5.6.14RC1

Add test XFAIL for bug #70470
Added support of LDAP_OPT_TIMEOUT, fixes #69574
2026-11-12 11:40:50 +00:00 · 2015-09-17 01:52:48 +02:00 · 2015-09-11 13:45:18 +08:00 · 2015-09-09 18:02:10 +02:00 · 2015-09-09 14:20:04 +03:00 · 2015-09-09 10:34:46 +02:00
531 changed files with 110676 additions and 26662 deletions
@@ -20,6 +20,9 @@
 *.tar.gz
 *.tar.bz2
 *.tar.xz
+*.tar.gz.asc
+*.tar.bz2.asc
+*.tar.xz.asc
 .FBCIndex
 .FBCLockFolder
 .deps
@@ -3,6 +3,13 @@ language: c
 notifications:
    email: 
       on_failure: change
+    irc:
+      template:
+        - "%{repository}#%{build_number} (%{branch} - %{commit} : %{author}): %{message} -  Change view : %{compare_url} - Build details : %{build_url}"
+      channels:
+        - "irc.efnet.org#php.pecl"
+      on_success: change
+      on_failure: always

 cache: 
    - apt
@@ -1,8 +1,349 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? May 2015, PHP 5.6.9
+17 Sep 2015, PHP 5.6.14RC1

-02 Apr 2015, PHP 5.6.8
+- Core:
+  . Fixed bug #70370 (Bundled libtool.m4 doesn't handle FreeBSD 10 when
+    building extensions). (Adam)
+
+- CLI server:
+  . Fixed bug #68291 (404 on urls with '+'). (cmb)
+
+- DOM:
+  . Fixed bug #70001 (Assigning to DOMNode::textContent does additional entity
+    encoding). (cmb)
+
+- Mysqlnd:
+  . Fixed bug #70456 (mysqlnd doesn't activate TCP keep-alive when connecting to
+    a server). (Sergei Turchanov)
+
+- OpenSSL:
+  . Fixed bug #55259 (openssl extension does not get the DH parameters from 
+    DH key resource). (Jakub Zelenka)
+  . Fixed bug #70395 (Missing ARG_INFO for openssl_seal()). (cmb)
+  . Fixed bug #60632 (openssl_seal fails with AES). (Jakub Zelenka)
+
+- PDO:
+  . Fixed bug #70389 (PDO constructor changes unrelated variables). (Laruence)
+
+- Phpdbg:
+  . Fix phpdbg_break_next() sometimes not breaking. (Bob)
+
+- Standard:
+  . Fixed bug #67131 (setcookie() conditional for empty values not met). (cmb)
+
+- Streams:
+  . Fixed bug #70361 (HTTP stream wrapper doesn't close keep-alive connections).
+    (Niklas Keller)
+
+- Zip:
+  . Fixed bug #70322 (ZipArchive::close() doesn't indicate errors). (cmb)
+
+03 Sep 2015, PHP 5.6.13
+
+- Core:
+  . Fixed bug #69900 (Too long timeout on pipes). (Anatol)
+  . Fixed bug #69487 (SAPI may truncate POST data). (cmb)
+  . Fixed bug #70198 (Checking liveness does not work as expected).
+    (Shafreeck Sea, Anatol Belski)
+  . Fixed bug #70172 (Use After Free Vulnerability in unserialize()). (Stas)
+  . Fixed bug #70219 (Use after free vulnerability in session deserializer).
+    (taoguangchen at icloud dot com)
+
+- CLI server:
+  . Fixed bug #66606 (Sets HTTP_CONTENT_TYPE but not CONTENT_TYPE).
+    (wusuopu, cmb)
+  . Fixed bug #70264 (CLI server directory traversal). (cmb)
+
+- Date:
+  . Fixed bug #70266 (DateInterval::__construct.interval_spec is not supposed to
+    be optional). (cmb)
+  . Fixed bug #70277 (new DateTimeZone($foo) is ignoring text after null byte).
+    (cmb)
+
+- EXIF:
+  . Fixed bug #70385 (Buffer over-read in exif_read_data with TIFF IFD tag byte
+    value of 32 bytes). (Stas)
+
+- GMP:
+  . Fixed bug #70284 (Use after free vulnerability in unserialize() with GMP).
+    (stas)
+
+- hash:
+  . Fixed bug #70312 (HAVAL gives wrong hashes in specific cases). (letsgolee
+    at naver dot com)
+
+- MCrypt:
+  . Fixed bug #69833 (mcrypt fd caching not working). (Anatol)
+
+- Opcache:
+  . Fixed bug #70237 (Empty while and do-while segmentation fault with opcode
+    on CLI enabled). (Dmitry, Laruence)
+
+- PCRE:
+  . Fixed bug #70232 (Incorrect bump-along behavior with \K and empty string
+    match). (cmb)
+  . Fixed bug #70345 (Multiple vulnerabilities related to PCRE functions).
+    (Anatol Belski)
+
+- SOAP:
+  . Fixed bug #70388 (SOAP serialize_function_call() type confusion / RCE).
+    (Stas)
+
+- SPL:
+  . Fixed bug #70290 (Null pointer deref (segfault) in spl_autoload via
+    ob_start). (hugh at allthethings dot co dot nz)
+  . Fixed bug #70303 (Incorrect constructor reflection for ArrayObject). (cmb)
+  . Fixed bug #70365 (Use-after-free vulnerability in unserialize() with
+    SplObjectStorage). (taoguangchen at icloud dot com)
+  . Fixed bug #70366 (Use-after-free vulnerability in unserialize() with
+    SplDoublyLinkedList). (taoguangchen at icloud dot com)
+
+- Standard:
+  . Fixed bug #70052 (getimagesize() fails for very large and very small WBMP).
+    (cmb)
+  . Fixed bug #70157 (parse_ini_string() segmentation fault with 
+    INI_SCANNER_TYPED). (Tjerk)
+
+- XSLT:
+  . Fixed bug #69782 (NULL pointer dereference). (Stas)
+
+- ZIP:
+  . Fixed bug #70350 (ZipArchive::extractTo allows for directory traversal when
+    creating directories). (neal at fb dot com)
+
+06 Aug 2015, PHP 5.6.12
+
+- Core:
+  . Fixed bug #70012 (Exception lost with nested finally block). (Laruence)
+  . Fixed bug #70002 (TS issues with temporary dir handling). (Anatol)
+  . Fixed bug #69793 (Remotely triggerable stack exhaustion via recursive
+    method calls). (Stas)
+  . Fixed bug #69892 (Different arrays compare indentical due to integer key
+    truncation). (Nikita)
+  . Fixed bug #70121 (unserialize() could lead to unexpected methods execution
+    / NULL pointer deref). (Stas)
+
+- CLI server:
+  . Fixed bug #69655 (php -S changes MKCALENDAR request method to MKCOL). (cmb)
+  . Fixed bug #64878 (304 responses return Content-Type header). (cmb)
+  
+- GD:
+  . Fixed bug #53156 (imagerectangle problem with point ordering). (cmb)
+  . Fixed bug #66387 (Stack overflow with imagefilltoborder). (cmb)
+  . Fixed bug #70102 (imagecreatefromwebm() shifts colors). (cmb)
+  . Fixed bug #66590 (imagewebp() doesn't pad to even length). (cmb)
+  . Fixed bug #66882 (imagerotate by -90 degrees truncates image by 1px). (cmb)
+  . Fixed bug #70064 (imagescale(..., IMG_BICUBIC) leaks memory). (cmb)
+  . Fixed bug #69024 (imagescale segfault with palette based image). (cmb)
+  . Fixed bug #53154 (Zero-height rectangle has whiskers). (cmb)
+  . Fixed bug #67447 (imagecrop() add a black line when cropping). (cmb)
+  . Fixed bug #68714 (copy 'n paste error). (cmb)
+  . Fixed bug #66339 (PHP segfaults in imagexbm). (cmb)
+  . Fixed bug #70047 (gd_info() doesn't report WebP support). (cmb)
+
+- ODBC:
+  . Fixed bug #69975 (PHP segfaults when accessing nvarchar(max) defined
+    columns). (cmb)
+
+- OpenSSL:
+  . Fixed bug #69882 (OpenSSL error "key values mismatch" after
+    openssl_pkcs12_read with extra cert). (Tomasz Sawicki)
+  . Fixed bug #70014 (openssl_random_pseudo_bytes() is not cryptographically
+    secure). (Stas)
+
+- Phar:
+  . Improved fix for bug #69441. (Anatol Belski)
+  . Fixed bug #70019 (Files extracted from archive may be placed outside of
+    destination directory). (Anatol Belski)
+
+- SOAP:
+  . Fixed bug #70081 (SoapClient info leak / null pointer dereference via
+    multiple type confusions). (Stas)
+
+- SPL:
+  . Fixed bug #70068 (Dangling pointer in the unserialization of ArrayObject
+    items). (sean.heelan)
+  . Fixed bug #70166 (Use After Free Vulnerability in unserialize() with
+    SPLArrayObject). (taoguangchen at icloud dot com)
+  . Fixed bug #70168 (Use After Free Vulnerability in unserialize() with
+    SplObjectStorage). (taoguangchen at icloud dot com)
+  . Fixed bug #70169 (Use After Free Vulnerability in unserialize() with
+    SplDoublyLinkedList). (taoguangchen at icloud dot com)
+
+- Standard:
+  . Fixed bug #70096 (Repeated iptcembed() adds superfluous FF bytes). (cmb)
+
+09 Jul 2015, PHP 5.6.11
+
+- Core:
+  . Fixed bug #69768 (escapeshell*() doesn't cater to !). (cmb)
+  . Fixed bug #69703 (Use __builtin_clzl on PowerPC).
+    (dja at axtens dot net, Kalle)
+  . Fixed bug #69732 (can induce segmentation fault with basic php code).
+    (Dmitry)
+  . Fixed bug #69642 (Windows 10 reported as Windows 8).
+    (Christian Wenz, Anatol Belski)
+  . Fixed bug #69551 (parse_ini_file() and parse_ini_string() segmentation
+    fault). (Christoph M. Becker)
+  . Fixed bug #69781 (phpinfo() reports Professional Editions of Windows
+    7/8/8.1/10 as "Business"). (Christian Wenz)
+  . Fixed bug #69740 (finally in generator (yield) swallows exception in
+    iteration). (Nikita)
+  . Fixed bug #69835 (phpinfo() does not report many Windows SKUs).
+    (Christian Wenz)
+  . Fixed bug #69892 (Different arrays compare indentical due to integer key
+    truncation). (Nikita)
+  . Fixed bug #69874 (Can't set empty additional_headers for mail()), regression
+    from fix to bug #68776. (Yasuo)
+
+- GD:
+  . Fixed bug #61221 (imagegammacorrect function loses alpha channel). (cmb)
+
+- GMP:
+  . Fixed bug #69803 (gmp_random_range() modifies second parameter if GMP
+    number). (Nikita)
+
+- Mysqlnd:
+  . Fixed bug #69669 (mysqlnd is vulnerable to BACKRONYM). (CVE-2015-3152)
+    (Andrey)
+    
+- PCRE:
+  . Fixed Bug #53823 (preg_replace: * qualifier on unicode replace garbles the
+    string). (cmb)
+  . Fixed bug #69864 (Segfault in preg_replace_callback) (cmb, ab)
+
+- PDO_pgsql:
+  . Fixed bug #69752 (PDOStatement::execute() leaks memory with DML
+    Statements when closeCuror() is u). (Philip Hofstetter)
+  . Fixed bug #69362 (PDO-pgsql fails to connect if password contains a
+    leading single quote). (Matteo)
+  . Fixed bug #69344 (PDO PgSQL Incorrect binding numeric array with gaps).
+    (Matteo)
+
+- Phar:
+  . Fixed bug #69958 (Segfault in Phar::convertToData on invalid file).
+    (CVE-2015-5589) (Stas)
+  . Fixed bug #69923 (Buffer overflow and stack smashing error in
+    phar_fix_filepath). (CVE-2015-5590) (Stas)
+
+- SimpleXML:
+  . Refactored the fix for bug #66084 (simplexml_load_string() mangles empty
+    node name). (Christoph Michael Becker)
+
+- SPL:
+  . Fixed bug #69737 (Segfault when SplMinHeap::compare produces fatal error).
+    (Stas)
+  . Fixed bug #67805 (SplFileObject setMaxLineLength). (Willian Gustavo Veiga).
+  . Fixed bug #69970 (Use-after-free vulnerability in
+    spl_recursive_it_move_forward_ex()). (Laruence)
+
+- Sqlite3:
+  . Fixed bug #69972 (Use-after-free vulnerability in
+    sqlite3SafetyCheckSickOrOk()). (Laruence)
+
+11 Jun 2015, PHP 5.6.10
+
+- Core:
+  . Fixed bug #66048 (temp. directory is cached during multiple requests).
+    (Julien)
+  . Fixed bug #69566 (Conditional jump or move depends on uninitialised value
+    in extension trait). (jbboehr at gmail dot com)
+  . Fixed bug #69599 (Strange generator+exception+variadic crash). (Nikita)
+  . Fixed bug #69628 (complex GLOB_BRACE fails on Windows).
+    (Christoph M. Becker)
+  . Fixed POST data processing slowdown due to small input buffer size
+    on Windows. (Jorge Oliveira, Anatol)
+  . Fixed bug #69646 (OS command injection vulnerability in escapeshellarg).
+    (CVE-2015-4642) (Anatol Belski)
+  . Fixed bug #69719 (Incorrect handling of paths with NULs). (Stas)
+
+- FTP
+  . Improved fix for bug #69545 (Integer overflow in ftp_genlist() resulting in
+    heap overflow). (CVE-2015-4643) (Max Spelsberg)
+
+- GD:
+  . Fixed bug #69479 (GD fails to build with newer libvpx). (Remi)
+
+- Iconv:
+  . Fixed bug #48147 (iconv with //IGNORE cuts the string). (Stas)
+
+- Litespeed SAPI:
+  . Fixed bug #68812 (Unchecked return value). (George Wang)
+
+- Mail:
+  . Fixed bug #68776 (mail() does not have mail header injection prevention for
+    additional headers). (Yasuo)
+
+- MCrypt:
+  . Added file descriptor caching to mcrypt_create_iv() (Leigh)
+
+- Opcache
+  . Fixed bug #69549 (Memory leak with opcache.optimization_level=0xFFFFFFFF).
+    (Laruence, Dmitry)
+
+- PCRE
+  . Upgraded pcrelib to 8.37. (CVE-2015-2325, CVE-2015-2326)
+
+- Phar:
+  . Fixed bug #69680 (phar symlink in binary directory broken).
+    (Matteo Bernardini, Remi)
+
+- Postgres:
+  . Fixed bug #69667 (segfault in php_pgsql_meta_data). (CVE-2015-4644) (Remi)
+
+- Sqlite3:
+  . Upgrade bundled sqlite to 3.8.10.2. (CVE-2015-3414, CVE-2015-3415,
+    CVE-2015-3416) (Kaplan)
+
+14 May 2015, PHP 5.6.9
+
+- Core:
+  . Fixed bug #69467 (Wrong checked for the interface by using Trait). 
+    (Laruence)
+  . Fixed bug #69420 (Invalid read in zend_std_get_method). (Laruence)
+  . Fixed bug #60022 ("use statement [...] has no effect" depends on leading
+    backslash). (Nikita)
+  . Fixed bug #67314 (Segmentation fault in gc_remove_zval_from_buffer).
+    (Dmitry)
+  . Fixed bug #68652 (segmentation fault in destructor). (Dmitry)
+  . Fixed bug #69419 (Returning compatible sub generator produces a warning).
+    (Nikita)
+  . Fixed bug #69472 (php_sys_readlink ignores misc errors from
+       GetFinalPathNameByHandleA). (Jan Starke)
+  . Fixed bug #69364 (PHP Multipart/form-data remote dos Vulnerability).
+    (CVE-2015-4024) (Stas)
+  . Fixed bug #69403 (str_repeat() sign mismatch based memory corruption).
+    (Stas)
+  . Fixed bug #69418 (CVE-2006-7243 fix regressions in 5.4+). (CVE-2015-4025)
+    (Stas)
+  . Fixed bug #69522 (heap buffer overflow in unpack()). (Stas)
+
+- FTP:
+  . Fixed bug #69545 (Integer overflow in ftp_genlist() resulting in heap
+    overflow). (CVE-2015-4022) (Stas)
+
+- ODBC:
+  . Fixed bug #69354 (Incorrect use of SQLColAttributes with ODBC 3.0).
+    (Anatol)
+  . Fixed bug #69474 (ODBC: Query with same field name from two tables returns
+    incorrect result). (Anatol)
+  . Fixed bug #69381 (out of memory with sage odbc driver). (Frederic Marchall,
+      Anatol Belski)
+
+- OpenSSL:
+  . Fixed bug #69402 (Reading empty SSL stream hangs until timeout).
+    (Daniel Lowrey)
+
+- PCNTL:
+  . Fixed bug #68598 (pcntl_exec() should not allow null char). (CVE-2015-4026)
+    (Stas)
+
+- Phar:
+  . Fixed bug #69453 (Memory Corruption in phar_parse_tarfile when entry
+    filename starts with null). (CVE-2015-4021) (Stas)
+
+16 Apr 2015, PHP 5.6.8

 - Core:
  . Fixed bug #66609 (php crashes with __get() and ++ operator in some cases).
@@ -12,19 +353,31 @@ PHP                                                                        NEWS
  . Fixed bug #68917 (parse_url fails on some partial urls). (Wei Dai)
  . Fixed bug #69134 (Per Directory Values overrides PHP_INI_SYSTEM
    configuration options). (Anatol Belski)
+  . Additional fix for bug #69152 (Type confusion vulnerability in
+    exception::getTraceAsString). (Stas)
  . Fixed bug #69210 (serialize function return corrupted data when sleep has
    non-string values). (Juan Basso)
  . Fixed bug #69212 (Leaking VIA_HANDLER func when exception thrown in
    __call/... arg passing). (Nikita)
  . Fixed bug #69221 (Segmentation fault when using a generator in combination
    with an Iterator). (Nikita)
+  . Fixed bug #69337 (php_stream_url_wrap_http_ex() type-confusion
+    vulnerability). (Stas)
+  . Fixed bug #69353 (Missing null byte checks for paths in various PHP
+    extensions). (Stas)
+
+- Apache2handler:
+  . Fixed bug #69218 (potential remote code execution with apache 2.4
+    apache2handler). (Gerrit Venema)

 - cURL:
  . Implemented FR#69278 (HTTP2 support). (Masaki Kagaya)
  . Fixed bug #68739 (Missing break / control flow). (Laruence)
+  . Fixed bug #69316 (Use-after-free in php_curl related to
+    CURLOPT_FILE/_INFILE/_WRITEHEADER). (Laruence)

 - Date:
-  . Added DateTime::createFromImmutable(). (Trevor Suarez)
+  . Fixed bug #69336 (Issues with "last day of <monthname>"). (Derick Rethans)

 - Enchant:
  . Fixed bug #65406 (Enchant broker plugins are in the wrong place in windows
@@ -33,18 +386,27 @@ PHP                                                                        NEWS
 - Ereg:
  . Fixed bug #68740 (NULL Pointer Dereference). (Laruence)

+- Fileinfo:
+  . Fixed bug #68819 (Fileinfo on specific file causes spurious OOM and/or
+    segfault). (Anatol Belski)
+
 - Filter:
-  . Fixed bug #69202: (FILTER_FLAG_STRIP_BACKTICK ignored unless other
+  . Fixed bug #69202 (FILTER_FLAG_STRIP_BACKTICK ignored unless other
    flags are used). (Jeff Welch)
  . Fixed bug #69203 (FILTER_FLAG_STRIP_HIGH doesn't strip ASCII 127). (Jeff
    Welch)

+- Mbstring:
+  . Fixed bug #68846 (False detection of CJK Unified Ideographs Extension E).
+    (Masaki Kagaya)
+
 - OPCache:
  . Fixed bug #69297 (function_exists strange behavior with OPCache on
    disabled function). (Laruence)
+  . Fixed bug #69281 (opcache_is_script_cached no longer works). (danack)
  . Fixed bug #68677 (Use After Free). (CVE-2015-1351) (Laruence)

- OpenSSL
+- OpenSSL:
  . Fixed bugs #68853, #65137 (Buffered crypto stream data breaks IO polling
    in stream_select() contexts) (Chris Wright)
  . Fixed bug #69197 (openssl_pkcs7_sign handles default value incorrectly)
@@ -60,22 +422,28 @@ PHP                                                                        NEWS
  . Fixed bug #65467 (Call to undefined method cli_arg_typ_string). (Mike)
  . Fixed bug #67761 (Phar::mapPhar fails for Phars inside a path containing 
    ".tar"). (Mike)
+  . Fixed bug #69324 (Buffer Over-read in unserialize when parsing Phar). (Stas)
+  . Fixed bug #69441 (Buffer Overflow when parsing tar/zip/phar in
+    phar_set_inode). (Stas)

 - Postgres:
  . Fixed bug #68741 (Null pointer dereference). (CVE-2015-1352) (Laruence)

+- SOAP:
+  . Fixed bug #69152 (Type Confusion Infoleak Vulnerability in unserialize()
+    with SoapFault). (Dmitry)
+  . Fixed bug #69293 (NEW segfault when using SoapClient::__setSoapHeader 
+     (bisected, regression)). (Laruence)
+
 - SPL:
  . Fixed bug #69227 (Use after free in zval_scan caused by
     spl_object_storage_get_gc). (adam dot scarr at 99designs dot com)

- SOAP:
-  . Fixed bug #69293 (NEW segfault when using SoapClient::__setSoapHeader 
-     (bisected, regression)). (Laruence)
-
- SQLITE:
+- Sqlite3:
  . Fixed bug #68760 (SQLITE segfaults if custom collator throws an exception).
     (Dan Ackroyd)
  . Fixed bug #69287 (Upgrade bundled libsqlite to 3.8.8.3). (Anatol)
+  . Fixed bug #66550 (SQLite prepared statement use-after-free). (Sean Heelan)

 19 Mar 2015, PHP 5.6.7

@@ -151,7 +519,8 @@ PHP                                                                        NEWS

 - SOAP:
  . Fixed bug #69085 (SoapClient's __call() type confusion through
-    unserialize()). (andrea dot palazzo at truel dot it, Laruence)
+    unserialize()). (CVE-2015-4147, CVE-2015-4148) (andrea dot palazzo at truel
+    dot it, Laruence)

 - SPL:
  . Fixed bug #69108 ("Segmentation fault" when (de)serializing
@@ -281,7 +650,7 @@ PHP                                                                        NEWS
    interval). (Marc Bennewitz)

 - EXIF:
-  . Fixed bug #68799: Free called on unitialized pointer. (CVE-2015-0232)
+  . Fixed bug #68799: Free called on uninitialized pointer. (CVE-2015-0232)
    (Stas)

 - Fileinfo:
@@ -12,7 +12,7 @@ Collaboration is a Good Thing(tm), and Git lets us do this. Thus, following
 some basic rules with regards to Git usage will::

   a. Make everybody happier, especially those responsible for maintaining
-      Git itself.
+      PHP itself.

   b. Keep the changes consistently well documented and easily trackable.

@@ -48,11 +48,11 @@ Currently we have the following branches in use::
  PHP-5.6   Is used to release the PHP 5.6.x series. This is a current
            stable version and is open for bugfixes only.

-  PHP-5.5   Is used to release the PHP 5.5.x series. This is a current
-            stable version and is open for bugfixes only.
+  PHP-5.5   Is used to release the PHP 5.5.x series. This is an old
+            stable version and is open for security fixes only.

-  PHP-5.4   Is used to release the PHP 5.4.x series. This is a current
-            stable version and is open for bugfixes only.
+  PHP-5.4   Is used to release the PHP 5.4.x series. This is an old
+            stable version and is open for security fixes only.

  PHP-5.3   This branch is closed.

@@ -67,7 +67,7 @@ Currently we have the following branches in use::

 The next few rules are more of a technical nature::

-   1. All changes should first go to the lowest branch (i.e. 5.4) and then
+   1. All changes should first go to the lowest branch (i.e. 5.6) and then
      get merged up to all other branches. If a change is not needed for
      later branches (i.e. fixes for features which where dropped from later
      branches) an empty merge should be done.
@@ -213,12 +213,14 @@ Getting the stable release announced

 c. ``$PHP_X_MD5`` array and update all the md5 sums

- d. set ``$PHP_X_RC`` to false!
+ d. ``$PHP_X_SHA256`` array and update all the SHA256 sums

- e. Make sure there are no outdated "notes" or edited "date" keys in the
+ e. set ``$PHP_X_RC`` to false!
+
+ f. Make sure there are no outdated "notes" or edited "date" keys in the
 ``$RELEASES[X][$PHP_X_VERSION]["source"]`` array

- f. if the windows builds aren't ready yet prefix the "windows" key with a dot (".windows")
+ g. if the windows builds aren't ready yet prefix the "windows" key with a dot (".windows")

 3. Create the release file (releases/x_y_z.php)
   Usually we use the same content as for point 6, but included in php template
@@ -267,6 +269,9 @@ to upgrade.
 9. Wait an hour or two, then send a mail to php-announce@lists.php.net,
 php-general@lists.php.net and internals@lists.php.net with a text similar to
 http://news.php.net/php.internals/17222.
+Please make sure that the mail to php-announce@ is its own completely seperate email.
+This is to make sure that repiles to the announcement on php-general@ or internals@
+will not accidentally hit the php-announce@ mailinglist.

 Re-releasing the same version (or -pl)
 --------------------------------------
@@ -283,7 +288,9 @@ Re-releasing the same version (or -pl)

 d. ``$PHP_X_MD5`` array and update all the md5 sums

- e. Make sure there are no outdated "notes" or edited "date" keys in the
+ e. ``$PHP_X_SHA256`` array and update all the SHA256 sums
+
+ f. Make sure there are no outdated "notes" or edited "date" keys in the
 ``$RELEASES[X][$PHP_X_VERSION]["source"]`` array

 3. Add a short notice to phpweb stating that there is a new release, and
@@ -300,3 +307,6 @@ to upgrade.
 5. Wait an hour or two, then send a mail to php-announce@lists.php.net,
 php-general@lists.php.net and internals@lists.php.net with a text similar to
 the news entry.
+Please make sure that the mail to php-announce@ is its own completely seperate email.
+This is to make sure that repiles to the announcement on php-general@ or internals@
+will not accidentally hit the php-announce@ mailinglist.
@@ -61,6 +61,9 @@ PHP 5.6 UPGRADE NOTES
  longer accept keys or IVs with incorrect sizes. Furthermore an IV is now
  required if the used block cipher mode requires it.

+- cURL:
+  Uploads using the @file syntax are now unsupported by default.
+
 ========================================
 2. New Features
 ========================================
@@ -271,7 +274,6 @@ PHP 5.6 UPGRADE NOTES

 - Datetime:
  Added DatePeriod::getStartDate(), DatePeriod::getEndDate(), DatePeriod::getDateInterval() in 5.6.5.
-  Added DateTime::createFromImmutable() in 5.6.8.

 - GMP:
  Added gmp_root($a, $nth) and gmp_rootrem($a, $nth) for calculating nth roots.
@@ -1,5 +1,5 @@
 --TEST--
-Bug #43201 (Crash on using unitialized vals and __get/__set)
+Bug #43201 (Crash on using uninitialized vals and __get/__set)
 --FILE--
 <?php
 class Foo {
@@ -1,7 +1,5 @@
 --TEST--
 Bug #63336 (invalid E_NOTICE error occur)
--XFAIL--
-Bug is not fixed yet
 --FILE--
 <?php
 error_reporting(E_ALL | E_NOTICE );
@@ -18,7 +16,7 @@ class Child extends Base {
    public function bar($var, $more=self::DUMMY) { return true; }
 }
 ?>
--EXPECT--
-Strict Standards: Declaration of Child::foo() should be compatible with Base::foo($var = '123', $more = NULL) in %sbug63336.php on line %d
+--EXPECTF--
+Strict Standards: Declaration of Child::foo() should be compatible with Base::foo($var = TEST, $more = NULL) in %sbug63336.php on line %d

-Strict Standards: Declaration of Child::bar() should be compatible with Base::bar($var, $more = 'XXX') in %sbug63336.php on line %d
+Strict Standards: Declaration of Child::bar() should be compatible with Base::bar($more = self::DUMMY) in %sbug63336.php on line %d
@@ -0,0 +1,22 @@
+--TEST--
+Bug #67314 (Segmentation fault in gc_remove_zval_from_buffer)
+--FILE--
+<?php
+function crash()
+{
+    $notDefined[$i] = 'test';
+}
+
+function error_handler() { return false; }
+
+set_error_handler('error_handler');
+crash();
+echo "made it once\n";
+crash();
+echo "ok\n";
+--EXPECTF--
+Notice: Undefined variable: i in %sbug67314.php on line 4
+made it once
+
+Notice: Undefined variable: i in %sbug67314.php on line 4
+ok
@@ -0,0 +1,40 @@
+--TEST--
+Bug #68652 (segmentation fault in destructor)
+--FILE--
+<?php
+class Foo {
+
+    private static $instance;
+    public static function getInstance() {
+        if (isset(self::$instance)) {
+            return self::$instance;
+        }
+        return self::$instance = new self();
+    }
+
+    public function __destruct() {
+        Bar::getInstance();
+    }
+}
+
+class Bar {
+
+    private static $instance;
+    public static function getInstance() {
+        if (isset(self::$instance)) {
+            return self::$instance;
+        }
+        return self::$instance = new self();
+    }
+
+    public function __destruct() {
+        Foo::getInstance();
+    }
+}
+
+
+$foo = new Foo();
+?>
+--EXPECTF--
+Fatal error: Access to undeclared static property: Bar::$instance in %sbug68652.php on line %d
+
@@ -0,0 +1,30 @@
+--TEST--
+Bug #69420 (Invalid read in zend_std_get_method)
+--FILE--
+<?php
+
+trait T {
+	protected function test() {
+		echo "okey";
+	}
+}
+
+
+class A {
+	protected function test() {
+	}
+}
+
+class B extends A {
+	use T;
+	public function foo() {
+		$this->test();
+	}
+}
+
+
+$b = new B();
+$b->foo();
+?>
+--EXPECT--
+okey
@@ -0,0 +1,21 @@
+--TEST--
+Bug #69467 (Wrong checked for the interface by using Trait)
+--FILE--
+<?php
+interface Baz {
+    public function bad();
+}
+
+trait Bar{
+    protected function bad(){}
+}
+
+class Foo implements Baz{
+    use Bar;
+}
+
+$test = new Foo();
+var_dump($test instanceof Baz);
+?>
+--EXPECTF--
+Fatal error: Access level to Bar::bad() must be public (as in class Baz) in %sbug69467.php on line %d
@@ -0,0 +1,16 @@
+--TEST--
+Bug #69551 - parse_ini_file() and parse_ini_string() segmentation fault
+--FILE--
+<?php
+$ini = <<<INI
+[Network.eth0]
+SubnetMask = "
+"
+INI;
+$settings = parse_ini_string($ini, false, INI_SCANNER_RAW);
+var_dump($settings);
+?>
+--EXPECTF--
+Warning: syntax error, unexpected '"' in Unknown on line %d
+ in %s on line %d
+bool(false)
@@ -0,0 +1,21 @@
+--TEST--
+Bug #69599: Strange generator+exception+variadic crash
+--FILE--
+<?php
+
+function crash() {
+    sin(...[0]);
+    throw new \Exception();
+    yield;
+}
+
+iterator_to_array(crash());
+
+?>
+--EXPECTF--
+Fatal error: Uncaught exception 'Exception' in %s:%d
+Stack trace:
+#0 [internal function]: crash()
+#1 %s(%d): iterator_to_array(Object(Generator))
+#2 {main}
+  thrown in %s on line %d
@@ -0,0 +1,27 @@
+--TEST--
+Bug #69732 (can induce segmentation fault with basic php code)
+--FILE--
+<?php
+class wpq {
+    private $unreferenced;
+ 
+    public function __get($name) {
+        return $this->$name . "XXX";
+    }
+}
+ 
+function ret_assoc() {
+	$x = "XXX";
+    return array('foo' => 'bar', $x);
+}
+ 
+$wpq = new wpq;
+$wpq->interesting =& ret_assoc();
+$x = $wpq->interesting;
+printf("%s\n", $x);
+--EXPECTF--
+Notice: Undefined property: wpq::$interesting in %sbug69732.php on line 6
+
+Notice: Indirect modification of overloaded property wpq::$interesting has no effect in %sbug69732.php on line 16
+
+Fatal error: Cannot assign by reference to overloaded object in %sbug69732.php on line 16
@@ -0,0 +1,28 @@
+--TEST--
+Bug #69740: finally in generator (yield) swallows exception in iteration
+--FILE--
+<?php
+
+function generate() {
+    try {
+        yield 1;
+        yield 2;
+    } finally {
+        echo "finally\n";
+    }
+}
+
+foreach (generate() as $i) {
+    echo $i, "\n";
+    throw new Exception();
+}
+
+?>
+--EXPECTF--
+1
+finally
+
+Fatal error: Uncaught exception 'Exception' in %s:%d
+Stack trace:
+#0 {main}
+  thrown in %s on line %d
@@ -0,0 +1,10 @@
+--TEST--
+Bug #69892: Different arrays compare indentical due to integer key truncation
+--SKIPIF--
+<?php if (PHP_INT_SIZE != 8) die("skip this test is for 64bit platforms only"); ?>
+--FILE--
+<?php
+var_dump([0 => 0] === [0x100000000 => 0]);
+?>
+--EXPECT--
+bool(false)
@@ -0,0 +1,32 @@
+--TEST--
+Bug #70012 (Exception lost with nested finally block)
+--FILE--
+<?php
+try {
+	echo "Outer try\n";
+	try {
+		echo "  Middle try\n";
+		throw new Exception();
+	} finally {
+		echo "  Middle finally\n";
+		try {
+			echo "    Inner try\n";
+		} finally {
+			echo "    Inner finally\n";
+		}
+	}
+	echo "Outer shouldnt get here\n";
+} catch (Exception $e) {
+	echo "Outer catch\n";
+} finally {
+	echo "Outer finally\n";
+}
+?>
+--EXPECT--
+Outer try
+  Middle try
+  Middle finally
+    Inner try
+    Inner finally
+Outer catch
+Outer finally
@@ -0,0 +1,9 @@
+--TEST--
+Bug #70121 (unserialize() could lead to unexpected methods execution / NULL pointer deref)
+--FILE--
+<?php
+unserialize('O:12:"DateInterval":1:{s:4:"days";O:9:"Exception":7:{s:10:"'."\0".'*'."\0".'message";s:1:"x";s:17:"'."\0".'Exception'."\0".'string";s:1:"A";s:7:"'."\0".'*'."\0".'code";i:0;s:7:"'."\0".'*'."\0".'file";s:1:"a";s:7:"'."\0".'*'."\0".'line";i:1337;s:16:"'."\0".'Exception'."\0".'trace";a:0:{}s:19:"'."\0".'Exception'."\0".'previous";O:8:"stdClass":0:{}}}');
+?>
+OK
+--EXPECT--
+OK
@@ -0,0 +1,18 @@
+--TEST--
+Testing declare statement with ticks
+--SKIPIF--
+--FILE--
+<?php
+register_tick_function(function () { echo "tick\n"; });
+function foo() { }
+
+declare(ticks=1) {
+
+$statement;
+foo();
+
+}
+?>
+--EXPECTF--
+tick
+tick
@@ -0,0 +1,22 @@
+--TEST--
+Bug #69419: Returning compatible sub generator produces a warning
+--FILE--
+<?php
+
+function & genRefInner() {
+    $var = 1;
+    yield $var;
+}
+
+function & genRefOuter() {
+    return genRefInner();
+}
+
+foreach(genRefOuter() as $i) {
+    var_dump($i);
+}
+
+?>
+--EXPECTF--
+Notice: Only variable references should be returned by reference in %s on line %d
+int(1)
@@ -3,6 +3,8 @@
 --FILE--
 <?php
 use A;
+use \B;
 --EXPECTF--
 Warning: The use statement with non-compound name 'A' has no effect in %sns_033.php on line 2

+Warning: The use statement with non-compound name 'B' has no effect in %sns_033.php on line 3
@@ -0,0 +1,17 @@
+--TEST--
+Closure::__invoke() with variadic parameter
+--FILE--
+<?php
+
+$closure = function(&...$refs) {};
+$closure->__invoke(
+    $v1,  $v2,  $v3,  $v4,
+    $v5,  $v6,  $v7,  $v8,
+    $v9, $v10, $v11, $v12,
+    $v13
+);
+
+?>
+===DONE===
+--EXPECT--
+===DONE===
@@ -678,7 +678,7 @@ static inline unsigned int zend_mm_high_bit(size_t _size)
 	__asm {
 		bsr eax, _size
 	}
-#elif defined(__GNUC__) && (defined(__arm__) ||  defined(__aarch64__))
+#elif defined(__GNUC__) && (defined(__arm__) || defined(__aarch64__) || defined(__powerpc__))
 	return (8 * SIZEOF_SIZE_T - 1) - __builtin_clzl(_size);
 #else
 	unsigned int n = 0;
@@ -706,7 +706,7 @@ static inline unsigned int zend_mm_low_bit(size_t _size)
 	__asm {
 		bsf eax, _size
   }
-#elif defined(__GNUC__) && (defined(__arm__) || defined(__aarch64__))
+#elif defined(__GNUC__) && (defined(__arm__) || defined(__aarch64__) || defined(__powerpc__))
 	return __builtin_ctzl(_size);
 #else
 	static const int offset[16] = {4,0,1,0,2,0,1,0,3,0,1,0,2,0,1,0};
@@ -984,7 +984,7 @@ static void zend_mm_random(unsigned char *buf, size_t size) /* {{{ */
 	int has_context = 0;

 	if (!CryptAcquireContext(&hCryptProv, NULL, NULL, PROV_RSA_FULL, 0)) {
-		/* Could mean that the key container does not exist, let try 
+		/* Could mean that the key container does not exist, let try
 		   again by asking for a new one */
 		if (GetLastError() == NTE_BAD_KEYSET) {
 			if (CryptAcquireContext(&hCryptProv, NULL, NULL, PROV_RSA_FULL, CRYPT_NEWKEYSET)) {
@@ -1348,7 +1348,7 @@ static int zend_mm_check_ptr(zend_mm_heap *heap, void *ptr, int silent ZEND_FILE
 	}
 	if (!silent) {
 		TSRMLS_FETCH();
-		
+
 		zend_message_dispatcher(ZMSG_LOG_SCRIPT_NAME, NULL TSRMLS_CC);
 		zend_debug_alloc_output("---------------------------------------\n");
 		zend_debug_alloc_output("%s(%d) : Block "PTR_FMT" status:\n" ZEND_FILE_LINE_RELAY_CC, ptr);
@@ -2175,7 +2175,7 @@ static void *_zend_mm_realloc_int(zend_mm_heap *heap, void *p, size_t size ZEND_
 #if ZEND_MM_CACHE
 	if (ZEND_MM_SMALL_SIZE(true_size)) {
 		size_t index = ZEND_MM_BUCKET_INDEX(true_size);
-		
+
 		if (heap->cache[index] != NULL) {
 			zend_mm_free_block *best_fit;
 			zend_mm_free_block **cache;
@@ -2188,7 +2188,7 @@ static void *_zend_mm_realloc_int(zend_mm_heap *heap, void *p, size_t size ZEND_
 			heap->cache[index] = best_fit->prev_free_block;
 			ZEND_MM_CHECK_MAGIC(best_fit, MEM_BLOCK_CACHED);
 			ZEND_MM_SET_DEBUG_INFO(best_fit, size, 1, 0);
-	
+
 			ptr = ZEND_MM_DATA_OF(best_fit);

 #if ZEND_DEBUG || ZEND_MM_HEAP_PROTECTION
@@ -2470,7 +2470,7 @@ static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
 	     : "%0"(res),
 	       "rm"(size),
 	       "rm"(offset));
-	
+
 	if (UNEXPECTED(overflow)) {
 		zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
 		return 0;
@@ -2619,7 +2619,7 @@ ZEND_API void *_ecalloc(size_t nmemb, size_t size ZEND_FILE_LINE_DC ZEND_FILE_LI

 ZEND_API char *_estrdup(const char *s ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)
 {
-	int length;
+	size_t length;
 	char *p;
 #ifdef ZEND_SIGNALS
 	TSRMLS_FETCH();
@@ -2627,13 +2627,13 @@ ZEND_API char *_estrdup(const char *s ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)

 	HANDLE_BLOCK_INTERRUPTIONS();

-	length = strlen(s)+1;
-	p = (char *) _emalloc(length ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
+	length = strlen(s);
+	p = (char *) _emalloc(safe_address(length, 1, 1) ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
 	if (UNEXPECTED(p == NULL)) {
 		HANDLE_UNBLOCK_INTERRUPTIONS();
 		return p;
 	}
-	memcpy(p, s, length);
+	memcpy(p, s, length+1);
 	HANDLE_UNBLOCK_INTERRUPTIONS();
 	return p;
 }
@@ -2647,7 +2647,7 @@ ZEND_API char *_estrndup(const char *s, uint length ZEND_FILE_LINE_DC ZEND_FILE_

 	HANDLE_BLOCK_INTERRUPTIONS();

-	p = (char *) _emalloc(length+1 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
+	p = (char *) _emalloc(safe_address(length, 1, 1) ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
 	if (UNEXPECTED(p == NULL)) {
 		HANDLE_UNBLOCK_INTERRUPTIONS();
 		return p;
@@ -2668,7 +2668,7 @@ ZEND_API char *zend_strndup(const char *s, uint length)

 	HANDLE_BLOCK_INTERRUPTIONS();

-	p = (char *) malloc(length+1);
+	p = (char *) malloc(safe_address(length, 1, 1));
 	if (UNEXPECTED(p == NULL)) {
 		HANDLE_UNBLOCK_INTERRUPTIONS();
 		return p;
@@ -148,10 +148,12 @@ ZEND_API zend_function *zend_get_closure_invoke_method(zval *obj TSRMLS_DC) /* {
 {
 	zend_closure *closure = (zend_closure *)zend_object_store_get_object(obj TSRMLS_CC);
 	zend_function *invoke = (zend_function*)emalloc(sizeof(zend_function));
+	const zend_uint keep_flags = ZEND_ACC_RETURN_REFERENCE | ZEND_ACC_VARIADIC;

 	invoke->common = closure->func.common;
 	invoke->type = ZEND_INTERNAL_FUNCTION;
-	invoke->internal_function.fn_flags = ZEND_ACC_PUBLIC | ZEND_ACC_CALL_VIA_HANDLER | (closure->func.common.fn_flags & ZEND_ACC_RETURN_REFERENCE);
+	invoke->internal_function.fn_flags =
+		ZEND_ACC_PUBLIC | ZEND_ACC_CALL_VIA_HANDLER | (closure->func.common.fn_flags & keep_flags);
 	invoke->internal_function.handler = ZEND_MN(Closure___invoke);
 	invoke->internal_function.module = 0;
 	invoke->internal_function.scope = zend_ce_closure;
@@ -4051,7 +4051,8 @@ static void zend_add_trait_method(zend_class_entry *ce, const char *name, const
 			}
 			zend_hash_quick_update(*overriden, arKey, nKeyLength, h, fn, sizeof(zend_function), (void**)&fn);
 			return;
-		} else if (existing_fn->common.fn_flags & ZEND_ACC_ABSTRACT) {
+		} else if (existing_fn->common.fn_flags & ZEND_ACC_ABSTRACT &&
+				(existing_fn->common.scope->ce_flags & ZEND_ACC_INTERFACE) == 0) {
 			/* Make sure the trait method is compatible with previosly declared abstract method */
 			if (!zend_traits_method_compatibility_check(fn, existing_fn TSRMLS_CC)) {
 				zend_error_noreturn(E_COMPILE_ERROR, "Declaration of %s must be compatible with %s",
@@ -4081,6 +4082,7 @@ static void zend_add_trait_method(zend_class_entry *ce, const char *name, const
 			/* inherited members are overridden by members inserted by traits */
 			/* check whether the trait method fulfills the inheritance requirements */
 			do_inheritance_check_on_method(fn, existing_fn TSRMLS_CC);
+			fn->common.prototype = NULL;
 		}
 	}

@@ -4099,7 +4101,7 @@ static int zend_fixup_trait_method(zend_function *fn, zend_class_entry *ce TSRML
 		if (fn->common.fn_flags & ZEND_ACC_ABSTRACT) {
 			ce->ce_flags |= ZEND_ACC_IMPLICIT_ABSTRACT_CLASS;
 		}
-		if (fn->op_array.static_variables) {
+		if (fn->type == ZEND_USER_FUNCTION && fn->op_array.static_variables) {
 			ce->ce_flags |= ZEND_HAS_STATIC_IN_METHODS;
 		}
 	}
@@ -6825,7 +6827,14 @@ void zend_do_extended_fcall_end(TSRMLS_D) /* {{{ */

 void zend_do_ticks(TSRMLS_D) /* {{{ */
 {
-	zend_op *opline = get_next_op(CG(active_op_array) TSRMLS_CC);
+	zend_op *opline;
+
+	/* This prevents a double TICK generated by the parser statement of "declare()" */
+	if (CG(active_op_array)->last && CG(active_op_array)->opcodes[CG(active_op_array)->last - 1].opcode == ZEND_TICKS) {
+		return;
+	}
+
+	opline = get_next_op(CG(active_op_array) TSRMLS_CC);

 	opline->opcode = ZEND_TICKS;
 	SET_UNUSED(opline->op1);
@@ -7141,7 +7150,7 @@ void zend_do_begin_namespace(const znode *name, zend_bool with_bracket TSRMLS_DC
 }
 /* }}} */

-void zend_do_use(znode *ns_name, znode *new_name, int is_global TSRMLS_DC) /* {{{ */
+void zend_do_use(znode *ns_name, znode *new_name TSRMLS_DC) /* {{{ */
 {
 	char *lcname;
 	zval *name, *ns, tmp;
@@ -7168,7 +7177,7 @@ void zend_do_use(znode *ns_name, znode *new_name, int is_global TSRMLS_DC) /* {{
 			ZVAL_STRING(name, p+1, 1);
 		} else {
 			ZVAL_ZVAL(name, ns, 1, 0);
-			warn = !is_global && !CG(current_namespace);
+			warn = !CG(current_namespace);
 		}
 	}

@@ -7224,7 +7233,7 @@ void zend_do_use(znode *ns_name, znode *new_name, int is_global TSRMLS_DC) /* {{
 }
 /* }}} */

-void zend_do_use_non_class(znode *ns_name, znode *new_name, int is_global, int is_function, zend_bool case_sensitive, HashTable *current_import_sub, HashTable *lookup_table TSRMLS_DC) /* {{{ */
+void zend_do_use_non_class(znode *ns_name, znode *new_name, int is_function, zend_bool case_sensitive, HashTable *current_import_sub, HashTable *lookup_table TSRMLS_DC) /* {{{ */
 {
 	char *lookup_name;
 	zval *name, *ns, tmp;
@@ -7245,7 +7254,7 @@ void zend_do_use_non_class(znode *ns_name, znode *new_name, int is_global, int i
 			ZVAL_STRING(name, p+1, 1);
 		} else {
 			ZVAL_ZVAL(name, ns, 1, 0);
-			warn = !is_global && !CG(current_namespace);
+			warn = !CG(current_namespace);
 		}
 	}

@@ -7309,25 +7318,25 @@ void zend_do_use_non_class(znode *ns_name, znode *new_name, int is_global, int i
 }
 /* }}} */

-void zend_do_use_function(znode *ns_name, znode *new_name, int is_global TSRMLS_DC) /* {{{ */
+void zend_do_use_function(znode *ns_name, znode *new_name TSRMLS_DC) /* {{{ */
 {
 	if (!CG(current_import_function)) {
 		CG(current_import_function) = emalloc(sizeof(HashTable));
 		zend_hash_init(CG(current_import_function), 0, NULL, ZVAL_PTR_DTOR, 0);
 	}

-	zend_do_use_non_class(ns_name, new_name, is_global, 1, 0, CG(current_import_function), CG(function_table) TSRMLS_CC);
+	zend_do_use_non_class(ns_name, new_name, 1, 0, CG(current_import_function), CG(function_table) TSRMLS_CC);
 }
 /* }}} */

-void zend_do_use_const(znode *ns_name, znode *new_name, int is_global TSRMLS_DC) /* {{{ */
+void zend_do_use_const(znode *ns_name, znode *new_name TSRMLS_DC) /* {{{ */
 {
 	if (!CG(current_import_const)) {
 		CG(current_import_const) = emalloc(sizeof(HashTable));
 		zend_hash_init(CG(current_import_const), 0, NULL, ZVAL_PTR_DTOR, 0);
 	}

-	zend_do_use_non_class(ns_name, new_name, is_global, 0, 1, CG(current_import_const), &CG(const_filenames) TSRMLS_CC);
+	zend_do_use_non_class(ns_name, new_name, 0, 1, CG(current_import_const), &CG(const_filenames) TSRMLS_CC);
 }
 /* }}} */

@@ -651,10 +651,10 @@ void zend_do_build_namespace_name(znode *result, znode *prefix, znode *name TSRM
 void zend_do_begin_namespace(const znode *name, zend_bool with_brackets TSRMLS_DC);
 void zend_do_end_namespace(TSRMLS_D);
 void zend_verify_namespace(TSRMLS_D);
-void zend_do_use(znode *name, znode *new_name, int is_global TSRMLS_DC);
-void zend_do_use_non_class(znode *ns_name, znode *new_name, int is_global, int is_function, zend_bool case_sensitive, HashTable *current_import_sub, HashTable *lookup_table TSRMLS_DC);
-void zend_do_use_function(znode *name, znode *new_name, int is_global TSRMLS_DC);
-void zend_do_use_const(znode *name, znode *new_name, int is_global TSRMLS_DC);
+void zend_do_use(znode *name, znode *new_name TSRMLS_DC);
+void zend_do_use_non_class(znode *ns_name, znode *new_name, int is_function, zend_bool case_sensitive, HashTable *current_import_sub, HashTable *lookup_table TSRMLS_DC);
+void zend_do_use_function(znode *name, znode *new_name TSRMLS_DC);
+void zend_do_use_const(znode *name, znode *new_name TSRMLS_DC);
 void zend_do_end_compilation(TSRMLS_D);
 void zend_do_constant_expression(znode *result, zend_ast *ast TSRMLS_DC);

@@ -41,7 +41,7 @@ void zend_exception_set_previous(zval *exception, zval *add_previous TSRMLS_DC)
 	if (exception == add_previous || !add_previous || !exception) {
 		return;
 	}
-	if (Z_TYPE_P(add_previous) != IS_OBJECT && !instanceof_function(Z_OBJCE_P(add_previous), default_exception_ce TSRMLS_CC)) {
+	if (Z_TYPE_P(add_previous) != IS_OBJECT || !instanceof_function(Z_OBJCE_P(add_previous), default_exception_ce TSRMLS_CC)) {
 		zend_error(E_ERROR, "Cannot set non exception as previous exception");
 		return;
 	}
@@ -218,6 +218,33 @@ ZEND_METHOD(exception, __construct)
 }
 /* }}} */

+/* {{{ proto Exception::__wakeup()
+   Exception unserialize checks */
+#define CHECK_EXC_TYPE(name, type) \
+	value = zend_read_property(default_exception_ce, object, name, sizeof(name)-1, 0 TSRMLS_CC); \
+	if(value && Z_TYPE_P(value) != type) { \
+		zval *tmp; \
+		MAKE_STD_ZVAL(tmp); \
+		ZVAL_STRINGL(tmp, name, sizeof(name)-1, 1); \
+		Z_OBJ_HANDLER_P(object, unset_property)(object, tmp, 0 TSRMLS_CC); \
+		zval_ptr_dtor(&tmp); \
+	}
+
+ZEND_METHOD(exception, __wakeup)
+{
+	zval *value;
+	zval *object = getThis();
+	HashTable *intern_ht = zend_std_get_properties(getThis() TSRMLS_CC);
+	CHECK_EXC_TYPE("message", IS_STRING);
+	CHECK_EXC_TYPE("string", IS_STRING);
+	CHECK_EXC_TYPE("code", IS_LONG);
+	CHECK_EXC_TYPE("file", IS_STRING);
+	CHECK_EXC_TYPE("line", IS_LONG);
+	CHECK_EXC_TYPE("trace", IS_ARRAY);
+	CHECK_EXC_TYPE("previous", IS_OBJECT);
+}
+/* }}} */
+
 /* {{{ proto ErrorException::__construct(string message, int code, int severity [, string filename [, int lineno [, Exception previous]]])
   ErrorException constructor */
 ZEND_METHOD(error_exception, __construct)
@@ -586,11 +613,15 @@ ZEND_METHOD(exception, getTraceAsString)
 	int res_len = 0, *len = &res_len, num = 0;

 	DEFAULT_0_PARAMS;
-	
+
+	trace = zend_read_property(default_exception_ce, getThis(), "trace", sizeof("trace")-1, 1 TSRMLS_CC);
+	if (Z_TYPE_P(trace) != IS_ARRAY) {
+		RETURN_FALSE;
+	}
+
 	res = estrdup("");
 	str = &res;

-	trace = zend_read_property(default_exception_ce, getThis(), "trace", sizeof("trace")-1, 1 TSRMLS_CC);
 	zend_hash_apply_with_arguments(Z_ARRVAL_P(trace) TSRMLS_CC, (apply_func_args_t)_build_trace_string, 3, str, len, &num);

 	s_tmp = emalloc(1 + MAX_LENGTH_OF_LONG + 7 + 1);
@@ -598,8 +629,8 @@ ZEND_METHOD(exception, getTraceAsString)
 	TRACE_APPEND_STRL(s_tmp, strlen(s_tmp));
 	efree(s_tmp);

-	res[res_len] = '\0';	
-	RETURN_STRINGL(res, res_len, 0); 
+	res[res_len] = '\0';
+	RETURN_STRINGL(res, res_len, 0);
 }
 /* }}} */

@@ -636,15 +667,15 @@ ZEND_METHOD(exception, __toString)
 	int len = 0;
 	zend_fcall_info fci;
 	zval fname;
-	
+
 	DEFAULT_0_PARAMS;
-	
+
 	str = estrndup("", 0);

 	exception = getThis();
 	ZVAL_STRINGL(&fname, "gettraceasstring", sizeof("gettraceasstring")-1, 1);

-	while (exception && Z_TYPE_P(exception) == IS_OBJECT) {
+	while (exception && Z_TYPE_P(exception) == IS_OBJECT && instanceof_function(Z_OBJCE_P(exception), default_exception_ce TSRMLS_CC)) {
 		prev_str = str;
 		_default_exception_get_entry(exception, "message", sizeof("message")-1, &message TSRMLS_CC);
 		_default_exception_get_entry(exception, "file", sizeof("file")-1, &file TSRMLS_CC);
@@ -654,6 +685,7 @@ ZEND_METHOD(exception, __toString)
 		convert_to_string(&file);
 		convert_to_long(&line);

+		trace = NULL;
 		fci.size = sizeof(fci);
 		fci.function_table = &Z_OBJCE_P(exception)->function_table;
 		fci.function_name = &fname;
@@ -666,7 +698,7 @@ ZEND_METHOD(exception, __toString)

 		zend_call_function(&fci, NULL TSRMLS_CC);

-		if (Z_TYPE_P(trace) != IS_STRING) {
+		if (trace && Z_TYPE_P(trace) != IS_STRING) {
 			zval_ptr_dtor(&trace);
 			trace = NULL;
 		}
@@ -723,6 +755,7 @@ ZEND_END_ARG_INFO()
 const static zend_function_entry default_exception_functions[] = {
 	ZEND_ME(exception, __clone, NULL, ZEND_ACC_PRIVATE|ZEND_ACC_FINAL)
 	ZEND_ME(exception, __construct, arginfo_exception___construct, ZEND_ACC_PUBLIC)
+	ZEND_ME(exception, __wakeup, NULL, ZEND_ACC_PUBLIC)
 	ZEND_ME(exception, getMessage, NULL, ZEND_ACC_PUBLIC|ZEND_ACC_FINAL)
 	ZEND_ME(exception, getCode, NULL, ZEND_ACC_PUBLIC|ZEND_ACC_FINAL)
 	ZEND_ME(exception, getFile, NULL, ZEND_ACC_PUBLIC|ZEND_ACC_FINAL)
@@ -1585,6 +1585,10 @@ ZEND_API void zend_rebuild_symbol_table(TSRMLS_D) /* {{{ */
 			ex->symbol_table = EG(active_symbol_table);
 			for (i = 0; i < ex->op_array->last_var; i++) {
 				if (*EX_CV_NUM(ex, i)) {
+					if (UNEXPECTED(**EX_CV_NUM(ex, i) == &EG(uninitialized_zval))) {
+						Z_DELREF(EG(uninitialized_zval));
+						ALLOC_INIT_ZVAL(**EX_CV_NUM(ex, i));
+					}
 					zend_hash_quick_update(EG(active_symbol_table),
 						ex->op_array->vars[i].name,
 						ex->op_array->vars[i].name_len + 1,
@@ -147,8 +147,6 @@ ZEND_API void gc_zval_possible_root(zval *zv TSRMLS_DC)
 	GC_BENCH_INC(zval_possible_root);

 	if (GC_ZVAL_GET_COLOR(zv) != GC_PURPLE) {
-		GC_ZVAL_SET_PURPLE(zv);
-
 		if (!GC_ZVAL_ADDRESS(zv)) {
 			gc_root_buffer *newRoot = GC_G(unused);

@@ -159,7 +157,6 @@ ZEND_API void gc_zval_possible_root(zval *zv TSRMLS_DC)
 				GC_G(first_unused)++;
 			} else {
 				if (!GC_G(gc_enabled)) {
-					GC_ZVAL_SET_BLACK(zv);
 					return;
 				}
 				zv->refcount__gc++;
@@ -169,10 +166,10 @@ ZEND_API void gc_zval_possible_root(zval *zv TSRMLS_DC)
 				if (!newRoot) {
 					return;
 				}
-				GC_ZVAL_SET_PURPLE(zv);
 				GC_G(unused) = newRoot->prev;
 			}

+			GC_ZVAL_SET_PURPLE(zv);
 			newRoot->next = GC_G(roots).next;
 			newRoot->prev = &GC_G(roots);
 			GC_G(roots).next->prev = newRoot;
@@ -203,7 +200,6 @@ ZEND_API void gc_zobj_possible_root(zval *zv TSRMLS_DC)

 	obj = &EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(zv)].bucket.obj;
 	if (GC_GET_COLOR(obj->buffered) != GC_PURPLE) {
-		GC_SET_PURPLE(obj->buffered);
 		if (!GC_ADDRESS(obj->buffered)) {
 			gc_root_buffer *newRoot = GC_G(unused);

@@ -214,7 +210,6 @@ ZEND_API void gc_zobj_possible_root(zval *zv TSRMLS_DC)
 				GC_G(first_unused)++;
 			} else {
 				if (!GC_G(gc_enabled)) {
-					GC_ZVAL_SET_BLACK(zv);
 					return;
 				}
 				zv->refcount__gc++;
@@ -225,10 +220,10 @@ ZEND_API void gc_zobj_possible_root(zval *zv TSRMLS_DC)
 					return;
 				}
 				obj = &EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(zv)].bucket.obj;
-				GC_SET_PURPLE(obj->buffered);
 				GC_G(unused) = newRoot->prev;
 			}

+			GC_SET_PURPLE(obj->buffered);
 			newRoot->next = GC_G(roots).next;
 			newRoot->prev = &GC_G(roots);
 			GC_G(roots).next->prev = newRoot;
@@ -198,6 +198,9 @@ static void zend_generator_dtor_storage(zend_generator *generator, zend_object_h
 	if (finally_op_num) {
 		ex->opline = &ex->op_array->opcodes[finally_op_num];
 		ex->fast_ret = NULL;
+		ex->delayed_exception = EG(exception);
+		EG(exception) = NULL;
+
 		generator->flags |= ZEND_GENERATOR_FORCED_CLOSE;
 		zend_generator_resume(generator TSRMLS_CC);
 	}
@@ -1446,11 +1446,10 @@ ZEND_API int zend_hash_compare(HashTable *ht1, HashTable *ht2, compare_func_t co
 		}
 		if (ordered) {
 			if (p1->nKeyLength==0 && p2->nKeyLength==0) { /* numeric indices */
-				result = p1->h - p2->h;
-				if (result!=0) {
+				if (p1->h != p2->h) {
 					HASH_UNPROTECT_RECURSION(ht1); 
 					HASH_UNPROTECT_RECURSION(ht2); 
-					return result;
+					return p1->h > p2->h ? 1 : -1;
 				}
 			} else { /* string indices */
 				result = p1->nKeyLength - p2->nKeyLength;
@@ -108,7 +108,18 @@ static void zend_ini_init_string(zval *result)
 */
 static void zend_ini_add_string(zval *result, zval *op1, zval *op2)
 {
-	int length = Z_STRLEN_P(op1) + Z_STRLEN_P(op2);
+	int length;
+
+	if (Z_TYPE_P(op1) != IS_STRING) {
+		zval copy;
+		MAKE_COPY_ZVAL(&op1, &copy);
+		convert_to_string(&copy);
+		Z_STRVAL_P(op1) = zend_strndup(Z_STRVAL(copy), Z_STRLEN(copy));
+		Z_STRLEN_P(op1) = Z_STRLEN(copy);
+		zval_dtor(&copy);
+	}
+
+	length = Z_STRLEN_P(op1) + Z_STRLEN_P(op2);

 	Z_STRVAL_P(result) = (char *) realloc(Z_STRVAL_P(op1), length+1);
 	memcpy(Z_STRVAL_P(result)+Z_STRLEN_P(op1), Z_STRVAL_P(op2), Z_STRLEN_P(op2));
@@ -213,7 +224,7 @@ ZEND_API int zend_parse_ini_file(zend_file_handle *fh, zend_bool unbuffered_erro
 	zend_file_handle_dtor(fh TSRMLS_CC);

 	shutdown_ini_scanner(TSRMLS_C);
-	
+
 	if (retval == 0) {
 		return SUCCESS;
 	} else {
@@ -303,7 +314,11 @@ statement:
 #endif
 			ZEND_INI_PARSER_CB(&$1, &$5, &$2, ZEND_INI_PARSER_POP_ENTRY, ZEND_INI_PARSER_ARG TSRMLS_CC);
 			free(Z_STRVAL($1));
-			free(Z_STRVAL($2));
+			if (Z_TYPE($2) == IS_STRING) {
+				free(Z_STRVAL($2));
+			} else {
+				zval_dtor(&$2);
+			}
 			zval_internal_dtor(&$5);
 		}
 	|	TC_LABEL	{ ZEND_INI_PARSER_CB(&$1, NULL, NULL, ZEND_INI_PARSER_ENTRY, ZEND_INI_PARSER_ARG TSRMLS_CC); free(Z_STRVAL($1)); }
@@ -2029,7 +2029,7 @@ end_raw_value_chars:
 	}

 	/* Eat leading and trailing double quotes */
-	if (yytext[0] == '"' && yytext[yyleng - 1] == '"') {
+	if (yyleng > 1 && yytext[0] == '"' && yytext[yyleng - 1] == '"') {
 		SCNG(yy_text)++;
 		yyleng = yyleng - 2;
 	} else if (sc) {
@@ -523,7 +523,7 @@ end_raw_value_chars:
 	}

 	/* Eat leading and trailing double quotes */
-	if (yytext[0] == '"' && yytext[yyleng - 1] == '"') {
+	if (yyleng > 1 && yytext[0] == '"' && yytext[yyleng - 1] == '"') {
 		SCNG(yy_text)++;
 		yyleng = yyleng - 2;
 	} else if (sc) {
@@ -255,10 +255,10 @@ use_declarations:
 ;

 use_declaration:
-		namespace_name 			{ zend_do_use(&$1, NULL, 0 TSRMLS_CC); }
-	|	namespace_name T_AS T_STRING	{ zend_do_use(&$1, &$3, 0 TSRMLS_CC); }
-	|	T_NS_SEPARATOR namespace_name { zend_do_use(&$2, NULL, 1 TSRMLS_CC); }
-	|	T_NS_SEPARATOR namespace_name T_AS T_STRING { zend_do_use(&$2, &$4, 1 TSRMLS_CC); }
+		namespace_name 			{ zend_do_use(&$1, NULL TSRMLS_CC); }
+	|	namespace_name T_AS T_STRING	{ zend_do_use(&$1, &$3 TSRMLS_CC); }
+	|	T_NS_SEPARATOR namespace_name { zend_do_use(&$2, NULL TSRMLS_CC); }
+	|	T_NS_SEPARATOR namespace_name T_AS T_STRING { zend_do_use(&$2, &$4 TSRMLS_CC); }
 ;

 use_function_declarations:
@@ -267,10 +267,10 @@ use_function_declarations:
 ;

 use_function_declaration:
-		namespace_name 			{ zend_do_use_function(&$1, NULL, 0 TSRMLS_CC); }
-	|	namespace_name T_AS T_STRING	{ zend_do_use_function(&$1, &$3, 0 TSRMLS_CC); }
-	|	T_NS_SEPARATOR namespace_name { zend_do_use_function(&$2, NULL, 1 TSRMLS_CC); }
-	|	T_NS_SEPARATOR namespace_name T_AS T_STRING { zend_do_use_function(&$2, &$4, 1 TSRMLS_CC); }
+		namespace_name 			{ zend_do_use_function(&$1, NULL TSRMLS_CC); }
+	|	namespace_name T_AS T_STRING	{ zend_do_use_function(&$1, &$3 TSRMLS_CC); }
+	|	T_NS_SEPARATOR namespace_name { zend_do_use_function(&$2, NULL TSRMLS_CC); }
+	|	T_NS_SEPARATOR namespace_name T_AS T_STRING { zend_do_use_function(&$2, &$4 TSRMLS_CC); }
 ;

 use_const_declarations:
@@ -279,10 +279,10 @@ use_const_declarations:
 ;

 use_const_declaration:
-		namespace_name 			{ zend_do_use_const(&$1, NULL, 0 TSRMLS_CC); }
-	|	namespace_name T_AS T_STRING	{ zend_do_use_const(&$1, &$3, 0 TSRMLS_CC); }
-	|	T_NS_SEPARATOR namespace_name { zend_do_use_const(&$2, NULL, 1 TSRMLS_CC); }
-	|	T_NS_SEPARATOR namespace_name T_AS T_STRING { zend_do_use_const(&$2, &$4, 1 TSRMLS_CC); }
+		namespace_name 			{ zend_do_use_const(&$1, NULL TSRMLS_CC); }
+	|	namespace_name T_AS T_STRING	{ zend_do_use_const(&$1, &$3 TSRMLS_CC); }
+	|	T_NS_SEPARATOR namespace_name { zend_do_use_const(&$2, NULL TSRMLS_CC); }
+	|	T_NS_SEPARATOR namespace_name T_AS T_STRING { zend_do_use_const(&$2, &$4 TSRMLS_CC); }
 ;

 constant_declaration:
@@ -162,16 +162,16 @@ static inline void cleanup_user_class_data(zend_class_entry *ce TSRMLS_DC)
 		zend_hash_apply(&ce->function_table, (apply_func_t) zend_cleanup_function_data_full TSRMLS_CC);
 	}
 	if (ce->static_members_table) {
+		zval **static_members = ce->static_members_table;
+		int count = ce->default_static_members_count;
 		int i;

-		for (i = 0; i < ce->default_static_members_count; i++) {
-			if (ce->static_members_table[i]) {
-				zval *p = ce->static_members_table[i];
-				ce->static_members_table[i] = NULL;
-				zval_ptr_dtor(&p);
-			}
+		ce->default_static_members_count = 0;
+		ce->default_static_members_table = ce->static_members_table = NULL;
+		for (i = 0; i < count; i++) {
+			zval_ptr_dtor(&static_members[i]);
 		}
-		ce->static_members_table = NULL;
+		efree(static_members);
 	}
 }

@@ -1456,14 +1456,19 @@ ZEND_API int concat_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{
 			zend_error(E_ERROR, "String size overflow");
 		}

-		Z_STRVAL_P(result) = erealloc(Z_STRVAL_P(result), res_len+1);
+		Z_STRVAL_P(result) = safe_erealloc(Z_STRVAL_P(result), res_len, 1, 1);

 		memcpy(Z_STRVAL_P(result)+Z_STRLEN_P(result), Z_STRVAL_P(op2), Z_STRLEN_P(op2));
 		Z_STRVAL_P(result)[res_len]=0;
 		Z_STRLEN_P(result) = res_len;
 	} else {
 		int length = Z_STRLEN_P(op1) + Z_STRLEN_P(op2);
-		char *buf = (char *) emalloc(length + 1);
+		char *buf;
+
+		if (Z_STRLEN_P(op1) < 0 || Z_STRLEN_P(op2) < 0 || (int) (Z_STRLEN_P(op1) + Z_STRLEN_P(op2)) < 0) {
+			zend_error(E_ERROR, "String size overflow");
+		}
+		buf = (char *) safe_emalloc(length, 1, 1);

 		memcpy(buf, Z_STRVAL_P(op1), Z_STRLEN_P(op1));
 		memcpy(buf + Z_STRLEN_P(op1), Z_STRVAL_P(op2), Z_STRLEN_P(op2));
@@ -261,7 +261,7 @@ CWD_API int php_sys_readlink(const char *link, char *target, size_t target_len){
 	}

 	dwRet = pGetFinalPathNameByHandle(hFile, target, MAXPATHLEN, VOLUME_NAME_DOS);
-	if(dwRet >= MAXPATHLEN) {
+	if(dwRet >= MAXPATHLEN || dwRet == 0) {
 		return -1;
 	}

@@ -1753,7 +1753,9 @@ ZEND_VM_HANDLER(38, ZEND_ASSIGN, VAR|CV, CONST|TMP|VAR|CV)
 		}
 	}

-	FREE_OP1_VAR_PTR();
+	if (OP1_TYPE == IS_VAR && OP1_FREE) {
+		zval_ptr_dtor_nogc(&value);
+	}

 	/* zend_assign_to_variable() always takes care of op2, never free it! */
 	FREE_OP2_IF_VAR();
@@ -1772,6 +1774,10 @@ ZEND_VM_HANDLER(39, ZEND_ASSIGN_REF, VAR|CV, VAR|CV)
 	SAVE_OPLINE();
 	value_ptr_ptr = GET_OP2_ZVAL_PTR_PTR(BP_VAR_W);

+	if (OP1_TYPE == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {
+		zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
+	}
+
 	if (OP2_TYPE == IS_VAR &&
 	    value_ptr_ptr &&
 	    !Z_ISREF_PP(value_ptr_ptr) &&
@@ -1789,9 +1795,6 @@ ZEND_VM_HANDLER(39, ZEND_ASSIGN_REF, VAR|CV, VAR|CV)
 	} else if (OP2_TYPE == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
 		PZVAL_LOCK(*value_ptr_ptr);
 	}
-	if (OP1_TYPE == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {
-		zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
-	}

 	variable_ptr_ptr = GET_OP1_ZVAL_PTR_PTR(BP_VAR_W);
 	if ((OP2_TYPE == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||
@@ -1887,7 +1890,7 @@ ZEND_VM_HELPER(zend_leave_helper, ANY, ANY)

 			EX(call)--;

-			zend_vm_stack_clear_multiple(1 TSRMLS_CC);
+			zend_vm_stack_clear_multiple(0 TSRMLS_CC);

 			if (UNEXPECTED(EG(exception) != NULL)) {
 				zend_throw_exception_internal(NULL TSRMLS_CC);
@@ -1995,13 +1998,12 @@ ZEND_VM_HELPER(zend_do_fcall_common_helper, ANY, ANY)
 			EX_T(opline->result.var).var.ptr = NULL;
 		}
 	} else if (fbc->type == ZEND_USER_FUNCTION) {
+		temp_variable *ret = &EX_T(opline->result.var);
 		EX(original_return_value) = EG(return_value_ptr_ptr);
 		EG(active_symbol_table) = NULL;
 		EG(active_op_array) = &fbc->op_array;
 		EG(return_value_ptr_ptr) = NULL;
 		if (RETURN_VALUE_USED(opline)) {
-			temp_variable *ret = &EX_T(opline->result.var);
-
 			ret->var.ptr = NULL;
 			EG(return_value_ptr_ptr) = &ret->var.ptr;
 			ret->var.ptr_ptr = &ret->var.ptr;
@@ -2010,7 +2012,8 @@ ZEND_VM_HELPER(zend_do_fcall_common_helper, ANY, ANY)

 		if (UNEXPECTED((EG(active_op_array)->fn_flags & ZEND_ACC_GENERATOR) != 0)) {
 			if (RETURN_VALUE_USED(opline)) {
-				EX_T(opline->result.var).var.ptr = zend_generator_create_zval(EG(active_op_array) TSRMLS_CC);
+				ret->var.ptr = zend_generator_create_zval(EG(active_op_array) TSRMLS_CC);
+				ret->var.fcall_returned_reference = 0;
 			}
 		} else if (EXPECTED(zend_execute_ex == execute_ex)) {
 			if (EXPECTED(EG(exception) == NULL)) {
@@ -2075,7 +2078,7 @@ ZEND_VM_HELPER(zend_do_fcall_common_helper, ANY, ANY)

 	EX(call)--;

-	zend_vm_stack_clear_multiple(1 TSRMLS_CC);
+	zend_vm_stack_clear_multiple(0 TSRMLS_CC);

 	if (UNEXPECTED(EG(exception) != NULL)) {
 		zend_throw_exception_internal(NULL TSRMLS_CC);
@@ -5425,7 +5428,6 @@ ZEND_VM_HANDLER(153, ZEND_DECLARE_LAMBDA_FUNCTION, CONST, UNUSED)
 {
 	USE_OPLINE
 	zend_function *op_array;
-	int closure_is_static, closure_is_being_defined_inside_static_context;

 	SAVE_OPLINE();

@@ -5434,9 +5436,9 @@ ZEND_VM_HANDLER(153, ZEND_DECLARE_LAMBDA_FUNCTION, CONST, UNUSED)
 		zend_error_noreturn(E_ERROR, "Base lambda function for closure not found");
 	}

-	closure_is_static = op_array->common.fn_flags & ZEND_ACC_STATIC;
-	closure_is_being_defined_inside_static_context = EX(prev_execute_data) && EX(prev_execute_data)->function_state.function->common.fn_flags & ZEND_ACC_STATIC;
-	if (closure_is_static || closure_is_being_defined_inside_static_context) {
+	if (UNEXPECTED((op_array->common.fn_flags & ZEND_ACC_STATIC) || 
+			(EX(prev_execute_data) &&
+			 EX(prev_execute_data)->function_state.function->common.fn_flags & ZEND_ACC_STATIC))) {
 		zend_create_closure(&EX_T(opline->result.var).tmp_var, (zend_function *) op_array,  EG(called_scope), NULL TSRMLS_CC);
 	} else {
 		zend_create_closure(&EX_T(opline->result.var).tmp_var, (zend_function *) op_array,  EG(scope), EG(This) TSRMLS_CC);
@@ -5649,8 +5651,11 @@ ZEND_VM_HANDLER(162, ZEND_FAST_CALL, ANY, ANY)
 		ZEND_VM_SET_OPCODE(&EX(op_array)->opcodes[opline->op2.opline_num]);
 		ZEND_VM_CONTINUE();
 	}
-	EX(fast_ret) = opline;
-	EX(delayed_exception) = NULL;
+	if (UNEXPECTED(EX(delayed_exception) != NULL)) {
+		EX(fast_ret) = NULL;
+	} else {
+		EX(fast_ret) = opline;
+	}	
 	ZEND_VM_SET_OPCODE(opline->op1.jmp_addr);
 	ZEND_VM_CONTINUE();
 }
@@ -459,7 +459,7 @@ static int ZEND_FASTCALL zend_leave_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS)

 			EX(call)--;

-			zend_vm_stack_clear_multiple(1 TSRMLS_CC);
+			zend_vm_stack_clear_multiple(0 TSRMLS_CC);

 			if (UNEXPECTED(EG(exception) != NULL)) {
 				zend_throw_exception_internal(NULL TSRMLS_CC);
@@ -567,13 +567,12 @@ static int ZEND_FASTCALL zend_do_fcall_common_helper_SPEC(ZEND_OPCODE_HANDLER_AR
 			EX_T(opline->result.var).var.ptr = NULL;
 		}
 	} else if (fbc->type == ZEND_USER_FUNCTION) {
+		temp_variable *ret = &EX_T(opline->result.var);
 		EX(original_return_value) = EG(return_value_ptr_ptr);
 		EG(active_symbol_table) = NULL;
 		EG(active_op_array) = &fbc->op_array;
 		EG(return_value_ptr_ptr) = NULL;
 		if (RETURN_VALUE_USED(opline)) {
-			temp_variable *ret = &EX_T(opline->result.var);
-
 			ret->var.ptr = NULL;
 			EG(return_value_ptr_ptr) = &ret->var.ptr;
 			ret->var.ptr_ptr = &ret->var.ptr;
@@ -582,7 +581,8 @@ static int ZEND_FASTCALL zend_do_fcall_common_helper_SPEC(ZEND_OPCODE_HANDLER_AR

 		if (UNEXPECTED((EG(active_op_array)->fn_flags & ZEND_ACC_GENERATOR) != 0)) {
 			if (RETURN_VALUE_USED(opline)) {
-				EX_T(opline->result.var).var.ptr = zend_generator_create_zval(EG(active_op_array) TSRMLS_CC);
+				ret->var.ptr = zend_generator_create_zval(EG(active_op_array) TSRMLS_CC);
+				ret->var.fcall_returned_reference = 0;
 			}
 		} else if (EXPECTED(zend_execute_ex == execute_ex)) {
 			if (EXPECTED(EG(exception) == NULL)) {
@@ -647,7 +647,7 @@ static int ZEND_FASTCALL zend_do_fcall_common_helper_SPEC(ZEND_OPCODE_HANDLER_AR

 	EX(call)--;

-	zend_vm_stack_clear_multiple(1 TSRMLS_CC);
+	zend_vm_stack_clear_multiple(0 TSRMLS_CC);

 	if (UNEXPECTED(EG(exception) != NULL)) {
 		zend_throw_exception_internal(NULL TSRMLS_CC);
@@ -1354,8 +1354,11 @@ static int ZEND_FASTCALL  ZEND_FAST_CALL_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 		ZEND_VM_SET_OPCODE(&EX(op_array)->opcodes[opline->op2.opline_num]);
 		ZEND_VM_CONTINUE();
 	}
-	EX(fast_ret) = opline;
-	EX(delayed_exception) = NULL;
+	if (UNEXPECTED(EX(delayed_exception) != NULL)) {
+		EX(fast_ret) = NULL;
+	} else {
+		EX(fast_ret) = opline;
+	}
 	ZEND_VM_SET_OPCODE(opline->op1.jmp_addr);
 	ZEND_VM_CONTINUE();
 }
@@ -6801,7 +6804,6 @@ static int ZEND_FASTCALL  ZEND_DECLARE_LAMBDA_FUNCTION_SPEC_CONST_UNUSED_HANDLER
 {
 	USE_OPLINE
 	zend_function *op_array;
-	int closure_is_static, closure_is_being_defined_inside_static_context;

 	SAVE_OPLINE();

@@ -6810,9 +6812,9 @@ static int ZEND_FASTCALL  ZEND_DECLARE_LAMBDA_FUNCTION_SPEC_CONST_UNUSED_HANDLER
 		zend_error_noreturn(E_ERROR, "Base lambda function for closure not found");
 	}

-	closure_is_static = op_array->common.fn_flags & ZEND_ACC_STATIC;
-	closure_is_being_defined_inside_static_context = EX(prev_execute_data) && EX(prev_execute_data)->function_state.function->common.fn_flags & ZEND_ACC_STATIC;
-	if (closure_is_static || closure_is_being_defined_inside_static_context) {
+	if (UNEXPECTED((op_array->common.fn_flags & ZEND_ACC_STATIC) ||
+			(EX(prev_execute_data) &&
+			 EX(prev_execute_data)->function_state.function->common.fn_flags & ZEND_ACC_STATIC))) {
 		zend_create_closure(&EX_T(opline->result.var).tmp_var, (zend_function *) op_array,  EG(called_scope), NULL TSRMLS_CC);
 	} else {
 		zend_create_closure(&EX_T(opline->result.var).tmp_var, (zend_function *) op_array,  EG(scope), EG(This) TSRMLS_CC);
@@ -15693,7 +15695,9 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER
 		}
 	}

-	if (free_op1.var) {zval_ptr_dtor_nogc(&free_op1.var);};
+	if (IS_VAR == IS_VAR && (free_op1.var != NULL)) {
+		zval_ptr_dtor_nogc(&value);
+	}

 	/* zend_assign_to_variable() always takes care of op2, never free it! */

@@ -18044,7 +18048,9 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_SPEC_VAR_TMP_HANDLER(ZEND_OPCODE_HANDLER_A
 		}
 	}

-	if (free_op1.var) {zval_ptr_dtor_nogc(&free_op1.var);};
+	if (IS_VAR == IS_VAR && (free_op1.var != NULL)) {
+		zval_ptr_dtor_nogc(&value);
+	}

 	/* zend_assign_to_variable() always takes care of op2, never free it! */

@@ -20304,7 +20310,9 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDLER_A
 		}
 	}

-	if (free_op1.var) {zval_ptr_dtor_nogc(&free_op1.var);};
+	if (IS_VAR == IS_VAR && (free_op1.var != NULL)) {
+		zval_ptr_dtor_nogc(&value);
+	}

 	/* zend_assign_to_variable() always takes care of op2, never free it! */
 	zval_ptr_dtor_nogc(&free_op2.var);
@@ -20323,6 +20331,10 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDL
 	SAVE_OPLINE();
 	value_ptr_ptr = _get_zval_ptr_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);

+	if (IS_VAR == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {
+		zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
+	}
+
 	if (IS_VAR == IS_VAR &&
 	    value_ptr_ptr &&
 	    !Z_ISREF_PP(value_ptr_ptr) &&
@@ -20340,9 +20352,6 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDL
 	} else if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
 		PZVAL_LOCK(*value_ptr_ptr);
 	}
-	if (IS_VAR == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {
-		zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
-	}

 	variable_ptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
 	if ((IS_VAR == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||
@@ -23773,7 +23782,9 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_AR
 		}
 	}

-	if (free_op1.var) {zval_ptr_dtor_nogc(&free_op1.var);};
+	if (IS_VAR == IS_VAR && (free_op1.var != NULL)) {
+		zval_ptr_dtor_nogc(&value);
+	}

 	/* zend_assign_to_variable() always takes care of op2, never free it! */

@@ -23791,6 +23802,10 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLE
 	SAVE_OPLINE();
 	value_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op2.var TSRMLS_CC);

+	if (IS_VAR == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {
+		zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
+	}
+
 	if (IS_CV == IS_VAR &&
 	    value_ptr_ptr &&
 	    !Z_ISREF_PP(value_ptr_ptr) &&
@@ -23808,9 +23823,6 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLE
 	} else if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
 		PZVAL_LOCK(*value_ptr_ptr);
 	}
-	if (IS_VAR == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {
-		zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
-	}

 	variable_ptr_ptr = _get_zval_ptr_ptr_var(opline->op1.var, execute_data, &free_op1 TSRMLS_CC);
 	if ((IS_CV == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||
@@ -33212,6 +33224,10 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_
 		}
 	}

+	if (IS_CV == IS_VAR && 0) {
+		zval_ptr_dtor_nogc(&value);
+	}
+
 	/* zend_assign_to_variable() always takes care of op2, never free it! */

 	CHECK_EXCEPTION();
@@ -35332,6 +35348,10 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_SPEC_CV_TMP_HANDLER(ZEND_OPCODE_HANDLER_AR
 		}
 	}

+	if (IS_CV == IS_VAR && 0) {
+		zval_ptr_dtor_nogc(&value);
+	}
+
 	/* zend_assign_to_variable() always takes care of op2, never free it! */

 	CHECK_EXCEPTION();
@@ -37453,6 +37473,10 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLER_AR
 		}
 	}

+	if (IS_CV == IS_VAR && 0) {
+		zval_ptr_dtor_nogc(&value);
+	}
+
 	/* zend_assign_to_variable() always takes care of op2, never free it! */
 	zval_ptr_dtor_nogc(&free_op2.var);

@@ -37470,6 +37494,10 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLE
 	SAVE_OPLINE();
 	value_ptr_ptr = _get_zval_ptr_ptr_var(opline->op2.var, execute_data, &free_op2 TSRMLS_CC);

+	if (IS_CV == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {
+		zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
+	}
+
 	if (IS_VAR == IS_VAR &&
 	    value_ptr_ptr &&
 	    !Z_ISREF_PP(value_ptr_ptr) &&
@@ -37487,9 +37515,6 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLE
 	} else if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
 		PZVAL_LOCK(*value_ptr_ptr);
 	}
-	if (IS_CV == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {
-		zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
-	}

 	variable_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
 	if ((IS_VAR == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||
@@ -40633,6 +40658,10 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARG
 		}
 	}

+	if (IS_CV == IS_VAR && 0) {
+		zval_ptr_dtor_nogc(&value);
+	}
+
 	/* zend_assign_to_variable() always takes care of op2, never free it! */

 	CHECK_EXCEPTION();
@@ -40649,6 +40678,10 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER
 	SAVE_OPLINE();
 	value_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op2.var TSRMLS_CC);

+	if (IS_CV == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {
+		zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
+	}
+
 	if (IS_CV == IS_VAR &&
 	    value_ptr_ptr &&
 	    !Z_ISREF_PP(value_ptr_ptr) &&
@@ -40666,9 +40699,6 @@ static int ZEND_FASTCALL  ZEND_ASSIGN_REF_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER
 	} else if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
 		PZVAL_LOCK(*value_ptr_ptr);
 	}
-	if (IS_CV == IS_VAR && UNEXPECTED(EX_T(opline->op1.var).var.ptr_ptr == &EX_T(opline->op1.var).var.ptr)) {
-		zend_error_noreturn(E_ERROR, "Cannot assign by reference to overloaded object");
-	}

 	variable_ptr_ptr = _get_zval_ptr_ptr_cv_BP_VAR_W(execute_data, opline->op1.var TSRMLS_CC);
 	if ((IS_CV == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||
@@ -1545,7 +1545,7 @@ freebsd* | dragonfly*)
    objformat=`/usr/bin/objformat`
  else
    case $host_os in
-    freebsd[[123]]*) objformat=aout ;;
+    freebsd[[123]].*) objformat=aout ;;
    *) objformat=elf ;;
    esac
  fi
@@ -3162,7 +3162,7 @@ case $host_os in
 	;;
    esac
    ;;
-  freebsd[[12]]*)
+  freebsd[[12]].*)
    # C++ shared libraries reported to be fairly broken before switch to ELF
    _LT_AC_TAGVAR(ld_shlibs, $1)=no
    ;;
@@ -119,8 +119,8 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=5
 PHP_MINOR_VERSION=6
-PHP_RELEASE_VERSION=9
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=14
+PHP_EXTRA_VERSION="RC1"
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -1346,6 +1346,7 @@ static size_t curl_write(char *data, size_t size, size_t nmemb, void *ctx)
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not call the CURLOPT_WRITEFUNCTION");
 				length = -1;
 			} else if (retval_ptr) {
+				_php_curl_verify_handlers(ch, 1 TSRMLS_CC);
 				if (Z_TYPE_P(retval_ptr) != IS_LONG) {
 					convert_to_long_ex(&retval_ptr);
 				}
@@ -1411,6 +1412,7 @@ static int curl_fnmatch(void *ctx, const char *pattern, const char *string)
 			if (error == FAILURE) {
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot call the CURLOPT_FNMATCH_FUNCTION");
 			} else if (retval_ptr) {
+				_php_curl_verify_handlers(ch, 1 TSRMLS_CC);
 				if (Z_TYPE_P(retval_ptr) != IS_LONG) {
 					convert_to_long_ex(&retval_ptr);
 				}
@@ -1489,6 +1491,7 @@ static size_t curl_progress(void *clientp, double dltotal, double dlnow, double
 			if (error == FAILURE) {
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot call the CURLOPT_PROGRESSFUNCTION");
 			} else if (retval_ptr) {
+				_php_curl_verify_handlers(ch, 1 TSRMLS_CC);
 				if (Z_TYPE_P(retval_ptr) != IS_LONG) {
 					convert_to_long_ex(&retval_ptr);
 				}
@@ -1566,6 +1569,7 @@ static size_t curl_read(char *data, size_t size, size_t nmemb, void *ctx)
 				length = CURL_READFUNC_ABORT;
 #endif
 			} else if (retval_ptr) {
+				_php_curl_verify_handlers(ch, 1 TSRMLS_CC);
 				if (Z_TYPE_P(retval_ptr) == IS_STRING) {
 					length = MIN((int) (size * nmemb), Z_STRLEN_P(retval_ptr));
 					memcpy(data, Z_STRVAL_P(retval_ptr), length);
@@ -1640,6 +1644,7 @@ static size_t curl_write_header(char *data, size_t size, size_t nmemb, void *ctx
 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not call the CURLOPT_HEADERFUNCTION");
 				length = -1;
 			} else if (retval_ptr) {
+				_php_curl_verify_handlers(ch, 1 TSRMLS_CC);
 				if (Z_TYPE_P(retval_ptr) != IS_LONG) {
 					convert_to_long_ex(&retval_ptr);
 				}
@@ -0,0 +1,45 @@
+--TEST--
+Bug #69316: Use-after-free in php_curl related to CURLOPT_FILE/_INFILE/_WRITEHEADER
+--SKIPIF--
+<?php include 'skipif.inc'; ?>
+--FILE--
+<?php
+  function hdr_callback($ch, $data) {
+      // close the stream, causing the FILE structure to be free()'d
+      if($GLOBALS['f_file']) {
+          fclose($GLOBALS['f_file']); $GLOBALS['f_file'] = 0;
+
+          // cause an allocation of approx the same size as a FILE structure, size varies a bit depending on platform/libc
+          $FILE_size = (PHP_INT_SIZE == 4 ? 0x160 : 0x238);
+          curl_setopt($ch, CURLOPT_COOKIE, str_repeat("a", $FILE_size - 1));
+      }
+      return strlen($data);
+  }
+
+  include 'server.inc';
+  $host = curl_cli_server_start();
+  $temp_file = dirname(__FILE__) . '/body.tmp';
+  $url = "{$host}/get.php?test=getpost";
+  $ch = curl_init();
+  $f_file = fopen($temp_file, "w") or die("failed to open file\n");
+  curl_setopt($ch, CURLOPT_BUFFERSIZE, 10);
+  curl_setopt($ch, CURLOPT_HEADERFUNCTION, "hdr_callback");
+  curl_setopt($ch, CURLOPT_FILE, $f_file);
+  curl_setopt($ch, CURLOPT_URL, $url);
+  curl_exec($ch);
+  curl_close($ch);
+?>
+===DONE===
+--CLEAN--
+<?php
+unlink(dirname(__FILE__) . '/body.tmp');
+?>
+--EXPECTF--
+Warning: curl_exec(): CURLOPT_FILE resource has gone away, resetting to default in %s on line %d
+array(1) {
+  ["test"]=>
+  string(7) "getpost"
+}
+array(0) {
+}
+===DONE===
@@ -115,7 +115,7 @@ static double astro_GMST0(double d)
 	/* time, imposing no runtime or code overhead.               */
 	sidtim0 = astro_revolution((180.0 + 356.0470 + 282.9404) + (0.9856002585 + 4.70935E-5) * d);
 	return sidtim0;
-} 
+}

 /* This function computes the Sun's position at any instant */

@@ -177,32 +177,32 @@ static void astro_sun_RA_dec(double d, double *RA, double *dec, double *r)

 /**
 * Note: timestamp = unixtimestamp (NEEDS to be 00:00:00 UT)
- *       Eastern longitude positive, Western longitude negative       
- *       Northern latitude positive, Southern latitude negative       
- *       The longitude value IS critical in this function!            
- *       altit = the altitude which the Sun should cross              
- *               Set to -35/60 degrees for rise/set, -6 degrees       
- *               for civil, -12 degrees for nautical and -18          
- *               degrees for astronomical twilight.                   
- *         upper_limb: non-zero -> upper limb, zero -> center         
- *               Set to non-zero (e.g. 1) when computing rise/set     
- *               times, and to zero when computing start/end of       
- *               twilight.                                            
- *        *rise = where to store the rise time                        
- *        *set  = where to store the set  time                        
- *                Both times are relative to the specified altitude,  
- *                and thus this function can be used to compute       
- *                various twilight times, as well as rise/set times   
- * Return value:  0 = sun rises/sets this day, times stored at        
- *                    *trise and *tset.                               
- *               +1 = sun above the specified "horizon" 24 hours.     
- *                    *trise set to time when the sun is at south,    
- *                    minus 12 hours while *tset is set to the south  
- *                    time plus 12 hours. "Day" length = 24 hours     
- *               -1 = sun is below the specified "horizon" 24 hours   
- *                    "Day" length = 0 hours, *trise and *tset are    
- *                    both set to the time when the sun is at south.  
- *                                                                    
+ *       Eastern longitude positive, Western longitude negative
+ *       Northern latitude positive, Southern latitude negative
+ *       The longitude value IS critical in this function!
+ *       altit = the altitude which the Sun should cross
+ *               Set to -35/60 degrees for rise/set, -6 degrees
+ *               for civil, -12 degrees for nautical and -18
+ *               degrees for astronomical twilight.
+ *         upper_limb: non-zero -> upper limb, zero -> center
+ *               Set to non-zero (e.g. 1) when computing rise/set
+ *               times, and to zero when computing start/end of
+ *               twilight.
+ *        *rise = where to store the rise time
+ *        *set  = where to store the set  time
+ *                Both times are relative to the specified altitude,
+ *                and thus this function can be used to compute
+ *                various twilight times, as well as rise/set times
+ * Return value:  0 = sun rises/sets this day, times stored at
+ *                    *trise and *tset.
+ *               +1 = sun above the specified "horizon" 24 hours.
+ *                    *trise set to time when the sun is at south,
+ *                    minus 12 hours while *tset is set to the south
+ *                    time plus 12 hours. "Day" length = 24 hours
+ *               -1 = sun is below the specified "horizon" 24 hours
+ *                    "Day" length = 0 hours, *trise and *tset are
+ *                    both set to the time when the sun is at south.
+ *
 */
 int timelib_astro_rise_set_altitude(timelib_time *t_loc, double lon, double lat, double altit, int upper_limb, double *h_rise, double *h_set, timelib_sll *ts_rise, timelib_sll *ts_set, timelib_sll *ts_transit)
 {
@@ -136,7 +136,7 @@ void timelib_isoweek_from_date(timelib_sll y, timelib_sll m, timelib_sll d, time
 timelib_sll timelib_daynr_from_weeknr(timelib_sll y, timelib_sll w, timelib_sll d)
 {
 	timelib_sll dow, day;
-	
+
 	/* Figure out the dayofweek for y-1-1 */
 	dow = timelib_day_of_week(y, 1, 1);
 	/* then use that to figure out the offset for day 1 of week 1 */
@@ -677,7 +677,7 @@ const static timelib_tz_lookup_table* abbr_search(const char *word, long gmtoffs
 	if (strcasecmp("utc", word) == 0 || strcasecmp("gmt", word) == 0) {
 		return timelib_timezone_utc;
 	}
-	
+
 	for (tp = timelib_timezone_lookup; tp->name; tp++) {
 		if (strcasecmp(word, tp->name) == 0) {
 			if (!first_found) {
@@ -808,7 +808,7 @@ static int scan(Scanner *s, timelib_tz_get_wrapper tz_get_wrapper)
 {
 	uchar *cursor = s->cur;
 	char *str, *ptr = NULL;
-		
+
 std:
 	s->tok = cursor;
 	s->len = 0;
@@ -1437,7 +1437,7 @@ weekdayof        = (reltextnumber|reltexttext) space (dayfull|dayabbr) space 'of
 		TIMELIB_INIT;
 		TIMELIB_HAVE_DATE();
 		TIMELIB_HAVE_RELATIVE();
-		
+
 		s->time->y = timelib_get_nr((char **) &ptr, 4);
 		w = timelib_get_nr((char **) &ptr, 2);
 		d = timelib_get_nr((char **) &ptr, 1);
@@ -1456,7 +1456,7 @@ weekdayof        = (reltextnumber|reltexttext) space (dayfull|dayabbr) space 'of
 		TIMELIB_INIT;
 		TIMELIB_HAVE_DATE();
 		TIMELIB_HAVE_RELATIVE();
-		
+
 		s->time->y = timelib_get_nr((char **) &ptr, 4);
 		w = timelib_get_nr((char **) &ptr, 2);
 		d = 1;
@@ -1560,7 +1560,7 @@ weekdayof        = (reltextnumber|reltexttext) space (dayfull|dayabbr) space 'of
 		if (s->time->relative.weekday_behavior != 2) {
 			s->time->relative.weekday_behavior = 1;
 		}
-		
+
 		TIMELIB_DEINIT;
 		return TIMELIB_WEEKDAY;
 	}
@@ -1877,7 +1877,7 @@ timelib_time *timelib_parse_from_format(char *format, char *string, int len, tim
 						add_pbf_error(s, "A textual day could not be found", string, begin);
 						break;
 					} else {
-						in.time->have_relative = 1; 
+						in.time->have_relative = 1;
 						in.time->relative.have_weekday_relative = 1;
 						in.time->relative.weekday = tmprel->multiplier;
 						in.time->relative.weekday_behavior = 1;
@@ -2148,13 +2148,13 @@ timelib_time *timelib_parse_from_format(char *format, char *string, int len, tim

 	/* do funky checking whether the parsed time was valid time */
 	if (s->time->h != TIMELIB_UNSET && s->time->i != TIMELIB_UNSET &&
-		s->time->s != TIMELIB_UNSET && 
+		s->time->s != TIMELIB_UNSET &&
 		!timelib_valid_time( s->time->h, s->time->i, s->time->s)) {
 		add_pbf_warning(s, "The parsed time was invalid", string, ptr);
 	}
 	/* do funky checking whether the parsed date was valid date */
 	if (s->time->y != TIMELIB_UNSET && s->time->m != TIMELIB_UNSET &&
-		s->time->d != TIMELIB_UNSET && 
+		s->time->d != TIMELIB_UNSET &&
 		!timelib_valid_date( s->time->y, s->time->m, s->time->d)) {
 		add_pbf_warning(s, "The parsed date was invalid", string, ptr);
 	}
@@ -2227,7 +2227,7 @@ int main(void)
 	printf ("%04d-%02d-%02d %02d:%02d:%02d.%-5d %+04d %1d",
 		time.y, time.m, time.d, time.h, time.i, time.s, time.f, time.z, time.dst);
 	if (time.have_relative) {
-		printf ("%3dY %3dM %3dD / %3dH %3dM %3dS", 
+		printf ("%3dY %3dM %3dD / %3dH %3dM %3dS",
 			time.relative.y, time.relative.m, time.relative.d, time.relative.h, time.relative.i, time.relative.s);
 	}
 	if (time.have_weekday_relative) {
@@ -2236,7 +2236,7 @@ int main(void)
 	if (time.have_weeknr_day) {
 		printf(" / %dW%d", time.relative.weeknr_day.weeknr, time.relative.weeknr_day.dayofweek);
 	}
-	return 0;				
+	return 0;
 }
 #endif

@@ -242,7 +242,7 @@ static int scan(Scanner *s)
 {
 	uchar *cursor = s->cur;
 	char *str, *ptr = NULL;
-		
+
 std:
 	s->tok = cursor;
 	s->len = 0;
@@ -336,11 +336,11 @@ isoweek          = year4 "-"? "W" weekofyear;
 				case 'D': s->period->d = nr; break;
 				case 'H': s->period->h = nr; break;
 				case 'S': s->period->s = nr; break;
-				case 'M': 
+				case 'M':
 					if (in_time) {
 						s->period->i = nr;
 					} else {
-						s->period->m = nr; 
+						s->period->m = nr;
 					}
 					break;
 				default:
@@ -398,9 +398,9 @@ isoweek          = year4 "-"? "W" weekofyear;

 /*!max:re2c */

-void timelib_strtointerval(char *s, int len, 
-                           timelib_time **begin, timelib_time **end, 
-						   timelib_rel_time **period, int *recurrences, 
+void timelib_strtointerval(char *s, int len,
+                           timelib_time **begin, timelib_time **end,
+						   timelib_rel_time **period, int *recurrences,
 						   struct timelib_error_container **errors)
 {
 	Scanner in;
@@ -31,12 +31,14 @@
 #else
 #include <strings.h>
 #endif
+
+#define TIMELIB_SUPPORTS_V2DATA
 #include "timezonedb.h"

 #if (defined(__APPLE__) || defined(__APPLE_CC__)) && (defined(__BIG_ENDIAN__) || defined(__LITTLE_ENDIAN__))
 # if defined(__LITTLE_ENDIAN__)
 #  undef WORDS_BIGENDIAN
-# else 
+# else
 #  if defined(__BIG_ENDIAN__)
 #   define WORDS_BIGENDIAN
 #  endif
@@ -49,11 +51,14 @@
 #define timelib_conv_int(l) ((l & 0x000000ff) << 24) + ((l & 0x0000ff00) << 8) + ((l & 0x00ff0000) >> 8) + ((l & 0xff000000) >> 24)
 #endif

-static void read_preamble(const unsigned char **tzf, timelib_tzinfo *tz)
+static int read_preamble(const unsigned char **tzf, timelib_tzinfo *tz)
 {
-	/* skip ID */
+	uint32_t version;
+
+	/* read ID */
+	version = (*tzf)[3] - '0';
 	*tzf += 4;
-	
+
 	/* read BC flag */
 	tz->bc = (**tzf == '\1');
 	*tzf += 1;
@@ -63,8 +68,10 @@ static void read_preamble(const unsigned char **tzf, timelib_tzinfo *tz)
 	tz->location.country_code[2] = '\0';
 	*tzf += 2;

-	/* skip read of preamble */
+	/* skip rest of preamble */
 	*tzf += 13;
+
+	return version;
 }

 static void read_header(const unsigned char **tzf, timelib_tzinfo *tz)
@@ -72,65 +79,88 @@ static void read_header(const unsigned char **tzf, timelib_tzinfo *tz)
 	uint32_t buffer[6];

 	memcpy(&buffer, *tzf, sizeof(buffer));
-	tz->ttisgmtcnt = timelib_conv_int(buffer[0]);
-	tz->ttisstdcnt = timelib_conv_int(buffer[1]);
-	tz->leapcnt    = timelib_conv_int(buffer[2]);
-	tz->timecnt    = timelib_conv_int(buffer[3]);
-	tz->typecnt    = timelib_conv_int(buffer[4]);
-	tz->charcnt    = timelib_conv_int(buffer[5]);
+	tz->bit32.ttisgmtcnt = timelib_conv_int(buffer[0]);
+	tz->bit32.ttisstdcnt = timelib_conv_int(buffer[1]);
+	tz->bit32.leapcnt    = timelib_conv_int(buffer[2]);
+	tz->bit32.timecnt    = timelib_conv_int(buffer[3]);
+	tz->bit32.typecnt    = timelib_conv_int(buffer[4]);
+	tz->bit32.charcnt    = timelib_conv_int(buffer[5]);
 	*tzf += sizeof(buffer);
 }

+static void skip_64bit_transistions(const unsigned char **tzf, timelib_tzinfo *tz)
+{
+	if (tz->bit64.timecnt) {
+		*tzf += (sizeof(int64_t) * tz->bit64.timecnt);
+		*tzf += (sizeof(unsigned char) * tz->bit64.timecnt);
+	}
+}
+
 static void read_transistions(const unsigned char **tzf, timelib_tzinfo *tz)
 {
 	int32_t *buffer = NULL;
 	uint32_t i;
 	unsigned char *cbuffer = NULL;

-	if (tz->timecnt) {
-		buffer = (int32_t*) malloc(tz->timecnt * sizeof(int32_t));
+	if (tz->bit32.timecnt) {
+		buffer = (int32_t*) malloc(tz->bit32.timecnt * sizeof(int32_t));
 		if (!buffer) {
 			return;
 		}
-		memcpy(buffer, *tzf, sizeof(int32_t) * tz->timecnt);
-		*tzf += (sizeof(int32_t) * tz->timecnt);
-		for (i = 0; i < tz->timecnt; i++) {
+		memcpy(buffer, *tzf, sizeof(int32_t) * tz->bit32.timecnt);
+		*tzf += (sizeof(int32_t) * tz->bit32.timecnt);
+		for (i = 0; i < tz->bit32.timecnt; i++) {
 			buffer[i] = timelib_conv_int(buffer[i]);
 		}

-		cbuffer = (unsigned char*) malloc(tz->timecnt * sizeof(unsigned char));
+		cbuffer = (unsigned char*) malloc(tz->bit32.timecnt * sizeof(unsigned char));
 		if (!cbuffer) {
 			free(buffer);
 			return;
 		}
-		memcpy(cbuffer, *tzf, sizeof(unsigned char) * tz->timecnt);
-		*tzf += sizeof(unsigned char) * tz->timecnt;
+		memcpy(cbuffer, *tzf, sizeof(unsigned char) * tz->bit32.timecnt);
+		*tzf += sizeof(unsigned char) * tz->bit32.timecnt;
 	}
-	
+
 	tz->trans = buffer;
 	tz->trans_idx = cbuffer;
 }

+static void skip_64bit_types(const unsigned char **tzf, timelib_tzinfo *tz)
+{
+	*tzf += sizeof(unsigned char) * 6 * tz->bit64.typecnt;
+	*tzf += sizeof(char) * tz->bit64.charcnt;
+	if (tz->bit64.leapcnt) {
+		*tzf += sizeof(int64_t) * tz->bit64.leapcnt * 2;
+	}
+	if (tz->bit64.ttisstdcnt) {
+		*tzf += sizeof(unsigned char) * tz->bit64.ttisstdcnt;
+	}
+	if (tz->bit64.ttisgmtcnt) {
+		*tzf += sizeof(unsigned char) * tz->bit64.ttisgmtcnt;
+	}
+}
+
 static void read_types(const unsigned char **tzf, timelib_tzinfo *tz)
 {
 	unsigned char *buffer;
 	int32_t *leap_buffer;
 	unsigned int i, j;

-	buffer = (unsigned char*) malloc(tz->typecnt * sizeof(unsigned char) * 6);
+	buffer = (unsigned char*) malloc(tz->bit32.typecnt * sizeof(unsigned char) * 6);
 	if (!buffer) {
 		return;
 	}
-	memcpy(buffer, *tzf, sizeof(unsigned char) * 6 * tz->typecnt);
-	*tzf += sizeof(unsigned char) * 6 * tz->typecnt;
+	memcpy(buffer, *tzf, sizeof(unsigned char) * 6 * tz->bit32.typecnt);
+	*tzf += sizeof(unsigned char) * 6 * tz->bit32.typecnt;

-	tz->type = (ttinfo*) malloc(tz->typecnt * sizeof(struct ttinfo));
+	tz->type = (ttinfo*) malloc(tz->bit32.typecnt * sizeof(struct ttinfo));
 	if (!tz->type) {
 		free(buffer);
 		return;
 	}

-	for (i = 0; i < tz->typecnt; i++) {
+	for (i = 0; i < tz->bit32.typecnt; i++) {
 		j = i * 6;
 		tz->type[i].offset = (buffer[j] * 16777216) + (buffer[j + 1] * 65536) + (buffer[j + 2] * 256) + buffer[j + 3];
 		tz->type[i].isdst = buffer[j + 4];
@@ -138,62 +168,74 @@ static void read_types(const unsigned char **tzf, timelib_tzinfo *tz)
 	}
 	free(buffer);

-	tz->timezone_abbr = (char*) malloc(tz->charcnt);
+	tz->timezone_abbr = (char*) malloc(tz->bit32.charcnt);
 	if (!tz->timezone_abbr) {
 		return;
 	}
-	memcpy(tz->timezone_abbr, *tzf, sizeof(char) * tz->charcnt);
-	*tzf += sizeof(char) * tz->charcnt;
+	memcpy(tz->timezone_abbr, *tzf, sizeof(char) * tz->bit32.charcnt);
+	*tzf += sizeof(char) * tz->bit32.charcnt;

-	if (tz->leapcnt) {
-		leap_buffer = (int32_t *) malloc(tz->leapcnt * 2 * sizeof(int32_t));
+	if (tz->bit32.leapcnt) {
+		leap_buffer = (int32_t *) malloc(tz->bit32.leapcnt * 2 * sizeof(int32_t));
 		if (!leap_buffer) {
 			return;
 		}
-		memcpy(leap_buffer, *tzf, sizeof(int32_t) * tz->leapcnt * 2);
-		*tzf += sizeof(int32_t) * tz->leapcnt * 2;
+		memcpy(leap_buffer, *tzf, sizeof(int32_t) * tz->bit32.leapcnt * 2);
+		*tzf += sizeof(int32_t) * tz->bit32.leapcnt * 2;

-		tz->leap_times = (tlinfo*) malloc(tz->leapcnt * sizeof(tlinfo));
+		tz->leap_times = (tlinfo*) malloc(tz->bit32.leapcnt * sizeof(tlinfo));
 		if (!tz->leap_times) {
 			free(leap_buffer);
 			return;
 		}
-		for (i = 0; i < tz->leapcnt; i++) {
+		for (i = 0; i < tz->bit32.leapcnt; i++) {
 			tz->leap_times[i].trans = timelib_conv_int(leap_buffer[i * 2]);
 			tz->leap_times[i].offset = timelib_conv_int(leap_buffer[i * 2 + 1]);
 		}
 		free(leap_buffer);
 	}

-	if (tz->ttisstdcnt) {
-		buffer = (unsigned char*) malloc(tz->ttisstdcnt * sizeof(unsigned char));
+	if (tz->bit32.ttisstdcnt) {
+		buffer = (unsigned char*) malloc(tz->bit32.ttisstdcnt * sizeof(unsigned char));
 		if (!buffer) {
 			return;
 		}
-		memcpy(buffer, *tzf, sizeof(unsigned char) * tz->ttisstdcnt);
-		*tzf += sizeof(unsigned char) * tz->ttisstdcnt;
+		memcpy(buffer, *tzf, sizeof(unsigned char) * tz->bit32.ttisstdcnt);
+		*tzf += sizeof(unsigned char) * tz->bit32.ttisstdcnt;

-		for (i = 0; i < tz->ttisstdcnt; i++) {
+		for (i = 0; i < tz->bit32.ttisstdcnt; i++) {
 			tz->type[i].isstdcnt = buffer[i];
 		}
 		free(buffer);
 	}

-	if (tz->ttisgmtcnt) {
-		buffer = (unsigned char*) malloc(tz->ttisgmtcnt * sizeof(unsigned char));
+	if (tz->bit32.ttisgmtcnt) {
+		buffer = (unsigned char*) malloc(tz->bit32.ttisgmtcnt * sizeof(unsigned char));
 		if (!buffer) {
 			return;
 		}
-		memcpy(buffer, *tzf, sizeof(unsigned char) * tz->ttisgmtcnt);
-		*tzf += sizeof(unsigned char) * tz->ttisgmtcnt;
+		memcpy(buffer, *tzf, sizeof(unsigned char) * tz->bit32.ttisgmtcnt);
+		*tzf += sizeof(unsigned char) * tz->bit32.ttisgmtcnt;

-		for (i = 0; i < tz->ttisgmtcnt; i++) {
+		for (i = 0; i < tz->bit32.ttisgmtcnt; i++) {
 			tz->type[i].isgmtcnt = buffer[i];
 		}
 		free(buffer);
 	}
 }

+static void skip_posix_string(const unsigned char **tzf, timelib_tzinfo *tz)
+{
+	int n_count = 0;
+
+	do {
+		if (*tzf[0] == '\n') {
+			n_count++;
+		}
+		(*tzf)++;
+	} while (n_count < 2);
+}
+
 static void read_location(const unsigned char **tzf, timelib_tzinfo *tz)
 {
 	uint32_t buffer[3];
@@ -221,12 +263,12 @@ void timelib_dump_tzinfo(timelib_tzinfo *tz)
 	printf("Geo Location:      %f,%f\n", tz->location.latitude, tz->location.longitude);
 	printf("Comments:\n%s\n",          tz->location.comments);
 	printf("BC:                %s\n",  tz->bc ? "" : "yes");
-	printf("UTC/Local count:   %lu\n", (unsigned long) tz->ttisgmtcnt);
-	printf("Std/Wall count:    %lu\n", (unsigned long) tz->ttisstdcnt);
-	printf("Leap.sec. count:   %lu\n", (unsigned long) tz->leapcnt);
-	printf("Trans. count:      %lu\n", (unsigned long) tz->timecnt);
-	printf("Local types count: %lu\n", (unsigned long) tz->typecnt);
-	printf("Zone Abbr. count:  %lu\n", (unsigned long) tz->charcnt);
+	printf("UTC/Local count:   %lu\n", (unsigned long) tz->bit32.ttisgmtcnt);
+	printf("Std/Wall count:    %lu\n", (unsigned long) tz->bit32.ttisstdcnt);
+	printf("Leap.sec. count:   %lu\n", (unsigned long) tz->bit32.leapcnt);
+	printf("Trans. count:      %lu\n", (unsigned long) tz->bit32.timecnt);
+	printf("Local types count: %lu\n", (unsigned long) tz->bit32.typecnt);
+	printf("Zone Abbr. count:  %lu\n", (unsigned long) tz->bit32.charcnt);

 	printf ("%8s (%12s) = %3d [%5ld %1d %3d '%s' (%d,%d)]\n",
 		"", "", 0,
@@ -237,7 +279,7 @@ void timelib_dump_tzinfo(timelib_tzinfo *tz)
 		tz->type[0].isstdcnt,
 		tz->type[0].isgmtcnt
 		);
-	for (i = 0; i < tz->timecnt; i++) {
+	for (i = 0; i < tz->bit32.timecnt; i++) {
 		printf ("%08X (%12d) = %3d [%5ld %1d %3d '%s' (%d,%d)]\n",
 			tz->trans[i], tz->trans[i], tz->trans_idx[i],
 			(long int) tz->type[tz->trans_idx[i]].offset,
@@ -248,7 +290,7 @@ void timelib_dump_tzinfo(timelib_tzinfo *tz)
 			tz->type[tz->trans_idx[i]].isgmtcnt
 			);
 	}
-	for (i = 0; i < tz->leapcnt; i++) {
+	for (i = 0; i < tz->bit32.leapcnt; i++) {
 		printf ("%08X (%12ld) = %d\n",
 			tz->leap_times[i].trans,
 			(long) tz->leap_times[i].trans,
@@ -267,7 +309,7 @@ static int seek_to_tz_position(const unsigned char **tzf, char *timezone, const
 		cur_locale = strdup(tmp);
 	}
 	setlocale(LC_CTYPE, "C");
-#endif	
+#endif

 	do {
 		int mid = ((unsigned)left + right) >> 1;
@@ -282,7 +324,7 @@ static int seek_to_tz_position(const unsigned char **tzf, char *timezone, const
 #ifdef HAVE_SETLOCALE
 			setlocale(LC_CTYPE, cur_locale);
 			if (cur_locale) free(cur_locale);
-#endif	
+#endif
 			return 1;
 		}

@@ -291,7 +333,7 @@ static int seek_to_tz_position(const unsigned char **tzf, char *timezone, const
 #ifdef HAVE_SETLOCALE
 	setlocale(LC_CTYPE, cur_locale);
 	if (cur_locale) free(cur_locale);
-#endif	
+#endif
 	return 0;
 }

@@ -312,18 +354,45 @@ int timelib_timezone_id_is_valid(char *timezone, const timelib_tzdb *tzdb)
 	return (seek_to_tz_position(&tzf, timezone, tzdb));
 }

+static void skip_64bit_preamble(const unsigned char **tzf, timelib_tzinfo *tz)
+{
+	*tzf += 20;
+}
+
+static void read_64bit_header(const unsigned char **tzf, timelib_tzinfo *tz)
+{
+	uint32_t buffer[6];
+
+	memcpy(&buffer, *tzf, sizeof(buffer));
+	tz->bit64.ttisgmtcnt = timelib_conv_int(buffer[0]);
+	tz->bit64.ttisstdcnt = timelib_conv_int(buffer[1]);
+	tz->bit64.leapcnt    = timelib_conv_int(buffer[2]);
+	tz->bit64.timecnt    = timelib_conv_int(buffer[3]);
+	tz->bit64.typecnt    = timelib_conv_int(buffer[4]);
+	tz->bit64.charcnt    = timelib_conv_int(buffer[5]);
+	*tzf += sizeof(buffer);
+}
+
 timelib_tzinfo *timelib_parse_tzfile(char *timezone, const timelib_tzdb *tzdb)
 {
 	const unsigned char *tzf;
 	timelib_tzinfo *tmp;
+	int version;

 	if (seek_to_tz_position(&tzf, timezone, tzdb)) {
 		tmp = timelib_tzinfo_ctor(timezone);

-		read_preamble(&tzf, tmp);
+		version = read_preamble(&tzf, tmp);
 		read_header(&tzf, tmp);
 		read_transistions(&tzf, tmp);
 		read_types(&tzf, tmp);
+		if (version == 2) {
+			skip_64bit_preamble(&tzf, tmp);
+			read_64bit_header(&tzf, tmp);
+			skip_64bit_transistions(&tzf, tmp);
+			skip_64bit_types(&tzf, tmp);
+			skip_posix_string(&tzf, tmp);
+		}
 		read_location(&tzf, tmp);
 	} else {
 		tmp = NULL;
@@ -338,9 +407,9 @@ static ttinfo* fetch_timezone_offset(timelib_tzinfo *tz, timelib_sll ts, timelib

 	/* If there is no transition time, we pick the first one, if that doesn't
 	 * exist we return NULL */
-	if (!tz->timecnt || !tz->trans) {
+	if (!tz->bit32.timecnt || !tz->trans) {
 		*transition_time = 0;
-		if (tz->typecnt == 1) {
+		if (tz->bit32.typecnt == 1) {
 			return &(tz->type[0]);
 		}
 		return NULL;
@@ -355,10 +424,10 @@ static ttinfo* fetch_timezone_offset(timelib_tzinfo *tz, timelib_sll ts, timelib

 		*transition_time = 0;
 		j = 0;
-		while (j < tz->timecnt && tz->type[j].isdst) {
+		while (j < tz->bit32.timecnt && tz->type[j].isdst) {
 			++j;
 		}
-		if (j == tz->timecnt) {
+		if (j == tz->bit32.timecnt) {
 			j = 0;
 		}
 		return &(tz->type[j]);
@@ -366,25 +435,25 @@ static ttinfo* fetch_timezone_offset(timelib_tzinfo *tz, timelib_sll ts, timelib

 	/* In all other cases we loop through the available transtion times to find
 	 * the correct entry */
-	for (i = 0; i < tz->timecnt; i++) {
+	for (i = 0; i < tz->bit32.timecnt; i++) {
 		if (ts < tz->trans[i]) {
 			*transition_time = tz->trans[i - 1];
 			return &(tz->type[tz->trans_idx[i - 1]]);
 		}
 	}
-	*transition_time = tz->trans[tz->timecnt - 1];
-	return &(tz->type[tz->trans_idx[tz->timecnt - 1]]);
+	*transition_time = tz->trans[tz->bit32.timecnt - 1];
+	return &(tz->type[tz->trans_idx[tz->bit32.timecnt - 1]]);
 }

 static tlinfo* fetch_leaptime_offset(timelib_tzinfo *tz, timelib_sll ts)
 {
 	int i;

-	if (!tz->leapcnt || !tz->leap_times) {
+	if (!tz->bit32.leapcnt || !tz->leap_times) {
 		return NULL;
 	}

-	for (i = tz->leapcnt - 1; i > 0; i--) {
+	for (i = tz->bit32.leapcnt - 1; i > 0; i--) {
 		if (ts > tz->leap_times[i].trans) {
 			return &(tz->leap_times[i]);
 		}
@@ -396,7 +465,7 @@ int timelib_timestamp_is_in_dst(timelib_sll ts, timelib_tzinfo *tz)
 {
 	ttinfo *to;
 	timelib_sll dummy;
-	
+
 	if ((to = fetch_timezone_offset(tz, ts, &dummy))) {
 		return to->isdst;
 	}
@@ -439,12 +508,12 @@ timelib_sll timelib_get_current_offset(timelib_time *t)
 {
 	timelib_time_offset *gmt_offset;
 	timelib_sll retval;
-			
+
 	switch (t->zone_type) {
 		case TIMELIB_ZONETYPE_ABBR:
 		case TIMELIB_ZONETYPE_OFFSET:
 			return (t->z + t->dst) * -60;
-			
+
 		case TIMELIB_ZONETYPE_ID:
 			gmt_offset = timelib_get_time_zone_info(t->sse, t->tz_info);
 			retval = gmt_offset->offset;
@@ -116,26 +116,26 @@ timelib_tzinfo* timelib_tzinfo_ctor(char *name)
 timelib_tzinfo *timelib_tzinfo_clone(timelib_tzinfo *tz)
 {
 	timelib_tzinfo *tmp = timelib_tzinfo_ctor(tz->name);
-	tmp->ttisgmtcnt = tz->ttisgmtcnt;
-	tmp->ttisstdcnt = tz->ttisstdcnt;
-	tmp->leapcnt = tz->leapcnt;
-	tmp->timecnt = tz->timecnt;
-	tmp->typecnt = tz->typecnt;
-	tmp->charcnt = tz->charcnt;
-	
-	tmp->trans = (int32_t *) malloc(tz->timecnt * sizeof(int32_t));
-	tmp->trans_idx = (unsigned char*) malloc(tz->timecnt * sizeof(unsigned char));
-	memcpy(tmp->trans, tz->trans, tz->timecnt * sizeof(int32_t));
-	memcpy(tmp->trans_idx, tz->trans_idx, tz->timecnt * sizeof(unsigned char));
+	tmp->bit32.ttisgmtcnt = tz->bit32.ttisgmtcnt;
+	tmp->bit32.ttisstdcnt = tz->bit32.ttisstdcnt;
+	tmp->bit32.leapcnt = tz->bit32.leapcnt;
+	tmp->bit32.timecnt = tz->bit32.timecnt;
+	tmp->bit32.typecnt = tz->bit32.typecnt;
+	tmp->bit32.charcnt = tz->bit32.charcnt;

-	tmp->type = (ttinfo*) malloc(tz->typecnt * sizeof(struct ttinfo));
-	memcpy(tmp->type, tz->type, tz->typecnt * sizeof(struct ttinfo));
+	tmp->trans = (int32_t *) malloc(tz->bit32.timecnt * sizeof(int32_t));
+	tmp->trans_idx = (unsigned char*) malloc(tz->bit32.timecnt * sizeof(unsigned char));
+	memcpy(tmp->trans, tz->trans, tz->bit32.timecnt * sizeof(int32_t));
+	memcpy(tmp->trans_idx, tz->trans_idx, tz->bit32.timecnt * sizeof(unsigned char));

-	tmp->timezone_abbr = (char*) malloc(tz->charcnt);
-	memcpy(tmp->timezone_abbr, tz->timezone_abbr, tz->charcnt);
+	tmp->type = (ttinfo*) malloc(tz->bit32.typecnt * sizeof(struct ttinfo));
+	memcpy(tmp->type, tz->type, tz->bit32.typecnt * sizeof(struct ttinfo));

-	tmp->leap_times = (tlinfo*) malloc(tz->leapcnt * sizeof(tlinfo));
-	memcpy(tmp->leap_times, tz->leap_times, tz->leapcnt * sizeof(tlinfo));
+	tmp->timezone_abbr = (char*) malloc(tz->bit32.charcnt);
+	memcpy(tmp->timezone_abbr, tz->timezone_abbr, tz->bit32.charcnt);
+
+	tmp->leap_times = (tlinfo*) malloc(tz->bit32.leapcnt * sizeof(tlinfo));
+	memcpy(tmp->leap_times, tz->leap_times, tz->bit32.leapcnt * sizeof(tlinfo));

 	return tmp;
 }
@@ -236,7 +236,7 @@ void timelib_dump_date(timelib_time *d, int options)

 	if ((options & 1) == 1) {
 		if (d->have_relative) {
-			printf("%3lldY %3lldM %3lldD / %3lldH %3lldM %3lldS", 
+			printf("%3lldY %3lldM %3lldD / %3lldH %3lldM %3lldS",
 				d->relative.y, d->relative.m, d->relative.d, d->relative.h, d->relative.i, d->relative.s);
 			if (d->relative.first_last_day_of != 0) {
 				switch (d->relative.first_last_day_of) {
@@ -271,7 +271,7 @@ void timelib_dump_date(timelib_time *d, int options)

 void timelib_dump_rel_time(timelib_rel_time *d)
 {
-	printf("%3lldY %3lldM %3lldD / %3lldH %3lldM %3lldS (days: %lld)%s", 
+	printf("%3lldY %3lldM %3lldD / %3lldH %3lldM %3lldS (days: %lld)%s",
 		d->y, d->m, d->d, d->h, d->i, d->s, d->days, d->invert ? " inverted" : "");
 	if (d->first_last_day_of != 0) {
 		switch (d->first_last_day_of) {
@@ -80,8 +80,8 @@ long timelib_parse_tz_cor(char**);

 /* From parse_iso_intervals.re */
 void timelib_strtointerval(char *s, int len, 
-                           timelib_time **begin, timelib_time **end, 
-						   timelib_rel_time **period, int *recurrences, 
+                           timelib_time **begin, timelib_time **end,
+						   timelib_rel_time **period, int *recurrences,
 						   struct timelib_error_container **errors);


@@ -158,12 +158,22 @@ typedef struct tlocinfo
 typedef struct timelib_tzinfo
 {
 	char    *name;
-	uint32_t ttisgmtcnt;
-	uint32_t ttisstdcnt;
-	uint32_t leapcnt;
-	uint32_t timecnt;
-	uint32_t typecnt;
-	uint32_t charcnt;
+	struct {
+		uint32_t ttisgmtcnt;
+		uint32_t ttisstdcnt;
+		uint32_t leapcnt;
+		uint32_t timecnt;
+		uint32_t typecnt;
+		uint32_t charcnt;
+	} bit32;
+	struct {
+		uint64_t ttisgmtcnt;
+		uint64_t ttisstdcnt;
+		uint64_t leapcnt;
+		uint64_t timecnt;
+		uint64_t typecnt;
+		uint64_t charcnt;
+	} bit64;

 	int32_t *trans;
 	unsigned char *trans_idx;
@@ -106,7 +106,7 @@ static int do_range_limit_days(timelib_sll *y, timelib_sll *m, timelib_sll *d)
 	timelib_sll days_this_month;
 	timelib_sll last_month, last_year;
 	timelib_sll days_last_month;
-	
+
 	/* can jump an entire leap year period quickly */
 	if (*d >= DAYS_PER_LYEAR_PERIOD || *d <= -DAYS_PER_LYEAR_PERIOD) {
 		*y += YEARS_PER_LYEAR_PERIOD * (*d / DAYS_PER_LYEAR_PERIOD);
@@ -396,7 +396,7 @@ static timelib_sll do_adjust_timezone(timelib_time *tz, timelib_tzinfo *tzi)
 				timelib_time_offset *before, *after;
 				timelib_sll          tmp;
 				int                  in_transistion;
-				
+
 				tz->is_localtime = 1;
 				before = timelib_get_time_zone_info(tz->sse, tzi);
 				after = timelib_get_time_zone_info(tz->sse - before->offset, tzi);
@@ -406,7 +406,7 @@ static timelib_sll do_adjust_timezone(timelib_time *tz, timelib_tzinfo *tzi)
 					((tz->sse - after->offset) >= (after->transistion_time + (before->offset - after->offset))) &&
 					((tz->sse - after->offset) < after->transistion_time)
 				);
-				
+
 				if ((before->offset != after->offset) && !in_transistion) {
 					tmp = -after->offset;
 				} else {
@@ -464,7 +464,7 @@ int main(void)
 	printf ("%04d-%02d-%02d %02d:%02d:%02d.%-5d %+04d %1d",
 		time.y, time.m, time.d, time.h, time.i, time.s, time.f, time.z, time.dst);
 	if (time.have_relative) {
-		printf ("%3dY %3dM %3dD / %3dH %3dM %3dS", 
+		printf ("%3dY %3dM %3dD / %3dH %3dM %3dS",
 			time.relative.y, time.relative.m, time.relative.d, time.relative.h, time.relative.i, time.relative.s);
 	}
 	if (time.have_weekday_relative) {
@@ -141,7 +141,7 @@ void timelib_update_from_sse(timelib_time *tm)
 	signed int dst = tm->dst;

 	sse = tm->sse;
-	
+
 	switch (tm->zone_type) {
 		case TIMELIB_ZONETYPE_ABBR:
 		case TIMELIB_ZONETYPE_OFFSET: {
@@ -152,11 +152,11 @@ void timelib_update_from_sse(timelib_time *tm)

 		case TIMELIB_ZONETYPE_ID: {
 			timelib_time_offset *gmt_offset;
-			
+
 			gmt_offset = timelib_get_time_zone_info(tm->sse, tm->tz_info);
 			timelib_unixtime2gmt(tm, tm->sse + gmt_offset->offset);
 			timelib_time_offset_dtor(gmt_offset);
-			
+
 			goto cleanup;
 		}

@@ -182,7 +182,7 @@ void timelib_unixtime2local(timelib_time *tm, timelib_sll ts)
 		case TIMELIB_ZONETYPE_OFFSET: {
 			int z = tm->z;
 			signed int dst = tm->dst;
-			
+
 			timelib_unixtime2gmt(tm, ts - (tm->z * 60) + (tm->dst * 3600));

 			tm->z = z;
@@ -195,7 +195,7 @@ void timelib_unixtime2local(timelib_time *tm, timelib_sll ts)
 			timelib_unixtime2gmt(tm, ts + gmt_offset->offset);

 			/* we need to reset the sse here as unixtime2gmt modifies it */
-			tm->sse = ts; 
+			tm->sse = ts;
 			tm->dst = gmt_offset->is_dst;
 			tm->z = gmt_offset->offset;
 			tm->tz_info = tz;
@@ -185,10 +185,6 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_date_format, 0, 0, 2)
 	ZEND_ARG_INFO(0, format)
 ZEND_END_ARG_INFO()

-ZEND_BEGIN_ARG_INFO_EX(arginfo_date_method_create_from_immutable, 0, 0, 1)
-	ZEND_ARG_INFO(0, DateTimeImmutable)
-ZEND_END_ARG_INFO()
-
 ZEND_BEGIN_ARG_INFO_EX(arginfo_date_method_format, 0, 0, 1)
 	ZEND_ARG_INFO(0, format)
 ZEND_END_ARG_INFO()
@@ -387,7 +383,7 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_date_period_construct, 0, 0, 3)
 	ZEND_ARG_INFO(0, end)
 ZEND_END_ARG_INFO()

-ZEND_BEGIN_ARG_INFO_EX(arginfo_date_interval_construct, 0, 0, 0)
+ZEND_BEGIN_ARG_INFO_EX(arginfo_date_interval_construct, 0, 0, 1)
 	ZEND_ARG_INFO(0, interval_spec)
 ZEND_END_ARG_INFO()
 /* }}} */
@@ -472,7 +468,6 @@ const zend_function_entry date_funcs_date[] = {
 	PHP_ME(DateTime,			__construct,		arginfo_date_create, ZEND_ACC_CTOR|ZEND_ACC_PUBLIC)
 	PHP_ME(DateTime,			__wakeup,			NULL, ZEND_ACC_PUBLIC)
 	PHP_ME(DateTime,			__set_state,		NULL, ZEND_ACC_PUBLIC|ZEND_ACC_STATIC)
-	PHP_ME(DateTime,			createFromImmutable,	arginfo_date_method_create_from_immutable, ZEND_ACC_PUBLIC|ZEND_ACC_STATIC)
 	PHP_ME_MAPPING(createFromFormat, date_create_from_format,	arginfo_date_create_from_format, ZEND_ACC_PUBLIC|ZEND_ACC_STATIC)
 	PHP_ME_MAPPING(getLastErrors, date_get_last_errors,	arginfo_date_get_last_errors, ZEND_ACC_PUBLIC|ZEND_ACC_STATIC)
 	PHP_ME_MAPPING(format,		date_format,		arginfo_date_method_format, 0)
@@ -606,7 +601,7 @@ static zend_object_handlers date_object_handlers_period;
 #define DATE_SET_CONTEXT \
 	zval *object; \
 	object = getThis(); \
-   
+
 #define DATE_FETCH_OBJECT	\
 	php_date_obj *obj;	\
 	DATE_SET_CONTEXT; \
@@ -775,7 +770,7 @@ PHP_RSHUTDOWN_FUNCTION(date)
 * RFC2822, Section 3.3: http://www.ietf.org/rfc/rfc2822.txt
 *  FWS             =       ([*WSP CRLF] 1*WSP) /   ; Folding white space
 *  CFWS            =       *([FWS] comment) (([FWS] comment) / FWS)
- *  
+ *
 *  date-time       =       [ day-of-week "," ] date FWS time [CFWS]
 *  day-of-week     =       ([FWS] day-name)
 *  day-name        =       "Mon" / "Tue" / "Wed" / "Thu" / "Fri" / "Sat" / "Sun"
@@ -797,19 +792,19 @@ PHP_RSHUTDOWN_FUNCTION(date)
 *  date-fullyear   = 4DIGIT
 *  date-month      = 2DIGIT  ; 01-12
 *  date-mday       = 2DIGIT  ; 01-28, 01-29, 01-30, 01-31 based on month/year
- *  
+ *
 *  time-hour       = 2DIGIT  ; 00-23
 *  time-minute     = 2DIGIT  ; 00-59
 *  time-second     = 2DIGIT  ; 00-58, 00-59, 00-60 based on leap second rules
- *  
+ *
 *  time-secfrac    = "." 1*DIGIT
 *  time-numoffset  = ("+" / "-") time-hour ":" time-minute
 *  time-offset     = "Z" / time-numoffset
- *  
+ *
 *  partial-time    = time-hour ":" time-minute ":" time-second [time-secfrac]
 *  full-date       = date-fullyear "-" date-month "-" date-mday
 *  full-time       = partial-time time-offset
- *  
+ *
 *  date-time       = full-date "T" full-time
 */
 #define DATE_FORMAT_RFC3339  "Y-m-d\\TH:i:sP"
@@ -890,6 +885,10 @@ PHP_MSHUTDOWN_FUNCTION(date)
 		timelib_error_container_dtor(DATEG(last_errors));
 	}

+#ifndef ZTS
+	DATEG(default_timezone) = NULL;
+#endif
+
 	return SUCCESS;
 }
 /* }}} */
@@ -898,7 +897,7 @@ PHP_MSHUTDOWN_FUNCTION(date)
 PHP_MINFO_FUNCTION(date)
 {
 	const timelib_tzdb *tzdb = DATE_TIMEZONEDB;
-	
+
 	php_info_print_table_start();
 	php_info_print_table_row(2, "date/time support", "enabled");
 	php_info_print_table_row(2, "\"Olson\" Timezone Database Version", tzdb->version);
@@ -1050,8 +1049,8 @@ char *php_date_full_day_name(timelib_sll y, timelib_sll m, timelib_sll d)
 	timelib_sll day_of_week = timelib_day_of_week(y, m, d);
 	if (day_of_week < 0) {
 		return "Unknown";
-	} 
-	return day_full_names[day_of_week];	
+	}
+	return day_full_names[day_of_week];
 }

 char *php_date_short_day_name(timelib_sll y, timelib_sll m, timelib_sll d)
@@ -1059,8 +1058,8 @@ char *php_date_short_day_name(timelib_sll y, timelib_sll m, timelib_sll d)
 	timelib_sll day_of_week = timelib_day_of_week(y, m, d);
 	if (day_of_week < 0) {
 		return "Unknown";
-	} 
-	return day_short_names[day_of_week];	
+	}
+	return day_short_names[day_of_week];
 }
 /* }}} */

@@ -1092,7 +1091,7 @@ static char *date_format(char *format, int format_len, timelib_time *t, int loca
 			offset->leap_secs = 0;
 			offset->is_dst = 0;
 			offset->abbr = malloc(9); /* GMT�xxxx\0 */
-			snprintf(offset->abbr, 9, "GMT%c%02d%02d", 
+			snprintf(offset->abbr, 9, "GMT%c%02d%02d",
 			                          localtime ? ((offset->offset < 0) ? '-' : '+') : '+',
 			                          localtime ? abs(offset->offset / 3600) : 0,
 			                          localtime ? abs((offset->offset % 3600) / 60) : 0 );
@@ -1138,7 +1137,7 @@ static char *date_format(char *format, int format_len, timelib_time *t, int loca
 			case 'a': length = slprintf(buffer, 32, "%s", t->h >= 12 ? "pm" : "am"); break;
 			case 'A': length = slprintf(buffer, 32, "%s", t->h >= 12 ? "PM" : "AM"); break;
 			case 'B': {
-				int retval = (((((long)t->sse)-(((long)t->sse) - ((((long)t->sse) % 86400) + 3600))) * 10) / 864);			
+				int retval = (((((long)t->sse)-(((long)t->sse) - ((((long)t->sse) % 86400) + 3600))) * 10) / 864);
 				while (retval < 0) {
 					retval += 1000;
 				}
@@ -1238,7 +1237,7 @@ static void php_date(INTERNAL_FUNCTION_PARAMETERS, int localtime)
 	}

 	string = php_format_date(format, format_len, ts, localtime TSRMLS_CC);
-	
+
 	RETVAL_STRING(string, 0);
 }
 /* }}} */
@@ -1262,7 +1261,7 @@ PHPAPI char *php_format_date(char *format, int format_len, time_t ts, int localt
 	}

 	string = date_format(format, format_len, t, localtime);
-	
+
 	timelib_time_dtor(t);
 	return string;
 }
@@ -1303,7 +1302,7 @@ PHPAPI int php_idate(char format, time_t ts, int localtime TSRMLS_DC)
 			offset->leap_secs = 0;
 			offset->is_dst = t->dst;
 			offset->abbr = malloc(9); /* GMT�xxxx\0 */
-			snprintf(offset->abbr, 9, "GMT%c%02d%02d", 
+			snprintf(offset->abbr, 9, "GMT%c%02d%02d",
 			                          !localtime ? ((offset->offset < 0) ? '-' : '+') : '+',
 			                          !localtime ? abs(offset->offset / 3600) : 0,
 			                          !localtime ? abs((offset->offset % 3600) / 60) : 0 );
@@ -1335,7 +1334,7 @@ PHPAPI int php_idate(char format, time_t ts, int localtime TSRMLS_DC)

 		/* Swatch Beat a.k.a. Internet Time */
 		case 'B':
-			retval = (((((long)t->sse)-(((long)t->sse) - ((((long)t->sse) % 86400) + 3600))) * 10) / 864);			
+			retval = (((((long)t->sse)-(((long)t->sse) - ((((long)t->sse) % 86400) + 3600))) * 10) / 864);
 			while (retval < 0) {
 				retval += 1000;
 			}
@@ -1387,7 +1386,7 @@ PHP_FUNCTION(idate)
 	char   *format;
 	int     format_len;
 	long    ts = 0;
-	int ret; 
+	int ret;

 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|l", &format, &format_len, &ts) == FAILURE) {
 		RETURN_FALSE;
@@ -1415,7 +1414,7 @@ PHP_FUNCTION(idate)
 PHPAPI void php_date_set_tzdb(timelib_tzdb *tzdb)
 {
 	const timelib_tzdb *builtin = timelib_builtin_db();
-	
+
 	if (php_version_compare(tzdb->version, builtin->version) > 0) {
 		php_date_global_timezone_db = tzdb;
 		php_date_global_timezone_db_enabled = 1;
@@ -1486,7 +1485,7 @@ PHP_FUNCTION(strtotime)
 	}

 	if (!time_len) {
-		timelib_time_dtor(now);	
+		timelib_time_dtor(now);
 		RETURN_FALSE;
 	}

@@ -1935,7 +1934,7 @@ static void date_period_it_current_data(zend_object_iterator *iter, zval ***data
 	if (it_time->tz_info) {
 		newdateobj->time->tz_info = it_time->tz_info;
 	}
-	
+
 	*data = &iterator->current;
 }
 /* }}} */
@@ -2129,13 +2128,13 @@ static inline zend_object_value date_object_new_date_ex(zend_class_entry *class_
 	if (ptr) {
 		*ptr = intern;
 	}
-	
+
 	zend_object_std_init(&intern->std, class_type TSRMLS_CC);
 	object_properties_init(&intern->std, class_type);
-	
+
 	retval.handle = zend_objects_store_put(intern, (zend_objects_store_dtor_t)zend_objects_destroy_object, (zend_objects_free_object_storage_t) date_object_free_storage_date, NULL TSRMLS_CC);
 	retval.handlers = &date_object_handlers_date;
-	
+
 	return retval;
 }

@@ -2149,12 +2148,12 @@ static zend_object_value date_object_clone_date(zval *this_ptr TSRMLS_DC)
 	php_date_obj *new_obj = NULL;
 	php_date_obj *old_obj = (php_date_obj *) zend_object_store_get_object(this_ptr TSRMLS_CC);
 	zend_object_value new_ov = date_object_new_date_ex(old_obj->std.ce, &new_obj TSRMLS_CC);
-	
+
 	zend_objects_clone_members(&new_obj->std, new_ov, &old_obj->std, Z_OBJ_HANDLE_P(this_ptr) TSRMLS_CC);
 	if (!old_obj->time) {
 		return new_ov;
 	}
-	
+
 	/* this should probably moved to a new `timelib_time *timelime_time_clone(timelib_time *)` */
 	new_obj->time = timelib_time_ctor();
 	*new_obj->time = *old_obj->time;
@@ -2164,7 +2163,7 @@ static zend_object_value date_object_clone_date(zval *this_ptr TSRMLS_DC)
 	if (old_obj->time->tz_info) {
 		new_obj->time->tz_info = old_obj->time->tz_info;
 	}
-	
+
 	return new_ov;
 }

@@ -2281,10 +2280,10 @@ static inline zend_object_value date_object_new_timezone_ex(zend_class_entry *cl

 	zend_object_std_init(&intern->std, class_type TSRMLS_CC);
 	object_properties_init(&intern->std, class_type);
-	
+
 	retval.handle = zend_objects_store_put(intern, (zend_objects_store_dtor_t)zend_objects_destroy_object, (zend_objects_free_object_storage_t) date_object_free_storage_timezone, NULL TSRMLS_CC);
 	retval.handlers = &date_object_handlers_timezone;
-	
+
 	return retval;
 }

@@ -2298,12 +2297,12 @@ static zend_object_value date_object_clone_timezone(zval *this_ptr TSRMLS_DC)
 	php_timezone_obj *new_obj = NULL;
 	php_timezone_obj *old_obj = (php_timezone_obj *) zend_object_store_get_object(this_ptr TSRMLS_CC);
 	zend_object_value new_ov = date_object_new_timezone_ex(old_obj->std.ce, &new_obj TSRMLS_CC);
-	
+
 	zend_objects_clone_members(&new_obj->std, new_ov, &old_obj->std, Z_OBJ_HANDLE_P(this_ptr) TSRMLS_CC);
 	if (!old_obj->initialized) {
 		return new_ov;
 	}
-	
+
 	new_obj->type = old_obj->type;
 	new_obj->initialized = 1;
 	switch (new_obj->type) {
@@ -2319,7 +2318,7 @@ static zend_object_value date_object_clone_timezone(zval *this_ptr TSRMLS_DC)
 			new_obj->tzi.z.abbr       = strdup(old_obj->tzi.z.abbr);
 			break;
 	}
-	
+
 	return new_ov;
 }

@@ -2380,10 +2379,10 @@ static inline zend_object_value date_object_new_interval_ex(zend_class_entry *cl

 	zend_object_std_init(&intern->std, class_type TSRMLS_CC);
 	object_properties_init(&intern->std, class_type);
-	
+
 	retval.handle = zend_objects_store_put(intern, (zend_objects_store_dtor_t)zend_objects_destroy_object, (zend_objects_free_object_storage_t) date_object_free_storage_interval, NULL TSRMLS_CC);
 	retval.handlers = &date_object_handlers_interval;
-	
+
 	return retval;
 }

@@ -2397,7 +2396,7 @@ static zend_object_value date_object_clone_interval(zval *this_ptr TSRMLS_DC)
 	php_interval_obj *new_obj = NULL;
 	php_interval_obj *old_obj = (php_interval_obj *) zend_object_store_get_object(this_ptr TSRMLS_CC);
 	zend_object_value new_ov = date_object_new_interval_ex(old_obj->std.ce, &new_obj TSRMLS_CC);
-	
+
 	zend_objects_clone_members(&new_obj->std, new_ov, &old_obj->std, Z_OBJ_HANDLE_P(this_ptr) TSRMLS_CC);

 	/** FIX ME ADD CLONE STUFF **/
@@ -2469,10 +2468,10 @@ static inline zend_object_value date_object_new_period_ex(zend_class_entry *clas

 	zend_object_std_init(&intern->std, class_type TSRMLS_CC);
 	object_properties_init(&intern->std, class_type);
-	
+
 	retval.handle = zend_objects_store_put(intern, (zend_objects_store_dtor_t)zend_objects_destroy_object, (zend_objects_free_object_storage_t) date_object_free_storage_period, NULL TSRMLS_CC);
 	retval.handlers = &date_object_handlers_period;
-	
+
 	return retval;
 }

@@ -2486,7 +2485,7 @@ static zend_object_value date_object_clone_period(zval *this_ptr TSRMLS_DC)
 	php_period_obj *new_obj = NULL;
 	php_period_obj *old_obj = (php_period_obj *) zend_object_store_get_object(this_ptr TSRMLS_CC);
 	zend_object_value new_ov = date_object_new_period_ex(old_obj->std.ce, &new_obj TSRMLS_CC);
-	
+
 	zend_objects_clone_members(&new_obj->std, new_ov, &old_obj->std, Z_OBJ_HANDLE_P(this_ptr) TSRMLS_CC);

 	/** FIX ME ADD CLONE STUFF **/
@@ -2572,7 +2571,7 @@ PHPAPI int php_date_initialize(php_date_obj *dateobj, /*const*/ char *time_str,
 	int type = TIMELIB_ZONETYPE_ID, new_dst = 0;
 	char *new_abbr = NULL;
 	timelib_sll     new_offset;
-	
+
 	if (dateobj->time) {
 		timelib_time_dtor(dateobj->time);
 	}
@@ -2786,7 +2785,7 @@ PHP_METHOD(DateTimeImmutable, createFromMutable)
 	php_date_obj *new_obj = NULL;
 	php_date_obj *old_obj = NULL;

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "O", &datetime_object, date_ce_date) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "O!", &datetime_object, date_ce_date) == FAILURE) {
 		return;
 	}

@@ -2917,34 +2916,6 @@ PHP_METHOD(DateTime, __wakeup)
 }
 /* }}} */

-/* {{{ proto DateTime::createFromImmutable(DateTimeImmutable object)
-   Creates new DateTime object from an existing DateTimeImmutable object.
-*/
-PHP_METHOD(DateTime, createFromImmutable)
-{
-	zval *datetimeimmutable_object = NULL;
-	php_date_obj *new_obj = NULL;
-	php_date_obj *old_obj = NULL;
-
-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "O", &datetimeimmutable_object, date_ce_immutable) == FAILURE) {
-		return;
-	}
-
-	php_date_instantiate(date_ce_date, return_value TSRMLS_CC);
-	old_obj = (php_date_obj *) zend_object_store_get_object(datetimeimmutable_object TSRMLS_CC);
-	new_obj = (php_date_obj *) zend_object_store_get_object(return_value TSRMLS_CC);
-
-	new_obj->time = timelib_time_ctor();
-	*new_obj->time = *old_obj->time;
-	if (old_obj->time->tz_abbr) {
-		new_obj->time->tz_abbr = strdup(old_obj->time->tz_abbr);
-	}
-	if (old_obj->time->tz_info) {
-		new_obj->time->tz_info = old_obj->time->tz_info;
-	}
-}
-/* }}} */
-
 /* Helper function used to add an associative array of warnings and errors to a zval */
 static void zval_from_error_container(zval *z, timelib_error_container *error)
 {
@@ -2999,7 +2970,7 @@ void php_date_do_return_parsed_time(INTERNAL_FUNCTION_PARAMETERS, timelib_time *
 	PHP_DATE_PARSE_DATE_SET_TIME_ELEMENT(hour,      h);
 	PHP_DATE_PARSE_DATE_SET_TIME_ELEMENT(minute,    i);
 	PHP_DATE_PARSE_DATE_SET_TIME_ELEMENT(second,    s);
-	
+
 	if (parsed_time->f == -99999) {
 		add_assoc_bool(return_value, "fraction", 0);
 	} else {
@@ -3066,7 +3037,7 @@ PHP_FUNCTION(date_parse)
 	int                             date_len;
 	struct timelib_error_container *error;
 	timelib_time                   *parsed_time;
-	
+
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &date, &date_len) == FAILURE) {
 		RETURN_FALSE;
 	}
@@ -3085,7 +3056,7 @@ PHP_FUNCTION(date_parse_from_format)
 	int                             date_len, format_len;
 	struct timelib_error_container *error;
 	timelib_time                   *parsed_time;
-	
+
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ss", &format, &format_len, &date, &date_len) == FAILURE) {
 		RETURN_FALSE;
 	}
@@ -3569,7 +3540,7 @@ static void php_date_isodate_set(zval *object, long y, long w, long d, zval *ret
 	memset(&dateobj->time->relative, 0, sizeof(dateobj->time->relative));
 	dateobj->time->relative.d = timelib_daynr_from_weeknr(y, w, d);
 	dateobj->time->have_relative = 1;
-	
+
 	timelib_update_ts(dateobj->time, NULL);
 }

@@ -3711,12 +3682,17 @@ PHP_FUNCTION(date_diff)
 }
 /* }}} */

-static int timezone_initialize(php_timezone_obj *tzobj, /*const*/ char *tz TSRMLS_DC)
+static int timezone_initialize(php_timezone_obj *tzobj, /*const*/ char *tz, size_t tz_len TSRMLS_DC)
 {
 	timelib_time *dummy_t = ecalloc(1, sizeof(timelib_time));
 	int           dst, not_found;
 	char         *orig_tz = tz;

+	if (strlen(tz) != tz_len) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Timezone must not contain null bytes");
+		return FAILURE;
+	}
+
 	dummy_t->z = timelib_parse_zone(&tz, &dst, dummy_t, &not_found, DATE_TIMEZONEDB, php_date_parse_tzfile_wrapper);
 	if (not_found) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unknown or bad timezone (%s)", orig_tz);
@@ -3743,7 +3719,7 @@ PHP_FUNCTION(timezone_open)
 		RETURN_FALSE;
 	}
 	tzobj = zend_object_store_get_object(php_date_instantiate(date_ce_timezone, return_value TSRMLS_CC) TSRMLS_CC);
-	if (SUCCESS != timezone_initialize(tzobj, tz TSRMLS_CC)) {
+	if (SUCCESS != timezone_initialize(tzobj, tz, tz_len TSRMLS_CC)) {
 		RETURN_FALSE;
 	}
 }
@@ -3758,11 +3734,11 @@ PHP_METHOD(DateTimeZone, __construct)
 	int tz_len;
 	php_timezone_obj *tzobj;
 	zend_error_handling error_handling;
-	
+
 	zend_replace_error_handling(EH_THROW, NULL, &error_handling TSRMLS_CC);
 	if (SUCCESS == zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &tz, &tz_len)) {
 		tzobj = zend_object_store_get_object(getThis() TSRMLS_CC);
-		if (FAILURE == timezone_initialize(tzobj, tz TSRMLS_CC)) {
+		if (FAILURE == timezone_initialize(tzobj, tz, tz_len TSRMLS_CC)) {
 			ZVAL_NULL(getThis());
 		}
 	}
@@ -3777,7 +3753,7 @@ static int php_date_timezone_initialize_from_hash(zval **return_value, php_timez

 	if (zend_hash_find(myht, "timezone_type", 14, (void**) &z_timezone_type) == SUCCESS && Z_TYPE_PP(z_timezone_type) == IS_LONG) {
 		if (zend_hash_find(myht, "timezone", 9, (void**) &z_timezone) == SUCCESS && Z_TYPE_PP(z_timezone) == IS_STRING) {
-			if (SUCCESS == timezone_initialize(*tzobj, Z_STRVAL_PP(z_timezone) TSRMLS_CC)) {
+			if (SUCCESS == timezone_initialize(*tzobj, Z_STRVAL_PP(z_timezone), Z_STRLEN_PP(z_timezone) TSRMLS_CC)) {
 				return SUCCESS;
 			}
 		}
@@ -3959,7 +3935,7 @@ PHP_FUNCTION(timezone_transitions_get)
 		add_assoc_string(element, "abbr", &tzobj->tzi.tz->timezone_abbr[tzobj->tzi.tz->type[tzobj->tzi.tz->trans_idx[i]].abbr_idx], 1); \
 		add_next_index_zval(return_value, element);

-#define add_last() add(tzobj->tzi.tz->timecnt - 1, timestamp_begin)
+#define add_last() add(tzobj->tzi.tz->bit32.timecnt - 1, timestamp_begin)

 	array_init(return_value);

@@ -3970,7 +3946,7 @@ PHP_FUNCTION(timezone_transitions_get)
 	} else {
 		begin = 0;
 		found = 0;
-		if (tzobj->tzi.tz->timecnt > 0) {
+		if (tzobj->tzi.tz->bit32.timecnt > 0) {
 			do {
 				if (tzobj->tzi.tz->trans[begin] > timestamp_begin) {
 					if (begin > 0) {
@@ -3982,18 +3958,18 @@ PHP_FUNCTION(timezone_transitions_get)
 					break;
 				}
 				begin++;
-			} while (begin < tzobj->tzi.tz->timecnt);
+			} while (begin < tzobj->tzi.tz->bit32.timecnt);
 		}
 	}

 	if (!found) {
-		if (tzobj->tzi.tz->timecnt > 0) {
+		if (tzobj->tzi.tz->bit32.timecnt > 0) {
 			add_last();
 		} else {
 			add_nominal();
 		}
 	} else {
-		for (i = begin; i < tzobj->tzi.tz->timecnt; ++i) {
+		for (i = begin; i < tzobj->tzi.tz->bit32.timecnt; ++i) {
 			if (tzobj->tzi.tz->trans[i] < timestamp_end) {
 				add(i, tzobj->tzi.tz->trans[i]);
 			}
@@ -4036,7 +4012,7 @@ static int date_interval_initialize(timelib_rel_time **rt, /*const*/ char *forma
 	struct timelib_error_container *errors;

 	timelib_strtointerval(format, format_length, &b, &e, &p, &r, &errors);
-	
+
 	if (errors->error_count > 0) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unknown or bad format (%s)", format);
 		retval = FAILURE;
@@ -4195,7 +4171,7 @@ PHP_METHOD(DateInterval, __construct)
 	php_interval_obj *diobj;
 	timelib_rel_time *reltime;
 	zend_error_handling error_handling;
-	
+
 	zend_replace_error_handling(EH_THROW, NULL, &error_handling TSRMLS_CC);
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &interval_string, &interval_string_length) == SUCCESS) {
 		if (date_interval_initialize(&reltime, interval_string, interval_string_length TSRMLS_CC) == SUCCESS) {
@@ -4218,8 +4194,7 @@ static int php_date_interval_initialize_from_hash(zval **return_value, php_inter
 #define PHP_DATE_INTERVAL_READ_PROPERTY(element, member, itype, def) \
 	do { \
 		zval **z_arg = NULL; \
-		if (zend_hash_find(myht, element, strlen(element) + 1, (void**) &z_arg) == SUCCESS) { \
-			convert_to_long(*z_arg); \
+		if (zend_hash_find(myht, element, strlen(element) + 1, (void**) &z_arg) == SUCCESS && Z_TYPE_PP(z_arg) == IS_LONG) { \
 			(*intobj)->diff->member = (itype)Z_LVAL_PP(z_arg); \
 		} else { \
 			(*intobj)->diff->member = (itype)def; \
@@ -4230,8 +4205,15 @@ static int php_date_interval_initialize_from_hash(zval **return_value, php_inter
 	do { \
 		zval **z_arg = NULL; \
 		if (zend_hash_find(myht, element, strlen(element) + 1, (void**) &z_arg) == SUCCESS) { \
-			convert_to_string(*z_arg); \
-			DATE_A64I((*intobj)->diff->member, Z_STRVAL_PP(z_arg)); \
+			if (Z_TYPE_PP(z_arg) == IS_STRING) { \
+				DATE_A64I((*intobj)->diff->member, Z_STRVAL_PP(z_arg)); \
+			} else if (Z_TYPE_PP(z_arg) == IS_LONG || Z_TYPE_PP(z_arg) == IS_BOOL) { \
+				(*intobj)->diff->member = (timelib_sll)Z_LVAL_PP(z_arg); \
+			} else if (Z_TYPE_PP(z_arg) == IS_DOUBLE) { \
+				(*intobj)->diff->member = (timelib_sll)Z_DVAL_PP(z_arg); \
+			} else { \
+				(*intobj)->diff->member = -1LL; \
+			} \
 		} else { \
 			(*intobj)->diff->member = -1LL; \
 		} \
@@ -4409,7 +4391,7 @@ static int date_period_initialize(timelib_time **st, timelib_time **et, timelib_
 	struct timelib_error_container *errors;

 	timelib_strtointerval(format, format_length, &b, &e, &p, &r, &errors);
-	
+
 	if (errors->error_count > 0) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unknown or bad format (%s)", format);
 		retval = FAILURE;
@@ -4438,7 +4420,7 @@ PHP_METHOD(DatePeriod, __construct)
 	int   isostr_len = 0;
 	timelib_time *clone;
 	zend_error_handling error_handling;
-	
+
 	zend_replace_error_handling(EH_THROW, NULL, &error_handling TSRMLS_CC);
 	if (zend_parse_parameters_ex(ZEND_PARSE_PARAMS_QUIET, ZEND_NUM_ARGS() TSRMLS_CC, "OOl|l", &start, date_ce_interface, &interval, date_ce_interval, &recurrences, &options) == FAILURE) {
 		if (zend_parse_parameters_ex(ZEND_PARSE_PARAMS_QUIET, ZEND_NUM_ARGS() TSRMLS_CC, "OOO|l", &start, date_ce_interface, &interval, date_ce_interval, &end, date_ce_interface, &options) == FAILURE) {
@@ -4628,7 +4610,7 @@ PHP_FUNCTION(timezone_identifiers_list)
 	tzdb = DATE_TIMEZONEDB;
 	item_count = tzdb->index_size;
 	table = tzdb->index;
-	
+
 	array_init(return_value);

 	for (i = 0; i < item_count; ++i) {
@@ -4662,7 +4644,7 @@ PHP_FUNCTION(timezone_abbreviations_list)
 {
 	const timelib_tz_lookup_table *table, *entry;
 	zval                          *element, **abbr_array_pp, *abbr_array;
-	
+
 	table = timelib_timezone_abbreviations_list();
 	array_init(return_value);
 	entry = table;
@@ -4738,11 +4720,11 @@ static void php_do_date_sunrise_sunset(INTERNAL_FUNCTION_PARAMETERS, int calc_su
 	timelib_time   *t;
 	timelib_tzinfo *tzi;
 	char           *retstr;
-	
+
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "l|ldddd", &time, &retformat, &latitude, &longitude, &zenith, &gmt_offset) == FAILURE) {
 		RETURN_FALSE;
 	}
-	
+
 	switch (ZEND_NUM_ARGS()) {
 		case 1:
 			retformat = SUNFUNCS_RET_STRING;
@@ -4786,7 +4768,7 @@ static void php_do_date_sunrise_sunset(INTERNAL_FUNCTION_PARAMETERS, int calc_su
 	timelib_unixtime2local(t, time);
 	rs = timelib_astro_rise_set_altitude(t, longitude, latitude, altitude, 1, &h_rise, &h_set, &rise, &set, &transit);
 	timelib_time_dtor(t);
-	
+
 	if (rs != 0) {
 		RETURN_FALSE;
 	}
@@ -4840,7 +4822,7 @@ PHP_FUNCTION(date_sun_info)
 	timelib_sll     rise, set, transit;
 	int             dummy;
 	double          ddummy;
-	
+
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ldd", &time, &latitude, &longitude) == FAILURE) {
 		RETURN_FALSE;
 	}
@@ -4854,7 +4836,7 @@ PHP_FUNCTION(date_sun_info)
 	/* Setup */
 	t2 = timelib_time_ctor();
 	array_init(return_value);
-	
+
 	/* Get sun up/down and transit */
 	rs = timelib_astro_rise_set_altitude(t, longitude, latitude, -35.0/60, 1, &ddummy, &ddummy, &rise, &set, &transit);
 	switch (rs) {
@@ -4998,7 +4980,7 @@ static HashTable *date_object_get_properties_period(zval *object TSRMLS_DC)
 		ZVAL_NULL(zv);
 	}
 	zend_hash_update(props, "interval", sizeof("interval"), &zv, sizeof(zv), NULL);
-	
+
 	/* converted to larger type (int->long); must check when unserializing */
 	MAKE_STD_ZVAL(zv);
 	ZVAL_LONG(zv, (long) period_obj->recurrences);
@@ -5081,7 +5063,7 @@ static int php_date_period_initialize_from_hash(php_period_obj *period_obj, Hash
 	}

 	period_obj->initialized = 1;
-	
+
 	return 1;
 }

@@ -5098,7 +5080,7 @@ PHP_METHOD(DatePeriod, __set_state)
 	}

 	myht = Z_ARRVAL_P(array);
-	
+
 	object_init_ex(return_value, date_ce_period);
 	period_obj = zend_object_store_get_object(return_value TSRMLS_CC);
 	if (!php_date_period_initialize_from_hash(period_obj, myht TSRMLS_CC)) {
@@ -50,7 +50,6 @@ PHP_FUNCTION(getdate);
 PHP_METHOD(DateTime, __construct);
 PHP_METHOD(DateTime, __wakeup);
 PHP_METHOD(DateTime, __set_state);
-PHP_METHOD(DateTime, createFromImmutable);
 PHP_FUNCTION(date_create);
 PHP_FUNCTION(date_create_immutable);
 PHP_FUNCTION(date_create_from_format);
@@ -16,7 +16,7 @@ date_default_timezone_set("Europe/London");
 // Create a DateTimeZone object
 $tz = new DateTimeZone("Europe/London");

-$tran = $tz->getTransitions();
+$tran = $tz->getTransitions(-306972000, -37241999);

 if (!is_array($tran)) {
 	echo "TEST FAILED: Expected an array\n";
@@ -25,14 +25,14 @@ if (!is_array($tran)) {
 echo "\n-- Total number of transitions: " . count($tran). " --\n"; 

 echo "\n-- Format a sample entry for Spring 1963 --\n";
-var_dump( $tran[97] );	
+var_dump( $tran[6] );

 ?>
 ===DONE===
 --EXPECT--
 *** Testing DateTimeZone::getTransitions() : basic functionality ***

-- Total number of transitions: 243 --
+-- Total number of transitions: 18 --

 -- Format a sample entry for Spring 1963 --
 array(5) {
@@ -10,6 +10,6 @@ define('PHPT_DATETIME_SHOW', PHPT_DATETIME_SHOW_ADD);
 require 'DateTime_data-massive.inc';

 ?>
--EXPECT--
-test_massive_positive: ADD: -333333-01-01 16:18:02 EST + P+666666Y0M0DT0H0M0S = **333333-01-01 16:18:02 EST**
-test_massive_negative: ADD: 333333-01-01 16:18:02 EST + P-666666Y0M0DT0H0M0S = **-333333-01-01 16:18:02 EST**
+--EXPECTF--
+test_massive_positive: ADD: -333333-01-01 16:18:02 %s + P+666666Y0M0DT0H0M0S = **333333-01-01 16:18:02 %s**
+test_massive_negative: ADD: 333333-01-01 16:18:02 %s + P-666666Y0M0DT0H0M0S = **-333333-01-01 16:18:02 %s**
@@ -1,26 +0,0 @@
--TEST--
-Tests for DateTime::createFromImmutable.
--INI--
-date.timezone=America/New_York
--FILE--
-<?php
-$current = "2015-03-05 07:00:16";
-
-$i = DateTime::createFromImmutable(date_create_immutable($current));
-var_dump($i);
-
-$i = DateTime::createFromImmutable(date_create($current));
-var_dump($i);
-?>
--EXPECTF--
-object(DateTime)#%d (3) {
-  ["date"]=>
-  string(26) "2015-03-05 07:00:16.000000"
-  ["timezone_type"]=>
-  int(3)
-  ["timezone"]=>
-  string(16) "America/New_York"
-}
-
-Warning: DateTime::createFromImmutable() expects parameter 1 to be DateTimeImmutable, object given in %stests%eDateTime_createFromImmutable.php on line %d
-NULL
@@ -10,6 +10,6 @@ define('PHPT_DATETIME_SHOW', PHPT_DATETIME_SHOW_DIFF);
 require 'DateTime_data-massive.inc';

 ?>
--EXPECT--
-test_massive_positive: DIFF: 333333-01-01 16:18:02 EST - -333333-01-01 16:18:02 EST = **P+666666Y0M0DT0H0M0S**
-test_massive_negative: DIFF: -333333-01-01 16:18:02 EST - 333333-01-01 16:18:02 EST = **P-666666Y0M0DT0H0M0S**
+--EXPECTF--
+test_massive_positive: DIFF: 333333-01-01 16:18:02 %s - -333333-01-01 16:18:02 %s = **P+666666Y0M0DT0H%s**
+test_massive_negative: DIFF: -333333-01-01 16:18:02 %s - 333333-01-01 16:18:02 %s = **P-666666Y0M0DT0H%s**
@@ -10,6 +10,6 @@ define('PHPT_DATETIME_SHOW', PHPT_DATETIME_SHOW_SUB);
 require 'DateTime_data-massive.inc';

 ?>
--EXPECT--
-test_massive_positive: SUB: 333333-01-01 16:18:02 EST - P+666666Y0M0DT0H0M0S = **-333333-01-01 16:18:02 EST**
-test_massive_negative: SUB: -333333-01-01 16:18:02 EST - P-666666Y0M0DT0H0M0S = **333333-01-01 16:18:02 EST**
+--EXPECTF--
+test_massive_positive: SUB: 333333-01-01 16:18:02 %s - P+666666Y0M0DT0H0M0S = **-333333-01-01 16:18:02 %s**
+test_massive_negative: SUB: -333333-01-01 16:18:02 %s - P-666666Y0M0DT0H0M0S = **333333-01-01 16:18:02 %s**
@@ -27,7 +27,7 @@ object(ReflectionClass)#%d (1) {
  string(8) "DateTime"
 }
 ..and get names of all its methods
-array(19) {
+array(18) {
  [0]=>
  &object(ReflectionMethod)#%d (2) {
    ["name"]=>
@@ -52,109 +52,102 @@ array(19) {
  [3]=>
  &object(ReflectionMethod)#%d (2) {
    ["name"]=>
-    string(19) "createFromImmutable"
+    string(16) "createFromFormat"
    ["class"]=>
    string(8) "DateTime"
  }
  [4]=>
  &object(ReflectionMethod)#%d (2) {
    ["name"]=>
-    string(16) "createFromFormat"
+    string(13) "getLastErrors"
    ["class"]=>
    string(8) "DateTime"
  }
  [5]=>
  &object(ReflectionMethod)#%d (2) {
    ["name"]=>
-    string(13) "getLastErrors"
+    string(6) "format"
    ["class"]=>
    string(8) "DateTime"
  }
  [6]=>
  &object(ReflectionMethod)#%d (2) {
    ["name"]=>
-    string(6) "format"
+    string(6) "modify"
    ["class"]=>
    string(8) "DateTime"
  }
  [7]=>
  &object(ReflectionMethod)#%d (2) {
    ["name"]=>
-    string(6) "modify"
+    string(3) "add"
    ["class"]=>
    string(8) "DateTime"
  }
  [8]=>
  &object(ReflectionMethod)#%d (2) {
    ["name"]=>
-    string(3) "add"
+    string(3) "sub"
    ["class"]=>
    string(8) "DateTime"
  }
  [9]=>
  &object(ReflectionMethod)#%d (2) {
    ["name"]=>
-    string(3) "sub"
+    string(11) "getTimezone"
    ["class"]=>
    string(8) "DateTime"
  }
  [10]=>
  &object(ReflectionMethod)#%d (2) {
    ["name"]=>
-    string(11) "getTimezone"
+    string(11) "setTimezone"
    ["class"]=>
    string(8) "DateTime"
  }
  [11]=>
  &object(ReflectionMethod)#%d (2) {
    ["name"]=>
-    string(11) "setTimezone"
+    string(9) "getOffset"
    ["class"]=>
    string(8) "DateTime"
  }
  [12]=>
  &object(ReflectionMethod)#%d (2) {
    ["name"]=>
-    string(9) "getOffset"
+    string(7) "setTime"
    ["class"]=>
    string(8) "DateTime"
  }
  [13]=>
  &object(ReflectionMethod)#%d (2) {
    ["name"]=>
-    string(7) "setTime"
+    string(7) "setDate"
    ["class"]=>
    string(8) "DateTime"
  }
  [14]=>
  &object(ReflectionMethod)#%d (2) {
    ["name"]=>
-    string(7) "setDate"
+    string(10) "setISODate"
    ["class"]=>
    string(8) "DateTime"
  }
  [15]=>
  &object(ReflectionMethod)#%d (2) {
    ["name"]=>
-    string(10) "setISODate"
+    string(12) "setTimestamp"
    ["class"]=>
    string(8) "DateTime"
  }
  [16]=>
-  &object(ReflectionMethod)#%d (2) {
-    ["name"]=>
-    string(12) "setTimestamp"
-    ["class"]=>
-    string(8) "DateTime"
-  }
-  [17]=>
  &object(ReflectionMethod)#%d (2) {
    ["name"]=>
    string(12) "getTimestamp"
    ["class"]=>
    string(8) "DateTime"
  }
-  [18]=>
+  [17]=>
  &object(ReflectionMethod)#%d (2) {
    ["name"]=>
    string(4) "diff"
@@ -20,10 +20,10 @@ array(5) {
  ["time"]=>
  string(%d) "%s"
  ["offset"]=>
-  int(3600)
+  int(%s)
  ["isdst"]=>
-  bool(true)
+  bool(%s)
  ["abbr"]=>
-  string(3) "BST"
+  string(%d) "%s"
 }
 10000002008-02-28T12:00:00+0000
@@ -14,17 +14,17 @@ var_dump($di);
 --EXPECTF--
 object(DateInterval)#%d (15) {
  ["y"]=>
-  int(2)
+  int(-1)
  ["m"]=>
-  int(0)
+  int(-1)
  ["d"]=>
-  int(0)
+  int(-1)
  ["h"]=>
-  int(6)
+  int(-1)
  ["i"]=>
-  int(8)
+  int(-1)
  ["s"]=>
-  int(0)
+  int(-1)
  ["weekday"]=>
  int(10)
  ["weekday_behavior"]=>
@@ -14,17 +14,17 @@ var_dump($di);
 --EXPECTF--
 object(DateInterval)#%d (15) {
  ["y"]=>
-  int(2)
+  int(-1)
  ["m"]=>
-  int(0)
+  int(-1)
  ["d"]=>
-  int(0)
+  int(-1)
  ["h"]=>
-  int(6)
+  int(-1)
  ["i"]=>
-  int(8)
+  int(-1)
  ["s"]=>
-  int(0)
+  int(-1)
  ["weekday"]=>
  int(10)
  ["weekday_behavior"]=>
@@ -1,5 +1,5 @@
 --TEST--
-Bug #66986 (Some timezones are no longer valid in PHP 5.5.10)
+Bug #66985 (Some timezones are no longer valid in PHP 5.5.10)
 --FILE--
 <?php
 $zones = array(
@@ -6,4 +6,4 @@ $data = unserialize('a:2:{i:0;O:12:"DateTimeZone":2:{s:13:"timezone_type";a:2:{i
 var_dump($data);
 ?>
 --EXPECTF--
-Fatal error: DateTimeZone::__wakeup(): Timezone initialization failed in %s/bug68942.php on line %d
+Fatal error: DateTimeZone::__wakeup(): Timezone initialization failed in %s%ebug68942.php on line %d
@@ -6,4 +6,4 @@ $data = unserialize('a:2:{i:0;O:8:"DateTime":3:{s:4:"date";s:26:"2000-01-01 00:0
 var_dump($data);
 ?>
 --EXPECTF--
-Fatal error: Invalid serialization data for DateTime object in %s/bug68942_2.php on line %d
+Fatal error: Invalid serialization data for DateTime object in %s%ebug68942_2.php on line %d
@@ -0,0 +1,8 @@
+--TEST--
+Bug #70266 (DateInterval::__construct.interval_spec is not supposed to be optional)
+--FILE--
+<?php
+var_dump((new ReflectionParameter(['DateInterval', '__construct'], 0))->isOptional());
+?>
+--EXPECT--
+bool(false)
@@ -0,0 +1,17 @@
+--TEST--
+Bug #70277 (new DateTimeZone($foo) is ignoring text after null byte)
+--FILE--
+<?php
+$timezone = "Europe/Zurich\0Foo";
+var_dump(timezone_open($timezone));
+var_dump(new DateTimeZone($timezone));
+?>
+--EXPECTF--
+Warning: timezone_open(): Timezone must not contain null bytes in %sbug70277.php on line %d
+bool(false)
+
+Fatal error: Uncaught exception 'Exception' with message 'DateTimeZone::__construct(): Timezone must not contain null bytes' in %sbug70277.php:%d
+Stack trace:
+#0 %sbug70277.php(%d): DateTimeZone->__construct('Europe/Zurich\x00F...')
+#1 {main}
+  thrown in %sbug70277.php on line %d
@@ -27,7 +27,7 @@ var_dump( getdate($timestamp) );
 -- Testing getdate\(\) function by passing float 12.3456789000e10 value to timestamp --
 array\(11\) {
  \["seconds"\]=>
-  int\((36|0)\)
+  int\((.+)\)
  \["minutes"\]=>
  int\((43|0)\)
  \["hours"\]=>
@@ -53,7 +53,7 @@ array\(11\) {
 -- Testing getdate\(\) function by passing float -12.3456789000e10 value to timestamp --
 array\(11\) {
  \["seconds"\]=>
-  int\((44|12|20)\)
+  int\((.+)\)
  \["minutes"\]=>
  int\((39|23)\)
  \["hours"\]=>
@@ -61,7 +61,7 @@ array\(11\) {
  \["mday"\]=>
  int\((9|14|23)\)
  \["wday"\]=>
-  int\(0\)
+  int\((0|6)\)
  \["mon"\]=>
  int\((10|12)\)
  \["year"\]=>
@@ -69,7 +69,7 @@ array\(11\) {
  \["yday"\]=>
  int\((282|347|295)\)
  \["weekday"\]=>
-  string\(6\) "Sunday"
+  string\((6|8)\) "(Sunday|Saturday)"
  \["month"\]=>
  string\((7|8)\) "(October|December)"
  \[0\]=>
@@ -87,7 +87,7 @@ array\(9\) {
  \[5\]=>
  int\((104|1|-3843)\)
  \[6\]=>
-  int\(6\)
+  int\((5|6)\)
  \[7\]=>
  int\((281|346|294)\)
  \[8\]=>
@@ -107,7 +107,7 @@ array\(9\) {
  \["tm_year"\]=>
  int\((104|1|-3843)\)
  \["tm_wday"\]=>
-  int\(6\)
+  int\((5|6)\)
  \["tm_yday"\]=>
  int\((281|346|294)\)
  \["tm_isdst"\]=>
@@ -24,7 +24,7 @@ foreach ($tzs as $tz) {
 	echo "\n";
 }
 ?>
--EXPECT--
+--EXPECTF--
 America/Toronto
 Y:    0 - January 2000-01-01T01:01:01-0500
 Y:   69 - January 2069-01-01T01:01:01-0500
@@ -32,11 +32,11 @@ Y:   70 - January 1970-01-01T01:01:01-0500
 Y:   71 - January 1971-01-01T01:01:01-0500
 Y:   99 - January 1999-01-01T01:01:01-0500
 Y:  100 - January 2000-01-01T01:01:01-0500
-Y:  101 - January 0101-01-01T01:01:01-0500
-Y:  105 - January 0105-01-01T01:01:01-0500
-Y:  110 - January 0110-01-01T01:01:01-0500
-Y: 1900 - January 1900-01-01T01:01:01-0500
-Y: 1901 - January 1901-01-01T01:01:01-0500
+Y:  101 - January 0101-01-01T01:01:01-0%d
+Y:  105 - January 0105-01-01T01:01:01-0%d
+Y:  110 - January 0110-01-01T01:01:01-0%d
+Y: 1900 - January 1900-01-01T01:01:01-0%d
+Y: 1901 - January 1901-01-01T01:01:01-0%d
 Y: 1902 - January 1902-01-01T01:01:01-0500
 Y: 1999 - January 1999-01-01T01:01:01-0500
 Y: 2000 - January 2000-01-01T01:01:01-0500
@@ -49,11 +49,11 @@ Y:   70 - January 1970-01-01T01:01:01+0100
 Y:   71 - January 1971-01-01T01:01:01+0100
 Y:   99 - January 1999-01-01T01:01:01+0100
 Y:  100 - January 2000-01-01T01:01:01+0100
-Y:  101 - January 0101-01-01T01:01:01+0100
-Y:  105 - January 0105-01-01T01:01:01+0100
-Y:  110 - January 0110-01-01T01:01:01+0100
-Y: 1900 - January 1900-01-01T01:01:01+0100
-Y: 1901 - January 1901-01-01T01:01:01+0100
+Y:  101 - January 0101-01-01T01:01:01+0%d
+Y:  105 - January 0105-01-01T01:01:01+0%d
+Y:  110 - January 0110-01-01T01:01:01+0%d
+Y: 1900 - January 1900-01-01T01:01:01+0%d
+Y: 1901 - January 1901-01-01T01:01:01+0%d
 Y: 1902 - January 1902-01-01T01:01:01+0100
 Y: 1999 - January 1999-01-01T01:01:01+0100
 Y: 2000 - January 2000-01-01T01:01:01+0100
@@ -18,24 +18,24 @@ $tz = timezone_open("Europe/London");

 $tran = timezone_transitions_get($tz);

-echo "\n-- Get all transitions --\n"; 
-$tran = timezone_transitions_get($tz);
+echo "\n-- Get all 60s transitions --\n";
+$tran = timezone_transitions_get($tz, -306972000, -37241999);
 var_dump( gettype($tran) );

 echo "\n-- Total number of transitions: " . count($tran). " --\n"; 

 echo "\n-- Format a sample entry pfor Spring 1963 --\n";
-var_dump( $tran[97] );	
+var_dump( $tran[6] );

 ?>
 ===DONE===
 --EXPECT--
 *** Testing timezone_transitions_get() : basic functionality ***

-- Get all transitions --
+-- Get all 60s transitions --
 string(5) "array"

-- Total number of transitions: 243 --
+-- Total number of transitions: 18 --

 -- Format a sample entry pfor Spring 1963 --
 array(5) {
@@ -914,7 +914,7 @@ static void php_dba_open(INTERNAL_FUNCTION_PARAMETERS, int persistent)
 				RETURN_FALSE;
 #ifdef F_SETFL
 			} else if (modenr == DBA_CREAT) {
-				int flags = fcntl(info->fd, F_SETFL);
+				int flags = fcntl(info->fd, F_GETFL);
 				fcntl(info->fd, F_SETFL, flags & ~O_APPEND);
 #endif
 			}
@@ -187,10 +187,10 @@ ZEND_END_ARG_INFO();
 /* }}} */

 /*
-* class DOMDocument extends DOMNode 
+* class DOMDocument extends DOMNode
 *
 * URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-i-Document
-* Since: 
+* Since:
 */

 const zend_function_entry php_dom_document_class_functions[] = { /* {{{ */
@@ -235,10 +235,10 @@ const zend_function_entry php_dom_document_class_functions[] = { /* {{{ */
 };
 /* }}} */

-/* {{{ docType	DOMDocumentType	
-readonly=yes 
+/* {{{ docType	DOMDocumentType
+readonly=yes
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-B63ED1A31
-Since: 
+Since:
 */
 int dom_document_doctype_read(dom_object *obj, zval **retval TSRMLS_DC)
 {
@@ -266,15 +266,15 @@ int dom_document_doctype_read(dom_object *obj, zval **retval TSRMLS_DC)
 		return FAILURE;
 	}
 	return SUCCESS;
-	
+
 }

 /* }}} */

-/* {{{ implementation	DOMImplementation	
-readonly=yes 
+/* {{{ implementation	DOMImplementation
+readonly=yes
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-1B793EBA
-Since: 
+Since:
 */
 int dom_document_implementation_read(dom_object *obj, zval **retval TSRMLS_DC)
 {
@@ -285,10 +285,10 @@ int dom_document_implementation_read(dom_object *obj, zval **retval TSRMLS_DC)

 /* }}} */

-/* {{{ documentElement	DOMElement	
-readonly=yes 
+/* {{{ documentElement	DOMElement
+readonly=yes
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-87CD092
-Since: 
+Since:
 */
 int dom_document_document_element_read(dom_object *obj, zval **retval TSRMLS_DC)
 {
@@ -384,8 +384,8 @@ int dom_document_encoding_write(dom_object *obj, zval *newval TSRMLS_DC)

 /* }}} */

-/* {{{ standalone	boolean	
-readonly=no 
+/* {{{ standalone	boolean
+readonly=no
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-Document3-standalone
 Since: DOM Level 3
 */
@@ -443,7 +443,7 @@ int dom_document_standalone_write(dom_object *obj, zval *newval TSRMLS_DC)

 /* }}} */

-/* {{{ version	string	
+/* {{{ version	string
 readonly=no
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-Document3-version
 Since: DOM Level 3
@@ -501,8 +501,8 @@ int dom_document_version_write(dom_object *obj, zval *newval TSRMLS_DC)

 /* }}} */

-/* {{{ strictErrorChecking	boolean	
-readonly=no 
+/* {{{ strictErrorChecking	boolean
+readonly=no
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-Document3-strictErrorChecking
 Since: DOM Level 3
 */
@@ -541,7 +541,7 @@ int dom_document_strict_error_checking_write(dom_object *obj, zval *newval TSRML

 /* }}} */

-/* {{{ formatOutput	boolean	
+/* {{{ formatOutput	boolean
 readonly=no
 */
 int dom_document_format_output_read(dom_object *obj, zval **retval TSRMLS_DC)
@@ -578,7 +578,7 @@ int dom_document_format_output_write(dom_object *obj, zval *newval TSRMLS_DC)
 }
 /* }}} */

-/* {{{ validateOnParse	boolean	
+/* {{{ validateOnParse	boolean
 readonly=no
 */
 int	dom_document_validate_on_parse_read(dom_object *obj, zval **retval TSRMLS_DC)
@@ -615,7 +615,7 @@ int dom_document_validate_on_parse_write(dom_object *obj, zval *newval TSRMLS_DC
 }
 /* }}} */

-/* {{{ resolveExternals	boolean	
+/* {{{ resolveExternals	boolean
 readonly=no
 */
 int dom_document_resolve_externals_read(dom_object *obj, zval **retval TSRMLS_DC)
@@ -652,7 +652,7 @@ int dom_document_resolve_externals_write(dom_object *obj, zval *newval TSRMLS_DC
 }
 /* }}} */

-/* {{{ preserveWhiteSpace	boolean	
+/* {{{ preserveWhiteSpace	boolean
 readonly=no
 */
 int dom_document_preserve_whitespace_read(dom_object *obj, zval **retval TSRMLS_DC)
@@ -689,7 +689,7 @@ int dom_document_preserve_whitespace_write(dom_object *obj, zval *newval TSRMLS_
 }
 /* }}} */

-/* {{{ recover	boolean	
+/* {{{ recover	boolean
 readonly=no
 */
 int dom_document_recover_read(dom_object *obj, zval **retval TSRMLS_DC)
@@ -726,7 +726,7 @@ int dom_document_recover_write(dom_object *obj, zval *newval TSRMLS_DC)
 }
 /* }}} */

-/* {{{ substituteEntities	boolean	
+/* {{{ substituteEntities	boolean
 readonly=no
 */
 int dom_document_substitue_entities_read(dom_object *obj, zval **retval TSRMLS_DC)
@@ -763,8 +763,8 @@ int dom_document_substitue_entities_write(dom_object *obj, zval *newval TSRMLS_D
 }
 /* }}} */

-/* {{{ documentURI	string	
-readonly=no 
+/* {{{ documentURI	string
+readonly=no
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-Document3-documentURI
 Since: DOM Level 3
 */
@@ -820,8 +820,8 @@ int dom_document_document_uri_write(dom_object *obj, zval *newval TSRMLS_DC)

 /* }}} */

-/* {{{ config	DOMConfiguration	
-readonly=yes 
+/* {{{ config	DOMConfiguration
+readonly=yes
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-Document3-config
 Since: DOM Level 3
 */
@@ -836,7 +836,7 @@ int dom_document_config_read(dom_object *obj, zval **retval TSRMLS_DC)

 /* {{{ proto DOMElement dom_document_create_element(string tagName [, string value]);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-2141741547
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_element)
 {
@@ -869,7 +869,7 @@ PHP_FUNCTION(dom_document_create_element)

 /* {{{ proto DOMDocumentFragment dom_document_create_document_fragment();
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-35CB04B5
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_document_fragment)
 {
@@ -896,7 +896,7 @@ PHP_FUNCTION(dom_document_create_document_fragment)

 /* {{{ proto DOMText dom_document_create_text_node(string data);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-1975348127
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_text_node)
 {
@@ -924,7 +924,7 @@ PHP_FUNCTION(dom_document_create_text_node)

 /* {{{ proto DOMComment dom_document_create_comment(string data);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-1334481328
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_comment)
 {
@@ -952,7 +952,7 @@ PHP_FUNCTION(dom_document_create_comment)

 /* {{{ proto DOMCdataSection dom_document_create_cdatasection(string data);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-D26C0AF8
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_cdatasection)
 {
@@ -980,7 +980,7 @@ PHP_FUNCTION(dom_document_create_cdatasection)

 /* {{{ proto DOMProcessingInstruction dom_document_create_processing_instruction(string target, string data);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-135944439
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_processing_instruction)
 {
@@ -1015,7 +1015,7 @@ PHP_FUNCTION(dom_document_create_processing_instruction)

 /* {{{ proto DOMAttr dom_document_create_attribute(string name);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-1084891198
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_attribute)
 {
@@ -1049,7 +1049,7 @@ PHP_FUNCTION(dom_document_create_attribute)

 /* {{{ proto DOMEntityReference dom_document_create_entity_reference(string name);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-392B75AE
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_create_entity_reference)
 {
@@ -1082,7 +1082,7 @@ PHP_FUNCTION(dom_document_create_entity_reference)

 /* {{{ proto DOMNodeList dom_document_get_elements_by_tag_name(string tagname);
 URL: http://www.w3.org/TR/2003/WD-DOM-Level-3-Core-20030226/DOM3-Core.html#core-ID-A6C9094
-Since: 
+Since:
 */
 PHP_FUNCTION(dom_document_get_elements_by_tag_name)
 {
@@ -1116,7 +1116,7 @@ PHP_FUNCTION(dom_document_import_node)
 	xmlDocPtr docp;
 	xmlNodePtr nodep, retnodep;
 	dom_object *intern, *nodeobj;
-	int ret; 
+	int ret;
 	long recursive = 0;

 	if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "OO|l", &id, dom_document_class_entry, &node, dom_node_class_entry, &recursive) == FAILURE) {
@@ -1127,7 +1127,7 @@ PHP_FUNCTION(dom_document_import_node)

 	DOM_GET_OBJ(nodep, node, xmlNodePtr, nodeobj);

-	if (nodep->type == XML_HTML_DOCUMENT_NODE || nodep->type == XML_DOCUMENT_NODE 
+	if (nodep->type == XML_HTML_DOCUMENT_NODE || nodep->type == XML_DOCUMENT_NODE
 		|| nodep->type == XML_DOCUMENT_TYPE_NODE) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot import: Node Type Not Supported");
 		RETURN_FALSE;
@@ -1217,7 +1217,7 @@ PHP_FUNCTION(dom_document_create_element_ns)
 		RETURN_FALSE;
 	}

-	
+
 	nodep->ns = nsptr;

 	DOM_RET_OBJ(nodep, &ret, intern);
@@ -1519,11 +1519,15 @@ static xmlDocPtr dom_document_parser(zval *id, int mode, char *source, int sourc
 	xmlInitParser();

 	if (mode == DOM_LOAD_FILE) {
-		char *file_dest = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN  TSRMLS_CC);
+		char *file_dest;
+		if (CHECK_NULL_PATH(source, source_len)) {
+			return NULL;
+		}
+		file_dest = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN  TSRMLS_CC);
 		if (file_dest) {
 			ctxt = xmlCreateFileParserCtxt(file_dest);
 		}
-		
+
 	} else {
 		ctxt = xmlCreateMemoryParserCtxt(source, source_len);
 	}
@@ -1696,7 +1700,7 @@ PHP_FUNCTION(dom_document_save)
 	char *file;
 	long options = 0;

-	if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os|l", &id, dom_document_class_entry, &file, &file_len, &options) == FAILURE) {
+	if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op|l", &id, dom_document_class_entry, &file, &file_len, &options) == FAILURE) {
 		return;
 	}

@@ -1845,7 +1849,7 @@ PHP_FUNCTION(dom_document_xinclude)
 	zval *id;
 	xmlDoc *docp;
 	xmlNodePtr root;
-	long flags = 0; 
+	long flags = 0;
 	int err;
 	dom_object *intern;

@@ -1858,7 +1862,7 @@ PHP_FUNCTION(dom_document_xinclude)
 	err = xmlXIncludeProcessFlags(docp, flags);

 	/* XML_XINCLUDE_START and XML_XINCLUDE_END nodes need to be removed as these
-	are added via xmlXIncludeProcess to mark beginning and ending of xincluded document 
+	are added via xmlXIncludeProcess to mark beginning and ending of xincluded document
 	but are not wanted in resulting document - must be done even if err as it could fail after
 	having processed some xincludes */
 	root = (xmlNodePtr) docp->children;
@@ -1874,7 +1878,7 @@ PHP_FUNCTION(dom_document_xinclude)
 	} else {
 		RETVAL_FALSE;
 	}
-    
+
 }
 /* }}} */

@@ -1895,19 +1899,19 @@ PHP_FUNCTION(dom_document_validate)
 	DOM_GET_OBJ(docp, id, xmlDocPtr, intern);

 	cvp = xmlNewValidCtxt();
-	
+
 	cvp->userData = NULL;
 	cvp->error    = (xmlValidityErrorFunc) php_libxml_error_handler;
 	cvp->warning  = (xmlValidityErrorFunc) php_libxml_error_handler;
-	
+
 	if (xmlValidateDocument(cvp, docp)) {
 		RETVAL_TRUE;
 	} else {
 		RETVAL_FALSE;
 	}
-	
+
 	xmlFreeValidCtxt(cvp);
-	
+
 }
 /* }}} */

@@ -1926,7 +1930,7 @@ static void _dom_document_schema_validate(INTERNAL_FUNCTION_PARAMETERS, int type
 	int                     is_valid;
 	char resolved_path[MAXPATHLEN + 1];

-	if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op|l", &id, dom_document_class_entry, &source, &source_len, &flags) == FAILURE) {
+	if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os|l", &id, dom_document_class_entry, &source, &source_len, &flags) == FAILURE) {
 		return;
 	}

@@ -1939,6 +1943,10 @@ static void _dom_document_schema_validate(INTERNAL_FUNCTION_PARAMETERS, int type

 	switch (type) {
 	case DOM_LOAD_FILE:
+		if (CHECK_NULL_PATH(source, source_len)) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid Schema file source");
+			RETURN_FALSE;
+		}
 		valid_file = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN  TSRMLS_CC);
 		if (!valid_file) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid Schema file source");
@@ -1948,7 +1956,7 @@ static void _dom_document_schema_validate(INTERNAL_FUNCTION_PARAMETERS, int type
 		break;
 	case DOM_LOAD_STRING:
 		parser = xmlSchemaNewMemParserCtxt(source, source_len);
-		/* If loading from memory, we need to set the base directory for the document 
+		/* If loading from memory, we need to set the base directory for the document
 		   but it is not apparent how to do that for schema's */
 		break;
 	default:
@@ -2022,7 +2030,7 @@ static void _dom_document_relaxNG_validate(INTERNAL_FUNCTION_PARAMETERS, int typ
 	int                     is_valid;
 	char resolved_path[MAXPATHLEN + 1];

-	if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op", &id, dom_document_class_entry, &source, &source_len) == FAILURE) {
+	if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os", &id, dom_document_class_entry, &source, &source_len) == FAILURE) {
 		return;
 	}

@@ -2035,6 +2043,10 @@ static void _dom_document_relaxNG_validate(INTERNAL_FUNCTION_PARAMETERS, int typ

 	switch (type) {
 	case DOM_LOAD_FILE:
+		if (CHECK_NULL_PATH(source, source_len)) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid RelaxNG file source");
+			RETURN_FALSE;
+		}
 		valid_file = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN  TSRMLS_CC);
 		if (!valid_file) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid RelaxNG file source");
@@ -2044,7 +2056,7 @@ static void _dom_document_relaxNG_validate(INTERNAL_FUNCTION_PARAMETERS, int typ
 		break;
 	case DOM_LOAD_STRING:
 		parser = xmlRelaxNGNewMemParserCtxt(source, source_len);
-		/* If loading from memory, we need to set the base directory for the document 
+		/* If loading from memory, we need to set the base directory for the document
 		   but it is not apparent how to do that for schema's */
 		break;
 	default:
@@ -2112,7 +2124,7 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */
 	int source_len, refcount, ret;
 	long options = 0;
 	htmlParserCtxtPtr ctxt;
-	
+
 	id = getThis();

 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|l", &source, &source_len, &options) == FAILURE) {
@@ -2125,6 +2137,10 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */
 	}

 	if (mode == DOM_LOAD_FILE) {
+		if (CHECK_NULL_PATH(source, source_len)) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid file source");
+			RETURN_FALSE;
+		}
 		ctxt = htmlCreateFileParserCtxt(source, NULL);
 	} else {
 		source_len = xmlStrlen(source);
@@ -2148,7 +2164,7 @@ static void dom_load_html(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{ */
 	htmlParseDocument(ctxt);
 	newdoc = ctxt->myDoc;
 	htmlFreeParserCtxt(ctxt);
-	
+
 	if (!newdoc)
 		RETURN_FALSE;

@@ -2213,7 +2229,7 @@ PHP_FUNCTION(dom_document_save_html_file)
 	char *file;
 	const char *encoding;

-	if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os", &id, dom_document_class_entry, &file, &file_len) == FAILURE) {
+	if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op", &id, dom_document_class_entry, &file, &file_len) == FAILURE) {
 		return;
 	}

@@ -2270,13 +2286,13 @@ PHP_FUNCTION(dom_document_save_html)
 			php_dom_throw_error(WRONG_DOCUMENT_ERR, dom_get_strict_error(intern->document) TSRMLS_CC);
 			RETURN_FALSE;
 		}
-		
+
 		buf = xmlBufferCreate();
 		if (!buf) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not fetch buffer");
 			RETURN_FALSE;
 		}
-		
+
 		if (node->type == XML_DOCUMENT_FRAG_NODE) {
 			int one_size;

@@ -930,7 +930,6 @@ int dom_node_text_content_write(dom_object *obj, zval *newval TSRMLS_DC)
 {
 	xmlNode *nodep = dom_object_get_node(obj);
 	zval value_copy;
-	xmlChar *enc_str;

 	if (nodep == NULL) {
 		php_dom_throw_error(INVALID_STATE_ERR, 0 TSRMLS_CC);
@@ -938,9 +937,9 @@ int dom_node_text_content_write(dom_object *obj, zval *newval TSRMLS_DC)
 	}

 	convert_to_string_copy(newval, value_copy);
-	enc_str = xmlEncodeEntitiesReentrant(nodep->doc, Z_STRVAL_P(newval));
-	xmlNodeSetContent(nodep, enc_str);
-	xmlFree(enc_str);
+	/* we have to use xmlNodeAddContent() to get the same behavior as with xmlNewText() */
+	xmlNodeSetContent(nodep, (xmlChar *) "");
+	xmlNodeAddContent(nodep, Z_STRVAL_P(newval));
 	if (newval == &value_copy) {
 		zval_dtor(newval);
 	}
@@ -13,6 +13,11 @@ assert.bail=true
 $doc = new DOMDocument();
 $result = $doc->loadHTMLFile("");
 assert('$result === false');
+$doc = new DOMDocument();
+$result = $doc->loadHTMLFile("text.html\0something");
+assert('$result === false');
 ?>
 --EXPECTF--
 %r(PHP ){0,1}%rWarning: DOMDocument::loadHTMLFile(): Empty string supplied as input %s
+
+%r(PHP ){0,1}%rWarning: DOMDocument::loadHTMLFile(): Invalid file source %s
@@ -0,0 +1,12 @@
+--TEST--
+Bug #69679 (DOMDocument::loadHTML refuses to accept NULL bytes)
+--FILE--
+<?php
+$doc = new DOMDocument();
+$html = "<!DOCTYPE html><html><head><meta charset='UTF-8'></head><body>U+0000 <span>\x0</span></body></html>";
+$doc->loadHTML($html);
+print($doc->saveHTML());
+?>
+--EXPECT--
+<!DOCTYPE html>
+<html><head><meta charset="UTF-8"></head><body>U+0000 <span></span></body></html>
@@ -0,0 +1,17 @@
+--TEST--
+Bug #70001 (Assigning to DOMNode::textContent does additional entity encoding)
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+$element = new DOMText('<p>foo & bar</p>');
+var_dump($element->textContent);
+$element = (new DOMDocument())->createTextNode('<p>foo & bar</p>');
+var_dump($element->textContent);
+$element->textContent = ('<p>foo & bar</p>');
+var_dump($element->textContent);
+?>
+--EXPECT--
+string(16) "<p>foo & bar</p>"
+string(16) "<p>foo & bar</p>"
+string(16) "<p>foo & bar</p>"
@@ -1,7 +1,10 @@
 --TEST--
 Testing reading and writing to DOMNode::textContent
 --SKIPIF--
-<?php require_once('skipif.inc'); ?>
+<?php
+require_once('skipif.inc');
+if (LIBXML_VERSION < 20707) die ('skip requires libxml2-2.7.7 or higher');
+?>
 --FILE--
 <?php

@@ -37,6 +37,6 @@ if test "$PHP_ENCHANT" != "no"; then
 	[
 	  AC_DEFINE(HAVE_ENCHANT_BROKER_SET_PARAM,             1, [ ])
 	  AC_DEFINE(ENCHANT_VERSION_STRING,             "1.5.x", [ ])
-	], [], [ -L$ENCHANT_LIB $ENCHANT_SHARED_LIBADD])
+	], [], [ -L$ENCHANT_LIBDIR $ENCHANT_SHARED_LIBADD])

 fi
@@ -64,7 +64,7 @@
 #include "php_ini.h"
 #include "ext/standard/php_string.h"
 #include "ext/standard/php_image.h"
-#include "ext/standard/info.h" 
+#include "ext/standard/info.h"

 /* needed for ssize_t definition */
 #include <sys/types.h>
@@ -151,7 +151,7 @@ ZEND_BEGIN_MODULE_GLOBALS(exif)
 	char * encode_jis;
 	char * decode_jis_be;
 	char * decode_jis_le;
-ZEND_END_MODULE_GLOBALS(exif) 
+ZEND_END_MODULE_GLOBALS(exif)

 ZEND_DECLARE_MODULE_GLOBALS(exif)

@@ -160,7 +160,7 @@ ZEND_DECLARE_MODULE_GLOBALS(exif)
 #else
 #define EXIF_G(v) (exif_globals.v)
 #endif
- 
+
 /* {{{ PHP_INI
 */

@@ -203,7 +203,7 @@ PHP_INI_BEGIN()
    STD_PHP_INI_ENTRY("exif.decode_jis_intel",        "JIS",         PHP_INI_ALL, OnUpdateDecode, decode_jis_le,     zend_exif_globals, exif_globals)
 PHP_INI_END()
 /* }}} */
- 
+
 /* {{{ PHP_GINIT_FUNCTION
 */
 static PHP_GINIT_FUNCTION(exif)
@@ -223,9 +223,9 @@ PHP_MINIT_FUNCTION(exif)
 {
 	REGISTER_INI_ENTRIES();
 	if (zend_hash_exists(&module_registry, "mbstring", sizeof("mbstring"))) {
-		REGISTER_LONG_CONSTANT("EXIF_USE_MBSTRING", 1, CONST_CS | CONST_PERSISTENT); 
+		REGISTER_LONG_CONSTANT("EXIF_USE_MBSTRING", 1, CONST_CS | CONST_PERSISTENT);
 	} else {
-		REGISTER_LONG_CONSTANT("EXIF_USE_MBSTRING", 0, CONST_CS | CONST_PERSISTENT); 
+		REGISTER_LONG_CONSTANT("EXIF_USE_MBSTRING", 0, CONST_CS | CONST_PERSISTENT);
 	}
 	return SUCCESS;
 }
@@ -255,7 +255,7 @@ zend_module_entry exif_module_entry = {
 	exif_module_deps,
 	"exif",
 	exif_functions,
-	PHP_MINIT(exif), 
+	PHP_MINIT(exif),
 	PHP_MSHUTDOWN(exif),
 	NULL, NULL,
 	PHP_MINFO(exif),
@@ -268,7 +268,7 @@ zend_module_entry exif_module_entry = {
 	NULL,
 	NULL,
 	STANDARD_MODULE_PROPERTIES_EX
-#else	
+#else
 	STANDARD_MODULE_PROPERTIES
 #endif
 };
@@ -657,73 +657,73 @@ static tag_info_array tag_table_IFD = {
  { 0x0213, "YCbCrPositioning"},
  { 0x0214, "ReferenceBlackWhite"},
  { 0x02BC, "ExtensibleMetadataPlatform"}, /* XAP: Extensible Authoring Publishing, obsoleted by XMP: Extensible Metadata Platform */
-  { 0x0301, "Gamma"}, 
-  { 0x0302, "ICCProfileDescriptor"}, 
-  { 0x0303, "SRGBRenderingIntent"}, 
-  { 0x0320, "ImageTitle"}, 
-  { 0x5001, "ResolutionXUnit"}, 
-  { 0x5002, "ResolutionYUnit"}, 
-  { 0x5003, "ResolutionXLengthUnit"}, 
-  { 0x5004, "ResolutionYLengthUnit"}, 
-  { 0x5005, "PrintFlags"}, 
-  { 0x5006, "PrintFlagsVersion"}, 
-  { 0x5007, "PrintFlagsCrop"}, 
-  { 0x5008, "PrintFlagsBleedWidth"}, 
-  { 0x5009, "PrintFlagsBleedWidthScale"}, 
-  { 0x500A, "HalftoneLPI"}, 
-  { 0x500B, "HalftoneLPIUnit"}, 
-  { 0x500C, "HalftoneDegree"}, 
-  { 0x500D, "HalftoneShape"}, 
-  { 0x500E, "HalftoneMisc"}, 
-  { 0x500F, "HalftoneScreen"}, 
-  { 0x5010, "JPEGQuality"}, 
-  { 0x5011, "GridSize"}, 
-  { 0x5012, "ThumbnailFormat"}, 
-  { 0x5013, "ThumbnailWidth"}, 
-  { 0x5014, "ThumbnailHeight"}, 
-  { 0x5015, "ThumbnailColorDepth"}, 
-  { 0x5016, "ThumbnailPlanes"}, 
-  { 0x5017, "ThumbnailRawBytes"}, 
-  { 0x5018, "ThumbnailSize"}, 
-  { 0x5019, "ThumbnailCompressedSize"}, 
-  { 0x501A, "ColorTransferFunction"}, 
-  { 0x501B, "ThumbnailData"}, 
-  { 0x5020, "ThumbnailImageWidth"}, 
-  { 0x5021, "ThumbnailImageHeight"}, 
-  { 0x5022, "ThumbnailBitsPerSample"}, 
-  { 0x5023, "ThumbnailCompression"}, 
-  { 0x5024, "ThumbnailPhotometricInterp"}, 
-  { 0x5025, "ThumbnailImageDescription"}, 
-  { 0x5026, "ThumbnailEquipMake"}, 
-  { 0x5027, "ThumbnailEquipModel"}, 
-  { 0x5028, "ThumbnailStripOffsets"}, 
-  { 0x5029, "ThumbnailOrientation"}, 
-  { 0x502A, "ThumbnailSamplesPerPixel"}, 
-  { 0x502B, "ThumbnailRowsPerStrip"}, 
-  { 0x502C, "ThumbnailStripBytesCount"}, 
-  { 0x502D, "ThumbnailResolutionX"}, 
-  { 0x502E, "ThumbnailResolutionY"}, 
-  { 0x502F, "ThumbnailPlanarConfig"}, 
-  { 0x5030, "ThumbnailResolutionUnit"}, 
-  { 0x5031, "ThumbnailTransferFunction"}, 
-  { 0x5032, "ThumbnailSoftwareUsed"}, 
-  { 0x5033, "ThumbnailDateTime"}, 
-  { 0x5034, "ThumbnailArtist"}, 
-  { 0x5035, "ThumbnailWhitePoint"}, 
-  { 0x5036, "ThumbnailPrimaryChromaticities"}, 
-  { 0x5037, "ThumbnailYCbCrCoefficients"}, 
-  { 0x5038, "ThumbnailYCbCrSubsampling"}, 
-  { 0x5039, "ThumbnailYCbCrPositioning"}, 
-  { 0x503A, "ThumbnailRefBlackWhite"}, 
-  { 0x503B, "ThumbnailCopyRight"}, 
-  { 0x5090, "LuminanceTable"}, 
-  { 0x5091, "ChrominanceTable"}, 
-  { 0x5100, "FrameDelay"}, 
-  { 0x5101, "LoopCount"}, 
-  { 0x5110, "PixelUnit"}, 
-  { 0x5111, "PixelPerUnitX"}, 
-  { 0x5112, "PixelPerUnitY"}, 
-  { 0x5113, "PaletteHistogram"}, 
+  { 0x0301, "Gamma"},
+  { 0x0302, "ICCProfileDescriptor"},
+  { 0x0303, "SRGBRenderingIntent"},
+  { 0x0320, "ImageTitle"},
+  { 0x5001, "ResolutionXUnit"},
+  { 0x5002, "ResolutionYUnit"},
+  { 0x5003, "ResolutionXLengthUnit"},
+  { 0x5004, "ResolutionYLengthUnit"},
+  { 0x5005, "PrintFlags"},
+  { 0x5006, "PrintFlagsVersion"},
+  { 0x5007, "PrintFlagsCrop"},
+  { 0x5008, "PrintFlagsBleedWidth"},
+  { 0x5009, "PrintFlagsBleedWidthScale"},
+  { 0x500A, "HalftoneLPI"},
+  { 0x500B, "HalftoneLPIUnit"},
+  { 0x500C, "HalftoneDegree"},
+  { 0x500D, "HalftoneShape"},
+  { 0x500E, "HalftoneMisc"},
+  { 0x500F, "HalftoneScreen"},
+  { 0x5010, "JPEGQuality"},
+  { 0x5011, "GridSize"},
+  { 0x5012, "ThumbnailFormat"},
+  { 0x5013, "ThumbnailWidth"},
+  { 0x5014, "ThumbnailHeight"},
+  { 0x5015, "ThumbnailColorDepth"},
+  { 0x5016, "ThumbnailPlanes"},
+  { 0x5017, "ThumbnailRawBytes"},
+  { 0x5018, "ThumbnailSize"},
+  { 0x5019, "ThumbnailCompressedSize"},
+  { 0x501A, "ColorTransferFunction"},
+  { 0x501B, "ThumbnailData"},
+  { 0x5020, "ThumbnailImageWidth"},
+  { 0x5021, "ThumbnailImageHeight"},
+  { 0x5022, "ThumbnailBitsPerSample"},
+  { 0x5023, "ThumbnailCompression"},
+  { 0x5024, "ThumbnailPhotometricInterp"},
+  { 0x5025, "ThumbnailImageDescription"},
+  { 0x5026, "ThumbnailEquipMake"},
+  { 0x5027, "ThumbnailEquipModel"},
+  { 0x5028, "ThumbnailStripOffsets"},
+  { 0x5029, "ThumbnailOrientation"},
+  { 0x502A, "ThumbnailSamplesPerPixel"},
+  { 0x502B, "ThumbnailRowsPerStrip"},
+  { 0x502C, "ThumbnailStripBytesCount"},
+  { 0x502D, "ThumbnailResolutionX"},
+  { 0x502E, "ThumbnailResolutionY"},
+  { 0x502F, "ThumbnailPlanarConfig"},
+  { 0x5030, "ThumbnailResolutionUnit"},
+  { 0x5031, "ThumbnailTransferFunction"},
+  { 0x5032, "ThumbnailSoftwareUsed"},
+  { 0x5033, "ThumbnailDateTime"},
+  { 0x5034, "ThumbnailArtist"},
+  { 0x5035, "ThumbnailWhitePoint"},
+  { 0x5036, "ThumbnailPrimaryChromaticities"},
+  { 0x5037, "ThumbnailYCbCrCoefficients"},
+  { 0x5038, "ThumbnailYCbCrSubsampling"},
+  { 0x5039, "ThumbnailYCbCrPositioning"},
+  { 0x503A, "ThumbnailRefBlackWhite"},
+  { 0x503B, "ThumbnailCopyRight"},
+  { 0x5090, "LuminanceTable"},
+  { 0x5091, "ChrominanceTable"},
+  { 0x5100, "FrameDelay"},
+  { 0x5101, "LoopCount"},
+  { 0x5110, "PixelUnit"},
+  { 0x5111, "PixelPerUnitX"},
+  { 0x5112, "PixelPerUnitY"},
+  { 0x5113, "PaletteHistogram"},
  { 0x1000, "RelatedImageFileFormat"},
  { 0x800D, "ImageID"},
  { 0x80E3, "Matteing"},   /* obsoleted by ExtraSamples */
@@ -929,7 +929,7 @@ static tag_info_array tag_table_VND_NIKON = {
  { 0x000b, "Converter"},
  TAG_TABLE_END
 };
-  
+
 static tag_info_array tag_table_VND_NIKON_990 = {
  { 0x0001, "Version"},
  { 0x0002, "ISOSetting"},
@@ -948,7 +948,7 @@ static tag_info_array tag_table_VND_NIKON_990 = {
  { 0x0010, "DataDump"},
  TAG_TABLE_END
 };
-  
+
 static tag_info_array tag_table_VND_OLYMPUS = {
  { 0x0200, "SpecialMode"},
  { 0x0201, "JPEGQuality"},
@@ -1214,7 +1214,7 @@ char * exif_dump_data(int *dump_free, int format, int components, int length, in
 		if (components > 0) {
 			dump = erealloc(dump, len + 2 + 1);
 			snprintf(dump + len, 2 + 1, ", ");
-			len += 2;			
+			len += 2;
 			components--;
 		} else{
 			break;
@@ -1564,7 +1564,7 @@ typedef struct {
 static void exif_error_docref(const char *docref EXIFERR_DC, const image_info_type *ImageInfo, int type, const char *format, ...)
 {
 	va_list args;
-	
+
 	va_start(args, format);
 #ifdef EXIF_DEBUG
 	{
@@ -2617,7 +2617,7 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
 			*pszEncoding = estrdup((const char*)szValuePtr);
 			szValuePtr = szValuePtr+8;
 			ByteCount -= 8;
-			/* First try to detect BOM: ZERO WIDTH NOBREAK SPACE (FEFF 16) 
+			/* First try to detect BOM: ZERO WIDTH NOBREAK SPACE (FEFF 16)
 			 * since we have no encoding support for the BOM yet we skip that.
 			 */
 			if (!memcmp(szValuePtr, "\xFE\xFF", 2)) {
@@ -2635,8 +2635,8 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
 			}
 			/* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX   */
 			if (zend_multibyte_encoding_converter(
-					(unsigned char**)pszInfoPtr, 
-					&len, 
+					(unsigned char**)pszInfoPtr,
+					&len,
 					(unsigned char*)szValuePtr,
 					ByteCount,
 					zend_multibyte_fetch_encoding(ImageInfo->encode_unicode TSRMLS_CC),
@@ -2656,8 +2656,8 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
 			ByteCount -= 8;
 			/* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX   */
 			if (zend_multibyte_encoding_converter(
-					(unsigned char**)pszInfoPtr, 
-					&len, 
+					(unsigned char**)pszInfoPtr,
+					&len,
 					(unsigned char*)szValuePtr,
 					ByteCount,
 					zend_multibyte_fetch_encoding(ImageInfo->encode_jis TSRMLS_CC),
@@ -2691,12 +2691,12 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
 * Process unicode field in IFD. */
 static int exif_process_unicode(image_info_type *ImageInfo, xp_field_type *xp_field, int tag, char *szValuePtr, int ByteCount TSRMLS_DC)
 {
-	xp_field->tag = tag;	
+	xp_field->tag = tag;
 	xp_field->value = NULL;
 	/* XXX this will fail again if encoding_converter returns on error something different than SIZE_MAX   */
 	if (zend_multibyte_encoding_converter(
-			(unsigned char**)&xp_field->value, 
-			&xp_field->size, 
+			(unsigned char**)&xp_field->value,
+			&xp_field->size,
 			(unsigned char*)szValuePtr,
 			ByteCount,
 			zend_multibyte_fetch_encoding(ImageInfo->encode_unicode TSRMLS_CC),
@@ -2721,7 +2721,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 		if (i==sizeof(maker_note_array)/sizeof(maker_note_type))
 			return FALSE;
 		maker_note = maker_note_array+i;
-		
+
 		/*exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "check (%s,%s)", maker_note->make?maker_note->make:"", maker_note->model?maker_note->model:"");*/
 		if (maker_note->make && (!ImageInfo->make || strcmp(maker_note->make, ImageInfo->make)))
 			continue;
@@ -2842,9 +2842,9 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 		offset_val = php_ifd_get32u(dir_entry+8, ImageInfo->motorola_intel);
 		/* If its bigger than 4 bytes, the dir entry contains an offset. */
 		value_ptr = offset_base+offset_val;
-        /* 
+        /*
            dir_entry is ImageInfo->file.list[sn].data+2+i*12
-            offset_base is ImageInfo->file.list[sn].data-dir_offset 
+            offset_base is ImageInfo->file.list[sn].data-dir_offset
            dir_entry - offset_base is dir_offset+2+i*12
        */
 		if (byte_count > IFDlength || offset_val > IFDlength-byte_count || value_ptr < dir_entry || offset_val < (size_t)(dir_entry-offset_base)) {
@@ -2915,18 +2915,18 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				case TAG_COMP_IMAGE_WIDTH:
 					ImageInfo->Thumbnail.width = exif_convert_any_to_int(value_ptr, format, ImageInfo->motorola_intel TSRMLS_CC);
 					break;
-	
+
 				case TAG_IMAGEHEIGHT:
 				case TAG_COMP_IMAGE_HEIGHT:
 					ImageInfo->Thumbnail.height = exif_convert_any_to_int(value_ptr, format, ImageInfo->motorola_intel TSRMLS_CC);
 					break;
-	
+
 				case TAG_STRIP_OFFSETS:
 				case TAG_JPEG_INTERCHANGE_FORMAT:
 					/* accept both formats */
 					ImageInfo->Thumbnail.offset = exif_convert_any_to_int(value_ptr, format, ImageInfo->motorola_intel TSRMLS_CC);
 					break;
-	
+
 				case TAG_STRIP_BYTE_COUNTS:
 					if (ImageInfo->FileType == IMAGE_FILETYPE_TIFF_II || ImageInfo->FileType == IMAGE_FILETYPE_TIFF_MM) {
 						ImageInfo->Thumbnail.filetype = ImageInfo->FileType;
@@ -2936,7 +2936,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 					}
 					ImageInfo->Thumbnail.size = exif_convert_any_to_int(value_ptr, format, ImageInfo->motorola_intel TSRMLS_CC);
 					break;
-	
+
 				case TAG_JPEG_INTERCHANGE_FORMAT_LEN:
 					if (ImageInfo->Thumbnail.filetype == IMAGE_FILETYPE_UNKNOWN) {
 						ImageInfo->Thumbnail.filetype = IMAGE_FILETYPE_JPEG;
@@ -2954,16 +2954,16 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 					if (length<byte_count-1) {
 						/* When there are any characters after the first NUL */
 						ImageInfo->CopyrightPhotographer  = estrdup(value_ptr);
-						ImageInfo->CopyrightEditor        = estrdup(value_ptr+length+1);
+						ImageInfo->CopyrightEditor        = estrndup(value_ptr+length+1, byte_count-length-1);
 						spprintf(&ImageInfo->Copyright, 0, "%s, %s", value_ptr, value_ptr+length+1);
 						/* format = TAG_FMT_UNDEFINED; this musn't be ASCII         */
 						/* but we are not supposed to change this                   */
 						/* keep in mind that image_info does not store editor value */
 					} else {
-						ImageInfo->Copyright = estrdup(value_ptr);
+						ImageInfo->Copyright = estrndup(value_ptr, byte_count);
 					}
 				}
-				break;   
+				break;

 			case TAG_USERCOMMENT:
 				ImageInfo->UserCommentLength = exif_process_user_comment(ImageInfo, &(ImageInfo->UserComment), &(ImageInfo->UserCommentEncoding), value_ptr, byte_count TSRMLS_CC);
@@ -3051,10 +3051,10 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				break;

 			case TAG_MAKE:
-				ImageInfo->make = estrdup(value_ptr);
+				ImageInfo->make = estrndup(value_ptr, byte_count);
 				break;
 			case TAG_MODEL:
-				ImageInfo->model = estrdup(value_ptr);
+				ImageInfo->model = estrndup(value_ptr, byte_count);
 				break;

 			case TAG_MAKER_NOTE:
@@ -3404,7 +3404,7 @@ static int exif_scan_JPEG_header(image_info_type *ImageInfo TSRMLS_DC)
 				if ((itemlen - 2) < 6) {
 					return FALSE;
 				}
-		
+
 				exif_process_SOFn(Data, marker, &sof_info);
 				ImageInfo->Width  = sof_info.width;
 				ImageInfo->Height = sof_info.height;
@@ -3449,21 +3449,21 @@ static int exif_scan_thumbnail(image_info_type *ImageInfo TSRMLS_DC)
 	}
 	for (;;) {
 		pos += length;
-		if (pos>=ImageInfo->Thumbnail.size) 
+		if (pos>=ImageInfo->Thumbnail.size)
 			return FALSE;
 		c = data[pos++];
-		if (pos>=ImageInfo->Thumbnail.size) 
+		if (pos>=ImageInfo->Thumbnail.size)
 			return FALSE;
 		if (c != 0xFF) {
 			return FALSE;
 		}
 		n = 8;
 		while ((c = data[pos++]) == 0xFF && n--) {
-			if (pos+3>=ImageInfo->Thumbnail.size) 
+			if (pos+3>=ImageInfo->Thumbnail.size)
 				return FALSE;
 			/* +3 = pos++ of next check when reaching marker + 2 bytes for length */
 		}
-		if (c == 0xFF) 
+		if (c == 0xFF)
 			return FALSE;
 		marker = c;
 		length = php_jpg_get16(data+pos);
@@ -3777,7 +3777,7 @@ static int exif_scan_FILE_header(image_info_type *ImageInfo TSRMLS_DC)
 				exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "File has TIFF/II format");
 #endif
 				ImageInfo->sections_found |= FOUND_IFD0;
-				if (exif_process_IFD_in_TIFF(ImageInfo, 
+				if (exif_process_IFD_in_TIFF(ImageInfo,
 											 php_ifd_get32u(file_header + 4, ImageInfo->motorola_intel),
 											 SECTION_IFD0 TSRMLS_CC)) {
 					ret = TRUE;
@@ -3957,7 +3957,7 @@ PHP_FUNCTION(exif_read_data)
 	sections_str = exif_get_sectionlist(ImageInfo.sections_found TSRMLS_CC);

 #ifdef EXIF_DEBUG
-	if (sections_str) 
+	if (sections_str)
 		exif_error_docref(NULL EXIFERR_CC, &ImageInfo, E_NOTICE, "Sections found: %s", sections_str[0] ? sections_str : "None");
 #endif

@@ -1,5 +1,5 @@
 --TEST--
-Bug #68799 (Free called on unitialized pointer)
+Bug #68799 (Free called on uninitialized pointer)
 --SKIPIF--
 <?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
 --FILE--
@@ -508,6 +508,11 @@ static void _php_finfo_get_type(INTERNAL_FUNCTION_PARAMETERS, int mode, int mime
 				RETVAL_FALSE;
 				goto clean;
 			}
+			if (CHECK_NULL_PATH(buffer, buffer_len)) {
+				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+				RETVAL_FALSE;
+				goto clean;
+			}

 			wrap = php_stream_locate_url_wrapper(buffer, &tmp2, 0 TSRMLS_CC);

@@ -1072,6 +1072,9 @@ mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
 			if (bytecnt > nbytes) {
 				bytecnt = nbytes;
 			}
+			if (offset > bytecnt) {
+				offset = bytecnt;
+			}
 			if (s == NULL) {
 				ms->search.s_len = 0;
 				ms->search.s = NULL;
@@ -0,0 +1,18 @@
+--TEST--
+Bug #68819 Fileinfo on specific file causes spurious OOM and/or segfault, var 1
+--SKIPIF--
+<?php require_once(dirname(__FILE__) . '/skipif.inc'); ?>
+--FILE--
+<?php
+
+$string = <<<HERE
+----a-----'''---------a---------------a--------a-----a-----a---------a-----as-------a----a--a-------------a--as-----s---------------a---------a---a--s-a-----a-----------asy---------a-----a-----------a----s--------a-------------a-------a--------a----s------------a-----a----------------a----s-----------------\r\n-------------------a-------a-a-------a-----a----a----s----s--------a-----------------------a----a----s-------------a------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-------------------a-------a-a-------a-----a----a----s----s--------a----------a----------------------a----a----s-------------a----------------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n------a-------a-a-------a-----a----a---a-----a-----------------------a----a---a-----a------------------s-------a----a---a-----a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s------\r\n-------------------a-------a-a-------a-----a----a---a-------a------------------------a----a---a-----''--a-------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-------------------a-------a-a-------a-----a----a-------s-----a---a-------------------------a----a-------------a---a-------------------s-------a----a-------------a---a-----as-a--------------a-----a--s----s---------y------------a-----a-s---a-------''----a---s--a-''------''----s------------a-y----------------s------a-----y--a-s--a-s------s--a-s----------''----------------------------a---s--a----a---------a-s---a-s--------s--------a---------s--a-y-------------as----a----a-------------a------a---s--a-s------a--------a----s----y--as--a----a-s---------------a-----a--------------------------------------\r\n-------------------a-------a-a-------a-----a----a-----------s--------a-----------------------a----a--------------------a------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-------------------a-------a-a-------a-----a----a-----------s--------a----------a----------------------a----a--------------------a------------------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-------------------a-------a-a-------a-----a----a---a-----------------------a----a---a------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-------------------a-------a-a-------a-----a----a---a----------a----------------------a----a---a------------------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-----a-a-----------a-------a-a-------a-----a----a----a---s-----a-----------------------a----a----a---------a-----------------s-------a----a----a---------a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-------------------a-------a-a-------a-----a----a--------a----a-----------------------a----a----------a----a------------------s-------a----a---a------as---s-a--------------s-----a------a-y--a-------a-----a--a--------a----s--------a-------------a-------a--------a----s--------------a-----a----------a----------s--a----------s-----------------\r\n-----a-------------a-------a-a-------a-----a----a--------s-----a---a-------------------------a----a--------------a---a-------------------s-------------a---------------a----a---a---a-----as-a--------------a-----a--s----s---------y------------a-----a-s---a-------''----a---s--a-''------''----s------------a-y----------------s------a-----y--a-s--a-s------s--a-s----------''----------------------------a---s--a----a---------a-s---a-s--------s--------a---------s--a-y-------------as----a----a-------------a------a---s--a-s------a--------a----s----y--as--a----a-s---------------a-----a-----------Line truncated
+HERE;
+
+$finfo = new finfo();
+$type = $finfo->buffer($string);
+
+var_dump($type);
+?>
+--EXPECT--
+string(60) "ASCII text, with very long lines, with CRLF line terminators"
@@ -0,0 +1,26 @@
+--TEST--
+Bug #68819 Fileinfo on specific file causes spurious OOM and/or segfault, var 2
+--SKIPIF--
+<?php require_once(dirname(__FILE__) . '/skipif.inc'); ?>
+--FILE--
+<?php
+
+$string = '';
+
+// These two in any order
+$string .= "\r\n";
+$string .= "''''";
+
+// Total string length > 8192
+$string .= str_repeat(chr(rand(32, 127)), 8184);
+
+// Ending in this string
+$string .= "say";
+
+$finfo = new finfo();
+$type = $finfo->buffer($string);
+var_dump($type);
+
+?>
+--EXPECT--
+string(60) "ASCII text, with very long lines, with CRLF line terminators"
@@ -19,6 +19,7 @@ echo "*** Testing finfo_file() : basic functionality ***\n";
 var_dump( finfo_file( $finfo, __FILE__) );
 var_dump( finfo_file( $finfo, __FILE__, FILEINFO_CONTINUE ) );
 var_dump( finfo_file( $finfo, $magicFile ) );
+var_dump( finfo_file( $finfo, $magicFile.chr(0).$magicFile) );

 ?>
 ===DONE===
@@ -27,4 +28,7 @@ var_dump( finfo_file( $finfo, $magicFile ) );
 string(28) "text/x-php; charset=us-ascii"
 string(22) "PHP script, ASCII text"
 string(25) "text/plain; charset=utf-8"
+
+Warning: finfo_file(): Invalid path in %s%efinfo_file_basic.php on line %d
+bool(false)
 ===DONE===
@@ -188,9 +188,9 @@ ftp_close(ftpbuf_t *ftp)
 			SSL_shutdown(ftp->ssl_handle);
 			SSL_free(ftp->ssl_handle);
 		}
-#endif		
+#endif
 		closesocket(ftp->fd);
-	}	
+	}
 	ftp_gc(ftp);
 	efree(ftp);
 	return NULL;
@@ -262,7 +262,7 @@ ftp_login(ftpbuf_t *ftp, const char *user, const char *pass TSRMLS_DC)
 		if (!ftp_getresp(ftp)) {
 			return 0;
 		}
-			
+
 		if (ftp->resp != 234) {
 			if (!ftp_putcmd(ftp, "AUTH", "SSL")) {
 				return 0;
@@ -270,7 +270,7 @@ ftp_login(ftpbuf_t *ftp, const char *user, const char *pass TSRMLS_DC)
 			if (!ftp_getresp(ftp)) {
 				return 0;
 			}
-				
+
 			if (ftp->resp != 334) {
 				return 0;
 			} else {
@@ -278,7 +278,7 @@ ftp_login(ftpbuf_t *ftp, const char *user, const char *pass TSRMLS_DC)
 				ftp->use_ssl_for_data = 1;
 			}
 		}
-		
+
 		ctx = SSL_CTX_new(SSLv23_client_method());
 		if (ctx == NULL) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "failed to create the SSL context");
@@ -325,8 +325,8 @@ ftp_login(ftpbuf_t *ftp, const char *user, const char *pass TSRMLS_DC)
 			if (!ftp_getresp(ftp)) {
 				return 0;
 			}
-			
-			ftp->use_ssl_for_data = (ftp->resp >= 200 && ftp->resp <=299);		
+
+			ftp->use_ssl_for_data = (ftp->resp >= 200 && ftp->resp <=299);
 		}
 	}
 #endif
@@ -360,7 +360,7 @@ ftp_reinit(ftpbuf_t *ftp)
 {
 	if (ftp == NULL) {
 		return 0;
-	}	
+	}

 	ftp_gc(ftp);

@@ -395,7 +395,7 @@ ftp_syst(ftpbuf_t *ftp)
 	if (!ftp_putcmd(ftp, "SYST", NULL)) {
 		return NULL;
 	}
-	if (!ftp_getresp(ftp) || ftp->resp != 215) { 
+	if (!ftp_getresp(ftp) || ftp->resp != 215) {
 		return NULL;
 	}
 	syst = ftp->inbuf;
@@ -431,14 +431,14 @@ ftp_pwd(ftpbuf_t *ftp)
 	if (!ftp_putcmd(ftp, "PWD", NULL)) {
 		return NULL;
 	}
-	if (!ftp_getresp(ftp) || ftp->resp != 257) { 
+	if (!ftp_getresp(ftp) || ftp->resp != 257) {
 		return NULL;
 	}
 	/* copy out the pwd from response */
-	if ((pwd = strchr(ftp->inbuf, '"')) == NULL) { 
+	if ((pwd = strchr(ftp->inbuf, '"')) == NULL) {
 		return NULL;
 	}
-	if ((end = strrchr(++pwd, '"')) == NULL) { 
+	if ((end = strrchr(++pwd, '"')) == NULL) {
 		return NULL;
 	}
 	ftp->pwd = estrndup(pwd, end - pwd);
@@ -608,7 +608,7 @@ ftp_chmod(ftpbuf_t *ftp, const int mode, const char *filename, const int filenam
 	if (!ftp_getresp(ftp) || ftp->resp != 200) {
 		return 0;
 	}
-	
+
 	return 1;
 }
 /* }}} */
@@ -625,7 +625,7 @@ ftp_alloc(ftpbuf_t *ftp, const long size, char **response)
 	}

 	snprintf(buffer, sizeof(buffer) - 1, "%ld", size);
-    
+
 	if (!ftp_putcmd(ftp, "ALLO", buffer)) {
 		return 0;
 	}
@@ -642,7 +642,7 @@ ftp_alloc(ftpbuf_t *ftp, const long size, char **response)
 		return 0;
 	}

-	return 1;	
+	return 1;
 }
 /* }}} */

@@ -674,7 +674,7 @@ ftp_type(ftpbuf_t *ftp, ftptype_t type)
 	if (ftp == NULL) {
 		return 0;
 	}
-	if (type == ftp->type) { 
+	if (type == ftp->type) {
 		return 1;
 	}
 	if (type == FTPTYPE_ASCII) {
@@ -765,7 +765,7 @@ ftp_pasv(ftpbuf_t *ftp, int pasv)
 	if (!ftp_putcmd(ftp, "PASV", NULL)) {
 		return 0;
 	}
-	if (!ftp_getresp(ftp) || ftp->resp != 227) { 
+	if (!ftp_getresp(ftp) || ftp->resp != 227) {
 		return 0;
 	}
 	/* parse out the IP and port */
@@ -807,7 +807,7 @@ ftp_get(ftpbuf_t *ftp, php_stream *outstream, const char *path, ftptype_t type,
 	if ((data = ftp_getdata(ftp TSRMLS_CC)) == NULL) {
 		goto bail;
 	}
-	
+
 	ftp->data = data;

 	if (resumepos > 0) {
@@ -900,7 +900,7 @@ ftp_put(ftpbuf_t *ftp, const char *path, php_stream *instream, ftptype_t type, l
 	if ((data = ftp_getdata(ftp TSRMLS_CC)) == NULL) {
 		goto bail;
 	}
-	ftp->data = data;	
+	ftp->data = data;

 	if (startpos > 0) {
 		snprintf(arg, sizeof(arg), "%ld", startpos);
@@ -1101,7 +1101,7 @@ ftp_putcmd(ftpbuf_t *ftp, const char *cmd, const char *args)

 	if (strpbrk(cmd, "\r\n")) {
 		return 0;
-	} 
+	}
 	/* build the output buffer */
 	if (args && args[0]) {
 		/* "cmd args\r\n\0" */
@@ -1247,7 +1247,7 @@ my_send(ftpbuf_t *ftp, php_socket_t s, void *buf, size_t len)
 #if HAVE_OPENSSL_EXT
 		if (ftp->use_ssl && ftp->fd == s && ftp->ssl_active) {
 			sent = SSL_write(ftp->ssl_handle, buf, size);
-		} else if (ftp->use_ssl && ftp->fd != s && ftp->use_ssl_for_data && ftp->data->ssl_active) {	
+		} else if (ftp->use_ssl && ftp->fd != s && ftp->use_ssl_for_data && ftp->data->ssl_active) {
 			sent = SSL_write(ftp->data->ssl_handle, buf, size);
 		} else {
 #endif
@@ -1287,14 +1287,14 @@ my_recv(ftpbuf_t *ftp, php_socket_t s, void *buf, size_t len)
 #if HAVE_OPENSSL_EXT
 	if (ftp->use_ssl && ftp->fd == s && ftp->ssl_active) {
 		nr_bytes = SSL_read(ftp->ssl_handle, buf, len);
-	} else if (ftp->use_ssl && ftp->fd != s && ftp->use_ssl_for_data && ftp->data->ssl_active) {	
+	} else if (ftp->use_ssl && ftp->fd != s && ftp->use_ssl_for_data && ftp->data->ssl_active) {
 		nr_bytes = SSL_read(ftp->data->ssl_handle, buf, len);
 	} else {
 #endif
 		nr_bytes = recv(s, buf, len, 0);
 #if HAVE_OPENSSL_EXT
 	}
-#endif	
+#endif
 	return (nr_bytes);
 }
 /* }}} */
@@ -1511,7 +1511,7 @@ data_accept(databuf_t *data, ftpbuf_t *ftp TSRMLS_DC)

 data_accepted:
 #if HAVE_OPENSSL_EXT
-	
+
 	/* now enable ssl if we need to */
 	if (ftp->use_ssl && ftp->use_ssl_for_data) {
 		ctx = SSL_CTX_new(SSLv23_client_method());
@@ -1531,23 +1531,23 @@ data_accepted:
 			SSL_CTX_free(ctx);
 			return 0;
 		}
-			
-		
+
+
 		SSL_set_fd(data->ssl_handle, data->fd);

 		if (ftp->old_ssl) {
 			SSL_copy_session_id(data->ssl_handle, ftp->ssl_handle);
 		}
-			
+
 		if (SSL_connect(data->ssl_handle) <= 0) {
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "data_accept: SSL/TLS handshake failed");
 			SSL_shutdown(data->ssl_handle);
 			SSL_free(data->ssl_handle);
 			return 0;
 		}
-			
+
 		data->ssl_active = 1;
-	}	
+	}

 #endif

@@ -1562,14 +1562,14 @@ data_close(ftpbuf_t *ftp, databuf_t *data)
 {
 #if HAVE_OPENSSL_EXT
 	SSL_CTX		*ctx;
-#endif				
+#endif
 	if (data == NULL) {
 		return NULL;
 	}
 	if (data->listener != -1) {
 #if HAVE_OPENSSL_EXT
 		if (data->ssl_active) {
-		
+
 			ctx = SSL_get_SSL_CTX(data->ssl_handle);
 			SSL_CTX_free(ctx);

@@ -1577,9 +1577,9 @@ data_close(ftpbuf_t *ftp, databuf_t *data)
 			SSL_free(data->ssl_handle);
 			data->ssl_active = 0;
 		}
-#endif				
+#endif
 		closesocket(data->listener);
-	}	
+	}
 	if (data->fd != -1) {
 #if HAVE_OPENSSL_EXT
 		if (data->ssl_active) {
@@ -1590,9 +1590,9 @@ data_close(ftpbuf_t *ftp, databuf_t *data)
 			SSL_free(data->ssl_handle);
 			data->ssl_active = 0;
 		}
-#endif				
+#endif
 		closesocket(data->fd);
-	}	
+	}
 	if (ftp) {
 		ftp->data = NULL;
 	}
@@ -1610,8 +1610,8 @@ ftp_genlist(ftpbuf_t *ftp, const char *cmd, const char *path TSRMLS_DC)
 	databuf_t	*data = NULL;
 	char		*ptr;
 	int		ch, lastch;
-	int		size, rcvd;
-	int		lines;
+	size_t		size, rcvd;
+	size_t		lines;
 	char		**ret = NULL;
 	char		**entry;
 	char		*text;
@@ -1629,7 +1629,7 @@ ftp_genlist(ftpbuf_t *ftp, const char *cmd, const char *path TSRMLS_DC)
 	if ((data = ftp_getdata(ftp TSRMLS_CC)) == NULL) {
 		goto bail;
 	}
-	ftp->data = data;	
+	ftp->data = data;

 	if (!ftp_putcmd(ftp, cmd, path)) {
 		goto bail;
@@ -1653,7 +1653,7 @@ ftp_genlist(ftpbuf_t *ftp, const char *cmd, const char *path TSRMLS_DC)
 	lines = 0;
 	lastch = 0;
 	while ((rcvd = my_recv(ftp, data->fd, data->buf, FTP_BUFSIZE))) {
-		if (rcvd == -1) {
+		if (rcvd == -1 || rcvd > ((size_t)(-1))-size) {
 			goto bail;
 		}

@@ -1663,8 +1663,6 @@ ftp_genlist(ftpbuf_t *ftp, const char *cmd, const char *path TSRMLS_DC)
 		for (ptr = data->buf; rcvd; rcvd--, ptr++) {
 			if (*ptr == '\n' && lastch == '\r') {
 				lines++;
-			} else {
-				size++;
 			}
 			lastch = *ptr;
 		}
@@ -1858,7 +1856,7 @@ ftp_nb_put(ftpbuf_t *ftp, const char *path, php_stream *instream, ftptype_t type
 	if (!ftp_getresp(ftp) || (ftp->resp != 150 && ftp->resp != 125)) {
 		goto bail;
 	}
-	if ((data = data_accept(data, ftp TSRMLS_CC)) == NULL) { 
+	if ((data = data_accept(data, ftp TSRMLS_CC)) == NULL) {
 		goto bail;
 	}
 	ftp->data = data;
@@ -1914,7 +1912,7 @@ ftp_nb_continue_write(ftpbuf_t *ftp TSRMLS_DC)
 		goto bail;
 	}
 	ftp->data = data_close(ftp, ftp->data);
- 
+
 	if (!ftp_getresp(ftp) || (ftp->resp != 226 && ftp->resp != 250)) {
 		goto bail;
 	}
@@ -1405,6 +1405,11 @@ PHP_FUNCTION(gd_info)
 	add_assoc_bool(return_value, "XPM Support", 0);
 #endif
 	add_assoc_bool(return_value, "XBM Support", 1);
+#ifdef HAVE_GD_WEBP
+	add_assoc_bool(return_value, "WebP Support", 1);
+#else
+	add_assoc_bool(return_value, "WebP Support", 0);
+#endif
 #if defined(USE_GD_JISX0208)
 	add_assoc_bool(return_value, "JIS-mapped Japanese Font Support", 1);
 #else
@@ -1432,7 +1437,7 @@ PHP_FUNCTION(imageloadfont)
 	gdFontPtr font;
 	php_stream *stream;

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &file, &file_name) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &file, &file_name) == FAILURE) {
 		return;
 	}

@@ -1750,7 +1755,7 @@ PHP_FUNCTION(imagefilledarc)
 	long cx, cy, w, h, ST, E, col, style;
 	gdImagePtr im;
 	int e, st;
-	
+
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rllllllll", &IM, &cx, &cy, &w, &h, &ST, &E, &col, &style) == FAILURE) {
 		return;
 	}
@@ -1991,7 +1996,7 @@ PHP_FUNCTION(imagegrabwindow)
 	if ( handle == 0 ) {
 		goto clean;
 	}
-	pPrintWindow = (tPrintWindow) GetProcAddress(handle, "PrintWindow");  
+	pPrintWindow = (tPrintWindow) GetProcAddress(handle, "PrintWindow");

 	if ( pPrintWindow )  {
 		pPrintWindow(window, memDC, (UINT) client_area);
@@ -2369,7 +2374,7 @@ static void _php_image_create_from(INTERNAL_FUNCTION_PARAMETERS, int image_type,
 	long ignore_warning;

 	if (image_type == PHP_GDIMG_TYPE_GD2PART) {
-		if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "sllll", &file, &file_len, &srcx, &srcy, &width, &height) == FAILURE) {
+		if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "pllll", &file, &file_len, &srcx, &srcy, &width, &height) == FAILURE) {
 			return;
 		}
 		if (width < 1 || height < 1) {
@@ -2377,7 +2382,7 @@ static void _php_image_create_from(INTERNAL_FUNCTION_PARAMETERS, int image_type,
 			RETURN_FALSE;
 		}
 	} else {
-		if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &file, &file_len) == FAILURE) {
+		if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &file, &file_len) == FAILURE) {
 			return;
 		}
 	}
@@ -3060,10 +3065,11 @@ PHP_FUNCTION(imagegammacorrect)
 			for (x = 0; x < gdImageSX(im); x++)	{
 				c = gdImageGetPixel(im, x, y);
 				gdImageSetPixel(im, x, y,
-					gdTrueColor(
+					gdTrueColorAlpha(
 						(int) ((pow((pow((gdTrueColorGetRed(c)   / 255.0), input)), 1.0 / output) * 255) + .5),
 						(int) ((pow((pow((gdTrueColorGetGreen(c) / 255.0), input)), 1.0 / output) * 255) + .5),
-						(int) ((pow((pow((gdTrueColorGetBlue(c)  / 255.0), input)), 1.0 / output) * 255) + .5)
+						(int) ((pow((pow((gdTrueColorGetBlue(c)  / 255.0), input)), 1.0 / output) * 255) + .5),
+						gdTrueColorGetAlpha(c)
 					)
 				);
 			}
@@ -3860,7 +3866,7 @@ static void php_imagettftext_common(INTERNAL_FUNCTION_PARAMETERS, int mode, int
 			if (zend_hash_get_current_data_ex(HASH_OF(EXT), (void **) &item, &pos) == FAILURE) {
 				continue;
 			}
-		
+
 			if (strcmp("linespacing", key) == 0) {
 				convert_to_double_ex(item);
 				strex.flags |= gdFTEX_LINESPACE;
@@ -3939,7 +3945,7 @@ PHP_FUNCTION(imagepsloadfont)
 	struct stat st;
 #endif

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &file, &file_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &file, &file_len) == FAILURE) {
 		return;
 	}

@@ -4046,7 +4052,7 @@ PHP_FUNCTION(imagepsencodefont)
 	char *enc, **enc_vector;
 	int enc_len, *f_ind;

-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rs", &fnt, &enc, &enc_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rp", &fnt, &enc, &enc_len) == FAILURE) {
 		return;
 	}

@@ -4279,11 +4285,11 @@ PHP_FUNCTION(imagepsbbox)
 	if (argc != 3 && argc != 6) {
 		ZEND_WRONG_PARAM_COUNT();
 	}
-	
+
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "srl|lld", &str, &str_len, &fnt, &sz, &sp, &wd, &angle) == FAILURE) {
 		return;
 	}
-	
+
 	if (argc == 6) {
 		space = sp;
 		add_width = wd;
@@ -137,6 +137,11 @@ static void _php_image_output_ctx(INTERNAL_FUNCTION_PARAMETERS, int image_type,
 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid 2nd parameter, it must a filename or a stream");
 			RETURN_FALSE;
 		}
+	} else if (argc > 1 && file != NULL) {
+		stream = php_stream_open_wrapper(file, "wb", REPORT_ERRORS|IGNORE_PATH|IGNORE_URL_WIN, NULL);
+		if (stream == NULL) {
+			RETURN_FALSE;
+		}
 	} else {
 		ctx = emalloc(sizeof(gdIOCtx));
 		ctx->putC = _php_image_output_putc;
@@ -184,7 +189,7 @@ static void _php_image_output_ctx(INTERNAL_FUNCTION_PARAMETERS, int image_type,
 				q = i;
 			}
 			if (image_type == PHP_GDIMG_TYPE_XBM) {
-				(*func_p)(im, file, q, ctx);
+				(*func_p)(im, file ? file : "", q, ctx);
 			} else {
 				(*func_p)(im, q, ctx);
 			}
@@ -1774,9 +1774,13 @@ void gdImageFillToBorder (gdImagePtr im, int x, int y, int border, int color)

 	if (x >= im->sx) {
 		x = im->sx - 1;
+	} else if (x < 0) {
+		x = 0;
 	}
 	if (y >= im->sy) {
 		y = im->sy - 1;
+	} else if (y < 0) {
+		y = 0;
 	}

 	for (i = x; i >= 0; i--) {
@@ -2044,7 +2048,9 @@ void gdImageRectangle (gdImagePtr im, int x1, int y1, int x2, int y2, int color)
 		t=y1;
 		y1 = y2;
 		y2 = t;
-
+	}
+	
+	if (x2 < x1) {
 		t = x1;
 		x1 = x2;
 		x2 = t;
@@ -2095,12 +2101,16 @@ void gdImageRectangle (gdImagePtr im, int x1, int y1, int x2, int y2, int color)

 		return;
 	} else {
-		y1v = y1h + 1;
-		y2v = y2h - 1;
-		gdImageLine(im, x1h, y1h, x2h, y1h, color);
-		gdImageLine(im, x1h, y2h, x2h, y2h, color);
-		gdImageLine(im, x1v, y1v, x1v, y2v, color);
-		gdImageLine(im, x2v, y1v, x2v, y2v, color);
+		if (x1 == x2 || y1 == y2) {
+			gdImageLine(im, x1, y1, x2, y2, color);
+		} else {
+			y1v = y1h + 1;
+			y2v = y2h - 1;
+			gdImageLine(im, x1h, y1h, x2h, y1h, color);
+			gdImageLine(im, x1h, y2h, x2h, y2h, color);
+			gdImageLine(im, x1v, y1v, x1v, y2v, color);
+			gdImageLine(im, x2v, y1v, x2v, y2v, color);
+		}
 	}
 }

@@ -58,7 +58,7 @@ void gdImageFilledEllipse (gdImagePtr im, int mx, int my, int w, int h, int c)
 	int x=0,mx1=0,mx2=0,my1=0,my2=0;
 	long aq,bq,dx,dy,r,rx,ry,a,b;
 	int i;
-	int old_y1,old_y2;
+	int old_y2;

 	a=w>>1;
 	b=h>>1;
@@ -79,7 +79,6 @@ void gdImageFilledEllipse (gdImagePtr im, int mx, int my, int w, int h, int c)
 	ry = 0;
 	x = a;
 	old_y2=-2;
-	old_y1=-2;
 	while (x > 0){
 		if (r > 0) {
 			my1++;my2--;
@@ -95,15 +94,10 @@ void gdImageFilledEllipse (gdImagePtr im, int mx, int my, int w, int h, int c)
 		if(old_y2!=my2){
 			for(i=mx1;i<=mx2;i++){
 				gdImageSetPixel(im,i,my1,c);
-			}
-		}
-		if(old_y2!=my2){
-			for(i=mx1;i<=mx2;i++){
 				gdImageSetPixel(im,i,my2,c);
 			}
 		}
 		old_y2 = my2;
-		old_y1 = my1;
 	}
 }

@@ -80,14 +80,14 @@ printf("rect->x: %i\nrect->y: %i\nrect->width: %i\nrect->height: %i\n", crop->x,
 	y = crop->y;
 	if (src->trueColor) {
 		unsigned int dst_y = 0;
-		while (y < (crop->y + (crop->height - 1))) {
+		while (y < (crop->y + crop->height)) {
 			/* TODO: replace 4 w/byte per channel||pitch once available */
 			memcpy(dst->tpixels[dst_y++], src->tpixels[y++] + crop->x, crop->width * 4);
 		}
 	} else {
 		int x;
-		for (y = crop->y; y < (crop->y + (crop->height - 1)); y++) {
-			for (x = crop->x; x < (crop->x + (crop->width - 1)); x++) {
+		for (y = crop->y; y < (crop->y + crop->height); y++) {
+			for (x = crop->x; x < (crop->x + crop->width); x++) {
 				dst->pixels[y - crop->y][x - crop->x] = src->pixels[y][x];
 			}
 		}
@@ -1059,6 +1059,11 @@ gdImagePtr gdImageScaleTwoPass(const gdImagePtr src, const unsigned int src_widt
 	gdImagePtr tmp_im;
 	gdImagePtr dst;

+	/* Convert to truecolor if it isn't; this code requires it. */
+	if (!src->trueColor) {
+		gdImagePaletteToTrueColor(src);
+	}
+
 	tmp_im = gdImageCreateTrueColor(new_width, src_height);
 	if (tmp_im == NULL) {
 		return NULL;
@@ -1068,12 +1073,12 @@ gdImagePtr gdImageScaleTwoPass(const gdImagePtr src, const unsigned int src_widt

 	dst = gdImageCreateTrueColor(new_width, new_height);
 	if (dst == NULL) {
-		gdFree(tmp_im);
+		gdImageDestroy(tmp_im);
 		return NULL;
 	}
 	gdImageSetInterpolationMethod(dst, src->interpolation_id);
 	_gdScaleVert(tmp_im, new_width, src_height, dst, new_width, new_height);
-	gdFree(tmp_im);
+	gdImageDestroy(tmp_im);

 	return dst;
 }
@@ -2173,10 +2178,13 @@ gdImagePtr gdImageRotateInterpolated(const gdImagePtr src, const float angle, in

 	/* no interpolation needed here */
 	switch (angle_rounded) {
-		case 9000:
+		case -27000:
+		case   9000:
 			return gdImageRotate90(src, 0);
-		case 18000:
+		case -18000:
+		case  18000:
 			return gdImageRotate180(src, 0);
+		case -9000:
 		case 27000:
 			return gdImageRotate270(src, 0);
 	}
@@ -57,21 +57,21 @@ static inline int clip(float v, int a, int b) {
  return (v > b) ? b : (v < 0) ? 0 : (int)(v);
 }
 enum {
-    COLOR_RED = 0,
-    COLOR_GREEN = 1,
-    COLOR_BLUE = 2,
-    ALPHA_CHANNEL = 3
+    COLOR_RED = 1,
+    COLOR_GREEN = 2,
+    COLOR_BLUE = 3,
+    ALPHA_CHANNEL = 0
 };

-/* endian neutral extractions of RGBA from a 32 bit pixel */
+/* endian neutral extractions of ARGB from a 32 bit pixel */
 static const uint32  RED_SHIFT =
-       8 * (sizeof(uint32) - 1 - COLOR_RED);           /* 24 */
+       8 * (sizeof(uint32) - 1 - COLOR_RED);           /* 16 */
 static const uint32  GREEN_SHIFT =
-       8 * (sizeof(uint32) - 1 - COLOR_GREEN);         /* 16 */
+       8 * (sizeof(uint32) - 1 - COLOR_GREEN);         /*  8 */
 static const uint32  BLUE_SHIFT =
-       8 * (sizeof(uint32) - 1 - COLOR_BLUE);          /*  8 */
+       8 * (sizeof(uint32) - 1 - COLOR_BLUE);          /*  0 */
 static const uint32  ALPHA_SHIFT =
-       8 * (sizeof(uint32) - 1 - ALPHA_CHANNEL);       /*  0 */
+       8 * (sizeof(uint32) - 1 - ALPHA_CHANNEL);       /* 24 */

 static inline int GetRed(const uint32* rgba) {
 	return gdTrueColorGetRed(*rgba);
@@ -706,14 +706,14 @@ static WebPResult VPXEncode(const uint8* Y,
    codec_ctl(&enc, VP8E_SET_STATIC_THRESHOLD, 0);
    codec_ctl(&enc, VP8E_SET_TOKEN_PARTITIONS, 2);

-    vpx_img_wrap(&img, IMG_FMT_I420,
+    vpx_img_wrap(&img, VPX_IMG_FMT_I420,
                 y_width, y_height, 16, (uint8*)(Y));
-    img.planes[PLANE_Y] = (uint8*)(Y);
-    img.planes[PLANE_U] = (uint8*)(U);
-    img.planes[PLANE_V] = (uint8*)(V);
-    img.stride[PLANE_Y] = y_stride;
-    img.stride[PLANE_U] = uv_stride;
-    img.stride[PLANE_V] = uv_stride;
+    img.planes[VPX_PLANE_Y] = (uint8*)(Y);
+    img.planes[VPX_PLANE_U] = (uint8*)(U);
+    img.planes[VPX_PLANE_V] = (uint8*)(V);
+    img.stride[VPX_PLANE_Y] = y_stride;
+    img.stride[VPX_PLANE_U] = uv_stride;
+    img.stride[VPX_PLANE_V] = uv_stride;

    res = vpx_codec_encode(&enc, &img, 0, 1, 0, VPX_DL_BEST_QUALITY);

@@ -779,6 +779,20 @@ WebPResult WebPEncode(const uint8* Y,
 										(chunk_size >> 24) & 255 };
 	  memcpy(*p_out, kRiffHeader, kRiffHeaderSize);

+	  if (img_size_bytes & 1) {  /* write a padding byte */
+		const int new_size = *p_out_size_bytes + 1;
+		unsigned char* p = (unsigned char*)realloc(*p_out, new_size);
+		if (p == NULL) {
+		  free(*p_out);
+		  *p_out = NULL;
+		  *p_out_size_bytes = 0;
+		  return webp_failure;
+		}
+		p[new_size - 1] = 0;
+        *p_out = p;
+		*p_out_size_bytes = new_size;
+	  }
+
 	  if (psnr) {
 		*psnr = WebPGetPSNR(Y, U, V, *p_out, *p_out_size_bytes);
 	  }
@@ -0,0 +1,21 @@
+--TEST--
+Bug #53154 (Zero-height rectangle has whiskers)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$im = imagecreatetruecolor(100, 10);
+$red = imagecolorallocate($im, 255, 0, 0);
+imagerectangle($im, 5, 5, 95, 5, $red);
+var_dump(imagecolorat($im, 5, 4) !== $red);
+var_dump(imagecolorat($im, 5, 6) !== $red);
+var_dump(imagecolorat($im, 95, 4) !== $red);
+var_dump(imagecolorat($im, 95, 6) !== $red);
+?>
+--EXPECT--
+bool(true)
+bool(true)
+bool(true)
+bool(true)