Update versions for PHP 7.2.0

- set release date
- merge all alpha/beta/RC entries
- clean entries already in 7.1

.appveyor.yml

@@ -18,13 +18,12 @@ clone_depth: 64
 
 cache:
         - c:\build-cache
-        - c:\build-cache\sdk -> .appveyor.yml
 
 environment:
         PHP_BUILD_CACHE_BASE_DIR: c:\build-cache  
         PHP_BUILD_OBJ_DIR: c:\obj
         PHP_BUILD_CACHE_SDK_DIR: c:\build-cache\sdk
-        PHP_BUILD_SDK_BRANCH: php-sdk-2.0.10
+        PHP_BUILD_SDK_BRANCH: php-sdk-2.0.12
         PHP_BUILD_CRT: vc15
         # ext and env setup for tests
         #MYSQL_TEST_PASSWD: Password12!

.editorconfig

@@ -1,16 +1,35 @@
-; http://editorconfig.org/
+# http://editorconfig.org/
 
 root = true
 
-[*.{c,h}]
-charset                  = UTF-8
-end_of_line              = LF
+[*.{c,h,awk,w32,bat,mk,frag}]
+charset                  = utf-8
+end_of_line              = lf
 indent_size              = 4
 indent_style             = tab
-insert_final_newline     = true
 tab_width                = 4
 trim_trailing_whitespace = true
+insert_final_newline     = true
 
-[*.yml]
+[*.{php,phpt}]
+charset                  = utf-8
+end_of_line              = lf
+indent_size              = 4
+indent_style             = space
+trim_trailing_whitespace = true
+insert_final_newline     = true
+
+[*.{yml,m4,sh}]
+charset                  = utf-8
+end_of_line              = lf
 indent_size              = 2
 indent_style             = space
+trim_trailing_whitespace = true
+insert_final_newline     = true
+
+[*.md]
+charset                  = utf-8
+end_of_line              = lf
+indent_style             = space
+trim_trailing_whitespace = false
+insert_final_newline     = true

.gitattributes

@@ -15,11 +15,8 @@ ext/dba/libflatfile/flatfile.c  ident
 ext/dba/libcdb/cdb_make.c       ident
 ext/dba/libcdb/cdb.c            ident
 ext/filter/filter.c             ident
-ext/zip/php_zip.c               ident
 README.input_filter             ident
 run-tests.php                   ident
-sapi/nsapi/nsapi.c              ident
-sapi/continuity/capi.c          ident
 Zend/RFCs/002.txt               ident
 Zend/RFCs/003.txt               ident
 ext/exif/exif.c                 ident
@@ -32,7 +29,6 @@ UPGRADING.INTERNALS             merge=NEWS
 /ext/bz2/tests/with_strings.phpt	-crlf
 /ext/dom/tests/bug40836.phpt	-crlf
 /ext/dom/tests/domelement.phpt	-crlf
-/ext/ereg/tests/eregi_basic_002.phpt	-crlf
 /ext/iconv/tests/iconv004.phpt	-crlf
 /ext/iconv/tests/iconv_basic.phpt	-crlf
 /ext/iconv/tests/iconv_strpos.phpt	-crlf

.gitignore

@@ -179,9 +179,7 @@ pear/phpize
 pear/run-tests
 pear/php-config
 pear/scripts
-sapi/apache/libphp7.module
 sapi/apache2handler/libphp7.module
-sapi/apache_hooks/libphp7.module
 sapi/cgi/php-cgi
 sapi/cgi/php-cgi.1
 sapi/cli/php.1

.travis.yml

@@ -1,3 +1,4 @@
+dist: trusty
 language: c
 sudo: false
 addons:

EXTENSIONS

@@ -37,7 +37,7 @@ MAINTENANCE:         Unknown
 STATUS:              Working
 -------------------------------------------------------------------------------
 EXTENSION:           cli
-MAINTENANCE:         Marcus Boerger <helly@php.net>, Edin Kadribasic <edink@php.net>
+MAINTENANCE:         Marcus Börger <helly@php.net>, Edin Kadribasic <edink@php.net>
 STATUS:              Working
 SINCE:               4.3.0
 -------------------------------------------------------------------------------
@@ -68,7 +68,7 @@ STATUS:              5.6
 
 -------------------------------------------------------------------------------
 EXTENSION:           dba
-PRIMARY MAINTAINER:  Marcus Börger <helly@php.net>,Christopher Jones <sixd@php.net>, Pierre-Alain Joye <pajoye@php.net>
+PRIMARY MAINTAINER:  Marcus Börger <helly@php.net>,Christopher Jones <sixd@php.net>, Pierre-Alain Joye <pajoye@php.net>
 MAINTENANCE:         Maintained
 STATUS:              Working
 COMMENT:             DBM abstraction for db2, db3, db4, dbm, ndbm, gdbm, ini
@@ -79,13 +79,13 @@ MAINTENANCE:         Odd fixes
 STATUS:              Working
 -------------------------------------------------------------------------------
 EXTENSION:           mysqli
-PRIMARY MAINTAINER:  Georg Richter <georg@php.net>, Andrey Hristov <andrey@php.net>,  Johannes Schlüter <johannes@php.net>, Ulf Wendel <uw@php.net>      
+PRIMARY MAINTAINER:  Georg Richter <georg@php.net>, Andrey Hristov <andrey@php.net>,  Johannes Schlüter <johannes@php.net>, Ulf Wendel <uw@php.net>
 MAINTENANCE:         Maintained
 STATUS:              Working
 SINCE:               5.0
 -------------------------------------------------------------------------------
 EXTENSION:           mysqlnd
-PRIMARY MAINTAINER:  Andrey Hristov <andrey@php.net>, Johannes Schlüter <johannes@php.net>, Ulf Wendel <uw@php.net>      
+PRIMARY MAINTAINER:  Andrey Hristov <andrey@php.net>, Johannes Schlüter <johannes@php.net>, Ulf Wendel <uw@php.net>
 MAINTENANCE:         Maintained
 STATUS:              Working
 SINCE:               5.3
@@ -99,7 +99,7 @@ EXTENSION:           odbc
 PRIMARY MAINTAINER:  Daniel R. Kalowsky <kalowsky@php.net>
 MAINTENANCE:         Maintained
 STATUS:              Working
-COMMENT:             Working 
+COMMENT:             Working
 -------------------------------------------------------------------------------
 EXTENSION:           pdo
 PRIMARY MAINTAINER:  Ilia Alshanetsky <iliaa@php.net>, Wez Furlong <wez@php.net>
@@ -120,7 +120,7 @@ STATUS:              Working
 SINCE:               5.1
 -------------------------------------------------------------------------------
 EXTENSION:           pdo_mysql
-PRIMARY MAINTAINER:  Ilia Alshanetsky <iliaa@php.net>, Johannes Schlüter <johannes@php.net>, Andrey Hristov <andrey@php.net>,  Ulf Wendel <uw@php.net>
+PRIMARY MAINTAINER:  Ilia Alshanetsky <iliaa@php.net>, Johannes Schlüter <johannes@php.net>, Andrey Hristov <andrey@php.net>,  Ulf Wendel <uw@php.net>
 MAINTENANCE:         Odd fixes
 STATUS:              Working
 SINCE:               5.1
@@ -150,7 +150,7 @@ STATUS:              Working
 SINCE:               5.1
 -------------------------------------------------------------------------------
 EXTENSION:           pgsql
-PRIMARY MAINTAINER:  Marcus Boerger <helly@php.net>, Yasuo Ohgaki <yohgaki@php.net>
+PRIMARY MAINTAINER:  Marcus Börger <helly@php.net>, Yasuo Ohgaki <yohgaki@php.net>
 MAINTENANCE:         Maintained
 STATUS:              Working
 COMMENT:             Use PostgreSQL 7.0.x or later. PostgreSQL 6.5.3 or less have fatal bug.
@@ -168,13 +168,13 @@ COMMENT:             Integrates SQLite 3 embeddable SQL database engine.
 
 -------------------------------------------------------------------------------
 EXTENSION:           dom
-PRIMARY MAINTAINER:  Christian Stocker <chregu@php.net>, Rob Richards <rrichards@php.net>, Marcus Boerger <helly@php.net>
+PRIMARY MAINTAINER:  Christian Stocker <chregu@php.net>, Rob Richards <rrichards@php.net>, Marcus Börger <helly@php.net>
 MAINTENANCE:         Maintained
 STATUS:              Working
 SINCE:               5.0
 -------------------------------------------------------------------------------
 EXTENSION:           simplexml
-PRIMARY MAINTAINER:  Marcus Boerger <helly@php.net>
+PRIMARY MAINTAINER:  Marcus Börger <helly@php.net>
 MAINTENANCE:         Maintained
 STATUS:              Working
 SINCE:               5.0
@@ -195,12 +195,12 @@ MAINTENANCE:         Maintained
 STATUS:              Working
 -------------------------------------------------------------------------------
 EXTENSION:           libxml
-PRIMARY MAINTAINER:   Rob Richards <rrichards@php.net>, Christian Stocker <chregu@php.net> 
+PRIMARY MAINTAINER:   Rob Richards <rrichards@php.net>, Christian Stocker <chregu@php.net>
 MAINTENANCE:         Maintained
 STATUS:              Working
 -------------------------------------------------------------------------------
 EXTENSION:           xmlreader
-PRIMARY MAINTAINER:  Rob Richards <rrichards@php.net>, Christian Stocker <chregu@php.net> 
+PRIMARY MAINTAINER:  Rob Richards <rrichards@php.net>, Christian Stocker <chregu@php.net>
 MAINTENANCE:         Maintained
 STATUS:              Working
 -------------------------------------------------------------------------------
@@ -335,7 +335,7 @@ STATUS:              Working
 SINCE:               5.2
 -------------------------------------------------------------------------------
 EXTENSION:           ldap
-PRIMARY MAINTAINER:  Stig Venaas <venaas@php.net>, Douglas Goldstein <cardoe@php.net>, Pierre-Alain Joye <pajoye@php.net>, Côme Bernigaud <mcmic@php.net>
+PRIMARY MAINTAINER:  Stig Venaas <venaas@php.net>, Douglas Goldstein <cardoe@php.net>, Pierre-Alain Joye <pajoye@php.net>, Côme Bernigaud <mcmic@php.net>
 MAINTENANCE:         Maintained
 STATUS:              Working
 -------------------------------------------------------------------------------
@@ -367,13 +367,13 @@ MAINTENANCE:         Maintained
 STATUS:              Working
 -------------------------------------------------------------------------------
 EXTENSION:           phar
-PRIMARY MAINTAINER:  Greg Beaver <cellog@php.net>, Marcus Börger <helly@php.net>, Steph Fox <sfox@php.net>
+PRIMARY MAINTAINER:  Greg Beaver <cellog@php.net>, Marcus Börger <helly@php.net>, Steph Fox <sfox@php.net>
 MAINTENANCE:         Maintained
 STATUS:              Working
 SINCE:               5.3
 -------------------------------------------------------------------------------
 EXTENSION:           posix
-PRIMARY MAINTAINER:  Kristian Köhntopp <kris@koehntopp.de>
+PRIMARY MAINTAINER:  Kristian Köhntopp <kris@koehntopp.de>
 MAINTENANCE:         Maintained
 STATUS:              Working
 -------------------------------------------------------------------------------
@@ -388,12 +388,12 @@ MAINTENANCE:         Unknown
 STATUS:              Working
 -------------------------------------------------------------------------------
 EXTENSION:           recode
-PRIMARY MAINTAINER:  Kristian Köhntopp <kris@koehntopp.de>
+PRIMARY MAINTAINER:  Kristian Köhntopp <kris@koehntopp.de>
 MAINTENANCE:         Maintained
 STATUS:              Working
 -------------------------------------------------------------------------------
 EXTENSION:           reflection
-PRIMARY MAINTAINER:  Marcus Börger <helly@php.net>, Johannes Schlüter <johannes@php.net>
+PRIMARY MAINTAINER:  Marcus Börger <helly@php.net>, Johannes Schlüter <johannes@php.net>
 MAINTENANCE:         Maintained
 STATUS:              Working
 -------------------------------------------------------------------------------
@@ -426,7 +426,7 @@ STATUS:              Working
 SINCE:               7.2.0
 -------------------------------------------------------------------------------
 EXTENSION:           spl
-PRIMARY MAINTAINER:  Marcus Boerger <helly@php.net>, Etienne Kneuss <colder@php.net>
+PRIMARY MAINTAINER:  Marcus Börger <helly@php.net>, Etienne Kneuss <colder@php.net>
 MAINTENANCE:         Maintained
 STATUS:              Working
 SINCE:               5.0.0

Makefile.global

@@ -5,7 +5,7 @@ INSTALL_DATA = $(INSTALL) -m 644
 DEFS = -DPHP_ATOM_INC -I$(top_builddir)/include -I$(top_builddir)/main -I$(top_srcdir)
 COMMON_FLAGS = $(DEFS) $(INCLUDES) $(EXTRA_INCLUDES) $(CPPFLAGS) $(PHP_FRAMEWORKPATH)
 
-all: $(all_targets) 
+all: $(all_targets)
 	@echo
 	@echo "Build complete."
 	@echo "Don't forget to run 'make test'."
@@ -112,13 +112,13 @@ test: all
 clean:
 	find . -name \*.gcno -o -name \*.gcda | xargs rm -f
 	find . -name \*.lo -o -name \*.o | xargs rm -f
-	find . -name \*.la -o -name \*.a | xargs rm -f 
+	find . -name \*.la -o -name \*.a | xargs rm -f
 	find . -name \*.so | xargs rm -f
 	find . -name .libs -a -type d|xargs rm -rf
 	rm -f libphp$(PHP_MAJOR_VERSION).la $(SAPI_CLI_PATH) $(SAPI_CGI_PATH) $(SAPI_MILTER_PATH) $(SAPI_LITESPEED_PATH) $(SAPI_FPM_PATH) $(OVERALL_TARGET) modules/* libs/*
 
 distclean: clean
-	rm -f Makefile config.cache config.log config.status Makefile.objects Makefile.fragments libtool main/php_config.h main/internal_functions_cli.c main/internal_functions.c stamp-h sapi/apache/libphp$(PHP_MAJOR_VERSION).module sapi/apache_hooks/libphp$(PHP_MAJOR_VERSION).module buildmk.stamp Zend/zend_dtrace_gen.h Zend/zend_dtrace_gen.h.bak Zend/zend_config.h TSRM/tsrm_config.h
+	rm -f Makefile config.cache config.log config.status Makefile.objects Makefile.fragments libtool main/php_config.h main/internal_functions_cli.c main/internal_functions.c stamp-h buildmk.stamp Zend/zend_dtrace_gen.h Zend/zend_dtrace_gen.h.bak Zend/zend_config.h TSRM/tsrm_config.h
 	rm -f php7.spec main/build-defs.h scripts/phpize
 	rm -f ext/date/lib/timelib_config.h ext/mbstring/oniguruma/config.h ext/mbstring/libmbfl/config.h ext/oci8/oci8_dtrace_gen.h ext/oci8/oci8_dtrace_gen.h.bak
 	rm -f scripts/man1/phpize.1 scripts/php-config scripts/man1/php-config.1 sapi/cli/php.1 sapi/cgi/php-cgi.1 ext/phar/phar.1 ext/phar/phar.phar.1
@@ -135,7 +135,7 @@ prof-gen:
 
 prof-clean:
 	find . -name \*.lo -o -name \*.o | xargs rm -f
-	find . -name \*.la -o -name \*.a | xargs rm -f 
+	find . -name \*.la -o -name \*.a | xargs rm -f
 	find . -name \*.so | xargs rm -f
 	rm -f libphp$(PHP_MAJOR_VERSION).la $(SAPI_CLI_PATH) $(SAPI_CGI_PATH) $(SAPI_MILTER_PATH) $(SAPI_LITESPEED_PATH) $(SAPI_FPM_PATH) $(OVERALL_TARGET) modules/* libs/*
 

UPGRADING

@@ -24,7 +24,7 @@ PHP 7.2 UPGRADE NOTES
     closed resources.
   . is_object() will now return true for objects of class
     __PHP_Incomplete_Class.
-  . Support for Netware operating systems have been removed.
+  . Support for Netware operating systems has been removed.
   . Casting arrays to objects (with (object) or settype()) will now convert
     integer keys to string property names. This fixes the behaviour of previous
     versions, where integer keys would become inaccessible properties with
@@ -182,7 +182,7 @@ PHP 8.0.
     it does not trigger a deprecation warning for technical reasons.
   
 - EXIF:
-  . The read_exif_data() alias have been deprecated, use exif_read_data() instead.
+  . The read_exif_data() alias has been deprecated, use exif_read_data() instead.
 
 - GD:
   . png2wbmp() and jpeg2wbmp() have been deprecated.
@@ -253,9 +253,12 @@ See also: https://wiki.php.net/rfc/deprecations_php_7_2
   . Added imageresolution().
   . Added imagecreatefrombmp() and imagebmp().
 
+- Hash:
+  . Added hash_hmac_algos().
+
 - Mbstring:
   . Added mb_chr() and mb_ord().
-  . Added mb_scurb() that scrub broken multibyte strings.
+  . Added mb_scrub() that scrubs broken multibyte strings.
 
 - OCI8:
   . Added oci_register_taf_callback() and oci_disable_taf_callback() for
@@ -265,6 +268,9 @@ See also: https://wiki.php.net/rfc/deprecations_php_7_2
   . Added socket_addrinfo_lookup(), socket_addrinfo_connect(),
     socket_addrinfo_bind() and socket_addrinfo_explain().
 
+- SPL:
+  . Added spl_object_id().
+
 ========================================
 7. New Classes and Interfaces
 ========================================
@@ -345,7 +351,7 @@ See also: https://wiki.php.net/rfc/deprecations_php_7_2
 ========================================
 
 - sql.safe_mode
-  . This INI directive have been removed.
+  . This INI directive has been removed.
 
 - realpath_cache_size
   . Set to 4096k by default

Zend/tests/bug75241.phpt

@@ -0,0 +1,13 @@
+--TEST--
+Bug #75241 (Null pointer dereference in zend_mm_alloc_small())
+--FILE--
+<?php
+function eh(){}
+
+set_error_handler('eh');
+
+$d->d = &$d + $d->d/=0;
+var_dump($d);
+?>
+--EXPECT--
+float(INF)

Zend/tests/bug75252.phpt

@@ -0,0 +1,28 @@
+--TEST--
+Bug #75252: Incorrect token formatting on two parse errors in one request
+--FILE--
+<?php
+
+$code = <<<'CODE'
+function test_missing_semicolon() : string {
+     $x = []
+     FOO
+}
+CODE;
+
+try {
+    eval($code);
+} catch (ParseError $e) {
+    var_dump($e->getMessage());
+}
+
+try {
+    eval($code);
+} catch (ParseError $e) {
+    var_dump($e->getMessage());
+}
+
+?>
+--EXPECT--
+string(41) "syntax error, unexpected 'FOO' (T_STRING)"
+string(41) "syntax error, unexpected 'FOO' (T_STRING)"

Zend/tests/bug75290.phpt

@@ -0,0 +1,26 @@
+--TEST--
+Bug #75290 (debug info of Closures of internal functions contain garbage argument names)
+--FILE--
+<?php
+
+var_dump((new ReflectionFunction('sin'))->getClosure());
+
+var_dump(function ($someThing) {});
+
+?>
+--EXPECT--
+object(Closure)#2 (1) {
+  ["parameter"]=>
+  array(1) {
+    ["$number"]=>
+    string(10) "<required>"
+  }
+}
+object(Closure)#2 (1) {
+  ["parameter"]=>
+  array(1) {
+    ["$someThing"]=>
+    string(10) "<required>"
+  }
+}
+

Zend/tests/bug75420.1.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug #75420.1 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test {
+	public function __isset($x) { $GLOBALS["name"] = 24; return true; }
+	public function __get($x) { var_dump($x); return 42; }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump($obj->$name ?? 12);
+var_dump($name);
+?>
+--EXPECT--
+string(3) "foo"
+int(42)
+int(24)

Zend/tests/bug75420.10.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Bug #75420.10 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test implements ArrayAccess {
+	public function offsetExists($x) { $GLOBALS["name"] = 24; return true; }
+	public function offsetGet($x) { var_dump($x); return 42; }
+	public function offsetSet($x, $y) { }
+	public function offsetUnset($x) { }
+}
+
+$obj = new Test;
+$name = "foo";
+$name = str_repeat($name, 2);
+var_dump($obj[$name] ?? 12);
+var_dump($name);
+?>
+--EXPECT--
+string(6) "foofoo"
+int(42)
+int(24)

Zend/tests/bug75420.11.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #75420.11 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test implements ArrayAccess {
+	public function offsetExists($x) { $GLOBALS["name"] = 24; return true; }
+	public function offsetGet($x) { var_dump($x); return 42; }
+	public function offsetSet($x, $y) { }
+	public function offsetUnset($x) { }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump(empty($obj[$name]));
+var_dump($name);
+?>
+--EXPECT--
+string(3) "foo"
+bool(false)
+int(24)

Zend/tests/bug75420.12.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Bug #75420.12 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test implements ArrayAccess {
+	public function offsetExists($x) { $GLOBALS["name"] = 24; return true; }
+	public function offsetGet($x) { var_dump($x); return 42; }
+	public function offsetSet($x, $y) { }
+	public function offsetUnset($x) { }
+}
+
+$obj = new Test;
+$name = "foo";
+$name = str_repeat($name, 2);
+var_dump(empty($obj[$name]));
+var_dump($name);
+?>
+--EXPECT--
+string(6) "foofoo"
+bool(false)
+int(24)

Zend/tests/bug75420.13.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #75420.13 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test implements ArrayAccess {
+	public function offsetExists($x) { $GLOBALS["obj"] = 24; return true; }
+	public function offsetGet($x) { var_dump($x); return 42; }
+	public function offsetSet($x, $y) { }
+	public function offsetUnset($x) { }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump($obj[$name] ?? 12);
+var_dump($obj);
+?>
+--EXPECT--
+string(3) "foo"
+int(42)
+int(24)

Zend/tests/bug75420.14.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #75420.14 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test implements ArrayAccess {
+	public function offsetExists($x) { $GLOBALS["obj"] = 24; return true; }
+	public function offsetGet($x) { var_dump($x); return 42; }
+	public function offsetSet($x, $y) { }
+	public function offsetUnset($x) { }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump(empty($obj[$name]));
+var_dump($obj);
+?>
+--EXPECT--
+string(3) "foo"
+bool(false)
+int(24)

Zend/tests/bug75420.15.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #75420.15 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test implements ArrayAccess {
+	public function offsetExists($x) { }
+	public function offsetGet($x) { }
+	public function offsetSet($x, $y) { $GLOBALS["name"] = 24; var_dump($x); }
+	public function offsetUnset($x) { }
+}
+
+$obj = new Test;
+$name = "foo";
+$name = str_repeat($name, 2);
+$obj[$name] = 1;
+var_dump($name);
+?>
+--EXPECT--
+string(6) "foofoo"
+int(24)

Zend/tests/bug75420.16.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #75420.16 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test implements ArrayAccess {
+	public function offsetExists($x) { }
+	public function offsetGet($x) { }
+	public function offsetSet($x, $y) { $GLOBALS["obj"] = 24; var_dump($this); }
+	public function offsetUnset($x) { }
+}
+
+$obj = new Test;
+$name = "foo";
+$obj[$name] = 1;
+var_dump($obj);
+?>
+--EXPECT--
+object(Test)#1 (0) {
+}
+int(24)

Zend/tests/bug75420.2.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #75420.2 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test {
+	public function __isset($x) { $GLOBALS["name"] = 24; return true; }
+	public function __get($x) { var_dump($x); return 42; }
+}
+
+$obj = new Test;
+$name = "foo";
+$name = str_repeat($name, 2);
+var_dump($obj->$name ?? 12);
+var_dump($name);
+?>
+--EXPECT--
+string(6) "foofoo"
+int(42)
+int(24)
+

Zend/tests/bug75420.3.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug #75420.3 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test {
+	public function __isset($x) { $GLOBALS["name"] = 24; return true; }
+	public function __get($x) { var_dump($x); return 42; }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump(empty($obj->$name));
+var_dump($name);
+?>
+--EXPECT--
+string(3) "foo"
+bool(false)
+int(24)

Zend/tests/bug75420.4.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Bug #75420.4 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test {
+	public function __isset($x) { $GLOBALS["name"] = 24; return true; }
+	public function __get($x) { var_dump($x); return 42; }
+}
+
+$obj = new Test;
+$name = "foo";
+$name = str_repeat($name, 2);
+var_dump(empty($obj->$name));
+?>
+--EXPECT--
+string(6) "foofoo"
+bool(false)

Zend/tests/bug75420.5.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Bug #75420.5 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test {
+	public function __isset($x) { $GLOBALS["obj"] = 24; return true; }
+	public function __get($x) { var_dump($this); return 42; }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump($obj->$name ?? 12);
+var_dump($obj);
+?>
+--EXPECT--
+object(Test)#1 (0) {
+}
+int(42)
+int(24)

Zend/tests/bug75420.6.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Bug #75420.6 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test {
+	public function __isset($x) { $GLOBALS["obj"] = 24; return true; }
+	public function __get($x) { var_dump($this); return 42; }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump(empty($obj->$name));
+var_dump($obj);
+?>
+--EXPECT--
+object(Test)#1 (0) {
+}
+bool(false)
+int(24)

Zend/tests/bug75420.7.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Bug #75420.7 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test {
+	public function __set($x,$v) { $GLOBALS["name"] = 24; var_dump($x); }
+}
+
+$obj = new Test;
+$name = "foo";
+$name = str_repeat($name, 2);
+$obj->$name = 1;
+var_dump($name);
+?>
+--EXPECT--
+string(6) "foofoo"
+int(24)

Zend/tests/bug75420.8.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Bug #75420.8 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test {
+	public function __set($x,$v) { $GLOBALS["obj"] = 24; var_dump($this); }
+}
+
+$obj = new Test;
+$name = "foo";
+$obj->$name = 1;
+var_dump($obj);
+?>
+--EXPECT--
+object(Test)#1 (0) {
+}
+int(24)

Zend/tests/bug75420.9.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #75420.9 (Indirect modification of magic method argument)
+--FILE--
+<?php
+class Test implements ArrayAccess {
+	public function offsetExists($x) { $GLOBALS["name"] = 24; return true; }
+	public function offsetGet($x) { var_dump($x); return 42; }
+	public function offsetSet($x, $y) { }
+	public function offsetUnset($x) { }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump($obj[$name] ?? 12);
+var_dump($name);
+?>
+--EXPECT--
+string(3) "foo"
+int(42)
+int(24)

Zend/tests/bug75420.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Bug #75420 (Crash when modifing property name in __isset for BP_VAR_IS)
+--FILE--
+<?php
+
+class Test {
+	public function __isset($x) { $GLOBALS["name"] = 24; return true; }
+public function __get($x) { var_dump($x); return 42; }
+}
+
+$obj = new Test;
+$name = "foo";
+var_dump($obj->$name ?? 12);
+?>
+--EXPECT--
+string(3) "foo"
+int(42)

Zend/zend.c

@@ -947,6 +947,8 @@ void zend_set_utility_values(zend_utility_values *utility_values) /* {{{ */
 /* this should be compatible with the standard zenderror */
 ZEND_COLD void zenderror(const char *error) /* {{{ */
 {
+	CG(parse_error) = 0;
+
 	if (EG(exception)) {
 		/* An exception was thrown in the lexer, don't throw another in the parser. */
 		return;

Zend/zend.h

@@ -22,7 +22,7 @@
 #ifndef ZEND_H
 #define ZEND_H
 
-#define ZEND_VERSION "3.2.0-dev"
+#define ZEND_VERSION "3.2.0"
 
 #define ZEND_ENGINE_3
 

Zend/zend_API.c

@@ -3129,7 +3129,8 @@ get_function_via_handler:
 					    (!fcc->function_handler->common.scope ||
 					     !instanceof_function(ce_org, fcc->function_handler->common.scope))) {
 						if (fcc->function_handler->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
-							if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION) {
+							if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION && 
+								fcc->function_handler->common.function_name) {
 								zend_string_release(fcc->function_handler->common.function_name);
 							}
 							zend_free_trampoline(fcc->function_handler);
@@ -3355,7 +3356,8 @@ again:
 				((fcc->function_handler->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) ||
 			     fcc->function_handler->type == ZEND_OVERLOADED_FUNCTION_TEMPORARY ||
 			     fcc->function_handler->type == ZEND_OVERLOADED_FUNCTION)) {
-				if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION) {
+				if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION && 
+					fcc->function_handler->common.function_name) {
 					zend_string_release(fcc->function_handler->common.function_name);
 				}
 				zend_free_trampoline(fcc->function_handler);
@@ -3413,7 +3415,8 @@ again:
 						((fcc->function_handler->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) ||
 					     fcc->function_handler->type == ZEND_OVERLOADED_FUNCTION_TEMPORARY ||
 					     fcc->function_handler->type == ZEND_OVERLOADED_FUNCTION)) {
-						if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION) {
+						if (fcc->function_handler->type != ZEND_OVERLOADED_FUNCTION && 
+							fcc->function_handler->common.function_name) {
 							zend_string_release(fcc->function_handler->common.function_name);
 						}
 						zend_free_trampoline(fcc->function_handler);
@@ -3741,7 +3744,11 @@ ZEND_API int zend_declare_property_ex(zend_class_entry *ce, zend_string *name, z
 			default:
 				break;
 		}
+
+		/* Must be interned to avoid ZTS data races */
+		name = zend_new_interned_string(zend_string_copy(name));
 	}
+
 	if (access_type & ZEND_ACC_PUBLIC) {
 		property_info->name = zend_string_copy(name);
 	} else if (access_type & ZEND_ACC_PRIVATE) {

Zend/zend_alloc.c

@@ -260,6 +260,8 @@ struct _zend_mm_heap {
 	int                peak_chunks_count;		/* peak number of allocated chunks for current request */
 	int                cached_chunks_count;		/* number of cached chunks */
 	double             avg_chunks_count;		/* average number of chunks allocated per request */
+	int                last_chunks_delete_boundary; /* numer of chunks after last deletion */
+	int                last_chunks_delete_count;    /* number of deletion over the last boundary */
 #if ZEND_MM_CUSTOM
 	union {
 		struct {
@@ -283,7 +285,7 @@ struct _zend_mm_chunk {
 	uint32_t           free_pages;				/* number of free pages */
 	uint32_t           free_tail;               /* number of free pages at the end of chunk */
 	uint32_t           num;
-	char               reserve[64 - (sizeof(void*) * 3 + sizeof(int) * 3)];
+	char               reserve[64 - (sizeof(void*) * 3 + sizeof(uint32_t) * 3)];
 	zend_mm_heap       heap_slot;               /* used only in main chunk */
 	zend_mm_page_map   free_map;                /* 512 bits or 64 bytes */
 	zend_mm_page_info  map[ZEND_MM_PAGES];      /* 2 KB = 512 * 4 */
@@ -1076,7 +1078,9 @@ static zend_always_inline void zend_mm_delete_chunk(zend_mm_heap *heap, zend_mm_
 	chunk->next->prev = chunk->prev;
 	chunk->prev->next = chunk->next;
 	heap->chunks_count--;
-	if (heap->chunks_count + heap->cached_chunks_count < heap->avg_chunks_count + 0.1) {
+	if (heap->chunks_count + heap->cached_chunks_count < heap->avg_chunks_count + 0.1
+	 || (heap->chunks_count == heap->last_chunks_delete_boundary
+	  && heap->last_chunks_delete_count >= 4)) {
 		/* delay deletion */
 		heap->cached_chunks_count++;
 		chunk->next = heap->cached_chunks;
@@ -1085,6 +1089,14 @@ static zend_always_inline void zend_mm_delete_chunk(zend_mm_heap *heap, zend_mm_
 #if ZEND_MM_STAT || ZEND_MM_LIMIT
 		heap->real_size -= ZEND_MM_CHUNK_SIZE;
 #endif
+		if (!heap->cached_chunks) {
+			if (heap->chunks_count != heap->last_chunks_delete_boundary) {
+				heap->last_chunks_delete_boundary = heap->chunks_count;
+				heap->last_chunks_delete_count = 0;
+			} else {
+				heap->last_chunks_delete_count++;
+			}
+		}
 		if (!heap->cached_chunks || chunk->num > heap->cached_chunks->num) {
 			zend_mm_chunk_free(heap, chunk, ZEND_MM_CHUNK_SIZE);
 		} else {
@@ -1819,6 +1831,8 @@ static zend_mm_heap *zend_mm_init(void)
 	heap->peak_chunks_count = 1;
 	heap->cached_chunks_count = 0;
 	heap->avg_chunks_count = 1.0;
+	heap->last_chunks_delete_boundary = 0;
+	heap->last_chunks_delete_count = 0;
 #if ZEND_MM_STAT || ZEND_MM_LIMIT
 	heap->real_size = ZEND_MM_CHUNK_SIZE;
 #endif
@@ -2235,6 +2249,8 @@ void zend_mm_shutdown(zend_mm_heap *heap, int full, int silent)
 		p->map[0] = ZEND_MM_LRUN(ZEND_MM_FIRST_PAGE);
 		heap->chunks_count = 1;
 		heap->peak_chunks_count = 1;
+		heap->last_chunks_delete_boundary = 0;
+		heap->last_chunks_delete_count = 0;
 #if ZEND_MM_STAT || ZEND_MM_LIMIT
 		heap->real_size = ZEND_MM_CHUNK_SIZE;
 #endif
@@ -2758,6 +2774,8 @@ ZEND_API zend_mm_heap *zend_mm_startup_ex(const zend_mm_handlers *handlers, void
 	heap->peak_chunks_count = 1;
 	heap->cached_chunks_count = 0;
 	heap->avg_chunks_count = 1.0;
+	heap->last_chunks_delete_boundary = 0;
+	heap->last_chunks_delete_count = 0;
 #if ZEND_MM_STAT || ZEND_MM_LIMIT
 	heap->real_size = ZEND_MM_CHUNK_SIZE;
 #endif

Zend/zend_closures.c

@@ -500,6 +500,7 @@ static HashTable *zend_closure_get_debug_info(zval *object, int *is_temp) /* {{{
 	zval val;
 	struct _zend_arg_info *arg_info = closure->func.common.arg_info;
 	HashTable *debug_info;
+	zend_bool zstr_args = (closure->func.type == ZEND_USER_FUNCTION) || (closure->func.common.fn_flags & ZEND_ACC_USER_ARG_INFO);
 
 	*is_temp = 1;
 
@@ -532,9 +533,15 @@ static HashTable *zend_closure_get_debug_info(zval *object, int *is_temp) /* {{{
 			zend_string *name;
 			zval info;
 			if (arg_info->name) {
-				name = zend_strpprintf(0, "%s$%s",
-						arg_info->pass_by_reference ? "&" : "",
-						ZSTR_VAL(arg_info->name));
+				if (zstr_args) {
+					name = zend_strpprintf(0, "%s$%s",
+							arg_info->pass_by_reference ? "&" : "",
+							ZSTR_VAL(arg_info->name));
+				} else {
+					name = zend_strpprintf(0, "%s$%s",
+							arg_info->pass_by_reference ? "&" : "",
+							((zend_internal_arg_info*)arg_info)->name);
+				}
 			} else {
 				name = zend_strpprintf(0, "%s$param%d",
 						arg_info->pass_by_reference ? "&" : "",

Zend/zend_object_handlers.c

@@ -562,9 +562,10 @@ ZEND_API uint32_t *zend_get_property_guard(zend_object *zobj, zend_string *membe
 zval *zend_std_read_property(zval *object, zval *member, int type, void **cache_slot, zval *rv) /* {{{ */
 {
 	zend_object *zobj;
-	zval tmp_member;
+	zval tmp_member, tmp_object;
 	zval *retval;
 	uint32_t property_offset;
+	uint32_t *guard = NULL;
 
 	zobj = Z_OBJ_P(object);
 
@@ -597,12 +598,18 @@ zval *zend_std_read_property(zval *object, zval *member, int type, void **cache_
 		goto exit;
 	}
 
+	ZVAL_UNDEF(&tmp_object);
+
 	/* magic isset */
 	if ((type == BP_VAR_IS) && zobj->ce->__isset) {
-		zval tmp_object, tmp_result;
-		uint32_t *guard = zend_get_property_guard(zobj, Z_STR_P(member));
+		zval tmp_result;
+		guard = zend_get_property_guard(zobj, Z_STR_P(member));
 
 		if (!((*guard) & IN_ISSET)) {
+			if (Z_TYPE(tmp_member) == IS_UNDEF) {
+				ZVAL_COPY(&tmp_member, member);
+				member = &tmp_member;
+			}
 			ZVAL_COPY(&tmp_object, object);
 			ZVAL_UNDEF(&tmp_result);
 
@@ -617,19 +624,20 @@ zval *zend_std_read_property(zval *object, zval *member, int type, void **cache_
 				goto exit;
 			}
 
-			zval_ptr_dtor(&tmp_object);
 			zval_ptr_dtor(&tmp_result);
 		}
 	}
 
 	/* magic get */
 	if (zobj->ce->__get) {
-		uint32_t *guard = zend_get_property_guard(zobj, Z_STR_P(member));
+		if (guard == NULL) {
+			guard = zend_get_property_guard(zobj, Z_STR_P(member));
+		}
 		if (!((*guard) & IN_GET)) {
-			zval tmp_object;
-
 			/* have getter - try with it! */
-			ZVAL_COPY(&tmp_object, object);
+			if (Z_TYPE(tmp_object) == IS_UNDEF) {
+				ZVAL_COPY(&tmp_object, object);
+			}
 			*guard |= IN_GET; /* prevent circular getting */
 			zend_std_call_getter(&tmp_object, member, rv);
 			*guard &= ~IN_GET;
@@ -649,6 +657,7 @@ zval *zend_std_read_property(zval *object, zval *member, int type, void **cache_
 			zval_ptr_dtor(&tmp_object);
 			goto exit;
 		} else {
+			zval_ptr_dtor(&tmp_object);
 			if (Z_STRVAL_P(member)[0] == '\0' && Z_STRLEN_P(member) != 0) {
 				zend_throw_error(NULL, "Cannot access property started with '\\0'");
 				retval = &EG(uninitialized_zval);
@@ -656,6 +665,9 @@ zval *zend_std_read_property(zval *object, zval *member, int type, void **cache_
 			}
 		}
 	}
+
+	zval_ptr_dtor(&tmp_object);
+
 	if ((type != BP_VAR_IS)) {
 		zend_error(E_NOTICE,"Undefined property: %s::$%s", ZSTR_VAL(zobj->ce->name), Z_STRVAL_P(member));
 	}
@@ -764,34 +776,38 @@ exit:
 zval *zend_std_read_dimension(zval *object, zval *offset, int type, zval *rv) /* {{{ */
 {
 	zend_class_entry *ce = Z_OBJCE_P(object);
-	zval tmp;
+	zval tmp_offset, tmp_object;
 
 	if (EXPECTED(instanceof_function_ex(ce, zend_ce_arrayaccess, 1) != 0)) {
 		if (offset == NULL) {
 			/* [] construct */
-			ZVAL_NULL(&tmp);
-			offset = &tmp;
+			ZVAL_NULL(&tmp_offset);
 		} else {
-			SEPARATE_ARG_IF_REF(offset);
+			ZVAL_DEREF(offset);
+			ZVAL_COPY(&tmp_offset, offset);
 		}
 
+		ZVAL_COPY(&tmp_object, object);
 		if (type == BP_VAR_IS) {
-			zend_call_method_with_1_params(object, ce, NULL, "offsetexists", rv, offset);
+			zend_call_method_with_1_params(&tmp_object, ce, NULL, "offsetexists", rv, &tmp_offset);
 			if (UNEXPECTED(Z_ISUNDEF_P(rv))) {
-				zval_ptr_dtor(offset);
+				zval_ptr_dtor(&tmp_object);
+				zval_ptr_dtor(&tmp_offset);
 				return NULL;
 			}
 			if (!i_zend_is_true(rv)) {
-				zval_ptr_dtor(offset);
+				zval_ptr_dtor(&tmp_object);
+				zval_ptr_dtor(&tmp_offset);
 				zval_ptr_dtor(rv);
 				return &EG(uninitialized_zval);
 			}
 			zval_ptr_dtor(rv);
 		}
 
-		zend_call_method_with_1_params(object, ce, NULL, "offsetget", rv, offset);
+		zend_call_method_with_1_params(&tmp_object, ce, NULL, "offsetget", rv, &tmp_offset);
 
-		zval_ptr_dtor(offset);
+		zval_ptr_dtor(&tmp_object);
+		zval_ptr_dtor(&tmp_offset);
 
 		if (UNEXPECTED(Z_TYPE_P(rv) == IS_UNDEF)) {
 			if (UNEXPECTED(!EG(exception))) {
@@ -810,17 +826,19 @@ zval *zend_std_read_dimension(zval *object, zval *offset, int type, zval *rv) /*
 static void zend_std_write_dimension(zval *object, zval *offset, zval *value) /* {{{ */
 {
 	zend_class_entry *ce = Z_OBJCE_P(object);
-	zval tmp;
+	zval tmp_offset, tmp_object;
 
 	if (EXPECTED(instanceof_function_ex(ce, zend_ce_arrayaccess, 1) != 0)) {
 		if (!offset) {
-			ZVAL_NULL(&tmp);
-			offset = &tmp;
+			ZVAL_NULL(&tmp_offset);
 		} else {
-			SEPARATE_ARG_IF_REF(offset);
+			ZVAL_DEREF(offset);
+			ZVAL_COPY(&tmp_offset, offset);
 		}
-		zend_call_method_with_2_params(object, ce, NULL, "offsetset", NULL, offset, value);
-		zval_ptr_dtor(offset);
+		ZVAL_COPY(&tmp_object, object);
+		zend_call_method_with_2_params(&tmp_object, ce, NULL, "offsetset", NULL, &tmp_offset, value);
+		zval_ptr_dtor(&tmp_object);
+		zval_ptr_dtor(&tmp_offset);
 	} else {
 		zend_throw_error(NULL, "Cannot use object of type %s as array", ZSTR_VAL(ce->name));
 	}
@@ -830,17 +848,19 @@ static void zend_std_write_dimension(zval *object, zval *offset, zval *value) /*
 static int zend_std_has_dimension(zval *object, zval *offset, int check_empty) /* {{{ */
 {
 	zend_class_entry *ce = Z_OBJCE_P(object);
-	zval retval;
+	zval retval, tmp_offset, tmp_object;
 	int result;
 
 	if (EXPECTED(instanceof_function_ex(ce, zend_ce_arrayaccess, 1) != 0)) {
-		SEPARATE_ARG_IF_REF(offset);
-		zend_call_method_with_1_params(object, ce, NULL, "offsetexists", &retval, offset);
+		ZVAL_DEREF(offset);
+		ZVAL_COPY(&tmp_offset, offset);
+		ZVAL_COPY(&tmp_object, object);
+		zend_call_method_with_1_params(&tmp_object, ce, NULL, "offsetexists", &retval, &tmp_offset);
 		if (EXPECTED(Z_TYPE(retval) != IS_UNDEF)) {
 			result = i_zend_is_true(&retval);
 			zval_ptr_dtor(&retval);
 			if (check_empty && result && EXPECTED(!EG(exception))) {
-				zend_call_method_with_1_params(object, ce, NULL, "offsetget", &retval, offset);
+				zend_call_method_with_1_params(&tmp_object, ce, NULL, "offsetget", &retval, &tmp_offset);
 				if (EXPECTED(Z_TYPE(retval) != IS_UNDEF)) {
 					result = i_zend_is_true(&retval);
 					zval_ptr_dtor(&retval);
@@ -849,7 +869,8 @@ static int zend_std_has_dimension(zval *object, zval *offset, int check_empty) /
 		} else {
 			result = 0;
 		}
-		zval_ptr_dtor(offset);
+		zval_ptr_dtor(&tmp_object);
+		zval_ptr_dtor(&tmp_offset);
 	} else {
 		zend_throw_error(NULL, "Cannot use object of type %s as array", ZSTR_VAL(ce->name));
 		return 0;
@@ -1006,11 +1027,15 @@ exit:
 static void zend_std_unset_dimension(zval *object, zval *offset) /* {{{ */
 {
 	zend_class_entry *ce = Z_OBJCE_P(object);
+	zval tmp_offset, tmp_object;
 
 	if (instanceof_function_ex(ce, zend_ce_arrayaccess, 1)) {
-		SEPARATE_ARG_IF_REF(offset);
-		zend_call_method_with_1_params(object, ce, NULL, "offsetunset", NULL, offset);
-		zval_ptr_dtor(offset);
+		ZVAL_DEREF(offset);
+		ZVAL_COPY(&tmp_offset, offset);
+		ZVAL_COPY(&tmp_object, object);
+		zend_call_method_with_1_params(&tmp_object, ce, NULL, "offsetunset", NULL, &tmp_offset);
+		zval_ptr_dtor(&tmp_object);
+		zval_ptr_dtor(&tmp_offset);
 	} else {
 		zend_throw_error(NULL, "Cannot use object of type %s as array", ZSTR_VAL(ce->name));
 	}
@@ -1561,6 +1586,10 @@ found:
 			zval tmp_object;
 
 			/* have issetter - try with it! */
+			if (Z_TYPE(tmp_member) == IS_UNDEF) {
+				ZVAL_COPY(&tmp_member, member);
+				member = &tmp_member;
+			}
 			ZVAL_COPY(&tmp_object, object);
 			(*guard) |= IN_ISSET; /* prevent circular getting */
 			zend_std_call_issetter(&tmp_object, member, &rv);

Zend/zend_opcode.c

@@ -142,6 +142,25 @@ ZEND_API void zend_function_dtor(zval *zv)
 		ZEND_ASSERT(function->type == ZEND_INTERNAL_FUNCTION);
 		ZEND_ASSERT(function->common.function_name);
 		zend_string_release(function->common.function_name);
+#ifndef ZTS
+		if ((function->common.fn_flags & (ZEND_ACC_HAS_RETURN_TYPE|ZEND_ACC_HAS_TYPE_HINTS)) &&
+		    !function->common.scope && function->common.arg_info) {
+
+			uint32_t i;
+			uint32_t num_args = function->common.num_args + 1;
+			zend_arg_info *arg_info = function->common.arg_info - 1;
+
+			if (function->common.fn_flags & ZEND_ACC_VARIADIC) {
+				num_args++;
+			}
+			for (i = 0 ; i < num_args; i++) {
+				if (ZEND_TYPE_IS_CLASS(arg_info[i].type)) {
+					zend_string_release(ZEND_TYPE_NAME(arg_info[i].type));
+				}
+			}
+			free(arg_info);
+		}
+#endif
 		if (!(function->common.fn_flags & ZEND_ACC_ARENA_ALLOCATED)) {
 			pefree(function, 1);
 		}
@@ -227,6 +246,9 @@ ZEND_API void destroy_zend_class(zval *zv)
 {
 	zend_property_info *prop_info;
 	zend_class_entry *ce = Z_PTR_P(zv);
+#ifndef ZTS
+	zend_function *fn;
+#endif
 
 	if (--ce->refcount > 0) {
 		return;
@@ -310,6 +332,15 @@ ZEND_API void destroy_zend_class(zval *zv)
 			}
 			zend_hash_destroy(&ce->properties_info);
 			zend_string_release(ce->name);
+#ifndef ZTS
+			ZEND_HASH_FOREACH_PTR(&ce->function_table, fn) {
+				if ((fn->common.fn_flags & (ZEND_ACC_HAS_RETURN_TYPE|ZEND_ACC_HAS_TYPE_HINTS)) &&
+				    fn->common.scope == ce) {
+					/* reset function scope to allow arg_info removing */
+					fn->common.scope = NULL;
+				}
+			} ZEND_HASH_FOREACH_END();
+#endif
 			zend_hash_destroy(&ce->function_table);
 			if (zend_hash_num_elements(&ce->constants_table)) {
 				zend_class_constant *c;

Zend/zend_operators.c

@@ -225,8 +225,10 @@ ZEND_API void ZEND_FASTCALL convert_scalar_to_number(zval *op) /* {{{ */
 					if (Z_TYPE(holder) == IS_LONG) {				\
 						if (op == result) {							\
 							zval_ptr_dtor(op);						\
+							ZVAL_LONG(op, Z_LVAL(holder));			\
+						} else {									\
+							(op) = &(holder);						\
 						}											\
-						(op) = &(holder);							\
 					}												\
 					break;											\
 			}														\

Zend/zend_variables.c

@@ -167,8 +167,10 @@ ZEND_API void ZEND_FASTCALL _zval_copy_ctor_func(zval *zvalue ZEND_FILE_LINE_DC)
 {
 	if (EXPECTED(Z_TYPE_P(zvalue) == IS_ARRAY)) {
 		ZVAL_ARR(zvalue, zend_array_dup(Z_ARRVAL_P(zvalue)));
-	} else if (EXPECTED(Z_TYPE_P(zvalue) == IS_STRING) ||
-	           EXPECTED(Z_TYPE_P(zvalue) == IS_CONSTANT)) {
+	} else if (EXPECTED(Z_TYPE_P(zvalue) == IS_STRING)) {
+		CHECK_ZVAL_STRING_REL(Z_STR_P(zvalue));
+		ZVAL_NEW_STR(zvalue, zend_string_dup(Z_STR_P(zvalue), 0));
+	} else if (EXPECTED(Z_TYPE_P(zvalue) == IS_CONSTANT)) {
 		CHECK_ZVAL_STRING_REL(Z_STR_P(zvalue));
 		Z_STR_P(zvalue) = zend_string_dup(Z_STR_P(zvalue), 0);
 	} else if (EXPECTED(Z_TYPE_P(zvalue) == IS_CONSTANT_AST)) {

Zend/zend_virtual_cwd.c

@@ -616,7 +616,7 @@ CWD_API void realpath_cache_del(const char *path, size_t path_len) /* {{{ */
 }
 /* }}} */
 
-static inline void realpath_cache_add(const char *path, int path_len, const char *realpath, size_t realpath_len, int is_dir, time_t t) /* {{{ */
+static inline void realpath_cache_add(const char *path, size_t path_len, const char *realpath, size_t realpath_len, int is_dir, time_t t) /* {{{ */
 {
 	zend_long size = sizeof(realpath_cache_bucket) + path_len + 1;
 	int same = 1;

appveyor/build.bat

@@ -2,6 +2,7 @@
 
 set SDK_REMOTE=https://github.com/OSTC/php-sdk-binary-tools.git
 set SDK_BRANCH=%PHP_BUILD_SDK_BRANCH%
+set SDK_RUNNER=%PHP_BUILD_CACHE_SDK_DIR%\phpsdk-%PHP_BUILD_CRT%-%PLATFORM%.bat
 
 if not exist "%PHP_BUILD_CACHE_BASE_DIR%" (
 	echo Creating %PHP_BUILD_CACHE_BASE_DIR%
@@ -13,17 +14,25 @@ if not exist "%PHP_BUILD_OBJ_DIR%" (
 	mkdir "%PHP_BUILD_OBJ_DIR%"
 )
 
+if not exist "%SDK_RUNNER%" (
+	if exist "%PHP_BUILD_CACHE_SDK_DIR%" rmdir /s /q "%PHP_BUILD_CACHE_SDK_DIR%"
+)
+
 if not exist "%PHP_BUILD_CACHE_SDK_DIR%" (
 	echo Cloning remote SDK repository
 	git clone --branch %SDK_BRANCH% %SDK_REMOTE% "%PHP_BUILD_CACHE_SDK_DIR%" 2>&1 
-) else (
+)
+
+for /f "tokens=*" %%a in ('type %PHP_BUILD_CACHE_SDK_DIR%\VERSION') do set GOT_SDK_VER=%%a
+echo Got SDK version %GOT_SDK_VER%
+if NOT "%GOT_SDK_VER%" == "%PHP_BUILD_SDK_BRANCH:~8%" (
+	echo Switching to the configured SDK version %SDK_BRANCH:~8%
 	echo Fetching remote SDK repository
 	git --git-dir="%PHP_BUILD_CACHE_SDK_DIR%\.git" --work-tree="%PHP_BUILD_CACHE_SDK_DIR%" fetch --prune origin 2>&1
 	echo Checkout SDK repository branch
 	git --git-dir="%PHP_BUILD_CACHE_SDK_DIR%\.git" --work-tree="%PHP_BUILD_CACHE_SDK_DIR%" checkout --force %SDK_BRANCH% 
 )
 
-set SDK_RUNNER=%PHP_BUILD_CACHE_SDK_DIR%\phpsdk-%PHP_BUILD_CRT%-%PLATFORM%.bat
 if not exist "%SDK_RUNNER%" (
 	echo "%SDK_RUNNER%" doesn't exist
 	exit /b 3

appveyor/build_task.bat

@@ -8,6 +8,8 @@ if "%APPVEYOR%" equ "True" rmdir /s /q C:\mingw >NUL 2>NUL
 if %errorlevel% neq 0 exit /b 3
 if "%APPVEYOR%" equ "True" rmdir /s /q C:\mingw-w64 >NUL 2>NUL
 if %errorlevel% neq 0 exit /b 3
+if "%APPVEYOR%" equ "True" rmdir /s /q C:\msys64 >NUL 2>NUL
+if %errorlevel% neq 0 exit /b 3
 
 cd /D %APPVEYOR_BUILD_FOLDER%
 if %errorlevel% neq 0 exit /b 3

configure.ac

@@ -108,7 +108,7 @@ int zend_sprintf(char *buffer, const char *format, ...);
 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=2
 PHP_RELEASE_VERSION=0
-PHP_EXTRA_VERSION="-dev"
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
 

ext/bcmath/bcmath.c

@@ -60,9 +60,10 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_bcdiv, 0, 0, 2)
 	ZEND_ARG_INFO(0, scale)
 ZEND_END_ARG_INFO()
 
-ZEND_BEGIN_ARG_INFO(arginfo_bcmod, 0)
+ZEND_BEGIN_ARG_INFO_EX(arginfo_bcmod, 0, 0, 2)
 	ZEND_ARG_INFO(0, left_operand)
 	ZEND_ARG_INFO(0, right_operand)
+	ZEND_ARG_INFO(0, scale)
 ZEND_END_ARG_INFO()
 
 ZEND_BEGIN_ARG_INFO_EX(arginfo_bcpowmod, 0, 0, 3)
@@ -388,26 +389,38 @@ PHP_FUNCTION(bcdiv)
 }
 /* }}} */
 
-/* {{{ proto string bcmod(string left_operand, string right_operand)
+/* {{{ proto string bcmod(string left_operand, string right_operand [, int scale])
    Returns the modulus of the two arbitrary precision operands */
 PHP_FUNCTION(bcmod)
 {
 	zend_string *left, *right;
+	zend_long scale_param = 0;
 	bc_num first, second, result;
+	int scale = (int)BCG(bc_precision);
 
-	ZEND_PARSE_PARAMETERS_START(2, 2)
+	ZEND_PARSE_PARAMETERS_START(2, 3)
 		Z_PARAM_STR(left)
 		Z_PARAM_STR(right)
+		Z_PARAM_OPTIONAL
+		Z_PARAM_LONG(scale_param)
 	ZEND_PARSE_PARAMETERS_END();
 
+	if (ZEND_NUM_ARGS() == 3) {
+		scale = (int) ((int)scale_param < 0 ? 0 : scale_param);
+	}
+
 	bc_init_num(&first);
 	bc_init_num(&second);
 	bc_init_num(&result);
 	php_str2num(&first, ZSTR_VAL(left));
 	php_str2num(&second, ZSTR_VAL(right));
 
-	switch (bc_modulo(first, second, &result, 0)) {
+	switch (bc_modulo(first, second, &result, scale)) {
 		case 0:
+			if (result->n_scale > scale) {
+				result = split_bc_num(result);
+				result->n_scale = scale;
+			}
 			RETVAL_STR(bc_num2str(result));
 			break;
 		case -1:

ext/bcmath/tests/bcmod.phpt

@@ -9,7 +9,7 @@ bcmath.scale=0
 echo bcmod("11", "2"),"\n";
 echo bcmod("-1", "5"),"\n";
 echo bcmod("8728932001983192837219398127471", "1928372132132819737213"),"\n";
-echo bcmod("3.5", "4"),"\n";
+echo bcmod("3.5", "4", 1),"\n";
 echo bcmod("1071", "357.5"),"\n";
 ?>
 --EXPECT--
@@ -17,4 +17,4 @@ echo bcmod("1071", "357.5"),"\n";
 -1
 1459434331351930289678
 3.5
-356.0
+356

ext/bcmath/tests/bcmod_error1.phpt

@@ -7,7 +7,7 @@ antoni@solucionsinternet.com
 <?php if(!extension_loaded("bcmath")) print "skip"; ?>
 --FILE--
 <?php
-echo bcmod('1', '2', '3');
+echo bcmod('1', '2', '3', '4');
 ?>
 --EXPECTF--
-Warning: bcmod() expects exactly 2 parameters, 3 given in %s.php on line %d
+Warning: bcmod() expects at most 3 parameters, 4 given in %s.php on line %d

ext/date/lib/parse_date.c

@@ -1,4 +1,4 @@
-/* Generated by re2c 0.15.3 on Mon Sep  4 22:44:17 2017 */
+/* Generated by re2c 0.15.3 on Tue Oct 24 13:44:48 2017 */
 #line 1 "ext/date/lib/parse_date.re"
 /*
  * The MIT License (MIT)

ext/date/lib/timezonemap.h

@@ -446,7 +446,6 @@
 	{ "cst",   0, -21600, "America/Thunder_Bay"           },
 	{ "cst",   0, -21600, "America/Winnipeg"              },
 	{ "cst",   0, -21600, "Canada/Central"                },
-	{ "cst",   0, -21600, "Canada/East-Saskatchewan"      },
 	{ "cst",   0, -21600, "Canada/Saskatchewan"           },
 	{ "cst",   0, -21600, "Mexico/BajaSur"                },
 	{ "cst",   0, -21600, "Mexico/General"                },
@@ -760,7 +759,6 @@
 	{ "mdt",   1, -21600, "America/Shiprock"              },
 	{ "mdt",   1, -21600, "America/Swift_Current"         },
 	{ "mdt",   1, -21600, "America/Yellowknife"           },
-	{ "mdt",   1, -21600, "Canada/East-Saskatchewan"      },
 	{ "mdt",   1, -21600, "Canada/Mountain"               },
 	{ "mdt",   1, -21600, "Canada/Saskatchewan"           },
 	{ "mdt",   1, -21600, "Mexico/BajaSur"                },
@@ -772,6 +770,8 @@
 	{ "mmt",   0,  -2670, "Africa/Monrovia"               },
 	{ "mmt",   0,  17640, "Indian/Maldives"               },
 	{ "mmt",   0,  19172, "Asia/Colombo"                  },
+	{ "mmt",   0,  19270, "Asia/Calcutta"                 },
+	{ "mmt",   0,  19270, "Asia/Kolkata"                  },
 	{ "mmt",   0,  28656, "Asia/Makassar"                 },
 	{ "mmt",   0,  28656, "Asia/Ujung_Pandang"            },
 	{ "mmt",   0,   6600, "Europe/Minsk"                  },
@@ -786,7 +786,6 @@
 	{ "mpt",   1, -21600, "America/Shiprock"              },
 	{ "mpt",   1, -21600, "America/Swift_Current"         },
 	{ "mpt",   1, -21600, "America/Yellowknife"           },
-	{ "mpt",   1, -21600, "Canada/East-Saskatchewan"      },
 	{ "mpt",   1, -21600, "Canada/Mountain"               },
 	{ "mpt",   1, -21600, "Canada/Saskatchewan"           },
 	{ "msd",   1,  14400, "Europe/Moscow"                 },
@@ -840,7 +839,6 @@
 	{ "mst",   0, -25200, "America/Swift_Current"         },
 	{ "mst",   0, -25200, "America/Tijuana"               },
 	{ "mst",   0, -25200, "America/Yellowknife"           },
-	{ "mst",   0, -25200, "Canada/East-Saskatchewan"      },
 	{ "mst",   0, -25200, "Canada/Mountain"               },
 	{ "mst",   0, -25200, "Canada/Saskatchewan"           },
 	{ "mst",   0, -25200, "Mexico/BajaNorte"              },
@@ -859,7 +857,6 @@
 	{ "mwt",   1, -21600, "America/Shiprock"              },
 	{ "mwt",   1, -21600, "America/Swift_Current"         },
 	{ "mwt",   1, -21600, "America/Yellowknife"           },
-	{ "mwt",   1, -21600, "Canada/East-Saskatchewan"      },
 	{ "mwt",   1, -21600, "Canada/Mountain"               },
 	{ "mwt",   1, -21600, "Canada/Saskatchewan"           },
 	{ "nddt",  1,  -5400, "America/St_Johns"              },
@@ -994,8 +991,8 @@
 	{ "pwt",   1, -25200, "Mexico/BajaNorte"              },
 	{ "qmt",   0, -18840, "America/Guayaquil"             },
 	{ "rmt",   0,   5794, "Europe/Riga"                   },
-	{ "rmt",   0,  23080, "Asia/Rangoon"                  },
-	{ "rmt",   0,  23080, "Asia/Yangon"                   },
+	{ "rmt",   0,  23087, "Asia/Rangoon"                  },
+	{ "rmt",   0,  23087, "Asia/Yangon"                   },
 	{ "rmt",   0,   2996, "Europe/Rome"                   },
 	{ "rmt",   0,   2996, "Europe/San_Marino"             },
 	{ "rmt",   0,   2996, "Europe/Vatican"                },

ext/date/php_date.c

@@ -659,6 +659,7 @@ static HashTable *date_object_get_gc_timezone(zval *object, zval **table, int *n
 
 zval *date_interval_read_property(zval *object, zval *member, int type, void **cache_slot, zval *rv);
 void date_interval_write_property(zval *object, zval *member, zval *value, void **cache_slot);
+static zval *date_interval_get_property_ptr_ptr(zval *object, zval *member, int type, void **cache_slot);
 static zval *date_period_read_property(zval *object, zval *member, int type, void **cache_slot, zval *rv);
 static void date_period_write_property(zval *object, zval *member, zval *value, void **cache_slot);
 
@@ -2149,7 +2150,7 @@ static void date_register_classes(void) /* {{{ */
 	date_object_handlers_interval.read_property = date_interval_read_property;
 	date_object_handlers_interval.write_property = date_interval_write_property;
 	date_object_handlers_interval.get_properties = date_object_get_properties_interval;
-	date_object_handlers_interval.get_property_ptr_ptr = NULL;
+	date_object_handlers_interval.get_property_ptr_ptr = date_interval_get_property_ptr_ptr;
 	date_object_handlers_interval.get_gc = date_object_get_gc_interval;
 
 	INIT_CLASS_ENTRY(ce_period, "DatePeriod", date_funcs_period);
@@ -4165,7 +4166,7 @@ zval *date_interval_read_property(zval *object, zval *member, int type, void **c
 		GET_VALUE_FROM_STRUCT(i, "i");
 		GET_VALUE_FROM_STRUCT(s, "s");
 		if (strcmp(Z_STRVAL_P(member), "f") == 0) {
-			fvalue = obj->diff->us / 1000000;
+			fvalue = obj->diff->us / 1000000.0;
 			break;
 		}
 		GET_VALUE_FROM_STRUCT(invert, "invert");
@@ -4250,6 +4251,40 @@ void date_interval_write_property(zval *object, zval *member, zval *value, void
 }
 /* }}} */
 
+/* {{{ date_interval_get_property_ptr_ptr */
+static zval *date_interval_get_property_ptr_ptr(zval *object, zval *member, int type, void **cache_slot)
+{
+	zval tmp_member, *ret;
+
+	if (Z_TYPE_P(member) != IS_STRING) {
+		tmp_member = *member;
+		zval_copy_ctor(&tmp_member);
+		convert_to_string(&tmp_member);
+		member = &tmp_member;
+		cache_slot = NULL;
+	}
+
+	if(zend_binary_strcmp("y", sizeof("y") - 1, Z_STRVAL_P(member), Z_STRLEN_P(member)) == 0 ||
+		zend_binary_strcmp("m", sizeof("m") - 1, Z_STRVAL_P(member), Z_STRLEN_P(member)) == 0 ||
+		zend_binary_strcmp("d", sizeof("d") - 1, Z_STRVAL_P(member), Z_STRLEN_P(member)) == 0 ||
+		zend_binary_strcmp("h", sizeof("h") - 1, Z_STRVAL_P(member), Z_STRLEN_P(member)) == 0 ||
+		zend_binary_strcmp("i", sizeof("i") - 1, Z_STRVAL_P(member), Z_STRLEN_P(member)) == 0 ||
+		zend_binary_strcmp("s", sizeof("s") - 1, Z_STRVAL_P(member), Z_STRLEN_P(member)) == 0 ||
+		zend_binary_strcmp("days", sizeof("days") - 1, Z_STRVAL_P(member), Z_STRLEN_P(member)) == 0 ||
+		zend_binary_strcmp("invert", sizeof("invert") - 1, Z_STRVAL_P(member), Z_STRLEN_P(member)) == 0) {
+		/* Fallback to read_property. */
+		ret = NULL;
+	} else {
+		ret = (zend_get_std_object_handlers())->get_property_ptr_ptr(object, member, type, cache_slot);
+	}
+
+	if (member == &tmp_member) {
+		zval_dtor(member);
+	}
+
+	return ret;
+}
+/* }}} */
 
 /* {{{ proto DateInterval::__construct([string interval_spec])
    Creates new DateInterval object.

ext/date/tests/bug53437_var3.phpt

@@ -40,7 +40,7 @@ object(DateInterval)#%d (16) {
   ["special_amount"]=>
   int(-1)
   ["have_weekday_relative"]=>
-  int(9)
+  int(%d)
   ["have_special_relative"]=>
   int(0)
   ["f"]=>

ext/date/tests/bug75222.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Bug #75222 DateInterval microseconds property always 0
+--FILE--
+<?php
+
+$dt1 = new \DateTimeImmutable('2017-01-01T00:00:00.000000Z');
+$dt2 = new \DateTimeImmutable('2017-01-01T00:00:00.123456Z');
+$diff = $dt1->diff($dt2);
+//var_dump($diff);
+var_dump($diff->f);
+var_dump(get_object_vars($diff)['f']);
+var_dump($diff->f === get_object_vars($diff)['f']);
+?>
+--EXPECTF--
+float(0.123456)
+float(0.123456)
+bool(true)

ext/date/tests/date_interval_prop_dim.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Test DateInterval props with dimension handling
+--FILE--
+<?php
+class Z extends DateInterval{}
+$z = new Z('P2Y4DT6H8M');
+$i = 0;
+$z->prop[1]=10;
+while ($i < 1026) {
+	$z->prop[$i] = $i;
+	$i++;
+}
+?>
+==NOCRASH==
+--EXPECT--
+==NOCRASH==

ext/enchant/enchant.c

@@ -323,7 +323,6 @@ PHP_MINFO_FUNCTION(enchant)
 #elif defined(HAVE_ENCHANT_BROKER_SET_PARAM)
 	php_info_print_table_row(2, "Libenchant Version", "1.5.0 or later");
 #endif
-	php_info_print_table_row(2, "Revision", "$Id$");
 	php_info_print_table_end();
 
 	php_info_print_table_start();
@@ -483,6 +482,11 @@ PHP_FUNCTION(enchant_broker_get_dict_path)
 			RETURN_FALSE;
 	}
 
+	if (value == NULL) {
+		php_error_docref(NULL, E_WARNING, "dict_path not set");
+		RETURN_FALSE;
+	}
+
 	RETURN_STRING(value);
 }
 /* }}} */

ext/enchant/php_enchant.h

@@ -24,7 +24,7 @@
 extern zend_module_entry enchant_module_entry;
 #define phpext_enchant_ptr &enchant_module_entry
 
-#define PHP_ENCHANT_VERSION "1.1.0"
+#define PHP_ENCHANT_VERSION PHP_VERSION
 
 #ifdef PHP_WIN32
 #define PHP_ENCHANT_API __declspec(dllexport)

ext/enchant/tests/bug53070.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #53070 (enchant_broker_get_path crashes if no path is set)
+--SKIPIF--
+<?php
+if(!extension_loaded('enchant')) die('skip, enchant not loader');
+if (!is_resource(enchant_broker_init())) {die("skip, resource dont load\n");}
+?>
+--FILE--
+<?php
+$broker = enchant_broker_init();
+var_dump(enchant_broker_get_dict_path($broker, ENCHANT_MYSPELL));
+var_dump(enchant_broker_get_dict_path($broker, ENCHANT_ISPELL));
+?>
+--EXPECTF--
+
+Warning: enchant_broker_get_dict_path(): dict_path not set in %s on line %d
+bool(false)
+
+Warning: enchant_broker_get_dict_path(): dict_path not set in %s on line %d
+bool(false)

ext/exif/php_exif.h

@@ -22,7 +22,7 @@
 #if HAVE_EXIF
 
 #include "php_version.h"
-#define PHP_EXIF_VERSION "1.4 $Id: 8bdc0c8f27c2c9dd1f7551f1f9fe3ab57a06a4b1 $"
+#define PHP_EXIF_VERSION PHP_VERSION
 
 extern zend_module_entry exif_module_entry;
 #define phpext_exif_ptr &exif_module_entry

ext/fileinfo/CREDITS

@@ -1,2 +1,2 @@
 fileinfo
-Ilia Alshanetsky, Pierre Alain Joye, Scott MacVicar, Derick Rethans
+Ilia Alshanetsky, Pierre Alain Joye, Scott MacVicar, Derick Rethans, Anatol Belski

ext/fileinfo/libmagic/apprentice.c

@@ -34,7 +34,7 @@
 #include "file.h"
 
 #ifndef	lint
-FILE_RCSID("@(#)$File: apprentice.c,v 1.255 2016/10/24 18:02:17 christos Exp $")
+FILE_RCSID("@(#)$File: apprentice.c,v 1.260 2017/04/28 16:27:58 christos Exp $")
 #endif	/* lint */
 
 #include "magic.h"
@@ -2235,7 +2235,7 @@ parse_ext(struct magic_set *ms, struct magic_entry *me, const char *line)
 
 	return parse_extra(ms, me, line,
 	    CAST(off_t, offsetof(struct magic, ext)),
-	    sizeof(m->ext), "EXTENSION", ",!+-/", 0);
+	    sizeof(m->ext), "EXTENSION", ",!+-/@", 0);
 }
 
 /*
@@ -2296,6 +2296,8 @@ check_format_type(const char *ptr, int type, const char **estr)
 			ptr++;
 		if (*ptr == '.')
 			ptr++;
+		if (*ptr == '#')
+			ptr++;
 #define CHECKLEN() do { \
 	for (len = cnt = 0; isdigit((unsigned char)*ptr); ptr++, cnt++) \
 		len = len * 10 + (*ptr - '0'); \
@@ -2851,7 +2853,7 @@ apprentice_buf(struct magic_set *ms, struct magic *buf, size_t len)
 {
 	struct magic_map *map;
 
-	if ((map = CAST(struct magic_map *, calloc(1, sizeof(*map)))) == NULL) {
+	if ((map = CAST(struct magic_map *, ecalloc(1, sizeof(*map)))) == NULL) {
 		file_oomem(ms, sizeof(*map));
 		return NULL;
 	}
@@ -3289,22 +3291,35 @@ file_pstring_get_length(const struct magic *m, const char *ss)
 {
 	size_t len = 0;
 	const unsigned char *s = (const unsigned char *)ss;
+	unsigned int s3, s2, s1, s0;
 
 	switch (m->str_flags & PSTRING_LEN) {
 	case PSTRING_1_LE:
 		len = *s;
 		break;
 	case PSTRING_2_LE:
-		len = (s[1] << 8) | s[0];
+		s0 = s[0];
+		s1 = s[1];
+		len = (s1 << 8) | s0;
 		break;
 	case PSTRING_2_BE:
-		len = (s[0] << 8) | s[1];
+		s0 = s[0];
+		s1 = s[1];
+		len = (s0 << 8) | s1;
 		break;
 	case PSTRING_4_LE:
-		len = (s[3] << 24) | (s[2] << 16) | (s[1] << 8) | s[0];
+		s0 = s[0];
+		s1 = s[1];
+		s2 = s[2];
+		s3 = s[3];
+		len = (s3 << 24) | (s2 << 16) | (s1 << 8) | s0;
 		break;
 	case PSTRING_4_BE:
-		len = (s[0] << 24) | (s[1] << 16) | (s[2] << 8) | s[3];
+		s0 = s[0];
+		s1 = s[1];
+		s2 = s[2];
+		s3 = s[3];
+		len = (s0 << 24) | (s1 << 16) | (s2 << 8) | s3;
 		break;
 	default:
 		abort();	/* Impossible */

ext/fileinfo/libmagic/cdf.c

@@ -35,7 +35,7 @@
 #include "file.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$File: cdf.c,v 1.85 2016/10/24 18:02:17 christos Exp $")
+FILE_RCSID("@(#)$File: cdf.c,v 1.106 2017/04/30 17:05:02 christos Exp $")
 #endif
 
 #include <assert.h>
@@ -90,6 +90,31 @@ static union {
 			    CDF_TOLE8(CAST(uint64_t, x))))
 #define CDF_GETUINT32(x, y)	cdf_getuint32(x, y)
 
+#define CDF_MALLOC(n) cdf_malloc(__FILE__, __LINE__, (n))
+#define CDF_REALLOC(p, n) cdf_realloc(__FILE__, __LINE__, (p), (n))
+#define CDF_CALLOC(n, u) cdf_calloc(__FILE__, __LINE__, (n), (u))
+
+
+static void *
+cdf_malloc(const char *file, size_t line, size_t n)
+{
+	DPRINTF(("%s,%zu: %s %zu\n", file, line, __func__, n));
+	return malloc(n);
+}
+
+static void *
+cdf_realloc(const char *file, size_t line, void *p, size_t n)
+{
+	DPRINTF(("%s,%zu: %s %zu\n", file, line, __func__, n));
+	return realloc(p, n);
+}
+
+static void *
+cdf_calloc(const char *file, size_t line, size_t n, size_t u)
+{
+	DPRINTF(("%s,%zu: %s %zu %zu\n", file, line, __func__, n, u));
+	return calloc(n, u);
+}
 
 /*
  * swap a short
@@ -354,18 +379,18 @@ cdf_read_header(const cdf_info_t *info, cdf_header_t *h)
 	cdf_unpack_header(h, buf);
 	cdf_swap_header(h);
 	if (h->h_magic != CDF_MAGIC) {
-		DPRINTF(("Bad magic 0x%" INT64_T_FORMAT "x != 0x%"
+		DPRINTF(("Bad magic %#" INT64_T_FORMAT "x != %#"
 		    INT64_T_FORMAT "x\n",
 		    (unsigned long long)h->h_magic,
 		    (unsigned long long)CDF_MAGIC));
 		goto out;
 	}
 	if (h->h_sec_size_p2 > 20) {
-		DPRINTF(("Bad sector size 0x%u\n", h->h_sec_size_p2));
+		DPRINTF(("Bad sector size %hu\n", h->h_sec_size_p2));
 		goto out;
 	}
 	if (h->h_short_sec_size_p2 > 20) {
-		DPRINTF(("Bad short sector size 0x%u\n",
+		DPRINTF(("Bad short sector size %hu\n",
 		    h->h_short_sec_size_p2));
 		goto out;
 	}
@@ -422,7 +447,7 @@ cdf_read_sat(const cdf_info_t *info, cdf_header_t *h, cdf_sat_t *sat)
 		if (h->h_master_sat[i] == CDF_SECID_FREE)
 			break;
 
-#define CDF_SEC_LIMIT (UINT32_MAX / (4 * ss))
+#define CDF_SEC_LIMIT (UINT32_MAX / (8 * ss))
 	if ((nsatpersec > 0 &&
 	    h->h_num_sectors_in_master_sat > CDF_SEC_LIMIT / nsatpersec) ||
 	    i > CDF_SEC_LIMIT) {
@@ -435,7 +460,7 @@ cdf_read_sat(const cdf_info_t *info, cdf_header_t *h, cdf_sat_t *sat)
 	sat->sat_len = h->h_num_sectors_in_master_sat * nsatpersec + i;
 	DPRINTF(("sat_len = %" SIZE_T_FORMAT "u ss = %" SIZE_T_FORMAT "u\n",
 	    sat->sat_len, ss));
-	if ((sat->sat_tab = CAST(cdf_secid_t *, calloc(sat->sat_len, ss)))
+	if ((sat->sat_tab = CAST(cdf_secid_t *, CDF_CALLOC(sat->sat_len, ss)))
 	    == NULL)
 		return -1;
 
@@ -449,7 +474,7 @@ cdf_read_sat(const cdf_info_t *info, cdf_header_t *h, cdf_sat_t *sat)
 		}
 	}
 
-	if ((msa = CAST(cdf_secid_t *, calloc(1, ss))) == NULL)
+	if ((msa = CAST(cdf_secid_t *, CDF_CALLOC(1, ss))) == NULL)
 		goto out1;
 
 	mid = h->h_secid_first_sector_in_master_sat;
@@ -541,13 +566,16 @@ cdf_read_long_sector_chain(const cdf_info_t *info, const cdf_header_t *h,
 	ssize_t nr;
 	scn->sst_tab = NULL;
 	scn->sst_len = cdf_count_chain(sat, sid, ss);
-	scn->sst_dirlen = len;
+	scn->sst_dirlen = MAX(h->h_min_size_standard_stream, len);
 	scn->sst_ss = ss;
 
+	if (sid == CDF_SECID_END_OF_CHAIN || len == 0)
+		return cdf_zero_stream(scn);
+
 	if (scn->sst_len == (size_t)-1)
 		goto out;
 
-	scn->sst_tab = calloc(scn->sst_len, ss);
+	scn->sst_tab = CDF_CALLOC(scn->sst_len, ss);
 	if (scn->sst_tab == NULL)
 		return cdf_zero_stream(scn);
 
@@ -593,7 +621,7 @@ cdf_read_short_sector_chain(const cdf_header_t *h,
 	if (scn->sst_len == (size_t)-1)
 		goto out;
 
-	scn->sst_tab = calloc(scn->sst_len, ss);
+	scn->sst_tab = CDF_CALLOC(scn->sst_len, ss);
 	if (scn->sst_tab == NULL)
 		return cdf_zero_stream(scn);
 
@@ -651,11 +679,11 @@ cdf_read_dir(const cdf_info_t *info, const cdf_header_t *h,
 
 	dir->dir_len = ns * nd;
 	dir->dir_tab = CAST(cdf_directory_t *,
-	    calloc(dir->dir_len, sizeof(dir->dir_tab[0])));
+	    CDF_CALLOC(dir->dir_len, sizeof(dir->dir_tab[0])));
 	if (dir->dir_tab == NULL)
 		return -1;
 
-	if ((buf = CAST(char *, malloc(ss))) == NULL) {
+	if ((buf = CAST(char *, CDF_MALLOC(ss))) == NULL) {
 		free(dir->dir_tab);
 		return -1;
 	}
@@ -701,7 +729,7 @@ cdf_read_ssat(const cdf_info_t *info, const cdf_header_t *h,
 	if (ssat->sat_len == (size_t)-1)
 		goto out;
 
-	ssat->sat_tab = CAST(cdf_secid_t *, calloc(ssat->sat_len, ss));
+	ssat->sat_tab = CAST(cdf_secid_t *, CDF_CALLOC(ssat->sat_len, ss));
 	if (ssat->sat_tab == NULL)
 		goto out1;
 
@@ -822,13 +850,107 @@ cdf_find_stream(const cdf_dir_t *dir, const char *name, int type)
 		    == 0)
 			break;
 	if (i > 0)
-		return i;
+		return CAST(int, i);
 
 	DPRINTF(("Cannot find type %d `%s'\n", type, name));
 	errno = ESRCH;
 	return 0;
 }
 
+#define CDF_SHLEN_LIMIT (UINT32_MAX / 8)
+#define CDF_PROP_LIMIT (UINT32_MAX / (8 * sizeof(cdf_property_info_t)))
+
+static const void *
+cdf_offset(const void *p, size_t l)
+{
+	return CAST(const void *, CAST(const uint8_t *, p) + l);
+}
+
+static const uint8_t *
+cdf_get_property_info_pos(const cdf_stream_t *sst, const cdf_header_t *h, 
+    const uint8_t *p, const uint8_t *e, size_t i)
+{
+	size_t tail = (i << 1) + 1;
+	size_t ofs;
+	const uint8_t *q;
+
+	if (p >= e) {
+		DPRINTF(("Past end %p < %p\n", e, p));
+		return NULL;
+	}
+	if (cdf_check_stream_offset(sst, h, p, (tail + 1) * sizeof(uint32_t),
+	    __LINE__) == -1)
+		return NULL;
+	ofs = CDF_GETUINT32(p, tail);
+	q = CAST(const uint8_t *, cdf_offset(CAST(const void *, p), 
+	    ofs - 2 * sizeof(uint32_t)));
+
+	if (q < p) {
+		DPRINTF(("Wrapped around %p < %p\n", q, p));
+		return NULL;
+	}
+
+	if (q >= e) {
+		DPRINTF(("Ran off the end %p >= %p\n", q, e));
+		return NULL;
+	}
+	return q;
+}
+
+static cdf_property_info_t *
+cdf_grow_info(cdf_property_info_t **info, size_t *maxcount, size_t incr)
+{
+	cdf_property_info_t *inp;
+	size_t newcount = *maxcount + incr;
+
+	if (newcount > CDF_PROP_LIMIT) {
+		DPRINTF(("exceeded property limit %zu > %zu\n", 
+		    newcount, CDF_PROP_LIMIT));
+		goto out;
+	}
+	inp = CAST(cdf_property_info_t *,
+	    CDF_REALLOC(*info, newcount * sizeof(*inp)));
+	if (inp == NULL)
+		goto out;
+
+	*info = inp;
+	*maxcount = newcount;
+	return inp;
+out:
+	free(*info);
+	*maxcount = 0;
+	*info = NULL;
+	return NULL;
+}
+
+static int
+cdf_copy_info(cdf_property_info_t *inp, const void *p, const void *e,
+    size_t len)
+{
+	if (inp->pi_type & CDF_VECTOR)
+		return 0;
+
+	if ((size_t)(CAST(const char *, e) - CAST(const char *, p)) < len)
+		return 0;
+
+	(void)memcpy(&inp->pi_val, p, len);
+
+	switch (len) {
+	case 2:
+		inp->pi_u16 = CDF_TOLE2(inp->pi_u16);
+		break;
+	case 4:
+		inp->pi_u32 = CDF_TOLE4(inp->pi_u32);
+		break;
+	case 8:
+		inp->pi_u64 = CDF_TOLE8(inp->pi_u64);
+		break;
+	default:
+		abort();
+	}
+	return 1;
+}
+
 int
 cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
     uint32_t offs, cdf_property_info_t **info, size_t *count, size_t *maxcount)
@@ -836,92 +958,69 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 	const cdf_section_header_t *shp;
 	cdf_section_header_t sh;
 	const uint8_t *p, *q, *e;
-	int16_t s16;
-	int32_t s32;
-	uint32_t u32;
-	int64_t s64;
-	uint64_t u64;
-	cdf_timestamp_t tp;
-	size_t i, o, o4, nelements, j;
+	size_t i, o4, nelements, j, slen, left;
 	cdf_property_info_t *inp;
 
 	if (offs > UINT32_MAX / 4) {
 		errno = EFTYPE;
 		goto out;
 	}
-	shp = CAST(const cdf_section_header_t *, (const void *)
-	    ((const char *)sst->sst_tab + offs));
+	shp = CAST(const cdf_section_header_t *,
+	    cdf_offset(sst->sst_tab, offs));
 	if (cdf_check_stream_offset(sst, h, shp, sizeof(*shp), __LINE__) == -1)
 		goto out;
 	sh.sh_len = CDF_TOLE4(shp->sh_len);
-#define CDF_SHLEN_LIMIT (UINT32_MAX / 8)
 	if (sh.sh_len > CDF_SHLEN_LIMIT) {
 		errno = EFTYPE;
 		goto out;
 	}
-	sh.sh_properties = CDF_TOLE4(shp->sh_properties);
-#define CDF_PROP_LIMIT (UINT32_MAX / (4 * sizeof(*inp)))
-	if (sh.sh_properties > CDF_PROP_LIMIT)
+
+	if (cdf_check_stream_offset(sst, h, shp, sh.sh_len, __LINE__) == -1)
 		goto out;
+
+	sh.sh_properties = CDF_TOLE4(shp->sh_properties);
 	DPRINTF(("section len: %u properties %u\n", sh.sh_len,
 	    sh.sh_properties));
-	if (*maxcount) {
-		if (*maxcount > CDF_PROP_LIMIT)
-			goto out;
-		*maxcount += sh.sh_properties;
-		inp = CAST(cdf_property_info_t *,
-		    realloc(*info, *maxcount * sizeof(*inp)));
-	} else {
-		*maxcount = sh.sh_properties;
-		inp = CAST(cdf_property_info_t *,
-		    malloc(*maxcount * sizeof(*inp)));
-	}
+	if (sh.sh_properties > CDF_PROP_LIMIT)
+		goto out;
+	inp = cdf_grow_info(info, maxcount, sh.sh_properties);
 	if (inp == NULL)
-		goto out1;
-	*info = inp;
+		goto out;
 	inp += *count;
 	*count += sh.sh_properties;
-	p = CAST(const uint8_t *, (const void *)
-	    ((const char *)(const void *)sst->sst_tab +
-	    offs + sizeof(sh)));
-	e = CAST(const uint8_t *, (const void *)
-	    (((const char *)(const void *)shp) + sh.sh_len));
-	if (cdf_check_stream_offset(sst, h, e, 0, __LINE__) == -1)
+	p = CAST(const uint8_t *, cdf_offset(sst->sst_tab, offs + sizeof(sh)));
+	e = CAST(const uint8_t *, cdf_offset(shp, sh.sh_len));
+	if (p >= e || cdf_check_stream_offset(sst, h, e, 0, __LINE__) == -1)
 		goto out;
+
 	for (i = 0; i < sh.sh_properties; i++) {
-		size_t tail = (i << 1) + 1;
-		size_t ofs;
-		if (cdf_check_stream_offset(sst, h, p, tail * sizeof(uint32_t),
-		    __LINE__) == -1)
+		if ((q = cdf_get_property_info_pos(sst, h, p, e, i)) == NULL)
 			goto out;
-		ofs = CDF_GETUINT32(p, tail);
-		q = (const uint8_t *)(const void *)
-		    ((const char *)(const void *)p + ofs
-		    - 2 * sizeof(uint32_t));
-		if (q < p) {
-			DPRINTF(("Wrapped around %p < %p\n", q, p));
-			goto out;
-		}
-		if (q > e) {
-			DPRINTF(("Ran of the end %p > %p\n", q, e));
-			goto out;
-		}
 		inp[i].pi_id = CDF_GETUINT32(p, i << 1);
+		left = CAST(size_t, e - q);
+		if (left < sizeof(uint32_t)) {
+			DPRINTF(("short info (no type)_\n"));
+			goto out;
+		}
 		inp[i].pi_type = CDF_GETUINT32(q, 0);
-		DPRINTF(("%" SIZE_T_FORMAT "u) id=%x type=%x offs=0x%tx,0x%x\n",
+		DPRINTF(("%" SIZE_T_FORMAT "u) id=%#x type=%#x offs=%#tx,%#x\n",
 		    i, inp[i].pi_id, inp[i].pi_type, q - p, offs));
 		if (inp[i].pi_type & CDF_VECTOR) {
+			if (left < sizeof(uint32_t) * 2) {
+				DPRINTF(("missing CDF_VECTOR length\n"));
+				goto out;
+			}
 			nelements = CDF_GETUINT32(q, 1);
 			if (nelements == 0) {
 				DPRINTF(("CDF_VECTOR with nelements == 0\n"));
 				goto out;
 			}
-			o = 2;
+			slen = 2;
 		} else {
 			nelements = 1;
-			o = 1;
+			slen = 1;
 		}
-		o4 = o * sizeof(uint32_t);
+		o4 = slen * sizeof(uint32_t);
 		if (inp[i].pi_type & (CDF_ARRAY|CDF_BYREF|CDF_RESERVED))
 			goto unknown;
 		switch (inp[i].pi_type & CDF_TYPEMASK) {
@@ -929,109 +1028,83 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 		case CDF_EMPTY:
 			break;
 		case CDF_SIGNED16:
-			if (inp[i].pi_type & CDF_VECTOR)
+			if (!cdf_copy_info(&inp[i], &q[o4], e, sizeof(int16_t)))
 				goto unknown;
-			(void)memcpy(&s16, &q[o4], sizeof(s16));
-			inp[i].pi_s16 = CDF_TOLE2(s16);
 			break;
 		case CDF_SIGNED32:
-			if (inp[i].pi_type & CDF_VECTOR)
-				goto unknown;
-			(void)memcpy(&s32, &q[o4], sizeof(s32));
-			inp[i].pi_s32 = CDF_TOLE4((uint32_t)s32);
-			break;
 		case CDF_BOOL:
 		case CDF_UNSIGNED32:
-			if (inp[i].pi_type & CDF_VECTOR)
+		case CDF_FLOAT:
+			if (!cdf_copy_info(&inp[i], &q[o4], e, sizeof(int32_t)))
 				goto unknown;
-			(void)memcpy(&u32, &q[o4], sizeof(u32));
-			inp[i].pi_u32 = CDF_TOLE4(u32);
 			break;
 		case CDF_SIGNED64:
-			if (inp[i].pi_type & CDF_VECTOR)
-				goto unknown;
-			(void)memcpy(&s64, &q[o4], sizeof(s64));
-			inp[i].pi_s64 = CDF_TOLE8((uint64_t)s64);
-			break;
 		case CDF_UNSIGNED64:
-			if (inp[i].pi_type & CDF_VECTOR)
-				goto unknown;
-			(void)memcpy(&u64, &q[o4], sizeof(u64));
-			inp[i].pi_u64 = CDF_TOLE8((uint64_t)u64);
-			break;
-		case CDF_FLOAT:
-			if (inp[i].pi_type & CDF_VECTOR)
-				goto unknown;
-			(void)memcpy(&u32, &q[o4], sizeof(u32));
-			u32 = CDF_TOLE4(u32);
-			memcpy(&inp[i].pi_f, &u32, sizeof(inp[i].pi_f));
-			break;
 		case CDF_DOUBLE:
-			if (inp[i].pi_type & CDF_VECTOR)
+		case CDF_FILETIME:
+			if (!cdf_copy_info(&inp[i], &q[o4], e, sizeof(int64_t)))
 				goto unknown;
-			(void)memcpy(&u64, &q[o4], sizeof(u64));
-			u64 = CDF_TOLE8((uint64_t)u64);
-			memcpy(&inp[i].pi_d, &u64, sizeof(inp[i].pi_d));
 			break;
 		case CDF_LENGTH32_STRING:
 		case CDF_LENGTH32_WSTRING:
 			if (nelements > 1) {
 				size_t nelem = inp - *info;
-				if (*maxcount > CDF_PROP_LIMIT
-				    || nelements > CDF_PROP_LIMIT)
-					goto out;
-				*maxcount += nelements;
-				inp = CAST(cdf_property_info_t *,
-				    realloc(*info, *maxcount * sizeof(*inp)));
+				inp = cdf_grow_info(info, maxcount, nelements);
 				if (inp == NULL)
-					goto out1;
-				*info = inp;
-				inp = *info + nelem;
+					goto out;
+				inp += nelem;
 			}
 			DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n",
 			    nelements));
 			for (j = 0; j < nelements && i < sh.sh_properties;
 			    j++, i++)
 			{
-				uint32_t l = CDF_GETUINT32(q, o);
+				uint32_t l;
+
+				if (o4 + sizeof(uint32_t) > left)
+					goto out;
+
+				l = CDF_GETUINT32(q, slen);
+				o4 += sizeof(uint32_t);
+				if (o4 + l > left)
+					goto out;
+
 				inp[i].pi_str.s_len = l;
-				inp[i].pi_str.s_buf = (const char *)
-				    (const void *)(&q[o4 + sizeof(l)]);
-				DPRINTF(("l = %d, r = %" SIZE_T_FORMAT
-				    "u, s = %s\n", l,
-				    CDF_ROUND(l, sizeof(l)),
+				inp[i].pi_str.s_buf = CAST(const char *,
+				    CAST(const void *, &q[o4]));
+
+				DPRINTF(("o=%zu l=%d(%" SIZE_T_FORMAT
+				    "u), t=%zu s=%s\n", o4, l,
+				    CDF_ROUND(l, sizeof(l)), left,
 				    inp[i].pi_str.s_buf));
+
 				if (l & 1)
 					l++;
-				o += l >> 1;
-				if (q + o >= e)
-					goto out;
-				o4 = o * sizeof(uint32_t);
+
+				slen += l >> 1;
+				o4 = slen * sizeof(uint32_t);
 			}
 			i--;
 			break;
-		case CDF_FILETIME:
-			if (inp[i].pi_type & CDF_VECTOR)
-				goto unknown;
-			(void)memcpy(&tp, &q[o4], sizeof(tp));
-			inp[i].pi_tp = CDF_TOLE8((uint64_t)tp);
-			break;
 		case CDF_CLIPBOARD:
 			if (inp[i].pi_type & CDF_VECTOR)
 				goto unknown;
 			break;
 		default:
 		unknown:
-			DPRINTF(("Don't know how to deal with %x\n",
+			memset(&inp[i].pi_val, 0, sizeof(inp[i].pi_val));
+			DPRINTF(("Don't know how to deal with %#x\n",
 			    inp[i].pi_type));
 			break;
 		}
 	}
 	return 0;
 out:
-	errno = EFTYPE;
-out1:
 	free(*info);
+	*info = NULL;
+	*count = 0;
+	*maxcount = 0;
+	errno = EFTYPE;
 	return -1;
 }
 
@@ -1079,7 +1152,7 @@ cdf_unpack_catalog(const cdf_header_t *h, const cdf_stream_t *sst,
 {
 	size_t ss = cdf_check_stream(sst, h);
 	const char *b = CAST(const char *, sst->sst_tab);
-	const char *eb = b + ss * sst->sst_len;
+	const char *nb, *eb = b + ss * sst->sst_len;
 	size_t nr, i, j, k;
 	cdf_catalog_entry_t *ce;
 	uint16_t reclen;
@@ -1098,7 +1171,7 @@ cdf_unpack_catalog(const cdf_header_t *h, const cdf_stream_t *sst,
 		return -1;
 	nr--;
 	*cat = CAST(cdf_catalog_t *,
-	    malloc(sizeof(cdf_catalog_t) + nr * sizeof(*ce)));
+	    CDF_MALLOC(sizeof(cdf_catalog_t) + nr * sizeof(*ce)));
 	if (*cat == NULL)
 		return -1;
 	ce = (*cat)->cat_e;
@@ -1124,7 +1197,9 @@ cdf_unpack_catalog(const cdf_header_t *h, const cdf_stream_t *sst,
 			cep->ce_namlen = rlen;
 
 		np = CAST(const uint16_t *, CAST(const void *, (b + 16)));
-		if (RCAST(const char *, np + cep->ce_namlen) > eb) {
+		nb = CAST(const char *, CAST(const void *,
+		    (np + cep->ce_namlen)));
+		if (nb > eb) {
 			cep->ce_namlen = 0;
 			break;
 		}
@@ -1183,7 +1258,7 @@ cdf_print_property_name(char *buf, size_t bufsiz, uint32_t p)
 	for (i = 0; i < __arraycount(vn); i++)
 		if (vn[i].v == p)
 			return snprintf(buf, bufsiz, "%s", vn[i].n);
-	return snprintf(buf, bufsiz, "0x%x", p);
+	return snprintf(buf, bufsiz, "%#x", p);
 }
 
 int
@@ -1242,7 +1317,7 @@ cdf_dump_header(const cdf_header_t *h)
     h->h_ ## b, 1 << h->h_ ## b)
 	DUMP("%d", revision);
 	DUMP("%d", version);
-	DUMP("0x%x", byte_order);
+	DUMP("%#x", byte_order);
 	DUMP2("%d", sec_size_p2);
 	DUMP2("%d", short_sec_size_p2);
 	DUMP("%d", num_sectors_in_sat);
@@ -1336,7 +1411,7 @@ cdf_dump_dir(const cdf_info_t *info, const cdf_header_t *h,
 		    d->d_color ? "black" : "red");
 		(void)fprintf(stderr, "Left child: %d\n", d->d_left_child);
 		(void)fprintf(stderr, "Right child: %d\n", d->d_right_child);
-		(void)fprintf(stderr, "Flags: 0x%x\n", d->d_flags);
+		(void)fprintf(stderr, "Flags: %#x\n", d->d_flags);
 		cdf_timestamp_to_timespec(&ts, d->d_created);
 		(void)fprintf(stderr, "Created %s", cdf_ctime(&ts.tv_sec, buf));
 		cdf_timestamp_to_timespec(&ts, d->d_modified);
@@ -1429,7 +1504,7 @@ cdf_dump_property_info(const cdf_property_info_t *info, size_t count)
 			(void)fprintf(stderr, "CLIPBOARD %u\n", info[i].pi_u32);
 			break;
 		default:
-			DPRINTF(("Don't know how to deal with %x\n",
+			DPRINTF(("Don't know how to deal with %#x\n",
 			    info[i].pi_type));
 			break;
 		}
@@ -1448,7 +1523,7 @@ cdf_dump_summary_info(const cdf_header_t *h, const cdf_stream_t *sst)
 	(void)&h;
 	if (cdf_unpack_summary_info(sst, h, &ssi, &info, &count) == -1)
 		return;
-	(void)fprintf(stderr, "Endian: %x\n", ssi.si_byte_order);
+	(void)fprintf(stderr, "Endian: %#x\n", ssi.si_byte_order);
 	(void)fprintf(stderr, "Os Version %d.%d\n", ssi.si_os_version & 0xff,
 	    ssi.si_os_version >> 8);
 	(void)fprintf(stderr, "Os %d\n", ssi.si_os);

ext/fileinfo/libmagic/cdf.h

@@ -129,9 +129,9 @@ typedef struct {
 
 typedef struct {
 	void *sst_tab;
-	size_t sst_len;
-	size_t sst_dirlen;
-	size_t sst_ss;
+	size_t sst_len;		/* Number of sectors */
+	size_t sst_dirlen;	/* Directory sector size */
+	size_t sst_ss;		/* Sector size */
 } cdf_stream_t;
 
 typedef struct {

ext/fileinfo/libmagic/cdf_time.c

@@ -27,7 +27,7 @@
 #include "file.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$File: cdf_time.c,v 1.15 2014/05/14 23:15:42 christos Exp $")
+FILE_RCSID("@(#)$File: cdf_time.c,v 1.16 2017/03/29 15:57:48 christos Exp $")
 #endif
 
 #include <time.h>
@@ -172,7 +172,7 @@ cdf_ctime(const time_t *sec, char *buf)
 	char *ptr = ctime_r(sec, buf);
 	if (ptr != NULL)
 		return buf;
-	(void)snprintf(buf, 26, "*Bad* 0x%16.16" INT64_T_FORMAT "x\n",
+	(void)snprintf(buf, 26, "*Bad* %#16.16" INT64_T_FORMAT "x\n",
 	    (long long)*sec);
 	return buf;
 }

ext/fileinfo/libmagic/compress.c

@@ -35,7 +35,7 @@
 #include "file.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$File: compress.c,v 1.100 2016/10/24 18:02:17 christos Exp $")
+FILE_RCSID("@(#)$File: compress.c,v 1.104 2017/03/29 15:57:48 christos Exp $")
 #endif
 
 #include "magic.h"
@@ -458,7 +458,7 @@ uncompresszlib(const unsigned char *old, unsigned char **newch,
 	z.next_in = CCAST(Bytef *, old);
 	z.avail_in = CAST(uint32_t, *n);
 	z.next_out = *newch;
-	z.avail_out = bytes_max;
+	z.avail_out = CAST(unsigned int, bytes_max);
 	z.zalloc = Z_NULL;
 	z.zfree = Z_NULL;
 	z.opaque = Z_NULL;
@@ -593,7 +593,7 @@ filter_error(unsigned char *ubuf, ssize_t n)
 		while (isspace((unsigned char)*p))
 			p++;
 		n = strlen(p);
-		memmove(ubuf, p, n + 1);
+		memmove(ubuf, p, CAST(size_t, n + 1));
 	}
 	DPRINTF("Filter error after[[[%s]]]\n", (char *)ubuf);
 	if (islower(*ubuf))
@@ -649,7 +649,7 @@ uncompressbuf(int fd, size_t bytes_max, size_t method, const unsigned char *old,
 		}
 		
 		for (i = 0; i < __arraycount(fdp); i++)
-			copydesc(i, fdp[i]);
+			copydesc(CAST(int, i), fdp[i]);
 
 		(void)execvp(compr[method].argv[0],
 		    (char *const *)(intptr_t)compr[method].argv);

ext/fileinfo/libmagic/der.c

@@ -35,7 +35,7 @@
 #include "file.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$File: der.c,v 1.10 2016/10/24 18:02:17 christos Exp $")
+FILE_RCSID("@(#)$File: der.c,v 1.12 2017/02/10 18:14:01 christos Exp $")
 #endif
 #endif
 
@@ -161,31 +161,49 @@ gettag(const uint8_t *c, size_t *p, size_t l)
 	return tag;
 }
 
+/*
+ * Read the length of a DER tag from the input.
+ *
+ * `c` is the input, `p` is an output parameter that specifies how much of the
+ * input we consumed, and `l` is the maximum input length.
+ *
+ * Returns the length, or DER_BAD if the end of the input is reached or the
+ * length exceeds the remaining input.
+ */
 static uint32_t
 getlength(const uint8_t *c, size_t *p, size_t l)
 {
 	uint8_t digits, i;
 	size_t len;
+	int is_onebyte_result;
 
 	if (*p >= l)
 		return DER_BAD;
 
-	digits = c[(*p)++];
-
-        if ((digits & 0x80) == 0)
-		return digits;
-
-        digits &= 0x7f;
-	len = 0;
-
+	/*
+	 * Digits can either be 0b0 followed by the result, or 0b1
+	 * followed by the number of digits of the result. In either case,
+	 * we verify that we can read so many bytes from the input.
+	 */
+	is_onebyte_result = (c[*p] & 0x80) == 0;
+	digits = c[(*p)++] & 0x7f;
 	if (*p + digits >= l)
 		return DER_BAD;
 
+	if (is_onebyte_result)
+		return digits;
+
+	/*
+	 * Decode len. We've already verified that we're allowed to read
+	 * `digits` bytes.
+	 */
+	len = 0;
 	for (i = 0; i < digits; i++)
 		len = (len << 8) | c[(*p)++];
+
 	if (*p + len >= l)
 		return DER_BAD;
-        return len;
+	return CAST(uint32_t, len);
 }
 
 static const char *
@@ -245,12 +263,12 @@ der_offs(struct magic_set *ms, struct magic *m, size_t nbytes)
 #endif
 	if (m->cont_level != 0) {
 		if (offs + tlen > nbytes)
-			return DER_BAD;
-		ms->c.li[m->cont_level - 1].off = offs + tlen;
+			return -1;
+		ms->c.li[m->cont_level - 1].off = CAST(int, offs + tlen);
 		DPRINTF(("cont_level[%u] = %u\n", m->cont_level - 1,
 		    ms->c.li[m->cont_level - 1].off));
 	}
-	return offs;
+	return CAST(int32_t, offs);
 }
 
 int

ext/fileinfo/libmagic/file.h

@@ -27,7 +27,7 @@
  */
 /*
  * file.h - definitions for file(1) program
- * @(#)$File: file.h,v 1.180 2016/07/20 11:27:08 christos Exp $
+ * @(#)$File: file.h,v 1.182 2017/04/07 19:46:44 christos Exp $
  */
 
 #ifndef __file_h__
@@ -553,7 +553,11 @@ static const char *rcsid(const char *p) { \
 #endif
 
 #ifdef PHP_WIN32
+#ifdef _WIN64
+#define FINFO_LSEEK_FUNC _lseeki64
+#else
 #define FINFO_LSEEK_FUNC _lseek
+#endif
 #define FINFO_READ_FUNC _read
 #else
 #define FINFO_LSEEK_FUNC lseek

ext/fileinfo/libmagic/funcs.c

@@ -27,7 +27,7 @@
 #include "file.h"
 
 #ifndef	lint
-FILE_RCSID("@(#)$File: funcs.c,v 1.90 2016/10/19 20:51:17 christos Exp $")
+FILE_RCSID("@(#)$File: funcs.c,v 1.92 2017/04/07 20:10:24 christos Exp $")
 #endif	/* lint */
 
 #include "magic.h"
@@ -61,7 +61,6 @@ extern public void convert_libmagic_pattern(zval *pattern, char *val, int len, i
 protected int
 file_printf(struct magic_set *ms, const char *fmt, ...)
 {
-	int rv;
 	va_list ap;
 	int len;
 	char *buf = NULL, *newstr;

ext/fileinfo/libmagic/is_tar.c

@@ -40,7 +40,7 @@
 #include "file.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$File: is_tar.c,v 1.38 2015/04/09 20:01:41 christos Exp $")
+FILE_RCSID("@(#)$File: is_tar.c,v 1.39 2017/03/17 20:45:01 christos Exp $")
 #endif
 
 #include "magic.h"
@@ -51,7 +51,7 @@ FILE_RCSID("@(#)$File: is_tar.c,v 1.38 2015/04/09 20:01:41 christos Exp $")
 #define	isodigit(c)	( ((c) >= '0') && ((c) <= '7') )
 
 private int is_tar(const unsigned char *, size_t);
-private int from_oct(int, const char *);	/* Decode octal number */
+private int from_oct(const char *, size_t);	/* Decode octal number */
 
 static const char tartype[][32] = {
 	"tar archive",
@@ -93,31 +93,35 @@ private int
 is_tar(const unsigned char *buf, size_t nbytes)
 {
 	const union record *header = (const union record *)(const void *)buf;
-	int	i;
-	int	sum, recsum;
-	const unsigned char	*p;
+	size_t i;
+	int sum, recsum;
+	const unsigned char *p, *ep;
 
-	if (nbytes < sizeof(union record))
+	if (nbytes < sizeof(*header))
 		return 0;
 
-	recsum = from_oct(8,  header->header.chksum);
+	recsum = from_oct(header->header.chksum, sizeof(header->header.chksum));
 
 	sum = 0;
 	p = header->charptr;
-	for (i = sizeof(union record); --i >= 0;)
+	ep = header->charptr + sizeof(*header);
+	while (p < ep)
 		sum += *p++;
 
 	/* Adjust checksum to count the "chksum" field as blanks. */
-	for (i = sizeof(header->header.chksum); --i >= 0;)
+	for (i = 0; i < sizeof(header->header.chksum); i++)
 		sum -= header->header.chksum[i];
-	sum += ' ' * sizeof header->header.chksum;
+	sum += ' ' * sizeof(header->header.chksum);
 
 	if (sum != recsum)
 		return 0;	/* Not a tar archive */
 
-	if (strcmp(header->header.magic, GNUTMAGIC) == 0)
+	if (strncmp(header->header.magic, GNUTMAGIC,
+	    sizeof(header->header.magic)) == 0)
 		return 3;		/* GNU Unix Standard tar archive */
-	if (strcmp(header->header.magic, TMAGIC) == 0)
+
+	if (strncmp(header->header.magic, TMAGIC,
+	    sizeof(header->header.magic)) == 0)
 		return 2;		/* Unix Standard tar archive */
 
 	return 1;			/* Old fashioned tar archive */
@@ -130,19 +134,22 @@ is_tar(const unsigned char *buf, size_t nbytes)
  * Result is -1 if the field is invalid (all blank, or non-octal).
  */
 private int
-from_oct(int digs, const char *where)
+from_oct(const char *where, size_t digs)
 {
 	int	value;
 
+	if (digs == 0)
+		return -1;
+
 	while (isspace((unsigned char)*where)) {	/* Skip spaces */
 		where++;
-		if (--digs <= 0)
+		if (digs-- == 0)
 			return -1;		/* All blank field */
 	}
 	value = 0;
 	while (digs > 0 && isodigit(*where)) {	/* Scan til non-octal */
 		value = (value << 3) | (*where++ - '0');
-		--digs;
+		digs--;
 	}
 
 	if (digs > 0 && *where && !isspace((unsigned char)*where))

ext/fileinfo/libmagic/magic.c

@@ -40,11 +40,7 @@ FILE_RCSID("@(#)$File: magic.c,v 1.100 2016/07/18 11:43:05 christos Exp $")
 #include <unistd.h>
 #endif
 #include <string.h>
-#ifdef PHP_WIN32
-# include "config.w32.h"
-#else
-# include "php_config.h"
-#endif
+#include "config.h"
 
 #ifdef PHP_WIN32
 #include <shlwapi.h>

ext/fileinfo/libmagic/magic.h

@@ -80,7 +80,7 @@
 #define	MAGIC_NO_CHECK_FORTRAN	0x000000 /* Don't check ascii/fortran */
 #define	MAGIC_NO_CHECK_TROFF	0x000000 /* Don't check ascii/troff */
 
-#define MAGIC_VERSION		529	/* This implementation */
+#define MAGIC_VERSION		531	/* This implementation */
 
 
 #ifdef __cplusplus

ext/fileinfo/libmagic/patchlevel.h

@@ -1,11 +1,15 @@
 #define	FILE_VERSION_MAJOR	5
-#define	patchlevel		29
+#define	patchlevel		31
 
 /*
  * Patchlevel file for Ian Darwin's MAGIC command.
  * $File: patchlevel.h,v 1.68 2008/03/22 21:39:43 christos Exp $
  *
  * $Log$
+ * Revision 2.0  2017/10/11 22:27:12 ab
+ * Update libmagic to 5.31
+ *
+ * $Log$
  * Revision 1.9  2016/11/24 22:27:12 ab
  * Update libmagic to 5.29
  *

ext/fileinfo/libmagic/print.c

@@ -34,7 +34,7 @@
 #include "file.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$File: print.c,v 1.81 2016/01/19 15:09:03 christos Exp $")
+FILE_RCSID("@(#)$File: print.c,v 1.82 2017/02/10 18:14:01 christos Exp $")
 #endif  /* lint */
 
 #include <string.h>

ext/fileinfo/libmagic/readcdf.c

@@ -26,7 +26,7 @@
 #include "file.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$File: readcdf.c,v 1.63 2016/10/18 22:25:42 christos Exp $")
+FILE_RCSID("@(#)$File: readcdf.c,v 1.65 2017/04/08 20:58:03 christos Exp $")
 #endif
 
 #include <assert.h>
@@ -140,7 +140,7 @@ cdf_file_property_info(struct magic_set *ms, const cdf_property_info_t *info,
         struct timeval ts;
         char buf[64];
         const char *str = NULL;
-        const char *s;
+        const char *s, *e;
         int len;
 
 	memset(&ts, 0, sizeof(ts));
@@ -189,7 +189,9 @@ cdf_file_property_info(struct magic_set *ms, const cdf_property_info_t *info,
                                 if (info[i].pi_type == CDF_LENGTH32_WSTRING)
                                     k++;
                                 s = info[i].pi_str.s_buf;
-                                for (j = 0; j < sizeof(vbuf) && len--; s += k) {
+				e = info[i].pi_str.s_buf + len;
+                                for (j = 0; s < e && j < sizeof(vbuf)
+				    && len--; s += k) {
                                         if (*s == '\0')
                                                 break;
                                         if (isprint((unsigned char)*s))
@@ -596,7 +598,7 @@ file_trycdf(struct magic_set *ms, int fd, const unsigned char *buf,
 	if ((i = cdf_read_user_stream(&info, &h, &sat, &ssat, &sst, &dir,
 	    "FileHeader", &scn)) != -1) {
 #define HWP5_SIGNATURE "HWP Document File"
-		if (scn.sst_dirlen >= sizeof(HWP5_SIGNATURE) - 1
+		if (scn.sst_len * scn.sst_ss >= sizeof(HWP5_SIGNATURE) - 1
 		    && memcmp(scn.sst_tab, HWP5_SIGNATURE,
 		    sizeof(HWP5_SIGNATURE) - 1) == 0) {
 		    if (NOTMIME(ms)) {

ext/fileinfo/libmagic/softmagic.c

@@ -32,7 +32,7 @@
 #include "file.h"
 
 #ifndef	lint
-FILE_RCSID("@(#)$File: softmagic.c,v 1.238 2016/10/24 18:02:17 christos Exp $")
+FILE_RCSID("@(#)$File: softmagic.c,v 1.248 2017/04/21 16:54:57 christos Exp $")
 #endif	/* lint */
 
 #include "magic.h"
@@ -198,6 +198,7 @@ flush:
 			while (magindex < nmagic - 1 &&
 			    magic[magindex + 1].cont_level != 0)
 				magindex++;
+			cont_level = 0;
 			continue; /* Skip to next top-level test*/
 		}
 
@@ -376,6 +377,7 @@ flush:
 				case -1:
 				case 0:
 					flush = 1;
+					cont_level--;
 					break;
 				default:
 					break;
@@ -1015,9 +1017,8 @@ private int
 mconvert(struct magic_set *ms, struct magic *m, int flip)
 {
 	union VALUETYPE *p = &ms->ms_value;
-	uint8_t type;
 
-	switch (type = cvt_flip(m->type, flip)) {
+	switch (cvt_flip(m->type, flip)) {
 	case FILE_BYTE:
 		if (cvt_8(p, m) == -1)
 			goto out;
@@ -1182,7 +1183,7 @@ mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
 		case FILE_DER:
 		case FILE_SEARCH:
 			if (offset > nbytes)
-				offset = nbytes;
+				offset = CAST(uint32_t, nbytes);
 			ms->search.s = RCAST(const char *, s) + offset;
 			ms->search.s_len = nbytes - offset;
 			ms->search.offset = offset;
@@ -1265,7 +1266,8 @@ mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
 				if (*dst == '\0') {
 					if (type == FILE_BESTRING16 ?
 					    *(src - 1) != '\0' :
-					    *(src + 1) != '\0')
+					    ((src + 1 < esrc) &&
+					    *(src + 1) != '\0'))
 						*dst = ' ';
 				}
 			}
@@ -1370,7 +1372,7 @@ mget(struct magic_set *ms, const unsigned char *s, struct magic *m,
 		return -1;
 
 	if ((ms->flags & MAGIC_DEBUG) != 0) {
-		fprintf(stderr, "mget(type=%d, flag=%x, offset=%u, o=%"
+		fprintf(stderr, "mget(type=%d, flag=%#x, offset=%u, o=%"
 		    SIZE_T_FORMAT "u, " "nbytes=%" SIZE_T_FORMAT
 		    "u, il=%hu, nc=%hu)\n",
 		    m->type, m->flag, offset, o, nbytes,
@@ -1631,6 +1633,7 @@ file_strncmp(const char *s1, const char *s2, size_t len, uint32_t flags)
 	 */
 	const unsigned char *a = (const unsigned char *)s1;
 	const unsigned char *b = (const unsigned char *)s2;
+	const unsigned char *eb = b + len;
 	uint64_t v;
 
 	/*
@@ -1645,6 +1648,10 @@ file_strncmp(const char *s1, const char *s2, size_t len, uint32_t flags)
 	}
 	else { /* combine the others */
 		while (len-- > 0) {
+			if (b >= eb) {
+				v = 1;
+				break;
+			}
 			if ((flags & STRING_IGNORE_LOWERCASE) &&
 			    islower(*a)) {
 				if ((v = tolower(*b++) - *a++) != '\0')
@@ -1659,14 +1666,9 @@ file_strncmp(const char *s1, const char *s2, size_t len, uint32_t flags)
 			    isspace(*a)) {
 				a++;
 				if (isspace(*b++)) {
-					if (!isspace(*a)) {
-						/* Limit to the remaining len only, otherwise
-							we risk to cause CVE-2014-3538. This
-							might be done better though, not sure. */
-						size_t remaining_len = len;
-						while (isspace(*b) && remaining_len-- > 0)
+					if (!isspace(*a))
+						while (b < eb && isspace(*b))
 							b++;
-					}
 				}
 				else {
 					v = 1;
@@ -1675,10 +1677,8 @@ file_strncmp(const char *s1, const char *s2, size_t len, uint32_t flags)
 			}
 			else if ((flags & STRING_COMPACT_OPTIONAL_WHITESPACE) &&
 			    isspace(*a)) {
-				/* Same as the comment in the previous elif clause. */
-				size_t remaining_len = len;
 				a++;
-				while (isspace(*b)&& remaining_len-- > 0)
+				while (b < eb && isspace(*b))
 					b++;
 			}
 			else {
@@ -1884,13 +1884,13 @@ magiccheck(struct magic_set *ms, struct magic *m)
 
 		for (idx = 0; m->str_range == 0 || idx < m->str_range; idx++) {
 			if (slen + idx > ms->search.s_len)
-				break;
+				return 0;
 
 			v = file_strncmp(m->value.s, ms->search.s + idx, slen,
 			    m->str_flags);
 			if (v == 0) {	/* found match */
 				ms->search.offset += idx;
-				ms->search.rm_len = m->str_range - idx;
+				ms->search.rm_len = ms->search.s_len - idx;
 				break;
 			}
 		}

ext/fileinfo/magicdata.patch

@@ -1,9 +1,6 @@
-Patches applied to file 5.17 sources tree before generating magic.mgc
-and before running create_data_file.php to create data_file.c.
-
-diff -u magic/Magdir.orig.0/cafebabe magic/Magdir/cafebabe
---- magic/Magdir.orig.0/cafebabe	2015-10-16 00:54:18.000000000 +0000
-+++ magic/Magdir/cafebabe	2016-11-24 15:59:25.553060242 +0000
+diff -u file-5.31.orig/magic/Magdir/cafebabe file-5.31/magic/Magdir/cafebabe
+--- file-5.31.orig/magic/Magdir/cafebabe	2017-03-17 21:35:28.000000000 +0000
++++ file-5.31/magic/Magdir/cafebabe	2017-10-11 14:30:57.476077825 +0000
 @@ -15,22 +15,6 @@
  # might add another one or two as time goes by...
  #
@@ -60,29 +57,41 @@ diff -u magic/Magdir.orig.0/cafebabe magic/Magdir/cafebabe
  >>>48	use		mach-o		\b
  >>4	belong		4
  >>>68	use		mach-o		\b
-diff -u magic/Magdir.orig.0/commands magic/Magdir/commands
---- magic/Magdir.orig.0/commands	2016-07-14 19:01:12.000000000 +0000
-+++ magic/Magdir/commands	2016-11-24 15:59:25.557060441 +0000
+diff -u file-5.31.orig/magic/Magdir/commands file-5.31/magic/Magdir/commands
+--- file-5.31.orig/magic/Magdir/commands	2017-04-04 20:34:24.000000000 +0000
++++ file-5.31/magic/Magdir/commands	2017-10-11 14:29:57.653552987 +0000
 @@ -56,7 +56,7 @@
  !:mime	text/x-awk
  0	string/wt	#!\ /usr/bin/awk	awk script text executable
  !:mime	text/x-awk
--0	regex/4096	=^\\s{0,100}BEGIN\\s{0,100}[{]	awk or perl script text
-+0	regex/4096	=^\\s{0,100}BEGIN\\s{0,100}[{]	awk script text
+-0	regex/4096	=^[A-Za-z0-9_]{0,100}BEGIN[A-Za-z0-9_]{0,100}[{]	awk or perl script text
++0	regex/4096	=^[\040\t\f\r\n]{0,100}BEGIN[\040\t\f\r\n]{0,100}[{]	awk or perl script text
  
  # AT&T Bell Labs' Plan 9 shell
  0	string/wt	#!\ /bin/rc	Plan 9 rc shell script text executable
-diff -u magic/Magdir.orig.0/filesystems magic/Magdir/filesystems
---- magic/Magdir.orig.0/filesystems	2016-09-05 08:34:25.000000000 +0000
-+++ magic/Magdir/filesystems	2016-11-24 15:59:25.553060242 +0000
+diff -u file-5.31.orig/magic/Magdir/dump file-5.31/magic/Magdir/dump
+--- file-5.31.orig/magic/Magdir/dump	2017-03-17 21:35:28.000000000 +0000
++++ file-5.31/magic/Magdir/dump	2017-10-11 14:30:09.622057792 +0000
+@@ -69,6 +69,8 @@
+ >0	use	old-dump-be
+ 
+ 24	lelong	60012		new-fs dump file (little endian),
++# to correctly recognize '*.mo' GNU message catalog (little endian)
++!:strength - 15
+ >0	use	\^new-dump-be
+ 
+ 24	lelong	60011		old-fs dump file (little endian),
+diff -u file-5.31.orig/magic/Magdir/filesystems file-5.31/magic/Magdir/filesystems
+--- file-5.31.orig/magic/Magdir/filesystems	2017-03-24 19:29:26.000000000 +0000
++++ file-5.31/magic/Magdir/filesystems	2017-10-11 14:30:57.476077825 +0000
 @@ -254,7 +254,7 @@
- 30		search/481	\x55\xAA	
+ 30		search/481	\x55\xAA
  # to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111)
  # DOS BPB information (70) and after DOS floppy (120) like in previous file version
 -!:strength +65
 +!:strength +0
  # for sector sizes < 512 Bytes
- >11		uleshort	<512		
+ >11		uleshort	<512
  >>(11.s-2)	uleshort	0xAA55		DOS/MBR boot sector
 @@ -266,7 +266,7 @@
  0x1FE          leshort         0xAA55         	DOS/MBR boot sector
@@ -93,191 +102,74 @@ diff -u magic/Magdir.orig.0/filesystems magic/Magdir/filesystems
  >2		string		OSBS		OS/BS MBR
  # added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/
  # and http://en.wikipedia.org/wiki/Master_Boot_Record
-diff -u magic/Magdir.orig.0/msdos magic/Magdir/msdos
---- magic/Magdir.orig.0/msdos	2016-09-14 01:26:26.000000000 +0000
-+++ magic/Magdir/msdos	2016-11-24 15:58:56.327609010 +0000
-@@ -404,7 +404,7 @@
- # GRR: line below too general as it catches also 
- # rt.lib DYADISKS.PIC and many more
- # start with assembler instruction MOV
--0	ubyte		0x8c		
-+#0	ubyte		0x8c		
- # skip "AppleWorks word processor data" like ARTICLE.1 ./apple
- >4	string			!O====	
- # skip some unknown basic binaries like RocketRnger.SHR
-@@ -428,17 +428,17 @@
- # updated by Joerg Jenderek at Oct 2008
- 0	ulelong		0xffff10eb	DR-DOS executable (COM)
- # byte 0xeb conflicts with "sequent" magic leshort 0xn2eb
--0	ubeshort&0xeb8d	>0xeb00		
-+#0	ubeshort&0xeb8d	>0xeb00		
- # DR-DOS STACKER.COM SCREATE.SYS missed
+Only in file-5.31/magic/Magdir/: gconv
+diff -u file-5.31.orig/magic/Magdir/images file-5.31/magic/Magdir/images
+--- file-5.31.orig/magic/Magdir/images	2017-04-04 20:34:24.000000000 +0000
++++ file-5.31/magic/Magdir/images	2017-10-11 14:29:57.653552987 +0000
+@@ -175,42 +175,42 @@
+ >>>&0	regex		=[0-9]{1,50}			\b %s
  
- 0       name    msdos-com
- >0  byte        x               DOS executable (COM)
- >6	string		SFX\ of\ LHarc	\b, %s
-->0x1FE leshort	0xAA55		    \b, boot code
-->85	string		UPX		        \b, UPX compressed
-->4	string		\ $ARX		    \b, ARX self-extracting archive
-->4	string		\ $LHarc	    \b, LHarc self-extracting archive
-->0x20e string	SFX\ by\ LARC	\b, LARC self-extracting archive
-+#>0x1FE leshort	0xAA55		    \b, boot code
-+#>85	string		UPX		        \b, UPX compressed
-+#>4	string		\ $ARX		    \b, ARX self-extracting archive
-+#>4	string		\ $LHarc	    \b, LHarc self-extracting archive
-+#>0x20e string	SFX\ by\ LARC	\b, LARC self-extracting archive
+ 0	search/1	P1
+->0	regex/4		P1[A-Za-z0-9_]
++>0	regex/4		P1[\040\t\f\r\n]
+ >>0	use		netpbm
+ >>>0	string		x	\b, bitmap
+ !:strength + 45
+ !:mime	image/x-portable-bitmap
  
- # JMP 8bit
- 0	        byte	0xeb
-@@ -508,27 +508,27 @@
- # GRR search is not working
- #2	search/28	\xcd\x21	COM executable for MS-DOS
- #WHICHFAT.cOM
--2	string	\xcd\x21		COM executable for DOS
-+#2	string	\xcd\x21		COM executable for DOS
- #DELTREE.cOM DELTREE2.cOM
--4	string	\xcd\x21		COM executable for DOS
-+#4	string	\xcd\x21		COM executable for DOS
- #IFMEMDSK.cOM ASSIGN.cOM COMP.cOM
--5	string	\xcd\x21		COM executable for DOS
-+#5	string	\xcd\x21		COM executable for DOS
- #DELTMP.COm HASFAT32.cOM
--7	string	\xcd\x21		
-->0	byte	!0xb8			COM executable for DOS
-+#7	string	\xcd\x21		
-+#>0	byte	!0xb8			COM executable for DOS
- #COMP.cOM MORE.COm
--10	string	\xcd\x21		
-->5	string	!\xcd\x21		COM executable for DOS
-+#10	string	\xcd\x21		
-+#>5	string	!\xcd\x21		COM executable for DOS
- #comecho.com
--13	string	\xcd\x21		COM executable for DOS
-+#13	string	\xcd\x21		COM executable for DOS
- #HELP.COm EDIT.coM
--18	string	\xcd\x21		COM executable for MS-DOS
-+#18	string	\xcd\x21		COM executable for MS-DOS
- #NWRPLTRM.COm
--23	string	\xcd\x21		COM executable for MS-DOS
-+#23	string	\xcd\x21		COM executable for MS-DOS
- #LOADFIX.cOm LOADFIX.cOm
--30	string	\xcd\x21		COM executable for MS-DOS
-+#30	string	\xcd\x21		COM executable for MS-DOS
- #syslinux.com 3.11
--70	string	\xcd\x21		COM executable for DOS
-+#70	string	\xcd\x21		COM executable for DOS
- # many compressed/converted COMs start with a copy loop instead of a jump
- 0x6	search/0xa	\xfc\x57\xf3\xa5\xc3	COM executable for MS-DOS
- 0x6	search/0xa	\xfc\x57\xf3\xa4\xc3	COM executable for DOS
-diff -u magic/Magdir.orig.0/perl magic/Magdir/perl
---- magic/Magdir.orig.0/perl	2016-06-12 16:50:16.000000000 +0000
-+++ magic/Magdir/perl	2016-11-24 15:59:25.553060242 +0000
-@@ -7,40 +7,54 @@
- # Send additions to <perl5-porters@perl.org>
- 0	search/1024	eval\ "exec\ perl		Perl script text
- !:mime	text/x-perl
-+!:strength + 30
- 0	search/1024	eval\ "exec\ /bin/perl		Perl script text
- !:mime	text/x-perl
-+!:strength + 30
- 0	search/1024	eval\ "exec\ /usr/bin/perl	Perl script text
- !:mime	text/x-perl
-+!:strength + 30
- 0	search/1024	eval\ "exec\ /usr/local/bin/perl	Perl script text
- !:mime	text/x-perl
-+!:strength + 30
- 0	search/1024	eval\ 'exec\ perl		Perl script text
- !:mime	text/x-perl
-+!:strength + 30
- 0	search/1024	eval\ 'exec\ /bin/perl		Perl script text
- !:mime	text/x-perl
-+!:strength + 30
- 0	search/1024	eval\ 'exec\ /usr/bin/perl	Perl script text
- !:mime	text/x-perl
-+!:strength + 30
- 0	search/1024	eval\ 'exec\ /usr/local/bin/perl	Perl script text
- !:mime	text/x-perl
-+!:strength + 30
- 0	search/1024	eval\ '(exit\ $?0)'\ &&\ eval\ 'exec	Perl script text
- !:mime	text/x-perl
-+!:strength + 1
- 0	string	#!/usr/bin/env\ perl	Perl script text executable
- !:mime	text/x-perl
-+!:strength + 30
- 0	string	#!\ /usr/bin/env\ perl	Perl script text executable
- !:mime	text/x-perl
-+!:strength + 30
- 0	string	#!
- >0	regex	\^#!.*/bin/perl([[:space:]].*)*$	Perl script text executable
- !:mime	text/x-perl
-+!:strength + 30
+ 0	search/1	P2
+->0	regex/4		P2[A-Za-z0-9_]
++>0	regex/4		P2[\040\t\f\r\n]
+ >>0	use		netpbm
+ >>>0	string		x	\b, greymap
+ !:strength + 45
+ !:mime	image/x-portable-greymap
  
- # by Dmitry V. Levin and Alexey Tourbin
- # check the first line
- 0	search/1024	package
- >0	regex		\^package[\ \t]+[0-9A-Za-z_:]+\ *;	Perl5 module source text
-+!:mime  text/x-perl
- !:strength + 10
- # not 'p', check other lines
- 0	search/1024	!p
- >0	regex		\^package[\ \t]+[0-9A-Za-z_:]+\ *;
- >>0	regex		\^1\ *;|\^(use|sub|my)\ .*[(;{=]	Perl5 module source text
--!:strength + 10
-+!:mime  text/x-perl
-+!:strength + 40
+ 0	search/1	P3
+->0	regex/4		P3[A-Za-z0-9_]
++>0	regex/4		P3[\040\t\f\r\n]
+ >>0	use		netpbm
+ >>>0	string		x	\b, pixmap
+ !:strength + 45
+ !:mime	image/x-portable-pixmap
  
- # Perl POD documents
- # From: Tom Hukins <tom@eborcom.com>
-diff -u magic/Magdir.orig.0/python magic/Magdir/python
---- magic/Magdir.orig.0/python	2016-09-16 12:06:13.000000000 +0000
-+++ magic/Magdir/python	2016-11-24 15:59:25.549060044 +0000
-@@ -43,20 +43,24 @@
- # from module.submodule import func1, func2
- 0	regex	\^from\\s+(\\w|\\.)+\\s+import.*$	Python script text executable
- !:mime text/x-python
-+!:strength + 15
+ 0	string		P4
+->0	regex/4		P4[A-Za-z0-9_]
++>0	regex/4		P4[\040\t\f\r\n]
+ >>0	use		netpbm
+ >>>0	string		x	\b, rawbits, bitmap
+ !:strength + 45
+ !:mime	image/x-portable-bitmap
  
- # def __init__ (self, ...):
- 0	search/4096	def\ __init__
- >&0	search/64 self	Python script text executable
- !:mime text/x-python
-+!:strength + 15
+ 0	string		P5
+->0	regex/4		P5[A-Za-z0-9_]
++>0	regex/4		P5[\040\t\f\r\n]
+ >>0	use		netpbm
+ >>>0	string		x	\b, rawbits, greymap
+ !:strength + 45
+ !:mime	image/x-portable-greymap
  
- # comments
--#0	search/4096	'''
--#>&0	regex	.*'''$	Python script text executable
--#!:mime text/x-python
-+0	search/4096	'''
-+>&0	regex	.*'''$	Python script text executable
-+!:mime text/x-python
-+!:strength + 15
- 
--#0	search/4096	"""
--#>&0	regex	.*"""$	Python script text executable
--#!:mime text/x-python
-+0	search/4096	"""
-+>&0	regex	.*"""$	Python script text executable
-+!:mime text/x-python
-+!:strength + 15
- 
- # try:
+ 0	string		P6
+->0	regex/4		P6[A-Za-z0-9_]
++>0	regex/4		P6[\040\t\f\r\n]
+ >>0	use		netpbm
+ >>>0	string		x	\b, rawbits, pixmap
+ !:strength + 45
+diff -u file-5.31.orig/magic/Magdir/python file-5.31/magic/Magdir/python
+--- file-5.31.orig/magic/Magdir/python	2017-05-08 18:10:13.000000000 +0000
++++ file-5.31/magic/Magdir/python	2017-10-11 14:29:57.653552987 +0000
+@@ -64,7 +64,7 @@
  # except: or finally:
-@@ -66,8 +70,10 @@
+ # block
+ 0	search/4096	try:
+->&0	regex	\^[A-Za-z0-9_]*except.*:	Python script text executable
++>&0	regex	\^[\040\t\f\r\n]*except.*:	Python script text executable
+ !:strength + 15
  !:mime text/x-python
  >&0	search/4096	finally:	Python script text executable
- !:mime text/x-python
-+!:strength + 15
- 
- # def name(args, args):
--0	regex	 \^(\ |\\t){0,50}def\ {1,50}[a-zA-Z]{1,100}
-->&0	regex	\ {0,50}\\(([a-zA-Z]|,|\ ){1,255}\\):$ Python script text executable
-+0	regex	 \^(\ |\\t)*def\ +[a-zA-Z]+
-+>&0	regex	\ *\\(([a-zA-Z]|,|\ )*\\):$ Python script text executable
- !:mime text/x-python
-+!:strength + 15
-diff -u magic/Magdir.orig.0/rpm magic/Magdir/rpm
---- magic/Magdir.orig.0/rpm	2014-09-11 15:03:07.000000000 +0000
-+++ magic/Magdir/rpm	2016-11-24 15:58:28.458225125 +0000
+diff -u file-5.31.orig/magic/Magdir/rpm file-5.31/magic/Magdir/rpm
+--- file-5.31.orig/magic/Magdir/rpm	2017-03-17 21:34:26.000000000 +0000
++++ file-5.31/magic/Magdir/rpm	2017-10-11 14:30:57.480078009 +0000
 @@ -29,6 +29,7 @@
  >>8	beshort		17		SuperH
  >>8	beshort		18		Xtensa
@@ -286,18 +178,76 @@ diff -u magic/Magdir.orig.0/rpm magic/Magdir/rpm
  
  #delta RPM    Daniel Novotny (dnovotny@redhat.com)
  0	string		drpm		Delta RPM
-diff -u magic/Magdir.orig.0/securitycerts magic/Magdir/securitycerts
---- magic/Magdir.orig.0/securitycerts	2014-09-11 15:03:07.000000000 +0000
-+++ magic/Magdir/securitycerts	2016-11-24 15:59:25.549060044 +0000
+diff -u file-5.31.orig/magic/Magdir/ruby file-5.31/magic/Magdir/ruby
+--- file-5.31.orig/magic/Magdir/ruby	2017-03-17 21:34:26.000000000 +0000
++++ file-5.31/magic/Magdir/ruby	2017-10-11 14:30:24.410682267 +0000
+@@ -6,27 +6,46 @@
+ # From: Reuben Thomas <rrt@sc3d.org>
+ 
+ # Ruby scripts
+-0	search/1/w	#!\ /usr/bin/ruby	Ruby script text executable
++0	search/1/w	#!\ /usr/bin/ruby				Ruby script text executable
+ !:strength + 15
+ !:mime text/x-ruby
+ 0	search/1/w	#!\ /usr/local/bin/ruby	Ruby script text executable
+ !:strength + 15
+ !:mime text/x-ruby
+-0	search/1	#!/usr/bin/env\ ruby	Ruby script text executable
++0	search/1	#!/usr/bin/env\ ruby				Ruby script text executable
+ !:strength + 15
+ !:mime text/x-ruby
+-0	search/1	#!\ /usr/bin/env\ ruby	Ruby script text executable
++0	search/1	#!\ /usr/bin/env\ ruby			Ruby script text executable
+ !:strength + 15
+ !:mime text/x-ruby
+ 
+ # What looks like ruby, but does not have a shebang
+ # (modules and such)
+ # From: Lubomir Rintel <lkundrak@v3.sk>
+-0	regex		\^[\ \t]*require[\ \t]'[A-Za-z_/]+'
+->0	regex		include\ [A-Z]|def\ [a-z]|\ do$
+->>0	regex		\^[\ \t]*end([\ \t]*[;#].*)?$		Ruby script text
++0	regex		\^[[:space:]]*require[[:space:]]'[A-Za-z_/]+'
++>0	regex		def\ [a-z]|\ do$
++>>&0	regex		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
++!:strength + 30
+ !:mime	text/x-ruby
+-0	regex		\^[\ \t]*(class|module)[\ \t][A-Z]
++0	regex		\^[[:space:]]*(class|module)[[:space:]][A-Z]
+ >0	regex		(modul|includ)e\ [A-Z]|def\ [a-z]
+->>0	regex		\^[\ \t]*end([\ \t]*[;#].*)?$		Ruby module source text
++>>&0	regex		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
++!:strength + 30
++!:mime	text/x-ruby
++# Classes with no modules or defs, beats simple ASCII
++0	regex		\^[[:space:]]*(class|module)[[:space:]][A-Z]
++>&0	regex	\^[[:space:]]*end([[:space:]]+[;#if].*)?$		Ruby script text
++!:strength + 10
++!:mime	text/x-ruby
++# Looks for function definiton to balance python magic
++# def name (args)
++# end
++0	regex		\^[[:space:]]*def\ [a-z]|def\ [[:alpha:]]+::[a-z]
++>&0	regex		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
++!:strength + 10
++!:mime	text/x-ruby
++
++0	regex		\^[[:space:]]*require[[:space:]]'[A-Za-z_/]+'	Ruby script text
++!:mime	text/x-ruby
++0 regex 	\^[[:space:]]*include\ ([A-Z]+[a-z]*(::))+	Ruby script text
+ !:mime	text/x-ruby
+diff -u file-5.31.orig/magic/Magdir/securitycerts file-5.31/magic/Magdir/securitycerts
+--- file-5.31.orig/magic/Magdir/securitycerts	2017-03-17 21:34:26.000000000 +0000
++++ file-5.31/magic/Magdir/securitycerts	2017-10-11 14:30:57.480078009 +0000
 @@ -4,3 +4,5 @@
  0	search/1		-----BEGIN\ CERTIFICATE------	RFC1421 Security Certificate text
  0	search/1		-----BEGIN\ NEW\ CERTIFICATE	RFC1421 Security Certificate Signing Request text
  0	belong	0xedfeedfe	Sun 'jks' Java Keystore File data
 +
 +0	string \0volume_key	volume_key escrow packet
-diff -u magic/Magdir.orig.0/varied.script magic/Magdir/varied.script
---- magic/Magdir.orig.0/varied.script	2015-03-27 17:59:39.000000000 +0000
-+++ magic/Magdir/varied.script	2016-11-24 15:59:25.557060441 +0000
+diff -u file-5.31.orig/magic/Magdir/varied.script file-5.31/magic/Magdir/varied.script
+--- file-5.31.orig/magic/Magdir/varied.script	2017-03-17 21:34:26.000000000 +0000
++++ file-5.31/magic/Magdir/varied.script	2017-10-11 14:30:57.480078009 +0000
 @@ -4,27 +4,35 @@
  
  0	string/t		#!\ /			a

ext/gd/config.m4

@@ -309,7 +309,6 @@ else
 
 dnl Various checks for GD features
   PHP_GD_ZLIB
-  PHP_GD_TTSTR
   PHP_GD_WEBP
   PHP_GD_JPEG
   PHP_GD_PNG

ext/gd/gd.c

@@ -381,6 +381,7 @@ ZEND_END_ARG_INFO()
 ZEND_BEGIN_ARG_INFO_EX(arginfo_imagewebp, 0, 0, 1)
 	ZEND_ARG_INFO(0, im)
 	ZEND_ARG_INFO(0, to)
+	ZEND_ARG_INFO(0, quality)
 ZEND_END_ARG_INFO()
 #endif
 

ext/gd/libgd/gd_interpolation.c

@@ -1709,13 +1709,28 @@ gdImagePtr gdImageScale(const gdImagePtr src, const unsigned int new_width, cons
 	return im_scaled;
 }
 
+static int gdRotatedImageSize(gdImagePtr src, const float angle, gdRectPtr bbox)
+{
+    gdRect src_area;
+    double m[6];
+
+    gdAffineRotate(m, angle);
+    src_area.x = 0;
+    src_area.y = 0;
+    src_area.width = gdImageSX(src);
+    src_area.height = gdImageSY(src);
+    if (gdTransformAffineBoundingBox(&src_area, m, bbox) != GD_TRUE) {
+        return GD_FALSE;
+    }
+
+    return GD_TRUE;
+}
+
 gdImagePtr gdImageRotateNearestNeighbour(gdImagePtr src, const float degrees, const int bgColor)
 {
 	float _angle = ((float) (-degrees / 180.0f) * (float)M_PI);
 	const int src_w  = gdImageSX(src);
 	const int src_h = gdImageSY(src);
-	const unsigned int new_width = (unsigned int)(abs((int)(src_w * cos(_angle))) + abs((int)(src_h * sin(_angle))) + 0.5f);
-	const unsigned int new_height = (unsigned int)(abs((int)(src_w * sin(_angle))) + abs((int)(src_h * cos(_angle))) + 0.5f);
 	const gdFixed f_0_5 = gd_ftofx(0.5f);
 	const gdFixed f_H = gd_itofx(src_h/2);
 	const gdFixed f_W = gd_itofx(src_w/2);
@@ -1726,6 +1741,12 @@ gdImagePtr gdImageRotateNearestNeighbour(gdImagePtr src, const float degrees, co
 	unsigned int dst_offset_y = 0;
 	unsigned int i;
 	gdImagePtr dst;
+	gdRect bbox;
+	int new_height, new_width;
+
+    gdRotatedImageSize(src, degrees, &bbox);
+    new_width = bbox.width;
+    new_height = bbox.height;
 
 	if (new_width == 0 || new_height == 0) {
 		return NULL;
@@ -1768,8 +1789,6 @@ gdImagePtr gdImageRotateGeneric(gdImagePtr src, const float degrees, const int b
 	const int angle_rounded = (int)floor(degrees * 100);
 	const int src_w  = gdImageSX(src);
 	const int src_h = gdImageSY(src);
-	const unsigned int new_width = (unsigned int)(abs((int)(src_w * cos(_angle))) + abs((int)(src_h * sin(_angle))) + 0.5f);
-	const unsigned int new_height = (unsigned int)(abs((int)(src_w * sin(_angle))) + abs((int)(src_h * cos(_angle))) + 0.5f);
 	const gdFixed f_0_5 = gd_ftofx(0.5f);
 	const gdFixed f_H = gd_itofx(src_h/2);
 	const gdFixed f_W = gd_itofx(src_w/2);
@@ -1780,6 +1799,8 @@ gdImagePtr gdImageRotateGeneric(gdImagePtr src, const float degrees, const int b
 	unsigned int dst_offset_y = 0;
 	unsigned int i;
 	gdImagePtr dst;
+	int new_width, new_height;
+	gdRect bbox;
 
 	const gdFixed f_slop_y = f_sin;
 	const gdFixed f_slop_x = f_cos;
@@ -1792,6 +1813,10 @@ gdImagePtr gdImageRotateGeneric(gdImagePtr src, const float degrees, const int b
 		return NULL;
 	}
 
+    gdRotatedImageSize(src, degrees, &bbox);
+    new_width = bbox.width;
+    new_height = bbox.height;
+
 	dst = gdImageCreateTrueColor(new_width, new_height);
 	if (!dst) {
 		return NULL;
@@ -1831,8 +1856,7 @@ gdImagePtr gdImageRotateBilinear(gdImagePtr src, const float degrees, const int
 	float _angle = (float)((- degrees / 180.0f) * M_PI);
 	const unsigned int src_w = gdImageSX(src);
 	const unsigned int src_h = gdImageSY(src);
-	unsigned int new_width = abs((int)(src_w*cos(_angle))) + abs((int)(src_h*sin(_angle) + 0.5f));
-	unsigned int new_height = abs((int)(src_w*sin(_angle))) + abs((int)(src_h*cos(_angle) + 0.5f));
+	unsigned int new_width, new_height;
 	const gdFixed f_0_5 = gd_ftofx(0.5f);
 	const gdFixed f_H = gd_itofx(src_h/2);
 	const gdFixed f_W = gd_itofx(src_w/2);
@@ -1844,6 +1868,12 @@ gdImagePtr gdImageRotateBilinear(gdImagePtr src, const float degrees, const int
 	unsigned int dst_offset_y = 0;
 	unsigned int src_offset_x, src_offset_y;
 	gdImagePtr dst;
+	gdRect bbox;
+
+	gdRotatedImageSize(src, degrees, &bbox);
+
+	new_width = bbox.width;
+	new_height = bbox.height;
 
 	dst = gdImageCreateTrueColor(new_width, new_height);
 	if (dst == NULL) {
@@ -1863,7 +1893,7 @@ gdImagePtr gdImageRotateBilinear(gdImagePtr src, const float degrees, const int
 			const unsigned int m = gd_fxtoi(f_m);
 			const unsigned int n = gd_fxtoi(f_n);
 
-			if ((m > 0) && (m < src_h - 1) && (n > 0) && (n < src_w - 1)) {
+			if ((m >= 0) && (m < src_h - 1) && (n >= 0) && (n < src_w - 1)) {
 				const gdFixed f_f = f_m - gd_itofx(m);
 				const gdFixed f_g = f_n - gd_itofx(n);
 				const gdFixed f_w1 = gd_mulfx(f_1-f_f, f_1-f_g);
@@ -1871,11 +1901,6 @@ gdImagePtr gdImageRotateBilinear(gdImagePtr src, const float degrees, const int
 				const gdFixed f_w3 = gd_mulfx(f_f, f_1-f_g);
 				const gdFixed f_w4 = gd_mulfx(f_f, f_g);
 
-				if (n < src_w - 1) {
-					src_offset_x = n + 1;
-					src_offset_y = m;
-				}
-
 				if (m < src_h-1) {
 					src_offset_x = n;
 					src_offset_y = m + 1;
@@ -1890,13 +1915,13 @@ gdImagePtr gdImageRotateBilinear(gdImagePtr src, const float degrees, const int
 					register int pixel2, pixel3, pixel4;
 
 					if (src_offset_y + 1 >= src_h) {
-						pixel2 = bgColor;
-						pixel3 = bgColor;
-						pixel4 = bgColor;
+						pixel2 = pixel1;
+						pixel3 = pixel1;
+						pixel4 = pixel1;
 					} else if (src_offset_x + 1 >= src_w) {
-						pixel2 = bgColor;
-						pixel3 = bgColor;
-						pixel4 = bgColor;
+						pixel2 = pixel1;
+						pixel3 = pixel1;
+						pixel4 = pixel1;
 					} else {
 					    pixel2 = src->tpixels[src_offset_y][src_offset_x + 1];
 						pixel3 = src->tpixels[src_offset_y + 1][src_offset_x];
@@ -1946,8 +1971,7 @@ gdImagePtr gdImageRotateBicubicFixed(gdImagePtr src, const float degrees, const
 	const float _angle = (float)((- degrees / 180.0f) * M_PI);
 	const int src_w = gdImageSX(src);
 	const int src_h = gdImageSY(src);
-	const unsigned int new_width = abs((int)(src_w*cos(_angle))) + abs((int)(src_h*sin(_angle) + 0.5f));
-	const unsigned int new_height = abs((int)(src_w*sin(_angle))) + abs((int)(src_h*cos(_angle) + 0.5f));
+	unsigned int new_width, new_height;
 	const gdFixed f_0_5 = gd_ftofx(0.5f);
 	const gdFixed f_H = gd_itofx(src_h/2);
 	const gdFixed f_W = gd_itofx(src_w/2);
@@ -1963,7 +1987,11 @@ gdImagePtr gdImageRotateBicubicFixed(gdImagePtr src, const float degrees, const
 	unsigned int dst_offset_y = 0;
 	unsigned int i;
 	gdImagePtr dst;
+	gdRect bbox;
 
+	gdRotatedImageSize(src, degrees, &bbox);
+	new_width = bbox.width;
+	new_height = bbox.height;
 	dst = gdImageCreateTrueColor(new_width, new_height);
 
 	if (dst == NULL) {
@@ -2206,8 +2234,11 @@ gdImagePtr gdImageRotateBicubicFixed(gdImagePtr src, const float degrees, const
 
 gdImagePtr gdImageRotateInterpolated(const gdImagePtr src, const float angle, int bgcolor)
 {
-	const int angle_rounded = (int)floor(angle * 100);
-
+	/* round to two decimals and keep the 100x multiplication to use it in the common square angles 
+	   case later. Keep the two decimal precisions so smaller rotation steps can be done, useful for
+	   slow animations, f.e. */
+	const int angle_rounded = fmod((int) floorf(angle * 100), 360 * 100);
+	   
 	if (bgcolor < 0) {
 		return NULL;
 	}
@@ -2224,6 +2255,18 @@ gdImagePtr gdImageRotateInterpolated(const gdImagePtr src, const float angle, in
 
 	/* no interpolation needed here */
 	switch (angle_rounded) {
+		case    0: {
+			gdImagePtr dst = gdImageCreateTrueColor(src->sx, src->sy);
+			if (dst == NULL) {
+				return NULL;
+			}
+			dst->transparent = src->transparent;
+			dst->saveAlphaFlag = 1;
+			dst->alphaBlendingFlag = gdEffectReplace;
+
+			gdImageCopy(dst, src, 0,0,0,0,src->sx,src->sy);
+			return dst;
+		}
 		case -27000:
 		case   9000:
 			return gdImageRotate90(src, 0);

ext/gd/libgd/wbmp.c

@@ -164,7 +164,10 @@ readwbmp (int (*getin) (void *in), void *in, Wbmp ** return_wbmp)
     }
 
   if (skipheader (getin, in))
-    return (-1);
+    {
+      gdFree (wbmp);
+      return (-1);
+    }
 
 
   wbmp->width = getmbi (getin, in);

ext/gd/tests/bug65148.phpt

@@ -0,0 +1,179 @@
+--TEST--
+Bug #65148 (imagerotate may alter image dimensions)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension is not available');
+?>
+--FILE--
+<?php
+
+$interpolations = array(
+    'IMG_BELL' => IMG_BELL,
+    'IMG_BESSEL' => IMG_BESSEL,
+    'IMG_BICUBIC' => IMG_BICUBIC,
+    'IMG_BICUBIC_FIXED' => IMG_BICUBIC_FIXED,
+    'IMG_BILINEAR_FIXED' => IMG_BILINEAR_FIXED,
+    'IMG_BLACKMAN' => IMG_BLACKMAN,
+    'IMG_BOX' => IMG_BOX,
+    'IMG_BSPLINE' => IMG_BSPLINE,
+    'IMG_CATMULLROM' => IMG_CATMULLROM,
+    'IMG_GAUSSIAN' => IMG_GAUSSIAN,
+    'IMG_GENERALIZED_CUBIC' => IMG_GENERALIZED_CUBIC,
+    'IMG_HERMITE' => IMG_HERMITE,
+    'IMG_HAMMING' => IMG_HAMMING,
+    'IMG_HANNING' => IMG_HANNING,
+    'IMG_MITCHELL' => IMG_MITCHELL,
+    'IMG_POWER' => IMG_POWER,
+    'IMG_QUADRATIC' => IMG_QUADRATIC,
+    'IMG_SINC' => IMG_SINC,
+    'IMG_NEAREST_NEIGHBOUR' => IMG_NEAREST_NEIGHBOUR,
+    'IMG_WEIGHTED4' => IMG_WEIGHTED4,
+    'IMG_TRIANGLE' => IMG_TRIANGLE,
+);
+
+$img = imagecreate(40, 20);
+$results = array();
+
+foreach ($interpolations as $name => $interpolation) {
+  imagesetinterpolation($img, $interpolation);
+  $t = imagecolorallocatealpha($img, 0, 0, 0, 127);
+  $imgr = imagerotate($img, -5, $t);
+  $results[$name] = array('x' => imagesx($imgr), 'y' => imagesy($imgr));
+  imagedestroy($imgr);
+}
+
+imagedestroy($img);
+print_r($results);
+?>
+===DONE===
+--EXPECT--
+Array
+(
+    [IMG_BELL] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_BESSEL] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_BICUBIC] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_BICUBIC_FIXED] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_BILINEAR_FIXED] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_BLACKMAN] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_BOX] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_BSPLINE] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_CATMULLROM] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_GAUSSIAN] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_GENERALIZED_CUBIC] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_HERMITE] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_HAMMING] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_HANNING] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_MITCHELL] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_POWER] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_QUADRATIC] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_SINC] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_NEAREST_NEIGHBOUR] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_WEIGHTED4] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+    [IMG_TRIANGLE] => Array
+        (
+            [x] => 40
+            [y] => 23
+        )
+
+)
+===DONE===

ext/gd/tests/bug75437.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #75437 Wrong reflection on imagewebp
+--SKIPIF--
+<?php
+if (!extension_loaded('reflection')) die('skip reflection not available');
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.0', '<')) die("skip test requires GD 2.2.0 or higher");
+if (!function_exists('imagewebp')) die('skip WebP support not available');
+?>
+--FILE--
+<?php
+$rf = new ReflectionFunction('imagewebp');
+var_dump($rf->getNumberOfParameters());
+var_dump($rf->getNumberOfRequiredParameters());
+?>
+===DONE===
+--EXPECT--
+int(3)
+int(1)
+===DONE===

ext/hash/config.m4

@@ -24,25 +24,33 @@ if test "$PHP_HASH" != "no"; then
   AC_CHECK_SIZEOF(int, 4)
   AC_CHECK_SIZEOF(long, 4)
   AC_CHECK_SIZEOF(long long, 8)
-  
-  PHP_CHECK_64BIT([
-    SHA3_DIR="sha3/generic32lc"
-    SHA3_OPT_SRC="$SHA3_DIR/KeccakP-1600-inplace32BI.c"
-  ],[
-    SHA3_DIR="sha3/generic64lc"
-    SHA3_OPT_SRC="$SHA3_DIR/KeccakP-1600-opt64.c"
-  ])
-  EXT_HASH_SHA3_SOURCES="$SHA3_OPT_SRC $SHA3_DIR/KeccakHash.c $SHA3_DIR/KeccakSponge.c"
-  PHP_HASH_CFLAGS="-I@ext_srcdir@/$SHA3_DIR -DKeccakP200_excluded -DKeccakP400_excluded -DKeccakP800_excluded"
+
+  if test $ac_cv_c_bigendian_php = yes; then
+    EXT_HASH_SHA3_SOURCES="hash_sha3.c"
+    AC_DEFINE(HAVE_SLOW_HASH3, 1, [Define is hash3 algo is available])
+    AC_MSG_WARN("Use SHA3 slow implementation on bigendian")
+  else
+    PHP_CHECK_64BIT([
+      SHA3_DIR="sha3/generic32lc"
+      SHA3_OPT_SRC="$SHA3_DIR/KeccakP-1600-inplace32BI.c"
+    ],[
+      SHA3_DIR="sha3/generic64lc"
+      SHA3_OPT_SRC="$SHA3_DIR/KeccakP-1600-opt64.c"
+    ])
+    EXT_HASH_SHA3_SOURCES="$SHA3_OPT_SRC $SHA3_DIR/KeccakHash.c $SHA3_DIR/KeccakSponge.c hash_sha3.c"
+    PHP_HASH_CFLAGS="-I@ext_srcdir@/$SHA3_DIR -DKeccakP200_excluded -DKeccakP400_excluded -DKeccakP800_excluded"
+
+    PHP_ADD_BUILD_DIR(ext/hash/$SHA3_DIR, 1)
+  fi
+
   EXT_HASH_SOURCES="hash.c hash_md.c hash_sha.c hash_ripemd.c hash_haval.c \
     hash_tiger.c hash_gost.c hash_snefru.c hash_whirlpool.c hash_adler32.c \
-    hash_crc32.c hash_fnv.c hash_joaat.c hash_sha3.c $EXT_HASH_SHA3_SOURCES"
+    hash_crc32.c hash_fnv.c hash_joaat.c $EXT_HASH_SHA3_SOURCES"
   EXT_HASH_HEADERS="php_hash.h php_hash_md.h php_hash_sha.h php_hash_ripemd.h \
     php_hash_haval.h php_hash_tiger.h php_hash_gost.h php_hash_snefru.h \
     php_hash_whirlpool.h php_hash_adler32.h php_hash_crc32.h \
     php_hash_fnv.h php_hash_joaat.h php_hash_sha3.h"
 
-  PHP_ADD_BUILD_DIR(ext/hash/$SHA3_DIR, 1)
   PHP_NEW_EXTENSION(hash, $EXT_HASH_SOURCES, $ext_shared,,$PHP_HASH_CFLAGS)
   ifdef([PHP_INSTALL_HEADERS], [
   	PHP_INSTALL_HEADERS(ext/hash, $EXT_HASH_HEADERS)

ext/hash/hash_sha3.c

@@ -19,6 +19,217 @@
 #include "php_hash.h"
 #include "php_hash_sha3.h"
 
+#ifdef HAVE_SLOW_HASH3
+// ================= slow algo ==============================================
+
+#if (defined(__APPLE__) || defined(__APPLE_CC__)) && \
+    (defined(__BIG_ENDIAN__) || defined(__LITTLE_ENDIAN__))
+# if defined(__LITTLE_ENDIAN__)
+#  undef WORDS_BIGENDIAN
+# else
+#  if defined(__BIG_ENDIAN__)
+#   define WORDS_BIGENDIAN
+#  endif
+# endif
+#endif
+
+static inline uint64_t rol64(uint64_t v, unsigned char b) {
+	return (v << b) | (v >> (64 - b));
+}
+static inline unsigned char idx(unsigned char x, unsigned char y) {
+	return x + (5 * y);
+}
+
+#ifdef WORDS_BIGENDIAN
+static inline uint64_t load64(const unsigned char* x) {
+	signed char i;
+	uint64_t ret = 0;
+	for (i = 7; i >= 0; --i) {
+		ret <<= 8;
+		ret |= x[i];
+	}
+	return ret;
+}
+static inline void store64(unsigned char* x, uint64_t val) {
+	char i;
+	for (i = 0; i < 8; ++i) {
+		x[i] = val & 0xFF;
+		val >>= 8;
+	}
+}
+static inline void xor64(unsigned char* x, uint64_t val) {
+	char i;
+	for (i = 0; i < 8; ++i) {
+		x[i] ^= val & 0xFF;
+		val >>= 8;
+	}
+}
+# define readLane(x, y)     load64(ctx->state+sizeof(uint64_t)*idx(x, y))
+# define writeLane(x, y, v) store64(ctx->state+sizeof(uint64_t)*idx(x, y), v)
+# define XORLane(x, y, v)   xor64(ctx->state+sizeof(uint64_t)*idx(x, y), v)
+#else
+# define readLane(x, y)     (((uint64_t*)ctx->state)[idx(x,y)])
+# define writeLane(x, y, v) (((uint64_t*)ctx->state)[idx(x,y)] = v)
+# define XORLane(x, y, v)   (((uint64_t*)ctx->state)[idx(x,y)] ^= v)
+#endif
+
+static inline char LFSR86540(unsigned char* pLFSR)
+{
+	unsigned char LFSR = *pLFSR;
+	char result = LFSR & 0x01;
+	if (LFSR & 0x80) {
+		// Primitive polynomial over GF(2): x^8+x^6+x^5+x^4+1
+		LFSR = (LFSR << 1) ^ 0x71;
+	} else {
+		LFSR <<= 1;
+	}
+	*pLFSR = LFSR;
+	return result;
+}
+
+static void permute(PHP_SHA3_CTX* ctx) {
+	unsigned char LFSRstate = 0x01;
+	unsigned char round;
+
+	for (round = 0; round < 24; ++round) {
+		{ // Theta step (see [Keccak Reference, Section 2.3.2])
+			uint64_t C[5], D;
+			unsigned char x, y;
+			for (x = 0; x < 5; ++x) {
+				C[x] = readLane(x, 0) ^ readLane(x, 1) ^
+				readLane(x, 2) ^ readLane(x, 3) ^ readLane(x, 4);
+			}
+			for (x = 0; x < 5; ++x) {
+				D = C[(x+4)%5] ^ rol64(C[(x+1)%5], 1);
+				for (y = 0; y < 5; ++y) {
+					XORLane(x, y, D);
+				}
+			}
+		}
+
+		{ // p and Pi steps (see [Keccak Reference, Sections 2.3.3 and 2.3.4])
+			unsigned char x = 1, y = 0, t;
+			uint64_t current = readLane(x, y);
+			for (t = 0; t < 24; ++t) {
+				unsigned char r = ((t + 1) * (t + 2) / 2) % 64;
+				unsigned char Y = (2*x + 3*y) % 5;
+				uint64_t temp;
+				x = y;
+				y = Y;
+				temp = readLane(x, y);
+				writeLane(x, y, rol64(current, r));
+				current = temp;
+			}
+		}
+
+		{ // X step (see [Keccak Reference, Section 2.3.1])
+			unsigned char x, y;
+			for (y = 0; y < 5; ++y) {
+				uint64_t temp[5];
+				for (x = 0; x < 5; ++x) {
+					temp[x] = readLane(x, y);
+				}
+				for (x = 0; x < 5; ++x) {
+					writeLane(x, y, temp[x] ^((~temp[(x+1)%5]) & temp[(x+2)%5]));
+				}
+			}
+		}
+
+		{ // i step (see [Keccak Reference, Section 2.3.5])
+			unsigned char j;
+			for (j = 0; j < 7; ++j) {
+				if (LFSR86540(&LFSRstate)) {
+					uint64_t bitPos = (1<<j) - 1;
+					XORLane(0, 0, (uint64_t)1 << bitPos);
+				}
+			}
+		}
+	}
+}
+
+// ==========================================================================
+
+static void PHP_SHA3_Init(PHP_SHA3_CTX* ctx,
+                          int bits) {
+	memset(ctx, 0, sizeof(PHP_SHA3_CTX));
+}
+
+static void PHP_SHA3_Update(PHP_SHA3_CTX* ctx,
+                            const unsigned char* buf,
+                            unsigned int count,
+                            size_t block_size) {
+	while (count > 0) {
+		unsigned int len = block_size - ctx->pos;
+		if (len > count) len = count;
+		count -= len;
+		while (len-- > 0) {
+			ctx->state[ctx->pos++] ^= *(buf++);
+		}
+		if (ctx->pos >= block_size) {
+			permute(ctx);
+			ctx->pos = 0;
+		}
+	}
+}
+
+static void PHP_SHA3_Final(unsigned char* digest,
+                           PHP_SHA3_CTX* ctx,
+                           int block_size,
+                           int digest_size) {
+	int len = digest_size;
+
+	// Pad state to finalize
+	ctx->state[ctx->pos++] ^= 0x06;
+	ctx->state[block_size-1] ^= 0x80;
+	permute(ctx);
+
+	// Square output for digest
+	for(;;) {
+		int bs = (len < block_size) ? len : block_size;
+		memcpy(digest, ctx->state, bs);
+		digest += bs;
+		len -= bs;
+		if (!len) break;
+		permute(ctx);
+	}
+
+	// Zero out context
+	memset(ctx, 0, sizeof(PHP_SHA3_CTX));
+}
+
+// ==========================================================================
+
+#define DECLARE_SHA3_OPS(bits) \
+void PHP_SHA3##bits##Init(PHP_SHA3_##bits##_CTX* ctx) { \
+	PHP_SHA3_Init(ctx, bits); \
+} \
+void PHP_SHA3##bits##Update(PHP_SHA3_##bits##_CTX* ctx, \
+                            const unsigned char* input, \
+                            unsigned int inputLen) { \
+	PHP_SHA3_Update(ctx, input, inputLen, \
+                    (1600 - (2 * bits)) >> 3); \
+} \
+void PHP_SHA3##bits##Final(unsigned char* digest, \
+                           PHP_SHA3_##bits##_CTX* ctx) { \
+	PHP_SHA3_Final(digest, ctx, \
+                   (1600 - (2 * bits)) >> 3, \
+                   bits >> 3); \
+} \
+const php_hash_ops php_hash_sha3_##bits##_ops = { \
+	(php_hash_init_func_t) PHP_SHA3##bits##Init, \
+	(php_hash_update_func_t) PHP_SHA3##bits##Update, \
+	(php_hash_final_func_t) PHP_SHA3##bits##Final, \
+	php_hash_copy, \
+	bits >> 3, \
+	(1600 - (2 * bits)) >> 3, \
+	sizeof(PHP_SHA3_##bits##_CTX), \
+	1 \
+}
+
+#else
+
+// ================= fast algo ==============================================
+
 #define SUCCESS SHA3_SUCCESS /* Avoid conflict between KeccacHash.h and zend_types.h */
 #include "KeccakHash.h"
 
@@ -60,6 +271,9 @@ const php_hash_ops php_hash_sha3_##bits##_ops = { \
 	1 \
 }
 
+#endif
+// ================= both algo ==============================================
+
 DECLARE_SHA3_OPS(224);
 DECLARE_SHA3_OPS(256);
 DECLARE_SHA3_OPS(384);

ext/hash/php_hash_sha3.h

@@ -22,7 +22,12 @@
 #include "php.h"
 
 typedef struct {
+#ifdef HAVE_SLOW_HASH3
+	unsigned char state[200]; // 5 * 5 * sizeof(uint64)
+	uint32_t pos;
+#else
 	void *hashinstance;
+#endif
 } PHP_SHA3_CTX;
 
 typedef PHP_SHA3_CTX PHP_SHA3_224_CTX;

ext/interbase/interbase.c

@@ -53,7 +53,7 @@ ZEND_END_ARG_INFO()
 ZEND_BEGIN_ARG_INFO(arginfo_ibase_errcode, 0)
 ZEND_END_ARG_INFO()
 
-ZEND_BEGIN_ARG_INFO_EX(arginfo_ibase_connect, 0, 0, 1)
+ZEND_BEGIN_ARG_INFO_EX(arginfo_ibase_connect, 0, 0, 0)
 	ZEND_ARG_INFO(0, database)
 	ZEND_ARG_INFO(0, username)
 	ZEND_ARG_INFO(0, password)
@@ -63,7 +63,7 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_ibase_connect, 0, 0, 1)
 	ZEND_ARG_INFO(0, role)
 ZEND_END_ARG_INFO()
 
-ZEND_BEGIN_ARG_INFO_EX(arginfo_ibase_pconnect, 0, 0, 1)
+ZEND_BEGIN_ARG_INFO_EX(arginfo_ibase_pconnect, 0, 0, 0)
 	ZEND_ARG_INFO(0, database)
 	ZEND_ARG_INFO(0, username)
 	ZEND_ARG_INFO(0, password)
@@ -1030,7 +1030,7 @@ static void _php_ibase_connect(INTERNAL_FUNCTION_PARAMETERS, int persistent) /*
 }
 /* }}} */
 
-/* {{{ proto resource ibase_connect(string database [, string username [, string password [, string charset [, int buffers [, int dialect [, string role]]]]]])
+/* {{{ proto resource ibase_connect([string database [, string username [, string password [, string charset [, int buffers [, int dialect [, string role]]]]]]])
    Open a connection to an InterBase database */
 PHP_FUNCTION(ibase_connect)
 {
@@ -1038,7 +1038,7 @@ PHP_FUNCTION(ibase_connect)
 }
 /* }}} */
 
-/* {{{ proto resource ibase_pconnect(string database [, string username [, string password [, string charset [, int buffers [, int dialect [, string role]]]]]])
+/* {{{ proto resource ibase_pconnect([string database [, string username [, string password [, string charset [, int buffers [, int dialect [, string role]]]]]]])
    Open a persistent connection to an InterBase database */
 PHP_FUNCTION(ibase_pconnect)
 {

ext/intl/converter/converter.c

@@ -411,7 +411,7 @@ static zend_bool php_converter_set_encoding(php_converter_object *objval,
 ZEND_BEGIN_ARG_INFO_EX(php_converter_set_encoding_arginfo, 0, ZEND_RETURN_VALUE, 1)
 	ZEND_ARG_INFO(0, encoding)
 ZEND_END_ARG_INFO();
-static void php_converter_do_set_encoding(UConverter *cnv, INTERNAL_FUNCTION_PARAMETERS) {
+static void php_converter_do_set_encoding(UConverter **pcnv, INTERNAL_FUNCTION_PARAMETERS) {
 	php_converter_object *objval = CONV_GET(getThis());
 	char *enc;
 	size_t enc_len;
@@ -423,21 +423,21 @@ static void php_converter_do_set_encoding(UConverter *cnv, INTERNAL_FUNCTION_PAR
 	}
 	intl_errors_reset(&objval->error);
 
-	RETURN_BOOL(php_converter_set_encoding(objval, &(objval->src), enc, enc_len));
+	RETURN_BOOL(php_converter_set_encoding(objval, pcnv, enc, enc_len));
 }
 /* }}} */
 
 /* {{{ proto bool UConverter::setSourceEncoding(string encoding) */
 static PHP_METHOD(UConverter, setSourceEncoding) {
 	php_converter_object *objval = CONV_GET(getThis());
-	php_converter_do_set_encoding(objval->src, INTERNAL_FUNCTION_PARAM_PASSTHRU);
+	php_converter_do_set_encoding(&(objval->src), INTERNAL_FUNCTION_PARAM_PASSTHRU);
 }
 /* }}} */
 
 /* {{{ proto bool UConverter::setDestinationEncoding(string encoding) */
 static PHP_METHOD(UConverter, setDestinationEncoding) {
 	php_converter_object *objval = CONV_GET(getThis());
-	php_converter_do_set_encoding(objval->dest, INTERNAL_FUNCTION_PARAM_PASSTHRU);
+	php_converter_do_set_encoding(&(objval->dest), INTERNAL_FUNCTION_PARAM_PASSTHRU);
 }
 /* }}} */
 
@@ -897,7 +897,7 @@ static PHP_METHOD(UConverter, getAvailable) {
 /* }}} */
 
 /* {{{ proto array UConverter::getAliases(string name) */
-ZEND_BEGIN_ARG_INFO_EX(php_converter_getaliases_arginfo, 0, ZEND_RETURN_VALUE, 0)
+ZEND_BEGIN_ARG_INFO_EX(php_converter_getaliases_arginfo, 0, ZEND_RETURN_VALUE, 1)
 	ZEND_ARG_INFO(0, name)
 ZEND_END_ARG_INFO();
 static PHP_METHOD(UConverter, getAliases) {

ext/intl/dateformat/dateformat_parse.c

@@ -145,6 +145,7 @@ PHP_FUNCTION(datefmt_parse)
 	DATE_FORMAT_METHOD_FETCH_OBJECT;
 
 	if (z_parse_pos) {
+		ZVAL_DEREF(z_parse_pos);
 		convert_to_long(z_parse_pos);
 		if (ZEND_LONG_INT_OVFL(Z_LVAL_P(z_parse_pos))) {
 			intl_error_set_code(NULL, U_ILLEGAL_ARGUMENT_ERROR);
@@ -188,6 +189,7 @@ PHP_FUNCTION(datefmt_localtime)
 	DATE_FORMAT_METHOD_FETCH_OBJECT;
 
 	if (z_parse_pos) {
+		ZVAL_DEREF(z_parse_pos);
 		convert_to_long(z_parse_pos);
 		if (ZEND_LONG_INT_OVFL(Z_LVAL_P(z_parse_pos))) {
 			intl_error_set_code(NULL, U_ILLEGAL_ARGUMENT_ERROR);

ext/intl/php_intl.c

@@ -1045,6 +1045,11 @@ PHP_RSHUTDOWN_FUNCTION( intl )
  */
 PHP_MINFO_FUNCTION( intl )
 {
+#if !UCONFIG_NO_FORMATTING
+	UErrorCode status = U_ZERO_ERROR;
+	const char *tzdata_ver = NULL;
+#endif
+
 	php_info_print_table_start();
 	php_info_print_table_header( 2, "Internationalization support", "enabled" );
 	php_info_print_table_row( 2, "version", INTL_MODULE_VERSION );
@@ -1052,6 +1057,13 @@ PHP_MINFO_FUNCTION( intl )
 #ifdef U_ICU_DATA_VERSION
 	php_info_print_table_row( 2, "ICU Data version", U_ICU_DATA_VERSION );
 #endif
+#if !UCONFIG_NO_FORMATTING
+	tzdata_ver = ucal_getTZDataVersion(&status);
+	if (U_ZERO_ERROR == status) {
+		php_info_print_table_row( 2, "ICU TZData version", tzdata_ver);
+	}
+#endif
+	php_info_print_table_row( 2, "ICU Unicode version", U_UNICODE_VERSION );
 	php_info_print_table_end();
 
     /* For the default locale php.ini setting */

ext/intl/spoofchecker/spoofchecker_class.h

@@ -78,4 +78,8 @@ extern zend_class_entry *Spoofchecker_ce_ptr;
         RETURN_FALSE;                                                           \
     }                                                                           \
 
+#if U_ICU_VERSION_MAJOR_NUM >= 58
+#define SPOOFCHECKER_DEFAULT_RESTRICTION_LEVEL USPOOF_HIGHLY_RESTRICTIVE
+#endif
+
 #endif // #ifndef SPOOFCHECKER_CLASS_H

ext/intl/spoofchecker/spoofchecker_create.c

@@ -43,12 +43,23 @@ PHP_METHOD(Spoofchecker, __construct)
 	co->uspoof = uspoof_open(SPOOFCHECKER_ERROR_CODE_P(co));
 	INTL_METHOD_CHECK_STATUS(co, "spoofchecker: unable to open ICU Spoof Checker");
 
+#if U_ICU_VERSION_MAJOR_NUM >= 58
+	/* TODO save it into the object for further suspiction check comparison. */
+	/* ICU 58 removes WSC and MSC handling. However there are restriction
+	 levels as defined in
+	 http://www.unicode.org/reports/tr39/tr39-15.html#Restriction_Level_Detection
+	 and the default is high restrictive. In further, we might want to utilize
+	 uspoof_check2 APIs when it became stable, to use extended check result APIs.
+	 Subsequent changes in the unicode security algos are to be watched.*/
+	uspoof_setRestrictionLevel(co->uspoof, SPOOFCHECKER_DEFAULT_RESTRICTION_LEVEL);
+#else
 	/* Single-script enforcement is on by default. This fails for languages
 	 like Japanese that legally use multiple scripts within a single word,
 	 so we turn it off.
 	*/
 	checks = uspoof_getChecks(co->uspoof, SPOOFCHECKER_ERROR_CODE_P(co));
 	uspoof_setChecks(co->uspoof, checks & ~USPOOF_SINGLE_SCRIPT, SPOOFCHECKER_ERROR_CODE_P(co));
+#endif
 	zend_restore_error_handling(&error_handling);
 }
 /* }}} */

ext/intl/tests/breakiter_getPartsIterator_basic.phpt

@@ -1,9 +1,11 @@
 --TEST--
-IntlBreakIterator::getPartsIterator(): basic test
+IntlBreakIterator::getPartsIterator(): basic test, ICU <= 57.1
 --SKIPIF--
 <?php
 if (!extension_loaded('intl'))
 	die('skip intl extension not enabled');
+if (version_compare(INTL_ICU_VERSION, '57.1') > 0) die('skip for ICU <= 57.1');
+?>
 --FILE--
 <?php
 ini_set("intl.error_level", E_WARNING);
@@ -34,4 +36,4 @@ Array
     [2] => bar
 )
 int(0)
-==DONE==
+==DONE==

ext/intl/tests/breakiter_getPartsIterator_basic2.phpt

@@ -0,0 +1,39 @@
+--TEST--
+IntlBreakIterator::getPartsIterator(): basic test, ICU >= 58.1
+--SKIPIF--
+<?php
+if (!extension_loaded('intl'))
+	die('skip intl extension not enabled');
+if (version_compare(INTL_ICU_VERSION, '57.1') <= 0) die('skip for ICU >= 58.1');
+?>
+--FILE--
+<?php
+ini_set("intl.error_level", E_WARNING);
+ini_set("intl.default_locale", "pt_PT");
+
+$bi = IntlBreakIterator::createWordInstance('pt');
+$pi = $bi->getPartsIterator();
+var_dump(get_class($pi));
+print_r(iterator_to_array($pi));
+
+$bi->setText("foo bar");
+$pi = $bi->getPartsIterator();
+var_dump(get_class($pi->getBreakIterator()));
+print_r(iterator_to_array($pi));
+var_dump($pi->getRuleStatus());
+?>
+==DONE==
+--EXPECTF--
+string(17) "IntlPartsIterator"
+Array
+(
+)
+string(26) "IntlRuleBasedBreakIterator"
+Array
+(
+    [0] => foo
+    [1] =>  
+    [2] => bar
+)
+int(%d)
+==DONE==

ext/intl/tests/breakiter_preceding_basic.phpt

@@ -1,9 +1,11 @@
 --TEST--
-IntlBreakIterator::preceding(): basic test
+IntlBreakIterator::preceding(): basic test, ICU <= 57.1
 --SKIPIF--
 <?php
 if (!extension_loaded('intl'))
 	die('skip intl extension not enabled');
+if (version_compare(INTL_ICU_VERSION, '57.1') > 0) die('skip for ICU <= 57.1');
+?>
 --FILE--
 <?php
 ini_set("intl.error_level", E_WARNING);
@@ -21,4 +23,4 @@ var_dump($bi->preceding(-1));
 int(4)
 int(21)
 int(0)
-==DONE==
+==DONE==

ext/intl/tests/breakiter_preceding_basic2.phpt

@@ -0,0 +1,25 @@
+--TEST--
+IntlBreakIterator::preceding(): basic test, ICU >= 58.1
+--SKIPIF--
+<?php
+if (!extension_loaded('intl'))
+	die('skip intl extension not enabled');
+if (version_compare(INTL_ICU_VERSION, '57.1') <= 0) die('skip for ICU >= 58.1');
+--FILE--
+<?php
+ini_set("intl.error_level", E_WARNING);
+ini_set("intl.default_locale", "pt_PT");
+
+$bi = IntlBreakIterator::createWordInstance('pt');
+$bi->setText('foo bar trans zoo bee');
+
+var_dump($bi->preceding(5));
+var_dump($bi->preceding(50));
+var_dump($bi->preceding(-1));
+?>
+==DONE==
+--EXPECTF--
+int(4)
+int(21)
+int(%i)
+==DONE==

ext/intl/tests/bug75317.phpt

@@ -0,0 +1,53 @@
+--TEST--
+Bug #75317 (UConverter::setDestinationEncoding changes source instead of destinatination)
+--SKIPIF--
+<?php
+if (!extension_loaded('intl')) die('skip intl extension is not available');
+?>
+--FILE--
+<?php
+$utf8 = UConverter::getAliases('utf-8')[0];
+$utf16 = UConverter::getAliases('utf-16')[0];
+$utf32 = UConverter::getAliases('utf-32')[0];
+$latin1 = UConverter::getAliases('latin1')[0];
+
+function printResult($actual, $expected) {
+    var_dump($actual === $expected ? true : "expected: $expected, actual: $actual");
+}
+
+// test default values
+$c = new UConverter();
+printResult($c->getDestinationEncoding(), $utf8);
+printResult($c->getSourceEncoding(), $utf8);
+
+// test constructor args
+$c = new UConverter('utf-16', 'latin1');
+printResult($c->getDestinationEncoding(), $utf16);
+printResult($c->getSourceEncoding(), $latin1);
+
+// test setters
+var_dump($c->setDestinationEncoding('utf-8'));
+var_dump($c->setSourceEncoding('utf-32'));
+printResult($c->getDestinationEncoding(), $utf8);
+printResult($c->getSourceEncoding(), $utf32);
+
+// test invalid inputs dont change values
+var_dump($c->setDestinationEncoding('foobar') === false);
+var_dump($c->setSourceEncoding('foobar') === false);
+printResult($c->getDestinationEncoding(), $utf8);
+printResult($c->getSourceEncoding(), $utf32);
+
+?>
+--EXPECT--
+bool(true)
+bool(true)
+bool(true)
+bool(true)
+bool(true)
+bool(true)
+bool(true)
+bool(true)
+bool(true)
+bool(true)
+bool(true)
+bool(true)

ext/intl/tests/bug75318.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Bug #75318 (The parameter of UConverter::getAliases() is not optional)
+--SKIP--
+<?php
+if (!extension_loaded('intl')) die('skip intl extension is not available');
+?>
+--FILE--
+<?php
+$rm = new ReflectionMethod('UConverter', 'getAliases');
+var_dump($rm->getNumberOfRequiredParameters());
+?>
+===DONE===
+--EXPECT--
+int(1)
+===DONE===

ext/intl/tests/bug75378.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Bug #75378 ([REGRESSION] IntlDateFormatter::parse() does not change $position argument)
+--SKIPIF--
+<?php
+if (!extension_loaded('intl')) die('skip this test requires ext/intl');
+?>
+--FILE--
+<?php
+
+$formatter = new IntlDateFormatter("en-GB", IntlDateFormatter::NONE, IntlDateFormatter::NONE, 'UTC', null, 'yyyy-MM-dd');
+$position = 0;
+$parsedDate = $formatter->parse("2017-10-12", $position);
+var_dump($position);
+$localdate = $formatter->localtime("2017-10-12 00:00:00", $position1);
+var_dump($position1);
+?>
+--EXPECT--
+int(10)
+int(10)