Fixed res leak

Fixed recently introduced memory leak
fix non-standard C
2026-11-11 11:10:49 +00:00 · 2015-04-14 21:16:17 -07:00 · 2015-04-14 11:08:48 -07:00 · 2015-04-14 00:47:38 -07:00 · 2015-04-14 00:30:04 -07:00 · 2015-04-14 00:26:53 -07:00
106 changed files with 1511 additions and 2251 deletions
@@ -1,17 +1,167 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2014, PHP 5.4.34
+16 Apr 2015 PHP 5.4.40

-Fileinfo:
+- Apache2handler:
+  . Fixed bug #69218 (potential remote code execution with apache 2.4
+    apache2handler). (Gerrit Venema)
+
+- Core:
+  . Additional fix for bug #69152 (Type confusion vulnerability in
+    exception::getTraceAsString). (Stas)
+  . Fixed bug #69337 (php_stream_url_wrap_http_ex() type-confusion
+    vulnerability). (Stas)
+  . Fixed bug #69353 (Missing null byte checks for paths in various PHP
+    extensions). (Stas)
+
+- cURL:
+  . Fixed bug #69316 (Use-after-free in php_curl related to
+    CURLOPT_FILE/_INFILE/_WRITEHEADER). (Laruence)
+
+- Ereg:
+  . Fixed bug #68740 (NULL Pointer Dereference). (Laruence)
+
+- Fileinfo:
+  . Fixed bug #68819 (Fileinfo on specific file causes spurious OOM and/or
+    segfault). (Anatol Belski)
+
+- GD:
+  . Fixed bug #68601 (buffer read overflow in gd_gif_in.c). (Remi)
+
+- Phar:
+  . Fixed bug #68901 (use after free). (bugreports at internot dot info)
+  . Fixed bug #69324 (Buffer Over-read in unserialize when parsing Phar). (Stas)
+  . Fixed bug #69441 (Buffer Overflow when parsing tar/zip/phar in
+    phar_set_inode). (Stas)
+
+- Postgres:
+  . Fixed bug #68741 (Null pointer deference) (CVE-2015-1352). (Xinchen Hui)
+
+- SOAP:
+  . Fixed bug #69152 (Type Confusion Infoleak Vulnerability in unserialize()
+    with SoapFault). (Dmitry)
+
+- Sqlite3:
+  . Fixed bug #66550 (SQLite prepared statement use-after-free). (Sean Heelan)
+
+19 Mar 2015 PHP 5.4.39
+
+- Core:
+  . Fixed bug #68976 (Use After Free Vulnerability in unserialize())
+    (CVE-2015-2787). (Stas)
+  . Fixed bug #69134 (Per Directory Values overrides PHP_INI_SYSTEM
+    configuration options). (Anatol Belski)
+  . Fixed bug #69207 (move_uploaded_file allows nulls in path). (Stas)
+
+- Ereg:
+  . Fixed bug #69248 (heap overflow vulnerability in regcomp.c) (CVE-2015-2305).
+    (Stas)
+
+- SOAP:
+  . Fixed bug #69085 (SoapClient's __call() type confusion through
+    unserialize()). (Dmitry)
+
+- ZIP:
+  . Fixed bug #69253 (ZIP Integer Overflow leads to writing past heap
+    boundary) (CVE-2015-2331). (Stas)
+
+19 Feb 2015 PHP 5.4.38
+
+- Core:
+  . Removed support for multi-line headers, as the are deprecated by RFC 7230.
+    (Stas)
+  . Added NULL byte protection to exec, system and passthru. (Yasuo)
+  . Fixed bug #68925 (Mitigation for CVE-2015-0235 – GHOST: glibc gethostbyname
+    buffer overflow). (Stas)
+  . Fixed bug #67827 (broken detection of system crypt sha256/sha512 support).
+    (ncopa at alpinelinux dot org)  
+  . Fixed bug #68942 (Use after free vulnerability in unserialize() with
+    DateTimeZone). (CVE-2015-0273) (Stas)
+  
+- Enchant: 
+  . Fixed bug #68552 (heap buffer overflow in enchant_broker_request_dict()).
+    (Antony)
+
+- SOAP:
+  . Fixed bug #67427 (SoapServer cannot handle large messages)
+    (brandt at docoloc dot de)
+
+22 Jan 2015 PHP 5.4.37
+- Core:
+  . Fixed bug #68710 (Use After Free Vulnerability in PHP's unserialize()).
+    (CVE-2015-0231) (Stefan Esser)
+
+- CGI:
+  . Fixed bug #68618 (out of bounds read crashes php-cgi). (CVE-2014-9427)
+    (Stas)
+
+- EXIF:
+  . Fixed bug #68799: Free called on unitialized pointer. (CVE-2015-0232) 
+    (Stas)
+
+- Fileinfo:
+  . Removed readelf.c and related code from libmagic sources
+    (Remi, Anatol)
+  . Fixed bug #68735 (fileinfo out-of-bounds memory access).
+    (Anatol)
+
+- OpenSSL:
+  . Fixed bug #55618 (use case-insensitive cert name matching).
+    (Daniel Lowrey)
+
+18 Dec 2014 PHP 5.4.36
+
+- Core:
+  . Upgraded crypt_blowfish to version 1.3. (Leigh)
+  . Fixed bug #68545 (NULL pointer dereference in unserialize.c). (Anatol)
+  . Fixed bug #68594 (Use after free vulnerability in unserialize()).
+    (CVE-2014-8142) (Stefan Esser)
+
+- Mcrypt:
+  . Fixed possible read after end of buffer and use after free. (Dmitry)
+
+13 Nov 2014 PHP 5.4.35
+
+- Core:
+  . Fixed bug #68365 (zend_mm_heap corrupted after memory overflow in
+    zend_hash_copy). (Dmitry)
+
+- Fileinfo:
+  . Fixed bug #68283 (fileinfo: out-of-bounds read in elf note headers).
+    (CVE-2014-3710) (Remi)
+
+- GMP:
+ . Fixed bug #63595 (GMP memory management conflicts with other libraries
+   using GMP). (Remi)
+
+- PDO_pgsql:
+  . Fixed bug #66584 (Segmentation fault on statement deallocation) (Matteo)
+
+16 Oct 2014, PHP 5.4.34
+
+- Fileinfo:
  . Fixed bug #66242 (libmagic: don't assume char is signed). (ArdB)

 - Core:
  . Fixed bug #67985 (Incorrect last used array index copied to new array after
    unset). (Tjerk)
+  . Fixed bug #68044 (Integer overflow in unserialize() (32-bits only)). 
+    (CVE-2014-3669) (Stas)
+
+- cURL:
+  . Fixed bug #68089 (NULL byte injection - cURL lib). (Stas)
+
+- EXIF:
+  . Fixed bug #68113 (Heap corruption in exif_thumbnail()). (CVE-2014-3670)
+    (Stas)

 - OpenSSL:
  . Reverted fixes for bug #41631, due to regressions. (Stas) 

+- XMLRPC:
+  . Fixed bug #68027 (Global buffer overflow in mkgmtime() function). 
+    (CVE-2014-3668) (Stas)
+
 18 Sep 2014, PHP 5.4.33

 - Core:
@@ -58,6 +208,9 @@ PHP                                                                        NEWS
  . Fixed bug #67730 (Null byte injection possible with imagexxx functions).
    (CVE-2014-5120) (Ryan Mauger)

+- LiteSpeed:
+  . Updated LiteSpeed SAPI code from V5.5 to V6.6 (George Wang)
+
 - Network:
  . Fixed bug #67717 (segfault in dns_get_record). (CVE-2014-3597) (Remi)

@@ -183,11 +183,11 @@ last commit id to web/php.git, then, mirrors will now sync
 Getting the stable release announced
 ------------------------------------

-1. Run the bumpRelease script for phpweb on your local checkout
+1. Update phpweb/include/releases.inc with the old release info
+  (updates the download archives)

- a. ``php bin/bumpRelease 5`` to create the release file (releases/x_y_z.php)
-    The release announcement file should list in detail security fixes and
-    changes in behavior (whether due to a bug fix or not).
+ a. You can run ``php bin/bumpRelease 5`` if you are making a release for the
+    highest branch, otherwise you have to do this manually, see point 1.b

 b. In case multiple PHP minor versions are in active development you have
    to manually copy the old information to include/releases.inc
@@ -207,8 +207,9 @@ Getting the stable release announced

 f. if the windows builds aren't ready yet prefix the "windows" key with a dot (".windows")

-3. Update phpweb/include/releases.php with the old release info
-  (updates the download archives)
+3. Create the release file (releases/x_y_z.php)
+   Usually we use the same content as for point 6, but included in php template
+   instead of the release xml.

 4. Update php-qa/include/release-qa.php and add the next version as an QARELEASE
   (prepare for next RC)
@@ -587,10 +587,14 @@ ZEND_METHOD(exception, getTraceAsString)

 	DEFAULT_0_PARAMS;
 	
+	trace = zend_read_property(default_exception_ce, getThis(), "trace", sizeof("trace")-1, 1 TSRMLS_CC);
+	if(Z_TYPE_P(trace) != IS_ARRAY) {
+		RETURN_FALSE;
+	}
+
 	res = estrdup("");
 	str = &res;

-	trace = zend_read_property(default_exception_ce, getThis(), "trace", sizeof("trace")-1, 1 TSRMLS_CC);
 	zend_hash_apply_with_arguments(Z_ARRVAL_P(trace) TSRMLS_CC, (apply_func_args_t)_build_trace_string, 3, str, len, &num);

 	s_tmp = emalloc(1 + MAX_LENGTH_OF_LONG + 7 + 1);
@@ -135,9 +135,9 @@ ZEND_API void _zval_copy_ctor_func(zval *zvalue ZEND_FILE_LINE_DC)
 				}
 				ALLOC_HASHTABLE_REL(tmp_ht);
 				zend_hash_init(tmp_ht, zend_hash_num_elements(original_ht), NULL, ZVAL_PTR_DTOR, 0);
+				zvalue->value.ht = tmp_ht;
 				zend_hash_copy(tmp_ht, original_ht, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
 				tmp_ht->nNextFreeElement = original_ht->nNextFreeElement;
-				zvalue->value.ht = tmp_ht;
 			}
 			break;
 		case IS_OBJECT:
@@ -119,8 +119,8 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=4
-PHP_RELEASE_VERSION=34
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=40
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -10,7 +10,7 @@
   | http://www.php.net/license/3_01.txt                                  |
   | If you did not receive a copy of the PHP license and are unable to   |
   | obtain it through the world-wide-web, please send a note to          |
-   | license@php.net so we can mail you 6 copy immediately.               |
+   | license@php.net so we can mail you a copy immediately.               |
   +----------------------------------------------------------------------+
   | Author: Sterling Hughes <sterling@php.net>                           |
   +----------------------------------------------------------------------+
@@ -170,6 +170,12 @@ static int php_curl_option_url(php_curl *ch, const char *url, const int len TSRM
 #if LIBCURL_VERSION_NUM < 0x071100
 	char *copystr = NULL;
 #endif
+
+	if (strlen(url) != len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Curl option contains invalid characters (\\0)");
+		return 0;
+	}
+
 	/* Disable file:// if open_basedir are used */
 	if (PG(open_basedir) && *PG(open_basedir)) {
 #if LIBCURL_VERSION_NUM >= 0x071304
@@ -1045,6 +1051,7 @@ static size_t curl_write(char *data, size_t size, size_t nmemb, void *ctx)
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not call the CURLOPT_WRITEFUNCTION");
 				length = -1;
 			} else if (retval_ptr) {
+				_php_curl_verify_handlers(ch, 1 TSRMLS_CC);
 				if (Z_TYPE_P(retval_ptr) != IS_LONG) {
 					convert_to_long_ex(&retval_ptr);
 				}
@@ -1118,6 +1125,7 @@ static size_t curl_progress(void *clientp, double dltotal, double dlnow, double
 			if (error == FAILURE) {
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot call the CURLOPT_PROGRESSFUNCTION");
 			} else if (retval_ptr) {
+				_php_curl_verify_handlers(ch, 1 TSRMLS_CC);
 				if (Z_TYPE_P(retval_ptr) != IS_LONG) {
 					convert_to_long_ex(&retval_ptr);
 				}
@@ -1194,6 +1202,7 @@ static size_t curl_read(char *data, size_t size, size_t nmemb, void *ctx)
 				length = CURL_READFUNC_ABORT;
 #endif
 			} else if (retval_ptr) {
+				_php_curl_verify_handlers(ch, 1 TSRMLS_CC);
 				if (Z_TYPE_P(retval_ptr) == IS_STRING) {
 					length = MIN((int) (size * nmemb), Z_STRLEN_P(retval_ptr));
 					memcpy(data, Z_STRVAL_P(retval_ptr), length);
@@ -1268,6 +1277,7 @@ static size_t curl_write_header(char *data, size_t size, size_t nmemb, void *ctx
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not call the CURLOPT_HEADERFUNCTION");
 				length = -1;
 			} else if (retval_ptr) {
+				_php_curl_verify_handlers(ch, 1 TSRMLS_CC);
 				if (Z_TYPE_P(retval_ptr) != IS_LONG) {
 					convert_to_long_ex(&retval_ptr);
 				}
@@ -0,0 +1,18 @@
+--TEST--
+Bug #68089 (NULL byte injection - cURL lib)
+--SKIPIF--
+<?php 
+include 'skipif.inc';
+
+?>
+--FILE--
+<?php
+$url = "file:///etc/passwd\0http://google.com";
+$ch = curl_init();
+var_dump(curl_setopt($ch, CURLOPT_URL, $url));
+?>
+Done
+--EXPECTF--
+Warning: curl_setopt(): Curl option contains invalid characters (\0) in %s/bug68089.php on line 4
+bool(false)
+Done
@@ -0,0 +1,41 @@
+--TEST--
+Bug #69316: Use-after-free in php_curl related to CURLOPT_FILE/_INFILE/_WRITEHEADER
+--SKIPIF--
+<?php 
+if (!extension_loaded("curl")) exit("skip curl extension not loaded");
+if (false === getenv('PHP_CURL_HTTP_REMOTE_SERVER'))  exit("skip PHP_CURL_HTTP_REMOTE_SERVER env variable is not defined");
+?>
+--FILE--
+<?php
+  function hdr_callback($ch, $data) {
+      // close the stream, causing the FILE structure to be free()'d
+      if($GLOBALS['f_file']) {
+          fclose($GLOBALS['f_file']); $GLOBALS['f_file'] = 0;
+
+          // cause an allocation of approx the same size as a FILE structure, size varies a bit depending on platform/libc
+          $FILE_size = (PHP_INT_SIZE == 4 ? 0x160 : 0x238);
+          curl_setopt($ch, CURLOPT_COOKIE, str_repeat("a", $FILE_size - 1));
+      }
+      return strlen($data);
+  }
+  $host = getenv('PHP_CURL_HTTP_REMOTE_SERVER');
+  
+  $temp_file = dirname(__FILE__) . '/body.tmp';
+  $url = "{$host}/get.php?test=getpost";
+  $ch = curl_init();
+  $f_file = fopen($temp_file, "w") or die("failed to open file\n");
+  curl_setopt($ch, CURLOPT_BUFFERSIZE, 10);
+  curl_setopt($ch, CURLOPT_HEADERFUNCTION, "hdr_callback");
+  curl_setopt($ch, CURLOPT_FILE, $f_file);
+  curl_setopt($ch, CURLOPT_URL, $url);
+  curl_exec($ch);
+  curl_close($ch);
+?>
+===DONE===
+--CLEAN--
+<?php
+unlink(dirname(__FILE__) . '/body.tmp');
+?>
+--EXPECTF--
+Warning: curl_exec(): CURLOPT_FILE resource has gone away, resetting to default in %s on line %d
+===DONE===
@@ -0,0 +1,7 @@
+<?php
+    if (!extension_loaded("curl")) exit("skip curl extension not loaded");
+    if(false === getenv('PHP_CURL_HTTP_REMOTE_SERVER')) {
+        if (php_sapi_name() != "cli") {
+                die("skip PHP_CURL_HTTP_REMOTE_SERVER env variable is not defined");
+        }
+    }
@@ -2575,12 +2575,9 @@ static int php_date_initialize_from_hash(php_date_obj **dateobj, HashTable *myht
 	timelib_tzinfo   *tzi;
 	php_timezone_obj *tzobj;

-	if (zend_hash_find(myht, "date", 5, (void**) &z_date) == SUCCESS) {
-		convert_to_string(*z_date);
-		if (zend_hash_find(myht, "timezone_type", 14, (void**) &z_timezone_type) == SUCCESS) {
-			convert_to_long(*z_timezone_type);
-			if (zend_hash_find(myht, "timezone", 9, (void**) &z_timezone) == SUCCESS) {
-				convert_to_string(*z_timezone);
+	if (zend_hash_find(myht, "date", 5, (void**) &z_date) == SUCCESS && Z_TYPE_PP(z_date) == IS_STRING) {
+		if (zend_hash_find(myht, "timezone_type", 14, (void**) &z_timezone_type) == SUCCESS && Z_TYPE_PP(z_timezone_type) == IS_LONG) {
+			if (zend_hash_find(myht, "timezone", 9, (void**) &z_timezone) == SUCCESS && Z_TYPE_PP(z_timezone) == IS_STRING) {

 				switch (Z_LVAL_PP(z_timezone_type)) {
 					case TIMELIB_ZONETYPE_OFFSET:
@@ -2595,7 +2592,6 @@ static int php_date_initialize_from_hash(php_date_obj **dateobj, HashTable *myht

 					case TIMELIB_ZONETYPE_ID: {
 						int ret;
-						convert_to_string(*z_timezone);

 						tzi = php_date_parse_tzfile(Z_STRVAL_PP(z_timezone), DATE_TIMEZONEDB TSRMLS_CC);

@@ -0,0 +1,9 @@
+--TEST--
+Bug #68942 (Use after free vulnerability in unserialize() with DateTime).
+--FILE--
+<?php
+$data = unserialize('a:2:{i:0;O:8:"DateTime":3:{s:4:"date";s:26:"2000-01-01 00:00:00.000000";s:13:"timezone_type";a:2:{i:0;i:1;i:1;i:2;}s:8:"timezone";s:1:"A";}i:1;R:5;}');
+var_dump($data);
+?>
+--EXPECTF--
+Fatal error: Invalid serialization data for DateTime object in %s/bug68942_2.php on line %d
@@ -187,10 +187,10 @@ ZEND_END_ARG_INFO();
 /* }}} */

 /*
-* class DOMDocument extends DOMNode 
+* class DOMDocument extends DOMNode
 *
 * URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-i-Document
-* Since: 
+* Since:
 */

 const zend_function_entry php_dom_document_class_functions[] = { /* {{{ */
@@ -235,10 +235,10 @@ const zend_function_entry php_dom_document_class_functions[] = { /* {{{ */
 };
 /* }}} */

-/* {{{ docType	DOMDocumentType	
-readonly=yes 
+/* {{{ docType	DOMDocumentType
+readonly=yes
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-B63ED1A31
-Since: 
+Since:
 */
 int dom_document_doctype_read(dom_object *obj, zval **retval TSRMLS_DC)
 {
@@ -266,15 +266,15 @@ int dom_document_doctype_read(dom_object *obj, zval **retval TSRMLS_DC)
 		return FAILURE;
 	}
 	return SUCCESS;
-	
+
 }

 /* }}} */

-/* {{{ implementation	DOMImplementation	
-readonly=yes 
+/* {{{ implementation	DOMImplementation
+readonly=yes
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-1B793EBA
-Since: 
+Since:
 */
 int dom_document_implementation_read(dom_object *obj, zval **retval TSRMLS_DC)
 {
@@ -285,10 +285,10 @@ int dom_document_implementation_read(dom_object *obj, zval **retval TSRMLS_DC)

 /* }}} */

-/* {{{ documentElement	DOMElement	
-readonly=yes 
+/* {{{ documentElement	DOMElement
+readonly=yes
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-87CD092
-Since: 
+Since:
 */
 int dom_document_document_element_read(dom_object *obj, zval **retval TSRMLS_DC)
 {
@@ -391,8 +391,8 @@ int dom_document_encoding_write(dom_object *obj, zval *newval TSRMLS_DC)

 /* }}} */

-/* {{{ standalone	boolean	
-readonly=no 
+/* {{{ standalone	boolean
+readonly=no
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-Document3-standalone
 Since: DOM Level 3
 */
@@ -455,7 +455,7 @@ int dom_document_standalone_write(dom_object *obj, zval *newval TSRMLS_DC)

 /* }}} */

-/* {{{ version	string	
+/* {{{ version	string
 readonly=no
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-Document3-version
 Since: DOM Level 3
@@ -520,8 +520,8 @@ int dom_document_version_write(dom_object *obj, zval *newval TSRMLS_DC)

 /* }}} */

-/* {{{ strictErrorChecking	boolean	
-readonly=no 
+/* {{{ strictErrorChecking	boolean
+readonly=no
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-Document3-strictErrorChecking
 Since: DOM Level 3
 */
@@ -565,7 +565,7 @@ int dom_document_strict_error_checking_write(dom_object *obj, zval *newval TSRML

 /* }}} */

-/* {{{ formatOutput	boolean	
+/* {{{ formatOutput	boolean
 readonly=no
 */
 int dom_document_format_output_read(dom_object *obj, zval **retval TSRMLS_DC)
@@ -607,7 +607,7 @@ int dom_document_format_output_write(dom_object *obj, zval *newval TSRMLS_DC)
 }
 /* }}} */

-/* {{{ validateOnParse	boolean	
+/* {{{ validateOnParse	boolean
 readonly=no
 */
 int	dom_document_validate_on_parse_read(dom_object *obj, zval **retval TSRMLS_DC)
@@ -649,7 +649,7 @@ int dom_document_validate_on_parse_write(dom_object *obj, zval *newval TSRMLS_DC
 }
 /* }}} */

-/* {{{ resolveExternals	boolean	
+/* {{{ resolveExternals	boolean
 readonly=no
 */
 int dom_document_resolve_externals_read(dom_object *obj, zval **retval TSRMLS_DC)
@@ -691,7 +691,7 @@ int dom_document_resolve_externals_write(dom_object *obj, zval *newval TSRMLS_DC
 }
 /* }}} */

-/* {{{ preserveWhiteSpace	boolean	
+/* {{{ preserveWhiteSpace	boolean
 readonly=no
 */
 int dom_document_preserve_whitespace_read(dom_object *obj, zval **retval TSRMLS_DC)
@@ -733,7 +733,7 @@ int dom_document_preserve_whitespace_write(dom_object *obj, zval *newval TSRMLS_
 }
 /* }}} */

-/* {{{ recover	boolean	
+/* {{{ recover	boolean
 readonly=no
 */
 int dom_document_recover_read(dom_object *obj, zval **retval TSRMLS_DC)
@@ -775,7 +775,7 @@ int dom_document_recover_write(dom_object *obj, zval *newval TSRMLS_DC)
 }
 /* }}} */

-/* {{{ substituteEntities	boolean	
+/* {{{ substituteEntities	boolean
 readonly=no
 */
 int dom_document_substitue_entities_read(dom_object *obj, zval **retval TSRMLS_DC)
@@ -817,8 +817,8 @@ int dom_document_substitue_entities_write(dom_object *obj, zval *newval TSRMLS_D
 }
 /* }}} */

-/* {{{ documentURI	string	
-readonly=no 
+/* {{{ documentURI	string
+readonly=no
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-Document3-documentURI
 Since: DOM Level 3
 */
@@ -881,8 +881,8 @@ int dom_document_document_uri_write(dom_object *obj, zval *newval TSRMLS_DC)

 /* }}} */

-/* {{{ config	DOMConfiguration	
-readonly=yes 
+/* {{{ config	DOMConfiguration
+readonly=yes
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-Document3-config
 Since: DOM Level 3
 */
@@ -897,7 +897,7 @@ int dom_document_config_read(dom_object *obj, zval **retval TSRMLS_DC)

 /* {{{ proto DOMElement dom_document_create_element(string tagName [, string value]);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-2141741547
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_element)
 {
@@ -930,7 +930,7 @@ PHP_FUNCTION(dom_document_create_element)

 /* {{{ proto DOMDocumentFragment dom_document_create_document_fragment();
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-35CB04B5
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_document_fragment)
 {
@@ -957,7 +957,7 @@ PHP_FUNCTION(dom_document_create_document_fragment)

 /* {{{ proto DOMText dom_document_create_text_node(string data);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-1975348127
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_text_node)
 {
@@ -985,7 +985,7 @@ PHP_FUNCTION(dom_document_create_text_node)

 /* {{{ proto DOMComment dom_document_create_comment(string data);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-1334481328
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_comment)
 {
@@ -1013,7 +1013,7 @@ PHP_FUNCTION(dom_document_create_comment)

 /* {{{ proto DOMCdataSection dom_document_create_cdatasection(string data);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-D26C0AF8
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_cdatasection)
 {
@@ -1041,7 +1041,7 @@ PHP_FUNCTION(dom_document_create_cdatasection)

 /* {{{ proto DOMProcessingInstruction dom_document_create_processing_instruction(string target, string data);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-135944439
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_processing_instruction)
 {
@@ -1076,7 +1076,7 @@ PHP_FUNCTION(dom_document_create_processing_instruction)

 /* {{{ proto DOMAttr dom_document_create_attribute(string name);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-1084891198
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_attribute)
 {
@@ -1110,7 +1110,7 @@ PHP_FUNCTION(dom_document_create_attribute)

 /* {{{ proto DOMEntityReference dom_document_create_entity_reference(string name);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-392B75AE
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_entity_reference)
 {
@@ -1143,7 +1143,7 @@ PHP_FUNCTION(dom_document_create_entity_reference)

 /* {{{ proto DOMNodeList dom_document_get_elements_by_tag_name(string tagname);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-A6C9094
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_get_elements_by_tag_name)
 {
@@ -1177,7 +1177,7 @@ PHP_FUNCTION(dom_document_import_node)
 	xmlDocPtr docp;
 	xmlNodePtr nodep, retnodep;
 	dom_object *intern, *nodeobj;
-	int ret; 
+	int ret;
 	long recursive = 0;

 	if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "OO|l", &id, dom_document_class_entry, &node, dom_node_class_entry, &recursive) == FAILURE) {
@@ -1188,7 +1188,7 @@ PHP_FUNCTION(dom_document_import_node)

 	DOM_GET_OBJ(nodep, node, xmlNodePtr, nodeobj);

-	if (nodep->type == XML_HTML_DOCUMENT_NODE || nodep->type == XML_DOCUMENT_NODE 
+	if (nodep->type == XML_HTML_DOCUMENT_NODE || nodep->type == XML_DOCUMENT_NODE
 		|| nodep->type == XML_DOCUMENT_TYPE_NODE) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot import: Node Type Not Supported");
 		RETURN_FALSE;
@@ -1278,7 +1278,7 @@ PHP_FUNCTION(dom_document_create_element_ns)
 		RETURN_FALSE;
 	}

-	
+
 	nodep->ns = nsptr;

 	DOM_RET_OBJ(nodep, &ret, intern);
@@ -1580,11 +1580,15 @@ static xmlDocPtr dom_document_parser(zval *id, int mode, char *source, int sourc
 	xmlInitParser();

 	if (mode == DOM_LOAD_FILE) {
-		char *file_dest = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN  TSRMLS_CC);
+		char *file_dest;
+		if (CHECK_NULL_PATH(source, source_len)) {
+			return NULL;
+		}
+		file_dest = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN  TSRMLS_CC);
 		if (file_dest) {
 			ctxt = xmlCreateFileParserCtxt(file_dest);
 		}
-		
+
 	} else {
 		ctxt = xmlCreateMemoryParserCtxt(source, source_len);
 	}
@@ -1906,7 +1910,7 @@ PHP_FUNCTION(dom_document_xinclude)
 	zval *id;
 	xmlDoc *docp;
 	xmlNodePtr root;
-	long flags = 0; 
+	long flags = 0;
 	int err;
 	dom_object *intern;

@@ -1919,7 +1923,7 @@ PHP_FUNCTION(dom_document_xinclude)
 	err = xmlXIncludeProcessFlags(docp, flags);

 	/* XML_XINCLUDE_START and XML_XINCLUDE_END nodes need to be removed as these
-	are added via xmlXIncludeProcess to mark beginning and ending of xincluded document 
+	are added via xmlXIncludeProcess to mark beginning and ending of xincluded document
 	but are not wanted in resulting document - must be done even if err as it could fail after
 	having processed some xincludes */
 	root = (xmlNodePtr) docp->children;
@@ -1935,7 +1939,7 @@ PHP_FUNCTION(dom_document_xinclude)
 	} else {
 		RETVAL_FALSE;
 	}
-    
+
 }
 /* }}} */

@@ -1956,19 +1960,19 @@ PHP_FUNCTION(dom_document_validate)
 	DOM_GET_OBJ(docp, id, xmlDocPtr, intern);

 	cvp = xmlNewValidCtxt();
-	
+
 	cvp->userData = NULL;
 	cvp->error    = (xmlValidityErrorFunc) php_libxml_error_handler;
 	cvp->warning  = (xmlValidityErrorFunc) php_libxml_error_handler;
-	
+
 	if (xmlValidateDocument(cvp, docp)) {
 		RETVAL_TRUE;
 	} else {
 		RETVAL_FALSE;
 	}
-	
+
 	xmlFreeValidCtxt(cvp);
-	
+
 }
 /* }}} */

@@ -2008,7 +2012,7 @@ static void _dom_document_schema_validate(INTERNAL_FUNCTION_PARAMETERS, int type
 		break;
 	case DOM_LOAD_STRING:
 		parser = xmlSchemaNewMemParserCtxt(source, source_len);
-		/* If loading from memory, we need to set the base directory for the document 
+		/* If loading from memory, we need to set the base directory for the document
 		   but it is not apparent how to do that for schema's */
 		break;
 	default:
@@ -2097,7 +2101,7 @@ static void _dom_document_relaxNG_validate(INTERNAL_FUNCTION_PARAMETERS, int typ
 		break;
 	case DOM_LOAD_STRING:
 		parser = xmlRelaxNGNewMemParserCtxt(source, source_len);
-		/* If loading from memory, we need to set the base directory for the document 
+		/* If loading from memory, we need to set the base directory for the document
 		   but it is not apparent how to do that for schema's */
 		break;
 	default:
@@ -2165,10 +2169,10 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */
 	int source_len, refcount, ret;
 	long options = 0;
 	htmlParserCtxtPtr ctxt;
-	
+
 	id = getThis();

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|l", &source, &source_len, &options) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|l", &source, &source_len, &options) == FAILURE) {
 		return;
 	}

@@ -2201,7 +2205,7 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */
 	htmlParseDocument(ctxt);
 	newdoc = ctxt->myDoc;
 	htmlFreeParserCtxt(ctxt);
-	
+
 	if (!newdoc)
 		RETURN_FALSE;

@@ -2323,13 +2327,13 @@ PHP_FUNCTION(dom_document_save_html)
 			php_dom_throw_error(WRONG_DOCUMENT_ERR, dom_get_strict_error(intern->document) TSRMLS_CC);
 			RETURN_FALSE;
 		}
-		
+
 		buf = xmlBufferCreate();
 		if (!buf) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not fetch buffer");
 			RETURN_FALSE;
 		}
-		
+
 		if (node->type == XML_DOCUMENT_FRAG_NODE) {
 			int one_size;

@@ -13,6 +13,11 @@ assert.bail=true
 $doc = new DOMDocument();
 $result = $doc->loadHTMLFile("");
 assert('$result === false');
+$doc = new DOMDocument();
+$result = $doc->loadHTMLFile("text.html\0something");
+assert('$result === null');
 ?>
 --EXPECTF--
 %r(PHP ){0,1}%rWarning: DOMDocument::loadHTMLFile(): Empty string supplied as input %s
+
+%r(PHP ){0,1}%rWarning: DOMDocument::loadHTMLFile() expects parameter 1 to be a valid path, string given %s
@@ -550,13 +550,12 @@ PHP_FUNCTION(enchant_broker_request_dict)

 	d = enchant_broker_request_dict(pbroker->pbroker, (const char *)tag);
 	if (d) {
+		pos = pbroker->dictcnt++;
 		if (pbroker->dictcnt) {
 			pbroker->dict = (enchant_dict **)erealloc(pbroker->dict, sizeof(enchant_dict *) * pbroker->dictcnt);
-			pos = pbroker->dictcnt++;
 		} else {
 			pbroker->dict = (enchant_dict **)emalloc(sizeof(enchant_dict *));
 			pos = 0;
-			pbroker->dictcnt++;
 		}

 		dict = pbroker->dict[pos] = (enchant_dict *)emalloc(sizeof(enchant_dict));
@@ -607,14 +606,14 @@ PHP_FUNCTION(enchant_broker_request_pwl_dict)

 	d = enchant_broker_request_pwl_dict(pbroker->pbroker, (const char *)pwl);
 	if (d) {
+		pos = pbroker->dictcnt++;
 		if (pbroker->dictcnt) {
-			pos = pbroker->dictcnt++;
 			pbroker->dict = (enchant_dict **)erealloc(pbroker->dict, sizeof(enchant_dict *) * pbroker->dictcnt);
 		} else {
 			pbroker->dict = (enchant_dict **)emalloc(sizeof(enchant_dict *));
 			pos = 0;
-			pbroker->dictcnt++;
 		}
+
 		dict = pbroker->dict[pos] = (enchant_dict *)emalloc(sizeof(enchant_dict));
 		dict->id = pos;
 		dict->pbroker = pbroker;
@@ -117,7 +117,15 @@ int cflags;
 							(NC-1)*sizeof(cat_t));
 	if (g == NULL)
 		return(REG_ESPACE);
-	p->ssize = len/(size_t)2*(size_t)3 + (size_t)1;	/* ugh */
+	{
+		/* Patched for CERT Vulnerability Note VU#695940, Feb 2015. */
+		size_t new_ssize = len/(size_t)2*(size_t)3 + (size_t)1; /* ugh */
+		if (new_ssize < len || new_ssize > LONG_MAX / sizeof(sop)) {
+			free((char *) g);
+			return REG_INVARG;
+		}
+		p->ssize = new_ssize;
+	}
 	p->strip = (sop *)malloc(p->ssize * sizeof(sop));
 	p->slen = 0;
 	if (p->strip == NULL) {
@@ -1276,6 +1284,10 @@ int c;
 	register int ncols = (g->ncsets+(CHAR_BIT-1)) / CHAR_BIT;
 	register unsigned uc = (unsigned char)c;

+	if (!g->setbits) {
+		return(0);
+	}
+
 	for (i = 0, col = g->setbits; i < ncols; i++, col += g->csetsize)
 		if (col[uc] != 0)
 			return(1);
@@ -2426,11 +2426,11 @@ static void* exif_ifd_make_value(image_info_data *info_data, int motorola_intel
 					data_ptr += 8;
 					break;
 				case TAG_FMT_SINGLE:
-					memmove(data_ptr, &info_data->value.f, byte_count);
+					memmove(data_ptr, &info_value->f, 4);
 					data_ptr += 4;
 					break;
 				case TAG_FMT_DOUBLE:
-					memmove(data_ptr, &info_data->value.d, byte_count);
+					memmove(data_ptr, &info_value->d, 8);
 					data_ptr += 8;
 					break;
 			}
@@ -2702,7 +2702,7 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
 static int exif_process_unicode(image_info_type *ImageInfo, xp_field_type *xp_field, int tag, char *szValuePtr, int ByteCount TSRMLS_DC)
 {
 	xp_field->tag = tag;	
-	
+	xp_field->value = NULL;
 	/* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX   */
 	if (zend_multibyte_encoding_converter(
 			(unsigned char**)&xp_field->value, 
@@ -0,0 +1,17 @@
+--TEST--
+Bug #68113 (Heap corruption in exif_thumbnail())
+--SKIPIF--
+<?php
+extension_loaded("exif") or die("skip need exif");
+?>
+--FILE--
+<?php
+var_dump(exif_thumbnail(__DIR__."/bug68113.jpg"));
+?>
+Done
+--EXPECTF--
+Warning: exif_thumbnail(bug68113.jpg): File structure corrupted in %s/bug68113.php on line 2
+
+Warning: exif_thumbnail(bug68113.jpg): Invalid JPEG file in %s/bug68113.php on line 2
+bool(false)
+Done
@@ -0,0 +1,63 @@
+--TEST--
+Bug #68799 (Free called on unitialized pointer)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+/*
+* Pollute the heap. Helps trigger bug. Sometimes not needed.
+*/
+class A {
+    function __construct() {
+        $a = 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAa';
+        $this->a = $a . $a . $a . $a . $a . $a;
+    }
+};
+
+function doStuff ($limit) {
+
+    $a = new A;
+
+    $b = array();
+    for ($i = 0; $i < $limit; $i++) {
+        $b[$i] = clone $a;
+    }
+
+    unset($a);
+
+    gc_collect_cycles();
+}
+
+$iterations = 3;
+
+doStuff($iterations);
+doStuff($iterations);
+
+gc_collect_cycles();
+
+print_r(exif_read_data(__DIR__.'/bug68799.jpg'));
+
+?>
+--EXPECTF--
+Array
+(
+    [FileName] => bug68799.jpg
+    [FileDateTime] => %d
+    [FileSize] => 735
+    [FileType] => 2
+    [MimeType] => image/jpeg
+    [SectionsFound] => ANY_TAG, IFD0, WINXP
+    [COMPUTED] => Array
+        (
+            [html] => width="1" height="1"
+            [Height] => 1
+            [Width] => 1
+            [IsColor] => 1
+            [ByteOrderMotorola] => 1
+        )
+
+    [XResolution] => 96/1
+    [YResolution] => 96/1
+    [ResolutionUnit] => 2
+    [Author] => 
+)
@@ -11,7 +11,7 @@ if test "$PHP_FILEINFO" != "no"; then
    libmagic/cdf.c libmagic/cdf_time.c libmagic/compress.c \
    libmagic/encoding.c libmagic/fsmagic.c libmagic/funcs.c \
    libmagic/is_tar.c libmagic/magic.c libmagic/print.c \
-    libmagic/readcdf.c libmagic/readelf.c libmagic/softmagic.c"
+    libmagic/readcdf.c libmagic/softmagic.c"

  PHP_NEW_EXTENSION(fileinfo, fileinfo.c $libmagic_sources, $ext_shared,,-I@ext_srcdir@/libmagic)
  PHP_ADD_BUILD_DIR($ext_builddir/libmagic)
@@ -8,7 +8,7 @@ if (PHP_FILEINFO != 'no') {
 			cdf.c cdf_time.c compress.c \
 			encoding.c fsmagic.c funcs.c \
 			is_tar.c magic.c print.c \
-			readcdf.c readelf.c softmagic.c";
+			readcdf.c softmagic.c";

 	if (VCVERS < 1500) {
 		ADD_FLAG('CFLAGS', '/Zm1000');
@@ -506,6 +506,11 @@ static void _php_finfo_get_type(INTERNAL_FUNCTION_PARAMETERS, int mode, int mime
 				RETVAL_FALSE;
 				goto clean;
 			}
+			if (CHECK_NULL_PATH(buffer, buffer_len)) {
+				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+				RETVAL_FALSE;
+				goto clean;
+			}

 			wrap = php_stream_locate_url_wrapper(buffer, &tmp2, 0 TSRMLS_CC);

@@ -1,6 +1,6 @@
 diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 --- libmagic.orig/apprentice.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/apprentice.c	Mon Apr 14 23:42:51 2014
+++ libmagic/apprentice.c	Sun Jan  4 17:02:29 2015
@@ -29,6 +29,8 @@
  * apprentice - make one pass through /etc/magic, learning its secrets.
  */
@@ -479,6 +479,15 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 		return NULL;
 	}
 	return map;
+@@ -1233,7 +1269,7 @@
+ 		 * the sign extension must have happened.
+ 		 */
+ 		case FILE_BYTE:
+-			v = (char) v;
+			v = (signed char) v;
+ 			break;
+ 		case FILE_SHORT:
+ 		case FILE_BESHORT:
@@ -1500,7 +1536,7 @@
 		if (me->cont_count == me->max_count) {
 			struct magic *nm;
@@ -833,7 +842,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 	}
 diff -u libmagic.orig/ascmagic.c libmagic/ascmagic.c
 --- libmagic.orig/ascmagic.c	Wed Oct 31 18:03:01 2012
-+++ libmagic/ascmagic.c	Mon Apr 14 23:42:51 2014
+++ libmagic/ascmagic.c	Sun Jan  4 17:02:29 2015
@@ -139,7 +139,7 @@
 		/* malloc size is a conservative overestimate; could be
 		   improved, or at least realloced after conversion. */
@@ -872,7 +881,7 @@ diff -u libmagic.orig/ascmagic.c libmagic/ascmagic.c
 }
 diff -u libmagic.orig/cdf.c libmagic/cdf.c
 --- libmagic.orig/cdf.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/cdf.c	Tue Jul  1 09:00:09 2014
+++ libmagic/cdf.c	Sun Jan  4 17:02:29 2015
@@ -43,7 +43,17 @@
 #include <err.h>
 #endif
@@ -955,7 +964,7 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
 			errno = EFTYPE;
 			return (size_t)-1;
 		}
-@@ -796,7 +812,11 @@
+@@ -796,11 +812,15 @@
 	if (cdf_check_stream_offset(sst, h, e, 0, __LINE__) == -1)
 		goto out;
 	for (i = 0; i < sh.sh_properties; i++) {
@@ -968,6 +977,11 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
 		q = (const uint8_t *)(const void *)
 		    ((const char *)(const void *)p + ofs
 		    - 2 * sizeof(uint32_t));
+-		if (q > e) {
+		if (q < p || q > e) {
+ 			DPRINTF(("Ran of the end %p > %p\n", q, e));
+ 			goto out;
+ 		}
@@ -810,6 +830,10 @@
 		    i, inp[i].pi_id, inp[i].pi_type, q - p, offs));
 		if (inp[i].pi_type & CDF_VECTOR) {
@@ -1056,7 +1070,7 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
 			} else {
 diff -u libmagic.orig/cdf.h libmagic/cdf.h
 --- libmagic.orig/cdf.h	Wed Oct 31 18:03:01 2012
-+++ libmagic/cdf.h	Mon Apr 14 23:32:55 2014
+++ libmagic/cdf.h	Sun Jan  4 17:02:29 2015
@@ -35,10 +35,12 @@
 #ifndef _H_CDF_
 #define _H_CDF_
@@ -1099,7 +1113,7 @@ diff -u libmagic.orig/cdf.h libmagic/cdf.h
 void cdf_unpack_header(cdf_header_t *, char *);
 diff -u libmagic.orig/cdf_time.c libmagic/cdf_time.c
 --- libmagic.orig/cdf_time.c	Wed Oct 31 18:03:01 2012
-+++ libmagic/cdf_time.c	Mon Apr 14 23:32:55 2014
+++ libmagic/cdf_time.c	Sun Nov  9 19:16:18 2014
@@ -96,7 +96,7 @@
 }
 
@@ -1159,7 +1173,7 @@ diff -u libmagic.orig/cdf_time.c libmagic/cdf_time.c
 	static const char *ref = "Sat Apr 23 01:30:00 1977";
 diff -u libmagic.orig/compress.c libmagic/compress.c
 --- libmagic.orig/compress.c	Sun Jan  6 21:35:43 2013
-+++ libmagic/compress.c	Mon Apr 14 23:42:51 2014
+++ libmagic/compress.c	Sun Jan  4 17:02:29 2015
@@ -32,6 +32,7 @@
  *	uncompress(method, old, n, newch) - uncompress old into new, 
  *					    using method, return sizeof new
@@ -1322,7 +1336,7 @@ diff -u libmagic.orig/compress.c libmagic/compress.c
 +#endif /* if PHP_FILEINFO_UNCOMPRESS */
 diff -u libmagic.orig/file.h libmagic/file.h
 --- libmagic.orig/file.h	Mon Feb 18 16:40:59 2013
-+++ libmagic/file.h	Mon Apr 14 23:42:51 2014
+++ libmagic/file.h	Sun Jan  4 17:02:29 2015
@@ -33,11 +33,9 @@
 #ifndef __file_h__
 #define __file_h__
@@ -1409,7 +1423,7 @@ diff -u libmagic.orig/file.h libmagic/file.h
 	void *map;			/* internal resources used by entry */
 	struct mlist *next, *prev;
 };
-@@ -411,21 +413,18 @@
+@@ -411,21 +413,16 @@
 protected const char *file_fmttime(uint64_t, int, char *);
 protected struct magic_set *file_ms_alloc(int);
 protected void file_ms_free(struct magic_set *);
@@ -1426,8 +1440,8 @@ diff -u libmagic.orig/file.h libmagic/file.h
 -    __attribute__((__format__(__printf__, 2, 3)));
 +protected int file_printf(struct magic_set *, const char *, ...);
 protected int file_reset(struct magic_set *);
- protected int file_tryelf(struct magic_set *, int, const unsigned char *,
-     size_t);
+-protected int file_tryelf(struct magic_set *, int, const unsigned char *,
+-    size_t);
 protected int file_trycdf(struct magic_set *, int, const unsigned char *,
     size_t);
 -#if HAVE_FORK
@@ -1435,7 +1449,7 @@ diff -u libmagic.orig/file.h libmagic/file.h
 protected int file_zmagic(struct magic_set *, int, const char *,
     const unsigned char *, size_t);
 #endif
-@@ -438,21 +437,18 @@
+@@ -438,21 +435,18 @@
     unichar **, size_t *, const char **, const char **, const char **);
 protected int file_is_tar(struct magic_set *, const unsigned char *, size_t);
 protected int file_softmagic(struct magic_set *, const unsigned char *, size_t,
@@ -1462,7 +1476,7 @@ diff -u libmagic.orig/file.h libmagic/file.h
 protected void file_showstr(FILE *, const char *, size_t);
 protected size_t file_mbswidth(const char *);
 protected const char *file_getbuffer(struct magic_set *);
-@@ -462,16 +458,14 @@
+@@ -462,16 +456,14 @@
     size_t *);
 protected size_t file_pstring_length_size(const struct magic *);
 protected size_t file_pstring_get_length(const struct magic *, const char *);
@@ -1480,7 +1494,7 @@ diff -u libmagic.orig/file.h libmagic/file.h
 
 #ifndef HAVE_STRERROR
 extern int sys_nerr;
-@@ -484,32 +478,16 @@
+@@ -484,32 +476,16 @@
 #define strtoul(a, b, c)	strtol(a, b, c)
 #endif
 
@@ -1515,7 +1529,7 @@ diff -u libmagic.orig/file.h libmagic/file.h
 
 #if defined(HAVE_MMAP) && defined(HAVE_SYS_MMAN_H) && !defined(QUICK)
 #define QUICK
-@@ -531,6 +509,14 @@
+@@ -531,6 +507,14 @@
 #endif
 #else
 #define FILE_RCSID(id)
@@ -1532,7 +1546,7 @@ diff -u libmagic.orig/file.h libmagic/file.h
 #endif /* __file_h__ */
 diff -u libmagic.orig/fsmagic.c libmagic/fsmagic.c
 --- libmagic.orig/fsmagic.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/fsmagic.c	Mon Apr 14 23:42:51 2014
+++ libmagic/fsmagic.c	Sun Jan  4 17:02:29 2015
@@ -59,27 +59,21 @@
 # define minor(dev)  ((dev) & 0xff)
 #endif
@@ -1899,7 +1913,7 @@ diff -u libmagic.orig/fsmagic.c libmagic/fsmagic.c
 }
 diff -u libmagic.orig/funcs.c libmagic/funcs.c
 --- libmagic.orig/funcs.c	Wed Oct 31 18:03:01 2012
-+++ libmagic/funcs.c	Mon Apr 14 23:42:51 2014
+++ libmagic/funcs.c	Sun Jan  4 17:02:29 2015
@@ -41,52 +41,42 @@
 #if defined(HAVE_WCTYPE_H)
 #include <wctype.h>
@@ -2193,7 +2207,7 @@ diff -u libmagic.orig/funcs.c libmagic/funcs.c
 +
 diff -u libmagic.orig/magic.c libmagic/magic.c
 --- libmagic.orig/magic.c	Fri Jan 11 17:43:09 2013
-+++ libmagic/magic.c	Mon Apr 14 23:42:51 2014
+++ libmagic/magic.c	Sun Jan  4 17:02:29 2015
@@ -25,11 +25,6 @@
  * SUCH DAMAGE.
  */
@@ -2537,7 +2551,7 @@ diff -u libmagic.orig/magic.c libmagic/magic.c
 magic_error(struct magic_set *ms)
 diff -u libmagic.orig/magic.h libmagic/magic.h
 --- libmagic.orig/magic.h	Thu Mar 21 18:52:42 2013
-+++ libmagic/magic.h	Mon Apr 14 23:42:51 2014
+++ libmagic/magic.h	Sun Jan  4 17:02:29 2015
@@ -87,6 +87,7 @@
 
 const char *magic_getpath(const char *, int);
@@ -2556,7 +2570,7 @@ diff -u libmagic.orig/magic.h libmagic/magic.h
 
 diff -u libmagic.orig/print.c libmagic/print.c
 --- libmagic.orig/print.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/print.c	Mon Apr 14 23:42:51 2014
+++ libmagic/print.c	Sun Jan  4 17:02:29 2015
@@ -29,12 +29,17 @@
  * print.c - debugging printout routines
  */
@@ -2787,7 +2801,7 @@ diff -u libmagic.orig/print.c libmagic/print.c
 	}
 diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
 --- libmagic.orig/readcdf.c	Wed Oct 31 18:03:01 2012
-+++ libmagic/readcdf.c	Tue May 27 22:17:37 2014
+++ libmagic/readcdf.c	Sun Jan  4 17:02:29 2015
@@ -30,7 +30,11 @@
 #endif
 
@@ -2861,282 +2875,9 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
 		    } else {
 			if (file_printf(ms, "application/CDFV2-corrupt") == -1)
 			    return -1;
-diff -u libmagic.orig/readelf.c libmagic/readelf.c
--- libmagic.orig/readelf.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/readelf.c	Mon Apr 14 23:42:51 2014
-@@ -48,8 +48,8 @@
- private int dophn_exec(struct magic_set *, int, int, int, off_t, int, size_t,
-     off_t, int *, int);
- private int doshn(struct magic_set *, int, int, int, off_t, int, size_t,
-    off_t, int *, int, int);
-private size_t donote(struct magic_set *, void *, size_t, size_t, int,
-+    off_t, int *, int);
-+private size_t donote(struct magic_set *, unsigned char *, size_t, size_t, int,
-     int, size_t, int *);
- 
- #define	ELF_ALIGN(a)	((((a) + align - 1) / align) * align)
-@@ -127,11 +127,17 @@
- 
- #define elf_getu16(swap, value) getu16(swap, value)
- #define elf_getu32(swap, value) getu32(swap, value)
-#define elf_getu64(swap, value) getu64(swap, value)
-+#ifdef USE_ARRAY_FOR_64BIT_TYPES
-+# define elf_getu64(swap, array) \
-+	((swap ? ((uint64_t)elf_getu32(swap, array[0])) << 32 : elf_getu32(swap, array[0])) + \
-+	 (swap ? elf_getu32(swap, array[1]) : ((uint64_t)elf_getu32(swap, array[1]) << 32)))
-+#else
-+# define elf_getu64(swap, value) getu64(swap, value)
-+#endif
- 
- #define xsh_addr	(clazz == ELFCLASS32			\
-			 ? (void *)&sh32			\
-			 : (void *)&sh64)
-+			 ? (void *) &sh32			\
-+			 : (void *) &sh64)
- #define xsh_sizeof	(clazz == ELFCLASS32			\
- 			 ? sizeof(sh32)				\
- 			 : sizeof(sh64))
-@@ -168,8 +174,8 @@
- 			 ? elf_getu32(swap, ph32.p_filesz)	\
- 			 : elf_getu64(swap, ph64.p_filesz)))
- #define xnh_addr	(clazz == ELFCLASS32			\
-			 ? (void *)&nh32			\
-			 : (void *)&nh64)
-+			 ? (void *) &nh32			\
-+			 : (void *) &nh64)
- #define xph_memsz	(size_t)((clazz == ELFCLASS32		\
- 			 ? elf_getu32(swap, ph32.p_memsz)	\
- 			 : elf_getu64(swap, ph64.p_memsz)))
-@@ -189,8 +195,8 @@
- 			 ? prpsoffsets32[i]			\
- 			 : prpsoffsets64[i])
- #define xcap_addr	(clazz == ELFCLASS32			\
-			 ? (void *)&cap32			\
-			 : (void *)&cap64)
-+			 ? (void *) &cap32			\
-+			 : (void *) &cap64)
- #define xcap_sizeof	(clazz == ELFCLASS32			\
- 			 ? sizeof cap32				\
- 			 : sizeof cap64)
-@@ -292,7 +298,7 @@
- {
- 	Elf32_Phdr ph32;
- 	Elf64_Phdr ph64;
-	size_t offset, len;
-+	size_t offset;
- 	unsigned char nbuf[BUFSIZ];
- 	ssize_t bufsize;
- 
-@@ -306,7 +312,11 @@
- 	 * Loop through all the program headers.
- 	 */
- 	for ( ; num; num--) {
-		if (pread(fd, xph_addr, xph_sizeof, off) == -1) {
-+		if (FINFO_LSEEK_FUNC(fd, off, SEEK_SET) == (off_t)-1) {
-+			file_badseek(ms);
-+			return -1;
-+		}
-+		if (FINFO_READ_FUNC(fd, xph_addr, xph_sizeof) == -1) {
- 			file_badread(ms);
- 			return -1;
- 		}
-@@ -324,8 +334,13 @@
- 		 * This is a PT_NOTE section; loop through all the notes
- 		 * in the section.
- 		 */
-		len = xph_filesz < sizeof(nbuf) ? xph_filesz : sizeof(nbuf);
-		if ((bufsize = pread(fd, nbuf, len, xph_offset)) == -1) {
-+		if (FINFO_LSEEK_FUNC(fd, xph_offset, SEEK_SET) == (off_t)-1) {
-+			file_badseek(ms);
-+			return -1;
-+		}
-+		bufsize = FINFO_READ_FUNC(fd, nbuf,
-+		    ((xph_filesz < sizeof(nbuf)) ? xph_filesz : sizeof(nbuf)));
-+		if (bufsize == -1) {
- 			file_badread(ms);
- 			return -1;
- 		}
-@@ -852,24 +867,12 @@
- 		return 0;
- 	}
- 
-	/* Read offset of name section to be able to read section names later */
-	if (pread(fd, xsh_addr, xsh_sizeof, off + size * strtab) == -1) {
-		file_badread(ms);
-		return -1;
-	}
-	name_off = xsh_offset;
-
- 	for ( ; num; num--) {
-		/* Read the name of this section. */
-		if (pread(fd, name, sizeof(name), name_off + xsh_name) == -1) {
-			file_badread(ms);
-+		if (FINFO_LSEEK_FUNC(fd, off, SEEK_SET) == (off_t)-1) {
-+			file_badseek(ms);
- 			return -1;
- 		}
-		name[sizeof(name) - 1] = '\0';
-		if (strcmp(name, ".debug_info") == 0)
-			stripped = 0;
-
-		if (pread(fd, xsh_addr, xsh_sizeof, off) == -1) {
-+		if (FINFO_READ_FUNC(fd, xsh_addr, xsh_sizeof) == -1) {
- 			file_badread(ms);
- 			return -1;
- 		}
-@@ -894,14 +897,17 @@
- 		/* Things we can determine when we seek */
- 		switch (xsh_type) {
- 		case SHT_NOTE:
-			if ((nbuf = malloc(xsh_size)) == NULL) {
-				file_error(ms, errno, "Cannot allocate memory"
-				    " for note");
-+			nbuf = emalloc((size_t)xsh_size);
-+			if ((noff = FINFO_LSEEK_FUNC(fd, (off_t)xsh_offset, SEEK_SET)) ==
-+			    (off_t)-1) {
-+				file_badread(ms);
-+				efree(nbuf);
- 				return -1;
- 			}
-			if (pread(fd, nbuf, xsh_size, xsh_offset) == -1) {
-+			if (FINFO_READ_FUNC(fd, nbuf, (size_t)xsh_size) !=
-+			    (ssize_t)xsh_size) {
-+				efree(nbuf);
- 				file_badread(ms);
-				free(nbuf);
- 				return -1;
- 			}
- 
-@@ -910,25 +916,16 @@
- 				if (noff >= (off_t)xsh_size)
- 					break;
- 				noff = donote(ms, nbuf, (size_t)noff,
-				    xsh_size, clazz, swap, 4, flags);
-+				    (size_t)xsh_size, clazz, swap, 4,
-+				    flags);
- 				if (noff == 0)
- 					break;
- 			}
-			free(nbuf);
-+			efree(nbuf);
- 			break;
- 		case SHT_SUNW_cap:
-			switch (mach) {
-			case EM_SPARC:
-			case EM_SPARCV9:
-			case EM_IA_64:
-			case EM_386:
-			case EM_AMD64:
-				break;
-			default:
-				goto skip;
-			}
-
-			if (lseek(fd, xsh_offset, SEEK_SET) == (off_t)-1) {
-+			if (FINFO_LSEEK_FUNC(fd, (off_t)xsh_offset, SEEK_SET) ==
-+			    (off_t)-1) {
- 				file_badseek(ms);
- 				return -1;
- 			}
-@@ -940,7 +937,7 @@
- 				    MAX(sizeof cap32, sizeof cap64)];
- 				if ((coff += xcap_sizeof) > (off_t)xsh_size)
- 					break;
-				if (read(fd, cbuf, (size_t)xcap_sizeof) !=
-+				if (FINFO_READ_FUNC(fd, cbuf, (size_t)xcap_sizeof) !=
- 				    (ssize_t)xcap_sizeof) {
- 					file_badread(ms);
- 					return -1;
-@@ -966,13 +963,12 @@
- 					break;
- 				}
- 			}
-			/*FALLTHROUGH*/
-		skip:
-+			break;
-+
- 		default:
- 			break;
- 		}
- 	}
-
- 	if (file_printf(ms, ", %sstripped", stripped ? "" : "not ") == -1)
- 		return -1;
- 	if (cap_hw1) {
-@@ -1051,7 +1047,7 @@
- 	const char *shared_libraries = "";
- 	unsigned char nbuf[BUFSIZ];
- 	ssize_t bufsize;
-	size_t offset, align, len;
-+	size_t offset, align;
- 	
- 	if (size != xph_sizeof) {
- 		if (file_printf(ms, ", corrupted program header size") == -1)
-@@ -1060,8 +1056,13 @@
- 	}
- 
-   	for ( ; num; num--) {
-		if (pread(fd, xph_addr, xph_sizeof, off) == -1) {
-			file_badread(ms);
-+		if (FINFO_LSEEK_FUNC(fd, off, SEEK_SET) == (off_t)-1) {
-+			file_badseek(ms);
-+			return -1;
-+		}
-+
-+  		if (FINFO_READ_FUNC(fd, xph_addr, xph_sizeof) == -1) {
-+  			file_badread(ms);
- 			return -1;
- 		}
- 
-@@ -1099,9 +1100,12 @@
- 			 * This is a PT_NOTE section; loop through all the notes
- 			 * in the section.
- 			 */
-			len = xph_filesz < sizeof(nbuf) ? xph_filesz
-			    : sizeof(nbuf);
-			bufsize = pread(fd, nbuf, len, xph_offset);
-+			if (FINFO_LSEEK_FUNC(fd, xph_offset, SEEK_SET) == (off_t)-1) {
-+				file_badseek(ms);
-+				return -1;
-+			}
-+			bufsize = FINFO_READ_FUNC(fd, nbuf, ((xph_filesz < sizeof(nbuf)) ?
-+			    xph_filesz : sizeof(nbuf)));
- 			if (bufsize == -1) {
- 				file_badread(ms);
- 				return -1;
-@@ -1162,7 +1166,7 @@
- 	/*
- 	 * If we cannot seek, it must be a pipe, socket or fifo.
- 	 */
-	if((lseek(fd, (off_t)0, SEEK_SET) == (off_t)-1) && (errno == ESPIPE))
-+	if((FINFO_LSEEK_FUNC(fd, (off_t)0, SEEK_SET) == (off_t)-1) && (errno == ESPIPE))
- 		fd = file_pipe2file(ms, fd, buf, nbytes);
- 
- 	if (fstat(fd, &st) == -1) {
-diff -u libmagic.orig/readelf.h libmagic/readelf.h
--- libmagic.orig/readelf.h	Thu Mar 21 18:45:14 2013
-+++ libmagic/readelf.h	Mon Apr 14 23:42:51 2014
-@@ -44,9 +44,17 @@
- typedef uint32_t	Elf32_Word;
- typedef uint8_t		Elf32_Char;
- 
-+#if SIZEOF_LONG_LONG != 8
-+#define	USE_ARRAY_FOR_64BIT_TYPES
-+typedef	uint32_t 	Elf64_Addr[2];
-+typedef	uint32_t 	Elf64_Off[2];
-+typedef uint32_t 	Elf64_Xword[2];
-+#else
-+#undef USE_ARRAY_FOR_64BIT_TYPES
- typedef	uint64_t 	Elf64_Addr;
- typedef	uint64_t 	Elf64_Off;
- typedef uint64_t 	Elf64_Xword;
-+#endif
- typedef uint16_t	Elf64_Half;
- typedef uint32_t	Elf64_Word;
- typedef uint8_t		Elf64_Char;
 diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 --- libmagic.orig/softmagic.c	Thu Mar 21 18:45:14 2013
-+++ libmagic/softmagic.c	Tue Jul  1 09:00:09 2014
+++ libmagic/softmagic.c	Sun Jan  4 17:02:29 2015
@@ -41,6 +41,11 @@
 #include <stdlib.h>
 #include <time.h>
@@ -3149,6 +2890,15 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 
 private int match(struct magic_set *, struct magic *, uint32_t,
     const unsigned char *, size_t, size_t, int, int, int, int, int *, int *,
+@@ -53,7 +58,7 @@
+ private int32_t moffset(struct magic_set *, struct magic *);
+ private void mdebug(uint32_t, const char *, size_t);
+ private int mcopy(struct magic_set *, union VALUETYPE *, int, int,
+-    const unsigned char *, uint32_t, size_t, size_t);
+    const unsigned char *, uint32_t, size_t, struct magic *);
+ private int mconvert(struct magic_set *, struct magic *, int);
+ private int print_sep(struct magic_set *, int);
+ private int handle_annotation(struct magic_set *, struct magic *);
@@ -62,6 +67,8 @@
 private void cvt_32(union VALUETYPE *, const struct magic *);
 private void cvt_64(union VALUETYPE *, const struct magic *);
@@ -3286,7 +3036,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 			break; \
 		} \
 
-@@ -896,10 +881,18 @@
+@@ -896,10 +881,21 @@
 		return 1;
 	}
 	case FILE_PSTRING: {
@@ -3296,21 +3046,87 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 		size_t len = file_pstring_get_length(m, ptr1);
 -		if (len >= sizeof(p->s))
 -			len = sizeof(p->s) - 1;
-+		if (len >= sizeof(p->s)) {
+		sz = sizeof(p->s) - sz; /* maximum length of string */
+		if (len >= sz) {
 +			/*
 +			 * The size of the pascal string length (sz)
 +			 * is 1, 2, or 4. We need at least 1 byte for NUL
 +			 * termination, but we've already truncated the
 +			 * string by p->s, so we need to deduct sz.
+			 * Because we can use one of the bytes of the length
+			 * after we shifted as NUL termination.
 +			 */ 
-+			len = sizeof(p->s) - sz;
+			len = sz;
 +		}
 		while (len--)
 			*ptr1++ = *ptr2++;
 		*ptr1 = '\0';
-@@ -1145,9 +1138,6 @@
- 		    "nbytes=%zu, count=%u)\n", m->type, m->flag, offset, o,
- 		    nbytes, count);
+@@ -1010,7 +1006,7 @@
+ 
+ private int
+ mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
+-    const unsigned char *s, uint32_t offset, size_t nbytes, size_t linecnt)
+    const unsigned char *s, uint32_t offset, size_t nbytes, struct magic *m)
+ {
+ 	/*
+ 	 * Note: FILE_SEARCH and FILE_REGEX do not actually copy
+@@ -1030,15 +1026,24 @@
+ 			const char *last;	/* end of search region */
+ 			const char *buf;	/* start of search region */
+ 			const char *end;
+-			size_t lines;
+			size_t lines, linecnt, bytecnt;
+
+			linecnt = m->str_range;
+			bytecnt = linecnt * 80;
+ 
+			if (bytecnt == 0) {
+				bytecnt = 8192;
+			}
+			if (bytecnt > nbytes) {
+				bytecnt = nbytes;
+			}
+ 			if (s == NULL) {
+ 				ms->search.s_len = 0;
+ 				ms->search.s = NULL;
+ 				return 0;
+ 			}
+ 			buf = RCAST(const char *, s) + offset;
+-			end = last = RCAST(const char *, s) + nbytes;
+			end = last = RCAST(const char *, s) + bytecnt;
+ 			/* mget() guarantees buf <= last */
+ 			for (lines = linecnt, b = buf; lines && b < end &&
+ 			     ((b = CAST(const char *,
+@@ -1051,7 +1056,7 @@
+ 					b++;
+ 			}
+ 			if (lines)
+-				last = RCAST(const char *, s) + nbytes;
+				last = RCAST(const char *, s) + bytecnt;
+ 
+ 			ms->search.s = buf;
+ 			ms->search.s_len = last - buf;
+@@ -1125,7 +1130,6 @@
+     int *need_separator, int *returnval)
+ {
+ 	uint32_t soffset, offset = ms->offset;
+-	uint32_t count = m->str_range;
+ 	int rv, oneed_separator;
+ 	char *sbuf, *rbuf;
+ 	union VALUETYPE *p = &ms->ms_value;
+@@ -1137,17 +1141,13 @@
+ 	}
+ 
+ 	if (mcopy(ms, p, m->type, m->flag & INDIR, s, (uint32_t)(offset + o),
+-	    (uint32_t)nbytes, count) == -1)
+	    (uint32_t)nbytes, m) == -1)
+ 		return -1;
+ 
+ 	if ((ms->flags & MAGIC_DEBUG) != 0) {
+ 		fprintf(stderr, "mget(type=%d, flag=%x, offset=%u, o=%zu, "
+-		    "nbytes=%zu, count=%u)\n", m->type, m->flag, offset, o,
+-		    nbytes, count);
+		    "nbytes=%zu)\n", m->type, m->flag, offset, o, nbytes);
 		mdebug(offset, (char *)(void *)p, sizeof(union VALUETYPE));
 -#ifndef COMPILE_ONLY
 -		file_mdump(m);
@@ -3318,7 +3134,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 	}
 
 	if (m->flag & INDIR) {
-@@ -1191,7 +1181,7 @@
+@@ -1191,7 +1191,7 @@
 		}
 		switch (cvt_flip(m->in_type, flip)) {
 		case FILE_BYTE:
@@ -3327,7 +3143,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1226,7 +1216,7 @@
+@@ -1226,7 +1226,7 @@
 				offset = ~offset;
 			break;
 		case FILE_BESHORT:
@@ -3336,7 +3152,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1278,7 +1268,7 @@
+@@ -1278,7 +1278,7 @@
 				offset = ~offset;
 			break;
 		case FILE_LESHORT:
@@ -3345,7 +3161,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1330,7 +1320,7 @@
+@@ -1330,7 +1330,7 @@
 				offset = ~offset;
 			break;
 		case FILE_SHORT:
@@ -3354,7 +3170,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1367,7 +1357,7 @@
+@@ -1367,7 +1367,7 @@
 			break;
 		case FILE_BELONG:
 		case FILE_BEID3:
@@ -3363,7 +3179,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1438,7 +1428,7 @@
+@@ -1438,7 +1438,7 @@
 			break;
 		case FILE_LELONG:
 		case FILE_LEID3:
@@ -3372,7 +3188,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1508,7 +1498,7 @@
+@@ -1508,7 +1508,7 @@
 				offset = ~offset;
 			break;
 		case FILE_MELONG:
@@ -3381,7 +3197,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1578,7 +1568,7 @@
+@@ -1578,7 +1578,7 @@
 				offset = ~offset;
 			break;
 		case FILE_LONG:
@@ -3390,7 +3206,15 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 				return 0;
 			if (off) {
 				switch (m->in_op & FILE_OPS_MASK) {
-@@ -1644,23 +1634,20 @@
+@@ -1637,30 +1637,27 @@
+ 			if ((ms->flags & MAGIC_DEBUG) != 0)
+ 				fprintf(stderr, "indirect +offs=%u\n", offset);
+ 		}
+-		if (mcopy(ms, p, m->type, 0, s, offset, nbytes, count) == -1)
+		if (mcopy(ms, p, m->type, 0, s, offset, nbytes, m) == -1)
+ 			return -1;
+ 		ms->offset = offset;
+ 
 		if ((ms->flags & MAGIC_DEBUG) != 0) {
 			mdebug(offset, (char *)(void *)p,
 			    sizeof(union VALUETYPE));
@@ -3416,7 +3240,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 			return 0;
 		break;
 
-@@ -1679,38 +1666,40 @@
+@@ -1679,38 +1676,40 @@
 	case FILE_FLOAT:
 	case FILE_BEFLOAT:
 	case FILE_LEFLOAT:
@@ -3463,7 +3287,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 		if ((ms->flags & MAGIC_DEBUG) != 0)
 			fprintf(stderr, "indirect @offs=%u[%d]\n", offset, rv);
 		rbuf = ms->o.buf;
-@@ -1718,16 +1707,26 @@
+@@ -1718,16 +1717,26 @@
 		ms->offset = soffset;
 		if (rv == 1) {
 			if ((ms->flags & (MAGIC_MIME|MAGIC_APPLE)) == 0 &&
@@ -3494,7 +3318,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 			return 0;
 		sbuf = m->value.s;
 		if (*sbuf == '^') {
-@@ -1837,6 +1836,42 @@
+@@ -1837,6 +1846,42 @@
 	return file_strncmp(a, b, len, flags);
 }
 
@@ -3537,7 +3361,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 private int
 magiccheck(struct magic_set *ms, struct magic *m)
 {
-@@ -1996,69 +2031,157 @@
+@@ -1996,69 +2041,157 @@
 		break;
 	}
 	case FILE_REGEX: {
@@ -3608,7 +3432,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 +			zval *retval;
 +			zval *subpats;
 +			char *haystack;
-+			
+
 +			MAKE_STD_ZVAL(retval);
 +			ALLOC_INIT_ZVAL(subpats);
 +			
@@ -420,8 +420,6 @@ protected int file_pipe2file(struct magic_set *, int, const void *, size_t);
 protected int file_replace(struct magic_set *, const char *, const char *);
 protected int file_printf(struct magic_set *, const char *, ...);
 protected int file_reset(struct magic_set *);
-protected int file_tryelf(struct magic_set *, int, const unsigned char *,
-    size_t);
 protected int file_trycdf(struct magic_set *, int, const unsigned char *,
    size_t);
 #ifdef PHP_FILEINFO_UNCOMPRESS 
@@ -1,333 +0,0 @@
-/*
- * Copyright (c) Christos Zoulas 2003.
- * All Rights Reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice immediately at the beginning of the file, without modification,
- *    this list of conditions, and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *  
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE FOR
- * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-/*
- * @(#)Id: readelf.h,v 1.9 2002/05/16 18:45:56 christos Exp
- *
- * Provide elf data structures for non-elf machines, allowing file
- * non-elf hosts to determine if an elf binary is stripped.
- * Note: cobbled from the linux header file, with modifications
- */
-#ifndef __fake_elf_h__
-#define	__fake_elf_h__
-
-#if HAVE_STDINT_H
-#include <stdint.h>
-#endif
-
-typedef uint32_t	Elf32_Addr;
-typedef uint32_t	Elf32_Off;
-typedef uint16_t	Elf32_Half;
-typedef uint32_t	Elf32_Word;
-typedef uint8_t		Elf32_Char;
-
-#if SIZEOF_LONG_LONG != 8
-#define	USE_ARRAY_FOR_64BIT_TYPES
-typedef	uint32_t 	Elf64_Addr[2];
-typedef	uint32_t 	Elf64_Off[2];
-typedef uint32_t 	Elf64_Xword[2];
-#else
-#undef USE_ARRAY_FOR_64BIT_TYPES
-typedef	uint64_t 	Elf64_Addr;
-typedef	uint64_t 	Elf64_Off;
-typedef uint64_t 	Elf64_Xword;
-#endif
-typedef uint16_t	Elf64_Half;
-typedef uint32_t	Elf64_Word;
-typedef uint8_t		Elf64_Char;
-
-#define	EI_NIDENT	16
-
-typedef struct {
-    Elf32_Char	e_ident[EI_NIDENT];
-    Elf32_Half	e_type;
-    Elf32_Half	e_machine;
-    Elf32_Word	e_version;
-    Elf32_Addr	e_entry;  /* Entry point */
-    Elf32_Off	e_phoff;
-    Elf32_Off	e_shoff;
-    Elf32_Word	e_flags;
-    Elf32_Half	e_ehsize;
-    Elf32_Half	e_phentsize;
-    Elf32_Half	e_phnum;
-    Elf32_Half	e_shentsize;
-    Elf32_Half	e_shnum;
-    Elf32_Half	e_shstrndx;
-} Elf32_Ehdr;
-
-typedef struct {
-    Elf64_Char	e_ident[EI_NIDENT];
-    Elf64_Half	e_type;
-    Elf64_Half	e_machine;
-    Elf64_Word	e_version;
-    Elf64_Addr	e_entry;  /* Entry point */
-    Elf64_Off	e_phoff;
-    Elf64_Off	e_shoff;
-    Elf64_Word	e_flags;
-    Elf64_Half	e_ehsize;
-    Elf64_Half	e_phentsize;
-    Elf64_Half	e_phnum;
-    Elf64_Half	e_shentsize;
-    Elf64_Half	e_shnum;
-    Elf64_Half	e_shstrndx;
-} Elf64_Ehdr;
-
-/* e_type */
-#define	ET_REL		1
-#define	ET_EXEC		2
-#define	ET_DYN		3
-#define	ET_CORE		4
-
-/* e_machine (used only for SunOS 5.x hardware capabilities) */
-#define	EM_SPARC	2
-#define	EM_386		3
-#define	EM_SPARC32PLUS	18
-#define	EM_SPARCV9	43
-#define	EM_IA_64	50
-#define	EM_AMD64	62
-
-/* sh_type */
-#define	SHT_SYMTAB	2
-#define	SHT_NOTE	7
-#define	SHT_DYNSYM	11
-#define	SHT_SUNW_cap	0x6ffffff5	/* SunOS 5.x hw/sw capabilites */
-
-/* elf type */
-#define	ELFDATANONE	0		/* e_ident[EI_DATA] */
-#define	ELFDATA2LSB	1
-#define	ELFDATA2MSB	2
-
-/* elf class */
-#define	ELFCLASSNONE	0
-#define	ELFCLASS32	1
-#define	ELFCLASS64	2
-
-/* magic number */
-#define	EI_MAG0		0		/* e_ident[] indexes */
-#define	EI_MAG1		1
-#define	EI_MAG2		2
-#define	EI_MAG3		3
-#define	EI_CLASS	4
-#define	EI_DATA		5
-#define	EI_VERSION	6
-#define	EI_PAD		7
-
-#define	ELFMAG0		0x7f		/* EI_MAG */
-#define	ELFMAG1		'E'
-#define	ELFMAG2		'L'
-#define	ELFMAG3		'F'
-#define	ELFMAG		"\177ELF"
-
-#define	OLFMAG1		'O'
-#define	OLFMAG		"\177OLF"
-
-typedef struct {
-    Elf32_Word	p_type;
-    Elf32_Off	p_offset;
-    Elf32_Addr	p_vaddr;
-    Elf32_Addr	p_paddr;
-    Elf32_Word	p_filesz;
-    Elf32_Word	p_memsz;
-    Elf32_Word	p_flags;
-    Elf32_Word	p_align;
-} Elf32_Phdr;
-
-typedef struct {
-    Elf64_Word	p_type;
-    Elf64_Word	p_flags;
-    Elf64_Off	p_offset;
-    Elf64_Addr	p_vaddr;
-    Elf64_Addr	p_paddr;
-    Elf64_Xword	p_filesz;
-    Elf64_Xword	p_memsz;
-    Elf64_Xword	p_align;
-} Elf64_Phdr;
-
-#define	PT_NULL		0		/* p_type */
-#define	PT_LOAD		1
-#define	PT_DYNAMIC	2
-#define	PT_INTERP	3
-#define	PT_NOTE		4
-#define	PT_SHLIB	5
-#define	PT_PHDR		6
-#define	PT_NUM		7
-
-typedef struct {
-    Elf32_Word	sh_name;
-    Elf32_Word	sh_type;
-    Elf32_Word	sh_flags;
-    Elf32_Addr	sh_addr;
-    Elf32_Off	sh_offset;
-    Elf32_Word	sh_size;
-    Elf32_Word	sh_link;
-    Elf32_Word	sh_info;
-    Elf32_Word	sh_addralign;
-    Elf32_Word	sh_entsize;
-} Elf32_Shdr;
-
-typedef struct {
-    Elf64_Word	sh_name;
-    Elf64_Word	sh_type;
-    Elf64_Off	sh_flags;
-    Elf64_Addr	sh_addr;
-    Elf64_Off	sh_offset;
-    Elf64_Off	sh_size;
-    Elf64_Word	sh_link;
-    Elf64_Word	sh_info;
-    Elf64_Off	sh_addralign;
-    Elf64_Off	sh_entsize;
-} Elf64_Shdr;
-
-#define	NT_NETBSD_CORE_PROCINFO		1
-
-/* Note header in a PT_NOTE section */
-typedef struct elf_note {
-    Elf32_Word	n_namesz;	/* Name size */
-    Elf32_Word	n_descsz;	/* Content size */
-    Elf32_Word	n_type;		/* Content type */
-} Elf32_Nhdr;
-
-typedef struct {
-    Elf64_Word	n_namesz;
-    Elf64_Word	n_descsz;
-    Elf64_Word	n_type;
-} Elf64_Nhdr;
-
-/* Notes used in ET_CORE */
-#define	NT_PRSTATUS	1
-#define	NT_PRFPREG	2
-#define	NT_PRPSINFO	3
-#define	NT_PRXREG	4
-#define	NT_TASKSTRUCT	4
-#define	NT_PLATFORM	5
-#define	NT_AUXV		6
-
-/* Note types used in executables */
-/* NetBSD executables (name = "NetBSD") */
-#define	NT_NETBSD_VERSION	1
-#define	NT_NETBSD_EMULATION	2
-#define	NT_FREEBSD_VERSION	1
-#define	NT_OPENBSD_VERSION	1
-#define	NT_DRAGONFLY_VERSION	1
-/*
- * GNU executables (name = "GNU")
- * word[0]: GNU OS tags
- * word[1]: major version
- * word[2]: minor version
- * word[3]: tiny version
- */
-#define	NT_GNU_VERSION		1
-
-/* GNU OS tags */
-#define	GNU_OS_LINUX	0
-#define	GNU_OS_HURD	1
-#define	GNU_OS_SOLARIS	2
-#define	GNU_OS_KFREEBSD	3
-#define	GNU_OS_KNETBSD	4
-
-/*
- * GNU Hardware capability information 
- * word[0]: Number of entries
- * word[1]: Bitmask of enabled entries
- * Followed by a byte id, and a NUL terminated string per entry
- */
-#define	NT_GNU_HWCAP		2
-
-/*
- * GNU Build ID generated by ld
- * 160 bit SHA1 [default] 
- * 128 bit md5 or uuid
- */
-#define	NT_GNU_BUILD_ID		3
-
-/* SunOS 5.x hardware/software capabilities */
-typedef struct {
-	Elf32_Word	c_tag;
-	union {
-		Elf32_Word	c_val;
-		Elf32_Addr	c_ptr;
-	} c_un;
-} Elf32_Cap;
-
-typedef struct {
-	Elf64_Xword	c_tag;
-	union {
-		Elf64_Xword	c_val;
-		Elf64_Addr	c_ptr;
-	} c_un;
-} Elf64_Cap;
-
-/* SunOS 5.x hardware/software capability tags */
-#define	CA_SUNW_NULL	0
-#define	CA_SUNW_HW_1	1
-#define	CA_SUNW_SF_1	2
-
-/* SunOS 5.x software capabilities */
-#define	SF1_SUNW_FPKNWN	0x01
-#define	SF1_SUNW_FPUSED	0x02
-#define	SF1_SUNW_MASK	0x03
-
-/* SunOS 5.x hardware capabilities: sparc */
-#define	AV_SPARC_MUL32		0x0001
-#define	AV_SPARC_DIV32		0x0002
-#define	AV_SPARC_FSMULD		0x0004
-#define	AV_SPARC_V8PLUS		0x0008
-#define	AV_SPARC_POPC		0x0010
-#define	AV_SPARC_VIS		0x0020
-#define	AV_SPARC_VIS2		0x0040
-#define	AV_SPARC_ASI_BLK_INIT	0x0080
-#define	AV_SPARC_FMAF		0x0100
-#define	AV_SPARC_FJFMAU		0x4000
-#define	AV_SPARC_IMA		0x8000
-
-/* SunOS 5.x hardware capabilities: 386 */
-#define	AV_386_FPU		0x00000001
-#define	AV_386_TSC		0x00000002
-#define	AV_386_CX8		0x00000004
-#define	AV_386_SEP		0x00000008
-#define	AV_386_AMD_SYSC		0x00000010
-#define	AV_386_CMOV		0x00000020
-#define	AV_386_MMX		0x00000040
-#define	AV_386_AMD_MMX		0x00000080
-#define	AV_386_AMD_3DNow	0x00000100
-#define	AV_386_AMD_3DNowx	0x00000200
-#define	AV_386_FXSR		0x00000400
-#define	AV_386_SSE		0x00000800
-#define	AV_386_SSE2		0x00001000
-#define	AV_386_PAUSE		0x00002000
-#define	AV_386_SSE3		0x00004000
-#define	AV_386_MON		0x00008000
-#define	AV_386_CX16		0x00010000
-#define	AV_386_AHF		0x00020000
-#define	AV_386_TSCP		0x00040000
-#define	AV_386_AMD_SSE4A	0x00080000
-#define	AV_386_POPCNT		0x00100000
-#define	AV_386_AMD_LZCNT	0x00200000
-#define	AV_386_SSSE3		0x00400000
-#define	AV_386_SSE4_1		0x00800000
-#define	AV_386_SSE4_2		0x01000000
-
-#endif
@@ -884,14 +884,17 @@ mconvert(struct magic_set *ms, struct magic *m, int flip)
 		size_t sz = file_pstring_length_size(m);
 		char *ptr1 = p->s, *ptr2 = ptr1 + sz;
 		size_t len = file_pstring_get_length(m, ptr1);
-		if (len >= sizeof(p->s)) {
+		sz = sizeof(p->s) - sz; /* maximum length of string */
+		if (len >= sz) {
 			/*
 			 * The size of the pascal string length (sz)
 			 * is 1, 2, or 4. We need at least 1 byte for NUL
 			 * termination, but we've already truncated the
 			 * string by p->s, so we need to deduct sz.
+			 * Because we can use one of the bytes of the length
+			 * after we shifted as NUL termination.
 			 */ 
-			len = sizeof(p->s) - sz;
+			len = sz;
 		}
 		while (len--)
 			*ptr1++ = *ptr2++;
@@ -1034,6 +1037,9 @@ mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
 			if (bytecnt > nbytes) {
 				bytecnt = nbytes;
 			}
+			if (offset > bytecnt) {
+				offset = bytecnt;
+			}
 			if (s == NULL) {
 				ms->search.s_len = 0;
 				ms->search.s = NULL;
@@ -0,0 +1,16 @@
+--TEST--
+Bug #68735 fileinfo out-of-bounds memory access
+--SKIPIF--
+<?php require_once(dirname(__FILE__) . '/skipif.inc'); ?>
+--FILE--
+<?php
+	$test_file = dirname(__FILE__) . DIRECTORY_SEPARATOR . "bug68735.jpg";
+	$f = new finfo;
+
+	var_dump($f->file($test_file));
+
+?>
+===DONE===
+--EXPECTF--
+string(%d) "JPEG image data, JFIF standard 1.01, comment: "%S""
+===DONE===
@@ -0,0 +1,18 @@
+--TEST--
+Bug #68819 Fileinfo on specific file causes spurious OOM and/or segfault, var 1
+--SKIPIF--
+<?php require_once(dirname(__FILE__) . '/skipif.inc'); ?>
+--FILE--
+<?php
+
+$string = <<<HERE
+----a-----'''---------a---------------a--------a-----a-----a---------a-----as-------a----a--a-------------a--as-----s---------------a---------a---a--s-a-----a-----------asy---------a-----a-----------a----s--------a-------------a-------a--------a----s------------a-----a----------------a----s-----------------\r\n-------------------a-------a-a-------a-----a----a----s----s--------a-----------------------a----a----s-------------a------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-------------------a-------a-a-------a-----a----a----s----s--------a----------a----------------------a----a----s-------------a----------------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n------a-------a-a-------a-----a----a---a-----a-----------------------a----a---a-----a------------------s-------a----a---a-----a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s------\r\n-------------------a-------a-a-------a-----a----a---a-------a------------------------a----a---a-----''--a-------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-------------------a-------a-a-------a-----a----a-------s-----a---a-------------------------a----a-------------a---a-------------------s-------a----a-------------a---a-----as-a--------------a-----a--s----s---------y------------a-----a-s---a-------''----a---s--a-''------''----s------------a-y----------------s------a-----y--a-s--a-s------s--a-s----------''----------------------------a---s--a----a---------a-s---a-s--------s--------a---------s--a-y-------------as----a----a-------------a------a---s--a-s------a--------a----s----y--as--a----a-s---------------a-----a--------------------------------------\r\n-------------------a-------a-a-------a-----a----a-----------s--------a-----------------------a----a--------------------a------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-------------------a-------a-a-------a-----a----a-----------s--------a----------a----------------------a----a--------------------a------------------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-------------------a-------a-a-------a-----a----a---a-----------------------a----a---a------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-------------------a-------a-a-------a-----a----a---a----------a----------------------a----a---a------------------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-----a-a-----------a-------a-a-------a-----a----a----a---s-----a-----------------------a----a----a---------a-----------------s-------a----a----a---------a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-------------------a-------a-a-------a-----a----a--------a----a-----------------------a----a----------a----a------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-----a-------------a-------a-a-------a-----a----a--------s-----a---a-------------------------a----a--------------a---a-------------------s-------------a---------------a----a---a---a-----as-a--------------a-----a--s----s---------y------------a-----a-s---a-------''----a---s--a-''------''----s------------a-y----------------s------a-----y--a-s--a-s------s--a-s----------''----------------------------a---s--a----a---------a-s---a-s--------s--------a---------s--a-y-------------as----a----a-------------a------a---s--a-s------a--------a----s----y--as--a----a-s---------------a-----a-----------Line truncated
+HERE;
+
+$finfo = new finfo();
+$type = $finfo->buffer($string);
+
+var_dump($type);
+?>
+--EXPECT--
+string(60) "ASCII text, with very long lines, with CRLF line terminators"
@@ -0,0 +1,26 @@
+--TEST--
+Bug #68819 Fileinfo on specific file causes spurious OOM and/or segfault, var 2
+--SKIPIF--
+<?php require_once(dirname(__FILE__) . '/skipif.inc'); ?>
+--FILE--
+<?php
+
+$string = '';
+
+// These two in any order
+$string .= "\r\n";
+$string .= "''''";
+
+// Total string length > 8192
+$string .= str_repeat(chr(rand(32, 127)), 8184);
+
+// Ending in this string
+$string .= "say";
+
+$finfo = new finfo();
+$type = $finfo->buffer($string);
+var_dump($type);
+
+?>
+--EXPECT--
+string(60) "ASCII text, with very long lines, with CRLF line terminators"
@@ -19,6 +19,7 @@ echo "*** Testing finfo_file() : basic functionality ***\n";
 var_dump( finfo_file( $finfo, __FILE__) );
 var_dump( finfo_file( $finfo, __FILE__, FILEINFO_CONTINUE ) );
 var_dump( finfo_file( $finfo, $magicFile ) );
+var_dump( finfo_file( $finfo, $magicFile.chr(0).$magicFile) );

 ?>
 ===DONE===
@@ -27,4 +28,7 @@ var_dump( finfo_file( $finfo, $magicFile ) );
 string(28) "text/x-php; charset=us-ascii"
 string(22) "PHP script, ASCII text"
 string(25) "text/plain; charset=utf-8"
+
+Warning: finfo_file(): Invalid path in %s/finfo_file_basic.php on line %d
+bool(false)
 ===DONE===
@@ -1495,7 +1495,7 @@ PHP_FUNCTION(imageloadfont)
 	gdFontPtr font;
 	php_stream *stream;

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &file, &file_name) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &file, &file_name) == FAILURE) {
 		return;
 	}

@@ -2438,7 +2438,7 @@ static void _php_image_create_from(INTERNAL_FUNCTION_PARAMETERS, int image_type,
 	long ignore_warning;
 #endif
 	if (image_type == PHP_GDIMG_TYPE_GD2PART) {
-		if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "sllll", &file, &file_len, &srcx, &srcy, &width, &height) == FAILURE) {
+		if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "pllll", &file, &file_len, &srcx, &srcy, &width, &height) == FAILURE) {
 			return;
 		}
 		if (width < 1 || height < 1) {
@@ -2446,7 +2446,7 @@ static void _php_image_create_from(INTERNAL_FUNCTION_PARAMETERS, int image_type,
 			RETURN_FALSE;
 		}
 	} else {
-		if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &file, &file_len) == FAILURE) {
+		if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &file, &file_len) == FAILURE) {
 			return;
 		}
 	}
@@ -4178,7 +4178,7 @@ PHP_FUNCTION(imagepsencodefont)
 	char *enc, **enc_vector;
 	int enc_len, *f_ind;

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rs", &fnt, &enc, &enc_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rp", &fnt, &enc, &enc_len) == FAILURE) {
 		return;
 	}

@@ -72,8 +72,10 @@ static struct {

 #define STACK_SIZE ((1<<(MAX_LWZ_BITS))*2)

+#define CSD_BUF_SIZE 280
+
 typedef struct {
-	unsigned char    buf[280];
+	unsigned char    buf[CSD_BUF_SIZE];
 	int              curbit, lastbit, done, last_byte;
 } CODE_STATIC_DATA;

@@ -398,9 +400,14 @@ GetCode_(gdIOCtx *fd, CODE_STATIC_DATA *scd, int code_size, int flag, int *ZeroD
 		scd->lastbit = (2+count)*8 ;
 	}

-	ret = 0;
-	for (i = scd->curbit, j = 0; j < code_size; ++i, ++j)
-		ret |= ((scd->buf[ i / 8 ] & (1 << (i % 8))) != 0) << j;
+	if ((scd->curbit + code_size - 1) >= (CSD_BUF_SIZE * 8)) {
+		ret = -1;
+	} else {
+		ret = 0;
+		for (i = scd->curbit, j = 0; j < code_size; ++i, ++j) {
+			ret |= ((scd->buf[i / 8] & (1 << (i % 8))) != 0) << j;
+		}
+	}

 	scd->curbit += code_size;
 	return ret;
@@ -3,7 +3,7 @@ Testing that imageloadfont() breaks on non-string first parameter
 --CREDITS--
 Neveo Harrison <neveoo [at] gmail [dot] com> #testfest #tek11
 --SKIPIF--
-<?php 
+<?php
 	if (!extension_loaded("gd")) die("skip GD not present");
 ?>
 --FILE--
@@ -11,5 +11,5 @@ Neveo Harrison <neveoo [at] gmail [dot] com> #testfest #tek11
 var_dump( imageloadfont(array()) );
 ?>
 --EXPECTF--
-Warning: imageloadfont() expects parameter 1 to be string, array given in %s on line %d
-NULL
+Warning: imageloadfont() expects parameter 1 to be a valid path, array given in %s on line %d
+NULL
@@ -324,30 +324,6 @@ static void _php_gmpnum_free(zend_rsrc_list_entry *rsrc TSRMLS_DC);
 #	define MAX_BASE 36
 #endif

-/* {{{ gmp_emalloc
- */
-static void *gmp_emalloc(size_t size)
-{
-	return emalloc(size);
-}
-/* }}} */
-
-/* {{{ gmp_erealloc
- */
-static void *gmp_erealloc(void *ptr, size_t old_size, size_t new_size)
-{
-	return erealloc(ptr, new_size);
-}
-/* }}} */
-
-/* {{{ gmp_efree
- */
-static void gmp_efree(void *ptr, size_t size)
-{
-	efree(ptr);
-}
-/* }}} */
-
 /* {{{ ZEND_GINIT_FUNCTION
 */
 static ZEND_GINIT_FUNCTION(gmp)
@@ -369,8 +345,6 @@ ZEND_MODULE_STARTUP_D(gmp)
 #endif
 	REGISTER_STRING_CONSTANT("GMP_VERSION", (char *)gmp_version, CONST_CS | CONST_PERSISTENT);

-	mp_set_memory_functions(gmp_emalloc, gmp_erealloc, gmp_efree);
-
 	return SUCCESS;
 }
 /* }}} */
@@ -142,6 +142,7 @@ static void php_hash_do_hash(INTERNAL_FUNCTION_PARAMETERS, int isfilename, zend_
 	}
 	if (isfilename) {
 		if (CHECK_NULL_PATH(data, data_len)) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
 			RETURN_FALSE;
 		}
 		stream = php_stream_open_wrapper_ex(data, "rb", REPORT_ERRORS, NULL, DEFAULT_CONTEXT);
@@ -222,6 +223,10 @@ static void php_hash_do_hash_hmac(INTERNAL_FUNCTION_PARAMETERS, int isfilename,
 		RETURN_FALSE;
 	}
 	if (isfilename) {
+		if (CHECK_NULL_PATH(data, data_len)) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+			RETURN_FALSE;
+		}
 		stream = php_stream_open_wrapper_ex(data, "rb", REPORT_ERRORS, NULL, DEFAULT_CONTEXT);
 		if (!stream) {
 			/* Stream will report errors opening file */
@@ -449,7 +454,7 @@ PHP_FUNCTION(hash_update_file)
 	char *filename, buf[1024];
 	int filename_len, n;

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rs|r", &zhash, &filename, &filename_len, &zcontext) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rp|r", &zhash, &filename, &filename_len, &zcontext) == FAILURE) {
 		return;
 	}

@@ -28,6 +28,9 @@ hash_hmac_file('crc32', $file, $key, TRUE, $extra_arg);
 echo "\n-- Testing hash_hmac_file() function with invalid hash algorithm --\n";
 hash_hmac_file('foo', $file, $key, TRUE);

+echo "\n-- Testing hash_hmac_file() function with bad path --\n";
+hash_hmac_file('crc32', $file.chr(0).$file, $key, TRUE);
+
 ?>
 ===Done===
 --EXPECTF--
@@ -51,4 +54,8 @@ Warning: hash_hmac_file() expects at most 4 parameters, 5 given in %s on line %d
 -- Testing hash_hmac_file() function with invalid hash algorithm --

 Warning: hash_hmac_file(): Unknown hashing algorithm: foo in %s on line %d
+
+-- Testing hash_hmac_file() function with bad path --
+
+Warning: hash_hmac_file(): Invalid path in %s on line %d
 ===Done===
@@ -619,8 +619,11 @@ PHP_FUNCTION(mcrypt_generic_init)

 	if (iv_len != iv_size) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Iv size incorrect; supplied length: %d, needed: %d", iv_len, iv_size);
+		if (iv_len > iv_size) {
+			iv_len = iv_size;
+		}
 	}
-	memcpy(iv_s, iv, iv_size);
+	memcpy(iv_s, iv, iv_len);

 	mcrypt_generic_deinit(pm->td);
 	result = mcrypt_generic_init(pm->td, key_s, key_size, iv_s);
@@ -641,8 +644,9 @@ PHP_FUNCTION(mcrypt_generic_init)
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unknown error");
 				break;
 		}
+	} else {
+		pm->init = 1;
 	}
-	pm->init = 1;
 	RETVAL_LONG(result);

 	efree(iv_s);
@@ -518,7 +518,7 @@ mysqlnd_query_read_result_set_header(MYSQLND_CONN_DATA * conn, MYSQLND_STMT * s
 						conn->current_result = NULL;
 					} else {
 						stmt->result = NULL;
-						memset(stmt, 0, sizeof(MYSQLND_STMT));
+						memset(stmt, 0, sizeof(*stmt));
 						stmt->state = MYSQLND_STMT_INITTED;
 					}
 				} else {
@@ -4556,14 +4556,14 @@ int php_openssl_apply_verification_policy(SSL *ssl, X509 *peer, php_stream *stre
 			return FAILURE;
 		}

-		match = strcmp(cnmatch, buf) == 0;
+		match = strcasecmp(cnmatch, buf) == 0;
 		if (!match && strlen(buf) > 3 && buf[0] == '*' && buf[1] == '.') {
 			/* Try wildcard */

 			if (strchr(buf+2, '.')) {
 				char *tmp = strstr(cnmatch, buf+1);

-				match = tmp && strcmp(tmp, buf+2) && tmp == strchr(cnmatch, '.');
+				match = tmp && strcasecmp(tmp, buf+2) && tmp == strchr(cnmatch, '.');
 			}
 		}

@@ -640,7 +640,7 @@ PHPAPI void php_pcre_match_impl(pcre_cache_entry *pce, char *subject, int subjec
 	}

 	offsets = (int *)safe_emalloc(size_offsets, sizeof(int), 0);
-
+	memset(offsets, 0, size_offsets*sizeof(int));
 	/* Allocate match sets array and initialize the values. */
 	if (global && subpats && subpats_order == PREG_PATTERN_ORDER) {
 		match_sets = (zval **)safe_emalloc(num_subpats, sizeof(zval *), 0);
@@ -294,7 +294,7 @@ static int pgsql_stmt_param_hook(pdo_stmt_t *stmt, struct pdo_bound_param_data *
 							sizeof(Oid));
 				}
 				if (param->paramno >= 0) {
-					if (param->paramno > zend_hash_num_elements(stmt->bound_param_map)) {
+					if (param->paramno >= zend_hash_num_elements(stmt->bound_param_map)) {
 						pdo_pgsql_error_stmt(stmt, PGRES_FATAL_ERROR, "HY105");
 						return 0;
 					}
@@ -0,0 +1,66 @@
+--TEST--
+PDO PgSQL Bug #66584 (Segmentation fault on statement deallocation)
+--SKIPIF--
+<?php
+if (!extension_loaded('pdo') || !extension_loaded('pdo_pgsql')) die('skip not loaded');
+require dirname(__FILE__) . '/config.inc';
+require dirname(__FILE__) . '/../../../ext/pdo/tests/pdo_test.inc';
+PDOTest::skip();
+?>
+--FILE--
+<?php
+require dirname(__FILE__) . '/../../../ext/pdo/tests/pdo_test.inc';
+$pdo = PDOTest::test_factory(dirname(__FILE__) . '/common.phpt');
+
+$pdo->setAttribute(\PDO::ATTR_ERRMODE, \PDO::ERRMODE_EXCEPTION);
+
+$pdo->beginTransaction();
+
+$pdo->query("CREATE TABLE b66584 (a int)");
+$pdo->query("INSERT INTO b66584 VALUES (165)");
+
+for ($i = 1; $i >= 0; $i--) {
+	$pdo->setAttribute(\PDO::ATTR_EMULATE_PREPARES, (bool)$i);
+
+	try {
+		run($pdo, [0 => 1, 2 => 165, 5 => 3]);
+	} catch (\Exception $e) {
+		var_dump($e->getMessage());
+	}
+
+	try {
+		run($pdo, json_decode('{"0":234,"1":165,"2":221,"3":207,"4":188,"5":216,"6":1150,"7":916,"8":967,"9":987,"10":951,"11":990,"12":959,"13":896,"14":947,"15":877,"16":1000,"17":1023,"18":904,"19":856,"20":860,"21":866,"22":930,"23":974,"24":1032,"25":1016,"26":1050,"27":1059,"28":1040,"29":1064,"30":1004,"31":214,"32":189,"33":166,"34":1002,"35":167,"36":191,"37":859,"38":204,"39":181,"40":1001,"42":208,"43":198,"44":177,"45":1003,"46":858,"47":190,"48":162,"49":210,"50":171,"51":197,"52":168,"53":194,"54":209,"55":200,"56":192,"57":180,"58":232,"59":222,"60":163,"61":196,"62":217,"64":176,"65":193,"66":172,"67":195,"68":170,"69":173,"70":233,"71":223,"72":218,"73":186,"74":175,"75":224,"76":205,"77":211,"78":235,"79":1101,"80":225,"81":236,"82":1102,"83":1164,"84":1083,"85":1005,"86":861,"87":1179,"88":960,"89":991,"90":1187,"91":880,"92":1149,"93":1033,"94":931,"95":1006,"96":862,"97":1151,"98":917,"99":881,"100":1148,"101":1065,"102":867,"103":952,"104":1152,"105":918,"106":961,"107":1180,"108":992,"109":1188,"110":932,"111":933,"112":968,"113":868,"114":882,"115":1147,"116":1017,"117":1131,"118":1174,"119":1178,"120":1186,"121":869,"122":1051,"123":934,"124":969,"125":975,"126":1066,"127":237,"128":953,"129":1024,"130":1146,"131":883,"132":1145,"133":884,"134":885,"135":1144,"136":886,"137":1143,"138":1025,"139":897,"140":898,"141":899,"142":1026,"143":1142,"144":887,"145":1141,"146":888,"147":889,"148":1140,"149":1189,"150":993,"151":1139,"152":890,"153":1138,"154":891,"155":900,"156":892,"157":1137,"158":1027,"159":901,"160":1136,"161":893,"162":870,"163":1052,"164":954,"165":1041,"166":1018,"167":1165,"168":1084,"169":962,"170":1181,"171":994,"172":1190,"173":1042,"174":935,"175":226,"176":871,"177":1191,"178":995,"179":977,"180":948,"181":1175,"182":1053,"183":955,"184":1182,"185":963,"186":1067,"187":919,"188":1153,"189":920,"190":1154,"191":1055,"192":1054,"193":1056,"194":863,"195":872,"196":1028,"197":921,"198":1155,"199":936,"200":970,"201":1019,"202":1166,"203":1085,"204":1135,"205":894,"206":1034,"207":905,"208":873,"209":937,"210":902,"211":1029,"212":1007,"213":864,"214":1043,"215":1057,"216":956,"217":957,"218":939,"219":1086,"220":1167,"221":1087,"222":1168,"223":1173,"224":1108,"225":978,"226":1044,"227":1183,"228":964,"229":965,"230":1184,"231":1045,"232":874,"233":940,"234":1046,"235":979,"236":903,"237":980,"238":1156,"239":922,"240":1035,"241":906,"242":971,"243":972,"244":878,"245":1134,"246":879,"247":1133,"248":907,"249":1036,"250":908,"251":1132,"252":895,"253":909,"254":1060,"255":981,"256":1068,"257":996,"258":1192,"259":941,"260":865,"261":1008,"262":910,"263":997,"264":1193,"265":982,"266":942,"267":1020,"268":983,"269":1061,"270":949,"271":1176,"272":875,"273":911,"274":1069,"275":1157,"276":923,"277":1158,"278":924,"279":988,"280":984,"281":925,"282":1159,"283":1062,"284":1047,"285":1194,"286":998,"287":1021,"288":1030,"289":1031,"290":1070,"291":1088,"292":1169,"293":958,"294":1195,"295":999,"296":966,"297":1185,"298":944,"299":945,"300":1022,"301":1103,"302":220,"303":1099,"304":1048,"305":927,"306":1161,"307":989,"308":973,"309":1071,"310":1074,"311":1072,"312":1073,"313":912,"314":1037,"315":913,"316":914,"317":1177,"318":950,"319":1049,"320":876,"321":985,"322":915,"323":1038,"324":946,"325":1089,"326":1170,"327":1090,"328":1171,"329":1091,"330":1172,"331":1063,"332":986,"333":928,"334":1162,"335":929,"336":1163,"337":976,"338":231,"339":201,"340":1098,"341":215}', true));
+	} catch (\Exception $e) {
+		var_dump($e->getMessage());
+	}
+}
+
+try {
+	$pdo->query("DROP TABLE b66584");
+	$pdo->rollback();
+} catch (\Exception $e) {
+}
+
+function run($pdo, $data)
+{
+    $bind = join(', ', array_fill(0, count($data), '?'));
+
+    $stmt = $pdo->prepare("SELECT COUNT(*) FROM b66584 WHERE a IN ({$bind})");
+
+	var_dump(count($data));
+
+    $stmt->execute($data);
+
+	var_dump($stmt->fetchColumn());
+}
+
+?>
+--EXPECTF--
+int(3)
+string(%d) "SQLSTATE%s"
+int(340)
+string(%d) "SQLSTATE%s"
+int(3)
+string(%d) "SQLSTATE%s"
+int(340)
+string(%d) "SQLSTATE%s"
@@ -3014,7 +3014,7 @@ PHP_FUNCTION(pg_trace)
 	php_stream *stream;
 	id = PGG(default_link);

-	if (zend_parse_parameters(argc TSRMLS_CC, "s|sr", &z_filename, &z_filename_len, &mode, &mode_len, &pgsql_link) == FAILURE) {
+	if (zend_parse_parameters(argc TSRMLS_CC, "p|sr", &z_filename, &z_filename_len, &mode, &mode_len, &pgsql_link) == FAILURE) {
 		return;
 	}

@@ -6117,6 +6117,9 @@ static inline void build_tablename(smart_str *querystr, PGconn *pg_link, const c
 	/* schame.table should be "schame"."table" */
 	table_copy = estrdup(table);
 	token = php_strtok_r(table_copy, ".", &tmp);
+	if (token == NULL) {
+		token = table;
+	}
 	len = strlen(token);
 	if (_php_pgsql_detect_identifier_escape(token, len) == SUCCESS) {
 		smart_str_appendl(querystr, token, len);
@@ -600,52 +600,41 @@ int phar_open_parsed_phar(char *fname, int fname_len, char *alias, int alias_len
 *
 * Meta-data is in this format:
 * [len32][data...]
- * 
+ *
 * data is the serialized zval
 */
-int phar_parse_metadata(char **buffer, zval **metadata, int zip_metadata_len TSRMLS_DC) /* {{{ */
+int phar_parse_metadata(char **buffer, zval **metadata, php_uint32 zip_metadata_len TSRMLS_DC) /* {{{ */
 {
-	const unsigned char *p;
-	php_uint32 buf_len;
 	php_unserialize_data_t var_hash;

-	if (!zip_metadata_len) {
-		PHAR_GET_32(*buffer, buf_len);
-	} else {
-		buf_len = zip_metadata_len;
-	}
-
-	if (buf_len) {
+	if (zip_metadata_len) {
+		const unsigned char *p, *p_buff = estrndup(*buffer, zip_metadata_len);
+		p = p_buff;
 		ALLOC_ZVAL(*metadata);
 		INIT_ZVAL(**metadata);
-		p = (const unsigned char*) *buffer;
 		PHP_VAR_UNSERIALIZE_INIT(var_hash);

-		if (!php_var_unserialize(metadata, &p, p + buf_len, &var_hash TSRMLS_CC)) {
+		if (!php_var_unserialize(metadata, &p, p + zip_metadata_len, &var_hash TSRMLS_CC)) {
+			efree(p_buff);
 			PHP_VAR_UNSERIALIZE_DESTROY(var_hash);
 			zval_ptr_dtor(metadata);
 			*metadata = NULL;
 			return FAILURE;
 		}
-
+		efree(p_buff);
 		PHP_VAR_UNSERIALIZE_DESTROY(var_hash);

 		if (PHAR_G(persist)) {
 			/* lazy init metadata */
 			zval_ptr_dtor(metadata);
-			*metadata = (zval *) pemalloc(buf_len, 1);
-			memcpy(*metadata, *buffer, buf_len);
-			*buffer += buf_len;
+			*metadata = (zval *) pemalloc(zip_metadata_len, 1);
+			memcpy(*metadata, *buffer, zip_metadata_len);
 			return SUCCESS;
 		}
 	} else {
 		*metadata = NULL;
 	}

-	if (!zip_metadata_len) {
-		*buffer += buf_len;
-	}
-
 	return SUCCESS;
 }
 /* }}}*/
@@ -655,7 +644,7 @@ int phar_parse_metadata(char **buffer, zval **metadata, int zip_metadata_len TSR
 *
 * Parse a new one and add it to the cache, returning either SUCCESS or
 * FAILURE, and setting pphar to the pointer to the manifest entry
- * 
+ *
 * This is used by phar_open_from_filename to process the manifest, but can be called
 * directly.
 */
@@ -666,6 +655,7 @@ static int phar_parse_pharfile(php_stream *fp, char *fname, int fname_len, char
 	phar_entry_info entry;
 	php_uint32 manifest_len, manifest_count, manifest_flags, manifest_index, tmp_len, sig_flags;
 	php_uint16 manifest_ver;
+	php_uint32 len;
 	long offset;
 	int sig_len, register_alias = 0, temp_alias = 0;
 	char *signature = NULL;
@@ -1031,16 +1021,21 @@ static int phar_parse_pharfile(php_stream *fp, char *fname, int fname_len, char
 	mydata->is_persistent = PHAR_G(persist);

 	/* check whether we have meta data, zero check works regardless of byte order */
+	PHAR_GET_32(buffer, len);
 	if (mydata->is_persistent) {
-		PHAR_GET_32(buffer, mydata->metadata_len);
-		if (phar_parse_metadata(&buffer, &mydata->metadata, mydata->metadata_len TSRMLS_CC) == FAILURE) {
-			MAPPHAR_FAIL("unable to read phar metadata in .phar file \"%s\"");
-		}
-	} else {
-		if (phar_parse_metadata(&buffer, &mydata->metadata, 0 TSRMLS_CC) == FAILURE) {
-			MAPPHAR_FAIL("unable to read phar metadata in .phar file \"%s\"");
+		mydata->metadata_len = len;
+		if(!len) {
+			/* FIXME: not sure why this is needed but removing it breaks tests */
+			PHAR_GET_32(buffer, len);
 		}
 	}
+	if(len > endbuffer - buffer) {
+		MAPPHAR_FAIL("internal corruption of phar \"%s\" (trying to read past buffer end)");
+	}
+	if (phar_parse_metadata(&buffer, &mydata->metadata, len TSRMLS_CC) == FAILURE) {
+		MAPPHAR_FAIL("unable to read phar metadata in .phar file \"%s\"");
+	}
+	buffer += len;

 	/* set up our manifest */
 	zend_hash_init(&mydata->manifest, manifest_count,
@@ -1075,7 +1070,7 @@ static int phar_parse_pharfile(php_stream *fp, char *fname, int fname_len, char
 			entry.manifest_pos = manifest_index;
 		}

-		if (buffer + entry.filename_len + 20 > endbuffer) {
+		if (entry.filename_len + 20 > endbuffer - buffer) {
 			MAPPHAR_FAIL("internal corruption of phar \"%s\" (truncated manifest entry)");
 		}

@@ -1111,19 +1106,21 @@ static int phar_parse_pharfile(php_stream *fp, char *fname, int fname_len, char
 			entry.flags |= PHAR_ENT_PERM_DEF_DIR;
 		}

+		PHAR_GET_32(buffer, len);
 		if (entry.is_persistent) {
-			PHAR_GET_32(buffer, entry.metadata_len);
-			if (!entry.metadata_len) buffer -= 4;
-			if (phar_parse_metadata(&buffer, &entry.metadata, entry.metadata_len TSRMLS_CC) == FAILURE) {
-				pefree(entry.filename, entry.is_persistent);
-				MAPPHAR_FAIL("unable to read file metadata in .phar file \"%s\"");
-			}
+			entry.metadata_len = len;
 		} else {
-			if (phar_parse_metadata(&buffer, &entry.metadata, 0 TSRMLS_CC) == FAILURE) {
-				pefree(entry.filename, entry.is_persistent);
-				MAPPHAR_FAIL("unable to read file metadata in .phar file \"%s\"");
-			}
+			entry.metadata_len = 0;
 		}
+		if (len > endbuffer - buffer) {
+			pefree(entry.filename, entry.is_persistent);
+			MAPPHAR_FAIL("internal corruption of phar \"%s\" (truncated manifest entry)");
+		}
+		if (phar_parse_metadata(&buffer, &entry.metadata, len TSRMLS_CC) == FAILURE) {
+			pefree(entry.filename, entry.is_persistent);
+			MAPPHAR_FAIL("unable to read file metadata in .phar file \"%s\"");
+		}
+		buffer += len;

 		entry.offset = entry.offset_abs = offset;
 		offset += entry.compressed_filesize;
@@ -2241,7 +2238,7 @@ last_time:

 /**
 * Process a phar stream name, ensuring we can handle any of:
- * 
+ *
 * - whatever.phar
 * - whatever.phar.gz
 * - whatever.phar.bz2
@@ -618,10 +618,13 @@ static inline void phar_set_inode(phar_entry_info *entry TSRMLS_DC) /* {{{ */
 {
 	char tmp[MAXPATHLEN];
 	int tmp_len;
+	size_t len;

-	tmp_len = entry->filename_len + entry->phar->fname_len;
-	memcpy(tmp, entry->phar->fname, entry->phar->fname_len);
-	memcpy(tmp + entry->phar->fname_len, entry->filename, entry->filename_len);
+	tmp_len = MIN(MAXPATHLEN, entry->filename_len + entry->phar->fname_len);
+	len = MIN(entry->phar->fname_len, tmp_len);
+	memcpy(tmp, entry->phar->fname, len);
+	len = MIN(tmp_len - len, entry->filename_len);
+	memcpy(tmp + entry->phar->fname_len, entry->filename, len);
 	entry->inode = (unsigned short)zend_get_hash_value(tmp, tmp_len);
 }
 /* }}} */
@@ -654,7 +657,7 @@ int phar_mount_entry(phar_archive_data *phar, char *filename, int filename_len,
 char *phar_find_in_include_path(char *file, int file_len, phar_archive_data **pphar TSRMLS_DC);
 char *phar_fix_filepath(char *path, int *new_len, int use_cwd TSRMLS_DC);
 phar_entry_info * phar_open_jit(phar_archive_data *phar, phar_entry_info *entry, char **error TSRMLS_DC);
-int phar_parse_metadata(char **buffer, zval **metadata, int zip_metadata_len TSRMLS_DC);
+int phar_parse_metadata(char **buffer, zval **metadata, php_uint32 zip_metadata_len TSRMLS_DC);
 void destroy_phar_manifest_entry(void *pDest);
 int phar_seek_efp(phar_entry_info *entry, off_t offset, int whence, off_t position, int follow_links TSRMLS_DC);
 php_stream *phar_get_efp(phar_entry_info *entry, int follow_links TSRMLS_DC);
@@ -2211,8 +2211,8 @@ static zval *phar_rename_archive(phar_archive_data *phar, char *ext, zend_bool c
 	}
 its_ok:
 	if (SUCCESS == php_stream_stat_path(newpath, &ssb)) {
-		efree(oldpath);
 		zend_throw_exception_ex(spl_ce_BadMethodCallException, 0 TSRMLS_CC, "phar \"%s\" exists and must be unlinked prior to conversion", newpath);
+		efree(oldpath);
 		return NULL;
 	}
 	if (!phar->is_data) {
@@ -0,0 +1,17 @@
+--TEST--
+Bug #69324: Buffer Over-read in unserialize when parsing Phar
+--SKIPIF--
+<?php
+if (!extension_loaded("phar")) die("skip");
+?>
+--FILE--
+<?php
+try {
+$p = new Phar(dirname(__FILE__).'/bug69324.phar', 0);
+$meta=$p->getMetadata();
+var_dump($meta);
+} catch(Exception $e) {
+	echo $e->getMessage();
+}
+--EXPECTF--
+internal corruption of phar "%s" (truncated manifest entry)
@@ -0,0 +1,21 @@
+--TEST--
+Phar: bug #69441: Buffer Overflow when parsing tar/zip/phar in phar_set_inode
+--SKIPIF--
+<?php if (!extension_loaded("phar")) die("skip"); ?>
+--FILE--
+<?php
+$fname = dirname(__FILE__) . '/bug69441.phar';
+try {
+$r = new Phar($fname, 0);
+} catch(UnexpectedValueException $e) {
+	echo $e;
+}
+?>
+
+==DONE==
+--EXPECTF--
+exception 'UnexpectedValueException' with message 'phar error: corrupted central directory entry, no magic signature in zip-based phar "%s/bug69441.phar"' in %s/bug69441.php:%d
+Stack trace:
+#0 %s/bug69441.php(%d): Phar->__construct('%s', 0)
+#1 {main}
+==DONE==
@@ -404,12 +404,15 @@ static xmlNodePtr master_to_xml_int(encodePtr encode, zval *data, int style, xml
 		encodePtr enc = NULL;
 		HashTable *ht = Z_OBJPROP_P(data);

-		if (zend_hash_find(ht, "enc_type", sizeof("enc_type"), (void **)&ztype) == FAILURE) {
+		if (zend_hash_find(ht, "enc_type", sizeof("enc_type"), (void **)&ztype) == FAILURE ||
+		    Z_TYPE_PP(ztype) != IS_LONG) {
 			soap_error0(E_ERROR, "Encoding: SoapVar has no 'enc_type' property");
 		}

-		if (zend_hash_find(ht, "enc_stype", sizeof("enc_stype"), (void **)&zstype) == SUCCESS) {
-			if (zend_hash_find(ht, "enc_ns", sizeof("enc_ns"), (void **)&zns) == SUCCESS) {
+		if (zend_hash_find(ht, "enc_stype", sizeof("enc_stype"), (void **)&zstype) == SUCCESS &&
+		    Z_TYPE_PP(zstype) == IS_STRING) {
+			if (zend_hash_find(ht, "enc_ns", sizeof("enc_ns"), (void **)&zns) == SUCCESS &&
+			    Z_TYPE_PP(zns) == IS_STRING) {
 				enc = get_encoder(SOAP_GLOBAL(sdl), Z_STRVAL_PP(zns), Z_STRVAL_PP(zstype));
 			} else {
 				zns = NULL;
@@ -445,8 +448,10 @@ static xmlNodePtr master_to_xml_int(encodePtr encode, zval *data, int style, xml
 		}

 		if (style == SOAP_ENCODED || (SOAP_GLOBAL(sdl) && encode != enc)) {
-			if (zend_hash_find(ht, "enc_stype", sizeof("enc_stype"), (void **)&zstype) == SUCCESS) {
-				if (zend_hash_find(ht, "enc_ns", sizeof("enc_ns"), (void **)&zns) == SUCCESS) {
+			if (zend_hash_find(ht, "enc_stype", sizeof("enc_stype"), (void **)&zstype) == SUCCESS &&
+			    Z_TYPE_PP(zstype) == IS_STRING) {
+				if (zend_hash_find(ht, "enc_ns", sizeof("enc_ns"), (void **)&zns) == SUCCESS &&
+				    Z_TYPE_PP(zns) == IS_STRING) {
 					set_ns_and_type_ex(node, Z_STRVAL_PP(zns), Z_STRVAL_PP(zstype));
 				} else {
 					set_ns_and_type_ex(node, NULL, Z_STRVAL_PP(zstype));
@@ -454,10 +459,12 @@ static xmlNodePtr master_to_xml_int(encodePtr encode, zval *data, int style, xml
 			}
 		}

-		if (zend_hash_find(ht, "enc_name", sizeof("enc_name"), (void **)&zname) == SUCCESS) {
+		if (zend_hash_find(ht, "enc_name", sizeof("enc_name"), (void **)&zname) == SUCCESS &&
+		    Z_TYPE_PP(zname) == IS_STRING) {
 			xmlNodeSetName(node, BAD_CAST(Z_STRVAL_PP(zname)));
 		}
-		if (zend_hash_find(ht, "enc_namens", sizeof("enc_namens"), (void **)&znamens) == SUCCESS) {
+		if (zend_hash_find(ht, "enc_namens", sizeof("enc_namens"), (void **)&znamens) == SUCCESS &&
+		    Z_TYPE_PP(znamens) == IS_STRING) {
 			xmlNsPtr nsp = encode_add_ns(node, Z_STRVAL_PP(znamens));
 			xmlSetNs(node, nsp);
 		}
@@ -3649,18 +3656,21 @@ static encodePtr get_array_type(xmlNodePtr node, zval *array, smart_str *type TS
 		    Z_OBJCE_PP(tmp) == soap_var_class_entry) {
 			zval **ztype;

-			if (zend_hash_find(Z_OBJPROP_PP(tmp), "enc_type", sizeof("enc_type"), (void **)&ztype) == FAILURE) {
+			if (zend_hash_find(Z_OBJPROP_PP(tmp), "enc_type", sizeof("enc_type"), (void **)&ztype) == FAILURE ||
+			    Z_TYPE_PP(ztype) != IS_LONG) {
 				soap_error0(E_ERROR,  "Encoding: SoapVar has no 'enc_type' property");
 			}
 			cur_type = Z_LVAL_PP(ztype);

-			if (zend_hash_find(Z_OBJPROP_PP(tmp), "enc_stype", sizeof("enc_stype"), (void **)&ztype) == SUCCESS) {
+			if (zend_hash_find(Z_OBJPROP_PP(tmp), "enc_stype", sizeof("enc_stype"), (void **)&ztype) == SUCCESS &&
+			    Z_TYPE_PP(ztype) == IS_STRING) {
 				cur_stype = Z_STRVAL_PP(ztype);
 			} else {
 				cur_stype = NULL;
 			}

-			if (zend_hash_find(Z_OBJPROP_PP(tmp), "enc_ns", sizeof("enc_ns"), (void **)&ztype) == SUCCESS) {
+			if (zend_hash_find(Z_OBJPROP_PP(tmp), "enc_ns", sizeof("enc_ns"), (void **)&ztype) == SUCCESS &&
+			    Z_TYPE_PP(ztype) == IS_STRING) {
 				cur_ns = Z_STRVAL_PP(ztype);
 			} else {
 				cur_ns = NULL;
@@ -36,14 +36,16 @@ int proxy_authentication(zval* this_ptr, smart_str* soap_headers TSRMLS_DC)
 {
 	zval **login, **password;

-	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_proxy_login", sizeof("_proxy_login"), (void **)&login) == SUCCESS) {
+	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_proxy_login", sizeof("_proxy_login"), (void **)&login) == SUCCESS &&
+	    Z_TYPE_PP(login) == IS_STRING) {
 		unsigned char* buf;
 		int len;
 		smart_str auth = {0};

 		smart_str_appendl(&auth, Z_STRVAL_PP(login), Z_STRLEN_PP(login));
 		smart_str_appendc(&auth, ':');
-		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_proxy_password", sizeof("_proxy_password"), (void **)&password) == SUCCESS) {
+		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_proxy_password", sizeof("_proxy_password"), (void **)&password) == SUCCESS &&
+		    Z_TYPE_PP(password) == IS_STRING) {
 			smart_str_appendl(&auth, Z_STRVAL_PP(password), Z_STRLEN_PP(password));
 		}
 		smart_str_0(&auth);
@@ -64,14 +66,16 @@ int basic_authentication(zval* this_ptr, smart_str* soap_headers TSRMLS_DC)
 	zval **login, **password;

 	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_login", sizeof("_login"), (void **)&login) == SUCCESS &&
-			!zend_hash_exists(Z_OBJPROP_P(this_ptr), "_digest", sizeof("_digest"))) {
+	    Z_TYPE_PP(login) == IS_STRING &&
+	    !zend_hash_exists(Z_OBJPROP_P(this_ptr), "_digest", sizeof("_digest"))) {
 		unsigned char* buf;
 		int len;
 		smart_str auth = {0};

 		smart_str_appendl(&auth, Z_STRVAL_PP(login), Z_STRLEN_PP(login));
 		smart_str_appendc(&auth, ':');
-		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_password", sizeof("_password"), (void **)&password) == SUCCESS) {
+		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_password", sizeof("_password"), (void **)&password) == SUCCESS &&
+		    Z_TYPE_PP(password) == IS_STRING) {
 			smart_str_appendl(&auth, Z_STRVAL_PP(password), Z_STRLEN_PP(password));
 		}
 		smart_str_0(&auth);
@@ -509,6 +513,7 @@ try_again:
 		}
 		if (!http_1_1 ||
 			(zend_hash_find(Z_OBJPROP_P(this_ptr), "_keep_alive", sizeof("_keep_alive"), (void **)&tmp) == SUCCESS &&
+			 (Z_TYPE_PP(tmp) == IS_BOOL || Z_TYPE_PP(tmp) == IS_LONG) &&
 			 Z_LVAL_PP(tmp) == 0)) {
 			smart_str_append_const(&soap_headers, "\r\n"
 				"Connection: close\r\n");
@@ -742,7 +747,8 @@ try_again:
 		}

 		/* Send cookies along with request */
-		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_cookies", sizeof("_cookies"), (void **)&cookies) == SUCCESS) {
+		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_cookies", sizeof("_cookies"), (void **)&cookies) == SUCCESS &&
+		    Z_TYPE_PP(cookies) == IS_ARRAY) {
 			zval **data;
 			char *key;
 			int i, n;
@@ -785,7 +791,7 @@ try_again:
 		smart_str_append_const(&soap_headers, "\r\n");
 		smart_str_0(&soap_headers);
 		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "trace", sizeof("trace"), (void **) &trace) == SUCCESS &&
-		    Z_LVAL_PP(trace) > 0) {
+		    (Z_TYPE_PP(trace) == IS_BOOL || Z_TYPE_PP(trace) == IS_LONG) && Z_LVAL_PP(trace) != 0) {
 			add_property_stringl(this_ptr, "__last_request_headers", soap_headers.c, soap_headers.len, 1);
 		}
 		smart_str_appendl(&soap_headers, request, request_size);
@@ -830,7 +836,7 @@ try_again:
 		}

 		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "trace", sizeof("trace"), (void **) &trace) == SUCCESS &&
-		    Z_LVAL_PP(trace) > 0) {
+		    (Z_TYPE_PP(trace) == IS_BOOL || Z_TYPE_PP(trace) == IS_LONG) && Z_LVAL_PP(trace) != 0) {
 			add_property_stringl(this_ptr, "__last_response_headers", http_headers, http_header_size, 1);
 		}

@@ -879,7 +885,8 @@ try_again:
 		char *eqpos, *sempos;
 		zval **cookies;

-		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_cookies", sizeof("_cookies"), (void **)&cookies) == FAILURE) {
+		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_cookies", sizeof("_cookies"), (void **)&cookies) == FAILURE ||
+		    Z_TYPE_PP(cookies) != IS_ARRAY) {
 			zval *tmp_cookies;
 			MAKE_STD_ZVAL(tmp_cookies);
 			array_init(tmp_cookies);
@@ -100,6 +100,9 @@ xmlDocPtr soap_xmlParseFile(const char *filename TSRMLS_DC)
 		ctxt->sax->warning = NULL;
 		ctxt->sax->error = NULL;
 		/*ctxt->sax->fatalError = NULL;*/
+#if LIBXML_VERSION >= 20703
+		ctxt->options |= XML_PARSE_HUGE;
+#endif
 		old = php_libxml_disable_entity_loader(1 TSRMLS_CC);
 		xmlParseDocument(ctxt);
 		php_libxml_disable_entity_loader(old TSRMLS_CC);
@@ -924,6 +924,12 @@ PHP_METHOD(SoapFault, __toString)

 	zend_call_function(&fci, NULL TSRMLS_CC);

+	convert_to_string(faultcode);
+	convert_to_string(faultstring);
+	convert_to_string(file);
+	convert_to_long(line);
+	convert_to_string(trace);
+
 	len = spprintf(&str, 0, "SoapFault exception: [%s] %s in %s:%ld\nStack trace:\n%s",
 	               Z_STRVAL_P(faultcode), Z_STRVAL_P(faultstring), Z_STRVAL_P(file), Z_LVAL_P(line),
 	               Z_STRLEN_P(trace) ? Z_STRVAL_P(trace) : "#0 {main}\n");
@@ -2554,7 +2560,7 @@ static int do_request(zval *this_ptr, xmlDoc *request, char *location, char *act
 	}

 	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "trace", sizeof("trace"), (void **) &trace) == SUCCESS &&
-	    Z_LVAL_PP(trace) > 0) {
+	    (Z_TYPE_PP(trace) == IS_BOOL || Z_TYPE_PP(trace) == IS_LONG) && Z_LVAL_PP(trace) != 0) {
 		add_property_stringl(this_ptr, "__last_request", buf, buf_size, 1);
 	}

@@ -2594,7 +2600,7 @@ static int do_request(zval *this_ptr, xmlDoc *request, char *location, char *act
 		}
 		ret = FALSE;
 	} else if (zend_hash_find(Z_OBJPROP_P(this_ptr), "trace", sizeof("trace"), (void **) &trace) == SUCCESS &&
-	    Z_LVAL_PP(trace) > 0) {
+	           (Z_TYPE_PP(trace) == IS_BOOL || Z_TYPE_PP(trace) == IS_LONG) && Z_LVAL_PP(trace) != 0) {
 		add_property_stringl(this_ptr, "__last_response", Z_STRVAL_P(response), Z_STRLEN_P(response), 1);
 	}
 	xmlFree(buf);
@@ -2633,13 +2639,13 @@ static void do_soap_call(zval* this_ptr,

 	SOAP_CLIENT_BEGIN_CODE();

-	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "trace", sizeof("trace"), (void **) &trace) == SUCCESS
-		&& Z_LVAL_PP(trace) > 0) {
+	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "trace", sizeof("trace"), (void **) &trace) == SUCCESS &&
+	    (Z_TYPE_PP(trace) == IS_BOOL || Z_TYPE_PP(trace) == IS_LONG) && Z_LVAL_PP(trace) != 0) {
 		zend_hash_del(Z_OBJPROP_P(this_ptr), "__last_request", sizeof("__last_request"));
 		zend_hash_del(Z_OBJPROP_P(this_ptr), "__last_response", sizeof("__last_response"));
 	}
-	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_soap_version", sizeof("_soap_version"), (void **) &tmp) == SUCCESS
-		&& Z_LVAL_PP(tmp) == SOAP_1_2) {
+	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_soap_version", sizeof("_soap_version"), (void **) &tmp) == SUCCESS &&
+		Z_TYPE_PP(tmp) == IS_LONG && Z_LVAL_PP(tmp) == SOAP_1_2) {
 		soap_version = SOAP_1_2;
 	} else {
 		soap_version = SOAP_1_1;
@@ -2735,7 +2741,7 @@ static void do_soap_call(zval* this_ptr,
 		zval **uri;
 		smart_str action = {0};

-		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "uri", sizeof("uri"), (void *)&uri) == FAILURE) {
+		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "uri", sizeof("uri"), (void *)&uri) == FAILURE || Z_TYPE_PP(uri) != IS_STRING) {
 			add_soap_fault(this_ptr, "Client", "Error finding \"uri\" property", NULL, NULL TSRMLS_CC);
 		} else if (location == NULL) {
 			add_soap_fault(this_ptr, "Client", "Error could not find \"location\" property", NULL, NULL TSRMLS_CC);
@@ -2884,7 +2890,8 @@ PHP_METHOD(SoapClient, __call)
 	}

 	/* Add default headers */
-	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__default_headers", sizeof("__default_headers"), (void **) &tmp)==SUCCESS) {
+	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__default_headers", sizeof("__default_headers"), (void **) &tmp)==SUCCESS &&
+	    Z_TYPE_PP(tmp) == IS_ARRAY) {
 		HashTable *default_headers = Z_ARRVAL_P(*tmp);
 		if (soap_headers) {
 			if (!free_soap_headers) {
@@ -3005,7 +3012,8 @@ PHP_METHOD(SoapClient, __getLastRequest)
 		return;
 	}

-	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__last_request", sizeof("__last_request"), (void **)&tmp) == SUCCESS) {
+	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__last_request", sizeof("__last_request"), (void **)&tmp) == SUCCESS &&
+	    Z_TYPE_PP(tmp) == IS_STRING) {
 		RETURN_STRINGL(Z_STRVAL_PP(tmp), Z_STRLEN_PP(tmp), 1);
 	}
 	RETURN_NULL();
@@ -3023,7 +3031,8 @@ PHP_METHOD(SoapClient, __getLastResponse)
 		return;
 	}
 	
-	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__last_response", sizeof("__last_response"), (void **)&tmp) == SUCCESS) {
+	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__last_response", sizeof("__last_response"), (void **)&tmp) == SUCCESS &&
+	    Z_TYPE_PP(tmp) == IS_STRING) {
 		RETURN_STRINGL(Z_STRVAL_PP(tmp), Z_STRLEN_PP(tmp), 1);
 	}
 	RETURN_NULL();
@@ -3041,7 +3050,8 @@ PHP_METHOD(SoapClient, __getLastRequestHeaders)
 		return;
 	}
 	
-	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__last_request_headers", sizeof("__last_request_headers"), (void **)&tmp) == SUCCESS) {
+	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__last_request_headers", sizeof("__last_request_headers"), (void **)&tmp) == SUCCESS &&
+	    Z_TYPE_PP(tmp) == IS_STRING) {
 		RETURN_STRINGL(Z_STRVAL_PP(tmp), Z_STRLEN_PP(tmp), 1);
 	}
 	RETURN_NULL();
@@ -3059,7 +3069,8 @@ PHP_METHOD(SoapClient, __getLastResponseHeaders)
 		return;
 	}

-	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__last_response_headers", sizeof("__last_response_headers"), (void **)&tmp) == SUCCESS) {
+	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "__last_response_headers", sizeof("__last_response_headers"), (void **)&tmp) == SUCCESS &&
+	    Z_TYPE_PP(tmp) == IS_STRING) {
 		RETURN_STRINGL(Z_STRVAL_PP(tmp), Z_STRLEN_PP(tmp), 1);
 	}
 	RETURN_NULL();
@@ -3115,13 +3126,15 @@ PHP_METHOD(SoapClient, __setCookie)
 	}

 	if (val == NULL) {
-		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_cookies", sizeof("_cookies"), (void **)&cookies) == SUCCESS) {
+		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_cookies", sizeof("_cookies"), (void **)&cookies) == SUCCESS &&
+		    Z_TYPE_PP(cookies) == IS_ARRAY) {
 			zend_hash_del(Z_ARRVAL_PP(cookies), name, name_len+1);
 		}
 	} else {
 		zval *zcookie;

-		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_cookies", sizeof("_cookies"), (void **)&cookies) == FAILURE) {
+		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_cookies", sizeof("_cookies"), (void **)&cookies) == FAILURE ||
+		    Z_TYPE_PP(cookies) != IS_ARRAY) {
 			zval *tmp_cookies;

 			MAKE_STD_ZVAL(tmp_cookies);
@@ -3149,7 +3162,8 @@ PHP_METHOD(SoapClient, __getCookies)

 	array_init(return_value);

-	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_cookies", sizeof("_cookies"), (void **)&cookies) != FAILURE) {
+	if (zend_hash_find(Z_OBJPROP_P(this_ptr), "_cookies", sizeof("_cookies"), (void **)&cookies) != FAILURE &&
+	    Z_TYPE_PP(cookies) == IS_ARRAY) {
 		zend_hash_copy(Z_ARRVAL_P(return_value), Z_ARRVAL_P(*cookies), (copy_ctor_func_t) zval_add_ref, (void *)&tmp, sizeof(zval*));
 	}
 }
@@ -3971,7 +3985,8 @@ static xmlDocPtr serialize_response_call(sdlFunctionPtr function, char *function
 		}

 		if (version == SOAP_1_1) {
-			if (zend_hash_find(prop, "faultcode", sizeof("faultcode"), (void**)&tmp) == SUCCESS) {
+			if (zend_hash_find(prop, "faultcode", sizeof("faultcode"), (void**)&tmp) == SUCCESS &&
+			    Z_TYPE_PP(tmp) == IS_STRING) {
 				size_t new_len;
 				xmlNodePtr node = xmlNewNode(NULL, BAD_CAST("faultcode"));
 				char *str = php_escape_html_entities((unsigned char*)Z_STRVAL_PP(tmp), Z_STRLEN_PP(tmp), &new_len, 0, 0, NULL TSRMLS_CC);
@@ -3996,7 +4011,8 @@ static xmlDocPtr serialize_response_call(sdlFunctionPtr function, char *function
 			}
 			detail_name = "detail";
 		} else {
-			if (zend_hash_find(prop, "faultcode", sizeof("faultcode"), (void**)&tmp) == SUCCESS) {
+			if (zend_hash_find(prop, "faultcode", sizeof("faultcode"), (void**)&tmp) == SUCCESS &&
+			    Z_TYPE_PP(tmp) == IS_STRING) {
 				size_t new_len;
 				xmlNodePtr node = xmlNewChild(param, ns, BAD_CAST("Code"), NULL);
 				char *str = php_escape_html_entities((unsigned char*)Z_STRVAL_PP(tmp), Z_STRLEN_PP(tmp), &new_len, 0, 0, NULL TSRMLS_CC);
@@ -4236,7 +4252,8 @@ static xmlDocPtr serialize_function_call(zval *this_ptr, sdlFunctionPtr function
 			}
 		}
 	} else {
-		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "style", sizeof("style"), (void **)&zstyle) == SUCCESS) {
+		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "style", sizeof("style"), (void **)&zstyle) == SUCCESS &&
+		    Z_TYPE_PP(zstyle) == IS_LONG) {
 			style = Z_LVAL_PP(zstyle);
 		} else {
 			style = SOAP_RPC;
@@ -4259,7 +4276,7 @@ static xmlDocPtr serialize_function_call(zval *this_ptr, sdlFunctionPtr function
 		}

 		if (zend_hash_find(Z_OBJPROP_P(this_ptr), "use", sizeof("use"), (void **)&zuse) == SUCCESS &&
-			  Z_LVAL_PP(zuse) == SOAP_LITERAL) {
+		    Z_TYPE_PP(zuse) == IS_LONG && Z_LVAL_PP(zuse) == SOAP_LITERAL) {
 			use = SOAP_LITERAL;
 		} else {
 			use = SOAP_ENCODED;
@@ -4389,6 +4406,7 @@ static xmlNodePtr serialize_parameter(sdlParamPtr param, zval *param_val, int in
 		zval **param_data;

 		if (zend_hash_find(Z_OBJPROP_P(param_val), "param_name", sizeof("param_name"), (void **)&param_name) == SUCCESS &&
+		    Z_TYPE_PP(param_name) == IS_STRING &&
 		    zend_hash_find(Z_OBJPROP_P(param_val), "param_data", sizeof("param_data"), (void **)&param_data) == SUCCESS) {
 			param_val = *param_data;
 			name = Z_STRVAL_PP(param_name);
@@ -1274,6 +1274,8 @@ PHP_METHOD(sqlite3stmt, paramCount)
 	php_sqlite3_stmt *stmt_obj;
 	zval *object = getThis();
 	stmt_obj = (php_sqlite3_stmt *)zend_object_store_get_object(object TSRMLS_CC);
+	
+	SQLITE3_CHECK_INITIALIZED(stmt_obj->db_obj, stmt_obj->initialised, SQLite3)

 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
@@ -1290,6 +1292,8 @@ PHP_METHOD(sqlite3stmt, close)
 	php_sqlite3_stmt *stmt_obj;
 	zval *object = getThis();
 	stmt_obj = (php_sqlite3_stmt *)zend_object_store_get_object(object TSRMLS_CC);
+	
+	SQLITE3_CHECK_INITIALIZED(stmt_obj->db_obj, stmt_obj->initialised, SQLite3)

 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
@@ -1308,6 +1312,8 @@ PHP_METHOD(sqlite3stmt, reset)
 	php_sqlite3_stmt *stmt_obj;
 	zval *object = getThis();
 	stmt_obj = (php_sqlite3_stmt *)zend_object_store_get_object(object TSRMLS_CC);
+	
+	SQLITE3_CHECK_INITIALIZED(stmt_obj->db_obj, stmt_obj->initialised, SQLite3)

 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
@@ -1328,6 +1334,8 @@ PHP_METHOD(sqlite3stmt, clear)
 	php_sqlite3_stmt *stmt_obj;
 	zval *object = getThis();
 	stmt_obj = (php_sqlite3_stmt *)zend_object_store_get_object(object TSRMLS_CC);
+	
+	SQLITE3_CHECK_INITIALIZED(stmt_obj->db_obj, stmt_obj->initialised, SQLite3)

 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
@@ -1349,6 +1357,8 @@ PHP_METHOD(sqlite3stmt, readOnly)
 	php_sqlite3_stmt *stmt_obj;
 	zval *object = getThis();
 	stmt_obj = (php_sqlite3_stmt *)zend_object_store_get_object(object TSRMLS_CC);
+	
+	SQLITE3_CHECK_INITIALIZED(stmt_obj->db_obj, stmt_obj->initialised, SQLite3)

 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
@@ -1416,6 +1426,8 @@ PHP_METHOD(sqlite3stmt, bindParam)
 	zval *object = getThis();
 	struct php_sqlite3_bound_param param = {0};
 	stmt_obj = (php_sqlite3_stmt *)zend_object_store_get_object(object TSRMLS_CC);
+	
+	SQLITE3_CHECK_INITIALIZED(stmt_obj->db_obj, stmt_obj->initialised, SQLite3)

 	param.param_number = -1;
 	param.type = SQLITE3_TEXT;
@@ -1447,6 +1459,8 @@ PHP_METHOD(sqlite3stmt, bindValue)
 	zval *object = getThis();
 	struct php_sqlite3_bound_param param = {0};
 	stmt_obj = (php_sqlite3_stmt *)zend_object_store_get_object(object TSRMLS_CC);
+	
+	SQLITE3_CHECK_INITIALIZED(stmt_obj->db_obj, stmt_obj->initialised, SQLite3)

 	param.param_number = -1;
 	param.type = SQLITE3_TEXT;
@@ -1482,6 +1496,8 @@ PHP_METHOD(sqlite3stmt, execute)

 	stmt_obj = (php_sqlite3_stmt *)zend_object_store_get_object(object TSRMLS_CC);

+	SQLITE3_CHECK_INITIALIZED(stmt_obj->db_obj, stmt_obj->initialised, SQLite3)
+
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
 	}
@@ -0,0 +1,23 @@
+--TEST--
+Bug #66550 (SQLite prepared statement use-after-free)
+--SKIPIF--
+<?php
+if (!extension_loaded('sqlite3')) die('skip');
+?>
+--FILE--
+<?php
+
+$db = new SQLite3(':memory:');
+
+$db->exec('CREATE TABLE foo (id INTEGER, bar STRING)');
+
+$stmt = $db->prepare('SELECT bar FROM foo WHERE id=:id');
+// Close the database connection and free the internal sqlite3_stmt object
+$db->close();
+// Access the sqlite3_stmt object via the php_sqlite3_stmt container
+$stmt->reset();
+?>
+==DONE==
+--EXPECTF--
+Warning: SQLite3Stmt::reset(): The SQLite3 object has not been correctly initialised in %s
+==DONE==
@@ -5775,7 +5775,7 @@ PHP_FUNCTION(move_uploaded_file)
 		RETURN_FALSE;
 	}

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ss", &path, &path_len, &new_path, &new_path_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "sp", &path, &path_len, &new_path, &new_path_len) == FAILURE) {
 		return;
 	}

@@ -170,7 +170,7 @@ main() {
  ac_cv_crypt_blowfish=no
 ])])

-AC_CACHE_CHECK(for SHA512 crypt, ac_cv_crypt_SHA512,[
+AC_CACHE_CHECK(for SHA512 crypt, ac_cv_crypt_sha512,[
 AC_TRY_RUN([
 #if HAVE_UNISTD_H
 #include <unistd.h>
@@ -192,14 +192,14 @@ main() {
 	exit(0);
 #endif
 }],[
-  ac_cv_crypt_SHA512=yes
+  ac_cv_crypt_sha512=yes
 ],[
-  ac_cv_crypt_SHA512=no
+  ac_cv_crypt_sha512=no
 ],[
-  ac_cv_crypt_SHA512=no
+  ac_cv_crypt_sha512=no
 ])])

-AC_CACHE_CHECK(for SHA256 crypt, ac_cv_crypt_SHA256,[
+AC_CACHE_CHECK(for SHA256 crypt, ac_cv_crypt_sha256,[
 AC_TRY_RUN([
 #if HAVE_UNISTD_H
 #include <unistd.h>
@@ -221,11 +221,11 @@ main() {
 	exit(0);
 #endif
 }],[
-  ac_cv_crypt_SHA256=yes
+  ac_cv_crypt_sha256=yes
 ],[
-  ac_cv_crypt_SHA256=no
+  ac_cv_crypt_sha256=no
 ],[
-  ac_cv_crypt_SHA256=no
+  ac_cv_crypt_sha256=no
 ])])


@@ -204,7 +204,7 @@ PHP_FUNCTION(crypt)
 			salt[salt_in_len] = '\0';

 			crypt_res = php_sha512_crypt_r(str, salt, output, needed);
-			if (!crypt_res) {
+			if (!crypt_res || (salt[0]=='*' && salt[1]=='0')) {
 				if (salt[0]=='*' && salt[1]=='0') {
 					RETVAL_STRING("*1", 1);
 				} else {
@@ -227,7 +227,7 @@ PHP_FUNCTION(crypt)
 			salt[salt_in_len] = '\0';

 			crypt_res = php_sha256_crypt_r(str, salt, output, needed);
-			if (!crypt_res) {
+			if (!crypt_res || (salt[0]=='*' && salt[1]=='0')) {
 				if (salt[0]=='*' && salt[1]=='0') {
 					RETVAL_STRING("*1", 1);
 				} else {
@@ -242,7 +242,6 @@ PHP_FUNCTION(crypt)
 		} else if (
 				salt[0] == '$' &&
 				salt[1] == '2' &&
-				salt[2] >= 'a' && salt[2] <= 'z' &&
 				salt[3] == '$' &&
 				salt[4] >= '0' && salt[4] <= '3' &&
 				salt[5] >= '0' && salt[5] <= '9' &&
@@ -252,7 +251,7 @@ PHP_FUNCTION(crypt)
 			memset(output, 0, PHP_MAX_SALT_LEN + 1);

 			crypt_res = php_crypt_blowfish_rn(str, salt, output, sizeof(output));
-			if (!crypt_res) {
+			if (!crypt_res || (salt[0]=='*' && salt[1]=='0')) {
 				if (salt[0]=='*' && salt[1]=='0') {
 					RETVAL_STRING("*1", 1);
 				} else {
@@ -268,7 +267,7 @@ PHP_FUNCTION(crypt)
 			_crypt_extended_init_r();

 			crypt_res = _crypt_extended_r(str, salt, &buffer);
-			if (!crypt_res) {
+			if (!crypt_res || (salt[0]=='*' && salt[1]=='0')) {
 				if (salt[0]=='*' && salt[1]=='0') {
 					RETURN_STRING("*1", 1);
 				} else {
@@ -292,7 +291,7 @@ PHP_FUNCTION(crypt)
 #    error Data struct used by crypt_r() is unknown. Please report.
 #  endif
 		crypt_res = crypt_r(str, salt, &buffer);
-		if (!crypt_res) {
+		if (!crypt_res || (salt[0]=='*' && salt[1]=='0')) {
 				if (salt[0]=='*' && salt[1]=='0') {
 					RETURN_STRING("*1", 1);
 				} else {
@@ -8,11 +8,11 @@
 * and crypt(3) interfaces added, but optimizations specific to password
 * cracking removed.
 *
- * Written by Solar Designer <solar at openwall.com> in 1998-2011.
+ * Written by Solar Designer <solar at openwall.com> in 1998-2014.
 * No copyright is claimed, and the software is hereby placed in the public
 * domain. In case this attempt to disclaim copyright and place the software
 * in the public domain is deemed null and void, then the software is
- * Copyright (c) 1998-2011 Solar Designer and it is hereby released to the
+ * Copyright (c) 1998-2014 Solar Designer and it is hereby released to the
 * general public under the following terms:
 *
 * Redistribution and use in source and binary forms, with or without
@@ -28,12 +28,12 @@
 * you place this code and any modifications you make under a license
 * of your choice.
 *
- * This implementation is mostly compatible with OpenBSD's bcrypt.c (prefix
- * "$2a$") by Niels Provos <provos at citi.umich.edu>, and uses some of his
- * ideas. The password hashing algorithm was designed by David Mazieres
- * <dm at lcs.mit.edu>. For more information on the level of compatibility,
- * please refer to the comments in BF_set_key() below and to the crypt(3)
- * man page included in the crypt_blowfish tarball.
+ * This implementation is fully compatible with OpenBSD's bcrypt.c for prefix
+ * "$2b$", originally by Niels Provos <provos at citi.umich.edu>, and it uses
+ * some of his ideas. The password hashing algorithm was designed by David
+ * Mazieres <dm at lcs.mit.edu>. For information on the level of
+ * compatibility for bcrypt hash prefixes other than "$2b$", please refer to
+ * the comments in BF_set_key() below and to the included crypt(3) man page.
 *
 * There's a paper on the algorithm that explains its design decisions:
 *
@@ -583,6 +583,7 @@ static void BF_set_key(const char *key, BF_key expanded, BF_key initial,
 * Valid combinations of settings are:
 *
 * Prefix "$2a$": bug = 0, safety = 0x10000
+ * Prefix "$2b$": bug = 0, safety = 0
 * Prefix "$2x$": bug = 1, safety = 0
 * Prefix "$2y$": bug = 0, safety = 0
 */
@@ -646,6 +647,10 @@ static void BF_set_key(const char *key, BF_key expanded, BF_key initial,
 	initial[0] ^= sign;
 }

+static const unsigned char flags_by_subtype[26] =
+	{2, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 4, 0};
+
 static char *BF_crypt(const char *key, const char *setting,
 	char *output, int size,
 	BF_word min)
@@ -653,9 +658,6 @@ static char *BF_crypt(const char *key, const char *setting,
 #if BF_ASM
 	extern void _BF_body_r(BF_ctx *ctx);
 #endif
-	static const unsigned char flags_by_subtype[26] =
-		{2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
-		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 4, 0};
 	struct {
 		BF_ctx ctx;
 		BF_key expanded_key;
@@ -821,9 +823,10 @@ char *php_crypt_blowfish_rn(const char *key, const char *setting,
 {
 	const char *test_key = "8b \xd0\xc1\xd2\xcf\xcc\xd8";
 	const char *test_setting = "$2a$00$abcdefghijklmnopqrstuu";
-	static const char * const test_hash[2] =
-		{"VUrPmXD6q/nVSSp7pNDhCR9071IfIRe\0\x55", /* $2x$ */
-		"i1D709vfamulimlGcq0qq3UvuUasvEa\0\x55"}; /* $2a$, $2y$ */
+	static const char * const test_hashes[2] =
+		{"i1D709vfamulimlGcq0qq3UvuUasvEa\0\x55", /* 'a', 'b', 'y' */
+		"VUrPmXD6q/nVSSp7pNDhCR9071IfIRe\0\x55"}; /* 'x' */
+	const char *test_hash = test_hashes[0];
 	char *retval;
 	const char *p;
 	int save_errno, ok;
@@ -845,17 +848,19 @@ char *php_crypt_blowfish_rn(const char *key, const char *setting,
 * detected by the self-test.
 */
 	memcpy(buf.s, test_setting, sizeof(buf.s));
-	if (retval)
+	if (retval) {
+		unsigned int flags = flags_by_subtype[
+		    (unsigned int)(unsigned char)setting[2] - 'a'];
+		test_hash = test_hashes[flags & 1];
 		buf.s[2] = setting[2];
+	}
 	memset(buf.o, 0x55, sizeof(buf.o));
 	buf.o[sizeof(buf.o) - 1] = 0;
 	p = BF_crypt(test_key, buf.s, buf.o, sizeof(buf.o) - (1 + 1), 1);

 	ok = (p == buf.o &&
 	    !memcmp(p, buf.s, 7 + 22) &&
-	    !memcmp(p + (7 + 22),
-	    test_hash[(unsigned int)(unsigned char)buf.s[2] & 1],
-	    31 + 1 + 1 + 1));
+	    !memcmp(p + (7 + 22), test_hash, 31 + 1 + 1 + 1));

 	{
 		const char *k = "\xff\xa3" "34" "\xff\xff\xff\xa3" "345";
@@ -885,7 +890,7 @@ char *_crypt_gensalt_blowfish_rn(const char *prefix, unsigned long count,
 	if (size < 16 || output_size < 7 + 22 + 1 ||
 	    (count && (count < 4 || count > 31)) ||
 	    prefix[0] != '$' || prefix[1] != '2' ||
-	    (prefix[2] != 'a' && prefix[2] != 'y')) {
+	    (prefix[2] != 'a' && prefix[2] != 'b' && prefix[2] != 'y')) {
 		if (output_size > 0) output[0] = '\0';
 		__set_errno((output_size < 7 + 22 + 1) ? ERANGE : EINVAL);
 		return NULL;
@@ -222,6 +222,11 @@ PHP_FUNCTION(gethostbyname)
 		return;
 	}

+	if(hostname_len > MAXFQDNLEN) {
+		/* name too long, protect from CVE-2015-0235 */
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Host name is too long, the limit is %d characters", MAXFQDNLEN);
+		RETURN_STRINGL(hostname, hostname_len, 1);
+	}
 	addr = php_gethostbyname(hostname);

 	RETVAL_STRING(addr, 0);
@@ -242,6 +247,12 @@ PHP_FUNCTION(gethostbynamel)
 		return;
 	}

+	if(hostname_len > MAXFQDNLEN) {
+		/* name too long, protect from CVE-2015-0235 */
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Host name is too long, the limit is %d characters", MAXFQDNLEN);
+		RETURN_FALSE;
+	}
+
 	hp = gethostbyname(hostname);
 	if (hp == NULL || hp->h_addr_list == NULL) {
 		RETURN_FALSE;
@@ -188,6 +188,10 @@ static void php_exec_ex(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot execute a blank command");
 		RETURN_FALSE;
 	}
+	if (strlen(cmd) != cmd_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "NULL byte detected. Possible attack");
+		RETURN_FALSE;
+	}

 	if (!ret_array) {
 		ret = php_exec(mode, cmd, NULL, return_value TSRMLS_CC);
@@ -19,7 +19,7 @@
   |          Sara Golemon <pollita@php.net>                              |
   +----------------------------------------------------------------------+
 */
-/* $Id$ */ 
+/* $Id$ */

 #include "php.h"
 #include "php_globals.h"
@@ -152,7 +152,7 @@ php_stream *php_stream_url_wrap_http_ex(php_stream_wrapper *wrapper, char *path,
 	}

 	if (strncasecmp(resource->scheme, "http", sizeof("http")) && strncasecmp(resource->scheme, "https", sizeof("https"))) {
-		if (!context || 
+		if (!context ||
 			php_stream_context_get_option(context, wrapper->wops->label, "proxy", &tmpzval) == FAILURE ||
 			Z_TYPE_PP(tmpzval) != IS_STRING ||
 			Z_STRLEN_PP(tmpzval) <= 0) {
@@ -168,7 +168,7 @@ php_stream *php_stream_url_wrap_http_ex(php_stream_wrapper *wrapper, char *path,
 		transport_string = estrndup(Z_STRVAL_PP(tmpzval), Z_STRLEN_PP(tmpzval));
 	} else {
 		/* Normal http request (possibly with proxy) */
-	
+
 		if (strpbrk(mode, "awx+")) {
 			php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "HTTP wrapper does not support writeable connections");
 			php_url_free(resource);
@@ -207,11 +207,11 @@ php_stream *php_stream_url_wrap_http_ex(php_stream_wrapper *wrapper, char *path,
 	stream = php_stream_xport_create(transport_string, transport_len, options,
 			STREAM_XPORT_CLIENT | STREAM_XPORT_CONNECT,
 			NULL, &timeout, context, &errstr, NULL);
-    
+
 	if (stream) {
 		php_stream_set_option(stream, PHP_STREAM_OPTION_READ_TIMEOUT, 0, &timeout);
 	}
-			
+
 	if (errstr) {
 		php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "%s", errstr);
 		efree(errstr);
@@ -328,7 +328,7 @@ finish:
 	/* avoid buffering issues while reading header */
 	if (options & STREAM_WILL_CAST)
 		chunk_size = php_stream_set_chunk_size(stream, 1);
-	
+
 	/* avoid problems with auto-detecting when reading the headers -> the headers
 	 * are always in canonical \r\n format */
 	eol_detect = stream->flags & (PHP_STREAM_FLAG_DETECT_EOL | PHP_STREAM_FLAG_EOL_MAC);
@@ -359,7 +359,7 @@ finish:
 			}
 		}
 	}
- 
+
 	if (context && php_stream_context_get_option(context, "http", "protocol_version", &tmpzval) == SUCCESS) {
 		SEPARATE_ZVAL(tmpzval);
 		convert_to_double_ex(tmpzval);
@@ -420,7 +420,7 @@ finish:

 	if (context && php_stream_context_get_option(context, "http", "header", &tmpzval) == SUCCESS) {
 		tmp = NULL;
-		
+
 		if (Z_TYPE_PP(tmpzval) == IS_ARRAY) {
 			HashPosition pos;
 			zval **tmpheader = NULL;
@@ -460,42 +460,42 @@ finish:
 				strip_header(user_headers, tmp, "content-type:");
 			}

-			if ((s = strstr(tmp, "user-agent:")) && 
-			    (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' || 
+			if ((s = strstr(tmp, "user-agent:")) &&
+			    (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' ||
 			                 *(s-1) == '\t' || *(s-1) == ' ')) {
 				 have_header |= HTTP_HEADER_USER_AGENT;
 			}
 			if ((s = strstr(tmp, "host:")) &&
-			    (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' || 
+			    (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' ||
 			                 *(s-1) == '\t' || *(s-1) == ' ')) {
 				 have_header |= HTTP_HEADER_HOST;
 			}
 			if ((s = strstr(tmp, "from:")) &&
-			    (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' || 
+			    (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' ||
 			                 *(s-1) == '\t' || *(s-1) == ' ')) {
 				 have_header |= HTTP_HEADER_FROM;
 				}
 			if ((s = strstr(tmp, "authorization:")) &&
-			    (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' || 
+			    (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' ||
 			                 *(s-1) == '\t' || *(s-1) == ' ')) {
 				 have_header |= HTTP_HEADER_AUTH;
 			}
 			if ((s = strstr(tmp, "content-length:")) &&
-			    (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' || 
+			    (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' ||
 			                 *(s-1) == '\t' || *(s-1) == ' ')) {
 				 have_header |= HTTP_HEADER_CONTENT_LENGTH;
 			}
 			if ((s = strstr(tmp, "content-type:")) &&
-			    (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' || 
+			    (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' ||
 			                 *(s-1) == '\t' || *(s-1) == ' ')) {
 				 have_header |= HTTP_HEADER_TYPE;
 			}
 			/* remove Proxy-Authorization header */
 			if (use_proxy && use_ssl && (s = strstr(tmp, "proxy-authorization:")) &&
-			    (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' || 
+			    (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' ||
 			                 *(s-1) == '\t' || *(s-1) == ' ')) {
 				char *p = s + sizeof("proxy-authorization:") - 1;
-				
+
 				while (s > tmp && (*(s-1) == ' ' || *(s-1) == '\t')) s--;
 				while (*p != 0 && *p != '\r' && *p != '\n') p++;
 				while (*p == '\r' || *p == '\n') p++;
@@ -534,7 +534,7 @@ finish:
 		}

 		tmp = (char*)php_base64_encode((unsigned char*)scratch, strlen(scratch), NULL);
-		
+
 		if (snprintf(scratch, scratch_len, "Authorization: Basic %s\r\n", tmp) > 0) {
 			php_stream_write(stream, scratch, strlen(scratch));
 			php_stream_notify_info(context, PHP_STREAM_NOTIFY_AUTH_REQUIRED, NULL, 0);
@@ -552,7 +552,7 @@ finish:

 	/* Send Host: header so name-based virtual hosts work */
 	if ((have_header & HTTP_HEADER_HOST) == 0) {
-		if ((use_ssl && resource->port != 443 && resource->port != 0) || 
+		if ((use_ssl && resource->port != 443 && resource->port != 0) ||
 			(!use_ssl && resource->port != 80 && resource->port != 0)) {
 			if (snprintf(scratch, scratch_len, "Host: %s:%i\r\n", resource->host, resource->port) > 0)
 				php_stream_write(stream, scratch, strlen(scratch));
@@ -563,7 +563,7 @@ finish:
 		}
 	}

-	if (context && 
+	if (context &&
 	    php_stream_context_get_option(context, "http", "user_agent", &ua_zval) == SUCCESS &&
 		Z_TYPE_PP(ua_zval) == IS_STRING) {
 		ua_str = Z_STRVAL_PP(ua_zval);
@@ -575,9 +575,9 @@ finish:
 #define _UA_HEADER "User-Agent: %s\r\n"
 		char *ua;
 		size_t ua_len;
-		
+
 		ua_len = sizeof(_UA_HEADER) + strlen(ua_str);
-		
+
 		/* ensure the header is only sent if user_agent is not blank */
 		if (ua_len > sizeof(_UA_HEADER)) {
 			ua = emalloc(ua_len + 1);
@@ -591,7 +591,7 @@ finish:
 			if (ua) {
 				efree(ua);
 			}
-		}	
+		}
 	}

 	if (user_headers) {
@@ -649,8 +649,12 @@ finish:

 	{
 		zval **rh;
-		zend_hash_find(EG(active_symbol_table), "http_response_header", sizeof("http_response_header"), (void **) &rh);
+		if(zend_hash_find(EG(active_symbol_table), "http_response_header", sizeof("http_response_header"), (void **) &rh) != SUCCESS || Z_TYPE_PP(rh) != IS_ARRAY) {
+			php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "HTTP request failed, http_response_header overwritten");
+			goto out;
+		}
 		response_header = *rh;
+		Z_ADDREF_P(response_header);
 	}

 	if (!php_stream_eof(stream)) {
@@ -706,9 +710,9 @@ finish:
 		php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "HTTP request failed, unexpected end of socket!");
 		goto out;
 	}
-	
+
 	/* read past HTTP headers */
-	
+
 	http_header_line = emalloc(HTTP_HEADER_BLOCK_SIZE);

 	while (!body && !php_stream_eof(stream)) {
@@ -738,7 +742,7 @@ finish:
 					follow_location = Z_LVAL_PP(tmpzval);
 				} else if (!(response_code >= 300 && response_code < 304 || 307 == response_code || 308 == response_code)) {
 					/* we shouldn't redirect automatically
-					if follow_location isn't set and response_code not in (300, 301, 302, 303 and 307) 
+					if follow_location isn't set and response_code not in (300, 301, 302, 303 and 307)
 					see http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.3.1
 					RFC 7238 defines 308: http://tools.ietf.org/html/rfc7238 */
 					follow_location = 0;
@@ -778,7 +782,7 @@ finish:
 				MAKE_STD_ZVAL(http_header);

 				ZVAL_STRINGL(http_header, http_header_line, http_header_line_length, 1);
-				
+
 				zend_hash_next_index_insert(Z_ARRVAL_P(response_header), &http_header, sizeof(zval *), NULL);
 			}
 		} else {
@@ -803,10 +807,10 @@ finish:
 			char loc_path[HTTP_HEADER_BLOCK_SIZE];

 			*new_path='\0';
-			if (strlen(location)<8 || (strncasecmp(location, "http://", sizeof("http://")-1) && 
-							strncasecmp(location, "https://", sizeof("https://")-1) && 
-							strncasecmp(location, "ftp://", sizeof("ftp://")-1) && 
-							strncasecmp(location, "ftps://", sizeof("ftps://")-1))) 
+			if (strlen(location)<8 || (strncasecmp(location, "http://", sizeof("http://")-1) &&
+							strncasecmp(location, "https://", sizeof("https://")-1) &&
+							strncasecmp(location, "ftp://", sizeof("ftp://")-1) &&
+							strncasecmp(location, "ftps://", sizeof("ftps://")-1)))
 			{
 				if (*location != '/') {
 					if (*(location+1) != '\0' && resource->path) {
@@ -820,7 +824,7 @@ finish:
 								*s = '/';
 							}
 						}
-						s[1] = '\0'; 
+						s[1] = '\0';
 						if (resource->path && *(resource->path) == '/' && *(resource->path + 1) == '\0') {
 							snprintf(loc_path, sizeof(loc_path) - 1, "%s%s", resource->path, location);
 						} else {
@@ -893,18 +897,21 @@ out:

 	if (stream) {
 		if (header_init) {
-			zval_add_ref(&response_header);
 			stream->wrapperdata = response_header;
+		} else {
+			if(response_header) {
+				Z_DELREF_P(response_header);
+			}
 		}
 		php_stream_notify_progress_init(context, 0, file_size);
-		
+
 		/* Restore original chunk size now that we're done with headers */
 		if (options & STREAM_WILL_CAST)
 			php_stream_set_chunk_size(stream, chunk_size);

 		/* restore the users auto-detect-line-endings setting */
 		stream->flags |= eol_detect;
-		
+
 		/* as far as streams are concerned, we are now at the start of
 		 * the stream */
 		stream->position = 0;
@@ -915,8 +922,13 @@ out:
 		if (transfer_encoding) {
 			php_stream_filter_append(&stream->readfilters, transfer_encoding);
 		}
-	} else if (transfer_encoding) {
-		php_stream_filter_free(transfer_encoding TSRMLS_CC);
+	} else {
+		if(response_header) {
+			Z_DELREF_P(response_header);
+		}
+		if (transfer_encoding) {
+			php_stream_filter_free(transfer_encoding TSRMLS_CC);
+		}
 	}

 	return stream;
@@ -144,7 +144,7 @@ PHPAPI char *php_lookup_class_name(zval *object, zend_uint *nlen)

 	object_properties = Z_OBJPROP_P(object);

-	if (zend_hash_find(object_properties, MAGIC_MEMBER, sizeof(MAGIC_MEMBER), (void **) &val) == SUCCESS) {
+	if (zend_hash_find(object_properties, MAGIC_MEMBER, sizeof(MAGIC_MEMBER), (void **) &val) == SUCCESS && Z_TYPE_PP(val) == IS_STRING) {
 		retval = estrndup(Z_STRVAL_PP(val), Z_STRLEN_PP(val));

 		if (nlen) {
@@ -59,7 +59,7 @@ PHP_FUNCTION(readlink)
 	char buff[MAXPATHLEN];
 	int ret;

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &link, &link_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &link, &link_len) == FAILURE) {
 		return;
 	}

@@ -1549,7 +1549,7 @@ PHP_FUNCTION(stream_resolve_include_path)
 	char *filename, *resolved_path;
 	int filename_len;

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &filename, &filename_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &filename, &filename_len) == FAILURE) {
 		return;
 	}

@@ -117,11 +117,11 @@ PHPAPI int strnatcmp_ex(char const *a, size_t a_len, char const *b, size_t b_len
 		ca = *ap; cb = *bp;

 		/* skip over leading zeros */
-		while (leading && ca == '0' && (ap+1 < aend) && isdigit(*(ap+1))) {
+		while (leading && ca == '0' && (ap+1 < aend) && isdigit((int)(unsigned char)*(ap+1))) {
 			ca = *++ap;
 		}

-		while (leading && cb == '0' && (bp+1 < bend) && isdigit(*(bp+1))) {
+		while (leading && cb == '0' && (bp+1 < bend) && isdigit((int)(unsigned char)*(bp+1))) {
 			cb = *++bp;
 		}

@@ -65,7 +65,7 @@ bool(false)
 Warning: readlink(): %s in %s on line %d
 bool(false)

-Warning: readlink() expects parameter 1 to be string, resource given in %s on line %d
+Warning: readlink() expects parameter 1 to be a valid path, resource given in %s on line %d
 NULL

 Warning: readlink(): %s in %s on line %d
@@ -1,14 +1,15 @@
 --TEST--
 Bug #60227 (header() cannot detect the multi-line header with CR), \r before \n
+--INI--
+expose_php=0
 --FILE--
 <?php
 header("X-foo: e\n foo");
-header("X-Foo6: e\rSet-Cookie: ID=123\n d");
 echo 'foo';
 ?>
 --EXPECTF--
+
 Warning: Header may not contain more than a single header, new line detected in %s on line %d
 foo
 --EXPECTHEADERS--
-X-foo: e
-foo
+Content-type: text/html
@@ -1,8 +1,9 @@
 --TEST--
 Bug #60227 (header() cannot detect the multi-line header with CR), \0 before \n
+--INI--
+expose_php=0
 --FILE--
 <?php
-header("X-foo: e\n foo");
 header("X-Foo6: e\0Set-Cookie: ID=\n123\n d");
 echo 'foo';
 ?>
@@ -10,5 +11,4 @@ echo 'foo';
 Warning: Header may not contain NUL bytes in %s on line %d
 foo
 --EXPECTHEADERS--
-X-foo: e
-foo
+Content-type: text/html
@@ -1,8 +1,9 @@
 --TEST--
 Bug #60227 (header() cannot detect the multi-line header with CR), CRLF
+--INI--
+expose_php=0
 --FILE--
 <?php
-header("X-foo: e\r\n foo");
 header("X-foo: e\r\nfoo");
 echo 'foo';
 ?>
@@ -10,5 +11,4 @@ echo 'foo';
 Warning: Header may not contain more than a single header, new line detected in %s on line %d
 foo
 --EXPECTHEADERS--
-X-foo: e
- foo
+Content-type: text/html
@@ -0,0 +1,41 @@
+--TEST--
+Bug #69337 (Stream context leaks when http request fails)
+--SKIPIF--
+<?php require 'server.inc'; http_server_skipif('tcp://127.0.0.1:22345'); ?>
+--INI--
+allow_url_fopen=1
+allow_url_include=1
+--FILE--
+<?php
+require 'server.inc';
+
+function stream_notification_callback($notification_code, $severity, $message, $message_code, $bytes_transferred, $bytes_max)
+{
+	if($notification_code == STREAM_NOTIFY_REDIRECTED) {
+	  // $http_response_header is now a string, but will be used as an array
+     // by php_stream_url_wrap_http_ex() later on
+       $GLOBALS['http_response_header'] = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\0\0\0\0";
+    }
+}
+
+$ctx = stream_context_create();
+stream_context_set_params($ctx, array("notification" => "stream_notification_callback"));
+
+$responses = array(
+	"data://text/plain,HTTP/1.0 302 Found\r\nLocation: http://127.0.0.1:22345/try-again\r\n\r\n",
+	"data://text/plain,HTTP/1.0 404 Not Found\r\n\r\n",
+);
+
+$pid = http_server("tcp://127.0.0.1:22345", $responses, $output);
+
+$f = file_get_contents('http://127.0.0.1:22345/', 0, $ctx);
+
+http_server_kill($pid);
+var_dump($f);
+?>
+==DONE==
+--EXPECTF--
+string(26) "HTTP/1.0 404 Not Found
+
+"
+==DONE==
@@ -0,0 +1,25 @@
+--TEST--
+exec, system, passthru  — Basic command execution functions
+--SKIPIF--
+<?php
+// If this does not work for Windows, please uncomment or fix test
+// if(substr(PHP_OS, 0, 3) == "WIN") die("skip not for Windows");
+?>
+--FILE--
+<?php
+$cmd = "echo abc\n\0command";
+var_dump(exec($cmd, $output));
+var_dump($output);
+var_dump(system($cmd));
+var_dump(passthru($cmd));
+?>
+--EXPECTF--
+Warning: exec(): NULL byte detected. Possible attack in %s on line %d
+bool(false)
+NULL
+
+Warning: system(): NULL byte detected. Possible attack in %s on line %d
+bool(false)
+
+Warning: passthru(): NULL byte detected. Possible attack in %s on line %d
+bool(false)
@@ -0,0 +1,13 @@
+--TEST--
+Bug #68925 (CVE-2015-0235 – GHOST: glibc gethostbyname buffer overflow)
+--FILE--
+<?php
+var_dump(gethostbyname(str_repeat("0", 2501)));
+var_dump(gethostbynamel(str_repeat("0", 2501)));
+?>
+--EXPECTF--
+Warning: gethostbyname(): Host name is too long, the limit is %d characters in %s/bug68925.php on line %d
+string(2501) "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
+
+Warning: gethostbynamel(): Host name is too long, the limit is %d characters in %s/bug68925.php on line %d
+bool(false)
@@ -0,0 +1,12 @@
+--TEST--
+Bug #68044 Integer overflow in unserialize() (32-bits only)
+--FILE--
+<?php
+	echo unserialize('C:3:"XYZ":18446744075857035259:{}');
+?>
+===DONE==
+--EXPECTF--
+Warning: Insufficient data for unserializing - %d required, 1 present in %s/bug68044.php on line 2
+
+Notice: unserialize(): Error at offset 32 of 33 bytes in %s/bug68044.php on line 2
+===DONE==
@@ -0,0 +1,11 @@
+--TEST--
+Bug #68545 NULL pointer dereference in unserialize.c:var_push_dtor
+--FILE--
+<?php 
+var_dump(unserialize('a:6:{a:6:{s:3:"322";s:3:"bar";s:3:"bar";s:3:"foo";a:6:{a:6:{s:3:"322";s:3:"bar";s:3:"bar";s:3:"foo";s:3:"bar";a:6:{a:6:{s:3:"322";s:3:"bar";s:3:"bar";s:3:"foo";a:6:{a:6:{s:3:"322";s:3:"bar";s:3:"b22";s:3:"bar";s:3:"bar";s:3:"foo";s:3:"bar";a:6:{a:6:{s:3:"322";s:3:"bar";s:3:"bar";s:3:"foo";s:3:"bar";s:3:"bar";')); 
+?>
+===DONE===
+--EXPECTF--
+Notice: unserialize(): Error at offset %d of %d bytes in %sbug68545.php on line %d
+bool(false)
+===DONE===
@@ -0,0 +1,23 @@
+--TEST--
+Bug #68545 Use after free vulnerability in unserialize()
+--FILE--
+<?php
+for ($i=4; $i<100; $i++) {
+	$m = new StdClass();
+
+	$u = array(1);
+
+	$m->aaa = array(1,2,&$u,4,5);
+	$m->bbb = 1;
+	$m->ccc = &$u;
+	$m->ddd = str_repeat("A", $i);
+
+	$z = serialize($m);
+	$z = str_replace("bbb", "aaa", $z);
+	$y = unserialize($z);
+	$z = serialize($y);
+}
+?>
+===DONE===
+--EXPECTF--
+===DONE===
@@ -0,0 +1,37 @@
+--TEST--
+Bug #68976 Use After Free Vulnerability in unserialize()
+--FILE--
+<?php
+class evilClass {
+	public $name;
+	function __wakeup() {
+		unset($this->name);
+	}
+}
+
+$fakezval = pack(
+    'IIII',
+    0x00100000,
+    0x00000400,
+    0x00000000,
+    0x00000006 
+);
+
+$data = unserialize('a:2:{i:0;O:9:"evilClass":1:{s:4:"name";a:2:{i:0;i:1;i:1;i:2;}}i:1;R:4;}');
+
+for($i = 0; $i < 5; $i++) {
+    $v[$i] = $fakezval.$i;
+}
+
+var_dump($data);
+?>
+===DONE===
+--EXPECTF--
+array(2) {
+  [0]=>
+  object(evilClass)#1 (0) {
+  }
+  [1]=>
+  int(1)
+}
+===DONE===
@@ -0,0 +1,16 @@
+--TEST--
+Bug #69152: Type Confusion Infoleak Vulnerability in unserialize()
+--FILE--
+<?php
+$x = unserialize('O:9:"exception":1:{s:16:"'."\0".'Exception'."\0".'trace";s:4:"ryat";}');
+echo $x;
+$x =  unserialize('O:4:"test":1:{s:27:"__PHP_Incomplete_Class_Name";R:1;}');
+$x->test();
+
+?>
+--EXPECTF--
+exception 'Exception' in %s:%d
+Stack trace:
+#0 {main}
+
+Fatal error: main(): The script tried to execute a method or access a property of an incomplete object. Please ensure that the class definition "unknown" of the object you are trying to operate on was loaded _before_ unserialize() gets called or provide a __autoload() function to load the class definition  in %s on line %d
@@ -0,0 +1,25 @@
+--TEST--
+Bug #68710 Use after free vulnerability in unserialize() (bypassing the
+CVE-2014-8142 fix)
+--FILE--
+<?php
+for ($i=4; $i<100; $i++) {
+    $m = new StdClass();
+
+    $u = array(1);
+
+    $m->aaa = array(1,2,&$u,4,5);
+    $m->bbb = 1;
+    $m->ccc = &$u;
+    $m->ddd = str_repeat("A", $i);
+
+    $z = serialize($m);
+    $z = str_replace("aaa", "123", $z);
+    $z = str_replace("bbb", "123", $z);
+    $y = unserialize($z);
+    $z = serialize($y);
+}
+?>
+===DONE===
+--EXPECTF--
+===DONE===
@@ -18,8 +18,10 @@ $tests =array(
 	array('$2x$05$/OK.fbVrR/bpIqNJ5ianF.CE5elHaaO4EbggVDjb8P19RukzXSM3e', "\xff\xff\xa3"),
 	array('$2y$05$/OK.fbVrR/bpIqNJ5ianF.CE5elHaaO4EbggVDjb8P19RukzXSM3e', "\xff\xff\xa3"),
 	array('$2a$05$/OK.fbVrR/bpIqNJ5ianF.nqd1wy.pTMdcvrRWxyiGL2eMz.2a85.', "\xff\xff\xa3"),
+	array('$2b$05$/OK.fbVrR/bpIqNJ5ianF.CE5elHaaO4EbggVDjb8P19RukzXSM3e', "\xff\xff\xa3"),
 	array('$2y$05$/OK.fbVrR/bpIqNJ5ianF.Sa7shbm4.OzKpvFnX1pQLmQW96oUlCq', "\xa3"),
 	array('$2a$05$/OK.fbVrR/bpIqNJ5ianF.Sa7shbm4.OzKpvFnX1pQLmQW96oUlCq', "\xa3"),
+	array('$2b$05$/OK.fbVrR/bpIqNJ5ianF.Sa7shbm4.OzKpvFnX1pQLmQW96oUlCq', "\xa3"),
 	array('$2x$05$/OK.fbVrR/bpIqNJ5ianF.o./n25XVfn6oAPaUvHe.Csk4zRfsYPi', "1\xa3345"),
 	array('$2x$05$/OK.fbVrR/bpIqNJ5ianF.o./n25XVfn6oAPaUvHe.Csk4zRfsYPi', "\xff\xa3345"),
 	array('$2x$05$/OK.fbVrR/bpIqNJ5ianF.o./n25XVfn6oAPaUvHe.Csk4zRfsYPi', "\xff\xa334\xff\xff\xff\xa3345"),
@@ -36,14 +38,35 @@ $tests =array(
 	array('$2a$05$/OK.fbVrR/bpIqNJ5ianF.R9xrDjiycxMbQE2bp.vgqlYpW5wx2yy', "\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55"),
 	array('$2a$05$/OK.fbVrR/bpIqNJ5ianF.9tQZzcJfm3uj2NvJ/n5xkhpqLrMpWCe', "\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff"),
 	array('$2a$05$CCCCCCCCCCCCCCCCCCCCC.7uG0VCzI2bS7j6ymqJi9CdcdxiRTWNy', ''),
-
 );
+
+$tests2 = array(
+	array('$2a$03$CCCCCCCCCCCCCCCCCCCCC.', '*0'),
+	array('$2a$32$CCCCCCCCCCCCCCCCCCCCC.', '*0'),
+	array('$2c$05$CCCCCCCCCCCCCCCCCCCCC.', '*0'),
+	array('$2z$05$CCCCCCCCCCCCCCCCCCCCC.', '*0'),
+	array('$2`$05$CCCCCCCCCCCCCCCCCCCCC.', '*0'),
+	array('$2{$05$CCCCCCCCCCCCCCCCCCCCC.', '*0'),
+	array('*0', '*1'),
+);
+
 $i=0;
 foreach($tests as $test) {
-  if(crypt($test[1], $test[0]) == $test[0]) {
+  $result = crypt($test[1], $test[0]);
+  if($result === $test[0]) {
    echo "$i. OK\n";
  } else {
-    echo "$i. Not OK: $test[0] ".crypt($test[1], $test[0])."\n";
+    echo "$i. Not OK: $test[0] $result\n";
+  }
+  $i++;
+}
+
+foreach($tests2 as $test) {
+  $result = crypt('', $test[0]);
+  if($result === $test[1]) {
+    echo "$i. OK\n";
+  } else {
+    echo "$i. Not OK: $test[0] $result\n";
  }
  $i++;
 }
@@ -76,3 +99,12 @@ foreach($tests as $test) {
 23. OK
 24. OK
 25. OK
+26. OK
+27. OK
+28. OK
+29. OK
+30. OK
+31. OK
+32. OK
+33. OK
+34. OK
@@ -1,4 +1,4 @@
-/* Generated by re2c 0.13.5 on Sat Jun 21 21:27:56 2014 */
+/* Generated by re2c 0.13.7.5 on Tue Mar 17 13:14:30 2015 */
 #line 1 "ext/standard/var_unserializer.re"
 /*
  +----------------------------------------------------------------------+
@@ -61,7 +61,13 @@ static inline void var_push(php_unserialize_data_t *var_hashx, zval **rval)

 PHPAPI void var_push_dtor(php_unserialize_data_t *var_hashx, zval **rval)
 {
-	var_entries *var_hash = (*var_hashx)->last_dtor;
+	var_entries *var_hash;
+
+	if (!var_hashx || !*var_hashx) {
+		return;
+	}
+
+	var_hash = (*var_hashx)->last_dtor;
 #if VAR_ENTRIES_DBG
 	fprintf(stderr, "var_push_dtor(%ld): %d\n", var_hash?var_hash->used_slots:-1L, Z_TYPE_PP(rval));
 #endif
@@ -227,7 +233,7 @@ static char *unserialize_str(const unsigned char **p, size_t *len, size_t maxlen
 #define YYMARKER marker


-#line 235 "ext/standard/var_unserializer.re"
+#line 241 "ext/standard/var_unserializer.re"



@@ -337,9 +343,13 @@ static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, long
 		} else {
 			/* object properties should include no integers */
 			convert_to_string(key);
+			if (zend_hash_find(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, (void **)&old_data)==SUCCESS) {
+				var_push_dtor(var_hash, old_data);
+			}
 			zend_hash_update(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, &data,
 					sizeof data, NULL);
 		}
+		var_push_dtor(var_hash, &data);
 		
 		zval_dtor(key);
 		FREE_ZVAL(key);
@@ -372,7 +382,7 @@ static inline int object_custom(UNSERIALIZE_PARAMETER, zend_class_entry *ce)

 	(*p) += 2;

-	if (datalen < 0 || (*p) + datalen >= max) {
+	if (datalen < 0 || (max - (*p)) <= datalen) {
 		zend_error(E_WARNING, "Insufficient data for unserializing - %ld required, %ld present", datalen, (long)(max - (*p)));
 		return 0;
 	}
@@ -474,7 +484,7 @@ PHPAPI int php_var_unserialize(UNSERIALIZE_PARAMETER)
 	
 	

-#line 478 "ext/standard/var_unserializer.c"
+#line 488 "ext/standard/var_unserializer.c"
 {
 	YYCTYPE yych;
 	static const unsigned char yybm[] = {
@@ -534,9 +544,9 @@ yy2:
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych == ':') goto yy95;
 yy3:
-#line 829 "ext/standard/var_unserializer.re"
+#line 839 "ext/standard/var_unserializer.re"
 	{ return 0; }
-#line 540 "ext/standard/var_unserializer.c"
+#line 550 "ext/standard/var_unserializer.c"
 yy4:
 	yych = *(YYMARKER = ++YYCURSOR);
 	if (yych == ':') goto yy89;
@@ -579,13 +589,13 @@ yy13:
 	goto yy3;
 yy14:
 	++YYCURSOR;
-#line 823 "ext/standard/var_unserializer.re"
+#line 833 "ext/standard/var_unserializer.re"
 	{
 	/* this is the case where we have less data than planned */
 	php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Unexpected end of serialized data");
 	return 0; /* not sure if it should be 0 or 1 here? */
 }
-#line 589 "ext/standard/var_unserializer.c"
+#line 599 "ext/standard/var_unserializer.c"
 yy16:
 	yych = *++YYCURSOR;
 	goto yy3;
@@ -611,11 +621,12 @@ yy20:
 	if (yybm[0+yych] & 128) {
 		goto yy20;
 	}
-	if (yych != ':') goto yy18;
+	if (yych <= '/') goto yy18;
+	if (yych >= ';') goto yy18;
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 677 "ext/standard/var_unserializer.re"
+#line 687 "ext/standard/var_unserializer.re"
 	{
 	size_t len, len2, len3, maxlen;
 	long elements;
@@ -761,7 +772,7 @@ yy20:

 	return object_common2(UNSERIALIZE_PASSTHRU, elements);
 }
-#line 765 "ext/standard/var_unserializer.c"
+#line 776 "ext/standard/var_unserializer.c"
 yy25:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -786,7 +797,7 @@ yy27:
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 669 "ext/standard/var_unserializer.re"
+#line 679 "ext/standard/var_unserializer.re"
 	{

 	INIT_PZVAL(*rval);
@@ -794,7 +805,7 @@ yy27:
 	return object_common2(UNSERIALIZE_PASSTHRU,
 			object_common1(UNSERIALIZE_PASSTHRU, ZEND_STANDARD_CLASS_DEF_PTR));
 }
-#line 798 "ext/standard/var_unserializer.c"
+#line 809 "ext/standard/var_unserializer.c"
 yy32:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy33;
@@ -815,7 +826,7 @@ yy34:
 	yych = *++YYCURSOR;
 	if (yych != '{') goto yy18;
 	++YYCURSOR;
-#line 649 "ext/standard/var_unserializer.re"
+#line 659 "ext/standard/var_unserializer.re"
 	{
 	long elements = parse_iv(start + 2);
 	/* use iv() not uiv() in order to check data range */
@@ -835,7 +846,7 @@ yy34:

 	return finish_nested_data(UNSERIALIZE_PASSTHRU);
 }
-#line 839 "ext/standard/var_unserializer.c"
+#line 850 "ext/standard/var_unserializer.c"
 yy39:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy40;
@@ -856,7 +867,7 @@ yy41:
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 620 "ext/standard/var_unserializer.re"
+#line 630 "ext/standard/var_unserializer.re"
 	{
 	size_t len, maxlen;
 	char *str;
@@ -885,7 +896,7 @@ yy41:
 	ZVAL_STRINGL(*rval, str, len, 0);
 	return 1;
 }
-#line 889 "ext/standard/var_unserializer.c"
+#line 900 "ext/standard/var_unserializer.c"
 yy46:
 	yych = *++YYCURSOR;
 	if (yych == '+') goto yy47;
@@ -906,7 +917,7 @@ yy48:
 	yych = *++YYCURSOR;
 	if (yych != '"') goto yy18;
 	++YYCURSOR;
-#line 592 "ext/standard/var_unserializer.re"
+#line 602 "ext/standard/var_unserializer.re"
 	{
 	size_t len, maxlen;
 	char *str;
@@ -934,7 +945,7 @@ yy48:
 	ZVAL_STRINGL(*rval, str, len, 1);
 	return 1;
 }
-#line 938 "ext/standard/var_unserializer.c"
+#line 949 "ext/standard/var_unserializer.c"
 yy53:
 	yych = *++YYCURSOR;
 	if (yych <= '/') {
@@ -1022,7 +1033,7 @@ yy61:
 	}
 yy63:
 	++YYCURSOR;
-#line 582 "ext/standard/var_unserializer.re"
+#line 592 "ext/standard/var_unserializer.re"
 	{
 #if SIZEOF_LONG == 4
 use_double:
@@ -1032,7 +1043,7 @@ use_double:
 	ZVAL_DOUBLE(*rval, zend_strtod((const char *)start + 2, NULL));
 	return 1;
 }
-#line 1036 "ext/standard/var_unserializer.c"
+#line 1047 "ext/standard/var_unserializer.c"
 yy65:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1091,7 +1102,7 @@ yy73:
 	yych = *++YYCURSOR;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 567 "ext/standard/var_unserializer.re"
+#line 577 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
@@ -1106,7 +1117,7 @@ yy73:

 	return 1;
 }
-#line 1110 "ext/standard/var_unserializer.c"
+#line 1121 "ext/standard/var_unserializer.c"
 yy76:
 	yych = *++YYCURSOR;
 	if (yych == 'N') goto yy73;
@@ -1133,7 +1144,7 @@ yy79:
 	if (yych <= '9') goto yy79;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 540 "ext/standard/var_unserializer.re"
+#line 550 "ext/standard/var_unserializer.re"
 	{
 #if SIZEOF_LONG == 4
 	int digits = YYCURSOR - start - 3;
@@ -1160,7 +1171,7 @@ yy79:
 	ZVAL_LONG(*rval, parse_iv(start + 2));
 	return 1;
 }
-#line 1164 "ext/standard/var_unserializer.c"
+#line 1175 "ext/standard/var_unserializer.c"
 yy83:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy18;
@@ -1168,24 +1179,24 @@ yy83:
 	yych = *++YYCURSOR;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 533 "ext/standard/var_unserializer.re"
+#line 543 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
 	ZVAL_BOOL(*rval, parse_iv(start + 2));
 	return 1;
 }
-#line 1179 "ext/standard/var_unserializer.c"
+#line 1190 "ext/standard/var_unserializer.c"
 yy87:
 	++YYCURSOR;
-#line 526 "ext/standard/var_unserializer.re"
+#line 536 "ext/standard/var_unserializer.re"
 	{
 	*p = YYCURSOR;
 	INIT_PZVAL(*rval);
 	ZVAL_NULL(*rval);
 	return 1;
 }
-#line 1189 "ext/standard/var_unserializer.c"
+#line 1200 "ext/standard/var_unserializer.c"
 yy89:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1208,7 +1219,7 @@ yy91:
 	if (yych <= '9') goto yy91;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 503 "ext/standard/var_unserializer.re"
+#line 513 "ext/standard/var_unserializer.re"
 	{
 	long id;

@@ -1231,7 +1242,7 @@ yy91:
 	
 	return 1;
 }
-#line 1235 "ext/standard/var_unserializer.c"
+#line 1246 "ext/standard/var_unserializer.c"
 yy95:
 	yych = *++YYCURSOR;
 	if (yych <= ',') {
@@ -1254,7 +1265,7 @@ yy97:
 	if (yych <= '9') goto yy97;
 	if (yych != ';') goto yy18;
 	++YYCURSOR;
-#line 482 "ext/standard/var_unserializer.re"
+#line 492 "ext/standard/var_unserializer.re"
 	{
 	long id;

@@ -1275,9 +1286,9 @@ yy97:
 	
 	return 1;
 }
-#line 1279 "ext/standard/var_unserializer.c"
+#line 1290 "ext/standard/var_unserializer.c"
 }
-#line 831 "ext/standard/var_unserializer.re"
+#line 841 "ext/standard/var_unserializer.re"


 	return 0;
@@ -59,7 +59,13 @@ static inline void var_push(php_unserialize_data_t *var_hashx, zval **rval)

 PHPAPI void var_push_dtor(php_unserialize_data_t *var_hashx, zval **rval)
 {
-	var_entries *var_hash = (*var_hashx)->last_dtor;
+	var_entries *var_hash;
+
+	if (!var_hashx || !*var_hashx) {
+		return;
+	}
+
+	var_hash = (*var_hashx)->last_dtor;
 #if VAR_ENTRIES_DBG
 	fprintf(stderr, "var_push_dtor(%ld): %d\n", var_hash?var_hash->used_slots:-1L, Z_TYPE_PP(rval));
 #endif
@@ -341,9 +347,13 @@ static inline int process_nested_data(UNSERIALIZE_PARAMETER, HashTable *ht, long
 		} else {
 			/* object properties should include no integers */
 			convert_to_string(key);
+			if (zend_hash_find(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, (void **)&old_data)==SUCCESS) {
+				var_push_dtor(var_hash, old_data);
+			}
 			zend_hash_update(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, &data,
 					sizeof data, NULL);
 		}
+		var_push_dtor(var_hash, &data);
 		
 		zval_dtor(key);
 		FREE_ZVAL(key);
@@ -376,7 +386,7 @@ static inline int object_custom(UNSERIALIZE_PARAMETER, zend_class_entry *ce)

 	(*p) += 2;

-	if (datalen < 0 || (*p) + datalen >= max) {
+	if (datalen < 0 || (max - (*p)) <= datalen) {
 		zend_error(E_WARNING, "Insufficient data for unserializing - %ld required, %ld present", datalen, (long)(max - (*p)));
 		return 0;
 	}
@@ -219,16 +219,19 @@ static int date_from_ISO8601 (const char *text, time_t * value) {
   n = 10;
   tm.tm_mon = 0;
   for(i = 0; i < 2; i++) {
-      XMLRPC_IS_NUMBER(text[i])
+      XMLRPC_IS_NUMBER(text[i+4])
      tm.tm_mon += (text[i+4]-'0')*n;
      n /= 10;
   }
   tm.tm_mon --;
+   if(tm.tm_mon < 0 || tm.tm_mon > 11) {
+       return -1;
+   }

   n = 10;
   tm.tm_mday = 0;
   for(i = 0; i < 2; i++) {
-      XMLRPC_IS_NUMBER(text[i])
+      XMLRPC_IS_NUMBER(text[i+6])
      tm.tm_mday += (text[i+6]-'0')*n;
      n /= 10;
   }
@@ -236,7 +239,7 @@ static int date_from_ISO8601 (const char *text, time_t * value) {
   n = 10;
   tm.tm_hour = 0;
   for(i = 0; i < 2; i++) {
-      XMLRPC_IS_NUMBER(text[i])
+      XMLRPC_IS_NUMBER(text[i+9])
      tm.tm_hour += (text[i+9]-'0')*n;
      n /= 10;
   }
@@ -244,7 +247,7 @@ static int date_from_ISO8601 (const char *text, time_t * value) {
   n = 10;
   tm.tm_min = 0;
   for(i = 0; i < 2; i++) {
-      XMLRPC_IS_NUMBER(text[i])
+      XMLRPC_IS_NUMBER(text[i+12])
      tm.tm_min += (text[i+12]-'0')*n;
      n /= 10;
   }
@@ -252,7 +255,7 @@ static int date_from_ISO8601 (const char *text, time_t * value) {
   n = 10;
   tm.tm_sec = 0;
   for(i = 0; i < 2; i++) {
-      XMLRPC_IS_NUMBER(text[i])
+      XMLRPC_IS_NUMBER(text[i+15])
      tm.tm_sec += (text[i+15]-'0')*n;
      n /= 10;
   }
@@ -0,0 +1,44 @@
+--TEST--
+Bug #68027 (buffer overflow in mkgmtime() function)
+--SKIPIF--
+<?php
+if (!extension_loaded("xmlrpc")) print "skip";
+?>
+--FILE--
+<?php
+
+$d = '6-01-01 20:00:00';
+xmlrpc_set_type($d, 'datetime');
+var_dump($d);
+$datetime = "2001-0-08T21:46:40-0400";
+$obj = xmlrpc_decode("<?xml version=\"1.0\"?><methodResponse><params><param><value><dateTime.iso8601>$datetime</dateTime.iso8601></value></param></params></methodResponse>");
+print_r($obj);
+
+$datetime = "34770-0-08T21:46:40-0400";
+$obj = xmlrpc_decode("<?xml version=\"1.0\"?><methodResponse><params><param><value><dateTime.iso8601>$datetime</dateTime.iso8601></value></param></params></methodResponse>");
+print_r($obj);
+
+echo "Done\n";
+?>
+--EXPECTF--	
+object(stdClass)#1 (3) {
+  ["scalar"]=>
+  string(16) "6-01-01 20:00:00"
+  ["xmlrpc_type"]=>
+  string(8) "datetime"
+  ["timestamp"]=>
+  int(%d)
+}
+stdClass Object
+(
+    [scalar] => 2001-0-08T21:46:40-0400
+    [xmlrpc_type] => datetime
+    [timestamp] => %s
+)
+stdClass Object
+(
+    [scalar] => 34770-0-08T21:46:40-0400
+    [xmlrpc_type] => datetime
+    [timestamp] => %d
+)
+Done
@@ -1738,7 +1738,7 @@ static PHP_FUNCTION(xmlwriter_write_dtd_entity)
 /* }}} */
 #endif

-/* {{{ proto resource xmlwriter_open_uri(resource xmlwriter, string source)
+/* {{{ proto resource xmlwriter_open_uri(string source)
 Create new xmlwriter using source uri for output */
 static PHP_FUNCTION(xmlwriter_open_uri)
 {
@@ -1759,7 +1759,7 @@ static PHP_FUNCTION(xmlwriter_open_uri)
 	void *ioctx;
 #endif

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &source, &source_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &source, &source_len) == FAILURE) {
 		return;
 	}
 	
@@ -101,7 +101,7 @@ _zip_cdir_new(int nentry, struct zip_error *error)
 	return NULL;
    }

-    if ((cd->entry=(struct zip_dirent *)malloc(sizeof(*(cd->entry))*nentry))
+    if ( nentry > ((size_t)-1)/sizeof(*(cd->entry)) || (cd->entry=(struct zip_dirent *)malloc(sizeof(*(cd->entry))*(size_t)nentry))
 	== NULL) {
 	_zip_error_set(error, ZIP_ER_MEMORY, 0);
 	free(cd);
@@ -1,17 +1,17 @@
 --TEST--
-Test gzopen() function : usage variation 
+Test gzopen() function : usage variation
 --SKIPIF--
-<?php 
+<?php
 if (!extension_loaded("zlib")) {
-	print "skip - zlib extension not loaded"; 
-}	 
+	print "skip - zlib extension not loaded";
+}
 ?>
 --FILE--
 <?php
 /* Prototype  : resource gzopen(string filename, string mode [, int use_include_path])
- * Description: Open a .gz-file and return a .gz-file pointer 
+ * Description: Open a .gz-file and return a .gz-file pointer
 * Source code: ext/zlib/zlib.c
- * Alias to functions: 
+ * Alias to functions:
 */

 echo "*** Testing gzopen() : usage variation ***\n";
@@ -102,9 +102,9 @@ $inputs = array(

      // unset data
      'unset var' => @$unset_var,
-      
+
      // resource variable
-      'resource' => $fp      
+      'resource' => $fp
 );

 // loop through each element of the array for filename
@@ -158,19 +158,19 @@ Error: 2 - gzopen(0.5): failed to open stream: No such file or directory, %s(%d)
 bool(false)

 --empty array--
-Error: 2 - gzopen() expects parameter 1 to be string, array given, %s(%d)
+Error: 2 - gzopen() expects parameter 1 to be a valid path, array given, %s(%d)
 NULL

 --int indexed array--
-Error: 2 - gzopen() expects parameter 1 to be string, array given, %s(%d)
+Error: 2 - gzopen() expects parameter 1 to be a valid path, array given, %s(%d)
 NULL

 --associative array--
-Error: 2 - gzopen() expects parameter 1 to be string, array given, %s(%d)
+Error: 2 - gzopen() expects parameter 1 to be a valid path, array given, %s(%d)
 NULL

 --nested arrays--
-Error: 2 - gzopen() expects parameter 1 to be string, array given, %s(%d)
+Error: 2 - gzopen() expects parameter 1 to be a valid path, array given, %s(%d)
 NULL

 --uppercase NULL--
@@ -210,7 +210,7 @@ Error: 2 - gzopen(Class A object): failed to open stream: No such file or direct
 bool(false)

 --instance of classWithoutToString--
-Error: 2 - gzopen() expects parameter 1 to be string, object given, %s(%d)
+Error: 2 - gzopen() expects parameter 1 to be a valid path, object given, %s(%d)
 NULL

 --undefined var--
@@ -222,7 +222,7 @@ Error: 2 - gzopen(): Filename cannot be empty, %s(%d)
 bool(false)

 --resource--
-Error: 2 - gzopen() expects parameter 1 to be string, resource given, %s(%d)
+Error: 2 - gzopen() expects parameter 1 to be a valid path, resource given, %s(%d)
 NULL
 ===DONE===

@@ -29,15 +29,15 @@ foreach ( $variation as $var ) {
 ===DONE===
 --EXPECTF--

-Warning: readgzfile() expects parameter 1 to be string, array given in %s on line %d
+Warning: readgzfile() expects parameter 1 to be a valid path, array given in %s on line %d
 NULL

-Warning: readgzfile() expects parameter 1 to be string, array given in %s on line %d
+Warning: readgzfile() expects parameter 1 to be a valid path, array given in %s on line %d
 NULL

-Warning: readgzfile() expects parameter 1 to be string, array given in %s on line %d
+Warning: readgzfile() expects parameter 1 to be a valid path, array given in %s on line %d
 NULL

-Warning: readgzfile() expects parameter 1 to be string, array given in %s on line %d
+Warning: readgzfile() expects parameter 1 to be a valid path, array given in %s on line %d
 NULL
-===DONE===
+===DONE===
@@ -45,5 +45,5 @@ foreach ( $variation as $var ) {
 --EXPECTF--
 Error: 2 - readgzfile(Class A object): failed to open stream: No such file or directory, %s(%d)
 bool(false)
-Error: 2 - readgzfile() expects parameter 1 to be string, object given, %s(%d)
-NULL
+Error: 2 - readgzfile() expects parameter 1 to be a valid path, object given, %s(%d)
+NULL
@@ -581,7 +581,7 @@ static PHP_FUNCTION(gzopen)
 	php_stream *stream;
 	long use_include_path = 0;

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ss|l", &filename, &filename_len, &mode, &mode_len, &use_include_path) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ps|l", &filename, &filename_len, &mode, &mode_len, &use_include_path) == FAILURE) {
 		return;
 	}

@@ -609,7 +609,7 @@ static PHP_FUNCTION(readgzfile)
 	int size;
 	long use_include_path = 0;

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|l", &filename, &filename_len, &use_include_path) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|l", &filename, &filename_len, &use_include_path) == FAILURE) {
 		return;
 	}

@@ -743,13 +743,8 @@ SAPI_API int sapi_header_op(sapi_header_op_enum op, void *arg TSRMLS_DC)
 		/* new line/NUL character safety check */
 		int i;
 		for (i = 0; i < header_line_len; i++) {
-			/* RFC 2616 allows new lines if followed by SP or HT */
-			int illegal_break =
-					(header_line[i+1] != ' ' && header_line[i+1] != '\t')
-					&& (
-						header_line[i] == '\n'
-						|| (header_line[i] == '\r' && header_line[i+1] != '\n'));
-			if (illegal_break) {
+			/* RFC 7230 ch. 3.2.4 deprecates folding support */
+			if (header_line[i] == '\n' || header_line[i] == '\r') {
 				efree(header_line);
 				sapi_module.sapi_error(E_WARNING, "Header may not contain "
 						"more than a single header, new line detected");
@@ -24,6 +24,7 @@
 #include "php.h"

 #include <stddef.h>
+#include <errno.h>

 #ifdef PHP_WIN32
 # include "win32/inet.h"
@@ -243,7 +244,12 @@ PHPAPI int php_network_getaddresses(const char *host, int socktype, struct socka
 #else
 	if (!inet_aton(host, &in)) {
 		/* XXX NOT THREAD SAFE (is safe under win32) */
-		host_info = gethostbyname(host);
+		if(strlen(host) > MAXFQDNLEN) {
+			host_info = NULL;
+			errno = E2BIG;
+		} else {
+			host_info = gethostbyname(host);
+		}
 		if (host_info == NULL) {
 			if (error_string) {
 				spprintf(error_string, 0, "php_network_getaddresses: gethostbyname failed. errno=%d", errno);
@@ -311,6 +311,10 @@ END_EXTERN_C()

 /* }}} */

+#ifndef MAXFQDNLEN
+#define MAXFQDNLEN 255
+#endif
+
 #endif /* _PHP_NETWORK_H */

 /*
@@ -2,8 +2,7 @@
 /* edit configure.in to change version number */
 #define PHP_MAJOR_VERSION 5
 #define PHP_MINOR_VERSION 4
-#define PHP_RELEASE_VERSION 34
-
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "5.4.34-dev"
-#define PHP_VERSION_ID 50434
+#define PHP_RELEASE_VERSION 40
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "5.4.40"
+#define PHP_VERSION_ID 50440
@@ -796,6 +796,11 @@ PHPAPI int vspprintf(char **pbuf, size_t max_len, const char *format, va_list ap
 {
 	smart_str xbuf = {0};

+	/* since there are places where (v)spprintf called without checking for null,
+	   a bit of defensive coding here */
+	if(!pbuf) {
+		return 0;
+	}
 	xbuf_format_converter(&xbuf, format, ap);

 	if (max_len && xbuf.len > max_len) {
@@ -240,6 +240,7 @@ $ini_overwrites = array(
 		'ignore_repeated_errors=0',
 		'precision=14',
 		'memory_limit=128M',
+		'log_errors_max_len=0',
 	);

 function write_information($show_html)
Author	SHA1	Message	Date
Xinchen Hui	e249836ea6	Fixed res leak	2015-04-14 21:16:17 -07:00
Dmitry Stogov	789fb16f4d	Fixed recently introduced memory leak	2015-04-14 11:08:48 -07:00
Stanislav Malyshev	aa6fcb485c	fix non-standard C	2015-04-14 00:47:38 -07:00
Stanislav Malyshev	9bd8c14dd5	5.4.40	2015-04-14 00:30:04 -07:00
Stanislav Malyshev	d3aeb8a204	Merge branch 'PHP-5.4.40' into PHP-5.4 * PHP-5.4.40: update NEWS Fix bug #69441 (Buffer Overflow when parsing tar/zip/phar in phar_set_inode) fix memory leak & add test Fix tests fix CVE num Fix bug #69337 (php_stream_url_wrap_http_ex() type-confusion vulnerability) Fix test Additional fix for bug #69324 More fixes for bug #69152 Fixed bug #69353 (Missing null byte checks for paths in various PHP extensions) Fixed bug #69324 (Buffer Over-read in unserialize when parsing Phar) Fixed bug #69316 (Use-after-free in php_curl related to CURLOPT_FILE/_INFILE/_WRITEHEADER) Fix bug #68486 and bug #69218 (segfault in apache2handler with apache 2.4) Fix bug #68819 (Fileinfo on specific file causes spurious OOM and/or segfault)	2015-04-14 00:26:53 -07:00
Stanislav Malyshev	ae46d1ce19	fix CVE num	2015-04-14 00:25:55 -07:00
Stanislav Malyshev	d734e75599	update NEWS	2015-04-14 00:22:09 -07:00
Stanislav Malyshev	aa2eca2e48	Merge branch 'PHP-5.4' into PHP-5.4.40 * PHP-5.4: fix CVE num	2015-04-14 00:08:57 -07:00
Stanislav Malyshev	f59b67ae50	Fix bug #69441 (Buffer Overflow when parsing tar/zip/phar in phar_set_inode)	2015-04-14 00:03:50 -07:00
Remi Collet	ff70b40dc9	fix type in fix for #69085	2015-04-13 14:41:39 +02:00
Stanislav Malyshev	45facd15fb	fix memory leak & add test	2015-04-12 22:38:34 -07:00
Stanislav Malyshev	a643ccfb90	Fix tests	2015-04-12 20:55:35 -07:00
Stanislav Malyshev	9bed19a1e0	fix CVE num	2015-04-12 20:47:27 -07:00
Stanislav Malyshev	d82d68742c	Fix bug #69337 (php_stream_url_wrap_http_ex() type-confusion vulnerability)	2015-04-12 01:30:33 -07:00
Stanislav Malyshev	1defbb25ed	Fix test	2015-04-12 00:56:02 -07:00
Stanislav Malyshev	12d3bdee3d	Additional fix for bug #69324 Not so happy about duplication but needed due to bug #69429	2015-04-11 16:53:22 -07:00
Stanislav Malyshev	a894a8155f	More fixes for bug #69152	2015-04-11 16:53:22 -07:00
Stanislav Malyshev	4435b9142f	Fixed bug #69353 (Missing null byte checks for paths in various PHP extensions)	2015-04-11 16:53:22 -07:00
Stanislav Malyshev	9faaee66fa	Fixed bug #69324 (Buffer Over-read in unserialize when parsing Phar)	2015-04-11 16:53:21 -07:00
Stanislav Malyshev	0ea75af9be	Fixed bug #69316 (Use-after-free in php_curl related to CURLOPT_FILE/_INFILE/_WRITEHEADER)	2015-04-11 16:53:21 -07:00
Stanislav Malyshev	809610f5ea	Fix bug #68486 and bug #69218 (segfault in apache2handler with apache 2.4)	2015-04-11 16:53:21 -07:00
Stanislav Malyshev	f938112c49	Fix bug #68819 (Fileinfo on specific file causes spurious OOM and/or segfault)	2015-04-11 16:53:21 -07:00
Xinchen Hui	920a0afbf8	Fixed bug #68901 (use after free)	2015-04-11 16:28:07 -07:00
Xinchen Hui	9a404df382	Fixed bug #68740 (NULL Pointer Dereference) (cherry picked from commit `124fb22a13`)	2015-04-05 22:48:10 -07:00
Stanislav Malyshev	5ae20c6247	Fix bug #66550 (SQLite prepared statement use-after-free)	2015-04-05 22:36:26 -07:00
Remi Collet	bd31cb7563	Better fix for #68601 for perf https://bitbucket.org/libgd/gd-libgd/commits/81e9a993f2893d651d225646378e3fd1b7465467	2015-04-05 17:36:47 -07:00
Remi Collet	afbf725e73	Fix bug #68601 buffer read overflow in gd_gif_in.c	2015-04-05 17:33:52 -07:00
Stanislav Malyshev	caecd88237	Revert "Merge branch 'PHP-5.4' of https://git.php.net/repository/php-src into PHP-5.4" This reverts commit `fe0ca2745f`, reversing changes made to `968fbc6acf`.	2015-04-01 23:43:33 -07:00
Dmitry Stogov	75f40ae1f3	Fixed bug #69293	2015-03-27 18:40:58 +03:00
Xinchen Hui	fe0ca2745f	Merge branch 'PHP-5.4' of https://git.php.net/repository/php-src into PHP-5.4	2015-03-25 13:05:08 +08:00
Stanislav Malyshev	968fbc6acf	Bacport fix bug #68741 - Null pointer dereference	2015-03-22 18:30:05 -07:00
Stanislav Malyshev	fb83c76dee	Check that the type is correct	2015-03-22 18:17:47 -07:00
Stanislav Malyshev	95b9c34f02	add CVEs	2015-03-19 22:54:48 -07:00
Dmitry Stogov	51856a76f8	Fixed bug #69152	2015-03-19 11:36:01 +03:00
Stanislav Malyshev	4c3b73b6df	5.4.40 next	2015-03-17 22:37:16 -07:00
Stanislav Malyshev	ef8fc4b53d	Fix bug #69253 - ZIP Integer Overflow leads to writing past heap boundary	2015-03-17 21:59:56 -07:00
Stanislav Malyshev	fb04dcf6db	Fix bug #69248 - heap overflow vulnerability in regcomp.c Merged from https://github.com/garyhouston/regex/commit/70bc2965604b6b8aaf260049e64c708dddf85334	2015-03-17 17:04:57 -07:00
Stanislav Malyshev	8b14d3052f	add test for bug #68976	2015-03-17 17:03:46 -07:00
Stanislav Malyshev	646572d6d3	Fixed bug #68976 - Use After Free Vulnerability in unserialize()	2015-03-17 13:20:22 -07:00
Stanislav Malyshev	bfb669891e	Fixed bug #69134 (Per Directory Values overrides PHP_INI_SYSTEM configuration options)	2015-03-17 13:05:43 -07:00
Stanislav Malyshev	9ba4db5e5d	fix tests	2015-03-17 12:55:35 -07:00
Stanislav Malyshev	1291d6bbee	Fix bug #69207 - move_uploaded_file allows nulls in path	2015-03-17 12:47:58 -07:00
Xinchen Hui	ef2db26c60	Merge branch 'arginfo' of https://github.com/realityking/php-src into PHP-5.4	2015-03-08 22:53:19 +08:00
Dmitry Stogov	c8eaca013a	Added type checks	2015-03-03 10:43:48 +03:00
Dmitry Stogov	0c136a2abd	Added type checks	2015-03-03 09:44:46 +03:00
Dmitry Stogov	d5248f67b5	Check variable type before its usage as IS_ARRAY.	2015-03-02 12:27:36 +03:00
George Wang	8584cc010a	Fixed a bug that header value is not terminated by '\0' when accessed through getenv().	2015-02-25 10:48:19 -05:00
Ferenc Kovacs	c17a17e44b	fix typo in bug#	2015-02-18 19:47:07 +01:00
Remi Collet	c6a26cb39d	add CVE	2015-02-18 06:44:41 +01:00
Stanislav Malyshev	24f8a68d0a	5.4.39 next	2015-02-17 07:34:00 +01:00
Stanislav Malyshev	bdfe457a2c	Port for for bug #68552	2015-02-17 06:53:02 +01:00
Stanislav Malyshev	7b18981830	Fix bug #68942 (Use after free vulnerability in unserialize() with DateTimeZone) Conflicts: ext/date/php_date.c	2015-02-17 06:43:51 +01:00
Felipe Pena	82d347a477	- BFN	2015-02-17 01:14:05 -02:00
Felipe Pena	8f9ab04d93	- Fixed bug #67827 (broken detection of system crypt sha256/sha512 support)	2015-02-17 00:23:47 -02:00
Felipe Pena	e08bef442c	- Fixed bug #67427 (SoapServer cannot handle large messages) patch by: brandt at docoloc dot de	2015-02-16 13:07:26 -02:00
Yasuo Ohgaki	5b6269a253	Update NEWS	2015-02-14 05:34:57 +09:00
Yasuo Ohgaki	a8722f5330	Add NULL byte protection to exec, system and passthru	2015-02-14 05:25:04 +09:00
George Wang	5e3f0f5671	Fixed #68790 (Missing return)	2015-02-07 12:16:54 -05:00
Stanislav Malyshev	f001c63073	Update header handling to RFC 7230	2015-02-05 20:08:12 -08:00
Stanislav Malyshev	7efbd70b03	fix sizeof size	2015-02-01 12:40:38 -08:00
Stanislav Malyshev	94d6cb4a78	fix TSRM	2015-01-31 23:34:14 -08:00
Stanislav Malyshev	b30a6d6018	Use better constant since MAXHOSTNAMELEN may mean shorter name	2015-01-31 21:46:56 -08:00
Stanislav Malyshev	2cdbd3537f	use right sizeof for memset	2015-01-31 21:30:58 -08:00
Stanislav Malyshev	0f9c708229	Add mitigation for CVE-2015-0235 (bug #68925 )	2015-01-31 19:08:13 -08:00
Ferenc Kovacs	61ad5e24ea	fix some factual errors in the process	2015-01-22 21:27:38 +01:00
Stanislav Malyshev	b3b155ffe2	format	2015-01-20 11:57:17 -08:00
Stanislav Malyshev	547f62ed2a	add CVE	2015-01-20 11:54:45 -08:00
Stanislav Malyshev	ef4896d956	add protection against nulls	2015-01-20 11:46:10 -08:00
Stanislav Malyshev	8825311ce1	5.4.38 next	2015-01-20 10:38:33 -08:00
Stanislav Malyshev	e63f7b47e1	Merge branch 'bug68710' into PHP-5.4 * bug68710: Fix for bug #68710 (Use After Free Vulnerability in PHP's unserialize())	2015-01-20 01:02:26 -08:00
Stanislav Malyshev	fc6aa939f5	Merge branch 'bug68799' into PHP-5.4 * bug68799: Fix bug #68799: Free called on unitialized pointer	2015-01-20 01:00:11 -08:00
Daniel Lowrey	0a76610459	Update NEWS	2015-01-14 18:03:27 +01:00
Daniel Lowrey	e2fe8e164f	Fixed bug #55618 (use case-insensitive cert name matching)	2015-01-14 18:02:50 +01:00
Stanislav Malyshev	2fc178cf44	Fix bug #68799 : Free called on unitialized pointer	2015-01-11 00:51:05 -08:00
Anatol Belski	ebb98e7aeb	updated libmagic.patch in 5.4	2015-01-04 17:04:13 +01:00
Anatol Belski	ede59c8feb	Fixed bug #68735 fileinfo out-of-bounds memory access	2015-01-04 14:20:21 +01:00
Remi Collet	919abf0cb1	removed dead code	2015-01-04 09:40:19 +01:00
Stanislav Malyshev	b585a3aed7	Fix for bug #68710 (Use After Free Vulnerability in PHP's unserialize())	2015-01-01 16:19:05 -08:00
Stanislav Malyshev	f9ad308669	FIx bug #68618 (out of bounds read crashes php-cgi)	2014-12-30 01:23:05 -08:00
Ferenc Kovacs	cd387b4575	add missing NEWS entry	2014-12-17 02:10:36 +01:00
Stanislav Malyshev	8fe4cc6d28	5.4.37	2014-12-16 11:44:41 -08:00
Stanislav Malyshev	53f129a44d	add CVE	2014-12-16 10:16:31 -08:00
Stanislav Malyshev	b75867fff0	add missing test file	2014-12-16 10:15:17 -08:00
Stanislav Malyshev	630f9c33c2	Fix bug #68594 - Use after free vulnerability in unserialize()	2014-12-16 10:15:17 -08:00
Andrea Faulds	034e6decb3	Fix undefined behaviour in strnatcmp	2014-12-13 22:27:10 +00:00
Stanislav Malyshev	97df260b27	update NEWS	2014-12-11 10:41:17 -08:00
Anatol Belski	0323f66fa2	move the test to the right place	2014-12-11 10:39:47 -08:00
Anatol Belski	13f1c276ab	Fixed bug #68545 NULL pointer dereference in unserialize.c	2014-12-11 10:39:37 -08:00
Dmitry Stogov	dd791cd717	Fixed possible read after end of buffer and use after free.	2014-12-08 12:18:27 +03:00
Chris Christoff	0e985d3726	Revert unintentional docblock change Revert unintentional docblock change It looks like commit `dd8e59da8f` introduced an unintended docbloc change. I have reverted this change in this commit.	2014-12-05 13:57:03 -08:00
Ferenc Kovacs	b28c3eb47e	make sure that we don't truncate the stack trace and cause false test failures when the test is executed in a directory with long path	2014-12-02 19:17:58 +01:00
Stanislav Malyshev	84be568366	update news	2014-11-30 21:37:39 -08:00
Leigh	301b7f990a	Apply error-code-salt fix to Windows too Conflicts: ext/standard/crypt.c	2014-11-30 21:07:31 -08:00
Leigh	7e870c596d	Bug fixes in light of failing bcrypt tests Conflicts: ext/standard/crypt.c	2014-11-30 21:06:39 -08:00
Leigh	2d9d10fbbf	Add tests from 1.3. Add missing tests. 3 of the missing tests fail. // TODO	2014-11-30 21:05:40 -08:00
Leigh	29f51e1ca9	Upgrade crypt_blowfish to version 1.3	2014-11-30 21:05:32 -08:00
Stanislav Malyshev	7dbc5e5c69	update for LiteSpeed	2014-11-23 18:05:26 -08:00
Stanislav Malyshev	96cde1841a	Revert "made lsapi_main.c compatible with PHP7/phpng ." This reverts commit `9fb816f45a`. Not a security-related fix.	2014-11-22 00:38:04 -08:00
George Wang	9fb816f45a	made lsapi_main.c compatible with PHP7/phpng .	2014-11-20 16:49:01 -05:00
Stanislav Malyshev	98b22864ff	5.4.36-dev	2014-11-11 16:31:38 -08:00
Matteo Beccati	2323e95df9	Fixed bug #66584 Segmentation fault on statement deallocation	2014-11-11 16:25:31 -08:00
Ferenc Kovacs	db5ad4c51f	update NEWS	2014-11-12 00:18:13 +01:00
Dmitry Stogov	9dfa843a38	Partial fix for bug #68365 (zend_mm_heap corrupted after memory overflow in zend_hash_copy)	2014-11-07 09:46:49 +03:00
Stanislav Malyshev	0ddcf2a919	update NEWS	2014-11-03 11:43:15 -08:00
Remi Collet	7740edae36	Fix bug #63595 GMP memory management conflicts with other libraries using GMP Drop use of php memory allocators as this raise various conflicts with other extensions and libraries which use libgmp. No other solution found. We cannot for ensure correct use of allocator with shared lib. Some memory can allocated before php init Some memory can be freed after php shutdown Known broken run cases - php + curl + gnutls + gmp - mod_gnutls + mod_php + gnutls + gmp - php + freetds + gnutls + gmp - php + odbc + freetds + gnutls + gmp - php + php-mapi (zarafa) + gnutls + gmp	2014-11-03 11:42:15 -08:00
Stanislav Malyshev	c351b47ce8	Initialize the offset table - PCRE may sometimes miss offsets	2014-11-03 11:31:02 -08:00
George Wang	1a2ec3fc60	set default response code to 200	2014-11-03 11:42:01 -05:00
Stanislav Malyshev	4d54c4bdf0	fix NEWS & version	2014-10-22 13:16:29 -07:00
Remi Collet	de4fff0fb3	NEWS	2014-10-22 15:39:49 +02:00
Remi Collet	1803228597	Fix bug #68283 : fileinfo: out-of-bounds read in elf note headers Upstream commit https://github.com/file/file/commit/39c7ac1106be844a5296d3eb5971946cc09ffda0 CVE -2014-3710	2014-10-22 15:37:04 +02:00
Stanislav Malyshev	287c91c1f0	Fix bug #68113 (Heap corruption in exif_thumbnail())	2014-10-13 23:17:45 -07:00
Stanislav Malyshev	ab0939e5e5	Fix bug #68089 - do not accept options with embedded \0 Conflicts: ext/curl/interface.c	2014-10-13 23:16:06 -07:00
Stanislav Malyshev	56754a7f9e	Fixed bug #68044 : Integer overflow in unserialize() (32-bits only)	2014-10-13 23:14:25 -07:00
Stanislav Malyshev	88412772d2	Fix bug #68027 - fix date parsing in XMLRPC lib	2014-10-13 23:12:11 -07:00
Rouven Weßling	aee6344e24	Add ZEND_ARG_CALLABLE_INFO to allow internal function to type hint against callable.	2014-01-25 00:04:50 +01:00