Fix date

Set versions
[ci skip] Update NEWS
2026-11-09 10:10:50 +00:00 · 2018-03-27 16:03:42 +02:00 · 2018-03-27 15:07:12 +02:00 · 2018-03-27 14:26:06 +02:00 · 2018-03-27 14:25:24 +02:00 · 2018-03-27 14:24:43 +02:00
311 changed files with 8969 additions and 4508 deletions
@@ -18,13 +18,12 @@ clone_depth: 64

 cache:
        - c:\build-cache
-        - c:\build-cache\sdk -> .appveyor.yml

 environment:
        PHP_BUILD_CACHE_BASE_DIR: c:\build-cache  
        PHP_BUILD_OBJ_DIR: c:\obj
        PHP_BUILD_CACHE_SDK_DIR: c:\build-cache\sdk
-        PHP_BUILD_SDK_BRANCH: php-sdk-2.0.7
+        PHP_BUILD_SDK_BRANCH: php-sdk-2.0.13
        # ext and env setup for tests
        #MYSQL_TEST_PASSWD: Password12!
        #MYSQL_TEST_USER: root
@@ -1,16 +1,35 @@
-; http://editorconfig.org/
+# http://editorconfig.org/

 root = true

-[*.{c,h}]
-charset                  = UTF-8
-end_of_line              = LF
+[*.{c,h,awk,w32,bat,mk,frag}]
+charset                  = utf-8
+end_of_line              = lf
 indent_size              = 4
 indent_style             = tab
-insert_final_newline     = true
 tab_width                = 4
 trim_trailing_whitespace = true
+insert_final_newline     = true

-[*.yml]
+[*.{php,phpt}]
+charset                  = utf-8
+end_of_line              = lf
+indent_size              = 4
+indent_style             = space
+trim_trailing_whitespace = true
+insert_final_newline     = true
+
+[*.{yml,m4,sh}]
+charset                  = utf-8
+end_of_line              = lf
 indent_size              = 2
 indent_style             = space
+trim_trailing_whitespace = true
+insert_final_newline     = true
+
+[*.md]
+charset                  = utf-8
+end_of_line              = lf
+indent_style             = space
+trim_trailing_whitespace = false
+insert_final_newline     = true
@@ -15,11 +15,8 @@ ext/dba/libflatfile/flatfile.c  ident
 ext/dba/libcdb/cdb_make.c       ident
 ext/dba/libcdb/cdb.c            ident
 ext/filter/filter.c             ident
-ext/zip/php_zip.c               ident
 README.input_filter             ident
 run-tests.php                   ident
-sapi/nsapi/nsapi.c              ident
-sapi/continuity/capi.c          ident
 Zend/RFCs/002.txt               ident
 Zend/RFCs/003.txt               ident
 ext/exif/exif.c                 ident
@@ -32,7 +29,6 @@ UPGRADING.INTERNALS             merge=NEWS
 /ext/bz2/tests/with_strings.phpt	-crlf
 /ext/dom/tests/bug40836.phpt	-crlf
 /ext/dom/tests/domelement.phpt	-crlf
-/ext/ereg/tests/eregi_basic_002.phpt	-crlf
 /ext/iconv/tests/iconv004.phpt	-crlf
 /ext/iconv/tests/iconv_basic.phpt	-crlf
 /ext/iconv/tests/iconv_strpos.phpt	-crlf
@@ -262,9 +262,7 @@ pear/phpize
 pear/run-tests
 pear/php-config
 pear/scripts
-sapi/apache/libphp7.module
 sapi/apache2handler/libphp7.module
-sapi/apache_hooks/libphp7.module
 sapi/cgi/php-cgi
 sapi/cgi/php-cgi.1
 sapi/cli/php.1
@@ -1,3 +1,4 @@
+dist: trusty
 language: c
 sudo: false
 addons:
@@ -47,7 +47,7 @@ MAINTENANCE:         Maintained
 STATUS:              Working
 -------------------------------------------------------------------------------
 EXTENSION:           fpm
-PRIMARY MAINTAINER:  Antony Dovgal <tony2001@php.net>, Jerome Loyet <fat@php.net>
+PRIMARY MAINTAINER:  Jakub Zelenka <bukka@php.net>
 MAINTENANCE:         Maintained
 STATUS:              Working
 SINCE:               5.3.3
@@ -5,7 +5,7 @@ INSTALL_DATA = $(INSTALL) -m 644
 DEFS = -DPHP_ATOM_INC -I$(top_builddir)/include -I$(top_builddir)/main -I$(top_srcdir)
 COMMON_FLAGS = $(DEFS) $(INCLUDES) $(EXTRA_INCLUDES) $(CPPFLAGS) $(PHP_FRAMEWORKPATH)

-all: $(all_targets) 
+all: $(all_targets)
 	@echo
 	@echo "Build complete."
 	@echo "Don't forget to run 'make test'."
@@ -112,13 +112,13 @@ test: all
 clean:
 	find . -name \*.gcno -o -name \*.gcda | xargs rm -f
 	find . -name \*.lo -o -name \*.o | xargs rm -f
-	find . -name \*.la -o -name \*.a | xargs rm -f 
+	find . -name \*.la -o -name \*.a | xargs rm -f
 	find . -name \*.so | xargs rm -f
 	find . -name .libs -a -type d|xargs rm -rf
 	rm -f libphp$(PHP_MAJOR_VERSION).la $(SAPI_CLI_PATH) $(SAPI_CGI_PATH) $(SAPI_MILTER_PATH) $(SAPI_LITESPEED_PATH) $(SAPI_FPM_PATH) $(OVERALL_TARGET) modules/* libs/*

 distclean: clean
-	rm -f Makefile config.cache config.log config.status Makefile.objects Makefile.fragments libtool main/php_config.h main/internal_functions_cli.c main/internal_functions.c stamp-h sapi/apache/libphp$(PHP_MAJOR_VERSION).module sapi/apache_hooks/libphp$(PHP_MAJOR_VERSION).module buildmk.stamp Zend/zend_dtrace_gen.h Zend/zend_dtrace_gen.h.bak Zend/zend_config.h TSRM/tsrm_config.h
+	rm -f Makefile config.cache config.log config.status Makefile.objects Makefile.fragments libtool main/php_config.h main/internal_functions_cli.c main/internal_functions.c stamp-h buildmk.stamp Zend/zend_dtrace_gen.h Zend/zend_dtrace_gen.h.bak Zend/zend_config.h TSRM/tsrm_config.h
 	rm -f php7.spec main/build-defs.h scripts/phpize
 	rm -f ext/date/lib/timelib_config.h ext/mbstring/oniguruma/config.h ext/mbstring/libmbfl/config.h ext/oci8/oci8_dtrace_gen.h ext/oci8/oci8_dtrace_gen.h.bak
 	rm -f scripts/man1/phpize.1 scripts/php-config scripts/man1/php-config.1 sapi/cli/php.1 sapi/cgi/php-cgi.1 ext/phar/phar.1 ext/phar/phar.phar.1
@@ -135,7 +135,7 @@ prof-gen:

 prof-clean:
 	find . -name \*.lo -o -name \*.o | xargs rm -f
-	find . -name \*.la -o -name \*.a | xargs rm -f 
+	find . -name \*.la -o -name \*.a | xargs rm -f
 	find . -name \*.so | xargs rm -f
 	rm -f libphp$(PHP_MAJOR_VERSION).la $(SAPI_CLI_PATH) $(SAPI_CGI_PATH) $(SAPI_MILTER_PATH) $(SAPI_LITESPEED_PATH) $(SAPI_FPM_PATH) $(OVERALL_TARGET) modules/* libs/*

@@ -1,5 +1,260 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
+29 Mar 2018 PHP 7.0.29
+
+- FPM:
+  . Fixed bug #75605 (Dumpable FPM child processes allow bypassing opcache
+    access controls). (Jakub Zelenka)
+
+01 Mar 2018 PHP 7.0.28
+
+- Standard:
+  . Fixed bug #75981 (stack-buffer-overflow while parsing HTTP response). (Stas)
+
+04 Jan 2018 PHP 7.0.27
+
+- CLI Server:
+  . Fixed bug #60471 (Random "Invalid request (unexpected EOF)" using a router
+    script). (SammyK)
+
+- Core:
+  . Fixed bug #75384 (PHP seems incompatible with OneDrive files on demand).
+    (Anatol)
+  . Fixed bug #75573 (Segmentation fault in 7.1.12 and 7.0.26). (Laruence)
+
+- FPM:
+  . Fixed bug #64938 (libxml_disable_entity_loader setting is shared between
+    requests). (Remi)
+
+- GD:
+  . Fixed bug #75571 (Potential infinite loop in gdImageCreateFromGifCtx). (cmb)
+
+- Opcache:
+  . Fixed bug #75579 (Interned strings buffer overflow may cause crash).
+    (Dmitry)
+
+- PCRE:
+  . Fixed bug #74183 (preg_last_error not returning error code after error).
+    (Andrew Nester)
+
+- Phar:
+  . Fixed bug #74782 (Reflected XSS in .phar 404 page). (Stas)
+
+- Standard:
+  . Fixed bug #75535 (Inappropriately parsing HTTP response leads to PHP
+    segment fault). (Nikita)
+  . Fixed bug #75409 (accept EFAULT in addition to ENOSYS as indicator 
+    that getrandom() is missing). (sarciszewski)
+
+- Zip:
+  . Fixed bug #75540 (Segfault with libzip 1.3.1). (Remi)
+
+23 Nov 2017 PHP 7.0.26
+
+- Core:
+  . Fixed bug #75420 (Crash when modifing property name in __isset for
+    BP_VAR_IS). (Laruence)
+  . Fixed bug #75368 (mmap/munmap trashing on unlucky allocations). (Nikita,
+    Dmitry)
+
+- CLI:
+  . Fixed bug #75287 (Builtin webserver crash after chdir in a shutdown
+    function). (Laruence)
+
+- Enchant:
+  . Fixed bug #53070 (enchant_broker_get_path crashes if no path is set). (jelle
+    van der Waa, cmb)
+  . Fixed bug #75365 (Enchant still reports version 1.1.0). (cmb)
+
+- Exif:
+  . Fixed bug #75301 (Exif extension has built in revision version). (Peter
+    Kokot)
+
+- GD:
+  . Fixed bug #65148 (imagerotate may alter image dimensions). (cmb)
+  . Fixed bug #75437 (Wrong reflection on imagewebp). (Fabien Villepinte)
+
+- intl:
+  . Fixed bug #75317 (UConverter::setDestinationEncoding changes source instead 
+    of destination). (andrewnester)
+
+- interbase:
+  . Fixed bug #75453 (Incorrect reflection for ibase_[p]connect). (villfa)
+
+- Mysqli:
+  . Fixed bug #75434 (Wrong reflection for mysqli_fetch_all function). (Fabien
+    Villepinte)
+
+- OCI8:
+  . Fixed valgrind issue. (Tianfang Yang)
+
+- Opcache:
+  . Fixed bug #75373 (Warning Internal error: wrong size calculation). (Laruence, Dmitry)
+
+- OpenSSL:
+  . Fixed bug #75363 (openssl_x509_parse leaks memory). (Bob, Jakub Zelenka)
+  . Fixed bug #75307 (Wrong reflection for openssl_open function). (villfa)
+
+- PGSQL:
+  . Fixed bug #75419 (Default link incorrectly cleared/linked by pg_close()). (Sara)
+
+- SOAP:
+  . Fixed bug #75464 (Wrong reflection on SoapClient::__setSoapHeaders). (villfa)
+
+- Zlib:
+  . Fixed bug #75299 (Wrong reflection on inflate_init and inflate_add). (Fabien
+    Villepinte)
+
+26 Oct 2017 PHP 7.0.25
+
+- Core:
+  . Fixed bug #75241 (Null pointer dereference in zend_mm_alloc_small()).
+    (Laruence)
+  . Fixed bug #75236 (infinite loop when printing an error-message). (Andrea)
+  . Fixed bug #75252 (Incorrect token formatting on two parse errors in one
+    request). (Nikita)
+  . Fixed bug #75220 (Segfault when calling is_callable on parent). 
+    (andrewnester)
+  . Fixed bug #75290 (debug info of Closures of internal functions contain
+    garbage argument names). (Andrea)
+
+- Apache2Handler:
+  . Fixed bug #75311 (error: 'zend_hash_key' has no member named 'arKey' in
+    apache2handler). (mcarbonneaux)
+
+- Date:
+  . Fixed bug #75055 (Out-Of-Bounds Read in timelib_meridian()). (Derick)
+
+- Intl:
+  . Fixed bug #75318 (The parameter of UConverter::getAliases() is not
+    optional). (cmb)
+
+- mcrypt:
+  . Fixed bug #72535 (arcfour encryption stream filter crashes php). (Leigh)
+
+- OCI8:
+  . Fixed incorrect reference counting. (Dmitry, Tianfang Yang)
+
+- PCRE:
+  . Fixed bug #75207 (applied upstream patch for CVE-2016-1283). (Anatol)
+
+- litespeed:
+  . Fixed bug #75248 (Binary directory doesn't get created when building 
+    only litespeed SAPI). (petk)
+  . Fixed bug #75251 (Missing program prefix and suffix). (petk)
+
+- SPL:
+  . Fixed bug #73629 (SplDoublyLinkedList::setIteratorMode masks intern flags).
+    (J. Jeising, cmb)
+
+28 Sep 2017 PHP 7.0.24
+
+- Core:
+  . Fixed bug #75042 (run-tests.php issues with EXTENSION block). (John Boehr)
+
+- BCMath:
+  . Fixed bug #44995 (bcpowmod() fails if scale != 0). (cmb)
+  . Fixed bug #46781 (BC math handles minus zero incorrectly). (cmb)
+  . Fixed bug #54598 (bcpowmod() may return 1 if modulus is 1). (okano1220, cmb)
+  . Fixed bug #75178 (bcpowmod() misbehaves for non-integer base or modulus). (cmb)
+
+- CLI server:
+  . Fixed bug #70470 (Built-in server truncates headers spanning over TCP
+    packets). (bouk)
+
+- CURL:
+  . Fixed bug #75093 (OpenSSL support not detected). (Remi)
+
+- GD:
+  . Fixed bug #75124 (gdImageGrayScale() may produce colors). (cmb)
+  . Fixed bug #75139 (libgd/gd_interpolation.c:1786: suspicious if ?). (cmb)
+
+- Gettext:
+  . Fixed bug #73730 (textdomain(null) throws in strict mode). (cmb)
+
+- Intl:
+  . Fixed bug #75090 (IntlGregorianCalendar doesn't have constants from parent
+    class). (tpunt)
+  . Fixed bug #75193 (segfault in collator_convert_object_to_string). (Remi)
+
+- PDO_OCI:
+  . Fixed bug #74631 (PDO_PCO with PHP-FPM: OCI environment initialized
+    before PHP-FPM sets it up). (Ingmar Runge)
+
+- SPL:
+  . Fixed bug #75173 (incorrect behavior of AppendIterator::append in foreach loop).
+    (jhdxr)
+
+- Standard:
+  . Fixed bug #75097 (gethostname fails if your host name is 64 chars long). (Andrea)
+
+31 Aug 2017 PHP 7.0.23
+
+- Core:
+  . Fixed bug #74947 (Segfault in scanner on INF number). (Laruence)
+  . Fixed bug #74954 (null deref and segfault in zend_generator_resume()). (Bob)
+  . Fixed bug #74725 (html_errors=1 breaks unhandled exceptions). (Andrea)
+  . Fixed bug #75349 (NAN comparison). (Sara)
+
+- cURL:
+  . Fixed bug #74125 (Fixed finding CURL on systems with multiarch support).
+    (cebe)
+
+- Date:
+  . Fixed bug #75002 (Null Pointer Dereference in timelib_time_clone). (Derick)
+
+- Intl:
+  . Fixed bug #74993 (Wrong reflection on some locale_* functions). (Sara)
+
+- Mbstring:
+  . Fixed bug #71606 (Segmentation fault mb_strcut with HTML-ENTITIES encoding).
+    (cmb)
+  . Fixed bug #62934 (mb_convert_kana() does not convert iteration marks).
+    (Nikita)
+  . Fixed bug #75001 (Wrong reflection on mb_eregi_replace). (Fabien
+    Villepinte)
+
+- MySQLi:
+  . Fixed bug #74968 (PHP crashes when calling mysqli_result::fetch_object with
+    an abstract class). (Anatol)
+
+- OCI8:
+  . Expose oci_unregister_taf_callback() (Tianfang Yang)
+
+- phar:
+  . Fixed bug #74991 (include_path has a 4096 char limit in some cases).
+    (bwbroersma)
+
+- Reflection:
+  . Fixed bug #74949 (null pointer dereference in _function_string). (Laruence)
+
+- Session:
+  . Fixed bug #74833 (SID constant created with wrong module number). (Anatol)
+
+- SimpleXML:
+  . Fixed bug #74950 (nullpointer deref in simplexml_element_getDocNamespaces).
+    (Laruence)
+
+- SPL:
+  . Fixed bug #75049 (spl_autoload_unregister can't handle
+    spl_autoload_functions results). (Laruence)
+  . Fixed bug #74669 (Unserialize ArrayIterator broken). (Andrew Nester)
+  . Fixed bug #75015 (Crash in recursive iterator destructors). (Julien)
+
+- Standard:
+  . Fixed bug #75075 (unpack with X* causes infinity loop). (Laruence)
+  . Fixed bug #74103 (heap-use-after-free when unserializing invalid array
+    size). (Nikita)
+  . Fixed bug #75054 (A Denial of Service Vulnerability was found when
+    performing deserialization). (Nikita)
+
+- WDDX:
+  . Fixed bug #73793 (WDDX uses wrong decimal seperator). (cmb)
+
+- XMLRPC:
+  . Fixed bug #74975 (Incorrect xmlrpc serialization for classes with declared
+    properties). (blar)
+
 03 Aug 2017 PHP 7.0.22

 - Core:
@@ -525,6 +780,7 @@ PHP                                                                        NEWS

 - JSON:
  . Fixed bug #73526 (php_json_encode depth issue). (Jakub Zelenka)
+  . Install headers on windows. (Darek Slusarczyk)

 - Mysqlnd:
  . Fixed bug #64526 (Add missing mysqlnd.* parameters to php.ini-*). (cmb)
@@ -0,0 +1,12 @@
+--TEST--
+Bug #74947 (Segfault in scanner on INF number)
+--FILE--
+<?php 
+
+echo 200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000;
+
+echo -200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000;
+
+?>
+--EXPECTF--
+INF-INF
@@ -0,0 +1,13 @@
+--TEST--
+Bug #75241 (Null pointer dereference in zend_mm_alloc_small())
+--FILE--
+<?php
+function eh(){}
+
+set_error_handler('eh');
+
+$d->d = &$d + $d->d/=0;
+var_dump($d);
+?>
+--EXPECT--
+float(INF)
@@ -0,0 +1,28 @@
+--TEST--
+Bug #75252: Incorrect token formatting on two parse errors in one request
+--FILE--
+<?php
+
+$code = <<<'CODE'
+function test_missing_semicolon() : string {
+     $x = []
+     FOO
+}
+CODE;
+
+try {
+    eval($code);
+} catch (ParseError $e) {
+    var_dump($e->getMessage());
+}
+
+try {
+    eval($code);
+} catch (ParseError $e) {
+    var_dump($e->getMessage());
+}
+
+?>
+--EXPECT--
+string(41) "syntax error, unexpected 'FOO' (T_STRING)"
+string(41) "syntax error, unexpected 'FOO' (T_STRING)"
@@ -0,0 +1,26 @@
+--TEST--
+Bug #75290 (debug info of Closures of internal functions contain garbage argument names)
+--FILE--
+<?php
+
+var_dump((new ReflectionFunction('sin'))->getClosure());
+
+var_dump(function ($someThing) {});
+
+?>
+--EXPECT--
+object(Closure)#2 (1) {
+  ["parameter"]=>
+  array(1) {
+    ["$number"]=>
+    string(10) "<required>"
+  }
+}
+object(Closure)#2 (1) {
+  ["parameter"]=>
+  array(1) {
+    ["$someThing"]=>
+    string(10) "<required>"
+  }
+}
+
@@ -0,0 +1,18 @@
+--TEST--
+Bug #75420.1 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test {
+	public function __isset($x) { $GLOBALS["name"] = 24; return true; }
+	public function __get($x) { var_dump($x); return 42; }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump($obj->$name ?? 12);
+var_dump($name);
+?>
+--EXPECT--
+string(3) "foo"
+int(42)
+int(24)
@@ -0,0 +1,21 @@
+--TEST--
+Bug #75420.10 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test implements ArrayAccess {
+	public function offsetExists($x) { $GLOBALS["name"] = 24; return true; }
+	public function offsetGet($x) { var_dump($x); return 42; }
+	public function offsetSet($x, $y) { }
+	public function offsetUnset($x) { }
+}
+
+$obj = new Test;
+$name = "foo";
+$name = str_repeat($name, 2);
+var_dump($obj[$name] ?? 12);
+var_dump($name);
+?>
+--EXPECT--
+string(6) "foofoo"
+int(42)
+int(24)
@@ -0,0 +1,20 @@
+--TEST--
+Bug #75420.11 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test implements ArrayAccess {
+	public function offsetExists($x) { $GLOBALS["name"] = 24; return true; }
+	public function offsetGet($x) { var_dump($x); return 42; }
+	public function offsetSet($x, $y) { }
+	public function offsetUnset($x) { }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump(empty($obj[$name]));
+var_dump($name);
+?>
+--EXPECT--
+string(3) "foo"
+bool(false)
+int(24)
@@ -0,0 +1,21 @@
+--TEST--
+Bug #75420.12 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test implements ArrayAccess {
+	public function offsetExists($x) { $GLOBALS["name"] = 24; return true; }
+	public function offsetGet($x) { var_dump($x); return 42; }
+	public function offsetSet($x, $y) { }
+	public function offsetUnset($x) { }
+}
+
+$obj = new Test;
+$name = "foo";
+$name = str_repeat($name, 2);
+var_dump(empty($obj[$name]));
+var_dump($name);
+?>
+--EXPECT--
+string(6) "foofoo"
+bool(false)
+int(24)
@@ -0,0 +1,20 @@
+--TEST--
+Bug #75420.13 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test implements ArrayAccess {
+	public function offsetExists($x) { $GLOBALS["obj"] = 24; return true; }
+	public function offsetGet($x) { var_dump($x); return 42; }
+	public function offsetSet($x, $y) { }
+	public function offsetUnset($x) { }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump($obj[$name] ?? 12);
+var_dump($obj);
+?>
+--EXPECT--
+string(3) "foo"
+int(42)
+int(24)
@@ -0,0 +1,20 @@
+--TEST--
+Bug #75420.14 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test implements ArrayAccess {
+	public function offsetExists($x) { $GLOBALS["obj"] = 24; return true; }
+	public function offsetGet($x) { var_dump($x); return 42; }
+	public function offsetSet($x, $y) { }
+	public function offsetUnset($x) { }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump(empty($obj[$name]));
+var_dump($obj);
+?>
+--EXPECT--
+string(3) "foo"
+bool(false)
+int(24)
@@ -0,0 +1,20 @@
+--TEST--
+Bug #75420.15 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test implements ArrayAccess {
+	public function offsetExists($x) { }
+	public function offsetGet($x) { }
+	public function offsetSet($x, $y) { $GLOBALS["name"] = 24; var_dump($x); }
+	public function offsetUnset($x) { }
+}
+
+$obj = new Test;
+$name = "foo";
+$name = str_repeat($name, 2);
+$obj[$name] = 1;
+var_dump($name);
+?>
+--EXPECT--
+string(6) "foofoo"
+int(24)
@@ -0,0 +1,20 @@
+--TEST--
+Bug #75420.16 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test implements ArrayAccess {
+	public function offsetExists($x) { }
+	public function offsetGet($x) { }
+	public function offsetSet($x, $y) { $GLOBALS["obj"] = 24; var_dump($this); }
+	public function offsetUnset($x) { }
+}
+
+$obj = new Test;
+$name = "foo";
+$obj[$name] = 1;
+var_dump($obj);
+?>
+--EXPECT--
+object(Test)#1 (0) {
+}
+int(24)
@@ -0,0 +1,20 @@
+--TEST--
+Bug #75420.2 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test {
+	public function __isset($x) { $GLOBALS["name"] = 24; return true; }
+	public function __get($x) { var_dump($x); return 42; }
+}
+
+$obj = new Test;
+$name = "foo";
+$name = str_repeat($name, 2);
+var_dump($obj->$name ?? 12);
+var_dump($name);
+?>
+--EXPECT--
+string(6) "foofoo"
+int(42)
+int(24)
+
@@ -0,0 +1,18 @@
+--TEST--
+Bug #75420.3 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test {
+	public function __isset($x) { $GLOBALS["name"] = 24; return true; }
+	public function __get($x) { var_dump($x); return 42; }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump(empty($obj->$name));
+var_dump($name);
+?>
+--EXPECT--
+string(3) "foo"
+bool(false)
+int(24)
@@ -0,0 +1,17 @@
+--TEST--
+Bug #75420.4 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test {
+	public function __isset($x) { $GLOBALS["name"] = 24; return true; }
+	public function __get($x) { var_dump($x); return 42; }
+}
+
+$obj = new Test;
+$name = "foo";
+$name = str_repeat($name, 2);
+var_dump(empty($obj->$name));
+?>
+--EXPECT--
+string(6) "foofoo"
+bool(false)
@@ -0,0 +1,19 @@
+--TEST--
+Bug #75420.5 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test {
+	public function __isset($x) { $GLOBALS["obj"] = 24; return true; }
+	public function __get($x) { var_dump($this); return 42; }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump($obj->$name ?? 12);
+var_dump($obj);
+?>
+--EXPECT--
+object(Test)#1 (0) {
+}
+int(42)
+int(24)
@@ -0,0 +1,19 @@
+--TEST--
+Bug #75420.6 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test {
+	public function __isset($x) { $GLOBALS["obj"] = 24; return true; }
+	public function __get($x) { var_dump($this); return 42; }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump(empty($obj->$name));
+var_dump($obj);
+?>
+--EXPECT--
+object(Test)#1 (0) {
+}
+bool(false)
+int(24)
@@ -0,0 +1,17 @@
+--TEST--
+Bug #75420.7 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test {
+	public function __set($x,$v) { $GLOBALS["name"] = 24; var_dump($x); }
+}
+
+$obj = new Test;
+$name = "foo";
+$name = str_repeat($name, 2);
+$obj->$name = 1;
+var_dump($name);
+?>
+--EXPECT--
+string(6) "foofoo"
+int(24)
@@ -0,0 +1,17 @@
+--TEST--
+Bug #75420.8 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test {
+	public function __set($x,$v) { $GLOBALS["obj"] = 24; var_dump($this); }
+}
+
+$obj = new Test;
+$name = "foo";
+$obj->$name = 1;
+var_dump($obj);
+?>
+--EXPECT--
+object(Test)#1 (0) {
+}
+int(24)
@@ -0,0 +1,20 @@
+--TEST--
+Bug #75420.9 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test implements ArrayAccess {
+	public function offsetExists($x) { $GLOBALS["name"] = 24; return true; }
+	public function offsetGet($x) { var_dump($x); return 42; }
+	public function offsetSet($x, $y) { }
+	public function offsetUnset($x) { }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump($obj[$name] ?? 12);
+var_dump($name);
+?>
+--EXPECT--
+string(3) "foo"
+int(42)
+int(24)
@@ -0,0 +1,17 @@
+--TEST--
+Bug #75420 (Crash when modifing property name in __isset for BP_VAR_IS)
+--FILE--
+<?php
+
+class Test {
+	public function __isset($x) { $GLOBALS["name"] = 24; return true; }
+public function __get($x) { var_dump($x); return 42; }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump($obj->$name ?? 12);
+?>
+--EXPECT--
+string(3) "foo"
+int(42)
@@ -0,0 +1,64 @@
+--TEST--
+Bug #75573 (Segmentation fault in 7.1.12 and 7.0.26)
+--FILE--
+<?php
+
+class A
+{
+	var $_stdObject;
+	function initialize($properties = FALSE) {
+		$this->_stdObject = $properties ? (object) $properties : new stdClass();
+		parent::initialize();
+	}
+	function &__get($property)
+	{
+		if (isset($this->_stdObject->{$property})) {
+			$retval =& $this->_stdObject->{$property};
+			return $retval;
+		} else {
+			return NULL;
+		}
+	}
+	function &__set($property, $value)
+	{
+		return $this->_stdObject->{$property} = $value;
+	}
+	function __isset($property_name)
+	{
+		return isset($this->_stdObject->{$property_name});
+	}
+}
+
+class B extends A
+{
+	function initialize($properties = array())
+	{
+		parent::initialize($properties);
+	}
+	function &__get($property)
+	{
+		if (isset($this->settings) && isset($this->settings[$property])) {
+			$retval =& $this->settings[$property];
+			return $retval;
+		} else {
+			return parent::__get($property);
+		}
+	}
+}
+
+$b = new B();
+$b->settings = [ "foo" => "bar", "name" => "abc" ];
+var_dump($b->name);
+var_dump($b->settings);
+?>
+--EXPECTF--
+Warning: Creating default object from empty value in %sbug75573.php on line %d
+
+Notice: Only variable references should be returned by reference in %sbug75573.php on line %d
+string(3) "abc"
+array(2) {
+  ["foo"]=>
+  string(3) "bar"
+  ["name"]=>
+  string(3) "abc"
+}
@@ -0,0 +1,45 @@
+--TEST--
+Bug #74954 (crash after update of generator yielding from finished generator)
+--FILE--
+<?php
+
+function from() {
+        yield 1;
+        throw new Exception();
+}
+
+function gen($gen) {
+        try {
+                var_dump(yield from $gen);
+        } catch (Exception $e) { print "Caught exception!\n$e\n"; }
+}
+
+$gen = from();
+$gens[] = gen($gen);
+$gens[] = gen($gen);
+
+foreach ($gens as $g) {
+        $g->current();
+}
+
+do {
+        foreach ($gens as $i => $g) {
+                $g->next();
+        }
+} while($gens[0]->valid());
+
+?>
+--EXPECTF--
+Caught exception!
+Exception in %s:%d
+Stack trace:
+#0 %s(%d): from()
+#1 [internal function]: gen(Object(Generator))
+#2 %s(%d): Generator->next()
+#3 {main}
+Caught exception!
+ClosedGeneratorException: Generator yielded from aborted, no return value available in %s:%d
+Stack trace:
+#0 [internal function]: gen(Object(Generator))
+#1 %s(%d): Generator->next()
+#2 {main}
@@ -701,7 +701,7 @@ int zend_startup(zend_utility_functions *utility_functions, char **extensions) /
 	zend_compile_file = compile_file;
 	zend_execute_ex = execute_ex;
 	zend_execute_internal = NULL;
-#endif /* HAVE_SYS_SDT_H */
+#endif /* HAVE_DTRACE */
 	zend_compile_string = compile_string;
 	zend_throw_exception_hook = NULL;

@@ -896,6 +896,8 @@ void zend_set_utility_values(zend_utility_values *utility_values) /* {{{ */
 /* this should be compatible with the standard zenderror */
 ZEND_COLD void zenderror(const char *error) /* {{{ */
 {
+	CG(parse_error) = 0;
+
 	if (EG(exception)) {
 		/* An exception was thrown in the lexer, don't throw another in the parser. */
 		return;
@@ -297,7 +297,6 @@ ZEND_COLD void zenderror(const char *error);
 #define ZEND_STANDARD_CLASS_DEF_PTR zend_standard_class_def
 extern ZEND_API zend_class_entry *zend_standard_class_def;
 extern ZEND_API zend_utility_values zend_uv;
-extern ZEND_API zval zval_used_for_init;

 /* If DTrace is available and enabled */
 extern ZEND_API zend_bool zend_dtrace_enabled;
@@ -3067,7 +3067,8 @@ get_function_via_handler:
 					    (!fcc->function_handler->common.scope ||
 					     !instanceof_function(ce_org, fcc->function_handler->common.scope))) {
 						if (fcc->function_handler->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
-							if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION) {
+							if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION && 
+								fcc->function_handler->common.function_name) {
 								zend_string_release(fcc->function_handler->common.function_name);
 							}
 							zend_free_trampoline(fcc->function_handler);
@@ -3237,7 +3238,8 @@ again:
 				((fcc->function_handler->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) ||
 			     fcc->function_handler->type == ZEND_OVERLOADED_FUNCTION_TEMPORARY ||
 			     fcc->function_handler->type == ZEND_OVERLOADED_FUNCTION)) {
-				if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION) {
+				if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION && 
+					fcc->function_handler->common.function_name) {
 					zend_string_release(fcc->function_handler->common.function_name);
 				}
 				zend_free_trampoline(fcc->function_handler);
@@ -3324,7 +3326,8 @@ again:
 						((fcc->function_handler->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) ||
 					     fcc->function_handler->type == ZEND_OVERLOADED_FUNCTION_TEMPORARY ||
 					     fcc->function_handler->type == ZEND_OVERLOADED_FUNCTION)) {
-						if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION) {
+						if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION && 
+							fcc->function_handler->common.function_name) {
 							zend_string_release(fcc->function_handler->common.function_name);
 						}
 						zend_free_trampoline(fcc->function_handler);
@@ -709,7 +709,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_error(int severity, in
 		int _num_args = EX_NUM_ARGS(); \
 		int _i; \
 		zval *_real_arg, *_arg = NULL; \
-		zend_expected_type _expected_type = IS_UNDEF; \
+		zend_expected_type _expected_type = Z_EXPECTED_LONG; \
 		char *_error = NULL; \
 		zend_bool _dummy; \
 		zend_bool _optional = 0; \
@@ -267,6 +267,8 @@ struct _zend_mm_heap {
 	int                peak_chunks_count;		/* peak number of allocated chunks for current request */
 	int                cached_chunks_count;		/* number of cached chunks */
 	double             avg_chunks_count;		/* average number of chunks allocated per request */
+	int                last_chunks_delete_boundary; /* numer of chunks after last deletion */
+	int                last_chunks_delete_count;    /* number of deletion over the last boundary */
 #if ZEND_MM_CUSTOM
 	union {
 		struct {
@@ -1122,7 +1124,9 @@ static zend_always_inline void zend_mm_delete_chunk(zend_mm_heap *heap, zend_mm_
 	chunk->next->prev = chunk->prev;
 	chunk->prev->next = chunk->next;
 	heap->chunks_count--;
-	if (heap->chunks_count + heap->cached_chunks_count < heap->avg_chunks_count + 0.1) {
+	if (heap->chunks_count + heap->cached_chunks_count < heap->avg_chunks_count + 0.1
+	 || (heap->chunks_count == heap->last_chunks_delete_boundary
+	  && heap->last_chunks_delete_count >= 4)) {
 		/* delay deletion */
 		heap->cached_chunks_count++;
 		chunk->next = heap->cached_chunks;
@@ -1131,6 +1135,14 @@ static zend_always_inline void zend_mm_delete_chunk(zend_mm_heap *heap, zend_mm_
 #if ZEND_MM_STAT || ZEND_MM_LIMIT
 		heap->real_size -= ZEND_MM_CHUNK_SIZE;
 #endif
+		if (!heap->cached_chunks) {
+			if (heap->chunks_count != heap->last_chunks_delete_boundary) {
+				heap->last_chunks_delete_boundary = heap->chunks_count;
+				heap->last_chunks_delete_count = 0;
+			} else {
+				heap->last_chunks_delete_count++;
+			}
+		}
 		if (!heap->cached_chunks || chunk->num > heap->cached_chunks->num) {
 			zend_mm_chunk_free(heap, chunk, ZEND_MM_CHUNK_SIZE);
 		} else {
@@ -1864,6 +1876,8 @@ static zend_mm_heap *zend_mm_init(void)
 	heap->peak_chunks_count = 1;
 	heap->cached_chunks_count = 0;
 	heap->avg_chunks_count = 1.0;
+	heap->last_chunks_delete_boundary = 0;
+	heap->last_chunks_delete_count = 0;
 #if ZEND_MM_STAT || ZEND_MM_LIMIT
 	heap->real_size = ZEND_MM_CHUNK_SIZE;
 #endif
@@ -2279,6 +2293,8 @@ void zend_mm_shutdown(zend_mm_heap *heap, int full, int silent)
 		p->map[0] = ZEND_MM_LRUN(ZEND_MM_FIRST_PAGE);
 		heap->chunks_count = 1;
 		heap->peak_chunks_count = 1;
+		heap->last_chunks_delete_boundary = 0;
+		heap->last_chunks_delete_count = 0;
 #if ZEND_MM_STAT || ZEND_MM_LIMIT
 		heap->real_size = ZEND_MM_CHUNK_SIZE;
 #endif
@@ -2811,6 +2827,8 @@ ZEND_API zend_mm_heap *zend_mm_startup_ex(const zend_mm_handlers *handlers, void
 	heap->peak_chunks_count = 1;
 	heap->cached_chunks_count = 0;
 	heap->avg_chunks_count = 1.0;
+	heap->last_chunks_delete_boundary = 0;
+	heap->last_chunks_delete_count = 0;
 #if ZEND_MM_STAT || ZEND_MM_LIMIT
 	heap->real_size = ZEND_MM_CHUNK_SIZE;
 #endif
@@ -1203,7 +1203,7 @@ ZEND_FUNCTION(get_object_vars)
 						zend_unmangle_property_name_ex(key, &class_name, &prop_name, &prop_len);
 						zend_hash_str_add_new(Z_ARRVAL_P(return_value), prop_name, prop_len, value);
 					} else {
-						zend_symbtable_add_new(Z_ARRVAL_P(return_value), key, value);
+						zend_symtable_add_new(Z_ARRVAL_P(return_value), key, value);
 					}
 				}
 			}
@@ -414,6 +414,7 @@ static HashTable *zend_closure_get_debug_info(zval *object, int *is_temp) /* {{{
 	zval val;
 	struct _zend_arg_info *arg_info = closure->func.common.arg_info;
 	HashTable *debug_info;
+	zend_bool zstr_args = (closure->func.type == ZEND_USER_FUNCTION) || (closure->func.common.fn_flags & ZEND_ACC_USER_ARG_INFO);

 	*is_temp = 1;

@@ -446,9 +447,15 @@ static HashTable *zend_closure_get_debug_info(zval *object, int *is_temp) /* {{{
 			zend_string *name;
 			zval info;
 			if (arg_info->name) {
-				name = zend_strpprintf(0, "%s$%s",
-						arg_info->pass_by_reference ? "&" : "",
-						ZSTR_VAL(arg_info->name));
+				if (zstr_args) {
+					name = zend_strpprintf(0, "%s$%s",
+							arg_info->pass_by_reference ? "&" : "",
+							ZSTR_VAL(arg_info->name));
+				} else {
+					name = zend_strpprintf(0, "%s$%s",
+							arg_info->pass_by_reference ? "&" : "",
+							((zend_internal_arg_info*)arg_info)->name);
+				}
 			} else {
 				name = zend_strpprintf(0, "%s$param%d",
 						arg_info->pass_by_reference ? "&" : "",
@@ -5601,7 +5601,7 @@ void zend_compile_use(zend_ast *ast) /* {{{ */
 			zend_string *ns_name = zend_string_alloc(ZSTR_LEN(current_ns) + 1 + ZSTR_LEN(new_name), 0);
 			zend_str_tolower_copy(ZSTR_VAL(ns_name), ZSTR_VAL(current_ns), ZSTR_LEN(current_ns));
 			ZSTR_VAL(ns_name)[ZSTR_LEN(current_ns)] = '\\';
-			memcpy(ZSTR_VAL(ns_name) + ZSTR_LEN(current_ns) + 1, ZSTR_VAL(lookup_name), ZSTR_LEN(lookup_name));
+			memcpy(ZSTR_VAL(ns_name) + ZSTR_LEN(current_ns) + 1, ZSTR_VAL(lookup_name), ZSTR_LEN(lookup_name) + 1);

 			zend_check_use_conflict(type, old_name, new_name, ns_name);

@@ -644,15 +644,13 @@ failure:

 ZEND_API void zend_generator_resume(zend_generator *orig_generator) /* {{{ */
 {
-	zend_generator *generator;
+	zend_generator *generator = zend_generator_get_current(orig_generator);

 	/* The generator is already closed, thus can't resume */
-	if (UNEXPECTED(!orig_generator->execute_data)) {
+	if (UNEXPECTED(!generator->execute_data)) {
 		return;
 	}

-	generator = zend_generator_get_current(orig_generator);
-
 try_again:
 	if (generator->flags & ZEND_GENERATOR_CURRENTLY_RUNNING) {
 		zend_throw_error(NULL, "Cannot resume an already running generator");
@@ -310,7 +310,7 @@ static zend_always_inline int zend_hash_str_exists_ind(const HashTable *ht, cons
 			Z_TYPE_P(Z_INDIRECT_P(zv)) != IS_UNDEF);
 }

-static zend_always_inline zval *zend_symbtable_add_new(HashTable *ht, zend_string *key, zval *pData)
+static zend_always_inline zval *zend_symtable_add_new(HashTable *ht, zend_string *key, zval *pData)
 {
 	zend_ulong idx;

@@ -321,6 +321,10 @@ static zend_always_inline zval *zend_symbtable_add_new(HashTable *ht, zend_strin
 	}
 }

+/* This typo snuck into 7.0.17 and 7.1.3, this define exists for BC */
+#define zend_symbtable_add_new(ht, key, pData) \
+        zend_symtable_add_new(ht, key, pData)
+
 static zend_always_inline zval *zend_symtable_update(HashTable *ht, zend_string *key, zval *pData)
 {
 	zend_ulong idx;
@@ -1676,7 +1676,6 @@ NEWLINE ("\r"|"\n"|"\r\n")
 		if (errno == ERANGE) { /* Overflow */
 			errno = 0;
 			if (yytext[0] == '0') { /* octal overflow */
-				errno = 0;
 				ZVAL_DOUBLE(zendlval, zend_oct_strtod(yytext, (const char **)&end));
 			} else {
 				ZVAL_DOUBLE(zendlval, zend_strtod(yytext, (const char **)&end));
@@ -1688,7 +1687,6 @@ NEWLINE ("\r"|"\n"|"\r\n")
 				ZVAL_UNDEF(zendlval);
 				RETURN_TOKEN(T_DNUMBER);
 			}
-			ZEND_ASSERT(!errno);
 			RETURN_TOKEN(T_DNUMBER);
 		}
 		/* Also not an assert for the same reason */
@@ -53,8 +53,8 @@
 	__asm__("mul %0, %2, %3\n"										\
 		"smulh %1, %2, %3\n"										\
 		"sub %1, %1, %0, asr #63\n"									\
-			: "=X"(__tmpvar), "=X"(usedval)							\
-			: "X"(a), "X"(b));										\
+			: "=&r"(__tmpvar), "=&r"(usedval)						\
+			: "r"(a), "r"(b));										\
 	if (usedval) (dval) = (double) (a) * (double) (b);				\
 	else (lval) = __tmpvar;											\
 } while (0)
@@ -507,9 +507,10 @@ static zend_long *zend_get_property_guard(zend_object *zobj, zend_string *member
 zval *zend_std_read_property(zval *object, zval *member, int type, void **cache_slot, zval *rv) /* {{{ */
 {
 	zend_object *zobj;
-	zval tmp_member;
+	zval tmp_member, tmp_object;
 	zval *retval;
 	uint32_t property_offset;
+	zend_long *guard = NULL;

 	zobj = Z_OBJ_P(object);

@@ -542,12 +543,18 @@ zval *zend_std_read_property(zval *object, zval *member, int type, void **cache_
 		goto exit;
 	}

+	ZVAL_UNDEF(&tmp_object);
+
 	/* magic isset */
 	if ((type == BP_VAR_IS) && zobj->ce->__isset) {
-		zval tmp_object, tmp_result;
-		zend_long *guard = zend_get_property_guard(zobj, Z_STR_P(member));
+		zval tmp_result;
+		guard = zend_get_property_guard(zobj, Z_STR_P(member));

 		if (!((*guard) & IN_ISSET)) {
+			if (Z_TYPE(tmp_member) == IS_UNDEF) {
+				ZVAL_COPY(&tmp_member, member);
+				member = &tmp_member;
+			}
 			ZVAL_COPY(&tmp_object, object);
 			ZVAL_UNDEF(&tmp_result);

@@ -562,19 +569,20 @@ zval *zend_std_read_property(zval *object, zval *member, int type, void **cache_
 				goto exit;
 			}

-			zval_ptr_dtor(&tmp_object);
 			zval_ptr_dtor(&tmp_result);
 		}
 	}

 	/* magic get */
 	if (zobj->ce->__get) {
-		zend_long *guard = zend_get_property_guard(zobj, Z_STR_P(member));
+		if (guard == NULL) {
+			guard = zend_get_property_guard(zobj, Z_STR_P(member));
+		}
 		if (!((*guard) & IN_GET)) {
-			zval tmp_object;
-
 			/* have getter - try with it! */
-			ZVAL_COPY(&tmp_object, object);
+			if (Z_TYPE(tmp_object) == IS_UNDEF) {
+				ZVAL_COPY(&tmp_object, object);
+			}
 			*guard |= IN_GET; /* prevent circular getting */
 			zend_std_call_getter(&tmp_object, member, rv);
 			*guard &= ~IN_GET;
@@ -595,6 +603,7 @@ zval *zend_std_read_property(zval *object, zval *member, int type, void **cache_
 			goto exit;
 		} else {
 			if (Z_STRVAL_P(member)[0] == '\0') {
+				zval_ptr_dtor(&tmp_object);
 				if (Z_STRLEN_P(member) == 0) {
 					zend_throw_error(NULL, "Cannot access empty property");
 					retval = &EG(uninitialized_zval);
@@ -607,6 +616,9 @@ zval *zend_std_read_property(zval *object, zval *member, int type, void **cache_
 			}
 		}
 	}
+
+	zval_ptr_dtor(&tmp_object);
+
 	if ((type != BP_VAR_IS)) {
 		zend_error(E_NOTICE,"Undefined property: %s::$%s", ZSTR_VAL(zobj->ce->name), Z_STRVAL_P(member));
 	}
@@ -722,34 +734,38 @@ exit:
 zval *zend_std_read_dimension(zval *object, zval *offset, int type, zval *rv) /* {{{ */
 {
 	zend_class_entry *ce = Z_OBJCE_P(object);
-	zval tmp;
+	zval tmp_offset, tmp_object;

 	if (EXPECTED(instanceof_function_ex(ce, zend_ce_arrayaccess, 1) != 0)) {
 		if (offset == NULL) {
 			/* [] construct */
-			ZVAL_NULL(&tmp);
-			offset = &tmp;
+			ZVAL_NULL(&tmp_offset);
 		} else {
-			SEPARATE_ARG_IF_REF(offset);
+			ZVAL_DEREF(offset);
+			ZVAL_COPY(&tmp_offset, offset);
 		}

+		ZVAL_COPY(&tmp_object, object);
 		if (type == BP_VAR_IS) {
-			zend_call_method_with_1_params(object, ce, NULL, "offsetexists", rv, offset);
+			zend_call_method_with_1_params(&tmp_object, ce, NULL, "offsetexists", rv, &tmp_offset);
 			if (UNEXPECTED(Z_ISUNDEF_P(rv))) {
-				zval_ptr_dtor(offset);
+				zval_ptr_dtor(&tmp_object);
+				zval_ptr_dtor(&tmp_offset);
 				return NULL;
 			}
 			if (!i_zend_is_true(rv)) {
-				zval_ptr_dtor(offset);
+				zval_ptr_dtor(&tmp_object);
+				zval_ptr_dtor(&tmp_offset);
 				zval_ptr_dtor(rv);
 				return &EG(uninitialized_zval);
 			}
 			zval_ptr_dtor(rv);
 		}

-		zend_call_method_with_1_params(object, ce, NULL, "offsetget", rv, offset);
+		zend_call_method_with_1_params(&tmp_object, ce, NULL, "offsetget", rv, &tmp_offset);

-		zval_ptr_dtor(offset);
+		zval_ptr_dtor(&tmp_object);
+		zval_ptr_dtor(&tmp_offset);

 		if (UNEXPECTED(Z_TYPE_P(rv) == IS_UNDEF)) {
 			if (UNEXPECTED(!EG(exception))) {
@@ -768,17 +784,19 @@ zval *zend_std_read_dimension(zval *object, zval *offset, int type, zval *rv) /*
 static void zend_std_write_dimension(zval *object, zval *offset, zval *value) /* {{{ */
 {
 	zend_class_entry *ce = Z_OBJCE_P(object);
-	zval tmp;
+	zval tmp_offset, tmp_object;

 	if (EXPECTED(instanceof_function_ex(ce, zend_ce_arrayaccess, 1) != 0)) {
 		if (!offset) {
-			ZVAL_NULL(&tmp);
-			offset = &tmp;
+			ZVAL_NULL(&tmp_offset);
 		} else {
-			SEPARATE_ARG_IF_REF(offset);
+			ZVAL_DEREF(offset);
+			ZVAL_COPY(&tmp_offset, offset);
 		}
-		zend_call_method_with_2_params(object, ce, NULL, "offsetset", NULL, offset, value);
-		zval_ptr_dtor(offset);
+		ZVAL_COPY(&tmp_object, object);
+		zend_call_method_with_2_params(&tmp_object, ce, NULL, "offsetset", NULL, &tmp_offset, value);
+		zval_ptr_dtor(&tmp_object);
+		zval_ptr_dtor(&tmp_offset);
 	} else {
 		zend_throw_error(NULL, "Cannot use object of type %s as array", ZSTR_VAL(ce->name));
 	}
@@ -788,17 +806,19 @@ static void zend_std_write_dimension(zval *object, zval *offset, zval *value) /*
 static int zend_std_has_dimension(zval *object, zval *offset, int check_empty) /* {{{ */
 {
 	zend_class_entry *ce = Z_OBJCE_P(object);
-	zval retval;
+	zval retval, tmp_offset, tmp_object;
 	int result;

 	if (EXPECTED(instanceof_function_ex(ce, zend_ce_arrayaccess, 1) != 0)) {
-		SEPARATE_ARG_IF_REF(offset);
-		zend_call_method_with_1_params(object, ce, NULL, "offsetexists", &retval, offset);
+		ZVAL_DEREF(offset);
+		ZVAL_COPY(&tmp_offset, offset);
+		ZVAL_COPY(&tmp_object, object);
+		zend_call_method_with_1_params(&tmp_object, ce, NULL, "offsetexists", &retval, &tmp_offset);
 		if (EXPECTED(Z_TYPE(retval) != IS_UNDEF)) {
 			result = i_zend_is_true(&retval);
 			zval_ptr_dtor(&retval);
 			if (check_empty && result && EXPECTED(!EG(exception))) {
-				zend_call_method_with_1_params(object, ce, NULL, "offsetget", &retval, offset);
+				zend_call_method_with_1_params(&tmp_object, ce, NULL, "offsetget", &retval, &tmp_offset);
 				if (EXPECTED(Z_TYPE(retval) != IS_UNDEF)) {
 					result = i_zend_is_true(&retval);
 					zval_ptr_dtor(&retval);
@@ -807,7 +827,8 @@ static int zend_std_has_dimension(zval *object, zval *offset, int check_empty) /
 		} else {
 			result = 0;
 		}
-		zval_ptr_dtor(offset);
+		zval_ptr_dtor(&tmp_object);
+		zval_ptr_dtor(&tmp_offset);
 	} else {
 		zend_throw_error(NULL, "Cannot use object of type %s as array", ZSTR_VAL(ce->name));
 		return 0;
@@ -969,11 +990,15 @@ exit:
 static void zend_std_unset_dimension(zval *object, zval *offset) /* {{{ */
 {
 	zend_class_entry *ce = Z_OBJCE_P(object);
+	zval tmp_offset, tmp_object;

 	if (instanceof_function_ex(ce, zend_ce_arrayaccess, 1)) {
-		SEPARATE_ARG_IF_REF(offset);
-		zend_call_method_with_1_params(object, ce, NULL, "offsetunset", NULL, offset);
-		zval_ptr_dtor(offset);
+		ZVAL_DEREF(offset);
+		ZVAL_COPY(&tmp_offset, offset);
+		ZVAL_COPY(&tmp_object, object);
+		zend_call_method_with_1_params(&tmp_object, ce, NULL, "offsetunset", NULL, &tmp_offset);
+		zval_ptr_dtor(&tmp_object);
+		zval_ptr_dtor(&tmp_offset);
 	} else {
 		zend_throw_error(NULL, "Cannot use object of type %s as array", ZSTR_VAL(ce->name));
 	}
@@ -1507,6 +1532,10 @@ found:
 			zval tmp_object;

 			/* have issetter - try with it! */
+			if (Z_TYPE(tmp_member) == IS_UNDEF) {
+				ZVAL_COPY(&tmp_member, member);
+				member = &tmp_member;
+			}
 			ZVAL_COPY(&tmp_object, object);
 			(*guard) |= IN_ISSET; /* prevent circular getting */
 			zend_std_call_issetter(&tmp_object, member, &rv);
@@ -221,8 +221,10 @@ try_again:
 					if (Z_TYPE(holder) == IS_LONG) {				\
 						if (op == result) {							\
 							zval_ptr_dtor(op);						\
+							ZVAL_LONG(op, Z_LVAL(holder));			\
+						} else {									\
+							(op) = &(holder);						\
 						}											\
-						(op) = &(holder);							\
 					}												\
 					break;											\
 			}														\
@@ -433,7 +433,7 @@ char *alloca();
 #define ZEND_STRL(str)		(str), (sizeof(str)-1)
 #define ZEND_STRS(str)		(str), (sizeof(str))
 #define ZEND_NORMALIZE_BOOL(n)			\
-	((n) ? (((n)>0) ? 1 : -1) : 0)
+	((n) ? (((n)<0) ? -1 : 1) : 0)
 #define ZEND_TRUTH(x)		((x) ? 1 : 0)
 #define ZEND_LOG_XOR(a, b)		(ZEND_TRUTH(a) ^ ZEND_TRUTH(b))

@@ -72,6 +72,10 @@ typedef unsigned long int uint32_t;
 #define NO_INFNAN_CHECK
 #endif

+#ifndef NO_ERRNO
+#define NO_ERRNO
+#endif
+
 #ifdef WORDS_BIGENDIAN
 #define IEEE_BIG_ENDIAN 1
 #else
@@ -219,8 +219,10 @@ ZEND_API void ZEND_FASTCALL _zval_copy_ctor_func(zval *zvalue ZEND_FILE_LINE_DC)
 {
 	if (EXPECTED(Z_TYPE_P(zvalue) == IS_ARRAY)) {
 		ZVAL_ARR(zvalue, zend_array_dup(Z_ARRVAL_P(zvalue)));
-	} else if (EXPECTED(Z_TYPE_P(zvalue) == IS_STRING) ||
-	           EXPECTED(Z_TYPE_P(zvalue) == IS_CONSTANT)) {
+	} else if (EXPECTED(Z_TYPE_P(zvalue) == IS_STRING)) {
+		CHECK_ZVAL_STRING_REL(Z_STR_P(zvalue));
+		ZVAL_NEW_STR(zvalue, zend_string_dup(Z_STR_P(zvalue), 0));
+	} else if (EXPECTED(Z_TYPE_P(zvalue) == IS_CONSTANT)) {
 		CHECK_ZVAL_STRING_REL(Z_STR_P(zvalue));
 		Z_STR_P(zvalue) = zend_string_dup(Z_STR_P(zvalue), 0);
 	} else if (EXPECTED(Z_TYPE_P(zvalue) == IS_CONSTANT_AST)) {
@@ -45,6 +45,19 @@
 #  define IO_REPARSE_TAG_DEDUP   0x80000013
 # endif

+# ifndef IO_REPARSE_TAG_CLOUD
+#  define IO_REPARSE_TAG_CLOUD    (0x9000001AL)
+# endif
+/* IO_REPARSE_TAG_CLOUD_1 through IO_REPARSE_TAG_CLOUD_F have values of 0x9000101AL
+   to 0x9000F01AL, they can be checked against the mask. */
+#ifndef IO_REPARSE_TAG_CLOUD_MASK
+#define IO_REPARSE_TAG_CLOUD_MASK (0x0000F000L)
+#endif
+
+#ifndef IO_REPARSE_TAG_ONEDRIVE
+#define IO_REPARSE_TAG_ONEDRIVE   (0x80000021L)
+#endif
+
 # ifndef VOLUME_NAME_NT
 #  define VOLUME_NAME_NT 0x2
 # endif
@@ -908,7 +921,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 				return -1;
 			}

-			hLink = CreateFile(path, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_FLAG_OPEN_REPARSE_POINT|FILE_FLAG_BACKUP_SEMANTICS, NULL);
+			hLink = CreateFile(path, 0, 0, NULL, OPEN_EXISTING, FILE_FLAG_OPEN_REPARSE_POINT|FILE_FLAG_BACKUP_SEMANTICS, NULL);
 			if(hLink == INVALID_HANDLE_VALUE) {
 				return -1;
 			}
@@ -977,7 +990,11 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 				};
 				substitutename[substitutename_len] = 0;
 			}
-			else if (pbuffer->ReparseTag == IO_REPARSE_TAG_DEDUP) {
+			else if (pbuffer->ReparseTag == IO_REPARSE_TAG_DEDUP ||
+					/* Starting with 1709. */
+					(pbuffer->ReparseTag & IO_REPARSE_TAG_CLOUD_MASK) != 0 && 0x90001018L != pbuffer->ReparseTag ||
+					IO_REPARSE_TAG_CLOUD == pbuffer->ReparseTag ||
+					IO_REPARSE_TAG_ONEDRIVE == pbuffer->ReparseTag) {
 				isabsolute = 1;
 				memcpy(substitutename, path, len + 1);
 				substitutename_len = len;
@@ -2692,21 +2692,21 @@ EOF
  else 
    CONFIGURE_COMMAND="$CONFIGURE_COMMAND [$]0"
  fi
-
-  for arg in $clean_configure_args; do
-    if test `expr -- $arg : "'.*"` = 0; then
-      if test `expr -- $arg : "-.*"` = 0 && test `expr -- $arg : ".*=.*"` = 0; then
-        continue;
-      fi
-      echo "'[$]arg' \\" >> $1
-      CONFIGURE_OPTIONS="$CONFIGURE_OPTIONS '[$]arg'"
-    else
-      if test `expr -- $arg : "'-.*"` = 0 && test `expr -- $arg : "'.*=.*"` = 0; then
-        continue;
-      fi
-      echo "[$]arg \\" >> $1
-      CONFIGURE_OPTIONS="$CONFIGURE_OPTIONS [$]arg"
-    fi
+  CONFIGURE_ARGS="$clean_configure_args"
+  while test "X$CONFIGURE_ARGS" != "X";
+  do
+   if CURRENT_ARG=`expr "X$CONFIGURE_ARGS" : "X *\('[[^']]*'\)"`
+   then
+     CONFIGURE_ARGS=`expr "X$CONFIGURE_ARGS" : "X *'[[^']]*' \(.*\)"`
+   elif CURRENT_ARG=`expr "X$CONFIGURE_ARGS" : "X *\([[^ ]]*\)"`
+   then
+     CONFIGURE_ARGS=`expr "X$CONFIGURE_ARGS" : "X *[[^ ]]* \(.*\)"`
+     CURRENT_ARG="'$CURRENT_ARG'"
+   else
+    break
+   fi
+   $as_echo "$CURRENT_ARG \\" >>$1
+   CONFIGURE_OPTIONS="$CONFIGURE_OPTIONS $CURRENT_ARG"
  done
  echo '"[$]@"' >> $1
  chmod +x $1
@@ -2,6 +2,7 @@

 set SDK_REMOTE=https://github.com/OSTC/php-sdk-binary-tools.git
 set SDK_BRANCH=%PHP_BUILD_SDK_BRANCH%
+set SDK_RUNNER=%PHP_BUILD_CACHE_SDK_DIR%\phpsdk-vc14-%PLATFORM%.bat

 if not exist "%PHP_BUILD_CACHE_BASE_DIR%" (
 	echo Creating %PHP_BUILD_CACHE_BASE_DIR%
@@ -13,17 +14,25 @@ if not exist "%PHP_BUILD_OBJ_DIR%" (
 	mkdir "%PHP_BUILD_OBJ_DIR%"
 )

+if not exist "%SDK_RUNNER%" (
+	if exist "%PHP_BUILD_CACHE_SDK_DIR%" rmdir /s /q "%PHP_BUILD_CACHE_SDK_DIR%"
+)
+
 if not exist "%PHP_BUILD_CACHE_SDK_DIR%" (
 	echo Cloning remote SDK repository
 	git clone --branch %SDK_BRANCH% %SDK_REMOTE% "%PHP_BUILD_CACHE_SDK_DIR%" 2>&1 
-) else (
+)
+
+for /f "tokens=*" %%a in ('type %PHP_BUILD_CACHE_SDK_DIR%\VERSION') do set GOT_SDK_VER=%%a
+echo Got SDK version %GOT_SDK_VER%
+if NOT "%GOT_SDK_VER%" == "%PHP_BUILD_SDK_BRANCH:~8%" (
+	echo Switching to the configured SDK version %SDK_BRANCH:~8%
 	echo Fetching remote SDK repository
 	git --git-dir="%PHP_BUILD_CACHE_SDK_DIR%\.git" --work-tree="%PHP_BUILD_CACHE_SDK_DIR%" fetch --prune origin 2>&1
 	echo Checkout SDK repository branch
 	git --git-dir="%PHP_BUILD_CACHE_SDK_DIR%\.git" --work-tree="%PHP_BUILD_CACHE_SDK_DIR%" checkout --force %SDK_BRANCH% 
 )

-set SDK_RUNNER=%PHP_BUILD_CACHE_SDK_DIR%\phpsdk-vc14-%PLATFORM%.bat
 if not exist "%SDK_RUNNER%" (
 	echo "%SDK_RUNNER%" doesn't exist
 	exit /b 3
@@ -2,10 +2,14 @@

 if "%APPVEYOR%" equ "True" rmdir /s /q C:\cygwin >NUL 2>NUL
 if %errorlevel% neq 0 exit /b 3
+if "%APPVEYOR%" equ "True" rmdir /s /q C:\cygwin64 >NUL 2>NUL
+if %errorlevel% neq 0 exit /b 3
 if "%APPVEYOR%" equ "True" rmdir /s /q C:\mingw >NUL 2>NUL
 if %errorlevel% neq 0 exit /b 3
 if "%APPVEYOR%" equ "True" rmdir /s /q C:\mingw-w64 >NUL 2>NUL
 if %errorlevel% neq 0 exit /b 3
+if "%APPVEYOR%" equ "True" rmdir /s /q C:\msys64 >NUL 2>NUL
+if %errorlevel% neq 0 exit /b 3

 cd /D %APPVEYOR_BUILD_FOLDER%
 if %errorlevel% neq 0 exit /b 3
@@ -34,7 +38,7 @@ if %errorlevel% neq 0 exit /b 3

 if "%THREAD_SAFE%" equ "0" set ADD_CONF=--disable-zts

-set EXT_EXCLUDE_FROM_TEST=snmp,oci8_12c,pdo_oci,pdo_odbc,odbc,pdo_firebird,interbase,ldap,imap,dba
+set EXT_EXCLUDE_FROM_TEST=snmp,oci8_12c,pdo_oci,pdo_odbc,odbc,pdo_firebird,interbase,ldap,imap,dba,ftp
 if "%OPCACHE%" equ "0" set EXT_EXCLUDE_FROM_TEST=%EXT_EXCLUDE_FROM_TEST%,opcache

 cmd /c configure.bat ^
@@ -119,7 +119,7 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=0
-PHP_RELEASE_VERSION=22
+PHP_RELEASE_VERSION=29
 PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
@@ -59,7 +59,7 @@ bc_divmod (bc_num num1, bc_num num2, bc_num *quot, bc_num *rem, int scale)
  bc_init_num(&temp);

  /* Calculate it. */
-  bc_divide (num1, num2, &temp, scale);
+  bc_divide (num1, num2, &temp, 0);
  if (quot)
    quotient = bc_copy_num (temp);
  bc_multiply (temp, num2, &temp, rscale);
@@ -45,7 +45,7 @@
 int
 bc_raisemod (bc_num base, bc_num expo, bc_num mod, bc_num *result, int scale)
 {
-  bc_num power, exponent, parity, temp;
+  bc_num power, exponent, modulus, parity, temp;
  int rscale;

  /* Check for correct numbers. */
@@ -55,12 +55,16 @@ bc_raisemod (bc_num base, bc_num expo, bc_num mod, bc_num *result, int scale)
  /* Set initial values.  */
  power = bc_copy_num (base);
  exponent = bc_copy_num (expo);
+  modulus = bc_copy_num (mod);
  temp = bc_copy_num (BCG(_one_));
  bc_init_num(&parity);

  /* Check the base for scale digits. */
-  if (base->n_scale != 0)
+  if (power->n_scale != 0)
+    {
      bc_rt_warn ("non-zero scale in base");
+      bc_divide (power, BCG(_one_), &power, 0); /*truncate */
+    }

  /* Check the exponent for scale digits. */
  if (exponent->n_scale != 0)
@@ -70,27 +74,38 @@ bc_raisemod (bc_num base, bc_num expo, bc_num mod, bc_num *result, int scale)
    }

  /* Check the modulus for scale digits. */
-  if (mod->n_scale != 0)
+  if (modulus->n_scale != 0)
+    {
      bc_rt_warn ("non-zero scale in modulus");
+      bc_divide (modulus, BCG(_one_), &modulus, 0); /*truncate */
+    }

  /* Do the calculation. */
-  rscale = MAX(scale, base->n_scale);
-  while ( !bc_is_zero(exponent) )
+  rscale = MAX(scale, power->n_scale);
+  if ( !bc_compare(modulus, BCG(_one_)) )
    {
-      (void) bc_divmod (exponent, BCG(_two_), &exponent, &parity, 0);
-      if ( !bc_is_zero(parity) )
+      temp = bc_new_num (1, scale);
+    }
+  else
+    {
+      while ( !bc_is_zero(exponent) )
 	{
-	  bc_multiply (temp, power, &temp, rscale);
-	  (void) bc_modulo (temp, mod, &temp, scale);
-	}
+	  (void) bc_divmod (exponent, BCG(_two_), &exponent, &parity, 0);
+	  if ( !bc_is_zero(parity) )
+	    {
+	      bc_multiply (temp, power, &temp, rscale);
+	      (void) bc_modulo (temp, modulus, &temp, scale);
+	    }

-      bc_multiply (power, power, &power, rscale);
-      (void) bc_modulo (power, mod, &power, scale);
+	  bc_multiply (power, power, &power, rscale);
+	  (void) bc_modulo (power, modulus, &power, scale);
+	}
    }

  /* Assign the value. */
  bc_free_num (&power);
  bc_free_num (&exponent);
+  bc_free_num (&modulus);
  bc_free_num (result);
  bc_free_num (&parity);
  *result = temp;
@@ -105,5 +105,8 @@ bc_str2num (bc_num *num, char *str, int scale)
      for (;strscale > 0; strscale--)
 	*nptr++ = CH_VAL(*ptr++);
    }
+
+  if (bc_is_zero (*num))
+    (*num)->n_sign = PLUS;
 }

@@ -0,0 +1,16 @@
+--TEST--
+Bug #44995 (bcpowmod() fails if scale != 0)
+--SKIPIF--
+<?php
+if (!extension_loaded('bcmath')) die('skip bcmath extension not available');
+?>
+--FILE--
+<?php
+var_dump(bcpowmod('4', '4', '3', 1));
+var_dump(bcpowmod('3234', '32345', '22345', 1));
+?>
+===DONE===
+--EXPECT--
+string(3) "1.0"
+string(7) "17334.0"
+===DONE===
@@ -0,0 +1,16 @@
+--TEST--
+Bug #46781 (BC math handles minus zero incorrectly)
+--SKIPIF--
+<?php
+if (!extension_loaded('bcmath')) die('skip bcmath extension is not available');
+?>
+--FILE--
+<?php
+var_dump(bcadd('-0.0', '-0.0', 1));
+var_dump(bccomp('-0.0', '0', 1));
+?>
+===DONE===
+--EXPECT--
+string(3) "0.0"
+int(0)
+===DONE===
@@ -0,0 +1,16 @@
+--TEST--
+Bug #54598 (bcpowmod() may return 1 if modulus is 1)
+--SKIPIF--
+<?php
+if (!extension_loaded('bcmath')) die('skip bcmath extension is not available');
+?>
+--FILE--
+<?php
+var_dump(bcpowmod(5, 0, 1));
+var_dump(bcpowmod(5, 0, 1, 3));
+?>
+===DONE===
+--EXPECT--
+string(1) "0"
+string(5) "0.000"
+===DONE===
@@ -0,0 +1,21 @@
+--TEST--
+Bug #75178 (bcpowmod() misbehaves for non-integer base or modulus)
+--SKIPIF--
+<?php
+if (!extension_loaded('bcmath')) die('skip bcmath extension is not available');
+if (substr(PHP_OS, 0, 3) != 'WIN') {
+    die('skip valid only for windows');
+}
+?>
+--FILE--
+<?php
+var_dump(bcpowmod('4.1', '4', '3', 3));
+var_dump(bcpowmod('4', '4', '3.1', 3));
+?>
+===DONE===
+--EXPECT--
+string(5) "1.000"
+string(5) "1.000"
+===DONE===
+bc math warning: non-zero scale in base
+bc math warning: non-zero scale in modulus
@@ -0,0 +1,21 @@
+--TEST--
+Bug #75178 (bcpowmod() misbehaves for non-integer base or modulus)
+--SKIPIF--
+<?php
+if (!extension_loaded('bcmath')) die('skip bcmath extension is not available');
+if (substr(PHP_OS, 0, 3) == 'WIN') {
+    die('skip Not valid for windows');
+}
+?>
+--FILE--
+<?php
+var_dump(bcpowmod('4.1', '4', '3', 3));
+var_dump(bcpowmod('4', '4', '3.1', 3));
+?>
+===DONE===
+--EXPECT--
+bc math warning: non-zero scale in base
+string(5) "1.000"
+bc math warning: non-zero scale in modulus
+string(5) "1.000"
+===DONE===
@@ -17,12 +17,24 @@ if test "$PHP_CURL" != "no"; then
        break
      fi
    done
+    if test -z "$CURL_DIR"; then
+      AC_MSG_RESULT(not found)
+      if which dpkg-architecture>/dev/null; then
+        AC_MSG_CHECKING(for cURL in multiarch path)
+        CURL_MULTIARCH_INCLUDE=/usr/include/$(dpkg-architecture -qDEB_HOST_MULTIARCH)
+        if test -r $CURL_MULTIARCH_INCLUDE/curl/easy.h; then
+          CURL_DIR=/usr
+          AC_MSG_RESULT(found in $CURL_MULTIARCH_INCLUDE)
+        else
+          AC_MSG_RESULT(not found)
+        fi
+      fi
+    fi
  fi

  if test -z "$CURL_DIR"; then
-    AC_MSG_RESULT(not found)
-    AC_MSG_ERROR(Please reinstall the libcurl distribution -
-    easy.h should be in <curl-dir>/include/curl/)
+    AC_MSG_ERROR(Could not find cURL, please reinstall the libcurl distribution -dnl
+ easy.h should be in <curl-dir>/include/curl/)
  fi

  CURL_CONFIG="curl-config"
@@ -45,7 +57,11 @@ if test "$PHP_CURL" != "no"; then
    AC_MSG_ERROR(cURL version 7.10.5 or later is required to compile php with cURL support)
  fi

-  PHP_ADD_INCLUDE($CURL_DIR/include)
+  if test -z "$CURL_MULTIARCH_INCLUDE"; then
+    PHP_ADD_INCLUDE($CURL_DIR/include)
+  else
+    PHP_ADD_INCLUDE($CURL_MULTIARCH_INCLUDE)
+  fi
  PHP_EVAL_LIBLINE($CURL_LIBS, CURL_SHARED_LIBADD)
  PHP_ADD_LIBRARY_WITH_PATH(curl, $CURL_DIR/$PHP_LIBDIR, CURL_SHARED_LIBADD)
  
@@ -57,6 +73,8 @@ if test "$PHP_CURL" != "no"; then
   
    save_CFLAGS="$CFLAGS"
    CFLAGS="`$CURL_CONFIG --cflags`"
+    save_LDFLAGS="$LDFLAGS"
+    LDFLAGS="`$CURL_CONFIG --libs`"
   
    AC_PROG_CPP
    AC_MSG_CHECKING([for openssl support in libcurl])
@@ -114,6 +132,7 @@ int main(int argc, char *argv[])
    ])
   
    CFLAGS="$save_CFLAGS"
+    LDFLAGS="$save_LDFLAGS"
  else
    AC_MSG_RESULT([no])
  fi
@@ -917,8 +917,8 @@ isoweek          = year4 "-"? "W" weekofyear;
 exif             = year4 ":" monthlz ":" daylz " " hour24lz ":" minutelz ":" secondlz;
 firstdayof       = 'first day of';
 lastdayof        = 'last day of';
-backof           = 'back of ' hour24 space? meridian?;
-frontof          = 'front of ' hour24 space? meridian?;
+backof           = 'back of ' hour24 (space? meridian)?;
+frontof          = 'front of ' hour24 (space? meridian)?;

 /* Common Log Format: 10/Oct/2000:13:55:36 -0700 */
 clf              = day "/" monthabbr "/" year4 ":" hour24lz ":" minutelz ":" secondlz space tzcorrection;
@@ -647,6 +647,7 @@ static HashTable *date_object_get_gc_timezone(zval *object, zval **table, int *n

 zval *date_interval_read_property(zval *object, zval *member, int type, void **cache_slot, zval *rv);
 void date_interval_write_property(zval *object, zval *member, zval *value, void **cache_slot);
+static zval *date_interval_get_property_ptr_ptr(zval *object, zval *member, int type, void **cache_slot);
 static zval *date_period_read_property(zval *object, zval *member, int type, void **cache_slot, zval *rv);
 static void date_period_write_property(zval *object, zval *member, zval *value, void **cache_slot);

@@ -910,6 +911,7 @@ PHP_MINFO_FUNCTION(date)

 	php_info_print_table_start();
 	php_info_print_table_row(2, "date/time support", "enabled");
+	php_info_print_table_row(2, "timelib version", TIMELIB_ASCII_VERSION);
 	php_info_print_table_row(2, "\"Olson\" Timezone Database Version", tzdb->version);
 	php_info_print_table_row(2, "Timezone Database", php_date_global_timezone_db_enabled ? "external" : "internal");
 	php_info_print_table_row(2, "Default timezone", guess_timezone(tzdb));
@@ -1932,6 +1934,10 @@ static void date_period_it_rewind(zend_object_iterator *iter)
 	if (iterator->object->current) {
 		timelib_time_dtor(iterator->object->current);
 	}
+	if (!iterator->object->start) {
+		zend_throw_error(NULL, "DatePeriod has not been initialized correctly");
+		return;
+	}
 	iterator->object->current = timelib_time_clone(iterator->object->start);
 	date_period_it_invalidate_current(iter);
 }
@@ -2112,7 +2118,7 @@ static void date_register_classes(void) /* {{{ */
 	date_object_handlers_interval.read_property = date_interval_read_property;
 	date_object_handlers_interval.write_property = date_interval_write_property;
 	date_object_handlers_interval.get_properties = date_object_get_properties_interval;
-	date_object_handlers_interval.get_property_ptr_ptr = NULL;
+	date_object_handlers_interval.get_property_ptr_ptr = date_interval_get_property_ptr_ptr;
 	date_object_handlers_interval.get_gc = date_object_get_gc_interval;

 	INIT_CLASS_ENTRY(ce_period, "DatePeriod", date_funcs_period);
@@ -4137,6 +4143,40 @@ void date_interval_write_property(zval *object, zval *member, zval *value, void
 }
 /* }}} */

+/* {{{ date_interval_get_property_ptr_ptr */
+static zval *date_interval_get_property_ptr_ptr(zval *object, zval *member, int type, void **cache_slot)
+{
+	zval tmp_member, *ret;
+
+	if (Z_TYPE_P(member) != IS_STRING) {
+		tmp_member = *member;
+		zval_copy_ctor(&tmp_member);
+		convert_to_string(&tmp_member);
+		member = &tmp_member;
+		cache_slot = NULL;
+	}
+
+	if(zend_binary_strcmp("y", sizeof("y") - 1, Z_STRVAL_P(member), Z_STRLEN_P(member)) == 0 ||
+		zend_binary_strcmp("m", sizeof("m") - 1, Z_STRVAL_P(member), Z_STRLEN_P(member)) == 0 ||
+		zend_binary_strcmp("d", sizeof("d") - 1, Z_STRVAL_P(member), Z_STRLEN_P(member)) == 0 ||
+		zend_binary_strcmp("h", sizeof("h") - 1, Z_STRVAL_P(member), Z_STRLEN_P(member)) == 0 ||
+		zend_binary_strcmp("i", sizeof("i") - 1, Z_STRVAL_P(member), Z_STRLEN_P(member)) == 0 ||
+		zend_binary_strcmp("s", sizeof("s") - 1, Z_STRVAL_P(member), Z_STRLEN_P(member)) == 0 ||
+		zend_binary_strcmp("days", sizeof("days") - 1, Z_STRVAL_P(member), Z_STRLEN_P(member)) == 0 ||
+		zend_binary_strcmp("invert", sizeof("invert") - 1, Z_STRVAL_P(member), Z_STRLEN_P(member)) == 0) {
+		/* Fallback to read_property. */
+		ret = NULL;
+	} else {
+		ret = (zend_get_std_object_handlers())->get_property_ptr_ptr(object, member, type, cache_slot);
+	}
+
+	if (member == &tmp_member) {
+		zval_dtor(member);
+	}
+
+	return ret;
+}
+/* }}} */

 /* {{{ proto DateInterval::__construct([string interval_spec])
   Creates new DateInterval object.
@@ -8,17 +8,8 @@ date_default_timezone_set('UTC');
  echo "Done\n";
 ?>
 --EXPECTF--
-array(6) {
+array(5) {
  [0]=>
-  array(3) {
-    ["dst"]=>
-    bool(false)
-    ["offset"]=>
-    int(0)
-    ["timezone_id"]=>
-    string(16) "Antarctica/Troll"
-  }
-  [1]=>
  array(3) {
    ["dst"]=>
    bool(false)
@@ -27,7 +18,7 @@ array(6) {
    ["timezone_id"]=>
    string(13) "Etc/Universal"
  }
-  [2]=>
+  [1]=>
  array(3) {
    ["dst"]=>
    bool(false)
@@ -36,7 +27,7 @@ array(6) {
    ["timezone_id"]=>
    string(7) "Etc/UTC"
  }
-  [3]=>
+  [2]=>
  array(3) {
    ["dst"]=>
    bool(false)
@@ -45,6 +36,15 @@ array(6) {
    ["timezone_id"]=>
    string(8) "Etc/Zulu"
  }
+  [3]=>
+  array(3) {
+    ["dst"]=>
+    bool(false)
+    ["offset"]=>
+    int(0)
+    ["timezone_id"]=>
+    string(3) "UTC"
+  }
  [4]=>
  array(3) {
    ["dst"]=>
@@ -54,14 +54,5 @@ array(6) {
    ["timezone_id"]=>
    string(3) "UTC"
  }
-  [5]=>
-  array(3) {
-    ["dst"]=>
-    bool(false)
-    ["offset"]=>
-    int(0)
-    ["timezone_id"]=>
-    string(3) "UTC"
-  }
 }
 Done
@@ -1,6 +1,5 @@
 --TEST--
-DateTimeZone::getLocation -- timezone_location_get — Returns location information for a timezone
-public array DateTimeZone::getLocation ( void ) ;
+DateTimeZone::getLocation -- timezone_location_get — Returns location information for a timezone public array DateTimeZone::getLocation ( void ) ;
 --CREDITS--
 marcosptf - <marcosptf@yahoo.com.br> - #phparty7 - @phpsp - novatec/2015 - sao paulo - br
 --SKIPIF--
@@ -53,30 +52,9 @@ Array
    [comments] => %s
 )
 Array
-(
-    [country_code] => %s
-    [latitude] => %f
-    [longitude] => %f
-    [comments] => 
-)
-Array
 (
    [country_code] => %s
    [latitude] => %f
    [longitude] => %f
    [comments] => %s
 )
-Array
-(
-    [country_code] => %s
-    [latitude] => %f
-    [longitude] => %f
-    [comments] => %s
-)
-Array
-(
-    [country_code] => %s
-    [latitude] => %f
-    [longitude] => %f
-    [comments] => 
-)
@@ -29,15 +29,15 @@ string(5) "array"
 int(%d)

 -- Format a sample entry --
-array(11) {
+array(12) {
  [0]=>
  array(3) {
    ["dst"]=>
-    bool(true)
+    bool(false)
    ["offset"]=>
-    int(-14400)
+    int(32400)
    ["timezone_id"]=>
-    string(18) "America/Porto_Acre"
+    string(18) "Australia/Adelaide"
  }
  [1]=>
  array(3) {
@@ -51,47 +51,47 @@ array(11) {
  [2]=>
  array(3) {
    ["dst"]=>
-    bool(true)
+    bool(false)
    ["offset"]=>
-    int(-14400)
+    int(32400)
    ["timezone_id"]=>
-    string(16) "America/Eirunepe"
+    string(21) "Australia/Broken_Hill"
  }
  [3]=>
  array(3) {
    ["dst"]=>
-    bool(true)
+    bool(false)
    ["offset"]=>
-    int(-14400)
+    int(32400)
    ["timezone_id"]=>
-    string(18) "America/Rio_Branco"
+    string(16) "Australia/Darwin"
  }
  [4]=>
  array(3) {
    ["dst"]=>
-    bool(true)
+    bool(false)
    ["offset"]=>
-    int(-14400)
+    int(32400)
    ["timezone_id"]=>
-    string(11) "Brazil/Acre"
+    string(15) "Australia/North"
  }
  [5]=>
  array(3) {
    ["dst"]=>
    bool(false)
    ["offset"]=>
-    int(34200)
+    int(32400)
    ["timezone_id"]=>
-    string(13) "Asia/Jayapura"
+    string(15) "Australia/South"
  }
  [6]=>
  array(3) {
    ["dst"]=>
    bool(false)
    ["offset"]=>
-    int(34200)
+    int(32400)
    ["timezone_id"]=>
-    string(21) "Australia/Broken_Hill"
+    string(20) "Australia/Yancowinna"
  }
  [7]=>
  array(3) {
@@ -100,7 +100,7 @@ array(11) {
    ["offset"]=>
    int(34200)
    ["timezone_id"]=>
-    string(16) "Australia/Darwin"
+    string(21) "Australia/Broken_Hill"
  }
  [8]=>
  array(3) {
@@ -109,7 +109,7 @@ array(11) {
    ["offset"]=>
    int(34200)
    ["timezone_id"]=>
-    string(15) "Australia/North"
+    string(16) "Australia/Darwin"
  }
  [9]=>
  array(3) {
@@ -118,9 +118,18 @@ array(11) {
    ["offset"]=>
    int(34200)
    ["timezone_id"]=>
-    string(15) "Australia/South"
+    string(15) "Australia/North"
  }
  [10]=>
+  array(3) {
+    ["dst"]=>
+    bool(false)
+    ["offset"]=>
+    int(34200)
+    ["timezone_id"]=>
+    string(15) "Australia/South"
+  }
+  [11]=>
  array(3) {
    ["dst"]=>
    bool(false)
@@ -5,7 +5,7 @@ date.timezone=Asia/Singapore
 --FILE--
 <?php

-print strtotime('2008-05-23 00:00:00 SGT');
+print strtotime('2008-05-23 00:00:00 +08');
 print "\n";
 print strtotime('2008-05-23 00:00:00');

@@ -40,7 +40,7 @@ object(DateInterval)#%d (15) {
  ["special_amount"]=>
  int(-1)
  ["have_weekday_relative"]=>
-  int(9)
+  int(%d)
  ["have_special_relative"]=>
  int(0)
 }
@@ -0,0 +1,22 @@
+--TEST--
+Bug #75002 Null Pointer Dereference in timelib_time_clone
+--FILE--
+<?php
+
+class aaa extends DatePeriod {
+	public function __construct() { }
+}
+
+$start=new DateTime( '2012-08-01' );
+
+foreach (new aaa($start) as $y) {
+	$a=$key;
+}
+
+?>
+==DONE==
+--EXPECTF--	
+Fatal error: Uncaught Error: DatePeriod has not been initialized correctly in %sbug75002.php:%d
+Stack trace:
+#0 {main}
+  thrown in %sbug75002.php on line %d
@@ -0,0 +1,16 @@
+--TEST--
+Test DateInterval props with dimension handling
+--FILE--
+<?php
+class Z extends DateInterval{}
+$z = new Z('P2Y4DT6H8M');
+$i = 0;
+$z->prop[1]=10;
+while ($i < 1026) {
+	$z->prop[$i] = $i;
+	$i++;
+}
+?>
+==NOCRASH==
+--EXPECT--
+==NOCRASH==
@@ -26,18 +26,18 @@ var_dump( $abbr["acst"] );
 --EXPECTF--
 *** Testing timezone_abbreviations_list() : basic functionality ***
 string(5) "array"
-int(%d)
+int(142)

 -- Format a sample entry --
-array(11) {
+array(12) {
  [0]=>
  array(3) {
    ["dst"]=>
-    bool(true)
+    bool(false)
    ["offset"]=>
-    int(-14400)
+    int(32400)
    ["timezone_id"]=>
-    string(18) "America/Porto_Acre"
+    string(18) "Australia/Adelaide"
  }
  [1]=>
  array(3) {
@@ -51,47 +51,47 @@ array(11) {
  [2]=>
  array(3) {
    ["dst"]=>
-    bool(true)
+    bool(false)
    ["offset"]=>
-    int(-14400)
+    int(32400)
    ["timezone_id"]=>
-    string(16) "America/Eirunepe"
+    string(21) "Australia/Broken_Hill"
  }
  [3]=>
  array(3) {
    ["dst"]=>
-    bool(true)
+    bool(false)
    ["offset"]=>
-    int(-14400)
+    int(32400)
    ["timezone_id"]=>
-    string(18) "America/Rio_Branco"
+    string(16) "Australia/Darwin"
  }
  [4]=>
  array(3) {
    ["dst"]=>
-    bool(true)
+    bool(false)
    ["offset"]=>
-    int(-14400)
+    int(32400)
    ["timezone_id"]=>
-    string(11) "Brazil/Acre"
+    string(15) "Australia/North"
  }
  [5]=>
  array(3) {
    ["dst"]=>
    bool(false)
    ["offset"]=>
-    int(34200)
+    int(32400)
    ["timezone_id"]=>
-    string(13) "Asia/Jayapura"
+    string(15) "Australia/South"
  }
  [6]=>
  array(3) {
    ["dst"]=>
    bool(false)
    ["offset"]=>
-    int(34200)
+    int(32400)
    ["timezone_id"]=>
-    string(21) "Australia/Broken_Hill"
+    string(20) "Australia/Yancowinna"
  }
  [7]=>
  array(3) {
@@ -100,7 +100,7 @@ array(11) {
    ["offset"]=>
    int(34200)
    ["timezone_id"]=>
-    string(16) "Australia/Darwin"
+    string(21) "Australia/Broken_Hill"
  }
  [8]=>
  array(3) {
@@ -109,7 +109,7 @@ array(11) {
    ["offset"]=>
    int(34200)
    ["timezone_id"]=>
-    string(15) "Australia/North"
+    string(16) "Australia/Darwin"
  }
  [9]=>
  array(3) {
@@ -118,9 +118,18 @@ array(11) {
    ["offset"]=>
    int(34200)
    ["timezone_id"]=>
-    string(15) "Australia/South"
+    string(15) "Australia/North"
  }
  [10]=>
+  array(3) {
+    ["dst"]=>
+    bool(false)
+    ["offset"]=>
+    int(34200)
+    ["timezone_id"]=>
+    string(15) "Australia/South"
+  }
+  [11]=>
  array(3) {
    ["dst"]=>
    bool(false)
@@ -24,11 +24,6 @@ var_dump( timezone_name_from_abbr("EDT") );
 echo "-- Lookup with name and offset--\n"; 
 var_dump( timezone_name_from_abbr("ADT", -10800) );
 var_dump( timezone_name_from_abbr("ADT", 14400) );
-var_dump( timezone_name_from_abbr("AKTT", 14400) );
-var_dump( timezone_name_from_abbr("aktt", 18000) );
-var_dump( timezone_name_from_abbr("Aktt", 21600) );
-var_dump( timezone_name_from_abbr("AMST", -10800) );
-var_dump( timezone_name_from_abbr("amst", 180000) );

 echo "-- Tests without valid name - uses gmtOffset and isdst to find match --\n"; 
 var_dump( timezone_name_from_abbr("", 3600, 1) );
@@ -51,12 +46,7 @@ string(13) "Europe/Berlin"
 string(16) "America/New_York"
 -- Lookup with name and offset--
 string(15) "America/Halifax"
-string(12) "Asia/Baghdad"
-string(11) "Asia/Aqtobe"
-string(11) "Asia/Aqtobe"
-string(11) "Asia/Aqtobe"
-string(17) "America/Boa_Vista"
-string(12) "Asia/Yerevan"
+string(15) "America/Halifax"
 -- Tests without valid name - uses gmtOffset and isdst to find match --
 string(13) "Europe/London"
 string(17) "America/Sao_Paulo"
@@ -65,4 +55,4 @@ string(15) "America/Halifax"
 -- Tests with invalid offsets --
 bool(false)
 bool(false)
-===DONE===
+===DONE===
@@ -5,7 +5,7 @@ Test 5: HTML Test
 --FILE--
 <?php
 $dom = new domdocument;
-$dom->loadHTMLFile(dirname(__FILE__)."/test.html");
+$dom->loadHTMLFile(dirname(__FILE__)."/test.html", LIBXML_NOBLANKS);
 print  "--- save as XML\n";

 print adjustDoctype($dom->saveXML());
@@ -323,7 +323,6 @@ PHP_MINFO_FUNCTION(enchant)
 #elif defined(HAVE_ENCHANT_BROKER_SET_PARAM)
 	php_info_print_table_row(2, "Libenchant Version", "1.5.0 or later");
 #endif
-	php_info_print_table_row(2, "Revision", "$Id$");
 	php_info_print_table_end();

 	php_info_print_table_start();
@@ -483,6 +482,11 @@ PHP_FUNCTION(enchant_broker_get_dict_path)
 			RETURN_FALSE;
 	}

+	if (value == NULL) {
+		php_error_docref(NULL, E_WARNING, "dict_path not set");
+		RETURN_FALSE;
+	}
+
 	RETURN_STRING(value);
 }
 /* }}} */
@@ -24,7 +24,7 @@
 extern zend_module_entry enchant_module_entry;
 #define phpext_enchant_ptr &enchant_module_entry

-#define PHP_ENCHANT_VERSION "1.1.0"
+#define PHP_ENCHANT_VERSION PHP_VERSION

 #ifdef PHP_WIN32
 #define PHP_ENCHANT_API __declspec(dllexport)
@@ -0,0 +1,20 @@
+--TEST--
+Bug #53070 (enchant_broker_get_path crashes if no path is set)
+--SKIPIF--
+<?php
+if(!extension_loaded('enchant')) die('skip, enchant not loader');
+if (!is_resource(enchant_broker_init())) {die("skip, resource dont load\n");}
+?>
+--FILE--
+<?php
+$broker = enchant_broker_init();
+var_dump(enchant_broker_get_dict_path($broker, ENCHANT_MYSPELL));
+var_dump(enchant_broker_get_dict_path($broker, ENCHANT_ISPELL));
+?>
+--EXPECTF--
+
+Warning: enchant_broker_get_dict_path(): dict_path not set in %s on line %d
+bool(false)
+
+Warning: enchant_broker_get_dict_path(): dict_path not set in %s on line %d
+bool(false)
@@ -22,7 +22,7 @@
 #if HAVE_EXIF

 #include "php_version.h"
-#define PHP_EXIF_VERSION "1.4 $Id: 8bdc0c8f27c2c9dd1f7551f1f9fe3ab57a06a4b1 $"
+#define PHP_EXIF_VERSION PHP_VERSION

 extern zend_module_entry exif_module_entry;
 #define phpext_exif_ptr &exif_module_entry
@@ -0,0 +1,14 @@
+--TEST--
+Test exif_read_data on unavailable file
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+$infile = dirname(__FILE__).'/bug73115.JPG';
+exif_read_data($infile);
+?>
+===DONE===
+--EXPECTF--
+Warning: exif_read_data(): Unable to open file in %sexif_read_data_0.php on line %d
+===DONE===
+
@@ -1,2 +1,2 @@
 fileinfo
-Ilia Alshanetsky, Pierre Alain Joye, Scott MacVicar, Derick Rethans
+Ilia Alshanetsky, Pierre Alain Joye, Scott MacVicar, Derick Rethans, Anatol Belski
@@ -377,6 +377,7 @@ ZEND_END_ARG_INFO()
 ZEND_BEGIN_ARG_INFO_EX(arginfo_imagewebp, 0, 0, 1)
 	ZEND_ARG_INFO(0, im)
 	ZEND_ARG_INFO(0, filename)
+	ZEND_ARG_INFO(0, quality)
 ZEND_END_ARG_INFO()
 #endif

@@ -53,12 +53,17 @@ int gdImageGrayScale(gdImagePtr src)
 	int new_pxl, pxl;
 	typedef int (*FuncPtr)(gdImagePtr, int, int);
 	FuncPtr f;
+	int alpha_blending;
+
 	f = GET_PIXEL_FUNCTION(src);

 	if (src==NULL) {
 		return 0;
 	}

+	alpha_blending = src->alphaBlendingFlag;
+	gdImageAlphaBlending(src, gdEffectReplace);
+
 	for (y=0; y<src->sy; ++y) {
 		for (x=0; x<src->sx; ++x) {
 			pxl = f (src, x, y);
@@ -75,6 +80,8 @@ int gdImageGrayScale(gdImagePtr src)
 			gdImageSetPixel (src, x, y, new_pxl);
 		}
 	}
+	gdImageAlphaBlending(src, alpha_blending);
+
 	return 1;
 }

@@ -261,10 +261,6 @@ terminated:
 	if (!im) {
 		return 0;
 	}
-	if (!im->colorsTotal) {
-		gdImageDestroy(im);
-		return 0;
-	}
 	/* Check for open colors at the end, so
 	   we can reduce colorsTotal and ultimately
 	   BitsPerPixel */
@@ -275,6 +271,10 @@ terminated:
 			break;
 		}
 	}
+	if (!im->colorsTotal) {
+		gdImageDestroy(im);
+		return 0;
+	}
 	return im;
 }
 /* }}} */
@@ -375,7 +375,7 @@ static int
 GetCode_(gdIOCtx *fd, CODE_STATIC_DATA *scd, int code_size, int flag, int *ZeroDataBlockP)
 {
 	int           i, j, ret;
-	unsigned char count;
+	int           count;

 	if (flag) {
 		scd->curbit = 0;
@@ -66,6 +66,16 @@ TODO:
 # include <emmintrin.h>
 #endif

+#ifndef HAVE_FLOORF
+# define HAVE_FLOORF 0
+#endif
+#if HAVE_FLOORF == 0
+# ifndef floorf
+/* float floorf(float x);*/
+#  define floorf(x) ((float)(floor(x)))
+# endif
+#endif
+
 #ifndef MIN
 #define MIN(a,b) ((a)<(b)?(a):(b))
 #endif
@@ -1709,13 +1719,28 @@ gdImagePtr gdImageScale(const gdImagePtr src, const unsigned int new_width, cons
 	return im_scaled;
 }

+static int gdRotatedImageSize(gdImagePtr src, const float angle, gdRectPtr bbox)
+{
+    gdRect src_area;
+    double m[6];
+
+    gdAffineRotate(m, angle);
+    src_area.x = 0;
+    src_area.y = 0;
+    src_area.width = gdImageSX(src);
+    src_area.height = gdImageSY(src);
+    if (gdTransformAffineBoundingBox(&src_area, m, bbox) != GD_TRUE) {
+        return GD_FALSE;
+    }
+
+    return GD_TRUE;
+}
+
 gdImagePtr gdImageRotateNearestNeighbour(gdImagePtr src, const float degrees, const int bgColor)
 {
 	float _angle = ((float) (-degrees / 180.0f) * (float)M_PI);
 	const int src_w  = gdImageSX(src);
 	const int src_h = gdImageSY(src);
-	const unsigned int new_width = (unsigned int)(abs((int)(src_w * cos(_angle))) + abs((int)(src_h * sin(_angle))) + 0.5f);
-	const unsigned int new_height = (unsigned int)(abs((int)(src_w * sin(_angle))) + abs((int)(src_h * cos(_angle))) + 0.5f);
 	const gdFixed f_0_5 = gd_ftofx(0.5f);
 	const gdFixed f_H = gd_itofx(src_h/2);
 	const gdFixed f_W = gd_itofx(src_w/2);
@@ -1726,6 +1751,12 @@ gdImagePtr gdImageRotateNearestNeighbour(gdImagePtr src, const float degrees, co
 	unsigned int dst_offset_y = 0;
 	unsigned int i;
 	gdImagePtr dst;
+	gdRect bbox;
+	int new_height, new_width;
+
+    gdRotatedImageSize(src, degrees, &bbox);
+    new_width = bbox.width;
+    new_height = bbox.height;

 	if (new_width == 0 || new_height == 0) {
 		return NULL;
@@ -1768,8 +1799,6 @@ gdImagePtr gdImageRotateGeneric(gdImagePtr src, const float degrees, const int b
 	const int angle_rounded = (int)floor(degrees * 100);
 	const int src_w  = gdImageSX(src);
 	const int src_h = gdImageSY(src);
-	const unsigned int new_width = (unsigned int)(abs((int)(src_w * cos(_angle))) + abs((int)(src_h * sin(_angle))) + 0.5f);
-	const unsigned int new_height = (unsigned int)(abs((int)(src_w * sin(_angle))) + abs((int)(src_h * cos(_angle))) + 0.5f);
 	const gdFixed f_0_5 = gd_ftofx(0.5f);
 	const gdFixed f_H = gd_itofx(src_h/2);
 	const gdFixed f_W = gd_itofx(src_w/2);
@@ -1780,11 +1809,13 @@ gdImagePtr gdImageRotateGeneric(gdImagePtr src, const float degrees, const int b
 	unsigned int dst_offset_y = 0;
 	unsigned int i;
 	gdImagePtr dst;
+	int new_width, new_height;
+	gdRect bbox;

 	const gdFixed f_slop_y = f_sin;
 	const gdFixed f_slop_x = f_cos;
-	const gdFixed f_slop = f_slop_x > 0 && f_slop_x > 0 ?
-							f_slop_x > f_slop_y ? gd_divfx(f_slop_y, f_slop_x) : gd_divfx(f_slop_x, f_slop_y)
+	const gdFixed f_slop = f_slop_x > 0 && f_slop_y > 0 ?
+							(f_slop_x > f_slop_y ? gd_divfx(f_slop_y, f_slop_x) : gd_divfx(f_slop_x, f_slop_y))
 						: 0;


@@ -1792,6 +1823,10 @@ gdImagePtr gdImageRotateGeneric(gdImagePtr src, const float degrees, const int b
 		return NULL;
 	}

+    gdRotatedImageSize(src, degrees, &bbox);
+    new_width = bbox.width;
+    new_height = bbox.height;
+
 	dst = gdImageCreateTrueColor(new_width, new_height);
 	if (!dst) {
 		return NULL;
@@ -1831,8 +1866,7 @@ gdImagePtr gdImageRotateBilinear(gdImagePtr src, const float degrees, const int
 	float _angle = (float)((- degrees / 180.0f) * M_PI);
 	const unsigned int src_w = gdImageSX(src);
 	const unsigned int src_h = gdImageSY(src);
-	unsigned int new_width = abs((int)(src_w*cos(_angle))) + abs((int)(src_h*sin(_angle) + 0.5f));
-	unsigned int new_height = abs((int)(src_w*sin(_angle))) + abs((int)(src_h*cos(_angle) + 0.5f));
+	unsigned int new_width, new_height;
 	const gdFixed f_0_5 = gd_ftofx(0.5f);
 	const gdFixed f_H = gd_itofx(src_h/2);
 	const gdFixed f_W = gd_itofx(src_w/2);
@@ -1844,6 +1878,12 @@ gdImagePtr gdImageRotateBilinear(gdImagePtr src, const float degrees, const int
 	unsigned int dst_offset_y = 0;
 	unsigned int src_offset_x, src_offset_y;
 	gdImagePtr dst;
+	gdRect bbox;
+
+	gdRotatedImageSize(src, degrees, &bbox);
+
+	new_width = bbox.width;
+	new_height = bbox.height;

 	dst = gdImageCreateTrueColor(new_width, new_height);
 	if (dst == NULL) {
@@ -1863,7 +1903,7 @@ gdImagePtr gdImageRotateBilinear(gdImagePtr src, const float degrees, const int
 			const unsigned int m = gd_fxtoi(f_m);
 			const unsigned int n = gd_fxtoi(f_n);

-			if ((m > 0) && (m < src_h - 1) && (n > 0) && (n < src_w - 1)) {
+			if ((m >= 0) && (m < src_h - 1) && (n >= 0) && (n < src_w - 1)) {
 				const gdFixed f_f = f_m - gd_itofx(m);
 				const gdFixed f_g = f_n - gd_itofx(n);
 				const gdFixed f_w1 = gd_mulfx(f_1-f_f, f_1-f_g);
@@ -1871,11 +1911,6 @@ gdImagePtr gdImageRotateBilinear(gdImagePtr src, const float degrees, const int
 				const gdFixed f_w3 = gd_mulfx(f_f, f_1-f_g);
 				const gdFixed f_w4 = gd_mulfx(f_f, f_g);

-				if (n < src_w - 1) {
-					src_offset_x = n + 1;
-					src_offset_y = m;
-				}
-
 				if (m < src_h-1) {
 					src_offset_x = n;
 					src_offset_y = m + 1;
@@ -1890,13 +1925,13 @@ gdImagePtr gdImageRotateBilinear(gdImagePtr src, const float degrees, const int
 					register int pixel2, pixel3, pixel4;

 					if (src_offset_y + 1 >= src_h) {
-						pixel2 = bgColor;
-						pixel3 = bgColor;
-						pixel4 = bgColor;
+						pixel2 = pixel1;
+						pixel3 = pixel1;
+						pixel4 = pixel1;
 					} else if (src_offset_x + 1 >= src_w) {
-						pixel2 = bgColor;
-						pixel3 = bgColor;
-						pixel4 = bgColor;
+						pixel2 = pixel1;
+						pixel3 = pixel1;
+						pixel4 = pixel1;
 					} else {
 					    pixel2 = src->tpixels[src_offset_y][src_offset_x + 1];
 						pixel3 = src->tpixels[src_offset_y + 1][src_offset_x];
@@ -1946,8 +1981,7 @@ gdImagePtr gdImageRotateBicubicFixed(gdImagePtr src, const float degrees, const
 	const float _angle = (float)((- degrees / 180.0f) * M_PI);
 	const int src_w = gdImageSX(src);
 	const int src_h = gdImageSY(src);
-	const unsigned int new_width = abs((int)(src_w*cos(_angle))) + abs((int)(src_h*sin(_angle) + 0.5f));
-	const unsigned int new_height = abs((int)(src_w*sin(_angle))) + abs((int)(src_h*cos(_angle) + 0.5f));
+	unsigned int new_width, new_height;
 	const gdFixed f_0_5 = gd_ftofx(0.5f);
 	const gdFixed f_H = gd_itofx(src_h/2);
 	const gdFixed f_W = gd_itofx(src_w/2);
@@ -1963,7 +1997,11 @@ gdImagePtr gdImageRotateBicubicFixed(gdImagePtr src, const float degrees, const
 	unsigned int dst_offset_y = 0;
 	unsigned int i;
 	gdImagePtr dst;
+	gdRect bbox;

+	gdRotatedImageSize(src, degrees, &bbox);
+	new_width = bbox.width;
+	new_height = bbox.height;
 	dst = gdImageCreateTrueColor(new_width, new_height);

 	if (dst == NULL) {
@@ -2206,8 +2244,11 @@ gdImagePtr gdImageRotateBicubicFixed(gdImagePtr src, const float degrees, const

 gdImagePtr gdImageRotateInterpolated(const gdImagePtr src, const float angle, int bgcolor)
 {
-	const int angle_rounded = (int)floor(angle * 100);
-
+	/* round to two decimals and keep the 100x multiplication to use it in the common square angles 
+	   case later. Keep the two decimal precisions so smaller rotation steps can be done, useful for
+	   slow animations, f.e. */
+	const int angle_rounded = fmod((int) floorf(angle * 100), 360 * 100);
+	   
 	if (bgcolor < 0) {
 		return NULL;
 	}
@@ -2224,6 +2265,18 @@ gdImagePtr gdImageRotateInterpolated(const gdImagePtr src, const float angle, in

 	/* no interpolation needed here */
 	switch (angle_rounded) {
+		case    0: {
+			gdImagePtr dst = gdImageCreateTrueColor(src->sx, src->sy);
+			if (dst == NULL) {
+				return NULL;
+			}
+			dst->transparent = src->transparent;
+			dst->saveAlphaFlag = 1;
+			dst->alphaBlendingFlag = gdEffectReplace;
+
+			gdImageCopy(dst, src, 0,0,0,0,src->sx,src->sy);
+			return dst;
+		}
 		case -27000:
 		case   9000:
 			return gdImageRotate90(src, 0);
@@ -164,7 +164,10 @@ readwbmp (int (*getin) (void *in), void *in, Wbmp ** return_wbmp)
    }

  if (skipheader (getin, in))
-    return (-1);
+    {
+      gdFree (wbmp);
+      return (-1);
+    }


  wbmp->width = getmbi (getin, in);
@@ -0,0 +1,179 @@
+--TEST--
+Bug #65148 (imagerotate may alter image dimensions)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension is not available');
+?>
+--FILE--
+<?php
+
+$interpolations = array(
+    'IMG_BELL' => IMG_BELL,
+    'IMG_BESSEL' => IMG_BESSEL,
+    'IMG_BICUBIC' => IMG_BICUBIC,
+    'IMG_BICUBIC_FIXED' => IMG_BICUBIC_FIXED,
+    'IMG_BILINEAR_FIXED' => IMG_BILINEAR_FIXED,
+    'IMG_BLACKMAN' => IMG_BLACKMAN,
+    'IMG_BOX' => IMG_BOX,
+    'IMG_BSPLINE' => IMG_BSPLINE,
+    'IMG_CATMULLROM' => IMG_CATMULLROM,
+    'IMG_GAUSSIAN' => IMG_GAUSSIAN,
+    'IMG_GENERALIZED_CUBIC' => IMG_GENERALIZED_CUBIC,
+    'IMG_HERMITE' => IMG_HERMITE,
+    'IMG_HAMMING' => IMG_HAMMING,
+    'IMG_HANNING' => IMG_HANNING,
+    'IMG_MITCHELL' => IMG_MITCHELL,
+    'IMG_POWER' => IMG_POWER,
+    'IMG_QUADRATIC' => IMG_QUADRATIC,
+    'IMG_SINC' => IMG_SINC,
+    'IMG_NEAREST_NEIGHBOUR' => IMG_NEAREST_NEIGHBOUR,
+    'IMG_WEIGHTED4' => IMG_WEIGHTED4,
+    'IMG_TRIANGLE' => IMG_TRIANGLE,
+);
+
+$img = imagecreate(40, 20);
+$results = array();
+
+foreach ($interpolations as $name => $interpolation) {
+  imagesetinterpolation($img, $interpolation);
+  $t = imagecolorallocatealpha($img, 0, 0, 0, 127);
+  $imgr = imagerotate($img, -5, $t);
+  $results[$name] = array('x' => imagesx($imgr), 'y' => imagesy($imgr));
+  imagedestroy($imgr);
+}
+
+imagedestroy($img);
+print_r($results);
+?>
+===DONE===
+--EXPECT--
+Array
+(
+    [IMG_BELL] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_BESSEL] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_BICUBIC] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_BICUBIC_FIXED] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_BILINEAR_FIXED] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_BLACKMAN] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_BOX] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_BSPLINE] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_CATMULLROM] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_GAUSSIAN] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_GENERALIZED_CUBIC] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_HERMITE] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_HAMMING] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_HANNING] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_MITCHELL] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_POWER] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_QUADRATIC] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_SINC] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_NEAREST_NEIGHBOUR] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_WEIGHTED4] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_TRIANGLE] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+)
+===DONE===
@@ -1,5 +1,9 @@
 --TEST--
 (Bug #74031) ReflectionFunction for imagepng returns wrong number of parameters
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die("skip gd extension not available\n");
+?>
 --FILE--
 <?php

@@ -0,0 +1,31 @@
+--TEST--
+Bug #75124 (gdImageGrayScale() may produce colors)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('gd extension not available');
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.5', '<')) {
+    die('skip only for bundled libgd or external libgd >= 2.2.5');
+}
+?>
+--FILE--
+<?php
+$im = imagecreatefrompng(__DIR__ . '/bug75124.png');
+var_dump(imageistruecolor($im));
+imagefilter($im, IMG_FILTER_GRAYSCALE);
+for ($i = 0, $width = imagesx($im); $i < $width; $i ++) {
+    for ($j = 0, $height = imagesy($im); $j < $height; $j++) {
+        $color = imagecolorat($im, $i, $j);
+        $red = ($color >> 16) & 0xff;
+        $green = ($color >> 8) & 0xff;
+        $blue = $color & 0xff;
+        if ($red != $green || $green != $blue) {
+            echo "non grayscale pixel detected\n";
+            break 2;
+        }
+    }
+}
+?>
+===DONE===
+--EXPECT--
+bool(true)
+===DONE===
@@ -0,0 +1,20 @@
+--TEST--
+Bug #75437 Wrong reflection on imagewebp
+--SKIPIF--
+<?php
+if (!extension_loaded('reflection')) die('skip reflection not available');
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.0', '<')) die("skip test requires GD 2.2.0 or higher");
+if (!function_exists('imagewebp')) die('skip WebP support not available');
+?>
+--FILE--
+<?php
+$rf = new ReflectionFunction('imagewebp');
+var_dump($rf->getNumberOfParameters());
+var_dump($rf->getNumberOfRequiredParameters());
+?>
+===DONE===
+--EXPECT--
+int(3)
+int(1)
+===DONE===
@@ -0,0 +1,15 @@
+--TEST--
+Bug #75571 (Infinite loop in GIF reading causing DoS)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+var_dump(imagecreatefromgif(__DIR__ . '/bug75571.gif'));
+?>
+===DONE===
+--EXPECTF--
+Warning: imagecreatefromgif(): '%s' is not a valid GIF file in %s on line %d
+bool(false)
+===DONE===
@@ -161,16 +161,16 @@ PHP_MINFO_FUNCTION(php_gettext)
   Set the textdomain to "domain". Returns the current domain */
 PHP_NAMED_FUNCTION(zif_textdomain)
 {
-	char *domain, *domain_name, *retval;
-	size_t domain_len;
+	char *domain = NULL, *domain_name, *retval;
+	size_t domain_len = 0;

-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "s", &domain, &domain_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS(), "s!", &domain, &domain_len) == FAILURE) {
 		return;
 	}

 	PHP_GETTEXT_DOMAIN_LENGTH_CHECK

-	if (strcmp(domain, "") && strcmp(domain, "0")) {
+	if (domain != NULL && strcmp(domain, "") && strcmp(domain, "0")) {
 		domain_name = domain;
 	} else {
 		domain_name = NULL;
@@ -0,0 +1,16 @@
+--TEST--
+Bug #73730 (textdomain(null) throws in strict mode)
+--SKIPIF--
+<?php
+if (!extension_loaded('gettext')) die('skip gettext extension is not available');
+?>
+--FILE--
+<?php
+declare(strict_types=1);
+
+var_dump(textdomain(null));
+?>
+===DONE===
+--EXPECT--
+string(8) "messages"
+===DONE===