif
@@ -1899,7 +1913,7 @@ diff -u libmagic.orig/fsmagic.c libmagic/fsmagic.c
  }
 diff -u libmagic.orig/funcs.c libmagic/funcs.c
 --- libmagic.orig/funcs.c	Wed Oct 31 18:03:01 2012
-+++ libmagic/funcs.c	Mon Apr 14 23:42:51 2014
++++ libmagic/funcs.c	Mon Mar 10 16:40:55 2014
 @@ -41,52 +41,42 @@
  #if defined(HAVE_WCTYPE_H)
  #include <wctype.h>
@@ -2193,7 +2207,7 @@ diff -u libmagic.orig/funcs.c libmagic/funcs.c
 +
 diff -u libmagic.orig/magic.c libmagic/magic.c
 --- libmagic.orig/magic.c	Fri Jan 11 17:43:09 2013
-+++ libmagic/magic.c	Mon Apr 14 23:42:51 2014
++++ libmagic/magic.c	Mon Dec  2 15:29:02 2013
 @@ -25,11 +25,6 @@
   * SUCH DAMAGE.
   */
@@ -2537,7 +2551,7 @@ diff -u libmagic.orig/magic.c libmagic/magic.c
  magic_error(struct magic_set *ms)
 diff -u libmagic.orig/magic.h libmagic/magic.h
 --- libmagic.orig/magic.h	Thu Mar 21 18:52:42 2013
-+++ libmagic/magic.h	Mon Apr 14 23:42:51 2014
++++ libmagic/magic.h	Mon Dec  2 15:25:29 2013
 @@ -87,6 +87,7 @@
  
  const char *magic_getpath(const char *, int);
@@ -2556,14 +2570,14 @@ diff -u libmagic.orig/magic.h libmagic/magic.h
  
 diff -u libmagic.orig/print.c libmagic/print.c
 --- libmagic.orig/print.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/print.c	Mon Apr 14 23:42:51 2014
-@@ -29,12 +29,17 @@
++++ libmagic/print.c	Mon Dec  2 15:29:02 2013
+@@ -28,13 +28,17 @@
+ /*
   * print.c - debugging printout routines
   */
- 
 +#define _GNU_SOURCE
 +#include "php.h"
-+
+ 
  #include "file.h"
 +#include "cdf.h"
  
@@ -2575,7 +2589,7 @@ diff -u libmagic.orig/print.c libmagic/print.c
  #include <string.h>
  #include <stdarg.h>
  #include <stdlib.h>
-@@ -43,188 +48,28 @@
+@@ -43,188 +47,28 @@
  #endif
  #include <time.h>
  
@@ -2776,7 +2790,7 @@ diff -u libmagic.orig/print.c libmagic/print.c
  }
  
  protected const char *
-@@ -235,7 +80,7 @@
+@@ -235,7 +79,7 @@
  	struct tm *tm;
  
  	if (flags & FILE_T_WINDOWS) {
@@ -2787,7 +2801,7 @@ diff -u libmagic.orig/print.c libmagic/print.c
  	}
 diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
 --- libmagic.orig/readcdf.c	Wed Oct 31 18:03:01 2012
-+++ libmagic/readcdf.c	Tue May 27 22:17:37 2014
++++ libmagic/readcdf.c	Thu Apr 24 19:54:40 2014
 @@ -30,7 +30,11 @@
  #endif
  
@@ -2863,7 +2877,7 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
  			    return -1;
 diff -u libmagic.orig/readelf.c libmagic/readelf.c
 --- libmagic.orig/readelf.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/readelf.c	Mon Apr 14 23:42:51 2014
++++ libmagic/readelf.c	Sat Oct 25 11:50:05 2014
 @@ -48,8 +48,8 @@
  private int dophn_exec(struct magic_set *, int, int, int, off_t, int, size_t,
      off_t, int *, int);
@@ -2956,7 +2970,21 @@ diff -u libmagic.orig/readelf.c libmagic/readelf.c
  			file_badread(ms);
  			return -1;
  		}
-@@ -852,24 +867,12 @@
+@@ -357,6 +372,13 @@
+ 	uint32_t namesz, descsz;
+ 	unsigned char *nbuf = CAST(unsigned char *, vbuf);
+ 
++	if (xnh_sizeof + offset > size) {
++		/*
++		 * We're out of note headers.
++		 */
++		return xnh_sizeof + offset;
++	}
++
+ 	(void)memcpy(xnh_addr, &nbuf[offset], xnh_sizeof);
+ 	offset += xnh_sizeof;
+ 
+@@ -852,24 +874,12 @@
  		return 0;
  	}
  
@@ -2984,7 +3012,7 @@ diff -u libmagic.orig/readelf.c libmagic/readelf.c
  			file_badread(ms);
  			return -1;
  		}
-@@ -894,14 +897,17 @@
+@@ -894,14 +904,17 @@
  		/* Things we can determine when we seek */
  		switch (xsh_type) {
  		case SHT_NOTE:
@@ -3007,7 +3035,7 @@ diff -u libmagic.orig/readelf.c libmagic/readelf.c
  				return -1;
  			}
  
-@@ -910,25 +916,16 @@
+@@ -910,25 +923,16 @@
  				if (noff >= (off_t)xsh_size)
  					break;
  				noff = donote(ms, nbuf, (size_t)noff,
@@ -3038,7 +3066,7 @@ diff -u libmagic.orig/readelf.c libmagic/readelf.c
  				file_badseek(ms);
  				return -1;
  			}
-@@ -940,7 +937,7 @@
+@@ -940,7 +944,7 @@
  				    MAX(sizeof cap32, sizeof cap64)];
  				if ((coff += xcap_sizeof) > (off_t)xsh_size)
  					break;
@@ -3047,7 +3075,7 @@ diff -u libmagic.orig/readelf.c libmagic/readelf.c
  				    (ssize_t)xcap_sizeof) {
  					file_badread(ms);
  					return -1;
-@@ -966,13 +963,12 @@
+@@ -966,13 +970,12 @@
  					break;
  				}
  			}
@@ -3063,7 +3091,7 @@ diff -u libmagic.orig/readelf.c libmagic/readelf.c
  	if (file_printf(ms, ", %sstripped", stripped ? "" : "not ") == -1)
  		return -1;
  	if (cap_hw1) {
-@@ -1051,7 +1047,7 @@
+@@ -1051,7 +1054,7 @@
  	const char *shared_libraries = "";
  	unsigned char nbuf[BUFSIZ];
  	ssize_t bufsize;
@@ -3072,7 +3100,7 @@ diff -u libmagic.orig/readelf.c libmagic/readelf.c
  	
  	if (size != xph_sizeof) {
  		if (file_printf(ms, ", corrupted program header size") == -1)
-@@ -1060,8 +1056,13 @@
+@@ -1060,8 +1063,13 @@
  	}
  
    	for ( ; num; num--) {
@@ -3088,7 +3116,7 @@ diff -u libmagic.orig/readelf.c libmagic/readelf.c
  			return -1;
  		}
  
-@@ -1099,9 +1100,12 @@
+@@ -1099,9 +1107,12 @@
  			 * This is a PT_NOTE section; loop through all the notes
  			 * in the section.
  			 */
@@ -3104,7 +3132,7 @@ diff -u libmagic.orig/readelf.c libmagic/readelf.c
  			if (bufsize == -1) {
  				file_badread(ms);
  				return -1;
-@@ -1162,7 +1166,7 @@
+@@ -1162,7 +1173,7 @@
  	/*
  	 * If we cannot seek, it must be a pipe, socket or fifo.
  	 */
@@ -3115,7 +3143,7 @@ diff -u libmagic.orig/readelf.c libmagic/readelf.c
  	if (fstat(fd, &st) == -1) {
 diff -u libmagic.orig/readelf.h libmagic/readelf.h
 --- libmagic.orig/readelf.h	Thu Mar 21 18:45:14 2013
-+++ libmagic/readelf.h	Mon Apr 14 23:42:51 2014
++++ libmagic/readelf.h	Mon Dec  2 15:25:29 2013
 @@ -44,9 +44,17 @@
  typedef uint32_t	Elf32_Word;
  typedef uint8_t		Elf32_Char;
@@ -3136,7 +3164,7 @@ diff -u libmagic.orig/readelf.h libmagic/readelf.h
  typedef uint8_t		Elf64_Char;
 diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 --- libmagic.orig/softmagic.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/softmagic.c	Tue Jul  1 09:00:09 2014
++++ libmagic/softmagic.c	Wed Aug 20 21:20:34 2014
 @@ -41,6 +41,11 @@
  #include <stdlib.h>
  #include <time.h>
@@ -3149,6 +3177,15 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  
  private int match(struct magic_set *, struct magic *, uint32_t,
      const unsigned char *, size_t, size_t, int, int, int, int, int *, int *,
+@@ -53,7 +58,7 @@
+ private int32_t moffset(struct magic_set *, struct magic *);
+ private void mdebug(uint32_t, const char *, size_t);
+ private int mcopy(struct magic_set *, union VALUETYPE *, int, int,
+-    const unsigned char *, uint32_t, size_t, size_t);
++    const unsigned char *, uint32_t, size_t, struct magic *);
+ private int mconvert(struct magic_set *, struct magic *, int);
+ private int print_sep(struct magic_set *, int);
+ private int handle_annotation(struct magic_set *, struct magic *);
 @@ -62,6 +67,8 @@
  private void cvt_32(union VALUETYPE *, const struct magic *);
  private void cvt_64(union VALUETYPE *, const struct magic *);
@@ -3308,9 +3345,72 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  		while (len--)
  			*ptr1++ = *ptr2++;
  		*ptr1 = '\0';
-@@ -1145,9 +1138,6 @@
- 		    "nbytes=%zu, count=%u)\n", m->type, m->flag, offset, o,
- 		    nbytes, count);
+@@ -1010,7 +1003,7 @@
+ 
+ private int
+ mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
+-    const unsigned char *s, uint32_t offset, size_t nbytes, size_t linecnt)
++    const unsigned char *s, uint32_t offset, size_t nbytes, struct magic *m)
+ {
+ 	/*
+ 	 * Note: FILE_SEARCH and FILE_REGEX do not actually copy
+@@ -1030,15 +1023,24 @@
+ 			const char *last;	/* end of search region */
+ 			const char *buf;	/* start of search region */
+ 			const char *end;
+-			size_t lines;
++			size_t lines, linecnt, bytecnt;
++
++			linecnt = m->str_range;
++			bytecnt = linecnt * 80;
+ 
++			if (bytecnt == 0) {
++				bytecnt = 8192;
++			}
++			if (bytecnt > nbytes) {
++				bytecnt = nbytes;
++			}
+ 			if (s == NULL) {
+ 				ms->search.s_len = 0;
+ 				ms->search.s = NULL;
+ 				return 0;
+ 			}
+ 			buf = RCAST(const char *, s) + offset;
+-			end = last = RCAST(const char *, s) + nbytes;
++			end = last = RCAST(const char *, s) + bytecnt;
+ 			/* mget() guarantees buf <= last */
+ 			for (lines = linecnt, b = buf; lines && b < end &&
+ 			     ((b = CAST(const char *,
+@@ -1051,7 +1053,7 @@
+ 					b++;
+ 			}
+ 			if (lines)
+-				last = RCAST(const char *, s) + nbytes;
++				last = RCAST(const char *, s) + bytecnt;
+ 
+ 			ms->search.s = buf;
+ 			ms->search.s_len = last - buf;
+@@ -1125,7 +1127,6 @@
+     int *need_separator, int *returnval)
+ {
+ 	uint32_t soffset, offset = ms->offset;
+-	uint32_t count = m->str_range;
+ 	int rv, oneed_separator;
+ 	char *sbuf, *rbuf;
+ 	union VALUETYPE *p = &ms->ms_value;
+@@ -1137,17 +1138,13 @@
+ 	}
+ 
+ 	if (mcopy(ms, p, m->type, m->flag & INDIR, s, (uint32_t)(offset + o),
+-	    (uint32_t)nbytes, count) == -1)
++	    (uint32_t)nbytes, m) == -1)
+ 		return -1;
+ 
+ 	if ((ms->flags & MAGIC_DEBUG) != 0) {
+ 		fprintf(stderr, "mget(type=%d, flag=%x, offset=%u, o=%zu, "
+-		    "nbytes=%zu, count=%u)\n", m->type, m->flag, offset, o,
+-		    nbytes, count);
++		    "nbytes=%zu)\n", m->type, m->flag, offset, o, nbytes);
  		mdebug(offset, (char *)(void *)p, sizeof(union VALUETYPE));
 -#ifndef COMPILE_ONLY
 -		file_mdump(m);
@@ -3318,7 +3418,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  	}
  
  	if (m->flag & INDIR) {
-@@ -1191,7 +1181,7 @@
+@@ -1191,7 +1188,7 @@
  		}
  		switch (cvt_flip(m->in_type, flip)) {
  		case FILE_BYTE:
@@ -3327,7 +3427,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  				return 0;
  			if (off) {
  				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1226,7 +1216,7 @@
+@@ -1226,7 +1223,7 @@
  				offset = ~offset;
  			break;
  		case FILE_BESHORT:
@@ -3336,7 +3436,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  				return 0;
  			if (off) {
  				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1278,7 +1268,7 @@
+@@ -1278,7 +1275,7 @@
  				offset = ~offset;
  			break;
  		case FILE_LESHORT:
@@ -3345,7 +3445,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  				return 0;
  			if (off) {
  				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1330,7 +1320,7 @@
+@@ -1330,7 +1327,7 @@
  				offset = ~offset;
  			break;
  		case FILE_SHORT:
@@ -3354,7 +3454,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  				return 0;
  			if (off) {
  				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1367,7 +1357,7 @@
+@@ -1367,7 +1364,7 @@
  			break;
  		case FILE_BELONG:
  		case FILE_BEID3:
@@ -3363,7 +3463,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  				return 0;
  			if (off) {
  				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1438,7 +1428,7 @@
+@@ -1438,7 +1435,7 @@
  			break;
  		case FILE_LELONG:
  		case FILE_LEID3:
@@ -3372,7 +3472,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  				return 0;
  			if (off) {
  				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1508,7 +1498,7 @@
+@@ -1508,7 +1505,7 @@
  				offset = ~offset;
  			break;
  		case FILE_MELONG:
@@ -3381,7 +3481,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  				return 0;
  			if (off) {
  				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1578,7 +1568,7 @@
+@@ -1578,7 +1575,7 @@
  				offset = ~offset;
  			break;
  		case FILE_LONG:
@@ -3390,7 +3490,15 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  				return 0;
  			if (off) {
  				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1644,23 +1634,20 @@
+@@ -1637,30 +1634,27 @@
+ 			if ((ms->flags & MAGIC_DEBUG) != 0)
+ 				fprintf(stderr, "indirect +offs=%u\n", offset);
+ 		}
+-		if (mcopy(ms, p, m->type, 0, s, offset, nbytes, count) == -1)
++		if (mcopy(ms, p, m->type, 0, s, offset, nbytes, m) == -1)
+ 			return -1;
+ 		ms->offset = offset;
+ 
  		if ((ms->flags & MAGIC_DEBUG) != 0) {
  			mdebug(offset, (char *)(void *)p,
  			    sizeof(union VALUETYPE));
@@ -3416,7 +3524,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  			return 0;
  		break;
  
-@@ -1679,38 +1666,40 @@
+@@ -1679,38 +1673,40 @@
  	case FILE_FLOAT:
  	case FILE_BEFLOAT:
  	case FILE_LEFLOAT:
@@ -3463,7 +3571,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  		if ((ms->flags & MAGIC_DEBUG) != 0)
  			fprintf(stderr, "indirect @offs=%u[%d]\n", offset, rv);
  		rbuf = ms->o.buf;
-@@ -1718,16 +1707,26 @@
+@@ -1718,16 +1714,26 @@
  		ms->offset = soffset;
  		if (rv == 1) {
  			if ((ms->flags & (MAGIC_MIME|MAGIC_APPLE)) == 0 &&
@@ -3494,7 +3602,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  			return 0;
  		sbuf = m->value.s;
  		if (*sbuf == '^') {
-@@ -1837,6 +1836,42 @@
+@@ -1837,6 +1843,42 @@
  	return file_strncmp(a, b, len, flags);
  }
  
@@ -3537,7 +3645,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  private int
  magiccheck(struct magic_set *ms, struct magic *m)
  {
-@@ -1996,69 +2031,157 @@
+@@ -1996,69 +2038,157 @@
  		break;
  	}
  	case FILE_REGEX: {
@@ -3608,7 +3716,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 +			zval *retval;
 +			zval *subpats;
 +			char *haystack;
-+			
++
 +			MAKE_STD_ZVAL(retval);
 +			ALLOC_INIT_ZVAL(subpats);
 +			

ext/fileinfo/libmagic/apprentice.c

@@ -1269,7 +1269,7 @@ file_signextend(struct magic_set *ms, struct magic *m, uint64_t v)
 		 * the sign extension must have happened.
 		 */
 		case FILE_BYTE:
-			v = (char) v;
+			v = (signed char) v;
 			break;
 		case FILE_SHORT:
 		case FILE_BESHORT:

ext/fileinfo/libmagic/cdf.c

@@ -820,7 +820,7 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 		q = (const uint8_t *)(const void *)
 		    ((const char *)(const void *)p + ofs
 		    - 2 * sizeof(uint32_t));
-		if (q > e) {
+		if (q < p || q > e) {
 			DPRINTF(("Ran of the end %p > %p\n", q, e));
 			goto out;
 		}

ext/fileinfo/libmagic/readelf.c

@@ -372,6 +372,13 @@ donote(struct magic_set *ms, void *vbuf, size_t offset, size_t size,
 	uint32_t namesz, descsz;
 	unsigned char *nbuf = CAST(unsigned char *, vbuf);
 
+	if (xnh_sizeof + offset > size) {
+		/*
+		 * We're out of note headers.
+		 */
+		return xnh_sizeof + offset;
+	}
+
 	(void)memcpy(xnh_addr, &nbuf[offset], xnh_sizeof);
 	offset += xnh_sizeof;
 

ext/fileinfo/libmagic/softmagic.c

@@ -58,7 +58,7 @@ private int32_t mprint(struct magic_set *, struct magic *);
 private int32_t moffset(struct magic_set *, struct magic *);
 private void mdebug(uint32_t, const char *, size_t);
 private int mcopy(struct magic_set *, union VALUETYPE *, int, int,
-    const unsigned char *, uint32_t, size_t, size_t);
+    const unsigned char *, uint32_t, size_t, struct magic *);
 private int mconvert(struct magic_set *, struct magic *, int);
 private int print_sep(struct magic_set *, int);
 private int handle_annotation(struct magic_set *, struct magic *);
@@ -1003,7 +1003,7 @@ mdebug(uint32_t offset, const char *str, size_t len)
 
 private int
 mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
-    const unsigned char *s, uint32_t offset, size_t nbytes, size_t linecnt)
+    const unsigned char *s, uint32_t offset, size_t nbytes, struct magic *m)
 {
 	/*
 	 * Note: FILE_SEARCH and FILE_REGEX do not actually copy
@@ -1023,15 +1023,24 @@ mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
 			const char *last;	/* end of search region */
 			const char *buf;	/* start of search region */
 			const char *end;
-			size_t lines;
+			size_t lines, linecnt, bytecnt;
 
+			linecnt = m->str_range;
+			bytecnt = linecnt * 80;
+
+			if (bytecnt == 0) {
+				bytecnt = 8192;
+			}
+			if (bytecnt > nbytes) {
+				bytecnt = nbytes;
+			}
 			if (s == NULL) {
 				ms->search.s_len = 0;
 				ms->search.s = NULL;
 				return 0;
 			}
 			buf = RCAST(const char *, s) + offset;
-			end = last = RCAST(const char *, s) + nbytes;
+			end = last = RCAST(const char *, s) + bytecnt;
 			/* mget() guarantees buf <= last */
 			for (lines = linecnt, b = buf; lines && b < end &&
 			     ((b = CAST(const char *,
@@ -1044,7 +1053,7 @@ mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
 					b++;
 			}
 			if (lines)
-				last = RCAST(const char *, s) + nbytes;
+				last = RCAST(const char *, s) + bytecnt;
 
 			ms->search.s = buf;
 			ms->search.s_len = last - buf;
@@ -1118,7 +1127,6 @@ mget(struct magic_set *ms, const unsigned char *s, struct magic *m,
     int *need_separator, int *returnval)
 {
 	uint32_t soffset, offset = ms->offset;
-	uint32_t count = m->str_range;
 	int rv, oneed_separator;
 	char *sbuf, *rbuf;
 	union VALUETYPE *p = &ms->ms_value;
@@ -1130,13 +1138,12 @@ mget(struct magic_set *ms, const unsigned char *s, struct magic *m,
 	}
 
 	if (mcopy(ms, p, m->type, m->flag & INDIR, s, (uint32_t)(offset + o),
-	    (uint32_t)nbytes, count) == -1)
+	    (uint32_t)nbytes, m) == -1)
 		return -1;
 
 	if ((ms->flags & MAGIC_DEBUG) != 0) {
 		fprintf(stderr, "mget(type=%d, flag=%x, offset=%u, o=%zu, "
-		    "nbytes=%zu, count=%u)\n", m->type, m->flag, offset, o,
-		    nbytes, count);
+		    "nbytes=%zu)\n", m->type, m->flag, offset, o, nbytes);
 		mdebug(offset, (char *)(void *)p, sizeof(union VALUETYPE));
 	}
 
@@ -1627,7 +1634,7 @@ mget(struct magic_set *ms, const unsigned char *s, struct magic *m,
 			if ((ms->flags & MAGIC_DEBUG) != 0)
 				fprintf(stderr, "indirect +offs=%u\n", offset);
 		}
-		if (mcopy(ms, p, m->type, 0, s, offset, nbytes, count) == -1)
+		if (mcopy(ms, p, m->type, 0, s, offset, nbytes, m) == -1)
 			return -1;
 		ms->offset = offset;
 
@@ -2057,7 +2064,7 @@ magiccheck(struct magic_set *ms, struct magic *m)
 			zval *retval;
 			zval *subpats;
 			char *haystack;
-			
+
 			MAKE_STD_ZVAL(retval);
 			ALLOC_INIT_ZVAL(subpats);
 			

ext/fileinfo/magicdata.patch

@@ -1,4 +1,4 @@
-Patches applied to file sources tree before generating magic.mgc
+Patches applied to file 5.14 sources tree before generating magic.mgc
 and before running create_data_file.php to create data_file.c.
 
 
@@ -17,14 +17,6 @@ diff --git a/magic/Magdir/commands b/magic/Magdir/commands
 index 67c3eee..4a7d8dd 100644
 --- a/magic/Magdir/commands
 +++ b/magic/Magdir/commands
-@@ -1,6 +1,6 @@
- 
- #------------------------------------------------------------------------------
--# $File: commands,v 1.44 2013/02/05 15:20:47 christos Exp $
-+# $File: commands,v 1.45 2013/02/06 14:18:52 christos Exp $
- # commands:  file(1) magic for various shells and interpreters
- #
- #0	string/w	:			shell archive or script for antique kernel text
 @@ -49,7 +49,7 @@
  !:mime	text/x-awk
  0	string/wt	#!\ /usr/bin/awk	awk script text executable
@@ -36,4 +28,56 @@ index 67c3eee..4a7d8dd 100644
  0	string/wt	#!\ /bin/rc	Plan 9 rc shell script text executable
 -- 
 1.8.5.5
+From 0b478f445b6b7540b58af5d1fe583fa9e48fd745 Mon Sep 17 00:00:00 2001
+From: Christos Zoulas <christos@zoulas.com>
+Date: Wed, 28 May 2014 19:52:36 +0000
+Subject: [PATCH] further optimize awk by not looking for the BEGIN regex until
+ we found the BEGIN (Jan Kaluza)
+
+---
+ magic/Magdir/commands | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/magic/Magdir/commands b/magic/Magdir/commands
+index bfffdef..26b2869 100644
+--- a/magic/Magdir/commands
++++ b/magic/Magdir/commands
+@@ -49,7 +49,8 @@
+ !:mime	text/x-awk
+ 0	string/wt	#!\ /usr/bin/awk	awk script text executable
+ !:mime	text/x-awk
+-0	regex		=^\\s{0,100}BEGIN\\s{0,100}[{]	awk script text
++0       search/16384    BEGIN
++>0	regex		=^\\s{0,100}BEGIN\\s{0,100}[{]	awk script text
+ 
+ # AT&T Bell Labs' Plan 9 shell
+ 0	string/wt	#!\ /bin/rc	Plan 9 rc shell script text executable
+-- 
+2.0.3
+
+From 71a8b6c0d758acb0f73e2e51421a711b5e9d6668 Mon Sep 17 00:00:00 2001
+From: Christos Zoulas <christos@zoulas.com>
+Date: Fri, 30 May 2014 16:48:44 +0000
+Subject: [PATCH] Limit regex search for BEGIN to the first 4K of the file.
+
+---
+ magic/Magdir/commands | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+diff --git a/magic/Magdir/commands b/magic/Magdir/commands
+index 26b2869..bcd0f43 100644
+--- a/magic/Magdir/commands
++++ b/magic/Magdir/commands
+@@ -49,8 +49,7 @@
+ !:mime	text/x-awk
+ 0	string/wt	#!\ /usr/bin/awk	awk script text executable
+ !:mime	text/x-awk
+-0       search/16384    BEGIN
+->0	regex		=^\\s{0,100}BEGIN\\s{0,100}[{]	awk script text
++0	regex/4096	=^\\s{0,100}BEGIN\\s{0,100}[{]	awk script text
+ 
+ # AT&T Bell Labs' Plan 9 shell
+ 0	string/wt	#!\ /bin/rc	Plan 9 rc shell script text executable
+-- 
+2.0.3
 

ext/fileinfo/tests/cve-2014-3538.phpt

@@ -0,0 +1,35 @@
+--TEST--
+Bug #66731: file: extensive backtraking
+--SKIPIF--
+<?php
+if (!class_exists('finfo'))
+	die('skip no fileinfo extension');
+--FILE--
+<?php
+$fd = __DIR__.'/cve-2014-3538.data';
+
+file_put_contents($fd,
+  'try:' .
+  str_repeat("\n", 1000000));
+
+$fi = finfo_open(FILEINFO_NONE);
+$t = microtime(true);
+var_dump(finfo_file($fi, $fd));
+$t = microtime(true) - $t;
+finfo_close($fi);
+if ($t < 1) {
+	echo "Ok\n";
+} else {
+	printf("Failed, time=%.2f\n", $t);
+}
+
+?>
+Done
+--CLEAN--
+<?php
+@unlink(__DIR__.'/cve-2014-3538.data');
+?>
+--EXPECTF--
+string(%d) "%s"
+Ok
+Done

ext/gd/gd.c

@@ -5110,11 +5110,23 @@ PHP_FUNCTION(imagescale)
 		return;
 	}
 	method = tmp_m;
-	new_width = tmp_w;
-	new_height = tmp_h;
 
 	ZEND_FETCH_RESOURCE(im, gdImagePtr, &IM, -1, "Image", le_gd);
 
+	if (tmp_h < 0) {
+		/* preserve ratio */
+		long src_x, src_y;
+
+		src_x = gdImageSX(im);
+		src_y = gdImageSY(im);
+		if (src_x) {
+			tmp_h = tmp_w * src_y / src_x;
+		}
+	}
+
+	new_width = tmp_w;
+	new_height = tmp_h;
+
 	if (gdImageSetInterpolationMethod(im, method)) {
 		im_scaled = gdImageScale(im, new_width, new_height);
 	}

ext/gd/gd_ctx.c

@@ -124,6 +124,11 @@ static void _php_image_output_ctx(INTERNAL_FUNCTION_PARAMETERS, int image_type,
 				RETURN_FALSE;
 			}
 		} else if (Z_TYPE_P(to_zval) == IS_STRING) {
+			if (CHECK_ZVAL_NULL_PATH(to_zval)) {
+				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid 2nd parameter, filename must not contain null bytes");
+				RETURN_FALSE;
+			}
+
 			stream = php_stream_open_wrapper(Z_STRVAL_P(to_zval), "wb", REPORT_ERRORS|IGNORE_PATH|IGNORE_URL_WIN, NULL);
 			if (stream == NULL) {
 				RETURN_FALSE;

ext/gd/libgd/gdft.c

@@ -370,9 +370,10 @@ static void *fontFetch (char **error, void *key)
 	fontlist = gdEstrdup(a->fontlist);
 
 	/*
-	 * Must use gd_strtok_r else pointer corrupted by strtok in nested loop.
+	 * Must use gd_strtok_r becasuse strtok() isn't thread safe
 	 */
 	for (name = gd_strtok_r (fontlist, LISTSEPARATOR, &strtok_ptr); name; name = gd_strtok_r (0, LISTSEPARATOR, &strtok_ptr)) {
+		char *strtok_ptr_path;
 		/* make a fresh copy each time - strtok corrupts it. */
 		path = gdEstrdup (fontsearchpath);
 
@@ -388,7 +389,8 @@ static void *fontFetch (char **error, void *key)
 				break;
 			}
 		}
-		for (dir = strtok (path, PATHSEPARATOR); dir; dir = strtok (0, PATHSEPARATOR)) {
+		for (dir = gd_strtok_r (path, PATHSEPARATOR, &strtok_ptr_path); dir;
+		     dir = gd_strtok_r (0, PATHSEPARATOR, &strtok_ptr_path)) {
 			if (!strcmp(dir, ".")) {
 				TSRMLS_FETCH();
 #if HAVE_GETCWD

ext/gd/libgd/gdxpm.c

@@ -31,12 +31,17 @@ gdImagePtr gdImageCreateFromXpm (char *filename)
 	if (ret != XpmSuccess) {
 		return 0;
 	}
+	number = image.ncolors;
+	for(i = 0; i < number; i++) {
+		if (!image.colorTable[i].c_color) {
+			goto done;
+		}
+	}
 
 	if (!(im = gdImageCreate(image.width, image.height))) {
 		goto done;
 	}
 
-	number = image.ncolors;
 	colors = (int *) safe_emalloc(number, sizeof(int), 0);
 	for (i = 0; i < number; i++) {
 		switch (strlen (image.colorTable[i].c_color)) {

ext/gd/tests/bug48801_1.phpt

@@ -20,6 +20,6 @@ echo '(' . $bbox[6] . ', ' . $bbox[7] . ")\n";
 ?>
 --EXPECTF--
 (-1, 15)
-(156, 15)
-(156, -48)
+(15%d, 15)
+(15%d, -48)
 (-1, -48)

ext/gd/tests/imagealphablending_error1.phpt

@@ -0,0 +1,19 @@
+--TEST--
+test imagealphablending without arguments
+
+--CREDITS--
+Marcelo Diniz <marcelo.leo27 [at] gmail [dot] com
+‪#‎phpspMaisTestFest PHPSP on 2014-07-05
+
+--SKIPIF--
+<?php
+    if (!extension_loaded('gd')) die("skip gd extension not available.");
+?>
+
+--FILE--
+<?php
+imagealphablending();
+?>
+
+--EXPECTF--
+Warning: imagealphablending() expects exactly 2 parameters, 0 given in %s on line %d

ext/gd/tests/imagecolorresolvealpha_error3.phpt

@@ -0,0 +1,19 @@
+--TEST--
+test imagecolorresolvealpha without arguments
+
+--CREDITS--
+Marcelo Diniz <marcelo.leo27 [at] gmail [dot] com
+‪#‎phpspMaisTestFest PHPSP on 2014-07-05
+
+--SKIPIF--
+<?php
+    if (!extension_loaded('gd')) die("skip gd extension not available.");
+?>
+
+--FILE--
+<?php
+imagecolorresolvealpha();
+?>
+
+--EXPECTF--
+Warning: imagecolorresolvealpha() expects exactly 5 parameters, 0 given in %s on line %d

ext/gd/tests/imagegd2_nullbyte_injection.phpt

@@ -0,0 +1,31 @@
+--TEST--
+Testing null byte injection in imagegd2
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagegd2 TEST\n";
+imagegd2($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagegd2 TEST
+
+Warning: imagegd2() expects parameter 2 to be a valid path, string given in %s on line %d
+bool(false)
+bool(false)

ext/gd/tests/imagegd_nullbyte_injection.phpt

@@ -0,0 +1,31 @@
+--TEST--
+Testing null byte injection in imagegd
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagegd TEST\n";
+imagegd($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagegd TEST
+
+Warning: imagegd() expects parameter 2 to be a valid path, string given in %s on line %d
+bool(false)
+bool(false)

ext/gd/tests/imagegif_nullbyte_injection.phpt

@@ -0,0 +1,38 @@
+--TEST--
+Testing null byte injection in imagegif
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--SKIPIF--
+<?php
+$support = gd_info();
+if (!isset($support['GIF Create Support']) || $support['GIF Create Support'] === false) {
+	print 'skip gif support not available';
+}
+?>
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagegif TEST\n";
+imagegif($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagegif TEST
+
+Warning: imagegif(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
+bool(false)
+bool(false)

ext/gd/tests/imagejpeg_nullbyte_injection.phpt

@@ -0,0 +1,38 @@
+--TEST--
+Testing null byte injection in imagejpeg
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--SKIPIF--
+<?php
+$support = gd_info();
+if (!isset($support['JPEG Support']) || $support['JPEG Support'] === false) {
+	print 'skip jpeg support not available';
+}
+?>
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagejpeg TEST\n";
+imagejpeg($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagejpeg TEST
+
+Warning: imagejpeg(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
+bool(false)
+bool(false)

ext/gd/tests/imagepng_nullbyte_injection.phpt

@@ -0,0 +1,38 @@
+--TEST--
+Testing null byte injection in imagepng
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--SKIPIF--
+<?php
+$support = gd_info();
+if (!isset($support['PNG Support']) || $support['PNG Support'] === false) {
+	print 'skip png support not available';
+}
+?>
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagepng TEST\n";
+imagepng($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagepng TEST
+
+Warning: imagepng(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
+bool(false)
+bool(false)

ext/gd/tests/imagesavealpha_error2.phpt

@@ -0,0 +1,19 @@
+--TEST--
+test imagesavealpha without arguments
+
+--CREDITS--
+Marcelo Diniz <marcelo.leo27 [at] gmail [dot] com
+‪#‎phpspMaisTestFest PHPSP on 2014-07-05
+
+--SKIPIF--
+<?php
+    if (!extension_loaded('gd')) die("skip gd extension not available.");
+?>
+
+--FILE--
+<?php
+imagesavealpha();
+?>
+
+--EXPECTF--
+Warning: imagesavealpha() expects exactly 2 parameters, 0 given in %s on line %d

ext/gd/tests/imagewbmp_nullbyte_injection.phpt

@@ -0,0 +1,38 @@
+--TEST--
+Testing null byte injection in imagewbmp
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--SKIPIF--
+<?php
+$support = gd_info();
+if (!isset($support['WBMP Support']) || $support['WBMP Support'] === false) {
+	print 'skip wbmp support not available';
+}
+?>
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagewbmp TEST\n";
+imagewbmp($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagewbmp TEST
+
+Warning: imagewbmp(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
+bool(false)
+bool(false)

ext/gd/tests/imagewebp_nullbyte_injection.phpt

@@ -0,0 +1,38 @@
+--TEST--
+Testing null byte injection in imagewebp
+--CLEAN--
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+rmdir($tempdir);
+--SKIPIF--
+<?php
+$support = gd_info();
+if (!isset($support['WEBP Support']) || $support['WEBP Support'] === false) {
+	print 'skip webp support not available';
+}
+?>
+--FILE--
+<?php
+$image = imagecreate(1,1);// 1px image
+
+
+$tempdir = sys_get_temp_dir(). '/php-gdtest';
+if (!file_exists($tempdir) && !is_dir($tempdir)) {
+	mkdir ($tempdir, 0777, true);
+}
+
+$userinput = "1\0"; // from post or get data
+$temp = $tempdir. "/test" . $userinput .".tmp";
+
+echo "\nimagewebp TEST\n";
+imagewebp($image, $temp);
+var_dump(file_exists($tempdir. "/test1"));
+var_dump(file_exists($tempdir. "/test1.tmp"));
+foreach (glob($tempdir . "/test*") as $file ) { unlink($file); }
+
+--EXPECTF--
+imagewbmp TEST
+
+Warning: imagewebp(): Invalid 2nd parameter, filename must not contain null bytes in %s on line %d
+bool(false)
+bool(false)

ext/gettext/tests/66265/de_DE/LC_MESSAGES/domain.po

@@ -0,0 +1,17 @@
+msgid ""
+msgstr ""
+"Project-Id-Version: bugs.php.net/66265\n"
+"POT-Creation-Date: 2014-11-20 16:33+0100\n"
+"PO-Revision-Date: 2014-11-20 16:40+0100\n"
+"Last-Translator:  <ab@php.net>\n"
+"Language-Team: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: Poedit 1.6.10\n"
+"X-Poedit-Basepath: .\n"
+"Plural-Forms: nplurals=2; plural=(n != 1);\n"
+"Language: de_DE\n"
+
+msgid "hello"
+msgstr "hallo"

ext/gettext/tests/66265/en_US/LC_MESSAGES/domain.po

@@ -0,0 +1,17 @@
+msgid ""
+msgstr ""
+"Project-Id-Version: bugs.php.net/66265\n"
+"POT-Creation-Date: 2014-11-20 16:33+0100\n"
+"PO-Revision-Date: 2014-11-20 16:40+0100\n"
+"Last-Translator: \n"
+"Language-Team: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: Poedit 1.6.10\n"
+"X-Poedit-Basepath: .\n"
+"Plural-Forms: nplurals=2; plural=(n != 1);\n"
+"Language: en_US\n"
+
+msgid "hello"
+msgstr "hello"

ext/gettext/tests/66265/fr_FR/LC_MESSAGES/domain.po

@@ -0,0 +1,17 @@
+msgid ""
+msgstr ""
+"Project-Id-Version: bugs.php.net/66265\n"
+"POT-Creation-Date: 2014-11-20 16:33+0100\n"
+"PO-Revision-Date: 2014-11-20 16:59+0100\n"
+"Last-Translator:  <ab@php.net>\n"
+"Language-Team: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: Poedit 1.6.10\n"
+"X-Poedit-Basepath: .\n"
+"Plural-Forms: nplurals=2; plural=(n != 1);\n"
+"Language: fr_FR\n"
+
+msgid "hello"
+msgstr "salut"

ext/gettext/tests/bug66267.phpt

@@ -0,0 +1,55 @@
+--TEST--
+#66265: gettext doesn't switch locales within the same script
+--SKIPIF--
+<?php
+if (!extension_loaded("gettext")) {
+	die("skip\n");
+}
+if (PHP_ZTS) {
+	/* this is supposed to fail on the TS build at least on Windows,
+	should be even XFAIL till it's fixed there */
+	die("skip NTS only");
+}
+if (substr(PHP_OS, 0, 3) != 'WIN') {
+	$loc = ["de_DE", "fr_FR", "en_US"];
+	foreach($loc as $l) {
+		if (!setlocale(LC_ALL, $l)) {
+			die("SKIP '$l' locale not supported.");
+		}
+	}
+}
+?>
+--FILE--
+<?php
+
+$domain = 'domain';
+
+$loc = ["de_DE", "fr_FR", "en_US"];
+
+foreach ($loc as $l) {
+	putenv("LC_ALL=$l");
+
+	$path = realpath(dirname(__FILE__) . DIRECTORY_SEPARATOR . "66265");
+	bindtextdomain($domain, $path);
+	bind_textdomain_codeset($domain, "UTF-8");
+	textdomain($domain);
+
+	echo 'LC_ALL=', getenv('LC_ALL'), "\n";
+	echo 'hello=', _('hello'), "\n";
+	echo "\n";
+}
+
+?>
+==DONE==
+--EXPECTF--
+LC_ALL=de_DE
+hello=hallo
+
+LC_ALL=fr_FR
+hello=salut
+
+LC_ALL=en_US
+hello=hello
+
+==DONE==
+

ext/gmp/gmp.c

@@ -324,30 +324,6 @@ static void _php_gmpnum_free(zend_rsrc_list_entry *rsrc TSRMLS_DC);
 #	define MAX_BASE 36
 #endif
 
-/* {{{ gmp_emalloc
- */
-static void *gmp_emalloc(size_t size)
-{
-	return emalloc(size);
-}
-/* }}} */
-
-/* {{{ gmp_erealloc
- */
-static void *gmp_erealloc(void *ptr, size_t old_size, size_t new_size)
-{
-	return erealloc(ptr, new_size);
-}
-/* }}} */
-
-/* {{{ gmp_efree
- */
-static void gmp_efree(void *ptr, size_t size)
-{
-	efree(ptr);
-}
-/* }}} */
-
 /* {{{ ZEND_GINIT_FUNCTION
  */
 static ZEND_GINIT_FUNCTION(gmp)
@@ -369,8 +345,6 @@ ZEND_MODULE_STARTUP_D(gmp)
 #endif
 	REGISTER_STRING_CONSTANT("GMP_VERSION", (char *)gmp_version, CONST_CS | CONST_PERSISTENT);
 
-	mp_set_memory_functions(gmp_emalloc, gmp_erealloc, gmp_efree);
-
 	return SUCCESS;
 }
 /* }}} */

ext/iconv/tests/iconv_basic_001-win32.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Test the basics to function iconv.
+--CREDITS--
+Rodrigo Prado de Jesus <royopa [at] gmail [dot] com>
+--SKIPIF--
+<?php extension_loaded('iconv') or die('skip iconv extension is not available'); ?>
+<?php if(substr(PHP_OS, 0, 3) != 'WIN' ) {die('skip windows only test');} ?>
+--FILE--
+<?php
+$in_charset          = 'UTF-8';
+$out_charset 	     = 'ASCII//TRANSLIT';
+$string_to_translate = 'Žluťoučký kůň\n';
+
+$string_out = iconv($in_charset, $out_charset, $string_to_translate);
+
+var_dump($string_out);
+?>
+--EXPECT--
+string(16) "Zlutouck'y kun\n"

ext/iconv/tests/iconv_basic_001.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Test the basics to function iconv.
+--CREDITS--
+Rodrigo Prado de Jesus <royopa [at] gmail [dot] com>
+--SKIPIF--
+<?php extension_loaded('iconv') or die('skip iconv extension is not available'); ?>
+<?php if(substr(PHP_OS, 0, 3) == 'WIN' ) {die('skip not for windows');} ?>
+--FILE--
+<?php
+$in_charset          = 'UTF-8';
+$out_charset 	     = 'ASCII//TRANSLIT';
+$string_to_translate = 'Žluťoučký kůň\n';
+
+$string_out = iconv($in_charset, $out_charset, $string_to_translate);
+
+var_dump($string_out);
+?>
+--EXPECT--
+string(15) "Zlutoucky kun\n"