Set versions

Sync NEWS [ci skip]
Merge branch 'PHP-5.6' into PHP-7.0
2026-11-12 11:40:50 +00:00 · 2018-12-04 13:01:42 +01:00 · 2018-12-04 12:49:10 +01:00 · 2018-12-03 10:19:49 -08:00 · 2018-12-03 10:19:08 -08:00 · 2018-12-03 00:42:35 -08:00
405 changed files with 14472 additions and 10031 deletions
@@ -18,13 +18,12 @@ clone_depth: 64

 cache:
        - c:\build-cache
-        - c:\build-cache\sdk -> .appveyor.yml

 environment:
        PHP_BUILD_CACHE_BASE_DIR: c:\build-cache  
        PHP_BUILD_OBJ_DIR: c:\obj
        PHP_BUILD_CACHE_SDK_DIR: c:\build-cache\sdk
-        PHP_BUILD_SDK_BRANCH: php-sdk-2.0.5
+        PHP_BUILD_SDK_BRANCH: php-sdk-2.0.13
        # ext and env setup for tests
        #MYSQL_TEST_PASSWD: Password12!
        #MYSQL_TEST_USER: root
@@ -1,16 +1,35 @@
-; http://editorconfig.org/
+# http://editorconfig.org/

 root = true

-[*.{c,h}]
-charset                  = UTF-8
-end_of_line              = LF
+[*.{c,h,awk,w32,bat,mk,frag}]
+charset                  = utf-8
+end_of_line              = lf
 indent_size              = 4
 indent_style             = tab
-insert_final_newline     = true
 tab_width                = 4
 trim_trailing_whitespace = true
+insert_final_newline     = true

-[*.yml]
+[*.{php,phpt}]
+charset                  = utf-8
+end_of_line              = lf
+indent_size              = 4
+indent_style             = space
+trim_trailing_whitespace = true
+insert_final_newline     = true
+
+[*.{yml,m4,sh}]
+charset                  = utf-8
+end_of_line              = lf
 indent_size              = 2
 indent_style             = space
+trim_trailing_whitespace = true
+insert_final_newline     = true
+
+[*.md]
+charset                  = utf-8
+end_of_line              = lf
+indent_style             = space
+trim_trailing_whitespace = false
+insert_final_newline     = true
@@ -15,11 +15,8 @@ ext/dba/libflatfile/flatfile.c  ident
 ext/dba/libcdb/cdb_make.c       ident
 ext/dba/libcdb/cdb.c            ident
 ext/filter/filter.c             ident
-ext/zip/php_zip.c               ident
 README.input_filter             ident
 run-tests.php                   ident
-sapi/nsapi/nsapi.c              ident
-sapi/continuity/capi.c          ident
 Zend/RFCs/002.txt               ident
 Zend/RFCs/003.txt               ident
 ext/exif/exif.c                 ident
@@ -32,7 +29,6 @@ UPGRADING.INTERNALS             merge=NEWS
 /ext/bz2/tests/with_strings.phpt	-crlf
 /ext/dom/tests/bug40836.phpt	-crlf
 /ext/dom/tests/domelement.phpt	-crlf
-/ext/ereg/tests/eregi_basic_002.phpt	-crlf
 /ext/iconv/tests/iconv004.phpt	-crlf
 /ext/iconv/tests/iconv_basic.phpt	-crlf
 /ext/iconv/tests/iconv_strpos.phpt	-crlf
@@ -262,9 +262,7 @@ pear/phpize
 pear/run-tests
 pear/php-config
 pear/scripts
-sapi/apache/libphp7.module
 sapi/apache2handler/libphp7.module
-sapi/apache_hooks/libphp7.module
 sapi/cgi/php-cgi
 sapi/cgi/php-cgi.1
 sapi/cli/php.1
@@ -1,3 +1,4 @@
+dist: trusty
 language: c
 sudo: false
 addons:
@@ -47,7 +47,7 @@ MAINTENANCE:         Maintained
 STATUS:              Working
 -------------------------------------------------------------------------------
 EXTENSION:           fpm
-PRIMARY MAINTAINER:  Antony Dovgal <tony2001@php.net>, Jerome Loyet <fat@php.net>
+PRIMARY MAINTAINER:  Jakub Zelenka <bukka@php.net>
 MAINTENANCE:         Maintained
 STATUS:              Working
 SINCE:               5.3.3
@@ -5,7 +5,7 @@ INSTALL_DATA = $(INSTALL) -m 644
 DEFS = -DPHP_ATOM_INC -I$(top_builddir)/include -I$(top_builddir)/main -I$(top_srcdir)
 COMMON_FLAGS = $(DEFS) $(INCLUDES) $(EXTRA_INCLUDES) $(CPPFLAGS) $(PHP_FRAMEWORKPATH)

-all: $(all_targets) 
+all: $(all_targets)
 	@echo
 	@echo "Build complete."
 	@echo "Don't forget to run 'make test'."
@@ -112,13 +112,13 @@ test: all
 clean:
 	find . -name \*.gcno -o -name \*.gcda | xargs rm -f
 	find . -name \*.lo -o -name \*.o | xargs rm -f
-	find . -name \*.la -o -name \*.a | xargs rm -f 
+	find . -name \*.la -o -name \*.a | xargs rm -f
 	find . -name \*.so | xargs rm -f
 	find . -name .libs -a -type d|xargs rm -rf
 	rm -f libphp$(PHP_MAJOR_VERSION).la $(SAPI_CLI_PATH) $(SAPI_CGI_PATH) $(SAPI_MILTER_PATH) $(SAPI_LITESPEED_PATH) $(SAPI_FPM_PATH) $(OVERALL_TARGET) modules/* libs/*

 distclean: clean
-	rm -f Makefile config.cache config.log config.status Makefile.objects Makefile.fragments libtool main/php_config.h main/internal_functions_cli.c main/internal_functions.c stamp-h sapi/apache/libphp$(PHP_MAJOR_VERSION).module sapi/apache_hooks/libphp$(PHP_MAJOR_VERSION).module buildmk.stamp Zend/zend_dtrace_gen.h Zend/zend_dtrace_gen.h.bak Zend/zend_config.h TSRM/tsrm_config.h
+	rm -f Makefile config.cache config.log config.status Makefile.objects Makefile.fragments libtool main/php_config.h main/internal_functions_cli.c main/internal_functions.c stamp-h buildmk.stamp Zend/zend_dtrace_gen.h Zend/zend_dtrace_gen.h.bak Zend/zend_config.h TSRM/tsrm_config.h
 	rm -f php7.spec main/build-defs.h scripts/phpize
 	rm -f ext/date/lib/timelib_config.h ext/mbstring/oniguruma/config.h ext/mbstring/libmbfl/config.h ext/oci8/oci8_dtrace_gen.h ext/oci8/oci8_dtrace_gen.h.bak
 	rm -f scripts/man1/phpize.1 scripts/php-config scripts/man1/php-config.1 sapi/cli/php.1 sapi/cgi/php-cgi.1 ext/phar/phar.1 ext/phar/phar.phar.1
@@ -135,7 +135,7 @@ prof-gen:

 prof-clean:
 	find . -name \*.lo -o -name \*.o | xargs rm -f
-	find . -name \*.la -o -name \*.a | xargs rm -f 
+	find . -name \*.la -o -name \*.a | xargs rm -f
 	find . -name \*.so | xargs rm -f
 	rm -f libphp$(PHP_MAJOR_VERSION).la $(SAPI_CLI_PATH) $(SAPI_CGI_PATH) $(SAPI_MILTER_PATH) $(SAPI_LITESPEED_PATH) $(SAPI_FPM_PATH) $(OVERALL_TARGET) modules/* libs/*

@@ -1,8 +1,349 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2017 PHP 7.0.22
+06 Dec 2018 PHP 7.0.33

+- Core:
+  . Fixed bug #77231 (Segfault when using convert.quoted-printable-encode
+    filter). (Stas)

+- IMAP:
+  . Fixed bug #77020 (null pointer dereference in imap_mail). (cmb)
+  . Fixed bug #77153 (imap_open allows to run arbitrary shell commands via
+    mailbox parameter). (Stas)
+
+- Phar:
+  . Fixed bug #77022 (PharData always creates new files with mode 0666). (Stas)
+  . Fixed bug #77143 (Heap Buffer Overflow (READ: 4) in phar_parse_pharfile).
+    (Stas)
+
+13 Sep 2018 PHP 7.0.32
+
+- Apache2
+  . Fixed bug #76582 (XSS due to the header Transfer-Encoding: chunked). (Stas)
+
+19 Jul 2018 PHP 7.0.31
+
+- Exif:
+  . Fixed bug #76423 (Int Overflow lead to Heap OverFlow in
+    exif_thumbnail_extract of exif.c). (Stas)
+  . Fixed bug #76557 (heap-buffer-overflow (READ of size 48) while reading exif
+    data). (Stas)
+
+- Win32:
+  . Fixed bug #76459 (windows linkinfo lacks openbasedir check). (Anatol)
+
+26 Apr 2018 PHP 7.0.30
+
+- Exif:
+  . Fixed bug #76130 (Heap Buffer Overflow (READ: 1786) in exif_iif_add_value).
+  (Stas)
+
+- iconv:
+  . Fixed bug #76249 (stream filter convert.iconv leads to infinite loop on
+    invalid sequence). (Stas)
+
+- LDAP:
+  . Fixed bug #76248 (Malicious LDAP-Server Response causes Crash). (Stas)
+
+- Phar:
+  . Fixed bug #76129 (fix for CVE-2018-5712 may not be complete). (Stas)
+
+29 Mar 2018 PHP 7.0.29
+
+- FPM:
+  . Fixed bug #75605 (Dumpable FPM child processes allow bypassing opcache
+    access controls). (Jakub Zelenka)
+
+01 Mar 2018 PHP 7.0.28
+
+- Standard:
+  . Fixed bug #75981 (stack-buffer-overflow while parsing HTTP response). (Stas)
+
+04 Jan 2018 PHP 7.0.27
+
+- CLI Server:
+  . Fixed bug #60471 (Random "Invalid request (unexpected EOF)" using a router
+    script). (SammyK)
+
+- Core:
+  . Fixed bug #75384 (PHP seems incompatible with OneDrive files on demand).
+    (Anatol)
+  . Fixed bug #75573 (Segmentation fault in 7.1.12 and 7.0.26). (Laruence)
+
+- FPM:
+  . Fixed bug #64938 (libxml_disable_entity_loader setting is shared between
+    requests). (Remi)
+
+- GD:
+  . Fixed bug #75571 (Potential infinite loop in gdImageCreateFromGifCtx). (cmb)
+
+- Opcache:
+  . Fixed bug #75579 (Interned strings buffer overflow may cause crash).
+    (Dmitry)
+
+- PCRE:
+  . Fixed bug #74183 (preg_last_error not returning error code after error).
+    (Andrew Nester)
+
+- Phar:
+  . Fixed bug #74782 (Reflected XSS in .phar 404 page). (Stas)
+
+- Standard:
+  . Fixed bug #75535 (Inappropriately parsing HTTP response leads to PHP
+    segment fault). (Nikita)
+  . Fixed bug #75409 (accept EFAULT in addition to ENOSYS as indicator 
+    that getrandom() is missing). (sarciszewski)
+
+- Zip:
+  . Fixed bug #75540 (Segfault with libzip 1.3.1). (Remi)
+
+23 Nov 2017 PHP 7.0.26
+
+- Core:
+  . Fixed bug #75420 (Crash when modifing property name in __isset for
+    BP_VAR_IS). (Laruence)
+  . Fixed bug #75368 (mmap/munmap trashing on unlucky allocations). (Nikita,
+    Dmitry)
+
+- CLI:
+  . Fixed bug #75287 (Builtin webserver crash after chdir in a shutdown
+    function). (Laruence)
+
+- Enchant:
+  . Fixed bug #53070 (enchant_broker_get_path crashes if no path is set). (jelle
+    van der Waa, cmb)
+  . Fixed bug #75365 (Enchant still reports version 1.1.0). (cmb)
+
+- Exif:
+  . Fixed bug #75301 (Exif extension has built in revision version). (Peter
+    Kokot)
+
+- GD:
+  . Fixed bug #65148 (imagerotate may alter image dimensions). (cmb)
+  . Fixed bug #75437 (Wrong reflection on imagewebp). (Fabien Villepinte)
+
+- intl:
+  . Fixed bug #75317 (UConverter::setDestinationEncoding changes source instead 
+    of destination). (andrewnester)
+
+- interbase:
+  . Fixed bug #75453 (Incorrect reflection for ibase_[p]connect). (villfa)
+
+- Mysqli:
+  . Fixed bug #75434 (Wrong reflection for mysqli_fetch_all function). (Fabien
+    Villepinte)
+
+- OCI8:
+  . Fixed valgrind issue. (Tianfang Yang)
+
+- Opcache:
+  . Fixed bug #75373 (Warning Internal error: wrong size calculation). (Laruence, Dmitry)
+
+- OpenSSL:
+  . Fixed bug #75363 (openssl_x509_parse leaks memory). (Bob, Jakub Zelenka)
+  . Fixed bug #75307 (Wrong reflection for openssl_open function). (villfa)
+
+- PGSQL:
+  . Fixed bug #75419 (Default link incorrectly cleared/linked by pg_close()). (Sara)
+
+- SOAP:
+  . Fixed bug #75464 (Wrong reflection on SoapClient::__setSoapHeaders). (villfa)
+
+- Zlib:
+  . Fixed bug #75299 (Wrong reflection on inflate_init and inflate_add). (Fabien
+    Villepinte)
+
+26 Oct 2017 PHP 7.0.25
+
+- Core:
+  . Fixed bug #75241 (Null pointer dereference in zend_mm_alloc_small()).
+    (Laruence)
+  . Fixed bug #75236 (infinite loop when printing an error-message). (Andrea)
+  . Fixed bug #75252 (Incorrect token formatting on two parse errors in one
+    request). (Nikita)
+  . Fixed bug #75220 (Segfault when calling is_callable on parent). 
+    (andrewnester)
+  . Fixed bug #75290 (debug info of Closures of internal functions contain
+    garbage argument names). (Andrea)
+
+- Apache2Handler:
+  . Fixed bug #75311 (error: 'zend_hash_key' has no member named 'arKey' in
+    apache2handler). (mcarbonneaux)
+
+- Date:
+  . Fixed bug #75055 (Out-Of-Bounds Read in timelib_meridian()). (Derick)
+
+- Intl:
+  . Fixed bug #75318 (The parameter of UConverter::getAliases() is not
+    optional). (cmb)
+
+- mcrypt:
+  . Fixed bug #72535 (arcfour encryption stream filter crashes php). (Leigh)
+
+- OCI8:
+  . Fixed incorrect reference counting. (Dmitry, Tianfang Yang)
+
+- PCRE:
+  . Fixed bug #75207 (applied upstream patch for CVE-2016-1283). (Anatol)
+
+- litespeed:
+  . Fixed bug #75248 (Binary directory doesn't get created when building 
+    only litespeed SAPI). (petk)
+  . Fixed bug #75251 (Missing program prefix and suffix). (petk)
+
+- SPL:
+  . Fixed bug #73629 (SplDoublyLinkedList::setIteratorMode masks intern flags).
+    (J. Jeising, cmb)
+
+28 Sep 2017 PHP 7.0.24
+
+- Core:
+  . Fixed bug #75042 (run-tests.php issues with EXTENSION block). (John Boehr)
+
+- BCMath:
+  . Fixed bug #44995 (bcpowmod() fails if scale != 0). (cmb)
+  . Fixed bug #46781 (BC math handles minus zero incorrectly). (cmb)
+  . Fixed bug #54598 (bcpowmod() may return 1 if modulus is 1). (okano1220, cmb)
+  . Fixed bug #75178 (bcpowmod() misbehaves for non-integer base or modulus). (cmb)
+
+- CLI server:
+  . Fixed bug #70470 (Built-in server truncates headers spanning over TCP
+    packets). (bouk)
+
+- CURL:
+  . Fixed bug #75093 (OpenSSL support not detected). (Remi)
+
+- GD:
+  . Fixed bug #75124 (gdImageGrayScale() may produce colors). (cmb)
+  . Fixed bug #75139 (libgd/gd_interpolation.c:1786: suspicious if ?). (cmb)
+
+- Gettext:
+  . Fixed bug #73730 (textdomain(null) throws in strict mode). (cmb)
+
+- Intl:
+  . Fixed bug #75090 (IntlGregorianCalendar doesn't have constants from parent
+    class). (tpunt)
+  . Fixed bug #75193 (segfault in collator_convert_object_to_string). (Remi)
+
+- PDO_OCI:
+  . Fixed bug #74631 (PDO_PCO with PHP-FPM: OCI environment initialized
+    before PHP-FPM sets it up). (Ingmar Runge)
+
+- SPL:
+  . Fixed bug #75173 (incorrect behavior of AppendIterator::append in foreach loop).
+    (jhdxr)
+
+- Standard:
+  . Fixed bug #75097 (gethostname fails if your host name is 64 chars long). (Andrea)
+
+31 Aug 2017 PHP 7.0.23
+
+- Core:
+  . Fixed bug #74947 (Segfault in scanner on INF number). (Laruence)
+  . Fixed bug #74954 (null deref and segfault in zend_generator_resume()). (Bob)
+  . Fixed bug #74725 (html_errors=1 breaks unhandled exceptions). (Andrea)
+  . Fixed bug #75349 (NAN comparison). (Sara)
+
+- cURL:
+  . Fixed bug #74125 (Fixed finding CURL on systems with multiarch support).
+    (cebe)
+
+- Date:
+  . Fixed bug #75002 (Null Pointer Dereference in timelib_time_clone). (Derick)
+
+- Intl:
+  . Fixed bug #74993 (Wrong reflection on some locale_* functions). (Sara)
+
+- Mbstring:
+  . Fixed bug #71606 (Segmentation fault mb_strcut with HTML-ENTITIES encoding).
+    (cmb)
+  . Fixed bug #62934 (mb_convert_kana() does not convert iteration marks).
+    (Nikita)
+  . Fixed bug #75001 (Wrong reflection on mb_eregi_replace). (Fabien
+    Villepinte)
+
+- MySQLi:
+  . Fixed bug #74968 (PHP crashes when calling mysqli_result::fetch_object with
+    an abstract class). (Anatol)
+
+- OCI8:
+  . Expose oci_unregister_taf_callback() (Tianfang Yang)
+
+- phar:
+  . Fixed bug #74991 (include_path has a 4096 char limit in some cases).
+    (bwbroersma)
+
+- Reflection:
+  . Fixed bug #74949 (null pointer dereference in _function_string). (Laruence)
+
+- Session:
+  . Fixed bug #74833 (SID constant created with wrong module number). (Anatol)
+
+- SimpleXML:
+  . Fixed bug #74950 (nullpointer deref in simplexml_element_getDocNamespaces).
+    (Laruence)
+
+- SPL:
+  . Fixed bug #75049 (spl_autoload_unregister can't handle
+    spl_autoload_functions results). (Laruence)
+  . Fixed bug #74669 (Unserialize ArrayIterator broken). (Andrew Nester)
+  . Fixed bug #75015 (Crash in recursive iterator destructors). (Julien)
+
+- Standard:
+  . Fixed bug #75075 (unpack with X* causes infinity loop). (Laruence)
+  . Fixed bug #74103 (heap-use-after-free when unserializing invalid array
+    size). (Nikita)
+  . Fixed bug #75054 (A Denial of Service Vulnerability was found when
+    performing deserialization). (Nikita)
+
+- WDDX:
+  . Fixed bug #73793 (WDDX uses wrong decimal seperator). (cmb)
+
+- XMLRPC:
+  . Fixed bug #74975 (Incorrect xmlrpc serialization for classes with declared
+    properties). (blar)
+
+03 Aug 2017 PHP 7.0.22
+
+- Core:
+  . Fixed bug #74832 (Loading PHP extension with already registered function 
+    name leads to a crash). (jpauli)
+  . Fixed bug #74780 (parse_url() borken when query string contains colon). 
+    (jhdxr)
+  . Fixed bug #74761 (Unary operator expected error on some systems). (petk)
+  . Fixed bug #73900 (Use After Free in unserialize() SplFixedArray). (nikic)
+  . Fixed bug #74913 (fixed incorrect poll.h include). (petk)
+  . Fixed bug #74906 (fixed incorrect errno.h include). (petk)
+
+- Date:
+  . Fixed bug #74852 (property_exists returns true on unknown DateInterval 
+    property). (jhdxr)
+
+- OCI8:
+  . Fixed bug #74625 (Integer overflow in oci_bind_array_by_name). (Ingmar Runge)
+
+- Opcache:
+  . Fixed bug #74840 (Opcache overwrites argument of GENERATOR_RETURN within
+    finally). (Bob)
+
+- PDO:
+  . Fixed bug #69356 (PDOStatement::debugDumpParams() truncates query). (Adam
+    Baratz)
+
+- SPL:
+  . Fixed bug #73471 (PHP freezes with AppendIterator). (jhdxr)
+
+- SQLite3:
+  . Fixed bug #74883 (SQLite3::__construct() produces "out of memory" exception
+    with invalid flags). (Anatol)
+
+- Wddx:
+  . Fixed bug #73173 (huge memleak when wddx_unserialize).
+    (tloi at fortinet dot com)
+
+- zlib:
+  . Fixed bug #73944 (dictionary option of inflate_init() does not work).
+    (wapmorgan)

 06 Jul 2017 PHP 7.0.21

@@ -12,26 +353,46 @@ PHP                                                                        NEWS
  . Fixed bug #74658 (Undefined constants in array properties result in broken
    properties). (Laruence)
  . Fixed misparsing of abstract unix domain socket names. (Sara)
+  . Fixed bug #74101, bug #74614 (Unserialize Heap Use-After-Free (READ: 1) in
+    zval_get_type). (Nikita)
+  . Fixed bug #74111 (Heap buffer overread (READ: 1) finish_nested_data from
+    unserialize). (Nikita)
+  . Fixed bug #74603 (PHP INI Parsing Stack Buffer Overflow Vulnerability).
+    (Stas)
+  . Fixed bug #74819 (wddx_deserialize() heap out-of-bound read via
+    php_parse_date()). (Derick)

 - DOM:
  . Fixed bug #69373 (References to deleted XPath query results). (ttoohey)

+- GD:
+  . Fixed bug #74435 (Buffer over-read into uninitialized memory). (cmb)
+
 - Intl:
  . Fixed bug #73473 (Stack Buffer Overflow in msgfmt_parse_message). (libnex)
  . Fixed bug #74705 (Wrong reflection on Collator::getSortKey and
    collator_get_sort_key). (Tyson Andre, Remi)
+  . Fixed bug #73634 (grapheme_strpos illegal memory access). (Stas)

 - Mbstring:
  . Add oniguruma upstream fix (CVE-2017-9224, CVE-2017-9226, CVE-2017-9227,
    CVE-2017-9228, CVE-2017-9229) (Remi, Mamoru TASAKA)

 - OCI8:
- . Add TAF callback (PR #2459). (KoenigsKind)
+  . Add TAF callback (PR #2459). (KoenigsKind)

 - Opcache:
  . Fixed bug #74663 (Segfault with opcache.memory_protect and
    validate_timestamp). (Laruence)

+- OpenSSL:
+  . Fixed bug #74651 (negative-size-param (-1) in memcpy in zif_openssl_seal()).
+    (Stas)
+
+- PCRE:
+  . Fixed bug #74087 (Segmentation fault in PHP7.1.1(compiled using the bundled PCRE library)).
+    (Stas)
+
 - PDO_OCI:
  . Support Instant Client 12.2 in --with-pdo-oci configure option.
    (Tianfang Yang)
@@ -47,6 +408,7 @@ PHP                                                                        NEWS
 - Standard:
  . Fixed bug #74708 (Invalid Reflection signatures for random_bytes and
    random_int). (Tyson Andre, Remi)
+  . Fixed bug #73648 (Heap buffer overflow in substr). (Stas)

 - FTP:
  . Fixed bug #74598 (ftp:// wrapper ignores context arg). (Sara)
@@ -466,6 +828,7 @@ PHP                                                                        NEWS

 - JSON:
  . Fixed bug #73526 (php_json_encode depth issue). (Jakub Zelenka)
+  . Install headers on windows. (Darek Slusarczyk)

 - Mysqlnd:
  . Fixed bug #64526 (Add missing mysqlnd.* parameters to php.ini-*). (cmb)
@@ -2527,4 +2890,3 @@ PHP                                                                        NEWS
  . Update bundled libzip to 1.0.1. (Remi, Anatol)
  . Fixed bug #67161 (ZipArchive::getStream() returns NULL for certain file).
    (Christoph M. Becker)
-
@@ -526,6 +526,13 @@ Other
  . Removed xsl.security_prefs ini option. Use XsltProcessor::setSecurityPrefs()
    instead.

+- IMAP:
+  Starting with 7.0.33, rsh/ssh logins are disabled by default. Use
+  imap.enable_insecure_rsh if you want to enable them. Note that the IMAP
+  library does not filter mailbox names before passing them to rsh/ssh
+  command, thus passing untrusted data to this function with rsh/ssh enabled
+  is insecure.
+
 ========================================
 2. New Features
 ========================================
@@ -53,27 +53,43 @@ string(3) "1st"
 string(3) "2nd"
 NULL
 string(3) "4th"
-array(3) {
+array(4) {
  [0]=>
  string(3) "1st"
  [1]=>
  &string(3) "2nd"
+  [2]=>
+  NULL
  [3]=>
  string(3) "4th"
 }
-array(2) {
+array(4) {
+  [0]=>
+  NULL
  [1]=>
  string(3) "2nd"
+  [2]=>
+  NULL
  [3]=>
  string(3) "4th"
 }
-array(2) {
+array(4) {
+  [0]=>
+  NULL
  [1]=>
  &string(3) "2nd"
+  [2]=>
+  NULL
  [3]=>
  string(3) "4th"
 }
-array(1) {
+array(4) {
+  [0]=>
+  NULL
+  [1]=>
+  NULL
+  [2]=>
+  NULL
  [3]=>
  string(3) "4th"
 }
@@ -0,0 +1,15 @@
+--TEST--
+Bug #73900: Use After Free in unserialize() SplFixedArray
+--FILE--
+<?php
+
+$a = new stdClass;
+$b = new SplFixedArray(1);
+$b[0] = $a;
+$c = &$b[0];
+var_dump($c);
+
+?>
+--EXPECT--
+object(stdClass)#1 (0) {
+}
@@ -0,0 +1 @@
+0=0&~2000000000
@@ -0,0 +1,15 @@
+--TEST--
+Bug #74603 (PHP INI Parsing Stack Buffer Overflow Vulnerability)
+--SKIPIF--
+<?php
+if (PHP_INT_MAX !== 2147483647)
+        die('skip for 32-bit only');
+--FILE--
+<?php
+var_dump(parse_ini_file(__DIR__ . "/bug74603.ini", true, INI_SCANNER_NORMAL));
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  string(1) "0"
+}
@@ -0,0 +1,21 @@
+--TEST--
+Bug #74840: Opcache overwrites argument of GENERATOR_RETURN within finally
+--FILE--
+<?php
+
+$g = (function($a) {
+	try {
+		return $a + 1;
+	} finally {
+		$b = $a + 2;
+		var_dump($b);
+	}
+	yield; // Generator
+})(1);
+$g->next();
+var_dump($g->getReturn());
+
+?>
+--EXPECT--
+int(3)
+int(2)
@@ -0,0 +1,12 @@
+--TEST--
+Bug #74947 (Segfault in scanner on INF number)
+--FILE--
+<?php 
+
+echo 200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000;
+
+echo -200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000;
+
+?>
+--EXPECTF--
+INF-INF
@@ -0,0 +1,13 @@
+--TEST--
+Bug #75241 (Null pointer dereference in zend_mm_alloc_small())
+--FILE--
+<?php
+function eh(){}
+
+set_error_handler('eh');
+
+$d->d = &$d + $d->d/=0;
+var_dump($d);
+?>
+--EXPECT--
+float(INF)
@@ -0,0 +1,28 @@
+--TEST--
+Bug #75252: Incorrect token formatting on two parse errors in one request
+--FILE--
+<?php
+
+$code = <<<'CODE'
+function test_missing_semicolon() : string {
+     $x = []
+     FOO
+}
+CODE;
+
+try {
+    eval($code);
+} catch (ParseError $e) {
+    var_dump($e->getMessage());
+}
+
+try {
+    eval($code);
+} catch (ParseError $e) {
+    var_dump($e->getMessage());
+}
+
+?>
+--EXPECT--
+string(41) "syntax error, unexpected 'FOO' (T_STRING)"
+string(41) "syntax error, unexpected 'FOO' (T_STRING)"
@@ -0,0 +1,26 @@
+--TEST--
+Bug #75290 (debug info of Closures of internal functions contain garbage argument names)
+--FILE--
+<?php
+
+var_dump((new ReflectionFunction('sin'))->getClosure());
+
+var_dump(function ($someThing) {});
+
+?>
+--EXPECT--
+object(Closure)#2 (1) {
+  ["parameter"]=>
+  array(1) {
+    ["$number"]=>
+    string(10) "<required>"
+  }
+}
+object(Closure)#2 (1) {
+  ["parameter"]=>
+  array(1) {
+    ["$someThing"]=>
+    string(10) "<required>"
+  }
+}
+
@@ -0,0 +1,18 @@
+--TEST--
+Bug #75420.1 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test {
+	public function __isset($x) { $GLOBALS["name"] = 24; return true; }
+	public function __get($x) { var_dump($x); return 42; }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump($obj->$name ?? 12);
+var_dump($name);
+?>
+--EXPECT--
+string(3) "foo"
+int(42)
+int(24)
@@ -0,0 +1,21 @@
+--TEST--
+Bug #75420.10 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test implements ArrayAccess {
+	public function offsetExists($x) { $GLOBALS["name"] = 24; return true; }
+	public function offsetGet($x) { var_dump($x); return 42; }
+	public function offsetSet($x, $y) { }
+	public function offsetUnset($x) { }
+}
+
+$obj = new Test;
+$name = "foo";
+$name = str_repeat($name, 2);
+var_dump($obj[$name] ?? 12);
+var_dump($name);
+?>
+--EXPECT--
+string(6) "foofoo"
+int(42)
+int(24)
@@ -0,0 +1,20 @@
+--TEST--
+Bug #75420.11 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test implements ArrayAccess {
+	public function offsetExists($x) { $GLOBALS["name"] = 24; return true; }
+	public function offsetGet($x) { var_dump($x); return 42; }
+	public function offsetSet($x, $y) { }
+	public function offsetUnset($x) { }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump(empty($obj[$name]));
+var_dump($name);
+?>
+--EXPECT--
+string(3) "foo"
+bool(false)
+int(24)
@@ -0,0 +1,21 @@
+--TEST--
+Bug #75420.12 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test implements ArrayAccess {
+	public function offsetExists($x) { $GLOBALS["name"] = 24; return true; }
+	public function offsetGet($x) { var_dump($x); return 42; }
+	public function offsetSet($x, $y) { }
+	public function offsetUnset($x) { }
+}
+
+$obj = new Test;
+$name = "foo";
+$name = str_repeat($name, 2);
+var_dump(empty($obj[$name]));
+var_dump($name);
+?>
+--EXPECT--
+string(6) "foofoo"
+bool(false)
+int(24)
@@ -0,0 +1,20 @@
+--TEST--
+Bug #75420.13 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test implements ArrayAccess {
+	public function offsetExists($x) { $GLOBALS["obj"] = 24; return true; }
+	public function offsetGet($x) { var_dump($x); return 42; }
+	public function offsetSet($x, $y) { }
+	public function offsetUnset($x) { }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump($obj[$name] ?? 12);
+var_dump($obj);
+?>
+--EXPECT--
+string(3) "foo"
+int(42)
+int(24)
@@ -0,0 +1,20 @@
+--TEST--
+Bug #75420.14 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test implements ArrayAccess {
+	public function offsetExists($x) { $GLOBALS["obj"] = 24; return true; }
+	public function offsetGet($x) { var_dump($x); return 42; }
+	public function offsetSet($x, $y) { }
+	public function offsetUnset($x) { }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump(empty($obj[$name]));
+var_dump($obj);
+?>
+--EXPECT--
+string(3) "foo"
+bool(false)
+int(24)
@@ -0,0 +1,20 @@
+--TEST--
+Bug #75420.15 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test implements ArrayAccess {
+	public function offsetExists($x) { }
+	public function offsetGet($x) { }
+	public function offsetSet($x, $y) { $GLOBALS["name"] = 24; var_dump($x); }
+	public function offsetUnset($x) { }
+}
+
+$obj = new Test;
+$name = "foo";
+$name = str_repeat($name, 2);
+$obj[$name] = 1;
+var_dump($name);
+?>
+--EXPECT--
+string(6) "foofoo"
+int(24)
@@ -0,0 +1,20 @@
+--TEST--
+Bug #75420.16 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test implements ArrayAccess {
+	public function offsetExists($x) { }
+	public function offsetGet($x) { }
+	public function offsetSet($x, $y) { $GLOBALS["obj"] = 24; var_dump($this); }
+	public function offsetUnset($x) { }
+}
+
+$obj = new Test;
+$name = "foo";
+$obj[$name] = 1;
+var_dump($obj);
+?>
+--EXPECT--
+object(Test)#1 (0) {
+}
+int(24)
@@ -0,0 +1,20 @@
+--TEST--
+Bug #75420.2 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test {
+	public function __isset($x) { $GLOBALS["name"] = 24; return true; }
+	public function __get($x) { var_dump($x); return 42; }
+}
+
+$obj = new Test;
+$name = "foo";
+$name = str_repeat($name, 2);
+var_dump($obj->$name ?? 12);
+var_dump($name);
+?>
+--EXPECT--
+string(6) "foofoo"
+int(42)
+int(24)
+
@@ -0,0 +1,18 @@
+--TEST--
+Bug #75420.3 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test {
+	public function __isset($x) { $GLOBALS["name"] = 24; return true; }
+	public function __get($x) { var_dump($x); return 42; }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump(empty($obj->$name));
+var_dump($name);
+?>
+--EXPECT--
+string(3) "foo"
+bool(false)
+int(24)
@@ -0,0 +1,17 @@
+--TEST--
+Bug #75420.4 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test {
+	public function __isset($x) { $GLOBALS["name"] = 24; return true; }
+	public function __get($x) { var_dump($x); return 42; }
+}
+
+$obj = new Test;
+$name = "foo";
+$name = str_repeat($name, 2);
+var_dump(empty($obj->$name));
+?>
+--EXPECT--
+string(6) "foofoo"
+bool(false)
@@ -0,0 +1,19 @@
+--TEST--
+Bug #75420.5 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test {
+	public function __isset($x) { $GLOBALS["obj"] = 24; return true; }
+	public function __get($x) { var_dump($this); return 42; }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump($obj->$name ?? 12);
+var_dump($obj);
+?>
+--EXPECT--
+object(Test)#1 (0) {
+}
+int(42)
+int(24)
@@ -0,0 +1,19 @@
+--TEST--
+Bug #75420.6 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test {
+	public function __isset($x) { $GLOBALS["obj"] = 24; return true; }
+	public function __get($x) { var_dump($this); return 42; }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump(empty($obj->$name));
+var_dump($obj);
+?>
+--EXPECT--
+object(Test)#1 (0) {
+}
+bool(false)
+int(24)
@@ -0,0 +1,17 @@
+--TEST--
+Bug #75420.7 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test {
+	public function __set($x,$v) { $GLOBALS["name"] = 24; var_dump($x); }
+}
+
+$obj = new Test;
+$name = "foo";
+$name = str_repeat($name, 2);
+$obj->$name = 1;
+var_dump($name);
+?>
+--EXPECT--
+string(6) "foofoo"
+int(24)
@@ -0,0 +1,17 @@
+--TEST--
+Bug #75420.8 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test {
+	public function __set($x,$v) { $GLOBALS["obj"] = 24; var_dump($this); }
+}
+
+$obj = new Test;
+$name = "foo";
+$obj->$name = 1;
+var_dump($obj);
+?>
+--EXPECT--
+object(Test)#1 (0) {
+}
+int(24)
@@ -0,0 +1,20 @@
+--TEST--
+Bug #75420.9 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test implements ArrayAccess {
+	public function offsetExists($x) { $GLOBALS["name"] = 24; return true; }
+	public function offsetGet($x) { var_dump($x); return 42; }
+	public function offsetSet($x, $y) { }
+	public function offsetUnset($x) { }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump($obj[$name] ?? 12);
+var_dump($name);
+?>
+--EXPECT--
+string(3) "foo"
+int(42)
+int(24)
@@ -0,0 +1,17 @@
+--TEST--
+Bug #75420 (Crash when modifing property name in __isset for BP_VAR_IS)
+--FILE--
+<?php
+
+class Test {
+	public function __isset($x) { $GLOBALS["name"] = 24; return true; }
+public function __get($x) { var_dump($x); return 42; }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump($obj->$name ?? 12);
+?>
+--EXPECT--
+string(3) "foo"
+int(42)
@@ -0,0 +1,64 @@
+--TEST--
+Bug #75573 (Segmentation fault in 7.1.12 and 7.0.26)
+--FILE--
+<?php
+
+class A
+{
+	var $_stdObject;
+	function initialize($properties = FALSE) {
+		$this->_stdObject = $properties ? (object) $properties : new stdClass();
+		parent::initialize();
+	}
+	function &__get($property)
+	{
+		if (isset($this->_stdObject->{$property})) {
+			$retval =& $this->_stdObject->{$property};
+			return $retval;
+		} else {
+			return NULL;
+		}
+	}
+	function &__set($property, $value)
+	{
+		return $this->_stdObject->{$property} = $value;
+	}
+	function __isset($property_name)
+	{
+		return isset($this->_stdObject->{$property_name});
+	}
+}
+
+class B extends A
+{
+	function initialize($properties = array())
+	{
+		parent::initialize($properties);
+	}
+	function &__get($property)
+	{
+		if (isset($this->settings) && isset($this->settings[$property])) {
+			$retval =& $this->settings[$property];
+			return $retval;
+		} else {
+			return parent::__get($property);
+		}
+	}
+}
+
+$b = new B();
+$b->settings = [ "foo" => "bar", "name" => "abc" ];
+var_dump($b->name);
+var_dump($b->settings);
+?>
+--EXPECTF--
+Warning: Creating default object from empty value in %sbug75573.php on line %d
+
+Notice: Only variable references should be returned by reference in %sbug75573.php on line %d
+string(3) "abc"
+array(2) {
+  ["foo"]=>
+  string(3) "bar"
+  ["name"]=>
+  string(3) "abc"
+}
@@ -0,0 +1,45 @@
+--TEST--
+Bug #74954 (crash after update of generator yielding from finished generator)
+--FILE--
+<?php
+
+function from() {
+        yield 1;
+        throw new Exception();
+}
+
+function gen($gen) {
+        try {
+                var_dump(yield from $gen);
+        } catch (Exception $e) { print "Caught exception!\n$e\n"; }
+}
+
+$gen = from();
+$gens[] = gen($gen);
+$gens[] = gen($gen);
+
+foreach ($gens as $g) {
+        $g->current();
+}
+
+do {
+        foreach ($gens as $i => $g) {
+                $g->next();
+        }
+} while($gens[0]->valid());
+
+?>
+--EXPECTF--
+Caught exception!
+Exception in %s:%d
+Stack trace:
+#0 %s(%d): from()
+#1 [internal function]: gen(Object(Generator))
+#2 %s(%d): Generator->next()
+#3 {main}
+Caught exception!
+ClosedGeneratorException: Generator yielded from aborted, no return value available in %s:%d
+Stack trace:
+#0 [internal function]: gen(Object(Generator))
+#1 %s(%d): Generator->next()
+#2 {main}
@@ -701,7 +701,7 @@ int zend_startup(zend_utility_functions *utility_functions, char **extensions) /
 	zend_compile_file = compile_file;
 	zend_execute_ex = execute_ex;
 	zend_execute_internal = NULL;
-#endif /* HAVE_SYS_SDT_H */
+#endif /* HAVE_DTRACE */
 	zend_compile_string = compile_string;
 	zend_throw_exception_hook = NULL;

@@ -896,6 +896,8 @@ void zend_set_utility_values(zend_utility_values *utility_values) /* {{{ */
 /* this should be compatible with the standard zenderror */
 ZEND_COLD void zenderror(const char *error) /* {{{ */
 {
+	CG(parse_error) = 0;
+
 	if (EG(exception)) {
 		/* An exception was thrown in the lexer, don't throw another in the parser. */
 		return;
@@ -297,7 +297,6 @@ ZEND_COLD void zenderror(const char *error);
 #define ZEND_STANDARD_CLASS_DEF_PTR zend_standard_class_def
 extern ZEND_API zend_class_entry *zend_standard_class_def;
 extern ZEND_API zend_utility_values zend_uv;
-extern ZEND_API zval zval_used_for_init;

 /* If DTrace is available and enabled */
 extern ZEND_API zend_bool zend_dtrace_enabled;
@@ -2028,17 +2028,19 @@ ZEND_API zend_module_entry* zend_register_module_ex(zend_module_entry *module) /
 		zend_string_release(lcname);
 		return NULL;
 	}
-	zend_string_release(lcname);
 	module = module_ptr;
 	EG(current_module) = module;

 	if (module->functions && zend_register_functions(NULL, module->functions, NULL, module->type)==FAILURE) {
+		zend_hash_del(&module_registry, lcname);
+		zend_string_release(lcname);
 		EG(current_module) = NULL;
 		zend_error(E_CORE_WARNING,"%s: Unable to register functions, unable to load", module->name);
 		return NULL;
 	}

 	EG(current_module) = NULL;
+	zend_string_release(lcname);
 	return module;
 }
 /* }}} */
@@ -3065,7 +3067,8 @@ get_function_via_handler:
 					    (!fcc->function_handler->common.scope ||
 					     !instanceof_function(ce_org, fcc->function_handler->common.scope))) {
 						if (fcc->function_handler->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
-							if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION) {
+							if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION && 
+								fcc->function_handler->common.function_name) {
 								zend_string_release(fcc->function_handler->common.function_name);
 							}
 							zend_free_trampoline(fcc->function_handler);
@@ -3235,7 +3238,8 @@ again:
 				((fcc->function_handler->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) ||
 			     fcc->function_handler->type == ZEND_OVERLOADED_FUNCTION_TEMPORARY ||
 			     fcc->function_handler->type == ZEND_OVERLOADED_FUNCTION)) {
-				if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION) {
+				if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION && 
+					fcc->function_handler->common.function_name) {
 					zend_string_release(fcc->function_handler->common.function_name);
 				}
 				zend_free_trampoline(fcc->function_handler);
@@ -3322,7 +3326,8 @@ again:
 						((fcc->function_handler->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) ||
 					     fcc->function_handler->type == ZEND_OVERLOADED_FUNCTION_TEMPORARY ||
 					     fcc->function_handler->type == ZEND_OVERLOADED_FUNCTION)) {
-						if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION) {
+						if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION && 
+							fcc->function_handler->common.function_name) {
 							zend_string_release(fcc->function_handler->common.function_name);
 						}
 						zend_free_trampoline(fcc->function_handler);
@@ -709,7 +709,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_error(int severity, in
 		int _num_args = EX_NUM_ARGS(); \
 		int _i; \
 		zval *_real_arg, *_arg = NULL; \
-		zend_expected_type _expected_type = IS_UNDEF; \
+		zend_expected_type _expected_type = Z_EXPECTED_LONG; \
 		char *_error = NULL; \
 		zend_bool _dummy; \
 		zend_bool _optional = 0; \
@@ -267,6 +267,8 @@ struct _zend_mm_heap {
 	int                peak_chunks_count;		/* peak number of allocated chunks for current request */
 	int                cached_chunks_count;		/* number of cached chunks */
 	double             avg_chunks_count;		/* average number of chunks allocated per request */
+	int                last_chunks_delete_boundary; /* numer of chunks after last deletion */
+	int                last_chunks_delete_count;    /* number of deletion over the last boundary */
 #if ZEND_MM_CUSTOM
 	union {
 		struct {
@@ -1122,7 +1124,9 @@ static zend_always_inline void zend_mm_delete_chunk(zend_mm_heap *heap, zend_mm_
 	chunk->next->prev = chunk->prev;
 	chunk->prev->next = chunk->next;
 	heap->chunks_count--;
-	if (heap->chunks_count + heap->cached_chunks_count < heap->avg_chunks_count + 0.1) {
+	if (heap->chunks_count + heap->cached_chunks_count < heap->avg_chunks_count + 0.1
+	 || (heap->chunks_count == heap->last_chunks_delete_boundary
+	  && heap->last_chunks_delete_count >= 4)) {
 		/* delay deletion */
 		heap->cached_chunks_count++;
 		chunk->next = heap->cached_chunks;
@@ -1131,6 +1135,14 @@ static zend_always_inline void zend_mm_delete_chunk(zend_mm_heap *heap, zend_mm_
 #if ZEND_MM_STAT || ZEND_MM_LIMIT
 		heap->real_size -= ZEND_MM_CHUNK_SIZE;
 #endif
+		if (!heap->cached_chunks) {
+			if (heap->chunks_count != heap->last_chunks_delete_boundary) {
+				heap->last_chunks_delete_boundary = heap->chunks_count;
+				heap->last_chunks_delete_count = 0;
+			} else {
+				heap->last_chunks_delete_count++;
+			}
+		}
 		if (!heap->cached_chunks || chunk->num > heap->cached_chunks->num) {
 			zend_mm_chunk_free(heap, chunk, ZEND_MM_CHUNK_SIZE);
 		} else {
@@ -1864,6 +1876,8 @@ static zend_mm_heap *zend_mm_init(void)
 	heap->peak_chunks_count = 1;
 	heap->cached_chunks_count = 0;
 	heap->avg_chunks_count = 1.0;
+	heap->last_chunks_delete_boundary = 0;
+	heap->last_chunks_delete_count = 0;
 #if ZEND_MM_STAT || ZEND_MM_LIMIT
 	heap->real_size = ZEND_MM_CHUNK_SIZE;
 #endif
@@ -2279,6 +2293,8 @@ void zend_mm_shutdown(zend_mm_heap *heap, int full, int silent)
 		p->map[0] = ZEND_MM_LRUN(ZEND_MM_FIRST_PAGE);
 		heap->chunks_count = 1;
 		heap->peak_chunks_count = 1;
+		heap->last_chunks_delete_boundary = 0;
+		heap->last_chunks_delete_count = 0;
 #if ZEND_MM_STAT || ZEND_MM_LIMIT
 		heap->real_size = ZEND_MM_CHUNK_SIZE;
 #endif
@@ -2811,6 +2827,8 @@ ZEND_API zend_mm_heap *zend_mm_startup_ex(const zend_mm_handlers *handlers, void
 	heap->peak_chunks_count = 1;
 	heap->cached_chunks_count = 0;
 	heap->avg_chunks_count = 1.0;
+	heap->last_chunks_delete_boundary = 0;
+	heap->last_chunks_delete_count = 0;
 #if ZEND_MM_STAT || ZEND_MM_LIMIT
 	heap->real_size = ZEND_MM_CHUNK_SIZE;
 #endif
@@ -507,7 +507,7 @@ ZEND_FUNCTION(func_get_args)
 {
 	zval *p, *q;
 	uint32_t arg_count, first_extra_arg;
-	uint32_t i, n;
+	uint32_t i;
 	zend_execute_data *ex = EX(prev_execute_data);

 	if (ZEND_CALL_INFO(ex) & ZEND_CALL_CODE) {
@@ -523,7 +523,6 @@ ZEND_FUNCTION(func_get_args)
 		zend_hash_real_init(Z_ARRVAL_P(return_value), 1);
 		ZEND_HASH_FILL_PACKED(Z_ARRVAL_P(return_value)) {
 			i = 0;
-			n = 0;
 			p = ZEND_CALL_ARG(ex, 1);
 			if (arg_count > first_extra_arg) {
 				while (i < first_extra_arg) {
@@ -533,7 +532,8 @@ ZEND_FUNCTION(func_get_args)
 						if (Z_OPT_REFCOUNTED_P(q)) { 
 							Z_ADDREF_P(q);
 						}
-						n++;
+					} else {
+						q = &EG(uninitialized_zval);
 					}
 					ZEND_HASH_FILL_ADD(q);
 					p++;
@@ -548,14 +548,15 @@ ZEND_FUNCTION(func_get_args)
 					if (Z_OPT_REFCOUNTED_P(q)) { 
 						Z_ADDREF_P(q);
 					}
-					n++;
+				} else {
+					q = &EG(uninitialized_zval);
 				}
 				ZEND_HASH_FILL_ADD(q);
 				p++;
 				i++;
 			}
 		} ZEND_HASH_FILL_END();
-		Z_ARRVAL_P(return_value)->nNumOfElements = n;
+		Z_ARRVAL_P(return_value)->nNumOfElements = arg_count;
 	}
 }
 /* }}} */
@@ -1202,7 +1203,7 @@ ZEND_FUNCTION(get_object_vars)
 						zend_unmangle_property_name_ex(key, &class_name, &prop_name, &prop_len);
 						zend_hash_str_add_new(Z_ARRVAL_P(return_value), prop_name, prop_len, value);
 					} else {
-						zend_symbtable_add_new(Z_ARRVAL_P(return_value), key, value);
+						zend_symtable_add_new(Z_ARRVAL_P(return_value), key, value);
 					}
 				}
 			}
@@ -2219,7 +2220,6 @@ static void debug_backtrace_get_args(zend_execute_data *call, zval *arg_array) /
 	array_init_size(arg_array, num_args);
 	if (num_args) {
 		uint32_t i = 0;
-		uint32_t n = 0;
 		zval *p = ZEND_CALL_ARG(call, 1);

 		zend_hash_real_init(Z_ARRVAL_P(arg_array), 1);
@@ -2242,12 +2242,9 @@ static void debug_backtrace_get_args(zend_execute_data *call, zval *arg_array) /
 							if (Z_OPT_REFCOUNTED_P(arg)) {
 								Z_ADDREF_P(arg);
 							}
-							n++;
 							ZEND_HASH_FILL_ADD(arg);
 						} else {
-							zval tmp;
-							ZVAL_UNDEF(&tmp);
-							ZEND_HASH_FILL_ADD(&tmp);
+							ZEND_HASH_FILL_ADD(&EG(uninitialized_zval));
 						}
 						i++;
 					}
@@ -2257,9 +2254,10 @@ static void debug_backtrace_get_args(zend_execute_data *call, zval *arg_array) /
 							if (Z_OPT_REFCOUNTED_P(p)) {
 								Z_ADDREF_P(p);
 							}
-							n++;
+							ZEND_HASH_FILL_ADD(p);
+						} else {
+							ZEND_HASH_FILL_ADD(&EG(uninitialized_zval));
 						}
-						ZEND_HASH_FILL_ADD(p);
 						p++;
 						i++;
 					}
@@ -2272,14 +2270,15 @@ static void debug_backtrace_get_args(zend_execute_data *call, zval *arg_array) /
 					if (Z_OPT_REFCOUNTED_P(p)) {
 						Z_ADDREF_P(p);
 					}
-					n++;
+					ZEND_HASH_FILL_ADD(p);
+				} else {
+					ZEND_HASH_FILL_ADD(&EG(uninitialized_zval));
 				}
-				ZEND_HASH_FILL_ADD(p);
 				p++;
 				i++;
 			}
 		} ZEND_HASH_FILL_END();
-		Z_ARRVAL_P(arg_array)->nNumOfElements = n;
+		Z_ARRVAL_P(arg_array)->nNumOfElements = num_args;
 	}
 }
 /* }}} */
@@ -414,6 +414,7 @@ static HashTable *zend_closure_get_debug_info(zval *object, int *is_temp) /* {{{
 	zval val;
 	struct _zend_arg_info *arg_info = closure->func.common.arg_info;
 	HashTable *debug_info;
+	zend_bool zstr_args = (closure->func.type == ZEND_USER_FUNCTION) || (closure->func.common.fn_flags & ZEND_ACC_USER_ARG_INFO);

 	*is_temp = 1;

@@ -446,9 +447,15 @@ static HashTable *zend_closure_get_debug_info(zval *object, int *is_temp) /* {{{
 			zend_string *name;
 			zval info;
 			if (arg_info->name) {
-				name = zend_strpprintf(0, "%s$%s",
-						arg_info->pass_by_reference ? "&" : "",
-						ZSTR_VAL(arg_info->name));
+				if (zstr_args) {
+					name = zend_strpprintf(0, "%s$%s",
+							arg_info->pass_by_reference ? "&" : "",
+							ZSTR_VAL(arg_info->name));
+				} else {
+					name = zend_strpprintf(0, "%s$%s",
+							arg_info->pass_by_reference ? "&" : "",
+							((zend_internal_arg_info*)arg_info)->name);
+				}
 			} else {
 				name = zend_strpprintf(0, "%s$param%d",
 						arg_info->pass_by_reference ? "&" : "",
@@ -5601,7 +5601,7 @@ void zend_compile_use(zend_ast *ast) /* {{{ */
 			zend_string *ns_name = zend_string_alloc(ZSTR_LEN(current_ns) + 1 + ZSTR_LEN(new_name), 0);
 			zend_str_tolower_copy(ZSTR_VAL(ns_name), ZSTR_VAL(current_ns), ZSTR_LEN(current_ns));
 			ZSTR_VAL(ns_name)[ZSTR_LEN(current_ns)] = '\\';
-			memcpy(ZSTR_VAL(ns_name) + ZSTR_LEN(current_ns) + 1, ZSTR_VAL(lookup_name), ZSTR_LEN(lookup_name));
+			memcpy(ZSTR_VAL(ns_name) + ZSTR_LEN(current_ns) + 1, ZSTR_VAL(lookup_name), ZSTR_LEN(lookup_name) + 1);

 			zend_check_use_conflict(type, old_name, new_name, ns_name);

@@ -1758,16 +1758,9 @@ convert_to_array:
 				zend_error(E_NOTICE, "Indirect modification of overloaded element of %s has no effect", ZSTR_VAL(ce->name));
 			} else if (EXPECTED(retval && Z_TYPE_P(retval) != IS_UNDEF)) {
 				if (!Z_ISREF_P(retval)) {
-					if (Z_REFCOUNTED_P(retval) &&
-					    Z_REFCOUNT_P(retval) > 1) {
-						if (Z_TYPE_P(retval) != IS_OBJECT) {
-							Z_DELREF_P(retval);
-							ZVAL_DUP(result, retval);
-							retval = result;
-						} else {
-							ZVAL_COPY_VALUE(result, retval);
-							retval = result;
-						}
+					if (result != retval) {
+						ZVAL_COPY(result, retval);
+						retval = result;
 					}
 					if (Z_TYPE_P(retval) != IS_OBJECT) {
 						zend_class_entry *ce = Z_OBJCE_P(container);
@@ -644,15 +644,13 @@ failure:

 ZEND_API void zend_generator_resume(zend_generator *orig_generator) /* {{{ */
 {
-	zend_generator *generator;
+	zend_generator *generator = zend_generator_get_current(orig_generator);

 	/* The generator is already closed, thus can't resume */
-	if (UNEXPECTED(!orig_generator->execute_data)) {
+	if (UNEXPECTED(!generator->execute_data)) {
 		return;
 	}

-	generator = zend_generator_get_current(orig_generator);
-
 try_again:
 	if (generator->flags & ZEND_GENERATOR_CURRENTLY_RUNNING) {
 		zend_throw_error(NULL, "Cannot resume an already running generator");
@@ -291,7 +291,6 @@ static uint32_t zend_array_recalc_elements(HashTable *ht)
       uint32_t num = ht->nNumOfElements;

 	   ZEND_HASH_FOREACH_VAL(ht, val) {
-		   if (Z_TYPE_P(val) == IS_UNDEF) continue;
 		   if (Z_TYPE_P(val) == IS_INDIRECT) {
 			   if (UNEXPECTED(Z_TYPE_P(Z_INDIRECT_P(val)) == IS_UNDEF)) {
 				   num--;
@@ -310,7 +310,7 @@ static zend_always_inline int zend_hash_str_exists_ind(const HashTable *ht, cons
 			Z_TYPE_P(Z_INDIRECT_P(zv)) != IS_UNDEF);
 }

-static zend_always_inline zval *zend_symbtable_add_new(HashTable *ht, zend_string *key, zval *pData)
+static zend_always_inline zval *zend_symtable_add_new(HashTable *ht, zend_string *key, zval *pData)
 {
 	zend_ulong idx;

@@ -321,6 +321,10 @@ static zend_always_inline zval *zend_symbtable_add_new(HashTable *ht, zend_strin
 	}
 }

+/* This typo snuck into 7.0.17 and 7.1.3, this define exists for BC */
+#define zend_symbtable_add_new(ht, key, pData) \
+        zend_symtable_add_new(ht, key, pData)
+
 static zend_always_inline zval *zend_symtable_update(HashTable *ht, zend_string *key, zval *pData)
 {
 	zend_ulong idx;
@@ -55,7 +55,7 @@ static void zend_ini_do_op(char type, zval *result, zval *op1, zval *op2)
 	int i_result;
 	int i_op1, i_op2;
 	int str_len;
-	char str_result[MAX_LENGTH_OF_LONG];
+	char str_result[MAX_LENGTH_OF_LONG+1];

 	i_op1 = atoi(Z_STRVAL_P(op1));
 	zend_string_free(Z_STR_P(op1));
@@ -1676,7 +1676,6 @@ NEWLINE ("\r"|"\n"|"\r\n")
 		if (errno == ERANGE) { /* Overflow */
 			errno = 0;
 			if (yytext[0] == '0') { /* octal overflow */
-				errno = 0;
 				ZVAL_DOUBLE(zendlval, zend_oct_strtod(yytext, (const char **)&end));
 			} else {
 				ZVAL_DOUBLE(zendlval, zend_strtod(yytext, (const char **)&end));
@@ -1688,7 +1687,6 @@ NEWLINE ("\r"|"\n"|"\r\n")
 				ZVAL_UNDEF(zendlval);
 				RETURN_TOKEN(T_DNUMBER);
 			}
-			ZEND_ASSERT(!errno);
 			RETURN_TOKEN(T_DNUMBER);
 		}
 		/* Also not an assert for the same reason */
@@ -122,11 +122,13 @@ struct _zend_module_dep {
 	unsigned char type;		/* dependency type */
 };

+BEGIN_EXTERN_C()
 extern ZEND_API HashTable module_registry;

 void module_destructor(zend_module_entry *module);
 int module_registry_request_startup(zend_module_entry *module);
 int module_registry_unload_temp(const zend_module_entry *module);
+END_EXTERN_C()

 #endif

@@ -53,8 +53,8 @@
 	__asm__("mul %0, %2, %3\n"										\
 		"smulh %1, %2, %3\n"										\
 		"sub %1, %1, %0, asr #63\n"									\
-			: "=X"(__tmpvar), "=X"(usedval)							\
-			: "X"(a), "X"(b));										\
+			: "=&r"(__tmpvar), "=&r"(usedval)						\
+			: "r"(a), "r"(b));										\
 	if (usedval) (dval) = (double) (a) * (double) (b);				\
 	else (lval) = __tmpvar;											\
 } while (0)
@@ -507,9 +507,10 @@ static zend_long *zend_get_property_guard(zend_object *zobj, zend_string *member
 zval *zend_std_read_property(zval *object, zval *member, int type, void **cache_slot, zval *rv) /* {{{ */
 {
 	zend_object *zobj;
-	zval tmp_member;
+	zval tmp_member, tmp_object;
 	zval *retval;
 	uint32_t property_offset;
+	zend_long *guard = NULL;

 	zobj = Z_OBJ_P(object);

@@ -542,12 +543,18 @@ zval *zend_std_read_property(zval *object, zval *member, int type, void **cache_
 		goto exit;
 	}

+	ZVAL_UNDEF(&tmp_object);
+
 	/* magic isset */
 	if ((type == BP_VAR_IS) && zobj->ce->__isset) {
-		zval tmp_object, tmp_result;
-		zend_long *guard = zend_get_property_guard(zobj, Z_STR_P(member));
+		zval tmp_result;
+		guard = zend_get_property_guard(zobj, Z_STR_P(member));

 		if (!((*guard) & IN_ISSET)) {
+			if (Z_TYPE(tmp_member) == IS_UNDEF) {
+				ZVAL_COPY(&tmp_member, member);
+				member = &tmp_member;
+			}
 			ZVAL_COPY(&tmp_object, object);
 			ZVAL_UNDEF(&tmp_result);

@@ -562,19 +569,20 @@ zval *zend_std_read_property(zval *object, zval *member, int type, void **cache_
 				goto exit;
 			}

-			zval_ptr_dtor(&tmp_object);
 			zval_ptr_dtor(&tmp_result);
 		}
 	}

 	/* magic get */
 	if (zobj->ce->__get) {
-		zend_long *guard = zend_get_property_guard(zobj, Z_STR_P(member));
+		if (guard == NULL) {
+			guard = zend_get_property_guard(zobj, Z_STR_P(member));
+		}
 		if (!((*guard) & IN_GET)) {
-			zval tmp_object;
-
 			/* have getter - try with it! */
-			ZVAL_COPY(&tmp_object, object);
+			if (Z_TYPE(tmp_object) == IS_UNDEF) {
+				ZVAL_COPY(&tmp_object, object);
+			}
 			*guard |= IN_GET; /* prevent circular getting */
 			zend_std_call_getter(&tmp_object, member, rv);
 			*guard &= ~IN_GET;
@@ -595,6 +603,7 @@ zval *zend_std_read_property(zval *object, zval *member, int type, void **cache_
 			goto exit;
 		} else {
 			if (Z_STRVAL_P(member)[0] == '\0') {
+				zval_ptr_dtor(&tmp_object);
 				if (Z_STRLEN_P(member) == 0) {
 					zend_throw_error(NULL, "Cannot access empty property");
 					retval = &EG(uninitialized_zval);
@@ -607,6 +616,9 @@ zval *zend_std_read_property(zval *object, zval *member, int type, void **cache_
 			}
 		}
 	}
+
+	zval_ptr_dtor(&tmp_object);
+
 	if ((type != BP_VAR_IS)) {
 		zend_error(E_NOTICE,"Undefined property: %s::$%s", ZSTR_VAL(zobj->ce->name), Z_STRVAL_P(member));
 	}
@@ -722,34 +734,38 @@ exit:
 zval *zend_std_read_dimension(zval *object, zval *offset, int type, zval *rv) /* {{{ */
 {
 	zend_class_entry *ce = Z_OBJCE_P(object);
-	zval tmp;
+	zval tmp_offset, tmp_object;

 	if (EXPECTED(instanceof_function_ex(ce, zend_ce_arrayaccess, 1) != 0)) {
 		if (offset == NULL) {
 			/* [] construct */
-			ZVAL_NULL(&tmp);
-			offset = &tmp;
+			ZVAL_NULL(&tmp_offset);
 		} else {
-			SEPARATE_ARG_IF_REF(offset);
+			ZVAL_DEREF(offset);
+			ZVAL_COPY(&tmp_offset, offset);
 		}

+		ZVAL_COPY(&tmp_object, object);
 		if (type == BP_VAR_IS) {
-			zend_call_method_with_1_params(object, ce, NULL, "offsetexists", rv, offset);
+			zend_call_method_with_1_params(&tmp_object, ce, NULL, "offsetexists", rv, &tmp_offset);
 			if (UNEXPECTED(Z_ISUNDEF_P(rv))) {
-				zval_ptr_dtor(offset);
+				zval_ptr_dtor(&tmp_object);
+				zval_ptr_dtor(&tmp_offset);
 				return NULL;
 			}
 			if (!i_zend_is_true(rv)) {
-				zval_ptr_dtor(offset);
+				zval_ptr_dtor(&tmp_object);
+				zval_ptr_dtor(&tmp_offset);
 				zval_ptr_dtor(rv);
 				return &EG(uninitialized_zval);
 			}
 			zval_ptr_dtor(rv);
 		}

-		zend_call_method_with_1_params(object, ce, NULL, "offsetget", rv, offset);
+		zend_call_method_with_1_params(&tmp_object, ce, NULL, "offsetget", rv, &tmp_offset);

-		zval_ptr_dtor(offset);
+		zval_ptr_dtor(&tmp_object);
+		zval_ptr_dtor(&tmp_offset);

 		if (UNEXPECTED(Z_TYPE_P(rv) == IS_UNDEF)) {
 			if (UNEXPECTED(!EG(exception))) {
@@ -768,17 +784,19 @@ zval *zend_std_read_dimension(zval *object, zval *offset, int type, zval *rv) /*
 static void zend_std_write_dimension(zval *object, zval *offset, zval *value) /* {{{ */
 {
 	zend_class_entry *ce = Z_OBJCE_P(object);
-	zval tmp;
+	zval tmp_offset, tmp_object;

 	if (EXPECTED(instanceof_function_ex(ce, zend_ce_arrayaccess, 1) != 0)) {
 		if (!offset) {
-			ZVAL_NULL(&tmp);
-			offset = &tmp;
+			ZVAL_NULL(&tmp_offset);
 		} else {
-			SEPARATE_ARG_IF_REF(offset);
+			ZVAL_DEREF(offset);
+			ZVAL_COPY(&tmp_offset, offset);
 		}
-		zend_call_method_with_2_params(object, ce, NULL, "offsetset", NULL, offset, value);
-		zval_ptr_dtor(offset);
+		ZVAL_COPY(&tmp_object, object);
+		zend_call_method_with_2_params(&tmp_object, ce, NULL, "offsetset", NULL, &tmp_offset, value);
+		zval_ptr_dtor(&tmp_object);
+		zval_ptr_dtor(&tmp_offset);
 	} else {
 		zend_throw_error(NULL, "Cannot use object of type %s as array", ZSTR_VAL(ce->name));
 	}
@@ -788,17 +806,19 @@ static void zend_std_write_dimension(zval *object, zval *offset, zval *value) /*
 static int zend_std_has_dimension(zval *object, zval *offset, int check_empty) /* {{{ */
 {
 	zend_class_entry *ce = Z_OBJCE_P(object);
-	zval retval;
+	zval retval, tmp_offset, tmp_object;
 	int result;

 	if (EXPECTED(instanceof_function_ex(ce, zend_ce_arrayaccess, 1) != 0)) {
-		SEPARATE_ARG_IF_REF(offset);
-		zend_call_method_with_1_params(object, ce, NULL, "offsetexists", &retval, offset);
+		ZVAL_DEREF(offset);
+		ZVAL_COPY(&tmp_offset, offset);
+		ZVAL_COPY(&tmp_object, object);
+		zend_call_method_with_1_params(&tmp_object, ce, NULL, "offsetexists", &retval, &tmp_offset);
 		if (EXPECTED(Z_TYPE(retval) != IS_UNDEF)) {
 			result = i_zend_is_true(&retval);
 			zval_ptr_dtor(&retval);
 			if (check_empty && result && EXPECTED(!EG(exception))) {
-				zend_call_method_with_1_params(object, ce, NULL, "offsetget", &retval, offset);
+				zend_call_method_with_1_params(&tmp_object, ce, NULL, "offsetget", &retval, &tmp_offset);
 				if (EXPECTED(Z_TYPE(retval) != IS_UNDEF)) {
 					result = i_zend_is_true(&retval);
 					zval_ptr_dtor(&retval);
@@ -807,7 +827,8 @@ static int zend_std_has_dimension(zval *object, zval *offset, int check_empty) /
 		} else {
 			result = 0;
 		}
-		zval_ptr_dtor(offset);
+		zval_ptr_dtor(&tmp_object);
+		zval_ptr_dtor(&tmp_offset);
 	} else {
 		zend_throw_error(NULL, "Cannot use object of type %s as array", ZSTR_VAL(ce->name));
 		return 0;
@@ -969,11 +990,15 @@ exit:
 static void zend_std_unset_dimension(zval *object, zval *offset) /* {{{ */
 {
 	zend_class_entry *ce = Z_OBJCE_P(object);
+	zval tmp_offset, tmp_object;

 	if (instanceof_function_ex(ce, zend_ce_arrayaccess, 1)) {
-		SEPARATE_ARG_IF_REF(offset);
-		zend_call_method_with_1_params(object, ce, NULL, "offsetunset", NULL, offset);
-		zval_ptr_dtor(offset);
+		ZVAL_DEREF(offset);
+		ZVAL_COPY(&tmp_offset, offset);
+		ZVAL_COPY(&tmp_object, object);
+		zend_call_method_with_1_params(&tmp_object, ce, NULL, "offsetunset", NULL, &tmp_offset);
+		zval_ptr_dtor(&tmp_object);
+		zval_ptr_dtor(&tmp_offset);
 	} else {
 		zend_throw_error(NULL, "Cannot use object of type %s as array", ZSTR_VAL(ce->name));
 	}
@@ -1507,6 +1532,10 @@ found:
 			zval tmp_object;

 			/* have issetter - try with it! */
+			if (Z_TYPE(tmp_member) == IS_UNDEF) {
+				ZVAL_COPY(&tmp_member, member);
+				member = &tmp_member;
+			}
 			ZVAL_COPY(&tmp_object, object);
 			(*guard) |= IN_ISSET; /* prevent circular getting */
 			zend_std_call_issetter(&tmp_object, member, &rv);
@@ -155,12 +155,12 @@ struct _zend_object_handlers {
 	zend_object_compare_zvals_t				compare;
 };

+BEGIN_EXTERN_C()
 extern ZEND_API zend_object_handlers std_object_handlers;

 #define zend_get_function_root_class(fbc) \
 	((fbc)->common.prototype ? (fbc)->common.prototype->common.scope : (fbc)->common.scope)

-BEGIN_EXTERN_C()
 ZEND_API union _zend_function *zend_std_get_static_method(zend_class_entry *ce, zend_string *function_name_strval, const zval *key);
 ZEND_API zval *zend_std_get_static_property(zend_class_entry *ce, zend_string *property_name, zend_bool silent);
 ZEND_API ZEND_COLD zend_bool zend_std_unset_static_property(zend_class_entry *ce, zend_string *property_name);
@@ -221,8 +221,10 @@ try_again:
 					if (Z_TYPE(holder) == IS_LONG) {				\
 						if (op == result) {							\
 							zval_ptr_dtor(op);						\
+							ZVAL_LONG(op, Z_LVAL(holder));			\
+						} else {									\
+							(op) = &(holder);						\
 						}											\
-						(op) = &(holder);							\
 					}												\
 					break;											\
 			}														\
@@ -433,7 +433,7 @@ char *alloca();
 #define ZEND_STRL(str)		(str), (sizeof(str)-1)
 #define ZEND_STRS(str)		(str), (sizeof(str))
 #define ZEND_NORMALIZE_BOOL(n)			\
-	((n) ? (((n)>0) ? 1 : -1) : 0)
+	((n) ? (((n)<0) ? -1 : 1) : 0)
 #define ZEND_TRUTH(x)		((x) ? 1 : 0)
 #define ZEND_LOG_XOR(a, b)		(ZEND_TRUTH(a) ^ ZEND_TRUTH(b))

@@ -72,6 +72,10 @@ typedef unsigned long int uint32_t;
 #define NO_INFNAN_CHECK
 #endif

+#ifndef NO_ERRNO
+#define NO_ERRNO
+#endif
+
 #ifdef WORDS_BIGENDIAN
 #define IEEE_BIG_ENDIAN 1
 #else
@@ -219,8 +219,10 @@ ZEND_API void ZEND_FASTCALL _zval_copy_ctor_func(zval *zvalue ZEND_FILE_LINE_DC)
 {
 	if (EXPECTED(Z_TYPE_P(zvalue) == IS_ARRAY)) {
 		ZVAL_ARR(zvalue, zend_array_dup(Z_ARRVAL_P(zvalue)));
-	} else if (EXPECTED(Z_TYPE_P(zvalue) == IS_STRING) ||
-	           EXPECTED(Z_TYPE_P(zvalue) == IS_CONSTANT)) {
+	} else if (EXPECTED(Z_TYPE_P(zvalue) == IS_STRING)) {
+		CHECK_ZVAL_STRING_REL(Z_STR_P(zvalue));
+		ZVAL_NEW_STR(zvalue, zend_string_dup(Z_STR_P(zvalue), 0));
+	} else if (EXPECTED(Z_TYPE_P(zvalue) == IS_CONSTANT)) {
 		CHECK_ZVAL_STRING_REL(Z_STR_P(zvalue));
 		Z_STR_P(zvalue) = zend_string_dup(Z_STR_P(zvalue), 0);
 	} else if (EXPECTED(Z_TYPE_P(zvalue) == IS_CONSTANT_AST)) {
@@ -45,6 +45,19 @@
 #  define IO_REPARSE_TAG_DEDUP   0x80000013
 # endif

+# ifndef IO_REPARSE_TAG_CLOUD
+#  define IO_REPARSE_TAG_CLOUD    (0x9000001AL)
+# endif
+/* IO_REPARSE_TAG_CLOUD_1 through IO_REPARSE_TAG_CLOUD_F have values of 0x9000101AL
+   to 0x9000F01AL, they can be checked against the mask. */
+#ifndef IO_REPARSE_TAG_CLOUD_MASK
+#define IO_REPARSE_TAG_CLOUD_MASK (0x0000F000L)
+#endif
+
+#ifndef IO_REPARSE_TAG_ONEDRIVE
+#define IO_REPARSE_TAG_ONEDRIVE   (0x80000021L)
+#endif
+
 # ifndef VOLUME_NAME_NT
 #  define VOLUME_NAME_NT 0x2
 # endif
@@ -908,7 +921,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 				return -1;
 			}

-			hLink = CreateFile(path, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_FLAG_OPEN_REPARSE_POINT|FILE_FLAG_BACKUP_SEMANTICS, NULL);
+			hLink = CreateFile(path, 0, 0, NULL, OPEN_EXISTING, FILE_FLAG_OPEN_REPARSE_POINT|FILE_FLAG_BACKUP_SEMANTICS, NULL);
 			if(hLink == INVALID_HANDLE_VALUE) {
 				return -1;
 			}
@@ -977,7 +990,11 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 				};
 				substitutename[substitutename_len] = 0;
 			}
-			else if (pbuffer->ReparseTag == IO_REPARSE_TAG_DEDUP) {
+			else if (pbuffer->ReparseTag == IO_REPARSE_TAG_DEDUP ||
+					/* Starting with 1709. */
+					(pbuffer->ReparseTag & IO_REPARSE_TAG_CLOUD_MASK) != 0 && 0x90001018L != pbuffer->ReparseTag ||
+					IO_REPARSE_TAG_CLOUD == pbuffer->ReparseTag ||
+					IO_REPARSE_TAG_ONEDRIVE == pbuffer->ReparseTag) {
 				isabsolute = 1;
 				memcpy(substitutename, path, len + 1);
 				substitutename_len = len;
@@ -2687,26 +2687,26 @@ EOF
  done

  echo "'[$]0' \\" >> $1
-  if test `expr -- [$]0 : "'.*"` = 0; then
+  if test `expr " [$]0" : " '.*"` = 0; then
    CONFIGURE_COMMAND="$CONFIGURE_COMMAND '[$]0'"
  else 
    CONFIGURE_COMMAND="$CONFIGURE_COMMAND [$]0"
  fi
-
-  for arg in $clean_configure_args; do
-    if test `expr -- $arg : "'.*"` = 0; then
-      if test `expr -- $arg : "-.*"` = 0 && test `expr -- $arg : ".*=.*"` = 0; then
-        continue;
-      fi
-      echo "'[$]arg' \\" >> $1
-      CONFIGURE_OPTIONS="$CONFIGURE_OPTIONS '[$]arg'"
-    else
-      if test `expr -- $arg : "'-.*"` = 0 && test `expr -- $arg : "'.*=.*"` = 0; then
-        continue;
-      fi
-      echo "[$]arg \\" >> $1
-      CONFIGURE_OPTIONS="$CONFIGURE_OPTIONS [$]arg"
-    fi
+  CONFIGURE_ARGS="$clean_configure_args"
+  while test "X$CONFIGURE_ARGS" != "X";
+  do
+   if CURRENT_ARG=`expr "X$CONFIGURE_ARGS" : "X *\('[[^']]*'\)"`
+   then
+     CONFIGURE_ARGS=`expr "X$CONFIGURE_ARGS" : "X *'[[^']]*' \(.*\)"`
+   elif CURRENT_ARG=`expr "X$CONFIGURE_ARGS" : "X *\([[^ ]]*\)"`
+   then
+     CONFIGURE_ARGS=`expr "X$CONFIGURE_ARGS" : "X *[[^ ]]* \(.*\)"`
+     CURRENT_ARG="'$CURRENT_ARG'"
+   else
+    break
+   fi
+   $as_echo "$CURRENT_ARG \\" >>$1
+   CONFIGURE_OPTIONS="$CONFIGURE_OPTIONS $CURRENT_ARG"
  done
  echo '"[$]@"' >> $1
  chmod +x $1
@@ -2,6 +2,7 @@

 set SDK_REMOTE=https://github.com/OSTC/php-sdk-binary-tools.git
 set SDK_BRANCH=%PHP_BUILD_SDK_BRANCH%
+set SDK_RUNNER=%PHP_BUILD_CACHE_SDK_DIR%\phpsdk-vc14-%PLATFORM%.bat

 if not exist "%PHP_BUILD_CACHE_BASE_DIR%" (
 	echo Creating %PHP_BUILD_CACHE_BASE_DIR%
@@ -13,17 +14,25 @@ if not exist "%PHP_BUILD_OBJ_DIR%" (
 	mkdir "%PHP_BUILD_OBJ_DIR%"
 )

+if not exist "%SDK_RUNNER%" (
+	if exist "%PHP_BUILD_CACHE_SDK_DIR%" rmdir /s /q "%PHP_BUILD_CACHE_SDK_DIR%"
+)
+
 if not exist "%PHP_BUILD_CACHE_SDK_DIR%" (
 	echo Cloning remote SDK repository
 	git clone --branch %SDK_BRANCH% %SDK_REMOTE% "%PHP_BUILD_CACHE_SDK_DIR%" 2>&1 
-) else (
+)
+
+for /f "tokens=*" %%a in ('type %PHP_BUILD_CACHE_SDK_DIR%\VERSION') do set GOT_SDK_VER=%%a
+echo Got SDK version %GOT_SDK_VER%
+if NOT "%GOT_SDK_VER%" == "%PHP_BUILD_SDK_BRANCH:~8%" (
+	echo Switching to the configured SDK version %SDK_BRANCH:~8%
 	echo Fetching remote SDK repository
 	git --git-dir="%PHP_BUILD_CACHE_SDK_DIR%\.git" --work-tree="%PHP_BUILD_CACHE_SDK_DIR%" fetch --prune origin 2>&1
 	echo Checkout SDK repository branch
 	git --git-dir="%PHP_BUILD_CACHE_SDK_DIR%\.git" --work-tree="%PHP_BUILD_CACHE_SDK_DIR%" checkout --force %SDK_BRANCH% 
 )

-set SDK_RUNNER=%PHP_BUILD_CACHE_SDK_DIR%\phpsdk-vc14-%PLATFORM%.bat
 if not exist "%SDK_RUNNER%" (
 	echo "%SDK_RUNNER%" doesn't exist
 	exit /b 3
@@ -2,10 +2,14 @@

 if "%APPVEYOR%" equ "True" rmdir /s /q C:\cygwin >NUL 2>NUL
 if %errorlevel% neq 0 exit /b 3
+if "%APPVEYOR%" equ "True" rmdir /s /q C:\cygwin64 >NUL 2>NUL
+if %errorlevel% neq 0 exit /b 3
 if "%APPVEYOR%" equ "True" rmdir /s /q C:\mingw >NUL 2>NUL
 if %errorlevel% neq 0 exit /b 3
 if "%APPVEYOR%" equ "True" rmdir /s /q C:\mingw-w64 >NUL 2>NUL
 if %errorlevel% neq 0 exit /b 3
+if "%APPVEYOR%" equ "True" rmdir /s /q C:\msys64 >NUL 2>NUL
+if %errorlevel% neq 0 exit /b 3

 cd /D %APPVEYOR_BUILD_FOLDER%
 if %errorlevel% neq 0 exit /b 3
@@ -22,12 +26,19 @@ echo Updating dependencies in %DEPS_DIR%
 cmd /c phpsdk_deps --update --no-backup --branch %BRANCH% --stability %STABILITY% --deps %DEPS_DIR%
 if %errorlevel% neq 0 exit /b 3

+rem Something went wrong, most likely when concurrent builds were to fetch deps
+rem updates. It might be, that some locking mechanism is needed.
+if not exist "%DEPS_DIR%" (
+	cmd /c phpsdk_deps --update --force --no-backup --branch %BRANCH% --stability %STABILITY% --deps %DEPS_DIR%
+)
+if %errorlevel% neq 0 exit /b 3
+
 cmd /c buildconf.bat --force
 if %errorlevel% neq 0 exit /b 3

 if "%THREAD_SAFE%" equ "0" set ADD_CONF=--disable-zts

-set EXT_EXCLUDE_FROM_TEST=snmp,oci8_12c,pdo_oci,pdo_odbc,odbc,pdo_firebird,interbase,ldap,imap,dba
+set EXT_EXCLUDE_FROM_TEST=snmp,oci8_12c,pdo_oci,pdo_odbc,odbc,pdo_firebird,interbase,ldap,imap,dba,ftp
 if "%OPCACHE%" equ "0" set EXT_EXCLUDE_FROM_TEST=%EXT_EXCLUDE_FROM_TEST%,opcache

 cmd /c configure.bat ^
@@ -119,8 +119,8 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=0
-PHP_RELEASE_VERSION=22
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=33
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -59,7 +59,7 @@ bc_divmod (bc_num num1, bc_num num2, bc_num *quot, bc_num *rem, int scale)
  bc_init_num(&temp);

  /* Calculate it. */
-  bc_divide (num1, num2, &temp, scale);
+  bc_divide (num1, num2, &temp, 0);
  if (quot)
    quotient = bc_copy_num (temp);
  bc_multiply (temp, num2, &temp, rscale);
@@ -45,7 +45,7 @@
 int
 bc_raisemod (bc_num base, bc_num expo, bc_num mod, bc_num *result, int scale)
 {
-  bc_num power, exponent, parity, temp;
+  bc_num power, exponent, modulus, parity, temp;
  int rscale;

  /* Check for correct numbers. */
@@ -55,12 +55,16 @@ bc_raisemod (bc_num base, bc_num expo, bc_num mod, bc_num *result, int scale)
  /* Set initial values.  */
  power = bc_copy_num (base);
  exponent = bc_copy_num (expo);
+  modulus = bc_copy_num (mod);
  temp = bc_copy_num (BCG(_one_));
  bc_init_num(&parity);

  /* Check the base for scale digits. */
-  if (base->n_scale != 0)
+  if (power->n_scale != 0)
+    {
      bc_rt_warn ("non-zero scale in base");
+      bc_divide (power, BCG(_one_), &power, 0); /*truncate */
+    }

  /* Check the exponent for scale digits. */
  if (exponent->n_scale != 0)
@@ -70,27 +74,38 @@ bc_raisemod (bc_num base, bc_num expo, bc_num mod, bc_num *result, int scale)
    }

  /* Check the modulus for scale digits. */
-  if (mod->n_scale != 0)
+  if (modulus->n_scale != 0)
+    {
      bc_rt_warn ("non-zero scale in modulus");
+      bc_divide (modulus, BCG(_one_), &modulus, 0); /*truncate */
+    }

  /* Do the calculation. */
-  rscale = MAX(scale, base->n_scale);
-  while ( !bc_is_zero(exponent) )
+  rscale = MAX(scale, power->n_scale);
+  if ( !bc_compare(modulus, BCG(_one_)) )
    {
-      (void) bc_divmod (exponent, BCG(_two_), &exponent, &parity, 0);
-      if ( !bc_is_zero(parity) )
+      temp = bc_new_num (1, scale);
+    }
+  else
+    {
+      while ( !bc_is_zero(exponent) )
 	{
-	  bc_multiply (temp, power, &temp, rscale);
-	  (void) bc_modulo (temp, mod, &temp, scale);
-	}
+	  (void) bc_divmod (exponent, BCG(_two_), &exponent, &parity, 0);
+	  if ( !bc_is_zero(parity) )
+	    {
+	      bc_multiply (temp, power, &temp, rscale);
+	      (void) bc_modulo (temp, modulus, &temp, scale);
+	    }

-      bc_multiply (power, power, &power, rscale);
-      (void) bc_modulo (power, mod, &power, scale);
+	  bc_multiply (power, power, &power, rscale);
+	  (void) bc_modulo (power, modulus, &power, scale);
+	}
    }

  /* Assign the value. */
  bc_free_num (&power);
  bc_free_num (&exponent);
+  bc_free_num (&modulus);
  bc_free_num (result);
  bc_free_num (&parity);
  *result = temp;
@@ -105,5 +105,8 @@ bc_str2num (bc_num *num, char *str, int scale)
      for (;strscale > 0; strscale--)
 	*nptr++ = CH_VAL(*ptr++);
    }
+
+  if (bc_is_zero (*num))
+    (*num)->n_sign = PLUS;
 }

@@ -0,0 +1,16 @@
+--TEST--
+Bug #44995 (bcpowmod() fails if scale != 0)
+--SKIPIF--
+<?php
+if (!extension_loaded('bcmath')) die('skip bcmath extension not available');
+?>
+--FILE--
+<?php
+var_dump(bcpowmod('4', '4', '3', 1));
+var_dump(bcpowmod('3234', '32345', '22345', 1));
+?>
+===DONE===
+--EXPECT--
+string(3) "1.0"
+string(7) "17334.0"
+===DONE===
@@ -0,0 +1,16 @@
+--TEST--
+Bug #46781 (BC math handles minus zero incorrectly)
+--SKIPIF--
+<?php
+if (!extension_loaded('bcmath')) die('skip bcmath extension is not available');
+?>
+--FILE--
+<?php
+var_dump(bcadd('-0.0', '-0.0', 1));
+var_dump(bccomp('-0.0', '0', 1));
+?>
+===DONE===
+--EXPECT--
+string(3) "0.0"
+int(0)
+===DONE===
@@ -0,0 +1,16 @@
+--TEST--
+Bug #54598 (bcpowmod() may return 1 if modulus is 1)
+--SKIPIF--
+<?php
+if (!extension_loaded('bcmath')) die('skip bcmath extension is not available');
+?>
+--FILE--
+<?php
+var_dump(bcpowmod(5, 0, 1));
+var_dump(bcpowmod(5, 0, 1, 3));
+?>
+===DONE===
+--EXPECT--
+string(1) "0"
+string(5) "0.000"
+===DONE===
@@ -0,0 +1,21 @@
+--TEST--
+Bug #75178 (bcpowmod() misbehaves for non-integer base or modulus)
+--SKIPIF--
+<?php
+if (!extension_loaded('bcmath')) die('skip bcmath extension is not available');
+if (substr(PHP_OS, 0, 3) != 'WIN') {
+    die('skip valid only for windows');
+}
+?>
+--FILE--
+<?php
+var_dump(bcpowmod('4.1', '4', '3', 3));
+var_dump(bcpowmod('4', '4', '3.1', 3));
+?>
+===DONE===
+--EXPECT--
+string(5) "1.000"
+string(5) "1.000"
+===DONE===
+bc math warning: non-zero scale in base
+bc math warning: non-zero scale in modulus
@@ -0,0 +1,21 @@
+--TEST--
+Bug #75178 (bcpowmod() misbehaves for non-integer base or modulus)
+--SKIPIF--
+<?php
+if (!extension_loaded('bcmath')) die('skip bcmath extension is not available');
+if (substr(PHP_OS, 0, 3) == 'WIN') {
+    die('skip Not valid for windows');
+}
+?>
+--FILE--
+<?php
+var_dump(bcpowmod('4.1', '4', '3', 3));
+var_dump(bcpowmod('4', '4', '3.1', 3));
+?>
+===DONE===
+--EXPECT--
+bc math warning: non-zero scale in base
+string(5) "1.000"
+bc math warning: non-zero scale in modulus
+string(5) "1.000"
+===DONE===
@@ -17,12 +17,24 @@ if test "$PHP_CURL" != "no"; then
        break
      fi
    done
+    if test -z "$CURL_DIR"; then
+      AC_MSG_RESULT(not found)
+      if which dpkg-architecture>/dev/null; then
+        AC_MSG_CHECKING(for cURL in multiarch path)
+        CURL_MULTIARCH_INCLUDE=/usr/include/$(dpkg-architecture -qDEB_HOST_MULTIARCH)
+        if test -r $CURL_MULTIARCH_INCLUDE/curl/easy.h; then
+          CURL_DIR=/usr
+          AC_MSG_RESULT(found in $CURL_MULTIARCH_INCLUDE)
+        else
+          AC_MSG_RESULT(not found)
+        fi
+      fi
+    fi
  fi

  if test -z "$CURL_DIR"; then
-    AC_MSG_RESULT(not found)
-    AC_MSG_ERROR(Please reinstall the libcurl distribution -
-    easy.h should be in <curl-dir>/include/curl/)
+    AC_MSG_ERROR(Could not find cURL, please reinstall the libcurl distribution -dnl
+ easy.h should be in <curl-dir>/include/curl/)
  fi

  CURL_CONFIG="curl-config"
@@ -45,7 +57,11 @@ if test "$PHP_CURL" != "no"; then
    AC_MSG_ERROR(cURL version 7.10.5 or later is required to compile php with cURL support)
  fi

-  PHP_ADD_INCLUDE($CURL_DIR/include)
+  if test -z "$CURL_MULTIARCH_INCLUDE"; then
+    PHP_ADD_INCLUDE($CURL_DIR/include)
+  else
+    PHP_ADD_INCLUDE($CURL_MULTIARCH_INCLUDE)
+  fi
  PHP_EVAL_LIBLINE($CURL_LIBS, CURL_SHARED_LIBADD)
  PHP_ADD_LIBRARY_WITH_PATH(curl, $CURL_DIR/$PHP_LIBDIR, CURL_SHARED_LIBADD)
  
@@ -57,6 +73,8 @@ if test "$PHP_CURL" != "no"; then
   
    save_CFLAGS="$CFLAGS"
    CFLAGS="`$CURL_CONFIG --cflags`"
+    save_LDFLAGS="$LDFLAGS"
+    LDFLAGS="`$CURL_CONFIG --libs`"
   
    AC_PROG_CPP
    AC_MSG_CHECKING([for openssl support in libcurl])
@@ -114,6 +132,7 @@ int main(int argc, char *argv[])
    ])
   
    CFLAGS="$save_CFLAGS"
+    LDFLAGS="$save_LDFLAGS"
  else
    AC_MSG_RESULT([no])
  fi
@@ -899,7 +899,7 @@ datefull         = day ([ \t.-])* monthtext ([ \t.-])* year;
 datenoday        = monthtext ([ .\t-])* year4;
 datenodayrev     = year4 ([ .\t-])* monthtext;
 datetextual      = monthtext ([ .\t-])* day [,.stndrh\t ]+ year;
-datenoyear       = monthtext ([ .\t-])* day [,.stndrh\t ]*;
+datenoyear       = monthtext ([ .\t-])* day ([,.stndrh\t ]+|[\000]);
 datenoyearrev    = day ([ .\t-])* monthtext;
 datenocolon      = year4 monthlz daylz;

@@ -917,8 +917,8 @@ isoweek          = year4 "-"? "W" weekofyear;
 exif             = year4 ":" monthlz ":" daylz " " hour24lz ":" minutelz ":" secondlz;
 firstdayof       = 'first day of';
 lastdayof        = 'last day of';
-backof           = 'back of ' hour24 space? meridian?;
-frontof          = 'front of ' hour24 space? meridian?;
+backof           = 'back of ' hour24 (space? meridian)?;
+frontof          = 'front of ' hour24 (space? meridian)?;

 /* Common Log Format: 10/Oct/2000:13:55:36 -0700 */
 clf              = day "/" monthabbr "/" year4 ":" hour24lz ":" minutelz ":" secondlz space tzcorrection;
@@ -647,6 +647,7 @@ static HashTable *date_object_get_gc_timezone(zval *object, zval **table, int *n

 zval *date_interval_read_property(zval *object, zval *member, int type, void **cache_slot, zval *rv);
 void date_interval_write_property(zval *object, zval *member, zval *value, void **cache_slot);
+static zval *date_interval_get_property_ptr_ptr(zval *object, zval *member, int type, void **cache_slot);
 static zval *date_period_read_property(zval *object, zval *member, int type, void **cache_slot, zval *rv);
 static void date_period_write_property(zval *object, zval *member, zval *value, void **cache_slot);

@@ -910,6 +911,7 @@ PHP_MINFO_FUNCTION(date)

 	php_info_print_table_start();
 	php_info_print_table_row(2, "date/time support", "enabled");
+	php_info_print_table_row(2, "timelib version", TIMELIB_ASCII_VERSION);
 	php_info_print_table_row(2, "\"Olson\" Timezone Database Version", tzdb->version);
 	php_info_print_table_row(2, "Timezone Database", php_date_global_timezone_db_enabled ? "external" : "internal");
 	php_info_print_table_row(2, "Default timezone", guess_timezone(tzdb));
@@ -1932,6 +1934,10 @@ static void date_period_it_rewind(zend_object_iterator *iter)
 	if (iterator->object->current) {
 		timelib_time_dtor(iterator->object->current);
 	}
+	if (!iterator->object->start) {
+		zend_throw_error(NULL, "DatePeriod has not been initialized correctly");
+		return;
+	}
 	iterator->object->current = timelib_time_clone(iterator->object->start);
 	date_period_it_invalidate_current(iter);
 }
@@ -1986,7 +1992,7 @@ static int date_interval_has_property(zval *object, zval *member, int type, void
 	zval *prop;
 	int retval = 0;

-	if (Z_TYPE_P(member) != IS_STRING) {
+	if (UNEXPECTED(Z_TYPE_P(member) != IS_STRING)) {
 		ZVAL_COPY(&tmp_member, member);
 		convert_to_string(&tmp_member);
 		member = &tmp_member;
@@ -2002,10 +2008,10 @@ static int date_interval_has_property(zval *object, zval *member, int type, void
 		}
 		return retval;
 	}
-
-	prop = date_interval_read_property(object, member, type, cache_slot, &rv);
-
-	if (prop != NULL) {
+	
+	prop = date_interval_read_property(object, member, BP_VAR_IS, cache_slot, &rv);
+	
+	if (prop != &EG(uninitialized_zval)) {
 		if (type == 2) {
 			retval = 1;
 		} else if (type == 1) {
@@ -2112,7 +2118,7 @@ static void date_register_classes(void) /* {{{ */
 	date_object_handlers_interval.read_property = date_interval_read_property;
 	date_object_handlers_interval.write_property = date_interval_write_property;
 	date_object_handlers_interval.get_properties = date_object_get_properties_interval;
-	date_object_handlers_interval.get_property_ptr_ptr = NULL;
+	date_object_handlers_interval.get_property_ptr_ptr = date_interval_get_property_ptr_ptr;
 	date_object_handlers_interval.get_gc = date_object_get_gc_interval;

 	INIT_CLASS_ENTRY(ce_period, "DatePeriod", date_funcs_period);
@@ -4137,6 +4143,40 @@ void date_interval_write_property(zval *object, zval *member, zval *value, void
 }
 /* }}} */

+/* {{{ date_interval_get_property_ptr_ptr */
+static zval *date_interval_get_property_ptr_ptr(zval *object, zval *member, int type, void **cache_slot)
+{
+	zval tmp_member, *ret;
+
+	if (Z_TYPE_P(member) != IS_STRING) {
+		tmp_member = *member;
+		zval_copy_ctor(&tmp_member);
+		convert_to_string(&tmp_member);
+		member = &tmp_member;
+		cache_slot = NULL;
+	}
+
+	if(zend_binary_strcmp("y", sizeof("y") - 1, Z_STRVAL_P(member), Z_STRLEN_P(member)) == 0 ||
+		zend_binary_strcmp("m", sizeof("m") - 1, Z_STRVAL_P(member), Z_STRLEN_P(member)) == 0 ||
+		zend_binary_strcmp("d", sizeof("d") - 1, Z_STRVAL_P(member), Z_STRLEN_P(member)) == 0 ||
+		zend_binary_strcmp("h", sizeof("h") - 1, Z_STRVAL_P(member), Z_STRLEN_P(member)) == 0 ||
+		zend_binary_strcmp("i", sizeof("i") - 1, Z_STRVAL_P(member), Z_STRLEN_P(member)) == 0 ||
+		zend_binary_strcmp("s", sizeof("s") - 1, Z_STRVAL_P(member), Z_STRLEN_P(member)) == 0 ||
+		zend_binary_strcmp("days", sizeof("days") - 1, Z_STRVAL_P(member), Z_STRLEN_P(member)) == 0 ||
+		zend_binary_strcmp("invert", sizeof("invert") - 1, Z_STRVAL_P(member), Z_STRLEN_P(member)) == 0) {
+		/* Fallback to read_property. */
+		ret = NULL;
+	} else {
+		ret = (zend_get_std_object_handlers())->get_property_ptr_ptr(object, member, type, cache_slot);
+	}
+
+	if (member == &tmp_member) {
+		zval_dtor(member);
+	}
+
+	return ret;
+}
+/* }}} */

 /* {{{ proto DateInterval::__construct([string interval_spec])
   Creates new DateInterval object.
@@ -8,17 +8,8 @@ date_default_timezone_set('UTC');
  echo "Done\n";
 ?>
 --EXPECTF--
-array(6) {
+array(5) {
  [0]=>
-  array(3) {
-    ["dst"]=>
-    bool(false)
-    ["offset"]=>
-    int(0)
-    ["timezone_id"]=>
-    string(16) "Antarctica/Troll"
-  }
-  [1]=>
  array(3) {
    ["dst"]=>
    bool(false)
@@ -27,7 +18,7 @@ array(6) {
    ["timezone_id"]=>
    string(13) "Etc/Universal"
  }
-  [2]=>
+  [1]=>
  array(3) {
    ["dst"]=>
    bool(false)
@@ -36,7 +27,7 @@ array(6) {
    ["timezone_id"]=>
    string(7) "Etc/UTC"
  }
-  [3]=>
+  [2]=>
  array(3) {
    ["dst"]=>
    bool(false)
@@ -45,6 +36,15 @@ array(6) {
    ["timezone_id"]=>
    string(8) "Etc/Zulu"
  }
+  [3]=>
+  array(3) {
+    ["dst"]=>
+    bool(false)
+    ["offset"]=>
+    int(0)
+    ["timezone_id"]=>
+    string(3) "UTC"
+  }
  [4]=>
  array(3) {
    ["dst"]=>
@@ -54,14 +54,5 @@ array(6) {
    ["timezone_id"]=>
    string(3) "UTC"
  }
-  [5]=>
-  array(3) {
-    ["dst"]=>
-    bool(false)
-    ["offset"]=>
-    int(0)
-    ["timezone_id"]=>
-    string(3) "UTC"
-  }
 }
 Done
@@ -1,6 +1,5 @@
 --TEST--
-DateTimeZone::getLocation -- timezone_location_get — Returns location information for a timezone
-public array DateTimeZone::getLocation ( void ) ;
+DateTimeZone::getLocation -- timezone_location_get — Returns location information for a timezone public array DateTimeZone::getLocation ( void ) ;
 --CREDITS--
 marcosptf - <marcosptf@yahoo.com.br> - #phparty7 - @phpsp - novatec/2015 - sao paulo - br
 --SKIPIF--
@@ -53,30 +52,9 @@ Array
    [comments] => %s
 )
 Array
-(
-    [country_code] => %s
-    [latitude] => %f
-    [longitude] => %f
-    [comments] => 
-)
-Array
 (
    [country_code] => %s
    [latitude] => %f
    [longitude] => %f
    [comments] => %s
 )
-Array
-(
-    [country_code] => %s
-    [latitude] => %f
-    [longitude] => %f
-    [comments] => %s
-)
-Array
-(
-    [country_code] => %s
-    [latitude] => %f
-    [longitude] => %f
-    [comments] => 
-)
@@ -29,15 +29,15 @@ string(5) "array"
 int(%d)

 -- Format a sample entry --
-array(11) {
+array(12) {
  [0]=>
  array(3) {
    ["dst"]=>
-    bool(true)
+    bool(false)
    ["offset"]=>
-    int(-14400)
+    int(32400)
    ["timezone_id"]=>
-    string(18) "America/Porto_Acre"
+    string(18) "Australia/Adelaide"
  }
  [1]=>
  array(3) {
@@ -51,47 +51,47 @@ array(11) {
  [2]=>
  array(3) {
    ["dst"]=>
-    bool(true)
+    bool(false)
    ["offset"]=>
-    int(-14400)
+    int(32400)
    ["timezone_id"]=>
-    string(16) "America/Eirunepe"
+    string(21) "Australia/Broken_Hill"
  }
  [3]=>
  array(3) {
    ["dst"]=>
-    bool(true)
+    bool(false)
    ["offset"]=>
-    int(-14400)
+    int(32400)
    ["timezone_id"]=>
-    string(18) "America/Rio_Branco"
+    string(16) "Australia/Darwin"
  }
  [4]=>
  array(3) {
    ["dst"]=>
-    bool(true)
+    bool(false)
    ["offset"]=>
-    int(-14400)
+    int(32400)
    ["timezone_id"]=>
-    string(11) "Brazil/Acre"
+    string(15) "Australia/North"
  }
  [5]=>
  array(3) {
    ["dst"]=>
    bool(false)
    ["offset"]=>
-    int(34200)
+    int(32400)
    ["timezone_id"]=>
-    string(13) "Asia/Jayapura"
+    string(15) "Australia/South"
  }
  [6]=>
  array(3) {
    ["dst"]=>
    bool(false)
    ["offset"]=>
-    int(34200)
+    int(32400)
    ["timezone_id"]=>
-    string(21) "Australia/Broken_Hill"
+    string(20) "Australia/Yancowinna"
  }
  [7]=>
  array(3) {
@@ -100,7 +100,7 @@ array(11) {
    ["offset"]=>
    int(34200)
    ["timezone_id"]=>
-    string(16) "Australia/Darwin"
+    string(21) "Australia/Broken_Hill"
  }
  [8]=>
  array(3) {
@@ -109,7 +109,7 @@ array(11) {
    ["offset"]=>
    int(34200)
    ["timezone_id"]=>
-    string(15) "Australia/North"
+    string(16) "Australia/Darwin"
  }
  [9]=>
  array(3) {
@@ -118,9 +118,18 @@ array(11) {
    ["offset"]=>
    int(34200)
    ["timezone_id"]=>
-    string(15) "Australia/South"
+    string(15) "Australia/North"
  }
  [10]=>
+  array(3) {
+    ["dst"]=>
+    bool(false)
+    ["offset"]=>
+    int(34200)
+    ["timezone_id"]=>
+    string(15) "Australia/South"
+  }
+  [11]=>
  array(3) {
    ["dst"]=>
    bool(false)
@@ -5,7 +5,7 @@ date.timezone=Asia/Singapore
 --FILE--
 <?php

-print strtotime('2008-05-23 00:00:00 SGT');
+print strtotime('2008-05-23 00:00:00 +08');
 print "\n";
 print strtotime('2008-05-23 00:00:00');

@@ -40,7 +40,7 @@ object(DateInterval)#%d (15) {
  ["special_amount"]=>
  int(-1)
  ["have_weekday_relative"]=>
-  int(9)
+  int(%d)
  ["have_special_relative"]=>
  int(0)
 }
@@ -0,0 +1,17 @@
+--TEST--
+Bug #74852 property_exists returns true on unknown DateInterval property
+--FILE--
+<?php
+
+$interval = new DateInterval('P2D');
+var_dump(property_exists($interval,'abcde'));
+var_dump(isset($interval->abcde));
+var_dump($interval->abcde);
+
+?>
+--EXPECTF--
+bool(false)
+bool(false)
+
+Notice: Undefined property: DateInterval::$abcde in %s on line %d
+NULL
@@ -0,0 +1,22 @@
+--TEST--
+Bug #75002 Null Pointer Dereference in timelib_time_clone
+--FILE--
+<?php
+
+class aaa extends DatePeriod {
+	public function __construct() { }
+}
+
+$start=new DateTime( '2012-08-01' );
+
+foreach (new aaa($start) as $y) {
+	$a=$key;
+}
+
+?>
+==DONE==
+--EXPECTF--	
+Fatal error: Uncaught Error: DatePeriod has not been initialized correctly in %sbug75002.php:%d
+Stack trace:
+#0 {main}
+  thrown in %sbug75002.php on line %d
@@ -34,14 +34,14 @@ foreach ( $tests as $start => $data )
 echo "\n";
 ?>
 --EXPECT--
-Sat, 23 Oct 2010 00:00:00 +0000
+Fri, 15 Oct 2010 23:00:00 +0000
 Wed, 15 Dec 2010 16:15:00 +0000
 Mon, 20 Dec 2010 00:00:00 +0000
 Mon, 20 Dec 2010 10:00:00 +0000
 Tue, 21 Dec 2010 12:00:00 +0000
 Mon, 03 Jan 2011 00:00:00 +0000
 Mon, 03 Jan 2011 09:00:00 +0000
-Sat, 23 Oct 2010 00:00:00 +0100
+Fri, 15 Oct 2010 23:00:00 +0100
 Sun, 28 Mar 2010 00:15:00 +0000
 Sun, 28 Mar 2010 02:15:00 +0100
 Sun, 28 Mar 2010 02:15:00 +0100
@@ -0,0 +1,16 @@
+--TEST--
+Test DateInterval props with dimension handling
+--FILE--
+<?php
+class Z extends DateInterval{}
+$z = new Z('P2Y4DT6H8M');
+$i = 0;
+$z->prop[1]=10;
+while ($i < 1026) {
+	$z->prop[$i] = $i;
+	$i++;
+}
+?>
+==NOCRASH==
+--EXPECT--
+==NOCRASH==
@@ -26,18 +26,18 @@ var_dump( $abbr["acst"] );
 --EXPECTF--
 *** Testing timezone_abbreviations_list() : basic functionality ***
 string(5) "array"
-int(%d)
+int(142)

 -- Format a sample entry --
-array(11) {
+array(12) {
  [0]=>
  array(3) {
    ["dst"]=>
-    bool(true)
+    bool(false)
    ["offset"]=>
-    int(-14400)
+    int(32400)
    ["timezone_id"]=>
-    string(18) "America/Porto_Acre"
+    string(18) "Australia/Adelaide"
  }
  [1]=>
  array(3) {
@@ -51,47 +51,47 @@ array(11) {
  [2]=>
  array(3) {
    ["dst"]=>
-    bool(true)
+    bool(false)
    ["offset"]=>
-    int(-14400)
+    int(32400)
    ["timezone_id"]=>
-    string(16) "America/Eirunepe"
+    string(21) "Australia/Broken_Hill"
  }
  [3]=>
  array(3) {
    ["dst"]=>
-    bool(true)
+    bool(false)
    ["offset"]=>
-    int(-14400)
+    int(32400)
    ["timezone_id"]=>
-    string(18) "America/Rio_Branco"
+    string(16) "Australia/Darwin"
  }
  [4]=>
  array(3) {
    ["dst"]=>
-    bool(true)
+    bool(false)
    ["offset"]=>
-    int(-14400)
+    int(32400)
    ["timezone_id"]=>
-    string(11) "Brazil/Acre"
+    string(15) "Australia/North"
  }
  [5]=>
  array(3) {
    ["dst"]=>
    bool(false)
    ["offset"]=>
-    int(34200)
+    int(32400)
    ["timezone_id"]=>
-    string(13) "Asia/Jayapura"
+    string(15) "Australia/South"
  }
  [6]=>
  array(3) {
    ["dst"]=>
    bool(false)
    ["offset"]=>
-    int(34200)
+    int(32400)
    ["timezone_id"]=>
-    string(21) "Australia/Broken_Hill"
+    string(20) "Australia/Yancowinna"
  }
  [7]=>
  array(3) {
@@ -100,7 +100,7 @@ array(11) {
    ["offset"]=>
    int(34200)
    ["timezone_id"]=>
-    string(16) "Australia/Darwin"
+    string(21) "Australia/Broken_Hill"
  }
  [8]=>
  array(3) {
@@ -109,7 +109,7 @@ array(11) {
    ["offset"]=>
    int(34200)
    ["timezone_id"]=>
-    string(15) "Australia/North"
+    string(16) "Australia/Darwin"
  }
  [9]=>
  array(3) {
@@ -118,9 +118,18 @@ array(11) {
    ["offset"]=>
    int(34200)
    ["timezone_id"]=>
-    string(15) "Australia/South"
+    string(15) "Australia/North"
  }
  [10]=>
+  array(3) {
+    ["dst"]=>
+    bool(false)
+    ["offset"]=>
+    int(34200)
+    ["timezone_id"]=>
+    string(15) "Australia/South"
+  }
+  [11]=>
  array(3) {
    ["dst"]=>
    bool(false)
@@ -24,11 +24,6 @@ var_dump( timezone_name_from_abbr("EDT") );
 echo "-- Lookup with name and offset--\n"; 
 var_dump( timezone_name_from_abbr("ADT", -10800) );
 var_dump( timezone_name_from_abbr("ADT", 14400) );
-var_dump( timezone_name_from_abbr("AKTT", 14400) );
-var_dump( timezone_name_from_abbr("aktt", 18000) );
-var_dump( timezone_name_from_abbr("Aktt", 21600) );
-var_dump( timezone_name_from_abbr("AMST", -10800) );
-var_dump( timezone_name_from_abbr("amst", 180000) );

 echo "-- Tests without valid name - uses gmtOffset and isdst to find match --\n"; 
 var_dump( timezone_name_from_abbr("", 3600, 1) );
@@ -51,12 +46,7 @@ string(13) "Europe/Berlin"
 string(16) "America/New_York"
 -- Lookup with name and offset--
 string(15) "America/Halifax"
-string(12) "Asia/Baghdad"
-string(11) "Asia/Aqtobe"
-string(11) "Asia/Aqtobe"
-string(11) "Asia/Aqtobe"
-string(17) "America/Boa_Vista"
-string(12) "Asia/Yerevan"
+string(15) "America/Halifax"
 -- Tests without valid name - uses gmtOffset and isdst to find match --
 string(13) "Europe/London"
 string(17) "America/Sao_Paulo"
@@ -65,4 +55,4 @@ string(15) "America/Halifax"
 -- Tests with invalid offsets --
 bool(false)
 bool(false)
-===DONE===
+===DONE===
@@ -5,7 +5,7 @@ Test 5: HTML Test
 --FILE--
 <?php
 $dom = new domdocument;
-$dom->loadHTMLFile(dirname(__FILE__)."/test.html");
+$dom->loadHTMLFile(dirname(__FILE__)."/test.html", LIBXML_NOBLANKS);
 print  "--- save as XML\n";

 print adjustDoctype($dom->saveXML());
@@ -323,7 +323,6 @@ PHP_MINFO_FUNCTION(enchant)
 #elif defined(HAVE_ENCHANT_BROKER_SET_PARAM)
 	php_info_print_table_row(2, "Libenchant Version", "1.5.0 or later");
 #endif
-	php_info_print_table_row(2, "Revision", "$Id$");
 	php_info_print_table_end();

 	php_info_print_table_start();
@@ -483,6 +482,11 @@ PHP_FUNCTION(enchant_broker_get_dict_path)
 			RETURN_FALSE;
 	}

+	if (value == NULL) {
+		php_error_docref(NULL, E_WARNING, "dict_path not set");
+		RETURN_FALSE;
+	}
+
 	RETURN_STRING(value);
 }
 /* }}} */
@@ -24,7 +24,7 @@
 extern zend_module_entry enchant_module_entry;
 #define phpext_enchant_ptr &enchant_module_entry

-#define PHP_ENCHANT_VERSION "1.1.0"
+#define PHP_ENCHANT_VERSION PHP_VERSION

 #ifdef PHP_WIN32
 #define PHP_ENCHANT_API __declspec(dllexport)
@@ -0,0 +1,20 @@
+--TEST--
+Bug #53070 (enchant_broker_get_path crashes if no path is set)
+--SKIPIF--
+<?php
+if(!extension_loaded('enchant')) die('skip, enchant not loader');
+if (!is_resource(enchant_broker_init())) {die("skip, resource dont load\n");}
+?>
+--FILE--
+<?php
+$broker = enchant_broker_init();
+var_dump(enchant_broker_get_dict_path($broker, ENCHANT_MYSPELL));
+var_dump(enchant_broker_get_dict_path($broker, ENCHANT_ISPELL));
+?>
+--EXPECTF--
+
+Warning: enchant_broker_get_dict_path(): dict_path not set in %s on line %d
+bool(false)
+
+Warning: enchant_broker_get_dict_path(): dict_path not set in %s on line %d
+bool(false)
@@ -1704,7 +1704,7 @@ static void exif_iif_add_value(image_info_type *image_info, int section_index, c
 		case TAG_FMT_UNDEFINED:
 			if (value) {
 				if (tag == TAG_MAKER_NOTE) {
-					length = MIN(length, strlen(value));
+					length = (int) php_strnlen(value, length);
 				}

 				/* do not recompute length here */
@@ -2536,7 +2536,10 @@ static void exif_thumbnail_extract(image_info_type *ImageInfo, char *offset, siz
 		return;
 	}
 	/* Check to make sure we are not going to go past the ExifLength */
-	if ((ImageInfo->Thumbnail.offset + ImageInfo->Thumbnail.size) > length) {
+	if (ImageInfo->Thumbnail.size > length
+		|| (ImageInfo->Thumbnail.offset + ImageInfo->Thumbnail.size) > length
+		|| ImageInfo->Thumbnail.offset > length - ImageInfo->Thumbnail.size
+	) {
 		EXIF_ERRLOG_THUMBEOF(ImageInfo)
 		return;
 	}
@@ -2714,6 +2717,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 	int NumDirEntries, old_motorola_intel, offset_diff;
 	const maker_note_type *maker_note;
 	char *dir_start;
+	int data_len;

 	for (i=0; i<=sizeof(maker_note_array)/sizeof(maker_note_type); i++) {
 		if (i==sizeof(maker_note_array)/sizeof(maker_note_type)) {
@@ -2768,6 +2772,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 	switch (maker_note->offset_mode) {
 		case MN_OFFSET_MAKER:
 			offset_base = value_ptr;
+			data_len = value_len;
 			break;
 		case MN_OFFSET_GUESS:
 			if (maker_note->offset + 10 + 4 >= value_len) {
@@ -2784,6 +2789,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 				return FALSE;
 			}
 			offset_base = value_ptr + offset_diff;
+			data_len = value_len - offset_diff;
 			break;
 		default:
 		case MN_OFFSET_NORMAL:
@@ -2797,7 +2803,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu

 	for (de=0;de<NumDirEntries;de++) {
 		if (!exif_process_IFD_TAG(ImageInfo, dir_start + 2 + 12 * de,
-								  offset_base, IFDlength, displacement, section_index, 0, maker_note->tag_table)) {
+								  offset_base, data_len, displacement, section_index, 0, maker_note->tag_table)) {
 			return FALSE;
 		}
 	}
@@ -22,7 +22,7 @@
 #if HAVE_EXIF

 #include "php_version.h"
-#define PHP_EXIF_VERSION "1.4 $Id: 8bdc0c8f27c2c9dd1f7551f1f9fe3ab57a06a4b1 $"
+#define PHP_EXIF_VERSION PHP_VERSION

 extern zend_module_entry exif_module_entry;
 #define phpext_exif_ptr &exif_module_entry
@@ -0,0 +1,20 @@
+--TEST--
+Bug #76130 (Heap Buffer Overflow (READ: 1786) in exif_iif_add_value)
+--DESCRIPTION--
+This test is meant to exhibit memory issues with the `-m` option. Since a lot of
+notices and warnings are to be expected anyway, we suppress these, since the are
+not relevant for this test.
+--INI--
+error_reporting=E_ALL & ~E_WARNING & ~E_NOTICE
+--SKIPIF--
+<?php
+if (!extension_loaded('exif')) die('skip exif extension not available');
+?>
+--FILE--
+<?php
+exif_read_data(__DIR__ . '/bug76130_1.jpg');
+exif_read_data(__DIR__ . '/bug76130_2.jpg');
+?>
+===DONE===
+--EXPECT--
+===DONE===