alphabetical order for NEWS blocks

We can not modify result since it can be copy of _zero_ or _one_, etc. and
"copy" in bcmath is just bumping the refcount.

Conflicts:
	main/php_version.h

NEWS

@@ -1,5 +1,112 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+28 Apr 2016, PHP 5.6.21
+
+- Core: 
+  . Fixed bug #69537 (__debugInfo with empty string for key gives error).
+    (krakjoe)
+  . Fixed bug #71841 (EG(error_zval) is not handled well). (Laruence)
+
+- BCmath:
+  . Fixed bug #72093 (bcpowmod accepts negative scale and corrupts
+    _one_ definition). (Stas)
+
+- Curl:
+  . Fixed bug #71831 (CURLOPT_NOPROXY applied as long instead of string).
+    (Michael Sierks)    
+
+- Date:
+  . Fixed bug #71889 (DateInterval::format Segmentation fault). (Thomas Punt)
+
+- EXIF:
+  . Fixed bug #72094 (Out of bounds heap read access in exif header processing). (Stas)
+
+- GD:
+  . Fixed bug #71952 (Corruption inside imageaffinematrixget). (Stas)
+  . Fixed bug #71912 (libgd: signedness vulnerability). (Stas)
+
+- Intl:
+  . Fixed bug #72061 (Out-of-bounds reads in zif_grapheme_stripos with negative
+    offset). (Stas)
+
+- OCI8:
+  . Fixed bug #71422 (Fix ORA-01438: value larger than specified precision
+    allowed for this column). (Chris Jones)
+
+- ODBC:
+  . Fixed bug #63171 (Script hangs after max_execution_time). (Remi)
+
+- Opcache:
+  . Fixed bug #71843 (null ptr deref ZEND_RETURN_SPEC_CONST_HANDLER).
+    (Laruence)
+
+- PDO:
+  . Fixed bug #52098 (Own PDOStatement implementation ignore __call()).
+    (Daniel Kalaspuffar, Julien)
+  . Fixed bug #71447 (Quotes inside comments not properly handled). (Matteo)
+
+- Postgres:
+  . Fixed bug #71820 (pg_fetch_object binds parameters before call
+    constructor). (Anatol)
+
+- SPL:
+  . Fixed bug #67582 (Cloned SplObjectStorage with overwritten getHash fails
+    offsetExists()). (Nikita)
+
+- Standard:
+  . Fixed bug #71840 (Unserialize accepts wrongly data). (Ryat, Laruence)
+  . Fixed bug #67512 (php_crypt() crashes if crypt_r() does not exist or
+    _REENTRANT is not defined). (Nikita)
+
+- XML:
+  . Fixed bug #72099 (xml_parse_into_struct segmentation fault). (Stas)
+
+31 Mar 2016, PHP 5.6.20
+
+- CLI Server:
+  . Fixed bug #69953 (Support MKCALENDAR request method). (Christoph)
+
+- Core:
+  . Fixed bug #71596 (Segmentation fault on ZTS with date function
+    (setlocale)). (Anatol)
+
+- Curl:
+  . Fixed bug #71694 (Support constant CURLM_ADDED_ALREADY). (mpyw)
+
+- Date:
+  . Fixed bug #71635 (DatePeriod::getEndDate segfault). (Thomas Punt)
+
+- Fileinfo:
+  . Fixed bug #71527 (Buffer over-write in finfo_open with malformed magic
+    file). (Anatol)
+
+- Mbstring:
+  . Fixed bug #71906 (AddressSanitizer: negative-size-param (-1) in
+    mbfl_strcut). (Stas)
+
+- ODBC:
+  . Fixed bug #47803, #69526 (Executing prepared statements is succesfull only
+    for the first two statements). (einavitamar at gmail dot com, Anatol)
+  . Fixed bug #71860 (Invalid memory write in phar on filename with \0 in
+    name). (Stas)
+
+- PDO_DBlib:
+  . Fixed bug #54648 (PDO::MSSQL forces format of datetime fields).
+    (steven dot lambeth at gmx dot de, Anatol)
+
+- Phar:
+  . Fixed bug #71625 (Crash in php7.dll with bad phar filename). (Anatol)
+  . Fixed bug #71504 (Parsing of tar file with duplicate filenames causes
+    memory leak). (Jos Elstgeest)
+
+- SNMP:
+  . Fixed bug #71704 (php_snmp_error() Format String Vulnerability).
+    (andrew at jmpesp dot org)
+
+- Standard:
+  . Fixed bug #71798 (Integer Overflow in php_raw_url_encode).
+    (taoguangchen at icloud dot com, Stas)
+
 03 Mar 2016, PHP 5.6.19
 
 - CLI server:

Zend/tests/bug69537.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Bug #69537 (__debugInfo with empty string for key gives error)
+--FILE--
+<?php
+class Foo {
+
+    public function __debugInfo(){
+        return ['' => 1];
+    }
+}
+
+var_dump(new Foo);
+?>
+--EXPECTF--
+object(Foo)#%d (%d) {
+  [""]=>
+  int(1)
+}
+

Zend/tests/bug71841.phpt

@@ -0,0 +1,23 @@
+--TEST--
+Bug #71841 (EG(error_zval) is not handled well)
+--INI--
+error_reporting=0
+--FILE--
+<?php
+$z = unserialize('O:1:"A":0:{}');
+var_dump($z->e.=0);
+var_dump(++$z->x);
+var_dump($z->y++);
+
+$y = array(PHP_INT_MAX => 0);
+var_dump($y[] .= 0);
+var_dump(++$y[]);
+var_dump($y[]++);
+?>
+--EXPECT--
+NULL
+NULL
+NULL
+NULL
+NULL
+NULL

Zend/zend_compile.c

@@ -5402,7 +5402,7 @@ ZEND_API int zend_unmangle_property_name_ex(const char *mangled_property, int le
 
 	*class_name = NULL;
 
-	if (mangled_property[0]!=0) {
+	if (!len || mangled_property[0] != 0) {
 		*prop_name = mangled_property;
 		if (prop_len) {
 			*prop_len = len;

Zend/zend_virtual_cwd.c

@@ -587,12 +587,14 @@ static inline unsigned long realpath_cache_key(const char *path, int path_len TS
 	register unsigned long h;
 	char *bucket_key_start = tsrm_win32_get_path_sid_key(path TSRMLS_CC);
 	char *bucket_key = (char *)bucket_key_start;
-	const char *e = bucket_key + strlen(bucket_key);
+	const char *e;
 
 	if (!bucket_key) {
 		return 0;
 	}
 
+	e = bucket_key + strlen(bucket_key);
+
 	for (h = 2166136261U; bucket_key < e;) {
 		h *= 16777619;
 		h ^= *bucket_key++;

Zend/zend_vm_def.h

@@ -364,13 +364,20 @@ ZEND_VM_HELPER_EX(zend_binary_assign_op_obj_helper, VAR|UNUSED|CV, CONST|TMP|VAR
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -625,13 +632,20 @@ ZEND_VM_HELPER_EX(zend_pre_incdec_property_helper, VAR|UNUSED|CV, CONST|TMP|VAR|
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -731,13 +745,16 @@ ZEND_VM_HELPER_EX(zend_post_incdec_property_helper, VAR|UNUSED|CV, CONST|TMP|VAR
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
-
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 

Zend/zend_vm_execute.h

@@ -14540,13 +14540,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_CONST(int (*b
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -14800,13 +14807,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_CONST(incdec_t
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -14906,13 +14920,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_CONST(incdec_
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
-
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
@@ -17053,13 +17070,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_TMP(int (*bin
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -17314,13 +17338,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_TMP(incdec_t i
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -17420,13 +17451,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_TMP(incdec_t
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
-
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
@@ -19153,13 +19187,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_VAR(int (*bin
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -19414,13 +19455,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_VAR(incdec_t i
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -19520,13 +19568,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_VAR(incdec_t
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
-
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
@@ -21359,13 +21410,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_UNUSED(int (*
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -22789,13 +22847,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_VAR_CV(int (*bina
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -23049,13 +23114,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_VAR_CV(incdec_t in
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -23155,13 +23227,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_VAR_CV(incdec_t i
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
-
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
@@ -24751,13 +24826,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_CONST(int
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -25010,13 +25092,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_CONST(incde
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -25116,13 +25205,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_CONST(incd
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
-
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
@@ -26164,13 +26256,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_TMP(int (*
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -26424,13 +26523,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_TMP(incdec_
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -26530,13 +26636,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_TMP(incdec
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
-
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
@@ -27486,13 +27595,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_VAR(int (*
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -27746,13 +27862,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_VAR(incdec_
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -27852,13 +27975,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_VAR(incdec
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
-
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
@@ -28809,13 +28935,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_UNUSED(int
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -29240,13 +29373,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_UNUSED_CV(int (*b
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -29499,13 +29639,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_UNUSED_CV(incdec_t
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -29605,13 +29752,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_UNUSED_CV(incdec_
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
-
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
@@ -32075,13 +32225,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_CONST(int (*bi
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -32334,13 +32491,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_CONST(incdec_t
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -32440,13 +32604,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_CONST(incdec_t
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CONST == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
-
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
@@ -34359,13 +34526,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_TMP(int (*bina
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -34619,13 +34793,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_TMP(incdec_t in
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -34725,13 +34906,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_TMP(incdec_t i
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_TMP_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
-
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
@@ -36322,13 +36506,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_VAR(int (*bina
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -36582,13 +36773,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_VAR(incdec_t in
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -36688,13 +36886,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_VAR(incdec_t i
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_VAR == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
-
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 
@@ -38390,13 +38591,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_UNUSED(int (*b
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_UNUSED == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -39671,13 +39879,20 @@ static int ZEND_FASTCALL zend_binary_assign_op_obj_helper_SPEC_CV_CV(int (*binar
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 				have_get_ptr = 1;
-				binary_op(*zptr, *zptr, value TSRMLS_CC);
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(*zptr);
-					EX_T(opline->result.var).var.ptr = *zptr;
+				if (UNEXPECTED(*zptr == &EG(error_zval))) {
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(&EG(uninitialized_zval));
+						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
+					}
+				} else {
+					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+					binary_op(*zptr, *zptr, value TSRMLS_CC);
+					if (RETURN_VALUE_USED(opline)) {
+						PZVAL_LOCK(*zptr);
+						EX_T(opline->result.var).var.ptr = *zptr;
+					}
 				}
 			}
 		}
@@ -39930,13 +40145,20 @@ static int ZEND_FASTCALL zend_pre_incdec_property_helper_SPEC_CV_CV(incdec_t inc
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
-
 			have_get_ptr = 1;
-			incdec_op(*zptr);
-			if (RETURN_VALUE_USED(opline)) {
-				*retval = *zptr;
-				PZVAL_LOCK(*retval);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(&EG(uninitialized_zval));
+					*retval = &EG(uninitialized_zval);
+				}
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+
+				incdec_op(*zptr);
+				if (RETURN_VALUE_USED(opline)) {
+					*retval = *zptr;
+					PZVAL_LOCK(*retval);
+				}
 			}
 		}
 	}
@@ -40036,13 +40258,16 @@ static int ZEND_FASTCALL zend_post_incdec_property_helper_SPEC_CV_CV(incdec_t in
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((IS_CV == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			SEPARATE_ZVAL_IF_NOT_REF(zptr);
+			if (UNEXPECTED(*zptr == &EG(error_zval))) {
+				ZVAL_NULL(retval);
+			} else {
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);
 
-			ZVAL_COPY_VALUE(retval, *zptr);
-			zendi_zval_copy_ctor(*retval);
-
-			incdec_op(*zptr);
+				ZVAL_COPY_VALUE(retval, *zptr);
+				zendi_zval_copy_ctor(*retval);
 
+				incdec_op(*zptr);
+			}
 		}
 	}
 

configure.in

@@ -119,7 +119,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
 
 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=6
-PHP_RELEASE_VERSION=19
+PHP_RELEASE_VERSION=21
 PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

ext/bcmath/bcmath.c

@@ -201,6 +201,21 @@ static void php_str2num(bc_num *num, char *str TSRMLS_DC)
 }
 /* }}} */
 
+/* {{{ split_bc_num
+   Convert to bc_num detecting scale */
+static bc_num split_bc_num(bc_num num) {
+	bc_num newnum;
+	if (num->n_refs >= 1) {
+		return num;
+	}
+	newnum = _bc_new_num_ex(0, 0, 0);
+	*newnum = *num;
+	newnum->n_refs = 1;
+	num->n_refs--;
+	return newnum;
+}
+/* }}} */
+
 /* {{{ proto string bcadd(string left_operand, string right_operand [, int scale])
    Returns the sum of two arbitrary precision numbers */
 PHP_FUNCTION(bcadd)
@@ -214,7 +229,7 @@ PHP_FUNCTION(bcadd)
 	if (zend_parse_parameters(argc TSRMLS_CC, "ss|l", &left, &left_len, &right, &right_len, &scale_param) == FAILURE) {
 		return;
 	}
-	
+
 	if (argc == 3) {
 		scale = (int) ((int)scale_param < 0) ? 0 : scale_param;
 	}
@@ -225,11 +240,12 @@ PHP_FUNCTION(bcadd)
 	php_str2num(&first, left TSRMLS_CC);
 	php_str2num(&second, right TSRMLS_CC);
 	bc_add (first, second, &result, scale);
-	
+
 	if (result->n_scale > scale) {
+		result = split_bc_num(result);
 		result->n_scale = scale;
 	}
-	
+
 	Z_STRVAL_P(return_value) = bc_num2str(result);
 	Z_STRLEN_P(return_value) = strlen(Z_STRVAL_P(return_value));
 	Z_TYPE_P(return_value) = IS_STRING;
@@ -253,7 +269,7 @@ PHP_FUNCTION(bcsub)
 	if (zend_parse_parameters(argc TSRMLS_CC, "ss|l", &left, &left_len, &right, &right_len, &scale_param) == FAILURE) {
 		return;
 	}
-	
+
 	if (argc == 3) {
 		scale = (int) ((int)scale_param < 0) ? 0 : scale_param;
 	}
@@ -266,6 +282,7 @@ PHP_FUNCTION(bcsub)
 	bc_sub (first, second, &result, scale);
 
 	if (result->n_scale > scale) {
+		result = split_bc_num(result);
 		result->n_scale = scale;
 	}
 
@@ -292,11 +309,11 @@ PHP_FUNCTION(bcmul)
 	if (zend_parse_parameters(argc TSRMLS_CC, "ss|l", &left, &left_len, &right, &right_len, &scale_param) == FAILURE) {
 		return;
 	}
-	
+
 	if (argc == 3) {
 		scale = (int) ((int)scale_param < 0) ? 0 : scale_param;
 	}
-	
+
 	bc_init_num(&first TSRMLS_CC);
 	bc_init_num(&second TSRMLS_CC);
 	bc_init_num(&result TSRMLS_CC);
@@ -305,6 +322,7 @@ PHP_FUNCTION(bcmul)
 	bc_multiply (first, second, &result, scale TSRMLS_CC);
 
 	if (result->n_scale > scale) {
+		result = split_bc_num(result);
 		result->n_scale = scale;
 	}
 
@@ -331,11 +349,11 @@ PHP_FUNCTION(bcdiv)
 	if (zend_parse_parameters(argc TSRMLS_CC, "ss|l", &left, &left_len, &right, &right_len, &scale_param) == FAILURE) {
 		return;
 	}
-	
+
 	if (argc == 3) {
 		scale = (int) ((int)scale_param < 0) ? 0 : scale_param;
 	}
-	
+
 	bc_init_num(&first TSRMLS_CC);
 	bc_init_num(&second TSRMLS_CC);
 	bc_init_num(&result TSRMLS_CC);
@@ -345,6 +363,7 @@ PHP_FUNCTION(bcdiv)
 	switch (bc_divide(first, second, &result, scale TSRMLS_CC)) {
 		case 0: /* OK */
 			if (result->n_scale > scale) {
+				result = split_bc_num(result);
 				result->n_scale = scale;
 			}
 			Z_STRVAL_P(return_value) = bc_num2str(result);
@@ -374,13 +393,13 @@ PHP_FUNCTION(bcmod)
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ss", &left, &left_len, &right, &right_len) == FAILURE) {
 		return;
 	}
-	
+
 	bc_init_num(&first TSRMLS_CC);
 	bc_init_num(&second TSRMLS_CC);
 	bc_init_num(&result TSRMLS_CC);
 	bc_str2num(&first, left, 0 TSRMLS_CC);
 	bc_str2num(&second, right, 0 TSRMLS_CC);
-	
+
 	switch (bc_modulo(first, second, &result, 0 TSRMLS_CC)) {
 		case 0:
 			Z_STRVAL_P(return_value) = bc_num2str(result);
@@ -391,7 +410,7 @@ PHP_FUNCTION(bcmod)
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Division by zero");
 			break;
 	}
-	
+
 	bc_free_num(&first);
 	bc_free_num(&second);
 	bc_free_num(&result);
@@ -424,8 +443,9 @@ PHP_FUNCTION(bcpowmod)
 	scale_int = (int) ((int)scale < 0) ? 0 : scale;
 
 	if (bc_raisemod(first, second, mod, &result, scale_int TSRMLS_CC) != -1) {
-		if (result->n_scale > scale) {
-			result->n_scale = scale;
+		if (result->n_scale > scale_int) {
+			result = split_bc_num(result);
+			result->n_scale = scale_int;
 		}
 		Z_STRVAL_P(return_value) = bc_num2str(result);
 		Z_STRLEN_P(return_value) = strlen(Z_STRVAL_P(return_value));
@@ -433,7 +453,7 @@ PHP_FUNCTION(bcpowmod)
 	} else {
 		RETVAL_FALSE;
 	}
-	
+
 	bc_free_num(&first);
 	bc_free_num(&second);
 	bc_free_num(&mod);
@@ -455,7 +475,7 @@ PHP_FUNCTION(bcpow)
 	if (zend_parse_parameters(argc TSRMLS_CC, "ss|l", &left, &left_len, &right, &right_len, &scale_param) == FAILURE) {
 		return;
 	}
-	
+
 	if (argc == 3) {
 		scale = (int) ((int)scale_param < 0) ? 0 : scale_param;
 	}
@@ -468,6 +488,7 @@ PHP_FUNCTION(bcpow)
 	bc_raise (first, second, &result, scale TSRMLS_CC);
 
 	if (result->n_scale > scale) {
+		result = split_bc_num(result);
 		result->n_scale = scale;
 	}
 
@@ -494,16 +515,17 @@ PHP_FUNCTION(bcsqrt)
 	if (zend_parse_parameters(argc TSRMLS_CC, "s|l", &left, &left_len, &scale_param) == FAILURE) {
 		return;
 	}
-	
+
 	if (argc == 2) {
 		scale = (int) ((int)scale_param < 0) ? 0 : scale_param;
 	}
 
 	bc_init_num(&result TSRMLS_CC);
 	php_str2num(&result, left TSRMLS_CC);
-	
+
 	if (bc_sqrt (&result, scale TSRMLS_CC) != 0) {
 		if (result->n_scale > scale) {
+			result = split_bc_num(result);
 			result->n_scale = scale;
 		}
 		Z_STRVAL_P(return_value) = bc_num2str(result);
@@ -531,7 +553,7 @@ PHP_FUNCTION(bccomp)
 	if (zend_parse_parameters(argc TSRMLS_CC, "ss|l", &left, &left_len, &right, &right_len, &scale_param) == FAILURE) {
 		return;
 	}
-	
+
 	if (argc == 3) {
 		scale = (int) ((int)scale_param < 0) ? 0 : scale_param;
 	}
@@ -555,7 +577,7 @@ PHP_FUNCTION(bccomp)
 PHP_FUNCTION(bcscale)
 {
 	long new_scale;
-	
+
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "l", &new_scale) == FAILURE) {
 		return;
 	}

ext/bcmath/tests/bug72093-win32.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug 72093: bcpowmod accepts negative scale and corrupts _one_ definition
+--SKIPIF--
+<?php
+if(!extension_loaded("bcmath")) print "skip";
+if (substr(PHP_OS, 0, 3) != 'WIN') {
+    die('skip valid only for windows');
+}
+?>
+--FILE--
+<?php
+var_dump(bcpowmod(1, "A", 128, -200));
+var_dump(bcpowmod(1, 1.2, 1, 1));
+?>
+--EXPECTF--
+string(1) "1"
+string(3) "0.0"
+bc math warning: non-zero scale in exponent

ext/bcmath/tests/bug72093.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug 72093: bcpowmod accepts negative scale and corrupts _one_ definition
+--SKIPIF--
+<?php
+if(!extension_loaded("bcmath")) print "skip";
+if (substr(PHP_OS, 0, 3) == 'WIN') {
+    die('skip Not valid for windows');
+}
+?>
+--FILE--
+<?php
+var_dump(bcpowmod(1, "A", 128, -200));
+var_dump(bcpowmod(1, 1.2, 1, 1));
+?>
+--EXPECTF--
+string(1) "1"
+bc math warning: non-zero scale in exponent
+string(3) "0.0"

ext/curl/interface.c

@@ -831,6 +831,9 @@ PHP_MINIT_FUNCTION(curl)
 	REGISTER_CURL_CONSTANT(CURLM_INTERNAL_ERROR);
 	REGISTER_CURL_CONSTANT(CURLM_OK);
 	REGISTER_CURL_CONSTANT(CURLM_OUT_OF_MEMORY);
+#if LIBCURL_VERSION_NUM >= 0x072001 /* Available since 7.32.1 */
+	REGISTER_CURL_CONSTANT(CURLM_ADDED_ALREADY);
+#endif
 
 	/* Curl proxy constants */
 	REGISTER_CURL_CONSTANT(CURLPROXY_HTTP);
@@ -2220,7 +2223,6 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue TSRMLS_DC)
 		case CURLOPT_CERTINFO:
 #endif
 #if LIBCURL_VERSION_NUM >= 0x071304 /* Available since 7.19.4 */
-		case CURLOPT_NOPROXY:
 		case CURLOPT_PROTOCOLS:
 		case CURLOPT_REDIR_PROTOCOLS:
 		case CURLOPT_SOCKS5_GSSAPI_NEC:
@@ -2302,6 +2304,7 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue TSRMLS_DC)
 		case CURLOPT_USERNAME:
 #endif
 #if LIBCURL_VERSION_NUM >= 0x071304 /* Available since 7.19.4 */
+		case CURLOPT_NOPROXY:
 		case CURLOPT_SOCKS5_GSSAPI_SERVICE:
 #endif
 #if LIBCURL_VERSION_NUM >= 0x071400 /* Available since 7.20.0 */

ext/date/php_date.c

@@ -4309,7 +4309,7 @@ static char *date_interval_format(char *format, int format_len, timelib_rel_time
 	char                 buffer[33];
 
 	if (!format_len) {
-		return estrdup("");
+		return STR_EMPTY_ALLOC();
 	}
 
 	for (i = 0; i < format_len; i++) {
@@ -4359,6 +4359,10 @@ static char *date_interval_format(char *format, int format_len, timelib_rel_time
 
 	smart_str_0(&string);
 
+	if (string.c == NULL) {
+		return STR_EMPTY_ALLOC();
+	}
+
 	return string.c;
 }
 /* }}} */
@@ -4536,6 +4540,10 @@ PHP_METHOD(DatePeriod, getEndDate)
 
         dpobj = (php_period_obj *)zend_object_store_get_object(getThis() TSRMLS_CC);
 
+        if (!dpobj->end) {
+                return;
+        }
+
         php_date_instantiate(dpobj->start_ce, return_value TSRMLS_CC);
         dateobj = (php_date_obj *)zend_object_store_get_object(return_value TSRMLS_CC);
         dateobj->time = timelib_time_ctor();

ext/date/tests/bug71635.phpt

@@ -0,0 +1,11 @@
+--TEST--
+Bug #71635 (segfault in DatePeriod::getEndDate() when no end date has been set)
+--FILE--
+<?php
+date_default_timezone_set('UTC');
+$period = new DatePeriod(new DateTimeImmutable("now"), new DateInterval("P2Y4DT6H8M"), 2);
+
+var_dump($period->getEndDate());
+?>
+--EXPECT--
+NULL

ext/date/tests/bug71889.phpt

@@ -0,0 +1,11 @@
+--TEST--
+Bug #71889 (DateInterval::format segfault on '%' input)
+--INI--
+date.timezone=US/Eastern
+--FILE--
+<?php
+$di = new DateInterval('P1D');
+var_dump($di->format("%"));
+?>
+--EXPECT--
+string(0) ""

ext/exif/exif.c

@@ -2955,7 +2955,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 						/* When there are any characters after the first NUL */
 						ImageInfo->CopyrightPhotographer  = estrdup(value_ptr);
 						ImageInfo->CopyrightEditor        = estrndup(value_ptr+length+1, byte_count-length-1);
-						spprintf(&ImageInfo->Copyright, 0, "%s, %s", value_ptr, value_ptr+length+1);
+						spprintf(&ImageInfo->Copyright, 0, "%s, %s", ImageInfo->CopyrightPhotographer, ImageInfo->CopyrightEditor);
 						/* format = TAG_FMT_UNDEFINED; this musn't be ASCII         */
 						/* but we are not supposed to change this                   */
 						/* keep in mind that image_info does not store editor value */
@@ -3124,6 +3124,11 @@ static int exif_process_IFD_in_JPEG(image_info_type *ImageInfo, char *dir_start,
 
 	ImageInfo->sections_found |= FOUND_IFD0;
 
+	if ((dir_start + 2) >= (offset_base+IFDlength)) {
+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size");
+		return FALSE;
+	}
+
 	NumDirEntries = php_ifd_get16u(dir_start, ImageInfo->motorola_intel);
 
 	if ((dir_start+2+NumDirEntries*12) > (offset_base+IFDlength)) {
@@ -3147,6 +3152,10 @@ static int exif_process_IFD_in_JPEG(image_info_type *ImageInfo, char *dir_start,
 	 * Hack to make it process IDF1 I hope
 	 * There are 2 IDFs, the second one holds the keys (0x0201 and 0x0202) to the thumbnail
 	 */
+	if ((dir_start+2+12*de + 4) >= (offset_base+IFDlength)) {
+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size");
+		return FALSE;
+	}
 	NextDirOffset = php_ifd_get32u(dir_start+2+12*de, ImageInfo->motorola_intel);
 	if (NextDirOffset) {
 		/* the next line seems false but here IFDlength means length of all IFDs */
@@ -3196,9 +3205,13 @@ static void exif_process_TIFF_in_JPEG(image_info_type *ImageInfo, char *CharBuf,
 	}
 
 	/* Check the next two values for correctness. */
+	if (length < 8) {
+		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid TIFF start (1)");
+		return;
+	}
 	exif_value_2a = php_ifd_get16u(CharBuf+2, ImageInfo->motorola_intel);
 	offset_of_ifd = php_ifd_get32u(CharBuf+4, ImageInfo->motorola_intel);
-	if ( exif_value_2a != 0x2a || offset_of_ifd < 0x08) {
+	if (exif_value_2a != 0x2a || offset_of_ifd < 0x08) {
 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid TIFF start (1)");
 		return;
 	}

ext/exif/tests/bug72094.phpt

@@ -0,0 +1,61 @@
+--TEST--
+Bug #72094: Out of bounds heap read access in exif header processing
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+print_r(exif_read_data(__DIR__ . '/bug72094_1.jpg'));
+print_r(exif_read_data(__DIR__ . '/bug72094_2.jpg'));
+print_r(exif_read_data(__DIR__ . '/bug72094_3.jpg'));
+print_r(exif_read_data(__DIR__ . '/bug72094_4.jpg'));
+?>
+DONE
+--EXPECTF--
+Warning: exif_read_data(bug72094_1.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_1.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_1.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_1.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_1.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_1.jpg): Process tag(x8298=Copyright  ): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_1.jpg): Illegal IFD offset in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_1.jpg): File structure corrupted in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_1.jpg): Invalid JPEG file in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_2.jpg): Illegal IFD size in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_2.jpg): File structure corrupted in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_2.jpg): Invalid JPEG file in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_3.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_3.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_3.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_3.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_3.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_3.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_3.jpg): Illegal IFD size in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_3.jpg): File structure corrupted in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_3.jpg): Invalid JPEG file in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_4.jpg): Invalid TIFF start (1) in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_4.jpg): File structure corrupted in %s%ebug72094.php on line %d
+
+Warning: exif_read_data(bug72094_4.jpg): Invalid JPEG file in %s%ebug72094.php on line %d
+DONE

ext/fileinfo/libmagic/funcs.c

@@ -414,7 +414,7 @@ file_check_mem(struct magic_set *ms, unsigned int level)
 	size_t len;
 
 	if (level >= ms->c.len) {
-		len = (ms->c.len += 20) * sizeof(*ms->c.li);
+		len = (ms->c.len = 20 + level) * sizeof(*ms->c.li);
 		ms->c.li = CAST(struct level_info *, (ms->c.li == NULL) ?
 		    emalloc(len) :
 		    erealloc(ms->c.li, len));

ext/fileinfo/tests/bug68819_002.phpt

@@ -12,7 +12,7 @@ $string .= "\r\n";
 $string .= "''''";
 
 // Total string length > 8192
-$string .= str_repeat(chr(rand(32, 127)), 8184);
+$string .= str_repeat("a", 8184);
 
 // Ending in this string
 $string .= "say";

ext/fileinfo/tests/bug68996.phpt

@@ -19,4 +19,4 @@ finfo_open(FILEINFO_MIME_TYPE, "\xfc\x63");
 <br />
 <b>Warning</b>:  : failed to open stream: No such file or directory in <b>%sbug68996.php</b> on line <b>%d</b><br />
 <br />
-<b>Warning</b>:  finfo_open():  in <b>%sbug68996.php</b> on line <b>%d</b><br />
+<b>Warning</b>:  finfo_open(): Failed to load magic database at '%s�c'. in <b>%sbug68996.php</b> on line <b>%d</b><br />

ext/fileinfo/tests/bug71527.magic

@@ -0,0 +1 @@
+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

ext/fileinfo/tests/bug71527.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Bug #71527 Buffer over-write in finfo_open with malformed magic file
+--SKIPIF--
+<?php
+if (!class_exists('finfo'))
+	die('skip no fileinfo extension');
+--ENV--
+USE_ZEND_ALLOC=0
+--FILE--
+<?php
+	$finfo = finfo_open(FILEINFO_NONE, dirname(__FILE__) . DIRECTORY_SEPARATOR . "bug71527.magic");
+	$info = finfo_file($finfo, __FILE__);
+	var_dump($info);
+?>
+--EXPECTF--
+Warning: finfo_open(): Failed to load magic database at '%sbug71527.magic'. in %sbug71527.php on line %d
+
+Warning: finfo_file() expects parameter 1 to be resource, boolean given in %sbug71527.php on line %d
+bool(false)

ext/gd/gd.c

@@ -5362,8 +5362,15 @@ PHP_FUNCTION(imageaffinematrixget)
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Number is expected as option");
 				RETURN_FALSE;
 			}
-			convert_to_double_ex(&options);
-			angle = Z_DVAL_P(options);
+			if(Z_TYPE_P(options) != IS_DOUBLE) {
+				zval dval;
+				dval = *options;
+				zval_copy_ctor(&dval);
+				convert_to_double(&dval);
+				angle = Z_DVAL(dval);
+			} else {
+				angle = Z_DVAL_P(options);
+			}
 
 			if (type == GD_AFFINE_SHEAR_HORIZONTAL) {
 				res = gdAffineShearHorizontal(affine, angle);

ext/gd/libgd/gd_gd2.c

@@ -145,9 +145,15 @@ static int _gd2GetHeader(gdIOCtxPtr in, int *sx, int *sy, int *cs, int *vers, in
 		cidx = gdCalloc(sidx, 1);
 		for (i = 0; i < nc; i++) {
 			if (gdGetInt(&cidx[i].offset, in) != 1) {
+				gdFree(cidx);
 				goto fail1;
 			}
 			if (gdGetInt(&cidx[i].size, in) != 1) {
+				gdFree(cidx);
+				goto fail1;
+			}
+			if (cidx[i].offset < 0 || cidx[i].size < 0) {
+				gdFree(cidx);
 				goto fail1;
 			}
 		}

ext/gd/tests/bug71912.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug #71912 (libgd: signedness vulnerability)
+--SKIPIF--
+<?php
+        if(!extension_loaded('gd')){ die('skip gd extension not available'); }
+        if(!function_exists('imagecreatefromgd2')) die('skip imagecreatefromgd2() not available');
+?>
+--FILE--
+<?php
+imagecreatefromgd2(__DIR__ . DIRECTORY_SEPARATOR . "invalid_neg_size.gd2");
+?>
+OK
+--EXPECTF--
+
+Warning: imagecreatefromgd2(): '%s%einvalid_neg_size.gd2' is not a valid GD2 file in %s%ebug71912.php on line %d
+OK

ext/gd/tests/bug71952.phpt

@@ -0,0 +1,14 @@
+--TEST--
+Bug #71952 (Corruption inside imageaffinematrixget)
+--SKIPIF--
+<?php
+	if(!extension_loaded('gd')){ die('skip gd extension not available'); }
+?>
+--FILE--
+<?php
+$vals=[str_repeat("A","200"),0,1,2,3,4,5,6,7,8,9];
+imageaffinematrixget(4,$vals[0]);
+var_dump($vals[0]);
+?>
+--EXPECTF--
+string(200) "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"

ext/gmp/tests/serialize.phpt

@@ -18,7 +18,7 @@ try {
 } catch (Exception $e) { var_dump($e->getMessage()); }
 
 try {
-    unserialize('C:3:"GMP":8:{s:2:"42"}');
+    unserialize('C:3:"GMP":8:{s:2:"42";}');
 } catch (Exception $e) { var_dump($e->getMessage()); }
 
 ?>

ext/intl/grapheme/grapheme_string.c

@@ -112,7 +112,7 @@ PHP_FUNCTION(grapheme_strpos)
 	int haystack_len, needle_len;
 	unsigned char *found;
 	long loffset = 0;
-	int32_t offset = 0;
+	int32_t offset = 0, noffset = 0;
 	int ret_pos;
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ss|l", (char **)&haystack, &haystack_len, (char **)&needle, &needle_len, &loffset) == FAILURE) {
@@ -132,6 +132,7 @@ PHP_FUNCTION(grapheme_strpos)
 
 	/* we checked that it will fit: */
 	offset = (int32_t) loffset;
+	noffset = offset >= 0 ? offset : haystack_len + offset;
 
 	/* the offset is 'grapheme count offset' so it still might be invalid - we'll check it later */
 
@@ -146,7 +147,7 @@ PHP_FUNCTION(grapheme_strpos)
 	/* quick check to see if the string might be there
 	 * I realize that 'offset' is 'grapheme count offset' but will work in spite of that
 	*/
-	found = (unsigned char *)php_memnstr((char *)haystack + offset, (char *)needle, needle_len, (char *)haystack + haystack_len);
+	found = (unsigned char *)php_memnstr((char *)haystack + noffset, (char *)needle, needle_len, (char *)haystack + haystack_len);
 
 	/* if it isn't there the we are done */
 	if (!found) {
@@ -214,12 +215,13 @@ PHP_FUNCTION(grapheme_stripos)
 	is_ascii = ( grapheme_ascii_check(haystack, haystack_len) >= 0 );
 
 	if ( is_ascii ) {
+		int32_t noffset = offset >= 0 ? offset : haystack_len + offset;
 		needle_dup = (unsigned char *)estrndup((char *)needle, needle_len);
 		php_strtolower((char *)needle_dup, needle_len);
 		haystack_dup = (unsigned char *)estrndup((char *)haystack, haystack_len);
 		php_strtolower((char *)haystack_dup, haystack_len);
 
-		found = (unsigned char*) php_memnstr((char *)haystack_dup + offset, (char *)needle_dup, needle_len, (char *)haystack_dup + haystack_len);
+		found = (unsigned char*) php_memnstr((char *)haystack_dup + noffset, (char *)needle_dup, needle_len, (char *)haystack_dup + haystack_len);
 
 		efree(haystack_dup);
 		efree(needle_dup);
@@ -537,7 +539,7 @@ PHP_FUNCTION(grapheme_substr)
 			efree(ustr);
 		}
 		ubrk_close(bi);
-		RETURN_EMPTY_STRING();		
+		RETURN_EMPTY_STRING();
 	}
 
 	/* find the end point of the string to return */
@@ -576,7 +578,7 @@ PHP_FUNCTION(grapheme_substr)
 			sub_str_end_pos = ustr_len;
 		}
 	}
-	
+
 	if(sub_str_start_pos > sub_str_end_pos) {
 		intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR, "grapheme_substr: length is beyond start", 1 TSRMLS_CC );
 

ext/intl/tests/bug72061.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Bug #72061: Out-of-bounds reads in zif_grapheme_stripos with negative offset
+--SKIPIF--
+<?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?>
+--FILE--
+<?php
+
+var_dump(grapheme_stripos(str_repeat("ABCD", 16384), "A", -201));
+var_dump(grapheme_strpos(str_repeat("ABCD", 16384), "A", -201));
+?>
+DONE
+--EXPECT--
+int(65336)
+int(65336)
+DONE

ext/mbstring/libmbfl/mbfl/mbfilter.c

@@ -72,7 +72,7 @@
  *
  */
 
-/* 
+/*
  * Unicode support
  *
  * Portions copyright (c) 1999,2000,2001 by the PHP3 internationalization team.
@@ -137,7 +137,7 @@ mbfl_buffer_converter_new(
 mbfl_buffer_converter *
 mbfl_buffer_converter_new2(
 	const mbfl_encoding *from,
-	const mbfl_encoding *to, 
+	const mbfl_encoding *to,
     int buf_initsz)
 {
 	mbfl_buffer_converter *convd;
@@ -339,7 +339,7 @@ mbfl_buffer_converter_result(mbfl_buffer_converter *convd, mbfl_string *result)
 }
 
 mbfl_string *
-mbfl_buffer_converter_feed_result(mbfl_buffer_converter *convd, mbfl_string *string, 
+mbfl_buffer_converter_feed_result(mbfl_buffer_converter *convd, mbfl_string *string,
 				  mbfl_string *result)
 {
 	if (convd == NULL || string == NULL || result == NULL) {
@@ -535,7 +535,7 @@ const mbfl_encoding *mbfl_encoding_detector_judge2(mbfl_encoding_detector *ident
 			}
 			n--;
 		}
- 
+
 		/* fallback judge */
 		if (!encoding) {
 			n = identd->filter_list_size - 1;
@@ -702,7 +702,7 @@ mbfl_identify_encoding(mbfl_string *string, enum mbfl_no_encoding *elist, int el
 			}
 		}
 	}
- 
+
 	/* cleanup */
 	/* dtors should be called in reverse order */
 	i = num; while (--i >= 0) {
@@ -785,7 +785,7 @@ mbfl_identify_encoding2(mbfl_string *string, const mbfl_encoding **elist, int el
 			}
 		}
 	}
- 
+
 	/* cleanup */
 	/* dtors should be called in reverse order */
 	i = num; while (--i >= 0) {
@@ -844,7 +844,7 @@ mbfl_strlen(mbfl_string *string)
 	} else {
 		/* wchar filter */
 		mbfl_convert_filter *filter = mbfl_convert_filter_new(
-		  string->no_encoding, 
+		  string->no_encoding,
 		  mbfl_no_encoding_wchar,
 		  filter_count_output, 0, &len);
 		if (filter == NULL) {
@@ -865,7 +865,7 @@ mbfl_strlen(mbfl_string *string)
 	return len;
 }
 
- 
+
 /*
  *  strpos
  */
@@ -931,7 +931,7 @@ retry:
 /*
  *	oddlen
  */
-int 
+int
 mbfl_oddlen(mbfl_string *string)
 {
 	int len, n, m, k;
@@ -1071,7 +1071,7 @@ mbfl_strpos(
 							++result;
 						} else if ((c & 0xc0) != 0x80) {
 							++result;
-						}	
+						}
 					}
 					goto out;
 				}
@@ -1116,7 +1116,7 @@ mbfl_strpos(
 		qe = needle_u8_val + needle_u8_len;
 		if (offset < 0) {
 			if (-offset > needle_len) {
-				offset += needle_len; 
+				offset += needle_len;
 				while (offset < 0) {
 					unsigned char c;
 					if (p <= e) {
@@ -1158,7 +1158,7 @@ mbfl_strpos(
 							++result;
 						} else if ((c & 0xc0) != 0x80) {
 							++result;
-						}	
+						}
 					}
 					goto out;
 				}
@@ -1501,7 +1501,7 @@ mbfl_strcut(
 		if (encoding->flag & (MBFL_ENCTYPE_WCS2BE | MBFL_ENCTYPE_WCS2LE)) {
 			from &= -2;
 
-			if (from + length >= string->len) {
+			if (length >= string->len - from) {
 				length = string->len - from;
 			}
 
@@ -1510,14 +1510,14 @@ mbfl_strcut(
 		} else if (encoding->flag & (MBFL_ENCTYPE_WCS4BE | MBFL_ENCTYPE_WCS4LE)) {
 			from &= -4;
 
-			if (from + length >= string->len) {
+			if (length >= string->len - from) {
 				length = string->len - from;
 			}
 
 			start = string->val + from;
 			end   = start + (length & -4);
 		} else if ((encoding->flag & MBFL_ENCTYPE_SBCS)) {
-			if (from + length >= string->len) {
+			if (length >= string->len - from) {
 				length = string->len - from;
 			}
 
@@ -1539,7 +1539,7 @@ mbfl_strcut(
 			start = p;
 
 			/* search end position */
-			if ((start - string->val) + length >= (int)string->len) {
+			if (length >= (int)string->len - (start - string->val)) {
 				end = string->val + string->len;
 			} else {
 				for (q = p + length; p < q; p += (m = mbtab[*p]));
@@ -2024,7 +2024,7 @@ mbfl_ja_jp_hantozen(
 		mbfl_no_encoding_wchar,
 		(int(*)(int, void*))next_filter->filter_function,
 		(int(*)(void*))next_filter->filter_flush,
-		next_filter);	
+		next_filter);
 	if (encoder == NULL) {
 		goto out;
 	}

ext/mysqli/mysqli.c

@@ -1295,9 +1295,13 @@ void php_mysqli_fetch_into_hash(INTERNAL_FUNCTION_PARAMETERS, int override_flags
 		zend_fcall_info fci;
 		zend_fcall_info_cache fcc;
 		zval *retval_ptr;
+		zend_bool props_merged = 0;
 
 		object_and_properties_init(return_value, ce, NULL);
-		zend_merge_properties(return_value, Z_ARRVAL(dataset), 1 TSRMLS_CC);
+		if (!ce->__set) {
+			props_merged = 1;
+			zend_merge_properties(return_value, Z_ARRVAL(dataset), 1 TSRMLS_CC);
+		}
 
 		if (ce->constructor) {
 			fci.size = sizeof(fci);
@@ -1331,6 +1335,10 @@ void php_mysqli_fetch_into_hash(INTERNAL_FUNCTION_PARAMETERS, int override_flags
 
 			if (zend_call_function(&fci, &fcc TSRMLS_CC) == FAILURE) {
 				zend_throw_exception_ex(zend_exception_get_default(TSRMLS_C), 0 TSRMLS_CC, "Could not execute %s::%s()", ce->name, ce->constructor->common.function_name);
+				if (fci.params) {
+					efree(fci.params);
+				}
+				return;
 			} else {
 				if (retval_ptr) {
 					zval_ptr_dtor(&retval_ptr);
@@ -1341,6 +1349,11 @@ void php_mysqli_fetch_into_hash(INTERNAL_FUNCTION_PARAMETERS, int override_flags
 			}
 		} else if (ctor_params) {
 			zend_throw_exception_ex(zend_exception_get_default(TSRMLS_C), 0 TSRMLS_CC, "Class %s does not have a constructor hence you cannot use ctor_params", ce->name);
+			return;
+		}
+
+		if (!props_merged) {
+			zend_merge_properties(return_value, Z_ARRVAL(dataset), 1 TSRMLS_CC);
 		}
 	}
 }

ext/mysqli/tests/bug71820.phpt

@@ -0,0 +1,104 @@
+--TEST--
+Bug #71820 __set has to be called after constructor, mysqli part
+--SKIPIF--
+<?php
+require_once('skipif.inc');
+require_once('skipifconnectfailure.inc');
+require_once("connect.inc");
+?>
+--FILE--
+<?php
+
+include "connect.inc";
+
+$tableName = 'test_mysqli_fetch_object';
+
+class TestRow
+{
+
+	private $set_from_constructor;
+	private $data;
+	private $hello = "world";
+
+	public function __construct($set_from_constructor)
+	{
+		$this->set_from_constructor = $set_from_constructor;
+	}
+
+	public function __set($name, $value)
+	{
+		if (!isset($this->data[$name])) {
+			/* $this->set_from_constructor has an expected value */
+			$this->data[$name] = 42 == $this->set_from_constructor ? $value : -1;
+			return;
+		}
+		throw new \Exception('Duplicity column name.');
+	}
+
+}
+
+
+if (!($connection = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))) {
+	printf("[001] Cannot connect to the server");
+}
+	
+$rc = mysqli_query($connection, "DROP TABLE IF EXISTS $tableName");
+if (!$rc)
+	printf("[002] [%d] %s\n", mysqli_errno($connection), mysqli_error($connection));
+
+$table = <<<SQL
+CREATE TABLE $tableName (
+  id int NOT NULL auto_increment primary key,
+  name varchar(255) NOT NULL
+);
+SQL;
+
+$rc = mysqli_query($connection, $table);
+if (!$rc)
+	printf("[003] [%d] %s\n", mysqli_errno($connection), mysqli_error($connection));
+
+$rc = mysqli_query($connection, "INSERT INTO " . $tableName . " (name) VALUES ('Doe'), ('Joe')");
+if (!$rc)
+	printf("[004] [%d] %s\n", mysqli_errno($connection), mysqli_error($connection));
+
+$result = mysqli_query($connection, 'SELECT * FROM ' . $tableName . ' LIMIT 10');
+if (!$result)
+	printf("[005] [%d] %s\n", mysqli_errno($result), mysqli_error($result));
+
+
+while ($row = mysqli_fetch_object($result, 'TestRow', [42])) {
+	var_dump($row);
+}
+
+mysqli_close($connection);
+
+?>
+==DONE==
+--EXPECTF--
+object(TestRow)#%d (3) {
+  ["set_from_constructor":"TestRow":private]=>
+  int(42)
+  ["data":"TestRow":private]=>
+  array(2) {
+    ["id"]=>
+    string(1) "1"
+    ["name"]=>
+    string(3) "Doe"
+  }
+  ["hello":"TestRow":private]=>
+  string(5) "world"
+}
+object(TestRow)#%d (3) {
+  ["set_from_constructor":"TestRow":private]=>
+  int(42)
+  ["data":"TestRow":private]=>
+  array(2) {
+    ["id"]=>
+    string(1) "2"
+    ["name"]=>
+    string(3) "Joe"
+  }
+  ["hello":"TestRow":private]=>
+  string(5) "world"
+}
+==DONE==

ext/oci8/oci8_dtrace.d

@@ -4,11 +4,11 @@
    +----------------------------------------------------------------------+
    | Copyright (c) 2013 Zend Technologies Ltd. (http://www.zend.com)      |
    +----------------------------------------------------------------------+
-   | This source file is subject to version 3.01 of the Zend license,     |
+   | This source file is subject to version 3.01 of the PHP license,      |
    | that is bundled with this package in the file LICENSE, and is        |
    | available through the world-wide-web at the following url:           |
-   | http://www.zend.com/license/3_01.txt.                                |
-   | If you did not receive a copy of the Zend license and are unable to  |
+   | http://www.php.net/license/3_01.txt.                                 |
+   | If you did not receive a copy of the PHP license and are unable to   |
    | obtain it through the world-wide-web, please send a note to          |
    | license@zend.com so we can mail you a copy immediately.              |
    +----------------------------------------------------------------------+

ext/oci8/oci8_statement.c

@@ -1145,7 +1145,9 @@ int php_oci_bind_by_name(php_oci_statement *statement, char *name, int name_len,
 				return 1;
 			}
 			convert_to_long(var);
-#if defined(OCI_MAJOR_VERSION) && OCI_MAJOR_VERSION > 10
+
+#if defined(OCI_MAJOR_VERSION) && (OCI_MAJOR_VERSION > 10) && \
+(defined(__x86_64__) || defined(__LP64__) || defined(_LP64) || defined(_WIN64)) 
 			bind_data = (ub8 *)&Z_LVAL_P(var);
 			value_sz = sizeof(ub8);
 #else

ext/oci8/package.xml

@@ -9,7 +9,7 @@ http://pear.php.net/dtd/package-2.0.xsd">
 
  <description>
 Use the OCI8 extension to access Oracle Database. PHP OCI8 2.1 builds
-with PHP 7.  Use 'pecl install oci8-2.0.10' to install OCI8 for PHP
+with PHP 7.  Use 'pecl install oci8-2.0.11' to install OCI8 for PHP
 5.2 - PHP 5.6.  Use 'pecl install oci8-1.4.10' to install PHP OCI8 1.4
 for PHP 4.3.9 - PHP 5.1.  The OCI8 extension can be linked with Oracle
 client libraries from Oracle Database 12.1, 11, or 10.2.  These
@@ -46,12 +46,12 @@ Interoperability Support" (ID 207303.1) for details.
   <active>no</active>
  </lead>
 
- <date>2015-12-12</date>
+ <date>2016-04-15</date>
  <time>12:00:00</time>
 
   <version>
-   <release>2.0.10</release>
-   <api>2.0.10</api>
+   <release>2.0.11</release>
+   <api>2.0.11</api>
   </version>
   <stability>
    <release>stable</release>
@@ -59,7 +59,7 @@ Interoperability Support" (ID 207303.1) for details.
   </stability>
   <license uri="http://www.php.net/license">PHP</license>
   <notes>
-Fixed bug #68298 (OCI int overflow)
+Fixed bug #71422 (Fix ORA-01438: value larger than specified precision allowed for this column)
   </notes>
  <contents>
   <dir name="/">
@@ -159,6 +159,7 @@ Fixed bug #68298 (OCI int overflow)
     <file name="bug51291_1.phpt" role="test" />
     <file name="bug51291_2.phpt" role="test" />
     <file name="bug68298.phpt" role="test" />
+    <file name="bug71422.phpt" role="test" />
     <file name="clientversion.phpt" role="test" />
     <file name="close.phpt" role="test" />
     <file name="coll_001.phpt" role="test" />
@@ -464,6 +465,21 @@ Fixed bug #68298 (OCI int overflow)
  </extsrcrelease>
  <changelog>
 
+<release>
+  <version>
+   <release>2.0.10</release>
+   <api>2.0.10</api>
+  </version>
+  <stability>
+   <release>stable</release>
+   <api>stable</api>
+  </stability>
+  <license uri="http://www.php.net/license">PHP</license>
+  <notes>
+Fixed bug #68298 (OCI int overflow)
+  </notes>
+</release>
+
 <release>
   <version>
    <release>2.0.9</release>

ext/oci8/php_oci8.h

@@ -45,7 +45,7 @@
  */
 #undef PHP_OCI8_VERSION
 #endif
-#define PHP_OCI8_VERSION "2.0.10"
+#define PHP_OCI8_VERSION "2.0.11"
 
 extern zend_module_entry oci8_module_entry;
 #define phpext_oci8_ptr &oci8_module_entry

ext/oci8/tests/bug71422.phpt

@@ -0,0 +1,65 @@
+--TEST--
+Bug #71422 (Fix ORA-01438: value larger than specified precision allowed for this column)
+--SKIPIF--
+<?php
+if (!extension_loaded('oci8')) die ("skip no oci8 extension");
+?>
+--FILE--
+<?php
+
+require(dirname(__FILE__).'/connect.inc');
+
+$stmtarray = array(
+	"DROP TABLE BUG71422_TEST",
+	"CREATE TABLE BUG71422_TEST (TEST_ID NUMBER(*,0) NOT NULL, LABEL VARCHAR2(50 CHAR), CONSTRAINT BUG71422_TEST_PK PRIMARY KEY (TEST_ID))",
+	"INSERT INTO BUG71422_TEST (TEST_ID, LABEL) VALUES (1, 'Foo')"
+);
+
+oci8_test_sql_execute($c, $stmtarray);
+
+$stmt = oci_parse($c, 'SELECT LABEL AS RAW_QUERY FROM BUG71422_TEST WHERE TEST_ID=1');
+oci_execute($stmt);
+while ($row = oci_fetch_array($stmt, OCI_ASSOC+OCI_RETURN_NULLS)) {
+	var_dump($row);
+}
+
+$stmt = oci_parse($c, 'SELECT LABEL AS NUMERIC_BIND_PARAMETER FROM BUG71422_TEST WHERE TEST_ID=:test_id');
+$value = 1;
+oci_bind_by_name($stmt, ':test_id', $value, -1, SQLT_INT);
+oci_execute($stmt);
+while ($row = oci_fetch_array($stmt, OCI_ASSOC+OCI_RETURN_NULLS)) {
+	var_dump($row);
+}
+
+$stmt = oci_parse($c, 'SELECT LABEL AS STRING_BIND_PARAMETER FROM BUG71422_TEST WHERE TEST_ID=:test_id');
+$value = 1;
+oci_bind_by_name($stmt, ':test_id', $value, -1, SQLT_CHR);
+oci_execute($stmt);
+while ($row = oci_fetch_array($stmt, OCI_ASSOC+OCI_RETURN_NULLS)) {
+	var_dump($row);
+}
+
+// Cleanup
+
+$stmtarray = array(
+	"DROP TABLE BUG71422_TEST"
+);
+oci8_test_sql_execute($c, $stmtarray);
+
+?>
+===DONE===
+<?php exit(0); ?>
+--EXPECTF--
+array(1) {
+  ["RAW_QUERY"]=>
+  string(3) "Foo"
+}
+array(1) {
+  ["NUMERIC_BIND_PARAMETER"]=>
+  string(3) "Foo"
+}
+array(1) {
+  ["STRING_BIND_PARAMETER"]=>
+  string(3) "Foo"
+}
+===DONE===

ext/odbc/php_odbc.c

@@ -431,7 +431,8 @@ static void _free_odbc_result(zend_rsrc_list_entry *rsrc TSRMLS_DC)
 			efree(res->values);
 			res->values = NULL;
 		}
-		if (res->stmt) {
+		/* If aborted via timer expiration, don't try to call any unixODBC function */
+		if (res->stmt && !(PG(connection_status) & PHP_CONNECTION_TIMEOUT)) {
 #if defined(HAVE_SOLID) || defined(HAVE_SOLID_30) || defined(HAVE_SOLID_35)
 			SQLTransact(res->conn_ptr->henv, res->conn_ptr->hdbc,
 						(SQLUSMALLINT) SQL_COMMIT);
@@ -442,6 +443,9 @@ static void _free_odbc_result(zend_rsrc_list_entry *rsrc TSRMLS_DC)
 			 * zend_list_delete(res->conn_ptr->id);
 			 */
 		}
+		if (res->param_info) {
+			efree(res->param_info);
+		}
 		efree(res);
 	}
 }
@@ -484,9 +488,12 @@ static void _close_odbc_conn(zend_rsrc_list_entry *rsrc TSRMLS_DC)
 		}
 	}
 
-   	safe_odbc_disconnect(conn->hdbc);
-	SQLFreeConnect(conn->hdbc);
-	SQLFreeEnv(conn->henv);
+	/* If aborted via timer expiration, don't try to call any unixODBC function */
+	if (!(PG(connection_status) & PHP_CONNECTION_TIMEOUT)) {
+		safe_odbc_disconnect(conn->hdbc);
+		SQLFreeConnect(conn->hdbc);
+		SQLFreeEnv(conn->henv);
+	}
 	efree(conn);
 	ODBCG(num_links)--;
 }
@@ -512,9 +519,12 @@ static void _close_odbc_pconn(zend_rsrc_list_entry *rsrc TSRMLS_DC)
 		}
 	}
 	
-	safe_odbc_disconnect(conn->hdbc);
-	SQLFreeConnect(conn->hdbc);
-	SQLFreeEnv(conn->henv);
+	/* If aborted via timer expiration, don't try to call any unixODBC function */
+	if (!(PG(connection_status) & PHP_CONNECTION_TIMEOUT)) {
+		safe_odbc_disconnect(conn->hdbc);
+		SQLFreeConnect(conn->hdbc);
+		SQLFreeEnv(conn->henv);
+	}
 	free(conn);
 
 	ODBCG(num_links)--;
@@ -1183,6 +1193,7 @@ PHP_FUNCTION(odbc_prepare)
 	odbc_result *result = NULL;
 	odbc_connection *conn;
 	RETCODE rc;
+	int i;
 #ifdef HAVE_SQL_EXTENDED_FETCH
 	SQLUINTEGER      scrollopts;
 #endif
@@ -1196,6 +1207,7 @@ PHP_FUNCTION(odbc_prepare)
 	result = (odbc_result *)ecalloc(1, sizeof(odbc_result));
 	
 	result->numparams = 0;
+	result->param_info = NULL;
 	
 	rc = PHP_ODBC_SQLALLOCSTMT(conn->hdbc, &(result->stmt));
 	if (rc == SQL_INVALID_HANDLE) {
@@ -1252,6 +1264,19 @@ PHP_FUNCTION(odbc_prepare)
 	zend_list_addref(conn->id);
 	result->conn_ptr = conn;
 	result->fetched = 0;
+
+	result->param_info = (odbc_param_info *) safe_emalloc(sizeof(odbc_param_info), result->numparams, 0);
+	for (i=0;i<result->numparams;i++) {
+		rc = SQLDescribeParam(result->stmt, (SQLUSMALLINT)(i+1), &result->param_info[i].sqltype, &result->param_info[i].precision,
+													&result->param_info[i].scale, &result->param_info[i].nullable);
+		if (rc == SQL_ERROR) {
+			odbc_sql_error(result->conn_ptr, result->stmt, "SQLDescribeParameter");
+			SQLFreeStmt(result->stmt, SQL_RESET_PARAMS);
+			efree(result->param_info);
+			efree(result);
+			RETURN_FALSE;
+		}
+	}
 	ZEND_REGISTER_RESOURCE(return_value, result, le_result);  
 }
 /* }}} */
@@ -1272,9 +1297,7 @@ PHP_FUNCTION(odbc_execute)
 	params_t *params = NULL;
 	char *filename;
 	unsigned char otype;
-   	SQLSMALLINT sqltype, ctype, scale;
-	SQLSMALLINT nullable;
-	SQLULEN precision;
+	SQLSMALLINT ctype;
    	odbc_result *result;
 	int numArgs, i, ne;
 	RETCODE rc;
@@ -1332,22 +1355,10 @@ PHP_FUNCTION(odbc_execute)
 				RETURN_FALSE;
 			}
 			
-			rc = SQLDescribeParam(result->stmt, (SQLUSMALLINT)i, &sqltype, &precision, &scale, &nullable);
 			params[i-1].vallen = Z_STRLEN_PP(tmp);
 			params[i-1].fp = -1;
-			if (rc == SQL_ERROR) {
-				odbc_sql_error(result->conn_ptr, result->stmt, "SQLDescribeParameter");	
-				SQLFreeStmt(result->stmt, SQL_RESET_PARAMS);
-				for (i = 0; i < result->numparams; i++) {
-					if (params[i].fp != -1) {
-						close(params[i].fp);
-					}
-				}
-				efree(params);
-				RETURN_FALSE;
-			}
 
-			if (IS_SQL_BINARY(sqltype)) {
+			if (IS_SQL_BINARY(result->param_info[i-1].sqltype)) {
 				ctype = SQL_C_BINARY;
 			} else {
 				ctype = SQL_C_CHAR;
@@ -1394,7 +1405,7 @@ PHP_FUNCTION(odbc_execute)
 				params[i-1].vallen = SQL_LEN_DATA_AT_EXEC(0);
 
 				rc = SQLBindParameter(result->stmt, (SQLUSMALLINT)i, SQL_PARAM_INPUT,
-									  ctype, sqltype, precision, scale,
+									  ctype, result->param_info[i-1].sqltype, result->param_info[i-1].precision, result->param_info[i-1].scale,
 									  (void *)params[i-1].fp, 0,
 									  &params[i-1].vallen);
 			} else {
@@ -1406,7 +1417,7 @@ PHP_FUNCTION(odbc_execute)
 				}
 
 				rc = SQLBindParameter(result->stmt, (SQLUSMALLINT)i, SQL_PARAM_INPUT,
-									  ctype, sqltype, precision, scale,
+									  ctype, result->param_info[i-1].sqltype, result->param_info[i-1].precision, result->param_info[i-1].scale,
 									  Z_STRVAL_PP(tmp), 0,
 									  &params[i-1].vallen);
 			}

ext/odbc/php_odbc_includes.h

@@ -233,6 +233,13 @@ typedef struct odbc_result_value {
 	SQLLEN coltype;
 } odbc_result_value;
 
+typedef struct odbc_param_info {
+	SQLSMALLINT sqltype;
+	SQLSMALLINT scale;
+	SQLSMALLINT nullable;
+	SQLULEN precision;
+} odbc_param_info;
+
 typedef struct odbc_result {
 	ODBC_SQL_STMT_T stmt;
 	odbc_result_value *values;
@@ -244,6 +251,7 @@ typedef struct odbc_result {
 	long longreadlen;
 	int binmode;
 	int fetched;
+	odbc_param_info * param_info;
 	odbc_connection *conn_ptr;
 } odbc_result;
 

ext/odbc/tests/bug47803.phpt

@@ -0,0 +1,185 @@
+--TEST--
+Bug #47803 Executing prepared statements is succesfull only for the first two statements
+--SKIPIF--
+<?php include 'skipif.inc'; ?>
+--FILE--
+<?php
+
+include dirname(__FILE__) . "/config.inc";
+
+$create_table = "CREATE TABLE FOO(
+		[PAR_ID] [int] NOT NULL,
+		[PAR_INT] [int] NULL,
+		[PAR_CHR] [varchar](500) NULL
+)";
+
+$inserts = "INSERT INTO FOO
+           ([PAR_ID]
+           ,[PAR_INT]
+           ,[PAR_CHR])
+     VALUES
+        (1,14,''),
+		(2,30,''),
+		(3,7,''),
+		(4,7,''),
+		(5,0,''),
+		(6,0,''),
+		(7,20130901,''),
+		(8,20140201,''),
+		(9,20140201,''),
+		(10,20140620,''),
+		(11,221,'')";
+
+
+date_default_timezone_set('Europe/Warsaw');
+
+$link = odbc_connect($dsn, $user, $pass);
+
+odbc_exec($link, 'CREATE DATABASE odbcTEST');
+odbc_exec($link, $create_table);
+odbc_exec($link, $inserts);
+
+$upd_params = array(
+	array('id'=>1, 'name'=>'test 1'),
+	array('id'=>2, 'name'=>'test 2'),
+	array('id'=>3, 'name'=>'test 3'),
+	array('id'=>4, 'name'=>'test 4'),
+	array('id'=>5, 'name'=>'test 5'),
+	array('id'=>10, 'name'=>'test 10'),
+	array('id'=>9, 'name'=>'test 9'),
+	array('id'=>8, 'name'=>'test 8'),
+	array('id'=>7, 'name'=>'test 7'),
+	array('id'=>6, 'name'=>'test 6'),
+);
+$sql = "UPDATE FOO
+     SET [PAR_CHR] = ?
+     WHERE [PAR_ID] = ?";
+$result = odbc_prepare($link, $sql);
+if (!$result) {
+	print ('[sql] prep: '.$sql);
+	goto out;
+}
+foreach ($upd_params as &$k) {
+	if(!odbc_execute($result, array($k['name'], $k['id']))) {
+		print ('[sql] exec: '."array({$k['name']}, {$k['id']})");
+		goto out;
+	}
+}
+odbc_free_result($result);
+
+$sql = "SELECT * FROM FOO WHERE [PAR_ID] = ?";
+$result = odbc_prepare($link, $sql);
+if (!$result) {
+	print ('[sql] prep: '.$sql);
+	goto out;
+}
+foreach ($upd_params as $k) { 
+	if(!odbc_execute($result, array($k['id']))) {
+		print ('[sql] exec: '."array({$k['id']})");
+		goto out;
+	}
+	while (($r = odbc_fetch_array($result)) !== false) {
+		var_dump($r);
+	}
+}
+
+out:
+if ($result) odbc_free_result($result);
+odbc_close($link);
+
+?>
+==DONE==
+--EXPECT--
+array(3) {
+  ["PAR_ID"]=>
+  string(1) "1"
+  ["PAR_INT"]=>
+  string(2) "14"
+  ["PAR_CHR"]=>
+  string(6) "test 1"
+}
+array(3) {
+  ["PAR_ID"]=>
+  string(1) "2"
+  ["PAR_INT"]=>
+  string(2) "30"
+  ["PAR_CHR"]=>
+  string(6) "test 2"
+}
+array(3) {
+  ["PAR_ID"]=>
+  string(1) "3"
+  ["PAR_INT"]=>
+  string(1) "7"
+  ["PAR_CHR"]=>
+  string(6) "test 3"
+}
+array(3) {
+  ["PAR_ID"]=>
+  string(1) "4"
+  ["PAR_INT"]=>
+  string(1) "7"
+  ["PAR_CHR"]=>
+  string(6) "test 4"
+}
+array(3) {
+  ["PAR_ID"]=>
+  string(1) "5"
+  ["PAR_INT"]=>
+  string(1) "0"
+  ["PAR_CHR"]=>
+  string(6) "test 5"
+}
+array(3) {
+  ["PAR_ID"]=>
+  string(2) "10"
+  ["PAR_INT"]=>
+  string(8) "20140620"
+  ["PAR_CHR"]=>
+  string(7) "test 10"
+}
+array(3) {
+  ["PAR_ID"]=>
+  string(1) "9"
+  ["PAR_INT"]=>
+  string(8) "20140201"
+  ["PAR_CHR"]=>
+  string(6) "test 9"
+}
+array(3) {
+  ["PAR_ID"]=>
+  string(1) "8"
+  ["PAR_INT"]=>
+  string(8) "20140201"
+  ["PAR_CHR"]=>
+  string(6) "test 8"
+}
+array(3) {
+  ["PAR_ID"]=>
+  string(1) "7"
+  ["PAR_INT"]=>
+  string(8) "20130901"
+  ["PAR_CHR"]=>
+  string(6) "test 7"
+}
+array(3) {
+  ["PAR_ID"]=>
+  string(1) "7"
+  ["PAR_INT"]=>
+  string(8) "20130901"
+  ["PAR_CHR"]=>
+  string(6) "test 7"
+}
+==DONE==
+--CLEAN--
+<?php
+include 'config.inc';
+
+$conn = odbc_connect($dsn, $user, $pass);
+
+odbc_exec($conn, 'DROP TABLE FOO');
+odbc_exec($conn, 'DROP DATABASE odbcTEST');
+
+odbc_close($conn);
+
+?>

ext/odbc/tests/config.inc

@@ -3,6 +3,17 @@
 putenv('ODBCINI=/etc/odbc.ini');
 putenv('ODBCSYSINI=/etc');
 
-$dsn = 'myodbc3';
-$user = 'root';
-$pass = '';
+$dsn  = getenv("ODBC_TEST_DSN");
+$user = getenv("ODBC_TEST_USER");
+$pass = getenv("ODBC_TEST_PASS");
+
+if (false === $dsn) {
+	$dsn = 'myodbc3';
+}
+if (false === $user) {
+	$user = 'root';
+}
+if (false == $pass) {
+	$pass = '';
+}
+

ext/opcache/Optimizer/block_pass.c

@@ -716,8 +716,11 @@ static void zend_optimize_block(zend_code_block *block, zend_op_array *op_array,
 			if (src->opcode == ZEND_BOOL) {
 				if (ZEND_OP1_TYPE(src) == IS_CONST) {
 					literal_dtor(&ZEND_OP1_LITERAL(src));
+				} else if (ZEND_OP1_TYPE(src) == IS_TMP_VAR) {
+					src->opcode = ZEND_FREE;
+				} else {
+					MAKE_NOP(src);
 				}
-				MAKE_NOP(src);
 				MAKE_NOP(opline);
 			}
 		}

ext/opcache/config.m4

@@ -359,7 +359,7 @@ AC_TRY_RUN([
     AC_MSG_RESULT("yes")
 ], AC_MSG_RESULT("no") )
 
-if test "$flock_type" == "unknown"; then
+if test "$flock_type" = "unknown"; then
 	AC_MSG_ERROR([Don't know how to define struct flock on this system[,] set --enable-opcache=no])
 fi
 

ext/opcache/tests/bug71843.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Bug #71843 (null ptr deref ZEND_RETURN_SPEC_CONST_HANDLER (zend_vm_execute.h:3479))
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.optimization_level=0xFFFFBFFF
+--SKIPIF--
+<?php if (!extension_loaded('Zend OPcache')) die("skip"); ?>
+--FILE--
+<?
+0 & ~E & ~R;
+6 && ~See
+?>
+okey
+--EXPECTF--
+Notice: Use of undefined constant E - assumed 'E' in %sbug71843.php on line %d
+
+Notice: Use of undefined constant R - assumed 'R' in %sbug71843.php on line %d
+
+Notice: Use of undefined constant See - assumed 'See' in %sbug71843.php on line %d
+okey

ext/pdo/pdo_dbh.c

@@ -1348,18 +1348,12 @@ int pdo_hash_methods(pdo_dbh_t *dbh, int kind TSRMLS_DC)
 }
 
 static union _zend_function *dbh_method_get(
-#if PHP_API_VERSION >= 20041225
 	zval **object_pp,
-#else
-	zval *object,
-#endif
 	char *method_name, int method_len, const zend_literal *key TSRMLS_DC)
 {
 	zend_function *fbc = NULL;
 	char *lc_method_name;
-#if PHP_API_VERSION >= 20041225
 	zval *object = *object_pp;
-#endif
 	pdo_dbh_t *dbh = zend_object_store_get_object(object TSRMLS_CC);
 
 	lc_method_name = emalloc(method_len + 1);

ext/pdo/pdo_sql_parser.c

@@ -54,7 +54,6 @@ static int scan(Scanner *s)
 #line 55 "ext/pdo/pdo_sql_parser.c"
 {
 	YYCTYPE yych;
-	unsigned int yyaccept = 0;
 
 	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
 	yych = *YYCURSOR;
@@ -62,31 +61,32 @@ static int scan(Scanner *s)
 	case 0x00:	goto yy2;
 	case '"':	goto yy3;
 	case '\'':	goto yy5;
-	case '-':	goto yy11;
-	case '/':	goto yy9;
+	case '(':
+	case ')':
+	case '*':
+	case '+':
+	case ',':
+	case '.':	goto yy9;
+	case '-':	goto yy10;
+	case '/':	goto yy11;
 	case ':':	goto yy6;
 	case '?':	goto yy7;
 	default:	goto yy12;
 	}
 yy2:
 	YYCURSOR = YYMARKER;
-	switch (yyaccept) {
-	case 0: 	goto yy4;
-	case 1: 	goto yy10;
-	}
+	goto yy4;
 yy3:
-	yyaccept = 0;
 	yych = *(YYMARKER = ++YYCURSOR);
-	if (yych >= 0x01) goto yy43;
+	if (yych >= 0x01) goto yy37;
 yy4:
 #line 63 "ext/pdo/pdo_sql_parser.re"
 	{ SKIP_ONE(PDO_PARSER_TEXT); }
-#line 85 "ext/pdo/pdo_sql_parser.c"
+#line 86 "ext/pdo/pdo_sql_parser.c"
 yy5:
-	yyaccept = 0;
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych <= 0x00) goto yy4;
-	goto yy38;
+	goto yy32;
 yy6:
 	yych = *++YYCURSOR;
 	switch (yych) {
@@ -152,14 +152,14 @@ yy6:
 	case 'w':
 	case 'x':
 	case 'y':
-	case 'z':	goto yy32;
-	case ':':	goto yy35;
+	case 'z':	goto yy26;
+	case ':':	goto yy29;
 	default:	goto yy4;
 	}
 yy7:
 	++YYCURSOR;
 	switch ((yych = *YYCURSOR)) {
-	case '?':	goto yy29;
+	case '?':	goto yy23;
 	default:	goto yy8;
 	}
 yy8:
@@ -167,133 +167,89 @@ yy8:
 	{ RET(PDO_PARSER_BIND_POS); }
 #line 169 "ext/pdo/pdo_sql_parser.c"
 yy9:
-	++YYCURSOR;
-	switch ((yych = *YYCURSOR)) {
-	case '*':	goto yy19;
-	default:	goto yy13;
-	}
+	yych = *++YYCURSOR;
+	goto yy4;
 yy10:
-#line 65 "ext/pdo/pdo_sql_parser.re"
-	{ RET(PDO_PARSER_TEXT); }
-#line 179 "ext/pdo/pdo_sql_parser.c"
-yy11:
 	yych = *++YYCURSOR;
 	switch (yych) {
-	case '-':	goto yy14;
-	default:	goto yy13;
+	case '-':	goto yy21;
+	default:	goto yy4;
+	}
+yy11:
+	yych = *(YYMARKER = ++YYCURSOR);
+	switch (yych) {
+	case '*':	goto yy15;
+	default:	goto yy4;
 	}
 yy12:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
-yy13:
 	switch (yych) {
 	case 0x00:
 	case '"':
 	case '\'':
+	case '(':
+	case ')':
+	case '*':
+	case '+':
+	case ',':
+	case '-':
+	case '.':
+	case '/':
 	case ':':
-	case '?':	goto yy10;
+	case '?':	goto yy14;
 	default:	goto yy12;
 	}
 yy14:
+#line 65 "ext/pdo/pdo_sql_parser.re"
+	{ RET(PDO_PARSER_TEXT); }
+#line 208 "ext/pdo/pdo_sql_parser.c"
+yy15:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
 	switch (yych) {
-	case 0x00:
-	case '"':
-	case '\'':
-	case ':':
-	case '?':	goto yy17;
-	case '\n':
-	case '\r':	goto yy12;
-	default:	goto yy14;
+	case '*':	goto yy17;
+	default:	goto yy15;
 	}
-yy16:
-#line 64 "ext/pdo/pdo_sql_parser.re"
-	{ RET(PDO_PARSER_TEXT); }
-#line 216 "ext/pdo/pdo_sql_parser.c"
 yy17:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
 	switch (yych) {
-	case '\n':
-	case '\r':	goto yy16;
-	default:	goto yy17;
+	case '*':	goto yy17;
+	case '/':	goto yy19;
+	default:	goto yy15;
 	}
 yy19:
-	yyaccept = 1;
-	YYMARKER = ++YYCURSOR;
-	if (YYLIMIT <= YYCURSOR) YYFILL(1);
-	yych = *YYCURSOR;
-	switch (yych) {
-	case 0x00:
-	case '"':
-	case '\'':
-	case ':':
-	case '?':	goto yy21;
-	case '*':	goto yy23;
-	default:	goto yy19;
-	}
+	++YYCURSOR;
+yy20:
+#line 64 "ext/pdo/pdo_sql_parser.re"
+	{ RET(PDO_PARSER_TEXT); }
+#line 231 "ext/pdo/pdo_sql_parser.c"
 yy21:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
 	switch (yych) {
-	case '*':	goto yy26;
+	case '\n':
+	case '\r':	goto yy20;
 	default:	goto yy21;
 	}
 yy23:
-	yyaccept = 1;
-	YYMARKER = ++YYCURSOR;
-	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
+	++YYCURSOR;
+	if (YYLIMIT <= YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
 	switch (yych) {
-	case 0x00:
-	case '"':
-	case '\'':
-	case ':':
-	case '?':	goto yy21;
-	case '*':	goto yy23;
-	case '/':	goto yy25;
-	default:	goto yy19;
+	case '?':	goto yy23;
+	default:	goto yy25;
 	}
 yy25:
-	yych = *++YYCURSOR;
-	switch (yych) {
-	case 0x00:
-	case '"':
-	case '\'':
-	case ':':
-	case '?':	goto yy16;
-	default:	goto yy12;
-	}
-yy26:
-	++YYCURSOR;
-	if (YYLIMIT <= YYCURSOR) YYFILL(1);
-	yych = *YYCURSOR;
-	switch (yych) {
-	case '*':	goto yy26;
-	case '/':	goto yy28;
-	default:	goto yy21;
-	}
-yy28:
-	yych = *++YYCURSOR;
-	goto yy16;
-yy29:
-	++YYCURSOR;
-	if (YYLIMIT <= YYCURSOR) YYFILL(1);
-	yych = *YYCURSOR;
-	switch (yych) {
-	case '?':	goto yy29;
-	default:	goto yy31;
-	}
-yy31:
 #line 60 "ext/pdo/pdo_sql_parser.re"
 	{ RET(PDO_PARSER_TEXT); }
-#line 296 "ext/pdo/pdo_sql_parser.c"
-yy32:
+#line 252 "ext/pdo/pdo_sql_parser.c"
+yy26:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
@@ -360,65 +316,65 @@ yy32:
 	case 'w':
 	case 'x':
 	case 'y':
-	case 'z':	goto yy32;
-	default:	goto yy34;
+	case 'z':	goto yy26;
+	default:	goto yy28;
 	}
-yy34:
+yy28:
 #line 61 "ext/pdo/pdo_sql_parser.re"
 	{ RET(PDO_PARSER_BIND); }
-#line 370 "ext/pdo/pdo_sql_parser.c"
-yy35:
+#line 326 "ext/pdo/pdo_sql_parser.c"
+yy29:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
 	switch (yych) {
-	case ':':	goto yy35;
-	default:	goto yy31;
+	case ':':	goto yy29;
+	default:	goto yy25;
 	}
-yy37:
+yy31:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
-yy38:
+yy32:
 	switch (yych) {
 	case 0x00:	goto yy2;
-	case '\'':	goto yy40;
-	case '\\':	goto yy39;
-	default:	goto yy37;
+	case '\'':	goto yy34;
+	case '\\':	goto yy33;
+	default:	goto yy31;
 	}
-yy39:
+yy33:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
 	if (yych <= 0x00) goto yy2;
-	goto yy37;
-yy40:
+	goto yy31;
+yy34:
 	++YYCURSOR;
 #line 59 "ext/pdo/pdo_sql_parser.re"
 	{ RET(PDO_PARSER_TEXT); }
-#line 400 "ext/pdo/pdo_sql_parser.c"
-yy42:
+#line 356 "ext/pdo/pdo_sql_parser.c"
+yy36:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
-yy43:
+yy37:
 	switch (yych) {
 	case 0x00:	goto yy2;
-	case '"':	goto yy45;
-	case '\\':	goto yy44;
-	default:	goto yy42;
+	case '"':	goto yy39;
+	case '\\':	goto yy38;
+	default:	goto yy36;
 	}
-yy44:
+yy38:
 	++YYCURSOR;
 	if (YYLIMIT <= YYCURSOR) YYFILL(1);
 	yych = *YYCURSOR;
 	if (yych <= 0x00) goto yy2;
-	goto yy42;
-yy45:
+	goto yy36;
+yy39:
 	++YYCURSOR;
 #line 58 "ext/pdo/pdo_sql_parser.re"
 	{ RET(PDO_PARSER_TEXT); }
-#line 422 "ext/pdo/pdo_sql_parser.c"
+#line 378 "ext/pdo/pdo_sql_parser.c"
 }
 #line 66 "ext/pdo/pdo_sql_parser.re"
 	

ext/pdo/pdo_sql_parser.re

@@ -49,7 +49,7 @@ static int scan(Scanner *s)
 	BINDCHR		= [:][a-zA-Z0-9_]+;
 	QUESTION	= [?];
 	COMMENTS	= ("/*"([^*]+|[*]+[^/*])*[*]*"*/"|"--"[^\r\n]*);
-	SPECIALS	= [:?"'];
+	SPECIALS	= [:?"'-/];
 	MULTICHAR	= ([:]{2,}|[?]{2,});
 	ANYNOEOF	= [\001-\377];
 	*/

ext/pdo/pdo_stmt.c

@@ -145,7 +145,7 @@ static inline int rewrite_name_to_position(pdo_stmt_t *stmt, struct pdo_bound_pa
 			pdo_raise_impl_error(stmt->dbh, stmt, "HY093", "parameter was not defined" TSRMLS_CC);
 			return 0;
 		}
-    
+
 		zend_hash_internal_pointer_reset(stmt->bound_param_map);
 		while (SUCCESS == zend_hash_get_current_data(stmt->bound_param_map, (void**)&name)) {
 			if (strcmp(name, param->name)) {
@@ -163,7 +163,7 @@ static inline int rewrite_name_to_position(pdo_stmt_t *stmt, struct pdo_bound_pa
 		pdo_raise_impl_error(stmt->dbh, stmt, "HY093", "parameter was not defined" TSRMLS_CC);
 		return 0;
 	}
-	return 1;	
+	return 1;
 }
 /* }}} */
 
@@ -188,7 +188,7 @@ iterate:
 				ret = 0;
 				break;
 			}
-			
+
 			zend_hash_move_forward(ht);
 		}
 	}
@@ -442,14 +442,14 @@ static PHP_METHOD(PDOStatement, execute)
 	}
 
 	PDO_STMT_CLEAR_ERR();
-	
+
 	if (input_params) {
 		struct pdo_bound_param_data param;
 		zval **tmp;
 		uint str_length;
 		ulong num_index;
-	
-		if (stmt->bound_params) {	
+
+		if (stmt->bound_params) {
 			zend_hash_destroy(stmt->bound_params);
 			FREE_HASHTABLE(stmt->bound_params);
 			stmt->bound_params = NULL;
@@ -490,7 +490,7 @@ static PHP_METHOD(PDOStatement, execute)
 
 	if (PDO_PLACEHOLDER_NONE == stmt->supports_placeholders) {
 		/* handle the emulated parameter binding,
-         * stmt->active_query_string holds the query with binds expanded and 
+         * stmt->active_query_string holds the query with binds expanded and
 		 * quoted.
          */
 
@@ -531,7 +531,7 @@ static PHP_METHOD(PDOStatement, execute)
 		if (ret && !dispatch_param_event(stmt, PDO_PARAM_EVT_EXEC_POST TSRMLS_CC)) {
 			RETURN_FALSE;
 		}
-			
+
 		RETURN_BOOL(ret);
 	}
 	if (stmt->active_query_string && stmt->active_query_string != stmt->query_string) {
@@ -569,12 +569,12 @@ static inline void fetch_value(pdo_stmt_t *stmt, zval *dest, int colno, int *typ
 			} else {
 				ZVAL_NULL(dest);
 			}
-			
+
 			if (Z_TYPE_P(dest) == IS_NULL) {
 				type = new_type;
 			}
 			break;
-			
+
 		case PDO_PARAM_INT:
 			if (value && value_len == sizeof(long)) {
 				ZVAL_LONG(dest, *(long*)value);
@@ -635,7 +635,7 @@ static inline void fetch_value(pdo_stmt_t *stmt, zval *dest, int colno, int *typ
 				}
 			}
 			break;
-		
+
 		case PDO_PARAM_STR:
 			if (value && !(value_len == 0 && stmt->dbh->oracle_nulls == PDO_NULL_EMPTY_STRING)) {
 				ZVAL_STRINGL(dest, value, value_len, !caller_frees);
@@ -666,7 +666,7 @@ static inline void fetch_value(pdo_stmt_t *stmt, zval *dest, int colno, int *typ
 				;
 		}
 	}
-	
+
 	if (caller_frees && value) {
 		efree(value);
 	}
@@ -705,7 +705,7 @@ static int do_fetch_common(pdo_stmt_t *stmt, enum pdo_fetch_orientation ori,
 	if (!stmt->columns && !pdo_stmt_describe_columns(stmt TSRMLS_CC)) {
 		return 0;
 	}
-	
+
 	if (!dispatch_param_event(stmt, PDO_PARAM_EVT_FETCH_POST TSRMLS_CC)) {
 		return 0;
 	}
@@ -751,7 +751,7 @@ static int do_fetch_class_prepare(pdo_stmt_t *stmt TSRMLS_DC) /* {{{ */
 		stmt->fetch.cls.ce = ZEND_STANDARD_CLASS_DEF_PTR;
 		ce = ZEND_STANDARD_CLASS_DEF_PTR;
 	}
-	
+
 	if (ce->constructor) {
 		fci->function_table = &ce->function_table;
 		fci->function_name = NULL;
@@ -780,7 +780,7 @@ static int make_callable_ex(pdo_stmt_t *stmt, zval *callable, zend_fcall_info *
 {
 	char *is_callable_error = NULL;
 
-	if (zend_fcall_info_init(callable, 0, fci, fcc, NULL, &is_callable_error TSRMLS_CC) == FAILURE) { 
+	if (zend_fcall_info_init(callable, 0, fci, fcc, NULL, &is_callable_error TSRMLS_CC) == FAILURE) {
 		if (is_callable_error) {
 			pdo_raise_impl_error(stmt->dbh, stmt, "HY000", is_callable_error TSRMLS_CC);
 			efree(is_callable_error);
@@ -793,10 +793,10 @@ static int make_callable_ex(pdo_stmt_t *stmt, zval *callable, zend_fcall_info *
 		/* Possible E_STRICT error message */
 		efree(is_callable_error);
 	}
-	
+
 	fci->param_count = num_args; /* probably less */
 	fci->params = safe_emalloc(sizeof(zval**), num_args, 0);
-	
+
 	return 1;
 }
 /* }}} */
@@ -909,7 +909,7 @@ static int do_fetch(pdo_stmt_t *stmt, int do_bind, zval *return_value,
 					} else if (flags == PDO_FETCH_GROUP && colno) {
 						fetch_value(stmt, return_value, 0, NULL TSRMLS_CC);
 					} else {
-						fetch_value(stmt, return_value, colno, NULL TSRMLS_CC); 
+						fetch_value(stmt, return_value, colno, NULL TSRMLS_CC);
 					}
 					if (!return_all) {
 						return 1;
@@ -976,7 +976,7 @@ static int do_fetch(pdo_stmt_t *stmt, int do_bind, zval *return_value,
 					}
 				}
 				break;
-			
+
 			case PDO_FETCH_INTO:
 				if (!stmt->fetch.into) {
 					pdo_raise_impl_error(stmt->dbh, stmt, "HY000", "No fetch-into object specified." TSRMLS_CC);
@@ -1006,13 +1006,13 @@ static int do_fetch(pdo_stmt_t *stmt, int do_bind, zval *return_value,
 					}
 				}
 				break;
-				
+
 
 			default:
 				/* shouldn't happen */
 				return 0;
 		}
-		
+
 		if (return_all && how != PDO_FETCH_KEY_PAIR) {
 			INIT_PZVAL(&grp_val);
 			if (flags == PDO_FETCH_GROUP && how == PDO_FETCH_COLUMN && stmt->fetch.column > 0) {
@@ -1037,7 +1037,7 @@ static int do_fetch(pdo_stmt_t *stmt, int do_bind, zval *return_value,
 				case PDO_FETCH_ASSOC:
 					add_assoc_zval(return_value, stmt->columns[i].name, val);
 					break;
-					
+
 				case PDO_FETCH_KEY_PAIR:
 					{
 						zval *tmp;
@@ -1144,12 +1144,12 @@ static int do_fetch(pdo_stmt_t *stmt, int do_bind, zval *return_value,
 						}
 					}
 					break;
-				
+
 				case PDO_FETCH_FUNC:
 					stmt->fetch.func.values[idx] = val;
 					stmt->fetch.cls.fci.params[idx] = &stmt->fetch.func.values[idx];
 					break;
-				
+
 				default:
 					zval_ptr_dtor(&val);
 					pdo_raise_impl_error(stmt->dbh, stmt, "22003", "mode is out of range" TSRMLS_CC);
@@ -1157,7 +1157,7 @@ static int do_fetch(pdo_stmt_t *stmt, int do_bind, zval *return_value,
 					break;
 			}
 		}
-		
+
 		switch (how) {
 			case PDO_FETCH_CLASS:
 				if (ce->constructor && !(flags & (PDO_FETCH_PROPS_LATE | PDO_FETCH_SERIALIZE))) {
@@ -1199,7 +1199,7 @@ static int do_fetch(pdo_stmt_t *stmt, int do_bind, zval *return_value,
 					zval_ptr_dtor(&stmt->fetch.func.values[idx]);
 				}
 				break;
-			
+
 			default:
 				break;
 		}
@@ -1236,7 +1236,7 @@ static int pdo_stmt_verify_mode(pdo_stmt_t *stmt, long mode, int fetch_all TSRML
 		pdo_raise_impl_error(stmt->dbh, stmt, "HY000", "invalid fetch mode" TSRMLS_CC);
 		return 0;
 	}
-	
+
 	if (mode == PDO_FETCH_USE_DEFAULT) {
 		flags = stmt->default_fetch_type & PDO_FETCH_FLAGS;
 		mode = stmt->default_fetch_type & ~PDO_FETCH_FLAGS;
@@ -1256,7 +1256,7 @@ static int pdo_stmt_verify_mode(pdo_stmt_t *stmt, long mode, int fetch_all TSRML
 			return 0;
 		}
 		/* fall through */
-	
+
 	default:
 		if ((flags & PDO_FETCH_SERIALIZE) == PDO_FETCH_SERIALIZE) {
 			pdo_raise_impl_error(stmt->dbh, stmt, "HY000", "PDO::FETCH_SERIALIZE can only be used together with PDO::FETCH_CLASS" TSRMLS_CC);
@@ -1333,7 +1333,7 @@ static PHP_METHOD(PDOStatement, fetchObject)
 	old_ce = stmt->fetch.cls.ce;
 	old_ctor_args = stmt->fetch.cls.ctor_args;
 	old_arg_count = stmt->fetch.cls.fci.param_count;
-	
+
 	do_fetch_opt_finish(stmt, 0 TSRMLS_CC);
 
 	if (ctor_args) {
@@ -1405,7 +1405,7 @@ static PHP_METHOD(PDOStatement, fetchAll)
 	zend_class_entry *old_ce;
 	zval *old_ctor_args, *ctor_args = NULL;
 	int error = 0, flags, old_arg_count;
-	PHP_STMT_GET_OBJ;    	  
+	PHP_STMT_GET_OBJ;
 
 	if (FAILURE == zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|lzz", &how, &arg2, &ctor_args)) {
 		RETURN_FALSE;
@@ -1474,7 +1474,7 @@ static PHP_METHOD(PDOStatement, fetchAll)
 			break;
 		}
 		break;
-	
+
 	case PDO_FETCH_COLUMN:
 		switch(ZEND_NUM_ARGS()) {
 		case 0:
@@ -1499,7 +1499,7 @@ static PHP_METHOD(PDOStatement, fetchAll)
 	}
 
 	flags = how & PDO_FETCH_FLAGS;
-	
+
 	if ((how & ~PDO_FETCH_FLAGS) == PDO_FETCH_USE_DEFAULT) {
 		flags |= stmt->default_fetch_type & PDO_FETCH_FLAGS;
 		how |= stmt->default_fetch_type & ~PDO_FETCH_FLAGS;
@@ -1508,7 +1508,7 @@ static PHP_METHOD(PDOStatement, fetchAll)
 	if (!error)	{
 		PDO_STMT_CLEAR_ERR();
 		MAKE_STD_ZVAL(data);
-		if (	(how & PDO_FETCH_GROUP) || how == PDO_FETCH_KEY_PAIR || 
+		if (	(how & PDO_FETCH_GROUP) || how == PDO_FETCH_KEY_PAIR ||
 			(how == PDO_FETCH_USE_DEFAULT && stmt->default_fetch_type == PDO_FETCH_KEY_PAIR)
 		) {
 			array_init(return_value);
@@ -1537,13 +1537,13 @@ static PHP_METHOD(PDOStatement, fetchAll)
 		}
 		FREE_ZVAL(data);
 	}
-	
+
 	do_fetch_opt_finish(stmt, 0 TSRMLS_CC);
 
 	stmt->fetch.cls.ce = old_ce;
 	stmt->fetch.cls.ctor_args = old_ctor_args;
 	stmt->fetch.cls.fci.param_count = old_arg_count;
-	
+
 	if (error) {
 		PDO_HANDLE_STMT_ERR();
 		if (error != 2) {
@@ -1569,14 +1569,14 @@ static int register_bound_param(INTERNAL_FUNCTION_PARAMETERS, pdo_stmt_t *stmt,
 			"lz|llz!", &param.paramno, &param.parameter, &param_type, &param.max_value_len,
 			&param.driver_params)) {
 		if (FAILURE == zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "sz|llz!", &param.name,
-				&param.namelen, &param.parameter, &param_type, &param.max_value_len, 
+				&param.namelen, &param.parameter, &param_type, &param.max_value_len,
 				&param.driver_params)) {
 			return 0;
-		}	
+		}
 	}
-	
+
 	param.param_type = (int) param_type;
-	
+
 	if (param.paramno > 0) {
 		--param.paramno; /* make it zero-based internally */
 	} else if (!param.name) {
@@ -1604,7 +1604,7 @@ static PHP_METHOD(PDOStatement, bindValue)
 	PHP_STMT_GET_OBJ;
 
 	param.paramno = -1;
-	
+
 	if (FAILURE == zend_parse_parameters_ex(ZEND_PARSE_PARAMS_QUIET, ZEND_NUM_ARGS() TSRMLS_CC,
 			"lz/|l", &param.paramno, &param.parameter, &param_type)) {
 		if (FAILURE == zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "sz/|l", &param.name,
@@ -1614,14 +1614,14 @@ static PHP_METHOD(PDOStatement, bindValue)
 	}
 
 	param.param_type = (int) param_type;
-	
+
 	if (param.paramno > 0) {
 		--param.paramno; /* make it zero-based internally */
 	} else if (!param.name) {
 		pdo_raise_impl_error(stmt->dbh, stmt, "HY093", "Columns/Parameters are 1-based" TSRMLS_CC);
 		RETURN_FALSE;
 	}
-	
+
 	Z_ADDREF_P(param.parameter);
 	if (!really_register_bound_param(&param, stmt, TRUE TSRMLS_CC)) {
 		if (param.parameter) {
@@ -1758,7 +1758,7 @@ static int generic_stmt_attr_get(pdo_stmt_t *stmt, zval *return_value, long attr
 	}
 	return 0;
 }
-   
+
 static PHP_METHOD(PDOStatement, getAttribute)
 {
 	long attr;
@@ -1859,7 +1859,7 @@ int pdo_stmt_setup_fetch_mode(INTERNAL_FUNCTION_PARAMETERS, pdo_stmt_t *stmt, in
 	zval ***args;
 	zend_class_entry **cep;
 	int retval;
-	
+
 	do_fetch_opt_finish(stmt, 1 TSRMLS_CC);
 
 	switch (stmt->default_fetch_type) {
@@ -1872,7 +1872,7 @@ int pdo_stmt_setup_fetch_mode(INTERNAL_FUNCTION_PARAMETERS, pdo_stmt_t *stmt, in
 		default:
 			;
 	}
-	
+
 	stmt->default_fetch_type = PDO_FETCH_BOTH;
 
 	if (argc == 0) {
@@ -1882,7 +1882,7 @@ int pdo_stmt_setup_fetch_mode(INTERNAL_FUNCTION_PARAMETERS, pdo_stmt_t *stmt, in
 	args = safe_emalloc(ZEND_NUM_ARGS(), sizeof(zval*), 0);
 
 	retval = zend_get_parameters_array_ex(ZEND_NUM_ARGS(), args);
-	
+
 	if (SUCCESS == retval) {
 		if (Z_TYPE_PP(args[skip]) != IS_LONG) {
 			pdo_raise_impl_error(stmt->dbh, stmt, "HY000", "mode must be an integer" TSRMLS_CC);
@@ -1890,11 +1890,11 @@ int pdo_stmt_setup_fetch_mode(INTERNAL_FUNCTION_PARAMETERS, pdo_stmt_t *stmt, in
 		} else {
 			mode = Z_LVAL_PP(args[skip]);
 			flags = mode & PDO_FETCH_FLAGS;
-	
+
 			retval = pdo_stmt_verify_mode(stmt, mode, 0 TSRMLS_CC);
 		}
 	}
-	
+
 	if (FAILURE == retval) {
 		PDO_STMT_CLEAR_ERR();
 		efree(args);
@@ -1978,7 +1978,7 @@ int pdo_stmt_setup_fetch_mode(INTERNAL_FUNCTION_PARAMETERS, pdo_stmt_t *stmt, in
 					do_fetch_class_prepare(stmt TSRMLS_CC);
 				}
 			}
-			
+
 			break;
 
 		case PDO_FETCH_INTO:
@@ -1989,13 +1989,13 @@ int pdo_stmt_setup_fetch_mode(INTERNAL_FUNCTION_PARAMETERS, pdo_stmt_t *stmt, in
 			} else {
 				retval = SUCCESS;
 			}
-			
+
 			if (SUCCESS == retval) {
 #ifdef ilia_0 /* we'll only need this when we have persistent statements, if ever */
 				if (stmt->dbh->is_persistent) {
 					php_error_docref(NULL TSRMLS_CC, E_WARNING, "PHP might crash if you don't call $stmt->setFetchMode() to reset to defaults on this persistent statement.  This will be fixed in a later release");
 				}
-#endif	
+#endif
 				MAKE_STD_ZVAL(stmt->fetch.into);
 
 				Z_TYPE_P(stmt->fetch.into) = IS_OBJECT;
@@ -2003,9 +2003,9 @@ int pdo_stmt_setup_fetch_mode(INTERNAL_FUNCTION_PARAMETERS, pdo_stmt_t *stmt, in
 				Z_OBJ_HT_P(stmt->fetch.into) = Z_OBJ_HT_PP(args[skip+1]);
 				zend_objects_store_add_ref(stmt->fetch.into TSRMLS_CC);
 			}
-			
+
 			break;
-		
+
 		default:
 			pdo_raise_impl_error(stmt->dbh, stmt, "22003", "Invalid fetch mode specified" TSRMLS_CC);
 	}
@@ -2024,10 +2024,10 @@ int pdo_stmt_setup_fetch_mode(INTERNAL_FUNCTION_PARAMETERS, pdo_stmt_t *stmt, in
 	PDO_STMT_CLEAR_ERR();
 
 	efree(args);
-		
+
 	return retval;
 }
-   
+
 static PHP_METHOD(PDOStatement, setFetchMode)
 {
 	PHP_STMT_GET_OBJ;
@@ -2048,7 +2048,7 @@ static int pdo_stmt_do_next_rowset(pdo_stmt_t *stmt TSRMLS_DC)
 	if (stmt->columns) {
 		int i;
 		struct pdo_column_data *cols = stmt->columns;
-		
+
 		for (i = 0; i < stmt->column_count; i++) {
 			efree(cols[i].name);
 		}
@@ -2078,7 +2078,7 @@ static PHP_METHOD(PDOStatement, nextRowset)
 	}
 
 	PDO_STMT_CLEAR_ERR();
-	
+
 	if (!pdo_stmt_do_next_rowset(stmt TSRMLS_CC)) {
 		PDO_HANDLE_STMT_ERR();
 		RETURN_FALSE;
@@ -2106,7 +2106,7 @@ static PHP_METHOD(PDOStatement, closeCursor)
 			if (!pdo_stmt_do_next_rowset(stmt TSRMLS_CC)) {
 				break;
 			}
-				
+
 		} while (1);
 		stmt->executed = 0;
 		RETURN_TRUE;
@@ -2135,14 +2135,14 @@ static PHP_METHOD(PDOStatement, debugDumpParams)
 	if (out == NULL) {
 		RETURN_FALSE;
 	}
-	
+
 	php_stream_printf(out TSRMLS_CC, "SQL: [%d] %.*s\n",
 		stmt->query_stringlen,
 		stmt->query_stringlen, stmt->query_string);
 
 	php_stream_printf(out TSRMLS_CC, "Params:  %d\n",
 		stmt->bound_params ? zend_hash_num_elements(stmt->bound_params) : 0);
-	
+
 	if (stmt->bound_params) {
 		zend_hash_internal_pointer_reset_ex(stmt->bound_params, &pos);
 		while (SUCCESS == zend_hash_get_current_data_ex(stmt->bound_params,
@@ -2163,7 +2163,7 @@ static PHP_METHOD(PDOStatement, debugDumpParams)
 				param->paramno, param->namelen, param->namelen, param->name ? param->name : "",
 				param->is_param,
 				param->param_type);
-			
+
 			zend_hash_move_forward_ex(stmt->bound_params, &pos);
 		}
 	}
@@ -2240,25 +2240,18 @@ static void dbstmt_prop_delete(zval *object, zval *member, const zend_literal *k
 	}
 }
 
-static union _zend_function *dbstmt_method_get(
-#if PHP_API_VERSION >= 20041225
-	zval **object_pp,
-#else
-	zval *object,
-#endif
-   	char *method_name, int method_len, const zend_literal *key TSRMLS_DC)
+static union _zend_function *dbstmt_method_get(zval **object_pp, char *method_name, int method_len, const zend_literal *key TSRMLS_DC)
 {
 	zend_function *fbc = NULL;
 	char *lc_method_name;
-#if PHP_API_VERSION >= 20041225
 	zval *object = *object_pp;
-#endif
 
 	lc_method_name = emalloc(method_len + 1);
 	zend_str_tolower_copy(lc_method_name, method_name, method_len);
 
-	if (zend_hash_find(&Z_OBJCE_P(object)->function_table, lc_method_name, 
+	if (zend_hash_find(&Z_OBJCE_P(object)->function_table, lc_method_name,
 			method_len+1, (void**)&fbc) == FAILURE) {
+
 		pdo_stmt_t *stmt = (pdo_stmt_t*)zend_object_store_get_object(object TSRMLS_CC);
 		/* instance not created by PDO object */
 		if (!stmt->dbh) {
@@ -2267,7 +2260,7 @@ static union _zend_function *dbstmt_method_get(
 		/* not a pre-defined method, nor a user-defined method; check
 		 * the driver specific methods */
 		if (!stmt->dbh->cls_methods[PDO_DBH_DRIVER_METHOD_KIND_STMT]) {
-			if (!pdo_hash_methods(stmt->dbh, 
+			if (!pdo_hash_methods(stmt->dbh,
 				PDO_DBH_DRIVER_METHOD_KIND_STMT TSRMLS_CC)
 				|| !stmt->dbh->cls_methods[PDO_DBH_DRIVER_METHOD_KIND_STMT]) {
 				goto out;
@@ -2276,13 +2269,15 @@ static union _zend_function *dbstmt_method_get(
 
 		if (zend_hash_find(stmt->dbh->cls_methods[PDO_DBH_DRIVER_METHOD_KIND_STMT],
 				lc_method_name, method_len+1, (void**)&fbc) == FAILURE) {
-			fbc = NULL;
 			goto out;
 		}
 		/* got it */
 	}
-	
+
 out:
+	if (!fbc) {
+		fbc = std_object_handlers.get_method(object_pp, method_name, method_len, key TSRMLS_CC);
+	}
 	efree(lc_method_name);
 	return fbc;
 }
@@ -2305,15 +2300,15 @@ static zend_object_value dbstmt_clone_obj(zval *zobject TSRMLS_DC)
 	stmt->refcount = 1;
 
 	old_stmt = (pdo_stmt_t *)zend_object_store_get_object(zobject TSRMLS_CC);
-	
+
 	retval.handle = zend_objects_store_put(stmt, (zend_objects_store_dtor_t)zend_objects_destroy_object, (zend_objects_free_object_storage_t)pdo_dbstmt_free_storage, (zend_objects_store_clone_t)dbstmt_clone_obj TSRMLS_CC);
 	retval.handlers = Z_OBJ_HT_P(zobject);
 
 	zend_objects_clone_members((zend_object *)stmt, retval, (zend_object *)old_stmt, handle TSRMLS_CC);
-	
+
 	zend_objects_store_add_ref(&old_stmt->database_object_handle TSRMLS_CC);
 	stmt->database_object_handle = old_stmt->database_object_handle;
-			
+
 	return retval;
 }
 
@@ -2328,7 +2323,7 @@ void pdo_stmt_init(TSRMLS_D)
 	pdo_dbstmt_ce = zend_register_internal_class(&ce TSRMLS_CC);
 	pdo_dbstmt_ce->get_iterator = pdo_stmt_iter_get;
 	pdo_dbstmt_ce->create_object = pdo_dbstmt_new;
-	zend_class_implements(pdo_dbstmt_ce TSRMLS_CC, 1, zend_ce_traversable); 
+	zend_class_implements(pdo_dbstmt_ce TSRMLS_CC, 1, zend_ce_traversable);
 	zend_declare_property_null(pdo_dbstmt_ce, "queryString", sizeof("queryString")-1, ZEND_ACC_PUBLIC TSRMLS_CC);
 
 	memcpy(&pdo_dbstmt_object_handlers, &std_object_handlers, sizeof(zend_object_handlers));
@@ -2388,7 +2383,7 @@ static void free_statement(pdo_stmt_t *stmt TSRMLS_DC)
 		FREE_ZVAL(stmt->fetch.into);
 		stmt->fetch.into = NULL;
 	}
-	
+
 	do_fetch_opt_finish(stmt, 1 TSRMLS_CC);
 
 	zend_objects_store_del_ref(&stmt->database_object_handle TSRMLS_CC);
@@ -2450,7 +2445,7 @@ static void pdo_stmt_iter_dtor(zend_object_iterator *iter TSRMLS_DC)
 	if (--I->stmt->refcount == 0) {
 		free_statement(I->stmt TSRMLS_CC);
 	}
-		
+
 	if (I->fetch_ahead) {
 		zval_ptr_dtor(&I->fetch_ahead);
 	}
@@ -2594,7 +2589,7 @@ static zval *row_prop_read(zval *object, zval *member, int type, const zend_lite
 
 	Z_SET_REFCOUNT_P(return_value, 0);
 	Z_UNSET_ISREF_P(return_value);
-	
+
 	return return_value;
 }
 
@@ -2660,7 +2655,7 @@ static HashTable *row_get_properties(zval *object TSRMLS_DC)
 	if (stmt == NULL) {
 		return NULL;
 	}
-	
+
 	if (!stmt->std.properties) {
 		rebuild_object_properties(&stmt->std);
 	}
@@ -2676,11 +2671,7 @@ static HashTable *row_get_properties(zval *object TSRMLS_DC)
 }
 
 static union _zend_function *row_method_get(
-#if PHP_API_VERSION >= 20041225
 	zval **object_pp,
-#else
-	zval *object,
-#endif
 	char *method_name, int method_len, const zend_literal *key TSRMLS_DC)
 {
 	zend_function *fbc;
@@ -2693,7 +2684,7 @@ static union _zend_function *row_method_get(
 		efree(lc_method_name);
 		return NULL;
 	}
-	
+
 	efree(lc_method_name);
 	return fbc;
 }
@@ -2767,7 +2758,7 @@ void pdo_row_free_storage(pdo_stmt_t *stmt TSRMLS_DC)
 {
 	if (stmt) {
 		ZVAL_NULL(&stmt->lazy_object_ref);
-		
+
 		if (--stmt->refcount == 0) {
 			free_statement(stmt TSRMLS_CC);
 		}

ext/pdo/tests/bug_44159.phpt

@@ -1,5 +1,5 @@
 --TEST--
-Bug #44159 (Crash: $pdo->setAttribute(PDO::STATEMENT_ATTR_CLASS, NULL))
+PDO Common: Bug #44159 (Crash: $pdo->setAttribute(PDO::STATEMENT_ATTR_CLASS, NULL))
 --SKIPIF--
 <?php # vim:ft=php
 if (!extension_loaded('pdo')) die('skip PDO not available');

ext/pdo/tests/bug_47769.phpt

@@ -1,5 +1,5 @@
 --TEST--
-Bug #47769 (Strange extends PDO)
+PDO Common: Bug #47769 (Strange extends PDO)
 --SKIPIF--
 <?php
 if (!extension_loaded("pdo_sqlite"))

ext/pdo/tests/bug_52098.phpt

@@ -0,0 +1,59 @@
+--TEST--
+PDO Common: Bug #52098 Own PDOStatement implementation ignore __call()
+--SKIPIF--
+<?php # vim:ft=php
+if (!extension_loaded('pdo')) die('skip');
+$dir = getenv('REDIR_TEST_DIR');
+if (false == $dir) die('skip no driver');
+require_once $dir . 'pdo_test.inc';
+PDOTest::skip();
+?>
+--FILE--
+<?php
+if (getenv('REDIR_TEST_DIR') === false) putenv('REDIR_TEST_DIR='.dirname(__FILE__) . '/../../pdo/tests/');
+require_once getenv('REDIR_TEST_DIR') . 'pdo_test.inc';
+$db = PDOTest::factory();
+
+@$db->exec("DROP TABLE test");
+$db->exec("CREATE TABLE test (x int)");
+$db->exec("INSERT INTO test VALUES (1)");
+
+class MyStatement extends PDOStatement
+{
+    public function __call($name, $arguments)
+    {
+        echo "Calling object method '$name'" . implode(', ', $arguments). "\n";
+    }
+}
+/*
+Test prepared statement with PDOStatement class.
+*/
+$derived = $db->prepare('SELECT * FROM test', array(PDO::ATTR_STATEMENT_CLASS=>array('MyStatement')));
+$derived->execute();
+$derived->foo();
+$derived->fetchAll();
+$derived = null;
+
+/*
+Test regular statement with PDOStatement class.
+*/
+$db->setAttribute(PDO::ATTR_STATEMENT_CLASS, array('MyStatement'));
+$r =  $db->query('SELECT * FROM test');
+echo $r->bar();
+$r->fetchAll();
+$r = null;
+
+/*
+Test object instance of PDOStatement class.
+*/
+$obj = new MyStatement;
+echo $obj->lucky();
+
+$db->exec("DROP TABLE test");
+?>
+===DONE===
+--EXPECTF--
+Calling object method 'foo'
+Calling object method 'bar'
+Calling object method 'lucky'
+===DONE===

ext/pdo/tests/bug_61292.phpt

@@ -1,5 +1,5 @@
 --TEST--
-Bug #61292 (Segfault while calling a method on an overloaded PDO object)
+PDO Common: Bug #61292 (Segfault while calling a method on an overloaded PDO object)
 --SKIPIF--
 <?php
 if (!extension_loaded('pdo')) die('skip');

ext/pdo/tests/bug_65946.phpt

@@ -1,5 +1,5 @@
 --TEST--
-Bug #65946 (pdo_sql_parser.c permanently converts values bound to strings)
+PDO Common: Bug #65946 (pdo_sql_parser.c permanently converts values bound to strings)
 --SKIPIF--
 <?php
 if (!extension_loaded('pdo')) die('skip');

ext/pdo/tests/bug_71447.phpt

@@ -0,0 +1,104 @@
+--TEST--
+PDO Common: Bug #71447 (Quotes inside comments not properly handled)
+--SKIPIF--
+<?php
+if (!extension_loaded('pdo')) die('skip');
+$dir = getenv('REDIR_TEST_DIR');
+if (false == $dir) die('skip no driver');
+require_once $dir . 'pdo_test.inc';
+PDOTest::skip();
+?>
+--FILE--
+<?php
+if (getenv('REDIR_TEST_DIR') === false) putenv('REDIR_TEST_DIR='.dirname(__FILE__) . '/../../pdo/tests/');
+require_once getenv('REDIR_TEST_DIR') . 'pdo_test.inc';
+
+$db = PDOTest::factory();
+$db->setAttribute (\PDO::ATTR_ERRMODE, \PDO::ERRMODE_WARNING);
+$db->setAttribute (\PDO::ATTR_DEFAULT_FETCH_MODE, \PDO::FETCH_NUM);
+$db->setAttribute (\PDO::ATTR_EMULATE_PREPARES, false);
+$db->exec('CREATE TABLE test(id int)');
+$db->exec('INSERT INTO test VALUES(1)');
+
+// Comment without quotes or placeholders
+$stmt = $db->prepare("
+	SELECT -- Thats all folks!
+		'\"abc\":8000'
+	FROM test
+");
+
+$stmt->execute();
+var_dump($stmt->fetchColumn());
+
+// Comment and placeholder within a string
+$stmt = $db->prepare("
+	SELECT
+		'\"abc\":8001 -- Wat?'
+	FROM test
+");
+
+$stmt->execute();
+var_dump($stmt->fetchColumn());
+
+// Comment with single quote
+$stmt = $db->prepare("
+	SELECT -- That's all folks!
+		'\"abc\":8002'
+	FROM test
+");
+
+$stmt->execute();
+var_dump($stmt->fetchColumn());
+
+// C-Style comment with single quote
+$stmt = $db->prepare("
+	SELECT /* That's all folks! */
+		'\"abc\":8003'
+	FROM test
+");
+
+$stmt->execute();
+var_dump($stmt->fetchColumn());
+
+// Comment with double quote
+$stmt = $db->prepare("
+	SELECT -- Is it only \"single quotes?
+		'\"abc\":8004'
+	FROM test
+");
+
+$stmt->execute();
+var_dump($stmt->fetchColumn());
+
+// Comment with ? placeholder
+$stmt = $db->prepare("
+	SELECT -- What about question marks here?
+		*
+	FROM test
+	WHERE id = ?
+");
+
+$stmt->execute([1]);
+var_dump($stmt->fetchColumn());
+
+// Comment with named placeholder
+$stmt = $db->prepare("
+	SELECT -- What about placeholders :bar
+		*
+	FROM test
+	WHERE id = :id
+");
+
+$stmt->execute(['id' => 1]);
+var_dump($stmt->fetchColumn());
+
+
+?>
+--EXPECT--
+string(10) ""abc":8000"
+string(18) ""abc":8001 -- Wat?"
+string(10) ""abc":8002"
+string(10) ""abc":8003"
+string(10) ""abc":8004"
+string(1) "1"
+string(1) "1"

ext/pdo_dblib/dblib_driver.c

@@ -286,8 +286,6 @@ static int pdo_dblib_handle_factory(pdo_dbh_t *dbh, zval *driver_options TSRMLS_
 		
 	};
 	
-	nvers = sizeof(tdsver)/sizeof(tdsver[0]);
-	
 	struct pdo_data_src_parser vars[] = {
 		{ "charset",	NULL,	0 }
 		,{ "appname",	"PHP " PDO_DBLIB_FLAVOUR,	0 }
@@ -298,6 +296,7 @@ static int pdo_dblib_handle_factory(pdo_dbh_t *dbh, zval *driver_options TSRMLS_
 	};
 	
 	nvars = sizeof(vars)/sizeof(vars[0]);
+	nvers = sizeof(tdsver)/sizeof(tdsver[0]);
 	
 	php_pdo_parse_data_source(dbh->data_source, dbh->data_source_len, vars, nvars);
 

ext/pdo_dblib/dblib_stmt.c

@@ -103,9 +103,6 @@ static int pdo_dblib_stmt_cursor_closer(pdo_stmt_t *stmt TSRMLS_DC)
 	/* Cancel any pending results */
 	dbcancel(H->link);
 	
-	efree(stmt->columns); 
-	stmt->columns = NULL;
-	
 	return 1;
 }
 
@@ -113,9 +110,6 @@ static int pdo_dblib_stmt_dtor(pdo_stmt_t *stmt TSRMLS_DC)
 {
 	pdo_dblib_stmt *S = (pdo_dblib_stmt*)stmt->driver_data;
 
-	efree(stmt->columns); 
-	stmt->columns = NULL;
-
 	efree(S);
 		
 	return 1;
@@ -211,7 +205,7 @@ static int pdo_dblib_stmt_describe(pdo_stmt_t *stmt, int colno TSRMLS_DC)
 		col->name = estrdup(fname);
 		col->namelen = strlen(col->name);
 	} else {
-		col->namelen = spprintf(&col->name, NULL, "computed%d", colno);
+		col->namelen = spprintf(&col->name, 0, "computed%d", colno);
 	}
 	col->maxlen = dbcollen(H->link, colno+1);
 	col->param_type = PDO_PARAM_STR;
@@ -271,6 +265,25 @@ static int pdo_dblib_stmt_get_col(pdo_stmt_t *stmt, int colno, char **ptr,
 			*ptr = tmp_ptr;
 			break;
 		}
+		case SQLDATETIM4:
+		case SQLDATETIME: {
+			DBDATETIME dt;
+			DBDATEREC di;
+
+			dbconvert(H->link, coltype, (BYTE*) *ptr, -1, SQLDATETIME, (LPBYTE) &dt, -1);
+			dbdatecrack(H->link, &di, &dt);
+
+			*len = spprintf((char**) &tmp_ptr, 20, "%d-%02d-%02d %02d:%02d:%02d",
+#if defined(PHP_DBLIB_IS_MSSQL) || defined(MSDBLIB)
+					di.year,     di.month,       di.day,        di.hour,     di.minute,     di.second
+#else
+					di.dateyear, di.datemonth+1, di.datedmonth, di.datehour, di.dateminute, di.datesecond
+#endif
+				);
+
+			*ptr = (char*) tmp_ptr;
+			break;
+		}
 		default:
 			if (dbwillconvert(coltype, SQLCHAR)) {
 				tmp_len = 32 + (2 * (*len)); /* FIXME: We allocate more than we need here */

ext/pdo_dblib/tests/bug_54648.phpt

@@ -0,0 +1,26 @@
+--TEST--
+PDO_DBLIB: Does not force correct dateformat
+--SKIPIF--
+<?php
+if (!extension_loaded('pdo_dblib')) die('skip not loaded');
+require dirname(__FILE__) . '/config.inc';
+?>
+--FILE--
+<?php
+require dirname(__FILE__) . '/config.inc';
+$db->query('set dateformat ymd'); 
+$rs = $db->query("select cast('1950-01-18 23:00:00' as smalldatetime) as sdt, cast('2030-01-01 23:59:59' as datetime) as dt");
+var_dump($rs->fetchAll(PDO::FETCH_ASSOC));
+echo "Done.\n";
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  array(2) {
+    ["sdt"]=>
+    string(19) "1950-01-18 23:00:00"
+    ["dt"]=>
+    string(19) "2030-01-01 23:59:59"
+  }
+}
+Done.

ext/pdo_dblib/tests/bug_68957.phpt

@@ -0,0 +1,29 @@
+--TEST--
+PDO_DBLIB bug #68957 PDO::query doesn't support several queries
+--SKIPIF--
+<?php
+if (!extension_loaded('pdo_dblib')) die('skip not loaded');
+require dirname(__FILE__) . '/config.inc';
+?>
+--FILE--
+<?php
+require dirname(__FILE__) . '/config.inc';
+
+$query = "declare @myInt int = 1; select @myInt;";
+$stmt = $db->query($query);
+$stmt->nextRowset(); // Added line
+$rows = $stmt->fetchAll();
+print_r($rows);
+
+?>
+--EXPECT--
+Array
+(
+    [0] => Array
+        (
+            [computed0] => 1
+            [0] => 1
+        )
+
+)
+

ext/pdo_dblib/tests/bug_69757.phpt

@@ -11,8 +11,8 @@ require __DIR__ . '/config.inc';
 
 $sql = "
     exec dbo.sp_executesql N'
-        SELECT * FROM sysobjects
-        SELECT * FROM syscolumns
+        SELECT TOP 1 * FROM sysobjects
+        SELECT TOP 1 * FROM syscolumns
     '
 ";
 $stmt = $db->query($sql);

ext/pgsql/pgsql.c

@@ -1249,7 +1249,7 @@ PHP_MINFO_FUNCTION(pgsql)
 #else
 	php_info_print_table_row(2, "Multibyte character support", "disabled");
 #endif
-#ifdef USE_SSL
+#if defined(USE_SSL) || defined(USE_OPENSSL)
 	php_info_print_table_row(2, "SSL support", "enabled");
 #else
 	php_info_print_table_row(2, "SSL support", "disabled");
@@ -2784,9 +2784,13 @@ static void php_pgsql_fetch_hash(INTERNAL_FUNCTION_PARAMETERS, long result_type,
 		zend_fcall_info fci;
 		zend_fcall_info_cache fcc;
 		zval *retval_ptr;
+		zend_bool props_merged = 0;
 
 		object_and_properties_init(return_value, ce, NULL);
-		zend_merge_properties(return_value, Z_ARRVAL(dataset), 1 TSRMLS_CC);
+		if (!ce->__set) {
+			props_merged = 1;
+			zend_merge_properties(return_value, Z_ARRVAL(dataset), 1 TSRMLS_CC);
+		}
 
 		if (ce->constructor) {
 			fci.size = sizeof(fci);
@@ -2820,6 +2824,10 @@ static void php_pgsql_fetch_hash(INTERNAL_FUNCTION_PARAMETERS, long result_type,
 
 			if (zend_call_function(&fci, &fcc TSRMLS_CC) == FAILURE) {
 				zend_throw_exception_ex(zend_exception_get_default(TSRMLS_C), 0 TSRMLS_CC, "Could not execute %s::%s()", ce->name, ce->constructor->common.function_name);
+				if (fci.params) {
+					efree(fci.params);
+				}
+				return;
 			} else {
 				if (retval_ptr) {
 					zval_ptr_dtor(&retval_ptr);
@@ -2830,6 +2838,11 @@ static void php_pgsql_fetch_hash(INTERNAL_FUNCTION_PARAMETERS, long result_type,
 			}
 		} else if (ctor_params) {
 			zend_throw_exception_ex(zend_exception_get_default(TSRMLS_C), 0 TSRMLS_CC, "Class %s does not have a constructor hence you cannot use ctor_params", ce->name);
+			return;
+		}
+
+		if (!props_merged) {
+			zend_merge_properties(return_value, Z_ARRVAL(dataset), 1 TSRMLS_CC);
 		}
 	}
 }

ext/pgsql/tests/bug71820.phpt

@@ -0,0 +1,93 @@
+--TEST--
+Bug #71820 pg_fetch_object bind parameters before call constructor
+--SKIPIF--
+<?php
+require_once('skipif.inc');
+?>
+--FILE--
+<?php
+
+require_once('config.inc');
+
+$tableName = 'test_pg_fetch_object';
+
+class TestRow
+{
+
+	private $set_from_constructor;
+	private $data;
+	private $hello = 42;
+
+	public function __construct($set_from_constructor)
+	{
+		$this->set_from_constructor = $set_from_constructor;
+	}
+
+	public function __set($name, $value)
+	{
+		if (!isset($this->data[$name])) {
+			/* $this->set_from_constructor has an expected value */
+			$this->data[$name] = 42 == $this->set_from_constructor ? $value : -1;
+			return;
+		}
+		throw new \Exception('Duplicity column name.');
+	}
+
+}
+
+$connection = pg_connect($conn_str);
+
+if (!$connection) {
+	die('Connection faild.');
+}
+
+$table = <<<SQL
+CREATE TABLE IF NOT EXISTS $tableName (
+  id serial NOT NULL,
+  name character varying NOT NULL
+);
+SQL;
+pg_query($connection, $table);
+
+pg_query_params('INSERT INTO ' . $tableName . ' (name) VALUES ($1), ($2);', ['$1' => 'Doe', '$2' => 'Joe']);
+
+$result = pg_query('SELECT * FROM ' . $tableName . ' LIMIT 10;');
+
+while ($row = pg_fetch_object($result, NULL, 'TestRow', [42])) {
+	var_dump($row);
+}
+
+pg_query($connection, "DROP TABLE $tableName");
+
+pg_close($connection);
+
+?>
+==DONE==
+--EXPECTF--
+object(TestRow)#%d (3) {
+  ["set_from_constructor":"TestRow":private]=>
+  int(42)
+  ["data":"TestRow":private]=>
+  array(2) {
+    ["id"]=>
+    string(1) "1"
+    ["name"]=>
+    string(3) "Doe"
+  }
+  ["hello":"TestRow":private]=>
+  int(42)
+}
+object(TestRow)#%d (3) {
+  ["set_from_constructor":"TestRow":private]=>
+  int(42)
+  ["data":"TestRow":private]=>
+  array(2) {
+    ["id"]=>
+    string(1) "2"
+    ["name"]=>
+    string(3) "Joe"
+  }
+  ["hello":"TestRow":private]=>
+  int(42)
+}
+==DONE==

ext/phar/phar.c

@@ -1791,8 +1791,11 @@ static int phar_analyze_path(const char *fname, const char *ext, int ext_len, in
 #ifdef PHP_WIN32
 				phar_unixify_path_separators(realpath, strlen(realpath));
 #endif
-				slash = strstr(realpath, filename) + ((ext - fname) + ext_len);
-				*slash = '\0';
+				slash = strstr(realpath, filename);
+				if (slash) {
+					slash += ((ext - fname) + ext_len);
+					*slash = '\0';
+				}
 				slash = strrchr(realpath, '/');
 
 				if (slash) {
@@ -2239,6 +2242,10 @@ int phar_split_fname(const char *filename, int filename_len, char **arch, int *a
 #endif
 	int ext_len;
 
+	if (CHECK_NULL_PATH(filename, filename_len)) {
+		return FAILURE;
+	}
+
 	if (!strncasecmp(filename, "phar://", 7)) {
 		filename += 7;
 		filename_len -= 7;

ext/phar/phar_object.c

@@ -478,7 +478,7 @@ PHP_METHOD(Phar, mount)
 	int fname_len, arch_len, entry_len, path_len, actual_len;
 	phar_archive_data **pphar;
 
-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ss", &path, &path_len, &actual, &actual_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "pp", &path, &path_len, &actual, &actual_len) == FAILURE) {
 		return;
 	}
 
@@ -960,7 +960,7 @@ PHP_METHOD(Phar, createDefaultStub)
 	int index_len = 0, webindex_len = 0;
 	size_t stub_len;
 
-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|ss", &index, &index_len, &webindex, &webindex_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|pp", &index, &index_len, &webindex, &webindex_len) == FAILURE) {
 		return;
 	}
 
@@ -1004,7 +1004,7 @@ PHP_METHOD(Phar, loadPhar)
 	char *fname, *alias = NULL, *error;
 	int fname_len, alias_len = 0;
 
-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|s!", &fname, &fname_len, &alias, &alias_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|s!", &fname, &fname_len, &alias, &alias_len) == FAILURE) {
 		return;
 	}
 
@@ -1083,7 +1083,7 @@ PHP_METHOD(Phar, isValidPharFilename)
 	int fname_len, ext_len, is_executable;
 	zend_bool executable = 1;
 
-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|b", &fname, &fname_len, &executable) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|b", &fname, &fname_len, &executable) == FAILURE) {
 		return;
 	}
 
@@ -1154,11 +1154,11 @@ PHP_METHOD(Phar, __construct)
 	is_data = instanceof_function(Z_OBJCE_P(zobj), phar_ce_data TSRMLS_CC);
 
 	if (is_data) {
-		if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|ls!l", &fname, &fname_len, &flags, &alias, &alias_len, &format) == FAILURE) {
+		if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|ls!l", &fname, &fname_len, &flags, &alias, &alias_len, &format) == FAILURE) {
 			return;
 		}
 	} else {
-		if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|ls!", &fname, &fname_len, &flags, &alias, &alias_len) == FAILURE) {
+		if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|ls!", &fname, &fname_len, &flags, &alias, &alias_len) == FAILURE) {
 			return;
 		}
 	}
@@ -1326,7 +1326,7 @@ PHP_METHOD(Phar, unlinkArchive)
 	int fname_len, zname_len, arch_len, entry_len;
 	phar_archive_data *phar;
 
-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &fname, &fname_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &fname, &fname_len) == FAILURE) {
 		RETURN_FALSE;
 	}
 
@@ -1756,7 +1756,7 @@ PHP_METHOD(Phar, buildFromDirectory)
 		return;
 	}
 
-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|s", &dir, &dir_len, &regex, &regex_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|s", &dir, &dir_len, &regex, &regex_len) == FAILURE) {
 		RETURN_FALSE;
 	}
 
@@ -2630,7 +2630,7 @@ PHP_METHOD(Phar, delete)
 		return;
 	}
 
-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &fname, &fname_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &fname, &fname_len) == FAILURE) {
 		RETURN_FALSE;
 	}
 
@@ -3442,7 +3442,7 @@ PHP_METHOD(Phar, copy)
 
 	PHAR_ARCHIVE_OBJECT();
 
-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ss", &oldfile, &oldfile_len, &newfile, &newfile_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "pp", &oldfile, &oldfile_len, &newfile, &newfile_len) == FAILURE) {
 		return;
 	}
 
@@ -3548,7 +3548,7 @@ PHP_METHOD(Phar, offsetExists)
 
 	PHAR_ARCHIVE_OBJECT();
 
-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &fname, &fname_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &fname, &fname_len) == FAILURE) {
 		return;
 	}
 
@@ -3585,7 +3585,7 @@ PHP_METHOD(Phar, offsetGet)
 	phar_entry_info *entry;
 	PHAR_ARCHIVE_OBJECT();
 
-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &fname, &fname_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &fname, &fname_len) == FAILURE) {
 		return;
 	}
 
@@ -3733,8 +3733,8 @@ PHP_METHOD(Phar, offsetSet)
 		return;
 	}
 
-	if (zend_parse_parameters_ex(ZEND_PARSE_PARAMS_QUIET, ZEND_NUM_ARGS() TSRMLS_CC, "sr", &fname, &fname_len, &zresource) == FAILURE
-	&& zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ss", &fname, &fname_len, &cont_str, &cont_len) == FAILURE) {
+	if (zend_parse_parameters_ex(ZEND_PARSE_PARAMS_QUIET, ZEND_NUM_ARGS() TSRMLS_CC, "pr", &fname, &fname_len, &zresource) == FAILURE
+	&& zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ps", &fname, &fname_len, &cont_str, &cont_len) == FAILURE) {
 		return;
 	}
 
@@ -3772,7 +3772,7 @@ PHP_METHOD(Phar, offsetUnset)
 		return;
 	}
 
-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &fname, &fname_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &fname, &fname_len) == FAILURE) {
 		return;
 	}
 
@@ -3819,7 +3819,7 @@ PHP_METHOD(Phar, addEmptyDir)
 
 	PHAR_ARCHIVE_OBJECT();
 
-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &dirname, &dirname_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &dirname, &dirname_len) == FAILURE) {
 		return;
 	}
 
@@ -3844,7 +3844,7 @@ PHP_METHOD(Phar, addFile)
 
 	PHAR_ARCHIVE_OBJECT();
 
-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|s", &fname, &fname_len, &localname, &localname_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|s", &fname, &fname_len, &localname, &localname_len) == FAILURE) {
 		return;
 	}
 
@@ -3888,7 +3888,7 @@ PHP_METHOD(Phar, addFromString)
 
 	PHAR_ARCHIVE_OBJECT();
 
-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ss", &localname, &localname_len, &cont_str, &cont_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ps", &localname, &localname_len, &cont_str, &cont_len) == FAILURE) {
 		return;
 	}
 
@@ -4315,7 +4315,7 @@ PHP_METHOD(Phar, extractTo)
 
 	PHAR_ARCHIVE_OBJECT();
 
-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|z!b", &pathto, &pathto_len, &zval_files, &overwrite) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|z!b", &pathto, &pathto_len, &zval_files, &overwrite) == FAILURE) {
 		return;
 	}
 
@@ -4454,7 +4454,7 @@ PHP_METHOD(PharFileInfo, __construct)
 	phar_archive_data *phar_data;
 	zval *zobj = getThis(), arg1;
 
-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &fname, &fname_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &fname, &fname_len) == FAILURE) {
 		return;
 	}
 

ext/phar/tar.c

@@ -500,7 +500,9 @@ bail:
 			entry.link = estrndup(hdr->linkname, linkname_len);
 		}
 		phar_set_inode(&entry TSRMLS_CC);
-		zend_hash_add(&myphar->manifest, entry.filename, entry.filename_len, (void*)&entry, sizeof(phar_entry_info), (void **) &newentry);
+
+		zend_hash_update(&myphar->manifest, entry.filename, entry.filename_len, (void*)&entry, sizeof(phar_entry_info), (void **) &newentry);
+		ZEND_ASSERT(newentry != NULL);
 
 		if (entry.is_persistent) {
 			++entry.manifest_pos;

ext/phar/tests/badparameters.phpt

@@ -126,19 +126,19 @@ echo $e->getMessage() . "\n";
 --EXPECTF--
 Warning: Phar::mungServer() expects parameter 1 to be array, %string given in %sbadparameters.php on line %d
 
-Warning: Phar::createDefaultStub() expects parameter 1 to be %string, array given in %sbadparameters.php on line %d
+Warning: Phar::createDefaultStub() expects parameter 1 to be a valid path, array given in %sbadparameters.php on line %d
 
-Warning: Phar::loadPhar() expects parameter 1 to be %string, array given in %sbadparameters.php on line %d
+Warning: Phar::loadPhar() expects parameter 1 to be a valid path, array given in %sbadparameters.php on line %d
 
 Warning: Phar::canCompress() expects parameter 1 to be long, %string given in %sbadparameters.php on line %d
 
-Warning: Phar::__construct() expects parameter 1 to be %string, array given in %sbadparameters.php on line %d
+Warning: Phar::__construct() expects parameter 1 to be a valid path, array given in %sbadparameters.php on line %d
 
 Warning: Phar::convertToExecutable() expects parameter 1 to be long, array given in %sbadparameters.php on line %d
 
 Warning: Phar::convertToData() expects parameter 1 to be long, array given in %sbadparameters.php on line %d
 
-Warning: PharData::delete() expects parameter 1 to be %string, array given in %sbadparameters.php on line %d
+Warning: PharData::delete() expects parameter 1 to be a valid path, array given in %sbadparameters.php on line %d
 Cannot write out phar archive, phar is read-only
 Entry oops does not exist and cannot be deleted
 %sfiles/frontcontroller10.phar
@@ -165,18 +165,18 @@ Phar is readonly, cannot change compression
 Warning: Phar::copy() expects exactly 2 parameters, 1 given in %sbadparameters.php on line %d
 Cannot copy "a" to "b", phar is read-only
 
-Warning: Phar::offsetExists() expects parameter 1 to be %string, array given in %sbadparameters.php on line %d
+Warning: Phar::offsetExists() expects parameter 1 to be a valid path, array given in %sbadparameters.php on line %d
 
-Warning: Phar::offsetGet() expects parameter 1 to be %string, array given in %sbadparameters.php on line %d
+Warning: Phar::offsetGet() expects parameter 1 to be a valid path, array given in %sbadparameters.php on line %d
 
 Warning: Phar::offsetSet() expects exactly 2 parameters, 1 given in %sbadparameters.php on line %d
 
-Warning: PharData::offsetUnset() expects parameter 1 to be %string, array given in %sbadparameters.php on line %d
+Warning: PharData::offsetUnset() expects parameter 1 to be a valid path, array given in %sbadparameters.php on line %d
 Write operations disabled by the php.ini setting phar.readonly
 
-Warning: Phar::addEmptyDir() expects parameter 1 to be %string, array given in %sbadparameters.php on line %d
+Warning: Phar::addEmptyDir() expects parameter 1 to be a valid path, array given in %sbadparameters.php on line %d
 
-Warning: Phar::addFile() expects parameter 1 to be %string, array given in %sbadparameters.php on line %d
+Warning: Phar::addFile() expects parameter 1 to be a valid path, array given in %sbadparameters.php on line %d
 
 Warning: Phar::addFromString() expects exactly 2 parameters, 1 given in %sbadparameters.php on line %d
 Write operations disabled by the php.ini setting phar.readonly

ext/phar/tests/bug64931/bug64931.phpt

@@ -48,11 +48,12 @@ try {
 <?php
 @unlink(__DIR__."/bug64931.phar");
 ?>
---EXPECT--
+--EXPECTF--
 Test
 CAUGHT: Cannot create any files in magic ".phar" directory
 CAUGHT: Cannot create any files in magic ".phar" directory
 CAUGHT: Cannot create any files in magic ".phar" directory
 CAUGHT: Cannot create any files in magic ".phar" directory
-CAUGHT: Cannot create any files in magic ".phar" directory
-===DONE===
+
+Warning: Phar::addFromString() expects parameter 1 to be a valid path, string given in %s%ebug64931.php on line %d
+===DONE===

ext/phar/tests/bug71498.phpt

@@ -13,5 +13,5 @@ $p = new PharData(__DIR__."/bug71498.zip");
 
 DONE
 --EXPECTF--
-phar error: end of central directory not found in zip-based phar "%s/bug71498.zip"
-DONE
+phar error: end of central directory not found in zip-based phar "%s%ebug71498.zip"
+DONE

ext/phar/tests/bug71625.phpt

@@ -0,0 +1,25 @@
+--TEST--
+Phar - Bug #71625 - Crash in php7.dll
+--INI--
+phar.readonly=0
+--SKIPIF--
+<?php 
+
+if (!extension_loaded("phar") || !extension_loaded("zlib")) die("skip");
+if(substr(PHP_OS, 0, 3) != 'WIN' ) {
+    die('skip windows only test');
+}
+
+?>
+--FILE--
+<?php
+$phar = new Phar("A:A:.phar");
+$phar["hello_habr.txt"] = '<? Hello Habr!?>';
+?>
+DONE
+--EXPECTF--
+Fatal error: Uncaught exception 'UnexpectedValueException' with message 'Cannot create phar 'A:A:.phar', file extension (or combination) not recognised or the directory does not exist' in %sbug71625.php:%d
+Stack trace:
+#0 %sbug71625.php(%d): Phar->__construct('A:A:.phar')
+#1 {main}
+  thrown in %sbug71625.php on line %d

ext/phar/tests/create_path_error.phpt

@@ -75,11 +75,10 @@ string(5) "query"
 6:
 7:
 8:
-9:Error: file_put_contents(phar://%s): failed to open stream: phar error: invalid path "%s" contains illegal character
-10:Error: file_put_contents(phar://%s): failed to open stream: phar error: invalid path "%s" contains illegal character
-11:Error: file_put_contents(phar://%s): failed to open stream: phar error: invalid path "%s" contains illegal character
-12:Error: file_put_contents(phar://%s): failed to open stream: phar error: invalid path "%s" contains illegal character
-13:Error: file_put_contents(phar://%s): failed to open stream: phar error: invalid path "%s" contains illegal character
-Exception: Entry a does not exist and cannot be created: phar error: invalid path "a" contains illegal character
-===DONE===
+9:Error: file_put_contents(phar:///%s): failed to open stream: phar error: invalid path "%s" contains illegal character
+10:Error: file_put_contents(phar:///%s): failed to open stream: phar error: invalid path "%s" contains illegal character
+11:Error: file_put_contents(phar:///%s): failed to open stream: phar error: invalid path "%s" contains illegal character
+12:Error: file_put_contents(phar:///%s): failed to open stream: phar error: invalid path "%s" contains illegal character
+13:Error: file_put_contents(phar:///%s): failed to open stream: phar error: invalid path "%s" contains illegal character
+Error: Phar::offsetSet() expects parameter 1 to be a valid path, string given===DONE===
 

ext/phar/tests/phar_extract.phpt

@@ -138,7 +138,7 @@ string(3) "hi2"
 bool(false)
 Invalid argument, expected a filename (string) or array of filenames
 
-Warning: Phar::extractTo() expects parameter 1 to be %string, array given in %sphar_extract.php on line %d
+Warning: Phar::extractTo() expects parameter 1 to be a valid path, array given in %sphar_extract.php on line %d
 Invalid argument, extraction path must be non-zero length
 Unable to use path "%soops" for extraction, it is a file, must be a directory
 Invalid argument, array of filenames to extract contains non-string value

ext/phar/tests/phar_isvalidpharfilename.phpt

@@ -76,7 +76,7 @@ var_dump(Phar::isValidPharFilename('dir.phar.php', false));
 <?php
 rmdir(dirname(__FILE__) . '/.phar');
 --EXPECTF--
-Warning: Phar::isValidPharFilename() expects parameter 1 to be %string, array given in %sphar_isvalidpharfilename.php on line %d
+Warning: Phar::isValidPharFilename() expects parameter 1 to be a valid path, array given in %sphar_isvalidpharfilename.php on line %d
 *
 bool(false)
 bool(false)

ext/phar/tests/phar_unlinkarchive.phpt

@@ -90,7 +90,7 @@ Unknown phar archive ""
 Unknown phar archive "%sphar_unlinkarchive.phar"
 Unknown phar archive "%sphar_unlinkarchive.phar.tar": internal corruption of phar "%sphar_unlinkarchive.phar.tar" (truncated entry)
 
-Warning: Phar::unlinkArchive() expects parameter 1 to be %string, array given in %sphar_unlinkarchive.php on line %d
+Warning: Phar::unlinkArchive() expects parameter 1 to be a valid path, array given in %sphar_unlinkarchive.php on line %d
 bool(false)
 string(48) "<?php echo "first stub\n"; __HALT_COMPILER(); ?>"
 phar archive "%sphar_unlinkarchive.phar" has open file handles or objects.  fclose() all file handles, and unset() all objects prior to calling unlinkArchive()

ext/phar/tests/pharfileinfo_construct.phpt

@@ -47,7 +47,7 @@ echo $e->getMessage() . "\n";
 --EXPECTF--
 Cannot open phar file 'phar://%spharfileinfo_construct.phar/oops': internal corruption of phar "%spharfileinfo_construct.phar" (truncated entry)
 
-Warning: PharFileInfo::__construct() expects parameter 1 to be %string, array given in %spharfileinfo_construct.php on line %d
+Warning: PharFileInfo::__construct() expects parameter 1 to be a valid path, array given in %spharfileinfo_construct.php on line %d
 Cannot access phar file entry '/oops/I/do/not/exist' in archive '%spharfileinfo_construct.phar'
 Cannot call constructor twice
 '%spharfileinfo_construct.php' is not a valid phar archive URL (must have at least phar://filename.phar)

ext/phar/tests/tar/bug71317-duplicate-filename.phpt

@@ -0,0 +1,50 @@
+--TEST--
+Bug #71317: regression in opening tar based phar files
+--SKIPIF--
+<?php if (!extension_loaded('phar')) die('skip'); ?>
+<?php if (!extension_loaded("spl")) die("skip SPL not available"); ?>
+<?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>
+--FILE--
+<?php
+include dirname(__FILE__) . '/files/tarmaker.php.inc';
+
+$testDirectory = __DIR__ . '/files/test_bug71317';
+$testTarFilename  = __DIR__ . '/files/test_bug71317.tar';
+
+$tar = new tarmaker($testTarFilename, 'none');
+$tar->init();
+$tar->addFile('file1.txt', 'file1');
+$tar->addFile('file2.txt', 'file2');
+$tar->addFile('file3.txt', 'file3');
+$tar->addFile('file4.txt', 'file4');
+$tar->addFile('file5.txt', 'file5');
+$tar->addFile('file2.txt', 'file2a');
+$tar->close();
+
+$fname = str_replace('\\', '/', $testTarFilename);
+try {
+	mkdir($testDirectory);
+	$tar = new PharData($fname);
+	$tar->extractTo($testDirectory);
+
+	$fileContent = file_get_contents($testDirectory . '/file2.txt');
+	$expectedContent = 'file2a';
+	if ($fileContent !== $expectedContent) {
+		throw new Exception(sprintf('Contents of file2.txt ("%s") is invalid, expected "%s"', $fileContent, $expectedContent));
+	}
+} catch(Exception $e) {
+	echo $e->getMessage() . "\n";
+}
+?>
+===DONE===
+--CLEAN--
+<?php
+$testDirectory = __DIR__ . '/files/test_bug71317';
+$testTarFilename  = __DIR__ . '/files/test_bug71317.tar';
+
+unlink($testTarFilename);
+array_map('unlink', glob($testDirectory . "/*.txt"));
+rmdir($testDirectory);
+?>
+--EXPECT--
+===DONE===

ext/phar/tests/tar/bug71504.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug #71504: Parsing of tar file with duplicate filenames causes memory leak
+--SKIPIF--
+<?php if (!extension_loaded('phar')) die('skip'); ?>
+<?php if (!extension_loaded("spl")) die("skip SPL not available"); ?>
+<?php if (!extension_loaded("zlib")) die("skip zlib not available"); ?>
+--FILE--
+<?php
+$fname = str_replace('\\', '/', dirname(__FILE__) . '/files/HTML_CSS-1.5.4.tgz');
+try {
+	$tar = new PharData($fname);
+} catch(Exception $e) {
+	echo $e->getMessage() . "\n";
+}
+?>
+===DONE===
+--EXPECT--
+===DONE===

ext/simplexml/simplexml.c

@@ -1129,7 +1129,7 @@ static HashTable * sxe_get_prop_hash(zval *object, int is_debug TSRMLS_DC) /* {{
 			node = NULL;
 		} else if (sxe->iter.type != SXE_ITER_CHILD) {
 
-			if ( sxe->iter.type == SXE_ITER_NONE || !node->children || !node->parent || node->children->next || node->children->children || node->parent->children == node->parent->last ) {
+			if ( sxe->iter.type == SXE_ITER_NONE || !node->children || !node->parent || !node->next || node->children->next || node->children->children || node->parent->children == node->parent->last ) {
 				node = node->children;
 			} else {
 				iter_data = sxe->iter.data;

ext/simplexml/tests/bug66084_1.phpt

@@ -5,12 +5,14 @@ Bug #66084 simplexml_load_string() mangles empty node name, json variant
 <?php if (!extension_loaded("json")) print "skip json not available"; ?>
 --FILE--
 <?php
+echo json_encode(simplexml_load_string('<a><b/><c><x/></c></a>')->c), "\n";
 echo json_encode(simplexml_load_string('<a><b/><c><x/></c></a>')), "\n";
 echo json_encode(simplexml_load_string('<a><b/><d/><c><x/></c></a>')), "\n";
 echo json_encode(simplexml_load_string('<a><b/><c><d/><x/></c></a>')), "\n";
 echo json_encode(simplexml_load_string('<a><b/><c><d><x/></d></c></a>')), "\n";
 ?>
 --EXPECT--
+{"x":{}}
 {"b":{},"c":{"x":{}}}
 {"b":{},"d":{},"c":{"x":{}}}
 {"b":{},"c":{"d":{},"x":{}}}

ext/snmp/snmp.c

@@ -531,7 +531,7 @@ static void php_snmp_error(zval *object, const char *docref TSRMLS_DC, int type,
 	}
 
 	if (object && (snmp_object->exceptions_enabled & type)) {
-		zend_throw_exception_ex(php_snmp_exception_ce, type TSRMLS_CC, snmp_object->snmp_errstr);
+		zend_throw_exception_ex(php_snmp_exception_ce, type TSRMLS_CC, "%s", snmp_object->snmp_errstr);
 	} else {
 		va_start(args, format);
 		php_verror(docref, "", E_WARNING, format, args TSRMLS_CC);

ext/spl/spl_observer.c

@@ -275,11 +275,6 @@ static zend_object_value spl_object_storage_new_ex(zend_class_entry *class_type,
 	retval.handle = zend_objects_store_put(intern, (zend_objects_store_dtor_t)zend_objects_destroy_object, (zend_objects_free_object_storage_t) spl_SplOjectStorage_free_storage, NULL TSRMLS_CC);
 	retval.handlers = &spl_handler_SplObjectStorage;
 
-	if (orig) {
-		spl_SplObjectStorage *other = (spl_SplObjectStorage*)zend_object_store_get_object(orig TSRMLS_CC);
-		spl_object_storage_addall(intern, orig, other TSRMLS_CC);
-	}
-
 	while (parent) {
 		if (parent == spl_ce_SplObjectStorage) {
 			if (class_type != spl_ce_SplObjectStorage) {
@@ -294,6 +289,11 @@ static zend_object_value spl_object_storage_new_ex(zend_class_entry *class_type,
 		parent = parent->parent;
 	}
 
+	if (orig) {
+		spl_SplObjectStorage *other = (spl_SplObjectStorage*)zend_object_store_get_object(orig TSRMLS_CC);
+		spl_object_storage_addall(intern, orig, other TSRMLS_CC);
+	}
+
 	return retval;
 }
 /* }}} */

ext/spl/tests/SplObjectStorage_unserialize_bad.phpt

@@ -44,5 +44,5 @@ object(SplObjectStorage)#2 (1) {
     }
   }
 }
-Error at offset 79 of 78 bytes
+Error at offset 78 of 78 bytes
 DONE

ext/spl/tests/bug67582.phpt

@@ -0,0 +1,24 @@
+--TEST--
+Bug #67582: Cloned SplObjectStorage with overwritten getHash fails offsetExists()
+--FILE--
+<?php
+
+class MyObjectStorage extends SplObjectStorage {
+	// Overwrite getHash() with just some (working) test-method
+	public function getHash($object) { return get_class($object); }
+}
+
+class TestObject {}
+
+$list = new MyObjectStorage();
+$list->attach(new TestObject());
+
+foreach($list as $x) var_dump($list->offsetExists($x));
+
+$list2 = clone $list;
+foreach($list2 as $x) var_dump($list2->offsetExists($x));
+
+?>
+--EXPECT--
+bool(true)
+bool(true)

ext/standard/config.m4

@@ -69,11 +69,12 @@ AC_CACHE_CHECK(for standard DES crypt, ac_cv_crypt_des,[
 #include <crypt.h>
 #endif
 
-main() {
+int main() {
 #if HAVE_CRYPT
-    exit (strcmp((char *)crypt("rasmuslerdorf","rl"),"rl.3StKT.4T8M"));
+	char *encrypted = crypt("rasmuslerdorf","rl");
+	exit(!encrypted || strcmp(encrypted,"rl.3StKT.4T8M"));
 #else
-	exit(0);
+	exit(1);
 #endif
 }],[
   ac_cv_crypt_des=yes
@@ -93,11 +94,12 @@ AC_CACHE_CHECK(for extended DES crypt, ac_cv_crypt_ext_des,[
 #include <crypt.h>
 #endif
 
-main() {
+int main() {
 #if HAVE_CRYPT
-  exit (strcmp((char *)crypt("rasmuslerdorf","_J9..rasm"),"_J9..rasmBYk8r9AiWNc"));
+	char *encrypted = crypt("rasmuslerdorf","_J9..rasm");
+	exit(!encrypted || strcmp(encrypted,"_J9..rasmBYk8r9AiWNc"));
 #else
-  exit(0);
+	exit(1);
 #endif
 }],[
   ac_cv_crypt_ext_des=yes
@@ -117,20 +119,22 @@ AC_TRY_RUN([
 #include <crypt.h>
 #endif
 
-main() {
+int main() {
 #if HAVE_CRYPT
-    char salt[15], answer[40];
+	char salt[15], answer[40];
+	char *encrypted;
 
-    salt[0]='$'; salt[1]='1'; salt[2]='$'; 
-    salt[3]='r'; salt[4]='a'; salt[5]='s';
-    salt[6]='m'; salt[7]='u'; salt[8]='s';
-    salt[9]='l'; salt[10]='e'; salt[11]='$';
-    salt[12]='\0';
-    strcpy(answer,salt);
-    strcat(answer,"rISCgZzpwk3UhDidwXvin0");
-    exit (strcmp((char *)crypt("rasmuslerdorf",salt),answer));
+	salt[0]='$'; salt[1]='1'; salt[2]='$'; 
+	salt[3]='r'; salt[4]='a'; salt[5]='s';
+	salt[6]='m'; salt[7]='u'; salt[8]='s';
+	salt[9]='l'; salt[10]='e'; salt[11]='$';
+	salt[12]='\0';
+	strcpy(answer,salt);
+	strcat(answer,"rISCgZzpwk3UhDidwXvin0");
+	encrypted = crypt("rasmuslerdorf",salt);
+	exit(!encrypted || strcmp(encrypted,answer));
 #else
-	exit(0);
+	exit(1);
 #endif
 }],[
   ac_cv_crypt_md5=yes
@@ -150,17 +154,19 @@ AC_TRY_RUN([
 #include <crypt.h>
 #endif
 
-main() {
+int main() {
 #if HAVE_CRYPT
-    char salt[30], answer[70];
-    
-    salt[0]='$'; salt[1]='2'; salt[2]='a'; salt[3]='$'; salt[4]='0'; salt[5]='7'; salt[6]='$'; salt[7]='\0';
-    strcat(salt,"rasmuslerd............");
-    strcpy(answer,salt);
-    strcpy(&answer[29],"nIdrcHdxcUxWomQX9j6kvERCFjTg7Ra");
-    exit (strcmp((char *)crypt("rasmuslerdorf",salt),answer));
+	char salt[30], answer[70];
+	char *encrypted;
+
+	salt[0]='$'; salt[1]='2'; salt[2]='a'; salt[3]='$'; salt[4]='0'; salt[5]='7'; salt[6]='$'; salt[7]='\0';
+	strcat(salt,"rasmuslerd............");
+	strcpy(answer,salt);
+	strcpy(&answer[29],"nIdrcHdxcUxWomQX9j6kvERCFjTg7Ra");
+	encrypted = crypt("rasmuslerdorf",salt);
+	exit(!encrypted || strcmp(encrypted,answer));
 #else
-	exit(0);
+	exit(1);
 #endif
 }],[
   ac_cv_crypt_blowfish=yes
@@ -180,16 +186,18 @@ AC_TRY_RUN([
 #include <crypt.h>
 #endif
 
-main() {
+int main() {
 #if HAVE_CRYPT
-    char salt[21], answer[21+86];
+	char salt[21], answer[21+86];
+	char *encrypted;
 
-    strcpy(salt,"\$6\$rasmuslerdorf\$");
-    strcpy(answer, salt);
-    strcat(answer, "EeHCRjm0bljalWuALHSTs1NB9ipEiLEXLhYeXdOpx22gmlmVejnVXFhd84cEKbYxCo.XuUTrW.RLraeEnsvWs/");
-    exit (strcmp((char *)crypt("rasmuslerdorf",salt),answer));
+	strcpy(salt,"\$6\$rasmuslerdorf\$");
+	strcpy(answer, salt);
+	strcat(answer, "EeHCRjm0bljalWuALHSTs1NB9ipEiLEXLhYeXdOpx22gmlmVejnVXFhd84cEKbYxCo.XuUTrW.RLraeEnsvWs/");
+	encrypted = crypt("rasmuslerdorf",salt);
+	exit(!encrypted || strcmp(encrypted,answer));
 #else
-	exit(0);
+	exit(1);
 #endif
 }],[
   ac_cv_crypt_sha512=yes
@@ -209,17 +217,18 @@ AC_TRY_RUN([
 #include <crypt.h>
 #endif
 
-main() {
+int main() {
 #if HAVE_CRYPT
-    char salt[21], answer[21+43];
-
-    strcpy(salt,"\$5\$rasmuslerdorf\$");
-    strcpy(answer, salt);
-    strcat(answer, "cFAm2puLCujQ9t.0CxiFIIvFi4JyQx5UncCt/xRIX23");
-    exit (strcmp((char *)crypt("rasmuslerdorf",salt),answer));
+	char salt[21], answer[21+43];
+	char *encrypted;
 
+	strcpy(salt,"\$5\$rasmuslerdorf\$");
+	strcpy(answer, salt);
+	strcat(answer, "cFAm2puLCujQ9t.0CxiFIIvFi4JyQx5UncCt/xRIX23");
+	encrypted = crypt("rasmuslerdorf",salt);
+	exit(!encrypted || strcmp(encrypted,answer));
 #else
-	exit(0);
+	exit(1);
 #endif
 }],[
   ac_cv_crypt_sha256=yes

ext/standard/crypt.c

@@ -236,18 +236,23 @@ PHPAPI int php_crypt(const char *password, const int pass_len, const char *salt,
 #  elif defined(CRYPT_R_CRYPTD)
 		CRYPTD buffer;
 #  else
-#    error Data struct used by crypt_r() is unknown. Please report.
+#   error Data struct used by crypt_r() is unknown. Please report.
 #  endif
 		crypt_res = crypt_r(password, salt, &buffer);
-		if (!crypt_res || (salt[0] == '*' && salt[1] == '0')) {
-			return FAILURE;
-		} else {
-			*result = estrdup(crypt_res);
-			return SUCCESS;
-		}
 	}
+# elif defined(HAVE_CRYPT)
+	crypt_res = crypt(password, salt);
+# else
+#  error No crypt() implementation
 # endif
 #endif
+
+	if (!crypt_res || (salt[0] == '*' && salt[1] == '0')) {
+		return FAILURE;
+	} else {
+		*result = estrdup(crypt_res);
+		return SUCCESS;
+	}
 }
 /* }}} */
 

ext/standard/flock_compat.c

@@ -127,7 +127,7 @@ PHPAPI int php_flock(int fd, int operation)
     {0, 0, 0, 0, NULL};
 	DWORD err;
 
-    if (hdl < 0) {
+    if (INVALID_HANDLE_VALUE == hdl) {
 		_set_errno(EBADF);
         return -1;              /* error in file descriptor */
 	}

ext/standard/tests/serialize/bug71840.phpt

@@ -0,0 +1,9 @@
+--TEST--
+Bug #71840 (Unserialize accepts wrongly data)
+--FILE--
+<?php
+var_dump(unserialize('a:1:{s:0:""0a:0:{}}'));
+?>
+--EXPECTF--
+Notice: unserialize(): Error at offset 11 of 19 bytes in %sbug71840.php on line %d
+bool(false)

ext/standard/url.c

@@ -599,7 +599,7 @@ PHPAPI int php_url_decode(char *str, int len)
  */
 PHPAPI char *php_raw_url_encode(char const *s, int len, int *new_length)
 {
-	register int x, y;
+	register size_t x, y;
 	unsigned char *str;
 
 	str = (unsigned char *) safe_emalloc(3, len, 1);

ext/standard/uuencode.c

@@ -168,7 +168,7 @@ PHPAPI int php_uudecode(char *src, int src_len, char **dest) /* {{{ */
 		s++;
 	}
 
-	if ((len = total_len > (p - *dest))) {
+	if ((len = total_len) > (p - *dest)) {
 		*p++ = PHP_UU_DEC(*s) << 2 | PHP_UU_DEC(*(s + 1)) >> 4;
 		if (len > 1) {
 			*p++ = PHP_UU_DEC(*(s + 1)) << 4 | PHP_UU_DEC(*(s + 2)) >> 2;

ext/standard/var_unserializer.c

@@ -1,4 +1,4 @@
-/* Generated by re2c 0.13.7.5 */
+/* Generated by re2c 0.13.5 */
 #line 1 "ext/standard/var_unserializer.re"
 /*
   +----------------------------------------------------------------------+
@@ -542,7 +542,7 @@ yy2:
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych == ':') goto yy95;
 yy3:
-#line 840 "ext/standard/var_unserializer.re"
+#line 851 "ext/standard/var_unserializer.re"
 	{ return 0; }
 #line 548 "ext/standard/var_unserializer.c"
 yy4:
@@ -587,7 +587,7 @@ yy13:
 	goto yy3;
 yy14:
 	++YYCURSOR;
-#line 834 "ext/standard/var_unserializer.re"
+#line 845 "ext/standard/var_unserializer.re"
 	{
 	/* this is the case where we have less data than planned */
 	php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Unexpected end of serialized data");
@@ -619,12 +619,11 @@ yy20:
 	if (yybm[0+yych] & 128) {
 		goto yy20;
 	}
-	if (yych <= '/') goto yy18;
-	if (yych >= ';') goto yy18;
+	if (yych != ':') goto yy18;
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 687 "ext/standard/var_unserializer.re"
+#line 698 "ext/standard/var_unserializer.re"
 	{
 	size_t len, len2, len3, maxlen;
 	long elements;
@@ -771,7 +770,7 @@ yy20:
 
 	return object_common2(UNSERIALIZE_PASSTHRU, elements);
 }
-#line 775 "ext/standard/var_unserializer.c"
+#line 774 "ext/standard/var_unserializer.c"
 yy25:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -796,7 +795,7 @@ yy27:
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 678 "ext/standard/var_unserializer.re"
+#line 689 "ext/standard/var_unserializer.re"
 	{
     if (!var_hash) return 0;
 
@@ -805,7 +804,7 @@ yy27:
 	return object_common2(UNSERIALIZE_PASSTHRU,
 			object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR));
 }
-#line 809 "ext/standard/var_unserializer.c"
+#line 808 "ext/standard/var_unserializer.c"
 yy32:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy33;
@@ -826,7 +825,7 @@ yy34:
 	yych = *++YYCURSOR;
 	if (yych != '{') goto yy18;
 	++YYCURSOR;
-#line 657 "ext/standard/var_unserializer.re"
+#line 668 "ext/standard/var_unserializer.re"
 	{
 	long elements = parse_iv(start + 2);
 	/* use iv() not uiv() in order to check data range */
@@ -847,7 +846,7 @@ yy34:
 
 	return finish_nested_data(UNSERIALIZE_PASSTHRU);
 }
-#line 851 "ext/standard/var_unserializer.c"
+#line 850 "ext/standard/var_unserializer.c"
 yy39:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy40;
@@ -868,7 +867,7 @@ yy41:
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 628 "ext/standard/var_unserializer.re"
+#line 633 "ext/standard/var_unserializer.re"
 	{
 	size_t len, maxlen;
 	char *str;
@@ -890,6 +889,12 @@ yy41:
 		return 0;
 	}
 
+	if (*(YYCURSOR + 1) != ';') {
+		efree(str);
+		*p = YYCURSOR + 1;
+		return 0;
+	}
+
 	YYCURSOR += 2;
 	*p = YYCURSOR;
 
@@ -897,7 +902,7 @@ yy41:
 	ZVAL_STRINGL(*rval, str, len, 0);
 	return 1;
 }
-#line 901 "ext/standard/var_unserializer.c"
+#line 906 "ext/standard/var_unserializer.c"
 yy46:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy47;
@@ -939,6 +944,11 @@ yy48:
 		return 0;
 	}
 
+	if (*(YYCURSOR + 1) != ';') {
+		*p = YYCURSOR + 1;
+		return 0;
+	}
+
 	YYCURSOR += 2;
 	*p = YYCURSOR;
 
@@ -946,7 +956,7 @@ yy48:
 	ZVAL_STRINGL(*rval, str, len, 1);
 	return 1;
 }
-#line 950 "ext/standard/var_unserializer.c"
+#line 960 "ext/standard/var_unserializer.c"
 yy53:
 	yych = *++YYCURSOR;
 	if (yych <= '/') {
@@ -1044,7 +1054,7 @@ use_double:
 	ZVAL_DOUBLE(*rval, zend_strtod((const char *)start + 2, NULL));
 	return 1;
 }
-#line 1048 "ext/standard/var_unserializer.c"
+#line 1058 "ext/standard/var_unserializer.c"
 yy65:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1118,7 +1128,7 @@ yy73:
 
 	return 1;
 }
-#line 1122 "ext/standard/var_unserializer.c"
+#line 1132 "ext/standard/var_unserializer.c"
 yy76:
 	yych = *++YYCURSOR;
 	if (yych == 'N') goto yy73;
@@ -1172,7 +1182,7 @@ yy79:
 	ZVAL_LONG(*rval, parse_iv(start + 2));
 	return 1;
 }
-#line 1176 "ext/standard/var_unserializer.c"
+#line 1186 "ext/standard/var_unserializer.c"
 yy83:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy18;
@@ -1187,7 +1197,7 @@ yy83:
 	ZVAL_BOOL(*rval, parse_iv(start + 2));
 	return 1;
 }
-#line 1191 "ext/standard/var_unserializer.c"
+#line 1201 "ext/standard/var_unserializer.c"
 yy87:
 	++YYCURSOR;
 #line 534 "ext/standard/var_unserializer.re"
@@ -1197,7 +1207,7 @@ yy87:
 	ZVAL_NULL(*rval);
 	return 1;
 }
-#line 1201 "ext/standard/var_unserializer.c"
+#line 1211 "ext/standard/var_unserializer.c"
 yy89:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1243,7 +1253,7 @@ yy91:
 
 	return 1;
 }
-#line 1247 "ext/standard/var_unserializer.c"
+#line 1257 "ext/standard/var_unserializer.c"
 yy95:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1287,9 +1297,9 @@ yy97:
 
 	return 1;
 }
-#line 1291 "ext/standard/var_unserializer.c"
+#line 1301 "ext/standard/var_unserializer.c"
 }
-#line 842 "ext/standard/var_unserializer.re"
+#line 853 "ext/standard/var_unserializer.re"
 
 
 	return 0;

ext/standard/var_unserializer.re

@@ -617,6 +617,11 @@ use_double:
 		return 0;
 	}
 
+	if (*(YYCURSOR + 1) != ';') {
+		*p = YYCURSOR + 1;
+		return 0;
+	}
+
 	YYCURSOR += 2;
 	*p = YYCURSOR;
 
@@ -646,6 +651,12 @@ use_double:
 		return 0;
 	}
 
+	if (*(YYCURSOR + 1) != ';') {
+		efree(str);
+		*p = YYCURSOR + 1;
+		return 0;
+	}
+
 	YYCURSOR += 2;
 	*p = YYCURSOR;
 

ext/xml/tests/bug72099.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Bug #72099: xml_parse_into_struct segmentation fault
+--SKIPIF--
+<?php
+require_once("skipif.inc");
+?>
+--FILE--
+<?php
+$var1=xml_parser_create_ns();
+$var2=str_repeat("a", 10);
+$var3=[];
+$var4=[];
+xml_parse_into_struct($var1, $var2, $var3, $var4);
+var_dump($var3);
+--EXPECT--
+array(0) {
+}

ext/xml/xml.c

@@ -283,7 +283,7 @@ xml_encoding xml_encodings[] = {
 static XML_Memory_Handling_Suite php_xml_mem_hdlrs;
 
 /* True globals, no need for thread safety */
-static int le_xml_parser; 
+static int le_xml_parser;
 
 /* }}} */
 
@@ -343,7 +343,7 @@ PHP_MINIT_FUNCTION(xml)
 	REGISTER_LONG_CONSTANT("XML_OPTION_SKIP_WHITE", PHP_XML_OPTION_SKIP_WHITE, CONST_CS|CONST_PERSISTENT);
 
 	/* this object should not be pre-initialised at compile time,
-	   as the order of members may vary */  
+	   as the order of members may vary */
 
 	php_xml_mem_hdlrs.malloc_fcn = php_xml_malloc_wrapper;
 	php_xml_mem_hdlrs.realloc_fcn = php_xml_realloc_wrapper;
@@ -404,7 +404,7 @@ static zval *_xml_xmlchar_zval(const XML_Char *s, int len, const XML_Char *encod
 {
 	zval *ret;
 	MAKE_STD_ZVAL(ret);
-	
+
 	if (s == NULL) {
 		ZVAL_FALSE(ret);
 		return ret;
@@ -422,7 +422,7 @@ static zval *_xml_xmlchar_zval(const XML_Char *s, int len, const XML_Char *encod
 static void xml_parser_dtor(zend_rsrc_list_entry *rsrc TSRMLS_DC)
 {
 	xml_parser *parser = (xml_parser *)rsrc->ptr;
-	
+
 	if (parser->parser) {
 		XML_ParserFree(parser->parser);
 	}
@@ -503,7 +503,7 @@ static void xml_set_handler(zval **handler, zval **data)
 /* {{{ xml_call_handler() */
 static zval *xml_call_handler(xml_parser *parser, zval *handler, zend_function *function_ptr, int argc, zval **argv)
 {
-	int i;	
+	int i;
 	TSRMLS_FETCH();
 
 	if (parser && handler && !EG(exception)) {
@@ -516,7 +516,7 @@ static zval *xml_call_handler(xml_parser *parser, zval *handler, zend_function *
 		for (i = 0; i < argc; i++) {
 			args[i] = &argv[i];
 		}
-		
+
 		fci.size = sizeof(fci);
 		fci.function_table = EG(function_table);
 		fci.function_name = handler;
@@ -540,7 +540,7 @@ static zval *xml_call_handler(xml_parser *parser, zval *handler, zend_function *
 					   Z_TYPE_PP(obj) == IS_OBJECT &&
 					   Z_TYPE_PP(method) == IS_STRING) {
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to call handler %s::%s()", Z_OBJCE_PP(obj)->name, Z_STRVAL_PP(method));
-			} else 
+			} else
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to call handler");
 		}
 
@@ -739,14 +739,14 @@ static void _xml_add_to_info(xml_parser *parser,char *name)
 
 	if (zend_hash_find(Z_ARRVAL_P(parser->info),name,strlen(name) + 1,(void **) &element) == FAILURE) {
 		MAKE_STD_ZVAL(values);
-		
+
 		array_init(values);
-		
+
 		zend_hash_update(Z_ARRVAL_P(parser->info), name, strlen(name)+1, (void *) &values, sizeof(zval*), (void **) &element);
-	} 
-			
+	}
+
 	add_next_index_long(*element,parser->curtag);
-	
+
 	parser->curtag++;
 }
 /* }}} */
@@ -798,11 +798,11 @@ void _xml_startElementHandler(void *userData, const XML_Char *name, const XML_Ch
 
 				efree(att);
 			}
-			
+
 			if ((retval = xml_call_handler(parser, parser->startElementHandler, parser->startElementPtr, 3, args))) {
 				zval_ptr_dtor(&retval);
 			}
-		} 
+		}
 
 		if (parser->data) {
 			if (parser->level <= XML_MAXLEVEL)  {
@@ -874,7 +874,7 @@ void _xml_endElementHandler(void *userData, const XML_Char *name)
 			if ((retval = xml_call_handler(parser, parser->endElementHandler, parser->endElementPtr, 2, args))) {
 				zval_ptr_dtor(&retval);
 			}
-		} 
+		}
 
 		if (parser->data) {
 			zval *tag;
@@ -885,13 +885,13 @@ void _xml_endElementHandler(void *userData, const XML_Char *name)
 				MAKE_STD_ZVAL(tag);
 
 				array_init(tag);
-				  
+
 				_xml_add_to_info(parser,((char *) tag_name) + parser->toffset);
 
 				add_assoc_string(tag,"tag",((char *) tag_name) + parser->toffset,1); /* cast to avoid gcc-warning */
 				add_assoc_string(tag,"type","close",1);
 				add_assoc_long(tag,"level",parser->level);
-				  
+
 				zend_hash_next_index_insert(Z_ARRVAL_P(parser->data),&tag,sizeof(zval*),NULL);
 			}
 
@@ -923,7 +923,7 @@ void _xml_characterDataHandler(void *userData, const XML_Char *s, int len)
 			if ((retval = xml_call_handler(parser, parser->characterDataHandler, parser->characterDataPtr, 2, args))) {
 				zval_ptr_dtor(&retval);
 			}
-		} 
+		}
 
 		if (parser->data) {
 			int i;
@@ -931,7 +931,7 @@ void _xml_characterDataHandler(void *userData, const XML_Char *s, int len)
 
 			char *decoded_value;
 			int decoded_len;
-			
+
 			decoded_value = xml_utf8_decode(s,len,&decoded_len,parser->target_encoding);
 			for (i = 0; i < decoded_len; i++) {
 				switch (decoded_value[i]) {
@@ -950,7 +950,7 @@ void _xml_characterDataHandler(void *userData, const XML_Char *s, int len)
 			if (doprint || (! parser->skipwhite)) {
 				if (parser->lastwasopen) {
 					zval **myval;
-					
+
 					/* check if the current tag already has a value - if yes append to that! */
 					if (zend_hash_find(Z_ARRVAL_PP(parser->ctag),"value",sizeof("value"),(void **) &myval) == SUCCESS) {
 						int newlen = Z_STRLEN_PP(myval) + decoded_len;
@@ -961,7 +961,7 @@ void _xml_characterDataHandler(void *userData, const XML_Char *s, int len)
 					} else {
 						add_assoc_string(*(parser->ctag),"value",decoded_value,0);
 					}
-					
+
 				} else {
 					zval *tag;
 					zval **curtag, **mytype, **myval;
@@ -984,7 +984,7 @@ void _xml_characterDataHandler(void *userData, const XML_Char *s, int len)
 						}
 					}
 
-					if (parser->level <= XML_MAXLEVEL) {
+					if (parser->level <= XML_MAXLEVEL && parser->level > 0) {
 						MAKE_STD_ZVAL(tag);
 
 						array_init(tag);
@@ -1046,8 +1046,8 @@ void _xml_defaultHandler(void *userData, const XML_Char *s, int len)
 /* }}} */
 
 /* {{{ _xml_unparsedEntityDeclHandler() */
-void _xml_unparsedEntityDeclHandler(void *userData, 
-										 const XML_Char *entityName, 
+void _xml_unparsedEntityDeclHandler(void *userData,
+										 const XML_Char *entityName,
 										 const XML_Char *base,
 										 const XML_Char *systemId,
 										 const XML_Char *publicId,
@@ -1172,9 +1172,9 @@ static void php_xml_parser_create_impl(INTERNAL_FUNCTION_PARAMETERS, int ns_supp
 
 	char *ns_param = NULL;
 	int ns_param_len = 0;
-	
+
 	XML_Char *encoding;
-	
+
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, (ns_support ? "|ss": "|s"), &encoding_param, &encoding_param_len, &ns_param, &ns_param_len) == FAILURE) {
 		RETURN_FALSE;
 	}
@@ -1220,15 +1220,15 @@ static void php_xml_parser_create_impl(INTERNAL_FUNCTION_PARAMETERS, int ns_supp
 }
 /* }}} */
 
-/* {{{ proto resource xml_parser_create([string encoding]) 
+/* {{{ proto resource xml_parser_create([string encoding])
    Create an XML parser */
 PHP_FUNCTION(xml_parser_create)
 {
-	php_xml_parser_create_impl(INTERNAL_FUNCTION_PARAM_PASSTHRU, 0);	
+	php_xml_parser_create_impl(INTERNAL_FUNCTION_PARAM_PASSTHRU, 0);
 }
 /* }}} */
 
-/* {{{ proto resource xml_parser_create_ns([string encoding [, string sep]]) 
+/* {{{ proto resource xml_parser_create_ns([string encoding [, string sep]])
    Create an XML parser */
 PHP_FUNCTION(xml_parser_create_ns)
 {
@@ -1236,7 +1236,7 @@ PHP_FUNCTION(xml_parser_create_ns)
 }
 /* }}} */
 
-/* {{{ proto int xml_set_object(resource parser, object &obj) 
+/* {{{ proto int xml_set_object(resource parser, object &obj)
    Set up object which should be used for callbacks */
 PHP_FUNCTION(xml_set_object)
 {
@@ -1256,7 +1256,7 @@ PHP_FUNCTION(xml_set_object)
 
 	/* please leave this commented - or ask thies@thieso.net before doing it (again) */
 /* #ifdef ZEND_ENGINE_2
-	zval_add_ref(&parser->object); 
+	zval_add_ref(&parser->object);
 #endif */
 
 	ALLOC_ZVAL(parser->object);
@@ -1266,7 +1266,7 @@ PHP_FUNCTION(xml_set_object)
 }
 /* }}} */
 
-/* {{{ proto int xml_set_element_handler(resource parser, string shdl, string ehdl) 
+/* {{{ proto int xml_set_element_handler(resource parser, string shdl, string ehdl)
    Set up start and end element handlers */
 PHP_FUNCTION(xml_set_element_handler)
 {
@@ -1286,7 +1286,7 @@ PHP_FUNCTION(xml_set_element_handler)
 }
 /* }}} */
 
-/* {{{ proto int xml_set_character_data_handler(resource parser, string hdl) 
+/* {{{ proto int xml_set_character_data_handler(resource parser, string hdl)
    Set up character data handler */
 PHP_FUNCTION(xml_set_character_data_handler)
 {
@@ -1305,7 +1305,7 @@ PHP_FUNCTION(xml_set_character_data_handler)
 }
 /* }}} */
 
-/* {{{ proto int xml_set_processing_instruction_handler(resource parser, string hdl) 
+/* {{{ proto int xml_set_processing_instruction_handler(resource parser, string hdl)
    Set up processing instruction (PI) handler */
 PHP_FUNCTION(xml_set_processing_instruction_handler)
 {
@@ -1324,7 +1324,7 @@ PHP_FUNCTION(xml_set_processing_instruction_handler)
 }
 /* }}} */
 
-/* {{{ proto int xml_set_default_handler(resource parser, string hdl) 
+/* {{{ proto int xml_set_default_handler(resource parser, string hdl)
    Set up default handler */
 PHP_FUNCTION(xml_set_default_handler)
 {
@@ -1342,7 +1342,7 @@ PHP_FUNCTION(xml_set_default_handler)
 }
 /* }}} */
 
-/* {{{ proto int xml_set_unparsed_entity_decl_handler(resource parser, string hdl) 
+/* {{{ proto int xml_set_unparsed_entity_decl_handler(resource parser, string hdl)
    Set up unparsed entity declaration handler */
 PHP_FUNCTION(xml_set_unparsed_entity_decl_handler)
 {
@@ -1361,7 +1361,7 @@ PHP_FUNCTION(xml_set_unparsed_entity_decl_handler)
 }
 /* }}} */
 
-/* {{{ proto int xml_set_notation_decl_handler(resource parser, string hdl) 
+/* {{{ proto int xml_set_notation_decl_handler(resource parser, string hdl)
    Set up notation declaration handler */
 PHP_FUNCTION(xml_set_notation_decl_handler)
 {
@@ -1379,7 +1379,7 @@ PHP_FUNCTION(xml_set_notation_decl_handler)
 }
 /* }}} */
 
-/* {{{ proto int xml_set_external_entity_ref_handler(resource parser, string hdl) 
+/* {{{ proto int xml_set_external_entity_ref_handler(resource parser, string hdl)
    Set up external entity reference handler */
 PHP_FUNCTION(xml_set_external_entity_ref_handler)
 {
@@ -1397,7 +1397,7 @@ PHP_FUNCTION(xml_set_external_entity_ref_handler)
 }
 /* }}} */
 
-/* {{{ proto int xml_set_start_namespace_decl_handler(resource parser, string hdl) 
+/* {{{ proto int xml_set_start_namespace_decl_handler(resource parser, string hdl)
    Set up character data handler */
 PHP_FUNCTION(xml_set_start_namespace_decl_handler)
 {
@@ -1416,7 +1416,7 @@ PHP_FUNCTION(xml_set_start_namespace_decl_handler)
 }
 /* }}} */
 
-/* {{{ proto int xml_set_end_namespace_decl_handler(resource parser, string hdl) 
+/* {{{ proto int xml_set_end_namespace_decl_handler(resource parser, string hdl)
    Set up character data handler */
 PHP_FUNCTION(xml_set_end_namespace_decl_handler)
 {
@@ -1435,7 +1435,7 @@ PHP_FUNCTION(xml_set_end_namespace_decl_handler)
 }
 /* }}} */
 
-/* {{{ proto int xml_parse(resource parser, string data [, int isFinal]) 
+/* {{{ proto int xml_parse(resource parser, string data [, int isFinal])
    Start parsing an XML document */
 PHP_FUNCTION(xml_parse)
 {
@@ -1471,8 +1471,8 @@ PHP_FUNCTION(xml_parse_into_struct)
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rsZ|Z", &pind, &data, &data_len, &xdata, &info) == FAILURE) {
 		return;
 	}
-	
-	if (info) {	
+
+	if (info) {
 		zval_dtor(*info);
 		array_init(*info);
 	}
@@ -1483,11 +1483,11 @@ PHP_FUNCTION(xml_parse_into_struct)
 	array_init(*xdata);
 
 	parser->data = *xdata;
-	
+
 	if (info) {
 		parser->info = *info;
 	}
-	
+
 	parser->level = 0;
 	parser->ltags = safe_emalloc(XML_MAXLEVEL, sizeof(char *), 0);
 
@@ -1503,7 +1503,7 @@ PHP_FUNCTION(xml_parse_into_struct)
 }
 /* }}} */
 
-/* {{{ proto int xml_get_error_code(resource parser) 
+/* {{{ proto int xml_get_error_code(resource parser)
    Get XML parser error code */
 PHP_FUNCTION(xml_get_error_code)
 {
@@ -1537,7 +1537,7 @@ PHP_FUNCTION(xml_error_string)
 }
 /* }}} */
 
-/* {{{ proto int xml_get_current_line_number(resource parser) 
+/* {{{ proto int xml_get_current_line_number(resource parser)
    Get current line number for an XML parser */
 PHP_FUNCTION(xml_get_current_line_number)
 {
@@ -1569,7 +1569,7 @@ PHP_FUNCTION(xml_get_current_column_number)
 }
 /* }}} */
 
-/* {{{ proto int xml_get_current_byte_index(resource parser) 
+/* {{{ proto int xml_get_current_byte_index(resource parser)
    Get current byte index for an XML parser */
 PHP_FUNCTION(xml_get_current_byte_index)
 {
@@ -1585,7 +1585,7 @@ PHP_FUNCTION(xml_get_current_byte_index)
 }
 /* }}} */
 
-/* {{{ proto int xml_parser_free(resource parser) 
+/* {{{ proto int xml_parser_free(resource parser)
    Free an XML parser */
 PHP_FUNCTION(xml_parser_free)
 {
@@ -1611,7 +1611,7 @@ PHP_FUNCTION(xml_parser_free)
 }
 /* }}} */
 
-/* {{{ proto int xml_parser_set_option(resource parser, int option, mixed value) 
+/* {{{ proto int xml_parser_set_option(resource parser, int option, mixed value)
    Set options in an XML parser */
 PHP_FUNCTION(xml_parser_set_option)
 {
@@ -1657,7 +1657,7 @@ PHP_FUNCTION(xml_parser_set_option)
 }
 /* }}} */
 
-/* {{{ proto int xml_parser_get_option(resource parser, int option) 
+/* {{{ proto int xml_parser_get_option(resource parser, int option)
    Get options from an XML parser */
 PHP_FUNCTION(xml_parser_get_option)
 {
@@ -1687,7 +1687,7 @@ PHP_FUNCTION(xml_parser_get_option)
 }
 /* }}} */
 
-/* {{{ proto string utf8_encode(string data) 
+/* {{{ proto string utf8_encode(string data)
    Encodes an ISO-8859-1 string to UTF-8 */
 PHP_FUNCTION(utf8_encode)
 {
@@ -1707,7 +1707,7 @@ PHP_FUNCTION(utf8_encode)
 }
 /* }}} */
 
-/* {{{ proto string utf8_decode(string data) 
+/* {{{ proto string utf8_decode(string data)
    Converts a UTF-8 encoded string to ISO-8859-1 */
 PHP_FUNCTION(utf8_decode)
 {

ext/xsl/tests/bug71540.phpt

@@ -3,6 +3,7 @@ Bug #71540 (NULL pointer dereference in xsl_ext_function_php())
 --SKIPIF--
 <?php
 if (!extension_loaded('xsl')) die("skip Extension XSL is required\n");
+if (LIBXML_VERSION >= 20903) die('skip this test is for PHP linked with libxml2 < 2.9.3 only')
 ?>
 --FILE--
 <?php
@@ -64,4 +65,4 @@ Warning: XSLTProcessor::transformToXml(): XPath evaluation returned no result. i
 <h2>Users</h2>
 <table><tr><td></td></tr></table>
 </body></html>
-DONE
+DONE

ext/zip/php_zip.c

@@ -16,7 +16,6 @@
   +----------------------------------------------------------------------+
 */
 
-/* $Id$ */
 
 #ifdef HAVE_CONFIG_H
 #include "config.h"
@@ -3162,7 +3161,6 @@ static PHP_MINFO_FUNCTION(zip)
 	php_info_print_table_start();
 
 	php_info_print_table_row(2, "Zip", "enabled");
-	php_info_print_table_row(2, "Extension Version","$Id$");
 	php_info_print_table_row(2, "Zip version", PHP_ZIP_VERSION);
 	php_info_print_table_row(2, "Libzip version", LIBZIP_VERSION);