alphabetical order for NEWS blocks

We can not modify result since it can be copy of _zero_ or _one_, etc. and
"copy" in bcmath is just bumping the refcount.

Conflicts:
	main/php_version.h

Makefile.global

@@ -53,7 +53,7 @@ install-headers:
 			paths="$$paths $(INSTALL_ROOT)$(phpincludedir)/$$i"; \
 		done; \
 		$(mkinstalldirs) $$paths && \
-		echo "Installing header files:          $(INSTALL_ROOT)$(phpincludedir)/" && \
+		echo "Installing header files:           $(INSTALL_ROOT)$(phpincludedir)/" && \
 		for i in `echo $(INSTALL_HEADERS)`; do \
 			if test "$(PHP_PECL_EXTENSION)"; then \
 				src=`echo $$i | $(SED) -e "s#ext/$(PHP_PECL_EXTENSION)/##g"`; \

NEWS

@@ -1,13 +1,171 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-21 Jan 2016, PHP 5.6.18RC1
+28 Apr 2016, PHP 5.6.21
+
+- Core: 
+  . Fixed bug #69537 (__debugInfo with empty string for key gives error).
+    (krakjoe)
+  . Fixed bug #71841 (EG(error_zval) is not handled well). (Laruence)
+
+- BCmath:
+  . Fixed bug #72093 (bcpowmod accepts negative scale and corrupts
+    _one_ definition). (Stas)
+
+- Curl:
+  . Fixed bug #71831 (CURLOPT_NOPROXY applied as long instead of string).
+    (Michael Sierks)    
+
+- Date:
+  . Fixed bug #71889 (DateInterval::format Segmentation fault). (Thomas Punt)
+
+- EXIF:
+  . Fixed bug #72094 (Out of bounds heap read access in exif header processing). (Stas)
+
+- GD:
+  . Fixed bug #71952 (Corruption inside imageaffinematrixget). (Stas)
+  . Fixed bug #71912 (libgd: signedness vulnerability). (Stas)
+
+- Intl:
+  . Fixed bug #72061 (Out-of-bounds reads in zif_grapheme_stripos with negative
+    offset). (Stas)
+
+- OCI8:
+  . Fixed bug #71422 (Fix ORA-01438: value larger than specified precision
+    allowed for this column). (Chris Jones)
+
+- ODBC:
+  . Fixed bug #63171 (Script hangs after max_execution_time). (Remi)
+
+- Opcache:
+  . Fixed bug #71843 (null ptr deref ZEND_RETURN_SPEC_CONST_HANDLER).
+    (Laruence)
+
+- PDO:
+  . Fixed bug #52098 (Own PDOStatement implementation ignore __call()).
+    (Daniel Kalaspuffar, Julien)
+  . Fixed bug #71447 (Quotes inside comments not properly handled). (Matteo)
+
+- Postgres:
+  . Fixed bug #71820 (pg_fetch_object binds parameters before call
+    constructor). (Anatol)
+
+- SPL:
+  . Fixed bug #67582 (Cloned SplObjectStorage with overwritten getHash fails
+    offsetExists()). (Nikita)
+
+- Standard:
+  . Fixed bug #71840 (Unserialize accepts wrongly data). (Ryat, Laruence)
+  . Fixed bug #67512 (php_crypt() crashes if crypt_r() does not exist or
+    _REENTRANT is not defined). (Nikita)
+
+- XML:
+  . Fixed bug #72099 (xml_parse_into_struct segmentation fault). (Stas)
+
+31 Mar 2016, PHP 5.6.20
+
+- CLI Server:
+  . Fixed bug #69953 (Support MKCALENDAR request method). (Christoph)
 
 - Core:
-  . Fixed bug #71201 (round() segfault on 64-bit builds). (Anatol)
+  . Fixed bug #71596 (Segmentation fault on ZTS with date function
+    (setlocale)). (Anatol)
+
+- Curl:
+  . Fixed bug #71694 (Support constant CURLM_ADDED_ALREADY). (mpyw)
+
+- Date:
+  . Fixed bug #71635 (DatePeriod::getEndDate segfault). (Thomas Punt)
+
+- Fileinfo:
+  . Fixed bug #71527 (Buffer over-write in finfo_open with malformed magic
+    file). (Anatol)
+
+- Mbstring:
+  . Fixed bug #71906 (AddressSanitizer: negative-size-param (-1) in
+    mbfl_strcut). (Stas)
+
+- ODBC:
+  . Fixed bug #47803, #69526 (Executing prepared statements is succesfull only
+    for the first two statements). (einavitamar at gmail dot com, Anatol)
+  . Fixed bug #71860 (Invalid memory write in phar on filename with \0 in
+    name). (Stas)
+
+- PDO_DBlib:
+  . Fixed bug #54648 (PDO::MSSQL forces format of datetime fields).
+    (steven dot lambeth at gmx dot de, Anatol)
+
+- Phar:
+  . Fixed bug #71625 (Crash in php7.dll with bad phar filename). (Anatol)
+  . Fixed bug #71504 (Parsing of tar file with duplicate filenames causes
+    memory leak). (Jos Elstgeest)
+
+- SNMP:
+  . Fixed bug #71704 (php_snmp_error() Format String Vulnerability).
+    (andrew at jmpesp dot org)
+
+- Standard:
+  . Fixed bug #71798 (Integer Overflow in php_raw_url_encode).
+    (taoguangchen at icloud dot com, Stas)
+
+03 Mar 2016, PHP 5.6.19
+
+- CLI server:
+  . Fixed bug #71559 (Built-in HTTP server, we can download file in web by bug).
+    (Johannes, Anatol)
+
+- CURL:
+  . Fixed bug #71523 (Copied handle with new option CURLOPT_HTTPHEADER crashes
+    while curl_multi_exec). (Laruence)
+
+- Date:
+  . Fixed bug #68078 (Datetime comparisons ignore microseconds). (Willem-Jan
+    Zijderveld)
+  . Fixed bug #71525 (Calls to date_modify will mutate timelib_rel_time,
+    causing date_date_set issues). (Sean DuBois)
+
+- Fileinfo:
+  . Fixed bug #71434 (finfo throws notice for specific python file). (Laruence)
+
+- FPM:
+  . Fixed bug #62172 (FPM not working with Apache httpd 2.4 balancer/fcgi
+    setup). (Matt Haught, Remi)
+
+- Opcache:
+  . Fixed bug  #71584 (Possible use-after-free of ZCG(cwd) in Zend Opcache).
+    (Yussuf Khalil)
+
+- PDO MySQL:
+  . Fixed bug #71569 (#70389 fix causes segmentation fault). (Nikita)
+
+- Phar:
+  . Fixed bug #71498 (Out-of-Bound Read in phar_parse_zipfile()). (Stas)
+
+- Standard:
+  . Fixed bug #70720 (strip_tags improper php code parsing). (Julien)
+
+- WDDX:
+  . Fixed bug #71587 (Use-After-Free / Double-Free in WDDX Deserialize). (Stas)
+
+- XSL:
+  . Fixed bug #71540 (NULL pointer dereference in xsl_ext_function_php()).
+    (Stas)
+
+- Zip:
+  . Fixed bug #71561 (NULL pointer dereference in Zip::ExtractTo). (Laruence)
+
+04 Feb 2016, PHP 5.6.18
+
+- Core:
+  . Fixed bug #71039 (exec functions ignore length but look for NULL
+    termination). (Anatol)
   . Fixed bug #71089 (No check to duplicate zend_extension). (Remi)
+  . Fixed bug #71201 (round() segfault on 64-bit builds). (Anatol)
   . Added support for new HTTP 451 code. (Julien)
   . Fixed bug #71273 (A wrong ext directory setup in php.ini leads to crash).
-    (Anatol);
+    (Anatol)
+  . Fixed bug #71323 (Output of stream_get_meta_data can be falsified by its
+    input). (Leo Gaspard)
+  . Fixed bug #71459 (Integer overflow in iptcembed()). (Stas)
 
 - Apache2handler:
   . Fix >2G Content-Length headers in apache2handler. (Adam Harvey)
@@ -21,15 +179,17 @@ PHP                                                                        NEWS
   . Fixed bug #71024 (Unable to use PHP 7.0 x64 side-by-side with PHP 5.6 x32
     on the same server). (Anatol)
 
+- PCRE:
+  . Upgraded bundled PCRE library to 8.38.
+
+- Phar:
+  . Fixed bug #71354 (Heap corruption in tar/zip/phar parser). (Stas)
+  . Fixed bug #71391 (NULL Pointer Dereference in phar_tar_setupmetadata()).
+    (Stas)
+  . Fixed bug #71488 (Stack overflow when decompressing tar archives). (Stas)
+
 - Session:
-  . Improved fix for bug #68063 (Empty session IDs do still start sessions). (Yasuo)
-  . Fixed bug #69111 (Crash in SessionHandler::read()). (Yasuo)
-  . Fixed bug #71122 (Session GC may not remove obsolete session data). (Yasuo)
-  . Fixed bug #71038 (session_start() returns TRUE on failure).
-    It's fixed partially on PHP 5.6. It still returns TRUE on session read
-    failure for compatibility. Session save handlers should return 'string'
-    always for successful read. i.e. Non-existing session read must return
-    empty string. PHP 7.0 is made not to tolerate buggy return value. (Yasuo)
+  . Fixed bug #69111 (Crash in SessionHandler::read()). (Anatol)
 
 - SOAP:
   . Fixed bug #70979 (crash with bad soap request). (Anatol)
@@ -38,8 +198,8 @@ PHP                                                                        NEWS
   . Fixed bug #71204 (segfault if clean spl_autoload_funcs while autoloading).
     (Laruence)
 
-- Standard:
-  . Fixed bug #70720 (strip_tags improper php code parsing). (Julien)
+- WDDX:
+  . Fixed bug #71335 (Type Confusion in WDDX Packet Deserialization). (Stas)
 
 07 Jan 2016, PHP 5.6.17
 
@@ -76,8 +236,8 @@ PHP                                                                        NEWS
   . Fixed bug #60052 (Integer returned as a 64bit integer on X64_86). (Mariuz)
 
 - WDDX:
-  . Fixed bug #70661 (Use After Free Vulnerability in WDDX Packet Deserialization).
-    (taoguangchen at icloud dot com)
+  . Fixed bug #70661 (Use After Free Vulnerability in WDDX Packet
+    Deserialization). (taoguangchen at icloud dot com)
   . Fixed bug #70741 (Session WDDX Packet Deserialization Type Confusion
     Vulnerability). (taoguangchen at icloud dot com)
 

Zend/tests/bug69537.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Bug #69537 (__debugInfo with empty string for key gives error)
+--FILE--
+<?php
+class Foo {
+
+    public function __debugInfo(){
+        return ['' => 1];
+    }
+}
+
+var_dump(new Foo);
+?>
+--EXPECTF--
+object(Foo)#%d (%d) {
+  [""]=>
+  int(1)
+}
+

Zend/tests/bug71841.phpt

@@ -0,0 +1,23 @@
+--TEST--
+Bug #71841 (EG(error_zval) is not handled well)
+--INI--
+error_reporting=0
+--FILE--
+<?php
+$z = unserialize('O:1:"A":0:{}');
+var_dump($z->e.=0);
+var_dump(++$z->x);
+var_dump($z->y++);
+
+$y = array(PHP_INT_MAX => 0);
+var_dump($y[] .= 0);
+var_dump(++$y[]);
+var_dump($y[]++);
+?>
+--EXPECT--
+NULL
+NULL
+NULL
+NULL
+NULL
+NULL

Zend/zend_compile.c

@@ -5402,7 +5402,7 @@ ZEND_API int zend_unmangle_property_name_ex(const char *mangled_property, int le
 
 	*class_name = NULL;
 
-	if (mangled_property[0]!=0) {
+	if (!len || mangled_property[0] != 0) {
 		*prop_name = mangled_property;
 		if (prop_len) {
 			*prop_len = len;

Zend/zend_virtual_cwd.c

@@ -587,12 +587,14 @@ static inline unsigned long realpath_cache_key(const char *path, int path_len TS
 	register unsigned long h;
 	char *bucket_key_start = tsrm_win32_get_path_sid_key(path TSRMLS_CC);
 	char *bucket_key = (char *)bucket_key_start;
-	const char *e = bucket_key + strlen(bucket_key);
+	const char *e;
 
 	if (!bucket_key) {
 		return 0;
 	}
 
+	e = bucket_key + strlen(bucket_key);
+
 	for (h = 2166136261U; bucket_key < e;) {
 		h *= 16777619;
 		h ^= *bucket_key++;

Zend/zend_vm_def.h

@@ -364,13 +364,20 @@ ZEND_VM_HELPER_EX(zend_binary_assign_op_obj_helper, VAR|UNUSED|CV, CONST|TMP|VAR
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -625,13 +632,20 @@ ZEND_VM_HELPER_EX(zend_pre_incdec_property_helper, VAR|UNUSED|CV, CONST|TMP|VAR|
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -731,13 +745,16 @@ ZEND_VM_HELPER_EX(zend_post_incdec_property_helper, VAR|UNUSED|CV, CONST|TMP|VAR
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
-
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 

Zend/zend_vm_execute.h

@@ -14540,13 +14540,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_CONST(int (*b
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -14800,13 +14807,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_CONST(incdec_t
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -14906,13 +14920,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_CONST(incdec_
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
-
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
@@ -17053,13 +17070,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_TMP(int (*bin
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -17314,13 +17338,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_TMP(incdec_t i
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -17420,13 +17451,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_TMP(incdec_t
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
-
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
@@ -19153,13 +19187,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_VAR(int (*bin
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -19414,13 +19455,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_VAR(incdec_t i
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -19520,13 +19568,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_VAR(incdec_t
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
-
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
@@ -21359,13 +21410,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_UNUSED(int (*
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -22789,13 +22847,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_CV(int (*bina
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -23049,13 +23114,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_CV(incdec_t in
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -23155,13 +23227,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_CV(incdec_t i
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
-
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
@@ -24751,13 +24826,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_CONST(int
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -25010,13 +25092,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_CONST(incde
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -25116,13 +25205,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_CONST(incd
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
-
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
@@ -26164,13 +26256,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_TMP(int (*
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -26424,13 +26523,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_TMP(incdec_
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -26530,13 +26636,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_TMP(incdec
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
-
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
@@ -27486,13 +27595,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_VAR(int (*
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -27746,13 +27862,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_VAR(incdec_
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -27852,13 +27975,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_VAR(incdec
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
-
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
@@ -28809,13 +28935,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_UNUSED(int
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -29240,13 +29373,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_CV(int (*b
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -29499,13 +29639,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_CV(incdec_t
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -29605,13 +29752,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_CV(incdec_
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
-
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
@@ -32075,13 +32225,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_CONST(int (*bi
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -32334,13 +32491,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_CONST(incdec_t
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -32440,13 +32604,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_CONST(incdec_t
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
-
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
@@ -34359,13 +34526,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_TMP(int (*bina
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -34619,13 +34793,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_TMP(incdec_t in
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -34725,13 +34906,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_TMP(incdec_t i
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
-
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
@@ -36322,13 +36506,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_VAR(int (*bina
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -36582,13 +36773,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_VAR(incdec_t in
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -36688,13 +36886,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_VAR(incdec_t i
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
-
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
@@ -38390,13 +38591,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_UNUSED(int (*b
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -39671,13 +39879,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_CV(int (*binar
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -39930,13 +40145,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_CV(incdec_t inc
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -40036,13 +40258,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_CV(incdec_t in
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
-
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 

configure.in

@@ -119,8 +119,8 @@ int zend_sprintf(char *buffer, const char *format, ...);
 
 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=6
-PHP_RELEASE_VERSION=18
-PHP_EXTRA_VERSION="RC1"
+PHP_RELEASE_VERSION=21
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
 

ext/bcmath/bcmath.c

@@ -201,6 +201,21 @@ static void php_str2num(bc_num *num, char *str TSRMLS_DC)
 }
 /* }}} */
 
+/* {{{ split_bc_num
+   Convert to bc_num detecting scale */
+static bc_num split_bc_num(bc_num num) {
+	bc_num newnum;
+	if (num->n_refs >= 1) {
+		return num;
+	}
+	newnum = _bc_new_num_ex(0, 0, 0);
+	*newnum = *num;
+	newnum->n_refs = 1;
+	num->n_refs--;
+	return newnum;
+}
+/* }}} */
+
 /* {{{ proto string bcadd(string left_operand, string right_operand [, int scale])
    Returns the sum of two arbitrary precision numbers */
 PHP_FUNCTION(bcadd)
@@ -214,7 +229,7 @@ PHP_FUNCTION(bcadd)
 	if (zend_parse_parameters(argc TSRMLS_CC, "ss|l", &left, &left_len, &right, &right_len, &scale_param) == FAILURE) {
 		return;
 	}
-	
+
 	if (argc == 3) {
 		scale = (int) ((int)scale_param < 0) ? 0 : scale_param;
 	}
@@ -225,11 +240,12 @@ PHP_FUNCTION(bcadd)
 	php_str2num(&first, left TSRMLS_CC);
 	php_str2num(&second, right TSRMLS_CC);
 	bc_add (first, second, &result, scale);
-	
+
 	if (result->n_scale > scale) {
+		result = split_bc_num(result);
 		result->n_scale = scale;
 	}
-	
+
 	Z_STRVAL_P(return_value) = bc_num2str(result);
 	Z_STRLEN_P(return_value) = strlen(Z_STRVAL_P(return_value));
 	Z_TYPE_P(return_value) = IS_STRING;
@@ -253,7 +269,7 @@ PHP_FUNCTION(bcsub)
 	if (zend_parse_parameters(argc TSRMLS_CC, "ss|l", &left, &left_len, &right, &right_len, &scale_param) == FAILURE) {
 		return;
 	}
-	
+
 	if (argc == 3) {
 		scale = (int) ((int)scale_param < 0) ? 0 : scale_param;
 	}
@@ -266,6 +282,7 @@ PHP_FUNCTION(bcsub)
 	bc_sub (first, second, &result, scale);
 
 	if (result->n_scale > scale) {
+		result = split_bc_num(result);
 		result->n_scale = scale;
 	}
 
@@ -292,11 +309,11 @@ PHP_FUNCTION(bcmul)
 	if (zend_parse_parameters(argc TSRMLS_CC, "ss|l", &left, &left_len, &right, &right_len, &scale_param) == FAILURE) {
 		return;
 	}
-	
+
 	if (argc == 3) {
 		scale = (int) ((int)scale_param < 0) ? 0 : scale_param;
 	}
-	
+
 	bc_init_num(&first TSRMLS_CC);
 	bc_init_num(&second TSRMLS_CC);
 	bc_init_num(&result TSRMLS_CC);
@@ -305,6 +322,7 @@ PHP_FUNCTION(bcmul)
 	bc_multiply (first, second, &result, scale TSRMLS_CC);
 
 	if (result->n_scale > scale) {
+		result = split_bc_num(result);
 		result->n_scale = scale;
 	}
 
@@ -331,11 +349,11 @@ PHP_FUNCTION(bcdiv)
 	if (zend_parse_parameters(argc TSRMLS_CC, "ss|l", &left, &left_len, &right, &right_len, &scale_param) == FAILURE) {
 		return;
 	}
-	
+
 	if (argc == 3) {
 		scale = (int) ((int)scale_param < 0) ? 0 : scale_param;
 	}
-	
+
 	bc_init_num(&first TSRMLS_CC);
 	bc_init_num(&second TSRMLS_CC);
 	bc_init_num(&result TSRMLS_CC);
@@ -345,6 +363,7 @@ PHP_FUNCTION(bcdiv)
 	switch (bc_divide(first, second, &result, scale TSRMLS_CC)) {
 		case 0: /* OK */
 			if (result->n_scale > scale) {
+				result = split_bc_num(result);
 				result->n_scale = scale;
 			}
 			Z_STRVAL_P(return_value) = bc_num2str(result);
@@ -374,13 +393,13 @@ PHP_FUNCTION(bcmod)
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ss", &left, &left_len, &right, &right_len) == FAILURE) {
 		return;
 	}
-	
+
 	bc_init_num(&first TSRMLS_CC);
 	bc_init_num(&second TSRMLS_CC);
 	bc_init_num(&result TSRMLS_CC);
 	bc_str2num(&first, left, 0 TSRMLS_CC);
 	bc_str2num(&second, right, 0 TSRMLS_CC);
-	
+
 	switch (bc_modulo(first, second, &result, 0 TSRMLS_CC)) {
 		case 0:
 			Z_STRVAL_P(return_value) = bc_num2str(result);
@@ -391,7 +410,7 @@ PHP_FUNCTION(bcmod)
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Division by zero");
 			break;
 	}
-	
+
 	bc_free_num(&first);
 	bc_free_num(&second);
 	bc_free_num(&result);
@@ -424,8 +443,9 @@ PHP_FUNCTION(bcpowmod)
 	scale_int = (int) ((int)scale < 0) ? 0 : scale;
 
 	if (bc_raisemod(first, second, mod, &result, scale_int TSRMLS_CC) != -1) {
-		if (result->n_scale > scale) {
-			result->n_scale = scale;
+		if (result->n_scale > scale_int) {
+			result = split_bc_num(result);
+			result->n_scale = scale_int;
 		}
 		Z_STRVAL_P(return_value) = bc_num2str(result);
 		Z_STRLEN_P(return_value) = strlen(Z_STRVAL_P(return_value));
@@ -433,7 +453,7 @@ PHP_FUNCTION(bcpowmod)
 	} else {
 		RETVAL_FALSE;
 	}
-	
+
 	bc_free_num(&first);
 	bc_free_num(&second);
 	bc_free_num(&mod);
@@ -455,7 +475,7 @@ PHP_FUNCTION(bcpow)
 	if (zend_parse_parameters(argc TSRMLS_CC, "ss|l", &left, &left_len, &right, &right_len, &scale_param) == FAILURE) {
 		return;
 	}
-	
+
 	if (argc == 3) {
 		scale = (int) ((int)scale_param < 0) ? 0 : scale_param;
 	}
@@ -468,6 +488,7 @@ PHP_FUNCTION(bcpow)
 	bc_raise (first, second, &result, scale TSRMLS_CC);
 
 	if (result->n_scale > scale) {
+		result = split_bc_num(result);
 		result->n_scale = scale;
 	}
 
@@ -494,16 +515,17 @@ PHP_FUNCTION(bcsqrt)
 	if (zend_parse_parameters(argc TSRMLS_CC, "s|l", &left, &left_len, &scale_param) == FAILURE) {
 		return;
 	}
-	
+
 	if (argc == 2) {
 		scale = (int) ((int)scale_param < 0) ? 0 : scale_param;
 	}
 
 	bc_init_num(&result TSRMLS_CC);
 	php_str2num(&result, left TSRMLS_CC);
-	
+
 	if (bc_sqrt (&result, scale TSRMLS_CC) != 0) {
 		if (result->n_scale > scale) {
+			result = split_bc_num(result);
 			result->n_scale = scale;
 		}
 		Z_STRVAL_P(return_value) = bc_num2str(result);
@@ -531,7 +553,7 @@ PHP_FUNCTION(bccomp)
 	if (zend_parse_parameters(argc TSRMLS_CC, "ss|l", &left, &left_len, &right, &right_len, &scale_param) == FAILURE) {
 		return;
 	}
-	
+
 	if (argc == 3) {
 		scale = (int) ((int)scale_param < 0) ? 0 : scale_param;
 	}
@@ -555,7 +577,7 @@ PHP_FUNCTION(bccomp)
 PHP_FUNCTION(bcscale)
 {
 	long new_scale;
-	
+
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "l", &new_scale) == FAILURE) {
 		return;
 	}

ext/bcmath/tests/bug72093-win32.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug 72093: bcpowmod accepts negative scale and corrupts _one_ definition
+--SKIPIF--
+<?php
+if(!extension_loaded("bcmath")) print "skip";
+if (substr(PHP_OS, 0, 3) != 'WIN') {
+    die('skip valid only for windows');
+}
+?>
+--FILE--
+<?php
+var_dump(bcpowmod(1, "A", 128, -200));
+var_dump(bcpowmod(1, 1.2, 1, 1));
+?>
+--EXPECTF--
+string(1) "1"
+string(3) "0.0"
+bc math warning: non-zero scale in exponent

ext/bcmath/tests/bug72093.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug 72093: bcpowmod accepts negative scale and corrupts _one_ definition
+--SKIPIF--
+<?php
+if(!extension_loaded("bcmath")) print "skip";
+if (substr(PHP_OS, 0, 3) == 'WIN') {
+    die('skip Not valid for windows');
+}
+?>
+--FILE--
+<?php
+var_dump(bcpowmod(1, "A", 128, -200));
+var_dump(bcpowmod(1, 1.2, 1, 1));
+?>
+--EXPECTF--
+string(1) "1"
+bc math warning: non-zero scale in exponent
+string(3) "0.0"

ext/curl/interface.c

@@ -831,6 +831,9 @@ PHP_MINIT_FUNCTION(curl)
 	REGISTER_CURL_CONSTANT(CURLM_INTERNAL_ERROR);
 	REGISTER_CURL_CONSTANT(CURLM_OK);
 	REGISTER_CURL_CONSTANT(CURLM_OUT_OF_MEMORY);
+#if LIBCURL_VERSION_NUM >= 0x072001 /* Available since 7.32.1 */
+	REGISTER_CURL_CONSTANT(CURLM_ADDED_ALREADY);
+#endif
 
 	/* Curl proxy constants */
 	REGISTER_CURL_CONSTANT(CURLPROXY_HTTP);
@@ -2220,7 +2223,6 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue TSRMLS_DC)
 		case CURLOPT_CERTINFO:
 #endif
 #if LIBCURL_VERSION_NUM >= 0x071304 /* Available since 7.19.4 */
-		case CURLOPT_NOPROXY:
 		case CURLOPT_PROTOCOLS:
 		case CURLOPT_REDIR_PROTOCOLS:
 		case CURLOPT_SOCKS5_GSSAPI_NEC:
@@ -2302,6 +2304,7 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue TSRMLS_DC)
 		case CURLOPT_USERNAME:
 #endif
 #if LIBCURL_VERSION_NUM >= 0x071304 /* Available since 7.19.4 */
+		case CURLOPT_NOPROXY:
 		case CURLOPT_SOCKS5_GSSAPI_SERVICE:
 #endif
 #if LIBCURL_VERSION_NUM >= 0x071400 /* Available since 7.20.0 */
@@ -2543,7 +2546,12 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue TSRMLS_DC)
 					return 1;
 				}
 			}
-			zend_hash_index_update(ch->to_free->slist, (ulong) option, &slist, sizeof(struct curl_slist *), NULL);
+
+			if (Z_REFCOUNT_P(ch->clone) <= 1) {
+				zend_hash_index_update(ch->to_free->slist, (ulong) option, &slist, sizeof(struct curl_slist *), NULL);
+			} else {
+				zend_hash_next_index_insert(ch->to_free->slist, &slist, sizeof(struct curl_slist *), NULL);
+			}
 
 			error = curl_easy_setopt(ch->cp, option, slist);
 

ext/curl/tests/bug71523.phpt

@@ -0,0 +1,28 @@
+--TEST--
+Bug #71523 (Copied handle with new option CURLOPT_HTTPHEADER crashes while curl_multi_exec)
+--SKIPIF--
+<?php
+if (!extension_loaded("curl")) {
+        exit("skip curl extension not loaded");
+}
+?>
+--FILE--
+<?php
+
+$base = curl_init('http://www.google.com/');
+curl_setopt($base, CURLOPT_RETURNTRANSFER, true);
+$mh = curl_multi_init();
+
+for ($i = 0; $i < 2; ++$i) {
+	$ch = curl_copy_handle($base);
+	curl_setopt($ch, CURLOPT_HTTPHEADER, ['Foo: Bar']);
+	curl_multi_add_handle($mh, $ch);
+}
+
+do {
+	curl_multi_exec($mh, $active);
+} while ($active);
+?>
+okey
+--EXPECTF--
+okey

ext/date/config.w32

@@ -12,6 +12,7 @@ tl_config.WriteLine("#include \"config.w32.h\"");
 tl_config.WriteLine("#include <php_stdint.h>");
 tl_config.WriteLine("#include \"win32/php_inttypes.h\"");
 tl_config.WriteLine("#define TIMELIB_OMIT_STDINT 1");
+tl_config.WriteLine("#define TIMELIB_FORCE_LONG32 1");
 tl_config.Close();
 
 PHP_INSTALL_HEADERS("ext/date/", "php_date.h lib/timelib.h lib/timelib_structs.h lib/timelib_config.h");

ext/date/lib/interval.c

@@ -70,7 +70,7 @@ timelib_rel_time *timelib_diff(timelib_time *one, timelib_time *two)
 		rt->i += dst_m_corr;
 	}
 
-	rt->days = abs(floor((one->sse - two->sse - (dst_h_corr * 3600) - (dst_m_corr * 60)) / 86400));
+	rt->days = fabs(floor((one->sse - two->sse - (dst_h_corr * 3600) - (dst_m_corr * 60)) / 86400));
 
 	timelib_do_rel_normalize(rt->invert ? one : two, rt);
 

ext/date/lib/parse_date.re

@@ -1812,6 +1812,11 @@ timelib_time* timelib_strtotime(char *s, size_t len, struct timelib_error_contai
 		{                                                              \
 			add_pbf_error(s, "Unexpected data found.", string, begin); \
 		}
+#define TIMELIB_CHECK_SIGNED_NUMBER                                    \
+		if (strchr("-0123456789", *ptr) == NULL)                       \
+		{                                                              \
+			add_pbf_error(s, "Unexpected data found.", string, begin); \
+		}
 
 static void timelib_time_reset_fields(timelib_time *time)
 {
@@ -2016,7 +2021,7 @@ timelib_time *timelib_parse_from_format(char *format, char *string, size_t len,
 				timelib_eat_spaces((char **) &ptr);
 				break;
 			case 'U': /* epoch seconds */
-				TIMELIB_CHECK_NUMBER;
+				TIMELIB_CHECK_SIGNED_NUMBER;
 				TIMELIB_HAVE_RELATIVE();
 				tmp = timelib_get_unsigned_nr((char **) &ptr, 24);
 				s->time->y = 1970;

ext/date/lib/timelib.c

@@ -65,6 +65,23 @@ timelib_time* timelib_time_clone(timelib_time *orig)
 	return tmp;
 }
 
+int timelib_time_compare(timelib_time *t1, timelib_time *t2)
+{
+	if (t1->sse == t2->sse) {
+		if (t1->f == t2->f) {
+			return 0;
+		}
+
+		if (t1->sse < 0) {
+			return (t1->f < t2->f) ? 1 : -1;
+		} else {
+			return (t1->f < t2->f) ? -1 : 1;
+		}
+	}
+
+	return (t1->sse < t2->sse) ? -1 : 1;
+}
+
 timelib_rel_time* timelib_rel_time_clone(timelib_rel_time *rel)
 {
 	timelib_rel_time *tmp = timelib_rel_time_ctor();

ext/date/lib/timelib.h

@@ -138,6 +138,7 @@ timelib_time* timelib_time_ctor(void);
 void timelib_time_set_option(timelib_time* tm, int option, void* option_value);
 void timelib_time_dtor(timelib_time* t);
 timelib_time* timelib_time_clone(timelib_time* orig);
+int timelib_time_compare(timelib_time *t1, timelib_time *t2);
 
 timelib_time_offset* timelib_time_offset_ctor(void);
 void timelib_time_offset_dtor(timelib_time_offset* t);

ext/date/lib/timelib_structs.h

@@ -125,7 +125,7 @@ typedef unsigned __int64  uint64_t;
 #include <strings.h>
 #endif
 
-#if defined(__x86_64__) || defined(__LP64__) || defined(_LP64) || defined(_WIN64)
+#if (defined(__x86_64__) || defined(__LP64__) || defined(_LP64) || defined(_WIN64)) && !defined(TIMELIB_FORCE_LONG32)
 typedef int64_t timelib_long;
 typedef uint64_t timelib_ulong;
 # define TIMELIB_LONG_MAX INT64_MAX

ext/date/php_date.c

@@ -2195,8 +2195,8 @@ static int date_object_compare_date(zval *d1, zval *d2 TSRMLS_DC)
 	if (!o2->time->sse_uptodate) {
 		timelib_update_ts(o2->time, o2->time->tz_info);
 	}
-	
-	return (o1->time->sse == o2->time->sse) ? 0 : ((o1->time->sse < o2->time->sse) ? -1 : 1);
+
+	return timelib_time_compare(o1->time, o2->time);
 }
 
 static HashTable *date_object_get_gc(zval *object, zval ***table, int *n TSRMLS_DC)
@@ -3143,6 +3143,7 @@ static int php_date_modify(zval *object, char *modify, int modify_len TSRMLS_DC)
 	timelib_update_ts(dateobj->time, NULL);
 	timelib_update_from_sse(dateobj->time);
 	dateobj->time->have_relative = 0;
+	memset(&dateobj->time->relative, 0, sizeof(dateobj->time->relative));
 	
 	return 1;
 }
@@ -4308,7 +4309,7 @@ static char *date_interval_format(char *format, int format_len, timelib_rel_time
 	char                 buffer[33];
 
 	if (!format_len) {
-		return estrdup("");
+		return STR_EMPTY_ALLOC();
 	}
 
 	for (i = 0; i < format_len; i++) {
@@ -4358,6 +4359,10 @@ static char *date_interval_format(char *format, int format_len, timelib_rel_time
 
 	smart_str_0(&string);
 
+	if (string.c == NULL) {
+		return STR_EMPTY_ALLOC();
+	}
+
 	return string.c;
 }
 /* }}} */
@@ -4535,6 +4540,10 @@ PHP_METHOD(DatePeriod, getEndDate)
 
         dpobj = (php_period_obj *)zend_object_store_get_object(getThis() TSRMLS_CC);
 
+        if (!dpobj->end) {
+                return;
+        }
+
         php_date_instantiate(dpobj->start_ce, return_value TSRMLS_CC);
         dateobj = (php_date_obj *)zend_object_store_get_object(return_value TSRMLS_CC);
         dateobj->time = timelib_time_ctor();

ext/date/tests/bug68078.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Comparing datetime objects should account for microseconds
+--FILE--
+<?php
+
+date_default_timezone_set('UTC');
+$date1 = DateTime::createFromFormat('U.u', '1448889063.3531');
+$date2 = DateTime::createFromFormat('U.u', '1448889063.5216');
+$date3 = DateTime::createFromFormat('U.u', '1448889063.5216');
+
+var_dump($date1 == $date2);
+var_dump($date1 < $date2);
+var_dump($date2 > $date1);
+var_dump($date2 == $date3);
+--EXPECT--
+bool(false)
+bool(true)
+bool(true)
+bool(true)

ext/date/tests/bug68078_negative.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Comparing datetime objects with negative timestamps should account for microseconds
+--FILE--
+<?php
+
+date_default_timezone_set('UTC');
+$earlyDate1 = DateTime::createFromFormat('U.u', '1.8642')->modify('-5 seconds');
+$earlyDate2 = DateTime::createFromFormat('U.u', '1.2768')->modify('-5 seconds');
+$earlyDate3 = DateTime::createFromFormat('U.u', '1.2768')->modify('-5 seconds');
+
+var_dump($earlyDate1 == $earlyDate2);
+var_dump($earlyDate1 < $earlyDate2);
+var_dump($earlyDate2 > $earlyDate1);
+var_dump($earlyDate2 == $earlyDate3);
+--EXPECT--
+bool(false)
+bool(true)
+bool(true)
+bool(true)

ext/date/tests/bug71525.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #71525 (Calls to date_modify will mutate timelib_rel_time, causing date_date_set issues)
+--INI--
+date.timezone=UTC
+--FILE--
+<?php
+$date = new DateTime('2011-12-25 00:00:00');
+$date->modify('first day of next month');
+$date->setDate('2012', '1', '29');
+var_dump($date);
+
+--EXPECTF--
+object(DateTime)#%d (3) {
+  ["date"]=>
+  string(26) "2012-01-29 00:00:00.000000"
+  ["timezone_type"]=>
+  int(3)
+  ["timezone"]=>
+  string(3) "UTC"
+}

ext/date/tests/bug71635.phpt

@@ -0,0 +1,11 @@
+--TEST--
+Bug #71635 (segfault in DatePeriod::getEndDate() when no end date has been set)
+--FILE--
+<?php
+date_default_timezone_set('UTC');
+$period = new DatePeriod(new DateTimeImmutable("now"), new DateInterval("P2Y4DT6H8M"), 2);
+
+var_dump($period->getEndDate());
+?>
+--EXPECT--
+NULL

ext/date/tests/bug71889.phpt

@@ -0,0 +1,11 @@
+--TEST--
+Bug #71889 (DateInterval::format segfault on '%' input)
+--INI--
+date.timezone=US/Eastern
+--FILE--
+<?php
+$di = new DateInterval('P1D');
+var_dump($di->format("%"));
+?>
+--EXPECT--
+string(0) ""

ext/exif/exif.c

@@ -2955,7 +2955,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 						/* When there are any characters after the first NUL */
 						ImageInfo->CopyrightPhotographer  = estrdup(value_ptr);
 						ImageInfo->CopyrightEditor        = estrndup(value_ptr+length+1, byte_count-length-1);
-						spprintf(&ImageInfo->Copyright, 0, "%s, %s", value_ptr, value_ptr+length+1);
+						spprintf(&ImageInfo->Copyright, 0, "%s, %s", ImageInfo->CopyrightPhotographer, ImageInfo->CopyrightEditor);
 						/* format = TAG_FMT_UNDEFINED; this musn't be ASCII         */
 						/* but we are not supposed to change this                   */
 						/* keep in mind that image_info does not store editor value */
@@ -3124,6 +3124,11 @@ static int exif_process_IFD_in_JPEG(image_info_type *ImageInfo, char *dir_start,
 
 	ImageInfo->sections_found |= FOUND_IFD0;
 
+	if ((dir_start + 2) >= (offset_base+IFDlength)) {
+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size");
+		return FALSE;
+	}
+
 	NumDirEntries = php_ifd_get16u(dir_start, ImageInfo->motorola_intel);
 
 	if ((dir_start+2+NumDirEntries*12) > (offset_base+IFDlength)) {
@@ -3147,6 +3152,10 @@ static int exif_process_IFD_in_JPEG(image_info_type *ImageInfo, char *dir_start,
 	 * Hack to make it process IDF1 I hope
 	 * There are 2 IDFs, the second one holds the keys (0x0201 and 0x0202) to the thumbnail
 	 */
+	if ((dir_start+2+12*de + 4) >= (offset_base+IFDlength)) {
+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size");
+		return FALSE;
+	}
 	NextDirOffset = php_ifd_get32u(dir_start+2+12*de, ImageInfo->motorola_intel);
 	if (NextDirOffset) {
 		/* the next line seems false but here IFDlength means length of all IFDs */
@@ -3196,9 +3205,13 @@ static void exif_process_TIFF_in_JPEG(image_info_type *ImageInfo, char *CharBuf,
 	}
 
 	/* Check the next two values for correctness. */
+	if (length < 8) {
+		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid TIFF start (1)");
+		return;
+	}
 	exif_value_2a = php_ifd_get16u(CharBuf+2, ImageInfo->motorola_intel);
 	offset_of_ifd = php_ifd_get32u(CharBuf+4, ImageInfo->motorola_intel);
-	if ( exif_value_2a != 0x2a || offset_of_ifd < 0x08) {
+	if (exif_value_2a != 0x2a || offset_of_ifd < 0x08) {
 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid TIFF start (1)");
 		return;
 	}

ext/exif/tests/bug72094.phpt

@@ -0,0 +1,61 @@
+--TEST--
+Bug #72094: Out of bounds heap read access in exif header processing
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+print_r(exif_read_data(__DIR__ . '/bug72094_1.jpg'));
+print_r(exif_read_data(__DIR__ . '/bug72094_2.jpg'));
+print_r(exif_read_data(__DIR__ . '/bug72094_3.jpg'));
+print_r(exif_read_data(__DIR__ . '/bug72094_4.jpg'));
+?>
+DONE
+--EXPECTF--
+Warning: exif_read_data(bug72094_1.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_1.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_1.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_1.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_1.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_1.jpg): Process tag(x8298=Copyright  ): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_1.jpg): Illegal IFD offset in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_1.jpg): File structure corrupted in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_1.jpg): Invalid JPEG file in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_2.jpg): Illegal IFD size in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_2.jpg): File structure corrupted in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_2.jpg): Invalid JPEG file in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_3.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_3.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_3.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_3.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_3.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_3.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_3.jpg): Illegal IFD size in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_3.jpg): File structure corrupted in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_3.jpg): Invalid JPEG file in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_4.jpg): Invalid TIFF start (1) in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_4.jpg): File structure corrupted in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_4.jpg): Invalid JPEG file in %s%ebug72094.php on line %d
+DONE

ext/fileinfo/libmagic.patch

@@ -1,6 +1,6 @@
 diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
---- libmagic.orig/apprentice.c	Tue Nov 19 22:01:12 2013
-+++ libmagic/apprentice.c	Sun Jan  4 17:06:01 2015
+--- libmagic.orig/apprentice.c	2016-01-25 11:17:38.141978563 +0800
++++ libmagic/apprentice.c	2016-01-25 11:19:37.409347842 +0800
 @@ -29,6 +29,8 @@
   * apprentice - make one pass through /etc/magic, learning its secrets.
   */
@@ -530,7 +530,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  	m->mimetype[0] = '\0';		/* initialise MIME type to none */
  	return 0;
  }
-@@ -2575,59 +2597,76 @@
+@@ -2575,59 +2597,75 @@
  private struct magic_map *
  apprentice_map(struct magic_set *ms, const char *fn)
  {
@@ -544,29 +544,29 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  	size_t i;
 +	php_stream *stream = NULL;
 +	php_stream_statbuf st;
-+
-+
-+	TSRMLS_FETCH();
  
 -	fd = -1;
 -	if ((map = CAST(struct magic_map *, calloc(1, sizeof(*map)))) == NULL) {
++
++	TSRMLS_FETCH();
++
 +	if ((map = CAST(struct magic_map *, ecalloc(1, sizeof(*map)))) == NULL) {
  		file_oomem(ms, sizeof(*map));
-+		efree(map);
- 		goto error;
- 	}
- 
+-		goto error;
++		return NULL;
++	}
++
 +	if (fn == NULL) {
 +		map->p = (void *)&php_magic_database;
 +		goto internal_loaded;
-+	}
-+
+ 	}
+ 
 +#ifdef PHP_WIN32
 +	/* Don't bother on windows with php_stream_open_wrapper,
 +	return to give apprentice_load() a chance. */
 +	if (php_stream_stat_path_ex((char *)fn, 0, &st, NULL) == SUCCESS) {
 +               if (st.sb.st_mode & S_IFDIR) {
-+                       goto error;
++                       return NULL;
 +               }
 +       }
 +#endif
@@ -628,7 +628,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  	if (*ptr != MAGICNO) {
  		if (swap4(*ptr) != MAGICNO) {
  			file_error(ms, 0, "bad magic in `%s'", dbname);
-@@ -2641,17 +2680,29 @@
+@@ -2641,17 +2679,29 @@
  	else
  		version = ptr[1];
  	if (version != VERSIONNO) {
@@ -666,7 +666,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  	}
  	map->magic[0] = CAST(struct magic *, map->p) + 1;
  	nentries = 0;
-@@ -2664,22 +2715,29 @@
+@@ -2664,22 +2714,29 @@
  			map->magic[i + 1] = map->magic[i] + map->nmagic[i];
  		nentries += map->nmagic[i];
  	}
@@ -701,7 +701,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  	return NULL;
  }
  
-@@ -2700,14 +2758,19 @@
+@@ -2700,14 +2757,19 @@
  	char *dbname;
  	int rv = -1;
  	uint32_t i;
@@ -724,7 +724,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  		file_error(ms, errno, "cannot open `%s'", dbname);
  		goto out;
  	}
-@@ -2717,31 +2780,33 @@
+@@ -2717,31 +2779,33 @@
  		goto out;
  	}
  
@@ -764,7 +764,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  	return rv;
  }
  
-@@ -2754,6 +2819,7 @@
+@@ -2754,6 +2818,7 @@
  {
  	const char *p, *q;
  	char *buf;
@@ -772,7 +772,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  
  	if (strip) {
  		if ((p = strrchr(fn, '/')) != NULL)
-@@ -2775,16 +2841,18 @@
+@@ -2775,16 +2840,18 @@
  	q++;
  	/* Compatibility with old code that looked in .mime */
  	if (ms->flags & MAGIC_MIME) {
@@ -797,7 +797,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  
  	/* Compatibility with old code that looked in .mime */
  	if (strstr(p, ".mime") != NULL)
-@@ -2874,7 +2942,7 @@
+@@ -2874,7 +2941,7 @@
  	m->offset = swap4((uint32_t)m->offset);
  	m->in_offset = swap4((uint32_t)m->in_offset);
  	m->lineno = swap4((uint32_t)m->lineno);
@@ -807,8 +807,8 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  		m->str_flags = swap4(m->str_flags);
  	}
 diff -u libmagic.orig/ascmagic.c libmagic/ascmagic.c
---- libmagic.orig/ascmagic.c	Thu Feb 13 00:20:53 2014
-+++ libmagic/ascmagic.c	Sun Jan  4 17:06:01 2015
+--- libmagic.orig/ascmagic.c	2016-01-25 11:17:38.161978563 +0800
++++ libmagic/ascmagic.c	2016-01-25 11:19:37.410347842 +0800
 @@ -139,7 +139,7 @@
  		/* malloc size is a conservative overestimate; could be
  		   improved, or at least realloced after conversion. */
@@ -829,8 +829,8 @@ diff -u libmagic.orig/ascmagic.c libmagic/ascmagic.c
  	return rv;
  }
 diff -u libmagic.orig/cdf.c libmagic/cdf.c
---- libmagic.orig/cdf.c	Tue Feb 26 17:20:42 2013
-+++ libmagic/cdf.c	Sun Jan  4 17:06:01 2015
+--- libmagic.orig/cdf.c	2016-01-25 11:17:38.140978563 +0800
++++ libmagic/cdf.c	2016-01-25 11:19:37.410347842 +0800
 @@ -35,7 +35,7 @@
  #include "file.h"
  
@@ -1050,8 +1050,8 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
  				(void)fprintf(stderr, "timestamp %s\n", buf);
  			} else {
 diff -u libmagic.orig/cdf.h libmagic/cdf.h
---- libmagic.orig/cdf.h	Thu Jun 21 00:19:55 2012
-+++ libmagic/cdf.h	Sun Jan  4 17:06:01 2015
+--- libmagic.orig/cdf.h	2016-01-25 11:17:38.160978563 +0800
++++ libmagic/cdf.h	2016-01-25 11:19:37.410347842 +0800
 @@ -35,10 +35,12 @@
  #ifndef _H_CDF_
  #define _H_CDF_
@@ -1103,8 +1103,8 @@ diff -u libmagic.orig/cdf.h libmagic/cdf.h
      cdf_property_info_t **, size_t *, size_t *);
  int cdf_read_summary_info(const cdf_info_t *, const cdf_header_t *,
 diff -u libmagic.orig/cdf_time.c libmagic/cdf_time.c
---- libmagic.orig/cdf_time.c	Thu Jun 21 00:18:33 2012
-+++ libmagic/cdf_time.c	Sun Nov  9 19:16:18 2014
+--- libmagic.orig/cdf_time.c	2016-01-25 11:17:38.160978563 +0800
++++ libmagic/cdf_time.c	2016-01-25 11:19:37.410347842 +0800
 @@ -96,7 +96,7 @@
  }
  
@@ -1163,8 +1163,8 @@ diff -u libmagic.orig/cdf_time.c libmagic/cdf_time.c
  	static const cdf_timestamp_t tst = 0x01A5E403C2D59C00ULL;
  	static const char *ref = "Sat Apr 23 01:30:00 1977";
 diff -u libmagic.orig/compress.c libmagic/compress.c
---- libmagic.orig/compress.c	Sun Jan  5 16:55:21 2014
-+++ libmagic/compress.c	Sun Jan  4 17:06:01 2015
+--- libmagic.orig/compress.c	2016-01-25 11:17:38.149978563 +0800
++++ libmagic/compress.c	2016-01-25 11:19:37.410347842 +0800
 @@ -32,6 +32,7 @@
   *	uncompress(method, old, n, newch) - uncompress old into new, 
   *					    using method, return sizeof new
@@ -1326,8 +1326,8 @@ diff -u libmagic.orig/compress.c libmagic/compress.c
 -#endif
 +#endif /* if PHP_FILEINFO_UNCOMPRESS */
 diff -u libmagic.orig/file.h libmagic/file.h
---- libmagic.orig/file.h	Thu Feb 13 00:20:53 2014
-+++ libmagic/file.h	Sun Jan  4 17:06:01 2015
+--- libmagic.orig/file.h	2016-01-25 11:17:38.140978563 +0800
++++ libmagic/file.h	2016-01-25 11:19:37.411347842 +0800
 @@ -33,11 +33,9 @@
  #ifndef __file_h__
  #define __file_h__
@@ -1485,24 +1485,22 @@ diff -u libmagic.orig/file.h libmagic/file.h
  size_t strlcat(char *, const char *, size_t);
  #endif
  #ifndef HAVE_STRCASESTR
-@@ -535,6 +516,14 @@
- #endif
- #else
+@@ -537,4 +518,12 @@
  #define FILE_RCSID(id)
-+#endif
-+
+ #endif
+ 
 +#ifdef PHP_WIN32
 +#define FINFO_LSEEK_FUNC _lseek
 +#define FINFO_READ_FUNC _read
 +#else
 +#define FINFO_LSEEK_FUNC lseek
 +#define FINFO_READ_FUNC read
- #endif
- 
++#endif
++
  #endif /* __file_h__ */
 diff -u libmagic.orig/fsmagic.c libmagic/fsmagic.c
---- libmagic.orig/fsmagic.c	Sun Dec  1 20:22:13 2013
-+++ libmagic/fsmagic.c	Sun Jan  4 17:06:01 2015
+--- libmagic.orig/fsmagic.c	2016-01-25 11:17:38.139978563 +0800
++++ libmagic/fsmagic.c	2016-01-25 11:19:37.411347842 +0800
 @@ -59,27 +59,21 @@
  # define minor(dev)  ((dev) & 0xff)
  #endif
@@ -1826,8 +1824,8 @@ diff -u libmagic.orig/fsmagic.c libmagic/fsmagic.c
  	return ret;
  }
 diff -u libmagic.orig/funcs.c libmagic/funcs.c
---- libmagic.orig/funcs.c	Thu Feb 13 00:20:53 2014
-+++ libmagic/funcs.c	Sun Jan  4 17:06:01 2015
+--- libmagic.orig/funcs.c	2016-01-25 11:17:38.150978563 +0800
++++ libmagic/funcs.c	2016-01-25 11:19:37.411347842 +0800
 @@ -27,7 +27,7 @@
  #include "file.h"
  
@@ -2165,9 +2163,10 @@ diff -u libmagic.orig/funcs.c libmagic/funcs.c
 -	return rv;
 +	return rep_cnt;
  }
+Common subdirectories: libmagic.orig/.libs and libmagic/.libs
 diff -u libmagic.orig/magic.c libmagic/magic.c
---- libmagic.orig/magic.c	Sun Dec  1 20:22:13 2013
-+++ libmagic/magic.c	Sun Jan  4 17:06:01 2015
+--- libmagic.orig/magic.c	2016-01-25 11:17:38.161978563 +0800
++++ libmagic/magic.c	2016-01-25 11:19:37.411347842 +0800
 @@ -25,11 +25,6 @@
   * SUCH DAMAGE.
   */
@@ -2505,17 +2504,8 @@ diff -u libmagic.orig/magic.c libmagic/magic.c
  public const char *
  magic_error(struct magic_set *ms)
 diff -u libmagic.orig/magic.h libmagic/magic.h
---- libmagic.orig/magic.h	Tue Feb 11 16:30:44 2014
-+++ libmagic/magic.h	Sun Jan  4 17:06:01 2015
-@@ -75,7 +75,7 @@
- #define	MAGIC_NO_CHECK_FORTRAN	0x000000 /* Don't check ascii/fortran */
- #define	MAGIC_NO_CHECK_TROFF	0x000000 /* Don't check ascii/troff */
- 
--#define MAGIC_VERSION		516	/* This implementation */
-+#define MAGIC_VERSION		517	/* This implementation */
- 
- 
- #ifdef __cplusplus
+--- libmagic.orig/magic.h	2016-01-25 11:17:38.139978563 +0800
++++ libmagic/magic.h	2016-01-25 11:19:37.412347842 +0800
 @@ -88,6 +88,7 @@
  
  const char *magic_getpath(const char *, int);
@@ -2532,9 +2522,21 @@ diff -u libmagic.orig/magic.h libmagic/magic.h
  int magic_list(magic_t, const char *);
  int magic_errno(magic_t);
  
+diff -u libmagic.orig/patchlevel.h libmagic/patchlevel.h
+--- libmagic.orig/patchlevel.h	2016-01-25 11:17:38.141978563 +0800
++++ libmagic/patchlevel.h	2016-01-25 11:19:37.412347842 +0800
+@@ -351,7 +351,7 @@
+  *
+  * Revision 1.8  93/02/19  15:01:26  ian
+  * Numerous changes from Guy Harris too numerous to mention but including
+- * byte-order independance, fixing "old-style masking", etc. etc. A bugfix
++ * byte-order independence, fixing "old-style masking", etc. etc. A bugfix
+  * for broken symlinks from martin@@d255s004.zfe.siemens.de.
+  * 
+  * Revision 1.7  93/01/05  14:57:27  ian
 diff -u libmagic.orig/print.c libmagic/print.c
---- libmagic.orig/print.c	Tue Feb 26 19:25:00 2013
-+++ libmagic/print.c	Sun Jan  4 17:04:32 2015
+--- libmagic.orig/print.c	2016-01-25 11:17:38.162978563 +0800
++++ libmagic/print.c	2016-01-25 11:19:37.412347842 +0800
 @@ -28,13 +28,17 @@
  /*
   * print.c - debugging printout routines
@@ -2767,8 +2769,8 @@ diff -u libmagic.orig/print.c libmagic/print.c
  		t = ts.tv_sec;
  	}
 diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
---- libmagic.orig/readcdf.c	Tue Jan  7 04:13:42 2014
-+++ libmagic/readcdf.c	Sun Jan  4 17:06:01 2015
+--- libmagic.orig/readcdf.c	2016-01-25 11:17:38.160978563 +0800
++++ libmagic/readcdf.c	2016-01-25 11:19:37.412347842 +0800
 @@ -26,11 +26,15 @@
  #include "file.h"
  
@@ -2984,9 +2986,11 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
  		}
  		if (NOTMIME(ms)) {
  			if (str != NULL) {
+Only in libmagic.orig/: readelf.c
+Only in libmagic.orig/: readelf.h
 diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
---- libmagic.orig/softmagic.c	Thu Feb 13 00:20:53 2014
-+++ libmagic/softmagic.c	Sun Jan  4 17:06:01 2015
+--- libmagic.orig/softmagic.c	2016-01-25 11:17:38.139978563 +0800
++++ libmagic/softmagic.c	2016-01-25 11:19:45.545347848 +0800
 @@ -50,6 +50,11 @@
  #include <locale.h>
  #endif
@@ -3164,21 +3168,24 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  {
  	/*
  	 * Note: FILE_SEARCH and FILE_REGEX do not actually copy
-@@ -1066,15 +1061,24 @@
+@@ -1066,15 +1061,27 @@
  			const char *last;	/* end of search region */
  			const char *buf;	/* start of search region */
  			const char *end;
 -			size_t lines;
 +			size_t lines, linecnt, bytecnt;
- 
++
 +			linecnt = m->str_range;
 +			bytecnt = linecnt * 80;
-+
+ 
 +			if (bytecnt == 0) {
 +				bytecnt = 8192;
 +			}
 +			if (bytecnt > nbytes) {
 +				bytecnt = nbytes;
++			}
++			if (offset > bytecnt) {
++				offset = bytecnt;
 +			}
  			if (s == NULL) {
  				ms->search.s_len = 0;
@@ -3191,7 +3198,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  			/* mget() guarantees buf <= last */
  			for (lines = linecnt, b = buf; lines && b < end &&
  			     ((b = CAST(const char *,
-@@ -1087,7 +1091,7 @@
+@@ -1087,7 +1094,7 @@
  					b++;
  			}
  			if (lines)
@@ -3200,7 +3207,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  
  			ms->search.s = buf;
  			ms->search.s_len = last - buf;
-@@ -1158,7 +1162,6 @@
+@@ -1158,7 +1165,6 @@
      int *need_separator, int *returnval)
  {
  	uint32_t soffset, offset = ms->offset;
@@ -3208,7 +3215,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  	int rv, oneed_separator, in_type;
  	char *sbuf, *rbuf;
  	union VALUETYPE *p = &ms->ms_value;
-@@ -1170,17 +1173,13 @@
+@@ -1170,17 +1176,13 @@
  	}
  
  	if (mcopy(ms, p, m->type, m->flag & INDIR, s, (uint32_t)(offset + o),
@@ -3228,7 +3235,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  	}
  
  	if (m->flag & INDIR) {
-@@ -1672,16 +1671,13 @@
+@@ -1672,16 +1674,13 @@
  			if ((ms->flags & MAGIC_DEBUG) != 0)
  				fprintf(stderr, "indirect +offs=%u\n", offset);
  		}
@@ -3246,7 +3253,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  		}
  	}
  
-@@ -1755,11 +1751,21 @@
+@@ -1755,11 +1754,21 @@
  		ms->offset = soffset;
  		if (rv == 1) {
  			if ((ms->flags & (MAGIC_MIME|MAGIC_APPLE)) == 0 &&
@@ -3271,7 +3278,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  		}
  		return rv;
  
-@@ -1875,6 +1881,42 @@
+@@ -1875,6 +1884,42 @@
  	return file_strncmp(a, b, len, flags);
  }
  
@@ -3314,7 +3321,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  private int
  magiccheck(struct magic_set *ms, struct magic *m)
  {
-@@ -2035,63 +2077,151 @@
+@@ -2035,63 +2080,90 @@
  		break;
  	}
  	case FILE_REGEX: {
@@ -3324,142 +3331,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 -
 -		if (ms->search.s == NULL)
 -			return 0;
-+		zval *pattern;
-+		int options = 0;
-+		pcre_cache_entry *pce;
-+		TSRMLS_FETCH();
-+		
-+		MAKE_STD_ZVAL(pattern);
-+		ZVAL_STRINGL(pattern, (char *)m->value.s, m->vallen, 0);
-+	
-+		options |= PCRE_MULTILINE;
-+		
-+		if (m->str_flags & STRING_IGNORE_CASE) {
-+			options |= PCRE_CASELESS;
-+		}
-+		
-+		convert_libmagic_pattern(pattern, options);
-+		
-+		l = v = 0;
-+		if ((pce = pcre_get_compiled_regex_cache(Z_STRVAL_P(pattern), Z_STRLEN_P(pattern) TSRMLS_CC)) == NULL) {
-+			zval_dtor(pattern);
-+			FREE_ZVAL(pattern);
-+			return -1;
-+		} else {
-+			/* pce now contains the compiled regex */
-+			zval *retval;
-+			zval *subpats;
-+			char *haystack;
-+
-+			MAKE_STD_ZVAL(retval);
-+			ALLOC_INIT_ZVAL(subpats);
-+			
-+			/* Cut the search len from haystack, equals to REG_STARTEND */
-+			haystack = estrndup(ms->search.s, ms->search.s_len);
-+
-+			/* match v = 0, no match v = 1 */
-+			php_pcre_match_impl(pce, haystack, ms->search.s_len, retval, subpats, 1, 1, PREG_OFFSET_CAPTURE, 0 TSRMLS_CC);
-+			/* Free haystack */
-+			efree(haystack);
-+			
-+			if (Z_LVAL_P(retval) < 0) {
-+				zval_ptr_dtor(&subpats);
-+				FREE_ZVAL(retval);
-+				zval_dtor(pattern);
-+				FREE_ZVAL(pattern);
-+				return -1;
-+			} else if ((Z_LVAL_P(retval) > 0) && (Z_TYPE_P(subpats) == IS_ARRAY)) {
-+				
-+				/* Need to fetch global match which equals pmatch[0] */
-+				HashTable *ht = Z_ARRVAL_P(subpats);
-+				HashPosition outer_pos;
-+				zval *pattern_match = NULL, *pattern_offset = NULL;
-+				
-+				zend_hash_internal_pointer_reset_ex(ht, &outer_pos); 
-+				
-+				if (zend_hash_has_more_elements_ex(ht, &outer_pos) == SUCCESS &&
-+					zend_hash_move_forward_ex(ht, &outer_pos)) {
-+					
-+					zval **ppzval;
-+					
-+					/* The first element (should be) is the global match 
-+					   Need to move to the inner array to get the global match */
-+					
-+					if (zend_hash_get_current_data_ex(ht, (void**)&ppzval, &outer_pos) != FAILURE) { 
-+						
-+						HashTable *inner_ht;
-+						HashPosition inner_pos;
-+						zval **match, **offset;
-+						zval tmpcopy = **ppzval, matchcopy, offsetcopy;
-+						
-+						zval_copy_ctor(&tmpcopy); 
-+						INIT_PZVAL(&tmpcopy);
-+						
-+						inner_ht = Z_ARRVAL(tmpcopy);
-+						
-+						/* If everything goes according to the master plan
-+						   tmpcopy now contains two elements:
-+						   0 = the match
-+						   1 = starting position of the match */
-+						zend_hash_internal_pointer_reset_ex(inner_ht, &inner_pos); 
-+						
-+						if (zend_hash_has_more_elements_ex(inner_ht, &inner_pos) == SUCCESS &&
-+							zend_hash_move_forward_ex(inner_ht, &inner_pos)) {
-+						
-+							if (zend_hash_get_current_data_ex(inner_ht, (void**)&match, &inner_pos) != FAILURE) { 
-+									
-+								matchcopy = **match;
-+								zval_copy_ctor(&matchcopy);
-+								INIT_PZVAL(&matchcopy);
-+								convert_to_string(&matchcopy); 
-+								
-+								MAKE_STD_ZVAL(pattern_match);
-+								Z_STRVAL_P(pattern_match) = (char *)Z_STRVAL(matchcopy);
-+								Z_STRLEN_P(pattern_match) = Z_STRLEN(matchcopy);
-+								Z_TYPE_P(pattern_match) = IS_STRING; 
-+
-+								zval_dtor(&matchcopy);
-+							}
-+						}
-+						
-+						if (zend_hash_has_more_elements_ex(inner_ht, &inner_pos) == SUCCESS &&
-+							zend_hash_move_forward_ex(inner_ht, &inner_pos)) {
-+							
-+							if (zend_hash_get_current_data_ex(inner_ht, (void**)&offset, &inner_pos) != FAILURE) { 
-+								
-+								offsetcopy = **offset;
-+								zval_copy_ctor(&offsetcopy);
-+								INIT_PZVAL(&offsetcopy);
-+								convert_to_long(&offsetcopy); 
-+								
-+								MAKE_STD_ZVAL(pattern_offset);
-+								Z_LVAL_P(pattern_offset) = Z_LVAL(offsetcopy);
-+								Z_TYPE_P(pattern_offset) = IS_LONG;
-+								
-+								zval_dtor(&offsetcopy);
-+							}
-+						}
-+						zval_dtor(&tmpcopy); 	
-+					}
-+					
-+					if ((pattern_match != NULL) && (pattern_offset != NULL)) {
-+						ms->search.s += (int)Z_LVAL_P(pattern_offset); /* this is where the match starts */
-+						ms->search.offset += (size_t)Z_LVAL_P(pattern_offset); /* this is where the match starts as size_t */
-+						ms->search.rm_len = Z_STRLEN_P(pattern_match) /* This is the length of the matched pattern */;
-+						v = 0;
-+						
-+						efree(pattern_match);
-+						efree(pattern_offset);
-+						
-+					} else {
-+						zval_ptr_dtor(&subpats);
-+						FREE_ZVAL(retval);
-+						zval_dtor(pattern);
-+						FREE_ZVAL(pattern);
-+						return -1;
-+					}
-+				}
- 
+-
 -		l = 0;
 -		rc = regcomp(&rx, m->value.s,
 -		    REG_EXTENDED|REG_NEWLINE|
@@ -3494,8 +3366,84 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 -				    (size_t)(pmatch[0].rm_eo - pmatch[0].rm_so);
 -				v = 0;
 -				break;
- 
+-
 -			case REG_NOMATCH:
++		zval *pattern;
++		int options = 0;
++		pcre_cache_entry *pce;
++		TSRMLS_FETCH();
++		
++		MAKE_STD_ZVAL(pattern);
++		ZVAL_STRINGL(pattern, (char *)m->value.s, m->vallen, 0);
++	
++		options |= PCRE_MULTILINE;
++		
++		if (m->str_flags & STRING_IGNORE_CASE) {
++			options |= PCRE_CASELESS;
++		}
++		
++		convert_libmagic_pattern(pattern, options);
++		
++		l = v = 0;
++		if ((pce = pcre_get_compiled_regex_cache(Z_STRVAL_P(pattern), Z_STRLEN_P(pattern) TSRMLS_CC)) == NULL) {
++			zval_dtor(pattern);
++			FREE_ZVAL(pattern);
++			return -1;
++		} else {
++			/* pce now contains the compiled regex */
++			zval *retval;
++			zval *subpats;
++			char *haystack;
++
++			MAKE_STD_ZVAL(retval);
++			ALLOC_INIT_ZVAL(subpats);
++			
++			/* Cut the search len from haystack, equals to REG_STARTEND */
++			haystack = estrndup(ms->search.s, ms->search.s_len);
++
++			/* match v = 0, no match v = 1 */
++			php_pcre_match_impl(pce, haystack, ms->search.s_len, retval, subpats, 0, 1, PREG_OFFSET_CAPTURE, 0 TSRMLS_CC);
++			/* Free haystack */
++			efree(haystack);
++			
++			if (Z_LVAL_P(retval) < 0) {
++				zval_ptr_dtor(&subpats);
++				FREE_ZVAL(retval);
++				zval_dtor(pattern);
++				FREE_ZVAL(pattern);
++				return -1;
++			} else if ((Z_LVAL_P(retval) > 0) && (Z_TYPE_P(subpats) == IS_ARRAY)) {
++				/* Need to fetch global match which equals pmatch[0] */
++				zval **ppzval;
++				HashTable *ht = Z_ARRVAL_P(subpats);
++				/* The first element (should be) is the global match 
++				   Need to move to the inner array to get the global match */
++				if (zend_hash_index_find(ht, 0, (void **)&ppzval) == SUCCESS) {
++					zval **match, **offset;
++					/* If everything goes according to the master plan
++					   tmpcopy now contains two elements:
++					   0 = the match
++					   1 = starting position of the match */
++					if (zend_hash_index_find(Z_ARRVAL_PP(ppzval), 0, (void **)&match) == SUCCESS 
++							&& zend_hash_index_find(Z_ARRVAL_PP(ppzval), 1, (void **)&offset) == SUCCESS) {
++						if (Z_TYPE_PP(match) != IS_STRING || Z_TYPE_PP(offset) != IS_LONG) {
++							goto error_out;
++						}
++						ms->search.s += (int)Z_LVAL_PP(offset); /* this is where the match starts */
++						ms->search.offset += (size_t)Z_LVAL_PP(offset); /* this is where the match starts as size_t */
++						ms->search.rm_len = Z_STRLEN_PP(match) /* This is the length of the matched pattern */;
++						v = 0;
++					} else {
++						goto error_out;
++					}
++				} else {
++error_out:
++					zval_ptr_dtor(&subpats);
++					FREE_ZVAL(retval);
++					zval_dtor(pattern);
++					FREE_ZVAL(pattern);
++					return -1;
++				}
 +			} else {
  				v = 1;
 -				break;
@@ -3519,8 +3467,8 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  	}
  	case FILE_INDIRECT:
 diff -u libmagic.orig/strcasestr.c libmagic/strcasestr.c
---- libmagic.orig/strcasestr.c	Thu Dec  5 17:57:50 2013
-+++ libmagic/strcasestr.c	Sun Jan  4 17:06:01 2015
+--- libmagic.orig/strcasestr.c	2016-01-25 11:17:38.160978563 +0800
++++ libmagic/strcasestr.c	2016-01-25 11:19:37.413347842 +0800
 @@ -37,6 +37,8 @@
  __RCSID("$NetBSD: strncasecmp.c,v 1.2 2007/06/04 18:19:27 christos Exp $");
  #endif /* LIBC_SCCS and not lint */

ext/fileinfo/libmagic/funcs.c

@@ -414,7 +414,7 @@ file_check_mem(struct magic_set *ms, unsigned int level)
 	size_t len;
 
 	if (level >= ms->c.len) {
-		len = (ms->c.len += 20) * sizeof(*ms->c.li);
+		len = (ms->c.len = 20 + level) * sizeof(*ms->c.li);
 		ms->c.li = CAST(struct level_info *, (ms->c.li == NULL) ?
 		    emalloc(len) :
 		    erealloc(ms->c.li, len));

ext/fileinfo/libmagic/softmagic.c

@@ -2114,7 +2114,7 @@ magiccheck(struct magic_set *ms, struct magic *m)
 			haystack = estrndup(ms->search.s, ms->search.s_len);
 
 			/* match v = 0, no match v = 1 */
-			php_pcre_match_impl(pce, haystack, ms->search.s_len, retval, subpats, 1, 1, PREG_OFFSET_CAPTURE, 0 TSRMLS_CC);
+			php_pcre_match_impl(pce, haystack, ms->search.s_len, retval, subpats, 0, 1, PREG_OFFSET_CAPTURE, 0 TSRMLS_CC);
 			/* Free haystack */
 			efree(haystack);
 			
@@ -2125,98 +2125,37 @@ magiccheck(struct magic_set *ms, struct magic *m)
 				FREE_ZVAL(pattern);
 				return -1;
 			} else if ((Z_LVAL_P(retval) > 0) && (Z_TYPE_P(subpats) == IS_ARRAY)) {
-				
 				/* Need to fetch global match which equals pmatch[0] */
+				zval **ppzval;
 				HashTable *ht = Z_ARRVAL_P(subpats);
-				HashPosition outer_pos;
-				zval *pattern_match = NULL, *pattern_offset = NULL;
-				
-				zend_hash_internal_pointer_reset_ex(ht, &outer_pos); 
-				
-				if (zend_hash_has_more_elements_ex(ht, &outer_pos) == SUCCESS &&
-					zend_hash_move_forward_ex(ht, &outer_pos)) {
-					
-					zval **ppzval;
-					
-					/* The first element (should be) is the global match 
-					   Need to move to the inner array to get the global match */
-					
-					if (zend_hash_get_current_data_ex(ht, (void**)&ppzval, &outer_pos) != FAILURE) { 
-						
-						HashTable *inner_ht;
-						HashPosition inner_pos;
-						zval **match, **offset;
-						zval tmpcopy = **ppzval, matchcopy, offsetcopy;
-						
-						zval_copy_ctor(&tmpcopy); 
-						INIT_PZVAL(&tmpcopy);
-						
-						inner_ht = Z_ARRVAL(tmpcopy);
-						
-						/* If everything goes according to the master plan
-						   tmpcopy now contains two elements:
-						   0 = the match
-						   1 = starting position of the match */
-						zend_hash_internal_pointer_reset_ex(inner_ht, &inner_pos); 
-						
-						if (zend_hash_has_more_elements_ex(inner_ht, &inner_pos) == SUCCESS &&
-							zend_hash_move_forward_ex(inner_ht, &inner_pos)) {
-						
-							if (zend_hash_get_current_data_ex(inner_ht, (void**)&match, &inner_pos) != FAILURE) { 
-									
-								matchcopy = **match;
-								zval_copy_ctor(&matchcopy);
-								INIT_PZVAL(&matchcopy);
-								convert_to_string(&matchcopy); 
-								
-								MAKE_STD_ZVAL(pattern_match);
-								Z_STRVAL_P(pattern_match) = (char *)Z_STRVAL(matchcopy);
-								Z_STRLEN_P(pattern_match) = Z_STRLEN(matchcopy);
-								Z_TYPE_P(pattern_match) = IS_STRING; 
-
-								zval_dtor(&matchcopy);
-							}
+				/* The first element (should be) is the global match 
+				   Need to move to the inner array to get the global match */
+				if (zend_hash_index_find(ht, 0, (void **)&ppzval) == SUCCESS) {
+					zval **match, **offset;
+					/* If everything goes according to the master plan
+					   tmpcopy now contains two elements:
+					   0 = the match
+					   1 = starting position of the match */
+					if (zend_hash_index_find(Z_ARRVAL_PP(ppzval), 0, (void **)&match) == SUCCESS 
+							&& zend_hash_index_find(Z_ARRVAL_PP(ppzval), 1, (void **)&offset) == SUCCESS) {
+						if (Z_TYPE_PP(match) != IS_STRING || Z_TYPE_PP(offset) != IS_LONG) {
+							goto error_out;
 						}
-						
-						if (zend_hash_has_more_elements_ex(inner_ht, &inner_pos) == SUCCESS &&
-							zend_hash_move_forward_ex(inner_ht, &inner_pos)) {
-							
-							if (zend_hash_get_current_data_ex(inner_ht, (void**)&offset, &inner_pos) != FAILURE) { 
-								
-								offsetcopy = **offset;
-								zval_copy_ctor(&offsetcopy);
-								INIT_PZVAL(&offsetcopy);
-								convert_to_long(&offsetcopy); 
-								
-								MAKE_STD_ZVAL(pattern_offset);
-								Z_LVAL_P(pattern_offset) = Z_LVAL(offsetcopy);
-								Z_TYPE_P(pattern_offset) = IS_LONG;
-								
-								zval_dtor(&offsetcopy);
-							}
-						}
-						zval_dtor(&tmpcopy); 	
-					}
-					
-					if ((pattern_match != NULL) && (pattern_offset != NULL)) {
-						ms->search.s += (int)Z_LVAL_P(pattern_offset); /* this is where the match starts */
-						ms->search.offset += (size_t)Z_LVAL_P(pattern_offset); /* this is where the match starts as size_t */
-						ms->search.rm_len = Z_STRLEN_P(pattern_match) /* This is the length of the matched pattern */;
+						ms->search.s += (int)Z_LVAL_PP(offset); /* this is where the match starts */
+						ms->search.offset += (size_t)Z_LVAL_PP(offset); /* this is where the match starts as size_t */
+						ms->search.rm_len = Z_STRLEN_PP(match) /* This is the length of the matched pattern */;
 						v = 0;
-						
-						efree(pattern_match);
-						efree(pattern_offset);
-						
 					} else {
-						zval_ptr_dtor(&subpats);
-						FREE_ZVAL(retval);
-						zval_dtor(pattern);
-						FREE_ZVAL(pattern);
-						return -1;
+						goto error_out;
 					}
+				} else {
+error_out:
+					zval_ptr_dtor(&subpats);
+					FREE_ZVAL(retval);
+					zval_dtor(pattern);
+					FREE_ZVAL(pattern);
+					return -1;
 				}
-
-
 			} else {
 				v = 1;
 			}

ext/fileinfo/tests/bug68819_002.phpt

@@ -12,7 +12,7 @@ $string .= "\r\n";
 $string .= "''''";
 
 // Total string length > 8192
-$string .= str_repeat(chr(rand(32, 127)), 8184);
+$string .= str_repeat("a", 8184);
 
 // Ending in this string
 $string .= "say";

ext/fileinfo/tests/bug68996.phpt

@@ -19,4 +19,4 @@ finfo_open(FILEINFO_MIME_TYPE, "\xfc\x63");
 <br />
 <b>Warning</b>:  : failed to open stream: No such file or directory in <b>%sbug68996.php</b> on line <b>%d</b><br />
 <br />
-<b>Warning</b>:  finfo_open():  in <b>%sbug68996.php</b> on line <b>%d</b><br />
+<b>Warning</b>:  finfo_open(): Failed to load magic database at '%s�c'. in <b>%sbug68996.php</b> on line <b>%d</b><br />

ext/fileinfo/tests/bug71527.magic

@@ -0,0 +1 @@
+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

ext/fileinfo/tests/bug71527.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Bug #71527 Buffer over-write in finfo_open with malformed magic file
+--SKIPIF--
+<?php
+if (!class_exists('finfo'))
+	die('skip no fileinfo extension');
+--ENV--
+USE_ZEND_ALLOC=0
+--FILE--
+<?php
+	$finfo = finfo_open(FILEINFO_NONE, dirname(__FILE__) . DIRECTORY_SEPARATOR . "bug71527.magic");
+	$info = finfo_file($finfo, __FILE__);
+	var_dump($info);
+?>
+--EXPECTF--
+Warning: finfo_open(): Failed to load magic database at '%sbug71527.magic'. in %sbug71527.php on line %d
+
+Warning: finfo_file() expects parameter 1 to be resource, boolean given in %sbug71527.php on line %d
+bool(false)

ext/gd/gd.c

@@ -5362,8 +5362,15 @@ PHP_FUNCTION(imageaffinematrixget)
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Number is expected as option");
 				RETURN_FALSE;
 			}
-			convert_to_double_ex(&options);
-			angle = Z_DVAL_P(options);
+			if(Z_TYPE_P(options) != IS_DOUBLE) {
+				zval dval;
+				dval = *options;
+				zval_copy_ctor(&dval);
+				convert_to_double(&dval);
+				angle = Z_DVAL(dval);
+			} else {
+				angle = Z_DVAL_P(options);
+			}
 
 			if (type == GD_AFFINE_SHEAR_HORIZONTAL) {
 				res = gdAffineShearHorizontal(affine, angle);

ext/gd/libgd/gd_gd2.c

@@ -145,9 +145,15 @@ static int _gd2GetHeader(gdIOCtxPtr in, int *sx, int *sy, int *cs, int *vers, in
 		cidx = gdCalloc(sidx, 1);
 		for (i = 0; i < nc; i++) {
 			if (gdGetInt(&cidx[i].offset, in) != 1) {
+				gdFree(cidx);
 				goto fail1;
 			}
 			if (gdGetInt(&cidx[i].size, in) != 1) {
+				gdFree(cidx);
+				goto fail1;
+			}
+			if (cidx[i].offset < 0 || cidx[i].size < 0) {
+				gdFree(cidx);
 				goto fail1;
 			}
 		}

ext/gd/tests/bug71912.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug #71912 (libgd: signedness vulnerability)
+--SKIPIF--
+<?php
+        if(!extension_loaded('gd')){ die('skip gd extension not available'); }
+        if(!function_exists('imagecreatefromgd2')) die('skip imagecreatefromgd2() not available');
+?>
+--FILE--
+<?php
+imagecreatefromgd2(__DIR__ . DIRECTORY_SEPARATOR . "invalid_neg_size.gd2");
+?>
+OK
+--EXPECTF--
+
+Warning: imagecreatefromgd2(): '%s%einvalid_neg_size.gd2' is not a valid GD2 file in %s%ebug71912.php on line %d
+OK

ext/gd/tests/bug71952.phpt

@@ -0,0 +1,14 @@
+--TEST--
+Bug #71952 (Corruption inside imageaffinematrixget)
+--SKIPIF--
+<?php
+	if(!extension_loaded('gd')){ die('skip gd extension not available'); }
+?>
+--FILE--
+<?php
+$vals=[str_repeat("A","200"),0,1,2,3,4,5,6,7,8,9];
+imageaffinematrixget(4,$vals[0]);
+var_dump($vals[0]);
+?>
+--EXPECTF--
+string(200) "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"

ext/gmp/tests/serialize.phpt

@@ -18,7 +18,7 @@ try {
 } catch (Exception $e) { var_dump($e->getMessage()); }
 
 try {
-    unserialize('C:3:"GMP":8:{s:2:"42"}');
+    unserialize('C:3:"GMP":8:{s:2:"42";}');
 } catch (Exception $e) { var_dump($e->getMessage()); }
 
 ?>

ext/intl/grapheme/grapheme_string.c

@@ -112,7 +112,7 @@ PHP_FUNCTION(grapheme_strpos)
 	int haystack_len, needle_len;
 	unsigned char *found;
 	long loffset = 0;
-	int32_t offset = 0;
+	int32_t offset = 0, noffset = 0;
 	int ret_pos;
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ss|l", (char **)&haystack, &haystack_len, (char **)&needle, &needle_len, &loffset) == FAILURE) {
@@ -132,6 +132,7 @@ PHP_FUNCTION(grapheme_strpos)
 
 	/* we checked that it will fit: */
 	offset = (int32_t) loffset;
+	noffset = offset >= 0 ? offset : haystack_len + offset;
 
 	/* the offset is 'grapheme count offset' so it still might be invalid - we'll check it later */
 
@@ -146,7 +147,7 @@ PHP_FUNCTION(grapheme_strpos)
 	/* quick check to see if the string might be there
 	 * I realize that 'offset' is 'grapheme count offset' but will work in spite of that
 	*/
-	found = (unsigned char *)php_memnstr((char *)haystack + offset, (char *)needle, needle_len, (char *)haystack + haystack_len);
+	found = (unsigned char *)php_memnstr((char *)haystack + noffset, (char *)needle, needle_len, (char *)haystack + haystack_len);
 
 	/* if it isn't there the we are done */
 	if (!found) {
@@ -214,12 +215,13 @@ PHP_FUNCTION(grapheme_stripos)
 	is_ascii = ( grapheme_ascii_check(haystack, haystack_len) >= 0 );
 
 	if ( is_ascii ) {
+		int32_t noffset = offset >= 0 ? offset : haystack_len + offset;
 		needle_dup = (unsigned char *)estrndup((char *)needle, needle_len);
 		php_strtolower((char *)needle_dup, needle_len);
 		haystack_dup = (unsigned char *)estrndup((char *)haystack, haystack_len);
 		php_strtolower((char *)haystack_dup, haystack_len);
 
-		found = (unsigned char*) php_memnstr((char *)haystack_dup + offset, (char *)needle_dup, needle_len, (char *)haystack_dup + haystack_len);
+		found = (unsigned char*) php_memnstr((char *)haystack_dup + noffset, (char *)needle_dup, needle_len, (char *)haystack_dup + haystack_len);
 
 		efree(haystack_dup);
 		efree(needle_dup);
@@ -537,7 +539,7 @@ PHP_FUNCTION(grapheme_substr)
 			efree(ustr);
 		}
 		ubrk_close(bi);
-		RETURN_EMPTY_STRING();		
+		RETURN_EMPTY_STRING();
 	}
 
 	/* find the end point of the string to return */
@@ -576,7 +578,7 @@ PHP_FUNCTION(grapheme_substr)
 			sub_str_end_pos = ustr_len;
 		}
 	}
-	
+
 	if(sub_str_start_pos > sub_str_end_pos) {
 		intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR, "grapheme_substr: length is beyond start", 1 TSRMLS_CC );
 

ext/intl/tests/bug72061.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Bug #72061: Out-of-bounds reads in zif_grapheme_stripos with negative offset
+--SKIPIF--
+<?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?>
+--FILE--
+<?php
+
+var_dump(grapheme_stripos(str_repeat("ABCD", 16384), "A", -201));
+var_dump(grapheme_strpos(str_repeat("ABCD", 16384), "A", -201));
+?>
+DONE
+--EXPECT--
+int(65336)
+int(65336)
+DONE

ext/mbstring/libmbfl/mbfl/mbfilter.c

@@ -72,7 +72,7 @@
  *
  */
 
-/* 
+/*
  * Unicode support
  *
  * Portions copyright (c) 1999,2000,2001 by the PHP3 internationalization team.
@@ -137,7 +137,7 @@ mbfl_buffer_converter_new(
 mbfl_buffer_converter *
 mbfl_buffer_converter_new2(
 	const mbfl_encoding *from,
-	const mbfl_encoding *to, 
+	const mbfl_encoding *to,
     int buf_initsz)
 {
 	mbfl_buffer_converter *convd;
@@ -339,7 +339,7 @@ mbfl_buffer_converter_result(mbfl_buffer_converter *convd, mbfl_string *result)
 }
 
 mbfl_string *
-mbfl_buffer_converter_feed_result(mbfl_buffer_converter *convd, mbfl_string *string, 
+mbfl_buffer_converter_feed_result(mbfl_buffer_converter *convd, mbfl_string *string,
 				  mbfl_string *result)
 {
 	if (convd == NULL || string == NULL || result == NULL) {
@@ -535,7 +535,7 @@ const mbfl_encoding *mbfl_encoding_detector_judge2(mbfl_encoding_detector *ident
 			}
 			n--;
 		}
- 
+
 		/* fallback judge */
 		if (!encoding) {
 			n = identd->filter_list_size - 1;
@@ -702,7 +702,7 @@ mbfl_identify_encoding(mbfl_string *string, enum mbfl_no_encoding *elist, int el
 			}
 		}
 	}
- 
+
 	/* cleanup */
 	/* dtors should be called in reverse order */
 	i = num; while (--i >= 0) {
@@ -785,7 +785,7 @@ mbfl_identify_encoding2(mbfl_string *string, const mbfl_encoding **elist, int el
 			}
 		}
 	}
- 
+
 	/* cleanup */
 	/* dtors should be called in reverse order */
 	i = num; while (--i >= 0) {
@@ -844,7 +844,7 @@ mbfl_strlen(mbfl_string *string)
 	} else {
 		/* wchar filter */
 		mbfl_convert_filter *filter = mbfl_convert_filter_new(
-		  string->no_encoding, 
+		  string->no_encoding,
 		  mbfl_no_encoding_wchar,
 		  filter_count_output, 0, &len);
 		if (filter == NULL) {
@@ -865,7 +865,7 @@ mbfl_strlen(mbfl_string *string)
 	return len;
 }
 
- 
+
 /*
  *  strpos
  */
@@ -931,7 +931,7 @@ retry:
 /*
  *	oddlen
  */
-int 
+int
 mbfl_oddlen(mbfl_string *string)
 {
 	int len, n, m, k;
@@ -1071,7 +1071,7 @@ mbfl_strpos(
 							++result;
 						} else if ((c & 0xc0) != 0x80) {
 							++result;
-						}	
+						}
 					}
 					goto out;
 				}
@@ -1116,7 +1116,7 @@ mbfl_strpos(
 		qe = needle_u8_val + needle_u8_len;
 		if (offset < 0) {
 			if (-offset > needle_len) {
-				offset += needle_len; 
+				offset += needle_len;
 				while (offset < 0) {
 					unsigned char c;
 					if (p <= e) {
@@ -1158,7 +1158,7 @@ mbfl_strpos(
 							++result;
 						} else if ((c & 0xc0) != 0x80) {
 							++result;
-						}	
+						}
 					}
 					goto out;
 				}
@@ -1501,7 +1501,7 @@ mbfl_strcut(
 		if (encoding->flag & (MBFL_ENCTYPE_WCS2BE | MBFL_ENCTYPE_WCS2LE)) {
 			from &= -2;
 
-			if (from + length >= string->len) {
+			if (length >= string->len - from) {
 				length = string->len - from;
 			}
 
@@ -1510,14 +1510,14 @@ mbfl_strcut(
 		} else if (encoding->flag & (MBFL_ENCTYPE_WCS4BE | MBFL_ENCTYPE_WCS4LE)) {
 			from &= -4;
 
-			if (from + length >= string->len) {
+			if (length >= string->len - from) {
 				length = string->len - from;
 			}
 
 			start = string->val + from;
 			end   = start + (length & -4);
 		} else if ((encoding->flag & MBFL_ENCTYPE_SBCS)) {
-			if (from + length >= string->len) {
+			if (length >= string->len - from) {
 				length = string->len - from;
 			}
 
@@ -1539,7 +1539,7 @@ mbfl_strcut(
 			start = p;
 
 			/* search end position */
-			if ((start - string->val) + length >= (int)string->len) {
+			if (length >= (int)string->len - (start - string->val)) {
 				end = string->val + string->len;
 			} else {
 				for (q = p + length; p < q; p += (m = mbtab[*p]));
@@ -2024,7 +2024,7 @@ mbfl_ja_jp_hantozen(
 		mbfl_no_encoding_wchar,
 		(int(*)(int, void*))next_filter->filter_function,
 		(int(*)(void*))next_filter->filter_flush,
-		next_filter);	
+		next_filter);
 	if (encoder == NULL) {
 		goto out;
 	}

ext/mysqli/mysqli.c

@@ -1295,9 +1295,13 @@ void php_mysqli_fetch_into_hash(INTERNAL_FUNCTION_PARAMETERS, int override_flags
 		zend_fcall_info fci;
 		zend_fcall_info_cache fcc;
 		zval *retval_ptr;
+		zend_bool props_merged = 0;
 
 		object_and_properties_init(return_value, ce, NULL);
-		zend_merge_properties(return_value, Z_ARRVAL(dataset), 1 TSRMLS_CC);
+		if (!ce->__set) {
+			props_merged = 1;
+			zend_merge_properties(return_value, Z_ARRVAL(dataset), 1 TSRMLS_CC);
+		}
 
 		if (ce->constructor) {
 			fci.size = sizeof(fci);
@@ -1331,6 +1335,10 @@ void php_mysqli_fetch_into_hash(INTERNAL_FUNCTION_PARAMETERS, int override_flags
 
 			if (zend_call_function(&fci, &fcc TSRMLS_CC) == FAILURE) {
 				zend_throw_exception_ex(zend_exception_get_default(TSRMLS_C), 0 TSRMLS_CC, "Could not execute %s::%s()", ce->name, ce->constructor->common.function_name);
+				if (fci.params) {
+					efree(fci.params);
+				}
+				return;
 			} else {
 				if (retval_ptr) {
 					zval_ptr_dtor(&retval_ptr);
@@ -1341,6 +1349,11 @@ void php_mysqli_fetch_into_hash(INTERNAL_FUNCTION_PARAMETERS, int override_flags
 			}
 		} else if (ctor_params) {
 			zend_throw_exception_ex(zend_exception_get_default(TSRMLS_C), 0 TSRMLS_CC, "Class %s does not have a constructor hence you cannot use ctor_params", ce->name);
+			return;
+		}
+
+		if (!props_merged) {
+			zend_merge_properties(return_value, Z_ARRVAL(dataset), 1 TSRMLS_CC);
 		}
 	}
 }

ext/mysqli/tests/bug71820.phpt

@@ -0,0 +1,104 @@
+--TEST--
+Bug #71820 __set has to be called after constructor, mysqli part
+--SKIPIF--
+<?php
+require_once('skipif.inc');
+require_once('skipifconnectfailure.inc');
+require_once("connect.inc");
+?>
+--FILE--
+<?php
+
+include "connect.inc";
+
+$tableName = 'test_mysqli_fetch_object';
+
+class TestRow
+{
+
+	private $set_from_constructor;
+	private $data;
+	private $hello = "world";
+
+	public function __construct($set_from_constructor)
+	{
+		$this->set_from_constructor = $set_from_constructor;
+	}
+
+	public function __set($name, $value)
+	{
+		if (!isset($this->data[$name])) {
+			/* $this->set_from_constructor has an expected value */
+			$this->data[$name] = 42 == $this->set_from_constructor ? $value : -1;
+			return;
+		}
+		throw new \Exception('Duplicity column name.');
+	}
+
+}
+
+
+if (!($connection = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))) {
+	printf("[001] Cannot connect to the server");
+}
+	
+$rc = mysqli_query($connection, "DROP TABLE IF EXISTS $tableName");
+if (!$rc)
+	printf("[002] [%d] %s\n", mysqli_errno($connection), mysqli_error($connection));
+
+$table = <<<SQL
+CREATE TABLE $tableName (
+  id int NOT NULL auto_increment primary key,
+  name varchar(255) NOT NULL
+);
+SQL;
+
+$rc = mysqli_query($connection, $table);
+if (!$rc)
+	printf("[003] [%d] %s\n", mysqli_errno($connection), mysqli_error($connection));
+
+$rc = mysqli_query($connection, "INSERT INTO " . $tableName . " (name) VALUES ('Doe'), ('Joe')");
+if (!$rc)
+	printf("[004] [%d] %s\n", mysqli_errno($connection), mysqli_error($connection));
+
+$result = mysqli_query($connection, 'SELECT * FROM ' . $tableName . ' LIMIT 10');
+if (!$result)
+	printf("[005] [%d] %s\n", mysqli_errno($result), mysqli_error($result));
+
+
+while ($row = mysqli_fetch_object($result, 'TestRow', [42])) {
+	var_dump($row);
+}
+
+mysqli_close($connection);
+
+?>
+==DONE==
+--EXPECTF--
+object(TestRow)#%d (3) {
+  ["set_from_constructor":"TestRow":private]=>
+  int(42)
+  ["data":"TestRow":private]=>
+  array(2) {
+    ["id"]=>
+    string(1) "1"
+    ["name"]=>
+    string(3) "Doe"
+  }
+  ["hello":"TestRow":private]=>
+  string(5) "world"
+}
+object(TestRow)#%d (3) {
+  ["set_from_constructor":"TestRow":private]=>
+  int(42)
+  ["data":"TestRow":private]=>
+  array(2) {
+    ["id"]=>
+    string(1) "2"
+    ["name"]=>
+    string(3) "Joe"
+  }
+  ["hello":"TestRow":private]=>
+  string(5) "world"
+}
+==DONE==

ext/oci8/oci8_dtrace.d

@@ -4,11 +4,11 @@
    +----------------------------------------------------------------------+
    | Copyright (c) 2013 Zend Technologies Ltd. (http://www.zend.com)      |
    +----------------------------------------------------------------------+
-   | This source file is subject to version 3.01 of the Zend license,     |
+   | This source file is subject to version 3.01 of the PHP license,      |
    | that is bundled with this package in the file LICENSE, and is        |
    | available through the world-wide-web at the following url:           |
-   | http://www.zend.com/license/3_01.txt.                                |
-   | If you did not receive a copy of the Zend license and are unable to  |
+   | http://www.php.net/license/3_01.txt.                                 |
+   | If you did not receive a copy of the PHP license and are unable to   |
    | obtain it through the world-wide-web, please send a note to          |
    | license@zend.com so we can mail you a copy immediately.              |
    +----------------------------------------------------------------------+

ext/oci8/oci8_statement.c

@@ -1145,7 +1145,9 @@ int php_oci_bind_by_name(php_oci_statement *statement, char *name, int name_len,
 				return 1;
 			}
 			convert_to_long(var);
-#if defined(OCI_MAJOR_VERSION) && OCI_MAJOR_VERSION > 10
+
+#if defined(OCI_MAJOR_VERSION) && (OCI_MAJOR_VERSION > 10) && \
+(defined(__x86_64__) || defined(__LP64__) || defined(_LP64) || defined(_WIN64)) 
 			bind_data = (ub8 *)&Z_LVAL_P(var);
 			value_sz = sizeof(ub8);
 #else

ext/oci8/package.xml

@@ -9,7 +9,7 @@ http://pear.php.net/dtd/package-2.0.xsd">
 
  <description>
 Use the OCI8 extension to access Oracle Database. PHP OCI8 2.1 builds
-with PHP 7.  Use 'pecl install oci8-2.0.10' to install OCI8 for PHP
+with PHP 7.  Use 'pecl install oci8-2.0.11' to install OCI8 for PHP
 5.2 - PHP 5.6.  Use 'pecl install oci8-1.4.10' to install PHP OCI8 1.4
 for PHP 4.3.9 - PHP 5.1.  The OCI8 extension can be linked with Oracle
 client libraries from Oracle Database 12.1, 11, or 10.2.  These
@@ -46,12 +46,12 @@ Interoperability Support" (ID 207303.1) for details.
   <active>no</active>
  </lead>
 
- <date>2015-12-12</date>
+ <date>2016-04-15</date>
  <time>12:00:00</time>
 
   <version>
-   <release>2.0.10</release>
-   <api>2.0.10</api>
+   <release>2.0.11</release>
+   <api>2.0.11</api>
   </version>
   <stability>
    <release>stable</release>
@@ -59,7 +59,7 @@ Interoperability Support" (ID 207303.1) for details.
   </stability>
   <license uri="http://www.php.net/license">PHP</license>
   <notes>
-Fixed bug #68298 (OCI int overflow)
+Fixed bug #71422 (Fix ORA-01438: value larger than specified precision allowed for this column)
   </notes>
  <contents>
   <dir name="/">
@@ -159,6 +159,7 @@ Fixed bug #68298 (OCI int overflow)
     <file name="bug51291_1.phpt" role="test" />
     <file name="bug51291_2.phpt" role="test" />
     <file name="bug68298.phpt" role="test" />
+    <file name="bug71422.phpt" role="test" />
     <file name="clientversion.phpt" role="test" />
     <file name="close.phpt" role="test" />
     <file name="coll_001.phpt" role="test" />
@@ -464,6 +465,21 @@ Fixed bug #68298 (OCI int overflow)
  </extsrcrelease>
  <changelog>
 
+<release>
+  <version>
+   <release>2.0.10</release>
+   <api>2.0.10</api>
+  </version>
+  <stability>
+   <release>stable</release>
+   <api>stable</api>
+  </stability>
+  <license uri="http://www.php.net/license">PHP</license>
+  <notes>
+Fixed bug #68298 (OCI int overflow)
+  </notes>
+</release>
+
 <release>
   <version>
    <release>2.0.9</release>

ext/oci8/php_oci8.h

@@ -45,7 +45,7 @@
  */
 #undef PHP_OCI8_VERSION
 #endif
-#define PHP_OCI8_VERSION "2.0.10"
+#define PHP_OCI8_VERSION "2.0.11"
 
 extern zend_module_entry oci8_module_entry;
 #define phpext_oci8_ptr &oci8_module_entry

ext/oci8/tests/bug71422.phpt

@@ -0,0 +1,65 @@
+--TEST--
+Bug #71422 (Fix ORA-01438: value larger than specified precision allowed for this column)
+--SKIPIF--
+<?php
+if (!extension_loaded('oci8')) die ("skip no oci8 extension");
+?>
+--FILE--
+<?php
+
+require(dirname(__FILE__).'/connect.inc');
+
+$stmtarray = array(
+	"DROP TABLE BUG71422_TEST",
+	"CREATE TABLE BUG71422_TEST (TEST_ID NUMBER(*,0) NOT NULL, LABEL VARCHAR2(50 CHAR), CONSTRAINT BUG71422_TEST_PK PRIMARY KEY (TEST_ID))",
+	"INSERT INTO BUG71422_TEST (TEST_ID, LABEL) VALUES (1, 'Foo')"
+);
+
+oci8_test_sql_execute($c, $stmtarray);
+
+$stmt = oci_parse($c, 'SELECT LABEL AS RAW_QUERY FROM BUG71422_TEST WHERE TEST_ID=1');
+oci_execute($stmt);
+while ($row = oci_fetch_array($stmt, OCI_ASSOC+OCI_RETURN_NULLS)) {
+	var_dump($row);
+}
+
+$stmt = oci_parse($c, 'SELECT LABEL AS NUMERIC_BIND_PARAMETER FROM BUG71422_TEST WHERE TEST_ID=:test_id');
+$value = 1;
+oci_bind_by_name($stmt, ':test_id', $value, -1, SQLT_INT);
+oci_execute($stmt);
+while ($row = oci_fetch_array($stmt, OCI_ASSOC+OCI_RETURN_NULLS)) {
+	var_dump($row);
+}
+
+$stmt = oci_parse($c, 'SELECT LABEL AS STRING_BIND_PARAMETER FROM BUG71422_TEST WHERE TEST_ID=:test_id');
+$value = 1;
+oci_bind_by_name($stmt, ':test_id', $value, -1, SQLT_CHR);
+oci_execute($stmt);
+while ($row = oci_fetch_array($stmt, OCI_ASSOC+OCI_RETURN_NULLS)) {
+	var_dump($row);
+}
+
+// Cleanup
+
+$stmtarray = array(
+	"DROP TABLE BUG71422_TEST"
+);
+oci8_test_sql_execute($c, $stmtarray);
+
+?>
+===DONE===
+<?php exit(0); ?>
+--EXPECTF--
+array(1) {
+  ["RAW_QUERY"]=>
+  string(3) "Foo"
+}
+array(1) {
+  ["NUMERIC_BIND_PARAMETER"]=>
+  string(3) "Foo"
+}
+array(1) {
+  ["STRING_BIND_PARAMETER"]=>
+  string(3) "Foo"
+}
+===DONE===

ext/odbc/php_odbc.c

@@ -431,7 +431,8 @@ static void _free_odbc_result(zend_rsrc_list_entry *rsrc TSRMLS_DC)
 			efree(res->values);
 			res->values = NULL;
 		}
-		if (res->stmt) {
+		/* If aborted via timer expiration, don't try to call any unixODBC function */
+		if (res->stmt && !(PG(connection_status) & PHP_CONNECTION_TIMEOUT)) {
 #if defined(HAVE_SOLID) || defined(HAVE_SOLID_30) || defined(HAVE_SOLID_35)
 			SQLTransact(res->conn_ptr->henv, res->conn_ptr->hdbc,
 						(SQLUSMALLINT) SQL_COMMIT);
@@ -442,6 +443,9 @@ static void _free_odbc_result(zend_rsrc_list_entry *rsrc TSRMLS_DC)
 			 * zend_list_delete(res->conn_ptr->id);
 			 */
 		}
+		if (res->param_info) {
+			efree(res->param_info);
+		}
 		efree(res);
 	}
 }
@@ -484,9 +488,12 @@ static void _close_odbc_conn(zend_rsrc_list_entry *rsrc TSRMLS_DC)
 		}
 	}
 
-   	safe_odbc_disconnect(conn->hdbc);
-	SQLFreeConnect(conn->hdbc);
-	SQLFreeEnv(conn->henv);
+	/* If aborted via timer expiration, don't try to call any unixODBC function */
+	if (!(PG(connection_status) & PHP_CONNECTION_TIMEOUT)) {
+		safe_odbc_disconnect(conn->hdbc);
+		SQLFreeConnect(conn->hdbc);
+		SQLFreeEnv(conn->henv);
+	}
 	efree(conn);
 	ODBCG(num_links)--;
 }
@@ -512,9 +519,12 @@ static void _close_odbc_pconn(zend_rsrc_list_entry *rsrc TSRMLS_DC)
 		}
 	}
 	
-	safe_odbc_disconnect(conn->hdbc);
-	SQLFreeConnect(conn->hdbc);
-	SQLFreeEnv(conn->henv);
+	/* If aborted via timer expiration, don't try to call any unixODBC function */
+	if (!(PG(connection_status) & PHP_CONNECTION_TIMEOUT)) {
+		safe_odbc_disconnect(conn->hdbc);
+		SQLFreeConnect(conn->hdbc);
+		SQLFreeEnv(conn->henv);
+	}
 	free(conn);
 
 	ODBCG(num_links)--;
@@ -1183,6 +1193,7 @@ PHP_FUNCTION(odbc_prepare)
 	odbc_result *result = NULL;
 	odbc_connection *conn;
 	RETCODE rc;
+	int i;
 #ifdef HAVE_SQL_EXTENDED_FETCH
 	SQLUINTEGER      scrollopts;
 #endif
@@ -1196,6 +1207,7 @@ PHP_FUNCTION(odbc_prepare)
 	result = (odbc_result *)ecalloc(1, sizeof(odbc_result));
 	
 	result->numparams = 0;
+	result->param_info = NULL;
 	
 	rc = PHP_ODBC_SQLALLOCSTMT(conn->hdbc, &(result->stmt));
 	if (rc == SQL_INVALID_HANDLE) {
@@ -1252,6 +1264,19 @@ PHP_FUNCTION(odbc_prepare)
 	zend_list_addref(conn->id);
 	result->conn_ptr = conn;
 	result->fetched = 0;
+
+	result->param_info = (odbc_param_info *) safe_emalloc(sizeof(odbc_param_info), result->numparams, 0);
+	for (i=0;i<result->numparams;i++) {
+		rc = SQLDescribeParam(result->stmt, (SQLUSMALLINT)(i+1), &result->param_info[i].sqltype, &result->param_info[i].precision,
+													&result->param_info[i].scale, &result->param_info[i].nullable);
+		if (rc == SQL_ERROR) {
+			odbc_sql_error(result->conn_ptr, result->stmt, "SQLDescribeParameter");
+			SQLFreeStmt(result->stmt, SQL_RESET_PARAMS);
+			efree(result->param_info);
+			efree(result);
+			RETURN_FALSE;
+		}
+	}
 	ZEND_REGISTER_RESOURCE(return_value, result, le_result);  
 }
 /* }}} */
@@ -1272,9 +1297,7 @@ PHP_FUNCTION(odbc_execute)
 	params_t *params = NULL;
 	char *filename;
 	unsigned char otype;
-   	SQLSMALLINT sqltype, ctype, scale;
-	SQLSMALLINT nullable;
-	SQLULEN precision;
+	SQLSMALLINT ctype;
    	odbc_result *result;
 	int numArgs, i, ne;
 	RETCODE rc;
@@ -1332,22 +1355,10 @@ PHP_FUNCTION(odbc_execute)
 				RETURN_FALSE;
 			}
 			
-			rc = SQLDescribeParam(result->stmt, (SQLUSMALLINT)i, &sqltype, &precision, &scale, &nullable);
 			params[i-1].vallen = Z_STRLEN_PP(tmp);
 			params[i-1].fp = -1;
-			if (rc == SQL_ERROR) {
-				odbc_sql_error(result->conn_ptr, result->stmt, "SQLDescribeParameter");	
-				SQLFreeStmt(result->stmt, SQL_RESET_PARAMS);
-				for (i = 0; i < result->numparams; i++) {
-					if (params[i].fp != -1) {
-						close(params[i].fp);
-					}
-				}
-				efree(params);
-				RETURN_FALSE;
-			}
 
-			if (IS_SQL_BINARY(sqltype)) {
+			if (IS_SQL_BINARY(result->param_info[i-1].sqltype)) {
 				ctype = SQL_C_BINARY;
 			} else {
 				ctype = SQL_C_CHAR;
@@ -1394,7 +1405,7 @@ PHP_FUNCTION(odbc_execute)
 				params[i-1].vallen = SQL_LEN_DATA_AT_EXEC(0);
 
 				rc = SQLBindParameter(result->stmt, (SQLUSMALLINT)i, SQL_PARAM_INPUT,
-									  ctype, sqltype, precision, scale,
+									  ctype, result->param_info[i-1].sqltype, result->param_info[i-1].precision, result->param_info[i-1].scale,
 									  (void *)params[i-1].fp, 0,
 									  &params[i-1].vallen);
 			} else {
@@ -1406,7 +1417,7 @@ PHP_FUNCTION(odbc_execute)
 				}
 
 				rc = SQLBindParameter(result->stmt, (SQLUSMALLINT)i, SQL_PARAM_INPUT,
-									  ctype, sqltype, precision, scale,
+									  ctype, result->param_info[i-1].sqltype, result->param_info[i-1].precision, result->param_info[i-1].scale,
 									  Z_STRVAL_PP(tmp), 0,
 									  &params[i-1].vallen);
 			}

ext/odbc/php_odbc_includes.h

@@ -233,6 +233,13 @@ typedef struct odbc_result_value {
 	SQLLEN coltype;
 } odbc_result_value;
 
+typedef struct odbc_param_info {
+	SQLSMALLINT sqltype;
+	SQLSMALLINT scale;
+	SQLSMALLINT nullable;
+	SQLULEN precision;
+} odbc_param_info;
+
 typedef struct odbc_result {
 	ODBC_SQL_STMT_T stmt;
 	odbc_result_value *values;
@@ -244,6 +251,7 @@ typedef struct odbc_result {
 	long longreadlen;
 	int binmode;
 	int fetched;
+	odbc_param_info * param_info;
 	odbc_connection *conn_ptr;
 } odbc_result;
 

ext/odbc/tests/bug47803.phpt

@@ -0,0 +1,185 @@
+--TEST--
+Bug #47803 Executing prepared statements is succesfull only for the first two statements
+--SKIPIF--
+<?php include 'skipif.inc'; ?>
+--FILE--
+<?php
+
+include dirname(__FILE__) . "/config.inc";
+
+$create_table = "CREATE TABLE FOO(
+		[PAR_ID] [int] NOT NULL,
+		[PAR_INT] [int] NULL,
+		[PAR_CHR] [varchar](500) NULL
+)";
+
+$inserts = "INSERT INTO FOO
+           ([PAR_ID]
+           ,[PAR_INT]
+           ,[PAR_CHR])
+     VALUES
+        (1,14,''),
+		(2,30,''),
+		(3,7,''),
+		(4,7,''),
+		(5,0,''),
+		(6,0,''),
+		(7,20130901,''),
+		(8,20140201,''),
+		(9,20140201,''),
+		(10,20140620,''),
+		(11,221,'')";
+
+
+date_default_timezone_set('Europe/Warsaw');
+
+$link = odbc_connect($dsn, $user, $pass);
+
+odbc_exec($link, 'CREATE DATABASE odbcTEST');
+odbc_exec($link, $create_table);
+odbc_exec($link, $inserts);
+
+$upd_params = array(
+	array('id'=>1, 'name'=>'test 1'),
+	array('id'=>2, 'name'=>'test 2'),
+	array('id'=>3, 'name'=>'test 3'),
+	array('id'=>4, 'name'=>'test 4'),
+	array('id'=>5, 'name'=>'test 5'),
+	array('id'=>10, 'name'=>'test 10'),
+	array('id'=>9, 'name'=>'test 9'),
+	array('id'=>8, 'name'=>'test 8'),
+	array('id'=>7, 'name'=>'test 7'),
+	array('id'=>6, 'name'=>'test 6'),
+);
+$sql = "UPDATE FOO
+     SET [PAR_CHR] = ?
+     WHERE [PAR_ID] = ?";
+$result = odbc_prepare($link, $sql);
+if (!$result) {
+	print ('[sql] prep: '.$sql);
+	goto out;
+}
+foreach ($upd_params as &$k) {
+	if(!odbc_execute($result, array($k['name'], $k['id']))) {
+		print ('[sql] exec: '."array({$k['name']}, {$k['id']})");
+		goto out;
+	}
+}
+odbc_free_result($result);
+
+$sql = "SELECT * FROM FOO WHERE [PAR_ID] = ?";
+$result = odbc_prepare($link, $sql);
+if (!$result) {
+	print ('[sql] prep: '.$sql);
+	goto out;
+}
+foreach ($upd_params as $k) { 
+	if(!odbc_execute($result, array($k['id']))) {
+		print ('[sql] exec: '."array({$k['id']})");
+		goto out;
+	}
+	while (($r = odbc_fetch_array($result)) !== false) {
+		var_dump($r);
+	}
+}
+
+out:
+if ($result) odbc_free_result($result);
+odbc_close($link);
+
+?>
+==DONE==
+--EXPECT--
+array(3) {
+  ["PAR_ID"]=>
+  string(1) "1"
+  ["PAR_INT"]=>
+  string(2) "14"
+  ["PAR_CHR"]=>
+  string(6) "test 1"
+}
+array(3) {
+  ["PAR_ID"]=>
+  string(1) "2"
+  ["PAR_INT"]=>
+  string(2) "30"
+  ["PAR_CHR"]=>
+  string(6) "test 2"
+}
+array(3) {
+  ["PAR_ID"]=>
+  string(1) "3"
+  ["PAR_INT"]=>
+  string(1) "7"
+  ["PAR_CHR"]=>
+  string(6) "test 3"
+}
+array(3) {
+  ["PAR_ID"]=>
+  string(1) "4"
+  ["PAR_INT"]=>
+  string(1) "7"
+  ["PAR_CHR"]=>
+  string(6) "test 4"
+}
+array(3) {
+  ["PAR_ID"]=>
+  string(1) "5"
+  ["PAR_INT"]=>
+  string(1) "0"
+  ["PAR_CHR"]=>
+  string(6) "test 5"
+}
+array(3) {
+  ["PAR_ID"]=>
+  string(2) "10"
+  ["PAR_INT"]=>
+  string(8) "20140620"
+  ["PAR_CHR"]=>
+  string(7) "test 10"
+}
+array(3) {
+  ["PAR_ID"]=>
+  string(1) "9"
+  ["PAR_INT"]=>
+  string(8) "20140201"
+  ["PAR_CHR"]=>
+  string(6) "test 9"
+}
+array(3) {
+  ["PAR_ID"]=>
+  string(1) "8"
+  ["PAR_INT"]=>
+  string(8) "20140201"
+  ["PAR_CHR"]=>
+  string(6) "test 8"
+}
+array(3) {
+  ["PAR_ID"]=>
+  string(1) "7"
+  ["PAR_INT"]=>
+  string(8) "20130901"
+  ["PAR_CHR"]=>
+  string(6) "test 7"
+}
+array(3) {
+  ["PAR_ID"]=>
+  string(1) "7"
+  ["PAR_INT"]=>
+  string(8) "20130901"
+  ["PAR_CHR"]=>
+  string(6) "test 7"
+}
+==DONE==
+--CLEAN--
+<?php
+include 'config.inc';
+
+$conn = odbc_connect($dsn, $user, $pass);
+
+odbc_exec($conn, 'DROP TABLE FOO');
+odbc_exec($conn, 'DROP DATABASE odbcTEST');
+
+odbc_close($conn);
+
+?>

ext/odbc/tests/config.inc

@@ -3,6 +3,17 @@
 putenv('ODBCINI=/etc/odbc.ini');
 putenv('ODBCSYSINI=/etc');
 
-$dsn = 'myodbc3';
-$user = 'root';
-$pass = '';
+$dsn  = getenv("ODBC_TEST_DSN");
+$user = getenv("ODBC_TEST_USER");
+$pass = getenv("ODBC_TEST_PASS");
+
+if (false === $dsn) {
+	$dsn = 'myodbc3';
+}
+if (false === $user) {
+	$user = 'root';
+}
+if (false == $pass) {
+	$pass = '';
+}
+

ext/opcache/Optimizer/block_pass.c

@@ -716,8 +716,11 @@ static void zend_optimize_block(zend_code_block *block, zend_op_array *op_array,
 			if (src->opcode == ZEND_BOOL) {
 				if (ZEND_OP1_TYPE(src) == IS_CONST) {
 					literal_dtor(&ZEND_OP1_LITERAL(src));
+				} else if (ZEND_OP1_TYPE(src) == IS_TMP_VAR) {
+					src->opcode = ZEND_FREE;
+				} else {
+					MAKE_NOP(src);
 				}
-				MAKE_NOP(src);
 				MAKE_NOP(opline);
 			}
 		}

ext/opcache/ZendAccelerator.c

@@ -2370,6 +2370,11 @@ static void accel_deactivate(void)
 	 */
 	TSRMLS_FETCH();
 
+	if (ZCG(cwd)) {
+		efree(ZCG(cwd));
+		ZCG(cwd) = NULL;
+	}
+
 	if (!ZCG(enabled) || !accel_startup_ok) {
 		return;
 	}
@@ -2383,12 +2388,6 @@ static void accel_deactivate(void)
 		zend_accel_fast_shutdown(TSRMLS_C);
 	}
 #endif
-
-	if (ZCG(cwd)) {
-		efree(ZCG(cwd));
-		ZCG(cwd) = NULL;
-	}
-
 }
 
 static int accelerator_remove_cb(zend_extension *element1, zend_extension *element2)

ext/opcache/config.m4

@@ -359,7 +359,7 @@ AC_TRY_RUN([
     AC_MSG_RESULT("yes")
 ], AC_MSG_RESULT("no") )
 
-if test "$flock_type" == "unknown"; then
+if test "$flock_type" = "unknown"; then
 	AC_MSG_ERROR([Don't know how to define struct flock on this system[,] set --enable-opcache=no])
 fi
 

ext/opcache/tests/bug71843.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Bug #71843 (null ptr deref ZEND_RETURN_SPEC_CONST_HANDLER (zend_vm_execute.h:3479))
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.optimization_level=0xFFFFBFFF
+--SKIPIF--
+<?php if (!extension_loaded('Zend OPcache')) die("skip"); ?>
+--FILE--
+<?
+0 & ~E & ~R;
+6 && ~See
+?>
+okey
+--EXPECTF--
+Notice: Use of undefined constant E - assumed 'E' in %sbug71843.php on line %d
+
+Notice: Use of undefined constant R - assumed 'R' in %sbug71843.php on line %d
+
+Notice: Use of undefined constant See - assumed 'See' in %sbug71843.php on line %d
+okey

ext/openssl/openssl.c

@@ -1277,6 +1277,10 @@ PHP_MSHUTDOWN_FUNCTION(openssl)
 {
 	EVP_cleanup();
 
+#if OPENSSL_VERSION_NUMBER >= 0x00090805f
+	ERR_free_strings();
+#endif
+
 	php_unregister_url_stream_wrapper("https" TSRMLS_CC);
 	php_unregister_url_stream_wrapper("ftps" TSRMLS_CC);
 

ext/openssl/tests/002.phpt

@@ -1,32 +0,0 @@
---TEST--
-openssl_seal() tests
---SKIPIF--
-<?php if (!extension_loaded("openssl")) print "skip"; ?>
---FILE--
-<?php
-
-$a = 1;
-$b = array(1);
-$c = array(1);
-$d = array(1);
-
-var_dump(openssl_seal($a, $b, $c, $d));
-var_dump(openssl_seal($a, $a, $a, array()));
-var_dump(openssl_seal($c, $c, $c, 1));
-var_dump(openssl_seal($b, $b, $b, ""));
-
-echo "Done\n";
-?>
---EXPECTF--	
-Warning: openssl_seal(): not a public key (1th member of pubkeys) in %s on line %d
-bool(false)
-
-Warning: openssl_seal(): Fourth argument to openssl_seal() must be a non-empty array in %s on line %d
-bool(false)
-
-Warning: openssl_seal() expects parameter 1 to be string, array given in %s on line %d
-NULL
-
-Warning: openssl_seal() expects parameter 1 to be string, array given in %s on line %d
-NULL
-Done

ext/openssl/tests/007.phpt

@@ -1,60 +0,0 @@
---TEST--
-openssl_x509_read() and openssl_x509_free() tests
---SKIPIF--
-<?php if (!extension_loaded("openssl")) print "skip"; ?>
---FILE--
-<?php
-$fp = fopen(dirname(__FILE__) . "/cert.crt","r");
-$a = fread($fp,8192);
-fclose($fp); 
-
-$b = "file://" . dirname(__FILE__) . "/cert.crt";
-$c = "invalid cert";
-$d = openssl_x509_read($a);
-$e = array();
-$f = array($b);
-
-var_dump($res = openssl_x509_read($a));         // read cert as a string
-openssl_x509_free($res);
-var_dump($res);
-var_dump($res = openssl_x509_read($b));         // read cert as a filename string
-openssl_x509_free($res);
-var_dump($res);
-var_dump($res = openssl_x509_read($c));         // read an invalid cert, fails
-openssl_x509_free($res);
-var_dump($res);
-var_dump($res = openssl_x509_read($d));         // read cert from a resource
-openssl_x509_free($res);
-var_dump($res);
-var_dump($res = openssl_x509_read($e));         // read an array
-openssl_x509_free($res);
-var_dump($res);
-var_dump($res = openssl_x509_read($f));         // read an array with the filename
-openssl_x509_free($res);
-var_dump($res);
-?>
---EXPECTF--
-resource(%d) of type (OpenSSL X.509)
-resource(%d) of type (Unknown)
-resource(%d) of type (OpenSSL X.509)
-resource(%d) of type (Unknown)
-
-Warning: openssl_x509_read(): supplied parameter cannot be coerced into an X509 certificate! in %s on line %d
-bool(false)
-
-Warning: openssl_x509_free() expects parameter 1 to be resource, boolean given in %s on line %d
-bool(false)
-resource(%d) of type (OpenSSL X.509)
-resource(%d) of type (Unknown)
-
-Warning: openssl_x509_read(): supplied parameter cannot be coerced into an X509 certificate! in %s on line %d
-bool(false)
-
-Warning: openssl_x509_free() expects parameter 1 to be resource, boolean given in %s on line %d
-bool(false)
-
-Warning: openssl_x509_read(): supplied parameter cannot be coerced into an X509 certificate! in %s on line %d
-bool(false)
-
-Warning: openssl_x509_free() expects parameter 1 to be resource, boolean given in %s on line %d
-bool(false)

ext/openssl/tests/008.phpt

@@ -1,74 +0,0 @@
---TEST--
-openssl_x509_export() and openssl_x509_export_to_file() tests
---SKIPIF--
-<?php if (!extension_loaded("openssl")) print "skip"; ?>
---FILE--
-<?php
-$fp = fopen(dirname(__FILE__) . "/cert.crt","r");
-$a = fread($fp,8192);
-fclose($fp); 
-
-$b = "file://" . dirname(__FILE__) . "/cert.crt";
-$c = "invalid cert";
-$d = openssl_x509_read($a);
-$e = array();
-
-var_dump(openssl_x509_export($a, $output));	// read cert as a binary string
-var_dump(openssl_x509_export($b, $output2));	// read cert from a filename string
-var_dump(openssl_x509_export($c, $output3));	// read an invalid cert, fails
-var_dump(openssl_x509_export($d, $output4));	// read cert from a resource
-var_dump(openssl_x509_export($e, $output5));	// read an array, fails
-
-$outfilename = tempnam("/tmp", "ssl");
-if ($outfilename === false)
-        die("failed to get a temporary filename!");
-
-echo "---\n";
-
-var_dump(openssl_x509_export_to_file($a, $outfilename));      // read cert as a binary string
-var_dump(openssl_x509_export_to_file($b, $outfilename));      // read cert from a filename string
-var_dump(openssl_x509_export_to_file($c, $outfilename));      // read an invalid cert, fails
-var_dump(openssl_x509_export_to_file($d, $outfilename));      // read cert from a resource
-var_dump(openssl_x509_export_to_file($e, $outfilename));      // read an array, fails
-echo "---\n";
-
-var_dump($exists = file_exists($outfilename));
-if ($exists) {
-        @unlink($outfilename);
-}
-echo "---\n";
-
-var_dump(strcmp($output, $a));
-var_dump(strcmp($output, $output2));
-var_dump(strcmp($output, $output3));
-var_dump(strcmp($output, $output4));	// different
-var_dump(strcmp($output, $output5));	// different
-?>
---EXPECTF--
-bool(true)
-bool(true)
-
-Warning: openssl_x509_export(): cannot get cert from parameter 1 in %s on line %d
-bool(false)
-bool(true)
-
-Warning: openssl_x509_export(): cannot get cert from parameter 1 in %s on line %d
-bool(false)
----
-bool(true)
-bool(true)
-
-Warning: openssl_x509_export_to_file(): cannot get cert from parameter 1 in %s on line %d
-bool(false)
-bool(true)
-
-Warning: openssl_x509_export_to_file(): cannot get cert from parameter 1 in %s on line %d
-bool(false)
----
-bool(true)
----
-int(0)
-int(0)
-int(%d)
-int(0)
-int(%d)

ext/openssl/tests/012.phpt

@@ -1,27 +0,0 @@
---TEST--
-openssl_seal() error tests
---SKIPIF--
-<?php if (!extension_loaded("openssl")) print "skip"; ?>
---FILE--
-<?php
-$data = "openssl_open() test";
-$pub_key = "file://" . dirname(__FILE__) . "/public.key";
-$wrong = "wrong";
-
-openssl_seal($data, $sealed, $ekeys, array($pub_key));                  // no output
-openssl_seal($data, $sealed, $ekeys, array($pub_key, $pub_key));        // no output
-openssl_seal($data, $sealed, $ekeys, array($pub_key, $wrong));
-openssl_seal($data, $sealed, $ekeys, $pub_key);
-openssl_seal($data, $sealed, $ekeys, array());
-openssl_seal($data, $sealed, $ekeys, array($wrong));
-?>
---EXPECTF--
-
-Warning: openssl_seal(): not a public key (2th member of pubkeys) in %s on line %d
-
-Warning: openssl_seal() expects parameter 4 to be array, string given in %s on line %d
-
-Warning: openssl_seal(): Fourth argument to openssl_seal() must be a non-empty array in %s on line %d
-
-Warning: openssl_seal(): not a public key (1th member of pubkeys) in %s on line %d
-

ext/openssl/tests/026.phpt

@@ -1,12 +0,0 @@
---TEST--
-Options type checks
---SKIPIF--
-<?php if (!extension_loaded("openssl")) print "skip"; ?>
---FILE--
-<?php
-$x = openssl_pkey_new();
-$csr = openssl_csr_new(["countryName" => "DE"], $x, ["x509_extensions" => 0xDEADBEEF]);
-?>
-DONE
---EXPECT--
-DONE

ext/openssl/tests/bug60632.phpt

@@ -10,7 +10,8 @@ $pkey = openssl_pkey_new(array(
 	'digest_alg' => 'sha256',
 	'private_key_bits' => 1024,
 	'private_key_type' => OPENSSL_KEYTYPE_RSA,
-	'encrypt_key' => false
+	'encrypt_key' => false,
+	'config' => __DIR__ . DIRECTORY_SEPARATOR . 'openssl.cnf',
 ));
 $details = openssl_pkey_get_details($pkey);
 $test_pubkey = $details['key'];

ext/openssl/tests/openssl_csr_export_bacis.phpt

@@ -14,7 +14,7 @@ $dn = array(
 	"localityName" => "Porto Alegre",
 	"commonName" => "Henrique do N. Angelo",
 	"emailAddress" => "hnangelo@php.net"
-	);
+);
 
 $args = array(
 	"digest_alg" => "sha1",
@@ -22,7 +22,7 @@ $args = array(
 	"private_key_type" => OPENSSL_KEYTYPE_DSA,
 	"encrypt_key" => true,
 	"config" => $config,
-	);
+);
 
 $privkey = openssl_pkey_new($config_arg);
 $csr = openssl_csr_new($dn, $privkey, $args);

ext/openssl/tests/openssl_csr_get_subject_basic.phpt

@@ -8,7 +8,7 @@ if (!function_exists("utf8_decode")) die("skip");
 --FILE--
 <?php
 
-$csr = file_get_contents(dirname(__FILE__) . '/005_crt.txt');
+$csr = file_get_contents(dirname(__FILE__) . '/cert.csr');
 if ($out = openssl_csr_get_subject($csr, 1)) {
 	var_dump($out);
 }

ext/openssl/tests/openssl_csr_new_basic.phpt

@@ -9,12 +9,18 @@ $a = 1;
 var_dump(openssl_csr_new(1,$a));
 var_dump(openssl_csr_new(1,$a,1,1));
 $a = array();
-var_dump(openssl_csr_new(array(), $a, array('config' => __DIR__ . DIRECTORY_SEPARATOR . 'openssl.cnf'), array()));
 
-//this leaks
+$conf = array('config' => dirname(__FILE__) . DIRECTORY_SEPARATOR . 'openssl.cnf');
+var_dump(openssl_csr_new(array(), $a, $conf, array()));
+
+// this leaks
 $a = array(1,2);
 $b = array(1,2);
-var_dump(openssl_csr_new($a, $b, array('config' => __DIR__ . DIRECTORY_SEPARATOR . 'openssl.cnf')));
+var_dump(openssl_csr_new($a, $b, $conf));
+
+// options type check
+$x = openssl_pkey_new($conf);
+var_dump(openssl_csr_new(["countryName" => "DE"], $x, $conf + ["x509_extensions" => 0xDEADBEEF]));
 
 
 echo "Done\n";
@@ -31,4 +37,5 @@ Warning: openssl_csr_new(): key array must be of the form array(0 => key, 1 => p
 Warning: openssl_csr_new(): add1_attr_by_txt challengePassword_min -> 4 (failed; check error queue and value of string_mask OpenSSL option if illegal characters are reported) in %s on line %d
 bool(false)
 resource(%d) of type (OpenSSL X.509 CSR)
+resource(%d) of type (OpenSSL X.509 CSR)
 Done

ext/openssl/tests/openssl_csr_sign_basic.phpt

@@ -5,7 +5,7 @@ openssl_csr_sign() tests
 --FILE--
 <?php
 $cert = "file://" . dirname(__FILE__) . "/cert.crt";
-$priv = "file://" . dirname(__FILE__) . "/private.key";
+$priv = "file://" . dirname(__FILE__) . "/private_rsa_1024.key";
 $wrong = "wrong";
 $pub = "file://" . dirname(__FILE__) . "/public.key";
 $config = __DIR__ . DIRECTORY_SEPARATOR . 'openssl.cnf';

ext/openssl/tests/openssl_decrypt_basic.phpt

@@ -1,5 +1,5 @@
 --TEST--
-openssl_encrypt() and openssl_decrypt() tests
+openssl_decrypt() tests dependent on openssl_encrypt
 --SKIPIF--
 <?php if (!extension_loaded("openssl")) print "skip"; ?>
 --FILE--

ext/openssl/tests/openssl_open_basic.phpt

@@ -6,7 +6,7 @@ openssl_open() tests
 <?php
 $data = "openssl_open() test";
 $pub_key = "file://" . dirname(__FILE__) . "/public.key";
-$priv_key = "file://" . dirname(__FILE__) . "/private.key";
+$priv_key = "file://" . dirname(__FILE__) . "/private_rsa_1024.key";
 $wrong = "wrong";
 
 openssl_seal($data, $sealed, $ekeys, array($pub_key, $pub_key, $pub_key));

ext/openssl/tests/openssl_pkcs7_decrypt_basic.phpt

@@ -5,7 +5,7 @@ openssl_pkcs7_decrypt() tests
 --FILE--
 <?php
 $infile = dirname(__FILE__) . "/cert.crt";
-$privkey = "file://" . dirname(__FILE__) . "/private.key";
+$privkey = "file://" . dirname(__FILE__) . "/private_rsa_1024.key";
 $encrypted = tempnam("/tmp", "ssl");
 if ($encrypted === false)
 	die("failed to get a temporary filename!");

ext/openssl/tests/openssl_pkcs7_decrypt_error.phpt

@@ -6,7 +6,7 @@ openssl_pkcs7_decrypt() and invalid parameters
 <?php
 
 function myErrorHandler($errno, $errstr, $errfile, $errline) {
-var_dump($errstr);
+	var_dump($errstr);
 } 
 set_error_handler("myErrorHandler"); 
 

ext/openssl/tests/openssl_pkcs7_encrypt_basic.phpt

@@ -13,7 +13,7 @@ if ($outfile2 === false)
 	die("failed to get a temporary filename!");
 
 $single_cert = "file://" . dirname(__FILE__) . "/cert.crt";
-$privkey = "file://" . dirname(__FILE__) . "/private.key";
+$privkey = "file://" . dirname(__FILE__) . "/private_rsa_1024.key";
 $multi_certs = array($single_cert, $single_cert);
 $assoc_headers = array("To" => "test@test", "Subject" => "testing openssl_pkcs7_encrypt()");
 $headers = array("test@test", "testing openssl_pkcs7_encrypt()");

ext/openssl/tests/openssl_pkcs7_sign_basic.phpt

@@ -6,10 +6,11 @@ openssl_pkcs7_sign() tests
 <?php
 $infile = dirname(__FILE__) . "/cert.crt";
 $outfile = tempnam("/tmp", "ssl");
-if ($outfile === false)
+if ($outfile === false) {
 	die("failed to get a temporary filename!");
+}
 
-$privkey = "file://" . dirname(__FILE__) . "/private.key";
+$privkey = "file://" . dirname(__FILE__) . "/private_rsa_1024.key";
 $single_cert = "file://" . dirname(__FILE__) . "/cert.crt";
 $assoc_headers = array("To" => "test@test", "Subject" => "testing openssl_pkcs7_sign()");
 $headers = array("test@test", "testing openssl_pkcs7_sign()");

ext/openssl/tests/openssl_pkey_export_basic.phpt

@@ -10,7 +10,9 @@ if (!defined('OPENSSL_KEYTYPE_EC')) die("skip no EC available");
 $key = openssl_pkey_get_private('file://' . dirname(__FILE__) . '/private_ec.key');
 var_dump($key);
 
-var_dump(openssl_pkey_export($key, $output));
+$config_arg = array("config" => __DIR__ . DIRECTORY_SEPARATOR . "openssl.cnf");
+
+var_dump(openssl_pkey_export($key, $output, NULL, $config_arg));
 echo $output;
 
 // Load the private key from the exported pem string
@@ -18,7 +20,7 @@ $details = openssl_pkey_get_details(openssl_pkey_get_private($output));
 var_dump(OPENSSL_KEYTYPE_EC === $details['type']);
 
 // Export key with passphrase
-openssl_pkey_export($key, $output, 'passphrase');
+openssl_pkey_export($key, $output, 'passphrase', $config_arg);
 
 $details = openssl_pkey_get_details(openssl_pkey_get_private($output, 'passphrase'));
 var_dump(OPENSSL_KEYTYPE_EC === $details['type']);
@@ -32,7 +34,7 @@ var_dump($details === openssl_pkey_get_details($pKey));
 
 // Export to file
 $tempname = tempnam(sys_get_temp_dir(), 'openssl_ec');
-var_dump(openssl_pkey_export_to_file($key, $tempname));
+var_dump(openssl_pkey_export_to_file($key, $tempname, NULL, $config_arg));
 $details = openssl_pkey_get_details(openssl_pkey_get_private('file://' . $tempname));
 var_dump(OPENSSL_KEYTYPE_EC === $details['type']);
 

ext/openssl/tests/openssl_pkey_new_basic.phpt

@@ -1,5 +1,5 @@
 --TEST--
-openssl_pkey_new() with an empty sub-array arg generates a malformed resource
+openssl_pkey_new() tests
 --SKIPIF--
 <?php if (!extension_loaded("openssl")) print "skip"; ?>
 --FILE--

ext/openssl/tests/openssl_private_decrypt_basic.phpt

@@ -5,7 +5,7 @@ openssl_private_decrypt() tests
 --FILE--
 <?php
 $data = "Testing openssl_public_decrypt()";
-$privkey = "file://" . dirname(__FILE__) . "/private.key";
+$privkey = "file://" . dirname(__FILE__) . "/private_rsa_1024.key";
 $pubkey = "file://" . dirname(__FILE__) . "/public.key";
 $wrong = "wrong";
 

ext/openssl/tests/openssl_private_encrypt_basic.phpt

@@ -5,13 +5,14 @@ openssl_private_encrypt() tests
 --FILE--
 <?php
 $data = "Testing openssl_private_encrypt()";
-$privkey = "file://" . dirname(__FILE__) . "/private.key";
+$privkey = "file://" . dirname(__FILE__) . "/private_rsa_1024.key";
 $pubkey = "file://" . dirname(__FILE__) . "/public.key";
 $wrong = "wrong";
+
 class test {
-        function __toString() {
-                return "test";
-        }
+	function __toString() {
+		return "test";
+	}
 }
 $obj = new test;
 

ext/openssl/tests/openssl_public_decrypt_basic.phpt

@@ -5,7 +5,7 @@ openssl_public_decrypt() tests
 --FILE--
 <?php
 $data = "Testing openssl_public_decrypt()";
-$privkey = "file://" . dirname(__FILE__) . "/private.key";
+$privkey = "file://" . dirname(__FILE__) . "/private_rsa_1024.key";
 $pubkey = "file://" . dirname(__FILE__) . "/public.key";
 $wrong = "wrong";
 

ext/openssl/tests/openssl_public_encrypt_basic.phpt

@@ -5,13 +5,14 @@ openssl_public_encrypt() tests
 --FILE--
 <?php
 $data = "Testing openssl_public_encrypt()";
-$privkey = "file://" . dirname(__FILE__) . "/private.key";
+$privkey = "file://" . dirname(__FILE__) . "/private_rsa_1024.key";
 $pubkey = "file://" . dirname(__FILE__) . "/public.key";
 $wrong = "wrong";
+
 class test {
-        function __toString() {
-                return "test";
-        }
+	function __toString() {
+		return "test";
+	}
 }
 $obj = new test;
 

ext/openssl/tests/openssl_seal_basic.phpt

@@ -0,0 +1,58 @@
+--TEST--
+openssl_seal() tests
+--SKIPIF--
+<?php if (!extension_loaded("openssl")) print "skip"; ?>
+--FILE--
+<?php
+// simple tests
+$a = 1;
+$b = array(1);
+$c = array(1);
+$d = array(1);
+
+var_dump(openssl_seal($a, $b, $c, $d));
+var_dump(openssl_seal($a, $a, $a, array()));
+var_dump(openssl_seal($c, $c, $c, 1));
+var_dump(openssl_seal($b, $b, $b, ""));
+
+// tests with cert
+$data = "openssl_open() test";
+$pub_key = "file://" . dirname(__FILE__) . "/public.key";
+$wrong = "wrong";
+
+var_dump(openssl_seal($data, $sealed, $ekeys, array($pub_key)));                  // no output
+var_dump(openssl_seal($data, $sealed, $ekeys, array($pub_key, $pub_key)));        // no output
+var_dump(openssl_seal($data, $sealed, $ekeys, array($pub_key, $wrong)));
+var_dump(openssl_seal($data, $sealed, $ekeys, $pub_key));
+var_dump(openssl_seal($data, $sealed, $ekeys, array()));
+var_dump(openssl_seal($data, $sealed, $ekeys, array($wrong)));
+
+echo "Done\n";
+?>
+--EXPECTF--	
+Warning: openssl_seal(): not a public key (1th member of pubkeys) in %s on line %d
+bool(false)
+
+Warning: openssl_seal(): Fourth argument to openssl_seal() must be a non-empty array in %s on line %d
+bool(false)
+
+Warning: openssl_seal() expects parameter 1 to be string, array given in %s on line %d
+NULL
+
+Warning: openssl_seal() expects parameter 1 to be string, array given in %s on line %d
+NULL
+int(19)
+int(19)
+
+Warning: openssl_seal(): not a public key (2th member of pubkeys) in %s on line %d
+bool(false)
+
+Warning: openssl_seal() expects parameter 4 to be array, string given in %s on line %d
+NULL
+
+Warning: openssl_seal(): Fourth argument to openssl_seal() must be a non-empty array in %s on line %d
+bool(false)
+
+Warning: openssl_seal(): not a public key (1th member of pubkeys) in %s on line %d
+bool(false)
+Done

ext/openssl/tests/openssl_sign_basic.phpt

@@ -5,7 +5,7 @@ openssl_sign() tests
 --FILE--
 <?php
 $data = "Testing openssl_sign()";
-$privkey = "file://" . dirname(__FILE__) . "/private.key";
+$privkey = "file://" . dirname(__FILE__) . "/private_rsa_1024.key";
 $wrong = "wrong";
 
 var_dump(openssl_sign($data, $sign, $privkey));                 // no output

ext/openssl/tests/openssl_spki_export.phpt

@@ -1,62 +0,0 @@
---TEST--
-Testing openssl_spki_export()
-Creates SPKAC for all available key sizes & signature algorithms and exports public key
---SKIPIF--
-<?php
-if (!extension_loaded("openssl")) die("skip");
-if (!@openssl_pkey_new()) die("skip cannot create private key");
-?>
---FILE--
-<?php
-
-/* array of private key sizes to test */
-$ksize = array('1024'=>1024,
-			   '2048'=>2048,
-			   '4096'=>4096);
-
-/* array of available hashings to test */
-$algo = array('md4'=>OPENSSL_ALGO_MD4,
-              'md5'=>OPENSSL_ALGO_MD5,
-              'sha1'=>OPENSSL_ALGO_SHA1,
-			  'sha224'=>OPENSSL_ALGO_SHA224,
-              'sha256'=>OPENSSL_ALGO_SHA256,
-              'sha384'=>OPENSSL_ALGO_SHA384,
-              'sha512'=>OPENSSL_ALGO_SHA512,
-              'rmd160'=>OPENSSL_ALGO_RMD160);
-
-/* loop over key sizes for test */
-foreach($ksize as $k => $v) {
-
-	/* generate new private key of specified size to use for tests */
-	$pkey = openssl_pkey_new(array('digest_alg' => 'sha512',
-	                               'private_key_type' => OPENSSL_KEYTYPE_RSA,
-	                               'private_key_bits' => $v));
-	openssl_pkey_export($pkey, $pass);
-
-	/* loop to create and verify results */
-	foreach($algo as $key => $value) {
-		$spkac = openssl_spki_new($pkey, _uuid(), $value);
-		echo openssl_spki_export(preg_replace('/SPKAC=/', '', $spkac));
-	}
-	openssl_free_key($pkey);
-}
-
-/* generate a random challenge */
-function _uuid()
-{
- return sprintf('%04x%04x-%04x-%04x-%04x-%04x%04x%04x', mt_rand(0, 0xffff),
-                mt_rand(0, 0xffff), mt_rand(0, 0xffff), mt_rand(0, 0x0fff) | 0x4000,
-                mt_rand(0, 0x3fff) | 0x8000, mt_rand(0, 0xffff),
-                mt_rand(0, 0xffff), mt_rand(0, 0xffff));
-}
-
-?>
---EXPECTREGEX--
-\-\-\-\-\-BEGIN PUBLIC KEY\-\-\-\-\-.*\-\-\-\-\-END PUBLIC KEY\-\-\-\-\-
-\-\-\-\-\-BEGIN PUBLIC KEY\-\-\-\-\-.*\-\-\-\-\-END PUBLIC KEY\-\-\-\-\-
-\-\-\-\-\-BEGIN PUBLIC KEY\-\-\-\-\-.*\-\-\-\-\-END PUBLIC KEY\-\-\-\-\-
-\-\-\-\-\-BEGIN PUBLIC KEY\-\-\-\-\-.*\-\-\-\-\-END PUBLIC KEY\-\-\-\-\-
-\-\-\-\-\-BEGIN PUBLIC KEY\-\-\-\-\-.*\-\-\-\-\-END PUBLIC KEY\-\-\-\-\-
-\-\-\-\-\-BEGIN PUBLIC KEY\-\-\-\-\-.*\-\-\-\-\-END PUBLIC KEY\-\-\-\-\-
-\-\-\-\-\-BEGIN PUBLIC KEY\-\-\-\-\-.*\-\-\-\-\-END PUBLIC KEY\-\-\-\-\-
-\-\-\-\-\-BEGIN PUBLIC KEY\-\-\-\-\-.*\-\-\-\-\-END PUBLIC KEY\-\-\-\-\-

ext/openssl/tests/openssl_spki_export_basic.phpt

@@ -0,0 +1,60 @@
+--TEST--
+openssl_spki_export() tests for exporting public key
+--SKIPIF--
+<?php
+if (!extension_loaded("openssl")) die("skip");
+if (!@openssl_pkey_new()) die("skip cannot create private key");
+?>
+--FILE--
+<?php
+
+/* array of private key sizes to test */
+$key_sizes = array(1024, 2048, 4096);
+$pkeys = array();
+foreach ($key_sizes as $key_size) {
+	$key_file = "file://" . dirname(__FILE__) . "/private_rsa_" . $key_size . ".key";
+	$pkeys[] = openssl_pkey_get_private($key_file);
+}
+
+
+/* array of available hashings to test */
+$algo = array(
+	OPENSSL_ALGO_MD4,
+	OPENSSL_ALGO_MD5,
+	OPENSSL_ALGO_SHA1,
+	OPENSSL_ALGO_SHA224,
+	OPENSSL_ALGO_SHA256,
+	OPENSSL_ALGO_SHA384,
+	OPENSSL_ALGO_SHA512,
+	OPENSSL_ALGO_RMD160
+);
+
+/* loop over key sizes for test */
+foreach ($pkeys as $pkey) {
+
+	/* loop to create and verify results */
+	foreach ($algo as $value) {
+		$spkac = openssl_spki_new($pkey, _uuid(), $value);
+		echo openssl_spki_export(preg_replace('/SPKAC=/', '', $spkac));
+	}
+}
+
+/* generate a random challenge */
+function _uuid() {
+	return sprintf('%04x%04x-%04x-%04x-%04x-%04x%04x%04x', mt_rand(0, 0xffff),
+		mt_rand(0, 0xffff), mt_rand(0, 0xffff), mt_rand(0, 0x0fff) | 0x4000,
+		mt_rand(0, 0x3fff) | 0x8000, mt_rand(0, 0xffff),
+		mt_rand(0, 0xffff), mt_rand(0, 0xffff));
+}
+
+
+?>
+--EXPECTREGEX--
+\-\-\-\-\-BEGIN PUBLIC KEY\-\-\-\-\-.*\-\-\-\-\-END PUBLIC KEY\-\-\-\-\-
+\-\-\-\-\-BEGIN PUBLIC KEY\-\-\-\-\-.*\-\-\-\-\-END PUBLIC KEY\-\-\-\-\-
+\-\-\-\-\-BEGIN PUBLIC KEY\-\-\-\-\-.*\-\-\-\-\-END PUBLIC KEY\-\-\-\-\-
+\-\-\-\-\-BEGIN PUBLIC KEY\-\-\-\-\-.*\-\-\-\-\-END PUBLIC KEY\-\-\-\-\-
+\-\-\-\-\-BEGIN PUBLIC KEY\-\-\-\-\-.*\-\-\-\-\-END PUBLIC KEY\-\-\-\-\-
+\-\-\-\-\-BEGIN PUBLIC KEY\-\-\-\-\-.*\-\-\-\-\-END PUBLIC KEY\-\-\-\-\-
+\-\-\-\-\-BEGIN PUBLIC KEY\-\-\-\-\-.*\-\-\-\-\-END PUBLIC KEY\-\-\-\-\-
+\-\-\-\-\-BEGIN PUBLIC KEY\-\-\-\-\-.*\-\-\-\-\-END PUBLIC KEY\-\-\-\-\-

ext/openssl/tests/openssl_spki_export_challenge_basic.phpt

@@ -1,6 +1,5 @@
 --TEST--
-Testing openssl_spki_export_challenge()
-Creates SPKAC for all available key sizes & signature algorithms and exports challenge
+openssl_spki_export_challenge() tests for exporting challenge
 --INI--
 error_reporting=0
 --SKIPIF--
@@ -12,47 +11,46 @@ if (!@openssl_pkey_new()) die("skip cannot create private key");
 <?php
 
 /* array of private key sizes to test */
-$ksize = array('1024'=>1024,
-			   '2048'=>2048,
-			   '4096'=>4096);
+$key_sizes = array(1024, 2048, 4096);
+$pkeys = array();
+foreach ($key_sizes as $key_size) {
+	$key_file = "file://" . dirname(__FILE__) . "/private_rsa_" . $key_size . ".key";
+	$pkeys[] = openssl_pkey_get_private($key_file);
+}
+
 
 /* array of available hashings to test */
-$algo = array('md4'=>OPENSSL_ALGO_MD4,
-              'md5'=>OPENSSL_ALGO_MD5,
-              'sha1'=>OPENSSL_ALGO_SHA1,
-			  'sha224'=>OPENSSL_ALGO_SHA224,
-              'sha256'=>OPENSSL_ALGO_SHA256,
-              'sha384'=>OPENSSL_ALGO_SHA384,
-              'sha512'=>OPENSSL_ALGO_SHA512,
-              'rmd160'=>OPENSSL_ALGO_RMD160);
+$algo = array(
+	OPENSSL_ALGO_MD4,
+	OPENSSL_ALGO_MD5,
+	OPENSSL_ALGO_SHA1,
+	OPENSSL_ALGO_SHA224,
+	OPENSSL_ALGO_SHA256,
+	OPENSSL_ALGO_SHA384,
+	OPENSSL_ALGO_SHA512,
+	OPENSSL_ALGO_RMD160
+);
 
 /* loop over key sizes for test */
-foreach($ksize as $k => $v) {
-
-	/* generate new private key of specified size to use for tests */
-	$pkey = openssl_pkey_new(array('digest_alg' => 'sha512',
-	                               'private_key_type' => OPENSSL_KEYTYPE_RSA,
-	                               'private_key_bits' => $v));
-	openssl_pkey_export($pkey, $pass);
+foreach ($pkeys as $pkey) {
 
 	/* loop to create and verify results */
-	foreach($algo as $key => $value) {
+	foreach ($algo as $value) {
 		$spkac = openssl_spki_new($pkey, _uuid(), $value);
 		var_dump(openssl_spki_export_challenge(preg_replace('/SPKAC=/', '', $spkac)));
-		var_dump(openssl_spki_export_challenge($spkac.'Make it fail'));
+		var_dump(openssl_spki_export_challenge($spkac  . 'Make it fail'));
 	}
-	openssl_free_key($pkey);
 }
 
 /* generate a random challenge */
-function _uuid()
-{
- return sprintf('%04x%04x-%04x-%04x-%04x-%04x%04x%04x', mt_rand(0, 0xffff),
-                mt_rand(0, 0xffff), mt_rand(0, 0xffff), mt_rand(0, 0x0fff) | 0x4000,
-                mt_rand(0, 0x3fff) | 0x8000, mt_rand(0, 0xffff),
-                mt_rand(0, 0xffff), mt_rand(0, 0xffff));
+function _uuid() {
+	return sprintf('%04x%04x-%04x-%04x-%04x-%04x%04x%04x', mt_rand(0, 0xffff),
+		mt_rand(0, 0xffff), mt_rand(0, 0xffff), mt_rand(0, 0x0fff) | 0x4000,
+		mt_rand(0, 0x3fff) | 0x8000, mt_rand(0, 0xffff),
+		mt_rand(0, 0xffff), mt_rand(0, 0xffff));
 }
 
+
 ?>
 --EXPECTREGEX--
 string\(36\) \"[0-9a-f]{8}\-([0-9a-f]{4}\-){3}[0-9a-f]{12}\"

ext/openssl/tests/openssl_spki_new.phpt

@@ -1,77 +0,0 @@
---TEST--
-Testing openssl_spki_new()
-Tests SPKAC for all available private key sizes & hashing algorithms
---SKIPIF--
-<?php
-if (!extension_loaded("openssl")) die("skip");
-if (!@openssl_pkey_new()) die("skip cannot create private key");
-?>
---FILE--
-<?php
-
-/* array of private key sizes to test */
-$ksize = array('1024'=>1024,
-			   '2048'=>2048,
-			   '4096'=>4096);
-
-/* array of available hashings to test */
-$algo = array('md4'=>OPENSSL_ALGO_MD4,
-              'md5'=>OPENSSL_ALGO_MD5,
-              'sha1'=>OPENSSL_ALGO_SHA1,
-			  'sha224'=>OPENSSL_ALGO_SHA224,
-              'sha256'=>OPENSSL_ALGO_SHA256,
-              'sha384'=>OPENSSL_ALGO_SHA384,
-              'sha512'=>OPENSSL_ALGO_SHA512,
-              'rmd160'=>OPENSSL_ALGO_RMD160);
-
-/* loop over key sizes for test */
-foreach($ksize as $k => $v) {
-
-	/* generate new private key of specified size to use for tests */
-	$pkey = openssl_pkey_new(array('digest_alg' => 'sha512',
-	                               'private_key_type' => OPENSSL_KEYTYPE_RSA,
-	                               'private_key_bits' => $v));
-	openssl_pkey_export($pkey, $pass);
-
-	/* loop to create and verify results */
-	foreach($algo as $key => $value) {
-		var_dump(openssl_spki_new($pkey, _uuid(), $value));
-	}
-	openssl_free_key($pkey);
-}
-
-/* generate a random challenge */
-function _uuid()
-{
- return sprintf('%04x%04x-%04x-%04x-%04x-%04x%04x%04x', mt_rand(0, 0xffff),
-                mt_rand(0, 0xffff), mt_rand(0, 0xffff), mt_rand(0, 0x0fff) | 0x4000,
-                mt_rand(0, 0x3fff) | 0x8000, mt_rand(0, 0xffff),
-                mt_rand(0, 0xffff), mt_rand(0, 0xffff));
-}
-
-?>
---EXPECTF--
-string(478) "%s"
-string(478) "%s"
-string(478) "%s"
-string(478) "%s"
-string(478) "%s"
-string(478) "%s"
-string(478) "%s"
-string(474) "%s"
-string(830) "%s"
-string(830) "%s"
-string(830) "%s"
-string(830) "%s"
-string(830) "%s"
-string(830) "%s"
-string(830) "%s"
-string(826) "%s"
-string(1510) "%s"
-string(1510) "%s"
-string(1510) "%s"
-string(1510) "%s"
-string(1510) "%s"
-string(1510) "%s"
-string(1510) "%s"
-string(1506) "%s"

ext/openssl/tests/openssl_spki_new_basic.phpt

@@ -0,0 +1,73 @@
+--TEST--
+openssl_spki_new() test for creating SPKI string
+--SKIPIF--
+<?php
+if (!extension_loaded("openssl")) die("skip");
+?>
+--FILE--
+<?php
+
+/* array of private key sizes to test */
+$key_sizes = array(1024, 2048, 4096);
+$pkeys = array();
+foreach ($key_sizes as $key_size) {
+	$key_file = "file://" . dirname(__FILE__) . "/private_rsa_" . $key_size . ".key";
+	$pkeys[] = openssl_pkey_get_private($key_file);
+}
+
+
+/* array of available hashings to test */
+$algo = array(
+	OPENSSL_ALGO_MD4,
+	OPENSSL_ALGO_MD5,
+	OPENSSL_ALGO_SHA1,
+	OPENSSL_ALGO_SHA224,
+	OPENSSL_ALGO_SHA256,
+	OPENSSL_ALGO_SHA384,
+	OPENSSL_ALGO_SHA512,
+	OPENSSL_ALGO_RMD160
+);
+
+/* loop over key sizes for test */
+foreach ($pkeys as $pkey) {
+
+	/* loop to create and verify results */
+	foreach ($algo as $value) {
+		var_dump(openssl_spki_new($pkey, _uuid(), $value));
+	}
+}
+
+/* generate a random challenge */
+function _uuid() {
+	return sprintf('%04x%04x-%04x-%04x-%04x-%04x%04x%04x', mt_rand(0, 0xffff),
+		mt_rand(0, 0xffff), mt_rand(0, 0xffff), mt_rand(0, 0x0fff) | 0x4000,
+		mt_rand(0, 0x3fff) | 0x8000, mt_rand(0, 0xffff),
+		mt_rand(0, 0xffff), mt_rand(0, 0xffff));
+}
+
+?>
+--EXPECTF--
+string(478) "%s"
+string(478) "%s"
+string(478) "%s"
+string(478) "%s"
+string(478) "%s"
+string(478) "%s"
+string(478) "%s"
+string(474) "%s"
+string(830) "%s"
+string(830) "%s"
+string(830) "%s"
+string(830) "%s"
+string(830) "%s"
+string(830) "%s"
+string(830) "%s"
+string(826) "%s"
+string(1510) "%s"
+string(1510) "%s"
+string(1510) "%s"
+string(1510) "%s"
+string(1510) "%s"
+string(1510) "%s"
+string(1510) "%s"
+string(1506) "%s"

ext/openssl/tests/openssl_spki_verify.phpt

@@ -1,91 +0,0 @@
---TEST--
-Testing openssl_spki_verify()
-Creates SPKAC for all available key sizes & signature algorithms and tests for valid signature
---INI--
-error_reporting=0
---SKIPIF--
-<?php
-if (!extension_loaded("openssl")) die("skip");
-if (!@openssl_pkey_new()) die("skip cannot create private key");
-?>
---FILE--
-<?php
-
-/* array of private key sizes to test */
-$ksize = array('1024'=>1024,
-               '2048'=>2048,
-			   '4096'=>4096);
-
-/* array of available hashings to test */
-$algo = array('sha1'=>OPENSSL_ALGO_SHA1,
-			  'sha224'=>OPENSSL_ALGO_SHA224,
-              'sha256'=>OPENSSL_ALGO_SHA256,
-              'sha384'=>OPENSSL_ALGO_SHA384,
-              'sha512'=>OPENSSL_ALGO_SHA512,
-              'rmd160'=>OPENSSL_ALGO_RMD160);
-
-/* loop over key sizes for test */
-foreach($ksize as $k => $v) {
-
-	/* generate new private key of specified size to use for tests */
-	$pkey = openssl_pkey_new(array('digest_alg' => 'sha512',
-	                               'private_key_type' => OPENSSL_KEYTYPE_RSA,
-	                               'private_key_bits' => $v));
-	openssl_pkey_export($pkey, $pass);
-
-	/* loop to create and verify results */
-	foreach($algo as $key => $value) {
-		$spkac = openssl_spki_new($pkey, _uuid(), $value);
-		var_dump(openssl_spki_verify(preg_replace('/SPKAC=/', '', $spkac)));
-		var_dump(openssl_spki_verify($spkac.'Make it fail'));
-	}
-	openssl_free_key($pkey);
-}
-
-/* generate a random challenge */
-function _uuid()
-{
- return sprintf('%04x%04x-%04x-%04x-%04x-%04x%04x%04x', mt_rand(0, 0xffff),
-                mt_rand(0, 0xffff), mt_rand(0, 0xffff), mt_rand(0, 0x0fff) | 0x4000,
-                mt_rand(0, 0x3fff) | 0x8000, mt_rand(0, 0xffff),
-                mt_rand(0, 0xffff), mt_rand(0, 0xffff));
-}
-
-?>
---EXPECT--
-bool(true)
-bool(false)
-bool(true)
-bool(false)
-bool(true)
-bool(false)
-bool(true)
-bool(false)
-bool(true)
-bool(false)
-bool(true)
-bool(false)
-bool(true)
-bool(false)
-bool(true)
-bool(false)
-bool(true)
-bool(false)
-bool(true)
-bool(false)
-bool(true)
-bool(false)
-bool(true)
-bool(false)
-bool(true)
-bool(false)
-bool(true)
-bool(false)
-bool(true)
-bool(false)
-bool(true)
-bool(false)
-bool(true)
-bool(false)
-bool(true)
-bool(false)