5.6.30

GD2 stores the number of horizontal and vertical chunks as words (i.e. 2
byte unsigned). These values are multiplied and assigned to an int when
reading the image, what can cause integer overflows. We have to avoid
that, and also make sure that either chunk count is actually greater
than zero. If illegal chunk counts are detected, we bail out from
reading the image.

(cherry picked from commit 5b5d9db3988b829e0b121b74bb3947f01c2796a1)

NEWS

@@ -1,17 +1,94 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2016, PHP 5.6.28
+19 Jan 2017, PHP 5.6.30
+
+- EXIF:
+  . Fixed bug #73737 (FPE when parsing a tag format). (Stas)
+
+- GD:
+  . Fixed bug #73549 (Use after free when stream is passed to imagepng). (cmb)
+  . Fixed bug #73868 (DOS vulnerability in gdImageCreateFromGd2Ctx()). (cmb)
+  . Fixed bug #73869 (Signed Integer Overflow gd_io.c). (cmb)
+
+- Intl:
+  . Fixed bug #68447 (grapheme_extract take an extra trailing character). 
+    (SATŌ Kentarō)
+
+- Phar:
+  . Fixed bug #73764 (Crash while loading hostile phar archive). (Stas)
+  . Fixed bug #73768 (Memory corruption when loading hostile phar). (Stas)
+  . Fixed bug #73773 (Seg fault when loading hostile phar). (Stas)
+
+- SQLite3:
+  . Reverted fix for bug #73530	(Unsetting result set may reset other result
+    set). (cmb)
+
+- Standard:
+  . Fixed bug #70213 (Unserialize context shared on double class lookup).
+    (Taoguang Chen)
+  . Fixed bug #73825 (Heap out of bounds read on unserialize in
+    finish_nested_data()). (Stas)
+
+08 Dec 2016, PHP 5.6.29
+
+- Mbstring:
+  . Fixed bug #73505 (string length overflow in mbfl_memory_device_output
+    function). (Stas)
+
+- Mysqlnd:
+  . Fixed bug #64526 (Add missing mysqlnd.* parameters to php.ini-*). (cmb)
+
+- Opcache:
+  . Fixed bug #73402 (Opcache segfault when using class constant to call a
+    method). (Laruence)
+  . Fixed bug #69090 (check cached files permissions)
+
+- OpenSSL
+  . Fixed bug #72776 (Invalid parameter in memcpy function trough
+    openssl_pbkdf2). (Jakub Zelenka)
+
+- Postgres:
+  . Fixed bug #73498 (Incorrect SQL generated for pg_copy_to()). (Craig Duncan)
+
+- SOAP:
+  . Fixed bug #73452 (Segfault (Regression for #69152)). (Dmitry)
+
+- SQLite3:
+  . Fixed bug #73530 (Unsetting result set may reset other result set). (cmb)
+
+- Standard:
+   . Fixed bug #73297 (HTTP stream wrapper should ignore HTTP 100 Continue).
+     (rowan dot collins at gmail dot com)
+
+- WDDX:
+  . Fixed bug #73631 (Memory leak due to invalid wddx stack processing). 
+    (bughunter at fosec dot vn).
+
+10 Nov 2016, PHP 5.6.28
 
 - Core:
   . Fixed bug #73337 (try/catch not working with two exceptions inside a same
     operation). (Dmitry)
 
+- Bz2:
+  . Fixed bug #73356 (crash in bzcompress function). (Stas)
+
 -GD:
   . Fixed bug #73213 (Integer overflow in imageline() with antialiasing). (cmb)
   . Fixed bug #73272 (imagescale() is not affected by, but affects
     imagesetinterpolation()). (cmb)
   . Fixed bug #73279 (Integer overflow in gdImageScaleBilinearPalette()). (cmb)
   . Fixed bug #73280 (Stack Buffer Overflow in GD dynamicGetbuf). (cmb)
+  . Fixed bug #72482 (Illegal write/read access caused by gdImageAALine overflow).
+    (cmb)
+  . Fixed bug #72696 (imagefilltoborder stackoverflow on truecolor images). (cmb)
+
+- Imap:
+  . Fixed bug #73418 (Integer Overflow in "_php_imap_mail" leads Heap Overflow).
+    (Anatol)
+
+- SPL:
+  . Fixed bug #73144 (Use-after-free in ArrayObject Deserialization). (Stas)
 
 - SOAP:
   . Fixed bug #73037 (SoapServer reports Bad Request when gzipped). (Anatol)
@@ -22,6 +99,11 @@ PHP                                                                        NEWS
 - Standard:
   . Fixed bug #73203 (passing additional_parameters causes mail to fail). (cmb)
   . Fixed bug #73188 (use after free in userspace streams). (Sara)
+  . Fixed bug #73192 (parse_url return wrong hostname). (Nikita)
+
+- Wddx:
+  . Fixed bug #73331 (NULL Pointer Dereference in WDDX Packet Deserialization
+    with PDORow). (Stas)
 
 13 Oct 2016, PHP 5.6.27
 

Zend/tests/debug_info-error-resource.phpt

@@ -1,5 +1,7 @@
 --TEST--
 Testing __debugInfo() magic method with bad returns RESOURCE
+--INI--
+allow_url_fopen=1
 --FILE--
 <?php
 

Zend/zend_API.h

@@ -667,6 +667,7 @@ END_EXTERN_C()
 	}										\
 	RETVAL_STRINGL((s), (int)__len, (dup)); \
 } while (0)
+#define RETURN_STRINGL_CHECK(s, len, dup) { RETVAL_STRINGL_CHECK(s, len, dup); return; }
 
 
 #define SET_VAR_STRING(n, v) {																				\

Zend/zend_object_handlers.c

@@ -1184,6 +1184,10 @@ ZEND_API zend_function *zend_std_get_static_method(zend_class_entry *ce, const c
 	ALLOCA_FLAG(use_heap)
 
 	if (EXPECTED(key != NULL)) {
+#if (ZEND_GCC_VERSION == 4009) && !(defined(ZTS) && defined(NETWARE)) && !(defined(ZTS) && defined(HPUX)) && !defined(DARWIN)
+		/* This is a workaround for bug in GCC 4.9.2 */
+		use_heap = 0;
+#endif
 		lc_function_name = Z_STRVAL(key->constant);
 		hash_value = key->hash_value;
 	} else {

acinclude.m4

@@ -2263,7 +2263,7 @@ AC_DEFUN([PHP_SETUP_KERBEROS],[
   fi
 
   dnl If krb5-config is found try using it
-  if test "$PHP_KERBEROS" = "yes" && test -x "$KRB5_CONFIG"; then
+  if test "$PHP_KERBEROS" != "no" && test -x "$KRB5_CONFIG"; then
     KERBEROS_LIBS=`$KRB5_CONFIG --libs gssapi`
     KERBEROS_CFLAGS=`$KRB5_CONFIG --cflags gssapi`
 

configure.in

@@ -119,8 +119,8 @@ int zend_sprintf(char *buffer, const char *format, ...);
 
 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=6
-PHP_RELEASE_VERSION=28
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=30
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
 

ext/bz2/bz2.c

@@ -513,7 +513,7 @@ static PHP_FUNCTION(bzcompress)
 	dest_len   = (unsigned int) (source_len + (0.01 * source_len) + 600);
 
 	/* Allocate the destination buffer */
-	dest = emalloc(dest_len + 1);
+	dest = safe_emalloc(dest_len, 1, 1);
 
 	/* Handle the optional arguments */
 	if (argc > 1) {
@@ -533,7 +533,7 @@ static PHP_FUNCTION(bzcompress)
 		   so we erealloc() the buffer to the proper size */
 		dest = erealloc(dest, dest_len + 1);
 		dest[dest_len] = 0;
-		RETURN_STRINGL(dest, dest_len, 0);
+		RETURN_STRINGL_CHECK(dest, dest_len, 0);
 	}
 }
 /* }}} */

ext/curl/curl_file.c

@@ -35,7 +35,7 @@ static void curlfile_ctor(INTERNAL_FUNCTION_PARAMETERS)
 	int fname_len, mime_len, postname_len;
 	zval *cf = return_value;
 
-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|ss", &fname, &fname_len, &mime, &mime_len, &postname, &postname_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|ss", &fname, &fname_len, &mime, &mime_len, &postname, &postname_len) == FAILURE) {
 		return;
 	}
 

ext/exif/exif.c

@@ -1303,7 +1303,7 @@ static size_t exif_convert_any_to_int(void *value, int format, int motorola_inte
 			if (s_den == 0) {
 				return 0;
 			} else {
-				return php_ifd_get32s(value, motorola_intel) / s_den;
+				return (size_t)((double)php_ifd_get32s(value, motorola_intel) / s_den);
 			}
 
 		case TAG_FMT_SSHORT:    return php_ifd_get16u(value, motorola_intel);
@@ -2855,7 +2855,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 	}
 
 	if (components < 0) {
-		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal components(%ld)", tag, exif_get_tagname(tag, tagname, -12, tag_table TSRMLS_CC), components);
+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal components(%d)", tag, exif_get_tagname(tag, tagname, -12, tag_table TSRMLS_CC), components);
 		return FALSE;
 	}
 
@@ -4210,7 +4210,7 @@ PHP_FUNCTION(exif_imagetype)
 	php_stream * stream;
  	int itype = 0;
 
-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &imagefile, &imagefile_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &imagefile, &imagefile_len) == FAILURE) {
 		return;
 	}
 

ext/exif/tests/bug73737.phpt

@@ -0,0 +1,12 @@
+--TEST--
+Bug #73737 (Crash when parsing a tag format)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+	$exif = exif_thumbnail(__DIR__ . '/bug73737.tiff');
+	var_dump($exif);
+?>
+--EXPECTF--
+Warning: exif_thumbnail(bug73737.tiff): Error in TIFF: filesize(x0030) less than start of IFD dir(x10102) in %s line %d
+bool(false)

ext/exif/tests/exif_imagetype_variation1.phpt

@@ -142,23 +142,23 @@ Warning: exif_imagetype(0.5): failed to open stream: No such file or directory i
 bool(false)
 -- Iteration 10 --
 
-Warning: exif_imagetype() expects parameter 1 to be string, array given in %s on line %d
+Warning: exif_imagetype() expects parameter 1 to be a valid path, array given in %s on line %d
 NULL
 -- Iteration 11 --
 
-Warning: exif_imagetype() expects parameter 1 to be string, array given in %s on line %d
+Warning: exif_imagetype() expects parameter 1 to be a valid path, array given in %s on line %d
 NULL
 -- Iteration 12 --
 
-Warning: exif_imagetype() expects parameter 1 to be string, array given in %s on line %d
+Warning: exif_imagetype() expects parameter 1 to be a valid path, array given in %s on line %d
 NULL
 -- Iteration 13 --
 
-Warning: exif_imagetype() expects parameter 1 to be string, array given in %s on line %d
+Warning: exif_imagetype() expects parameter 1 to be a valid path, array given in %s on line %d
 NULL
 -- Iteration 14 --
 
-Warning: exif_imagetype() expects parameter 1 to be string, array given in %s on line %d
+Warning: exif_imagetype() expects parameter 1 to be a valid path, array given in %s on line %d
 NULL
 -- Iteration 15 --
 
@@ -198,7 +198,7 @@ Warning: exif_imagetype(obj'ct): failed to open stream: No such file or director
 bool(false)
 -- Iteration 24 --
 
-Warning: exif_imagetype() expects parameter 1 to be string, resource given in %s on line %d
+Warning: exif_imagetype() expects parameter 1 to be a valid path, resource given in %s on line %d
 NULL
 -- Iteration 25 --
 

ext/gd/gd_ctx.c

@@ -61,6 +61,16 @@ static int _php_image_stream_putbuf(struct gdIOCtx *ctx, const void* buf, int l)
 }
 
 static void _php_image_stream_ctxfree(struct gdIOCtx *ctx)
+{
+	if(ctx->data) {
+		ctx->data = NULL;
+	}
+	if(ctx) {
+		efree(ctx);
+	}
+} /* }}} */
+
+static void _php_image_stream_ctxfreeandclose(struct gdIOCtx *ctx) /* {{{ */
 {
 	TSRMLS_FETCH();
 
@@ -87,6 +97,7 @@ static void _php_image_output_ctx(INTERNAL_FUNCTION_PARAMETERS, int image_type,
 	gdIOCtx *ctx = NULL;
 	zval *to_zval = NULL;
 	php_stream *stream;
+	int close_stream = 1;
 
 	/* The third (quality) parameter for Wbmp stands for the threshold when called from image2wbmp().
 	 * The third (quality) parameter for Wbmp and Xbm stands for the foreground color index when called
@@ -123,6 +134,7 @@ static void _php_image_output_ctx(INTERNAL_FUNCTION_PARAMETERS, int image_type,
 			if (stream == NULL) {
 				RETURN_FALSE;
 			}
+			close_stream = 0;
 		} else if (Z_TYPE_P(to_zval) == IS_STRING) {
 			if (CHECK_ZVAL_NULL_PATH(to_zval)) {
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid 2nd parameter, filename must not contain null bytes");
@@ -159,7 +171,11 @@ static void _php_image_output_ctx(INTERNAL_FUNCTION_PARAMETERS, int image_type,
 		ctx = emalloc(sizeof(gdIOCtx));
 		ctx->putC = _php_image_stream_putc;
 		ctx->putBuf = _php_image_stream_putbuf;
-		ctx->gd_free = _php_image_stream_ctxfree;
+		if (close_stream) {
+			ctx->gd_free = _php_image_stream_ctxfreeandclose;
+		} else {
+			ctx->gd_free = _php_image_stream_ctxfree;
+		}
 		ctx->data = (void *)stream;
 	}
 

ext/gd/libgd/gd.c

@@ -1117,7 +1117,7 @@ void gdImageLine (gdImagePtr im, int x1, int y1, int x2, int y2, int color)
 	}
 
 	/* 2.0.10: Nick Atty: clip to edges of drawing rectangle, return if no points need to be drawn */
-	if (!clip_1d(&x1,&y1,&x2,&y2,gdImageSX(im)) || !clip_1d(&y1,&x1,&y2,&x2,gdImageSY(im))) {
+	if (!clip_1d(&x1,&y1,&x2,&y2,gdImageSX(im)-1) || !clip_1d(&y1,&x1,&y2,&x2,gdImageSY(im)-1)) {
 		return;
 	}
 
@@ -1301,55 +1301,10 @@ void gdImageAALine (gdImagePtr im, int x1, int y1, int x2, int y2, int col)
 	long x, y, inc, frac;
 	long dx, dy,tmp;
 
-	if (y1 < 0 && y2 < 0) {
+	/* 2.0.10: Nick Atty: clip to edges of drawing rectangle, return if no points need to be drawn */
+	if (!clip_1d(&x1,&y1,&x2,&y2,gdImageSX(im)-1) || !clip_1d(&y1,&x1,&y2,&x2,gdImageSY(im)-1)) {
 		return;
 	}
-	if (y1 < 0) {
-		x1 += (y1 * (x1 - x2)) / (y2 - y1);
-		y1 = 0;
-	}
-	if (y2 < 0) {
-		x2 += (y2 * (x1 - x2)) / (y2 - y1);
-		y2 = 0;
-	}
-
-	/* bottom edge */
-	if (y1 >= im->sy && y2 >= im->sy) {
-		return;
-	}
-	if (y1 >= im->sy) {
-		x1 -= ((im->sy - y1) * (x1 - x2)) / (y2 - y1);
-		y1 = im->sy - 1;
-	}
-	if (y2 >= im->sy) {
-		x2 -= ((im->sy - y2) * (x1 - x2)) / (y2 - y1);
-		y2 = im->sy - 1;
-	}
-
-	/* left edge */
-	if (x1 < 0 && x2 < 0) {
-		return;
-	}
-	if (x1 < 0) {
-		y1 += (x1 * (y1 - y2)) / (x2 - x1);
-		x1 = 0;
-	}
-	if (x2 < 0) {
-		y2 += (x2 * (y1 - y2)) / (x2 - x1);
-		x2 = 0;
-	}
-	/* right edge */
-	if (x1 >= im->sx && x2 >= im->sx) {
-		return;
-	}
-	if (x1 >= im->sx) {
-		y1 -= ((im->sx - x1) * (y1 - y2)) / (x2 - x1);
-		x1 = im->sx - 1;
-	}
-	if (x2 >= im->sx) {
-		y2 -= ((im->sx - x2) * (y1 - y2)) / (x2 - x1);
-		x2 = im->sx - 1;
-	}
 
 	dx = x2 - x1;
 	dy = y2 - y1;
@@ -1792,7 +1747,7 @@ void gdImageFillToBorder (gdImagePtr im, int x, int y, int border, int color)
 	int leftLimit = -1, rightLimit;
 	int i, restoreAlphaBlending = 0;
 
-	if (border < 0) {
+	if (border < 0 || color < 0) {
 		/* Refuse to fill to a non-solid border */
 		return;
 	}

ext/gd/libgd/gd_gd2.c

@@ -136,6 +136,10 @@ static int _gd2GetHeader(gdIOCtxPtr in, int *sx, int *sy, int *cs, int *vers, in
 	GD2_DBG(php_gd_error("%d Chunks vertically", *ncy));
 
 	if (gd2_compressed(*fmt)) {
+		if (*ncx <= 0 || *ncy <= 0 || *ncx > INT_MAX / *ncy) {
+			GD2_DBG(printf ("Illegal chunk counts: %d * %d\n", *ncx, *ncy));
+			goto fail1;
+		}
 		nc = (*ncx) * (*ncy);
 		GD2_DBG(php_gd_error("Reading %d chunk index entries", nc));
 		if (overflow2(sizeof(t_chunk_info), nc)) {
@@ -340,12 +344,16 @@ gdImagePtr gdImageCreateFromGd2Ctx (gdIOCtxPtr in)
 					for (x = xlo; x < xhi; x++) {
 						if (im->trueColor) {
 							if (!gdGetInt(&im->tpixels[y][x], in)) {
-								im->tpixels[y][x] = 0;
+								php_gd_error("gd2: EOF while reading\n");
+								gdImageDestroy(im);
+								return NULL;
 							}
 						} else {
 							int ch;
 							if (!gdGetByte(&ch, in)) {
-								ch = 0;
+								php_gd_error("gd2: EOF while reading\n");
+								gdImageDestroy(im);
+								return NULL;
 							}
 							im->pixels[y][x] = ch;
 						}

ext/gd/tests/bug72482.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Bug #72482 (Ilegal write/read access caused by gdImageAALine overflow)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$img = imagecreatetruecolor(13, 1007);
+imageantialias($img, true);
+imageline($img, 0, 0, 1073745919, 1073745919, 4096);
+
+$img = imagecreatetruecolor(100, 100);
+imageantialias($img, true);
+imageline($img, 1094795585, 0, 2147483647, 255, 0xff);
+?>
+===DONE===
+--EXPECT--
+===DONE===

ext/gd/tests/bug72482_2.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Bug 72482 (Ilegal write/read access caused by gdImageAALine overflow)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+require_once __DIR__ . DIRECTORY_SEPARATOR . 'func.inc';
+
+$im = imagecreatetruecolor(10, 10);
+imagefilledrectangle($im, 0, 0, 9, 9, imagecolorallocate($im, 255, 255, 255));
+imageantialias($im, true);
+imageline($im, 0, 0, 10, 10, imagecolorallocate($im, 0, 0, 0));
+
+test_image_equals_file(__DIR__ . DIRECTORY_SEPARATOR . 'bug72482_2.png', $im);
+?>
+===DONE===
+--EXPECT--
+The images are equal.
+===DONE===

ext/gd/tests/bug72696.phpt

@@ -0,0 +1,14 @@
+--TEST--
+Bug #72696 (imagefilltoborder stackoverflow on truecolor images)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$im = imagecreatetruecolor(10, 10);
+imagefilltoborder($im, 0, 0, 1, -2);
+?>
+===DONE===
+--EXPECT--
+===DONE===

ext/gd/tests/bug73549.phpt

@@ -0,0 +1,22 @@
+--TEST--
+Bug #73549 (Use after free when stream is passed to imagepng)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$stream = fopen(__DIR__ . DIRECTORY_SEPARATOR . 'bug73549.png', 'w');
+$im = imagecreatetruecolor(8, 8);
+var_dump(imagepng($im, $stream));
+var_dump($stream);
+?>
+===DONE===
+--EXPECTF--
+bool(true)
+resource(%d) of type (stream)
+===DONE===
+--CLEAN--
+<?php
+unlink(__DIR__ . DIRECTORY_SEPARATOR . 'bug73549.png');
+?>

ext/gd/tests/bug73868.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug 73868 (DOS vulnerability in gdImageCreateFromGd2Ctx())
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+var_dump(imagecreatefromgd2(__DIR__ . DIRECTORY_SEPARATOR . 'bug73868.gd2'));
+?>
+===DONE===
+--EXPECTF--
+Warning: imagecreatefromgd2(): gd2: EOF while reading
+ in %s on line %d
+
+Warning: imagecreatefromgd2(): '%s' is not a valid GD2 file in %s on line %d
+bool(false)
+===DONE===

ext/gd/tests/bug73869.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Bug #73869 (Signed Integer Overflow gd_io.c)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+var_dump(imagecreatefromgd2(__DIR__ . DIRECTORY_SEPARATOR . 'bug73869a.gd2'));
+var_dump(imagecreatefromgd2(__DIR__ . DIRECTORY_SEPARATOR . 'bug73869b.gd2'));
+?>
+===DONE===
+--EXPECTF--
+Warning: imagecreatefromgd2(): '%s' is not a valid GD2 file in %s on line %d
+bool(false)
+
+Warning: imagecreatefromgd2(): '%s' is not a valid GD2 file in %s on line %d
+bool(false)
+===DONE===

ext/gd/tests/imagettftext_charmap_order.phpt

@@ -4,6 +4,7 @@ Font charmap order is deterministic based on order in the font, use the selected
 <?php
 	if(!extension_loaded('gd')){ die('skip gd extension not available'); }
 	if(!function_exists('imagettftext')) die('skip imagettftext() not available');
+  if(gd_info()['JIS-mapped Japanese Font Support']) die('skip JIS-mapped Japanese Font Support not supported');
 ?>
 --FILE--
 <?php

ext/iconv/iconv.c

@@ -2491,7 +2491,7 @@ PHP_NAMED_FUNCTION(php_if_iconv)
 		&out_buffer, &out_len, out_charset, in_charset);
 	_php_iconv_show_error(err, out_charset, in_charset TSRMLS_CC);
 	if (err == PHP_ICONV_ERR_SUCCESS && out_buffer != NULL) {
-		RETVAL_STRINGL(out_buffer, out_len, 0);
+		RETVAL_STRINGL_CHECK(out_buffer, out_len, 0);
 	} else {
 		if (out_buffer != NULL) {
 			efree(out_buffer);

ext/imap/php_imap.c

@@ -3900,7 +3900,7 @@ int _php_imap_mail(char *to, char *subject, char *message, char *headers, char *
 	char *tsm_errmsg = NULL;
 	ADDRESS *addr;
 	char *bufferTo = NULL, *bufferCc = NULL, *bufferBcc = NULL, *bufferHeader = NULL;
-	int offset, bufferLen = 0;
+	size_t offset, bufferLen = 0;
 	size_t bt_len;
 
 	if (headers) {
@@ -3916,7 +3916,7 @@ int _php_imap_mail(char *to, char *subject, char *message, char *headers, char *
 #define PHP_IMAP_CLEAN	if (bufferTo) efree(bufferTo); if (bufferCc) efree(bufferCc); if (bufferBcc) efree(bufferBcc); if (bufferHeader) efree(bufferHeader);
 #define PHP_IMAP_BAD_DEST PHP_IMAP_CLEAN; efree(tempMailTo); return (BAD_MSG_DESTINATION);
 
-	bufferHeader = (char *)emalloc(bufferLen + 1);
+	bufferHeader = (char *)safe_emalloc(bufferLen, 1, 1);
 	memset(bufferHeader, 0, bufferLen);
 	if (to && *to) {
 		strlcat(bufferHeader, "To: ", bufferLen + 1);

ext/intl/breakiterator/breakiterator_iterators.cpp

@@ -182,7 +182,7 @@ static void _breakiterator_parts_move_forward(zend_object_iterator *iter TSRMLS_
 	}
 	assert(next <= slen && next >= cur);
 	len = next - cur;
-	res = static_cast<char*>(emalloc(len + 1));
+	res = static_cast<char*>(safe_emalloc(len, 1, 1));
 
 	memcpy(res, &s[cur], len);
 	res[len] = '\0';

ext/intl/collator/collator.h

@@ -16,7 +16,7 @@
  */
 
 #ifndef COLLATOR_COLLATOR_H
-#define CCOLLATOR_COLLATOR_H
+#define COLLATOR_COLLATOR_H
 
 #include <php.h>
 

ext/intl/grapheme/grapheme_string.c

@@ -702,8 +702,10 @@ PHP_FUNCTION(grapheme_stristr)
 static inline int32_t
 grapheme_extract_charcount_iter(UBreakIterator *bi, int32_t csize, unsigned char *pstr, int32_t str_len)
 {
-	int pos = 0, prev_pos = 0;
-	int ret_pos = 0, prev_ret_pos = 0;
+	int pos = 0;
+	int ret_pos = 0;
+	int break_pos, prev_break_pos;
+	int count = 0;
 
 	while ( 1 ) {
 		pos = ubrk_next(bi);
@@ -712,23 +714,24 @@ grapheme_extract_charcount_iter(UBreakIterator *bi, int32_t csize, unsigned char
 			break;
 		}
 
+		for ( break_pos = ret_pos; break_pos < pos; ) {
+			count++;
+			prev_break_pos = break_pos;
+			U8_FWD_1(pstr, break_pos, str_len);
+
+			if ( prev_break_pos == break_pos ) {
+				/* something wrong - malformed utf8? */
+				csize = 0;
+				break;
+			}
+		}
+
 		/* if we are beyond our limit, then the loop is done */
-		if ( pos > csize ) {
+		if ( count > csize ) {
 			break;
 		}
 
-		/* update our pointer in the original UTF-8 buffer by as many characters
-		   as ubrk_next iterated over */
-
-		prev_ret_pos = ret_pos;
-		U8_FWD_N(pstr, ret_pos, str_len, pos - prev_pos);
-
-		if ( prev_ret_pos == ret_pos ) {
-			/* something wrong - malformed utf8? */
-			break;
-		}
-
-		prev_pos = pos;
+		ret_pos = break_pos;
 	}
 
 	return ret_pos;
@@ -739,8 +742,8 @@ grapheme_extract_charcount_iter(UBreakIterator *bi, int32_t csize, unsigned char
 static inline int32_t
 grapheme_extract_bytecount_iter(UBreakIterator *bi, int32_t bsize, unsigned char *pstr, int32_t str_len)
 {
-	int pos = 0, prev_pos = 0;
-	int ret_pos = 0, prev_ret_pos = 0;
+	int pos = 0;
+	int ret_pos = 0;
 
 	while ( 1 ) {
 		pos = ubrk_next(bi);
@@ -749,20 +752,11 @@ grapheme_extract_bytecount_iter(UBreakIterator *bi, int32_t bsize, unsigned char
 			break;
 		}
 
-		prev_ret_pos = ret_pos;
-		U8_FWD_N(pstr, ret_pos, str_len, pos - prev_pos);
-
-		if ( ret_pos > bsize ) {
-			ret_pos = prev_ret_pos;
+		if ( pos > bsize ) {
 			break;
 		}
 
-		if ( prev_ret_pos == ret_pos ) {
-			/* something wrong - malformed utf8? */
-			break;
-		}
-
-		prev_pos = pos;
+		ret_pos = pos;
 	}
 
 	return ret_pos;
@@ -773,7 +767,7 @@ grapheme_extract_bytecount_iter(UBreakIterator *bi, int32_t bsize, unsigned char
 static inline int32_t
 grapheme_extract_count_iter(UBreakIterator *bi, int32_t size, unsigned char *pstr, int32_t str_len)
 {
-	int pos = 0, next_pos = 0;
+	int next_pos = 0;
 	int ret_pos = 0;
 
 	while ( size ) {
@@ -782,16 +776,10 @@ grapheme_extract_count_iter(UBreakIterator *bi, int32_t size, unsigned char *pst
 		if ( UBRK_DONE == next_pos ) {
 			break;
 		}
-		pos = next_pos;
+		ret_pos = next_pos;
 		size--;
 	}
 
-	/* pos is one past the last UChar - and represent the number of code units to
-		advance in the utf-8 buffer
-	*/
-
-	U8_FWD_N(pstr, ret_pos, str_len, pos);
-
 	return ret_pos;
 }
 /* }}} */
@@ -810,9 +798,9 @@ static grapheme_extract_iter grapheme_extract_iters[] = {
 	Function to extract a sequence of default grapheme clusters */
 PHP_FUNCTION(grapheme_extract)
 {
-	unsigned char *str, *pstr;
-	UChar *ustr;
-	int str_len, ustr_len;
+	char *str, *pstr;
+	UText ut = UTEXT_INITIALIZER;
+	int str_len;
 	long size; /* maximum number of grapheme clusters, bytes, or characters (based on extract_type) to return */
 	long lstart = 0; /* starting position in str in bytes */
 	int32_t start = 0;
@@ -900,21 +888,15 @@ PHP_FUNCTION(grapheme_extract)
 		RETURN_STRINGL(((char *)pstr), nsize, 1);
 	}
 
-	/* convert the strings to UTF-16. */
-	ustr = NULL;
-	ustr_len = 0;
 	status = U_ZERO_ERROR;
-	intl_convert_utf8_to_utf16(&ustr, &ustr_len, (char *)pstr, str_len, &status );
+	utext_openUTF8(&ut, pstr, str_len, &status);
 
 	if ( U_FAILURE( status ) ) {
 		/* Set global error code. */
 		intl_error_set_code( NULL, status TSRMLS_CC );
 
 		/* Set error messages. */
-		intl_error_set_custom_msg( NULL, "Error converting input string to UTF-16", 0 TSRMLS_CC );
-
-		if ( NULL != ustr )
-			efree( ustr );
+		intl_error_set_custom_msg( NULL, "Error opening UTF-8 text", 0 TSRMLS_CC );
 
 		RETURN_FALSE;
 	}
@@ -923,8 +905,7 @@ PHP_FUNCTION(grapheme_extract)
 	status = U_ZERO_ERROR;
 	bi = grapheme_get_break_iterator(u_break_iterator_buffer, &status TSRMLS_CC );
 
-	ubrk_setText(bi, ustr, ustr_len, &status);
-
+	ubrk_setUText(bi, &ut, &status);
 	/* if the caller put us in the middle of a grapheme, we can't detect it in all cases since we
 		can't back up. So, we will not do anything. */
 
@@ -932,9 +913,7 @@ PHP_FUNCTION(grapheme_extract)
 
 	ret_pos = (*grapheme_extract_iters[extract_type])(bi, size, pstr, str_len);
 
-	if (ustr) {
-		efree(ustr);
-	}
+	utext_close(&ut);
 	ubrk_close(bi);
 
 	if ( NULL != next ) {

ext/intl/intl_convert.c

@@ -49,7 +49,7 @@ void intl_convert_utf8_to_utf16(
 	UErrorCode* status )
 {
 	UChar*      dst_buf = NULL;
-	int32_t     dst_len = 0;
+	uint32_t    dst_len = 0;
 
 	/* If *target is NULL determine required destination buffer size (pre-flighting).
 	 * Otherwise, attempt to convert source string; if *target buffer is not large enough

ext/intl/locale/locale_methods.c

@@ -263,6 +263,9 @@ static char* get_icu_value_internal( const char* loc_name , char* tag_name, int*
 	int32_t     	buflen          = 512;
 	UErrorCode  	status          = U_ZERO_ERROR;
 
+	if (strlen(loc_name) > INTL_MAX_LOCALE_LEN) {
+		return NULL;
+	}
 
 	if( strcmp(tag_name, LOC_CANONICALIZE_TAG) != 0 ){
 		/* Handle  grandfathered languages */
@@ -395,7 +398,7 @@ static void get_icu_value_src_php( char* tag_name, INTERNAL_FUNCTION_PARAMETERS)
 	if(loc_name_len == 0) {
 		loc_name = intl_locale_get_default(TSRMLS_C);
 	}
-	
+
 	INTL_CHECK_LOCALE_LEN(strlen(loc_name));
 
 	/* Call ICU get */
@@ -702,6 +705,8 @@ PHP_FUNCTION( locale_get_keywords )
         RETURN_FALSE;
     }
 
+	INTL_CHECK_LOCALE_LEN(strlen(loc_name));
+
     if(loc_name_len == 0) {
         loc_name = intl_locale_get_default(TSRMLS_C);
     }
@@ -1109,6 +1114,8 @@ PHP_FUNCTION(locale_parse)
         RETURN_FALSE;
     }
 
+    INTL_CHECK_LOCALE_LEN(strlen(loc_name));
+
     if(loc_name_len == 0) {
         loc_name = intl_locale_get_default(TSRMLS_C);
     }

ext/intl/msgformat/msgformat_data.c

@@ -80,10 +80,10 @@ msgformat_data* msgformat_data_create( TSRMLS_D )
 /* }}} */
 
 #ifdef MSG_FORMAT_QUOTE_APOS
-int msgformat_fix_quotes(UChar **spattern, uint32_t *spattern_len, UErrorCode *ec) 
+int msgformat_fix_quotes(UChar **spattern, uint32_t *spattern_len, UErrorCode *ec)
 {
 	if(*spattern && *spattern_len && u_strchr(*spattern, (UChar)'\'')) {
-		UChar *npattern = emalloc(sizeof(UChar)*(2*(*spattern_len)+1));
+		UChar *npattern = safe_emalloc(sizeof(UChar)*2, *spattern_len, sizeof(UChar));
 		uint32_t npattern_len;
 		npattern_len = umsg_autoQuoteApostrophe(*spattern, *spattern_len, npattern, 2*(*spattern_len)+1, ec);
 		efree(*spattern);

ext/intl/tests/bug68447.phpt

@@ -0,0 +1,28 @@
+--TEST--
+Bug #68447: grapheme_extract take an extra trailing character
+--SKIPIF--
+<?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?>
+--FILE--
+<?php
+$katsushikaku = "葛󠄁飾区";
+echo grapheme_extract($katsushikaku, 1) . "\n";
+
+$haiyore = "這󠄀いよれ";
+echo grapheme_extract($haiyore, 1, GRAPHEME_EXTR_COUNT) . "\n";
+echo grapheme_extract($haiyore, 2, GRAPHEME_EXTR_COUNT) . "\n";
+echo grapheme_extract($haiyore, 6, GRAPHEME_EXTR_MAXBYTES) . "\n";
+echo grapheme_extract($haiyore, 9, GRAPHEME_EXTR_MAXBYTES) . "\n";
+echo grapheme_extract($haiyore, 12, GRAPHEME_EXTR_MAXBYTES) . "\n";
+echo grapheme_extract($haiyore, 1, GRAPHEME_EXTR_MAXCHARS) . "\n";
+echo grapheme_extract($haiyore, 2, GRAPHEME_EXTR_MAXCHARS) . "\n";
+echo grapheme_extract($haiyore, 3, GRAPHEME_EXTR_MAXCHARS) . "\n";
+--EXPECT--
+葛󠄁
+這󠄀
+這󠄀い
+
+這󠄀
+這󠄀い
+
+這󠄀
+這󠄀い

ext/mbstring/libmbfl/mbfl/mbfl_memory_device.c

@@ -5,7 +5,7 @@
  * LICENSE NOTICES
  *
  * This file is part of "streamable kanji code filter and converter",
- * which is distributed under the terms of GNU Lesser General Public 
+ * which is distributed under the terms of GNU Lesser General Public
  * License (version 2) as published by the Free Software Foundation.
  *
  * This software is distributed in the hope that it will be useful,
@@ -146,6 +146,10 @@ mbfl_memory_device_output(int c, void *data)
 		unsigned char *tmp;
 
 		newlen = device->length + device->allocsz;
+		if (newlen <= 0) {
+			/* overflow */
+			return -1;
+		}
 		tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char));
 		if (tmp == NULL) {
 			return -1;
@@ -169,6 +173,10 @@ mbfl_memory_device_output2(int c, void *data)
 		unsigned char *tmp;
 
 		newlen = device->length + device->allocsz;
+		if (newlen <= 0) {
+			/* overflow */
+			return -1;
+		}
 		tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char));
 		if (tmp == NULL) {
 			return -1;
@@ -194,6 +202,10 @@ mbfl_memory_device_output4(int c, void* data)
 		unsigned char *tmp;
 
 		newlen = device->length + device->allocsz;
+		if (newlen <= 0) {
+			/* overflow */
+			return -1;
+		}
 		tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char));
 		if (tmp == NULL) {
 			return -1;
@@ -227,7 +239,12 @@ mbfl_memory_device_strcat(mbfl_memory_device *device, const char *psrc)
 	if ((device->pos + len) >= device->length) {
 		/* reallocate buffer */
 		int newlen = device->length + (len + MBFL_MEMORY_DEVICE_ALLOC_SIZE)*sizeof(unsigned char);
-		unsigned char *tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char));
+		unsigned char *tmp;
+		if (newlen <= 0) {
+			/* overflow */
+			return -1;
+		}
+		tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char));
 		if (tmp == NULL) {
 			return -1;
 		}
@@ -254,7 +271,12 @@ mbfl_memory_device_strncat(mbfl_memory_device *device, const char *psrc, int len
 	if ((device->pos + len) >= device->length) {
 		/* reallocate buffer */
 		int newlen = device->length + len + MBFL_MEMORY_DEVICE_ALLOC_SIZE;
-		unsigned char *tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char));
+		unsigned char *tmp;
+		if (newlen <= 0) {
+			/* overflow */
+			return -1;
+		}
+		tmp = (unsigned char *)mbfl_realloc((void *)device->buffer, newlen*sizeof(unsigned char));
 		if (tmp == NULL) {
 			return -1;
 		}
@@ -281,7 +303,12 @@ mbfl_memory_device_devcat(mbfl_memory_device *dest, mbfl_memory_device *src)
 	if ((dest->pos + src->pos) >= dest->length) {
 		/* reallocate buffer */
 		int newlen = dest->length + src->pos + MBFL_MEMORY_DEVICE_ALLOC_SIZE;
-		unsigned char *tmp = (unsigned char *)mbfl_realloc((void *)dest->buffer, newlen*sizeof(unsigned char));
+		unsigned char *tmp;
+		if (newlen <= 0) {
+			/* overflow */
+			return -1;
+		}
+		tmp = (unsigned char *)mbfl_realloc((void *)dest->buffer, newlen*sizeof(unsigned char));
 		if (tmp == NULL) {
 			return -1;
 		}
@@ -336,6 +363,10 @@ mbfl_wchar_device_output(int c, void *data)
 		unsigned int *tmp;
 
 		newlen = device->length + device->allocsz;
+		if (newlen <= 0) {
+			/* overflow */
+			return -1;
+		}
 		tmp = (unsigned int *)mbfl_realloc((void *)device->buffer, newlen*sizeof(int));
 		if (tmp == NULL) {
 			return -1;

ext/opcache/Optimizer/zend_optimizer.c

@@ -157,7 +157,7 @@ static void update_op1_const(zend_op_array *op_array,
 					opline->op1.constant = zend_optimizer_add_literal(op_array, val TSRMLS_CC);
 					Z_HASH_P(&ZEND_OP1_LITERAL(opline)) = zend_hash_func(Z_STRVAL(ZEND_OP1_LITERAL(opline)), Z_STRLEN(ZEND_OP1_LITERAL(opline)) + 1);
 					op_array->literals[opline->op1.constant].cache_slot = op_array->last_cache_slot++;
-					zend_str_tolower(Z_STRVAL_P(val), Z_STRLEN_P(val));
+					Z_STRVAL_P(val) = zend_str_tolower_dup(Z_STRVAL_P(val), Z_STRLEN_P(val));
 					zend_optimizer_add_literal(op_array, val TSRMLS_CC);
 					op_array->literals[opline->op1.constant+1].hash_value = zend_hash_func(Z_STRVAL(op_array->literals[opline->op1.constant+1].constant), Z_STRLEN(op_array->literals[opline->op1.constant+1].constant) + 1);
 					break;
@@ -205,13 +205,13 @@ static void update_op2_const(zend_op_array *op_array,
 			case ZEND_ADD_INTERFACE:
 			case ZEND_ADD_TRAIT:
 				op_array->literals[opline->op2.constant].cache_slot = op_array->last_cache_slot++;
-				zend_str_tolower(Z_STRVAL_P(val), Z_STRLEN_P(val));
+				Z_STRVAL_P(val) = zend_str_tolower_dup(Z_STRVAL_P(val), Z_STRLEN_P(val));
 				zend_optimizer_add_literal(op_array, val TSRMLS_CC);
 				op_array->literals[opline->op2.constant+1].hash_value = zend_hash_func(Z_STRVAL(op_array->literals[opline->op2.constant+1].constant), Z_STRLEN(op_array->literals[opline->op2.constant+1].constant) + 1);
 				break;
 			case ZEND_INIT_METHOD_CALL:
 			case ZEND_INIT_STATIC_METHOD_CALL:
-				zend_str_tolower(Z_STRVAL_P(val), Z_STRLEN_P(val));
+				Z_STRVAL_P(val) = zend_str_tolower_dup(Z_STRVAL_P(val), Z_STRLEN_P(val));
 				zend_optimizer_add_literal(op_array, val TSRMLS_CC);
 				op_array->literals[opline->op2.constant+1].hash_value = zend_hash_func(Z_STRVAL(op_array->literals[opline->op2.constant+1].constant), Z_STRLEN(op_array->literals[opline->op2.constant+1].constant) + 1);
 				/* break missing intentionally */						

ext/opcache/README

@@ -102,6 +102,16 @@ opcache.validate_timestamps (default "1")
 	The frequency of the check is controlled by the directive
 	"opcache.revalidate_freq".
 
+opcache.validate_permission (default "0")
+	Leads OPcache to check file readability on each access to cached file.
+	This directive should be enabled in shared hosting environment, when few
+	users (PHP-FPM pools) reuse the common OPcache shared memory.
+
+opcache.validate_root (default "0")
+	This directive prevents file name collisions in different "chroot"
+	environments. It should be enabled for sites that may serve requests in
+	different "chroot" environments.
+
 opcache.revalidate_freq (default "2")
 	How often (in seconds) to check file timestamps for changes to the shared
 	memory storage allocation. ("1" means validate once per second, but only

ext/opcache/ZendAccelerator.c

@@ -1592,6 +1592,28 @@ zend_op_array *persistent_compile_file(zend_file_handle *file_handle, int type T
 		persistent_script = NULL;
 	}
 
+	/* Revalidate acessibility of cached file */
+	if (EXPECTED(persistent_script != NULL) &&
+	    UNEXPECTED(ZCG(accel_directives).validate_permission) &&
+	    file_handle->type == ZEND_HANDLE_FILENAME &&
+	    UNEXPECTED(access(persistent_script->full_path, R_OK) != 0)) {
+		if (type == ZEND_REQUIRE) {
+#if ZEND_EXTENSION_API_NO < PHP_5_3_X_API_NO
+			zend_message_dispatcher(ZMSG_FAILED_REQUIRE_FOPEN, file_handle->filename);
+#else
+			zend_message_dispatcher(ZMSG_FAILED_REQUIRE_FOPEN, file_handle->filename TSRMLS_CC);
+#endif
+			zend_bailout();
+		} else {
+#if ZEND_EXTENSION_API_NO < PHP_5_3_X_API_NO
+			zend_message_dispatcher(ZMSG_FAILED_INCLUDE_FOPEN, file_handle->filename);
+#else
+			zend_message_dispatcher(ZMSG_FAILED_INCLUDE_FOPEN, file_handle->filename TSRMLS_CC);
+#endif
+		}
+		return NULL;
+	}
+
 	SHM_UNPROTECT();
 
 	/* If script is found then validate_timestamps if option is enabled */
@@ -2126,6 +2148,27 @@ static void accel_activate(void)
 		return;
 	}
 
+#ifndef ZEND_WIN32
+	if (ZCG(accel_directives).validate_root) {
+		struct stat buf;
+
+		if (stat("/", &buf) != 0) {
+			ZCG(root_hash) = 0;
+		} else {
+			ZCG(root_hash) = buf.st_ino;
+			if (sizeof(buf.st_ino) > sizeof(ZCG(root_hash))) {
+				if (ZCG(root_hash) != buf.st_ino) {
+					zend_alter_ini_entry("opcache.enable", sizeof("opcache.enable"), "0", 1, ZEND_INI_SYSTEM, ZEND_INI_STAGE_RUNTIME);
+					zend_accel_error(ACCEL_LOG_WARNING, "Can't cache files in chroot() directory with too big inode");
+					return;
+				}
+			}
+		}
+	} else {
+		ZCG(root_hash) = 0;
+	}
+#endif
+
 	SHM_UNPROTECT();
 	/* PHP-5.4 and above return "double", but we use 1 sec precision */
 	ZCG(request_time) = (time_t)sapi_get_request_time(TSRMLS_C);

ext/opcache/ZendAccelerator.h

@@ -230,6 +230,10 @@ typedef struct _zend_accel_directives {
 	zend_bool      file_override_enabled;
 	zend_bool      inherited_hack;
 	zend_bool      enable_cli;
+	zend_bool      validate_permission;
+#ifndef ZEND_WIN32
+	zend_bool      validate_root;
+#endif
 	unsigned long  revalidate_freq;
 	unsigned long  file_update_protection;
 	char          *error_log;
@@ -264,6 +268,9 @@ typedef struct _zend_accel_globals {
 	int                     include_path_len; /* "include_path" string length */
 	int                     include_path_check;
 	time_t                  request_time;
+#ifndef ZEND_WIN32
+	unsigned long           root_hash;
+#endif
 	/* preallocated shared-memory block to save current script */
 	void                   *mem;
 	/* cache to save hash lookup on the same INCLUDE opcode */

ext/opcache/tests/bug73402.phpt

@@ -0,0 +1,29 @@
+--TEST--
+Bug #73402 (Opcache segfault when using class constant to call a method)
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+class Logger {
+	public function info($msg) {
+		echo $msg;
+	}
+}
+
+class B
+{
+	const LOG_LEVEL = 'Info';
+	public function test()
+	{
+		$logger = new \Logger();
+		$logger->{self::LOG_LEVEL}('test');
+	}
+}
+
+$b = new B;
+$b->test();
+--EXPECT--
+test

ext/opcache/zend_accelerator_hash.c

@@ -77,6 +77,9 @@ zend_accel_hash_entry* zend_accel_hash_update(zend_accel_hash *accel_hash, char
 	zend_ulong index;
 	zend_accel_hash_entry *entry;
 	zend_accel_hash_entry *indirect_bucket = NULL;
+#ifndef ZEND_WIN32
+	TSRMLS_FETCH();
+#endif
 
 	if (indirect) {
 		indirect_bucket = (zend_accel_hash_entry*)data;
@@ -86,6 +89,9 @@ zend_accel_hash_entry* zend_accel_hash_update(zend_accel_hash *accel_hash, char
 	}
 
 	hash_value = zend_inline_hash_func(key, key_length);
+#ifndef ZEND_WIN32
+	hash_value ^= ZCG(root_hash);
+#endif
 	index = hash_value % accel_hash->max_num_entries;
 
 	/* try to see if the element already exists in the hash */
@@ -145,8 +151,14 @@ void* zend_accel_hash_find(zend_accel_hash *accel_hash, char *key, zend_uint key
 	zend_ulong hash_value;
 	zend_ulong index;
 	zend_accel_hash_entry *entry;
+#ifndef ZEND_WIN32
+	TSRMLS_FETCH();
+#endif
 
 	hash_value = zend_inline_hash_func(key, key_length);
+#ifndef ZEND_WIN32
+	hash_value ^= ZCG(root_hash);
+#endif
 	index = hash_value % accel_hash->max_num_entries;
 
 	entry = accel_hash->hash_table[index];
@@ -173,8 +185,14 @@ zend_accel_hash_entry* zend_accel_hash_find_entry(zend_accel_hash *accel_hash, c
 	zend_ulong hash_value;
 	zend_ulong index;
 	zend_accel_hash_entry *entry;
+#ifndef ZEND_WIN32
+	TSRMLS_FETCH();
+#endif
 
 	hash_value = zend_inline_hash_func(key, key_length);
+#ifndef ZEND_WIN32
+	hash_value ^= ZCG(root_hash);
+#endif
 	index = hash_value % accel_hash->max_num_entries;
 
 	entry = accel_hash->hash_table[index];
@@ -198,8 +216,14 @@ int zend_accel_hash_unlink(zend_accel_hash *accel_hash, char *key, zend_uint key
 	zend_ulong hash_value;
     zend_ulong index;
     zend_accel_hash_entry *entry, *last_entry=NULL;
+#ifndef ZEND_WIN32
+	TSRMLS_FETCH();
+#endif
 
 	hash_value = zend_inline_hash_func(key, key_length);
+#ifndef ZEND_WIN32
+	hash_value ^= ZCG(root_hash);
+#endif
 	index = hash_value % accel_hash->max_num_entries;
 
 	entry = accel_hash->hash_table[index];

ext/opcache/zend_accelerator_module.c

@@ -255,6 +255,10 @@ ZEND_INI_BEGIN()
     STD_PHP_INI_BOOLEAN("opcache.enable"             , "1", PHP_INI_ALL,    OnEnable,     enabled                             , zend_accel_globals, accel_globals)
 	STD_PHP_INI_BOOLEAN("opcache.use_cwd"            , "1", PHP_INI_SYSTEM, OnUpdateBool, accel_directives.use_cwd            , zend_accel_globals, accel_globals)
 	STD_PHP_INI_BOOLEAN("opcache.validate_timestamps", "1", PHP_INI_ALL   , OnUpdateBool, accel_directives.validate_timestamps, zend_accel_globals, accel_globals)
+	STD_PHP_INI_BOOLEAN("opcache.validate_permission", "0", PHP_INI_SYSTEM, OnUpdateBool, accel_directives.validate_permission, zend_accel_globals, accel_globals)
+#ifndef ZEND_WIN32
+	STD_PHP_INI_BOOLEAN("opcache.validate_root"      , "0", PHP_INI_SYSTEM, OnUpdateBool, accel_directives.validate_root      , zend_accel_globals, accel_globals)
+#endif
 	STD_PHP_INI_BOOLEAN("opcache.inherited_hack"     , "1", PHP_INI_SYSTEM, OnUpdateBool, accel_directives.inherited_hack     , zend_accel_globals, accel_globals)
 	STD_PHP_INI_BOOLEAN("opcache.dups_fix"           , "0", PHP_INI_ALL   , OnUpdateBool, accel_directives.ignore_dups        , zend_accel_globals, accel_globals)
 	STD_PHP_INI_BOOLEAN("opcache.revalidate_path"    , "0", PHP_INI_ALL   , OnUpdateBool, accel_directives.revalidate_path    , zend_accel_globals, accel_globals)
@@ -663,6 +667,10 @@ static ZEND_FUNCTION(opcache_get_configuration)
 	add_assoc_bool(directives, "opcache.enable_cli",          ZCG(accel_directives).enable_cli);
 	add_assoc_bool(directives, "opcache.use_cwd",             ZCG(accel_directives).use_cwd);
 	add_assoc_bool(directives, "opcache.validate_timestamps", ZCG(accel_directives).validate_timestamps);
+	add_assoc_bool(directives, "opcache.validate_permission", ZCG(accel_directives).validate_permission);
+#ifndef ZEND_WIN32
+	add_assoc_bool(directives, "opcache.validate_root",       ZCG(accel_directives).validate_root);
+#endif
 	add_assoc_bool(directives, "opcache.inherited_hack",      ZCG(accel_directives).inherited_hack);
 	add_assoc_bool(directives, "opcache.dups_fix",            ZCG(accel_directives).ignore_dups);
 	add_assoc_bool(directives, "opcache.revalidate_path",     ZCG(accel_directives).revalidate_path);

ext/openssl/openssl.c

@@ -4059,7 +4059,7 @@ PHP_FUNCTION(openssl_pbkdf2)
 		return;
 	}
 
-	if (key_length <= 0) {
+	if (key_length <= 0 || key_length > INT_MAX) {
 		RETURN_FALSE;
 	}
 

ext/openssl/tests/openssl_pkey_new_basic.phpt

@@ -86,8 +86,8 @@ $details = openssl_pkey_get_details($dh);
 $dh_details = $details['dh'];
 openssl_pkey_test_cmp($phex, $dh_details['p']);
 var_dump($dh_details['g']);
-var_dump(strlen($dh_details['pub_key']));
-var_dump(strlen($dh_details['priv_key']));
+var_dump(strlen($dh_details['pub_key']) > 0);
+var_dump(strlen($dh_details['priv_key']) > 0);
 ?>
 --EXPECT--
 int(0)
@@ -102,5 +102,5 @@ int(20)
 int(128)
 int(0)
 string(1) "2"
-int(128)
-int(128)
+bool(true)
+bool(true)

ext/pdo/pdo_stmt.c

@@ -2338,6 +2338,7 @@ void pdo_stmt_init(TSRMLS_D)
 	pdo_row_ce->ce_flags |= ZEND_ACC_FINAL_CLASS; /* when removing this a lot of handlers need to be redone */
 	pdo_row_ce->create_object = pdo_row_new;
 	pdo_row_ce->serialize = pdo_row_serialize;
+	pdo_row_ce->unserialize = zend_class_unserialize_deny;
 }
 
 static void free_statement(pdo_stmt_t *stmt TSRMLS_DC)

ext/pdo_mysql/tests/pdo_mysql_exec_load_data.phpt

@@ -16,6 +16,17 @@ if (count($tmp) < 2)
 if (($tmp[1] !== 'localhost') && ($tmp[1] !== '127.0.0.1'))
 	die("skip Test cannot be run against remote database server");
 
+$stmt = $db->query("SHOW VARIABLES LIKE 'secure_file_priv'");
+if (($row = $stmt->fetch(PDO::FETCH_ASSOC)) && ($row['value'] != '')) {
+	if (!is_writable($row['value']))
+		die("skip secure_file_priv directory not writable: {$row['value']}");
+
+	$filename = $row['value'] . DIRECTORY_SEPARATOR  . "pdo_mysql_exec_load_data.csv";
+
+	if (file_exists($filename) && !is_writable($filename))
+		die("skip {$filename} not writable");
+}
+
 ?>
 --FILE--
 <?php

ext/pdo_mysql/tests/pdo_mysql_prepare_load_data.phpt

@@ -16,6 +16,17 @@ if (count($tmp) < 2)
 if (($tmp[1] !== 'localhost') && ($tmp[1] !== '127.0.0.1'))
 	die("skip Test cannot be run against remote database server");
 
+$stmt = $db->query("SHOW VARIABLES LIKE 'secure_file_priv'");
+if (($row = $stmt->fetch(PDO::FETCH_ASSOC)) && ($row['value'] != '')) {
+    if (!is_writable($row['value']))
+        die("skip secure_file_priv directory not writable: {$row['value']}");
+
+    $filename = $row['value'] . DIRECTORY_SEPARATOR  . "pdo_mysql_exec_load_data.csv";
+
+    if (file_exists($filename) && !is_writable($filename))
+        die("skip {$filename} not writable");
+}
+
 ?>
 --FILE--
 <?php
@@ -115,4 +126,4 @@ Warning: PDOStatement::execute(): SQLSTATE[HY000]: General error: %s in %s on li
   1 => %d,
   2 => %s,
 )
-done!
+done!

ext/pgsql/pgsql.c

@@ -4054,7 +4054,7 @@ PHP_FUNCTION(pg_copy_to)
 		free_pg_null = 1;
 	}
 
-	spprintf(&query, 0, "COPY %s TO STDOUT DELIMITERS E'%c' WITH NULL AS E'%s'", table_name, *pg_delim, pg_null_as);
+	spprintf(&query, 0, "COPY %s TO STDOUT DELIMITER E'%c' NULL AS E'%s'", table_name, *pg_delim, pg_null_as);
 
 	while ((pgsql_result = PQgetResult(pgsql))) {
 		PQclear(pgsql_result);
@@ -4187,7 +4187,7 @@ PHP_FUNCTION(pg_copy_from)
 		pg_null_as_free = 1;
 	}
 
-	spprintf(&query, 0, "COPY %s FROM STDIN DELIMITERS E'%c' WITH NULL AS E'%s'", table_name, *pg_delim, pg_null_as);
+	spprintf(&query, 0, "COPY %s FROM STDIN DELIMITER E'%c' NULL AS E'%s'", table_name, *pg_delim, pg_null_as);
 	while ((pgsql_result = PQgetResult(pgsql))) {
 		PQclear(pgsql_result);
 	}

ext/pgsql/tests/01createdb.phpt

@@ -29,6 +29,9 @@ else {
 	echo pg_last_error()."\n";
 }
 
+// Create view here
+pg_query($db,$view_def);
+
 pg_close($db);
 
 echo "OK";

ext/pgsql/tests/06_bug73498.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug 73498 Incorrect DELIMITER syntax for pg_copy_to()
+--SKIPIF--
+<?php include("skipif.inc"); ?>
+--FILE--
+<?php
+
+include('config.inc');
+
+$db = pg_connect($conn_str);
+
+$rows = pg_copy_to($db, "(select * from {$view_name})");
+
+var_dump(gettype($rows));
+var_dump(count($rows) > 0);
+
+?>
+--EXPECT--
+string(5) "array"
+bool(true)

ext/pgsql/tests/9999dropdb.phpt

@@ -9,6 +9,7 @@ PostgreSQL drop db
 include('config.inc');
 
 $db = pg_connect($conn_str);
+pg_query($db, "DROP VIEW {$view_name}");
 pg_query($db, "DROP TABLE ".$table_name);
 @pg_query($db, "DROP TABLE ".$table_name_92);
 

ext/pgsql/tests/config.inc

@@ -11,6 +11,10 @@ $table_name      = "php_pgsql_test";          // test table that will be created
 $table_name_92   = "php_pgsql_test_92";       // test table that will be created
 $num_test_record = 1000;                      // Number of records to create
 
+// Test view
+$view_name   = "php_pgsql_viewtest";
+$view_def    = "CREATE VIEW {$view_name} AS SELECT * FROM {$table_name};";
+
 // Test table
 $table_def    = "CREATE TABLE ${table_name} (num int, str text, bin bytea);";
 $table_def_92 = "CREATE TABLE ${table_name_92} (textary text[],  jsn json);";

ext/phar/phar.c

@@ -981,7 +981,6 @@ static int phar_parse_pharfile(php_stream *fp, char *fname, int fname_len, char
 		/* if the alias is stored we enforce it (implicit overrides explicit) */
 		if (alias && alias_len && (alias_len != (int)tmp_len || strncmp(alias, buffer, tmp_len)))
 		{
-			buffer[tmp_len] = '\0';
 			php_stream_close(fp);
 
 			if (signature) {
@@ -989,7 +988,7 @@ static int phar_parse_pharfile(php_stream *fp, char *fname, int fname_len, char
 			}
 
 			if (error) {
-				spprintf(error, 0, "cannot load phar \"%s\" with implicit alias \"%s\" under different alias \"%s\"", fname, buffer, alias);
+				spprintf(error, 0, "cannot load phar \"%s\" with implicit alias \"%.*s\" under different alias \"%s\"", fname, tmp_len, buffer, alias);
 			}
 
 			efree(savebuf);
@@ -1055,7 +1054,7 @@ static int phar_parse_pharfile(php_stream *fp, char *fname, int fname_len, char
 	entry.is_persistent = mydata->is_persistent;
 
 	for (manifest_index = 0; manifest_index < manifest_count; ++manifest_index) {
-		if (buffer + 4 > endbuffer) {
+		if (buffer + 28 > endbuffer) {
 			MAPPHAR_FAIL("internal corruption of phar \"%s\" (truncated manifest entry)")
 		}
 
@@ -1069,7 +1068,7 @@ static int phar_parse_pharfile(php_stream *fp, char *fname, int fname_len, char
 			entry.manifest_pos = manifest_index;
 		}
 
-		if (entry.filename_len + 20 > endbuffer - buffer) {
+		if (entry.filename_len > endbuffer - buffer - 24) {
 			MAPPHAR_FAIL("internal corruption of phar \"%s\" (truncated manifest entry)");
 		}
 

ext/phar/tests/bug73764.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Phar: PHP bug #73764: Crash while loading hostile phar archive
+--SKIPIF--
+<?php if (!extension_loaded("phar")) die("skip"); ?>
+--FILE--
+<?php
+chdir(__DIR__);
+try {
+$p = Phar::LoadPhar('bug73764.phar', 'alias.phar');
+echo "OK\n";
+} catch(PharException $e) {
+	echo $e->getMessage();
+}
+?>
+--EXPECTF--
+internal corruption of phar "%sbug73764.phar" (truncated manifest entry)

ext/phar/tests/bug73768.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Phar: PHP bug #73768: Memory corruption when loading hostile phar
+--SKIPIF--
+<?php if (!extension_loaded("phar")) die("skip"); ?>
+--FILE--
+<?php
+chdir(__DIR__);
+try {
+$p = Phar::LoadPhar('bug73768.phar', 'alias.phar');
+echo "OK\n";
+} catch(PharException $e) {
+	echo $e->getMessage();
+}
+?>
+--EXPECTF--
+cannot load phar "%sbug73768.phar" with implicit alias "" under different alias "alias.phar"

ext/soap/soap.c

@@ -904,6 +904,7 @@ PHP_METHOD(SoapFault, SoapFault)
 PHP_METHOD(SoapFault, __toString)
 {
 	zval *faultcode, *faultstring, *file, *line, *trace;
+	zval *faultcode_cp, *faultstring_cp, *file_cp, *line_cp;
 	char *str;
 	int len;
 	zend_fcall_info fci;
@@ -932,16 +933,36 @@ PHP_METHOD(SoapFault, __toString)
 
 	zend_call_function(&fci, NULL TSRMLS_CC);
 
-	convert_to_string(faultcode);
-	convert_to_string(faultstring);
-	convert_to_string(file);
-	convert_to_long(line);
+	ALLOC_ZVAL(faultcode_cp);
+	INIT_PZVAL_COPY(faultcode_cp, faultcode);
+	zval_copy_ctor(faultcode_cp);
+
+	ALLOC_ZVAL(faultstring_cp);
+	INIT_PZVAL_COPY(faultstring_cp, faultstring);
+	zval_copy_ctor(faultstring_cp);
+
+	ALLOC_ZVAL(file_cp);
+	INIT_PZVAL_COPY(file_cp, file);
+	zval_copy_ctor(file_cp);
+
+	ALLOC_ZVAL(line_cp);
+	INIT_PZVAL_COPY(line_cp, line);
+	zval_copy_ctor(line_cp);
+
+	convert_to_string(faultcode_cp);
+	convert_to_string(faultstring_cp);
+	convert_to_string(file_cp);
+	convert_to_long(line_cp);
 	convert_to_string(trace);
 
 	len = spprintf(&str, 0, "SoapFault exception: [%s] %s in %s:%ld\nStack trace:\n%s",
-	               Z_STRVAL_P(faultcode), Z_STRVAL_P(faultstring), Z_STRVAL_P(file), Z_LVAL_P(line),
+	               Z_STRVAL_P(faultcode_cp), Z_STRVAL_P(faultstring_cp), Z_STRVAL_P(file_cp), Z_LVAL_P(line_cp),
 	               Z_STRLEN_P(trace) ? Z_STRVAL_P(trace) : "#0 {main}\n");
 
+	zval_ptr_dtor(&faultcode_cp);
+	zval_ptr_dtor(&faultstring_cp);
+	zval_ptr_dtor(&file_cp);
+	zval_ptr_dtor(&line_cp);
 	zval_ptr_dtor(&trace);
 
 	RETURN_STRINGL(str, len, 0);

ext/soap/tests/bug73452.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Bug #73452 Segfault (Regression for #69152)
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+
+$data = 'O:9:"SoapFault":4:{s:9:"faultcode";i:4298448493;s:11:"faultstring";i:4298448543;s:7:"'."\0*\0".'file";i:4298447319;s:7:"'."\0*\0".'line";s:4:"ryat";}';
+echo unserialize($data);
+
+?>
+==DONE==
+--EXPECTF--
+SoapFault exception: [4298448493] 4298448543 in :0
+Stack trace:
+#0 %sbug73452.php(4): unserialize('O:9:"SoapFault"...')
+#1 {main}==DONE==

ext/spl/spl_array.c

@@ -1812,7 +1812,7 @@ SPL_METHOD(Array, unserialize)
 		ALLOC_INIT_ZVAL(intern->array);
 		if (!php_var_unserialize(&intern->array, &p, s + buf_len, &var_hash TSRMLS_CC)
 				|| (Z_TYPE_P(intern->array) != IS_ARRAY && Z_TYPE_P(intern->array) != IS_OBJECT)) {
-			zval_ptr_dtor(&intern->array);
+			// zval_ptr_dtor(&intern->array);
 			goto outexcept;
 		}
 		var_push_dtor(&var_hash, &intern->array);

ext/standard/exec.c

@@ -133,7 +133,7 @@ PHPAPI int php_exec(int type, char *cmd, zval *array, zval *return_value TSRMLS_
 
 	if (type != 3) {
 		b = buf;
-		
+
 		while (php_stream_get_line(stream, b, EXEC_INPUT_BUF, &bufl)) {
 			/* no new line found, let's read some more */
 			if (b[bufl - 1] != '\n' && !php_stream_eof(stream)) {
@@ -330,7 +330,7 @@ PHPAPI char *php_escape_shell_cmd(char *str)
 				cmd[y++] = str[x];
 				break;
 #else
-			/* % is Windows specific for enviromental variables, ^%PATH% will 
+			/* % is Windows specific for enviromental variables, ^%PATH% will
 				output PATH while ^%PATH^% will not. escapeshellcmd will escape all % and !.
 			*/
 			case '%':
@@ -492,7 +492,7 @@ PHP_FUNCTION(escapeshellcmd)
 			return;
 		}
 		cmd = php_escape_shell_cmd(command);
-		RETVAL_STRING(cmd, 0);
+		RETVAL_STRINGL_CHECK(cmd, strlen(cmd), 0);
 	} else {
 		RETVAL_EMPTY_STRING();
 	}
@@ -517,7 +517,7 @@ PHP_FUNCTION(escapeshellarg)
 			return;
 		}
 		cmd = php_escape_shell_arg(argument);
-		RETVAL_STRING(cmd, 0);
+		RETVAL_STRINGL_CHECK(cmd, strlen(cmd), 0);
 	}
 }
 /* }}} */
@@ -551,7 +551,7 @@ PHP_FUNCTION(shell_exec)
 	php_stream_close(stream);
 
 	if (total_readbytes > 0) {
-		RETVAL_STRINGL(ret, total_readbytes, 0);
+		RETVAL_STRINGL_CHECK(ret, total_readbytes, 0);
 	}
 }
 /* }}} */

ext/standard/http_fopen_wrapper.c

@@ -699,6 +699,24 @@ finish:
 			if ((options & STREAM_ONLY_GET_HEADERS) || ignore_errors) {
 				reqok = 1;
 			}
+
+			/* status codes of 1xx are "informational", and will be followed by a real response
+			 * e.g "100 Continue". RFC 7231 states that unexpected 1xx status MUST be parsed,
+			 * and MAY be ignored. As such, we need to skip ahead to the "real" status*/
+			if (response_code >= 100 && response_code < 200) {
+				/* consume lines until we find a line starting 'HTTP/1' */
+				while (
+					!php_stream_eof(stream)
+					&& php_stream_get_line(stream, tmp_line, sizeof(tmp_line) - 1, &tmp_line_len) != NULL
+					&& ( tmp_line_len < sizeof("HTTP/1") - 1 || strncasecmp(tmp_line, "HTTP/1", sizeof("HTTP/1") - 1) )
+				);
+
+				if (tmp_line_len > 9) {
+					response_code = atoi(tmp_line + 9);
+				} else {
+					response_code = 0;
+				}
+			}
 			/* all status codes in the 2xx range are defined by the specification as successful;
 			 * all status codes in the 3xx range are for redirection, and so also should never
 			 * fail */

ext/standard/php_smart_str.h

@@ -57,7 +57,8 @@
 		newlen = (n);												\
 		(d)->a = newlen < SMART_STR_START_SIZE 						\
 				? SMART_STR_START_SIZE 								\
-				: newlen + SMART_STR_PREALLOC;						\
+				: (newlen >= (INT_MAX - SMART_STR_PREALLOC)? newlen \
+							: (newlen + SMART_STR_PREALLOC));		\
 		SMART_STR_DO_REALLOC(d, what);								\
 	} else {														\
 		newlen = (d)->len + (n);									\

ext/standard/string.c

@@ -20,8 +20,6 @@
 
 /* $Id$ */
 
-/* Synced with php 3.0 revision 1.193 1999-06-16 [ssb] */
-
 #include <stdio.h>
 #include "php.h"
 #include "php_rand.h"

ext/standard/tests/file/bug43008.phpt

@@ -4,6 +4,8 @@ Bug #43008 (php://filter uris ignore url encoded filternames and can't handle sl
 <?php
 if (!extension_loaded("iconv")) die("skip iconv extension not available");
 ?>
+--INI--
+allow_url_fopen=1
 --FILE--
 <?php
 $url = b""

ext/standard/tests/file/lchown_error.phpt

@@ -73,6 +73,6 @@ bool(true)
 Warning: lchown() expects parameter 1 to be a valid path, array given in %s on line %d
 bool(true)
 
-Warning: lchown(): Operation not permitted in %s on line %d
+Warning: lchown(): %r(Operation not permitted|Invalid argument)%r in %s on line %d
 bool(false)
 ===DONE===

ext/standard/tests/http/bug73297.phpt

@@ -0,0 +1,33 @@
+--TEST--
+Bug #73297 (Ignore 100 Continue returned by HTTP/1.1 servers)
+--INI--
+allow_url_fopen=1
+--SKIPIF--
+<?php require 'server.inc'; http_server_skipif('tcp://127.0.0.1:12342'); ?>
+--FILE--
+<?php
+require 'server.inc';
+
+$options = [
+  'http' => [
+    'protocol_version' => '1.1',
+    'header' => 'Connection: Close'
+  ],
+];
+
+$ctx = stream_context_create($options);
+
+$responses = [
+  "data://text/plain,HTTP/1.1 100 Continue\r\n\r\nHTTP/1.1 200 OK\r\n\r\n"
+    . "Hello"
+];
+$pid = http_server('tcp://127.0.0.1:12342', $responses);
+
+echo file_get_contents('http://127.0.0.1:12342/', false, $ctx);
+echo "\n";
+
+http_server_kill($pid);
+
+?>
+--EXPECT--
+Hello

ext/standard/tests/serialize/bug69425.phpt

@@ -0,0 +1,63 @@
+--TEST--
+Bug #69425: Use After Free in unserialize()
+--FILE--
+<?php
+
+// POC 1
+class test
+{
+	var $ryat;
+	
+	function __wakeup()
+	{
+		$this->ryat = 1;
+	}
+}
+
+$data = unserialize('a:2:{i:0;O:4:"test":1:{s:4:"ryat";R:1;}i:1;i:2;}');
+var_dump($data);
+
+// POC 2
+$data = unserialize('a:2:{i:0;O:12:"DateInterval":1:{s:1:"y";R:1;}i:1;i:2;}');
+var_dump($data);
+
+?>
+--EXPECT--
+int(1)
+array(2) {
+  [0]=>
+  object(DateInterval)#1 (15) {
+    ["y"]=>
+    int(-1)
+    ["m"]=>
+    int(-1)
+    ["d"]=>
+    int(-1)
+    ["h"]=>
+    int(-1)
+    ["i"]=>
+    int(-1)
+    ["s"]=>
+    int(-1)
+    ["weekday"]=>
+    int(-1)
+    ["weekday_behavior"]=>
+    int(-1)
+    ["first_last_day_of"]=>
+    int(-1)
+    ["invert"]=>
+    int(0)
+    ["days"]=>
+    int(-1)
+    ["special_type"]=>
+    int(0)
+    ["special_amount"]=>
+    int(-1)
+    ["have_weekday_relative"]=>
+    int(0)
+    ["have_special_relative"]=>
+    int(0)
+  }
+  [1]=>
+  int(2)
+}

ext/standard/tests/serialize/bug70213.phpt

@@ -0,0 +1,30 @@
+--TEST--
+Bug #70213: Unserialize context shared on double class lookup
+--FILE--
+<?php
+
+ini_set('unserialize_callback_func', 'evil');
+
+function evil() {
+	function __autoload($arg) {
+        var_dump(unserialize('R:1;'));
+    }
+}
+
+var_dump(unserialize('a:2:{i:0;i:42;i:1;O:4:"evil":0:{}}'));
+
+?>
+--EXPECTF--
+Notice: unserialize(): Error at offset 4 of 4 bytes in %s on line %d
+bool(false)
+
+Warning: unserialize(): Function evil() hasn't defined the class it was called for in %s on line %d
+array(2) {
+  [0]=>
+  int(42)
+  [1]=>
+  object(__PHP_Incomplete_Class)#1 (1) {
+    ["__PHP_Incomplete_Class_Name"]=>
+    string(4) "evil"
+  }
+}

ext/standard/tests/serialize/bug70513.phpt

@@ -0,0 +1,39 @@
+--TEST--
+Bug #70513: GMP Deserialization Type Confusion Vulnerability
+--SKIPIF--
+<?php if (!extension_loaded('gmp')) die('skip requires gmp');
+--FILE--
+<?php
+
+class obj
+{
+	var $ryat;
+	
+	function __wakeup()
+	{
+		$this->ryat = 1;
+	}
+}
+
+$obj = new stdClass;
+$obj->aa = 1;
+$obj->bb = 2;
+
+$inner = 's:1:"1";a:3:{s:2:"aa";s:2:"hi";s:2:"bb";s:2:"hi";i:0;O:3:"obj":1:{s:4:"ryat";R:2;}}';
+$exploit = 'a:1:{i:0;C:3:"GMP":'.strlen($inner).':{'.$inner.'}}';
+$x = unserialize($exploit);
+var_dump($x);
+var_dump($obj);
+
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  int(1)
+}
+object(stdClass)#1 (2) {
+  ["aa"]=>
+  int(1)
+  ["bb"]=>
+  int(2)
+}

ext/standard/tests/serialize/bug72610.phpt

@@ -0,0 +1,64 @@
+--TEST--
+__wakeup should be able to add dynamic properties without affecting other dynamic properties
+--FILE--
+<?php
+
+class Obj {
+	// Testing $this->a being a dynamic property.
+
+	function __construct($a) {
+		$this->a = $a;
+	}
+
+	public function __wakeup() {
+		echo "Calling __wakeup\n";
+		for ($i = 0; $i < 10000; $i++) {
+			$this->{'b' . $i} = 42;
+		}
+	}
+}
+
+function main() {
+	$obj = new stdClass();
+	$obj->test = 'foo';
+	$variable = [new Obj($obj), new Obj($obj)];
+	$serialized = serialize($variable);
+	printf("%s\n", $serialized);
+	$unserialized = unserialize($serialized);
+	for ($i = 0; $i < 10000; $i++) {
+		if ($unserialized[0]->{'b' . $i} !== 42) {
+			echo "Fail 0 b$i\n";
+			return;
+		}
+		if ($unserialized[1]->{'b' . $i} !== 42) {
+			echo "Fail 1 b$i\n";
+			return;
+		}
+		unset($unserialized[0]->{'b' . $i});
+		unset($unserialized[1]->{'b' . $i});
+	}
+	var_dump($unserialized);
+}
+main();
+--EXPECTF--
+a:2:{i:0;O:3:"Obj":1:{s:1:"a";O:8:"stdClass":1:{s:4:"test";s:3:"foo";}}i:1;O:3:"Obj":1:{s:1:"a";r:3;}}
+Calling __wakeup
+Calling __wakeup
+array(2) {
+  [0]=>
+  object(Obj)#%d (1) {
+    ["a"]=>
+    object(stdClass)#%d (1) {
+      ["test"]=>
+      string(3) "foo"
+    }
+  }
+  [1]=>
+  object(Obj)#%d (1) {
+    ["a"]=>
+    object(stdClass)#%d (1) {
+      ["test"]=>
+      string(3) "foo"
+    }
+  }
+}

ext/standard/tests/serialize/bug72610_2.phpt

@@ -0,0 +1,32 @@
+--TEST--
+__wakeup can replace a copy of the object referring to the root node.
+--FILE--
+<?php
+/* This bug never happened, but adding this test to make sure that further changes to unserialize don't allow freeing the root in __wakeup. */
+class Obj {
+	function __construct($a) {
+		$this->a = $a;
+	}
+
+	public function __wakeup() {
+		echo "Calling __wakeup\n";
+		$this->a = "replaced";
+	}
+}
+
+$a = new stdClass();
+$a->obj = new Obj($a);;
+$serialized = serialize($a);
+printf("%s\n", $serialized);
+$unserialized = unserialize($serialized);
+var_dump($unserialized);
+--EXPECTF--
+O:8:"stdClass":1:{s:3:"obj";O:3:"Obj":1:{s:1:"a";r:1;}}
+Calling __wakeup
+object(stdClass)#%d (1) {
+  ["obj"]=>
+  object(Obj)#%d (1) {
+    ["a"]=>
+    string(8) "replaced"
+  }
+}

ext/standard/tests/serialize/bug72610_3.phpt

@@ -0,0 +1,51 @@
+--TEST--
+__wakeup should be able to modify dynamic properties without affecting copies of those properties
+--SKIPIF--
+<?php if (!extension_loaded("json")) print "skip json_encode needed"; ?>
+--FILE--
+<?php
+
+class Obj {
+	// Testing $this->a being a dynamic property.
+
+	function __construct($a) {
+		$this->a = $a;
+	}
+
+	public function __wakeup() {
+		echo "Calling __wakeup " . json_encode($this->a) . "\n";
+		$this->a = "roh";
+	}
+}
+
+function main() {
+	$obj = new stdClass();
+	$obj->c = null;
+    $variable = [new Obj($obj), new Obj($obj), $obj];
+	$serialized = serialize($variable);
+	printf("%s\n", $serialized);
+	$unserialized = unserialize($serialized);
+	var_dump($unserialized);
+}
+main();
+--EXPECTF--
+a:3:{i:0;O:3:"Obj":1:{s:1:"a";O:8:"stdClass":1:{s:1:"c";N;}}i:1;O:3:"Obj":1:{s:1:"a";r:3;}i:2;r:3;}
+Calling __wakeup {"c":null}
+Calling __wakeup {"c":null}
+array(3) {
+  [0]=>
+  object(Obj)#%d (1) {
+    ["a"]=>
+    string(3) "roh"
+  }
+  [1]=>
+  object(Obj)#%d (1) {
+    ["a"]=>
+    string(3) "roh"
+  }
+  [2]=>
+  object(stdClass)#%d (1) {
+    ["c"]=>
+    NULL
+  }
+}

ext/standard/tests/serialize/bug72731.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug #72731: Type Confusion in Object Deserialization
+--FILE--
+<?php
+
+class obj {
+	var $ryat;
+	function __wakeup() {
+		$this->ryat = 0x1122334455;
+	}
+}
+
+$poc = 'O:8:"stdClass":1:{i:0;O:3:"obj":1:{s:4:"ryat";R:1;}}';
+var_dump(unserialize($poc));
+
+?>
+--EXPECT--
+int(73588229205)

ext/standard/tests/serialize/bug73092.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Bug #73092: Unserialize use-after-free when resizing object's properties hash table
+--FILE--
+<?php
+
+class foo {
+    function __wakeup() {
+        $this->{'x'} = 1;
+    }
+}
+
+unserialize('a:3:{i:0;O:3:"foo":8:{i:0;i:0;i:1;i:1;i:2;i:2;i:3;i:3;i:4;i:4;i:5;i:5;i:6;i:6;i:7;i:7;}i:1;s:263:"'.str_repeat("\06", 263).'";i:2;r:3;}');
+
+?>
+===DONE===
+--EXPECT--
+===DONE===

ext/standard/tests/serialize/bug73092_2.phpt

@@ -0,0 +1,49 @@
+--TEST--
+Bug #73092: Unserialize use-after-free when resizing object's properties hash table (2)
+--FILE--
+<?php
+class foo {
+    public $x;
+    function __wakeup() {
+        var_dump($this->x);
+    }
+}
+
+unserialize('a:3:{i:0;O:3:"foo":1:{s:1:"x";O:12:"DateInterval":1:{i:0;i:0;}}i:1;s:263:"'.str_repeat("\06", 263).'";i:2;r:4;}}');
+
+?>
+--EXPECTF--
+object(DateInterval)#%d (16) {
+  ["0"]=>
+  int(0)
+  ["y"]=>
+  int(-1)
+  ["m"]=>
+  int(-1)
+  ["d"]=>
+  int(-1)
+  ["h"]=>
+  int(-1)
+  ["i"]=>
+  int(-1)
+  ["s"]=>
+  int(-1)
+  ["weekday"]=>
+  int(-1)
+  ["weekday_behavior"]=>
+  int(-1)
+  ["first_last_day_of"]=>
+  int(-1)
+  ["invert"]=>
+  int(0)
+  ["days"]=>
+  int(-1)
+  ["special_type"]=>
+  int(0)
+  ["special_amount"]=>
+  int(-1)
+  ["have_weekday_relative"]=>
+  int(0)
+  ["have_special_relative"]=>
+  int(0)
+}

ext/standard/tests/serialize/bug73341.phpt

@@ -0,0 +1,24 @@
+--TEST--
+Bug #73144 (Use-afte-free in ArrayObject Deserialization)
+--FILE--
+<?php
+try {
+$token = 'a:2:{i:0;O:1:"0":2:0s:1:"0";i:0;s:1:"0";a:1:{i:0;C:11:"ArrayObject":7:0x:i:0;r0';
+$obj = unserialize($token);
+} catch(Exception $e) {
+	echo $e->getMessage()."\n";
+}
+
+try {
+$inner = 'x:i:1;O:8:"stdClass":1:{};m:a:0:{}';
+$exploit = 'C:11:"ArrayObject":'.strlen($inner).':{'.$inner.'}';
+unserialize($exploit);
+} catch(Exception $e) {
+	echo $e->getMessage()."\n";
+}
+?>
+--EXPECTF--
+Error at offset 6 of 7 bytes
+
+Notice: ArrayObject::unserialize(): Unexpected end of serialized data in %sbug73341.php on line %d
+Error at offset 24 of 34 bytes

ext/standard/tests/serialize/bug73367.phpt

@@ -0,0 +1,31 @@
+--TEST--
+Bug #73367: Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization
+--FILE--
+<?php
+
+class obj {
+	var $ryat;
+	function __wakeup() {
+		$this->ryat = null;
+        echo "wakeup\n";
+		throw new Exception("Not a serializable object");
+	}
+	function __destruct() {
+        echo "dtor\n";
+		if ($this->ryat == 1) {
+            echo "dtor ryat==1\n";
+		}
+	}
+}
+
+$poc = 'O:3:"obj":2:{s:4:"ryat";i:1;i:0;O:3:"obj":1:{s:4:"ryat";R:1;}}';
+try {
+    unserialize($poc);
+} catch (Exception $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+wakeup
+Not a serializable object

ext/standard/tests/serialize/bug73367_2.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Bug #73367: Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization (2)
+--FILE--
+<?php
+
+class obj {
+    var $ryat;
+    function __wakeup() {
+        $this->ryat = null;
+        $this->foo = 'bar'; // $this should still be live here
+        echo "wakeup\n";
+    }
+}
+
+$poc = 'O:3:"obj":2:{s:4:"ryat";i:1;i:0;O:3:"obj":1:{s:4:"ryat";R:1;}}';
+unserialize($poc);
+
+?>
+--EXPECT--
+wakeup
+wakeup

ext/standard/tests/serialize/bug73825.phpt

@@ -0,0 +1,12 @@
+--TEST--
+Bug #73825 Heap out of bounds read on unserialize in finish_nested_data()
+--FILE--
+<?php
+$obj = unserialize('O:8:"00000000":');
+var_dump($obj);
+?>
+--EXPECTF--
+Warning: Bad unserialize data in %sbug73825.php on line %d
+
+Notice: unserialize(): Error at offset 13 of 15 bytes in %sbug73825.php on line %d
+bool(false)

ext/standard/tests/streams/bug40459.phpt

@@ -1,5 +1,7 @@
 --TEST--
 bug 40459 - Test whether the constructor of the user-space stream wrapper is called when stream functions are called
+--INI--
+allow_url_fopen=1
 --FILE--
 <?php
 // Test whether the constructor of the user-space stream wrapper is called when stream functions are called

ext/standard/tests/streams/bug71323.phpt

@@ -1,5 +1,7 @@
 --TEST--
 Bug #71323: Output of stream_get_meta_data can be falsified by its input
+--INI--
+allow_url_fopen=1
 --FILE--
 <?php
 $file = 'data:text/plain;z=y;uri=eviluri;mediatype=wut?;mediatype2=hello,somedata';

ext/standard/tests/streams/glob-wrapper.phpt

@@ -0,0 +1,35 @@
+--TEST--
+Glob wrapper bypasses open_basedir
+--INI--
+open_basedir=/does_not_exist
+--SKIPIF--
+<?php
+if (!in_array("glob", stream_get_wrappers())) echo "skip";
+--FILE--
+<?php
+
+foreach ( [ __DIR__, "glob://".__DIR__ ] as $spec) {
+  echo "** Opening $spec\n";
+  $dir = opendir($spec);
+  if (!$dir) {
+    echo "Failed to open $spec\n";
+    continue;
+  }
+  if (false === readdir($dir)) {
+    echo "No files in $spec\n";
+    continue;
+  }
+}
+--EXPECTF--
+** Opening %s
+
+Warning: opendir(): open_basedir restriction in effect. File(%s) is not within the allowed path(s): (/does_not_exist) in %s%eglob-wrapper.php on line 5
+
+Warning: opendir(%s): failed to open dir: Operation not permitted in %s%eglob-wrapper.php on line 5
+Failed to open %s
+** Opening glob://%s
+
+Warning: opendir(): open_basedir restriction in effect. File(%s) is not within the allowed path(s): (/does_not_exist) in %s%eglob-wrapper.php on line 5
+
+Warning: opendir(glob://%s): failed to open dir: operation failed in %s%eglob-wrapper.php on line 5
+Failed to open glob://%s

ext/standard/tests/streams/user-stream-error.phpt

@@ -13,4 +13,4 @@ fopen('mystream://foo', 'r');
 echo 'Done';
 
 --EXPECTF--
-Fatal error: Call to undefined function _some_undefined_function() in %s/user-stream-error.php on line %d
+Fatal error: Call to undefined function _some_undefined_function() in %s%euser-stream-error.php on line %d

ext/standard/url.c

@@ -104,7 +104,7 @@ PHPAPI php_url *php_url_parse_ex(char const *str, int length)
 	ue = s + length;
 
 	/* parse scheme */
-	if ((e = memchr(s, ':', length)) && (e - s)) {
+	if ((e = memchr(s, ':', length)) && e != s) {
 		/* validate scheme */
 		p = s;
 		while (p < e) {
@@ -119,10 +119,10 @@ PHPAPI php_url *php_url_parse_ex(char const *str, int length)
 			p++;
 		}
 
-		if (*(e + 1) == '\0') { /* only scheme is available */
+		if (e + 1 == ue) { /* only scheme is available */
 			ret->scheme = estrndup(s, (e - s));
 			php_replace_controlchars_ex(ret->scheme, (e - s));
-			goto end;
+			return ret;
 		}
 
 		/*
@@ -134,46 +134,39 @@ PHPAPI php_url *php_url_parse_ex(char const *str, int length)
 			 * correctly parse things like a.com:80
 			 */
 			p = e + 1;
-			while (isdigit(*p)) {
+			while (p < ue && isdigit(*p)) {
 				p++;
 			}
 
-			if ((*p == '\0' || *p == '/') && (p - e) < 7) {
+			if ((p == ue || *p == '/') && (p - e) < 7) {
 				goto parse_port;
 			}
 
 			ret->scheme = estrndup(s, (e-s));
 			php_replace_controlchars_ex(ret->scheme, (e - s));
 
-			length -= ++e - s;
-			s = e;
+			s = e + 1;
 			goto just_path;
 		} else {
 			ret->scheme = estrndup(s, (e-s));
 			php_replace_controlchars_ex(ret->scheme, (e - s));
 
-			if (*(e+2) == '/') {
+			if (e + 2 < ue && *(e + 2) == '/') {
 				s = e + 3;
 				if (!strncasecmp("file", ret->scheme, sizeof("file"))) {
-					if (*(e + 3) == '/') {
+					if (e + 3 < ue && *(e + 3) == '/') {
 						/* support windows drive letters as in:
 						   file:///c:/somedir/file.txt
 						*/
-						if (*(e + 5) == ':') {
+						if (e + 5 < ue && *(e + 5) == ':') {
 							s = e + 4;
 						}
-						goto nohost;
+						goto just_path;
 					}
 				}
 			} else {
-				if (!strncasecmp("file", ret->scheme, sizeof("file"))) {
-					s = e + 1;
-					goto nohost;
-				} else {
-					length -= ++e - s;
-					s = e;
-					goto just_path;
-				}
+				s = e + 1;
+				goto just_path;
 			}
 		}
 	} else if (e) { /* no scheme; starts with colon: look for port */
@@ -181,18 +174,18 @@ PHPAPI php_url *php_url_parse_ex(char const *str, int length)
 		p = e + 1;
 		pp = p;
 
-		while (pp-p < 6 && isdigit(*pp)) {
+		while (pp < ue && pp - p < 6 && isdigit(*pp)) {
 			pp++;
 		}
 
-		if (pp - p > 0 && pp - p < 6 && (*pp == '/' || *pp == '\0')) {
+		if (pp - p > 0 && pp - p < 6 && (pp == ue || *pp == '/')) {
 			long port;
 			memcpy(port_buf, p, (pp - p));
 			port_buf[pp - p] = '\0';
 			port = strtol(port_buf, NULL, 10);
 			if (port > 0 && port <= 65535) {
 				ret->port = (unsigned short) port;
-				if (*s == '/' && *(s + 1) == '/') { /* relative-scheme URL */
+				if (s + 1 < ue && *s == '/' && *(s + 1) == '/') { /* relative-scheme URL */
 				    s += 2;
 				}
 			} else {
@@ -200,24 +193,32 @@ PHPAPI php_url *php_url_parse_ex(char const *str, int length)
 				efree(ret);
 				return NULL;
 			}
-		} else if (p == pp && *pp == '\0') {
+		} else if (p == pp && pp == ue) {
 			STR_FREE(ret->scheme);
 			efree(ret);
 			return NULL;
-		} else if (*s == '/' && *(s + 1) == '/') { /* relative-scheme URL */
+		} else if (s + 1 < ue && *s == '/' && *(s + 1) == '/') { /* relative-scheme URL */
 			s += 2;
 		} else {
 			goto just_path;
 		}
-	} else if (*s == '/' && *(s + 1) == '/') { /* relative-scheme URL */
+	} else if (s + 1 < ue && *s == '/' && *(s + 1) == '/') { /* relative-scheme URL */
 		s += 2;
 	} else {
-		just_path:
-		ue = s + length;
-		goto nohost;
+		goto just_path;
 	}
 
-	e = s + strcspn(s, "/?#");
+	/* Binary-safe strcspn(s, "/?#") */
+	e = ue;
+	if ((p = memchr(s, '/', e - s))) {
+		e = p;
+	}
+	if ((p = memchr(s, '?', e - s))) {
+		e = p;
+	}
+	if ((p = memchr(s, '#', e - s))) {
+		e = p;
+	}
 
 	/* check for login and password */
 	if ((p = zend_memrchr(s, '@', (e-s)))) {
@@ -237,18 +238,16 @@ PHPAPI php_url *php_url_parse_ex(char const *str, int length)
 	}
 
 	/* check for port */
-	if (*s == '[' && *(e-1) == ']') {
+	if (s < ue && *s == '[' && *(e-1) == ']') {
 		/* Short circuit portscan,
 		   we're dealing with an
 		   IPv6 embedded address */
-		p = s;
+		p = NULL;
 	} else {
-		/* memrchr is a GNU specific extension
-		   Emulate for wide compatibility */
-		for(p = e; p >= s && *p != ':'; p--);
+		p = zend_memrchr(s, ':', (e-s));
 	}
 
-	if (p >= s && *p == ':') {
+	if (p) {
 		if (!ret->port) {
 			p++;
 			if (e-p > 5) { /* port cannot be longer then 5 characters */
@@ -296,54 +295,34 @@ PHPAPI php_url *php_url_parse_ex(char const *str, int length)
 
 	s = e;
 
-	nohost:
+	just_path:
 
-	if ((p = memchr(s, '?', (ue - s)))) {
-		pp = memchr(s, '#', (ue - s));
-
-		if (pp && pp < p) {
-			if (pp - s) {
-				ret->path = estrndup(s, (pp-s));
-				php_replace_controlchars_ex(ret->path, (pp - s));
-			}
-			p = pp;
-			goto label_parse;
-		}
-
-		if (p - s) {
-			ret->path = estrndup(s, (p-s));
-			php_replace_controlchars_ex(ret->path, (p - s));
-		}
-
-		if (pp) {
-			if (pp - ++p) {
-				ret->query = estrndup(p, (pp-p));
-				php_replace_controlchars_ex(ret->query, (pp - p));
-			}
-			p = pp;
-			goto label_parse;
-		} else if (++p - ue) {
-			ret->query = estrndup(p, (ue-p));
-			php_replace_controlchars_ex(ret->query, (ue - p));
-		}
-	} else if ((p = memchr(s, '#', (ue - s)))) {
-		if (p - s) {
-			ret->path = estrndup(s, (p-s));
-			php_replace_controlchars_ex(ret->path, (p - s));
-		}
-
-		label_parse:
+	e = ue;
+	p = memchr(s, '#', (e - s));
+	if (p) {
 		p++;
-
-		if (ue - p) {
-			ret->fragment = estrndup(p, (ue-p));
-			php_replace_controlchars_ex(ret->fragment, (ue - p));
+		if (p < e) {
+			ret->fragment = estrndup(p, (e - p));
+			php_replace_controlchars_ex(ret->fragment, (e - p));
 		}
-	} else {
-		ret->path = estrndup(s, (ue-s));
-		php_replace_controlchars_ex(ret->path, (ue - s));
+		e = p-1;
 	}
-end:
+
+	p = memchr(s, '?', (e - s));
+	if (p) {
+		p++;
+		if (p < e) {
+			ret->query = estrndup(p, (e - p));
+			php_replace_controlchars_ex(ret->query, (e - p));
+		}
+		e = p-1;
+	}
+
+	if (s < e || s == ue) {
+		ret->path = estrndup(s, (e - s));
+		php_replace_controlchars_ex(ret->path, (e - s));
+	}
+
 	return ret;
 }
 /* }}} */

ext/standard/var_unserializer.re

@@ -26,6 +26,11 @@
 #define VAR_ENTRIES_MAX 1024
 #define VAR_ENTRIES_DBG 0
 
+#define VAR_WAKEUP_FLAG 1
+#define WITH_WAKEUP_FLAG(zv_ptr) ((zval *) ((zend_uintptr_t) zv_ptr | VAR_WAKEUP_FLAG))
+#define WITHOUT_WAKEUP_FLAG(zv_ptr) ((zval *) ((zend_uintptr_t) zv_ptr & ~VAR_WAKEUP_FLAG))
+#define HAS_WAKEUP_FLAG(zv_ptr) ((zend_uintptr_t) zv_ptr & VAR_WAKEUP_FLAG)
+
 typedef struct {
 	zval *data[VAR_ENTRIES_MAX];
 	long used_slots;
@@ -56,12 +61,12 @@ static inline void var_push(php_unserialize_data_t *var_hashx, zval **rval)
 	var_hash->data[var_hash->used_slots++] = *rval;
 }
 
-PHPAPI void var_push_dtor(php_unserialize_data_t *var_hashx, zval **rval)
+static inline zval **get_var_push_dtor_slot(php_unserialize_data_t *var_hashx)
 {
 	var_entries *var_hash;
 
 	if (!var_hashx || !*var_hashx) {
-		return;
+		return NULL;
 	}
 
 	var_hash = (*var_hashx)->last_dtor;
@@ -83,8 +88,14 @@ PHPAPI void var_push_dtor(php_unserialize_data_t *var_hashx, zval **rval)
 		(*var_hashx)->last_dtor = var_hash;
 	}
 
+	return &var_hash->data[var_hash->used_slots++];
+}
+
+PHPAPI void var_push_dtor(php_unserialize_data_t *var_hashx, zval **rval)
+{
+	zval **slot = get_var_push_dtor_slot(var_hashx);
 	Z_ADDREF_PP(rval);
-	var_hash->data[var_hash->used_slots++] = *rval;
+	*slot = *rval;
 }
 
 PHPAPI void var_push_dtor_no_addref(php_unserialize_data_t *var_hashx, zval **rval)
@@ -162,6 +173,9 @@ PHPAPI void var_destroy(php_unserialize_data_t *var_hashx)
 	void *next;
 	long i;
 	var_entries *var_hash = (*var_hashx)->first;
+	zend_bool wakeup_failed = 0;
+	TSRMLS_FETCH();
+
 #if VAR_ENTRIES_DBG
 	fprintf(stderr, "var_destroy(%ld)\n", var_hash?var_hash->used_slots:-1L);
 #endif
@@ -176,10 +190,35 @@ PHPAPI void var_destroy(php_unserialize_data_t *var_hashx)
 
 	while (var_hash) {
 		for (i = 0; i < var_hash->used_slots; i++) {
+			zval *zv = var_hash->data[i];
 #if VAR_ENTRIES_DBG
     fprintf(stderr, "var_destroy dtor(%p, %ld)\n", var_hash->data[i], Z_REFCOUNT_P(var_hash->data[i]));
 #endif
-			zval_ptr_dtor(&var_hash->data[i]);
+
+			if (HAS_WAKEUP_FLAG(zv)) {
+				zv = WITHOUT_WAKEUP_FLAG(zv);
+				if (!wakeup_failed) {
+					zval *retval_ptr = NULL;
+					zval wakeup_name;
+					INIT_PZVAL(&wakeup_name);
+					ZVAL_STRINGL(&wakeup_name, "__wakeup", sizeof("__wakeup") - 1, 0);
+
+					BG(serialize_lock)++;
+					if (call_user_function_ex(CG(function_table), &zv, &wakeup_name, &retval_ptr, 0, 0, 1, NULL TSRMLS_CC) == FAILURE || retval_ptr == NULL) {
+						wakeup_failed = 1;
+						zend_object_store_ctor_failed(zv TSRMLS_CC);
+					}
+					BG(serialize_lock)--;
+
+					if (retval_ptr) {
+						zval_ptr_dtor(&retval_ptr);
+					}
+				} else {
+					zend_object_store_ctor_failed(zv TSRMLS_CC);
+				}
+			}
+
+			zval_ptr_dtor(&zv);
 		}
 		next = var_hash->next;
 		efree(var_hash);
@@ -409,6 +448,11 @@ static inline long object_common1(UNSERIALIZE_PARAMETER, zend_class_entry *ce)
 {
 	long elements;
 
+	if( *p >= max - 2) {
+		zend_error(E_WARNING, "Bad unserialize data");
+		return -1;
+	}
+
 	elements = parse_iv2((*p) + 2, p);
 
 	(*p) += 2;
@@ -419,7 +463,7 @@ static inline long object_common1(UNSERIALIZE_PARAMETER, zend_class_entry *ce)
 		/* If this class implements Serializable, it should not land here but in object_custom(). The passed string
 		obviously doesn't descend from the regular serializer. */
 		zend_error(E_WARNING, "Erroneous data format for unserializing '%s'", ce->name);
-		return 0;
+		return -1;
 	}
 
 	return elements;
@@ -430,19 +474,16 @@ static inline long object_common1(UNSERIALIZE_PARAMETER, zend_class_entry *ce)
 #endif
 static inline int object_common2(UNSERIALIZE_PARAMETER, long elements)
 {
-	zval *retval_ptr = NULL;
-	zval fname;
-
 	if (Z_TYPE_PP(rval) != IS_OBJECT) {
 		return 0;
 	}
 
 	if (!process_nested_data(UNSERIALIZE_PASSTHRU, Z_OBJPROP_PP(rval), elements, 1)) {
-	    /* We've got partially constructed object on our hands here. Wipe it. */
-	    if(Z_TYPE_PP(rval) == IS_OBJECT) {
-	       zend_hash_clean(Z_OBJPROP_PP(rval));
-	       zend_object_store_ctor_failed(*rval TSRMLS_CC);
-	    }
+		/* We've got partially constructed object on our hands here. Wipe it. */
+		if (Z_TYPE_PP(rval) == IS_OBJECT) {
+			zend_hash_clean(Z_OBJPROP_PP(rval));
+			zend_object_store_ctor_failed(*rval TSRMLS_CC);
+		}
 	    ZVAL_NULL(*rval);
 		return 0;
 	}
@@ -452,20 +493,16 @@ static inline int object_common2(UNSERIALIZE_PARAMETER, long elements)
     }
 
 	if (Z_OBJCE_PP(rval) != PHP_IC_ENTRY &&
-		zend_hash_exists(&Z_OBJCE_PP(rval)->function_table, "__wakeup", sizeof("__wakeup"))) {
-		INIT_PZVAL(&fname);
-		ZVAL_STRINGL(&fname, "__wakeup", sizeof("__wakeup") - 1, 0);
-		BG(serialize_lock)++;
-		call_user_function_ex(CG(function_table), rval, &fname, &retval_ptr, 0, 0, 1, NULL TSRMLS_CC);
-		BG(serialize_lock)--;
-	}
-
-	if (retval_ptr) {
-		zval_ptr_dtor(&retval_ptr);
-	}
-
-	if (EG(exception)) {
-		return 0;
+		zend_hash_exists(&Z_OBJCE_PP(rval)->function_table, "__wakeup", sizeof("__wakeup"))
+	) {
+		/* Store object for delayed __wakeup call. Remove references. */
+		zval **slot = get_var_push_dtor_slot(var_hash);
+		zval *zv = *rval;
+		Z_ADDREF_P(zv);
+		if (PZVAL_IS_REF(zv)) {
+			SEPARATE_ZVAL(&zv);
+		}
+		*slot = WITH_WAKEUP_FLAG(zv);
 	}
 
 	return finish_nested_data(UNSERIALIZE_PASSTHRU);
@@ -697,12 +734,16 @@ use_double:
 }
 
 "o:" iv ":" ["] {
+	long elements;
     if (!var_hash) return 0;
 
 	INIT_PZVAL(*rval);
 
-	return object_common2(UNSERIALIZE_PASSTHRU,
-			object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR));
+	elements = object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR);
+	if (elements < 0) {
+		return 0;
+	}
+	return object_common2(UNSERIALIZE_PASSTHRU, elements);
 }
 
 object ":" uiv ":" ["]	{
@@ -815,6 +856,7 @@ object ":" uiv ":" ["]	{
 		}
 
 		/* The callback function may have defined the class */
+		BG(serialize_lock)++;
 		if (zend_lookup_class(class_name, len2, &pce TSRMLS_CC) == SUCCESS) {
 			ce = *pce;
 		} else {
@@ -822,6 +864,7 @@ object ":" uiv ":" ["]	{
 			incomplete_class = 1;
 			ce = PHP_IC_ENTRY;
 		}
+		BG(serialize_lock)--;
 
 		zval_ptr_dtor(&user_func);
 		zval_ptr_dtor(&arg_func_name);
@@ -844,6 +887,11 @@ object ":" uiv ":" ["]	{
 
 	elements = object_common1(UNSERIALIZE_PASSTHRU, ce);
 
+	if (elements < 0) {
+	   efree(class_name);
+	   return 0;
+	}
+
 	if (incomplete_class) {
 		php_store_class_name(*rval, class_name, len2);
 	}

ext/wddx/tests/bug45901.phpt

@@ -14,5 +14,7 @@ echo wddx_serialize_value($xml, 'Variables') . "\n";
 echo "DONE";
 ?>
 --EXPECTF--
-<wddxPacket version='1.0'><header><comment>Variables</comment></header><data><struct><var name='php_class_name'><string>SimpleXMLElement</string></var><var name='test'><struct><var name='php_class_name'><string>SimpleXMLElement</string></var></struct></var></struct></data></wddxPacket>
+
+Warning: wddx_serialize_value(): Class SimpleXMLElement can not be serialized in %sbug45901.php on line %d
+<wddxPacket version='1.0'><header><comment>Variables</comment></header><data></data></wddxPacket>
 DONE

ext/wddx/tests/bug72790.phpt

@@ -1,5 +1,5 @@
 --TEST--
-Bug 72790: wddx_deserialize null dereference with invalid xml
+Bug #72790: wddx_deserialize null dereference with invalid xml
 --SKIPIF--
 <?php
 if (!extension_loaded('wddx')) {

ext/wddx/tests/bug73331.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Bug #73331 (NULL Pointer Dereference in WDDX Packet Deserialization with PDORow)
+--SKIPIF--
+<?php if (!extension_loaded("wddx") || !extension_loaded("pdo")) print "skip"; ?>
+--FILE--
+<?php
+
+$wddx = "<wddxPacket version='1.0'><header/><data><struct><var name='php_class_name'><string>PDORow</string></var></struct></data></wddxPacket>";
+var_dump(wddx_deserialize($wddx));
+?>
+--EXPECTF--
+
+Warning: wddx_deserialize(): Class pdorow can not be unserialized in %s73331.php on line %d
+NULL
+

ext/wddx/tests/bug73631.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug #73631 (Memory leak due to invalid wddx stack processing)
+--SKIPIF--
+<?php if (!extension_loaded("wddx")) print "skip"; ?>
+--FILE--
+<?php
+$xml = <<<EOF
+<?xml version="1.0" ?>
+<wddxPacket version="1.0">
+<number>1234</number>
+<binary><boolean/></binary>
+</wddxPacket>
+EOF;
+$wddx = wddx_deserialize($xml);
+var_dump($wddx);
+?>
+--EXPECTF--
+int(1234)

ext/wddx/wddx.c

@@ -471,21 +471,26 @@ static void php_wddx_serialize_object(wddx_packet *packet, zval *obj)
 	ulong idx;
 	char tmp_buf[WDDX_BUF_LEN];
 	HashTable *objhash, *sleephash;
+	zend_class_entry *ce;
+	PHP_CLASS_ATTRIBUTES;
 	TSRMLS_FETCH();
 
+	PHP_SET_CLASS_ATTRIBUTES(obj);
+	ce = Z_OBJCE_P(obj);
+	if (!ce || ce->serialize || ce->unserialize) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Class %s can not be serialized", class_name);
+		PHP_CLEANUP_CLASS_ATTRIBUTES();
+		return;
+	}
+
 	MAKE_STD_ZVAL(fname);
 	ZVAL_STRING(fname, "__sleep", 1);
-
 	/*
 	 * We try to call __sleep() method on object. It's supposed to return an
 	 * array of property names to be serialized.
 	 */
 	if (call_user_function_ex(CG(function_table), &obj, fname, &retval, 0, 0, 1, NULL TSRMLS_CC) == SUCCESS) {
 		if (retval && (sleephash = HASH_OF(retval))) {
-			PHP_CLASS_ATTRIBUTES;
-
-			PHP_SET_CLASS_ATTRIBUTES(obj);
-
 			php_wddx_add_chunk_static(packet, WDDX_STRUCT_S);
 			snprintf(tmp_buf, WDDX_BUF_LEN, WDDX_VAR_S, PHP_CLASS_NAME_VAR);
 			php_wddx_add_chunk(packet, tmp_buf);
@@ -494,8 +499,6 @@ static void php_wddx_serialize_object(wddx_packet *packet, zval *obj)
 			php_wddx_add_chunk_static(packet, WDDX_STRING_E);
 			php_wddx_add_chunk_static(packet, WDDX_VAR_E);
 
-			PHP_CLEANUP_CLASS_ATTRIBUTES();
-
 			objhash = HASH_OF(obj);
 
 			for (zend_hash_internal_pointer_reset(sleephash);
@@ -516,10 +519,6 @@ static void php_wddx_serialize_object(wddx_packet *packet, zval *obj)
 	} else {
 		uint key_len;
 
-		PHP_CLASS_ATTRIBUTES;
-
-		PHP_SET_CLASS_ATTRIBUTES(obj);
-
 		php_wddx_add_chunk_static(packet, WDDX_STRUCT_S);
 		snprintf(tmp_buf, WDDX_BUF_LEN, WDDX_VAR_S, PHP_CLASS_NAME_VAR);
 		php_wddx_add_chunk(packet, tmp_buf);
@@ -528,8 +527,6 @@ static void php_wddx_serialize_object(wddx_packet *packet, zval *obj)
 		php_wddx_add_chunk_static(packet, WDDX_STRING_E);
 		php_wddx_add_chunk_static(packet, WDDX_VAR_E);
 
-		PHP_CLEANUP_CLASS_ATTRIBUTES();
-
 		objhash = HASH_OF(obj);
 		for (zend_hash_internal_pointer_reset(objhash);
 			 zend_hash_get_current_data(objhash, (void**)&ent) == SUCCESS;
@@ -551,6 +548,8 @@ static void php_wddx_serialize_object(wddx_packet *packet, zval *obj)
 		php_wddx_add_chunk_static(packet, WDDX_STRUCT_E);
 	}
 
+	PHP_CLEANUP_CLASS_ATTRIBUTES();
+
 	zval_dtor(fname);
 	FREE_ZVAL(fname);
 
@@ -812,6 +811,11 @@ static void php_wddx_push_element(void *user_data, const XML_Char *name, const X
 				php_wddx_process_data(user_data, atts[i+1], strlen(atts[i+1]));
 				break;
 			}
+		} else {
+			ent.type = ST_BOOLEAN;
+			SET_STACK_VARNAME;
+			ZVAL_FALSE(&ent.data);
+			wddx_stack_push((wddx_stack *)stack, &ent, sizeof(st_entry));
 		}
 	} else if (!strcmp(name, EL_NULL)) {
 		ent.type = ST_NULL;
@@ -1012,26 +1016,31 @@ static void php_wddx_pop_element(void *user_data, const XML_Char *name)
 							pce = &PHP_IC_ENTRY;
 						}
 
-						/* Initialize target object */
-						MAKE_STD_ZVAL(obj);
-						object_init_ex(obj, *pce);
+						if (pce != &PHP_IC_ENTRY && ((*pce)->serialize || (*pce)->unserialize)) {
+							zval_ptr_dtor(&ent2->data);
+							ent2->data = NULL;
+							php_error_docref(NULL TSRMLS_CC, E_WARNING, "Class %s can not be unserialized", Z_STRVAL_P(ent1->data));
+						} else {
+							/* Initialize target object */
+							MAKE_STD_ZVAL(obj);
+							object_init_ex(obj, *pce);
 
-						/* Merge current hashtable with object's default properties */
-						zend_hash_merge(Z_OBJPROP_P(obj),
-										Z_ARRVAL_P(ent2->data),
-										(void (*)(void *)) zval_add_ref,
-										(void *) &tmp, sizeof(zval *), 0);
+							/* Merge current hashtable with object's default properties */
+							zend_hash_merge(Z_OBJPROP_P(obj),
+											Z_ARRVAL_P(ent2->data),
+											(void (*)(void *)) zval_add_ref,
+											(void *) &tmp, sizeof(zval *), 0);
 
-						if (incomplete_class) {
-							php_store_class_name(obj, Z_STRVAL_P(ent1->data), Z_STRLEN_P(ent1->data));
+							if (incomplete_class) {
+								php_store_class_name(obj, Z_STRVAL_P(ent1->data), Z_STRLEN_P(ent1->data));
+							}
+
+							/* Clean up old array entry */
+							zval_ptr_dtor(&ent2->data);
+
+							/* Set stack entry to point to the newly created object */
+							ent2->data = obj;
 						}
-
-						/* Clean up old array entry */
-						zval_ptr_dtor(&ent2->data);
-
-						/* Set stack entry to point to the newly created object */
-						ent2->data = obj;
-
 						/* Clean up class name var entry */
 						zval_ptr_dtor(&ent1->data);
 					} else if (Z_TYPE_P(ent2->data) == IS_OBJECT) {
@@ -1048,6 +1057,8 @@ static void php_wddx_pop_element(void *user_data, const XML_Char *name)
 				} else	{
 					zend_hash_next_index_insert(target_hash, &ent1->data, sizeof(zval *), NULL);
 				}
+			} else if (!strcmp(name, EL_BINARY) && Z_STRLEN_P(ent1->data) < 1) {
+				zval_ptr_dtor(&ent1->data);
 			}
 			efree(ent1);
 		} else {

ext/xmlrpc/libxmlrpc/base64.c

@@ -15,6 +15,7 @@ static const char rcsid[] = "#(@) $Id$";
 /*  ENCODE  --	Encode binary file into base64.  */
 #include <stdlib.h>
 #include <ctype.h>
+#include <limits.h>
 
 #include "base64.h"
 
@@ -31,6 +32,9 @@ void buffer_new(struct buffer_st *b)
 
 void buffer_add(struct buffer_st *b, char c)
 {
+  if ((INT_MAX - b->length) <= 512) {
+		return;
+  }
   *(b->ptr++) = c;
   b->offset++;
   if (b->offset == b->length) {
@@ -54,13 +58,13 @@ void base64_encode_xmlrpc(struct buffer_st *b, const char *source, int length)
   int i, hiteof = 0;
   int offset = 0;
   int olen;
-  
+
   olen = 0;
-  
+
   buffer_new(b);
-  
+
   /*	Fill dtable with character encodings.  */
-  
+
   for (i = 0; i < 26; i++) {
     dtable[i] = 'A' + i;
     dtable[26 + i] = 'a' + i;
@@ -70,16 +74,16 @@ void base64_encode_xmlrpc(struct buffer_st *b, const char *source, int length)
   }
   dtable[62] = '+';
   dtable[63] = '/';
-  
+
   while (!hiteof) {
     unsigned char igroup[3], ogroup[4];
     int c, n;
-    
+
     igroup[0] = igroup[1] = igroup[2] = 0;
     for (n = 0; n < 3; n++) {
       c = *(source++);
       offset++;
-      if (offset > length) {
+      if (offset > length || offset <= 0) {
 	hiteof = 1;
 	break;
       }
@@ -90,11 +94,11 @@ void base64_encode_xmlrpc(struct buffer_st *b, const char *source, int length)
       ogroup[1] = dtable[((igroup[0] & 3) << 4) | (igroup[1] >> 4)];
       ogroup[2] = dtable[((igroup[1] & 0xF) << 2) | (igroup[2] >> 6)];
       ogroup[3] = dtable[igroup[2] & 0x3F];
-      
+
       /* Replace characters in output stream with "=" pad
 	 characters if fewer than three characters were
 	 read from the end of the input stream. */
-      
+
       if (n < 3) {
 	ogroup[3] = '=';
 	if (n < 2) {

ext/xmlrpc/libxmlrpc/simplestring.c

@@ -80,6 +80,7 @@ static const char rcsid[] = "#(@) $Id$";
 
 #include <stdlib.h>
 #include <string.h>
+#include <limits.h>
 #include "simplestring.h"
 
 #define my_free(thing)  if(thing) {free(thing); thing = 0;}
@@ -200,7 +201,7 @@ void simplestring_addn(simplestring* target, const char* source, size_t add_len)
          simplestring_init_str(target);
       }
 
-      if((SIZE_MAX - add_len) < target->len || (SIZE_MAX - add_len - 1) < target->len) {
+      if((INT_MAX - add_len) < target->len || (INT_MAX - add_len - 1) < target->len) {
     	  /* check for overflows, if there's a potential overflow do nothing */
     	  return;
       }

ext/zip/php_zip.c

@@ -1701,7 +1701,7 @@ static ZIPARCHIVE_METHOD(addEmptyDir)
 	}
 
 	if (dirname[dirname_len-1] != '/') {
-		s=(char *)emalloc(dirname_len+2);
+		s=(char *)safe_emalloc(dirname_len, 1, 2);
 		strcpy(s, dirname);
 		s[dirname_len] = '/';
 		s[dirname_len+1] = '\0';
@@ -1915,14 +1915,14 @@ static ZIPARCHIVE_METHOD(addFromString)
 
 	ze_obj = (ze_zip_object*) zend_object_store_get_object(this TSRMLS_CC);
 	if (ze_obj->buffers_cnt) {
-		ze_obj->buffers = (char **)erealloc(ze_obj->buffers, sizeof(char *) * (ze_obj->buffers_cnt+1));
+		ze_obj->buffers = (char **)safe_erealloc(ze_obj->buffers, sizeof(char *), (ze_obj->buffers_cnt+1), 0);
 		pos = ze_obj->buffers_cnt++;
 	} else {
 		ze_obj->buffers = (char **)emalloc(sizeof(char *));
 		ze_obj->buffers_cnt++;
 		pos = 0;
 	}
-	ze_obj->buffers[pos] = (char *)emalloc(buffer_len + 1);
+	ze_obj->buffers[pos] = (char *)safe_emalloc(buffer_len, 1, 1);
 	memcpy(ze_obj->buffers[pos], buffer, buffer_len + 1);
 
 	zs = zip_source_buffer(intern, ze_obj->buffers[pos], buffer_len, 0);
@@ -2662,7 +2662,7 @@ static ZIPARCHIVE_METHOD(extractTo)
 		RETURN_FALSE;
 	}
 
-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|z", &pathto, &pathto_len, &zval_files) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|z", &pathto, &pathto_len, &zval_files) == FAILURE) {
 		return;
 	}
 

ext/zlib/zlib.c

@@ -673,7 +673,7 @@ static PHP_FUNCTION(name) \
 	if (SUCCESS != php_zlib_encode(in_buf, in_len, &out_buf, &out_len, encoding, level TSRMLS_CC)) { \
 		RETURN_FALSE; \
 	} \
-	RETURN_STRINGL(out_buf, out_len, 0); \
+	RETVAL_STRINGL_CHECK(out_buf, out_len, 0); \
 }
 
 #define PHP_ZLIB_DECODE_FUNC(name, encoding) \

main/php_version.h

@@ -2,7 +2,7 @@
 /* edit configure.in to change version number */
 #define PHP_MAJOR_VERSION 5
 #define PHP_MINOR_VERSION 6
-#define PHP_RELEASE_VERSION 28
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "5.6.28-dev"
-#define PHP_VERSION_ID 50628
+#define PHP_RELEASE_VERSION 30
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "5.6.30"
+#define PHP_VERSION_ID 50630

main/streams/glob_wrapper.c

@@ -213,10 +213,6 @@ static php_stream *php_glob_stream_opener(php_stream_wrapper *wrapper, const cha
 	int ret;
 	const char *tmp, *pos;
 
-	if (((options & STREAM_DISABLE_OPEN_BASEDIR) == 0) && php_check_open_basedir(path TSRMLS_CC)) {
-		return NULL;
-	}
-
 	if (!strncmp(path, "glob://", sizeof("glob://")-1)) {
 		path += sizeof("glob://")-1;
 		if (opened_path) {
@@ -224,6 +220,10 @@ static php_stream *php_glob_stream_opener(php_stream_wrapper *wrapper, const cha
 		}
 	}
 
+	if (((options & STREAM_DISABLE_OPEN_BASEDIR) == 0) && php_check_open_basedir(path TSRMLS_CC)) {
+		return NULL;
+	}
+
 	pglob = ecalloc(sizeof(*pglob), 1);
 	
 	if (0 != (ret = glob(path, pglob->flags & GLOB_FLAGMASK, NULL, &pglob->glob))) {