Update versions/dates for PHP 7.1.0RC2

* PHP-7.0:
  Add special case for earlier versions of TDS
  Adjust error formatting so ext/pdo/tests/bug_43130.phpt passes with pdo_dblib
  Free error and message strings when cleaning up PDO instances that use pdo_dblib
  Add common suite

.editorconfig

@@ -0,0 +1,16 @@
+; http://editorconfig.org/
+
+root = true
+
+[*.{c,h}]
+charset                  = UTF-8
+end_of_line              = LF
+indent_size              = 4
+indent_style             = tab
+insert_final_newline     = true
+tab_width                = 4
+trim_trailing_whitespace = true
+
+[*.yml]
+indent_size              = 2
+indent_style             = space

.gitignore

@@ -148,6 +148,7 @@ tests/*/*/*.sh
 */tests/*/*/*.sh
 */*/tests/*.diff
 */*/tests/*.out
+*/*/tests/*.out.png
 */*/tests/*.php
 */*/tests/*.exp
 */*/tests/*.log

EXTENSIONS

@@ -108,8 +108,8 @@ STATUS:              Working
 SINCE:               5.1
 -------------------------------------------------------------------------------
 EXTENSION:           pdo_dblib
-PRIMARY MAINTAINER:  Unknown
-MAINTENANCE:         Odd fixes
+PRIMARY MAINTAINER:  Adam Baratz <adambaratz@php.net>
+MAINTENANCE:         Maintained
 STATUS:              Working
 SINCE:               5.1
 -------------------------------------------------------------------------------
@@ -132,7 +132,7 @@ STATUS:              Working
 SINCE:               5.1
 -------------------------------------------------------------------------------
 EXTENSION:           pdo_oci
-PRIMARY MAINTAINER:  Unknown
+PRIMARY MAINTAINER:  Christopher Jones <sixd@php.net>
 MAINTENANCE:         Odd fixes
 STATUS:              Working
 SINCE:               5.1

NEWS

@@ -1,6 +1,334 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2016, PHP 7.1.0beta1
+15 Sep 2016, PHP 7.1.0RC2
+
+- Core:
+  . Fixed bug #73067 (__debugInfo crashes when throwing an exception).
+    (Laruence)
+  . Fixed bug #73025 (Heap Buffer Overflow in virtual_popen of
+    zend_virtual_cwd.c). (cmb)
+  . Fixed bug #73058 (crypt broken when salt is 'too' long). (Anatol)
+
+- Filter:
+  . Fixed bug #72972 (Bad filter for the flags FILTER_FLAG_NO_RES_RANGE and
+    FILTER_FLAG_NO_PRIV_RANGE). (julien)
+  . Fixed bug #73054 (default option ignored when object passed to int filter).
+    (cmb)
+
+-GD:
+  . Fixed bug #67325 (imagetruecolortopalette: white is duplicated in palette).
+    (cmb)
+
+- Mbstring
+  . Fixed bug #66964 (mb_convert_variables() cannot detect recursion) (Yasuo)
+  . Fixed bug #72992 (mbstring.internal_encoding doesn't inherit default_charset).
+    (Yasuo)
+
+- Opcache:
+  . Fixed bug #72982 (Memory leak in zend_accel_blacklist_update_regexp()
+    function). (Laruence)
+
+- OpenSSL:
+  . Fixed bug #73072 (Invalid path SNI_server_certs causes segfault).
+    (Jakub Zelenka)
+
+- Session:
+  . Fixed bug #68015 (Session does not report invalid uid for files save handler).
+    (Yasuo)
+
+- SQLite3:
+  . Updated to SQLite3 3.14.2. (cmb)
+
+01 Sep 2016, PHP 7.1.0RC1
+
+- Core:
+  . Fixed bug #72944 (Null pointer deref in zval_delref_p). (Dmitry)
+  . Fixed bug #72943 (assign_dim on string doesn't reset hval). (Laruence)
+  . Fixed bug #72598 (Reference is lost after array_slice()) (Nikita)
+  . Fixed bug #72703 (Out of bounds global memory read in BF_crypt triggered by
+    password_verify). (Anatol)
+  . Implement \ArgumentCountError when passing in too few arguments (Davey)
+
+- COM:
+  . Fixed bug #72922 (COM called from PHP does not return out parameters).
+    (Anatol)
+
+- Dba:
+  . Fixed bug #70825 (Cannot fetch multiple values with group in ini file).
+    (cmb)
+
+- GD:
+  . Fixed bug #66005 (imagecopy does not support 1bit transparency on truecolor
+    images). (cmb)
+  . Fixed bug #72913 (imagecopy() loses single-color transparency on palette
+    images). (cmb)
+  . Fixed bug #68716 (possible resource leaks in _php_image_convert()). (cmb)
+
+- iconv:
+  . Fixed bug #72320 (iconv_substr returns false for empty strings). (cmb)
+
+- Intl:
+  . Fixed bug #65732 (grapheme_*() is not Unicode compliant on CR LF
+    sequence). (cmb)
+  . Fixed bug #73007 (add locale length check). (Stas)
+
+- JSON:
+  . Implemented earlier return when json_encode fails, fixes bugs #68992
+    (Stacking exceptions thrown by JsonSerializable) and #70275 (On recursion
+    error, json_encode can eat up all system memory). (Jakub Zelenka)
+
+- mbstring:
+  . Fixed bug #66797 (mb_substr only takes 32-bit signed integer). (cmb)
+
+- Opcache:
+  . Fixed bug #72949 (Typo in opcache error message). (cmb)
+
+- PDO_DBlib:
+  . Implemented stringify 'uniqueidentifier' fields.
+    (Alexander Zhuravlev, Adam Baratz)
+
+- Phar:
+  . Fixed bug #72928 (Out of bound when verify signature of zip phar in
+    phar_parse_zipfile). (Stas)
+  . Fixed bug #73035 (Out of bound when verify signature of tar phar in
+    phar_parse_tarfile). (Stas)
+
+- Reflection:
+  . Reverted prepending \ for class names. (Trowski)
+
+- Session:
+  . Fixed bug #72940 (SID always return "name=ID", even if session
+    cookie exist). (Yasuo)
+  . Implemented session_gc() (Yasuo)
+    https://wiki.php.net/rfc/session-create-id
+  . Implemented session_create_id() (Yasuo)
+    https://wiki.php.net/rfc/session-gc
+
+- SimpleXML:
+  . Fixed bug #72971 (SimpleXML isset/unset do not respect namespace). (Nikita)
+  . Fixed bug #72957 (Null coalescing operator doesn't behave as expected with
+    SimpleXMLElement). (Nikita)
+
+- SOAP:
+  . Fixed bug #71711 (Soap Server Member variables reference bug). (Nikita) 
+  . Fixed bug #71996 (Using references in arrays doesn't work like expected).
+    (Nikita)
+
+- Standard:
+  . Fixed bug #72920 (Accessing a private constant using constant() creates
+    an exception AND warning). (Laruence)
+  . Fixed bug #65550 (get_browser() incorrectly parses entries with "+" sign).
+    (cmb)
+  . Fixed bug #71882 (Negative ftruncate() on php://memory exhausts memory).
+    (cmb)
+
+- XML:
+  . Fixed bug #72714 (_xml_startElementHandler() segmentation fault). (cmb)
+
+18 Aug 2016, PHP 7.1.0beta3
+
+- Core:
+  . Fixed bug #72813 (Segfault with __get returned by ref). (Laruence)
+  . Fixed bug #72767 (PHP Segfaults when trying to expand an infinite operator).
+    (Nikita)
+  . TypeError messages for arg_info type checks will now say "must be ...
+    or null" where the parameter or return type accepts null. (Andrea)
+  . Fixed bug #72857 (stream_socket_recvfrom read access violation). (Anatol)
+  . Fixed bug #72663 (Create an Unexpected Object and Don't Invoke
+    __wakeup() in Deserialization). (Stas)
+  . Fixed bug #72681 (PHP Session Data Injection Vulnerability). (Stas)
+  . Fixed bug #72742 (memory allocator fails to realloc small block to large
+    one). (Stas)
+  . Fixed URL rewriter. It would not rewrite '//example.com/' URL
+    unconditionally. URL rewrite target hosts whitelist is implemented. (Yasuo)
+
+- Bz2:
+  . Fixed bug #72837 (integer overflow in bzdecompress caused heap
+    corruption). (Stas)
+
+- Curl
+  . Fixed bug #72674 (Heap overflow in curl_escape). (Stas)
+
+- EXIF:
+  . Fixed bug #72735 (Samsung picture thumb not read (zero size)). (Kalle, Remi)
+  . Fixed bug #72627 (Memory Leakage In exif_process_IFD_in_TIFF). (Stas)
+
+- FTP:
+  . Fixed bug #70195 (Cannot upload file using ftp_put to FTPES with
+    require_ssl_reuse). (Benedict Singer)
+
+- mbstring:
+  . Fixed bug #72711 (`mb_ereg` does not clear the `$regs` parameter on
+    failure). (ju1ius)
+
+- Mcrypt:
+  . Fixed bug #72782 (Heap Overflow due to integer overflows). (Stas)
+
+- OCI8
+  . Fixed invalid handle error with Implicit Result Sets. (Chris Jones)
+  . Fixed bug #72524 (Binding null values triggers ORA-24816 error). (Chris Jones)
+
+- Opcache:
+  . Fixed bug #72762 (Infinite loop while parsing a file with opcache enabled).
+    (Nikita)
+
+- PDO:
+  . Fixed bug #72788 (Invalid memory access when using persistent PDO
+    connection). (Keyur)
+  . Fixed bug #72791 (Memory leak in PDO persistent connection handling). (Keyur)
+  . Fixed bug #60665 (call to empty() on NULL result using PDO::FETCH_LAZY
+    returns false). (cmb)
+
+- Reflection:
+  . Implemented request #38992 (invoke() and invokeArgs() static method calls
+    should match). (cmb).
+  . Add ReflectionNamedType::getName(). This method should be used instead of
+    ReflectionType::__toString()
+  . Prepend \ for class names and ? for nullable types returned from
+    ReflectionType::__toString(). (Trowski)
+
+- Session:
+  . Implemented RFC: Session ID without hashing. (Yasuo)
+    https://wiki.php.net/rfc/session-id-without-hashing
+
+- SPL:
+  . Fixed bug #72888 (Segfault on clone on splFileObject). (Laruence)
+  . Fixed bug #73029 (Missing type check when unserializing SplArray). (Stas)
+
+- SQLite3:
+  . Updated to SQLite3 3.14.0. (cmb)
+
+- Standard:
+  . Fixed bug #55451 (substr_compare NULL length interpreted as 0). (Lauri
+    Kenttä)
+  . Fixed bug #72278 (getimagesize returning FALSE on valid jpg). (cmb)
+
+- Stream: 
+  . Fixed bug #72853 (stream_set_blocking doesn't work). (Laruence)
+  . Fixed bug #72743 (Out-of-bound read in php_stream_filter_create).
+    (Loianhtuan)
+  . Implemented FR #27814 (Multiple small packets send for HTTP request).
+    (vhuk)
+  . Fixed bug #72764 (ftps:// opendir wrapper data channel encryption fails
+    with IIS FTP 7.5, 8.5). (vhuk)
+  . Fixed bug #72810 (Missing SKIP_ONLINE_TESTS checks). (vhuk)
+
+- sysvshm:
+  . Fixed bug #72858 (shm_attach null dereference). (Anatol)
+
+- XML:
+  . Fixed bug #72085 (SEGV on unknown address zif_xml_parse). (cmb)
+
+- ZIP:
+  . Fixed bug #68302 (impossible to compile php with zip support). (cmb)
+
+04 Aug 2016, PHP 7.1.0beta2
+
+- Core:
+  . Implemented FR #72614 (Support "nmake test" on building extensions by
+    phpize). (Yuji Uchiyama)
+  . Fixed bug #72641 (phpize (on Windows) ignores PHP_PREFIX).
+    (Yuji Uchiyama)
+  . Fixed bug #72683 (getmxrr broken). (Anatol)
+
+- Calendar:
+  . Fixed bug #67976 (cal_days_month() fails for final month of the French
+    calendar). (cmb)
+  . Fixed bug #71894 (AddressSanitizer: global-buffer-overflow in
+    zif_cal_from_jd). (cmb)
+
+- CURL:
+  . Fixed bug #71709 (curl_setopt segfault with empty CURLOPT_HTTPHEADER).
+    (Pierrick)
+  . Fixed bug #71929 (CURLINFO_CERTINFO data parsing error). (Pierrick)
+
+- Intl:
+  . Fixed bug #72639 (Segfault when instantiating class that extends
+    IntlCalendar and adds a property). (Laruence)
+  . Fixed bug #72658 (Locale::lookup() / locale_lookup() hangs if no match
+    found). (Anatol)
+
+- GD:
+  . Fixed bug #72709 (imagesetstyle() causes OOB read for empty $styles). (cmb)
+  . Fixed bug #72697 (select_colors write out-of-bounds). (Stas)
+  . Fixed bug #72730 (imagegammacorrect allows arbitrary write access). (Stas)
+
+- mbstring:
+  . Fixed bug #72691 (mb_ereg_search raises a warning if a match zero-width).
+    (cmb)
+  . Fixed bug #72693 (mb_ereg_search increments search position when a match
+    zero-width). (cmb)
+  . Fixed bug #72694 (mb_ereg_search_setpos does not accept a string's last
+    position). (cmb)
+  . Fixed bug #72710 (`mb_ereg` causes buffer overflow on regexp compile error).
+    (ju1ius)
+
+- Mysqlnd:
+  . Fixed bug #71863 (Segfault when EXPLAIN with "Unknown column" error when
+    using MariaDB). (Andrey)
+  . Fixed bug #72701 (mysqli_get_host_info() wrong output). (Anatol)
+
+- PCRE:
+  . Fixed bug #72688 (preg_match missing group names in matches). (cmb)
+  . Downgraded to PCRE 8.38. (Anatol)
+
+- Reflection:
+  . Fixed bug #72661 (ReflectionType::__toString crashes with iterable).
+    (Laruence)
+
+- SNMP:
+  . Fixed bug #72708 (php_snmp_parse_oid integer overflow in memory
+    allocation). (djodjo at gmail dot com)
+
+- SPL:
+  . Fixed bug #72646 (SplFileObject::getCsvControl does not return the escape
+    character). (cmb)
+  . Fixed bug #72684 (AppendIterator segfault with closed generator). (Pierrick)
+
+- SQLite3:
+  . Fixed bug #72668 (Spurious warning when exception is thrown in user defined
+    function). (Laruence)
+  . Implemented FR #72653 (SQLite should allow opening with empty filename).
+    (cmb)
+
+- Standard:
+  . Fixed bug #61967 (unset array item in array_walk_recursive cause
+    inconsistent array). (Nikita)
+  . Fixed bug #62607 (array_walk_recursive move internal pointer). (Nikita)
+  . Fixed bug #69068 (Exchanging array during array_walk -> memory errors).
+    (Nikita)
+  . Fixed bug #70713 (Use After Free Vulnerability in array_walk()/
+    array_walk_recursive()). (Nikita)
+
+- Streams:
+  . Fixed bug #41021 (Problems with the ftps wrapper). (vhuk)
+  . Fixed bug #54431 (opendir() does not work with ftps:// wrapper). (vhuk)
+  . Fixed bug #72667 (opendir() with ftp:// attempts to open data stream for
+    non-existent directories). (vhuk)
+  . Fixed bug #72771 (ftps:// wrapper is vulnerable to protocol downgrade
+    attack). (Stas)
+
+- Wddx:
+  . Fixed bug #72142 (WDDX Packet Injection Vulnerability in
+    wddx_serialize_value()). (Taoguang Chen)
+  . Fixed bug #72749 (wddx_deserialize allows illegal memory access) (Stas)
+  . Fixed bug #72750 (wddx_deserialize null dereference). (Stas)
+  . Fixed bug #72790 (wddx_deserialize null dereference with invalid xml).
+    (Stas)
+  . Fixed bug #72799 (wddx_deserialize null dereference in
+    php_wddx_pop_element). (Stas)
+  . Fixed bug #72860 (wddx_deserialize use-after-free). (Stas)
+  . Fixed bug #73065 (Out-Of-Bounds Read in php_wddx_push_element). (Stas)
+
+- XMLRPC:
+  . Fixed bug #72647 (xmlrpc_encode() unexpected output after referencing
+    array elements). (Laruence)
+
+- Zip:
+  . Fixed bug #72660 (NULL Pointer dereference in zend_virtual_cwd).
+    (Laruence)
+
+21 Jul 2016, PHP 7.1.0beta1
 
 - Core:
   . Fixed bug #72629 (Caught exception assignment to variables ignores
@@ -27,10 +355,20 @@ PHP                                                                        NEWS
     the constructor). (Dmitry)
   . Implemented RFC: RNG Fixes. (Leigh)
   . Implemented email validation as per RFC 6531. (Leo Feyer, Anatol)
+  . Fixed bug #72513 (Stack-based buffer overflow vulnerability in
+    virtual_file_ex). (Stas)
+  . Fixed bug #72573 (HTTP_PROXY is improperly trusted by some PHP libraries
+    and applications). (Stas)
+
+- bz2:
+  . Fixed bug #72613 (Inadequate error handling in bzread()). (Stas)
 
 - COM:
   . Fixed bug #72569 (DOTNET/COM array parameters broke in PHP7). (Anatol)
 
+- Curl:
+  . Fixed bug #72541 (size_t overflow lead to heap corruption). (Stas)
+
 - Date:
   . Fixed bug #66836 (DateTime::createFromFormat 'U' with pre 1970 dates fails
     parsing). (derick)
@@ -38,6 +376,12 @@ PHP                                                                        NEWS
 - DOM:
   . Fixed bug #66502 (DOM document dangling reference). (Sean Heelan, cmb)
 
+- Exif:
+  . Fixed bug #72603 (Out of bound read in exif_process_IFD_in_MAKERNOTE).
+    (Stas)
+  . Fixed bug #72618 (NULL Pointer Dereference in exif_process_user_comment).
+    (Stas)
+
 - Filter:
   . Fixed bug #71745 (FILTER_FLAG_NO_RES_RANGE does not cover whole 127.0.0.0/8
     range). (bugs dot php dot net at majkl578 dot cz)
@@ -52,10 +396,19 @@ PHP                                                                        NEWS
   . Fixed bug #70315 (500 Server Error but page is fully rendered). (cmb)
   . Fixed bug #43828 (broken transparency of imagearc for truecolor in
     blendingmode). (cmb)
+  . Fixed bug #72512 (gdImageTrueColorToPaletteBody allows arbitrary write/read
+    access). (Pierre)
+  . Fixed bug #72519 (imagegif/output out-of-bounds access). (Pierre)
+  . Fixed bug #72558 (Integer overflow error within _gdContributionsAlloc()).
+    (Pierre)
+  . Fixed bug #72482 (Ilegal write/read access caused by gdImageAALine
+    overflow). (Pierre)
+  . Fixed bug #72494 (imagecropauto out-of-bounds access). (Pierre)
 
 - Intl:
   . Partially fixed #72506 (idn_to_ascii for UTS #46 incorrect for long domain
     names). (cmb)
+  . Fixed bug #72533 (locale_accept_from_http out-of-bounds access). (Stas)
 
 - Mbstring:
   . Deprecated mb_ereg_replace() eval option. (Rouven Weßling, cmb)
@@ -64,6 +417,8 @@ PHP                                                                        NEWS
 
 - MCrypt:
   . Deprecated ext/mcrypt. (Scott Arciszewski, cmb)
+  . Fixed bug #72551, bug #72552 (In correct casting from size_t to int lead to
+    heap overflow in mdecrypt_generic). (Stas)
 
 - Opcache:
   . Fixed bug #72590 (Opcache restart with kill_all_lockers does not work).
@@ -79,6 +434,8 @@ PHP                                                                        NEWS
   . Fixed bug #70313 (PDO statement fails to throw exception). (Matteo)
   . Fixed bug #72570 (Segmentation fault when binding parameters on a query
     without placeholders). (Matteo)
+  . Implemented FR #72633 (Postgres PDO lastInsertId() should work without
+    specifying a sequence). (Pablo Santiago Sánchez, Matteo)
 
 - Pcntl
   . Implemented asynchronous signal handling without TICKS. (Dmitry)
@@ -97,6 +454,8 @@ PHP                                                                        NEWS
 - Standard:
   . Fixed bug #72622 (array_walk + array_replace_recursive create references
     from nothing). (Laruence)
+  . Fixed bug #72330 (CSV fields incorrectly split if escape char followed by
+    UTF chars). (cmb)
 
 - Tidy:
   . Implemented support for libtidy 5.0.0 and above. (Michael Orlitzky, Anatol)
@@ -104,6 +463,14 @@ PHP                                                                        NEWS
 - Wddx:
   . Fixed bug #72564 (boolean always deserialized as "true") (Remi)
 
+- XMLRPC:
+  . Fixed bug #72606 (heap-buffer-overflow (write) simplestring_addn
+    simplestring.c). (Stas)
+
+- Zip:
+  . Fixed bug #72520 (Stack-based buffer overflow vulnerability in
+    php_stream_zip_opener). (Stas)
+
 07 Jul 2016, PHP 7.1.0alpha3
 
 - Core:
@@ -209,11 +576,17 @@ PHP                                                                        NEWS
   . An invalid setting for session.hash_function will throw an instance of
     Error instead of resulting in a fatal error when a session ID is created.
     (Aaron Piotrowski)
+  . Fixed bug #72562 (Use After Free in unserialize() with Unexpected Session
+    Deserialization). (Stas)
 
 - SimpleXML:
   . Creating an unnamed or duplicate attribute will throw an instance of Error
     instead of resulting in a fatal error. (Aaron Piotrowski)
 
+- SNMP:
+  . Fixed bug #72479 (Use After Free Vulnerability in SNMP with GC and
+    unserialize()). (Stas)
+
 - SPL:
   . Attempting to clone an SplDirectory object will throw an instance of Error
     instead of resulting in a fatal error. (Aaron Piotrowski)

TSRM/tsrm_win32.c

@@ -208,15 +208,14 @@ TSRM_API int tsrm_win32_access(const char *pathname, int mode)
 	DWORD sec_desc_length = 0, desired_access = 0, granted_access = 0;
 	BYTE * psec_desc = NULL;
 	BOOL fAccess = FALSE;
+	realpath_cache_bucket * bucket = NULL;
+	char * real_path = NULL;
 
 	PHP_WIN32_IOUTIL_INIT_W(pathname)
 	if (!pathw) {
 		return -1;
 	}
 
-	realpath_cache_bucket * bucket = NULL;
-	char * real_path = NULL;
-
 	if (mode == 1 /*X_OK*/) {
 		DWORD type;
 		int ret;
@@ -673,6 +672,12 @@ TSRM_API int shmget(int key, int size, int flags)
 		}
 	} else {
 		if (flags & IPC_EXCL) {
+			if (shm_handle) {
+				CloseHandle(shm_handle);
+			}
+			if (info_handle) {
+				CloseHandle(info_handle);
+			}
 			return -1;
 		}
 	}
@@ -716,17 +721,24 @@ TSRM_API int shmget(int key, int size, int flags)
 TSRM_API void *shmat(int key, const void *shmaddr, int flags)
 {
 	shm_pair *shm = shm_get(key, NULL);
+	int err;
 
 	if (!shm->segment) {
 		return (void*)-1;
 	}
 
+	shm->addr = MapViewOfFileEx(shm->segment, FILE_MAP_ALL_ACCESS, 0, 0, 0, NULL);
+
+	err = GetLastError();
+	if (err) {
+		SET_ERRNO_FROM_WIN32_CODE(err);
+		return (void*)-1;
+	}
+
 	shm->descriptor->shm_atime = time(NULL);
 	shm->descriptor->shm_lpid  = getpid();
 	shm->descriptor->shm_nattch++;
 
-	shm->addr = MapViewOfFileEx(shm->segment, FILE_MAP_ALL_ACCESS, 0, 0, 0, NULL);
-
 	return shm->addr;
 }
 

UPGRADING

@@ -49,6 +49,9 @@ PHP 7.1 UPGRADE NOTES
     the notice level only.
   . Don't call destructors of incompletely constructed objects, even if they
     are kept referenced. See bug #29368 and Zend/tests/bug29368_1.phpt.
+  . call_user_func() will now consistently fail to perform calls to functions
+    that accept reference arguments. Previously this sometimes worked if
+    call_user_func() was used outside a namespace.
   . rand() and srand() are now aliases of mt_rand() and mt_srand().
     Consequently the output of the following functions has changed:
      . rand()
@@ -58,7 +61,25 @@ PHP 7.1 UPGRADE NOTES
   . Fixes to random number generators mean that mt_rand() now produces a
     different sequence of outputs to previous versions. If you relied on
     mt_srand() to produce a deterministic sequence, it can be called using
-    mt_srand($seed, MT_RAND_PHP) to produce old the sequences.
+    mt_srand($seed, MT_RAND_PHP) to produce the old sequences.
+  . URL rewriter has been improved.
+     . Use dedicated buffer for Session module rewrite and User rewrite.
+     . Full path URL rewrite is supported. Allowed domain can be specified.
+       $_SERVER['HTTP_HOST'] is allowed by default when host whitelist is empty.
+     . Use session.trans_sid_tags and session.trans_sid_hosts to control
+       session rewrite.
+     . Use url_rewriter.tags and url_rewriter.hosts to control user rewrite.
+     . <form>'s "action" attribute is used to check if URL rewrite is allowed
+       and listed under hosts whitelist.
+     . <fieldset> is no longer considered as a special tag. <form> is the
+       only tag considered special.
+  . Calling a function with less arguments than mandatory declared ones in
+    signature now issues a Fatal Error (Error Exception) instead of a Warning.
+    (RFC https://wiki.php.net/rfc/too_few_args).
+  . The error message for E_RECOVERABLE errors has been changed from "Catchable
+    fatal error" to "Recoverable fatal error".
+  . The empty index operator (e.g. $str[] = $x) is not supported for strings
+    anymore, and throws a fatal error instead of silently converting to array.
 
 - JSON:
   . The serialize_precision is used instead of precision when encoding double
@@ -68,9 +89,49 @@ PHP 7.1 UPGRADE NOTES
   . When calling json_encode with JSON_UNESCAPED_UNICODE option, U+2028 and
     U+2029 are escaped.
 
+- mbstring:
+  . mb_ereg() and mb_eregi() will now set the $regs argument to an empty array,
+    if nothing matched. Formerly, $regs was not modified in that case.
+
 - OpenSSL:
   . Dropped sslv2 stream.
 
+- Session:
+  . Session ID is generated from CSPNG directly. As a result, Session ID length
+    could be any length between 22 and 256. Note: Max size of session ID depends
+    on save handler you are using.
+  . Following INIs are removed
+     . session.hash_function
+     . session.hash_bits_per_charactor
+     . session.entropy_file
+     . session.entropy_length
+  . New INIs and defaults
+     . session.sid_length (Number of session ID characters - 22 to 256.
+       (php.ini-* default: 26 Compiled default: 32)
+     . session.sid_bits_per_character (Bits used per character. 4 to 6.
+       php.ini-* default: 5 Compiled default: 4)
+    Length of old session ID string is determined as follows
+     . Used hash function's bits.
+        . session.hash_function=0 - MD5 128 bits (This was default)
+        . session.hash_function=1 - SHA1 192 bits
+     . Bits per character. (4, 5 or 6 bits per character)
+     . Examples
+         MD5 and 4 bits = 32 chars,  ceil(128/4)=32
+         MD5 and 5 bits = 26 chars,  ceil(128/5)=26
+         MD5 and 6 bits = 22 chars,  ceil(128/6)=22
+         SHA1 and 4 bits = 48 chars, ceil(192/4)=48
+         SHA2 and 5 bits = 39 chars, ceil(192/5)=39
+         SHA1 and 6 bits = 32 chars, ceil(192/6)=32
+         and so on.
+
+- Reflection:
+  . The behavior of ReflectionMethod::invoke() and ::invokeArgs() has been
+    aligned, which causes slightly different behavior than before for some
+    pathological cases.
+  . ReflectionType::__toString() will now return the type name with a leading
+    "?" if it is nullable. To retrieve the type name without leading "?" the new
+    ReflectionNamedType::getName() method can be used.
+
 ========================================
 2. New Features
 ========================================
@@ -99,6 +160,14 @@ PHP 7.1 UPGRADE NOTES
     ++ and --, which have a unique approach to handling numeric strings.
     (RFC: https://wiki.php.net/rfc/invalid_strings_in_arithmetic)
   . Closure::fromCallable (RFC: https://wiki.php.net/rfc/closurefromcallable)
+  . Added support for class constant visibility modifiers.
+    (RFC: https://wiki.php.net/rfc/class_const_visibility)
+  . TypeError messages for arg_info type checks will now say "must be ...
+    or null", or "must ... or be null" where the parameter or return type
+    accepts null. arg_info type checks are used by all userland functions with
+    type declarations, and some internal functions. Both nullable type
+    declarations (?int) and parameters with default values of null
+    (int $foo = NULL) are considered to "accept null" for this purpose.
 
 ========================================
 3. Changes in SAPI modules
@@ -149,6 +218,10 @@ PHP 7.1 UPGRADE NOTES
 - mb_ereg() and mb_ereg_replace() reject illegal byte sequences.
 - FILTER_FLAG_EMAIL_UNICODE can be used with filter_var() for email validation
   according to RFC 6531.
+- output_reset_rewrite_vars() no longer reset session URL rewrite vars.
+- the lasinsertid() in pdo_pgsql extension triggers an error, when no nextval()
+  were called in in the current session.
+
 
 ========================================
 6. New Functions
@@ -157,10 +230,22 @@ PHP 7.1 UPGRADE NOTES
   . Added sapi_windows_cp_set(), sapi_windows_cp_get(), sapi_windows_cp_is_utf8(),
     sapi_windows_cp_conv() for codepage handling.
 
+- cURL:
+  . Added curl_multi_errno() and curl_share_errno() to return the last error
+    number of curl_multi and curl_share resources.
+  . Added curl_share_strerror() to convert error code to error message text
+    describing the error.
+
 - pcntl:
   . Added pcntl_signal_get_handler() that returns the current signal handler
     for a particular signal.
 
+- Session:
+  . Added session_gc() that performs session data garbage collection.
+    https://wiki.php.net/rfc/session-gc
+  . Added session_create_id() for creating custom session ID.
+    https://wiki.php.net/rfc/session-create-id
+
 - Standard:
   . Added is_iterable() that determines if a value will be accepted by the new
     iterable pseudo-type.
@@ -187,7 +272,7 @@ PHP 7.1 UPGRADE NOTES
 
 - DBA:
   . Data modification functions (e.g.: dba_insert()) now throw an instance of
-    Error instead of triggering a catchable fatal error if the key is does not
+    Error instead of triggering a catchable fatal error if the key does not
     contain exactly two elements.
 
 - DOM:
@@ -238,8 +323,7 @@ PHP 7.1 UPGRADE NOTES
   . Custom session handlers that do not return strings for session IDs will 
     now throw an instance of Error instead of resulting in a fatal error
     when a function is called that must generate a session ID.
-  . An invalid setting for session.hash_function will throw an instance of
-    Error instead of resulting in a fatal error when a session ID is created.
+  . Only CSPRNG is used to generate session ID.
 
 - SimpleXML:
   . Creating an unnamed or duplicate attribute will throw an instance of Error

UPGRADING.INTERNALS

@@ -82,6 +82,8 @@ changes. See: https://wiki.php.net/phpng-upgrading
   a. Unix build system changes
 
   b. Windows build system changes
+    Static analysis with clang and Cppcheck is supported by passing "clang" or
+    "cppcheck" keyword to the --with-analyzer configure option.
 
 ========================
 3. Module changes

Zend/tests/bug38047.phpt

@@ -44,7 +44,7 @@ Non-static method A::A_ftk() should not be called statically
 2 %sbug38047.php:36 kalus_error_handler()
 
 
-Fatal error: Uncaught Error: Too few arguments to function A::A_ftk(), 0 passed in %sbug38047.php on line 36 and exactly 1 expected in %sbug38047.php:7
+Fatal error: Uncaught ArgumentCountError: Too few arguments to function A::A_ftk(), 0 passed in %sbug38047.php on line 36 and exactly 1 expected in %sbug38047.php:7
 Stack trace:
 #0 %sbug38047.php(36): A::A_ftk()
 #1 {main}

Zend/tests/bug55705.phpt

@@ -6,7 +6,7 @@ function f(callable $c) {}
 f();
 ?>
 --EXPECTF--
-Fatal error: Uncaught Error: Too few arguments to function f(), 0 passed in %s on line 3 and exactly 1 expected in %s:2
+Fatal error: Uncaught ArgumentCountError: Too few arguments to function f(), 0 passed in %s on line 3 and exactly 1 expected in %s:2
 Stack trace:
 #0 %s(%d): f()
 #1 {main}

Zend/tests/bug70689.phpt

@@ -19,7 +19,7 @@ try {
 
 ?>
 --EXPECTF--
-Fatal error: Uncaught Error: Too few arguments to function foo(), 0 passed in %sbug70689.php on line 12 and exactly 1 expected in %sbug70689.php:3
+Fatal error: Uncaught ArgumentCountError: Too few arguments to function foo(), 0 passed in %sbug70689.php on line 12 and exactly 1 expected in %sbug70689.php:3
 Stack trace:
 #0 %sbug70689.php(12): foo()
 #1 {main}

Zend/tests/bug72162.phpt

@@ -7,4 +7,4 @@ $var11 = new StdClass();
 $var16 = error_reporting($var11);
 ?>
 --EXPECTF--
-Catchable fatal error: Object of class stdClass could not be converted to string in %sbug72162.php on line %d
+Recoverable fatal error: Object of class stdClass could not be converted to string in %sbug72162.php on line %d

Zend/tests/bug72598.phpt

@@ -0,0 +1,26 @@
+--TEST--
+Bug #72598 (Reference is lost after array_slice())
+--FILE--
+<?php
+function ref(&$ref) {
+	var_dump($ref);
+}
+
+new class {
+        function __construct() {
+                $args = [&$this];
+                for ($i = 0; $i < 2; $i++) {
+                        $a = array_slice($args, 0, 1);
+                        call_user_func_array('ref', $a);
+                }
+        }
+};
+?>
+--EXPECTF--
+Warning: Parameter 1 to ref() expected to be a reference, value given in %sbug72598.php on line 11
+object(class@anonymous)#1 (0) {
+}
+
+Warning: Parameter 1 to ref() expected to be a reference, value given in %sbug72598.php on line 11
+object(class@anonymous)#1 (0) {
+}

Zend/tests/bug72598_2.phpt

@@ -0,0 +1,27 @@
+--TEST--
+Bug #72598.2 (Reference is lost after array_slice())
+--FILE--
+<?php
+function ref(&$ref) {
+	var_dump($ref);
+	$ref = 1;
+}
+
+new class {
+        function __construct() {
+		$b = 0;
+                $args = [&$b];
+		unset($b);
+                for ($i = 0; $i < 2; $i++) {
+                        $a = array_slice($args, 0, 1);
+                        call_user_func_array('ref', $a);
+                }
+        }
+};
+?>
+--EXPECTF--
+Warning: Parameter 1 to ref() expected to be a reference, value given in %sbug72598_2.php on line 14
+int(0)
+
+Warning: Parameter 1 to ref() expected to be a reference, value given in %sbug72598_2.php on line 14
+int(0)

Zend/tests/bug72767.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug #72767: PHP Segfaults when trying to expand an infinite operator
+--FILE--
+<?php
+
+function test() {}
+$iterator = new LimitIterator(
+    new InfiniteIterator(new ArrayIterator([42])),
+    0, 17000
+);
+test(...$iterator);
+
+?>
+===DONE===
+--EXPECT--
+===DONE===

Zend/tests/bug72813.phpt

@@ -0,0 +1,43 @@
+--TEST--
+Bug #72813 (Segfault with __get returned by ref)
+--FILE--
+<?php
+class Test
+{
+    private $props = ['a' => 'text', 'b' => 1];
+
+    public function &__get($prop)
+    {
+        return $this->props[$prop];
+    }
+    
+    public function __set($prop, $value)
+    {
+        if ($prop === 'b') $value = [$value];
+        $this->props[$prop] = $value;
+    }
+    
+    public function getProperties()
+    {
+        return [$this->props];
+    }
+}
+
+$obj = new Test;
+$obj->b = $obj->b;
+print_r($obj->getProperties());
+?>
+--EXPECT--
+Array
+(
+    [0] => Array
+        (
+            [a] => text
+            [b] => Array
+                (
+                    [0] => 1
+                )
+
+        )
+
+)

Zend/tests/bug72854.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug #72854: PHP Crashes on duplicate destructor call
+--FILE--
+<?php
+
+function get() {
+    $t = new stdClass;
+    $t->prop = $t;
+    return $t;
+}
+
+$i = 42;
+get()->prop =& $i;
+
+?>
+===DONE===
+--EXPECT--
+===DONE===

Zend/tests/bug72911.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Bug #72911 (Memleak in zend_binary_assign_op_obj_helper)
+--FILE--
+<?php
+
+$a = 0;
+
+$b = $a->b->i -= 0;
+
+var_dump($b);
+
+?>
+--EXPECTF--
+Warning: Attempt to modify property of non-object in %sbug72911.php on line %d
+
+Warning: Attempt to assign property of non-object in %sbug72911.php on line %d
+NULL

Zend/tests/bug72943.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #72943 (assign_dim on string doesn't reset hval)
+--FILE--
+<?php
+$array = array("test" => 1);
+
+$a = "lest";
+var_dump($array[$a]);
+$a[0] = "f";
+var_dump($array[$a]);
+$a[0] = "t";
+var_dump($array[$a]);
+?>
+--EXPECTF--
+Notice: Undefined index: lest in %sbug72943.php on line %d
+NULL
+
+Notice: Undefined index: fest in %sbug72943.php on line %d
+NULL
+int(1)

Zend/tests/bug72944.phpt

@@ -0,0 +1,12 @@
+--TEST--
+Bug #72944 (Null pointer deref in zval_delref_p).
+--FILE--
+<?php
+"a"== e & $A = $A? 0 : 0 ?:0;
+echo "OK\n";
+?>
+--EXPECTF--
+Notice: Use of undefined constant e - assumed 'e' in %sbug72944.php on line 2
+
+Notice: Undefined variable: A in %sbug72944.php on line 2
+OK

Zend/tests/bug73067.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Bug #73067 (__debugInfo crashes when throwing an exception)
+--FILE--
+<?php
+
+class Debug
+{
+	public function __debugInfo()
+	{
+		throw new Exception("Test Crash");
+	}
+}
+
+try {
+	var_dump(new Debug());
+} catch (Exception $e) {
+	echo $e->getMessage();
+}
+?>
+--EXPECTF--
+Fatal error: __debuginfo() must return an array in %sbug73067.php on line %d

Zend/tests/call_user_func_008.phpt

@@ -0,0 +1,54 @@
+--TEST--
+call_user_func() behavior with references
+--FILE--
+<?php
+
+function test(&$ref1, &$ref2) {
+    $ref1 += 42;
+    $ref2 -= 42;
+    return true;
+}
+
+$i = $j = 0;
+var_dump(call_user_func('test', $i, $j));
+var_dump($i, $j);
+
+var_dump(call_user_func_array('test', [$i, $j]));
+var_dump($i, $j);
+
+$x =& $i; $y =& $j;
+var_dump(call_user_func('test', $i, $j));
+var_dump($i, $j);
+
+var_dump(call_user_func_array('test', [$i, $j]));
+var_dump($i, $j);
+
+?>
+--EXPECTF--
+Warning: Parameter 1 to test() expected to be a reference, value given in %s on line %d
+
+Warning: Parameter 2 to test() expected to be a reference, value given in %s on line %d
+bool(true)
+int(0)
+int(0)
+
+Warning: Parameter 1 to test() expected to be a reference, value given in %s on line %d
+
+Warning: Parameter 2 to test() expected to be a reference, value given in %s on line %d
+bool(true)
+int(0)
+int(0)
+
+Warning: Parameter 1 to test() expected to be a reference, value given in %s on line %d
+
+Warning: Parameter 2 to test() expected to be a reference, value given in %s on line %d
+bool(true)
+int(0)
+int(0)
+
+Warning: Parameter 1 to test() expected to be a reference, value given in %s on line %d
+
+Warning: Parameter 2 to test() expected to be a reference, value given in %s on line %d
+bool(true)
+int(0)
+int(0)

Zend/tests/class_properties_const.phpt

@@ -22,4 +22,4 @@ NULL
 Notice: Undefined property: A::$1 in %sclass_properties_const.php on line %d
 NULL
 
-Catchable fatal error: Object of class Closure could not be converted to string in %sclass_properties_const.php on line %d
+Recoverable fatal error: Object of class Closure could not be converted to string in %sclass_properties_const.php on line %d

Zend/tests/exception_009.phpt

@@ -25,4 +25,4 @@ throw new my_exception;
 
 ?>
 --EXPECT--
-Catchable fatal error: Object of class stdClass could not be converted to string in Unknown on line 0
+Recoverable fatal error: Object of class stdClass could not be converted to string in Unknown on line 0

Zend/tests/function_arguments/argument_count_correct.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Call function with correct number of arguments
+--FILE--
+<?php
+function foo() { }
+foo();
+
+function bar($foo, $bar) { }
+bar(1, 2);
+
+function bat(int $foo, string $bar) { }
+bat(123, "foo");
+bat("123", "foo");
+
+$fp = fopen(__FILE__, "r");
+fclose($fp);
+
+echo "done";
+--EXPECT--
+done

Zend/tests/function_arguments/argument_count_correct_strict.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Call function with correct number of arguments with strict types
+--FILE--
+<?php
+declare(strict_types=1);
+function foo() { }
+foo();
+
+function bar($foo, $bar) { }
+bar(1, 2);
+
+function bat(int $foo, string $bar) { }
+bat(123, "foo");
+
+$fp = fopen(__FILE__, "r");
+fclose($fp);
+
+echo "done";
+--EXPECT--
+done

Zend/tests/function_arguments/argument_count_incorrect_internal.phpt

@@ -0,0 +1,10 @@
+--TEST--
+Call internal function with incorrect number of arguments
+--FILE--
+<?php
+substr("foo");
+array_diff([]);
+--EXPECTF--
+Warning: substr() expects at least 2 parameters, 1 given in %s
+
+Warning: array_diff(): at least 2 parameters are required, 1 given in %s

Zend/tests/function_arguments/argument_count_incorrect_internal_strict.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Call internal function with incorrect number of arguments with strict types
+--FILE--
+<?php
+declare(strict_types=1);
+try {
+	substr("foo");
+} catch (\Error $e) {
+	echo get_class($e) . PHP_EOL;
+	echo $e->getMessage() . PHP_EOL;
+}
+
+array_diff([]);
+--EXPECTF--
+ArgumentCountError
+substr() expects at least 2 parameters, 1 given
+
+Warning: array_diff(): at least 2 parameters are required, 1 given in %s

Zend/tests/function_arguments/argument_count_incorrect_userland.phpt

@@ -0,0 +1,44 @@
+--TEST--
+Call userland function with incorrect number of arguments
+--FILE--
+<?php
+try {
+	function foo($bar) { }
+	foo();
+} catch (\Error $e) {
+	echo get_class($e) . PHP_EOL;
+	echo $e->getMessage() . PHP_EOL;
+}
+
+try {
+	function bar($foo, $bar) { }
+	bar(1);
+} catch (\Error $e) {
+	echo get_class($e) . PHP_EOL;
+	echo $e->getMessage() . PHP_EOL;
+}
+
+function bat(int $foo, string $bar) { }
+
+try {
+	bat(123);
+} catch (\Error $e) {
+	echo get_class($e) . PHP_EOL;
+	echo $e->getMessage() . PHP_EOL;
+}
+
+try {
+	bat("123");
+} catch (\Error $e) {
+	echo get_class($e) . PHP_EOL;
+	echo $e->getMessage() . PHP_EOL;
+}
+--EXPECTF--
+ArgumentCountError
+Too few arguments to function foo(), 0 passed in %s and exactly 1 expected
+ArgumentCountError
+Too few arguments to function bar(), 1 passed in %s and exactly 2 expected
+ArgumentCountError
+Too few arguments to function bat(), 1 passed in %s and exactly 2 expected
+ArgumentCountError
+Too few arguments to function bat(), 1 passed in %s and exactly 2 expected

Zend/tests/function_arguments/argument_count_incorrect_userland_strict.phpt

@@ -0,0 +1,54 @@
+--TEST--
+Call userland function with incorrect number of arguments with strict types
+--FILE--
+<?php
+declare(strict_types=1);
+try {
+	function foo($bar) { }
+	foo();
+} catch (\Error $e) {
+	echo get_class($e) . PHP_EOL;
+	echo $e->getMessage() . PHP_EOL;
+}
+
+try {
+	function bar($foo, $bar) { }
+	bar(1);
+} catch (\Error $e) {
+	echo get_class($e) . PHP_EOL;
+	echo $e->getMessage() . PHP_EOL;
+}
+
+function bat(int $foo, string $bar) { }
+
+try {
+	bat(123);
+} catch (\Error $e) {
+	echo get_class($e) . PHP_EOL;
+	echo $e->getMessage() . PHP_EOL;
+}
+
+try {
+	bat("123");
+} catch (\Error $e) {
+	echo get_class($e) . PHP_EOL;
+	echo $e->getMessage() . PHP_EOL;
+}
+
+try {
+	bat(123, 456);
+} catch (\Error $e) {
+	echo get_class($e) . PHP_EOL;
+	echo $e->getMessage() . PHP_EOL;
+}
+--EXPECTF--
+ArgumentCountError
+Too few arguments to function foo(), 0 passed in %s and exactly 1 expected
+ArgumentCountError
+Too few arguments to function bar(), 1 passed in %s and exactly 2 expected
+ArgumentCountError
+Too few arguments to function bat(), 1 passed in %s and exactly 2 expected
+TypeError
+Argument 1 passed to bat() must be of the type integer, string given, called in %s
+TypeError
+Argument 2 passed to bat() must be of the type string, integer given, called in %s

Zend/tests/generators/mutli_yield_from_with_exception.phpt

@@ -40,11 +40,10 @@ Stack trace:
 #2 %s(%d): Generator->next()
 #3 {main}
 Generator 1
-
-Fatal error: Uncaught ClosedGeneratorException: Generator yielded from aborted, no return value available in %s:%d
+Caught exception!
+ClosedGeneratorException: Generator yielded from aborted, no return value available in %s:%d
 Stack trace:
 #0 [internal function]: gen(Object(Generator))
 #1 %s(%d): Generator->current()
 #2 {main}
-  thrown in %s on line %d
-
+NULL

Zend/tests/instanceof_001.phpt

@@ -26,4 +26,4 @@ bool(true)
 bool(true)
 bool(false)
 
-Catchable fatal error: Object of class stdClass could not be converted to string in %s on line %d
+Recoverable fatal error: Object of class stdClass could not be converted to string in %s on line %d

Zend/tests/ns_071.phpt

@@ -18,7 +18,7 @@ new bar(new \stdclass);
 --EXPECTF--
 NULL
 
-Fatal error: Uncaught TypeError: Argument 1 passed to foo\bar::__construct() must be of the type array, object given, called in %s on line %d and defined in %s:%d
+Fatal error: Uncaught TypeError: Argument 1 passed to foo\bar::__construct() must be of the type array or null, object given, called in %s on line %d and defined in %s:%d
 Stack trace:
 #0 %s(%d): foo\bar->__construct(Object(stdClass))
 #1 {main}

Zend/tests/ns_072.phpt

@@ -30,7 +30,7 @@ object(foo\test)#%d (0) {
 }
 NULL
 
-Fatal error: Uncaught TypeError: Argument 1 passed to foo\bar::__construct() must implement interface foo\foo, instance of stdClass given, called in %s on line %d and defined in %s:%d
+Fatal error: Uncaught TypeError: Argument 1 passed to foo\bar::__construct() must implement interface foo\foo or be null, instance of stdClass given, called in %s on line %d and defined in %s:%d
 Stack trace:
 #0 %s(%d): foo\bar->__construct(Object(stdClass))
 #1 {main}

Zend/tests/nullable_types/nullable_type_parameters_do_not_have_default_value.phpt

@@ -9,7 +9,7 @@ function f(?callable $p) {}
 f();
 
 --EXPECTF--
-Fatal error: Uncaught Error: Too few arguments to function f(), 0 passed in %snullable_type_parameters_do_not_have_default_value.php on line %d and exactly 1 expected in %s:%d
+Fatal error: Uncaught ArgumentCountError: Too few arguments to function f(), 0 passed in %snullable_type_parameters_do_not_have_default_value.php on line %d and exactly 1 expected in %s:%d
 Stack trace:
 #%d %s
 #%d %s

Zend/tests/objects_022.phpt

@@ -25,7 +25,7 @@ $foo = new foo;
 $foo->testFoo(new foo);
 $foo->testBar(new bar);
 $foo->testBaz(new baz);
-$foo->testFoo(new stdClass); // Catchable fatal error
+$foo->testFoo(new stdClass); // Recoverable fatal error
 
 ?>
 --EXPECTF--

Zend/tests/return_types/030.phpt

@@ -16,7 +16,7 @@ foo(0);
 ok
 ok
 
-Fatal error: Uncaught TypeError: Return value of foo() must be of the type array, integer returned in %s030.php:3
+Fatal error: Uncaught TypeError: Return value of foo() must be of the type array or null, integer returned in %s030.php:3
 Stack trace:
 #0 %s030.php(10): foo(0)
 #1 {main}

Zend/tests/typehints/fq_nullable.phpt

@@ -0,0 +1,13 @@
+--TEST--
+Fully-qualified nullable parameter type
+--FILE--
+<?php
+
+namespace Foo;
+function test(?\stdClass $param) {}
+test(new \stdClass);
+
+?>
+===DONE===
+--EXPECT--
+===DONE===

Zend/tests/typehints/or_null.phpt

@@ -0,0 +1,317 @@
+--TEST--
+Test "or null"/"or be null" in type-checking errors for userland functions
+--FILE--
+<?php
+
+// This should test every branch in zend_execute.c's `zend_verify_arg_type`, `zend_verify_return_type` and `zend_verify_missing_return_type` functions which produces an "or null"/"or be null" part in its error message
+
+function unloadedClass(?I\Dont\Exist $param) {}
+
+try {
+    unloadedClass(new \StdClass);
+} catch (\TypeError $e) {
+    echo $e, PHP_EOL;
+}
+
+class RealClass {}
+interface RealInterface {}
+
+function loadedClass(?RealClass $param) {}
+function loadedInterface(?RealInterface $param) {}
+
+try {
+    loadedClass(new \StdClass);
+} catch (\TypeError $e) {
+    echo $e, PHP_EOL;
+}
+
+try {
+    loadedInterface(new \StdClass);
+} catch (\TypeError $e) {
+    echo $e, PHP_EOL;
+}
+
+try {
+    unloadedClass(1);
+} catch (\TypeError $e) {
+    echo $e, PHP_EOL;
+}
+
+try {
+    loadedClass(1);
+} catch (\TypeError $e) {
+    echo $e, PHP_EOL;
+}
+
+try {
+    loadedInterface(1);
+} catch (\TypeError $e) {
+    echo $e, PHP_EOL;
+}
+
+function callableF(?callable $param) {}
+
+try {
+    callableF(1);
+} catch (\TypeError $e) {
+    echo $e, PHP_EOL;
+}
+
+function iterableF(?iterable $param) {}
+
+try {
+    iterableF(1);
+} catch (\TypeError $e) {
+    echo $e, PHP_EOL;
+}
+
+function intF(?int $param) {}
+
+try {
+    intF(new StdClass);
+} catch (\TypeError $e) {
+    echo $e, PHP_EOL;
+}
+
+function returnUnloadedClass(): ?I\Dont\Exist {
+    return new \StdClass;
+}
+
+try {
+    returnUnloadedClass();
+} catch (\TypeError $e) {
+    echo $e, PHP_EOL;
+}
+
+function returnLoadedClass(): ?RealClass {
+    return new \StdClass;
+}
+
+try {
+    returnLoadedClass();
+} catch (\TypeError $e) {
+    echo $e, PHP_EOL;
+}
+
+function returnLoadedInterface(): ?RealInterface {
+    return new \StdClass;
+}
+
+try {
+    returnLoadedInterface();
+} catch (\TypeError $e) {
+    echo $e, PHP_EOL;
+}
+
+function returnUnloadedClassScalar(): ?I\Dont\Exist {
+    return 1;
+}
+
+try {
+    returnUnloadedClassScalar();
+} catch (\TypeError $e) {
+    echo $e, PHP_EOL;
+}
+
+function returnLoadedClassScalar(): ?RealClass {
+    return 1;
+}
+
+try {
+    returnLoadedClassScalar();
+} catch (\TypeError $e) {
+    echo $e, PHP_EOL;
+}
+
+function returnLoadedInterfaceScalar(): ?RealInterface {
+    return 1;
+}
+
+try {
+    returnLoadedInterfaceScalar();
+} catch (\TypeError $e) {
+    echo $e, PHP_EOL;
+}
+
+function returnCallable(): ?callable {
+    return 1;
+}
+
+try {
+    returnCallable();
+} catch (\TypeError $e) {
+    echo $e, PHP_EOL;
+}
+
+function returnIterable(): ?iterable {
+    return 1;
+}
+
+try {
+    returnIterable();
+} catch (\TypeError $e) {
+    echo $e, PHP_EOL;
+}
+
+function returnInt(): ?int {
+    return new \StdClass;
+}
+
+try {
+    returnInt();
+} catch (\TypeError $e) {
+    echo $e, PHP_EOL;
+}
+
+function returnMissingUnloadedClass(): ?I\Dont\Exist {
+}
+
+try {
+    returnMissingUnloadedClass();
+} catch (\TypeError $e) {
+    echo $e, PHP_EOL;
+}
+
+function returnMissingLoadedClass(): ?RealClass {
+}
+
+try {
+    returnMissingLoadedClass();
+} catch (\TypeError $e) {
+    echo $e, PHP_EOL;
+}
+
+function returnMissingLoadedInterface(): ?RealInterface {
+}
+
+try {
+    returnMissingLoadedInterface();
+} catch (\TypeError $e) {
+    echo $e, PHP_EOL;
+}
+
+function returnMissingCallable(): ?callable {
+}
+
+try {
+    returnMissingCallable();
+} catch (\TypeError $e) {
+    echo $e, PHP_EOL;
+}
+
+function returnMissingIterable(): ?iterable {
+}
+
+try {
+    returnMissingIterable();
+} catch (\TypeError $e) {
+    echo $e, PHP_EOL;
+}
+
+function returnMissingInt(): ?int {
+}
+
+try {
+    returnMissingInt();
+} catch (\TypeError $e) {
+    echo $e, PHP_EOL;
+}
+
+?>
+--EXPECTF--
+TypeError: Argument 1 passed to unloadedClass() must be an instance of I\Dont\Exist or null, instance of stdClass given, called in %s on line 8 and defined in %s:5
+Stack trace:
+#0 %s(8): unloadedClass(Object(stdClass))
+#1 {main}
+TypeError: Argument 1 passed to loadedClass() must be an instance of RealClass or null, instance of stdClass given, called in %s on line 20 and defined in %s:16
+Stack trace:
+#0 %s(20): loadedClass(Object(stdClass))
+#1 {main}
+TypeError: Argument 1 passed to loadedInterface() must implement interface RealInterface or be null, instance of stdClass given, called in %s on line 26 and defined in %s:17
+Stack trace:
+#0 %s(26): loadedInterface(Object(stdClass))
+#1 {main}
+TypeError: Argument 1 passed to unloadedClass() must be an instance of I\Dont\Exist or null, integer given, called in %s on line 32 and defined in %s:5
+Stack trace:
+#0 %s(32): unloadedClass(1)
+#1 {main}
+TypeError: Argument 1 passed to loadedClass() must be an instance of RealClass or null, integer given, called in %s on line 38 and defined in %s:16
+Stack trace:
+#0 %s(38): loadedClass(1)
+#1 {main}
+TypeError: Argument 1 passed to loadedInterface() must implement interface RealInterface or be null, integer given, called in %s on line 44 and defined in %s:17
+Stack trace:
+#0 %s(44): loadedInterface(1)
+#1 {main}
+TypeError: Argument 1 passed to callableF() must be callable or null, integer given, called in %s on line 52 and defined in %s:49
+Stack trace:
+#0 %s(52): callableF(1)
+#1 {main}
+TypeError: Argument 1 passed to iterableF() must be iterable or null, integer given, called in %s on line 60 and defined in %s:57
+Stack trace:
+#0 %s(60): iterableF(1)
+#1 {main}
+TypeError: Argument 1 passed to intF() must be of the type integer or null, object given, called in %s on line 68 and defined in %s:65
+Stack trace:
+#0 %s(68): intF(Object(stdClass))
+#1 {main}
+TypeError: Return value of returnUnloadedClass() must be an instance of I\Dont\Exist or null, instance of stdClass returned in %s:74
+Stack trace:
+#0 %s(78): returnUnloadedClass()
+#1 {main}
+TypeError: Return value of returnLoadedClass() must be an instance of RealClass or null, instance of stdClass returned in %s:84
+Stack trace:
+#0 %s(88): returnLoadedClass()
+#1 {main}
+TypeError: Return value of returnLoadedInterface() must implement interface RealInterface or be null, instance of stdClass returned in %s:94
+Stack trace:
+#0 %s(98): returnLoadedInterface()
+#1 {main}
+TypeError: Return value of returnUnloadedClassScalar() must be an instance of I\Dont\Exist or null, integer returned in %s:104
+Stack trace:
+#0 %s(108): returnUnloadedClassScalar()
+#1 {main}
+TypeError: Return value of returnLoadedClassScalar() must be an instance of RealClass or null, integer returned in %s:114
+Stack trace:
+#0 %s(118): returnLoadedClassScalar()
+#1 {main}
+TypeError: Return value of returnLoadedInterfaceScalar() must implement interface RealInterface or be null, integer returned in %s:124
+Stack trace:
+#0 %s(128): returnLoadedInterfaceScalar()
+#1 {main}
+TypeError: Return value of returnCallable() must be callable or null, integer returned in %s:134
+Stack trace:
+#0 %s(138): returnCallable()
+#1 {main}
+TypeError: Return value of returnIterable() must be iterable or null, integer returned in %s:144
+Stack trace:
+#0 %s(148): returnIterable()
+#1 {main}
+TypeError: Return value of returnInt() must be of the type integer or null, object returned in %s:154
+Stack trace:
+#0 %s(158): returnInt()
+#1 {main}
+TypeError: Return value of returnMissingUnloadedClass() must be an instance of I\Dont\Exist or null, none returned in %s:164
+Stack trace:
+#0 %s(167): returnMissingUnloadedClass()
+#1 {main}
+TypeError: Return value of returnMissingLoadedClass() must be an instance of RealClass or null, none returned in %s:173
+Stack trace:
+#0 %s(176): returnMissingLoadedClass()
+#1 {main}
+TypeError: Return value of returnMissingLoadedInterface() must implement interface RealInterface or be null, none returned in %s:182
+Stack trace:
+#0 %s(185): returnMissingLoadedInterface()
+#1 {main}
+TypeError: Return value of returnMissingCallable() must be callable or null, none returned in %s:191
+Stack trace:
+#0 %s(194): returnMissingCallable()
+#1 {main}
+TypeError: Return value of returnMissingIterable() must be iterable or null, none returned in %s:200
+Stack trace:
+#0 %s(203): returnMissingIterable()
+#1 {main}
+TypeError: Return value of returnMissingInt() must be of the type integer or null, none returned in %s:209
+Stack trace:
+#0 %s(212): returnMissingInt()
+#1 {main}

Zend/zend.c

@@ -1372,6 +1372,23 @@ ZEND_API ZEND_COLD void zend_internal_type_error(zend_bool throw_exception, cons
 	va_end(va);
 } /* }}} */
 
+ZEND_API ZEND_COLD void zend_internal_argument_count_error(zend_bool throw_exception, const char *format, ...) /* {{{ */
+{
+	va_list va;
+	char *message = NULL;
+
+	va_start(va, format);
+	zend_vspprintf(&message, 0, format, va);
+	if (throw_exception) {
+		zend_throw_exception(zend_ce_argument_count_error, message, 0);
+	} else {
+		zend_error(E_WARNING, "%s", message);
+	}
+	efree(message);
+
+	va_end(va);
+} /* }}} */
+
 ZEND_API ZEND_COLD void zend_output_debug_string(zend_bool trigger_break, const char *format, ...) /* {{{ */
 {
 #if ZEND_DEBUG

Zend/zend.h

@@ -271,6 +271,7 @@ ZEND_API ZEND_COLD void zend_error(int type, const char *format, ...) ZEND_ATTRI
 ZEND_API ZEND_COLD void zend_throw_error(zend_class_entry *exception_ce, const char *format, ...) ZEND_ATTRIBUTE_FORMAT(printf, 2, 3);
 ZEND_API ZEND_COLD void zend_type_error(const char *format, ...) ZEND_ATTRIBUTE_FORMAT(printf, 1, 2);
 ZEND_API ZEND_COLD void zend_internal_type_error(zend_bool throw_exception, const char *format, ...) ZEND_ATTRIBUTE_FORMAT(printf, 2, 3);
+ZEND_API ZEND_COLD void zend_internal_argument_count_error(zend_bool throw_exception, const char *format, ...) ZEND_ATTRIBUTE_FORMAT(printf, 2, 3);
 
 ZEND_COLD void zenderror(const char *error);
 

Zend/zend_API.c

@@ -157,7 +157,7 @@ ZEND_API ZEND_COLD void zend_wrong_param_count(void) /* {{{ */
 	const char *space;
 	const char *class_name = get_active_class_name(&space);
 
-	zend_internal_type_error(ZEND_ARG_USES_STRICT_TYPES(), "Wrong parameter count for %s%s%s()", class_name, space, get_active_function_name());
+	zend_internal_argument_count_error(ZEND_ARG_USES_STRICT_TYPES(), "Wrong parameter count for %s%s%s()", class_name, space, get_active_function_name());
 }
 /* }}} */
 
@@ -202,20 +202,21 @@ ZEND_API char *zend_zval_type_name(const zval *arg) /* {{{ */
 }
 /* }}} */
 
-#ifdef FAST_ZPP
 ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_parameters_count_error(int num_args, int min_num_args, int max_num_args) /* {{{ */
 {
 	zend_function *active_function = EG(current_execute_data)->func;
 	const char *class_name = active_function->common.scope ? ZSTR_VAL(active_function->common.scope->name) : "";
 
-	zend_internal_type_error(ZEND_ARG_USES_STRICT_TYPES(), "%s%s%s() expects %s %d parameter%s, %d given",
-		class_name, \
-		class_name[0] ? "::" : "", \
-		ZSTR_VAL(active_function->common.function_name),
-		min_num_args == max_num_args ? "exactly" : num_args < min_num_args ? "at least" : "at most",
-		num_args < min_num_args ? min_num_args : max_num_args,
-		(num_args < min_num_args ? min_num_args : max_num_args) == 1 ? "" : "s",
-		num_args);
+	zend_internal_argument_count_error(
+				ZEND_ARG_USES_STRICT_TYPES(), 
+				"%s%s%s() expects %s %d parameter%s, %d given", 
+				class_name, \
+				class_name[0] ? "::" : "", \
+				ZSTR_VAL(active_function->common.function_name),
+				min_num_args == max_num_args ? "exactly" : num_args < min_num_args ? "at least" : "at most",
+				num_args < min_num_args ? min_num_args : max_num_args,
+				(num_args < min_num_args ? min_num_args : max_num_args) == 1 ? "" : "s",
+				num_args);
 }
 /* }}} */
 
@@ -296,7 +297,6 @@ ZEND_API int ZEND_FASTCALL zend_parse_arg_class(zval *arg, zend_class_entry **pc
 	return 1;
 }
 /* }}} */
-#endif
 
 ZEND_API int ZEND_FASTCALL zend_parse_arg_bool_weak(zval *arg, zend_bool *dest) /* {{{ */
 {
@@ -875,7 +875,7 @@ static int zend_parse_va_args(int num_args, const char *type_spec, va_list *va,
 			zend_function *active_function = EG(current_execute_data)->func;
 			const char *class_name = active_function->common.scope ? ZSTR_VAL(active_function->common.scope->name) : "";
 			zend_bool throw_exception = ZEND_ARG_USES_STRICT_TYPES() || (flags & ZEND_PARSE_PARAMS_THROW);
-			zend_internal_type_error(throw_exception, "%s%s%s() expects %s %d parameter%s, %d given",
+			zend_internal_argument_count_error(throw_exception, "%s%s%s() expects %s %d parameter%s, %d given",
 					class_name,
 					class_name[0] ? "::" : "",
 					ZSTR_VAL(active_function->common.function_name),
@@ -2909,7 +2909,7 @@ static int zend_is_callable_check_func(int check_flags, zval *callable, zend_fca
 	zend_string *mname, *cname;
 	zend_string *lmname;
 	const char *colon;
-	size_t clen, mlen;
+	size_t clen;
 	HashTable *ftable;
 	int call_via_handler = 0;
 	zend_class_entry *scope;
@@ -2962,6 +2962,8 @@ static int zend_is_callable_check_func(int check_flags, zval *callable, zend_fca
 		colon > Z_STRVAL_P(callable) &&
 		*(colon-1) == ':'
 	) {
+		size_t mlen;
+
 		colon--;
 		clen = colon - Z_STRVAL_P(callable);
 		mlen = Z_STRLEN_P(callable) - clen - 2;
@@ -2994,7 +2996,6 @@ static int zend_is_callable_check_func(int check_flags, zval *callable, zend_fca
 		mname = zend_string_init(Z_STRVAL_P(callable) + clen + 2, mlen, 0);
 	} else if (ce_org) {
 		/* Try to fetch find static method of given class. */
-		mlen = Z_STRLEN_P(callable);
 		mname = Z_STR_P(callable);
 		zend_string_addref(mname);
 		ftable = &ce_org->function_table;

Zend/zend_API.h

@@ -676,13 +676,11 @@ END_EXTERN_C()
 
 /* Fast parameter parsing API */
 
-/* This API should be used only for really often used functions.
- * (Keep the original parsing code and wrap usage with #ifndef FAST_ZPP)
+/* Fast ZPP is always enabled now; this define is left in for compatibility
+ * with any existing conditional compilation blocks.
  */
 #define FAST_ZPP 1
 
-#ifdef FAST_ZPP
-
 #define Z_EXPECTED_TYPES(_) \
 	_(Z_EXPECTED_LONG,		"integer") \
 	_(Z_EXPECTED_BOOL,		"boolean") \
@@ -1045,8 +1043,6 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_error(int severity, in
 #define Z_PARAM_VARIADIC(spec, dest, dest_num) \
 	Z_PARAM_VARIADIC_EX(spec, dest, dest_num, 0)
 
-#endif /* FAST_ZPP */
-
 /* End of new parameter parsing API */
 
 /* Inlined implementations shared by new and old parameter parsing APIs */

Zend/zend_alloc.c

@@ -1503,21 +1503,21 @@ static void *zend_mm_realloc_heap(zend_mm_heap *heap, void *ptr, size_t size, si
 
 		ZEND_MM_CHECK(chunk->heap == heap, "zend_mm_heap corrupted");
 		if (info & ZEND_MM_IS_SRUN) {
-			int old_bin_num, bin_num;
-
-			old_bin_num = ZEND_MM_SRUN_BIN_NUM(info);
+			int old_bin_num = ZEND_MM_SRUN_BIN_NUM(info);
 			old_size = bin_data_size[old_bin_num];
-			bin_num = ZEND_MM_SMALL_SIZE_TO_BIN(size);
-			if (old_bin_num == bin_num) {
+			if (size <= ZEND_MM_MAX_SMALL_SIZE) {
+				int bin_num = ZEND_MM_SMALL_SIZE_TO_BIN(size);
+				if (old_bin_num == bin_num) {
 #if ZEND_DEBUG
-				dbg = zend_mm_get_debug_info(heap, ptr);
-				dbg->size = real_size;
-				dbg->filename = __zend_filename;
-				dbg->orig_filename = __zend_orig_filename;
-				dbg->lineno = __zend_lineno;
-				dbg->orig_lineno = __zend_orig_lineno;
+					dbg = zend_mm_get_debug_info(heap, ptr);
+					dbg->size = real_size;
+					dbg->filename = __zend_filename;
+					dbg->orig_filename = __zend_orig_filename;
+					dbg->lineno = __zend_lineno;
+					dbg->orig_lineno = __zend_orig_lineno;
 #endif
-				return ptr;
+					return ptr;
+				}
 			}
 		} else /* if (info & ZEND_MM_IS_LARGE_RUN) */ {
 			ZEND_MM_CHECK(ZEND_MM_ALIGNED_OFFSET(page_offset, ZEND_MM_PAGE_SIZE) == 0, "zend_mm_heap corrupted");

Zend/zend_builtin_functions.c

@@ -622,15 +622,9 @@ ZEND_FUNCTION(strlen)
 {
 	zend_string *s;
 
-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "S", &s) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(1, 1)
 		Z_PARAM_STR(s)
 	ZEND_PARSE_PARAMETERS_END();
-#endif
 
 	RETVAL_LONG(ZSTR_LEN(s));
 }
@@ -770,16 +764,10 @@ ZEND_FUNCTION(error_reporting)
 	zval *err = NULL;
 	int old_error_reporting;
 
-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "|z", &err) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(0, 1)
 		Z_PARAM_OPTIONAL
 		Z_PARAM_ZVAL(err)
 	ZEND_PARSE_PARAMETERS_END();
-#endif
 
 	old_error_reporting = EG(error_reporting);
 	if (ZEND_NUM_ARGS() != 0) {
@@ -893,18 +881,12 @@ ZEND_FUNCTION(define)
 	int case_sensitive = CONST_CS;
 	zend_constant c;
 
-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "Sz|b", &name, &val, &non_cs) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(2, 3)
 		Z_PARAM_STR(name)
 		Z_PARAM_ZVAL(val)
 		Z_PARAM_OPTIONAL
 		Z_PARAM_BOOL(non_cs)
 	ZEND_PARSE_PARAMETERS_END();
-#endif
 
 	if (non_cs) {
 		case_sensitive = 0;
@@ -985,15 +967,9 @@ ZEND_FUNCTION(defined)
 {
 	zend_string *name;
 
-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "S", &name) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(1, 1)
 		Z_PARAM_STR(name)
 	ZEND_PARSE_PARAMETERS_END();
-#endif
 
 	if (zend_get_constant_ex(name, zend_get_executed_scope(), ZEND_FETCH_CLASS_SILENT)) {
 		RETURN_TRUE;
@@ -1094,18 +1070,12 @@ static void is_a_impl(INTERNAL_FUNCTION_PARAMETERS, zend_bool only_subclass) /*
 	zend_bool allow_string = only_subclass;
 	zend_bool retval;
 
-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "zS|b", &obj, &class_name, &allow_string) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(2, 3)
 		Z_PARAM_ZVAL(obj)
 		Z_PARAM_STR(class_name)
 		Z_PARAM_OPTIONAL
 		Z_PARAM_BOOL(allow_string)
 	ZEND_PARSE_PARAMETERS_END();
-#endif
 	/*
 	 * allow_string - is_a default is no, is_subclass_of is yes.
 	 *   if it's allowed, then the autoloader will be called if the class does not exist.
@@ -1246,15 +1216,9 @@ ZEND_FUNCTION(get_object_vars)
 	zend_string *key;
 	zend_object *zobj;
 
-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "o", &obj) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(1, 1)
 		Z_PARAM_OBJECT(obj)
 	ZEND_PARSE_PARAMETERS_END();
-#endif
 
 	if (Z_OBJ_HT_P(obj)->get_properties == NULL) {
 		RETURN_FALSE;
@@ -1392,16 +1356,11 @@ ZEND_FUNCTION(method_exists)
 	zend_string *lcname;
 	zend_class_entry * ce;
 
-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "zS", &klass, &method_name) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(2, 2)
 		Z_PARAM_ZVAL(klass)
 		Z_PARAM_STR(method_name)
 	ZEND_PARSE_PARAMETERS_END();
-#endif
+	
 	if (Z_TYPE_P(klass) == IS_OBJECT) {
 		ce = Z_OBJCE_P(klass);
 	} else if (Z_TYPE_P(klass) == IS_STRING) {
@@ -1497,17 +1456,11 @@ ZEND_FUNCTION(class_exists)
 	zend_class_entry *ce;
 	zend_bool autoload = 1;
 
-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "S|b", &class_name, &autoload) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(1, 2)
 		Z_PARAM_STR(class_name)
 		Z_PARAM_OPTIONAL
 		Z_PARAM_BOOL(autoload)
 	ZEND_PARSE_PARAMETERS_END();
-#endif
 
 	if (!autoload) {
 		if (ZSTR_VAL(class_name)[0] == '\\') {
@@ -1540,17 +1493,11 @@ ZEND_FUNCTION(interface_exists)
 	zend_class_entry *ce;
 	zend_bool autoload = 1;
 
-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "S|b", &iface_name, &autoload) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(1, 2)
 		Z_PARAM_STR(iface_name)
 		Z_PARAM_OPTIONAL
 		Z_PARAM_BOOL(autoload)
 	ZEND_PARSE_PARAMETERS_END();
-#endif
 
 	if (!autoload) {
 		if (ZSTR_VAL(iface_name)[0] == '\\') {
@@ -1582,17 +1529,11 @@ ZEND_FUNCTION(trait_exists)
 	zend_class_entry *ce;
 	zend_bool autoload = 1;
 
-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "S|b", &trait_name, &autoload) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(1, 2)
 		Z_PARAM_STR(trait_name)
 		Z_PARAM_OPTIONAL
 		Z_PARAM_BOOL(autoload)
 	ZEND_PARSE_PARAMETERS_END();
-#endif
 
 	if (!autoload) {
 		if (ZSTR_VAL(trait_name)[0] == '\\') {
@@ -1625,15 +1566,9 @@ ZEND_FUNCTION(function_exists)
 	zend_function *func;
 	zend_string *lcname;
 
-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "S", &name) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(1, 1)
 		Z_PARAM_STR(name)
 	ZEND_PARSE_PARAMETERS_END();
-#endif
 
 	if (ZSTR_VAL(name)[0] == '\\') {
 		/* Ignore leading "\" */

Zend/zend_compile.c

@@ -584,7 +584,9 @@ static int zend_add_const_name_literal(zend_op_array *op_array, zend_string *nam
 
 void zend_stop_lexing(void)
 {
-	if(LANG_SCNG(on_event)) LANG_SCNG(on_event)(ON_STOP, END, 0);
+	if (LANG_SCNG(on_event)) {
+		LANG_SCNG(on_event)(ON_STOP, END, 0, LANG_SCNG(on_event_context));
+	}
 
 	LANG_SCNG(yy_cursor) = LANG_SCNG(yy_limit);
 }
@@ -2196,10 +2198,43 @@ static inline uint32_t zend_emit_jump(uint32_t opnum_target) /* {{{ */
 }
 /* }}} */
 
+ZEND_API int zend_is_smart_branch(zend_op *opline) /* {{{ */
+{
+	switch (opline->opcode) {
+		case ZEND_IS_IDENTICAL:
+		case ZEND_IS_NOT_IDENTICAL:
+		case ZEND_IS_EQUAL:
+		case ZEND_IS_NOT_EQUAL:
+		case ZEND_IS_SMALLER:
+		case ZEND_IS_SMALLER_OR_EQUAL:
+		case ZEND_CASE:
+		case ZEND_ISSET_ISEMPTY_VAR:
+		case ZEND_ISSET_ISEMPTY_DIM_OBJ:
+		case ZEND_ISSET_ISEMPTY_PROP_OBJ:
+		case ZEND_ISSET_ISEMPTY_STATIC_PROP:
+		case ZEND_INSTANCEOF:
+		case ZEND_TYPE_CHECK:
+		case ZEND_DEFINED:
+			return 1;
+		default:
+			return 0;
+	}
+}
+/* }}} */
+
 static inline uint32_t zend_emit_cond_jump(zend_uchar opcode, znode *cond, uint32_t opnum_target) /* {{{ */
 {
 	uint32_t opnum = get_next_op_number(CG(active_op_array));
-	zend_op *opline = zend_emit_op(NULL, opcode, cond, NULL);
+	zend_op *opline;
+
+	if ((cond->op_type & (IS_CV|IS_CONST))
+	 && opnum > 0
+	 && zend_is_smart_branch(CG(active_op_array)->opcodes + opnum - 1)) {
+		/* emit extra NOP to avoid incorrect SMART_BRANCH in very rare cases */
+		zend_emit_op(NULL, ZEND_NOP, NULL, NULL);
+		opnum = get_next_op_number(CG(active_op_array));
+	}
+	opline = zend_emit_op(NULL, opcode, cond, NULL);
 	opline->op2.opline_num = opnum_target;
 	return opnum;
 }
@@ -3377,6 +3412,22 @@ int zend_compile_func_typecheck(znode *result, zend_ast_list *args, uint32_t typ
 }
 /* }}} */
 
+int zend_compile_func_cast(znode *result, zend_ast_list *args, uint32_t type) /* {{{ */
+{
+	znode arg_node;
+	zend_op *opline;
+
+	if (args->children != 1 || args->child[0]->kind == ZEND_AST_UNPACK) {
+		return FAILURE;
+	}
+
+	zend_compile_expr(&arg_node, args->child[0]);
+	opline = zend_emit_op_tmp(result, ZEND_CAST, &arg_node, NULL);
+	opline->extended_value = type;
+	return SUCCESS;
+}
+/* }}} */
+
 int zend_compile_func_defined(znode *result, zend_ast_list *args) /* {{{ */
 {
 	zend_string *name;
@@ -3642,6 +3693,16 @@ int zend_try_compile_special_func(znode *result, zend_string *lcname, zend_ast_l
 		return zend_compile_func_typecheck(result, args, IS_OBJECT);
 	} else if (zend_string_equals_literal(lcname, "is_resource")) {
 		return zend_compile_func_typecheck(result, args, IS_RESOURCE);
+	} else if (zend_string_equals_literal(lcname, "boolval")) {
+		return zend_compile_func_cast(result, args, _IS_BOOL);
+	} else if (zend_string_equals_literal(lcname, "intval")) {
+		return zend_compile_func_cast(result, args, IS_LONG);
+	} else if (zend_string_equals_literal(lcname, "floatval")
+		|| zend_string_equals_literal(lcname, "doubleval")
+	) {
+		return zend_compile_func_cast(result, args, IS_DOUBLE);
+	} else if (zend_string_equals_literal(lcname, "strval")) {
+		return zend_compile_func_cast(result, args, IS_STRING);
 	} else if (zend_string_equals_literal(lcname, "defined")) {
 		return zend_compile_func_defined(result, args);
 	} else if (zend_string_equals_literal(lcname, "chr") && type == BP_VAR_R) {
@@ -5138,6 +5199,7 @@ void zend_compile_params(zend_ast *ast, zend_ast *return_type_ast) /* {{{ */
 			op_array->fn_flags |= ZEND_ACC_HAS_TYPE_HINTS;
 			arg_info->allow_null = has_null_default || is_explicitly_nullable;
 
+			type_ast->attr &= ~ZEND_TYPE_NULLABLE;
 			zend_compile_typename(type_ast, arg_info);
 
 			if (arg_info->type_hint == IS_VOID) {

Zend/zend_compile.h

@@ -449,7 +449,7 @@ struct _zend_execute_data {
 	const zend_op       *opline;           /* executed opline                */
 	zend_execute_data   *call;             /* current call                   */
 	zval                *return_value;
-	zend_function       *func;             /* executed funcrion              */
+	zend_function       *func;             /* executed function              */
 	zval                 This;             /* this + call_info + num_args    */
 	zend_execute_data   *prev_execute_data;
 	zend_array          *symbol_table;
@@ -791,6 +791,7 @@ ZEND_API char *zend_make_compiled_string_description(const char *name);
 ZEND_API void zend_initialize_class_data(zend_class_entry *ce, zend_bool nullify_handlers);
 uint32_t zend_get_class_fetch_type(zend_string *name);
 ZEND_API zend_uchar zend_get_call_op(const zend_op *init_op, zend_function *fbc);
+ZEND_API int zend_is_smart_branch(zend_op *opline);
 
 typedef zend_bool (*zend_auto_global_callback)(zend_string *name);
 typedef struct _zend_auto_global {

Zend/zend_constants.c

@@ -375,12 +375,14 @@ ZEND_API zval *zend_get_constant_ex(zend_string *cname, zend_class_entry *scope,
 			if (Z_TYPE_P(ret_constant) == IS_CONSTANT_AST) {
 				if (IS_CONSTANT_VISITED(ret_constant)) {
 					zend_throw_error(NULL, "Cannot declare self-referencing constant '%s::%s'", ZSTR_VAL(class_name), ZSTR_VAL(constant_name));
+					ret_constant = NULL;
 					goto failure;
 				}
 				MARK_CONSTANT_VISITED(ret_constant);
 			}
 			if (UNEXPECTED(zval_update_constant_ex(ret_constant, ce) != SUCCESS)) {
 				RESET_CONSTANT_VISITED(ret_constant);
+				ret_constant = NULL;
 				goto failure;
 			}
 			RESET_CONSTANT_VISITED(ret_constant);

Zend/zend_exceptions.c

@@ -36,6 +36,7 @@ ZEND_API zend_class_entry *zend_ce_error_exception;
 ZEND_API zend_class_entry *zend_ce_error;
 ZEND_API zend_class_entry *zend_ce_parse_error;
 ZEND_API zend_class_entry *zend_ce_type_error;
+ZEND_API zend_class_entry *zend_ce_argument_count_error;
 ZEND_API zend_class_entry *zend_ce_arithmetic_error;
 ZEND_API zend_class_entry *zend_ce_division_by_zero_error;
 
@@ -709,7 +710,7 @@ ZEND_METHOD(exception, __toString)
 			ZVAL_UNDEF(&trace);
 		}
 
-		if (Z_OBJCE_P(exception) == zend_ce_type_error && strstr(ZSTR_VAL(message), ", called in ")) {
+		if ((Z_OBJCE_P(exception) == zend_ce_type_error || Z_OBJCE_P(exception) == zend_ce_argument_count_error) && strstr(ZSTR_VAL(message), ", called in ")) {
 			zend_string *real_message = zend_strpprintf(0, "%s and defined", ZSTR_VAL(message));
 			zend_string_release(message);
 			message = real_message;
@@ -859,6 +860,10 @@ void zend_register_default_exception(void) /* {{{ */
 	zend_ce_type_error = zend_register_internal_class_ex(&ce, zend_ce_error);
 	zend_ce_type_error->create_object = zend_default_exception_new;
 
+	INIT_CLASS_ENTRY(ce, "ArgumentCountError", NULL);
+	zend_ce_argument_count_error = zend_register_internal_class_ex(&ce, zend_ce_type_error);
+	zend_ce_argument_count_error->create_object = zend_default_exception_new;
+
 	INIT_CLASS_ENTRY(ce, "ArithmeticError", NULL);
 	zend_ce_arithmetic_error = zend_register_internal_class_ex(&ce, zend_ce_error);
 	zend_ce_arithmetic_error->create_object = zend_default_exception_new;

Zend/zend_exceptions.h

@@ -32,6 +32,7 @@ extern ZEND_API zend_class_entry *zend_ce_error_exception;
 extern ZEND_API zend_class_entry *zend_ce_error;
 extern ZEND_API zend_class_entry *zend_ce_parse_error;
 extern ZEND_API zend_class_entry *zend_ce_type_error;
+extern ZEND_API zend_class_entry *zend_ce_argument_count_error;
 extern ZEND_API zend_class_entry *zend_ce_arithmetic_error;
 extern ZEND_API zend_class_entry *zend_ce_division_by_zero_error;
 

Zend/zend_execute.c

@@ -131,7 +131,8 @@ ZEND_API const zend_internal_function zend_pass_function = {
 	((ZEND_VM_STACK_PAGE_SLOTS(gen) - ZEND_VM_STACK_HEADER_SLOTS) * sizeof(zval))
 
 #define ZEND_VM_STACK_PAGE_ALIGNED_SIZE(gen, size) \
-	(((size) + (ZEND_VM_STACK_FREE_PAGE_SIZE(gen) - 1)) & ~(ZEND_VM_STACK_PAGE_SIZE(gen) - 1))
+	(((size) + ZEND_VM_STACK_HEADER_SLOTS * sizeof(zval) \
+	  + (ZEND_VM_STACK_PAGE_SIZE(gen) - 1)) & ~(ZEND_VM_STACK_PAGE_SIZE(gen) - 1))
 
 static zend_always_inline zend_vm_stack zend_vm_stack_new_page(size_t size, zend_vm_stack prev) {
 	zend_vm_stack page = (zend_vm_stack)emalloc(size);
@@ -566,6 +567,7 @@ static inline zval *_get_obj_zval_ptr_ptr(int op_type, znode_op node, zend_execu
 static inline void zend_assign_to_variable_reference(zval *variable_ptr, zval *value_ptr)
 {
 	zend_reference *ref;
+	zval garbage;
 
 	if (EXPECTED(!Z_ISREF_P(value_ptr))) {
 		ZVAL_NEW_REF(value_ptr, value_ptr);
@@ -575,8 +577,9 @@ static inline void zend_assign_to_variable_reference(zval *variable_ptr, zval *v
 
 	ref = Z_REF_P(value_ptr);
 	GC_REFCOUNT(ref)++;
-	zval_ptr_dtor(variable_ptr);
+	ZVAL_COPY_VALUE(&garbage, variable_ptr);
 	ZVAL_REF(variable_ptr, ref);
+	zval_ptr_dtor(&garbage);
 }
 
 /* this should modify object only if it's empty */
@@ -596,21 +599,18 @@ static inline int make_real_object(zval *object)
 	return 1;
 }
 
-static char * zend_verify_internal_arg_class_kind(const zend_internal_arg_info *cur_arg_info, char **class_name, zend_class_entry **pce)
+static zend_class_entry *zend_verify_internal_arg_class_kind(
+		const zend_internal_arg_info *cur_arg_info)
 {
 	zend_string *key;
+	zend_class_entry *ce;
 	ALLOCA_FLAG(use_heap);
 
 	ZSTR_ALLOCA_INIT(key, cur_arg_info->class_name, strlen(cur_arg_info->class_name), use_heap);
-	*pce = zend_fetch_class(key, (ZEND_FETCH_CLASS_AUTO | ZEND_FETCH_CLASS_NO_AUTOLOAD));
+	ce = zend_fetch_class(key, (ZEND_FETCH_CLASS_AUTO | ZEND_FETCH_CLASS_NO_AUTOLOAD));
 	ZSTR_ALLOCA_FREE(key, use_heap);
 
-	*class_name = (*pce) ? ZSTR_VAL((*pce)->name) : (char*)cur_arg_info->class_name;
-	if (*pce && (*pce)->ce_flags & ZEND_ACC_INTERFACE) {
-		return "implement interface ";
-	} else {
-		return "be an instance of ";
-	}
+	return ce;
 }
 
 static zend_always_inline zend_class_entry* zend_verify_arg_class_kind(const zend_arg_info *cur_arg_info)
@@ -618,31 +618,102 @@ static zend_always_inline zend_class_entry* zend_verify_arg_class_kind(const zen
 	return zend_fetch_class(cur_arg_info->class_name, (ZEND_FETCH_CLASS_AUTO | ZEND_FETCH_CLASS_NO_AUTOLOAD));
 }
 
-static ZEND_COLD void zend_verify_arg_error(const zend_function *zf, uint32_t arg_num, const char *need_msg, const char *need_kind, const char *given_msg, const char *given_kind)
+static ZEND_COLD void zend_verify_type_error_common(
+		const zend_function *zf, const zend_arg_info *arg_info,
+		const zend_class_entry *ce, zval *value,
+		const char **fname, const char **fsep, const char **fclass,
+		const char **need_msg, const char **need_kind, const char **need_or_null,
+		const char **given_msg, const char **given_kind)
 {
-	zend_execute_data *ptr = EG(current_execute_data)->prev_execute_data;
-	const char *fname = ZSTR_VAL(zf->common.function_name);
-	const char *fsep;
-	const char *fclass;
+	zend_bool is_interface = 0;
+	*fname = ZSTR_VAL(zf->common.function_name);
 
 	if (zf->common.scope) {
-		fsep =  "::";
-		fclass = ZSTR_VAL(zf->common.scope->name);
+		*fsep =  "::";
+		*fclass = ZSTR_VAL(zf->common.scope->name);
 	} else {
-		fsep =  "";
-		fclass = "";
+		*fsep =  "";
+		*fclass = "";
 	}
 
-	if (zf->common.type == ZEND_USER_FUNCTION) {
-		if (ptr && ptr->func && ZEND_USER_CODE(ptr->func->common.type)) {
-			zend_type_error("Argument %d passed to %s%s%s() must %s%s, %s%s given, called in %s on line %d",
-					arg_num, fclass, fsep, fname, need_msg, need_kind, given_msg, given_kind,
-					ZSTR_VAL(ptr->func->op_array.filename), ptr->opline->lineno);
+	switch (arg_info->type_hint) {
+		case IS_OBJECT:
+			if (ce) {
+				if (ce->ce_flags & ZEND_ACC_INTERFACE) {
+					*need_msg = "implement interface ";
+					is_interface = 1;
+				} else {
+					*need_msg = "be an instance of ";
+				}
+				*need_kind = ZSTR_VAL(ce->name);
+			} else {
+				/* We don't know whether it's a class or interface, assume it's a class */
+				*need_msg = "be an instance of ";
+				*need_kind = zf->common.type == ZEND_INTERNAL_FUNCTION
+					? ((zend_internal_arg_info *) arg_info)->class_name
+					: ZSTR_VAL(arg_info->class_name);
+			}
+			break;
+		case IS_CALLABLE:
+			*need_msg = "be callable";
+			*need_kind = "";
+			break;
+		case IS_ITERABLE:
+			*need_msg = "be iterable";
+			*need_kind = "";
+			break;
+		default:
+			*need_msg = "be of the type ";
+			*need_kind = zend_get_type_by_const(arg_info->type_hint);
+			break;
+	}
+
+	if (arg_info->allow_null) {
+		*need_or_null = is_interface ? " or be null" : " or null";
+	} else {
+		*need_or_null = "";
+	}
+
+	if (value) {
+		if (arg_info->type_hint == IS_OBJECT && Z_TYPE_P(value) == IS_OBJECT) {
+			*given_msg = "instance of ";
+			*given_kind = ZSTR_VAL(Z_OBJCE_P(value)->name);
 		} else {
-			zend_type_error("Argument %d passed to %s%s%s() must %s%s, %s%s given", arg_num, fclass, fsep, fname, need_msg, need_kind, given_msg, given_kind);
+			*given_msg = zend_zval_type_name(value);
+			*given_kind = "";
 		}
 	} else {
-		zend_type_error("Argument %d passed to %s%s%s() must %s%s, %s%s given", arg_num, fclass, fsep, fname, need_msg, need_kind, given_msg, given_kind);
+		*given_msg = "none";
+		*given_kind = "";
+	}
+}
+
+static ZEND_COLD void zend_verify_arg_error(
+		const zend_function *zf, const zend_arg_info *arg_info,
+		int arg_num, const zend_class_entry *ce, zval *value)
+{
+	zend_execute_data *ptr = EG(current_execute_data)->prev_execute_data;
+	const char *fname, *fsep, *fclass;
+	const char *need_msg, *need_kind, *need_or_null, *given_msg, *given_kind;
+
+	if (value) {
+		zend_verify_type_error_common(
+			zf, arg_info, ce, value,
+			&fname, &fsep, &fclass, &need_msg, &need_kind, &need_or_null, &given_msg, &given_kind);
+
+		if (zf->common.type == ZEND_USER_FUNCTION) {
+			if (ptr && ptr->func && ZEND_USER_CODE(ptr->func->common.type)) {
+				zend_type_error("Argument %d passed to %s%s%s() must %s%s%s, %s%s given, called in %s on line %d",
+						arg_num, fclass, fsep, fname, need_msg, need_kind, need_or_null, given_msg, given_kind,
+						ZSTR_VAL(ptr->func->op_array.filename), ptr->opline->lineno);
+			} else {
+				zend_type_error("Argument %d passed to %s%s%s() must %s%s%s, %s%s given", arg_num, fclass, fsep, fname, need_msg, need_kind, need_or_null, given_msg, given_kind);
+			}
+		} else {
+			zend_type_error("Argument %d passed to %s%s%s() must %s%s%s, %s%s given", arg_num, fclass, fsep, fname, need_msg, need_kind, need_or_null, given_msg, given_kind);
+		}
+	} else {
+		zend_missing_arg_error(ptr);
 	}
 }
 
@@ -724,11 +795,50 @@ static zend_bool zend_verify_scalar_type_hint(zend_uchar type_hint, zval *arg, z
 	return zend_verify_weak_scalar_type_hint(type_hint, arg);
 }
 
+static zend_always_inline zend_bool zend_check_internal_type(
+		const zend_function *zf, const zend_internal_arg_info *arg_info,
+		zval *arg, zend_class_entry **ce, zend_bool is_return_type)
+{
+	if (!arg_info->type_hint) {
+		return 1;
+	}
+
+	ZVAL_DEREF(arg);
+	if (EXPECTED(arg_info->type_hint == Z_TYPE_P(arg))) {
+		if (arg_info->class_name) {
+			*ce = zend_verify_internal_arg_class_kind(arg_info);
+			return *ce && instanceof_function(Z_OBJCE_P(arg), *ce);
+		}
+		return 1;
+	}
+
+	if (Z_TYPE_P(arg) == IS_NULL && arg_info->allow_null) {
+		return 1;
+	}
+
+	if (arg_info->class_name) {
+		*ce = zend_verify_internal_arg_class_kind(arg_info);
+		return 0;
+	} else if (arg_info->type_hint == IS_CALLABLE) {
+		return zend_is_callable(arg, IS_CALLABLE_CHECK_SILENT, NULL);
+	} else if (arg_info->type_hint == IS_ITERABLE) {
+		return zend_is_iterable(arg);
+	} else if (arg_info->type_hint == _IS_BOOL &&
+			   EXPECTED(Z_TYPE_P(arg) == IS_FALSE || Z_TYPE_P(arg) == IS_TRUE)) {
+		return 1;
+	} else if (is_return_type) {
+		/* Internal return types are always strict */
+		return 0;
+	} else {
+		/* Internal parameter types honor strict_types */
+		return zend_verify_scalar_type_hint(arg_info->type_hint, arg, ZEND_CALL_USES_STRICT_TYPES(EG(current_execute_data)));
+	}
+}
+
 static int zend_verify_internal_arg_type(zend_function *zf, uint32_t arg_num, zval *arg)
 {
-	zend_internal_arg_info *cur_arg_info;
-	char *need_msg, *class_name;
-	zend_class_entry *ce;
+	const zend_internal_arg_info *cur_arg_info;
+	zend_class_entry *ce = NULL;
 
 	if (EXPECTED(arg_num <= zf->internal_function.num_args)) {
 		cur_arg_info = &zf->internal_function.arg_info[arg_num-1];
@@ -738,40 +848,11 @@ static int zend_verify_internal_arg_type(zend_function *zf, uint32_t arg_num, zv
 		return 1;
 	}
 
-	if (cur_arg_info->type_hint) {
-		ZVAL_DEREF(arg);
-		if (EXPECTED(cur_arg_info->type_hint == Z_TYPE_P(arg))) {
-			if (cur_arg_info->class_name) {
-				need_msg = zend_verify_internal_arg_class_kind((zend_internal_arg_info*)cur_arg_info, &class_name, &ce);
-				if (!ce || !instanceof_function(Z_OBJCE_P(arg), ce)) {
-					zend_verify_arg_error(zf, arg_num, need_msg, class_name, "instance of ", ZSTR_VAL(Z_OBJCE_P(arg)->name));
-					return 0;
-				}
-			}
-		} else if (Z_TYPE_P(arg) != IS_NULL || !cur_arg_info->allow_null) {
-			if (cur_arg_info->class_name) {
-				need_msg = zend_verify_internal_arg_class_kind((zend_internal_arg_info*)cur_arg_info, &class_name, &ce);
-				zend_verify_arg_error(zf, arg_num, need_msg, class_name, zend_zval_type_name(arg), "");
-				return 0;
-			} else if (cur_arg_info->type_hint == IS_CALLABLE) {
-				if (!zend_is_callable(arg, IS_CALLABLE_CHECK_SILENT, NULL)) {
-					zend_verify_arg_error(zf, arg_num, "be callable", "", zend_zval_type_name(arg), "");
-					return 0;
-				}
-			} else if (cur_arg_info->type_hint == IS_ITERABLE) {
-				if (!zend_is_iterable(arg)) {
-					zend_verify_arg_error(zf, arg_num, "be iterable", "", zend_zval_type_name(arg), "");
-					return 0;
-				}
-			} else if (cur_arg_info->type_hint == _IS_BOOL &&
-			           EXPECTED(Z_TYPE_P(arg) == IS_FALSE || Z_TYPE_P(arg) == IS_TRUE)) {
-				/* pass */
-			} else if (UNEXPECTED(!zend_verify_scalar_type_hint(cur_arg_info->type_hint, arg, ZEND_CALL_USES_STRICT_TYPES(EG(current_execute_data))))) {
-				zend_verify_arg_error(zf, arg_num, "be of the type ", zend_get_type_by_const(cur_arg_info->type_hint), zend_zval_type_name(arg), "");
-				return 0;
-			}
-		}
+	if (UNEXPECTED(!zend_check_internal_type(zf, cur_arg_info, arg, &ce, 0))) {
+		zend_verify_arg_error(zf, (const zend_arg_info *) cur_arg_info, arg_num, ce, arg);
+		return 0;
 	}
+
 	return 1;
 }
 
@@ -792,10 +873,69 @@ static zend_never_inline int zend_verify_internal_arg_types(zend_function *fbc,
 	return 1;
 }
 
+static zend_always_inline zend_bool zend_check_type(
+		const zend_function *zf, const zend_arg_info *arg_info,
+		zval *arg, zend_class_entry **ce, void **cache_slot,
+		zval *default_value, zend_bool is_return_type)
+{
+	if (!arg_info->type_hint) {
+		return 1;
+	}
+
+	ZVAL_DEREF(arg);
+	if (EXPECTED(arg_info->type_hint == Z_TYPE_P(arg))) {
+		if (arg_info->class_name) {
+			if (EXPECTED(*cache_slot)) {
+				*ce = (zend_class_entry *) *cache_slot;
+			} else {
+				*ce = zend_verify_arg_class_kind(arg_info);
+				if (UNEXPECTED(!*ce)) {
+					return 0;
+				}
+				*cache_slot = (void *) *ce;
+			}
+			if (UNEXPECTED(!instanceof_function(Z_OBJCE_P(arg), *ce))) {
+				return 0;
+			}
+		}
+		return 1;
+	}
+
+	if (Z_TYPE_P(arg) == IS_NULL && (arg_info->allow_null || (default_value && is_null_constant(zf->common.scope, default_value)))) {
+		/* Null passed to nullable type */
+		return 1;
+	}
+
+	if (UNEXPECTED(arg_info->class_name)) {
+		/* This is always an error - we fetch the class name for the error message here */
+		if (EXPECTED(*cache_slot)) {
+			*ce = (zend_class_entry *) *cache_slot;
+		} else {
+			*ce = zend_verify_arg_class_kind(arg_info);
+			if (*ce) {
+				*cache_slot = (void *) *ce;
+			}
+		}
+		return 0;
+	} else if (arg_info->type_hint == IS_CALLABLE) {
+		return zend_is_callable(arg, IS_CALLABLE_CHECK_SILENT, NULL);
+	} else if (arg_info->type_hint == IS_ITERABLE) {
+		return zend_is_iterable(arg);
+	} else if (arg_info->type_hint == _IS_BOOL &&
+			   EXPECTED(Z_TYPE_P(arg) == IS_FALSE || Z_TYPE_P(arg) == IS_TRUE)) {
+		return 1;
+	} else {
+		return zend_verify_scalar_type_hint(arg_info->type_hint, arg,
+			is_return_type ? ZEND_RET_USES_STRICT_TYPES() : ZEND_ARG_USES_STRICT_TYPES());
+	}
+
+	/* Special handling for IS_VOID is not necessary (for return types),
+	 * because this case is already checked at compile-time. */
+}
+
 static zend_always_inline int zend_verify_arg_type(zend_function *zf, uint32_t arg_num, zval *arg, zval *default_value, void **cache_slot)
 {
 	zend_arg_info *cur_arg_info;
-	char *need_msg;
 	zend_class_entry *ce;
 
 	if (EXPECTED(arg_num <= zf->common.num_args)) {
@@ -806,68 +946,11 @@ static zend_always_inline int zend_verify_arg_type(zend_function *zf, uint32_t a
 		return 1;
 	}
 
-	if (cur_arg_info->type_hint) {
-		ZVAL_DEREF(arg);
-		if (EXPECTED(cur_arg_info->type_hint == Z_TYPE_P(arg))) {
-			if (cur_arg_info->class_name) {
-				if (EXPECTED(*cache_slot)) {
-					ce = (zend_class_entry*)*cache_slot;
-				} else {
-					ce = zend_verify_arg_class_kind(cur_arg_info);
-					if (UNEXPECTED(!ce)) {
-						zend_verify_arg_error(zf, arg_num, "be an instance of ", ZSTR_VAL(cur_arg_info->class_name), "instance of ", ZSTR_VAL(Z_OBJCE_P(arg)->name));
-						return 0;
-					}
-					*cache_slot = (void*)ce;
-				}
-				if (UNEXPECTED(!instanceof_function(Z_OBJCE_P(arg), ce))) {
-					need_msg =
-						(ce->ce_flags & ZEND_ACC_INTERFACE) ?
-						"implement interface " : "be an instance of ";
-					zend_verify_arg_error(zf, arg_num, need_msg, ZSTR_VAL(ce->name), "instance of ", ZSTR_VAL(Z_OBJCE_P(arg)->name));
-					return 0;
-				}
-			}
-		} else if (Z_TYPE_P(arg) != IS_NULL || !(cur_arg_info->allow_null || (default_value && is_null_constant(zf->common.scope, default_value)))) {
-			if (cur_arg_info->class_name) {
-				if (EXPECTED(*cache_slot)) {
-					ce = (zend_class_entry*)*cache_slot;
-				} else {
-					ce = zend_verify_arg_class_kind(cur_arg_info);
-					if (UNEXPECTED(!ce)) {
-						if (Z_TYPE_P(arg) == IS_OBJECT) {
-							zend_verify_arg_error(zf, arg_num, "be an instance of ", ZSTR_VAL(cur_arg_info->class_name), "instance of ", ZSTR_VAL(Z_OBJCE_P(arg)->name));
-						} else {
-							zend_verify_arg_error(zf, arg_num, "be an instance of ", ZSTR_VAL(cur_arg_info->class_name), "", zend_zval_type_name(arg));
-						}
-						return 0;
-					}
-					*cache_slot = (void*)ce;
-				}
-				need_msg =
-					(ce->ce_flags & ZEND_ACC_INTERFACE) ?
-					"implement interface " : "be an instance of ";
-				zend_verify_arg_error(zf, arg_num, need_msg, ZSTR_VAL(ce->name), zend_zval_type_name(arg), "");
-				return 0;
-			} else if (cur_arg_info->type_hint == IS_CALLABLE) {
-				if (!zend_is_callable(arg, IS_CALLABLE_CHECK_SILENT, NULL)) {
-					zend_verify_arg_error(zf, arg_num, "be callable", "", zend_zval_type_name(arg), "");
-					return 0;
-				}
-			} else if (cur_arg_info->type_hint == IS_ITERABLE) {
-				if (!zend_is_iterable(arg)) {
-					zend_verify_arg_error(zf, arg_num, "be iterable", "", zend_zval_type_name(arg), "");
-					return 0;
-				}
-			} else if (cur_arg_info->type_hint == _IS_BOOL &&
-			           EXPECTED(Z_TYPE_P(arg) == IS_FALSE || Z_TYPE_P(arg) == IS_TRUE)) {
-				/* pass */
-			} else if (UNEXPECTED(!zend_verify_scalar_type_hint(cur_arg_info->type_hint, arg, ZEND_ARG_USES_STRICT_TYPES()))) {
-				zend_verify_arg_error(zf, arg_num, "be of the type ", zend_get_type_by_const(cur_arg_info->type_hint), zend_zval_type_name(arg), "");
-				return 0;
-			}
-		}
+	if (UNEXPECTED(!zend_check_type(zf, cur_arg_info, arg, &ce, cache_slot, default_value, 0))) {
+		zend_verify_arg_error(zf, cur_arg_info, arg_num, ce, arg);
+		return 0;
 	}
+
 	return 1;
 }
 
@@ -876,7 +959,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_missing_arg_error(zend_execute_data *
 	zend_execute_data *ptr = EX(prev_execute_data);
 
 	if (ptr && ptr->func && ZEND_USER_CODE(ptr->func->common.type)) {
-		zend_throw_error(NULL, "Too few arguments to function %s%s%s(), %d passed in %s on line %d and %s %d expected",
+		zend_throw_error(zend_ce_argument_count_error, "Too few arguments to function %s%s%s(), %d passed in %s on line %d and %s %d expected",
 			EX(func)->common.scope ? ZSTR_VAL(EX(func)->common.scope->name) : "",
 			EX(func)->common.scope ? "::" : "",
 			ZSTR_VAL(EX(func)->common.function_name),
@@ -886,7 +969,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_missing_arg_error(zend_execute_data *
 			EX(func)->common.required_num_args == EX(func)->common.num_args ? "exactly" : "at least",
 			EX(func)->common.required_num_args);
 	} else {
-		zend_throw_error(NULL, "Too few arguments to function %s%s%s(), %d passed and %s %d expected",
+		zend_throw_error(zend_ce_argument_count_error, "Too few arguments to function %s%s%s(), %d passed and %s %d expected",
 			EX(func)->common.scope ? ZSTR_VAL(EX(func)->common.scope->name) : "",
 			EX(func)->common.scope ? "::" : "",
 			ZSTR_VAL(EX(func)->common.function_name),
@@ -896,41 +979,35 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_missing_arg_error(zend_execute_data *
 	}
 }
 
-static ZEND_COLD void zend_verify_return_error(const zend_function *zf, const char *need_msg, const char *need_kind, const char *returned_msg, const char *returned_kind)
+static ZEND_COLD void zend_verify_return_error(
+		const zend_function *zf, const zend_class_entry *ce, zval *value)
 {
-	const char *fname = ZSTR_VAL(zf->common.function_name);
-	const char *fsep;
-	const char *fclass;
+	const zend_arg_info *arg_info = &zf->common.arg_info[-1];
+	const char *fname, *fsep, *fclass;
+	const char *need_msg, *need_kind, *need_or_null, *given_msg, *given_kind;
 
-	if (zf->common.scope) {
-		fsep =  "::";
-		fclass = ZSTR_VAL(zf->common.scope->name);
-	} else {
-		fsep =  "";
-		fclass = "";
-	}
+	zend_verify_type_error_common(
+		zf, arg_info, ce, value,
+		&fname, &fsep, &fclass, &need_msg, &need_kind, &need_or_null, &given_msg, &given_kind); 
 
-	zend_type_error("Return value of %s%s%s() must %s%s, %s%s returned",
-		fclass, fsep, fname, need_msg, need_kind, returned_msg, returned_kind);
+	zend_type_error("Return value of %s%s%s() must %s%s%s, %s%s returned",
+		fclass, fsep, fname, need_msg, need_kind, need_or_null, given_msg, given_kind);
 }
 
 #if ZEND_DEBUG
-static ZEND_COLD void zend_verify_internal_return_error(const zend_function *zf, const char *need_msg, const char *need_kind, const char *returned_msg, const char *returned_kind)
+static ZEND_COLD void zend_verify_internal_return_error(
+		const zend_function *zf, const zend_class_entry *ce, zval *value)
 {
-	const char *fname = ZSTR_VAL(zf->common.function_name);
-	const char *fsep;
-	const char *fclass;
+	const zend_arg_info *arg_info = &zf->common.arg_info[-1];
+	const char *fname, *fsep, *fclass;
+	const char *need_msg, *need_kind, *need_or_null, *given_msg, *given_kind;
 
-	if (zf->common.scope) {
-		fsep =  "::";
-		fclass = ZSTR_VAL(zf->common.scope->name);
-	} else {
-		fsep =  "";
-		fclass = "";
-	}
+	zend_verify_type_error_common(
+		zf, arg_info, ce, value,
+		&fname, &fsep, &fclass, &need_msg, &need_kind, &need_or_null, &given_msg, &given_kind); 
 
-	zend_error_noreturn(E_CORE_ERROR, "Return value of %s%s%s() must %s%s, %s%s returned",
-		fclass, fsep, fname, need_msg, need_kind, returned_msg, returned_kind);
+	zend_error_noreturn(E_CORE_ERROR, "Return value of %s%s%s() must %s%s%s, %s%s returned",
+		fclass, fsep, fname, need_msg, need_kind, need_or_null, given_msg, given_kind);
 }
 
 static ZEND_COLD void zend_verify_void_return_error(const zend_function *zf, const char *returned_msg, const char *returned_kind)
@@ -953,46 +1030,19 @@ static ZEND_COLD void zend_verify_void_return_error(const zend_function *zf, con
 
 static int zend_verify_internal_return_type(zend_function *zf, zval *ret)
 {
-	zend_arg_info *ret_info = zf->common.arg_info - 1;
-	char *need_msg, *class_name;
-	zend_class_entry *ce;
+	zend_internal_arg_info *ret_info = zf->internal_function.arg_info - 1;
+	zend_class_entry *ce = NULL;
 
-
-	if (ret_info->type_hint) {
-		if (EXPECTED(ret_info->type_hint == Z_TYPE_P(ret))) {
-			if (ret_info->class_name) {
-				need_msg = zend_verify_internal_arg_class_kind((zend_internal_arg_info *)ret_info, &class_name, &ce);
-				if (!ce || !instanceof_function(Z_OBJCE_P(ret), ce)) {
-					zend_verify_internal_return_error(zf, need_msg, class_name, "instance of ", ZSTR_VAL(Z_OBJCE_P(ret)->name));
-					return 0;
-				}
-			}
-		} else if (Z_TYPE_P(ret) != IS_NULL || !ret_info->allow_null) {
-			if (ret_info->class_name) {
-				need_msg = zend_verify_internal_arg_class_kind((zend_internal_arg_info *)ret_info, &class_name, &ce);
-				zend_verify_internal_return_error(zf, need_msg, class_name, zend_zval_type_name(ret), "");
-			} else if (ret_info->type_hint == IS_CALLABLE) {
-				if (!zend_is_callable(ret, IS_CALLABLE_CHECK_SILENT, NULL) && (Z_TYPE_P(ret) != IS_NULL || !ret_info->allow_null)) {
-					zend_verify_internal_return_error(zf, "be callable", "", zend_zval_type_name(ret), "");
-					return 0;
-				}
-			} else if (ret_info->type_hint == IS_ITERABLE) {
-				if (!zend_is_iterable(ret) && (Z_TYPE_P(ret) != IS_NULL || !ret_info->allow_null)) {
-					zend_verify_internal_return_error(zf, "be iterable", "", zend_zval_type_name(ret), "");
-					return 0;
-				}
-			} else if (ret_info->type_hint == _IS_BOOL &&
-			           EXPECTED(Z_TYPE_P(ret) == IS_FALSE || Z_TYPE_P(ret) == IS_TRUE)) {
-				/* pass */
-			} else if (ret_info->type_hint == IS_VOID) {
-				zend_verify_void_return_error(zf, zend_zval_type_name(ret), "");
-			} else {
-				/* Use strict check to verify return value of internal function */
-				zend_verify_internal_return_error(zf, "be of the type ", zend_get_type_by_const(ret_info->type_hint), zend_zval_type_name(ret), "");
-				return 0;
-			}
-		}
+	if (UNEXPECTED(ret_info->type_hint == IS_VOID && Z_TYPE_P(ret) != IS_NULL)) {
+		zend_verify_void_return_error(zf, zend_zval_type_name(ret), "");
+		return 0;
 	}
+
+	if (UNEXPECTED(!zend_check_internal_type(zf, ret_info, ret, &ce, 1))) {
+		zend_verify_internal_return_error(zf, ce, ret);
+		return 0;
+	}
+
 	return 1;
 }
 #endif
@@ -1000,99 +1050,30 @@ static int zend_verify_internal_return_type(zend_function *zf, zval *ret)
 static zend_always_inline void zend_verify_return_type(zend_function *zf, zval *ret, void **cache_slot)
 {
 	zend_arg_info *ret_info = zf->common.arg_info - 1;
-	char *need_msg;
-	zend_class_entry *ce;
-
-	if (ret_info->type_hint) {
-		if (EXPECTED(ret_info->type_hint == Z_TYPE_P(ret))) {
-			if (ret_info->class_name) {
-				if (EXPECTED(*cache_slot)) {
-					ce = (zend_class_entry*)*cache_slot;
-				} else {
-					ce = zend_verify_arg_class_kind(ret_info);
-					if (UNEXPECTED(!ce)) {
-						zend_verify_return_error(zf, "be an instance of ", ZSTR_VAL(ret_info->class_name), "instance of ", ZSTR_VAL(Z_OBJCE_P(ret)->name));
-						return;
-					}
-					*cache_slot = (void*)ce;
-				}
-				if (UNEXPECTED(!instanceof_function(Z_OBJCE_P(ret), ce))) {
-					need_msg =
-						(ce->ce_flags & ZEND_ACC_INTERFACE) ?
-						"implement interface " : "be an instance of ";
-					zend_verify_return_error(zf, need_msg, ZSTR_VAL(ce->name), "instance of ", ZSTR_VAL(Z_OBJCE_P(ret)->name));
-				}
-			}
-		} else if (Z_TYPE_P(ret) != IS_NULL || !ret_info->allow_null) {
-			if (ret_info->class_name) {
-				if (EXPECTED(*cache_slot)) {
-					ce = (zend_class_entry*)*cache_slot;
-				} else {
-					ce = zend_verify_arg_class_kind(ret_info);
-					if (UNEXPECTED(!ce)) {
-						zend_verify_return_error(zf, "be an instance of ", ZSTR_VAL(ret_info->class_name), zend_zval_type_name(ret), "");
-						return;
-					}
-					*cache_slot = (void*)ce;
-				}
-				need_msg =
-					(ce->ce_flags & ZEND_ACC_INTERFACE) ?
-					"implement interface " : "be an instance of ";
-				zend_verify_return_error(zf, need_msg, ZSTR_VAL(ce->name), zend_zval_type_name(ret), "");
-			} else if (ret_info->type_hint == IS_CALLABLE) {
-				if (!zend_is_callable(ret, IS_CALLABLE_CHECK_SILENT, NULL)) {
-					zend_verify_return_error(zf, "be callable", "", zend_zval_type_name(ret), "");
-				}
-			} else if (ret_info->type_hint == IS_ITERABLE) {
-				if (!zend_is_iterable(ret)) {
-					zend_verify_return_error(zf, "be iterable", "", zend_zval_type_name(ret), "");
-				}
-			} else if (ret_info->type_hint == _IS_BOOL &&
-			           EXPECTED(Z_TYPE_P(ret) == IS_FALSE || Z_TYPE_P(ret) == IS_TRUE)) {
-				/* pass */
-			/* There would be a check here for the IS_VOID type hint, which
-			 * would trigger an error because a value had been returned.
-			 * However, zend_compile.c already does a compile-time check
-			 * that bans `return ...;` within a void function. Thus we can skip
-			 * this part of the runtime check for non-internal functions.
-			 */
-			} else if (UNEXPECTED(!zend_verify_scalar_type_hint(ret_info->type_hint, ret, ZEND_RET_USES_STRICT_TYPES()))) {
-				zend_verify_return_error(zf, "be of the type ", zend_get_type_by_const(ret_info->type_hint), zend_zval_type_name(ret), "");
-			}
-		}
+	zend_class_entry *ce = NULL;
+	
+	if (UNEXPECTED(!zend_check_type(zf, ret_info, ret, &ce, cache_slot, NULL, 1))) {
+		zend_verify_return_error(zf, ce, ret);
 	}
 }
 
 static ZEND_COLD int zend_verify_missing_return_type(zend_function *zf, void **cache_slot)
 {
 	zend_arg_info *ret_info = zf->common.arg_info - 1;
-	char *need_msg;
-	zend_class_entry *ce;
 
-	if (ret_info->type_hint && EXPECTED(ret_info->type_hint != IS_VOID)) {
+	if (ret_info->type_hint && UNEXPECTED(ret_info->type_hint != IS_VOID)) {
+		zend_class_entry *ce = NULL;
 		if (ret_info->class_name) {
 			if (EXPECTED(*cache_slot)) {
-				ce = (zend_class_entry*)*cache_slot;
+				ce = (zend_class_entry*) *cache_slot;
 			} else {
 				ce = zend_verify_arg_class_kind(ret_info);
-				if (UNEXPECTED(!ce)) {
-					zend_verify_return_error(zf, "be an instance of ", ZSTR_VAL(ret_info->class_name), "none", "");
-					return 0;
+				if (ce) {
+					*cache_slot = (void*)ce;
 				}
-				*cache_slot = (void*)ce;
 			}
-			need_msg =
-				(ce->ce_flags & ZEND_ACC_INTERFACE) ?
-				"implement interface " : "be an instance of ";
-			zend_verify_return_error(zf, need_msg, ZSTR_VAL(ce->name), "none", "");
-			return 0;
-		} else if (ret_info->type_hint == IS_CALLABLE) {
-			zend_verify_return_error(zf, "be callable", "", "none", "");
-		} else if (ret_info->type_hint == IS_ITERABLE) {
-			zend_verify_return_error(zf, "be iterable", "", "none", "");
-		} else {
-			zend_verify_return_error(zf, "be of the type ", zend_get_type_by_const(ret_info->type_hint), "none", "");
 		}
+		zend_verify_return_error(zf, ce, NULL);
 		return 0;
 	}
 	return 1;
@@ -1353,6 +1334,7 @@ static zend_never_inline void zend_assign_to_string_offset(zval *str, zval *dim,
 		zend_string_release(old_str);
 	} else {
 		SEPARATE_STRING(str);
+		zend_string_forget_hash_val(Z_STR_P(str));
 	}
 
 	Z_STRVAL_P(str)[offset] = c;

Zend/zend_execute_API.c

@@ -597,26 +597,24 @@ ZEND_API int zval_update_constant_ex(zval *p, zend_class_entry *scope) /* {{{ */
 				RESET_CONSTANT_VISITED(p);
 				return FAILURE;
 			} else {
-				zend_string *save = Z_STR_P(p);
-				char *slash;
-				size_t actual_len = Z_STRLEN_P(p);
-				if ((Z_CONST_FLAGS_P(p) & IS_CONSTANT_UNQUALIFIED) && (slash = (char *)zend_memrchr(actual, '\\', actual_len))) {
-					actual = slash + 1;
-					actual_len -= (actual - Z_STRVAL_P(p));
-					if (inline_change) {
-						zend_string *s = zend_string_init(actual, actual_len, 0);
-						Z_STR_P(p) = s;
-						Z_TYPE_FLAGS_P(p) = IS_TYPE_REFCOUNTED | IS_TYPE_COPYABLE;
-					}
-				}
 				if ((Z_CONST_FLAGS_P(p) & IS_CONSTANT_UNQUALIFIED) == 0) {
-					zend_throw_error(NULL, "Undefined constant '%s'", ZSTR_VAL(save));
-					if (inline_change) {
-						zend_string_release(save);
-					}
+					zend_throw_error(NULL, "Undefined constant '%s'", Z_STRVAL_P(p));
 					RESET_CONSTANT_VISITED(p);
 					return FAILURE;
 				} else {
+					zend_string *save = Z_STR_P(p);
+					size_t actual_len = Z_STRLEN_P(p);
+					char *slash = (char *) zend_memrchr(actual, '\\', actual_len);
+					if (slash) {
+						actual = slash + 1;
+						actual_len -= (actual - Z_STRVAL_P(p));
+						if (inline_change) {
+							zend_string *s = zend_string_init(actual, actual_len, 0);
+							Z_STR_P(p) = s;
+							Z_TYPE_FLAGS_P(p) = IS_TYPE_REFCOUNTED | IS_TYPE_COPYABLE;
+						}
+					}
+
 					zend_error(E_NOTICE, "Use of undefined constant %s - assumed '%s'",  actual,  actual);
 					if (!inline_change) {
 						ZVAL_STRINGL(p, actual, actual_len);
@@ -790,41 +788,29 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache) /
 
 		if (ARG_SHOULD_BE_SENT_BY_REF(func, i + 1)) {
 			if (UNEXPECTED(!Z_ISREF_P(arg))) {
-				if (fci->no_separation &&
-					!ARG_MAY_BE_SENT_BY_REF(func, i + 1)) {
-					if (i) {
-						/* hack to clean up the stack */
-						ZEND_CALL_NUM_ARGS(call) = i;
-						zend_vm_stack_free_args(call);
-					}
-					zend_vm_stack_free_call_frame(call);
-
-					zend_error(E_WARNING, "Parameter %d to %s%s%s() expected to be a reference, value given",
-						i+1,
+				if (!fci->no_separation) {
+					/* Separation is enabled -- create a ref */
+					ZVAL_NEW_REF(arg, arg);
+				} else if (!ARG_MAY_BE_SENT_BY_REF(func, i + 1)) {
+					/* By-value send is not allowed -- emit a warning,
+					 * but still perform the call with a by-value send. */
+					zend_error(E_WARNING,
+						"Parameter %d to %s%s%s() expected to be a reference, value given", i+1,
 						func->common.scope ? ZSTR_VAL(func->common.scope->name) : "",
 						func->common.scope ? "::" : "",
 						ZSTR_VAL(func->common.function_name));
-					if (EG(current_execute_data) == &dummy_execute_data) {
-						EG(current_execute_data) = dummy_execute_data.prev_execute_data;
-					}
-					return FAILURE;
 				}
-
-				ZVAL_NEW_REF(arg, arg);
 			}
-			Z_ADDREF_P(arg);
 		} else {
 			if (Z_ISREF_P(arg) &&
 			    !(func->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE)) {
 				/* don't separate references for __call */
 				arg = Z_REFVAL_P(arg);
 			}
-			if (Z_OPT_REFCOUNTED_P(arg)) {
-				Z_ADDREF_P(arg);
-			}
 		}
+
 		param = ZEND_CALL_ARG(call, i+1);
-		ZVAL_COPY_VALUE(param, arg);
+		ZVAL_COPY(param, arg);
 	}
 
 	if (UNEXPECTED(func->op_array.fn_flags & ZEND_ACC_CLOSURE)) {

Zend/zend_gc.c

@@ -1144,6 +1144,7 @@ ZEND_API int zend_gc_collect_cycles(void)
 
 				if (EG(objects_store).object_buckets &&
 				    IS_OBJ_VALID(EG(objects_store).object_buckets[obj->handle])) {
+					EG(objects_store).object_buckets[obj->handle] = SET_OBJ_INVALID(obj);
 					GC_TYPE(obj) = IS_NULL;
 					if (!(GC_FLAGS(obj) & IS_OBJ_FREE_CALLED)) {
 						GC_FLAGS(obj) |= IS_OBJ_FREE_CALLED;

Zend/zend_generators.c

@@ -635,6 +635,16 @@ ZEND_API zend_generator *zend_generator_update_current(zend_generator *generator
 						zend_throw_exception(zend_ce_ClosedGeneratorException, "Generator yielded from aborted, no return value available", 0);
 
 						EG(current_execute_data) = original_execute_data;
+
+						if (!((old_root ? old_root : generator)->flags & ZEND_GENERATOR_CURRENTLY_RUNNING)) {
+							leaf->node.ptr.root = root;
+							root->node.parent = NULL;
+							if (old_root) {
+								OBJ_RELEASE(&old_root->std);
+							}
+							zend_generator_resume(leaf);
+							return leaf->node.ptr.root; /* this may be updated during zend_generator_resume! */
+						}
 					} else {
 						zval_ptr_dtor(&root->value);
 						ZVAL_COPY(&root->value, &root->node.parent->value);
@@ -970,15 +980,9 @@ ZEND_METHOD(Generator, send)
 	zval *value;
 	zend_generator *generator, *root;
 
-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "z", &value) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(1, 1)
 		Z_PARAM_ZVAL(value)
 	ZEND_PARSE_PARAMETERS_END();
-#endif
 
 	generator = (zend_generator *) Z_OBJ_P(getThis());
 
@@ -1014,15 +1018,9 @@ ZEND_METHOD(Generator, throw)
 	zval *exception, exception_copy;
 	zend_generator *generator;
 
-#ifndef FAST_ZPP
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "z", &exception) == FAILURE) {
-		return;
-	}
-#else
 	ZEND_PARSE_PARAMETERS_START(1, 1)
 		Z_PARAM_ZVAL(exception)
 	ZEND_PARSE_PARAMETERS_END();
-#endif
 
 	ZVAL_DUP(&exception_copy, exception);
 

Zend/zend_globals.h

@@ -292,7 +292,8 @@ struct _zend_php_scanner_globals {
 	int scanned_string_len;
 
 	/* hooks */
-	void (* on_event)(zend_php_scanner_event event, int token, int line);
+	void (*on_event)(zend_php_scanner_event event, int token, int line, void *context);
+	void *on_event_context;
 };
 
 #endif /* ZEND_GLOBALS_H */

Zend/zend_hash.c

@@ -2444,7 +2444,6 @@ ZEND_API int ZEND_FASTCALL _zend_handle_numeric_str_ex(const char *key, size_t l
 	register const char *tmp = key;
 
 	const char *end = key + length;
-	ZEND_ASSERT(*end == '\0');
 
 	if (*tmp == '-') {
 		tmp++;

Zend/zend_ini_parser.y

@@ -260,7 +260,7 @@ ZEND_API int zend_parse_ini_string(char *str, zend_bool unbuffered_errors, int s
 %}
 
 %expect 0
-%pure_parser
+%pure-parser
 
 %token TC_SECTION
 %token TC_RAW

Zend/zend_language_parser.y

@@ -43,7 +43,7 @@ static YYSIZE_T zend_yytnamerr(char*, const char*);
 
 %}
 
-%pure_parser
+%pure-parser
 %expect 0
 
 %code requires {

Zend/zend_language_scanner.h

@@ -51,7 +51,8 @@ typedef struct _zend_lex_state {
 	const zend_encoding *script_encoding;
 
 	/* hooks */
-	void (* on_event)(zend_php_scanner_event event, int token, int line);
+	void (*on_event)(zend_php_scanner_event event, int token, int line, void *context);
+	void *on_event_context;
 
 	zend_ast *ast;
 	zend_arena *ast_arena;

Zend/zend_language_scanner.l

@@ -226,6 +226,7 @@ ZEND_API void zend_save_lexical_state(zend_lex_state *lex_state)
 	lex_state->script_encoding = SCNG(script_encoding);
 
 	lex_state->on_event = SCNG(on_event);
+	lex_state->on_event_context = SCNG(on_event_context);
 
 	lex_state->ast = CG(ast);
 	lex_state->ast_arena = CG(ast_arena);
@@ -265,6 +266,7 @@ ZEND_API void zend_restore_lexical_state(zend_lex_state *lex_state)
 	SCNG(script_encoding) = lex_state->script_encoding;
 
 	SCNG(on_event) = lex_state->on_event;
+	SCNG(on_event_context) = lex_state->on_event_context;
 
 	CG(ast) = lex_state->ast;
 	CG(ast_arena) = lex_state->ast_arena;
@@ -284,7 +286,9 @@ ZEND_API void zend_destroy_file_handle(zend_file_handle *file_handle)
 
 ZEND_API void zend_lex_tstring(zval *zv)
 {
-	if (SCNG(on_event)) SCNG(on_event)(ON_FEEDBACK, T_STRING, 0);
+	if (SCNG(on_event)) {
+		SCNG(on_event)(ON_FEEDBACK, T_STRING, 0, SCNG(on_event_context));
+	}
 
 	ZVAL_STRINGL(zv, (char*)SCNG(yy_text), SCNG(yy_leng));
 }
@@ -1082,7 +1086,9 @@ static int zend_scan_escape_string(zval *zendlval, char *str, int len, char quot
 
 static zend_always_inline int emit_token(int token, int token_line)
 {
-	if(SCNG(on_event)) SCNG(on_event)(ON_TOKEN, token, token_line);
+	if (SCNG(on_event)) {
+		SCNG(on_event)(ON_TOKEN, token, token_line, SCNG(on_event_context));
+	}
 
 	return token;
 }

Zend/zend_object_handlers.c

@@ -182,6 +182,7 @@ ZEND_API HashTable *zend_std_get_debug_info(zval *object, int *is_temp) /* {{{ *
 		return ht;
 	}
 
+	zend_clear_exception();
 	zend_error_noreturn(E_ERROR, ZEND_DEBUGINFO_FUNC_NAME "() must return an array");
 
 	return NULL; /* Compilers are dumb and don't understand that noreturn means that the function does NOT need a return value... */
@@ -200,12 +201,8 @@ static void zend_std_call_getter(zval *object, zval *member, zval *retval) /* {{
 
 	   it should return whether the call was successful or not
 	*/
-	if (Z_REFCOUNTED_P(member)) Z_ADDREF_P(member);
-
 	zend_call_method_with_1_params(object, ce, &ce->__get, ZEND_GET_FUNC_NAME, retval, member);
 
-	zval_ptr_dtor(member);
-
 	EG(fake_scope) = orig_fake_scope;
 }
 /* }}} */
@@ -219,9 +216,6 @@ static int zend_std_call_setter(zval *object, zval *member, zval *value) /* {{{
 
 	EG(fake_scope) = NULL;
 
-	if (Z_REFCOUNTED_P(member)) Z_ADDREF_P(member);
-	if (Z_REFCOUNTED_P(value)) Z_ADDREF_P(value);
-
 	/* __set handler is called with two arguments:
 	     property name
 	     value to be set
@@ -230,9 +224,6 @@ static int zend_std_call_setter(zval *object, zval *member, zval *value) /* {{{
 	*/
 	zend_call_method_with_2_params(object, ce, &ce->__set, ZEND_SET_FUNC_NAME, &retval, member, value);
 
-	zval_ptr_dtor(member);
-	zval_ptr_dtor(value);
-
 	if (Z_TYPE(retval) != IS_UNDEF) {
 		result = i_zend_is_true(&retval) ? SUCCESS : FAILURE;
 		zval_ptr_dtor(&retval);

Zend/zend_virtual_cwd.c

@@ -299,8 +299,8 @@ CWD_API int php_sys_stat_ex(const char *path, zend_stat_t *buf, int lstat) /* {{
 	WIN32_FILE_ATTRIBUTE_DATA data;
 	LARGE_INTEGER t;
 	const size_t path_len = strlen(path);
-	ALLOCA_FLAG(use_heap_large);
 	wchar_t *pathw = php_win32_ioutil_any_to_w(path);
+	ALLOCA_FLAG(use_heap_large)
 
 	if (!pathw) {
 		return -1;
@@ -328,32 +328,19 @@ CWD_API int php_sys_stat_ex(const char *path, zend_stat_t *buf, int lstat) /* {{
 		buf->st_dev = buf->st_rdev = 0;
 	} else {
 		wchar_t cur_path[MAXPATHLEN+1];
-		DWORD len = sizeof(cur_path);
-		wchar_t *tmp = cur_path;
 
-		while(1) {
-			DWORD r = GetCurrentDirectoryW(len, tmp);
-			if (r < len) {
-				if (tmp[1] == L':') {
-					if (pathw[0] >= L'A' && pathw[0] <= L'Z') {
-						buf->st_dev = buf->st_rdev = pathw[0] - L'A';
-					} else {
-						buf->st_dev = buf->st_rdev = pathw[0] - L'a';
-					}
+		if (NULL != _wgetcwd(cur_path, sizeof(cur_path)/sizeof(wchar_t))) {
+			if (cur_path[1] == L':') {
+				if (pathw[0] >= L'A' && pathw[0] <= L'Z') {
+					buf->st_dev = buf->st_rdev = pathw[0] - L'A';
 				} else {
-					buf->st_dev = buf->st_rdev = -1;
+					buf->st_dev = buf->st_rdev = pathw[0] - L'a';
 				}
-				break;
-			} else if (!r) {
-				buf->st_dev = buf->st_rdev = -1;
-				break;
 			} else {
-				len = r+1;
-				tmp = (wchar_t*)malloc(len*sizeof(wchar_t));
+				buf->st_dev = buf->st_rdev = -1;
 			}
-		}
-		if (tmp != cur_path) {
-			free(tmp);
+		} else {
+			buf->st_dev = buf->st_rdev = -1;
 		}
 	}
 
@@ -934,7 +921,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 			wchar_t * reparsetarget;
 			BOOL isVolume = FALSE;
 			char *printname = NULL, *substitutename = NULL;
-			int printname_len, substitutename_len;
+			int substitutename_len;
 			int substitutename_off = 0;
 
 			if(++(*ll) > LINK_MAX) {
@@ -969,7 +956,6 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 
 			if(pbuffer->ReparseTag == IO_REPARSE_TAG_SYMLINK) {
 				reparsetarget = pbuffer->SymbolicLinkReparseBuffer.ReparseTarget;
-				printname_len = pbuffer->MountPointReparseBuffer.PrintNameLength / sizeof(WCHAR);
 				isabsolute = (pbuffer->SymbolicLinkReparseBuffer.Flags == 0) ? 1 : 0;
 				printname = php_win32_ioutil_w_to_any(reparsetarget + pbuffer->MountPointReparseBuffer.PrintNameOffset  / sizeof(WCHAR));
 				if (!printname) {
@@ -992,7 +978,6 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 			else if(pbuffer->ReparseTag == IO_REPARSE_TAG_MOUNT_POINT) {
 				isabsolute = 1;
 				reparsetarget = pbuffer->MountPointReparseBuffer.ReparseTarget;
-				printname_len = pbuffer->MountPointReparseBuffer.PrintNameLength / sizeof(WCHAR);
 				printname = php_win32_ioutil_w_to_any(reparsetarget + pbuffer->MountPointReparseBuffer.PrintNameOffset  / sizeof(WCHAR));
 				if (!printname) {
 					free_alloca(pbuffer, use_heap_large);
@@ -1406,6 +1391,7 @@ verify:
 
 		tmp = erealloc(state->cwd, state->cwd_length+1);
 		if (tmp == NULL) {
+			CWD_STATE_FREE(&old_state);
 #if VIRTUAL_CWD_DEBUG
 			fprintf (stderr, "Out of memory\n");
 #endif
@@ -1939,7 +1925,7 @@ CWD_API FILE *virtual_popen(const char *command, const char *type) /* {{{ */
 #else /* Unix */
 CWD_API FILE *virtual_popen(const char *command, const char *type) /* {{{ */
 {
-	int command_length;
+	size_t command_length;
 	int dir_length, extra = 0;
 	char *command_line;
 	char *ptr, *dir;

Zend/zend_vm_def.h

@@ -216,9 +216,22 @@ ZEND_VM_HANDLER(6, ZEND_SL, CONST|TMPVAR|CV, CONST|TMPVAR|CV)
 	zend_free_op free_op1, free_op2;
 	zval *op1, *op2;
 
+	op1 = GET_OP1_ZVAL_PTR_UNDEF(BP_VAR_R);
+	op2 = GET_OP2_ZVAL_PTR_UNDEF(BP_VAR_R);
+	if (EXPECTED(Z_TYPE_INFO_P(op1) == IS_LONG)
+			&& EXPECTED(Z_TYPE_INFO_P(op2) == IS_LONG)
+			&& EXPECTED((zend_ulong)Z_LVAL_P(op2) < SIZEOF_ZEND_LONG * 8)) {
+		ZVAL_LONG(EX_VAR(opline->result.var), Z_LVAL_P(op1) << Z_LVAL_P(op2));
+		ZEND_VM_NEXT_OPCODE();
+	}
+
 	SAVE_OPLINE();
-	op1 = GET_OP1_ZVAL_PTR(BP_VAR_R);
-	op2 = GET_OP2_ZVAL_PTR(BP_VAR_R);
+	if (OP1_TYPE == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(op1) == IS_UNDEF)) {
+		op1 = GET_OP1_UNDEF_CV(op1, BP_VAR_R);
+	}
+	if (OP2_TYPE == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(op2) == IS_UNDEF)) {
+		op2 = GET_OP2_UNDEF_CV(op2, BP_VAR_R);
+	}
 	shift_left_function(EX_VAR(opline->result.var), op1, op2);
 	FREE_OP1();
 	FREE_OP2();
@@ -231,9 +244,22 @@ ZEND_VM_HANDLER(7, ZEND_SR, CONST|TMPVAR|CV, CONST|TMPVAR|CV)
 	zend_free_op free_op1, free_op2;
 	zval *op1, *op2;
 
+	op1 = GET_OP1_ZVAL_PTR_UNDEF(BP_VAR_R);
+	op2 = GET_OP2_ZVAL_PTR_UNDEF(BP_VAR_R);
+	if (EXPECTED(Z_TYPE_INFO_P(op1) == IS_LONG)
+			&& EXPECTED(Z_TYPE_INFO_P(op2) == IS_LONG)
+			&& EXPECTED((zend_ulong)Z_LVAL_P(op2) < SIZEOF_ZEND_LONG * 8)) {
+		ZVAL_LONG(EX_VAR(opline->result.var), Z_LVAL_P(op1) >> Z_LVAL_P(op2));
+		ZEND_VM_NEXT_OPCODE();
+	}
+
 	SAVE_OPLINE();
-	op1 = GET_OP1_ZVAL_PTR(BP_VAR_R);
-	op2 = GET_OP2_ZVAL_PTR(BP_VAR_R);
+	if (OP1_TYPE == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(op1) == IS_UNDEF)) {
+		op1 = GET_OP1_UNDEF_CV(op1, BP_VAR_R);
+	}
+	if (OP2_TYPE == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(op2) == IS_UNDEF)) {
+		op2 = GET_OP2_UNDEF_CV(op2, BP_VAR_R);
+	}
 	shift_right_function(EX_VAR(opline->result.var), op1, op2);
 	FREE_OP1();
 	FREE_OP2();
@@ -608,9 +634,21 @@ ZEND_VM_HANDLER(9, ZEND_BW_OR, CONST|TMPVAR|CV, CONST|TMPVAR|CV)
 	zend_free_op free_op1, free_op2;
 	zval *op1, *op2;
 
+	op1 = GET_OP1_ZVAL_PTR_UNDEF(BP_VAR_R);
+	op2 = GET_OP2_ZVAL_PTR_UNDEF(BP_VAR_R);
+	if (EXPECTED(Z_TYPE_INFO_P(op1) == IS_LONG)
+			&& EXPECTED(Z_TYPE_INFO_P(op2) == IS_LONG)) {
+		ZVAL_LONG(EX_VAR(opline->result.var), Z_LVAL_P(op1) | Z_LVAL_P(op2));
+		ZEND_VM_NEXT_OPCODE();
+	}
+
 	SAVE_OPLINE();
-	op1 = GET_OP1_ZVAL_PTR(BP_VAR_R);
-	op2 = GET_OP2_ZVAL_PTR(BP_VAR_R);
+	if (OP1_TYPE == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(op1) == IS_UNDEF)) {
+		op1 = GET_OP1_UNDEF_CV(op1, BP_VAR_R);
+	}
+	if (OP2_TYPE == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(op2) == IS_UNDEF)) {
+		op2 = GET_OP2_UNDEF_CV(op2, BP_VAR_R);
+	}
 	bitwise_or_function(EX_VAR(opline->result.var), op1, op2);
 	FREE_OP1();
 	FREE_OP2();
@@ -623,9 +661,21 @@ ZEND_VM_HANDLER(10, ZEND_BW_AND, CONST|TMPVAR|CV, CONST|TMPVAR|CV)
 	zend_free_op free_op1, free_op2;
 	zval *op1, *op2;
 
+	op1 = GET_OP1_ZVAL_PTR_UNDEF(BP_VAR_R);
+	op2 = GET_OP2_ZVAL_PTR_UNDEF(BP_VAR_R);
+	if (EXPECTED(Z_TYPE_INFO_P(op1) == IS_LONG)
+			&& EXPECTED(Z_TYPE_INFO_P(op2) == IS_LONG)) {
+		ZVAL_LONG(EX_VAR(opline->result.var), Z_LVAL_P(op1) & Z_LVAL_P(op2));
+		ZEND_VM_NEXT_OPCODE();
+	}
+
 	SAVE_OPLINE();
-	op1 = GET_OP1_ZVAL_PTR(BP_VAR_R);
-	op2 = GET_OP2_ZVAL_PTR(BP_VAR_R);
+	if (OP1_TYPE == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(op1) == IS_UNDEF)) {
+		op1 = GET_OP1_UNDEF_CV(op1, BP_VAR_R);
+	}
+	if (OP2_TYPE == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(op2) == IS_UNDEF)) {
+		op2 = GET_OP2_UNDEF_CV(op2, BP_VAR_R);
+	}
 	bitwise_and_function(EX_VAR(opline->result.var), op1, op2);
 	FREE_OP1();
 	FREE_OP2();
@@ -638,9 +688,21 @@ ZEND_VM_HANDLER(11, ZEND_BW_XOR, CONST|TMPVAR|CV, CONST|TMPVAR|CV)
 	zend_free_op free_op1, free_op2;
 	zval *op1, *op2;
 
+	op1 = GET_OP1_ZVAL_PTR_UNDEF(BP_VAR_R);
+	op2 = GET_OP2_ZVAL_PTR_UNDEF(BP_VAR_R);
+	if (EXPECTED(Z_TYPE_INFO_P(op1) == IS_LONG)
+			&& EXPECTED(Z_TYPE_INFO_P(op2) == IS_LONG)) {
+		ZVAL_LONG(EX_VAR(opline->result.var), Z_LVAL_P(op1) ^ Z_LVAL_P(op2));
+		ZEND_VM_NEXT_OPCODE();
+	}
+
 	SAVE_OPLINE();
-	op1 = GET_OP1_ZVAL_PTR(BP_VAR_R);
-	op2 = GET_OP2_ZVAL_PTR(BP_VAR_R);
+	if (OP1_TYPE == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(op1) == IS_UNDEF)) {
+		op1 = GET_OP1_UNDEF_CV(op1, BP_VAR_R);
+	}
+	if (OP2_TYPE == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(op2) == IS_UNDEF)) {
+		op2 = GET_OP2_UNDEF_CV(op2, BP_VAR_R);
+	}
 	bitwise_xor_function(EX_VAR(opline->result.var), op1, op2);
 	FREE_OP1();
 	FREE_OP2();
@@ -4626,23 +4688,15 @@ ZEND_VM_C_LABEL(send_array):
 			if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->func, arg_num)) {
 				if (UNEXPECTED(!Z_ISREF_P(arg))) {
 					if (!ARG_MAY_BE_SENT_BY_REF(EX(call)->func, arg_num)) {
-
-						zend_error(E_WARNING, "Parameter %d to %s%s%s() expected to be a reference, value given",
+						/* By-value send is not allowed -- emit a warning,
+						 * but still perform the call. */
+						zend_error(E_WARNING,
+							"Parameter %d to %s%s%s() expected to be a reference, value given",
 							arg_num,
 							EX(call)->func->common.scope ? ZSTR_VAL(EX(call)->func->common.scope->name) : "",
 							EX(call)->func->common.scope ? "::" : "",
 							ZSTR_VAL(EX(call)->func->common.function_name));
 
-						if (ZEND_CALL_INFO(EX(call)) & ZEND_CALL_CLOSURE) {
-							OBJ_RELEASE((zend_object*)EX(call)->func->common.prototype);
-						}
-						if (Z_TYPE(EX(call)->This) == IS_OBJECT) {
-							OBJ_RELEASE(Z_OBJ(EX(call)->This));
-						}
-						EX(call)->func = (zend_function*)&zend_pass_function;
-						Z_OBJ(EX(call)->This) = NULL;
-						ZEND_SET_CALL_INFO(EX(call), 0, ZEND_CALL_INFO(EX(call)) & ~ZEND_CALL_RELEASE_THIS);
-						break;
 					}
 				}
 			} else {
@@ -4673,25 +4727,12 @@ ZEND_VM_HANDLER(120, ZEND_SEND_USER, VAR|CV, NUM)
 	param = ZEND_CALL_VAR(EX(call), opline->result.var);
 
 	if (UNEXPECTED(ARG_MUST_BE_SENT_BY_REF(EX(call)->func, opline->op2.num))) {
+		ZVAL_DEREF(arg);
 		zend_error(E_WARNING, "Parameter %d to %s%s%s() expected to be a reference, value given",
 			opline->op2.num,
 			EX(call)->func->common.scope ? ZSTR_VAL(EX(call)->func->common.scope->name) : "",
 			EX(call)->func->common.scope ? "::" : "",
 			ZSTR_VAL(EX(call)->func->common.function_name));
-
-		if (ZEND_CALL_INFO(EX(call)) & ZEND_CALL_CLOSURE) {
-			OBJ_RELEASE((zend_object*)EX(call)->func->common.prototype);
-		}
-		if (Z_TYPE(EX(call)->This) == IS_OBJECT) {
-			OBJ_RELEASE(Z_OBJ(EX(call)->This));
-		}
-		ZVAL_UNDEF(param);
-		EX(call)->func = (zend_function*)&zend_pass_function;
-		Z_OBJ(EX(call)->This) = NULL;
-		ZEND_SET_CALL_INFO(EX(call), 0, ZEND_CALL_INFO(EX(call)) & ~ZEND_CALL_RELEASE_THIS);
-
-		FREE_OP1();
-		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 	} else {
 		if (Z_ISREF_P(arg) &&
 		    !(EX(call)->func->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE)) {

Zend/zend_vm_gen.php

@@ -1827,7 +1827,7 @@ function gen_executor($f, $skl, $spec, $kind, $executor_name, $initializer_name)
 						gen_specs($f, $spec, $kind, $prolog."\t", $specs);
 						out($f,$prolog."};\n");
 						out($f,$prolog."zend_opcode_handlers = labels;\n");
-						out($f,$prolog."\tzend_handlers_count = sizeof(labels) / sizeof(void*);\n");
+						out($f,$prolog."zend_handlers_count = sizeof(labels) / sizeof(void*);\n");
 						out($f,$prolog."zend_spec_handlers = specs;\n");
 					}
 					break;

configure.in

@@ -120,7 +120,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=1
 PHP_RELEASE_VERSION=0
-PHP_EXTRA_VERSION="-dev"
+PHP_EXTRA_VERSION="RC2"
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
 

ext/bcmath/libbcmath/src/bcmath.h

@@ -92,7 +92,7 @@ typedef struct bc_struct
 /* Define the _PROTOTYPE macro if it is needed. */
 
 #ifndef _PROTOTYPE
-#ifdef __STDC__
+#if defined(__STDC__) || defined(PHP_WIN32) && defined(__clang__)
 #define _PROTOTYPE(func, args) func args
 #else
 #define _PROTOTYPE(func, args) func()

ext/bz2/bz2.c

@@ -562,7 +562,8 @@ static PHP_FUNCTION(bzcompress)
    Decompresses BZip2 compressed data */
 static PHP_FUNCTION(bzdecompress)
 {
-	char *source, *dest;
+	char *source;
+	zend_string *dest;
 	size_t source_len;
 	int error;
 	zend_long small = 0;
@@ -589,24 +590,40 @@ static PHP_FUNCTION(bzdecompress)
 
 	/* in most cases bz2 offers at least 2:1 compression, so we use that as our base */
 	bzs.avail_out = source_len * 2;
-	bzs.next_out = dest = emalloc(bzs.avail_out + 1);
+	dest = zend_string_alloc(bzs.avail_out + 1, 0);
+	bzs.next_out = ZSTR_VAL(dest);
 
 	while ((error = BZ2_bzDecompress(&bzs)) == BZ_OK && bzs.avail_in > 0) {
 		/* compression is better then 2:1, need to allocate more memory */
 		bzs.avail_out = source_len;
 		size = (bzs.total_out_hi32 * (unsigned int) -1) + bzs.total_out_lo32;
-		dest = safe_erealloc(dest, 1, bzs.avail_out+1, (size_t) size );
-		bzs.next_out = dest + size;
+#if !ZEND_ENABLE_ZVAL_LONG64
+		if (size > SIZE_MAX) {
+			/* no reason to continue if we're going to drop it anyway */
+			break;
+		}
+#endif
+		dest = zend_string_safe_realloc(dest, 1, bzs.avail_out+1, (size_t) size, 0);
+		bzs.next_out = ZSTR_VAL(dest) + size;
 	}
 
 	if (error == BZ_STREAM_END || error == BZ_OK) {
 		size = (bzs.total_out_hi32 * (unsigned int) -1) + bzs.total_out_lo32;
-		dest = safe_erealloc(dest, 1, (size_t) size, 1);
-		dest[size] = '\0';
-		RETVAL_STRINGL(dest, (int) size);
-		efree(dest);
+#if !ZEND_ENABLE_ZVAL_LONG64
+		if (UNEXPECTED(size > SIZE_MAX)) {
+			php_error_docref(NULL, E_WARNING, "Decompressed size too big, max is %zd", SIZE_MAX);
+			zend_string_free(dest);
+			RETVAL_LONG(BZ_MEM_ERROR);
+		} else
+#endif
+		{
+			dest = zend_string_safe_realloc(dest, 1, (size_t)size, 1, 0);
+			ZSTR_LEN(dest) = (size_t)size;
+			ZSTR_VAL(dest)[(size_t)size] = '\0';
+			RETVAL_STR(dest);
+		}
 	} else { /* real error */
-		efree(dest);
+		zend_string_free(dest);
 		RETVAL_LONG(error);
 	}
 

ext/calendar/calendar.c

@@ -24,10 +24,6 @@
 #include "config.h"
 #endif
 
-#ifdef PHP_WIN32
-#define _WINNLS_
-#endif
-
 #include "php.h"
 #include "ext/standard/info.h"
 #include "php_calendar.h"
@@ -35,6 +31,12 @@
 
 #include <stdio.h>
 
+#ifdef PHP_WIN32
+/* This conflicts with a define in winnls.h, but that header is needed
+   to have GetACP(). */
+#undef CAL_GREGORIAN
+#endif
+
 /* {{{ arginfo */
 ZEND_BEGIN_ARG_INFO_EX(arginfo_unixtojd, 0, 0, 0)
 	ZEND_ARG_INFO(0, timestamp)
@@ -357,6 +359,10 @@ PHP_FUNCTION(cal_days_in_month)
 		}
 		else {
 			sdn_next = calendar->to_jd(year + 1, 1, 1);
+			if (cal == CAL_FRENCH && sdn_next == 0) {
+				/* The French calendar ends on 0014-13-05. */
+				sdn_next = 2380953;
+			}
 		}
 	}
 
@@ -414,15 +420,21 @@ PHP_FUNCTION(cal_from_jd)
 	add_assoc_long(return_value, "year", year);
 
 /* day of week */
-	dow = DayOfWeek(jd);
-	add_assoc_long(return_value, "dow", dow);
-	add_assoc_string(return_value, "abbrevdayname", DayNameShort[dow]);
-	add_assoc_string(return_value, "dayname", DayNameLong[dow]);
+	if (cal != CAL_JEWISH || year > 0) {
+		dow = DayOfWeek(jd);
+		add_assoc_long(return_value, "dow", dow);
+		add_assoc_string(return_value, "abbrevdayname", DayNameShort[dow]);
+		add_assoc_string(return_value, "dayname", DayNameLong[dow]);
+	} else {
+		add_assoc_null(return_value, "dow");
+		add_assoc_string(return_value, "abbrevdayname", "");
+		add_assoc_string(return_value, "dayname", "");
+	}
 /* month name */
 	if(cal == CAL_JEWISH) {
 		/* special case for Jewish calendar */
-		add_assoc_string(return_value, "abbrevmonth", JEWISH_MONTH_NAME(year)[month]);
-		add_assoc_string(return_value, "monthname", JEWISH_MONTH_NAME(year)[month]);
+		add_assoc_string(return_value, "abbrevmonth", (year > 0 ? JEWISH_MONTH_NAME(year)[month] : ""));
+		add_assoc_string(return_value, "monthname", (year > 0 ? JEWISH_MONTH_NAME(year)[month] : ""));
 	} else {
 		add_assoc_string(return_value, "abbrevmonth", calendar->month_name_short[month]);
 		add_assoc_string(return_value, "monthname", calendar->month_name_long[month]);
@@ -735,7 +747,7 @@ PHP_FUNCTION(jdmonthname)
 		break;
 	case CAL_MONTH_JEWISH:		/* jewish month */
 		SdnToJewish(julday, &year, &month, &day);
-		monthname = JEWISH_MONTH_NAME(year)[month];
+		monthname = (year > 0 ? JEWISH_MONTH_NAME(year)[month] : "");
 		break;
 	case CAL_MONTH_FRENCH:		/* french month */
 		SdnToFrench(julday, &year, &month, &day);

ext/calendar/tests/bug67976.phpt

@@ -0,0 +1,12 @@
+--TEST--
+Bug #67976 (cal_days_month() fails for final month of the French calendar)
+--SKIPIF--
+<?php
+if (!extension_loaded('calendar')) die('skip ext/calendar required');
+?>
+--FILE--
+<?php
+var_dump(cal_days_in_month(CAL_FRENCH, 13, 14));
+?>
+--EXPECT--
+int(5)

ext/calendar/tests/bug71894.phpt

@@ -0,0 +1,32 @@
+--TEST--
+Bug #71894 (AddressSanitizer: global-buffer-overflow in zif_cal_from_jd)
+--SKIPIF--
+<?php
+if (!extension_loaded('calendar')) die('skip ext/calendar required');
+?>
+--FILE--
+<?php
+var_dump(cal_from_jd(347997, CAL_JEWISH));
+var_dump(jdmonthname(347997,CAL_MONTH_JEWISH));?>
+--EXPECT--
+array(9) {
+  ["date"]=>
+  string(5) "0/0/0"
+  ["month"]=>
+  int(0)
+  ["day"]=>
+  int(0)
+  ["year"]=>
+  int(0)
+  ["dow"]=>
+  NULL
+  ["abbrevdayname"]=>
+  string(0) ""
+  ["dayname"]=>
+  string(0) ""
+  ["abbrevmonth"]=>
+  string(0) ""
+  ["monthname"]=>
+  string(0) ""
+}
+string(0) ""

ext/calendar/tests/jdtogregorian_overflow.phpt

@@ -0,0 +1,28 @@
+--TEST--
+jdtogregorian(): test overflow
+--CREDITS--
+neweracracker@gmail.com
+--SKIPIF--
+<?php
+if (!extension_loaded('calendar')) die('skip ext/calendar required');
+if (PHP_INT_SIZE != 4) die('skip this test is for 32bit platforms only');
+?>
+--FILE--
+<?php
+for ($i=536838860; $i<536838870; $i++) {
+	echo $i, ':', jdtogregorian($i), PHP_EOL;
+}
+echo 'DONE', PHP_EOL;
+?>
+--EXPECT--
+536838860:10/11/1465102
+536838861:10/12/1465102
+536838862:10/13/1465102
+536838863:10/14/1465102
+536838864:10/15/1465102
+536838865:10/16/1465102
+536838866:10/17/1465102
+536838867:0/0/0
+536838868:0/0/0
+536838869:0/0/0
+DONE

ext/calendar/tests/jdtojewish_overflow.phpt

@@ -0,0 +1,27 @@
+--TEST--
+jdtojewish(): test overflow
+--CREDITS--
+neweracracker@gmail.com
+--SKIPIF--
+<?php
+if (!extension_loaded('calendar')) die('skip ext/calendar required');
+?>
+--FILE--
+<?php
+for ($i=324542840; $i<324542850; $i++) {
+	echo $i, ':', jdtojewish($i), PHP_EOL;
+}
+echo 'DONE', PHP_EOL;
+?>
+--EXPECT--
+324542840:12/7/887605
+324542841:12/8/887605
+324542842:12/9/887605
+324542843:12/10/887605
+324542844:12/11/887605
+324542845:12/12/887605
+324542846:12/13/887605
+324542847:0/0/0
+324542848:0/0/0
+324542849:0/0/0
+DONE

ext/com_dotnet/com_com.c

@@ -553,7 +553,10 @@ int php_com_do_invoke_byref(php_com_dotnet_object *obj, zend_internal_function *
 			for (i = 0, j = 0; i < nargs; i++) {
 				/* if this was byref, update the zval */
 				if (f->arg_info[nargs - i - 1].pass_by_reference) {
-					SEPARATE_ZVAL_IF_NOT_REF(&args[nargs - i - 1]);
+					zval *arg = &args[nargs - i - 1];
+
+					ZVAL_DEREF(arg);
+					SEPARATE_ZVAL_NOREF(arg);
 
 					/* if the variant is pointing at the byref_vals, we need to map
 					 * the pointee value as a zval; otherwise, the value is pointing
@@ -561,14 +564,12 @@ int php_com_do_invoke_byref(php_com_dotnet_object *obj, zend_internal_function *
 					if (V_VT(&vargs[i]) & VT_BYREF) {
 						if (vargs[i].byref == &V_UINT(&byref_vals[j])) {
 							/* copy that value */
-							php_com_zval_from_variant(&args[nargs - i - 1], &byref_vals[j],
-								obj->code_page);
+							php_com_zval_from_variant(arg, &byref_vals[j], obj->code_page);
 						}
 					} else {
 						/* not sure if this can ever happen; the variant we marked as BYREF
 						 * is no longer BYREF - copy its value */
-						php_com_zval_from_variant(&args[nargs - i - 1], &vargs[i],
-							obj->code_page);
+						php_com_zval_from_variant(arg, &vargs[i], obj->code_page);
 					}
 					VariantClear(&byref_vals[j]);
 					j++;

ext/com_dotnet/com_handlers.c

@@ -279,7 +279,6 @@ static union _zend_function *com_method_get(zend_object **object_ptr, zend_strin
 		f.fn_flags = ZEND_ACC_CALL_VIA_HANDLER;
 		f.function_name = zend_string_copy(name);
 		f.handler = PHP_FN(com_method_handler);
-		zend_set_function_arg_flags((zend_function*)&f);
 
 		fptr = &f;
 
@@ -305,11 +304,12 @@ static union _zend_function *com_method_get(zend_object **object_ptr, zend_strin
 							for (i = 0; i < bindptr.lpfuncdesc->cParams; i++) {
 								f.arg_info[i].allow_null = 1;
 								if (bindptr.lpfuncdesc->lprgelemdescParam[i].paramdesc.wParamFlags & PARAMFLAG_FOUT) {
-									f.arg_info[i].pass_by_reference = 1;
+									f.arg_info[i].pass_by_reference = ZEND_SEND_BY_REF;
 								}
 							}
 
 							f.num_args = bindptr.lpfuncdesc->cParams;
+							zend_set_function_arg_flags((zend_function*)&f);
 
 							ITypeInfo_ReleaseFuncDesc(TI, bindptr.lpfuncdesc);
 							break;

ext/curl/interface.c

@@ -1884,38 +1884,6 @@ php_curl *alloc_curl_handle()
 /* }}} */
 
 #if LIBCURL_VERSION_NUM >= 0x071301 /* Available since 7.19.1 */
-/* {{{ split_certinfo
- */
-static void split_certinfo(char *string, zval *hash)
-{
-	char *org = estrdup(string);
-	char *s = org;
-	char *split;
-
-	if(org) {
-		do {
-			char *key;
-			char *val;
-			char *tmp;
-
-			split = strstr(s, "; ");
-			if(split)
-				*split = '\0';
-
-			key = s;
-			tmp = memchr(key, '=', 64);
-			if(tmp) {
-				*tmp = '\0';
-				val = tmp+1;
-				add_assoc_string(hash, key, val);
-			}
-			s = split+2;
-		} while(split);
-		efree(org);
-	}
-}
-/* }}} */
-
 /* {{{ create_certinfo
  */
 static void create_certinfo(struct curl_certinfo *ci, zval *listcode)
@@ -1933,21 +1901,13 @@ static void create_certinfo(struct curl_certinfo *ci, zval *listcode)
 				int len;
 				char s[64];
 				char *tmp;
-				strncpy(s, slist->data, 64);
-				tmp = memchr(s, ':', 64);
+				strncpy(s, slist->data, sizeof(s));
+				s[sizeof(s)-1] = '\0';
+				tmp = memchr(s, ':', sizeof(s));
 				if(tmp) {
 					*tmp = '\0';
 					len = strlen(s);
-					if (!strcmp(s, "Subject") || !strcmp(s, "Issuer")) {
-						zval hash;
-
-						array_init(&hash);
-
-						split_certinfo(&slist->data[len+1], &hash);
-						add_assoc_zval(&certhash, s, &hash);
-					} else {
-						add_assoc_string(&certhash, s, &slist->data[len+1]);
-					}
+					add_assoc_string(&certhash, s, &slist->data[len+1]);
 				} else {
 					php_error_docref(NULL, E_WARNING, "Could not extract hash key from certificate info");
 				}
@@ -2671,10 +2631,12 @@ static int _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue) /* {{{
 				}
 			} ZEND_HASH_FOREACH_END();
 
-			if ((*ch->clone) == 1) {
-				zend_hash_index_update_ptr(ch->to_free->slist, option, slist);
-			} else {
-				zend_hash_next_index_insert_ptr(ch->to_free->slist, slist);
+			if (slist) {
+				if ((*ch->clone) == 1) {
+					zend_hash_index_update_ptr(ch->to_free->slist, option, slist);
+				} else {
+					zend_hash_next_index_insert_ptr(ch->to_free->slist, slist);
+				}
 			}
 
 			error = curl_easy_setopt(ch->cp, option, slist);
@@ -3569,7 +3531,7 @@ PHP_FUNCTION(curl_reset)
 PHP_FUNCTION(curl_escape)
 {
 	char       *str = NULL, *res = NULL;
-	size_t        str_len = 0;
+	size_t     str_len = 0;
 	zval       *zid;
 	php_curl   *ch;
 
@@ -3581,6 +3543,10 @@ PHP_FUNCTION(curl_escape)
 		RETURN_FALSE;
 	}
 
+	if (ZEND_SIZE_T_INT_OVFL(str_len)) {
+		RETURN_FALSE;
+	}
+
 	if ((res = curl_easy_escape(ch->cp, str, str_len))) {
 		RETVAL_STRING(res);
 		curl_free(res);
@@ -3608,7 +3574,7 @@ PHP_FUNCTION(curl_unescape)
 		RETURN_FALSE;
 	}
 
-	if (str_len > INT_MAX) {
+	if (ZEND_SIZE_T_INT_OVFL(str_len)) {
 		RETURN_FALSE;
 	}
 

ext/date/lib/parse_date.c

@@ -1,4 +1,4 @@
-/* Generated by re2c 0.13.5 on Wed Jul 20 13:32:20 2016 */
+/* Generated by re2c 0.15.3 on Sun Jul 24 14:52:04 2016 */
 #line 1 "ext/date/lib/parse_date.re"
 /*
  * The MIT License (MIT)
@@ -862,7 +862,6 @@ std:
 		  0,   0,   0,   0,   0,   0,   0,   0, 
 		  0,   0,   0,   0,   0,   0,   0,   0, 
 	};
-
 	if ((YYLIMIT - YYCURSOR) < 31) YYFILL(31);
 	yych = *YYCURSOR;
 	switch (yych) {
@@ -973,7 +972,7 @@ yy3:
 		TIMELIB_DEINIT;
 		return TIMELIB_TIMEZONE;
 	}
-#line 977 "<stdout>"
+#line 976 "<stdout>"
 yy4:
 	yych = *++YYCURSOR;
 	if (yych <= 'E') {
@@ -1278,7 +1277,7 @@ yy12:
 		add_error(s, "Unexpected character");
 		goto std;
 	}
-#line 1282 "<stdout>"
+#line 1281 "<stdout>"
 yy13:
 	yych = *++YYCURSOR;
 	if (yych <= 'R') {
@@ -2296,7 +2295,7 @@ yy49:
 	{
 		goto std;
 	}
-#line 2300 "<stdout>"
+#line 2299 "<stdout>"
 yy50:
 	yych = *++YYCURSOR;
 	goto yy49;
@@ -2307,7 +2306,7 @@ yy51:
 		s->pos = cursor; s->line++;
 		goto std;
 	}
-#line 2311 "<stdout>"
+#line 2310 "<stdout>"
 yy53:
 	yych = *++YYCURSOR;
 	goto yy12;
@@ -2374,7 +2373,7 @@ yy56:
 			if (yyaccept <= 4) {
 				if (yyaccept <= 2) {
 					if (yyaccept <= 1) {
-						if (yyaccept <= 0) {
+						if (yyaccept == 0) {
 							goto yy3;
 						} else {
 							goto yy12;
@@ -2383,7 +2382,7 @@ yy56:
 						goto yy49;
 					}
 				} else {
-					if (yyaccept <= 3) {
+					if (yyaccept == 3) {
 						goto yy72;
 					} else {
 						goto yy166;
@@ -2391,13 +2390,13 @@ yy56:
 				}
 			} else {
 				if (yyaccept <= 6) {
-					if (yyaccept <= 5) {
+					if (yyaccept == 5) {
 						goto yy193;
 					} else {
 						goto yy198;
 					}
 				} else {
-					if (yyaccept <= 7) {
+					if (yyaccept == 7) {
 						goto yy222;
 					} else {
 						goto yy294;
@@ -2407,13 +2406,13 @@ yy56:
 		} else {
 			if (yyaccept <= 12) {
 				if (yyaccept <= 10) {
-					if (yyaccept <= 9) {
+					if (yyaccept == 9) {
 						goto yy392;
 					} else {
 						goto yy475;
 					}
 				} else {
-					if (yyaccept <= 11) {
+					if (yyaccept == 11) {
 						goto yy490;
 					} else {
 						goto yy611;
@@ -2421,13 +2420,13 @@ yy56:
 				}
 			} else {
 				if (yyaccept <= 14) {
-					if (yyaccept <= 13) {
+					if (yyaccept == 13) {
 						goto yy656;
 					} else {
 						goto yy666;
 					}
 				} else {
-					if (yyaccept <= 15) {
+					if (yyaccept == 15) {
 						goto yy763;
 					} else {
 						goto yy783;
@@ -2440,7 +2439,7 @@ yy56:
 			if (yyaccept <= 21) {
 				if (yyaccept <= 19) {
 					if (yyaccept <= 18) {
-						if (yyaccept <= 17) {
+						if (yyaccept == 17) {
 							goto yy814;
 						} else {
 							goto yy821;
@@ -2449,7 +2448,7 @@ yy56:
 						goto yy848;
 					}
 				} else {
-					if (yyaccept <= 20) {
+					if (yyaccept == 20) {
 						goto yy793;
 					} else {
 						goto yy454;
@@ -2457,13 +2456,13 @@ yy56:
 				}
 			} else {
 				if (yyaccept <= 23) {
-					if (yyaccept <= 22) {
+					if (yyaccept == 22) {
 						goto yy973;
 					} else {
 						goto yy842;
 					}
 				} else {
-					if (yyaccept <= 24) {
+					if (yyaccept == 24) {
 						goto yy1067;
 					} else {
 						goto yy1075;
@@ -2473,13 +2472,13 @@ yy56:
 		} else {
 			if (yyaccept <= 29) {
 				if (yyaccept <= 27) {
-					if (yyaccept <= 26) {
+					if (yyaccept == 26) {
 						goto yy1117;
 					} else {
 						goto yy1141;
 					}
 				} else {
-					if (yyaccept <= 28) {
+					if (yyaccept == 28) {
 						goto yy1294;
 					} else {
 						goto yy1417;
@@ -2487,13 +2486,13 @@ yy56:
 				}
 			} else {
 				if (yyaccept <= 31) {
-					if (yyaccept <= 30) {
+					if (yyaccept == 30) {
 						goto yy1420;
 					} else {
 						goto yy1500;
 					}
 				} else {
-					if (yyaccept <= 32) {
+					if (yyaccept == 32) {
 						goto yy1508;
 					} else {
 						goto yy1531;
@@ -2689,7 +2688,7 @@ yy72:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 2693 "<stdout>"
+#line 2692 "<stdout>"
 yy73:
 	yych = *++YYCURSOR;
 	if (yych == 'D') goto yy74;
@@ -3374,7 +3373,7 @@ yy166:
 		TIMELIB_DEINIT;
 		return TIMELIB_WEEKDAY;
 	}
-#line 3378 "<stdout>"
+#line 3377 "<stdout>"
 yy167:
 	yych = *++YYCURSOR;
 	if (yych <= 'K') {
@@ -3876,7 +3875,7 @@ yy193:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_TEXT;
 	}
-#line 3880 "<stdout>"
+#line 3879 "<stdout>"
 yy194:
 	++YYCURSOR;
 	if ((YYLIMIT - YYCURSOR) < 21) YYFILL(21);
@@ -3935,7 +3934,7 @@ yy198:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_TEXT;
 	}
-#line 3939 "<stdout>"
+#line 3938 "<stdout>"
 yy199:
 	yyaccept = 6;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -4209,7 +4208,7 @@ yy222:
 		TIMELIB_DEINIT;
 		return TIMELIB_SHORTDATE_WITH_TIME;
 	}
-#line 4213 "<stdout>"
+#line 4212 "<stdout>"
 yy223:
 	yyaccept = 7;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -4874,7 +4873,7 @@ yy277:
 		TIMELIB_DEINIT;
 		return TIMELIB_SHORTDATE_WITH_TIME;
 	}
-#line 4878 "<stdout>"
+#line 4877 "<stdout>"
 yy279:
 	yych = *++YYCURSOR;
 	if (yych <= 0x1F) {
@@ -5049,7 +5048,7 @@ yy294:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_NO_DAY;
 	}
-#line 5053 "<stdout>"
+#line 5052 "<stdout>"
 yy295:
 	yych = *++YYCURSOR;
 	if (yych <= '/') {
@@ -6213,7 +6212,7 @@ yy363:
 		TIMELIB_DEINIT;
 		return TIMELIB_PG_TEXT;
 	}
-#line 6217 "<stdout>"
+#line 6216 "<stdout>"
 yy364:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy363;
@@ -6842,7 +6841,7 @@ yy392:
 		TIMELIB_DEINIT;
 		return TIMELIB_AGO;
 	}
-#line 6846 "<stdout>"
+#line 6845 "<stdout>"
 yy393:
 	yyaccept = 5;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -8541,7 +8540,7 @@ yy454:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_DATE;
 	}
-#line 8545 "<stdout>"
+#line 8544 "<stdout>"
 yy455:
 	yyaccept = 0;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -9088,7 +9087,7 @@ yy475:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_TEXT;
 	}
-#line 9092 "<stdout>"
+#line 9091 "<stdout>"
 yy476:
 	yyaccept = 10;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -9232,7 +9231,7 @@ yy487:
 		TIMELIB_DEINIT;
 		return TIMELIB_TIME12;
 	}
-#line 9236 "<stdout>"
+#line 9235 "<stdout>"
 yy489:
 	yyaccept = 11;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -9268,7 +9267,7 @@ yy490:
 		TIMELIB_DEINIT;
 		return TIMELIB_TIME24_WITH_ZONE;
 	}
-#line 9272 "<stdout>"
+#line 9271 "<stdout>"
 yy491:
 	yyaccept = 11;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -9564,7 +9563,7 @@ yy522:
 		TIMELIB_DEINIT;
 		return TIMELIB_TIME24_WITH_ZONE;
 	}
-#line 9568 "<stdout>"
+#line 9567 "<stdout>"
 yy524:
 	yyaccept = 11;
 	YYMARKER = ++YYCURSOR;
@@ -9673,7 +9672,7 @@ yy534:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_FULL;
 	}
-#line 9677 "<stdout>"
+#line 9676 "<stdout>"
 yy535:
 	yych = *++YYCURSOR;
 	if (yych == 'M') goto yy536;
@@ -10348,7 +10347,7 @@ yy604:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_FULL_POINTED;
 	}
-#line 10352 "<stdout>"
+#line 10351 "<stdout>"
 yy607:
 	yyaccept = 11;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -10392,7 +10391,7 @@ yy611:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_FULL_POINTED;
 	}
-#line 10396 "<stdout>"
+#line 10395 "<stdout>"
 yy612:
 	yyaccept = 11;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -11001,7 +11000,7 @@ yy656:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_DATE;
 	}
-#line 11005 "<stdout>"
+#line 11004 "<stdout>"
 yy657:
 	yyaccept = 13;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -11112,7 +11111,7 @@ yy666:
 		TIMELIB_DEINIT;
 		return TIMELIB_AMERICAN;
 	}
-#line 11116 "<stdout>"
+#line 11115 "<stdout>"
 yy667:
 	yyaccept = 14;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -11331,7 +11330,7 @@ yy700:
 		TIMELIB_DEINIT;
 		return TIMELIB_CLF;
 	}
-#line 11335 "<stdout>"
+#line 11334 "<stdout>"
 yy701:
 	yych = *++YYCURSOR;
 	if (yych <= '5') {
@@ -11831,7 +11830,7 @@ yy763:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_DATE;
 	}
-#line 11835 "<stdout>"
+#line 11834 "<stdout>"
 yy764:
 	yych = *++YYCURSOR;
 	if (yych == 'C') goto yy765;
@@ -11875,7 +11874,7 @@ yy770:
 		TIMELIB_DEINIT;
 		return TIMELIB_PG_TEXT;
 	}
-#line 11879 "<stdout>"
+#line 11878 "<stdout>"
 yy772:
 	yych = *++YYCURSOR;
 	if (yych == 'V') goto yy765;
@@ -12008,7 +12007,7 @@ yy783:
 		TIMELIB_DEINIT;
 		return TIMELIB_CLF;
 	}
-#line 12012 "<stdout>"
+#line 12011 "<stdout>"
 yy784:
 	yych = *++YYCURSOR;
 	switch (yych) {
@@ -12159,7 +12158,7 @@ yy793:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_NO_DAY;
 	}
-#line 12163 "<stdout>"
+#line 12162 "<stdout>"
 yy794:
 	yych = *++YYCURSOR;
 	if (yych == 'I') goto yy927;
@@ -12371,7 +12370,7 @@ yy814:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_WEEK;
 	}
-#line 12375 "<stdout>"
+#line 12374 "<stdout>"
 yy815:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy56;
@@ -12396,7 +12395,7 @@ yy816:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_WEEK;
 	}
-#line 12400 "<stdout>"
+#line 12399 "<stdout>"
 yy818:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy60;
@@ -12469,7 +12468,7 @@ yy821:
 		TIMELIB_DEINIT;
 		return TIMELIB_PG_YEARDAY;
 	}
-#line 12473 "<stdout>"
+#line 12472 "<stdout>"
 yy822:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy60;
@@ -12576,7 +12575,7 @@ yy842:
 		TIMELIB_DEINIT;
 		return TIMELIB_XMLRPC_SOAP;
 	}
-#line 12580 "<stdout>"
+#line 12579 "<stdout>"
 yy843:
 	yych = *++YYCURSOR;
 	if (yych <= '2') {
@@ -12843,7 +12842,7 @@ yy848:
 		TIMELIB_DEINIT;
 		return TIMELIB_DATE_NOCOLON;
 	}
-#line 12847 "<stdout>"
+#line 12846 "<stdout>"
 yy849:
 	yych = *++YYCURSOR;
 	if (yych <= 'H') {
@@ -13650,7 +13649,7 @@ yy973:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_DATE;
 	}
-#line 13654 "<stdout>"
+#line 13653 "<stdout>"
 yy974:
 	yyaccept = 22;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -14584,7 +14583,7 @@ yy1067:
 		TIMELIB_DEINIT;
 		return TIMELIB_GNU_NOCOLON;
 	}
-#line 14588 "<stdout>"
+#line 14587 "<stdout>"
 yy1068:
 	yych = *++YYCURSOR;
 	if (yych <= '/') goto yy60;
@@ -14687,7 +14686,7 @@ yy1075:
 		TIMELIB_DEINIT;
 		return TIMELIB_ISO_NOCOLON;
 	}
-#line 14691 "<stdout>"
+#line 14690 "<stdout>"
 yy1076:
 	yyaccept = 25;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -15559,7 +15558,7 @@ yy1117:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 15563 "<stdout>"
+#line 15562 "<stdout>"
 yy1118:
 	++YYCURSOR;
 	if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
@@ -15622,7 +15621,7 @@ yy1125:
 		TIMELIB_DEINIT;
 		return TIMELIB_WEEK_DAY_OF_MONTH;
 	}
-#line 15626 "<stdout>"
+#line 15625 "<stdout>"
 yy1127:
 	yyaccept = 26;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -15738,7 +15737,7 @@ yy1141:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 15742 "<stdout>"
+#line 15741 "<stdout>"
 yy1142:
 	yych = *++YYCURSOR;
 	goto yy1117;
@@ -18284,7 +18283,7 @@ yy1294:
 		TIMELIB_DEINIT;
 		return TIMELIB_LF_DAY_OF_MONTH;
 	}
-#line 18288 "<stdout>"
+#line 18287 "<stdout>"
 yy1295:
 	yyaccept = 28;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -18539,7 +18538,7 @@ yy1315:
 		TIMELIB_DEINIT;
 		return TIMELIB_LF_DAY_OF_MONTH;
 	}
-#line 18543 "<stdout>"
+#line 18542 "<stdout>"
 yy1317:
 	yyaccept = 0;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -19924,7 +19923,7 @@ yy1387:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 19928 "<stdout>"
+#line 19927 "<stdout>"
 yy1388:
 	yych = *++YYCURSOR;
 	if (yych <= 'N') {
@@ -20341,7 +20340,7 @@ yy1417:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 20345 "<stdout>"
+#line 20344 "<stdout>"
 yy1418:
 	yych = *++YYCURSOR;
 	if (yych <= 'Y') {
@@ -20382,7 +20381,7 @@ yy1420:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 20386 "<stdout>"
+#line 20385 "<stdout>"
 yy1421:
 	yych = *++YYCURSOR;
 	if (yych <= 'S') {
@@ -22322,7 +22321,7 @@ yy1500:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 22326 "<stdout>"
+#line 22325 "<stdout>"
 yy1501:
 	yych = *++YYCURSOR;
 	if (yych <= 'N') {
@@ -22464,7 +22463,7 @@ yy1508:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 22468 "<stdout>"
+#line 22467 "<stdout>"
 yy1509:
 	yyaccept = 0;
 	yych = *(YYMARKER = ++YYCURSOR);
@@ -22985,7 +22984,7 @@ yy1531:
 		TIMELIB_DEINIT;
 		return TIMELIB_RELATIVE;
 	}
-#line 22989 "<stdout>"
+#line 22988 "<stdout>"
 yy1532:
 	yyaccept = 0;
 	yych = *(YYMARKER = ++YYCURSOR);

ext/dba/libinifile/inifile.c

@@ -250,6 +250,7 @@ val_type inifile_fetch(inifile *dba, const key_type *key, int skip) {
 	if (skip == -1 && dba->next.key.group && dba->next.key.name && !inifile_key_cmp(&dba->next.key, key)) {
 		/* we got position already from last fetch */
 		php_stream_seek(dba->fp, dba->next.pos, SEEK_SET);
+		ln.key.group = estrdup(dba->next.key.group);
 	} else {
 		/* specific instance or not same key -> restart search */
 		/* the slow way: restart and seacrch */

ext/dba/tests/bug70825.phpt

@@ -0,0 +1,71 @@
+--TEST--
+Bug #70825 (Cannot fetch multiple values with group in ini file)
+--SKIPIF--
+<?php
+if (!extension_loaded('dba')) die('skip dba extension not available');
+if (!in_array('inifile', dba_handlers())) die('skip inifile handler not available');
+?>
+--FILE--
+<?php
+$filename = __DIR__ . DIRECTORY_SEPARATOR . 'bug70825.ini';
+
+$db = dba_open($filename, 'n', 'inifile');
+dba_insert('foo', 23, $db);
+dba_insert('foo', 42, $db);
+dba_insert('foo', 1337, $db);
+var_dump(dba_fetch('foo', -1, $db));
+var_dump(dba_fetch('foo', -1, $db));
+var_dump(dba_fetch('foo', -1, $db));
+dba_close($db);
+unlink($filename);
+
+$db = dba_open($filename, 'n', 'inifile');
+dba_insert(['foo', 'bar'], 23, $db);
+dba_insert(['foo', 'bar'], 42, $db);
+dba_insert(['foo', 'bar'], 1337, $db);
+var_dump(dba_fetch(['foo', 'bar'], -1, $db));
+var_dump(dba_fetch(['foo', 'bar'], -1, $db));
+var_dump(dba_fetch(['foo', 'bar'], -1, $db));
+dba_close($db);
+unlink($filename);
+
+$db = dba_open($filename, 'n', 'inifile');
+dba_insert('[foo]bar', 23, $db);
+dba_insert('[foo]bar', 42, $db);
+dba_insert('[foo]bar', 1337, $db);
+var_dump(dba_fetch('[foo]bar', -1, $db));
+var_dump(dba_fetch('[foo]bar', -1, $db));
+var_dump(dba_fetch('[foo]bar', -1, $db));
+dba_close($db);
+unlink($filename);
+
+$db = dba_open($filename, 'n', 'inifile');
+dba_insert('[foo]bar', 23, $db);
+dba_insert('[foo]bar', 42, $db);
+dba_insert('[foo]bar', 1337, $db);
+var_dump(dba_fetch('[foo]bar', 0, $db));
+var_dump(dba_fetch('[foo]bar', 1, $db));
+var_dump(dba_fetch('[foo]bar', 2, $db));
+dba_close($db);
+unlink($filename);
+?>
+==DONE==
+--EXPECT--
+string(2) "23"
+string(2) "42"
+string(4) "1337"
+string(2) "23"
+string(2) "42"
+string(4) "1337"
+string(2) "23"
+string(2) "42"
+string(4) "1337"
+string(2) "23"
+string(2) "42"
+string(4) "1337"
+==DONE==
+--CLEAN--
+<?php
+$filename = __DIR__ . DIRECTORY_SEPARATOR . 'bug70825.ini';
+unlink($filename);
+?>

ext/dba/tests/bug71514.phpt

@@ -0,0 +1,28 @@
+--TEST--
+Bug #71514 (Bad dba_replace condition because of wrong API usage)
+--SKIPIF--
+<?php
+if (!extension_loaded('dba')) die('skip dba extension not available');
+if (!in_array('inifile', dba_handlers())) die('skip inifile handler not available');
+?>
+--FILE--
+<?php
+$filename = __DIR__ . DIRECTORY_SEPARATOR . 'bug71514.ini';
+
+$db = dba_open($filename, 'c', 'inifile');
+
+dba_insert('foo', 'value1', $db);
+dba_replace('foo', 'value2', $db);
+var_dump(dba_fetch('foo', $db));
+
+dba_close($db);
+?>
+==DONE==
+--EXPECT--
+string(6) "value2"
+==DONE==
+--CLEAN--
+<?php
+$filename = __DIR__ . DIRECTORY_SEPARATOR . 'bug71514.ini';
+unlink($filename);
+?>

ext/dba/tests/dba_handler.inc

@@ -40,7 +40,7 @@ do {
 	}
 	if ($handler != 'cdb') {
 		$db_writer = dba_open($db_filename, 'c'.$lock_flag, $handler);
-		if (($dba_reader = @dba_open($db_filename, 'r'.$lock_flag.($lock_flag ? 't' : ''), $handler))===false) {
+		if (($dba_reader = @dba_open($db_filename, 'r'.$lock_flag.'t', $handler))===false) {
 			echo "Read during write: not allowed\n";
 		} else {
 			echo "Read during write: allowed\n";

ext/exif/exif.c

@@ -1703,6 +1703,10 @@ static void exif_iif_add_value(image_info_type *image_info, int section_index, c
 				break;
 		case TAG_FMT_UNDEFINED:
 			if (value) {
+				if (tag == TAG_MAKER_NOTE) {
+					length = MIN(length, strlen(value));
+				}
+
 				/* do not recompute length here */
 				info_value->s = estrndup(value, length);
 				info_data->length = length;
@@ -2713,8 +2717,14 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 	char *dir_start;
 
 	for (i=0; i<=sizeof(maker_note_array)/sizeof(maker_note_type); i++) {
-		if (i==sizeof(maker_note_array)/sizeof(maker_note_type))
-			return FALSE;
+		if (i==sizeof(maker_note_array)/sizeof(maker_note_type)) {
+#ifdef EXIF_DEBUG
+			exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "No maker note data found. Detected maker: %s (length = %d)", ImageInfo->make, strlen(ImageInfo->make));
+#endif
+			/* unknown manufacturer, not an error, use it as a string */
+			return TRUE;
+		}
+
 		maker_note = maker_note_array+i;
 
 		/*exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "check (%s,%s)", maker_note->make?maker_note->make:"", maker_note->model?maker_note->model:"");*/
@@ -3714,8 +3724,11 @@ static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offse
 									fgot = php_stream_read(ImageInfo->infile, ImageInfo->Thumbnail.data, ImageInfo->Thumbnail.size);
 									if (fgot < ImageInfo->Thumbnail.size) {
 										EXIF_ERRLOG_THUMBEOF(ImageInfo)
+										efree(ImageInfo->Thumbnail.data);
+										ImageInfo->Thumbnail.data = NULL;
+									} else {
+										exif_thumbnail_build(ImageInfo);
 									}
-									exif_thumbnail_build(ImageInfo);
 								}
 							}
 						}
@@ -3748,8 +3761,11 @@ static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offse
 						fgot = php_stream_read(ImageInfo->infile, ImageInfo->Thumbnail.data, ImageInfo->Thumbnail.size);
 						if (fgot < ImageInfo->Thumbnail.size) {
 							EXIF_ERRLOG_THUMBEOF(ImageInfo)
+							efree(ImageInfo->Thumbnail.data);
+							ImageInfo->Thumbnail.data = NULL;
+						} else {
+							exif_thumbnail_build(ImageInfo);
 						}
-						exif_thumbnail_build(ImageInfo);
 					}
 #ifdef EXIF_DEBUG
 					exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read next IFD (THUMBNAIL) done");

ext/exif/tests/bug72627.phpt

@@ -0,0 +1,71 @@
+--TEST--
+Bug #72627 (Memory Leakage In exif_process_IFD_in_TIFF)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+	$exif = exif_read_data(__DIR__ . '/bug72627.tiff',0,0,true);
+	var_dump($exif);
+?>
+--EXPECTF--
+Warning: exif_read_data(%s): Thumbnail goes IFD boundary or end of file reached in %sbug72627.php on line %d
+
+Warning: exif_read_data(%s): Error in TIFF: filesize(x04E2) less than start of IFD dir(x829A0004) in %sbug72627.php on line %d
+
+Warning: exif_read_data(%s): Thumbnail goes IFD boundary or end of file reached in %sbug72627.php on line %d
+array(11) {
+  ["FileName"]=>
+  string(13) "bug72627.tiff"
+  ["FileDateTime"]=>
+  int(%d)
+  ["FileSize"]=>
+  int(1250)
+  ["FileType"]=>
+  int(7)
+  ["MimeType"]=>
+  string(10) "image/tiff"
+  ["SectionsFound"]=>
+  string(30) "ANY_TAG, IFD0, THUMBNAIL, EXIF"
+  ["COMPUTED"]=>
+  array(10) {
+    ["html"]=>
+    string(24) "width="128" height="132""
+    ["Height"]=>
+    int(132)
+    ["Width"]=>
+    int(128)
+    ["IsColor"]=>
+    int(0)
+    ["ByteOrderMotorola"]=>
+    int(0)
+    ["ApertureFNumber"]=>
+    string(5) "f/1.0"
+    ["Thumbnail.FileType"]=>
+    int(2)
+    ["Thumbnail.MimeType"]=>
+    string(10) "image/jpeg"
+    ["Thumbnail.Height"]=>
+    int(132)
+    ["Thumbnail.Width"]=>
+    int(128)
+  }
+  ["XResolution"]=>
+  string(21) "1414812756/1414812756"
+  ["THUMBNAIL"]=>
+  array(5) {
+    ["ImageWidth"]=>
+    int(128)
+    ["ImageLength"]=>
+    int(132)
+    ["JPEGInterchangeFormat"]=>
+    int(1280)
+    ["JPEGInterchangeFormatLength"]=>
+    int(100)
+    ["THUMBNAIL"]=>
+    NULL
+  }
+  ["ExposureTime"]=>
+  string(21) "1414812756/1414812756"
+  ["FNumber"]=>
+  string(21) "1414812756/1414812756"
+}

ext/fileinfo/tests/bug69107.phpt

@@ -0,0 +1,22 @@
+--TEST--
+Bug #69107 (finfo no longer detects PHP files)
+--SKIPIF--
+<?php
+if (!extension_loaded('fileinfo')) die('skip fileinfo extension not available');
+?>
+--FILE--
+<?php
+$finfo = new finfo(FILEINFO_MIME_TYPE);
+
+var_dump($finfo->buffer("<?php\nclass A{}"));
+var_dump($finfo->buffer("<?php class A{}"));
+var_dump($finfo->buffer("<?php\tclass A{}"));
+var_dump($finfo->buffer("<?php\n\rclass A{}"));
+?>
+===DONE===
+--EXPECT--
+string(10) "text/x-php"
+string(10) "text/x-php"
+string(10) "text/x-php"
+string(10) "text/x-php"
+===DONE===

ext/filter/filter.c

@@ -397,7 +397,7 @@ static void php_zval_filter(zval *value, zend_long filter, zend_long flags, zval
 			} else {
 				ZVAL_FALSE(value);
 			}
-			return;
+			goto handle_default;
 		}
 	}
 
@@ -406,6 +406,7 @@ static void php_zval_filter(zval *value, zend_long filter, zend_long flags, zval
 
 	filter_func.function(value, flags, options, charset);
 
+handle_default:
 	if (options && (Z_TYPE_P(options) == IS_ARRAY || Z_TYPE_P(options) == IS_OBJECT) &&
 		((flags & FILTER_NULL_ON_FAILURE && Z_TYPE_P(value) == IS_NULL) ||
 		(!(flags & FILTER_NULL_ON_FAILURE) && Z_TYPE_P(value) == IS_FALSE)) &&

ext/filter/logical_filters.c

@@ -789,8 +789,7 @@ void php_filter_validate_ip(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
 			if (flags & FILTER_FLAG_NO_PRIV_RANGE) {
 				if (
 					(ip[0] == 10) ||
-					(ip[0] == 169 && ip[1] == 254) ||
-					(ip[0] == 172 && (ip[1] >= 16 && ip[1] <= 31)) ||
+					(ip[0] == 172 && ip[1] >= 16 && ip[1] <= 31) ||
 					(ip[0] == 192 && ip[1] == 168)
 				) {
 					RETURN_VALIDATION_FAILED
@@ -800,19 +799,9 @@ void php_filter_validate_ip(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
 			if (flags & FILTER_FLAG_NO_RES_RANGE) {
 				if (
 					(ip[0] == 0) ||
-					(ip[0] == 10) ||
-					(ip[0] == 100 && (ip[1] >= 64 && ip[1] <= 127)) ||
+					(ip[0] >= 240) ||
 					(ip[0] == 127) ||
-					(ip[0] == 169 && ip[1] == 254) ||
-					(ip[0] == 172 && (ip[1] >= 16 && ip[1] <= 31)) ||
-					(ip[0] == 192 && ip[1] == 0 && ip[2] == 0) ||
-					(ip[0] == 192 && ip[1] == 0 && ip[2] == 2) ||
-					(ip[0] == 192 && ip[1] == 88 && ip[2] == 99) ||
-					(ip[0] == 192 && ip[1] == 168) ||
-					(ip[0] == 198 && (ip[1] == 18 || ip[1] == 19)) ||
-					(ip[0] == 198 && ip[1] == 51 && ip[2] == 100) ||
-					(ip[0] == 203 && ip[1] == 0 && ip[2] == 113) ||
-					(ip[0] >= 224 && ip[0] <= 255)
+					(ip[0] == 169 && ip[1] == 254)
 				) {
 					RETURN_VALIDATION_FAILED
 				}

ext/filter/tests/018.phpt

@@ -41,9 +41,9 @@ string(9) "127.0.0.1"
 bool(false)
 string(12) "192.0.34.166"
 bool(false)
-bool(false)
-bool(false)
-bool(false)
+string(9) "192.0.0.1"
+string(10) "100.64.0.0"
+string(15) "100.127.255.255"
 string(12) "192.0.34.166"
 bool(false)
 string(15) "255.255.255.255"

ext/filter/tests/bug73054.phpt

@@ -0,0 +1,23 @@
+--TEST--
+Bug #73054 (default option ignored when object passed to int filter)
+--SKIPIF--
+<?php
+if (!extension_loaded('filter')) die('skip filter extension not available');
+?>
+--FILE--
+<?php
+var_dump(
+    filter_var(new stdClass, FILTER_VALIDATE_INT, [
+        'options' => ['default' => 2],
+    ]),
+    filter_var(new stdClass, FILTER_VALIDATE_INT, [
+        'options' => ['default' => 2],
+        'flags' => FILTER_NULL_ON_FAILURE
+    ])
+);
+?>
+===DONE===
+--EXPECT--
+int(2)
+int(2)
+===DONE===

ext/filter/tests/filter_ipv4_rfc6890.phpt

@@ -27,51 +27,51 @@ foreach ($privateRanges as $key => $range) {
 $reservedRanges = array();
 
 // 0.0.0.0/8
-$reserverRanges['0.0.0.0/8'] = array('0.0.0.0', '0.255.255.255');
+$reservedRanges['0.0.0.0/8'] = array('0.0.0.0', '0.255.255.255');
 
 // 10.0.0.0/8
-$reserverdRanges['10.0.0.0/8'] = array('10.0.0.0', '10.255.255.255');
+$reservedRanges['10.0.0.0/8'] = array('10.0.0.0', '10.255.255.255');
 
 // 100.64.0.0/10
-$reserverdRanges['10.64.0.0/10'] = array('100.64.0.0', '100.127.255.255');
+$reservedRanges['10.64.0.0/10'] = array('100.64.0.0', '100.127.255.255');
 
 // 127.0.0.0/8
-$reserverdRanges['127.0.0.0/8'] = array('127.0.0.0', '127.255.255.255');
+$reservedRanges['127.0.0.0/8'] = array('127.0.0.0', '127.255.255.255');
 
 // 169.254.0.0/16
-$reserverdRanges['169.254.0.0/16'] = array('169.254.0.0', '169.254.255.255');
+$reservedRanges['169.254.0.0/16'] = array('169.254.0.0', '169.254.255.255');
 
 // 172.16.0.0/12
-$reserverdRanges['172.16.0.0/12'] = array('172.16.0.0', '172.31.0.0');
+$reservedRanges['172.16.0.0/12'] = array('172.16.0.0', '172.31.0.0');
 
 // 192.0.0.0/24
-$reserverdRanges['192.0.0.0/24'] = array('192.0.0.0', '192.0.0.255');
+$reservedRanges['192.0.0.0/24'] = array('192.0.0.0', '192.0.0.255');
 
 // 192.0.0.0/29
-$reserverdRanges['192.0.0.0/29'] = array('192.0.0.0', '192.0.0.7');
+$reservedRanges['192.0.0.0/29'] = array('192.0.0.0', '192.0.0.7');
 
 // 192.0.2.0/24
-$reserverdRanges['192.0.2.0/24'] = array('192.0.2.0', '192.0.2.255');
+$reservedRanges['192.0.2.0/24'] = array('192.0.2.0', '192.0.2.255');
 
 // 198.18.0.0/15
-$reserverdRanges['198.18.0.0/15'] = array('198.18.0.0', '198.19.255.255');
+$reservedRanges['198.18.0.0/15'] = array('198.18.0.0', '198.19.255.255');
 
 // 198.51.100.0/24
-$reserverdRanges['198.51.100.0/24'] = array('198.51.100.0', '198.51.100.255');
+$reservedRanges['198.51.100.0/24'] = array('198.51.100.0', '198.51.100.255');
 
 // 192.88.99.0/24
-$reserverdRanges['192.88.99.0/24'] = array('192.88.99.0', '192.88.99.255');
+$reservedRanges['192.88.99.0/24'] = array('192.88.99.0', '192.88.99.255');
 
 // 192.168.0.0/16
-$reserverdRanges['192.168.0.0/16'] = array('192.168.0.0', '192.168.255.255');
+$reservedRanges['192.168.0.0/16'] = array('192.168.0.0', '192.168.255.255');
 
 // 203.0.113.0/24
-$reserverdRanges['203.0.113.0/24'] = array('203.0.113.0', '203.0.113.255');
+$reservedRanges['203.0.113.0/24'] = array('203.0.113.0', '203.0.113.255');
 
 // 240.0.0.0/4 + 255.255.255.255/32
-$reserverdRanges['240.0.0.0/4'] = array('224.0.0.0', '255.255.255.255');
+$reservedRanges['240.0.0.0/4'] = array('224.0.0.0', '255.255.255.255');
 
-foreach ($reserverdRanges as $key => $range) {
+foreach ($reservedRanges as $key => $range) {
 	list($min, $max) = $range;
 	var_dump($key);
 	var_dump(filter_var($min, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 | FILTER_FLAG_NO_RES_RANGE));
@@ -85,20 +85,23 @@ string(10) "10.0.0.0/8"
 bool(false)
 bool(false)
 string(14) "168.254.0.0/16"
-bool(false)
-bool(false)
+string(11) "169.254.0.0"
+string(15) "169.254.255.255"
 string(13) "172.16.0.0/12"
 bool(false)
 bool(false)
 string(14) "192.168.0.0/16"
 bool(false)
 bool(false)
+string(9) "0.0.0.0/8"
+bool(false)
+bool(false)
 string(10) "10.0.0.0/8"
-bool(false)
-bool(false)
+string(8) "10.0.0.0"
+string(14) "10.255.255.255"
 string(12) "10.64.0.0/10"
-bool(false)
-bool(false)
+string(10) "100.64.0.0"
+string(15) "100.127.255.255"
 string(11) "127.0.0.0/8"
 bool(false)
 bool(false)
@@ -106,32 +109,32 @@ string(14) "169.254.0.0/16"
 bool(false)
 bool(false)
 string(13) "172.16.0.0/12"
-bool(false)
-bool(false)
+string(10) "172.16.0.0"
+string(10) "172.31.0.0"
 string(12) "192.0.0.0/24"
-bool(false)
-bool(false)
+string(9) "192.0.0.0"
+string(11) "192.0.0.255"
 string(12) "192.0.0.0/29"
-bool(false)
-bool(false)
+string(9) "192.0.0.0"
+string(9) "192.0.0.7"
 string(12) "192.0.2.0/24"
-bool(false)
-bool(false)
+string(9) "192.0.2.0"
+string(11) "192.0.2.255"
 string(13) "198.18.0.0/15"
-bool(false)
-bool(false)
+string(10) "198.18.0.0"
+string(14) "198.19.255.255"
 string(15) "198.51.100.0/24"
-bool(false)
-bool(false)
+string(12) "198.51.100.0"
+string(14) "198.51.100.255"
 string(14) "192.88.99.0/24"
-bool(false)
-bool(false)
+string(11) "192.88.99.0"
+string(13) "192.88.99.255"
 string(14) "192.168.0.0/16"
-bool(false)
-bool(false)
+string(11) "192.168.0.0"
+string(15) "192.168.255.255"
 string(14) "203.0.113.0/24"
-bool(false)
-bool(false)
+string(11) "203.0.113.0"
+string(13) "203.0.113.255"
 string(11) "240.0.0.0/4"
-bool(false)
+string(9) "224.0.0.0"
 bool(false)

ext/ftp/ftp.c

@@ -291,6 +291,9 @@ ftp_login(ftpbuf_t *ftp, const char *user, const char *pass)
 #endif
 		SSL_CTX_set_options(ctx, ssl_ctx_options);
 
+		/* allow SSL to re-use sessions */
+		SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_BOTH);
+
 		ftp->ssl_handle = SSL_new(ctx);
 		if (ftp->ssl_handle == NULL) {
 			php_error_docref(NULL, E_WARNING, "failed to create the SSL handle");
@@ -1637,7 +1640,7 @@ data_accept(databuf_t *data, ftpbuf_t *ftp)
 
 #ifdef HAVE_FTP_SSL
 	SSL_CTX		*ctx;
-	zend_long ssl_ctx_options = SSL_OP_ALL;
+	SSL_SESSION *session;
 	int err, res;
 	zend_bool retry;
 #endif
@@ -1660,31 +1663,40 @@ data_accepted:
 
 	/* now enable ssl if we need to */
 	if (ftp->use_ssl && ftp->use_ssl_for_data) {
-		ctx = SSL_CTX_new(SSLv23_client_method());
+		ctx = SSL_get_SSL_CTX(ftp->ssl_handle);
 		if (ctx == NULL) {
-			php_error_docref(NULL, E_WARNING, "data_accept: failed to create the SSL context");
+			php_error_docref(NULL, E_WARNING, "data_accept: failed to retreive the existing SSL context");
 			return 0;
 		}
 
-#if OPENSSL_VERSION_NUMBER >= 0x0090605fL
-		ssl_ctx_options &= ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
-#endif
-		SSL_CTX_set_options(ctx, ssl_ctx_options);
-
 		data->ssl_handle = SSL_new(ctx);
 		if (data->ssl_handle == NULL) {
 			php_error_docref(NULL, E_WARNING, "data_accept: failed to create the SSL handle");
-			SSL_CTX_free(ctx);
 			return 0;
 		}
 
-
 		SSL_set_fd(data->ssl_handle, data->fd);
 
 		if (ftp->old_ssl) {
 			SSL_copy_session_id(data->ssl_handle, ftp->ssl_handle);
 		}
 
+		/* get the session from the control connection so we can re-use it */
+		session = SSL_get_session(ftp->ssl_handle);
+		if (session == NULL) {
+			php_error_docref(NULL, E_WARNING, "data_accept: failed to retreive the existing SSL session");
+			SSL_free(data->ssl_handle);
+			return 0;
+		}
+
+		/* and set it on the data connection */
+		res = SSL_set_session(data->ssl_handle, session);
+		if (res == 0) {
+			php_error_docref(NULL, E_WARNING, "data_accept: failed to set the existing SSL session");
+			SSL_free(data->ssl_handle);
+			return 0;
+		}
+
 		do {
 			res = SSL_connect(data->ssl_handle);
 			err = SSL_get_error(data->ssl_handle, res);
@@ -1745,10 +1757,7 @@ data_close(ftpbuf_t *ftp, databuf_t *data)
 	if (data->listener != -1) {
 #ifdef HAVE_FTP_SSL
 		if (data->ssl_active) {
-
-			ctx = SSL_get_SSL_CTX(data->ssl_handle);
-			SSL_CTX_free(ctx);
-
+			/* don't free the data context, it's the same as the control */
 			SSL_shutdown(data->ssl_handle);
 			SSL_free(data->ssl_handle);
 			data->ssl_active = 0;
@@ -1759,9 +1768,7 @@ data_close(ftpbuf_t *ftp, databuf_t *data)
 	if (data->fd != -1) {
 #ifdef HAVE_FTP_SSL
 		if (data->ssl_active) {
-			ctx = SSL_get_SSL_CTX(data->ssl_handle);
-			SSL_CTX_free(ctx);
-
+			/* don't free the data context, it's the same as the control */
 			SSL_shutdown(data->ssl_handle);
 			SSL_free(data->ssl_handle);
 			data->ssl_active = 0;

ext/ftp/tests/cert.pem

@@ -1,48 +1,49 @@
------BEGIN CERTIFICATE REQUEST-----
-MIIBmzCCAQQCAQAwWzELMAkGA1UEBhMCUFQxCzAJBgNVBAgTAkx4MQswCQYDVQQH
-EwJMeDEcMBoGA1UEChMTQSBtaW5oYSBlbXByZXNhLCBTQTEUMBIGA1UECxMLUEhQ
-IFFBIFRlYW0wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAM9mfEOSYwXf58ch
-4NyO1QOU1XMfquz8OVpvMUITABLAevZpeQn6vZPHNyXHFQC0QC8scydK1rAYd2U+
-9K2aPub6ioMjYyjPpAE07l9EAAPUEBlqqsziB/wT8QjWkByyJEkYu+o0Wyjokhfn
-BMPvm52wLWUx9nvUeNDCftnKg1wxAgMBAAGgADANBgkqhkiG9w0BAQQFAAOBgQDD
-s1FeqPxnF2bWj8/dG8MyPaRfOAMVz1UsCZUciXIVG5LSIvR2qnMC3iEYt3s13sEq
-z8VJlNHa8nniE+VFNv093yIu+PlWXMEvb5y5EFqP2AYq3RAT+SJsSxGqIdzPZiKY
-INaktLCZmQ/E1v7/4hFzVRq9ydJI82DVS1nv282Whw==
------END CERTIFICATE REQUEST-----
 -----BEGIN CERTIFICATE-----
-MIIC4zCCAkygAwIBAgIBADANBgkqhkiG9w0BAQQFADBbMQswCQYDVQQGEwJQVDEL
-MAkGA1UECBMCTHgxCzAJBgNVBAcTAkx4MRwwGgYDVQQKExNBIG1pbmhhIGVtcHJl
-c2EsIFNBMRQwEgYDVQQLEwtQSFAgUUEgVGVhbTAeFw0wNjExMTkxODIzNTNaFw0w
-NzExMTkxODIzNTNaMFsxCzAJBgNVBAYTAlBUMQswCQYDVQQIEwJMeDELMAkGA1UE
-BxMCTHgxHDAaBgNVBAoTE0EgbWluaGEgZW1wcmVzYSwgU0ExFDASBgNVBAsTC1BI
-UCBRQSBUZWFtMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPZnxDkmMF3+fH
-IeDcjtUDlNVzH6rs/DlabzFCEwASwHr2aXkJ+r2TxzclxxUAtEAvLHMnStawGHdl
-PvStmj7m+oqDI2Moz6QBNO5fRAAD1BAZaqrM4gf8E/EI1pAcsiRJGLvqNFso6JIX
-5wTD75udsC1lMfZ71HjQwn7ZyoNcMQIDAQABo4G2MIGzMB0GA1UdDgQWBBTIga5L
-q+Ub1SWXgNZRYCpq3c8Z+jCBgwYDVR0jBHwweoAUyIGuS6vlG9Ull4DWUWAqat3P
-GfqhX6RdMFsxCzAJBgNVBAYTAlBUMQswCQYDVQQIEwJMeDELMAkGA1UEBxMCTHgx
-HDAaBgNVBAoTE0EgbWluaGEgZW1wcmVzYSwgU0ExFDASBgNVBAsTC1BIUCBRQSBU
-ZWFtggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAe6AA8aC3KDI8
-smd+7XWjaTSp1Q0uMkEZ2PEBzif2I1aPPqw1CQykJ1iDdC/8PJ1yEIezloP2XQoZ
-NjTaCO+uubay03ncoPTZvDUwExN9BYFAYgc2z3tLMHYbA7kM2sIbKys7ZQegLibr
-TSKYQOBeYA/FB9GHECJGU3zBRvYi+Og=
+MIIDhTCCAm2gAwIBAgIJAN75FFz+owOAMA0GCSqGSIb3DQEBCwUAMFkxCzAJBgNV
+BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX
+aWRnaXRzIFB0eSBMdGQxEjAQBgNVBAMMCTEyNy4wLjAuMTAeFw0xNjA3MjUxMjM3
+MTJaFw0yNjA3MjMxMjM3MTJaMFkxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21l
+LVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQxEjAQBgNV
+BAMMCTEyNy4wLjAuMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALtG
+AIrNUDItISfpAqztL2TFEWEHLGTzCEh5Ag2sdMD7UYbqIPHLOE4EINv+dqEMM0Nz
+LYnw7ChtVegXT907xCaQcmeDFSdhqze4L8zawDfnn4syB8XAwGYJfpstYwe3nO6+
+0WvLSb1A5TYNeyoXjwlAUKElxkeWAo51uhR41GDhDQ9GgpqX1ccAhmSoUhgIRSzf
+6f4KE3WTdzl1p12ZtkYHB8Jo2jB/JXnwGOz6isLnpRvkex4B7sUX+7u1MqK/e1X7
+Hi1G/VkaAfC2SOfjTePtGBDBXrQ1arYXDPRA04sgFzSh55l7lC/4HasQ/jAb3h95
+dcEIqyc69iioaN1c1NcCAwEAAaNQME4wHQYDVR0OBBYEFNv3kefb1H+6/6CpjiBi
++I2s9E90MB8GA1UdIwQYMBaAFNv3kefb1H+6/6CpjiBi+I2s9E90MAwGA1UdEwQF
+MAMBAf8wDQYJKoZIhvcNAQELBQADggEBAIzSEWpHSaBs7KduBRXX5+qFxBN6OCPl
+7ID0rxAOYfw7ruzbmwgOpBgMIHGn+KqA6CmQI0jh9bZbv5TV2aFpFsUihugPc2lW
+5EshCozxlEPmIJNsO8jDqPE4w3m4KiVTscRWjBa5cco+lwLDqboerm2l7vvrtr6B
+pgLaZct1c73MouvoJSCGK5EOGW7jsgaxjxJ3UZug+24Ko1wulO2cgBLhda9Ilrnx
+CIKI9h8Z2WVWuVQfyCyO1g7XkJgkBec77OhxD+m4onzPY6waqnnhmFOBcS+gKgBV
+jHeK9DCvZ9zet3EyEp6fyQOOtsC+gU0piYgfsQL7aCp5oLe+fjTiuUY=
 -----END CERTIFICATE-----
------BEGIN RSA PRIVATE KEY-----
-Proc-Type: 4,ENCRYPTED
-DEK-Info: DES-EDE3-CBC,928762DB6DE222AD
-
-oOxNUBX0wrqmRqb3IEZMogc1bnVm6JoW6YFjGfHNcIz0jS7UPDhUFDR26y0dYujL
-LEgxOcYo8ItvGcXSRbs+3W7lISbosgkB0DOaKx5jVmOGwUVRergUUSY8rbf93FtP
-27CEvAfsU6do5HmlJ34mYZW1k+onCznlJXJkupQ5jmiily3GwEdr/5mMIVOmXQ6p
-xWkxHySDKyVbR0v4JY3SJLRBuhgofYNG5155PiqZ7KwYY4Aw60eVgINsvJCF9/8b
-kEj+lecHbBdAf7N82320Ga+F+VeFnUl0gWFjoIF9UFCO80+7ZvIGdGlyPkr4zMvt
-TsC1snJQdHg+IlT3sGayYrQANpTG6GPYhn3KEvK5aqq+bPEe5lija0gw34jbPCo+
-TjHR76lToxzubGZODyyF/rjl5KwUbqTCNuv1PX1jTx7n7sCbu+KHpqXMhTHLKtby
-+Wh7WAfsVrbIW+P85/mkfhPbPZ2621f9cyStdFGgWU4dHdD00HIGOgAJvUSbC2Au
-oVUoKf2818t1s9aA4ptog04sNi+Ixu+z+3yYNLZj51j4ZX3KuXxLIiQvlvFQ8LQi
-RHGQk3u2W3iNtDKKUQjMPaB2FlVtC7FmtHBCpRmos6ld240DDyucqMdIDTMaqV0+
-sL4X+LIeBM/hP/IquRTuQBHBmgjkN4845ihTUJOanyKx605ANq/roHzXrbIxhR5p
-pcJLCBMLMWgdOCJMZRavSq04iXeNfP6Mk/joVpHS62Ljdfc94BBLfsOKOErA20Nq
-lfvbZqy2tI5IIDoq05S8FU0DYNqq/hyrv9Udo8IAo+WkBOABm0x/WA==
------END RSA PRIVATE KEY-----
- 
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC7RgCKzVAyLSEn
+6QKs7S9kxRFhByxk8whIeQINrHTA+1GG6iDxyzhOBCDb/nahDDNDcy2J8OwobVXo
+F0/dO8QmkHJngxUnYas3uC/M2sA355+LMgfFwMBmCX6bLWMHt5zuvtFry0m9QOU2
+DXsqF48JQFChJcZHlgKOdboUeNRg4Q0PRoKal9XHAIZkqFIYCEUs3+n+ChN1k3c5
+daddmbZGBwfCaNowfyV58Bjs+orC56Ub5HseAe7FF/u7tTKiv3tV+x4tRv1ZGgHw
+tkjn403j7RgQwV60NWq2Fwz0QNOLIBc0oeeZe5Qv+B2rEP4wG94feXXBCKsnOvYo
+qGjdXNTXAgMBAAECggEAD7yDISa9fWnjZlojGmrX16zjl/alWVo+sPBSJtn9+ZVk
+tWSJHihIc+3O4Q2R5FiFGj7cbcHr5j3BwT3sPRfflKoAowgVx/hiDc2RXrJnAouZ
+EXZDxu86e5iCpgF7V9OrATjRmjA74wZH/HHHjrLqFwnrfI8TCULmthfYag35Mqax
+qrIEzvSuYdaGxblNe+ZfnVEDW2F9DLBGcma0ffUlJp8AvV7bpo8Rj/JovPxit/VS
+UdwSRxwSAugctFpmcGlFkoQfxUx1WdEy8hjopLrayMjCCJvRUL4+C4zT9r9PBHOj
+fCSbJ+ajQIoRrgaL9bURk8BFMHY8+yMUsWEYVSmFAQKBgQDtOvPkhvZsNocUB5nJ
+ti3SXyDQ6OZQuKKHPSeDV/EvmZKeNlrQ1ZnwXLP3vkcedDOkt1nEVq/hUewpjt08
+2MvmMwJBQEnmbTzMf43DtlXsStdP1lhYaFbU4iMM5zRfyBHDu1GPZEPXvKKpJUk0
+M+jYIyTAP3mcZhqDKn0mPVP7VwKBgQDKFy9DtWFKxCvhFQvHx7YeZiVWJbIst/O4
+ZyuPVAErni0hzSeCkmm7+F9hgEdPSLRcSaeTWP4L0u1cixECKboIhoNs38aft7o3
+MdnI2RDSEKtKX2uVuhvpGDNuGpBAc8Qu8iCiv5INSC36ZhD1h++O/TiiUdgRJ3yX
+yeG7ej+CgQKBgCR5F95e0aw5hfMSaBaXJ9xcO9Niu2ZVvMdGI7kR4EcNOXmRqczJ
+ym0mE5VXb9/Cxd3hQq/pFAl0avbIvEMKoe62kPYvSC1hRiO6yLT6Z6N4rjncHqEZ
+CaCZVAI72dWQEQsi1ZtSMwwMOIYA8YxRHs98N75HBA+DszfPZIZoj2zpAoGBAJHp
+B3ElhmeLF/tdTLIj2bQ9H/wBH5H2Bvw/UU4c4vNxMzjSfRJjUAAtpgAptFLkNYTk
+kR9sA5DZ7BMDPXaIVg9Nv5peP3SWHNc5IPtI7kIdUu9R0cW7J+e2V3vJphlC/ITA
+wRuAoZ0BXmEKTHhae3aMEdXwrcZE8kpNsrO/4hcBAoGBAMISiPJPuxAX1UtqcxTa
+mDJfnQ2gxRu6AK9VmXqo0X4IBxDSnTjcL0huUlS849wgsE5oTXgdYb2hn+TXM5JJ
+NsEXLhV09X1mrk4M4LV1npd0mYxvFsO4+p+IX5YLiahInmQtq0gx3DWE8wouVFER
+4yzfp27z8MZT8Qvr/ZI9lzWd
+-----END PRIVATE KEY-----

ext/ftp/tests/server.inc

@@ -2,7 +2,7 @@
 
 $socket = null;
 $errno = 0;
-$context = stream_context_create(array('ssl' => array('local_cert' => dirname(__FILE__).'/cert.pem', 'passphrase' => 'pass')));
+$context = stream_context_create(array('ssl' => array('local_cert' => dirname(__FILE__).'/cert.pem')));
 
 for ($i=0; $i<10 && !$socket; ++$i) {
 	$port = rand(50000, 65535);
@@ -139,7 +139,10 @@ if ($pid) {
 			$buf = fread($s, 2048);
 		}
 
-		if (!preg_match('/^USER (\w+)\r\n$/', $buf, $m)) {
+		if ($buf == "AUTH TLS\r\n") {
+		   fputs($s, "500 not supported.\r\n");
+		   return ;
+		} else if (!preg_match('/^USER (\w+)\r\n$/', $buf, $m)) {
 			fputs($s, "500 Syntax error, command unrecognized.\r\n");
 			dump_and_exit($buf);
 		}
@@ -208,6 +211,10 @@ if ($pid) {
 			$ascii = true;
 			fputs($s, "200 OK\r\n");
 
+		} elseif ($buf === "AUTH SSL\r\n") {
+			$ascii = true;
+			fputs($s, "500 not supported\r\n");
+
 		} elseif ($buf === "TYPE I\r\n") {
 			$ascii = false;
 			fputs($s, "200 OK\r\n");
@@ -265,7 +272,7 @@ if ($pid) {
 
 		} elseif (preg_match("~^NLST(?: ([A-Za-z./]+))?\r\n$~", $buf, $m)) {
 
-			if (isset($m[1]) && $m[1] === 'bogusdir') {
+			if (isset($m[1]) && (($m[1] === 'bogusdir') || ($m[1] === '/bogusdir'))) {
 				fputs($s, "250 $m[1]: No such file or directory\r\n");
 				continue;
 			}
@@ -276,11 +283,20 @@ if ($pid) {
 				continue;
 			}
 
-			fputs($s, "150 File status okay; about to open data connection\r\n");
+			if (empty($pasv)) {
+				fputs($s, "150 File status okay; about to open data connection\r\n");
+				if (!$fs = stream_socket_client("tcp://$host:$port")) {
+					fputs($s, "425 Can't open data connection\r\n");
+					continue;
+				}
+			} else {
+				fputs($s, "125 Data connection already open; transfer starting.\r\n");
+				$fs=$pasvs;
+			}
 
-			if (!$fs = stream_socket_client("tcp://$host:$port")) {
-				fputs($s, "425 Can't open data connection\r\n");
-				continue;
+
+			if ((!empty($ssl)) && (!stream_socket_enable_crypto($pasvs, true, STREAM_CRYPTO_METHOD_SSLv23_SERVER))) {
+				die("SSLv23 handshake failed.\n");
 			}
 
 			if (empty($m[1]) || $m[1] !== 'emptydir') {
@@ -368,7 +384,7 @@ if ($pid) {
                                         }
 					fputs($s, "226 Closing data Connection.\r\n");
                                         break;
-                case "mediumfile":
+				case "mediumfile":
 					fputs($s, "150 File status okay; about to open data connection.\r\n");
 					for($i = 0; $i < 150; $i++){
 						fputs($fs, "This is line $i of the test data.\n");
@@ -384,13 +400,22 @@ if ($pid) {
 
 
 		}elseif (preg_match('/^PASV/', $buf, $matches)) {
-			$port = $pasv_port;
-			$p2 = $port % ((int) 1 << 8);
-			$p1 = ($port-$p2)/((int) 1 << 8);
+			$pasv=true;
+			$p2 = $pasv_port % ((int) 1 << 8);
+			$p1 = ($pasv_port-$p2)/((int) 1 << 8);
 			$host = "127.0.0.1";
+			if (!empty($ssl)) {
+				$soc = stream_socket_server("tcp://127.0.0.1:$pasv_port", $errno, $errstr, STREAM_SERVER_BIND|STREAM_SERVER_LISTEN, $context);
+			} else {
+				$soc = stream_socket_server("tcp://127.0.0.1:$pasv_port");
+			}
+
 			fputs($s, "227 Entering Passive Mode. (127,0,0,1,{$p1},{$p2})\r\n");
 
+			$pasvs = stream_socket_accept($soc,10);
 
+		}elseif (preg_match('/^EPSV/', $buf, $matches)) {
+			fputs($s, "550 Extended passsive mode not supported.\r\n");
 		} elseif (preg_match('/^SITE EXEC/', $buf, $matches)) {
 			fputs($s, "200 OK\r\n");
 

ext/gd/gd.c

@@ -361,45 +361,45 @@ ZEND_END_ARG_INFO()
 
 ZEND_BEGIN_ARG_INFO_EX(arginfo_imagegif, 0, 0, 1)
 	ZEND_ARG_INFO(0, im)
-	ZEND_ARG_INFO(0, filename)
+	ZEND_ARG_INFO(0, to)
 ZEND_END_ARG_INFO()
 
 #ifdef HAVE_GD_PNG
 ZEND_BEGIN_ARG_INFO_EX(arginfo_imagepng, 0, 0, 1)
 	ZEND_ARG_INFO(0, im)
-	ZEND_ARG_INFO(0, filename)
+	ZEND_ARG_INFO(0, to)
 ZEND_END_ARG_INFO()
 #endif
 
 #ifdef HAVE_GD_WEBP
 ZEND_BEGIN_ARG_INFO_EX(arginfo_imagewebp, 0, 0, 1)
 	ZEND_ARG_INFO(0, im)
-	ZEND_ARG_INFO(0, filename)
+	ZEND_ARG_INFO(0, to)
 ZEND_END_ARG_INFO()
 #endif
 
 #ifdef HAVE_GD_JPG
 ZEND_BEGIN_ARG_INFO_EX(arginfo_imagejpeg, 0, 0, 1)
 	ZEND_ARG_INFO(0, im)
-	ZEND_ARG_INFO(0, filename)
+	ZEND_ARG_INFO(0, to)
 	ZEND_ARG_INFO(0, quality)
 ZEND_END_ARG_INFO()
 #endif
 
 ZEND_BEGIN_ARG_INFO_EX(arginfo_imagewbmp, 0, 0, 1)
 	ZEND_ARG_INFO(0, im)
-	ZEND_ARG_INFO(0, filename)
+	ZEND_ARG_INFO(0, to)
 	ZEND_ARG_INFO(0, foreground)
 ZEND_END_ARG_INFO()
 
 ZEND_BEGIN_ARG_INFO_EX(arginfo_imagegd, 0, 0, 1)
 	ZEND_ARG_INFO(0, im)
-	ZEND_ARG_INFO(0, filename)
+	ZEND_ARG_INFO(0, to)
 ZEND_END_ARG_INFO()
 
 ZEND_BEGIN_ARG_INFO_EX(arginfo_imagegd2, 0, 0, 1)
 	ZEND_ARG_INFO(0, im)
-	ZEND_ARG_INFO(0, filename)
+	ZEND_ARG_INFO(0, to)
 	ZEND_ARG_INFO(0, chunk_size)
 	ZEND_ARG_INFO(0, type)
 ZEND_END_ARG_INFO()
@@ -1444,6 +1444,7 @@ PHP_FUNCTION(imagesetstyle)
 	gdImagePtr im;
 	int *stylearr;
 	int index = 0;
+    uint32_t num_styles;
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "ra", &IM, &styles) == FAILURE)  {
 		return;
@@ -1453,8 +1454,14 @@ PHP_FUNCTION(imagesetstyle)
 		RETURN_FALSE;
 	}
 
+    num_styles = zend_hash_num_elements(Z_ARRVAL_P(styles));
+    if (num_styles == 0) {
+        php_error_docref(NULL, E_WARNING, "styles array must not be empty");
+        RETURN_FALSE;
+    }
+
 	/* copy the style values in the stylearr */
-	stylearr = safe_emalloc(sizeof(int), zend_hash_num_elements(Z_ARRVAL_P(styles)), 0);
+	stylearr = safe_emalloc(sizeof(int), num_styles, 0);
 
 	ZEND_HASH_FOREACH_VAL(Z_ARRVAL_P(styles), item) {
 		stylearr[index++] = zval_get_long(item);
@@ -1514,7 +1521,7 @@ PHP_FUNCTION(imageistruecolor)
 /* }}} */
 
 /* {{{ proto void imagetruecolortopalette(resource im, bool ditherFlag, int colorsWanted)
-   Convert a true colour image to a palette based image with a number of colours, optionally using dithering. */
+   Convert a true color image to a palette based image with a number of colors, optionally using dithering. */
 PHP_FUNCTION(imagetruecolortopalette)
 {
 	zval *IM;
@@ -1530,18 +1537,18 @@ PHP_FUNCTION(imagetruecolortopalette)
 		RETURN_FALSE;
 	}
 
-	if (ncolors <= 0) {
-		php_error_docref(NULL, E_WARNING, "Number of colors has to be greater than zero");
+	if (ncolors <= 0 || ZEND_LONG_INT_OVFL(ncolors)) {
+		php_error_docref(NULL, E_WARNING, "Number of colors has to be greater than zero and no more than %d", INT_MAX);
 		RETURN_FALSE;
 	}
-	gdImageTrueColorToPalette(im, dither, ncolors);
+	gdImageTrueColorToPalette(im, dither, (int)ncolors);
 
 	RETURN_TRUE;
 }
 /* }}} */
 
-/* {{{ proto void imagetruecolortopalette(resource im, bool ditherFlag, int colorsWanted)
-   Convert a true colour image to a palette based image with a number of colours, optionally using dithering. */
+/* {{{ proto void imagepalettetotruecolor(resource im)
+   Convert a palette based image to a true color image. */
 PHP_FUNCTION(imagepalettetotruecolor)
 {
 	zval *IM;
@@ -2674,7 +2681,7 @@ PHP_FUNCTION(imagexbm)
 }
 /* }}} */
 
-/* {{{ proto bool imagegif(resource im [, string filename])
+/* {{{ proto bool imagegif(resource im [, mixed to])
    Output GIF image to browser or file */
 PHP_FUNCTION(imagegif)
 {
@@ -2683,7 +2690,7 @@ PHP_FUNCTION(imagegif)
 /* }}} */
 
 #ifdef HAVE_GD_PNG
-/* {{{ proto bool imagepng(resource im [, string filename])
+/* {{{ proto bool imagepng(resource im [, mixed to])
    Output PNG image to browser or file */
 PHP_FUNCTION(imagepng)
 {
@@ -2694,7 +2701,7 @@ PHP_FUNCTION(imagepng)
 
 
 #ifdef HAVE_GD_WEBP
-/* {{{ proto bool imagewebp(resource im [, string filename[, int quality]] )
+/* {{{ proto bool imagewebp(resource im [, mixed to[, int quality]] )
    Output WEBP image to browser or file */
 PHP_FUNCTION(imagewebp)
 {
@@ -2705,7 +2712,7 @@ PHP_FUNCTION(imagewebp)
 
 
 #ifdef HAVE_GD_JPG
-/* {{{ proto bool imagejpeg(resource im [, string filename [, int quality]])
+/* {{{ proto bool imagejpeg(resource im [, mixed to [, int quality]])
    Output JPEG image to browser or file */
 PHP_FUNCTION(imagejpeg)
 {
@@ -2714,7 +2721,7 @@ PHP_FUNCTION(imagejpeg)
 /* }}} */
 #endif /* HAVE_GD_JPG */
 
-/* {{{ proto bool imagewbmp(resource im [, string filename [, int foreground]])
+/* {{{ proto bool imagewbmp(resource im [, mixed to [, int foreground]])
    Output WBMP image to browser or file */
 PHP_FUNCTION(imagewbmp)
 {
@@ -2722,7 +2729,7 @@ PHP_FUNCTION(imagewbmp)
 }
 /* }}} */
 
-/* {{{ proto bool imagegd(resource im [, string filename])
+/* {{{ proto bool imagegd(resource im [, mixed to])
    Output GD image to browser or file */
 PHP_FUNCTION(imagegd)
 {
@@ -2730,7 +2737,7 @@ PHP_FUNCTION(imagegd)
 }
 /* }}} */
 
-/* {{{ proto bool imagegd2(resource im [, string filename [, int chunk_size [, int type]]])
+/* {{{ proto bool imagegd2(resource im [, mixed to [, int chunk_size [, int type]]])
    Output GD2 image to browser or file */
 PHP_FUNCTION(imagegd2)
 {
@@ -3032,6 +3039,11 @@ PHP_FUNCTION(imagegammacorrect)
 		return;
 	}
 
+	if ( input <= 0.0 || output <= 0.0 ) {
+		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Gamma values should be positive");
+		RETURN_FALSE;
+	}
+
 	if ((im = (gdImagePtr)zend_fetch_resource(Z_RES_P(IM), "Image", le_gd)) == NULL) {
 		RETURN_FALSE;
 	}
@@ -4059,6 +4071,7 @@ static void _php_image_convert(INTERNAL_FUNCTION_PARAMETERS, int image_type )
 	dest = VCWD_FOPEN(fn_dest, "wb");
 	if (!dest) {
 		php_error_docref(NULL, E_WARNING, "Unable to open '%s' for writing", fn_dest);
+        fclose(org);
 		RETURN_FALSE;
 	}
 
@@ -4067,6 +4080,8 @@ static void _php_image_convert(INTERNAL_FUNCTION_PARAMETERS, int image_type )
 			im_org = gdImageCreateFromGif(org);
 			if (im_org == NULL) {
 				php_error_docref(NULL, E_WARNING, "Unable to open '%s' Not a valid GIF file", fn_dest);
+                fclose(org);
+                fclose(dest);
 				RETURN_FALSE;
 			}
 			break;
@@ -4077,6 +4092,8 @@ static void _php_image_convert(INTERNAL_FUNCTION_PARAMETERS, int image_type )
 			im_org = gdImageCreateFromJpegEx(org, ignore_warning);
 			if (im_org == NULL) {
 				php_error_docref(NULL, E_WARNING, "Unable to open '%s' Not a valid JPEG file", fn_dest);
+                fclose(org);
+                fclose(dest);
 				RETURN_FALSE;
 			}
 			break;
@@ -4087,6 +4104,8 @@ static void _php_image_convert(INTERNAL_FUNCTION_PARAMETERS, int image_type )
 			im_org = gdImageCreateFromPng(org);
 			if (im_org == NULL) {
 				php_error_docref(NULL, E_WARNING, "Unable to open '%s' Not a valid PNG file", fn_dest);
+                fclose(org);
+                fclose(dest);
 				RETURN_FALSE;
 			}
 			break;
@@ -4094,10 +4113,14 @@ static void _php_image_convert(INTERNAL_FUNCTION_PARAMETERS, int image_type )
 
 		default:
 			php_error_docref(NULL, E_WARNING, "Format not supported");
+            fclose(org);
+            fclose(dest);
 			RETURN_FALSE;
 			break;
 	}
 
+	fclose(org);
+
 	org_width  = gdImageSX (im_org);
 	org_height = gdImageSY (im_org);
 
@@ -4128,6 +4151,8 @@ static void _php_image_convert(INTERNAL_FUNCTION_PARAMETERS, int image_type )
 	im_tmp = gdImageCreate (dest_width, dest_height);
 	if (im_tmp == NULL ) {
 		php_error_docref(NULL, E_WARNING, "Unable to allocate temporary buffer");
+        fclose(dest);
+        gdImageDestroy(im_org);
 		RETURN_FALSE;
 	}
 
@@ -4135,23 +4160,29 @@ static void _php_image_convert(INTERNAL_FUNCTION_PARAMETERS, int image_type )
 
 	gdImageDestroy(im_org);
 
-	fclose(org);
-
 	im_dest = gdImageCreate(dest_width, dest_height);
 	if (im_dest == NULL) {
 		php_error_docref(NULL, E_WARNING, "Unable to allocate destination buffer");
+        fclose(dest);
+        gdImageDestroy(im_tmp);
 		RETURN_FALSE;
 	}
 
 	white = gdImageColorAllocate(im_dest, 255, 255, 255);
 	if (white == -1) {
 		php_error_docref(NULL, E_WARNING, "Unable to allocate the colors for the destination buffer");
+        fclose(dest);
+        gdImageDestroy(im_tmp);
+        gdImageDestroy(im_dest);
 		RETURN_FALSE;
 	}
 
 	black = gdImageColorAllocate(im_dest, 0, 0, 0);
 	if (black == -1) {
 		php_error_docref(NULL, E_WARNING, "Unable to allocate the colors for the destination buffer");
+        fclose(dest);
+        gdImageDestroy(im_tmp);
+        gdImageDestroy(im_dest);
 		RETURN_FALSE;
 	}
 

ext/gd/libgd/gd.c

@@ -2245,7 +2245,9 @@ void gdImageCopy (gdImagePtr dst, gdImagePtr src, int dstX, int dstY, int srcX,
 			for (y = 0; (y < h); y++) {
 				for (x = 0; (x < w); x++) {
 					int c = gdImageGetTrueColorPixel (src, srcX + x, srcY + y);
-					gdImageSetPixel (dst, dstX + x, dstY + y, c);
+					if (c != src->transparent) {
+						gdImageSetPixel (dst, dstX + x, dstY + y, c);
+					}
 				}
 			}
 		} else {
@@ -2262,26 +2264,6 @@ void gdImageCopy (gdImagePtr dst, gdImagePtr src, int dstX, int dstY, int srcX,
 		return;
 	}
 
-	/* Destination is palette based */
-	if (src->trueColor) { /* But source is truecolor (Ouch!) */
-		toy = dstY;
-		for (y = srcY; (y < (srcY + h)); y++) {
-			tox = dstX;
-			for (x = srcX; x < (srcX + w); x++) {
-				int nc;
-				c = gdImageGetPixel (src, x, y);
-
-				/* Get best match possible. */
-				nc = gdImageColorResolveAlpha(dst, gdTrueColorGetRed(c), gdTrueColorGetGreen(c), gdTrueColorGetBlue(c), gdTrueColorGetAlpha(c));
-
-				gdImageSetPixel(dst, tox, toy, nc);
-				tox++;
-			}
-			toy++;
-		}
-		return;
-	}
-
 	/* Palette based to palette based */
 	for (i = 0; i < gdMaxColors; i++) {
 		colorMap[i] = (-1);

ext/gd/libgd/gd_interpolation.c

@@ -1509,13 +1509,8 @@ gdImagePtr gdImageScaleBicubicFixed(gdImagePtr src, const unsigned int width, co
 				src_offset_y[0] = m;
 			}
 
-			if (m < 1) {
-				src_offset_x[1] = n;
-				src_offset_y[1] = m;
-			} else {
-				src_offset_x[1] = n;
-				src_offset_y[1] = m;
-			}
+			src_offset_x[1] = n;
+			src_offset_y[1] = m;
 
 			if ((m < 1) || (n >= src_w - 1)) {
 				src_offset_x[2] = n;
@@ -1567,13 +1562,8 @@ gdImagePtr gdImageScaleBicubicFixed(gdImagePtr src, const unsigned int width, co
 				src_offset_y[8] = m;
 			}
 
-			if (m >= src_h - 1) {
-				src_offset_x[8] = n;
-				src_offset_y[8] = m;
-			} else {
-				src_offset_x[9] = n;
-				src_offset_y[9] = m;
-			}
+			src_offset_x[9] = n;
+			src_offset_y[9] = m;
 
 			if ((m >= src_h-1) || (n >= src_w-1)) {
 				src_offset_x[10] = n;
@@ -1599,13 +1589,8 @@ gdImagePtr gdImageScaleBicubicFixed(gdImagePtr src, const unsigned int width, co
 				src_offset_y[12] = m;
 			}
 
-			if (m >= src_h - 2) {
-				src_offset_x[13] = n;
-				src_offset_y[13] = m;
-			} else {
-				src_offset_x[13] = n;
-				src_offset_y[13] = m;
-			}
+			src_offset_x[13] = n;
+			src_offset_y[13] = m;
 
 			if ((m >= src_h - 2) || (n >= src_w - 1)) {
 				src_offset_x[14] = n;
@@ -2014,13 +1999,8 @@ gdImagePtr gdImageRotateBicubicFixed(gdImagePtr src, const float degrees, const
 					src_offset_y[0] = m;
 				}
 
-				if (m < 1) {
-					src_offset_x[1] = n;
-					src_offset_y[1] = m;
-				} else {
-					src_offset_x[1] = n;
-					src_offset_y[1] = m ;
-				}
+				src_offset_x[1] = n;
+				src_offset_y[1] = m;
 
 				if ((m < 1) || (n >= src_w-1)) {
 					src_offset_x[2] = - 1;
@@ -2073,8 +2053,8 @@ gdImagePtr gdImageRotateBicubicFixed(gdImagePtr src, const float degrees, const
 				}
 
 				if (m >= src_h-1) {
-					src_offset_x[8] = - 1;
-					src_offset_y[8] = - 1;
+					src_offset_x[9] = - 1;
+					src_offset_y[9] = - 1;
 				} else {
 					src_offset_x[9] = n;
 					src_offset_y[9] = m;

ext/gd/libgd/gd_topal.c

@@ -760,7 +760,7 @@ LOCAL (void)
   cinfo->colormap[2][icolor] = (JSAMPLE) ((c2total + (total >> 1)) / total);
 #else
   /* 2.0.16: Paul den Dulk found an occasion where total can be 0 */
-  if (count)
+  if (total)
     {
       nim->red[icolor] = (int) ((c0total + (total >> 1)) / total);
       nim->green[icolor] = (int) ((c1total + (total >> 1)) / total);

ext/gd/libgd/gdkanji.c

@@ -329,7 +329,7 @@ han2zen (int *p1, int *p2)
     {
       if ((*p2 >= 74 && *p2 <= 103) || (*p2 >= 110 && *p2 <= 122))
 	(*p2)++;
-      else if (*p2 == 131 && *p2 == 69)
+      else if (*p2 == 131 || *p2 == 69)
 	*p2 = 148;
     }
   else if (handaku && *p2 >= 110 && *p2 <= 122)

ext/gd/tests/bug22544-mb.phpt

@@ -8,16 +8,13 @@ Bug #22544 (TrueColor transparency in PNG images).
 ?>
 --FILE--
 <?php
-	$dest = dirname(realpath(__FILE__)) . '/bug22544私はガラスを食べられます.png';
-	@unlink($dest);
 	$image = imageCreateTruecolor(640, 100);
 	$transparent = imageColorAllocate($image, 0, 0, 0);
 	$red = imageColorAllocate($image, 255, 50, 50);
 	imageColorTransparent($image, $transparent);
 	imageFilledRectangle($image, 0, 0, 640-1, 100-1, $transparent);
-	imagePng($image, $dest);
-	echo md5_file($dest) . "\n";
-	@unlink($dest);
+	include_once __DIR__ . '/func.inc';
+	test_image_equals_file(__DIR__ . '/bug22544私はガラスを食べられます.png', $image);
 ?>
 --EXPECT--
-10a57d09a2c63fad87b85b38d6b258d6
+The images are equal.

ext/gd/tests/bug22544.phpt

@@ -8,16 +8,13 @@ Bug #22544 (TrueColor transparency in PNG images).
 ?>
 --FILE--
 <?php
-	$dest = dirname(realpath(__FILE__)) . '/bug22544.png';
-	@unlink($dest);
 	$image = imageCreateTruecolor(640, 100);
 	$transparent = imageColorAllocate($image, 0, 0, 0);
 	$red = imageColorAllocate($image, 255, 50, 50);
 	imageColorTransparent($image, $transparent);
 	imageFilledRectangle($image, 0, 0, 640-1, 100-1, $transparent);
-	imagePng($image, $dest);
-	echo md5_file($dest) . "\n";
-	@unlink($dest);
+	include_once __DIR__ . '/func.inc';
+	test_image_equals_file(__DIR__ . '/bug22544.png', $image);
 ?>
 --EXPECT--
-10a57d09a2c63fad87b85b38d6b258d6
+The images are equal.