5.6.25

BLock test with memory leak
fix tests
2026-11-10 10:40:50 +00:00 · 2016-08-18 13:07:46 +02:00 · 2016-08-18 12:54:07 +02:00 · 2016-08-18 12:54:00 +02:00 · 2016-08-18 12:53:53 +02:00 · 2016-08-18 12:53:47 +02:00
301 changed files with 3850 additions and 7382 deletions
@@ -1,16 +0,0 @@
-; http://editorconfig.org/
-
-root = true
-
-[*.{c,h}]
-charset                  = UTF-8
-end_of_line              = LF
-indent_size              = 4
-indent_style             = tab
-insert_final_newline     = true
-tab_width                = 4
-trim_trailing_whitespace = true
-
-[*.yml]
-indent_size              = 2
-indent_style             = space
@@ -135,7 +135,6 @@ tests/*/*.sh
 */tests/*/*.sh
 */*/tests/*.diff
 */*/tests/*.out
-*/*/tests/*.out.png
 */*/tests/*.php
 */*/tests/*.exp
 */*/tests/*.log
@@ -181,8 +181,8 @@ STATUS:              Working
 SINCE:               5.1
 -------------------------------------------------------------------------------
 EXTENSION:           pdo_dblib
-PRIMARY MAINTAINER:  Adam Baratz <adambaratz@php.net>
-MAINTENANCE:         Maintained
+PRIMARY MAINTAINER:  Unknown
+MAINTENANCE:         Odd fixes
 STATUS:              Working
 SINCE:               5.1
 -------------------------------------------------------------------------------
@@ -205,7 +205,7 @@ STATUS:              Working
 SINCE:               5.1
 -------------------------------------------------------------------------------
 EXTENSION:           pdo_oci
-PRIMARY MAINTAINER:  Christopher Jones <sixd@php.net>
+PRIMARY MAINTAINER:  Unknown
 MAINTENANCE:         Odd fixes
 STATUS:              Working
 SINCE:               5.1
@@ -1,212 +1,5 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-27 Oct 2016, PHP 5.6.28RC1
-
- Core:
-  . Fixed bug #73337 (try/catch not working with two exceptions inside a same
-    operation). (Dmitry)
-
-GD:
-  . Fixed bug #73213 (Integer overflow in imageline() with antialiasing). (cmb)
-  . Fixed bug #73272 (imagescale() is not affected by, but affects
-    imagesetinterpolation()). (cmb)
-  . Fixed bug #73279 (Integer overflow in gdImageScaleBilinearPalette()). (cmb)
-  . Fixed bug #73280 (Stack Buffer Overflow in GD dynamicGetbuf). (cmb)
-
- SOAP:
-  . Fixed bug #73037 (SoapServer reports Bad Request when gzipped). (Anatol)
-
- SQLite3:
-  . Fixed bug #73333 (2147483647 is fetched as string). (cmb)
-
- Standard:
-  . Fixed bug #73203 (passing additional_parameters causes mail to fail). (cmb)
-  . Fixed bug #73188 (use after free in userspace streams). (Sara)
-
-13 Oct 2016, PHP 5.6.27
-
- Core:
-  . Fixed bug #73025 (Heap Buffer Overflow in virtual_popen of
-    zend_virtual_cwd.c). (cmb)
-  . Fixed bug #73058 (crypt broken when salt is 'too' long). (Anatol)
-  . Fixed bug #72703 (Out of bounds global memory read in BF_crypt triggered by
-    password_verify). (Anatol)
-  . Fixed bug #73189 (Memcpy negative size parameter php_resolve_path). (Stas)
-  . Fixed bug #73147 (Use After Free in unserialize()). (Stas)
-
- BCmath:
-  . Fixed bug #73190 (memcpy negative parameter _bc_new_num_ex). (Stas)
-
- DOM:
-  . Fixed bug #73150 (missing NULL check in dom_document_save_html). (Stas)
-
- Ereg:
-  . Fixed bug #73284 (heap overflow in php_ereg_replace function). (Stas)
-
- Filter:
-  . Fixed bug #72972 (Bad filter for the flags FILTER_FLAG_NO_RES_RANGE and
-    FILTER_FLAG_NO_PRIV_RANGE). (julien)
-  . Fixed bug #67167 (Wrong return value from FILTER_VALIDATE_BOOLEAN,
-    FILTER_NULL_ON_FAILURE). (levim, cmb)
-  . Fixed bug #73054 (default option ignored when object passed to int filter).
-    (cmb)
-
- GD:
-  . Fixed bug #67325 (imagetruecolortopalette: white is duplicated in palette).
-    (cmb)
-  . Fixed bug #50194 (imagettftext broken on transparent background w/o
-    alphablending). (cmb)
-  . Fixed bug #73003 (Integer Overflow in gdImageWebpCtx of gd_webp.c). (trylab,
-    cmb)
-  . Fixed bug #53504 (imagettfbbox gives incorrect values for bounding box).
-    (Mark Plomer, cmb)
-  . Fixed bug #73157 (imagegd2() ignores 3rd param if 4 are given). (cmb)
-  . Fixed bug #73155 (imagegd2() writes wrong chunk sizes on boundaries). (cmb)
-  . Fixed bug #73159 (imagegd2(): unrecognized formats may result in corrupted
-    files). (cmb)
-  . Fixed bug #73161 (imagecreatefromgd2() may leak memory). (cmb)
-
- Intl:
-  . Fixed bug #73218 (add mitigation for ICU int overflow). (Stas)
-
- Imap:
-  . Fixed bug #73208 (integer overflow in imap_8bit caused heap corruption).
-    (Stas)
-
- Mbstring:
-  . Fixed bug #72994 (mbc_to_code() out of bounds read). (Laruence, cmb)
-  . Fixed bug #66964 (mb_convert_variables() cannot detect recursion). (Yasuo)
-  . Fixed bug #72992 (mbstring.internal_encoding doesn't inherit default_charset).
-    (Yasuo)
-  . Fixed bug #73082 (string length overflow in mb_encode_* function). (Stas)
-
- PCRE:
-  . Fixed bug #73174 (heap overflow in php_pcre_replace_impl). (Stas)
-
- Opcache:
-  . Fixed bug #72590 (Opcache restart with kill_all_lockers does not work).
-    (Keyur) (julien backport)
-
- OpenSSL:
-  . Fixed bug #73072 (Invalid path SNI_server_certs causes segfault).
-    (Jakub Zelenka)
-  . Fixed bug #73275 (crash in openssl_encrypt function). (Stas)
-  . Fixed bug #73276 (crash in openssl_random_pseudo_bytes function). (Stas)
-
- Session:
-  . Fixed bug #68015 (Session does not report invalid uid for files save handler).
-    (Yasuo)
-  . Fixed bug #73100 (session_destroy null dereference in ps_files_path_create).
-    (cmb)
-
- SimpleXML:
-  . Fixed bug #73293 (NULL pointer dereference in SimpleXMLElement::asXML()).
-    (Stas)
-
- SPL:
-  . Fixed bug #73073 (CachingIterator null dereference when convert to string).
-    (Stas)
-
- Standard:
-  . Fixed bug #73240 (Write out of bounds at number_format). (Stas)
-  . Fixed bug #73017 (memory corruption in wordwrap function). (Stas)
-
- Stream:
-  . Fixed bug #73069 (readfile() mangles files larger than 2G). (Laruence)
-
- Zip:
-  . Fixed bug #70752 (Depacking with wrong password leaves 0 length files).
-    (cmb)
-
-15 Sep 2016, PHP 5.6.26
-
- Core:
-  . Fixed bug #72907 (null pointer deref, segfault in gc_remove_zval_from_buffer
-    (zend_gc.c:260)). (Laruence)
-
- Dba:
-  . Fixed bug #71514 (Bad dba_replace condition because of wrong API usage).
-    (cmb)
-  . Fixed bug #70825 (Cannot fetch multiple values with group in ini file).
-    (cmb)
-
- EXIF:
-  . Fixed bug #72926 (Uninitialized Thumbail Data Leads To Memory Leakage in
-    exif_process_IFD_in_TIFF). (Stas)
-
- FTP:
-  . Fixed bug #70195 (Cannot upload file using ftp_put to FTPES with
-    require_ssl_reuse). (Benedict Singer)
-
- GD:
-  . Fixed bug #66005 (imagecopy does not support 1bit transparency on truecolor
-    images). (cmb)
-  . Fixed bug #72913 (imagecopy() loses single-color transparency on palette
-    images). (cmb)
-  . Fixed bug #68716 (possible resource leaks in _php_image_convert()). (cmb)
-
- Intl:
-  . Fixed bug #73007 (add locale length check). (Stas)
-
- JSON:
-  . Fixed bug #72787 (json_decode reads out of bounds). (Jakub Zelenka)
-
- mbstring:
-  . Fixed bug #66797 (mb_substr only takes 32-bit signed integer). (cmb)
-  . Fixed bug #72910 (Out of bounds heap read in mbc_to_code() / triggered by
-    mb_ereg_match()). (Stas)
-
- MSSQL:
-  . Fixed bug #72039 (Use of uninitialised value on mssql_guid_string). (Kalle)
-
- Mysqlnd:
-  . Fixed bug #72293 (Heap overflow in mysqlnd related to BIT fields). (Stas)
-
- Phar:
-  . Fixed bug #72928 (Out of bound when verify signature of zip phar in
-    phar_parse_zipfile). (Stas)
-  . Fixed bug #73035 (Out of bound when verify signature of tar phar in
-    phar_parse_tarfile). (Stas)
-
- PDO:
-  . Fixed bug #60665 (call to empty() on NULL result using PDO::FETCH_LAZY
-    returns false). (cmb)
-
- PDO_pgsql:
-  . Implemented FR #72633 (Postgres PDO lastInsertId() should work without
-    specifying a sequence). (Pablo Santiago Sánchez, Matteo)
-  . Fixed bug #72759 (Regression in pgo_pgsql). (Anatol)
-
- SPL:
-  . Fixed bug #73029 (Missing type check when unserializing SplArray). (Stas)
-
- Standard:
-  . Fixed bug #72823 (strtr out-of-bound access). (cmb)
-  . Fixed bug #72278 (getimagesize returning FALSE on valid jpg). (cmb)
-  . Fixed bug #65550 (get_browser() incorrectly parses entries with "+" sign).
-    (cmb)
-  . Fixed bug #71882 (Negative ftruncate() on php://memory exhausts memory).
-    (cmb)
-  . Fixed bug #73011 (integer overflow in fgets cause heap corruption). (Stas)
-  . Fixed bug #73017 (memory corruption in wordwrap function). (Stas)
-  . Fixed bug #73045 (integer overflow in fgetcsv caused heap corruption). (Stas)
-  . Fixed bug #73052 (Memory Corruption in During Deserialized-object Destruction)
-    (Stas)
-
- Streams:
-  . Fixed bug #72853 (stream_set_blocking doesn't work). (Laruence)
-
- Wddx:
-  . Fixed bug #72860 (wddx_deserialize use-after-free). (Stas)
-  . Fixed bug #73065 (Out-Of-Bounds Read in php_wddx_push_element). (Stas)
-
- XML:
-  . Fixed bug #72085 (SEGV on unknown address zif_xml_parse). (cmb)
-  . Fixed bug #72927 (integer overflow in xml_utf8_encode). (Stas)
-
- ZIP:
-  . Fixed bug #68302 (impossible to compile php with zip support). (cmb)
-
 18 Aug 2016, PHP 5.6.25

 - Bz2:
@@ -226,8 +19,6 @@ PHP                                                                        NEWS
  . Fixed bug #72663 (Create an Unexpected Object and Don't Invoke
    __wakeup() in Deserialization). (Stas)
  . Fixed bug #72681 (PHP Session Data Injection Vulnerability). (Stas)
-  . Fixed URL rewriter partially. It would not rewrite '//example.com/' URL
-    unconditionally. Only requested host(HTTP_HOST) is rewritten. (Yasuo)

 - Calendar:
  . Fixed bug #67976 (cal_days_month() fails for final month of the French
@@ -273,8 +64,6 @@ PHP                                                                        NEWS
  . Fixed bug #72697 (select_colors write out-of-bounds). (Stas)
  . Fixed bug #72709 (imagesetstyle() causes OOB read for empty $styles). (cmb)
  . Fixed bug #72730 (imagegammacorrect allows arbitrary write access). (Stas)
-  . Fixed bug #72494 (imagecropauto out-of-bounds access). (Fernando, Pierre,
-    cmb)

 - Intl:
  . Partially fixed #72506 (idn_to_ascii for UTS #46 incorrect for long domain
@@ -290,9 +79,6 @@ PHP                                                                        NEWS
  . Fixed bug #72710 (`mb_ereg` causes buffer overflow on regexp compile error).
    (ju1ius)

- OCI8:
-  . Fixed invalid handle error with Implicit Result Sets. (Chris Jones)
-
 - PCRE:
  . Fixed bug #72688 (preg_match missing group names in matches). (cmb)

@@ -314,6 +100,7 @@ PHP                                                                        NEWS
  . Fixed bug #72848 (integer overflow in quoted_printable_encode). (Stas)
  . Fixed bug #72849 (integer overflow in urlencode). (Stas)
  . Fixed bug #72850 (integer overflow in php_uuencode). (Stas)
+  . Fixed bug #72716 (initialize buffer before read). (Stas)

 - Streams:
  . Fixed bug #41021 (Problems with the ftps wrapper). (vhuk)
@@ -437,7 +224,7 @@ PHP                                                                        NEWS
    (cmb)
  . Fixed bug #72298 (pass2_no_dither out-of-bounds access). (Stas)
  . Fixed bug #72337 (invalid dimensions can lead to crash). (Pierre)
-  . Fixed bug #72339 (Integer Overflow in _gd2GetHeader() resulting in
+  . Fixed bug #72339 (Integer Overflow in _gd2GetHeader() resulting in 
    heap overflow). (CVE-2016-5766) (Pierre)
  . Fixed bug #72407 (NULL Pointer Dereference at _gdScaleVert). (Stas)
  . Fixed bug #72446 (Integer Overflow in gdImagePaletteToTrueColor() resulting
@@ -511,7 +298,7 @@ PHP                                                                        NEWS

 - Curl:
  . Fixed bug #71831 (CURLOPT_NOPROXY applied as long instead of string).
-    (Michael Sierks)
+    (Michael Sierks)    

 - Date:
  . Fixed bug #71889 (DateInterval::format Segmentation fault). (Thomas Punt)
@@ -826,7 +613,7 @@ PHP                                                                        NEWS
    a server). (Sergei Turchanov)

 - OpenSSL:
-  . Fixed bug #55259 (openssl extension does not get the DH parameters from
+  . Fixed bug #55259 (openssl extension does not get the DH parameters from 
    DH key resource). (Jakub Zelenka)
  . Fixed bug #70395 (Missing ARG_INFO for openssl_seal()). (cmb)
  . Fixed bug #60632 (openssl_seal fails with AES). (Jakub Zelenka)
@@ -918,7 +705,7 @@ PHP                                                                        NEWS
 - Standard:
  . Fixed bug #70052 (getimagesize() fails for very large and very small WBMP).
    (cmb)
-  . Fixed bug #70157 (parse_ini_string() segmentation fault with
+  . Fixed bug #70157 (parse_ini_string() segmentation fault with 
    INI_SCANNER_TYPED). (Tjerk)

 - XSLT:
@@ -944,7 +731,7 @@ PHP                                                                        NEWS
 - CLI server:
  . Fixed bug #69655 (php -S changes MKCALENDAR request method to MKCOL). (cmb)
  . Fixed bug #64878 (304 responses return Content-Type header). (cmb)
-
+  
 - GD:
  . Fixed bug #53156 (imagerectangle problem with point ordering). (cmb)
  . Fixed bug #66387 (Stack overflow with imagefilltoborder). (CVE-2015-8874)
@@ -1025,7 +812,7 @@ PHP                                                                        NEWS
 - Mysqlnd:
  . Fixed bug #69669 (mysqlnd is vulnerable to BACKRONYM). (CVE-2015-3152)
    (Andrey)
-
+    
 - PCRE:
  . Fixed Bug #53823 (preg_replace: * qualifier on unicode replace garbles the
    string). (cmb)
@@ -1118,7 +905,7 @@ PHP                                                                        NEWS
 14 May 2015, PHP 5.6.9

 - Core:
-  . Fixed bug #69467 (Wrong checked for the interface by using Trait).
+  . Fixed bug #69467 (Wrong checked for the interface by using Trait). 
    (Laruence)
  . Fixed bug #69420 (Invalid read in zend_std_get_method). (Laruence)
  . Fixed bug #60022 ("use statement [...] has no effect" depends on leading
@@ -1239,7 +1026,7 @@ PHP                                                                        NEWS
    (Mike)
  . Fixed bug #64931 (phar_add_file is too restrictive on filename). (Mike)
  . Fixed bug #65467 (Call to undefined method cli_arg_typ_string). (Mike)
-  . Fixed bug #67761 (Phar::mapPhar fails for Phars inside a path containing
+  . Fixed bug #67761 (Phar::mapPhar fails for Phars inside a path containing 
    ".tar"). (Mike)
  . Fixed bug #69324 (Buffer Over-read in unserialize when parsing Phar). (Stas)
  . Fixed bug #69441 (Buffer Overflow when parsing tar/zip/phar in
@@ -1251,7 +1038,7 @@ PHP                                                                        NEWS
 - SOAP:
  . Fixed bug #69152 (Type Confusion Infoleak Vulnerability in unserialize()
    with SoapFault). (Dmitry)
-  . Fixed bug #69293 (NEW segfault when using SoapClient::__setSoapHeader
+  . Fixed bug #69293 (NEW segfault when using SoapClient::__setSoapHeader 
     (bisected, regression)). (Laruence)

 - SPL:
@@ -1273,7 +1060,7 @@ PHP                                                                        NEWS
    (Laruence)
  . Fixed bug #69121 (Segfault in get_current_user when script owner is not
    in passwd with ZTS build). (dan at syneto dot net)
-  . Fixed bug #65593 (Segfault when calling ob_start from output buffering
+  . Fixed bug #65593 (Segfault when calling ob_start from output buffering 
    callback). (Mike)
  . Fixed bug #68986 (pointer returned by php_stream_fopen_temporary_file
    not validated in memory.c). (nayana at ddproperty dot com)
@@ -1310,7 +1097,7 @@ PHP                                                                        NEWS
  . Fixed bug #68964 (Allowed memory size exhausted with odbc_exec). (Anatol)

 - Opcache:
-  . Fixed bug #69159 (Opcache causes problem when passing a variable variable
+  . Fixed bug #69159 (Opcache causes problem when passing a variable variable 
    to a function). (Dmitry, Laruence)
  . Fixed bug #69125 (Array numeric string as key). (Laruence)
  . Fixed bug #69038 (switch(SOMECONSTANT) misbehaves). (Laruence)
@@ -1344,7 +1131,7 @@ PHP                                                                        NEWS
 - SPL:
  . Fixed bug #69108 ("Segmentation fault" when (de)serializing
    SplObjectStorage). (Laruence)
-  . Fixed bug #68557 (RecursiveDirectoryIterator::seek(0) broken after
+  . Fixed bug #68557 (RecursiveDirectoryIterator::seek(0) broken after 
    calling getChildren()). (Julien)

 - ZIP:
@@ -1420,7 +1207,7 @@ PHP                                                                        NEWS
  . Fixed bug #68063 (Empty session IDs do still start sessions) (Yasuo)

 - Sqlite3:
-  . Fixed bug #68260 (SQLite3Result::fetchArray declares wrong
+  . Fixed bug #68260 (SQLite3Result::fetchArray declares wrong 
    required_num_args). (Julien)

 - Standard:
@@ -1465,7 +1252,7 @@ PHP                                                                        NEWS
    CURLOPT_RETURNTRANSFER isn't set). (Jille Timmermans)

 - Date:
-  . Implemented FR #68268 (DatePeriod: Getter for start date, end date and
+  . Implemented FR #68268 (DatePeriod: Getter for start date, end date and 
    interval). (Marc Bennewitz)

 - EXIF:
@@ -1542,7 +1329,7 @@ PHP                                                                        NEWS
    (Adam)
  . Fixed bug #68104 (Segfault while pre-evaluating a disabled function).
    (Laruence)
-  . Fixed bug #68185 ("Inconsistent insteadof definition."- incorrectly
+  . Fixed bug #68185 ("Inconsistent insteadof definition."- incorrectly 
    triggered). (Julien)
  . Fixed bug #68355 (Inconsistency in example php.ini comments).
    (Chris McCafferty)
@@ -1589,7 +1376,7 @@ PHP                                                                        NEWS
  (Matteo)

 - Session:
-  . Fixed bug #68331 (Session custom storage callable functions not being called)
+  . Fixed bug #68331 (Session custom storage callable functions not being called) 
    (Yasuo Ohgaki)

 - SOAP:
@@ -1614,13 +1401,13 @@ PHP                                                                        NEWS
  . Fixed bug #68095 (AddressSanitizer reports a heap buffer overflow in
    php_getopt()). (Stas)
  . Fixed bug #68118 ($a->foo .= 'test'; can leave $a->foo undefined). (Nikita)
-  . Fixed bug #68129 (parse_url() - incomplete support for empty usernames
+  . Fixed bug #68129 (parse_url() - incomplete support for empty usernames 
    and passwords) (Tjerk)
  . Fixed bug #68365 (zend_mm_heap corrupted after memory overflow in
    zend_hash_copy). (Dmitry)

 - CURL:
-  . Add CURL_SSLVERSION_TLSv1_0, CURL_SSLVERSION_TLSv1_1, and
+  . Add CURL_SSLVERSION_TLSv1_0, CURL_SSLVERSION_TLSv1_1, and 
    CURL_SSLVERSION_TLSv1_2 constants if supported by libcurl (Rasmus)

 - Fileinfo:
@@ -1792,7 +1579,7 @@ PHP                                                                        NEWS
  . Fixed bug #67250 (iptcparse out-of-bounds read). (Stas)
  . Fixed bug #67252 (convert_uudecode out-of-bounds read). (Stas)
  . Fixed bug #67249 (printf out-of-bounds read). (Stas)
-  . Implemented FR #64744 (Differentiate between member function call on a null
+  . Implemented FR #64744 (Differentiate between member function call on a null 
    and non-null, non-objects). (Boro Sitnikovski)
  . Fixed bug #67436 (Autoloader isn't called if two method definitions don't
    match). (Bob)
@@ -1823,7 +1610,7 @@ PHP                                                                        NEWS
    (Ralf Lang, Mike)
  . Reduced POST data memory usage by 200-300%. Changed INI setting
    always_populate_raw_post_data to throw a deprecation warning when enabling
-    and to accept -1 for never populating the $HTTP_RAW_POST_DATA global
+    and to accept -1 for never populating the $HTTP_RAW_POST_DATA global 
    variable, which will be the default in future PHP versions. (Mike)
  . Implemented dedicated syntax for variadic functions
    (RFC: https://wiki.php.net/rfc/variadics). (Nikita)
@@ -1836,9 +1623,9 @@ PHP                                                                        NEWS
  . Allow zero length comparison in substr_compare() (Tjerk)
  . Fixed bug #60602 (proc_open() changes environment array) (Tjerk)
  . Fixed bug #61019 (Out of memory on command stream_get_contents). (Mike)
-  . Fixed bug #64330 (stream_socket_server() creates wrong Abstract Namespace
+  . Fixed bug #64330 (stream_socket_server() creates wrong Abstract Namespace 
    UNIX sockets). (Mike)
-  . Fixed bug #66182 (exit in stream filter produces segfault). (Mike)
+  . Fixed bug #66182 (exit in stream filter produces segfault). (Mike)  
  . Fixed bug #66736 (fpassthru broken). (Mike)
  . Fixed bug #66822 (Cannot use T_POW in const expression) (Tjerk)
  . Fixed bug #67043 (substr_compare broke by previous change) (Tjerk)
@@ -2209,7 +1996,7 @@ PHP                                                                        NEWS
    (Matteo)

 - PDO-ODBC:
-  . Fixed bug #50444 (PDO-ODBC changes for 64-bit).
+  . Fixed bug #50444 (PDO-ODBC changes for 64-bit). 

 - PDO_pgsql:
  . Fixed Bug #42614 (PDO_pgsql: add pg_get_notify support). (Matteo)
@@ -2268,7 +2055,7 @@ PHP                                                                        NEWS

 - SPL:
  . Revert fix for bug #67064 (BC issues). (Bob)
-  . Fixed bug #67539 (ArrayIterator use-after-free due to object change during
+  . Fixed bug #67539 (ArrayIterator use-after-free due to object change during 
    sorting). (CVE-2014-4698) (research at insighti dot org, Laruence)
  . Fixed bug #67538 (SPL Iterators use-after-free). (CVE-2014-4670) (Laruence)
  . Fixed bug #67492 (unserialize() SPL ArrayObject / SPLObjectStorage Type
@@ -2297,7 +2084,7 @@ PHP                                                                        NEWS
    token). (Ferenc)

 - XMLReader:
-  . Fixed bug #55285 (XMLReader::getAttribute/No/Ns methods inconsistency).
+  . Fixed bug #55285 (XMLReader::getAttribute/No/Ns methods inconsistency). 
    (Mike)

 - XSL:
@@ -2317,7 +2104,7 @@ PHP                                                                        NEWS

 - Zlib:
  . Fixed bug #67865 (internal corruption phar error). Mike
-  . Fixed bug #67724 (chained zlib filters silently fail with large amounts of
+  . Fixed bug #67724 (chained zlib filters silently fail with large amounts of 
    data). (Mike)

 21 Aug 2014, PHP 5.5.16
@@ -2342,7 +2129,7 @@ PHP                                                                        NEWS

 - Milter:
  . Fixed bug #67715 (php-milter does not build and crashes randomly). (Mike)
-
+  
 - Network:
  . Fixed bug #67717 (segfault in dns_get_record). (CVE-2014-3597) (Remi)

@@ -2396,7 +2183,7 @@ PHP                                                                        NEWS
  . Fixed bug #67531 (syslog cannot be set in pool configuration). (Remi)

 - Intl:
-  . Fixed bug #66921 (Wrong argument type hint for function
+  . Fixed bug #66921 (Wrong argument type hint for function 
    intltz_from_date_time_zone). (Stas)
  . Fixed bug #67052 (NumberFormatter::parse() resets LC_NUMERIC setting).
    (Stas)
@@ -2413,7 +2200,7 @@ PHP                                                                        NEWS
  . Fixed bug #67587 (Redirection loop on nginx with FPM). (Christian Weiske)

 - SPL:
-  . Fixed bug #67539 (ArrayIterator use-after-free due to object change during
+  . Fixed bug #67539 (ArrayIterator use-after-free due to object change during 
    sorting). (CVE-2014-4698) (research at insighti dot org, Laruence)
  . Fixed bug #67538 (SPL Iterators use-after-free). (CVE-2014-4670) (Laruence)

@@ -2535,9 +2322,9 @@ PHP                                                                        NEWS
 30 Apr 2014, PHP 5.5.12
 - Core:
  . Fixed bug #61019 (Out of memory on command stream_get_contents). (Mike)
-  . Fixed bug #64330 (stream_socket_server() creates wrong Abstract Namespace
+  . Fixed bug #64330 (stream_socket_server() creates wrong Abstract Namespace 
    UNIX sockets). (Mike)
-  . Fixed bug #66182 (exit in stream filter produces segfault). (Mike)
+  . Fixed bug #66182 (exit in stream filter produces segfault). (Mike)  
  . Fixed bug #66736 (fpassthru broken). (Mike)
  . Fixed bug #67024 (getimagesize should recognize BMP files with negative
    height). (Gabor Buella)
@@ -2631,7 +2418,7 @@ PHP                                                                        NEWS
    (Nikita)

 - Intl:
-  . Fixed bug #66873 (A reproductible crash in UConverter when given invalid
+  . Fixed bug #66873 (A reproductible crash in UConverter when given invalid 
    encoding) (Stas)

 - Mail:
@@ -2706,7 +2493,7 @@ PHP                                                                        NEWS
    (Dmitry)
  . Fixed bug #66461 (PHP crashes if opcache.interned_strings_buffer=0).
    (Dmitry)
-  . Fixed bug #66298 (ext/opcache/Optimizer/zend_optimizer.c has dos-style
+  . Fixed bug #66298 (ext/opcache/Optimizer/zend_optimizer.c has dos-style 
    ^M as lineend). (Laruence)

 - PDO_pgsql:
@@ -2748,12 +2535,12 @@ spaces) (willfitch, iliaa)
  . Fixed bug #66218 (zend_register_functions breaks reflection). (Remi)

 - Date:
-  . Fixed bug #66060 (Heap buffer over-read in DateInterval) (CVE-2013-6712).
+  . Fixed bug #66060 (Heap buffer over-read in DateInterval) (CVE-2013-6712). 
    (Remi)
  . Fixed bug #65768 (DateTimeImmutable::diff does not work). (Nikita Nefedov)
-
+  
 - DOM:
-  . Fixed bug #65196 (Passing DOMDocumentFragment to DOMDocument::saveHTML()
+  . Fixed bug #65196 (Passing DOMDocumentFragment to DOMDocument::saveHTML() 
    Produces invalid Markup). (Mike)

 - Exif:
@@ -2765,9 +2552,9 @@ spaces) (willfitch, iliaa)
 - GD:
  . Fixed bug #64405 (Use freetype-config for determining freetype2 dir(s)).
    (Adam)
-
+    
 - PDO_odbc:
-  . Fixed bug #66311 (Stack smashing protection kills PDO/ODBC queries).
+  . Fixed bug #66311 (Stack smashing protection kills PDO/ODBC queries). 
    (michael at orlitzky dot com)

 - MySQLi:
@@ -2804,7 +2591,7 @@ spaces) (willfitch, iliaa)
    server) - also implements apache_response_headers() (Andrea Faulds)

 - Core:
-  . Fixed bug #66094 (unregister_tick_function tries to cast a Closure to a
+  . Fixed bug #66094 (unregister_tick_function tries to cast a Closure to a 
    string). (Laruence)
  . Fixed bug #65969 (Chain assignment with T_LIST failure). (Dmitry)

@@ -2824,7 +2611,7 @@ spaces) (willfitch, iliaa)
 14 Nov 2013, PHP 5.5.6

 - Core:
-  . Fixed bug #65947 (basename is no more working after fgetcsv in certain
+  . Fixed bug #65947 (basename is no more working after fgetcsv in certain 
    situation). (Laruence)
  . Improved performance of array_merge() and func_get_args() by eliminating
    useless copying. (Dmitry)
@@ -2855,7 +2642,7 @@ spaces) (willfitch, iliaa)
    32 characters). (patch submitted by: michael dot y at zend dot com, Yasuo)

 - PDO:
-  . Fixed bug #66033 (Segmentation Fault when constructor of PDO statement
+  . Fixed bug #66033 (Segmentation Fault when constructor of PDO statement 
    throws an exception). (Laruence)
  . Fixed bug 65946 (sql_parser permanently converts values bound to strings)

@@ -2876,7 +2663,7 @@ spaces) (willfitch, iliaa)
 - CLI server:
  . Fixed bug #65633 (built-in server treat some http headers as
    case-sensitive). (Adam)
-  . Fixed bug #65818 (Segfault with built-in webserver and chunked transfer
+  . Fixed bug #65818 (Segfault with built-in webserver and chunked transfer 
    encoding). (Felipe)
  . Added application/pdf to PHP CLI Web Server mime types (Chris Jones)

@@ -2929,17 +2716,17 @@ spaces) (willfitch, iliaa)
    a default value). (Nikita)

 - Standard:
-  . Fixed bug #61548 (content-type must appear at the end of headers for 201
+  . Fixed bug #61548 (content-type must appear at the end of headers for 201 
    Location to work in http). (Mike)

 - XMLReader:
  . Fixed bug #51936 (Crash with clone XMLReader). (Mike)
  . Fixed bug #64230 (XMLReader does not suppress errors). (Mike)
-
+  
 - Build system:
  . Fixed bug #51076 (race condition in shtool's mkdir -p implementation).
    (Mike, Raphael Geissert)
-  . Fixed bug #62396 ('make test' crashes starting with 5.3.14 (missing
+  . Fixed bug #62396 ('make test' crashes starting with 5.3.14 (missing 
    gzencode())). (Mike)


@@ -2949,7 +2736,7 @@ spaces) (willfitch, iliaa)
  . Fixed bug #60598 (cli/apache sapi segfault on objects manipulation).
    (Laruence)
  . Improved fputcsv() to allow specifying escape character.
-  . Fixed bug #65490 (Duplicate calls to get lineno & filename for
+  . Fixed bug #65490 (Duplicate calls to get lineno & filename for 
    DTRACE_FUNCTION_*). (Chris Jones)
  . Fixed bug #65483 (quoted-printable encode stream filter incorrectly encoding
    spaces). (Michael M Slusarz)
@@ -2981,21 +2768,21 @@ spaces) (willfitch, iliaa)
    some cases). (Mark Jones)

 - PDO:
-  . Fixed bug #64953 (Postgres prepared statement positional parameter
+  . Fixed bug #64953 (Postgres prepared statement positional parameter 
    casting). (Mike)

 - Session:
  . Fixed bug #65475 (Session ID is not initialized properly when strict session
    is enabled). (Yasuo)
-  . Fixed bug #51127/#65359 Request #25630/#43980/#54383 (Added php_serialize
+  . Fixed bug #51127/#65359 Request #25630/#43980/#54383 (Added php_serialize 
    session serialize handler that uses plain serialize()). (Yasuo)

 - Standard:
  . Fix issue with return types of password API helper functions. Found via
-    static analysis by cjones. (Anthony Ferrara)
+    static analysis by cjones. (Anthony Ferrara) 

 - Zlib:
-  . Fixed bug #65391 (Unable to send vary header user-agent when
+  . Fixed bug #65391 (Unable to send vary header user-agent when 
    ob_start('ob_gzhandler') is called) (Mike)

 22 Aug 2013, PHP 5.5.3
@@ -3020,8 +2807,8 @@ spaces) (willfitch, iliaa)
    Zend/zend_dtrace.d) (Chris Jones)

 - DOM:
-  . Added flags option to DOMDocument::schemaValidate() and
-    DOMDocument::schemaValidateSource(). Added LIBXML_SCHEMA_CREATE flag.
+  . Added flags option to DOMDocument::schemaValidate() and 
+    DOMDocument::schemaValidateSource(). Added LIBXML_SCHEMA_CREATE flag. 
    (Chris Wright)

 - OPcache:
@@ -3044,12 +2831,12 @@ spaces) (willfitch, iliaa)
    /pg_delete()/pg_insert()). (Yasuo)

 - Phar:
-  . Fixed bug #65028 (Phar::buildFromDirectory creates corrupt archives for
+  . Fixed bug #65028 (Phar::buildFromDirectory creates corrupt archives for 
    some specific contents). (Stas)

 - Sessions:
  . Implemented strict sessions RFC (https://wiki.php.net/rfc/strict_sessions)
-    which protects against session fixation attacks and session collisions.
+    which protects against session fixation attacks and session collisions.    
    (CVE-2011-4718). (Yasuo Ohgaki)
  . Fixed possible buffer overflow under Windows. Note: Not a security fix.
    (Yasuo)
@@ -3060,9 +2847,9 @@ spaces) (willfitch, iliaa)

 - SPL:
  . Fixed bug #65328 (Segfault when getting SplStack object Value). (Laruence)
-  . Added RecursiveTreeIterator setPostfix and getPostifx methods. (Joshua
+  . Added RecursiveTreeIterator setPostfix and getPostifx methods. (Joshua 
    Thijssen)
-  . Fixed bug #61697 (spl_autoload_functions returns lambda functions
+  . Fixed bug #61697 (spl_autoload_functions returns lambda functions 
    incorrectly). (Laruence)

 - Streams:
@@ -3079,7 +2866,7 @@ spaces) (willfitch, iliaa)
    with a namespace). (Laruence)
  . Fixed bug #65088 (Generated configure script is malformed on OpenBSD).
    (Adam)
-  . Fixed bug #65108 (is_callable() triggers Fatal Error).
+  . Fixed bug #65108 (is_callable() triggers Fatal Error). 
    (David Soria Parra, Laruence)
  . Fixed bug #65035 (yield / exit segfault). (Nikita)
  . Fixed bug #65161 (Generator + autoload + syntax error = segfault). (Nikita)
@@ -3497,7 +3284,7 @@ spaces) (willfitch, iliaa)
  . Fixed bug #63284 (Upgrade PCRE to 8.31). (Anatoliy)

 - PDO:
-  . Fixed bug #63176 (Segmentation fault when instantiate 2 persistent PDO to
+  . Fixed bug #63176 (Segmentation fault when instantiate 2 persistent PDO to 
    the same db server). (Laruence)

 - PDO_DBlib:
@@ -3583,7 +3370,7 @@ spaces) (willfitch, iliaa)
 06 Jun 2013, PHP 5.4.16

 - Core:
-  . Fixed bug #64879 (Heap based buffer overflow in quoted_printable_encode,
+  . Fixed bug #64879 (Heap based buffer overflow in quoted_printable_encode, 
    CVE 2013-2110). (Stas)
  . Fixed bug #64853 (Use of no longer available ini directives causes crash on
    TS build). (Anatol)
@@ -3612,7 +3399,7 @@ spaces) (willfitch, iliaa)
    pointer has closed). (Laruence)

 - Phar
-  . Fixed bug #64214 (PHAR PHPTs intermittently crash when run on DFS, SMB or
+  . Fixed bug #64214 (PHAR PHPTs intermittently crash when run on DFS, SMB or 
    with non std tmp dir). (Pierre)

 - SNMP:
@@ -3625,7 +3412,7 @@ spaces) (willfitch, iliaa)
    on Windows x64). (Anatol)

 - Zend Engine:
-  . Fixed bug #64821 (Custom Exceptions crash when internal properties
+  . Fixed bug #64821 (Custom Exceptions crash when internal properties 
    overridden). (Anatol)

 09 May 2013, PHP 5.4.15
@@ -616,12 +616,6 @@ TSRM_API int shmget(int key, int size, int flags)
 		}
 	} else {
 		if (flags & IPC_EXCL) {
-			if (shm_handle) {
-				CloseHandle(shm_handle);
-			}
-			if (info_handle) {
-				CloseHandle(info_handle);
-			}
 			return -1;
 		}
 	}
@@ -660,27 +654,17 @@ TSRM_API int shmget(int key, int size, int flags)
 TSRM_API void *shmat(int key, const void *shmaddr, int flags)
 {
 	shm_pair *shm = shm_get(key, NULL);
-	int err;

 	if (!shm->segment) {
 		return (void*)-1;
 	}

-	shm->addr = MapViewOfFileEx(shm->segment, FILE_MAP_ALL_ACCESS, 0, 0, 0, NULL);
-
-	err = GetLastError();
-	if (err) {
-		/* Catch more errors */
-		if (ERROR_NOT_ENOUGH_MEMORY == err) {
-			_set_errno(ENOMEM);
-		}
-		return (void*)-1;
-	}
-
 	shm->descriptor->shm_atime = time(NULL);
 	shm->descriptor->shm_lpid  = getpid();
 	shm->descriptor->shm_nattch++;

+	shm->addr = MapViewOfFileEx(shm->segment, FILE_MAP_ALL_ACCESS, 0, 0, 0, NULL);
+
 	return shm->addr;
 }

@@ -1,25 +0,0 @@
--TEST--
-Next free element may overflow in array literals
--FILE--
-<?php
-
-$i = PHP_INT_MAX;
-$array = [$i => 42, new stdClass];
-var_dump($array);
-
-const FOO = [PHP_INT_MAX => 42, "foo"];
-var_dump(FOO);
-
-?>
--EXPECTF--
-Warning: Cannot add element to the array as the next element is already occupied in %s on line %d
-array(1) {
-  [%d]=>
-  int(42)
-}
-
-Warning: Cannot add element to the array as the next element is already occupied in %s on line %d
-array(1) {
-  [%d]=>
-  int(42)
-}
@@ -1,18 +0,0 @@
--TEST--
-Bug #72907 (null pointer deref, segfault in gc_remove_zval_from_buffer (zend_gc.c:260))
--FILE--
-<?php
-
-$a = 0;
-
-($a->a = &$E) + ($b = $a->b->i -= 0);
-
-?>
--EXPECTF--
-Warning: Attempt to modify property of non-object in %sbug72907.php on line %d
-
-Warning: Attempt to modify property of non-object in %sbug72907.php on line %d
-
-Warning: Creating default object from empty value in %sbug72907.php on line %d
-
-Notice: Undefined property: stdClass::$i in %sbug72907.php on line %d
@@ -1,12 +0,0 @@
--TEST--
-Bug #73337 (try/catch not working with two exceptions inside a same operation)
--FILE--
-<?php
-class d { function __destruct() { throw new Exception; } }
-try { new d + new d; } catch (Exception $e) { print "Exception properly caught\n"; }
-?>
--EXPECTF--
-Notice: Object of class d could not be converted to int in %sbug73337.php on line 3
-
-Notice: Object of class d could not be converted to int in %sbug73337.php on line 3
-Exception properly caught
@@ -1,15 +0,0 @@
--TEST--
-Constexpr arrays should be able to handle resource keys
--FILE--
-<?php
-
-const FOO = [STDIN => 42];
-var_dump(FOO);
-
-?>
--EXPECTF--
-Strict Standards: Resource ID#%d used as offset, casting to integer (%d) in %s on line %d
-array(1) {
-  [%d]=>
-  int(42)
-}
@@ -1074,7 +1074,7 @@ static int zval_update_class_constant(zval **pp, int is_static, int offset TSRML
 						*scope = old_scope;
 						return ret;
 					}
-				}
+				}				
 				ce = ce->parent;
 			} while (ce);

@@ -1279,14 +1279,9 @@ ZEND_API int add_assoc_double_ex(zval *arg, const char *key, uint key_len, doubl
 ZEND_API int add_assoc_string_ex(zval *arg, const char *key, uint key_len, char *str, int duplicate) /* {{{ */
 {
 	zval *tmp;
-	size_t _len = strlen(str);
-
-	if (UNEXPECTED(_len > INT_MAX)) {
-		zend_error_noreturn(E_ERROR, "String overflow, max size is %d", INT_MAX);
-	}

 	MAKE_STD_ZVAL(tmp);
-	ZVAL_STRINGL(tmp, str, _len, duplicate);
+	ZVAL_STRING(tmp, str, duplicate);

 	return zend_symtable_update(Z_ARRVAL_P(arg), key, key_len, (void *) &tmp, sizeof(zval *), NULL);
 }
@@ -1296,10 +1291,6 @@ ZEND_API int add_assoc_stringl_ex(zval *arg, const char *key, uint key_len, char
 {
 	zval *tmp;

-	if (UNEXPECTED(length > INT_MAX)) {
-		zend_error_noreturn(E_ERROR, "String overflow, max size is %d", INT_MAX);
-	}
-
 	MAKE_STD_ZVAL(tmp);
 	ZVAL_STRINGL(tmp, str, length, duplicate);

@@ -1371,11 +1362,6 @@ ZEND_API int add_index_double(zval *arg, ulong index, double d) /* {{{ */
 ZEND_API int add_index_string(zval *arg, ulong index, const char *str, int duplicate) /* {{{ */
 {
 	zval *tmp;
-	size_t _len = strlen(str);
-
-	if (UNEXPECTED(_len > INT_MAX)) {
-		zend_error_noreturn(E_ERROR, "String overflow, max size is %d", INT_MAX);
-	}

 	MAKE_STD_ZVAL(tmp);
 	ZVAL_STRING(tmp, str, duplicate);
@@ -1388,10 +1374,6 @@ ZEND_API int add_index_stringl(zval *arg, ulong index, const char *str, uint len
 {
 	zval *tmp;

-	if (UNEXPECTED(length > INT_MAX)) {
-		zend_error_noreturn(E_ERROR, "String overflow, max size is %d", INT_MAX);
-	}
-
 	MAKE_STD_ZVAL(tmp);
 	ZVAL_STRINGL(tmp, str, length, duplicate);

@@ -1475,9 +1457,6 @@ ZEND_API int add_next_index_stringl(zval *arg, const char *str, uint length, int
 {
 	zval *tmp;

-	if (UNEXPECTED(length > INT_MAX)) {
-		zend_error_noreturn(E_ERROR, "String overflow, max size is %d", INT_MAX);
-	}
 	MAKE_STD_ZVAL(tmp);
 	ZVAL_STRINGL(tmp, str, length, duplicate);

@@ -1494,14 +1473,9 @@ ZEND_API int add_next_index_zval(zval *arg, zval *value) /* {{{ */
 ZEND_API int add_get_assoc_string_ex(zval *arg, const char *key, uint key_len, const char *str, void **dest, int duplicate) /* {{{ */
 {
 	zval *tmp;
-	size_t _len = strlen(str);
-
-	if (UNEXPECTED(_len > INT_MAX)) {
-		zend_error_noreturn(E_ERROR, "String overflow, max size is %d", INT_MAX);
-	}

 	MAKE_STD_ZVAL(tmp);
-	ZVAL_STRINGL(tmp, str, _len, duplicate);
+	ZVAL_STRING(tmp, str, duplicate);

 	return zend_symtable_update(Z_ARRVAL_P(arg), key, key_len, (void *) &tmp, sizeof(zval *), dest);
 }
@@ -1511,10 +1485,6 @@ ZEND_API int add_get_assoc_stringl_ex(zval *arg, const char *key, uint key_len,
 {
 	zval *tmp;

-	if (UNEXPECTED(length > INT_MAX)) {
-		zend_error_noreturn(E_ERROR, "String overflow, max size is %d", INT_MAX);
-	}
-
 	MAKE_STD_ZVAL(tmp);
 	ZVAL_STRINGL(tmp, str, length, duplicate);

@@ -1694,14 +1664,9 @@ ZEND_API int add_property_string_ex(zval *arg, const char *key, uint key_len, co
 {
 	zval *tmp;
 	zval *z_key;
-	size_t _len = strlen(str);
-
-	if (UNEXPECTED(_len > INT_MAX)) {
-		zend_error_noreturn(E_ERROR, "String overflow, max size is %d", INT_MAX);
-	}

 	MAKE_STD_ZVAL(tmp);
-	ZVAL_STRINGL(tmp, str, _len, duplicate);
+	ZVAL_STRING(tmp, str, duplicate);

 	MAKE_STD_ZVAL(z_key);
 	ZVAL_STRINGL(z_key, key, key_len-1, 1);
@@ -1718,10 +1683,6 @@ ZEND_API int add_property_stringl_ex(zval *arg, const char *key, uint key_len, c
 	zval *tmp;
 	zval *z_key;

-	if (UNEXPECTED(length > INT_MAX)) {
-		zend_error_noreturn(E_ERROR, "String overflow, max size is %d", INT_MAX);
-	}
-
 	MAKE_STD_ZVAL(tmp);
 	ZVAL_STRINGL(tmp, str, length, duplicate);

@@ -1805,12 +1766,6 @@ ZEND_API int zend_startup_module_ex(zend_module_entry *module TSRMLS_DC) /* {{{
 }
 /* }}} */

-static int zend_startup_module_int(zend_module_entry *module TSRMLS_DC) /* {{{ */
-{
-	return (zend_startup_module_ex(module TSRMLS_CC) == SUCCESS) ? ZEND_HASH_APPLY_KEEP : ZEND_HASH_APPLY_REMOVE;
-}
-/* }}} */
-
 static void zend_sort_modules(void *base, size_t count, size_t siz, compare_func_t compare TSRMLS_DC) /* {{{ */
 {
 	Bucket **b1 = base;
@@ -1881,7 +1836,7 @@ ZEND_API void zend_collect_module_handlers(TSRMLS_D) /* {{{ */
 	module_post_deactivate_handlers = module_request_shutdown_handlers + shutdown_count + 1;
 	module_post_deactivate_handlers[post_deactivate_count] = NULL;
 	startup_count = 0;
-
+	
 	for (zend_hash_internal_pointer_reset_ex(&module_registry, &pos);
 	     zend_hash_get_current_data_ex(&module_registry, (void *) &module, &pos) == SUCCESS;
 	     zend_hash_move_forward_ex(&module_registry, &pos)) {
@@ -1927,7 +1882,7 @@ ZEND_API void zend_collect_module_handlers(TSRMLS_D) /* {{{ */
 ZEND_API int zend_startup_modules(TSRMLS_D) /* {{{ */
 {
 	zend_hash_sort(&module_registry, zend_sort_modules, NULL, 0 TSRMLS_CC);
-	zend_hash_apply(&module_registry, (apply_func_t)zend_startup_module_int TSRMLS_CC);
+	zend_hash_apply(&module_registry, (apply_func_t)zend_startup_module_ex TSRMLS_CC);
 	return SUCCESS;
 }
 /* }}} */
@@ -2128,7 +2083,7 @@ ZEND_API int zend_register_functions(zend_class_entry *scope, const zend_functio
 		}
 		if (ptr->arg_info) {
 			zend_internal_function_info *info = (zend_internal_function_info*)ptr->arg_info;
-
+			
 			internal_function->arg_info = (zend_arg_info*)ptr->arg_info+1;
 			internal_function->num_args = ptr->num_args;
 			/* Currently you cannot denote that the function can accept less arguments than num_args */
@@ -2746,7 +2701,7 @@ static int zend_is_callable_check_class(const char *name, int name_len, zend_fca
 			}
 			ret = 1;
 		}
-	} else if (name_len == sizeof("parent") - 1 &&
+	} else if (name_len == sizeof("parent") - 1 && 
 		       !memcmp(lcname, "parent", sizeof("parent") - 1)) {
 		if (!EG(scope)) {
 			if (error) *error = estrdup("cannot access parent:: when no class scope is active");
@@ -3075,7 +3030,7 @@ ZEND_API zend_bool zend_is_callable_ex(zval *callable, zval *object_ptr, uint ch
 	if (error) {
 		*error = NULL;
 	}
-
+	
 	fcc->initialized = 0;
 	fcc->calling_scope = NULL;
 	fcc->called_scope = NULL;
@@ -3087,7 +3042,7 @@ ZEND_API zend_bool zend_is_callable_ex(zval *callable, zval *object_ptr, uint ch
 		object_ptr = NULL;
 	}
 	if (object_ptr &&
-	    (!EG(objects_store).object_buckets ||
+	    (!EG(objects_store).object_buckets || 
 	     !EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(object_ptr)].valid)) {
 		return 0;
 	}
@@ -3168,7 +3123,7 @@ ZEND_API zend_bool zend_is_callable_ex(zval *callable, zval *object_ptr, uint ch
 						}

 					} else {
-						if (!EG(objects_store).object_buckets ||
+						if (!EG(objects_store).object_buckets || 
 						    !EG(objects_store).object_buckets[Z_OBJ_HANDLE_PP(obj)].valid) {
 							return 0;
 						}
@@ -3237,7 +3192,7 @@ ZEND_API zend_bool zend_is_callable_ex(zval *callable, zval *object_ptr, uint ch
 					*callable_name = emalloc(*callable_name_len + 1);
 					memcpy(*callable_name, ce->name, ce->name_length);
 					memcpy((*callable_name) + ce->name_length, "::__invoke", sizeof("::__invoke"));
-				}
+				}									
 				return 1;
 			}
 			/* break missing intentionally */
@@ -3776,30 +3731,6 @@ ZEND_API void zend_update_property(zend_class_entry *scope, zval *object, const
 }
 /* }}} */

-ZEND_API void zend_unset_property(zend_class_entry *scope, zval *object, const char *name, int name_length TSRMLS_DC) /* {{{ */
-{
-	zval *property;
-	zend_class_entry *old_scope = EG(scope);
-
-	EG(scope) = scope;
-
-	if (!Z_OBJ_HT_P(object)->unset_property) {
-		const char *class_name;
-		zend_uint class_name_len;
-
-		zend_get_object_classname(object, &class_name, &class_name_len TSRMLS_CC);
-
-		zend_error(E_CORE_ERROR, "Property %s of class %s cannot be unset", name, class_name);
-	}
-	MAKE_STD_ZVAL(property);
-	ZVAL_STRINGL(property, name, name_length, 1);
-	Z_OBJ_HT_P(object)->unset_property(object, property, 0 TSRMLS_CC);
-	zval_ptr_dtor(&property);
-
-	EG(scope) = old_scope;
-}
-/* }}} */
-
 ZEND_API void zend_update_property_null(zend_class_entry *scope, zval *object, const char *name, int name_length TSRMLS_DC) /* {{{ */
 {
 	zval *tmp;
@@ -330,7 +330,6 @@ ZEND_API void zend_update_property_long(zend_class_entry *scope, zval *object, c
 ZEND_API void zend_update_property_double(zend_class_entry *scope, zval *object, const char *name, int name_length, double value TSRMLS_DC);
 ZEND_API void zend_update_property_string(zend_class_entry *scope, zval *object, const char *name, int name_length, const char *value TSRMLS_DC);
 ZEND_API void zend_update_property_stringl(zend_class_entry *scope, zval *object, const char *name, int name_length, const char *value, int value_length TSRMLS_DC);
-ZEND_API void zend_unset_property(zend_class_entry *scope, zval *object, const char *name, int name_length TSRMLS_DC);

 ZEND_API int zend_update_static_property(zend_class_entry *scope, const char *name, int name_length, zval *value TSRMLS_DC);
 ZEND_API int zend_update_static_property_null(zend_class_entry *scope, const char *name, int name_length TSRMLS_DC);
@@ -655,20 +654,6 @@ END_EXTERN_C()
 } while (0)
 #define RETURN_ZVAL_FAST(z) { RETVAL_ZVAL_FAST(z); return; }

-/* Check that returned string length fits int */
-#define RETVAL_STRINGL_CHECK(s, len, dup) do {	\
-	size_t __len = (len);					\
-	if (UNEXPECTED(__len > INT_MAX)) { 		\
-		php_error_docref(NULL TSRMLS_CC, E_WARNING, "String too long, max is %d", INT_MAX); \
-		if(!(dup)) { 						\
-			efree((s));						\
-		}									\
-		RETURN_FALSE;						\
-	}										\
-	RETVAL_STRINGL((s), (int)__len, (dup)); \
-} while (0)
-
-
 #define SET_VAR_STRING(n, v) {																				\
 								{																			\
 									zval *var;																\
@@ -2578,15 +2578,6 @@ static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
 #endif


-ZEND_API void *_safe_emalloc_string(size_t nmemb, size_t size, size_t offset ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)
-{
-	size_t str_size = safe_address(nmemb, size, offset);
-	if (UNEXPECTED(str_size > INT_MAX)) {
-		zend_error_noreturn(E_ERROR, "String allocation overflow, max size is %d", INT_MAX);
-	}
-	return emalloc_rel(str_size);
-}
-
 ZEND_API void *_safe_emalloc(size_t nmemb, size_t size, size_t offset ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)
 {
 	return emalloc_rel(safe_address(nmemb, size, offset));
@@ -2735,9 +2726,9 @@ static void alloc_globals_ctor(zend_alloc_globals *alloc_globals TSRMLS_DC)
 		alloc_globals->mm_heap = malloc(sizeof(struct _zend_mm_heap));
 		memset(alloc_globals->mm_heap, 0, sizeof(struct _zend_mm_heap));
 		alloc_globals->mm_heap->use_zend_alloc = 0;
-		alloc_globals->mm_heap->_malloc = __zend_malloc;
+		alloc_globals->mm_heap->_malloc = malloc;
 		alloc_globals->mm_heap->_free = free;
-		alloc_globals->mm_heap->_realloc = __zend_realloc;
+		alloc_globals->mm_heap->_realloc = realloc;
 	} else {
 		alloc_globals->mm_heap = zend_mm_startup();
 	}
@@ -5,7 +5,7 @@
   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
-   | that is bundled with this package in the file LICENSE, and is        |
+   | that is bundled with this package in the file LICENSE, and is        | 
   | available through the world-wide-web at the following url:           |
   | http://www.zend.com/license/2_00.txt.                                |
   | If you did not receive a copy of the Zend license and are unable to  |
@@ -56,7 +56,6 @@ ZEND_API char *zend_strndup(const char *s, unsigned int length) ZEND_ATTRIBUTE_M

 ZEND_API void *_emalloc(size_t size ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) ZEND_ATTRIBUTE_MALLOC ZEND_ATTRIBUTE_ALLOC_SIZE(1);
 ZEND_API void *_safe_emalloc(size_t nmemb, size_t size, size_t offset ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) ZEND_ATTRIBUTE_MALLOC;
-ZEND_API void *_safe_emalloc_string(size_t nmemb, size_t size, size_t offset ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) ZEND_ATTRIBUTE_MALLOC;
 ZEND_API void *_safe_malloc(size_t nmemb, size_t size, size_t offset) ZEND_ATTRIBUTE_MALLOC;
 ZEND_API void _efree(void *ptr ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC);
 ZEND_API void *_ecalloc(size_t nmemb, size_t size ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) ZEND_ATTRIBUTE_MALLOC ZEND_ATTRIBUTE_ALLOC_SIZE2(1,2);
@@ -70,7 +69,6 @@ ZEND_API size_t _zend_mem_block_size(void *ptr TSRMLS_DC ZEND_FILE_LINE_DC ZEND_
 /* Standard wrapper macros */
 #define emalloc(size)						_emalloc((size) ZEND_FILE_LINE_CC ZEND_FILE_LINE_EMPTY_CC)
 #define safe_emalloc(nmemb, size, offset)	_safe_emalloc((nmemb), (size), (offset) ZEND_FILE_LINE_CC ZEND_FILE_LINE_EMPTY_CC)
-#define safe_emalloc_string(nmemb, size, offset)	_safe_emalloc_string((nmemb), (size), (offset) ZEND_FILE_LINE_CC ZEND_FILE_LINE_EMPTY_CC)
 #define efree(ptr)							_efree((ptr) ZEND_FILE_LINE_CC ZEND_FILE_LINE_EMPTY_CC)
 #define ecalloc(nmemb, size)				_ecalloc((nmemb), (size) ZEND_FILE_LINE_CC ZEND_FILE_LINE_EMPTY_CC)
 #define erealloc(ptr, size)					_erealloc((ptr), (size), 0 ZEND_FILE_LINE_CC ZEND_FILE_LINE_EMPTY_CC)
@@ -5929,7 +5929,7 @@ void zend_do_add_array_element(znode *result, const znode *expr, const znode *of
 }
 /* }}} */

-void zend_do_add_static_array_element(zval *result, zval *offset, zval *expr) /* {{{ */
+void zend_do_add_static_array_element(zval *result, zval *offset, const zval *expr) /* {{{ */
 {
 	if (offset) {
 		switch (Z_TYPE_P(offset)) {
@@ -5940,9 +5940,6 @@ void zend_do_add_static_array_element(zval *result, zval *offset, zval *expr) /*
 			case IS_NULL:
 				zend_symtable_update(Z_ARRVAL_P(result), "", 1, &expr, sizeof(zval *), NULL);
 				break;
-			case IS_RESOURCE:
-				zend_error(E_STRICT, "Resource ID#%ld used as offset, casting to integer (%ld)", Z_LVAL_P(offset), Z_LVAL_P(offset));
-				/* break missing intentionally */
 			case IS_LONG:
 			case IS_BOOL:
 				zend_hash_index_update(Z_ARRVAL_P(result), Z_LVAL_P(offset), &expr, sizeof(zval *), NULL);
@@ -5955,10 +5952,7 @@ void zend_do_add_static_array_element(zval *result, zval *offset, zval *expr) /*
 				break;
 		}
 	} else {
-		if (zend_hash_next_index_insert(Z_ARRVAL_P(result), &expr, sizeof(zval *), NULL) == FAILURE) {
-			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
-			zval_ptr_dtor(&expr);
-		}
+		zend_hash_next_index_insert(Z_ARRVAL_P(result), &expr, sizeof(zval *), NULL);
 	}
 }
 /* }}} */
@@ -598,7 +598,7 @@ void zend_do_shell_exec(znode *result, const znode *cmd TSRMLS_DC);

 void zend_do_init_array(znode *result, const znode *expr, const znode *offset, zend_bool is_ref TSRMLS_DC);
 void zend_do_add_array_element(znode *result, const znode *expr, const znode *offset, zend_bool is_ref TSRMLS_DC);
-void zend_do_add_static_array_element(zval *result, zval *offset, zval *expr);
+void zend_do_add_static_array_element(zval *result, zval *offset, const zval *expr);
 void zend_do_list_init(TSRMLS_D);
 void zend_do_list_end(znode *result, znode *expr TSRMLS_DC);
 void zend_do_add_list_element(const znode *element TSRMLS_DC);
@@ -229,9 +229,13 @@ ZEND_METHOD(exception, __construct)
 /* {{{ proto Exception::__wakeup()
   Exception unserialize checks */
 #define CHECK_EXC_TYPE(name, type) \
-	value = zend_read_property(default_exception_ce, object, name, sizeof(name)-1, 1 TSRMLS_CC); \
+	value = zend_read_property(default_exception_ce, object, name, sizeof(name)-1, 0 TSRMLS_CC); \
 	if (value && Z_TYPE_P(value) != IS_NULL && Z_TYPE_P(value) != type) { \
-		zend_unset_property(default_exception_ce, object, name, sizeof(name)-1 TSRMLS_CC); \
+		zval *tmp; \
+		MAKE_STD_ZVAL(tmp); \
+		ZVAL_STRINGL(tmp, name, sizeof(name)-1, 1); \
+		Z_OBJ_HANDLER_P(object, unset_property)(object, tmp, 0 TSRMLS_CC); \
+		zval_ptr_dtor(&tmp); \
 	}

 ZEND_METHOD(exception, __wakeup)
@@ -244,12 +248,7 @@ ZEND_METHOD(exception, __wakeup)
 	CHECK_EXC_TYPE("file", IS_STRING);
 	CHECK_EXC_TYPE("line", IS_LONG);
 	CHECK_EXC_TYPE("trace", IS_ARRAY);
-	value = zend_read_property(default_exception_ce, object, "previous", sizeof("previous")-1, 1 TSRMLS_CC);
-	if (value && Z_TYPE_P(value) != IS_NULL && (Z_TYPE_P(value) != IS_OBJECT ||
-			!instanceof_function(Z_OBJCE_P(value), default_exception_ce TSRMLS_CC) ||
-			value == object)) {
-		zend_unset_property(default_exception_ce, object, "previous", sizeof("previous")-1 TSRMLS_CC);
-	}
+	CHECK_EXC_TYPE("previous", IS_OBJECT);
 }
 /* }}} */

@@ -728,11 +727,7 @@ ZEND_METHOD(exception, __toString)
 		zval_dtor(&file);
 		zval_dtor(&line);

-		Z_OBJPROP_P(exception)->nApplyCount++;
-		exception = zend_read_property(default_exception_ce, exception, "previous", sizeof("previous")-1, 1 TSRMLS_CC);
-		if (exception && Z_TYPE_P(exception) == IS_OBJECT && Z_OBJPROP_P(exception)->nApplyCount > 0) {
-			exception = NULL;
-		}
+		exception = zend_read_property(default_exception_ce, exception, "previous", sizeof("previous")-1, 0 TSRMLS_CC);

 		if (trace) {
 			zval_ptr_dtor(&trace);
@@ -741,17 +736,6 @@ ZEND_METHOD(exception, __toString)
 	}
 	zval_dtor(&fname);

-	/* Reset apply counts */
-	exception = getThis();
-	while (exception && Z_TYPE_P(exception) == IS_OBJECT && instanceof_function(Z_OBJCE_P(exception), default_exception_ce TSRMLS_CC)) {
-		if(Z_OBJPROP_P(exception)->nApplyCount) {
-			Z_OBJPROP_P(exception)->nApplyCount--;
-		} else {
-			break;
-		}
-		exception = zend_read_property(default_exception_ce, exception, "previous", sizeof("previous")-1, 1 TSRMLS_CC);
-	}
-
 	/* We store the result in the private property string so we can access
 	 * the result in uncaught exception handlers without memleaks. */
 	zend_update_property_string(default_exception_ce, getThis(), "string", sizeof("string")-1, str TSRMLS_CC);
@@ -909,10 +893,11 @@ static void zend_error_va(int type, const char *file, uint lineno, const char *f
 ZEND_API void zend_exception_error(zval *exception, int severity TSRMLS_DC) /* {{{ */
 {
 	zend_class_entry *ce_exception = Z_OBJCE_P(exception);
-	EG(exception) = NULL;
 	if (instanceof_function(ce_exception, default_exception_ce TSRMLS_CC)) {
 		zval *str, *file, *line;

+		EG(exception) = NULL;
+
 		zend_call_method_with_0_params(&exception, ce_exception, NULL, "__tostring", &str);
 		if (!EG(exception)) {
 			if (Z_TYPE_P(str) != IS_STRING) {
@@ -951,7 +936,6 @@ ZEND_API void zend_exception_error(zval *exception, int severity TSRMLS_DC) /* {
 	} else {
 		zend_error(severity, "Uncaught exception '%s'", ce_exception->name);
 	}
-	zval_ptr_dtor(&exception);
 }
 /* }}} */

@@ -522,7 +522,9 @@ static void zend_assign_to_variable_reference(zval **variable_ptr_ptr, zval **va
 	zval *variable_ptr = *variable_ptr_ptr;
 	zval *value_ptr = *value_ptr_ptr;

-	if (variable_ptr != value_ptr) {
+	if (variable_ptr == &EG(error_zval) || value_ptr == &EG(error_zval)) {
+		variable_ptr_ptr = &EG(uninitialized_zval_ptr);
+	} else if (variable_ptr != value_ptr) {
 		if (!PZVAL_IS_REF(value_ptr)) {
 			/* break it away */
 			Z_DELREF_P(value_ptr);
@@ -826,10 +826,7 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache TS
 		if (EG(active_op_array)->fn_flags & ZEND_ACC_GENERATOR) {
 			*fci->retval_ptr_ptr = zend_generator_create_zval(EG(active_op_array) TSRMLS_CC);
 		} else {
-			const zend_op *current_opline_before_exception = EG(opline_before_exception);
-
 			zend_execute(EG(active_op_array) TSRMLS_CC);
-			EG(opline_before_exception) = current_opline_before_exception;
 		}

 		if (!fci->symbol_table && EG(active_symbol_table)) {
@@ -215,7 +215,7 @@ ZEND_API void zend_objects_store_del_ref_by_handle_ex(zend_object_handle handle,
 					} zend_end_try();
 				}
 			}
-
+			
 			/* re-read the object from the object store as the store might have been reallocated in the dtor */
 			obj = &EG(objects_store).object_buckets[handle].bucket.obj;

@@ -306,8 +306,8 @@ ZEND_API void zend_object_store_ctor_failed(zval *zobject TSRMLS_DC)
 {
 	zend_object_handle handle = Z_OBJ_HANDLE_P(zobject);
 	zend_object_store_bucket *obj_bucket = &EG(objects_store).object_buckets[handle];
-
-	obj_bucket->bucket.obj.handlers = Z_OBJ_HT_P(zobject);
+	
+	obj_bucket->bucket.obj.handlers = Z_OBJ_HT_P(zobject);;
 	obj_bucket->destructor_called = 1;
 }

@@ -1896,7 +1896,7 @@ CWD_API FILE *virtual_popen(const char *command, const char *type TSRMLS_DC) /*
 #else /* Unix */
 CWD_API FILE *virtual_popen(const char *command, const char *type TSRMLS_DC) /* {{{ */
 {
-	size_t command_length;
+	int command_length;
 	int dir_length, extra = 0;
 	char *command_line;
 	char *ptr, *dir;
@@ -1817,14 +1817,11 @@ ZEND_VM_HANDLER(39, ZEND_ASSIGN_REF, VAR|CV, VAR|CV)
 	if ((OP2_TYPE == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||
 	    (OP1_TYPE == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL))) {
 		zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets nor overloaded objects");
-	} else if ((OP2_TYPE == IS_VAR && UNEXPECTED(*value_ptr_ptr == &EG(error_zval))) ||
-		(OP1_TYPE == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval)))) {
-		variable_ptr_ptr = &EG(uninitialized_zval_ptr);
-	} else {
-		zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
-		if (OP2_TYPE == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
-			Z_DELREF_PP(variable_ptr_ptr);
-		}
+	}
+	zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
+
+	if (OP2_TYPE == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
+		Z_DELREF_PP(variable_ptr_ptr);
 	}

 	if (RETURN_VALUE_USED(opline)) {
@@ -3879,10 +3876,7 @@ ZEND_VM_C_LABEL(num_index):
 		}
 		FREE_OP2();
 	} else {
-		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
-			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
-			zval_ptr_dtor(&expr_ptr);
-		}
+		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
 	}
 	if ((OP1_TYPE == IS_VAR || OP1_TYPE == IS_CV) && opline->extended_value) {
 		FREE_OP1_VAR_PTR();
@@ -4119,10 +4119,7 @@ num_index:
 		}

 	} else {
-		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
-			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
-			zval_ptr_dtor(&expr_ptr);
-		}
+		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
 	}
 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {

@@ -5033,10 +5030,7 @@ num_index:
 		}
 		zval_dtor(free_op2.var);
 	} else {
-		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
-			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
-			zval_ptr_dtor(&expr_ptr);
-		}
+		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
 	}
 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {

@@ -5900,10 +5894,7 @@ num_index:
 		}
 		zval_ptr_dtor_nogc(&free_op2.var);
 	} else {
-		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
-			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
-			zval_ptr_dtor(&expr_ptr);
-		}
+		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
 	}
 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {

@@ -6623,10 +6614,7 @@ num_index:
 		}

 	} else {
-		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
-			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
-			zval_ptr_dtor(&expr_ptr);
-		}
+		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
 	}
 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {

@@ -7559,10 +7547,7 @@ num_index:
 		}

 	} else {
-		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
-			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
-			zval_ptr_dtor(&expr_ptr);
-		}
+		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
 	}
 	if ((IS_CONST == IS_VAR || IS_CONST == IS_CV) && opline->extended_value) {

@@ -9462,10 +9447,7 @@ num_index:
 		}

 	} else {
-		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
-			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
-			zval_ptr_dtor(&expr_ptr);
-		}
+		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
 	}
 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {

@@ -10332,10 +10314,7 @@ num_index:
 		}
 		zval_dtor(free_op2.var);
 	} else {
-		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
-			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
-			zval_ptr_dtor(&expr_ptr);
-		}
+		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
 	}
 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {

@@ -11201,10 +11180,7 @@ num_index:
 		}
 		zval_ptr_dtor_nogc(&free_op2.var);
 	} else {
-		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
-			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
-			zval_ptr_dtor(&expr_ptr);
-		}
+		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
 	}
 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {

@@ -11799,10 +11775,7 @@ num_index:
 		}

 	} else {
-		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
-			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
-			zval_ptr_dtor(&expr_ptr);
-		}
+		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
 	}
 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {

@@ -12651,10 +12624,7 @@ num_index:
 		}

 	} else {
-		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
-			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
-			zval_ptr_dtor(&expr_ptr);
-		}
+		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
 	}
 	if ((IS_TMP_VAR == IS_VAR || IS_TMP_VAR == IS_CV) && opline->extended_value) {

@@ -16137,10 +16107,7 @@ num_index:
 		}

 	} else {
-		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
-			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
-			zval_ptr_dtor(&expr_ptr);
-		}
+		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
 	}
 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
 		if (free_op1.var) {zval_ptr_dtor_nogc(&free_op1.var);};
@@ -18420,10 +18387,7 @@ num_index:
 		}
 		zval_dtor(free_op2.var);
 	} else {
-		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
-			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
-			zval_ptr_dtor(&expr_ptr);
-		}
+		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
 	}
 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
 		if (free_op1.var) {zval_ptr_dtor_nogc(&free_op1.var);};
@@ -20444,14 +20408,11 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDL
 	if ((IS_VAR == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||
 	    (IS_VAR == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL))) {
 		zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets nor overloaded objects");
-	} else if ((IS_VAR == IS_VAR && UNEXPECTED(*value_ptr_ptr == &EG(error_zval))) ||
-		(IS_VAR == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval)))) {
-		variable_ptr_ptr = &EG(uninitialized_zval_ptr);
-	} else {
-		zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
-		if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
-			Z_DELREF_PP(variable_ptr_ptr);
-		}
+	}
+	zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
+
+	if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
+		Z_DELREF_PP(variable_ptr_ptr);
 	}

 	if (RETURN_VALUE_USED(opline)) {
@@ -20761,10 +20722,7 @@ num_index:
 		}
 		zval_ptr_dtor_nogc(&free_op2.var);
 	} else {
-		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
-			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
-			zval_ptr_dtor(&expr_ptr);
-		}
+		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
 	}
 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
 		if (free_op1.var) {zval_ptr_dtor_nogc(&free_op1.var);};
@@ -22204,10 +22162,7 @@ num_index:
 		}

 	} else {
-		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
-			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
-			zval_ptr_dtor(&expr_ptr);
-		}
+		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
 	}
 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
 		if (free_op1.var) {zval_ptr_dtor_nogc(&free_op1.var);};
@@ -23948,14 +23903,11 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLE
 	if ((IS_CV == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||
 	    (IS_VAR == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL))) {
 		zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets nor overloaded objects");
-	} else if ((IS_CV == IS_VAR && UNEXPECTED(*value_ptr_ptr == &EG(error_zval))) ||
-		(IS_VAR == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval)))) {
-		variable_ptr_ptr = &EG(uninitialized_zval_ptr);
-	} else {
-		zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
-		if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
-			Z_DELREF_PP(variable_ptr_ptr);
-		}
+	}
+	zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
+
+	if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
+		Z_DELREF_PP(variable_ptr_ptr);
 	}

 	if (RETURN_VALUE_USED(opline)) {
@@ -24262,10 +24214,7 @@ num_index:
 		}

 	} else {
-		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
-			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
-			zval_ptr_dtor(&expr_ptr);
-		}
+		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
 	}
 	if ((IS_VAR == IS_VAR || IS_VAR == IS_CV) && opline->extended_value) {
 		if (free_op1.var) {zval_ptr_dtor_nogc(&free_op1.var);};
@@ -33619,10 +33568,7 @@ num_index:
 		}

 	} else {
-		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
-			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
-			zval_ptr_dtor(&expr_ptr);
-		}
+		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
 	}
 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {

@@ -35765,10 +35711,7 @@ num_index:
 		}
 		zval_dtor(free_op2.var);
 	} else {
-		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
-			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
-			zval_ptr_dtor(&expr_ptr);
-		}
+		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
 	}
 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {

@@ -37778,14 +37721,11 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLE
 	if ((IS_VAR == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||
 	    (IS_CV == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL))) {
 		zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets nor overloaded objects");
-	} else if ((IS_VAR == IS_VAR && UNEXPECTED(*value_ptr_ptr == &EG(error_zval))) ||
-		(IS_CV == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval)))) {
-		variable_ptr_ptr = &EG(uninitialized_zval_ptr);
-	} else {
-		zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
-		if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
-			Z_DELREF_PP(variable_ptr_ptr);
-		}
+	}
+	zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
+
+	if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
+		Z_DELREF_PP(variable_ptr_ptr);
 	}

 	if (RETURN_VALUE_USED(opline)) {
@@ -37968,10 +37908,7 @@ num_index:
 		}
 		zval_ptr_dtor_nogc(&free_op2.var);
 	} else {
-		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
-			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
-			zval_ptr_dtor(&expr_ptr);
-		}
+		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
 	}
 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {

@@ -39279,10 +39216,7 @@ num_index:
 		}

 	} else {
-		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
-			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
-			zval_ptr_dtor(&expr_ptr);
-		}
+		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
 	}
 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {

@@ -40995,14 +40929,11 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER
 	if ((IS_CV == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||
 	    (IS_CV == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL))) {
 		zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets nor overloaded objects");
-	} else if ((IS_CV == IS_VAR && UNEXPECTED(*value_ptr_ptr == &EG(error_zval))) ||
-		(IS_CV == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval)))) {
-		variable_ptr_ptr = &EG(uninitialized_zval_ptr);
-	} else {
-		zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
-		if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
-			Z_DELREF_PP(variable_ptr_ptr);
-		}
+	}
+	zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
+
+	if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
+		Z_DELREF_PP(variable_ptr_ptr);
 	}

 	if (RETURN_VALUE_USED(opline)) {
@@ -41182,10 +41113,7 @@ num_index:
 		}

 	} else {
-		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
-			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
-			zval_ptr_dtor(&expr_ptr);
-		}
+		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
 	}
 	if ((IS_CV == IS_VAR || IS_CV == IS_CV) && opline->extended_value) {

@@ -119,8 +119,8 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=6
-PHP_RELEASE_VERSION=28
-PHP_EXTRA_VERSION="RC1"
+PHP_RELEASE_VERSION=25
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -49,10 +49,7 @@ _bc_new_num_ex (length, scale, persistent)
     int length, scale, persistent;
 {
  bc_num temp;
-  /* PHP Change:  add length check */
-  if ((size_t)length+(size_t)scale > INT_MAX) {
-   zend_error(E_ERROR, "Result too long, max is %d", INT_MAX);
-  }
+
  /* PHP Change:  malloc() -> pemalloc(), removed free_list code */
  temp = (bc_num) safe_pemalloc (1, sizeof(bc_struct)+length, scale, persistent);
 #if 0
@@ -41,5 +41,6 @@

 void bc_out_of_memory (void)
 {
-  zend_error(E_ERROR, "bcmath: out of memory!");
+  (void) fprintf (stderr, "bcmath: out of memory!\n");
+  exit (1);
 }
@@ -137,10 +137,7 @@ ZEND_METHOD(CURLFile, setPostFilename)
   Unserialization handler */
 ZEND_METHOD(CURLFile, __wakeup)
 {
-	zval *_this = getThis();
-
-	zend_unset_property(curl_CURLFile_class, _this, "name", sizeof("name")-1 TSRMLS_CC);
-	zend_update_property_string(curl_CURLFile_class, _this, "name", sizeof("name")-1, "" TSRMLS_CC);
+	zend_update_property_string(curl_CURLFile_class, getThis(), "name", sizeof("name")-1, "" TSRMLS_CC);
 	zend_throw_exception(NULL, "Unserialization of CURLFile instances is not allowed", 0 TSRMLS_CC);
 }
 /* }}} */
@@ -1851,9 +1851,8 @@ static void create_certinfo(struct curl_certinfo *ci, zval *listcode TSRMLS_DC)
 				int len;
 				char s[64];
 				char *tmp;
-				strncpy(s, slist->data, sizeof(s));
-				s[sizeof(s)-1] = '\0';
-				tmp = memchr(s, ':', sizeof(s));
+				strncpy(s, slist->data, 64);
+				tmp = memchr(s, ':', 64);
 				if(tmp) {
 					*tmp = '\0';
 					len = strlen(s);
@@ -1,20 +0,0 @@
--TEST--
-Bug #73147: Use After Free in PHP7 unserialize()
--SKIPIF--
-<?php
-if (!extension_loaded("curl")) {
-        exit("skip curl extension not loaded");
-}
-?>
--FILE--
-<?php
-
-$poc = 'a:1:{i:0;O:8:"CURLFile":1:{s:4:"name";R:1;}}';
-try {
-var_dump(unserialize($poc));
-} catch(Exception $e) {
-	echo $e->getMessage();
-}
-?>
--EXPECT--
-Unserialization of CURLFile instances is not allowed
@@ -1,4 +1,4 @@
-/* Generated by re2c 0.15.3 on Fri Sep 30 20:18:29 2016 */
+/* Generated by re2c 0.15.3 on Sun Jul 24 14:49:45 2016 */
 #line 1 "ext/date/lib/parse_date.re"
 /*
 * The MIT License (MIT)
@@ -396,12 +396,8 @@ static timelib_sll timelib_meridian(char **ptr, timelib_sll h)
 	}
 	++*ptr;
 	if (**ptr == '.') {
-		++*ptr;
-	}
-	if (**ptr == 'M' || **ptr == 'm') {
-		++*ptr;
-	}
-	if (**ptr == '.') {
+		*ptr += 3;
+	} else {
 		++*ptr;
 	}
 	return retval;
@@ -824,11 +820,11 @@ static int scan(Scanner *s, timelib_tz_get_wrapper tz_get_wrapper)
 std:
 	s->tok = cursor;
 	s->len = 0;
-#line 950 "ext/date/lib/parse_date.re"
+#line 946 "ext/date/lib/parse_date.re"



-#line 832 "<stdout>"
+#line 828 "<stdout>"
 {
 	YYCTYPE yych;
 	unsigned int yyaccept = 0;
@@ -963,7 +959,7 @@ yy2:
 		}
 	}
 yy3:
-#line 1630 "ext/date/lib/parse_date.re"
+#line 1626 "ext/date/lib/parse_date.re"
 	{
 		int tz_not_found;
 		DEBUG_OUTPUT("tzcorrection | tz");
@@ -976,7 +972,7 @@ yy3:
 		TIMELIB_DEINIT;
 		return TIMELIB_TIMEZONE;
 	}
-#line 980 "<stdout>"
+#line 976 "<stdout>"
 yy4:
 	yych = *++YYCURSOR;
 	if (yych <= 'E') {
@@ -1276,12 +1272,12 @@ yy11:
 	if (yych <= '/') goto yy12;
 	if (yych <= '9') goto yy1385;
 yy12:
-#line 1725 "ext/date/lib/parse_date.re"
+#line 1721 "ext/date/lib/parse_date.re"
 	{
 		add_error(s, "Unexpected character");
 		goto std;
 	}
-#line 1285 "<stdout>"
+#line 1281 "<stdout>"
 yy13:
 	yych = *++YYCURSOR;
 	if (yych <= 'R') {
@@ -2295,22 +2291,22 @@ yy48:
 	if (yych <= '/') goto yy49;
 	if (yych <= '9') goto yy54;
 yy49:
-#line 1714 "ext/date/lib/parse_date.re"
+#line 1710 "ext/date/lib/parse_date.re"
 	{
 		goto std;
 	}
-#line 2303 "<stdout>"
+#line 2299 "<stdout>"
 yy50:
 	yych = *++YYCURSOR;
 	goto yy49;
 yy51:
 	++YYCURSOR;
-#line 1719 "ext/date/lib/parse_date.re"
+#line 1715 "ext/date/lib/parse_date.re"
 	{
 		s->pos = cursor; s->line++;
 		goto std;
 	}
-#line 2314 "<stdout>"
+#line 2310 "<stdout>"
 yy53:
 	yych = *++YYCURSOR;
 	goto yy12;
@@ -2677,7 +2673,7 @@ yy71:
 	if (yych == 'S') goto yy73;
 	if (yych == 's') goto yy73;
 yy72:
-#line 1698 "ext/date/lib/parse_date.re"
+#line 1694 "ext/date/lib/parse_date.re"
 	{
 		timelib_ull i;
 		DEBUG_OUTPUT("relative");
@@ -2692,7 +2688,7 @@ yy72:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 2696 "<stdout>"
+#line 2692 "<stdout>"
 yy73:
 	yych = *++YYCURSOR;
 	if (yych == 'D') goto yy74;
@@ -3360,7 +3356,7 @@ yy165:
 		}
 	}
 yy166:
-#line 1561 "ext/date/lib/parse_date.re"
+#line 1557 "ext/date/lib/parse_date.re"
 	{
 		const timelib_relunit* relunit;
 		DEBUG_OUTPUT("daytext");
@@ -3377,7 +3373,7 @@ yy166:
 		TIMELIB_DEINIT;
 		return TIMELIB_WEEKDAY;
 	}
-#line 3381 "<stdout>"
+#line 3377 "<stdout>"
 yy167:
 	yych = *++YYCURSOR;
 	if (yych <= 'K') {
@@ -3870,7 +3866,7 @@ yy192:
 		}
 	}
 yy193:
-#line 1620 "ext/date/lib/parse_date.re"
+#line 1616 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("monthtext");
 		TIMELIB_INIT;
@@ -3879,7 +3875,7 @@ yy193:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_TEXT;
 	}
-#line 3883 "<stdout>"
+#line 3879 "<stdout>"
 yy194:
 	++YYCURSOR;
 	if ((YYLIMIT - YYCURSOR) < 21) YYFILL(21);
@@ -3925,7 +3921,7 @@ yy197:
 		}
 	}
 yy198:
-#line 1366 "ext/date/lib/parse_date.re"
+#line 1362 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("datetextual | datenoyear");
@@ -3938,7 +3934,7 @@ yy198:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_TEXT;
 	}
-#line 3942 "<stdout>"
+#line 3938 "<stdout>"
 yy199:
 	yyaccept = 6;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -4183,7 +4179,7 @@ yy221:
 		if (yych <= ':') goto yy224;
 	}
 yy222:
-#line 1668 "ext/date/lib/parse_date.re"
+#line 1664 "ext/date/lib/parse_date.re"
 	{
 		int tz_not_found;
 		DEBUG_OUTPUT("dateshortwithtimeshort | dateshortwithtimelong | dateshortwithtimelongtz");
@@ -4212,7 +4208,7 @@ yy222:
 		TIMELIB_DEINIT;
 		return TIMELIB_SHORTDATE_WITH_TIME;
 	}
-#line 4216 "<stdout>"
+#line 4212 "<stdout>"
 yy223:
 	yyaccept = 7;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -4854,7 +4850,7 @@ yy276:
 	}
 yy277:
 	++YYCURSOR;
-#line 1644 "ext/date/lib/parse_date.re"
+#line 1640 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("dateshortwithtimeshort12 | dateshortwithtimelong12");
 		TIMELIB_INIT;
@@ -4877,7 +4873,7 @@ yy277:
 		TIMELIB_DEINIT;
 		return TIMELIB_SHORTDATE_WITH_TIME;
 	}
-#line 4881 "<stdout>"
+#line 4877 "<stdout>"
 yy279:
 	yych = *++YYCURSOR;
 	if (yych <= 0x1F) {
@@ -5039,7 +5035,7 @@ yy292:
 yy293:
 	++YYCURSOR;
 yy294:
-#line 1338 "ext/date/lib/parse_date.re"
+#line 1334 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("datenoday");
@@ -5052,7 +5048,7 @@ yy294:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_NO_DAY;
 	}
-#line 5056 "<stdout>"
+#line 5052 "<stdout>"
 yy295:
 	yych = *++YYCURSOR;
 	if (yych <= '/') {
@@ -6203,7 +6199,7 @@ yy361:
 	if ((yych = *YYCURSOR) <= '/') goto yy363;
 	if (yych <= '9') goto yy364;
 yy363:
-#line 1482 "ext/date/lib/parse_date.re"
+#line 1478 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("pgtextshort");
@@ -6216,7 +6212,7 @@ yy363:
 		TIMELIB_DEINIT;
 		return TIMELIB_PG_TEXT;
 	}
-#line 6220 "<stdout>"
+#line 6216 "<stdout>"
 yy364:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy363;
@@ -6825,7 +6821,7 @@ yy391:
 		if (yych <= 'z') goto yy142;
 	}
 yy392:
-#line 1540 "ext/date/lib/parse_date.re"
+#line 1536 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("ago");
 		TIMELIB_INIT;
@@ -6845,7 +6841,7 @@ yy392:
 		TIMELIB_DEINIT;
 		return TIMELIB_AGO;
 	}
-#line 6849 "<stdout>"
+#line 6845 "<stdout>"
 yy393:
 	yyaccept = 5;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -8533,7 +8529,7 @@ yy452:
 yy453:
 	++YYCURSOR;
 yy454:
-#line 1243 "ext/date/lib/parse_date.re"
+#line 1239 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("iso8601date4 | iso8601date2 | iso8601dateslash | dateslash");
 		TIMELIB_INIT;
@@ -8544,7 +8540,7 @@ yy454:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_DATE;
 	}
-#line 8548 "<stdout>"
+#line 8544 "<stdout>"
 yy455:
 	yyaccept = 0;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -9080,7 +9076,7 @@ yy474:
 		}
 	}
 yy475:
-#line 1380 "ext/date/lib/parse_date.re"
+#line 1376 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("datenoyearrev");
 		TIMELIB_INIT;
@@ -9091,7 +9087,7 @@ yy475:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_TEXT;
 	}
-#line 9095 "<stdout>"
+#line 9091 "<stdout>"
 yy476:
 	yyaccept = 10;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -9219,7 +9215,7 @@ yy485:
 	}
 yy487:
 	++YYCURSOR;
-#line 1098 "ext/date/lib/parse_date.re"
+#line 1094 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("timetiny12 | timeshort12 | timelong12");
 		TIMELIB_INIT;
@@ -9235,7 +9231,7 @@ yy487:
 		TIMELIB_DEINIT;
 		return TIMELIB_TIME12;
 	}
-#line 9239 "<stdout>"
+#line 9235 "<stdout>"
 yy489:
 	yyaccept = 11;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -9246,7 +9242,7 @@ yy489:
 		if (yych <= ':') goto yy492;
 	}
 yy490:
-#line 1135 "ext/date/lib/parse_date.re"
+#line 1131 "ext/date/lib/parse_date.re"
 	{
 		int tz_not_found;
 		DEBUG_OUTPUT("timeshort24 | timelong24 | iso8601long");
@@ -9271,7 +9267,7 @@ yy490:
 		TIMELIB_DEINIT;
 		return TIMELIB_TIME24_WITH_ZONE;
 	}
-#line 9275 "<stdout>"
+#line 9271 "<stdout>"
 yy491:
 	yyaccept = 11;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -9548,7 +9544,7 @@ yy520:
 	}
 yy522:
 	++YYCURSOR;
-#line 1115 "ext/date/lib/parse_date.re"
+#line 1111 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("mssqltime");
 		TIMELIB_INIT;
@@ -9567,7 +9563,7 @@ yy522:
 		TIMELIB_DEINIT;
 		return TIMELIB_TIME24_WITH_ZONE;
 	}
-#line 9571 "<stdout>"
+#line 9567 "<stdout>"
 yy524:
 	yyaccept = 11;
 	YYMARKER = ++YYCURSOR;
@@ -9662,7 +9658,7 @@ yy533:
 	if ((yych = *YYCURSOR) <= '/') goto yy534;
 	if (yych <= '9') goto yy540;
 yy534:
-#line 1297 "ext/date/lib/parse_date.re"
+#line 1293 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("datefull");
@@ -9676,7 +9672,7 @@ yy534:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_FULL;
 	}
-#line 9680 "<stdout>"
+#line 9676 "<stdout>"
 yy535:
 	yych = *++YYCURSOR;
 	if (yych == 'M') goto yy536;
@@ -10340,7 +10336,7 @@ yy604:
 	if (yych <= '/') goto yy56;
 	if (yych >= ':') goto yy56;
 	++YYCURSOR;
-#line 1312 "ext/date/lib/parse_date.re"
+#line 1308 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("pointed date YYYY");
 		TIMELIB_INIT;
@@ -10351,7 +10347,7 @@ yy604:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_FULL_POINTED;
 	}
-#line 10355 "<stdout>"
+#line 10351 "<stdout>"
 yy607:
 	yyaccept = 11;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -10382,7 +10378,7 @@ yy610:
 	if (yych <= '/') goto yy611;
 	if (yych <= '9') goto yy604;
 yy611:
-#line 1324 "ext/date/lib/parse_date.re"
+#line 1320 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("pointed date YY");
@@ -10395,7 +10391,7 @@ yy611:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_FULL_POINTED;
 	}
-#line 10399 "<stdout>"
+#line 10395 "<stdout>"
 yy612:
 	yyaccept = 11;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -10991,7 +10987,7 @@ yy655:
 		}
 	}
 yy656:
-#line 1283 "ext/date/lib/parse_date.re"
+#line 1279 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("gnudateshort");
@@ -11004,7 +11000,7 @@ yy656:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_DATE;
 	}
-#line 11008 "<stdout>"
+#line 11004 "<stdout>"
 yy657:
 	yyaccept = 13;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -11100,7 +11096,7 @@ yy665:
 		}
 	}
 yy666:
-#line 1227 "ext/date/lib/parse_date.re"
+#line 1223 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("americanshort | american");
@@ -11115,7 +11111,7 @@ yy666:
 		TIMELIB_DEINIT;
 		return TIMELIB_AMERICAN;
 	}
-#line 11119 "<stdout>"
+#line 11115 "<stdout>"
 yy667:
 	yyaccept = 14;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -11314,7 +11310,7 @@ yy699:
 	if (yych <= '9') goto yy702;
 	if (yych <= ':') goto yy703;
 yy700:
-#line 1510 "ext/date/lib/parse_date.re"
+#line 1506 "ext/date/lib/parse_date.re"
 	{
 		int tz_not_found;
 		DEBUG_OUTPUT("clf");
@@ -11334,7 +11330,7 @@ yy700:
 		TIMELIB_DEINIT;
 		return TIMELIB_CLF;
 	}
-#line 11338 "<stdout>"
+#line 11334 "<stdout>"
 yy701:
 	yych = *++YYCURSOR;
 	if (yych <= '5') {
@@ -11821,7 +11817,7 @@ yy762:
 		if (yych <= 't') goto yy662;
 	}
 yy763:
-#line 1255 "ext/date/lib/parse_date.re"
+#line 1251 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("iso8601date2");
@@ -11834,7 +11830,7 @@ yy763:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_DATE;
 	}
-#line 11838 "<stdout>"
+#line 11834 "<stdout>"
 yy764:
 	yych = *++YYCURSOR;
 	if (yych == 'C') goto yy765;
@@ -11865,7 +11861,7 @@ yy769:
 	if (yych >= '2') goto yy56;
 yy770:
 	++YYCURSOR;
-#line 1496 "ext/date/lib/parse_date.re"
+#line 1492 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("pgtextreverse");
@@ -11878,7 +11874,7 @@ yy770:
 		TIMELIB_DEINIT;
 		return TIMELIB_PG_TEXT;
 	}
-#line 11882 "<stdout>"
+#line 11878 "<stdout>"
 yy772:
 	yych = *++YYCURSOR;
 	if (yych == 'V') goto yy765;
@@ -12003,7 +11999,7 @@ yy782:
 	default:	goto yy783;
 	}
 yy783:
-#line 1531 "ext/date/lib/parse_date.re"
+#line 1527 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("year4");
 		TIMELIB_INIT;
@@ -12011,7 +12007,7 @@ yy783:
 		TIMELIB_DEINIT;
 		return TIMELIB_CLF;
 	}
-#line 12015 "<stdout>"
+#line 12011 "<stdout>"
 yy784:
 	yych = *++YYCURSOR;
 	switch (yych) {
@@ -12149,7 +12145,7 @@ yy792:
 		if (yych <= 'X') goto yy883;
 	}
 yy793:
-#line 1352 "ext/date/lib/parse_date.re"
+#line 1348 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("datenodayrev");
@@ -12162,7 +12158,7 @@ yy793:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_NO_DAY;
 	}
-#line 12166 "<stdout>"
+#line 12162 "<stdout>"
 yy794:
 	yych = *++YYCURSOR;
 	if (yych == 'I') goto yy927;
@@ -12356,7 +12352,7 @@ yy813:
 	if (yych <= '/') goto yy814;
 	if (yych <= '7') goto yy816;
 yy814:
-#line 1463 "ext/date/lib/parse_date.re"
+#line 1459 "ext/date/lib/parse_date.re"
 	{
 		timelib_sll w, d;
 		DEBUG_OUTPUT("isoweek");
@@ -12374,14 +12370,14 @@ yy814:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_WEEK;
 	}
-#line 12378 "<stdout>"
+#line 12374 "<stdout>"
 yy815:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy56;
 	if (yych >= '8') goto yy56;
 yy816:
 	++YYCURSOR;
-#line 1444 "ext/date/lib/parse_date.re"
+#line 1440 "ext/date/lib/parse_date.re"
 	{
 		timelib_sll w, d;
 		DEBUG_OUTPUT("isoweekday");
@@ -12399,7 +12395,7 @@ yy816:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_WEEK;
 	}
-#line 12403 "<stdout>"
+#line 12399 "<stdout>"
 yy818:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy60;
@@ -12459,7 +12455,7 @@ yy820:
 		}
 	}
 yy821:
-#line 1430 "ext/date/lib/parse_date.re"
+#line 1426 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("pgydotd");
@@ -12472,7 +12468,7 @@ yy821:
 		TIMELIB_DEINIT;
 		return TIMELIB_PG_YEARDAY;
 	}
-#line 12476 "<stdout>"
+#line 12472 "<stdout>"
 yy822:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy60;
@@ -12554,7 +12550,7 @@ yy840:
 yy841:
 	++YYCURSOR;
 yy842:
-#line 1404 "ext/date/lib/parse_date.re"
+#line 1400 "ext/date/lib/parse_date.re"
 	{
 		int tz_not_found;
 		DEBUG_OUTPUT("xmlrpc | xmlrpcnocolon | soap | wddx | exif");
@@ -12579,7 +12575,7 @@ yy842:
 		TIMELIB_DEINIT;
 		return TIMELIB_XMLRPC_SOAP;
 	}
-#line 12583 "<stdout>"
+#line 12579 "<stdout>"
 yy843:
 	yych = *++YYCURSOR;
 	if (yych <= '2') {
@@ -12835,7 +12831,7 @@ yy847:
 		}
 	}
 yy848:
-#line 1392 "ext/date/lib/parse_date.re"
+#line 1388 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("datenocolon");
 		TIMELIB_INIT;
@@ -12846,7 +12842,7 @@ yy848:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_NOCOLON;
 	}
-#line 12850 "<stdout>"
+#line 12846 "<stdout>"
 yy849:
 	yych = *++YYCURSOR;
 	if (yych <= 'H') {
@@ -13640,7 +13636,7 @@ yy972:
 	if (yych <= '/') goto yy973;
 	if (yych <= '9') goto yy995;
 yy973:
-#line 1269 "ext/date/lib/parse_date.re"
+#line 1265 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("gnudateshorter");
@@ -13653,7 +13649,7 @@ yy973:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_DATE;
 	}
-#line 13657 "<stdout>"
+#line 13653 "<stdout>"
 yy974:
 	yyaccept = 22;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -14565,7 +14561,7 @@ yy1065:
 	default:	goto yy1067;
 	}
 yy1067:
-#line 1161 "ext/date/lib/parse_date.re"
+#line 1157 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("gnunocolon");
 		TIMELIB_INIT;
@@ -14587,7 +14583,7 @@ yy1067:
 		TIMELIB_DEINIT;
 		return TIMELIB_GNU_NOCOLON;
 	}
-#line 14591 "<stdout>"
+#line 14587 "<stdout>"
 yy1068:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy60;
@@ -14671,7 +14667,7 @@ yy1074:
 		}
 	}
 yy1075:
-#line 1207 "ext/date/lib/parse_date.re"
+#line 1203 "ext/date/lib/parse_date.re"
 	{
 		int tz_not_found;
 		DEBUG_OUTPUT("iso8601nocolon");
@@ -14690,7 +14686,7 @@ yy1075:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_NOCOLON;
 	}
-#line 14694 "<stdout>"
+#line 14690 "<stdout>"
 yy1076:
 	yyaccept = 25;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -15546,7 +15542,7 @@ yy1116:
 		}
 	}
 yy1117:
-#line 1603 "ext/date/lib/parse_date.re"
+#line 1599 "ext/date/lib/parse_date.re"
 	{
 		timelib_sll i;
 		int         behavior = 0;
@@ -15562,7 +15558,7 @@ yy1117:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 15566 "<stdout>"
+#line 15562 "<stdout>"
 yy1118:
 	++YYCURSOR;
 	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
@@ -15604,7 +15600,7 @@ yy1124:
 	if (yych != 'f') goto yy56;
 yy1125:
 	++YYCURSOR;
-#line 1076 "ext/date/lib/parse_date.re"
+#line 1072 "ext/date/lib/parse_date.re"
 	{
 		timelib_sll i;
 		int         behavior = 0;
@@ -15625,7 +15621,7 @@ yy1125:
 		TIMELIB_DEINIT;
 		return TIMELIB_WEEK_DAY_OF_MONTH;
 	}
-#line 15629 "<stdout>"
+#line 15625 "<stdout>"
 yy1127:
 	yyaccept = 26;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -15718,7 +15714,7 @@ yy1140:
 		}
 	}
 yy1141:
-#line 1579 "ext/date/lib/parse_date.re"
+#line 1575 "ext/date/lib/parse_date.re"
 	{
 		timelib_sll i;
 		int         behavior = 0;
@@ -15741,7 +15737,7 @@ yy1141:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 15745 "<stdout>"
+#line 15741 "<stdout>"
 yy1142:
 	yych = *++YYCURSOR;
 	goto yy1117;
@@ -18265,7 +18261,7 @@ yy1293:
 	if (yych <= '9') goto yy1296;
 	goto yy1297;
 yy1294:
-#line 1053 "ext/date/lib/parse_date.re"
+#line 1049 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("backof | frontof");
 		TIMELIB_INIT;
@@ -18287,7 +18283,7 @@ yy1294:
 		TIMELIB_DEINIT;
 		return TIMELIB_LF_DAY_OF_MONTH;
 	}
-#line 18291 "<stdout>"
+#line 18287 "<stdout>"
 yy1295:
 	yyaccept = 28;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -18526,7 +18522,7 @@ yy1314:
 	if (yych != 'f') goto yy56;
 yy1315:
 	++YYCURSOR;
-#line 1036 "ext/date/lib/parse_date.re"
+#line 1032 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("firstdayof | lastdayof");
 		TIMELIB_INIT;
@@ -18542,7 +18538,7 @@ yy1315:
 		TIMELIB_DEINIT;
 		return TIMELIB_LF_DAY_OF_MONTH;
 	}
-#line 18546 "<stdout>"
+#line 18542 "<stdout>"
 yy1317:
 	yyaccept = 0;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -19902,7 +19898,7 @@ yy1385:
 	if (yych <= '/') goto yy1387;
 	if (yych <= '9') goto yy1385;
 yy1387:
-#line 1010 "ext/date/lib/parse_date.re"
+#line 1006 "ext/date/lib/parse_date.re"
 	{
 		timelib_ull i;

@@ -19927,7 +19923,7 @@ yy1387:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 19931 "<stdout>"
+#line 19927 "<stdout>"
 yy1388:
 	yych = *++YYCURSOR;
 	if (yych <= 'N') {
@@ -20333,7 +20329,7 @@ yy1415:
 yy1416:
 	++YYCURSOR;
 yy1417:
-#line 998 "ext/date/lib/parse_date.re"
+#line 994 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("tomorrow");
 		TIMELIB_INIT;
@@ -20344,7 +20340,7 @@ yy1417:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 20348 "<stdout>"
+#line 20344 "<stdout>"
 yy1418:
 	yych = *++YYCURSOR;
 	if (yych <= 'Y') {
@@ -20376,7 +20372,7 @@ yy1419:
 		if (yych <= 'z') goto yy144;
 	}
 yy1420:
-#line 988 "ext/date/lib/parse_date.re"
+#line 984 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("midnight | today");
 		TIMELIB_INIT;
@@ -20385,7 +20381,7 @@ yy1420:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 20389 "<stdout>"
+#line 20385 "<stdout>"
 yy1421:
 	yych = *++YYCURSOR;
 	if (yych <= 'S') {
@@ -22317,7 +22313,7 @@ yy1499:
 		if (yych <= 'z') goto yy142;
 	}
 yy1500:
-#line 967 "ext/date/lib/parse_date.re"
+#line 963 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("now");
 		TIMELIB_INIT;
@@ -22325,7 +22321,7 @@ yy1500:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 22329 "<stdout>"
+#line 22325 "<stdout>"
 yy1501:
 	yych = *++YYCURSOR;
 	if (yych <= 'N') {
@@ -22456,7 +22452,7 @@ yy1507:
 		if (yych <= 'z') goto yy143;
 	}
 yy1508:
-#line 976 "ext/date/lib/parse_date.re"
+#line 972 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("noon");
 		TIMELIB_INIT;
@@ -22467,7 +22463,7 @@ yy1508:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 22471 "<stdout>"
+#line 22467 "<stdout>"
 yy1509:
 	yyaccept = 0;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -22977,7 +22973,7 @@ yy1529:
 yy1530:
 	++YYCURSOR;
 yy1531:
-#line 955 "ext/date/lib/parse_date.re"
+#line 951 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("yesterday");
 		TIMELIB_INIT;
@@ -22988,7 +22984,7 @@ yy1531:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 22992 "<stdout>"
+#line 22988 "<stdout>"
 yy1532:
 	yyaccept = 0;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -23153,7 +23149,7 @@ yy1537:
 		goto yy1531;
 	}
 }
-#line 1729 "ext/date/lib/parse_date.re"
+#line 1725 "ext/date/lib/parse_date.re"

 }

@@ -394,12 +394,8 @@ static timelib_sll timelib_meridian(char **ptr, timelib_sll h)
 	}
 	++*ptr;
 	if (**ptr == '.') {
-		++*ptr;
-	}
-	if (**ptr == 'M' || **ptr == 'm') {
-		++*ptr;
-	}
-	if (**ptr == '.') {
+		*ptr += 3;
+	} else {
 		++*ptr;
 	}
 	return retval;
@@ -75,8 +75,8 @@ result = Monday 1983-04-18 01:00:00 CEST
 wanted = Monday            00:00:00

 Asia/Yerevan
-ts     = Monday 2037-10-19 17:17:17 +04
-result = Monday 2037-10-26 00:00:00 +04
+ts     = Monday 2037-10-19 17:17:17 AMT
+result = Monday 2037-10-26 00:00:00 AMT
 wanted = Monday            00:00:00

 America/Curacao
@@ -115,8 +115,8 @@ result = Monday 1971-04-05 00:00:00 AST
 wanted = Monday            00:00:00

 Asia/Baku
-ts     = Friday 1971-01-01 17:17:17 +04
-result = Monday 1971-01-04 00:00:00 +04
+ts     = Friday 1971-01-01 17:17:17 BAKT
+result = Monday 1971-01-04 00:00:00 BAKT
 wanted = Monday            00:00:00

 Europe/Sarajevo
@@ -165,6 +165,6 @@ result = Monday 1980-04-07 00:00:00 CEST
 wanted = Monday            00:00:00

 Asia/Baku
-ts     = Monday 1995-12-25 17:17:17 +04
-result = Monday 1996-01-01 00:00:00 +04
+ts     = Monday 1995-12-25 17:17:17 AZT
+result = Monday 1996-01-01 00:00:00 AZT
 wanted = Monday            00:00:00
@@ -226,8 +226,8 @@ result=Thursday 1980-04-10 00:00:00 CEST 1
 wanted=Thursday             00:00:00

 TZ=Asia/Baku - wrong day.
-tStamp=Sunday 1992-09-20 17:17:17 +04 1
-result=Monday 1992-09-28 00:00:00 +04 0
+tStamp=Sunday 1992-09-20 17:17:17 AZST 1
+result=Monday 1992-09-28 00:00:00 AZT 0
 wanted=Monday              00:00:00

 TZ=America/Noronha - wrong day.
@@ -28,6 +28,6 @@ result=Monday 1990-10-22 00:00:00 WART 0
 wanted=Monday            00:00:00

 TZ=Asia/Tbilisi - Is it OK for this to be 2 AM?
-tStamp=Sunday 2005-03-20 17:17:17 +03 0
-result=Sunday 2005-03-27 00:00:00 +03 0
+tStamp=Sunday 2005-03-20 17:17:17 GET 0
+result=Sunday 2005-03-27 00:00:00 GET 0
 wanted=Sunday            00:00:00
@@ -250,7 +250,6 @@ val_type inifile_fetch(inifile *dba, const key_type *key, int skip TSRMLS_DC) {
 	if (skip == -1 && dba->next.key.group && dba->next.key.name && !inifile_key_cmp(&dba->next.key, key TSRMLS_CC)) {
 		/* we got position already from last fetch */
 		php_stream_seek(dba->fp, dba->next.pos, SEEK_SET);
-		ln.key.group = estrdup(dba->next.key.group);
 	} else {
 		/* specific instance or not same key -> restart search */
 		/* the slow way: restart and seacrch */
@@ -403,7 +402,7 @@ static int inifile_copy_to(inifile *dba, size_t pos_start, size_t pos_end, inifi
 		return FAILURE;
 	}
 	php_stream_seek(dba->fp, pos_start, SEEK_SET);
-	if (SUCCESS != php_stream_copy_to_stream_ex(dba->fp, fp, pos_end - pos_start, NULL)) {
+	if (!php_stream_copy_to_stream_ex(dba->fp, fp, pos_end - pos_start, NULL)) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not copy group [%zu - %zu] to temporary stream", pos_start, pos_end);
 		return FAILURE;
 	} 
@@ -428,7 +427,7 @@ static int inifile_filter(inifile *dba, inifile *from, const key_type *key TSRML
 			pos_curr = php_stream_tell(from->fp);
 			if (pos_start != pos_next) {
 				php_stream_seek(from->fp, pos_start, SEEK_SET);
-				if (SUCCESS != php_stream_copy_to_stream_ex(from->fp, dba->fp, pos_next - pos_start, NULL)) {
+				if (!php_stream_copy_to_stream_ex(from->fp, dba->fp, pos_next - pos_start, NULL)) {
 					php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not copy [%zu - %zu] from temporary stream", pos_next, pos_start);
 					ret = FAILURE;
 				}
@@ -447,7 +446,7 @@ static int inifile_filter(inifile *dba, inifile *from, const key_type *key TSRML
 	}
 	if (pos_start != pos_next) {
 		php_stream_seek(from->fp, pos_start, SEEK_SET);
-		if (SUCCESS != php_stream_copy_to_stream_ex(from->fp, dba->fp, pos_next - pos_start, NULL)) {
+		if (!php_stream_copy_to_stream_ex(from->fp, dba->fp, pos_next - pos_start, NULL)) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not copy [%zu - %zu] from temporary stream", pos_next, pos_start);
 			ret = FAILURE;
 		}
@@ -498,7 +497,7 @@ static int inifile_delete_replace_append(inifile *dba, const key_type *key, cons
 			php_stream_seek(dba->fp, 0, SEEK_END);
 			if (pos_grp_next != (size_t)php_stream_tell(dba->fp)) {
 				php_stream_seek(dba->fp, pos_grp_next, SEEK_SET);
-				if (SUCCESS != php_stream_copy_to_stream_ex(dba->fp, fp_tmp, PHP_STREAM_COPY_ALL, NULL)) {
+				if (!php_stream_copy_to_stream_ex(dba->fp, fp_tmp, PHP_STREAM_COPY_ALL, NULL)) {
 					php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not copy remainder to temporary stream");
 					ret = FAILURE;
 				}
@@ -539,7 +538,7 @@ static int inifile_delete_replace_append(inifile *dba, const key_type *key, cons
 		if (fp_tmp && php_stream_tell(fp_tmp)) {
 			php_stream_seek(fp_tmp, 0, SEEK_SET);
 			php_stream_seek(dba->fp, 0, SEEK_END);
-			if (SUCCESS != php_stream_copy_to_stream_ex(fp_tmp, dba->fp, PHP_STREAM_COPY_ALL, NULL)) {
+			if (!php_stream_copy_to_stream_ex(fp_tmp, dba->fp, PHP_STREAM_COPY_ALL, NULL)) {
 				php_error_docref(NULL TSRMLS_CC, E_RECOVERABLE_ERROR, "Could not copy from temporary stream - ini file truncated");
 				ret = FAILURE;
 			}
@@ -1,71 +0,0 @@
--TEST--
-Bug #70825 (Cannot fetch multiple values with group in ini file)
--SKIPIF--
-<?php
-if (!extension_loaded('dba')) die('skip dba extension not available');
-if (!in_array('inifile', dba_handlers())) die('skip inifile handler not available');
-?>
--FILE--
-<?php
-$filename = __DIR__ . DIRECTORY_SEPARATOR . 'bug70825.ini';
-
-$db = dba_open($filename, 'n', 'inifile');
-dba_insert('foo', 23, $db);
-dba_insert('foo', 42, $db);
-dba_insert('foo', 1337, $db);
-var_dump(dba_fetch('foo', -1, $db));
-var_dump(dba_fetch('foo', -1, $db));
-var_dump(dba_fetch('foo', -1, $db));
-dba_close($db);
-unlink($filename);
-
-$db = dba_open($filename, 'n', 'inifile');
-dba_insert(['foo', 'bar'], 23, $db);
-dba_insert(['foo', 'bar'], 42, $db);
-dba_insert(['foo', 'bar'], 1337, $db);
-var_dump(dba_fetch(['foo', 'bar'], -1, $db));
-var_dump(dba_fetch(['foo', 'bar'], -1, $db));
-var_dump(dba_fetch(['foo', 'bar'], -1, $db));
-dba_close($db);
-unlink($filename);
-
-$db = dba_open($filename, 'n', 'inifile');
-dba_insert('[foo]bar', 23, $db);
-dba_insert('[foo]bar', 42, $db);
-dba_insert('[foo]bar', 1337, $db);
-var_dump(dba_fetch('[foo]bar', -1, $db));
-var_dump(dba_fetch('[foo]bar', -1, $db));
-var_dump(dba_fetch('[foo]bar', -1, $db));
-dba_close($db);
-unlink($filename);
-
-$db = dba_open($filename, 'n', 'inifile');
-dba_insert('[foo]bar', 23, $db);
-dba_insert('[foo]bar', 42, $db);
-dba_insert('[foo]bar', 1337, $db);
-var_dump(dba_fetch('[foo]bar', 0, $db));
-var_dump(dba_fetch('[foo]bar', 1, $db));
-var_dump(dba_fetch('[foo]bar', 2, $db));
-dba_close($db);
-unlink($filename);
-?>
-==DONE==
--EXPECT--
-string(2) "23"
-string(2) "42"
-string(4) "1337"
-string(2) "23"
-string(2) "42"
-string(4) "1337"
-string(2) "23"
-string(2) "42"
-string(4) "1337"
-string(2) "23"
-string(2) "42"
-string(4) "1337"
-==DONE==
--CLEAN--
-<?php
-$filename = __DIR__ . DIRECTORY_SEPARATOR . 'bug70825.ini';
-unlink($filename);
-?>
@@ -1,28 +0,0 @@
--TEST--
-Bug #71514 (Bad dba_replace condition because of wrong API usage)
--SKIPIF--
-<?php
-if (!extension_loaded('dba')) die('skip dba extension not available');
-if (!in_array('inifile', dba_handlers())) die('skip inifile handler not available');
-?>
--FILE--
-<?php
-$filename = __DIR__ . DIRECTORY_SEPARATOR . 'bug71514.ini';
-
-$db = dba_open($filename, 'c', 'inifile');
-
-dba_insert('foo', 'value1', $db);
-dba_replace('foo', 'value2', $db);
-var_dump(dba_fetch('foo', $db));
-
-dba_close($db);
-?>
-==DONE==
--EXPECT--
-string(6) "value2"
-==DONE==
--CLEAN--
-<?php
-$filename = __DIR__ . DIRECTORY_SEPARATOR . 'bug71514.ini';
-unlink($filename);
-?>
@@ -40,7 +40,7 @@ do {
 	}
 	if ($handler != 'cdb') {
 		$db_writer = dba_open($db_filename, 'c'.$lock_flag, $handler);
-		if (($dba_reader = @dba_open($db_filename, 'r'.$lock_flag.'t', $handler))===false) {
+		if (($dba_reader = @dba_open($db_filename, 'r'.$lock_flag.($lock_flag ? 't' : ''), $handler))===false) {
 			echo "Read during write: not allowed\n";
 		} else {
 			echo "Read during write: allowed\n";
@@ -1792,7 +1792,7 @@ PHP_FUNCTION(dom_document_savexml)
 		if (options & LIBXML_SAVE_NOEMPTYTAG) {
 			xmlSaveNoEmptyTags = saveempty;
 		}
-		if (!size || !mem) {
+		if (!size) {
 			RETURN_FALSE;
 		}
 		RETVAL_STRINGL(mem, size, 1);
@@ -2327,7 +2327,7 @@ PHP_FUNCTION(dom_document_save_html)
 #else
 		htmlDocDumpMemory(docp, &mem, &size);
 #endif
-		if (!size || !mem) {
+		if (!size) {
 			RETVAL_FALSE;
 		} else {
 			RETVAL_STRINGL((const char*) mem, size, 1);
@@ -14,7 +14,7 @@
   +----------------------------------------------------------------------+
   | Authors: Rasmus Lerdorf <rasmus@php.net>                             |
   |          Jim Winstead <jimw@php.net>                                 |
-   |          Jaakko Hyvätti <jaakko@hyvatti.iki.fi>                      |
+   |          Jaakko Hyvätti <jaakko@hyvatti.iki.fi>                      | 
   +----------------------------------------------------------------------+
 */
 /* $Id$ */
@@ -29,7 +29,7 @@
 /* {{{ arginfo */
 ZEND_BEGIN_ARG_INFO_EX(arginfo_ereg, 0, 0, 2)
 	ZEND_ARG_INFO(0, pattern)
-	ZEND_ARG_INFO(0, string)
+	ZEND_ARG_INFO(0, string) 
 	ZEND_ARG_INFO(1, registers) /* ARRAY_INFO(1, registers, 1) */
 ZEND_END_ARG_INFO()

@@ -41,8 +41,8 @@ ZEND_END_ARG_INFO()

 ZEND_BEGIN_ARG_INFO_EX(arginfo_split, 0, 0, 2)
 	ZEND_ARG_INFO(0, pattern)
-	ZEND_ARG_INFO(0, string)
-	ZEND_ARG_INFO(0, limit)
+	ZEND_ARG_INFO(0, string) 
+	ZEND_ARG_INFO(0, limit)  
 ZEND_END_ARG_INFO()

 ZEND_BEGIN_ARG_INFO(arginfo_sql_regcase, 0)
@@ -204,7 +204,7 @@ static int _php_regcomp(regex_t *preg, const char *pattern, int cflags TSRMLS_DC
 }
 /* }}} */

-static void _free_ereg_cache(reg_cache *rc)
+static void _free_ereg_cache(reg_cache *rc) 
 {
 	regfree(&rc->preg);
 }
@@ -309,7 +309,7 @@ static void php_ereg(INTERNAL_FUNCTION_PARAMETERS, int icase)
 	if (icase) {
 		copts |= REG_ICASE;
 	}
-
+	
 	if (argc == 2) {
 		copts |= REG_NOSUB;
 	}
@@ -337,7 +337,7 @@ static void php_ereg(INTERNAL_FUNCTION_PARAMETERS, int icase)

 	/* allocate storage for (sub-)expression-matches */
 	subs = (regmatch_t *)ecalloc(sizeof(regmatch_t),re.re_nsub+1);
-
+	
 	/* actually execute the regular expression */
 	err = regexec(&re, string, re.re_nsub+1, subs, 0);
 	if (err && err != REG_NOMATCH) {
@@ -409,8 +409,8 @@ PHP_EREG_API char *php_ereg_replace(const char *pattern, const char *replace, co
 		 *nbuf,	/* nbuf is used when we grow the buffer */
 		 *walkbuf; /* used to walk buf when replacing backrefs */
 	const char *walk; /* used to walk replacement string for backrefs */
-	size_t buf_len, new_l;
-	int pos, tmp, string_len;
+	int buf_len;
+	int pos, tmp, string_len, new_l;
 	int err, copts = 0;

 	string_len = strlen(string);
@@ -434,8 +434,8 @@ PHP_EREG_API char *php_ereg_replace(const char *pattern, const char *replace, co

 	/* start with a buffer that is twice the size of the stringo
 	   we're doing replacements in */
-	buf = safe_emalloc(string_len, 2, 1);
 	buf_len = 2 * string_len + 1;
+	buf = safe_emalloc(buf_len, sizeof(char), 0);

 	err = pos = 0;
 	buf[0] = '\0';
@@ -472,8 +472,8 @@ PHP_EREG_API char *php_ereg_replace(const char *pattern, const char *replace, co
 				}
 			}
 			if (new_l + 1 > buf_len) {
-				nbuf = safe_emalloc(new_l + 1, 2, buf_len);
 				buf_len = 1 + buf_len + 2 * new_l;
+				nbuf = emalloc(buf_len);
 				strncpy(nbuf, buf, buf_len - 1);
 				nbuf[buf_len - 1] = '\0';
 				efree(buf);
@@ -491,7 +491,7 @@ PHP_EREG_API char *php_ereg_replace(const char *pattern, const char *replace, co
 					if (subs[walk[1] - '0'].rm_so > -1 && subs[walk[1] - '0'].rm_eo > -1
 						/* this next case shouldn't happen. it does. */
 						&& subs[walk[1] - '0'].rm_so <= subs[walk[1] - '0'].rm_eo) {
-
+						
 						tmp = subs[walk[1] - '0'].rm_eo - subs[walk[1] - '0'].rm_so;
 						memcpy (walkbuf, &string[pos + subs[walk[1] - '0'].rm_so], tmp);
 						walkbuf += tmp;
@@ -510,8 +510,8 @@ PHP_EREG_API char *php_ereg_replace(const char *pattern, const char *replace, co
 				}
 				new_l = strlen (buf) + 1;
 				if (new_l + 1 > buf_len) {
-					nbuf = safe_emalloc(new_l + 1, 2, buf_len);
 					buf_len = 1 + buf_len + 2 * new_l;
+					nbuf = safe_emalloc(buf_len, sizeof(char), 0);
 					strncpy(nbuf, buf, buf_len-1);
 					efree(buf);
 					buf = nbuf;
@@ -526,7 +526,7 @@ PHP_EREG_API char *php_ereg_replace(const char *pattern, const char *replace, co
 			new_l = strlen(buf) + strlen(&string[pos]);
 			if (new_l + 1 > buf_len) {
 				buf_len = new_l + 1; /* now we know exactly how long it is */
-				nbuf = safe_emalloc(new_l, 1, 1);
+				nbuf = safe_emalloc(buf_len, sizeof(char), 0);
 				strncpy(nbuf, buf, buf_len-1);
 				efree(buf);
 				buf = nbuf;
@@ -556,7 +556,7 @@ static void php_do_ereg_replace(INTERNAL_FUNCTION_PARAMETERS, int icase)
 	char *replace;
 	char *ret;
 	int arg_string_len;
-
+	
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ZZs", &arg_pattern, &arg_replace, &arg_string, &arg_string_len) == FAILURE) {
 		return;
 	}
@@ -598,7 +598,7 @@ static void php_do_ereg_replace(INTERNAL_FUNCTION_PARAMETERS, int icase)
 	if (ret == (char *) -1) {
 		RETVAL_FALSE;
 	} else {
-		RETVAL_STRINGL_CHECK(ret, strlen(ret), 1);
+		RETVAL_STRING(ret, 1);
 		STR_FREE(ret);
 	}

@@ -664,9 +664,9 @@ static void php_split(INTERNAL_FUNCTION_PARAMETERS, int icase)
 		} else if (subs[0].rm_so == 0 && subs[0].rm_eo == 0) {
 			/* No more matches */
 			regfree(&re);
-
+			
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid Regular Expression");
-
+			
 			zend_hash_destroy(Z_ARRVAL_P(return_value));
 			efree(Z_ARRVAL_P(return_value));
 			RETURN_FALSE;
@@ -675,7 +675,7 @@ static void php_split(INTERNAL_FUNCTION_PARAMETERS, int icase)

 			/* make a copy of the substring */
 			size = subs[0].rm_so;
-
+		
 			/* add it to the array */
 			add_next_index_stringl(return_value, strp, size, 1);

@@ -701,7 +701,7 @@ static void php_split(INTERNAL_FUNCTION_PARAMETERS, int icase)

 	/* otherwise we just have one last element to add to the array */
 	size = endp - strp;
-
+	
 	add_next_index_stringl(return_value, strp, size, 1);

 	regfree(&re);
@@ -738,9 +738,9 @@ PHP_EREG_API PHP_FUNCTION(sql_regcase)
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &string, &string_len) == FAILURE) {
 		return;
 	}
-
+	
 	tmp = safe_emalloc(string_len, 4, 1);
-
+	
 	for (i = j = 0; i < string_len; i++) {
 		c = (unsigned char) string[i];
 		if ( j >= INT_MAX - 1 || (isalpha(c) && j >= INT_MAX - 4)) {
@@ -3734,11 +3734,8 @@ static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offse
 									fgot = php_stream_read(ImageInfo->infile, ImageInfo->Thumbnail.data, ImageInfo->Thumbnail.size);
 									if (fgot < ImageInfo->Thumbnail.size) {
 										EXIF_ERRLOG_THUMBEOF(ImageInfo)
-										efree(ImageInfo->Thumbnail.data);
-										ImageInfo->Thumbnail.data = NULL;
-									} else {
-										exif_thumbnail_build(ImageInfo TSRMLS_CC);
 									}
+									exif_thumbnail_build(ImageInfo TSRMLS_CC);
 								}
 							}
 						}
@@ -1,22 +0,0 @@
--TEST--
-Bug #69107 (finfo no longer detects PHP files)
--SKIPIF--
-<?php
-if (!extension_loaded('fileinfo')) die('skip fileinfo extension not available');
-?>
--FILE--
-<?php
-$finfo = new finfo(FILEINFO_MIME_TYPE);
-
-var_dump($finfo->buffer("<?php\nclass A{}"));
-var_dump($finfo->buffer("<?php class A{}"));
-var_dump($finfo->buffer("<?php\tclass A{}"));
-var_dump($finfo->buffer("<?php\n\rclass A{}"));
-?>
-===DONE===
--EXPECT--
-string(10) "text/x-php"
-string(10) "text/x-php"
-string(10) "text/x-php"
-string(10) "text/x-php"
-===DONE===
@@ -380,14 +380,8 @@ static void php_zval_filter(zval **value, long filter, long flags, zval *options

 		ce = Z_OBJCE_PP(value);
 		if (!ce->__tostring) {
-			zval_dtor(*value);
-			/* #67167: doesn't return null on failure for objects */
-			if (flags & FILTER_NULL_ON_FAILURE) {
-				ZVAL_NULL(*value);
-			} else {
-				ZVAL_FALSE(*value);
-			}
-			goto handle_default;
+			ZVAL_FALSE(*value);
+			return;
 		}
 	}

@@ -396,7 +390,6 @@ static void php_zval_filter(zval **value, long filter, long flags, zval *options

 	filter_func.function(*value, flags, options, charset TSRMLS_CC);

-handle_default:
 	if (
 		options && (Z_TYPE_P(options) == IS_ARRAY || Z_TYPE_P(options) == IS_OBJECT) &&
 		((flags & FILTER_NULL_ON_FAILURE && Z_TYPE_PP(value) == IS_NULL) || 
@@ -704,7 +704,8 @@ void php_filter_validate_ip(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
 			if (flags & FILTER_FLAG_NO_PRIV_RANGE) {
 				if (
 					(ip[0] == 10) ||
-					(ip[0] == 172 && ip[1] >= 16 && ip[1] <= 31) ||
+					(ip[0] == 169 && ip[1] == 254) ||
+					(ip[0] == 172 && (ip[1] >= 16 && ip[1] <= 31)) ||
 					(ip[0] == 192 && ip[1] == 168)
 				) {
 					RETURN_VALIDATION_FAILED
@@ -714,9 +715,19 @@ void php_filter_validate_ip(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
 			if (flags & FILTER_FLAG_NO_RES_RANGE) {
 				if (
 					(ip[0] == 0) ||
-					(ip[0] >= 240) ||
+					(ip[0] == 10) ||
+					(ip[0] == 100 && (ip[1] >= 64 && ip[1] <= 127)) ||
 					(ip[0] == 127) ||
-					(ip[0] == 169 && ip[1] == 254)
+					(ip[0] == 169 && ip[1] == 254) ||
+					(ip[0] == 172 && (ip[1] >= 16 && ip[1] <= 31)) ||
+					(ip[0] == 192 && ip[1] == 0 && ip[2] == 0) ||
+					(ip[0] == 192 && ip[1] == 0 && ip[2] == 2) ||
+					(ip[0] == 192 && ip[1] == 88 && ip[2] == 99) ||
+					(ip[0] == 192 && ip[1] == 168) ||
+					(ip[0] == 198 && (ip[1] == 18 || ip[1] == 19)) ||
+					(ip[0] == 198 && ip[1] == 51 && ip[2] == 100) ||
+					(ip[0] == 203 && ip[1] == 0 && ip[2] == 113) ||
+					(ip[0] >= 224 && ip[0] <= 255)
 				) {
 					RETURN_VALIDATION_FAILED
 				}
@@ -41,9 +41,9 @@ string(9) "127.0.0.1"
 bool(false)
 string(12) "192.0.34.166"
 bool(false)
-string(9) "192.0.0.1"
-string(10) "100.64.0.0"
-string(15) "100.127.255.255"
+bool(false)
+bool(false)
+bool(false)
 string(12) "192.0.34.166"
 bool(false)
 string(15) "255.255.255.255"
@@ -1,16 +0,0 @@
--TEST--
-Bug #67167: object with VALIDATE_BOOLEAN and NULL_ON_FAILURE
-
--SKIPIF--
-<?php if (!extension_loaded("filter")) die("skip"); ?>
-
--FILE--
-<?php
-var_dump(filter_var(
-    new \StdClass(),
-    FILTER_VALIDATE_BOOLEAN,
-    FILTER_NULL_ON_FAILURE
-));
-
--EXPECTF--
-NULL
@@ -1,20 +0,0 @@
--TEST--
-Bug #67167: filter_var(null,FILTER_VALIDATE_BOOLEAN,FILTER_NULL_ON_FAILURE) returns null
-
--SKIPIF--
-<?php if (!extension_loaded("filter")) die("skip"); ?>
-
--FILE--
-<?php
-var_dump(filter_var(
-    null,
-    FILTER_VALIDATE_BOOLEAN,
-    FILTER_NULL_ON_FAILURE
-));
-
--XFAIL--
-Requires php_zval_filter to not use convert_to_string for all filters.
-
--EXPECTF--
-NULL
-
@@ -1,23 +0,0 @@
--TEST--
-Bug #73054 (default option ignored when object passed to int filter)
--SKIPIF--
-<?php
-if (!extension_loaded('filter')) die('skip filter extension not available');
-?>
--FILE--
-<?php
-var_dump(
-    filter_var(new stdClass, FILTER_VALIDATE_INT, [
-        'options' => ['default' => 2],
-    ]),
-    filter_var(new stdClass, FILTER_VALIDATE_INT, [
-        'options' => ['default' => 2],
-        'flags' => FILTER_NULL_ON_FAILURE
-    ])
-);
-?>
-===DONE===
--EXPECT--
-int(2)
-int(2)
-===DONE===
@@ -85,8 +85,8 @@ string(10) "10.0.0.0/8"
 bool(false)
 bool(false)
 string(14) "168.254.0.0/16"
-string(11) "169.254.0.0"
-string(15) "169.254.255.255"
+bool(false)
+bool(false)
 string(13) "172.16.0.0/12"
 bool(false)
 bool(false)
@@ -94,11 +94,11 @@ string(14) "192.168.0.0/16"
 bool(false)
 bool(false)
 string(10) "10.0.0.0/8"
-string(8) "10.0.0.0"
-string(14) "10.255.255.255"
+bool(false)
+bool(false)
 string(12) "10.64.0.0/10"
-string(10) "100.64.0.0"
-string(15) "100.127.255.255"
+bool(false)
+bool(false)
 string(11) "127.0.0.0/8"
 bool(false)
 bool(false)
@@ -106,32 +106,32 @@ string(14) "169.254.0.0/16"
 bool(false)
 bool(false)
 string(13) "172.16.0.0/12"
-string(10) "172.16.0.0"
-string(10) "172.31.0.0"
+bool(false)
+bool(false)
 string(12) "192.0.0.0/24"
-string(9) "192.0.0.0"
-string(11) "192.0.0.255"
+bool(false)
+bool(false)
 string(12) "192.0.0.0/29"
-string(9) "192.0.0.0"
-string(9) "192.0.0.7"
+bool(false)
+bool(false)
 string(12) "192.0.2.0/24"
-string(9) "192.0.2.0"
-string(11) "192.0.2.255"
+bool(false)
+bool(false)
 string(13) "198.18.0.0/15"
-string(10) "198.18.0.0"
-string(14) "198.19.255.255"
+bool(false)
+bool(false)
 string(15) "198.51.100.0/24"
-string(12) "198.51.100.0"
-string(14) "198.51.100.255"
+bool(false)
+bool(false)
 string(14) "192.88.99.0/24"
-string(11) "192.88.99.0"
-string(13) "192.88.99.255"
+bool(false)
+bool(false)
 string(14) "192.168.0.0/16"
-string(11) "192.168.0.0"
-string(15) "192.168.255.255"
+bool(false)
+bool(false)
 string(14) "203.0.113.0/24"
-string(11) "203.0.113.0"
-string(13) "203.0.113.255"
+bool(false)
+bool(false)
 string(11) "240.0.0.0/4"
-string(9) "224.0.0.0"
+bool(false)
 bool(false)
@@ -290,9 +290,6 @@ ftp_login(ftpbuf_t *ftp, const char *user, const char *pass TSRMLS_DC)
 #endif
 		SSL_CTX_set_options(ctx, ssl_ctx_options);

-		/* allow SSL to re-use sessions */
-		SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_BOTH);
-
 		ftp->ssl_handle = SSL_new(ctx);
 		if (ftp->ssl_handle == NULL) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "failed to create the SSL handle");
@@ -1498,8 +1495,7 @@ data_accept(databuf_t *data, ftpbuf_t *ftp TSRMLS_DC)

 #if HAVE_OPENSSL_EXT
 	SSL_CTX		*ctx;
-	SSL_SESSION *session;
-	int result;
+	long ssl_ctx_options = SSL_OP_ALL;
 #endif

 	if (data->fd != -1) {
@@ -1520,40 +1516,31 @@ data_accepted:

 	/* now enable ssl if we need to */
 	if (ftp->use_ssl && ftp->use_ssl_for_data) {
-		ctx = SSL_get_SSL_CTX(ftp->ssl_handle);
+		ctx = SSL_CTX_new(SSLv23_client_method());
 		if (ctx == NULL) {
-			php_error_docref(NULL TSRMLS_CC, E_WARNING, "data_accept: failed to retreive the existing SSL context");
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "data_accept: failed to create the SSL context");
 			return 0;
 		}

+#if OPENSSL_VERSION_NUMBER >= 0x0090605fL
+		ssl_ctx_options &= ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
+#endif
+		SSL_CTX_set_options(ctx, ssl_ctx_options);
+
 		data->ssl_handle = SSL_new(ctx);
 		if (data->ssl_handle == NULL) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "data_accept: failed to create the SSL handle");
+			SSL_CTX_free(ctx);
 			return 0;
 		}

+
 		SSL_set_fd(data->ssl_handle, data->fd);

 		if (ftp->old_ssl) {
 			SSL_copy_session_id(data->ssl_handle, ftp->ssl_handle);
 		}

-		/* get the session from the control connection so we can re-use it */
-		session = SSL_get_session(ftp->ssl_handle);
-		if (session == NULL) {
-			php_error_docref(NULL TSRMLS_CC, E_WARNING, "data_accept: failed to retreive the existing SSL session");
-			SSL_free(data->ssl_handle);
-			return 0;
-		}
-
-		/* and set it on the data connection */
-		result = SSL_set_session(data->ssl_handle, session);
-		if (result == 0) {
-			php_error_docref(NULL TSRMLS_CC, E_WARNING, "data_accept: failed to set the existing SSL session");
-			SSL_free(data->ssl_handle);
-			return 0;
-		}
-
 		if (SSL_connect(data->ssl_handle) <= 0) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "data_accept: SSL/TLS handshake failed");
 			SSL_shutdown(data->ssl_handle);
@@ -1584,7 +1571,10 @@ data_close(ftpbuf_t *ftp, databuf_t *data)
 	if (data->listener != -1) {
 #if HAVE_OPENSSL_EXT
 		if (data->ssl_active) {
-			/* don't free the data context, it's the same as the control */
+
+			ctx = SSL_get_SSL_CTX(data->ssl_handle);
+			SSL_CTX_free(ctx);
+
 			SSL_shutdown(data->ssl_handle);
 			SSL_free(data->ssl_handle);
 			data->ssl_active = 0;
@@ -1595,7 +1585,9 @@ data_close(ftpbuf_t *ftp, databuf_t *data)
 	if (data->fd != -1) {
 #if HAVE_OPENSSL_EXT
 		if (data->ssl_active) {
-			/* don't free the data context, it's the same as the control */
+			ctx = SSL_get_SSL_CTX(data->ssl_handle);
+			SSL_CTX_free(ctx);
+
 			SSL_shutdown(data->ssl_handle);
 			SSL_free(data->ssl_handle);
 			data->ssl_active = 0;
@@ -139,10 +139,7 @@ if ($pid) {
 			$buf = fread($s, 2048);
 		}

-		if ($buf == "AUTH TLS\r\n") {
-		   fputs($s, "500 not supported.\r\n");
-		   return ;
-		} else if (!preg_match('/^USER (\w+)\r\n$/', $buf, $m)) {
+		if (!preg_match('/^USER (\w+)\r\n$/', $buf, $m)) {
 			fputs($s, "500 Syntax error, command unrecognized.\r\n");
 			dump_and_exit($buf);
 		}
@@ -211,10 +208,6 @@ if ($pid) {
 			$ascii = true;
 			fputs($s, "200 OK\r\n");

-		} elseif ($buf === "AUTH SSL\r\n") {
-			$ascii = true;
-			fputs($s, "500 not supported\r\n");
-
 		} elseif ($buf === "TYPE I\r\n") {
 			$ascii = false;
 			fputs($s, "200 OK\r\n");
@@ -1644,7 +1644,7 @@ PHP_FUNCTION(imageistruecolor)
 /* }}} */

 /* {{{ proto void imagetruecolortopalette(resource im, bool ditherFlag, int colorsWanted)
-   Convert a true color image to a palette based image with a number of colors, optionally using dithering. */
+   Convert a true colour image to a palette based image with a number of colours, optionally using dithering. */
 PHP_FUNCTION(imagetruecolortopalette)
 {
 	zval *IM;
@@ -1670,8 +1670,8 @@ PHP_FUNCTION(imagetruecolortopalette)



-/* {{{ proto void imagepalettetotruecolor(resource im)
-   Convert a palette based image to a true color image. */
+/* {{{ proto void imagetruecolortopalette(resource im, bool ditherFlag, int colorsWanted)
+   Convert a true colour image to a palette based image with a number of colours, optionally using dithering. */
 PHP_FUNCTION(imagepalettetotruecolor)
 {
 	zval *IM;
@@ -2614,11 +2614,11 @@ static void _php_image_output(INTERNAL_FUNCTION_PARAMETERS, int image_type, char

 	if (argc > 1) {
 		fn = file;
-		if (argc >= 3) {
+		if (argc == 3) {
 			q = quality;
-			if (argc == 4) {
-				t = type;
-			}
+		}
+		if (argc == 4) {
+			t = type;
 		}
 	}

@@ -3854,7 +3854,7 @@ static void php_imagettftext_common(INTERNAL_FUNCTION_PARAMETERS, int mode, int
 {
 	zval *IM, *EXT = NULL;
 	gdImagePtr im=NULL;
-	long col = -1, x = 0, y = 0;
+	long col = -1, x = -1, y = -1;
 	int str_len, fontname_len, i, brect[8];
 	double ptsize, angle;
 	char *str = NULL, *fontname = NULL;
@@ -4530,7 +4530,6 @@ static void _php_image_convert(INTERNAL_FUNCTION_PARAMETERS, int image_type )
 	dest = VCWD_FOPEN(fn_dest, "wb");
 	if (!dest) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to open '%s' for writing", fn_dest);
-        fclose(org);
 		RETURN_FALSE;
 	}

@@ -4539,8 +4538,6 @@ static void _php_image_convert(INTERNAL_FUNCTION_PARAMETERS, int image_type )
 			im_org = gdImageCreateFromGif(org);
 			if (im_org == NULL) {
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to open '%s' Not a valid GIF file", fn_dest);
-                fclose(org);
-                fclose(dest);
 				RETURN_FALSE;
 			}
 			break;
@@ -4551,8 +4548,6 @@ static void _php_image_convert(INTERNAL_FUNCTION_PARAMETERS, int image_type )
 			im_org = gdImageCreateFromJpegEx(org, ignore_warning);
 			if (im_org == NULL) {
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to open '%s' Not a valid JPEG file", fn_dest);
-                fclose(org);
-                fclose(dest);
 				RETURN_FALSE;
 			}
 			break;
@@ -4563,8 +4558,6 @@ static void _php_image_convert(INTERNAL_FUNCTION_PARAMETERS, int image_type )
 			im_org = gdImageCreateFromPng(org);
 			if (im_org == NULL) {
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to open '%s' Not a valid PNG file", fn_dest);
-                fclose(org);
-                fclose(dest);
 				RETURN_FALSE;
 			}
 			break;
@@ -4572,14 +4565,10 @@ static void _php_image_convert(INTERNAL_FUNCTION_PARAMETERS, int image_type )

 		default:
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Format not supported");
-            fclose(org);
-            fclose(dest);
 			RETURN_FALSE;
 			break;
 	}

-	fclose(org);
-
 	org_width  = gdImageSX (im_org);
 	org_height = gdImageSY (im_org);

@@ -4610,8 +4599,6 @@ static void _php_image_convert(INTERNAL_FUNCTION_PARAMETERS, int image_type )
 	im_tmp = gdImageCreate (dest_width, dest_height);
 	if (im_tmp == NULL ) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to allocate temporary buffer");
-        fclose(dest);
-        gdImageDestroy(im_org);
 		RETURN_FALSE;
 	}

@@ -4619,29 +4606,23 @@ static void _php_image_convert(INTERNAL_FUNCTION_PARAMETERS, int image_type )

 	gdImageDestroy(im_org);

+	fclose(org);
+
 	im_dest = gdImageCreate(dest_width, dest_height);
 	if (im_dest == NULL) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to allocate destination buffer");
-        fclose(dest);
-        gdImageDestroy(im_tmp);
 		RETURN_FALSE;
 	}

 	white = gdImageColorAllocate(im_dest, 255, 255, 255);
 	if (white == -1) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to allocate the colors for the destination buffer");
-        fclose(dest);
-        gdImageDestroy(im_tmp);
-        gdImageDestroy(im_dest);
 		RETURN_FALSE;
 	}

 	black = gdImageColorAllocate(im_dest, 0, 0, 0);
 	if (black == -1) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to allocate the colors for the destination buffer");
-        fclose(dest);
-        gdImageDestroy(im_tmp);
-        gdImageDestroy(im_dest);
 		RETURN_FALSE;
 	}

@@ -5175,7 +5156,7 @@ PHP_FUNCTION(imagescale)
 	gdImagePtr im_scaled = NULL;
 	int new_width, new_height;
 	long tmp_w, tmp_h=-1, tmp_m = GD_BILINEAR_FIXED;
-	gdInterpolationMethod method, old_method;
+	gdInterpolationMethod method;

 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rl|ll", &IM, &tmp_w, &tmp_h, &tmp_m) == FAILURE)  {
 		return;
@@ -5202,12 +5183,9 @@ PHP_FUNCTION(imagescale)
 	new_width = tmp_w;
 	new_height = tmp_h;

-	/* gdImageGetInterpolationMethod() is only available as of GD 2.1.1 */
-	old_method = im->interpolation_id;
 	if (gdImageSetInterpolationMethod(im, method)) {
 		im_scaled = gdImageScale(im, new_width, new_height);
 	}
-	gdImageSetInterpolationMethod(im, old_method);

 	if (im_scaled == NULL) {
 		RETURN_FALSE;
@@ -1298,7 +1298,7 @@ inline static void gdImageSetAAPixelColor(gdImagePtr im, int x, int y, int color
 void gdImageAALine (gdImagePtr im, int x1, int y1, int x2, int y2, int col)
 {
 	/* keep them as 32bits */
-	long x, y, inc, frac;
+	long x, y, inc;
 	long dx, dy,tmp;

 	if (y1 < 0 && y2 < 0) {
@@ -1368,22 +1368,16 @@ void gdImageAALine (gdImagePtr im, int x1, int y1, int x2, int y2, int col)
 			dx = x2 - x1;
 			dy = y2 - y1;
 		}
-		y = y1;
+		x = x1 << 16;
+		y = y1 << 16;
 		inc = (dy * 65536) / dx;
-		frac = 0;
-		for (x = x1; x <= x2; x++) {
-			gdImageSetAAPixelColor(im, x, y, col, (frac >> 8) & 0xFF);
-			if (y + 1 < im->sy) {
-				gdImageSetAAPixelColor(im, x, y + 1, col, (~frac >> 8) & 0xFF);
-			}
-			frac += inc;
-			if (frac >= 65536) {
-				frac -= 65536;
-				y++;
-			} else if (frac < 0) {
-				frac += 65536;
-				y--;
+		while ((x >> 16) <= x2) {
+			gdImageSetAAPixelColor(im, x >> 16, y >> 16, col, (y >> 8) & 0xFF);
+			if ((y >> 16) + 1 < im->sy) {
+				gdImageSetAAPixelColor(im, x >> 16, (y >> 16) + 1,col, (~y >> 8) & 0xFF);
 			}
+			x += (1 << 16);
+			y += inc;
 		}
 	} else {
 		if (dy < 0) {
@@ -1396,22 +1390,16 @@ void gdImageAALine (gdImagePtr im, int x1, int y1, int x2, int y2, int col)
 			dx = x2 - x1;
 			dy = y2 - y1;
 		}
-		x = x1;
+		x = x1 << 16;
+		y = y1 << 16;
 		inc = (dx * 65536) / dy;
-		frac = 0;
-		for (y = y1; y <= y2; y++) {
-			gdImageSetAAPixelColor(im, x, y, col, (frac >> 8) & 0xFF);
-			if (x + 1 < im->sx) {
-				gdImageSetAAPixelColor(im, x + 1, y, col, (~frac >> 8) & 0xFF);
-			}
-			frac += inc;
-			if (frac >= 65536) {
-				frac -= 65536;
-				x++;
-			} else if (frac < 0) {
-				frac += 65536;
-				x--;
+		while ((y>>16) <= y2) {
+			gdImageSetAAPixelColor(im, x >> 16, y >> 16, col, (x >> 8) & 0xFF);
+			if ((x >> 16) + 1 < im->sx) {
+				gdImageSetAAPixelColor(im, (x >> 16) + 1, (y >> 16),col, (~x >> 8) & 0xFF);
 			}
+			x += inc;
+			y += (1<<16);
 		}
 	}
 }
@@ -2259,9 +2247,7 @@ void gdImageCopy (gdImagePtr dst, gdImagePtr src, int dstX, int dstY, int srcX,
 			for (y = 0; (y < h); y++) {
 				for (x = 0; (x < w); x++) {
 					int c = gdImageGetTrueColorPixel (src, srcX + x, srcY + y);
-					if (c != src->transparent) {
-						gdImageSetPixel (dst, dstX + x, dstY + y, c);
-					}
+					gdImageSetPixel (dst, dstX + x, dstY + y, c);
 				}
 			}
 		} else {
@@ -2278,6 +2264,26 @@ void gdImageCopy (gdImagePtr dst, gdImagePtr src, int dstX, int dstY, int srcX,
 		return;
 	}

+	/* Destination is palette based */
+	if (src->trueColor) { /* But source is truecolor (Ouch!) */
+		toy = dstY;
+		for (y = srcY; (y < (srcY + h)); y++) {
+			tox = dstX;
+			for (x = srcX; x < (srcX + w); x++) {
+				int nc;
+				c = gdImageGetPixel (src, x, y);
+
+				/* Get best match possible. */
+				nc = gdImageColorResolveAlpha(dst, gdTrueColorGetRed(c), gdTrueColorGetGreen(c), gdTrueColorGetBlue(c), gdTrueColorGetAlpha(c));
+
+				gdImageSetPixel(dst, tox, toy, nc);
+				tox++;
+			}
+			toy++;
+		}
+		return;
+	}
+
 	/* Palette based to palette based */
 	for (i = 0; i < gdMaxColors; i++) {
 		colorMap[i] = (-1);
@@ -243,10 +243,6 @@ gdImagePtr gdImageCropThreshold(gdImagePtr im, const unsigned int color, const f
 		return NULL;
 	}

-	if (!gdImageTrueColor(im) && color >= gdImageColorsTotal(im)) {
-		return NULL;
-	}
-
 	/* TODO: Add gdImageGetRowPtr and works with ptr at the row level
 	 * for the true color and palette images
 	 * new formats will simply work with ptr
@@ -191,21 +191,21 @@ static gdImagePtr _gd2CreateFromFile (gdIOCtxPtr in, int *sx, int *sy, int *cs,
 	}
 	if (im == NULL) {
 		GD2_DBG(php_gd_error("Could not create gdImage"));
-		goto fail2;
+		goto fail1;
 	}

 	if (!_gdGetColors(in, im, (*vers) == 2)) {
 		GD2_DBG(php_gd_error("Could not read color palette"));
-		goto fail3;
+		goto fail2;
 	}
 	GD2_DBG(php_gd_error("Image palette completed: %d colours", im->colorsTotal));

 	return im;

-fail3:
-	gdImageDestroy(im);
 fail2:
-	gdFree(*cidx);
+	gdImageDestroy(im);
+	return 0;
+
 fail1:
 	return 0;
 }
@@ -670,7 +670,7 @@ static void _gdImageGd2 (gdImagePtr im, gdIOCtx * out, int cs, int fmt)

 	/* Force fmt to a valid value since we don't return anything. */
 	if ((fmt != GD2_FMT_RAW) && (fmt != GD2_FMT_COMPRESSED)) {
-		fmt = GD2_FMT_COMPRESSED;
+		fmt = im->trueColor ? GD2_FMT_TRUECOLOR_COMPRESSED : GD2_FMT_COMPRESSED;
 	}
 	if (im->trueColor) {
 		fmt += 2;
@@ -689,8 +689,8 @@ static void _gdImageGd2 (gdImagePtr im, gdIOCtx * out, int cs, int fmt)
 	}

 	/* Work out number of chunks. */
-	ncx = (im->sx + cs - 1) / cs;
-	ncy = (im->sy + cs - 1) / cs;
+	ncx = im->sx / cs + 1;
+	ncy = im->sy / cs + 1;

 	/* Write the standard header. */
 	_gd2PutHeader (im, out, cs, fmt, ncx, ncy);
@@ -1331,10 +1331,10 @@ static gdImagePtr gdImageScaleBilinearPalette(gdImagePtr im, const unsigned int
 			f_a4 = gd_itofx(gdTrueColorGetAlpha(pixel4));

 			{
-				const unsigned char red = (unsigned char) gd_fxtoi(gd_mulfx(f_w1, f_r1) + gd_mulfx(f_w2, f_r2) + gd_mulfx(f_w3, f_r3) + gd_mulfx(f_w4, f_r4));
-				const unsigned char green = (unsigned char) gd_fxtoi(gd_mulfx(f_w1, f_g1) + gd_mulfx(f_w2, f_g2) + gd_mulfx(f_w3, f_g3) + gd_mulfx(f_w4, f_g4));
-				const unsigned char blue = (unsigned char) gd_fxtoi(gd_mulfx(f_w1, f_b1) + gd_mulfx(f_w2, f_b2) + gd_mulfx(f_w3, f_b3) + gd_mulfx(f_w4, f_b4));
-				const unsigned char alpha = (unsigned char) gd_fxtoi(gd_mulfx(f_w1, f_a1) + gd_mulfx(f_w2, f_a2) + gd_mulfx(f_w3, f_a3) + gd_mulfx(f_w4, f_a4));
+				const char red = (char) gd_fxtoi(gd_mulfx(f_w1, f_r1) + gd_mulfx(f_w2, f_r2) + gd_mulfx(f_w3, f_r3) + gd_mulfx(f_w4, f_r4));
+				const char green = (char) gd_fxtoi(gd_mulfx(f_w1, f_g1) + gd_mulfx(f_w2, f_g2) + gd_mulfx(f_w3, f_g3) + gd_mulfx(f_w4, f_g4));
+				const char blue = (char) gd_fxtoi(gd_mulfx(f_w1, f_b1) + gd_mulfx(f_w2, f_b2) + gd_mulfx(f_w3, f_b3) + gd_mulfx(f_w4, f_b4));
+				const char alpha = (char) gd_fxtoi(gd_mulfx(f_w1, f_a1) + gd_mulfx(f_w2, f_a2) + gd_mulfx(f_w3, f_a3) + gd_mulfx(f_w4, f_a4));

 				new_img->tpixels[dst_offset_v][dst_offset_h] = gdTrueColorAlpha(red, green, blue, alpha);
 			}
@@ -237,7 +237,7 @@ static int dynamicGetbuf (gdIOCtxPtr ctx, void *buf, int len)
 	if (remain >= len) {
 		rlen = len;
 	} else {
-		if (remain <= 0) {
+		if (remain == 0) {
 			return EOF;
 		}
 		rlen = remain;
@@ -760,7 +760,7 @@ LOCAL (void)
  cinfo->colormap[2][icolor] = (JSAMPLE) ((c2total + (total >> 1)) / total);
 #else
  /* 2.0.16: Paul den Dulk found an occasion where total can be 0 */
-  if (total)
+  if (count)
    {
      nim->red[icolor] = (int) ((c0total + (total >> 1)) / total);
      nim->green[icolor] = (int) ((c1total + (total >> 1)) / total);
@@ -180,15 +180,6 @@ void gdImageWebpCtx (gdImagePtr im, gdIOCtx * outfile, int quantization)
 	/* Conversion to Y,U,V buffer */
    yuv_width = (width + 1) >> 1;
    yuv_height = (height + 1) >> 1;
-
-	if (overflow2(width, height)) {
-		return;
-	}
-	/* simplification possible, because WebP must not be larger than 16384**2 */
-	if (overflow2(width * height, 2 * sizeof(unsigned char))) {
-		return;
-	}
-
    yuv_nbytes = width * height + 2 * yuv_width * yuv_height;

    if ((Y = (unsigned char *)gdCalloc(yuv_nbytes, sizeof(unsigned char))) == NULL) {
@@ -659,8 +659,6 @@ static char * gdft_draw_bitmap (gdCache_head_t *tc_cache, gdImage * im, int fg,
 				} else {
 					return "Unsupported ft_pixel_mode";
 				}
-				if (level == 0)  /* if background */
-					continue;
 				if ((fg >= 0) && (im->trueColor)) {
 					/* Consider alpha in the foreground color itself to be an
 					 * upper bound on how opaque things get, when truecolor is
@@ -750,9 +748,9 @@ static char * gdft_draw_bitmap (gdCache_head_t *tc_cache, gdImage * im, int fg,
 }

 static int
-gdroundupdown (FT_F26Dot6 v1, int roundup)
+gdroundupdown (FT_F26Dot6 v1, int updown)
 {
-	return (!roundup) ? v1 >> 6 : (v1 + 63) >> 6;
+	return (!updown) ? (v1 < 0 ? ((v1 - 63) >> 6) : v1 >> 6) : (v1 > 0 ? ((v1 + 63) >> 6) : v1 >> 6);
 }

 void gdFontCacheShutdown()
@@ -822,6 +820,8 @@ gdImageStringFTEx (gdImage * im, int *brect, int fg, char *fontlist, double ptsi
 	double cos_a = cos (angle);
 	int len, i = 0, ch;
 	int x1 = 0, y1 = 0;
+	int xb = x, yb = y;
+	int yd = 0;
 	font_t *font;
 	fontkey_t fontkey;
 	char *next;
@@ -982,6 +982,9 @@ gdImageStringFTEx (gdImage * im, int *brect, int fg, char *fontlist, double ptsi
 			  penf.y = (penf.y - 32) & -64;		/* round to next pixel row */
 			  x1 = (int)(- penf.y * sin_a + 32) / 64;
 			  y1 = (int)(- penf.y * cos_a + 32) / 64;
+			  xb = x + x1;
+			  yb = y + y1;
+			  yd = 0;
 			  pen.x = pen.y = 0;
 			  previous = 0;		/* clear kerning flag */
 			  continue;
@@ -1071,32 +1074,23 @@ gdImageStringFTEx (gdImage * im, int *brect, int fg, char *fontlist, double ptsi
 		/* retrieve kerning distance and move pen position */
 		if (use_kerning && previous && glyph_index) {
 			FT_Get_Kerning(face, previous, glyph_index, ft_kerning_default, &delta);
-			pen.x += (int)(delta.x * cos_a);
-			pen.y -= (int)(delta.x * sin_a);
+			pen.x += delta.x;
 			penf.x += delta.x;
 		}

+		/* load glyph image into the slot (erase previous one) */
+		if (FT_Load_Glyph(face, glyph_index, render_mode)) {
+			if (tmpstr) {
+				gdFree(tmpstr);
+			}
+			gdCacheDelete(tc_cache);
+			gdMutexUnlock(gdFontCacheMutex);
+			return "Problem loading glyph";
+		}
+
+		/* transform glyph image */
+		FT_Get_Glyph(slot, &image);
 		if (brect) { /* only if need brect */
-			/* load glyph image into the slot (erase previous one) */
-			if (FT_Load_Glyph(face, glyph_index, render_mode | FT_LOAD_IGNORE_TRANSFORM)) {
-				if (tmpstr) {
-					gdFree(tmpstr);
-				}
-				gdCacheDelete(tc_cache);
-				gdMutexUnlock(gdFontCacheMutex);
-				return "Problem loading glyph";
-			}
-
-			/* transform glyph image */
-			if (FT_Get_Glyph(slot, &image)) {
-				if (tmpstr) {
-					gdFree(tmpstr);
-				}
-				gdCacheDelete(tc_cache);
-				gdMutexUnlock(gdFontCacheMutex);
-				return "Problem loading glyph";
-			}
-
 			FT_Glyph_Get_CBox(image, ft_glyph_bbox_gridfit, &glyph_bbox);
 			glyph_bbox.xMin += penf.x;
 			glyph_bbox.yMin += penf.y;
@@ -1106,11 +1100,17 @@ gdImageStringFTEx (gdImage * im, int *brect, int fg, char *fontlist, double ptsi
 				glyph_bbox.xMax += slot->metrics.horiAdvance;
 			}
 			if (!i) { /* if first character, init BB corner values */
+				yd = slot->metrics.height - slot->metrics.horiBearingY;
 				bbox.xMin = glyph_bbox.xMin;
 				bbox.yMin = glyph_bbox.yMin;
 				bbox.xMax = glyph_bbox.xMax;
 				bbox.yMax = glyph_bbox.yMax;
 			} else {
+				FT_Pos desc;
+
+				if ( (desc = (slot->metrics.height - slot->metrics.horiBearingY)) > yd) {
+					yd = desc;
+				}
 				if (bbox.xMin > glyph_bbox.xMin) {
 					bbox.xMin = glyph_bbox.xMin;
 				}
@@ -1127,35 +1127,7 @@ gdImageStringFTEx (gdImage * im, int *brect, int fg, char *fontlist, double ptsi
 			i++;
 		}

-		/* increment (unrotated) pen position */
-		penf.x += slot->metrics.horiAdvance;
-
 		if (render) {
-			if (!brect || angle != 0) {
-				/* reload the rotated glyph (for bbox we needed FT_LOAD_IGNORE_TRANSFORM - bbox is rotated later) */
-				FT_Done_Glyph(image);
-
-				/* load glyph image into the slot (erase previous one) */
-				if (FT_Load_Glyph(face, glyph_index, render_mode)) {
-					if (tmpstr) {
-						gdFree(tmpstr);
-					}
-					gdCacheDelete(tc_cache);
-					gdMutexUnlock(gdFontCacheMutex);
-					return "Problem loading glyph";
-				}
-
-				/* transform glyph image */
-				if (FT_Get_Glyph(slot, &image)) {
-					if (tmpstr) {
-						gdFree(tmpstr);
-					}
-					gdCacheDelete(tc_cache);
-					gdMutexUnlock(gdFontCacheMutex);
-					return "Problem loading glyph";
-				}
-			}
-
 			if (image->format != ft_glyph_format_bitmap && FT_Glyph_To_Bitmap(&image, ft_render_mode_normal, 0, 1)) {
 				FT_Done_Glyph(image);
 				if (tmpstr) {
@@ -1178,6 +1150,8 @@ gdImageStringFTEx (gdImage * im, int *brect, int fg, char *fontlist, double ptsi
 		pen.x += image->advance.x >> 10;
 		pen.y -= image->advance.y >> 10;

+		penf.x += slot->metrics.horiAdvance;
+
 		FT_Done_Glyph(image);
 	}

@@ -1186,25 +1160,36 @@ gdImageStringFTEx (gdImage * im, int *brect, int fg, char *fontlist, double ptsi
 		double d1 = sin (angle + 0.78539816339744830962);
 		double d2 = sin (angle - 0.78539816339744830962);

-		/* rotate bounding rectangle (at 0, 0) */
-		brect[0] = (int) (bbox.xMin * cos_a - bbox.yMin * sin_a);
-		brect[1] = (int) (bbox.xMin * sin_a + bbox.yMin * cos_a);
-		brect[2] = (int) (bbox.xMax * cos_a - bbox.yMin * sin_a);
-		brect[3] = (int) (bbox.xMax * sin_a + bbox.yMin * cos_a);
-		brect[4] = (int) (bbox.xMax * cos_a - bbox.yMax * sin_a);
-		brect[5] = (int) (bbox.xMax * sin_a + bbox.yMax * cos_a);
-		brect[6] = (int) (bbox.xMin * cos_a - bbox.yMax * sin_a);
-		brect[7] = (int) (bbox.xMin * sin_a + bbox.yMax * cos_a);
+		/* make the center of rotation at (0, 0) */
+		FT_BBox normbox;
+
+		normbox.xMin = 0;
+		normbox.yMin = 0;
+		normbox.xMax = bbox.xMax - bbox.xMin;
+		normbox.yMax = bbox.yMax - bbox.yMin;
+
+		brect[0] = brect[2] = brect[4] = brect[6] = (int)  (yd * sin_a);
+		brect[1] = brect[3] = brect[5] = brect[7] = (int)(- yd * cos_a);
+
+		/* rotate bounding rectangle */
+		brect[0] += (int) (normbox.xMin * cos_a - normbox.yMin * sin_a);
+		brect[1] += (int) (normbox.xMin * sin_a + normbox.yMin * cos_a);
+		brect[2] += (int) (normbox.xMax * cos_a - normbox.yMin * sin_a);
+		brect[3] += (int) (normbox.xMax * sin_a + normbox.yMin * cos_a);
+		brect[4] += (int) (normbox.xMax * cos_a - normbox.yMax * sin_a);
+		brect[5] += (int) (normbox.xMax * sin_a + normbox.yMax * cos_a);
+		brect[6] += (int) (normbox.xMin * cos_a - normbox.yMax * sin_a);
+		brect[7] += (int) (normbox.xMin * sin_a + normbox.yMax * cos_a);

 		/* scale, round and offset brect */
-		brect[0] = x + gdroundupdown(brect[0], d2 > 0);
-		brect[1] = y - gdroundupdown(brect[1], d1 < 0);
-		brect[2] = x + gdroundupdown(brect[2], d1 > 0);
-		brect[3] = y - gdroundupdown(brect[3], d2 > 0);
-		brect[4] = x + gdroundupdown(brect[4], d2 < 0);
-		brect[5] = y - gdroundupdown(brect[5], d1 > 0);
-		brect[6] = x + gdroundupdown(brect[6], d1 < 0);
-		brect[7] = y - gdroundupdown(brect[7], d2 < 0);
+		brect[0] = xb + gdroundupdown(brect[0], d2 > 0);
+		brect[1] = yb - gdroundupdown(brect[1], d1 < 0);
+		brect[2] = xb + gdroundupdown(brect[2], d1 > 0);
+		brect[3] = yb - gdroundupdown(brect[3], d2 > 0);
+		brect[4] = xb + gdroundupdown(brect[4], d2 < 0);
+		brect[5] = yb - gdroundupdown(brect[5], d1 > 0);
+		brect[6] = xb + gdroundupdown(brect[6], d1 < 0);
+		brect[7] = yb - gdroundupdown(brect[7], d2 < 0);
 	}

 	if (tmpstr) {
@@ -8,13 +8,16 @@ Bug #22544 (TrueColor transparency in PNG images).
 ?>
 --FILE--
 <?php
+	$dest = dirname(realpath(__FILE__)) . '/bug22544.png';
+	@unlink($dest);
 	$image = imageCreateTruecolor(640, 100);
 	$transparent = imageColorAllocate($image, 0, 0, 0);
 	$red = imageColorAllocate($image, 255, 50, 50);
 	imageColorTransparent($image, $transparent);
 	imageFilledRectangle($image, 0, 0, 640-1, 100-1, $transparent);
-	include_once __DIR__ . '/func.inc';
-	test_image_equals_file(__DIR__ . '/bug22544.png', $image);
+	imagePng($image, $dest);
+	echo md5_file($dest) . "\n";
+	@unlink($dest);
 ?>
 --EXPECT--
-The images are equal.
+10a57d09a2c63fad87b85b38d6b258d6
@@ -1,53 +1,29 @@
 --TEST--
-Bug #43073 (TrueType bounding box is wrong for angle<>0)
+Bug #43073 (TrueType bounding box is wrong for angle<>0) freetype < 2.4.10
 --SKIPIF--
 <?php
 	if(!extension_loaded('gd')){ die('skip gd extension not available'); }
 	if(!function_exists('imagettftext')) die('skip imagettftext() not available');
+
+	include dirname(__FILE__) . '/func.inc';
+	if(version_compare(get_freetype_version(), '2.4.10') >= 0) die('skip for freetype < 2.4.10');
 ?>
 --FILE--
 <?php
-$exp = [
-	[501,400, 611,400, 611,376, 501,376],
-	[492,361, 595,319, 586,296, 483,338],
-	[470,329, 549,251, 531,233, 453,312],
-	[439,307, 481,204, 458,195, 416,297],
-	[400,299, 400,189, 376,189, 376,299],
-	[361,307, 319,204, 296,213, 338,316],
-	[329,329, 251,250, 233,267, 311,346],
-	[307,360, 204,318, 195,341, 297,383],
-	[299,400, 189,400, 189,424, 299,424],
-	[307,438, 204,480, 213,503, 316,461],
-	[329,470, 250,548, 267,566, 346,488],
-	[360,492, 318,595, 341,604, 383,502],
-	[400,501, 400,611, 424,611, 424,501],
-	[438,492, 480,595, 503,586, 461,483],
-	[470,470, 548,549, 566,532, 488,453],
-	[492,439, 595,481, 604,458, 502,416]
-];
 $cwd = dirname(__FILE__);
 $font = "$cwd/Tuffy.ttf";
 $delta_t = 360.0 / 16; # Make 16 steps around
 $g = imagecreate(800, 800);
 $bgnd  = imagecolorallocate($g, 255, 255, 255);
 $black = imagecolorallocate($g, 0, 0, 0);
-$red = imagecolorallocate($g, 255, 0, 0);
 $x = 100;
 $y = 0;
 $cos_t = cos(deg2rad($delta_t));
 $sin_t = sin(deg2rad($delta_t));
-for ($angle = 0.0, $i = 0; $angle < 360.0; $angle += $delta_t, $i++) {
+for ($angle = 0.0; $angle < 360.0; $angle += $delta_t) {
  $bbox = imagettftext($g, 24, $angle, 400+$x, 400+$y, $black, $font, 'ABCDEF');
-  imagepolygon($g, $bbox, 4, $red);
-  printf("%2d: ", $i);
-  for ($j = 0; $j < 8; $j++) {
-	if ($bbox[$j] >= $exp[$i][$j] - 1 && $bbox[$j] <= $exp[$i][$j] + 1) {
-		echo '.';
-	} else {
-		echo "(expected $exp[$i][$j], got $bbox[$j])";
-	}
-  }
-  echo "\n";
+  $s = vsprintf("(%d, %d), (%d, %d), (%d, %d), (%d, %d)\n", $bbox);
+  echo $s;
  $temp = $cos_t * $x + $sin_t * $y;
  $y    = $cos_t * $y - $sin_t * $x;
  $x    = $temp;
@@ -56,20 +32,20 @@ imagepng($g, "$cwd/bug43073.png");
 ?>
 --CLEAN--
 <?php @unlink(dirname(__FILE__) . '/bug43073.png'); ?>
--EXPECT--
- 0: ........
- 1: ........
- 2: ........
- 3: ........
- 4: ........
- 5: ........
- 6: ........
- 7: ........
- 8: ........
- 9: ........
-10: ........
-11: ........
-12: ........
-13: ........
-14: ........
-15: ........
+--EXPECTF--
+(500, 40%d), (610, 40%d), (610, 376), (500, 376)
+(492, 363), (591, 322), (580, 295), (480, 336)
+(470, 331), (548, 254), (527, 233), (449, 310)
+(439, 309), (483, 202), (461, 193), (416, 299)
+(40%d, 300), (40%d, 183), (38%d, 183), (38%d, 300)
+(362, 307), (316, 195), (291, 205), (337, 318)
+(330, 329), (246, 244), (224, 265), (308, 350)
+(308, 360), (202, 316), (190, 344), (296, 388)
+(300, %d), (18%d, %d), (18%d, 425), (%d, 425)
+(306, 437), (195, 483), (206, 510), (318, 464)
+(328, 469), (240, 557), (260, 578), (349, 491)
+(359, 491), (312, 607), (334, 616), (382, 501)
+(%d, 500), (%d, 618), (41%d, 618), (41%d, 500)
+(436, 493), (483, 607), (507, 597), (461, 482)
+(468, 471), (555, 558), (577, 538), (490, 450)
+(490, 440), (600, 485), (611, 457), (502, 412)
@@ -0,0 +1,51 @@
+--TEST--
+Bug #43073 (TrueType bounding box is wrong for angle<>0) freetype >= 2.4.10
+--SKIPIF--
+<?php
+	if(!extension_loaded('gd')){ die('skip gd extension not available'); }
+	if(!function_exists('imagettftext')) die('skip imagettftext() not available');
+
+	include dirname(__FILE__) . '/func.inc';
+	if(version_compare(get_freetype_version(), '2.4.10') == -1) die('skip for freetype >= 2.4.10');
+?>
+--FILE--
+<?php
+$cwd = dirname(__FILE__);
+$font = "$cwd/Tuffy.ttf";
+$delta_t = 360.0 / 16; # Make 16 steps around
+$g = imagecreate(800, 800);
+$bgnd  = imagecolorallocate($g, 255, 255, 255);
+$black = imagecolorallocate($g, 0, 0, 0);
+$x = 100;
+$y = 0;
+$cos_t = cos(deg2rad($delta_t));
+$sin_t = sin(deg2rad($delta_t));
+for ($angle = 0.0; $angle < 360.0; $angle += $delta_t) {
+  $bbox = imagettftext($g, 24, $angle, 400+$x, 400+$y, $black, $font, 'ABCDEF');
+  $s = vsprintf("(%d, %d), (%d, %d), (%d, %d), (%d, %d)\n", $bbox);
+  echo $s;
+  $temp = $cos_t * $x + $sin_t * $y;
+  $y    = $cos_t * $y - $sin_t * $x;
+  $x    = $temp;
+}
+imagepng($g, "$cwd/bug43073.png");
+?>
+--CLEAN--
+<?php @unlink(dirname(__FILE__) . '/bug43073.png'); ?>
+--EXPECTF--
+(500, 400), (610, 400), (610, 376), (500, 376)
+(492, 363), (591, 322), (580, 295), (480, 336)
+(470, 331), (548, 254), (527, 233), (449, 310)
+(439, 309), (483, 202), (461, 193), (416, 299)
+(400, 300), (400, 183), (380, 183), (380, 300)
+(362, 307), (316, 195), (291, 205), (337, 318)
+(330, 329), (246, 244), (224, 265), (308, 350)
+(308, 360), (202, 316), (190, 344), (296, 388)
+(300, 400), (187, 400), (187, 425), (300, 425)
+(306, 437), (195, 483), (206, 510), (318, 464)
+(328, 469), (240, 557), (260, 578), (349, 491)
+(359, 491), (312, 607), (334, 616), (382, 501)
+(400, 500), (400, 618), (419, 618), (419, 500)
+(436, 493), (483, 607), (507, 597), (461, 482)
+(468, 471), (555, 558), (577, 538), (490, 450)
+(490, 440), (600, 485), (611, 457), (502, 412)
@@ -3,9 +3,6 @@ Bug #43121 (gdImageFill with IMG_COLOR_TILED crashes httpd)
 --SKIPIF--
 <?php
 	if (!extension_loaded('gd')) die("skip gd extension not available\n");
-	if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.0', '<')) {
-		die("skip test requires GD 2.2.0 or higher");
-	}
 ?>
 --FILE--
 <?php
@@ -3,9 +3,6 @@ Bug #43475 (Thick styled lines have scrambled patterns)
 --SKIPIF--
 <?php
 	if (!extension_loaded('gd')) die("skip gd extension not available\n");
-	if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.2', '<')) {
-		die("skip test requires GD 2.2.2 or higher");
-	}
 ?>
 --FILE--
 <?php
@@ -3,9 +3,6 @@ Bug #43828 (broken transparency of imagearc for truecolor in blendingmode)
 --SKIPIF--
 <?php
 if (!extension_loaded('gd')) die('skip ext/gd not available');
-if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.2', '<')) {
-	die("skip test requires GD 2.2.2 or higher");
-}
 ?>
 --FILE--
 <?php
@@ -17,10 +14,10 @@ imagefilledrectangle($im, 0,0, 99,99, $transparent);
 $color = imagecolorallocatealpha($im, 0, 255, 0, 100);
 imagefilledarc($im, 49, 49, 99,99, 0 , 360, $color, IMG_ARC_PIE);

-include_once __DIR__ . '/func.inc';
-test_image_equals_file(__DIR__ . '/bug43828.png', $im);
-
+ob_start();
+imagepng($im);
+echo md5(ob_get_clean());
 imagedestroy($im);
 ?>
 --EXPECT--
-The images are equal.
+3d82e4525f19790ae1055366e2a36917
@@ -19,4 +19,4 @@ echo 'Left Bottom: (' . $bbox[0]  . ', ' . $bbox[1] . ')';
 --CLEAN--
 <?php @unlink(dirname(__FILE__) . '/bug48732.png'); ?>
 --EXPECTF--
-Left Bottom: (0, 46)
+Left Bottom: (0, 47)
@@ -1,9 +1,12 @@
 --TEST--
-Bug #48801 (Problem with imagettfbbox)
+Bug #48801 (Problem with imagettfbbox) freetype < 2.4.10
 --SKIPIF--
 <?php
 	if(!extension_loaded('gd')){ die('skip gd extension not available'); }
 	if(!function_exists('imageftbbox')) die('skip imageftbbox() not available');
+
+	include dirname(__FILE__) . '/func.inc';
+	if(version_compare(get_freetype_version(), '2.4.10') >= 0) die('skip for freetype < 2.4.10');
 ?>
 --FILE--
 <?php
@@ -15,8 +18,8 @@ echo '(' . $bbox[2] . ', ' . $bbox[3] . ")\n";
 echo '(' . $bbox[4] . ', ' . $bbox[5] . ")\n";
 echo '(' . $bbox[6] . ', ' . $bbox[7] . ")\n";
 ?>
--EXPECTREGEX--
-\(4, 15\)
-\(16[0-1], 15\)
-\(16[0-1], -4[7-8]\)
-\(4, -4[7-8]\)
+--EXPECTF--
+(-1, 15)
+(15%d, 15)
+(15%d, -48)
+(-1, -48)
@@ -0,0 +1,25 @@
+--TEST--
+Bug #48801 (Problem with imagettfbbox) freetype >= 2.4.10
+--SKIPIF--
+<?php
+	if(!extension_loaded('gd')){ die('skip gd extension not available'); }
+	if(!function_exists('imageftbbox')) die('skip imageftbbox() not available');
+
+	include dirname(__FILE__) . '/func.inc';
+	if(version_compare(get_freetype_version(), '2.4.10') == -1) die('skip for freetype >= 2.4.10');
+?>
+--FILE--
+<?php
+$cwd = dirname(__FILE__);
+$font = "$cwd/Tuffy.ttf";
+$bbox = imageftbbox(50, 0, $font, "image");
+echo '(' . $bbox[0] . ', ' . $bbox[1] . ")\n";
+echo '(' . $bbox[2] . ', ' . $bbox[3] . ")\n";
+echo '(' . $bbox[4] . ', ' . $bbox[5] . ")\n";
+echo '(' . $bbox[6] . ', ' . $bbox[7] . ")\n";
+?>
+--EXPECTF--
+(-1, 15)
+(15%d, 15)
+(15%d, -48)
+(-1, -48)
@@ -1,38 +0,0 @@
--TEST--
-Bug #50194 (imagettftext broken on transparent background w/o alphablending)
--SKIPIF--
-<?php
-if (!extension_loaded('gd')) die('skip gd extension not available');
-if (!function_exists('imagettftext')) die('skip imagettftext() not available');
-//die('skip freetype issues');
-?>
--FILE--
-<?php
-require_once __DIR__ . DIRECTORY_SEPARATOR . 'func.inc';
-
-$im = imagecreatetruecolor(240, 55);
-$background = imagecolorallocatealpha($im, 60, 60, 60, 0); // no tranparency
-$black = imagecolorallocate($im, 0, 0, 0);
-imagealphablending($im, false); 
-imagefilledrectangle($im, 0, 0, 239, 54, $background);
-$text = 'Testing ... ';
-$font = __DIR__ . DIRECTORY_SEPARATOR . 'Tuffy.ttf';
-imagettftext($im, 40, 0, 10, 40, $black, $font, $text);
-imagesavealpha($im, true);
-
-ob_start();
-test_image_equals_file(__DIR__ . DIRECTORY_SEPARATOR . 'bug50194.png', $im);
-$output = ob_get_clean();
-assert(preg_match('/The images are equal|The images differ in (\d+) pixels/', $output, $matches));
-if (isset($matches[1]) && $matches[1] > 2000) {
-    echo "The images differ in {$matches[1]} pixels.\n";
-} else {
-    echo "The images are similar.\n";
-}
-
-imagedestroy($im);
-?>
-===DONE===
--EXPECT--
-The images are similar.
-===DONE===
@@ -3,9 +3,6 @@ Bug #53154 (Zero-height rectangle has whiskers)
 --SKIPIF--
 <?php
 if (!extension_loaded('gd')) die('skip gd extension not available');
-if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.2', '<')) {
-    die("skip test requires GD 2.2.2 or higher");
-}
 ?>
 --FILE--
 <?php
@@ -3,9 +3,6 @@ Bug #53156 (imagerectangle problem with point ordering)
 --SKIPIF--
 <?php
 if (!extension_loaded('gd')) die('skip gd extension not available');
-if (!GD_BUNDLED && version_compare(GD_VERSION, '2.3', '<')) {
-    die("skip test requires GD 2.3 or newer");
-}
 ?>
 --FILE--
 <?php
@@ -1,107 +0,0 @@
--TEST--
-Bug #53504 imagettfbbox/imageftbbox gives incorrect values for bounding box
--SKIPIF--
-<?php
-	if(!extension_loaded('gd')){ die('skip gd extension not available'); }
-	if(!function_exists('imageftbbox')) die('skip imageftbbox() not available');
-?>
--FILE--
-<?php
-$cwd = dirname(__FILE__);
-$font = "$cwd/Tuffy.ttf";
-
-$g = imagecreate(800, 800);
-$bgnd  = imagecolorallocate($g, 255, 255, 255);
-$black = imagecolorallocate($g, 0, 0, 0);
-$red = imagecolorallocate($g, 255, 0, 0);
-$blue = imagecolorallocate($g, 0, 0, 255);
-
-$tests = [
-    // Kerning examples (unfortunately not available in "Tuffy" test font):
-    ['fontSize' => 50, 'angle' => 0, 'x' => 20, 'y' => 70, 'text' => 'AV Teg', 'exp' => [2,15, 208,15, 208,-48, 2,-48]],
-    ['fontSize' => 50, 'angle' => 90, 'x' => 70, 'y' => 350, 'text' => 'AV Teg', 'exp' => [15,-1, 15,-208, -48,-208, -48,-2]],
-    ['fontSize' => 50, 'angle' => 40, 'x' => 130, 'y' => 280, 'text' => 'AV Teg', 'exp' => [11,11, 169,-122, 129,-171, -30,-39]],
-
-    // Shift-Test:
-    ['fontSize' => 100, 'angle' => 0, 'x' => 350, 'y' => 110, 'text' => 'H-Shift', 'exp' => [8,2, 386,2, 386,-97, 8,-97]],
-
-    // Small/single chars:
-    ['fontSize' => 100, 'angle' => 0, 'x' => 350, 'y' => 220, 'text' => '-', 'exp' => [7,-37, 51,-37, 51,-46, 7,-46]],
-    ['fontSize' => 100, 'angle' => 0, 'x' => 430, 'y' => 220, 'text' => ',', 'exp' => [7,15, 21,15, 21,-13, 7,-13]],
-    ['fontSize' => 100, 'angle' => 0, 'x' => 510, 'y' => 220, 'text' => '.', 'exp' => [7,1, 21,1, 21,-13, 7,-13]],
-    ['fontSize' => 100, 'angle' => 0, 'x' => 590, 'y' => 220, 'text' => '|', 'exp' => [8,0, 17,0, 17,-95, 8,-95]],
-    ['fontSize' => 100, 'angle' => 0, 'x' => 670, 'y' => 220, 'text' => 'g', 'exp' => [5,29, 60,29, 60,-72, 5,-72]],
-
-    // Multi-Line + rotation:
-    ['fontSize' => 30, 'angle' => 0, 'x' => 20, 'y' => 400, 'text' => "Multi\nLine\nTest", 'exp' => [2,107, 80,107, 80,-29, 2,-29]],
-    ['fontSize' => 30, 'angle' => 40, 'x' => 150, 'y' => 420, 'text' => "Multi\nLine\nTest", 'exp' => [70,81, 131,31, 43,-74, -18,-24]],
-    ['fontSize' => 30, 'angle' => 90, 'x' => 250, 'y' => 340, 'text' => "Multi\nLine\nTest", 'exp' => [107,-1, 107,-80, -29,-80, -29,-2]],
-
-    // Some edge case glyphs:
-    ['fontSize' => 50, 'angle' => 90, 'x' => 70, 'y' => 750, 'text' => "iiiiiiiiiiii", 'exp' => [0,-4, 0,-165, -47,-165, -47,-4]],
-    ['fontSize' => 50, 'angle' => 90, 'x' => 150, 'y' => 750, 'text' => "~~~~~~~", 'exp' => [-19,-2, -18,-167, -29,-167, -29,-2]],
-    ['fontSize' => 50, 'angle' => 50, 'x' => 210, 'y' => 750, 'text' => "iiiiiiiiiiii", 'exp' => [3,-3, 107,-127, 70,-157, -34,-33]],
-    ['fontSize' => 50, 'angle' => 50, 'x' => 300, 'y' => 750, 'text' => "~~~~~~~", 'exp' => [-13,-13, 93,-141, 85,-147, -21,-20]],
-    ['fontSize' => 50, 'angle' => 0, 'x' => 430, 'y' => 650, 'text' => "iiiiiiiiiiii", 'exp' => [4,0, 165,0, 165,-47, 4,-47]],
-    ['fontSize' => 50, 'angle' => 0, 'x' => 430, 'y' => 750, 'text' => "~~~~~~~", 'exp' => [2,-19, 167,-19, 167,-29, 2,-29]],
-
-    // "Big" test:
-    ['fontSize' => 200, 'angle' => 0, 'x' => 400, 'y' => 500, 'text' => "Big", 'exp' => [16,59, 329,59, 329,-190, 16,-190]],
-];
-
-foreach ($tests as $testnum => $test) {
-    $bbox = imageftbbox($test['fontSize'], $test['angle'], $font, $test['text']);
-	printf('%2d: ', $testnum);
-	for ($i = 0; $i < 8; $i++) {
-		$exp = $test['exp'][$i];
-		if ($bbox[$i] >= $exp - 2 && $bbox[$i] <= $exp + 2) {
-			echo '.';
-		} else {
-			echo "(expected $exp, got $bbox[$i])";
-		}
-	}
-	echo "\n";
-
-    $bboxDrawn = imagefttext($g, $test['fontSize'], $test['angle'],
-        $test['x'], $test['y'], $black, $font, $test['text']);
-
-    // check if both bboxes match when adding x/y offset:
-    for ($i = 0; $i < count($bbox); $i += 2) {
-        if ($bbox[$i] + $test['x'] !== $bboxDrawn[$i]) echo "imageftbbox and imagefttext differ!\n";
-        if ($bbox[$i + 1] + $test['y'] !== $bboxDrawn[$i + 1]) echo "imageftbbox and imagefttext differ!\n";
-    }
-
-    // draw bounding box:
-    imagepolygon($g, $bboxDrawn, 4, $red);
-
-    // draw baseline:
-    $width = sqrt(pow($bboxDrawn[2] - $bboxDrawn[0], 2) + pow($bboxDrawn[3] - $bboxDrawn[1], 2));
-    imageline($g, $test['x'], $test['y'],
-        $test['x'] + $width * cos(deg2rad($test['angle'])),
-        $test['y'] - $width * sin(deg2rad($test['angle'])), $blue);
-}
-
-imagepng($g, "$cwd/bug53504.png");
-?>
--CLEAN--
-<?php @unlink(dirname(__FILE__) . '/bug53504.png'); ?>
--EXPECT--
- 0: ........
- 1: ........
- 2: ........
- 3: ........
- 4: ........
- 5: ........
- 6: ........
- 7: ........
- 8: ........
- 9: ........
-10: ........
-11: ........
-12: ........
-13: ........
-14: ........
-15: ........
-16: ........
-17: ........
-18: ........
@@ -3,9 +3,6 @@ Bug #53640 (XBM images require width to be multiple of 8)
 --SKIPIF--
 <?php
 if (!extension_loaded('gd')) die('skip gd extension not available');
-if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.3', '<')) {
-    die("skip test requires GD 2.2.3 or higher");
-}
 ?>
 --FILE--
 <?php
@@ -3,9 +3,6 @@ Bug #64641 (imagefilledpolygon doesn't draw horizontal line)
 --SKIPIF--
 <?php
 if (!extension_loaded('gd')) die("skip gd extension not available\n");
-if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.2', '<')) {
-	die("skip test requires GD 2.2.2 or higher");
-}
 ?>
 --FILE--
 <?php
@@ -1,34 +0,0 @@
--TEST--
-Bug #66005 (imagecopy does not support 1bit transparency on truecolor images)
--SKIPIF--
-<?php
-if (!extension_loaded('gd')) die('skip gd extension not available');
-?>
--FILE--
-<?php
-$dest = imagecreatetruecolor(150, 50);
-$transparent = imagecolorallocatealpha($dest, 255, 255, 255, 127);
-imagealphablending($dest, false);
-imagefill($dest, 1, 1, $transparent);
-imagesavealpha($dest, true);
-
-// Palette image with transparent color
-$png_palette = imagecreatefromstring(base64_decode('iVBORw0KGgoAAAANSUhEUgAAADIAAAAyAgMAAABjUWAiAAAACVBMVEUAAAD/AAD///9nGWQeAAAAAXRSTlMAQObYZgAAAEFJREFUKM9jYBimIASZIxoagOAwhoaGInisQJ4DksJQJKWoPCAnNIQYHsgChBX4eMSbiddlqH5A9R+q39HCZWgDAFxFGyOrmguhAAAAAElFTkSuQmCCPHP'));
-
-// 24 bit with transparent color
-$png_24 = imagecreatefromstring(base64_decode('iVBORw0KGgoAAAANSUhEUgAAADIAAAAyCAIAAACRXR/mAAAABnRSTlMAAAAAAABupgeRAAAAVklEQVRYw+3UQQqAMBAEwf3/p9eTBxEPiWAmWMU8oGFJqgAAuOpzWTX3xQUti+uRJTZ9V5aY1bOTFZLV7yZr9zt6ibv/qPXfrMpsGipbIy7oqQ8AYJED1plDy5PCu2sAAAAASUVORK5CYII='));
-
-// 32 bit with full alpha channel
-$png_full = imagecreatefromstring(base64_decode('iVBORw0KGgoAAAANSUhEUgAAADIAAAAyCAYAAAAeP4ixAAAAXklEQVRo3u3XMQrAIBBFwb3/pU2VwiJNIvjdzMD2PlBwqwAAAGajatxz9OGf5viA+KA3EXExXyKiYlqErIiIiBGSFLIyYmuMkO7Xy2MX4ovS/ONoH7Eh/m1nBwCASBe3VYeVaAy8PwAAAABJRU5ErkJggg=='));
-
-imagecopy($dest, $png_palette, 0, 0, 0, 0, 50, 50);
-imagecopy($dest, $png_24, 50, 0, 0, 0, 50, 50);
-imagecopy($dest, $png_full, 100, 0, 0, 0, 50, 50);
-
-include_once __DIR__ . '/func.inc';
-test_image_equals_file(__DIR__ . '/bug66005.png', $dest);
-?>
-==DONE==
--EXPECT--
-The images are equal.
-==DONE==
@@ -3,9 +3,6 @@ Bug #66387 (Stack overflow with imagefilltoborder)
 --SKIPIF--
 <?php
 if (!extension_loaded('gd')) die('skip gd extension not available!');
-if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.1', '<')) {
-    die("skip test requires GD 2.2.1 or higher");
-}
 ?>
 --FILE--
 <?php
@@ -3,9 +3,6 @@ Bug #66590 (imagewebp() doesn't pad to even length)
 --SKIPIF--
 <?php
 if (!extension_loaded('gd')) die('skip gd extension not available');
-if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.0', '<')) {
-    die("skip test requires GD 2.2.0 or higher");
-}
 if (!function_exists('imagewebp')) die('skip WebP support not available');
 ?>
 --FILE--
@@ -1,32 +0,0 @@
--TEST--
-Bug #67325 (imagetruecolortopalette: white is duplicated in palette)
--SKIPIF--
-<?php
-if (!extension_loaded('gd')) die('skip gd extension not available');
-if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.3', '<=')) {
-    die("skip test requires newer than GD 2.2.3");
-}
- if (!(imagetypes() & IMG_JPG)) die('skip JPEG support not available');
-?>
--FILE--
-<?php
-$filename = __DIR__ . DIRECTORY_SEPARATOR . 'bug67325.jpeg';
-
-$im = imagecreatefromjpeg($filename);
-imagetruecolortopalette($im, 0, 256);
-
-$white = 0;
-for ($i = 0; $i < 256; $i++) {
-    $components = imagecolorsforindex($im, $i);
-    if ($components['red'] === 255 && $components['green'] === 255 && $components['blue'] === 255) {
-        $white++;
-    }
-}
-var_dump($white);
-
-imagedestroy($im);
-?>
-===DONE===
--EXPECT--
-int(0)
-===DONE===
@@ -1,11 +1,5 @@
 --TEST--
 Bug #67447 (imagecrop() adds a black line when cropping)
--SKIPIF--
-<?php
-	if (!extension_loaded('gd')) {
-		die("skip gd extension not available\n");
-	}
-?>
 --FILE--
 <?php
 // true color
@@ -23,19 +17,10 @@ imagecolorallocate($image, 0, 0, 255); // first palette color = background
 $red = imagecolorallocate($image, 255, 0, 0);
 imagefill($image, 0, 0, $red);
 $cropped = imagecrop($image, ['x' => 0, 'y' => 0, 'width' => 250, 'height' => 250]);
-var_dump(imagecolorsforindex($cropped, imagecolorat($cropped, 249, 249)));
+var_dump(imagecolorat($cropped, 249, 249) === $red);
 imagedestroy($image);
 imagedestroy($cropped);
 ?>
 --EXPECT--
 bool(true)
-array(4) {
-  ["red"]=>
-  int(255)
-  ["green"]=>
-  int(0)
-  ["blue"]=>
-  int(0)
-  ["alpha"]=>
-  int(0)
-}
+bool(true)
@@ -3,9 +3,6 @@ Bug #70102 (imagecreatefromwebm() shifts colors)
 --SKIPIF--
 <?php
 if (!extension_loaded('gd')) die('skip gd extension not available');
-if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.0', '<')) {
-    die("skip test requires GD 2.2.0 or higher");
-}
 if (!function_exists('imagewebp') || !function_exists('imagecreatefromwebp'))
    die('skip WebP support not available');
 ?>
@@ -3,9 +3,6 @@ Bug #71912 (libgd: signedness vulnerability)
 --SKIPIF--
 <?php
        if(!extension_loaded('gd')){ die('skip gd extension not available'); }
-        if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.0', '<')) {
-            die("skip test requires GD 2.2.0 or higher");
-        }
        if(!function_exists('imagecreatefromgd2')) die('skip imagecreatefromgd2() not available');
 ?>
 --FILE--
@@ -1,12 +1,7 @@
 --TEST--
 Bug #72339 Integer Overflow in _gd2GetHeader() resulting in heap overflow 
 --SKIPIF--
-<?php
-if (!function_exists("imagecreatefromgd2")) print "skip";
-if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.2', '<')) {
-	die("skip test requires GD 2.2.2 or higher");
-}
-?>
+<?php if (!function_exists("imagecreatefromgd2")) print "skip"; ?>
 --FILE--
 <?php
 $fname = dirname(__FILE__) . DIRECTORY_SEPARATOR . "bug72339.gd";
@@ -1,15 +0,0 @@
--TEST--
-Bug #72494 (imagecropauto out-of-bounds access)
--SKIPIF--
-<?php
-if (!extension_loaded('gd')) die('skip gd extension not available');
-?>
--FILE--
-<?php
-$im = imagecreate(10,10);
-imagecropauto($im, IMG_CROP_THRESHOLD, 0, 1337);
-?>
-===DONE===
--EXPECTF--
-Warning: imagecropauto(): Color argument missing with threshold mode in %s on line %d
-===DONE===
@@ -3,9 +3,6 @@ Bug #19366 (gdimagefill() function crashes (fixed in bundled libgd))
 --SKIPIF--
 <?php
 	if (!extension_loaded('gd')) die("skip gd extension not available\n");
-	if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.2', '<')) {
-		die("skip test requires GD 2.2.2 or higher");
-	}
 ?>
 --FILE--
 <?php
@@ -3,9 +3,6 @@ Bug #72512 gdImageTrueColorToPaletteBody allows arbitrary write/read access, var
 --SKIPIF--
 <?php
 	if (!extension_loaded('gd')) die("skip gd extension not available\n");
-	if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.2', '<')) {
-		die("skip test requires GD 2.2.2 or higher");
-	}
 ?>
 --FILE--
 <?php
@@ -3,9 +3,6 @@ Bug #72512 gdImageTrueColorToPaletteBody allows arbitrary write/read access, var
 --SKIPIF--
 <?php
 	if (!extension_loaded('gd')) die("skip gd extension not available\n");
-	if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.2', '<')) {
-		die("skip test requires GD 2.2.2 or higher");
-	}
 ?>
 --FILE--
 <?php
@@ -10,9 +10,10 @@ if (!(imagetypes() & IMG_PNG)) die('skip requires PNG support');
 $im = imagecreatetruecolor(100, 100);
 imagesetthickness($im, 5);
 imagearc($im, 50, 50, 90, 90, 0, 360, 0xffffff);
-
-include_once __DIR__ . '/func.inc';
-test_image_equals_file(__DIR__ . '/bug72604.png', $im);
+ob_start();
+imagepng($im);
+$imagestring = ob_get_clean();
+echo md5($imagestring);
 ?>
 --EXPECT--
-The images are equal.
+2ffa6afb915afbdf870cf6459477bc8a
@@ -1,28 +0,0 @@
--TEST--
-Bug #72913 (imagecopy() loses single-color transparency on palette images)
--SKIPIF--
-<?php
-if (!extension_loaded('gd')) die('skip gd extension not available');
-?>
--FILE--
-<?php
-$base64 = 'iVBORw0KGgoAAAANSUhEUgAAADIAAAAyCAIAAACRXR/mAAAABnRSTlMAAAAAAABu'
-    . 'pgeRAAAAVklEQVRYw+3UQQqAMBAEwf3/p9eTBxEPiWAmWMU8oGFJqgAAuOpzWTX3'
-    . 'xQUti+uRJTZ9V5aY1bOTFZLV7yZr9zt6ibv/qPXfrMpsGipbIy7oqQ8AYJED1plD'
-    . 'y5PCu2sAAAAASUVORK5CYII=';
-$src = imagecreatefromstring(base64_decode($base64));
-
-$dst = imagecreate(50, 50);
-$transparent = imagecolorallocatealpha($dst, 255, 255, 255, 127);
-imagealphablending($dst, false);
-imagesavealpha($dst, true);
-
-imagecopy($dst, $src, 0,0, 0,0, 50,50);
-
-include_once __DIR__ . '/func.inc';
-test_image_equals_file(__DIR__ . '/bug72913.png', $dst);
-?>
-==DONE==
--EXPECT--
-The images are equal.
-==DONE==
@@ -1,28 +0,0 @@
--TEST--
-Bug #73155 (imagegd2() writes wrong chunk sizes on boundaries)
--SKIPIF--
-<?php
-if (!extension_loaded('gd')) die('skip gd extension not available');
-?>
--FILE--
-<?php
-$im = imagecreate(64, 64);
-imagecolorallocate($im, 0, 0, 0);
-
-ob_start();
-imagegd2($im, null, 64, IMG_GD2_RAW);
-$buffer = ob_get_clean();
-
-$header = unpack('@10/nchunk_size/nformat/nx_count/ny_count', $buffer);
-printf("chunk size: %d\n", $header['chunk_size']);
-printf("x chunk count: %d\n", $header['x_count']);
-printf("y chunk count: %d\n", $header['y_count']);
-printf("file size: %d\n", strlen($buffer));
-?>
-===DONE===
--EXPECT--
-chunk size: 64
-x chunk count: 1
-y chunk count: 1
-file size: 5145
-===DONE===
@@ -1,22 +0,0 @@
--TEST--
-Bug #73157 (imagegd2() ignores 3rd param if 4 are given)
--SKIPIF--
-<?php
-if (!extension_loaded('gd')) die('skip gd extension not available');
-?>
--FILE--
-<?php
-$im = imagecreate(8, 8);
-imagecolorallocate($im, 0, 0, 0);
-
-ob_start();
-imagegd2($im, null, 256, IMG_GD2_RAW);
-$buffer = ob_get_clean();
-
-$header = unpack('@10/nchunk_size', $buffer);
-printf("chunk size: %d\n", $header['chunk_size']);
-?>
-===DONE===
--EXPECT--
-chunk size: 256
-===DONE===
@@ -1,21 +0,0 @@
--TEST--
-Bug #73159 (imagegd2(): unrecognized formats may result in corrupted files)
--SKIPIF--
-<?php
-if (!extension_loaded('gd')) die('skip gd extension not available');
-?>
--FILE--
-<?php
-$im = imagecreatetruecolor(10, 10);
-
-ob_start();
-imagegd2($im, null, 128, 0);
-$buffer = ob_get_clean();
-
-$header = unpack('@12/nformat', $buffer);
-printf("format: %d\n", $header['format']);
-?>
-===DONE===
--EXPECT--
-format: 4
-===DONE===
Author	SHA1	Message	Date
Ferenc Kovacs	e37064dae4	5.6.25	2016-08-18 13:07:46 +02:00
Stanislav Malyshev	4eb3ecbccf	BLock test with memory leak	2016-08-18 12:54:07 +02:00
Stanislav Malyshev	64e4b276bd	fix tests	2016-08-18 12:54:00 +02:00
Stanislav Malyshev	f01446dacf	Fix TSRM build	2016-08-18 12:53:53 +02:00
Stanislav Malyshev	c35e4cb20c	Fix bug #72850 - integer overflow in uuencode	2016-08-18 12:53:47 +02:00
Stanislav Malyshev	dc223e524d	Fixed bug #72849 - integer overflow in urlencode	2016-08-18 12:53:39 +02:00
Stanislav Malyshev	444314a291	Fix bug #72848 - integer overflow in quoted_printable_encode caused heap corruption	2016-08-18 12:53:28 +02:00
Stanislav Malyshev	6ba48cff6c	Fix bug #72838 - Integer overflow lead to heap corruption in sql_regcase	2016-08-18 12:53:18 +02:00
Stanislav Malyshev	69236ea979	Fix bug #72837 - integer overflow in bzdecompress caused heap corruption	2016-08-18 12:53:07 +02:00
Stanislav Malyshev	f973877a2f	Fix bug #72836 - integer overflow in base64_decode caused heap corruption	2016-08-18 12:52:59 +02:00
Stanislav Malyshev	791a98eb1c	Fix for bug #72807 - do not produce strings with negative length	2016-08-18 12:52:45 +02:00
Stanislav Malyshev	1f6078e4a5	Fix for bug #72790 and bug #72799	2016-08-18 12:52:39 +02:00
Stanislav Malyshev	229782c0ad	Fix bug #72730 - imagegammacorrect allows arbitrary write access	2016-08-18 12:52:29 +02:00
Stanislav Malyshev	4d76676101	Fix bug#72697 - select_colors write out-of-bounds	2016-08-18 12:52:21 +02:00
Stanislav Malyshev	32a629ef2c	Fixed bug #72627 : Memory Leakage In exif_process_IFD_in_TIFF	2016-08-18 12:52:15 +02:00
Stanislav Malyshev	82b95bb758	Fix bug #72750 : wddx_deserialize null dereference	2016-08-18 12:52:08 +02:00
Stanislav Malyshev	7d5ca3b28d	Fix bug #72771 : ftps:// opendir wrapper is vulnerable to protocol downgrade attack	2016-08-18 12:52:00 +02:00
Stanislav Malyshev	75c0dbdd02	Improve fix for #72663	2016-08-18 12:51:50 +02:00
Stanislav Malyshev	27fe2b42fc	Fix bug #70436 : Use After Free Vulnerability in unserialize()	2016-08-18 12:51:42 +02:00
Stanislav Malyshev	db38282f42	Fix bug #72749 : wddx_deserialize allows illegal memory access	2016-08-18 12:51:27 +02:00
Stanislav Malyshev	b25f44098f	Update comment	2016-08-18 12:51:21 +02:00
Stanislav Malyshev	b9ab6e14ff	Fix bug #72708 - php_snmp_parse_oid integer overflow in memory allocation	2016-08-18 12:51:13 +02:00
Stanislav Malyshev	61156f0d68	Fix bug #72681 - consume data even if we're not storing them	2016-08-18 12:51:06 +02:00
Stanislav Malyshev	c1cfd6a9fe	Fix bug #72663 - destroy broken object when unserializing	2016-08-18 12:50:58 +02:00
Ville Hukkamaki	869c547681	Fix #72764 Negotiate data channel encryption after NLST command. This is to prevent issues with IIS and ProFTPD.	2016-08-18 11:35:37 +02:00
Stanislav Malyshev	9c291f0fa0	Fix bug #72716 - initialize buffer before read	2016-08-18 11:35:24 +02:00
Ferenc Kovacs	58043201f8	#72633 is reverted for now	2016-08-17 00:58:55 +02:00
Ferenc Kovacs	9caabe953a	Revert "- lastInsertId using Postgres Lastval() function" This reverts commit `90c6cbd09b`.	2016-08-17 00:58:15 +02:00
Ferenc Kovacs	cf1f579fcd	Revert "cleanup table after test" This reverts commit `40b3a031b2`.	2016-08-17 00:57:55 +02:00
Ferenc Kovacs	327f538e91	5.6.25RC1	2016-08-04 01:47:14 +02:00