fix indent

(cherry picked from commit 9b1430140a)

NEWS

@@ -1,5 +1,141 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+08 Dec 2016 PHP 7.0.14
+
+- Core:
+  . Fixed memory leak(null coalescing operator with Spl hash). (Tyson Andre)
+  . Fixded bug #72736 (Slow performance when fetching large dataset with mysqli
+    / PDO). (Dmitry)
+
+- Calendar:
+  . Fix integer overflows (Joshua Rogers)
+
+- Date:
+  . Fixed bug #69587 (DateInterval properties and isset). (jhdxr)
+
+- DTrace:
+  . Disabled PHP call tracing by default (it makes significant overhead).
+    This may be enabled again using envirionment variable USE_ZEND_DTRACE=1.
+    (Dmitry)
+
+- JSON:
+  . Fixed bug #73526 (php_json_encode depth issue). (Jakub Zelenka)
+
+- Mysqlnd:
+  . Fixed bug #64526 (Add missing mysqlnd.* parameters to php.ini-*). (cmb)
+
+- ODBC:
+  . Fixed bug #73448 (odbc_errormsg returns trash, always 513 bytes).
+    (Anatol)
+
+- Opcache:
+  . Fixed bug #69090 (check cached files permissions). (dmitry)
+  . Fixed bug #73546 (Logging for opcache has an empty file name). (mhagstrand)
+
+- PCRE:
+  . Fixed bug #73483 (Segmentation fault on pcre_replace_callback). (Laruence)
+  . Fixed bug #73392 (A use-after-free in zend allocator management). 
+    (Laruence)
+
+- PDO_Firebird:
+  . Fixed bug #73087, #61183, #71494 (Memory corruption in bindParam).
+    (Dorin Marcoci)
+
+- Phar:
+  . Fixed bug #73580 (Phar::isValidPharFilename illegal memory access). (Stas)
+
+- Postgres:
+  . Fixed bug #73498 (Incorrect SQL generated for pg_copy_to()). (Craig Duncan)
+
+- Soap:
+  . Fixed bug #73538 (SoapClient::__setSoapHeaders doesn't overwrite SOAP
+    headers). (duncan3dc)
+  . Fixed bug #73452 (Segfault (Regression for #69152)). (Dmitry)
+
+- SPL:
+  . Fixed bug #73423 (Reproducible crash with GDB backtrace). (Laruence)
+
+- SQLite3:
+  . Fixed bug #73530 (Unsetting result set may reset other result set). (cmb)
+
+- Standard:
+  . Fixed bug #73297 (HTTP stream wrapper should ignore HTTP 100 Continue).
+    (rowan dot collins at gmail dot com)
+  . Fixed bug #73645 (version_compare illegal write access). (Stas)
+
+- Wddx:
+  . Fixed bug #73631 (Invalid read when wddx decodes empty boolean element).
+    (Stas)
+- XML:
+  . Fixed bug #72135 (malformed XML causes fault) (edgarsandi)
+
+10 Nov 2016 PHP 7.0.13
+
+- Core:
+  . Fixed bug #73350 (Exception::__toString() cause circular references).
+    (Laruence)
+  . Fixed bug #73181 (parse_str() without a second argument leads to crash).
+    (Nikita)
+  . Fixed bug #66773 (Autoload with Opcache allows importing conflicting class
+    name to namespace). (Nikita)
+  . Fixed bug #66862 ((Sub-)Namespaces unexpected behaviour). (Nikita)
+  . Fix pthreads detection when cross-compiling (ffontaine)
+  . Fixed bug #73337 (try/catch not working with two exceptions inside a same
+    operation). (Dmitry)
+  . Fixed bug #73338 (Exception thrown from error handler causes valgrind
+    warnings (and crashes)). (Bob, Dmitry)
+  . Fixed bug #73329 ((Float)"Nano" == NAN). (Anatol)
+
+- GD:
+  . Fixed bug #73213 (Integer overflow in imageline() with antialiasing). (cmb)
+  . Fixed bug #73272 (imagescale() is not affected by, but affects
+    imagesetinterpolation()). (cmb)
+  . Fixed bug #73279 (Integer overflow in gdImageScaleBilinearPalette()). (cmb)
+  . Fixed bug #73280 (Stack Buffer Overflow in GD dynamicGetbuf). (cmb)
+  . Fixed bug #72482 (Ilegal write/read access caused by gdImageAALine
+    overflow). (cmb)
+  . Fixed bug #72696 (imagefilltoborder stackoverflow on truecolor images).
+    (cmb)
+
+- IMAP:
+  . Fixed bug #73418 (Integer Overflow in "_php_imap_mail" leads to crash).
+    (Anatol)
+
+- OCI8
+  . Fixed bug #71148 (Bind reference overwritten on PHP 7). (Oracle Corp.)
+
+- phpdbg:
+  . Properly allow for stdin input from a file. (Bob)
+  . Add -s command line option / stdin command for reading script from stdin.
+    (Bob)
+  . Ignore non-executable opcodes in line mode of phpdbg_end_oplog(). (Bob)
+  . Fixed bug #70776 (Simple SIGINT does not have any effect with -rr). (Bob)
+  . Fixed bug #71234 (INI files are loaded even invoked as -n --version). (Bob)
+
+- Session:
+  . Fixed bug #73273 (session_unset() empties values from all variables in which
+    is $_session stored). (Nikita)
+
+- SOAP:
+  . Fixed bug #73037 (SoapServer reports Bad Request when gzipped). (Anatol)
+  . Fixed bug #73237 (Nested object in "any" element overwrites other fields).
+    (Keith Smiley)
+  . Fixed bug #69137 (Peer verification fails when using a proxy with SoapClient)
+    (Keith Smiley)
+
+- SQLite3:
+  . Fixed bug #73333 (2147483647 is fetched as string). (cmb)
+
+- Standard:
+  . Fixed bug #73203 (passing additional_parameters causes mail to fail). (cmb)
+  . Fixed bug #71241 (array_replace_recursive sometimes mutates its parameters).
+    (adsr)
+  . Fixed bug #73192 (parse_url return wrong hostname). (Nikita)
+
+- Wddx:
+  . Fixed bug #73331 (NULL Pointer Dereference in WDDX Packet Deserialization
+    with PDORow). (Stas)
+
 13 Oct 2016 PHP 7.0.12
 
 - Core:
@@ -13,10 +149,23 @@ PHP                                                                        NEWS
   . Fixed bug #73163 (PHP hangs if error handler throws while accessing undef
     const in default value). (Nikita)
   . Fixed bug #73172 (parse error: Invalid numeric literal). (Nikita, Anatol)
+  . Fixed for #73240 (Write out of bounds at number_format). (Stas)
+  . Fixed bug #73147 (Use After Free in PHP7 unserialize()). (Stas)
+  . Fixed bug #73189 (Memcpy negative size parameter php_resolve_path). (Stas)
+
+- BCmath:
+  . Fix bug #73190 (memcpy negative parameter _bc_new_num_ex). (Stas)
 
 - COM:
   . Fixed bug #73126 (Cannot pass parameter 1 by reference). (Anatol)
 
+- Date:
+  . Fixed bug #73091 (Unserializing DateInterval object may lead to __toString
+    invocation). (Stas)
+
+- DOM:
+  . Fixed bug #73150 (missing NULL check in dom_document_save_html). (Stas)
+
 - Filter:
   . Fixed bug #72972 (Bad filter for the flags FILTER_FLAG_NO_RES_RANGE and
     FILTER_FLAG_NO_PRIV_RANGE). (julien)
@@ -38,6 +187,9 @@ PHP                                                                        NEWS
     files). (cmb)
   . Fixed bug #73161 (imagecreatefromgd2() may leak memory). (cmb)
 
+- Intl:
+  . Fixed bug #73218 (add mitigation for ICU int overflow). (Stas)
+
 - Mbstring:
   . Fixed bug #66797 (mb_substr only takes 32-bit signed integer). (cmb)
   . Fixed bug #66964 (mb_convert_variables() cannot detect recursion) (Yasuo)
@@ -55,10 +207,13 @@ PHP                                                                        NEWS
 - OpenSSL:
   . Fixed bug #73072 (Invalid path SNI_server_certs causes segfault).
     (Jakub Zelenka)
+  . Fixed bug #73276 (crash in openssl_random_pseudo_bytes function). (Stas)
+  . Fixed bug #73275 (crash in openssl_encrypt function). (Stas)
 
 - PCRE:
   . Fixed bug #73121 (Bundled PCRE doesn't compile because JIT isn't supported
     on s390). (Anatol)
+  . Fixed bug #73174 (heap overflow in php_pcre_replace_impl). (Stas)
 
 - PDO_DBlib:
   . Fixed bug #72414 (Never quote values as raw binary data). (Adam Baratz)
@@ -82,11 +237,19 @@ PHP                                                                        NEWS
   . Fixed bug #73100 (session_destroy null dereference in ps_files_path_create).
     (cmb)
 
+- SimpleXML:
+  . Fixed bug #73293 (NULL pointer dereference in SimpleXMLElement::asXML()).
+    (Stas)
+
 - SOAP:
   . Fixed bug #71711 (Soap Server Member variables reference bug). (Nikita)
   . Fixed bug #71996 (Using references in arrays doesn't work like expected).
     (Nikita)
 
+- SPL:
+  . Fixed bug #73257, #73258 (SplObjectStorage unserialize allows use of
+    non-object as key). (Stas)
+
 - SQLite3:
   . Updated bundled SQLite3 to 3.14.2. (cmb)
 
@@ -292,6 +455,8 @@ PHP                                                                        NEWS
   . Fixed bug #68712 (suspicious if-else statements). (cmb)
   . Fixed bug #72697 (select_colors write out-of-bounds). (Stas)
   . Fixed bug #72730 (imagegammacorrect allows arbitrary write access). (Stas)
+  . Fixed bug #72494 (imagecropauto out-of-bounds access). (Fernando, Pierre,
+    cmb)
 
 - Intl:
   . Fixed bug #72639 (Segfault when instantiating class that extends

TSRM/threads.m4

@@ -66,7 +66,7 @@ dnl
 dnl Check whether the current setup can use POSIX threads calls
 dnl
 AC_DEFUN([PTHREADS_CHECK_COMPILE], [
-AC_TRY_RUN( [
+AC_LINK_IFELSE([ AC_LANG_SOURCE([
 #include <pthread.h>
 #include <stddef.h>
 
@@ -80,18 +80,11 @@ int main() {
     int data = 1;
     pthread_mutexattr_init(&mattr);
     return pthread_create(&thd, NULL, thread_routine, &data);
-} ], [
-  pthreads_working=yes
+} ]) ], [
+  pthreads_checked=yes
   ], [
-  pthreads_working=no
-  ], [
-  dnl For cross compiling running this test is of no use. NetWare supports pthreads
-  pthreads_working=no
-  case $host_alias in
-  *netware*)
-    pthreads_working=yes
-  esac
-]
+  pthreads_checked=no
+  ]
 ) ] )dnl
 dnl
 dnl PTHREADS_CHECK()
@@ -129,30 +122,34 @@ else
       CFLAGS="$CFLAGS $flag"
       PTHREADS_CHECK_COMPILE
       CFLAGS=$ac_save
-      if test "$pthreads_working" = "yes"; then
+      if test "$pthreads_checked" = "yes"; then
         ac_cv_pthreads_cflags=$flag
         break
       fi
     done
   fi
-fi
-])
+  ])
 
-AC_CACHE_CHECK(for pthreads_lib, ac_cv_pthreads_lib,[
-ac_cv_pthreads_lib=
-if test "$pthreads_working" != "yes"; then
-  for lib in pthread pthreads c_r; do
-    ac_save=$LIBS
-    LIBS="$LIBS -l$lib"
-    PTHREADS_CHECK_COMPILE
-    LIBS=$ac_save
-    if test "$pthreads_working" = "yes"; then
-      ac_cv_pthreads_lib=$lib
-      break
-    fi
-  done
+  AC_CACHE_CHECK(for pthreads_lib, ac_cv_pthreads_lib,[
+  ac_cv_pthreads_lib=
+  if test "$pthreads_working" != "yes"; then
+   for lib in pthread pthreads c_r; do
+      ac_save=$LIBS
+      LIBS="$LIBS -l$lib"
+      PTHREADS_CHECK_COMPILE
+      LIBS=$ac_save
+      if test "$pthreads_checked" = "yes"; then
+        ac_cv_pthreads_lib=$lib
+        break
+      fi
+    done
+  fi
+  ])
+
+  if test "x$ac_cv_pthreads_cflags" != "x" -o "x$ac_cv_pthreads_lib" != "x"; then
+    pthreads_working="yes"
+  fi
 fi
-])
 
 if test "$pthreads_working" = "yes"; then
   threads_result="POSIX-Threads found"

UPGRADING

@@ -727,6 +727,9 @@ out, that the corresponding SDK isn't available anymore.
 - Openssl
   minimum supported OpenSSL version series was raised to 0.9.8
 
+- Shmop
+  The shmop identifiers have been changed from ints to resources of type shmop.
+
 ========================================
 10. New Global Constants
 ========================================

Zend/tests/array_literal_next_element_error.phpt

@@ -0,0 +1,25 @@
+--TEST--
+Next free element may overflow in array literals
+--FILE--
+<?php
+
+$i = PHP_INT_MAX;
+$array = [$i => 42, new stdClass];
+var_dump($array);
+
+const FOO = [PHP_INT_MAX => 42, "foo"];
+var_dump(FOO);
+
+?>
+--EXPECTF--
+Warning: Cannot add element to the array as the next element is already occupied in %s on line %d
+array(1) {
+  [%d]=>
+  int(42)
+}
+
+Warning: Cannot add element to the array as the next element is already occupied in %s on line %d
+array(1) {
+  [%d]=>
+  int(42)
+}

Zend/tests/bug73156.phpt

@@ -1,5 +1,5 @@
 --TEST--
-iBug #73156 (segfault on undefined function)
+Bug #73156 (segfault on undefined function)
 --FILE--
 <?php
 class A {

Zend/tests/bug73181.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #73181: parse_str() without a second argument leads to crash
+--FILE--
+<?php
+
+function x() {
+    parse_str("1&x");
+    var_dump(get_defined_vars());
+}
+
+x();
+
+?>
+--EXPECT--
+array(2) {
+  [1]=>
+  string(0) ""
+  ["x"]=>
+  string(0) ""
+}

Zend/tests/bug73337.phpt

@@ -0,0 +1,12 @@
+--TEST--
+Bug #73337 (try/catch not working with two exceptions inside a same operation)
+--FILE--
+<?php
+class d { function __destruct() { throw new Exception; } }
+try { new d + new d; } catch (Exception $e) { print "Exception properly caught\n"; }
+?>
+--EXPECTF--
+Notice: Object of class d could not be converted to int in %sbug73337.php on line 3
+
+Notice: Object of class d could not be converted to int in %sbug73337.php on line 3
+Exception properly caught

Zend/tests/bug73338.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug #73338: Ensure exceptions in function init opcodes are cleaned properly
+--FILE--
+<?php
+
+try { call_user_func(new class { function __destruct () { throw new Error; } }); } catch (Error $e) {}
+
+set_error_handler(function() { throw new Error; });
+
+try { var_dump(new stdClass, call_user_func("fail")); } catch (Error $e) {}
+
+try { (function() { call_user_func("fail"); })(); } catch (Error $e) {}
+
+try { [new class { static function foo() {} function __destruct () { throw new Error; } }, "foo"](); } catch (Error $e) {}
+
+?>
+--EXPECTF--
+Warning: call_user_func() expects parameter 1 to be a valid callback, no array or string given in %s on line %d

Zend/tests/bug73350.phpt

@@ -0,0 +1,27 @@
+--TEST--
+Bug #73350 (Exception::__toString() cause circular references)
+--FILE--
+<?php
+$e = new Exception();
+
+// This line cause problem :(
+// Comment it to see the difference.
+(string) $e;
+
+// This line show the clue (PHP Warning: ...).
+var_export($e);
+?>
+--EXPECTF--
+Exception::__set_state(array(
+   'message' => '',
+   'string' => 'Exception in %sbug73350.php:%d
+Stack trace:
+#0 {main}',
+   'code' => 0,
+   'file' => '%sbug73350.php',
+   'line' => %d,
+   'trace' => 
+  array (
+  ),
+   'previous' => NULL,
+))

Zend/tests/const_array_with_resource_key.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Constexpr arrays should be able to handle resource keys
+--FILE--
+<?php
+
+const FOO = [STDIN => 42];
+var_dump(FOO);
+
+?>
+--EXPECTF--
+Notice: Resource ID#%d used as offset, casting to integer (%d) in %s on line %d
+array(1) {
+  [%d]=>
+  int(42)
+}

Zend/tests/debug_info-error-resource.phpt

@@ -1,5 +1,7 @@
 --TEST--
 Testing __debugInfo() magic method with bad returns RESOURCE
+--INI--
+allow_url_fopen=1
 --FILE--
 <?php
 

Zend/tests/use_function/no_conflict_with_classes.phpt

@@ -0,0 +1,15 @@
+--TEST--
+"use function" should not conflict with class names
+--FILE--
+<?php
+
+namespace Foo;
+
+class Bar {}
+
+use function bar;
+
+?>
+===DONE===
+--EXPECT--
+===DONE===

Zend/tests/use_no_file_conflict.phpt

@@ -0,0 +1,12 @@
+--TEST--
+Use conflicts should not occur across files
+--FILE--
+<?php
+
+require __DIR__ . '/use_no_file_conflict_1.inc';
+require __DIR__ . '/use_no_file_conflict_2.inc';
+
+?>
+===DONE===
+--EXPECT--
+===DONE===

Zend/tests/use_no_file_conflict_1.inc

@@ -0,0 +1,4 @@
+<?php
+
+namespace Foo;
+class A {}

Zend/tests/use_no_file_conflict_2.inc

@@ -0,0 +1,4 @@
+<?php
+
+namespace Foo;
+use A;

Zend/zend.c

@@ -678,9 +678,19 @@ int zend_startup(zend_utility_functions *utility_functions, char **extensions) /
 
 #if HAVE_DTRACE
 /* build with dtrace support */
-	zend_compile_file = dtrace_compile_file;
-	zend_execute_ex = dtrace_execute_ex;
-	zend_execute_internal = dtrace_execute_internal;
+	{
+		char *tmp = getenv("USE_ZEND_DTRACE");
+
+		if (tmp && zend_atoi(tmp, 0)) {
+			zend_compile_file = dtrace_compile_file;
+			zend_execute_ex = dtrace_execute_ex;
+			zend_execute_internal = dtrace_execute_internal;
+		} else {
+			zend_compile_file = compile_file;
+			zend_execute_ex = execute_ex;
+			zend_execute_internal = NULL;
+		}
+	}
 #else
 	zend_compile_file = compile_file;
 	zend_execute_ex = execute_ex;

Zend/zend_API.c

@@ -3847,6 +3847,24 @@ ZEND_API void zend_update_property_null(zend_class_entry *scope, zval *object, c
 }
 /* }}} */
 
+ZEND_API void zend_unset_property(zend_class_entry *scope, zval *object, const char *name, size_t name_length) /* {{{ */
+{
+	zval property;
+	zend_class_entry *old_scope = EG(scope);
+
+	EG(scope) = scope;
+
+	if (!Z_OBJ_HT_P(object)->unset_property) {
+		zend_error_noreturn(E_CORE_ERROR, "Property %s of class %s cannot be unset", name, ZSTR_VAL(Z_OBJCE_P(object)->name));
+	}
+	ZVAL_STRINGL(&property, name, name_length);
+	Z_OBJ_HT_P(object)->unset_property(object, &property, 0);
+	zval_ptr_dtor(&property);
+
+	EG(scope) = old_scope;
+}
+/* }}} */
+
 ZEND_API void zend_update_property_bool(zend_class_entry *scope, zval *object, const char *name, size_t name_length, zend_long value) /* {{{ */
 {
 	zval tmp;

Zend/zend_API.h

@@ -343,6 +343,7 @@ ZEND_API void zend_update_property_double(zend_class_entry *scope, zval *object,
 ZEND_API void zend_update_property_str(zend_class_entry *scope, zval *object, const char *name, size_t name_length, zend_string *value);
 ZEND_API void zend_update_property_string(zend_class_entry *scope, zval *object, const char *name, size_t name_length, const char *value);
 ZEND_API void zend_update_property_stringl(zend_class_entry *scope, zval *object, const char *name, size_t name_length, const char *value, size_t value_length);
+ZEND_API void zend_unset_property(zend_class_entry *scope, zval *object, const char *name, size_t name_length);
 
 ZEND_API int zend_update_static_property(zend_class_entry *scope, const char *name, size_t name_length, zval *value);
 ZEND_API int zend_update_static_property_null(zend_class_entry *scope, const char *name, size_t name_length);

Zend/zend_alloc.c

@@ -897,6 +897,7 @@ static void *zend_mm_alloc_pages(zend_mm_heap *heap, int pages_count ZEND_FILE_L
 {
 	zend_mm_chunk *chunk = heap->main_chunk;
 	int page_num, len;
+	int steps = 0;
 
 	while (1) {
 		if (UNEXPECTED(chunk->free_pages < pages_count)) {
@@ -1073,10 +1074,20 @@ get_chunk:
 			goto found;
 		} else {
 			chunk = chunk->next;
+			steps++;
 		}
 	}
 
 found:
+	if (steps > 2 && pages_count < 8) {
+		/* move chunk into the head of the linked-list */
+		chunk->prev->next = chunk->next;
+		chunk->next->prev = chunk->prev;
+		chunk->next = heap->main_chunk->next;
+		chunk->prev = heap->main_chunk;
+		chunk->prev->next = chunk;
+		chunk->next->prev = chunk;
+	}
 	/* mark run as allocated */
 	chunk->free_pages -= pages_count;
 	zend_mm_bitset_set_range(chunk->free_map, page_num, pages_count);
@@ -1472,7 +1483,7 @@ static void *zend_mm_realloc_heap(zend_mm_heap *heap, void *ptr, size_t size, si
 #endif
 #ifdef ZEND_WIN32
 			/* On Windows we don't have ability to extend huge blocks in-place.
-			 * We allocate them with 2MB size granularity, to avoid many 
+			 * We allocate them with 2MB size granularity, to avoid many
 			 * reallocations when they are extended by small pieces
 			 */
 			new_size = ZEND_MM_ALIGNED_SIZE_EX(size, MAX(REAL_PAGE_SIZE, ZEND_MM_CHUNK_SIZE));
@@ -1740,7 +1751,7 @@ static void *zend_mm_alloc_huge(zend_mm_heap *heap, size_t size ZEND_FILE_LINE_D
 {
 #ifdef ZEND_WIN32
 	/* On Windows we don't have ability to extend huge blocks in-place.
-	 * We allocate them with 2MB size granularity, to avoid many 
+	 * We allocate them with 2MB size granularity, to avoid many
 	 * reallocations when they are extended by small pieces
 	 */
 	size_t new_size = ZEND_MM_ALIGNED_SIZE_EX(size, MAX(REAL_PAGE_SIZE, ZEND_MM_CHUNK_SIZE));
@@ -2500,37 +2511,24 @@ ZEND_API size_t ZEND_FASTCALL _zend_mem_block_size(void *ptr ZEND_FILE_LINE_DC Z
 	return zend_mm_size(AG(mm_heap), ptr ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
 }
 
-static zend_always_inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
-{
-	int overflow;
-	size_t ret = zend_safe_address(nmemb, size, offset, &overflow);
-
-	if (UNEXPECTED(overflow)) {
-		zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
-		return 0;
-	}
-	return ret;
-}
-
-
 ZEND_API void* ZEND_FASTCALL _safe_emalloc(size_t nmemb, size_t size, size_t offset ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)
 {
-	return emalloc_rel(safe_address(nmemb, size, offset));
+	return emalloc_rel(zend_safe_address_guarded(nmemb, size, offset));
 }
 
 ZEND_API void* ZEND_FASTCALL _safe_malloc(size_t nmemb, size_t size, size_t offset)
 {
-	return pemalloc(safe_address(nmemb, size, offset), 1);
+	return pemalloc(zend_safe_address_guarded(nmemb, size, offset), 1);
 }
 
 ZEND_API void* ZEND_FASTCALL _safe_erealloc(void *ptr, size_t nmemb, size_t size, size_t offset ZEND_FILE_LINE_DC ZEND_FILE_LINE_ORIG_DC)
 {
-	return erealloc_rel(ptr, safe_address(nmemb, size, offset));
+	return erealloc_rel(ptr, zend_safe_address_guarded(nmemb, size, offset));
 }
 
 ZEND_API void* ZEND_FASTCALL _safe_realloc(void *ptr, size_t nmemb, size_t size, size_t offset)
 {
-	return perealloc(ptr, safe_address(nmemb, size, offset), 1);
+	return perealloc(ptr, zend_safe_address_guarded(nmemb, size, offset), 1);
 }
 
 

Zend/zend_ast.c

@@ -181,7 +181,11 @@ static int zend_ast_add_array_element(zval *result, zval *offset, zval *expr)
 {
 	switch (Z_TYPE_P(offset)) {
 		case IS_UNDEF:
-			zend_hash_next_index_insert(Z_ARRVAL_P(result), expr);
+			if (!zend_hash_next_index_insert(Z_ARRVAL_P(result), expr)) {
+				zend_error(E_WARNING,
+					"Cannot add element to the array as the next element is already occupied");
+				zval_ptr_dtor(expr);
+			}
 			break;
 		case IS_STRING:
 			zend_symtable_update(Z_ARRVAL_P(result), Z_STR_P(offset), expr);
@@ -202,6 +206,10 @@ static int zend_ast_add_array_element(zval *result, zval *offset, zval *expr)
 		case IS_DOUBLE:
 			zend_hash_index_update(Z_ARRVAL_P(result), zend_dval_to_lval(Z_DVAL_P(offset)), expr);
 			break;
+		case IS_RESOURCE:
+			zend_error(E_NOTICE, "Resource ID#%d used as offset, casting to integer (%d)", Z_RES_HANDLE_P(offset), Z_RES_HANDLE_P(offset));
+			zend_hash_index_update(Z_ARRVAL_P(result), Z_RES_HANDLE_P(offset), expr);
+			break;
 		default:
 			zend_throw_error(NULL, "Illegal offset type");
 			return FAILURE;

Zend/zend_compile.c

@@ -5499,6 +5499,41 @@ static void zend_check_already_in_use(uint32_t type, zend_string *old_name, zend
 }
 /* }}} */
 
+static void zend_check_use_conflict(
+		uint32_t type, zend_string *old_name, zend_string *new_name, zend_string *lookup_name) {
+	switch (type) {
+		case T_CLASS:
+		{
+			zend_class_entry *ce = zend_hash_find_ptr(CG(class_table), lookup_name);
+			if (ce && ce->type == ZEND_USER_CLASS
+				&& ce->info.user.filename == CG(compiled_filename)
+			) {
+				zend_check_already_in_use(type, old_name, new_name, lookup_name);
+			}
+			break;
+		}
+		case T_FUNCTION:
+		{
+			zend_function *fn = zend_hash_find_ptr(CG(function_table), lookup_name);
+			if (fn && fn->type == ZEND_USER_FUNCTION
+				&& fn->op_array.filename == CG(compiled_filename)
+			) {
+				zend_check_already_in_use(type, old_name, new_name, lookup_name);
+			}
+			break;
+		}
+		case T_CONST:
+		{
+			zend_string *filename = zend_hash_find_ptr(&CG(const_filenames), lookup_name);
+			if (filename && filename == CG(compiled_filename)) {
+				zend_check_already_in_use(type, old_name, new_name, lookup_name);
+			}
+			break;
+		}
+		EMPTY_SWITCH_DEFAULT_CASE()
+	}
+}
+
 void zend_compile_use(zend_ast *ast) /* {{{ */
 {
 	zend_ast_list *list = zend_ast_get_list(ast);
@@ -5555,43 +5590,11 @@ void zend_compile_use(zend_ast *ast) /* {{{ */
 			ZSTR_VAL(ns_name)[ZSTR_LEN(current_ns)] = '\\';
 			memcpy(ZSTR_VAL(ns_name) + ZSTR_LEN(current_ns) + 1, ZSTR_VAL(lookup_name), ZSTR_LEN(lookup_name));
 
-			if (zend_hash_exists(CG(class_table), ns_name)) {
-				zend_check_already_in_use(type, old_name, new_name, ns_name);
-			}
+			zend_check_use_conflict(type, old_name, new_name, ns_name);
 
 			zend_string_free(ns_name);
 		} else {
-			switch (type) {
-				case T_CLASS:
-				{
-					zend_class_entry *ce = zend_hash_find_ptr(CG(class_table), lookup_name);
-					if (ce && ce->type == ZEND_USER_CLASS
-						&& ce->info.user.filename == CG(compiled_filename)
-					) {
-						zend_check_already_in_use(type, old_name, new_name, lookup_name);
-					}
-					break;
-				}
-				case T_FUNCTION:
-				{
-					zend_function *fn = zend_hash_find_ptr(CG(function_table), lookup_name);
-					if (fn && fn->type == ZEND_USER_FUNCTION
-						&& fn->op_array.filename == CG(compiled_filename)
-					) {
-						zend_check_already_in_use(type, old_name, new_name, lookup_name);
-					}
-					break;
-				}
-				case T_CONST:
-				{
-					zend_string *filename = zend_hash_find_ptr(&CG(const_filenames), lookup_name);
-					if (filename && filename == CG(compiled_filename)) {
-						zend_check_already_in_use(type, old_name, new_name, lookup_name);
-					}
-					break;
-				}
-				EMPTY_SWITCH_DEFAULT_CASE()
-			}
+			zend_check_use_conflict(type, old_name, new_name, lookup_name);
 		}
 
 		zend_string_addref(old_name);
@@ -5950,7 +5953,11 @@ static zend_bool zend_try_ct_eval_array(zval *result, zend_ast *ast) /* {{{ */
 					break;
 			}
 		} else {
-			zend_hash_next_index_insert(Z_ARRVAL_P(result), value);
+			if (!zend_hash_next_index_insert(Z_ARRVAL_P(result), value)) {
+				zval_ptr_dtor_nogc(value);
+				zval_ptr_dtor(result);
+				return 0;
+			}
 		}
 	}
 

Zend/zend_exceptions.c

@@ -293,10 +293,7 @@ ZEND_METHOD(exception, __construct)
 #define CHECK_EXC_TYPE(name, type) \
 	pvalue = zend_read_property(i_get_exception_base(object), (object), name, sizeof(name) - 1, 1, &value); \
 	if (Z_TYPE_P(pvalue) != IS_NULL && Z_TYPE_P(pvalue) != type) { \
-		zval tmp; \
-		ZVAL_STRINGL(&tmp, name, sizeof(name) - 1); \
-		Z_OBJ_HANDLER_P(object, unset_property)(object, &tmp, NULL); \
-		zval_ptr_dtor(&tmp); \
+		zend_unset_property(i_get_exception_base(object), object, name, sizeof(name)-1); \
 	}
 
 ZEND_METHOD(exception, __wakeup)
@@ -309,7 +306,12 @@ ZEND_METHOD(exception, __wakeup)
 	CHECK_EXC_TYPE("file", IS_STRING);
 	CHECK_EXC_TYPE("line", IS_LONG);
 	CHECK_EXC_TYPE("trace", IS_ARRAY);
-	CHECK_EXC_TYPE("previous", IS_OBJECT);
+	pvalue = zend_read_property(i_get_exception_base(object), object, "previous", sizeof("previous")-1, 1, &value);
+	if (pvalue && Z_TYPE_P(pvalue) != IS_NULL && (Z_TYPE_P(pvalue) != IS_OBJECT ||
+			!instanceof_function(Z_OBJCE_P(pvalue), i_get_exception_base(object)) ||
+			pvalue == object)) {
+		zend_unset_property(i_get_exception_base(object), object, "previous", sizeof("previous")-1);
+	}
 }
 /* }}} */
 
@@ -771,10 +773,25 @@ ZEND_METHOD(exception, __toString)
 		zend_string_release(file);
 		zval_ptr_dtor(&trace);
 
+		Z_OBJPROP_P(exception)->u.v.nApplyCount++;
 		exception = GET_PROPERTY(exception, "previous");
+		if (exception && Z_TYPE_P(exception) == IS_OBJECT && Z_OBJPROP_P(exception)->u.v.nApplyCount > 0) {
+			break;
+		}
 	}
 	zval_dtor(&fname);
 
+	exception = getThis();
+	/* Reset apply counts */
+	while (exception && Z_TYPE_P(exception) == IS_OBJECT && (base_ce = i_get_exception_base(exception)) && instanceof_function(Z_OBJCE_P(exception), base_ce)) {
+		if (Z_OBJPROP_P(exception)->u.v.nApplyCount) {
+			Z_OBJPROP_P(exception)->u.v.nApplyCount--;
+		} else {
+			break;
+		}
+		exception = GET_PROPERTY(exception, "previous");
+	}
+
 	exception = getThis();
 	base_ce = i_get_exception_base(exception);
 

Zend/zend_execute.c

@@ -576,7 +576,6 @@ static inline zval *_get_obj_zval_ptr_ptr(int op_type, znode_op node, zend_execu
 static inline void zend_assign_to_variable_reference(zval *variable_ptr, zval *value_ptr)
 {
 	zend_reference *ref;
-	zval garbage;
 
 	if (EXPECTED(!Z_ISREF_P(value_ptr))) {
 		ZVAL_NEW_REF(value_ptr, value_ptr);
@@ -586,9 +585,18 @@ static inline void zend_assign_to_variable_reference(zval *variable_ptr, zval *v
 
 	ref = Z_REF_P(value_ptr);
 	GC_REFCOUNT(ref)++;
-	ZVAL_COPY_VALUE(&garbage, variable_ptr);
+	if (Z_REFCOUNTED_P(variable_ptr)) {
+		zend_refcounted *garbage = Z_COUNTED_P(variable_ptr);
+
+		if (--GC_REFCOUNT(garbage) == 0) {
+			ZVAL_REF(variable_ptr, ref);
+			zval_dtor_func_for_ptr(garbage);
+			return;
+		} else {
+			GC_ZVAL_CHECK_POSSIBLE_ROOT(variable_ptr);
+		}
+	}
 	ZVAL_REF(variable_ptr, ref);
-	zval_ptr_dtor(&garbage);
 }
 
 /* this should modify object only if it's empty */
@@ -1404,11 +1412,11 @@ static zend_never_inline void zend_pre_incdec_overloaded_property(zval *object,
 	zval rv;
 
 	if (Z_OBJ_HT_P(object)->read_property && Z_OBJ_HT_P(object)->write_property) {
-		zval *z, obj;
+		zval *z, *zptr, obj;
 				
 		ZVAL_OBJ(&obj, Z_OBJ_P(object));
 		Z_ADDREF(obj);
-		z = Z_OBJ_HT(obj)->read_property(&obj, property, BP_VAR_R, cache_slot, &rv);
+		zptr = z = Z_OBJ_HT(obj)->read_property(&obj, property, BP_VAR_R, cache_slot, &rv);
 		if (UNEXPECTED(EG(exception))) {
 			OBJ_RELEASE(Z_OBJ(obj));
 			return;
@@ -1435,7 +1443,7 @@ static zend_never_inline void zend_pre_incdec_overloaded_property(zval *object,
 		}
 		Z_OBJ_HT(obj)->write_property(&obj, property, z, cache_slot);
 		OBJ_RELEASE(Z_OBJ(obj));
-		zval_ptr_dtor(z);
+		zval_ptr_dtor(zptr);
 	} else {
 		zend_error(E_WARNING, "Attempt to increment/decrement property of non-object");
 		if (UNEXPECTED(result)) {

Zend/zend_execute_API.c

@@ -852,8 +852,11 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache) /
 		EG(scope) = func->common.scope;
 		call->symbol_table = fci->symbol_table;
 		if (EXPECTED((func->op_array.fn_flags & ZEND_ACC_GENERATOR) == 0)) {
+			const zend_op *current_opline_before_exception = EG(opline_before_exception);
+
 			zend_init_execute_data(call, &func->op_array, fci->retval);
 			zend_execute_ex(call);
+			EG(opline_before_exception) = current_opline_before_exception;
 		} else {
 			zend_generator_create_zval(call, &func->op_array, fci->retval);
 		}

Zend/zend_hash.c

@@ -1447,13 +1447,17 @@ ZEND_API void ZEND_FASTCALL zend_symtable_clean(HashTable *ht)
 		} else if (ht->nNumUsed == ht->nNumOfElements) {
 			do {
 				i_zval_ptr_dtor(&p->val ZEND_FILE_LINE_CC);
-				zend_string_release(p->key);
+				if (EXPECTED(p->key)) {
+					zend_string_release(p->key);
+				}
 			} while (++p != end);
 		} else {
 			do {
 				if (EXPECTED(Z_TYPE(p->val) != IS_UNDEF)) {
 					i_zval_ptr_dtor(&p->val ZEND_FILE_LINE_CC);
-					zend_string_release(p->key);
+					if (EXPECTED(p->key)) {
+						zend_string_release(p->key);
+					}
 				}
 			} while (++p != end);
 		}

Zend/zend_ini_parser.y

@@ -46,6 +46,8 @@ int ini_parse(void);
 #define YYFREE free
 #endif
 
+#define ZEND_SYSTEM_INI CG(ini_parser_unbuffered_errors)
+
 /* {{{ zend_ini_do_op()
 */
 static void zend_ini_do_op(char type, zval *result, zval *op1, zval *op2)
@@ -86,7 +88,7 @@ static void zend_ini_do_op(char type, zval *result, zval *op1, zval *op2)
 	}
 
 	str_len = zend_sprintf(str_result, "%d", i_result);
-	ZVAL_PSTRINGL(result, str_result, str_len);
+	ZVAL_NEW_STR(result, zend_string_init(str_result, str_len, ZEND_SYSTEM_INI));
 }
 /* }}} */
 
@@ -94,7 +96,11 @@ static void zend_ini_do_op(char type, zval *result, zval *op1, zval *op2)
 */
 static void zend_ini_init_string(zval *result)
 {
-	ZVAL_EMPTY_PSTRING(result);
+	if (ZEND_SYSTEM_INI) {
+		ZVAL_EMPTY_PSTRING(result);
+	} else {
+		ZVAL_EMPTY_STRING(result);
+	}
 }
 /* }}} */
 
@@ -107,8 +113,12 @@ static void zend_ini_add_string(zval *result, zval *op1, zval *op2)
 	if (Z_TYPE_P(op1) != IS_STRING) {
 		zend_string *str = zval_get_string(op1);
 		/* ZEND_ASSERT(!Z_REFCOUNTED_P(op1)); */
-		ZVAL_PSTRINGL(op1, ZSTR_VAL(str), ZSTR_LEN(str));
-		zend_string_release(str);
+		if (ZEND_SYSTEM_INI) {
+			ZVAL_PSTRINGL(op1, ZSTR_VAL(str), ZSTR_LEN(str));
+			zend_string_release(str);
+		} else {
+			ZVAL_STR(op1, str);
+		}
 	}
 	op1_len = (int)Z_STRLEN_P(op1);
 	
@@ -117,7 +127,7 @@ static void zend_ini_add_string(zval *result, zval *op1, zval *op2)
 	}
 	length = op1_len + (int)Z_STRLEN_P(op2);
 
-	ZVAL_NEW_STR(result, zend_string_extend(Z_STR_P(op1), length, 1));
+	ZVAL_NEW_STR(result, zend_string_extend(Z_STR_P(op1), length, ZEND_SYSTEM_INI));
 	memcpy(Z_STRVAL_P(result) + op1_len, Z_STRVAL_P(op2), Z_STRLEN_P(op2) + 1);
 }
 /* }}} */
@@ -140,7 +150,7 @@ static void zend_ini_get_constant(zval *result, zval *name)
 			convert_to_string(&tmp);
 			c = &tmp;
 		}
-		ZVAL_PSTRINGL(result, Z_STRVAL_P(c), Z_STRLEN_P(c));
+		ZVAL_NEW_STR(result, zend_string_init(Z_STRVAL_P(c), Z_STRLEN_P(c), ZEND_SYSTEM_INI));
 		if (c == &tmp) {
 			zend_string_release(Z_STR(tmp));
 		}
@@ -160,11 +170,11 @@ static void zend_ini_get_var(zval *result, zval *name)
 
 	/* Fetch configuration option value */
 	if ((curval = zend_get_configuration_directive(Z_STR_P(name))) != NULL) {
-		ZVAL_PSTRINGL(result, Z_STRVAL_P(curval), Z_STRLEN_P(curval));
+		ZVAL_NEW_STR(result, zend_string_init(Z_STRVAL_P(curval), Z_STRLEN_P(curval), ZEND_SYSTEM_INI));
 	/* ..or if not found, try ENV */
 	} else if ((envvar = zend_getenv(Z_STRVAL_P(name), Z_STRLEN_P(name))) != NULL ||
 			   (envvar = getenv(Z_STRVAL_P(name))) != NULL) {
-		ZVAL_PSTRING(result, envvar);
+		ZVAL_NEW_STR(result, zend_string_init(envvar, strlen(envvar), ZEND_SYSTEM_INI));
 	} else {
 		zend_ini_init_string(result);
 	}
@@ -282,6 +292,8 @@ ZEND_API int zend_parse_ini_string(char *str, zend_bool unbuffered_errors, int s
 %left '|' '&' '^'
 %right '~' '!'
 
+%destructor { zval_ptr_dtor(&$$); } TC_RAW TC_CONSTANT TC_NUMBER TC_STRING TC_WHITESPACE TC_LABEL TC_OFFSET TC_VARNAME BOOL_TRUE BOOL_FALSE NULL_NULL
+
 %%
 
 statement_list:

Zend/zend_ini_scanner.l

@@ -110,6 +110,8 @@ ZEND_API ts_rsrc_id ini_scanner_globals_id;
 ZEND_API zend_ini_scanner_globals ini_scanner_globals;
 #endif
 
+#define ZEND_SYSTEM_INI CG(ini_parser_unbuffered_errors)
+
 /* Eat leading whitespace */
 #define EAT_LEADING_WHITESPACE()                     \
 	while (yyleng) {                                 \
@@ -137,7 +139,7 @@ ZEND_API zend_ini_scanner_globals ini_scanner_globals;
 #define EAT_TRAILING_WHITESPACE()	EAT_TRAILING_WHITESPACE_EX('X')
 
 #define zend_ini_copy_value(retval, str, len)	\
-	ZVAL_NEW_STR(retval, zend_string_init(str, len, 1))
+	ZVAL_NEW_STR(retval, zend_string_init(str, len, ZEND_SYSTEM_INI))
 
 
 #define RETURN_TOKEN(type, str, len) {                       \

Zend/zend_ini_scanner_defs.h

@@ -1,4 +1,4 @@
-/* Generated by re2c 0.13.5 */
+/* Generated by re2c 0.14.3 */
 #line 3 "Zend/zend_ini_scanner_defs.h"
 
 enum YYCONDTYPE {

Zend/zend_language_scanner.l

@@ -589,6 +589,7 @@ ZEND_API zend_op_array *compile_file(zend_file_handle *file_handle, int type)
 		CG(ast) = NULL;
 		CG(ast_arena) = zend_arena_create(1024 * 32);
 		if (!zendparse()) {
+			int last_lineno = CG(zend_lineno);
 			zval retval_zv;
 			zend_file_context original_file_context;
 			zend_oparray_context original_oparray_context;
@@ -605,9 +606,10 @@ ZEND_API zend_op_array *compile_file(zend_file_handle *file_handle, int type)
 			zend_file_context_begin(&original_file_context);
 			zend_oparray_context_begin(&original_oparray_context);
 			zend_compile_top_stmt(CG(ast));
+			CG(zend_lineno) = last_lineno;
 			zend_emit_final_return(&retval_zv);
 			op_array->line_start = 1;
-			op_array->line_end = CG(zend_lineno);
+			op_array->line_end = last_lineno;
 			pass_two(op_array);
 			zend_oparray_context_end(&original_oparray_context);
 			zend_file_context_end(&original_file_context);
@@ -756,6 +758,7 @@ zend_op_array *compile_string(zval *source_string, char *filename)
 		BEGIN(ST_IN_SCRIPTING);
 
 		if (!zendparse()) {
+			int last_lineno = CG(zend_lineno);
 			zend_file_context original_file_context;
 			zend_oparray_context original_oparray_context;
 			zend_op_array *original_active_op_array = CG(active_op_array);
@@ -770,9 +773,10 @@ zend_op_array *compile_string(zval *source_string, char *filename)
 			zend_file_context_begin(&original_file_context);
 			zend_oparray_context_begin(&original_oparray_context);
 			zend_compile_top_stmt(CG(ast));
+			CG(zend_lineno) = last_lineno;
 			zend_emit_final_return(NULL);
 			op_array->line_start = 1;
-			op_array->line_end = CG(zend_lineno);
+			op_array->line_end = last_lineno;
 			pass_two(op_array);
 			zend_oparray_context_end(&original_oparray_context);
 			zend_file_context_end(&original_file_context);

Zend/zend_language_scanner_defs.h

@@ -1,4 +1,4 @@
-/* Generated by re2c 0.13.5 */
+/* Generated by re2c 0.16 */
 #line 3 "Zend/zend_language_scanner_defs.h"
 
 enum YYCONDTYPE {

Zend/zend_multiply.h

@@ -266,6 +266,31 @@ static zend_always_inline size_t zend_safe_address(size_t nmemb, size_t size, si
 }
 #endif
 
+static zend_always_inline size_t zend_safe_address_guarded(size_t nmemb, size_t size, size_t offset)
+{
+	int overflow;
+	size_t ret = zend_safe_address(nmemb, size, offset, &overflow);
+
+	if (UNEXPECTED(overflow)) {
+		zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
+		return 0;
+	}
+	return ret;
+}
+
+/* A bit more generic version of the same */
+static zend_always_inline size_t zend_safe_addmult(size_t nmemb, size_t size, size_t offset, const char *message)
+{
+	int overflow;
+	size_t ret = zend_safe_address(nmemb, size, offset, &overflow);
+
+	if (UNEXPECTED(overflow)) {
+		zend_error_noreturn(E_ERROR, "Possible integer overflow in %s (%zu * %zu + %zu)", message, nmemb, size, offset);
+		return 0;
+	}
+	return ret;
+}
+
 #endif /* ZEND_MULTIPLY_H */
 
 /*

Zend/zend_object_handlers.c

@@ -736,9 +736,11 @@ zval *zend_std_read_dimension(zval *object, zval *offset, int type, zval *rv) /*
 		if (type == BP_VAR_IS) {
 			zend_call_method_with_1_params(object, ce, NULL, "offsetexists", rv, offset);
 			if (UNEXPECTED(Z_ISUNDEF_P(rv))) {
+				zval_ptr_dtor(offset);
 				return NULL;
 			}
 			if (!i_zend_is_true(rv)) {
+				zval_ptr_dtor(offset);
 				zval_ptr_dtor(rv);
 				return &EG(uninitialized_zval);
 			}

Zend/zend_portability.h

@@ -125,6 +125,8 @@
 # define ZEND_IGNORE_VALUE(x) ((void) (x))
 #endif
 
+#define zend_quiet_write(...) ZEND_IGNORE_VALUE(write(__VA_ARGS__))
+
 /* all HAVE_XXX test have to be after the include of zend_config above */
 
 #if defined(HAVE_LIBDL) && !defined(ZEND_WIN32)

Zend/zend_strtod.c

@@ -2677,6 +2677,14 @@ zend_strtod
 			}
 		}
  dig_done:
+ 	if (nd < 0) {
+ 		/* overflow */
+ 		nd = DBL_DIG + 2;
+ 	}
+ 	if (nf < 0) {
+ 		/* overflow */
+ 		nf = DBL_DIG + 2;
+ 	}
 	e = 0;
 	if (c == 'e' || c == 'E') {
 		if (!nd && !nz && !nz0) {
@@ -4543,7 +4551,7 @@ static void destroy_freelist(void)
 		}
 		freelist[i] = NULL;
 	}
-	FREE_DTOA_LOCK(0) 
+	FREE_DTOA_LOCK(0)
 }
 
 #ifdef __cplusplus

Zend/zend_strtod_int.h

@@ -68,6 +68,10 @@ typedef unsigned long int uint32_t;
 #undef USE_LOCALE
 #endif
 
+#ifndef NO_INFNAN_CHECK
+#define NO_INFNAN_CHECK
+#endif
+
 #ifdef WORDS_BIGENDIAN
 #define IEEE_BIG_ENDIAN 1
 #else

Zend/zend_vm_def.h

@@ -3012,15 +3012,19 @@ ZEND_VM_HANDLER(112, ZEND_INIT_METHOD_CALL, CONST|TMPVAR|UNUSED|CV, CONST|TMPVAR
 		GC_REFCOUNT(obj)++; /* For $this pointer */
 	}
 
+	FREE_OP2();
+	FREE_OP1();
+
+	if ((OP1_TYPE & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(EG(exception))) {
+		HANDLE_EXCEPTION();
+	}
+
 	call = zend_vm_stack_push_call_frame(call_info,
 		fbc, opline->extended_value, called_scope, obj);
 	call->prev_execute_data = EX(call);
 	EX(call) = call;
 
-	FREE_OP2();
-	FREE_OP1();
-
-	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+	ZEND_VM_NEXT_OPCODE();
 }
 
 ZEND_VM_HANDLER(113, ZEND_INIT_STATIC_METHOD_CALL, CONST|VAR, CONST|TMPVAR|UNUSED|CV)
@@ -3161,7 +3165,7 @@ ZEND_VM_HANDLER(113, ZEND_INIT_STATIC_METHOD_CALL, CONST|VAR, CONST|TMPVAR|UNUSE
 	call->prev_execute_data = EX(call);
 	EX(call) = call;
 
-	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+	ZEND_VM_NEXT_OPCODE();
 }
 
 ZEND_VM_HANDLER(59, ZEND_INIT_FCALL_BY_NAME, ANY, CONST)
@@ -3283,7 +3287,6 @@ ZEND_VM_C_LABEL(try_function_name):
 			called_scope = NULL;
 			object = NULL;
 		}
-		FREE_OP2();
 	} else if (OP2_TYPE != IS_CONST &&
 	    EXPECTED(Z_TYPE_P(function_name) == IS_OBJECT) &&
 		Z_OBJ_HANDLER_P(function_name, get_closure) &&
@@ -3297,7 +3300,6 @@ ZEND_VM_C_LABEL(try_function_name):
 			call_info |= ZEND_CALL_RELEASE_THIS;
 			GC_REFCOUNT(object)++; /* For $this pointer */
 		}
-		FREE_OP2();
 	} else if (EXPECTED(Z_TYPE_P(function_name) == IS_ARRAY) &&
 			zend_hash_num_elements(Z_ARRVAL_P(function_name)) == 2) {
 		zval *obj;
@@ -3381,7 +3383,6 @@ ZEND_VM_C_LABEL(try_function_name):
 				GC_REFCOUNT(object)++; /* For $this pointer */
 			}
 		}
-		FREE_OP2();
 	} else if ((OP2_TYPE & (IS_VAR|IS_CV)) && Z_TYPE_P(function_name) == IS_REFERENCE) {
 		function_name = Z_REFVAL_P(function_name);
 		ZEND_VM_C_GOTO(try_function_name);
@@ -3396,6 +3397,18 @@ ZEND_VM_C_LABEL(try_function_name):
 		FREE_OP2();
 		HANDLE_EXCEPTION();
 	}
+
+	FREE_OP2();
+	if ((OP2_TYPE & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(EG(exception))) {
+		if (call_info & ZEND_CALL_RELEASE_THIS) {
+			zend_object_release(object);
+		}
+		if (fbc->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
+			zend_string_release(fbc->common.function_name);
+			zend_free_trampoline(fbc);
+		}
+		HANDLE_EXCEPTION();
+	}
 	call = zend_vm_stack_push_call_frame(call_info,
 		fbc, opline->extended_value, called_scope, object);
 	call->prev_execute_data = EX(call);
@@ -3421,6 +3434,19 @@ ZEND_VM_HANDLER(118, ZEND_INIT_USER_CALL, CONST, CONST|TMPVAR|CV)
 	function_name = GET_OP2_ZVAL_PTR(BP_VAR_R);
 	if (zend_is_callable_ex(function_name, NULL, 0, NULL, &fcc, &error)) {
 		func = fcc.function_handler;
+		called_scope = fcc.called_scope;
+		object = fcc.object;
+		if (error) {
+			efree(error);
+			/* This is the only soft error is_callable() can generate */
+			zend_error(E_DEPRECATED,
+				"Non-static method %s::%s() should not be called statically",
+				ZSTR_VAL(func->common.scope->name), ZSTR_VAL(func->common.function_name));
+			if (UNEXPECTED(EG(exception) != NULL)) {
+				FREE_OP2();
+				HANDLE_EXCEPTION();
+			}
+		}
 		if (func->common.fn_flags & ZEND_ACC_CLOSURE) {
 			/* Delay closure destruction until its invocation */
 			if (OP2_TYPE & (IS_VAR|IS_CV)) {
@@ -3430,25 +3456,28 @@ ZEND_VM_HANDLER(118, ZEND_INIT_USER_CALL, CONST, CONST|TMPVAR|CV)
 			GC_REFCOUNT((zend_object*)func->common.prototype)++;
 			call_info |= ZEND_CALL_CLOSURE;
 		}
-		called_scope = fcc.called_scope;
-		object = fcc.object;
 		if (object) {
 			call_info |= ZEND_CALL_RELEASE_THIS;
 			GC_REFCOUNT(object)++; /* For $this pointer */
 		}
-		if (error) {
-			efree(error);
-			/* This is the only soft error is_callable() can generate */
-			zend_error(E_DEPRECATED,
-				"Non-static method %s::%s() should not be called statically",
-				ZSTR_VAL(func->common.scope->name), ZSTR_VAL(func->common.function_name));
-			if (UNEXPECTED(EG(exception) != NULL)) {
-				HANDLE_EXCEPTION();
+
+		FREE_OP2();
+		if ((OP2_TYPE & (IS_TMP_VAR|IS_VAR)) && UNEXPECTED(EG(exception))) {
+			if (call_info & ZEND_CALL_CLOSURE) {
+				zend_object_release((zend_object*)func->common.prototype);
 			}
+			if (call_info & ZEND_CALL_RELEASE_THIS) {
+				zend_object_release(object);
+			}
+			HANDLE_EXCEPTION();
 		}
 	} else {
 		zend_internal_type_error(EX_USES_STRICT_TYPES(), "%s() expects parameter 1 to be a valid callback, %s", Z_STRVAL_P(EX_CONSTANT(opline->op1)), error);
 		efree(error);
+		FREE_OP2();
+		if (UNEXPECTED(EG(exception))) {
+			HANDLE_EXCEPTION();
+		}
 		func = (zend_function*)&zend_pass_function;
 		called_scope = NULL;
 		object = NULL;
@@ -3459,8 +3488,7 @@ ZEND_VM_HANDLER(118, ZEND_INIT_USER_CALL, CONST, CONST|TMPVAR|CV)
 	call->prev_execute_data = EX(call);
 	EX(call) = call;
 
-	FREE_OP2();
-	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+	ZEND_VM_NEXT_OPCODE();
 }
 
 ZEND_VM_HANDLER(69, ZEND_INIT_NS_FCALL_BY_NAME, ANY, CONST)
@@ -4946,7 +4974,7 @@ ZEND_VM_HANDLER(68, ZEND_NEW, CONST|VAR, ANY)
 			ZVAL_COPY(EX_VAR(opline->result.var), &object_zval);
 		}
 
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+		ZEND_VM_NEXT_OPCODE();
 	}
 }
 
@@ -5232,7 +5260,10 @@ ZEND_VM_C_LABEL(num_index):
 		}
 		FREE_OP2();
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr);
+		if (!zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr)) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(expr_ptr);
+		}
 	}
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }

Zend/zend_vm_execute.h

@@ -1995,7 +1995,6 @@ try_function_name:
 			called_scope = NULL;
 			object = NULL;
 		}
-
 	} else if (IS_CONST != IS_CONST &&
 	    EXPECTED(Z_TYPE_P(function_name) == IS_OBJECT) &&
 		Z_OBJ_HANDLER_P(function_name, get_closure) &&
@@ -2009,7 +2008,6 @@ try_function_name:
 			call_info |= ZEND_CALL_RELEASE_THIS;
 			GC_REFCOUNT(object)++; /* For $this pointer */
 		}
-
 	} else if (EXPECTED(Z_TYPE_P(function_name) == IS_ARRAY) &&
 			zend_hash_num_elements(Z_ARRVAL_P(function_name)) == 2) {
 		zval *obj;
@@ -2093,7 +2091,6 @@ try_function_name:
 				GC_REFCOUNT(object)++; /* For $this pointer */
 			}
 		}
-
 	} else if ((IS_CONST & (IS_VAR|IS_CV)) && Z_TYPE_P(function_name) == IS_REFERENCE) {
 		function_name = Z_REFVAL_P(function_name);
 		goto try_function_name;
@@ -2108,6 +2105,17 @@ try_function_name:
 
 		HANDLE_EXCEPTION();
 	}
+
+	if ((IS_CONST & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(EG(exception))) {
+		if (call_info & ZEND_CALL_RELEASE_THIS) {
+			zend_object_release(object);
+		}
+		if (fbc->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
+			zend_string_release(fbc->common.function_name);
+			zend_free_trampoline(fbc);
+		}
+		HANDLE_EXCEPTION();
+	}
 	call = zend_vm_stack_push_call_frame(call_info,
 		fbc, opline->extended_value, called_scope, object);
 	call->prev_execute_data = EX(call);
@@ -2418,7 +2426,6 @@ try_function_name:
 			called_scope = NULL;
 			object = NULL;
 		}
-
 	} else if (IS_CV != IS_CONST &&
 	    EXPECTED(Z_TYPE_P(function_name) == IS_OBJECT) &&
 		Z_OBJ_HANDLER_P(function_name, get_closure) &&
@@ -2432,7 +2439,6 @@ try_function_name:
 			call_info |= ZEND_CALL_RELEASE_THIS;
 			GC_REFCOUNT(object)++; /* For $this pointer */
 		}
-
 	} else if (EXPECTED(Z_TYPE_P(function_name) == IS_ARRAY) &&
 			zend_hash_num_elements(Z_ARRVAL_P(function_name)) == 2) {
 		zval *obj;
@@ -2516,7 +2522,6 @@ try_function_name:
 				GC_REFCOUNT(object)++; /* For $this pointer */
 			}
 		}
-
 	} else if ((IS_CV & (IS_VAR|IS_CV)) && Z_TYPE_P(function_name) == IS_REFERENCE) {
 		function_name = Z_REFVAL_P(function_name);
 		goto try_function_name;
@@ -2531,6 +2536,17 @@ try_function_name:
 
 		HANDLE_EXCEPTION();
 	}
+
+	if ((IS_CV & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(EG(exception))) {
+		if (call_info & ZEND_CALL_RELEASE_THIS) {
+			zend_object_release(object);
+		}
+		if (fbc->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
+			zend_string_release(fbc->common.function_name);
+			zend_free_trampoline(fbc);
+		}
+		HANDLE_EXCEPTION();
+	}
 	call = zend_vm_stack_push_call_frame(call_info,
 		fbc, opline->extended_value, called_scope, object);
 	call->prev_execute_data = EX(call);
@@ -2674,7 +2690,6 @@ try_function_name:
 			called_scope = NULL;
 			object = NULL;
 		}
-		zval_ptr_dtor_nogc(free_op2);
 	} else if ((IS_TMP_VAR|IS_VAR) != IS_CONST &&
 	    EXPECTED(Z_TYPE_P(function_name) == IS_OBJECT) &&
 		Z_OBJ_HANDLER_P(function_name, get_closure) &&
@@ -2688,7 +2703,6 @@ try_function_name:
 			call_info |= ZEND_CALL_RELEASE_THIS;
 			GC_REFCOUNT(object)++; /* For $this pointer */
 		}
-		zval_ptr_dtor_nogc(free_op2);
 	} else if (EXPECTED(Z_TYPE_P(function_name) == IS_ARRAY) &&
 			zend_hash_num_elements(Z_ARRVAL_P(function_name)) == 2) {
 		zval *obj;
@@ -2772,7 +2786,6 @@ try_function_name:
 				GC_REFCOUNT(object)++; /* For $this pointer */
 			}
 		}
-		zval_ptr_dtor_nogc(free_op2);
 	} else if (((IS_TMP_VAR|IS_VAR) & (IS_VAR|IS_CV)) && Z_TYPE_P(function_name) == IS_REFERENCE) {
 		function_name = Z_REFVAL_P(function_name);
 		goto try_function_name;
@@ -2787,6 +2800,18 @@ try_function_name:
 		zval_ptr_dtor_nogc(free_op2);
 		HANDLE_EXCEPTION();
 	}
+
+	zval_ptr_dtor_nogc(free_op2);
+	if (((IS_TMP_VAR|IS_VAR) & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(EG(exception))) {
+		if (call_info & ZEND_CALL_RELEASE_THIS) {
+			zend_object_release(object);
+		}
+		if (fbc->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
+			zend_string_release(fbc->common.function_name);
+			zend_free_trampoline(fbc);
+		}
+		HANDLE_EXCEPTION();
+	}
 	call = zend_vm_stack_push_call_frame(call_info,
 		fbc, opline->extended_value, called_scope, object);
 	call->prev_execute_data = EX(call);
@@ -3367,7 +3392,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_NEW_SPEC_CONST_HANDLER(ZEND_OP
 			ZVAL_COPY(EX_VAR(opline->result.var), &object_zval);
 		}
 
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+		ZEND_VM_NEXT_OPCODE();
 	}
 }
 
@@ -5594,13 +5619,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_CONST_CO
 		GC_REFCOUNT(obj)++; /* For $this pointer */
 	}
 
+
+	if ((IS_CONST & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(EG(exception))) {
+		HANDLE_EXCEPTION();
+	}
+
 	call = zend_vm_stack_push_call_frame(call_info,
 		fbc, opline->extended_value, called_scope, obj);
 	call->prev_execute_data = EX(call);
 	EX(call) = call;
 
-
-	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+	ZEND_VM_NEXT_OPCODE();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -5741,7 +5770,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_C
 	call->prev_execute_data = EX(call);
 	EX(call) = call;
 
-	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+	ZEND_VM_NEXT_OPCODE();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_USER_CALL_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -5761,6 +5790,19 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_USER_CALL_SPEC_CONST_CONS
 	function_name = EX_CONSTANT(opline->op2);
 	if (zend_is_callable_ex(function_name, NULL, 0, NULL, &fcc, &error)) {
 		func = fcc.function_handler;
+		called_scope = fcc.called_scope;
+		object = fcc.object;
+		if (error) {
+			efree(error);
+			/* This is the only soft error is_callable() can generate */
+			zend_error(E_DEPRECATED,
+				"Non-static method %s::%s() should not be called statically",
+				ZSTR_VAL(func->common.scope->name), ZSTR_VAL(func->common.function_name));
+			if (UNEXPECTED(EG(exception) != NULL)) {
+
+				HANDLE_EXCEPTION();
+			}
+		}
 		if (func->common.fn_flags & ZEND_ACC_CLOSURE) {
 			/* Delay closure destruction until its invocation */
 			if (IS_CONST & (IS_VAR|IS_CV)) {
@@ -5770,25 +5812,27 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_USER_CALL_SPEC_CONST_CONS
 			GC_REFCOUNT((zend_object*)func->common.prototype)++;
 			call_info |= ZEND_CALL_CLOSURE;
 		}
-		called_scope = fcc.called_scope;
-		object = fcc.object;
 		if (object) {
 			call_info |= ZEND_CALL_RELEASE_THIS;
 			GC_REFCOUNT(object)++; /* For $this pointer */
 		}
-		if (error) {
-			efree(error);
-			/* This is the only soft error is_callable() can generate */
-			zend_error(E_DEPRECATED,
-				"Non-static method %s::%s() should not be called statically",
-				ZSTR_VAL(func->common.scope->name), ZSTR_VAL(func->common.function_name));
-			if (UNEXPECTED(EG(exception) != NULL)) {
-				HANDLE_EXCEPTION();
+
+		if ((IS_CONST & (IS_TMP_VAR|IS_VAR)) && UNEXPECTED(EG(exception))) {
+			if (call_info & ZEND_CALL_CLOSURE) {
+				zend_object_release((zend_object*)func->common.prototype);
 			}
+			if (call_info & ZEND_CALL_RELEASE_THIS) {
+				zend_object_release(object);
+			}
+			HANDLE_EXCEPTION();
 		}
 	} else {
 		zend_internal_type_error(EX_USES_STRICT_TYPES(), "%s() expects parameter 1 to be a valid callback, %s", Z_STRVAL_P(EX_CONSTANT(opline->op1)), error);
 		efree(error);
+
+		if (UNEXPECTED(EG(exception))) {
+			HANDLE_EXCEPTION();
+		}
 		func = (zend_function*)&zend_pass_function;
 		called_scope = NULL;
 		object = NULL;
@@ -5799,7 +5843,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_USER_CALL_SPEC_CONST_CONS
 	call->prev_execute_data = EX(call);
 	EX(call) = call;
 
-	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+	ZEND_VM_NEXT_OPCODE();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CASE_SPEC_CONST_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -6077,7 +6121,10 @@ num_index:
 		}
 
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr);
+		if (!zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr)) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(expr_ptr);
+		}
 	}
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
@@ -7737,7 +7784,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_C
 	call->prev_execute_data = EX(call);
 	EX(call) = call;
 
-	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+	ZEND_VM_NEXT_OPCODE();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_VERIFY_RETURN_TYPE_SPEC_CONST_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -7891,7 +7938,10 @@ num_index:
 		}
 
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr);
+		if (!zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr)) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(expr_ptr);
+		}
 	}
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
@@ -9340,13 +9390,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_CONST_CV
 		GC_REFCOUNT(obj)++; /* For $this pointer */
 	}
 
+
+	if ((IS_CONST & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(EG(exception))) {
+		HANDLE_EXCEPTION();
+	}
+
 	call = zend_vm_stack_push_call_frame(call_info,
 		fbc, opline->extended_value, called_scope, obj);
 	call->prev_execute_data = EX(call);
 	EX(call) = call;
 
-
-	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+	ZEND_VM_NEXT_OPCODE();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -9487,7 +9541,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_C
 	call->prev_execute_data = EX(call);
 	EX(call) = call;
 
-	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+	ZEND_VM_NEXT_OPCODE();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_USER_CALL_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -9507,6 +9561,19 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_USER_CALL_SPEC_CONST_CV_H
 	function_name = _get_zval_ptr_cv_BP_VAR_R(execute_data, opline->op2.var);
 	if (zend_is_callable_ex(function_name, NULL, 0, NULL, &fcc, &error)) {
 		func = fcc.function_handler;
+		called_scope = fcc.called_scope;
+		object = fcc.object;
+		if (error) {
+			efree(error);
+			/* This is the only soft error is_callable() can generate */
+			zend_error(E_DEPRECATED,
+				"Non-static method %s::%s() should not be called statically",
+				ZSTR_VAL(func->common.scope->name), ZSTR_VAL(func->common.function_name));
+			if (UNEXPECTED(EG(exception) != NULL)) {
+
+				HANDLE_EXCEPTION();
+			}
+		}
 		if (func->common.fn_flags & ZEND_ACC_CLOSURE) {
 			/* Delay closure destruction until its invocation */
 			if (IS_CV & (IS_VAR|IS_CV)) {
@@ -9516,25 +9583,27 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_USER_CALL_SPEC_CONST_CV_H
 			GC_REFCOUNT((zend_object*)func->common.prototype)++;
 			call_info |= ZEND_CALL_CLOSURE;
 		}
-		called_scope = fcc.called_scope;
-		object = fcc.object;
 		if (object) {
 			call_info |= ZEND_CALL_RELEASE_THIS;
 			GC_REFCOUNT(object)++; /* For $this pointer */
 		}
-		if (error) {
-			efree(error);
-			/* This is the only soft error is_callable() can generate */
-			zend_error(E_DEPRECATED,
-				"Non-static method %s::%s() should not be called statically",
-				ZSTR_VAL(func->common.scope->name), ZSTR_VAL(func->common.function_name));
-			if (UNEXPECTED(EG(exception) != NULL)) {
-				HANDLE_EXCEPTION();
+
+		if ((IS_CV & (IS_TMP_VAR|IS_VAR)) && UNEXPECTED(EG(exception))) {
+			if (call_info & ZEND_CALL_CLOSURE) {
+				zend_object_release((zend_object*)func->common.prototype);
 			}
+			if (call_info & ZEND_CALL_RELEASE_THIS) {
+				zend_object_release(object);
+			}
+			HANDLE_EXCEPTION();
 		}
 	} else {
 		zend_internal_type_error(EX_USES_STRICT_TYPES(), "%s() expects parameter 1 to be a valid callback, %s", Z_STRVAL_P(EX_CONSTANT(opline->op1)), error);
 		efree(error);
+
+		if (UNEXPECTED(EG(exception))) {
+			HANDLE_EXCEPTION();
+		}
 		func = (zend_function*)&zend_pass_function;
 		called_scope = NULL;
 		object = NULL;
@@ -9545,7 +9614,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_USER_CALL_SPEC_CONST_CV_H
 	call->prev_execute_data = EX(call);
 	EX(call) = call;
 
-	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+	ZEND_VM_NEXT_OPCODE();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CATCH_SPEC_CONST_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -9771,7 +9840,10 @@ num_index:
 		}
 
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr);
+		if (!zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr)) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(expr_ptr);
+		}
 	}
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
@@ -11167,14 +11239,18 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_CONST_TM
 		GC_REFCOUNT(obj)++; /* For $this pointer */
 	}
 
+	zval_ptr_dtor_nogc(free_op2);
+
+	if ((IS_CONST & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(EG(exception))) {
+		HANDLE_EXCEPTION();
+	}
+
 	call = zend_vm_stack_push_call_frame(call_info,
 		fbc, opline->extended_value, called_scope, obj);
 	call->prev_execute_data = EX(call);
 	EX(call) = call;
 
-	zval_ptr_dtor_nogc(free_op2);
-
-	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+	ZEND_VM_NEXT_OPCODE();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_CONST_TMPVAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -11315,7 +11391,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_C
 	call->prev_execute_data = EX(call);
 	EX(call) = call;
 
-	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+	ZEND_VM_NEXT_OPCODE();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_USER_CALL_SPEC_CONST_TMPVAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -11335,6 +11411,19 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_USER_CALL_SPEC_CONST_TMPV
 	function_name = _get_zval_ptr_var(opline->op2.var, execute_data, &free_op2);
 	if (zend_is_callable_ex(function_name, NULL, 0, NULL, &fcc, &error)) {
 		func = fcc.function_handler;
+		called_scope = fcc.called_scope;
+		object = fcc.object;
+		if (error) {
+			efree(error);
+			/* This is the only soft error is_callable() can generate */
+			zend_error(E_DEPRECATED,
+				"Non-static method %s::%s() should not be called statically",
+				ZSTR_VAL(func->common.scope->name), ZSTR_VAL(func->common.function_name));
+			if (UNEXPECTED(EG(exception) != NULL)) {
+				zval_ptr_dtor_nogc(free_op2);
+				HANDLE_EXCEPTION();
+			}
+		}
 		if (func->common.fn_flags & ZEND_ACC_CLOSURE) {
 			/* Delay closure destruction until its invocation */
 			if ((IS_TMP_VAR|IS_VAR) & (IS_VAR|IS_CV)) {
@@ -11344,25 +11433,28 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_USER_CALL_SPEC_CONST_TMPV
 			GC_REFCOUNT((zend_object*)func->common.prototype)++;
 			call_info |= ZEND_CALL_CLOSURE;
 		}
-		called_scope = fcc.called_scope;
-		object = fcc.object;
 		if (object) {
 			call_info |= ZEND_CALL_RELEASE_THIS;
 			GC_REFCOUNT(object)++; /* For $this pointer */
 		}
-		if (error) {
-			efree(error);
-			/* This is the only soft error is_callable() can generate */
-			zend_error(E_DEPRECATED,
-				"Non-static method %s::%s() should not be called statically",
-				ZSTR_VAL(func->common.scope->name), ZSTR_VAL(func->common.function_name));
-			if (UNEXPECTED(EG(exception) != NULL)) {
-				HANDLE_EXCEPTION();
+
+		zval_ptr_dtor_nogc(free_op2);
+		if (((IS_TMP_VAR|IS_VAR) & (IS_TMP_VAR|IS_VAR)) && UNEXPECTED(EG(exception))) {
+			if (call_info & ZEND_CALL_CLOSURE) {
+				zend_object_release((zend_object*)func->common.prototype);
 			}
+			if (call_info & ZEND_CALL_RELEASE_THIS) {
+				zend_object_release(object);
+			}
+			HANDLE_EXCEPTION();
 		}
 	} else {
 		zend_internal_type_error(EX_USES_STRICT_TYPES(), "%s() expects parameter 1 to be a valid callback, %s", Z_STRVAL_P(EX_CONSTANT(opline->op1)), error);
 		efree(error);
+		zval_ptr_dtor_nogc(free_op2);
+		if (UNEXPECTED(EG(exception))) {
+			HANDLE_EXCEPTION();
+		}
 		func = (zend_function*)&zend_pass_function;
 		called_scope = NULL;
 		object = NULL;
@@ -11373,8 +11465,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_USER_CALL_SPEC_CONST_TMPV
 	call->prev_execute_data = EX(call);
 	EX(call) = call;
 
-	zval_ptr_dtor_nogc(free_op2);
-	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+	ZEND_VM_NEXT_OPCODE();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CASE_SPEC_CONST_TMPVAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -11545,7 +11636,10 @@ num_index:
 		}
 		zval_ptr_dtor_nogc(free_op2);
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr);
+		if (!zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr)) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(expr_ptr);
+		}
 	}
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
@@ -13014,7 +13108,10 @@ num_index:
 		}
 
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr);
+		if (!zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr)) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(expr_ptr);
+		}
 	}
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
@@ -13738,7 +13835,10 @@ num_index:
 		}
 
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr);
+		if (!zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr)) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(expr_ptr);
+		}
 	}
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
@@ -14287,7 +14387,10 @@ num_index:
 		}
 
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr);
+		if (!zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr)) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(expr_ptr);
+		}
 	}
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
@@ -14801,7 +14904,10 @@ num_index:
 		}
 		zval_ptr_dtor_nogc(free_op2);
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr);
+		if (!zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr)) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(expr_ptr);
+		}
 	}
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
@@ -15458,7 +15564,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_NEW_SPEC_VAR_HANDLER(ZEND_OPCO
 			ZVAL_COPY(EX_VAR(opline->result.var), &object_zval);
 		}
 
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+		ZEND_VM_NEXT_OPCODE();
 	}
 }
 
@@ -17702,7 +17808,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_V
 	call->prev_execute_data = EX(call);
 	EX(call) = call;
 
-	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+	ZEND_VM_NEXT_OPCODE();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_CONSTANT_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -17906,7 +18012,10 @@ num_index:
 		}
 
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr);
+		if (!zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr)) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(expr_ptr);
+		}
 	}
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
@@ -19338,7 +19447,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_V
 	call->prev_execute_data = EX(call);
 	EX(call) = call;
 
-	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+	ZEND_VM_NEXT_OPCODE();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_VERIFY_RETURN_TYPE_SPEC_VAR_UNUSED_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -19492,7 +19601,10 @@ num_index:
 		}
 
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr);
+		if (!zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr)) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(expr_ptr);
+		}
 	}
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
@@ -20980,7 +21092,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_V
 	call->prev_execute_data = EX(call);
 	EX(call) = call;
 
-	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+	ZEND_VM_NEXT_OPCODE();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -21077,7 +21189,10 @@ num_index:
 		}
 
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr);
+		if (!zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr)) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(expr_ptr);
+		}
 	}
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
@@ -22569,7 +22684,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_V
 	call->prev_execute_data = EX(call);
 	EX(call) = call;
 
-	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+	ZEND_VM_NEXT_OPCODE();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_ADD_ARRAY_ELEMENT_SPEC_VAR_TMPVAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -22666,7 +22781,10 @@ num_index:
 		}
 		zval_ptr_dtor_nogc(free_op2);
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr);
+		if (!zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr)) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(expr_ptr);
+		}
 	}
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
@@ -23949,13 +24067,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_UNUSED_C
 		GC_REFCOUNT(obj)++; /* For $this pointer */
 	}
 
+
+	if ((IS_UNUSED & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(EG(exception))) {
+		HANDLE_EXCEPTION();
+	}
+
 	call = zend_vm_stack_push_call_frame(call_info,
 		fbc, opline->extended_value, called_scope, obj);
 	call->prev_execute_data = EX(call);
 	EX(call) = call;
 
-
-	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+	ZEND_VM_NEXT_OPCODE();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FETCH_CONSTANT_SPEC_UNUSED_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -26376,13 +26498,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_UNUSED_C
 		GC_REFCOUNT(obj)++; /* For $this pointer */
 	}
 
+
+	if ((IS_UNUSED & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(EG(exception))) {
+		HANDLE_EXCEPTION();
+	}
+
 	call = zend_vm_stack_push_call_frame(call_info,
 		fbc, opline->extended_value, called_scope, obj);
 	call->prev_execute_data = EX(call);
 	EX(call) = call;
 
-
-	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+	ZEND_VM_NEXT_OPCODE();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_ARRAY_SPEC_UNUSED_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -27880,14 +28006,18 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_UNUSED_T
 		GC_REFCOUNT(obj)++; /* For $this pointer */
 	}
 
+	zval_ptr_dtor_nogc(free_op2);
+
+	if ((IS_UNUSED & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(EG(exception))) {
+		HANDLE_EXCEPTION();
+	}
+
 	call = zend_vm_stack_push_call_frame(call_info,
 		fbc, opline->extended_value, called_scope, obj);
 	call->prev_execute_data = EX(call);
 	EX(call) = call;
 
-	zval_ptr_dtor_nogc(free_op2);
-
-	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+	ZEND_VM_NEXT_OPCODE();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_ARRAY_SPEC_UNUSED_TMPVAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -32164,13 +32294,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_CV_CONST
 		GC_REFCOUNT(obj)++; /* For $this pointer */
 	}
 
+
+	if ((IS_CV & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(EG(exception))) {
+		HANDLE_EXCEPTION();
+	}
+
 	call = zend_vm_stack_push_call_frame(call_info,
 		fbc, opline->extended_value, called_scope, obj);
 	call->prev_execute_data = EX(call);
 	EX(call) = call;
 
-
-	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+	ZEND_VM_NEXT_OPCODE();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CASE_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -32341,7 +32475,10 @@ num_index:
 		}
 
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr);
+		if (!zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr)) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(expr_ptr);
+		}
 	}
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
@@ -34874,7 +35011,10 @@ num_index:
 		}
 
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr);
+		if (!zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr)) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(expr_ptr);
+		}
 	}
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
@@ -37262,13 +37402,17 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_CV_CV_HA
 		GC_REFCOUNT(obj)++; /* For $this pointer */
 	}
 
+
+	if ((IS_CV & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(EG(exception))) {
+		HANDLE_EXCEPTION();
+	}
+
 	call = zend_vm_stack_push_call_frame(call_info,
 		fbc, opline->extended_value, called_scope, obj);
 	call->prev_execute_data = EX(call);
 	EX(call) = call;
 
-
-	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+	ZEND_VM_NEXT_OPCODE();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CASE_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -37439,7 +37583,10 @@ num_index:
 		}
 
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr);
+		if (!zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr)) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(expr_ptr);
+		}
 	}
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
@@ -39854,14 +40001,18 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_CV_TMPVA
 		GC_REFCOUNT(obj)++; /* For $this pointer */
 	}
 
+	zval_ptr_dtor_nogc(free_op2);
+
+	if ((IS_CV & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(EG(exception))) {
+		HANDLE_EXCEPTION();
+	}
+
 	call = zend_vm_stack_push_call_frame(call_info,
 		fbc, opline->extended_value, called_scope, obj);
 	call->prev_execute_data = EX(call);
 	EX(call) = call;
 
-	zval_ptr_dtor_nogc(free_op2);
-
-	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+	ZEND_VM_NEXT_OPCODE();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CASE_SPEC_CV_TMPVAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -40032,7 +40183,10 @@ num_index:
 		}
 		zval_ptr_dtor_nogc(free_op2);
 	} else {
-		zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr);
+		if (!zend_hash_next_index_insert(Z_ARRVAL_P(EX_VAR(opline->result.var)), expr_ptr)) {
+			zend_error(E_WARNING, "Cannot add element to the array as the next element is already occupied");
+			zval_ptr_dtor(expr_ptr);
+		}
 	}
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
@@ -42093,14 +42247,18 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_TMPVAR_C
 		GC_REFCOUNT(obj)++; /* For $this pointer */
 	}
 
+	zval_ptr_dtor_nogc(free_op1);
+
+	if (((IS_TMP_VAR|IS_VAR) & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(EG(exception))) {
+		HANDLE_EXCEPTION();
+	}
+
 	call = zend_vm_stack_push_call_frame(call_info,
 		fbc, opline->extended_value, called_scope, obj);
 	call->prev_execute_data = EX(call);
 	EX(call) = call;
 
-	zval_ptr_dtor_nogc(free_op1);
-
-	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+	ZEND_VM_NEXT_OPCODE();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CASE_SPEC_TMPVAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -44241,14 +44399,18 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_TMPVAR_C
 		GC_REFCOUNT(obj)++; /* For $this pointer */
 	}
 
+	zval_ptr_dtor_nogc(free_op1);
+
+	if (((IS_TMP_VAR|IS_VAR) & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(EG(exception))) {
+		HANDLE_EXCEPTION();
+	}
+
 	call = zend_vm_stack_push_call_frame(call_info,
 		fbc, opline->extended_value, called_scope, obj);
 	call->prev_execute_data = EX(call);
 	EX(call) = call;
 
-	zval_ptr_dtor_nogc(free_op1);
-
-	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+	ZEND_VM_NEXT_OPCODE();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CASE_SPEC_TMPVAR_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
@@ -45387,15 +45549,19 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_TMPVAR_T
 		GC_REFCOUNT(obj)++; /* For $this pointer */
 	}
 
+	zval_ptr_dtor_nogc(free_op2);
+	zval_ptr_dtor_nogc(free_op1);
+
+	if (((IS_TMP_VAR|IS_VAR) & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(EG(exception))) {
+		HANDLE_EXCEPTION();
+	}
+
 	call = zend_vm_stack_push_call_frame(call_info,
 		fbc, opline->extended_value, called_scope, obj);
 	call->prev_execute_data = EX(call);
 	EX(call) = call;
 
-	zval_ptr_dtor_nogc(free_op2);
-	zval_ptr_dtor_nogc(free_op1);
-
-	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
+	ZEND_VM_NEXT_OPCODE();
 }
 
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CASE_SPEC_TMPVAR_TMPVAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)

acinclude.m4

@@ -2678,7 +2678,7 @@ EOF
     if test -n "$val"; then
       echo "$var='$val' \\" >> $1
       if test `expr "X$ac_configure_args" : ".*${var}.*"` != 0; then
-        clean_configure_args=$(echo $clean_configure_args | sed -e "s/'$var=$val'//")
+        clean_configure_args=$(echo $clean_configure_args | sed -e "s#'$var=$val'##")
       fi
     fi
   done

configure.in

@@ -119,7 +119,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
 
 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=0
-PHP_RELEASE_VERSION=12
+PHP_RELEASE_VERSION=14
 PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

ext/bcmath/libbcmath/src/init.c

@@ -49,7 +49,10 @@ _bc_new_num_ex (length, scale, persistent)
      int length, scale, persistent;
 {
   bc_num temp;
-
+  /* PHP Change:  add length check */
+  if ((size_t)length+(size_t)scale > INT_MAX) {
+   zend_error(E_ERROR, "Result too long, max is %d", INT_MAX);
+  }
   /* PHP Change:  malloc() -> pemalloc(), removed free_list code */
   temp = (bc_num) safe_pemalloc (1, sizeof(bc_struct)+length, scale, persistent);
 #if 0

ext/bcmath/libbcmath/src/outofmem.c

@@ -41,6 +41,5 @@
 
 void bc_out_of_memory (void)
 {
-  (void) fprintf (stderr, "bcmath: out of memory!\n");
-  exit (1);
+  zend_error(E_ERROR, "bcmath: out of memory!");
 }

ext/bz2/bz2.c

@@ -588,8 +588,8 @@ static PHP_FUNCTION(bzdecompress)
 	bzs.avail_in = source_len;
 
 	/* in most cases bz2 offers at least 2:1 compression, so we use that as our base */
+	dest = zend_string_safe_alloc(source_len, 2, 1, 0);
 	bzs.avail_out = source_len * 2;
-	dest = zend_string_alloc(bzs.avail_out + 1, 0);
 	bzs.next_out = ZSTR_VAL(dest);
 
 	while ((error = BZ2_bzDecompress(&bzs)) == BZ_OK && bzs.avail_in > 0) {

ext/calendar/calendar.c

@@ -12,7 +12,7 @@
    | obtain it through the world-wide-web, please send a note to          |
    | license@php.net so we can mail you a copy immediately.               |
    +----------------------------------------------------------------------+
-   | Authors: Shane Caraveo             <shane@caraveo.com>               | 
+   | Authors: Shane Caraveo             <shane@caraveo.com>               |
    |          Colin Viebrock            <colin@easydns.com>               |
    |          Hartmut Holzgraefe        <hholzgra@php.net>                |
    |          Wez Furlong               <wez@thebrainroom.com>            |

ext/calendar/gregor.c

@@ -195,7 +195,7 @@ zend_long GregorianToSdn(
 						   int inputMonth,
 						   int inputDay)
 {
-	int year;
+	zend_long year;
 	int month;
 
 	/* check for invalid dates */

ext/calendar/julian.c

@@ -217,7 +217,7 @@ zend_long JulianToSdn(
 						int inputMonth,
 						int inputDay)
 {
-	int year;
+	zend_long year;
 	int month;
 
 	/* check for invalid dates */

ext/calendar/tests/gregoriantojd_overflow.phpt

@@ -0,0 +1,11 @@
+--TEST--
+gregoriantojd()
+--SKIPIF--
+<?php if (PHP_INT_SIZE != 8) die("skip this test is for 64bit platform only"); ?>
+<?php include 'skipif.inc'; ?>
+--FILE--
+<?php
+echo gregoriantojd(5, 5, 6000000) . "\n";
+?>
+--EXPECT--
+2193176185

ext/calendar/tests/juliantojd_overflow.phpt

@@ -0,0 +1,11 @@
+--TEST--
+juliantojd()
+--SKIPIF--
+<?php if (PHP_INT_SIZE != 8) die("skip this test is for 64bit platform only"); ?>
+<?php include 'skipif.inc'; ?>
+--FILE--
+<?php
+echo juliantojd(5, 5, 6000000000) . "\n";
+?>
+--EXPECT--
+622764916319

ext/curl/curl_file.c

@@ -137,6 +137,7 @@ ZEND_METHOD(CURLFile, setPostFilename)
    Unserialization handler */
 ZEND_METHOD(CURLFile, __wakeup)
 {
+	zend_unset_property(curl_CURLFile_class, getThis(), "name", sizeof("name")-1);
 	zend_update_property_string(curl_CURLFile_class, getThis(), "name", sizeof("name")-1, "");
 	zend_throw_exception(NULL, "Unserialization of CURLFile instances is not allowed", 0);
 }

ext/curl/interface.c

@@ -801,6 +801,9 @@ PHP_MINIT_FUNCTION(curl)
 	REGISTER_CURL_CONSTANT(CURLE_SSL_ENGINE_NOTFOUND);
 	REGISTER_CURL_CONSTANT(CURLE_SSL_ENGINE_SETFAILED);
 	REGISTER_CURL_CONSTANT(CURLE_SSL_PEER_CERTIFICATE);
+#if LIBCURL_VERSION_NUM >= 0x072700 /* Available since 7.39.0 */
+	REGISTER_CURL_CONSTANT(CURLE_SSL_PINNEDPUBKEYNOTMATCH);
+#endif
 	REGISTER_CURL_CONSTANT(CURLE_TELNET_OPTION_SYNTAX);
 	REGISTER_CURL_CONSTANT(CURLE_TOO_MANY_REDIRECTS);
 	REGISTER_CURL_CONSTANT(CURLE_UNKNOWN_TELNET_OPTION);

ext/curl/tests/bug73147.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #73147: Use After Free in PHP7 unserialize()
+--SKIPIF--
+<?php
+if (!extension_loaded("curl")) {
+        exit("skip curl extension not loaded");
+}
+?>
+--FILE--
+<?php
+
+$poc = 'a:1:{i:0;O:8:"CURLFile":1:{s:4:"name";R:1;}}';
+try {
+var_dump(unserialize($poc));
+} catch(Exception $e) {
+	echo $e->getMessage();
+}
+?>
+--EXPECT--
+Unserialization of CURLFile instances is not allowed

ext/date/lib/parse_date.c

@@ -1,4 +1,4 @@
-/* Generated by re2c 0.15.3 on Sun Jul 24 14:52:04 2016 */
+/* Generated by re2c 0.15.3 on Fri Sep 30 20:30:54 2016 */
 #line 1 "ext/date/lib/parse_date.re"
 /*
  * The MIT License (MIT)
@@ -396,8 +396,12 @@ static timelib_sll timelib_meridian(char **ptr, timelib_sll h)
 	}
 	++*ptr;
 	if (**ptr == '.') {
-		*ptr += 3;
-	} else {
+		++*ptr;
+	}
+	if (**ptr == 'M' || **ptr == 'm') {
+		++*ptr;
+	}
+	if (**ptr == '.') {
 		++*ptr;
 	}
 	return retval;
@@ -820,11 +824,11 @@ static int scan(Scanner *s, timelib_tz_get_wrapper tz_get_wrapper)
 std:
 	s->tok = cursor;
 	s->len = 0;
-#line 946 "ext/date/lib/parse_date.re"
+#line 950 "ext/date/lib/parse_date.re"
 
 
 
-#line 828 "<stdout>"
+#line 832 "<stdout>"
 {
 	YYCTYPE yych;
 	unsigned int yyaccept = 0;
@@ -959,7 +963,7 @@ yy2:
 		}
 	}
 yy3:
-#line 1626 "ext/date/lib/parse_date.re"
+#line 1630 "ext/date/lib/parse_date.re"
 	{
 		int tz_not_found;
 		DEBUG_OUTPUT("tzcorrection | tz");
@@ -972,7 +976,7 @@ yy3:
 		TIMELIB_DEINIT;
 		return TIMELIB_TIMEZONE;
 	}
-#line 976 "<stdout>"
+#line 980 "<stdout>"
 yy4:
 	yych = *++YYCURSOR;
 	if (yych <= 'E') {
@@ -1272,12 +1276,12 @@ yy11:
 	if (yych <= '/') goto yy12;
 	if (yych <= '9') goto yy1385;
 yy12:
-#line 1721 "ext/date/lib/parse_date.re"
+#line 1725 "ext/date/lib/parse_date.re"
 	{
 		add_error(s, "Unexpected character");
 		goto std;
 	}
-#line 1281 "<stdout>"
+#line 1285 "<stdout>"
 yy13:
 	yych = *++YYCURSOR;
 	if (yych <= 'R') {
@@ -2291,22 +2295,22 @@ yy48:
 	if (yych <= '/') goto yy49;
 	if (yych <= '9') goto yy54;
 yy49:
-#line 1710 "ext/date/lib/parse_date.re"
+#line 1714 "ext/date/lib/parse_date.re"
 	{
 		goto std;
 	}
-#line 2299 "<stdout>"
+#line 2303 "<stdout>"
 yy50:
 	yych = *++YYCURSOR;
 	goto yy49;
 yy51:
 	++YYCURSOR;
-#line 1715 "ext/date/lib/parse_date.re"
+#line 1719 "ext/date/lib/parse_date.re"
 	{
 		s->pos = cursor; s->line++;
 		goto std;
 	}
-#line 2310 "<stdout>"
+#line 2314 "<stdout>"
 yy53:
 	yych = *++YYCURSOR;
 	goto yy12;
@@ -2673,7 +2677,7 @@ yy71:
 	if (yych == 'S') goto yy73;
 	if (yych == 's') goto yy73;
 yy72:
-#line 1694 "ext/date/lib/parse_date.re"
+#line 1698 "ext/date/lib/parse_date.re"
 	{
 		timelib_ull i;
 		DEBUG_OUTPUT("relative");
@@ -2688,7 +2692,7 @@ yy72:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 2692 "<stdout>"
+#line 2696 "<stdout>"
 yy73:
 	yych = *++YYCURSOR;
 	if (yych == 'D') goto yy74;
@@ -3356,7 +3360,7 @@ yy165:
 		}
 	}
 yy166:
-#line 1557 "ext/date/lib/parse_date.re"
+#line 1561 "ext/date/lib/parse_date.re"
 	{
 		const timelib_relunit* relunit;
 		DEBUG_OUTPUT("daytext");
@@ -3373,7 +3377,7 @@ yy166:
 		TIMELIB_DEINIT;
 		return TIMELIB_WEEKDAY;
 	}
-#line 3377 "<stdout>"
+#line 3381 "<stdout>"
 yy167:
 	yych = *++YYCURSOR;
 	if (yych <= 'K') {
@@ -3866,7 +3870,7 @@ yy192:
 		}
 	}
 yy193:
-#line 1616 "ext/date/lib/parse_date.re"
+#line 1620 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("monthtext");
 		TIMELIB_INIT;
@@ -3875,7 +3879,7 @@ yy193:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_TEXT;
 	}
-#line 3879 "<stdout>"
+#line 3883 "<stdout>"
 yy194:
 	++YYCURSOR;
 	if ((YYLIMIT - YYCURSOR) < 21) YYFILL(21);
@@ -3921,7 +3925,7 @@ yy197:
 		}
 	}
 yy198:
-#line 1362 "ext/date/lib/parse_date.re"
+#line 1366 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("datetextual | datenoyear");
@@ -3934,7 +3938,7 @@ yy198:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_TEXT;
 	}
-#line 3938 "<stdout>"
+#line 3942 "<stdout>"
 yy199:
 	yyaccept = 6;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -4179,7 +4183,7 @@ yy221:
 		if (yych <= ':') goto yy224;
 	}
 yy222:
-#line 1664 "ext/date/lib/parse_date.re"
+#line 1668 "ext/date/lib/parse_date.re"
 	{
 		int tz_not_found;
 		DEBUG_OUTPUT("dateshortwithtimeshort | dateshortwithtimelong | dateshortwithtimelongtz");
@@ -4208,7 +4212,7 @@ yy222:
 		TIMELIB_DEINIT;
 		return TIMELIB_SHORTDATE_WITH_TIME;
 	}
-#line 4212 "<stdout>"
+#line 4216 "<stdout>"
 yy223:
 	yyaccept = 7;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -4850,7 +4854,7 @@ yy276:
 	}
 yy277:
 	++YYCURSOR;
-#line 1640 "ext/date/lib/parse_date.re"
+#line 1644 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("dateshortwithtimeshort12 | dateshortwithtimelong12");
 		TIMELIB_INIT;
@@ -4873,7 +4877,7 @@ yy277:
 		TIMELIB_DEINIT;
 		return TIMELIB_SHORTDATE_WITH_TIME;
 	}
-#line 4877 "<stdout>"
+#line 4881 "<stdout>"
 yy279:
 	yych = *++YYCURSOR;
 	if (yych <= 0x1F) {
@@ -5035,7 +5039,7 @@ yy292:
 yy293:
 	++YYCURSOR;
 yy294:
-#line 1334 "ext/date/lib/parse_date.re"
+#line 1338 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("datenoday");
@@ -5048,7 +5052,7 @@ yy294:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_NO_DAY;
 	}
-#line 5052 "<stdout>"
+#line 5056 "<stdout>"
 yy295:
 	yych = *++YYCURSOR;
 	if (yych <= '/') {
@@ -6199,7 +6203,7 @@ yy361:
 	if ((yych = *YYCURSOR) <= '/') goto yy363;
 	if (yych <= '9') goto yy364;
 yy363:
-#line 1478 "ext/date/lib/parse_date.re"
+#line 1482 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("pgtextshort");
@@ -6212,7 +6216,7 @@ yy363:
 		TIMELIB_DEINIT;
 		return TIMELIB_PG_TEXT;
 	}
-#line 6216 "<stdout>"
+#line 6220 "<stdout>"
 yy364:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy363;
@@ -6821,7 +6825,7 @@ yy391:
 		if (yych <= 'z') goto yy142;
 	}
 yy392:
-#line 1536 "ext/date/lib/parse_date.re"
+#line 1540 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("ago");
 		TIMELIB_INIT;
@@ -6841,7 +6845,7 @@ yy392:
 		TIMELIB_DEINIT;
 		return TIMELIB_AGO;
 	}
-#line 6845 "<stdout>"
+#line 6849 "<stdout>"
 yy393:
 	yyaccept = 5;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -8529,7 +8533,7 @@ yy452:
 yy453:
 	++YYCURSOR;
 yy454:
-#line 1239 "ext/date/lib/parse_date.re"
+#line 1243 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("iso8601date4 | iso8601date2 | iso8601dateslash | dateslash");
 		TIMELIB_INIT;
@@ -8540,7 +8544,7 @@ yy454:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_DATE;
 	}
-#line 8544 "<stdout>"
+#line 8548 "<stdout>"
 yy455:
 	yyaccept = 0;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -9076,7 +9080,7 @@ yy474:
 		}
 	}
 yy475:
-#line 1376 "ext/date/lib/parse_date.re"
+#line 1380 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("datenoyearrev");
 		TIMELIB_INIT;
@@ -9087,7 +9091,7 @@ yy475:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_TEXT;
 	}
-#line 9091 "<stdout>"
+#line 9095 "<stdout>"
 yy476:
 	yyaccept = 10;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -9215,7 +9219,7 @@ yy485:
 	}
 yy487:
 	++YYCURSOR;
-#line 1094 "ext/date/lib/parse_date.re"
+#line 1098 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("timetiny12 | timeshort12 | timelong12");
 		TIMELIB_INIT;
@@ -9231,7 +9235,7 @@ yy487:
 		TIMELIB_DEINIT;
 		return TIMELIB_TIME12;
 	}
-#line 9235 "<stdout>"
+#line 9239 "<stdout>"
 yy489:
 	yyaccept = 11;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -9242,7 +9246,7 @@ yy489:
 		if (yych <= ':') goto yy492;
 	}
 yy490:
-#line 1131 "ext/date/lib/parse_date.re"
+#line 1135 "ext/date/lib/parse_date.re"
 	{
 		int tz_not_found;
 		DEBUG_OUTPUT("timeshort24 | timelong24 | iso8601long");
@@ -9267,7 +9271,7 @@ yy490:
 		TIMELIB_DEINIT;
 		return TIMELIB_TIME24_WITH_ZONE;
 	}
-#line 9271 "<stdout>"
+#line 9275 "<stdout>"
 yy491:
 	yyaccept = 11;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -9544,7 +9548,7 @@ yy520:
 	}
 yy522:
 	++YYCURSOR;
-#line 1111 "ext/date/lib/parse_date.re"
+#line 1115 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("mssqltime");
 		TIMELIB_INIT;
@@ -9563,7 +9567,7 @@ yy522:
 		TIMELIB_DEINIT;
 		return TIMELIB_TIME24_WITH_ZONE;
 	}
-#line 9567 "<stdout>"
+#line 9571 "<stdout>"
 yy524:
 	yyaccept = 11;
 	YYMARKER = ++YYCURSOR;
@@ -9658,7 +9662,7 @@ yy533:
 	if ((yych = *YYCURSOR) <= '/') goto yy534;
 	if (yych <= '9') goto yy540;
 yy534:
-#line 1293 "ext/date/lib/parse_date.re"
+#line 1297 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("datefull");
@@ -9672,7 +9676,7 @@ yy534:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_FULL;
 	}
-#line 9676 "<stdout>"
+#line 9680 "<stdout>"
 yy535:
 	yych = *++YYCURSOR;
 	if (yych == 'M') goto yy536;
@@ -10336,7 +10340,7 @@ yy604:
 	if (yych <= '/') goto yy56;
 	if (yych >= ':') goto yy56;
 	++YYCURSOR;
-#line 1308 "ext/date/lib/parse_date.re"
+#line 1312 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("pointed date YYYY");
 		TIMELIB_INIT;
@@ -10347,7 +10351,7 @@ yy604:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_FULL_POINTED;
 	}
-#line 10351 "<stdout>"
+#line 10355 "<stdout>"
 yy607:
 	yyaccept = 11;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -10378,7 +10382,7 @@ yy610:
 	if (yych <= '/') goto yy611;
 	if (yych <= '9') goto yy604;
 yy611:
-#line 1320 "ext/date/lib/parse_date.re"
+#line 1324 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("pointed date YY");
@@ -10391,7 +10395,7 @@ yy611:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_FULL_POINTED;
 	}
-#line 10395 "<stdout>"
+#line 10399 "<stdout>"
 yy612:
 	yyaccept = 11;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -10987,7 +10991,7 @@ yy655:
 		}
 	}
 yy656:
-#line 1279 "ext/date/lib/parse_date.re"
+#line 1283 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("gnudateshort");
@@ -11000,7 +11004,7 @@ yy656:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_DATE;
 	}
-#line 11004 "<stdout>"
+#line 11008 "<stdout>"
 yy657:
 	yyaccept = 13;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -11096,7 +11100,7 @@ yy665:
 		}
 	}
 yy666:
-#line 1223 "ext/date/lib/parse_date.re"
+#line 1227 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("americanshort | american");
@@ -11111,7 +11115,7 @@ yy666:
 		TIMELIB_DEINIT;
 		return TIMELIB_AMERICAN;
 	}
-#line 11115 "<stdout>"
+#line 11119 "<stdout>"
 yy667:
 	yyaccept = 14;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -11310,7 +11314,7 @@ yy699:
 	if (yych <= '9') goto yy702;
 	if (yych <= ':') goto yy703;
 yy700:
-#line 1506 "ext/date/lib/parse_date.re"
+#line 1510 "ext/date/lib/parse_date.re"
 	{
 		int tz_not_found;
 		DEBUG_OUTPUT("clf");
@@ -11330,7 +11334,7 @@ yy700:
 		TIMELIB_DEINIT;
 		return TIMELIB_CLF;
 	}
-#line 11334 "<stdout>"
+#line 11338 "<stdout>"
 yy701:
 	yych = *++YYCURSOR;
 	if (yych <= '5') {
@@ -11817,7 +11821,7 @@ yy762:
 		if (yych <= 't') goto yy662;
 	}
 yy763:
-#line 1251 "ext/date/lib/parse_date.re"
+#line 1255 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("iso8601date2");
@@ -11830,7 +11834,7 @@ yy763:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_DATE;
 	}
-#line 11834 "<stdout>"
+#line 11838 "<stdout>"
 yy764:
 	yych = *++YYCURSOR;
 	if (yych == 'C') goto yy765;
@@ -11861,7 +11865,7 @@ yy769:
 	if (yych >= '2') goto yy56;
 yy770:
 	++YYCURSOR;
-#line 1492 "ext/date/lib/parse_date.re"
+#line 1496 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("pgtextreverse");
@@ -11874,7 +11878,7 @@ yy770:
 		TIMELIB_DEINIT;
 		return TIMELIB_PG_TEXT;
 	}
-#line 11878 "<stdout>"
+#line 11882 "<stdout>"
 yy772:
 	yych = *++YYCURSOR;
 	if (yych == 'V') goto yy765;
@@ -11999,7 +12003,7 @@ yy782:
 	default:	goto yy783;
 	}
 yy783:
-#line 1527 "ext/date/lib/parse_date.re"
+#line 1531 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("year4");
 		TIMELIB_INIT;
@@ -12007,7 +12011,7 @@ yy783:
 		TIMELIB_DEINIT;
 		return TIMELIB_CLF;
 	}
-#line 12011 "<stdout>"
+#line 12015 "<stdout>"
 yy784:
 	yych = *++YYCURSOR;
 	switch (yych) {
@@ -12145,7 +12149,7 @@ yy792:
 		if (yych <= 'X') goto yy883;
 	}
 yy793:
-#line 1348 "ext/date/lib/parse_date.re"
+#line 1352 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("datenodayrev");
@@ -12158,7 +12162,7 @@ yy793:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_NO_DAY;
 	}
-#line 12162 "<stdout>"
+#line 12166 "<stdout>"
 yy794:
 	yych = *++YYCURSOR;
 	if (yych == 'I') goto yy927;
@@ -12352,7 +12356,7 @@ yy813:
 	if (yych <= '/') goto yy814;
 	if (yych <= '7') goto yy816;
 yy814:
-#line 1459 "ext/date/lib/parse_date.re"
+#line 1463 "ext/date/lib/parse_date.re"
 	{
 		timelib_sll w, d;
 		DEBUG_OUTPUT("isoweek");
@@ -12370,14 +12374,14 @@ yy814:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_WEEK;
 	}
-#line 12374 "<stdout>"
+#line 12378 "<stdout>"
 yy815:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy56;
 	if (yych >= '8') goto yy56;
 yy816:
 	++YYCURSOR;
-#line 1440 "ext/date/lib/parse_date.re"
+#line 1444 "ext/date/lib/parse_date.re"
 	{
 		timelib_sll w, d;
 		DEBUG_OUTPUT("isoweekday");
@@ -12395,7 +12399,7 @@ yy816:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_WEEK;
 	}
-#line 12399 "<stdout>"
+#line 12403 "<stdout>"
 yy818:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy60;
@@ -12455,7 +12459,7 @@ yy820:
 		}
 	}
 yy821:
-#line 1426 "ext/date/lib/parse_date.re"
+#line 1430 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("pgydotd");
@@ -12468,7 +12472,7 @@ yy821:
 		TIMELIB_DEINIT;
 		return TIMELIB_PG_YEARDAY;
 	}
-#line 12472 "<stdout>"
+#line 12476 "<stdout>"
 yy822:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy60;
@@ -12550,7 +12554,7 @@ yy840:
 yy841:
 	++YYCURSOR;
 yy842:
-#line 1400 "ext/date/lib/parse_date.re"
+#line 1404 "ext/date/lib/parse_date.re"
 	{
 		int tz_not_found;
 		DEBUG_OUTPUT("xmlrpc | xmlrpcnocolon | soap | wddx | exif");
@@ -12575,7 +12579,7 @@ yy842:
 		TIMELIB_DEINIT;
 		return TIMELIB_XMLRPC_SOAP;
 	}
-#line 12579 "<stdout>"
+#line 12583 "<stdout>"
 yy843:
 	yych = *++YYCURSOR;
 	if (yych <= '2') {
@@ -12831,7 +12835,7 @@ yy847:
 		}
 	}
 yy848:
-#line 1388 "ext/date/lib/parse_date.re"
+#line 1392 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("datenocolon");
 		TIMELIB_INIT;
@@ -12842,7 +12846,7 @@ yy848:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_NOCOLON;
 	}
-#line 12846 "<stdout>"
+#line 12850 "<stdout>"
 yy849:
 	yych = *++YYCURSOR;
 	if (yych <= 'H') {
@@ -13636,7 +13640,7 @@ yy972:
 	if (yych <= '/') goto yy973;
 	if (yych <= '9') goto yy995;
 yy973:
-#line 1265 "ext/date/lib/parse_date.re"
+#line 1269 "ext/date/lib/parse_date.re"
 	{
 		int length = 0;
 		DEBUG_OUTPUT("gnudateshorter");
@@ -13649,7 +13653,7 @@ yy973:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_DATE;
 	}
-#line 13653 "<stdout>"
+#line 13657 "<stdout>"
 yy974:
 	yyaccept = 22;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -14561,7 +14565,7 @@ yy1065:
 	default:	goto yy1067;
 	}
 yy1067:
-#line 1157 "ext/date/lib/parse_date.re"
+#line 1161 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("gnunocolon");
 		TIMELIB_INIT;
@@ -14583,7 +14587,7 @@ yy1067:
 		TIMELIB_DEINIT;
 		return TIMELIB_GNU_NOCOLON;
 	}
-#line 14587 "<stdout>"
+#line 14591 "<stdout>"
 yy1068:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy60;
@@ -14667,7 +14671,7 @@ yy1074:
 		}
 	}
 yy1075:
-#line 1203 "ext/date/lib/parse_date.re"
+#line 1207 "ext/date/lib/parse_date.re"
 	{
 		int tz_not_found;
 		DEBUG_OUTPUT("iso8601nocolon");
@@ -14686,7 +14690,7 @@ yy1075:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_NOCOLON;
 	}
-#line 14690 "<stdout>"
+#line 14694 "<stdout>"
 yy1076:
 	yyaccept = 25;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -15542,7 +15546,7 @@ yy1116:
 		}
 	}
 yy1117:
-#line 1599 "ext/date/lib/parse_date.re"
+#line 1603 "ext/date/lib/parse_date.re"
 	{
 		timelib_sll i;
 		int         behavior = 0;
@@ -15558,7 +15562,7 @@ yy1117:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 15562 "<stdout>"
+#line 15566 "<stdout>"
 yy1118:
 	++YYCURSOR;
 	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
@@ -15600,7 +15604,7 @@ yy1124:
 	if (yych != 'f') goto yy56;
 yy1125:
 	++YYCURSOR;
-#line 1072 "ext/date/lib/parse_date.re"
+#line 1076 "ext/date/lib/parse_date.re"
 	{
 		timelib_sll i;
 		int         behavior = 0;
@@ -15621,7 +15625,7 @@ yy1125:
 		TIMELIB_DEINIT;
 		return TIMELIB_WEEK_DAY_OF_MONTH;
 	}
-#line 15625 "<stdout>"
+#line 15629 "<stdout>"
 yy1127:
 	yyaccept = 26;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -15714,7 +15718,7 @@ yy1140:
 		}
 	}
 yy1141:
-#line 1575 "ext/date/lib/parse_date.re"
+#line 1579 "ext/date/lib/parse_date.re"
 	{
 		timelib_sll i;
 		int         behavior = 0;
@@ -15737,7 +15741,7 @@ yy1141:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 15741 "<stdout>"
+#line 15745 "<stdout>"
 yy1142:
 	yych = *++YYCURSOR;
 	goto yy1117;
@@ -18261,7 +18265,7 @@ yy1293:
 	if (yych <= '9') goto yy1296;
 	goto yy1297;
 yy1294:
-#line 1049 "ext/date/lib/parse_date.re"
+#line 1053 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("backof | frontof");
 		TIMELIB_INIT;
@@ -18283,7 +18287,7 @@ yy1294:
 		TIMELIB_DEINIT;
 		return TIMELIB_LF_DAY_OF_MONTH;
 	}
-#line 18287 "<stdout>"
+#line 18291 "<stdout>"
 yy1295:
 	yyaccept = 28;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -18522,7 +18526,7 @@ yy1314:
 	if (yych != 'f') goto yy56;
 yy1315:
 	++YYCURSOR;
-#line 1032 "ext/date/lib/parse_date.re"
+#line 1036 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("firstdayof | lastdayof");
 		TIMELIB_INIT;
@@ -18538,7 +18542,7 @@ yy1315:
 		TIMELIB_DEINIT;
 		return TIMELIB_LF_DAY_OF_MONTH;
 	}
-#line 18542 "<stdout>"
+#line 18546 "<stdout>"
 yy1317:
 	yyaccept = 0;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -19898,7 +19902,7 @@ yy1385:
 	if (yych <= '/') goto yy1387;
 	if (yych <= '9') goto yy1385;
 yy1387:
-#line 1006 "ext/date/lib/parse_date.re"
+#line 1010 "ext/date/lib/parse_date.re"
 	{
 		timelib_ull i;
 
@@ -19923,7 +19927,7 @@ yy1387:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 19927 "<stdout>"
+#line 19931 "<stdout>"
 yy1388:
 	yych = *++YYCURSOR;
 	if (yych <= 'N') {
@@ -20329,7 +20333,7 @@ yy1415:
 yy1416:
 	++YYCURSOR;
 yy1417:
-#line 994 "ext/date/lib/parse_date.re"
+#line 998 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("tomorrow");
 		TIMELIB_INIT;
@@ -20340,7 +20344,7 @@ yy1417:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 20344 "<stdout>"
+#line 20348 "<stdout>"
 yy1418:
 	yych = *++YYCURSOR;
 	if (yych <= 'Y') {
@@ -20372,7 +20376,7 @@ yy1419:
 		if (yych <= 'z') goto yy144;
 	}
 yy1420:
-#line 984 "ext/date/lib/parse_date.re"
+#line 988 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("midnight | today");
 		TIMELIB_INIT;
@@ -20381,7 +20385,7 @@ yy1420:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 20385 "<stdout>"
+#line 20389 "<stdout>"
 yy1421:
 	yych = *++YYCURSOR;
 	if (yych <= 'S') {
@@ -22313,7 +22317,7 @@ yy1499:
 		if (yych <= 'z') goto yy142;
 	}
 yy1500:
-#line 963 "ext/date/lib/parse_date.re"
+#line 967 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("now");
 		TIMELIB_INIT;
@@ -22321,7 +22325,7 @@ yy1500:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 22325 "<stdout>"
+#line 22329 "<stdout>"
 yy1501:
 	yych = *++YYCURSOR;
 	if (yych <= 'N') {
@@ -22452,7 +22456,7 @@ yy1507:
 		if (yych <= 'z') goto yy143;
 	}
 yy1508:
-#line 972 "ext/date/lib/parse_date.re"
+#line 976 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("noon");
 		TIMELIB_INIT;
@@ -22463,7 +22467,7 @@ yy1508:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 22467 "<stdout>"
+#line 22471 "<stdout>"
 yy1509:
 	yyaccept = 0;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -22973,7 +22977,7 @@ yy1529:
 yy1530:
 	++YYCURSOR;
 yy1531:
-#line 951 "ext/date/lib/parse_date.re"
+#line 955 "ext/date/lib/parse_date.re"
 	{
 		DEBUG_OUTPUT("yesterday");
 		TIMELIB_INIT;
@@ -22984,7 +22988,7 @@ yy1531:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 22988 "<stdout>"
+#line 22992 "<stdout>"
 yy1532:
 	yyaccept = 0;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -23149,7 +23153,7 @@ yy1537:
 		goto yy1531;
 	}
 }
-#line 1725 "ext/date/lib/parse_date.re"
+#line 1729 "ext/date/lib/parse_date.re"
 
 }
 

ext/date/lib/parse_date.re

@@ -394,8 +394,12 @@ static timelib_sll timelib_meridian(char **ptr, timelib_sll h)
 	}
 	++*ptr;
 	if (**ptr == '.') {
-		*ptr += 3;
-	} else {
+		++*ptr;
+	}
+	if (**ptr == 'M' || **ptr == 'm') {
+		++*ptr;
+	}
+	if (**ptr == '.') {
 		++*ptr;
 	}
 	return retval;

ext/date/php_date.c

@@ -1970,6 +1970,54 @@ static int implement_date_interface_handler(zend_class_entry *interface, zend_cl
 	return SUCCESS;
 } /* }}} */
 
+static int date_interval_has_property(zval *object, zval *member, int type, void **cache_slot) /* {{{ */
+{
+	php_interval_obj *obj;
+	zval tmp_member;
+	zval rv;
+	zval *prop;
+	int retval = 0;
+
+	if (Z_TYPE_P(member) != IS_STRING) {
+		ZVAL_COPY(&tmp_member, member);
+		convert_to_string(&tmp_member);
+		member = &tmp_member;
+		cache_slot = NULL;
+	}
+
+	obj = Z_PHPINTERVAL_P(object);
+
+	if (!obj->initialized) {
+		retval = (zend_get_std_object_handlers())->has_property(object, member, type, cache_slot);
+		if (member == &tmp_member) {
+			zval_dtor(member);
+		}
+		return retval;
+	}
+
+	prop = date_interval_read_property(object, member, type, cache_slot, &rv);
+
+	if (prop != NULL) {
+		if (type == 2) {
+			retval = 1;
+		} else if (type == 1) {
+			retval = zend_is_true(prop);
+		} else if (type == 0) {
+			retval = (Z_TYPE(*prop) != IS_NULL);
+		}
+	} else {
+		retval = (zend_get_std_object_handlers())->has_property(object, member, type, cache_slot);
+	}
+
+	if (member == &tmp_member) {
+		zval_dtor(member);
+	}
+
+	return retval;
+	
+}
+/* }}} */
+
 static void date_register_classes(void) /* {{{ */
 {
 	zend_class_entry ce_date, ce_immutable, ce_timezone, ce_interval, ce_period, ce_interface;
@@ -2051,6 +2099,7 @@ static void date_register_classes(void) /* {{{ */
 	date_object_handlers_interval.offset = XtOffsetOf(php_interval_obj, std);
 	date_object_handlers_interval.free_obj = date_object_free_storage_interval;
 	date_object_handlers_interval.clone_obj = date_object_clone_interval;
+	date_object_handlers_interval.has_property = date_interval_has_property;
 	date_object_handlers_interval.read_property = date_interval_read_property;
 	date_object_handlers_interval.write_property = date_interval_write_property;
 	date_object_handlers_interval.get_properties = date_object_get_properties_interval;

ext/date/tests/bug20382-2.phpt

@@ -75,8 +75,8 @@ result = Monday 1983-04-18 01:00:00 CEST
 wanted = Monday            00:00:00
 
 Asia/Yerevan
-ts     = Monday 2037-10-19 17:17:17 AMT
-result = Monday 2037-10-26 00:00:00 AMT
+ts     = Monday 2037-10-19 17:17:17 +04
+result = Monday 2037-10-26 00:00:00 +04
 wanted = Monday            00:00:00
 
 America/Curacao
@@ -115,8 +115,8 @@ result = Monday 1971-04-05 00:00:00 AST
 wanted = Monday            00:00:00
 
 Asia/Baku
-ts     = Friday 1971-01-01 17:17:17 BAKT
-result = Monday 1971-01-04 00:00:00 BAKT
+ts     = Friday 1971-01-01 17:17:17 +04
+result = Monday 1971-01-04 00:00:00 +04
 wanted = Monday            00:00:00
 
 Europe/Sarajevo
@@ -165,6 +165,6 @@ result = Monday 1980-04-07 00:00:00 CEST
 wanted = Monday            00:00:00
 
 Asia/Baku
-ts     = Monday 1995-12-25 17:17:17 AZT
-result = Monday 1996-01-01 00:00:00 AZT
+ts     = Monday 1995-12-25 17:17:17 +04
+result = Monday 1996-01-01 00:00:00 +04
 wanted = Monday            00:00:00

ext/date/tests/bug33414-1.phpt

@@ -226,8 +226,8 @@ result=Thursday 1980-04-10 00:00:00 CEST 1
 wanted=Thursday             00:00:00
 
 TZ=Asia/Baku - wrong day.
-tStamp=Sunday 1992-09-20 17:17:17 AZST 1
-result=Monday 1992-09-28 00:00:00 AZT 0
+tStamp=Sunday 1992-09-20 17:17:17 +04 1
+result=Monday 1992-09-28 00:00:00 +04 0
 wanted=Monday              00:00:00
 
 TZ=America/Noronha - wrong day.

ext/date/tests/bug33415-1.phpt

@@ -28,6 +28,6 @@ result=Monday 1990-10-22 00:00:00 WART 0
 wanted=Monday            00:00:00
 
 TZ=Asia/Tbilisi - Is it OK for this to be 2 AM?
-tStamp=Sunday 2005-03-20 17:17:17 GET 0
-result=Sunday 2005-03-27 00:00:00 GET 0
+tStamp=Sunday 2005-03-20 17:17:17 +03 0
+result=Sunday 2005-03-27 00:00:00 +03 0
 wanted=Sunday            00:00:00

ext/date/tests/bug69587.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Bug #69587 (DateInterval properties and isset)
+--FILE--
+<?php
+$datetime1 = new DateTime('2009-10-11');
+$datetime2 = new DateTime('2009-10-13');
+$interval = $datetime1->diff($datetime2);
+
+var_dump(property_exists($interval, 'm'), isset($interval->m), empty($interval->m), empty($interval->d));
+?>
+--EXPECT--
+bool(true)
+bool(true)
+bool(true)
+bool(false)

ext/date/tests/date_interval_format.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Test date_interval_format() function : basic functionality
+--CREDITS--
+Jean Carlo Machado <contato@jeancarlomachado.com.br>
+--INI--
+date.timezone=UTC
+--FILE--
+<?php
+
+$interval = new DateInterval('P2Y4DT6H8M');
+echo date_interval_format($interval, '%d days');
+
+echo PHP_EOL;
+
+$interval = new DateInterval('P32D');
+echo date_interval_format($interval, '%d days');
+
+?>
+--EXPECTF--
+4 days
+32 days

ext/dom/document.c

@@ -1663,7 +1663,7 @@ PHP_FUNCTION(dom_document_savexml)
 		if (options & LIBXML_SAVE_NOEMPTYTAG) {
 			xmlSaveNoEmptyTags = saveempty;
 		}
-		if (!size) {
+		if (!size || !mem) {
 			RETURN_FALSE;
 		}
 		RETVAL_STRINGL((char *) mem, size);
@@ -2215,7 +2215,7 @@ PHP_FUNCTION(dom_document_save_html)
 #else
 		htmlDocDumpMemory(docp, &mem, &size);
 #endif
-		if (!size) {
+		if (!size || !mem) {
 			RETVAL_FALSE;
 		} else {
 			RETVAL_STRINGL((const char*) mem, size);

ext/gd/gd.c

@@ -1036,7 +1036,7 @@ void php_gd_error_method(int type, const char *format, va_list args)
 		default:
 			type = E_ERROR;
 	}
-	php_verror(NULL, "", type, format, args TSRMLS_CC);
+	php_verror(NULL, "", type, format, args);
 }
 /* }}} */
 #endif
@@ -3040,7 +3040,7 @@ PHP_FUNCTION(imagegammacorrect)
 	}
 
 	if ( input <= 0.0 || output <= 0.0 ) {
-		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Gamma values should be positive");
+		php_error_docref(NULL, E_WARNING, "Gamma values should be positive");
 		RETURN_FALSE;
 	}
 
@@ -4668,7 +4668,7 @@ PHP_FUNCTION(imagecropauto)
 
 		case GD_CROP_THRESHOLD:
 			if (color < 0 || (!gdImageTrueColor(im) && color >= gdImageColorsTotal(im))) {
-				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Color argument missing with threshold mode");
+				php_error_docref(NULL, E_WARNING, "Color argument missing with threshold mode");
 				RETURN_FALSE;
 			}
 			im_crop = gdImageCropThreshold(im, color, (float) threshold);
@@ -4695,7 +4695,7 @@ PHP_FUNCTION(imagescale)
 	gdImagePtr im_scaled = NULL;
 	int new_width, new_height;
 	zend_long tmp_w, tmp_h=-1, tmp_m = GD_BILINEAR_FIXED;
-	gdInterpolationMethod method;
+	gdInterpolationMethod method, old_method;
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "rl|ll", &IM, &tmp_w, &tmp_h, &tmp_m) == FAILURE)  {
 		return;
@@ -4724,9 +4724,12 @@ PHP_FUNCTION(imagescale)
 	new_width = tmp_w;
 	new_height = tmp_h;
 
+	/* gdImageGetInterpolationMethod() is only available as of GD 2.1.1 */
+	old_method = im->interpolation_id;
 	if (gdImageSetInterpolationMethod(im, method)) {
 		im_scaled = gdImageScale(im, new_width, new_height);
 	}
+	gdImageSetInterpolationMethod(im, old_method);
 
 	if (im_scaled == NULL) {
 		RETURN_FALSE;

ext/gd/libgd/gd.c

@@ -1115,7 +1115,7 @@ void gdImageLine (gdImagePtr im, int x1, int y1, int x2, int y2, int color)
 	}
 
 	/* 2.0.10: Nick Atty: clip to edges of drawing rectangle, return if no points need to be drawn */
-	if (!clip_1d(&x1,&y1,&x2,&y2,gdImageSX(im)) || !clip_1d(&y1,&x1,&y2,&x2,gdImageSY(im))) {
+	if (!clip_1d(&x1,&y1,&x2,&y2,gdImageSX(im)-1) || !clip_1d(&y1,&x1,&y2,&x2,gdImageSY(im)-1)) {
 		return;
 	}
 
@@ -1296,58 +1296,13 @@ inline static void gdImageSetAAPixelColor(gdImagePtr im, int x, int y, int color
 void gdImageAALine (gdImagePtr im, int x1, int y1, int x2, int y2, int col)
 {
 	/* keep them as 32bits */
-	long x, y, inc;
+	long x, y, inc, frac;
 	long dx, dy,tmp;
 
-	if (y1 < 0 && y2 < 0) {
+	/* 2.0.10: Nick Atty: clip to edges of drawing rectangle, return if no points need to be drawn */
+	if (!clip_1d(&x1,&y1,&x2,&y2,gdImageSX(im)-1) || !clip_1d(&y1,&x1,&y2,&x2,gdImageSY(im)-1)) {
 		return;
 	}
-	if (y1 < 0) {
-		x1 += (y1 * (x1 - x2)) / (y2 - y1);
-		y1 = 0;
-	}
-	if (y2 < 0) {
-		x2 += (y2 * (x1 - x2)) / (y2 - y1);
-		y2 = 0;
-	}
-
-	/* bottom edge */
-	if (y1 >= im->sy && y2 >= im->sy) {
-		return;
-	}
-	if (y1 >= im->sy) {
-		x1 -= ((im->sy - y1) * (x1 - x2)) / (y2 - y1);
-		y1 = im->sy - 1;
-	}
-	if (y2 >= im->sy) {
-		x2 -= ((im->sy - y2) * (x1 - x2)) / (y2 - y1);
-		y2 = im->sy - 1;
-	}
-
-	/* left edge */
-	if (x1 < 0 && x2 < 0) {
-		return;
-	}
-	if (x1 < 0) {
-		y1 += (x1 * (y1 - y2)) / (x2 - x1);
-		x1 = 0;
-	}
-	if (x2 < 0) {
-		y2 += (x2 * (y1 - y2)) / (x2 - x1);
-		x2 = 0;
-	}
-	/* right edge */
-	if (x1 >= im->sx && x2 >= im->sx) {
-		return;
-	}
-	if (x1 >= im->sx) {
-		y1 -= ((im->sx - x1) * (y1 - y2)) / (x2 - x1);
-		x1 = im->sx - 1;
-	}
-	if (x2 >= im->sx) {
-		y2 -= ((im->sx - x2) * (y1 - y2)) / (x2 - x1);
-		x2 = im->sx - 1;
-	}
 
 	dx = x2 - x1;
 	dy = y2 - y1;
@@ -1366,16 +1321,22 @@ void gdImageAALine (gdImagePtr im, int x1, int y1, int x2, int y2, int col)
 			dx = x2 - x1;
 			dy = y2 - y1;
 		}
-		x = x1 << 16;
-		y = y1 << 16;
+		y = y1;
 		inc = (dy * 65536) / dx;
-		while ((x >> 16) <= x2) {
-			gdImageSetAAPixelColor(im, x >> 16, y >> 16, col, (y >> 8) & 0xFF);
-			if ((y >> 16) + 1 < im->sy) {
-				gdImageSetAAPixelColor(im, x >> 16, (y >> 16) + 1,col, (~y >> 8) & 0xFF);
+		frac = 0;
+		for (x = x1; x <= x2; x++) {
+			gdImageSetAAPixelColor(im, x, y, col, (frac >> 8) & 0xFF);
+			if (y + 1 < im->sy) {
+				gdImageSetAAPixelColor(im, x, y + 1, col, (~frac >> 8) & 0xFF);
+			}
+			frac += inc;
+			if (frac >= 65536) {
+				frac -= 65536;
+				y++;
+			} else if (frac < 0) {
+				frac += 65536;
+				y--;
 			}
-			x += (1 << 16);
-			y += inc;
 		}
 	} else {
 		if (dy < 0) {
@@ -1388,16 +1349,22 @@ void gdImageAALine (gdImagePtr im, int x1, int y1, int x2, int y2, int col)
 			dx = x2 - x1;
 			dy = y2 - y1;
 		}
-		x = x1 << 16;
-		y = y1 << 16;
+		x = x1;
 		inc = (dx * 65536) / dy;
-		while ((y>>16) <= y2) {
-			gdImageSetAAPixelColor(im, x >> 16, y >> 16, col, (x >> 8) & 0xFF);
-			if ((x >> 16) + 1 < im->sx) {
-				gdImageSetAAPixelColor(im, (x >> 16) + 1, (y >> 16),col, (~x >> 8) & 0xFF);
+		frac = 0;
+		for (y = y1; y <= y2; y++) {
+			gdImageSetAAPixelColor(im, x, y, col, (frac >> 8) & 0xFF);
+			if (x + 1 < im->sx) {
+				gdImageSetAAPixelColor(im, x + 1, y, col, (~frac >> 8) & 0xFF);
+			}
+			frac += inc;
+			if (frac >= 65536) {
+				frac -= 65536;
+				x++;
+			} else if (frac < 0) {
+				frac += 65536;
+				x--;
 			}
-			x += inc;
-			y += (1<<16);
 		}
 	}
 }
@@ -1778,7 +1745,7 @@ void gdImageFillToBorder (gdImagePtr im, int x, int y, int border, int color)
 	int leftLimit = -1, rightLimit;
 	int i, restoreAlphaBlending = 0;
 
-	if (border < 0) {
+	if (border < 0 || color < 0) {
 		/* Refuse to fill to a non-solid border */
 		return;
 	}

ext/gd/libgd/gd_crop.c

@@ -243,6 +243,10 @@ gdImagePtr gdImageCropThreshold(gdImagePtr im, const unsigned int color, const f
 		return NULL;
 	}
 
+	if (!gdImageTrueColor(im) && color >= gdImageColorsTotal(im)) {
+		return NULL;
+	}
+
 	/* TODO: Add gdImageGetRowPtr and works with ptr at the row level
 	 * for the true color and palette images
 	 * new formats will simply work with ptr

ext/gd/libgd/gd_interpolation.c

@@ -1331,10 +1331,10 @@ static gdImagePtr gdImageScaleBilinearPalette(gdImagePtr im, const unsigned int
 			f_a4 = gd_itofx(gdTrueColorGetAlpha(pixel4));
 
 			{
-				const char red = (char) gd_fxtoi(gd_mulfx(f_w1, f_r1) + gd_mulfx(f_w2, f_r2) + gd_mulfx(f_w3, f_r3) + gd_mulfx(f_w4, f_r4));
-				const char green = (char) gd_fxtoi(gd_mulfx(f_w1, f_g1) + gd_mulfx(f_w2, f_g2) + gd_mulfx(f_w3, f_g3) + gd_mulfx(f_w4, f_g4));
-				const char blue = (char) gd_fxtoi(gd_mulfx(f_w1, f_b1) + gd_mulfx(f_w2, f_b2) + gd_mulfx(f_w3, f_b3) + gd_mulfx(f_w4, f_b4));
-				const char alpha = (char) gd_fxtoi(gd_mulfx(f_w1, f_a1) + gd_mulfx(f_w2, f_a2) + gd_mulfx(f_w3, f_a3) + gd_mulfx(f_w4, f_a4));
+				const unsigned char red = (unsigned char) gd_fxtoi(gd_mulfx(f_w1, f_r1) + gd_mulfx(f_w2, f_r2) + gd_mulfx(f_w3, f_r3) + gd_mulfx(f_w4, f_r4));
+				const unsigned char green = (unsigned char) gd_fxtoi(gd_mulfx(f_w1, f_g1) + gd_mulfx(f_w2, f_g2) + gd_mulfx(f_w3, f_g3) + gd_mulfx(f_w4, f_g4));
+				const unsigned char blue = (unsigned char) gd_fxtoi(gd_mulfx(f_w1, f_b1) + gd_mulfx(f_w2, f_b2) + gd_mulfx(f_w3, f_b3) + gd_mulfx(f_w4, f_b4));
+				const unsigned char alpha = (unsigned char) gd_fxtoi(gd_mulfx(f_w1, f_a1) + gd_mulfx(f_w2, f_a2) + gd_mulfx(f_w3, f_a3) + gd_mulfx(f_w4, f_a4));
 
 				new_img->tpixels[dst_offset_v][dst_offset_h] = gdTrueColorAlpha(red, green, blue, alpha);
 			}

ext/gd/libgd/gd_io_dp.c

@@ -237,7 +237,7 @@ static int dynamicGetbuf (gdIOCtxPtr ctx, void *buf, int len)
 	if (remain >= len) {
 		rlen = len;
 	} else {
-		if (remain == 0) {
+		if (remain <= 0) {
 			return EOF;
 		}
 		rlen = remain;

ext/gd/tests/bug72482.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Bug #72482 (Ilegal write/read access caused by gdImageAALine overflow)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$img = imagecreatetruecolor(13, 1007);
+imageantialias($img, true);
+imageline($img, 0, 0, 1073745919, 1073745919, 4096);
+
+$img = imagecreatetruecolor(100, 100);
+imageantialias($img, true);
+imageline($img, 1094795585, 0, 2147483647, 255, 0xff);
+?>
+===DONE===
+--EXPECT--
+===DONE===

ext/gd/tests/bug72482_2.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Bug 72482 (Ilegal write/read access caused by gdImageAALine overflow)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+require_once __DIR__ . DIRECTORY_SEPARATOR . 'func.inc';
+
+$im = imagecreatetruecolor(10, 10);
+imagefilledrectangle($im, 0, 0, 9, 9, imagecolorallocate($im, 255, 255, 255));
+imageantialias($im, true);
+imageline($im, 0, 0, 10, 10, imagecolorallocate($im, 0, 0, 0));
+
+test_image_equals_file(__DIR__ . DIRECTORY_SEPARATOR . 'bug72482_2.png', $im);
+?>
+===DONE===
+--EXPECT--
+The images are equal.
+===DONE===

ext/gd/tests/bug72494.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Bug #72494 (imagecropauto out-of-bounds access)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$im = imagecreate(10,10);
+imagecropauto($im, IMG_CROP_THRESHOLD, 0, 1337);
+?>
+===DONE===
+--EXPECTF--
+Warning: imagecropauto(): Color argument missing with threshold mode in %s on line %d
+===DONE===

ext/gd/tests/bug72696.phpt

@@ -0,0 +1,14 @@
+--TEST--
+Bug #72696 (imagefilltoborder stackoverflow on truecolor images)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$im = imagecreatetruecolor(10, 10);
+imagefilltoborder($im, 0, 0, 1, -2);
+?>
+===DONE===
+--EXPECT--
+===DONE===

ext/gd/tests/bug73213.phpt

@@ -0,0 +1,22 @@
+--TEST--
+Bug #73213 (Integer overflow in imageline() with antialiasing)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+require_once __DIR__ . DIRECTORY_SEPARATOR . 'func.inc';
+
+$im = imagecreatetruecolor(32768, 1);
+$black = imagecolorallocate($im, 0, 0, 0);
+imageantialias($im, true);
+
+imageline($im, 0,0, 32767,0, $black);
+
+test_image_equals_file(__DIR__ . DIRECTORY_SEPARATOR . 'bug73213.png', $im);
+?>
+===DONE===
+--EXPECT--
+The images are equal.
+===DONE===

ext/gd/tests/bug73272.phpt

@@ -0,0 +1,24 @@
+--TEST--
+Bug #73272 (imagescale() is not affected by, but affects imagesetinterpolation())
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+require_once __DIR__ . DIRECTORY_SEPARATOR . 'func.inc';
+
+$src = imagecreatetruecolor(100, 100);
+imagefilledrectangle($src, 0,0, 99,99, 0xFFFFFF);
+imageellipse($src, 49,49, 40,40, 0x000000);
+
+imagesetinterpolation($src, IMG_NEAREST_NEIGHBOUR);
+imagescale($src, 200, 200, IMG_BILINEAR_FIXED);
+$dst = imagerotate($src, 60, 0xFFFFFF);
+
+test_image_equals_file(__DIR__ . DIRECTORY_SEPARATOR . 'bug73272.png', $dst);
+?>
+===DONE===
+--EXPECT--
+The images are equal.
+===DONE===

ext/gd/tests/bug73279.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #73279 (Integer overflow in gdImageScaleBilinearPalette())
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.4', '<')) {
+    die('skip only for bundled libgd or external libgd >= 2.2.4');
+}
+?>
+--FILE--
+<?php
+$src = imagecreate(100, 100);
+imagecolorallocate($src, 255, 255, 255);
+$dst = imagescale($src, 200, 200, IMG_BILINEAR_FIXED);
+printf("color: %x\n", imagecolorat($dst, 99, 99));
+?>
+===DONE===
+--EXPECT--
+color: ffffff
+===DONE===

ext/gd/tests/bug73279_old.phpt

@@ -0,0 +1,22 @@
+--TEST--
+Bug #73279 (Integer overflow in gdImageScaleBilinearPalette())
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (GD_BUNDLED || version_compare(GD_VERSION, '2.2.4', '>=')) {
+    die('skip only for external libgd < 2.2.4');
+}
+?>
+--FILE--
+<?php
+$src = imagecreate(100, 100);
+imagecolorallocate($src, 255, 255, 255);
+$dst = imagescale($src, 200, 200, IMG_BILINEAR_FIXED);
+printf("color: %x\n", imagecolorat($dst, 99, 99));
+?>
+===DONE===
+--XFAIL--
+Bug #330 has not yet been fixed
+--EXPECT--
+color: ffffff
+===DONE===

ext/hash/tests/hash_update_file.phpt

@@ -0,0 +1,21 @@
+--TEST--
+bool hash_update_file ( resource $hcontext , string $filename [, resource $scontext = NULL ] );
+--CREDITS--
+marcosptf - <marcosptf@yahoo.com.br> - @phpsp - sao paulo - br
+--SKIPIF--
+<?php
+if (phpversion() < "5.3.0") {
+    die('SKIP php version so lower.');
+}
+require_once(dirname(__FILE__) . '/skip_mhash.inc'); ?>
+?>
+--FILE--
+<?php
+$ctx = hash_init('md5');
+$filePath = __DIR__ . DIRECTORY_SEPARATOR . 'sha1.phpt';
+fopen($filePath, "r");
+var_dump(hash_update_file($ctx, $filePath));
+hash_final($ctx);
+?>
+--EXPECT--
+bool(true)

ext/hash/tests/hash_update_stream.phpt

@@ -0,0 +1,23 @@
+--TEST--
+int hash_update_stream ( resource $context , resource $handle [, int $length = -1 ] );
+--CREDITS--
+marcosptf - <marcosptf@yahoo.com.br> - @phpsp - sao paulo - br
+--SKIPIF--
+<?php
+if (phpversion() < "5.3.0") {
+    die('SKIP php version so lower.');
+}
+require_once(dirname(__FILE__) . '/skip_mhash.inc'); ?>
+?>
+--FILE--
+<?php
+$fp = tmpfile();
+fwrite($fp, 'The quick brown fox jumped over the lazy dog.');
+rewind($fp);
+
+$ctx = hash_init('md5');
+hash_update_stream($ctx, $fp);
+echo hash_final($ctx);
+?>
+--EXPECT--
+5c6ffbdd40d9556b73a21e63c3e0e904

ext/imap/php_imap.c

@@ -3934,7 +3934,7 @@ int _php_imap_mail(char *to, char *subject, char *message, char *headers, char *
 	char *tsm_errmsg = NULL;
 	ADDRESS *addr;
 	char *bufferTo = NULL, *bufferCc = NULL, *bufferBcc = NULL, *bufferHeader = NULL;
-	int offset, bufferLen = 0;
+	size_t offset, bufferLen = 0;
 	size_t bt_len;
 
 	if (headers) {
@@ -3950,7 +3950,7 @@ int _php_imap_mail(char *to, char *subject, char *message, char *headers, char *
 #define PHP_IMAP_CLEAN	if (bufferTo) efree(bufferTo); if (bufferCc) efree(bufferCc); if (bufferBcc) efree(bufferBcc); if (bufferHeader) efree(bufferHeader);
 #define PHP_IMAP_BAD_DEST PHP_IMAP_CLEAN; efree(tempMailTo); return (BAD_MSG_DESTINATION);
 
-	bufferHeader = (char *)emalloc(bufferLen + 1);
+	bufferHeader = (char *)safe_emalloc(bufferLen, 1, 1);
 	memset(bufferHeader, 0, bufferLen);
 	if (to && *to) {
 		strlcat(bufferHeader, "To: ", bufferLen + 1);

ext/intl/config.w32

@@ -120,7 +120,16 @@ if (PHP_INTL != "no") {
 				codepointiterator_methods.cpp ",
 				"intl");
 		
-		ADD_FLAG("LIBS_INTL", "icudt.lib icuin.lib icuio.lib icule.lib iculx.lib");
+		ADD_FLAG("LIBS_INTL", "icudt.lib icuin.lib icuio.lib");
+
+		/* Compat for ICU before 58.1.*/
+		if (CHECK_LIB("icule.lib", "intl", PHP_INTL)) {
+			ADD_FLAG("LIBS_INTL", "icule.lib");
+		}
+		if (CHECK_LIB("iculx.lib", "intl", PHP_INTL)) {
+			ADD_FLAG("LIBS_INTL", "iculx.lib");
+		}
+
 		ADD_FLAG("CFLAGS_INTL", "/EHsc");
 		AC_DEFINE("HAVE_INTL", 1, "Internationalization support enabled");
 	} else {

ext/intl/intl_convert.c

@@ -53,7 +53,7 @@ void intl_convert_utf8_to_utf16(
 	UErrorCode* status )
 {
 	UChar*      dst_buf = NULL;
-	int32_t     dst_len = 0;
+	uint32_t    dst_len = 0;
 
 	/* If *target is NULL determine required destination buffer size (pre-flighting).
 	 * Otherwise, attempt to convert source string; if *target buffer is not large enough

ext/intl/locale/locale_methods.c

@@ -268,6 +268,9 @@ static zend_string* get_icu_value_internal( const char* loc_name , char* tag_nam
 	int32_t     	buflen          = 512;
 	UErrorCode  	status          = U_ZERO_ERROR;
 
+	if (strlen(loc_name) > INTL_MAX_LOCALE_LEN) {
+		return NULL;
+	}
 
 	if( strcmp(tag_name, LOC_CANONICALIZE_TAG) != 0 ){
 		/* Handle  grandfathered languages */
@@ -405,7 +408,10 @@ static void get_icu_value_src_php( char* tag_name, INTERNAL_FUNCTION_PARAMETERS)
 
 	if(loc_name_len == 0) {
 		loc_name = intl_locale_get_default();
+		loc_name_len = strlen(loc_name);
 	}
+	
+	INTL_CHECK_LOCALE_LEN(loc_name_len);
 
 	/* Call ICU get */
 	tag_value = get_icu_value_internal( loc_name , tag_name , &result ,0);
@@ -710,6 +716,8 @@ PHP_FUNCTION( locale_get_keywords )
         RETURN_FALSE;
     }
 
+	INTL_CHECK_LOCALE_LEN(strlen(loc_name));
+
     if(loc_name_len == 0) {
         loc_name = intl_locale_get_default();
     }
@@ -1117,6 +1125,8 @@ PHP_FUNCTION(locale_parse)
         RETURN_FALSE;
     }
 
+    INTL_CHECK_LOCALE_LEN(strlen(loc_name));
+
     if(loc_name_len == 0) {
         loc_name = intl_locale_get_default();
     }
@@ -1167,8 +1177,10 @@ PHP_FUNCTION(locale_get_all_variants)
 
 	if(loc_name_len == 0) {
 		loc_name = intl_locale_get_default();
+		loc_name_len = strlen(loc_name);
 	}
 
+	INTL_CHECK_LOCALE_LEN(loc_name_len);
 
 	array_init( return_value );
 
@@ -1271,12 +1283,16 @@ PHP_FUNCTION(locale_filter_matches)
 
 	if(loc_range_len == 0) {
 		loc_range = intl_locale_get_default();
+		loc_range_len = strlen(loc_range);
 	}
 
 	if( strcmp(loc_range,"*")==0){
 		RETURN_TRUE;
 	}
 
+	INTL_CHECK_LOCALE_LEN(loc_range_len);
+	INTL_CHECK_LOCALE_LEN(lang_tag_len);
+
 	if( boolCanonical ){
 		/* canonicalize loc_range */
 		can_loc_range=get_icu_value_internal( loc_range , LOC_CANONICALIZE_TAG , &result , 0);
@@ -1551,13 +1567,17 @@ PHP_FUNCTION(locale_lookup)
 	if(loc_range_len == 0) {
 		if(fallback_loc_str) {
 			loc_range = ZSTR_VAL(fallback_loc_str);
+			loc_range_len = ZSTR_LEN(fallback_loc_str);
 		} else {
 			loc_range = intl_locale_get_default();
+			loc_range_len = strlen(loc_range);
 		}
 	}
 
 	hash_arr = Z_ARRVAL_P(arr);
 
+	INTL_CHECK_LOCALE_LEN(loc_range_len);
+
 	if( !hash_arr || zend_hash_num_elements( hash_arr ) == 0 ) {
 		RETURN_EMPTY_STRING();
 	}
@@ -1608,7 +1628,7 @@ PHP_FUNCTION(locale_accept_from_http)
 			len = end ? end-start : http_accept_len-(start-http_accept);
 			if(len > ULOC_FULLNAME_CAPACITY) {
 				intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR,
-						"locale_accept_from_http: locale string too long", 0 TSRMLS_CC );
+						"locale_accept_from_http: locale string too long", 0 );
 				RETURN_FALSE;
 			}
 			if(end) {

ext/intl/msgformat/msgformat_data.c

@@ -83,7 +83,7 @@ msgformat_data* msgformat_data_create( void )
 int msgformat_fix_quotes(UChar **spattern, uint32_t *spattern_len, UErrorCode *ec)
 {
 	if(*spattern && *spattern_len && u_strchr(*spattern, (UChar)'\'')) {
-		UChar *npattern = emalloc(sizeof(UChar)*(2*(*spattern_len)+1));
+		UChar *npattern = safe_emalloc(sizeof(UChar)*2, *spattern_len, sizeof(UChar));
 		uint32_t npattern_len;
 		npattern_len = umsg_autoQuoteApostrophe(*spattern, *spattern_len, npattern, 2*(*spattern_len)+1, ec);
 		efree(*spattern);

ext/intl/resourcebundle/resourcebundle_class.c

@@ -101,6 +101,13 @@ static int resourcebundle_ctor(INTERNAL_FUNCTION_PARAMETERS, zend_bool is_constr
 		locale = intl_locale_get_default();
 	}
 
+	if (bundlename_len >= MAXPATHLEN) {
+		intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR,	"Bundle name too long", 0 );
+		zval_dtor(return_value);
+		ZVAL_NULL(return_value);
+		return FAILURE;
+	}
+
 	if (fallback) {
 		rb->me = ures_open(bundlename, locale, &INTL_DATA_ERROR_CODE(rb));
 	} else {
@@ -331,6 +338,11 @@ PHP_FUNCTION( resourcebundle_locales )
 		RETURN_FALSE;
 	}
 
+	if (bundlename_len >= MAXPATHLEN) {
+		intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR,	"resourcebundle_locales: bundle name too long", 0 );
+		RETURN_FALSE;
+	}
+
 	if(bundlename_len == 0) {
 		// fetch default locales list
 		bundlename = NULL;

ext/intl/tests/bug72241.phpt

@@ -9,6 +9,4 @@ $out = locale_get_primary_language($var1);
 echo strlen($out) . PHP_EOL;
 echo unpack('H*', $out)[1] . PHP_EOL;
 --EXPECT--
-1000
-61616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161
-
+0

ext/json/json.c

@@ -148,7 +148,7 @@ static PHP_GINIT_FUNCTION(json)
 #endif
 	json_globals->encoder_depth = 0;
 	json_globals->error_code = 0;
-	json_globals->encode_max_depth = 0;
+	json_globals->encode_max_depth = PHP_JSON_PARSER_DEFAULT_DEPTH;
 }
 /* }}} */
 
@@ -261,12 +261,12 @@ static PHP_FUNCTION(json_decode)
 	}
 
 	if (depth <= 0) {
-		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Depth must be greater than zero");
+		php_error_docref(NULL, E_WARNING, "Depth must be greater than zero");
 		RETURN_NULL();
 	}
 
 	if (depth > INT_MAX) {
-		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Depth must be lower than %d", INT_MAX);
+		php_error_docref(NULL, E_WARNING, "Depth must be lower than %d", INT_MAX);
 		RETURN_NULL();
 	}
 

ext/mbstring/mbstring.c

@@ -3766,10 +3766,12 @@ PHP_FUNCTION(mb_convert_variables)
 					target_hash = HASH_OF(var);
 					if (target_hash != NULL) {
 						while ((hash_entry = zend_hash_get_current_data(target_hash)) != NULL) {
-							if (++target_hash->u.v.nApplyCount > 1) {
-								--target_hash->u.v.nApplyCount;
-								recursion_error = 1;
-								goto detect_end;
+							if (!Z_IMMUTABLE_P(var)) {
+								if (++target_hash->u.v.nApplyCount > 1) {
+									--target_hash->u.v.nApplyCount;
+									recursion_error = 1;
+									goto detect_end;
+								}
 							}
 							zend_hash_move_forward(target_hash);
 							if (Z_TYPE_P(hash_entry) == IS_INDIRECT) {
@@ -3813,15 +3815,17 @@ detect_end:
 		}
 		if (recursion_error) {
 			while(stack_level-- && (var = &stack[stack_level])) {
-				if (HASH_OF(var)->u.v.nApplyCount > 1) {
-					HASH_OF(var)->u.v.nApplyCount--;
+				if (!Z_IMMUTABLE_P(var)) {
+					if (HASH_OF(var)->u.v.nApplyCount > 1) {
+						HASH_OF(var)->u.v.nApplyCount--;
+					}
 				}
 			}
 			efree(stack);
 			if (elist != NULL) {
 				efree((void *)elist);
 			}
-			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot handle recursive references");
+			php_error_docref(NULL, E_WARNING, "Cannot handle recursive references");
 			RETURN_FALSE;
 		}
 		efree(stack);
@@ -3878,10 +3882,12 @@ detect_end:
 						hash_entry = hash_entry_ptr;
 						ZVAL_DEREF(hash_entry);
 						if (Z_TYPE_P(hash_entry) == IS_ARRAY || Z_TYPE_P(hash_entry) == IS_OBJECT) {
-							if (++(HASH_OF(hash_entry)->u.v.nApplyCount) > 1) {
-								--(HASH_OF(hash_entry)->u.v.nApplyCount);
-								recursion_error = 1;
-								goto conv_end;
+							if (!Z_IMMUTABLE_P(hash_entry)) {
+								if (++(HASH_OF(hash_entry)->u.v.nApplyCount) > 1) {
+									--(HASH_OF(hash_entry)->u.v.nApplyCount);
+									recursion_error = 1;
+									goto conv_end;
+								}
 							}
 							if (stack_level >= stack_max) {
 								stack_max += PHP_MBSTR_STACK_BLOCK_SIZE;
@@ -3929,12 +3935,14 @@ conv_end:
 
 		if (recursion_error) {
 			while(stack_level-- && (var = &stack[stack_level])) {
-				if (HASH_OF(var)->u.v.nApplyCount > 1) {
-					HASH_OF(var)->u.v.nApplyCount--;
+				if (!Z_IMMUTABLE_P(var)) {
+					if (HASH_OF(var)->u.v.nApplyCount > 1) {
+						HASH_OF(var)->u.v.nApplyCount--;
+					}
 				}
 			}
 			efree(stack);
-			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot handle recursive references");
+			php_error_docref(NULL, E_WARNING, "Cannot handle recursive references");
 			RETURN_FALSE;
 		}
 		efree(stack);

ext/mcrypt/mcrypt.c

@@ -642,7 +642,7 @@ PHP_FUNCTION(mcrypt_generic)
 		block_size = mcrypt_enc_get_block_size(pm->td);
 		data_size = ((((int)data_len - 1) / block_size) + 1) * block_size;
 		if (data_size <= 0) {
-			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Integer overflow in data size");
+			php_error_docref(NULL, E_WARNING, "Integer overflow in data size");
 			RETURN_FALSE;
 		}
 		data_str = zend_string_alloc(data_size, 0);
@@ -696,7 +696,7 @@ PHP_FUNCTION(mdecrypt_generic)
 		block_size = mcrypt_enc_get_block_size(pm->td);
 		data_size = ((((int)data_len - 1) / block_size) + 1) * block_size;
 		if (data_size <= 0) {
-			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Integer overflow in data size");
+			php_error_docref(NULL, E_WARNING, "Integer overflow in data size");
 			RETURN_FALSE;
 		}
 		data_s = emalloc((size_t)data_size + 1);
@@ -1299,6 +1299,7 @@ static void php_mcrypt_do_crypt(char* cipher, const char *key, size_t key_len, c
 	}
 
 	if (mcrypt_generic_init(td, (void *) key, (int)key_len, (void *) iv) < 0) {
+		efree(data_s);
 		php_error_docref(NULL, E_RECOVERABLE_ERROR, "Mcrypt initialisation failed");
 		mcrypt_module_close(td);
 		RETURN_FALSE;

ext/oci8/oci8.c

@@ -1387,6 +1387,11 @@ void php_oci_bind_hash_dtor(zval *data)
 {
 	php_oci_bind *bind = (php_oci_bind *) Z_PTR_P(data);
 
+	if (!Z_ISUNDEF(bind->parameter)) {
+		zval_ptr_dtor(&bind->parameter);
+		ZVAL_UNDEF(&bind->parameter);
+	}
+
 	if (bind->array.elements) {
 		efree(bind->array.elements);
 		bind->array.elements = NULL;

ext/oci8/oci8_interface.c

@@ -110,7 +110,7 @@ PHP_FUNCTION(oci_bind_by_name)
 	zval *bind_var = NULL;
 	php_oci_statement *statement;
 	
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "rsz/|ll", &z_statement, &name, &name_len, &bind_var, &maxlen, &type) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS(), "rsz|ll", &z_statement, &name, &name_len, &bind_var, &maxlen, &type) == FAILURE) {
 		return;
 	}
 

ext/oci8/oci8_statement.c

@@ -1094,13 +1094,20 @@ int php_oci_bind_by_name(php_oci_statement *statement, char *name, size_t name_l
 	int mode = OCI_DATA_AT_EXEC;
 	sb4 value_sz = -1;
 	sword errstatus;
+	zval *param = NULL;
+
+	if (!Z_ISREF_P(var)) {
+		param = var;
+	} else {
+		param = Z_REFVAL_P(var);
+	}
 
 	switch (type) {
 		case SQLT_NTY:
 		{
 			zval *tmp;
 			
-			if (Z_TYPE_P(var) != IS_OBJECT || (tmp = zend_hash_str_find(Z_OBJPROP_P(var), "collection", sizeof("collection")-1)) == NULL) {
+			if (Z_TYPE_P(param) != IS_OBJECT || (tmp = zend_hash_str_find(Z_OBJPROP_P(param), "collection", sizeof("collection")-1)) == NULL) {
 				php_error_docref(NULL, E_WARNING, "Unable to find collection property");
 				return 1;
 			}
@@ -1122,7 +1129,7 @@ int php_oci_bind_by_name(php_oci_statement *statement, char *name, size_t name_l
 		{
 			zval *tmp;
 			
-			if (Z_TYPE_P(var) != IS_OBJECT || (tmp = zend_hash_str_find(Z_OBJPROP_P(var), "descriptor", sizeof("descriptor")-1)) == NULL) {
+			if (Z_TYPE_P(param) != IS_OBJECT || (tmp = zend_hash_str_find(Z_OBJPROP_P(param), "descriptor", sizeof("descriptor")-1)) == NULL) {
 				php_error_docref(NULL, E_WARNING, "Unable to find descriptor property");
 				return 1;
 			}
@@ -1141,17 +1148,17 @@ int php_oci_bind_by_name(php_oci_statement *statement, char *name, size_t name_l
 			
 		case SQLT_INT:
 		case SQLT_NUM:
-			if (Z_TYPE_P(var) == IS_RESOURCE || Z_TYPE_P(var) == IS_OBJECT) {
+			if (Z_TYPE_P(param) == IS_RESOURCE || Z_TYPE_P(param) == IS_OBJECT) {
 				php_error_docref(NULL, E_WARNING, "Invalid variable used for bind");
 				return 1;
 			}
-			convert_to_long(var);
+			convert_to_long(param);
 #if defined(OCI_MAJOR_VERSION) && (OCI_MAJOR_VERSION > 10) &&			\
 	(defined(__x86_64__) || defined(__LP64__) || defined(_LP64) || defined(_WIN64)) 
-			bind_data = (ub8 *)&Z_LVAL_P(var);
+			bind_data = (ub8 *)&Z_LVAL_P(param);
 			value_sz = sizeof(ub8);
 #else
-			bind_data = (ub4 *)&Z_LVAL_P(var);
+			bind_data = (ub4 *)&Z_LVAL_P(param);
 			value_sz = sizeof(ub4);
 #endif
 			mode = OCI_DEFAULT;
@@ -1162,20 +1169,20 @@ int php_oci_bind_by_name(php_oci_statement *statement, char *name, size_t name_l
 		case SQLT_LNG:
 		case SQLT_AFC:
 		case SQLT_CHR: /* SQLT_CHR is the default value when type was not specified */
-			if (Z_TYPE_P(var) == IS_RESOURCE || Z_TYPE_P(var) == IS_OBJECT) {
+			if (Z_TYPE_P(param) == IS_RESOURCE || Z_TYPE_P(param) == IS_OBJECT) {
 				php_error_docref(NULL, E_WARNING, "Invalid variable used for bind");
 				return 1;
 			}
-			if (Z_TYPE_P(var) != IS_NULL) {
-				convert_to_string(var);
+			if (Z_TYPE_P(param) != IS_NULL) {
+				convert_to_string(param);
 			}
 			if ((maxlength == -1) || (maxlength == 0)) {
 				if (type == SQLT_LNG) {
 					value_sz = SB4MAXVAL;
-				} else if (Z_TYPE_P(var) == IS_STRING) {
-					value_sz = (sb4) Z_STRLEN_P(var);
+				} else if (Z_TYPE_P(param) == IS_STRING) {
+					value_sz = (sb4) Z_STRLEN_P(param);
 				} else {
-					/* Bug-72524: revert value_sz from PHP_OCI_PIECE_SIZE to 0. This restores PHP 5.6 behavior */
+					/* Bug-72524: revert value_sz from PHP_OCI_PIECE_SIZE to 0. This restores PHP 5.6 behavior  */
 					value_sz = 0;
 				}
 			} else {
@@ -1184,11 +1191,11 @@ int php_oci_bind_by_name(php_oci_statement *statement, char *name, size_t name_l
 			break;
 
 		case SQLT_RSET:
-			if (Z_TYPE_P(var) != IS_RESOURCE) {
+			if (Z_TYPE_P(param) != IS_RESOURCE) {
 				php_error_docref(NULL, E_WARNING, "Invalid variable used for bind");
 				return 1;
 			}
-			PHP_OCI_ZVAL_TO_STATEMENT_EX(var, bind_statement);
+			PHP_OCI_ZVAL_TO_STATEMENT_EX(param, bind_statement);
 			value_sz = sizeof(void*);
 
 			oci_stmt = bind_statement->stmt;
@@ -1200,15 +1207,15 @@ int php_oci_bind_by_name(php_oci_statement *statement, char *name, size_t name_l
 
 #if defined(OCI_MAJOR_VERSION) && OCI_MAJOR_VERSION >= 12
 		case SQLT_BOL:
-			if (Z_TYPE_P(var) == IS_RESOURCE || Z_TYPE_P(var) == IS_OBJECT) {
+			if (Z_TYPE_P(param) == IS_RESOURCE || Z_TYPE_P(param) == IS_OBJECT) {
 				php_error_docref(NULL, E_WARNING, "Invalid variable used for bind");
 				return 1;
 			}
-			convert_to_boolean(var);
-			bind_data = (zend_long *)&Z_LVAL_P(var);
-			if (Z_TYPE_P(var) == IS_TRUE)
+			convert_to_boolean(param);
+			bind_data = (zend_long *)&Z_LVAL_P(param);
+			if (Z_TYPE_P(param) == IS_TRUE)
 				*(zend_long *)bind_data = 1;
-			else if (Z_TYPE_P(var) == IS_FALSE)
+			else if (Z_TYPE_P(param) == IS_FALSE)
 				*(zend_long *)bind_data = 0;
 			else {
 				php_error_docref(NULL, E_WARNING, "Invalid variable used for bind");
@@ -1234,6 +1241,10 @@ int php_oci_bind_by_name(php_oci_statement *statement, char *name, size_t name_l
 
 	if ((old_bind = zend_hash_str_find_ptr(statement->binds, name, name_len)) != NULL) {
 		bindp = old_bind;
+		if (!Z_ISUNDEF(bindp->parameter)) {
+			zval_ptr_dtor(&bindp->parameter);
+			ZVAL_UNDEF(&bindp->parameter);
+		}
 	} else {
 		zend_string *zvtmp;
 		zvtmp = zend_string_init(name, name_len, 0);
@@ -1241,16 +1252,20 @@ int php_oci_bind_by_name(php_oci_statement *statement, char *name, size_t name_l
 		bindp = zend_hash_update_ptr(statement->binds, zvtmp, bindp);
 		zend_string_release(zvtmp);
 	}
-    /* Make sure the minimum of value_sz is 1 to avoid ORA-3149 
-     * when both in/out parameters are bound with empty strings
-     */
+
+	/* Keep a copy of bound variable in the bind hash */
+	ZVAL_COPY(&bindp->parameter, var);
+
+	/* Make sure the minimum of value_sz is 1 to avoid ORA-3149 
+	 * when both in/out parameters are bound with empty strings
+	 */
 	if (value_sz == 0)
 		value_sz = 1;
 	
 	bindp->descriptor = oci_desc;
 	bindp->statement = oci_stmt;
 	bindp->parent_statement = statement;
-	bindp->zval = var;
+	bindp->zval = param;
 	bindp->type = type;
 	/* Storing max length set in OCIBindByName() to check it later in
 	 * php_oci_bind_in_callback() function to avoid ORA-1406 error while

ext/oci8/package.xml

@@ -46,12 +46,12 @@ Interoperability Support" (ID 207303.1) for details.
   <active>no</active>
  </lead>
 
- <date>2016-08-18</date>
+ <date>2016-10-17</date>
  <time>12:00:00</time>
 
   <version>
-   <release>2.1.2</release>
-   <api>2.1.2</api>
+   <release>2.1.3</release>
+   <api>2.1.3</api>
   </version>
   <stability>
    <release>stable</release>
@@ -60,8 +60,7 @@ Interoperability Support" (ID 207303.1) for details.
   <license uri="http://www.php.net/license">PHP</license>
   <notes>
 This version is for PHP 7 only.
-Fixed invalid handle error with Implicit Result Sets
-Fixed bug #72524 (Binding null values triggers ORA-24816 error)
+Fixed bug #71148 (Bind reference overwritten on PHP 7)
   </notes>
  <contents>
   <dir name="/">
@@ -469,6 +468,23 @@ Fixed bug #72524 (Binding null values triggers ORA-24816 error)
  </extsrcrelease>
  <changelog>
 
+<release>
+  <version>
+   <release>2.1.2</release>
+   <api>2.1.2</api>
+  </version>
+  <stability>
+   <release>stable</release>
+   <api>stable</api>
+  </stability>
+  <license uri="http://www.php.net/license">PHP</license>
+  <notes>
+This version is for PHP 7 only.
+Fixed invalid handle error with Implicit Result Sets
+Fixed bug #72524 (Binding null values triggers ORA-24816 error)
+  </notes>
+</release>
+
 <release>
   <version>
    <release>2.1.1</release>

ext/oci8/php_oci8.h

@@ -43,7 +43,7 @@
  */
 #undef PHP_OCI8_VERSION
 #endif
-#define PHP_OCI8_VERSION "2.1.2"
+#define PHP_OCI8_VERSION "2.1.3"
 
 extern zend_module_entry oci8_module_entry;
 #define phpext_oci8_ptr &oci8_module_entry

ext/oci8/php_oci8_int.h

@@ -243,6 +243,7 @@ typedef struct {
 typedef struct { 
 	OCIBind				*bind;					/* bind handle */
 	zval				*zval;					/* value */
+	zval				parameter;				/* a copy of bound variable used for oci_bind_by_name */
 	dvoid				*descriptor;			/* used for binding of LOBS etc */
 	OCIStmt				*statement;				/* used for binding REFCURSORs */
 	php_oci_statement	*parent_statement;		/* pointer to the parent statement */

ext/oci8/tests/bug71148.phpt

@@ -0,0 +1,191 @@
+--TEST--
+Bug #71448 (Binding reference overwritten on php7)
+--SKIPIF--
+<?php
+$target_dbs = array('oracledb' => true, 'timesten' => true);  // test runs on these DBs
+require(dirname(__FILE__).'/skipif.inc');
+?>
+--FILE--
+<?php
+
+require(dirname(__FILE__).'/connect.inc');
+
+// Initialize
+
+$stmtarray = array(
+    "CREATE OR REPLACE FUNCTION bindfunc(var1 varchar2, var2 varchar2)
+       RETURN varchar2
+       AS var3 VARCHAR2(20);
+       BEGIN
+         var3 := CONCAT(var1, var2);
+         RETURN var3;
+       END;",
+    "CREATE OR REPLACE PROCEDURE bindproc(var1 IN string, var2 IN string, var3 IN OUT string) IS
+       BEGIN
+         var3 := CONCAT(var1, var3);
+         var3 := CONCAT(var3, var2);
+       END;"
+);
+
+oci8_test_sql_execute($c, $stmtarray);
+
+// Run test
+
+function bindvar($stmt, $name, $var)
+{
+  oci_bind_by_name($stmt, $name, $var);
+}
+
+// Test 1: Bind input parameter in a local function
+$sql = "select :var1, :var2 from dual";
+$cache1 = "INSTR1";
+$cache2 = "INSTR2";
+
+echo "Test 1: Bind input parameter in a local function\n";
+$stmt = oci_parse($c, $sql);
+
+bindvar($stmt, ':var1', $cache1);
+bindvar($stmt, ':var2', $cache2);
+
+oci_execute($stmt);
+
+var_dump(oci_fetch_assoc($stmt));
+
+oci_free_statement($stmt);
+
+// Test 2: Bind output parameter in a local function
+$sql = "begin :output1 := 'OUTSTR1'; :output2 := 'OUTSTR2'; end;";
+$cache1 = "xxxxxx";
+$cache2 = "xxxxxx";
+
+echo "\nTest 2: Bind output parameter in a local function\n";
+$stmt = oci_parse($c, $sql);
+
+bindvar($stmt, ':output1', $cache1);
+bindvar($stmt, ':output2', $cache2);
+
+oci_execute($stmt);
+
+var_dump($cache1);
+var_dump($cache2);
+
+oci_free_statement($stmt);
+
+// Test 3: Bind output parameter within the same scope of execute
+$sql = "begin :output1 := 'OUTSTR1'; :output2 := 'OUTSTR2'; end;";
+$cache1 = "xxxxxx";
+$cache2 = "xxxxxx";
+
+echo "\nTest 3: Bind output parameter within the same scope of execute\n";
+$stmt = oci_parse($c, $sql);
+
+oci_bind_by_name($stmt, ":output1", $cache1);
+oci_bind_by_name($stmt, ":output2", $cache2);
+
+oci_execute($stmt);
+
+var_dump($cache1);
+var_dump($cache2);
+
+oci_free_statement($stmt);
+
+// Test 4: Bind output parameter within the same scope of execute
+$sql= "begin :output := bindfunc(:var1, :var2); end;";
+$cache1 = "STR1";
+$cache2 = "STR2";
+
+echo "\nTest 4: Bind output parameter within the same scope of execute\n";
+$stmt = oci_parse($c, $sql);
+
+oci_bind_by_name($stmt, ":var1", $cache1, -1);
+oci_bind_by_name($stmt, ":var2", $cache2, -1);
+oci_bind_by_name($stmt, ":output", $cache3, 100);
+
+oci_execute($stmt);
+
+var_dump($cache3);
+
+// Test 5: Bind IN OUT parameter in a local function
+
+$sql = "call bindproc(:var1, :var2, :var3)";
+$cache1 = 'STR1';
+$cache2 = 'STR2';
+$cache3 = ' ';
+
+echo "\nTest 5: Bind IN OUT parameter in a local function\n";
+$stmt = oci_parse($c, $sql);
+
+bindvar($stmt, ':var1', $cache1);
+bindvar($stmt, ':var2', $cache2);
+bindvar($stmt, ':var3', $cache3);
+
+oci_execute($stmt);
+
+var_dump($cache1);
+var_dump($cache2);
+var_dump($cache3);
+
+oci_free_statement($stmt);
+
+// Test 6: Bind IN OUT parameter within the same scope of execute 
+
+$sql = "call bindproc(:var1, :var2, :var3)";
+$cache1 = 'STR1';
+$cache2 = 'STR2';
+$cache3 = ' ';
+
+echo "\nTest 6: Bind IN OUT parameter within the same scope of execute\n";
+$stmt = oci_parse($c, $sql);
+
+oci_bind_by_name($stmt, ":var1", $cache1, -1);
+oci_bind_by_name($stmt, ":var2", $cache2, -1);
+oci_bind_by_name($stmt, ":var3", $cache3, 100);
+
+oci_execute($stmt);
+
+var_dump($cache1);
+var_dump($cache2);
+var_dump($cache3);
+
+// Cleanup
+
+$stmtarray = array(
+    "DROP FUNCTION bindfunc",
+    "DROP PROCEDURE bindproc"
+);
+
+oci8_test_sql_execute($c, $stmtarray);
+
+?>
+===DONE===
+<?php exit(0); ?>
+--EXPECT--
+Test 1: Bind input parameter in a local function
+array(2) {
+  [":VAR1"]=>
+  string(6) "INSTR1"
+  [":VAR2"]=>
+  string(6) "INSTR2"
+}
+
+Test 2: Bind output parameter in a local function
+string(6) "xxxxxx"
+string(6) "xxxxxx"
+
+Test 3: Bind output parameter within the same scope of execute
+string(7) "OUTSTR1"
+string(7) "OUTSTR2"
+
+Test 4: Bind output parameter within the same scope of execute
+string(8) "STR1STR2"
+
+Test 5: Bind IN OUT parameter in a local function
+string(4) "STR1"
+string(4) "STR2"
+string(1) " "
+
+Test 6: Bind IN OUT parameter within the same scope of execute
+string(4) "STR1"
+string(4) "STR2"
+string(9) "STR1 STR2"
+===DONE===

ext/oci8/tests/driver_name.phpt

@@ -57,11 +57,11 @@ function get_attr($conn)
 ?>
 --EXPECT--
 **Test 1.1 - Default values for the attribute **************
-The value of DRIVER_NAME is PHP OCI8 : 2.1.2
+The value of DRIVER_NAME is PHP OCI8 : 2.1.3
 
 ***Test 1.2 - Get the values from different connections **************
 Testing with oci_pconnect()
-The value of DRIVER_NAME is PHP OCI8 : 2.1.2
+The value of DRIVER_NAME is PHP OCI8 : 2.1.3
 Testing with oci_new_connect()
-The value of DRIVER_NAME is PHP OCI8 : 2.1.2
+The value of DRIVER_NAME is PHP OCI8 : 2.1.3
 Done

ext/odbc/php_odbc.c

@@ -876,9 +876,7 @@ PHP_MINFO_FUNCTION(odbc)
 /* {{{ odbc_sql_error */
 void odbc_sql_error(ODBC_SQL_ERROR_PARAMS)
 {
-	char   	    state[6];
 	SQLINTEGER	error;        /* Not used */
-	char   	    errormsg[SQL_MAX_MESSAGE_LENGTH];
 	SQLSMALLINT	errormsgsize; /* Not used */
 	RETCODE rc;
 	ODBC_SQL_ENV_T henv;
@@ -897,21 +895,19 @@ void odbc_sql_error(ODBC_SQL_ERROR_PARAMS)
 	   while(henv != SQL_NULL_HENV){
 		do {
 	 */
-	rc = SQLError(henv, conn, stmt, state, &error, errormsg, sizeof(errormsg)-1, &errormsgsize);
+	rc = SQLError(henv, conn, stmt, ODBCG(laststate), &error, ODBCG(lasterrormsg), sizeof(ODBCG(lasterrormsg))-1, &errormsgsize);
 	if (rc != SQL_SUCCESS && rc != SQL_SUCCESS_WITH_INFO) {
-		snprintf(state, sizeof(state), "HY000");
-		snprintf(errormsg, sizeof(errormsg), "Failed to fetch error message");
+		snprintf(ODBCG(laststate), sizeof(ODBCG(laststate)), "HY000");
+		snprintf(ODBCG(lasterrormsg), sizeof(ODBCG(lasterrormsg)), "Failed to fetch error message");
 	}
 	if (conn_resource) {
-		memcpy(conn_resource->laststate, state, sizeof(state));
-		memcpy(conn_resource->lasterrormsg, errormsg, sizeof(errormsg));
+		memcpy(conn_resource->laststate, ODBCG(laststate), sizeof(ODBCG(laststate)));
+		memcpy(conn_resource->lasterrormsg, ODBCG(lasterrormsg), sizeof(ODBCG(lasterrormsg)));
 	}
-	memcpy(ODBCG(laststate), state, sizeof(state));
-	memcpy(ODBCG(lasterrormsg), errormsg, sizeof(errormsg));
 	if (func) {
-		php_error_docref(NULL, E_WARNING, "SQL error: %s, SQL state %s in %s", errormsg, state, func);
+		php_error_docref(NULL, E_WARNING, "SQL error: %s, SQL state %s in %s", ODBCG(lasterrormsg), ODBCG(laststate), func);
 	} else {
-		php_error_docref(NULL, E_WARNING, "SQL error: %s, SQL state %s", errormsg, state);
+		php_error_docref(NULL, E_WARNING, "SQL error: %s, SQL state %s", ODBCG(lasterrormsg), ODBCG(laststate));
 	}
 	/*		
 		} while (SQL_SUCCEEDED(rc));
@@ -2442,6 +2438,7 @@ int odbc_sqlconnect(odbc_connection **conn, char *db, char *uid, char *pwd, int
 	RETCODE rc;
 	
 	*conn = (odbc_connection *)pemalloc(sizeof(odbc_connection), persistent);
+	memset(*conn, 0, sizeof(odbc_connection));
 	(*conn)->persistent = persistent;
 	SQLAllocEnv(&((*conn)->henv));
 	SQLAllocConnect((*conn)->henv, &((*conn)->hdbc));
@@ -3047,38 +3044,30 @@ static void php_odbc_lasterror(INTERNAL_FUNCTION_PARAMETERS, int mode)
 {
 	odbc_connection *conn;
 	zval *pv_handle;
-	zend_string *ptr;
-	int len;
+	char *ret;
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "|r", &pv_handle) == FAILURE) {
 		return;
 	}
 
-	if (mode == 0) {  /* last state */
-		len = 6;
-	} else { /* last error message */
-		len = SQL_MAX_MESSAGE_LENGTH;
-	}
-
 	if (ZEND_NUM_ARGS() == 1) {
 		if (!(conn = (odbc_connection *)zend_fetch_resource2(Z_RES_P(pv_handle), "ODBC-Link", le_conn, le_pconn))) {
 			RETURN_FALSE;
 		}
-		ptr = zend_string_alloc(len + 1, 0);
 		if (mode == 0) {
-			strlcpy(ZSTR_VAL(ptr), conn->laststate, len+1);
+			ret = conn->laststate;
 		} else {
-			strlcpy(ZSTR_VAL(ptr), conn->lasterrormsg, len+1);
+			ret = conn->lasterrormsg;
 		}
 	} else {
-		ptr = zend_string_alloc(len, 0);
 		if (mode == 0) {
-			strlcpy(ZSTR_VAL(ptr), ODBCG(laststate), len+1);
+			ret = ODBCG(laststate);
 		} else {
-			strlcpy(ZSTR_VAL(ptr), ODBCG(lasterrormsg), len+1);
+			ret = ODBCG(lasterrormsg);
 		}
 	}
-	RETVAL_STR(ptr);
+
+	RETURN_STRING(ret);
 }
 /* }}} */
 

ext/odbc/tests/bug73448.phpt

@@ -0,0 +1,52 @@
+--TEST--
+Bug #73448 odbc_errormsg returns trash, always 513 bytes
+--SKIPIF--
+<?php include 'skipif.inc'; ?>
+--FILE--
+<?php
+
+include 'config.inc';
+
+$conn = odbc_connect($dsn, $user, $pass);
+
+$sqlCommandList = array(
+	"/* empty batch is without error */",
+	"/* non existent procedure xy */ execute xy",
+	"/* empty batch,error message is not empty */",
+	"/* valid select with result */ select * from sys.sysobjects",
+	"/* another erroneous query */ SELECT * FROM zwiebelfleisch",
+	"/* valid select with result */ select * from sys.sysobjects",
+);
+
+foreach ($sqlCommandList as $exampleNumber => $sql) {
+	$r = @odbc_exec($conn, $sql);
+
+	if (false === $r) {
+		$e = odbc_errormsg($conn);
+		$n = odbc_error($conn);
+
+		var_dump($sql, $n, $e, strlen($e));	
+		echo "\n";
+	}
+
+	if ($r) {
+		odbc_free_result($r);
+	}
+
+}
+
+odbc_close($conn);
+?>
+==DONE==
+--EXPECT--
+string(42) "/* non existent procedure xy */ execute xy"
+string(5) "37000"
+string(84) "[Microsoft][ODBC SQL Server Driver][SQL Server]Could not find stored procedure 'xy'."
+int(84)
+
+string(58) "/* another erroneous query */ SELECT * FROM zwiebelfleisch"
+string(5) "S0002"
+string(84) "[Microsoft][ODBC SQL Server Driver][SQL Server]Invalid object name 'zwiebelfleisch'."
+int(84)
+
+==DONE==