set versions

Fixed bug #75075 (unpack with X* causes infinity loop)
Merge branch 'syncoci8' into PHP-7.0
2026-11-11 03:00:49 +00:00 · 2017-08-15 10:01:08 +02:00 · 2017-08-15 12:34:13 +08:00 · 2017-08-14 21:16:34 -04:00 · 2017-08-14 21:14:14 -04:00 · 2017-08-14 13:08:04 +02:00
271 changed files with 10610 additions and 8482 deletions
@@ -24,7 +24,7 @@ environment:
        PHP_BUILD_CACHE_BASE_DIR: c:\build-cache  
        PHP_BUILD_OBJ_DIR: c:\obj
        PHP_BUILD_CACHE_SDK_DIR: c:\build-cache\sdk
-        PHP_BUILD_SDK_BRANCH: php-sdk-2.0.1
+        PHP_BUILD_SDK_BRANCH: php-sdk-2.0.9
        # ext and env setup for tests
        #MYSQL_TEST_PASSWD: Password12!
        #MYSQL_TEST_USER: root
@@ -43,7 +43,7 @@ environment:
 services:
        # the setup scripts have to be touched, once some other db version is used
        - mysql
-        - postgresql95
+        - postgresql96

 platform:
        - x64
@@ -1,6 +1,221 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2017 PHP 7.0.19
+17 Aug 2017 PHP 7.0.23RC1
+
+- Core:
+  . Fixed bug #74947 (Segfault in scanner on INF number). (Laruence)
+  . Fixed bug #74954 (null deref and segfault in zend_generator_resume()). (Bob)
+  . Fixed bug #74725 (html_errors=1 breaks unhandled exceptions). (Andrea)
+
+- cURL:
+  . Fixed bug #74125 (Fixed finding CURL on systems with multiarch support).
+    (cebe)
+
+- Date:
+  . Fixed bug #75002 (Null Pointer Dereference in timelib_time_clone). (Derick)
+
+- Intl:
+  . Fixed bug #74993 (Wrong reflection on some locale_* functions). (Sara)
+
+- Mbstring:
+  . Fixed bug #71606 (Segmentation fault mb_strcut with HTML-ENTITIES encoding).
+    (cmb)
+  . Fixed bug #62934 (mb_convert_kana() does not convert iteration marks).
+    (Nikita)
+  . Fixed bug #75001 (Wrong reflection on mb_eregi_replace). (Fabien
+    Villepinte)
+
+- MySQLi:
+  . Fixed bug #74968 (PHP crashes when calling mysqli_result::fetch_object with
+    an abstract class). (Anatol)
+
+- OCI8:
+  . Expose oci_unregister_taf_callback() (Tianfang Yang)
+
+- phar:
+  . Fixed bug #74991 (include_path has a 4096 char limit in some cases).
+    (bwbroersma)
+
+- Reflection:
+  . Fixed bug #74949 (null pointer dereference in _function_string). (Laruence)
+
+- Session:
+  . Fixed bug #74833 (SID constant created with wrong module number). (Anatol)
+
+- SimpleXML:
+  . Fixed bug #74950 (nullpointer deref in simplexml_element_getDocNamespaces).
+    (Laruence)
+
+- SPL:
+  . Fixed bug #75049 (spl_autoload_unregister can't handle
+    spl_autoload_functions results). (Laruence)
+  . Fixed bug #74669 (Unserialize ArrayIterator broken). (Andrew Nester)
+  . Fixed bug #75015 (Crash in recursive iterator destructors). (Julien)
+
+- Standard:
+  . Fixed bug #75075 (unpack with X* causes infinity loop). (Laruence)
+  . Fixed bug #74103 (heap-use-after-free when unserializing invalid array
+    size). (Nikita)
+  . Fixed bug #75054 (A Denial of Service Vulnerability was found when
+    performing deserialization). (Nikita)
+
+- WDDX:
+  . Fixed bug #73793 (WDDX uses wrong decimal seperator). (cmb)
+
+- XMLRPC:
+  . Fixed bug #74975 (Incorrect xmlrpc serialization for classes with declared
+    properties). (blar)
+
+03 Aug 2017 PHP 7.0.22
+
+- Core:
+  . Fixed bug #74832 (Loading PHP extension with already registered function 
+    name leads to a crash). (jpauli)
+  . Fixed bug #74780 (parse_url() borken when query string contains colon). 
+    (jhdxr)
+  . Fixed bug #74761 (Unary operator expected error on some systems). (petk)
+  . Fixed bug #73900 (Use After Free in unserialize() SplFixedArray). (nikic)
+  . Fixed bug #74913 (fixed incorrect poll.h include). (petk)
+  . Fixed bug #74906 (fixed incorrect errno.h include). (petk)
+
+- Date:
+  . Fixed bug #74852 (property_exists returns true on unknown DateInterval 
+    property). (jhdxr)
+
+- OCI8:
+  . Fixed bug #74625 (Integer overflow in oci_bind_array_by_name). (Ingmar Runge)
+
+- Opcache:
+  . Fixed bug #74840 (Opcache overwrites argument of GENERATOR_RETURN within
+    finally). (Bob)
+
+- PDO:
+  . Fixed bug #69356 (PDOStatement::debugDumpParams() truncates query). (Adam
+    Baratz)
+
+- SPL:
+  . Fixed bug #73471 (PHP freezes with AppendIterator). (jhdxr)
+
+- SQLite3:
+  . Fixed bug #74883 (SQLite3::__construct() produces "out of memory" exception
+    with invalid flags). (Anatol)
+
+- Wddx:
+  . Fixed bug #73173 (huge memleak when wddx_unserialize).
+    (tloi at fortinet dot com)
+
+- zlib:
+  . Fixed bug #73944 (dictionary option of inflate_init() does not work).
+    (wapmorgan)
+
+06 Jul 2017 PHP 7.0.21
+
+- Core:
+  . Fixed bug #74738 (Multiple [PATH=] and [HOST=] sections not properly
+    parsed). (Manuel Mausz)
+  . Fixed bug #74658 (Undefined constants in array properties result in broken
+    properties). (Laruence)
+  . Fixed misparsing of abstract unix domain socket names. (Sara)
+  . Fixed bug #74101, bug #74614 (Unserialize Heap Use-After-Free (READ: 1) in
+    zval_get_type). (Nikita)
+  . Fixed bug #74111 (Heap buffer overread (READ: 1) finish_nested_data from
+    unserialize). (Nikita)
+  . Fixed bug #74603 (PHP INI Parsing Stack Buffer Overflow Vulnerability).
+    (Stas)
+  . Fixed bug #74819 (wddx_deserialize() heap out-of-bound read via
+    php_parse_date()). (Derick)
+
+- DOM:
+  . Fixed bug #69373 (References to deleted XPath query results). (ttoohey)
+
+- GD:
+  . Fixed bug #74435 (Buffer over-read into uninitialized memory). (cmb)
+
+- Intl:
+  . Fixed bug #73473 (Stack Buffer Overflow in msgfmt_parse_message). (libnex)
+  . Fixed bug #74705 (Wrong reflection on Collator::getSortKey and
+    collator_get_sort_key). (Tyson Andre, Remi)
+  . Fixed bug #73634 (grapheme_strpos illegal memory access). (Stas)
+
+- Mbstring:
+  . Add oniguruma upstream fix (CVE-2017-9224, CVE-2017-9226, CVE-2017-9227,
+    CVE-2017-9228, CVE-2017-9229) (Remi, Mamoru TASAKA)
+
+- OCI8:
+  . Add TAF callback (PR #2459). (KoenigsKind)
+
+- Opcache:
+  . Fixed bug #74663 (Segfault with opcache.memory_protect and
+    validate_timestamp). (Laruence)
+
+- OpenSSL:
+  . Fixed bug #74651 (negative-size-param (-1) in memcpy in zif_openssl_seal()).
+    (Stas)
+
+- PCRE:
+  . Fixed bug #74087 (Segmentation fault in PHP7.1.1(compiled using the bundled PCRE library)).
+    (Stas)
+
+- PDO_OCI:
+  . Support Instant Client 12.2 in --with-pdo-oci configure option.
+    (Tianfang Yang)
+
+- Reflection:
+  . Fixed bug #74673 (Segfault when cast Reflection object to string with
+    undefined constant). (Laruence)
+
+- SPL:
+  . Fixed bug #74478 (null coalescing operator failing with SplFixedArray).
+    (jhdxr)
+
+- Standard:
+  . Fixed bug #74708 (Invalid Reflection signatures for random_bytes and
+    random_int). (Tyson Andre, Remi)
+  . Fixed bug #73648 (Heap buffer overflow in substr). (Stas)
+
+- FTP:
+  . Fixed bug #74598 (ftp:// wrapper ignores context arg). (Sara)
+
+- PHAR:
+  . Fixed bug #74386 (Phar::__construct reflection incorrect). (villfa)
+
+- SOAP
+  . Fixed bug #74679 (Incorrect conversion array with WSDL_CACHE_MEMORY).
+    (Dmitry)
+
+- Streams:
+  . Fixed bug #74556 (stream_socket_get_name() returns '\0'). (Sara)
+
+8 Jun 2017 PHP 7.0.20
+
+- Core:
+  . Fixed bug #74600 (crash (SIGSEGV) in _zend_hash_add_or_update_i).
+    (Laruence)
+  . Fixed bug #74546 (SIGILL in ZEND_FETCH_CLASS_CONSTANT_SPEC_CONST_CONST).
+    (Laruence)
+
+- intl:
+  . Fixed bug #74468 (wrong reflection on Collator::sortWithSortKeys). (villfa)
+
+- MySQLi:
+  . Fixed bug #74547 (mysqli::change_user() doesn't accept null as $database
+    argument w/strict_types). (Anatol)
+
+- Opcache:
+  . Fixed bug #74596 (SIGSEGV with opcache.revalidate_path enabled). (Laruence)
+
+- phar:
+  . Fixed bug #51918 (Phar::webPhar() does not handle requests sent through PUT
+    and DELETE method). (Christian Weiske)
+
+- Standard:
+  . Fixed bug #74510 (win32/sendmail.c anchors CC header but not BCC).
+    (Damian Wadley, Anatol)
+
+- xmlreader:
+  . Fixed bug #74457 (Wrong reflection on XMLReader::expand). (villfa)
+
+11 May 2017 PHP 7.0.19

 - Core:
  . Fixed bug #74188 (Null coalescing operator fails for undeclared static
@@ -10,6 +225,7 @@ PHP                                                                        NEWS
    (Matt Ficken)
  . Fixed bug #74337 (php-cgi.exe crash on facebook callback).
    (Anton Serbulov)
+  . Patch for bug #74216 was reverted. (Anatol)

 - Date:
  . Fixed bug #74404 (Wrong reflection on DateTimeZone::getTransitions).
@@ -32,6 +248,10 @@ PHP                                                                        NEWS
  . Fixed bug #74433 (wrong reflection for Normalizer methods). (villfa)
  . Fixed bug #74439 (wrong reflection for Locale methods). (villfa)

+- MySQLi:
+  . Fixed bug #74432 (mysqli_connect adding ":3306" to $host if $port parameter
+    not given). (Anatol)
+
 - MySQLnd:
  . Added support for MySQL 8.0 types. (Johannes)
  . Fixed bug #74376 (Invalid free of persistent results on error/connection
@@ -371,6 +591,7 @@ PHP                                                                        NEWS

 - JSON:
  . Fixed bug #73526 (php_json_encode depth issue). (Jakub Zelenka)
+  . Install headers on windows. (Darek Slusarczyk)

 - Mysqlnd:
  . Fixed bug #64526 (Add missing mysqlnd.* parameters to php.ini-*). (cmb)
@@ -2432,4 +2653,3 @@ PHP                                                                        NEWS
  . Update bundled libzip to 1.0.1. (Remi, Anatol)
  . Fixed bug #67161 (ZipArchive::getStream() returns NULL for certain file).
    (Christoph M. Becker)
-
@@ -53,27 +53,43 @@ string(3) "1st"
 string(3) "2nd"
 NULL
 string(3) "4th"
-array(3) {
+array(4) {
  [0]=>
  string(3) "1st"
  [1]=>
  &string(3) "2nd"
+  [2]=>
+  NULL
  [3]=>
  string(3) "4th"
 }
-array(2) {
+array(4) {
+  [0]=>
+  NULL
  [1]=>
  string(3) "2nd"
+  [2]=>
+  NULL
  [3]=>
  string(3) "4th"
 }
-array(2) {
+array(4) {
+  [0]=>
+  NULL
  [1]=>
  &string(3) "2nd"
+  [2]=>
+  NULL
  [3]=>
  string(3) "4th"
 }
-array(1) {
+array(4) {
+  [0]=>
+  NULL
+  [1]=>
+  NULL
+  [2]=>
+  NULL
  [3]=>
  string(3) "4th"
 }
@@ -0,0 +1,15 @@
+--TEST--
+Bug #73900: Use After Free in unserialize() SplFixedArray
+--FILE--
+<?php
+
+$a = new stdClass;
+$b = new SplFixedArray(1);
+$b[0] = $a;
+$c = &$b[0];
+var_dump($c);
+
+?>
+--EXPECT--
+object(stdClass)#1 (0) {
+}
@@ -0,0 +1,11 @@
+--TEST--
+Bug #74546 (SIGILL in ZEND_FETCH_CLASS_CONSTANT_SPEC_CONST_CONST_HANDLER())
+--FILE--
+<?php 
+"000000"[0]::d;
+?>
+--EXPECTF--
+Fatal error: Uncaught Error: Class '0' not found in %sbug74546.php:%d
+Stack trace:
+#0 {main}
+  thrown in %sbug74546.php on line %d
@@ -0,0 +1 @@
+0=0&~2000000000
@@ -0,0 +1,15 @@
+--TEST--
+Bug #74603 (PHP INI Parsing Stack Buffer Overflow Vulnerability)
+--SKIPIF--
+<?php
+if (PHP_INT_MAX !== 2147483647)
+        die('skip for 32-bit only');
+--FILE--
+<?php
+var_dump(parse_ini_file(__DIR__ . "/bug74603.ini", true, INI_SCANNER_NORMAL));
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  string(1) "0"
+}
@@ -0,0 +1,26 @@
+--TEST--
+Bug #74657 (Undefined constants in array properties result in broken properties)
+--FILE--
+<?php
+
+interface I {
+}
+
+class C {
+	const FOO = I::FOO;
+
+	public $options = [self::FOO => "bar"];
+}
+
+try {
+	var_dump((new C)->options);
+} catch (Throwable $e) {}
+
+var_dump((new C)->options);
+?>
+--EXPECTF--
+Fatal error: Uncaught Error: Undefined class constant 'I::FOO' in %sbug74657.php:%d
+Stack trace:
+#0 {main}
+  thrown in %sbug74657.php on line %d
+
@@ -0,0 +1,21 @@
+--TEST--
+Bug #74840: Opcache overwrites argument of GENERATOR_RETURN within finally
+--FILE--
+<?php
+
+$g = (function($a) {
+	try {
+		return $a + 1;
+	} finally {
+		$b = $a + 2;
+		var_dump($b);
+	}
+	yield; // Generator
+})(1);
+$g->next();
+var_dump($g->getReturn());
+
+?>
+--EXPECT--
+int(3)
+int(2)
@@ -0,0 +1,12 @@
+--TEST--
+Bug #74947 (Segfault in scanner on INF number)
+--FILE--
+<?php 
+
+echo 200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000;
+
+echo -200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000;
+
+?>
+--EXPECTF--
+INF-INF
@@ -0,0 +1,45 @@
+--TEST--
+Bug #74954 (crash after update of generator yielding from finished generator)
+--FILE--
+<?php
+
+function from() {
+        yield 1;
+        throw new Exception();
+}
+
+function gen($gen) {
+        try {
+                var_dump(yield from $gen);
+        } catch (Exception $e) { print "Caught exception!\n$e\n"; }
+}
+
+$gen = from();
+$gens[] = gen($gen);
+$gens[] = gen($gen);
+
+foreach ($gens as $g) {
+        $g->current();
+}
+
+do {
+        foreach ($gens as $i => $g) {
+                $g->next();
+        }
+} while($gens[0]->valid());
+
+?>
+--EXPECTF--
+Caught exception!
+Exception in %s:%d
+Stack trace:
+#0 %s(%d): from()
+#1 [internal function]: gen(Object(Generator))
+#2 %s(%d): Generator->next()
+#3 {main}
+Caught exception!
+ClosedGeneratorException: Generator yielded from aborted, no return value available in %s:%d
+Stack trace:
+#0 [internal function]: gen(Object(Generator))
+#1 %s(%d): Generator->next()
+#2 {main}
@@ -701,7 +701,7 @@ int zend_startup(zend_utility_functions *utility_functions, char **extensions) /
 	zend_compile_file = compile_file;
 	zend_execute_ex = execute_ex;
 	zend_execute_internal = NULL;
-#endif /* HAVE_SYS_SDT_H */
+#endif /* HAVE_DTRACE */
 	zend_compile_string = compile_string;
 	zend_throw_exception_hook = NULL;

@@ -1087,8 +1087,6 @@ ZEND_API void zend_merge_properties(zval *obj, HashTable *properties) /* {{{ */
 ZEND_API int zend_update_class_constants(zend_class_entry *class_type) /* {{{ */
 {
 	if (!(class_type->ce_flags & ZEND_ACC_CONSTANTS_UPDATED)) {
-		class_type->ce_flags |= ZEND_ACC_CONSTANTS_UPDATED;
-
 		if (class_type->parent) {
 			if (UNEXPECTED(zend_update_class_constants(class_type->parent) != SUCCESS)) {
 				return FAILURE;
@@ -1162,7 +1160,9 @@ ZEND_API int zend_update_class_constants(zend_class_entry *class_type) /* {{{ */

 			*scope = old_scope;
 		}
+		class_type->ce_flags |= ZEND_ACC_CONSTANTS_UPDATED;
 	}
+
 	return SUCCESS;
 }
 /* }}} */
@@ -2028,17 +2028,19 @@ ZEND_API zend_module_entry* zend_register_module_ex(zend_module_entry *module) /
 		zend_string_release(lcname);
 		return NULL;
 	}
-	zend_string_release(lcname);
 	module = module_ptr;
 	EG(current_module) = module;

 	if (module->functions && zend_register_functions(NULL, module->functions, NULL, module->type)==FAILURE) {
+		zend_hash_del(&module_registry, lcname);
+		zend_string_release(lcname);
 		EG(current_module) = NULL;
 		zend_error(E_CORE_WARNING,"%s: Unable to register functions, unable to load", module->name);
 		return NULL;
 	}

 	EG(current_module) = NULL;
+	zend_string_release(lcname);
 	return module;
 }
 /* }}} */
@@ -507,7 +507,7 @@ ZEND_FUNCTION(func_get_args)
 {
 	zval *p, *q;
 	uint32_t arg_count, first_extra_arg;
-	uint32_t i, n;
+	uint32_t i;
 	zend_execute_data *ex = EX(prev_execute_data);

 	if (ZEND_CALL_INFO(ex) & ZEND_CALL_CODE) {
@@ -523,7 +523,6 @@ ZEND_FUNCTION(func_get_args)
 		zend_hash_real_init(Z_ARRVAL_P(return_value), 1);
 		ZEND_HASH_FILL_PACKED(Z_ARRVAL_P(return_value)) {
 			i = 0;
-			n = 0;
 			p = ZEND_CALL_ARG(ex, 1);
 			if (arg_count > first_extra_arg) {
 				while (i < first_extra_arg) {
@@ -533,7 +532,8 @@ ZEND_FUNCTION(func_get_args)
 						if (Z_OPT_REFCOUNTED_P(q)) { 
 							Z_ADDREF_P(q);
 						}
-						n++;
+					} else {
+						q = &EG(uninitialized_zval);
 					}
 					ZEND_HASH_FILL_ADD(q);
 					p++;
@@ -548,14 +548,15 @@ ZEND_FUNCTION(func_get_args)
 					if (Z_OPT_REFCOUNTED_P(q)) { 
 						Z_ADDREF_P(q);
 					}
-					n++;
+				} else {
+					q = &EG(uninitialized_zval);
 				}
 				ZEND_HASH_FILL_ADD(q);
 				p++;
 				i++;
 			}
 		} ZEND_HASH_FILL_END();
-		Z_ARRVAL_P(return_value)->nNumOfElements = n;
+		Z_ARRVAL_P(return_value)->nNumOfElements = arg_count;
 	}
 }
 /* }}} */
@@ -2219,7 +2220,6 @@ static void debug_backtrace_get_args(zend_execute_data *call, zval *arg_array) /
 	array_init_size(arg_array, num_args);
 	if (num_args) {
 		uint32_t i = 0;
-		uint32_t n = 0;
 		zval *p = ZEND_CALL_ARG(call, 1);

 		zend_hash_real_init(Z_ARRVAL_P(arg_array), 1);
@@ -2242,12 +2242,9 @@ static void debug_backtrace_get_args(zend_execute_data *call, zval *arg_array) /
 							if (Z_OPT_REFCOUNTED_P(arg)) {
 								Z_ADDREF_P(arg);
 							}
-							n++;
 							ZEND_HASH_FILL_ADD(arg);
 						} else {
-							zval tmp;
-							ZVAL_UNDEF(&tmp);
-							ZEND_HASH_FILL_ADD(&tmp);
+							ZEND_HASH_FILL_ADD(&EG(uninitialized_zval));
 						}
 						i++;
 					}
@@ -2257,9 +2254,10 @@ static void debug_backtrace_get_args(zend_execute_data *call, zval *arg_array) /
 							if (Z_OPT_REFCOUNTED_P(p)) {
 								Z_ADDREF_P(p);
 							}
-							n++;
+							ZEND_HASH_FILL_ADD(p);
+						} else {
+							ZEND_HASH_FILL_ADD(&EG(uninitialized_zval));
 						}
-						ZEND_HASH_FILL_ADD(p);
 						p++;
 						i++;
 					}
@@ -2272,14 +2270,15 @@ static void debug_backtrace_get_args(zend_execute_data *call, zval *arg_array) /
 					if (Z_OPT_REFCOUNTED_P(p)) {
 						Z_ADDREF_P(p);
 					}
-					n++;
+					ZEND_HASH_FILL_ADD(p);
+				} else {
+					ZEND_HASH_FILL_ADD(&EG(uninitialized_zval));
 				}
-				ZEND_HASH_FILL_ADD(p);
 				p++;
 				i++;
 			}
 		} ZEND_HASH_FILL_END();
-		Z_ARRVAL_P(arg_array)->nNumOfElements = n;
+		Z_ARRVAL_P(arg_array)->nNumOfElements = num_args;
 	}
 }
 /* }}} */
@@ -6669,8 +6669,11 @@ void zend_compile_class_const(znode *result, zend_ast *ast) /* {{{ */
 		return;
 	}

-	zend_eval_const_expr(&class_ast);
-	zend_eval_const_expr(&const_ast);
+	zend_eval_const_expr(&ast->child[0]);
+	zend_eval_const_expr(&ast->child[1]);
+
+	class_ast = ast->child[0];
+	const_ast = ast->child[1];

 	if (class_ast->kind == ZEND_AST_ZVAL) {
 		resolved_name = zend_resolve_class_name_ast(class_ast);
@@ -7612,8 +7615,11 @@ void zend_eval_const_expr(zend_ast **ast_ptr) /* {{{ */
 				break;
 			}

-			zend_eval_const_expr(&class_ast);
-			zend_eval_const_expr(&name_ast);
+			zend_eval_const_expr(&ast->child[0]);
+			zend_eval_const_expr(&ast->child[1]);
+
+			class_ast = ast->child[0];
+			name_ast = ast->child[1];

 			if (name_ast->kind == ZEND_AST_ZVAL && zend_string_equals_literal_ci(zend_ast_get_str(name_ast), "class")) {
 				zend_error_noreturn(E_COMPILE_ERROR,
@@ -1758,16 +1758,9 @@ convert_to_array:
 				zend_error(E_NOTICE, "Indirect modification of overloaded element of %s has no effect", ZSTR_VAL(ce->name));
 			} else if (EXPECTED(retval && Z_TYPE_P(retval) != IS_UNDEF)) {
 				if (!Z_ISREF_P(retval)) {
-					if (Z_REFCOUNTED_P(retval) &&
-					    Z_REFCOUNT_P(retval) > 1) {
-						if (Z_TYPE_P(retval) != IS_OBJECT) {
-							Z_DELREF_P(retval);
-							ZVAL_DUP(result, retval);
-							retval = result;
-						} else {
-							ZVAL_COPY_VALUE(result, retval);
-							retval = result;
-						}
+					if (result != retval) {
+						ZVAL_COPY(result, retval);
+						retval = result;
 					}
 					if (Z_TYPE_P(retval) != IS_OBJECT) {
 						zend_class_entry *ce = Z_OBJCE_P(container);
@@ -644,15 +644,13 @@ failure:

 ZEND_API void zend_generator_resume(zend_generator *orig_generator) /* {{{ */
 {
-	zend_generator *generator;
+	zend_generator *generator = zend_generator_get_current(orig_generator);

 	/* The generator is already closed, thus can't resume */
-	if (UNEXPECTED(!orig_generator->execute_data)) {
+	if (UNEXPECTED(!generator->execute_data)) {
 		return;
 	}

-	generator = zend_generator_get_current(orig_generator);
-
 try_again:
 	if (generator->flags & ZEND_GENERATOR_CURRENTLY_RUNNING) {
 		zend_throw_error(NULL, "Cannot resume an already running generator");
@@ -291,7 +291,6 @@ static uint32_t zend_array_recalc_elements(HashTable *ht)
       uint32_t num = ht->nNumOfElements;

 	   ZEND_HASH_FOREACH_VAL(ht, val) {
-		   if (Z_TYPE_P(val) == IS_UNDEF) continue;
 		   if (Z_TYPE_P(val) == IS_INDIRECT) {
 			   if (UNEXPECTED(Z_TYPE_P(Z_INDIRECT_P(val)) == IS_UNDEF)) {
 				   num--;
@@ -55,7 +55,7 @@ static void zend_ini_do_op(char type, zval *result, zval *op1, zval *op2)
 	int i_result;
 	int i_op1, i_op2;
 	int str_len;
-	char str_result[MAX_LENGTH_OF_LONG];
+	char str_result[MAX_LENGTH_OF_LONG+1];

 	i_op1 = atoi(Z_STRVAL_P(op1));
 	zend_string_free(Z_STR_P(op1));
@@ -1676,7 +1676,6 @@ NEWLINE ("\r"|"\n"|"\r\n")
 		if (errno == ERANGE) { /* Overflow */
 			errno = 0;
 			if (yytext[0] == '0') { /* octal overflow */
-				errno = 0;
 				ZVAL_DOUBLE(zendlval, zend_oct_strtod(yytext, (const char **)&end));
 			} else {
 				ZVAL_DOUBLE(zendlval, zend_strtod(yytext, (const char **)&end));
@@ -1688,7 +1687,6 @@ NEWLINE ("\r"|"\n"|"\r\n")
 				ZVAL_UNDEF(zendlval);
 				RETURN_TOKEN(T_DNUMBER);
 			}
-			ZEND_ASSERT(!errno);
 			RETURN_TOKEN(T_DNUMBER);
 		}
 		/* Also not an assert for the same reason */
@@ -122,11 +122,13 @@ struct _zend_module_dep {
 	unsigned char type;		/* dependency type */
 };

+BEGIN_EXTERN_C()
 extern ZEND_API HashTable module_registry;

 void module_destructor(zend_module_entry *module);
 int module_registry_request_startup(zend_module_entry *module);
 int module_registry_unload_temp(const zend_module_entry *module);
+END_EXTERN_C()

 #endif

@@ -155,12 +155,12 @@ struct _zend_object_handlers {
 	zend_object_compare_zvals_t				compare;
 };

+BEGIN_EXTERN_C()
 extern ZEND_API zend_object_handlers std_object_handlers;

 #define zend_get_function_root_class(fbc) \
 	((fbc)->common.prototype ? (fbc)->common.prototype->common.scope : (fbc)->common.scope)

-BEGIN_EXTERN_C()
 ZEND_API union _zend_function *zend_std_get_static_method(zend_class_entry *ce, zend_string *function_name_strval, const zval *key);
 ZEND_API zval *zend_std_get_static_property(zend_class_entry *ce, zend_string *property_name, zend_bool silent);
 ZEND_API ZEND_COLD zend_bool zend_std_unset_static_property(zend_class_entry *ce, zend_string *property_name);
@@ -433,7 +433,7 @@ char *alloca();
 #define ZEND_STRL(str)		(str), (sizeof(str)-1)
 #define ZEND_STRS(str)		(str), (sizeof(str))
 #define ZEND_NORMALIZE_BOOL(n)			\
-	((n) ? (((n)>0) ? 1 : -1) : 0)
+	((n) ? (((n)<0) ? -1 : 1) : 0)
 #define ZEND_TRUTH(x)		((x) ? 1 : 0)
 #define ZEND_LOG_XOR(a, b)		(ZEND_TRUTH(a) ^ ZEND_TRUTH(b))

@@ -72,6 +72,10 @@ typedef unsigned long int uint32_t;
 #define NO_INFNAN_CHECK
 #endif

+#ifndef NO_ERRNO
+#define NO_ERRNO
+#endif
+
 #ifdef WORDS_BIGENDIAN
 #define IEEE_BIG_ENDIAN 1
 #else
@@ -2687,7 +2687,7 @@ EOF
  done

  echo "'[$]0' \\" >> $1
-  if test `expr -- [$]0 : "'.*"` = 0; then
+  if test `expr " [$]0" : " '.*"` = 0; then
    CONFIGURE_COMMAND="$CONFIGURE_COMMAND '[$]0'"
  else 
    CONFIGURE_COMMAND="$CONFIGURE_COMMAND [$]0"
@@ -29,5 +29,8 @@ if not exist "%SDK_RUNNER%" (
 	exit /b 3
 )

-call %SDK_RUNNER% -t %APPVEYOR_BUILD_FOLDER%\appveyor\build_task.bat
+cmd /c %SDK_RUNNER% -t %APPVEYOR_BUILD_FOLDER%\appveyor\build_task.bat
+if %errorlevel% neq 0 exit /b 3
+
+exit /b 0

@@ -2,6 +2,8 @@

 if "%APPVEYOR%" equ "True" rmdir /s /q C:\cygwin >NUL 2>NUL
 if %errorlevel% neq 0 exit /b 3
+if "%APPVEYOR%" equ "True" rmdir /s /q C:\cygwin64 >NUL 2>NUL
+if %errorlevel% neq 0 exit /b 3
 if "%APPVEYOR%" equ "True" rmdir /s /q C:\mingw >NUL 2>NUL
 if %errorlevel% neq 0 exit /b 3
 if "%APPVEYOR%" equ "True" rmdir /s /q C:\mingw-w64 >NUL 2>NUL
@@ -19,18 +21,25 @@ set STABILITY=staging
 set DEPS_DIR=%PHP_BUILD_CACHE_BASE_DIR%\deps-%BRANCH%-%PHP_SDK_VC%-%PHP_SDK_ARCH%
 rem SDK is cached, deps info is cached as well
 echo Updating dependencies in %DEPS_DIR%
-call phpsdk_deps --update --no-backup --branch %BRANCH% --stability %STABILITY% --deps %DEPS_DIR%
+cmd /c phpsdk_deps --update --no-backup --branch %BRANCH% --stability %STABILITY% --deps %DEPS_DIR%
 if %errorlevel% neq 0 exit /b 3

-call buildconf.bat --force
+rem Something went wrong, most likely when concurrent builds were to fetch deps
+rem updates. It might be, that some locking mechanism is needed.
+if not exist "%DEPS_DIR%" (
+	cmd /c phpsdk_deps --update --force --no-backup --branch %BRANCH% --stability %STABILITY% --deps %DEPS_DIR%
+)
+if %errorlevel% neq 0 exit /b 3
+
+cmd /c buildconf.bat --force
 if %errorlevel% neq 0 exit /b 3

 if "%THREAD_SAFE%" equ "0" set ADD_CONF=--disable-zts

-set EXT_EXCLUDE_FROM_TEST=snmp,oci8_12c,pdo_oci,pdo_odbc,odbc,pdo_firebird,interbase,ldap,imap,dba
+set EXT_EXCLUDE_FROM_TEST=snmp,oci8_12c,pdo_oci,pdo_odbc,odbc,pdo_firebird,interbase,ldap,imap,dba,ftp
 if "%OPCACHE%" equ "0" set EXT_EXCLUDE_FROM_TEST=%EXT_EXCLUDE_FROM_TEST%,opcache

-call configure.bat ^
+cmd /c configure.bat ^
 	--enable-snapshot-build ^
 	--disable-debug-pack ^
 	--with-mcrypt=shared ^
@@ -6,5 +6,8 @@ if not exist "%SDK_RUNNER%" (
 	exit /b 3
 )

-call %SDK_RUNNER% -t %APPVEYOR_BUILD_FOLDER%\appveyor\test_task.bat
+cmd /c %SDK_RUNNER% -t %APPVEYOR_BUILD_FOLDER%\appveyor\test_task.bat
+if %errorlevel% neq 0 exit /b 3
+
+exit /b 0

@@ -12,6 +12,10 @@ if /i "%APPVEYOR_REPO_BRANCH:~0,4%" equ "php-" (
 	set STABILITY=staging
 )
 set DEPS_DIR=%PHP_BUILD_CACHE_BASE_DIR%\deps-%BRANCH%-%PHP_SDK_VC%-%PHP_SDK_ARCH%
+if not exist "%DEPS_DIR%" (
+	echo "%DEPS_DIR%" doesn't exist
+	exit /b 3
+)

 rem setup MySQL related exts
 set MYSQL_PWD=Password12!
@@ -25,6 +29,7 @@ set PDO_MYSQL_TEST_HOST=%MYSQL_TEST_HOST%
 set PDO_MYSQL_TEST_PORT=%MYSQL_TEST_PORT%
 set PDO_MYSQL_TEST_DSN=mysql:host=%PDO_MYSQL_TEST_HOST% port=%PDO_MYSQL_TEST_PORT% dbname=test user=%PDO_MYSQL_TEST_USER% password=%MYSQL_PW%
 "C:\Program Files\MySql\MySQL Server 5.7\bin\mysql.exe" --user=%MYSQL_TEST_USER% -e "CREATE DATABASE IF NOT EXISTS test"
+if %errorlevel% neq 0 exit /b 3

 rem setup PostgreSQL related exts
 set PGUSER=postgres
@@ -33,12 +38,15 @@ rem set PGSQL_TEST_CONNSTR=host=127.0.0.1 dbname=test port=5432 user=postgres pa
 echo ^<?php $conn_str = "host=127.0.0.1 dbname=test port=5432 user=%PGUSER% password=%PGPASSWORD%"; ?^> >> "./ext/pgsql/tests/config.inc"
 set PDO_PGSQL_TEST_DSN=pgsql:host=127.0.0.1 port=5432 dbname=test user=%PGUSER% password=%PGPASSWORD%
 "C:\Program Files\PostgreSQL\9.5\bin\createdb.exe" test
+if %errorlevel% neq 0 exit /b 3

 rem prepare for ext/openssl
 if "%APPVEYOR%" equ "True" rmdir /s /q C:\OpenSSL-Win32 >NUL 2>NUL
 if "%APPVEYOR%" equ "True" rmdir /s /q C:\OpenSSL-Win64 >NUL 2>NUL
 mkdir c:\usr\local\ssl
+if %errorlevel% neq 0 exit /b 3
 copy %DEPS_DIR%\template\ssl\openssl.cnf c:\usr\local\ssl
+if %errorlevel% neq 0 exit /b 3
 set OPENSSL_CONF=c:\usr\local\ssl\openssl.cnf
 rem set OPENSSL_CONF=
 rem set SSLEAY_CONF=
@@ -48,9 +56,13 @@ if "%OPCACHE%" equ "1" set OPCACHE_OPTS=-d opcache.enabled=1 -d opcache.enable_c

 rem prepare for enchant
 mkdir c:\enchant_plugins
+if %errorlevel% neq 0 exit /b 3
 copy %DEPS_DIR%\bin\libenchant_ispell.dll c:\enchant_plugins
+if %errorlevel% neq 0 exit /b 3
 copy %DEPS_DIR%\bin\libenchant_myspell.dll c:\enchant_plugins
+if %errorlevel% neq 0 exit /b 3
 reg add HKEY_CURRENT_USER\SOFTWARE\Enchant\Config /v Module_Dir /t REG_SZ /d c:\enchant_plugins
+if %errorlevel% neq 0 exit /b 3
 set PHP_BUILD_CACHE_ENCHANT_DICT_DIR=%PHP_BUILD_CACHE_BASE_DIR%\enchant_dict
 if not exist "%PHP_BUILD_CACHE_ENCHANT_DICT_DIR%" (
 	echo Creating %PHP_BUILD_CACHE_ENCHANT_DICT_DIR%
@@ -73,3 +85,5 @@ mkdir c:\tests_tmp
 cd "%APPVEYOR_BUILD_FOLDER%"
 nmake test TESTS="%OPCACHE_OPTS% -q --offline --show-diff --set-timeout 120 -g FAIL,XFAIL,BORK,WARN,LEAK,SKIP --temp-source c:\tests_tmp --temp-target c:\tests_tmp"

+exit /b %errorlevel%
+
@@ -119,8 +119,8 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=0
-PHP_RELEASE_VERSION=19
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=23
+PHP_EXTRA_VERSION="RC1"
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -494,6 +494,7 @@ limits.h \
 locale.h \
 monetary.h \
 netdb.h \
+poll.h \
 pwd.h \
 resolv.h \
 signal.h \
@@ -17,11 +17,23 @@ if test "$PHP_CURL" != "no"; then
        break
      fi
    done
+    if test -z "$CURL_DIR"; then
+      AC_MSG_RESULT(not found)
+      if which dpkg-architecture>/dev/null; then
+        AC_MSG_CHECKING(for cURL in multiarch path)
+        CURL_MULTIARCH_INCLUDE=/usr/include/$(dpkg-architecture -qDEB_HOST_MULTIARCH)
+        if test -r $CURL_MULTIARCH_INCLUDE/curl/easy.h; then
+          CURL_DIR=/usr
+          AC_MSG_RESULT(found in $CURL_MULTIARCH_INCLUDE)
+        else
+          AC_MSG_RESULT(not found)
+        fi
+      fi
+    fi
  fi

  if test -z "$CURL_DIR"; then
-    AC_MSG_RESULT(not found)
-    AC_MSG_ERROR(Please reinstall the libcurl distribution -
+    AC_MSG_ERROR(Could not find cURL, please reinstall the libcurl distribution -
    easy.h should be in <curl-dir>/include/curl/)
  fi

@@ -45,7 +57,11 @@ if test "$PHP_CURL" != "no"; then
    AC_MSG_ERROR(cURL version 7.10.5 or later is required to compile php with cURL support)
  fi

-  PHP_ADD_INCLUDE($CURL_DIR/include)
+  if test -z "$CURL_MULTIARCH_INCLUDE"; then
+    PHP_ADD_INCLUDE($CURL_DIR/include)
+  else
+    PHP_ADD_INCLUDE($CURL_MULTIARCH_INCLUDE)
+  fi
  PHP_EVAL_LIBLINE($CURL_LIBS, CURL_SHARED_LIBADD)
  PHP_ADD_LIBRARY_WITH_PATH(curl, $CURL_DIR/$PHP_LIBDIR, CURL_SHARED_LIBADD)
  
@@ -899,7 +899,7 @@ datefull         = day ([ \t.-])* monthtext ([ \t.-])* year;
 datenoday        = monthtext ([ .\t-])* year4;
 datenodayrev     = year4 ([ .\t-])* monthtext;
 datetextual      = monthtext ([ .\t-])* day [,.stndrh\t ]+ year;
-datenoyear       = monthtext ([ .\t-])* day [,.stndrh\t ]*;
+datenoyear       = monthtext ([ .\t-])* day ([,.stndrh\t ]+|[\000]);
 datenoyearrev    = day ([ .\t-])* monthtext;
 datenocolon      = year4 monthlz daylz;

@@ -1932,6 +1932,10 @@ static void date_period_it_rewind(zend_object_iterator *iter)
 	if (iterator->object->current) {
 		timelib_time_dtor(iterator->object->current);
 	}
+	if (!iterator->object->start) {
+		zend_throw_error(NULL, "DatePeriod has not been initialized correctly");
+		return;
+	}
 	iterator->object->current = timelib_time_clone(iterator->object->start);
 	date_period_it_invalidate_current(iter);
 }
@@ -1986,7 +1990,7 @@ static int date_interval_has_property(zval *object, zval *member, int type, void
 	zval *prop;
 	int retval = 0;

-	if (Z_TYPE_P(member) != IS_STRING) {
+	if (UNEXPECTED(Z_TYPE_P(member) != IS_STRING)) {
 		ZVAL_COPY(&tmp_member, member);
 		convert_to_string(&tmp_member);
 		member = &tmp_member;
@@ -2002,10 +2006,10 @@ static int date_interval_has_property(zval *object, zval *member, int type, void
 		}
 		return retval;
 	}
-
-	prop = date_interval_read_property(object, member, type, cache_slot, &rv);
-
-	if (prop != NULL) {
+	
+	prop = date_interval_read_property(object, member, BP_VAR_IS, cache_slot, &rv);
+	
+	if (prop != &EG(uninitialized_zval)) {
 		if (type == 2) {
 			retval = 1;
 		} else if (type == 1) {
@@ -0,0 +1,17 @@
+--TEST--
+Bug #74852 property_exists returns true on unknown DateInterval property
+--FILE--
+<?php
+
+$interval = new DateInterval('P2D');
+var_dump(property_exists($interval,'abcde'));
+var_dump(isset($interval->abcde));
+var_dump($interval->abcde);
+
+?>
+--EXPECTF--
+bool(false)
+bool(false)
+
+Notice: Undefined property: DateInterval::$abcde in %s on line %d
+NULL
@@ -0,0 +1,22 @@
+--TEST--
+Bug #75002 Null Pointer Dereference in timelib_time_clone
+--FILE--
+<?php
+
+class aaa extends DatePeriod {
+	public function __construct() { }
+}
+
+$start=new DateTime( '2012-08-01' );
+
+foreach (new aaa($start) as $y) {
+	$a=$key;
+}
+
+?>
+==DONE==
+--EXPECTF--	
+Fatal error: Uncaught Error: DatePeriod has not been initialized correctly in %sbug75002.php:%d
+Stack trace:
+#0 {main}
+  thrown in %sbug75002.php on line %d
@@ -34,14 +34,14 @@ foreach ( $tests as $start => $data )
 echo "\n";
 ?>
 --EXPECT--
-Sat, 23 Oct 2010 00:00:00 +0000
+Fri, 15 Oct 2010 23:00:00 +0000
 Wed, 15 Dec 2010 16:15:00 +0000
 Mon, 20 Dec 2010 00:00:00 +0000
 Mon, 20 Dec 2010 10:00:00 +0000
 Tue, 21 Dec 2010 12:00:00 +0000
 Mon, 03 Jan 2011 00:00:00 +0000
 Mon, 03 Jan 2011 09:00:00 +0000
-Sat, 23 Oct 2010 00:00:00 +0100
+Fri, 15 Oct 2010 23:00:00 +0100
 Sun, 28 Mar 2010 00:15:00 +0000
 Sun, 28 Mar 2010 02:15:00 +0100
 Sun, 28 Mar 2010 02:15:00 +0100
@@ -337,6 +337,8 @@ int dom_node_node_value_write(dom_object *obj, zval *newval)
 		case XML_ATTRIBUTE_NODE:
 			if (nodep->children) {
 				node_list_unlink(nodep->children);
+				php_libxml_node_free_list((xmlNodePtr) nodep->children);
+				nodep->children = NULL;
 			}
 		case XML_TEXT_NODE:
 		case XML_COMMENT_NODE:
@@ -854,6 +856,14 @@ int dom_node_text_content_write(dom_object *obj, zval *newval)
 		return FAILURE;
 	}

+	if (nodep->type == XML_ELEMENT_NODE || nodep->type == XML_ATTRIBUTE_NODE) {
+		if (nodep->children) {
+			node_list_unlink(nodep->children);
+			php_libxml_node_free_list((xmlNodePtr) nodep->children);
+			nodep->children = NULL;
+		}
+	}
+
 	str = zval_get_string(newval);
 	/* we have to use xmlNodeAddContent() to get the same behavior as with xmlNewText() */
 	xmlNodeSetContent(nodep, (xmlChar *) "");
@@ -0,0 +1,15 @@
+--TEST--
+Bug #69373 References to deleted XPath query results
+--FILE--
+<?php
+$doc = new DOMDocument();
+for( $i=0; $i<20; $i++ ) {
+	$doc->loadXML("<parent><child /><child /></parent>");
+	$xpath = new DOMXpath($doc);
+	$all = $xpath->query('//*');
+	$doc->firstChild->nodeValue = '';
+}
+echo 'DONE', PHP_EOL;
+?>
+--EXPECT--
+DONE
@@ -0,0 +1,14 @@
+--TEST--
+Test exif_read_data on unavailable file
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+$infile = dirname(__FILE__).'/bug73115.JPG';
+exif_read_data($infile);
+?>
+===DONE===
+--EXPECTF--
+Warning: exif_read_data(): Unable to open file in %sexif_read_data_0.php on line %d
+===DONE===
+
@@ -147,6 +147,9 @@ gdImagePtr gdImageCreateFromGifCtx(gdIOCtxPtr fd) /* {{{ */
 	int haveGlobalColormap;
 	gdImagePtr im = 0;

+	memset(ColorMap, 0, 3 * MAXCOLORMAPSIZE);
+	memset(localColorMap, 0, 3 * MAXCOLORMAPSIZE);
+
 	/*1.4//imageNumber = 1; */
 	if (! ReadOK(fd,buf,6)) {
 		return 0;
@@ -1,5 +1,9 @@
 --TEST--
 (Bug #74031) ReflectionFunction for imagepng returns wrong number of parameters
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die("skip gd extension not available\n");
+?>
 --FILE--
 <?php

@@ -0,0 +1,27 @@
+--TEST--
+Bug #74435 (Buffer over-read into uninitialized memory)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$im = imagecreatefromgif(__DIR__ . DIRECTORY_SEPARATOR . 'bug74435.gif');
+var_dump($im);
+$width = imagesx($im);
+$height = imagesy($im);
+for ($i = 0; $i < $width; $i += 16) {
+    for ($j = 0; $j < $height; $j += 16) {
+        if (($index = imagecolorat($im, $i, $j)) >= 2) {
+            list($red, $green, $blue, $alpha) = array_values(imagecolorsforindex($im, $index));
+            if ($red !== 0 || $green !== 0 || $blue !== 0 || $alpha !== 0) {
+                echo "unexpected color at ($i, $j)\n";
+            }
+        }
+    }
+}
+?>
+===DONE===
+--EXPECTF--
+resource(%d) of type (gd)
+===DONE===
@@ -95,6 +95,10 @@ ZEND_BEGIN_ARG_INFO_EX( collator_sort_args, 0, 0, 1 )
 	ZEND_ARG_INFO( 0, flags )
 ZEND_END_ARG_INFO()

+ZEND_BEGIN_ARG_INFO_EX( collator_sort_with_sort_keys_args, 0, 0, 1 )
+	ZEND_ARG_ARRAY_INFO( 1, arr, 0 )
+ZEND_END_ARG_INFO()
+
 /* }}} */

 /* {{{ Collator_class_functions
@@ -106,7 +110,7 @@ zend_function_entry Collator_class_functions[] = {
 	ZEND_FENTRY( create, ZEND_FN( collator_create ), collator_1_arg, ZEND_ACC_PUBLIC|ZEND_ACC_STATIC )
 	PHP_NAMED_FE( compare, ZEND_FN( collator_compare ), collator_2_args )
 	PHP_NAMED_FE( sort, ZEND_FN( collator_sort ), collator_sort_args )
-	PHP_NAMED_FE( sortWithSortKeys, ZEND_FN( collator_sort_with_sort_keys ), collator_sort_args )
+	PHP_NAMED_FE( sortWithSortKeys, ZEND_FN( collator_sort_with_sort_keys ), collator_sort_with_sort_keys_args )
 	PHP_NAMED_FE( asort, ZEND_FN( collator_asort ), collator_sort_args )
 	PHP_NAMED_FE( getAttribute, ZEND_FN( collator_get_attribute ), collator_1_arg )
 	PHP_NAMED_FE( setAttribute, ZEND_FN( collator_set_attribute ), collator_2_args )
@@ -115,7 +119,7 @@ zend_function_entry Collator_class_functions[] = {
 	PHP_NAMED_FE( getLocale, ZEND_FN( collator_get_locale ), collator_1_arg )
 	PHP_NAMED_FE( getErrorCode, ZEND_FN( collator_get_error_code ), collator_0_args )
 	PHP_NAMED_FE( getErrorMessage, ZEND_FN( collator_get_error_message ), collator_0_args )
-	PHP_NAMED_FE( getSortKey, ZEND_FN( collator_get_sort_key ), collator_2_args )
+	PHP_NAMED_FE( getSortKey, ZEND_FN( collator_get_sort_key ), collator_1_arg )
 	PHP_FE_END
 };
 /* }}} */
@@ -110,7 +110,8 @@ PHP_FUNCTION(grapheme_strpos)
 	size_t haystack_len, needle_len;
 	const char *found;
 	zend_long loffset = 0;
-	int32_t offset = 0, noffset = 0;
+	int32_t offset = 0;
+	size_t noffset = 0;
 	zend_long ret_pos;

 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "ss|l", &haystack, &haystack_len, &needle, &needle_len, &loffset) == FAILURE) {
@@ -110,6 +110,7 @@ PHP_FUNCTION( msgfmt_parse_message )
 		RETURN_FALSE;
 	}

+	INTL_CHECK_LOCALE_LEN(slocale_len);
 	memset(mfo, 0, sizeof(*mfo));
 	msgformat_data_init(&mfo->mf_data);

@@ -159,6 +159,11 @@ ZEND_BEGIN_ARG_INFO_EX(collator_sort_args, 0, 0, 2)
 	ZEND_ARG_INFO(0, sort_flags)
 ZEND_END_ARG_INFO()

+ZEND_BEGIN_ARG_INFO_EX(collator_sort_with_sort_keys_args, 0, 0, 2)
+	ZEND_ARG_OBJ_INFO(0, coll, Collator, 0)
+	ZEND_ARG_ARRAY_INFO(1, arr, 0)
+ZEND_END_ARG_INFO()
+
 ZEND_BEGIN_ARG_INFO_EX(numfmt_parse_arginfo, 0, 0, 2)
 	ZEND_ARG_INFO(0, formatter)
 	ZEND_ARG_INFO(0, string)
@@ -173,6 +178,24 @@ ZEND_BEGIN_ARG_INFO_EX(numfmt_parse_currency_arginfo, 0, 0, 3)
 	ZEND_ARG_INFO(1, position)
 ZEND_END_ARG_INFO()

+ZEND_BEGIN_ARG_INFO_EX( locale_get_loc_in_loc_args, 0, ZEND_RETURN_VALUE, 1 )
+	ZEND_ARG_INFO(0, locale)
+	ZEND_ARG_INFO(0, in_locale)
+ZEND_END_ARG_INFO()
+
+ZEND_BEGIN_ARG_INFO_EX( locale_filter_matches_args, 0, ZEND_RETURN_VALUE, 2 )
+	ZEND_ARG_INFO(0, langtag)
+	ZEND_ARG_INFO(0, locale)
+	ZEND_ARG_INFO(0, canonicalize)
+ZEND_END_ARG_INFO()
+
+ZEND_BEGIN_ARG_INFO_EX( locale_lookup_args, 0, ZEND_RETURN_VALUE, 2 )
+	ZEND_ARG_INFO(0, langtag)
+	ZEND_ARG_INFO(0, locale)
+	ZEND_ARG_INFO(0, canonicalize)
+	ZEND_ARG_INFO(0, def)
+ZEND_END_ARG_INFO()
+
 ZEND_BEGIN_ARG_INFO_EX(locale_0_args, 0, 0, 0)
 ZEND_END_ARG_INFO()

@@ -180,24 +203,6 @@ ZEND_BEGIN_ARG_INFO_EX(locale_1_arg, 0, 0, 1)
 	ZEND_ARG_INFO(0, arg1)
 ZEND_END_ARG_INFO()

-ZEND_BEGIN_ARG_INFO_EX(locale_2_args, 0, 0, 2)
-	ZEND_ARG_INFO(0, arg1)
-	ZEND_ARG_INFO(0, arg2)
-ZEND_END_ARG_INFO()
-
-ZEND_BEGIN_ARG_INFO_EX(locale_3_args, 0, 0, 3)
-	ZEND_ARG_INFO(0, arg1)
-	ZEND_ARG_INFO(0, arg2)
-	ZEND_ARG_INFO(0, arg3)
-ZEND_END_ARG_INFO()
-
-ZEND_BEGIN_ARG_INFO_EX(locale_4_args, 0, 0, 4)
-	ZEND_ARG_INFO(0, arg1)
-	ZEND_ARG_INFO(0, arg2)
-	ZEND_ARG_INFO(0, arg3)
-	ZEND_ARG_INFO(0, arg4)
-ZEND_END_ARG_INFO()
-
 #define intl_0_args collator_static_0_args
 #define intl_1_arg collator_static_1_arg

@@ -645,12 +650,12 @@ zend_function_entry intl_functions[] = {
 	PHP_FE( collator_get_strength, collator_0_args )
 	PHP_FE( collator_set_strength, collator_1_arg )
 	PHP_FE( collator_sort, collator_sort_args )
-	PHP_FE( collator_sort_with_sort_keys, collator_sort_args )
+	PHP_FE( collator_sort_with_sort_keys, collator_sort_with_sort_keys_args )
 	PHP_FE( collator_asort, collator_sort_args )
 	PHP_FE( collator_get_locale, collator_1_arg )
 	PHP_FE( collator_get_error_code, collator_0_args )
 	PHP_FE( collator_get_error_message, collator_0_args )
-	PHP_FE( collator_get_sort_key, collator_2_args )
+	PHP_FE( collator_get_sort_key, collator_1_arg )

 	/* formatter functions */
 	PHP_FE( numfmt_create, arginfo_numfmt_create )
@@ -681,17 +686,17 @@ zend_function_entry intl_functions[] = {
 	PHP_FE( locale_get_script, locale_1_arg )
 	PHP_FE( locale_get_region, locale_1_arg )
 	PHP_FE( locale_get_keywords, locale_1_arg )
-	PHP_FE( locale_get_display_script, locale_2_args )
-	PHP_FE( locale_get_display_region, locale_2_args )
-	PHP_FE( locale_get_display_name, locale_2_args )
-	PHP_FE( locale_get_display_language, locale_2_args)
-	PHP_FE( locale_get_display_variant, locale_2_args )
+	PHP_FE( locale_get_display_script, locale_get_loc_in_loc_args )
+	PHP_FE( locale_get_display_region, locale_get_loc_in_loc_args )
+	PHP_FE( locale_get_display_name, locale_get_loc_in_loc_args )
+	PHP_FE( locale_get_display_language, locale_get_loc_in_loc_args)
+	PHP_FE( locale_get_display_variant, locale_get_loc_in_loc_args )
 	PHP_FE( locale_compose, locale_1_arg )
 	PHP_FE( locale_parse, locale_1_arg )
 	PHP_FE( locale_get_all_variants, locale_1_arg )
-	PHP_FE( locale_filter_matches, locale_3_args )
+	PHP_FE( locale_filter_matches, locale_filter_matches_args )
 	PHP_FE( locale_canonicalize, locale_1_arg )
-	PHP_FE( locale_lookup, locale_4_args )
+	PHP_FE( locale_lookup, locale_lookup_args )
 	PHP_FE( locale_accept_from_http, locale_1_arg )

 	/* MessageFormatter functions */
@@ -0,0 +1,22 @@
+--TEST--
+Bug #74468 Wrong reflection on Collator::sortWithSortKeys
+--SKIPIF--
+<?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?>
+<?php if (version_compare(INTL_ICU_VERSION, '51.2') >=  0) die('skip for ICU < 51.2'); ?>
+--FILE--
+<?php
+$rm = new ReflectionMethod(Collator::class, 'sortWithSortKeys');
+var_dump($rm->getNumberOfParameters());
+var_dump($rm->getNumberOfRequiredParameters());
+
+$rf = new ReflectionFunction('collator_sort_with_sort_keys');
+var_dump($rf->getNumberOfParameters());
+var_dump($rf->getNumberOfRequiredParameters());
+?>
+===DONE===
+--EXPECT--
+int(1)
+int(1)
+int(2)
+int(2)
+===DONE===
@@ -0,0 +1,21 @@
+--TEST--
+Bug #74705 Wrong reflection on Collator::getSortKey
+--SKIPIF--
+<?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?>
+--FILE--
+<?php
+$rm = new ReflectionMethod(Collator::class, 'getSortKey');
+var_dump($rm->getNumberOfParameters());
+var_dump($rm->getNumberOfRequiredParameters());
+
+$rf = new ReflectionFunction('collator_get_sort_key');
+var_dump($rf->getNumberOfParameters());
+var_dump($rf->getNumberOfRequiredParameters());
+?>
+===DONE===
+--EXPECT--
+int(1)
+int(1)
+int(2)
+int(2)
+===DONE===
@@ -0,0 +1,73 @@
+--TEST--
+Bug #74993 Wrong reflection on some locale_* functions
+--SKIPIF--
+<?php
+extension_loaded('intl') || print 'skip';
+--FILE--
+<?php
+$funcs = [
+    'locale_get_display_language',
+    'locale_get_display_name',
+    'locale_get_display_region',
+    'locale_get_display_script',
+    'locale_get_display_variant',
+    'locale_filter_matches',
+    'locale_lookup',
+];
+
+foreach ($funcs as $func) {
+    echo (new ReflectionFunction($func));
+}
+--EXPECT--
+Function [ <internal:intl> function locale_get_display_language ] {
+
+  - Parameters [2] {
+    Parameter #0 [ <required> $locale ]
+    Parameter #1 [ <optional> $in_locale ]
+  }
+}
+Function [ <internal:intl> function locale_get_display_name ] {
+
+  - Parameters [2] {
+    Parameter #0 [ <required> $locale ]
+    Parameter #1 [ <optional> $in_locale ]
+  }
+}
+Function [ <internal:intl> function locale_get_display_region ] {
+
+  - Parameters [2] {
+    Parameter #0 [ <required> $locale ]
+    Parameter #1 [ <optional> $in_locale ]
+  }
+}
+Function [ <internal:intl> function locale_get_display_script ] {
+
+  - Parameters [2] {
+    Parameter #0 [ <required> $locale ]
+    Parameter #1 [ <optional> $in_locale ]
+  }
+}
+Function [ <internal:intl> function locale_get_display_variant ] {
+
+  - Parameters [2] {
+    Parameter #0 [ <required> $locale ]
+    Parameter #1 [ <optional> $in_locale ]
+  }
+}
+Function [ <internal:intl> function locale_filter_matches ] {
+
+  - Parameters [3] {
+    Parameter #0 [ <required> $langtag ]
+    Parameter #1 [ <required> $locale ]
+    Parameter #2 [ <optional> $canonicalize ]
+  }
+}
+Function [ <internal:intl> function locale_lookup ] {
+
+  - Parameters [4] {
+    Parameter #0 [ <required> $langtag ]
+    Parameter #1 [ <required> $locale ]
+    Parameter #2 [ <optional> $canonicalize ]
+    Parameter #3 [ <optional> $def ]
+  }
+}
@@ -19,8 +19,8 @@ var_dump($lsb->getDisplayName(false, IntlTimeZone::DISPLAY_LONG, 'pt_PT'));

 ?>
 ==DONE==
--EXPECT--
+--EXPECTF--
 string(30) "Western European Standard Time"
 string(30) "Western European Standard Time"
-string(32) "Hora Padrão da Europa Ocidental"
+string(32) "Hora %cadrão da Europa Ocidental"
 ==DONE==
@@ -21,7 +21,8 @@ echo $orstr,"\n";
 echo $new_str,"\n";
 echo $recovstr,"\n";

-var_dump(($orstr == $recovstr) == $recovstr2);
+var_dump($orstr === $recovstr);
+var_dump($orstr === $recovstr2);

 echo "Done.\n";
 --EXPECT--
@@ -29,4 +30,5 @@ echo "Done.\n";
 ōshanbyū
 オーシャンビュー
 bool(true)
+bool(true)
 Done.
@@ -8,7 +8,7 @@ data-interchange format as specified in RFC 7159
 The parser is implemented using re2c and Bison. The used versions
 of both tools for generating files in the repository are following:

-re2c 0.14.3
+re2c 0.16
 Bison 3.0.4

 It is recommended to do all contributions to the JSON extension
@@ -17,6 +17,6 @@ if (PHP_JSON != "no") {

 	ADD_SOURCES(configure_module_dirname, "json_encoder.c json_parser.tab.c json_scanner.c", "json");

-	PHP_INSTALL_HEADERS("ext/json/", "php_json.h");
+	PHP_INSTALL_HEADERS("ext/json/", "php_json.h php_json_parser.h php_json_scanner.h");
 }

@@ -1,4 +1,4 @@
-/* Generated by re2c 0.14.3 */
+/* Generated by re2c 0.16 */

 enum YYCONDTYPE {
 	yycJS,
@@ -366,7 +366,7 @@ PHP_FUNCTION(ldap_connect)
 	{
 		int rc = LDAP_SUCCESS;
 		char	*url = host;
-		if (!ldap_is_ldap_url(url)) {
+		if (url && !ldap_is_ldap_url(url)) {
 			int	urllen = hostlen + sizeof( "ldap://:65535" );

 			if (port <= 0 || port > 65535) {
@@ -376,7 +376,7 @@ PHP_FUNCTION(ldap_connect)
 			}

 			url = emalloc(urllen);
-			snprintf( url, urllen, "ldap://%s:%ld", host ? host : "", port );
+			snprintf( url, urllen, "ldap://%s:%ld", host, port );
 		}

 #ifdef LDAP_API_FEATURE_X_OPENLDAP
@@ -0,0 +1,26 @@
+--TEST--
+ldap_connect() - Connection using default host from openldap's ldap.conf
+--CREDITS--
+David Caldwell <david@galvanix.com>
+--SKIPIF--
+<?php
+require_once('skipif.inc');
+ob_start();
+phpinfo();
+if (!preg_match("/vendor name => openldap/i", ob_get_clean()))
+    die("skip not openldap");
+?>
+--FILE--
+<?php
+$conf=tempnam("/tmp","ldap.conf");
+file_put_contents($conf, "uri ldaps://example.com:3141/");
+putenv("LDAPCONF=$conf");
+$link = ldap_connect();
+ldap_get_option($link, LDAP_OPT_HOST_NAME, $host);
+var_dump($host);
+unlink($conf);
+?>
+===DONE===
+--EXPECTF--
+string(16) "example.com:3141"
+===DONE===
@@ -224,7 +224,7 @@ static void php_libxml_node_free(xmlNodePtr node)
 	}
 }

-static void php_libxml_node_free_list(xmlNodePtr node)
+PHP_LIBXML_API void php_libxml_node_free_list(xmlNodePtr node)
 {
 	xmlNodePtr curnode;

@@ -100,6 +100,7 @@ PHP_LIBXML_API int php_libxml_decrement_doc_ref(php_libxml_node_object *object);
 PHP_LIBXML_API xmlNodePtr php_libxml_import_node(zval *object);
 PHP_LIBXML_API zval *php_libxml_register_export(zend_class_entry *ce, php_libxml_export_node export_function);
 /* When an explicit freeing of node and children is required */
+PHP_LIBXML_API void php_libxml_node_free_list(xmlNodePtr node);
 PHP_LIBXML_API void php_libxml_node_free_resource(xmlNodePtr node);
 /* When object dtor is called as node may still be referenced */
 PHP_LIBXML_API void php_libxml_node_decrement_resource(php_libxml_node_object *object);
@@ -88,7 +88,8 @@ const struct mbfl_convert_vtbl vtbl_html_wchar = {
 	mbfl_filt_conv_html_dec_ctor,
 	mbfl_filt_conv_html_dec_dtor,
 	mbfl_filt_conv_html_dec,
-	mbfl_filt_conv_html_dec_flush };
+	mbfl_filt_conv_html_dec_flush,
+	mbfl_filt_conv_html_dec_copy };


 #define CK(statement)	do { if ((statement) < 0) return (-1); } while (0)
@@ -309,4 +310,9 @@ int mbfl_filt_conv_html_dec_flush(mbfl_convert_filter *filter)
 	return err;
 }

-
+void mbfl_filt_conv_html_dec_copy(mbfl_convert_filter *src, mbfl_convert_filter *dest)
+{
+	*dest = *src;
+	dest->opaque = mbfl_malloc(html_enc_buffer_size+1);
+	memcpy(dest->opaque, src->opaque, html_enc_buffer_size+1);
+}
@@ -42,6 +42,7 @@ int mbfl_filt_conv_html_enc(int c, mbfl_convert_filter *filter);
 int mbfl_filt_conv_html_enc_flush(mbfl_convert_filter *filter);
 int mbfl_filt_conv_html_dec(int c, mbfl_convert_filter *filter);
 int mbfl_filt_conv_html_dec_flush(mbfl_convert_filter *filter);
+void mbfl_filt_conv_html_dec_copy(mbfl_convert_filter *src, mbfl_convert_filter *dest);
 void mbfl_filt_conv_html_dec_ctor(mbfl_convert_filter *filter);
 void mbfl_filt_conv_html_dec_dtor(mbfl_convert_filter *filter);

@@ -222,11 +222,11 @@ mbfl_filt_tl_jisx0201_jisx0208(int c, mbfl_convert_filter *filt)
 	} else if (mode & (MBFL_FILT_TL_ZEN2HAN_HIRA2KANA
 			| MBFL_FILT_TL_ZEN2HAN_KANA2HIRA)) {
 		if ((mode & MBFL_FILT_TL_ZEN2HAN_HIRA2KANA) &&
-				c >= 0x3041 && c <= 0x3093) {
+				((c >= 0x3041 && c <= 0x3093) || c == 0x309d || c == 0x309e)) {
 			/* Zenkaku hirangana to Zenkaku katakana */
 			s = c + 0x60;
 		} else if ((mode & MBFL_FILT_TL_ZEN2HAN_KANA2HIRA) &&
-				c >= 0x30a1 && c <= 0x30f3) {
+				((c >= 0x30a1 && c <= 0x30f3) || c == 0x30fd || c == 0x30fe)) {
 			/* Zenkaku katakana to Zenkaku hirangana */
 			s = c - 0x60;
 		}
@@ -457,6 +457,7 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_mb_eregi_replace, 0, 0, 3)
 	ZEND_ARG_INFO(0, pattern)
 	ZEND_ARG_INFO(0, replacement)
 	ZEND_ARG_INFO(0, string)
+	ZEND_ARG_INFO(0, option)
 ZEND_END_ARG_INFO()

 ZEND_BEGIN_ARG_INFO_EX(arginfo_mb_ereg_replace_callback, 0, 0, 3)
@@ -1425,14 +1425,9 @@ match_at(regex_t* reg, const UChar* str, const UChar* end,
      break;

    case OP_EXACT1:  MOP_IN(OP_EXACT1);
-#if 0
      DATA_ENSURE(1);
      if (*p != *s) goto fail;
      p++; s++;
-#endif
-      if (*p != *s++) goto fail;
-      DATA_ENSURE(0);
-      p++;
      MOP_OUT;
      break;

@@ -3128,6 +3123,8 @@ forward_search_range(regex_t* reg, const UChar* str, const UChar* end, UChar* s,
    }
    else {
      UChar *q = p + reg->dmin;
+
+      if (q >= end) return 0; /* fail */
      while (p < q) p += enclen(reg->enc, p);
    }
  }
@@ -3208,7 +3205,13 @@ forward_search_range(regex_t* reg, const UChar* str, const UChar* end, UChar* s,
    else {
      if (reg->dmax != ONIG_INFINITE_DISTANCE) {
 	*low = p - reg->dmax;
-	if (*low > s) {
+	if (p - str < reg->dmax) {
+	  *low = (UChar* )str;
+	  if (low_prev)
+	    *low_prev = onigenc_get_prev_char_head(reg->enc, str, *low);
+	}
+	else {
+ 	if (*low > s) {
 	  *low = onigenc_get_right_adjust_char_head_with_prev(reg->enc, s,
 							      *low, (const UChar** )low_prev);
 	  if (low_prev && IS_NULL(*low_prev))
@@ -3221,6 +3224,7 @@ forward_search_range(regex_t* reg, const UChar* str, const UChar* end, UChar* s,
 					       (pprev ? pprev : str), *low);
 	}
      }
+      }
    }
    /* no needs to adjust *high, *high is used as range check only */
    *high = p - reg->dmin;
@@ -3064,7 +3064,7 @@ fetch_token_in_cc(OnigToken* tok, UChar** src, UChar* end, ScanEnv* env)
 	PUNFETCH;
 	prev = p;
 	num = scan_unsigned_octal_number(&p, end, 3, enc);
-	if (num < 0) return ONIGERR_TOO_BIG_NUMBER;
+	if (num < 0 || num >= 256) return ONIGERR_TOO_BIG_NUMBER;
 	if (p == prev) {  /* can't read nothing. */
 	  num = 0; /* but, it's not error */
 	}
@@ -3436,7 +3436,7 @@ fetch_token(OnigToken* tok, UChar** src, UChar* end, ScanEnv* env)
      if (IS_SYNTAX_OP(syn, ONIG_SYN_OP_ESC_OCTAL3)) {
 	prev = p;
 	num = scan_unsigned_octal_number(&p, end, (c == '0' ? 2:3), enc);
-	if (num < 0) return ONIGERR_TOO_BIG_NUMBER;
+	if (num < 0 || num >= 256) return ONIGERR_TOO_BIG_NUMBER;
 	if (p == prev) {  /* can't read nothing. */
 	  num = 0; /* but, it's not error */
 	}
@@ -4068,7 +4068,9 @@ next_state_class(CClassNode* cc, OnigCodePoint* vs, enum CCVALTYPE* type,
    }
  }

-  *state = CCS_VALUE;
+  if (*state != CCS_START)
+    *state = CCS_VALUE;
+
  *type  = CCV_CLASS;
  return 0;
 }
@@ -4084,7 +4086,11 @@ next_state_val(CClassNode* cc, OnigCodePoint *vs, OnigCodePoint v,
  switch (*state) {
  case CCS_VALUE:
    if (*type == CCV_SB)
+    {
+    if (*vs > 0xff)
+      return ONIGERR_INVALID_CODE_POINT_VALUE;
      BITSET_SET_BIT(cc->bs, (int )(*vs));
+    }
    else if (*type == CCV_CODE_POINT) {
      r = add_code_range(&(cc->mbuf), env, *vs, *vs);
      if (r < 0) return r;
@@ -0,0 +1,10 @@
+--TEST--
+Bug #62934: mb_convert_kana() does not convert iteration marks
+--FILE--
+<?php
+echo mb_convert_kana('あゝすゞめアヽスヾメ', 'C', 'UTF-8') . "\n";
+echo mb_convert_kana('あゝすゞめアヽスヾメ', 'c', 'UTF-8') . "\n";
+?>
+--EXPECT--
+アヽスヾメアヽスヾメ
+あゝすゞめあゝすゞめ
@@ -0,0 +1,13 @@
+--TEST--
+Bug #71606 (Segmentation fault mb_strcut + mb_list_encodings)
+--SKIPIF--
+<?php
+if (!extension_loaded('mbstring')) die('skip ext/mbstring not available');
+?>
+--FILE--
+<?php
+echo mb_strcut('&quot;', 0, 0, 'HTML-ENTITIES');
+echo 'DONE', PHP_EOL;
+?>
+--EXPECT--
+DONE
@@ -1156,7 +1156,7 @@ void php_mysqli_fetch_into_hash_aux(zval *return_value, MYSQL_RES * result, zend
 {
 #if !defined(MYSQLI_USE_MYSQLND)
 	MYSQL_ROW row;
-	unsigned int	i;
+	unsigned int	i, num_fields;
 	MYSQL_FIELD		*fields;
 	zend_ulong	*field_len;

@@ -1170,8 +1170,9 @@ void php_mysqli_fetch_into_hash_aux(zval *return_value, MYSQL_RES * result, zend

 	array_init(return_value);
 	field_len = mysql_fetch_lengths(result);
+	num_fields = mysql_num_fields(result);

-	for (i = 0; i < mysql_num_fields(result); i++) {
+	for (i = 0; i < num_fields; i++) {
 		if (row[i]) {
 			zval res;

@@ -1251,6 +1252,10 @@ void php_mysqli_fetch_into_hash(INTERNAL_FUNCTION_PARAMETERS, int override_flags
 			php_error_docref(NULL, E_WARNING, "Could not find class '%s'", ZSTR_VAL(class_name));
 			return;
 		}
+		if (UNEXPECTED(ce->ce_flags & (ZEND_ACC_INTERFACE|ZEND_ACC_TRAIT|ZEND_ACC_IMPLICIT_ABSTRACT_CLASS|ZEND_ACC_EXPLICIT_ABSTRACT_CLASS))) {
+			zend_throw_error(NULL, "Class '%s' cannot be instantiated", ZSTR_VAL(ce->name));
+			return;
+		}
 		fetchtype = MYSQLI_ASSOC;
 	} else {
 		if (override_flags) {
@@ -619,7 +619,7 @@ PHP_FUNCTION(mysqli_change_user)
 	const		CHARSET_INFO * old_charset;
 #endif

-	if (zend_parse_method_parameters(ZEND_NUM_ARGS(), getThis(), "Osss", &mysql_link, mysqli_link_class_entry, &user, &user_len, &password, &password_len, &dbname, &dbname_len) == FAILURE) {
+	if (zend_parse_method_parameters(ZEND_NUM_ARGS(), getThis(), "Osss!", &mysql_link, mysqli_link_class_entry, &user, &user_len, &password, &password_len, &dbname, &dbname_len) == FAILURE) {
 		return;
 	}
 	MYSQLI_FETCH_RESOURCE_CONN(mysql, mysql_link, MYSQLI_STATUS_VALID);
@@ -1210,7 +1210,7 @@ PHP_FUNCTION(mysqli_fetch_fields)
 	zval		*mysql_result;
 	zval		obj;

-	unsigned int i;
+	unsigned int i, num_fields;

 	if (zend_parse_method_parameters(ZEND_NUM_ARGS(), getThis(), "O", &mysql_result, mysqli_result_class_entry) == FAILURE) {
 		return;
@@ -1219,8 +1219,9 @@ PHP_FUNCTION(mysqli_fetch_fields)
 	MYSQLI_FETCH_RESOURCE(result, MYSQL_RES *, mysql_result, "mysqli_result", MYSQLI_STATUS_VALID);

 	array_init(return_value);
+	num_fields = mysql_num_fields(result);

-	for (i = 0; i < mysql_num_fields(result); i++) {
+	for (i = 0; i < num_fields; i++) {
 		const MYSQL_FIELD *field = mysql_fetch_field_direct(result, i);

 		object_init(&obj);
@@ -1266,7 +1267,7 @@ PHP_FUNCTION(mysqli_fetch_lengths)
 {
 	MYSQL_RES		*result;
 	zval			*mysql_result;
-	unsigned int	i;
+	unsigned int	i, num_fields;
 	zend_ulong	*ret;

 	if (zend_parse_method_parameters(ZEND_NUM_ARGS(), getThis(), "O", &mysql_result, mysqli_result_class_entry) == FAILURE) {
@@ -1280,8 +1281,9 @@ PHP_FUNCTION(mysqli_fetch_lengths)
 	}

 	array_init(return_value);
+	num_fields = mysql_num_fields(result);

-	for (i = 0; i < mysql_num_fields(result); i++) {
+	for (i = 0; i < num_fields; i++) {
 		add_index_long(return_value, i, ret[i]);
 	}
 }
@@ -0,0 +1,25 @@
+--TEST--
+Bug #74547 mysqli::change_user() doesn't accept null as $database argument w/strict_types
+--SKIPIF--
+<?php
+  require_once('skipif.inc');
+  require_once('skipifconnectfailure.inc');
+?>
+--FILE--
+<?php
+	declare(strict_types=1);
+
+	require_once("connect.inc");
+
+	if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
+		printf("[001] Cannot connect to the server using host=%s, user=%s, passwd=***, dbname=%s, port=%s, socket=%s\n",
+			$host, $user, $db, $port, $socket);
+
+	var_dump(mysqli_change_user($link, $user, $passwd, NULL));
+
+	mysqli_close($link);
+?>
+===DONE===
+--EXPECTF--
+bool(true)
+===DONE===
@@ -0,0 +1,24 @@
+--TEST--
+Bug #74968 PHP crashes when calling mysqli_result::fetch_object with an abstract class
+--SKIPIF--
+<?php
+require_once('skipif.inc');
+require_once('skipifconnectfailure.inc');
+?>
+--FILE--
+<?php
+	require_once("connect.inc");
+
+	$mysqli = new mysqli("$host:$port", $user, $passwd, $db);
+	abstract class test {
+		public $a;
+	}
+	$mysqli->query("SELECT 1 as a")->fetch_object("test");
+?>
+==DONE==
+--EXPECTF--
+Fatal error: Uncaught Error: Class 'test' cannot be instantiated in %sbug74968.php:%d
+Stack trace:
+#0 %sbug74968.php(%d): mysqli_result->fetch_object('test')
+#1 {main}
+  thrown in %sbug74968.php on line %d
@@ -0,0 +1,29 @@
+--TEST--
+Bug #74432, BC issue on undocumented connect string
+--SKIPIF--
+<?php
+require_once('skipif.inc');
+require_once('skipifemb.inc');
+require_once('skipifconnectfailure.inc');
+?>
+--FILE--
+<?php
+	/* This behavior is undocumented, but might be in use. Until there's no officially
+		supported alternative, ensure changes doesn't cause BC breach. Otherwise,
+		the test should be removed once the undocumented behavior changes. */
+
+	require_once("connect.inc");
+
+	$handle = mysqli_connect("$host:$port", $user, $passwd);
+
+	var_dump($handle);
+
+	if ($handle) {
+		mysqli_close($handle);
+	}
+?>
+--EXPECTF--
+object(mysqli)#%d (%d) {
+%A
+}
+
@@ -38,7 +38,7 @@ if (!$IS_MYSQLND)

 	function poll_async($offset, $link, $links, $errors, $reject, $exp_ready, $use_oo_syntax) {

-		if ($exp_ready !== ($tmp = mysqli_poll($links, $errors, $reject, 0, 1000)))
+		if ($exp_ready !== ($tmp = mysqli_poll($links, $errors, $reject, 0, 2000)))
 			printf("[%03d + 1] There should be %d links ready to read from, %d ready\n",
 				$offset, $exp_ready, $tmp);

@@ -335,7 +335,7 @@ if test "$PHP_OCI8" != "no"; then

    PHP_ADD_LIBRARY(clntsh, 1, OCI8_SHARED_LIBADD)
    PHP_ADD_LIBPATH($OCI8_DIR/$OCI8_LIB_DIR, OCI8_SHARED_LIBADD)
-    PHP_NEW_EXTENSION(oci8, oci8.c oci8_lob.c oci8_statement.c oci8_collection.c oci8_interface.c, $ext_shared)
+    PHP_NEW_EXTENSION(oci8, oci8.c oci8_lob.c oci8_statement.c oci8_collection.c oci8_interface.c oci8_failover.c, $ext_shared)
    AC_DEFINE(HAVE_OCI8,1,[Defined to 1 if the PHP OCI8 extension for Oracle Database is configured])

    PHP_SUBST_OLD(OCI8_SHARED_LIBADD)
@@ -406,7 +406,7 @@ if test "$PHP_OCI8" != "no"; then

    AC_DEFINE(HAVE_OCI_INSTANT_CLIENT,1,[Defined to 1 if OCI8 configuration located Oracle's Instant Client libraries])

-    PHP_NEW_EXTENSION(oci8, oci8.c oci8_lob.c oci8_statement.c oci8_collection.c oci8_interface.c, $ext_shared)
+    PHP_NEW_EXTENSION(oci8, oci8.c oci8_lob.c oci8_statement.c oci8_collection.c oci8_interface.c oci8_failover.c, $ext_shared)
    AC_DEFINE(HAVE_OCI8,1,[Defined to 1 if the PHP OCI8 extension for Oracle Database is configured])

    PHP_SUBST_OLD(OCI8_SHARED_LIBADD)
@@ -45,7 +45,7 @@ if (PHP_OCI8 != "no") {
 	if (CHECK_HEADER_ADD_INCLUDE("oci.h", "CFLAGS_OCI8", oci8_inc_paths) &&
 			CHECK_LIB("oci.lib", "oci8", oci8_lib_paths))
 	{
-		EXTENSION('oci8', 'oci8.c oci8_lob.c oci8_statement.c oci8_collection.c oci8_interface.c');
+		EXTENSION('oci8', 'oci8.c oci8_lob.c oci8_statement.c oci8_collection.c oci8_interface.c oci8_failover.c');

 		AC_DEFINE('HAVE_OCI8', 1);
 		AC_DEFINE('HAVE_OCI_INSTANT_CLIENT', 1);
@@ -80,7 +80,7 @@ if (PHP_OCI8_11G != "no") {
 	if (CHECK_HEADER_ADD_INCLUDE("oci.h", "CFLAGS_OCI8_11G", oci8_11g_inc_paths) &&
 			CHECK_LIB("oci.lib", "oci8_11g", oci8_11g_lib_paths))
 	{
-		EXTENSION('oci8_11g', 'oci8.c oci8_lob.c oci8_statement.c oci8_collection.c oci8_interface.c', null, null, null, "ext\\oci8_11g")
+		EXTENSION('oci8_11g', 'oci8.c oci8_lob.c oci8_statement.c oci8_collection.c oci8_interface.c oci8_failover.c', null, null, null, "ext\\oci8_11g")

 		AC_DEFINE('HAVE_OCI8', 1);
 		AC_DEFINE('HAVE_OCI_INSTANT_CLIENT', 1);
@@ -115,7 +115,7 @@ if (PHP_OCI8_12C != "no") {
 	if (CHECK_HEADER_ADD_INCLUDE("oci.h", "CFLAGS_OCI8_12C", oci8_12c_inc_paths) &&
 			CHECK_LIB("oci.lib", "oci8_12c", oci8_12c_lib_paths))
 	{
-		EXTENSION('oci8_12c', 'oci8.c oci8_lob.c oci8_statement.c oci8_collection.c oci8_interface.c', null, null, null, "ext\\oci8_12c")
+		EXTENSION('oci8_12c', 'oci8.c oci8_lob.c oci8_statement.c oci8_collection.c oci8_interface.c oci8_failover.c', null, null, null, "ext\\oci8_12c")

 		AC_DEFINE('HAVE_OCI8', 1);
 		AC_DEFINE('HAVE_OCI_INSTANT_CLIENT', 1);
@@ -504,6 +504,15 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_oci_new_collection, 0, 0, 2)
 	ZEND_ARG_INFO(0, type_name)
 	ZEND_ARG_INFO(0, schema_name)
 ZEND_END_ARG_INFO()
+
+ZEND_BEGIN_ARG_INFO_EX(arginfo_oci_register_taf_callback, 0, 0, 1)
+	ZEND_ARG_INFO(0, connection_resource)
+	ZEND_ARG_INFO(0, function_name)
+ZEND_END_ARG_INFO()
+
+ZEND_BEGIN_ARG_INFO_EX(arginfo_oci_unregister_taf_callback, 0, 0, 1)
+	ZEND_ARG_INFO(0, connection_resource)
+ZEND_END_ARG_INFO()
 /* }}} */

 /* {{{ LOB Method arginfo */
@@ -701,6 +710,8 @@ PHP_FUNCTION(oci_collection_assign);
 PHP_FUNCTION(oci_collection_size);
 PHP_FUNCTION(oci_collection_max);
 PHP_FUNCTION(oci_collection_trim);
+PHP_FUNCTION(oci_register_taf_callback);
+PHP_FUNCTION(oci_unregister_taf_callback);
 /* }}} */

 /* {{{ extension definition structures
@@ -783,6 +794,8 @@ static const zend_function_entry php_oci_functions[] = {
 	PHP_FE(oci_collection_max,			arginfo_oci_collection_max)
 	PHP_FE(oci_collection_trim,			arginfo_oci_collection_trim)
 	PHP_FE(oci_new_collection,			arginfo_oci_new_collection)
+	PHP_FE(oci_register_taf_callback,   arginfo_oci_register_taf_callback)
+	PHP_FE(oci_unregister_taf_callback, arginfo_oci_unregister_taf_callback)

 	PHP_FALIAS(oci_free_cursor,		oci_free_statement,		arginfo_oci_free_statement)
 	PHP_FALIAS(ocifreecursor,		oci_free_statement,		arginfo_oci_free_statement)
@@ -1129,6 +1142,20 @@ PHP_MINIT_FUNCTION(oci)
 	REGISTER_LONG_CONSTANT("OCI_TEMP_CLOB",OCI_TEMP_CLOB, CONST_CS | CONST_PERSISTENT);
 	REGISTER_LONG_CONSTANT("OCI_TEMP_BLOB",OCI_TEMP_BLOB, CONST_CS | CONST_PERSISTENT);

+/* for Transparent Application Failover */
+	REGISTER_LONG_CONSTANT("OCI_FO_END", OCI_FO_END, CONST_CS | CONST_PERSISTENT);
+	REGISTER_LONG_CONSTANT("OCI_FO_ABORT", OCI_FO_ABORT, CONST_CS | CONST_PERSISTENT);
+	REGISTER_LONG_CONSTANT("OCI_FO_REAUTH", OCI_FO_REAUTH, CONST_CS | CONST_PERSISTENT);
+	REGISTER_LONG_CONSTANT("OCI_FO_BEGIN", OCI_FO_BEGIN, CONST_CS | CONST_PERSISTENT);
+	REGISTER_LONG_CONSTANT("OCI_FO_ERROR", OCI_FO_ERROR, CONST_CS | CONST_PERSISTENT);
+
+	REGISTER_LONG_CONSTANT("OCI_FO_NONE", OCI_FO_NONE, CONST_CS | CONST_PERSISTENT);
+	REGISTER_LONG_CONSTANT("OCI_FO_SESSION", OCI_FO_SESSION, CONST_CS | CONST_PERSISTENT);
+	REGISTER_LONG_CONSTANT("OCI_FO_SELECT", OCI_FO_SELECT, CONST_CS | CONST_PERSISTENT);
+	REGISTER_LONG_CONSTANT("OCI_FO_TXNAL", OCI_FO_TXNAL, CONST_CS | CONST_PERSISTENT);
+
+	REGISTER_LONG_CONSTANT("OCI_FO_RETRY", OCI_FO_RETRY, CONST_CS | CONST_PERSISTENT);
+
 	return SUCCESS;
 }

@@ -1930,6 +1957,7 @@ php_oci_connection *php_oci_do_connect_ex(char *username, int username_len, char
 			connection = (php_oci_connection *) ecalloc(1, sizeof(php_oci_connection));
 			connection->hash_key = zend_string_dup(hashed_details.s, 0);
 			connection->is_persistent = 0;
+			ZVAL_UNDEF(&connection->taf_callback);
 #ifdef HAVE_OCI8_DTRACE
 			connection->client_id = NULL;
 #endif
@@ -1944,6 +1972,7 @@ php_oci_connection *php_oci_do_connect_ex(char *username, int username_len, char
 				return NULL;
 			}
 			connection->is_persistent = 1;
+			ZVAL_UNDEF(&connection->taf_callback);
 #ifdef HAVE_OCI8_DTRACE
 			connection->client_id = NULL;
 #endif
@@ -1952,6 +1981,7 @@ php_oci_connection *php_oci_do_connect_ex(char *username, int username_len, char
 		connection = (php_oci_connection *) ecalloc(1, sizeof(php_oci_connection));
 		connection->hash_key = zend_string_dup(hashed_details.s, 0);
 		connection->is_persistent = 0;
+		ZVAL_UNDEF(&connection->taf_callback);
 #ifdef HAVE_OCI8_DTRACE
 		connection->client_id = NULL;
 #endif
@@ -2225,6 +2255,15 @@ static int php_oci_connection_close(php_oci_connection *connection)
 		connection->client_id = NULL;
 	}
 #endif /* HAVE_OCI8_DTRACE */
+
+	if (!Z_ISUNDEF(connection->taf_callback)) {
+		/* If it's NULL, then its value should be freed already */
+		if (!Z_ISNULL(connection->taf_callback)) {
+			zval_ptr_dtor(&connection->taf_callback);
+		}
+		ZVAL_UNDEF(&connection->taf_callback);
+	}
+
 	pefree(connection, connection->is_persistent);
 	connection = NULL;
 	OCI_G(in_call) = in_call_save;
@@ -2667,6 +2706,11 @@ static int php_oci_persistent_helper(zval *zv)
 	if (le->type == le_pconnection) {
 		connection = (php_oci_connection *)le->ptr;

+		/* Remove TAF callback function as it's bound to current request */
+		if (connection->used_this_request && !Z_ISUNDEF(connection->taf_callback) && !Z_ISNULL(connection->taf_callback)) {
+			php_oci_unregister_taf_callback(connection);
+		}
+
 		if (!connection->used_this_request && OCI_G(persistent_timeout) != -1) {
 #ifdef HAVE_OCI8_DTRACE
 			if (DTRACE_OCI8_CONNECT_EXPIRY_ENABLED()) {
@@ -12,7 +12,7 @@
   | obtain it through the world-wide-web, please send a note to          |
   | license@php.net so we can mail you a copy immediately.               |
   +----------------------------------------------------------------------+
-   | Authors: Stig Sæther Bakken <ssb@php.net>                            |
+   | Authors: Stig Sæther Bakken <ssb@php.net>                            |
   |          Thies C. Arntzen <thies@thieso.net>                         |
   |                                                                      |
   | Collection support by Andy Sautins <asautins@veripost.net>           |
@@ -0,0 +1,163 @@
+/*
+   +----------------------------------------------------------------------+
+   | PHP Version 7                                                        |
+   +----------------------------------------------------------------------+
+   | Copyright (c) 1997-2017 The PHP Group                                |
+   +----------------------------------------------------------------------+
+   | This source file is subject to version 3.01 of the PHP license,      |
+   | that is bundled with this package in the file LICENSE, and is        |
+   | available through the world-wide-web at the following url:           |
+   | http://www.php.net/license/3_01.txt                                  |
+   | If you did not receive a copy of the PHP license and are unable to   |
+   | obtain it through the world-wide-web, please send a note to          |
+   | license@php.net so we can mail you a copy immediately.               |
+   +----------------------------------------------------------------------+
+   | Authors: Stig Sæther Bakken <ssb@php.net>                            |
+   |          Thies C. Arntzen <thies@thieso.net>                         |
+   |                                                                      |
+   | Collection support by Andy Sautins <asautins@veripost.net>           |
+   | Temporary LOB support by David Benson <dbenson@mancala.com>          |
+   | ZTS per process OCIPLogon by Harald Radi <harald.radi@nme.at>        |
+   |                                                                      |
+   | Redesigned by: Antony Dovgal <antony@zend.com>                       |
+   |                Andi Gutmans <andi@zend.com>                          |
+   |                Wez Furlong <wez@omniti.com>                          |
+   +----------------------------------------------------------------------+
+*/
+
+
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include "php.h"
+#include "ext/standard/info.h"
+#include "php_ini.h"
+
+#if HAVE_OCI8
+
+#include "php_oci8.h"
+#include "php_oci8_int.h"
+
+/* {{{ callback_fn() 
+   OCI TAF callback function, calling userspace function */
+sb4 callback_fn(void *svchp, void *envhp, void *fo_ctx, ub4 fo_type, ub4 fo_event)
+{
+	/* Create zval */
+	zval retval, params[3];
+    php_oci_connection *connection = (php_oci_connection*)fo_ctx;
+
+	/* Default return value */
+	sb4 returnValue = 0;
+
+	/* Check if userspace callback function was unregistered */
+	if (Z_ISUNDEF(connection->taf_callback) || Z_ISNULL(connection->taf_callback)) {
+		return 0;
+	}
+
+	/* Initialize zval */
+	ZVAL_RES(&params[0], connection->id);
+	ZVAL_LONG(&params[1], fo_event);
+	ZVAL_LONG(&params[2], fo_type);
+
+	/* Call user function (if possible) */
+	if (call_user_function(EG(function_table), NULL, &connection->taf_callback, &retval, 3, params) == FAILURE) {
+		php_error_docref(NULL, E_WARNING, "Unable to call Oracle TAF callback function");
+	}
+
+	/* Set return value */
+	if (Z_TYPE(retval) == IS_LONG) {
+		returnValue = (sb4) Z_LVAL(retval);
+	}
+
+	/* Setting params[0] to null so ressource isn't destroyed on zval_dtor */
+	ZVAL_NULL(&params[0]);
+
+	/* Cleanup */
+	zval_dtor(&retval);
+	zval_dtor(&params[0]);
+	zval_dtor(&params[1]);
+	zval_dtor(&params[2]);
+
+	return returnValue;
+}
+/* }}} */
+
+/* {{{ php_oci_unregister_taf_callback()
+   Unregister the userspace callback function for Oracle TAF,
+   while keeping the OCI callback alive */
+int php_oci_unregister_taf_callback(php_oci_connection *connection)
+{
+	return php_oci_register_taf_callback(connection, NULL);
+}
+/* }}} */
+
+/* {{{ php_oci_register_taf_callback()
+   Register a callback function for Oracle TAF */
+int php_oci_register_taf_callback(php_oci_connection *connection, zval *callback)
+{
+	sword errstatus;
+	int registered = 0;
+
+	/* temporary failover callback structure */
+	OCIFocbkStruct failover;
+
+	if (!callback) {
+		/* Unregister callback */
+		if (Z_ISUNDEF(connection->taf_callback) || Z_ISNULL(connection->taf_callback)) {
+			return 0; // Nothing to unregister 
+		}
+
+		registered = 1;
+		zval_ptr_dtor(&connection->taf_callback);
+		ZVAL_NULL(&connection->taf_callback);
+	} else {
+		if (!Z_ISUNDEF(connection->taf_callback)) {
+			registered = 1;
+			if (!Z_ISNULL(connection->taf_callback)) {
+				zval_ptr_dtor(&connection->taf_callback);
+				ZVAL_NULL(&connection->taf_callback);
+			}
+		}
+
+		/* Set userspace callback function */
+		ZVAL_COPY(&connection->taf_callback, callback);
+	}
+
+	/* OCI callback function already registered */
+	if (registered) {
+		return 0;
+	}
+
+	/* set context */
+	failover.fo_ctx = connection;
+
+	/* set callback function */
+	failover.callback_function = &callback_fn;
+
+	/* do the registration */
+	PHP_OCI_CALL_RETURN(errstatus, OCIAttrSet, (connection->server, (ub4) OCI_HTYPE_SERVER, (void *) &failover, (ub4) 0, (ub4) OCI_ATTR_FOCBK, connection->err));
+
+	if (errstatus  != OCI_SUCCESS) {
+		zval_ptr_dtor(&connection->taf_callback);
+		ZVAL_UNDEF(&connection->taf_callback);
+		connection->errcode = php_oci_error(connection->err, errstatus);
+		return 1;
+	}
+
+	/* successful conclusion */
+	return 0;
+}
+/* }}} */
+
+#endif /* HAVE_OCI8 */
+
+/*
+ * Local variables:
+ * tab-width: 4
+ * c-basic-offset: 4
+ * End:
+ * vim600: noet sw=4 ts=4 fdm=marker
+ * vim<600: noet sw=4 ts=4
+ */
@@ -12,7 +12,7 @@
   | obtain it through the world-wide-web, please send a note to          |
   | license@php.net so we can mail you a copy immediately.               |
   +----------------------------------------------------------------------+
-   | Authors: Stig Sæther Bakken <ssb@php.net>                            |
+   | Authors: Stig Sæther Bakken <ssb@php.net>                            |
   |          Thies C. Arntzen <thies@thieso.net>                         |
   |                                                                      |
   | Collection support by Andy Sautins <asautins@veripost.net>           |
@@ -42,6 +42,68 @@
 #define OCI_STMT_CALL 10
 #endif

+/* {{{ proto bool oci_register_taf_callback( resource connection [, mixed callback] )
+   Register a callback function for Oracle Transparent Application Failover (TAF) */
+PHP_FUNCTION(oci_register_taf_callback)
+{
+	zval *z_connection;
+	php_oci_connection *connection;
+	zval *callback;
+	zend_string *callback_name;
+
+	if (zend_parse_parameters(ZEND_NUM_ARGS(), "r|z!", &z_connection, &callback) == FAILURE) {
+		return;
+	}
+
+	if (callback) {
+#if PHP_MAJOR_VERSION > 7 || (PHP_MAJOR_VERSION == 7 && PHP_MINOR_VERSION >= 2)    
+		if (!zend_is_callable(callback, 0, 0)) {
+			callback_name = zend_get_callable_name(callback);
+			php_error_docref(NULL, E_WARNING, "function '%s' is not callable", ZSTR_VAL(callback_name));
+			zend_string_release(callback_name);
+			RETURN_FALSE;
+		}
+#else
+		if (!zend_is_callable(callback, 0, &callback_name)) {
+			php_error_docref(NULL, E_WARNING, "function '%s' is not callable", ZSTR_VAL(callback_name));
+			zend_string_release(callback_name);
+			RETURN_FALSE;
+		}
+		zend_string_release(callback_name);
+#endif
+	}
+
+	PHP_OCI_ZVAL_TO_CONNECTION(z_connection, connection);
+
+	if (php_oci_register_taf_callback(connection, callback) == 0) {
+		RETURN_TRUE;
+	} else {
+		RETURN_FALSE;
+	}
+}
+/* }}} */
+
+/* {{{ proto bool oci_unregister_taf_callback( resource connection )
+ *    Unregister a callback function for Oracle Transparent Application Failover (TAF) */
+PHP_FUNCTION(oci_unregister_taf_callback)
+{
+	zval *z_connection;
+	php_oci_connection *connection;
+
+	if (zend_parse_parameters(ZEND_NUM_ARGS(), "r", &z_connection) == FAILURE) {
+		return;
+	}
+
+	PHP_OCI_ZVAL_TO_CONNECTION(z_connection, connection);
+
+	if (php_oci_unregister_taf_callback(connection) == 0) {
+		RETURN_TRUE;
+	} else {
+		RETURN_FALSE;
+	}
+}
+/* }}} */
+
 /* {{{ proto bool oci_define_by_name(resource stmt, string name, mixed &var [, int type])
   Define a PHP variable to an Oracle column by name */
 /* if you want to define a LOB/CLOB etc make sure you allocate it via OCINewDescriptor BEFORE defining!!! */
@@ -1553,6 +1615,9 @@ PHP_FUNCTION(oci_close)
 											 internally Zend engine increments
 											 RefCount value by 1 */
 		zend_list_close(connection->id);
+	
+	/* Unregister Oracle TAF */
+	php_oci_unregister_taf_callback(connection);

 	/* ZVAL_NULL(z_connection); */
 	
@@ -12,7 +12,7 @@
   | obtain it through the world-wide-web, please send a note to          |
   | license@php.net so we can mail you a copy immediately.               |
   +----------------------------------------------------------------------+
-   | Authors: Stig Sæther Bakken <ssb@php.net>                            |
+   | Authors: Stig Sæther Bakken <ssb@php.net>                            |
   |          Thies C. Arntzen <thies@thieso.net>                         |
   |                                                                      |
   | Collection support by Andy Sautins <asautins@veripost.net>           |
@@ -12,7 +12,7 @@
   | obtain it through the world-wide-web, please send a note to          |
   | license@php.net so we can mail you a copy immediately.               |
   +----------------------------------------------------------------------+
-   | Authors: Stig Sæther Bakken <ssb@php.net>                            |
+   | Authors: Stig Sæther Bakken <ssb@php.net>                            |
   |          Thies C. Arntzen <thies@thieso.net>                         |
   |                                                                      |
   | Collection support by Andy Sautins <asautins@veripost.net>           |
@@ -38,6 +38,13 @@
 #include "php_oci8.h"
 #include "php_oci8_int.h"

+#if defined(OCI_MAJOR_VERSION) && (OCI_MAJOR_VERSION > 10) && \
+	(defined(__x86_64__) || defined(__LP64__) || defined(_LP64) || defined(_WIN64))
+typedef ub8 oci_phpsized_int;
+#else
+typedef ub4 oci_phpsized_int;
+#endif
+
 /* {{{ php_oci_statement_create()
 Create statemend handle and allocate necessary resources */
 php_oci_statement *php_oci_statement_create(php_oci_connection *connection, char *query, int query_len)
@@ -997,10 +1004,10 @@ int php_oci_bind_post_exec(zval *data)
 				for (i = 0; i < (int) bind->array.current_length; i++) {
 					if ((i < (int) bind->array.old_length) && (entry = zend_hash_get_current_data(hash)) != NULL) {
 						zval_dtor(entry);
-						ZVAL_LONG(entry, ((ub4 *)(bind->array.elements))[i]);
+						ZVAL_LONG(entry, ((oci_phpsized_int *)(bind->array.elements))[i]);
 						zend_hash_move_forward(hash);
 					} else {
-						add_next_index_long(bind->zval, ((ub4 *)(bind->array.elements))[i]);
+						add_next_index_long(bind->zval, ((oci_phpsized_int *)(bind->array.elements))[i]);
 					}
 				}
 				break;
@@ -1153,14 +1160,8 @@ int php_oci_bind_by_name(php_oci_statement *statement, char *name, size_t name_l
 				return 1;
 			}
 			convert_to_long(param);
-#if defined(OCI_MAJOR_VERSION) && (OCI_MAJOR_VERSION > 10) &&			\
-	(defined(__x86_64__) || defined(__LP64__) || defined(_LP64) || defined(_WIN64)) 
-			bind_data = (ub8 *)&Z_LVAL_P(param);
-			value_sz = sizeof(ub8);
-#else
-			bind_data = (ub4 *)&Z_LVAL_P(param);
-			value_sz = sizeof(ub4);
-#endif
+			bind_data = (oci_phpsized_int *)&Z_LVAL_P(param);
+			value_sz = sizeof(oci_phpsized_int);
 			mode = OCI_DEFAULT;
 			break;
 			
@@ -1783,10 +1784,10 @@ php_oci_bind *php_oci_bind_array_helper_number(zval *var, zend_long max_table_le

 	bind = emalloc(sizeof(php_oci_bind));
 	ZVAL_UNDEF(&bind->parameter);
-	bind->array.elements		= (ub4 *)safe_emalloc(max_table_length, sizeof(ub4), 0);
+	bind->array.elements		= (oci_phpsized_int *)safe_emalloc(max_table_length, sizeof(oci_phpsized_int), 0);
 	bind->array.current_length	= zend_hash_num_elements(Z_ARRVAL_P(var));
 	bind->array.old_length		= bind->array.current_length;
-	bind->array.max_length		= sizeof(ub4);
+	bind->array.max_length		= sizeof(oci_phpsized_int);
 	bind->array.element_lengths	= safe_emalloc(max_table_length, sizeof(ub2), 0);
 	memset(bind->array.element_lengths, 0, max_table_length * sizeof(ub2));
 	bind->array.indicators		= NULL;
@@ -1794,14 +1795,14 @@ php_oci_bind *php_oci_bind_array_helper_number(zval *var, zend_long max_table_le
 	zend_hash_internal_pointer_reset(hash);
 	for (i = 0; i < max_table_length; i++) {
 		if (i < bind->array.current_length) {
-			bind->array.element_lengths[i] = sizeof(ub4);
+			bind->array.element_lengths[i] = sizeof(oci_phpsized_int);
 		}
 		if ((i < bind->array.current_length) && (entry = zend_hash_get_current_data(hash)) != NULL) {
 			convert_to_long_ex(entry);
-			((ub4 *)bind->array.elements)[i] = (ub4) Z_LVAL_P(entry);
+			((oci_phpsized_int *)bind->array.elements)[i] = (oci_phpsized_int) Z_LVAL_P(entry);
 			zend_hash_move_forward(hash);
 		} else {
-			((ub4 *)bind->array.elements)[i] = 0;
+			((oci_phpsized_int *)bind->array.elements)[i] = 0;
 		}
 	}
 	zend_hash_internal_pointer_reset(hash);
@@ -12,7 +12,7 @@ Use the OCI8 extension to access Oracle Database.  Use 'pecl install
 oci8' to install for PHP 7.  Use 'pecl install oci8-2.0.12' to install
 for PHP 5.2 - PHP 5.6.  Use 'pecl install oci8-1.4.10' to install for
 PHP 4.3.9 - PHP 5.1.  The OCI8 extension can be linked with Oracle
-client libraries from Oracle Database 12.1, 11, or 10.2.  These
+client libraries from Oracle Database 12, 11, or 10.2.  These
 libraries are found in your database installation, or in the free
 Oracle Instant Client from
 http://www.oracle.com/technetwork/database/features/instant-client/.
@@ -27,6 +27,12 @@ Interoperability Support" (ID 207303.1) for details.
  <email>sixd@php.net</email>
  <active>yes</active>
 </lead>
+ <lead>
+  <name>Tianfang Yang</name>
+  <user>tianfyan</user>
+  <email>tianfyan@php.net</email>
+  <active>yes</active>
+ </lead>
 <lead>
  <name>Antony Dovgal</name>
  <user>tony2001</user>
@@ -46,12 +52,12 @@ Interoperability Support" (ID 207303.1) for details.
  <active>no</active>
 </lead>

- <date>2017-04-12</date>
+ <date>2017-08-15</date>
 <time>12:00:00</time>

  <version>
-   <release>2.1.4</release>
-   <api>2.1.4</api>
+   <release>2.1.7</release>
+   <api>2.1.7</api>
  </version>
  <stability>
   <release>stable</release>
@@ -60,7 +66,7 @@ Interoperability Support" (ID 207303.1) for details.
  <license uri="http://www.php.net/license">PHP</license>
  <notes>
 This version is for PHP 7 only.
-Fixed uninitialized data causing random crash
+Added oci_unregister_taf_callback()    
  </notes>
 <contents>
  <dir name="/">
@@ -164,6 +170,7 @@ Fixed uninitialized data causing random crash
    <file name="bug71422.phpt" role="test" />
    <file name="bug71600.phpt" role="test" />
    <file name="bug72524.phpt" role="test" />
+    <file name="bug74625.phpt" role="test" />
    <file name="clientversion.phpt" role="test" />
    <file name="close.phpt" role="test" />
    <file name="coll_001.phpt" role="test" />
@@ -447,6 +454,7 @@ Fixed uninitialized data causing random crash
   <file name="oci8_interface.c" role="src" />
   <file name="oci8_lob.c" role="src" />
   <file name="oci8_statement.c" role="src" />
+   <file name="oci8_failover.c" role="src" />
   <file name="php_oci8.h" role="src" />
   <file name="php_oci8_int.h" role="src" />
   <file name="README" role="doc" />
@@ -468,6 +476,54 @@ Fixed uninitialized data causing random crash
 </extsrcrelease>
 <changelog>

+<release>
+  <version>
+   <release>2.1.6</release>
+   <api>2.1.6</api>
+  </version>
+  <stability>
+   <release>stable</release>
+   <api>stable</api>
+  </stability>
+  <license uri="http://www.php.net/license">PHP</license>
+  <notes>
+This version is for PHP 7 only.
+Fixed bug #74625 (Integer overflow in oci_bind_array_by_name). (Ingmar Runge)
+  </notes>
+</release>
+
+<release>   
+ <version>
+   <release>2.1.5</release>
+   <api>2.1.5</api>
+  </version>
+  <stability>
+   <release>stable</release>
+   <api>stable</api>
+  </stability>
+  <license uri="http://www.php.net/license">PHP</license>
+  <notes>
+This version is for PHP 7 only.
+Added TAF callback support (PR #2459, KoenigsKind) 
+  </notes>
+</release>   
+
+<release>
+  <version>
+   <release>2.1.4</release>
+   <api>2.1.4</api>
+  </version>
+  <stability>
+   <release>stable</release>
+   <api>stable</api>
+  </stability>
+  <license uri="http://www.php.net/license">PHP</license>
+  <notes>
+This version is for PHP 7 only.
+Fixed uninitialized data causing random crash
+  </notes>
+</release>
+
 <release>
  <version>
   <release>2.1.3</release>
@@ -12,7 +12,7 @@
   | obtain it through the world-wide-web, please send a note to          |
   | license@php.net so we can mail you a copy immediately.               |
   +----------------------------------------------------------------------+
-   | Authors: Stig Sæther Bakken <ssb@php.net>                            |
+   | Authors: Stig Sæther Bakken <ssb@php.net>                            |
   |          Thies C. Arntzen <thies@thieso.net>                         |
   |                                                                      |
   | Collection support by Andy Sautins <asautins@veripost.net>           |
@@ -43,11 +43,12 @@
 */
 #undef PHP_OCI8_VERSION
 #endif
-#define PHP_OCI8_VERSION "2.1.4"
+#define PHP_OCI8_VERSION "2.1.7"

 extern zend_module_entry oci8_module_entry;
 #define phpext_oci8_ptr &oci8_module_entry
 #define phpext_oci8_11g_ptr &oci8_module_entry
+#define phpext_oci8_12c_ptr &oci8_module_entry


 PHP_MINIT_FUNCTION(oci);
@@ -12,7 +12,7 @@
   | obtain it through the world-wide-web, please send a note to          |
   | license@php.net so we can mail you a copy immediately.               |
   +----------------------------------------------------------------------+
-   | Authors: Stig Sæther Bakken <ssb@php.net>                            |
+   | Authors: Stig Sæther Bakken <ssb@php.net>                            |
   |          Thies C. Arntzen <thies@thieso.net>                         |
   |                                                                      |
   | Collection support by Andy Sautins <asautins@veripost.net>           |
@@ -164,6 +164,8 @@ typedef struct {
 #ifdef HAVE_OCI8_DTRACE
 	char		   *client_id;					/* The oci_set_client_identifier() value */
 #endif
+
+	zval		    taf_callback;				/* The Oracle TAF callback function in the userspace */
 } php_oci_connection;
 /* }}} */

@@ -531,6 +533,13 @@ ZEND_BEGIN_MODULE_GLOBALS(oci) /* {{{ Module globals */
 	char		*edition;
 ZEND_END_MODULE_GLOBALS(oci) /* }}} */

+/* {{{ transparent failover related prototypes */
+
+int php_oci_register_taf_callback(php_oci_connection *connection, zval *callback);
+int php_oci_unregister_taf_callback(php_oci_connection *connection);
+
+/* }}} */
+
 #ifdef ZTS
 #define OCI_G(v) TSRMG(oci_globals_id, zend_oci_globals *, v)
 #else
@@ -0,0 +1,183 @@
+--TEST--
+Tests for LOBs with multibyte strings, reading them out in chunks
+(Doc Bug #70700)
+--CREDITS--
+Chuck Burgess
+ashnazg@php.net
+--SKIPIF--
+<?php
+if (!extension_loaded('mbstring')) die('skip mbstring is not enabled');
+$target_dbs = array('oracledb' => true, 'timesten' => false);  // test runs on these DBs
+require(dirname(__FILE__).'/skipif.inc');
+?> 
+--ENV--
+NLS_LANG=.AL32UTF8
+--FILE--
+<?php
+require(dirname(__FILE__).'/connect.inc');
+
+
+$stmt = oci_parse($c, 'DROP TABLE oci8_bug70700');
+@oci_execute($stmt);
+oci_free_statement($stmt);
+$stmt = oci_parse($c, 'CREATE TABLE oci8_bug70700 (id NUMBER, data CLOB)');
+oci_execute($stmt);
+oci_free_statement($stmt);
+
+
+$id = null;
+$insert = oci_parse($c, 'INSERT INTO oci8_bug70700 (id, data) VALUES (:id, :data)');
+oci_bind_by_name($insert, ':id', $id);
+$select = oci_parse($c, "SELECT data FROM oci8_bug70700 WHERE id = :id");
+oci_bind_by_name($select, ':id', $id);
+
+
+echo PHP_EOL, 'Test 1: j', PHP_EOL;
+$string1 = 'abc' . str_repeat('j', 1000000) . 'xyz';
+$id = 1;
+$desc = oci_new_descriptor($c, OCI_D_LOB);
+oci_bind_by_name($insert, ':data', $desc, -1, OCI_B_CLOB);
+$desc->writeTemporary($string1, OCI_TEMP_CLOB);
+oci_execute($insert);
+$desc->save($string1);
+oci_commit($c);
+$desc->close();
+oci_bind_by_name($select, ':id', $id);
+oci_execute($select);
+$row = oci_fetch_array($select, OCI_ASSOC);
+$lob = $row['DATA'];
+$fh = fopen('php://temp', 'rw');
+while (! $lob->eof()) {
+    $data = $lob->read(8192);             // read($characters), not read($bytes)
+    fwrite($fh, $data, strlen($data));    // fwrite(a, b, $bytes)
+}
+$lob->free();
+rewind($fh);
+$stream1a = stream_get_contents($fh);
+fclose($fh);
+$start1a = mb_substr($stream1a, 0, 10);
+$ending1a = mb_substr($stream1a, -10);
+echo 'size of string1 is ', strlen($string1), ' bytes, ', mb_strlen($string1), ' chars.', PHP_EOL;
+echo 'size of stream1a is ', strlen($stream1a), ' bytes, ', mb_strlen($stream1a), ' chars.', PHP_EOL;
+echo 'beg of stream1a is ', $start1a, PHP_EOL;
+echo 'end of stream1a is ', $ending1a, PHP_EOL;
+
+
+echo PHP_EOL, 'Test 2: £', PHP_EOL;
+$string2 = 'abc' . str_repeat('£', 4094) . 'xyz';
+$id = 2;
+$desc = oci_new_descriptor($c, OCI_D_LOB);
+oci_bind_by_name($insert, ':data', $desc, -1, OCI_B_CLOB);
+$desc->writeTemporary($string2, OCI_TEMP_CLOB);
+oci_execute($insert);
+$desc->save($string2);
+oci_commit($c);
+$desc->close();
+oci_bind_by_name($select, ':id', $id);
+oci_execute($select);
+$row = oci_fetch_array($select, OCI_ASSOC);
+$lob = $row['DATA'];
+$fh = fopen('php://temp', 'rw');
+while (! $lob->eof()) {
+    $data = $lob->read(8192);             // read($characters), not read($bytes)
+    fwrite($fh, $data, strlen($data));    // fwrite(a, b, $bytes)
+}
+$lob->free();
+rewind($fh);
+$stream2a = stream_get_contents($fh);
+fclose($fh);
+$start2a = mb_substr($stream2a, 0, 10);
+$ending2a = mb_substr($stream2a, -10);
+echo 'size of string2 is ', strlen($string2), ' bytes, ', mb_strlen($string2), ' chars.', PHP_EOL;
+echo 'size of stream2a is ', strlen($stream2a), ' bytes, ', mb_strlen($stream2a), ' chars.', PHP_EOL;
+echo 'beg of stream2a is ', $start2a, PHP_EOL;
+echo 'end of stream2a is ', $ending2a, PHP_EOL;
+
+
+echo PHP_EOL, 'Test 3: Җ', PHP_EOL;
+$string3 = 'abc' . str_repeat('Җ', 4094) . 'xyz';
+$id = 3;
+$desc = oci_new_descriptor($c, OCI_D_LOB);
+oci_bind_by_name($insert, ':data', $desc, -1, OCI_B_CLOB);
+$desc->writeTemporary($string3, OCI_TEMP_CLOB);
+oci_execute($insert);
+$desc->save($string3);
+oci_commit($c);
+$desc->close();
+oci_bind_by_name($select, ':id', $id);
+oci_execute($select);
+$row = oci_fetch_array($select, OCI_ASSOC);
+$lob = $row['DATA'];
+$fh = fopen('php://temp', 'rw');
+while (! $lob->eof()) {
+    $data = $lob->read(8192);             // read($characters), not read($bytes)
+    fwrite($fh, $data, strlen($data));    // fwrite(a, b, $bytes)
+}
+$lob->free();
+rewind($fh);
+$stream3a = stream_get_contents($fh);
+fclose($fh);
+$start3a = mb_substr($stream3a, 0, 10);
+$ending3a = mb_substr($stream3a, -10);
+echo 'size of string3 is ', strlen($string3), ' bytes, ', mb_strlen($string3), ' chars.', PHP_EOL;
+echo 'size of stream3a is ', strlen($stream3a), ' bytes, ', mb_strlen($stream3a), ' chars.', PHP_EOL;
+echo 'beg of stream3a is ', $start3a, PHP_EOL;
+echo 'end of stream3a is ', $ending3a, PHP_EOL;
+
+
+echo PHP_EOL, 'Test 4: の', PHP_EOL;
+$string4 = 'abc' . str_repeat('の', 2729) . 'xyz';
+$id = 4;
+$desc = oci_new_descriptor($c, OCI_D_LOB);
+oci_bind_by_name($insert, ':data', $desc, -1, OCI_B_CLOB);
+$desc->writeTemporary($string4, OCI_TEMP_CLOB);
+oci_execute($insert);
+$desc->save($string4);
+oci_commit($c);
+$desc->close();
+oci_bind_by_name($select, ':id', $id);
+oci_execute($select);
+$row = oci_fetch_array($select, OCI_ASSOC);
+$lob = $row['DATA'];
+$fh = fopen('php://temp', 'rw');
+while (! $lob->eof()) {
+    $data = $lob->read(8192);             // read($characters), not read($bytes)
+    fwrite($fh, $data, strlen($data));    // fwrite(a, b, $bytes)
+}
+$lob->free();
+rewind($fh);
+$stream4a = stream_get_contents($fh);
+fclose($fh);
+$start4a = mb_substr($stream4a, 0, 10);
+$ending4a = mb_substr($stream4a, -10);
+echo 'size of string4 is ', strlen($string4), ' bytes, ', mb_strlen($string4), ' chars.', PHP_EOL;
+echo 'size of stream4a is ', strlen($stream4a), ' bytes, ', mb_strlen($stream4a), ' chars.', PHP_EOL;
+echo 'beg of stream4a is ', $start4a, PHP_EOL;
+echo 'end of stream4a is ', $ending4a, PHP_EOL;
+
+--EXPECTF--
+
+Test 1: j
+size of string1 is 1000006 bytes, 1000006 chars.
+size of stream1a is 1000006 bytes, 1000006 chars.
+beg of stream1a is abcjjjjjjj
+end of stream1a is jjjjjjjxyz
+
+Test 2: £
+size of string2 is 8194 bytes, 4100 chars.
+size of stream2a is 8194 bytes, 4100 chars.
+beg of stream2a is abc£££££££
+end of stream2a is £££££££xyz
+
+Test 3: Җ
+size of string3 is 8194 bytes, 4100 chars.
+size of stream3a is 8194 bytes, 4100 chars.
+beg of stream3a is abcҖҖҖҖҖҖҖ
+end of stream3a is ҖҖҖҖҖҖҖxyz
+
+Test 4: の
+size of string4 is 8193 bytes, 2735 chars.
+size of stream4a is 8193 bytes, 2735 chars.
+beg of stream4a is abcののののののの
+end of stream4a is のののののののxyz
+
@@ -1,96 +1,96 @@
--TEST--
-Bug #72524 (Binding null values triggers ORA-24816 error)
--SKIPIF--
-<?php
-$target_dbs = array('oracledb' => true, 'timesten' => true);  // test runs on these DBs
-require(dirname(__FILE__).'/skipif.inc');
-?>
--FILE--
-
-<?php
-
-require(dirname(__FILE__).'/connect.inc');
-
-// Initialize
-
-$stmtarray = array(
-         "CREATE TABLE mytable (clob_col CLOB DEFAULT NULL, varchar2_col VARCHAR2(255) DEFAULT NULL)"
-);
-
-oci8_test_sql_execute($c, $stmtarray);
-
-// Run test
-
-$sql = "INSERT INTO mytable VALUES (:clob_col, :varchar2_col)";
-
-echo "Test 1 - P1 Value: NULL  P1 Length: Default  P1 Type: Default  P2 Value: NULL P2 Length: Default  P2 Type: Default\n";
-$stmt = oci_parse($c, $sql);
-
-$clob = NULL;
-$varchar2 = NULL;
-oci_bind_by_name($stmt, ':clob_col', $clob);
-oci_bind_by_name($stmt, ':varchar2_col', $varchar2);
-
-var_dump(oci_execute($stmt));
-
-echo "Test 2 - P1 Value: ''    P1 Length: Default  P1 Type: Default  P2 Value: ''   P2 Length: Default  P2 Type: Default\n";
-
-$clob = '';
-$varchar2 = '';
-oci_bind_by_name($stmt, ':clob_col', $clob);
-oci_bind_by_name($stmt, ':varchar2_col', $varchar2);
-
-var_dump(oci_execute($stmt));
-
-echo "Test 3 - P1 Value: 'abc' P1 Length: 0        P1 Type: Default  P2 Value: ''   P2 Length: 0        P2 Type: Default\n";
-$clob = 'abc';
-$varchar2 = 'abc';
-oci_bind_by_name($stmt, ':clob_col', $clob, 0);
-oci_bind_by_name($stmt, ':varchar2_col', $varchar2, 0);
-
-var_dump(oci_execute($stmt));
-
-echo "Test 4 - P1 Value: NULL  P1 Length: -1       P1 Type: SQLT_LNG P2 Value: NULL P2 Length: -1       P2 Type:Default\n";
-$clob = NULL;
-$varchar2 = NULL;
-oci_bind_by_name($stmt, ':clob_col', $clob, -1, SQLT_LNG);
-oci_bind_by_name($stmt, ':varchar2_col', $varchar2, -1, SQLT_LNG);
-
-var_dump(oci_execute($stmt));
-
-echo "Test 5 - P1 Value: NULL  P1 Length: 0        P1 Type: SQLT_LNG P2 Value: NULL P2 Length: 0        P2 Type:Default\n";
-$clob = NULL;
-$varchar2 = NULL;
-oci_bind_by_name($stmt, ':clob_col', $clob, 0, SQLT_LNG);
-oci_bind_by_name($stmt, ':varchar2_col', $varchar2, 0, SQLT_LNG);
-
-
-var_dump(oci_execute($stmt));
-
-// Cleanup
-
-$stmtarray = array(
-    "DROP TABLE mytable"
-);
-
-oci8_test_sql_execute($c, $stmtarray);
-
-?>
-===DONE===
-<?php exit(0); ?>
--EXPECTF--
-Test 1 - P1 Value: NULL  P1 Length: Default  P1 Type: Default  P2 Value: NULL P2 Length: Default  P2 Type: Default
-bool(true)
-Test 2 - P1 Value: ''    P1 Length: Default  P1 Type: Default  P2 Value: ''   P2 Length: Default  P2 Type: Default
-bool(true)
-Test 3 - P1 Value: 'abc' P1 Length: 0        P1 Type: Default  P2 Value: ''   P2 Length: 0        P2 Type: Default
-bool(true)
-Test 4 - P1 Value: NULL  P1 Length: -1       P1 Type: SQLT_LNG P2 Value: NULL P2 Length: -1       P2 Type:Default
-
-Warning: oci_execute(): ORA-24816: %s in %s on line %d
-bool(false)
-Test 5 - P1 Value: NULL  P1 Length: 0        P1 Type: SQLT_LNG P2 Value: NULL P2 Length: 0        P2 Type:Default
-
-Warning: oci_execute(): ORA-24816: %s in %s on line %d
-bool(false)
-===DONE===
+--TEST--
+Bug #72524 (Binding null values triggers ORA-24816 error)
+--SKIPIF--
+<?php
+$target_dbs = array('oracledb' => true, 'timesten' => true);  // test runs on these DBs
+require(dirname(__FILE__).'/skipif.inc');
+?>
+--FILE--
+
+<?php
+
+require(dirname(__FILE__).'/connect.inc');
+
+// Initialize
+
+$stmtarray = array(
+         "CREATE TABLE mytable (clob_col CLOB DEFAULT NULL, varchar2_col VARCHAR2(255) DEFAULT NULL)"
+);
+
+oci8_test_sql_execute($c, $stmtarray);
+
+// Run test
+
+$sql = "INSERT INTO mytable VALUES (:clob_col, :varchar2_col)";
+
+echo "Test 1 - P1 Value: NULL  P1 Length: Default  P1 Type: Default  P2 Value: NULL P2 Length: Default  P2 Type: Default\n";
+$stmt = oci_parse($c, $sql);
+
+$clob = NULL;
+$varchar2 = NULL;
+oci_bind_by_name($stmt, ':clob_col', $clob);
+oci_bind_by_name($stmt, ':varchar2_col', $varchar2);
+
+var_dump(oci_execute($stmt));
+
+echo "Test 2 - P1 Value: ''    P1 Length: Default  P1 Type: Default  P2 Value: ''   P2 Length: Default  P2 Type: Default\n";
+
+$clob = '';
+$varchar2 = '';
+oci_bind_by_name($stmt, ':clob_col', $clob);
+oci_bind_by_name($stmt, ':varchar2_col', $varchar2);
+
+var_dump(oci_execute($stmt));
+
+echo "Test 3 - P1 Value: 'abc' P1 Length: 0        P1 Type: Default  P2 Value: ''   P2 Length: 0        P2 Type: Default\n";
+$clob = 'abc';
+$varchar2 = 'abc';
+oci_bind_by_name($stmt, ':clob_col', $clob, 0);
+oci_bind_by_name($stmt, ':varchar2_col', $varchar2, 0);
+
+var_dump(oci_execute($stmt));
+
+echo "Test 4 - P1 Value: NULL  P1 Length: -1       P1 Type: SQLT_LNG P2 Value: NULL P2 Length: -1       P2 Type:Default\n";
+$clob = NULL;
+$varchar2 = NULL;
+oci_bind_by_name($stmt, ':clob_col', $clob, -1, SQLT_LNG);
+oci_bind_by_name($stmt, ':varchar2_col', $varchar2, -1, SQLT_LNG);
+
+var_dump(oci_execute($stmt));
+
+echo "Test 5 - P1 Value: NULL  P1 Length: 0        P1 Type: SQLT_LNG P2 Value: NULL P2 Length: 0        P2 Type:Default\n";
+$clob = NULL;
+$varchar2 = NULL;
+oci_bind_by_name($stmt, ':clob_col', $clob, 0, SQLT_LNG);
+oci_bind_by_name($stmt, ':varchar2_col', $varchar2, 0, SQLT_LNG);
+
+
+var_dump(oci_execute($stmt));
+
+// Cleanup
+
+$stmtarray = array(
+    "DROP TABLE mytable"
+);
+
+oci8_test_sql_execute($c, $stmtarray);
+
+?>
+===DONE===
+<?php exit(0); ?>
+--EXPECTF--
+Test 1 - P1 Value: NULL  P1 Length: Default  P1 Type: Default  P2 Value: NULL P2 Length: Default  P2 Type: Default
+bool(true)
+Test 2 - P1 Value: ''    P1 Length: Default  P1 Type: Default  P2 Value: ''   P2 Length: Default  P2 Type: Default
+bool(true)
+Test 3 - P1 Value: 'abc' P1 Length: 0        P1 Type: Default  P2 Value: ''   P2 Length: 0        P2 Type: Default
+bool(true)
+Test 4 - P1 Value: NULL  P1 Length: -1       P1 Type: SQLT_LNG P2 Value: NULL P2 Length: -1       P2 Type:Default
+
+Warning: oci_execute(): ORA-24816: %s in %s on line %d
+bool(false)
+Test 5 - P1 Value: NULL  P1 Length: 0        P1 Type: SQLT_LNG P2 Value: NULL P2 Length: 0        P2 Type:Default
+
+Warning: oci_execute(): ORA-24816: %s in %s on line %d
+bool(false)
+===DONE===
@@ -0,0 +1,65 @@
+--TEST--
+Bug #74625 (Integer overflow in oci_bind_array_by_name)
+--SKIPIF--
+<?php
+if (!extension_loaded('oci8')) die ("skip no oci8 extension");
+?>
+--FILE--
+<?php
+require(dirname(__FILE__).'/connect.inc');
+
+// Initialization
+
+$stmtarray = array(
+        "CREATE TABLE bug74625_tab (NAME NUMBER)",
+        "CREATE OR REPLACE PACKAGE PKG74625 AS
+          TYPE ARRTYPE IS TABLE OF NUMBER INDEX BY BINARY_INTEGER;
+          PROCEDURE iobind(c1 IN OUT ARRTYPE);
+         END PKG74625;",
+        "CREATE OR REPLACE PACKAGE BODY PKG74625 AS
+          PROCEDURE iobind(c1 IN OUT ARRTYPE) IS
+          BEGIN
+           FOR i IN 1..5 LOOP
+            c1(i) := c1(i) * 2;
+           END LOOP;
+          END iobind;
+         END PKG74625;"
+);
+
+oci8_test_sql_execute($c, $stmtarray);
+
+$statement = oci_parse($c, "BEGIN pkg74625.iobind(:c1); END;");
+
+$array = Array(-1,-2,-3,-4,-5);
+
+oci_bind_array_by_name($statement, ":c1", $array, 5, -1, SQLT_INT);
+
+oci_execute($statement);
+
+var_dump($array);
+
+// Cleanup
+$stmtarray = array(
+    "DROP TABLE bug74625_tab",
+    "DROP PACKAGE PKG74625"
+);
+
+oci8_test_sql_execute($c, $stmtarray);
+
+?>
+===DONE===
+<?php exit(0); ?>
+--EXPECTF--
+array(5) {
+  [0]=>
+  int(-2)
+  [1]=>
+  int(-4)
+  [2]=>
+  int(-6)
+  [3]=>
+  int(-8)
+  [4]=>
+  int(-10)
+}
+===DONE===
@@ -13,7 +13,7 @@ require(dirname(__FILE__).'/skipif.inc');

 require dirname(__FILE__)."/connect.inc";

-$ora_sql = "DROP TYPE ".$type_name;;
+$ora_sql = "DROP TYPE ".$type_name;
 $statement = oci_parse($c,$ora_sql);
@oci_execute($statement);

@@ -29,7 +29,7 @@ echo "Test 1\n";

 // Make errors throw exceptions

-set_error_handler(create_function('$x, $y', 'throw new Exception($y, $x);'));
+set_error_handler(function($x, $y) { throw new Exception($y, $x); });

 try
 {
@@ -29,7 +29,7 @@ echo "Test 1\n";

 // Make errors throw exceptions

-set_error_handler(create_function('$x, $y', 'throw new Exception($y, $x);'));
+set_error_handler(function($x, $y) { throw new Exception($y, $x); });

 try
 {
@@ -29,7 +29,7 @@ echo "Test 1\n";

 // Make errors throw exceptions

-set_error_handler(create_function('$x, $y', 'throw new Exception($y, $x);'));
+set_error_handler(function($x, $y) { throw new Exception($y, $x); });

 try
 {
@@ -29,7 +29,7 @@ echo "Test 1\n";

 // Make errors throw exceptions

-set_error_handler(create_function('$x, $y', 'throw new Exception($y, $x);'));
+set_error_handler(function($x, $y) { throw new Exception($y, $x); });

 try
 {
@@ -29,7 +29,7 @@ echo "Test 1\n";

 // Make errors throw exceptions

-set_error_handler(create_function('$x, $y', 'throw new Exception($y, $x);'));
+set_error_handler(function($x, $y) { throw new Exception($y, $x); });

 try
 {
@@ -29,7 +29,7 @@ echo "Test 1\n";

 // Make errors throw exceptions

-set_error_handler(create_function('$x, $y', 'throw new Exception($y, $x);'));
+set_error_handler(function($x, $y) { throw new Exception($y, $x); });

 try
 {
@@ -57,11 +57,11 @@ function get_attr($conn)
 ?>
 --EXPECT--
 **Test 1.1 - Default values for the attribute **************
-The value of DRIVER_NAME is PHP OCI8 : 2.1.3
+The value of DRIVER_NAME is PHP OCI8 : 2.1.7

 ***Test 1.2 - Get the values from different connections **************
 Testing with oci_pconnect()
-The value of DRIVER_NAME is PHP OCI8 : 2.1.3
+The value of DRIVER_NAME is PHP OCI8 : 2.1.7
 Testing with oci_new_connect()
-The value of DRIVER_NAME is PHP OCI8 : 2.1.3
+The value of DRIVER_NAME is PHP OCI8 : 2.1.7
 Done
@@ -29,9 +29,9 @@ for ($i = 0; $i < NUMLOBS; $i++) {
 }

 for ($i = 0; $i < NUMLOBS; $i++) {
-	echo "Row $i Size:  " . $row[$i][0]->size() . "\n";;
+	echo "Row $i Size:  " . $row[$i][0]->size() . "\n";
 	echo "Pos 1: " . $row[$i][0]->tell() . "\n";
-	echo "Data:  " . $row[$i][0]->read(5) . "\n";;
+	echo "Data:  " . $row[$i][0]->read(5) . "\n";
 	echo "Pos 2: " . $row[$i][0]->tell() . "\n";
 	echo "Data:  " . $row[$i][0]->read(12) . "\n";
 }