5.4.31

5.4.31 RC1
fix unstable test
2026-11-10 10:40:50 +00:00 · 2014-07-22 17:59:30 -07:00 · 2014-07-08 21:23:42 -07:00 · 2014-07-08 14:13:46 -07:00 · 2014-07-08 12:53:45 -07:00 · 2014-07-08 10:06:35 +02:00
114 changed files with 2041 additions and 965 deletions
@@ -1,19 +1,101 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2014, PHP 5.4.30
+24 Jul 2014, PHP 5.4.31
+
+- Core:
+  . Fixed bug #67428 (header('Location: foo') will override a 308-399 response
+    code). (Adam)
+  . Fixed bug #67436 (Autoloader isn't called if two method definitions don't
+    match). (Bob)
+  . Fixed bug #67091 (make install fails to install libphp5.so on FreeBSD 10.0).
+    (Ferenc)
+  . Fixed bug #67151 (strtr with empty array crashes). (Nikita)
+  . Fixed bug #67407 (Windows 8.1/Server 2012 R2 reported as Windows 8/Server
+    2012). (Christian Wenz)
+
+- CLI server:
+  . Implemented FR #67429 (CLI server is missing some new HTTP response codes).
+    (Adam)
+  . Fixed bug #66830 (Empty header causes PHP built-in web server to hang).
+    (Adam)
+
+- FPM:
+  . Fixed bug #67530 (error_log=syslog ignored). (Remi)
+  . Fixed bug #67531 (syslog cannot be set in pool configuration). (Remi)
+
+- Intl:
+  . Fixed bug #67052 (NumberFormatter::parse() resets LC_NUMERIC setting). 
+    (Stas)
+
+- pgsql:
+  . Fixed bug #67550 (Error in code "form" instead of "from", pgsql.c, line 756),
+    which affected builds against libpq < 7.3. (Adam)
+
+- Phar:
+  . Fixed bug #67587 (Redirection loop on nginx with FPM). (Christian Weiske)
+
+- Streams:
+  . Fixed bug #67430 (http:// wrapper doesn't follow 308 redirects). (Adam)
+
+26 Jun 2014, PHP 5.4.30
+
+- Core:
+  . Fixed BC break introduced by patch for bug #67072. (Anatol, Stas)
+  . Fixed bug #66622 (Closures do not correctly capture the late bound class 
+    (static::) in some cases). (Levi Morrison)
+  . Fixed bug #67390 (insecure temporary file use in the configure script).
+    (Remi) (CVE-2014-3981)
+  . Fixed bug #67399 (putenv with empty variable may lead to crash). (Stas)
+  . Fixed bug #67498 (phpinfo() Type Confusion Information Leak Vulnerability). 
+    (Stefan Esser)
+
+- CLI server:
+  . Fixed Bug #67406 (built-in web-server segfaults on startup). (Remi)

 - Date:
  . Fixed bug #67308 (Serialize of DateTime truncates fractions of second).
    (Adam)
+  . Fixed regression in fix for bug #67118 (constructor can't be called twice).
+    (Remi)

 - Fileinfo:
-  . Fixed bug #67326 (fileinfo: cdf_read_short_sector insufficient boundary check).
+  . Fixed bug #67326 (fileinfo: cdf_read_short_sector insufficient boundary 
+    check). (CVE-2014-0207) 
+  . Fixed bug #67410 (fileinfo: mconvert incorrect handling of truncated pascal
+    string size). (CVE-2014-3478) (Francisco Alonso, Jan Kaluza, Remi) 
+  . Fixed bug #67411 (fileinfo: cdf_check_stream_offset insufficient boundary
+    check). (CVE-2014-3479) (Francisco Alonso, Jan Kaluza, Remi)
+  . Fixed bug #67412 (fileinfo: cdf_count_chain insufficient boundary check).
+    (CVE-2014-3480) (Francisco Alonso, Jan Kaluza, Remi)
+  . Fixed bug #67413 (fileinfo: cdf_read_property_info insufficient boundary
+    check). (CVE-2014-3487) (Francisco Alonso, Jan Kaluza, Remi)
+
+- Intl:
+  . Fixed bug #67349 (Locale::parseLocale Double Free). (Stas)
+  . Fixed bug #67397 (Buffer overflow in locale_get_display_name and
+    uloc_getDisplayName (libicu 4.8.1)). (Stas)
+
+- Network:
+  . Fixed bug #67432 (Fix potential segfault in dns_get_record()). 
+    (CVE-2014-4049). (Sara)
+
+- OpenSSL:
+  . Fixed bug #65698 (certificates validity parsing does not work past 2050). 
+    (Paul Oehler)
+  . Fixed bug #66636 (openssl_x509_parse warning with V_ASN1_GENERALIZEDTIME). 
+    (Paul Oehler)
+
+- SOAP:
+  . Implemented FR #49898 (Add SoapClient::__getCookies()). (Boro Sitnikovski)

 - SPL:
+  . Fixed bug #66127 (Segmentation fault with ArrayObject unset). (Stas)
  . Fixed bug #67359 (Segfault in recursiveDirectoryIterator). (Laruence)
  . Fixed bug #67360 (Missing element after ArrayObject::getIterator). (Adam)
+  . Fixed bug #67492 (unserialize() SPL ArrayObject / SPLObjectStorage Type 
+    Confusion) (CVE-2014-3515). (Stefan Esser)

-?? ??? 2014, PHP 5.4.29
+29 May 2014, PHP 5.4.29

 - COM:
  . Fixed bug #66431 (Special Character via COM Interface (CP_UTF8)). (Anatol)
@@ -10,6 +10,7 @@ PHP 5.4 UPGRADE NOTES
 2. Changes to reserved words and classes
 3. Changes to engine behavior
 4. Changes to existing functions
+   a. unserialize() change
 5. Changes to existing classes
 6. Changes to existing methods
 7. Deprecated Functionality
@@ -311,7 +312,7 @@ PHP 5.4 UPGRADE NOTES
  to limit the amount of stack frames returned.

 - Fixed crypt_blowfish handling of 8-bit characters. crypt() in Blowfish mode
-  now supports hashes marked $2a$, $2x$, $2y$ and $2z$.
+  now supports hashes marked $2a$, $2x$ and $2y$.

 - mbstring now supports following encodings: Shift_JIS/UTF-8 Emoji,
  JIS X0213:2004 (Shift_JIS-2004, EUC-JP-2004, ISO-2022-JP-2004),
@@ -350,8 +351,46 @@ PHP 5.4 UPGRADE NOTES
 - Since 5.4.7, ctor is always called when new user stream wrapper object is created.
  Before, it was called only when stream_open was called.

- Manipulated serialization strings for objects implementing Serializable by
-  replacing "C:" with "O:" at the start will now produce an error.
+4a. unserialize() change
+------------------------
+
+- Starting PHP 5.4.29, the bug fix for bug #67072 introduces a change to 
+  unserialize() function, detailed below:
+
+    If the string looking like 'O:..:"ClassName":...' is unserialized, and
+    the class named is an internal class that declares custom unserializer
+    function, or extends such class, unserialize would fail.
+
+    Using O: for user classes not extending internal classes (including
+    those implementing Serializable) is still supported in 5.4, though
+    it is deprecated and may not be supported in 5.6 for classes that do not 
+    originally serialize to O:. Same for using O: for internal classes 
+    implementing Serializable (like ArrayObject) and classes that extend 
+    them.
+
+    The reason for that is that O: format is meant to be used with classes
+    that do not define custom handlers, and was never intended for the use
+    with classes that do. When used with the class that relies on custom
+    unserializer, it can leave the object of such internal class in an
+    inconsistent state which has been observed to result in crashes and may
+    also lead to memory corruption and ultimately even arbitrary code
+    execution. This was never the intended use of unserializer, and mere
+    possibility of doing this constitutes a bug, since the data passed to
+    unserialize() is not a valid serialization of any object. Since there
+    are many applications applying unserialize() to untrusted data, this
+    presents a potential security vulnerability. Thus, keeping such bug in
+    the code base was considered too dangerous.
+
+    We are aware that some applications use O: format as a way to
+    instantiate classes. This was never the intended usage of serializer,
+    and ReflectionClass methods such as newInstance or
+    newInstanceWithoutConstructor can be used for that. We're working on
+    providing more comprehensive solution for such use cases in PHP 5.6 and
+    welcome the ideas in this area.
+
+    We note also that using unserialize() on any data that is not the result
+    of serialize() call continues to be an unsupported scenario and should
+    not be relied on to produce any specific result.

 ==============================
 5. Changes to existing classes
@@ -373,6 +412,8 @@ PHP 5.4 UPGRADE NOTES

 - Added iterator support in MySQLi. mysqli_result implements Traversable.

+- Since 5.4.30, SOAPClient has __getCookies() method. 
+
 ==============================
 6. Changes to existing methods
 ==============================
@@ -0,0 +1,10 @@
+<?php
+
+class a {
+	public function test($arg = c::TESTCONSTANT) {
+		echo __METHOD__ . "($arg)\n";
+	}
+
+	static public function staticTest() {
+  	}
+}
@@ -0,0 +1,8 @@
+<?php
+
+class b extends a {
+	public function test() {
+		echo __METHOD__ . "()\n";
+		parent::test();
+	}
+}
@@ -0,0 +1,26 @@
+--TEST--
+bug67436: Autoloader isn't called if user defined error handler is present
+
+--INI--
+error_reporting=
+
+--FILE--
+<?php
+
+spl_autoload_register(function($classname) {
+	if (in_array($classname, array('a','b','c'))) {
+		require_once ($classname . '.php');
+	}
+});
+
+set_error_handler(function ($errno, $errstr, $errfile, $errline) {
+}, error_reporting());
+
+a::staticTest();
+
+$b = new b();
+$b->test();
+
+--EXPECT--
+b::test()
+a::test(c::TESTCONSTANT)
@@ -0,0 +1,24 @@
+--TEST--
+bug67436: E_STRICT instead of custom error handler
+
+--INI--
+error_reporting=-1
+
+--FILE--
+<?php
+
+spl_autoload_register(function($classname) {
+	if (in_array($classname, array('a','b','c'))) {
+		require_once ($classname . '.php');
+	}
+});
+
+a::staticTest();
+
+$b = new b();
+$b->test();
+
+--EXPECTF--
+Strict Standards: Declaration of b::test() should be compatible with a::test($arg = c::TESTCONSTANT) in %s/bug67436/b.php on line %d
+b::test()
+a::test(c::TESTCONSTANT)
@@ -0,0 +1,5 @@
+<?php
+
+class c {
+	const TESTCONSTANT = "c::TESTCONSTANT";
+}
@@ -0,0 +1,37 @@
+--TEST--
+Bug 66622: Closures do not correctly capture the late bound class (static::) in some cases
+
+--FILE--
+<?php
+class A {
+    static function name() { return 'A'; }
+    function foo() {
+        $fn = function() { return static::name(); };
+        echo static::name() . ' vs ' . $fn() . "\n";
+    }
+    function bar() {
+        $fn = static function() { return static::name(); };
+        echo static::name() . ' vs ' . $fn() . "\n";
+    }
+    static function baz() {
+        $fn = function() { return static::name(); };
+        echo static::name() . ' vs ' . $fn() . "\n";
+    }
+}
+class B extends A {
+    static function name() { return 'B'; }
+}
+
+function test() {
+    (new B)->foo();
+    (new B)->bar();
+    (new B)->baz();
+    B::baz();
+}
+test();
+
+--EXPECT--
+B vs B
+B vs B
+B vs B
+B vs B
@@ -245,16 +245,16 @@ static const zend_function_entry builtin_functions[] = { /* {{{ */
 	ZEND_FE(func_num_args,		arginfo_zend__void)
 	ZEND_FE(func_get_arg,		arginfo_func_get_arg)
 	ZEND_FE(func_get_args,		arginfo_zend__void)
-	ZEND_FE(strlen,				arginfo_strlen)
-	ZEND_FE(strcmp,				arginfo_strcmp)
-	ZEND_FE(strncmp,			arginfo_strncmp)
-	ZEND_FE(strcasecmp,			arginfo_strcmp)
+	ZEND_FE(strlen,			arginfo_strlen)
+	ZEND_FE(strcmp,			arginfo_strcmp)
+	ZEND_FE(strncmp,		arginfo_strncmp)
+	ZEND_FE(strcasecmp,		arginfo_strcmp)
 	ZEND_FE(strncasecmp,		arginfo_strncmp)
-	ZEND_FE(each,				arginfo_each)
+	ZEND_FE(each,			arginfo_each)
 	ZEND_FE(error_reporting,	arginfo_error_reporting)
-	ZEND_FE(define,				arginfo_define)
-	ZEND_FE(defined,			arginfo_defined)
-	ZEND_FE(get_class,			arginfo_get_class)
+	ZEND_FE(define,			arginfo_define)
+	ZEND_FE(defined,		arginfo_defined)
+	ZEND_FE(get_class,		arginfo_get_class)
 	ZEND_FE(get_called_class,	arginfo_zend__void)
 	ZEND_FE(get_parent_class,	arginfo_get_class)
 	ZEND_FE(method_exists,		arginfo_method_exists)
@@ -274,13 +274,13 @@ static const zend_function_entry builtin_functions[] = { /* {{{ */
 	ZEND_FE(get_included_files,	arginfo_zend__void)
 	ZEND_FALIAS(get_required_files,	get_included_files,		arginfo_zend__void)
 	ZEND_FE(is_subclass_of,		arginfo_is_subclass_of)
-	ZEND_FE(is_a,				arginfo_is_subclass_of)
+	ZEND_FE(is_a,			arginfo_is_subclass_of)
 	ZEND_FE(get_class_vars,		arginfo_get_class_vars)
 	ZEND_FE(get_object_vars,	arginfo_get_object_vars)
 	ZEND_FE(get_class_methods,	arginfo_get_class_methods)
 	ZEND_FE(trigger_error,		arginfo_trigger_error)
 	ZEND_FALIAS(user_error,		trigger_error,		arginfo_trigger_error)
-	ZEND_FE(set_error_handler,			arginfo_set_error_handler)
+	ZEND_FE(set_error_handler,		arginfo_set_error_handler)
 	ZEND_FE(restore_error_handler,		arginfo_zend__void)
 	ZEND_FE(set_exception_handler,		arginfo_set_exception_handler)
 	ZEND_FE(restore_exception_handler,	arginfo_zend__void)
@@ -288,14 +288,14 @@ static const zend_function_entry builtin_functions[] = { /* {{{ */
 	ZEND_FE(get_declared_traits, 		arginfo_zend__void)
 	ZEND_FE(get_declared_interfaces, 	arginfo_zend__void)
 	ZEND_FE(get_defined_functions, 		arginfo_zend__void)
-	ZEND_FE(get_defined_vars,			arginfo_zend__void)
-	ZEND_FE(create_function,			arginfo_create_function)
-	ZEND_FE(get_resource_type,			arginfo_get_resource_type)
+	ZEND_FE(get_defined_vars,		arginfo_zend__void)
+	ZEND_FE(create_function,		arginfo_create_function)
+	ZEND_FE(get_resource_type,		arginfo_get_resource_type)
 	ZEND_FE(get_loaded_extensions,		arginfo_get_loaded_extensions)
-	ZEND_FE(extension_loaded,			arginfo_extension_loaded)
+	ZEND_FE(extension_loaded,		arginfo_extension_loaded)
 	ZEND_FE(get_extension_funcs,		arginfo_extension_loaded)
 	ZEND_FE(get_defined_constants,		arginfo_get_defined_constants)
-	ZEND_FE(debug_backtrace, 			arginfo_debug_backtrace)
+	ZEND_FE(debug_backtrace, 		arginfo_debug_backtrace)
 	ZEND_FE(debug_print_backtrace, 		arginfo_debug_print_backtrace)
 #if ZEND_DEBUG
 	ZEND_FE(zend_test_func,		NULL)
@@ -305,7 +305,7 @@ static const zend_function_entry builtin_functions[] = { /* {{{ */
 #endif
 	ZEND_FE(gc_collect_cycles, 	arginfo_zend__void)
 	ZEND_FE(gc_enabled, 		arginfo_zend__void)
-	ZEND_FE(gc_enable, 			arginfo_zend__void)
+	ZEND_FE(gc_enable, 		arginfo_zend__void)
 	ZEND_FE(gc_disable, 		arginfo_zend__void)
 	ZEND_FE_END
 };
@@ -487,6 +487,7 @@ ZEND_API void zend_create_closure(zval *res, zend_function *func, zend_class_ent
 		}
 	}

+	closure->this_ptr = NULL;
 	/* Invariants:
 	 * If the closure is unscoped, it has no bound object.
 	 * The the closure is scoped, it's either static or it's bound */
@@ -498,10 +499,7 @@ ZEND_API void zend_create_closure(zval *res, zend_function *func, zend_class_ent
 			Z_ADDREF_P(this_ptr);
 		} else {
 			closure->func.common.fn_flags |= ZEND_ACC_STATIC;
-			closure->this_ptr = NULL;
 		}
-	} else {
-		closure->this_ptr = NULL;
 	}
 }
 /* }}} */
@@ -3150,8 +3150,11 @@ static char * zend_get_function_declaration(zend_function *fptr TSRMLS_DC) /* {{
 						*zv = *precv->op2.zv;
 						zval_copy_ctor(zv);
 						INIT_PZVAL(zv);
-						zval_update_constant_ex(&zv, (void*)1, fptr->common.scope TSRMLS_CC);
-						if (Z_TYPE_P(zv) == IS_BOOL) {
+						if ((Z_TYPE_P(zv) & IS_CONSTANT_TYPE_MASK) == IS_CONSTANT) {
+							REALLOC_BUF_IF_EXCEED(buf, offset, length, Z_STRLEN_P(zv));
+							memcpy(offset, Z_STRVAL_P(zv), Z_STRLEN_P(zv));
+							offset += Z_STRLEN_P(zv);
+						} else if (Z_TYPE_P(zv) == IS_BOOL) {
 							if (Z_LVAL_P(zv)) {
 								memcpy(offset, "true", 4);
 								offset += 4;
@@ -3173,7 +3176,7 @@ static char * zend_get_function_declaration(zend_function *fptr TSRMLS_DC) /* {{
 								*(offset++) = '.';
 							}
 							*(offset++) = '\'';
-						} else if (Z_TYPE_P(zv) == IS_ARRAY) {
+						} else if (Z_TYPE_P(zv) == IS_ARRAY || (Z_TYPE_P(zv) & IS_CONSTANT_TYPE_MASK) == IS_CONSTANT_ARRAY) {
 							memcpy(offset, "Array", 5);
 							offset += 5;
 						} else {
@@ -5161,6 +5161,7 @@ ZEND_VM_HANDLER(153, ZEND_DECLARE_LAMBDA_FUNCTION, CONST, UNUSED)
 {
 	USE_OPLINE
 	zend_function *op_array;
+	int closure_is_static, closure_is_being_defined_inside_static_context;

 	SAVE_OPLINE();

@@ -5169,7 +5170,13 @@ ZEND_VM_HANDLER(153, ZEND_DECLARE_LAMBDA_FUNCTION, CONST, UNUSED)
 		zend_error_noreturn(E_ERROR, "Base lambda function for closure not found");
 	}

-	zend_create_closure(&EX_T(opline->result.var).tmp_var, op_array, EG(scope), EG(This) TSRMLS_CC);
+	closure_is_static = op_array->common.fn_flags & ZEND_ACC_STATIC;
+	closure_is_being_defined_inside_static_context = EX(prev_execute_data) && EX(prev_execute_data)->function_state.function->common.fn_flags & ZEND_ACC_STATIC;
+	if (closure_is_static || closure_is_being_defined_inside_static_context) {
+		zend_create_closure(&EX_T(opline->result.var).tmp_var, (zend_function *) op_array,  EG(called_scope), NULL TSRMLS_CC);
+	} else {
+		zend_create_closure(&EX_T(opline->result.var).tmp_var, (zend_function *) op_array,  EG(scope), EG(This) TSRMLS_CC);
+	}

 	CHECK_EXCEPTION();
 	ZEND_VM_NEXT_OPCODE();
@@ -5847,6 +5847,7 @@ static int ZEND_FASTCALL  ZEND_DECLARE_LAMBDA_FUNCTION_SPEC_CONST_UNUSED_HANDLER
 {
 	USE_OPLINE
 	zend_function *op_array;
+	int closure_is_static, closure_is_being_defined_inside_static_context;

 	SAVE_OPLINE();

@@ -5855,7 +5856,13 @@ static int ZEND_FASTCALL  ZEND_DECLARE_LAMBDA_FUNCTION_SPEC_CONST_UNUSED_HANDLER
 		zend_error_noreturn(E_ERROR, "Base lambda function for closure not found");
 	}

-	zend_create_closure(&EX_T(opline->result.var).tmp_var, op_array, EG(scope), EG(This) TSRMLS_CC);
+	closure_is_static = op_array->common.fn_flags & ZEND_ACC_STATIC;
+	closure_is_being_defined_inside_static_context = EX(prev_execute_data) && EX(prev_execute_data)->function_state.function->common.fn_flags & ZEND_ACC_STATIC;
+	if (closure_is_static || closure_is_being_defined_inside_static_context) {
+		zend_create_closure(&EX_T(opline->result.var).tmp_var, (zend_function *) op_array,  EG(called_scope), NULL TSRMLS_CC);
+	} else {
+		zend_create_closure(&EX_T(opline->result.var).tmp_var, (zend_function *) op_array,  EG(scope), EG(This) TSRMLS_CC);
+	}

 	CHECK_EXCEPTION();
 	ZEND_VM_NEXT_OPCODE();
@@ -1210,7 +1210,7 @@ function gen_vm($def, $skel) {
 		fputs($f,"#define $op $code\n");
 	}

-	fputs($f, "\n#endif");
+	fputs($f, "\n#endif\n");
 	fclose($f);
 	echo "zend_vm_opcodes.h generated successfully.\n";

@@ -165,4 +165,4 @@ ZEND_API const char *zend_get_opcode_name(zend_uchar opcode);
 #define ZEND_QM_ASSIGN_VAR                   157
 #define ZEND_JMP_SET_VAR                     158

-#endif
+#endif
@@ -1711,7 +1711,7 @@ int main(int argc, char *argv[])
 {
  FILE *fp;
  long position;
-  char *filename = "/tmp/phpglibccheck";
+  char *filename = tmpnam(NULL);
  
  fp = fopen(filename, "w");
  if (fp == NULL) {
@@ -1532,10 +1532,6 @@ dgux*)
  shlibpath_var=LD_LIBRARY_PATH
  ;;

-freebsd1*)
-  dynamic_linker=no
-  ;;
-
 freebsd* | dragonfly*)
  # DragonFly does not have aout.  When/if they implement a new
  # versioning mechanism, adjust this.
@@ -5842,10 +5838,6 @@ _LT_EOF
      _LT_AC_TAGVAR(hardcode_shlibpath_var, $1)=no
      ;;

-    freebsd1*)
-      _LT_AC_TAGVAR(ld_shlibs, $1)=no
-      ;;
-
    # FreeBSD 2.2.[012] allows us to include c++rt0.o to get C++ constructor
    # support.  Future versions do this automatically, but an explicit c++rt0.o
    # does not break anything, and helps significantly (at the cost of a little
@@ -119,8 +119,8 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=4
-PHP_RELEASE_VERSION=30
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=31
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -4,7 +4,7 @@
   +----------------------------------------------------------------------+
   | PHP Version 5                                                        |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1997-2013 The PHP Group                                |
+   | Copyright (c) 1997-2014 The PHP Group                                |
   +----------------------------------------------------------------------+
   | This source file is subject to version 3.01 of the PHP license,      |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | PHP Version 5                                                        |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1997-2013 The PHP Group                                |
+   | Copyright (c) 1997-2014 The PHP Group                                |
   +----------------------------------------------------------------------+
   | This source file is subject to version 3.01 of the PHP license,      |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2,7 +2,7 @@
   +----------------------------------------------------------------------+
   | PHP Version 5                                                        |
   +----------------------------------------------------------------------+
-   | Copyright (c) 1997-2013 The PHP Group                                |
+   | Copyright (c) 1997-2014 The PHP Group                                |
   +----------------------------------------------------------------------+
   | This source file is subject to version 3.01 of the PHP license,      |
   | that is bundled with this package in the file LICENSE, and is        |
@@ -2441,6 +2441,8 @@ PHPAPI int php_date_initialize(php_date_obj *dateobj, /*const*/ char *time_str,
 			err->error_messages[0].position, err->error_messages[0].character, err->error_messages[0].message);
 	}
 	if (err && err->error_count) {
+		timelib_time_dtor(dateobj->time);
+		dateobj->time = 0;
 		return 0;
 	}

@@ -2548,9 +2550,7 @@ PHP_METHOD(DateTime, __construct)

 	zend_replace_error_handling(EH_THROW, NULL, &error_handling TSRMLS_CC);
 	if (SUCCESS == zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|sO!", &time_str, &time_str_len, &timezone_object, date_ce_timezone)) {
-		if (!php_date_initialize(zend_object_store_get_object(getThis() TSRMLS_CC), time_str, time_str_len, NULL, timezone_object, 1 TSRMLS_CC)) {
-			ZVAL_NULL(getThis());
-		}
+		php_date_initialize(zend_object_store_get_object(getThis() TSRMLS_CC), time_str, time_str_len, NULL, timezone_object, 1 TSRMLS_CC);
 	}
 	zend_restore_error_handling(&error_handling TSRMLS_CC);
 }
@@ -1,5 +1,5 @@
 --TEST--
-Bug #67118 php-cgi crashes regularly on IIS 7
+Bug #67118 crashes in DateTime when this used after failed __construct
 --INI--
 date.timezone=Europe/Berlin
 --FILE--
@@ -11,17 +11,17 @@ class mydt extends datetime
 		if (!empty($tz) && !is_object($tz)) {
 			$tz = new DateTimeZone($tz);
 		}
-
-		@parent::__construct($time, $tz);
+		try {
+			@parent::__construct($time, $tz);
+		} catch (Exception $e) {
+			echo "Bad date" . $this->format("Y") . "\n";
+		}
 	}

 };

 new mydt("Funktionsansvarig rådgivning och juridik", "UTC");
+?>
 --EXPECTF--
-Fatal error: Uncaught exception 'Exception' with message 'DateTime::__construct(): Failed to parse time string (Funktionsansvarig rådgivning och juridik) at position 0 (F): The timezone could not be found in the database' in %sbug67118.php:%d
-Stack trace:
-#0 %sbug67118.php(%d): DateTime->__construct('Funktionsansvar...', Object(DateTimeZone))
-#1 %sbug67118.php(%d): mydt->__construct('Funktionsansvar...', 'UTC')
-#2 {main}
-  thrown in %sbug67118.php on line %d
+Warning: DateTime::format(): The DateTime object has not been correctly initialized by its constructor in %sbug67118.php on line %d
+Bad date
@@ -0,0 +1,35 @@
+--TEST--
+Regression introduce in fix for Bug #67118
+--INI--
+date.timezone=Europe/Paris
+--FILE--
+<?php
+class Foo extends DateTime {
+    public function __construct($time = null) {
+        $tz = new DateTimeZone('UTC');
+        try {
+            echo "First try\n";
+            parent::__construct($time, $tz);
+            return;
+        } catch (Exception $e) {
+            echo "Second try\n";
+            parent::__construct($time.'C', $tz);
+        }
+    }
+}
+$date = '12 Sep 2007 15:49:12 UT';
+var_dump(new Foo($date));
+?>
+Done
+--EXPECTF--
+First try
+Second try
+object(Foo)#1 (3) {
+  ["date"]=>
+  string(%d) "2007-09-12 15:49:%s"
+  ["timezone_type"]=>
+  int(3)
+  ["timezone"]=>
+  string(3) "UTC"
+}
+Done
@@ -12,6 +12,7 @@ require_once dirname(__FILE__) .'/skipif.inc';
 // reusing existing xml: http://cvs.php.net/viewvc.cgi/php-src/ext/dom/tests/dom.xml?view=co&content-type=text%2Fplain
 // reusing existing dtd: http://cvs.php.net/viewvc.cgi/php-src/ext/dom/tests/dom.ent?view=co&content-type=text%2Fplain
 $dom = new DOMDocument('1.0');
+$dom->substituteEntities = true;
 $dom->load(dirname(__FILE__).'/dom.xml');
 var_dump($dom->validate());
 ?>
@@ -7,18 +7,22 @@ require_once('skipif.inc');
 --FILE--
 <?php
 	$domDocument = new DOMDocument();
+	$domDocument->substituteEntities = true;
 	$domDocument->load(dirname(__FILE__) . DIRECTORY_SEPARATOR . "bug67081_0.xml");
 	var_dump($domDocument->doctype->internalSubset);

 	$domDocument = new DOMDocument();
+	$domDocument->substituteEntities = true;
 	$domDocument->load(dirname(__FILE__) . DIRECTORY_SEPARATOR . "bug67081_1.xml");
 	var_dump($domDocument->doctype->internalSubset);

 	$domDocument = new DOMDocument();
+	$domDocument->substituteEntities = true;
 	$domDocument->load(dirname(__FILE__) . DIRECTORY_SEPARATOR . "bug67081_2.xml");
 	var_dump($domDocument->doctype->internalSubset);

 	$domDocument = new DOMDocument();
+	$domDocument->substituteEntities = true;
 	$domDocument->load(dirname(__FILE__) . DIRECTORY_SEPARATOR . "dom.xml");
 	var_dump($domDocument->doctype->internalSubset);
 ?>
@@ -18,7 +18,7 @@ exif.encode_unicode=ISO-8859-1
  test4.jpg is a 1*1 image that contains Exif tags written by WindowsXP
 */
 $image  = exif_read_data(dirname(__FILE__).'/test4.jpg','',true,false);
-echo var_dump($image['WINXP']);
+var_dump($image['WINXP']);
 ?>
 --EXPECT--
 array(5) {
@@ -1,6 +1,6 @@
 diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 --- libmagic.orig/apprentice.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/apprentice.c	Fri Apr 11 12:36:52 2014
+++ libmagic/apprentice.c	Mon Apr 14 23:42:51 2014
@@ -29,6 +29,8 @@
  * apprentice - make one pass through /etc/magic, learning its secrets.
  */
@@ -833,7 +833,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 	}
 diff -u libmagic.orig/ascmagic.c libmagic/ascmagic.c
 --- libmagic.orig/ascmagic.c	Wed Oct 31 18:03:01 2012
-+++ libmagic/ascmagic.c	Mon Mar 10 16:40:55 2014
+++ libmagic/ascmagic.c	Mon Apr 14 23:42:51 2014
@@ -139,7 +139,7 @@
 		/* malloc size is a conservative overestimate; could be
 		   improved, or at least realloced after conversion. */
@@ -872,7 +872,7 @@ diff -u libmagic.orig/ascmagic.c libmagic/ascmagic.c
 }
 diff -u libmagic.orig/cdf.c libmagic/cdf.c
 --- libmagic.orig/cdf.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/cdf.c	Tue May 27 22:22:35 2014
+++ libmagic/cdf.c	Tue Jul  1 09:00:09 2014
@@ -43,7 +43,17 @@
 #include <err.h>
 #endif
@@ -891,7 +891,25 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
 #include <string.h>
 #include <time.h>
 #include <ctype.h>
-@@ -296,7 +306,10 @@
+@@ -267,13 +277,15 @@
+ {
+ 	const char *b = (const char *)sst->sst_tab;
+ 	const char *e = ((const char *)p) + tail;
+	size_t ss = sst->sst_dirlen < h->h_min_size_standard_stream ?
+	    CDF_SHORT_SEC_SIZE(h) : CDF_SEC_SIZE(h);
+ 	(void)&line;
+-	if (e >= b && (size_t)(e - b) <= CDF_SEC_SIZE(h) * sst->sst_len)
+	if (e >= b && (size_t)(e - b) <= ss * sst->sst_len)
+ 		return 0;
+ 	DPRINTF(("%d: offset begin %p < end %p || %" SIZE_T_FORMAT "u"
+ 	    " > %" SIZE_T_FORMAT "u [%" SIZE_T_FORMAT "u %"
+ 	    SIZE_T_FORMAT "u]\n", line, b, e, (size_t)(e - b),
+-	    CDF_SEC_SIZE(h) * sst->sst_len, CDF_SEC_SIZE(h), sst->sst_len));
+	    ss * sst->sst_len, ss, sst->sst_len));
+ 	errno = EFTYPE;
+ 	return -1;
+ }
+@@ -296,7 +308,10 @@
 	if (info->i_fd == -1)
 		return -1;
 
@@ -903,7 +921,54 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
 		return -1;
 
 	return (ssize_t)len;
-@@ -810,6 +823,10 @@
+@@ -352,10 +367,10 @@
+ 	size_t ss = CDF_SHORT_SEC_SIZE(h);
+ 	size_t pos = CDF_SHORT_SEC_POS(h, id);
+ 	assert(ss == len);
+-	if (pos > CDF_SEC_SIZE(h) * sst->sst_len) {
+	if (pos + len > CDF_SEC_SIZE(h) * sst->sst_len) {
+ 		DPRINTF(("Out of bounds read %" SIZE_T_FORMAT "u > %"
+ 		    SIZE_T_FORMAT "u\n",
+-		    pos, CDF_SEC_SIZE(h) * sst->sst_len));
+		    pos + len, CDF_SEC_SIZE(h) * sst->sst_len));
+ 		return -1;
+ 	}
+ 	(void)memcpy(((char *)buf) + offs,
+@@ -455,7 +470,8 @@
+ cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size)
+ {
+ 	size_t i, j;
+-	cdf_secid_t maxsector = (cdf_secid_t)(sat->sat_len * size);
+	cdf_secid_t maxsector = (cdf_secid_t)((sat->sat_len * size)
+	    / sizeof(maxsector));
+ 
+ 	DPRINTF(("Chain:"));
+ 	for (j = i = 0; sid >= 0; i++, j++) {
+@@ -465,8 +481,8 @@
+ 			errno = EFTYPE;
+ 			return (size_t)-1;
+ 		}
+-		if (sid > maxsector) {
+-			DPRINTF(("Sector %d > %d\n", sid, maxsector));
+		if (sid >= maxsector) {
+			DPRINTF(("Sector %d >= %d\n", sid, maxsector));
+ 			errno = EFTYPE;
+ 			return (size_t)-1;
+ 		}
+@@ -796,7 +812,11 @@
+ 	if (cdf_check_stream_offset(sst, h, e, 0, __LINE__) == -1)
+ 		goto out;
+ 	for (i = 0; i < sh.sh_properties; i++) {
+-		size_t ofs = CDF_GETUINT32(p, (i << 1) + 1);
+		size_t ofs, tail = (i << 1) + 1;
+		if (cdf_check_stream_offset(sst, h, p, tail * sizeof(uint32_t),
+		    __LINE__) == -1)
+			goto out;
+		ofs = CDF_GETUINT32(p, tail);
+ 		q = (const uint8_t *)(const void *)
+ 		    ((const char *)(const void *)p + ofs
+ 		    - 2 * sizeof(uint32_t));
+@@ -810,6 +830,10 @@
 		    i, inp[i].pi_id, inp[i].pi_type, q - p, offs));
 		if (inp[i].pi_type & CDF_VECTOR) {
 			nelements = CDF_GETUINT32(q, 1);
@@ -914,7 +979,7 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
 			o = 2;
 		} else {
 			nelements = 1;
-@@ -884,7 +901,9 @@
+@@ -884,7 +908,9 @@
 			}
 			DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n",
 			    nelements));
@@ -925,7 +990,7 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
 				uint32_t l = CDF_GETUINT32(q, o);
 				inp[i].pi_str.s_len = l;
 				inp[i].pi_str.s_buf = (const char *)
-@@ -929,7 +948,7 @@
+@@ -929,7 +955,7 @@
 cdf_unpack_summary_info(const cdf_stream_t *sst, const cdf_header_t *h,
     cdf_summary_info_header_t *ssi, cdf_property_info_t **info, size_t *count)
 {
@@ -934,7 +999,7 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
 	const cdf_summary_info_header_t *si =
 	    CAST(const cdf_summary_info_header_t *, sst->sst_tab);
 	const cdf_section_declaration_t *sd =
-@@ -944,21 +963,13 @@
+@@ -944,21 +970,13 @@
 	ssi->si_os = CDF_TOLE2(si->si_os);
 	ssi->si_class = si->si_class;
 	cdf_swap_class(&ssi->si_class);
@@ -959,7 +1024,7 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
 	return 0;
 }
 
-@@ -1132,7 +1143,7 @@
+@@ -1132,7 +1150,7 @@
 	cdf_directory_t *d;
 	char name[__arraycount(d->d_name)];
 	cdf_stream_t scn;
@@ -968,7 +1033,7 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
 
 	static const char *types[] = { "empty", "user storage",
 	    "user stream", "lockbytes", "property", "root storage" };
-@@ -1185,7 +1196,7 @@
+@@ -1185,7 +1203,7 @@
 cdf_dump_property_info(const cdf_property_info_t *info, size_t count)
 {
 	cdf_timestamp_t tp;
@@ -977,7 +1042,7 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
 	char buf[64];
 	size_t i, j;
 
-@@ -1229,7 +1240,11 @@
+@@ -1229,7 +1247,11 @@
 			break;
 		case CDF_FILETIME:
 			tp = info[i].pi_tp;
@@ -991,7 +1056,7 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
 			} else {
 diff -u libmagic.orig/cdf.h libmagic/cdf.h
 --- libmagic.orig/cdf.h	Wed Oct 31 18:03:01 2012
-+++ libmagic/cdf.h	Mon Dec  2 15:25:29 2013
+++ libmagic/cdf.h	Mon Apr 14 23:32:55 2014
@@ -35,10 +35,12 @@
 #ifndef _H_CDF_
 #define _H_CDF_
@@ -1034,7 +1099,7 @@ diff -u libmagic.orig/cdf.h libmagic/cdf.h
 void cdf_unpack_header(cdf_header_t *, char *);
 diff -u libmagic.orig/cdf_time.c libmagic/cdf_time.c
 --- libmagic.orig/cdf_time.c	Wed Oct 31 18:03:01 2012
-+++ libmagic/cdf_time.c	Mon Dec  2 15:25:29 2013
+++ libmagic/cdf_time.c	Mon Apr 14 23:32:55 2014
@@ -96,7 +96,7 @@
 }
 
@@ -1094,7 +1159,7 @@ diff -u libmagic.orig/cdf_time.c libmagic/cdf_time.c
 	static const char *ref = "Sat Apr 23 01:30:00 1977";
 diff -u libmagic.orig/compress.c libmagic/compress.c
 --- libmagic.orig/compress.c	Sun Jan  6 21:35:43 2013
-+++ libmagic/compress.c	Mon Dec  2 15:25:29 2013
+++ libmagic/compress.c	Mon Apr 14 23:42:51 2014
@@ -32,6 +32,7 @@
  *	uncompress(method, old, n, newch) - uncompress old into new, 
  *					    using method, return sizeof new
@@ -1257,7 +1322,7 @@ diff -u libmagic.orig/compress.c libmagic/compress.c
 +#endif /* if PHP_FILEINFO_UNCOMPRESS */
 diff -u libmagic.orig/file.h libmagic/file.h
 --- libmagic.orig/file.h	Mon Feb 18 16:40:59 2013
-+++ libmagic/file.h	Mon Mar 10 16:40:55 2014
+++ libmagic/file.h	Mon Apr 14 23:42:51 2014
@@ -33,11 +33,9 @@
 #ifndef __file_h__
 #define __file_h__
@@ -1467,7 +1532,7 @@ diff -u libmagic.orig/file.h libmagic/file.h
 #endif /* __file_h__ */
 diff -u libmagic.orig/fsmagic.c libmagic/fsmagic.c
 --- libmagic.orig/fsmagic.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/fsmagic.c	Mon Dec  2 15:25:29 2013
+++ libmagic/fsmagic.c	Mon Apr 14 23:42:51 2014
@@ -59,27 +59,21 @@
 # define minor(dev)  ((dev) & 0xff)
 #endif
@@ -1834,7 +1899,7 @@ diff -u libmagic.orig/fsmagic.c libmagic/fsmagic.c
 }
 diff -u libmagic.orig/funcs.c libmagic/funcs.c
 --- libmagic.orig/funcs.c	Wed Oct 31 18:03:01 2012
-+++ libmagic/funcs.c	Mon Mar 10 16:40:55 2014
+++ libmagic/funcs.c	Mon Apr 14 23:42:51 2014
@@ -41,52 +41,42 @@
 #if defined(HAVE_WCTYPE_H)
 #include <wctype.h>
@@ -2128,7 +2193,7 @@ diff -u libmagic.orig/funcs.c libmagic/funcs.c
 +
 diff -u libmagic.orig/magic.c libmagic/magic.c
 --- libmagic.orig/magic.c	Fri Jan 11 17:43:09 2013
-+++ libmagic/magic.c	Mon Dec  2 15:29:02 2013
+++ libmagic/magic.c	Mon Apr 14 23:42:51 2014
@@ -25,11 +25,6 @@
  * SUCH DAMAGE.
  */
@@ -2472,7 +2537,7 @@ diff -u libmagic.orig/magic.c libmagic/magic.c
 magic_error(struct magic_set *ms)
 diff -u libmagic.orig/magic.h libmagic/magic.h
 --- libmagic.orig/magic.h	Thu Mar 21 18:52:42 2013
-+++ libmagic/magic.h	Mon Dec  2 15:25:29 2013
+++ libmagic/magic.h	Mon Apr 14 23:42:51 2014
@@ -87,6 +87,7 @@
 
 const char *magic_getpath(const char *, int);
@@ -2491,14 +2556,14 @@ diff -u libmagic.orig/magic.h libmagic/magic.h
 
 diff -u libmagic.orig/print.c libmagic/print.c
 --- libmagic.orig/print.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/print.c	Mon Dec  2 15:29:02 2013
-@@ -28,13 +28,17 @@
- /*
+++ libmagic/print.c	Mon Apr 14 23:42:51 2014
+@@ -29,12 +29,17 @@
  * print.c - debugging printout routines
  */
+ 
 +#define _GNU_SOURCE
 +#include "php.h"
- 
+
 #include "file.h"
 +#include "cdf.h"
 
@@ -2510,7 +2575,7 @@ diff -u libmagic.orig/print.c libmagic/print.c
 #include <string.h>
 #include <stdarg.h>
 #include <stdlib.h>
-@@ -43,188 +47,28 @@
+@@ -43,188 +48,28 @@
 #endif
 #include <time.h>
 
@@ -2711,7 +2776,7 @@ diff -u libmagic.orig/print.c libmagic/print.c
 }
 
 protected const char *
-@@ -235,7 +79,7 @@
+@@ -235,7 +80,7 @@
 	struct tm *tm;
 
 	if (flags & FILE_T_WINDOWS) {
@@ -2722,7 +2787,7 @@ diff -u libmagic.orig/print.c libmagic/print.c
 	}
 diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
 --- libmagic.orig/readcdf.c	Wed Oct 31 18:03:01 2012
-+++ libmagic/readcdf.c	Thu Apr 24 19:54:40 2014
+++ libmagic/readcdf.c	Tue May 27 22:17:37 2014
@@ -30,7 +30,11 @@
 #endif
 
@@ -2798,7 +2863,7 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
 			    return -1;
 diff -u libmagic.orig/readelf.c libmagic/readelf.c
 --- libmagic.orig/readelf.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/readelf.c	Mon Dec  2 15:25:29 2013
+++ libmagic/readelf.c	Mon Apr 14 23:42:51 2014
@@ -48,8 +48,8 @@
 private int dophn_exec(struct magic_set *, int, int, int, off_t, int, size_t,
     off_t, int *, int);
@@ -3050,7 +3115,7 @@ diff -u libmagic.orig/readelf.c libmagic/readelf.c
 	if (fstat(fd, &st) == -1) {
 diff -u libmagic.orig/readelf.h libmagic/readelf.h
 --- libmagic.orig/readelf.h	Thu Mar 21 18:45:14 2013
-+++ libmagic/readelf.h	Mon Dec  2 15:25:29 2013
+++ libmagic/readelf.h	Mon Apr 14 23:42:51 2014
@@ -44,9 +44,17 @@
 typedef uint32_t	Elf32_Word;
 typedef uint8_t		Elf32_Char;
@@ -3071,7 +3136,7 @@ diff -u libmagic.orig/readelf.h libmagic/readelf.h
 typedef uint8_t		Elf64_Char;
 diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 --- libmagic.orig/softmagic.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/softmagic.c	Mon Mar 10 16:40:55 2014
+++ libmagic/softmagic.c	Tue Jul  1 09:00:09 2014
@@ -41,6 +41,11 @@
 #include <stdlib.h>
 #include <time.h>
@@ -3221,7 +3286,29 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 			break; \
 		} \
 
-@@ -1145,9 +1130,6 @@
+@@ -896,10 +881,18 @@
+ 		return 1;
+ 	}
+ 	case FILE_PSTRING: {
+-		char *ptr1 = p->s, *ptr2 = ptr1 + file_pstring_length_size(m);
+		size_t sz = file_pstring_length_size(m);
+		char *ptr1 = p->s, *ptr2 = ptr1 + sz;
+ 		size_t len = file_pstring_get_length(m, ptr1);
+-		if (len >= sizeof(p->s))
+-			len = sizeof(p->s) - 1;
+		if (len >= sizeof(p->s)) {
+			/*
+			 * The size of the pascal string length (sz)
+			 * is 1, 2, or 4. We need at least 1 byte for NUL
+			 * termination, but we've already truncated the
+			 * string by p->s, so we need to deduct sz.
+			 */ 
+			len = sizeof(p->s) - sz;
+		}
+ 		while (len--)
+ 			*ptr1++ = *ptr2++;
+ 		*ptr1 = '\0';
+@@ -1145,9 +1138,6 @@
 		    "nbytes=%zu, count=%u)\n", m->type, m->flag, offset, o,
 		    nbytes, count);
 		mdebug(offset, (char *)(void *)p, sizeof(union VALUETYPE));
@@ -3231,7 +3318,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 	}
 
 	if (m->flag & INDIR) {
-@@ -1191,7 +1173,7 @@
+@@ -1191,7 +1181,7 @@
 		}
 		switch (cvt_flip(m->in_type, flip)) {
 		case FILE_BYTE:
@@ -3240,7 +3327,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1226,7 +1208,7 @@
+@@ -1226,7 +1216,7 @@
 				offset = ~offset;
 			break;
 		case FILE_BESHORT:
@@ -3249,7 +3336,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1278,7 +1260,7 @@
+@@ -1278,7 +1268,7 @@
 				offset = ~offset;
 			break;
 		case FILE_LESHORT:
@@ -3258,7 +3345,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1330,7 +1312,7 @@
+@@ -1330,7 +1320,7 @@
 				offset = ~offset;
 			break;
 		case FILE_SHORT:
@@ -3267,7 +3354,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1367,7 +1349,7 @@
+@@ -1367,7 +1357,7 @@
 			break;
 		case FILE_BELONG:
 		case FILE_BEID3:
@@ -3276,7 +3363,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1438,7 +1420,7 @@
+@@ -1438,7 +1428,7 @@
 			break;
 		case FILE_LELONG:
 		case FILE_LEID3:
@@ -3285,7 +3372,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1508,7 +1490,7 @@
+@@ -1508,7 +1498,7 @@
 				offset = ~offset;
 			break;
 		case FILE_MELONG:
@@ -3294,7 +3381,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1578,7 +1560,7 @@
+@@ -1578,7 +1568,7 @@
 				offset = ~offset;
 			break;
 		case FILE_LONG:
@@ -3303,7 +3390,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1644,23 +1626,20 @@
+@@ -1644,23 +1634,20 @@
 		if ((ms->flags & MAGIC_DEBUG) != 0) {
 			mdebug(offset, (char *)(void *)p,
 			    sizeof(union VALUETYPE));
@@ -3329,7 +3416,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 			return 0;
 		break;
 
-@@ -1679,38 +1658,40 @@
+@@ -1679,38 +1666,40 @@
 	case FILE_FLOAT:
 	case FILE_BEFLOAT:
 	case FILE_LEFLOAT:
@@ -3376,7 +3463,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 		if ((ms->flags & MAGIC_DEBUG) != 0)
 			fprintf(stderr, "indirect @offs=%u[%d]\n", offset, rv);
 		rbuf = ms->o.buf;
-@@ -1718,16 +1699,26 @@
+@@ -1718,16 +1707,26 @@
 		ms->offset = soffset;
 		if (rv == 1) {
 			if ((ms->flags & (MAGIC_MIME|MAGIC_APPLE)) == 0 &&
@@ -3407,7 +3494,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 			return 0;
 		sbuf = m->value.s;
 		if (*sbuf == '^') {
-@@ -1837,6 +1828,42 @@
+@@ -1837,6 +1836,42 @@
 	return file_strncmp(a, b, len, flags);
 }
 
@@ -3450,7 +3537,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 private int
 magiccheck(struct magic_set *ms, struct magic *m)
 {
-@@ -1996,69 +2023,157 @@
+@@ -1996,69 +2031,157 @@
 		break;
 	}
 	case FILE_REGEX: {
@@ -3663,4 +3750,3 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 	default:
 		file_magerror(ms, "invalid type %d in magiccheck()", m->type);
 		return -1;
-
@@ -277,13 +277,15 @@ cdf_check_stream_offset(const cdf_stream_t *sst, const cdf_header_t *h,
 {
 	const char *b = (const char *)sst->sst_tab;
 	const char *e = ((const char *)p) + tail;
+	size_t ss = sst->sst_dirlen < h->h_min_size_standard_stream ?
+	    CDF_SHORT_SEC_SIZE(h) : CDF_SEC_SIZE(h);
 	(void)&line;
-	if (e >= b && (size_t)(e - b) <= CDF_SEC_SIZE(h) * sst->sst_len)
+	if (e >= b && (size_t)(e - b) <= ss * sst->sst_len)
 		return 0;
 	DPRINTF(("%d: offset begin %p < end %p || %" SIZE_T_FORMAT "u"
 	    " > %" SIZE_T_FORMAT "u [%" SIZE_T_FORMAT "u %"
 	    SIZE_T_FORMAT "u]\n", line, b, e, (size_t)(e - b),
-	    CDF_SEC_SIZE(h) * sst->sst_len, CDF_SEC_SIZE(h), sst->sst_len));
+	    ss * sst->sst_len, ss, sst->sst_len));
 	errno = EFTYPE;
 	return -1;
 }
@@ -468,7 +470,8 @@ size_t
 cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size)
 {
 	size_t i, j;
-	cdf_secid_t maxsector = (cdf_secid_t)(sat->sat_len * size);
+	cdf_secid_t maxsector = (cdf_secid_t)((sat->sat_len * size)
+	    / sizeof(maxsector));

 	DPRINTF(("Chain:"));
 	for (j = i = 0; sid >= 0; i++, j++) {
@@ -478,8 +481,8 @@ cdf_count_chain(const cdf_sat_t *sat, cdf_secid_t sid, size_t size)
 			errno = EFTYPE;
 			return (size_t)-1;
 		}
-		if (sid > maxsector) {
-			DPRINTF(("Sector %d > %d\n", sid, maxsector));
+		if (sid >= maxsector) {
+			DPRINTF(("Sector %d >= %d\n", sid, maxsector));
 			errno = EFTYPE;
 			return (size_t)-1;
 		}
@@ -809,7 +812,11 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 	if (cdf_check_stream_offset(sst, h, e, 0, __LINE__) == -1)
 		goto out;
 	for (i = 0; i < sh.sh_properties; i++) {
-		size_t ofs = CDF_GETUINT32(p, (i << 1) + 1);
+		size_t ofs, tail = (i << 1) + 1;
+		if (cdf_check_stream_offset(sst, h, p, tail * sizeof(uint32_t),
+		    __LINE__) == -1)
+			goto out;
+		ofs = CDF_GETUINT32(p, tail);
 		q = (const uint8_t *)(const void *)
 		    ((const char *)(const void *)p + ofs
 		    - 2 * sizeof(uint32_t));
@@ -881,10 +881,18 @@ mconvert(struct magic_set *ms, struct magic *m, int flip)
 		return 1;
 	}
 	case FILE_PSTRING: {
-		char *ptr1 = p->s, *ptr2 = ptr1 + file_pstring_length_size(m);
+		size_t sz = file_pstring_length_size(m);
+		char *ptr1 = p->s, *ptr2 = ptr1 + sz;
 		size_t len = file_pstring_get_length(m, ptr1);
-		if (len >= sizeof(p->s))
-			len = sizeof(p->s) - 1;
+		if (len >= sizeof(p->s)) {
+			/*
+			 * The size of the pascal string length (sz)
+			 * is 1, 2, or 4. We need at least 1 byte for NUL
+			 * termination, but we've already truncated the
+			 * string by p->s, so we need to deduct sz.
+			 */ 
+			len = sizeof(p->s) - sz;
+		}
 		while (len--)
 			*ptr1++ = *ptr2++;
 		*ptr1 = '\0';
@@ -0,0 +1,22 @@
+--TEST--
+Bug #67296 (filter_input doesn't validate variables)
+--XFAIL--
+See Bug #49184
+--SKIPIF--
+<?php if (!extension_loaded("filter")) die("skip needs filter ext"); ?>
+--ENV--
+return <<<END
+HTTP_X_FORWARDED_FOR=example.com
+END;
+--FILE--
+<?php
+  var_dump(filter_input(INPUT_SERVER, "HTTP_X_FORWARDED_FOR", FILTER_UNSAFE_RAW));
+  var_dump($_SERVER["HTTP_X_FORWARDED_FOR"]);
+  var_dump(getenv("HTTP_X_FORWARDED_FOR"));
+  var_dump("done");
+?>
+--EXPECT--
+string(11) "example.com"
+string(11) "example.com"
+string(11) "example.com"
+string(4) "done"
@@ -18,5 +18,5 @@ var_dump(ftp_login($ftp, 'user', 'pass'));
 ftp_close($ftp);
 ?>
 --EXPECTF--
-Warning: ftp_login(): bogus msg in %sbug37799.php on line 8
+Warning: ftp_login(): %rdummy|bogus msg%r in %sbug37799.php on line 8
 bool(false)
@@ -73,7 +73,9 @@ PHP_FUNCTION( numfmt_parse )
 	}

 #if ICU_LOCALE_BUG && defined(LC_NUMERIC)
-	oldlocale = setlocale(LC_NUMERIC, "C");
+	/* need to copy here since setlocale may change it later */
+	oldlocale = estrdup(setlocale(LC_NUMERIC, NULL));
+	setlocale(LC_NUMERIC, "C");
 #endif

 	switch(type) {
@@ -100,6 +102,7 @@ PHP_FUNCTION( numfmt_parse )
 	}
 #if ICU_LOCALE_BUG && defined(LC_NUMERIC)
 	setlocale(LC_NUMERIC, oldlocale);
+	efree(oldlocale);
 #endif
 	if(zposition) {
 		zval_dtor(zposition);
@@ -272,8 +272,7 @@ static char* get_icu_value_internal( char* loc_name , char* tag_name, int* resul
 		grOffset =  findOffset( LOC_GRANDFATHERED , loc_name );
 		if( grOffset >= 0 ){
 			if( strcmp(tag_name , LOC_LANG_TAG)==0 ){
-				tag_value = estrdup(loc_name);
-				return tag_value;
+				return estrdup(loc_name);
 			} else {
 				/* Since Grandfathered , no value , do nothing , retutn NULL */
 				return NULL;
@@ -283,8 +282,8 @@ static char* get_icu_value_internal( char* loc_name , char* tag_name, int* resul
 	if( fromParseLocale==1 ){
 		/* Handle singletons */
 		if( strcmp(tag_name , LOC_LANG_TAG)==0 ){
-			if( strlen(loc_name)>1 && (isIDPrefix(loc_name) ==1 ) ){
-				return loc_name;
+			if( strlen(loc_name)>1 && isIDPrefix(loc_name) ){
+				return estrdup(loc_name);
 			}
 		}

@@ -501,8 +500,16 @@ static void get_icu_disp_value_src_php( char* tag_name, INTERNAL_FUNCTION_PARAME
 		RETURN_FALSE;
 	}

+    if(loc_name_len > ULOC_FULLNAME_CAPACITY) {
+        /* See bug 67397: overlong locale names cause trouble in uloc_getDisplayName */
+		spprintf(&msg , 0, "locale_get_display_%s : name too long", tag_name );
+		intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR,  msg , 1 TSRMLS_CC );
+		efree(msg);
+		RETURN_FALSE;
+    }
+
 	if(loc_name_len == 0) {
-	loc_name = INTL_G(default_locale);
+        loc_name = INTL_G(default_locale);
 	}

 	if( strcmp(tag_name, DISP_NAME) != 0 ){
@@ -15,6 +15,7 @@ function ut_main()
 	setlocale(LC_ALL, $de_locale);
 	$fmt = new NumberFormatter("de", NumberFormatter::DECIMAL );
 	$numeric = $fmt->parse("1234,56");
+	setlocale(LC_ALL, "C"); // reset for printing
 	$res_str .= "$numeric\n";
    	return $res_str;
 }
@@ -10,6 +10,7 @@ var_dump(locale_get_display_name(str_repeat("a", 300), null));
 var_dump(locale_get_display_name(str_repeat("a", 512), null));
 var_dump(locale_get_display_name(str_repeat("a", 600), null));
 --EXPECT--
-string(300) "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-string(512) "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-string(600) "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+bool(false)
+bool(false)
+bool(false)
+
@@ -0,0 +1,25 @@
+--TEST--
+Bug #67052 - NumberFormatter::parse() resets LC_NUMERIC setting
+--SKIPIF--
+<?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?>
+--FILE--
+<?php
+
+function ut_main()
+{
+	setlocale(LC_ALL, 'de_DE');
+
+	$fmt = new NumberFormatter( 'sl_SI.UTF-8', NumberFormatter::DECIMAL);
+	$num = "1.234.567,891";
+	$res_str =  $fmt->parse($num)."\n";
+	$res_str .=  setlocale(LC_NUMERIC, 0);
+    	return $res_str;
+}
+
+include_once( 'ut_common.inc' );
+ut_run();
+
+?>
+--EXPECT--
+1234567,891
+de_DE
@@ -0,0 +1,21 @@
+--TEST--
+Bug #67397 (Buffer overflow in locale_get_display_name->uloc_getDisplayName (libicu 4.8.1))
+--SKIPIF--
+<?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?>
+--FILE--
+<?php
+
+function ut_main()
+{
+    $ret = var_export(ut_loc_get_display_name(str_repeat('*', 256), 'en_us'), true);
+    $ret .= "\n";
+    $ret .= var_export(intl_get_error_message(), true);
+    return $ret;
+}
+
+include_once( 'ut_common.inc' );
+ut_run();
+?>
+--EXPECTF--
+false
+'locale_get_display_name : name too long: U_ILLEGAL_ARGUMENT_ERROR'
@@ -63,7 +63,8 @@ function ut_main()
 //Some Invalid Tags:
        'de-419-DE',
        'a-DE',
-        'ar-a-aaa-b-bbb-a-ccc'
+        'ar-a-aaa-b-bbb-a-ccc',
+	'x-AAAAAA',
    );


@@ -201,3 +202,6 @@ No values found from Locale parsing.
 ---------------------
 ar-a-aaa-b-bbb-a-ccc:
 language : 'ar' ,
+---------------------
+x-AAAAAA:
+private0 : 'AAAAAA' ,
@@ -37,6 +37,7 @@ libxml_set_external_entity_loader(
 );

 $dd = new DOMDocument;
+$dd->substituteEntities = true;
 $dd->resolveExternals = true;
 $r = $dd->loadXML($xml);
 var_dump($dd->validate());
@@ -30,7 +30,7 @@ require_once("clean_table.inc");
 ?>
 --EXPECTF--
 I don\'t mind character sets, do I?\n
-Warning: mysql_query(): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'BOGUS_SQL' at line 1 in %s on line %d
+Warning: mysql_query(): You have an error in your SQL syntax; check the manual that corresponds to your %s server version for the right syntax to use near 'BOGUS_SQL' at line 1 in %s on line %d
 done!

 Warning: Unknown: 1 result set(s) not freed. Use mysql_free_result to free result sets which were requested using mysql_query() in %s on line %d
@@ -110,5 +110,5 @@ require_once('skipifconnectfailure.inc');
 	print "done!";
 ?>
 --EXPECTF--
-Warning: mysqli_query(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'NO_SQL' at line 1 in %s on line %d
+Warning: mysqli_query(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your %s server version for the right syntax to use near 'NO_SQL' at line 1 in %s on line %d
 done!
@@ -287,21 +287,21 @@ require_once('skipifconnectfailure.inc');
 	require_once("clean_table.inc");
 ?>
 --EXPECTF--
-Warning: mysqli_multi_query(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'BAR; FOO' at line 1 in %s on line %d
+Warning: mysqli_multi_query(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your %s server version for the right syntax to use near 'BAR; FOO' at line 1 in %s on line %d

-Warning: mysqli_query(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'FOO' at line 1 in %s on line %d
+Warning: mysqli_query(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your %s server version for the right syntax to use near 'FOO' at line 1 in %s on line %d

 Warning: mysqli_change_user(): (%d/%d): Access denied for user '%s'@'%s' (using password: %s) in %s on line %d

 Warning: mysqli_kill(): processid should have positive value in %s on line %d

-Warning: mysqli_prepare(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'FOO' at line 1 in %s on line %d
+Warning: mysqli_prepare(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your %s server version for the right syntax to use near 'FOO' at line 1 in %s on line %d

-Warning: mysqli_real_query(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'FOO' at line 1 in %s on line %d
+Warning: mysqli_real_query(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your %s server version for the right syntax to use near 'FOO' at line 1 in %s on line %d

 Warning: mysqli_kill(): processid should have positive value in %s on line %d

-Warning: mysqli_stmt_prepare(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'FOO' at line 1 in %s on line %d
+Warning: mysqli_stmt_prepare(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your %s server version for the right syntax to use near 'FOO' at line 1 in %s on line %d
 [013] Access denied for user '%s'@'%s' (using password: YES)
 [016] Access denied for user '%s'@'%s' (using password: YES)
 done!
@@ -97,15 +97,15 @@ require_once('skipifconnectfailure.inc');
 	require_once("clean_table.inc");
 ?>
 --EXPECTF--
-Warning: mysqli_multi_query(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'BAR; FOO' at line 1 in %s on line %d
+Warning: mysqli_multi_query(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your %s server version for the right syntax to use near 'BAR; FOO' at line 1 in %s on line %d

-Warning: mysqli_query(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'FOO' at line 1 in %s on line %d
+Warning: mysqli_query(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your %s server version for the right syntax to use near 'FOO' at line 1 in %s on line %d

 Warning: mysqli_change_user(): (%d/%d): Access denied for user '%s'@'%s' (using password: %s) in %s on line %d

 Warning: mysqli_kill(): processid should have positive value in %s on line %d

-Warning: mysqli_real_query(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'FOO' at line 1 in %s on line %d
+Warning: mysqli_real_query(): (%d/%d): You have an error in your SQL syntax; check the manual that corresponds to your %s server version for the right syntax to use near 'FOO' at line 1 in %s on line %d

 Warning: mysqli_kill(): processid should have positive value in %s on line %d
 [011] Access denied for user '%s'@'%s' (using password: YES)
@@ -649,7 +649,7 @@ static time_t asn1_time_to_time_t(ASN1_UTCTIME * timestr TSRMLS_DC) /* {{{ */
 	char * thestr;
 	long gmadjust = 0;

-	if (ASN1_STRING_type(timestr) != V_ASN1_UTCTIME) {
+	if (ASN1_STRING_type(timestr) != V_ASN1_UTCTIME && ASN1_STRING_type(timestr) != V_ASN1_GENERALIZEDTIME) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "illegal ASN1 data type for timestamp");
 		return (time_t)-1;
 	}
@@ -664,6 +664,11 @@ static time_t asn1_time_to_time_t(ASN1_UTCTIME * timestr TSRMLS_DC) /* {{{ */
 		return (time_t)-1;
 	}

+	if (ASN1_STRING_type(timestr) == V_ASN1_GENERALIZEDTIME && ASN1_STRING_length(timestr) < 15) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "unable to parse time string %s correctly", timestr->data);
+		return (time_t)-1;
+	}
+
 	strbuf = estrdup((char *)ASN1_STRING_data(timestr));

 	memset(&thetime, 0, sizeof(thetime));
@@ -685,14 +690,21 @@ static time_t asn1_time_to_time_t(ASN1_UTCTIME * timestr TSRMLS_DC) /* {{{ */
 	*thestr = '\0';
 	thestr -= 2;
 	thetime.tm_mon = atoi(thestr)-1;
-	*thestr = '\0';
-	thestr -= 2;
-	thetime.tm_year = atoi(thestr);

-	if (thetime.tm_year < 68) {
-		thetime.tm_year += 100;
+	*thestr = '\0';
+	if( ASN1_STRING_type(timestr) == V_ASN1_UTCTIME ) {
+		thestr -= 2;
+		thetime.tm_year = atoi(thestr);
+
+		if (thetime.tm_year < 68) {
+			thetime.tm_year += 100;
+		}
+	} else if( ASN1_STRING_type(timestr) == V_ASN1_GENERALIZEDTIME ) {
+		thestr -= 4;
+		thetime.tm_year = atoi(thestr) - 1900;
 	}

+
 	thetime.tm_isdst = -1;
 	ret = mktime(&thetime);

@@ -0,0 +1,28 @@
+-----BEGIN CERTIFICATE-----
+MIIEsTCCA5mgAwIBAgIQdwrGwrpRpBwdXS+ZsmsMGjANBgkqhkiG9w0BAQUFADA+
+MQswCQYDVQQGEwJQTDEbMBkGA1UEChMSVW5pemV0byBTcC4geiBvLm8uMRIwEAYD
+VQQDEwlDZXJ0dW0gQ0EwIhgPMjAwOTAzMDMxMjUzMThaGA8yMDI0MDMwMzEyNTMx
+OFowdzELMAkGA1UEBhMCUEwxIjAgBgNVBAoTGVVuaXpldG8gVGVjaG5vbG9naWVz
+IFMuQS4xJzAlBgNVBAsTHkNlcnR1bSBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTEb
+MBkGA1UEAxMSQ2VydHVtIExldmVsIElJIENBMIIBIjANBgkqhkiG9w0BAQEFAAOC
+AQ8AMIIBCgKCAQEA4LE0Ixw8h5Lper9tHVtZkWIujxYsPVgUZABeZZgQsKTdJjaG
+VP64B/oiEV5Hd3AxRqaZ7dRRsf4Pg/PSS/2mHRQQ/SH3XACbrDHmucDvYgtU/WoZ
+yp9d6PXVPY4j7J5t/52s+EbZD5swSuQLGjZ9iwg9sXX3JdJ9Ty+B3z80oiajpK0B
+wqAxrcX3DekEOknj7LkAOK6iuQKI85REj4IVb9kD7KKIWdISGbfL4Ezh/TP51e0L
+/WhTJ7lHbHbRzFfPU/oi3Qyt5tEexrPKe+6N+Jrejdb5Ya7Ne3tKujDU7KlbO+dn
+pzFH7VHkBPJcQJ7QUrprPaqVsVg3JJ1PXTqVnwIDAQABo4IBbDCCAWgwDwYDVR0T
+AQH/BAUwAwEB/zAdBgNVHQ4EFgQUgGIR3sBrpxDhCPBVtDCDv/qPCGAwUgYDVR0j
+BEswSaFCpEAwPjELMAkGA1UEBhMCUEwxGzAZBgNVBAoTElVuaXpldG8gU3AuIHog
+by5vLjESMBAGA1UEAxMJQ2VydHVtIENBggMBACAwDgYDVR0PAQH/BAQDAgEGMCwG
+A1UdHwQlMCMwIaAfoB2GG2h0dHA6Ly9jcmwuY2VydHVtLnBsL2NhLmNybDBoBggr
+BgEFBQcBAQRcMFowKAYIKwYBBQUHMAGGHGh0dHA6Ly9zdWJjYS5vY3NwLWNlcnR1
+bS5jb20wLgYIKwYBBQUHMAKGImh0dHA6Ly9yZXBvc2l0b3J5LmNlcnR1bS5wbC9j
+YS5jZXIwOgYDVR0gBDMwMTAvBgRVHSAAMCcwJQYIKwYBBQUHAgEWGWh0dHBzOi8v
+d3d3LmNlcnR1bS5wbC9DUFMwDQYJKoZIhvcNAQEFBQADggEBAI/jSDAW/w9qLzF6
+4oQiIRB7dGKp2Nlj27xZFYDBRINn4DKyZExkpanASF2of9eEzvrS+qoDY29mhXCi
+MkiGr0vCsVhn0ReUpjg4Z5SsiQhZ2BGSjXiOJgaDI7Dw1MH7Ru6jdfSbLyd97EFj
+ER0ERGdrcA2kLw7KfQm78IkClXEEKjKnAUTn1d/5Y4UuBWDCEL0FLgO9AqNXEzIy
+rlXVGIs73kdefAK+Z1T6dm83vUrDMyzemWNRBI2tVBujkN6zkaF6uPjE4hfoIkEQ
+Z4317byFkG4mxjATU+tQLG1Bs88HUAOrxtJOo/WoeCNsFJaxbYPt4oQGxIVYdz29
+OUX9CQA=
+-----END CERTIFICATE-----
@@ -0,0 +1,19 @@
+--TEST--
+Bug #65689 (GeneralizedTime format parsing)
+--SKIPIF--
+<?php 
+if (!extension_loaded("openssl")) die("skip"); 
+?>
+--FILE--
+<?php
+$crt = substr(__FILE__, 0, -4).'.crt';
+$info = openssl_x509_parse("file://$crt");
+var_dump($info["validFrom"], $info["validFrom_time_t"], $info["validTo"], $info["validTo_time_t"]);
+?>
+Done
+--EXPECTF--
+string(15) "20090303125318Z"
+int(1236084798)
+string(15) "20240303125318Z"
+int(1709470398)
+Done
@@ -12,7 +12,7 @@ var_dump($info['issuer']['emailAddress'], $info["validFrom_time_t"]);
 ?>
 Done
 --EXPECTF--
-%s openssl_x509_parse(): illegal ASN1 data type for timestamp in %s%ecve-2013-6420.php on line 3
+%s openssl_x509_parse(): illegal length in timestamp in %s%ecve-2013-6420.php on line 3
 string(27) "stefan.esser@sektioneins.de"
 int(-1)
 Done
@@ -2,7 +2,7 @@
  +----------------------------------------------------------------------+
  | PHP Version 5                                                        |
  +----------------------------------------------------------------------+
-  | Copyright (c) 1997-2013 The PHP Group                                |
+  | Copyright (c) 1997-2014 The PHP Group                                |
  +----------------------------------------------------------------------+
  | This source file is subject to version 3.01 of the PHP license,      |
  | that is bundled with this package in the file LICENSE, and is        |
@@ -47,14 +47,14 @@ array(1) {
  string(3) "foo"
 }

-Warning: PDOStatement::execute(): SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '--'' at line 1 in %s on line %d
+Warning: PDOStatement::execute(): SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your %s server version for the right syntax to use near '--'' at line 1 in %s on line %d
 array(3) {
  [0]=>
  string(5) "42000"
  [1]=>
  int(1064)
  [2]=>
-  string(149) "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '--'' at line 1"
+  string(149) "You have an error in your SQL syntax; check the manual that corresponds to your %s server version for the right syntax to use near '--'' at line 1"
 }
 array(1) {
  ["f1"]=>
@@ -31,7 +31,7 @@ var_dump($quotedInput2);
 ?>
 done
 --EXPECTF--
-Warning: PDO::query(): SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'something that throws an exception' at line %d in %s on line %d
+Warning: PDO::query(): SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your %s server version for the right syntax to use near 'something that throws an exception' at line %d in %s on line %d
 string(50) "'Something\', 1 as one, 2 as two  FROM dual; -- f'"
 string(50) "'Something'', 1 as one, 2 as two  FROM dual; -- f'"
 string(50) "'Something'', 1 as one, 2 as two  FROM dual; -- f'"
@@ -161,6 +161,6 @@ error_reporting=E_ALL
 --EXPECTF--
 [003] Maybe PDO could indicate that this is not a proper way of setting the ERRMODE...true

-Warning: PDO::query(): SQLSTATE[42000]: Syntax error or access violation: %d You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '%s' at line %d in %s on line %d
+Warning: PDO::query(): SQLSTATE[42000]: Syntax error or access violation: %d You have an error in your SQL syntax; check the manual that corresponds to your %s server version for the right syntax to use near '%s' at line %d in %s on line %d

 end of execution
@@ -179,7 +179,7 @@ $db = MySQLPDOTest::factory();
@$db->exec('DROP TABLE IF EXISTS test');
 ?>
 --EXPECTF--
-Warning: PDO::exec(): SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'THIS IS NOT VALID SQL, I HOPE' at line 1 in %s on line %d
-[016] [42000] 42000 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'THIS IS NOT VALID SQL, I HOPE' at line %d
+Warning: PDO::exec(): SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your %s server version for the right syntax to use near 'THIS IS NOT VALID SQL, I HOPE' at line 1 in %s on line %d
+[016] [42000] 42000 1064 You have an error in your SQL syntax; check the manual that corresponds to your %s server version for the right syntax to use near 'THIS IS NOT VALID SQL, I HOPE' at line %d
 [035] With emulated PS it works but makes no sense given that exec() returns sort of affected rows...
 done!
@@ -97,6 +97,6 @@ array(1) {
 }
 Native Prepared Statements...

-Warning: PDO::query(): SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '%SSELECT label FROM test ORDER BY id ASC LIMIT 1' at line %d in %s on line %d
+Warning: PDO::query(): SQLSTATE[42000]: Syntax error or access violation: 1064 You have an error in your SQL syntax; check the manual that corresponds to your %s server version for the right syntax to use near '%SSELECT label FROM test ORDER BY id ASC LIMIT 1' at line %d in %s on line %d

 Fatal error: Call to a member function errorInfo() on a non-object in %s on line %d
@@ -753,7 +753,7 @@ static int le_link, le_plink, le_result, le_lofp, le_string;
 #endif

 #if !HAVE_PQESCAPE_CONN
-#define PQescapeStringConn(conn, to, form, len, error) PQescapeString(to, from, len)
+#define PQescapeStringConn(conn, to, from, len, error) PQescapeString(to, from, len)
 #endif

 #if HAVE_PQESCAPELITERAL
@@ -606,6 +606,7 @@ PHP_METHOD(Phar, webPhar)
 	}

 	if ((strlen(sapi_module.name) == sizeof("cgi-fcgi")-1 && !strncmp(sapi_module.name, "cgi-fcgi", sizeof("cgi-fcgi")-1))
+		|| (strlen(sapi_module.name) == sizeof("fpm-fcgi")-1 && !strncmp(sapi_module.name, "fpm-fcgi", sizeof("fpm-fcgi")-1))
 		|| (strlen(sapi_module.name) == sizeof("cgi")-1 && !strncmp(sapi_module.name, "cgi", sizeof("cgi")-1))) {

 		if (PG(http_globals)[TRACK_VARS_SERVER]) {
@@ -13,6 +13,6 @@ if (!extension_loaded('reflection') || !defined('PHP_VERSION_ID') || PHP_VERSION
 <?php
 $closure = function($param) { return "this is a closure"; };
 $rc = new ReflectionFunction($closure);
-echo var_dump($rc->isClosure());
+var_dump($rc->isClosure());
 --EXPECTF--
 bool(true)
@@ -10,6 +10,6 @@ if (!extension_loaded('reflection') || !defined('PHP_VERSION_ID') || PHP_VERSION
 --FILE-- 
 <?php
 $rc = new ReflectionFunction('ereg');
-echo var_dump($rc->isDeprecated());
+var_dump($rc->isDeprecated());
 --EXPECTF--
 bool(true)
@@ -12,6 +12,6 @@ disable_functions=is_file
 --FILE-- 
 <?php
 $rc = new ReflectionFunction('is_file');
-echo var_dump($rc->isDisabled());
+var_dump($rc->isDisabled());
 --EXPECTF--
 bool(true)
@@ -225,6 +225,7 @@ PHP_METHOD(SoapClient, __getFunctions);
 PHP_METHOD(SoapClient, __getTypes);
 PHP_METHOD(SoapClient, __doRequest);
 PHP_METHOD(SoapClient, __setCookie);
+PHP_METHOD(SoapClient, __getCookies);
 PHP_METHOD(SoapClient, __setLocation);
 PHP_METHOD(SoapClient, __setSoapHeaders);

@@ -368,6 +369,9 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_soapclient___setcookie, 0, 0, 1)
 	ZEND_ARG_INFO(0, value)
 ZEND_END_ARG_INFO()

+ZEND_BEGIN_ARG_INFO(arginfo_soapclient___getcookies, 0)
+ZEND_END_ARG_INFO()
+
 ZEND_BEGIN_ARG_INFO_EX(arginfo_soapclient___setsoapheaders, 0, 0, 1)
 	ZEND_ARG_INFO(0, soapheaders)
 ZEND_END_ARG_INFO()
@@ -422,6 +426,7 @@ static const zend_function_entry soap_client_functions[] = {
 	PHP_ME(SoapClient, __getTypes, 					arginfo_soapclient___gettypes, 0)
 	PHP_ME(SoapClient, __doRequest, 				arginfo_soapclient___dorequest, 0)
 	PHP_ME(SoapClient, __setCookie, 				arginfo_soapclient___setcookie, 0)
+	PHP_ME(SoapClient, __getCookies, 				arginfo_soapclient___getcookies, 0)
 	PHP_ME(SoapClient, __setLocation, 				arginfo_soapclient___setlocation, 0)
 	PHP_ME(SoapClient, __setSoapHeaders, 			arginfo_soapclient___setsoapheaders, 0)
 	PHP_FE_END
@@ -3132,6 +3137,24 @@ PHP_METHOD(SoapClient, __setCookie)
 }
 /* }}} */

+/* {{{ proto array SoapClient::__getCookies ( void )
+   Returns list of cookies */
+PHP_METHOD(SoapClient, __getCookies)
+{
+	zval **cookies, *tmp;
+
+	if (zend_parse_parameters_none() == FAILURE) {
+		return;
+	}
+
+	array_init(return_value);
+
+	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_cookies", sizeof("_cookies"), (void **)&cookies) != FAILURE) {
+		zend_hash_copy(Z_ARRVAL_P(return_value), Z_ARRVAL_P(*cookies), (copy_ctor_func_t) zval_add_ref, (void *)&tmp, sizeof(zval*));
+	}
+}
+/* }}} */
+
 /* {{{ proto void SoapClient::__setSoapHeaders(array SoapHeaders)
   Sets SOAP headers for subsequent calls (replaces any previous
   values).
@@ -0,0 +1,14 @@
+--TEST--
+Test for bug #49898: SoapClient::__getCookies() implementation
+--CREDITS--
+Boro Sitnikovski <buritomath@yahoo.com>
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+$client = new SoapClient(null, array('uri' => 'mo:http://www.w3.org/', 'location' => 'http://some.url'));
+$client->__setCookie("CookieTest", "HelloWorld");
+var_dump($client->__getCookies()['CookieTest'][0]);
+?>
+--EXPECT--
+string(10) "HelloWorld"
@@ -402,7 +402,7 @@ static zval *spl_array_read_dimension_ex(int check_inherited, zval *object, zval
 	/* When in a write context,
 	 * ZE has to be fooled into thinking this is in a reference set
 	 * by separating (if necessary) and returning as an is_ref=1 zval (even if refcount == 1) */
-	if ((type == BP_VAR_W || type == BP_VAR_RW || type == BP_VAR_UNSET) && !Z_ISREF_PP(ret)) {
+	if ((type == BP_VAR_W || type == BP_VAR_RW || type == BP_VAR_UNSET) && !Z_ISREF_PP(ret) && ret != &EG(uninitialized_zval_ptr)) {
 		if (Z_REFCOUNT_PP(ret) > 1) {
 			zval *newval;

@@ -1808,7 +1808,7 @@ SPL_METHOD(Array, unserialize)
 	++p;

 	ALLOC_INIT_ZVAL(pmembers);
-	if (!php_var_unserialize(&pmembers, &p, s + buf_len, &var_hash TSRMLS_CC)) {
+	if (!php_var_unserialize(&pmembers, &p, s + buf_len, &var_hash TSRMLS_CC) || Z_TYPE_P(pmembers) != IS_ARRAY) {
 		zval_ptr_dtor(&pmembers);
 		goto outexcept;
 	}
@@ -898,7 +898,7 @@ SPL_METHOD(SplObjectStorage, unserialize)
 	++p;

 	ALLOC_INIT_ZVAL(pmembers);
-	if (!php_var_unserialize(&pmembers, &p, s + buf_len, &var_hash TSRMLS_CC)) {
+	if (!php_var_unserialize(&pmembers, &p, s + buf_len, &var_hash TSRMLS_CC) || Z_TYPE_P(pmembers) != IS_ARRAY) {
 		zval_ptr_dtor(&pmembers);
 		goto outexcept;
 	}
@@ -7,6 +7,7 @@ $badblobs = array(
 'x:i:2;i:0;,i:1;;i:0;,i:2;;m:a:0:{}',
 'x:i:3;O:8:"stdClass":0:{},O:8:"stdClass":0:{};R:2;,i:1;;O:8:"stdClass":0:{},r:2;;m:a:0:{}',
 'x:i:3;O:8:"stdClass":0:{},O:8:"stdClass":0:{};r:2;,i:1;;O:8:"stdClass":0:{},r:2;;m:a:0:{}',
+'x:i:1;O:8:"stdClass":0:{},N;;m:s:40:"1234567890123456789012345678901234567890"',
 );
 foreach($badblobs as $blob) {
 try {
@@ -17,6 +18,7 @@ try {
 	echo $e->getMessage()."\n";
 }
 }
+echo "DONE\n";
 --EXPECTF--
 Error at offset 6 of 34 bytes
 Error at offset 46 of 89 bytes
@@ -42,4 +44,5 @@ object(SplObjectStorage)#2 (1) {
    }
  }
 }
-
+Error at offset 79 of 78 bytes
+DONE
@@ -0,0 +1,25 @@
+--TEST--
+Bug #66127 (Segmentation fault with ArrayObject unset)
+--INI--
+error_reporting = E_ALL & ~E_NOTICE
+--FILE--
+<?php
+function crash()
+{
+    set_error_handler(function () {});
+    $var = 1;
+    trigger_error('error');
+    $var2 = $var;
+    $var3 = $var;
+    trigger_error('error');
+}
+
+$items = new ArrayObject();
+
+unset($items[0]);
+unset($items[0][0]);
+crash();
+echo "Worked!\n";
+?>
+--EXPECT--
+Worked!
@@ -12,4 +12,6 @@ $a[] = &$tmp;
 echo "Done\n";
 ?>
 --EXPECTF--	
+Notice: Indirect modification of overloaded element of ArrayIterator has no effect in %s on line %d
+
 Fatal error: Cannot assign by reference to overloaded object in %s on line %d
@@ -4021,92 +4021,91 @@ PHP_FUNCTION(putenv)
 {
 	char *setting;
 	int setting_len;
+	char *p, **env;
+	putenv_entry pe;
+#ifdef PHP_WIN32
+	char *value = NULL;
+	int equals = 0;
+	int error_code;
+#endif

 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &setting, &setting_len) == FAILURE) {
 		return;
 	}
+    
+    if(setting_len == 0 || setting[0] == '=') {
+    	php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid parameter syntax");
+    	RETURN_FALSE;
+    }

-	if (setting_len) {
-		char *p, **env;
-		putenv_entry pe;
+	pe.putenv_string = estrndup(setting, setting_len);
+	pe.key = estrndup(setting, setting_len);
+	if ((p = strchr(pe.key, '='))) {	/* nullify the '=' if there is one */
+		*p = '\0';
 #ifdef PHP_WIN32
-		char *value = NULL;
-		int equals = 0;
-		int error_code;
+		equals = 1;
 #endif
+	}

-		pe.putenv_string = estrndup(setting, setting_len);
-		pe.key = estrndup(setting, setting_len);
-		if ((p = strchr(pe.key, '='))) {	/* nullify the '=' if there is one */
-			*p = '\0';
+	pe.key_len = strlen(pe.key);
 #ifdef PHP_WIN32
-			equals = 1;
-#endif
-		}
-
-		pe.key_len = strlen(pe.key);
-#ifdef PHP_WIN32
-		if (equals) {
-			if (pe.key_len < setting_len - 1) {
-				value = p + 1;
-			} else {
-				/* empty string*/
-				value = p;
-			}
-		}
-#endif
-
-		zend_hash_del(&BG(putenv_ht), pe.key, pe.key_len+1);
-
-		/* find previous value */
-		pe.previous_value = NULL;
-		for (env = environ; env != NULL && *env != NULL; env++) {
-			if (!strncmp(*env, pe.key, pe.key_len) && (*env)[pe.key_len] == '=') {	/* found it */
-#if defined(PHP_WIN32)
-				/* must copy previous value because MSVCRT's putenv can free the string without notice */
-				pe.previous_value = estrdup(*env);
-#else
-				pe.previous_value = *env;
-#endif
-				break;
-			}
-		}
-
-#if HAVE_UNSETENV
-		if (!p) { /* no '=' means we want to unset it */
-			unsetenv(pe.putenv_string);
-		}
-		if (!p || putenv(pe.putenv_string) == 0) { /* success */
-#else
-# ifndef PHP_WIN32
-		if (putenv(pe.putenv_string) == 0) { /* success */
-# else
-		error_code = SetEnvironmentVariable(pe.key, value);
-#  if _MSC_VER < 1500
-		/* Yet another VC6 bug, unset may return env not found */
-		if (error_code != 0 || 
-			(error_code == 0 && GetLastError() == ERROR_ENVVAR_NOT_FOUND)) {
-#  else
-		if (error_code != 0) { /* success */
-#  endif
-# endif
-#endif
-			zend_hash_add(&BG(putenv_ht), pe.key, pe.key_len + 1, (void **) &pe, sizeof(putenv_entry), NULL);
-#ifdef HAVE_TZSET
-			if (!strncmp(pe.key, "TZ", pe.key_len)) {
-				tzset();
-			}
-#endif
-			RETURN_TRUE;
+	if (equals) {
+		if (pe.key_len < setting_len - 1) {
+			value = p + 1;
 		} else {
-			efree(pe.putenv_string);
-			efree(pe.key);
-			RETURN_FALSE;
+			/* empty string*/
+			value = p;
+		}
+	}
+#endif
+
+	zend_hash_del(&BG(putenv_ht), pe.key, pe.key_len+1);
+
+	/* find previous value */
+	pe.previous_value = NULL;
+	for (env = environ; env != NULL && *env != NULL; env++) {
+		if (!strncmp(*env, pe.key, pe.key_len) && (*env)[pe.key_len] == '=') {	/* found it */
+#if defined(PHP_WIN32)
+			/* must copy previous value because MSVCRT's putenv can free the string without notice */
+			pe.previous_value = estrdup(*env);
+#else
+			pe.previous_value = *env;
+#endif
+			break;
 		}
 	}

-	php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid parameter syntax");
-	RETURN_FALSE;
+#if HAVE_UNSETENV
+	if (!p) { /* no '=' means we want to unset it */
+		unsetenv(pe.putenv_string);
+	}
+	if (!p || putenv(pe.putenv_string) == 0) { /* success */
+#else
+# ifndef PHP_WIN32
+	if (putenv(pe.putenv_string) == 0) { /* success */
+# else
+	error_code = SetEnvironmentVariable(pe.key, value);
+#  if _MSC_VER < 1500
+	/* Yet another VC6 bug, unset may return env not found */
+	if (error_code != 0 || 
+		(error_code == 0 && GetLastError() == ERROR_ENVVAR_NOT_FOUND)) {
+#  else
+	if (error_code != 0) { /* success */
+#  endif
+# endif
+#endif
+		zend_hash_add(&BG(putenv_ht), pe.key, pe.key_len + 1, (void **) &pe, sizeof(putenv_entry), NULL);
+#ifdef HAVE_TZSET
+		if (!strncmp(pe.key, "TZ", pe.key_len)) {
+			tzset();
+		}
+#endif
+		RETURN_TRUE;
+	} else {
+		efree(pe.putenv_string);
+		efree(pe.key);
+		RETURN_FALSE;
+	}
 }
 /* }}} */
 #endif
@@ -517,6 +517,10 @@ static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int
 				
 				while (ll < dlen) {
 					n = cp[ll];
+					if ((ll + n) >= dlen) {
+						// Invalid chunk length, truncate
+						n = dlen - (ll + 1);
+					}
 					memcpy(tp + ll , cp + ll + 1, n);
 					add_next_index_stringl(entries, cp + ll + 1, n, 1);
 					ll = ll + n + 1;
@@ -518,7 +518,7 @@ PHP_FUNCTION(file_get_contents)
 	char *contents;
 	zend_bool use_include_path = 0;
 	php_stream *stream;
-	int len;
+	long len;
 	long offset = -1;
 	long maxlen = PHP_STREAM_COPY_ALL;
 	zval *zcontext = NULL;
@@ -550,6 +550,10 @@ PHP_FUNCTION(file_get_contents)
 	}

 	if ((len = php_stream_copy_to_mem(stream, &contents, maxlen, 0)) > 0) {
+		if (len > INT_MAX) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "content truncated from %ld to %d bytes", len, INT_MAX);
+			len = INT_MAX;
+		}
 		RETVAL_STRINGL(contents, len, 0);
 	} else if (len == 0) {
 		RETVAL_EMPTY_STRING();
@@ -569,7 +573,7 @@ PHP_FUNCTION(file_put_contents)
 	char *filename;
 	int filename_len;
 	zval *data;
-	int numbytes = 0;
+	long numbytes = 0;
 	long flags = 0;
 	zval *zcontext = NULL;
 	php_stream_context *context = NULL;
@@ -621,6 +625,10 @@ PHP_FUNCTION(file_put_contents)
 			if (php_stream_copy_to_stream_ex(srcstream, stream, PHP_STREAM_COPY_ALL, &len) != SUCCESS) {
 				numbytes = -1;
 			} else {
+				if (len > LONG_MAX) {
+					php_error_docref(NULL TSRMLS_CC, E_WARNING, "content truncated from %lu to %ld bytes", (unsigned long) len, LONG_MAX);
+					len = LONG_MAX;
+				}
 				numbytes = len;
 			}
 			break;
@@ -636,7 +644,7 @@ PHP_FUNCTION(file_put_contents)
 			if (Z_STRLEN_P(data)) {
 				numbytes = php_stream_write(stream, Z_STRVAL_P(data), Z_STRLEN_P(data));
 				if (numbytes != Z_STRLEN_P(data)) {
-					php_error_docref(NULL TSRMLS_CC, E_WARNING, "Only %d of %d bytes written, possibly out of free disk space", numbytes, Z_STRLEN_P(data));
+					php_error_docref(NULL TSRMLS_CC, E_WARNING, "Only %ld of %d bytes written, possibly out of free disk space", numbytes, Z_STRLEN_P(data));
 					numbytes = -1;
 				}
 			}
@@ -679,7 +687,7 @@ PHP_FUNCTION(file_put_contents)
 				if (zend_std_cast_object_tostring(data, &out, IS_STRING TSRMLS_CC) == SUCCESS) {
 					numbytes = php_stream_write(stream, Z_STRVAL(out), Z_STRLEN(out));
 					if (numbytes != Z_STRLEN(out)) {
-						php_error_docref(NULL TSRMLS_CC, E_WARNING, "Only %d of %d bytes written, possibly out of free disk space", numbytes, Z_STRLEN(out));
+						php_error_docref(NULL TSRMLS_CC, E_WARNING, "Only %ld of %d bytes written, possibly out of free disk space", numbytes, Z_STRLEN(out));
 						numbytes = -1;
 					}
 					zval_dtor(&out);
@@ -736,10 +736,11 @@ finish:
 					SEPARATE_ZVAL(tmpzval);
 					convert_to_long_ex(tmpzval);
 					follow_location = Z_LVAL_PP(tmpzval);
-				} else if (!(response_code >= 300 && response_code < 304 || 307 == response_code)) { 
+				} else if (!(response_code >= 300 && response_code < 304 || 307 == response_code || 308 == response_code)) {
 					/* we shouldn't redirect automatically
 					if follow_location isn't set and response_code not in (300, 301, 302, 303 and 307) 
-					see http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.3.1 */
+					see http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.3.1
+					RFC 7238 defines 308: http://tools.ietf.org/html/rfc7238 */
 					follow_location = 0;
 				}
 				strlcpy(location, http_header_line + 10, sizeof(location));
@@ -328,7 +328,7 @@ char* php_get_windows_name()
 	}

 	if (VER_PLATFORM_WIN32_NT==osvi.dwPlatformId && osvi.dwMajorVersion > 4 ) {
-		if (osvi.dwMajorVersion == 6)	{
+		if (osvi.dwMajorVersion == 6) {
 			if( osvi.dwMinorVersion == 0 ) {
 				if( osvi.wProductType == VER_NT_WORKSTATION ) {
 					major = "Windows Vista";
@@ -342,6 +342,38 @@ char* php_get_windows_name()
 				} else {
 					major = "Windows Server 2008 R2";
 				}
+			} else if ( osvi.dwMinorVersion == 2 ) {
+				/* could be Windows 8/Windows Server 2012, could be Windows 8.1/Windows Server 2012 R2 */
+				OSVERSIONINFOEX osvi81;
+				DWORDLONG dwlConditionMask = 0;
+				int op = VER_GREATER_EQUAL;
+
+				ZeroMemory(&osvi81, sizeof(OSVERSIONINFOEX));
+				osvi81.dwOSVersionInfoSize = sizeof(OSVERSIONINFOEX);
+				osvi81.dwMajorVersion = 6;
+				osvi81.dwMinorVersion = 3;
+				osvi81.wServicePackMajor = 0;
+
+				VER_SET_CONDITION(dwlConditionMask, VER_MAJORVERSION, op);
+				VER_SET_CONDITION(dwlConditionMask, VER_MINORVERSION, op);
+				VER_SET_CONDITION(dwlConditionMask, VER_SERVICEPACKMAJOR, op);
+
+				if (VerifyVersionInfo(&osvi81, 
+					VER_MAJORVERSION | VER_MINORVERSION | VER_SERVICEPACKMAJOR,
+					dwlConditionMask)) {
+					osvi.dwMinorVersion = 3; /* Windows 8.1/Windows Server 2012 R2 */
+					if( osvi.wProductType == VER_NT_WORKSTATION )  {
+						major = "Windows 8.1";
+					} else {
+						major = "Windows Server 2012 R2";
+					}
+				} else {
+					if( osvi.wProductType == VER_NT_WORKSTATION )  {
+						major = "Windows 8";
+					} else {
+						major = "Windows Server 2012";
+					}
+				} 
 			} else {
 				major = "Unknown Windows version";
 			}
@@ -875,16 +907,16 @@ PHPAPI void php_print_info(int flag TSRMLS_DC)

 		php_info_print_table_start();
 		php_info_print_table_header(2, "Variable", "Value");
-		if (zend_hash_find(&EG(symbol_table), "PHP_SELF", sizeof("PHP_SELF"), (void **) &data) != FAILURE) {
+		if (zend_hash_find(&EG(symbol_table), "PHP_SELF", sizeof("PHP_SELF"), (void **) &data) != FAILURE && Z_TYPE_PP(data) == IS_STRING) {
 			php_info_print_table_row(2, "PHP_SELF", Z_STRVAL_PP(data));
 		}
-		if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_TYPE", sizeof("PHP_AUTH_TYPE"), (void **) &data) != FAILURE) {
+		if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_TYPE", sizeof("PHP_AUTH_TYPE"), (void **) &data) != FAILURE && Z_TYPE_PP(data) == IS_STRING) {
 			php_info_print_table_row(2, "PHP_AUTH_TYPE", Z_STRVAL_PP(data));
 		}
-		if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_USER", sizeof("PHP_AUTH_USER"), (void **) &data) != FAILURE) {
+		if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_USER", sizeof("PHP_AUTH_USER"), (void **) &data) != FAILURE && Z_TYPE_PP(data) == IS_STRING) {
 			php_info_print_table_row(2, "PHP_AUTH_USER", Z_STRVAL_PP(data));
 		}
-		if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_PW", sizeof("PHP_AUTH_PW"), (void **) &data) != FAILURE) {
+		if (zend_hash_find(&EG(symbol_table), "PHP_AUTH_PW", sizeof("PHP_AUTH_PW"), (void **) &data) != FAILURE && Z_TYPE_PP(data) == IS_STRING) {
 			php_info_print_table_row(2, "PHP_AUTH_PW", Z_STRVAL_PP(data));
 		}
 		php_print_gpcse_array(ZEND_STRL("_REQUEST") TSRMLS_CC);
@@ -407,7 +407,7 @@ PHP_FUNCTION(stream_get_contents)
 	zval		*zsrc;
 	long		maxlen		= PHP_STREAM_COPY_ALL,
 				desiredpos	= -1L;
-	int			len;
+	long		len;
 	char		*contents	= NULL;

 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "r|ll", &zsrc, &maxlen, &desiredpos) == FAILURE) {
@@ -439,6 +439,10 @@ PHP_FUNCTION(stream_get_contents)
 	len = php_stream_copy_to_mem(stream, &contents, maxlen, 0);

 	if (contents) {
+		if (len > INT_MAX) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "content truncated from %ld to %d bytes", len, INT_MAX);
+			len = INT_MAX;
+		}
 		RETVAL_STRINGL(contents, len, 0);
 	} else {
 		RETVAL_EMPTY_STRING();
@@ -3155,6 +3155,10 @@ static void php_strtr_array(zval *return_value, char *str, int slen, HashTable *
 	int			patterns_len;
 	zend_llist	*allocs;

+	if (zend_hash_num_elements(pats) == 0) {
+		RETURN_STRINGL(str, slen, 1);
+	}
+
 	S(&text) = str;
 	L(&text) = slen;

@@ -0,0 +1,15 @@
+--TEST--
+phpinfo() Type Confusion Information Leak Vulnerability
+--FILE--
+<?php
+$PHP_SELF = 1;
+phpinfo(INFO_VARIABLES);
+
+?>
+==DONE==
+--EXPECTF--
+phpinfo()
+
+PHP Variables
+%A
+==DONE==
@@ -0,0 +1,11 @@
+--TEST--
+Location: headers change the status code
+--CGI--
+--FILE--
+<?php
+header('Location: http://example.com/');
+?>
+--EXPECTHEADERS--
+Status: 302 Moved Temporarily
+Location: http://example.com/
+--EXPECT--
@@ -0,0 +1,12 @@
+--TEST--
+Location: headers override non-201 and 3xx response codes
+--CGI--
+--FILE--
+<?php
+header("HTTP/1.1 418 I'm a Teapot");
+header('Location: http://example.com/');
+?>
+--EXPECTHEADERS--
+Status: 302 Moved Temporarily
+Location: http://example.com/
+--EXPECT--
@@ -0,0 +1,11 @@
+--TEST--
+Location: headers respect the header() response code parameter
+--CGI--
+--FILE--
+<?php
+header('Location: http://example.com/', true, 404);
+?>
+--EXPECTHEADERS--
+Status: 404 Not Found
+Location: http://example.com/
+--EXPECT--
@@ -0,0 +1,11 @@
+--TEST--
+Location: headers respect the header() response code parameter
+--CGI--
+--FILE--
+<?php
+header('Location: http://example.com/', true, 404);
+?>
+--EXPECTHEADERS--
+Status: 404 Not Found
+Location: http://example.com/
+--EXPECT--
@@ -0,0 +1,12 @@
+--TEST--
+Location: headers do not override the 201 response code
+--CGI--
+--FILE--
+<?php
+header('HTTP/1.1 201 Created');
+header('Location: http://example.com/');
+?>
+--EXPECTHEADERS--
+Status: 201 Created
+Location: http://example.com/
+--EXPECT--
@@ -0,0 +1,12 @@
+--TEST--
+Location: headers do not override the 300 Multiple Choices response code
+--CGI--
+--FILE--
+<?php
+header('HTTP/1.1 300 Multiple Choices');
+header('Location: http://example.com/');
+?>
+--EXPECTHEADERS--
+Status: 300 Multiple Choices
+Location: http://example.com/
+--EXPECT--
@@ -0,0 +1,12 @@
+--TEST--
+Location: headers do not override the 301 Moved Permanently response code
+--CGI--
+--FILE--
+<?php
+header('HTTP/1.1 301 Moved Permanently');
+header('Location: http://example.com/');
+?>
+--EXPECTHEADERS--
+Status: 301 Moved Permanently
+Location: http://example.com/
+--EXPECT--
@@ -0,0 +1,12 @@
+--TEST--
+Location: headers do not override the 302 Found response code
+--CGI--
+--FILE--
+<?php
+header('HTTP/1.1 302 Found');
+header('Location: http://example.com/');
+?>
+--EXPECTHEADERS--
+Status: 302 Found
+Location: http://example.com/
+--EXPECT--
@@ -0,0 +1,12 @@
+--TEST--
+Location: headers do not override the 303 See Other response code
+--CGI--
+--FILE--
+<?php
+header('HTTP/1.1 303 See Other');
+header('Location: http://example.com/');
+?>
+--EXPECTHEADERS--
+Status: 303 See Other
+Location: http://example.com/
+--EXPECT--
@@ -0,0 +1,12 @@
+--TEST--
+Location: headers do not override the 304 Not Modified response code
+--CGI--
+--FILE--
+<?php
+header('HTTP/1.1 304 Not Modified');
+header('Location: http://example.com/');
+?>
+--EXPECTHEADERS--
+Status: 304 Not Modified
+Location: http://example.com/
+--EXPECT--
@@ -0,0 +1,12 @@
+--TEST--
+Location: headers do not override the 305 Use Proxy response code
+--CGI--
+--FILE--
+<?php
+header('HTTP/1.1 305 Use Proxy');
+header('Location: http://example.com/');
+?>
+--EXPECTHEADERS--
+Status: 305 Use Proxy
+Location: http://example.com/
+--EXPECT--
@@ -0,0 +1,12 @@
+--TEST--
+Location: headers do not override the 307 Temporary Redirect response code
+--CGI--
+--FILE--
+<?php
+header('HTTP/1.1 307 Temporary Redirect');
+header('Location: http://example.com/');
+?>
+--EXPECTHEADERS--
+Status: 307 Temporary Redirect
+Location: http://example.com/
+--EXPECT--
@@ -0,0 +1,12 @@
+--TEST--
+Location: headers do not override the 308 Permanent Redirect response code
+--CGI--
+--FILE--
+<?php
+header('HTTP/1.1 308 Permanent Redirect');
+header('Location: http://example.com/');
+?>
+--EXPECTHEADERS--
+Status: 308 Permanent Redirect
+Location: http://example.com/
+--EXPECT--
@@ -0,0 +1,12 @@
+--TEST--
+Location: headers do not override the 399 Choose Your Own Adventure response code
+--CGI--
+--FILE--
+<?php
+header('HTTP/1.1 399 Choose Your Own Adventure');
+header('Location: http://example.com/');
+?>
+--EXPECTHEADERS--
+Status: 399 Choose Your Own Adventure
+Location: http://example.com/
+--EXPECT--
@@ -15,6 +15,9 @@ var_dump(getenv($var_name));
 var_dump(putenv($var_name));
 var_dump(getenv($var_name));

+var_dump(putenv("=123"));
+var_dump(putenv(""));
+
 echo "Done\n";
 ?>
 --EXPECTF--	
@@ -25,4 +28,10 @@ bool(true)
 string(0) ""
 bool(true)
 bool(false)
+
+Warning: putenv(): Invalid parameter syntax in %s on line %d
+bool(false)
+
+Warning: putenv(): Invalid parameter syntax in %s on line %d
+bool(false)
 Done
@@ -0,0 +1,49 @@
+--TEST--
+Bug #67430 (http:// wrapper doesn't follow 308 redirects)
+--INI--
+allow_url_fopen=1
+--SKIPIF--
+<?php require 'server.inc'; http_server_skipif('tcp://127.0.0.1:12342'); ?>
+--FILE--
+<?php
+require 'server.inc';
+
+function do_test($follow) {
+  $options = [
+    'http' => [
+      'method' => 'POST',
+      'follow_location' => $follow,
+    ],
+  ];
+
+  $ctx = stream_context_create($options);
+
+  $responses = [
+    "data://text/plain,HTTP/1.1 308\r\nLocation: /foo\r\n\r\n",
+    "data://text/plain,HTTP/1.1 200\r\nConnection: close\r\n\r\n",
+  ];
+  $pid = http_server('tcp://127.0.0.1:12342', $responses, $output);
+
+  $fd = fopen('http://127.0.0.1:12342/', 'rb', false, $ctx);
+  fseek($output, 0, SEEK_SET);
+  echo stream_get_contents($output);
+
+  http_server_kill($pid);
+}
+
+do_test(true);
+do_test(false);
+
+?>
+Done
+--EXPECT--
+POST / HTTP/1.0
+Host: 127.0.0.1:12342
+
+GET /foo HTTP/1.0
+Host: 127.0.0.1:12342
+
+POST / HTTP/1.0
+Host: 127.0.0.1:12342
+
+Done
@@ -0,0 +1,84 @@
+--TEST--
+Bug #67072 Echoing unserialized "SplFileObject" crash - BC break fixes
+--FILE--
+<?php
+class MySplFileObject extends SplFileObject {}
+class MyArrayObject extends ArrayObject{ var $a = 1; }
+echo unserialize('O:15:"MySplFileObject":1:{s:9:"*filename";s:15:"/home/flag/flag";}');
+
+function testClass($className) 
+{
+    // simulate phpunit
+    $object = unserialize(sprintf('O:%d:"%s":0:{}', strlen($className), $className));
+    return $object;
+}
+
+class MyClass {}
+class MyClassSer implements Serializable {
+        function serialize() { return "";}
+        function unserialize($data) { }
+}
+class MyClassSer2 extends MyClassSer {
+}
+
+$classes = array('stdClass', 'MyClass', 'MyClassSer', 'MyClassSer2', 'SplFileObject', 'MySplFileObject', 
+                 'SplObjectStorage', 'FooBar', 'Closure', 'ArrayObject', 'MyArrayObject',
+                 'Directory'
+             );
+foreach($classes as $cl) {
+        var_dump(testClass($cl));
+}
+
+?>
+===DONE==
+--EXPECTF--
+Warning: Erroneous data format for unserializing 'MySplFileObject' in %s on line 4
+
+Notice: unserialize(): Error at offset 26 of 66 bytes in %s on line 4
+object(stdClass)#%d (0) {
+}
+object(MyClass)#%d (0) {
+}
+object(MyClassSer)#%d (0) {
+}
+object(MyClassSer2)#%d (0) {
+}
+
+Warning: Erroneous data format for unserializing 'SplFileObject' in %s on line 9
+
+Notice: unserialize(): Error at offset 24 of 25 bytes in %s on line 9
+bool(false)
+
+Warning: Erroneous data format for unserializing 'MySplFileObject' in %s on line 9
+
+Notice: unserialize(): Error at offset 26 of 27 bytes in %s on line 9
+bool(false)
+object(SplObjectStorage)#%d (1) {
+  ["storage":"SplObjectStorage":private]=>
+  array(0) {
+  }
+}
+object(__PHP_Incomplete_Class)#%d (1) {
+  ["__PHP_Incomplete_Class_Name"]=>
+  string(6) "FooBar"
+}
+
+Warning: Erroneous data format for unserializing 'Closure' in %s on line 9
+
+Notice: unserialize(): Error at offset 17 of 18 bytes in %s on line 9
+bool(false)
+object(ArrayObject)#%d (1) {
+  ["storage":"ArrayObject":private]=>
+  array(0) {
+  }
+}
+object(MyArrayObject)#1 (2) {
+  ["a"]=>
+  int(1)
+  ["storage":"ArrayObject":private]=>
+  array(0) {
+  }
+}
+object(Directory)#1 (0) {
+}
+===DONE==
@@ -0,0 +1,8 @@
+--TEST--
+Buf #67151: strtr with empty array crashes
+--FILE--
+<?php
+var_dump(strtr("foo", []));
+?>
+--EXPECT--
+string(3) "foo"
@@ -2,7 +2,7 @@
  +----------------------------------------------------------------------+
  | PHP Version 5                                                        |
  +----------------------------------------------------------------------+
-  | Copyright (c) 1997-2013 The PHP Group                                |
+  | Copyright (c) 1997-2014 The PHP Group                                |
  +----------------------------------------------------------------------+
  | This source file is subject to version 3.01 of the PHP license,      |
  | that is bundled with this package in the file LICENSE, and is        |
@@ -1,10 +1,10 @@
-/* Generated by re2c 0.13.5 on Tue Jun  3 10:23:35 2014 */
+/* Generated by re2c 0.13.5 on Sat Jun 21 21:27:56 2014 */
 #line 1 "ext/standard/var_unserializer.re"
 /*
  +----------------------------------------------------------------------+
  | PHP Version 5                                                        |
  +----------------------------------------------------------------------+
-  | Copyright (c) 1997-2013 The PHP Group                                |
+  | Copyright (c) 1997-2014 The PHP Group                                |
  +----------------------------------------------------------------------+
  | This source file is subject to version 3.01 of the PHP license,      |
  | that is bundled with this package in the file LICENSE, and is        |
@@ -23,6 +23,7 @@
 #include "php.h"
 #include "ext/standard/php_var.h"
 #include "php_incomplete_class.h"
+#include "Zend/zend_interfaces.h"

 /* {{{ reference-handling for unserializer: var_* */
 #define VAR_ENTRIES_MAX 1024
@@ -226,7 +227,7 @@ static char *unserialize_str(const unsigned char **p, size_t *len, size_t maxlen
 #define YYMARKER marker


-#line 234 "ext/standard/var_unserializer.re"
+#line 235 "ext/standard/var_unserializer.re"



@@ -400,7 +401,7 @@ static inline long object_common1(UNSERIALIZE_PARAMETER, zend_class_entry *ce)
 	Serializable interface have eventually an inconsistent behavior at this place when
 	unserialized from a manipulated string. Additionaly the interal classes can possibly
 	crash PHP so they're still disabled here. */
-	if (ce->serialize == NULL || ZEND_INTERNAL_CLASS != ce->type) {
+	if (ce->serialize == NULL || ce->unserialize == zend_user_unserialize || (ZEND_INTERNAL_CLASS != ce->type && ce->create_object == NULL)) {
 		object_init_ex(*rval, ce);
 	} else {
 		/* If this class implements Serializable, it should not land here but in object_custom(). The passed string
@@ -473,7 +474,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 	
 	

-#line 477 "ext/standard/var_unserializer.c"
+#line 478 "ext/standard/var_unserializer.c"
 {
 	YYCTYPE yych;
 	static const unsigned char yybm[] = {
@@ -533,9 +534,9 @@ yy2:
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych == ':') goto yy95;
 yy3:
-#line 828 "ext/standard/var_unserializer.re"
+#line 829 "ext/standard/var_unserializer.re"
 	{ return 0; }
-#line 539 "ext/standard/var_unserializer.c"
+#line 540 "ext/standard/var_unserializer.c"
 yy4:
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych == ':') goto yy89;
@@ -578,13 +579,13 @@ yy13:
 	goto yy3;
 yy14:
 	++YYCURSOR;
-#line 822 "ext/standard/var_unserializer.re"
+#line 823 "ext/standard/var_unserializer.re"
 	{
 	/* this is the case where we have less data than planned */
 	php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Unexpected end of serialized data");
 	return 0; /* not sure if it should be 0 or 1 here? */
 }
-#line 588 "ext/standard/var_unserializer.c"
+#line 589 "ext/standard/var_unserializer.c"
 yy16:
 	yych = *++YYCURSOR;
 	goto yy3;
@@ -614,7 +615,7 @@ yy20:
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 676 "ext/standard/var_unserializer.re"
+#line 677 "ext/standard/var_unserializer.re"
 	{
 	size_t len, len2, len3, maxlen;
 	long elements;
@@ -760,7 +761,7 @@ yy20:

 	return object_common2(UNSERIALIZE_PASSTHRU, elements);
 }
-#line 764 "ext/standard/var_unserializer.c"
+#line 765 "ext/standard/var_unserializer.c"
 yy25:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -785,7 +786,7 @@ yy27:
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 668 "ext/standard/var_unserializer.re"
+#line 669 "ext/standard/var_unserializer.re"
 	{

 	INIT_PZVAL(*rval);
@@ -793,7 +794,7 @@ yy27:
 	return object_common2(UNSERIALIZE_PASSTHRU,
 			object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR));
 }
-#line 797 "ext/standard/var_unserializer.c"
+#line 798 "ext/standard/var_unserializer.c"
 yy32:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy33;
@@ -814,7 +815,7 @@ yy34:
 	yych = *++YYCURSOR;
 	if (yych != '{') goto yy18;
 	++YYCURSOR;
-#line 648 "ext/standard/var_unserializer.re"
+#line 649 "ext/standard/var_unserializer.re"
 	{
 	long elements = parse_iv(start + 2);
 	/* use iv() not uiv() in order to check data range */
@@ -834,7 +835,7 @@ yy34:

 	return finish_nested_data(UNSERIALIZE_PASSTHRU);
 }
-#line 838 "ext/standard/var_unserializer.c"
+#line 839 "ext/standard/var_unserializer.c"
 yy39:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy40;
@@ -855,7 +856,7 @@ yy41:
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 619 "ext/standard/var_unserializer.re"
+#line 620 "ext/standard/var_unserializer.re"
 	{
 	size_t len, maxlen;
 	char *str;
@@ -884,7 +885,7 @@ yy41:
 	ZVAL_STRINGL(*rval, str, len, 0);
 	return 1;
 }
-#line 888 "ext/standard/var_unserializer.c"
+#line 889 "ext/standard/var_unserializer.c"
 yy46:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy47;
@@ -905,7 +906,7 @@ yy48:
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 591 "ext/standard/var_unserializer.re"
+#line 592 "ext/standard/var_unserializer.re"
 	{
 	size_t len, maxlen;
 	char *str;
@@ -933,7 +934,7 @@ yy48:
 	ZVAL_STRINGL(*rval, str, len, 1);
 	return 1;
 }
-#line 937 "ext/standard/var_unserializer.c"
+#line 938 "ext/standard/var_unserializer.c"
 yy53:
 	yych = *++YYCURSOR;
 	if (yych <= '/') {
@@ -1021,7 +1022,7 @@ yy61:
 	}
 yy63:
 	++YYCURSOR;
-#line 581 "ext/standard/var_unserializer.re"
+#line 582 "ext/standard/var_unserializer.re"
 	{
 #if SIZEOF_LONG == 4
 use_double:
@@ -1031,7 +1032,7 @@ use_double:
 	ZVAL_DOUBLE(*rval, zend_strtod((const char *)start + 2, NULL));
 	return 1;
 }
-#line 1035 "ext/standard/var_unserializer.c"
+#line 1036 "ext/standard/var_unserializer.c"
 yy65:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1090,7 +1091,7 @@ yy73:
 	yych = *++YYCURSOR;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 566 "ext/standard/var_unserializer.re"
+#line 567 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
@@ -1105,7 +1106,7 @@ yy73:

 	return 1;
 }
-#line 1109 "ext/standard/var_unserializer.c"
+#line 1110 "ext/standard/var_unserializer.c"
 yy76:
 	yych = *++YYCURSOR;
 	if (yych == 'N') goto yy73;
@@ -1132,7 +1133,7 @@ yy79:
 	if (yych <= '9') goto yy79;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 539 "ext/standard/var_unserializer.re"
+#line 540 "ext/standard/var_unserializer.re"
 	{
 #if SIZEOF_LONG == 4
 	int digits = YYCURSOR - start - 3;
@@ -1159,7 +1160,7 @@ yy79:
 	ZVAL_LONG(*rval, parse_iv(start + 2));
 	return 1;
 }
-#line 1163 "ext/standard/var_unserializer.c"
+#line 1164 "ext/standard/var_unserializer.c"
 yy83:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy18;
@@ -1167,24 +1168,24 @@ yy83:
 	yych = *++YYCURSOR;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 532 "ext/standard/var_unserializer.re"
+#line 533 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
 	ZVAL_BOOL(*rval, parse_iv(start + 2));
 	return 1;
 }
-#line 1178 "ext/standard/var_unserializer.c"
+#line 1179 "ext/standard/var_unserializer.c"
 yy87:
 	++YYCURSOR;
-#line 525 "ext/standard/var_unserializer.re"
+#line 526 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
 	ZVAL_NULL(*rval);
 	return 1;
 }
-#line 1188 "ext/standard/var_unserializer.c"
+#line 1189 "ext/standard/var_unserializer.c"
 yy89:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1207,7 +1208,7 @@ yy91:
 	if (yych <= '9') goto yy91;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 502 "ext/standard/var_unserializer.re"
+#line 503 "ext/standard/var_unserializer.re"
 	{
 	long id;

@@ -1230,7 +1231,7 @@ yy91:
 	
 	return 1;
 }
-#line 1234 "ext/standard/var_unserializer.c"
+#line 1235 "ext/standard/var_unserializer.c"
 yy95:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1253,7 +1254,7 @@ yy97:
 	if (yych <= '9') goto yy97;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 481 "ext/standard/var_unserializer.re"
+#line 482 "ext/standard/var_unserializer.re"
 	{
 	long id;

@@ -1274,9 +1275,9 @@ yy97:
 	
 	return 1;
 }
-#line 1278 "ext/standard/var_unserializer.c"
+#line 1279 "ext/standard/var_unserializer.c"
 }
-#line 830 "ext/standard/var_unserializer.re"
+#line 831 "ext/standard/var_unserializer.re"


 	return 0;
@@ -2,7 +2,7 @@
  +----------------------------------------------------------------------+
  | PHP Version 5                                                        |
  +----------------------------------------------------------------------+
-  | Copyright (c) 1997-2013 The PHP Group                                |
+  | Copyright (c) 1997-2014 The PHP Group                                |
  +----------------------------------------------------------------------+
  | This source file is subject to version 3.01 of the PHP license,      |
  | that is bundled with this package in the file LICENSE, and is        |
@@ -21,6 +21,7 @@
 #include "php.h"
 #include "ext/standard/php_var.h"
 #include "php_incomplete_class.h"
+#include "Zend/zend_interfaces.h"

 /* {{{ reference-handling for unserializer: var_* */
 #define VAR_ENTRIES_MAX 1024
@@ -404,7 +405,7 @@ static inline long object_common1(UNSERIALIZE_PARAMETER, zend_class_entry *ce)
 	Serializable interface have eventually an inconsistent behavior at this place when
 	unserialized from a manipulated string. Additionaly the interal classes can possibly
 	crash PHP so they're still disabled here. */
-	if (ce->serialize == NULL || ZEND_INTERNAL_CLASS != ce->type) {
+	if (ce->serialize == NULL || ce->unserialize == zend_user_unserialize || (ZEND_INTERNAL_CLASS != ce->type && ce->create_object == NULL)) {
 		object_init_ex(*rval, ce);
 	} else {
 		/* If this class implements Serializable, it should not land here but in object_custom(). The passed string
@@ -24,7 +24,7 @@ gzclose($h);
 echo "\nreading the output file\n";
 $h = gzopen($f, 'r');
 echo gzread($h, strlen($str1))."\n";
-echo var_dump(bin2hex(gzread($h, 20)));
+var_dump(bin2hex(gzread($h, 20)));
 echo gzread($h, strlen($str2))."\n";
 gzclose($h);
 unlink($f);
@@ -39,4 +39,4 @@ reading the output file
 This is the first line.
 string(40) "0000000000000000000000000000000000000000"
 This is the second line.
-===DONE===
+===DONE===
@@ -20,7 +20,7 @@ gzwrite($h, $str2);
 gzclose($h);
 $h = gzopen($f, 'r');
 echo gzread($h, strlen($str1))."\n";
-echo var_dump(bin2hex(gzread($h, 20)));
+var_dump(bin2hex(gzread($h, 20)));
 echo gzread($h, strlen($str2))."\n";
 gzclose($h);
 unlink($f);
@@ -30,4 +30,4 @@ unlink($f);
 This is the first line.
 string(40) "0000000000000000000000000000000000000000"
 This is the second line.
-===DONE===
+===DONE===
@@ -24,7 +24,7 @@ gzclose($h);
 echo "\nreading the output file\n";
 $h = gzopen($f, 'r');
 echo gzread($h, strlen($str1))."\n";
-echo var_dump(bin2hex(gzread($h, 20)));
+var_dump(bin2hex(gzread($h, 20)));
 echo gzread($h, strlen($str2))."\n";
 gzclose($h);
 unlink($f);
@@ -39,4 +39,4 @@ reading the output file
 This is the first line.
 string(40) "0000000000000000000000000000000000000000"
 This is the second line.
-===DONE===
+===DONE===
Author	SHA1	Message	Date
Stanislav Malyshev	2f779e7d14	5.4.31	2014-07-22 17:59:30 -07:00
Stanislav Malyshev	cd901a0407	5.4.31 RC1	2014-07-08 21:23:42 -07:00
Stanislav Malyshev	64e4261c9b	fix unstable test	2014-07-08 14:13:46 -07:00
Christian Weiske	0bf50a8302	Fix bug #67587 : Redirection loop on nginx with FPM Redirection will work correctly as long as PATH_INFO is available, e.g. via the following nginx configuration: set $path_info $fastcgi_path_info; fastcgi_param PATH_INFO $path_info;	2014-07-08 12:53:45 -07:00
Anatol Belski	d472434ea0	updated NEWS	2014-07-08 10:06:35 +02:00
Anatol Belski	03214a2aef	Backported the patch from bug #67407 into 5.4	2014-07-08 09:52:35 +02:00
Remi Collet	494034901e	NEWS	2014-07-08 08:30:15 +02:00
Remi Collet	f8acf826c3	Fix Bug #67530 error_log=syslog ignored As for Bug #64915 Systemd use --nodaemonize but need to error_log to file or syslog to be honoured	2014-07-08 08:29:24 +02:00
Adam Harvey	604de67b7d	Fixed bug #66830 (Empty header causes PHP built-in web server to hang). We had an infinite loop in sapi_cli_server_send_headers(): while iterating over the linked list of headers, when an empty header was hit, continue would go to the next iteration of the loop without updating h to be the next value in the linked list. Updating it to always increment regardless of whether the header is actually valid or not fixes the issue.	2014-07-07 20:36:06 +00:00
Stanislav Malyshev	a7d1cad4c3	change locale - looks like not everybody has sl_SI	2014-07-07 01:35:25 -07:00
Stanislav Malyshev	897b7b68cc	fix format	2014-07-07 00:48:32 -07:00
Stanislav Malyshev	6c8a570a96	Fix bug #67052 (NumberFormatter::parse() resets LC_NUMERIC setting)	2014-07-07 00:36:57 -07:00
Lior Kaplan	716d2a3937	Make sure the generator script also creates a newline at the end of file Similar to commit `d6713f39` in master	2014-07-06 22:15:09 -07:00
Lior Kaplan	c5fec9e09d	Add newline at end of file to prevent compilation warning The newline was removed at commit `50d50c2f`	2014-07-06 22:15:00 -07:00
Nikita Popov	18989420b6	Add test for bug #67151	2014-07-02 22:39:54 +02:00
Ferenc Kovacs	37a13d2df7	adding a reproduce script for bug #49184	2014-07-02 22:37:58 +02:00
Nikita Popov	3cc6bd10ac	Fix bug #67151 : strtr with empty array crashes	2014-07-02 22:33:20 +02:00
Anatol Belski	5efda71e54	bundle deplister.exe with releases	2014-07-02 11:34:37 +02:00
Michael Wallner	34e686c556	fix integer overflow in {stream,file}_{get,put}_contents()	2014-07-02 09:53:03 +02:00
Adam Harvey	899fe3d8af	Fix ext/pgsql builds with libpq < 7.3. Fixes bug #67550 (Error in code "form" instead of "from", pgsql.c, line 756).	2014-07-01 13:19:22 -07:00
Anatol Belski	6081dd781a	updated libs_version.txt	2014-07-01 10:33:09 +02:00
Anatol Belski	af5f997a5d	updated libmagic.patch	2014-07-01 10:25:20 +02:00
Ferenc Kovacs	48df4464ea	remove the NEWS entry for the reverted fpm fix	2014-06-30 18:37:56 +02:00
Ferenc Kovacs	9c8b42960d	Revert "Fix Bug #67530 error_log=syslog ignored" This reverts commit `a0ecb3794f`.	2014-06-30 18:37:23 +02:00
Ferenc Kovacs	a7d1656b96	Fix bug #67091 : make install fails to install libphp5.so on FreeBSD 10.0 Simplest fix is to remove the specific checks for freebsd1* as it also matches freebsd10, and nobody should be using >=PHP 5.4 with freebsd 1.x(if it is even possible to make it to compile there).	2014-06-30 01:31:10 +02:00
Ferenc Kovacs	cc22f021fe	removing the format added by mistake, props to Solar Designer for spotting this.	2014-06-27 16:27:36 +02:00
Remi Collet	334758794d	NEWS	2014-06-27 09:50:01 +02:00
Remi Collet	bf328b1681	Fix Bug #67531 syslog cannot be set in pool configuration error_log is listed in FPM_PHP_INI_TO_EXPAND, but should not be expand when value = syslog	2014-06-27 09:47:28 +02:00
Remi Collet	a0ecb3794f	Fix Bug #67530 error_log=syslog ignored As for Bug #64915 Systemd use --nodaemonize but need to error_log to file or syslog to be honoured	2014-06-27 09:45:53 +02:00
Stanislav Malyshev	2db96fea2d	update the date	2014-06-26 21:15:47 -07:00
Stanislav Malyshev	b23460063f	better explanation	2014-06-26 15:25:19 -07:00
Stanislav Malyshev	ad9ed232e7	more extensive note on unserialize() change	2014-06-26 10:35:47 -07:00
Stanislav Malyshev	9d1d25e625	Fix test - because of big #67397 we don't allow overlong locales anymore	2014-06-24 11:21:43 -07:00
Stanislav Malyshev	3488cf6fd8	Merge branch 'PHP-5.4.30' into PHP-5.4 * PHP-5.4.30: 5.4.30 Better fix for bug #67072 with more BC provisions Fix bug #67498 - phpinfo() Type Confusion Information Leak Vulnerability update CVE Fix bug #67492: unserialize() SPL ArrayObject / SPLObjectStorage Type Confusion Fix bug #67397 (Buffer overflow in locale_get_display_name->uloc_getDisplayName (libicu 4.8.1)) Fix bug #67349: Locale::parseLocale Double Free add CVEs Fix potential segfault in dns_get_record() Fix bug #66127 (Segmentation fault with ArrayObject unset) 5.4.30 rc1 Conflicts: configure.in main/php_version.h	2014-06-24 10:23:36 -07:00
Stanislav Malyshev	08e7252abf	update NEWS	2014-06-24 10:20:33 -07:00
Stanislav Malyshev	79457d1964	5.4.30	2014-06-24 10:17:49 -07:00
Stanislav Malyshev	6d97b4b2b3	Better fix for bug #67072 with more BC provisions	2014-06-23 22:16:25 -07:00
Stanislav Malyshev	fb0128af2a	Fix bug #67498 - phpinfo() Type Confusion Information Leak Vulnerability	2014-06-23 00:22:59 -07:00
Stanislav Malyshev	f3dd77714d	update CVE	2014-06-23 00:07:08 -07:00
Stanislav Malyshev	c42d5cf5de	Better fix for bug #67072 with more BC provisions	2014-06-21 21:29:11 -07:00
Stanislav Malyshev	88223c5245	Fix bug #67492 : unserialize() SPL ArrayObject / SPLObjectStorage Type Confusion	2014-06-21 19:46:16 -07:00
Stanislav Malyshev	6027c56fd7	Fix bug #67397 (Buffer overflow in locale_get_display_name->uloc_getDisplayName (libicu 4.8.1))	2014-06-21 18:44:14 -07:00
Stanislav Malyshev	aef6432fbe	Fix bug #67349 : Locale::parseLocale Double Free	2014-06-21 18:38:41 -07:00
Stanislav Malyshev	300e0418a4	add CVEs	2014-06-21 18:37:08 -07:00
Dmitry Stogov	680ddabac1	Fixed MarinaDB support	2014-06-20 13:56:32 +04:00
Lior Kaplan	4106d48d1c	Update copyright year to 2014	2014-06-17 23:57:20 +03:00
Lior Kaplan	945938d33c	Update copyright year to 2014	2014-06-17 23:56:46 +03:00
Lior Kaplan	6f3bcb0d6e	Update copyright year for re2c generated files	2014-06-16 23:28:36 +03:00
Lior Kaplan	2d576c2a99	Update copyright year to 2014	2014-06-16 23:27:45 +03:00
Lior Kaplan	e667d23178	Update copyright year for re2c files as well	2014-06-16 23:26:50 +03:00
Bob Weinand	0a3979e08b	Fix patch for bug #67436	2014-06-16 11:10:50 +02:00
Bob Weinand	4053dbe29f	Merge branch 'pull-request/695' into PHP-5.4	2014-06-16 00:35:20 +02:00
Levi Morrison	6c9c44905e	Added tests for bug 67436	2014-06-15 16:31:39 -06:00
Bob Weinand	a84a2d4ace	Fixed wrong XFAIL test - already fixed	2014-06-15 23:52:41 +02:00
Lior Kaplan	d9432d6a50	Fix typo in Bug #67406 NEWS entry	2014-06-16 00:26:01 +03:00
Bob Weinand	85d3ac5763	Updated NEWS	2014-06-15 22:32:47 +02:00
Bob Weinand	ca29063da5	Fix bug #67436	2014-06-15 22:18:25 +02:00
Sara Golemon	21525d0413	Fix potential segfault in dns_get_record() If the remote sends us a packet with a malformed TXT record, we could end up trying to over-consume the packet and wander off into overruns.	2014-06-15 01:04:24 -07:00
Stanislav Malyshev	b053c4f4f6	update NEWS	2014-06-15 00:46:31 -07:00
Derick Rethans	ce70b920e4	- Updated to version 2014.5 (2014e)	2014-06-13 23:26:42 +01:00
Adam Harvey	b51f82f260	Follow 308 Permanent Redirect responses. Fixes bug #67430 (http:// wrapper doesn't follow 308 redirects).	2014-06-12 18:12:53 -07:00
Adam Harvey	fe67674809	Add 308 and 426 to the HTTP response code map in the CLI server. Implements FR #67429 (CLI server is missing some new HTTP response codes).	2014-06-12 17:54:29 -07:00
Adam Harvey	1b9cbab9a7	Keep 308-399 HTTP response codes when header('Location:') is called. Fixes bug #67428 (header('Location: foo') will override a 308-399 response code).	2014-06-12 17:35:05 -07:00
Sara Golemon	5f2a30e111	NEWS entry for "Fix potential segfault in dns_get_record()"	2014-06-11 14:24:13 -07:00
Sara Golemon	4f73394fdd	Fix potential segfault in dns_get_record() If the remote sends us a packet with a malformed TXT record, we could end up trying to over-consume the packet and wander off into overruns.	2014-06-11 13:37:04 -07:00
Stanislav Malyshev	2b04d68972	Fix bug #66127 (Segmentation fault with ArrayObject unset)	2014-06-10 23:24:11 -07:00
Stanislav Malyshev	317bcb96d0	Fix bug #66127 (Segmentation fault with ArrayObject unset)	2014-06-10 23:17:30 -07:00
Stanislav Malyshev	979eed5c6b	5.4.31 next	2014-06-10 23:03:40 -07:00
Stanislav Malyshev	0235a8acdc	5.4.30 rc1	2014-06-10 21:17:37 -07:00
Remi Collet	6256b79a35	NEWS	2014-06-10 14:35:14 +02:00
Remi Collet	25b1dc917a	Fixed Bug #67413 fileinfo: cdf_read_property_info insufficient boundary chec Upstream: https://github.com/file/file/commit/93e063ee374b6a75729df9e7201fb511e47e259d Adapted for C standard.	2014-06-10 14:33:37 +02:00
Remi Collet	da5d40bae6	NEWS	2014-06-10 14:23:31 +02:00
Remi Collet	40ef6e07e0	Bug #67412 fileinfo: cdf_count_chain insufficient boundary check Upstream: https://github.com/file/file/commit/40bade80cbe2af1d0b2cd0420cebd5d5905a2382	2014-06-10 14:22:04 +02:00
Remi Collet	2b33a41162	NEWS	2014-06-10 14:16:00 +02:00
Remi Collet	5c9f967999	Fixed Bug #67411 fileinfo: cdf_check_stream_offset insufficient boundary check Upstream: https://github.com/file/file/commit/36fadd29849b8087af9f4586f89dbf74ea45be67	2014-06-10 14:13:14 +02:00
Remi Collet	d02aa44090	NEWS	2014-06-10 14:04:27 +02:00
Remi Collet	e77659a8c8	Fixed Bug #67410 fileinfo: mconvert incorrect handling of truncated pascal string size Upstream https://github.com/file/file/commit/27a14bc7ba285a0a5ebfdb55e54001aa11932b08	2014-06-10 14:02:36 +02:00
Remi Collet	949cab09f2	NEWS	2014-06-10 10:31:17 +02:00
Remi Collet	58c6a08e00	Fixed bug #67406 built-in web-server segfaults on startup Reproduce on aarch64. From select man page: "select() may update the timeout argument to indicate how much time was left." So "const" is not ok.	2014-06-10 10:28:34 +02:00
Stanislav Malyshev	62857998c5	Fixed bug #67399 (putenv with empty variable may lead to crash)	2014-06-08 23:09:09 -07:00
Matteo Beccati	5c8c57aa6c	Fixed DOM tests when using libxml2 versions patched against CVE-2014-0191 DOMDocument::substituteEntities needs to be set to true in order for external entities to be parsed.	2014-06-09 07:05:23 +02:00
Stanislav Malyshev	9b5d56fd61	add news	2014-06-08 19:44:27 -07:00
Boro Sitnikovski	aebb23e4db	Bug 49898 __getCookies() method implementation	2014-06-08 19:36:18 -07:00
Stanislav Malyshev	e43270cb2a	fix order	2014-06-08 19:03:50 -07:00
Levi Morrison	e030efa4f6	Fix bug 666222 This also adds some smaller, isolated tests related to bug 66622. Conflicts: Zend/zend_vm_def.h Zend/zend_vm_execute.h	2014-06-08 18:59:23 -07:00
Jefersson Nathan	33926b19d0	Fixed identation on file	2014-06-08 14:30:01 -07:00
Jefersson Nathan	e51eaaf665	Fix align indentation	2014-06-08 14:28:51 -07:00
Paul Oehler	76a7fd893b	Added support for parsing ssl certificates using GeneralizedTime format. fix bug #65698 fix bug #66636	2014-06-08 14:17:58 -07:00
Jeff Welch	5fd7c2b01d	Remove superfluous echos.	2014-06-08 13:50:22 -07:00
Remi Collet	811f35d0ed	NEWS	2014-06-06 14:17:54 +02:00
Remi Collet	91bcadd85e	Fix bug #67390 insecure temporary file use in the configure script	2014-06-06 14:16:04 +02:00
Remi Collet	56c9e22c1f	drop exec perm on doc files	2014-06-05 17:45:22 +02:00
Remi Collet	127651e9ae	fix test for 5.4/5.5	2014-06-05 17:33:40 +02:00
Remi Collet	15d8c80ead	add test for previous fix	2014-06-05 14:00:00 +02:00
Remi Collet	3f47368738	NEWS	2014-06-05 13:45:25 +02:00
Remi Collet	1fe9f1e4f5	Fix regression introduce in fix for bug #67118 The fix was correct but break some code (at least in Horde) This is a temporary workaround to fix regressioni in 5.4, 5.5 and 5.6 This make php_date_initialize more consistent - on success return 1 + time initiliazed - on failure return 0 + time = zero which is check by DATE_CHECK_INITIALIZED by later method call Will restore consistency with other date classes in master.	2014-06-05 13:39:46 +02:00
Stanislav Malyshev	e06c4f7fe5	update NEWS	2014-06-04 01:09:37 -07:00