re-fix leak

Revert "fix leak"
This reverts commit c5d9c50897.
2026-11-09 02:00:49 +00:00 · 2016-06-22 03:50:40 +02:00 · 2016-06-22 03:50:31 +02:00 · 2016-06-22 03:50:22 +02:00 · 2016-06-22 03:49:54 +02:00 · 2016-06-22 03:06:31 +02:00
70 changed files with 3346 additions and 3274 deletions
@@ -1,136 +1,51 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-21 Jul 2016, PHP 5.6.24
-
- Core:
-  . Fixed bug #71936 (Segmentation fault destroying HTTP_RAW_POST_DATA).
-    (mike dot laspina at gmail dot com, Remi)
-  . Fixed bug #72496 (Cannot declare public method with signature incompatible
-    with parent private method). (Pedro Magalhães)
-  . Fixed bug #72138 (Integer Overflow in Length of String-typed ZVAL). (Stas)
-  . Fixed bug #72513 (Stack-based buffer overflow vulnerability in
-    virtual_file_ex). (loianhtuan at gmail dot com)
-  . Fixed bug #72562 (Use After Free in unserialize() with Unexpected Session
-    Deserialization). (taoguangchen at icloud dot com)
-  . Fixed bug #72573 (HTTP_PROXY is improperly trusted by some PHP libraries and
-    applications). (CVE-2016-5385) (Stas)
-
- bz2:
-  . Fixed bug #72447 (Type Confusion in php_bz2_filter_create()). (gogil at 
-    stealien dot com).
-  . Fixed bug #72613 (Inadequate error handling in bzread()). (Stas)
-
- EXIF:
-  . Fixed bug #50845 (exif_read_data() returns corrupted exif headers).
-    (Bartosz Dziewoński)
- EXIF:
-  . Fixed bug #72603 (Out of bound read in exif_process_IFD_in_MAKERNOTE).
-    (Stas)
-  . Fixed bug #72618 (NULL Pointer Dereference in exif_process_user_comment).
-    (Stas)
-
- GD:
-  . Fixed bug #43475 (Thick styled lines have scrambled patterns). (cmb)
-  . Fixed bug #53640 (XBM images require width to be multiple of 8). (cmb)
-  . Fixed bug #64641 (imagefilledpolygon doesn't draw horizontal line). (cmb)
-  . Fixed bug #72512 (gdImageTrueColorToPaletteBody allows arbitrary write/read
-    access). (Pierre)
-  . Fixed bug #72519 (imagegif/output out-of-bounds access). (Pierre)
-  . Fixed bug #72558 (Integer overflow error within _gdContributionsAlloc()).
-    (CVE-2016-6207) (Pierre)
-
- Intl:
-  . Fixed bug #72533 (locale_accept_from_http out-of-bounds access). (Stas)
-
- ODBC:
-  . Fixed bug #69975 (PHP segfaults when accessing nvarchar(max) defined columns)
-
- OpenSSL:
-  . Fixed bug #71915 (openssl_random_pseudo_bytes is not fork-safe).
-    (Jakub Zelenka)
-  . Fixed bug #72336 (openssl_pkey_new does not fail for invalid DSA params).
-    (Jakub Zelenka)
-
- SNMP:
-  . Fixed bug #72479 (Use After Free Vulnerability in SNMP with GC and
-    unserialize()). (taoguangchen at icloud dot com)
-
- SPL:
-  . Fixed bug #55701 (GlobIterator throws LogicException). (Valentin VĂLCIU)
-
- SQLite3:
-  . Fixed bug #70628 (Clearing bindings on an SQLite3 statement doesn't work).
-    (cmb)
-
- Streams:
-  . Fixed bug #72439 (Stream socket with remote address leads to a segmentation
-    fault). (Laruence)
-
- Xmlrpc:
-  . Fixed bug #72606 (heap-buffer-overflow (write) simplestring_addn simplestring.c).
-    (Stas)
-
- Zip:
-  . Fixed bug #72520 (Stack-based buffer overflow vulnerability in
-    php_stream_zip_opener). (loianhtuan at gmail dot com)
-
 23 Jun 2016, PHP 5.6.23

 - Core:
-  . Fixed bug #72268 (Integer Overflow in nl2br()). (Stas)
  . Fixed bug #72275 (Integer Overflow in json_encode()/json_decode()/
    json_utf8_to_utf16()). (Stas)
  . Fixed bug #72400 (Integer Overflow in addcslashes/addslashes). (Stas)
  . Fixed bug #72403 (Integer Overflow in Length of String-typed ZVAL). (Stas)

- Date:
-  . Fixed bug #63740 (strtotime seems to use both sunday and monday as start of
-    week). (Derick)
-
 - GD:
-  . Fixed bug #66387 (Stack overflow with imagefilltoborder). (CVE-2015-8874)
-    (cmb)
  . Fixed bug #72298 (pass2_no_dither out-of-bounds access). (Stas)
-  . Fixed bug #72337 (invalid dimensions can lead to crash). (Pierre)
-  . Fixed bug #72339 (Integer Overflow in _gd2GetHeader() resulting in 
-    heap overflow). (CVE-2016-5766) (Pierre)
+  . Fixed bug #72337 (invalid dimensions can lead to crash) (Pierre)
+  . Fixed bug #72339 (Integer Overflow in _gd2GetHeader() resulting in
+    heap overflow). (Pierre)
  . Fixed bug #72407 (NULL Pointer Dereference at _gdScaleVert). (Stas)
  . Fixed bug #72446 (Integer Overflow in gdImagePaletteToTrueColor() resulting
-    in heap overflow). (CVE-2016-5767) (Pierre)
+    in heap overflow). (Pierre)

 - Intl:
  . Fixed bug #70484 (selectordinal doesn't work with named parameters).
    (Anatol)

 - mbstring:
-   . Fixed bug #72402 (_php_mb_regex_ereg_replace_exec - double free).
-     (CVE-2016-5768) (Stas)
+   . Fixed bug #72402 (_php_mb_regex_ereg_replace_exec - double free). (Stas)

 - mcrypt:
-   . Fixed bug #72455 (Heap Overflow due to integer overflows). (CVE-2016-5769)
-     (Stas)
-
- OpenSSL:
-  . Fixed bug #72140 (segfault after calling ERR_free_strings()).
-    (Jakub Zelenka)
+   . Fixed bug #72455 (Heap Overflow due to integer overflows). (Stas)

 - Phar:
  . Fixed bug #72321 (invalid free in phar_extract_file()).
    (hji at dyntopia dot com)

 - SPL:
-  . Fixed bug #72262 (int/size_t confusion in SplFileObject::fread).
-    (CVE-2016-5770) (Stas)
+  . Fixed bug #72262 (int/size_t confusion in SplFileObject::fread). (Stas)
  . Fixed bug #72433 (Use After Free Vulnerability in PHP's GC algorithm and
-    unserialize). (CVE-2016-5771) (Dmitry)
+    unserialize). (Dmitry)
+
+- OpenSSL:
+  . Fixed bug #72140 (segfault after calling ERR_free_strings()).
+    (Jakub Zelenka)

 - WDDX:
-  . Fixed bug #72340 (Double Free Courruption in wddx_deserialize).
-    (CVE-2016-5772) (Stas)
+  . Fixed bug #72340 (Double Free Courruption in wddx_deserialize). (Stas)

 - zip:
  . Fixed bug #72434 (ZipArchive class Use After Free Vulnerability in PHP's GC
-    algorithm and unserialize). (CVE-2016-5773) (Dmitry)
+    algorithm and unserialize). (Dmitry)

 26 May 2016, PHP 5.6.22

@@ -138,24 +53,22 @@ PHP                                                                        NEWS
  . Fixed bug #72172 (zend_hex_strtod should not use strlen).
    (bwitz at hotmail dot com )
  . Fixed bug #72114 (Integer underflow / arbitrary null write in
-    fread/gzread). (CVE-2016-5096) (Stas)
-  . Fixed bug #72135 (Integer Overflow in php_html_entities). (CVE-2016-5094)
-    (Stas)
+    fread/gzread). (Stas)
+  . Fixed bug #72135 (Integer Overflow in php_html_entities). (Stas)

 - GD:
-  . Fixed bug #72227 (imagescale out-of-bounds read). (CVE-2013-7456) (Stas)
+  . Fixed bug #72227 (imagescale out-of-bounds read). (Stas)

 - Intl
  . Fixed bug #64524 (Add intl.use_exceptions to php.ini-*). (Anatol)
-  . Fixed bug #72241 (get_icu_value_internal out-of-bounds read).
-    (CVE-2016-5093) (Stas)
+  . Fixed bug #72241 (get_icu_value_internal out-of-bounds read). (Stas)

 - Postgres:
-  . Fixed bug #72151 (mysqli_fetch_object changed behaviour). (Anatol)
+  . Fixed bug #72151 (mysqli_fetch_object changed behaviour). (Anatol) 

 28 Apr 2016, PHP 5.6.21

- Core:
+- Core: 
  . Fixed bug #69537 (__debugInfo with empty string for key gives error).
    (krakjoe)
  . Fixed bug #71841 (EG(error_zval) is not handled well). (Laruence)
@@ -169,6 +82,8 @@ PHP                                                                        NEWS
    (Michael Sierks)    

 - Date:
+  . Fixed bug #63740 (strtotime seems to use both sunday and monday as start of
+    week). (Derick)
  . Fixed bug #71889 (DateInterval::format Segmentation fault). (Thomas Punt)

 - EXIF:
@@ -1,43 +0,0 @@
--TEST--
-Bug #72496 (declare public method with signature incompatible with parent private method should not throw a warning)
--FILE--
-<?php
-class Foo
-{
-    private function getFoo()
-    {
-        return 'Foo';
-    }
-
-    private function getBar()
-    {
-        return 'Bar';
-    }
-
-    private function getBaz()
-    {
-        return 'Baz';
-    }
-}
-
-class Bar extends Foo
-{
-    public function getFoo($extraArgument)
-    {
-        return $extraArgument;
-    }
-
-    protected function getBar($extraArgument)
-    {
-        return $extraArgument;
-    }
-
-    private function getBaz($extraArgument)
-    {
-        return $extraArgument;
-    }
-}
-
-echo "OK\n";
--EXPECT--
-OK
@@ -3252,8 +3252,8 @@ static zend_bool zend_do_perform_implementation_check(const zend_function *fe, c
 		return 1;
 	}

-	/* If the prototype method is private do not enforce a signature */
-	if (proto->common.fn_flags & ZEND_ACC_PRIVATE) {
+	/* If both methods are private do not enforce a signature */
+    if ((fe->common.fn_flags & ZEND_ACC_PRIVATE) && (proto->common.fn_flags & ZEND_ACC_PRIVATE)) {
 		return 1;
 	}

@@ -651,14 +651,14 @@ CWD_API void realpath_cache_del(const char *path, int path_len TSRMLS_DC) /* {{{
 					memcmp(path, (*bucket)->path, path_len) == 0) {
 			realpath_cache_bucket *r = *bucket;
 			*bucket = (*bucket)->next;
-
+		   
 			/* if the pointers match then only subtract the length of the path */
 		   	if(r->path == r->realpath) {
 				CWDG(realpath_cache_size) -= sizeof(realpath_cache_bucket) + r->path_len + 1;
 			} else {
 				CWDG(realpath_cache_size) -= sizeof(realpath_cache_bucket) + r->path_len + 1 + r->realpath_len + 1;
 			}
-
+		   
 			free(r);
 			return;
 		} else {
@@ -734,7 +734,7 @@ static inline realpath_cache_bucket* realpath_cache_find(const char *path, int p
 			realpath_cache_bucket *r = *bucket;
 			*bucket = (*bucket)->next;

-			/* if the pointers match then only subtract the length of the path */
+			/* if the pointers match then only subtract the length of the path */		   
 		   	if(r->path == r->realpath) {
 				CWDG(realpath_cache_size) -= sizeof(realpath_cache_bucket) + r->path_len + 1;
 			} else {
@@ -1190,7 +1190,7 @@ CWD_API int virtual_file_ex(cwd_state *state, const char *path, verify_path_func
 	int add_slash;
 	void *tmp;

-	if (path_length <= 0 || path_length >= MAXPATHLEN-1) {
+	if (path_length == 0 || path_length >= MAXPATHLEN-1) {
 #ifdef TSRM_WIN32
 # if _MSC_VER < 1300
 		errno = EINVAL;
@@ -119,7 +119,7 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=6
-PHP_RELEASE_VERSION=24
+PHP_RELEASE_VERSION=23
 PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
@@ -15,7 +15,7 @@
  | Author: Sterling Hughes <sterling@php.net>                           |
  +----------------------------------------------------------------------+
 */
-
+ 
 /* $Id$ */

 #ifdef HAVE_CONFIG_H
@@ -138,33 +138,29 @@ struct php_bz2_stream_data_t {
 static size_t php_bz2iop_read(php_stream *stream, char *buf, size_t count TSRMLS_DC)
 {
 	struct php_bz2_stream_data_t *self = (struct php_bz2_stream_data_t *) stream->abstract;
-	int bz2_ret;
+	size_t ret;
+	
+	ret = BZ2_bzread(self->bz_file, buf, count);

-	bz2_ret = BZ2_bzread(self->bz_file, buf, count);
-
-	if (bz2_ret < 0) {
-		stream->eof = 1;
-		return -1;
-	}
-	if (bz2_ret == 0) {
+	if (ret == 0) {
 		stream->eof = 1;
 	}

-	return (size_t)bz2_ret;
+	return ret;
 }

 static size_t php_bz2iop_write(php_stream *stream, const char *buf, size_t count TSRMLS_DC)
 {
 	struct php_bz2_stream_data_t *self = (struct php_bz2_stream_data_t *) stream->abstract;

-	return BZ2_bzwrite(self->bz_file, (char*)buf, count);
+	return BZ2_bzwrite(self->bz_file, (char*)buf, count); 
 }

 static int php_bz2iop_close(php_stream *stream, int close_handle TSRMLS_DC)
 {
 	struct php_bz2_stream_data_t *self = (struct php_bz2_stream_data_t *)stream->abstract;
 	int ret = EOF;
-
+	
 	if (close_handle) {
 		BZ2_bzclose(self->bz_file);
 	}
@@ -200,7 +196,7 @@ PHP_BZ2_API php_stream *_php_stream_bz2open_from_BZFILE(BZFILE *bz,
 														const char *mode, php_stream *innerstream STREAMS_DC TSRMLS_DC)
 {
 	struct php_bz2_stream_data_t *self;
-
+	
 	self = emalloc(sizeof(*self));

 	self->stream = innerstream;
@@ -231,7 +227,7 @@ PHP_BZ2_API php_stream *_php_stream_bz2open(php_stream_wrapper *wrapper,
 	virtual_filepath_ex(path, &path_copy, NULL TSRMLS_CC);
 #else
 	path_copy = path;
-#endif
+#endif  

 	if (php_check_open_basedir(path_copy TSRMLS_CC)) {
 #ifdef VIRTUAL_DIR
@@ -239,7 +235,7 @@ PHP_BZ2_API php_stream *_php_stream_bz2open(php_stream_wrapper *wrapper,
 #endif
 		return NULL;
 	}
-
+	
 	/* try and open it directly first */
 	bz_file = BZ2_bzopen(path_copy, mode);

@@ -250,11 +246,11 @@ PHP_BZ2_API php_stream *_php_stream_bz2open(php_stream_wrapper *wrapper,
 	efree(path_copy);
 #endif
 	path_copy = NULL;
-
+	
 	if (bz_file == NULL) {
 		/* that didn't work, so try and get something from the network/wrapper */
 		stream = php_stream_open_wrapper(path, mode, options | STREAM_WILL_CAST, opened_path);
-
+	
 		if (stream) {
 			php_socket_t fd;
 			if (SUCCESS == php_stream_cast(stream, PHP_STREAM_AS_FD, (void **) &fd, REPORT_ERRORS)) {
@@ -269,7 +265,7 @@ PHP_BZ2_API php_stream *_php_stream_bz2open(php_stream_wrapper *wrapper,
 			VCWD_UNLINK(*opened_path);
 		}
 	}
-
+	
 	if (bz_file) {
 		retstream = _php_stream_bz2open_from_BZFILE(bz_file, mode, stream STREAMS_REL_CC TSRMLS_CC);
 		if (retstream) {
@@ -345,7 +341,7 @@ static PHP_FUNCTION(bzread)
 	if (FAILURE == zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "r|l", &bz, &len)) {
 		RETURN_FALSE;
 	}
-
+	
 	php_stream_from_zval(stream, &bz);

 	if ((len + 1) < 1) {
@@ -355,13 +351,13 @@ static PHP_FUNCTION(bzread)

 	Z_STRVAL_P(return_value) = emalloc(len + 1);
 	Z_STRLEN_P(return_value) = php_stream_read(stream, Z_STRVAL_P(return_value), len);
-
+	
 	if (Z_STRLEN_P(return_value) < 0) {
 		efree(Z_STRVAL_P(return_value));
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "could not read valid bz2 data from stream");
-		RETURN_FALSE;
+		RETURN_FALSE;		
 	}
-
+	
 	Z_STRVAL_P(return_value)[Z_STRLEN_P(return_value)] = 0;
 	Z_TYPE_P(return_value) = IS_STRING;
 }
@@ -377,7 +373,7 @@ static PHP_FUNCTION(bzopen)

 	BZFILE   *bz;     /* The compressed file stream */
 	php_stream *stream = NULL;
-
+	
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "Zs", &file, &mode, &mode_len) == FAILURE) {
 		return;
 	}
@@ -393,15 +389,15 @@ static PHP_FUNCTION(bzopen)
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "filename cannot be empty");
 			RETURN_FALSE;
 		}
-
+		
 		if (CHECK_ZVAL_NULL_PATH(*file)) {
 			RETURN_FALSE;
 		}

 		stream = php_stream_bz2open(NULL,
-									Z_STRVAL_PP(file),
-									mode,
-									REPORT_ERRORS,
+									Z_STRVAL_PP(file), 
+									mode, 
+									REPORT_ERRORS, 
 									NULL);
 	} else if (Z_TYPE_PP(file) == IS_RESOURCE) {
 		/* If it is a resource, than its a stream resource */
@@ -410,7 +406,7 @@ static PHP_FUNCTION(bzopen)

 		php_stream_from_zval(stream, file);
 		stream_mode_len = strlen(stream->mode);
-
+		
 		if (stream_mode_len != 1 && !(stream_mode_len == 2 && memchr(stream->mode, 'b', 2))) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "cannot use stream opened in mode '%s'", stream->mode);
 			RETURN_FALSE;
@@ -444,7 +440,7 @@ static PHP_FUNCTION(bzopen)
 		if (FAILURE == php_stream_cast(stream, PHP_STREAM_AS_FD, (void *) &fd, REPORT_ERRORS)) {
 			RETURN_FALSE;
 		}
-
+		
 		bz = BZ2_bzdopen(fd, mode);

 		stream = php_stream_bz2open_from_BZFILE(bz, mode, stream);
@@ -498,7 +494,7 @@ static PHP_FUNCTION(bzcompress)
 					  work_factor = 0, /* Work factor for compression algorithm */
 					  argc;            /* Argument count */
 	int               source_len;      /* Length of the source data */
-	unsigned int      dest_len;        /* Length of the destination buffer */
+	unsigned int      dest_len;        /* Length of the destination buffer */ 

 	argc = ZEND_NUM_ARGS();

@@ -507,19 +503,19 @@ static PHP_FUNCTION(bzcompress)
 	}

 	/* Assign them to easy to use variables, dest_len is initially the length of the data
-	   + .01 x length of data + 600 which is the largest size the results of the compression
-	   could possibly be, at least that's what the libbz2 docs say (thanks to jeremy@nirvani.net
+	   + .01 x length of data + 600 which is the largest size the results of the compression 
+	   could possibly be, at least that's what the libbz2 docs say (thanks to jeremy@nirvani.net 
 	   for pointing this out).  */
 	dest_len   = (unsigned int) (source_len + (0.01 * source_len) + 600);
-
+	
 	/* Allocate the destination buffer */
 	dest = emalloc(dest_len + 1);
-
+	
 	/* Handle the optional arguments */
 	if (argc > 1) {
 		block_size = zblock_size;
 	}
-
+	
 	if (argc > 2) {
 		work_factor = zwork_factor;
 	}
@@ -569,7 +565,7 @@ static PHP_FUNCTION(bzdecompress)
 	/* in most cases bz2 offers at least 2:1 compression, so we use that as our base */
 	bzs.avail_out = source_len * 2;
 	bzs.next_out = dest = emalloc(bzs.avail_out + 1);
-
+	
 	while ((error = BZ2_bzDecompress(&bzs)) == BZ_OK && bzs.avail_in > 0) {
 		/* compression is better then 2:1, need to allocate more memory */
 		bzs.avail_out = source_len;
@@ -595,13 +591,13 @@ static PHP_FUNCTION(bzdecompress)
 /* {{{ php_bz2_error()
   The central error handling interface, does the work for bzerrno, bzerrstr and bzerror */
 static void php_bz2_error(INTERNAL_FUNCTION_PARAMETERS, int opt)
-{
+{ 
 	zval         *bzp;     /* BZip2 Resource Pointer */
 	php_stream   *stream;
 	const char   *errstr;  /* Error string */
 	int           errnum;  /* Error number */
 	struct php_bz2_stream_data_t *self;
-
+	
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "r", &bzp) == FAILURE) {
 		return;
 	}
@@ -613,10 +609,10 @@ static void php_bz2_error(INTERNAL_FUNCTION_PARAMETERS, int opt)
 	}

 	self = (struct php_bz2_stream_data_t *) stream->abstract;
-
+	
 	/* Fetch the error information */
 	errstr = BZ2_bzerror(self->bz_file, &errnum);
-
+	
 	/* Determine what to return */
 	switch (opt) {
 		case PHP_BZ_ERRNO:
@@ -627,7 +623,7 @@ static void php_bz2_error(INTERNAL_FUNCTION_PARAMETERS, int opt)
 			break;
 		case PHP_BZ_ERRBOTH:
 			array_init(return_value);
-
+		
 			add_assoc_long  (return_value, "errno",  errnum);
 			add_assoc_string(return_value, "errstr", (char*)errstr, 1);
 			break;
@@ -396,7 +396,7 @@ static php_stream_filter *php_bz2_filter_create(const char *filtername, zval *fi
 					zval_copy_ctor(&tmp);
 					convert_to_long(&tmp);
 					if (Z_LVAL(tmp) < 1 || Z_LVAL(tmp) > 9) {
-						php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid parameter given for number of blocks to allocate. (%ld)", Z_LVAL(tmp));
+						php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid parameter given for number of blocks to allocate. (%ld)", Z_LVAL_PP(tmpzval));
 					} else {
 						blockSize100k = Z_LVAL(tmp);
 					}
@@ -1,15 +0,0 @@
--TEST--
-Bug #72447: Type Confusion in php_bz2_filter_create()
--SKIPIF--
-<?php if (!extension_loaded("bz2")) print "skip"; ?>
--FILE--
-<?php
-$input = "AAAAAAAA";
-$param = array('blocks' => $input);
-
-$fp = fopen('testfile', 'w');
-stream_filter_append($fp, 'bzip2.compress', STREAM_FILTER_WRITE, $param);
-fclose($fp);
-?>
--EXPECTF--
-Warning: stream_filter_append(): Invalid parameter given for number of blocks to allocate. (0) in %s%ebug72447.php on line %d
@@ -1,23 +0,0 @@
--TEST--
-Bug #72613 (Inadequate error handling in bzread())
--SKIPIF--
-<?php if (!extension_loaded("bz2")) print "skip"; ?>
--FILE--
-<?php
-$fp = bzopen(__DIR__.'/72613.bz2', 'r');
-if ($fp === FALSE) {
-    exit("ERROR: bzopen()");
-}
-$data = "";
-while (!feof($fp)) {
-    $res = bzread($fp);
-    if ($res === FALSE) {
-        exit("ERROR: bzread()");
-    }
-    $data .= $res;
-}
-bzclose($fp);
-?>
-DONE
--EXPECT--
-DONE
@@ -2059,7 +2059,6 @@ static void date_register_classes(TSRMLS_D)
 	date_object_handlers_immutable.clone_obj = date_object_clone_date;
 	date_object_handlers_immutable.compare_objects = date_object_compare_date;
 	date_object_handlers_immutable.get_properties = date_object_get_properties;
-	date_object_handlers_immutable.get_gc = date_object_get_gc;
 	zend_class_implements(date_ce_immutable TSRMLS_CC, 1, date_ce_interface);

 	INIT_CLASS_ENTRY(ce_timezone, "DateTimeZone", date_funcs_timezone);
@@ -2226,7 +2225,7 @@ static HashTable *date_object_get_properties(zval *object TSRMLS_DC)

 	props = zend_std_get_properties(object TSRMLS_CC);

-	if (!dateobj->time) {
+	if (!dateobj->time || GC_G(gc_active)) {
 		return props;
 	}

@@ -4942,7 +4941,7 @@ static HashTable *date_object_get_properties_period(zval *object TSRMLS_DC)

 	props = zend_std_get_properties(object TSRMLS_CC);

-	if (!period_obj->start) {
+	if (!period_obj->start || GC_G(gc_active)) {
 		return props;
 	}

@@ -49,9 +49,9 @@ print "TZ=Asia/Baku - wrong day.\n";
 date_default_timezone_set("Asia/Baku");
 $tStamp = mktime (17, 17, 17, 1, 8299, 1970);
 print "tStamp=". date("l Y-m-d H:i:s T I", $tStamp). "\n";
-$strtotime_tstamp = strtotime("second Monday", $tStamp);
+$strtotime_tstamp = strtotime("next Sunday", $tStamp);
 print "result=".date("l Y-m-d H:i:s T I", $strtotime_tstamp)."\n";
-print "wanted=Monday              00:00:00\n\n";
+print "wanted=Sunday              00:00:00\n\n";

 print "TZ=America/Noronha - wrong day.\n";
 date_default_timezone_set("America/Noronha");
@@ -227,8 +227,8 @@ wanted=Thursday             00:00:00

 TZ=Asia/Baku - wrong day.
 tStamp=Sunday 1992-09-20 17:17:17 AZST 1
-result=Monday 1992-09-28 00:00:00 AZT 0
-wanted=Monday              00:00:00
+result=Sunday 1992-09-27 00:00:00 AZT 0
+wanted=Sunday              00:00:00

 TZ=America/Noronha - wrong day.
 tStamp=Friday 1999-10-01 17:17:17 FNT 0
@@ -2613,7 +2613,6 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
 	*pszEncoding = NULL;
 	/* Copy the comment */
 	if (ByteCount>=8) {
-		const zend_encoding *from, *to;
 		if (!memcmp(szValuePtr, "UNICODE\0", 8)) {
 			*pszEncoding = estrdup((const char*)szValuePtr);
 			szValuePtr = szValuePtr+8;
@@ -2634,16 +2633,14 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
 			} else {
 				decode = ImageInfo->decode_unicode_le;
 			}
-			to = zend_multibyte_fetch_encoding(ImageInfo->encode_unicode TSRMLS_CC);
-			from = zend_multibyte_fetch_encoding(decode TSRMLS_CC);
 			/* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX   */
-			if (!to || !from || zend_multibyte_encoding_converter(
+			if (zend_multibyte_encoding_converter(
 					(unsigned char**)pszInfoPtr,
 					&len,
 					(unsigned char*)szValuePtr,
 					ByteCount,
-					to,
-					from
+					zend_multibyte_fetch_encoding(ImageInfo->encode_unicode TSRMLS_CC),
+					zend_multibyte_fetch_encoding(decode TSRMLS_CC)
 					TSRMLS_CC) == (size_t)-1) {
 				len = exif_process_string_raw(pszInfoPtr, szValuePtr, ByteCount);
 			}
@@ -2658,15 +2655,13 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
 			szValuePtr = szValuePtr+8;
 			ByteCount -= 8;
 			/* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX   */
-			to = zend_multibyte_fetch_encoding(ImageInfo->encode_jis TSRMLS_CC);
-			from = zend_multibyte_fetch_encoding(ImageInfo->motorola_intel ? ImageInfo->decode_jis_be : ImageInfo->decode_jis_le TSRMLS_CC);
-			if (!to || !from || zend_multibyte_encoding_converter(
+			if (zend_multibyte_encoding_converter(
 					(unsigned char**)pszInfoPtr,
 					&len,
 					(unsigned char*)szValuePtr,
 					ByteCount,
-					to,
-					from
+					zend_multibyte_fetch_encoding(ImageInfo->encode_jis TSRMLS_CC),
+					zend_multibyte_fetch_encoding(ImageInfo->motorola_intel ? ImageInfo->decode_jis_be : ImageInfo->decode_jis_le TSRMLS_CC)
 					TSRMLS_CC) == (size_t)-1) {
 				len = exif_process_string_raw(pszInfoPtr, szValuePtr, ByteCount);
 			}
@@ -2737,12 +2732,6 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 		break;
 	}

-	if (maker_note->offset >= value_len) {
-		/* Do not go past the value end */
-		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "IFD data too short: 0x%04X offset 0x%04X", value_len, maker_note->offset);
-		return FALSE;
-	}
-
 	dir_start = value_ptr + maker_note->offset;

 #ifdef EXIF_DEBUG
@@ -2771,19 +2760,10 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 			offset_base = value_ptr;
 			break;
 		case MN_OFFSET_GUESS:
-			if (maker_note->offset + 10 + 4 >= value_len) {
-				/* Can not read dir_start+10 since it's beyond value end */
-				exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "IFD data too short: 0x%04X", value_len);
-				return FALSE;
-			}
 			offset_diff = 2 + NumDirEntries*12 + 4 - php_ifd_get32u(dir_start+10, ImageInfo->motorola_intel);
 #ifdef EXIF_DEBUG
 			exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Using automatic offset correction: 0x%04X", ((int)dir_start-(int)offset_base+maker_note->offset+displacement) + offset_diff);
 #endif
-			if (offset_diff < 0 || offset_diff >= value_len ) {
-				exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "IFD data bad offset: 0x%04X length 0x%04X", offset_diff, value_len);
-				return FALSE;
-			}
 			offset_base = value_ptr + offset_diff;
 			break;
 		default:
@@ -2792,7 +2772,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 	}

 	if ((2+NumDirEntries*12) > value_len) {
-		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 2 + 0x%04X*12 = 0x%04X > 0x%04X", NumDirEntries, 2+NumDirEntries*12, value_len);
+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 2 + x%04X*12 = x%04X > x%04X", NumDirEntries, 2+NumDirEntries*12, value_len);
 		return FALSE;
 	}

@@ -2898,11 +2878,11 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 			}

 			fpos = php_stream_tell(ImageInfo->infile);
-			php_stream_seek(ImageInfo->infile, displacement+offset_val, SEEK_SET);
+			php_stream_seek(ImageInfo->infile, offset_val, SEEK_SET);
 			fgot = php_stream_tell(ImageInfo->infile);
-			if (fgot!=displacement+offset_val) {
+			if (fgot!=offset_val) {
 				EFREE_IF(outside);
-				exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Wrong file pointer: 0x%08X != 0x%08X", fgot, displacement+offset_val);
+				exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Wrong file pointer: 0x%08X != 0x%08X", fgot, offset_val);
 				return FALSE;
 			}
 			fgot = php_stream_read(ImageInfo->infile, value_ptr, byte_count);
@@ -3078,10 +3058,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				break;

 			case TAG_MAKER_NOTE:
-				if (!exif_process_IFD_in_MAKERNOTE(ImageInfo, value_ptr, byte_count, offset_base, IFDlength, displacement TSRMLS_CC)) {
-					EFREE_IF(outside);
-					return FALSE;
-				}
+				exif_process_IFD_in_MAKERNOTE(ImageInfo, value_ptr, byte_count, offset_base, IFDlength, displacement TSRMLS_CC);
 				break;

 			case TAG_EXIF_IFD_POINTER:
@@ -1,140 +0,0 @@
--TEST--
-Bug #50845 (exif_read_data() returns corrupted exif headers)
--SKIPIF--
-<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
--FILE--
-<?php
-$infile = dirname(__FILE__).'/bug50845.jpg';
-var_dump(exif_read_data($infile));
--EXPECTF--
-array(44) {
-  ["FileName"]=>
-  string(12) "bug50845.jpg"
-  ["FileDateTime"]=>
-  int(%d)
-  ["FileSize"]=>
-  int(803603)
-  ["FileType"]=>
-  int(2)
-  ["MimeType"]=>
-  string(10) "image/jpeg"
-  ["SectionsFound"]=>
-  string(30) "ANY_TAG, IFD0, THUMBNAIL, EXIF"
-  ["COMPUTED"]=>
-  array(9) {
-    ["html"]=>
-    string(26) "width="5472" height="3648""
-    ["Height"]=>
-    int(3648)
-    ["Width"]=>
-    int(5472)
-    ["IsColor"]=>
-    int(1)
-    ["ByteOrderMotorola"]=>
-    int(0)
-    ["ApertureFNumber"]=>
-    string(5) "f/7.1"
-    ["Copyright"]=>
-    string(13) "Public Domain"
-    ["Thumbnail.FileType"]=>
-    int(2)
-    ["Thumbnail.MimeType"]=>
-    string(10) "image/jpeg"
-  }
-  ["ImageDescription"]=>
-  string(295) "A U.S. Marine Corps MV-22 Osprey lands on the USS Whidbey Island (LSD-41), May 5, 2016. The vehicles were loaded to support a theater security cooperation event as a part of a MEU readiness exercise. (U.S. Marine Corps photo by Lance Cpl. Koby I. Saunders/22 Marine Expeditionary Unit/ Released)"
-  ["Make"]=>
-  string(5) "Canon"
-  ["Model"]=>
-  string(22) "Canon EOS-1D X Mark II"
-  ["Orientation"]=>
-  int(1)
-  ["XResolution"]=>
-  string(5) "240/1"
-  ["YResolution"]=>
-  string(5) "240/1"
-  ["ResolutionUnit"]=>
-  int(2)
-  ["Artist"]=>
-  string(24) "Lance Cpl. Koby Saunders"
-  ["Copyright"]=>
-  string(13) "Public Domain"
-  ["Exif_IFD_Pointer"]=>
-  int(12572)
-  ["THUMBNAIL"]=>
-  array(6) {
-    ["Compression"]=>
-    int(6)
-    ["XResolution"]=>
-    string(5) "240/1"
-    ["YResolution"]=>
-    string(5) "240/1"
-    ["ResolutionUnit"]=>
-    int(2)
-    ["JPEGInterchangeFormat"]=>
-    int(860)
-    ["JPEGInterchangeFormatLength"]=>
-    int(11204)
-  }
-  ["ExposureTime"]=>
-  string(5) "1/200"
-  ["FNumber"]=>
-  string(5) "71/10"
-  ["ExposureProgram"]=>
-  int(1)
-  ["ISOSpeedRatings"]=>
-  int(100)
-  ["UndefinedTag:0x8830"]=>
-  int(2)
-  ["UndefinedTag:0x8832"]=>
-  int(100)
-  ["ExifVersion"]=>
-  string(4) "0230"
-  ["ShutterSpeedValue"]=>
-  string(15) "7643856/1000000"
-  ["ApertureValue"]=>
-  string(15) "5655638/1000000"
-  ["ExposureBiasValue"]=>
-  string(3) "0/1"
-  ["MaxApertureValue"]=>
-  string(3) "4/1"
-  ["MeteringMode"]=>
-  int(5)
-  ["Flash"]=>
-  int(16)
-  ["FocalLength"]=>
-  string(4) "24/1"
-  ["ColorSpace"]=>
-  int(65535)
-  ["FocalPlaneXResolution"]=>
-  string(12) "5472000/1438"
-  ["FocalPlaneYResolution"]=>
-  string(11) "3648000/958"
-  ["FocalPlaneResolutionUnit"]=>
-  int(2)
-  ["CustomRendered"]=>
-  int(0)
-  ["ExposureMode"]=>
-  int(1)
-  ["WhiteBalance"]=>
-  int(0)
-  ["SceneCaptureType"]=>
-  int(0)
-  ["UndefinedTag:0xA431"]=>
-  string(12) "002099000358"
-  ["UndefinedTag:0xA432"]=>
-  array(4) {
-    [0]=>
-    string(4) "24/1"
-    [1]=>
-    string(5) "105/1"
-    [2]=>
-    string(3) "0/0"
-    [3]=>
-    string(3) "0/0"
-  }
-  ["UndefinedTag:0xA434"]=>
-  string(22) "EF24-105mm f/4L IS USM"
-  ["UndefinedTag:0xA435"]=>
-  string(10) "000044bc4c"
-}
@@ -13,4 +13,8 @@ exif_read_data(__DIR__ . '/bug54002_2.jpeg');
 --EXPECTF--
 Warning: exif_read_data(bug54002_1.jpeg): Process tag(x0205=UndefinedTa): Illegal byte_count in %sbug54002.php on line %d

-Warning: exif_read_data(bug54002_2.jpeg): Process tag(x0205=UndefinedTa): Illegal byte_count in %sbug54002.php on line %d
+Warning: exif_read_data(bug54002_1.jpeg): Process tag(xA000=FlashPixVer): Illegal pointer offset(%s) in %sbug54002.php on line %d
+
+Warning: exif_read_data(bug54002_2.jpeg): Process tag(x0205=UndefinedTa): Illegal byte_count in %sbug54002.php on line %d
+
+Warning: exif_read_data(bug54002_2.jpeg): Process tag(xA000=FlashPixVer): Illegal pointer offset(%s) in %sbug54002.php on line %d
@@ -10,9 +10,7 @@ echo "Test\n";
 var_dump(count(exif_read_data(__DIR__."/bug62523_2.jpg")));
 ?>
 Done
--EXPECTF--
+--EXPECT--
 Test
-
-Warning: exif_read_data(bug62523_2.jpg): IFD data bad offset: 0xADB23672 length 0x0D94 in %s%ebug62523_2.php on line %d
-int(30)
+int(76)
 Done
@@ -1,11 +0,0 @@
--TEST--
-Bug #72603 (Out of bound read in exif_process_IFD_in_MAKERNOTE)
--SKIPIF--
-<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
--FILE--
-<?php
-var_dump(count(exif_read_data(dirname(__FILE__) . "/bug72603.jpeg")));
-?>
--EXPECTF--
-Warning: exif_read_data(bug72603.jpeg): %s in %s%ebug72603.php on line %d
-int(%d)
@@ -1,11 +0,0 @@
--TEST--
-Bug 72618 (NULL Pointer Dereference in exif_process_user_comment)
--SKIPIF--
-<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
--FILE--
-<?php
-var_dump(count(exif_read_data(dirname(__FILE__) . "/bug72618.jpg")));
-?>
--EXPECTF--
-Warning: exif_read_data(bug72618.jpg): %s in %s%ebug72618.php on line %d
-int(%d)
@@ -190,7 +190,7 @@ gdImagePtr gdImageCreateTrueColor (int sx, int sy)
 		return NULL;
 	}

-	if (overflow2(sizeof(int *), sx)) {
+	if (overflow2(sizeof(int), sx)) {
 		return NULL;
 	}

@@ -599,18 +599,15 @@ void gdImageColorDeallocate (gdImagePtr im, int color)

 void gdImageColorTransparent (gdImagePtr im, int color)
 {
-	if (color < 0) {
-		return;
-	}
 	if (!im->trueColor) {
-		if((color >= im->colorsTotal)) {
-			return;
-		}
-		/* Make the old transparent color opaque again */
 		if (im->transparent != -1) {
 			im->alpha[im->transparent] = gdAlphaOpaque;
 		}
-		im->alpha[color] = gdAlphaTransparent;
+		if (color > -1 && color < im->colorsTotal && color < gdMaxColors) {
+			im->alpha[color] = gdAlphaTransparent;
+		} else {
+			return;
+		}
 	}
 	im->transparent = color;
 }
@@ -1058,13 +1055,11 @@ void gdImageAABlend (gdImagePtr im)
 	}
 }

-static void _gdImageFilledHRectangle (gdImagePtr im, int x1, int y1, int x2, int y2, int color);
-
 static void gdImageHLine(gdImagePtr im, int y, int x1, int x2, int col)
 {
 	if (im->thick > 1) {
 		int thickhalf = im->thick >> 1;
-		_gdImageFilledHRectangle(im, x1, y - thickhalf, x2, y + im->thick - thickhalf - 1, col);
+		gdImageFilledRectangle(im, x1, y - thickhalf, x2, y + im->thick - thickhalf - 1, col);
 	} else {
 		if (x2 < x1) {
 			int t = x2;
@@ -2129,53 +2124,10 @@ void gdImageRectangle (gdImagePtr im, int x1, int y1, int x2, int y2, int color)
 	}
 }

-static void _gdImageFilledHRectangle (gdImagePtr im, int x1, int y1, int x2, int y2, int color)
+void gdImageFilledRectangle (gdImagePtr im, int x1, int y1, int x2, int y2, int color)
 {
 	int x, y;

-	if (x1 == x2 && y1 == y2) {
-		gdImageSetPixel(im, x1, y1, color);
-		return;
-	}
-
-	if (x1 > x2) {
-		x = x1;
-		x1 = x2;
-		x2 = x;
-	}
-
-	if (y1 > y2) {
-		y = y1;
-		y1 = y2;
-		y2 = y;
-	}
-
-	if (x1 < 0) {
-		x1 = 0;
-	}
-
-	if (x2 >= gdImageSX(im)) {
-		x2 = gdImageSX(im) - 1;
-	}
-
-	if (y1 < 0) {
-		y1 = 0;
-	}
-
-	if (y2 >= gdImageSY(im)) {
-		y2 = gdImageSY(im) - 1;
-	}
-
-	for (x = x1; (x <= x2); x++) {
-		for (y = y1; (y <= y2); y++) {
-			gdImageSetPixel (im, x, y, color);
-		}
-	}
-}
-
-static void _gdImageFilledVRectangle (gdImagePtr im, int x1, int y1, int x2, int y2, int color)
-{
-	int x, y;

 	if (x1 == x2 && y1 == y2) {
 		gdImageSetPixel(im, x1, y1, color);
@@ -2217,11 +2169,6 @@ static void _gdImageFilledVRectangle (gdImagePtr im, int x1, int y1, int x2, int
 	}
 }

-void gdImageFilledRectangle (gdImagePtr im, int x1, int y1, int x2, int y2, int color)
-{
-	_gdImageFilledVRectangle(im, x1, y1, x2, y2, color);
-}
-
 void gdImageCopy (gdImagePtr dst, gdImagePtr src, int dstX, int dstY, int srcX, int srcY, int w, int h)
 {
 	int c;
@@ -2724,19 +2671,6 @@ void gdImageFilledPolygon (gdImagePtr im, gdPointPtr p, int n, int c)
 			maxy = p[i].y;
 		}
 	}
-	/* necessary special case: horizontal line */
-	if (n > 1 && miny == maxy) {
-		x1 = x2 = p[0].x;
-		for (i = 1; (i < n); i++) {
-			if (p[i].x < x1) {
-				x1 = p[i].x;
-			} else if (p[i].x > x2) {
-				x2 = p[i].x;
-			}
-		}
-		gdImageLine(im, x1, miny, x2, miny, c);
-		return;
-	}
 	pmaxy = maxy;
 	/* 2.0.16: Optimization by Ilia Chipitsine -- don't waste time offscreen */
 	if (miny < 0) {
@@ -601,26 +601,14 @@ nomatch:
 * code in turn.  When the buffer fills up empty it and start over.
 */

-static const unsigned long masks[] = { 0x0000, 0x0001, 0x0003, 0x0007, 0x000F,
+static unsigned long masks[] = { 0x0000, 0x0001, 0x0003, 0x0007, 0x000F,
                                  0x001F, 0x003F, 0x007F, 0x00FF,
                                  0x01FF, 0x03FF, 0x07FF, 0x0FFF,
                                  0x1FFF, 0x3FFF, 0x7FFF, 0xFFFF };

-
-/* Arbitrary value to mark output is done.  When we see EOFCode, then we don't
- * expect to see any more data.  If we do (e.g. corrupt image inputs), cur_bits
- * might be negative, so flag it to return early.
- */
-#define CUR_BITS_FINISHED -1000
-
-
 static void
 output(code_int code, GifCtx *ctx)
 {
-	if (ctx->cur_bits == CUR_BITS_FINISHED) {
-		return;
-	}
-
    ctx->cur_accum &= masks[ ctx->cur_bits ];

    if( ctx->cur_bits > 0 )
@@ -667,10 +655,8 @@ output(code_int code, GifCtx *ctx)
                ctx->cur_bits -= 8;
        }

-		/* Flag that it's done to prevent re-entry. */
-		ctx->cur_bits = CUR_BITS_FINISHED;
-
        flush_char(ctx);
+
    }
 }

@@ -879,42 +879,20 @@ int getPixelInterpolated(gdImagePtr im, const double x, const double y, const in
 static inline LineContribType * _gdContributionsAlloc(unsigned int line_length, unsigned int windows_size)
 {
 	unsigned int u = 0;
-	LineContribType *res;
-	int overflow_error = 0;
+    LineContribType *res;

 	res = (LineContribType *) gdMalloc(sizeof(LineContribType));
 	if (!res) {
 		return NULL;
 	}
-	res->WindowSize = windows_size;
-	res->LineLength = line_length;
-	if (overflow2(line_length, sizeof(ContributionType))) {
-		gdFree(res);
-		return NULL;
-	}
-	res->ContribRow = (ContributionType *) gdMalloc(line_length * sizeof(ContributionType));
-	if (res->ContribRow == NULL) {
-		gdFree(res);
-		return NULL;
-	}
-	for (u = 0 ; u < line_length ; u++) {
-		if (overflow2(windows_size, sizeof(double))) {
-			overflow_error = 1;
-		} else {
-			res->ContribRow[u].Weights = (double *) gdMalloc(windows_size * sizeof(double));
-		}
-		if (overflow_error == 1 || res->ContribRow[u].Weights == NULL) {
-			unsigned int i;
-			u--;
-			for (i=0;i<=u;i++) {
-				gdFree(res->ContribRow[i].Weights);
-			}
-			gdFree(res->ContribRow);
-			gdFree(res);
-			return NULL;
-		}
-	}
-	return res;
+    res->WindowSize = windows_size;
+    res->LineLength = line_length;
+    res->ContribRow = (ContributionType *) gdMalloc(line_length * sizeof(ContributionType));
+
+    for (u = 0 ; u < line_length ; u++) {
+        res->ContribRow[u].Weights = (double *) gdMalloc(windows_size * sizeof(double));
+    }
+    return res;
 }

 static inline void _gdContributionsFree(LineContribType * p)
@@ -929,62 +907,59 @@ static inline void _gdContributionsFree(LineContribType * p)

 static inline LineContribType *_gdContributionsCalc(unsigned int line_size, unsigned int src_size, double scale_d,  const interpolation_method pFilter)
 {
-	double width_d;
-	double scale_f_d = 1.0;
-	const double filter_width_d = DEFAULT_BOX_RADIUS;
+    double width_d;
+    double scale_f_d = 1.0;
+    const double filter_width_d = DEFAULT_BOX_RADIUS;
 	int windows_size;
 	unsigned int u;
 	LineContribType *res;
-	int overflow_error = 0;

-	if (scale_d < 1.0) {
-		width_d = filter_width_d / scale_d;
-		scale_f_d = scale_d;
-	}  else {
-		width_d= filter_width_d;
-	}
+    if (scale_d < 1.0) {
+        width_d = filter_width_d / scale_d;
+        scale_f_d = scale_d;
+    }  else {
+        width_d= filter_width_d;
+    }

-	windows_size = 2 * (int)ceil(width_d) + 1;
-	res = _gdContributionsAlloc(line_size, windows_size);
-	if (res == NULL) {
-		return NULL;
-	}
-	for (u = 0; u < line_size; u++) {
-	const double dCenter = (double)u / scale_d;
-	/* get the significant edge points affecting the pixel */
-	register int iLeft = MAX(0, (int)floor (dCenter - width_d));
-	int iRight = MIN((int)ceil(dCenter + width_d), (int)src_size - 1);
-	double dTotalWeight = 0.0;
+    windows_size = 2 * (int)ceil(width_d) + 1;
+    res = _gdContributionsAlloc(line_size, windows_size);
+
+    for (u = 0; u < line_size; u++) {
+        const double dCenter = (double)u / scale_d;
+        /* get the significant edge points affecting the pixel */
+        register int iLeft = MAX(0, (int)floor (dCenter - width_d));
+        int iRight = MIN((int)ceil(dCenter + width_d), (int)src_size - 1);
+        double dTotalWeight = 0.0;
 		int iSrc;

-	/* Cut edge points to fit in filter window in case of spill-off */
-	if (iRight - iLeft + 1 > windows_size)  {
-		if (iLeft < ((int)src_size - 1 / 2))  {
-			iLeft++;
-		} else {
-			iRight--;
-		}
-	}
+        /* Cut edge points to fit in filter window in case of spill-off */
+        if (iRight - iLeft + 1 > windows_size)  {
+            if (iLeft < ((int)src_size - 1 / 2))  {
+                iLeft++;
+            } else {
+                iRight--;
+            }
+        }

-	res->ContribRow[u].Left = iLeft;
-	res->ContribRow[u].Right = iRight;
+        res->ContribRow[u].Left = iLeft;
+        res->ContribRow[u].Right = iRight;

-	for (iSrc = iLeft; iSrc <= iRight; iSrc++) {
-		dTotalWeight += (res->ContribRow[u].Weights[iSrc-iLeft] =  scale_f_d * (*pFilter)(scale_f_d * (dCenter - (double)iSrc)));
-	}
+        for (iSrc = iLeft; iSrc <= iRight; iSrc++) {
+            dTotalWeight += (res->ContribRow[u].Weights[iSrc-iLeft] =  scale_f_d * (*pFilter)(scale_f_d * (dCenter - (double)iSrc)));
+        }

 		if (dTotalWeight < 0.0) {
 			_gdContributionsFree(res);
 			return NULL;
 		}

-	if (dTotalWeight > 0.0) {
-		for (iSrc = iLeft; iSrc <= iRight; iSrc++) {
-			res->ContribRow[u].Weights[iSrc-iLeft] /= dTotalWeight;
-		}
-	}
-	}
-	return res;
+        if (dTotalWeight > 0.0) {
+            for (iSrc = iLeft; iSrc <= iRight; iSrc++) {
+                res->ContribRow[u].Weights[iSrc-iLeft] /= dTotalWeight;
+            }
+        }
+   }
+   return res;
 }

 static inline void _gdScaleRow(gdImagePtr pSrc,  unsigned int src_width, gdImagePtr dst, unsigned int dst_width, unsigned int row, LineContribType *contrib)
@@ -1269,13 +1244,7 @@ static gdImagePtr gdImageScaleBilinearPalette(gdImagePtr im, const unsigned int
 	if (new_img == NULL) {
 		return NULL;
 	}
-
-	if (transparent < 0) {
-		/* uninitialized */
-		new_img->transparent = -1;
-	} else {
-		new_img->transparent = gdTrueColorAlpha(im->red[transparent], im->green[transparent], im->blue[transparent], im->alpha[transparent]);
-	}
+	new_img->transparent = gdTrueColorAlpha(im->red[transparent], im->green[transparent], im->blue[transparent], im->alpha[transparent]);

 	for (i=0; i < _height; i++) {
 		long j;
@@ -210,7 +210,7 @@ void gdImageXbmCtx(gdImagePtr image, char* file_name, int fg, gdIOCtx * out)
 			if (gdImageGetPixel(image, x, y) == fg) {
 				c |= b;
 			}
-			if ((b == 128) || (x == sx - 1)) {
+			if ((b == 128) || (x == sx && y == sy)) {
 				b = 1;
 				if (p) {
 					gdCtxPrintf(out, ", ");
@@ -1,59 +0,0 @@
--TEST--
-Bug #43475 (Thick styled lines have scrambled patterns)
--SKIPIF--
-<?php
-	if (!extension_loaded('gd')) die("skip gd extension not available\n");
-?>
--FILE--
-<?php
-require_once __DIR__ . '/similarity.inc';
-
-function setStyleAndThickness($im, $color, $thickness)
-{
-	$style = array();
-	$i = 0;
-	while ($i < 16 * $thickness) {
-		$style[$i++] = $color;
-	}
-	while ($i < 20 * $thickness) {
-		$style[$i++] = IMG_COLOR_TRANSPARENT;
-	}
-	while ($i < 28 * $thickness) {
-		$style[$i++] = $color;
-	}
-	while ($i < 32 * $thickness) {
-		$style[$i++] = IMG_COLOR_TRANSPARENT;
-	}
-	imagesetstyle($im, $style);
-	imagesetthickness($im, $thickness);
-}
-
-$im = imagecreate(800, 800);
-imagecolorallocate($im, 255, 255, 255);
-$black = imagecolorallocate($im, 0, 0, 0);
-
-setStyleAndThickness($im, $black, 1);
-imageline($im,  50, 250, 550, 250, IMG_COLOR_STYLED);
-imageline($im, 550, 250, 550, 750, IMG_COLOR_STYLED);
-imageline($im, 550, 750,  50, 250, IMG_COLOR_STYLED);
-
-setStyleAndThickness($im, $black, 2);
-imageline($im, 100, 200, 600, 200, IMG_COLOR_STYLED);
-imageline($im, 600, 200, 600, 700, IMG_COLOR_STYLED);
-imageline($im, 600, 700, 100, 200, IMG_COLOR_STYLED);
-
-setStyleAndThickness($im, $black, 4);
-imageline($im, 150, 150, 650, 150, IMG_COLOR_STYLED);
-imageline($im, 650, 150, 650, 650, IMG_COLOR_STYLED);
-imageline($im, 650, 650, 150, 150, IMG_COLOR_STYLED);
-
-setStyleAndThickness($im, $black, 6);
-imageline($im, 200, 100, 700, 100, IMG_COLOR_STYLED);
-imageline($im, 700, 100, 700, 600, IMG_COLOR_STYLED);
-imageline($im, 700, 600, 200, 100, IMG_COLOR_STYLED);
-
-$ex = imagecreatefrompng(__DIR__ . '/bug43475.png');
-var_dump(calc_image_dissimilarity($ex, $im) < 1e-5);
-?>
--EXPECT--
-bool(true)
@@ -12,6 +12,8 @@ $white = imagecolorallocate($im, 255, 255, 255);
 imagefilledrectangle($im, 2, 2, 6, 6, $white);
 imagexbm($im, NULL);
 ?>
+--XFAIL--
+Padding is not implemented yet
 --EXPECT--
 #define image_width 9
 #define image_height 9
@@ -1,38 +0,0 @@
--TEST--
-Bug #64641 (imagefilledpolygon doesn't draw horizontal line)
--SKIPIF--
-<?php
-if (!extension_loaded('gd')) die("skip gd extension not available\n");
-?>
--FILE--
-<?php
-require_once __DIR__ . '/similarity.inc';
-
-$im = imagecreatetruecolor(640, 480);
-
-$points = array(
-	100, 100,
-	100, 200,
-	100, 300
-);
-imagefilledpolygon($im, $points, 3, 0xFFFF00);
-
-$points = array(
-	300, 200,
-	400, 200,
-	500, 200
-);
-imagefilledpolygon($im, $points, 3, 0xFFFF00);
-
-$ex = imagecreatefrompng(__DIR__ . '/bug64641.png');
-if (($diss = calc_image_dissimilarity($ex, $im)) < 1e-5) {
-	echo "IDENTICAL";
-} else {
-	echo "DISSIMILARITY: $diss";
-}
-imagedestroy($ex);
-
-imagedestroy($im);
-?>
--EXPECT--
-IDENTICAL
@@ -1,17 +0,0 @@
--TEST--
-Bug #19366 (gdimagefill() function crashes (fixed in bundled libgd))
--SKIPIF--
-<?php
-	if (!extension_loaded('gd')) die("skip gd extension not available\n");
-?>
--FILE--
-<?php
-$img = imagecreatetruecolor(100, 100);
-imagecolortransparent($img, -1000000);
-imagetruecolortopalette($img, TRUE, 3);
-imagecolortransparent($img, 9);
-echo "OK";
-?>
--EXPECT--
-OK
-
@@ -1,18 +0,0 @@
--TEST--
-Bug #72512 gdImageTrueColorToPaletteBody allows arbitrary write/read access, var 0
--SKIPIF--
-<?php
-	if (!extension_loaded('gd')) die("skip gd extension not available\n");
-?>
--FILE--
-<?php
-
-$img = imagecreatetruecolor(13, 1007);
-
-imagecolortransparent($img, -10066304);
-imagetruecolortopalette($img, TRUE, 3);
-imagescale($img, 1, 65535);
-?>
-==DONE==
--EXPECT--
-==DONE==
@@ -1,18 +0,0 @@
--TEST--
-Bug #72512 gdImageTrueColorToPaletteBody allows arbitrary write/read access, var 1
--SKIPIF--
-<?php
-	if (!extension_loaded('gd')) die("skip gd extension not available\n");
-?>
--FILE--
-<?php
-
-$img = imagecreatetruecolor(100, 100);
-imagecolortransparent($img, -1000000);
-imagetruecolortopalette($img, TRUE, 3);
-imagecolortransparent($img, 9);
-
-?>
-==DONE==
--EXPECT--
-==DONE==
@@ -26,5 +26,5 @@ var_dump(md5(base64_encode($imgsrc)));
 var_dump($corA);
 ?>
 --EXPECT--
-string(32) "2a6424e4cb4e1b7391dfff74bf136bde"
+string(32) "b856a0b1a15efe0f79551ebbb5651fe8"
 int(842163455)
@@ -25,4 +25,4 @@ ob_end_clean();
 echo md5(base64_encode($img));
 ?>
 --EXPECT--
-beffeaf5231adaaff1f21a2108fb6f7e
+894f394c7f2e2364642ef27fea6bfc33
@@ -25,4 +25,4 @@ ob_end_clean();
 echo md5(base64_encode($img));
 ?>
 --EXPECT--
-b467492b806001c3720b3f18cfbde5b0
+b77bbb8207e5adbebfcc8bd1c4074305
@@ -25,4 +25,4 @@ ob_end_clean();
 echo md5(base64_encode($img));
 ?>
 --EXPECT--
-cfad369fc6d863785d3c95b4b4788225
+b8b572812b3c85678f6c38c4ecca7619
@@ -29,4 +29,4 @@ if ($gamma){
 echo md5(base64_encode($img));
 ?>
 --EXPECT--
-e79553115df689ea5df18a4636380569
+30639772903913594bc665743e1b9ab8
@@ -29,4 +29,4 @@ if ($gamma){
 echo md5(base64_encode($img));
 ?>
 --EXPECT--
-b017b1ddc8bda00e82aa8cbfb54c35d4
+7716c0905ae08bd84b4d6cba8969a42e
@@ -28,4 +28,4 @@ echo md5(base64_encode($img));
 ?>
 --EXPECT--
 bool(true)
-1d41787ff70aa0c7eea5ee9304afa36b
+0843f63ab2f9fddedd69b0b421686bc5
@@ -1591,24 +1591,6 @@ PHP_FUNCTION(locale_accept_from_http)
 		"locale_accept_from_http: unable to parse input parameters", 0 TSRMLS_CC );
 		RETURN_FALSE;
 	}
-	if(http_accept_len > ULOC_FULLNAME_CAPACITY) {
-		/* check each fragment, if any bigger than capacity, can't do it due to bug #72533 */
-		char *start = http_accept;
-		char *end;
-		size_t len;
-		do {
-			end = strchr(start, ',');
-			len = end ? end-start : http_accept_len-(start-http_accept);
-			if(len > ULOC_FULLNAME_CAPACITY) {
-				intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR,
-						"locale_accept_from_http: locale string too long", 0 TSRMLS_CC );
-				RETURN_FALSE;
-			}
-			if(end) {
-				start = end+1;
-			}
-		} while(end != NULL);
-	}

 	available = ures_openAvailableLocales(NULL, &status);
 	INTL_CHECK_STATUS(status, "locale_accept_from_http: failed to retrieve locale list");
@@ -1,30 +0,0 @@
--TEST--
-Bug #72533 (locale_accept_from_http out-of-bounds access)
--SKIPIF--
-<?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?>
--FILE--
-<?php
-
-function ut_main()
-{
-    $ret = var_export(ut_loc_accept_http(str_repeat('x', 256)), true);
-    $ret .= "\n";
-	if(intl_is_failure(intl_get_error_code())) {
-		$ret .= var_export(intl_get_error_message(), true);
-	}
-    $ret .= "\n";
-    $ret .= var_export(ut_loc_accept_http(str_repeat('en,', 256)), true);
-    $ret .= "\n";
-	if(intl_is_failure(intl_get_error_code())) {
-		$ret .= var_export(intl_get_error_message(), true);
-	}
-    return $ret;
-}
-
-include_once( 'ut_common.inc' );
-ut_run();
-?>
--EXPECTF--
-false
-'locale_accept_from_http: locale string too long: U_ILLEGAL_ARGUMENT_ERROR'
-'en'
@@ -1544,5 +1544,3 @@ xmlXPtrNewRangePointNode
 xmlXPtrNewRangePoints
 xmlXPtrRangeToFunction
 xmlXPtrWrapLocationSet
-xmlBufContent
-xmlBufUse
@@ -967,22 +967,6 @@ static void php_openssl_dispose_config(struct php_x509_request * req TSRMLS_DC)
 }
 /* }}} */

-#ifdef PHP_WIN32
-#define PHP_OPENSSL_RAND_ADD_TIME() ((void) 0)
-#else
-#define PHP_OPENSSL_RAND_ADD_TIME() php_openssl_rand_add_timeval()
-
-static inline void php_openssl_rand_add_timeval()  /* {{{ */
-{
-	struct timeval tv;
-
-	gettimeofday(&tv, NULL);
-	RAND_add(&tv, sizeof(tv), 0.0);
-}
-/* }}} */
-
-#endif
-
 static int php_openssl_load_rand_file(const char * file, int *egdsocket, int *seeded TSRMLS_DC) /* {{{ */
 {
 	char buffer[MAXPATHLEN];
@@ -1026,7 +1010,6 @@ static int php_openssl_write_rand_file(const char * file, int egdsocket, int see
 	if (file == NULL) {
 		file = RAND_file_name(buffer, sizeof(buffer));
 	}
-	PHP_OPENSSL_RAND_ADD_TIME();
 	if (file == NULL || !RAND_write_file(file)) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "unable to write random state");
 		return FAILURE;
@@ -3416,14 +3399,12 @@ static EVP_PKEY * php_openssl_generate_private_key(struct php_x509_request * req
 	if ((req->priv_key = EVP_PKEY_new()) != NULL) {
 		switch(req->priv_key_type) {
 			case OPENSSL_KEYTYPE_RSA:
-				PHP_OPENSSL_RAND_ADD_TIME();
 				if (EVP_PKEY_assign_RSA(req->priv_key, RSA_generate_key(req->priv_key_bits, 0x10001, NULL, NULL))) {
 					return_val = req->priv_key;
 				}
 				break;
 #if !defined(NO_DSA) && defined(HAVE_DSA_DEFAULT_METHOD)
 			case OPENSSL_KEYTYPE_DSA:
-				PHP_OPENSSL_RAND_ADD_TIME();
 				{
 					DSA *dsapar = DSA_generate_parameters(req->priv_key_bits, NULL, 0, NULL, NULL, NULL, NULL);
 					if (dsapar) {
@@ -3441,7 +3422,6 @@ static EVP_PKEY * php_openssl_generate_private_key(struct php_x509_request * req
 #endif
 #if !defined(NO_DH)
 			case OPENSSL_KEYTYPE_DH:
-				PHP_OPENSSL_RAND_ADD_TIME();
 				{
 					DH *dhpar = DH_generate_parameters(req->priv_key_bits, 2, NULL, NULL);
 					int codes = 0;
@@ -3551,46 +3531,6 @@ static int php_openssl_is_private_key(EVP_PKEY* pkey TSRMLS_DC)
 	    }                                                               \
 	} while (0);

-/* {{{ php_openssl_pkey_init_dsa */
-zend_bool php_openssl_pkey_init_dsa(DSA *dsa)
-{
-	if (!dsa->p || !dsa->q || !dsa->g) {
-		return 0;
-	}
-	if (dsa->priv_key || dsa->pub_key) {
-		return 1;
-	}
-	PHP_OPENSSL_RAND_ADD_TIME();
-	if (!DSA_generate_key(dsa)) {
-		return 0;
-	}
-	/* if BN_mod_exp return -1, then DSA_generate_key succeed for failed key
-	 * so we need to double check that public key is created */
-	if (!dsa->pub_key || BN_is_zero(dsa->pub_key)) {
-		return 0;
-	}
-	/* all good */
-	return 1;
-}
-/* }}} */
-
-/* {{{ php_openssl_pkey_init_dh */
-zend_bool php_openssl_pkey_init_dh(DH *dh)
-{
-	if (!dh->p || !dh->g) {
-		return 0;
-	}
-	if (dh->pub_key) {
-		return 1;
-	}
-	PHP_OPENSSL_RAND_ADD_TIME();
-	if (!DH_generate_key(dh)) {
-		return 0;
-	}
-	/* all good */
-	return 1;
-}
-/* }}} */

 /* {{{ proto resource openssl_pkey_new([array configargs])
   Generates a new private key */
@@ -3643,7 +3583,10 @@ PHP_FUNCTION(openssl_pkey_new)
 					OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), dsa, g);
 					OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), dsa, priv_key);
 					OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), dsa, pub_key);
-					if (php_openssl_pkey_init_dsa(dsa)) {
+					if (dsa->p && dsa->q && dsa->g) {
+						if (!dsa->priv_key && !dsa->pub_key) {
+							DSA_generate_key(dsa);
+						}
 						if (EVP_PKEY_assign_DSA(pkey, dsa)) {
 							RETURN_RESOURCE(zend_list_insert(pkey, le_key TSRMLS_CC));
 						}
@@ -3663,10 +3606,10 @@ PHP_FUNCTION(openssl_pkey_new)
 					OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), dh, g);
 					OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), dh, priv_key);
 					OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), dh, pub_key);
-					if (php_openssl_pkey_init_dh(dh)) {
-						if (EVP_PKEY_assign_DH(pkey, dh)) {
-							RETURN_RESOURCE(zend_list_insert(pkey, le_key TSRMLS_CC));
-						}
+					if (dh->p && dh->g &&
+							(dh->pub_key || DH_generate_key(dh)) &&
+							EVP_PKEY_assign_DH(pkey, dh)) {
+						RETURN_RESOURCE(zend_list_insert(pkey, le_key TSRMLS_CC));
 					}
 					DH_free(dh);
 				}
@@ -5483,7 +5426,6 @@ PHP_FUNCTION(openssl_random_pseudo_bytes)
 		RETURN_FALSE;
 	}
 #else
-	PHP_OPENSSL_RAND_ADD_TIME();
 	if (RAND_bytes(buffer, buffer_length) <= 0) {
 		efree(buffer);
 		if (zstrong_result_returned) {
@@ -16,14 +16,14 @@ $dh = openssl_pkey_new(array( 'dh'=> array( 'p' => hex2bin($phex), 'g' => '2' ))
 $details = openssl_pkey_get_details($dh);
 var_dump(bin2hex($details['dh']['p']));
 var_dump($details['dh']['g']);
-var_dump(strlen($details['dh']['pub_key']) > 0);
-var_dump(strlen($details['dh']['priv_key']) > 0);
+var_dump(strlen($details['dh']['pub_key']));
+var_dump(strlen($details['dh']['priv_key']));
 echo "Done";
 ?>
 --EXPECT--
 bool(false)
 string(256) "dcf93a0b883972ec0e19989ac5a2ce310e1d37717e8d9571bb7623731866e61ef75a2e27898b057f9891c2e27a639c3f29b60814581cd3b2ca3986d2683705577d45c2e7e52dc81c7a171876e5cea74b1448bfdfaf18828efd2519f14e45e3826634af1949e5b535cc829a483b8a76223e5d490a257f05bdff16f2fb22c583ab"
 string(1) "2"
-bool(true)
-bool(true)
+int(128)
+int(128)
 Done
@@ -1,24 +0,0 @@
--TEST--
-Bug #72336 (openssl_pkey_new does not fail for invalid DSA params)
--SKIPIF--
-<?php if (!extension_loaded("openssl")) print "skip"; ?>
--FILE--
-<?php
-$p = '00f8000ae45b2dacb47dd977d58b719d097bdf07cb2c17660ad898518c08' .
-        '1a61659a16daadfaa406a0a994c743df5eda07e36bd0adcad921b77432ff' .
-        '24ccc31e782d647e66768122b578857e9293df78387dc8b44af2a4a3f305' .
-        '1f236b1000a3e31da489c6681b0031f7ec37c2e1091bdb698e7660f135b6' .
-        '996def90090303b7ad';
-
-$q = '009b3734fc9f7a4a9d6437ec314e0a78c2889af64b';
-
-$g = '00b320300a0bc55b8f0ec6edc218e2185250f38fbb8291db8a89227f6e41' .
-        '00d47d6ccb9c7d42fc43280ecc2ed386e81ff65bc5d6a2ae78db7372f5dc' .
-        'f780f4558e7ed3dd0c96a1b40727ac56c5165aed700a3b63997893a1fb21' .
-        '4e882221f0dd9604820dc34e2725dd6901c93e0ca56f6d76d495c332edc5' .
-        'b81747c4c447a941f3';
-
-var_dump(openssl_pkey_new(array('dsa' => array('p' => $p, 'q' => $q, 'g' => $g))));
-?>
--EXPECT--
-bool(false)
@@ -1,37 +1,16 @@
 --TEST--
 openssl_error_string() tests
 --SKIPIF--
-<?php if (!extension_loaded("openssl")) print "skip"; ?>
+<?php
+if (!extension_loaded("openssl")) print "skip";
+//if (OPENSSL_VERSION_NUMBER < 0x10001001) die("skip OpenSSLv1.0.1 required");
+?>
+--XFAIL--
+ot ready baked yet, fails different ways on different envs
 --FILE--
 <?php
-// helper function to check openssl errors
-function expect_openssl_errors($name, $expected_error_codes) {
-	$expected_errors = array_fill_keys($expected_error_codes, false);
-	while (($error_string = openssl_error_string()) !== false) {
-		if (strlen($error_string) > 14) {
-			$error_code = substr($error_string, 6, 8);
-			if (isset($expected_errors[$error_code])) {
-				$expected_errors[$error_code] = true;
-			}
-		}
-	}
-
-	$fail = false;
-	foreach ($expected_errors as $error_code => $error_code_found) {
-		if (!$error_code_found) {
-			$fail = true;
-			echo "$name: no error code $error_code\n";
-		}
-	}
-
-	if (!$fail) {
-		echo "$name: ok\n";
-	}
-}
-
-// helper for debugging errors
-function dump_openssl_errors($name) {
-	echo "\n$name\n";
+// helper function to dump openssl errors
+function dump_openssl_errors() {
 	while (($error_string = openssl_error_string()) !== false) {
 		var_dump($error_string);
 	}
@@ -77,59 +56,61 @@ while (($enc_error_new = openssl_error_string()) !== false) {
 	++$error_queue_size;
 }
 var_dump($error_queue_size);
-echo "\n";

 // PKEY
 echo "PKEY errors\n";
 // file for pkey (file:///) fails when opennig (BIO_new_file)
-@openssl_pkey_export_to_file("file://" . $invalid_file_for_read, $output_file);
-expect_openssl_errors('openssl_pkey_export_to_file opening', ['02001002', '2006D080']);
+openssl_pkey_export_to_file("file://" . $invalid_file_for_read, $output_file);
+dump_openssl_errors();
 // file or private pkey is not correct PEM - failing PEM_read_bio_PrivateKey
-@openssl_pkey_export_to_file($csr_file, $output_file);
-expect_openssl_errors('openssl_pkey_export_to_file pem', ['0906D06C']);
+openssl_pkey_export_to_file($csr_file, $output_file);
+dump_openssl_errors();
 // file to export cannot be written
-@openssl_pkey_export_to_file($private_key_file, $invalid_file_for_write);
-expect_openssl_errors('openssl_pkey_export_to_file write', ['2006D002', '09072007']);
+openssl_pkey_export_to_file($private_key_file, $invalid_file_for_write);
+dump_openssl_errors();
 // succesful export
-@openssl_pkey_export($private_key_file_with_pass, $out, 'wrong pwd');
-expect_openssl_errors('openssl_pkey_export', ['06065064', '0906A065']);
+openssl_pkey_export($private_key_file_with_pass, $out, 'wrong pwd');
+dump_openssl_errors();
 // invalid x509 for getting public key
-@openssl_pkey_get_public($private_key_file);
-expect_openssl_errors('openssl_pkey_get_public', ['0906D06C']);
+openssl_pkey_get_public($private_key_file);
+dump_openssl_errors();
 // private encrypt with unknown padding
-@openssl_private_encrypt("data", $crypted, $private_key_file, 1000);
-expect_openssl_errors('openssl_private_encrypt', ['04066076']);
+openssl_private_encrypt("data", $crypted, $private_key_file, 1000);
+dump_openssl_errors();
 // private decrypt with failed padding check
-@openssl_private_decrypt("data", $crypted, $private_key_file);
-expect_openssl_errors('openssl_private_decrypt', ['04065072']);
+openssl_private_decrypt("data", $crypted, $private_key_file);
+dump_openssl_errors();
 // public encrypt and decrypt with failed padding check and padding
-@openssl_public_encrypt("data", $crypted, $public_key_file, 1000);
-@openssl_public_decrypt("data", $crypted, $public_key_file);
-expect_openssl_errors('openssl_private_(en|de)crypt padding', ['0906D06C', '04068076', '0407006A', '04067072']);
+openssl_public_encrypt("data", $crypted, $public_key_file, 1000);
+openssl_public_decrypt("data", $crypted, $public_key_file);
+dump_openssl_errors();

 // X509
 echo "X509 errors\n";
 // file for x509 (file:///) fails when opennig (BIO_new_file)
-@openssl_x509_export_to_file("file://" . $invalid_file_for_read, $output_file);
-expect_openssl_errors('openssl_x509_export_to_file open', ['02001002']);
+openssl_x509_export_to_file("file://" . $invalid_file_for_read, $output_file);
+dump_openssl_errors();
 // file or str cert is not correct PEM - failing PEM_read_bio_X509 or PEM_ASN1_read_bio
-@openssl_x509_export_to_file($csr_file, $output_file);
-expect_openssl_errors('openssl_x509_export_to_file pem', ['0906D06C']);
+openssl_x509_export_to_file($csr_file, $output_file);
+dump_openssl_errors();
 // file to export cannot be written
-@openssl_x509_export_to_file($crt_file, $invalid_file_for_write);
-expect_openssl_errors('openssl_x509_export_to_file write', ['2006D002']);
+openssl_x509_export_to_file($crt_file, $invalid_file_for_write);
+dump_openssl_errors();
 // checking purpose fails because there is no such purpose 1000
-@openssl_x509_checkpurpose($crt_file, 1000);
-expect_openssl_errors('openssl_x509_checkpurpose purpose', ['0B086079']);
+openssl_x509_checkpurpose($crt_file, 1000);
+dump_openssl_errors();
+// make sure that X509_STORE_add_lookup will not emmit any error (just PHP warning)
+openssl_x509_checkpurpose($crt_file, X509_PURPOSE_SSL_CLIENT, array( __DIR__ . "/cert.csr"));
+dump_openssl_errors();

 // CSR
 echo "CSR errors\n";
 // file for csr (file:///) fails when opennig (BIO_new_file)
-@openssl_csr_get_subject("file://" . $invalid_file_for_read);
-expect_openssl_errors('openssl_csr_get_subject open', ['02001002', '2006D080', '20068079', '0906D06C']);
+openssl_csr_get_subject("file://" . $invalid_file_for_read);
+dump_openssl_errors();
 // file or str csr is not correct PEM - failing PEM_read_bio_X509_REQ
-@openssl_csr_get_subject($crt_file);
-expect_openssl_errors('openssl_csr_get_subjec pem', ['0906D06C']);
+openssl_csr_get_subject($crt_file);
+dump_openssl_errors();

 // other possible cuases that are difficult to catch:
 // - ASN1_STRING_to_UTF8 fails in add_assoc_name_entry
@@ -143,25 +124,59 @@ if (is_file($output_file)) {
 	unlink($output_file);
 }
 ?>
--EXPECT--
+--EXPECTF--
 string(89) "error:0607A082:digital envelope routines:EVP_CIPHER_CTX_set_key_length:invalid key length"
 bool(false)
 int(15)
-
 PKEY errors
-openssl_pkey_export_to_file opening: ok
-openssl_pkey_export_to_file pem: ok
-openssl_pkey_export_to_file write: ok
-openssl_pkey_export: ok
-openssl_pkey_get_public: ok
-openssl_private_encrypt: ok
-openssl_private_decrypt: ok
-openssl_private_(en|de)crypt padding: ok
+
+Warning: openssl_pkey_export_to_file(): cannot get key from parameter 1 in %s on line %d
+string(61) "error:02001002:system library:fopen:No such file or directory"
+string(53) "error:2006D080:BIO routines:BIO_new_file:no such file"
+
+Warning: openssl_pkey_export_to_file(): cannot get key from parameter 1 in %s on line %d
+string(54) "error:0906D06C:PEM routines:PEM_read_bio:no start line"
+string(68) "error:0E06D06C:configuration file routines:NCONF_get_string:no value"
+string(68) "error:0E06D06C:configuration file routines:NCONF_get_string:no value"
+string(68) "error:0E06D06C:configuration file routines:NCONF_get_string:no value"
+string(68) "error:0E06D06C:configuration file routines:NCONF_get_string:no value"
+string(68) "error:0E06D06C:configuration file routines:NCONF_get_string:no value"
+string(68) "error:0E06D06C:configuration file routines:NCONF_get_string:no value"
+string(50) "error:02001015:system library:fopen:Is a directory"
+string(51) "error:2006D002:BIO routines:BIO_new_file:system lib"
+string(49) "error:09072007:PEM routines:PEM_write_bio:BUF lib"
+
+Warning: openssl_pkey_export(): cannot get key from parameter 1 in %s on line %d
+string(72) "error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt"
+string(53) "error:0906A065:PEM routines:PEM_do_header:bad decrypt"
+string(54) "error:0906D06C:PEM routines:PEM_read_bio:no start line"
+string(54) "error:0906D06C:PEM routines:PEM_read_bio:no start line"
+string(72) "error:04066076:rsa routines:RSA_EAY_PRIVATE_ENCRYPT:unknown padding type"
+string(78) "error:0407109F:rsa routines:RSA_padding_check_PKCS1_type_2:pkcs decoding error"
+string(72) "error:04065072:rsa routines:RSA_EAY_PRIVATE_DECRYPT:padding check failed"
+string(54) "error:0906D06C:PEM routines:PEM_read_bio:no start line"
+string(71) "error:04068076:rsa routines:RSA_EAY_PUBLIC_ENCRYPT:unknown padding type"
+string(54) "error:0906D06C:PEM routines:PEM_read_bio:no start line"
+string(79) "error:0407006A:rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01"
+string(71) "error:04067072:rsa routines:RSA_EAY_PUBLIC_DECRYPT:padding check failed"
 X509 errors
-openssl_x509_export_to_file open: ok
-openssl_x509_export_to_file pem: ok
-openssl_x509_export_to_file write: ok
-openssl_x509_checkpurpose purpose: ok
+
+Warning: openssl_x509_export_to_file(): cannot get cert from parameter 1 in %s on line %d
+string(61) "error:02001002:system library:fopen:No such file or directory"
+string(53) "error:2006D080:BIO routines:BIO_new_file:no such file"
+
+Warning: openssl_x509_export_to_file(): cannot get cert from parameter 1 in %s on line %d
+string(54) "error:0906D06C:PEM routines:PEM_read_bio:no start line"
+
+Warning: openssl_x509_export_to_file(): error opening file %s in %s on line %d
+string(50) "error:02001015:system library:fopen:Is a directory"
+string(51) "error:2006D002:BIO routines:BIO_new_file:system lib"
+string(90) "error:0B086079:x509 certificate routines:X509_STORE_CTX_purpose_inherit:unknown purpose id"
+
+Warning: openssl_x509_checkpurpose(): error loading file %s in %s on line %d
 CSR errors
-openssl_csr_get_subject open: ok
-openssl_csr_get_subjec pem: ok
+string(61) "error:02001002:system library:fopen:No such file or directory"
+string(53) "error:2006D080:BIO routines:BIO_new_file:no such file"
+string(55) "error:20068079:BIO routines:BIO_gets:unsupported method"
+string(54) "error:0906D06C:PEM routines:PEM_read_bio:no start line"
+string(54) "error:0906D06C:PEM routines:PEM_read_bio:no start line"
@@ -4,7 +4,7 @@ if [[ "$2" = "" ]] || [[ "$3" = "" ]]; then
       echo "Usage: $0 BASE_DIRECTORY DEPTH HASH_BITS"
       echo "BASE_DIRECTORY will be created if it doesn't exist"
       echo "DEPTH must be an integer number >0"
-       echo "HASH_BITS(session.hash_bits_per_character) should be one of 4, 5, or 6"
+       echo "HASH_BITS(session.hash_bits_per_charactor) should be one of 4, 5, or 6"
       exit 1
 fi

@@ -867,7 +867,7 @@ PS_SERIALIZER_DECODE_FUNC(php_serialize) /* {{{ */
 	if (php_var_unserialize(&session_vars, &val, endptr, &var_hash TSRMLS_CC)) {
 		var_push_dtor(&var_hash, &session_vars);
 	}
-
+	
 	PHP_VAR_UNSERIALIZE_DESTROY(var_hash);
 	if (PS(http_session_vars)) {
 		zval_ptr_dtor(&PS(http_session_vars));
@@ -932,7 +932,6 @@ PS_SERIALIZER_DECODE_FUNC(php_binary) /* {{{ */
 		namelen = ((unsigned char)(*p)) & (~PS_BIN_UNDEF);

 		if (namelen < 0 || namelen > PS_BIN_MAX || (p + namelen) >= endptr) {
-			PHP_VAR_UNSERIALIZE_DESTROY(var_hash);
 			return FAILURE;
 		}

@@ -1,44 +0,0 @@
--TEST--
-Bug #72562: Use After Free in unserialize() with Unexpected Session Deserialization
--SKIPIF--
-<?php include('skipif.inc'); ?>
--FILE--
-<?php
-
-ini_set('session.serialize_handler', 'php_binary');
-session_start();
-$sess = "\x1xi:1;\x2y";
-session_decode($sess);
-$uns_1 = '{';
-$out_1[] = unserialize($uns_1);
-unset($out_1);
-$fakezval = ptr2str(1122334455);
-$fakezval .= ptr2str(0);
-$fakezval .= "\x00\x00\x00\x00";
-$fakezval .= "\x01";
-$fakezval .= "\x00";
-$fakezval .= "\x00\x00";
-for ($i = 0; $i < 5; $i++) {
-  $v[$i] = $fakezval.$i;
-}
-$uns_2 = 'R:2;';
-$out_2 = unserialize($uns_2);
-var_dump($out_2);
-
-function ptr2str($ptr)
-{
-	$out = '';
-	for ($i = 0; $i < 8; $i++) {
-		$out .= chr($ptr & 0xff);
-		$ptr >>= 8;
-	}
-	return $out;
-}
-?>
--EXPECTF--
-Warning: session_decode(): Failed to decode session object. Session has been destroyed in %s/bug72562.php on line %d
-
-Notice: unserialize(): Error at offset 0 of 1 bytes in %s/bug72562.php on line %d
-
-Notice: unserialize(): Error at offset 4 of 4 bytes in %s/bug72562.php on line %d
-bool(false)
@@ -473,7 +473,7 @@ static void php_snmp_session_destructor(zend_rsrc_list_entry *rsrc TSRMLS_DC)
 static void php_snmp_object_free_storage(void *object TSRMLS_DC)
 {
 	php_snmp_object *intern = (php_snmp_object *)object;
-
+	
 	if (!intern) {
 		return;
 	}
@@ -481,7 +481,7 @@ static void php_snmp_object_free_storage(void *object TSRMLS_DC)
 	netsnmp_session_free(&(intern->session));

 	zend_object_std_dtor(&intern->zo TSRMLS_CC);
-
+	
 	efree(intern);
 }

@@ -501,7 +501,7 @@ static zend_object_value php_snmp_object_new(zend_class_entry *class_type TSRMLS
 	retval.handlers = (zend_object_handlers *) &php_snmp_object_handlers;

 	return retval;
-
+	
 }

 /* {{{ php_snmp_error
@@ -554,7 +554,7 @@ static void php_snmp_getvalue(struct variable_list *vars, zval *snmpval TSRMLS_D
 	char *dbuf = (char *)NULL;
 	int buflen = sizeof(sbuf) - 1;
 	int val_len = vars->val_len;
-
+	
 	/* use emalloc() for large values, use static array otherwize */

 	/* There is no way to know the size of buffer snprint_value() needs in order to print a value there.
@@ -700,7 +700,7 @@ static void php_snmp_getvalue(struct variable_list *vars, zval *snmpval TSRMLS_D
 * SNMP object fetcher/setter for all SNMP versions
 *
 */
-static void php_snmp_internal(INTERNAL_FUNCTION_PARAMETERS, int st,
+static void php_snmp_internal(INTERNAL_FUNCTION_PARAMETERS, int st, 
 							struct snmp_session *session,
 							struct objid_query *objid_query)
 {
@@ -719,7 +719,7 @@ static void php_snmp_internal(INTERNAL_FUNCTION_PARAMETERS, int st,

 	/* we start with retval=FALSE. If any actual data is acquired, retval will be set to appropriate type */
 	RETVAL_FALSE;
-
+	
 	/* reset errno and errstr */
 	php_snmp_error(getThis(), NULL TSRMLS_CC, PHP_SNMP_ERRNO_NOERROR, "");

@@ -803,8 +803,8 @@ retry:
 				}
 				for (vars = response->variables; vars; vars = vars->next_variable) {
 					/* do not output errors as values */
-					if ( 	vars->type == SNMP_ENDOFMIBVIEW ||
-						vars->type == SNMP_NOSUCHOBJECT ||
+					if ( 	vars->type == SNMP_ENDOFMIBVIEW || 
+						vars->type == SNMP_NOSUCHOBJECT || 
 						vars->type == SNMP_NOSUCHINSTANCE ) {
 						if ((st & SNMP_CMD_WALK) && Z_TYPE_P(return_value) == IS_ARRAY) {
 							break;
@@ -814,8 +814,8 @@ retry:
 						php_snmp_error(getThis(), NULL TSRMLS_CC, PHP_SNMP_ERRNO_ERROR_IN_REPLY, "Error in packet at '%s': %s", buf, buf2);
 						continue;
 					}
-
-					if ((st & SNMP_CMD_WALK) &&
+					
+					if ((st & SNMP_CMD_WALK) && 
 						(vars->name_length < rootlen || memcmp(root, vars->name, rootlen * sizeof(oid)))) { /* not part of this subtree */
 						if (Z_TYPE_P(return_value) == IS_ARRAY) { /* some records are fetched already, shut down further lookup */
 							keepwalking = 0;
@@ -1099,7 +1099,7 @@ static int php_snmp_parse_oid(zval *object, int st, struct objid_query *objid_qu
 				efree(objid_query->vars);
 				return FALSE;
 			}
-		} else {
+		} else { 
 			memmove((char *)objid_query->vars[0].name, (char *)objid_mib, sizeof(objid_mib));
 			objid_query->vars[0].name_length = sizeof(objid_mib) / sizeof(oid);
 		}
@@ -1435,7 +1435,7 @@ static void php_snmp(INTERNAL_FUNCTION_PARAMETERS, int st, int version)
 	int session_less_mode = (getThis() == NULL);
 	php_snmp_object *snmp_object;
 	php_snmp_object glob_snmp_object;
-
+	
 	objid_query.max_repetitions = -1;
 	objid_query.non_repeaters = 0;
 	objid_query.valueretrieval = SNMP_G(valueretrieval);
@@ -1548,7 +1548,7 @@ static void php_snmp(INTERNAL_FUNCTION_PARAMETERS, int st, int version)
 	}

 	php_snmp_internal(INTERNAL_FUNCTION_PARAM_PASSTHRU, st, session, &objid_query);
-
+	
 	efree(objid_query.vars);

 	if (session_less_mode) {
@@ -1561,7 +1561,7 @@ static void php_snmp(INTERNAL_FUNCTION_PARAMETERS, int st, int version)
 }
 /* }}} */

-/* {{{ proto mixed snmpget(string host, string community, mixed object_id [, int timeout [, int retries]])
+/* {{{ proto mixed snmpget(string host, string community, mixed object_id [, int timeout [, int retries]]) 
   Fetch a SNMP object */
 PHP_FUNCTION(snmpget)
 {
@@ -1569,7 +1569,7 @@ PHP_FUNCTION(snmpget)
 }
 /* }}} */

-/* {{{ proto mixed snmpgetnext(string host, string community, mixed object_id [, int timeout [, int retries]])
+/* {{{ proto mixed snmpgetnext(string host, string community, mixed object_id [, int timeout [, int retries]]) 
   Fetch a SNMP object */
 PHP_FUNCTION(snmpgetnext)
 {
@@ -1577,7 +1577,7 @@ PHP_FUNCTION(snmpgetnext)
 }
 /* }}} */

-/* {{{ proto mixed snmpwalk(string host, string community, mixed object_id [, int timeout [, int retries]])
+/* {{{ proto mixed snmpwalk(string host, string community, mixed object_id [, int timeout [, int retries]]) 
   Return all objects under the specified object id */
 PHP_FUNCTION(snmpwalk)
 {
@@ -1593,7 +1593,7 @@ PHP_FUNCTION(snmprealwalk)
 }
 /* }}} */

-/* {{{ proto bool snmpset(string host, string community, mixed object_id, mixed type, mixed value [, int timeout [, int retries]])
+/* {{{ proto bool snmpset(string host, string community, mixed object_id, mixed type, mixed value [, int timeout [, int retries]]) 
   Set the value of a SNMP object */
 PHP_FUNCTION(snmpset)
 {
@@ -1640,7 +1640,7 @@ PHP_FUNCTION(snmp_set_enum_print)

 	netsnmp_ds_set_boolean(NETSNMP_DS_LIBRARY_ID, NETSNMP_DS_LIB_PRINT_NUMERIC_ENUM, (int) a1);
 	RETURN_TRUE;
-}
+} 
 /* }}} */

 /* {{{ proto bool snmp_set_oid_output_format(int oid_format)
@@ -1668,10 +1668,10 @@ PHP_FUNCTION(snmp_set_oid_output_format)
 			RETURN_FALSE;
 			break;
 	}
-}
+} 
 /* }}} */

-/* {{{ proto mixed snmp2_get(string host, string community, mixed object_id [, int timeout [, int retries]])
+/* {{{ proto mixed snmp2_get(string host, string community, mixed object_id [, int timeout [, int retries]]) 
   Fetch a SNMP object */
 PHP_FUNCTION(snmp2_get)
 {
@@ -1679,7 +1679,7 @@ PHP_FUNCTION(snmp2_get)
 }
 /* }}} */

-/* {{{ proto mixed snmp2_getnext(string host, string community, mixed object_id [, int timeout [, int retries]])
+/* {{{ proto mixed snmp2_getnext(string host, string community, mixed object_id [, int timeout [, int retries]]) 
   Fetch a SNMP object */
 PHP_FUNCTION(snmp2_getnext)
 {
@@ -1687,7 +1687,7 @@ PHP_FUNCTION(snmp2_getnext)
 }
 /* }}} */

-/* {{{ proto mixed snmp2_walk(string host, string community, mixed object_id [, int timeout [, int retries]])
+/* {{{ proto mixed snmp2_walk(string host, string community, mixed object_id [, int timeout [, int retries]]) 
   Return all objects under the specified object id */
 PHP_FUNCTION(snmp2_walk)
 {
@@ -1703,7 +1703,7 @@ PHP_FUNCTION(snmp2_real_walk)
 }
 /* }}} */

-/* {{{ proto bool snmp2_set(string host, string community, mixed object_id, mixed type, mixed value [, int timeout [, int retries]])
+/* {{{ proto bool snmp2_set(string host, string community, mixed object_id, mixed type, mixed value [, int timeout [, int retries]]) 
   Set the value of a SNMP object */
 PHP_FUNCTION(snmp2_set)
 {
@@ -1819,7 +1819,7 @@ PHP_METHOD(snmp, __construct)

 	snmp_object = (php_snmp_object *)zend_object_store_get_object(object TSRMLS_CC);
 	zend_replace_error_handling(EH_THROW, NULL, &error_handling TSRMLS_CC);
-
+	
 	if (zend_parse_parameters(argc TSRMLS_CC, "lss|ll", &version, &a1, &a1_len, &a2, &a2_len, &timeout, &retries) == FAILURE) {
 		zend_restore_error_handling(&error_handling TSRMLS_CC);
 		return;
@@ -1841,7 +1841,7 @@ PHP_METHOD(snmp, __construct)
 	if (snmp_object->session) {
 		netsnmp_session_free(&(snmp_object->session));
 	}
-
+	
 	if (netsnmp_session_init(&(snmp_object->session), version, a1, a2, timeout, retries TSRMLS_CC)) {
 		return;
 	}
@@ -1855,7 +1855,7 @@ PHP_METHOD(snmp, __construct)
 }
 /* }}} */

-/* {{{ proto bool SNMP::close()
+/* {{{ proto bool SNMP::close() 
 	Close SNMP session */
 PHP_METHOD(snmp, close)
 {
@@ -1898,7 +1898,7 @@ PHP_METHOD(snmp, walk)
 }
 /* }}} */

-/* {{{ proto bool SNMP::set(mixed object_id, mixed type, mixed value)
+/* {{{ proto bool SNMP::set(mixed object_id, mixed type, mixed value) 
   Set the value of a SNMP object */
 PHP_METHOD(snmp, set)
 {
@@ -1916,7 +1916,7 @@ PHP_METHOD(snmp, setSecurity)
 	int argc = ZEND_NUM_ARGS();

 	snmp_object = (php_snmp_object *)zend_object_store_get_object(object TSRMLS_CC);
-
+	
 	if (zend_parse_parameters(argc TSRMLS_CC, "s|ssssss", &a1, &a1_len, &a2, &a2_len, &a3, &a3_len,
 		&a4, &a4_len, &a5, &a5_len, &a6, &a6_len, &a7, &a7_len) == FAILURE) {
 		RETURN_FALSE;
@@ -1930,7 +1930,7 @@ PHP_METHOD(snmp, setSecurity)
 }
 /* }}} */

-/* {{{ proto long SNMP::getErrno()
+/* {{{ proto long SNMP::getErrno() 
 	Get last error code number */
 PHP_METHOD(snmp, getErrno)
 {
@@ -1944,7 +1944,7 @@ PHP_METHOD(snmp, getErrno)
 }
 /* }}} */

-/* {{{ proto long SNMP::getError()
+/* {{{ proto long SNMP::getError() 
 	Get last error message */
 PHP_METHOD(snmp, getError)
 {
@@ -2093,14 +2093,6 @@ static int php_snmp_has_property(zval *object, zval *member, int has_set_exists,
 }
 /* }}} */

-static HashTable *php_snmp_get_gc(zval *object, zval ***gc_data, int *gc_data_count TSRMLS_DC) /* {{{ */
-{
-	*gc_data = NULL;
-	*gc_data_count = 0;
-	return zend_std_get_properties(object TSRMLS_CC);
-}
-/* }}} */
-
 /* {{{ php_snmp_get_properties(zval *object)
   Returns all object properties. Injects SNMP properties into object on first call */
 static HashTable *php_snmp_get_properties(zval *object TSRMLS_DC)
@@ -2143,23 +2135,23 @@ static int php_snmp_read_info(php_snmp_object *snmp_object, zval **retval TSRMLS
 	if (snmp_object->session == NULL) {
 		return SUCCESS;
 	}
-
+		
 	MAKE_STD_ZVAL(val);
 	ZVAL_STRINGL(val, snmp_object->session->peername, strlen(snmp_object->session->peername), 1);
 	add_assoc_zval(*retval, "hostname", val);
-
+	
 	MAKE_STD_ZVAL(val);
 	ZVAL_LONG(val, snmp_object->session->remote_port);
 	add_assoc_zval(*retval, "port", val);
-
+	
 	MAKE_STD_ZVAL(val);
 	ZVAL_LONG(val, snmp_object->session->timeout);
 	add_assoc_zval(*retval, "timeout", val);
-
+	
 	MAKE_STD_ZVAL(val);
 	ZVAL_LONG(val, snmp_object->session->retries);
 	add_assoc_zval(*retval, "retries", val);
-
+	
 	return SUCCESS;
 }
 /* }}} */
@@ -2232,7 +2224,7 @@ static int php_snmp_write_max_oids(php_snmp_object *snmp_object, zval *newval TS
 	} else {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "max_oids should be positive integer or NULL, got %ld", Z_LVAL_P(newval));
 	}
-
+	
 	if (newval == &ztmp) {
 		zval_dtor(newval);
 	}
@@ -2260,7 +2252,7 @@ static int php_snmp_write_valueretrieval(php_snmp_object *snmp_object, zval *new
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unknown SNMP value retrieval method '%ld'", Z_LVAL_P(newval));
 		ret = FAILURE;
 	}
-
+	
 	if (newval == &ztmp) {
 		zval_dtor(newval);
 	}
@@ -2303,7 +2295,7 @@ static int php_snmp_write_oid_output_format(php_snmp_object *snmp_object, zval *
 		convert_to_long(&ztmp);
 		newval = &ztmp;
 	}
-
+	
 	switch(Z_LVAL_P(newval)) {
 		case NETSNMP_OID_OUTPUT_SUFFIX:
 		case NETSNMP_OID_OUTPUT_MODULE:
@@ -2338,7 +2330,7 @@ static int php_snmp_write_exceptions_enabled(php_snmp_object *snmp_object, zval
 		newval = &ztmp;
 	}

-	snmp_object->exceptions_enabled = Z_LVAL_P(newval);
+	snmp_object->exceptions_enabled = Z_LVAL_P(newval);	

 	if (newval == &ztmp) {
 		zval_dtor(newval);
@@ -2407,7 +2399,6 @@ PHP_MINIT_FUNCTION(snmp)
 	php_snmp_object_handlers.write_property = php_snmp_write_property;
 	php_snmp_object_handlers.has_property = php_snmp_has_property;
 	php_snmp_object_handlers.get_properties = php_snmp_get_properties;
-	php_snmp_object_handlers.get_gc = php_snmp_get_gc;

 	/* Register SNMP Class */
 	INIT_CLASS_ENTRY(ce, "SNMP", php_snmp_class_methods);
@@ -2474,7 +2465,7 @@ PHP_MINIT_FUNCTION(snmp)
 PHP_MSHUTDOWN_FUNCTION(snmp)
 {
 	snmp_shutdown("snmpapp");
-
+	
 	zend_hash_destroy(&php_snmp_properties);

 	return SUCCESS;
@@ -1,35 +0,0 @@
--TEST--                                 
-Bug #72479: Use After Free Vulnerability in SNMP with GC and unserialize()
--SKIPIF--
-<?php
-require_once(dirname(__FILE__).'/skipif.inc');
-?>
--FILE--
-<?php
-$arr = [1, [1, 2, 3, 4, 5], 3, 4, 5];
-$poc = 'a:3:{i:1;N;i:2;O:4:"snmp":1:{s:11:"quick_print";'.serialize($arr).'}i:1;R:7;}';
-$out = unserialize($poc);
-gc_collect_cycles();
-$fakezval = ptr2str(1122334455);
-$fakezval .= ptr2str(0);
-$fakezval .= "\x00\x00\x00\x00";
-$fakezval .= "\x01";
-$fakezval .= "\x00";
-$fakezval .= "\x00\x00";
-for ($i = 0; $i < 5; $i++) {
-    $v[$i] = $fakezval.$i;
-}
-var_dump($out[1]);
-
-function ptr2str($ptr)
-{
-    $out = '';
-    for ($i = 0; $i < 8; $i++) {
-        $out .= chr($ptr & 0xff);
-        $ptr >>= 8;
-    }
-    return $out;
-}
-?>
--EXPECT--
-int(1)
@@ -666,7 +666,7 @@ zend_function *spl_filesystem_object_get_method_check(zval **object_ptr, char *m
 {
 	spl_filesystem_object *fsobj = zend_object_store_get_object(*object_ptr TSRMLS_CC);

-	if (fsobj->u.dir.dirp == NULL && fsobj->orig_path == NULL) {
+	if (fsobj->u.dir.entry.d_name[0] == '\0' && fsobj->orig_path == NULL) {
 		method = "_bad_state_ex";
 		method_len = sizeof("_bad_state_ex") - 1;
 		key = NULL;
@@ -1,337 +0,0 @@
--TEST--
-Bug #55701 (GlobIterator throws LogicException with message 'The parent constructor was not called')
--FILE--
-<?php
-
-//
-// Some methods of GlobIterator do not throw a RuntimeException when the glob pattern doesn't match any file.
-// Most methods of GlobIterator throw a RuntimeException when the glob pattern does't match any file
-// because they get the properties of the current file
-function testBaseClass($f) {
-    // The tested iterator is in an invalid state; the behaviour of most of its methods is undefined
-    try {
-        $f();
-        echo "ran normally (expected)\n";
-    } catch (RuntimeException $e) {
-        // Throwing a RuntimeException is the correct behaviour for some methods
-        echo "ran normally (expected)\n";
-    } catch (LogicException $e) {
-        // Throwing a LogicException is not correct
-        echo "threw LogicException (unexpected)\n";
-    }
-}
-
-//
-// The derived classes must throw LogicException if the parent class constructor was not called
-function testChildClass($f) {
-    try {
-        $f();
-        echo "didn't throw (unexpected)\n";
-    } catch (LogicException $e) {
-        echo "threw LogicException (expected)\n";
-    } catch (Exception $e) {
-        echo "threw other exception (unexpected)\n";
-    }
-}
-
-
-
-//
-// It must not throw LogicException when the iterator is not valid
-echo "->count()... ";
-testBaseClass( function() {
-    $o = new GlobIterator(__DIR__.'/*.abcdefghij');
-    $o->count();
-} );
-
-echo "->rewind()... ";
-testBaseClass( function() {
-    $o = new GlobIterator(__DIR__.'/*.abcdefghij');
-    $o->rewind();
-} );
-
-echo "->getFlags()... ";
-testBaseClass( function() {
-    $o = new GlobIterator(__DIR__.'/*.abcdefghij');
-    $o->getFlags();
-} );
-
-echo "->setFlags()... ";
-testBaseClass( function() {
-    $o = new GlobIterator(__DIR__.'/*.abcdefghij');
-    $o->setFlags(FilesystemIterator::KEY_AS_PATHNAME);
-} );
-
-echo "->valid()... ";
-testBaseClass( function() {
-    $o = new GlobIterator(__DIR__.'/*.abcdefghij');
-    $o->valid();
-} );
-
-
-
-//
-// When the iterator is not valid, the behaviour of the next methods is undefined
-// Some of them throw a RuntimeException while others just return an invalid value
-// However, they must not throw LogicException
-echo "->current()... ";
-testBaseClass( function() {
-    $o = new GlobIterator(__DIR__.'/*.abcdefghij');
-    $o->current();
-} );
-
-echo "->key()... ";
-testBaseClass( function() {
-    $o = new GlobIterator(__DIR__.'/*.abcdefghij');
-    $o->key();
-} );
-
-echo "->next()... ";
-testBaseClass( function() {
-    $o = new GlobIterator(__DIR__.'/*.abcdefghij');
-    $o->next();
-} );
-
-echo "->getATime()... ";
-testBaseClass( function() {
-    $o = new GlobIterator(__DIR__.'/*.abcdefghij');
-    $o->getATime();
-} );
-
-echo "->getBasename()... ";
-testBaseClass( function() {
-    $o = new GlobIterator(__DIR__.'/*.abcdefghij');
-    $o->getBasename();
-} );
-
-echo "->getCTime()... ";
-testBaseClass( function() {
-    $o = new GlobIterator(__DIR__.'/*.abcdefghij');
-    $o->getCTime();
-} );
-
-echo "->getExtension()... ";
-testBaseClass( function() {
-    $o = new GlobIterator(__DIR__.'/*.abcdefghij');
-    $o->getExtension();
-} );
-
-echo "->getFilename()... ";
-testBaseClass( function() {
-    $o = new GlobIterator(__DIR__.'/*.abcdefghij');
-    $o->getFilename();
-} );
-
-echo "->getGroup()... ";
-testBaseClass( function() {
-    $o = new GlobIterator(__DIR__.'/*.abcdefghij');
-    $o->getGroup();
-} );
-
-echo "->getInode()... ";
-testBaseClass( function() {
-    $o = new GlobIterator(__DIR__.'/*.abcdefghij');
-    $o->getInode();
-} );
-
-echo "->getMTime()... ";
-testBaseClass( function() {
-    $o = new GlobIterator(__DIR__.'/*.abcdefghij');
-    $o->getMTime();
-} );
-
-echo "->getOwner()... ";
-testBaseClass( function() {
-    $o = new GlobIterator(__DIR__.'/*.abcdefghij');
-    $o->getOwner();
-} );
-
-echo "->getPath()... ";
-testBaseClass( function() {
-    $o = new GlobIterator(__DIR__.'/*.abcdefghij');
-    $o->getPath();
-} );
-
-echo "->getPathname()... ";
-testBaseClass( function() {
-    $o = new GlobIterator(__DIR__.'/*.abcdefghij');
-    $o->getPathname();
-} );
-
-echo "->getPerms()... ";
-testBaseClass( function() {
-    $o = new GlobIterator(__DIR__.'/*.abcdefghij');
-    $o->getPerms();
-} );
-
-echo "->getSize()... ";
-testBaseClass( function() {
-    $o = new GlobIterator(__DIR__.'/*.abcdefghij');
-    $o->getSize();
-} );
-
-echo "->getType()... ";
-testBaseClass( function() {
-    $o = new GlobIterator(__DIR__.'/*.abcdefghij');
-    $o->getType();
-} );
-
-echo "->isDir()... ";
-testBaseClass( function() {
-    $o = new GlobIterator(__DIR__.'/*.abcdefghij');
-    $o->isDir();
-} );
-
-echo "->isDot()... ";
-testBaseClass( function() {
-    $o = new GlobIterator(__DIR__.'/*.abcdefghij');
-    $o->isDot();
-} );
-
-echo "->isExecutable()... ";
-testBaseClass( function() {
-    $o = new GlobIterator(__DIR__.'/*.abcdefghij');
-    $o->isExecutable();
-} );
-
-echo "->isFile()... ";
-testBaseClass( function() {
-    $o = new GlobIterator(__DIR__.'/*.abcdefghij');
-    $o->isFile();
-} );
-
-echo "->isLink()... ";
-testBaseClass( function() {
-    $o = new GlobIterator(__DIR__.'/*.abcdefghij');
-    $o->isLink();
-} );
-
-echo "->isReadable()... ";
-testBaseClass( function() {
-    $o = new GlobIterator(__DIR__.'/*.abcdefghij');
-    $o->isReadable();
-} );
-
-echo "->isWritable()... ";
-testBaseClass( function() {
-    $o = new GlobIterator(__DIR__.'/*.abcdefghij');
-    $o->isWritable();
-} );
-
-echo "->seek()... ";
-testBaseClass( function() {
-    $o = new GlobIterator(__DIR__.'/*.abcdefghij');
-    $o->seek(0);
-} );
-
-echo "->__toString()... ";
-testBaseClass( function() {
-    $o = new GlobIterator(__DIR__.'/*.abcdefghij');
-    $o->__toString();
-} );
-
-
-//
-// Supplemental test: no method should throw LogicException if it is invoked
-// after a successful iteration over a non-empty list of files.
-echo "non-empty GlobIterator... ";
-testBaseClass( function() {
-    $o = new GlobIterator(__DIR__.'/*.phpt');
-    foreach ($o as $file) {
-        // nothing here, just consume all the items
-    }
-    // This must not throw an exception
-    $o->count();
-} );
-
-
-//
-// The correct existing behaviour must not change
-// The classes SplFileObject and SplTempFileObject are not affected by the bug
-echo "======================= test there are no regressions =======================\n";
-
-echo "SplFileObject existent file... ";
-testBaseClass( function() {
-    $o = new SplFileObject(__FILE__);
-    $o->fread(1);
-} );
-
-echo "SplFileObject non-existent file... ";
-testBaseClass( function() {
-    $o = new SplFileObject('/tmp/abcdefghij.abcdefghij');
-    $o->fread(1);
-} );
-
-
-
-//
-// Check that when derived classes do not call GlobIterator::__construct()
-// the LogicException is thrown (don't break the behaviour introduced to fix bug #54384)
-echo "extends GlobIterator... ";
-class GlobIteratorChild extends GlobIterator {
-    public function __construct() {}
-}
-testChildClass( function() {
-    $o = new GlobIteratorChild();
-    $o->count();
-} );
-
-echo "extends SplFileObject... ";
-class SplFileObjectChild extends SplFileObject {
-    public function __construct() {}
-}
-testChildClass( function() {
-    $o = new SplFileObjectChild();
-    $o->count();
-} );
-
-echo "extends SplTempFileObject... ";
-class SplTempFileObjectChild extends SplTempFileObject {
-    public function __construct() {}
-}
-testChildClass( function() {
-    $o = new SplTempFileObjectChild();
-    $o->count();
-} );
-
-
-
--EXPECT--
->count()... ran normally (expected)
->rewind()... ran normally (expected)
->getFlags()... ran normally (expected)
->setFlags()... ran normally (expected)
->valid()... ran normally (expected)
->current()... ran normally (expected)
->key()... ran normally (expected)
->next()... ran normally (expected)
->getATime()... ran normally (expected)
->getBasename()... ran normally (expected)
->getCTime()... ran normally (expected)
->getExtension()... ran normally (expected)
->getFilename()... ran normally (expected)
->getGroup()... ran normally (expected)
->getInode()... ran normally (expected)
->getMTime()... ran normally (expected)
->getOwner()... ran normally (expected)
->getPath()... ran normally (expected)
->getPathname()... ran normally (expected)
->getPerms()... ran normally (expected)
->getSize()... ran normally (expected)
->getType()... ran normally (expected)
->isDir()... ran normally (expected)
->isDot()... ran normally (expected)
->isExecutable()... ran normally (expected)
->isFile()... ran normally (expected)
->isLink()... ran normally (expected)
->isReadable()... ran normally (expected)
->isWritable()... ran normally (expected)
->seek()... ran normally (expected)
->__toString()... ran normally (expected)
-non-empty GlobIterator... ran normally (expected)
-======================= test there are no regressions =======================
-SplFileObject existent file... ran normally (expected)
-SplFileObject non-existent file... ran normally (expected)
-extends GlobIterator... threw LogicException (expected)
-extends SplFileObject... threw LogicException (expected)
-extends SplTempFileObject... threw LogicException (expected)
@@ -1376,12 +1376,6 @@ PHP_METHOD(sqlite3stmt, clear)
 		RETURN_FALSE;
 	}

-	if (stmt_obj->bound_params) {
-		zend_hash_destroy(stmt_obj->bound_params);
-		FREE_HASHTABLE(stmt_obj->bound_params);
-		stmt_obj->bound_params = NULL;
-	}
-
 	RETURN_TRUE;
 }
 /* }}} */
@@ -1,55 +0,0 @@
--TEST--
-Bug #70628 (Clearing bindings on an SQLite3 statement doesn't work)
--SKIPIF--
-<?php
-if (!extension_loaded('sqlite3')) die('skip'); ?>
--FILE--
-<?php
-$db = new SQLite3(':memory:');
-
-$db->exec("CREATE TABLE Dogs (Id INTEGER PRIMARY KEY, Breed TEXT, Name TEXT, Age INTEGER)");
-
-$sth = $db->prepare("INSERT INTO Dogs (Breed, Name, Age)  VALUES (:breed,:name,:age)");
-
-$sth->bindValue(':breed', 'canis', SQLITE3_TEXT);
-$sth->bindValue(':name', 'jack', SQLITE3_TEXT);
-$sth->bindValue(':age', 7, SQLITE3_INTEGER);
-$sth->execute();
-
-$sth->clear();
-$sth->reset();
-
-$sth->bindValue(':breed', 'russel', SQLITE3_TEXT);
-$sth->bindValue(':age', 3, SQLITE3_INTEGER);
-$sth->execute();
-
-$res = $db->query('SELECT * FROM Dogs');
-while (($row = $res->fetchArray(SQLITE3_ASSOC))) {
-    var_dump($row);
-}
-$res->finalize();
-
-$sth->close();
-$db->close();
-?>
--EXPECT--
-array(4) {
-  ["Id"]=>
-  int(1)
-  ["Breed"]=>
-  string(5) "canis"
-  ["Name"]=>
-  string(4) "jack"
-  ["Age"]=>
-  int(7)
-}
-array(4) {
-  ["Id"]=>
-  int(2)
-  ["Breed"]=>
-  string(6) "russel"
-  ["Name"]=>
-  NULL
-  ["Age"]=>
-  int(3)
-}
@@ -636,9 +636,8 @@ ZEND_BEGIN_ARG_INFO(arginfo_long2ip, 0)
 	ZEND_ARG_INFO(0, proper_address)
 ZEND_END_ARG_INFO()

-ZEND_BEGIN_ARG_INFO_EX(arginfo_getenv, 0, 0, 1)
+ZEND_BEGIN_ARG_INFO(arginfo_getenv, 0)
 	ZEND_ARG_INFO(0, varname)
-	ZEND_ARG_INFO(0, local_only)
 ZEND_END_ARG_INFO()

 #ifdef HAVE_PUTENV
@@ -3987,24 +3986,21 @@ PHP_FUNCTION(long2ip)
 * System Functions *
 ********************/

-/* {{{ proto string getenv(string varname[, bool local_only])
+/* {{{ proto string getenv(string varname)
   Get the value of an environment variable */
 PHP_FUNCTION(getenv)
 {
 	char *ptr, *str;
 	int str_len;
-	zend_bool local_only = 0;

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|b", &str, &str_len, &local_only) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &str, &str_len) == FAILURE) {
 		RETURN_FALSE;
 	}

-	if (!local_only) {
-		/* SAPI method returns an emalloc()'d string */
-		ptr = sapi_getenv(str, str_len TSRMLS_CC);
-		if (ptr) {
-			RETURN_STRING(ptr, 0);
-		}
+	/* SAPI method returns an emalloc()'d string */
+	ptr = sapi_getenv(str, str_len TSRMLS_CC);
+	if (ptr) {
+		RETURN_STRING(ptr, 0);
 	}
 #ifdef PHP_WIN32
 	{
@@ -3640,9 +3640,6 @@ PHPAPI int php_char_to_str_ex(char *str, uint len, char from, char *to, int to_l
 	}

 	Z_STRLEN_P(result) = len + (char_count * (to_len - 1));
-	if (Z_STRLEN_P(result) < 0) {
-		zend_error(E_ERROR, "String size overflow");
-	}
 	Z_STRVAL_P(result) = target = safe_emalloc(char_count, to_len, len + 1);
 	Z_TYPE_P(result) = IS_STRING;

@@ -4265,7 +4262,7 @@ PHP_FUNCTION(nl2br)
 {
 	/* in brief this inserts <br /> or <br> before matched regexp \n\r?|\r\n? */
 	char		*tmp, *str;
-	size_t		new_length;
+	int		new_length;
 	char		*end, *target;
 	int		repl_cnt = 0;
 	int		str_len;
@@ -20,7 +20,7 @@ var_dump(filesize($dst));
 <?php
 $file_path = dirname(__FILE__) . "/bug65701/";
 foreach (scandir($file_path) as $file) {
-    if (strpos($file, "bug65701") !== false || 'WIN' == substr(PHP_OS, 0, 3)) {
+    if (strpos($file, "bug65701") !== false) {
        unlink($file_path . $file);
    }
 }
@@ -5,28 +5,28 @@
  Epinions.com may be contacted at feedback@epinions-inc.com
 */

-/*
-  Copyright 2000 Epinions, Inc.
+/*  
+  Copyright 2000 Epinions, Inc. 

-  Subject to the following 3 conditions, Epinions, Inc.  permits you, free
-  of charge, to (a) use, copy, distribute, modify, perform and display this
-  software and associated documentation files (the "Software"), and (b)
-  permit others to whom the Software is furnished to do so as well.
+  Subject to the following 3 conditions, Epinions, Inc.  permits you, free 
+  of charge, to (a) use, copy, distribute, modify, perform and display this 
+  software and associated documentation files (the "Software"), and (b) 
+  permit others to whom the Software is furnished to do so as well.  

-  1) The above copyright notice and this permission notice shall be included
-  without modification in all copies or substantial portions of the
-  Software.
+  1) The above copyright notice and this permission notice shall be included 
+  without modification in all copies or substantial portions of the 
+  Software.  

-  2) THE SOFTWARE IS PROVIDED "AS IS", WITHOUT ANY WARRANTY OR CONDITION OF
-  ANY KIND, EXPRESS, IMPLIED OR STATUTORY, INCLUDING WITHOUT LIMITATION ANY
-  IMPLIED WARRANTIES OF ACCURACY, MERCHANTABILITY, FITNESS FOR A PARTICULAR
-  PURPOSE OR NONINFRINGEMENT.
+  2) THE SOFTWARE IS PROVIDED "AS IS", WITHOUT ANY WARRANTY OR CONDITION OF 
+  ANY KIND, EXPRESS, IMPLIED OR STATUTORY, INCLUDING WITHOUT LIMITATION ANY 
+  IMPLIED WARRANTIES OF ACCURACY, MERCHANTABILITY, FITNESS FOR A PARTICULAR 
+  PURPOSE OR NONINFRINGEMENT.  

-  3) IN NO EVENT SHALL EPINIONS, INC. BE LIABLE FOR ANY DIRECT, INDIRECT,
-  SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES OR LOST PROFITS ARISING OUT
-  OF OR IN CONNECTION WITH THE SOFTWARE (HOWEVER ARISING, INCLUDING
-  NEGLIGENCE), EVEN IF EPINIONS, INC.  IS AWARE OF THE POSSIBILITY OF SUCH
-  DAMAGES.
+  3) IN NO EVENT SHALL EPINIONS, INC. BE LIABLE FOR ANY DIRECT, INDIRECT, 
+  SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES OR LOST PROFITS ARISING OUT 
+  OF OR IN CONNECTION WITH THE SOFTWARE (HOWEVER ARISING, INCLUDING 
+  NEGLIGENCE), EVEN IF EPINIONS, INC.  IS AWARE OF THE POSSIBILITY OF SUCH 
+  DAMAGES.    

 */

@@ -71,7 +71,7 @@ static const char rcsid[] = "#(@) $Id$";
 *
 *   Oh, and it is also binary safe, ie it can handle strings with embedded NULLs,
 *   so long as the real length is passed in.
- *
+ *   
 *   And the masses rejoiced.
 *
 * BUGS
@@ -136,7 +136,7 @@ static void simplestring_init_str(simplestring* string) {
 * NOTES
 *   This function is very fast as it does not de-allocate any memory.
 * SEE ALSO
- *
+ * 
 * SOURCE
 */
 void simplestring_clear(simplestring* string) {
@@ -172,9 +172,6 @@ void simplestring_free(simplestring* string) {
 }
 /******/

-#ifndef SIZE_MAX
-#define SIZE_MAX ((size_t)-1)
-#endif
 /****f* FUNC/simplestring_addn
 * NAME
 *   simplestring_addn
@@ -193,31 +190,18 @@ void simplestring_free(simplestring* string) {
 *   simplestring_add ()
 * SOURCE
 */
-void simplestring_addn(simplestring* target, const char* source, size_t add_len) {
-   size_t newsize = target->size, incr = 0;
+void simplestring_addn(simplestring* target, const char* source, int add_len) {
   if(target && source) {
      if(!target->str) {
         simplestring_init_str(target);
      }
-
-      if((SIZE_MAX - add_len) < target->len || (SIZE_MAX - add_len - 1) < target->len) {
-    	  /* check for overflows, if there's a potential overflow do nothing */
-    	  return;
-      }
-
      if(target->len + add_len + 1 > target->size) {
         /* newsize is current length + new length */
-         newsize = target->len + add_len + 1;
-         incr = target->size * 2;
+         int newsize = target->len + add_len + 1;
+         int incr = target->size * 2;

         /* align to SIMPLESTRING_INCR increments */
-         if (incr) {
-            newsize = newsize - (newsize % incr) + incr;
-         }
-         if(newsize < (target->len + add_len + 1)) {
-        	 /* some kind of overflow happened */
-        	 return;
-         }
+         newsize = newsize - (newsize % incr) + incr;
         target->str = (char*)realloc(target->str, newsize);

         target->size = target->str ? newsize : 0;
@@ -63,7 +63,7 @@ void simplestring_init(simplestring* string);
 void simplestring_clear(simplestring* string);
 void simplestring_free(simplestring* string);
 void simplestring_add(simplestring* string, const char* add);
-void simplestring_addn(simplestring* string, const char* add, size_t add_len);
+void simplestring_addn(simplestring* string, const char* add, int add_len);

 #ifdef __cplusplus
 }
@@ -116,13 +116,13 @@ static int php_zip_ops_stat(php_stream *stream, php_stream_statbuf *ssb TSRMLS_D
 {
 	struct zip_stat sb;
 	const char *path = stream->orig_path;
-	size_t path_len = strlen(stream->orig_path);
+	int path_len = strlen(stream->orig_path);
 	char *file_basename;
 	size_t file_basename_len;
 	char file_dirname[MAXPATHLEN];
 	struct zip *za;
 	char *fragment;
-	size_t fragment_len;
+	int fragment_len;
 	int err;

 	fragment = strchr(path, '#');
@@ -229,7 +229,7 @@ php_stream *php_stream_zip_open(const char *filename, const char *path, const ch
 			self = emalloc(sizeof(*self));

 			self->za = stream_za;
-			self->zf = zf;
+			self->zf = zf; 
 			self->stream = NULL;
 			self->cursor = 0;
 			stream = php_stream_alloc(&php_stream_zipio_ops, self, NULL, mode);
@@ -256,7 +256,7 @@ php_stream *php_stream_zip_opener(php_stream_wrapper *wrapper,
 											char **opened_path,
 											php_stream_context *context STREAMS_DC TSRMLS_DC)
 {
-	size_t path_len;
+	int path_len;

 	char *file_basename;
 	size_t file_basename_len;
@@ -265,7 +265,7 @@ php_stream *php_stream_zip_opener(php_stream_wrapper *wrapper,
 	struct zip *za;
 	struct zip_file *zf = NULL;
 	char *fragment;
-	size_t fragment_len;
+	int fragment_len;
 	int err;

 	php_stream *stream = NULL;
@@ -308,7 +308,7 @@ php_stream *php_stream_zip_opener(php_stream_wrapper *wrapper,
 			self = emalloc(sizeof(*self));

 			self->za = za;
-			self->zf = zf;
+			self->zf = zf; 
 			self->stream = NULL;
 			self->cursor = 0;
 			stream = php_stream_alloc(&php_stream_zipio_ops, self, NULL, mode);
@@ -174,7 +174,7 @@ static php_stream_filter_ops php_zlib_inflate_ops = {
 };
 /* }}} */

-/* {{{ zlib.deflate filter implementation */
+/* {{{ zlib.inflate filter implementation */

 static php_stream_filter_status_t php_zlib_deflate_filter(
 	php_stream *stream,
@@ -1,4 +1,4 @@
-/*
+/* 
   +----------------------------------------------------------------------+
   | PHP Version 5                                                        |
   +----------------------------------------------------------------------+
@@ -128,7 +128,7 @@ PHP_FUNCTION(header_register_callback)
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "z", &callback_func) == FAILURE) {
 		return;
 	}
-
+	
 	if (!zend_is_callable(callback_func, 0, &callback_name TSRMLS_CC)) {
 		efree(callback_name);
 		RETURN_FALSE;
@@ -156,10 +156,10 @@ static void sapi_run_header_callback(TSRMLS_D)
 	char *callback_name = NULL;
 	char *callback_error = NULL;
 	zval *retval_ptr = NULL;
-
+	
 	if (zend_fcall_info_init(SG(callback_func), 0, &fci, &SG(fci_cache), &callback_name, &callback_error TSRMLS_CC) == SUCCESS) {
 		fci.retval_ptr_ptr = &retval_ptr;
-
+		
 		error = zend_call_function(&fci, &SG(fci_cache) TSRMLS_CC);
 		if (error == FAILURE) {
 			goto callback_failed;
@@ -170,13 +170,13 @@ static void sapi_run_header_callback(TSRMLS_D)
 callback_failed:
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not call the sapi_header_callback");
 	}
-
+	
 	if (callback_name) {
 		efree(callback_name);
 	}
 	if (callback_error) {
 		efree(callback_error);
-	}
+	}	
 }

 SAPI_API void sapi_handle_post(void *arg TSRMLS_DC)
@@ -407,11 +407,11 @@ SAPI_API void sapi_activate_headers_only(TSRMLS_D)
 	if (SG(request_info).headers_read == 1)
 		return;
 	SG(request_info).headers_read = 1;
-	zend_llist_init(&SG(sapi_headers).headers, sizeof(sapi_header_struct),
+	zend_llist_init(&SG(sapi_headers).headers, sizeof(sapi_header_struct), 
 			(void (*)(void *)) sapi_free_header, 0);
 	SG(sapi_headers).send_default_content_type = 1;

-	/* SG(sapi_headers).http_response_code = 200; */
+	/* SG(sapi_headers).http_response_code = 200; */ 
 	SG(sapi_headers).http_status_line = NULL;
 	SG(sapi_headers).mimetype = NULL;
 	SG(read_post_bytes) = 0;
@@ -423,7 +423,7 @@ SAPI_API void sapi_activate_headers_only(TSRMLS_D)
 	SG(global_request_time) = 0;

 	/*
-	 * It's possible to override this general case in the activate() callback,
+	 * It's possible to override this general case in the activate() callback, 
 	 * if necessary.
 	 */
 	if (SG(request_info).request_method && !strcmp(SG(request_info).request_method, "HEAD")) {
@@ -509,7 +509,7 @@ static void sapi_send_headers_free(TSRMLS_D)
 		SG(sapi_headers).http_status_line = NULL;
 	}
 }
-
+	
 SAPI_API void sapi_deactivate(TSRMLS_D)
 {
 	zend_llist_destroy(&SG(sapi_headers).headers);
@@ -583,7 +583,7 @@ static int sapi_extract_response_code(const char *header_line)
 			break;
 		}
 	}
-
+	
 	return code;
 }

@@ -603,7 +603,7 @@ static void sapi_update_response_code(int ncode TSRMLS_DC)
 	SG(sapi_headers).http_response_code = ncode;
 }

-/*
+/* 
 * since zend_llist_del_element only remove one matched item once,
 * we should remove them by ourself
 */
@@ -639,7 +639,7 @@ SAPI_API int sapi_add_header_ex(char *header_line, uint header_line_len, zend_bo
 {
 	sapi_header_line ctr = {0};
 	int r;
-
+	
 	ctr.line = header_line;
 	ctr.line_len = header_line_len;

@@ -733,7 +733,7 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg TSRMLS_DC)
 		} while(header_line_len && isspace(header_line[header_line_len-1]));
 		header_line[header_line_len]='\0';
 	}
-
+	
 	if (op == SAPI_HEADER_DELETE) {
 		if (strchr(header_line, ':')) {
 			efree(header_line);
@@ -771,7 +771,7 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg TSRMLS_DC)
 	sapi_header.header_len = header_line_len;

 	/* Check the header for a few cases that we have special support for in SAPI */
-	if (header_line_len>=5
+	if (header_line_len>=5 
 		&& !strncasecmp(header_line, "HTTP/", 5)) {
 		/* filter out the response code */
 		sapi_update_response_code(sapi_extract_response_code(header_line) TSRMLS_CC);
@@ -830,8 +830,8 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg TSRMLS_DC)
 					/* Return a Found Redirect if one is not already specified */
 					if (http_response_code) { /* user specified redirect code */
 						sapi_update_response_code(http_response_code TSRMLS_CC);
-					} else if (SG(request_info).proto_num > 1000 &&
-					   SG(request_info).request_method &&
+					} else if (SG(request_info).proto_num > 1000 && 
+					   SG(request_info).request_method && 
 					   strcmp(SG(request_info).request_method, "HEAD") &&
 					   strcmp(SG(request_info).request_method, "GET")) {
 						sapi_update_response_code(303 TSRMLS_CC);
@@ -1020,11 +1020,7 @@ SAPI_API struct stat *sapi_get_stat(TSRMLS_D)

 SAPI_API char *sapi_getenv(char *name, size_t name_len TSRMLS_DC)
 {
-	if (!strncasecmp(name, "HTTP_PROXY", name_len)) {
-		/* Ugly fix for HTTP_PROXY issue, see bug #72573 */
-		return NULL;
-	}
-	if (sapi_module.getenv) {
+	if (sapi_module.getenv) { 
 		char *value, *tmp = sapi_module.getenv(name, name_len TSRMLS_CC);
 		if (tmp) {
 			value = estrdup(tmp);
@@ -70,9 +70,6 @@ SAPI_API SAPI_POST_READER_FUNC(php_default_post_reader)
 					(unsigned long) length, INT_MAX);
 				length = INT_MAX;
 			}
-			if (!data) {
-				data = STR_EMPTY_ALLOC();
-			}
 			SET_VAR_STRINGL("HTTP_RAW_POST_DATA", data, length);

 			sapi_module.sapi_error(E_DEPRECATED,
@@ -47,7 +47,7 @@ PHPAPI void php_register_variable_safe(char *var, char *strval, int str_len, zva
 {
 	zval new_entry;
 	assert(strval != NULL);
-
+	
 	/* Prepare value */
 	Z_STRLEN(new_entry) = str_len;
 	Z_STRVAL(new_entry) = estrndup(strval, Z_STRLEN(new_entry));
@@ -85,7 +85,7 @@ PHPAPI void php_register_variable_ex(char *var_name, zval *val, zval *track_vars
 	while (*var_name && *var_name==' ') {
 		var_name++;
 	}
-
+	
 	/*
 	 * Prepare variable name
 	 */
@@ -171,7 +171,7 @@ PHPAPI void php_register_variable_ex(char *var_name, zval *val, zval *track_vars
 					return;
 				}
 				*ip = 0;
-				new_idx_len = strlen(index_s);
+				new_idx_len = strlen(index_s);	
 			}

 			if (!index) {
@@ -214,7 +214,7 @@ plain_var:
 				zval_ptr_dtor(&gpc_element);
 			}
 		} else {
-			/*
+			/* 
 			 * According to rfc2965, more specific paths are listed above the less specific ones.
 			 * If we encounter a duplicate cookie name, we should skip it, since it is not possible
 			 * to have the same (plain text) cookie name for the same path and we should not overwrite
@@ -367,7 +367,7 @@ SAPI_API SAPI_TREAT_DATA_FUNC(php_default_treat_data)
 	int free_buffer = 0;
 	char *strtok_buf = NULL;
 	long count = 0;
-
+	
 	switch (arg) {
 		case PARSE_POST:
 		case PARSE_GET:
@@ -440,9 +440,9 @@ SAPI_API SAPI_TREAT_DATA_FUNC(php_default_treat_data)
 			separator = ";\0";
 			break;
 	}
-
+	
 	var = php_strtok_r(res, separator, &strtok_buf);
-
+	
 	while (var) {
 		val = strchr(var, '=');

@@ -537,11 +537,11 @@ static void php_build_argv(char *s, zval *track_vars_array TSRMLS_DC)
 	zval *arr, *argc, *tmp;
 	int count = 0;
 	char *ss, *space;
-
+	
 	if (!(SG(request_info).argc || track_vars_array)) {
 		return;
 	}
-
+	
 	ALLOC_INIT_ZVAL(arr);
 	array_init(arr);

@@ -602,7 +602,7 @@ static void php_build_argv(char *s, zval *track_vars_array TSRMLS_DC)
 		Z_ADDREF_P(argc);
 		zend_hash_update(&EG(symbol_table), "argv", sizeof("argv"), &arr, sizeof(zval *), NULL);
 		zend_hash_update(&EG(symbol_table), "argc", sizeof("argc"), &argc, sizeof(zval *), NULL);
-	}
+	} 
 	if (track_vars_array) {
 		Z_ADDREF_P(arr);
 		Z_ADDREF_P(argc);
@@ -732,7 +732,7 @@ static zend_bool php_auto_globals_create_get(const char *name, uint name_len TSR

 	zend_hash_update(&EG(symbol_table), name, name_len + 1, &vars, sizeof(zval *), NULL);
 	Z_ADDREF_P(vars);
-
+	
 	return 0; /* don't rearm */
 }

@@ -758,7 +758,7 @@ static zend_bool php_auto_globals_create_post(const char *name, uint name_len TS

 	zend_hash_update(&EG(symbol_table), name, name_len + 1, &vars, sizeof(zval *), NULL);
 	Z_ADDREF_P(vars);
-
+	
 	return 0; /* don't rearm */
 }

@@ -781,7 +781,7 @@ static zend_bool php_auto_globals_create_cookie(const char *name, uint name_len

 	zend_hash_update(&EG(symbol_table), name, name_len + 1, &vars, sizeof(zval *), NULL);
 	Z_ADDREF_P(vars);
-
+	
 	return 0; /* don't rearm */
 }

@@ -800,27 +800,10 @@ static zend_bool php_auto_globals_create_files(const char *name, uint name_len T

 	zend_hash_update(&EG(symbol_table), name, name_len + 1, &vars, sizeof(zval *), NULL);
 	Z_ADDREF_P(vars);
-
+	
 	return 0; /* don't rearm */
 }

-/* Upgly hack to fix HTTP_PROXY issue, see bug #72573 */
-static void check_http_proxy(HashTable *var_table)
-{
-	if (zend_hash_exists(var_table, "HTTP_PROXY", sizeof("HTTP_PROXY"))) {
-		char *local_proxy = getenv("HTTP_PROXY");
-
-		if (!local_proxy) {
-			zend_hash_del(var_table, "HTTP_PROXY", sizeof("HTTP_PROXY"));
-		} else {
-			zval *local_zval;
-			ALLOC_INIT_ZVAL(local_zval);
-			ZVAL_STRING(local_zval, local_proxy, 1);
-			zend_hash_update(var_table, "HTTP_PROXY", sizeof("HTTP_PROXY"), &local_zval, sizeof(zval **), NULL);
-		}
-	}
-}
-
 static zend_bool php_auto_globals_create_server(const char *name, uint name_len TSRMLS_DC)
 {
 	if (PG(variables_order) && (strchr(PG(variables_order),'S') || strchr(PG(variables_order),'s'))) {
@@ -829,7 +812,7 @@ static zend_bool php_auto_globals_create_server(const char *name, uint name_len
 		if (PG(register_argc_argv)) {
 			if (SG(request_info).argc) {
 				zval **argc, **argv;
-
+	
 				if (zend_hash_find(&EG(symbol_table), "argc", sizeof("argc"), (void**)&argc) == SUCCESS &&
 					zend_hash_find(&EG(symbol_table), "argv", sizeof("argv"), (void**)&argv) == SUCCESS) {
 					Z_ADDREF_PP(argc);
@@ -841,7 +824,7 @@ static zend_bool php_auto_globals_create_server(const char *name, uint name_len
 				php_build_argv(SG(request_info).query_string, PG(http_globals)[TRACK_VARS_SERVER] TSRMLS_CC);
 			}
 		}
-
+	
 	} else {
 		zval *server_vars=NULL;
 		ALLOC_ZVAL(server_vars);
@@ -853,10 +836,9 @@ static zend_bool php_auto_globals_create_server(const char *name, uint name_len
 		PG(http_globals)[TRACK_VARS_SERVER] = server_vars;
 	}

-	check_http_proxy(Z_ARRVAL_P(PG(http_globals)[TRACK_VARS_SERVER]));
 	zend_hash_update(&EG(symbol_table), name, name_len + 1, &PG(http_globals)[TRACK_VARS_SERVER], sizeof(zval *), NULL);
 	Z_ADDREF_P(PG(http_globals)[TRACK_VARS_SERVER]);
-
+	
 	return 0; /* don't rearm */
 }

@@ -870,12 +852,11 @@ static zend_bool php_auto_globals_create_env(const char *name, uint name_len TSR
 		zval_ptr_dtor(&PG(http_globals)[TRACK_VARS_ENV]);
 	}
 	PG(http_globals)[TRACK_VARS_ENV] = env_vars;
-
+	
 	if (PG(variables_order) && (strchr(PG(variables_order),'E') || strchr(PG(variables_order),'e'))) {
 		php_import_environment_variables(PG(http_globals)[TRACK_VARS_ENV] TSRMLS_CC);
 	}

-	check_http_proxy(Z_ARRVAL_P(PG(http_globals)[TRACK_VARS_ENV]));
 	zend_hash_update(&EG(symbol_table), name, name_len + 1, &PG(http_globals)[TRACK_VARS_ENV], sizeof(zval *), NULL);
 	Z_ADDREF_P(PG(http_globals)[TRACK_VARS_ENV]);

@@ -2,7 +2,7 @@
 /* edit configure.in to change version number */
 #define PHP_MAJOR_VERSION 5
 #define PHP_MINOR_VERSION 6
-#define PHP_RELEASE_VERSION 24
+#define PHP_RELEASE_VERSION 23
 #define PHP_EXTRA_VERSION ""
-#define PHP_VERSION "5.6.24"
-#define PHP_VERSION_ID 50624
+#define PHP_VERSION "5.6.23"
+#define PHP_VERSION_ID 50623
@@ -247,27 +247,16 @@ static inline int sock_recvfrom(php_netstream_data_t *sock, char *buf, size_t bu
 		struct sockaddr **addr, socklen_t *addrlen
 		TSRMLS_DC)
 {
+	php_sockaddr_storage sa;
+	socklen_t sl = sizeof(sa);
 	int ret;
 	int want_addr = textaddr || addr;

 	if (want_addr) {
-		php_sockaddr_storage sa;
-		socklen_t sl = sizeof(sa);
 		ret = recvfrom(sock->socket, buf, buflen, flags, (struct sockaddr*)&sa, &sl);
 		ret = (ret == SOCK_CONN_ERR) ? -1 : ret;
-		if (sl) {
-			php_network_populate_name_from_sockaddr((struct sockaddr*)&sa, sl,
-					textaddr, textaddrlen, addr, addrlen TSRMLS_CC);
-		} else {
-			if (textaddr) {
-				*textaddr = estrndup("", 0);
-				*textaddrlen = 0;
-			}
-			if (addr) {
-				*addr = NULL;
-				*addrlen = 0;
-			}
-		}
+		php_network_populate_name_from_sockaddr((struct sockaddr*)&sa, sl,
+			textaddr, textaddrlen, addr, addrlen TSRMLS_CC);
 	} else {
 		ret = recv(sock->socket, buf, buflen, flags);
 		ret = (ret == SOCK_CONN_ERR) ? -1 : ret;
@@ -314,7 +303,7 @@ static int php_sockop_set_option(php_stream *stream, int option, int value, void
 					ret = recv(sock->socket, &buf, sizeof(buf), MSG_PEEK);
 					err = php_socket_errno();
 					if (0 == ret || /* the counterpart did properly shutdown*/
-						(0 > ret && err != EWOULDBLOCK && err != EAGAIN)) { /* there was an unrecoverable error */
+						0 > ret && err != EWOULDBLOCK && err != EAGAIN) { /* there was an unrecoverable error */
 						alive = 0;
 					}
 				}
Author	SHA1	Message	Date
Anatol Belski	961e562d1b	re-fix leak	2016-06-22 03:50:40 +02:00
Anatol Belski	e6bcc0bb0b	Revert "fix leak" This reverts commit `c5d9c50897`.	2016-06-22 03:50:31 +02:00
Anatol Belski	db18c87e77	fix leak	2016-06-22 03:50:22 +02:00
Anatol Belski	1cfd6996d4	fix test There is a difference between TS and NTS warning message, since virtual_mkdir vs glibc directly is used. This has no effect for the actual fix functionality.	2016-06-22 03:49:54 +02:00
Ferenc Kovacs	c6af288e32	5.6.23	2016-06-22 03:06:31 +02:00
Anatol Belski	fa8e1c026a	remove the huge test file, generate it on the fly instead	2016-06-21 09:57:39 +02:00