PHP-5.6.26RC1

Fix #71882 amendment 2: Negative ftruncate() on php://memory exhausts memory
Fix #71882 amendment: Negative ftruncate() on php://memory exhausts memory
2026-11-15 05:00:49 +00:00 · 2016-09-01 20:37:33 +02:00 · 2016-08-31 16:33:14 +02:00 · 2016-08-31 14:51:37 +02:00 · 2016-08-31 21:06:19 +09:00 · 2016-08-30 14:52:47 +02:00
235 changed files with 5121 additions and 2653 deletions
@@ -205,7 +205,7 @@ STATUS:              Working
 SINCE:               5.1
 -------------------------------------------------------------------------------
 EXTENSION:           pdo_oci
-PRIMARY MAINTAINER:  Unknown
+PRIMARY MAINTAINER:  Christopher Jones <sixd@php.net>
 MAINTENANCE:         Odd fixes
 STATUS:              Working
 SINCE:               5.1
@@ -1,26 +1,245 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-07 Jul 2016, PHP 5.6.24RC1
+01 Sep 2016, PHP 5.6.26RC1

 - Core:
-  . Fix bug #71936 (Segmentation fault destroying HTTP_RAW_POST_DATA).
+  . Fixed bug #72907 (null pointer deref, segfault in gc_remove_zval_from_buffer
+    (zend_gc.c:260)). (Laruence)
+  . Fixed bug #72703 (Out of bounds global memory read in BF_crypt triggered by
+    password_verify). (Anatol)
+
+- Dba:
+  . Fixed bug #71514 (Bad dba_replace condition because of wrong API usage).
+    (cmb)
+  . Fixed bug #70825 (Cannot fetch multiple values with group in ini file).
+    (cmb)
+
+- FTP:
+  . Fixed bug #70195 (Cannot upload file using ftp_put to FTPES with
+    require_ssl_reuse). (Benedict Singer)
+
+- GD:
+  . Fixed bug #66005 (imagecopy does not support 1bit transparency on truecolor
+    images). (cmb)
+  . Fixed bug #72913 (imagecopy() loses single-color transparency on palette
+    images). (cmb)
+  . Fixed bug #68716 (possible resource leaks in _php_image_convert()). (cmb)
+
+- JSON:
+  . Fixed bug #72787 (json_decode reads out of bounds). (Jakub Zelenka)
+
+- mbstring:
+  . Fixed bug #66797 (mb_substr only takes 32-bit signed integer). (cmb)
+
+- MSSQL:
+  . Fixed bug #72039 (Use of uninitialised value on mssql_guid_string). (Kalle)
+
+- PDO:
+  . Fixed bug #60665 (call to empty() on NULL result using PDO::FETCH_LAZY
+    returns false). (cmb)
+
+- PDO_pgsql:
+  . Implemented FR #72633 (Postgres PDO lastInsertId() should work without
+    specifying a sequence). (Pablo Santiago Sánchez, Matteo)
+  . Fixed bug #72759 (Regression in pgo_pgsql). (Anatol)
+
+- Standard:
+  . Fixed bug #72823 (strtr out-of-bound access). (cmb)
+  . Fixed bug #72278 (getimagesize returning FALSE on valid jpg). (cmb)
+  . Fixed bug #65550 (get_browser() incorrectly parses entries with "+" sign).
+    (cmb)
+  . Fixed bug #71882 (Negative ftruncate() on php://memory exhausts memory).
+    (cmb)
+
+- Streams:
+  . Fixed bug #72853 (stream_set_blocking doesn't work). (Laruence)
+
+- XML:
+  . Fixed bug #72085 (SEGV on unknown address zif_xml_parse). (cmb)
+
+- ZIP:
+  . Fixed bug #68302 (impossible to compile php with zip support). (cmb)
+
+18 Aug 2016, PHP 5.6.25
+
+- Bz2:
+  . Fixed bug #72837 (integer overflow in bzdecompress caused heap
+    corruption). (Stas)
+
+- Core:
+  . Fixed bug #70436 (Use After Free Vulnerability in unserialize()).
+    (Taoguang Chen)
+  . Fixed bug #72024 (microtime() leaks memory). (maroszek at gmx dot net)
+  . Fixed bug #72581 (previous property undefined in Exception after
+    deserialization). (Laruence)
+  . Implemented FR #72614 (Support "nmake test" on building extensions by
+    phpize). (Yuji Uchiyama)
+  . Fixed bug #72641 (phpize (on Windows) ignores PHP_PREFIX).
+    (Yuji Uchiyama)
+  . Fixed bug #72663 (Create an Unexpected Object and Don't Invoke
+    __wakeup() in Deserialization). (Stas)
+  . Fixed bug #72681 (PHP Session Data Injection Vulnerability). (Stas)
+  . Fixed URL rewriter partially. It would not rewrite '//example.com/' URL
+    unconditionally. Only requested host(HTTP_HOST) is rewritten. (Yasuo)
+
+- Calendar:
+  . Fixed bug #67976 (cal_days_month() fails for final month of the French
+    calendar). (cmb)
+  . Fixed bug #71894 (AddressSanitizer: global-buffer-overflow in
+    zif_cal_from_jd). (cmb)
+
+- Curl:
+  . Fixed bug #71144 (Segmentation fault when using cURL with ZTS).
+    (maroszek at gmx dot net)
+  . Fixed bug #71929 (Certification information (CERTINFO) data parsing error).
+    (Pierrick)
+  . Fixed bug #72807 (integer overflow in curl_escape caused heap
+    corruption). (Stas)
+
+- DOM:
+  . Fixed bug #66502 (DOM document dangling reference). (Sean Heelan, cmb)
+
+- Ereg:
+  . Fixed bug #72838 (Integer overflow lead to heap corruption in
+    sql_regcase). (Stas)
+
+- EXIF:
+  . Fixed bug #72627 (Memory Leakage In exif_process_IFD_in_TIFF). (Stas)
+  . Fixed bug #72735 (Samsung picture thumb not read (zero size)). (Kalle, Remi)
+
+- Filter:
+  . Fixed bug #71745 (FILTER_FLAG_NO_RES_RANGE does not cover whole 127.0.0.0/8
+    range). (bugs dot php dot net at majkl578 dot cz)
+
+- FPM:
+  . Fixed bug #72575 (using --allow-to-run-as-root should ignore missing user).
+    (gooh)
+
+- GD:
+  . Fixed bug #43828 (broken transparency of imagearc for truecolor in
+    blendingmode). (cmb)
+  . Fixed bug #66555 (Always false condition in ext/gd/libgd/gdkanji.c). (cmb)
+  . Fixed bug #68712 (suspicious if-else statements). (cmb)
+  . Fixed bug #70315 (500 Server Error but page is fully rendered). (cmb)
+  . Fixed bug #72596 (imagetypes function won't advertise WEBP support). (cmb)
+  . Fixed bug #72604 (imagearc() ignores thickness for full arcs). (cmb)
+  . Fixed bug #72697 (select_colors write out-of-bounds). (Stas)
+  . Fixed bug #72709 (imagesetstyle() causes OOB read for empty $styles). (cmb)
+  . Fixed bug #72730 (imagegammacorrect allows arbitrary write access). (Stas)
+
+- Intl:
+  . Partially fixed #72506 (idn_to_ascii for UTS #46 incorrect for long domain
+    names). (cmb)
+
+- mbstring:
+  . Fixed bug #72691 (mb_ereg_search raises a warning if a match zero-width).
+    (cmb)
+  . Fixed bug #72693 (mb_ereg_search increments search position when a match
+    zero-width). (cmb)
+  . Fixed bug #72694 (mb_ereg_search_setpos does not accept a string's last
+    position). (cmb)
+  . Fixed bug #72710 (`mb_ereg` causes buffer overflow on regexp compile error).
+    (ju1ius)
+
+- OCI8:
+  . Fixed invalid handle error with Implicit Result Sets. (Chris Jones)
+
+- PCRE:
+  . Fixed bug #72688 (preg_match missing group names in matches). (cmb)
+
+- PDO_pgsql:
+  . Fixed bug #70313 (PDO statement fails to throw exception). (Matteo)
+
+- Reflection:
+  . Fixed bug #72222 (ReflectionClass::export doesn't handle array constants).
+    (Nikita Nefedov)
+
+- SNMP:
+  . Fixed bug #72708 (php_snmp_parse_oid integer overflow in memory
+    allocation). (djodjo at gmail dot com)
+
+- Standard:
+  . Fixed bug #72330 (CSV fields incorrectly split if escape char followed by
+    UTF chars). (cmb)
+  . Fixed bug #72836 (integer overflow in base64_decode). (Stas)
+  . Fixed bug #72848 (integer overflow in quoted_printable_encode). (Stas)
+  . Fixed bug #72849 (integer overflow in urlencode). (Stas)
+  . Fixed bug #72850 (integer overflow in php_uuencode). (Stas)
+
+- Streams:
+  . Fixed bug #41021 (Problems with the ftps wrapper). (vhuk)
+  . Fixed bug #54431 (opendir() does not work with ftps:// wrapper). (vhuk)
+  . Fixed bug #72667 (opendir() with ftp:// attempts to open data stream for
+    non-existent directories). (vhuk)
+  . Fixed bug #72764 (ftps:// opendir wrapper data channel encryption fails
+    with IIS FTP 7.5, 8.5). (vhuk)
+  . Fixed bug #72771 (ftps:// wrapper is vulnerable to protocol downgrade
+    attack). (Stas)
+
+- SPL:
+  . Fixed bug #72122 (IteratorIterator breaks '@' error suppression). (kinglozzer)
+  . Fixed bug #72646 (SplFileObject::getCsvControl does not return the escape
+    character). (cmb)
+  . Fixed bug #72684 (AppendIterator segfault with closed generator). (Pierrick)
+
+- SQLite3:
+  . Implemented FR #72653 (SQLite should allow opening with empty filename).
+    (cmb)
+
+- Wddx:
+  . Fixed bug #72142 (WDDX Packet Injection Vulnerability in
+    wddx_serialize_value()). (Taoguang Chen)
+  . Fixed bug #72749 (wddx_deserialize allows illegal memory access) (Stas)
+  . Fixed bug #72750 (wddx_deserialize null dereference). (Stas)
+  . Fixed bug #72790 (wddx_deserialize null dereference with invalid xml).
+    (Stas)
+  . Fixed bug #72799 (wddx_deserialize null dereference in
+    php_wddx_pop_element). (Stas)
+
+21 Jul 2016, PHP 5.6.24
+
+- Core:
+  . Fixed bug #71936 (Segmentation fault destroying HTTP_RAW_POST_DATA).
    (mike dot laspina at gmail dot com, Remi)
-  . Fix bug #72496 (Cannot declare public method with signature incompatible
+  . Fixed bug #72496 (Cannot declare public method with signature incompatible
    with parent private method). (Pedro Magalhães)
-  . Fix bug #72138 (Integer Overflow in Length of String-typed ZVAL). (Stas)
+  . Fixed bug #72138 (Integer Overflow in Length of String-typed ZVAL). (Stas)
+  . Fixed bug #72513 (Stack-based buffer overflow vulnerability in
+    virtual_file_ex). (loianhtuan at gmail dot com)
+  . Fixed bug #72562 (Use After Free in unserialize() with Unexpected Session
+    Deserialization). (taoguangchen at icloud dot com)
+  . Fixed bug #72573 (HTTP_PROXY is improperly trusted by some PHP libraries and
+    applications). (CVE-2016-5385) (Stas)

 - bz2:
-  . Fix bug #72447 (Type Confusion in php_bz2_filter_create()). (gogil at 
+  . Fixed bug #72447 (Type Confusion in php_bz2_filter_create()). (gogil at
    stealien dot com).
+  . Fixed bug #72613 (Inadequate error handling in bzread()). (Stas)
+
+- Date:
+  . Fixed bug #66836 (DateTime::createFromFormat 'U' with pre 1970 dates fails
+    parsing). (derick)

 - EXIF:
  . Fixed bug #50845 (exif_read_data() returns corrupted exif headers).
    (Bartosz Dziewoński)
+  . Fixed bug #72603 (Out of bound read in exif_process_IFD_in_MAKERNOTE).
+    (Stas)
+  . Fixed bug #72618 (NULL Pointer Dereference in exif_process_user_comment).
+    (Stas)

 - GD:
  . Fixed bug #43475 (Thick styled lines have scrambled patterns). (cmb)
  . Fixed bug #53640 (XBM images require width to be multiple of 8). (cmb)
  . Fixed bug #64641 (imagefilledpolygon doesn't draw horizontal line). (cmb)
+  . Fixed bug #72512 (gdImageTrueColorToPaletteBody allows arbitrary write/read
+    access). (Pierre)
+  . Fixed bug #72519 (imagegif/output out-of-bounds access). (Pierre)
+  . Fixed bug #72558 (Integer overflow error within _gdContributionsAlloc()).
+    (CVE-2016-6207) (Pierre)
+
+- Intl:
+  . Fixed bug #72533 (locale_accept_from_http out-of-bounds access). (Stas)

 - OpenSSL:
  . Fixed bug #71915 (openssl_random_pseudo_bytes is not fork-safe).
@@ -28,6 +247,10 @@ PHP                                                                        NEWS
  . Fixed bug #72336 (openssl_pkey_new does not fail for invalid DSA params).
    (Jakub Zelenka)

+- SNMP:
+  . Fixed bug #72479 (Use After Free Vulnerability in SNMP with GC and
+    unserialize()). (taoguangchen at icloud dot com)
+
 - SPL:
  . Fixed bug #55701 (GlobIterator throws LogicException). (Valentin VĂLCIU)

@@ -39,6 +262,14 @@ PHP                                                                        NEWS
  . Fixed bug #72439 (Stream socket with remote address leads to a segmentation
    fault). (Laruence)

+- Xmlrpc:
+  . Fixed bug #72606 (heap-buffer-overflow (write) simplestring_addn simplestring.c).
+    (Stas)
+
+- Zip:
+  . Fixed bug #72520 (Stack-based buffer overflow vulnerability in
+    php_stream_zip_opener). (loianhtuan at gmail dot com)
+
 23 Jun 2016, PHP 5.6.23

 - Core:
@@ -57,7 +288,7 @@ PHP                                                                        NEWS
    (cmb)
  . Fixed bug #72298 (pass2_no_dither out-of-bounds access). (Stas)
  . Fixed bug #72337 (invalid dimensions can lead to crash). (Pierre)
-  . Fixed bug #72339 (Integer Overflow in _gd2GetHeader() resulting in 
+  . Fixed bug #72339 (Integer Overflow in _gd2GetHeader() resulting in
    heap overflow). (CVE-2016-5766) (Pierre)
  . Fixed bug #72407 (NULL Pointer Dereference at _gdScaleVert). (Stas)
  . Fixed bug #72446 (Integer Overflow in gdImagePaletteToTrueColor() resulting
@@ -131,7 +362,7 @@ PHP                                                                        NEWS

 - Curl:
  . Fixed bug #71831 (CURLOPT_NOPROXY applied as long instead of string).
-    (Michael Sierks)    
+    (Michael Sierks)

 - Date:
  . Fixed bug #71889 (DateInterval::format Segmentation fault). (Thomas Punt)
@@ -446,7 +677,7 @@ PHP                                                                        NEWS
    a server). (Sergei Turchanov)

 - OpenSSL:
-  . Fixed bug #55259 (openssl extension does not get the DH parameters from 
+  . Fixed bug #55259 (openssl extension does not get the DH parameters from
    DH key resource). (Jakub Zelenka)
  . Fixed bug #70395 (Missing ARG_INFO for openssl_seal()). (cmb)
  . Fixed bug #60632 (openssl_seal fails with AES). (Jakub Zelenka)
@@ -538,7 +769,7 @@ PHP                                                                        NEWS
 - Standard:
  . Fixed bug #70052 (getimagesize() fails for very large and very small WBMP).
    (cmb)
-  . Fixed bug #70157 (parse_ini_string() segmentation fault with 
+  . Fixed bug #70157 (parse_ini_string() segmentation fault with
    INI_SCANNER_TYPED). (Tjerk)

 - XSLT:
@@ -564,7 +795,7 @@ PHP                                                                        NEWS
 - CLI server:
  . Fixed bug #69655 (php -S changes MKCALENDAR request method to MKCOL). (cmb)
  . Fixed bug #64878 (304 responses return Content-Type header). (cmb)
-  
+
 - GD:
  . Fixed bug #53156 (imagerectangle problem with point ordering). (cmb)
  . Fixed bug #66387 (Stack overflow with imagefilltoborder). (CVE-2015-8874)
@@ -582,7 +813,7 @@ PHP                                                                        NEWS

 - ODBC:
  . Fixed bug #69975 (PHP segfaults when accessing nvarchar(max) defined
-    columns). (cmb)
+    columns). (CVE-2015-8879) (cmb)

 - OpenSSL:
  . Fixed bug #69882 (OpenSSL error "key values mismatch" after
@@ -645,7 +876,7 @@ PHP                                                                        NEWS
 - Mysqlnd:
  . Fixed bug #69669 (mysqlnd is vulnerable to BACKRONYM). (CVE-2015-3152)
    (Andrey)
-    
+
 - PCRE:
  . Fixed Bug #53823 (preg_replace: * qualifier on unicode replace garbles the
    string). (cmb)
@@ -738,7 +969,7 @@ PHP                                                                        NEWS
 14 May 2015, PHP 5.6.9

 - Core:
-  . Fixed bug #69467 (Wrong checked for the interface by using Trait). 
+  . Fixed bug #69467 (Wrong checked for the interface by using Trait).
    (Laruence)
  . Fixed bug #69420 (Invalid read in zend_std_get_method). (Laruence)
  . Fixed bug #60022 ("use statement [...] has no effect" depends on leading
@@ -859,7 +1090,7 @@ PHP                                                                        NEWS
    (Mike)
  . Fixed bug #64931 (phar_add_file is too restrictive on filename). (Mike)
  . Fixed bug #65467 (Call to undefined method cli_arg_typ_string). (Mike)
-  . Fixed bug #67761 (Phar::mapPhar fails for Phars inside a path containing 
+  . Fixed bug #67761 (Phar::mapPhar fails for Phars inside a path containing
    ".tar"). (Mike)
  . Fixed bug #69324 (Buffer Over-read in unserialize when parsing Phar). (Stas)
  . Fixed bug #69441 (Buffer Overflow when parsing tar/zip/phar in
@@ -871,7 +1102,7 @@ PHP                                                                        NEWS
 - SOAP:
  . Fixed bug #69152 (Type Confusion Infoleak Vulnerability in unserialize()
    with SoapFault). (Dmitry)
-  . Fixed bug #69293 (NEW segfault when using SoapClient::__setSoapHeader 
+  . Fixed bug #69293 (NEW segfault when using SoapClient::__setSoapHeader
     (bisected, regression)). (Laruence)

 - SPL:
@@ -893,7 +1124,7 @@ PHP                                                                        NEWS
    (Laruence)
  . Fixed bug #69121 (Segfault in get_current_user when script owner is not
    in passwd with ZTS build). (dan at syneto dot net)
-  . Fixed bug #65593 (Segfault when calling ob_start from output buffering 
+  . Fixed bug #65593 (Segfault when calling ob_start from output buffering
    callback). (Mike)
  . Fixed bug #68986 (pointer returned by php_stream_fopen_temporary_file
    not validated in memory.c). (nayana at ddproperty dot com)
@@ -930,7 +1161,7 @@ PHP                                                                        NEWS
  . Fixed bug #68964 (Allowed memory size exhausted with odbc_exec). (Anatol)

 - Opcache:
-  . Fixed bug #69159 (Opcache causes problem when passing a variable variable 
+  . Fixed bug #69159 (Opcache causes problem when passing a variable variable
    to a function). (Dmitry, Laruence)
  . Fixed bug #69125 (Array numeric string as key). (Laruence)
  . Fixed bug #69038 (switch(SOMECONSTANT) misbehaves). (Laruence)
@@ -964,7 +1195,7 @@ PHP                                                                        NEWS
 - SPL:
  . Fixed bug #69108 ("Segmentation fault" when (de)serializing
    SplObjectStorage). (Laruence)
-  . Fixed bug #68557 (RecursiveDirectoryIterator::seek(0) broken after 
+  . Fixed bug #68557 (RecursiveDirectoryIterator::seek(0) broken after
    calling getChildren()). (Julien)

 - ZIP:
@@ -1040,7 +1271,7 @@ PHP                                                                        NEWS
  . Fixed bug #68063 (Empty session IDs do still start sessions) (Yasuo)

 - Sqlite3:
-  . Fixed bug #68260 (SQLite3Result::fetchArray declares wrong 
+  . Fixed bug #68260 (SQLite3Result::fetchArray declares wrong
    required_num_args). (Julien)

 - Standard:
@@ -1085,7 +1316,7 @@ PHP                                                                        NEWS
    CURLOPT_RETURNTRANSFER isn't set). (Jille Timmermans)

 - Date:
-  . Implemented FR #68268 (DatePeriod: Getter for start date, end date and 
+  . Implemented FR #68268 (DatePeriod: Getter for start date, end date and
    interval). (Marc Bennewitz)

 - EXIF:
@@ -1162,7 +1393,7 @@ PHP                                                                        NEWS
    (Adam)
  . Fixed bug #68104 (Segfault while pre-evaluating a disabled function).
    (Laruence)
-  . Fixed bug #68185 ("Inconsistent insteadof definition."- incorrectly 
+  . Fixed bug #68185 ("Inconsistent insteadof definition."- incorrectly
    triggered). (Julien)
  . Fixed bug #68355 (Inconsistency in example php.ini comments).
    (Chris McCafferty)
@@ -1209,7 +1440,7 @@ PHP                                                                        NEWS
  (Matteo)

 - Session:
-  . Fixed bug #68331 (Session custom storage callable functions not being called) 
+  . Fixed bug #68331 (Session custom storage callable functions not being called)
    (Yasuo Ohgaki)

 - SOAP:
@@ -1234,13 +1465,13 @@ PHP                                                                        NEWS
  . Fixed bug #68095 (AddressSanitizer reports a heap buffer overflow in
    php_getopt()). (Stas)
  . Fixed bug #68118 ($a->foo .= 'test'; can leave $a->foo undefined). (Nikita)
-  . Fixed bug #68129 (parse_url() - incomplete support for empty usernames 
+  . Fixed bug #68129 (parse_url() - incomplete support for empty usernames
    and passwords) (Tjerk)
  . Fixed bug #68365 (zend_mm_heap corrupted after memory overflow in
    zend_hash_copy). (Dmitry)

 - CURL:
-  . Add CURL_SSLVERSION_TLSv1_0, CURL_SSLVERSION_TLSv1_1, and 
+  . Add CURL_SSLVERSION_TLSv1_0, CURL_SSLVERSION_TLSv1_1, and
    CURL_SSLVERSION_TLSv1_2 constants if supported by libcurl (Rasmus)

 - Fileinfo:
@@ -1412,7 +1643,7 @@ PHP                                                                        NEWS
  . Fixed bug #67250 (iptcparse out-of-bounds read). (Stas)
  . Fixed bug #67252 (convert_uudecode out-of-bounds read). (Stas)
  . Fixed bug #67249 (printf out-of-bounds read). (Stas)
-  . Implemented FR #64744 (Differentiate between member function call on a null 
+  . Implemented FR #64744 (Differentiate between member function call on a null
    and non-null, non-objects). (Boro Sitnikovski)
  . Fixed bug #67436 (Autoloader isn't called if two method definitions don't
    match). (Bob)
@@ -1443,7 +1674,7 @@ PHP                                                                        NEWS
    (Ralf Lang, Mike)
  . Reduced POST data memory usage by 200-300%. Changed INI setting
    always_populate_raw_post_data to throw a deprecation warning when enabling
-    and to accept -1 for never populating the $HTTP_RAW_POST_DATA global 
+    and to accept -1 for never populating the $HTTP_RAW_POST_DATA global
    variable, which will be the default in future PHP versions. (Mike)
  . Implemented dedicated syntax for variadic functions
    (RFC: https://wiki.php.net/rfc/variadics). (Nikita)
@@ -1456,9 +1687,9 @@ PHP                                                                        NEWS
  . Allow zero length comparison in substr_compare() (Tjerk)
  . Fixed bug #60602 (proc_open() changes environment array) (Tjerk)
  . Fixed bug #61019 (Out of memory on command stream_get_contents). (Mike)
-  . Fixed bug #64330 (stream_socket_server() creates wrong Abstract Namespace 
+  . Fixed bug #64330 (stream_socket_server() creates wrong Abstract Namespace
    UNIX sockets). (Mike)
-  . Fixed bug #66182 (exit in stream filter produces segfault). (Mike)  
+  . Fixed bug #66182 (exit in stream filter produces segfault). (Mike)
  . Fixed bug #66736 (fpassthru broken). (Mike)
  . Fixed bug #66822 (Cannot use T_POW in const expression) (Tjerk)
  . Fixed bug #67043 (substr_compare broke by previous change) (Tjerk)
@@ -1829,7 +2060,7 @@ PHP                                                                        NEWS
    (Matteo)

 - PDO-ODBC:
-  . Fixed bug #50444 (PDO-ODBC changes for 64-bit). 
+  . Fixed bug #50444 (PDO-ODBC changes for 64-bit).

 - PDO_pgsql:
  . Fixed Bug #42614 (PDO_pgsql: add pg_get_notify support). (Matteo)
@@ -1888,7 +2119,7 @@ PHP                                                                        NEWS

 - SPL:
  . Revert fix for bug #67064 (BC issues). (Bob)
-  . Fixed bug #67539 (ArrayIterator use-after-free due to object change during 
+  . Fixed bug #67539 (ArrayIterator use-after-free due to object change during
    sorting). (CVE-2014-4698) (research at insighti dot org, Laruence)
  . Fixed bug #67538 (SPL Iterators use-after-free). (CVE-2014-4670) (Laruence)
  . Fixed bug #67492 (unserialize() SPL ArrayObject / SPLObjectStorage Type
@@ -1917,7 +2148,7 @@ PHP                                                                        NEWS
    token). (Ferenc)

 - XMLReader:
-  . Fixed bug #55285 (XMLReader::getAttribute/No/Ns methods inconsistency). 
+  . Fixed bug #55285 (XMLReader::getAttribute/No/Ns methods inconsistency).
    (Mike)

 - XSL:
@@ -1937,7 +2168,7 @@ PHP                                                                        NEWS

 - Zlib:
  . Fixed bug #67865 (internal corruption phar error). Mike
-  . Fixed bug #67724 (chained zlib filters silently fail with large amounts of 
+  . Fixed bug #67724 (chained zlib filters silently fail with large amounts of
    data). (Mike)

 21 Aug 2014, PHP 5.5.16
@@ -1962,7 +2193,7 @@ PHP                                                                        NEWS

 - Milter:
  . Fixed bug #67715 (php-milter does not build and crashes randomly). (Mike)
-  
+
 - Network:
  . Fixed bug #67717 (segfault in dns_get_record). (CVE-2014-3597) (Remi)

@@ -2016,7 +2247,7 @@ PHP                                                                        NEWS
  . Fixed bug #67531 (syslog cannot be set in pool configuration). (Remi)

 - Intl:
-  . Fixed bug #66921 (Wrong argument type hint for function 
+  . Fixed bug #66921 (Wrong argument type hint for function
    intltz_from_date_time_zone). (Stas)
  . Fixed bug #67052 (NumberFormatter::parse() resets LC_NUMERIC setting).
    (Stas)
@@ -2033,7 +2264,7 @@ PHP                                                                        NEWS
  . Fixed bug #67587 (Redirection loop on nginx with FPM). (Christian Weiske)

 - SPL:
-  . Fixed bug #67539 (ArrayIterator use-after-free due to object change during 
+  . Fixed bug #67539 (ArrayIterator use-after-free due to object change during
    sorting). (CVE-2014-4698) (research at insighti dot org, Laruence)
  . Fixed bug #67538 (SPL Iterators use-after-free). (CVE-2014-4670) (Laruence)

@@ -2155,9 +2386,9 @@ PHP                                                                        NEWS
 30 Apr 2014, PHP 5.5.12
 - Core:
  . Fixed bug #61019 (Out of memory on command stream_get_contents). (Mike)
-  . Fixed bug #64330 (stream_socket_server() creates wrong Abstract Namespace 
+  . Fixed bug #64330 (stream_socket_server() creates wrong Abstract Namespace
    UNIX sockets). (Mike)
-  . Fixed bug #66182 (exit in stream filter produces segfault). (Mike)  
+  . Fixed bug #66182 (exit in stream filter produces segfault). (Mike)
  . Fixed bug #66736 (fpassthru broken). (Mike)
  . Fixed bug #67024 (getimagesize should recognize BMP files with negative
    height). (Gabor Buella)
@@ -2251,7 +2482,7 @@ PHP                                                                        NEWS
    (Nikita)

 - Intl:
-  . Fixed bug #66873 (A reproductible crash in UConverter when given invalid 
+  . Fixed bug #66873 (A reproductible crash in UConverter when given invalid
    encoding) (Stas)

 - Mail:
@@ -2326,7 +2557,7 @@ PHP                                                                        NEWS
    (Dmitry)
  . Fixed bug #66461 (PHP crashes if opcache.interned_strings_buffer=0).
    (Dmitry)
-  . Fixed bug #66298 (ext/opcache/Optimizer/zend_optimizer.c has dos-style 
+  . Fixed bug #66298 (ext/opcache/Optimizer/zend_optimizer.c has dos-style
    ^M as lineend). (Laruence)

 - PDO_pgsql:
@@ -2368,12 +2599,12 @@ spaces) (willfitch, iliaa)
  . Fixed bug #66218 (zend_register_functions breaks reflection). (Remi)

 - Date:
-  . Fixed bug #66060 (Heap buffer over-read in DateInterval) (CVE-2013-6712). 
+  . Fixed bug #66060 (Heap buffer over-read in DateInterval) (CVE-2013-6712).
    (Remi)
  . Fixed bug #65768 (DateTimeImmutable::diff does not work). (Nikita Nefedov)
-  
+
 - DOM:
-  . Fixed bug #65196 (Passing DOMDocumentFragment to DOMDocument::saveHTML() 
+  . Fixed bug #65196 (Passing DOMDocumentFragment to DOMDocument::saveHTML()
    Produces invalid Markup). (Mike)

 - Exif:
@@ -2385,9 +2616,9 @@ spaces) (willfitch, iliaa)
 - GD:
  . Fixed bug #64405 (Use freetype-config for determining freetype2 dir(s)).
    (Adam)
-    
+
 - PDO_odbc:
-  . Fixed bug #66311 (Stack smashing protection kills PDO/ODBC queries). 
+  . Fixed bug #66311 (Stack smashing protection kills PDO/ODBC queries).
    (michael at orlitzky dot com)

 - MySQLi:
@@ -2424,7 +2655,7 @@ spaces) (willfitch, iliaa)
    server) - also implements apache_response_headers() (Andrea Faulds)

 - Core:
-  . Fixed bug #66094 (unregister_tick_function tries to cast a Closure to a 
+  . Fixed bug #66094 (unregister_tick_function tries to cast a Closure to a
    string). (Laruence)
  . Fixed bug #65969 (Chain assignment with T_LIST failure). (Dmitry)

@@ -2444,7 +2675,7 @@ spaces) (willfitch, iliaa)
 14 Nov 2013, PHP 5.5.6

 - Core:
-  . Fixed bug #65947 (basename is no more working after fgetcsv in certain 
+  . Fixed bug #65947 (basename is no more working after fgetcsv in certain
    situation). (Laruence)
  . Improved performance of array_merge() and func_get_args() by eliminating
    useless copying. (Dmitry)
@@ -2475,7 +2706,7 @@ spaces) (willfitch, iliaa)
    32 characters). (patch submitted by: michael dot y at zend dot com, Yasuo)

 - PDO:
-  . Fixed bug #66033 (Segmentation Fault when constructor of PDO statement 
+  . Fixed bug #66033 (Segmentation Fault when constructor of PDO statement
    throws an exception). (Laruence)
  . Fixed bug 65946 (sql_parser permanently converts values bound to strings)

@@ -2496,7 +2727,7 @@ spaces) (willfitch, iliaa)
 - CLI server:
  . Fixed bug #65633 (built-in server treat some http headers as
    case-sensitive). (Adam)
-  . Fixed bug #65818 (Segfault with built-in webserver and chunked transfer 
+  . Fixed bug #65818 (Segfault with built-in webserver and chunked transfer
    encoding). (Felipe)
  . Added application/pdf to PHP CLI Web Server mime types (Chris Jones)

@@ -2549,17 +2780,17 @@ spaces) (willfitch, iliaa)
    a default value). (Nikita)

 - Standard:
-  . Fixed bug #61548 (content-type must appear at the end of headers for 201 
+  . Fixed bug #61548 (content-type must appear at the end of headers for 201
    Location to work in http). (Mike)

 - XMLReader:
  . Fixed bug #51936 (Crash with clone XMLReader). (Mike)
  . Fixed bug #64230 (XMLReader does not suppress errors). (Mike)
-  
+
 - Build system:
  . Fixed bug #51076 (race condition in shtool's mkdir -p implementation).
    (Mike, Raphael Geissert)
-  . Fixed bug #62396 ('make test' crashes starting with 5.3.14 (missing 
+  . Fixed bug #62396 ('make test' crashes starting with 5.3.14 (missing
    gzencode())). (Mike)


@@ -2569,7 +2800,7 @@ spaces) (willfitch, iliaa)
  . Fixed bug #60598 (cli/apache sapi segfault on objects manipulation).
    (Laruence)
  . Improved fputcsv() to allow specifying escape character.
-  . Fixed bug #65490 (Duplicate calls to get lineno & filename for 
+  . Fixed bug #65490 (Duplicate calls to get lineno & filename for
    DTRACE_FUNCTION_*). (Chris Jones)
  . Fixed bug #65483 (quoted-printable encode stream filter incorrectly encoding
    spaces). (Michael M Slusarz)
@@ -2601,21 +2832,21 @@ spaces) (willfitch, iliaa)
    some cases). (Mark Jones)

 - PDO:
-  . Fixed bug #64953 (Postgres prepared statement positional parameter 
+  . Fixed bug #64953 (Postgres prepared statement positional parameter
    casting). (Mike)

 - Session:
  . Fixed bug #65475 (Session ID is not initialized properly when strict session
    is enabled). (Yasuo)
-  . Fixed bug #51127/#65359 Request #25630/#43980/#54383 (Added php_serialize 
+  . Fixed bug #51127/#65359 Request #25630/#43980/#54383 (Added php_serialize
    session serialize handler that uses plain serialize()). (Yasuo)

 - Standard:
  . Fix issue with return types of password API helper functions. Found via
-    static analysis by cjones. (Anthony Ferrara) 
+    static analysis by cjones. (Anthony Ferrara)

 - Zlib:
-  . Fixed bug #65391 (Unable to send vary header user-agent when 
+  . Fixed bug #65391 (Unable to send vary header user-agent when
    ob_start('ob_gzhandler') is called) (Mike)

 22 Aug 2013, PHP 5.5.3
@@ -2640,8 +2871,8 @@ spaces) (willfitch, iliaa)
    Zend/zend_dtrace.d) (Chris Jones)

 - DOM:
-  . Added flags option to DOMDocument::schemaValidate() and 
-    DOMDocument::schemaValidateSource(). Added LIBXML_SCHEMA_CREATE flag. 
+  . Added flags option to DOMDocument::schemaValidate() and
+    DOMDocument::schemaValidateSource(). Added LIBXML_SCHEMA_CREATE flag.
    (Chris Wright)

 - OPcache:
@@ -2664,12 +2895,12 @@ spaces) (willfitch, iliaa)
    /pg_delete()/pg_insert()). (Yasuo)

 - Phar:
-  . Fixed bug #65028 (Phar::buildFromDirectory creates corrupt archives for 
+  . Fixed bug #65028 (Phar::buildFromDirectory creates corrupt archives for
    some specific contents). (Stas)

 - Sessions:
  . Implemented strict sessions RFC (https://wiki.php.net/rfc/strict_sessions)
-    which protects against session fixation attacks and session collisions.    
+    which protects against session fixation attacks and session collisions.
    (CVE-2011-4718). (Yasuo Ohgaki)
  . Fixed possible buffer overflow under Windows. Note: Not a security fix.
    (Yasuo)
@@ -2680,9 +2911,9 @@ spaces) (willfitch, iliaa)

 - SPL:
  . Fixed bug #65328 (Segfault when getting SplStack object Value). (Laruence)
-  . Added RecursiveTreeIterator setPostfix and getPostifx methods. (Joshua 
+  . Added RecursiveTreeIterator setPostfix and getPostifx methods. (Joshua
    Thijssen)
-  . Fixed bug #61697 (spl_autoload_functions returns lambda functions 
+  . Fixed bug #61697 (spl_autoload_functions returns lambda functions
    incorrectly). (Laruence)

 - Streams:
@@ -2699,7 +2930,7 @@ spaces) (willfitch, iliaa)
    with a namespace). (Laruence)
  . Fixed bug #65088 (Generated configure script is malformed on OpenBSD).
    (Adam)
-  . Fixed bug #65108 (is_callable() triggers Fatal Error). 
+  . Fixed bug #65108 (is_callable() triggers Fatal Error).
    (David Soria Parra, Laruence)
  . Fixed bug #65035 (yield / exit segfault). (Nikita)
  . Fixed bug #65161 (Generator + autoload + syntax error = segfault). (Nikita)
@@ -3117,7 +3348,7 @@ spaces) (willfitch, iliaa)
  . Fixed bug #63284 (Upgrade PCRE to 8.31). (Anatoliy)

 - PDO:
-  . Fixed bug #63176 (Segmentation fault when instantiate 2 persistent PDO to 
+  . Fixed bug #63176 (Segmentation fault when instantiate 2 persistent PDO to
    the same db server). (Laruence)

 - PDO_DBlib:
@@ -3203,7 +3434,7 @@ spaces) (willfitch, iliaa)
 06 Jun 2013, PHP 5.4.16

 - Core:
-  . Fixed bug #64879 (Heap based buffer overflow in quoted_printable_encode, 
+  . Fixed bug #64879 (Heap based buffer overflow in quoted_printable_encode,
    CVE 2013-2110). (Stas)
  . Fixed bug #64853 (Use of no longer available ini directives causes crash on
    TS build). (Anatol)
@@ -3232,7 +3463,7 @@ spaces) (willfitch, iliaa)
    pointer has closed). (Laruence)

 - Phar
-  . Fixed bug #64214 (PHAR PHPTs intermittently crash when run on DFS, SMB or 
+  . Fixed bug #64214 (PHAR PHPTs intermittently crash when run on DFS, SMB or
    with non std tmp dir). (Pierre)

 - SNMP:
@@ -3245,7 +3476,7 @@ spaces) (willfitch, iliaa)
    on Windows x64). (Anatol)

 - Zend Engine:
-  . Fixed bug #64821 (Custom Exceptions crash when internal properties 
+  . Fixed bug #64821 (Custom Exceptions crash when internal properties
    overridden). (Anatol)

 09 May 2013, PHP 5.4.15
@@ -616,6 +616,12 @@ TSRM_API int shmget(int key, int size, int flags)
 		}
 	} else {
 		if (flags & IPC_EXCL) {
+			if (shm_handle) {
+				CloseHandle(shm_handle);
+			}
+			if (info_handle) {
+				CloseHandle(info_handle);
+			}
 			return -1;
 		}
 	}
@@ -654,17 +660,27 @@ TSRM_API int shmget(int key, int size, int flags)
 TSRM_API void *shmat(int key, const void *shmaddr, int flags)
 {
 	shm_pair *shm = shm_get(key, NULL);
+	int err;

 	if (!shm->segment) {
 		return (void*)-1;
 	}

+	shm->addr = MapViewOfFileEx(shm->segment, FILE_MAP_ALL_ACCESS, 0, 0, 0, NULL);
+
+	err = GetLastError();
+	if (err) {
+		/* Catch more errors */
+		if (ERROR_NOT_ENOUGH_MEMORY == err) {
+			_set_errno(ENOMEM);
+		}
+		return (void*)-1;
+	}
+
 	shm->descriptor->shm_atime = time(NULL);
 	shm->descriptor->shm_lpid  = getpid();
 	shm->descriptor->shm_nattch++;

-	shm->addr = MapViewOfFileEx(shm->segment, FILE_MAP_ALL_ACCESS, 0, 0, 0, NULL);
-
 	return shm->addr;
 }

@@ -218,6 +218,9 @@ PHP 5.6 UPGRADE NOTES
    . CURLOPT_KRBLEVEL
    . CURLOPT_KRB4LEVEL

+  curl_getinfo($ch, CURLINFO_CERTINFO) returns certificate Subject and Issuer
+  as a string (PHP >= 5.6.25)
+
 - Strings:
  substr_compare() now allows $length to be zero.
  pack() and unpack() now support 64-bit format specifiers: q, Q, J and P.
@@ -400,6 +403,9 @@ PHP 5.6 UPGRADE NOTES
 - CURL:
  CURL_HTTP_VERSION_2_0 and CURL_VERSION_HTTP2 (>= 5.6.8)

+- GD:
+  IMG_WEBP (>= 5.6.25)
+
 - LDAP:
  LDAP_ESCAPE_FILTER int(1)
  LDAP_ESCAPE_DN     int(2)
@@ -0,0 +1,18 @@
+--TEST--
+Bug #72907 (null pointer deref, segfault in gc_remove_zval_from_buffer (zend_gc.c:260))
+--FILE--
+<?php
+
+$a = 0;
+
+($a->a = &$E) + ($b = $a->b->i -= 0);
+
+?>
+--EXPECTF--
+Warning: Attempt to modify property of non-object in %sbug72907.php on line %d
+
+Warning: Attempt to modify property of non-object in %sbug72907.php on line %d
+
+Warning: Creating default object from empty value in %sbug72907.php on line %d
+
+Notice: Undefined property: stdClass::$i in %sbug72907.php on line %d
@@ -447,7 +447,7 @@ ZEND_API int add_property_zval_ex(zval *arg, const char *key, uint key_len, zval
 #define add_property_double(__arg, __key, __d) add_property_double_ex(__arg, __key, strlen(__key)+1, __d TSRMLS_CC)
 #define add_property_string(__arg, __key, __str, __duplicate) add_property_string_ex(__arg, __key, strlen(__key)+1, __str, __duplicate TSRMLS_CC)
 #define add_property_stringl(__arg, __key, __str, __length, __duplicate) add_property_stringl_ex(__arg, __key, strlen(__key)+1, __str, __length, __duplicate TSRMLS_CC)
-#define add_property_zval(__arg, __key, __value) add_property_zval_ex(__arg, __key, strlen(__key)+1, __value TSRMLS_CC)       
+#define add_property_zval(__arg, __key, __value) add_property_zval_ex(__arg, __key, strlen(__key)+1, __value TSRMLS_CC)


 ZEND_API int call_user_function(HashTable *function_table, zval **object_pp, zval *function_name, zval *retval_ptr, zend_uint param_count, zval *params[] TSRMLS_DC);
@@ -458,7 +458,7 @@ ZEND_API extern const zend_fcall_info_cache empty_fcall_info_cache;

 /** Build zend_call_info/cache from a zval*
 *
- * Caller is responsible to provide a return value, otherwise the we will crash. 
+ * Caller is responsible to provide a return value, otherwise the we will crash.
 * fci->retval_ptr_ptr = NULL;
 * In order to pass parameters the following members need to be set:
 * fci->param_count = 0;
@@ -578,6 +578,9 @@ END_EXTERN_C()
 		const char *__s=(s);				\
 		zval *__z = (z);					\
 		Z_STRLEN_P(__z) = strlen(__s);		\
+		if (UNEXPECTED(Z_STRLEN_P(__z) < 0)) { \
+			zend_error(E_ERROR, "String size overflow"); \
+		}									\
 		Z_STRVAL_P(__z) = (duplicate?estrndup(__s, Z_STRLEN_P(__z)):(char*)__s);\
 		Z_TYPE_P(__z) = IS_STRING;			\
 	} while (0)
@@ -230,7 +230,7 @@ ZEND_METHOD(exception, __construct)
   Exception unserialize checks */
 #define CHECK_EXC_TYPE(name, type) \
 	value = zend_read_property(default_exception_ce, object, name, sizeof(name)-1, 0 TSRMLS_CC); \
-	if(value && Z_TYPE_P(value) != type) { \
+	if (value && Z_TYPE_P(value) != IS_NULL && Z_TYPE_P(value) != type) { \
 		zval *tmp; \
 		MAKE_STD_ZVAL(tmp); \
 		ZVAL_STRINGL(tmp, name, sizeof(name)-1, 1); \
@@ -522,9 +522,7 @@ static void zend_assign_to_variable_reference(zval **variable_ptr_ptr, zval **va
 	zval *variable_ptr = *variable_ptr_ptr;
 	zval *value_ptr = *value_ptr_ptr;

-	if (variable_ptr == &EG(error_zval) || value_ptr == &EG(error_zval)) {
-		variable_ptr_ptr = &EG(uninitialized_zval_ptr);
-	} else if (variable_ptr != value_ptr) {
+	if (variable_ptr != value_ptr) {
 		if (!PZVAL_IS_REF(value_ptr)) {
 			/* break it away */
 			Z_DELREF_P(value_ptr);
@@ -651,14 +651,14 @@ CWD_API void realpath_cache_del(const char *path, int path_len TSRMLS_DC) /* {{{
 					memcmp(path, (*bucket)->path, path_len) == 0) {
 			realpath_cache_bucket *r = *bucket;
 			*bucket = (*bucket)->next;
-		   
+
 			/* if the pointers match then only subtract the length of the path */
 		   	if(r->path == r->realpath) {
 				CWDG(realpath_cache_size) -= sizeof(realpath_cache_bucket) + r->path_len + 1;
 			} else {
 				CWDG(realpath_cache_size) -= sizeof(realpath_cache_bucket) + r->path_len + 1 + r->realpath_len + 1;
 			}
-		   
+
 			free(r);
 			return;
 		} else {
@@ -734,7 +734,7 @@ static inline realpath_cache_bucket* realpath_cache_find(const char *path, int p
 			realpath_cache_bucket *r = *bucket;
 			*bucket = (*bucket)->next;

-			/* if the pointers match then only subtract the length of the path */		   
+			/* if the pointers match then only subtract the length of the path */
 		   	if(r->path == r->realpath) {
 				CWDG(realpath_cache_size) -= sizeof(realpath_cache_bucket) + r->path_len + 1;
 			} else {
@@ -1190,7 +1190,7 @@ CWD_API int virtual_file_ex(cwd_state *state, const char *path, verify_path_func
 	int add_slash;
 	void *tmp;

-	if (path_length == 0 || path_length >= MAXPATHLEN-1) {
+	if (path_length <= 0 || path_length >= MAXPATHLEN-1) {
 #ifdef TSRM_WIN32
 # if _MSC_VER < 1300
 		errno = EINVAL;
@@ -1817,11 +1817,14 @@ ZEND_VM_HANDLER(39, ZEND_ASSIGN_REF, VAR|CV, VAR|CV)
 	if ((OP2_TYPE == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||
 	    (OP1_TYPE == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL))) {
 		zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets nor overloaded objects");
-	}
-	zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
-
-	if (OP2_TYPE == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
-		Z_DELREF_PP(variable_ptr_ptr);
+	} else if ((OP2_TYPE == IS_VAR && UNEXPECTED(*value_ptr_ptr == &EG(error_zval))) ||
+		(OP1_TYPE == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval)))) {
+		variable_ptr_ptr = &EG(uninitialized_zval_ptr);
+	} else {
+		zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
+		if (OP2_TYPE == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
+			Z_DELREF_PP(variable_ptr_ptr);
+		}
 	}

 	if (RETURN_VALUE_USED(opline)) {
@@ -20408,11 +20408,14 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDL
 	if ((IS_VAR == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||
 	    (IS_VAR == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL))) {
 		zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets nor overloaded objects");
-	}
-	zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
-
-	if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
-		Z_DELREF_PP(variable_ptr_ptr);
+	} else if ((IS_VAR == IS_VAR && UNEXPECTED(*value_ptr_ptr == &EG(error_zval))) ||
+		(IS_VAR == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval)))) {
+		variable_ptr_ptr = &EG(uninitialized_zval_ptr);
+	} else {
+		zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
+		if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
+			Z_DELREF_PP(variable_ptr_ptr);
+		}
 	}

 	if (RETURN_VALUE_USED(opline)) {
@@ -23903,11 +23906,14 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLE
 	if ((IS_CV == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||
 	    (IS_VAR == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL))) {
 		zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets nor overloaded objects");
-	}
-	zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
-
-	if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
-		Z_DELREF_PP(variable_ptr_ptr);
+	} else if ((IS_CV == IS_VAR && UNEXPECTED(*value_ptr_ptr == &EG(error_zval))) ||
+		(IS_VAR == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval)))) {
+		variable_ptr_ptr = &EG(uninitialized_zval_ptr);
+	} else {
+		zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
+		if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
+			Z_DELREF_PP(variable_ptr_ptr);
+		}
 	}

 	if (RETURN_VALUE_USED(opline)) {
@@ -37721,11 +37727,14 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLE
 	if ((IS_VAR == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||
 	    (IS_CV == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL))) {
 		zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets nor overloaded objects");
-	}
-	zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
-
-	if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
-		Z_DELREF_PP(variable_ptr_ptr);
+	} else if ((IS_VAR == IS_VAR && UNEXPECTED(*value_ptr_ptr == &EG(error_zval))) ||
+		(IS_CV == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval)))) {
+		variable_ptr_ptr = &EG(uninitialized_zval_ptr);
+	} else {
+		zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
+		if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
+			Z_DELREF_PP(variable_ptr_ptr);
+		}
 	}

 	if (RETURN_VALUE_USED(opline)) {
@@ -40929,11 +40938,14 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER
 	if ((IS_CV == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||
 	    (IS_CV == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL))) {
 		zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets nor overloaded objects");
-	}
-	zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
-
-	if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
-		Z_DELREF_PP(variable_ptr_ptr);
+	} else if ((IS_CV == IS_VAR && UNEXPECTED(*value_ptr_ptr == &EG(error_zval))) ||
+		(IS_CV == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval)))) {
+		variable_ptr_ptr = &EG(uninitialized_zval_ptr);
+	} else {
+		zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
+		if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
+			Z_DELREF_PP(variable_ptr_ptr);
+		}
 	}

 	if (RETURN_VALUE_USED(opline)) {
@@ -119,7 +119,7 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=6
-PHP_RELEASE_VERSION=24
+PHP_RELEASE_VERSION=26
 PHP_EXTRA_VERSION="RC1"
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
@@ -15,7 +15,7 @@
  | Author: Sterling Hughes <sterling@php.net>                           |
  +----------------------------------------------------------------------+
 */
- 
+
 /* $Id$ */

 #ifdef HAVE_CONFIG_H
@@ -138,29 +138,33 @@ struct php_bz2_stream_data_t {
 static size_t php_bz2iop_read(php_stream *stream, char *buf, size_t count TSRMLS_DC)
 {
 	struct php_bz2_stream_data_t *self = (struct php_bz2_stream_data_t *) stream->abstract;
-	size_t ret;
-	
-	ret = BZ2_bzread(self->bz_file, buf, count);
+	int bz2_ret;

-	if (ret == 0) {
+	bz2_ret = BZ2_bzread(self->bz_file, buf, count);
+
+	if (bz2_ret < 0) {
+		stream->eof = 1;
+		return -1;
+	}
+	if (bz2_ret == 0) {
 		stream->eof = 1;
 	}

-	return ret;
+	return (size_t)bz2_ret;
 }

 static size_t php_bz2iop_write(php_stream *stream, const char *buf, size_t count TSRMLS_DC)
 {
 	struct php_bz2_stream_data_t *self = (struct php_bz2_stream_data_t *) stream->abstract;

-	return BZ2_bzwrite(self->bz_file, (char*)buf, count); 
+	return BZ2_bzwrite(self->bz_file, (char*)buf, count);
 }

 static int php_bz2iop_close(php_stream *stream, int close_handle TSRMLS_DC)
 {
 	struct php_bz2_stream_data_t *self = (struct php_bz2_stream_data_t *)stream->abstract;
 	int ret = EOF;
-	
+
 	if (close_handle) {
 		BZ2_bzclose(self->bz_file);
 	}
@@ -192,11 +196,11 @@ php_stream_ops php_stream_bz2io_ops = {
 };

 /* {{{ Bzip2 stream openers */
-PHP_BZ2_API php_stream *_php_stream_bz2open_from_BZFILE(BZFILE *bz, 
+PHP_BZ2_API php_stream *_php_stream_bz2open_from_BZFILE(BZFILE *bz,
 														const char *mode, php_stream *innerstream STREAMS_DC TSRMLS_DC)
 {
 	struct php_bz2_stream_data_t *self;
-	
+
 	self = emalloc(sizeof(*self));

 	self->stream = innerstream;
@@ -227,7 +231,7 @@ PHP_BZ2_API php_stream *_php_stream_bz2open(php_stream_wrapper *wrapper,
 	virtual_filepath_ex(path, &path_copy, NULL TSRMLS_CC);
 #else
 	path_copy = path;
-#endif  
+#endif

 	if (php_check_open_basedir(path_copy TSRMLS_CC)) {
 #ifdef VIRTUAL_DIR
@@ -235,7 +239,7 @@ PHP_BZ2_API php_stream *_php_stream_bz2open(php_stream_wrapper *wrapper,
 #endif
 		return NULL;
 	}
-	
+
 	/* try and open it directly first */
 	bz_file = BZ2_bzopen(path_copy, mode);

@@ -246,11 +250,11 @@ PHP_BZ2_API php_stream *_php_stream_bz2open(php_stream_wrapper *wrapper,
 	efree(path_copy);
 #endif
 	path_copy = NULL;
-	
+
 	if (bz_file == NULL) {
 		/* that didn't work, so try and get something from the network/wrapper */
 		stream = php_stream_open_wrapper(path, mode, options | STREAM_WILL_CAST, opened_path);
-	
+
 		if (stream) {
 			php_socket_t fd;
 			if (SUCCESS == php_stream_cast(stream, PHP_STREAM_AS_FD, (void **) &fd, REPORT_ERRORS)) {
@@ -265,7 +269,7 @@ PHP_BZ2_API php_stream *_php_stream_bz2open(php_stream_wrapper *wrapper,
 			VCWD_UNLINK(*opened_path);
 		}
 	}
-	
+
 	if (bz_file) {
 		retstream = _php_stream_bz2open_from_BZFILE(bz_file, mode, stream STREAMS_REL_CC TSRMLS_CC);
 		if (retstream) {
@@ -341,7 +345,7 @@ static PHP_FUNCTION(bzread)
 	if (FAILURE == zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "r|l", &bz, &len)) {
 		RETURN_FALSE;
 	}
-	
+
 	php_stream_from_zval(stream, &bz);

 	if ((len + 1) < 1) {
@@ -351,13 +355,13 @@ static PHP_FUNCTION(bzread)

 	Z_STRVAL_P(return_value) = emalloc(len + 1);
 	Z_STRLEN_P(return_value) = php_stream_read(stream, Z_STRVAL_P(return_value), len);
-	
+
 	if (Z_STRLEN_P(return_value) < 0) {
 		efree(Z_STRVAL_P(return_value));
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "could not read valid bz2 data from stream");
-		RETURN_FALSE;		
+		RETURN_FALSE;
 	}
-	
+
 	Z_STRVAL_P(return_value)[Z_STRLEN_P(return_value)] = 0;
 	Z_TYPE_P(return_value) = IS_STRING;
 }
@@ -373,7 +377,7 @@ static PHP_FUNCTION(bzopen)

 	BZFILE   *bz;     /* The compressed file stream */
 	php_stream *stream = NULL;
-	
+
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "Zs", &file, &mode, &mode_len) == FAILURE) {
 		return;
 	}
@@ -389,15 +393,15 @@ static PHP_FUNCTION(bzopen)
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "filename cannot be empty");
 			RETURN_FALSE;
 		}
-		
+
 		if (CHECK_ZVAL_NULL_PATH(*file)) {
 			RETURN_FALSE;
 		}

 		stream = php_stream_bz2open(NULL,
-									Z_STRVAL_PP(file), 
-									mode, 
-									REPORT_ERRORS, 
+									Z_STRVAL_PP(file),
+									mode,
+									REPORT_ERRORS,
 									NULL);
 	} else if (Z_TYPE_PP(file) == IS_RESOURCE) {
 		/* If it is a resource, than its a stream resource */
@@ -406,7 +410,7 @@ static PHP_FUNCTION(bzopen)

 		php_stream_from_zval(stream, file);
 		stream_mode_len = strlen(stream->mode);
-		
+
 		if (stream_mode_len != 1 && !(stream_mode_len == 2 && memchr(stream->mode, 'b', 2))) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "cannot use stream opened in mode '%s'", stream->mode);
 			RETURN_FALSE;
@@ -440,7 +444,7 @@ static PHP_FUNCTION(bzopen)
 		if (FAILURE == php_stream_cast(stream, PHP_STREAM_AS_FD, (void *) &fd, REPORT_ERRORS)) {
 			RETURN_FALSE;
 		}
-		
+
 		bz = BZ2_bzdopen(fd, mode);

 		stream = php_stream_bz2open_from_BZFILE(bz, mode, stream);
@@ -494,7 +498,7 @@ static PHP_FUNCTION(bzcompress)
 					  work_factor = 0, /* Work factor for compression algorithm */
 					  argc;            /* Argument count */
 	int               source_len;      /* Length of the source data */
-	unsigned int      dest_len;        /* Length of the destination buffer */ 
+	unsigned int      dest_len;        /* Length of the destination buffer */

 	argc = ZEND_NUM_ARGS();

@@ -503,19 +507,19 @@ static PHP_FUNCTION(bzcompress)
 	}

 	/* Assign them to easy to use variables, dest_len is initially the length of the data
-	   + .01 x length of data + 600 which is the largest size the results of the compression 
-	   could possibly be, at least that's what the libbz2 docs say (thanks to jeremy@nirvani.net 
+	   + .01 x length of data + 600 which is the largest size the results of the compression
+	   could possibly be, at least that's what the libbz2 docs say (thanks to jeremy@nirvani.net
 	   for pointing this out).  */
 	dest_len   = (unsigned int) (source_len + (0.01 * source_len) + 600);
-	
+
 	/* Allocate the destination buffer */
 	dest = emalloc(dest_len + 1);
-	
+
 	/* Handle the optional arguments */
 	if (argc > 1) {
 		block_size = zblock_size;
 	}
-	
+
 	if (argc > 2) {
 		work_factor = zwork_factor;
 	}
@@ -565,20 +569,30 @@ static PHP_FUNCTION(bzdecompress)
 	/* in most cases bz2 offers at least 2:1 compression, so we use that as our base */
 	bzs.avail_out = source_len * 2;
 	bzs.next_out = dest = emalloc(bzs.avail_out + 1);
-	
+
 	while ((error = BZ2_bzDecompress(&bzs)) == BZ_OK && bzs.avail_in > 0) {
 		/* compression is better then 2:1, need to allocate more memory */
 		bzs.avail_out = source_len;
 		size = (bzs.total_out_hi32 * (unsigned int) -1) + bzs.total_out_lo32;
+		if (size > INT_MAX) {
+			/* no reason to continue if we're going to drop it anyway */
+			break;
+		}
 		dest = safe_erealloc(dest, 1, bzs.avail_out+1, (size_t) size );
 		bzs.next_out = dest + size;
 	}

 	if (error == BZ_STREAM_END || error == BZ_OK) {
 		size = (bzs.total_out_hi32 * (unsigned int) -1) + bzs.total_out_lo32;
-		dest = safe_erealloc(dest, 1, (size_t) size, 1);
-		dest[size] = '\0';
-		RETVAL_STRINGL(dest, (int) size, 0);
+		if (size > INT_MAX) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Decompressed size too big, max is %d", INT_MAX);
+			efree(dest);
+			RETVAL_LONG(BZ_MEM_ERROR);
+		} else {
+			dest = safe_erealloc(dest, 1, (size_t) size, 1);
+			dest[size] = '\0';
+			RETVAL_STRINGL(dest, (int) size, 0);
+		}
 	} else { /* real error */
 		efree(dest);
 		RETVAL_LONG(error);
@@ -591,13 +605,13 @@ static PHP_FUNCTION(bzdecompress)
 /* {{{ php_bz2_error()
   The central error handling interface, does the work for bzerrno, bzerrstr and bzerror */
 static void php_bz2_error(INTERNAL_FUNCTION_PARAMETERS, int opt)
-{ 
+{
 	zval         *bzp;     /* BZip2 Resource Pointer */
 	php_stream   *stream;
 	const char   *errstr;  /* Error string */
 	int           errnum;  /* Error number */
 	struct php_bz2_stream_data_t *self;
-	
+
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "r", &bzp) == FAILURE) {
 		return;
 	}
@@ -609,10 +623,10 @@ static void php_bz2_error(INTERNAL_FUNCTION_PARAMETERS, int opt)
 	}

 	self = (struct php_bz2_stream_data_t *) stream->abstract;
-	
+
 	/* Fetch the error information */
 	errstr = BZ2_bzerror(self->bz_file, &errnum);
-	
+
 	/* Determine what to return */
 	switch (opt) {
 		case PHP_BZ_ERRNO:
@@ -623,7 +637,7 @@ static void php_bz2_error(INTERNAL_FUNCTION_PARAMETERS, int opt)
 			break;
 		case PHP_BZ_ERRBOTH:
 			array_init(return_value);
-		
+
 			add_assoc_long  (return_value, "errno",  errnum);
 			add_assoc_string(return_value, "errstr", (char*)errstr, 1);
 			break;
@@ -0,0 +1,23 @@
+--TEST--
+Bug #72613 (Inadequate error handling in bzread())
+--SKIPIF--
+<?php if (!extension_loaded("bz2")) print "skip"; ?>
+--FILE--
+<?php
+$fp = bzopen(__DIR__.'/72613.bz2', 'r');
+if ($fp === FALSE) {
+    exit("ERROR: bzopen()");
+}
+$data = "";
+while (!feof($fp)) {
+    $res = bzread($fp);
+    if ($res === FALSE) {
+        exit("ERROR: bzread()");
+    }
+    $data .= $res;
+}
+bzclose($fp);
+?>
+DONE
+--EXPECT--
+DONE
@@ -359,6 +359,10 @@ PHP_FUNCTION(cal_days_in_month)
 		}
 		else {
 			sdn_next = calendar->to_jd(year + 1, 1, 1);
+			if (cal == CAL_FRENCH && sdn_next == 0) {
+				/* The French calendar ends on 0014-13-05. */
+				sdn_next = 2380953;
+			}
 		}
 	}

@@ -416,15 +420,21 @@ PHP_FUNCTION(cal_from_jd)
 	add_assoc_long(return_value, "year", year);

 /* day of week */
-	dow = DayOfWeek(jd);
-	add_assoc_long(return_value, "dow", dow);
-	add_assoc_string(return_value, "abbrevdayname", DayNameShort[dow], 1);
-	add_assoc_string(return_value, "dayname", DayNameLong[dow], 1);
+	if (cal != CAL_JEWISH || year > 0) {
+		dow = DayOfWeek(jd);
+		add_assoc_long(return_value, "dow", dow);
+		add_assoc_string(return_value, "abbrevdayname", DayNameShort[dow], 1);
+		add_assoc_string(return_value, "dayname", DayNameLong[dow], 1);
+	} else {
+		add_assoc_null(return_value, "dow");
+		add_assoc_string(return_value, "abbrevdayname", "", 1);
+		add_assoc_string(return_value, "dayname", "", 1);
+	}
 /* month name */
 	if(cal == CAL_JEWISH) {
 		/* special case for Jewish calendar */
-		add_assoc_string(return_value, "abbrevmonth", JEWISH_MONTH_NAME(year)[month], 1);
-		add_assoc_string(return_value, "monthname", JEWISH_MONTH_NAME(year)[month], 1);
+		add_assoc_string(return_value, "abbrevmonth", (year > 0 ? JEWISH_MONTH_NAME(year)[month] : ""), 1);
+		add_assoc_string(return_value, "monthname", (year > 0 ? JEWISH_MONTH_NAME(year)[month] : ""), 1);
 	} else {
 		add_assoc_string(return_value, "abbrevmonth", calendar->month_name_short[month], 1);
 		add_assoc_string(return_value, "monthname", calendar->month_name_long[month], 1);
@@ -737,7 +747,7 @@ PHP_FUNCTION(jdmonthname)
 		break;
 	case CAL_MONTH_JEWISH:		/* jewish month */
 		SdnToJewish(julday, &year, &month, &day);
-		monthname = JEWISH_MONTH_NAME(year)[month];
+		monthname = (year > 0 ? JEWISH_MONTH_NAME(year)[month] : "");
 		break;
 	case CAL_MONTH_FRENCH:		/* french month */
 		SdnToFrench(julday, &year, &month, &day);
@@ -0,0 +1,12 @@
+--TEST--
+Bug #67976 (cal_days_month() fails for final month of the French calendar)
+--SKIPIF--
+<?php
+if (!extension_loaded('calendar')) die('skip ext/calendar required');
+?>
+--FILE--
+<?php
+var_dump(cal_days_in_month(CAL_FRENCH, 13, 14));
+?>
+--EXPECT--
+int(5)
@@ -0,0 +1,32 @@
+--TEST--
+Bug #71894 (AddressSanitizer: global-buffer-overflow in zif_cal_from_jd)
+--SKIPIF--
+<?php
+if (!extension_loaded('calendar')) die('skip ext/calendar required');
+?>
+--FILE--
+<?php
+var_dump(cal_from_jd(347997, CAL_JEWISH));
+var_dump(jdmonthname(347997,CAL_MONTH_JEWISH));?>
+--EXPECT--
+array(9) {
+  ["date"]=>
+  string(5) "0/0/0"
+  ["month"]=>
+  int(0)
+  ["day"]=>
+  int(0)
+  ["year"]=>
+  int(0)
+  ["dow"]=>
+  NULL
+  ["abbrevdayname"]=>
+  string(0) ""
+  ["dayname"]=>
+  string(0) ""
+  ["abbrevmonth"]=>
+  string(0) ""
+  ["monthname"]=>
+  string(0) ""
+}
+string(0) ""
@@ -0,0 +1,28 @@
+--TEST--
+jdtogregorian(): test overflow
+--CREDITS--
+neweracracker@gmail.com
+--SKIPIF--
+<?php
+if (!extension_loaded('calendar')) die('skip ext/calendar required');
+if (PHP_INT_SIZE != 4) die('skip this test is for 32bit platforms only');
+?>
+--FILE--
+<?php
+for ($i=536838860; $i<536838870; $i++) {
+	echo $i, ':', jdtogregorian($i), PHP_EOL;
+}
+echo 'DONE', PHP_EOL;
+?>
+--EXPECT--
+536838860:10/11/1465102
+536838861:10/12/1465102
+536838862:10/13/1465102
+536838863:10/14/1465102
+536838864:10/15/1465102
+536838865:10/16/1465102
+536838866:10/17/1465102
+536838867:0/0/0
+536838868:0/0/0
+536838869:0/0/0
+DONE
@@ -0,0 +1,27 @@
+--TEST--
+jdtojewish(): test overflow
+--CREDITS--
+neweracracker@gmail.com
+--SKIPIF--
+<?php
+if (!extension_loaded('calendar')) die('skip ext/calendar required');
+?>
+--FILE--
+<?php
+for ($i=324542840; $i<324542850; $i++) {
+	echo $i, ':', jdtojewish($i), PHP_EOL;
+}
+echo 'DONE', PHP_EOL;
+?>
+--EXPECT--
+324542840:12/7/887605
+324542841:12/8/887605
+324542842:12/9/887605
+324542843:12/10/887605
+324542844:12/11/887605
+324542845:12/12/887605
+324542846:12/13/887605
+324542847:0/0/0
+324542848:0/0/0
+324542849:0/0/0
+DONE
@@ -1833,38 +1833,6 @@ static void alloc_curl_handle(php_curl **ch)
 /* }}} */

 #if LIBCURL_VERSION_NUM >= 0x071301 /* Available since 7.19.1 */
-/* {{{ split_certinfo
- */
-static void split_certinfo(char *string, zval *hash)
-{
-	char *org = estrdup(string);
-	char *s = org;
-	char *split;
-
-	if(org) {
-		do {
-			char *key;
-			char *val;
-			char *tmp;
-
-			split = strstr(s, "; ");
-			if(split)
-				*split = '\0';
-
-			key = s;
-			tmp = memchr(key, '=', 64);
-			if(tmp) {
-				*tmp = '\0';
-				val = tmp+1;
-				add_assoc_string(hash, key, val, 1);
-			}
-			s = split+2;
-		} while(split);
-		efree(org);
-	}
-}
-/* }}} */
-
 /* {{{ create_certinfo
 */
 static void create_certinfo(struct curl_certinfo *ci, zval *listcode TSRMLS_DC)
@@ -1883,22 +1851,13 @@ static void create_certinfo(struct curl_certinfo *ci, zval *listcode TSRMLS_DC)
 				int len;
 				char s[64];
 				char *tmp;
-				strncpy(s, slist->data, 64);
-				tmp = memchr(s, ':', 64);
+				strncpy(s, slist->data, sizeof(s));
+				s[sizeof(s)-1] = '\0';
+				tmp = memchr(s, ':', sizeof(s));
 				if(tmp) {
 					*tmp = '\0';
 					len = strlen(s);
-					if(!strcmp(s, "Subject") || !strcmp(s, "Issuer")) {
-						zval *hash;
-
-						MAKE_STD_ZVAL(hash);
-						array_init(hash);
-
-						split_certinfo(&slist->data[len+1], hash);
-						add_assoc_zval(certhash, s, hash);
-					} else {
-						add_assoc_string(certhash, s, &slist->data[len+1], 1);
-					}
+					add_assoc_string(certhash, s, &slist->data[len+1], 1);
 				} else {
 					php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not extract hash key from certificate info");
 				}
@@ -1925,7 +1884,9 @@ static void _php_curl_set_default_options(php_curl *ch)
 	curl_easy_setopt(ch->cp, CURLOPT_INFILE,            (void *) ch);
 	curl_easy_setopt(ch->cp, CURLOPT_HEADERFUNCTION,    curl_write_header);
 	curl_easy_setopt(ch->cp, CURLOPT_WRITEHEADER,       (void *) ch);
+#if !defined(ZTS)
 	curl_easy_setopt(ch->cp, CURLOPT_DNS_USE_GLOBAL_CACHE, 1);
+#endif
 	curl_easy_setopt(ch->cp, CURLOPT_DNS_CACHE_TIMEOUT, 120);
 	curl_easy_setopt(ch->cp, CURLOPT_MAXREDIRS, 20); /* prevent infinite redirects */

@@ -2263,7 +2224,14 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue TSRMLS_DC)
 					return 1;
 			}
 #endif
+# if defined(ZTS)
+			if (option == CURLOPT_DNS_USE_GLOBAL_CACHE) {
+				php_error_docref(NULL TSRMLS_CC, E_WARNING, "CURLOPT_DNS_USE_GLOBAL_CACHE cannot be activated when thread safety is enabled");
+				return 1;
+			}
+# endif
 			error = curl_easy_setopt(ch->cp, option, Z_LVAL_PP(zvalue));
+
 			break;
 		case CURLOPT_SAFE_UPLOAD:
 			convert_to_long_ex(zvalue);
@@ -2547,12 +2515,13 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue TSRMLS_DC)
 				}
 			}

-			if (Z_REFCOUNT_P(ch->clone) <= 1) {
-				zend_hash_index_update(ch->to_free->slist, (ulong) option, &slist, sizeof(struct curl_slist *), NULL);
-			} else {
-				zend_hash_next_index_insert(ch->to_free->slist, &slist, sizeof(struct curl_slist *), NULL);
+			if (slist) {
+				if (Z_REFCOUNT_P(ch->clone) <= 1) {
+					zend_hash_index_update(ch->to_free->slist, (ulong) option, &slist, sizeof(struct curl_slist *), NULL);
+				} else {
+					zend_hash_next_index_insert(ch->to_free->slist, &slist, sizeof(struct curl_slist *), NULL);
+				}
 			}
-
 			error = curl_easy_setopt(ch->cp, option, slist);

 			break;
@@ -3510,6 +3479,10 @@ PHP_FUNCTION(curl_escape)
 	ZEND_FETCH_RESOURCE(ch, php_curl *, &zid, -1, le_curl_name, le_curl);

 	if ((res = curl_easy_escape(ch->cp, str, str_len))) {
+		if (strlen(res) > INT_MAX) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Escaped string is too long, maximum is %d", INT_MAX);
+			RETURN_FALSE;
+		}
 		RETVAL_STRING(res, 1);
 		curl_free(res);
 	} else {
@@ -0,0 +1,13 @@
+--TEST--
+Bug #71144 (Sementation fault when using cURL with ZTS)
+--SKIPIF--
+<?php include 'skipif.inc'; ?>
+<?php if (!PHP_ZTS) { print "skip only for zts build"; } ?>
+--FILE--
+<?php
+$ch = curl_init();
+var_dump(curl_setopt($ch, CURLOPT_DNS_USE_GLOBAL_CACHE, 1));
+?>
+--EXPECTF--
+Warning: curl_setopt(): CURLOPT_DNS_USE_GLOBAL_CACHE cannot be activated when thread safety is enabled in %sbug71144.php on line %d
+bool(false)
@@ -0,0 +1,15 @@
+--TEST--
+Bug #66836 (DateTime::createFromFormat 'U' with pre 1970 dates fails parsing)
+--INI--
+date.timezone=Europe/Berlin
+--FILE--
+<?php
+foreach (['-1', '-86400', '-1000000'] as $timestamp) {
+    $dt = DateTime::createFromFormat('U', $timestamp);
+    var_dump($dt->format('U') === $timestamp);
+}
+?>
+--EXPECT--
+bool(true)
+bool(true)
+bool(true)
@@ -250,6 +250,7 @@ val_type inifile_fetch(inifile *dba, const key_type *key, int skip TSRMLS_DC) {
 	if (skip == -1 && dba->next.key.group && dba->next.key.name && !inifile_key_cmp(&dba->next.key, key TSRMLS_CC)) {
 		/* we got position already from last fetch */
 		php_stream_seek(dba->fp, dba->next.pos, SEEK_SET);
+		ln.key.group = estrdup(dba->next.key.group);
 	} else {
 		/* specific instance or not same key -> restart search */
 		/* the slow way: restart and seacrch */
@@ -402,7 +403,7 @@ static int inifile_copy_to(inifile *dba, size_t pos_start, size_t pos_end, inifi
 		return FAILURE;
 	}
 	php_stream_seek(dba->fp, pos_start, SEEK_SET);
-	if (!php_stream_copy_to_stream_ex(dba->fp, fp, pos_end - pos_start, NULL)) {
+	if (SUCCESS != php_stream_copy_to_stream_ex(dba->fp, fp, pos_end - pos_start, NULL)) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not copy group [%zu - %zu] to temporary stream", pos_start, pos_end);
 		return FAILURE;
 	} 
@@ -427,7 +428,7 @@ static int inifile_filter(inifile *dba, inifile *from, const key_type *key TSRML
 			pos_curr = php_stream_tell(from->fp);
 			if (pos_start != pos_next) {
 				php_stream_seek(from->fp, pos_start, SEEK_SET);
-				if (!php_stream_copy_to_stream_ex(from->fp, dba->fp, pos_next - pos_start, NULL)) {
+				if (SUCCESS != php_stream_copy_to_stream_ex(from->fp, dba->fp, pos_next - pos_start, NULL)) {
 					php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not copy [%zu - %zu] from temporary stream", pos_next, pos_start);
 					ret = FAILURE;
 				}
@@ -446,7 +447,7 @@ static int inifile_filter(inifile *dba, inifile *from, const key_type *key TSRML
 	}
 	if (pos_start != pos_next) {
 		php_stream_seek(from->fp, pos_start, SEEK_SET);
-		if (!php_stream_copy_to_stream_ex(from->fp, dba->fp, pos_next - pos_start, NULL)) {
+		if (SUCCESS != php_stream_copy_to_stream_ex(from->fp, dba->fp, pos_next - pos_start, NULL)) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not copy [%zu - %zu] from temporary stream", pos_next, pos_start);
 			ret = FAILURE;
 		}
@@ -497,7 +498,7 @@ static int inifile_delete_replace_append(inifile *dba, const key_type *key, cons
 			php_stream_seek(dba->fp, 0, SEEK_END);
 			if (pos_grp_next != (size_t)php_stream_tell(dba->fp)) {
 				php_stream_seek(dba->fp, pos_grp_next, SEEK_SET);
-				if (!php_stream_copy_to_stream_ex(dba->fp, fp_tmp, PHP_STREAM_COPY_ALL, NULL)) {
+				if (SUCCESS != php_stream_copy_to_stream_ex(dba->fp, fp_tmp, PHP_STREAM_COPY_ALL, NULL)) {
 					php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not copy remainder to temporary stream");
 					ret = FAILURE;
 				}
@@ -538,7 +539,7 @@ static int inifile_delete_replace_append(inifile *dba, const key_type *key, cons
 		if (fp_tmp && php_stream_tell(fp_tmp)) {
 			php_stream_seek(fp_tmp, 0, SEEK_SET);
 			php_stream_seek(dba->fp, 0, SEEK_END);
-			if (!php_stream_copy_to_stream_ex(fp_tmp, dba->fp, PHP_STREAM_COPY_ALL, NULL)) {
+			if (SUCCESS != php_stream_copy_to_stream_ex(fp_tmp, dba->fp, PHP_STREAM_COPY_ALL, NULL)) {
 				php_error_docref(NULL TSRMLS_CC, E_RECOVERABLE_ERROR, "Could not copy from temporary stream - ini file truncated");
 				ret = FAILURE;
 			}
@@ -0,0 +1,71 @@
+--TEST--
+Bug #70825 (Cannot fetch multiple values with group in ini file)
+--SKIPIF--
+<?php
+if (!extension_loaded('dba')) die('skip dba extension not available');
+if (!in_array('inifile', dba_handlers())) die('skip inifile handler not available');
+?>
+--FILE--
+<?php
+$filename = __DIR__ . DIRECTORY_SEPARATOR . 'bug70825.ini';
+
+$db = dba_open($filename, 'n', 'inifile');
+dba_insert('foo', 23, $db);
+dba_insert('foo', 42, $db);
+dba_insert('foo', 1337, $db);
+var_dump(dba_fetch('foo', -1, $db));
+var_dump(dba_fetch('foo', -1, $db));
+var_dump(dba_fetch('foo', -1, $db));
+dba_close($db);
+unlink($filename);
+
+$db = dba_open($filename, 'n', 'inifile');
+dba_insert(['foo', 'bar'], 23, $db);
+dba_insert(['foo', 'bar'], 42, $db);
+dba_insert(['foo', 'bar'], 1337, $db);
+var_dump(dba_fetch(['foo', 'bar'], -1, $db));
+var_dump(dba_fetch(['foo', 'bar'], -1, $db));
+var_dump(dba_fetch(['foo', 'bar'], -1, $db));
+dba_close($db);
+unlink($filename);
+
+$db = dba_open($filename, 'n', 'inifile');
+dba_insert('[foo]bar', 23, $db);
+dba_insert('[foo]bar', 42, $db);
+dba_insert('[foo]bar', 1337, $db);
+var_dump(dba_fetch('[foo]bar', -1, $db));
+var_dump(dba_fetch('[foo]bar', -1, $db));
+var_dump(dba_fetch('[foo]bar', -1, $db));
+dba_close($db);
+unlink($filename);
+
+$db = dba_open($filename, 'n', 'inifile');
+dba_insert('[foo]bar', 23, $db);
+dba_insert('[foo]bar', 42, $db);
+dba_insert('[foo]bar', 1337, $db);
+var_dump(dba_fetch('[foo]bar', 0, $db));
+var_dump(dba_fetch('[foo]bar', 1, $db));
+var_dump(dba_fetch('[foo]bar', 2, $db));
+dba_close($db);
+unlink($filename);
+?>
+==DONE==
+--EXPECT--
+string(2) "23"
+string(2) "42"
+string(4) "1337"
+string(2) "23"
+string(2) "42"
+string(4) "1337"
+string(2) "23"
+string(2) "42"
+string(4) "1337"
+string(2) "23"
+string(2) "42"
+string(4) "1337"
+==DONE==
+--CLEAN--
+<?php
+$filename = __DIR__ . DIRECTORY_SEPARATOR . 'bug70825.ini';
+unlink($filename);
+?>
@@ -0,0 +1,28 @@
+--TEST--
+Bug #71514 (Bad dba_replace condition because of wrong API usage)
+--SKIPIF--
+<?php
+if (!extension_loaded('dba')) die('skip dba extension not available');
+if (!in_array('inifile', dba_handlers())) die('skip inifile handler not available');
+?>
+--FILE--
+<?php
+$filename = __DIR__ . DIRECTORY_SEPARATOR . 'bug71514.ini';
+
+$db = dba_open($filename, 'c', 'inifile');
+
+dba_insert('foo', 'value1', $db);
+dba_replace('foo', 'value2', $db);
+var_dump(dba_fetch('foo', $db));
+
+dba_close($db);
+?>
+==DONE==
+--EXPECT--
+string(6) "value2"
+==DONE==
+--CLEAN--
+<?php
+$filename = __DIR__ . DIRECTORY_SEPARATOR . 'bug71514.ini';
+unlink($filename);
+?>
@@ -40,7 +40,7 @@ do {
 	}
 	if ($handler != 'cdb') {
 		$db_writer = dba_open($db_filename, 'c'.$lock_flag, $handler);
-		if (($dba_reader = @dba_open($db_filename, 'r'.$lock_flag.($lock_flag ? 't' : ''), $handler))===false) {
+		if (($dba_reader = @dba_open($db_filename, 'r'.$lock_flag.'t', $handler))===false) {
 			echo "Read during write: not allowed\n";
 		} else {
 			echo "Read during write: allowed\n";
@@ -0,0 +1,20 @@
+--TEST--
+Bug #66502 (DOM document dangling reference)
+--SKIPIF--
+<?php
+if (!extension_loaded('dom')) die('skip requires ext/dom');
+?>
+--FILE--
+<?php
+$dom = new DOMDocument('1.0', 'UTF-8');
+$element = $dom->appendChild(new DOMElement('root'));
+$comment = new DOMComment("Comment 0");
+$comment = $element->appendChild($comment);
+
+$comment->__construct("Comment 1");
+$comment->__construct("Comment 2");
+$comment->__construct("Comment 3");
+echo 'DONE', PHP_EOL;
+?>
+--EXPECT--
+DONE
@@ -743,6 +743,11 @@ PHP_EREG_API PHP_FUNCTION(sql_regcase)
 	
 	for (i = j = 0; i < string_len; i++) {
 		c = (unsigned char) string[i];
+		if ( j >= INT_MAX - 1 || (isalpha(c) && j >= INT_MAX - 4)) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "String too long, max length is %d", INT_MAX);
+			efree(tmp);
+			RETURN_FALSE;
+		}
 		if (isalpha(c)) {
 			tmp[j++] = '[';
 			tmp[j++] = toupper(c);
@@ -1709,6 +1709,10 @@ static void exif_iif_add_value(image_info_type *image_info, int section_index, c
 				break;
 		case TAG_FMT_UNDEFINED:
 			if (value) {
+				if (tag == TAG_MAKER_NOTE) {
+					length = MIN(length, strlen(value));
+				}
+
 				/* do not recompute length here */
 				info_value->s = estrndup(value, length);
 				info_data->length = length;
@@ -2613,6 +2617,7 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
 	*pszEncoding = NULL;
 	/* Copy the comment */
 	if (ByteCount>=8) {
+		const zend_encoding *from, *to;
 		if (!memcmp(szValuePtr, "UNICODE\0", 8)) {
 			*pszEncoding = estrdup((const char*)szValuePtr);
 			szValuePtr = szValuePtr+8;
@@ -2633,14 +2638,16 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
 			} else {
 				decode = ImageInfo->decode_unicode_le;
 			}
+			to = zend_multibyte_fetch_encoding(ImageInfo->encode_unicode TSRMLS_CC);
+			from = zend_multibyte_fetch_encoding(decode TSRMLS_CC);
 			/* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX   */
-			if (zend_multibyte_encoding_converter(
+			if (!to || !from || zend_multibyte_encoding_converter(
 					(unsigned char**)pszInfoPtr,
 					&len,
 					(unsigned char*)szValuePtr,
 					ByteCount,
-					zend_multibyte_fetch_encoding(ImageInfo->encode_unicode TSRMLS_CC),
-					zend_multibyte_fetch_encoding(decode TSRMLS_CC)
+					to,
+					from
 					TSRMLS_CC) == (size_t)-1) {
 				len = exif_process_string_raw(pszInfoPtr, szValuePtr, ByteCount);
 			}
@@ -2655,13 +2662,15 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
 			szValuePtr = szValuePtr+8;
 			ByteCount -= 8;
 			/* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX   */
-			if (zend_multibyte_encoding_converter(
+			to = zend_multibyte_fetch_encoding(ImageInfo->encode_jis TSRMLS_CC);
+			from = zend_multibyte_fetch_encoding(ImageInfo->motorola_intel ? ImageInfo->decode_jis_be : ImageInfo->decode_jis_le TSRMLS_CC);
+			if (!to || !from || zend_multibyte_encoding_converter(
 					(unsigned char**)pszInfoPtr,
 					&len,
 					(unsigned char*)szValuePtr,
 					ByteCount,
-					zend_multibyte_fetch_encoding(ImageInfo->encode_jis TSRMLS_CC),
-					zend_multibyte_fetch_encoding(ImageInfo->motorola_intel ? ImageInfo->decode_jis_be : ImageInfo->decode_jis_le TSRMLS_CC)
+					to,
+					from
 					TSRMLS_CC) == (size_t)-1) {
 				len = exif_process_string_raw(pszInfoPtr, szValuePtr, ByteCount);
 			}
@@ -2718,8 +2727,14 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 	char *dir_start;

 	for (i=0; i<=sizeof(maker_note_array)/sizeof(maker_note_type); i++) {
-		if (i==sizeof(maker_note_array)/sizeof(maker_note_type))
-			return FALSE;
+		if (i==sizeof(maker_note_array)/sizeof(maker_note_type)) {
+#ifdef EXIF_DEBUG
+			exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "No maker note data found. Detected maker: %s (length = %d)", ImageInfo->make, strlen(ImageInfo->make));
+#endif
+			/* unknown manufacturer, not an error, use it as a string */
+			return TRUE;
+		}
+
 		maker_note = maker_note_array+i;

 		/*exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "check (%s,%s)", maker_note->make?maker_note->make:"", maker_note->model?maker_note->model:"");*/
@@ -2732,6 +2747,12 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 		break;
 	}

+	if (maker_note->offset >= value_len) {
+		/* Do not go past the value end */
+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "IFD data too short: 0x%04X offset 0x%04X", value_len, maker_note->offset);
+		return FALSE;
+	}
+
 	dir_start = value_ptr + maker_note->offset;

 #ifdef EXIF_DEBUG
@@ -2760,10 +2781,19 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 			offset_base = value_ptr;
 			break;
 		case MN_OFFSET_GUESS:
+			if (maker_note->offset + 10 + 4 >= value_len) {
+				/* Can not read dir_start+10 since it's beyond value end */
+				exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "IFD data too short: 0x%04X", value_len);
+				return FALSE;
+			}
 			offset_diff = 2 + NumDirEntries*12 + 4 - php_ifd_get32u(dir_start+10, ImageInfo->motorola_intel);
 #ifdef EXIF_DEBUG
 			exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Using automatic offset correction: 0x%04X", ((int)dir_start-(int)offset_base+maker_note->offset+displacement) + offset_diff);
 #endif
+			if (offset_diff < 0 || offset_diff >= value_len ) {
+				exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "IFD data bad offset: 0x%04X length 0x%04X", offset_diff, value_len);
+				return FALSE;
+			}
 			offset_base = value_ptr + offset_diff;
 			break;
 		default:
@@ -2772,7 +2802,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 	}

 	if ((2+NumDirEntries*12) > value_len) {
-		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 2 + x%04X*12 = x%04X > x%04X", NumDirEntries, 2+NumDirEntries*12, value_len);
+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 2 + 0x%04X*12 = 0x%04X > 0x%04X", NumDirEntries, 2+NumDirEntries*12, value_len);
 		return FALSE;
 	}

@@ -3058,7 +3088,10 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				break;

 			case TAG_MAKER_NOTE:
-				exif_process_IFD_in_MAKERNOTE(ImageInfo, value_ptr, byte_count, offset_base, IFDlength, displacement TSRMLS_CC);
+				if (!exif_process_IFD_in_MAKERNOTE(ImageInfo, value_ptr, byte_count, offset_base, IFDlength, displacement TSRMLS_CC)) {
+					EFREE_IF(outside);
+					return FALSE;
+				}
 				break;

 			case TAG_EXIF_IFD_POINTER:
@@ -3735,8 +3768,11 @@ static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offse
 						fgot = php_stream_read(ImageInfo->infile, ImageInfo->Thumbnail.data, ImageInfo->Thumbnail.size);
 						if (fgot < ImageInfo->Thumbnail.size) {
 							EXIF_ERRLOG_THUMBEOF(ImageInfo)
+							efree(ImageInfo->Thumbnail.data);
+							ImageInfo->Thumbnail.data = NULL;
+						} else {
+							exif_thumbnail_build(ImageInfo TSRMLS_CC);
 						}
-						exif_thumbnail_build(ImageInfo TSRMLS_CC);
 					}
 #ifdef EXIF_DEBUG
 					exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read next IFD (THUMBNAIL) done");
@@ -13,8 +13,4 @@ exif_read_data(__DIR__ . '/bug54002_2.jpeg');
 --EXPECTF--
 Warning: exif_read_data(bug54002_1.jpeg): Process tag(x0205=UndefinedTa): Illegal byte_count in %sbug54002.php on line %d

-Warning: exif_read_data(bug54002_1.jpeg): Process tag(xA000=FlashPixVer): Illegal pointer offset(%s) in %sbug54002.php on line %d
-
-Warning: exif_read_data(bug54002_2.jpeg): Process tag(x0205=UndefinedTa): Illegal byte_count in %sbug54002.php on line %d
-
-Warning: exif_read_data(bug54002_2.jpeg): Process tag(xA000=FlashPixVer): Illegal pointer offset(%s) in %sbug54002.php on line %d
+Warning: exif_read_data(bug54002_2.jpeg): Process tag(x0205=UndefinedTa): Illegal byte_count in %sbug54002.php on line %d
@@ -10,7 +10,9 @@ echo "Test\n";
 var_dump(count(exif_read_data(__DIR__."/bug62523_2.jpg")));
 ?>
 Done
--EXPECT--
+--EXPECTF--
 Test
-int(76)
+
+Warning: exif_read_data(bug62523_2.jpg): IFD data bad offset: 0xADB23672 length 0x0D94 in %s%ebug62523_2.php on line %d
+int(30)
 Done
@@ -0,0 +1,11 @@
+--TEST--
+Bug #72603 (Out of bound read in exif_process_IFD_in_MAKERNOTE)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+var_dump(count(exif_read_data(dirname(__FILE__) . "/bug72603.jpeg")));
+?>
+--EXPECTF--
+Warning: exif_read_data(bug72603.jpeg): %s in %s%ebug72603.php on line %d
+int(%d)
@@ -0,0 +1,11 @@
+--TEST--
+Bug 72618 (NULL Pointer Dereference in exif_process_user_comment)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+var_dump(count(exif_read_data(dirname(__FILE__) . "/bug72618.jpg")));
+?>
+--EXPECTF--
+Warning: exif_read_data(bug72618.jpg): %s in %s%ebug72618.php on line %d
+int(%d)
@@ -0,0 +1,71 @@
+--TEST--
+Bug #72627 (Memory Leakage In exif_process_IFD_in_TIFF)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+	$exif = exif_read_data(__DIR__ . '/bug72627.tiff',0,0,true);
+	var_dump($exif);
+?>
+--EXPECTF--
+Warning: exif_read_data(%s): Thumbnail goes IFD boundary or end of file reached in %sbug72627.php on line %d
+
+Warning: exif_read_data(%s): Error in TIFF: filesize(x04E2) less than start of IFD dir(x829A0004) in %sbug72627.php on line %d
+
+Warning: exif_read_data(%s): Thumbnail goes IFD boundary or end of file reached in %sbug72627.php on line %d
+array(11) {
+  ["FileName"]=>
+  string(13) "bug72627.tiff"
+  ["FileDateTime"]=>
+  int(%d)
+  ["FileSize"]=>
+  int(1250)
+  ["FileType"]=>
+  int(7)
+  ["MimeType"]=>
+  string(10) "image/tiff"
+  ["SectionsFound"]=>
+  string(30) "ANY_TAG, IFD0, THUMBNAIL, EXIF"
+  ["COMPUTED"]=>
+  array(10) {
+    ["html"]=>
+    string(24) "width="128" height="132""
+    ["Height"]=>
+    int(132)
+    ["Width"]=>
+    int(128)
+    ["IsColor"]=>
+    int(0)
+    ["ByteOrderMotorola"]=>
+    int(0)
+    ["ApertureFNumber"]=>
+    string(5) "f/1.0"
+    ["Thumbnail.FileType"]=>
+    int(2)
+    ["Thumbnail.MimeType"]=>
+    string(10) "image/jpeg"
+    ["Thumbnail.Height"]=>
+    int(132)
+    ["Thumbnail.Width"]=>
+    int(128)
+  }
+  ["XResolution"]=>
+  string(21) "1414812756/1414812756"
+  ["THUMBNAIL"]=>
+  array(5) {
+    ["ImageWidth"]=>
+    int(128)
+    ["ImageLength"]=>
+    int(132)
+    ["JPEGInterchangeFormat"]=>
+    int(1280)
+    ["JPEGInterchangeFormatLength"]=>
+    int(100)
+    ["THUMBNAIL"]=>
+    NULL
+  }
+  ["ExposureTime"]=>
+  string(21) "1414812756/1414812756"
+  ["FNumber"]=>
+  string(21) "1414812756/1414812756"
+}
@@ -0,0 +1,22 @@
+--TEST--
+Bug #69107 (finfo no longer detects PHP files)
+--SKIPIF--
+<?php
+if (!extension_loaded('fileinfo')) die('skip fileinfo extension not available');
+?>
+--FILE--
+<?php
+$finfo = new finfo(FILEINFO_MIME_TYPE);
+
+var_dump($finfo->buffer("<?php\nclass A{}"));
+var_dump($finfo->buffer("<?php class A{}"));
+var_dump($finfo->buffer("<?php\tclass A{}"));
+var_dump($finfo->buffer("<?php\n\rclass A{}"));
+?>
+===DONE===
+--EXPECT--
+string(10) "text/x-php"
+string(10) "text/x-php"
+string(10) "text/x-php"
+string(10) "text/x-php"
+===DONE===
@@ -704,6 +704,7 @@ void php_filter_validate_ip(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
 			if (flags & FILTER_FLAG_NO_PRIV_RANGE) {
 				if (
 					(ip[0] == 10) ||
+					(ip[0] == 169 && ip[1] == 254) ||
 					(ip[0] == 172 && (ip[1] >= 16 && ip[1] <= 31)) ||
 					(ip[0] == 192 && ip[1] == 168)
 				) {
@@ -714,10 +715,18 @@ void php_filter_validate_ip(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
 			if (flags & FILTER_FLAG_NO_RES_RANGE) {
 				if (
 					(ip[0] == 0) ||
+					(ip[0] == 10) ||
 					(ip[0] == 100 && (ip[1] >= 64 && ip[1] <= 127)) ||
+					(ip[0] == 127) ||
 					(ip[0] == 169 && ip[1] == 254) ||
+					(ip[0] == 172 && (ip[1] >= 16 && ip[1] <= 31)) ||
+					(ip[0] == 192 && ip[1] == 0 && ip[2] == 0) ||
 					(ip[0] == 192 && ip[1] == 0 && ip[2] == 2) ||
-					(ip[0] == 127 && ip[1] == 0 && ip[2] == 0 && ip[3] == 1) ||
+					(ip[0] == 192 && ip[1] == 88 && ip[2] == 99) ||
+					(ip[0] == 192 && ip[1] == 168) ||
+					(ip[0] == 198 && (ip[1] == 18 || ip[1] == 19)) ||
+					(ip[0] == 198 && ip[1] == 51 && ip[2] == 100) ||
+					(ip[0] == 203 && ip[1] == 0 && ip[2] == 113) ||
 					(ip[0] >= 224 && ip[0] <= 255)
 				) {
 					RETURN_VALIDATION_FAILED
@@ -41,7 +41,7 @@ string(9) "127.0.0.1"
 bool(false)
 string(12) "192.0.34.166"
 bool(false)
-string(9) "192.0.0.1"
+bool(false)
 bool(false)
 bool(false)
 string(12) "192.0.34.166"
@@ -0,0 +1,137 @@
+--TEST--
+Bug #71745 FILTER_FLAG_NO_RES_RANGE does not cover whole 127.0.0.0/8 range
+--FILE--
+<?php
+//https://tools.ietf.org/html/rfc6890#section-2.1
+
+$privateRanges = array();
+// 10.0.0.0/8
+$privateRanges['10.0.0.0/8'] = array('10.0.0.0', '10.255.255.255');
+
+// 169.254.0.0/16
+$privateRanges['168.254.0.0/16'] = array('169.254.0.0', '169.254.255.255');
+
+// 172.16.0.0/12
+$privateRanges['172.16.0.0/12'] = array('172.16.0.0', '172.31.0.0');
+
+// 192.168.0.0/16
+$privateRanges['192.168.0.0/16'] = array('192.168.0.0', '192.168.255.255');
+
+foreach ($privateRanges as $key => $range) {
+	list($min, $max) = $range;
+	var_dump($key);
+	var_dump(filter_var($min, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 | FILTER_FLAG_NO_PRIV_RANGE));
+	var_dump(filter_var($max, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 | FILTER_FLAG_NO_PRIV_RANGE));
+}
+
+$reservedRanges = array();
+
+// 0.0.0.0/8
+$reserverRanges['0.0.0.0/8'] = array('0.0.0.0', '0.255.255.255');
+
+// 10.0.0.0/8
+$reserverdRanges['10.0.0.0/8'] = array('10.0.0.0', '10.255.255.255');
+
+// 100.64.0.0/10
+$reserverdRanges['10.64.0.0/10'] = array('100.64.0.0', '100.127.255.255');
+
+// 127.0.0.0/8
+$reserverdRanges['127.0.0.0/8'] = array('127.0.0.0', '127.255.255.255');
+
+// 169.254.0.0/16
+$reserverdRanges['169.254.0.0/16'] = array('169.254.0.0', '169.254.255.255');
+
+// 172.16.0.0/12
+$reserverdRanges['172.16.0.0/12'] = array('172.16.0.0', '172.31.0.0');
+
+// 192.0.0.0/24
+$reserverdRanges['192.0.0.0/24'] = array('192.0.0.0', '192.0.0.255');
+
+// 192.0.0.0/29
+$reserverdRanges['192.0.0.0/29'] = array('192.0.0.0', '192.0.0.7');
+
+// 192.0.2.0/24
+$reserverdRanges['192.0.2.0/24'] = array('192.0.2.0', '192.0.2.255');
+
+// 198.18.0.0/15
+$reserverdRanges['198.18.0.0/15'] = array('198.18.0.0', '198.19.255.255');
+
+// 198.51.100.0/24
+$reserverdRanges['198.51.100.0/24'] = array('198.51.100.0', '198.51.100.255');
+
+// 192.88.99.0/24
+$reserverdRanges['192.88.99.0/24'] = array('192.88.99.0', '192.88.99.255');
+
+// 192.168.0.0/16
+$reserverdRanges['192.168.0.0/16'] = array('192.168.0.0', '192.168.255.255');
+
+// 203.0.113.0/24
+$reserverdRanges['203.0.113.0/24'] = array('203.0.113.0', '203.0.113.255');
+
+// 240.0.0.0/4 + 255.255.255.255/32
+$reserverdRanges['240.0.0.0/4'] = array('224.0.0.0', '255.255.255.255');
+
+foreach ($reserverdRanges as $key => $range) {
+	list($min, $max) = $range;
+	var_dump($key);
+	var_dump(filter_var($min, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 | FILTER_FLAG_NO_RES_RANGE));
+	var_dump(filter_var($max, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 | FILTER_FLAG_NO_RES_RANGE));
+}
+
+
+
+--EXPECT--
+string(10) "10.0.0.0/8"
+bool(false)
+bool(false)
+string(14) "168.254.0.0/16"
+bool(false)
+bool(false)
+string(13) "172.16.0.0/12"
+bool(false)
+bool(false)
+string(14) "192.168.0.0/16"
+bool(false)
+bool(false)
+string(10) "10.0.0.0/8"
+bool(false)
+bool(false)
+string(12) "10.64.0.0/10"
+bool(false)
+bool(false)
+string(11) "127.0.0.0/8"
+bool(false)
+bool(false)
+string(14) "169.254.0.0/16"
+bool(false)
+bool(false)
+string(13) "172.16.0.0/12"
+bool(false)
+bool(false)
+string(12) "192.0.0.0/24"
+bool(false)
+bool(false)
+string(12) "192.0.0.0/29"
+bool(false)
+bool(false)
+string(12) "192.0.2.0/24"
+bool(false)
+bool(false)
+string(13) "198.18.0.0/15"
+bool(false)
+bool(false)
+string(15) "198.51.100.0/24"
+bool(false)
+bool(false)
+string(14) "192.88.99.0/24"
+bool(false)
+bool(false)
+string(14) "192.168.0.0/16"
+bool(false)
+bool(false)
+string(14) "203.0.113.0/24"
+bool(false)
+bool(false)
+string(11) "240.0.0.0/4"
+bool(false)
+bool(false)
@@ -290,6 +290,9 @@ ftp_login(ftpbuf_t *ftp, const char *user, const char *pass TSRMLS_DC)
 #endif
 		SSL_CTX_set_options(ctx, ssl_ctx_options);

+		/* allow SSL to re-use sessions */
+		SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_BOTH);
+
 		ftp->ssl_handle = SSL_new(ctx);
 		if (ftp->ssl_handle == NULL) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "failed to create the SSL handle");
@@ -1495,7 +1498,8 @@ data_accept(databuf_t *data, ftpbuf_t *ftp TSRMLS_DC)

 #if HAVE_OPENSSL_EXT
 	SSL_CTX		*ctx;
-	long ssl_ctx_options = SSL_OP_ALL;
+	SSL_SESSION *session;
+	int result;
 #endif

 	if (data->fd != -1) {
@@ -1516,31 +1520,40 @@ data_accepted:

 	/* now enable ssl if we need to */
 	if (ftp->use_ssl && ftp->use_ssl_for_data) {
-		ctx = SSL_CTX_new(SSLv23_client_method());
+		ctx = SSL_get_SSL_CTX(ftp->ssl_handle);
 		if (ctx == NULL) {
-			php_error_docref(NULL TSRMLS_CC, E_WARNING, "data_accept: failed to create the SSL context");
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "data_accept: failed to retreive the existing SSL context");
 			return 0;
 		}

-#if OPENSSL_VERSION_NUMBER >= 0x0090605fL
-		ssl_ctx_options &= ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
-#endif
-		SSL_CTX_set_options(ctx, ssl_ctx_options);
-
 		data->ssl_handle = SSL_new(ctx);
 		if (data->ssl_handle == NULL) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "data_accept: failed to create the SSL handle");
-			SSL_CTX_free(ctx);
 			return 0;
 		}

-
 		SSL_set_fd(data->ssl_handle, data->fd);

 		if (ftp->old_ssl) {
 			SSL_copy_session_id(data->ssl_handle, ftp->ssl_handle);
 		}

+		/* get the session from the control connection so we can re-use it */
+		session = SSL_get_session(ftp->ssl_handle);
+		if (session == NULL) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "data_accept: failed to retreive the existing SSL session");
+			SSL_free(data->ssl_handle);
+			return 0;
+		}
+
+		/* and set it on the data connection */
+		result = SSL_set_session(data->ssl_handle, session);
+		if (result == 0) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "data_accept: failed to set the existing SSL session");
+			SSL_free(data->ssl_handle);
+			return 0;
+		}
+
 		if (SSL_connect(data->ssl_handle) <= 0) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "data_accept: SSL/TLS handshake failed");
 			SSL_shutdown(data->ssl_handle);
@@ -1571,10 +1584,7 @@ data_close(ftpbuf_t *ftp, databuf_t *data)
 	if (data->listener != -1) {
 #if HAVE_OPENSSL_EXT
 		if (data->ssl_active) {
-
-			ctx = SSL_get_SSL_CTX(data->ssl_handle);
-			SSL_CTX_free(ctx);
-
+			/* don't free the data context, it's the same as the control */
 			SSL_shutdown(data->ssl_handle);
 			SSL_free(data->ssl_handle);
 			data->ssl_active = 0;
@@ -1585,9 +1595,7 @@ data_close(ftpbuf_t *ftp, databuf_t *data)
 	if (data->fd != -1) {
 #if HAVE_OPENSSL_EXT
 		if (data->ssl_active) {
-			ctx = SSL_get_SSL_CTX(data->ssl_handle);
-			SSL_CTX_free(ctx);
-
+			/* don't free the data context, it's the same as the control */
 			SSL_shutdown(data->ssl_handle);
 			SSL_free(data->ssl_handle);
 			data->ssl_active = 0;
@@ -1,48 +1,49 @@
-----BEGIN CERTIFICATE REQUEST-----
-MIIBmzCCAQQCAQAwWzELMAkGA1UEBhMCUFQxCzAJBgNVBAgTAkx4MQswCQYDVQQH
-EwJMeDEcMBoGA1UEChMTQSBtaW5oYSBlbXByZXNhLCBTQTEUMBIGA1UECxMLUEhQ
-IFFBIFRlYW0wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAM9mfEOSYwXf58ch
-4NyO1QOU1XMfquz8OVpvMUITABLAevZpeQn6vZPHNyXHFQC0QC8scydK1rAYd2U+
-9K2aPub6ioMjYyjPpAE07l9EAAPUEBlqqsziB/wT8QjWkByyJEkYu+o0Wyjokhfn
-BMPvm52wLWUx9nvUeNDCftnKg1wxAgMBAAGgADANBgkqhkiG9w0BAQQFAAOBgQDD
-s1FeqPxnF2bWj8/dG8MyPaRfOAMVz1UsCZUciXIVG5LSIvR2qnMC3iEYt3s13sEq
-z8VJlNHa8nniE+VFNv093yIu+PlWXMEvb5y5EFqP2AYq3RAT+SJsSxGqIdzPZiKY
-INaktLCZmQ/E1v7/4hFzVRq9ydJI82DVS1nv282Whw==
-----END CERTIFICATE REQUEST-----
 -----BEGIN CERTIFICATE-----
-MIIC4zCCAkygAwIBAgIBADANBgkqhkiG9w0BAQQFADBbMQswCQYDVQQGEwJQVDEL
-MAkGA1UECBMCTHgxCzAJBgNVBAcTAkx4MRwwGgYDVQQKExNBIG1pbmhhIGVtcHJl
-c2EsIFNBMRQwEgYDVQQLEwtQSFAgUUEgVGVhbTAeFw0wNjExMTkxODIzNTNaFw0w
-NzExMTkxODIzNTNaMFsxCzAJBgNVBAYTAlBUMQswCQYDVQQIEwJMeDELMAkGA1UE
-BxMCTHgxHDAaBgNVBAoTE0EgbWluaGEgZW1wcmVzYSwgU0ExFDASBgNVBAsTC1BI
-UCBRQSBUZWFtMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPZnxDkmMF3+fH
-IeDcjtUDlNVzH6rs/DlabzFCEwASwHr2aXkJ+r2TxzclxxUAtEAvLHMnStawGHdl
-PvStmj7m+oqDI2Moz6QBNO5fRAAD1BAZaqrM4gf8E/EI1pAcsiRJGLvqNFso6JIX
-5wTD75udsC1lMfZ71HjQwn7ZyoNcMQIDAQABo4G2MIGzMB0GA1UdDgQWBBTIga5L
-q+Ub1SWXgNZRYCpq3c8Z+jCBgwYDVR0jBHwweoAUyIGuS6vlG9Ull4DWUWAqat3P
-GfqhX6RdMFsxCzAJBgNVBAYTAlBUMQswCQYDVQQIEwJMeDELMAkGA1UEBxMCTHgx
-HDAaBgNVBAoTE0EgbWluaGEgZW1wcmVzYSwgU0ExFDASBgNVBAsTC1BIUCBRQSBU
-ZWFtggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAe6AA8aC3KDI8
-smd+7XWjaTSp1Q0uMkEZ2PEBzif2I1aPPqw1CQykJ1iDdC/8PJ1yEIezloP2XQoZ
-NjTaCO+uubay03ncoPTZvDUwExN9BYFAYgc2z3tLMHYbA7kM2sIbKys7ZQegLibr
-TSKYQOBeYA/FB9GHECJGU3zBRvYi+Og=
+MIIDhTCCAm2gAwIBAgIJAN75FFz+owOAMA0GCSqGSIb3DQEBCwUAMFkxCzAJBgNV
+BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX
+aWRnaXRzIFB0eSBMdGQxEjAQBgNVBAMMCTEyNy4wLjAuMTAeFw0xNjA3MjUxMjM3
+MTJaFw0yNjA3MjMxMjM3MTJaMFkxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21l
+LVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQxEjAQBgNV
+BAMMCTEyNy4wLjAuMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALtG
+AIrNUDItISfpAqztL2TFEWEHLGTzCEh5Ag2sdMD7UYbqIPHLOE4EINv+dqEMM0Nz
+LYnw7ChtVegXT907xCaQcmeDFSdhqze4L8zawDfnn4syB8XAwGYJfpstYwe3nO6+
+0WvLSb1A5TYNeyoXjwlAUKElxkeWAo51uhR41GDhDQ9GgpqX1ccAhmSoUhgIRSzf
+6f4KE3WTdzl1p12ZtkYHB8Jo2jB/JXnwGOz6isLnpRvkex4B7sUX+7u1MqK/e1X7
+Hi1G/VkaAfC2SOfjTePtGBDBXrQ1arYXDPRA04sgFzSh55l7lC/4HasQ/jAb3h95
+dcEIqyc69iioaN1c1NcCAwEAAaNQME4wHQYDVR0OBBYEFNv3kefb1H+6/6CpjiBi
+I2s9E90MB8GA1UdIwQYMBaAFNv3kefb1H+6/6CpjiBi+I2s9E90MAwGA1UdEwQF
+MAMBAf8wDQYJKoZIhvcNAQELBQADggEBAIzSEWpHSaBs7KduBRXX5+qFxBN6OCPl
+7ID0rxAOYfw7ruzbmwgOpBgMIHGn+KqA6CmQI0jh9bZbv5TV2aFpFsUihugPc2lW
+5EshCozxlEPmIJNsO8jDqPE4w3m4KiVTscRWjBa5cco+lwLDqboerm2l7vvrtr6B
+pgLaZct1c73MouvoJSCGK5EOGW7jsgaxjxJ3UZug+24Ko1wulO2cgBLhda9Ilrnx
+CIKI9h8Z2WVWuVQfyCyO1g7XkJgkBec77OhxD+m4onzPY6waqnnhmFOBcS+gKgBV
+jHeK9DCvZ9zet3EyEp6fyQOOtsC+gU0piYgfsQL7aCp5oLe+fjTiuUY=
 -----END CERTIFICATE-----
-----BEGIN RSA PRIVATE KEY-----
-Proc-Type: 4,ENCRYPTED
-DEK-Info: DES-EDE3-CBC,928762DB6DE222AD
-
-oOxNUBX0wrqmRqb3IEZMogc1bnVm6JoW6YFjGfHNcIz0jS7UPDhUFDR26y0dYujL
-LEgxOcYo8ItvGcXSRbs+3W7lISbosgkB0DOaKx5jVmOGwUVRergUUSY8rbf93FtP
-27CEvAfsU6do5HmlJ34mYZW1k+onCznlJXJkupQ5jmiily3GwEdr/5mMIVOmXQ6p
-xWkxHySDKyVbR0v4JY3SJLRBuhgofYNG5155PiqZ7KwYY4Aw60eVgINsvJCF9/8b
-kEj+lecHbBdAf7N82320Ga+F+VeFnUl0gWFjoIF9UFCO80+7ZvIGdGlyPkr4zMvt
-TsC1snJQdHg+IlT3sGayYrQANpTG6GPYhn3KEvK5aqq+bPEe5lija0gw34jbPCo+
-TjHR76lToxzubGZODyyF/rjl5KwUbqTCNuv1PX1jTx7n7sCbu+KHpqXMhTHLKtby
-+Wh7WAfsVrbIW+P85/mkfhPbPZ2621f9cyStdFGgWU4dHdD00HIGOgAJvUSbC2Au
-oVUoKf2818t1s9aA4ptog04sNi+Ixu+z+3yYNLZj51j4ZX3KuXxLIiQvlvFQ8LQi
-RHGQk3u2W3iNtDKKUQjMPaB2FlVtC7FmtHBCpRmos6ld240DDyucqMdIDTMaqV0+
-sL4X+LIeBM/hP/IquRTuQBHBmgjkN4845ihTUJOanyKx605ANq/roHzXrbIxhR5p
-pcJLCBMLMWgdOCJMZRavSq04iXeNfP6Mk/joVpHS62Ljdfc94BBLfsOKOErA20Nq
-lfvbZqy2tI5IIDoq05S8FU0DYNqq/hyrv9Udo8IAo+WkBOABm0x/WA==
-----END RSA PRIVATE KEY-----
- 
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC7RgCKzVAyLSEn
+6QKs7S9kxRFhByxk8whIeQINrHTA+1GG6iDxyzhOBCDb/nahDDNDcy2J8OwobVXo
+F0/dO8QmkHJngxUnYas3uC/M2sA355+LMgfFwMBmCX6bLWMHt5zuvtFry0m9QOU2
+DXsqF48JQFChJcZHlgKOdboUeNRg4Q0PRoKal9XHAIZkqFIYCEUs3+n+ChN1k3c5
+daddmbZGBwfCaNowfyV58Bjs+orC56Ub5HseAe7FF/u7tTKiv3tV+x4tRv1ZGgHw
+tkjn403j7RgQwV60NWq2Fwz0QNOLIBc0oeeZe5Qv+B2rEP4wG94feXXBCKsnOvYo
+qGjdXNTXAgMBAAECggEAD7yDISa9fWnjZlojGmrX16zjl/alWVo+sPBSJtn9+ZVk
+tWSJHihIc+3O4Q2R5FiFGj7cbcHr5j3BwT3sPRfflKoAowgVx/hiDc2RXrJnAouZ
+EXZDxu86e5iCpgF7V9OrATjRmjA74wZH/HHHjrLqFwnrfI8TCULmthfYag35Mqax
+qrIEzvSuYdaGxblNe+ZfnVEDW2F9DLBGcma0ffUlJp8AvV7bpo8Rj/JovPxit/VS
+UdwSRxwSAugctFpmcGlFkoQfxUx1WdEy8hjopLrayMjCCJvRUL4+C4zT9r9PBHOj
+fCSbJ+ajQIoRrgaL9bURk8BFMHY8+yMUsWEYVSmFAQKBgQDtOvPkhvZsNocUB5nJ
+ti3SXyDQ6OZQuKKHPSeDV/EvmZKeNlrQ1ZnwXLP3vkcedDOkt1nEVq/hUewpjt08
+2MvmMwJBQEnmbTzMf43DtlXsStdP1lhYaFbU4iMM5zRfyBHDu1GPZEPXvKKpJUk0
+M+jYIyTAP3mcZhqDKn0mPVP7VwKBgQDKFy9DtWFKxCvhFQvHx7YeZiVWJbIst/O4
+ZyuPVAErni0hzSeCkmm7+F9hgEdPSLRcSaeTWP4L0u1cixECKboIhoNs38aft7o3
+MdnI2RDSEKtKX2uVuhvpGDNuGpBAc8Qu8iCiv5INSC36ZhD1h++O/TiiUdgRJ3yX
+yeG7ej+CgQKBgCR5F95e0aw5hfMSaBaXJ9xcO9Niu2ZVvMdGI7kR4EcNOXmRqczJ
+ym0mE5VXb9/Cxd3hQq/pFAl0avbIvEMKoe62kPYvSC1hRiO6yLT6Z6N4rjncHqEZ
+CaCZVAI72dWQEQsi1ZtSMwwMOIYA8YxRHs98N75HBA+DszfPZIZoj2zpAoGBAJHp
+B3ElhmeLF/tdTLIj2bQ9H/wBH5H2Bvw/UU4c4vNxMzjSfRJjUAAtpgAptFLkNYTk
+kR9sA5DZ7BMDPXaIVg9Nv5peP3SWHNc5IPtI7kIdUu9R0cW7J+e2V3vJphlC/ITA
+wRuAoZ0BXmEKTHhae3aMEdXwrcZE8kpNsrO/4hcBAoGBAMISiPJPuxAX1UtqcxTa
+mDJfnQ2gxRu6AK9VmXqo0X4IBxDSnTjcL0huUlS849wgsE5oTXgdYb2hn+TXM5JJ
+NsEXLhV09X1mrk4M4LV1npd0mYxvFsO4+p+IX5YLiahInmQtq0gx3DWE8wouVFER
+4yzfp27z8MZT8Qvr/ZI9lzWd
+-----END PRIVATE KEY-----
@@ -2,7 +2,7 @@

 $socket = null;
 $errno = 0;
-$context = stream_context_create(array('ssl' => array('local_cert' => dirname(__FILE__).'/cert.pem', 'passphrase' => 'pass')));
+$context = stream_context_create(array('ssl' => array('local_cert' => dirname(__FILE__).'/cert.pem')));

 for ($i=0; $i<10 && !$socket; ++$i) {
 	$port = rand(50000, 65535);
@@ -139,7 +139,10 @@ if ($pid) {
 			$buf = fread($s, 2048);
 		}

-		if (!preg_match('/^USER (\w+)\r\n$/', $buf, $m)) {
+		if ($buf == "AUTH TLS\r\n") {
+		   fputs($s, "500 not supported.\r\n");
+		   return ;
+		} else if (!preg_match('/^USER (\w+)\r\n$/', $buf, $m)) {
 			fputs($s, "500 Syntax error, command unrecognized.\r\n");
 			dump_and_exit($buf);
 		}
@@ -208,6 +211,10 @@ if ($pid) {
 			$ascii = true;
 			fputs($s, "200 OK\r\n");

+		} elseif ($buf === "AUTH SSL\r\n") {
+			$ascii = true;
+			fputs($s, "500 not supported\r\n");
+
 		} elseif ($buf === "TYPE I\r\n") {
 			$ascii = false;
 			fputs($s, "200 OK\r\n");
@@ -265,7 +272,7 @@ if ($pid) {

 		} elseif (preg_match("~^NLST(?: ([A-Za-z./]+))?\r\n$~", $buf, $m)) {

-			if (isset($m[1]) && $m[1] === 'bogusdir') {
+			if (isset($m[1]) && (($m[1] === 'bogusdir') || ($m[1] === '/bogusdir'))) {
 				fputs($s, "250 $m[1]: No such file or directory\r\n");
 				continue;
 			}
@@ -276,11 +283,20 @@ if ($pid) {
 				continue;
 			}

-			fputs($s, "150 File status okay; about to open data connection\r\n");
+			if (empty($pasv)) {
+				fputs($s, "150 File status okay; about to open data connection\r\n");
+				if (!$fs = stream_socket_client("tcp://$host:$port")) {
+					fputs($s, "425 Can't open data connection\r\n");
+					continue;
+				}
+			} else {
+				fputs($s, "125 Data connection already open; transfer starting.\r\n");
+				$fs=$pasvs;
+			}

-			if (!$fs = stream_socket_client("tcp://$host:$port")) {
-				fputs($s, "425 Can't open data connection\r\n");
-				continue;
+
+			if ((!empty($ssl)) && (!stream_socket_enable_crypto($pasvs, true, STREAM_CRYPTO_METHOD_SSLv23_SERVER))) {
+				die("SSLv23 handshake failed.\n");
 			}

 			if (empty($m[1]) || $m[1] !== 'emptydir') {
@@ -368,7 +384,7 @@ if ($pid) {
                                        }
 					fputs($s, "226 Closing data Connection.\r\n");
                                        break;
-                case "mediumfile":
+				case "mediumfile":
 					fputs($s, "150 File status okay; about to open data connection.\r\n");
 					for($i = 0; $i < 150; $i++){
 						fputs($fs, "This is line $i of the test data.\n");
@@ -384,13 +400,22 @@ if ($pid) {


 		}elseif (preg_match('/^PASV/', $buf, $matches)) {
-			$port = $pasv_port;
-			$p2 = $port % ((int) 1 << 8);
-			$p1 = ($port-$p2)/((int) 1 << 8);
+			$pasv=true;
+			$p2 = $pasv_port % ((int) 1 << 8);
+			$p1 = ($pasv_port-$p2)/((int) 1 << 8);
 			$host = "127.0.0.1";
+			if (!empty($ssl)) {
+				$soc = stream_socket_server("tcp://127.0.0.1:$pasv_port", $errno, $errstr, STREAM_SERVER_BIND|STREAM_SERVER_LISTEN, $context);
+			} else {
+				$soc = stream_socket_server("tcp://127.0.0.1:$pasv_port");
+			}
+
 			fputs($s, "227 Entering Passive Mode. (127,0,0,1,{$p1},{$p2})\r\n");

+			$pasvs = stream_socket_accept($soc,10);

+		}elseif (preg_match('/^EPSV/', $buf, $matches)) {
+			fputs($s, "550 Extended passsive mode not supported.\r\n");
 		} elseif (preg_match('/^SITE EXEC/', $buf, $matches)) {
 			fputs($s, "200 OK\r\n");

@@ -69,6 +69,9 @@ static void php_free_ps_enc(zend_rsrc_list_entry *rsrc TSRMLS_DC);
 #endif

 #include <gd.h>
+#ifndef HAVE_GD_BUNDLED
+# include <gd_errors.h>
+#endif
 #include <gdfontt.h>  /* 1 Tiny font */
 #include <gdfonts.h>  /* 2 Small font */
 #include <gdfontmb.h> /* 3 Medium bold font */
@@ -96,7 +99,7 @@ static void php_imagettftext_common(INTERNAL_FUNCTION_PARAMETERS, int, int);

 #include "gd_ctx.c"

-/* as it is not really public, duplicate declaration here to avoid 
+/* as it is not really public, duplicate declaration here to avoid
   pointless warnings */
 int overflow2(int a, int b);

@@ -1099,6 +1102,18 @@ void php_gd_error_method(int type, const char *format, va_list args)
 {
 	TSRMLS_FETCH();

+	switch (type) {
+		case GD_DEBUG:
+		case GD_INFO:
+		case GD_NOTICE:
+			type = E_NOTICE;
+			break;
+		case GD_WARNING:
+			type = E_WARNING;
+			break;
+		default:
+			type = E_ERROR;
+	}
 	php_verror(NULL, "", type, format, args TSRMLS_CC);
 }
 /* }}} */
@@ -1148,6 +1163,7 @@ PHP_MINIT_FUNCTION(gd)
 	REGISTER_LONG_CONSTANT("IMG_PNG", 4, CONST_CS | CONST_PERSISTENT);
 	REGISTER_LONG_CONSTANT("IMG_WBMP", 8, CONST_CS | CONST_PERSISTENT);
 	REGISTER_LONG_CONSTANT("IMG_XPM", 16, CONST_CS | CONST_PERSISTENT);
+	REGISTER_LONG_CONSTANT("IMG_WEBP", 32, CONST_CS | CONST_PERSISTENT);

 	/* special colours for gd */
 	REGISTER_LONG_CONSTANT("IMG_COLOR_TILED", gdTiled, CONST_CS | CONST_PERSISTENT);
@@ -1181,7 +1197,7 @@ PHP_MINIT_FUNCTION(gd)
 	REGISTER_LONG_CONSTANT("IMG_CROP_SIDES", GD_CROP_SIDES, CONST_CS | CONST_PERSISTENT);
 	REGISTER_LONG_CONSTANT("IMG_CROP_THRESHOLD", GD_CROP_THRESHOLD, CONST_CS | CONST_PERSISTENT);

-	
+
 	REGISTER_LONG_CONSTANT("IMG_BELL", GD_BELL, CONST_CS | CONST_PERSISTENT);
 	REGISTER_LONG_CONSTANT("IMG_BESSEL", GD_BESSEL, CONST_CS | CONST_PERSISTENT);
 	REGISTER_LONG_CONSTANT("IMG_BILINEAR_FIXED", GD_BILINEAR_FIXED, CONST_CS | CONST_PERSISTENT);
@@ -1539,6 +1555,7 @@ PHP_FUNCTION(imagesetstyle)
 	int * stylearr;
 	int index;
 	HashPosition pos;
+    int num_styles;

 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ra", &IM, &styles) == FAILURE)  {
 		return;
@@ -1546,8 +1563,14 @@ PHP_FUNCTION(imagesetstyle)

 	ZEND_FETCH_RESOURCE(im, gdImagePtr, &IM, -1, "Image", le_gd);

+    num_styles = zend_hash_num_elements(HASH_OF(styles));
+    if (num_styles == 0) {
+        php_error_docref(NULL TSRMLS_CC, E_WARNING, "styles array must not be empty");
+        RETURN_FALSE;
+    }
+
 	/* copy the style values in the stylearr */
-	stylearr = safe_emalloc(sizeof(int), zend_hash_num_elements(HASH_OF(styles)), 0);
+	stylearr = safe_emalloc(sizeof(int), num_styles, 0);

 	zend_hash_internal_pointer_reset_ex(HASH_OF(styles), &pos);

@@ -1635,11 +1658,11 @@ PHP_FUNCTION(imagetruecolortopalette)

 	ZEND_FETCH_RESOURCE(im, gdImagePtr, &IM, -1, "Image", le_gd);

-	if (ncolors <= 0) {
-		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Number of colors has to be greater than zero");
+	if (ncolors <= 0 || ncolors > INT_MAX) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Number of colors has to be greater than zero and no more than %d", INT_MAX);
 		RETURN_FALSE;
 	}
-	gdImageTrueColorToPalette(im, dither, ncolors);
+	gdImageTrueColorToPalette(im, dither, (int)ncolors);

 	RETURN_TRUE;
 }
@@ -2200,6 +2223,9 @@ PHP_FUNCTION(imagetypes)
 #if defined(HAVE_GD_XPM)
 	ret |= 16;
 #endif
+#ifdef HAVE_GD_WEBP
+	ret |= 32;
+#endif

 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
@@ -3056,6 +3082,11 @@ PHP_FUNCTION(imagegammacorrect)
 		return;
 	}

+	if ( input <= 0.0 || output <= 0.0 ) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Gamma values should be positive");
+		RETURN_FALSE;
+	}
+
 	ZEND_FETCH_RESOURCE(im, gdImagePtr, &IM, -1, "Image", le_gd);

 	if (gdImageTrueColor(im))	{
@@ -3887,7 +3918,7 @@ static void php_imagettftext_common(INTERNAL_FUNCTION_PARAMETERS, int mode, int
 #endif /* VIRTUAL_DIR */

 	PHP_GD_CHECK_OPEN_BASEDIR(fontname, "Invalid font filename");
-	
+
 #ifdef HAVE_GD_FREETYPE
 	if (extended) {
 		error = gdImageStringFTEx(im, brect, col, fontname, ptsize, angle, x, y, str, &strex);
@@ -4465,7 +4496,7 @@ static void _php_image_convert(INTERNAL_FUNCTION_PARAMETERS, int image_type )
 	int x, y;
 	float x_ratio, y_ratio;
    long ignore_warning;
-	
+
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "pplll", &f_org, &f_org_len, &f_dest, &f_dest_len, &height, &width, &threshold) == FAILURE) {
 		return;
 	}
@@ -4499,6 +4530,7 @@ static void _php_image_convert(INTERNAL_FUNCTION_PARAMETERS, int image_type )
 	dest = VCWD_FOPEN(fn_dest, "wb");
 	if (!dest) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to open '%s' for writing", fn_dest);
+        fclose(org);
 		RETURN_FALSE;
 	}

@@ -4507,6 +4539,8 @@ static void _php_image_convert(INTERNAL_FUNCTION_PARAMETERS, int image_type )
 			im_org = gdImageCreateFromGif(org);
 			if (im_org == NULL) {
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to open '%s' Not a valid GIF file", fn_dest);
+                fclose(org);
+                fclose(dest);
 				RETURN_FALSE;
 			}
 			break;
@@ -4517,6 +4551,8 @@ static void _php_image_convert(INTERNAL_FUNCTION_PARAMETERS, int image_type )
 			im_org = gdImageCreateFromJpegEx(org, ignore_warning);
 			if (im_org == NULL) {
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to open '%s' Not a valid JPEG file", fn_dest);
+                fclose(org);
+                fclose(dest);
 				RETURN_FALSE;
 			}
 			break;
@@ -4527,6 +4563,8 @@ static void _php_image_convert(INTERNAL_FUNCTION_PARAMETERS, int image_type )
 			im_org = gdImageCreateFromPng(org);
 			if (im_org == NULL) {
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to open '%s' Not a valid PNG file", fn_dest);
+                fclose(org);
+                fclose(dest);
 				RETURN_FALSE;
 			}
 			break;
@@ -4534,10 +4572,14 @@ static void _php_image_convert(INTERNAL_FUNCTION_PARAMETERS, int image_type )

 		default:
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Format not supported");
+            fclose(org);
+            fclose(dest);
 			RETURN_FALSE;
 			break;
 	}

+	fclose(org);
+
 	org_width  = gdImageSX (im_org);
 	org_height = gdImageSY (im_org);

@@ -4568,6 +4610,8 @@ static void _php_image_convert(INTERNAL_FUNCTION_PARAMETERS, int image_type )
 	im_tmp = gdImageCreate (dest_width, dest_height);
 	if (im_tmp == NULL ) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to allocate temporary buffer");
+        fclose(dest);
+        gdImageDestroy(im_org);
 		RETURN_FALSE;
 	}

@@ -4575,23 +4619,29 @@ static void _php_image_convert(INTERNAL_FUNCTION_PARAMETERS, int image_type )

 	gdImageDestroy(im_org);

-	fclose(org);
-
 	im_dest = gdImageCreate(dest_width, dest_height);
 	if (im_dest == NULL) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to allocate destination buffer");
+        fclose(dest);
+        gdImageDestroy(im_tmp);
 		RETURN_FALSE;
 	}

 	white = gdImageColorAllocate(im_dest, 255, 255, 255);
 	if (white == -1) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to allocate the colors for the destination buffer");
+        fclose(dest);
+        gdImageDestroy(im_tmp);
+        gdImageDestroy(im_dest);
 		RETURN_FALSE;
 	}

 	black = gdImageColorAllocate(im_dest, 0, 0, 0);
 	if (black == -1) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to allocate the colors for the destination buffer");
+        fclose(dest);
+        gdImageDestroy(im_tmp);
+        gdImageDestroy(im_dest);
 		RETURN_FALSE;
 	}

@@ -5097,7 +5147,7 @@ PHP_FUNCTION(imagecropauto)
 			break;

 		case GD_CROP_THRESHOLD:
-			if (color < 0) {
+			if (color < 0 || (!gdImageTrueColor(im) && color >= gdImageColorsTotal(im))) {
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Color argument missing with threshold mode");
 				RETURN_FALSE;
 			}
@@ -5348,7 +5398,7 @@ PHP_FUNCTION(imageaffinematrixget)
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Missing y position");
 				RETURN_FALSE;
 			}
-			
+
 			if (type == GD_AFFINE_TRANSLATE) {
 				res = gdAffineTranslate(affine, x, y);
 			} else {
@@ -190,7 +190,7 @@ gdImagePtr gdImageCreateTrueColor (int sx, int sy)
 		return NULL;
 	}

-	if (overflow2(sizeof(int), sx)) {
+	if (overflow2(sizeof(int *), sx)) {
 		return NULL;
 	}

@@ -599,15 +599,18 @@ void gdImageColorDeallocate (gdImagePtr im, int color)

 void gdImageColorTransparent (gdImagePtr im, int color)
 {
+	if (color < 0) {
+		return;
+	}
 	if (!im->trueColor) {
+		if((color >= im->colorsTotal)) {
+			return;
+		}
+		/* Make the old transparent color opaque again */
 		if (im->transparent != -1) {
 			im->alpha[im->transparent] = gdAlphaOpaque;
 		}
-		if (color > -1 && color < im->colorsTotal && color < gdMaxColors) {
-			im->alpha[color] = gdAlphaTransparent;
-		} else {
-			return;
-		}
+		im->alpha[color] = gdAlphaTransparent;
 	}
 	im->transparent = color;
 }
@@ -1667,23 +1670,17 @@ long lsqrt (long n)
 /* s and e are integers modulo 360 (degrees), with 0 degrees
   being the rightmost extreme and degrees changing clockwise.
   cx and cy are the center in pixels; w and h are the horizontal
-   and vertical diameter in pixels. Nice interface, but slow.
-   See gd_arc_f_buggy.c for a better version that doesn't
-   seem to be bug-free yet. */
+   and vertical diameter in pixels. */

 void gdImageArc (gdImagePtr im, int cx, int cy, int w, int h, int s, int e, int color)
 {
-	if ((s % 360) == (e % 360)) {
-		gdImageEllipse(im, cx, cy, w, h, color);
-	} else {
-		gdImageFilledArc(im, cx, cy, w, h, s, e, color, gdNoFill);
-	}
+	gdImageFilledArc(im, cx, cy, w, h, s, e, color, gdNoFill);
 }

 void gdImageFilledArc (gdImagePtr im, int cx, int cy, int w, int h, int s, int e, int color, int style)
 {
-	gdPoint pts[3];
-	int i;
+	gdPoint pts[363];
+	int i, pti;
 	int lx = 0, ly = 0;
 	int fx = 0, fy = 0;

@@ -1711,7 +1708,7 @@ void gdImageFilledArc (gdImagePtr im, int cx, int cy, int w, int h, int s, int e
 		}
 	}

-	for (i = s; i <= e; i++) {
+	for (i = s, pti = 1; i <= e; i++, pti++) {
 		int x, y;
 		x = ((long) gdCosT[i % 360] * (long) w / (2 * 1024)) + cx;
 		y = ((long) gdSinT[i % 360] * (long) h / (2 * 1024)) + cy;
@@ -1720,19 +1717,28 @@ void gdImageFilledArc (gdImagePtr im, int cx, int cy, int w, int h, int s, int e
 				if (style & gdNoFill) {
 					gdImageLine(im, lx, ly, x, y, color);
 				} else {
-					/* This is expensive! */
-					pts[0].x = lx;
-					pts[0].y = ly;
-					pts[1].x = x;
-					pts[1].y = y;
-					pts[2].x = cx;
-					pts[2].y = cy;
-					gdImageFilledPolygon(im, pts, 3, color);
-				}
+					if (y == ly) {
+						pti--; /* don't add this point */
+						if (((i > 270 || i < 90) && x > lx) || ((i >  90 && i < 270) && x < lx)) {
+							/* replace the old x coord, if increasing on the
+							   right side or decreasing on the left side */
+							pts[pti].x = x;
+						}
+					} else {
+						pts[pti].x = x;
+						pts[pti].y = y;
+					}
+  				}
 			}
 		} else {
 			fx = x;
 			fy = y;
+			if (!(style & (gdChord | gdNoFill))) {
+				pts[0].x = cx;
+				pts[0].y = cy;
+				pts[pti].x = x;
+				pts[pti].y = y;
+			}
 		}
 		lx = x;
 		ly = y;
@@ -1759,6 +1765,10 @@ void gdImageFilledArc (gdImagePtr im, int cx, int cy, int w, int h, int s, int e
 				gdImageLine(im, cx, cy, lx, ly, color);
 				gdImageLine(im, cx, cy, fx, fy, color);
 			}
+		} else {
+			pts[pti].x = cx;
+			pts[pti].y = cy;
+			gdImageFilledPolygon(im, pts, pti+1, color);
 		}
 	}
 }
@@ -2237,7 +2247,9 @@ void gdImageCopy (gdImagePtr dst, gdImagePtr src, int dstX, int dstY, int srcX,
 			for (y = 0; (y < h); y++) {
 				for (x = 0; (x < w); x++) {
 					int c = gdImageGetTrueColorPixel (src, srcX + x, srcY + y);
-					gdImageSetPixel (dst, dstX + x, dstY + y, c);
+					if (c != src->transparent) {
+						gdImageSetPixel (dst, dstX + x, dstY + y, c);
+					}
 				}
 			}
 		} else {
@@ -2254,26 +2266,6 @@ void gdImageCopy (gdImagePtr dst, gdImagePtr src, int dstX, int dstY, int srcX,
 		return;
 	}

-	/* Destination is palette based */
-	if (src->trueColor) { /* But source is truecolor (Ouch!) */
-		toy = dstY;
-		for (y = srcY; (y < (srcY + h)); y++) {
-			tox = dstX;
-			for (x = srcX; x < (srcX + w); x++) {
-				int nc;
-				c = gdImageGetPixel (src, x, y);
-
-				/* Get best match possible. */
-				nc = gdImageColorResolveAlpha(dst, gdTrueColorGetRed(c), gdTrueColorGetGreen(c), gdTrueColorGetBlue(c), gdTrueColorGetAlpha(c));
-
-				gdImageSetPixel(dst, tox, toy, nc);
-				tox++;
-			}
-			toy++;
-		}
-		return;
-	}
-
 	/* Palette based to palette based */
 	for (i = 0; i < gdMaxColors; i++) {
 		colorMap[i] = (-1);
@@ -601,14 +601,26 @@ nomatch:
 * code in turn.  When the buffer fills up empty it and start over.
 */

-static unsigned long masks[] = { 0x0000, 0x0001, 0x0003, 0x0007, 0x000F,
+static const unsigned long masks[] = { 0x0000, 0x0001, 0x0003, 0x0007, 0x000F,
                                  0x001F, 0x003F, 0x007F, 0x00FF,
                                  0x01FF, 0x03FF, 0x07FF, 0x0FFF,
                                  0x1FFF, 0x3FFF, 0x7FFF, 0xFFFF };

+
+/* Arbitrary value to mark output is done.  When we see EOFCode, then we don't
+ * expect to see any more data.  If we do (e.g. corrupt image inputs), cur_bits
+ * might be negative, so flag it to return early.
+ */
+#define CUR_BITS_FINISHED -1000
+
+
 static void
 output(code_int code, GifCtx *ctx)
 {
+	if (ctx->cur_bits == CUR_BITS_FINISHED) {
+		return;
+	}
+
    ctx->cur_accum &= masks[ ctx->cur_bits ];

    if( ctx->cur_bits > 0 )
@@ -655,8 +667,10 @@ output(code_int code, GifCtx *ctx)
                ctx->cur_bits -= 8;
        }

-        flush_char(ctx);
+		/* Flag that it's done to prevent re-entry. */
+		ctx->cur_bits = CUR_BITS_FINISHED;

+        flush_char(ctx);
    }
 }

@@ -879,20 +879,42 @@ int getPixelInterpolated(gdImagePtr im, const double x, const double y, const in
 static inline LineContribType * _gdContributionsAlloc(unsigned int line_length, unsigned int windows_size)
 {
 	unsigned int u = 0;
-    LineContribType *res;
+	LineContribType *res;
+	int overflow_error = 0;

 	res = (LineContribType *) gdMalloc(sizeof(LineContribType));
 	if (!res) {
 		return NULL;
 	}
-    res->WindowSize = windows_size;
-    res->LineLength = line_length;
-    res->ContribRow = (ContributionType *) gdMalloc(line_length * sizeof(ContributionType));
-
-    for (u = 0 ; u < line_length ; u++) {
-        res->ContribRow[u].Weights = (double *) gdMalloc(windows_size * sizeof(double));
-    }
-    return res;
+	res->WindowSize = windows_size;
+	res->LineLength = line_length;
+	if (overflow2(line_length, sizeof(ContributionType))) {
+		gdFree(res);
+		return NULL;
+	}
+	res->ContribRow = (ContributionType *) gdMalloc(line_length * sizeof(ContributionType));
+	if (res->ContribRow == NULL) {
+		gdFree(res);
+		return NULL;
+	}
+	for (u = 0 ; u < line_length ; u++) {
+		if (overflow2(windows_size, sizeof(double))) {
+			overflow_error = 1;
+		} else {
+			res->ContribRow[u].Weights = (double *) gdMalloc(windows_size * sizeof(double));
+		}
+		if (overflow_error == 1 || res->ContribRow[u].Weights == NULL) {
+			unsigned int i;
+			u--;
+			for (i=0;i<=u;i++) {
+				gdFree(res->ContribRow[i].Weights);
+			}
+			gdFree(res->ContribRow);
+			gdFree(res);
+			return NULL;
+		}
+	}
+	return res;
 }

 static inline void _gdContributionsFree(LineContribType * p)
@@ -907,59 +929,62 @@ static inline void _gdContributionsFree(LineContribType * p)

 static inline LineContribType *_gdContributionsCalc(unsigned int line_size, unsigned int src_size, double scale_d,  const interpolation_method pFilter)
 {
-    double width_d;
-    double scale_f_d = 1.0;
-    const double filter_width_d = DEFAULT_BOX_RADIUS;
+	double width_d;
+	double scale_f_d = 1.0;
+	const double filter_width_d = DEFAULT_BOX_RADIUS;
 	int windows_size;
 	unsigned int u;
 	LineContribType *res;
+	int overflow_error = 0;

-    if (scale_d < 1.0) {
-        width_d = filter_width_d / scale_d;
-        scale_f_d = scale_d;
-    }  else {
-        width_d= filter_width_d;
-    }
+	if (scale_d < 1.0) {
+		width_d = filter_width_d / scale_d;
+		scale_f_d = scale_d;
+	}  else {
+		width_d= filter_width_d;
+	}

-    windows_size = 2 * (int)ceil(width_d) + 1;
-    res = _gdContributionsAlloc(line_size, windows_size);
-
-    for (u = 0; u < line_size; u++) {
-        const double dCenter = (double)u / scale_d;
-        /* get the significant edge points affecting the pixel */
-        register int iLeft = MAX(0, (int)floor (dCenter - width_d));
-        int iRight = MIN((int)ceil(dCenter + width_d), (int)src_size - 1);
-        double dTotalWeight = 0.0;
+	windows_size = 2 * (int)ceil(width_d) + 1;
+	res = _gdContributionsAlloc(line_size, windows_size);
+	if (res == NULL) {
+		return NULL;
+	}
+	for (u = 0; u < line_size; u++) {
+	const double dCenter = (double)u / scale_d;
+	/* get the significant edge points affecting the pixel */
+	register int iLeft = MAX(0, (int)floor (dCenter - width_d));
+	int iRight = MIN((int)ceil(dCenter + width_d), (int)src_size - 1);
+	double dTotalWeight = 0.0;
 		int iSrc;

-        /* Cut edge points to fit in filter window in case of spill-off */
-        if (iRight - iLeft + 1 > windows_size)  {
-            if (iLeft < ((int)src_size - 1 / 2))  {
-                iLeft++;
-            } else {
-                iRight--;
-            }
-        }
+	/* Cut edge points to fit in filter window in case of spill-off */
+	if (iRight - iLeft + 1 > windows_size)  {
+		if (iLeft < ((int)src_size - 1 / 2))  {
+			iLeft++;
+		} else {
+			iRight--;
+		}
+	}

-        res->ContribRow[u].Left = iLeft;
-        res->ContribRow[u].Right = iRight;
+	res->ContribRow[u].Left = iLeft;
+	res->ContribRow[u].Right = iRight;

-        for (iSrc = iLeft; iSrc <= iRight; iSrc++) {
-            dTotalWeight += (res->ContribRow[u].Weights[iSrc-iLeft] =  scale_f_d * (*pFilter)(scale_f_d * (dCenter - (double)iSrc)));
-        }
+	for (iSrc = iLeft; iSrc <= iRight; iSrc++) {
+		dTotalWeight += (res->ContribRow[u].Weights[iSrc-iLeft] =  scale_f_d * (*pFilter)(scale_f_d * (dCenter - (double)iSrc)));
+	}

 		if (dTotalWeight < 0.0) {
 			_gdContributionsFree(res);
 			return NULL;
 		}

-        if (dTotalWeight > 0.0) {
-            for (iSrc = iLeft; iSrc <= iRight; iSrc++) {
-                res->ContribRow[u].Weights[iSrc-iLeft] /= dTotalWeight;
-            }
-        }
-   }
-   return res;
+	if (dTotalWeight > 0.0) {
+		for (iSrc = iLeft; iSrc <= iRight; iSrc++) {
+			res->ContribRow[u].Weights[iSrc-iLeft] /= dTotalWeight;
+		}
+	}
+	}
+	return res;
 }

 static inline void _gdScaleRow(gdImagePtr pSrc,  unsigned int src_width, gdImagePtr dst, unsigned int dst_width, unsigned int row, LineContribType *contrib)
@@ -1244,7 +1269,13 @@ static gdImagePtr gdImageScaleBilinearPalette(gdImagePtr im, const unsigned int
 	if (new_img == NULL) {
 		return NULL;
 	}
-	new_img->transparent = gdTrueColorAlpha(im->red[transparent], im->green[transparent], im->blue[transparent], im->alpha[transparent]);
+
+	if (transparent < 0) {
+		/* uninitialized */
+		new_img->transparent = -1;
+	} else {
+		new_img->transparent = gdTrueColorAlpha(im->red[transparent], im->green[transparent], im->blue[transparent], im->alpha[transparent]);
+	}

 	for (i=0; i < _height; i++) {
 		long j;
@@ -1478,13 +1509,8 @@ gdImagePtr gdImageScaleBicubicFixed(gdImagePtr src, const unsigned int width, co
 				src_offset_y[0] = m;
 			}

-			if (m < 1) {
-				src_offset_x[1] = n;
-				src_offset_y[1] = m;
-			} else {
-				src_offset_x[1] = n;
-				src_offset_y[1] = m;
-			}
+			src_offset_x[1] = n;
+			src_offset_y[1] = m;

 			if ((m < 1) || (n >= src_w - 1)) {
 				src_offset_x[2] = n;
@@ -1536,13 +1562,8 @@ gdImagePtr gdImageScaleBicubicFixed(gdImagePtr src, const unsigned int width, co
 				src_offset_y[8] = m;
 			}

-			if (m >= src_h - 1) {
-				src_offset_x[8] = n;
-				src_offset_y[8] = m;
-			} else {
-				src_offset_x[9] = n;
-				src_offset_y[9] = m;
-			}
+			src_offset_x[9] = n;
+			src_offset_y[9] = m;

 			if ((m >= src_h-1) || (n >= src_w-1)) {
 				src_offset_x[10] = n;
@@ -1568,13 +1589,8 @@ gdImagePtr gdImageScaleBicubicFixed(gdImagePtr src, const unsigned int width, co
 				src_offset_y[12] = m;
 			}

-			if (m >= src_h - 2) {
-				src_offset_x[13] = n;
-				src_offset_y[13] = m;
-			} else {
-				src_offset_x[13] = n;
-				src_offset_y[13] = m;
-			}
+			src_offset_x[13] = n;
+			src_offset_y[13] = m;

 			if ((m >= src_h - 2) || (n >= src_w - 1)) {
 				src_offset_x[14] = n;
@@ -1983,13 +1999,8 @@ gdImagePtr gdImageRotateBicubicFixed(gdImagePtr src, const float degrees, const
 					src_offset_y[0] = m;
 				}

-				if (m < 1) {
-					src_offset_x[1] = n;
-					src_offset_y[1] = m;
-				} else {
-					src_offset_x[1] = n;
-					src_offset_y[1] = m ;
-				}
+				src_offset_x[1] = n;
+				src_offset_y[1] = m;

 				if ((m < 1) || (n >= src_w-1)) {
 					src_offset_x[2] = - 1;
@@ -2042,8 +2053,8 @@ gdImagePtr gdImageRotateBicubicFixed(gdImagePtr src, const float degrees, const
 				}

 				if (m >= src_h-1) {
-					src_offset_x[8] = - 1;
-					src_offset_y[8] = - 1;
+					src_offset_x[9] = - 1;
+					src_offset_y[9] = - 1;
 				} else {
 					src_offset_x[9] = n;
 					src_offset_y[9] = m;
@@ -330,7 +330,7 @@ han2zen (int *p1, int *p2)
    {
      if ((*p2 >= 74 && *p2 <= 103) || (*p2 >= 110 && *p2 <= 122))
 	(*p2)++;
-      else if (*p2 == 131 && *p2 == 69)
+      else if (*p2 == 131 || *p2 == 69)
 	*p2 = 148;
    }
  else if (handaku && *p2 >= 110 && *p2 <= 122)
@@ -15,9 +15,9 @@ Bug #22544 (TrueColor transparency in PNG images).
 	$red = imageColorAllocate($image, 255, 50, 50);
 	imageColorTransparent($image, $transparent);
 	imageFilledRectangle($image, 0, 0, 640-1, 100-1, $transparent);
-	imagePng($image, $dest);
+	imagegd($image, $dest);
 	echo md5_file($dest) . "\n";
 	@unlink($dest);
 ?>
 --EXPECT--
-10a57d09a2c63fad87b85b38d6b258d6
+7643ef115f642a79c2de6e411f485ddd
@@ -3,6 +3,9 @@ Bug #43121 (gdImageFill with IMG_COLOR_TILED crashes httpd)
 --SKIPIF--
 <?php
 	if (!extension_loaded('gd')) die("skip gd extension not available\n");
+	if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.0', '<')) {
+		die("skip test requires GD 2.2.0 or higher");
+	}
 ?>
 --FILE--
 <?php
@@ -3,6 +3,9 @@ Bug #43475 (Thick styled lines have scrambled patterns)
 --SKIPIF--
 <?php
 	if (!extension_loaded('gd')) die("skip gd extension not available\n");
+	if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.2', '<')) {
+		die("skip test requires GD 2.2.2 or higher");
+	}
 ?>
 --FILE--
 <?php
@@ -0,0 +1,26 @@
+--TEST--
+Bug #43828 (broken transparency of imagearc for truecolor in blendingmode)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip ext/gd not available');
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.2', '<')) {
+	die("skip test requires GD 2.2.2 or higher");
+}
+?>
+--FILE--
+<?php
+
+$im = imagecreatetruecolor(100,100);
+
+$transparent = imagecolorallocatealpha($im, 255, 255, 255, 80);
+imagefilledrectangle($im, 0,0, 99,99, $transparent);
+$color = imagecolorallocatealpha($im, 0, 255, 0, 100);
+imagefilledarc($im, 49, 49, 99,99, 0 , 360, $color, IMG_ARC_PIE);
+
+ob_start();
+imagegd($im);
+echo md5(ob_get_clean());
+imagedestroy($im);
+?>
+--EXPECT--
+2400a58cd7570b5472c25264715321cd
@@ -3,6 +3,9 @@ Bug #53154 (Zero-height rectangle has whiskers)
 --SKIPIF--
 <?php
 if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.2', '<')) {
+    die("skip test requires GD 2.2.2 or higher");
+}
 ?>
 --FILE--
 <?php
@@ -3,6 +3,9 @@ Bug #53640 (XBM images require width to be multiple of 8)
 --SKIPIF--
 <?php
 if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.3', '<')) {
+    die("skip test requires GD 2.2.3 or higher");
+}
 ?>
 --FILE--
 <?php
@@ -3,6 +3,9 @@ Bug #64641 (imagefilledpolygon doesn't draw horizontal line)
 --SKIPIF--
 <?php
 if (!extension_loaded('gd')) die("skip gd extension not available\n");
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.2', '<')) {
+	die("skip test requires GD 2.2.2 or higher");
+}
 ?>
 --FILE--
 <?php
@@ -0,0 +1,35 @@
+--TEST--
+Bug #66005 (imagecopy does not support 1bit transparency on truecolor images)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$dest = imagecreatetruecolor(150, 50);
+$transparent = imagecolorallocatealpha($dest, 255, 255, 255, 127);
+imagealphablending($dest, false);
+imagefill($dest, 1, 1, $transparent);
+imagesavealpha($dest, true);
+
+// Palette image with transparent color
+$png_palette = imagecreatefromstring(base64_decode('iVBORw0KGgoAAAANSUhEUgAAADIAAAAyAgMAAABjUWAiAAAACVBMVEUAAAD/AAD///9nGWQeAAAAAXRSTlMAQObYZgAAAEFJREFUKM9jYBimIASZIxoagOAwhoaGInisQJ4DksJQJKWoPCAnNIQYHsgChBX4eMSbiddlqH5A9R+q39HCZWgDAFxFGyOrmguhAAAAAElFTkSuQmCCPHP'));
+
+// 24 bit with transparent color
+$png_24 = imagecreatefromstring(base64_decode('iVBORw0KGgoAAAANSUhEUgAAADIAAAAyCAIAAACRXR/mAAAABnRSTlMAAAAAAABupgeRAAAAVklEQVRYw+3UQQqAMBAEwf3/p9eTBxEPiWAmWMU8oGFJqgAAuOpzWTX3xQUti+uRJTZ9V5aY1bOTFZLV7yZr9zt6ibv/qPXfrMpsGipbIy7oqQ8AYJED1plDy5PCu2sAAAAASUVORK5CYII='));
+
+// 32 bit with full alpha channel
+$png_full = imagecreatefromstring(base64_decode('iVBORw0KGgoAAAANSUhEUgAAADIAAAAyCAYAAAAeP4ixAAAAXklEQVRo3u3XMQrAIBBFwb3/pU2VwiJNIvjdzMD2PlBwqwAAAGajatxz9OGf5viA+KA3EXExXyKiYlqErIiIiBGSFLIyYmuMkO7Xy2MX4ovS/ONoH7Eh/m1nBwCASBe3VYeVaAy8PwAAAABJRU5ErkJggg=='));
+
+imagecopy($dest, $png_palette, 0, 0, 0, 0, 50, 50);
+imagecopy($dest, $png_24, 50, 0, 0, 0, 50, 50);
+imagecopy($dest, $png_full, 100, 0, 0, 0, 50, 50);
+
+ob_start();
+imagegd($dest);
+echo md5(ob_get_clean()), PHP_EOL;
+?>
+==DONE==
+--EXPECT--
+9b36049de01006b367efd433f1689043
+==DONE==
@@ -3,6 +3,9 @@ Bug #66387 (Stack overflow with imagefilltoborder)
 --SKIPIF--
 <?php
 if (!extension_loaded('gd')) die('skip gd extension not available!');
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.1', '<')) {
+    die("skip test requires GD 2.2.1 or higher");
+}
 ?>
 --FILE--
 <?php
@@ -1,5 +1,11 @@
 --TEST--
 Bug #67447 (imagecrop() adds a black line when cropping)
+--SKIPIF--
+<?php
+	if (!extension_loaded('gd')) {
+		die("skip gd extension not available\n");
+	}
+?>
 --FILE--
 <?php
 // true color
@@ -3,6 +3,9 @@ Bug #71912 (libgd: signedness vulnerability)
 --SKIPIF--
 <?php
        if(!extension_loaded('gd')){ die('skip gd extension not available'); }
+        if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.0', '<')) {
+            die("skip test requires GD 2.2.0 or higher");
+        }
        if(!function_exists('imagecreatefromgd2')) die('skip imagecreatefromgd2() not available');
 ?>
 --FILE--
@@ -1,7 +1,12 @@
 --TEST--
 Bug #72339 Integer Overflow in _gd2GetHeader() resulting in heap overflow 
 --SKIPIF--
-<?php if (!function_exists("imagecreatefromgd2")) print "skip"; ?>
+<?php
+if (!function_exists("imagecreatefromgd2")) print "skip";
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.2', '<')) {
+	die("skip test requires GD 2.2.2 or higher");
+}
+?>
 --FILE--
 <?php
 $fname = dirname(__FILE__) . DIRECTORY_SEPARATOR . "bug72339.gd";
@@ -0,0 +1,20 @@
+--TEST--
+Bug #19366 (gdimagefill() function crashes (fixed in bundled libgd))
+--SKIPIF--
+<?php
+	if (!extension_loaded('gd')) die("skip gd extension not available\n");
+	if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.2', '<')) {
+		die("skip test requires GD 2.2.2 or higher");
+	}
+?>
+--FILE--
+<?php
+$img = imagecreatetruecolor(100, 100);
+imagecolortransparent($img, -1000000);
+imagetruecolortopalette($img, TRUE, 3);
+imagecolortransparent($img, 9);
+echo "OK";
+?>
+--EXPECT--
+OK
+
@@ -0,0 +1,21 @@
+--TEST--
+Bug #72512 gdImageTrueColorToPaletteBody allows arbitrary write/read access, var 0
+--SKIPIF--
+<?php
+	if (!extension_loaded('gd')) die("skip gd extension not available\n");
+	if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.2', '<')) {
+		die("skip test requires GD 2.2.2 or higher");
+	}
+?>
+--FILE--
+<?php
+
+$img = imagecreatetruecolor(13, 1007);
+
+imagecolortransparent($img, -10066304);
+imagetruecolortopalette($img, TRUE, 3);
+imagescale($img, 1, 65535);
+?>
+==DONE==
+--EXPECT--
+==DONE==
@@ -0,0 +1,21 @@
+--TEST--
+Bug #72512 gdImageTrueColorToPaletteBody allows arbitrary write/read access, var 1
+--SKIPIF--
+<?php
+	if (!extension_loaded('gd')) die("skip gd extension not available\n");
+	if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.2', '<')) {
+		die("skip test requires GD 2.2.2 or higher");
+	}
+?>
+--FILE--
+<?php
+
+$img = imagecreatetruecolor(100, 100);
+imagecolortransparent($img, -1000000);
+imagetruecolortopalette($img, TRUE, 3);
+imagecolortransparent($img, 9);
+
+?>
+==DONE==
+--EXPECT--
+==DONE==
@@ -0,0 +1,12 @@
+--TEST--
+Bug #72596 (imagetypes function won't advertise WEBP support)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+var_dump(function_exists('imagewebp') === (bool) (imagetypes() & IMG_WEBP));
+?>
+--EXPECT--
+bool(true)
@@ -0,0 +1,19 @@
+--TEST--
+Bug #72604 (imagearc() ignores thickness for full arcs)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip requires ext/gd');
+if (!(imagetypes() & IMG_PNG)) die('skip requires PNG support');
+?>
+--FILE--
+<?php
+$im = imagecreatetruecolor(100, 100);
+imagesetthickness($im, 5);
+imagearc($im, 50, 50, 90, 90, 0, 360, 0xffffff);
+ob_start();
+imagegd($im);
+$imagestring = ob_get_clean();
+echo md5($imagestring);
+?>
+--EXPECT--
+4f5080080a774efe4fc8d55cd4a5849c
@@ -0,0 +1,17 @@
+--TEST--
+Bug #72697: select_colors write out-of-bounds
+--SKIPIF--
+<?php 
+if (!function_exists("imagecreatetruecolor")) die("skip");
+if (PHP_INT_MAX !== 9223372036854775807) die("skip for 64-bit long systems only");
+?>
+--FILE--
+<?php
+
+$img=imagecreatetruecolor(10, 10);
+imagetruecolortopalette($img, false, PHP_INT_MAX / 8);
+?>
+DONE
+--EXPECTF--
+Warning: imagetruecolortopalette(): Number of colors has to be greater than zero and no more than 2147483647 in %sbug72697.php on line %d
+DONE
@@ -0,0 +1,18 @@
+--TEST--
+Bug #72709 (imagesetstyle() causes OOB read for empty $styles)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip ext/gd not available');
+?>
+--FILE--
+<?php
+$im = imagecreatetruecolor(1, 1);
+var_dump(imagesetstyle($im, array()));
+imagesetpixel($im, 0, 0, IMG_COLOR_STYLED);
+imagedestroy($im);
+?>
+====DONE====
+--EXPECTF--
+Warning: imagesetstyle(): styles array must not be empty in %s%ebug72709.php on line %d
+bool(false)
+====DONE====
@@ -0,0 +1,15 @@
+--TEST--
+Bug #72730: imagegammacorrect allows arbitrary write access
+--SKIPIF--
+<?php 
+if (!function_exists("imagecreatetruecolor")) die("skip");
+?>
+--FILE--
+<?php
+$img =  imagecreatetruecolor(1, 1);
+imagegammacorrect($img, -1, 1337);
+?>
+DONE
+--EXPECTF--
+Warning: imagegammacorrect(): Gamma values should be positive in %sbug72730.php on line %d
+DONE
@@ -0,0 +1,29 @@
+--TEST--
+Bug #72913 (imagecopy() loses single-color transparency on palette images)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$base64 = 'iVBORw0KGgoAAAANSUhEUgAAADIAAAAyCAIAAACRXR/mAAAABnRSTlMAAAAAAABu'
+    . 'pgeRAAAAVklEQVRYw+3UQQqAMBAEwf3/p9eTBxEPiWAmWMU8oGFJqgAAuOpzWTX3'
+    . 'xQUti+uRJTZ9V5aY1bOTFZLV7yZr9zt6ibv/qPXfrMpsGipbIy7oqQ8AYJED1plD'
+    . 'y5PCu2sAAAAASUVORK5CYII=';
+$src = imagecreatefromstring(base64_decode($base64));
+
+$dst = imagecreate(50, 50);
+$transparent = imagecolorallocatealpha($dst, 255, 255, 255, 127);
+imagealphablending($dst, false);
+imagesavealpha($dst, true);
+
+imagecopy($dst, $src, 0,0, 0,0, 50,50);
+
+ob_start();
+imagegd($dst);
+echo md5(ob_get_clean()), PHP_EOL;
+?>
+==DONE==
+--EXPECT--
+f03c27f20710e21debd7090c660f1a1e
+==DONE==
@@ -25,26 +25,28 @@ var_dump(gd_info());
 *** Testing gd_info() : variation ***
 array(%d) {
  ["GD Version"]=>
-  string(%d) %a
+  string(%d) %s
  ["FreeType Support"]=>
-  bool%a
+  bool(%a
  ["T1Lib Support"]=>
-  bool%a
+  bool(%s)
  ["GIF Read Support"]=>
-  bool%a
+  bool(%s)
  ["GIF Create Support"]=>
-  bool%a
+  bool(%s)
  ["JPEG Support"]=>
-  bool%a
+  bool(%s)
  ["PNG Support"]=>
-  bool%a
+  bool(%s)
  ["WBMP Support"]=>
-  bool%a
+  bool(%s)
  ["XPM Support"]=>
-  bool%a
+  bool(%s)
  ["XBM Support"]=>
-  bool%a
+  bool(%s)
+  ["WebP Support"]=>
+  bool(%s)
  ["JIS-mapped Japanese Font Support"]=>
-  bool%a
+  bool(%s)
 }
 ===DONE===
@@ -3,6 +3,9 @@ Github #215 (imagefilltoborder stack overflow when invalid pallete index used)
 --SKIPIF-- 
 <?php  
 if (!extension_loaded("gd")) die("skip GD not present"); 
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.2', '<')) {
+    die("skip test requires GD 2.2.2 or higher");
+}
 ?> 
 --FILE--
 <?php
@@ -18,11 +18,11 @@ $white = imagecolorallocate($image, 0xFF, 0xFF, 0xFF);
 imagearc($image, 50, 50, 30, 30, 0, 180, $white);

 ob_start();
-imagepng($image);
+imagegd($image);
 $img = ob_get_contents();
 ob_end_clean();

 echo md5(base64_encode($img));
 ?>
 --EXPECT--
-f18ad8001afefee2e9b8c08d6884425b
+13149c3fd54a92a0d43cd5083a19b1d7
@@ -18,7 +18,7 @@ $white = imagecolorallocate($image, 0xFF, 0xFF, 0xFF);
 imagearc($image, 50, 50, 30, 30, 0, 180);

 ob_start();
-imagepng($image);
+imagegd($image);
 $img = ob_get_contents();
 ob_end_clean();

@@ -26,4 +26,4 @@ echo md5(base64_encode($img));
 ?>
 --EXPECTF--
 Warning: imagearc() expects exactly 8 parameters, 7 given in %s on line %d
-abebb25b5a2813cfbf92f1f24365786a
+c5b7013900f5466aebfc42499a7ec8ec
@@ -18,11 +18,11 @@ $white = imagecolorallocate($image, 0xFF, 0xFF, 0xFF);
 imagearc($image, 50, 50, 30, 30, 0, -90, $white);

 ob_start();
-imagepng($image);
+imagegd($image);
 $img = ob_get_contents();
 ob_end_clean();

 echo md5(base64_encode($img));
 ?>
 --EXPECT--
-ed2c8427a9922dfd8a105f10a88a0d20
+fe662ebe7488057c43e38c5de43b1727
@@ -18,11 +18,11 @@ $white = imagecolorallocate($image, 0xFF, 0xFF, 0xFF);
 imagearc($image, 50, 50, 30, 30, -90, 0, $white);

 ob_start();
-imagepng($image);
+imagegd($image);
 $img = ob_get_contents();
 ob_end_clean();

 echo md5(base64_encode($img));
 ?>
 --EXPECT--
-463b4aea9d9acfab30016ee92613c779
+8bd78aa775b5f29e7227eaeebaa84889
@@ -15,11 +15,11 @@ $white = imagecolorallocate($image, 255,255,255);
 $result = imagechar($image, 1, 5, 5, 'C', $white);

 ob_start();
-imagepng($image, null, 9);
+imagegd($image);
 $img = ob_get_contents();
 ob_end_clean();

 echo md5(base64_encode($img));
 ?>
 --EXPECT--
-e94962ac28ad03bd4142cb1abe9ef98b
+f0291252e7ac2fadda25e63287e6860c
@@ -15,11 +15,11 @@ $white = imagecolorallocate($image, 255,255,255);
 $result = imagecharup($image, 1, 5, 5, 'C', $white);

 ob_start();
-imagepng($image, null, 9);
+imagegd($image);
 $img = ob_get_contents();
 ob_end_clean();

 echo md5(base64_encode($img));
 ?>
 --EXPECT--
-79b48d5cef6d489bb68573df0296d775
+c65aad5d78f934dee2a844e7978eabd5
@@ -5,6 +5,9 @@ Rafael Dohms <rdohms [at] gmail [dot] com>
 --SKIPIF--
 <?php 
 	if (!extension_loaded("gd")) die("skip GD not present");
+	if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.2', '<')) {
+		die("skip test requires GD 2.2.2 or higher");
+	}
 ?>
 --FILE--
 <?php
@@ -18,7 +21,7 @@ $half =  imagefilledarc ( $img, 75, 75, 70, 70, 0, 180, $cor, IMG_ARC_PIE );
 $half2 =  imagefilledarc ( $img, 75, 75, 70, 70, 180, 360, $corA, IMG_ARC_PIE );

 ob_start();
-imagepng($img, null, 9);
+imagegd($img);
 $imgsrc = ob_get_contents();
 ob_end_clean();

@@ -26,5 +29,5 @@ var_dump(md5(base64_encode($imgsrc)));
 var_dump($corA);
 ?>
 --EXPECT--
-string(32) "2a6424e4cb4e1b7391dfff74bf136bde"
+string(32) "0981ef94ee2209a8dccb59aa8ad07e18"
 int(842163455)
@@ -25,11 +25,11 @@ imagecolorset($im, $bg, 0, 0, 255);

 // Get output and generate md5 hash
 ob_start();
-imagepng($im, null, 9);
+imagegd($im);
 $result_image = ob_get_contents();
 ob_end_clean();
 echo md5(base64_encode($result_image));
 imagedestroy($im);
 ?>
 --EXPECT--
-6f2002aafb57b2d275fad6a6258d7476
+85e406abd0a975c97b3403cad5d078c9
@@ -23,11 +23,11 @@ $gaussian = array(
 imageconvolution($image, $gaussian, 16, 0);

 ob_start();
-imagepng($image, null, 9);
+imagegd($image);
 $img = ob_get_contents();
 ob_end_clean();

 echo md5(base64_encode($img));
 ?>
 --EXPECT--
-594576a2a2a689447ffc07eb5a73f09b
+20979b45f8772cdbd78262af4e332638
@@ -12,11 +12,11 @@ Rafael Dohms <rdohms [at] gmail [dot] com>
 $image = imagecreatetruecolor(180, 30);

 ob_start();
-imagepng($image, null, 9);
+imagegd($image);
 $img = ob_get_contents();
 ob_end_clean();

 echo md5(base64_encode($img));
 ?>
 --EXPECT--
-5a8fe9864cbd20e5dbe730c77f30db95
+da884f488a851e0267a316ad232aee86
@@ -17,11 +17,11 @@ $image = imagecreatetruecolor(400, 300);
 imageellipse($image, 200, 150, 300, 200, 16777215);

 ob_start();
-imagepng($image, null, 9);
+imagegd($image);
 $img = ob_get_contents();
 ob_end_clean();

 echo md5(base64_encode($img));
 ?>
 --EXPECT--
-d8b9bc2ca224bd68569413f4617f8e1f
+49c1544b012c3460c74cd04f1332d4ad
@@ -6,6 +6,9 @@ Edgar Ferreira da Silva <contato [at] edgarfs [dot] com [dot] br>
 --SKIPIF--
 <?php 
 if (!extension_loaded("gd")) die("skip GD not present");
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.2', '<')) {
+	die("skip test requires GD 2.2.2 or higher");
+}
 ?>
 --FILE--
 <?php
@@ -18,11 +21,11 @@ $white = imagecolorallocate($image, 0xFF, 0xFF, 0xFF);
 imagefilledarc($image, 50, 50, 30, 30, 0, 90, $white, IMG_ARC_PIE);

 ob_start();
-imagepng($image);
+imagegd($image);
 $img = ob_get_contents();
 ob_end_clean();

 echo md5(base64_encode($img));
 ?>
 --EXPECT--
-beffeaf5231adaaff1f21a2108fb6f7e
+87637c60ac0ceea48dbcaa4d98319f90
@@ -18,7 +18,7 @@ $white = imagecolorallocate($image, 0xFF, 0xFF, 0xFF);
 imagefilledarc($image, 50, 50, 30, 30, 0, 90, $white);

 ob_start();
-imagepng($image);
+imagegd($image);
 $img = ob_get_contents();
 ob_end_clean();

@@ -26,4 +26,4 @@ echo md5(base64_encode($img));
 ?>
 --EXPECTF--
 Warning: imagefilledarc() expects exactly 9 parameters, 8 given in %s on line %d
-abebb25b5a2813cfbf92f1f24365786a
+c5b7013900f5466aebfc42499a7ec8ec
@@ -6,6 +6,9 @@ Edgar Ferreira da Silva <contato [at] edgarfs [dot] com [dot] br>
 --SKIPIF--
 <?php 
 if (!extension_loaded("gd")) die("skip GD not present");
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.2', '<')) {
+	die("skip test requires GD 2.2.2 or higher");
+}
 ?>
 --FILE--
 <?php
@@ -18,11 +21,11 @@ $white = imagecolorallocate($image, 0xFF, 0xFF, 0xFF);
 imagefilledarc($image, 50, 50, 30, 30, 0, -25, $white, IMG_ARC_PIE);

 ob_start();
-imagepng($image);
+imagegd($image);
 $img = ob_get_contents();
 ob_end_clean();

 echo md5(base64_encode($img));
 ?>
 --EXPECT--
-b467492b806001c3720b3f18cfbde5b0
+f25f589b5c5fa7deead7242652919bcf
@@ -6,6 +6,9 @@ Edgar Ferreira da Silva <contato [at] edgarfs [dot] com [dot] br>
 --SKIPIF--
 <?php 
 if (!extension_loaded("gd")) die("skip GD not present");
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.2', '<')) {
+	die("skip test requires GD 2.2.2 or higher");
+}
 ?>
 --FILE--
 <?php
@@ -18,11 +21,11 @@ $white = imagecolorallocate($image, 0xFF, 0xFF, 0xFF);
 imagefilledarc($image, 50, 50, 30, 30, -25, 25, $white, IMG_ARC_PIE);

 ob_start();
-imagepng($image);
+imagegd($image);
 $img = ob_get_contents();
 ob_end_clean();

 echo md5(base64_encode($img));
 ?>
 --EXPECT--
-cfad369fc6d863785d3c95b4b4788225
+43c2973eb4872903eb6f5464c7965a93
@@ -15,11 +15,11 @@ $white = imagecolorallocate($image, 0xFF, 0xFF, 0xFF);
 imagefilledellipse($image, 50, 50, 40, 30, $white);

 ob_start();
-imagepng($image);
+imagegd($image);
 $img = ob_get_contents();
 ob_end_clean();

 echo md5(base64_encode($img));
 ?>
 --EXPECT--
-9ba540bba1b78c9f08efaa6fa0afd93b
+233beffe003a41d3c9e788039e3191dd
@@ -22,7 +22,7 @@ imageellipse( $image, 50, 50, 50, 50, imagecolorallocate( $image, 0, 0, 0 ) );
 imagefilltoborder( $image, 50, 50, imagecolorallocate( $image, 0, 0, 0 ), imagecolorallocate( $image, 255, 0, 0 ) );

 ob_start(); 
-imagepng( $image, null, 9 ); 
+imagegd( $image);
 $img = ob_get_contents(); 
 ob_end_clean();

@@ -30,4 +30,4 @@ echo md5(base64_encode($img));

 ?> 
 --EXPECT-- 
-847ec236f1c4d14c465306c8408550fc
+8185a06ccff03c2abeb99d5e3ed60e45
@@ -6,6 +6,9 @@ Rafael Dohms <rdohms [at] gmail [dot] com>
 --SKIPIF--
 <?php 
 	if (!extension_loaded("gd")) die("skip GD not present");
+	if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.2', '<')) {
+		die("skip test requires GD 2.2.2 or higher");
+	}
 ?>
 --FILE--
 <?php
@@ -21,7 +24,7 @@ $gamma = imagegammacorrect($image, 1, 5);

 if ($gamma){
 	ob_start();
-	imagepng($image, null, 9);
+	imagegd($image);
 	$img = ob_get_contents();
 	ob_end_clean();
 }
@@ -29,4 +32,4 @@ if ($gamma){
 echo md5(base64_encode($img));
 ?>
 --EXPECT--
-e79553115df689ea5df18a4636380569
+1f625723f9d27251a1f15b83a6a4bf55
@@ -6,6 +6,9 @@ Rafael Dohms <rdohms [at] gmail [dot] com>
 --SKIPIF--
 <?php 
 	if (!extension_loaded("gd")) die("skip GD not present");
+	if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.2', '<')) {
+		die("skip test requires GD 2.2.2 or higher");
+	}
 ?>
 --FILE--
 <?php
@@ -21,7 +24,7 @@ $gamma = imagegammacorrect($image, 1, 5);

 if ($gamma){
 	ob_start();
-	imagepng($image, null, 9);
+	imagegd($image);
 	$img = ob_get_contents();
 	ob_end_clean();
 }
@@ -29,4 +32,4 @@ if ($gamma){
 echo md5(base64_encode($img));
 ?>
 --EXPECT--
-b017b1ddc8bda00e82aa8cbfb54c35d4
+32fdb7b3675e4a9fd601c6a0645c88b3
@@ -16,7 +16,7 @@ $layer = imagelayereffect($image, IMG_EFFECT_REPLACE);

 if ($layer){
 	ob_start();
-	imagepng($image, null, 9);
+	imagegd($image);
 	$img = ob_get_contents();
 	ob_end_clean();
 }
@@ -24,4 +24,4 @@ if ($layer){
 echo md5(base64_encode($img));
 ?>
 --EXPECT--
-5a8fe9864cbd20e5dbe730c77f30db95
+da884f488a851e0267a316ad232aee86
@@ -16,7 +16,7 @@ $image = imagecreatetruecolor( 100, 100 );
 imagerectangle( $image, 0, 0, 50, 50, imagecolorallocate($image, 255, 255, 255) );

 ob_start(); 
-imagepng( $image, null, 9 ); 
+imagegd( $image );
 $img = ob_get_contents(); 
 ob_end_clean();

@@ -24,4 +24,4 @@ echo md5(base64_encode($img));

 ?> 
 --EXPECT-- 
-282aaecfdd50091821d63093d9bb1bb9
+e7f8ca8c63fb08b248f3ed6435983aed
@@ -28,10 +28,10 @@ imageline($mainimg, 50, 50, 50, 60, IMG_COLOR_BRUSHED);

 // Get output and generate md5 hash
 ob_start();
-imagepng($mainimg, null, 9);
+imagegd($mainimg);
 $result_image = ob_get_contents();
 ob_end_clean();
 echo md5(base64_encode($result_image));
 ?>
 --EXPECT--
-8168577c0d1fe6d9d11397cb15263d82
+2bb294c388d826cc9bba6c6fd31f265a
@@ -24,11 +24,11 @@ imagesetthickness($image, 5);
 imagerectangle($image, 14, 14, 185, 85, $black);

 ob_start();
-imagepng($image, null, 9);
+imagegd($image);
 $img = ob_get_contents();
 ob_end_clean();

 echo md5(base64_encode($img));
 ?>
 --EXPECT--
-93c3077f1bdc372cd0b0db96db282985
+1a6bc882772310d2e9b32cca2574236c
@@ -15,11 +15,11 @@ $white = imagecolorallocate($image, 255,255,255);
 $result = imagestring($image, 1, 5, 5, 'String Text', $white);

 ob_start();
-imagepng($image, null, 9);
+imagegd($image);
 $img = ob_get_contents();
 ob_end_clean();

 echo md5(base64_encode($img));
 ?>
 --EXPECT--
-d0d2fe757400cb7846b36a8c34b41e4a
+7f146e3cdcaf89c6b9d68ccbb44cf94e
@@ -15,11 +15,11 @@ $white = imagecolorallocate($image, 255,255,255);
 $result = imagestringup($image, 1, 5, 25, 'Str', $white);

 ob_start();
-imagepng($image, null, 9);
+imagegd($image);
 $img = ob_get_contents();
 ob_end_clean();

 echo md5(base64_encode($img));
 ?>
 --EXPECT--
-7c28016adcf620b772af2a8655b87bd2
+7c55836800702bdd43b4c25d8ebcfcd0
@@ -5,6 +5,9 @@ Rafael Dohms <rdohms [at] gmail [dot] com>
 --SKIPIF--
 <?php 
 	if (!extension_loaded("gd")) die("skip GD not present");
+	if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.2', '<')) {
+		die("skip test requires GD 2.2.2 or higher");
+	}
 	if (!function_exists("imagecreatetruecolor")) die("skip GD Version not compatible");
 ?>
 --FILE--
@@ -20,7 +23,7 @@ $half2 =  imagefilledarc ( $image, 75, 55, 80, 70, 0, -180, $b, IMG_ARC_PIE );
 var_dump(imagetruecolortopalette($image, true, 2));

 ob_start();
-imagepng($image, null, 9);
+imagegd($image);
 $img = ob_get_contents();
 ob_end_clean();

@@ -28,4 +31,4 @@ echo md5(base64_encode($img));
 ?>
 --EXPECT--
 bool(true)
-1d41787ff70aa0c7eea5ee9304afa36b
+17c901cb2217eb7647deed1c79d445de