fix test to not to cause false positives

Fixed bug #71527 Buffer over-write in finfo_open with malformed magic file
The actual fix is applying the upstream patch from https://github.com/file/file/commit/6713ca45e7757297381f4b4cdb9cf5e624a9ad36
2026-11-09 10:10:50 +00:00 · 2016-03-31 01:35:38 +02:00 · 2016-03-30 23:00:33 +02:00 · 2016-03-30 22:33:04 +02:00 · 2016-03-28 23:45:04 -07:00 · 2016-03-28 23:44:55 -07:00
620 changed files with 17067 additions and 27066 deletions
@@ -1,16 +0,0 @@
-; http://editorconfig.org/
-
-root = true
-
-[*.{c,h}]
-charset                  = UTF-8
-end_of_line              = LF
-indent_size              = 4
-indent_style             = tab
-insert_final_newline     = true
-tab_width                = 4
-trim_trailing_whitespace = true
-
-[*.yml]
-indent_size              = 2
-indent_style             = space
@@ -135,7 +135,6 @@ tests/*/*.sh
 */tests/*/*.sh
 */*/tests/*.diff
 */*/tests/*.out
-*/*/tests/*.out.png
 */*/tests/*.php
 */*/tests/*.exp
 */*/tests/*.log
@@ -1,4 +1,3 @@
-dist: precise
 language: c
 sudo: false
 addons:
@@ -74,7 +74,7 @@ MAINTENANCE:         Maintained
 STATUS:              Working
 -------------------------------------------------------------------------------
 EXTENSION:           fpm
-PRIMARY MAINTAINER:  Jakub Zelenka <bukka@php.net>
+PRIMARY MAINTAINER:  Antony Dovgal <tony2001@php.net>, Jerome Loyet <fat@php.net>
 MAINTENANCE:         Maintained
 STATUS:              Working
 SINCE:               5.3.3
@@ -181,8 +181,8 @@ STATUS:              Working
 SINCE:               5.1
 -------------------------------------------------------------------------------
 EXTENSION:           pdo_dblib
-PRIMARY MAINTAINER:  Adam Baratz <adambaratz@php.net>
-MAINTENANCE:         Maintained
+PRIMARY MAINTAINER:  Unknown
+MAINTENANCE:         Odd fixes
 STATUS:              Working
 SINCE:               5.1
 -------------------------------------------------------------------------------
@@ -205,7 +205,7 @@ STATUS:              Working
 SINCE:               5.1
 -------------------------------------------------------------------------------
 EXTENSION:           pdo_oci
-PRIMARY MAINTAINER:  Christopher Jones <sixd@php.net>
+PRIMARY MAINTAINER:  Unknown
 MAINTENANCE:         Odd fixes
 STATUS:              Working
 SINCE:               5.1
@@ -616,12 +616,6 @@ TSRM_API int shmget(int key, int size, int flags)
 		}
 	} else {
 		if (flags & IPC_EXCL) {
-			if (shm_handle) {
-				CloseHandle(shm_handle);
-			}
-			if (info_handle) {
-				CloseHandle(info_handle);
-			}
 			return -1;
 		}
 	}
@@ -660,27 +654,17 @@ TSRM_API int shmget(int key, int size, int flags)
 TSRM_API void *shmat(int key, const void *shmaddr, int flags)
 {
 	shm_pair *shm = shm_get(key, NULL);
-	int err;

 	if (!shm->segment) {
 		return (void*)-1;
 	}

-	shm->addr = MapViewOfFileEx(shm->segment, FILE_MAP_ALL_ACCESS, 0, 0, 0, NULL);
-
-	err = GetLastError();
-	if (err) {
-		/* Catch more errors */
-		if (ERROR_NOT_ENOUGH_MEMORY == err) {
-			_set_errno(ENOMEM);
-		}
-		return (void*)-1;
-	}
-
 	shm->descriptor->shm_atime = time(NULL);
 	shm->descriptor->shm_lpid  = getpid();
 	shm->descriptor->shm_nattch++;

+	shm->addr = MapViewOfFileEx(shm->segment, FILE_MAP_ALL_ACCESS, 0, 0, 0, NULL);
+
 	return shm->addr;
 }

@@ -218,9 +218,6 @@ PHP 5.6 UPGRADE NOTES
    . CURLOPT_KRBLEVEL
    . CURLOPT_KRB4LEVEL

-  curl_getinfo($ch, CURLINFO_CERTINFO) returns certificate Subject and Issuer
-  as a string (PHP >= 5.6.25)
-
 - Strings:
  substr_compare() now allows $length to be zero.
  pack() and unpack() now support 64-bit format specifiers: q, Q, J and P.
@@ -403,9 +400,6 @@ PHP 5.6 UPGRADE NOTES
 - CURL:
  CURL_HTTP_VERSION_2_0 and CURL_VERSION_HTTP2 (>= 5.6.8)

- GD:
-  IMG_WEBP (>= 5.6.25)
-
 - LDAP:
  LDAP_ESCAPE_FILTER int(1)
  LDAP_ESCAPE_DN     int(2)
@@ -1,25 +0,0 @@
--TEST--
-Next free element may overflow in array literals
--FILE--
-<?php
-
-$i = PHP_INT_MAX;
-$array = [$i => 42, new stdClass];
-var_dump($array);
-
-const FOO = [PHP_INT_MAX => 42, "foo"];
-var_dump(FOO);
-
-?>
--EXPECTF--
-Warning: Cannot add element to the array as the next element is already occupied in %s on line %d
-array(1) {
-  [%d]=>
-  int(42)
-}
-
-Warning: Cannot add element to the array as the next element is already occupied in %s on line %d
-array(1) {
-  [%d]=>
-  int(42)
-}
@@ -1,19 +0,0 @@
--TEST--
-Bug #69537 (__debugInfo with empty string for key gives error)
--FILE--
-<?php
-class Foo {
-
-    public function __debugInfo(){
-        return ['' => 1];
-    }
-}
-
-var_dump(new Foo);
-?>
--EXPECTF--
-object(Foo)#%d (%d) {
-  [""]=>
-  int(1)
-}
-
@@ -1,23 +0,0 @@
--TEST--
-Bug #71841 (EG(error_zval) is not handled well)
--INI--
-error_reporting=0
--FILE--
-<?php
-$z = unserialize('O:1:"A":0:{}');
-var_dump($z->e.=0);
-var_dump(++$z->x);
-var_dump($z->y++);
-
-$y = array(PHP_INT_MAX => 0);
-var_dump($y[] .= 0);
-var_dump(++$y[]);
-var_dump($y[]++);
-?>
--EXPECT--
-NULL
-NULL
-NULL
-NULL
-NULL
-NULL
@@ -1,43 +0,0 @@
--TEST--
-Bug #72496 (declare public method with signature incompatible with parent private method should not throw a warning)
--FILE--
-<?php
-class Foo
-{
-    private function getFoo()
-    {
-        return 'Foo';
-    }
-
-    private function getBar()
-    {
-        return 'Bar';
-    }
-
-    private function getBaz()
-    {
-        return 'Baz';
-    }
-}
-
-class Bar extends Foo
-{
-    public function getFoo($extraArgument)
-    {
-        return $extraArgument;
-    }
-
-    protected function getBar($extraArgument)
-    {
-        return $extraArgument;
-    }
-
-    private function getBaz($extraArgument)
-    {
-        return $extraArgument;
-    }
-}
-
-echo "OK\n";
--EXPECT--
-OK
@@ -1,18 +0,0 @@
--TEST--
-Bug #72907 (null pointer deref, segfault in gc_remove_zval_from_buffer (zend_gc.c:260))
--FILE--
-<?php
-
-$a = 0;
-
-($a->a = &$E) + ($b = $a->b->i -= 0);
-
-?>
--EXPECTF--
-Warning: Attempt to modify property of non-object in %sbug72907.php on line %d
-
-Warning: Attempt to modify property of non-object in %sbug72907.php on line %d
-
-Warning: Creating default object from empty value in %sbug72907.php on line %d
-
-Notice: Undefined property: stdClass::$i in %sbug72907.php on line %d
@@ -1,12 +0,0 @@
--TEST--
-Bug #73337 (try/catch not working with two exceptions inside a same operation)
--FILE--
-<?php
-class d { function __destruct() { throw new Exception; } }
-try { new d + new d; } catch (Exception $e) { print "Exception properly caught\n"; }
-?>
--EXPECTF--
-Notice: Object of class d could not be converted to int in %sbug73337.php on line 3
-
-Notice: Object of class d could not be converted to int in %sbug73337.php on line 3
-Exception properly caught
@@ -1 +0,0 @@
-0=0&~2000000000
@@ -1,15 +0,0 @@
--TEST--
-Bug #74603 (PHP INI Parsing Stack Buffer Overflow Vulnerability)
--SKIPIF--
-<?php
-if (PHP_INT_MAX !== 2147483647)
-        die('skip for 32-bit only');
--FILE--
-<?php
-var_dump(parse_ini_file(__DIR__ . "/bug74603.ini", true, INI_SCANNER_NORMAL));
-?>
--EXPECT--
-array(1) {
-  [0]=>
-  string(1) "0"
-}
@@ -1,15 +0,0 @@
--TEST--
-Constexpr arrays should be able to handle resource keys
--FILE--
-<?php
-
-const FOO = [STDIN => 42];
-var_dump(FOO);
-
-?>
--EXPECTF--
-Strict Standards: Resource ID#%d used as offset, casting to integer (%d) in %s on line %d
-array(1) {
-  [%d]=>
-  int(42)
-}
@@ -1,7 +1,5 @@
 --TEST--
 Testing __debugInfo() magic method with bad returns RESOURCE
--INI--
-allow_url_fopen=1
 --FILE--
 <?php

@@ -13,5 +13,5 @@ var_dump(gc_collect_cycles());
 echo "ok\n";
 ?>
 --EXPECT--
-int(2)
+int(1)
 ok
@@ -1074,7 +1074,7 @@ static int zval_update_class_constant(zval **pp, int is_static, int offset TSRML
 						*scope = old_scope;
 						return ret;
 					}
-				}
+				}				
 				ce = ce->parent;
 			} while (ce);

@@ -1279,14 +1279,9 @@ ZEND_API int add_assoc_double_ex(zval *arg, const char *key, uint key_len, doubl
 ZEND_API int add_assoc_string_ex(zval *arg, const char *key, uint key_len, char *str, int duplicate) /* {{{ */
 {
 	zval *tmp;
-	size_t _len = strlen(str);
-
-	if (UNEXPECTED(_len > INT_MAX)) {
-		zend_error_noreturn(E_ERROR, "String overflow, max size is %d", INT_MAX);
-	}

 	MAKE_STD_ZVAL(tmp);
-	ZVAL_STRINGL(tmp, str, _len, duplicate);
+	ZVAL_STRING(tmp, str, duplicate);

 	return zend_symtable_update(Z_ARRVAL_P(arg), key, key_len, (void *) &tmp, sizeof(zval *), NULL);
 }
@@ -1296,10 +1291,6 @@ ZEND_API int add_assoc_stringl_ex(zval *arg, const char *key, uint key_len, char
 {
 	zval *tmp;

-	if (UNEXPECTED(length > INT_MAX)) {
-		zend_error_noreturn(E_ERROR, "String overflow, max size is %d", INT_MAX);
-	}
-
 	MAKE_STD_ZVAL(tmp);
 	ZVAL_STRINGL(tmp, str, length, duplicate);

@@ -1371,11 +1362,6 @@ ZEND_API int add_index_double(zval *arg, ulong index, double d) /* {{{ */
 ZEND_API int add_index_string(zval *arg, ulong index, const char *str, int duplicate) /* {{{ */
 {
 	zval *tmp;
-	size_t _len = strlen(str);
-
-	if (UNEXPECTED(_len > INT_MAX)) {
-		zend_error_noreturn(E_ERROR, "String overflow, max size is %d", INT_MAX);
-	}

 	MAKE_STD_ZVAL(tmp);
 	ZVAL_STRING(tmp, str, duplicate);
@@ -1388,10 +1374,6 @@ ZEND_API int add_index_stringl(zval *arg, ulong index, const char *str, uint len
 {
 	zval *tmp;

-	if (UNEXPECTED(length > INT_MAX)) {
-		zend_error_noreturn(E_ERROR, "String overflow, max size is %d", INT_MAX);
-	}
-
 	MAKE_STD_ZVAL(tmp);
 	ZVAL_STRINGL(tmp, str, length, duplicate);

@@ -1475,9 +1457,6 @@ ZEND_API int add_next_index_stringl(zval *arg, const char *str, uint length, int
 {
 	zval *tmp;

-	if (UNEXPECTED(length > INT_MAX)) {
-		zend_error_noreturn(E_ERROR, "String overflow, max size is %d", INT_MAX);
-	}
 	MAKE_STD_ZVAL(tmp);
 	ZVAL_STRINGL(tmp, str, length, duplicate);

@@ -1494,14 +1473,9 @@ ZEND_API int add_next_index_zval(zval *arg, zval *value) /* {{{ */
 ZEND_API int add_get_assoc_string_ex(zval *arg, const char *key, uint key_len, const char *str, void **dest, int duplicate) /* {{{ */
 {
 	zval *tmp;
-	size_t _len = strlen(str);
-
-	if (UNEXPECTED(_len > INT_MAX)) {
-		zend_error_noreturn(E_ERROR, "String overflow, max size is %d", INT_MAX);
-	}

 	MAKE_STD_ZVAL(tmp);
-	ZVAL_STRINGL(tmp, str, _len, duplicate);
+	ZVAL_STRING(tmp, str, duplicate);

 	return zend_symtable_update(Z_ARRVAL_P(arg), key, key_len, (void *) &tmp, sizeof(zval *), dest);
 }
@@ -1511,10 +1485,6 @@ ZEND_API int add_get_assoc_stringl_ex(zval *arg, const char *key, uint key_len,
 {
 	zval *tmp;

-	if (UNEXPECTED(length > INT_MAX)) {
-		zend_error_noreturn(E_ERROR, "String overflow, max size is %d", INT_MAX);
-	}
-
 	MAKE_STD_ZVAL(tmp);
 	ZVAL_STRINGL(tmp, str, length, duplicate);

@@ -1694,14 +1664,9 @@ ZEND_API int add_property_string_ex(zval *arg, const char *key, uint key_len, co
 {
 	zval *tmp;
 	zval *z_key;
-	size_t _len = strlen(str);
-
-	if (UNEXPECTED(_len > INT_MAX)) {
-		zend_error_noreturn(E_ERROR, "String overflow, max size is %d", INT_MAX);
-	}

 	MAKE_STD_ZVAL(tmp);
-	ZVAL_STRINGL(tmp, str, _len, duplicate);
+	ZVAL_STRING(tmp, str, duplicate);

 	MAKE_STD_ZVAL(z_key);
 	ZVAL_STRINGL(z_key, key, key_len-1, 1);
@@ -1718,10 +1683,6 @@ ZEND_API int add_property_stringl_ex(zval *arg, const char *key, uint key_len, c
 	zval *tmp;
 	zval *z_key;

-	if (UNEXPECTED(length > INT_MAX)) {
-		zend_error_noreturn(E_ERROR, "String overflow, max size is %d", INT_MAX);
-	}
-
 	MAKE_STD_ZVAL(tmp);
 	ZVAL_STRINGL(tmp, str, length, duplicate);

@@ -1805,12 +1766,6 @@ ZEND_API int zend_startup_module_ex(zend_module_entry *module TSRMLS_DC) /* {{{
 }
 /* }}} */

-static int zend_startup_module_int(zend_module_entry *module TSRMLS_DC) /* {{{ */
-{
-	return (zend_startup_module_ex(module TSRMLS_CC) == SUCCESS) ? ZEND_HASH_APPLY_KEEP : ZEND_HASH_APPLY_REMOVE;
-}
-/* }}} */
-
 static void zend_sort_modules(void *base, size_t count, size_t siz, compare_func_t compare TSRMLS_DC) /* {{{ */
 {
 	Bucket **b1 = base;
@@ -1881,7 +1836,7 @@ ZEND_API void zend_collect_module_handlers(TSRMLS_D) /* {{{ */
 	module_post_deactivate_handlers = module_request_shutdown_handlers + shutdown_count + 1;
 	module_post_deactivate_handlers[post_deactivate_count] = NULL;
 	startup_count = 0;
-
+	
 	for (zend_hash_internal_pointer_reset_ex(&module_registry, &pos);
 	     zend_hash_get_current_data_ex(&module_registry, (void *) &module, &pos) == SUCCESS;
 	     zend_hash_move_forward_ex(&module_registry, &pos)) {
@@ -1927,7 +1882,7 @@ ZEND_API void zend_collect_module_handlers(TSRMLS_D) /* {{{ */
 ZEND_API int zend_startup_modules(TSRMLS_D) /* {{{ */
 {
 	zend_hash_sort(&module_registry, zend_sort_modules, NULL, 0 TSRMLS_CC);
-	zend_hash_apply(&module_registry, (apply_func_t)zend_startup_module_int TSRMLS_CC);
+	zend_hash_apply(&module_registry, (apply_func_t)zend_startup_module_ex TSRMLS_CC);
 	return SUCCESS;
 }
 /* }}} */
@@ -2128,7 +2083,7 @@ ZEND_API int zend_register_functions(zend_class_entry *scope, const zend_functio
 		}
 		if (ptr->arg_info) {
 			zend_internal_function_info *info = (zend_internal_function_info*)ptr->arg_info;
-
+			
 			internal_function->arg_info = (zend_arg_info*)ptr->arg_info+1;
 			internal_function->num_args = ptr->num_args;
 			/* Currently you cannot denote that the function can accept less arguments than num_args */
@@ -2746,7 +2701,7 @@ static int zend_is_callable_check_class(const char *name, int name_len, zend_fca
 			}
 			ret = 1;
 		}
-	} else if (name_len == sizeof("parent") - 1 &&
+	} else if (name_len == sizeof("parent") - 1 && 
 		       !memcmp(lcname, "parent", sizeof("parent") - 1)) {
 		if (!EG(scope)) {
 			if (error) *error = estrdup("cannot access parent:: when no class scope is active");
@@ -3075,7 +3030,7 @@ ZEND_API zend_bool zend_is_callable_ex(zval *callable, zval *object_ptr, uint ch
 	if (error) {
 		*error = NULL;
 	}
-
+	
 	fcc->initialized = 0;
 	fcc->calling_scope = NULL;
 	fcc->called_scope = NULL;
@@ -3087,7 +3042,7 @@ ZEND_API zend_bool zend_is_callable_ex(zval *callable, zval *object_ptr, uint ch
 		object_ptr = NULL;
 	}
 	if (object_ptr &&
-	    (!EG(objects_store).object_buckets ||
+	    (!EG(objects_store).object_buckets || 
 	     !EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(object_ptr)].valid)) {
 		return 0;
 	}
@@ -3168,7 +3123,7 @@ ZEND_API zend_bool zend_is_callable_ex(zval *callable, zval *object_ptr, uint ch
 						}

 					} else {
-						if (!EG(objects_store).object_buckets ||
+						if (!EG(objects_store).object_buckets || 
 						    !EG(objects_store).object_buckets[Z_OBJ_HANDLE_PP(obj)].valid) {
 							return 0;
 						}
@@ -3237,7 +3192,7 @@ ZEND_API zend_bool zend_is_callable_ex(zval *callable, zval *object_ptr, uint ch
 					*callable_name = emalloc(*callable_name_len + 1);
 					memcpy(*callable_name, ce->name, ce->name_length);
 					memcpy((*callable_name) + ce->name_length, "::__invoke", sizeof("::__invoke"));
-				}
+				}									
 				return 1;
 			}
 			/* break missing intentionally */
@@ -3776,30 +3731,6 @@ ZEND_API void zend_update_property(zend_class_entry *scope, zval *object, const
 }
 /* }}} */

-ZEND_API void zend_unset_property(zend_class_entry *scope, zval *object, const char *name, int name_length TSRMLS_DC) /* {{{ */
-{
-	zval *property;
-	zend_class_entry *old_scope = EG(scope);
-
-	EG(scope) = scope;
-
-	if (!Z_OBJ_HT_P(object)->unset_property) {
-		const char *class_name;
-		zend_uint class_name_len;
-
-		zend_get_object_classname(object, &class_name, &class_name_len TSRMLS_CC);
-
-		zend_error(E_CORE_ERROR, "Property %s of class %s cannot be unset", name, class_name);
-	}
-	MAKE_STD_ZVAL(property);
-	ZVAL_STRINGL(property, name, name_length, 1);
-	Z_OBJ_HT_P(object)->unset_property(object, property, 0 TSRMLS_CC);
-	zval_ptr_dtor(&property);
-
-	EG(scope) = old_scope;
-}
-/* }}} */
-
 ZEND_API void zend_update_property_null(zend_class_entry *scope, zval *object, const char *name, int name_length TSRMLS_DC) /* {{{ */
 {
 	zval *tmp;
@@ -330,7 +330,6 @@ ZEND_API void zend_update_property_long(zend_class_entry *scope, zval *object, c
 ZEND_API void zend_update_property_double(zend_class_entry *scope, zval *object, const char *name, int name_length, double value TSRMLS_DC);
 ZEND_API void zend_update_property_string(zend_class_entry *scope, zval *object, const char *name, int name_length, const char *value TSRMLS_DC);
 ZEND_API void zend_update_property_stringl(zend_class_entry *scope, zval *object, const char *name, int name_length, const char *value, int value_length TSRMLS_DC);
-ZEND_API void zend_unset_property(zend_class_entry *scope, zval *object, const char *name, int name_length TSRMLS_DC);

 ZEND_API int zend_update_static_property(zend_class_entry *scope, const char *name, int name_length, zval *value TSRMLS_DC);
 ZEND_API int zend_update_static_property_null(zend_class_entry *scope, const char *name, int name_length TSRMLS_DC);
@@ -448,7 +447,7 @@ ZEND_API int add_property_zval_ex(zval *arg, const char *key, uint key_len, zval
 #define add_property_double(__arg, __key, __d) add_property_double_ex(__arg, __key, strlen(__key)+1, __d TSRMLS_CC)
 #define add_property_string(__arg, __key, __str, __duplicate) add_property_string_ex(__arg, __key, strlen(__key)+1, __str, __duplicate TSRMLS_CC)
 #define add_property_stringl(__arg, __key, __str, __length, __duplicate) add_property_stringl_ex(__arg, __key, strlen(__key)+1, __str, __length, __duplicate TSRMLS_CC)
-#define add_property_zval(__arg, __key, __value) add_property_zval_ex(__arg, __key, strlen(__key)+1, __value TSRMLS_CC)
+#define add_property_zval(__arg, __key, __value) add_property_zval_ex(__arg, __key, strlen(__key)+1, __value TSRMLS_CC)       


 ZEND_API int call_user_function(HashTable *function_table, zval **object_pp, zval *function_name, zval *retval_ptr, zend_uint param_count, zval *params[] TSRMLS_DC);
@@ -459,7 +458,7 @@ ZEND_API extern const zend_fcall_info_cache empty_fcall_info_cache;

 /** Build zend_call_info/cache from a zval*
 *
- * Caller is responsible to provide a return value, otherwise the we will crash.
+ * Caller is responsible to provide a return value, otherwise the we will crash. 
 * fci->retval_ptr_ptr = NULL;
 * In order to pass parameters the following members need to be set:
 * fci->param_count = 0;
@@ -579,9 +578,6 @@ END_EXTERN_C()
 		const char *__s=(s);				\
 		zval *__z = (z);					\
 		Z_STRLEN_P(__z) = strlen(__s);		\
-		if (UNEXPECTED(Z_STRLEN_P(__z) < 0)) { \
-			zend_error(E_ERROR, "String size overflow"); \
-		}									\
 		Z_STRVAL_P(__z) = (duplicate?estrndup(__s, Z_STRLEN_P(__z)):(char*)__s);\
 		Z_TYPE_P(__z) = IS_STRING;			\
 	} while (0)
@@ -655,21 +651,6 @@ END_EXTERN_C()
 } while (0)
 #define RETURN_ZVAL_FAST(z) { RETVAL_ZVAL_FAST(z); return; }

-/* Check that returned string length fits int */
-#define RETVAL_STRINGL_CHECK(s, len, dup) do {	\
-	size_t __len = (len);					\
-	if (UNEXPECTED(__len > INT_MAX)) { 		\
-		php_error_docref(NULL TSRMLS_CC, E_WARNING, "String too long, max is %d", INT_MAX); \
-		if(!(dup)) { 						\
-			efree((s));						\
-		}									\
-		RETURN_FALSE;						\
-	}										\
-	RETVAL_STRINGL((s), (int)__len, (dup)); \
-} while (0)
-#define RETURN_STRINGL_CHECK(s, len, dup) { RETVAL_STRINGL_CHECK(s, len, dup); return; }
-
-
 #define SET_VAR_STRING(n, v) {																				\
 								{																			\
 									zval *var;																\
@@ -2578,15 +2578,6 @@ static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
 #endif


-ZEND_API void *_safe_emalloc_string(size_t nmemb, size_t size, size_t offset ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)
-{
-	size_t str_size = safe_address(nmemb, size, offset);
-	if (UNEXPECTED(str_size > INT_MAX)) {
-		zend_error_noreturn(E_ERROR, "String allocation overflow, max size is %d", INT_MAX);
-	}
-	return emalloc_rel(str_size);
-}
-
 ZEND_API void *_safe_emalloc(size_t nmemb, size_t size, size_t offset ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)
 {
 	return emalloc_rel(safe_address(nmemb, size, offset));
@@ -2735,9 +2726,9 @@ static void alloc_globals_ctor(zend_alloc_globals *alloc_globals TSRMLS_DC)
 		alloc_globals->mm_heap = malloc(sizeof(struct _zend_mm_heap));
 		memset(alloc_globals->mm_heap, 0, sizeof(struct _zend_mm_heap));
 		alloc_globals->mm_heap->use_zend_alloc = 0;
-		alloc_globals->mm_heap->_malloc = __zend_malloc;
+		alloc_globals->mm_heap->_malloc = malloc;
 		alloc_globals->mm_heap->_free = free;
-		alloc_globals->mm_heap->_realloc = __zend_realloc;
+		alloc_globals->mm_heap->_realloc = realloc;
 	} else {
 		alloc_globals->mm_heap = zend_mm_startup();
 	}
@@ -5,7 +5,7 @@
   | Copyright (c) 1998-2016 Zend Technologies Ltd. (http://www.zend.com) |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
-   | that is bundled with this package in the file LICENSE, and is        |
+   | that is bundled with this package in the file LICENSE, and is        | 
   | available through the world-wide-web at the following url:           |
   | http://www.zend.com/license/2_00.txt.                                |
   | If you did not receive a copy of the Zend license and are unable to  |
@@ -56,7 +56,6 @@ ZEND_API char *zend_strndup(const char *s, unsigned int length) ZEND_ATTRIBUTE_M

 ZEND_API void *_emalloc(size_t size ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) ZEND_ATTRIBUTE_MALLOC ZEND_ATTRIBUTE_ALLOC_SIZE(1);
 ZEND_API void *_safe_emalloc(size_t nmemb, size_t size, size_t offset ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) ZEND_ATTRIBUTE_MALLOC;
-ZEND_API void *_safe_emalloc_string(size_t nmemb, size_t size, size_t offset ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) ZEND_ATTRIBUTE_MALLOC;
 ZEND_API void *_safe_malloc(size_t nmemb, size_t size, size_t offset) ZEND_ATTRIBUTE_MALLOC;
 ZEND_API void _efree(void *ptr ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC);
 ZEND_API void *_ecalloc(size_t nmemb, size_t size ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC) ZEND_ATTRIBUTE_MALLOC ZEND_ATTRIBUTE_ALLOC_SIZE2(1,2);
@@ -70,7 +69,6 @@ ZEND_API size_t _zend_mem_block_size(void *ptr TSRMLS_DC ZEND_FILE_LINE_DC ZEND_
 /* Standard wrapper macros */
 #define emalloc(size)						_emalloc((size) ZEND_FILE_LINE_CC ZEND_FILE_LINE_EMPTY_CC)
 #define safe_emalloc(nmemb, size, offset)	_safe_emalloc((nmemb), (size), (offset) ZEND_FILE_LINE_CC ZEND_FILE_LINE_EMPTY_CC)
-#define safe_emalloc_string(nmemb, size, offset)	_safe_emalloc_string((nmemb), (size), (offset) ZEND_FILE_LINE_CC ZEND_FILE_LINE_EMPTY_CC)
 #define efree(ptr)							_efree((ptr) ZEND_FILE_LINE_CC ZEND_FILE_LINE_EMPTY_CC)
 #define ecalloc(nmemb, size)				_ecalloc((nmemb), (size) ZEND_FILE_LINE_CC ZEND_FILE_LINE_EMPTY_CC)
 #define erealloc(ptr, size)					_erealloc((ptr), (size), 0 ZEND_FILE_LINE_CC ZEND_FILE_LINE_EMPTY_CC)
@@ -3252,8 +3252,8 @@ static zend_bool zend_do_perform_implementation_check(const zend_function *fe, c
 		return 1;
 	}

-	/* If the prototype method is private do not enforce a signature */
-	if (proto->common.fn_flags & ZEND_ACC_PRIVATE) {
+	/* If both methods are private do not enforce a signature */
+    if ((fe->common.fn_flags & ZEND_ACC_PRIVATE) && (proto->common.fn_flags & ZEND_ACC_PRIVATE)) {
 		return 1;
 	}

@@ -3637,7 +3637,6 @@ static zend_bool do_inherit_property_access_check(HashTable *target_ht, zend_pro
 {
 	zend_property_info *child_info;
 	zend_class_entry *parent_ce = ce->parent;
-	TSRMLS_FETCH();

 	if (parent_info->flags & (ZEND_ACC_PRIVATE|ZEND_ACC_SHADOW)) {
 		if (zend_hash_quick_find(&ce->properties_info, hash_key->arKey, hash_key->nKeyLength, hash_key->h, (void **) &child_info)==SUCCESS) {
@@ -3670,8 +3669,7 @@ static zend_bool do_inherit_property_access_check(HashTable *target_ht, zend_pro
 		if ((child_info->flags & ZEND_ACC_PPP_MASK) > (parent_info->flags & ZEND_ACC_PPP_MASK)) {
 			zend_error_noreturn(E_COMPILE_ERROR, "Access level to %s::$%s must be %s (as in class %s)%s", ce->name, hash_key->arKey, zend_visibility_string(parent_info->flags), parent_ce->name, (parent_info->flags&ZEND_ACC_PUBLIC) ? "" : " or weaker");
 		} else if ((child_info->flags & ZEND_ACC_STATIC) == 0) {
-			/* Don't keep default properties in GC (thry may be freed by opcache) */
-			i_zval_ptr_dtor_nogc(ce->default_properties_table[parent_info->offset] ZEND_FILE_LINE_CC TSRMLS_CC);
+			zval_ptr_dtor(&(ce->default_properties_table[parent_info->offset]));
 			ce->default_properties_table[parent_info->offset] = ce->default_properties_table[child_info->offset];
 			ce->default_properties_table[child_info->offset] = NULL;
 			child_info->offset = parent_info->offset;
@@ -5404,7 +5402,7 @@ ZEND_API int zend_unmangle_property_name_ex(const char *mangled_property, int le

 	*class_name = NULL;

-	if (!len || mangled_property[0] != 0) {
+	if (mangled_property[0]!=0) {
 		*prop_name = mangled_property;
 		if (prop_len) {
 			*prop_len = len;
@@ -5929,7 +5927,7 @@ void zend_do_add_array_element(znode *result, const znode *expr, const znode *of
 }
 /* }}} */

-void zend_do_add_static_array_element(zval *result, zval *offset, zval *expr) /* {{{ */
+void zend_do_add_static_array_element(zval *result, zval *offset, const zval *expr) /* {{{ */
 {
 	if (offset) {
 		switch (Z_TYPE_P(offset)) {
@@ -5940,9 +5938,6 @@ void zend_do_add_static_array_element(zval *result, zval *offset, zval *expr) /*
 			case IS_NULL:
 				zend_symtable_update(Z_ARRVAL_P(result), "", 1, &expr, sizeof(zval *), NULL);
 				break;
-			case IS_RESOURCE:
-				zend_error(E_STRICT, "Resource ID#%ld used as offset, casting to integer (%ld)", Z_LVAL_P(offset), Z_LVAL_P(offset));
-				/* break missing intentionally */
 			case IS_LONG:
 			case IS_BOOL:
 				zend_hash_index_update(Z_ARRVAL_P(result), Z_LVAL_P(offset), &expr, sizeof(zval *), NULL);
@@ -5955,10 +5950,7 @@ void zend_do_add_static_array_element(zval *result, zval *offset, zval *expr) /*
 				break;
 		}
 	} else {
-		if (zend_hash_next_index_insert(Z_ARRVAL_P(result), &expr, sizeof(zval *), NULL) == FAILURE) {
-			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
-			zval_ptr_dtor(&expr);
-		}
+		zend_hash_next_index_insert(Z_ARRVAL_P(result), &expr, sizeof(zval *), NULL);
 	}
 }
 /* }}} */
@@ -598,7 +598,7 @@ void zend_do_shell_exec(znode *result, const znode *cmd TSRMLS_DC);

 void zend_do_init_array(znode *result, const znode *expr, const znode *offset, zend_bool is_ref TSRMLS_DC);
 void zend_do_add_array_element(znode *result, const znode *expr, const znode *offset, zend_bool is_ref TSRMLS_DC);
-void zend_do_add_static_array_element(zval *result, zval *offset, zval *expr);
+void zend_do_add_static_array_element(zval *result, zval *offset, const zval *expr);
 void zend_do_list_init(TSRMLS_D);
 void zend_do_list_end(znode *result, znode *expr TSRMLS_DC);
 void zend_do_add_list_element(const znode *element TSRMLS_DC);
@@ -229,9 +229,13 @@ ZEND_METHOD(exception, __construct)
 /* {{{ proto Exception::__wakeup()
   Exception unserialize checks */
 #define CHECK_EXC_TYPE(name, type) \
-	value = zend_read_property(default_exception_ce, object, name, sizeof(name)-1, 1 TSRMLS_CC); \
-	if (value && Z_TYPE_P(value) != IS_NULL && Z_TYPE_P(value) != type) { \
-		zend_unset_property(default_exception_ce, object, name, sizeof(name)-1 TSRMLS_CC); \
+	value = zend_read_property(default_exception_ce, object, name, sizeof(name)-1, 0 TSRMLS_CC); \
+	if(value && Z_TYPE_P(value) != type) { \
+		zval *tmp; \
+		MAKE_STD_ZVAL(tmp); \
+		ZVAL_STRINGL(tmp, name, sizeof(name)-1, 1); \
+		Z_OBJ_HANDLER_P(object, unset_property)(object, tmp, 0 TSRMLS_CC); \
+		zval_ptr_dtor(&tmp); \
 	}

 ZEND_METHOD(exception, __wakeup)
@@ -244,12 +248,7 @@ ZEND_METHOD(exception, __wakeup)
 	CHECK_EXC_TYPE("file", IS_STRING);
 	CHECK_EXC_TYPE("line", IS_LONG);
 	CHECK_EXC_TYPE("trace", IS_ARRAY);
-	value = zend_read_property(default_exception_ce, object, "previous", sizeof("previous")-1, 1 TSRMLS_CC);
-	if (value && Z_TYPE_P(value) != IS_NULL && (Z_TYPE_P(value) != IS_OBJECT ||
-			!instanceof_function(Z_OBJCE_P(value), default_exception_ce TSRMLS_CC) ||
-			value == object)) {
-		zend_unset_property(default_exception_ce, object, "previous", sizeof("previous")-1 TSRMLS_CC);
-	}
+	CHECK_EXC_TYPE("previous", IS_OBJECT);
 }
 /* }}} */

@@ -728,11 +727,7 @@ ZEND_METHOD(exception, __toString)
 		zval_dtor(&file);
 		zval_dtor(&line);

-		Z_OBJPROP_P(exception)->nApplyCount++;
-		exception = zend_read_property(default_exception_ce, exception, "previous", sizeof("previous")-1, 1 TSRMLS_CC);
-		if (exception && Z_TYPE_P(exception) == IS_OBJECT && Z_OBJPROP_P(exception)->nApplyCount > 0) {
-			exception = NULL;
-		}
+		exception = zend_read_property(default_exception_ce, exception, "previous", sizeof("previous")-1, 0 TSRMLS_CC);

 		if (trace) {
 			zval_ptr_dtor(&trace);
@@ -741,17 +736,6 @@ ZEND_METHOD(exception, __toString)
 	}
 	zval_dtor(&fname);

-	/* Reset apply counts */
-	exception = getThis();
-	while (exception && Z_TYPE_P(exception) == IS_OBJECT && instanceof_function(Z_OBJCE_P(exception), default_exception_ce TSRMLS_CC)) {
-		if(Z_OBJPROP_P(exception)->nApplyCount) {
-			Z_OBJPROP_P(exception)->nApplyCount--;
-		} else {
-			break;
-		}
-		exception = zend_read_property(default_exception_ce, exception, "previous", sizeof("previous")-1, 1 TSRMLS_CC);
-	}
-
 	/* We store the result in the private property string so we can access
 	 * the result in uncaught exception handlers without memleaks. */
 	zend_update_property_string(default_exception_ce, getThis(), "string", sizeof("string")-1, str TSRMLS_CC);
@@ -909,10 +893,11 @@ static void zend_error_va(int type, const char *file, uint lineno, const char *f
 ZEND_API void zend_exception_error(zval *exception, int severity TSRMLS_DC) /* {{{ */
 {
 	zend_class_entry *ce_exception = Z_OBJCE_P(exception);
-	EG(exception) = NULL;
 	if (instanceof_function(ce_exception, default_exception_ce TSRMLS_CC)) {
 		zval *str, *file, *line;

+		EG(exception) = NULL;
+
 		zend_call_method_with_0_params(&exception, ce_exception, NULL, "__tostring", &str);
 		if (!EG(exception)) {
 			if (Z_TYPE_P(str) != IS_STRING) {
@@ -951,7 +936,6 @@ ZEND_API void zend_exception_error(zval *exception, int severity TSRMLS_DC) /* {
 	} else {
 		zend_error(severity, "Uncaught exception '%s'", ce_exception->name);
 	}
-	zval_ptr_dtor(&exception);
 }
 /* }}} */

@@ -522,7 +522,9 @@ static void zend_assign_to_variable_reference(zval **variable_ptr_ptr, zval **va
 	zval *variable_ptr = *variable_ptr_ptr;
 	zval *value_ptr = *value_ptr_ptr;

-	if (variable_ptr != value_ptr) {
+	if (variable_ptr == &EG(error_zval) || value_ptr == &EG(error_zval)) {
+		variable_ptr_ptr = &EG(uninitialized_zval_ptr);
+	} else if (variable_ptr != value_ptr) {
 		if (!PZVAL_IS_REF(value_ptr)) {
 			/* break it away */
 			Z_DELREF_P(value_ptr);
@@ -826,10 +826,7 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache TS
 		if (EG(active_op_array)->fn_flags & ZEND_ACC_GENERATOR) {
 			*fci->retval_ptr_ptr = zend_generator_create_zval(EG(active_op_array) TSRMLS_CC);
 		} else {
-			const zend_op *current_opline_before_exception = EG(opline_before_exception);
-
 			zend_execute(EG(active_op_array) TSRMLS_CC);
-			EG(opline_before_exception) = current_opline_before_exception;
 		}

 		if (!fci->symbol_table && EG(active_symbol_table)) {
@@ -53,7 +53,7 @@ static void zend_ini_do_op(char type, zval *result, zval *op1, zval *op2)
 {
 	int i_result;
 	int i_op1, i_op2;
-	char str_result[MAX_LENGTH_OF_LONG+1];
+	char str_result[MAX_LENGTH_OF_LONG];

 	i_op1 = atoi(Z_STRVAL_P(op1));
 	free(Z_STRVAL_P(op1));
@@ -1184,10 +1184,6 @@ ZEND_API zend_function *zend_std_get_static_method(zend_class_entry *ce, const c
 	ALLOCA_FLAG(use_heap)

 	if (EXPECTED(key != NULL)) {
-#if (ZEND_GCC_VERSION == 4009) && !(defined(ZTS) && defined(NETWARE)) && !(defined(ZTS) && defined(HPUX)) && !defined(DARWIN)
-		/* This is a workaround for bug in GCC 4.9.2 */
-		use_heap = 0;
-#endif
 		lc_function_name = Z_STRVAL(key->constant);
 		hash_value = key->hash_value;
 	} else {
@@ -215,7 +215,7 @@ ZEND_API void zend_objects_store_del_ref_by_handle_ex(zend_object_handle handle,
 					} zend_end_try();
 				}
 			}
-
+			
 			/* re-read the object from the object store as the store might have been reallocated in the dtor */
 			obj = &EG(objects_store).object_buckets[handle].bucket.obj;

@@ -306,8 +306,8 @@ ZEND_API void zend_object_store_ctor_failed(zval *zobject TSRMLS_DC)
 {
 	zend_object_handle handle = Z_OBJ_HANDLE_P(zobject);
 	zend_object_store_bucket *obj_bucket = &EG(objects_store).object_buckets[handle];
-
-	obj_bucket->bucket.obj.handlers = Z_OBJ_HT_P(zobject);
+	
+	obj_bucket->bucket.obj.handlers = Z_OBJ_HT_P(zobject);;
 	obj_bucket->destructor_called = 1;
 }

@@ -1397,13 +1397,7 @@ ZEND_API int shift_right_function(zval *result, zval *op1, zval *op2 TSRMLS_DC)
 ZEND_API int add_char_to_string(zval *result, const zval *op1, const zval *op2) /* {{{ */
 {
 	int length = Z_STRLEN_P(op1) + 1;
-	char *buf;
-
-	if (UNEXPECTED(length < 0)) {
-		zend_error(E_ERROR, "String size overflow");
-	}
-
-	buf = str_erealloc(Z_STRVAL_P(op1), length + 1);
+	char *buf = str_erealloc(Z_STRVAL_P(op1), length + 1);

 	buf[length - 1] = (char) Z_LVAL_P(op2);
 	buf[length] = 0;
@@ -1416,13 +1410,7 @@ ZEND_API int add_char_to_string(zval *result, const zval *op1, const zval *op2)
 ZEND_API int add_string_to_string(zval *result, const zval *op1, const zval *op2) /* {{{ */
 {
 	int length = Z_STRLEN_P(op1) + Z_STRLEN_P(op2);
-	char *buf;
-
-	if (UNEXPECTED(length < 0)) {
-		zend_error(E_ERROR, "String size overflow");
-	}
-
-	buf = str_erealloc(Z_STRVAL_P(op1), length + 1);
+	char *buf = str_erealloc(Z_STRVAL_P(op1), length + 1);

 	memcpy(buf + Z_STRLEN_P(op1), Z_STRVAL_P(op2), Z_STRLEN_P(op2));
 	buf[length] = 0;
@@ -2590,7 +2590,7 @@ ZEND_API double zend_hex_strtod(const char *str, const char **endptr)
 	int any = 0;
 	double value = 0;

-	if (s[0] == '\0' || s[1] == '\0') {
+	if (strlen(str) < 2) {
 		*endptr = str;
 		return 0.0;
 	}
@@ -651,14 +651,14 @@ CWD_API void realpath_cache_del(const char *path, int path_len TSRMLS_DC) /* {{{
 					memcmp(path, (*bucket)->path, path_len) == 0) {
 			realpath_cache_bucket *r = *bucket;
 			*bucket = (*bucket)->next;
-
+		   
 			/* if the pointers match then only subtract the length of the path */
 		   	if(r->path == r->realpath) {
 				CWDG(realpath_cache_size) -= sizeof(realpath_cache_bucket) + r->path_len + 1;
 			} else {
 				CWDG(realpath_cache_size) -= sizeof(realpath_cache_bucket) + r->path_len + 1 + r->realpath_len + 1;
 			}
-
+		   
 			free(r);
 			return;
 		} else {
@@ -734,7 +734,7 @@ static inline realpath_cache_bucket* realpath_cache_find(const char *path, int p
 			realpath_cache_bucket *r = *bucket;
 			*bucket = (*bucket)->next;

-			/* if the pointers match then only subtract the length of the path */
+			/* if the pointers match then only subtract the length of the path */		   
 		   	if(r->path == r->realpath) {
 				CWDG(realpath_cache_size) -= sizeof(realpath_cache_bucket) + r->path_len + 1;
 			} else {
@@ -919,7 +919,6 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i

 			pbuffer = (REPARSE_DATA_BUFFER *)do_alloca(MAXIMUM_REPARSE_DATA_BUFFER_SIZE, use_heap_large);
 			if (pbuffer == NULL) {
-				CloseHandle(hLink);
 				return -1;
 			}
 			if(!DeviceIoControl(hLink, FSCTL_GET_REPARSE_POINT, NULL, 0, pbuffer,  MAXIMUM_REPARSE_DATA_BUFFER_SIZE, &retlength, NULL)) {
@@ -1190,7 +1189,7 @@ CWD_API int virtual_file_ex(cwd_state *state, const char *path, verify_path_func
 	int add_slash;
 	void *tmp;

-	if (path_length <= 0 || path_length >= MAXPATHLEN-1) {
+	if (path_length == 0 || path_length >= MAXPATHLEN-1) {
 #ifdef TSRM_WIN32
 # if _MSC_VER < 1300
 		errno = EINVAL;
@@ -1896,7 +1895,7 @@ CWD_API FILE *virtual_popen(const char *command, const char *type TSRMLS_DC) /*
 #else /* Unix */
 CWD_API FILE *virtual_popen(const char *command, const char *type TSRMLS_DC) /* {{{ */
 {
-	size_t command_length;
+	int command_length;
 	int dir_length, extra = 0;
 	char *command_line;
 	char *ptr, *dir;
@@ -364,20 +364,13 @@ ZEND_VM_HELPER_EX(zend_binary_assign_op_obj_helper, VAR|UNUSED|CV, CONST|TMP|VAR
 			&& Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 			zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 			if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-				have_get_ptr = 1;
-				if (UNEXPECTED(*zptr == &EG(error_zval))) {
-					if (RETURN_VALUE_USED(opline)) {
-						PZVAL_LOCK(&EG(uninitialized_zval));
-						EX_T(opline->result.var).var.ptr = &EG(uninitialized_zval);
-					}
-				} else {
-					SEPARATE_ZVAL_IF_NOT_REF(zptr);
+				SEPARATE_ZVAL_IF_NOT_REF(zptr);

-					binary_op(*zptr, *zptr, value TSRMLS_CC);
-					if (RETURN_VALUE_USED(opline)) {
-						PZVAL_LOCK(*zptr);
-						EX_T(opline->result.var).var.ptr = *zptr;
-					}
+				have_get_ptr = 1;
+				binary_op(*zptr, *zptr, value TSRMLS_CC);
+				if (RETURN_VALUE_USED(opline)) {
+					PZVAL_LOCK(*zptr);
+					EX_T(opline->result.var).var.ptr = *zptr;
 				}
 			}
 		}
@@ -632,20 +625,13 @@ ZEND_VM_HELPER_EX(zend_pre_incdec_property_helper, VAR|UNUSED|CV, CONST|TMP|VAR|
 	if (Z_OBJ_HT_P(object)->get_property_ptr_ptr) {
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
-			have_get_ptr = 1;
-			if (UNEXPECTED(*zptr == &EG(error_zval))) {
-				if (RETURN_VALUE_USED(opline)) {
-					PZVAL_LOCK(&EG(uninitialized_zval));
-					*retval = &EG(uninitialized_zval);
-				}
-			} else {
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+			SEPARATE_ZVAL_IF_NOT_REF(zptr);

-				incdec_op(*zptr);
-				if (RETURN_VALUE_USED(opline)) {
-					*retval = *zptr;
-					PZVAL_LOCK(*retval);
-				}
+			have_get_ptr = 1;
+			incdec_op(*zptr);
+			if (RETURN_VALUE_USED(opline)) {
+				*retval = *zptr;
+				PZVAL_LOCK(*retval);
 			}
 		}
 	}
@@ -745,16 +731,13 @@ ZEND_VM_HELPER_EX(zend_post_incdec_property_helper, VAR|UNUSED|CV, CONST|TMP|VAR
 		zval **zptr = Z_OBJ_HT_P(object)->get_property_ptr_ptr(object, property, BP_VAR_RW, ((OP2_TYPE == IS_CONST) ? opline->op2.literal : NULL) TSRMLS_CC);
 		if (zptr != NULL) { 			/* NULL means no success in getting PTR */
 			have_get_ptr = 1;
-			if (UNEXPECTED(*zptr == &EG(error_zval))) {
-				ZVAL_NULL(retval);
-			} else {
-				SEPARATE_ZVAL_IF_NOT_REF(zptr);
+			SEPARATE_ZVAL_IF_NOT_REF(zptr);

-				ZVAL_COPY_VALUE(retval, *zptr);
-				zendi_zval_copy_ctor(*retval);
+			ZVAL_COPY_VALUE(retval, *zptr);
+			zendi_zval_copy_ctor(*retval);
+
+			incdec_op(*zptr);

-				incdec_op(*zptr);
-			}
 		}
 	}

@@ -1817,14 +1800,11 @@ ZEND_VM_HANDLER(39, ZEND_ASSIGN_REF, VAR|CV, VAR|CV)
 	if ((OP2_TYPE == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||
 	    (OP1_TYPE == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL))) {
 		zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets nor overloaded objects");
-	} else if ((OP2_TYPE == IS_VAR && UNEXPECTED(*value_ptr_ptr == &EG(error_zval))) ||
-		(OP1_TYPE == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval)))) {
-		variable_ptr_ptr = &EG(uninitialized_zval_ptr);
-	} else {
-		zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
-		if (OP2_TYPE == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
-			Z_DELREF_PP(variable_ptr_ptr);
-		}
+	}
+	zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
+
+	if (OP2_TYPE == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
+		Z_DELREF_PP(variable_ptr_ptr);
 	}

 	if (RETURN_VALUE_USED(opline)) {
@@ -3879,10 +3859,7 @@ ZEND_VM_C_LABEL(num_index):
 		}
 		FREE_OP2();
 	} else {
-		if (zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL) == FAILURE) {
-			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
-			zval_ptr_dtor(&expr_ptr);
-		}
+		zend_hash_next_index_insert(Z_ARRVAL(EX_T(opline->result.var).tmp_var), &expr_ptr, sizeof(zval *), NULL);
 	}
 	if ((OP1_TYPE == IS_VAR || OP1_TYPE == IS_CV) && opline->extended_value) {
 		FREE_OP1_VAR_PTR();
@@ -2263,7 +2263,7 @@ AC_DEFUN([PHP_SETUP_KERBEROS],[
  fi

  dnl If krb5-config is found try using it
-  if test "$PHP_KERBEROS" != "no" && test -x "$KRB5_CONFIG"; then
+  if test "$PHP_KERBEROS" = "yes" && test -x "$KRB5_CONFIG"; then
    KERBEROS_LIBS=`$KRB5_CONFIG --libs gssapi`
    KERBEROS_CFLAGS=`$KRB5_CONFIG --cflags gssapi`

@@ -119,7 +119,7 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=6
-PHP_RELEASE_VERSION=35
+PHP_RELEASE_VERSION=20
 PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
@@ -201,21 +201,6 @@ static void php_str2num(bc_num *num, char *str TSRMLS_DC)
 }
 /* }}} */

-/* {{{ split_bc_num
-   Convert to bc_num detecting scale */
-static bc_num split_bc_num(bc_num num) {
-	bc_num newnum;
-	if (num->n_refs >= 1) {
-		return num;
-	}
-	newnum = _bc_new_num_ex(0, 0, 0);
-	*newnum = *num;
-	newnum->n_refs = 1;
-	num->n_refs--;
-	return newnum;
-}
-/* }}} */
-
 /* {{{ proto string bcadd(string left_operand, string right_operand [, int scale])
   Returns the sum of two arbitrary precision numbers */
 PHP_FUNCTION(bcadd)
@@ -229,7 +214,7 @@ PHP_FUNCTION(bcadd)
 	if (zend_parse_parameters(argc TSRMLS_CC, "ss|l", &left, &left_len, &right, &right_len, &scale_param) == FAILURE) {
 		return;
 	}
-
+	
 	if (argc == 3) {
 		scale = (int) ((int)scale_param < 0) ? 0 : scale_param;
 	}
@@ -240,12 +225,11 @@ PHP_FUNCTION(bcadd)
 	php_str2num(&first, left TSRMLS_CC);
 	php_str2num(&second, right TSRMLS_CC);
 	bc_add (first, second, &result, scale);
-
+	
 	if (result->n_scale > scale) {
-		result = split_bc_num(result);
 		result->n_scale = scale;
 	}
-
+	
 	Z_STRVAL_P(return_value) = bc_num2str(result);
 	Z_STRLEN_P(return_value) = strlen(Z_STRVAL_P(return_value));
 	Z_TYPE_P(return_value) = IS_STRING;
@@ -269,7 +253,7 @@ PHP_FUNCTION(bcsub)
 	if (zend_parse_parameters(argc TSRMLS_CC, "ss|l", &left, &left_len, &right, &right_len, &scale_param) == FAILURE) {
 		return;
 	}
-
+	
 	if (argc == 3) {
 		scale = (int) ((int)scale_param < 0) ? 0 : scale_param;
 	}
@@ -282,7 +266,6 @@ PHP_FUNCTION(bcsub)
 	bc_sub (first, second, &result, scale);

 	if (result->n_scale > scale) {
-		result = split_bc_num(result);
 		result->n_scale = scale;
 	}

@@ -309,11 +292,11 @@ PHP_FUNCTION(bcmul)
 	if (zend_parse_parameters(argc TSRMLS_CC, "ss|l", &left, &left_len, &right, &right_len, &scale_param) == FAILURE) {
 		return;
 	}
-
+	
 	if (argc == 3) {
 		scale = (int) ((int)scale_param < 0) ? 0 : scale_param;
 	}
-
+	
 	bc_init_num(&first TSRMLS_CC);
 	bc_init_num(&second TSRMLS_CC);
 	bc_init_num(&result TSRMLS_CC);
@@ -322,7 +305,6 @@ PHP_FUNCTION(bcmul)
 	bc_multiply (first, second, &result, scale TSRMLS_CC);

 	if (result->n_scale > scale) {
-		result = split_bc_num(result);
 		result->n_scale = scale;
 	}

@@ -349,11 +331,11 @@ PHP_FUNCTION(bcdiv)
 	if (zend_parse_parameters(argc TSRMLS_CC, "ss|l", &left, &left_len, &right, &right_len, &scale_param) == FAILURE) {
 		return;
 	}
-
+	
 	if (argc == 3) {
 		scale = (int) ((int)scale_param < 0) ? 0 : scale_param;
 	}
-
+	
 	bc_init_num(&first TSRMLS_CC);
 	bc_init_num(&second TSRMLS_CC);
 	bc_init_num(&result TSRMLS_CC);
@@ -363,7 +345,6 @@ PHP_FUNCTION(bcdiv)
 	switch (bc_divide(first, second, &result, scale TSRMLS_CC)) {
 		case 0: /* OK */
 			if (result->n_scale > scale) {
-				result = split_bc_num(result);
 				result->n_scale = scale;
 			}
 			Z_STRVAL_P(return_value) = bc_num2str(result);
@@ -393,13 +374,13 @@ PHP_FUNCTION(bcmod)
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ss", &left, &left_len, &right, &right_len) == FAILURE) {
 		return;
 	}
-
+	
 	bc_init_num(&first TSRMLS_CC);
 	bc_init_num(&second TSRMLS_CC);
 	bc_init_num(&result TSRMLS_CC);
 	bc_str2num(&first, left, 0 TSRMLS_CC);
 	bc_str2num(&second, right, 0 TSRMLS_CC);
-
+	
 	switch (bc_modulo(first, second, &result, 0 TSRMLS_CC)) {
 		case 0:
 			Z_STRVAL_P(return_value) = bc_num2str(result);
@@ -410,7 +391,7 @@ PHP_FUNCTION(bcmod)
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Division by zero");
 			break;
 	}
-
+	
 	bc_free_num(&first);
 	bc_free_num(&second);
 	bc_free_num(&result);
@@ -443,9 +424,8 @@ PHP_FUNCTION(bcpowmod)
 	scale_int = (int) ((int)scale < 0) ? 0 : scale;

 	if (bc_raisemod(first, second, mod, &result, scale_int TSRMLS_CC) != -1) {
-		if (result->n_scale > scale_int) {
-			result = split_bc_num(result);
-			result->n_scale = scale_int;
+		if (result->n_scale > scale) {
+			result->n_scale = scale;
 		}
 		Z_STRVAL_P(return_value) = bc_num2str(result);
 		Z_STRLEN_P(return_value) = strlen(Z_STRVAL_P(return_value));
@@ -453,7 +433,7 @@ PHP_FUNCTION(bcpowmod)
 	} else {
 		RETVAL_FALSE;
 	}
-
+	
 	bc_free_num(&first);
 	bc_free_num(&second);
 	bc_free_num(&mod);
@@ -475,7 +455,7 @@ PHP_FUNCTION(bcpow)
 	if (zend_parse_parameters(argc TSRMLS_CC, "ss|l", &left, &left_len, &right, &right_len, &scale_param) == FAILURE) {
 		return;
 	}
-
+	
 	if (argc == 3) {
 		scale = (int) ((int)scale_param < 0) ? 0 : scale_param;
 	}
@@ -488,7 +468,6 @@ PHP_FUNCTION(bcpow)
 	bc_raise (first, second, &result, scale TSRMLS_CC);

 	if (result->n_scale > scale) {
-		result = split_bc_num(result);
 		result->n_scale = scale;
 	}

@@ -515,17 +494,16 @@ PHP_FUNCTION(bcsqrt)
 	if (zend_parse_parameters(argc TSRMLS_CC, "s|l", &left, &left_len, &scale_param) == FAILURE) {
 		return;
 	}
-
+	
 	if (argc == 2) {
 		scale = (int) ((int)scale_param < 0) ? 0 : scale_param;
 	}

 	bc_init_num(&result TSRMLS_CC);
 	php_str2num(&result, left TSRMLS_CC);
-
+	
 	if (bc_sqrt (&result, scale TSRMLS_CC) != 0) {
 		if (result->n_scale > scale) {
-			result = split_bc_num(result);
 			result->n_scale = scale;
 		}
 		Z_STRVAL_P(return_value) = bc_num2str(result);
@@ -553,7 +531,7 @@ PHP_FUNCTION(bccomp)
 	if (zend_parse_parameters(argc TSRMLS_CC, "ss|l", &left, &left_len, &right, &right_len, &scale_param) == FAILURE) {
 		return;
 	}
-
+	
 	if (argc == 3) {
 		scale = (int) ((int)scale_param < 0) ? 0 : scale_param;
 	}
@@ -577,7 +555,7 @@ PHP_FUNCTION(bccomp)
 PHP_FUNCTION(bcscale)
 {
 	long new_scale;
-
+	
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "l", &new_scale) == FAILURE) {
 		return;
 	}
@@ -49,10 +49,7 @@ _bc_new_num_ex (length, scale, persistent)
     int length, scale, persistent;
 {
  bc_num temp;
-  /* PHP Change:  add length check */
-  if ((size_t)length+(size_t)scale > INT_MAX) {
-   zend_error(E_ERROR, "Result too long, max is %d", INT_MAX);
-  }
+
  /* PHP Change:  malloc() -> pemalloc(), removed free_list code */
  temp = (bc_num) safe_pemalloc (1, sizeof(bc_struct)+length, scale, persistent);
 #if 0
@@ -41,5 +41,6 @@

 void bc_out_of_memory (void)
 {
-  zend_error(E_ERROR, "bcmath: out of memory!");
+  (void) fprintf (stderr, "bcmath: out of memory!\n");
+  exit (1);
 }
@@ -1,18 +0,0 @@
--TEST--
-Bug 72093: bcpowmod accepts negative scale and corrupts _one_ definition
--SKIPIF--
-<?php
-if(!extension_loaded("bcmath")) print "skip";
-if (substr(PHP_OS, 0, 3) != 'WIN') {
-    die('skip valid only for windows');
-}
-?>
--FILE--
-<?php
-var_dump(bcpowmod(1, "A", 128, -200));
-var_dump(bcpowmod(1, 1.2, 1, 1));
-?>
--EXPECTF--
-string(1) "1"
-string(3) "0.0"
-bc math warning: non-zero scale in exponent
@@ -1,18 +0,0 @@
--TEST--
-Bug 72093: bcpowmod accepts negative scale and corrupts _one_ definition
--SKIPIF--
-<?php
-if(!extension_loaded("bcmath")) print "skip";
-if (substr(PHP_OS, 0, 3) == 'WIN') {
-    die('skip Not valid for windows');
-}
-?>
--FILE--
-<?php
-var_dump(bcpowmod(1, "A", 128, -200));
-var_dump(bcpowmod(1, 1.2, 1, 1));
-?>
--EXPECTF--
-string(1) "1"
-bc math warning: non-zero scale in exponent
-string(3) "0.0"
@@ -15,7 +15,7 @@
  | Author: Sterling Hughes <sterling@php.net>                           |
  +----------------------------------------------------------------------+
 */
-
+ 
 /* $Id$ */

 #ifdef HAVE_CONFIG_H
@@ -138,33 +138,29 @@ struct php_bz2_stream_data_t {
 static size_t php_bz2iop_read(php_stream *stream, char *buf, size_t count TSRMLS_DC)
 {
 	struct php_bz2_stream_data_t *self = (struct php_bz2_stream_data_t *) stream->abstract;
-	int bz2_ret;
+	size_t ret;
+	
+	ret = BZ2_bzread(self->bz_file, buf, count);

-	bz2_ret = BZ2_bzread(self->bz_file, buf, count);
-
-	if (bz2_ret < 0) {
-		stream->eof = 1;
-		return -1;
-	}
-	if (bz2_ret == 0) {
+	if (ret == 0) {
 		stream->eof = 1;
 	}

-	return (size_t)bz2_ret;
+	return ret;
 }

 static size_t php_bz2iop_write(php_stream *stream, const char *buf, size_t count TSRMLS_DC)
 {
 	struct php_bz2_stream_data_t *self = (struct php_bz2_stream_data_t *) stream->abstract;

-	return BZ2_bzwrite(self->bz_file, (char*)buf, count);
+	return BZ2_bzwrite(self->bz_file, (char*)buf, count); 
 }

 static int php_bz2iop_close(php_stream *stream, int close_handle TSRMLS_DC)
 {
 	struct php_bz2_stream_data_t *self = (struct php_bz2_stream_data_t *)stream->abstract;
 	int ret = EOF;
-
+	
 	if (close_handle) {
 		BZ2_bzclose(self->bz_file);
 	}
@@ -196,11 +192,11 @@ php_stream_ops php_stream_bz2io_ops = {
 };

 /* {{{ Bzip2 stream openers */
-PHP_BZ2_API php_stream *_php_stream_bz2open_from_BZFILE(BZFILE *bz,
+PHP_BZ2_API php_stream *_php_stream_bz2open_from_BZFILE(BZFILE *bz, 
 														const char *mode, php_stream *innerstream STREAMS_DC TSRMLS_DC)
 {
 	struct php_bz2_stream_data_t *self;
-
+	
 	self = emalloc(sizeof(*self));

 	self->stream = innerstream;
@@ -231,7 +227,7 @@ PHP_BZ2_API php_stream *_php_stream_bz2open(php_stream_wrapper *wrapper,
 	virtual_filepath_ex(path, &path_copy, NULL TSRMLS_CC);
 #else
 	path_copy = path;
-#endif
+#endif  

 	if (php_check_open_basedir(path_copy TSRMLS_CC)) {
 #ifdef VIRTUAL_DIR
@@ -239,7 +235,7 @@ PHP_BZ2_API php_stream *_php_stream_bz2open(php_stream_wrapper *wrapper,
 #endif
 		return NULL;
 	}
-
+	
 	/* try and open it directly first */
 	bz_file = BZ2_bzopen(path_copy, mode);

@@ -250,11 +246,11 @@ PHP_BZ2_API php_stream *_php_stream_bz2open(php_stream_wrapper *wrapper,
 	efree(path_copy);
 #endif
 	path_copy = NULL;
-
+	
 	if (bz_file == NULL) {
 		/* that didn't work, so try and get something from the network/wrapper */
 		stream = php_stream_open_wrapper(path, mode, options | STREAM_WILL_CAST, opened_path);
-
+	
 		if (stream) {
 			php_socket_t fd;
 			if (SUCCESS == php_stream_cast(stream, PHP_STREAM_AS_FD, (void **) &fd, REPORT_ERRORS)) {
@@ -269,7 +265,7 @@ PHP_BZ2_API php_stream *_php_stream_bz2open(php_stream_wrapper *wrapper,
 			VCWD_UNLINK(*opened_path);
 		}
 	}
-
+	
 	if (bz_file) {
 		retstream = _php_stream_bz2open_from_BZFILE(bz_file, mode, stream STREAMS_REL_CC TSRMLS_CC);
 		if (retstream) {
@@ -345,7 +341,7 @@ static PHP_FUNCTION(bzread)
 	if (FAILURE == zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "r|l", &bz, &len)) {
 		RETURN_FALSE;
 	}
-
+	
 	php_stream_from_zval(stream, &bz);

 	if ((len + 1) < 1) {
@@ -355,13 +351,13 @@ static PHP_FUNCTION(bzread)

 	Z_STRVAL_P(return_value) = emalloc(len + 1);
 	Z_STRLEN_P(return_value) = php_stream_read(stream, Z_STRVAL_P(return_value), len);
-
+	
 	if (Z_STRLEN_P(return_value) < 0) {
 		efree(Z_STRVAL_P(return_value));
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "could not read valid bz2 data from stream");
-		RETURN_FALSE;
+		RETURN_FALSE;		
 	}
-
+	
 	Z_STRVAL_P(return_value)[Z_STRLEN_P(return_value)] = 0;
 	Z_TYPE_P(return_value) = IS_STRING;
 }
@@ -377,7 +373,7 @@ static PHP_FUNCTION(bzopen)

 	BZFILE   *bz;     /* The compressed file stream */
 	php_stream *stream = NULL;
-
+	
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "Zs", &file, &mode, &mode_len) == FAILURE) {
 		return;
 	}
@@ -393,15 +389,15 @@ static PHP_FUNCTION(bzopen)
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "filename cannot be empty");
 			RETURN_FALSE;
 		}
-
+		
 		if (CHECK_ZVAL_NULL_PATH(*file)) {
 			RETURN_FALSE;
 		}

 		stream = php_stream_bz2open(NULL,
-									Z_STRVAL_PP(file),
-									mode,
-									REPORT_ERRORS,
+									Z_STRVAL_PP(file), 
+									mode, 
+									REPORT_ERRORS, 
 									NULL);
 	} else if (Z_TYPE_PP(file) == IS_RESOURCE) {
 		/* If it is a resource, than its a stream resource */
@@ -410,7 +406,7 @@ static PHP_FUNCTION(bzopen)

 		php_stream_from_zval(stream, file);
 		stream_mode_len = strlen(stream->mode);
-
+		
 		if (stream_mode_len != 1 && !(stream_mode_len == 2 && memchr(stream->mode, 'b', 2))) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "cannot use stream opened in mode '%s'", stream->mode);
 			RETURN_FALSE;
@@ -444,7 +440,7 @@ static PHP_FUNCTION(bzopen)
 		if (FAILURE == php_stream_cast(stream, PHP_STREAM_AS_FD, (void *) &fd, REPORT_ERRORS)) {
 			RETURN_FALSE;
 		}
-
+		
 		bz = BZ2_bzdopen(fd, mode);

 		stream = php_stream_bz2open_from_BZFILE(bz, mode, stream);
@@ -498,7 +494,7 @@ static PHP_FUNCTION(bzcompress)
 					  work_factor = 0, /* Work factor for compression algorithm */
 					  argc;            /* Argument count */
 	int               source_len;      /* Length of the source data */
-	unsigned int      dest_len;        /* Length of the destination buffer */
+	unsigned int      dest_len;        /* Length of the destination buffer */ 

 	argc = ZEND_NUM_ARGS();

@@ -507,19 +503,19 @@ static PHP_FUNCTION(bzcompress)
 	}

 	/* Assign them to easy to use variables, dest_len is initially the length of the data
-	   + .01 x length of data + 600 which is the largest size the results of the compression
-	   could possibly be, at least that's what the libbz2 docs say (thanks to jeremy@nirvani.net
+	   + .01 x length of data + 600 which is the largest size the results of the compression 
+	   could possibly be, at least that's what the libbz2 docs say (thanks to jeremy@nirvani.net 
 	   for pointing this out).  */
 	dest_len   = (unsigned int) (source_len + (0.01 * source_len) + 600);
-
+	
 	/* Allocate the destination buffer */
-	dest = safe_emalloc(dest_len, 1, 1);
-
+	dest = emalloc(dest_len + 1);
+	
 	/* Handle the optional arguments */
 	if (argc > 1) {
 		block_size = zblock_size;
 	}
-
+	
 	if (argc > 2) {
 		work_factor = zwork_factor;
 	}
@@ -533,7 +529,7 @@ static PHP_FUNCTION(bzcompress)
 		   so we erealloc() the buffer to the proper size */
 		dest = erealloc(dest, dest_len + 1);
 		dest[dest_len] = 0;
-		RETURN_STRINGL_CHECK(dest, dest_len, 0);
+		RETURN_STRINGL(dest, dest_len, 0);
 	}
 }
 /* }}} */
@@ -569,30 +565,20 @@ static PHP_FUNCTION(bzdecompress)
 	/* in most cases bz2 offers at least 2:1 compression, so we use that as our base */
 	bzs.avail_out = source_len * 2;
 	bzs.next_out = dest = emalloc(bzs.avail_out + 1);
-
+	
 	while ((error = BZ2_bzDecompress(&bzs)) == BZ_OK && bzs.avail_in > 0) {
 		/* compression is better then 2:1, need to allocate more memory */
 		bzs.avail_out = source_len;
 		size = (bzs.total_out_hi32 * (unsigned int) -1) + bzs.total_out_lo32;
-		if (size > INT_MAX) {
-			/* no reason to continue if we're going to drop it anyway */
-			break;
-		}
 		dest = safe_erealloc(dest, 1, bzs.avail_out+1, (size_t) size );
 		bzs.next_out = dest + size;
 	}

 	if (error == BZ_STREAM_END || error == BZ_OK) {
 		size = (bzs.total_out_hi32 * (unsigned int) -1) + bzs.total_out_lo32;
-		if (size > INT_MAX) {
-			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Decompressed size too big, max is %d", INT_MAX);
-			efree(dest);
-			RETVAL_LONG(BZ_MEM_ERROR);
-		} else {
-			dest = safe_erealloc(dest, 1, (size_t) size, 1);
-			dest[size] = '\0';
-			RETVAL_STRINGL(dest, (int) size, 0);
-		}
+		dest = safe_erealloc(dest, 1, (size_t) size, 1);
+		dest[size] = '\0';
+		RETVAL_STRINGL(dest, (int) size, 0);
 	} else { /* real error */
 		efree(dest);
 		RETVAL_LONG(error);
@@ -605,13 +591,13 @@ static PHP_FUNCTION(bzdecompress)
 /* {{{ php_bz2_error()
   The central error handling interface, does the work for bzerrno, bzerrstr and bzerror */
 static void php_bz2_error(INTERNAL_FUNCTION_PARAMETERS, int opt)
-{
+{ 
 	zval         *bzp;     /* BZip2 Resource Pointer */
 	php_stream   *stream;
 	const char   *errstr;  /* Error string */
 	int           errnum;  /* Error number */
 	struct php_bz2_stream_data_t *self;
-
+	
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "r", &bzp) == FAILURE) {
 		return;
 	}
@@ -623,10 +609,10 @@ static void php_bz2_error(INTERNAL_FUNCTION_PARAMETERS, int opt)
 	}

 	self = (struct php_bz2_stream_data_t *) stream->abstract;
-
+	
 	/* Fetch the error information */
 	errstr = BZ2_bzerror(self->bz_file, &errnum);
-
+	
 	/* Determine what to return */
 	switch (opt) {
 		case PHP_BZ_ERRNO:
@@ -637,7 +623,7 @@ static void php_bz2_error(INTERNAL_FUNCTION_PARAMETERS, int opt)
 			break;
 		case PHP_BZ_ERRBOTH:
 			array_init(return_value);
-
+		
 			add_assoc_long  (return_value, "errno",  errnum);
 			add_assoc_string(return_value, "errstr", (char*)errstr, 1);
 			break;
@@ -396,7 +396,7 @@ static php_stream_filter *php_bz2_filter_create(const char *filtername, zval *fi
 					zval_copy_ctor(&tmp);
 					convert_to_long(&tmp);
 					if (Z_LVAL(tmp) < 1 || Z_LVAL(tmp) > 9) {
-						php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid parameter given for number of blocks to allocate. (%ld)", Z_LVAL(tmp));
+						php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid parameter given for number of blocks to allocate. (%ld)", Z_LVAL_PP(tmpzval));
 					} else {
 						blockSize100k = Z_LVAL(tmp);
 					}
@@ -1,15 +0,0 @@
--TEST--
-Bug #72447: Type Confusion in php_bz2_filter_create()
--SKIPIF--
-<?php if (!extension_loaded("bz2")) print "skip"; ?>
--FILE--
-<?php
-$input = "AAAAAAAA";
-$param = array('blocks' => $input);
-
-$fp = fopen('testfile', 'w');
-stream_filter_append($fp, 'bzip2.compress', STREAM_FILTER_WRITE, $param);
-fclose($fp);
-?>
--EXPECTF--
-Warning: stream_filter_append(): Invalid parameter given for number of blocks to allocate. (0) in %s%ebug72447.php on line %d
@@ -1,23 +0,0 @@
--TEST--
-Bug #72613 (Inadequate error handling in bzread())
--SKIPIF--
-<?php if (!extension_loaded("bz2")) print "skip"; ?>
--FILE--
-<?php
-$fp = bzopen(__DIR__.'/72613.bz2', 'r');
-if ($fp === FALSE) {
-    exit("ERROR: bzopen()");
-}
-$data = "";
-while (!feof($fp)) {
-    $res = bzread($fp);
-    if ($res === FALSE) {
-        exit("ERROR: bzread()");
-    }
-    $data .= $res;
-}
-bzclose($fp);
-?>
-DONE
--EXPECT--
-DONE
@@ -359,10 +359,6 @@ PHP_FUNCTION(cal_days_in_month)
 		}
 		else {
 			sdn_next = calendar->to_jd(year + 1, 1, 1);
-			if (cal == CAL_FRENCH && sdn_next == 0) {
-				/* The French calendar ends on 0014-13-05. */
-				sdn_next = 2380953;
-			}
 		}
 	}

@@ -420,21 +416,15 @@ PHP_FUNCTION(cal_from_jd)
 	add_assoc_long(return_value, "year", year);

 /* day of week */
-	if (cal != CAL_JEWISH || year > 0) {
-		dow = DayOfWeek(jd);
-		add_assoc_long(return_value, "dow", dow);
-		add_assoc_string(return_value, "abbrevdayname", DayNameShort[dow], 1);
-		add_assoc_string(return_value, "dayname", DayNameLong[dow], 1);
-	} else {
-		add_assoc_null(return_value, "dow");
-		add_assoc_string(return_value, "abbrevdayname", "", 1);
-		add_assoc_string(return_value, "dayname", "", 1);
-	}
+	dow = DayOfWeek(jd);
+	add_assoc_long(return_value, "dow", dow);
+	add_assoc_string(return_value, "abbrevdayname", DayNameShort[dow], 1);
+	add_assoc_string(return_value, "dayname", DayNameLong[dow], 1);
 /* month name */
 	if(cal == CAL_JEWISH) {
 		/* special case for Jewish calendar */
-		add_assoc_string(return_value, "abbrevmonth", (year > 0 ? JEWISH_MONTH_NAME(year)[month] : ""), 1);
-		add_assoc_string(return_value, "monthname", (year > 0 ? JEWISH_MONTH_NAME(year)[month] : ""), 1);
+		add_assoc_string(return_value, "abbrevmonth", JEWISH_MONTH_NAME(year)[month], 1);
+		add_assoc_string(return_value, "monthname", JEWISH_MONTH_NAME(year)[month], 1);
 	} else {
 		add_assoc_string(return_value, "abbrevmonth", calendar->month_name_short[month], 1);
 		add_assoc_string(return_value, "monthname", calendar->month_name_long[month], 1);
@@ -747,7 +737,7 @@ PHP_FUNCTION(jdmonthname)
 		break;
 	case CAL_MONTH_JEWISH:		/* jewish month */
 		SdnToJewish(julday, &year, &month, &day);
-		monthname = (year > 0 ? JEWISH_MONTH_NAME(year)[month] : "");
+		monthname = JEWISH_MONTH_NAME(year)[month];
 		break;
 	case CAL_MONTH_FRENCH:		/* french month */
 		SdnToFrench(julday, &year, &month, &day);
@@ -1,12 +0,0 @@
--TEST--
-Bug #67976 (cal_days_month() fails for final month of the French calendar)
--SKIPIF--
-<?php
-if (!extension_loaded('calendar')) die('skip ext/calendar required');
-?>
--FILE--
-<?php
-var_dump(cal_days_in_month(CAL_FRENCH, 13, 14));
-?>
--EXPECT--
-int(5)
@@ -1,32 +0,0 @@
--TEST--
-Bug #71894 (AddressSanitizer: global-buffer-overflow in zif_cal_from_jd)
--SKIPIF--
-<?php
-if (!extension_loaded('calendar')) die('skip ext/calendar required');
-?>
--FILE--
-<?php
-var_dump(cal_from_jd(347997, CAL_JEWISH));
-var_dump(jdmonthname(347997,CAL_MONTH_JEWISH));?>
--EXPECT--
-array(9) {
-  ["date"]=>
-  string(5) "0/0/0"
-  ["month"]=>
-  int(0)
-  ["day"]=>
-  int(0)
-  ["year"]=>
-  int(0)
-  ["dow"]=>
-  NULL
-  ["abbrevdayname"]=>
-  string(0) ""
-  ["dayname"]=>
-  string(0) ""
-  ["abbrevmonth"]=>
-  string(0) ""
-  ["monthname"]=>
-  string(0) ""
-}
-string(0) ""
@@ -1,28 +0,0 @@
--TEST--
-jdtogregorian(): test overflow
--CREDITS--
-neweracracker@gmail.com
--SKIPIF--
-<?php
-if (!extension_loaded('calendar')) die('skip ext/calendar required');
-if (PHP_INT_SIZE != 4) die('skip this test is for 32bit platforms only');
-?>
--FILE--
-<?php
-for ($i=536838860; $i<536838870; $i++) {
-	echo $i, ':', jdtogregorian($i), PHP_EOL;
-}
-echo 'DONE', PHP_EOL;
-?>
--EXPECT--
-536838860:10/11/1465102
-536838861:10/12/1465102
-536838862:10/13/1465102
-536838863:10/14/1465102
-536838864:10/15/1465102
-536838865:10/16/1465102
-536838866:10/17/1465102
-536838867:0/0/0
-536838868:0/0/0
-536838869:0/0/0
-DONE
@@ -1,27 +0,0 @@
--TEST--
-jdtojewish(): test overflow
--CREDITS--
-neweracracker@gmail.com
--SKIPIF--
-<?php
-if (!extension_loaded('calendar')) die('skip ext/calendar required');
-?>
--FILE--
-<?php
-for ($i=324542840; $i<324542850; $i++) {
-	echo $i, ':', jdtojewish($i), PHP_EOL;
-}
-echo 'DONE', PHP_EOL;
-?>
--EXPECT--
-324542840:12/7/887605
-324542841:12/8/887605
-324542842:12/9/887605
-324542843:12/10/887605
-324542844:12/11/887605
-324542845:12/12/887605
-324542846:12/13/887605
-324542847:0/0/0
-324542848:0/0/0
-324542849:0/0/0
-DONE
@@ -35,7 +35,7 @@ static void curlfile_ctor(INTERNAL_FUNCTION_PARAMETERS)
 	int fname_len, mime_len, postname_len;
 	zval *cf = return_value;

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|ss", &fname, &fname_len, &mime, &mime_len, &postname, &postname_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|ss", &fname, &fname_len, &mime, &mime_len, &postname, &postname_len) == FAILURE) {
 		return;
 	}

@@ -137,10 +137,7 @@ ZEND_METHOD(CURLFile, setPostFilename)
   Unserialization handler */
 ZEND_METHOD(CURLFile, __wakeup)
 {
-	zval *_this = getThis();
-
-	zend_unset_property(curl_CURLFile_class, _this, "name", sizeof("name")-1 TSRMLS_CC);
-	zend_update_property_string(curl_CURLFile_class, _this, "name", sizeof("name")-1, "" TSRMLS_CC);
+	zend_update_property_string(curl_CURLFile_class, getThis(), "name", sizeof("name")-1, "" TSRMLS_CC);
 	zend_throw_exception(NULL, "Unserialization of CURLFile instances is not allowed", 0 TSRMLS_CC);
 }
 /* }}} */
@@ -1833,6 +1833,38 @@ static void alloc_curl_handle(php_curl **ch)
 /* }}} */

 #if LIBCURL_VERSION_NUM >= 0x071301 /* Available since 7.19.1 */
+/* {{{ split_certinfo
+ */
+static void split_certinfo(char *string, zval *hash)
+{
+	char *org = estrdup(string);
+	char *s = org;
+	char *split;
+
+	if(org) {
+		do {
+			char *key;
+			char *val;
+			char *tmp;
+
+			split = strstr(s, "; ");
+			if(split)
+				*split = '\0';
+
+			key = s;
+			tmp = memchr(key, '=', 64);
+			if(tmp) {
+				*tmp = '\0';
+				val = tmp+1;
+				add_assoc_string(hash, key, val, 1);
+			}
+			s = split+2;
+		} while(split);
+		efree(org);
+	}
+}
+/* }}} */
+
 /* {{{ create_certinfo
 */
 static void create_certinfo(struct curl_certinfo *ci, zval *listcode TSRMLS_DC)
@@ -1851,13 +1883,22 @@ static void create_certinfo(struct curl_certinfo *ci, zval *listcode TSRMLS_DC)
 				int len;
 				char s[64];
 				char *tmp;
-				strncpy(s, slist->data, sizeof(s));
-				s[sizeof(s)-1] = '\0';
-				tmp = memchr(s, ':', sizeof(s));
+				strncpy(s, slist->data, 64);
+				tmp = memchr(s, ':', 64);
 				if(tmp) {
 					*tmp = '\0';
 					len = strlen(s);
-					add_assoc_string(certhash, s, &slist->data[len+1], 1);
+					if(!strcmp(s, "Subject") || !strcmp(s, "Issuer")) {
+						zval *hash;
+
+						MAKE_STD_ZVAL(hash);
+						array_init(hash);
+
+						split_certinfo(&slist->data[len+1], hash);
+						add_assoc_zval(certhash, s, hash);
+					} else {
+						add_assoc_string(certhash, s, &slist->data[len+1], 1);
+					}
 				} else {
 					php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not extract hash key from certificate info");
 				}
@@ -1884,9 +1925,7 @@ static void _php_curl_set_default_options(php_curl *ch)
 	curl_easy_setopt(ch->cp, CURLOPT_INFILE,            (void *) ch);
 	curl_easy_setopt(ch->cp, CURLOPT_HEADERFUNCTION,    curl_write_header);
 	curl_easy_setopt(ch->cp, CURLOPT_WRITEHEADER,       (void *) ch);
-#if !defined(ZTS)
 	curl_easy_setopt(ch->cp, CURLOPT_DNS_USE_GLOBAL_CACHE, 1);
-#endif
 	curl_easy_setopt(ch->cp, CURLOPT_DNS_CACHE_TIMEOUT, 120);
 	curl_easy_setopt(ch->cp, CURLOPT_MAXREDIRS, 20); /* prevent infinite redirects */

@@ -2184,6 +2223,7 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue TSRMLS_DC)
 		case CURLOPT_CERTINFO:
 #endif
 #if LIBCURL_VERSION_NUM >= 0x071304 /* Available since 7.19.4 */
+		case CURLOPT_NOPROXY:
 		case CURLOPT_PROTOCOLS:
 		case CURLOPT_REDIR_PROTOCOLS:
 		case CURLOPT_SOCKS5_GSSAPI_NEC:
@@ -2224,14 +2264,7 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue TSRMLS_DC)
 					return 1;
 			}
 #endif
-# if defined(ZTS)
-			if (option == CURLOPT_DNS_USE_GLOBAL_CACHE) {
-				php_error_docref(NULL TSRMLS_CC, E_WARNING, "CURLOPT_DNS_USE_GLOBAL_CACHE cannot be activated when thread safety is enabled");
-				return 1;
-			}
-# endif
 			error = curl_easy_setopt(ch->cp, option, Z_LVAL_PP(zvalue));
-
 			break;
 		case CURLOPT_SAFE_UPLOAD:
 			convert_to_long_ex(zvalue);
@@ -2272,7 +2305,6 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue TSRMLS_DC)
 		case CURLOPT_USERNAME:
 #endif
 #if LIBCURL_VERSION_NUM >= 0x071304 /* Available since 7.19.4 */
-		case CURLOPT_NOPROXY:
 		case CURLOPT_SOCKS5_GSSAPI_SERVICE:
 #endif
 #if LIBCURL_VERSION_NUM >= 0x071400 /* Available since 7.20.0 */
@@ -2515,13 +2547,12 @@ static int _php_curl_setopt(php_curl *ch, long option, zval **zvalue TSRMLS_DC)
 				}
 			}

-			if (slist) {
-				if (Z_REFCOUNT_P(ch->clone) <= 1) {
-					zend_hash_index_update(ch->to_free->slist, (ulong) option, &slist, sizeof(struct curl_slist *), NULL);
-				} else {
-					zend_hash_next_index_insert(ch->to_free->slist, &slist, sizeof(struct curl_slist *), NULL);
-				}
+			if (Z_REFCOUNT_P(ch->clone) <= 1) {
+				zend_hash_index_update(ch->to_free->slist, (ulong) option, &slist, sizeof(struct curl_slist *), NULL);
+			} else {
+				zend_hash_next_index_insert(ch->to_free->slist, &slist, sizeof(struct curl_slist *), NULL);
 			}
+
 			error = curl_easy_setopt(ch->cp, option, slist);

 			break;
@@ -3479,10 +3510,6 @@ PHP_FUNCTION(curl_escape)
 	ZEND_FETCH_RESOURCE(ch, php_curl *, &zid, -1, le_curl_name, le_curl);

 	if ((res = curl_easy_escape(ch->cp, str, str_len))) {
-		if (strlen(res) > INT_MAX) {
-			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Escaped string is too long, maximum is %d", INT_MAX);
-			RETURN_FALSE;
-		}
 		RETVAL_STRING(res, 1);
 		curl_free(res);
 	} else {
@@ -1,13 +0,0 @@
--TEST--
-Bug #71144 (Sementation fault when using cURL with ZTS)
--SKIPIF--
-<?php include 'skipif.inc'; ?>
-<?php if (!PHP_ZTS) { print "skip only for zts build"; } ?>
--FILE--
-<?php
-$ch = curl_init();
-var_dump(curl_setopt($ch, CURLOPT_DNS_USE_GLOBAL_CACHE, 1));
-?>
--EXPECTF--
-Warning: curl_setopt(): CURLOPT_DNS_USE_GLOBAL_CACHE cannot be activated when thread safety is enabled in %sbug71144.php on line %d
-bool(false)
@@ -1,20 +0,0 @@
--TEST--
-Bug #73147: Use After Free in PHP7 unserialize()
--SKIPIF--
-<?php
-if (!extension_loaded("curl")) {
-        exit("skip curl extension not loaded");
-}
-?>
--FILE--
-<?php
-
-$poc = 'a:1:{i:0;O:8:"CURLFile":1:{s:4:"name";R:1;}}';
-try {
-var_dump(unserialize($poc));
-} catch(Exception $e) {
-	echo $e->getMessage();
-}
-?>
--EXPECT--
-Unserialization of CURLFile instances is not allowed
@@ -394,12 +394,8 @@ static timelib_sll timelib_meridian(char **ptr, timelib_sll h)
 	}
 	++*ptr;
 	if (**ptr == '.') {
-		++*ptr;
-	}
-	if (**ptr == 'M' || **ptr == 'm') {
-		++*ptr;
-	}
-	if (**ptr == '.') {
+		*ptr += 3;
+	} else {
 		++*ptr;
 	}
 	return retval;
@@ -899,7 +895,7 @@ datefull         = day ([ \t.-])* monthtext ([ \t.-])* year;
 datenoday        = monthtext ([ .\t-])* year4;
 datenodayrev     = year4 ([ .\t-])* monthtext;
 datetextual      = monthtext ([ .\t-])* day [,.stndrh\t ]+ year;
-datenoyear       = monthtext ([ .\t-])* day ([,.stndrh\t ]+|[\000]);
+datenoyear       = monthtext ([ .\t-])* day [,.stndrh\t ]*;
 datenoyearrev    = day ([ .\t-])* monthtext;
 datenocolon      = year4 monthlz daylz;

@@ -917,8 +913,8 @@ isoweek          = year4 "-"? "W" weekofyear;
 exif             = year4 ":" monthlz ":" daylz " " hour24lz ":" minutelz ":" secondlz;
 firstdayof       = 'first day of';
 lastdayof        = 'last day of';
-backof           = 'back of ' hour24 (space? meridian)?;
-frontof          = 'front of ' hour24 (space? meridian)?;
+backof           = 'back of ' hour24 space? meridian?;
+frontof          = 'front of ' hour24 space? meridian?;

 /* Common Log Format: 10/Oct/2000:13:55:36 -0700 */
 clf              = day "/" monthabbr "/" year4 ":" hour24lz ":" minutelz ":" secondlz space tzcorrection;
@@ -310,33 +310,33 @@ void timelib_dump_rel_time(timelib_rel_time *d)

 timelib_long timelib_parse_tz_cor(char **ptr)
 {
-	char *begin = *ptr, *end;
-	timelib_long  tmp;
+        char *begin = *ptr, *end;
+        timelib_long  tmp;

-	while (isdigit(**ptr) || **ptr == ':') {
-		++*ptr;
-	}
-	end = *ptr;
-	switch (end - begin) {
-		case 1: /* H */
-		case 2: /* HH */
-			return HOUR(strtol(begin, NULL, 10));
-			break;
-		case 3: /* H:M */
-		case 4: /* H:MM, HH:M, HHMM */
-			if (begin[1] == ':') {
-				tmp = HOUR(strtol(begin, NULL, 10)) + strtol(begin + 2, NULL, 10);
-				return tmp;
-			} else if (begin[2] == ':') {
-				tmp = HOUR(strtol(begin, NULL, 10)) + strtol(begin + 3, NULL, 10);
-				return tmp;
-			} else {
-				tmp = strtol(begin, NULL, 10);
-				return HOUR(tmp / 100) + tmp % 100;
-			}
-		case 5: /* HH:MM */
-			tmp = HOUR(strtol(begin, NULL, 10)) + strtol(begin + 3, NULL, 10);
-			return tmp;
-	}
-	return 0;
+        while (isdigit(**ptr) || **ptr == ':') {
+                ++*ptr;
+        }
+        end = *ptr;
+        switch (end - begin) {
+                case 1:
+                case 2:
+                        return HOUR(strtol(begin, NULL, 10));
+                        break;
+                case 3:
+                case 4:
+                        if (begin[1] == ':') {
+                                tmp = HOUR(strtol(begin, NULL, 10)) + strtol(begin + 2, NULL, 10);
+                                return tmp;
+                        } else if (begin[2] == ':') {
+                                tmp = HOUR(strtol(begin, NULL, 10)) + strtol(begin + 3, NULL, 10);
+                                return tmp;
+                        } else {
+                                tmp = strtol(begin, NULL, 10);
+                                return HOUR(tmp / 100) + tmp % 100;
+                        }
+                case 5:
+                        tmp = HOUR(strtol(begin, NULL, 10)) + strtol(begin + 3, NULL, 10);
+                        return tmp;
+        }
+        return 0;
 }
@@ -38,8 +38,8 @@
 # define timelib_free    free
 #endif

-#define TIMELIB_VERSION 201602
-#define TIMELIB_ASCII_VERSION "2016.02"
+#define TIMELIB_VERSION 201502
+#define TIMELIB_ASCII_VERSION "2015.02"

 #define TIMELIB_NONE             0x00
 #define TIMELIB_OVERRIDE_TIME    0x01
@@ -152,17 +152,9 @@ static void do_adjust_for_weekday(timelib_time* time)
 	current_dow = timelib_day_of_week(time->y, time->m, time->d);
 	if (time->relative.weekday_behavior == 2)
 	{
-		/* To make "this week" work, where the current DOW is a "sunday" */
-		if (current_dow == 0 && time->relative.weekday != 0) {
-			time->relative.weekday = -6;
-		}
-
-		/* To make "sunday this week" work, where the current DOW is not a
-		 * "sunday" */
-		if (time->relative.weekday == 0 && current_dow != 0) {
+		if (time->relative.weekday == 0) {
 			time->relative.weekday = 7;
 		}
-
 		time->d -= current_dow;
 		time->d += time->relative.weekday;
 		return;
@@ -2059,7 +2059,6 @@ static void date_register_classes(TSRMLS_D)
 	date_object_handlers_immutable.clone_obj = date_object_clone_date;
 	date_object_handlers_immutable.compare_objects = date_object_compare_date;
 	date_object_handlers_immutable.get_properties = date_object_get_properties;
-	date_object_handlers_immutable.get_gc = date_object_get_gc;
 	zend_class_implements(date_ce_immutable TSRMLS_CC, 1, date_ce_interface);

 	INIT_CLASS_ENTRY(ce_timezone, "DateTimeZone", date_funcs_timezone);
@@ -2226,7 +2225,7 @@ static HashTable *date_object_get_properties(zval *object TSRMLS_DC)

 	props = zend_std_get_properties(object TSRMLS_CC);

-	if (!dateobj->time) {
+	if (!dateobj->time || GC_G(gc_active)) {
 		return props;
 	}

@@ -4310,7 +4309,7 @@ static char *date_interval_format(char *format, int format_len, timelib_rel_time
 	char                 buffer[33];

 	if (!format_len) {
-		return STR_EMPTY_ALLOC();
+		return estrdup("");
 	}

 	for (i = 0; i < format_len; i++) {
@@ -4360,10 +4359,6 @@ static char *date_interval_format(char *format, int format_len, timelib_rel_time

 	smart_str_0(&string);

-	if (string.c == NULL) {
-		return STR_EMPTY_ALLOC();
-	}
-
 	return string.c;
 }
 /* }}} */
@@ -4942,7 +4937,7 @@ static HashTable *date_object_get_properties_period(zval *object TSRMLS_DC)

 	props = zend_std_get_properties(object TSRMLS_CC);

-	if (!period_obj->start) {
+	if (!period_obj->start || GC_G(gc_active)) {
 		return props;
 	}

@@ -75,8 +75,8 @@ result = Monday 1983-04-18 01:00:00 CEST
 wanted = Monday            00:00:00

 Asia/Yerevan
-ts     = Monday 2037-10-19 17:17:17 +04
-result = Monday 2037-10-26 00:00:00 +04
+ts     = Monday 2037-10-19 17:17:17 AMT
+result = Monday 2037-10-26 00:00:00 AMT
 wanted = Monday            00:00:00

 America/Curacao
@@ -115,8 +115,8 @@ result = Monday 1971-04-05 00:00:00 AST
 wanted = Monday            00:00:00

 Asia/Baku
-ts     = Friday 1971-01-01 17:17:17 +04
-result = Monday 1971-01-04 00:00:00 +04
+ts     = Friday 1971-01-01 17:17:17 BAKT
+result = Monday 1971-01-04 00:00:00 BAKT
 wanted = Monday            00:00:00

 Europe/Sarajevo
@@ -165,6 +165,6 @@ result = Monday 1980-04-07 00:00:00 CEST
 wanted = Monday            00:00:00

 Asia/Baku
-ts     = Monday 1995-12-25 17:17:17 +04
-result = Monday 1996-01-01 00:00:00 +04
+ts     = Monday 1995-12-25 17:17:17 AZT
+result = Monday 1996-01-01 00:00:00 AZT
 wanted = Monday            00:00:00
@@ -49,9 +49,9 @@ print "TZ=Asia/Baku - wrong day.\n";
 date_default_timezone_set("Asia/Baku");
 $tStamp = mktime (17, 17, 17, 1, 8299, 1970);
 print "tStamp=". date("l Y-m-d H:i:s T I", $tStamp). "\n";
-$strtotime_tstamp = strtotime("second Monday", $tStamp);
+$strtotime_tstamp = strtotime("next Sunday", $tStamp);
 print "result=".date("l Y-m-d H:i:s T I", $strtotime_tstamp)."\n";
-print "wanted=Monday              00:00:00\n\n";
+print "wanted=Sunday              00:00:00\n\n";

 print "TZ=America/Noronha - wrong day.\n";
 date_default_timezone_set("America/Noronha");
@@ -226,9 +226,9 @@ result=Thursday 1980-04-10 00:00:00 CEST 1
 wanted=Thursday             00:00:00

 TZ=Asia/Baku - wrong day.
-tStamp=Sunday 1992-09-20 17:17:17 +04 1
-result=Monday 1992-09-28 00:00:00 +04 0
-wanted=Monday              00:00:00
+tStamp=Sunday 1992-09-20 17:17:17 AZST 1
+result=Sunday 1992-09-27 00:00:00 AZT 0
+wanted=Sunday              00:00:00

 TZ=America/Noronha - wrong day.
 tStamp=Friday 1999-10-01 17:17:17 FNT 0
@@ -28,6 +28,6 @@ result=Monday 1990-10-22 00:00:00 WART 0
 wanted=Monday            00:00:00

 TZ=Asia/Tbilisi - Is it OK for this to be 2 AM?
-tStamp=Sunday 2005-03-20 17:17:17 +03 0
-result=Sunday 2005-03-27 00:00:00 +03 0
+tStamp=Sunday 2005-03-20 17:17:17 GET 0
+result=Sunday 2005-03-27 00:00:00 GET 0
 wanted=Sunday            00:00:00
@@ -40,7 +40,7 @@ object(DateInterval)#%d (15) {
  ["special_amount"]=>
  int(-1)
  ["have_weekday_relative"]=>
-  int(%d)
+  int(9)
  ["have_special_relative"]=>
  int(0)
 }
@@ -1,41 +0,0 @@
--TEST--
-Bug #63740 (strtotime seems to use both sunday and monday as start of week)
--FILE--
-<?php
-$dates = [
-	'2015-07-04',
-	'2015-07-05',
-	'2015-07-06',
-	'2015-07-07',
-	'2015-07-08',
-	'2015-07-09',
-	'2015-07-10',
-	'2015-07-11',
-	'2015-07-12',
-	'2015-07-13',
-	'2015-07-14',
-];
-
-foreach ( $dates as $date )
-{
-	$dt = new DateTimeImmutable( "$date 00:00 UTC" );
-
-	echo $dt->format( "D Y-m-d H:i" ), " → ";
-
-	$dtn = $dt->modify( "this week" );
-
-	echo $dtn->format( "D Y-m-d H:i" ), "\n";
-}
-?>
--EXPECT--
-Sat 2015-07-04 00:00 → Mon 2015-06-29 00:00
-Sun 2015-07-05 00:00 → Mon 2015-06-29 00:00
-Mon 2015-07-06 00:00 → Mon 2015-07-06 00:00
-Tue 2015-07-07 00:00 → Mon 2015-07-06 00:00
-Wed 2015-07-08 00:00 → Mon 2015-07-06 00:00
-Thu 2015-07-09 00:00 → Mon 2015-07-06 00:00
-Fri 2015-07-10 00:00 → Mon 2015-07-06 00:00
-Sat 2015-07-11 00:00 → Mon 2015-07-06 00:00
-Sun 2015-07-12 00:00 → Mon 2015-07-06 00:00
-Mon 2015-07-13 00:00 → Mon 2015-07-13 00:00
-Tue 2015-07-14 00:00 → Mon 2015-07-13 00:00
@@ -1,15 +0,0 @@
--TEST--
-Bug #66836 (DateTime::createFromFormat 'U' with pre 1970 dates fails parsing)
--INI--
-date.timezone=Europe/Berlin
--FILE--
-<?php
-foreach (['-1', '-86400', '-1000000'] as $timestamp) {
-    $dt = DateTime::createFromFormat('U', $timestamp);
-    var_dump($dt->format('U') === $timestamp);
-}
-?>
--EXPECT--
-bool(true)
-bool(true)
-bool(true)
@@ -1,11 +0,0 @@
--TEST--
-Bug #71889 (DateInterval::format segfault on '%' input)
--INI--
-date.timezone=US/Eastern
--FILE--
-<?php
-$di = new DateInterval('P1D');
-var_dump($di->format("%"));
-?>
--EXPECT--
-string(0) ""
@@ -34,14 +34,14 @@ foreach ( $tests as $start => $data )
 echo "\n";
 ?>
 --EXPECT--
-Fri, 15 Oct 2010 23:00:00 +0000
+Sat, 23 Oct 2010 00:00:00 +0000
 Wed, 15 Dec 2010 16:15:00 +0000
 Mon, 20 Dec 2010 00:00:00 +0000
 Mon, 20 Dec 2010 10:00:00 +0000
 Tue, 21 Dec 2010 12:00:00 +0000
 Mon, 03 Jan 2011 00:00:00 +0000
 Mon, 03 Jan 2011 09:00:00 +0000
-Fri, 15 Oct 2010 23:00:00 +0100
+Sat, 23 Oct 2010 00:00:00 +0100
 Sun, 28 Mar 2010 00:15:00 +0000
 Sun, 28 Mar 2010 02:15:00 +0100
 Sun, 28 Mar 2010 02:15:00 +0100
@@ -250,7 +250,6 @@ val_type inifile_fetch(inifile *dba, const key_type *key, int skip TSRMLS_DC) {
 	if (skip == -1 && dba->next.key.group && dba->next.key.name && !inifile_key_cmp(&dba->next.key, key TSRMLS_CC)) {
 		/* we got position already from last fetch */
 		php_stream_seek(dba->fp, dba->next.pos, SEEK_SET);
-		ln.key.group = estrdup(dba->next.key.group);
 	} else {
 		/* specific instance or not same key -> restart search */
 		/* the slow way: restart and seacrch */
@@ -403,7 +402,7 @@ static int inifile_copy_to(inifile *dba, size_t pos_start, size_t pos_end, inifi
 		return FAILURE;
 	}
 	php_stream_seek(dba->fp, pos_start, SEEK_SET);
-	if (SUCCESS != php_stream_copy_to_stream_ex(dba->fp, fp, pos_end - pos_start, NULL)) {
+	if (!php_stream_copy_to_stream_ex(dba->fp, fp, pos_end - pos_start, NULL)) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not copy group [%zu - %zu] to temporary stream", pos_start, pos_end);
 		return FAILURE;
 	} 
@@ -428,7 +427,7 @@ static int inifile_filter(inifile *dba, inifile *from, const key_type *key TSRML
 			pos_curr = php_stream_tell(from->fp);
 			if (pos_start != pos_next) {
 				php_stream_seek(from->fp, pos_start, SEEK_SET);
-				if (SUCCESS != php_stream_copy_to_stream_ex(from->fp, dba->fp, pos_next - pos_start, NULL)) {
+				if (!php_stream_copy_to_stream_ex(from->fp, dba->fp, pos_next - pos_start, NULL)) {
 					php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not copy [%zu - %zu] from temporary stream", pos_next, pos_start);
 					ret = FAILURE;
 				}
@@ -447,7 +446,7 @@ static int inifile_filter(inifile *dba, inifile *from, const key_type *key TSRML
 	}
 	if (pos_start != pos_next) {
 		php_stream_seek(from->fp, pos_start, SEEK_SET);
-		if (SUCCESS != php_stream_copy_to_stream_ex(from->fp, dba->fp, pos_next - pos_start, NULL)) {
+		if (!php_stream_copy_to_stream_ex(from->fp, dba->fp, pos_next - pos_start, NULL)) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not copy [%zu - %zu] from temporary stream", pos_next, pos_start);
 			ret = FAILURE;
 		}
@@ -498,7 +497,7 @@ static int inifile_delete_replace_append(inifile *dba, const key_type *key, cons
 			php_stream_seek(dba->fp, 0, SEEK_END);
 			if (pos_grp_next != (size_t)php_stream_tell(dba->fp)) {
 				php_stream_seek(dba->fp, pos_grp_next, SEEK_SET);
-				if (SUCCESS != php_stream_copy_to_stream_ex(dba->fp, fp_tmp, PHP_STREAM_COPY_ALL, NULL)) {
+				if (!php_stream_copy_to_stream_ex(dba->fp, fp_tmp, PHP_STREAM_COPY_ALL, NULL)) {
 					php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not copy remainder to temporary stream");
 					ret = FAILURE;
 				}
@@ -539,7 +538,7 @@ static int inifile_delete_replace_append(inifile *dba, const key_type *key, cons
 		if (fp_tmp && php_stream_tell(fp_tmp)) {
 			php_stream_seek(fp_tmp, 0, SEEK_SET);
 			php_stream_seek(dba->fp, 0, SEEK_END);
-			if (SUCCESS != php_stream_copy_to_stream_ex(fp_tmp, dba->fp, PHP_STREAM_COPY_ALL, NULL)) {
+			if (!php_stream_copy_to_stream_ex(fp_tmp, dba->fp, PHP_STREAM_COPY_ALL, NULL)) {
 				php_error_docref(NULL TSRMLS_CC, E_RECOVERABLE_ERROR, "Could not copy from temporary stream - ini file truncated");
 				ret = FAILURE;
 			}
@@ -1,71 +0,0 @@
--TEST--
-Bug #70825 (Cannot fetch multiple values with group in ini file)
--SKIPIF--
-<?php
-if (!extension_loaded('dba')) die('skip dba extension not available');
-if (!in_array('inifile', dba_handlers())) die('skip inifile handler not available');
-?>
--FILE--
-<?php
-$filename = __DIR__ . DIRECTORY_SEPARATOR . 'bug70825.ini';
-
-$db = dba_open($filename, 'n', 'inifile');
-dba_insert('foo', 23, $db);
-dba_insert('foo', 42, $db);
-dba_insert('foo', 1337, $db);
-var_dump(dba_fetch('foo', -1, $db));
-var_dump(dba_fetch('foo', -1, $db));
-var_dump(dba_fetch('foo', -1, $db));
-dba_close($db);
-unlink($filename);
-
-$db = dba_open($filename, 'n', 'inifile');
-dba_insert(['foo', 'bar'], 23, $db);
-dba_insert(['foo', 'bar'], 42, $db);
-dba_insert(['foo', 'bar'], 1337, $db);
-var_dump(dba_fetch(['foo', 'bar'], -1, $db));
-var_dump(dba_fetch(['foo', 'bar'], -1, $db));
-var_dump(dba_fetch(['foo', 'bar'], -1, $db));
-dba_close($db);
-unlink($filename);
-
-$db = dba_open($filename, 'n', 'inifile');
-dba_insert('[foo]bar', 23, $db);
-dba_insert('[foo]bar', 42, $db);
-dba_insert('[foo]bar', 1337, $db);
-var_dump(dba_fetch('[foo]bar', -1, $db));
-var_dump(dba_fetch('[foo]bar', -1, $db));
-var_dump(dba_fetch('[foo]bar', -1, $db));
-dba_close($db);
-unlink($filename);
-
-$db = dba_open($filename, 'n', 'inifile');
-dba_insert('[foo]bar', 23, $db);
-dba_insert('[foo]bar', 42, $db);
-dba_insert('[foo]bar', 1337, $db);
-var_dump(dba_fetch('[foo]bar', 0, $db));
-var_dump(dba_fetch('[foo]bar', 1, $db));
-var_dump(dba_fetch('[foo]bar', 2, $db));
-dba_close($db);
-unlink($filename);
-?>
-==DONE==
--EXPECT--
-string(2) "23"
-string(2) "42"
-string(4) "1337"
-string(2) "23"
-string(2) "42"
-string(4) "1337"
-string(2) "23"
-string(2) "42"
-string(4) "1337"
-string(2) "23"
-string(2) "42"
-string(4) "1337"
-==DONE==
--CLEAN--
-<?php
-$filename = __DIR__ . DIRECTORY_SEPARATOR . 'bug70825.ini';
-unlink($filename);
-?>
@@ -1,28 +0,0 @@
--TEST--
-Bug #71514 (Bad dba_replace condition because of wrong API usage)
--SKIPIF--
-<?php
-if (!extension_loaded('dba')) die('skip dba extension not available');
-if (!in_array('inifile', dba_handlers())) die('skip inifile handler not available');
-?>
--FILE--
-<?php
-$filename = __DIR__ . DIRECTORY_SEPARATOR . 'bug71514.ini';
-
-$db = dba_open($filename, 'c', 'inifile');
-
-dba_insert('foo', 'value1', $db);
-dba_replace('foo', 'value2', $db);
-var_dump(dba_fetch('foo', $db));
-
-dba_close($db);
-?>
-==DONE==
--EXPECT--
-string(6) "value2"
-==DONE==
--CLEAN--
-<?php
-$filename = __DIR__ . DIRECTORY_SEPARATOR . 'bug71514.ini';
-unlink($filename);
-?>
@@ -40,7 +40,7 @@ do {
 	}
 	if ($handler != 'cdb') {
 		$db_writer = dba_open($db_filename, 'c'.$lock_flag, $handler);
-		if (($dba_reader = @dba_open($db_filename, 'r'.$lock_flag.'t', $handler))===false) {
+		if (($dba_reader = @dba_open($db_filename, 'r'.$lock_flag.($lock_flag ? 't' : ''), $handler))===false) {
 			echo "Read during write: not allowed\n";
 		} else {
 			echo "Read during write: allowed\n";
@@ -1792,7 +1792,7 @@ PHP_FUNCTION(dom_document_savexml)
 		if (options & LIBXML_SAVE_NOEMPTYTAG) {
 			xmlSaveNoEmptyTags = saveempty;
 		}
-		if (!size || !mem) {
+		if (!size) {
 			RETURN_FALSE;
 		}
 		RETVAL_STRINGL(mem, size, 1);
@@ -2327,7 +2327,7 @@ PHP_FUNCTION(dom_document_save_html)
 #else
 		htmlDocDumpMemory(docp, &mem, &size);
 #endif
-		if (!size || !mem) {
+		if (!size) {
 			RETVAL_FALSE;
 		} else {
 			RETVAL_STRINGL((const char*) mem, size, 1);
@@ -1,20 +0,0 @@
--TEST--
-Bug #66502 (DOM document dangling reference)
--SKIPIF--
-<?php
-if (!extension_loaded('dom')) die('skip requires ext/dom');
-?>
--FILE--
-<?php
-$dom = new DOMDocument('1.0', 'UTF-8');
-$element = $dom->appendChild(new DOMElement('root'));
-$comment = new DOMComment("Comment 0");
-$comment = $element->appendChild($comment);
-
-$comment->__construct("Comment 1");
-$comment->__construct("Comment 2");
-$comment->__construct("Comment 3");
-echo 'DONE', PHP_EOL;
-?>
--EXPECT--
-DONE
@@ -14,7 +14,7 @@
   +----------------------------------------------------------------------+
   | Authors: Rasmus Lerdorf <rasmus@php.net>                             |
   |          Jim Winstead <jimw@php.net>                                 |
-   |          Jaakko Hyvätti <jaakko@hyvatti.iki.fi>                      |
+   |          Jaakko Hyvätti <jaakko@hyvatti.iki.fi>                      | 
   +----------------------------------------------------------------------+
 */
 /* $Id$ */
@@ -29,7 +29,7 @@
 /* {{{ arginfo */
 ZEND_BEGIN_ARG_INFO_EX(arginfo_ereg, 0, 0, 2)
 	ZEND_ARG_INFO(0, pattern)
-	ZEND_ARG_INFO(0, string)
+	ZEND_ARG_INFO(0, string) 
 	ZEND_ARG_INFO(1, registers) /* ARRAY_INFO(1, registers, 1) */
 ZEND_END_ARG_INFO()

@@ -41,8 +41,8 @@ ZEND_END_ARG_INFO()

 ZEND_BEGIN_ARG_INFO_EX(arginfo_split, 0, 0, 2)
 	ZEND_ARG_INFO(0, pattern)
-	ZEND_ARG_INFO(0, string)
-	ZEND_ARG_INFO(0, limit)
+	ZEND_ARG_INFO(0, string) 
+	ZEND_ARG_INFO(0, limit)  
 ZEND_END_ARG_INFO()

 ZEND_BEGIN_ARG_INFO(arginfo_sql_regcase, 0)
@@ -204,7 +204,7 @@ static int _php_regcomp(regex_t *preg, const char *pattern, int cflags TSRMLS_DC
 }
 /* }}} */

-static void _free_ereg_cache(reg_cache *rc)
+static void _free_ereg_cache(reg_cache *rc) 
 {
 	regfree(&rc->preg);
 }
@@ -309,7 +309,7 @@ static void php_ereg(INTERNAL_FUNCTION_PARAMETERS, int icase)
 	if (icase) {
 		copts |= REG_ICASE;
 	}
-
+	
 	if (argc == 2) {
 		copts |= REG_NOSUB;
 	}
@@ -337,7 +337,7 @@ static void php_ereg(INTERNAL_FUNCTION_PARAMETERS, int icase)

 	/* allocate storage for (sub-)expression-matches */
 	subs = (regmatch_t *)ecalloc(sizeof(regmatch_t),re.re_nsub+1);
-
+	
 	/* actually execute the regular expression */
 	err = regexec(&re, string, re.re_nsub+1, subs, 0);
 	if (err && err != REG_NOMATCH) {
@@ -409,8 +409,8 @@ PHP_EREG_API char *php_ereg_replace(const char *pattern, const char *replace, co
 		 *nbuf,	/* nbuf is used when we grow the buffer */
 		 *walkbuf; /* used to walk buf when replacing backrefs */
 	const char *walk; /* used to walk replacement string for backrefs */
-	size_t buf_len, new_l;
-	int pos, tmp, string_len;
+	int buf_len;
+	int pos, tmp, string_len, new_l;
 	int err, copts = 0;

 	string_len = strlen(string);
@@ -434,8 +434,8 @@ PHP_EREG_API char *php_ereg_replace(const char *pattern, const char *replace, co

 	/* start with a buffer that is twice the size of the stringo
 	   we're doing replacements in */
-	buf = safe_emalloc(string_len, 2, 1);
 	buf_len = 2 * string_len + 1;
+	buf = safe_emalloc(buf_len, sizeof(char), 0);

 	err = pos = 0;
 	buf[0] = '\0';
@@ -472,8 +472,8 @@ PHP_EREG_API char *php_ereg_replace(const char *pattern, const char *replace, co
 				}
 			}
 			if (new_l + 1 > buf_len) {
-				nbuf = safe_emalloc(new_l + 1, 2, buf_len);
 				buf_len = 1 + buf_len + 2 * new_l;
+				nbuf = emalloc(buf_len);
 				strncpy(nbuf, buf, buf_len - 1);
 				nbuf[buf_len - 1] = '\0';
 				efree(buf);
@@ -491,7 +491,7 @@ PHP_EREG_API char *php_ereg_replace(const char *pattern, const char *replace, co
 					if (subs[walk[1] - '0'].rm_so > -1 && subs[walk[1] - '0'].rm_eo > -1
 						/* this next case shouldn't happen. it does. */
 						&& subs[walk[1] - '0'].rm_so <= subs[walk[1] - '0'].rm_eo) {
-
+						
 						tmp = subs[walk[1] - '0'].rm_eo - subs[walk[1] - '0'].rm_so;
 						memcpy (walkbuf, &string[pos + subs[walk[1] - '0'].rm_so], tmp);
 						walkbuf += tmp;
@@ -510,8 +510,8 @@ PHP_EREG_API char *php_ereg_replace(const char *pattern, const char *replace, co
 				}
 				new_l = strlen (buf) + 1;
 				if (new_l + 1 > buf_len) {
-					nbuf = safe_emalloc(new_l + 1, 2, buf_len);
 					buf_len = 1 + buf_len + 2 * new_l;
+					nbuf = safe_emalloc(buf_len, sizeof(char), 0);
 					strncpy(nbuf, buf, buf_len-1);
 					efree(buf);
 					buf = nbuf;
@@ -526,7 +526,7 @@ PHP_EREG_API char *php_ereg_replace(const char *pattern, const char *replace, co
 			new_l = strlen(buf) + strlen(&string[pos]);
 			if (new_l + 1 > buf_len) {
 				buf_len = new_l + 1; /* now we know exactly how long it is */
-				nbuf = safe_emalloc(new_l, 1, 1);
+				nbuf = safe_emalloc(buf_len, sizeof(char), 0);
 				strncpy(nbuf, buf, buf_len-1);
 				efree(buf);
 				buf = nbuf;
@@ -556,7 +556,7 @@ static void php_do_ereg_replace(INTERNAL_FUNCTION_PARAMETERS, int icase)
 	char *replace;
 	char *ret;
 	int arg_string_len;
-
+	
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ZZs", &arg_pattern, &arg_replace, &arg_string, &arg_string_len) == FAILURE) {
 		return;
 	}
@@ -598,7 +598,7 @@ static void php_do_ereg_replace(INTERNAL_FUNCTION_PARAMETERS, int icase)
 	if (ret == (char *) -1) {
 		RETVAL_FALSE;
 	} else {
-		RETVAL_STRINGL_CHECK(ret, strlen(ret), 1);
+		RETVAL_STRING(ret, 1);
 		STR_FREE(ret);
 	}

@@ -664,9 +664,9 @@ static void php_split(INTERNAL_FUNCTION_PARAMETERS, int icase)
 		} else if (subs[0].rm_so == 0 && subs[0].rm_eo == 0) {
 			/* No more matches */
 			regfree(&re);
-
+			
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid Regular Expression");
-
+			
 			zend_hash_destroy(Z_ARRVAL_P(return_value));
 			efree(Z_ARRVAL_P(return_value));
 			RETURN_FALSE;
@@ -675,7 +675,7 @@ static void php_split(INTERNAL_FUNCTION_PARAMETERS, int icase)

 			/* make a copy of the substring */
 			size = subs[0].rm_so;
-
+		
 			/* add it to the array */
 			add_next_index_stringl(return_value, strp, size, 1);

@@ -701,7 +701,7 @@ static void php_split(INTERNAL_FUNCTION_PARAMETERS, int icase)

 	/* otherwise we just have one last element to add to the array */
 	size = endp - strp;
-
+	
 	add_next_index_stringl(return_value, strp, size, 1);

 	regfree(&re);
@@ -738,16 +738,11 @@ PHP_EREG_API PHP_FUNCTION(sql_regcase)
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &string, &string_len) == FAILURE) {
 		return;
 	}
-
+	
 	tmp = safe_emalloc(string_len, 4, 1);
-
+	
 	for (i = j = 0; i < string_len; i++) {
 		c = (unsigned char) string[i];
-		if ( j >= INT_MAX - 1 || (isalpha(c) && j >= INT_MAX - 4)) {
-			php_error_docref(NULL TSRMLS_CC, E_WARNING, "String too long, max length is %d", INT_MAX);
-			efree(tmp);
-			RETURN_FALSE;
-		}
 		if (isalpha(c)) {
 			tmp[j++] = '[';
 			tmp[j++] = toupper(c);
@@ -1303,7 +1303,7 @@ static size_t exif_convert_any_to_int(void *value, int format, int motorola_inte
 			if (s_den == 0) {
 				return 0;
 			} else {
-				return (size_t)((double)php_ifd_get32s(value, motorola_intel) / s_den);
+				return php_ifd_get32s(value, motorola_intel) / s_den;
 			}

 		case TAG_FMT_SSHORT:    return php_ifd_get16u(value, motorola_intel);
@@ -1709,10 +1709,6 @@ static void exif_iif_add_value(image_info_type *image_info, int section_index, c
 				break;
 		case TAG_FMT_UNDEFINED:
 			if (value) {
-				if (tag == TAG_MAKER_NOTE) {
-					length = MIN(length, strlen(value));
-				}
-
 				/* do not recompute length here */
 				info_value->s = estrndup(value, length);
 				info_data->length = length;
@@ -2617,7 +2613,6 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
 	*pszEncoding = NULL;
 	/* Copy the comment */
 	if (ByteCount>=8) {
-		const zend_encoding *from, *to;
 		if (!memcmp(szValuePtr, "UNICODE\0", 8)) {
 			*pszEncoding = estrdup((const char*)szValuePtr);
 			szValuePtr = szValuePtr+8;
@@ -2638,16 +2633,14 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
 			} else {
 				decode = ImageInfo->decode_unicode_le;
 			}
-			to = zend_multibyte_fetch_encoding(ImageInfo->encode_unicode TSRMLS_CC);
-			from = zend_multibyte_fetch_encoding(decode TSRMLS_CC);
 			/* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX   */
-			if (!to || !from || zend_multibyte_encoding_converter(
+			if (zend_multibyte_encoding_converter(
 					(unsigned char**)pszInfoPtr,
 					&len,
 					(unsigned char*)szValuePtr,
 					ByteCount,
-					to,
-					from
+					zend_multibyte_fetch_encoding(ImageInfo->encode_unicode TSRMLS_CC),
+					zend_multibyte_fetch_encoding(decode TSRMLS_CC)
 					TSRMLS_CC) == (size_t)-1) {
 				len = exif_process_string_raw(pszInfoPtr, szValuePtr, ByteCount);
 			}
@@ -2662,15 +2655,13 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
 			szValuePtr = szValuePtr+8;
 			ByteCount -= 8;
 			/* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX   */
-			to = zend_multibyte_fetch_encoding(ImageInfo->encode_jis TSRMLS_CC);
-			from = zend_multibyte_fetch_encoding(ImageInfo->motorola_intel ? ImageInfo->decode_jis_be : ImageInfo->decode_jis_le TSRMLS_CC);
-			if (!to || !from || zend_multibyte_encoding_converter(
+			if (zend_multibyte_encoding_converter(
 					(unsigned char**)pszInfoPtr,
 					&len,
 					(unsigned char*)szValuePtr,
 					ByteCount,
-					to,
-					from
+					zend_multibyte_fetch_encoding(ImageInfo->encode_jis TSRMLS_CC),
+					zend_multibyte_fetch_encoding(ImageInfo->motorola_intel ? ImageInfo->decode_jis_be : ImageInfo->decode_jis_le TSRMLS_CC)
 					TSRMLS_CC) == (size_t)-1) {
 				len = exif_process_string_raw(pszInfoPtr, szValuePtr, ByteCount);
 			}
@@ -2727,14 +2718,8 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 	char *dir_start;

 	for (i=0; i<=sizeof(maker_note_array)/sizeof(maker_note_type); i++) {
-		if (i==sizeof(maker_note_array)/sizeof(maker_note_type)) {
-#ifdef EXIF_DEBUG
-			exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "No maker note data found. Detected maker: %s (length = %d)", ImageInfo->make, strlen(ImageInfo->make));
-#endif
-			/* unknown manufacturer, not an error, use it as a string */
-			return TRUE;
-		}
-
+		if (i==sizeof(maker_note_array)/sizeof(maker_note_type))
+			return FALSE;
 		maker_note = maker_note_array+i;

 		/*exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "check (%s,%s)", maker_note->make?maker_note->make:"", maker_note->model?maker_note->model:"");*/
@@ -2747,12 +2732,6 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 		break;
 	}

-	if (maker_note->offset >= value_len) {
-		/* Do not go past the value end */
-		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "IFD data too short: 0x%04X offset 0x%04X", value_len, maker_note->offset);
-		return FALSE;
-	}
-
 	dir_start = value_ptr + maker_note->offset;

 #ifdef EXIF_DEBUG
@@ -2781,19 +2760,10 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 			offset_base = value_ptr;
 			break;
 		case MN_OFFSET_GUESS:
-			if (maker_note->offset + 10 + 4 >= value_len) {
-				/* Can not read dir_start+10 since it's beyond value end */
-				exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "IFD data too short: 0x%04X", value_len);
-				return FALSE;
-			}
 			offset_diff = 2 + NumDirEntries*12 + 4 - php_ifd_get32u(dir_start+10, ImageInfo->motorola_intel);
 #ifdef EXIF_DEBUG
 			exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Using automatic offset correction: 0x%04X", ((int)dir_start-(int)offset_base+maker_note->offset+displacement) + offset_diff);
 #endif
-			if (offset_diff < 0 || offset_diff >= value_len ) {
-				exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "IFD data bad offset: 0x%04X length 0x%04X", offset_diff, value_len);
-				return FALSE;
-			}
 			offset_base = value_ptr + offset_diff;
 			break;
 		default:
@@ -2802,7 +2772,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 	}

 	if ((2+NumDirEntries*12) > value_len) {
-		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 2 + 0x%04X*12 = 0x%04X > 0x%04X", NumDirEntries, 2+NumDirEntries*12, value_len);
+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 2 + x%04X*12 = x%04X > x%04X", NumDirEntries, 2+NumDirEntries*12, value_len);
 		return FALSE;
 	}

@@ -2855,7 +2825,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 	}

 	if (components < 0) {
-		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal components(%d)", tag, exif_get_tagname(tag, tagname, -12, tag_table TSRMLS_CC), components);
+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal components(%ld)", tag, exif_get_tagname(tag, tagname, -12, tag_table TSRMLS_CC), components);
 		return FALSE;
 	}

@@ -2908,11 +2878,11 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 			}

 			fpos = php_stream_tell(ImageInfo->infile);
-			php_stream_seek(ImageInfo->infile, displacement+offset_val, SEEK_SET);
+			php_stream_seek(ImageInfo->infile, offset_val, SEEK_SET);
 			fgot = php_stream_tell(ImageInfo->infile);
-			if (fgot!=displacement+offset_val) {
+			if (fgot!=offset_val) {
 				EFREE_IF(outside);
-				exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Wrong file pointer: 0x%08X != 0x%08X", fgot, displacement+offset_val);
+				exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Wrong file pointer: 0x%08X != 0x%08X", fgot, offset_val);
 				return FALSE;
 			}
 			fgot = php_stream_read(ImageInfo->infile, value_ptr, byte_count);
@@ -2985,7 +2955,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 						/* When there are any characters after the first NUL */
 						ImageInfo->CopyrightPhotographer  = estrdup(value_ptr);
 						ImageInfo->CopyrightEditor        = estrndup(value_ptr+length+1, byte_count-length-1);
-						spprintf(&ImageInfo->Copyright, 0, "%s, %s", ImageInfo->CopyrightPhotographer, ImageInfo->CopyrightEditor);
+						spprintf(&ImageInfo->Copyright, 0, "%s, %s", value_ptr, value_ptr+length+1);
 						/* format = TAG_FMT_UNDEFINED; this musn't be ASCII         */
 						/* but we are not supposed to change this                   */
 						/* keep in mind that image_info does not store editor value */
@@ -3088,10 +3058,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				break;

 			case TAG_MAKER_NOTE:
-				if (!exif_process_IFD_in_MAKERNOTE(ImageInfo, value_ptr, byte_count, offset_base, IFDlength, displacement TSRMLS_CC)) {
-					EFREE_IF(outside);
-					return FALSE;
-				}
+				exif_process_IFD_in_MAKERNOTE(ImageInfo, value_ptr, byte_count, offset_base, IFDlength, displacement TSRMLS_CC);
 				break;

 			case TAG_EXIF_IFD_POINTER:
@@ -3157,11 +3124,6 @@ static int exif_process_IFD_in_JPEG(image_info_type *ImageInfo, char *dir_start,

 	ImageInfo->sections_found |= FOUND_IFD0;

-	if ((dir_start + 2) >= (offset_base+IFDlength)) {
-		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size");
-		return FALSE;
-	}
-
 	NumDirEntries = php_ifd_get16u(dir_start, ImageInfo->motorola_intel);

 	if ((dir_start+2+NumDirEntries*12) > (offset_base+IFDlength)) {
@@ -3185,10 +3147,6 @@ static int exif_process_IFD_in_JPEG(image_info_type *ImageInfo, char *dir_start,
 	 * Hack to make it process IDF1 I hope
 	 * There are 2 IDFs, the second one holds the keys (0x0201 and 0x0202) to the thumbnail
 	 */
-	if ((dir_start+2+12*de + 4) >= (offset_base+IFDlength)) {
-		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size");
-		return FALSE;
-	}
 	NextDirOffset = php_ifd_get32u(dir_start+2+12*de, ImageInfo->motorola_intel);
 	if (NextDirOffset) {
 		/* the next line seems false but here IFDlength means length of all IFDs */
@@ -3238,13 +3196,9 @@ static void exif_process_TIFF_in_JPEG(image_info_type *ImageInfo, char *CharBuf,
 	}

 	/* Check the next two values for correctness. */
-	if (length < 8) {
-		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid TIFF start (1)");
-		return;
-	}
 	exif_value_2a = php_ifd_get16u(CharBuf+2, ImageInfo->motorola_intel);
 	offset_of_ifd = php_ifd_get32u(CharBuf+4, ImageInfo->motorola_intel);
-	if (exif_value_2a != 0x2a || offset_of_ifd < 0x08) {
+	if ( exif_value_2a != 0x2a || offset_of_ifd < 0x08) {
 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Invalid TIFF start (1)");
 		return;
 	}
@@ -3734,11 +3688,8 @@ static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offse
 									fgot = php_stream_read(ImageInfo->infile, ImageInfo->Thumbnail.data, ImageInfo->Thumbnail.size);
 									if (fgot < ImageInfo->Thumbnail.size) {
 										EXIF_ERRLOG_THUMBEOF(ImageInfo)
-										efree(ImageInfo->Thumbnail.data);
-										ImageInfo->Thumbnail.data = NULL;
-									} else {
-										exif_thumbnail_build(ImageInfo TSRMLS_CC);
 									}
+									exif_thumbnail_build(ImageInfo TSRMLS_CC);
 								}
 							}
 						}
@@ -3771,11 +3722,8 @@ static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offse
 						fgot = php_stream_read(ImageInfo->infile, ImageInfo->Thumbnail.data, ImageInfo->Thumbnail.size);
 						if (fgot < ImageInfo->Thumbnail.size) {
 							EXIF_ERRLOG_THUMBEOF(ImageInfo)
-							efree(ImageInfo->Thumbnail.data);
-							ImageInfo->Thumbnail.data = NULL;
-						} else {
-							exif_thumbnail_build(ImageInfo TSRMLS_CC);
 						}
+						exif_thumbnail_build(ImageInfo TSRMLS_CC);
 					}
 #ifdef EXIF_DEBUG
 					exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read next IFD (THUMBNAIL) done");
@@ -4210,7 +4158,7 @@ PHP_FUNCTION(exif_imagetype)
 	php_stream * stream;
 	int itype = 0;

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &imagefile, &imagefile_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &imagefile, &imagefile_len) == FAILURE) {
 		return;
 	}

@@ -1,140 +0,0 @@
--TEST--
-Bug #50845 (exif_read_data() returns corrupted exif headers)
--SKIPIF--
-<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
--FILE--
-<?php
-$infile = dirname(__FILE__).'/bug50845.jpg';
-var_dump(exif_read_data($infile));
--EXPECTF--
-array(44) {
-  ["FileName"]=>
-  string(12) "bug50845.jpg"
-  ["FileDateTime"]=>
-  int(%d)
-  ["FileSize"]=>
-  int(803603)
-  ["FileType"]=>
-  int(2)
-  ["MimeType"]=>
-  string(10) "image/jpeg"
-  ["SectionsFound"]=>
-  string(30) "ANY_TAG, IFD0, THUMBNAIL, EXIF"
-  ["COMPUTED"]=>
-  array(9) {
-    ["html"]=>
-    string(26) "width="5472" height="3648""
-    ["Height"]=>
-    int(3648)
-    ["Width"]=>
-    int(5472)
-    ["IsColor"]=>
-    int(1)
-    ["ByteOrderMotorola"]=>
-    int(0)
-    ["ApertureFNumber"]=>
-    string(5) "f/7.1"
-    ["Copyright"]=>
-    string(13) "Public Domain"
-    ["Thumbnail.FileType"]=>
-    int(2)
-    ["Thumbnail.MimeType"]=>
-    string(10) "image/jpeg"
-  }
-  ["ImageDescription"]=>
-  string(295) "A U.S. Marine Corps MV-22 Osprey lands on the USS Whidbey Island (LSD-41), May 5, 2016. The vehicles were loaded to support a theater security cooperation event as a part of a MEU readiness exercise. (U.S. Marine Corps photo by Lance Cpl. Koby I. Saunders/22 Marine Expeditionary Unit/ Released)"
-  ["Make"]=>
-  string(5) "Canon"
-  ["Model"]=>
-  string(22) "Canon EOS-1D X Mark II"
-  ["Orientation"]=>
-  int(1)
-  ["XResolution"]=>
-  string(5) "240/1"
-  ["YResolution"]=>
-  string(5) "240/1"
-  ["ResolutionUnit"]=>
-  int(2)
-  ["Artist"]=>
-  string(24) "Lance Cpl. Koby Saunders"
-  ["Copyright"]=>
-  string(13) "Public Domain"
-  ["Exif_IFD_Pointer"]=>
-  int(12572)
-  ["THUMBNAIL"]=>
-  array(6) {
-    ["Compression"]=>
-    int(6)
-    ["XResolution"]=>
-    string(5) "240/1"
-    ["YResolution"]=>
-    string(5) "240/1"
-    ["ResolutionUnit"]=>
-    int(2)
-    ["JPEGInterchangeFormat"]=>
-    int(860)
-    ["JPEGInterchangeFormatLength"]=>
-    int(11204)
-  }
-  ["ExposureTime"]=>
-  string(5) "1/200"
-  ["FNumber"]=>
-  string(5) "71/10"
-  ["ExposureProgram"]=>
-  int(1)
-  ["ISOSpeedRatings"]=>
-  int(100)
-  ["UndefinedTag:0x8830"]=>
-  int(2)
-  ["UndefinedTag:0x8832"]=>
-  int(100)
-  ["ExifVersion"]=>
-  string(4) "0230"
-  ["ShutterSpeedValue"]=>
-  string(15) "7643856/1000000"
-  ["ApertureValue"]=>
-  string(15) "5655638/1000000"
-  ["ExposureBiasValue"]=>
-  string(3) "0/1"
-  ["MaxApertureValue"]=>
-  string(3) "4/1"
-  ["MeteringMode"]=>
-  int(5)
-  ["Flash"]=>
-  int(16)
-  ["FocalLength"]=>
-  string(4) "24/1"
-  ["ColorSpace"]=>
-  int(65535)
-  ["FocalPlaneXResolution"]=>
-  string(12) "5472000/1438"
-  ["FocalPlaneYResolution"]=>
-  string(11) "3648000/958"
-  ["FocalPlaneResolutionUnit"]=>
-  int(2)
-  ["CustomRendered"]=>
-  int(0)
-  ["ExposureMode"]=>
-  int(1)
-  ["WhiteBalance"]=>
-  int(0)
-  ["SceneCaptureType"]=>
-  int(0)
-  ["UndefinedTag:0xA431"]=>
-  string(12) "002099000358"
-  ["UndefinedTag:0xA432"]=>
-  array(4) {
-    [0]=>
-    string(4) "24/1"
-    [1]=>
-    string(5) "105/1"
-    [2]=>
-    string(3) "0/0"
-    [3]=>
-    string(3) "0/0"
-  }
-  ["UndefinedTag:0xA434"]=>
-  string(22) "EF24-105mm f/4L IS USM"
-  ["UndefinedTag:0xA435"]=>
-  string(10) "000044bc4c"
-}
@@ -13,4 +13,8 @@ exif_read_data(__DIR__ . '/bug54002_2.jpeg');
 --EXPECTF--
 Warning: exif_read_data(bug54002_1.jpeg): Process tag(x0205=UndefinedTa): Illegal byte_count in %sbug54002.php on line %d

-Warning: exif_read_data(bug54002_2.jpeg): Process tag(x0205=UndefinedTa): Illegal byte_count in %sbug54002.php on line %d
+Warning: exif_read_data(bug54002_1.jpeg): Process tag(xA000=FlashPixVer): Illegal pointer offset(%s) in %sbug54002.php on line %d
+
+Warning: exif_read_data(bug54002_2.jpeg): Process tag(x0205=UndefinedTa): Illegal byte_count in %sbug54002.php on line %d
+
+Warning: exif_read_data(bug54002_2.jpeg): Process tag(xA000=FlashPixVer): Illegal pointer offset(%s) in %sbug54002.php on line %d
@@ -10,9 +10,7 @@ echo "Test\n";
 var_dump(count(exif_read_data(__DIR__."/bug62523_2.jpg")));
 ?>
 Done
--EXPECTF--
+--EXPECT--
 Test
-
-Warning: exif_read_data(bug62523_2.jpg): IFD data bad offset: 0xADB23672 length 0x0D94 in %s%ebug62523_2.php on line %d
-int(30)
+int(76)
 Done
@@ -1,61 +0,0 @@
--TEST--
-Bug #72094: Out of bounds heap read access in exif header processing
--SKIPIF--
-<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
--FILE--
-<?php
-print_r(exif_read_data(__DIR__ . '/bug72094_1.jpg'));
-print_r(exif_read_data(__DIR__ . '/bug72094_2.jpg'));
-print_r(exif_read_data(__DIR__ . '/bug72094_3.jpg'));
-print_r(exif_read_data(__DIR__ . '/bug72094_4.jpg'));
-?>
-DONE
--EXPECTF--
-Warning: exif_read_data(bug72094_1.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
-
-Warning: exif_read_data(bug72094_1.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
-
-Warning: exif_read_data(bug72094_1.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
-
-Warning: exif_read_data(bug72094_1.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
-
-Warning: exif_read_data(bug72094_1.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
-
-Warning: exif_read_data(bug72094_1.jpg): Process tag(x8298=Copyright  ): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
-
-Warning: exif_read_data(bug72094_1.jpg): Illegal IFD offset in %s%ebug72094.php on line %d
-
-Warning: exif_read_data(bug72094_1.jpg): File structure corrupted in %s%ebug72094.php on line %d
-
-Warning: exif_read_data(bug72094_1.jpg): Invalid JPEG file in %s%ebug72094.php on line %d
-
-Warning: exif_read_data(bug72094_2.jpg): Illegal IFD size in %s%ebug72094.php on line %d
-
-Warning: exif_read_data(bug72094_2.jpg): File structure corrupted in %s%ebug72094.php on line %d
-
-Warning: exif_read_data(bug72094_2.jpg): Invalid JPEG file in %s%ebug72094.php on line %d
-
-Warning: exif_read_data(bug72094_3.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
-
-Warning: exif_read_data(bug72094_3.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
-
-Warning: exif_read_data(bug72094_3.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
-
-Warning: exif_read_data(bug72094_3.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
-
-Warning: exif_read_data(bug72094_3.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
-
-Warning: exif_read_data(bug72094_3.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
-
-Warning: exif_read_data(bug72094_3.jpg): Illegal IFD size in %s%ebug72094.php on line %d
-
-Warning: exif_read_data(bug72094_3.jpg): File structure corrupted in %s%ebug72094.php on line %d
-
-Warning: exif_read_data(bug72094_3.jpg): Invalid JPEG file in %s%ebug72094.php on line %d
-
-Warning: exif_read_data(bug72094_4.jpg): Invalid TIFF start (1) in %s%ebug72094.php on line %d
-
-Warning: exif_read_data(bug72094_4.jpg): File structure corrupted in %s%ebug72094.php on line %d
-
-Warning: exif_read_data(bug72094_4.jpg): Invalid JPEG file in %s%ebug72094.php on line %d
-DONE
@@ -1,11 +0,0 @@
--TEST--
-Bug #72603 (Out of bound read in exif_process_IFD_in_MAKERNOTE)
--SKIPIF--
-<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
--FILE--
-<?php
-var_dump(count(exif_read_data(dirname(__FILE__) . "/bug72603.jpeg")));
-?>
--EXPECTF--
-Warning: exif_read_data(bug72603.jpeg): %s in %s%ebug72603.php on line %d
-int(%d)
@@ -1,11 +0,0 @@
--TEST--
-Bug 72618 (NULL Pointer Dereference in exif_process_user_comment)
--SKIPIF--
-<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
--FILE--
-<?php
-var_dump(count(exif_read_data(dirname(__FILE__) . "/bug72618.jpg")));
-?>
--EXPECTF--
-Warning: exif_read_data(bug72618.jpg): %s in %s%ebug72618.php on line %d
-int(%d)
@@ -1,71 +0,0 @@
--TEST--
-Bug #72627 (Memory Leakage In exif_process_IFD_in_TIFF)
--SKIPIF--
-<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
--FILE--
-<?php
-	$exif = exif_read_data(__DIR__ . '/bug72627.tiff',0,0,true);
-	var_dump($exif);
-?>
--EXPECTF--
-Warning: exif_read_data(%s): Thumbnail goes IFD boundary or end of file reached in %sbug72627.php on line %d
-
-Warning: exif_read_data(%s): Error in TIFF: filesize(x04E2) less than start of IFD dir(x829A0004) in %sbug72627.php on line %d
-
-Warning: exif_read_data(%s): Thumbnail goes IFD boundary or end of file reached in %sbug72627.php on line %d
-array(11) {
-  ["FileName"]=>
-  string(13) "bug72627.tiff"
-  ["FileDateTime"]=>
-  int(%d)
-  ["FileSize"]=>
-  int(1250)
-  ["FileType"]=>
-  int(7)
-  ["MimeType"]=>
-  string(10) "image/tiff"
-  ["SectionsFound"]=>
-  string(30) "ANY_TAG, IFD0, THUMBNAIL, EXIF"
-  ["COMPUTED"]=>
-  array(10) {
-    ["html"]=>
-    string(24) "width="128" height="132""
-    ["Height"]=>
-    int(132)
-    ["Width"]=>
-    int(128)
-    ["IsColor"]=>
-    int(0)
-    ["ByteOrderMotorola"]=>
-    int(0)
-    ["ApertureFNumber"]=>
-    string(5) "f/1.0"
-    ["Thumbnail.FileType"]=>
-    int(2)
-    ["Thumbnail.MimeType"]=>
-    string(10) "image/jpeg"
-    ["Thumbnail.Height"]=>
-    int(132)
-    ["Thumbnail.Width"]=>
-    int(128)
-  }
-  ["XResolution"]=>
-  string(21) "1414812756/1414812756"
-  ["THUMBNAIL"]=>
-  array(5) {
-    ["ImageWidth"]=>
-    int(128)
-    ["ImageLength"]=>
-    int(132)
-    ["JPEGInterchangeFormat"]=>
-    int(1280)
-    ["JPEGInterchangeFormatLength"]=>
-    int(100)
-    ["THUMBNAIL"]=>
-    NULL
-  }
-  ["ExposureTime"]=>
-  string(21) "1414812756/1414812756"
-  ["FNumber"]=>
-  string(21) "1414812756/1414812756"
-}
@@ -1,12 +0,0 @@
--TEST--
-Bug #73737 (Crash when parsing a tag format)
--SKIPIF--
-<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
--FILE--
-<?php
-	$exif = exif_thumbnail(__DIR__ . '/bug73737.tiff');
-	var_dump($exif);
-?>
--EXPECTF--
-Warning: exif_thumbnail(bug73737.tiff): Error in TIFF: filesize(x0030) less than start of IFD dir(x10102) in %s line %d
-bool(false)
@@ -142,23 +142,23 @@ Warning: exif_imagetype(0.5): failed to open stream: No such file or directory i
 bool(false)
 -- Iteration 10 --

-Warning: exif_imagetype() expects parameter 1 to be a valid path, array given in %s on line %d
+Warning: exif_imagetype() expects parameter 1 to be string, array given in %s on line %d
 NULL
 -- Iteration 11 --

-Warning: exif_imagetype() expects parameter 1 to be a valid path, array given in %s on line %d
+Warning: exif_imagetype() expects parameter 1 to be string, array given in %s on line %d
 NULL
 -- Iteration 12 --

-Warning: exif_imagetype() expects parameter 1 to be a valid path, array given in %s on line %d
+Warning: exif_imagetype() expects parameter 1 to be string, array given in %s on line %d
 NULL
 -- Iteration 13 --

-Warning: exif_imagetype() expects parameter 1 to be a valid path, array given in %s on line %d
+Warning: exif_imagetype() expects parameter 1 to be string, array given in %s on line %d
 NULL
 -- Iteration 14 --

-Warning: exif_imagetype() expects parameter 1 to be a valid path, array given in %s on line %d
+Warning: exif_imagetype() expects parameter 1 to be string, array given in %s on line %d
 NULL
 -- Iteration 15 --

@@ -198,7 +198,7 @@ Warning: exif_imagetype(obj'ct): failed to open stream: No such file or director
 bool(false)
 -- Iteration 24 --

-Warning: exif_imagetype() expects parameter 1 to be a valid path, resource given in %s on line %d
+Warning: exif_imagetype() expects parameter 1 to be string, resource given in %s on line %d
 NULL
 -- Iteration 25 --

@@ -414,7 +414,7 @@ file_check_mem(struct magic_set *ms, unsigned int level)
 	size_t len;

 	if (level >= ms->c.len) {
-		len = (ms->c.len = 20 + level) * sizeof(*ms->c.li);
+		len = (ms->c.len += 20 + level) * sizeof(*ms->c.li);
 		ms->c.li = CAST(struct level_info *, (ms->c.li == NULL) ?
 		    emalloc(len) :
 		    erealloc(ms->c.li, len));
@@ -1,22 +0,0 @@
--TEST--
-Bug #69107 (finfo no longer detects PHP files)
--SKIPIF--
-<?php
-if (!extension_loaded('fileinfo')) die('skip fileinfo extension not available');
-?>
--FILE--
-<?php
-$finfo = new finfo(FILEINFO_MIME_TYPE);
-
-var_dump($finfo->buffer("<?php\nclass A{}"));
-var_dump($finfo->buffer("<?php class A{}"));
-var_dump($finfo->buffer("<?php\tclass A{}"));
-var_dump($finfo->buffer("<?php\n\rclass A{}"));
-?>
-===DONE===
--EXPECT--
-string(10) "text/x-php"
-string(10) "text/x-php"
-string(10) "text/x-php"
-string(10) "text/x-php"
-===DONE===
@@ -380,14 +380,8 @@ static void php_zval_filter(zval **value, long filter, long flags, zval *options

 		ce = Z_OBJCE_PP(value);
 		if (!ce->__tostring) {
-			zval_dtor(*value);
-			/* #67167: doesn't return null on failure for objects */
-			if (flags & FILTER_NULL_ON_FAILURE) {
-				ZVAL_NULL(*value);
-			} else {
-				ZVAL_FALSE(*value);
-			}
-			goto handle_default;
+			ZVAL_FALSE(*value);
+			return;
 		}
 	}

@@ -396,7 +390,6 @@ static void php_zval_filter(zval **value, long filter, long flags, zval *options

 	filter_func.function(*value, flags, options, charset TSRMLS_CC);

-handle_default:
 	if (
 		options && (Z_TYPE_P(options) == IS_ARRAY || Z_TYPE_P(options) == IS_OBJECT) &&
 		((flags & FILTER_NULL_ON_FAILURE && Z_TYPE_PP(value) == IS_NULL) ||
Author	SHA1	Message	Date
Anatol Belski	e197c9b139	fix test to not to cause false positives	2016-03-31 01:35:38 +02:00
Anatol Belski	7522335b99	Fixed bug #71527 Buffer over-write in finfo_open with malformed magic file The actual fix is applying the upstream patch from https://github.com/file/file/commit/6713ca45e7757297381f4b4cdb9cf5e624a9ad36	2016-03-30 23:00:33 +02:00
Ferenc Kovacs	43416cfc06	PHP 5.6.20	2016-03-30 22:33:04 +02:00
Stanislav Malyshev	0b92349da7	Merge branch 'PHP-5.5' into PHP-5.6.20 * PHP-5.5: Fixed bug #71704 php_snmp_error() Format String Vulnerability	2016-03-28 23:45:04 -07:00
Stanislav Malyshev	a50e1cb5a3	Merge branch 'PHP-5.5' into PHP-5.6.20 * PHP-5.5: Fixed bug #71906: AddressSanitizer: negative-size-param (-1) in mbfl_strcut Fixed bug #71906: AddressSanitizer: negative-size-param (-1) in mbfl_strcut Fix bug #71798 - Integer Overflow in php_raw_url_encode Fix bug #71860: Require valid paths for phar filenames Going for 5.5.34 Conflicts: configure.in ext/phar/tests/create_path_error.phpt main/php_version.h	2016-03-28 23:44:55 -07:00
Ferenc Kovacs	dc318cd7db	5.6.20RC1	2016-03-17 01:50:21 +01:00