set versions

fix typo
set versions
2026-11-13 20:20:50 +00:00 · 2017-08-01 11:14:27 +02:00 · 2017-07-18 12:02:02 +02:00 · 2017-07-18 10:30:46 +02:00 · 2017-07-17 19:38:50 +02:00 · 2017-07-17 06:54:27 +01:00
264 changed files with 11170 additions and 8923 deletions
@@ -24,7 +24,7 @@ environment:
        PHP_BUILD_CACHE_BASE_DIR: c:\build-cache  
        PHP_BUILD_OBJ_DIR: c:\obj
        PHP_BUILD_CACHE_SDK_DIR: c:\build-cache\sdk
-        PHP_BUILD_SDK_BRANCH: php-sdk-2.0.0beta2
+        PHP_BUILD_SDK_BRANCH: php-sdk-2.0.7
        # ext and env setup for tests
        #MYSQL_TEST_PASSWD: Password12!
        #MYSQL_TEST_USER: root
@@ -43,7 +43,7 @@ environment:
 services:
        # the setup scripts have to be touched, once some other db version is used
        - mysql
-        - postgresql95
+        - postgresql96

 platform:
        - x64
@@ -1,6 +1,223 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2017 PHP 7.0.18
+03 Aug 2017 PHP 7.0.22
+
+- Core:
+  . Fixed bug #74832 (Loading PHP extension with already registered function 
+    name leads to a crash). (jpauli)
+  . Fixed bug #74780 (parse_url() borken when query string contains colon). 
+    (jhdxr)
+  . Fixed bug #74761 (Unary operator expected error on some systems). (petk)
+  . Fixed bug #73900 (Use After Free in unserialize() SplFixedArray). (nikic)
+  . Fixed bug #74913 (fixed incorrect poll.h include). (petk)
+  . Fixed bug #74906 (fixed incorrect errno.h include). (petk)
+
+- Date:
+  . Fixed bug #74852 (property_exists returns true on unknown DateInterval 
+    property). (jhdxr)
+
+- OCI8:
+  . Fixed bug #74625 (Integer overflow in oci_bind_array_by_name). (Ingmar Runge)
+
+- Opcache:
+  . Fixed bug #74840 (Opcache overwrites argument of GENERATOR_RETURN within
+    finally). (Bob)
+
+- PDO:
+  . Fixed bug #69356 (PDOStatement::debugDumpParams() truncates query). (Adam
+    Baratz)
+
+- SPL:
+  . Fixed bug #73471 (PHP freezes with AppendIterator). (jhdxr)
+
+- SQLite3:
+  . Fixed bug #74883 (SQLite3::__construct() produces "out of memory" exception
+    with invalid flags). (Anatol)
+
+- Wddx:
+  . Fixed bug #73173 (huge memleak when wddx_unserialize).
+    (tloi at fortinet dot com)
+
+- zlib:
+  . Fixed bug #73944 (dictionary option of inflate_init() does not work).
+    (wapmorgan)
+
+06 Jul 2017 PHP 7.0.21
+
+- Core:
+  . Fixed bug #74738 (Multiple [PATH=] and [HOST=] sections not properly
+    parsed). (Manuel Mausz)
+  . Fixed bug #74658 (Undefined constants in array properties result in broken
+    properties). (Laruence)
+  . Fixed misparsing of abstract unix domain socket names. (Sara)
+  . Fixed bug #74101, bug #74614 (Unserialize Heap Use-After-Free (READ: 1) in
+    zval_get_type). (Nikita)
+  . Fixed bug #74111 (Heap buffer overread (READ: 1) finish_nested_data from
+    unserialize). (Nikita)
+  . Fixed bug #74603 (PHP INI Parsing Stack Buffer Overflow Vulnerability).
+    (Stas)
+  . Fixed bug #74819 (wddx_deserialize() heap out-of-bound read via
+    php_parse_date()). (Derick)
+
+- DOM:
+  . Fixed bug #69373 (References to deleted XPath query results). (ttoohey)
+
+- GD:
+  . Fixed bug #74435 (Buffer over-read into uninitialized memory). (cmb)
+
+- Intl:
+  . Fixed bug #73473 (Stack Buffer Overflow in msgfmt_parse_message). (libnex)
+  . Fixed bug #74705 (Wrong reflection on Collator::getSortKey and
+    collator_get_sort_key). (Tyson Andre, Remi)
+  . Fixed bug #73634 (grapheme_strpos illegal memory access). (Stas)
+
+- Mbstring:
+  . Add oniguruma upstream fix (CVE-2017-9224, CVE-2017-9226, CVE-2017-9227,
+    CVE-2017-9228, CVE-2017-9229) (Remi, Mamoru TASAKA)
+
+- OCI8:
+  . Add TAF callback (PR #2459). (KoenigsKind)
+
+- Opcache:
+  . Fixed bug #74663 (Segfault with opcache.memory_protect and
+    validate_timestamp). (Laruence)
+
+- OpenSSL:
+  . Fixed bug #74651 (negative-size-param (-1) in memcpy in zif_openssl_seal()).
+    (Stas)
+
+- PCRE:
+  . Fixed bug #74087 (Segmentation fault in PHP7.1.1(compiled using the bundled PCRE library)).
+    (Stas)
+
+- PDO_OCI:
+  . Support Instant Client 12.2 in --with-pdo-oci configure option.
+    (Tianfang Yang)
+
+- Reflection:
+  . Fixed bug #74673 (Segfault when cast Reflection object to string with
+    undefined constant). (Laruence)
+
+- SPL:
+  . Fixed bug #74478 (null coalescing operator failing with SplFixedArray).
+    (jhdxr)
+
+- Standard:
+  . Fixed bug #74708 (Invalid Reflection signatures for random_bytes and
+    random_int). (Tyson Andre, Remi)
+  . Fixed bug #73648 (Heap buffer overflow in substr). (Stas)
+
+- FTP:
+  . Fixed bug #74598 (ftp:// wrapper ignores context arg). (Sara)
+
+- PHAR:
+  . Fixed bug #74386 (Phar::__construct reflection incorrect). (villfa)
+
+- SOAP
+  . Fixed bug #74679 (Incorrect conversion array with WSDL_CACHE_MEMORY).
+    (Dmitry)
+
+- Streams:
+  . Fixed bug #74556 (stream_socket_get_name() returns '\0'). (Sara)
+
+8 Jun 2017 PHP 7.0.20
+
+- Core:
+  . Fixed bug #74600 (crash (SIGSEGV) in _zend_hash_add_or_update_i).
+    (Laruence)
+  . Fixed bug #74546 (SIGILL in ZEND_FETCH_CLASS_CONSTANT_SPEC_CONST_CONST).
+    (Laruence)
+
+- intl:
+  . Fixed bug #74468 (wrong reflection on Collator::sortWithSortKeys). (villfa)
+
+- MySQLi:
+  . Fixed bug #74547 (mysqli::change_user() doesn't accept null as $database
+    argument w/strict_types). (Anatol)
+
+- Opcache:
+  . Fixed bug #74596 (SIGSEGV with opcache.revalidate_path enabled). (Laruence)
+
+- phar:
+  . Fixed bug #51918 (Phar::webPhar() does not handle requests sent through PUT
+    and DELETE method). (Christian Weiske)
+
+- Standard:
+  . Fixed bug #74510 (win32/sendmail.c anchors CC header but not BCC).
+    (Damian Wadley, Anatol)
+
+- xmlreader:
+  . Fixed bug #74457 (Wrong reflection on XMLReader::expand). (villfa)
+
+11 May 2017 PHP 7.0.19
+
+- Core:
+  . Fixed bug #74188 (Null coalescing operator fails for undeclared static
+    class properties). (tpunt)
+  . Fixed bug #74408 (Endless loop bypassing execution time limit). (Laruence)
+  . Fixed bug #74410 (stream_select() is broken on Windows Nanoserver).
+    (Matt Ficken)
+  . Fixed bug #74337 (php-cgi.exe crash on facebook callback).
+    (Anton Serbulov)
+  . Patch for bug #74216 was reverted. (Anatol)
+
+- Date:
+  . Fixed bug #74404 (Wrong reflection on DateTimeZone::getTransitions).
+    (krakjoe)
+  . Fixed bug #74080 (add constant for RFC7231 format datetime). (duncan3dc)
+
+- DOM:
+  . Fixed bug #74416 (Wrong reflection on DOMNode::cloneNode).
+    (Remi, Fabien Villepinte)
+
+- Fileinfo:
+  . Fixed bug #74379 (syntax error compile error in libmagic/apprentice.c).
+    (Laruence)
+
+- GD:
+  . Fixed bug #74343 (compile fails on solaris 11 with system gd2 library).
+    (krakjoe)
+
+- intl:
+  . Fixed bug #74433 (wrong reflection for Normalizer methods). (villfa)
+  . Fixed bug #74439 (wrong reflection for Locale methods). (villfa)
+
+- MySQLi:
+  . Fixed bug #74432 (mysqli_connect adding ":3306" to $host if $port parameter
+    not given). (Anatol)
+
+- MySQLnd:
+  . Added support for MySQL 8.0 types. (Johannes)
+  . Fixed bug #74376 (Invalid free of persistent results on error/connection
+    loss). (Yussuf Khalil)
+
+- OpenSSL:
+  . Fixed bug #73833 (null character not allowed in openssl_pkey_get_private).
+    (Jakub Zelenka)
+  . Fixed bug #73711 (Segfault in openssl_pkey_new when generating DSA or DH
+    key). (Jakub Zelenka)
+  . Fixed bug #74341 (openssl_x509_parse fails to parse ASN.1 UTCTime without
+    seconds). (Moritz Fain)
+  . Added OpenSSL 1.1.0 support. (Jakub Zelenka)
+
+- phar:
+  . Fixed bug #74383 (phar method parameters reflection correction). 
+    (mhagstrand)
+
+- Standard:
+  . Fixed bug #74409 (Reflection information for ini_get_all() is incomplete).
+    (Sebastian Bergmann)
+  . Fixed bug #72071 (setcookie allows max-age to be negative). (Craig Duncan)
+
+- Streams:
+  . Fixed bug #74429 (Remote socket URI with unique persistence identifier
+    broken). (Sara)
+
+- SQLite3:
+  . Fixed bug #74413 (incorrect reflection for SQLite3::enableExceptions).
+    (krakjoe)
+
+13 Apr 2017 PHP 7.0.18

 - Core:
  . Fixed bug #73370 (falsely exits with "Out of Memory" when using
@@ -11,6 +228,9 @@ PHP                                                                        NEWS
    to `isfinite'). (Nikita)
  . Fixed bug #74302 (yield fromLABEL is over-greedy). (Sara)

+- Apache:
+  . Reverted patch for bug #61471, fixes bug #74318. (Anatol)
+
 - Date:
  . Fixed bug #72096 (Swatch time value incorrect for dates before 1970). (mcq8)

@@ -21,6 +241,9 @@ PHP                                                                        NEWS
 - iconv:
  . Fixed bug #74230 (iconv fails to fail on surrogates). (Anatol)

+- OCI8:
+  . Fixed uninitialized data causing random crash. (Dmitry)
+
 - OpenSSL:
  . Fixed bug #72333 (fwrite() on non-blocking SSL sockets doesn't work).
    (Jakub Zelenka)
@@ -2363,4 +2586,3 @@ PHP                                                                        NEWS
  . Update bundled libzip to 1.0.1. (Remi, Anatol)
  . Fixed bug #67161 (ZipArchive::getStream() returns NULL for certain file).
    (Christoph M. Becker)
-
@@ -671,7 +671,6 @@ TSRM_API int shmget(int key, int size, int flags)
 TSRM_API void *shmat(int key, const void *shmaddr, int flags)
 {
 	shm_pair *shm = shm_get(key, NULL);
-	int err;

 	if (!shm->segment) {
 		return (void*)-1;
@@ -679,8 +678,8 @@ TSRM_API void *shmat(int key, const void *shmaddr, int flags)

 	shm->addr = MapViewOfFileEx(shm->segment, FILE_MAP_ALL_ACCESS, 0, 0, 0, NULL);

-	err = GetLastError();
-	if (err) {
+	if (NULL == shm->addr) {
+		int err = GetLastError();
 		/* Catch more errors */
 		if (ERROR_NOT_ENOUGH_MEMORY == err) {
 			_set_errno(ENOMEM);
@@ -53,27 +53,43 @@ string(3) "1st"
 string(3) "2nd"
 NULL
 string(3) "4th"
-array(3) {
+array(4) {
  [0]=>
  string(3) "1st"
  [1]=>
  &string(3) "2nd"
+  [2]=>
+  NULL
  [3]=>
  string(3) "4th"
 }
-array(2) {
+array(4) {
+  [0]=>
+  NULL
  [1]=>
  string(3) "2nd"
+  [2]=>
+  NULL
  [3]=>
  string(3) "4th"
 }
-array(2) {
+array(4) {
+  [0]=>
+  NULL
  [1]=>
  &string(3) "2nd"
+  [2]=>
+  NULL
  [3]=>
  string(3) "4th"
 }
-array(1) {
+array(4) {
+  [0]=>
+  NULL
+  [1]=>
+  NULL
+  [2]=>
+  NULL
  [3]=>
  string(3) "4th"
 }
@@ -79,7 +79,7 @@ Stack trace:
 #0 %sbug72101.php(8): {closure}(2, 'Parameter 1 to ...', '%s', 8, Array)
 #1 %sbug72101.php(27): PHPUnit_Framework_MockObject_Stub_ReturnCallback->invoke(Object(PHPUnit_Framework_MockObject_Invocation_Static))
 #2 %sbug72101.php(19): PHPUnit_Framework_MockObject_Matcher->invoked(Object(PHPUnit_Framework_MockObject_Invocation_Static))
-#3 %sbug72101.php(51): PHPUnit_Framework_MockObject_InvocationMocker->invoke(Object(PHPUnit_Framework_MockObject_Invocation_Static))
+#3 %sbug72101.php(52): PHPUnit_Framework_MockObject_InvocationMocker->invoke(Object(PHPUnit_Framework_MockObject_Invocation_Static))
 #4 %sbug72101.php(72): Mock_MethodCallbackByReference_7b180d26->bar(0, 0, 0)
 #5 {main}
  thrown in %sbug72101.php on line 61
@@ -0,0 +1,15 @@
+--TEST--
+Bug #73900: Use After Free in unserialize() SplFixedArray
+--FILE--
+<?php
+
+$a = new stdClass;
+$b = new SplFixedArray(1);
+$b[0] = $a;
+$c = &$b[0];
+var_dump($c);
+
+?>
+--EXPECT--
+object(stdClass)#1 (0) {
+}
@@ -0,0 +1,14 @@
+--TEST--
+Fixes bug 74188 (undeclared static variables emit a warning with ?? operator)
+--FILE--
+<?php
+abstract class Test
+{
+	public static function get()
+	{
+		static::$a ?? true;
+	}
+}
+Test::get();
+?>
+--EXPECT--
@@ -0,0 +1,38 @@
+--TEST--
+Bug #74408 (Endless loop bypassing execution time limit)
+--INI--
+error_reporting = E_ALL | E_DEPRECATED | E_STRICT
+--FILE--
+<?php
+
+ //php.ini: error_reporting = E_ALL | E_DEPRECATED | E_STRICT
+
+ class ErrorHandling {
+
+  public  function error_handler($errno, $errstr, $errfile, $errline) {
+	  $bla = new NonExistingClass2();
+  }
+
+  public function exception_handler(Error $e) { 
+	  echo "Caught, exception: " . $e->getMessage();
+  }
+ }
+
+ set_error_handler('ErrorHandling::error_handler');
+ set_exception_handler('ErrorHandling::exception_handler');
+
+ $blubb = new NonExistingClass();
+?>
+--EXPECTF--
+Deprecated: Non-static method ErrorHandling::error_handler() should not be called statically in %sbug74408.php on line %d
+
+Deprecated: Non-static method ErrorHandling::error_handler() should not be called statically in %sbug74408.php on line %d
+
+Deprecated: Non-static method ErrorHandling::error_handler() should not be called statically in Unknown on line 0
+
+Fatal error: Uncaught Error: Class 'NonExistingClass2' not found in %sbug74408.php:%d
+Stack trace:
+#0 [internal function]: ErrorHandling::error_handler(8192, 'Non-static meth...', '%s', %d, Array)
+#1 %sbug74408.php(%d): set_exception_handler('ErrorHandling::...')
+#2 {main}
+  thrown in %sbug74408.php on line %d
@@ -0,0 +1,11 @@
+--TEST--
+Bug #74546 (SIGILL in ZEND_FETCH_CLASS_CONSTANT_SPEC_CONST_CONST_HANDLER())
+--FILE--
+<?php 
+"000000"[0]::d;
+?>
+--EXPECTF--
+Fatal error: Uncaught Error: Class '0' not found in %sbug74546.php:%d
+Stack trace:
+#0 {main}
+  thrown in %sbug74546.php on line %d
@@ -0,0 +1 @@
+0=0&~2000000000
@@ -0,0 +1,15 @@
+--TEST--
+Bug #74603 (PHP INI Parsing Stack Buffer Overflow Vulnerability)
+--SKIPIF--
+<?php
+if (PHP_INT_MAX !== 2147483647)
+        die('skip for 32-bit only');
+--FILE--
+<?php
+var_dump(parse_ini_file(__DIR__ . "/bug74603.ini", true, INI_SCANNER_NORMAL));
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  string(1) "0"
+}
@@ -0,0 +1,26 @@
+--TEST--
+Bug #74657 (Undefined constants in array properties result in broken properties)
+--FILE--
+<?php
+
+interface I {
+}
+
+class C {
+	const FOO = I::FOO;
+
+	public $options = [self::FOO => "bar"];
+}
+
+try {
+	var_dump((new C)->options);
+} catch (Throwable $e) {}
+
+var_dump((new C)->options);
+?>
+--EXPECTF--
+Fatal error: Uncaught Error: Undefined class constant 'I::FOO' in %sbug74657.php:%d
+Stack trace:
+#0 {main}
+  thrown in %sbug74657.php on line %d
+
@@ -0,0 +1,21 @@
+--TEST--
+Bug #74840: Opcache overwrites argument of GENERATOR_RETURN within finally
+--FILE--
+<?php
+
+$g = (function($a) {
+	try {
+		return $a + 1;
+	} finally {
+		$b = $a + 2;
+		var_dump($b);
+	}
+	yield; // Generator
+})(1);
+$g->next();
+var_dump($g->getReturn());
+
+?>
+--EXPECT--
+int(3)
+int(2)
@@ -1087,8 +1087,6 @@ ZEND_API void zend_merge_properties(zval *obj, HashTable *properties) /* {{{ */
 ZEND_API int zend_update_class_constants(zend_class_entry *class_type) /* {{{ */
 {
 	if (!(class_type->ce_flags & ZEND_ACC_CONSTANTS_UPDATED)) {
-		class_type->ce_flags |= ZEND_ACC_CONSTANTS_UPDATED;
-
 		if (class_type->parent) {
 			if (UNEXPECTED(zend_update_class_constants(class_type->parent) != SUCCESS)) {
 				return FAILURE;
@@ -1162,7 +1160,9 @@ ZEND_API int zend_update_class_constants(zend_class_entry *class_type) /* {{{ */

 			*scope = old_scope;
 		}
+		class_type->ce_flags |= ZEND_ACC_CONSTANTS_UPDATED;
 	}
+
 	return SUCCESS;
 }
 /* }}} */
@@ -2028,17 +2028,19 @@ ZEND_API zend_module_entry* zend_register_module_ex(zend_module_entry *module) /
 		zend_string_release(lcname);
 		return NULL;
 	}
-	zend_string_release(lcname);
 	module = module_ptr;
 	EG(current_module) = module;

 	if (module->functions && zend_register_functions(NULL, module->functions, NULL, module->type)==FAILURE) {
+		zend_hash_del(&module_registry, lcname);
+		zend_string_release(lcname);
 		EG(current_module) = NULL;
 		zend_error(E_CORE_WARNING,"%s: Unable to register functions, unable to load", module->name);
 		return NULL;
 	}

 	EG(current_module) = NULL;
+	zend_string_release(lcname);
 	return module;
 }
 /* }}} */
@@ -507,7 +507,7 @@ ZEND_FUNCTION(func_get_args)
 {
 	zval *p, *q;
 	uint32_t arg_count, first_extra_arg;
-	uint32_t i, n;
+	uint32_t i;
 	zend_execute_data *ex = EX(prev_execute_data);

 	if (ZEND_CALL_INFO(ex) & ZEND_CALL_CODE) {
@@ -523,7 +523,6 @@ ZEND_FUNCTION(func_get_args)
 		zend_hash_real_init(Z_ARRVAL_P(return_value), 1);
 		ZEND_HASH_FILL_PACKED(Z_ARRVAL_P(return_value)) {
 			i = 0;
-			n = 0;
 			p = ZEND_CALL_ARG(ex, 1);
 			if (arg_count > first_extra_arg) {
 				while (i < first_extra_arg) {
@@ -533,7 +532,8 @@ ZEND_FUNCTION(func_get_args)
 						if (Z_OPT_REFCOUNTED_P(q)) { 
 							Z_ADDREF_P(q);
 						}
-						n++;
+					} else {
+						q = &EG(uninitialized_zval);
 					}
 					ZEND_HASH_FILL_ADD(q);
 					p++;
@@ -548,14 +548,15 @@ ZEND_FUNCTION(func_get_args)
 					if (Z_OPT_REFCOUNTED_P(q)) { 
 						Z_ADDREF_P(q);
 					}
-					n++;
+				} else {
+					q = &EG(uninitialized_zval);
 				}
 				ZEND_HASH_FILL_ADD(q);
 				p++;
 				i++;
 			}
 		} ZEND_HASH_FILL_END();
-		Z_ARRVAL_P(return_value)->nNumOfElements = n;
+		Z_ARRVAL_P(return_value)->nNumOfElements = arg_count;
 	}
 }
 /* }}} */
@@ -2219,7 +2220,6 @@ static void debug_backtrace_get_args(zend_execute_data *call, zval *arg_array) /
 	array_init_size(arg_array, num_args);
 	if (num_args) {
 		uint32_t i = 0;
-		uint32_t n = 0;
 		zval *p = ZEND_CALL_ARG(call, 1);

 		zend_hash_real_init(Z_ARRVAL_P(arg_array), 1);
@@ -2242,12 +2242,9 @@ static void debug_backtrace_get_args(zend_execute_data *call, zval *arg_array) /
 							if (Z_OPT_REFCOUNTED_P(arg)) {
 								Z_ADDREF_P(arg);
 							}
-							n++;
 							ZEND_HASH_FILL_ADD(arg);
 						} else {
-							zval tmp;
-							ZVAL_UNDEF(&tmp);
-							ZEND_HASH_FILL_ADD(&tmp);
+							ZEND_HASH_FILL_ADD(&EG(uninitialized_zval));
 						}
 						i++;
 					}
@@ -2257,9 +2254,10 @@ static void debug_backtrace_get_args(zend_execute_data *call, zval *arg_array) /
 							if (Z_OPT_REFCOUNTED_P(p)) {
 								Z_ADDREF_P(p);
 							}
-							n++;
+							ZEND_HASH_FILL_ADD(p);
+						} else {
+							ZEND_HASH_FILL_ADD(&EG(uninitialized_zval));
 						}
-						ZEND_HASH_FILL_ADD(p);
 						p++;
 						i++;
 					}
@@ -2272,14 +2270,15 @@ static void debug_backtrace_get_args(zend_execute_data *call, zval *arg_array) /
 					if (Z_OPT_REFCOUNTED_P(p)) {
 						Z_ADDREF_P(p);
 					}
-					n++;
+					ZEND_HASH_FILL_ADD(p);
+				} else {
+					ZEND_HASH_FILL_ADD(&EG(uninitialized_zval));
 				}
-				ZEND_HASH_FILL_ADD(p);
 				p++;
 				i++;
 			}
 		} ZEND_HASH_FILL_END();
-		Z_ARRVAL_P(arg_array)->nNumOfElements = n;
+		Z_ARRVAL_P(arg_array)->nNumOfElements = num_args;
 	}
 }
 /* }}} */
@@ -6669,8 +6669,11 @@ void zend_compile_class_const(znode *result, zend_ast *ast) /* {{{ */
 		return;
 	}

-	zend_eval_const_expr(&class_ast);
-	zend_eval_const_expr(&const_ast);
+	zend_eval_const_expr(&ast->child[0]);
+	zend_eval_const_expr(&ast->child[1]);
+
+	class_ast = ast->child[0];
+	const_ast = ast->child[1];

 	if (class_ast->kind == ZEND_AST_ZVAL) {
 		resolved_name = zend_resolve_class_name_ast(class_ast);
@@ -7314,6 +7317,8 @@ void zend_compile_expr(znode *result, zend_ast *ast) /* {{{ */

 void zend_compile_var(znode *result, zend_ast *ast, uint32_t type) /* {{{ */
 {
+	CG(zend_lineno) = zend_ast_get_lineno(ast);
+
 	switch (ast->kind) {
 		case ZEND_AST_VAR:
 			zend_compile_simple_var(result, ast, type, 0);
@@ -7610,8 +7615,11 @@ void zend_eval_const_expr(zend_ast **ast_ptr) /* {{{ */
 				break;
 			}

-			zend_eval_const_expr(&class_ast);
-			zend_eval_const_expr(&name_ast);
+			zend_eval_const_expr(&ast->child[0]);
+			zend_eval_const_expr(&ast->child[1]);
+
+			class_ast = ast->child[0];
+			name_ast = ast->child[1];

 			if (name_ast->kind == ZEND_AST_ZVAL && zend_string_equals_literal_ci(zend_ast_get_str(name_ast), "class")) {
 				zend_error_noreturn(E_COMPILE_ERROR,
@@ -1758,16 +1758,9 @@ convert_to_array:
 				zend_error(E_NOTICE, "Indirect modification of overloaded element of %s has no effect", ZSTR_VAL(ce->name));
 			} else if (EXPECTED(retval && Z_TYPE_P(retval) != IS_UNDEF)) {
 				if (!Z_ISREF_P(retval)) {
-					if (Z_REFCOUNTED_P(retval) &&
-					    Z_REFCOUNT_P(retval) > 1) {
-						if (Z_TYPE_P(retval) != IS_OBJECT) {
-							Z_DELREF_P(retval);
-							ZVAL_DUP(result, retval);
-							retval = result;
-						} else {
-							ZVAL_COPY_VALUE(result, retval);
-							retval = result;
-						}
+					if (result != retval) {
+						ZVAL_COPY(result, retval);
+						retval = result;
 					}
 					if (Z_TYPE_P(retval) != IS_OBJECT) {
 						zend_class_entry *ce = Z_OBJCE_P(container);
@@ -755,6 +755,15 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache) /
 			}
 			zend_error(E_DEPRECATED, "%s", error);
 			efree(error);
+			if (UNEXPECTED(EG(exception))) {
+				if (callable_name) {
+					zend_string_release(callable_name);
+				}
+				if (EG(current_execute_data) == &dummy_execute_data) {
+					EG(current_execute_data) = dummy_execute_data.prev_execute_data;
+				}
+				return FAILURE;
+			}
 		}
 		zend_string_release(callable_name);
 	}
@@ -291,7 +291,6 @@ static uint32_t zend_array_recalc_elements(HashTable *ht)
       uint32_t num = ht->nNumOfElements;

 	   ZEND_HASH_FOREACH_VAL(ht, val) {
-		   if (Z_TYPE_P(val) == IS_UNDEF) continue;
 		   if (Z_TYPE_P(val) == IS_INDIRECT) {
 			   if (UNEXPECTED(Z_TYPE_P(Z_INDIRECT_P(val)) == IS_UNDEF)) {
 				   num--;
@@ -55,7 +55,7 @@ static void zend_ini_do_op(char type, zval *result, zval *op1, zval *op2)
 	int i_result;
 	int i_op1, i_op2;
 	int str_len;
-	char str_result[MAX_LENGTH_OF_LONG];
+	char str_result[MAX_LENGTH_OF_LONG+1];

 	i_op1 = atoi(Z_STRVAL_P(op1));
 	zend_string_free(Z_STR_P(op1));
@@ -122,11 +122,13 @@ struct _zend_module_dep {
 	unsigned char type;		/* dependency type */
 };

+BEGIN_EXTERN_C()
 extern ZEND_API HashTable module_registry;

 void module_destructor(zend_module_entry *module);
 int module_registry_request_startup(zend_module_entry *module);
 int module_registry_unload_temp(const zend_module_entry *module);
+END_EXTERN_C()

 #endif

@@ -155,12 +155,12 @@ struct _zend_object_handlers {
 	zend_object_compare_zvals_t				compare;
 };

+BEGIN_EXTERN_C()
 extern ZEND_API zend_object_handlers std_object_handlers;

 #define zend_get_function_root_class(fbc) \
 	((fbc)->common.prototype ? (fbc)->common.prototype->common.scope : (fbc)->common.scope)

-BEGIN_EXTERN_C()
 ZEND_API union _zend_function *zend_std_get_static_method(zend_class_entry *ce, zend_string *function_name_strval, const zval *key);
 ZEND_API zval *zend_std_get_static_property(zend_class_entry *ce, zend_string *property_name, zend_bool silent);
 ZEND_API ZEND_COLD zend_bool zend_std_unset_static_property(zend_class_entry *ce, zend_string *property_name);
@@ -380,7 +380,7 @@ CWD_API int php_sys_stat_ex(const char *path, zend_stat_t *buf, int lstat) /* {{
 	if ((data.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) == 0) {
 		size_t len = strlen(path);

-		if (path[len-4] == '.') {
+		if (len >= 4 && path[len-4] == '.') {
 			if (_memicmp(path+len-3, "exe", 3) == 0 ||
 				_memicmp(path+len-3, "com", 3) == 0 ||
 				_memicmp(path+len-3, "bat", 3) == 0 ||
@@ -1515,9 +1515,13 @@ ZEND_VM_HELPER_EX(zend_fetch_var_address_helper, CONST|TMPVAR|CV, UNUSED|CONST|V

 				/* check if static properties were destoyed */
 				if (UNEXPECTED(CE_STATIC_MEMBERS(ce) == NULL)) {
-					zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));
-					FREE_OP1();
-					HANDLE_EXCEPTION();
+					if (type == BP_VAR_IS) {
+						retval = &EG(uninitialized_zval);
+					} else {
+						zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));
+						FREE_OP1();
+						HANDLE_EXCEPTION();
+					}
 				}

 				ZEND_VM_C_GOTO(fetch_var_return);
@@ -1539,15 +1543,19 @@ ZEND_VM_HELPER_EX(zend_fetch_var_address_helper, CONST|TMPVAR|CV, UNUSED|CONST|V
 				
 				/* check if static properties were destoyed */
 				if (UNEXPECTED(CE_STATIC_MEMBERS(ce) == NULL)) {
-					zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));
-					FREE_OP1();
-					HANDLE_EXCEPTION();
+					if (type == BP_VAR_IS) {
+						retval = &EG(uninitialized_zval);
+					} else {
+						zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));
+						FREE_OP1();
+						HANDLE_EXCEPTION();
+					}
 				}

 				ZEND_VM_C_GOTO(fetch_var_return);
 			}
 		}
-		retval = zend_std_get_static_property(ce, name, 0);
+		retval = zend_std_get_static_property(ce, name, type == BP_VAR_IS);
 		if (UNEXPECTED(EG(exception))) {
 			if (OP1_TYPE != IS_CONST) {
 				zend_string_release(name);
@@ -1555,8 +1563,12 @@ ZEND_VM_HELPER_EX(zend_fetch_var_address_helper, CONST|TMPVAR|CV, UNUSED|CONST|V
 			FREE_OP1();
 			HANDLE_EXCEPTION();
 		}
-		if (OP1_TYPE == IS_CONST && retval) {
-			CACHE_POLYMORPHIC_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce, retval);
+		if (EXPECTED(retval)) {
+			if (OP1_TYPE == IS_CONST) {
+				CACHE_POLYMORPHIC_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce, retval);
+			}
+		} else {
+			retval = &EG(uninitialized_zval);
 		}

 		FREE_OP1();
@@ -5007,9 +5007,13 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_

 				/* check if static properties were destoyed */
 				if (UNEXPECTED(CE_STATIC_MEMBERS(ce) == NULL)) {
-					zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));
+					if (type == BP_VAR_IS) {
+						retval = &EG(uninitialized_zval);
+					} else {
+						zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));

-					HANDLE_EXCEPTION();
+						HANDLE_EXCEPTION();
+					}
 				}

 				goto fetch_var_return;
@@ -5031,15 +5035,19 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_

 				/* check if static properties were destoyed */
 				if (UNEXPECTED(CE_STATIC_MEMBERS(ce) == NULL)) {
-					zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));
+					if (type == BP_VAR_IS) {
+						retval = &EG(uninitialized_zval);
+					} else {
+						zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));

-					HANDLE_EXCEPTION();
+						HANDLE_EXCEPTION();
+					}
 				}

 				goto fetch_var_return;
 			}
 		}
-		retval = zend_std_get_static_property(ce, name, 0);
+		retval = zend_std_get_static_property(ce, name, type == BP_VAR_IS);
 		if (UNEXPECTED(EG(exception))) {
 			if (IS_CONST != IS_CONST) {
 				zend_string_release(name);
@@ -5047,8 +5055,12 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_

 			HANDLE_EXCEPTION();
 		}
-		if (IS_CONST == IS_CONST && retval) {
-			CACHE_POLYMORPHIC_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce, retval);
+		if (EXPECTED(retval)) {
+			if (IS_CONST == IS_CONST) {
+				CACHE_POLYMORPHIC_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce, retval);
+			}
+		} else {
+			retval = &EG(uninitialized_zval);
 		}

 	} else {
@@ -6963,9 +6975,13 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_

 				/* check if static properties were destoyed */
 				if (UNEXPECTED(CE_STATIC_MEMBERS(ce) == NULL)) {
-					zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));
+					if (type == BP_VAR_IS) {
+						retval = &EG(uninitialized_zval);
+					} else {
+						zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));

-					HANDLE_EXCEPTION();
+						HANDLE_EXCEPTION();
+					}
 				}

 				goto fetch_var_return;
@@ -6987,15 +7003,19 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_

 				/* check if static properties were destoyed */
 				if (UNEXPECTED(CE_STATIC_MEMBERS(ce) == NULL)) {
-					zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));
+					if (type == BP_VAR_IS) {
+						retval = &EG(uninitialized_zval);
+					} else {
+						zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));

-					HANDLE_EXCEPTION();
+						HANDLE_EXCEPTION();
+					}
 				}

 				goto fetch_var_return;
 			}
 		}
-		retval = zend_std_get_static_property(ce, name, 0);
+		retval = zend_std_get_static_property(ce, name, type == BP_VAR_IS);
 		if (UNEXPECTED(EG(exception))) {
 			if (IS_CONST != IS_CONST) {
 				zend_string_release(name);
@@ -7003,8 +7023,12 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_

 			HANDLE_EXCEPTION();
 		}
-		if (IS_CONST == IS_CONST && retval) {
-			CACHE_POLYMORPHIC_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce, retval);
+		if (EXPECTED(retval)) {
+			if (IS_CONST == IS_CONST) {
+				CACHE_POLYMORPHIC_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce, retval);
+			}
+		} else {
+			retval = &EG(uninitialized_zval);
 		}

 	} else {
@@ -7469,9 +7493,13 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_

 				/* check if static properties were destoyed */
 				if (UNEXPECTED(CE_STATIC_MEMBERS(ce) == NULL)) {
-					zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));
+					if (type == BP_VAR_IS) {
+						retval = &EG(uninitialized_zval);
+					} else {
+						zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));

-					HANDLE_EXCEPTION();
+						HANDLE_EXCEPTION();
+					}
 				}

 				goto fetch_var_return;
@@ -7493,15 +7521,19 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_

 				/* check if static properties were destoyed */
 				if (UNEXPECTED(CE_STATIC_MEMBERS(ce) == NULL)) {
-					zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));
+					if (type == BP_VAR_IS) {
+						retval = &EG(uninitialized_zval);
+					} else {
+						zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));

-					HANDLE_EXCEPTION();
+						HANDLE_EXCEPTION();
+					}
 				}

 				goto fetch_var_return;
 			}
 		}
-		retval = zend_std_get_static_property(ce, name, 0);
+		retval = zend_std_get_static_property(ce, name, type == BP_VAR_IS);
 		if (UNEXPECTED(EG(exception))) {
 			if (IS_CONST != IS_CONST) {
 				zend_string_release(name);
@@ -7509,8 +7541,12 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_

 			HANDLE_EXCEPTION();
 		}
-		if (IS_CONST == IS_CONST && retval) {
-			CACHE_POLYMORPHIC_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce, retval);
+		if (EXPECTED(retval)) {
+			if (IS_CONST == IS_CONST) {
+				CACHE_POLYMORPHIC_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce, retval);
+			}
+		} else {
+			retval = &EG(uninitialized_zval);
 		}

 	} else {
@@ -31389,9 +31425,13 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_

 				/* check if static properties were destoyed */
 				if (UNEXPECTED(CE_STATIC_MEMBERS(ce) == NULL)) {
-					zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));
+					if (type == BP_VAR_IS) {
+						retval = &EG(uninitialized_zval);
+					} else {
+						zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));

-					HANDLE_EXCEPTION();
+						HANDLE_EXCEPTION();
+					}
 				}

 				goto fetch_var_return;
@@ -31413,15 +31453,19 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_

 				/* check if static properties were destoyed */
 				if (UNEXPECTED(CE_STATIC_MEMBERS(ce) == NULL)) {
-					zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));
+					if (type == BP_VAR_IS) {
+						retval = &EG(uninitialized_zval);
+					} else {
+						zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));

-					HANDLE_EXCEPTION();
+						HANDLE_EXCEPTION();
+					}
 				}

 				goto fetch_var_return;
 			}
 		}
-		retval = zend_std_get_static_property(ce, name, 0);
+		retval = zend_std_get_static_property(ce, name, type == BP_VAR_IS);
 		if (UNEXPECTED(EG(exception))) {
 			if (IS_CV != IS_CONST) {
 				zend_string_release(name);
@@ -31429,8 +31473,12 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_

 			HANDLE_EXCEPTION();
 		}
-		if (IS_CV == IS_CONST && retval) {
-			CACHE_POLYMORPHIC_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce, retval);
+		if (EXPECTED(retval)) {
+			if (IS_CV == IS_CONST) {
+				CACHE_POLYMORPHIC_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce, retval);
+			}
+		} else {
+			retval = &EG(uninitialized_zval);
 		}

 	} else {
@@ -33617,9 +33665,13 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_

 				/* check if static properties were destoyed */
 				if (UNEXPECTED(CE_STATIC_MEMBERS(ce) == NULL)) {
-					zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));
+					if (type == BP_VAR_IS) {
+						retval = &EG(uninitialized_zval);
+					} else {
+						zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));

-					HANDLE_EXCEPTION();
+						HANDLE_EXCEPTION();
+					}
 				}

 				goto fetch_var_return;
@@ -33641,15 +33693,19 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_

 				/* check if static properties were destoyed */
 				if (UNEXPECTED(CE_STATIC_MEMBERS(ce) == NULL)) {
-					zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));
+					if (type == BP_VAR_IS) {
+						retval = &EG(uninitialized_zval);
+					} else {
+						zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));

-					HANDLE_EXCEPTION();
+						HANDLE_EXCEPTION();
+					}
 				}

 				goto fetch_var_return;
 			}
 		}
-		retval = zend_std_get_static_property(ce, name, 0);
+		retval = zend_std_get_static_property(ce, name, type == BP_VAR_IS);
 		if (UNEXPECTED(EG(exception))) {
 			if (IS_CV != IS_CONST) {
 				zend_string_release(name);
@@ -33657,8 +33713,12 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_

 			HANDLE_EXCEPTION();
 		}
-		if (IS_CV == IS_CONST && retval) {
-			CACHE_POLYMORPHIC_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce, retval);
+		if (EXPECTED(retval)) {
+			if (IS_CV == IS_CONST) {
+				CACHE_POLYMORPHIC_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce, retval);
+			}
+		} else {
+			retval = &EG(uninitialized_zval);
 		}

 	} else {
@@ -34565,9 +34625,13 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_

 				/* check if static properties were destoyed */
 				if (UNEXPECTED(CE_STATIC_MEMBERS(ce) == NULL)) {
-					zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));
+					if (type == BP_VAR_IS) {
+						retval = &EG(uninitialized_zval);
+					} else {
+						zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));

-					HANDLE_EXCEPTION();
+						HANDLE_EXCEPTION();
+					}
 				}

 				goto fetch_var_return;
@@ -34589,15 +34653,19 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_

 				/* check if static properties were destoyed */
 				if (UNEXPECTED(CE_STATIC_MEMBERS(ce) == NULL)) {
-					zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));
+					if (type == BP_VAR_IS) {
+						retval = &EG(uninitialized_zval);
+					} else {
+						zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));

-					HANDLE_EXCEPTION();
+						HANDLE_EXCEPTION();
+					}
 				}

 				goto fetch_var_return;
 			}
 		}
-		retval = zend_std_get_static_property(ce, name, 0);
+		retval = zend_std_get_static_property(ce, name, type == BP_VAR_IS);
 		if (UNEXPECTED(EG(exception))) {
 			if (IS_CV != IS_CONST) {
 				zend_string_release(name);
@@ -34605,8 +34673,12 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_

 			HANDLE_EXCEPTION();
 		}
-		if (IS_CV == IS_CONST && retval) {
-			CACHE_POLYMORPHIC_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce, retval);
+		if (EXPECTED(retval)) {
+			if (IS_CV == IS_CONST) {
+				CACHE_POLYMORPHIC_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce, retval);
+			}
+		} else {
+			retval = &EG(uninitialized_zval);
 		}

 	} else {
@@ -41826,9 +41898,13 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_

 				/* check if static properties were destoyed */
 				if (UNEXPECTED(CE_STATIC_MEMBERS(ce) == NULL)) {
-					zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));
-					zval_ptr_dtor_nogc(free_op1);
-					HANDLE_EXCEPTION();
+					if (type == BP_VAR_IS) {
+						retval = &EG(uninitialized_zval);
+					} else {
+						zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));
+						zval_ptr_dtor_nogc(free_op1);
+						HANDLE_EXCEPTION();
+					}
 				}

 				goto fetch_var_return;
@@ -41850,15 +41926,19 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_

 				/* check if static properties were destoyed */
 				if (UNEXPECTED(CE_STATIC_MEMBERS(ce) == NULL)) {
-					zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));
-					zval_ptr_dtor_nogc(free_op1);
-					HANDLE_EXCEPTION();
+					if (type == BP_VAR_IS) {
+						retval = &EG(uninitialized_zval);
+					} else {
+						zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));
+						zval_ptr_dtor_nogc(free_op1);
+						HANDLE_EXCEPTION();
+					}
 				}

 				goto fetch_var_return;
 			}
 		}
-		retval = zend_std_get_static_property(ce, name, 0);
+		retval = zend_std_get_static_property(ce, name, type == BP_VAR_IS);
 		if (UNEXPECTED(EG(exception))) {
 			if ((IS_TMP_VAR|IS_VAR) != IS_CONST) {
 				zend_string_release(name);
@@ -41866,8 +41946,12 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_
 			zval_ptr_dtor_nogc(free_op1);
 			HANDLE_EXCEPTION();
 		}
-		if ((IS_TMP_VAR|IS_VAR) == IS_CONST && retval) {
-			CACHE_POLYMORPHIC_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce, retval);
+		if (EXPECTED(retval)) {
+			if ((IS_TMP_VAR|IS_VAR) == IS_CONST) {
+				CACHE_POLYMORPHIC_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce, retval);
+			}
+		} else {
+			retval = &EG(uninitialized_zval);
 		}

 		zval_ptr_dtor_nogc(free_op1);
@@ -42829,9 +42913,13 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_

 				/* check if static properties were destoyed */
 				if (UNEXPECTED(CE_STATIC_MEMBERS(ce) == NULL)) {
-					zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));
-					zval_ptr_dtor_nogc(free_op1);
-					HANDLE_EXCEPTION();
+					if (type == BP_VAR_IS) {
+						retval = &EG(uninitialized_zval);
+					} else {
+						zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));
+						zval_ptr_dtor_nogc(free_op1);
+						HANDLE_EXCEPTION();
+					}
 				}

 				goto fetch_var_return;
@@ -42853,15 +42941,19 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_

 				/* check if static properties were destoyed */
 				if (UNEXPECTED(CE_STATIC_MEMBERS(ce) == NULL)) {
-					zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));
-					zval_ptr_dtor_nogc(free_op1);
-					HANDLE_EXCEPTION();
+					if (type == BP_VAR_IS) {
+						retval = &EG(uninitialized_zval);
+					} else {
+						zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));
+						zval_ptr_dtor_nogc(free_op1);
+						HANDLE_EXCEPTION();
+					}
 				}

 				goto fetch_var_return;
 			}
 		}
-		retval = zend_std_get_static_property(ce, name, 0);
+		retval = zend_std_get_static_property(ce, name, type == BP_VAR_IS);
 		if (UNEXPECTED(EG(exception))) {
 			if ((IS_TMP_VAR|IS_VAR) != IS_CONST) {
 				zend_string_release(name);
@@ -42869,8 +42961,12 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_
 			zval_ptr_dtor_nogc(free_op1);
 			HANDLE_EXCEPTION();
 		}
-		if ((IS_TMP_VAR|IS_VAR) == IS_CONST && retval) {
-			CACHE_POLYMORPHIC_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce, retval);
+		if (EXPECTED(retval)) {
+			if ((IS_TMP_VAR|IS_VAR) == IS_CONST) {
+				CACHE_POLYMORPHIC_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce, retval);
+			}
+		} else {
+			retval = &EG(uninitialized_zval);
 		}

 		zval_ptr_dtor_nogc(free_op1);
@@ -43240,9 +43336,13 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_

 				/* check if static properties were destoyed */
 				if (UNEXPECTED(CE_STATIC_MEMBERS(ce) == NULL)) {
-					zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));
-					zval_ptr_dtor_nogc(free_op1);
-					HANDLE_EXCEPTION();
+					if (type == BP_VAR_IS) {
+						retval = &EG(uninitialized_zval);
+					} else {
+						zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));
+						zval_ptr_dtor_nogc(free_op1);
+						HANDLE_EXCEPTION();
+					}
 				}

 				goto fetch_var_return;
@@ -43264,15 +43364,19 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_

 				/* check if static properties were destoyed */
 				if (UNEXPECTED(CE_STATIC_MEMBERS(ce) == NULL)) {
-					zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));
-					zval_ptr_dtor_nogc(free_op1);
-					HANDLE_EXCEPTION();
+					if (type == BP_VAR_IS) {
+						retval = &EG(uninitialized_zval);
+					} else {
+						zend_throw_error(NULL, "Access to undeclared static property: %s::$%s", ZSTR_VAL(ce->name), ZSTR_VAL(name));
+						zval_ptr_dtor_nogc(free_op1);
+						HANDLE_EXCEPTION();
+					}
 				}

 				goto fetch_var_return;
 			}
 		}
-		retval = zend_std_get_static_property(ce, name, 0);
+		retval = zend_std_get_static_property(ce, name, type == BP_VAR_IS);
 		if (UNEXPECTED(EG(exception))) {
 			if ((IS_TMP_VAR|IS_VAR) != IS_CONST) {
 				zend_string_release(name);
@@ -43280,8 +43384,12 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_fetch_var_address_helper_SPEC_
 			zval_ptr_dtor_nogc(free_op1);
 			HANDLE_EXCEPTION();
 		}
-		if ((IS_TMP_VAR|IS_VAR) == IS_CONST && retval) {
-			CACHE_POLYMORPHIC_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce, retval);
+		if (EXPECTED(retval)) {
+			if ((IS_TMP_VAR|IS_VAR) == IS_CONST) {
+				CACHE_POLYMORPHIC_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce, retval);
+			}
+		} else {
+			retval = &EG(uninitialized_zval);
 		}

 		zval_ptr_dtor_nogc(free_op1);
@@ -2337,15 +2337,13 @@ AC_DEFUN([PHP_SETUP_OPENSSL],[

  dnl If pkg-config is found try using it
  if test "$PHP_OPENSSL_DIR" = "yes" && test -x "$PKG_CONFIG" && $PKG_CONFIG --exists openssl; then
-    if $PKG_CONFIG --atleast-version=1.1 openssl; then
-      AC_MSG_ERROR([OpenSSL version >= 1.1 is not supported.])
-    elif $PKG_CONFIG --atleast-version=0.9.8 openssl; then
+    if $PKG_CONFIG --atleast-version=0.9.8 openssl; then
      found_openssl=yes
      OPENSSL_LIBS=`$PKG_CONFIG --libs openssl`
      OPENSSL_INCS=`$PKG_CONFIG --cflags-only-I openssl`
      OPENSSL_INCDIR=`$PKG_CONFIG --variable=includedir openssl`
    else
-      AC_MSG_ERROR([OpenSSL version >= 0.9.8 and < 1.1 required.])
+      AC_MSG_ERROR([OpenSSL version 0.9.8 or greater required.])
    fi

    if test -n "$OPENSSL_LIBS"; then
@@ -2689,7 +2687,7 @@ EOF
  done

  echo "'[$]0' \\" >> $1
-  if test `expr -- [$]0 : "'.*"` = 0; then
+  if test `expr " [$]0" : " '.*"` = 0; then
    CONFIGURE_COMMAND="$CONFIGURE_COMMAND '[$]0'"
  else 
    CONFIGURE_COMMAND="$CONFIGURE_COMMAND [$]0"
@@ -29,5 +29,8 @@ if not exist "%SDK_RUNNER%" (
 	exit /b 3
 )

-call %SDK_RUNNER% -t %APPVEYOR_BUILD_FOLDER%\appveyor\build_task.bat
+cmd /c %SDK_RUNNER% -t %APPVEYOR_BUILD_FOLDER%\appveyor\build_task.bat
+if %errorlevel% neq 0 exit /b 3
+
+exit /b 0

@@ -19,10 +19,17 @@ set STABILITY=staging
 set DEPS_DIR=%PHP_BUILD_CACHE_BASE_DIR%\deps-%BRANCH%-%PHP_SDK_VC%-%PHP_SDK_ARCH%
 rem SDK is cached, deps info is cached as well
 echo Updating dependencies in %DEPS_DIR%
-call phpsdk_deps --update --branch %BRANCH% --stability %STABILITY% --deps %DEPS_DIR%
+cmd /c phpsdk_deps --update --no-backup --branch %BRANCH% --stability %STABILITY% --deps %DEPS_DIR%
 if %errorlevel% neq 0 exit /b 3

-call buildconf.bat --force
+rem Something went wrong, most likely when concurrent builds were to fetch deps
+rem updates. It might be, that some locking mechanism is needed.
+if not exist "%DEPS_DIR%" (
+	cmd /c phpsdk_deps --update --force --no-backup --branch %BRANCH% --stability %STABILITY% --deps %DEPS_DIR%
+)
+if %errorlevel% neq 0 exit /b 3
+
+cmd /c buildconf.bat --force
 if %errorlevel% neq 0 exit /b 3

 if "%THREAD_SAFE%" equ "0" set ADD_CONF=--disable-zts
@@ -30,7 +37,7 @@ if "%THREAD_SAFE%" equ "0" set ADD_CONF=--disable-zts
 set EXT_EXCLUDE_FROM_TEST=snmp,oci8_12c,pdo_oci,pdo_odbc,odbc,pdo_firebird,interbase,ldap,imap,dba
 if "%OPCACHE%" equ "0" set EXT_EXCLUDE_FROM_TEST=%EXT_EXCLUDE_FROM_TEST%,opcache

-call configure.bat ^
+cmd /c configure.bat ^
 	--enable-snapshot-build ^
 	--disable-debug-pack ^
 	--with-mcrypt=shared ^
@@ -6,5 +6,8 @@ if not exist "%SDK_RUNNER%" (
 	exit /b 3
 )

-call %SDK_RUNNER% -t %APPVEYOR_BUILD_FOLDER%\appveyor\test_task.bat
+cmd /c %SDK_RUNNER% -t %APPVEYOR_BUILD_FOLDER%\appveyor\test_task.bat
+if %errorlevel% neq 0 exit /b 3
+
+exit /b 0

@@ -12,6 +12,10 @@ if /i "%APPVEYOR_REPO_BRANCH:~0,4%" equ "php-" (
 	set STABILITY=staging
 )
 set DEPS_DIR=%PHP_BUILD_CACHE_BASE_DIR%\deps-%BRANCH%-%PHP_SDK_VC%-%PHP_SDK_ARCH%
+if not exist "%DEPS_DIR%" (
+	echo "%DEPS_DIR%" doesn't exist
+	exit /b 3
+)

 rem setup MySQL related exts
 set MYSQL_PWD=Password12!
@@ -25,6 +29,7 @@ set PDO_MYSQL_TEST_HOST=%MYSQL_TEST_HOST%
 set PDO_MYSQL_TEST_PORT=%MYSQL_TEST_PORT%
 set PDO_MYSQL_TEST_DSN=mysql:host=%PDO_MYSQL_TEST_HOST% port=%PDO_MYSQL_TEST_PORT% dbname=test user=%PDO_MYSQL_TEST_USER% password=%MYSQL_PW%
 "C:\Program Files\MySql\MySQL Server 5.7\bin\mysql.exe" --user=%MYSQL_TEST_USER% -e "CREATE DATABASE IF NOT EXISTS test"
+if %errorlevel% neq 0 exit /b 3

 rem setup PostgreSQL related exts
 set PGUSER=postgres
@@ -33,12 +38,15 @@ rem set PGSQL_TEST_CONNSTR=host=127.0.0.1 dbname=test port=5432 user=postgres pa
 echo ^<?php $conn_str = "host=127.0.0.1 dbname=test port=5432 user=%PGUSER% password=%PGPASSWORD%"; ?^> >> "./ext/pgsql/tests/config.inc"
 set PDO_PGSQL_TEST_DSN=pgsql:host=127.0.0.1 port=5432 dbname=test user=%PGUSER% password=%PGPASSWORD%
 "C:\Program Files\PostgreSQL\9.5\bin\createdb.exe" test
+if %errorlevel% neq 0 exit /b 3

 rem prepare for ext/openssl
 if "%APPVEYOR%" equ "True" rmdir /s /q C:\OpenSSL-Win32 >NUL 2>NUL
 if "%APPVEYOR%" equ "True" rmdir /s /q C:\OpenSSL-Win64 >NUL 2>NUL
 mkdir c:\usr\local\ssl
+if %errorlevel% neq 0 exit /b 3
 copy %DEPS_DIR%\template\ssl\openssl.cnf c:\usr\local\ssl
+if %errorlevel% neq 0 exit /b 3
 set OPENSSL_CONF=c:\usr\local\ssl\openssl.cnf
 rem set OPENSSL_CONF=
 rem set SSLEAY_CONF=
@@ -48,9 +56,13 @@ if "%OPCACHE%" equ "1" set OPCACHE_OPTS=-d opcache.enabled=1 -d opcache.enable_c

 rem prepare for enchant
 mkdir c:\enchant_plugins
+if %errorlevel% neq 0 exit /b 3
 copy %DEPS_DIR%\bin\libenchant_ispell.dll c:\enchant_plugins
+if %errorlevel% neq 0 exit /b 3
 copy %DEPS_DIR%\bin\libenchant_myspell.dll c:\enchant_plugins
+if %errorlevel% neq 0 exit /b 3
 reg add HKEY_CURRENT_USER\SOFTWARE\Enchant\Config /v Module_Dir /t REG_SZ /d c:\enchant_plugins
+if %errorlevel% neq 0 exit /b 3
 set PHP_BUILD_CACHE_ENCHANT_DICT_DIR=%PHP_BUILD_CACHE_BASE_DIR%\enchant_dict
 if not exist "%PHP_BUILD_CACHE_ENCHANT_DICT_DIR%" (
 	echo Creating %PHP_BUILD_CACHE_ENCHANT_DICT_DIR%
@@ -73,3 +85,5 @@ mkdir c:\tests_tmp
 cd "%APPVEYOR_BUILD_FOLDER%"
 nmake test TESTS="%OPCACHE_OPTS% -q --offline --show-diff --set-timeout 120 -g FAIL,XFAIL,BORK,WARN,LEAK,SKIP --temp-source c:\tests_tmp --temp-target c:\tests_tmp"

+exit /b %errorlevel%
+
@@ -119,8 +119,8 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=0
-PHP_RELEASE_VERSION=18
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=22
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -494,6 +494,7 @@ limits.h \
 locale.h \
 monetary.h \
 netdb.h \
+poll.h \
 pwd.h \
 resolv.h \
 signal.h \
@@ -1,4 +1,4 @@
-#if PHP_WIN32
+#ifdef PHP_WIN32
 #include "../../../../main/config.w32.h"
 #else
 #include <php_config.h>
@@ -899,7 +899,7 @@ datefull         = day ([ \t.-])* monthtext ([ \t.-])* year;
 datenoday        = monthtext ([ .\t-])* year4;
 datenodayrev     = year4 ([ .\t-])* monthtext;
 datetextual      = monthtext ([ .\t-])* day [,.stndrh\t ]+ year;
-datenoyear       = monthtext ([ .\t-])* day [,.stndrh\t ]*;
+datenoyear       = monthtext ([ .\t-])* day ([,.stndrh\t ]+|[\000]);
 datenoyearrev    = day ([ .\t-])* monthtext;
 datenocolon      = year4 monthlz daylz;

@@ -339,7 +339,7 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_timezone_transitions_get, 0, 0, 1)
 	ZEND_ARG_INFO(0, timestamp_end)
 ZEND_END_ARG_INFO()

-ZEND_BEGIN_ARG_INFO(arginfo_timezone_method_transitions_get, 0)
+ZEND_BEGIN_ARG_INFO_EX(arginfo_timezone_method_transitions_get, 0, 0, 0)
 	ZEND_ARG_INFO(0, timestamp_begin)
 	ZEND_ARG_INFO(0, timestamp_end)
 ZEND_END_ARG_INFO()
@@ -764,6 +764,11 @@ PHP_RSHUTDOWN_FUNCTION(date)
 */
 #define DATE_FORMAT_RFC1123  "D, d M Y H:i:s O"

+/*
+ * RFC7231, Section 7.1.1: http://tools.ietf.org/html/rfc7231
+ */
+#define DATE_FORMAT_RFC7231  "D, d M Y H:i:s \\G\\M\\T"
+
 /*
 * RFC2822, Section 3.3: http://www.ietf.org/rfc/rfc2822.txt
 *  FWS             =       ([*WSP CRLF] 1*WSP) /   ; Folding white space
@@ -857,6 +862,7 @@ PHP_MINIT_FUNCTION(date)
 	REGISTER_STRING_CONSTANT("DATE_RFC850",  DATE_FORMAT_RFC850,  CONST_CS | CONST_PERSISTENT);
 	REGISTER_STRING_CONSTANT("DATE_RFC1036", DATE_FORMAT_RFC1036, CONST_CS | CONST_PERSISTENT);
 	REGISTER_STRING_CONSTANT("DATE_RFC1123", DATE_FORMAT_RFC1123, CONST_CS | CONST_PERSISTENT);
+	REGISTER_STRING_CONSTANT("DATE_RFC7231", DATE_FORMAT_RFC7231, CONST_CS | CONST_PERSISTENT);
 	REGISTER_STRING_CONSTANT("DATE_RFC2822", DATE_FORMAT_RFC2822, CONST_CS | CONST_PERSISTENT);
 	REGISTER_STRING_CONSTANT("DATE_RFC3339", DATE_FORMAT_RFC3339, CONST_CS | CONST_PERSISTENT);
 	REGISTER_STRING_CONSTANT("DATE_RFC3339_EXTENDED", DATE_FORMAT_RFC3339_EXTENDED, CONST_CS | CONST_PERSISTENT);
@@ -1980,7 +1986,7 @@ static int date_interval_has_property(zval *object, zval *member, int type, void
 	zval *prop;
 	int retval = 0;

-	if (Z_TYPE_P(member) != IS_STRING) {
+	if (UNEXPECTED(Z_TYPE_P(member) != IS_STRING)) {
 		ZVAL_COPY(&tmp_member, member);
 		convert_to_string(&tmp_member);
 		member = &tmp_member;
@@ -1996,10 +2002,10 @@ static int date_interval_has_property(zval *object, zval *member, int type, void
 		}
 		return retval;
 	}
-
-	prop = date_interval_read_property(object, member, type, cache_slot, &rv);
-
-	if (prop != NULL) {
+	
+	prop = date_interval_read_property(object, member, BP_VAR_IS, cache_slot, &rv);
+	
+	if (prop != &EG(uninitialized_zval)) {
 		if (type == 2) {
 			retval = 1;
 		} else if (type == 1) {
@@ -2050,6 +2056,7 @@ static void date_register_classes(void) /* {{{ */
 	REGISTER_DATE_CLASS_CONST_STRING("RFC850",           DATE_FORMAT_RFC850);
 	REGISTER_DATE_CLASS_CONST_STRING("RFC1036",          DATE_FORMAT_RFC1036);
 	REGISTER_DATE_CLASS_CONST_STRING("RFC1123",          DATE_FORMAT_RFC1123);
+	REGISTER_DATE_CLASS_CONST_STRING("RFC7231",          DATE_FORMAT_RFC7231);
 	REGISTER_DATE_CLASS_CONST_STRING("RFC2822",          DATE_FORMAT_RFC2822);
 	REGISTER_DATE_CLASS_CONST_STRING("RFC3339",          DATE_FORMAT_RFC3339);
 	REGISTER_DATE_CLASS_CONST_STRING("RFC3339_EXTENDED", DATE_FORMAT_RFC3339_EXTENDED);
@@ -156,7 +156,7 @@ array(18) {
  }
 }
 ..and get names of all its class constants
-array(12) {
+array(13) {
  ["ATOM"]=>
  string(13) "Y-m-d\TH:i:sP"
  ["COOKIE"]=>
@@ -171,6 +171,8 @@ array(12) {
  string(16) "D, d M y H:i:s O"
  ["RFC1123"]=>
  string(16) "D, d M Y H:i:s O"
+  ["RFC7231"]=>
+  string(21) "D, d M Y H:i:s \G\M\T"
  ["RFC2822"]=>
  string(16) "D, d M Y H:i:s O"
  ["RFC3339"]=>
@@ -0,0 +1,11 @@
+--TEST--
+Bug #74080 Provide an RFC7231 date time format
+--FILE--
+<?php
+
+$date = mktime(17, 52, 13, 4, 30, 2016);
+var_dump(date(\DateTime::RFC7231, $date));
+
+?>
+--EXPECTF--
+string(29) "Sat, 30 Apr 2016 17:52:13 GMT"
@@ -0,0 +1,17 @@
+--TEST--
+Bug #74852 property_exists returns true on unknown DateInterval property
+--FILE--
+<?php
+
+$interval = new DateInterval('P2D');
+var_dump(property_exists($interval,'abcde'));
+var_dump(isset($interval->abcde));
+var_dump($interval->abcde);
+
+?>
+--EXPECTF--
+bool(false)
+bool(false)
+
+Notice: Undefined property: DateInterval::$abcde in %s on line %d
+NULL
@@ -34,14 +34,14 @@ foreach ( $tests as $start => $data )
 echo "\n";
 ?>
 --EXPECT--
-Sat, 23 Oct 2010 00:00:00 +0000
+Fri, 15 Oct 2010 23:00:00 +0000
 Wed, 15 Dec 2010 16:15:00 +0000
 Mon, 20 Dec 2010 00:00:00 +0000
 Mon, 20 Dec 2010 10:00:00 +0000
 Tue, 21 Dec 2010 12:00:00 +0000
 Mon, 03 Jan 2011 00:00:00 +0000
 Mon, 03 Jan 2011 09:00:00 +0000
-Sat, 23 Oct 2010 00:00:00 +0100
+Fri, 15 Oct 2010 23:00:00 +0100
 Sun, 28 Mar 2010 00:15:00 +0000
 Sun, 28 Mar 2010 02:15:00 +0100
 Sun, 28 Mar 2010 02:15:00 +0100
@@ -10,12 +10,12 @@ date.timezone=UTC
 $location = timezone_location_get(new DateTimeZone("Europe/Oslo"));
 var_dump($location);
 ?>
--EXPECT--
+--EXPECTF--
 array(4) {
  ["country_code"]=>
  string(2) "NO"
  ["latitude"]=>
-  float(59.91666)
+  float(59.9166%d)
  ["longitude"]=>
  float(10.75)
  ["comments"]=>
@@ -49,7 +49,7 @@ ZEND_END_ARG_INFO();
 ZEND_BEGIN_ARG_INFO_EX(arginfo_dom_node_has_child_nodes, 0, 0, 0)
 ZEND_END_ARG_INFO();

-ZEND_BEGIN_ARG_INFO_EX(arginfo_dom_node_clone_node, 0, 0, 1)
+ZEND_BEGIN_ARG_INFO_EX(arginfo_dom_node_clone_node, 0, 0, 0)
 	ZEND_ARG_INFO(0, deep)
 ZEND_END_ARG_INFO();

@@ -337,6 +337,8 @@ int dom_node_node_value_write(dom_object *obj, zval *newval)
 		case XML_ATTRIBUTE_NODE:
 			if (nodep->children) {
 				node_list_unlink(nodep->children);
+				php_libxml_node_free_list((xmlNodePtr) nodep->children);
+				nodep->children = NULL;
 			}
 		case XML_TEXT_NODE:
 		case XML_COMMENT_NODE:
@@ -854,6 +856,14 @@ int dom_node_text_content_write(dom_object *obj, zval *newval)
 		return FAILURE;
 	}

+	if (nodep->type == XML_ELEMENT_NODE || nodep->type == XML_ATTRIBUTE_NODE) {
+		if (nodep->children) {
+			node_list_unlink(nodep->children);
+			php_libxml_node_free_list((xmlNodePtr) nodep->children);
+			nodep->children = NULL;
+		}
+	}
+
 	str = zval_get_string(newval);
 	/* we have to use xmlNodeAddContent() to get the same behavior as with xmlNewText() */
 	xmlNodeSetContent(nodep, (xmlChar *) "");
@@ -0,0 +1,15 @@
+--TEST--
+Bug #69373 References to deleted XPath query results
+--FILE--
+<?php
+$doc = new DOMDocument();
+for( $i=0; $i<20; $i++ ) {
+	$doc->loadXML("<parent><child /><child /></parent>");
+	$xpath = new DOMXpath($doc);
+	$all = $xpath->query('//*');
+	$doc->firstChild->nodeValue = '';
+}
+echo 'DONE', PHP_EOL;
+?>
+--EXPECT--
+DONE
@@ -0,0 +1,21 @@
+--TEST--
+Bug #74416 Wrong reflection on DOMNode::cloneNode
+--SKIPIF--
+<?php
+require_once('skipif.inc');
+if (!extension_loaded('reflection')) die('skip reflection extension not available');
+?>
+--FILE--
+<?php
+$rm = new ReflectionMethod(DOMNode::class, "cloneNode");
+printf("%d\n%d\n", $rm->getNumberOfParameters(), $rm->getNumberOfRequiredParameters());
+foreach ($rm->getParameters() as $param) {
+    printf("Parameter #%d %s OPTIONAL\n", $param->getPosition(), $param->isOptional() ? "IS" : "IS NOT");
+}
+?>
+===DONE===
+--EXPECT--
+1
+0
+Parameter #0 IS OPTIONAL
+===DONE===
@@ -1,6 +1,6 @@
 diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
--- libmagic.orig/apprentice.c	2016-01-25 11:31:21.473017702 +0800
-+++ libmagic/apprentice.c	2016-01-25 11:41:58.210723599 +0800
+--- libmagic.orig/apprentice.c	2017-04-10 11:41:09.731268025 +0800
+++ libmagic/apprentice.c	2017-04-10 11:43:17.272811417 +0800
@@ -29,6 +29,8 @@
  * apprentice - make one pass through /etc/magic, learning its secrets.
  */
@@ -49,7 +49,18 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 
 #ifndef SSIZE_MAX
 #define MAXMAGIC_SIZE        ((ssize_t)0x7fffffff)
-@@ -168,38 +173,7 @@
+@@ -75,6 +80,10 @@
+ #endif
+ #endif
+ 
+#ifndef offsetof
+#define offsetof(STRUCTURE,FIELD) ((int)((char*)&((STRUCTURE*)0)->FIELD))
+#endif
+
+ #ifndef MAP_FAILED
+ #define MAP_FAILED (void *) -1
+ #endif
+@@ -168,38 +177,7 @@
 	{ NULL, 0, NULL }
 };
 
@@ -89,7 +100,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 
 struct type_tbl_s {
 	const char name[16];
-@@ -281,6 +255,10 @@
+@@ -281,6 +259,10 @@
 # undef XX
 # undef XX_NULL
 
@@ -100,7 +111,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 private int
 get_type(const struct type_tbl_s *tbl, const char *l, const char **t)
 {
-@@ -405,7 +383,7 @@
+@@ -405,7 +387,7 @@
 	struct mlist *ml;
 
 	mlp->map = idx == 0 ? map : NULL;
@@ -109,7 +120,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 		return -1;
 
 	ml->map = NULL;
-@@ -426,10 +404,8 @@
+@@ -426,10 +408,8 @@
 apprentice_1(struct magic_set *ms, const char *fn, int action)
 {
 	struct magic_map *map;
@@ -120,7 +131,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 
 	if (magicsize != FILE_MAGICSIZE) {
 		file_error(ms, 0, "magic element size %lu != %lu",
-@@ -445,12 +421,13 @@
+@@ -445,12 +425,13 @@
 		return apprentice_compile(ms, map, fn);
 	}
 
@@ -138,7 +149,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 		if (map == NULL)
 			return -1;
 	}
-@@ -458,7 +435,8 @@
+@@ -458,7 +439,8 @@
 	for (i = 0; i < MAGIC_SETS; i++) {
 		if (add_mlist(ms->mlist[i], map, i) == -1) {
 			file_oomem(ms, sizeof(*ml));
@@ -148,7 +159,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 		}
 	}
 
-@@ -472,15 +450,6 @@
+@@ -472,15 +454,6 @@
 		}
 	}
 	return 0;
@@ -164,7 +175,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 }
 
 protected void
-@@ -491,10 +460,16 @@
+@@ -491,10 +464,16 @@
 		return;
 	for (i = 0; i < MAGIC_SETS; i++)
 		mlist_free(ms->mlist[i]);
@@ -185,7 +196,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 }
 
 protected struct magic_set *
-@@ -503,7 +478,7 @@
+@@ -503,7 +482,7 @@
 	struct magic_set *ms;
 	size_t i, len;
 
@@ -194,7 +205,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 	    sizeof(struct magic_set)))) == NULL)
 		return NULL;
 
-@@ -515,7 +490,7 @@
+@@ -515,7 +494,7 @@
 	ms->o.buf = ms->o.pbuf = NULL;
 	len = (ms->c.len = 10) * sizeof(*ms->c.li);
 
@@ -203,7 +214,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 		goto free;
 
 	ms->event_flags = 0;
-@@ -531,7 +506,7 @@
+@@ -531,7 +510,7 @@
 	ms->elf_notes_max = FILE_ELF_NOTES_MAX;
 	return ms;
 free:
@@ -212,7 +223,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 	return NULL;
 }
 
-@@ -540,30 +515,26 @@
+@@ -540,30 +519,26 @@
 {
 	if (map == NULL)
 		return;
@@ -256,7 +267,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 		return NULL;
 	}
 	mlist->next = mlist->prev = mlist;
-@@ -582,61 +553,12 @@
+@@ -582,61 +557,12 @@
 	for (ml = mlist->next; (next = ml->next) != NULL; ml = next) {
 		if (ml->map)
 			apprentice_unmap(ml->map);
@@ -319,7 +330,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 /* const char *fn: list of magic files and directories */
 protected int
 file_apprentice(struct magic_set *ms, const char *fn, int action)
-@@ -648,12 +570,28 @@
+@@ -648,12 +574,28 @@
 	if (ms->mlist[0] != NULL)
 		file_reset(ms);
 
@@ -349,7 +360,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 		file_oomem(ms, strlen(fn));
 		return -1;
 	}
-@@ -666,7 +604,7 @@
+@@ -666,7 +608,7 @@
 				mlist_free(ms->mlist[i]);
 				ms->mlist[i] = NULL;
 			}
@@ -358,7 +369,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 			return -1;
 		}
 	}
-@@ -683,7 +621,7 @@
+@@ -683,7 +625,7 @@
 		fn = p;
 	}
 
@@ -367,7 +378,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 
 	if (errs == -1) {
 		for (i = 0; i < MAGIC_SETS; i++) {
-@@ -1062,7 +1000,7 @@
+@@ -1062,7 +1004,7 @@
 
 		mset[i].max += ALLOC_INCR;
 		if ((mp = CAST(struct magic_entry *,
@@ -376,7 +387,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 		    NULL) {
 			file_oomem(ms, sizeof(*mp) * mset[i].max);
 			return -1;
-@@ -1083,13 +1021,19 @@
+@@ -1083,13 +1025,19 @@
 load_1(struct magic_set *ms, int action, const char *fn, int *errs,
    struct magic_entry_set *mset)
 {
@@ -400,7 +411,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 		if (errno != ENOENT)
 			file_error(ms, errno, "cannot read magic file `%s'",
 				   fn);
-@@ -1099,8 +1043,7 @@
+@@ -1099,8 +1047,7 @@
 
 	memset(&me, 0, sizeof(me));
 	/* read and parse this file */
@@ -410,7 +421,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 		if (len == 0) /* null line, garbage, etc */
 			continue;
 		if (line[len - 1] == '\n') {
-@@ -1158,8 +1101,8 @@
+@@ -1158,8 +1105,8 @@
 	}
 	if (me.mp)
 		(void)addentry(ms, &me, mset);
@@ -421,7 +432,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 }
 
 /*
-@@ -1238,7 +1181,7 @@
+@@ -1238,7 +1185,7 @@
 		mentrycount += me[i].cont_count;
 
 	slen = sizeof(**ma) * mentrycount;
@@ -430,7 +441,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 		file_oomem(ms, slen);
 		return -1;
 	}
-@@ -1260,8 +1203,8 @@
+@@ -1260,8 +1207,8 @@
 	if (me == NULL)
 		return;
 	for (i = 0; i < nme; i++)
@@ -441,7 +452,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 }
 
 private struct magic_map *
-@@ -1270,18 +1213,19 @@
+@@ -1270,18 +1217,19 @@
 	int errs = 0;
 	uint32_t i, j;
 	size_t files = 0, maxfiles = 0;
@@ -466,7 +477,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 	{
 		file_oomem(ms, sizeof(*map));
 		return NULL;
-@@ -1292,22 +1236,26 @@
+@@ -1292,22 +1240,26 @@
 		(void)fprintf(stderr, "%s\n", usg_hdr);
 
 	/* load directory or file */
@@ -501,7 +512,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 				continue;
 			}
 			if (files >= maxfiles) {
-@@ -1315,23 +1263,22 @@
+@@ -1315,23 +1267,22 @@
 				maxfiles = (maxfiles + 1) * 2;
 				mlen = maxfiles * sizeof(*filearr);
 				if ((filearr = CAST(char **,
@@ -531,7 +542,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 	} else
 		load_1(ms, action, fn, &errs, mset);
 	if (errs)
-@@ -1796,7 +1743,7 @@
+@@ -1796,7 +1747,7 @@
 		if (me->cont_count == me->max_count) {
 			struct magic *nm;
 			size_t cnt = me->max_count + ALLOC_CHUNK;
@@ -540,7 +551,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 			    sizeof(*nm) * cnt))) == NULL) {
 				file_oomem(ms, sizeof(*nm) * cnt);
 				return -1;
-@@ -1811,7 +1758,7 @@
+@@ -1811,7 +1762,7 @@
 		static const size_t len = sizeof(*m) * ALLOC_CHUNK;
 		if (me->mp != NULL)
 			return 1;
@@ -549,7 +560,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 			file_oomem(ms, len);
 			return -1;
 		}
-@@ -1984,7 +1931,7 @@
+@@ -1984,7 +1935,7 @@
 				m->type = get_standard_integer_type(l, &l);
 			else if (*l == 's' && !isalpha((unsigned char)l[1])) {
 				m->type = FILE_STRING;
@@ -558,7 +569,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 			}
 		}
 	}
-@@ -2005,7 +1952,7 @@
+@@ -2005,7 +1956,7 @@
 
 	m->mask_op = 0;
 	if (*l == '~') {
@@ -567,7 +578,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 			m->mask_op |= FILE_OPINVERSE;
 		else if (ms->flags & MAGIC_CHECK)
 			file_magwarn(ms, "'~' invalid for string types");
-@@ -2014,7 +1961,7 @@
+@@ -2014,7 +1965,7 @@
 	m->str_range = 0;
 	m->str_flags = m->type == FILE_PSTRING ? PSTRING_1_LE : 0;
 	if ((op = get_op(*l)) != -1) {
@@ -576,7 +587,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 			int r;
 
 			if (op != FILE_OPDIVIDE) {
-@@ -2119,11 +2066,6 @@
+@@ -2119,11 +2070,6 @@
 		if (check_format(ms, m) == -1)
 			return -1;
 	}
@@ -588,7 +599,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 	m->mimetype[0] = '\0';		/* initialise MIME type to none */
 	return 0;
 }
-@@ -2195,7 +2137,7 @@
+@@ -2195,7 +2141,7 @@
 
 private int
 parse_extra(struct magic_set *ms, struct magic_entry *me, const char *line,
@@ -597,7 +608,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 {
 	size_t i;
 	const char *l = line;
-@@ -2264,7 +2206,7 @@
+@@ -2264,7 +2210,7 @@
 	struct magic *m = &me->mp[0];
 
 	return parse_extra(ms, me, line,
@@ -606,7 +617,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 	    sizeof(m->mimetype), "MIME", "+-/.", 1);
 }
 
-@@ -2517,14 +2459,18 @@
+@@ -2517,14 +2463,18 @@
 			return -1;
 		}
 		if (m->type == FILE_REGEX) {
@@ -632,7 +643,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 		}
 		return 0;
 	case FILE_FLOAT:
-@@ -2854,68 +2800,144 @@
+@@ -2854,68 +2804,144 @@
 private struct magic_map *
 apprentice_map(struct magic_set *ms, const char *fn)
 {
@@ -745,9 +756,10 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 +		file_error(ms, 0, "File %d.%d supports only version %d magic "
 +		    "files. `%s' is version %d", FILE_VERSION_MAJOR, patchlevel,
 +		    VERSIONNO, dbname, version);
-+		goto error;
+ 		goto error;
 +	}
-+
+ 
+-	free(dbname);
 +	/* php_magic_database is a const, performing writes will segfault. This is for big-endian
 +	machines only, PPC and Sparc specifically. Consider static variable or MINIT in
 +	future. */
@@ -780,13 +792,12 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 +	if (NULL != fn && entries != nentries + 1) {
 +		file_error(ms, 0, "Inconsistent entries in `%s' %u != %u",
 +		    dbname, entries, nentries + 1);
- 		goto error;
+		goto error;
 +	}
 +	if (needsbyteswap)
 +		for (i = 0; i < MAGIC_SETS; i++)
 +			byteswap(map->magic[i], map->nmagic[i]);
- 
-	free(dbname);
+
 +	if (dbname) {
 +		efree(dbname);
 +	}
@@ -806,7 +817,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 	return NULL;
 }
 
-@@ -2942,7 +2964,7 @@
+@@ -2942,7 +2968,7 @@
 		version = ptr[1];
 	if (version != VERSIONNO) {
 		file_error(ms, 0, "File %s supports only version %d magic "
@@ -815,7 +826,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 		    VERSIONNO, dbname, version);
 		return -1;
 	}
-@@ -2983,7 +3005,6 @@
+@@ -2983,7 +3009,6 @@
 {
 	static const size_t nm = sizeof(*map->nmagic) * MAGIC_SETS;
 	static const size_t m = sizeof(**map->magic);
@@ -823,7 +834,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 	size_t len;
 	char *dbname;
 	int rv = -1;
-@@ -2992,14 +3013,18 @@
+@@ -2992,14 +3017,18 @@
 		struct magic m;
 		uint32_t h[2 + MAGIC_SETS];
 	} hdr;
@@ -846,7 +857,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 		file_error(ms, errno, "cannot open `%s'", dbname);
 		goto out;
 	}
-@@ -3008,24 +3033,25 @@
+@@ -3008,24 +3037,25 @@
 	hdr.h[1] = VERSIONNO;
 	memcpy(hdr.h + 2, map->nmagic, nm);
 
@@ -877,7 +888,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 	return rv;
 }
 
-@@ -3059,16 +3085,18 @@
+@@ -3059,16 +3089,18 @@
 	q++;
 	/* Compatibility with old code that looked in .mime */
 	if (ms->flags & MAGIC_MIME) {
@@ -902,7 +913,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 
 	/* Compatibility with old code that looked in .mime */
 	if (strstr(p, ".mime") != NULL)
-@@ -3158,7 +3186,7 @@
+@@ -3158,7 +3190,7 @@
 	m->offset = swap4((uint32_t)m->offset);
 	m->in_offset = swap4((uint32_t)m->in_offset);
 	m->lineno = swap4((uint32_t)m->lineno);
@@ -912,8 +923,8 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 		m->str_flags = swap4(m->str_flags);
 	}
 diff -u libmagic.orig/ascmagic.c libmagic/ascmagic.c
--- libmagic.orig/ascmagic.c	2016-01-25 11:31:21.495017704 +0800
-+++ libmagic/ascmagic.c	2016-01-25 11:31:32.676017695 +0800
+--- libmagic.orig/ascmagic.c	2017-04-10 11:41:09.737268025 +0800
+++ libmagic/ascmagic.c	2017-04-10 11:41:14.411268021 +0800
@@ -139,7 +139,7 @@
 		/* malloc size is a conservative overestimate; could be
 		   improved, or at least realloced after conversion. */
@@ -934,8 +945,8 @@ diff -u libmagic.orig/ascmagic.c libmagic/ascmagic.c
 	return rv;
 }
 diff -u libmagic.orig/cdf.c libmagic/cdf.c
--- libmagic.orig/cdf.c	2016-01-25 11:31:21.472017703 +0800
-+++ libmagic/cdf.c	2016-01-25 11:31:32.676017695 +0800
+--- libmagic.orig/cdf.c	2017-04-10 11:41:09.731268025 +0800
+++ libmagic/cdf.c	2017-04-10 11:41:14.411268021 +0800
@@ -35,7 +35,7 @@
 #include "file.h"
 
@@ -1101,8 +1112,8 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
 #ifdef CDF_DEBUG
 		else
 diff -u libmagic.orig/cdf.h libmagic/cdf.h
--- libmagic.orig/cdf.h	2016-01-25 11:31:21.493017704 +0800
-+++ libmagic/cdf.h	2016-01-25 11:31:32.676017695 +0800
+--- libmagic.orig/cdf.h	2017-04-10 11:41:09.737268025 +0800
+++ libmagic/cdf.h	2017-04-10 11:41:14.412268021 +0800
@@ -35,10 +35,12 @@
 #ifndef _H_CDF_
 #define _H_CDF_
@@ -1131,8 +1142,8 @@ diff -u libmagic.orig/cdf.h libmagic/cdf.h
 void cdf_swap_header(cdf_header_t *);
 void cdf_unpack_header(cdf_header_t *, char *);
 diff -u libmagic.orig/cdf_time.c libmagic/cdf_time.c
--- libmagic.orig/cdf_time.c	2016-01-25 11:31:21.494017704 +0800
-+++ libmagic/cdf_time.c	2016-01-25 11:31:32.676017695 +0800
+--- libmagic.orig/cdf_time.c	2017-04-10 11:41:09.737268025 +0800
+++ libmagic/cdf_time.c	2017-04-10 11:41:14.412268021 +0800
@@ -96,7 +96,7 @@
 }
 
@@ -1182,8 +1193,8 @@ diff -u libmagic.orig/cdf_time.c libmagic/cdf_time.c
 	static const cdf_timestamp_t tst = 0x01A5E403C2D59C00ULL;
 	static const char *ref = "Sat Apr 23 01:30:00 1977";
 diff -u libmagic.orig/compress.c libmagic/compress.c
--- libmagic.orig/compress.c	2016-01-25 11:31:21.483017704 +0800
-+++ libmagic/compress.c	2016-01-25 11:31:32.676017695 +0800
+--- libmagic.orig/compress.c	2017-04-10 11:41:09.732268025 +0800
+++ libmagic/compress.c	2017-04-10 11:41:14.412268021 +0800
@@ -32,10 +32,11 @@
  *	uncompress(method, old, n, newch) - uncompress old into new, 
  *					    using method, return sizeof new
@@ -1382,8 +1393,8 @@ diff -u libmagic.orig/compress.c libmagic/compress.c
 -#endif
 +#endif /* if PHP_FILEINFO_UNCOMPRESS */
 diff -u libmagic.orig/elfclass.h libmagic/elfclass.h
--- libmagic.orig/elfclass.h	2016-01-25 11:31:21.471017705 +0800
-+++ libmagic/elfclass.h	2016-01-25 11:31:32.677017695 +0800
+--- libmagic.orig/elfclass.h	2017-04-10 11:41:09.731268025 +0800
+++ libmagic/elfclass.h	2017-04-10 11:41:14.412268021 +0800
@@ -41,7 +41,7 @@
 			return toomany(ms, "program headers", phnum);
 		flags |= FLAGS_IS_CORE;
@@ -1412,8 +1423,8 @@ diff -u libmagic.orig/elfclass.h libmagic/elfclass.h
 		    fsize, elf_getu16(swap, elfhdr.e_machine),
 		    (int)elf_getu16(swap, elfhdr.e_shstrndx),
 diff -u libmagic.orig/file.h libmagic/file.h
--- libmagic.orig/file.h	2016-01-25 11:31:21.472017703 +0800
-+++ libmagic/file.h	2016-01-25 11:31:32.677017695 +0800
+--- libmagic.orig/file.h	2017-04-10 11:41:09.731268025 +0800
+++ libmagic/file.h	2017-04-10 11:41:14.412268021 +0800
@@ -33,11 +33,9 @@
 #ifndef __file_h__
 #define __file_h__
@@ -1633,8 +1644,8 @@ diff -u libmagic.orig/file.h libmagic/file.h
 #define __RCSID(a)
 #endif
 diff -u libmagic.orig/fsmagic.c libmagic/fsmagic.c
--- libmagic.orig/fsmagic.c	2016-01-25 11:31:21.471017705 +0800
-+++ libmagic/fsmagic.c	2016-01-25 11:31:32.677017695 +0800
+--- libmagic.orig/fsmagic.c	2017-04-10 11:41:09.730268025 +0800
+++ libmagic/fsmagic.c	2017-04-10 11:41:14.413268021 +0800
@@ -63,27 +63,21 @@
 # define minor(dev)  ((dev) & 0xff)
 #endif
@@ -1985,8 +1996,8 @@ diff -u libmagic.orig/fsmagic.c libmagic/fsmagic.c
 	return ret;
 }
 diff -u libmagic.orig/funcs.c libmagic/funcs.c
--- libmagic.orig/funcs.c	2016-01-25 11:31:21.483017704 +0800
-+++ libmagic/funcs.c	2016-01-25 11:41:34.164723619 +0800
+--- libmagic.orig/funcs.c	2017-04-10 11:41:09.732268025 +0800
+++ libmagic/funcs.c	2017-04-10 11:41:14.413268021 +0800
@@ -31,7 +31,6 @@
 #endif	/* lint */
 
@@ -2217,7 +2228,7 @@ diff -u libmagic.orig/funcs.c libmagic/funcs.c
 	{
@@ -403,8 +405,8 @@
 	if (level >= ms->c.len) {
- 		len = (ms->c.len += 20) * sizeof(*ms->c.li);
+ 		len = (ms->c.len = 20 + level) * sizeof(*ms->c.li);
 		ms->c.li = CAST(struct level_info *, (ms->c.li == NULL) ?
 -		    malloc(len) :
 -		    realloc(ms->c.li, len));
@@ -2370,9 +2381,10 @@ diff -u libmagic.orig/funcs.c libmagic/funcs.c
 	return buf;
 }
 +
+Common subdirectories: libmagic.orig/.libs and libmagic/.libs
 diff -u libmagic.orig/magic.c libmagic/magic.c
--- libmagic.orig/magic.c	2016-01-25 11:31:21.495017704 +0800
-+++ libmagic/magic.c	2016-01-25 11:31:32.677017695 +0800
+--- libmagic.orig/magic.c	2017-04-10 11:41:09.737268025 +0800
+++ libmagic/magic.c	2017-04-10 11:41:14.413268021 +0800
@@ -25,11 +25,6 @@
  * SUCH DAMAGE.
  */
@@ -2761,8 +2773,8 @@ diff -u libmagic.orig/magic.c libmagic/magic.c
 public const char *
 magic_error(struct magic_set *ms)
 diff -u libmagic.orig/magic.h libmagic/magic.h
--- libmagic.orig/magic.h	2016-01-25 11:31:21.471017705 +0800
-+++ libmagic/magic.h	2016-01-25 11:31:32.677017695 +0800
+--- libmagic.orig/magic.h	2017-04-10 11:41:09.731268025 +0800
+++ libmagic/magic.h	2017-04-10 11:41:14.413268021 +0800
@@ -88,6 +88,7 @@
 
 const char *magic_getpath(const char *, int);
@@ -2780,8 +2792,8 @@ diff -u libmagic.orig/magic.h libmagic/magic.h
 int magic_errno(magic_t);
 
 diff -u libmagic.orig/patchlevel.h libmagic/patchlevel.h
--- libmagic.orig/patchlevel.h	2016-01-25 11:31:21.473017702 +0800
-+++ libmagic/patchlevel.h	2016-01-25 11:31:32.678017695 +0800
+--- libmagic.orig/patchlevel.h	2017-04-10 11:41:09.731268025 +0800
+++ libmagic/patchlevel.h	2017-04-10 11:41:14.414268021 +0800
@@ -1,34 +1,43 @@
 #define	FILE_VERSION_MAJOR	5
 -#define	patchlevel		6
@@ -2846,8 +2858,8 @@ diff -u libmagic.orig/patchlevel.h libmagic/patchlevel.h
  * Revision 1.69  2008/07/02 15:27:05  christos
  * welcome to 4.25
 diff -u libmagic.orig/print.c libmagic/print.c
--- libmagic.orig/print.c	2016-01-25 11:31:21.495017704 +0800
-+++ libmagic/print.c	2016-01-25 11:31:32.678017695 +0800
+--- libmagic.orig/print.c	2017-04-10 11:41:09.738268025 +0800
+++ libmagic/print.c	2017-04-10 11:41:14.414268021 +0800
@@ -28,13 +28,17 @@
 /*
  * print.c - debugging printout routines
@@ -3119,8 +3131,8 @@ diff -u libmagic.orig/print.c libmagic/print.c
 	if (tm == NULL)
 		goto out;
 diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
--- libmagic.orig/readcdf.c	2016-01-25 11:31:21.493017704 +0800
-+++ libmagic/readcdf.c	2016-01-25 11:31:32.678017695 +0800
+--- libmagic.orig/readcdf.c	2017-04-10 11:41:09.737268025 +0800
+++ libmagic/readcdf.c	2017-04-10 11:41:14.414268021 +0800
@@ -26,15 +26,21 @@
 #include "file.h"
 
@@ -3245,8 +3257,8 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
 #ifdef CDF_DEBUG
 	cdf_dump_catalog(&h, &scn);
 diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
--- libmagic.orig/softmagic.c	2016-01-25 11:31:21.471017705 +0800
-+++ libmagic/softmagic.c	2016-01-25 11:44:35.541684679 +0800
+--- libmagic.orig/softmagic.c	2017-04-10 11:41:09.730268025 +0800
+++ libmagic/softmagic.c	2017-04-10 11:41:14.414268021 +0800
@@ -36,11 +36,19 @@
 #endif	/* lint */
 
@@ -3669,8 +3681,8 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 	}
 	case FILE_INDIRECT:
 diff -u libmagic.orig/strcasestr.c libmagic/strcasestr.c
--- libmagic.orig/strcasestr.c	2016-01-25 11:31:21.494017704 +0800
-+++ libmagic/strcasestr.c	2016-01-25 11:31:32.678017695 +0800
+--- libmagic.orig/strcasestr.c	2017-04-10 11:41:09.737268025 +0800
+++ libmagic/strcasestr.c	2017-04-10 11:41:14.415268021 +0800
@@ -39,6 +39,8 @@
 
 #include "file.h"
@@ -80,6 +80,10 @@ FILE_RCSID("@(#)$File: apprentice.c,v 1.230 2015/01/02 21:29:39 christos Exp $")
 #endif
 #endif

+#ifndef offsetof
+#define offsetof(STRUCTURE,FIELD) ((int)((char*)&((STRUCTURE*)0)->FIELD))
+#endif
+
 #ifndef MAP_FAILED
 #define MAP_FAILED (void *) -1
 #endif
@@ -325,7 +325,7 @@ dnl Various checks for GD features
  PHP_GD_FREETYPE2

 dnl Header path
-  for i in include/gd include gd ""; do
+  for i in include/gd include/gd2 include gd ""; do
    test -f "$PHP_GD/$i/gd.h" && GD_INCLUDE="$PHP_GD/$i"
  done

@@ -39,7 +39,7 @@
 #include "php.h"

 /* This just seems unessacary */
-#if PHP_WIN32
+#ifdef PHP_WIN32
 #define ENABLE_GD_TTF
 #else
 #include <php_config.h>
@@ -147,6 +147,9 @@ gdImagePtr gdImageCreateFromGifCtx(gdIOCtxPtr fd) /* {{{ */
 	int haveGlobalColormap;
 	gdImagePtr im = 0;

+	memset(ColorMap, 0, 3 * MAXCOLORMAPSIZE);
+	memset(localColorMap, 0, 3 * MAXCOLORMAPSIZE);
+
 	/*1.4//imageNumber = 1; */
 	if (! ReadOK(fd,buf,6)) {
 		return 0;
@@ -0,0 +1,27 @@
+--TEST--
+Bug #74435 (Buffer over-read into uninitialized memory)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$im = imagecreatefromgif(__DIR__ . DIRECTORY_SEPARATOR . 'bug74435.gif');
+var_dump($im);
+$width = imagesx($im);
+$height = imagesy($im);
+for ($i = 0; $i < $width; $i += 16) {
+    for ($j = 0; $j < $height; $j += 16) {
+        if (($index = imagecolorat($im, $i, $j)) >= 2) {
+            list($red, $green, $blue, $alpha) = array_values(imagecolorsforindex($im, $index));
+            if ($red !== 0 || $green !== 0 || $blue !== 0 || $alpha !== 0) {
+                echo "unexpected color at ($i, $j)\n";
+            }
+        }
+    }
+}
+?>
+===DONE===
+--EXPECTF--
+resource(%d) of type (gd)
+===DONE===
@@ -30,7 +30,6 @@ if test "$PHP_GETTEXT" != "no"; then
 		AC_MSG_ERROR(Unable to find required gettext library)
 	])
  )
-  LDFLAGS=$O_LDFLAGS

  AC_DEFINE(HAVE_LIBINTL,1,[ ])
  PHP_NEW_EXTENSION(gettext, gettext.c, $ext_shared)
@@ -46,5 +45,6 @@ if test "$PHP_GETTEXT" != "no"; then
  AC_CHECK_LIB($GETTEXT_CHECK_IN_LIB, dngettext,  [AC_DEFINE(HAVE_DNGETTEXT, 1, [ ])])
  AC_CHECK_LIB($GETTEXT_CHECK_IN_LIB, dcngettext,  [AC_DEFINE(HAVE_DCNGETTEXT, 1, [ ])])
  AC_CHECK_LIB($GETTEXT_CHECK_IN_LIB, bind_textdomain_codeset,  [AC_DEFINE(HAVE_BIND_TEXTDOMAIN_CODESET, 1, [ ])])
+  LDFLAGS=$O_LDFLAGS
  
 fi
@@ -95,6 +95,10 @@ ZEND_BEGIN_ARG_INFO_EX( collator_sort_args, 0, 0, 1 )
 	ZEND_ARG_INFO( 0, flags )
 ZEND_END_ARG_INFO()

+ZEND_BEGIN_ARG_INFO_EX( collator_sort_with_sort_keys_args, 0, 0, 1 )
+	ZEND_ARG_ARRAY_INFO( 1, arr, 0 )
+ZEND_END_ARG_INFO()
+
 /* }}} */

 /* {{{ Collator_class_functions
@@ -106,7 +110,7 @@ zend_function_entry Collator_class_functions[] = {
 	ZEND_FENTRY( create, ZEND_FN( collator_create ), collator_1_arg, ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
 	PHP_NAMED_FE( compare, ZEND_FN( collator_compare ), collator_2_args )
 	PHP_NAMED_FE( sort, ZEND_FN( collator_sort ), collator_sort_args )
-	PHP_NAMED_FE( sortWithSortKeys, ZEND_FN( collator_sort_with_sort_keys ), collator_sort_args )
+	PHP_NAMED_FE( sortWithSortKeys, ZEND_FN( collator_sort_with_sort_keys ), collator_sort_with_sort_keys_args )
 	PHP_NAMED_FE( asort, ZEND_FN( collator_asort ), collator_sort_args )
 	PHP_NAMED_FE( getAttribute, ZEND_FN( collator_get_attribute ), collator_1_arg )
 	PHP_NAMED_FE( setAttribute, ZEND_FN( collator_set_attribute ), collator_2_args )
@@ -115,7 +119,7 @@ zend_function_entry Collator_class_functions[] = {
 	PHP_NAMED_FE( getLocale, ZEND_FN( collator_get_locale ), collator_1_arg )
 	PHP_NAMED_FE( getErrorCode, ZEND_FN( collator_get_error_code ), collator_0_args )
 	PHP_NAMED_FE( getErrorMessage, ZEND_FN( collator_get_error_message ), collator_0_args )
-	PHP_NAMED_FE( getSortKey, ZEND_FN( collator_get_sort_key ), collator_2_args )
+	PHP_NAMED_FE( getSortKey, ZEND_FN( collator_get_sort_key ), collator_1_arg )
 	PHP_FE_END
 };
 /* }}} */
@@ -110,7 +110,8 @@ PHP_FUNCTION(grapheme_strpos)
 	size_t haystack_len, needle_len;
 	const char *found;
 	zend_long loffset = 0;
-	int32_t offset = 0, noffset = 0;
+	int32_t offset = 0;
+	size_t noffset = 0;
 	zend_long ret_pos;

 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "ss|l", &haystack, &haystack_len, &needle, &needle_len, &loffset) == FAILURE) {
@@ -38,26 +38,34 @@ zend_class_entry *Locale_ce_ptr = NULL;
 ZEND_BEGIN_ARG_INFO_EX( locale_0_args, 0, 0, 0 )
 ZEND_END_ARG_INFO()

-ZEND_BEGIN_ARG_INFO_EX( locale_1_arg, 0, 0, 1 )
-	ZEND_ARG_INFO( 0, arg1 )
+ZEND_BEGIN_ARG_INFO_EX( locale_arg_locale, 0, 0, 1 )
+	ZEND_ARG_INFO( 0, locale )
 ZEND_END_ARG_INFO()

-ZEND_BEGIN_ARG_INFO_EX( locale_2_args, 0, 0, 2 )
-	ZEND_ARG_INFO( 0, arg1 )
-	ZEND_ARG_INFO( 0, arg2 )
+ZEND_BEGIN_ARG_INFO_EX( locale_accept_from_http_args, 0, 0, 1 )
+	ZEND_ARG_INFO( 0, header )
 ZEND_END_ARG_INFO()

-ZEND_BEGIN_ARG_INFO_EX( locale_3_args, 0, 0, 3 )
-        ZEND_ARG_INFO( 0, arg1 )
-        ZEND_ARG_INFO( 0, arg2 )
-        ZEND_ARG_INFO( 0, arg3 )
+ZEND_BEGIN_ARG_INFO_EX( locale_compose_args, 0, 0, 1 )
+	ZEND_ARG_INFO( 0, subtags )
 ZEND_END_ARG_INFO()

-ZEND_BEGIN_ARG_INFO_EX( locale_4_args, 0, 0, 4 )
-        ZEND_ARG_INFO( 0, arg1 )
-        ZEND_ARG_INFO( 0, arg2 )
-        ZEND_ARG_INFO( 0, arg3 )
-        ZEND_ARG_INFO( 0, arg4 )
+ZEND_BEGIN_ARG_INFO_EX( locale_2_args, 0, 0, 1 )
+	ZEND_ARG_INFO( 0, locale )
+	ZEND_ARG_INFO( 0, in_locale )
+ZEND_END_ARG_INFO()
+
+ZEND_BEGIN_ARG_INFO_EX( locale_filter_matches_args, 0, 0, 2 )
+        ZEND_ARG_INFO( 0, langtag )
+        ZEND_ARG_INFO( 0, locale )
+        ZEND_ARG_INFO( 0, canonicalize )
+ZEND_END_ARG_INFO()
+
+ZEND_BEGIN_ARG_INFO_EX( locale_lookup_args, 0, 0, 2 )
+        ZEND_ARG_INFO( 0, langtag )
+        ZEND_ARG_INFO( 0, locale )
+        ZEND_ARG_INFO( 0, canonicalize )
+        ZEND_ARG_INFO( 0, default )
 ZEND_END_ARG_INFO()

 /* }}} */
@@ -68,23 +76,23 @@ ZEND_END_ARG_INFO()

 zend_function_entry Locale_class_functions[] = {
 	ZEND_FENTRY( getDefault, zif_locale_get_default , locale_0_args , ZEND_ACC_PUBLIC|ZEND_ACC_STATIC  )
-	ZEND_FENTRY( setDefault, zif_locale_set_default , locale_1_arg , ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
-	ZEND_FENTRY( getPrimaryLanguage, ZEND_FN( locale_get_primary_language ), locale_1_arg , ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
-	ZEND_FENTRY( getScript, ZEND_FN( locale_get_script ), locale_1_arg , ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
-	ZEND_FENTRY( getRegion, ZEND_FN( locale_get_region ), locale_1_arg , ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
-	ZEND_FENTRY( getKeywords, ZEND_FN( locale_get_keywords ), locale_1_arg , ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
+	ZEND_FENTRY( setDefault, zif_locale_set_default , locale_arg_locale , ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
+	ZEND_FENTRY( getPrimaryLanguage, ZEND_FN( locale_get_primary_language ), locale_arg_locale , ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
+	ZEND_FENTRY( getScript, ZEND_FN( locale_get_script ), locale_arg_locale , ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
+	ZEND_FENTRY( getRegion, ZEND_FN( locale_get_region ), locale_arg_locale , ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
+	ZEND_FENTRY( getKeywords, ZEND_FN( locale_get_keywords ), locale_arg_locale , ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
 	ZEND_FENTRY( getDisplayScript, ZEND_FN( locale_get_display_script ), locale_2_args , ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
 	ZEND_FENTRY( getDisplayRegion, ZEND_FN( locale_get_display_region ), locale_2_args , ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
 	ZEND_FENTRY( getDisplayName, ZEND_FN( locale_get_display_name ), locale_2_args , ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
 	ZEND_FENTRY( getDisplayLanguage, ZEND_FN( locale_get_display_language ), locale_2_args , ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
 	ZEND_FENTRY( getDisplayVariant, ZEND_FN( locale_get_display_variant ), locale_2_args , ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
-	ZEND_FENTRY( composeLocale, ZEND_FN( locale_compose ), locale_1_arg , ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
-	ZEND_FENTRY( parseLocale, ZEND_FN( locale_parse ), locale_1_arg , ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
-	ZEND_FENTRY( getAllVariants, ZEND_FN( locale_get_all_variants ), locale_1_arg , ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
-	ZEND_FENTRY( filterMatches, ZEND_FN( locale_filter_matches ), locale_3_args, ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
-	ZEND_FENTRY( lookup, ZEND_FN( locale_lookup ), locale_4_args, ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
-	ZEND_FENTRY( canonicalize, ZEND_FN( locale_canonicalize ), locale_1_arg , ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
-	ZEND_FENTRY( acceptFromHttp, ZEND_FN( locale_accept_from_http ), locale_1_arg , ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
+	ZEND_FENTRY( composeLocale, ZEND_FN( locale_compose ), locale_compose_args , ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
+	ZEND_FENTRY( parseLocale, ZEND_FN( locale_parse ), locale_arg_locale , ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
+	ZEND_FENTRY( getAllVariants, ZEND_FN( locale_get_all_variants ), locale_arg_locale , ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
+	ZEND_FENTRY( filterMatches, ZEND_FN( locale_filter_matches ), locale_filter_matches_args, ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
+	ZEND_FENTRY( lookup, ZEND_FN( locale_lookup ), locale_lookup_args, ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
+	ZEND_FENTRY( canonicalize, ZEND_FN( locale_canonicalize ), locale_arg_locale , ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
+	ZEND_FENTRY( acceptFromHttp, ZEND_FN( locale_accept_from_http ), locale_accept_from_http_args , ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
 	PHP_FE_END
 };
 /* }}} */
@@ -110,6 +110,7 @@ PHP_FUNCTION( msgfmt_parse_message )
 		RETURN_FALSE;
 	}

+	INTL_CHECK_LOCALE_LEN(slocale_len);
 	memset(mfo, 0, sizeof(*mfo));
 	msgformat_data_init(&mfo->mf_data);

@@ -29,10 +29,9 @@ zend_class_entry *Normalizer_ce_ptr = NULL;

 /* {{{ Normalizer methods arguments info */

-ZEND_BEGIN_ARG_INFO_EX( normalizer_3_args, 0, 0, 3 )
-	ZEND_ARG_INFO( 0, arg1 )
-	ZEND_ARG_INFO( 0, arg2 )
-	ZEND_ARG_INFO( 0, arg3 )
+ZEND_BEGIN_ARG_INFO_EX( normalizer_args, 0, 0, 1 )
+	ZEND_ARG_INFO( 0, input )
+	ZEND_ARG_INFO( 0, form )
 ZEND_END_ARG_INFO()

 /* }}} */
@@ -42,8 +41,8 @@ ZEND_END_ARG_INFO()
 */

 zend_function_entry Normalizer_class_functions[] = {
-	ZEND_FENTRY( normalize, ZEND_FN( normalizer_normalize ), normalizer_3_args, ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
-	ZEND_FENTRY( isNormalized, ZEND_FN( normalizer_is_normalized ), normalizer_3_args, ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
+	ZEND_FENTRY( normalize, ZEND_FN( normalizer_normalize ), normalizer_args, ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
+	ZEND_FENTRY( isNormalized, ZEND_FN( normalizer_is_normalized ), normalizer_args, ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
 	PHP_FE_END
 };
 /* }}} */
@@ -159,6 +159,11 @@ ZEND_BEGIN_ARG_INFO_EX(collator_sort_args, 0, 0, 2)
 	ZEND_ARG_INFO(0, sort_flags)
 ZEND_END_ARG_INFO()

+ZEND_BEGIN_ARG_INFO_EX(collator_sort_with_sort_keys_args, 0, 0, 2)
+	ZEND_ARG_OBJ_INFO(0, coll, Collator, 0)
+	ZEND_ARG_ARRAY_INFO(1, arr, 0)
+ZEND_END_ARG_INFO()
+
 ZEND_BEGIN_ARG_INFO_EX(numfmt_parse_arginfo, 0, 0, 2)
 	ZEND_ARG_INFO(0, formatter)
 	ZEND_ARG_INFO(0, string)
@@ -645,12 +650,12 @@ zend_function_entry intl_functions[] = {
 	PHP_FE( collator_get_strength, collator_0_args )
 	PHP_FE( collator_set_strength, collator_1_arg )
 	PHP_FE( collator_sort, collator_sort_args )
-	PHP_FE( collator_sort_with_sort_keys, collator_sort_args )
+	PHP_FE( collator_sort_with_sort_keys, collator_sort_with_sort_keys_args )
 	PHP_FE( collator_asort, collator_sort_args )
 	PHP_FE( collator_get_locale, collator_1_arg )
 	PHP_FE( collator_get_error_code, collator_0_args )
 	PHP_FE( collator_get_error_message, collator_0_args )
-	PHP_FE( collator_get_sort_key, collator_2_args )
+	PHP_FE( collator_get_sort_key, collator_1_arg )

 	/* formatter functions */
 	PHP_FE( numfmt_create, arginfo_numfmt_create )
@@ -0,0 +1,20 @@
+--TEST--
+Bug #74433 Wrong reflection on the Normalizer methods
+--SKIPIF--
+<?php if (!extension_loaded('intl')) die('skip intl extension not available'); ?>
+--FILE--
+<?php
+$rm = new ReflectionMethod(Normalizer::class, 'isNormalized');
+var_dump($rm->getNumberOfParameters());
+var_dump($rm->getNumberOfRequiredParameters());
+$rm = new ReflectionMethod(Normalizer::class, 'normalize');
+var_dump($rm->getNumberOfParameters());
+var_dump($rm->getNumberOfRequiredParameters());
+?>
+===DONE===
+--EXPECT--
+int(2)
+int(1)
+int(2)
+int(1)
+===DONE===
@@ -0,0 +1,22 @@
+--TEST--
+Bug #74468 Wrong reflection on Collator::sortWithSortKeys
+--SKIPIF--
+<?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?>
+<?php if (version_compare(INTL_ICU_VERSION, '51.2') >=  0) die('skip for ICU < 51.2'); ?>
+--FILE--
+<?php
+$rm = new ReflectionMethod(Collator::class, 'sortWithSortKeys');
+var_dump($rm->getNumberOfParameters());
+var_dump($rm->getNumberOfRequiredParameters());
+
+$rf = new ReflectionFunction('collator_sort_with_sort_keys');
+var_dump($rf->getNumberOfParameters());
+var_dump($rf->getNumberOfRequiredParameters());
+?>
+===DONE===
+--EXPECT--
+int(1)
+int(1)
+int(2)
+int(2)
+===DONE===
@@ -0,0 +1,21 @@
+--TEST--
+Bug #74705 Wrong reflection on Collator::getSortKey
+--SKIPIF--
+<?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?>
+--FILE--
+<?php
+$rm = new ReflectionMethod(Collator::class, 'getSortKey');
+var_dump($rm->getNumberOfParameters());
+var_dump($rm->getNumberOfRequiredParameters());
+
+$rf = new ReflectionFunction('collator_get_sort_key');
+var_dump($rf->getNumberOfParameters());
+var_dump($rf->getNumberOfRequiredParameters());
+?>
+===DONE===
+--EXPECT--
+int(1)
+int(1)
+int(2)
+int(2)
+===DONE===
@@ -0,0 +1,54 @@
+--TEST--
+Bug #74439 Wrong reflection on the Locale methods
+--SKIPIF--
+<?php if (!extension_loaded('intl')) die('skip intl extension not available'); ?>
+--FILE--
+<?php
+
+$methods = [
+'getDefault',
+'acceptFromHttp',
+'canonicalize',
+'composeLocale',
+'getAllVariants',
+'getKeywords',
+'getPrimaryLanguage',
+'getRegion',
+'getScript',
+'parseLocale',
+'setDefault',
+'getDisplayLanguage',
+'getDisplayName',
+'getDisplayRegion',
+'getDisplayScript',
+'getDisplayVariant',
+'filterMatches',
+'lookup',
+];
+
+foreach ($methods as $method) {
+    $rm = new ReflectionMethod(Locale::class, $method);
+    printf("%s: %d, %d\n", $method, $rm->getNumberOfParameters(), $rm->getNumberOfRequiredParameters());
+}
+?>
+===DONE===
+--EXPECT--
+getDefault: 0, 0
+acceptFromHttp: 1, 1
+canonicalize: 1, 1
+composeLocale: 1, 1
+getAllVariants: 1, 1
+getKeywords: 1, 1
+getPrimaryLanguage: 1, 1
+getRegion: 1, 1
+getScript: 1, 1
+parseLocale: 1, 1
+setDefault: 1, 1
+getDisplayLanguage: 2, 1
+getDisplayName: 2, 1
+getDisplayRegion: 2, 1
+getDisplayScript: 2, 1
+getDisplayVariant: 2, 1
+filterMatches: 3, 2
+lookup: 4, 2
+===DONE===
@@ -19,8 +19,8 @@ var_dump($lsb->getDisplayName(false, IntlTimeZone::DISPLAY_LONG, 'pt_PT'));

 ?>
 ==DONE==
--EXPECT--
+--EXPECTF--
 string(30) "Western European Standard Time"
 string(30) "Western European Standard Time"
-string(32) "Hora Padrão da Europa Ocidental"
+string(32) "Hora %cadrão da Europa Ocidental"
 ==DONE==
@@ -8,7 +8,7 @@ data-interchange format as specified in RFC 7159
 The parser is implemented using re2c and Bison. The used versions
 of both tools for generating files in the repository are following:

-re2c 0.14.3
+re2c 0.16
 Bison 3.0.4

 It is recommended to do all contributions to the JSON extension
@@ -1,4 +1,4 @@
-/* Generated by re2c 0.14.3 */
+/* Generated by re2c 0.16 */

 enum YYCONDTYPE {
 	yycJS,
@@ -366,7 +366,7 @@ PHP_FUNCTION(ldap_connect)
 	{
 		int rc = LDAP_SUCCESS;
 		char	*url = host;
-		if (!ldap_is_ldap_url(url)) {
+		if (url && !ldap_is_ldap_url(url)) {
 			int	urllen = hostlen + sizeof( "ldap://:65535" );

 			if (port <= 0 || port > 65535) {
@@ -376,7 +376,7 @@ PHP_FUNCTION(ldap_connect)
 			}

 			url = emalloc(urllen);
-			snprintf( url, urllen, "ldap://%s:%ld", host ? host : "", port );
+			snprintf( url, urllen, "ldap://%s:%ld", host, port );
 		}

 #ifdef LDAP_API_FEATURE_X_OPENLDAP
@@ -0,0 +1,26 @@
+--TEST--
+ldap_connect() - Connection using default host from openldap's ldap.conf
+--CREDITS--
+David Caldwell <david@galvanix.com>
+--SKIPIF--
+<?php
+require_once('skipif.inc');
+ob_start();
+phpinfo();
+if (!preg_match("/vendor name => openldap/i", ob_get_clean()))
+    die("skip not openldap");
+?>
+--FILE--
+<?php
+$conf=tempnam("/tmp","ldap.conf");
+file_put_contents($conf, "uri ldaps://example.com:3141/");
+putenv("LDAPCONF=$conf");
+$link = ldap_connect();
+ldap_get_option($link, LDAP_OPT_HOST_NAME, $host);
+var_dump($host);
+unlink($conf);
+?>
+===DONE===
+--EXPECTF--
+string(16) "example.com:3141"
+===DONE===
@@ -224,7 +224,7 @@ static void php_libxml_node_free(xmlNodePtr node)
 	}
 }

-static void php_libxml_node_free_list(xmlNodePtr node)
+PHP_LIBXML_API void php_libxml_node_free_list(xmlNodePtr node)
 {
 	xmlNodePtr curnode;

@@ -100,6 +100,7 @@ PHP_LIBXML_API int php_libxml_decrement_doc_ref(php_libxml_node_object *object);
 PHP_LIBXML_API xmlNodePtr php_libxml_import_node(zval *object);
 PHP_LIBXML_API zval *php_libxml_register_export(zend_class_entry *ce, php_libxml_export_node export_function);
 /* When an explicit freeing of node and children is required */
+PHP_LIBXML_API void php_libxml_node_free_list(xmlNodePtr node);
 PHP_LIBXML_API void php_libxml_node_free_resource(xmlNodePtr node);
 /* When object dtor is called as node may still be referenced */
 PHP_LIBXML_API void php_libxml_node_decrement_resource(php_libxml_node_object *object);
@@ -1425,14 +1425,9 @@ match_at(regex_t* reg, const UChar* str, const UChar* end,
      break;

    case OP_EXACT1:  MOP_IN(OP_EXACT1);
-#if 0
      DATA_ENSURE(1);
      if (*p != *s) goto fail;
      p++; s++;
-#endif
-      if (*p != *s++) goto fail;
-      DATA_ENSURE(0);
-      p++;
      MOP_OUT;
      break;

@@ -3128,6 +3123,8 @@ forward_search_range(regex_t* reg, const UChar* str, const UChar* end, UChar* s,
    }
    else {
      UChar *q = p + reg->dmin;
+
+      if (q >= end) return 0; /* fail */
      while (p < q) p += enclen(reg->enc, p);
    }
  }
@@ -3208,7 +3205,13 @@ forward_search_range(regex_t* reg, const UChar* str, const UChar* end, UChar* s,
    else {
      if (reg->dmax != ONIG_INFINITE_DISTANCE) {
 	*low = p - reg->dmax;
-	if (*low > s) {
+	if (p - str < reg->dmax) {
+	  *low = (UChar* )str;
+	  if (low_prev)
+	    *low_prev = onigenc_get_prev_char_head(reg->enc, str, *low);
+	}
+	else {
+ 	if (*low > s) {
 	  *low = onigenc_get_right_adjust_char_head_with_prev(reg->enc, s,
 							      *low, (const UChar** )low_prev);
 	  if (low_prev && IS_NULL(*low_prev))
@@ -3221,6 +3224,7 @@ forward_search_range(regex_t* reg, const UChar* str, const UChar* end, UChar* s,
 					       (pprev ? pprev : str), *low);
 	}
      }
+      }
    }
    /* no needs to adjust *high, *high is used as range check only */
    *high = p - reg->dmin;
@@ -3064,7 +3064,7 @@ fetch_token_in_cc(OnigToken* tok, UChar** src, UChar* end, ScanEnv* env)
 	PUNFETCH;
 	prev = p;
 	num = scan_unsigned_octal_number(&p, end, 3, enc);
-	if (num < 0) return ONIGERR_TOO_BIG_NUMBER;
+	if (num < 0 || num >= 256) return ONIGERR_TOO_BIG_NUMBER;
 	if (p == prev) {  /* can't read nothing. */
 	  num = 0; /* but, it's not error */
 	}
@@ -3436,7 +3436,7 @@ fetch_token(OnigToken* tok, UChar** src, UChar* end, ScanEnv* env)
      if (IS_SYNTAX_OP(syn, ONIG_SYN_OP_ESC_OCTAL3)) {
 	prev = p;
 	num = scan_unsigned_octal_number(&p, end, (c == '0' ? 2:3), enc);
-	if (num < 0) return ONIGERR_TOO_BIG_NUMBER;
+	if (num < 0 || num >= 256) return ONIGERR_TOO_BIG_NUMBER;
 	if (p == prev) {  /* can't read nothing. */
 	  num = 0; /* but, it's not error */
 	}
@@ -4068,7 +4068,9 @@ next_state_class(CClassNode* cc, OnigCodePoint* vs, enum CCVALTYPE* type,
    }
  }

-  *state = CCS_VALUE;
+  if (*state != CCS_START)
+    *state = CCS_VALUE;
+
  *type  = CCV_CLASS;
  return 0;
 }
@@ -4084,7 +4086,11 @@ next_state_val(CClassNode* cc, OnigCodePoint *vs, OnigCodePoint v,
  switch (*state) {
  case CCS_VALUE:
    if (*type == CCV_SB)
+    {
+    if (*vs > 0xff)
+      return ONIGERR_INVALID_CODE_POINT_VALUE;
      BITSET_SET_BIT(cc->bs, (int )(*vs));
+    }
    else if (*type == CCV_CODE_POINT) {
      r = add_code_range(&(cc->mbuf), env, *vs, *vs);
      if (r < 0) return r;
@@ -26,7 +26,7 @@

 #if HAVE_LIBMCRYPT

-#if PHP_WIN32
+#ifdef PHP_WIN32
 # include "win32/winutil.h"
 #endif

@@ -1376,7 +1376,7 @@ PHP_FUNCTION(mcrypt_create_iv)
 	iv = ecalloc(size + 1, 1);

 	if (source == RANDOM || source == URANDOM) {
-#if PHP_WIN32
+#ifdef PHP_WIN32
 		/* random/urandom equivalent on Windows */
 		BYTE *iv_b = (BYTE *) iv;
 		if (php_win32_get_random_bytes(iv_b, (size_t) size) == FAILURE){
@@ -619,7 +619,7 @@ PHP_FUNCTION(mysqli_change_user)
 	const		CHARSET_INFO * old_charset;
 #endif

-	if (zend_parse_method_parameters(ZEND_NUM_ARGS(), getThis(), "Osss", &mysql_link, mysqli_link_class_entry, &user, &user_len, &password, &password_len, &dbname, &dbname_len) == FAILURE) {
+	if (zend_parse_method_parameters(ZEND_NUM_ARGS(), getThis(), "Osss!", &mysql_link, mysqli_link_class_entry, &user, &user_len, &password, &password_len, &dbname, &dbname_len) == FAILURE) {
 		return;
 	}
 	MYSQLI_FETCH_RESOURCE_CONN(mysql, mysql_link, MYSQLI_STATUS_VALID);
@@ -0,0 +1,25 @@
+--TEST--
+Bug #74547 mysqli::change_user() doesn't accept null as $database argument w/strict_types
+--SKIPIF--
+<?php
+  require_once('skipif.inc');
+  require_once('skipifconnectfailure.inc');
+?>
+--FILE--
+<?php
+	declare(strict_types=1);
+
+	require_once("connect.inc");
+
+	if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
+		printf("[001] Cannot connect to the server using host=%s, user=%s, passwd=***, dbname=%s, port=%s, socket=%s\n",
+			$host, $user, $db, $port, $socket);
+
+	var_dump(mysqli_change_user($link, $user, $passwd, NULL));
+
+	mysqli_close($link);
+?>
+===DONE===
+--EXPECTF--
+bool(true)
+===DONE===
@@ -0,0 +1,29 @@
+--TEST--
+Bug #74432, BC issue on undocumented connect string
+--SKIPIF--
+<?php
+require_once('skipif.inc');
+require_once('skipifemb.inc');
+require_once('skipifconnectfailure.inc');
+?>
+--FILE--
+<?php
+	/* This behavior is undocumented, but might be in use. Until there's no officially
+		supported alternative, ensure changes doesn't cause BC breach. Otherwise,
+		the test should be removed once the undocumented behavior changes. */
+
+	require_once("connect.inc");
+
+	$handle = mysqli_connect("$host:$port", $user, $passwd);
+
+	var_dump($handle);
+
+	if ($handle) {
+		mysqli_close($handle);
+	}
+?>
+--EXPECTF--
+object(mysqli)#%d (%d) {
+%A
+}
+
@@ -38,7 +38,7 @@ if (!$IS_MYSQLND)

 	function poll_async($offset, $link, $links, $errors, $reject, $exp_ready, $use_oo_syntax) {

-		if ($exp_ready !== ($tmp = mysqli_poll($links, $errors, $reject, 0, 1000)))
+		if ($exp_ready !== ($tmp = mysqli_poll($links, $errors, $reject, 0, 2000)))
 			printf("[%03d + 1] There should be %d links ready to read from, %d ready\n",
 				$offset, $exp_ready, $tmp);

@@ -688,6 +688,53 @@ const MYSQLND_CHARSET mysqlnd_charsets[] =
 	{ 249, "gb18030", "gb18030_bin", 1, 4, "", mysqlnd_mbcharlen_gb18030, my_ismbchar_gb18030},

 	{ 254, UTF8_MB3, UTF8_MB3"_general_cs", 1, 3, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 255, UTF8_MB4, UTF8_MB4"_0900_ai_ci", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 256, UTF8_MB4, UTF8_MB4"_de_pb_0900_ai_ci", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 257, UTF8_MB4, UTF8_MB4"_is_0900_ai_ci", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 258, UTF8_MB4, UTF8_MB4"_lv_0900_ai_ci", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 259, UTF8_MB4, UTF8_MB4"_ro_0900_ai_ci", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 260, UTF8_MB4, UTF8_MB4"_sl_0900_ai_ci", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 261, UTF8_MB4, UTF8_MB4"_pl_0900_ai_ci", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 262, UTF8_MB4, UTF8_MB4"_et_0900_ai_ci", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 263, UTF8_MB4, UTF8_MB4"_es_0900_ai_ci", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 264, UTF8_MB4, UTF8_MB4"_sv_0900_ai_ci", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 265, UTF8_MB4, UTF8_MB4"_tr_0900_ai_ci", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 266, UTF8_MB4, UTF8_MB4"_cs_0900_ai_ci", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 267, UTF8_MB4, UTF8_MB4"_da_0900_ai_ci", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 268, UTF8_MB4, UTF8_MB4"_lt_0900_ai_ci", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 269, UTF8_MB4, UTF8_MB4"_sk_0900_ai_ci", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 270, UTF8_MB4, UTF8_MB4"_es_trad_0900_ai_ci", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 271, UTF8_MB4, UTF8_MB4"_la_0900_ai_ci", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 272, UTF8_MB4, UTF8_MB4"_fa_0900_ai_ci", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 273, UTF8_MB4, UTF8_MB4"_eo_0900_ai_ci", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 274, UTF8_MB4, UTF8_MB4"_hu_0900_ai_ci", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 275, UTF8_MB4, UTF8_MB4"_hr_0900_ai_ci", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 276, UTF8_MB4, UTF8_MB4"_si_0900_ai_ci", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 277, UTF8_MB4, UTF8_MB4"_vi_0900_ai_ci", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 278, UTF8_MB4, UTF8_MB4"_0900_as_cs", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 279, UTF8_MB4, UTF8_MB4"_de_pb_0900_as_cs", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 280, UTF8_MB4, UTF8_MB4"_is_0900_as_cs", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 281, UTF8_MB4, UTF8_MB4"_lv_0900_as_cs", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 282, UTF8_MB4, UTF8_MB4"_ro_0900_as_cs", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 283, UTF8_MB4, UTF8_MB4"_sl_0900_as_cs", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 284, UTF8_MB4, UTF8_MB4"_pl_0900_as_cs", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 285, UTF8_MB4, UTF8_MB4"_et_0900_as_cs", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 286, UTF8_MB4, UTF8_MB4"_es_0900_as_cs", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 287, UTF8_MB4, UTF8_MB4"_sv_0900_as_cs", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 288, UTF8_MB4, UTF8_MB4"_tr_0900_as_cs", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 289, UTF8_MB4, UTF8_MB4"_cs_0900_as_cs", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 290, UTF8_MB4, UTF8_MB4"_da_0900_as_cs", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 291, UTF8_MB4, UTF8_MB4"_lt_0900_as_cs", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 292, UTF8_MB4, UTF8_MB4"_sk_0900_as_cs", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 293, UTF8_MB4, UTF8_MB4"_es_trad_0900_as_cs", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 294, UTF8_MB4, UTF8_MB4"_la_0900_as_cs", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 295, UTF8_MB4, UTF8_MB4"_fa_0900_as_cs", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 296, UTF8_MB4, UTF8_MB4"_eo_0900_as_cs", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 297, UTF8_MB4, UTF8_MB4"_hu_0900_as_cs", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 298, UTF8_MB4, UTF8_MB4"_hr_0900_as_cs", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 299, UTF8_MB4, UTF8_MB4"_si_0900_as_cs", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 300, UTF8_MB4, UTF8_MB4"_vi_0900_as_cs", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
+	{ 303, UTF8_MB4, UTF8_MB4"_ja_0900_as_cs", 1, 4, "", mysqlnd_mbcharlen_utf8, check_mb_utf8_valid},
 	{   0, NULL, NULL, 0, 0, NULL, NULL, NULL}
 };
 /* }}} */
@@ -129,7 +129,7 @@ MYSQLND_METHOD(mysqlnd_stmt, store_result)(MYSQLND_STMT * const s)
 	} else {
 		COPY_CLIENT_ERROR(*conn->error_info, result->stored_data->error_info);
 		stmt->result->m.free_result_contents(stmt->result);
-		mnd_efree(stmt->result);
+		mnd_pefree(stmt->result, stmt->result->persistent);
 		stmt->result = NULL;
 		stmt->state = MYSQLND_STMT_PREPARED;
 	}
@@ -356,7 +356,7 @@ mysqlnd_stmt_prepare_read_eof(MYSQLND_STMT * s)
 		if (FAIL == (ret = PACKET_READ(fields_eof, stmt->conn))) {
 			if (stmt->result) {
 				stmt->result->m.free_result_contents(stmt->result);
-				mnd_efree(stmt->result);
+				mnd_pefree(stmt->result, stmt->result->persistent);
 				memset(stmt, 0, sizeof(MYSQLND_STMT_DATA));
 				stmt->state = MYSQLND_STMT_INITTED;
 			}
@@ -335,7 +335,7 @@ if test "$PHP_OCI8" != "no"; then

    PHP_ADD_LIBRARY(clntsh, 1, OCI8_SHARED_LIBADD)
    PHP_ADD_LIBPATH($OCI8_DIR/$OCI8_LIB_DIR, OCI8_SHARED_LIBADD)
-    PHP_NEW_EXTENSION(oci8, oci8.c oci8_lob.c oci8_statement.c oci8_collection.c oci8_interface.c, $ext_shared)
+    PHP_NEW_EXTENSION(oci8, oci8.c oci8_lob.c oci8_statement.c oci8_collection.c oci8_interface.c oci8_failover.c, $ext_shared)
    AC_DEFINE(HAVE_OCI8,1,[Defined to 1 if the PHP OCI8 extension for Oracle Database is configured])

    PHP_SUBST_OLD(OCI8_SHARED_LIBADD)
@@ -406,7 +406,7 @@ if test "$PHP_OCI8" != "no"; then

    AC_DEFINE(HAVE_OCI_INSTANT_CLIENT,1,[Defined to 1 if OCI8 configuration located Oracle's Instant Client libraries])

-    PHP_NEW_EXTENSION(oci8, oci8.c oci8_lob.c oci8_statement.c oci8_collection.c oci8_interface.c, $ext_shared)
+    PHP_NEW_EXTENSION(oci8, oci8.c oci8_lob.c oci8_statement.c oci8_collection.c oci8_interface.c oci8_failover.c, $ext_shared)
    AC_DEFINE(HAVE_OCI8,1,[Defined to 1 if the PHP OCI8 extension for Oracle Database is configured])

    PHP_SUBST_OLD(OCI8_SHARED_LIBADD)
@@ -80,7 +80,7 @@ if (PHP_OCI8_11G != "no") {
 	if (CHECK_HEADER_ADD_INCLUDE("oci.h", "CFLAGS_OCI8_11G", oci8_11g_inc_paths) &&
 			CHECK_LIB("oci.lib", "oci8_11g", oci8_11g_lib_paths))
 	{
-		EXTENSION('oci8_11g', 'oci8.c oci8_lob.c oci8_statement.c oci8_collection.c oci8_interface.c', null, null, null, "ext\\oci8_11g")
+		EXTENSION('oci8_11g', 'oci8.c oci8_lob.c oci8_statement.c oci8_collection.c oci8_interface.c oci8_failover.c', null, null, null, "ext\\oci8_11g")

 		AC_DEFINE('HAVE_OCI8', 1);
 		AC_DEFINE('HAVE_OCI_INSTANT_CLIENT', 1);
@@ -115,7 +115,7 @@ if (PHP_OCI8_12C != "no") {
 	if (CHECK_HEADER_ADD_INCLUDE("oci.h", "CFLAGS_OCI8_12C", oci8_12c_inc_paths) &&
 			CHECK_LIB("oci.lib", "oci8_12c", oci8_12c_lib_paths))
 	{
-		EXTENSION('oci8_12c', 'oci8.c oci8_lob.c oci8_statement.c oci8_collection.c oci8_interface.c', null, null, null, "ext\\oci8_12c")
+		EXTENSION('oci8_12c', 'oci8.c oci8_lob.c oci8_statement.c oci8_collection.c oci8_interface.c oci8_failover.c', null, null, null, "ext\\oci8_12c")

 		AC_DEFINE('HAVE_OCI8', 1);
 		AC_DEFINE('HAVE_OCI_INSTANT_CLIENT', 1);
@@ -504,6 +504,11 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_oci_new_collection, 0, 0, 2)
 	ZEND_ARG_INFO(0, type_name)
 	ZEND_ARG_INFO(0, schema_name)
 ZEND_END_ARG_INFO()
+
+ZEND_BEGIN_ARG_INFO_EX(arginfo_oci_register_taf_callback, 0, 0, 1)
+	ZEND_ARG_INFO(0, connection_resource)
+	ZEND_ARG_INFO(0, function_name)
+ZEND_END_ARG_INFO()
 /* }}} */

 /* {{{ LOB Method arginfo */
@@ -701,6 +706,7 @@ PHP_FUNCTION(oci_collection_assign);
 PHP_FUNCTION(oci_collection_size);
 PHP_FUNCTION(oci_collection_max);
 PHP_FUNCTION(oci_collection_trim);
+PHP_FUNCTION(oci_register_taf_callback);
 /* }}} */

 /* {{{ extension definition structures
@@ -783,6 +789,7 @@ static const zend_function_entry php_oci_functions[] = {
 	PHP_FE(oci_collection_max,			arginfo_oci_collection_max)
 	PHP_FE(oci_collection_trim,			arginfo_oci_collection_trim)
 	PHP_FE(oci_new_collection,			arginfo_oci_new_collection)
+	PHP_FE(oci_register_taf_callback,   arginfo_oci_register_taf_callback)

 	PHP_FALIAS(oci_free_cursor,		oci_free_statement,		arginfo_oci_free_statement)
 	PHP_FALIAS(ocifreecursor,		oci_free_statement,		arginfo_oci_free_statement)
@@ -1129,6 +1136,20 @@ PHP_MINIT_FUNCTION(oci)
 	REGISTER_LONG_CONSTANT("OCI_TEMP_CLOB",OCI_TEMP_CLOB, CONST_CS | CONST_PERSISTENT);
 	REGISTER_LONG_CONSTANT("OCI_TEMP_BLOB",OCI_TEMP_BLOB, CONST_CS | CONST_PERSISTENT);

+/* for Transparent Application Failover */
+	REGISTER_LONG_CONSTANT("OCI_FO_END", OCI_FO_END, CONST_CS | CONST_PERSISTENT);
+	REGISTER_LONG_CONSTANT("OCI_FO_ABORT", OCI_FO_ABORT, CONST_CS | CONST_PERSISTENT);
+	REGISTER_LONG_CONSTANT("OCI_FO_REAUTH", OCI_FO_REAUTH, CONST_CS | CONST_PERSISTENT);
+	REGISTER_LONG_CONSTANT("OCI_FO_BEGIN", OCI_FO_BEGIN, CONST_CS | CONST_PERSISTENT);
+	REGISTER_LONG_CONSTANT("OCI_FO_ERROR", OCI_FO_ERROR, CONST_CS | CONST_PERSISTENT);
+
+	REGISTER_LONG_CONSTANT("OCI_FO_NONE", OCI_FO_NONE, CONST_CS | CONST_PERSISTENT);
+	REGISTER_LONG_CONSTANT("OCI_FO_SESSION", OCI_FO_SESSION, CONST_CS | CONST_PERSISTENT);
+	REGISTER_LONG_CONSTANT("OCI_FO_SELECT", OCI_FO_SELECT, CONST_CS | CONST_PERSISTENT);
+	REGISTER_LONG_CONSTANT("OCI_FO_TXNAL", OCI_FO_TXNAL, CONST_CS | CONST_PERSISTENT);
+
+	REGISTER_LONG_CONSTANT("OCI_FO_RETRY", OCI_FO_RETRY, CONST_CS | CONST_PERSISTENT);
+
 	return SUCCESS;
 }

@@ -1930,6 +1951,7 @@ php_oci_connection *php_oci_do_connect_ex(char *username, int username_len, char
 			connection = (php_oci_connection *) ecalloc(1, sizeof(php_oci_connection));
 			connection->hash_key = zend_string_dup(hashed_details.s, 0);
 			connection->is_persistent = 0;
+			ZVAL_UNDEF(&connection->taf_callback);
 #ifdef HAVE_OCI8_DTRACE
 			connection->client_id = NULL;
 #endif
@@ -1944,6 +1966,7 @@ php_oci_connection *php_oci_do_connect_ex(char *username, int username_len, char
 				return NULL;
 			}
 			connection->is_persistent = 1;
+			ZVAL_UNDEF(&connection->taf_callback);
 #ifdef HAVE_OCI8_DTRACE
 			connection->client_id = NULL;
 #endif
@@ -1952,6 +1975,7 @@ php_oci_connection *php_oci_do_connect_ex(char *username, int username_len, char
 		connection = (php_oci_connection *) ecalloc(1, sizeof(php_oci_connection));
 		connection->hash_key = zend_string_dup(hashed_details.s, 0);
 		connection->is_persistent = 0;
+		ZVAL_UNDEF(&connection->taf_callback);
 #ifdef HAVE_OCI8_DTRACE
 		connection->client_id = NULL;
 #endif
@@ -2225,6 +2249,15 @@ static int php_oci_connection_close(php_oci_connection *connection)
 		connection->client_id = NULL;
 	}
 #endif /* HAVE_OCI8_DTRACE */
+
+	if (!Z_ISUNDEF(connection->taf_callback)) {
+		/* If it's NULL, then its value should be freed already */
+		if (!Z_ISNULL(connection->taf_callback)) {
+			zval_ptr_dtor(&connection->taf_callback);
+		}
+		ZVAL_UNDEF(&connection->taf_callback);
+	}
+
 	pefree(connection, connection->is_persistent);
 	connection = NULL;
 	OCI_G(in_call) = in_call_save;
@@ -2667,6 +2700,11 @@ static int php_oci_persistent_helper(zval *zv)
 	if (le->type == le_pconnection) {
 		connection = (php_oci_connection *)le->ptr;

+		/* Remove TAF callback function as it's bound to current request */
+		if (connection->used_this_request && !Z_ISUNDEF(connection->taf_callback) && !Z_ISNULL(connection->taf_callback)) {
+			php_oci_disable_taf_callback(connection);
+		}
+
 		if (!connection->used_this_request && OCI_G(persistent_timeout) != -1) {
 #ifdef HAVE_OCI8_DTRACE
 			if (DTRACE_OCI8_CONNECT_EXPIRY_ENABLED()) {
@@ -0,0 +1,162 @@
+/*
+   +----------------------------------------------------------------------+
+   | PHP Version 5                                                        |
+   +----------------------------------------------------------------------+
+   | Copyright (c) 1997-2016 The PHP Group                                |
+   +----------------------------------------------------------------------+
+   | This source file is subject to version 3.01 of the PHP license,      |
+   | that is bundled with this package in the file LICENSE, and is        |
+   | available through the world-wide-web at the following url:           |
+   | http://www.php.net/license/3_01.txt                                  |
+   | If you did not receive a copy of the PHP license and are unable to   |
+   | obtain it through the world-wide-web, please send a note to          |
+   | license@php.net so we can mail you a copy immediately.               |
+   +----------------------------------------------------------------------+
+   | Authors: Stig Sæther Bakken <ssb@php.net>                            |
+   |          Thies C. Arntzen <thies@thieso.net>                         |
+   |                                                                      |
+   | Collection support by Andy Sautins <asautins@veripost.net>           |
+   | Temporary LOB support by David Benson <dbenson@mancala.com>          |
+   | ZTS per process OCIPLogon by Harald Radi <harald.radi@nme.at>        |
+   |                                                                      |
+   | Redesigned by: Antony Dovgal <antony@zend.com>                       |
+   |                Andi Gutmans <andi@zend.com>                          |
+   |                Wez Furlong <wez@omniti.com>                          |
+   +----------------------------------------------------------------------+
+*/
+
+
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include "php.h"
+#include "ext/standard/info.h"
+#include "php_ini.h"
+
+#if HAVE_OCI8
+
+#include "php_oci8.h"
+#include "php_oci8_int.h"
+
+/* {{{ callback_fn() 
+   OCI TAF callback function, calling userspace function */
+sb4 callback_fn(OCISvcCtx *svchp, OCIEnv *envhp, php_oci_connection *fo_ctx, ub4 fo_type, ub4 fo_event)
+{
+	/* Create zval */
+	zval retval, params[3];
+
+	/* Default return value */
+	sb4 returnValue = 0;
+
+	/* Check if userspace callback function was disabled */
+	if (Z_ISUNDEF(fo_ctx->taf_callback) || Z_ISNULL(fo_ctx->taf_callback)) {
+		return 0;
+	}
+
+	/* Initialize zval */
+	ZVAL_RES(&params[0], fo_ctx->id);
+	ZVAL_LONG(&params[1], fo_event);
+	ZVAL_LONG(&params[2], fo_type);
+
+	/* Call user function (if possible) */
+	if (call_user_function(EG(function_table), NULL, &fo_ctx->taf_callback, &retval, 3, params) == FAILURE) {
+		php_error_docref(NULL, E_WARNING, "Unable to call taf callback function, is it defined?");
+	}
+
+	/* Set return value */
+	if (Z_TYPE(retval) == IS_LONG) {
+		returnValue = (sb4) Z_LVAL(retval);
+	}
+
+	/* Setting params[0] to null so ressource isn't destroyed on zval_dtor */
+	ZVAL_NULL(&params[0]);
+
+	/* Cleanup */
+	zval_dtor(&retval);
+	zval_dtor(&params[0]);
+	zval_dtor(&params[1]);
+	zval_dtor(&params[2]);
+
+	return returnValue;
+}
+/* }}} */
+
+/* {{{ php_oci_disable_taf_callback()
+   Disables the userspace callback function for Oracle TAF,
+   while keeping the OCI callback alive */
+int php_oci_disable_taf_callback(php_oci_connection *connection)
+{
+	return php_oci_register_taf_callback(connection, NULL);
+}
+/* }}} */
+
+/* {{{ php_oci_register_taf_callback()
+   Register a callback function for Oracle TAF */
+int php_oci_register_taf_callback(php_oci_connection *connection, zval *callback)
+{
+	sword errstatus;
+	int registered = 0;
+
+	/* temporary failover callback structure */
+	OCIFocbkStruct failover;
+
+	if (!callback) {
+		/* Disable callback */
+		if (Z_ISUNDEF(connection->taf_callback) || Z_ISNULL(connection->taf_callback)) {
+			return 0; // Nothing to disable
+		}
+
+		registered = 1;
+		zval_ptr_dtor(&connection->taf_callback);
+		ZVAL_NULL(&connection->taf_callback);
+	} else {
+		if (!Z_ISUNDEF(connection->taf_callback)) {
+			registered = 1;
+			if (!Z_ISNULL(connection->taf_callback)) {
+				zval_ptr_dtor(&connection->taf_callback);
+				ZVAL_NULL(&connection->taf_callback);
+			}
+		}
+
+		/* Set userspace callback function */
+		ZVAL_COPY(&connection->taf_callback, callback);
+	}
+
+	/* OCI callback function already registered */
+	if (registered) {
+		return 0;
+	}
+
+	/* set context */
+	failover.fo_ctx = connection;
+
+	/* set callback function */
+	failover.callback_function = &callback_fn;
+
+	/* do the registration */
+	PHP_OCI_CALL_RETURN(errstatus, OCIAttrSet, (connection->server, (ub4) OCI_HTYPE_SERVER, (void *) &failover, (ub4) 0, (ub4) OCI_ATTR_FOCBK, connection->err));
+
+	if (errstatus  != OCI_SUCCESS) {
+		zval_ptr_dtor(&connection->taf_callback);
+		ZVAL_UNDEF(&connection->taf_callback);
+		connection->errcode = php_oci_error(connection->err, errstatus);
+		return 1;
+	}
+
+	/* successful conclusion */
+	return 0;
+}
+/* }}} */
+
+#endif /* HAVE_OCI8 */
+
+/*
+ * Local variables:
+ * tab-width: 4
+ * c-basic-offset: 4
+ * End:
+ * vim600: noet sw=4 ts=4 fdm=marker
+ * vim<600: noet sw=4 ts=4
+ */
@@ -42,6 +42,39 @@
 #define OCI_STMT_CALL 10
 #endif

+/* {{{ proto bool oci_register_taf_callback( resource connection [, mixed callback] )
+   Register a callback function for Oracle Transparent Application Failover (TAF) */
+PHP_FUNCTION(oci_register_taf_callback)
+{
+	zval *z_connection;
+	php_oci_connection *connection;
+	zval *callback;
+	zend_string *callback_name;
+
+	if (zend_parse_parameters(ZEND_NUM_ARGS(), "r|z!", &z_connection, &callback) == FAILURE) {
+		return;
+	}
+
+	if (callback) {
+		if (!zend_is_callable(callback, 0, &callback_name)) {
+			php_error_docref(NULL, E_WARNING, "function '%s' is not callable", ZSTR_VAL(callback_name));
+			zend_string_release(callback_name);
+			RETURN_FALSE;
+		}
+
+		zend_string_release(callback_name);
+	}
+
+	PHP_OCI_ZVAL_TO_CONNECTION(z_connection, connection);
+
+	if (php_oci_register_taf_callback(connection, callback) == 0) {
+		RETURN_TRUE;
+	} else {
+		RETURN_FALSE;
+	}
+}
+/* }}} */
+
 /* {{{ proto bool oci_define_by_name(resource stmt, string name, mixed &var [, int type])
   Define a PHP variable to an Oracle column by name */
 /* if you want to define a LOB/CLOB etc make sure you allocate it via OCINewDescriptor BEFORE defining!!! */
@@ -1553,6 +1586,9 @@ PHP_FUNCTION(oci_close)
 											 internally Zend engine increments
 											 RefCount value by 1 */
 		zend_list_close(connection->id);
+	
+	/* Disable Oracle TAF */
+	php_oci_disable_taf_callback(connection);

 	/* ZVAL_NULL(z_connection); */
 	
@@ -38,6 +38,13 @@
 #include "php_oci8.h"
 #include "php_oci8_int.h"

+#if defined(OCI_MAJOR_VERSION) && (OCI_MAJOR_VERSION > 10) && \
+	(defined(__x86_64__) || defined(__LP64__) || defined(_LP64) || defined(_WIN64))
+typedef ub8 oci_phpsized_int;
+#else
+typedef ub4 oci_phpsized_int;
+#endif
+
 /* {{{ php_oci_statement_create()
 Create statemend handle and allocate necessary resources */
 php_oci_statement *php_oci_statement_create(php_oci_connection *connection, char *query, int query_len)
@@ -997,10 +1004,10 @@ int php_oci_bind_post_exec(zval *data)
 				for (i = 0; i < (int) bind->array.current_length; i++) {
 					if ((i < (int) bind->array.old_length) && (entry = zend_hash_get_current_data(hash)) != NULL) {
 						zval_dtor(entry);
-						ZVAL_LONG(entry, ((ub4 *)(bind->array.elements))[i]);
+						ZVAL_LONG(entry, ((oci_phpsized_int *)(bind->array.elements))[i]);
 						zend_hash_move_forward(hash);
 					} else {
-						add_next_index_long(bind->zval, ((ub4 *)(bind->array.elements))[i]);
+						add_next_index_long(bind->zval, ((oci_phpsized_int *)(bind->array.elements))[i]);
 					}
 				}
 				break;
@@ -1153,14 +1160,8 @@ int php_oci_bind_by_name(php_oci_statement *statement, char *name, size_t name_l
 				return 1;
 			}
 			convert_to_long(param);
-#if defined(OCI_MAJOR_VERSION) && (OCI_MAJOR_VERSION > 10) &&			\
-	(defined(__x86_64__) || defined(__LP64__) || defined(_LP64) || defined(_WIN64)) 
-			bind_data = (ub8 *)&Z_LVAL_P(param);
-			value_sz = sizeof(ub8);
-#else
-			bind_data = (ub4 *)&Z_LVAL_P(param);
-			value_sz = sizeof(ub4);
-#endif
+			bind_data = (oci_phpsized_int *)&Z_LVAL_P(param);
+			value_sz = sizeof(oci_phpsized_int);
 			mode = OCI_DEFAULT;
 			break;
 			
@@ -1783,10 +1784,10 @@ php_oci_bind *php_oci_bind_array_helper_number(zval *var, zend_long max_table_le

 	bind = emalloc(sizeof(php_oci_bind));
 	ZVAL_UNDEF(&bind->parameter);
-	bind->array.elements		= (ub4 *)safe_emalloc(max_table_length, sizeof(ub4), 0);
+	bind->array.elements		= (oci_phpsized_int *)safe_emalloc(max_table_length, sizeof(oci_phpsized_int), 0);
 	bind->array.current_length	= zend_hash_num_elements(Z_ARRVAL_P(var));
 	bind->array.old_length		= bind->array.current_length;
-	bind->array.max_length		= sizeof(ub4);
+	bind->array.max_length		= sizeof(oci_phpsized_int);
 	bind->array.element_lengths	= safe_emalloc(max_table_length, sizeof(ub2), 0);
 	memset(bind->array.element_lengths, 0, max_table_length * sizeof(ub2));
 	bind->array.indicators		= NULL;
@@ -1794,14 +1795,14 @@ php_oci_bind *php_oci_bind_array_helper_number(zval *var, zend_long max_table_le
 	zend_hash_internal_pointer_reset(hash);
 	for (i = 0; i < max_table_length; i++) {
 		if (i < bind->array.current_length) {
-			bind->array.element_lengths[i] = sizeof(ub4);
+			bind->array.element_lengths[i] = sizeof(oci_phpsized_int);
 		}
 		if ((i < bind->array.current_length) && (entry = zend_hash_get_current_data(hash)) != NULL) {
 			convert_to_long_ex(entry);
-			((ub4 *)bind->array.elements)[i] = (ub4) Z_LVAL_P(entry);
+			((oci_phpsized_int *)bind->array.elements)[i] = (oci_phpsized_int) Z_LVAL_P(entry);
 			zend_hash_move_forward(hash);
 		} else {
-			((ub4 *)bind->array.elements)[i] = 0;
+			((oci_phpsized_int *)bind->array.elements)[i] = 0;
 		}
 	}
 	zend_hash_internal_pointer_reset(hash);
@@ -46,12 +46,12 @@ Interoperability Support" (ID 207303.1) for details.
  <active>no</active>
 </lead>

- <date>2016-10-17</date>
+ <date>2017-06-20</date>
 <time>12:00:00</time>

  <version>
-   <release>2.1.3</release>
-   <api>2.1.3</api>
+   <release>2.1.6</release>
+   <api>2.1.6</api>
  </version>
  <stability>
   <release>stable</release>
@@ -60,7 +60,7 @@ Interoperability Support" (ID 207303.1) for details.
  <license uri="http://www.php.net/license">PHP</license>
  <notes>
 This version is for PHP 7 only.
-Fixed bug #71148 (Bind reference overwritten on PHP 7)
+Fixed bug #74625 (Integer overflow in oci_bind_array_by_name). (Ingmar Runge)
  </notes>
 <contents>
  <dir name="/">
@@ -164,6 +164,7 @@ Fixed bug #71148 (Bind reference overwritten on PHP 7)
    <file name="bug71422.phpt" role="test" />
    <file name="bug71600.phpt" role="test" />
    <file name="bug72524.phpt" role="test" />
+    <file name="bug74625.phpt" role="test" />
    <file name="clientversion.phpt" role="test" />
    <file name="close.phpt" role="test" />
    <file name="coll_001.phpt" role="test" />
@@ -447,6 +448,7 @@ Fixed bug #71148 (Bind reference overwritten on PHP 7)
   <file name="oci8_interface.c" role="src" />
   <file name="oci8_lob.c" role="src" />
   <file name="oci8_statement.c" role="src" />
+   <file name="oci8_failover.c" role="src" />
   <file name="php_oci8.h" role="src" />
   <file name="php_oci8_int.h" role="src" />
   <file name="README" role="doc" />
@@ -468,6 +470,54 @@ Fixed bug #71148 (Bind reference overwritten on PHP 7)
 </extsrcrelease>
 <changelog>

+<release>   
+ <version>
+   <release>2.1.5</release>
+   <api>2.1.5</api>
+  </version>
+  <stability>
+   <release>stable</release>
+   <api>stable</api>
+  </stability>
+  <license uri="http://www.php.net/license">PHP</license>
+  <notes>
+This version is for PHP 7 only.
+Added TAF callback support (PR #2459, KoenigsKind) 
+  </notes>
+</release>   
+
+<release>
+  <version>
+   <release>2.1.4</release>
+   <api>2.1.4</api>
+  </version>
+  <stability>
+   <release>stable</release>
+   <api>stable</api>
+  </stability>
+  <license uri="http://www.php.net/license">PHP</license>
+  <notes>
+This version is for PHP 7 only.
+Fixed uninitialized data causing random crash
+  </notes>
+</release>
+
+<release>
+  <version>
+   <release>2.1.3</release>
+   <api>2.1.3</api>
+  </version>
+  <stability>
+   <release>stable</release>
+   <api>stable</api>
+  </stability>
+  <license uri="http://www.php.net/license">PHP</license>
+  <notes>
+This version is for PHP 7 only.
+Fixed bug #71148 (Bind reference overwritten on PHP 7)
+  </notes>
+</release>
+   
 <release>
  <version>
   <release>2.1.2</release>
@@ -43,11 +43,12 @@
 */
 #undef PHP_OCI8_VERSION
 #endif
-#define PHP_OCI8_VERSION "2.1.3"
+#define PHP_OCI8_VERSION "2.1.6"

 extern zend_module_entry oci8_module_entry;
 #define phpext_oci8_ptr &oci8_module_entry
 #define phpext_oci8_11g_ptr &oci8_module_entry
+#define phpext_oci8_12c_ptr &oci8_module_entry


 PHP_MINIT_FUNCTION(oci);
@@ -164,6 +164,8 @@ typedef struct {
 #ifdef HAVE_OCI8_DTRACE
 	char		   *client_id;					/* The oci_set_client_identifier() value */
 #endif
+
+	zval		    taf_callback;				/* The Oracle TAF callback function in the userspace */
 } php_oci_connection;
 /* }}} */

@@ -531,6 +533,13 @@ ZEND_BEGIN_MODULE_GLOBALS(oci) /* {{{ Module globals */
 	char		*edition;
 ZEND_END_MODULE_GLOBALS(oci) /* }}} */

+/* {{{ transparent failover related prototypes */
+
+int php_oci_register_taf_callback(php_oci_connection *connection, zval *callback);
+int php_oci_disable_taf_callback(php_oci_connection *connection);
+
+/* }}} */
+
 #ifdef ZTS
 #define OCI_G(v) TSRMG(oci_globals_id, zend_oci_globals *, v)
 #else
@@ -0,0 +1,183 @@
+--TEST--
+Tests for LOBs with multibyte strings, reading them out in chunks
+(Doc Bug #70700)
+--CREDITS--
+Chuck Burgess
+ashnazg@php.net
+--SKIPIF--
+<?php
+if (!extension_loaded('mbstring')) die('skip mbstring is not enabled');
+$target_dbs = array('oracledb' => true, 'timesten' => false);  // test runs on these DBs
+require(dirname(__FILE__).'/skipif.inc');
+?> 
+--ENV--
+NLS_LANG=.AL32UTF8
+--FILE--
+<?php
+require(dirname(__FILE__).'/connect.inc');
+
+
+$stmt = oci_parse($c, 'DROP TABLE oci8_bug70700');
+@oci_execute($stmt);
+oci_free_statement($stmt);
+$stmt = oci_parse($c, 'CREATE TABLE oci8_bug70700 (id NUMBER, data CLOB)');
+oci_execute($stmt);
+oci_free_statement($stmt);
+
+
+$id = null;
+$insert = oci_parse($c, 'INSERT INTO oci8_bug70700 (id, data) VALUES (:id, :data)');
+oci_bind_by_name($insert, ':id', $id);
+$select = oci_parse($c, "SELECT data FROM oci8_bug70700 WHERE id = :id");
+oci_bind_by_name($select, ':id', $id);
+
+
+echo PHP_EOL, 'Test 1: j', PHP_EOL;
+$string1 = 'abc' . str_repeat('j', 1000000) . 'xyz';
+$id = 1;
+$desc = oci_new_descriptor($c, OCI_D_LOB);
+oci_bind_by_name($insert, ':data', $desc, -1, OCI_B_CLOB);
+$desc->writeTemporary($string1, OCI_TEMP_CLOB);
+oci_execute($insert);
+$desc->save($string1);
+oci_commit($c);
+$desc->close();
+oci_bind_by_name($select, ':id', $id);
+oci_execute($select);
+$row = oci_fetch_array($select, OCI_ASSOC);
+$lob = $row['DATA'];
+$fh = fopen('php://temp', 'rw');
+while (! $lob->eof()) {
+    $data = $lob->read(8192);             // read($characters), not read($bytes)
+    fwrite($fh, $data, strlen($data));    // fwrite(a, b, $bytes)
+}
+$lob->free();
+rewind($fh);
+$stream1a = stream_get_contents($fh);
+fclose($fh);
+$start1a = mb_substr($stream1a, 0, 10);
+$ending1a = mb_substr($stream1a, -10);
+echo 'size of string1 is ', strlen($string1), ' bytes, ', mb_strlen($string1), ' chars.', PHP_EOL;
+echo 'size of stream1a is ', strlen($stream1a), ' bytes, ', mb_strlen($stream1a), ' chars.', PHP_EOL;
+echo 'beg of stream1a is ', $start1a, PHP_EOL;
+echo 'end of stream1a is ', $ending1a, PHP_EOL;
+
+
+echo PHP_EOL, 'Test 2: £', PHP_EOL;
+$string2 = 'abc' . str_repeat('£', 4094) . 'xyz';
+$id = 2;
+$desc = oci_new_descriptor($c, OCI_D_LOB);
+oci_bind_by_name($insert, ':data', $desc, -1, OCI_B_CLOB);
+$desc->writeTemporary($string2, OCI_TEMP_CLOB);
+oci_execute($insert);
+$desc->save($string2);
+oci_commit($c);
+$desc->close();
+oci_bind_by_name($select, ':id', $id);
+oci_execute($select);
+$row = oci_fetch_array($select, OCI_ASSOC);
+$lob = $row['DATA'];
+$fh = fopen('php://temp', 'rw');
+while (! $lob->eof()) {
+    $data = $lob->read(8192);             // read($characters), not read($bytes)
+    fwrite($fh, $data, strlen($data));    // fwrite(a, b, $bytes)
+}
+$lob->free();
+rewind($fh);
+$stream2a = stream_get_contents($fh);
+fclose($fh);
+$start2a = mb_substr($stream2a, 0, 10);
+$ending2a = mb_substr($stream2a, -10);
+echo 'size of string2 is ', strlen($string2), ' bytes, ', mb_strlen($string2), ' chars.', PHP_EOL;
+echo 'size of stream2a is ', strlen($stream2a), ' bytes, ', mb_strlen($stream2a), ' chars.', PHP_EOL;
+echo 'beg of stream2a is ', $start2a, PHP_EOL;
+echo 'end of stream2a is ', $ending2a, PHP_EOL;
+
+
+echo PHP_EOL, 'Test 3: Җ', PHP_EOL;
+$string3 = 'abc' . str_repeat('Җ', 4094) . 'xyz';
+$id = 3;
+$desc = oci_new_descriptor($c, OCI_D_LOB);
+oci_bind_by_name($insert, ':data', $desc, -1, OCI_B_CLOB);
+$desc->writeTemporary($string3, OCI_TEMP_CLOB);
+oci_execute($insert);
+$desc->save($string3);
+oci_commit($c);
+$desc->close();
+oci_bind_by_name($select, ':id', $id);
+oci_execute($select);
+$row = oci_fetch_array($select, OCI_ASSOC);
+$lob = $row['DATA'];
+$fh = fopen('php://temp', 'rw');
+while (! $lob->eof()) {
+    $data = $lob->read(8192);             // read($characters), not read($bytes)
+    fwrite($fh, $data, strlen($data));    // fwrite(a, b, $bytes)
+}
+$lob->free();
+rewind($fh);
+$stream3a = stream_get_contents($fh);
+fclose($fh);
+$start3a = mb_substr($stream3a, 0, 10);
+$ending3a = mb_substr($stream3a, -10);
+echo 'size of string3 is ', strlen($string3), ' bytes, ', mb_strlen($string3), ' chars.', PHP_EOL;
+echo 'size of stream3a is ', strlen($stream3a), ' bytes, ', mb_strlen($stream3a), ' chars.', PHP_EOL;
+echo 'beg of stream3a is ', $start3a, PHP_EOL;
+echo 'end of stream3a is ', $ending3a, PHP_EOL;
+
+
+echo PHP_EOL, 'Test 4: の', PHP_EOL;
+$string4 = 'abc' . str_repeat('の', 2729) . 'xyz';
+$id = 4;
+$desc = oci_new_descriptor($c, OCI_D_LOB);
+oci_bind_by_name($insert, ':data', $desc, -1, OCI_B_CLOB);
+$desc->writeTemporary($string4, OCI_TEMP_CLOB);
+oci_execute($insert);
+$desc->save($string4);
+oci_commit($c);
+$desc->close();
+oci_bind_by_name($select, ':id', $id);
+oci_execute($select);
+$row = oci_fetch_array($select, OCI_ASSOC);
+$lob = $row['DATA'];
+$fh = fopen('php://temp', 'rw');
+while (! $lob->eof()) {
+    $data = $lob->read(8192);             // read($characters), not read($bytes)
+    fwrite($fh, $data, strlen($data));    // fwrite(a, b, $bytes)
+}
+$lob->free();
+rewind($fh);
+$stream4a = stream_get_contents($fh);
+fclose($fh);
+$start4a = mb_substr($stream4a, 0, 10);
+$ending4a = mb_substr($stream4a, -10);
+echo 'size of string4 is ', strlen($string4), ' bytes, ', mb_strlen($string4), ' chars.', PHP_EOL;
+echo 'size of stream4a is ', strlen($stream4a), ' bytes, ', mb_strlen($stream4a), ' chars.', PHP_EOL;
+echo 'beg of stream4a is ', $start4a, PHP_EOL;
+echo 'end of stream4a is ', $ending4a, PHP_EOL;
+
+--EXPECTF--
+
+Test 1: j
+size of string1 is 1000006 bytes, 1000006 chars.
+size of stream1a is 1000006 bytes, 1000006 chars.
+beg of stream1a is abcjjjjjjj
+end of stream1a is jjjjjjjxyz
+
+Test 2: £
+size of string2 is 8194 bytes, 4100 chars.
+size of stream2a is 8194 bytes, 4100 chars.
+beg of stream2a is abc£££££££
+end of stream2a is £££££££xyz
+
+Test 3: Җ
+size of string3 is 8194 bytes, 4100 chars.
+size of stream3a is 8194 bytes, 4100 chars.
+beg of stream3a is abcҖҖҖҖҖҖҖ
+end of stream3a is ҖҖҖҖҖҖҖxyz
+
+Test 4: の
+size of string4 is 8193 bytes, 2735 chars.
+size of stream4a is 8193 bytes, 2735 chars.
+beg of stream4a is abcののののののの
+end of stream4a is のののののののxyz
+
@@ -0,0 +1,65 @@
+--TEST--
+Bug #74625 (Integer overflow in oci_bind_array_by_name)
+--SKIPIF--
+<?php
+if (!extension_loaded('oci8')) die ("skip no oci8 extension");
+?>
+--FILE--
+<?php
+require(dirname(__FILE__).'/connect.inc');
+
+// Initialization
+
+$stmtarray = array(
+        "CREATE TABLE bug74625_tab (NAME NUMBER)",
+        "CREATE OR REPLACE PACKAGE PKG74625 AS
+          TYPE ARRTYPE IS TABLE OF NUMBER INDEX BY BINARY_INTEGER;
+          PROCEDURE iobind(c1 IN OUT ARRTYPE);
+         END PKG74625;",
+        "CREATE OR REPLACE PACKAGE BODY PKG74625 AS
+          PROCEDURE iobind(c1 IN OUT ARRTYPE) IS
+          BEGIN
+           FOR i IN 1..5 LOOP
+            c1(i) := c1(i) * 2;
+           END LOOP;
+          END iobind;
+         END PKG74625;"
+);
+
+oci8_test_sql_execute($c, $stmtarray);
+
+$statement = oci_parse($c, "BEGIN pkg74625.iobind(:c1); END;");
+
+$array = Array(-1,-2,-3,-4,-5);
+
+oci_bind_array_by_name($statement, ":c1", $array, 5, -1, SQLT_INT);
+
+oci_execute($statement);
+
+var_dump($array);
+
+// Cleanup
+$stmtarray = array(
+    "DROP TABLE bug74625_tab",
+    "DROP PACKAGE PKG74625"
+);
+
+oci8_test_sql_execute($c, $stmtarray);
+
+?>
+===DONE===
+<?php exit(0); ?>
+--EXPECTF--
+array(5) {
+  [0]=>
+  int(-2)
+  [1]=>
+  int(-4)
+  [2]=>
+  int(-6)
+  [3]=>
+  int(-8)
+  [4]=>
+  int(-10)
+}
+===DONE===
@@ -29,7 +29,7 @@ echo "Test 1\n";

 // Make errors throw exceptions

-set_error_handler(create_function('$x, $y', 'throw new Exception($y, $x);'));
+set_error_handler(function($x, $y) { throw new Exception($y, $x); });

 try
 {
@@ -29,7 +29,7 @@ echo "Test 1\n";

 // Make errors throw exceptions

-set_error_handler(create_function('$x, $y', 'throw new Exception($y, $x);'));
+set_error_handler(function($x, $y) { throw new Exception($y, $x); });

 try
 {
@@ -29,7 +29,7 @@ echo "Test 1\n";

 // Make errors throw exceptions

-set_error_handler(create_function('$x, $y', 'throw new Exception($y, $x);'));
+set_error_handler(function($x, $y) { throw new Exception($y, $x); });

 try
 {
@@ -29,7 +29,7 @@ echo "Test 1\n";

 // Make errors throw exceptions

-set_error_handler(create_function('$x, $y', 'throw new Exception($y, $x);'));
+set_error_handler(function($x, $y) { throw new Exception($y, $x); });

 try
 {
@@ -29,7 +29,7 @@ echo "Test 1\n";

 // Make errors throw exceptions

-set_error_handler(create_function('$x, $y', 'throw new Exception($y, $x);'));
+set_error_handler(function($x, $y) { throw new Exception($y, $x); });

 try
 {
@@ -29,7 +29,7 @@ echo "Test 1\n";

 // Make errors throw exceptions

-set_error_handler(create_function('$x, $y', 'throw new Exception($y, $x);'));
+set_error_handler(function($x, $y) { throw new Exception($y, $x); });

 try
 {
@@ -57,11 +57,11 @@ function get_attr($conn)
 ?>
 --EXPECT--
 **Test 1.1 - Default values for the attribute **************
-The value of DRIVER_NAME is PHP OCI8 : 2.1.3
+The value of DRIVER_NAME is PHP OCI8 : 2.1.6

 ***Test 1.2 - Get the values from different connections **************
 Testing with oci_pconnect()
-The value of DRIVER_NAME is PHP OCI8 : 2.1.3
+The value of DRIVER_NAME is PHP OCI8 : 2.1.6
 Testing with oci_new_connect()
-The value of DRIVER_NAME is PHP OCI8 : 2.1.3
+The value of DRIVER_NAME is PHP OCI8 : 2.1.6
 Done
@@ -1462,7 +1462,9 @@ static void zend_jmp_optimization(zend_code_block *block, zend_op_array *op_arra
 						break;
 					}
 				}
-				if (last_op->op1_type & (IS_VAR|IS_TMP_VAR)) {
+				if (last_op->op1_type == IS_CV) {
+					break;
+				} else if (last_op->op1_type & (IS_VAR|IS_TMP_VAR)) {
 					last_op->opcode = ZEND_FREE;
 					last_op->op2.num = 0;
 					block->op2_to = NULL;
@@ -2000,6 +2002,10 @@ void optimize_cfg(zend_op_array *op_array, zend_optimizer_ctx *ctx)
 		return;
 	}

+	if ((uint64_t) op_array->last * (op_array->last_var + op_array->T) > 512 * 1024 * 1024) {
+		return;
+	}
+
    /* Build CFG */
 	checkpoint = zend_arena_checkpoint(ctx->arena);
 	if (!find_code_blocks(op_array, &cfg, ctx)) {
@@ -146,6 +146,9 @@ void zend_optimizer_compact_literals(zend_op_array *op_array, zend_optimizer_ctx
 					LITERAL_INFO(opline->op2.constant, LITERAL_FUNC, 1, 1, 3);
 					break;
 				case ZEND_INIT_METHOD_CALL:
+					if (ZEND_OP1_TYPE(opline) == IS_CONST) {
+						LITERAL_INFO(opline->op1.constant, LITERAL_VALUE, 1, 0, 1);
+					}
 					if (ZEND_OP2_TYPE(opline) == IS_CONST) {
 						optimizer_literal_obj_info(
 							info,
@@ -109,6 +109,7 @@ void optimize_temporary_variables(zend_op_array *op_array, zend_optimizer_ctx *c
 					 */
 					if ((op_array->fn_flags & ZEND_ACC_HAS_FINALLY_BLOCK) &&
 					    (opline->opcode == ZEND_RETURN ||
+					     opline->opcode == ZEND_GENERATOR_RETURN ||
 					     opline->opcode == ZEND_RETURN_BY_REF ||
 					     opline->opcode == ZEND_FREE ||
 					     opline->opcode == ZEND_FE_FREE)) {
@@ -485,7 +485,7 @@ void zend_optimizer_pass1(zend_op_array *op_array, zend_optimizer_ctx *ctx)

 					zend_string_release(lc_name);
 					if (!m) {
-						if (!PG(enable_dl)) {
+						if (PG(enable_dl)) {
 							break;
 						} else {
 							ZVAL_FALSE(&t);