Update versions for PHP 7.2.14

Update NEWS for PHP 7.2.14
cleanup merge
2026-11-12 19:50:50 +00:00 · 2019-01-08 09:43:02 +00:00 · 2019-01-08 09:43:02 +00:00 · 2019-01-08 09:35:31 +01:00 · 2019-01-07 11:54:24 +01:00 · 2019-01-07 11:11:06 +01:00
92 changed files with 1554 additions and 662 deletions
@@ -1,3 +1,6 @@
+git:
+  quiet: true
+
 dist: trusty
 language: c
 sudo: required
@@ -1,6 +1,76 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2018, PHP 7.2.13
+10 Jan 2019, PHP 7.2.14
+
+- Core:
+  . Fixed bug #77369 (memcpy with negative length via crafted DNS response). (Stas)
+  . Fixed bug #71041 (zend_signal_startup() needs ZEND_API).
+    (Valentin V. Bartenev)
+  . Fixed bug #76046 (PHP generates "FE_FREE" opcode on the wrong line).
+    (Nikita)
+
+- COM:
+  . Fixed bug #77177 (Serializing or unserializing COM objects crashes). (cmb)
+
+- Date:
+  . Fixed bug #77097 (DateTime::diff gives wrong diff when the actual diff is
+    less than 1 second). (Derick)
+
+- Exif:
+  . Fixed bug #77184 (Unsigned rational numbers are written out as signed
+    rationals). (Colin Basnett)
+
+- GD:
+  . Fixed bug #77269 (efree() on uninitialized Heap data in imagescale leads to
+    use-after-free). (cmb)
+  . Fixed bug #77270 (imagecolormatch Out Of Bounds Write on Heap). (cmb)
+  . Fixed bug #77195 (Incorrect error handling of imagecreatefromjpeg()). (cmb)
+  . Fixed bug #77198 (auto cropping has insufficient precision). (cmb)
+  . Fixed bug #77200 (imagecropauto(…, GD_CROP_SIDES) crops left but not right).
+    (cmb)
+
+- IMAP:
+  . Fixed bug #77020 (null pointer dereference in imap_mail). (cmb)
+
+- Mbstring:
+  . Fixed bug #77370 (Buffer overflow on mb regex functions - fetch_token). (Stas)
+  . Fixed bug #77371 (heap buffer overflow in mb regex functions
+    - compile_string_node). (Stas)
+  . Fixed bug #77381 (heap buffer overflow in multibyte match_at). (Stas)
+  . Fixed bug #77382 (heap buffer overflow due to incorrect length in
+    expand_case_fold_string). (Stas)
+  . Fixed bug #77385 (buffer overflow in fetch_token). (Stas)
+  . Fixed bug #77394 (Buffer overflow in multibyte case folding - unicode). (Stas)
+  . Fixed bug #77418 (Heap overflow in utf32be_mbc_to_code). (Stas)
+
+- OCI8:
+  . Fixed bug #76804 (oci_pconnect with OCI_CRED_EXT not working). (KoenigsKind)
+  . Added oci_set_call_timeout() for call timeouts.
+  . Added oci_set_db_operation() for the DBOP end-to-end-tracing attribute.
+
+- Opcache:
+  . Fixed bug #77215 (CFG assertion failure on multiple finalizing switch
+    frees in one block). (Nikita)
+
+- PDO:
+  . Handle invalid index passed to PDOStatement::fetchColumn() as error. (Sergei
+    Morozov)
+
+- Phar:
+  . Fixed bug #77247 (heap buffer overflow in phar_detect_phar_fname_ext). (Stas)
+
+- Sockets:
+  . Fixed bug #77136 (Unsupported IPV6_RECVPKTINFO constants on macOS).
+    (Mizunashi Mana)
+
+- SQLite3:
+  . Fixed bug #77051 (Issue with re-binding on SQLite3). (BohwaZ)
+
+- Xmlrpc:
+  . Fixed bug #77242 (heap out of bounds read in xmlrpc_decode()). (cmb)
+  . Fixed bug #77380 (Global out of bounds read in xmlrpc base64 code). (Stas)
+
+06 Dec 2018, PHP 7.2.13

 - ftp:
  . Fixed bug #77151 (ftp_close(): SSL_read on shutdown). (Remi)
@@ -17,6 +87,10 @@ PHP                                                                        NEWS
  . Fixed bug #77147 (Fixing 60494 ignored ICONV_MIME_DECODE_CONTINUE_ON_ERROR).
    (cmb)

+- IMAP:
+  . Fixed bug #77153 (imap_open allows to run arbitrary shell commands via
+    mailbox parameter). (Stas)
+
 - ODBC:
  . Fixed bug #77079 (odbc_fetch_object has incorrect type signature).
    (Jon Allen)
@@ -99,6 +99,13 @@ PHP 7.2 UPGRADE NOTES
    from PHP 7.1 on 64-bit machines. This change was necessary to resolve a
    modulo bias bug in the implementation.

+- IMAP:
+  Starting with 7.2.13, rsh/ssh logins are disabled by default. Use
+  imap.enable_insecure_rsh if you want to enable them. Note that the IMAP
+  library does not filter mailbox names before passing them to rsh/ssh
+  command, thus passing untrusted data to this function with rsh/ssh enabled
+  is insecure.
+
 ========================================
 2. New Features
 ========================================
@@ -4797,6 +4797,10 @@ void zend_compile_foreach(zend_ast *ast) /* {{{ */

 	zend_compile_stmt(stmt_ast);

+	/* Place JMP and FE_FREE on the line where foreach starts. It would be
+	 * better to use the end line, but this information is not available
+	 * currently. */
+	CG(zend_lineno) = ast->lineno;
 	zend_emit_jump(opnum_fetch);

 	opline = &CG(active_op_array)->opcodes[opnum_reset];
@@ -399,7 +399,7 @@ void zend_signal_init(void) /* {{{ */

 /* {{{ zend_signal_startup
 * alloc zend signal globals */
-void zend_signal_startup(void)
+ZEND_API void zend_signal_startup(void)
 {

 #ifdef ZTS
@@ -89,7 +89,7 @@ ZEND_API void zend_signal_handler_unblock(void);
 void zend_signal_activate(void);
 void zend_signal_deactivate(void);
 BEGIN_EXTERN_C()
-void zend_signal_startup(void);
+ZEND_API void zend_signal_startup(void);
 END_EXTERN_C()
 void zend_signal_init(void);

@@ -107,8 +107,8 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=2
-PHP_RELEASE_VERSION=13
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=14
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -30,6 +30,7 @@
 #include "php_com_dotnet.h"
 #include "php_com_dotnet_internal.h"
 #include "Zend/zend_exceptions.h"
+#include "Zend/zend_interfaces.h"

 ZEND_DECLARE_MODULE_GLOBALS(com_dotnet)
 static PHP_GINIT_FUNCTION(com_dotnet);
@@ -354,6 +355,8 @@ PHP_MINIT_FUNCTION(com_dotnet)
 {
 	zend_class_entry ce, *tmp;

+	zend_hash_init(&com_dotnet_object_properties, 0, NULL, NULL, 0);
+
 	php_com_wrapper_minit(INIT_FUNC_ARGS_PASSTHRU);
 	php_com_persist_minit(INIT_FUNC_ARGS_PASSTHRU);

@@ -372,11 +375,15 @@ PHP_MINIT_FUNCTION(com_dotnet)
 	ce.create_object = php_com_object_new;
 	php_com_variant_class_entry = zend_register_internal_class(&ce);
 	php_com_variant_class_entry->get_iterator = php_com_iter_get;
+	php_com_variant_class_entry->serialize = zend_class_serialize_deny;
+	php_com_variant_class_entry->unserialize = zend_class_unserialize_deny;

 	INIT_CLASS_ENTRY(ce, "com", NULL);
 	ce.create_object = php_com_object_new;
 	tmp = zend_register_internal_class_ex(&ce, php_com_variant_class_entry);
 	tmp->get_iterator = php_com_iter_get;
+	tmp->serialize = zend_class_serialize_deny;
+	tmp->unserialize = zend_class_unserialize_deny;

 	zend_ts_hash_init(&php_com_typelibraries, 0, NULL, php_com_typelibrary_dtor, 1);

@@ -385,6 +392,8 @@ PHP_MINIT_FUNCTION(com_dotnet)
 	ce.create_object = php_com_object_new;
 	tmp = zend_register_internal_class_ex(&ce, php_com_variant_class_entry);
 	tmp->get_iterator = php_com_iter_get;
+	tmp->serialize = zend_class_serialize_deny;
+	tmp->unserialize = zend_class_unserialize_deny;
 #endif

 	REGISTER_INI_ENTRIES();
@@ -29,6 +29,8 @@
 #include "php_com_dotnet_internal.h"
 #include "Zend/zend_exceptions.h"

+const HashTable com_dotnet_object_properties;
+
 static zval *com_property_read(zval *object, zval *member, int type, void **cahce_slot, zval *rv)
 {
 	php_com_dotnet_object *obj;
@@ -231,7 +233,7 @@ static HashTable *com_properties_get(zval *object)
 	 * infinite recursion when the hash is displayed via var_dump().
 	 * Perhaps it is best to leave it un-implemented.
 	 */
-	return NULL;
+	return &com_dotnet_object_properties;
 }

 static void function_dtor(zval *zv)
@@ -31,6 +31,8 @@

 #include "zend_ts_hash.h"

+extern const HashTable com_dotnet_object_properties;
+
 typedef struct _php_com_dotnet_object {
 	zend_object zo;

@@ -0,0 +1,57 @@
+--TEST--
+Bug #77177 (Serializing or unserializing COM objects crashes)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+?>
+--FILE--
+<?php
+$com = new COM("WScript.Shell");
+$dotnet = new DOTNET("mscorlib", "System.Collections.Stack");
+$variant = new VARIANT;
+foreach ([$com, $dotnet, $variant] as $object) {
+    try {
+        serialize($object);
+    } catch (Exception $ex) {
+        echo "Exception: {$ex->getMessage()}\n";
+    }
+}
+
+$strings = ['C:3:"com":0:{}', 'C:6:"dotnet":0:{}', 'C:7:"variant":0:{}'];
+foreach ($strings as $string) {
+    try {
+        unserialize($string);
+    } catch (Exception $ex) {
+        echo "Exception: {$ex->getMessage()}\n";
+    }
+}
+
+$strings = ['O:3:"com":0:{}', 'O:6:"dotnet":0:{}', 'O:7:"variant":0:{}'];
+foreach ($strings as $string) {
+    var_dump(unserialize($string));
+}
+?>
+===DONE===
+--EXPECTF--
+Exception: Serialization of 'com' is not allowed
+Exception: Serialization of 'dotnet' is not allowed
+Exception: Serialization of 'variant' is not allowed
+Exception: Unserialization of 'com' is not allowed
+Exception: Unserialization of 'dotnet' is not allowed
+Exception: Unserialization of 'variant' is not allowed
+
+Warning: Erroneous data format for unserializing 'com' in %s on line %d
+
+Notice: unserialize(): Error at offset 13 of 14 bytes in %s on line %d
+bool(false)
+
+Warning: Erroneous data format for unserializing 'dotnet' in %s on line %d
+
+Notice: unserialize(): Error at offset 16 of 17 bytes in %s on line %d
+bool(false)
+
+Warning: Erroneous data format for unserializing 'variant' in %s on line %d
+
+Notice: unserialize(): Error at offset 17 of 18 bytes in %s on line %d
+bool(false)
+===DONE===
@@ -35,7 +35,10 @@ timelib_rel_time *timelib_diff(timelib_time *one, timelib_time *two)

 	rt = timelib_rel_time_ctor();
 	rt->invert = 0;
-	if (one->sse > two->sse) {
+	if (
+		(one->sse > two->sse) ||
+		(one->sse == two->sse && one->us > two->us)
+	) {
 		swp = two;
 		two = one;
 		one = swp;
@@ -310,9 +310,9 @@ typedef struct _timelib_tzdb {
 # define timelib_free    free
 #endif

-#define TIMELIB_VERSION 201708
-#define TIMELIB_EXTENDED_VERSION 20170800
-#define TIMELIB_ASCII_VERSION "2017.08"
+#define TIMELIB_VERSION 201709
+#define TIMELIB_EXTENDED_VERSION 20170900
+#define TIMELIB_ASCII_VERSION "2017.09"

 #define TIMELIB_NONE             0x00
 #define TIMELIB_OVERRIDE_TIME    0x01
@@ -0,0 +1,33 @@
+--TEST--
+Bug #77097 (DateTime::diff gives wrong diff when the actual diff is less than 1 second)
+--FILE--
+<?php
+$now = new DateTime('2018-11-03 11:34:20.781751');
+$ago = new DateTime('2018-11-03 11:34:20.000000');
+
+$diff = $now->diff($ago);
+var_dump($diff->invert, $diff->s, $diff->f);
+
+$diff = $ago->diff($now);
+var_dump($diff->invert, $diff->s, $diff->f);
+
+$diff = $now->diff($ago, true);
+var_dump($diff->invert, $diff->s, $diff->f);
+
+$diff = $ago->diff($now, true);
+var_dump($diff->invert, $diff->s, $diff->f);
+?>
+--EXPECTF--
+int(1)
+int(0)
+float(0.781751)
+int(0)
+int(0)
+float(0.781751)
+int(0)
+int(0)
+float(0.781751)
+int(0)
+int(0)
+float(0.781751)
+
@@ -2440,7 +2440,7 @@ static void add_assoc_image_info(zval *value, int sub_array, image_info_type *im
 									break;

 								case TAG_FMT_URATIONAL:
-									snprintf(buffer, sizeof(buffer), "%i/%i", info_value->ur.num, info_value->ur.den);
+									snprintf(buffer, sizeof(buffer), "%u/%u", info_value->ur.num, info_value->ur.den);
 									if (l==1) {
 										add_assoc_string(&tmpi, name, buffer);
 									} else {
@@ -0,0 +1,19 @@
+--TEST--
+Bug #74428 (Unsigned rational numbers are written out as signed rationals)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--INI--
+output_handler=
+zlib.output_compression=0
+--FILE--
+<?php
+$infile = dirname(__FILE__).'/DJI_0245_tiny.JPG';
+$tags = exif_read_data($infile);
+echo $tags['GPSLatitude'][2], PHP_EOL;
+echo $tags['GPSLongitude'][2], PHP_EOL;
+?>
+===DONE===
+--EXPECTF--
+156691934/70000000
+2672193571/70000000
+===DONE===
@@ -33,8 +33,8 @@ int gdImageColorMatch (gdImagePtr im1, gdImagePtr im2)
 		return -4; /* At least 1 color must be allocated */
 	}

-	buf = (unsigned long *)safe_emalloc(sizeof(unsigned long), 5 * im2->colorsTotal, 0);
-	memset( buf, 0, sizeof(unsigned long) * 5 * im2->colorsTotal );
+	buf = (unsigned long *)safe_emalloc(sizeof(unsigned long), 5 * gdMaxColors, 0);
+	memset( buf, 0, sizeof(unsigned long) * 5 * gdMaxColors );

 	for (x=0; x<im1->sx; x++) {
 		for( y=0; y<im1->sy; y++ ) {
@@ -163,30 +163,24 @@ gdImagePtr gdImageCropAuto(gdImagePtr im, const unsigned int mode)
 		}
 	}

-	/* Nothing to do > bye
-	 * Duplicate the image?
-	 */
-	if (y == height - 1) {
+	/* Whole image would be cropped > bye */
+	if (match) {
 		return NULL;
 	}

-	crop.y = y -1;
+	crop.y = y - 1;
+
 	match = 1;
 	for (y = height - 1; match && y >= 0; y--) {
 		for (x = 0; match && x < width; x++) {
 			match = (color == gdImageGetPixel(im, x,y));
 		}
 	}
-
-	if (y == 0) {
-		crop.height = height - crop.y + 1;
-	} else {
-		crop.height = y - crop.y + 2;
-	}
+	crop.height = y - crop.y + 2;

 	match = 1;
 	for (x = 0; match && x < width; x++) {
-		for (y = 0; match && y < crop.y + crop.height - 1; y++) {
+		for (y = 0; match && y < crop.y + crop.height; y++) {
 			match = (color == gdImageGetPixel(im, x,y));
 		}
 	}
@@ -194,12 +188,13 @@ gdImagePtr gdImageCropAuto(gdImagePtr im, const unsigned int mode)

 	match = 1;
 	for (x = width - 1; match && x >= 0; x--) {
-		for (y = 0; match &&  y < crop.y + crop.height - 1; y++) {
+		for (y = 0; match &&  y < crop.y + crop.height; y++) {
 			match = (color == gdImageGetPixel(im, x,y));
 		}
 	}
 	crop.width = x - crop.x + 2;
-	if (crop.x <= 0 || crop.y <= 0 || crop.width <= 0 || crop.height <= 0) {
+
+	if (crop.x < 0 || crop.y < 0 || crop.width <= 0 || crop.height <= 0) {
 		return NULL;
 	}
 	return gdImageCrop(im, &crop);
@@ -258,31 +253,24 @@ gdImagePtr gdImageCropThreshold(gdImagePtr im, const unsigned int color, const f
 		}
 	}

-	/* Pierre
-	 * Nothing to do > bye
-	 * Duplicate the image?
-	 */
-	if (y == height - 1) {
+	/* Whole image would be cropped > bye */
+	if (match) {
 		return NULL;
 	}

-	crop.y = y -1;
+	crop.y = y - 1;
+
 	match = 1;
 	for (y = height - 1; match && y >= 0; y--) {
 		for (x = 0; match && x < width; x++) {
 			match = (gdColorMatch(im, color, gdImageGetPixel(im, x, y), threshold)) > 0;
 		}
 	}
-
-	if (y == 0) {
-		crop.height = height - crop.y + 1;
-	} else {
-		crop.height = y - crop.y + 2;
-	}
+	crop.height = y - crop.y + 2;

 	match = 1;
 	for (x = 0; match && x < width; x++) {
-		for (y = 0; match && y < crop.y + crop.height - 1; y++) {
+		for (y = 0; match && y < crop.y + crop.height; y++) {
 			match = (gdColorMatch(im, color, gdImageGetPixel(im, x,y), threshold)) > 0;
 		}
 	}
@@ -290,7 +278,7 @@ gdImagePtr gdImageCropThreshold(gdImagePtr im, const unsigned int color, const f

 	match = 1;
 	for (x = width - 1; match && x >= 0; x--) {
-		for (y = 0; match &&  y < crop.y + crop.height - 1; y++) {
+		for (y = 0; match &&  y < crop.y + crop.height; y++) {
 			match = (gdColorMatch(im, color, gdImageGetPixel(im, x,y), threshold)) > 0;
 		}
 	}
@@ -327,7 +315,7 @@ static int gdGuessBackgroundColorFromCorners(gdImagePtr im, int *color)
 	} else if (tl == tr  || tl == bl || tl == br) {
 		*color = tl;
 		return 2;
-	} else if (tr == bl) {
+	} else if (tr == bl || tr == br) {
 		*color = tr;
 		return 2;
 	} else if (br == bl) {
@@ -890,8 +890,13 @@ static inline LineContribType * _gdContributionsAlloc(unsigned int line_length,
 {
 	unsigned int u = 0;
 	LineContribType *res;
-	int overflow_error = 0;
+	size_t weights_size;

+	if (overflow2(windows_size, sizeof(double))) {
+		return NULL;
+	} else {
+		weights_size = windows_size * sizeof(double);
+	}
 	res = (LineContribType *) gdMalloc(sizeof(LineContribType));
 	if (!res) {
 		return NULL;
@@ -908,15 +913,10 @@ static inline LineContribType * _gdContributionsAlloc(unsigned int line_length,
 		return NULL;
 	}
 	for (u = 0 ; u < line_length ; u++) {
-		if (overflow2(windows_size, sizeof(double))) {
-			overflow_error = 1;
-		} else {
-			res->ContribRow[u].Weights = (double *) gdMalloc(windows_size * sizeof(double));
-		}
-		if (overflow_error == 1 || res->ContribRow[u].Weights == NULL) {
+		res->ContribRow[u].Weights = (double *) gdMalloc(weights_size);
+		if (res->ContribRow[u].Weights == NULL) {
 			unsigned int i;
-			u--;
-			for (i=0;i<=u;i++) {
+			for (i=0;i<u;i++) {
 				gdFree(res->ContribRow[i].Weights);
 			}
 			gdFree(res->ContribRow);
@@ -67,14 +67,18 @@ static long php_jpeg_emit_message(j_common_ptr jpeg_info, int level)
 		 * unless strace_level >= 3
 		 */
 		if ((jpeg_info->err->num_warnings == 0) || (jpeg_info->err->trace_level >= 3)) {
-			gd_error_ex(ignore_warning ? GD_NOTICE : GD_WARNING, "gd-jpeg, libjpeg: recoverable error: %s\n", message);
+			if (!ignore_warning) {
+				gd_error("gd-jpeg, libjpeg: recoverable error: %s\n", message);
+			}
 		}

 		jpeg_info->err->num_warnings++;
 	} else {
 		/* strace msg, Show it if trace_level >= level. */
 		if (jpeg_info->err->trace_level >= level) {
-			gd_error_ex(GD_NOTICE, "gd-jpeg, libjpeg: strace message: %s\n", message);
+			if (!ignore_warning) {
+				gd_error("gd-jpeg, libjpeg: strace message: %s\n", message);
+			}
 		}
 	}
 	return 1;
@@ -86,9 +90,10 @@ static long php_jpeg_emit_message(j_common_ptr jpeg_info, int level)
 static void fatal_jpeg_error (j_common_ptr cinfo)
 {
 	jmpbuf_wrapper *jmpbufw;
+	char buffer[JMSG_LENGTH_MAX];

-	gd_error("gd-jpeg: JPEG library reports unrecoverable error: ");
-	(*cinfo->err->output_message) (cinfo);
+	(*cinfo->err->format_message)(cinfo, buffer);
+	gd_error_ex(GD_WARNING, "gd-jpeg: JPEG library reports unrecoverable error: %s", buffer);

 	jmpbufw = (jmpbuf_wrapper *) cinfo->client_data;
 	jpeg_destroy (cinfo);
@@ -0,0 +1,19 @@
+--TEST--
+Bug #77195 (Incorrect error handling of imagecreatefromjpeg())
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!gd_info()['JPEG Support']) die('skip JPEG support not available');
+?>
+--FILE--
+<?php
+$filename = __DIR__ . '/bug77195.jpeg';
+@imagecreatefromjpeg($filename);
+imagecreatefromjpeg($filename);
+?>
+===DONE===
+--EXPECTF--
+Warning: imagecreatefromjpeg(): gd-jpeg: JPEG library reports unrecoverable error: JPEG datastream contains no image in %s on line %d
+
+Warning: imagecreatefromjpeg(): '%s' is not a valid JPEG file in %s on line %d
+===DONE===
@@ -0,0 +1,50 @@
+--TEST--
+Bug #77198 (auto cropping has insufficient precision)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNDLED) die('upstream bugfix has not been released');
+?>
+--FILE--
+<?php
+
+function createWhiteImageWithBlackPixelAt($x, $y)
+{
+    $im = imagecreatetruecolor(8, 8);
+    imagefilledrectangle($im, 0, 0, 7, 7, 0xffffff);
+    imagesetpixel($im, $x, $y, 0x000000);
+    return $im;
+}
+
+for ($y = 0; $y < 8; $y++) {
+    for ($x = 0; $x < 8; $x++) {
+        if (($x == 0 && ($y == 0 || $y == 7)) || ($x == 7 && ($y == 0 || $y == 7))) {
+            continue; // skip the corners
+        }
+        $orig = createWhiteImageWithBlackPixelAt($x, $y);
+        $cropped = imagecropauto($orig, IMG_CROP_SIDES);
+        if (!$cropped) {
+            printf("Pixel at %d, %d: unexpected NULL crop\n", $x, $y);
+        } else {
+            $width = imagesx($cropped);
+            if ($width !== 1) {
+                printf("Pixel at %d, %d: unexpected width (%d)\n", $x, $y, $width);
+            }
+            $height = imagesy($cropped);
+            if ($height !== 1) {
+                printf("Pixel at %d, %d: unexpected height (%d)\n", $x, $y, $height);
+            }
+            $color = imagecolorat($cropped, 0, 0);
+            if ($color !== 0x000000) {
+                printf("Pixel at %d, %d: unexpected color (%d)\n", $x, $y, $color);
+            }
+            imagedestroy($cropped);
+        }
+        imagedestroy($orig);
+    }
+}
+
+?>
+===DONE===
+--EXPECT--
+===DONE===
@@ -0,0 +1,47 @@
+--TEST--
+Bug #77198 (threshold cropping has insufficient precision)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNDLED) die('upstream bugfix has not been released');
+?>
+--FILE--
+<?php
+
+function createWhiteImageWithBlackPixelAt($x, $y)
+{
+    $im = imagecreatetruecolor(8, 8);
+    imagefilledrectangle($im, 0, 0, 7, 7, 0xffffff);
+    imagesetpixel($im, $x, $y, 0x000000);
+    return $im;
+}
+
+for ($y = 0; $y < 8; $y++) {
+    for ($x = 0; $x < 8; $x++) {
+        $orig = createWhiteImageWithBlackPixelAt($x, $y);
+        $cropped = imagecropauto($orig, IMG_CROP_THRESHOLD, 1, 0xffffff);
+        if (!$cropped) {
+            printf("Pixel at %d, %d: unexpected NULL crop\n", $x, $y);
+        } else {
+            $width = imagesx($cropped);
+            if ($width !== 1) {
+                printf("Pixel at %d, %d: unexpected width (%d)\n", $x, $y, $width);
+            }
+            $height = imagesy($cropped);
+            if ($height !== 1) {
+                printf("Pixel at %d, %d: unexpected height (%d)\n", $x, $y, $height);
+            }
+            $color = imagecolorat($cropped, 0, 0);
+            if ($color !== 0x000000) {
+                printf("Pixel at %d, %d: unexpected color (%d)\n", $x, $y, $color);
+            }
+            imagedestroy($cropped);
+        }
+        imagedestroy($orig);
+    }
+}
+
+?>
+===DONE===
+--EXPECT--
+===DONE===
@@ -0,0 +1,37 @@
+--TEST--
+Bug #77200 (imagecropauto(…, GD_CROP_SIDES) crops left but not right)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNDLED) die('upstream bugfix has not been released');
+?>
+--FILE--
+<?php
+
+$orig = imagecreatetruecolor(8, 8);
+$red = imagecolorallocate($orig, 255, 0, 0);
+$green = imagecolorallocate($orig, 0, 255, 0);
+$blue = imagecolorallocate($orig, 0, 0, 255);
+
+imagefilledrectangle($orig, 0, 0, 3, 3, $green); // tl
+imagefilledrectangle($orig, 4, 0, 7, 3, $red);   // tr
+imagefilledrectangle($orig, 0, 4, 3, 7, $green); // bl
+imagefilledrectangle($orig, 4, 4, 7, 7, $blue);  // br
+
+$cropped = imagecropauto($orig, IMG_CROP_SIDES);
+var_dump(imagesx($cropped));
+
+imagefilledrectangle($orig, 0, 0, 3, 3, $red);   // tl
+imagefilledrectangle($orig, 4, 0, 7, 3, $green); // tr
+imagefilledrectangle($orig, 0, 4, 3, 7, $blue);  // bl
+imagefilledrectangle($orig, 4, 4, 7, 7, $green); // br
+
+$cropped = imagecropauto($orig, IMG_CROP_SIDES);
+var_dump(imagesx($cropped));
+
+?>
+===DONE===
+--EXPECT--
+int(4)
+int(4)
+===DONE===
@@ -0,0 +1,21 @@
+--TEST--
+Bug #77269 (Potential unsigned underflow in gdImageScale)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (getenv("SKIP_SLOW_TESTS")) die("skip slow test");
+?>
+--INI--
+memory_limit=2G
+--FILE--
+<?php
+$im = imagecreate(2**28, 1);
+if(is_resource($im)) {
+	imagescale($im, 1, 1, IMG_TRIANGLE);
+}
+?>
+===DONE===
+--EXPECTF--
+Warning: imagescale():%S product of memory allocation multiplication would exceed INT_MAX, failing operation gracefully
+ in %s on line %d
+===DONE===
@@ -0,0 +1,20 @@
+--TEST--
+Bug #77270 (imagecolormatch Out Of Bounds Write on Heap)
+--INI--
+memory_limit=-1
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.5', '<=')) die('skip upstream bugfix has not been released');
+?>
+--FILE--
+<?php
+$img1 = imagecreatetruecolor(0xfff, 0xfff);
+$img2 = imagecreate(0xfff, 0xfff);
+imagecolorallocate($img2, 0, 0, 0);
+imagesetpixel($img2, 0, 0, 255);
+imagecolormatch($img1, $img2);
+?>
+===DONE===
+--EXPECT--
+===DONE===
@@ -562,6 +562,15 @@ static const zend_module_dep imap_deps[] = {
 };
 /* }}} */

+
+/* {{{ PHP_INI
+ */
+PHP_INI_BEGIN()
+STD_PHP_INI_BOOLEAN("imap.enable_insecure_rsh", "0", PHP_INI_SYSTEM, OnUpdateBool, enable_rsh, zend_imap_globals, imap_globals)
+PHP_INI_END()
+/* }}} */
+
+
 /* {{{ imap_module_entry
 */
 zend_module_entry imap_module_entry = {
@@ -832,6 +841,8 @@ PHP_MINIT_FUNCTION(imap)
 {
 	unsigned long sa_all =	SA_MESSAGES | SA_RECENT | SA_UNSEEN | SA_UIDNEXT | SA_UIDVALIDITY;

+	REGISTER_INI_ENTRIES();
+
 #ifndef PHP_WIN32
 	mail_link(&unixdriver);		/* link in the unix driver */
 	mail_link(&mhdriver);		/* link in the mh driver */
@@ -1049,6 +1060,12 @@ PHP_MINIT_FUNCTION(imap)
 	GC_TEXTS               texts
 	*/

+	if (!IMAPG(enable_rsh)) {
+		/* disable SSH and RSH, see https://bugs.php.net/bug.php?id=77153 */
+		mail_parameters (NIL, SET_RSHTIMEOUT, 0);
+		mail_parameters (NIL, SET_SSHTIMEOUT, 0);
+	}
+
 	le_imap = zend_register_list_destructors_ex(mail_close_it, NULL, "imap", module_number);
 	return SUCCESS;
 }
@@ -1136,6 +1153,8 @@ PHP_MINFO_FUNCTION(imap)
 	php_info_print_table_row(2, "Kerberos Support", "enabled");
 #endif
 	php_info_print_table_end();
+
+	DISPLAY_INI_ENTRIES();
 }
 /* }}} */

@@ -4106,7 +4125,6 @@ PHP_FUNCTION(imap_mail)
 	if (!ZSTR_LEN(message)) {
 		/* this is not really an error, so it is allowed. */
 		php_error_docref(NULL, E_WARNING, "No message string in mail command");
-		message = NULL;
 	}

 	if (_php_imap_mail(ZSTR_VAL(to), ZSTR_VAL(subject), ZSTR_VAL(message), headers?ZSTR_VAL(headers):NULL, cc?ZSTR_VAL(cc):NULL,
@@ -231,6 +231,7 @@ ZEND_BEGIN_MODULE_GLOBALS(imap)
 #endif
 	/* php_stream for php_mail_gets() */
 	php_stream *gets_stream;
+	zend_bool enable_rsh;
 ZEND_END_MODULE_GLOBALS(imap)

 #ifdef ZTS
@@ -0,0 +1,15 @@
+--TEST--
+Bug #77020 (null pointer dereference in imap_mail)
+--SKIPIF--
+<?php
+if (!extension_loaded('imap')) die('skip imap extension not available');
+?>
+--FILE--
+<?php
+imap_mail('1', 1, NULL);
+?>
+===DONE===
+--EXPECTF--
+Warning: imap_mail(): No message string in mail command in %s on line %d
+%s
+===DONE===
@@ -0,0 +1,24 @@
+--TEST--                                 
+Bug #77153 (imap_open allows to run arbitrary shell commands via mailbox parameter)
+--SKIPIF--
+<?php
+        if (!extension_loaded("imap")) { 
+                die("skip imap extension not available");  
+        }
+?>
+--FILE--
+<?php
+$payload = "echo 'BUG'> " . __DIR__ . '/__bug';
+$payloadb64 = base64_encode($payload);
+$server = "x -oProxyCommand=echo\t$payloadb64|base64\t-d|sh}";
+@imap_open('{'.$server.':143/imap}INBOX', '', '');
+// clean
+imap_errors();
+var_dump(file_exists(__DIR__ . '/__bug'));
+?>
+--EXPECT--
+bool(false)
+--CLEAN--
+<?php
+if(file_exists(__DIR__ . '/__bug')) unlink(__DIR__ . '/__bug');
+?>
@@ -469,13 +469,13 @@ compile_length_string_node(Node* node, regex_t* reg)
  ambig = NSTRING_IS_AMBIG(node);

  p = prev = sn->s;
-  prev_len = enclen(enc, p);
+  SAFE_ENC_LEN(enc, p, sn->end, prev_len);
  p += prev_len;
  slen = 1;
  rlen = 0;

  for (; p < sn->end; ) {
-    len = enclen(enc, p);
+    SAFE_ENC_LEN(enc, p, sn->end, len);
    if (len == prev_len) {
      slen++;
    }
@@ -518,12 +518,12 @@ compile_string_node(Node* node, regex_t* reg)
  ambig = NSTRING_IS_AMBIG(node);

  p = prev = sn->s;
-  prev_len = enclen(enc, p);
+  SAFE_ENC_LEN(enc, p, end, prev_len);
  p += prev_len;
  slen = 1;

  for (; p < end; ) {
-    len = enclen(enc, p);
+    SAFE_ENC_LEN(enc, p, end, len);
    if (len == prev_len) {
      slen++;
    }
@@ -3435,7 +3435,7 @@ expand_case_fold_string(Node* node, regex_t* reg)
      goto err;
    }

-    len = enclen(reg->enc, p);
+	SAFE_ENC_LEN(reg->enc, p, end, len);

    if (n == 0) {
      if (IS_NULL(snode)) {
@@ -304,14 +304,17 @@ strdup_with_null(OnigEncoding enc, UChar* s, UChar* end)
  c = ONIGENC_MBC_TO_CODE(enc, p, end); \
  pfetch_prev = p; \
  p += ONIGENC_MBC_ENC_LEN(enc, p); \
+  if(UNEXPECTED(p > end)) p = end; \
 } while (0)

 #define PINC_S     do { \
  p += ONIGENC_MBC_ENC_LEN(enc, p); \
+  if(UNEXPECTED(p > end)) p = end; \
 } while (0)
 #define PFETCH_S(c) do { \
  c = ONIGENC_MBC_TO_CODE(enc, p, end); \
  p += ONIGENC_MBC_ENC_LEN(enc, p); \
+  if(UNEXPECTED(p > end)) p = end; \
 } while (0)

 #define PPEEK        (p < end ? ONIGENC_MBC_TO_CODE(enc, p, end) : PEND_VALUE)
@@ -3593,7 +3596,9 @@ fetch_token(OnigToken* tok, UChar** src, UChar* end, ScanEnv* env)
          tok->u.code = c2;
        }
        else { /* string */
-          p = tok->backp + enclen(enc, tok->backp);
+          int len;
+          SAFE_ENC_LEN(enc, tok->backp, end, len);
+          p = tok->backp + len;
        }
      }
      break;
@@ -348,4 +348,16 @@ extern int onig_print_names(FILE*, regex_t*);
 #endif
 #endif

+#if (defined (__GNUC__) && __GNUC__ > 2 ) && !defined(DARWIN) && !defined(__hpux) && !defined(_AIX)
+# define UNEXPECTED(condition) __builtin_expect(condition, 0)
+#else
+# define UNEXPECTED(condition) (condition)
+#endif
+
+#define SAFE_ENC_LEN(enc, p, end, res) do {  \
+    int __res = enclen(enc, p);              \
+    if (UNEXPECTED(p + __res > end)) __res = end - p;    \
+	res = __res;                             \
+} while(0);
+
 #endif /* REGPARSE_H */
@@ -82,16 +82,18 @@ utf16be_is_mbc_newline(const UChar* p, const UChar* end)
 }

 static OnigCodePoint
-utf16be_mbc_to_code(const UChar* p, const UChar* end ARG_UNUSED)
+utf16be_mbc_to_code(const UChar* p, const UChar* end)
 {
  OnigCodePoint code;

  if (UTF16_IS_SURROGATE_FIRST(*p)) {
+    if (end - p < 4) return 0;
    code = ((((p[0] - 0xd8) << 2) + ((p[1] & 0xc0) >> 6) + 1) << 16)
         + ((((p[1] & 0x3f) << 2) + (p[2] - 0xdc)) << 8)
         + p[3];
  }
  else {
+    if (end - p < 2) return 0;
    code = p[0] * 256 + p[1];
  }
  return code;
@@ -97,13 +97,14 @@ utf16le_is_mbc_newline(const UChar* p, const UChar* end)
 }

 static OnigCodePoint
-utf16le_mbc_to_code(const UChar* p, const UChar* end ARG_UNUSED)
+utf16le_mbc_to_code(const UChar* p, const UChar* end)
 {
  OnigCodePoint code;
  UChar c0 = *p;
  UChar c1 = *(p+1);

  if (UTF16_IS_SURROGATE_FIRST(c1)) {
+    if (end - p < 4) return 0;
    code = ((((c1 - 0xd8) << 2) + ((c0  & 0xc0) >> 6) + 1) << 16)
         + ((((c0 & 0x3f) << 2) + (p[3] - 0xdc)) << 8)
         + p[2];
@@ -67,6 +67,7 @@ utf32be_is_mbc_newline(const UChar* p, const UChar* end)
 static OnigCodePoint
 utf32be_mbc_to_code(const UChar* p, const UChar* end ARG_UNUSED)
 {
+  if (end - p < 4) return 0;
  return (OnigCodePoint )(((p[0] * 256 + p[1]) * 256 + p[2]) * 256 + p[3]);
 }

@@ -67,6 +67,7 @@ utf32le_is_mbc_newline(const UChar* p, const UChar* end)
 static OnigCodePoint
 utf32le_mbc_to_code(const UChar* p, const UChar* end ARG_UNUSED)
 {
+  if (end - p < 4) return 0;
  return (OnigCodePoint )(((p[3] * 256 + p[2]) * 256 + p[1]) * 256 + p[0]);
 }

@@ -0,0 +1,11 @@
+--TEST--
+Bug #77370 (Buffer overflow on mb regex functions - fetch_token)
+--SKIPIF--
+<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+--FILE--
+<?php
+var_dump(mb_split("   \xfd",""));
+?>
+--EXPECTF--
+Warning: mb_split(): mbregex compile err: invalid code point value in %sbug77370.php on line %d
+bool(false)
@@ -0,0 +1,11 @@
+--TEST--
+Bug #77371 (heap buffer overflow in mb regex functions - compile_string_node)
+--SKIPIF--
+<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+--FILE--
+<?php
+var_dump(mb_ereg("()0\xfc00000\xfc00000\xfc00000\xfc",""));
+?>
+--EXPECTF--
+Warning: mb_ereg(): mbregex compile err: invalid code point value in %sbug77371.php on line %d
+bool(false)
@@ -0,0 +1,23 @@
+--TEST--
+Bug #77381 (heap buffer overflow in multibyte match_at)
+--SKIPIF--
+<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+--FILE--
+<?php
+var_dump(mb_ereg("000||0\xfa","0"));
+var_dump(mb_ereg("(?i)000000000000000000000\xf0",""));
+var_dump(mb_ereg("0000\\"."\xf5","0"));
+var_dump(mb_ereg("(?i)FFF00000000000000000\xfd",""));
+?>
+--EXPECTF--
+Warning: mb_ereg(): mbregex compile err: invalid code point value in %sbug77381.php on line %d
+bool(false)
+
+Warning: mb_ereg(): mbregex compile err: invalid code point value in %sbug77381.php on line %d
+bool(false)
+
+Warning: mb_ereg(): mbregex compile err: invalid code point value in %sbug77381.php on line %d
+bool(false)
+
+Warning: mb_ereg(): mbregex compile err: invalid code point value in %sbug77381.php on line %d
+bool(false)
@@ -0,0 +1,14 @@
+--TEST--
+Bug #77371 (Heap overflow in utf32be_mbc_to_code)
+--SKIPIF--
+<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+--FILE--
+<?php
+mb_regex_encoding("UTF-32");
+var_dump(mb_split("\x00\x00\x00\x5c\x00\x00\x00B","000000000000000000000000000000"));
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  string(30) "000000000000000000000000000000"
+}
@@ -11,14 +11,14 @@ Use 'pecl install oci8-2.0.12' to install for PHP 5.2 - PHP 5.6.

 Use 'pecl install oci8-1.4.10' to install for PHP 4.3.9 - PHP 5.1.

-The OCI8 extension needs to be linked with Oracle 12, 11, or 10.2
+The OCI8 extension needs to be linked with Oracle 18, 12, 11, or 10.2
 client libraries.  These libraries are found in your database
 installation, or in the free Oracle Instant Client from
-http://www.oracle.com/technetwork/database/features/instant-client/
-Install the 'Basic' or 'Basic Lite' Instant Client package.  If
+https://www.oracle.com/technetwork/database/database-technologies/instant-client/overview/index.html
+Install the 'Basic' or 'Basic Light' Instant Client package.  If
 building from source, then also install the SDK package.

-Oracle's standard cross-version connectivity applies.  For example,
-PHP OCI8 linked with Instant Client 11.2 can connect to Oracle
-Database 9.2 onward.  See Oracle's note "Oracle Client / Server
+Oracle's standard cross-version interoperability applies.  For
+example, PHP OCI8 linked with Instant Client 11.2 can connect to
+Oracle Database 9.2 onward.  See Oracle's note "Oracle Client / Server
 Interoperability Support" (ID 207303.1) for details.
@@ -423,12 +423,15 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_oci_set_client_info, 0, 0, 2)
 	ZEND_ARG_INFO(0, client_information)
 ZEND_END_ARG_INFO()

-#ifdef WAITIING_ORACLE_BUG_16695981_FIX
 ZEND_BEGIN_ARG_INFO_EX(arginfo_oci_set_db_operation, 0, 0, 2)
-ZEND_ARG_INFO(0, connection_resource)
-ZEND_ARG_INFO(0, action)
+	ZEND_ARG_INFO(0, connection_resource)
+	ZEND_ARG_INFO(0, action)
+ZEND_END_ARG_INFO()
+
+ZEND_BEGIN_ARG_INFO_EX(arginfo_oci_set_call_timeout, 0, 0, 2)
+	ZEND_ARG_INFO(0, connection_resource)
+	ZEND_ARG_INFO(0, call_timeout)
 ZEND_END_ARG_INFO()
-#endif

 ZEND_BEGIN_ARG_INFO_EX(arginfo_oci_password_change, 0, 0, 4)
 	ZEND_ARG_INFO(0, connection_resource_or_connection_string)
@@ -672,9 +675,8 @@ PHP_FUNCTION(oci_statement_type);
 PHP_FUNCTION(oci_num_rows);
 PHP_FUNCTION(oci_set_prefetch);
 PHP_FUNCTION(oci_set_client_identifier);
-#ifdef WAITIING_ORACLE_BUG_16695981_FIX
 PHP_FUNCTION(oci_set_db_operation);
-#endif
+PHP_FUNCTION(oci_set_call_timeout);
 PHP_FUNCTION(oci_set_edition);
 PHP_FUNCTION(oci_set_module_name);
 PHP_FUNCTION(oci_set_action);
@@ -777,9 +779,8 @@ static const zend_function_entry php_oci_functions[] = {
 	PHP_FE(oci_new_descriptor,			arginfo_oci_new_descriptor)
 	PHP_FE(oci_set_prefetch,			arginfo_oci_set_prefetch)
 	PHP_FE(oci_set_client_identifier,	arginfo_oci_set_client_identifier)
-#ifdef WAITIING_ORACLE_BUG_16695981_FIX
 	PHP_FE(oci_set_db_operation,		arginfo_oci_set_db_operation)
-#endif
+	PHP_FE(oci_set_call_timeout,		arginfo_oci_set_call_timeout)
 	PHP_FE(oci_set_edition,				arginfo_oci_set_edition)
 	PHP_FE(oci_set_module_name,			arginfo_oci_set_module_name)
 	PHP_FE(oci_set_action,				arginfo_oci_set_action)
@@ -1455,11 +1456,7 @@ void php_oci_column_hash_dtor(zval *data)
 		if (GC_REFCOUNT(column->descid) == 1)
 			zend_list_close(column->descid);
 		else {
-#if PHP_VERSION_ID < 70300
-			GC_REFCOUNT(column->descid)--;
-#else
 			GC_DELREF(column->descid);
-#endif
 		}
 	}

@@ -1634,9 +1631,14 @@ void php_oci_do_connect(INTERNAL_FUNCTION_PARAMETERS, int persistent, int exclus
 	zend_long session_mode = OCI_DEFAULT;

 	/* if a fourth parameter is handed over, it is the charset identifier (but is only used in Oracle 9i+) */
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "ss|ssl", &username, &username_len, &password, &password_len, &dbname, &dbname_len, &charset, &charset_len, &session_mode) == FAILURE) {
-		return;
-	}
+	ZEND_PARSE_PARAMETERS_START(2, 5)
+		Z_PARAM_STRING(username, username_len)
+		Z_PARAM_STRING(password, password_len)
+		Z_PARAM_OPTIONAL
+		Z_PARAM_STRING(dbname, dbname_len)
+		Z_PARAM_STRING(charset, charset_len)
+		Z_PARAM_LONG(session_mode)
+	ZEND_PARSE_PARAMETERS_END();

 #ifdef HAVE_OCI8_DTRACE
 	if (DTRACE_OCI8_CONNECT_ENTRY_ENABLED()) {
@@ -1882,11 +1884,7 @@ php_oci_connection *php_oci_do_connect_ex(char *username, int username_len, char
 									(memcmp(ZSTR_VAL(tmp->hash_key), ZSTR_VAL(hashed_details.s),
 									 ZSTR_LEN(tmp->hash_key)) == 0)) {
 									connection = tmp;
-#if PHP_VERSION_ID < 70300
-									++GC_REFCOUNT(connection->id);
-#else
 									GC_ADDREF(connection->id);
-#endif
 								}
 							} else {
 								PHP_OCI_REGISTER_RESOURCE(connection, le_pconnection);
@@ -1896,11 +1894,7 @@ php_oci_connection *php_oci_do_connect_ex(char *username, int username_len, char
 								 * decremented in the persistent helper
 								 */
 								if (OCI_G(old_oci_close_semantics)) {
-#if PHP_VERSION_ID < 70300
-									++GC_REFCOUNT(connection->id);
-#else
 									GC_ADDREF(connection->id);
-#endif
 								}
 							}
 							smart_str_free(&hashed_details);
@@ -1911,11 +1905,7 @@ php_oci_connection *php_oci_do_connect_ex(char *username, int username_len, char
 				} else {
 					/* we do not ping non-persistent connections */
 					smart_str_free(&hashed_details);
-#if PHP_VERSION_ID < 70300
-					++GC_REFCOUNT(connection->id);
-#else
 					GC_ADDREF(connection->id);
-#endif
 					return connection;
 				}
 			} /* is_open is true? */
@@ -2069,11 +2059,7 @@ php_oci_connection *php_oci_do_connect_ex(char *username, int username_len, char
 		 * refcount is decremented in the persistent helper
 		 */
 		if (OCI_G(old_oci_close_semantics)) {
-#if PHP_VERSION_ID < 70300
-			++GC_REFCOUNT(connection->id);
-#else
 			GC_ADDREF(connection->id);
-#endif
 		}
 #if PHP_VERSION_ID < 70300
 		zend_hash_update_mem(&EG(persistent_list), connection->hash_key, (void *)&new_le, sizeof(zend_resource));
@@ -2371,7 +2357,6 @@ int php_oci_connection_release(php_oci_connection *connection)
 		connection->svc = NULL;
 		connection->server = NULL;
 		connection->session = NULL;
-		connection->id = NULL;

 		connection->is_attached = connection->is_open = connection->rb_on_disconnect = connection->used_this_request = 0;
 		connection->is_stub = 1;
@@ -2388,6 +2373,9 @@ int php_oci_connection_release(php_oci_connection *connection)
 #endif /* HAVE_OCI8_DTRACE */
 	}

+	/* Always set id to null, so next time a new resource is being registered. */
+	connection->id = NULL;
+
 	OCI_G(in_call) = in_call_save;
 	return result;
 }
@@ -2474,11 +2462,7 @@ int php_oci_column_to_zval(php_oci_out_column *column, zval *value, int mode)

 	if (column->is_cursor) { /* REFCURSOR -> simply return the statement id */
 		ZVAL_RES(value, column->stmtid);
-#if PHP_VERSION_ID < 70300
-		++GC_REFCOUNT(column->stmtid);
-#else
 		GC_ADDREF(column->stmtid);
-#endif
 	} else if (column->is_descr) {

 		if (column->data_type != SQLT_RDD) {
@@ -2487,7 +2471,7 @@ int php_oci_column_to_zval(php_oci_out_column *column, zval *value, int mode)
 			descriptor = (php_oci_descriptor *) column->descid->ptr;

 			if (!descriptor) {
-				php_error_docref(NULL, E_WARNING, "Unable to find LOB descriptor #%d", column->descid);
+				php_error_docref(NULL, E_WARNING, "Unable to find LOB descriptor #%d", column->descid->handle);
 				return 1;
 			}

@@ -2522,11 +2506,7 @@ int php_oci_column_to_zval(php_oci_out_column *column, zval *value, int mode)
 			/* return the locator */
 			object_init_ex(value, oci_lob_class_entry_ptr);
 			add_property_resource(value, "descriptor", column->descid);
-#if PHP_VERSION_ID < 70300
-			++GC_REFCOUNT(column->descid);
-#else
 			GC_ADDREF(column->descid);
-#endif
 		}
 	} else {
 		switch (column->retcode) {
@@ -2573,9 +2553,12 @@ void php_oci_fetch_row (INTERNAL_FUNCTION_PARAMETERS, int mode, int expected_arg
 	if (expected_args > 2) {
 		/* only for ocifetchinto BC */

-		if (zend_parse_parameters(ZEND_NUM_ARGS(), "rz|l", &z_statement, &array, &fetch_mode) == FAILURE) {
-			return;
-		}
+		ZEND_PARSE_PARAMETERS_START(2, 3)
+			Z_PARAM_RESOURCE(z_statement)
+			Z_PARAM_ZVAL(array)
+			Z_PARAM_OPTIONAL
+			Z_PARAM_LONG(fetch_mode)
+		ZEND_PARSE_PARAMETERS_END();

 		if (ZEND_NUM_ARGS() == 2) {
 			fetch_mode = mode;
@@ -2589,9 +2572,11 @@ void php_oci_fetch_row (INTERNAL_FUNCTION_PARAMETERS, int mode, int expected_arg
 	} else if (expected_args == 2) {
 		/* only for oci_fetch_array() */

-		if (zend_parse_parameters(ZEND_NUM_ARGS(), "r|l", &z_statement, &fetch_mode) == FAILURE) {
-			return;
-		}
+		ZEND_PARSE_PARAMETERS_START(1, 2)
+			Z_PARAM_RESOURCE(z_statement)
+			Z_PARAM_OPTIONAL
+			Z_PARAM_LONG(fetch_mode)
+		ZEND_PARSE_PARAMETERS_END();

 		if (ZEND_NUM_ARGS() == 1) {
 			fetch_mode = mode;
@@ -2599,9 +2584,9 @@ void php_oci_fetch_row (INTERNAL_FUNCTION_PARAMETERS, int mode, int expected_arg
 	} else {
 		/* for all oci_fetch_*() */

-		if (zend_parse_parameters(ZEND_NUM_ARGS(), "r", &z_statement) == FAILURE) {
-			return;
-		}
+		ZEND_PARSE_PARAMETERS_START(1, 1)
+			Z_PARAM_RESOURCE(z_statement)
+		ZEND_PARSE_PARAMETERS_END();

 		fetch_mode = mode;
 	}
@@ -129,9 +129,13 @@ PHP_FUNCTION(oci_define_by_name)
 	php_oci_define *define;
 	zend_string *zvtmp;

-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "rsz|l", &stmt, &name, &name_len, &var, &type) == FAILURE) {
-		return;
-	}
+	ZEND_PARSE_PARAMETERS_START(3, 4)
+		Z_PARAM_RESOURCE(stmt)
+		Z_PARAM_STRING(name, name_len)
+		Z_PARAM_ZVAL(var)
+		Z_PARAM_OPTIONAL
+		Z_PARAM_LONG(type)
+	ZEND_PARSE_PARAMETERS_END();

 	if (!name_len) {
 		php_error_docref(NULL, E_WARNING, "Column name cannot be empty");
@@ -193,9 +197,14 @@ PHP_FUNCTION(oci_bind_by_name)
 	zval *bind_var = NULL;
 	php_oci_statement *statement;

-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "rsz|ll", &z_statement, &name, &name_len, &bind_var, &maxlen, &type) == FAILURE) {
-		return;
-	}
+	ZEND_PARSE_PARAMETERS_START(3, 5)
+		Z_PARAM_RESOURCE(z_statement)
+		Z_PARAM_STRING(name, name_len)
+		Z_PARAM_ZVAL(bind_var)
+		Z_PARAM_OPTIONAL
+		Z_PARAM_LONG(maxlen)
+		Z_PARAM_LONG(type)
+	ZEND_PARSE_PARAMETERS_END();

 	if (type) {
 		bind_type = (ub2) type;
@@ -223,9 +232,15 @@ PHP_FUNCTION(oci_bind_array_by_name)
 	zval *bind_var = NULL;
 	php_oci_statement *statement;

-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "rszl|ll", &z_statement, &name, &name_len, &bind_var, &max_array_len, &max_item_len, &type) == FAILURE) {
-		return;
-	}
+	ZEND_PARSE_PARAMETERS_START(4, 6)
+		Z_PARAM_RESOURCE(z_statement)
+		Z_PARAM_STRING(name, name_len)
+		Z_PARAM_ZVAL(bind_var)
+		Z_PARAM_LONG(max_array_len)
+		Z_PARAM_OPTIONAL
+		Z_PARAM_LONG(max_item_len)
+		Z_PARAM_LONG(type)
+	ZEND_PARSE_PARAMETERS_END();

 	PHP_OCI_ZVAL_TO_STATEMENT(z_statement, statement);

@@ -1157,9 +1172,9 @@ PHP_FUNCTION(oci_rollback)
 	zval *z_connection;
 	php_oci_connection *connection;

-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "r", &z_connection) == FAILURE) {
-		return;
-	}
+	ZEND_PARSE_PARAMETERS_START(1, 1)
+		Z_PARAM_RESOURCE(z_connection)
+	ZEND_PARSE_PARAMETERS_END();

 	PHP_OCI_ZVAL_TO_CONNECTION(z_connection, connection);

@@ -1181,9 +1196,9 @@ PHP_FUNCTION(oci_commit)
 	zval *z_connection;
 	php_oci_connection *connection;

-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "r", &z_connection) == FAILURE) {
-		return;
-	}
+	ZEND_PARSE_PARAMETERS_START(1, 1)
+		Z_PARAM_RESOURCE(z_connection)
+	ZEND_PARSE_PARAMETERS_END();

 	PHP_OCI_ZVAL_TO_CONNECTION(z_connection, connection);

@@ -1379,9 +1394,11 @@ PHP_FUNCTION(oci_execute)
 	php_oci_statement *statement;
 	zend_long mode = OCI_COMMIT_ON_SUCCESS;

-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "r|l", &z_statement, &mode) == FAILURE) {
-		return;
-	}
+	ZEND_PARSE_PARAMETERS_START(1, 2)
+		Z_PARAM_RESOURCE(z_statement)
+		Z_PARAM_OPTIONAL
+		Z_PARAM_LONG(mode)
+	ZEND_PARSE_PARAMETERS_END();

 	PHP_OCI_ZVAL_TO_STATEMENT(z_statement, statement);

@@ -1420,9 +1437,9 @@ PHP_FUNCTION(oci_fetch)
 	php_oci_statement *statement;
 	ub4 nrows = 1; /* only one row at a time is supported for now */

-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "r", &z_statement) == FAILURE) {
-		return;
-	}
+	ZEND_PARSE_PARAMETERS_START(1, 1)
+		Z_PARAM_RESOURCE(z_statement)
+	ZEND_PARSE_PARAMETERS_END();

 	PHP_OCI_ZVAL_TO_STATEMENT(z_statement, statement);

@@ -1454,9 +1471,14 @@ PHP_FUNCTION(oci_fetch_all)
 	int i;
 	zend_long rows = 0, flags = 0, skip = 0, maxrows = -1;

-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "rz/|lll", &z_statement, &array, &skip, &maxrows, &flags) == FAILURE) {
-		return;
-	}
+	ZEND_PARSE_PARAMETERS_START(2, 5)
+		Z_PARAM_RESOURCE(z_statement)
+		Z_PARAM_ZVAL_DEREF_EX(array, 0, 1)
+		Z_PARAM_OPTIONAL
+		Z_PARAM_LONG(skip)
+		Z_PARAM_LONG(maxrows)
+		Z_PARAM_LONG(flags)
+	ZEND_PARSE_PARAMETERS_END();

 	PHP_OCI_ZVAL_TO_STATEMENT(z_statement, statement);

@@ -1604,9 +1626,9 @@ PHP_FUNCTION(oci_free_statement)
 	zval *z_statement;
 	php_oci_statement *statement;

-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "r", &z_statement) == FAILURE) {
-		return;
-	}
+	ZEND_PARSE_PARAMETERS_START(1, 1)
+		Z_PARAM_RESOURCE(z_statement)
+	ZEND_PARSE_PARAMETERS_END();

 	PHP_OCI_ZVAL_TO_STATEMENT(z_statement, statement);

@@ -1634,9 +1656,9 @@ PHP_FUNCTION(oci_close)
 		return;
 	}

-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "r", &z_connection) == FAILURE) {
-		return;
-	}
+	ZEND_PARSE_PARAMETERS_START(1, 1)
+		Z_PARAM_RESOURCE(z_connection)
+	ZEND_PARSE_PARAMETERS_END();

 	PHP_OCI_ZVAL_TO_CONNECTION(z_connection, connection);
 	if (GC_REFCOUNT(connection->id) == 2) { /* CHANGED VERSION::PHP7
@@ -1692,9 +1714,10 @@ PHP_FUNCTION(oci_error)
 	ub2 error_offset = 0;
 	text *sqltext = NULL;

-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "|r", &arg) == FAILURE) {
-		return;
-	}
+	ZEND_PARSE_PARAMETERS_START(0, 1)
+		Z_PARAM_OPTIONAL
+		Z_PARAM_RESOURCE(arg)
+	ZEND_PARSE_PARAMETERS_END();

 	if (ZEND_NUM_ARGS() > 0) {
 		statement = (php_oci_statement *) zend_fetch_resource_ex(arg, NULL, le_statement);
@@ -1758,9 +1781,9 @@ PHP_FUNCTION(oci_num_fields)
 	zval *z_statement;
 	php_oci_statement *statement;

-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "r", &z_statement) == FAILURE) {
-		return;
-	}
+	ZEND_PARSE_PARAMETERS_START(1, 1)
+		Z_PARAM_RESOURCE(z_statement)
+	ZEND_PARSE_PARAMETERS_END();

 	PHP_OCI_ZVAL_TO_STATEMENT(z_statement, statement);

@@ -1778,9 +1801,10 @@ PHP_FUNCTION(oci_parse)
 	char *query;
 	size_t query_len;

-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "rs", &z_connection, &query, &query_len) == FAILURE) {
-		return;
-	}
+	ZEND_PARSE_PARAMETERS_START(2, 2)
+		Z_PARAM_RESOURCE(z_connection)
+		Z_PARAM_STRING(query, query_len)
+	ZEND_PARSE_PARAMETERS_END();

 	PHP_OCI_ZVAL_TO_CONNECTION(z_connection, connection);

@@ -1801,9 +1825,10 @@ PHP_FUNCTION(oci_set_prefetch)
 	php_oci_statement *statement;
 	zend_long size;

-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "rl", &z_statement, &size) == FAILURE) {
-		return;
-	}
+	ZEND_PARSE_PARAMETERS_START(2, 2)
+		Z_PARAM_RESOURCE(z_statement)
+		Z_PARAM_LONG(size)
+	ZEND_PARSE_PARAMETERS_END();

 	PHP_OCI_ZVAL_TO_STATEMENT(z_statement, statement);

@@ -1829,9 +1854,10 @@ PHP_FUNCTION(oci_set_client_identifier)
 	size_t client_id_len;
 	sword errstatus;

-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "rs", &z_connection, &client_id, &client_id_len) == FAILURE) {
-		return;
-	}
+	ZEND_PARSE_PARAMETERS_START(2, 2)
+		Z_PARAM_RESOURCE(z_connection)
+		Z_PARAM_STRING(client_id, client_id_len)
+	ZEND_PARSE_PARAMETERS_END();

 	PHP_OCI_ZVAL_TO_CONNECTION(z_connection, connection);

@@ -1878,9 +1904,9 @@ PHP_FUNCTION(oci_set_edition)
 	char *edition;
 	size_t edition_len;

-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "s", &edition, &edition_len) == FAILURE) {
-		return;
-	}
+	ZEND_PARSE_PARAMETERS_START(1, 1)
+		Z_PARAM_STRING(edition, edition_len)
+	ZEND_PARSE_PARAMETERS_END();

 	if (OCI_G(edition)) {
 		efree(OCI_G(edition));
@@ -1913,9 +1939,10 @@ PHP_FUNCTION(oci_set_module_name)
 	size_t module_len;
 	sword errstatus;

-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "rs", &z_connection, &module, &module_len) == FAILURE) {
-		return;
-	}
+	ZEND_PARSE_PARAMETERS_START(2, 2)
+		Z_PARAM_RESOURCE(z_connection)
+		Z_PARAM_STRING(module, module_len)
+	ZEND_PARSE_PARAMETERS_END();

 	PHP_OCI_ZVAL_TO_CONNECTION(z_connection, connection);

@@ -1945,9 +1972,10 @@ PHP_FUNCTION(oci_set_action)
 	size_t action_len;
 	sword errstatus;

-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "rs", &z_connection, &action, &action_len) == FAILURE) {
-		return;
-	}
+	ZEND_PARSE_PARAMETERS_START(2, 2)
+		Z_PARAM_RESOURCE(z_connection)
+		Z_PARAM_STRING(action, action_len)
+	ZEND_PARSE_PARAMETERS_END();

 	PHP_OCI_ZVAL_TO_CONNECTION(z_connection, connection);

@@ -1977,9 +2005,10 @@ PHP_FUNCTION(oci_set_client_info)
 	size_t client_info_len;
 	sword errstatus;

-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "rs", &z_connection, &client_info, &client_info_len) == FAILURE) {
-		return;
-	}
+	ZEND_PARSE_PARAMETERS_START(2, 2)
+		Z_PARAM_RESOURCE(z_connection)
+		Z_PARAM_STRING(client_info, client_info_len)
+	ZEND_PARSE_PARAMETERS_END();

 	PHP_OCI_ZVAL_TO_CONNECTION(z_connection, connection);

@@ -1998,9 +2027,9 @@ PHP_FUNCTION(oci_set_client_info)
 }
 /* }}} */

-#ifdef WAITIING_ORACLE_BUG_16695981_FIX
 /* {{{ proto bool oci_set_db_operation(resource connection, string value)
-   Sets the "DB operation" on the connection for Oracle end-to-end tracing */
+   Sets the "DB operation" on the connection for Oracle end-to-end tracing.
+   For history, see Oracle bug 16695981 */
 PHP_FUNCTION(oci_set_db_operation)
 {
 #if (OCI_MAJOR_VERSION > 11)
@@ -2009,9 +2038,10 @@ PHP_FUNCTION(oci_set_db_operation)
 	char *dbop_name;
 	size_t dbop_name_len;

-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "rs", &z_connection, &dbop_name, &dbop_name_len) == FAILURE) {
-		return;
-	}
+	ZEND_PARSE_PARAMETERS_START(2, 2)
+		Z_PARAM_RESOURCE(z_connection)
+		Z_PARAM_STRING(dbop_name, dbop_name_len)
+	ZEND_PARSE_PARAMETERS_END();

 	PHP_OCI_ZVAL_TO_CONNECTION(z_connection, connection);

@@ -2028,7 +2058,36 @@ PHP_FUNCTION(oci_set_db_operation)
 #endif
 }
 /* }}} */
-#endif /* WAITIING_ORACLE_BUG_16695981_FIX */
+
+/* {{{ proto bool oci_set_call_timeout(resource connection, int call_timeout)
+ */
+PHP_FUNCTION(oci_set_call_timeout)
+{
+#if (OCI_MAJOR_VERSION >= 18)
+	zval *z_connection;
+	php_oci_connection *connection;
+	zend_long call_timeout;  // milliseconds
+
+	ZEND_PARSE_PARAMETERS_START(2, 2)
+		Z_PARAM_RESOURCE(z_connection)
+		Z_PARAM_LONG(call_timeout)
+	ZEND_PARSE_PARAMETERS_END();
+
+	PHP_OCI_ZVAL_TO_CONNECTION(z_connection, connection);
+
+	PHP_OCI_CALL_RETURN(OCI_G(errcode), OCIAttrSet, ((dvoid *) connection->svc, (ub4) OCI_HTYPE_SVCCTX, (ub4 *) &call_timeout, 0, OCI_ATTR_CALL_TIMEOUT, OCI_G(err)));
+
+	if (OCI_G(errcode) != OCI_SUCCESS) {
+		php_oci_error(OCI_G(err), OCI_G(errcode));
+		RETURN_FALSE;
+	}
+	RETURN_TRUE;
+#else
+	php_error_docref(NULL, E_NOTICE, "Unsupported with this version of Oracle Client");
+	RETURN_FALSE;
+#endif
+}
+/* }}} */

 /* {{{ proto bool oci_password_change(resource connection, string username, string old_password, string new_password)
  Changes the password of an account */
@@ -2092,9 +2151,9 @@ PHP_FUNCTION(oci_new_cursor)
 	php_oci_connection *connection;
 	php_oci_statement *statement;

-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "r", &z_connection) == FAILURE) {
-		return;
-	}
+	ZEND_PARSE_PARAMETERS_START(1, 1)
+		Z_PARAM_RESOURCE(z_connection)
+	ZEND_PARSE_PARAMETERS_END();

 	PHP_OCI_ZVAL_TO_CONNECTION(z_connection, connection);

@@ -2143,9 +2202,9 @@ PHP_FUNCTION(oci_server_version)
 	char version[256];
 	zend_string *ret;

-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "r", &z_connection) == FAILURE) {
-		return;
-	}
+	ZEND_PARSE_PARAMETERS_START(1, 1)
+		Z_PARAM_RESOURCE(z_connection)
+	ZEND_PARSE_PARAMETERS_END();

 	PHP_OCI_ZVAL_TO_CONNECTION(z_connection, connection);

@@ -2166,9 +2225,9 @@ PHP_FUNCTION(oci_statement_type)
 	php_oci_statement *statement;
 	ub2 type;

-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "r", &z_statement) == FAILURE) {
-		return;
-	}
+	ZEND_PARSE_PARAMETERS_START(1, 1)
+		Z_PARAM_RESOURCE(z_statement)
+	ZEND_PARSE_PARAMETERS_END();

 	PHP_OCI_ZVAL_TO_STATEMENT(z_statement, statement);

@@ -2221,9 +2280,9 @@ PHP_FUNCTION(oci_num_rows)
 	php_oci_statement *statement;
 	ub4 rowcount;

-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "r", &z_statement) == FAILURE) {
-		return;
-	}
+	ZEND_PARSE_PARAMETERS_START(1, 1)
+		Z_PARAM_RESOURCE(z_statement)
+	ZEND_PARSE_PARAMETERS_END();

 	PHP_OCI_ZVAL_TO_STATEMENT(z_statement, statement);

@@ -2524,9 +2583,9 @@ PHP_FUNCTION(oci_get_implicit_resultset)
 	php_oci_statement *statement;
 	php_oci_statement *imp_statement;

-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "r", &z_statement) == FAILURE) {
-		return;
-	}
+	ZEND_PARSE_PARAMETERS_START(1, 1)
+		Z_PARAM_RESOURCE(z_statement)
+	ZEND_PARSE_PARAMETERS_END();

 	PHP_OCI_ZVAL_TO_STATEMENT(z_statement, statement);

@@ -67,11 +67,7 @@ php_oci_descriptor *php_oci_lob_create (php_oci_connection *connection, zend_lon
 	descriptor = ecalloc(1, sizeof(php_oci_descriptor));
 	descriptor->type = (ub4) type;
 	descriptor->connection = connection;
-#if PHP_VERSION_ID < 70300
-	++GC_REFCOUNT(descriptor->connection->id);
-#else
 	GC_ADDREF(descriptor->connection->id);
-#endif

 	PHP_OCI_CALL_RETURN(errstatus, OCIDescriptorAlloc, (connection->env, (dvoid*)&(descriptor->descriptor), descriptor->type, (size_t) 0, (dvoid **) 0));

@@ -111,11 +111,7 @@ php_oci_statement *php_oci_statement_create(php_oci_connection *connection, char
 	statement->impres_child_stmt = NULL;
 	statement->impres_count = 0;
 	statement->impres_flag = PHP_OCI_IMPRES_UNKNOWN;  /* may or may not have Implicit Result Set children */
-#if PHP_VERSION_ID < 70300
-	++GC_REFCOUNT(statement->connection->id);
-#else
 	GC_ADDREF(statement->connection->id);
-#endif

 	if (OCI_G(default_prefetch) >= 0) {
 		php_oci_statement_set_prefetch(statement, (ub4)OCI_G(default_prefetch));
@@ -175,13 +171,8 @@ php_oci_statement *php_oci_get_implicit_resultset(php_oci_statement *statement)
 		statement2->has_descr = 0;
 		statement2->stmttype = 0;

-#if PHP_VERSION_ID < 70300
-		GC_REFCOUNT(statement->id)++;
-		GC_REFCOUNT(statement2->connection->id)++;
-#else
 		GC_ADDREF(statement->id);
 		GC_ADDREF(statement2->connection->id);
-#endif

 		php_oci_statement_set_prefetch(statement2, statement->prefetch_count);

@@ -271,7 +262,11 @@ int php_oci_statement_fetch(php_oci_statement *statement, ub4 nrows)
 		zend_hash_apply(statement->columns, php_oci_cleanup_pre_fetch);
    }

+#if ((OCI_MAJOR_VERSION > 10) || ((OCI_MAJOR_VERSION == 10) && (OCI_MINOR_VERSION >= 2)))
+	PHP_OCI_CALL_RETURN(errstatus, OCIStmtFetch2, (statement->stmt, statement->err, nrows, OCI_FETCH_NEXT, 0, OCI_DEFAULT));
+#else
 	PHP_OCI_CALL_RETURN(errstatus, OCIStmtFetch, (statement->stmt, statement->err, nrows, OCI_FETCH_NEXT, OCI_DEFAULT));
+#endif

 	if (errstatus == OCI_NO_DATA || nrows == 0) {
 		if (statement->last_query == NULL) {
@@ -347,7 +342,11 @@ int php_oci_statement_fetch(php_oci_statement *statement, ub4 nrows)
 			}
 		}

+#if ((OCI_MAJOR_VERSION > 10) || ((OCI_MAJOR_VERSION == 10) && (OCI_MINOR_VERSION >= 2)))
+		PHP_OCI_CALL_RETURN(errstatus, OCIStmtFetch2, (statement->stmt, statement->err, nrows, OCI_FETCH_NEXT, 0, OCI_DEFAULT));
+#else
 		PHP_OCI_CALL_RETURN(errstatus, OCIStmtFetch, (statement->stmt, statement->err, nrows, OCI_FETCH_NEXT, OCI_DEFAULT));
+#endif

 		if (piecewisecols) {
 			for (i = 0; i < statement->ncolumns; i++) {
@@ -442,11 +441,7 @@ sb4 php_oci_define_callback(dvoid *ctx, OCIDefine *define, ub4 iter, dvoid **buf
 					return OCI_ERROR;
 				}
 				nested_stmt->parent_stmtid = outcol->statement->id;
-#if PHP_VERSION_ID < 70300
-				++GC_REFCOUNT(outcol->statement->id);
-#else
 				GC_ADDREF(outcol->statement->id);
-#endif
 				outcol->nested_statement = nested_stmt;
 				outcol->stmtid = nested_stmt->id;

@@ -608,15 +603,7 @@ int php_oci_statement_execute(php_oci_statement *statement, ub4 mode)
 		for (counter = 1; counter <= colcount; counter++) {
 			outcol = (php_oci_out_column *) ecalloc(1, sizeof(php_oci_out_column));

-#if PHP_VERSION_ID < 70300
-			if ((outcol = zend_hash_index_update_ptr(statement->columns, counter, outcol)) == NULL) {
-				FREE_HASHTABLE(statement->columns);
-				/* out of memory */
-				return 1;
-			}
-#else
 			outcol = zend_hash_index_update_ptr(statement->columns, counter, outcol);
-#endif

 			/* get column */
 			PHP_OCI_CALL_RETURN(errstatus, OCIParamGet, ((dvoid *)statement->stmt, OCI_HTYPE_STMT, statement->err, (dvoid**)&param, counter));
@@ -1023,7 +1010,7 @@ int php_oci_bind_post_exec(zval *data)
 		HashTable *hash;

 		SEPARATE_ARRAY(zv);
-		hash = HASH_OF(zv);
+		hash = Z_ARRVAL_P(zv);
 		zend_hash_internal_pointer_reset(hash);

 		switch (bind->array.type) {
@@ -1532,9 +1519,10 @@ php_oci_out_column *php_oci_statement_get_column_helper(INTERNAL_FUNCTION_PARAME
 	php_oci_statement *statement;
 	php_oci_out_column *column;

-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "rz", &z_statement, &column_index) == FAILURE) {
-		return NULL;
-	}
+	ZEND_PARSE_PARAMETERS_START(2, 2)
+		Z_PARAM_RESOURCE(z_statement)
+		Z_PARAM_ZVAL(column_index)
+	ZEND_PARSE_PARAMETERS_END_EX(return NULL);

 	statement = (php_oci_statement *) zend_fetch_resource_ex(z_statement, "oci8 statement", le_statement);

@@ -1553,22 +1541,7 @@ php_oci_out_column *php_oci_statement_get_column_helper(INTERNAL_FUNCTION_PARAME
 			return NULL;
 		}
 	} else {
-#if PHP_VERSION_ID < 70300
-		zval tmp;
-		/* NB: for PHP4 compat only, it should be using 'Z' instead */
-		tmp = *column_index;
-		zval_copy_ctor(&tmp);
-		convert_to_long(&tmp);
-		column = php_oci_statement_get_column(statement, Z_LVAL(tmp), NULL, 0);
-		if (!column) {
-			php_error_docref(NULL, E_WARNING, "Invalid column index \"" ZEND_LONG_FMT "\"", Z_LVAL(tmp));
-			zval_ptr_dtor(&tmp);
-			return NULL;
-		}
-		zval_ptr_dtor(&tmp);
-#else
 		zend_long tmp;
-		/* NB: for PHP4 compat only, it should be using 'Z' instead */

 		tmp = zval_get_long(column_index);
 		column = php_oci_statement_get_column(statement, tmp, NULL, 0);
@@ -1576,7 +1549,6 @@ php_oci_out_column *php_oci_statement_get_column_helper(INTERNAL_FUNCTION_PARAME
 			php_error_docref(NULL, E_WARNING, "Invalid column index \"" ZEND_LONG_FMT "\"", tmp);
 			return NULL;
 		}
-#endif
 	}
 	return column;
 }
@@ -1639,13 +1611,8 @@ int php_oci_bind_array_by_name(php_oci_statement *statement, char *name, size_t

 	ZEND_ASSERT(Z_ISREF_P(var));
 	val = Z_REFVAL_P(var);
-#if PHP_VERSION_ID < 70300
-	SEPARATE_ZVAL_NOREF(val);
-	convert_to_array(val);
-#else
 	convert_to_array(val);
 	SEPARATE_ARRAY(val);
-#endif

 	if (maxlength < -1) {
 		php_error_docref(NULL, E_WARNING, "Invalid max length value (" ZEND_LONG_FMT ")", maxlength);
@@ -1769,7 +1736,7 @@ php_oci_bind *php_oci_bind_array_helper_string(zval *var, zend_long max_table_le
 	zval *entry;

 	SEPARATE_ARRAY(var); /* TODO: may be use new HashTable iteration and prevent inplace modification */
-	hash = HASH_OF(var);
+	hash = Z_ARRVAL_P(var);

 	if (maxlength == -1) {
 		zend_hash_internal_pointer_reset(hash);
@@ -1843,7 +1810,7 @@ php_oci_bind *php_oci_bind_array_helper_number(zval *var, zend_long max_table_le
 	zval *entry;

 	SEPARATE_ARRAY(var); /* TODO: may be use new HashTable iteration and prevent inplace modification */
-	hash = HASH_OF(var);
+	hash = Z_ARRVAL_P(var);

 	bind = emalloc(sizeof(php_oci_bind));
 	ZVAL_UNDEF(&bind->val);
@@ -1884,7 +1851,7 @@ php_oci_bind *php_oci_bind_array_helper_double(zval *var, zend_long max_table_le
 	zval *entry;

 	SEPARATE_ARRAY(var); /* TODO: may be use new HashTable iteration and prevent inplace modification */
-	hash = HASH_OF(var);
+	hash = Z_ARRVAL_P(var);

 	bind = emalloc(sizeof(php_oci_bind));
 	ZVAL_UNDEF(&bind->val);
@@ -1926,7 +1893,7 @@ php_oci_bind *php_oci_bind_array_helper_date(zval *var, zend_long max_table_leng
 	sword errstatus;

 	SEPARATE_ARRAY(var); /* TODO: may be use new HashTable iteration and prevent inplace modification */
-	hash = HASH_OF(var);
+	hash = Z_ARRVAL_P(var);

 	bind = emalloc(sizeof(php_oci_bind));
 	ZVAL_UNDEF(&bind->val);
@@ -52,12 +52,12 @@ Interoperability Support" (ID 207303.1) for details.
  <active>no</active>
 </lead>

- <date>2017-08-15</date>
+ <date>2018-12-11</date>
 <time>12:00:00</time>

  <version>
-   <release>2.1.8</release>
-   <api>2.1.8</api>
+   <release>2.2.0</release>
+   <api>2.2.0</api>
  </version>
  <stability>
   <release>stable</release>
@@ -66,7 +66,11 @@ Interoperability Support" (ID 207303.1) for details.
  <license uri="http://www.php.net/license">PHP</license>
  <notes>
 This version is for PHP 7 only.
-Fixed reference counting and memory issues. (Dmitry, Tianfang)
+Added oci_set_call_timeout() for call timeouts. (Requires Oracle client libraries 18c or later)
+Added oci_set_db_operation() for the Oracle Database 'DBOP' end-to-end-tracing attribute. (Requires Oracle 12.2 or later)
+Fixed bug #76804 (oci_pconnect with OCI_CRED_EXT not working). (KoenigsKind)
+Fixed installation on PHP 7.3.
+Internal change: Convert some parameter parsing to the Fast Parameter Parsing API.
  </notes>
 <contents>
  <dir name="/">
@@ -171,6 +175,7 @@ Fixed reference counting and memory issues. (Dmitry, Tianfang)
    <file name="bug71600.phpt" role="test" />
    <file name="bug72524.phpt" role="test" />
    <file name="bug74625.phpt" role="test" />
+    <file name="calltimeout1.phpt" role="test" />
    <file name="clientversion.phpt" role="test" />
    <file name="close.phpt" role="test" />
    <file name="coll_001.phpt" role="test" />
@@ -476,6 +481,22 @@ Fixed reference counting and memory issues. (Dmitry, Tianfang)
 </extsrcrelease>
 <changelog>

+<release>
+  <version>
+   <release>2.1.8</release>
+   <api>2.1.8</api>
+  </version>
+  <stability>
+   <release>stable</release>
+   <api>stable</api>
+  </stability>
+  <license uri="http://www.php.net/license">PHP</license>
+  <notes>
+This version is for PHP 7 only.
+Fixed reference counting and memory issues. (Dmitry, Tianfang)
+  </notes>
+</release>
+
 <release>
  <version>
   <release>2.1.7</release>
@@ -43,7 +43,7 @@
 */
 #undef PHP_OCI8_VERSION
 #endif
-#define PHP_OCI8_VERSION "2.1.8"
+#define PHP_OCI8_VERSION "2.2.0"

 extern zend_module_entry oci8_module_entry;
 #define phpext_oci8_ptr &oci8_module_entry
@@ -344,7 +344,9 @@ typedef struct {
 			case  3114:							  \
 			case  3122:							  \
 			case  3135:							  \
+			case  3136:							  \
 			case 12153:							  \
+			case 12161:							  \
 			case 27146:							  \
 			case 28511:							  \
 				(connection)->is_open = 0;		  \
@@ -545,6 +547,14 @@ int php_oci_unregister_taf_callback(php_oci_connection *connection);
 #define OCI_G(v) (oci_globals.v)
 #endif

+/* Allow install from PECL on PHP < 7.3 */
+#ifndef GC_ADDREF
+# define GC_ADDREF(p) (++GC_REFCOUNT(p))
+#endif
+#ifndef GC_DELREF
+# define GC_DELREF(p) (GC_REFCOUNT(p)--)
+#endif
+
 ZEND_EXTERN_MODULE_GLOBALS(oci)

 # endif /* !PHP_OCI8_INT_H */
@@ -0,0 +1,51 @@
+--TEST--
+oci_set_call_timeout: test timing out 
+--SKIPIF--
+<?php
+if (getenv('SKIP_SLOW_TESTS')) die('skip slow tests excluded by request');
+if (!extension_loaded('oci8')) die ("skip no oci8 extension");
+$target_dbs = array('oracledb' => true, 'timesten' => false);  // test runs on these DBs
+require(dirname(__FILE__).'/skipif.inc');
+if (strcasecmp($user, "system") && strcasecmp($user, "sys")) {
+    die("skip needs to be run as a user with access to DBMS_LOCK");
+}
+preg_match('/^[[:digit:]]+/', oci_client_version(), $matches);
+if (!(isset($matches[0]) && $matches[0] >= 18)) {
+    die("skip works only with Oracle 18c or greater version of Oracle client libraries");
+}
+
+?>
+--FILE--
+<?php
+
+require(dirname(__FILE__).'/connect.inc');
+
+function mysleep($c, $t)
+{
+    $s = @oci_parse($c, "begin dbms_lock.sleep(:t); end;");
+    if (!$s) {
+        $m = oci_error($c);
+        echo "Execute error was ", $m['message'], "\n";
+        return;
+    }
+    @oci_bind_by_name($s, ":t", $t);
+    $r = @oci_execute($s);
+    if ($r) {
+        echo "Execute succeeded\n";
+    } else {
+        $m = oci_error($s);
+        echo "Execute error was ", $m['message'], "\n";
+    }
+}
+
+echo "Test 1\n";
+oci_set_call_timeout($c, 4000);  // milliseconds
+$r = mysleep($c, 8);             // seconds
+
+?>
+===DONE===
+<?php exit(0); ?>
+--EXPECTF--
+Test 1
+Execute error was ORA-03136: %s
+===DONE===
@@ -16,10 +16,6 @@ preg_match('/^[[:digit:]]+/', oci_client_version(), $matches);
 if (!(isset($matches[0]) && $matches[0] >= 12)) {
    die("skip works only with Oracle 12c or greater version of Oracle client libraries");
 }
-if (!function_exists('oci_set_db_operation'))
-{
-    die("skip function oci_set_db_operation() does not exist");
-}
 ?>
 --FILE--
 <?php
@@ -40,7 +36,7 @@ function dq($c, $q)
 }

 oci_set_db_operation($c, "db_op_1");
-dq($c, 'select * from dual');
+dq($c, 'select /*+ MONITOR */ * from dual');

 dq($c, 'select dbop_name from v$sql_monitor where dbop_name is not null order by dbop_exec_id desc');

@@ -1,5 +1,5 @@
 --TEST--
-oci_set_db_operation: basic test for end-to-end tracing
+oci_set_db_operation: test DBOP for end-to-end tracing
 --SKIPIF--
 <?php
 if (!extension_loaded('oci8')) die ("skip no oci8 extension");
@@ -35,34 +35,45 @@ function dq($c, $q)

 echo "Test 1\n";
 oci_set_db_operation($c, "db_op_2_a");
-dq($c, 'select * from dual');
+dq($c, 'select /*+ MONITOR */ * from dual');
+
+oci_set_db_operation($c, "db_op_2_b");
+dq($c, 'select /*+ MONITOR */ * from dual');
+
+dq($c, 'select dbop_name from v$sql_monitor where dbop_name like \'db_op_2%\' order by dbop_exec_id desc');

 echo "Test 2\n";
-oci_set_db_operation($c, "db_op_2_b");
-dq($c, 'select * from dual');
+oci_set_db_operation($c, "");
+dq($c, 'select /*+ MONITOR */ \'dboptest\' from dual');

-echo "Test 3\n";
-dq($c, 'select dbop_name from v$sql_monitor where dbop_name like \'db_op2%\' order by dbop_exec_id desc');
+dq($c, 'select sql_text, dbop_name from v$sql_monitor where sql_text like \'%dboptest%\' order by dbop_exec_id desc');

 ?>
 ===DONE===
 <?php exit(0); ?>
--XFAIL--
-Fails due to Oracle Bug 16695981
 --EXPECT--
 Test 1
 array(1) {
  ["DUMMY"]=>
  string(1) "X"
 }
-Test 2
 array(1) {
  ["DUMMY"]=>
  string(1) "X"
 }
-Test 3
-array(2) {
+array(1) {
  ["DBOP_NAME"]=>
-  string(7) "db_op_2a"
+  string(9) "db_op_2_b"
+}
+Test 2
+array(1) {
+  ["'DBOPTEST'"]=>
+  string(8) "dboptest"
+}
+array(2) {
+  ["SQL_TEXT"]=>
+  string(42) "select /*+ MONITOR */ 'dboptest' from dual"
+  ["DBOP_NAME"]=>
+  NULL
 }
 ===DONE===
@@ -8,9 +8,9 @@ if (strcasecmp($user, "system") && strcasecmp($user, "sys")) die("skip needs to
 if ($test_drcp) die("skip as Output might vary with DRCP");

 preg_match('/.*Release ([[:digit:]]+)\.([[:digit:]]+)\.([[:digit:]]+)\.([[:digit:]]+)\.([[:digit:]]+)*/', oci_server_version($c), $matches);
-if (!(isset($matches[0]) &&
+if (!(isset($matches[0]) && ($matches[1] > 12 ||
     ($matches[1] == 12 && $matches[2] == 1 && $matches[3] >= 0
-     && $matches[4] >= 2) || ($matches[1] == 12 && $matches[2] > 1))) {
+         && $matches[4] >= 2) || ($matches[1] == 12 && $matches[2] > 1)))) {
    die("skip test expected to work only with Oracle 12.1.0.2 database or its later patchsets");
 }

@@ -57,11 +57,11 @@ function get_attr($conn)
 ?>
 --EXPECT--
 **Test 1.1 - Default values for the attribute **************
-The value of DRIVER_NAME is PHP OCI8 : 2.1.8
+The value of DRIVER_NAME is PHP OCI8 : 2.2.0

 ***Test 1.2 - Get the values from different connections **************
 Testing with oci_pconnect()
-The value of DRIVER_NAME is PHP OCI8 : 2.1.8
+The value of DRIVER_NAME is PHP OCI8 : 2.2.0
 Testing with oci_new_connect()
-The value of DRIVER_NAME is PHP OCI8 : 2.1.8
+The value of DRIVER_NAME is PHP OCI8 : 2.2.0
 Done
@@ -47,8 +47,6 @@ Warning: oci_bind_by_name() expects at most 5 parameters, 7 given in %s on line
 Warning: oci_bind_by_name() expects at least 3 parameters, 2 given in %s on line %d

 Warning: oci_bind_by_name() expects at least 3 parameters, 1 given in %s on line %d
-
-Warning: oci_execute(): ORA-00932: %s on line %d
 object(OCI-Lob)#%d (1) {
  ["descriptor"]=>
  resource(%d) of type (oci8 descriptor)
@@ -153,7 +153,6 @@ static void zend_mark_reachable_blocks(const zend_op_array *op_array, zend_cfg *
 							changed = 1;
 							zend_mark_reachable(op_array->opcodes, cfg, b);
 						} else {
-							ZEND_ASSERT(b->start == live_range->end);
 							b->flags |= ZEND_BB_UNREACHABLE_FREE;
 						}
 					}
@@ -0,0 +1,22 @@
+--TEST--
+Bug #77215: CFG assertion failure on multiple finalizing switch frees in one block
+--INI--
+opcache.enable_cli=1
+opcache.optimization_level=-1
+--FILE--
+<?php
+
+function _crash($eValeur) {
+    switch ($eValeur["a"]) {
+        default:
+            switch($eValeur["a"]) {
+                default:
+                    return 2;
+            }
+    }
+}
+
+var_dump(_crash(["a" => "b"]));
+?>
+--EXPECT--
+int(2)
@@ -1,42 +1,35 @@
 -----BEGIN CERTIFICATE-----
-MIIHZzCCBU+gAwIBAgIBATANBgkqhkiG9w0BAQQFADCByzEpMCcGA1UEAxMgQ2F0
-YXBocmFjdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxCzAJBgNVBAYTAlBUMQ8wDQYD
-VQQHEwZMaXNib2ExETAPBgNVBAgTCFBvcnR1Z2FsMSkwJwYDVQQKEyBDYXRhcGhy
-YWN0IENlcnRpZmljYXRlIEF1dGhvcml0eTEcMBoGA1UECxMTQ2VydGlmaWNhdGUg
-U2lnbmluZzEkMCIGCSqGSIb3DQEJARYVQ2F0YXBocmFjdEBuZXRjYWJvLnB0MB4X
-DTAzMTIwNTAwMTExOVoXDTE4MTIwMTAwMTExOVowgcsxKTAnBgNVBAMTIENhdGFw
-aHJhY3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MQswCQYDVQQGEwJQVDEPMA0GA1UE
-BxMGTGlzYm9hMREwDwYDVQQIEwhQb3J0dWdhbDEpMCcGA1UEChMgQ2F0YXBocmFj
-dCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxHDAaBgNVBAsTE0NlcnRpZmljYXRlIFNp
-Z25pbmcxJDAiBgkqhkiG9w0BCQEWFUNhdGFwaHJhY3RAbmV0Y2Fiby5wdDCCAiIw
-DQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANg+noZuxtWdxmZjxanJGEpzmDYu
-Uko9OHdmhVr3UU+z04a9JFT7aH5wuwrnpadNy1u9CqrSHVWFEtSmOMOH8QYzIy4C
-qCjFPSJR5UQjxpxTZeXaTvfhKI9n0LMSqc7I68HkP5MF64N3Z2cRdYvM4U6R5ERD
-Xw2LiRpii/+J2cezgi/Nw3vS4hZlWDWMkttfBd0HKSwxxN7OlPcjyzoTVhQgSISV
-Zvd3kwENTWD7s3EnnPRtMiW8Vzcjd8eSTCSjuGBG/8NnI44amLo7gSWocCJ2os69
-CJgiqMpp0tLT8cJm0mQUBk0o9gBS7l1GPpgq5fwWG+DmoLIHrKjxpuI5v2DW23gx
-yimXSyiD1GX0JLlTqZ+klM7Mv7ptnigRXA8F5f4GbVzBlGM1L1EERd8orsSmzPEA
-S6puHdlNzjcx00glp1UoAs6+tV39eW/fjiP493biPcar0pNO8QWfRSqPsgy6/qKN
-m7x2DoSdTbRgCalBMp57xYCUHIETZvlewGKnQD1Tj9FlbzvOnH6r52gj5U/5r3pn
-E4DshILn/qtdRwd/2Dwx/KSyBJznU7Yu0vEeMwQioZ6YFH1FnC4229lHYCN6ByVw
-UE7OMH7n0A8SUN8flxr2X7MmWpQsMrgVfrAjufmFwUaeIRq9X3wihDYw0MYP0brU
-x5ONmY+VA93gLdStAgMBAAGjggFSMIIBTjASBgNVHRMBAf8ECDAGAQH/AgEBMB0G
-A1UdDgQWBBQj+82/Y4YWpR8kIi0obJULkqmBwTCB+AYDVR0jBIHwMIHtgBQj+82/
-Y4YWpR8kIi0obJULkqmBwaGB0aSBzjCByzEpMCcGA1UEAxMgQ2F0YXBocmFjdCBD
-ZXJ0aWZpY2F0ZSBBdXRob3JpdHkxCzAJBgNVBAYTAlBUMQ8wDQYDVQQHEwZMaXNi
-b2ExETAPBgNVBAgTCFBvcnR1Z2FsMSkwJwYDVQQKEyBDYXRhcGhyYWN0IENlcnRp
-ZmljYXRlIEF1dGhvcml0eTEcMBoGA1UECxMTQ2VydGlmaWNhdGUgU2lnbmluZzEk
-MCIGCSqGSIb3DQEJARYVQ2F0YXBocmFjdEBuZXRjYWJvLnB0ggEBMAsGA1UdDwQE
-AwIBBjARBglghkgBhvhCAQEEBAMCAAcwDQYJKoZIhvcNAQEEBQADggIBAKN6pRY1
-8GwQx378ukmw4pzvODlee5IKSPRT92hfLKNGNUAMu2LFo+bjItpilhSvR4aklRvh
-5RBoVE8ejEdZXsz0HobMUUcL9IemaRwBCWHPii7Y3zX2J1FUiS/KmWhrYvw5hb1P
-P83f/kxdWhxD+MbwuGc2I/6WgfsRyzevQsxdJgElQvNGkOXsC56pEXm2ChVoLbZL
-sZX0zPa5ZzXByQGwXl9eqOkV7fdNKulJPcLPOs/y1cAfcxXrDYHpqBGf9nb14p3C
-NaWXFhvq9Khk/QiWKSO4QarPlYS4H0Sl6tp7zBaE+dZHAjci2mSTraUf7q61kqoJ
-g/ZA3qupd1rR67NzN+6x/TJmIq0G3GUxnDNNqNAHvS4YJx8g4Ji0F3Qoz3CgKnc4
-HsneYQ/LCLq2pDjsffnLI88MBGbfHZDjdj2nowwX76W/6PPutD5IR/kOmHEaX1TJ
-/Ff99bVV4HwNF3GPwmKPmHpw3hB9A/xG9aiQRcYs0reXoYeQ+8nyCGmu41LweFyV
-1WVwWJ/MHgdtzJZHdPjeXKMWQzOx3AS3TCc31oi4IEo4NgNigcuvl0qgUcwDRXBI
-HZm4f7npm7xiES8BSoq5PIVCj8EXJd4b7Gk6dHGJGO+APaw3kYKqfqg5+AN1e4a5
-x3onNvWhjcwDGgcs/xAfVJIUucEqpC5h0pZq
+MIIGAzCCA+ugAwIBAgIUZ7ZvvfVqSEf1EswMT9LfMIPc/U8wDQYJKoZIhvcNAQEL
+BQAwgZAxCzAJBgNVBAYTAlBUMQ8wDQYDVQQIDAZMaXNib2ExDzANBgNVBAcMBkxp
+c2JvYTEXMBUGA1UECgwOUEhQIEZvdW5kYXRpb24xHjAcBgNVBAMMFVJvb3QgQ0Eg
+Zm9yIFBIUCBUZXN0czEmMCQGCSqGSIb3DQEJARYXaW50ZXJuYWxzQGxpc3RzLnBo
+cC5uZXQwHhcNMTgxMjMxMDg0NDU3WhcNMjAwMjA0MDg0NDU3WjCBkDELMAkGA1UE
+BhMCUFQxDzANBgNVBAgMBkxpc2JvYTEPMA0GA1UEBwwGTGlzYm9hMRcwFQYDVQQK
+DA5QSFAgRm91bmRhdGlvbjEeMBwGA1UEAwwVUm9vdCBDQSBmb3IgUEhQIFRlc3Rz
+MSYwJAYJKoZIhvcNAQkBFhdpbnRlcm5hbHNAbGlzdHMucGhwLm5ldDCCAiIwDQYJ
+KoZIhvcNAQEBBQADggIPADCCAgoCggIBAPVThsunmhda5hbNi+pXD3WF9ijryB9H
+JDnIbPW/vMffWcQgtiRzc+6aCykBygnhnN91NNRpxOsoLCb7OjUMM0TjhSE9DxKD
+aVLRoDcs5VSaddQjq3AwdkU6ek9InUOeDuZ8gatrpWlEyuQPwwnMAfR9NkcTajuF
+hGO0BlqkHg98GckQD0N5x6CrrDJt6RE6hf9gUZSGSWdPTiETBQUN8LTuxo/ybFSN
+hcpVNCF+r3eozATbSU8YvQU52RmPIZWHHmYb7KtMO3TEX4LnLJUOefUK4qk+ZJ0s
+f4JfnY7RhBlZGh2kIyE5jwqz8/KzKtxrutNaupdTFZO8nX09QSgmDCxVWVclrPaG
+q2ZFYpeauTy71pTm8DjF7PwQI/+PUrBdFIX0V6uxqUEG0pvPdb8zenVbaK4Jh39u
+w0V5tH/rbtd7zZX4vl3bmKo1Wk0SQxd83iXitxLiJnWNOsmrJcM/Hx91kE10+/ly
+zgL/w5A9HSA616kfPdNzny0laH1TXVLJsnyyV3DyfnU4O6VI0JG3WjhgRdMkgobn
+GvGJ2ZsZAxds9lBtT2y+gw5BU+jkSilPk3jM9MA7Kmyci93U9xxMuDNzyUzfcnXR
+UIq99dZWeMMy1LT3buZXrAWu1WRgPdQtDKcQHDIQaIkxlWsT8q2q/wIirb6fwxlw
+vXkFp+aEP35BAgMBAAGjUzBRMB0GA1UdDgQWBBR37F1+W1gcCp8bhZaFFi9JKQhu
+tTAfBgNVHSMEGDAWgBR37F1+W1gcCp8bhZaFFi9JKQhutTAPBgNVHRMBAf8EBTAD
+AQH/MA0GCSqGSIb3DQEBCwUAA4ICAQAYHqpISUI/x8UW33i35rYkFYNvXBMQDc8J
+v4G2eqEBNCOVmHg6P//lq1F2jrtAEr/saESN1uS1Q80sUsthlVsceV1z1isdpugG
+kMbfHxLe0QpthnP3PEChQw30TPB22BThuGVkteNSZKTCPGdzjSTPq2kOR6PCBZRd
+r0r/TW3lT/Ng3KgjT6g7E3ZUpAeFEQMlmNYr/eEOL7K+1jzQrbCLmXbs6rmtffr7
+n4p+wMPMPaSRqQoQ86ff9GPzxWuAQGlytVoiS5Xt3jotd/RWlOy0YQ2QSzOQvFUW
+4te5lwdOvOFnJTo43U3DqASqMcaazvIsN41zVlOyOyKEr9oZERju6FU1aZmuZtHQ
+wMCmXVj/Swj67Zp9tG+vVQenbEk314+8c2nenuOIFP1F2C/NG3vMLIpENRGxpmAm
+s5gIT6mXvJ4JCwWYc75zucOr2KVkDmEziJh/pARuOrOAPdc6NjKku8HBC9UI96+x
+Db4hG2SqXUzShkFX/px7vlCADvgO3FDk2aiyW02PFsItob2O6OB98VGsU26hgRO/
+Czz/jbjWTPHNOt6/fcL0m7XLwlJ+K9gRArY15DeJGumcHEq/Vd/Z8iPQKKdzgF4O
+9XFZvu+VHP82AS5TeiYHCddFJyzktQYcNu5/OBuxzO83d7rpqrLFETTEOL4cN8O7
+LJ7Q89hYAQ==
 -----END CERTIFICATE-----
@@ -1,34 +1,26 @@
 -----BEGIN CERTIFICATE-----
-MIIFizCCA3OgAwIBAgIBGTANBgkqhkiG9w0BAQUFADCByzEpMCcGA1UEAxMgQ2F0
-YXBocmFjdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkxCzAJBgNVBAYTAlBUMQ8wDQYD
-VQQHEwZMaXNib2ExETAPBgNVBAgTCFBvcnR1Z2FsMSkwJwYDVQQKEyBDYXRhcGhy
-YWN0IENlcnRpZmljYXRlIEF1dGhvcml0eTEcMBoGA1UECxMTQ2VydGlmaWNhdGUg
-U2lnbmluZzEkMCIGCSqGSIb3DQEJARYVQ2F0YXBocmFjdEBuZXRjYWJvLnB0MB4X
-DTExMDYwNzIzNTIwM1oXDTE4MTIwMTAwMTExOVowWjEXMBUGA1UEAxMOYnVnNTQ5
-OTIubG9jYWwxCzAJBgNVBAYTAlBUMQ8wDQYDVQQHEwZMaXNib2ExDzANBgNVBAgT
-Bkxpc2JvYTEQMA4GA1UEChMHcGhwLm5ldDCBnzANBgkqhkiG9w0BAQEFAAOBjQAw
-gYkCgYEAtUAVQKTgpUPgtFOJ3w3kDJETS45tWeT96kUg1NeYLKW+jNbFhxPoPJv7
-XhfemCaqh2tbq1cdYW906Wp1L+eNQvdTYA2IQG4EQBUlmfyIakOIMsN/RizVkF09
-vlNQwTpaMpqTv7wB8vvwbxb9jbC2ZhQUBEg6PIn18dSstbM9FZ0CAwEAAaOCAWww
-ggFoMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFCysG9r7vXtfHa38AUZeCM6tgH9c
-MIH4BgNVHSMEgfAwge2AFCP7zb9jhhalHyQiLShslQuSqYHBoYHRpIHOMIHLMSkw
-JwYDVQQDEyBDYXRhcGhyYWN0IENlcnRpZmljYXRlIEF1dGhvcml0eTELMAkGA1UE
-BhMCUFQxDzANBgNVBAcTBkxpc2JvYTERMA8GA1UECBMIUG9ydHVnYWwxKTAnBgNV
-BAoTIENhdGFwaHJhY3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MRwwGgYDVQQLExND
-ZXJ0aWZpY2F0ZSBTaWduaW5nMSQwIgYJKoZIhvcNAQkBFhVDYXRhcGhyYWN0QG5l
-dGNhYm8ucHSCAQEwCwYDVR0PBAQDAgXgMBEGCWCGSAGG+EIBAQQEAwIGQDAeBglg
-hkgBhvhCAQ0EERYPeGNhIGNlcnRpZmljYXRlMA0GCSqGSIb3DQEBBQUAA4ICAQAT
-M7Id7nBSvaDXuStLunfeV0WPAh3DkKWCxw9YK0MjK7E/K5xEiYaWWbz9zuHEcKrN
-MuflSdYVPXTqvD6mHLFNptOgzG6YMOO+rAAEYB5HZ/PYTO6UWAdSLlS96DpA4SS3
-Qwmrc0eXe1p4U8noEN+N3+rAbetjOuvnLG/cpoQGcA8Mws84B/elzjRne5C8N1rF
-Tvdb3bqIqvP1thuPfyh/uIKSQb5ZusHvj7ZBkEs+zQLBRnCcDK4ETXFM0TcKSPar
-d11tve/91BqqemwlA+ntVrVTgi/pnw4wuWxa3GOVmeEeWgtv3063wZ3lGv/72PCh
-gSjxoCoVLaLPTbC/iG2a5+ca2HcF0TjfJqYNCgosgRGlm5IunvuIv+g5jLcZcDSO
-hMw+HzyF8GlDF166YRRb9nUL6AtBisdEw6uQW1vQFRRQS4SGMoArSBw2EBqd7Kvf
-ruCMcrkudC8vbWQHMETEvhAXdAjgsIxLeGCPh0/8mtES1Lnr0TWIrM9evPJkKACj
-f6CyIASkIDZKFf5JwuUh02qvuNLr/QRELfI1NnA1aTYMQQWWOVCBffu4ce+NPdtl
-Uh1vRwWAWI0Zjszw3kUk2vHLbSXeD3bU7gP3IFa1X8XsXBW2SH+BfpNWHUilHj1I
-bX+zqjfaRWDJuZqB9y6iTCu8DfBtbMiTUGcI/Rs9wQ==
+MIID7jCCAdYCFDw0rvm7q8y5HfispK5A2I2+RBqHMA0GCSqGSIb3DQEBCwUAMIGQ
+MQswCQYDVQQGEwJQVDEPMA0GA1UECAwGTGlzYm9hMQ8wDQYDVQQHDAZMaXNib2Ex
+FzAVBgNVBAoMDlBIUCBGb3VuZGF0aW9uMR4wHAYDVQQDDBVSb290IENBIGZvciBQ
+SFAgVGVzdHMxJjAkBgkqhkiG9w0BCQEWF2ludGVybmFsc0BsaXN0cy5waHAubmV0
+MB4XDTE4MTIzMTA4NDY0M1oXDTIwMDIwNDA4NDY0M1owWjEXMBUGA1UEAxMOYnVn
+NTQ5OTIubG9jYWwxCzAJBgNVBAYTAlBUMQ8wDQYDVQQHEwZMaXNib2ExDzANBgNV
+BAgTBkxpc2JvYTEQMA4GA1UEChMHcGhwLm5ldDCBnzANBgkqhkiG9w0BAQEFAAOB
+jQAwgYkCgYEAtUAVQKTgpUPgtFOJ3w3kDJETS45tWeT96kUg1NeYLKW+jNbFhxPo
+PJv7XhfemCaqh2tbq1cdYW906Wp1L+eNQvdTYA2IQG4EQBUlmfyIakOIMsN/RizV
+kF09vlNQwTpaMpqTv7wB8vvwbxb9jbC2ZhQUBEg6PIn18dSstbM9FZ0CAwEAATAN
+BgkqhkiG9w0BAQsFAAOCAgEAKtSMguV5ZQ2KpdZ9MAFa+GiHL0APb58OrvwNK4BF
+6032UZLOWnsBZlo85WGLNnIT/GNzKKr7n9jHeuZcBVOFQLsebahSlfJZs9FPatlI
+9Md1tRzVoTKohjG86HeFhhL+gZQ69SdIcK40wpH1qNv7KyMGA8gnx6rRKbOxZqsx
+pkA/wS7CTqP9/DeOxh/MZPg7N/GZXW1QOz+SE537E9iyiRsbldNYFtwn5iaVfjpr
+xz09wYYW3HJpR+QKPCfJ79JxDhuMHMoUOpIy8vGFnt5zVTcFLa378Sy3vCT1Qwvt
+tTavFGHby4A7OqT6xu+9GTW37OaiV91UelLLV0+MoR4XiMVMX76mvqzmKCp6L9ae
+7RYHrrCtNxkYUKUSkOEc2VHnT+sENkJIZu7zzN7/QNlc0yE9Rtsmgy4QAxo2m9u0
+pUZLAulZ1lS7g/sr7/8Pp17RDvJiJh+oAPyVYZ7OoLF1IoHDHcZI0bqcqhDhiHZs
+PXYqyMCxyYzHFOAOgvbrEkmp8z/E8ATVwdUbAYN1dMrYHre1P4HFEtJh2QiGG2KE
+4jheuNhH1R25AizbwYbD33Kdp7ltCgBlfYqjl771SlgY45QYs0mUdc1Pv39SGIwf
+ZUm7mOWjaTBdYANrkvGM5NNT9kESjKkWykyTg4UF5rHV6nlyexR4b3fjabroi4BS
+v6w=
 -----END CERTIFICATE-----
 -----BEGIN RSA PRIVATE KEY-----
 MIICXgIBAAKBgQC1QBVApOClQ+C0U4nfDeQMkRNLjm1Z5P3qRSDU15gspb6M1sWH
@@ -7,6 +7,48 @@ if (!function_exists("proc_open")) die("skip no proc_open");
 ?>
 --FILE--
 <?php
+/*
+ How to generate bug54992.pem and bug54992-ca.pem and all dependants:
+
+ All the commands below assume you're in the root of php sources
+
+ Generate new key for CA:
+ $ openssl genrsa -out ./ext/openssl/tests/bug54992-ca.key 4096
+
+ Create new CA:
+ $ openssl req -new -x509 -key ./ext/openssl/tests/bug54992-ca.key \
+      -out ext/openssl/tests/bug54992-ca.pem \
+      -subj '/C=PT/ST=Lisboa/L=Lisboa/O=PHP Foundation/CN=Root CA for PHP Tests/emailAddress=internals@lists.php.net' \
+      -days 400
+
+ Extract private key from the bundle:
+ $ openssl rsa -in ext/openssl/tests/bug54992.pem > ext/openssl/tests/bug54992.key
+
+ Extract CSR from existing certificate:
+ $ openssl x509 -x509toreq -in ext/openssl/tests/bug54992.pem -out ext/openssl/tests/bug54992.csr -signkey ext/openssl/tests/bug54992.key
+
+ Sign the CSR:
+ $ openssl x509 -CA ext/openssl/tests/bug54992-ca.pem \
+        -CAcreateserial \
+        -CAkey ./ext/openssl/tests/bug54992-ca.key \
+        -req \
+        -in ext/openssl/tests/bug54992.csr \
+        -sha256 \
+        -days 400 \
+        -out ./ext/openssl/tests/bug54992.pem
+
+ Bundle certificate's private key with the certificate:
+ $ cat ext/openssl/tests/bug54992.key >> ext/openssl/tests/bug54992.pem\
+
+
+ Dependants:
+
+ 1. ext/openssl/tests/bug65538_003.phpt
+    Run the following to generate required phar:
+    php -d phar.readonly=Off -r '$phar = new Phar("ext/openssl/tests/bug65538.phar"); $phar->addFile("ext/openssl/tests/bug54992.pem", "bug54992.pem"); $phar->addFile("ext/openssl/tests/bug54992-ca.pem", "bug54992-ca.pem");'
+
+ 2. Update ext/openssl/tests/openssl_peer_fingerprint_basic.phpt (see instructions in there)
+ */
 $serverCode = <<<'CODE'
    $serverUri = "ssl://127.0.0.1:64321";
    $serverFlags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN;
@@ -33,12 +33,17 @@ $clientCode = <<<'CODE'

    phpt_wait();

-    // should be: 81cafc260aa8d82956ebc6212a362ecc
-    stream_context_set_option($clientCtx, 'ssl', 'peer_fingerprint', '81cafc260aa8d82956ebc6212a362ece');
+    // Run the following to get actual md5 (from sources root):
+    // openssl x509 -noout -fingerprint -md5 -inform pem -in ext/openssl/tests/bug54992.pem | cut -d '=' -f 2 | tr -d ':' | tr 'A-F' 'a-f'
+    // Currently it's 4edbbaf40a6a4b6af22b6d6d9818378f
+    // One below is intentionally broken (compare the last character):
+    stream_context_set_option($clientCtx, 'ssl', 'peer_fingerprint', '4edbbaf40a6a4b6af22b6d6d98183780');
    var_dump(stream_socket_client($serverUri, $errno, $errstr, 2, $clientFlags, $clientCtx));

+    // Run the following to get actual sha256 (from sources root):
+    // openssl x509 -noout -fingerprint -sha256 -inform pem -in ext/openssl/tests/bug54992.pem | cut -d '=' -f 2 | tr -d ':' | tr 'A-F' 'a-f'
    stream_context_set_option($clientCtx, 'ssl', 'peer_fingerprint', [
-        'sha256' => '78ea579f2c3b439359dec5dac9d445108772927427c4780037e87df3799a0aa0',
+        'sha256' => 'b1d480a2f83594fa243d26378cf611f334d369e59558d87e3de1abe8f36cb997',
    ]);
    var_dump(stream_socket_client($serverUri, $errno, $errstr, 2, $clientFlags, $clientCtx));
 CODE;
@@ -532,6 +532,13 @@ static inline void fetch_value(pdo_stmt_t *stmt, zval *dest, int colno, int *typ
 	int caller_frees = 0;
 	int type, new_type;

+	if (colno < 0 || colno >= stmt->column_count) {
+		pdo_raise_impl_error(stmt->dbh, stmt, "HY000", "Invalid column index");
+		ZVAL_FALSE(dest);
+
+		return;
+	}
+
 	col = &stmt->columns[colno];
 	type = PDO_PARAM_TYPE(col->param_type);
 	new_type =  type_override ? (int)PDO_PARAM_TYPE(*type_override) : type;
@@ -0,0 +1,45 @@
+--TEST--
+PDOStatement::fetchColumn() invalid column index
+--SKIPIF--
+<?php # vim:ft=php
+if (!extension_loaded('pdo')) die('skip');
+$dir = getenv('REDIR_TEST_DIR');
+if (false == $dir) die('skip no driver');
+require_once $dir . 'pdo_test.inc';
+PDOTest::skip();
+?>
+--FILE--
+<?php
+if (getenv('REDIR_TEST_DIR') === false) putenv('REDIR_TEST_DIR='.dirname(__FILE__) . '/../../pdo/tests/');
+require_once getenv('REDIR_TEST_DIR') . 'pdo_test.inc';
+
+function fetchColumn($stmt, $index) {
+    $stmt->execute();
+    return $stmt->fetchColumn($index);
+}
+
+$conn  = PDOTest::factory();
+$query = 'SELECT 1';
+
+switch ($conn->getAttribute(PDO::ATTR_DRIVER_NAME)) {
+    case 'oci':
+        $query .= ' FROM DUAL';
+        break;
+    case 'firebird':
+        $query .= ' FROM RDB$DATABASE';
+        break;
+}
+
+$stmt = $conn->prepare($query);
+
+var_dump(fetchColumn($stmt, -1));
+var_dump(fetchColumn($stmt, 0));
+var_dump(fetchColumn($stmt, 1));
+?>
+--EXPECTF--
+Warning: PDOStatement::fetchColumn(): SQLSTATE[HY000]: General error: Invalid column index in %s
+bool(false)
+string(1) "1"
+
+Warning: PDOStatement::fetchColumn(): SQLSTATE[HY000]: General error: Invalid column index in %s
+bool(false)
@@ -642,6 +642,18 @@ int phar_parse_metadata(char **buffer, zval *metadata, uint32_t zip_metadata_len
 }
 /* }}}*/

+/**
+ * Size of fixed fields in the manifest.
+ * See: http://php.net/manual/en/phar.fileformat.phar.php
+ */
+#define MANIFEST_FIXED_LEN	18
+
+#define SAFE_PHAR_GET_32(buffer, endbuffer, var) \
+	if (UNEXPECTED(buffer + 4 > endbuffer)) { \
+		MAPPHAR_FAIL("internal corruption of phar \"%s\" (truncated manifest header)"); \
+	} \
+	PHAR_GET_32(buffer, var);
+
 /**
 * Does not check for a previously opened phar in the cache.
 *
@@ -725,12 +737,12 @@ static int phar_parse_pharfile(php_stream *fp, char *fname, int fname_len, char
 	savebuf = buffer;
 	endbuffer = buffer + manifest_len;

-	if (manifest_len < 10 || manifest_len != php_stream_read(fp, buffer, manifest_len)) {
+	if (manifest_len < MANIFEST_FIXED_LEN || manifest_len != php_stream_read(fp, buffer, manifest_len)) {
 		MAPPHAR_FAIL("internal corruption of phar \"%s\" (truncated manifest header)")
 	}

 	/* extract the number of entries */
-	PHAR_GET_32(buffer, manifest_count);
+	SAFE_PHAR_GET_32(buffer, endbuffer, manifest_count);

 	if (manifest_count == 0) {
 		MAPPHAR_FAIL("in phar \"%s\", manifest claims to have zero entries.  Phars must have at least 1 entry");
@@ -750,7 +762,7 @@ static int phar_parse_pharfile(php_stream *fp, char *fname, int fname_len, char
 		return FAILURE;
 	}

-	PHAR_GET_32(buffer, manifest_flags);
+	SAFE_PHAR_GET_32(buffer, endbuffer, manifest_flags);

 	manifest_flags &= ~PHAR_HDR_COMPRESSION_MASK;
 	manifest_flags &= ~PHAR_FILE_COMPRESSION_MASK;
@@ -970,13 +982,13 @@ static int phar_parse_pharfile(php_stream *fp, char *fname, int fname_len, char
 	}

 	/* extract alias */
-	PHAR_GET_32(buffer, tmp_len);
+	SAFE_PHAR_GET_32(buffer, endbuffer, tmp_len);

 	if (buffer + tmp_len > endbuffer) {
 		MAPPHAR_FAIL("internal corruption of phar \"%s\" (buffer overrun)");
 	}

-	if (manifest_len < 10 + tmp_len) {
+	if (manifest_len < MANIFEST_FIXED_LEN + tmp_len) {
 		MAPPHAR_FAIL("internal corruption of phar \"%s\" (truncated manifest header)")
 	}

@@ -1014,7 +1026,7 @@ static int phar_parse_pharfile(php_stream *fp, char *fname, int fname_len, char
 	}

 	/* we have 5 32-bit items plus 1 byte at least */
-	if (manifest_count > ((manifest_len - 10 - tmp_len) / (5 * 4 + 1))) {
+	if (manifest_count > ((manifest_len - MANIFEST_FIXED_LEN - tmp_len) / (5 * 4 + 1))) {
 		/* prevent serious memory issues */
 		MAPPHAR_FAIL("internal corruption of phar \"%s\" (too many manifest entries for size of manifest)")
 	}
@@ -1023,12 +1035,12 @@ static int phar_parse_pharfile(php_stream *fp, char *fname, int fname_len, char
 	mydata->is_persistent = PHAR_G(persist);

 	/* check whether we have meta data, zero check works regardless of byte order */
-	PHAR_GET_32(buffer, len);
+	SAFE_PHAR_GET_32(buffer, endbuffer, len);
 	if (mydata->is_persistent) {
 		mydata->metadata_len = len;
-		if(!len) {
+		if (!len) {
 			/* FIXME: not sure why this is needed but removing it breaks tests */
-			PHAR_GET_32(buffer, len);
+			SAFE_PHAR_GET_32(buffer, endbuffer, len);
 		}
 	}
 	if(len > (size_t)(endbuffer - buffer)) {
@@ -1996,7 +2008,7 @@ next_extension:
 	}

 	while (pos != filename && (*(pos - 1) == '/' || *(pos - 1) == '\0')) {
-		pos = memchr(pos + 1, '.', filename_len - (pos - filename) + 1);
+		pos = memchr(pos + 1, '.', filename_len - (pos - filename) - 1);
 		if (!pos) {
 			return FAILURE;
 		}
@@ -3684,7 +3684,8 @@ static void phar_add_file(phar_archive_data **pphar, char *filename, int filenam
 	char *error;
 	size_t contents_len;
 	phar_entry_data *data;
-	php_stream *contents_file;
+	php_stream *contents_file = NULL;
+	php_stream_statbuf ssb;

 	if (filename_len >= (int)sizeof(".phar")-1) {
 		start_pos = ('/' == filename[0] ? 1 : 0); /* account for any leading slash: multiple-leads handled elsewhere */
@@ -3721,10 +3722,20 @@ static void phar_add_file(phar_archive_data **pphar, char *filename, int filenam
 				}
 				php_stream_copy_to_stream_ex(contents_file, data->fp, PHP_STREAM_COPY_ALL, &contents_len);
 			}
-
 			data->internal_file->compressed_filesize = data->internal_file->uncompressed_filesize = contents_len;
 		}

+		if (contents_file != NULL && php_stream_stat(contents_file, &ssb) != -1) {
+			data->internal_file->flags = ssb.sb.st_mode & PHAR_ENT_PERM_MASK ;
+		} else {
+#ifndef _WIN32
+			mode_t mask;
+			mask = umask(0);
+			umask(mask);
+			data->internal_file->flags &= ~mask;
+#endif
+		}
+
 		/* check for copy-on-write */
 		if (pphar[0] != data->phar) {
 			*pphar = data->phar;
@@ -13,4 +13,4 @@ echo "OK\n";
 }
 ?>
 --EXPECTF--
-cannot load phar "%sbug73768.phar" with implicit alias "" under different alias "alias.phar"
+internal corruption of phar "%sbug73768.phar" (truncated manifest header)
@@ -0,0 +1,36 @@
+--TEST--
+Phar: Bug #77022: PharData always creates new files with mode 0666
+--SKIPIF--
+<?php 
+if (!extension_loaded("phar")) die("skip"); 
+if (defined("PHP_WINDOWS_VERSION_MAJOR")) die("skip not for Windows")
+?>
+--FILE--
+<?php
+umask(022);
+var_dump(decoct(umask()));
+
+$sFile = tempnam(__DIR__, 'test77022');
+var_dump(decoct(stat($sFile)['mode']));
+
+foreach([Phar::TAR => 'tar', Phar::ZIP => 'zip'] as $mode => $ext) {
+	clearstatcache();
+	$phar = new PharData(__DIR__ . '/test77022.' . $ext, null, null, $mode);
+	$phar->addFile($sFile, 'test-file-phar');
+	$phar->addFromString("test-from-string", 'test-file-phar');
+	$phar->extractTo(__DIR__);
+	var_dump(decoct(stat(__DIR__ . '/test-file-phar')['mode']));
+	var_dump(decoct(stat(__DIR__ . '/test-from-string')['mode']));
+	unlink(__DIR__ . '/test-file-phar');
+	unlink(__DIR__ . '/test-from-string');
+	unlink(__DIR__ . '/test77022.' . $ext);
+}
+unlink($sFile);
+?>
+--EXPECT--
+string(2) "22"
+string(6) "100600"
+string(6) "100600"
+string(6) "100644"
+string(6) "100600"
+string(6) "100644"
@@ -0,0 +1,18 @@
+--TEST--
+PHP bug #77143: Heap Buffer Overflow (READ: 4) in phar_parse_pharfile
+--INI--
+phar.readonly=0
+--SKIPIF--
+<?php if (!extension_loaded("phar")) die("skip"); ?>
+--FILE--
+<?php
+chdir(__DIR__);
+try {
+var_dump(new Phar('bug77143.phar',0,'project.phar'));
+echo "OK\n";
+} catch(UnexpectedValueException $e) {
+	echo $e->getMessage();
+}
+?>
+--EXPECTF--
+internal corruption of phar "%sbug77143.phar" (truncated manifest header)
@@ -0,0 +1,14 @@
+--TEST--
+PHP bug #77247 (heap buffer overflow in phar_detect_phar_fname_ext)
+--SKIPIF--
+<?php if (!extension_loaded("phar")) die("skip"); ?>
+--FILE--
+<?php
+try {
+var_dump(new Phar('a/.b', 0,'test.phar'));
+} catch(UnexpectedValueException $e) {
+	echo "OK";
+}
+?>
+--EXPECT--
+OK
@@ -7,6 +7,7 @@ phar.require_hash=1
 phar.readonly=0
 --FILE--
 <?php
+umask(0);
 Phar::interceptFileFuncs();
 var_dump(stat(""));

@@ -82,6 +82,14 @@ if test "$PHP_SOCKETS" != "no"; then
    AC_DEFINE(HAVE_AI_IDN,1,[Whether you have AI_IDN])
  fi

-  PHP_NEW_EXTENSION([sockets], [sockets.c multicast.c conversions.c sockaddr_conv.c sendrecvmsg.c], [$ext_shared],, -DZEND_ENABLE_STATIC_TSRMLS_CACHE=1)
+  PHP_SOCKETS_CFLAGS=-DZEND_ENABLE_STATIC_TSRMLS_CACHE=1
+  case $host_alias in
+  *darwin*) PHP_SOCKETS_CFLAGS="$PHP_SOCKETS_CFLAGS -D__APPLE_USE_RFC_3542"
+  esac
+  PHP_NEW_EXTENSION(
+    [sockets],
+    [sockets.c multicast.c conversions.c sockaddr_conv.c sendrecvmsg.c],
+    [$ext_shared],,
+    $PHP_SOCKETS_CFLAGS)
  PHP_INSTALL_HEADERS([ext/sockets/], [php_sockets.h])
 fi
@@ -2780,7 +2780,7 @@ PHP_FUNCTION(sodium_base642bin)
 							 "invalid base64 variant identifier", 0);
 		return;
 	}
-	bin_len = b64_len / 4U * 3U + 1U;
+	bin_len = b64_len / 4U * 3U + 2U;
 	bin = zend_string_alloc(bin_len, 0);
 	if (sodium_base642bin((unsigned char *) ZSTR_VAL(bin), bin_len,
 						  b64, b64_len,
@@ -3399,9 +3399,6 @@ PHP_FUNCTION(sodium_pad)
 	}
 	xpadded_len = unpadded_len + xpadlen;
 	padded = zend_string_alloc(xpadded_len + 1U, 0);
-	st = 1U;
-	i = 0U;
-	k = unpadded_len;
 	if (unpadded_len > 0) {
 		st = 1U;
 		i = 0U;
@@ -1568,6 +1568,9 @@ PHP_METHOD(sqlite3stmt, execute)

 	SQLITE3_CHECK_INITIALIZED(stmt_obj->db_obj, stmt_obj->initialised, SQLite3);

+	/* Always reset statement before execution, see bug #77051 */
+	sqlite3_reset(stmt_obj->stmt);
+
 	if (stmt_obj->bound_params) {
 		ZEND_HASH_FOREACH_PTR(stmt_obj->bound_params, param) {
 			zval *parameter;
@@ -0,0 +1,84 @@
+--TEST--
+Bug #77051 SQLite3::bindParam memory bug when missing ::reset call
+--SKIPIF--
+<?php require_once(__DIR__ . '/skipif.inc'); ?>
+--FILE--
+<?php
+
+$db = new SQLite3(':memory:');
+$db->enableExceptions(true);
+
+$stmt = $db->prepare('SELECT :a, :b, ?;');
+
+$a = 42;
+$stmt->bindParam(':a', $a, SQLITE3_INTEGER);
+$stmt->bindValue(':b', 'php');
+$stmt->bindValue(':b', 'PHP');
+$stmt->bindValue(3, 424242);
+
+echo "Execute statement\n";
+var_dump($res = $stmt->execute());
+
+echo "Statement result\n";
+var_dump($res->fetchArray(SQLITE3_NUM));
+
+echo "Change binded param to wrong type\n";
+$a = 'TEST';
+
+echo "Execute statement\n";
+var_dump($res = $stmt->execute());
+
+echo "Statement result\n";
+var_dump($res->fetchArray(SQLITE3_NUM));
+
+echo "Change binded values\n";
+$a = 5252552;
+$stmt->bindValue(':b', 'TEST');
+$stmt->bindValue(3, '!!!');
+
+echo "Execute statement\n";
+var_dump($res = $stmt->execute());
+
+echo "Statement result\n";
+var_dump($res->fetchArray(SQLITE3_NUM));
+
+?>
+--EXPECTF--
+Execute statement
+object(SQLite3Result)#3 (0) {
+}
+Statement result
+array(3) {
+  [0]=>
+  int(42)
+  [1]=>
+  string(3) "PHP"
+  [2]=>
+  int(424242)
+}
+Change binded param to wrong type
+Execute statement
+object(SQLite3Result)#4 (0) {
+}
+Statement result
+array(3) {
+  [0]=>
+  int(0)
+  [1]=>
+  string(3) "PHP"
+  [2]=>
+  int(424242)
+}
+Change binded values
+Execute statement
+object(SQLite3Result)#3 (0) {
+}
+Statement result
+array(3) {
+  [0]=>
+  int(5252552)
+  [1]=>
+  string(4) "TEST"
+  [2]=>
+  string(3) "!!!"
+}
@@ -1,11 +1,11 @@
-/* 
+/*
                      DO NOT EDIT THIS FILE!

- it has been automaticaly created by php7/scripts/credits from  
+ it has been automaticaly created by php7/scripts/credits from
 the information found in the various php7/ext/.../CREDITS and
- php7/sapi/.../CREDITS files 
- 
- if you want to change an entry you have to edit the appropriate 
+ php7/sapi/.../CREDITS files
+
+ if you want to change an entry you have to edit the appropriate
 CREDITS file instead

 */
@@ -28,7 +28,7 @@ CREDIT_LINE("FTP", "Stefan Esser, Andrew Skalski");
 CREDIT_LINE("GD imaging", "Rasmus Lerdorf, Stig Bakken, Jim Winstead, Jouni Ahto, Ilia Alshanetsky, Pierre-Alain Joye, Marcus Boerger");
 CREDIT_LINE("GetText", "Alex Plotnick");
 CREDIT_LINE("GNU GMP support", "Stanislav Malyshev");
-CREDIT_LINE("Iconv", "Rui Hirokawa, Stig Bakken, Moriyoshi Koizumi ");
+CREDIT_LINE("Iconv", "Rui Hirokawa, Stig Bakken, Moriyoshi Koizumi");
 CREDIT_LINE("IMAP", "Rex Logan, Mark Musone, Brian Wang, Kaj-Michael Lang, Antoni Pamies Olive, Rasmus Lerdorf, Andrew Skalski, Chuck Hagenbuch, Daniel R Kalowsky");
 CREDIT_LINE("Input Filter", "Rasmus Lerdorf, Derick Rethans, Pierre-Alain Joye, Ilia Alshanetsky");
 CREDIT_LINE("InterBase", "Jouni Ahto, Andrew Avdeev, Ard Biesheuvel");
@@ -1,11 +1,11 @@
-/* 
+/*
                      DO NOT EDIT THIS FILE!

- it has been automaticaly created by php7/scripts/credits from  
+ it has been automaticaly created by php7/scripts/credits from
 the information found in the various php7/ext/.../CREDITS and
- php7/sapi/.../CREDITS files 
- 
- if you want to change an entry you have to edit the appropriate 
+ php7/sapi/.../CREDITS files
+
+ if you want to change an entry you have to edit the appropriate
 CREDITS file instead

 */
@@ -456,6 +456,10 @@ static u_char *php_parserr(u_char *cp, u_char *end, querybuf *answer, int type_t
 	GETLONG(ttl, cp);
 	GETSHORT(dlen, cp);
 	CHECKCP(dlen);
+	if (dlen == 0) {
+		/* No data in the response - nothing to do */
+		return NULL;
+	}
 	if (type_to_fetch != T_ANY && type != type_to_fetch) {
 		cp += dlen;
 		return cp;
@@ -546,6 +550,9 @@ static u_char *php_parserr(u_char *cp, u_char *end, querybuf *answer, int type_t
 			CHECKCP(n);
 			add_assoc_stringl(subarray, "tag", (char*)cp, n);
 			cp += n;
+			if ( (size_t) dlen < ((size_t)n) + 2 ) {
+				return NULL;
+			}
 			n = dlen - n - 2;
 			CHECKCP(n);
 			add_assoc_stringl(subarray, "value", (char*)cp, n);
@@ -917,7 +917,7 @@ static php_conv_err_t php_conv_qprint_encode_convert(php_conv_qprint_encode *ins
 			line_ccnt--;
 			CONSUME_CHAR(ps, icnt, lb_ptr, lb_cnt);
 		} else {
-			if (line_ccnt < 4) {
+			if (line_ccnt < 4 && inst->lbchars != NULL) {
 				if (ocnt < inst->lbchars_len + 1) {
 					err = PHP_CONV_ERR_TOO_BIG;
 					break;
@@ -0,0 +1,11 @@
+--TEST--
+Bug #77231 (Segfault when using convert.quoted-printable-encode filter)
+--FILE--
+<?php
+var_dump(file(urldecode('php://filter/convert.quoted-printable-encode/resource=data://,%bfAAAAAAAAFAAAAAAAAAAAAAA%ff%ff%ff%ff%ff%ff%ff%ffAAAAAAAAAAAAAAAAAAAAAAAA')));
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  string(74) "=BFAAAAAAAAFAAAAAAAAAAAAAA=FF=FF=FF=FF=FF=FF=FF=FFAAAAAAAAAAAAAAAAAAAAAAAA"
+}
@@ -4,7 +4,9 @@
 ARG_WITH("tidy", "TIDY support", "no");

 if (PHP_TIDY != "no") {
-	if (CHECK_LIB("libtidy_a.lib;libtidy.lib;tidy_a.lib;tidy.lib", "tidy", PHP_TIDY) &&
+	var tidy_static = false;
+	if ((CHECK_LIB("libtidy_a.lib;tidy_a.lib", "tidy", PHP_TIDY) && (tidy_static = true) ||
+		CHECK_LIB("libtidy.lib;tidy.lib", "tidy", PHP_TIDY)) &&
 			(
 				CHECK_HEADER_ADD_INCLUDE("tidy.h", "CFLAGS_TIDY") ||
 				CHECK_HEADER_ADD_INCLUDE("tidy/tidy.h", "CFLAGS_TIDY", null, null, true) ||
@@ -22,6 +24,10 @@ if (PHP_TIDY != "no") {
 		if (!PHP_TIDY_SHARED) {
 			ADD_DEF_FILE("ext\\tidy\\php_tidy.def");
 		}
+		if (tidy_static) {
+			ADD_FLAG("CFLAGS_TIDY", "/DTIDY_STATIC=1");
+		}
+
 	} else {
 		WARNING("tidy not enabled; libraries and headers not found");
 	}
@@ -1,290 +1,190 @@
 EXPORTS
-tidyBufInit
+TidyLangPosixName
+TidyLangWindowsName
+getErrorCodeList
+getInstalledLanguageList
+getNextErrorCode
+getNextInstalledLanguage
+getNextStringKey
+getNextWindowsLanguage
+getStringKeyList
+getWindowsLanguageList
+tidyAccessWarningCount
+tidyAttrDiscard
+tidyAttrFirst
+tidyAttrGetById
+tidyAttrGetId
+tidyAttrIsEvent
+tidyAttrName
+tidyAttrNext
+tidyAttrValue
 tidyBufAlloc
-tidyBufCheckAlloc
-tidyBufFree
-tidyBufClear
-tidyBufAttach
-tidyBufDetach
+tidyBufAllocWithAllocator
 tidyBufAppend
-tidyBufPutByte
-tidyBufPopByte
-tidyBufGetByte
+tidyBufAttach
+tidyBufCheckAlloc
+tidyBufClear
+tidyBufDetach
 tidyBufEndOfInput
+tidyBufFree
+tidyBufGetByte
+tidyBufInit
+tidyBufInitWithAllocator
+tidyBufPopByte
+tidyBufPutByte
 tidyBufUngetByte
+tidyCleanAndRepair
+tidyConfigErrorCount
 tidyCreate
-tidyRelease
-tidySetAppData
-tidyGetAppData
-tidyReleaseDate
-tidyStatus
+tidyCreateWithAllocator
+tidyDefaultString
+tidyDetectedGenericXml
 tidyDetectedHtmlVersion
 tidyDetectedXhtml
-tidyDetectedGenericXml
+tidyDiscardElement
+tidyErrorCodeAsKey
+tidyErrorCodeFromKey
 tidyErrorCount
-tidyWarningCount
-tidyAccessWarningCount
-tidyConfigErrorCount
-tidyLoadConfig
-tidyLoadConfigEnc
+tidyErrorSummary
 tidyFileExists
-tidySetCharEncoding
-tidySetOptionCallback
-tidyOptGetIdForName
-tidyGetOptionList
+tidyGeneralInfo
+tidyGetAppData
+tidyGetArgFormat
+tidyGetArgType
+tidyGetArgValueDouble
+tidyGetArgValueInt
+tidyGetArgValueString
+tidyGetArgValueUInt
+tidyGetBody
+tidyGetByte
+tidyGetChild
+tidyGetEmacsFile
+tidyGetHead
+tidyGetHtml
+tidyGetLanguage
+tidyGetMessage
+tidyGetMessageArguments
+tidyGetMessageCode
+tidyGetMessageColumn
+tidyGetMessageDefault
+tidyGetMessageDoc
+tidyGetMessageFormat
+tidyGetMessageFormatDefault
+tidyGetMessageIsMuted
+tidyGetMessageKey
+tidyGetMessageLevel
+tidyGetMessageLine
+tidyGetMessageOutput
+tidyGetMessageOutputDefault
+tidyGetMessagePos
+tidyGetMessagePosDefault
+tidyGetMessagePrefix
+tidyGetMessagePrefixDefault
+tidyGetNext
+tidyGetNextMessageArgument
 tidyGetNextOption
 tidyGetOption
 tidyGetOptionByName
-tidyOptGetId
-tidyOptGetName
-tidyOptGetType
-tidyOptIsReadOnly
-tidyOptGetCategory
-tidyOptGetDefault
-tidyOptGetDefaultInt
-tidyOptGetDefaultBool
-tidyOptGetPickList
-tidyOptGetNextPick
-tidyOptGetValue
-tidyOptSetValue
-tidyOptParseValue
-tidyOptGetInt
-tidyOptSetInt
-tidyOptGetBool
-tidyOptSetBool
-tidyOptResetToDefault
-tidyOptResetAllToDefault
-tidyOptSnapshot
-tidyOptResetToSnapshot
+tidyGetOptionList
+tidyGetParent
+tidyGetPrev
+tidyGetRoot
+tidyInitInputBuffer
+tidyInitOutputBuffer
+tidyInitSink
+tidyInitSource
+tidyIsEOF
+tidyLibraryVersion
+tidyLoadConfig
+tidyLoadConfigEnc
+tidyLocalizedString
+tidyLocalizedStringN
+tidyNodeColumn
+tidyNodeGetId
+tidyNodeGetName
+tidyNodeGetText
+tidyNodeGetType
+tidyNodeGetValue
+tidyNodeHasText
+tidyNodeIsHeader
+tidyNodeIsProp
+tidyNodeIsText
+tidyNodeLine
+tidyOptCopyConfig
 tidyOptDiffThanDefault
 tidyOptDiffThanSnapshot
-tidyOptCopyConfig
-tidyOptGetEncName
+tidyOptGetBool
+tidyOptGetCategory
 tidyOptGetCurrPick
 tidyOptGetDeclTagList
+tidyOptGetDefault
+tidyOptGetDefaultBool
+tidyOptGetDefaultInt
+tidyOptGetDoc
+tidyOptGetDocLinksList
+tidyOptGetEncName
+tidyOptGetId
+tidyOptGetIdForName
+tidyOptGetInt
+tidyOptGetMutedMessageList
+tidyOptGetName
 tidyOptGetNextDeclTag
-tidyInitSource
-tidyGetByte
-tidyUngetByte
-tidyIsEOF
-tidyInitSink
-tidyPutByte
-tidySetReportFilter
-tidySetErrorFile
-tidySetErrorBuffer
-tidySetErrorSink
-tidySetMallocCall
-tidySetReallocCall
-tidySetFreeCall
-tidySetPanicCall
-tidyParseFile
-tidyParseStdin
-tidyParseString
-tidyParseBuffer
-tidyParseSource
-tidyCleanAndRepair
-tidyRunDiagnostics
-tidySaveFile
-tidySaveStdout
-tidySaveBuffer
-tidySaveString
-tidySaveSink
+tidyOptGetNextDocLinks
+tidyOptGetNextMutedMessage
+tidyOptGetNextPick
+tidyOptGetNextPriorityAttr
+tidyOptGetPickList
+tidyOptGetPriorityAttrList
+tidyOptGetType
+tidyOptGetValue
+tidyOptIsReadOnly
+tidyOptParseValue
+tidyOptResetAllToDefault
+tidyOptResetToDefault
+tidyOptResetToSnapshot
 tidyOptSaveFile
 tidyOptSaveSink
-tidyErrorSummary
-tidyGeneralInfo
-tidyGetRoot
-tidyGetHtml
-tidyGetHead
-tidyGetBody
-tidyGetParent
-tidyGetChild
-tidyGetNext
-tidyGetPrev
-tidyAttrFirst
-tidyAttrNext
-tidyAttrName
-tidyAttrValue
-tidyNodeGetType
-tidyNodeGetName
-tidyNodeIsText
-tidyNodeIsProp
-tidyNodeIsHeader
-tidyNodeHasText
-tidyNodeGetText
-tidyNodeGetId
-tidyNodeLine
-tidyNodeColumn
-tidyNodeIsHTML
-tidyNodeIsHEAD
-tidyNodeIsTITLE
-tidyNodeIsBASE
-tidyNodeIsMETA
-tidyNodeIsBODY
-tidyNodeIsFRAMESET
-tidyNodeIsFRAME
-tidyNodeIsIFRAME
-tidyNodeIsNOFRAMES
-tidyNodeIsHR
-tidyNodeIsH1
-tidyNodeIsH2
-tidyNodeIsPRE
-tidyNodeIsLISTING
-tidyNodeIsP
-tidyNodeIsUL
-tidyNodeIsOL
-tidyNodeIsDL
-tidyNodeIsDIR
-tidyNodeIsLI
-tidyNodeIsDT
-tidyNodeIsDD
-tidyNodeIsTABLE
-tidyNodeIsCAPTION
-tidyNodeIsTD
-tidyNodeIsTH
-tidyNodeIsTR
-tidyNodeIsCOL
-tidyNodeIsCOLGROUP
-tidyNodeIsBR
-tidyNodeIsA
-tidyNodeIsLINK
-tidyNodeIsB
-tidyNodeIsI
-tidyNodeIsSTRONG
-tidyNodeIsEM
-tidyNodeIsBIG
-tidyNodeIsSMALL
-tidyNodeIsPARAM
-tidyNodeIsOPTION
-tidyNodeIsOPTGROUP
-tidyNodeIsIMG
-tidyNodeIsMAP
-tidyNodeIsAREA
-tidyNodeIsNOBR
-tidyNodeIsWBR
-tidyNodeIsFONT
-tidyNodeIsLAYER
-tidyNodeIsSPACER
-tidyNodeIsCENTER
-tidyNodeIsSTYLE
-tidyNodeIsSCRIPT
-tidyNodeIsNOSCRIPT
-tidyNodeIsFORM
-tidyNodeIsTEXTAREA
-tidyNodeIsBLOCKQUOTE
-tidyNodeIsAPPLET
-tidyNodeIsOBJECT
-tidyNodeIsDIV
-tidyNodeIsSPAN
-tidyNodeIsINPUT
-tidyNodeIsQ
-tidyNodeIsLABEL
-tidyNodeIsH3
-tidyNodeIsH4
-tidyNodeIsH5
-tidyNodeIsH6
-tidyNodeIsADDRESS
-tidyNodeIsXMP
-tidyNodeIsSELECT
-tidyNodeIsBLINK
-tidyNodeIsMARQUEE
-tidyNodeIsEMBED
-tidyNodeIsBASEFONT
-tidyNodeIsISINDEX
-tidyNodeIsS
-tidyNodeIsSTRIKE
-tidyNodeIsU
-tidyNodeIsMENU
-tidyAttrGetId
-tidyAttrIsEvent
-tidyAttrIsProp
-tidyAttrIsHREF
-tidyAttrIsSRC
-tidyAttrIsID
-tidyAttrIsNAME
-tidyAttrIsSUMMARY
-tidyAttrIsALT
-tidyAttrIsLONGDESC
-tidyAttrIsUSEMAP
-tidyAttrIsISMAP
-tidyAttrIsLANGUAGE
-tidyAttrIsTYPE
-tidyAttrIsVALUE
-tidyAttrIsCONTENT
-tidyAttrIsTITLE
-tidyAttrIsXMLNS
-tidyAttrIsDATAFLD
-tidyAttrIsWIDTH
-tidyAttrIsHEIGHT
-tidyAttrIsFOR
-tidyAttrIsSELECTED
-tidyAttrIsCHECKED
-tidyAttrIsLANG
-tidyAttrIsTARGET
-tidyAttrIsHTTP_EQUIV
-tidyAttrIsREL
-tidyAttrIsOnMOUSEMOVE
-tidyAttrIsOnMOUSEDOWN
-tidyAttrIsOnMOUSEUP
-tidyAttrIsOnCLICK
-tidyAttrIsOnMOUSEOVER
-tidyAttrIsOnMOUSEOUT
-tidyAttrIsOnKEYDOWN
-tidyAttrIsOnKEYUP
-tidyAttrIsOnKEYPRESS
-tidyAttrIsOnFOCUS
-tidyAttrIsOnBLUR
-tidyAttrIsBGCOLOR
-tidyAttrIsLINK
-tidyAttrIsALINK
-tidyAttrIsVLINK
-tidyAttrIsTEXT
-tidyAttrIsSTYLE
-tidyAttrIsABBR
-tidyAttrIsCOLSPAN
-tidyAttrIsROWSPAN
-tidyAttrGetHREF
-tidyAttrGetSRC
-tidyAttrGetID
-tidyAttrGetNAME
-tidyAttrGetSUMMARY
-tidyAttrGetALT
-tidyAttrGetLONGDESC
-tidyAttrGetUSEMAP
-tidyAttrGetISMAP
-tidyAttrGetLANGUAGE
-tidyAttrGetTYPE
-tidyAttrGetVALUE
-tidyAttrGetCONTENT
-tidyAttrGetTITLE
-tidyAttrGetXMLNS
-tidyAttrGetDATAFLD
-tidyAttrGetWIDTH
-tidyAttrGetHEIGHT
-tidyAttrGetFOR
-tidyAttrGetSELECTED
-tidyAttrGetCHECKED
-tidyAttrGetLANG
-tidyAttrGetTARGET
-tidyAttrGetHTTP_EQUIV
-tidyAttrGetREL
-tidyAttrGetOnMOUSEMOVE
-tidyAttrGetOnMOUSEDOWN
-tidyAttrGetOnMOUSEUP
-tidyAttrGetOnCLICK
-tidyAttrGetOnMOUSEOVER
-tidyAttrGetOnMOUSEOUT
-tidyAttrGetOnKEYDOWN
-tidyAttrGetOnKEYUP
-tidyAttrGetOnKEYPRESS
-tidyAttrGetOnFOCUS
-tidyAttrGetOnBLUR
-tidyAttrGetBGCOLOR
-tidyAttrGetLINK
-tidyAttrGetALINK
-tidyAttrGetVLINK
-tidyAttrGetTEXT
-tidyAttrGetSTYLE
-tidyAttrGetABBR
-tidyAttrGetCOLSPAN
-tidyAttrGetROWSPAN
+tidyOptSetBool
+tidyOptSetInt
+tidyOptSetValue
+tidyOptSnapshot
+tidyOptionIsList
+tidyParseBuffer
+tidyParseFile
+tidyParseSource
+tidyParseStdin
+tidyParseString
+tidyPlatform
+tidyPutByte
+tidyRelease
+tidyReleaseDate
+tidyReportDoctype
+tidyRunDiagnostics
+tidySaveBuffer
+tidySaveFile
+tidySaveSink
+tidySaveStdout
+tidySaveString
+tidySetAppData
+tidySetCharEncoding
+tidySetConfigCallback
+tidySetConfigChangeCallback
+tidySetEmacsFile
+tidySetErrorBuffer
+tidySetErrorFile
+tidySetErrorSink
+tidySetFreeCall
+tidySetInCharEncoding
+tidySetLanguage
+tidySetMallocCall
+tidySetMessageCallback
+tidySetOptionCallback
+tidySetOutCharEncoding
+tidySetPanicCall
+tidySetPrettyPrinterCallback
+tidySetReallocCall
+tidySetReportCallback
+tidySetReportFilter
+tidyStatus
+tidyUngetByte
+tidyWarningCount
@@ -2,6 +2,8 @@
 Bug #73631 (Memory leak due to invalid wddx stack processing)
 --SKIPIF--
 <?php if (!extension_loaded("wddx")) print "skip"; ?>
+---XFAIL--
+Still has memory leaks in debug build.
 --FILE--
 <?php
 $xml = <<<EOF
@@ -77,7 +77,7 @@ void base64_encode_xmlrpc(struct buffer_st *b, const char *source, int length)

  while (!hiteof) {
    unsigned char igroup[3], ogroup[4];
-    int c, n;
+	int c, n;

    igroup[0] = igroup[1] = igroup[2] = 0;
    for (n = 0; n < 3; n++) {
@@ -169,7 +169,7 @@ void base64_decode_xmlrpc(struct buffer_st *bfr, const char *source, int length)
 		return;
 	    }

-	    if (dtable[c] & 0x80) {
+	    if (dtable[(unsigned char)c] & 0x80) {
 	      /*
 	      fprintf(stderr, "Offset %i length %i\n", offset, length);
 	      fprintf(stderr, "character '%c:%x:%c' in input file.\n", c, c, dtable[c]);
@@ -720,6 +720,9 @@ xml_element* xml_elem_parse_buf(const char* in_buf, int len, XML_ELEM_INPUT_OPTI
         long byte_idx = XML_GetCurrentByteIndex(parser);
 /*         int byte_total = XML_GetCurrentByteCount(parser); */
         const char * error_str = XML_ErrorString(err_code);
+         if(byte_idx > len) {
+             byte_idx = len;
+         }
         if(byte_idx >= 0) {
             snprintf(buf,
                      sizeof(buf),
@@ -0,0 +1,10 @@
+--TEST--
+Bug #77242 (heap out of bounds read in xmlrpc_decode())
+--SKIPIF--
+<?php if (!extension_loaded("xmlrpc")) print "skip"; ?>
+--FILE--
+<?php
+var_dump(xmlrpc_decode(base64_decode("PD94bWwgdmVyc2lvbmVuY29kaW5nPSJJU084ODU5NyKkpKSkpKSkpKSkpKSkpKSkpKSkpKSk")));
+?>
+--EXPECT--
+NULL
@@ -0,0 +1,17 @@
+--TEST--
+Bug #77380 (Global out of bounds read in xmlrpc base64 code)
+--SKIPIF--
+<?php
+if (!extension_loaded("xmlrpc")) print "skip";
+?>
+--FILE--
+<?php
+var_dump(xmlrpc_decode(base64_decode("PGJhc2U2ND7CkzwvYmFzZTY0Pgo=")));
+?>
+--EXPECT--
+object(stdClass)#1 (2) {
+  ["scalar"]=>
+  string(0) ""
+  ["xmlrpc_type"]=>
+  string(6) "base64"
+}
@@ -2,7 +2,7 @@
 /* edit configure.ac to change version number */
 #define PHP_MAJOR_VERSION 7
 #define PHP_MINOR_VERSION 2
-#define PHP_RELEASE_VERSION 13
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "7.2.13-dev"
-#define PHP_VERSION_ID 70213
+#define PHP_RELEASE_VERSION 14
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "7.2.14"
+#define PHP_VERSION_ID 70214
@@ -968,6 +968,13 @@ cli_server.color = On
 ; otherwise output encoding conversion cannot be performed.
 ;iconv.output_encoding =

+[imap]
+; rsh/ssh logins are disabled by default. Use this INI entry if you want to
+; enable them. Note that the IMAP library does not filter mailbox names before
+; passing them to rsh/ssh command, thus passing untrusted data to this function
+; with rsh/ssh enabled is insecure.
+;imap.enable_insecure_rsh=0
+
 [intl]
 ;intl.default_locale =
 ; This directive allows you to produce PHP errors when some error
@@ -975,6 +975,13 @@ cli_server.color = On
 ; otherwise output encoding conversion cannot be performed.
 ;iconv.output_encoding =

+[imap]
+; rsh/ssh logins are disabled by default. Use this INI entry if you want to
+; enable them. Note that the IMAP library does not filter mailbox names before
+; passing them to rsh/ssh command, thus passing untrusted data to this function
+; with rsh/ssh enabled is insecure.
+;imap.enable_insecure_rsh=0
+
 [intl]
 ;intl.default_locale =
 ; This directive allows you to produce PHP errors when some error
Author	SHA1	Message	Date
Remi Collet	643a161a24	Update versions for PHP 7.2.14	2019-01-08 09:43:02 +00:00
Remi Collet	ba64d2cbdf	Update NEWS for PHP 7.2.14	2019-01-08 09:43:02 +00:00
Remi Collet	f25ad94494	cleanup merge	2019-01-08 09:35:31 +01:00
Alexander Kurilo	c725b782d9	Regenerate certs for openssl tests	2019-01-07 11:54:24 +01:00
Remi Collet	d4b8081d5b	[ci skip] NEWS	2019-01-07 11:11:06 +01:00
Stanislav Malyshev	e91b7cdde8	Merge branch 'PHP-7.1' into PHP-7.2 * PHP-7.1: Still leaking for some reason, XFAIL for now, I'll look into it later.	2019-01-07 11:07:35 +01:00
Stanislav Malyshev	9bc3ca418f	Merge branch 'PHP-7.1' into PHP-7.2 * PHP-7.1: Fix bug #77418 - Heap overflow in utf32be_mbc_to_code Add NEWS [ci skip] Add NEWS Fix more issues with encodilng length Fix #77270: imagecolormatch Out Of Bounds Write on Heap Fix bug #77380 (Global out of bounds read in xmlrpc base64 code) Fix bug #77371 (heap buffer overflow in mb regex functions - compile_string_node) Fix bug #77370 - check that we do not read past buffer end when parsing multibytes Fix #77269: Potential unsigned underflow in gdImageScale Fix bug #77247 (heap buffer overflow in phar_detect_phar_fname_ext) Fix bug #77242 (heap out of bounds read in xmlrpc_decode()) Regenerate certs for openssl tests	2019-01-07 11:07:19 +01:00
Stanislav Malyshev	f94b81ce48	Fix tests - newer versions check Unicode	2019-01-07 11:06:35 +01:00
Stanislav Malyshev	678429c028	Merge branch 'PHP-7.1' into PHP-7.2 * PHP-7.1: Fix test	2019-01-07 11:05:15 +01:00
Stanislav Malyshev	ad2412c169	Merge branch 'PHP-7.1' into PHP-7.2 * PHP-7.1: Fix #77369 - memcpy with negative length via crafted DNS response Fix more issues with encodilng length Fix #77270: imagecolormatch Out Of Bounds Write on Heap Fix bug #77380 (Global out of bounds read in xmlrpc base64 code) Fix bug #77371 (heap buffer overflow in mb regex functions - compile_string_node) Fix bug #77370 - check that we do not read past buffer end when parsing multibytes Fix #77269: Potential unsigned underflow in gdImageScale Fix bug #77247 (heap buffer overflow in phar_detect_phar_fname_ext) Fix bug #77242 (heap out of bounds read in xmlrpc_decode()) Regenerate certs for openssl tests	2019-01-07 11:04:06 +01:00
Remi Collet	8240cf0fda	missing entry for #77020	2018-12-18 16:31:53 +01:00
Remi Collet	66778cd2f4	Update CREDITS for PHP 7.2.14RC1	2018-12-18 11:08:31 +00:00
Remi Collet	8feb435bc2	Update NEWS for PHP 7.2.14RC1	2018-12-18 11:08:31 +00:00
Christopher Jones	3aee9ca571	LOL I had 2.10 on my mind	2018-12-10 21:54:13 +11:00
Christopher Jones	444e400c3b	Bundle the new test	2018-12-10 10:45:43 +11:00
Christopher Jones	e4d894edb3	Improve test portability	2018-12-10 10:16:15 +11:00
Christopher Jones	56e2c0d7db	Update for newer Oracle versions	2018-12-10 10:15:53 +11:00
Anatol Belski	81207fc607	Fix syntax error	2018-12-09 19:13:09 +01:00
Anatol Belski	0d166f76ee	Fix libtidy exports when ext/tidy compiled static	2018-12-09 18:59:05 +01:00
Christopher Jones	99f1f3dedf	Add oci_set_call_timeout() and bump version to 2.10.0	2018-12-09 20:55:04 +11:00
Christopher Jones	e2ecd60f2f	Upgrade internal OCI call	2018-12-09 12:38:35 +11:00
Christopher Jones	4246702406	Enable Oracle Database DBOP tracing attribute	2018-12-09 12:16:47 +11:00
Christopher Jones	465c149cd3	Update OCI8 README	2018-12-09 11:28:52 +11:00
Christopher Jones	216d6592e1	Convert some parameter parsing to the Fast Parameter Parsing API	2018-12-09 11:28:04 +11:00
Remi Collet	fd0077bf06	Merge branch 'PHP-7.1' into PHP-7.2 * PHP-7.1: add imap.enable_insecure_rsh in php.ini	2018-12-08 10:25:05 +01:00
Remi Collet	4288674651	add imap.enable_insecure_rsh in php.ini	2018-12-08 10:24:36 +01:00
Christopher Jones	290671e7f2	Merge branch 'PHP-7.2' of https://git.php.net/repository/php-src into PHP-7.2	2018-12-08 20:19:59 +11:00
Christopher Jones	43adf3dc5e	Note that PECL install now works on PHP 7.3	2018-12-08 20:13:40 +11:00
Christopher Jones	9a0ec35fa3	Don't skip with 18c DB	2018-12-08 20:12:43 +11:00
Remi Collet	431ff36f51	missing entry for #77020	2018-12-08 10:07:01 +01:00
Remi Collet	da90b477c6	Merge branch 'PHP-7.1' into PHP-7.2 * PHP-7.1: missing entry for #77020	2018-12-08 10:06:34 +01:00
Remi Collet	9b8f2417ad	missing entry for #77020	2018-12-08 10:06:19 +01:00
Christopher Jones	dd0a8091f4	Fix resource warning value	2018-12-08 19:24:32 +11:00
Christopher Jones	2d53040a6d	Bump OCI8 version	2018-12-08 19:23:22 +11:00
Christopher Jones	8ff6a30598	Update NEWS	2018-12-08 19:12:04 +11:00
KoenigsKind	3c91851874	When releasing an oci8 connection always set the resource to null.	2018-12-08 18:49:12 +11:00
Nikita Popov	e3946534a4	Drop unnecessary HASH_OF uses in ext/oci8 These only operate on arrays.	2018-12-07 23:21:32 +11:00
Christopher Jones	b797818e09	Simplify based on feedback from nikic	2018-12-07 23:07:37 +11:00
Ferenc Kovacs	bc32061dba	Merge branch 'PHP-7.1' into PHP-7.2	2018-12-05 09:36:31 +01:00
Ferenc Kovacs	6cbdc5e207	Merge branch 'PHP-7.0' into PHP-7.1	2018-12-05 09:30:20 +01:00
Ferenc Kovacs	bd289af963	Merge branch 'PHP-5.6' into PHP-7.0	2018-12-05 09:25:53 +01:00
Ferenc Kovacs	c26cb383a5	5.6.40 will be next. probably not	2018-12-05 09:13:30 +01:00
Anatol Belski	6e9435f339	Merge branch 'PHP-7.1' into PHP-7.2 * PHP-7.1: Sync NEWS [ci skip]	2018-12-04 12:50:04 +01:00
Anatol Belski	d07e63211a	Merge branch 'PHP-7.0' into PHP-7.1 * PHP-7.0: Sync NEWS [ci skip]	2018-12-04 12:49:42 +01:00
Anatol Belski	a8f125fbca	Sync NEWS [ci skip]	2018-12-04 12:49:10 +01:00
Stanislav Malyshev	a9ef7ecc60	Merge branch 'PHP-7.1' into PHP-7.2 * PHP-7.1: Fix null pointer deref in qprint-encode filter (bug #77231)	2018-12-03 10:20:02 -08:00
Stanislav Malyshev	d5dc3c69f9	Merge branch 'PHP-7.0' into PHP-7.1 * PHP-7.0: Fix null pointer deref in qprint-encode filter (bug #77231)	2018-12-03 10:19:57 -08:00
Stanislav Malyshev	036bc5c1fb	Merge branch 'PHP-5.6' into PHP-7.0 * PHP-5.6: Fix null pointer deref in qprint-encode filter (bug #77231)	2018-12-03 10:19:49 -08:00
Stanislav Malyshev	78bffa72c1	Fix null pointer deref in qprint-encode filter (bug #77231 )	2018-12-03 10:19:08 -08:00
Stanislav Malyshev	8fff90250b	Merge branch 'PHP-7.1' into PHP-7.2 * PHP-7.1: Fix bug #77143 - add more checks to buffer reads Fix bug #77143 - add more checks to buffer reads Fix #77020: null pointer dereference in imap_mail	2018-12-03 00:42:50 -08:00
Stanislav Malyshev	8ab5d22332	Merge branch 'PHP-7.0' into PHP-7.1 * PHP-7.0: Fix bug #77143 - add more checks to buffer reads Fix bug #77143 - add more checks to buffer reads Fix #77020: null pointer dereference in imap_mail	2018-12-03 00:42:45 -08:00
Stanislav Malyshev	5718d73dbb	Merge branch 'PHP-5.6' into PHP-7.0 * PHP-5.6: Fix bug #77143 - add more checks to buffer reads	2018-12-03 00:42:35 -08:00
Stanislav Malyshev	48f0f73f75	Fix bug #77143 - add more checks to buffer reads	2018-12-03 00:41:46 -08:00
Stanislav Malyshev	66a0f061f6	Merge branch 'PHP-5.6' into PHP-7.0 * PHP-5.6: Fix bug #77143 - add more checks to buffer reads Fix #77020: null pointer dereference in imap_mail	2018-12-03 00:39:03 -08:00
Stanislav Malyshev	54212674b9	Fix bug #77143 - add more checks to buffer reads	2018-12-03 00:03:10 -08:00
Stanislav Malyshev	7edc639b9f	Fix #77020 : null pointer dereference in imap_mail If an empty $message is passed to imap_mail(), we must not set message to NULL, since _php_imap_mail() is not supposed to handle NULL pointers (opposed to pointers to NUL).	2018-12-03 00:00:56 -08:00
Stanislav Malyshev	1f78b1dfd0	Merge branch 'PHP-7.1' into PHP-7.2 * PHP-7.1: Don't need interactive progress on git clones in Travis	2018-12-02 16:04:33 -08:00
Philip Prindeville	61af343768	Don't need interactive progress on git clones in Travis Travis logs are usually inspected after the build completes, by which time progress info is useless. Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>	2018-12-02 16:04:22 -08:00
Stanislav Malyshev	1225467d8a	Merge branch 'PHP-7.1' into PHP-7.2 * PHP-7.1: Fix TSRM signature - php_stream_stat macro has it's own TSRM Regenerate certificates for openssl tests Improve test for bug77022	2018-12-02 15:12:15 -08:00
Stanislav Malyshev	f8eac1f438	Merge branch 'PHP-7.0' into PHP-7.1 * PHP-7.0: Fix TSRM signature - php_stream_stat macro has it's own TSRM Regenerate certificates for openssl tests Improve test for bug77022	2018-12-02 13:38:59 -08:00
Stanislav Malyshev	6e3f5d57d4	Merge branch 'PHP-5.6' into PHP-7.0 * PHP-5.6: Fix TSRM signature - php_stream_stat macro has it's own TSRM Regenerate certificates for openssl tests Improve test for bug77022	2018-12-02 13:18:07 -08:00
Stanislav Malyshev	aabdb71dc3	Fix TSRM signature - php_stream_stat macro has it's own TSRM	2018-12-02 12:54:19 -08:00
Alexander Kurilo	0382e761d7	Regenerate certificates for openssl tests	2018-12-02 12:08:19 -08:00
Stanislav Malyshev	2fba1e2f59	Improve test for bug77022	2018-12-02 12:06:13 -08:00
Alexander Kurilo	655fb96354	Regenerate certificates for openssl tests	2018-12-02 19:37:10 +00:00
Stanislav Malyshev	c5869fd1c8	Merge branch 'PHP-7.1' into PHP-7.2 * PHP-7.1:	2018-12-01 21:48:40 -08:00
Stanislav Malyshev	09885f78c6	Merge branch 'PHP-7.0' into PHP-7.1 * PHP-7.0:	2018-12-01 21:48:35 -08:00
Stanislav Malyshev	cea277048d	Merge branch 'PHP-5.6' into PHP-7.0 * PHP-5.6: Fix bug #77022 - use file mode or umask for new files	2018-12-01 21:48:27 -08:00
Stanislav Malyshev	8136d130b6	Merge branch 'PHP-7.1' into PHP-7.2 * PHP-7.1: Fix bug #77022 - use file mode or umask for new files	2018-12-01 21:47:44 -08:00
Stanislav Malyshev	1aec05defd	Merge branch 'PHP-7.0' into PHP-7.1 * PHP-7.0: Fix bug #77022 - use file mode or umask for new files	2018-12-01 21:47:37 -08:00
Stanislav Malyshev	67f3615102	Merge branch 'PHP-5.6' into PHP-7.0 * PHP-5.6: Fix bug #77022 - use file mode or umask for new files	2018-12-01 21:08:38 -08:00
Stanislav Malyshev	69f5e7992b	Fix bug #77022 - use file mode or umask for new files	2018-12-01 21:06:45 -08:00
BohwaZ	94ec262fca	Fix #77051 : Issue with re-binding on SQLite3 We have to call `sqlite3_reset()` before re-binding the parameters.	2018-11-29 02:16:57 +01:00
Stanislav Malyshev	4ac764e8bb	Merge branch 'PHP-7.1' into PHP-7.2 * PHP-7.1: Add DISPLAY_INI_ENTRIES for imap Disable rsh/ssh functionality in imap by default (bug #77153) Disable rsh/ssh functionality in imap by default (bug #77153)	2018-11-28 15:47:00 -08:00
Stanislav Malyshev	223b8c15a8	Merge branch 'PHP-7.0' into PHP-7.1 * PHP-7.0: Add DISPLAY_INI_ENTRIES for imap Disable rsh/ssh functionality in imap by default (bug #77153) Disable rsh/ssh functionality in imap by default (bug #77153)	2018-11-28 15:46:53 -08:00
Stanislav Malyshev	87bf84c8c7	Merge branch 'PHP-5.6' into PHP-7.0 * PHP-5.6: Add DISPLAY_INI_ENTRIES for imap	2018-11-28 15:46:39 -08:00
Stanislav Malyshev	d8765852e0	Add DISPLAY_INI_ENTRIES for imap	2018-11-28 15:45:51 -08:00
Derick Rethans	a3f2871b8e	Fixed bug #77097 (DateTime::diff gives wrong diff when the actual diff is less than 1 second) by upgrading to timelib 2017.09	2018-11-28 20:34:21 +00:00
Nikita Popov	17f8b9fb36	Fixed bug #77215 Remove invalid assertion: A block can have multiple switch frees, so if we don't do live range block splitting, it is not necessarily true that the free is located at the start of a block.	2018-11-28 20:08:39 +01:00
Nikita Popov	b565c85b9e	Improve fix for #76046 Also locate the JMP at the start of the foreach. Patch suggested by Derick.	2018-11-27 19:43:25 +01:00
Nikita Popov	d6595f276f	Fixed bug #76046 Place FE_FREE on start line of foreach, instead of whatever random line number might be in CG(zend_lineno) at the time.	2018-11-27 16:37:55 +01:00
Colin Basnett	9ec519e094	Fixed bug #77184 The U in URATIONAL is for unsigned, so the values should be printed as unsigned.	2018-11-26 22:48:48 +01:00
Sergei Morozov	e126ca1557	Check column number before trying to fetch the value	2018-11-26 10:34:37 -05:00
Christoph M. Becker	a1aaec08b5	Fix #77200 : imagecropauto(…, GD_CROP_SIDES) crops left but not right We apply the upstream patch[1]. [1] <https://github.com/libgd/libgd/commit/6613094e5d218dc4d4372757aef5e58c6462a9f7>	2018-11-25 19:00:50 +01:00
Christoph M. Becker	b47b8886dd	Fix #77198 : auto cropping has insufficient precision We apply the upstream patch[1], and also fix the erroneous bailout at the end of `gdImageAutoCrop()`, since `crop.x` and `crop.y` may very well be zero. [1] <https://github.com/libgd/libgd/commit/bda85aaeeb1d7467d92c892ba4c30eaa53d7a6d4>	2018-11-25 15:41:27 +01:00
Frank Denis	ff02d50909	ext/sodium: remove redundant code	2018-11-24 17:55:36 +01:00
Frank Denis	542d0bce50	ext/sodium: Correct base64 decoding with unpadded variants Backports 0eee0b957a3b75f8175cdd30b306c15e372685e8 from the PECL extension	2018-11-24 17:53:08 +01:00
Christoph M. Becker	5af5f56fc9	Fix test case	2018-11-24 13:36:42 +01:00
Christoph M. Becker	60a9f7a3a3	Fix #77195 : Incorrect error handling of imagecreatefromjpeg() The broken JPEG image triggers a notice, two warnings and outputs a message to stderr directly. The additional notice is pretty useless, and the direct output to stderr is bad. Therefore, we port the relevant differences from upstream to our bundled libgd. This leaves us with two warnings; the first one is triggered by libjpeg and shows the actual problem, the second one is triggered by our libgd wrapper whenever an image can't be read, what may not have necessarily triggered a warning before.	2018-11-24 12:52:08 +01:00
Christoph M. Becker	115ee49b0b	Fix #77177 : Serializing or unserializing COM objects crashes Firstly, we avoid returning NULL from the get_property handler, but instead return an empty HashTable, which already prevents the crashes. Secondly, since (de-)serialization obviously makes no sense for COM, DOTNET and VARIANT objects (at least with the current implementation), we prohibit it right away.	2018-11-23 16:32:33 +01:00
Sara Golemon	f2de4d185d	Merge branch 'PHP-7.1' into PHP-7.2 * PHP-7.1: Prep for 7.1.26	2018-11-21 14:39:25 -05:00
Sara Golemon	0b3cbd665e	Prep for 7.1.26	2018-11-21 14:37:37 -05:00
Nikita Popov	bbbaf1ca85	Merge branch 'PHP-7.1' into PHP-7.2	2018-11-20 21:30:38 +01:00
Valentin V. Bartenev	11ddf7669a	Fix bug #71041 dynamic embed SAPI load error If the library is built with ZEND_SIGNALS defined, it's unusable with an external SAPI module because the zend_signal_startup() call is mandatory in this case. This bug is similar to #74149, but related to dynamic loading of PHP library.	2018-11-20 21:30:02 +01:00
Mizunashi Mana	e672cd4385	Define __APPLE_USE_RFC_3542 for new ipv6 constants	2018-11-20 21:16:03 +01:00
Sara Golemon	9fc52c16b5	Bump for 7.2.14	2018-11-20 14:40:21 -05:00
Stanislav Malyshev	336d2086a9	Disable rsh/ssh functionality in imap by default (bug #77153 )	2018-11-20 11:18:53 -08:00
Stanislav Malyshev	05782f01f5	Disable rsh/ssh functionality in imap by default (bug #77153 )	2018-11-20 11:16:08 -08:00
Stanislav Malyshev	aed4065aa6	Merge branch 'PHP-5.6' into PHP-7.0 * PHP-5.6: Disable rsh/ssh functionality in imap by default (bug #77153)	2018-11-20 11:14:18 -08:00
Stanislav Malyshev	628df47e79	Disable rsh/ssh functionality in imap by default (bug #77153 )	2018-11-20 11:14:07 -08:00
Stanislav Malyshev	e5bfea64c8	Disable rsh/ssh functionality in imap by default (bug #77153 )	2018-11-20 00:13:50 -08:00