Update versions for PHP 7.2.18

Update NEWS for PHP 7.2.18
add news entries for secfix
2026-11-12 19:50:50 +00:00 · 2019-04-30 08:30:27 +00:00 · 2019-04-30 08:30:27 +00:00 · 2019-04-30 09:56:00 +02:00 · 2019-04-30 09:52:36 +02:00 · 2019-04-30 09:52:10 +02:00
173 changed files with 3517 additions and 551 deletions
@@ -16,7 +16,7 @@ environment:
        PHP_BUILD_CACHE_BASE_DIR: c:\build-cache
        PHP_BUILD_OBJ_DIR: c:\obj
        PHP_BUILD_CACHE_SDK_DIR: c:\build-cache\sdk
-        PHP_BUILD_SDK_BRANCH: php-sdk-2.2.0beta3
+        PHP_BUILD_SDK_BRANCH: php-sdk-2.2.0beta4
        PHP_BUILD_CRT: vc15
        # ext and env setup for tests
        #MYSQL_TEST_PASSWD: Password12!
@@ -1,17 +1,19 @@
-# http://editorconfig.org/
+# https://editorconfig.org/

 root = true

-[*.{c,h,awk,w32,bat,mk,frag}]
+[*]
+tab_width                = 4
+
+[*.{c,h,y,awk,w32,bat,mk,frag,cpp}]
 charset                  = utf-8
 end_of_line              = lf
 indent_size              = 4
 indent_style             = tab
-tab_width                = 4
 trim_trailing_whitespace = true
 insert_final_newline     = true

-[*.{php,phpt}]
+[*.{php,phpt,inc}]
 charset                  = utf-8
 end_of_line              = lf
 indent_size              = 4
@@ -31,5 +33,15 @@ insert_final_newline     = true
 charset                  = utf-8
 end_of_line              = lf
 indent_style             = space
-trim_trailing_whitespace = false
+trim_trailing_whitespace = true
 insert_final_newline     = true
+max_line_length          = 80
+
+[COMMIT_EDITMSG]
+charset                  = utf-8
+end_of_line              = lf
+indent_size              = 4
+indent_style             = space
+trim_trailing_whitespace = true
+insert_final_newline     = true
+max_line_length          = 80
@@ -1,22 +1,146 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2019, PHP 7.2.16
+02 May 2019, PHP 7.2.18
+
+- CLI:
+  . Fixed bug #77794 (Incorrect Date header format in built-in server).
+    (kelunik)
+
+- EXIF
+  . Fixed bug #77950 (Heap-buffer-overflow in _estrndup via exif_process_IFD_TAG).
+    (CVE-2019-11036) (Stas)
+
+- Interbase:
+  . Fixed bug #72175 (Impossibility of creating multiple connections to
+    Interbase with php 7.x). (Nikita)
+
+- Intl:
+  . Fixed bug #77895 (IntlDateFormatter::create fails in strict mode if $locale
+    = null). (Nikita)
+
+- litespeed:
+  . LiteSpeed SAPI 7.3.1, better process management, new API function
+    litespeed_finish_request(). (George Wang)
+
+- Mail
+  . Fixed bug #77821 (Potential heap corruption in TSendMail()). (cmb)
+
+- PCRE:
+  . Fixed bug #77827 (preg_match does not ignore \r in regex flags). (requinix,
+    cmb)
+
+- PDO:
+  . Fixed bug #77849 (Disable cloning of PDO handle/connection objects).
+    (camporter)
+
+- phpdbg:
+  . Fixed bug #76801 (too many open files). (alekitto)
+  . Fixed bug #77800 (phpdbg segfaults on listing some conditional breakpoints).
+    (krakjoe)
+  . Fixed bug #77805 (phpdbg build fails when readline is shared). (krakjoe)
+    
+- Reflection:
+  . Fixed bug #77772 (ReflectionClass::getMethods(null) doesn't work). (Nikita)
+  . Fixed bug #77882 (Different behavior: always calls destructor). (Nikita)
+
+- Standard:
+  . Fixed bug #77680 (recursive mkdir on ftp stream wrapper is incorrect).
+    (Vlad Temian)
+  . Fixed bug #77844 (Crash due to null pointer in parse_ini_string with
+    INI_SCANNER_TYPED). (Nikita)
+  . Fixed bug #77853 (Inconsistent substr_compare behaviour with empty
+    haystack). (Nikita)
+
+04 Apr 2019, PHP 7.2.17
+
+- Core:
+  . Fixed bug #77738 (Nullptr deref in zend_compile_expr). (Laruence)
+  . Fixed bug #77660 (Segmentation fault on break 2147483648). (Laruence)
+  . Fixed bug #77652 (Anonymous classes can lose their interface information).
+    (Nikita)
+  . Fixed bug #77676 (Unable to run tests when building shared extension on
+    AIX). (Kevin Adler)
+
+- Bcmath:
+  . Fixed bug #77742 (bcpow() implementation related to gcc compiler
+    optimization). (Nikita)
+
+- COM:
+  . Fixed bug #77578 (Crash when php unload). (cmb)
+
+- Date:
+  . Fixed bug #50020 (DateInterval:createDateFromString() silently fails).
+    (Derick)
+  . Fixed bug #75113 (Added DatePeriod::getRecurrences() method). (Ignace
+    Nyamagana Butera)
+
+- FPM:
+  . Fixed bug #77677 (FPM fails to build on AIX due to missing WCOREDUMP).
+    (Kevin Adler)
+
+- GD:
+  . Fixed bug #77700 (Writing truecolor images as GIF ignores interlace flag).
+    (cmb)
+
+- MySQLi:
+  . Fixed bug #77597 (mysqli_fetch_field hangs scripts). (Nikita)
+
+- Opcache:
+  . Fixed bug #77691 (Opcache passes wrong value for inline array push
+    assignments). (Nikita)
+  . Fixed bug #77743 (Incorrect pi node insertion for jmpznz with identical
+    successors). (Nikita)
+
+- phpdbg:
+  . Fixed bug #77767 (phpdbg break cmd aliases listed in help do not match
+    actual aliases). (Miriam Lauter)
+
+- sodium:
+  . Fixed bug #77646 (sign_detached() strings not terminated). (Frank)
+
+- SQLite3:
+  . Added sqlite3.defensive INI directive. (BohwaZ)
+
+- Standard:
+  . Fixed bug #77664 (Segmentation fault when using undefined constant in
+    custom wrapper). (Laruence)
+  . Fixed bug #77669 (Crash in extract() when overwriting extracted array).
+    (Nikita)
+  . Fixed bug #76717 (var_export() does not create a parsable value for
+    PHP_INT_MIN). (Nikita)
+  . Fixed bug #77765 (FTP stream wrapper should set the directory as
+    executable). (Vlad Temian)
+
+07 Mar 2019, PHP 7.2.16

 - Core:
  . Fixed bug #77589 (Core dump using parse_ini_string with numeric sections).
    (Laruence)
+  . Fixed bug #77630 (rename() across the device may allow unwanted access
+    during processing). (Stas)

 - COM:
  . Fixed bug #77621 (Already defined constants are not properly reported).
    (cmb)

+- EXIF:
+  . Fixed bug #77509 (Uninitialized read in exif_process_IFD_in_TIFF). (Stas)
+  . Fixed bug #77540 (Invalid Read on exif_process_SOFn). (Stas)
+  . Fixed bug #77563 (Uninitialized read in exif_process_IFD_in_MAKERNOTE). (Stas)
+  . Fixed bug #77659 (Uninitialized read in exif_process_IFD_in_MAKERNOTE). (Stas)
+
 - PDO_OCI:
  . Support Oracle Database tracing attributes ACTION, MODULE,
    CLIENT_INFO, and CLIENT_IDENTIFIER. (Cameron Porter)

+- PHAR:
+  . Fixed bug #77396 (Null Pointer Dereference in phar_create_or_parse_filename).
+    (bishop)
+
 - SPL:
  . Fixed bug #51068 (DirectoryIterator glob:// don't support current path
    relative queries). (Ahmed Abdou)
+  . Fixed bug #77431 (openFile() silently truncates after a null byte). (cmb)

 - Standard:
  . Fixed bug #77552 (Unintialized php_stream_statbuf in stat functions).
@@ -0,0 +1,6 @@
+<?php
+return [
+  'I' => function() {
+    return new class implements I {};
+  },
+];
@@ -0,0 +1,16 @@
+--TEST--
+Bug #77652: Anonymous classes can lose their interface information
+--FILE--
+<?php
+
+interface I {}
+require __DIR__ . '/bug77652.inc';
+$data = require __DIR__ . '/bug77652.inc';
+print_r(class_implements($data['I']()));
+
+?>
+--EXPECT--
+Array
+(
+    [I] => I
+)
@@ -0,0 +1,10 @@
+--TEST--
+Bug #77660 (Segmentation fault on break 2147483648)
+--SKIPIF--
+<?php if (PHP_INT_SIZE != 8) die("skip this test is for 64bit platform only"); ?>
+--FILE--
+<?php
+for(;;) break 2147483648;
+?>
+--EXPECTF--
+Fatal error: Cannot 'break' 2147483648 levels in %sbug77660.php on line %d
@@ -0,0 +1,8 @@
+--TEST--
+Bug #77738 (Nullptr deref in zend_compile_expr)
+--FILE--
+<?php
+__COMPILER_HALT_OFFSET__;
+; // <- important
+--EXPECTF--
+Warning: Use of undefined constant __COMPILER_HALT_OFFSET__ - assumed '__COMPILER_HALT_OFFSET__' %sbug77738.php on line %d
@@ -0,0 +1,30 @@
+--TEST--
+Calling exception getters when properties hold references
+--FILE--
+<?php
+
+class MyException extends Exception {
+    public function __construct(&$refMsg, &$refCode, &$refFile, &$refLine) {
+        $this->message =& $refMsg;
+        $this->code =& $refCode;
+        $this->file =& $refFile;
+        $this->line =& $refLine;
+    }
+}
+
+$refMsg = "foo";
+$refCode = 0;
+$refFile = "foobar";
+$refLine = 42;
+$ex = new MyException($refMsg, $refCode, $refFile, $refLine);
+var_dump($ex->getMessage());
+var_dump($ex->getCode());
+var_dump($ex->getFile());
+var_dump($ex->getLine());
+
+?>
+--EXPECT--
+string(3) "foo"
+int(0)
+string(6) "foobar"
+int(42)
@@ -0,0 +1,14 @@
+--TEST--
+Bug object gc not working in shutdown
+--FILE--
+<?php
+ini_set('memory_limit', '2M');
+register_shutdown_function(function () {
+    for ($n = 1000 * 1000; $n--;) {
+        new stdClass;
+    }
+    echo "OK\n";
+});
+?>
+--EXPECT--
+OK
@@ -4508,7 +4508,7 @@ void zend_compile_break_continue(zend_ast *ast) /* {{{ */
 	zend_ast *depth_ast = ast->child[0];

 	zend_op *opline;
-	int depth;
+	zend_long depth;

 	ZEND_ASSERT(ast->kind == ZEND_AST_BREAK || ast->kind == ZEND_AST_CONTINUE);

@@ -4535,7 +4535,7 @@ void zend_compile_break_continue(zend_ast *ast) /* {{{ */
 			ast->kind == ZEND_AST_BREAK ? "break" : "continue");
 	} else {
 		if (!zend_handle_loops_and_finally_ex(depth, NULL)) {
-			zend_error_noreturn(E_COMPILE_ERROR, "Cannot '%s' %d level%s",
+			zend_error_noreturn(E_COMPILE_ERROR, "Cannot '%s' " ZEND_LONG_FMT " level%s",
 				ast->kind == ZEND_AST_BREAK ? "break" : "continue",
 				depth, depth == 1 ? "" : "s");
 		}
@@ -6365,10 +6365,32 @@ void zend_compile_class_decl(zend_ast *ast) /* {{{ */
 		if (!zend_hash_exists(CG(class_table), lcname)) {
 			zend_hash_add_ptr(CG(class_table), lcname, ce);
 		} else {
-			/* this anonymous class has been included */
+			/* This anonymous class has been included, reuse the existing definition.
+			 * NB: This behavior is buggy, and this should always result in a separate
+			 * class declaration. However, until the problem of RTD key collisions is
+			 * solved, this gives a behavior close to what is expected. */
 			zval zv;
 			ZVAL_PTR(&zv, ce);
 			destroy_zend_class(&zv);
+			ce = zend_hash_find_ptr(CG(class_table), lcname);
+
+			/* Manually replicate emission of necessary inheritance opcodes here. We cannot
+			 * reuse the general code, as we only want to emit the opcodes, without modifying
+			 * the reused class definition. */
+			if (ce->ce_flags & ZEND_ACC_IMPLEMENT_TRAITS) {
+				zend_emit_op(NULL, ZEND_BIND_TRAITS, &declare_node, NULL);
+			}
+			if (implements_ast) {
+				zend_ast_list *iface_list = zend_ast_get_list(implements_ast);
+				uint32_t i;
+				for (i = 0; i < iface_list->children; i++) {
+					opline = zend_emit_op(NULL, ZEND_ADD_INTERFACE, &declare_node, NULL);
+					opline->op2_type = IS_CONST;
+					opline->op2.constant = zend_add_class_name_literal(CG(active_op_array),
+						zend_resolve_class_name_ast(iface_list->child[i]));
+				}
+				zend_emit_op(NULL, ZEND_VERIFY_ABSTRACT_CLASS, &declare_node, NULL);
+			}
 			return;
 		}
 	} else {
@@ -7651,11 +7673,11 @@ void zend_compile_const(znode *result, zend_ast *ast) /* {{{ */
 	if (zend_string_equals_literal(resolved_name, "__COMPILER_HALT_OFFSET__") || (name_ast->attr != ZEND_NAME_RELATIVE && zend_string_equals_literal(orig_name, "__COMPILER_HALT_OFFSET__"))) {
 		zend_ast *last = CG(ast);

-		while (last->kind == ZEND_AST_STMT_LIST) {
+		while (last && last->kind == ZEND_AST_STMT_LIST) {
 			zend_ast_list *list = zend_ast_get_list(last);
 			last = list->child[list->children-1];
 		}
-		if (last->kind == ZEND_AST_HALT_COMPILER) {
+		if (last && last->kind == ZEND_AST_HALT_COMPILER) {
 			result->op_type = IS_CONST;
 			ZVAL_LONG(&result->u.constant, Z_LVAL_P(zend_ast_get_zval(last->child[0])));
 			zend_string_release(resolved_name);
@@ -401,11 +401,13 @@ ZEND_METHOD(error_exception, __construct)
   Get the file in which the exception occurred */
 ZEND_METHOD(exception, getFile)
 {
-	zval rv;
+	zval *prop, rv;

 	DEFAULT_0_PARAMS;

-	ZVAL_COPY(return_value, GET_PROPERTY(getThis(), ZEND_STR_FILE));
+	prop = GET_PROPERTY(getThis(), ZEND_STR_FILE);
+	ZVAL_DEREF(prop);
+	ZVAL_COPY(return_value, prop);
 }
 /* }}} */

@@ -413,11 +415,13 @@ ZEND_METHOD(exception, getFile)
   Get the line in which the exception occurred */
 ZEND_METHOD(exception, getLine)
 {
-	zval rv;
+	zval *prop, rv;

 	DEFAULT_0_PARAMS;

-	ZVAL_COPY(return_value, GET_PROPERTY(getThis(), ZEND_STR_LINE));
+	prop = GET_PROPERTY(getThis(), ZEND_STR_LINE);
+	ZVAL_DEREF(prop);
+	ZVAL_COPY(return_value, prop);
 }
 /* }}} */

@@ -425,11 +429,13 @@ ZEND_METHOD(exception, getLine)
   Get the exception message */
 ZEND_METHOD(exception, getMessage)
 {
-	zval rv;
+	zval *prop, rv;

 	DEFAULT_0_PARAMS;

-	ZVAL_COPY(return_value, GET_PROPERTY(getThis(), ZEND_STR_MESSAGE));
+	prop = GET_PROPERTY(getThis(), ZEND_STR_MESSAGE);
+	ZVAL_DEREF(prop);
+	ZVAL_COPY(return_value, prop);
 }
 /* }}} */

@@ -437,11 +443,13 @@ ZEND_METHOD(exception, getMessage)
   Get the exception code */
 ZEND_METHOD(exception, getCode)
 {
-	zval rv;
+	zval *prop, rv;

 	DEFAULT_0_PARAMS;

-	ZVAL_COPY(return_value, GET_PROPERTY(getThis(), ZEND_STR_CODE));
+	prop = GET_PROPERTY(getThis(), ZEND_STR_CODE);
+	ZVAL_DEREF(prop);
+	ZVAL_COPY(return_value, prop);
 }
 /* }}} */

@@ -449,11 +457,13 @@ ZEND_METHOD(exception, getCode)
   Get the stack trace for the location in which the exception occurred */
 ZEND_METHOD(exception, getTrace)
 {
-	zval rv;
+	zval *prop, rv;

 	DEFAULT_0_PARAMS;

-	ZVAL_COPY(return_value, GET_PROPERTY(getThis(), ZEND_STR_TRACE));
+	prop = GET_PROPERTY(getThis(), ZEND_STR_TRACE);
+	ZVAL_DEREF(prop);
+	ZVAL_COPY(return_value, prop);
 }
 /* }}} */

@@ -461,11 +471,13 @@ ZEND_METHOD(exception, getTrace)
   Get the exception severity */
 ZEND_METHOD(error_exception, getSeverity)
 {
-	zval rv;
+	zval *prop, rv;

 	DEFAULT_0_PARAMS;

-	ZVAL_COPY(return_value, GET_PROPERTY(getThis(), ZEND_STR_SEVERITY));
+	prop = GET_PROPERTY(getThis(), ZEND_STR_SEVERITY);
+	ZVAL_DEREF(prop);
+	ZVAL_COPY(return_value, prop);
 }
 /* }}} */

@@ -230,8 +230,9 @@ struct _zend_executor_globals {
 	void *reserved[ZEND_MAX_RESERVED_RESOURCES];
 };

-#define EG_FLAGS_INITIAL	0x00
-#define EG_FLAGS_IN_SHUTDOWN	0x01
+#define EG_FLAGS_INITIAL				(0)
+#define EG_FLAGS_IN_SHUTDOWN			(1<<0)
+#define EG_FLAGS_OBJECT_STORE_NO_REUSE	(1<<1)

 struct _zend_ini_scanner_globals {
 	zend_file_handle *yy_in;
@@ -61,7 +61,7 @@ static void _zend_is_inconsistent(const HashTable *ht, const char *file, int lin
 			zend_output_debug_string(1, "%s(%d) : ht=%p is inconsistent", file, line, ht);
 			break;
 	}
-	zend_bailout();
+	ZEND_ASSERT(0);
 }
 #define IS_CONSISTENT(a) _zend_is_inconsistent(a, __FILE__, __LINE__);
 #define SET_INCONSISTENT(n) do { \
@@ -48,6 +48,22 @@ int ini_parse(void);

 #define ZEND_SYSTEM_INI CG(ini_parser_unbuffered_errors)

+static int get_int_val(zval *op) {
+	switch (Z_TYPE_P(op)) {
+		case IS_LONG:
+			return Z_LVAL_P(op);
+		case IS_DOUBLE:
+			return (int)Z_DVAL_P(op);
+		case IS_STRING:
+		{
+			int val = atoi(Z_STRVAL_P(op));
+			zend_string_free(Z_STR_P(op));
+			return val;
+		}
+		EMPTY_SWITCH_DEFAULT_CASE()
+	}
+}
+
 /* {{{ zend_ini_do_op()
 */
 static void zend_ini_do_op(char type, zval *result, zval *op1, zval *op2)
@@ -57,22 +73,8 @@ static void zend_ini_do_op(char type, zval *result, zval *op1, zval *op2)
 	int str_len;
 	char str_result[MAX_LENGTH_OF_LONG+1];

-	if (IS_LONG == Z_TYPE_P(op1)) {
-		i_op1 = Z_LVAL_P(op1);
-	} else {
-		i_op1 = atoi(Z_STRVAL_P(op1));
-		zend_string_free(Z_STR_P(op1));
-	}
-	if (op2) {
-		if (IS_LONG == Z_TYPE_P(op2)) {
-			i_op2 = Z_LVAL_P(op2);
-		} else {
-			i_op2 = atoi(Z_STRVAL_P(op2));
-			zend_string_free(Z_STR_P(op2));
-		}
-	} else {
-		i_op2 = 0;
-	}
+	i_op1 = get_int_val(op1);
+	i_op2 = op2 ? get_int_val(op2) : 0;

 	switch (type) {
 		case '|':
@@ -43,6 +43,7 @@ ZEND_API void zend_objects_store_destroy(zend_objects_store *objects)

 ZEND_API void zend_objects_store_call_destructors(zend_objects_store *objects)
 {
+	EG(flags) |= EG_FLAGS_OBJECT_STORE_NO_REUSE;
 	if (objects->top > 1) {
 		uint32_t i;
 		for (i = 1; i < objects->top; i++) {
@@ -133,10 +134,10 @@ ZEND_API void zend_objects_store_put(zend_object *object)
 {
 	int handle;

-	/* When in shutdown sequesnce - do not reuse previously freed handles, to make sure
+	/* When in shutdown sequence - do not reuse previously freed handles, to make sure
 	 * the dtors for newly created objects are called in zend_objects_store_call_destructors() loop
 	 */
-	if (!(EG(flags) & EG_FLAGS_IN_SHUTDOWN) && EG(objects_store).free_list_head != -1) {
+	if (EG(objects_store).free_list_head != -1 && EXPECTED(!(EG(flags) & EG_FLAGS_OBJECT_STORE_NO_REUSE))) {
 		handle = EG(objects_store).free_list_head;
 		EG(objects_store).free_list_head = GET_OBJ_BUCKET_NUMBER(EG(objects_store).object_buckets[handle]);
 	} else {
@@ -1805,7 +1805,7 @@ function gen_executor($f, $skl, $spec, $kind, $executor_name, $initializer_name)
 						$prolog = $m[1];
 						out($f,$prolog."if (UNEXPECTED(execute_data == NULL)) {\n");
 						out($f,$prolog."\tstatic const void* labels[] = {\n");
-						gen_labels($f, $spec, ZEND_VM_KIND_GOTO, $prolog."\t\t", $specs);
+						gen_labels($f, $spec, ($kind == ZEND_VM_KIND_HYBRID) ? ZEND_VM_KIND_GOTO : $kind, $prolog."\t\t", $specs);
 						out($f,$prolog."\t};\n");
 						out($f,$prolog."\tzend_opcode_handlers = (const void **) labels;\n");
 						out($f,$prolog."\tzend_handlers_count = sizeof(labels) / sizeof(void*);\n");
@@ -1920,7 +1920,7 @@ function gen_executor($f, $skl, $spec, $kind, $executor_name, $initializer_name)
 						out($f,$prolog.$executor_name."_ex(NULL);\n");
 					} else {
 						out($f,$prolog."static const void *labels[] = {\n");
-						gen_labels($f, $spec, ZEND_VM_KIND_CALL, $prolog."\t", $specs, $switch_labels);
+						gen_labels($f, $spec, ($kind == ZEND_VM_KIND_HYBRID) ? ZEND_VM_KIND_CALL : $kind, $prolog."\t", $specs, $switch_labels);
 						out($f,$prolog."};\n");
 						out($f,$prolog."static const uint32_t specs[] = {\n");
 						gen_specs($f, $prolog."\t", $specs);
@@ -836,15 +836,11 @@ dnl from object_var in build-dir.
 dnl
 AC_DEFUN([PHP_SHARED_MODULE],[
  install_modules="install-modules"
+  suffix=la

  case $host_alias in
    *aix*[)]
-      suffix=so
-      link_cmd='$(LIBTOOL) --mode=link ifelse($4,,[$(CC)],[$(CXX)]) $(COMMON_FLAGS) $(CFLAGS_CLEAN) $(EXTRA_CFLAGS) $(LDFLAGS) -Wl,-G -o '$3'/$1.la -export-dynamic -avoid-version -prefer-pic -module -rpath $(phplibdir) $(EXTRA_LDFLAGS) $($2) $(translit($1,a-z_-,A-Z__)_SHARED_LIBADD) && mv -f '$3'/.libs/$1.so '$3'/$1.so'
-      ;;
-    *[)]
-      suffix=la
-      link_cmd='$(LIBTOOL) --mode=link ifelse($4,,[$(CC)],[$(CXX)]) $(COMMON_FLAGS) $(CFLAGS_CLEAN) $(EXTRA_CFLAGS) $(LDFLAGS) -o [$]@ -export-dynamic -avoid-version -prefer-pic -module -rpath $(phplibdir) $(EXTRA_LDFLAGS) $($2) $(translit($1,a-z_-,A-Z__)_SHARED_LIBADD)'
+      additional_flags="-Wl,-G"
      ;;
  esac

@@ -859,7 +855,7 @@ AC_DEFUN([PHP_SHARED_MODULE],[
 	\$(LIBTOOL) --mode=install cp $3/$1.$suffix \$(phplibdir)

 $3/$1.$suffix: \$($2) \$(translit($1,a-z_-,A-Z__)_SHARED_DEPENDENCIES)
-	$link_cmd
+	\$(LIBTOOL) --mode=link ifelse($4,,[\$(CC)],[\$(CXX)]) \$(COMMON_FLAGS) \$(CFLAGS_CLEAN) \$(EXTRA_CFLAGS) \$(LDFLAGS) $additional_flags -o [\$]@ -export-dynamic -avoid-version -prefer-pic -module -rpath \$(phplibdir) \$(EXTRA_LDFLAGS) \$($2) \$(translit($1,a-z_-,A-Z__)_SHARED_LIBADD)

 EOF
 ])
@@ -975,7 +971,7 @@ dnl ---------------------------------------------- Shared module
 dnl ---------------------------------------------- CLI static module
    [PHP_]translit($1,a-z_-,A-Z__)[_SHARED]=no
    case "$PHP_SAPI" in
-      cgi|embed[)]
+      cgi|embed|phpdbg[)]
        PHP_ADD_SOURCES($ext_dir,$2,$ac_extra,)
        EXT_STATIC="$EXT_STATIC $1;$ext_dir"
        ;;
@@ -107,8 +107,8 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=2
-PHP_RELEASE_VERSION=16
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=18
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -54,12 +54,19 @@ bc_num2long (num)
  /* Extract the int value, ignore the fraction. */
  val = 0;
  nptr = num->n_value;
-  for (index=num->n_len; (index>0) && (val<=(LONG_MAX/BASE)); index--)
-    val = val*BASE + *nptr++;
+  for (index = num->n_len; index > 0; index--) {
+    char n = *nptr++;

-  /* Check for overflow.  If overflow, return zero. */
-  if (index>0) val = 0;
-  if (val < 0) val = 0;
+    if (val > LONG_MAX/BASE) {
+      return 0;
+    }
+    val *= BASE;
+
+    if (val > LONG_MAX - n) {
+      return 0;
+    }
+    val += n;
+  }

  /* Return the value. */
  if (num->n_sign == PLUS)
@@ -225,8 +225,8 @@ PHP_COM_DOTNET_API int php_com_import_typelib(ITypeLib *TL, int mode, int codepa
 /* Type-library stuff */
 void php_com_typelibrary_dtor(zval *pDest)
 {
-	ITypeLib **Lib = (ITypeLib**)Z_PTR_P(pDest);
-	ITypeLib_Release(*Lib);
+	ITypeLib *Lib = (ITypeLib*)Z_PTR_P(pDest);
+	ITypeLib_Release(Lib);
 }

 PHP_COM_DOTNET_API ITypeLib *php_com_load_typelib_via_cache(char *search_string,
@@ -0,0 +1,23 @@
+--TEST--
+Bug #77578 (Crash when php unload)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+?>
+--FILE--
+<?php
+// To actually be able to verify the crash during shutdown on Windows, we have
+// to execute a PHP subprocess, and check its exit status.
+$php = PHP_BINARY;
+$ini = php_ini_loaded_file();
+$iniopt = $ini ? "-c $ini" : '';
+$command = "$php $iniopt -d com.autoregister_typelib=1 -r \"new COM('WbemScripting.SWbemLocator');\"";
+exec($command, $output, $status);
+var_dump($output, $status);
+?>
+===DONE===
+--EXPECT--
+array(0) {
+}
+int(0)
+===DONE===
@@ -3310,8 +3310,12 @@ PHP_FUNCTION(curl_error)
 		RETURN_FALSE;
 	}

-	ch->err.str[CURL_ERROR_SIZE] = 0;
-	RETURN_STRING(ch->err.str);
+	if (ch->err.no) {
+		ch->err.str[CURL_ERROR_SIZE] = 0;
+		RETURN_STRING(ch->err.str);
+	} else {
+		RETURN_EMPTY_STRING();
+	}
 }
 /* }}} */

@@ -425,6 +425,7 @@ void _php_curl_multi_close(zend_resource *rsrc) /* {{{ */
 		curl_multi_cleanup(mh->multi);
 		zend_llist_clean(&mh->easyh);
 		if (mh->handlers->server_push) {
+			zval_ptr_dtor(&mh->handlers->server_push->func_name);
 			efree(mh->handlers->server_push);
 		}
 		if (mh->handlers) {
@@ -587,11 +588,6 @@ static int _php_curl_multi_setopt(php_curlm *mh, zend_long option, zval *zvalue,

 			ZVAL_COPY(&mh->handlers->server_push->func_name, zvalue);
 			mh->handlers->server_push->method = PHP_CURL_USER;
-			if (!Z_ISUNDEF(mh->handlers->server_push->func_name)) {
-				zval_ptr_dtor(&mh->handlers->server_push->func_name);
-				mh->handlers->server_push->fci_cache = empty_fcall_info_cache;
-
-			}
 			error = curl_multi_setopt(mh->multi, option, _php_server_push_callback);
 			if (error != CURLM_OK) {
 				return 0;
@@ -0,0 +1,77 @@
+--TEST--
+Bug #77535 (Invalid callback, h2 server push)
+--SKIPIF--
+<?php
+include 'skipif.inc';
+if (getenv("SKIP_ONLINE_TESTS")) {
+	die("skip online test");
+}
+$curl_version = curl_version();
+if ($curl_version['version_number'] < 0x073d00) {
+	exit("skip: test may crash with curl < 7.61.0");
+}
+?>
+--FILE--
+<?php
+class MyHttpClient
+{
+    private $mh;
+    private $curl;
+
+    public function sendRequest()
+    {
+        if (false === $this->mh = curl_multi_init()) {
+            throw new \RuntimeException('Unable to create a new cURL multi handle');
+        }
+
+        $this->addServerPushCallback();
+
+        $this->curl = curl_init();
+        curl_setopt($this->curl, CURLOPT_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS);
+        curl_setopt($this->curl, CURLOPT_REDIR_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS);
+        curl_setopt($this->curl, CURLOPT_HEADER, false);
+        curl_setopt($this->curl, CURLOPT_RETURNTRANSFER, false);
+        curl_setopt($this->curl, CURLOPT_FAILONERROR, false);
+        curl_setopt($this->curl, CURLOPT_URL, 'https://http2.golang.org/serverpush');
+        curl_setopt($this->curl, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2_0);
+        curl_setopt($this->curl, CURLOPT_HEADERFUNCTION, function ($ch, $data) {
+            return \strlen($data);
+        });
+        curl_setopt($this->curl, CURLOPT_WRITEFUNCTION, function ($ch, $data) {
+            return \strlen($data);
+        });
+        curl_multi_add_handle($this->mh, $this->curl);
+        
+        $stillRunning = null;
+        while (true) {
+            do {
+                $mrc = curl_multi_exec($this->mh, $stillRunning);
+            } while (CURLM_CALL_MULTI_PERFORM === $mrc);
+
+            $info = curl_multi_info_read($this->mh);
+            while (false !== $info && $info['msg'] == CURLMSG_DONE) {
+                if (CURLMSG_DONE !== $info['msg']) {
+                    continue;
+                }
+                die("Start handle request.");
+            }
+        }
+    }
+
+    private function addServerPushCallback(): void
+    {
+
+        $callback = static function () {
+            return CURL_PUSH_OK;
+        };
+
+        curl_multi_setopt($this->mh, CURLMOPT_PIPELINING, CURLPIPE_MULTIPLEX);
+        curl_multi_setopt($this->mh, CURLMOPT_PUSHFUNCTION, $callback);
+    }
+}
+
+$buzz = new MyHttpClient();
+$buzz->sendRequest();
+--EXPECT--
+Start handle request.
+
@@ -543,6 +543,7 @@ const zend_function_entry date_funcs_period[] = {
 	PHP_ME(DatePeriod,                getStartDate,                NULL, ZEND_ACC_PUBLIC)
 	PHP_ME(DatePeriod,                getEndDate,                  NULL, ZEND_ACC_PUBLIC)
 	PHP_ME(DatePeriod,                getDateInterval,             NULL, ZEND_ACC_PUBLIC)
+	PHP_ME(DatePeriod,                getRecurrences,              NULL, ZEND_ACC_PUBLIC)
 	PHP_FE_END
 };

@@ -4435,12 +4436,21 @@ PHP_FUNCTION(date_interval_create_from_date_string)
 		Z_PARAM_STR(time_str)
 	ZEND_PARSE_PARAMETERS_END_EX(RETURN_FALSE);

-	php_date_instantiate(date_ce_interval, return_value);
-
 	time = timelib_strtotime(ZSTR_VAL(time_str), ZSTR_LEN(time_str), &err, DATE_TIMEZONEDB, php_date_parse_tzfile_wrapper);
+
+	if (err->error_count > 0)  {
+		php_error_docref(NULL, E_WARNING, "Unknown or bad format (%s) at position %d (%c): %s", ZSTR_VAL(time_str),
+			err->error_messages[0].position, err->error_messages[0].character ? err->error_messages[0].character : ' ', err->error_messages[0].message);
+		RETVAL_FALSE;
+		goto cleanup;
+	}
+
+	php_date_instantiate(date_ce_interval, return_value);
 	diobj = Z_PHPINTERVAL_P(return_value);
 	diobj->diff = timelib_rel_time_clone(&time->relative);
 	diobj->initialized = 1;
+
+cleanup:
 	timelib_time_dtor(time);
 	timelib_error_container_dtor(err);
 }
@@ -4727,6 +4737,27 @@ PHP_METHOD(DatePeriod, getDateInterval)
 }
 /* }}} */

+/* {{{ proto int DatePeriod::getRecurrences()
+   Get recurrences.
+*/
+PHP_METHOD(DatePeriod, getRecurrences)
+{
+	php_period_obj *dpobj;
+
+	if (zend_parse_parameters_none() == FAILURE) {
+		return;
+	}
+
+	dpobj = Z_PHPPERIOD_P(getThis());
+
+	if (0 == dpobj->recurrences - dpobj->include_start_date) {
+		return;
+	}
+
+	RETURN_LONG(dpobj->recurrences - dpobj->include_start_date);
+}
+/* }}} */
+
 static int check_id_allowed(char *id, zend_long what) /* {{{ */
 {
 	if (what & PHP_DATE_TIMEZONE_GROUP_AFRICA     && strncasecmp(id, "Africa/",      7) == 0) return 1;
@@ -112,6 +112,7 @@ PHP_METHOD(DatePeriod, __set_state);
 PHP_METHOD(DatePeriod, getStartDate);
 PHP_METHOD(DatePeriod, getEndDate);
 PHP_METHOD(DatePeriod, getDateInterval);
+PHP_METHOD(DatePeriod, getRecurrences);

 /* Options and Configuration */
 PHP_FUNCTION(date_default_timezone_set);
@@ -8,6 +8,7 @@ $start = new DateTime('2000-01-01 00:00:00', new DateTimeZone('Europe/Berlin'));
 $end   = new DateTime('2000-01-31 00:00:00', new DateTimeZone('UTC'));
 $interval = new DateInterval('P1D');
 $period   = new DatePeriod($start, $interval, $end);
+$recurrences = 4;

 var_dump($period->getStartDate()->format('Y-m-d H:i:s'));
 var_dump($period->getStartDate()->getTimeZone()->getName());
@@ -16,6 +17,17 @@ var_dump($period->getEndDate()->format('Y-m-d H:i:s'));
 var_dump($period->getEndDate()->getTimeZone()->getName());

 var_dump($period->getDateInterval()->format('%R%y-%m-%d-%h-%i-%s'));
+var_dump($period->getRecurrences());
+
+$periodWithRecurrences = new DatePeriod($start, $interval, $recurrences);
+
+var_dump($periodWithRecurrences->getRecurrences());
+var_dump($periodWithRecurrences->getEndDate());
+
+$periodWithRecurrencesWithoutStart = new DatePeriod($start, $interval, $recurrences, DatePeriod::EXCLUDE_START_DATE);
+
+var_dump($periodWithRecurrences->getRecurrences());
+
 ?>
 --EXPECTF--
 string(19) "2000-01-01 00:00:00"
@@ -23,3 +35,7 @@ string(13) "Europe/Berlin"
 string(19) "2000-01-31 00:00:00"
 string(3) "UTC"
 string(12) "+0-0-1-0-0-0"
+NULL
+int(4)
+NULL
+int(4)
@@ -0,0 +1,10 @@
+--TEST--
+Test date_interval_create_from_date_string() function : nonsense data
+--FILE--
+<?php
+$i = date_interval_create_from_date_string("foobar");
+var_dump($i);
+?>
+--EXPECTF--
+Warning: date_interval_create_from_date_string(): Unknown or bad format (foobar) at position 0 (f): The timezone could not be found in the database in %sdate_interval_create_from_date_string_broken.php on line 2
+bool(false)
@@ -4,41 +4,9 @@ Test date_interval_create_from_date_string() function : null parameter
 Rodrigo Prado de Jesus <royopa [at] gmail [dot] com>
 --FILE--
 <?php
-$i = date_interval_create_from_date_string(null); //returns a empty object
+$i = date_interval_create_from_date_string(null);
 var_dump($i);
 ?>
 --EXPECTF--
-object(DateInterval)#%d (16) {
-  ["y"]=>
-  int(0)
-  ["m"]=>
-  int(0)
-  ["d"]=>
-  int(0)
-  ["h"]=>
-  int(0)
-  ["i"]=>
-  int(0)
-  ["s"]=>
-  int(0)
-  ["f"]=>
-  float(0)
-  ["weekday"]=>
-  int(0)
-  ["weekday_behavior"]=>
-  int(0)
-  ["first_last_day_of"]=>
-  int(0)
-  ["invert"]=>
-  int(0)
-  ["days"]=>
-  int(0)
-  ["special_type"]=>
-  int(0)
-  ["special_amount"]=>
-  int(0)
-  ["have_weekday_relative"]=>
-  int(0)
-  ["have_special_relative"]=>
-  int(0)
-}
+Warning: date_interval_create_from_date_string(): Unknown or bad format () at position 0 ( ): Empty string in %sdate_interval_create_from_date_string_nullparam.php on line 2
+bool(false)
@@ -2062,10 +2062,10 @@ static int exif_file_sections_free(image_info_type *ImageInfo)
 /* {{{ exif_iif_add_value
 Add a value to image_info
 */
-static void exif_iif_add_value(image_info_type *image_info, int section_index, char *name, int tag, int format, int length, void* value, int motorola_intel)
+static void exif_iif_add_value(image_info_type *image_info, int section_index, char *name, int tag, int format, int length, void* value, size_t value_len, int motorola_intel)
 {
 	size_t idex;
-	void *vptr;
+	void *vptr, *vptr_end;
 	image_info_value *info_value;
 	image_info_data  *info_data;
 	image_info_data  *list;
@@ -2087,8 +2087,12 @@ static void exif_iif_add_value(image_info_type *image_info, int section_index, c

 	switch (format) {
 		case TAG_FMT_STRING:
+			if (length > value_len) {
+				exif_error_docref("exif_iif_add_value" EXIFERR_CC, image_info, E_WARNING, "length > value_len: %d > %zu", length, value_len);
+				value = NULL;
+			}
 			if (value) {
-				length = php_strnlen(value, length);
+				length = (int)php_strnlen(value, length);
 				info_value->s = estrndup(value, length);
 				info_data->length = length;
 			} else {
@@ -2110,6 +2114,10 @@ static void exif_iif_add_value(image_info_type *image_info, int section_index, c
 			if (!length)
 				break;
 		case TAG_FMT_UNDEFINED:
+			if (length > value_len) {
+				exif_error_docref("exif_iif_add_value" EXIFERR_CC, image_info, E_WARNING, "length > value_len: %d > %zu", length, value_len);
+				value = NULL;
+			}
 			if (value) {
 				if (tag == TAG_MAKER_NOTE) {
 					length = (int) php_strnlen(value, length);
@@ -2140,7 +2148,12 @@ static void exif_iif_add_value(image_info_type *image_info, int section_index, c
 			} else {
 				info_value = &info_data->value;
 			}
+			vptr_end = (char *) value + value_len;
 			for (idex=0,vptr=value; idex<(size_t)length; idex++,vptr=(char *) vptr + php_tiff_bytes_per_format[format]) {
+				if ((char *) vptr_end - (char *) vptr < php_tiff_bytes_per_format[format]) {
+					exif_error_docref("exif_iif_add_value" EXIFERR_CC, image_info, E_WARNING, "Value too short");
+					break;
+				}
 				if (length>1) {
 					info_value = &info_data->value.list[idex];
 				}
@@ -2176,7 +2189,7 @@ static void exif_iif_add_value(image_info_type *image_info, int section_index, c
 						php_error_docref(NULL, E_WARNING, "Found value of type single");
 #endif
 						info_value->f = *(float *)value;
-
+						break;
 					case TAG_FMT_DOUBLE:
 #ifdef EXIF_DEBUG
 						php_error_docref(NULL, E_WARNING, "Found value of type double");
@@ -2194,9 +2207,9 @@ static void exif_iif_add_value(image_info_type *image_info, int section_index, c
 /* {{{ exif_iif_add_tag
 Add a tag from IFD to image_info
 */
-static void exif_iif_add_tag(image_info_type *image_info, int section_index, char *name, int tag, int format, size_t length, void* value)
+static void exif_iif_add_tag(image_info_type *image_info, int section_index, char *name, int tag, int format, size_t length, void* value, size_t value_len)
 {
-	exif_iif_add_value(image_info, section_index, name, tag, format, (int)length, value, image_info->motorola_intel);
+	exif_iif_add_value(image_info, section_index, name, tag, format, (int)length, value, value_len, image_info->motorola_intel);
 }
 /* }}} */

@@ -2617,7 +2630,7 @@ static void add_assoc_image_info(zval *value, int sub_array, image_info_type *im
 */
 static void exif_process_COM (image_info_type *image_info, char *value, size_t length)
 {
-	exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_STRING, length-2, value+2);
+	exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_STRING, length-2, value+2, length-2);
 }
 /* }}} */

@@ -2632,17 +2645,17 @@ static void exif_process_CME (image_info_type *image_info, char *value, size_t l
 	if (length>3) {
 		switch(value[2]) {
 			case 0:
-				exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_UNDEFINED, length, value);
+				exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_UNDEFINED, length, value, length);
 				break;
 			case 1:
-				exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_STRING, length, value);
+				exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_STRING, length, value, length);
 				break;
 			default:
 				php_error_docref(NULL, E_NOTICE, "Undefined JPEG2000 comment encoding");
 				break;
 		}
 	} else {
-		exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_UNDEFINED, 0, NULL);
+		exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_UNDEFINED, 0, NULL, 0);
 		php_error_docref(NULL, E_NOTICE, "JPEG2000 comment section too small");
 	}
 }
@@ -3152,7 +3165,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 		break;
 	}

-	if (maker_note->offset >= value_len) {
+	if (value_len < 2 || maker_note->offset >= value_len - 1) {
 		/* Do not go past the value end */
 		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "IFD data too short: 0x%04X offset 0x%04X", value_len, maker_note->offset);
 		return FALSE;
@@ -3207,6 +3220,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 #endif
 		default:
 		case MN_OFFSET_NORMAL:
+			data_len = value_len;
 			break;
 	}

@@ -3214,6 +3228,10 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 2 + 0x%04X*12 = 0x%04X > 0x%04X", NumDirEntries, 2+NumDirEntries*12, value_len);
 		return FALSE;
 	}
+	if ((dir_start - value_ptr) > value_len - (2+NumDirEntries*12)) {
+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 0x%04X > 0x%04X", (dir_start - value_ptr) + (2+NumDirEntries*12), value_len);
+		return FALSE;
+	}

 	for (de=0;de<NumDirEntries;de++) {
 		if (!exif_process_IFD_TAG(ImageInfo, dir_start + 2 + 12 * de,
@@ -3235,7 +3253,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, char *offset_base, size_t IFDlength, size_t displacement, int section_index, int ReadNextIFD, tag_table_type tag_table)
 {
 	size_t length;
-	int tag, format, components;
+	unsigned int tag, format, components;
 	char *value_ptr, tagname[64], cbuf[32], *outside=NULL;
 	size_t byte_count, offset_val, fpos, fgot;
 	int64_t byte_count_signed;
@@ -3286,7 +3304,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
            offset_base is ImageInfo->file.list[sn].data-dir_offset
            dir_entry - offset_base is dir_offset+2+i*12
        */
-		if (byte_count > IFDlength || offset_val > IFDlength-byte_count || value_ptr < dir_entry || offset_val < (size_t)(dir_entry-offset_base)) {
+		if (byte_count > IFDlength || offset_val > IFDlength-byte_count || value_ptr < dir_entry || offset_val < (size_t)(dir_entry-offset_base) || dir_entry <= offset_base) {
 			/* It is important to check for IMAGE_FILETYPE_TIFF
 			 * JPEG does not use absolute pointers instead its pointers are
 			 * relative to the start of the TIFF header in APP1 section. */
@@ -3550,7 +3568,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				}
 		}
 	}
-	exif_iif_add_tag(ImageInfo, section_index, exif_get_tagname(tag, tagname, sizeof(tagname), tag_table), tag, format, components, value_ptr);
+	exif_iif_add_tag(ImageInfo, section_index, exif_get_tagname(tag, tagname, sizeof(tagname), tag_table), tag, format, components, value_ptr, byte_count);
 	EFREE_IF(outside);
 	return TRUE;
 }
@@ -3712,10 +3730,10 @@ static void exif_process_APP12(image_info_type *ImageInfo, char *buffer, size_t
 	size_t l1, l2=0;

 	if ((l1 = php_strnlen(buffer+2, length-2)) > 0) {
-		exif_iif_add_tag(ImageInfo, SECTION_APP12, "Company", TAG_NONE, TAG_FMT_STRING, l1, buffer+2);
+		exif_iif_add_tag(ImageInfo, SECTION_APP12, "Company", TAG_NONE, TAG_FMT_STRING, l1, buffer+2, l1);
 		if (length > 2+l1+1) {
 			l2 = php_strnlen(buffer+2+l1+1, length-2-l1-1);
-			exif_iif_add_tag(ImageInfo, SECTION_APP12, "Info", TAG_NONE, TAG_FMT_STRING, l2, buffer+2+l1+1);
+			exif_iif_add_tag(ImageInfo, SECTION_APP12, "Info", TAG_NONE, TAG_FMT_STRING, l2, buffer+2+l1+1, l2);
 		}
 	}
 #ifdef EXIF_DEBUG
@@ -3930,7 +3948,7 @@ static int exif_scan_thumbnail(image_info_type *ImageInfo)
 			return FALSE;
 		marker = c;
 		length = php_jpg_get16(data+pos);
-		if (pos+length>=ImageInfo->Thumbnail.size) {
+		if (length > ImageInfo->Thumbnail.size || pos >= ImageInfo->Thumbnail.size - length) {
 			return FALSE;
 		}
 #ifdef EXIF_DEBUG
@@ -3951,6 +3969,10 @@ static int exif_scan_thumbnail(image_info_type *ImageInfo)
 			case M_SOF14:
 			case M_SOF15:
 				/* handle SOFn block */
+				if (length < 8 || ImageInfo->Thumbnail.size - 8 < pos) {
+					/* exif_process_SOFn needs 8 bytes */
+					return FALSE;
+				}
 				exif_process_SOFn(data+pos, marker, &sof_info);
 				ImageInfo->Thumbnail.height   = sof_info.height;
 				ImageInfo->Thumbnail.width    = sof_info.width;
@@ -3988,10 +4010,10 @@ static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offse
 	tag_table_type tag_table = exif_get_tag_table(section_index);

 	if (ImageInfo->ifd_nesting_level > MAX_IFD_NESTING_LEVEL) {
-                return FALSE;
-        }
+		return FALSE;
+	}

-	if (ImageInfo->FileSize >= dir_offset+2) {
+	if (ImageInfo->FileSize >= 2 && ImageInfo->FileSize - 2 >= dir_offset) {
 		sn = exif_file_sections_add(ImageInfo, M_PSEUDO, 2, NULL);
 #ifdef EXIF_DEBUG
 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read from TIFF: filesize(x%04X), IFD dir(x%04X + x%04X)", ImageInfo->FileSize, dir_offset, 2);
@@ -3999,8 +4021,8 @@ static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offse
 		php_stream_seek(ImageInfo->infile, dir_offset, SEEK_SET); /* we do not know the order of sections */
 		php_stream_read(ImageInfo->infile, (char*)ImageInfo->file.list[sn].data, 2);
 		num_entries = php_ifd_get16u(ImageInfo->file.list[sn].data, ImageInfo->motorola_intel);
-		dir_size = 2/*num dir entries*/ +12/*length of entry*/*num_entries +4/* offset to next ifd (points to thumbnail or NULL)*/;
-		if (ImageInfo->FileSize >= dir_offset+dir_size) {
+		dir_size = 2/*num dir entries*/ +12/*length of entry*/*(size_t)num_entries +4/* offset to next ifd (points to thumbnail or NULL)*/;
+		if (ImageInfo->FileSize >= dir_size && ImageInfo->FileSize - dir_size >= dir_offset) {
 #ifdef EXIF_DEBUG
 			exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read from TIFF: filesize(x%04X), IFD dir(x%04X + x%04X), IFD entries(%d)", ImageInfo->FileSize, dir_offset+2, dir_size-2, num_entries);
 #endif
@@ -4083,9 +4105,9 @@ static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offse
 					}
 				}
 			}
-			if (ImageInfo->FileSize >= dir_offset + ImageInfo->file.list[sn].size) {
+			if (ImageInfo->FileSize >= ImageInfo->file.list[sn].size && ImageInfo->FileSize - ImageInfo->file.list[sn].size >= dir_offset) {
 				if (ifd_size > dir_size) {
-					if (dir_offset + ifd_size > ImageInfo->FileSize) {
+					if (ImageInfo->FileSize < ifd_size || dir_offset > ImageInfo->FileSize - ifd_size) {
 						exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Error in TIFF: filesize(x%04X) less than size of IFD(x%04X + x%04X)", ImageInfo->FileSize, dir_offset, ifd_size);
 						return FALSE;
 					}
@@ -4579,7 +4601,7 @@ PHP_FUNCTION(exif_read_data)
 	if (ImageInfo.Thumbnail.size) {
 		if (read_thumbnail) {
 			/* not exif_iif_add_str : this is a buffer */
-			exif_iif_add_tag(&ImageInfo, SECTION_THUMBNAIL, "THUMBNAIL", TAG_NONE, TAG_FMT_UNDEFINED, ImageInfo.Thumbnail.size, ImageInfo.Thumbnail.data);
+			exif_iif_add_tag(&ImageInfo, SECTION_THUMBNAIL, "THUMBNAIL", TAG_NONE, TAG_FMT_UNDEFINED, ImageInfo.Thumbnail.size, ImageInfo.Thumbnail.data, ImageInfo.Thumbnail.size);
 		}
 		if (!ImageInfo.Thumbnail.width || !ImageInfo.Thumbnail.height) {
 			/* try to evaluate if thumbnail data is present */
@@ -4682,7 +4704,9 @@ PHP_FUNCTION(exif_thumbnail)
 	ZVAL_STRINGL(return_value, ImageInfo.Thumbnail.data, ImageInfo.Thumbnail.size);
 	if (arg_c >= 3) {
 		if (!ImageInfo.Thumbnail.width || !ImageInfo.Thumbnail.height) {
-			exif_scan_thumbnail(&ImageInfo);
+			if (!exif_scan_thumbnail(&ImageInfo)) {
+				ImageInfo.Thumbnail.width = ImageInfo.Thumbnail.height = 0;
+			}
 		}
 		zval_dtor(z_width);
 		zval_dtor(z_height);
@@ -0,0 +1,16 @@
+--TEST--
+Bug 77540 (Invalid Read on exif_process_SOFn)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+$width = $height = 42;
+$s = exif_thumbnail(__DIR__."/bug77540.jpg", $width, $height);
+echo "Width ".$width."\n";
+echo "Height ".$height."\n";
+?>
+DONE
+--EXPECTF--
+Width 0
+Height 0
+DONE
@@ -0,0 +1,16 @@
+--TEST--
+Bug 77563 (Uninitialized read in exif_process_IFD_in_MAKERNOTE)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+$s = exif_thumbnail(__DIR__."/bug77563.jpg");
+?>
+DONE
+--EXPECTF--
+Warning: exif_thumbnail(bug77563.jpg): IFD data too short: 0x0009 offset 0x0008 in %s%ebug77563.php on line %d
+
+Warning: exif_thumbnail(bug77563.jpg): File structure corrupted in %s%ebug77563.php on line %d
+
+Warning: exif_thumbnail(bug77563.jpg): Invalid JPEG file in %s%ebug77563.php on line %d
+DONE
@@ -0,0 +1,16 @@
+--TEST--
+Bug #77753 (Heap-buffer-overflow in php_ifd_get32s)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+var_dump(exif_read_data(__DIR__."/bug77753.tiff"));
+?>
+DONE
+--EXPECTF--
+%A
+Warning: exif_read_data(bug77753.tiff): Illegal IFD size: 0x006A > 0x0065 in %sbug77753.php on line %d
+
+Warning: exif_read_data(bug77753.tiff): Invalid TIFF file in %sbug77753.php on line %d
+bool(false)
+DONE
@@ -0,0 +1,13 @@
+--TEST--
+Bug #77831 (Heap-buffer-overflow in exif_iif_add_value in EXIF)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+var_dump(exif_read_data(__DIR__."/bug77831.tiff"));
+?>
+DONE
+--EXPECTF--
+%A
+bool(false)
+DONE
@@ -0,0 +1,12 @@
+--TEST--
+Bug #77950 (Heap-buffer-overflow in _estrndup via exif_process_IFD_TAG)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+exif_read_data(__DIR__."/bug77950.tiff");
+?>
+DONE
+--EXPECTF--
+%A
+DONE
@@ -289,8 +289,13 @@ if ($pid) {
            }

 		}elseif (preg_match("~^CWD ([A-Za-z./]+)\r\n$~", $buf, $m)) {
-			change_dir($m[1]);
-			fputs($s, "250 CWD command successful.\r\n");
+			if (isset($bug77680)) {
+				fputs($s, "550 Directory change to $m[1] failed: file does not exist\r\n");
+				var_dump($buf);
+			} else {
+				change_dir($m[1]);
+				fputs($s, "250 CWD command successful.\r\n");
+			}

 		} elseif (preg_match("~^NLST(?: ([A-Za-z./]+))?\r\n$~", $buf, $m)) {

@@ -332,6 +337,9 @@ if ($pid) {
 			if (isset($bug7216)) {
 				fputs($s, "257 OK.\r\n");
 			} else {
+				if (isset($bug77680)) {
+					var_dump($buf);
+				}
 				fputs($s, "257 \"/path/to/ftproot$cwd$m[1]\" created.\r\n");
 			}

@@ -132,7 +132,7 @@ void gdImageGifCtx(gdImagePtr im, gdIOCtxPtr out)
 	BitsPerPixel = colorstobpp(tim->colorsTotal);
 	/* All set, let's do it. */
 	GIFEncode(
-		out, tim->sx, tim->sy, tim->interlace, 0, tim->transparent, BitsPerPixel,
+		out, tim->sx, tim->sy, interlace, 0, tim->transparent, BitsPerPixel,
 		tim->red, tim->green, tim->blue, tim);
 	if (pim) {
 		/* Destroy palette based temporary image. */
@@ -0,0 +1,24 @@
+--TEST--
+Bug #77700 (Writing truecolor images as GIF ignores interlace flag)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$im = imagecreatetruecolor(10, 10);
+imagefilledrectangle($im, 0, 0, 9, 9, imagecolorallocate($im, 255, 255, 255));
+imageinterlace($im, 1);
+imagegif($im, __DIR__ . 'bug77700.gif');
+
+$im = imagecreatefromgif(__DIR__ . 'bug77700.gif');
+var_dump(imageinterlace($im));
+?>
+===DONE===
+--EXPECT--
+int(1)
+===DONE===
+--CLEAN--
+<?php
+unlink(__DIR__ . 'bug77700.gif');
+?>
@@ -194,7 +194,7 @@ static void PHP_SHA3_Final(unsigned char* digest,
 	}

 	// Zero out context
-	memset(ctx, 0, sizeof(PHP_SHA3_CTX));
+	ZEND_SECURE_ZERO(ctx, sizeof(PHP_SHA3_CTX));
 }

 // ==========================================================================
@@ -129,7 +129,7 @@ static inline void SnefruTransform(PHP_SNEFRU_CTX *context, const unsigned char
 								((input[i+2] & 0xff) << 8) | (input[i+3] & 0xff);
 	}
 	Snefru(context->state);
-	memset(&context->state[8], 0, sizeof(uint32_t) * 8);
+	ZEND_SECURE_ZERO(&context->state[8], sizeof(uint32_t) * 8);
 }

 PHP_HASH_API void PHP_SNEFRUInit(PHP_SNEFRU_CTX *context)
@@ -939,13 +939,15 @@ static void _php_ibase_connect(INTERNAL_FUNCTION_PARAMETERS, int persistent) /*

 		xlink = (zend_resource*) le->ptr;
 		if ((!persistent && xlink->type == le_link) || xlink->type == le_plink) {
-			if (IBG(default_link)) {
-				zend_list_close(IBG(default_link));
+			if (IBG(default_link) != xlink) {
+				GC_REFCOUNT(xlink)++;
+				if (IBG(default_link)) {
+					zend_list_delete(IBG(default_link));
+				}
+				IBG(default_link) = xlink;
 			}
-			xlink->gc.refcount++;
-			xlink->gc.refcount++;
-			IBG(default_link) = xlink;
-			RETVAL_RES(xlink);
+			GC_REFCOUNT(xlink)++;
+			RETURN_RES(xlink);
 		} else {
 			zend_hash_str_del(&EG(regular_list), hash, sizeof(hash)-1);
 		}
@@ -74,7 +74,7 @@ static int datefmt_ctor(INTERNAL_FUNCTION_PARAMETERS, zend_bool is_constructor)
 	intl_error_reset(NULL);
 	object = return_value;
 	/* Parse parameters. */
-	if (zend_parse_parameters_ex(zpp_flags, ZEND_NUM_ARGS(), "sll|zzs",
+	if (zend_parse_parameters_ex(zpp_flags, ZEND_NUM_ARGS(), "s!ll|zzs",
 			&locale_str, &locale_len, &date_type, &time_type, &timezone_zv,
 			&calendar_zv, &pattern_str, &pattern_str_len) == FAILURE) {
 		intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR,	"datefmt_create: "
@@ -169,7 +169,7 @@ U_CFUNC PHP_FUNCTION(datefmt_format_object)
 			goto cleanup;
 		}
 		cal = obj_cal->clone();
-	} else if (instanceof_function(instance_ce, php_date_get_date_ce())) {
+	} else if (instanceof_function(instance_ce, php_date_get_interface_ce())) {
 		if (intl_datetime_decompose(object, &date, &timeZone, NULL,
 				"datefmt_format_object") == FAILURE) {
 			RETURN_FALSE;
@@ -0,0 +1,13 @@
+--TEST--
+Bug #77895: IntlDateFormatter::create fails in strict mode if $locale = null 
+--FILE--
+<?php
+
+declare(strict_types=1);
+
+var_dump(IntlDateFormatter::create(null, IntlDateFormatter::NONE, IntlDateFormatter::NONE));
+
+?>
+--EXPECT--
+object(IntlDateFormatter)#1 (0) {
+}
@@ -0,0 +1,12 @@
+--TEST--
+Bug #65683: Intl does not support DateTimeImmutable (using datefmt_format_object)
+--FILE--
+<?php
+$date = date_create('1970-01-01');
+$date_imm = date_create_immutable('1970-01-01');
+var_dump(datefmt_format_object($date, null, 'fr_FR'));
+var_dump(datefmt_format_object($date_imm, null, 'fr_FR'));
+?>
+--EXPECTF--
+string(%d) "%s"
+string(%d) "%s"
@@ -3269,7 +3269,7 @@ MBSTRING_API HashTable *php_mb_convert_encoding_recursive(HashTable *input, cons
 {
 	HashTable *output, *chash;
 	zend_long idx;
-	zend_string *key, *key_tmp;
+	zend_string *key;
 	zval *entry, entry_tmp;
 	size_t ckey_len, cval_len;
 	char *ckey, *cval;
@@ -3289,7 +3289,8 @@ MBSTRING_API HashTable *php_mb_convert_encoding_recursive(HashTable *input, cons
 		/* convert key */
 		if (key) {
 			ckey = php_mb_convert_encoding(ZSTR_VAL(key), ZSTR_LEN(key), _to_encoding, _from_encodings, &ckey_len);
-			key_tmp = zend_string_init(ckey, ckey_len, 0);
+			key = zend_string_init(ckey, ckey_len, 0);
+			efree(ckey);
 		}
 		/* convert value */
 		ZEND_ASSERT(entry);
@@ -3317,13 +3318,14 @@ MBSTRING_API HashTable *php_mb_convert_encoding_recursive(HashTable *input, cons
 			case IS_OBJECT:
 			default:
 				if (key) {
-					efree(key_tmp);
+					zend_string_release(key);
 				}
 				php_error_docref(NULL, E_WARNING, "Object is not supported");
 				continue;
 		}
 		if (key) {
-			zend_hash_add(output, key_tmp, &entry_tmp);
+			zend_hash_add(output, key, &entry_tmp);
+			zend_string_release(key);
 		} else {
 			zend_hash_index_add(output, idx, &entry_tmp);
 		}
@@ -448,13 +448,18 @@ static php_mb_regex_t *php_mbregex_compile_pattern(const char *pattern, int patl
 	OnigErrorInfo err_info;
 	OnigUChar err_str[ONIG_MAX_ERROR_MESSAGE_LEN];

+	if (!php_mb_check_encoding(pattern, patlen, _php_mb_regex_mbctype2name(enc))) {
+		php_error_docref(NULL, E_WARNING,
+			"Pattern is not valid under %s encoding", _php_mb_regex_mbctype2name(enc));
+		return NULL;
+	}
+
 	rc = zend_hash_str_find_ptr(&MBREX(ht_rc), (char *)pattern, patlen);
 	if (!rc || onig_get_options(rc) != options || onig_get_encoding(rc) != enc || onig_get_syntax(rc) != syntax) {
 		if ((err_code = onig_new(&retval, (OnigUChar *)pattern, (OnigUChar *)(pattern + patlen), options, enc, syntax, &err_info)) != ONIG_NORMAL) {
 			onig_error_code_to_str(err_str, err_code, &err_info);
 			php_error_docref(NULL, E_WARNING, "mbregex compile err: %s", err_str);
-			retval = NULL;
-			goto out;
+			return NULL;
 		}
 		if (rc == MBREX(search_re)) {
 			/* reuse the new rc? see bug #72399 */
@@ -464,7 +469,6 @@ static php_mb_regex_t *php_mbregex_compile_pattern(const char *pattern, int patl
 	} else {
 		retval = rc;
 	}
-out:
 	return retval;
 }
 /* }}} */
@@ -1107,6 +1111,11 @@ PHP_FUNCTION(mb_split)
 		count--;
 	}

+	if (!php_mb_check_encoding(string, string_len,
+			_php_mb_regex_mbctype2name(MBREX(current_mbctype)))) {
+		RETURN_FALSE;
+	}
+
 	/* create regex pattern buffer */
 	if ((re = php_mbregex_compile_pattern(arg_pattern, arg_pattern_len, MBREX(regex_default_options), MBREX(current_mbctype), MBREX(regex_default_syntax))) == NULL) {
 		RETURN_FALSE;
@@ -1196,6 +1205,11 @@ PHP_FUNCTION(mb_ereg_match)
 		}
 	}

+	if (!php_mb_check_encoding(string, string_len,
+			_php_mb_regex_mbctype2name(MBREX(current_mbctype)))) {
+		RETURN_FALSE;
+	}
+
 	if ((re = php_mbregex_compile_pattern(arg_pattern, arg_pattern_len, option, MBREX(current_mbctype), syntax)) == NULL) {
 		RETURN_FALSE;
 	}
@@ -1,7 +1,10 @@
 --TEST--
 Bug #43301 (mb_ereg*_replace() crashes when replacement string is invalid PHP expression and 'e' option is used)
 --SKIPIF--
-<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+<?php
+if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
+if (!function_exists('mb_ereg_replace')) die('skip mb_ereg_replace() not available');
+?>
 --FILE--
 <?php

@@ -1,7 +1,10 @@
 --TEST--
 Bug #69151 (mb_ereg should reject ill-formed byte sequence)
 --SKIPIF--
-<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+<?php
+if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
+if (!function_exists('mb_ereg')) die('skip mb_ereg() not available');
+?>
 --FILE--
 <?php
 $str = "\x80";
@@ -1,7 +1,10 @@
 --TEST--
 Bug #72164 (Null Pointer Dereference - mb_ereg_replace)
 --SKIPIF--
-<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+<?php
+if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
+if (!function_exists('mb_ereg_replace')) die('skip mb_ereg_replace() not available');
+?>
 --FILE--
 <?php
 $var0 = "e";
@@ -1,5 +1,10 @@
 --TEST--
 Bug #72399 (Use-After-Free in MBString (search_re))
+--SKIPIF--
+<?php
+if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
+if (!function_exists('mb_ereg_replace')) die('skip mb_ereg_replace() not available');
+?>
 --FILE--
 <?php
 $var5 = mbereg_search_init("","2");
@@ -1,7 +1,10 @@
 --TEST--
 Bug #72402: _php_mb_regex_ereg_replace_exec - double free
 --SKIPIF--
-<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+<?php
+if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
+if (!function_exists('mb_ereg_replace_callback')) die('skip mb_ereg_replace_callback() not available');
+?>
 --FILE--
 <?php
 function throwit() {
@@ -2,7 +2,8 @@
 Bug #72691 (mb_ereg_search raises a warning if a match zero-width)
 --SKIPIF--
 <?php
-if (!extension_loaded('mbstring')) die('skip ext/mbstring required');
+if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
+if (!function_exists('mb_ereg_search_init')) die('skip mb_ereg_search_init() not available');
 ?>
 --FILE--
 <?php
@@ -2,7 +2,8 @@
 Bug #72693 (mb_ereg_search increments search position when a match zero-width)
 --SKIPIF--
 <?php
-if (!extension_loaded('mbstring')) die('skip ext/mbstring required');
+if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
+if (!function_exists('mb_ereg_search_init')) die('skip mb_ereg_search_init() not available');
 ?>
 --FILE--
 <?php
@@ -2,7 +2,8 @@
 Bug #72694 (mb_ereg_search_setpos does not accept a string's last position)
 --SKIPIF--
 <?php
-if (!extension_loaded('mbstring')) die('skip ext/mbstring required');
+if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
+if (!function_exists('mb_ereg_search_init')) die('skip mb_ereg_search_init() not available');
 ?>
 --FILE--
 <?php
@@ -2,7 +2,8 @@
 Bug #72710 (`mb_ereg` causes buffer overflow on regexp compile error)
 --SKIPIF--
 <?php
-if (!extension_loaded('mbstring')) die('skip ext/mbstring required');
+if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
+if (!function_exists('mb_ereg')) die('skip mb_ereg() not available');
 ?>
 --FILE--
 <?php
@@ -14,6 +14,6 @@ var_dump($var1);
 --EXPECTF--
 Notice: Undefined variable: var in %s on line %d

-Warning: mbereg_replace(): mbregex compile err: invalid code point value in %sbug72994.php on line %d
+Warning: mbereg_replace(): Pattern is not valid under UTF-8 encoding in %s on line %d
 bool(false)
 ===DONE===
@@ -1,5 +1,10 @@
 --TEST--
 Bug #73532 (Null pointer dereference in mb_eregi)
+--SKIPIF--
+<?php
+if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
+if (!function_exists('mb_eregi')) die('skip mb_eregi() not available');
+?>
 --FILE--
 <?php
 var_dump(mb_eregi("a", "\xf5"));
@@ -1,5 +1,10 @@
 --TEST--
 Bug #73646 (mb_ereg_search_init null pointer dereference)
+--SKIPIF--
+<?php
+if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
+if (!function_exists('mb_ereg_search_init')) die('skip mb_ereg_search_init() not available');
+?>
 --FILE--
 <?php

@@ -1,11 +1,14 @@
 --TEST--
 Bug #77370 (Buffer overflow on mb regex functions - fetch_token)
 --SKIPIF--
-<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+<?php
+if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
+if (!function_exists('mb_split')) die('skip mb_split() not available');
+?>
 --FILE--
 <?php
 var_dump(mb_split("   \xfd",""));
 ?>
 --EXPECTF--
-Warning: mb_split(): mbregex compile err: invalid code point value in %sbug77370.php on line %d
+Warning: mb_split(): Pattern is not valid under UTF-8 encoding in %s on line %d
 bool(false)
@@ -1,11 +1,14 @@
 --TEST--
 Bug #77371 (heap buffer overflow in mb regex functions - compile_string_node)
 --SKIPIF--
-<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+<?php
+if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
+if (!function_exists('mb_ereg')) die('skip mb_ereg() not available');
+?>
 --FILE--
 <?php
 var_dump(mb_ereg("()0\xfc00000\xfc00000\xfc00000\xfc",""));
 ?>
 --EXPECTF--
-Warning: mb_ereg(): mbregex compile err: invalid code point value in %sbug77371.php on line %d
+Warning: mb_ereg(): Pattern is not valid under UTF-8 encoding in %s on line %d
 bool(false)
@@ -1,7 +1,10 @@
 --TEST--
 Bug #77381 (heap buffer overflow in multibyte match_at)
 --SKIPIF--
-<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+<?php
+if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
+if (!function_exists('mb_ereg')) die('skip mb_ereg() not available');
+?>
 --FILE--
 <?php
 var_dump(mb_ereg("000||0\xfa","0"));
@@ -10,14 +13,14 @@ var_dump(mb_ereg("0000\\"."\xf5","0"));
 var_dump(mb_ereg("(?i)FFF00000000000000000\xfd",""));
 ?>
 --EXPECTF--
-Warning: mb_ereg(): mbregex compile err: invalid code point value in %sbug77381.php on line %d
+Warning: mb_ereg(): Pattern is not valid under UTF-8 encoding in %s on line %d
 bool(false)

-Warning: mb_ereg(): mbregex compile err: invalid code point value in %sbug77381.php on line %d
+Warning: mb_ereg(): Pattern is not valid under UTF-8 encoding in %s on line %d
 bool(false)

-Warning: mb_ereg(): mbregex compile err: invalid code point value in %sbug77381.php on line %d
+Warning: mb_ereg(): Pattern is not valid under UTF-8 encoding in %s on line %d
 bool(false)

-Warning: mb_ereg(): mbregex compile err: invalid code point value in %sbug77381.php on line %d
+Warning: mb_ereg(): Pattern is not valid under UTF-8 encoding in %s on line %d
 bool(false)
@@ -1,14 +1,14 @@
 --TEST--
-Bug #77371 (Heap overflow in utf32be_mbc_to_code)
+Bug #77418 (Heap overflow in utf32be_mbc_to_code)
 --SKIPIF--
-<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+<?php
+if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
+if (!function_exists('mb_split')) die('skip mb_split() not available');
+?>
 --FILE--
 <?php
 mb_regex_encoding("UTF-32");
 var_dump(mb_split("\x00\x00\x00\x5c\x00\x00\x00B","000000000000000000000000000000"));
 ?>
 --EXPECT--
-array(1) {
-  [0]=>
-  string(30) "000000000000000000000000000000"
-}
+bool(false)
@@ -1,7 +1,10 @@
 --TEST--
 Check for empty pattern
 --SKIPIF--
-<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+<?php
+if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
+if (!function_exists('mb_ereg_search_init')) die('skip mb_ereg_search_init() not available');
+?>
 --FILE--
 <?php

@@ -0,0 +1,16 @@
+--TEST--
+mb_convert_encoding() shouldn't leak keys
+--FILE--
+<?php
+
+$x = "x";
+$array = ["foo" . $x => "bar"];
+mb_convert_encoding($array, 'UTF-8', 'UTF-8');
+var_dump($array);
+
+?>
+--EXPECT--
+array(1) {
+  ["foox"]=>
+  string(3) "bar"
+}
@@ -110,7 +110,7 @@ string(10) "string_val"

 -- Iteration 4 --

-Warning: mb_ereg_replace(): mbregex compile err: invalid code point value in %smb_ereg_replace_variation1.php on line %d
+Warning: mb_ereg_replace(): Pattern is not valid under UTF-8 encoding in %s on line %d
 bool(false)

 -- Iteration 5 --
@@ -118,7 +118,7 @@ string(10) "string_val"

 -- Iteration 6 --

-Warning: mb_ereg_replace(): mbregex compile err: invalid code point value in %smb_ereg_replace_variation1.php on line %d
+Warning: mb_ereg_replace(): Pattern is not valid under UTF-8 encoding in %s on line %d
 bool(false)

 -- Iteration 7 --
@@ -2,7 +2,8 @@
 mb_ereg_search_pos() # a test for the basic function of mb_ereg_search_pos
 --SKIPIF--
 <?php
-if (!extension_loaded('mbstring')) die('skip mbstring not enabled');
+if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
+if (!function_exists('mb_ereg_search_init')) die('skip mb_ereg_search_init() not available');
 ?>
 --FILE--
 <?php
@@ -2,7 +2,8 @@
 mb_ereg_search_setpos() function
 --SKIPIF--
 <?php
-if (!extension_loaded('mbstring')) die('skip mbstring not enabled');
+if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
+if (!function_exists('mb_ereg_search_init')) die('skip mb_ereg_search_init() not available');
 ?>
 --FILE--
 <?php
@@ -0,0 +1,27 @@
+--TEST--
+Bug #77597: mysqli_fetch_field hangs scripts
+--SKIPIF--
+<?php
+require_once('skipif.inc');
+require_once('skipifconnectfailure.inc');
+?>
+--FILE--
+<?php
+
+require_once("connect.inc");
+$mysqli = new my_mysqli($host, $user, $passwd, $db, $port, $socket);
+
+$mysqli->query('DROP TABLE IF EXISTS a');
+$mysqli->query('CREATE TABLE a (b int)');
+$mysqli->query('INSERT INTO a VALUES (1),(2),(3),(4),(5),(6),(7),(8),(9)');
+
+$mysqli->real_query("SELECT * FROM a");
+
+$result = $mysqli->store_result(MYSQLI_STORE_RESULT_COPY_DATA);
+
+$field = $result->fetch_field();
+var_dump($field->name);
+
+?>
+--EXPECT--
+string(1) "b"
@@ -91,7 +91,7 @@ MYSQLND_METHOD(mysqlnd_result_buffered_c, initialize_result_set_rest)(MYSQLND_RE
 																	  MYSQLND_STATS * stats,
 																	  zend_bool int_and_float_native)
 {
-	unsigned int i;
+	unsigned int row, field;
 	enum_func_status ret = PASS;
 	const unsigned int field_count = meta->field_count;
 	const uint64_t row_count = result->row_count;
@@ -106,33 +106,33 @@ MYSQLND_METHOD(mysqlnd_result_buffered_c, initialize_result_set_rest)(MYSQLND_RE
 			DBG_RETURN(FAIL);
 		}

-		for (i = 0; i < result->row_count; i++) {
+		for (row = 0; row < result->row_count; row++) {
 			/* (i / 8) & the_bit_for_i*/
-			if (initialized[i >> 3] & (1 << (i & 7))) {
+			if (initialized[row >> 3] & (1 << (row & 7))) {
 				continue;
 			}

-			rc = result->m.row_decoder(result->row_buffers[i], current_row, field_count, meta->fields, int_and_float_native, stats);
+			rc = result->m.row_decoder(result->row_buffers[row], current_row, field_count, meta->fields, int_and_float_native, stats);

 			if (rc != PASS) {
 				ret = FAIL;
 				break;
 			}
 			result->initialized_rows++;
-			initialized[i >> 3] |= (1 << (i & 7));
-			for (i = 0; i < field_count; i++) {
+			initialized[row >> 3] |= (1 << (row & 7));
+			for (field = 0; field < field_count; field++) {
 				/*
 				  NULL fields are 0 length, 0 is not more than 0
 				  String of zero size, definitely can't be the next max_length.
 				  Thus for NULL and zero-length we are quite efficient.
 				*/
-				if (Z_TYPE(current_row[i]) == IS_STRING) {
-					const size_t len = Z_STRLEN(current_row[i]);
-					if (meta->fields[i].max_length < len) {
-						meta->fields[i].max_length = len;
+				if (Z_TYPE(current_row[field]) == IS_STRING) {
+					const size_t len = Z_STRLEN(current_row[field]);
+					if (meta->fields[field].max_length < len) {
+						meta->fields[field].max_length = len;
 					}
 				}
-				zval_ptr_dtor_nogc(&current_row[i]);
+				zval_ptr_dtor_nogc(&current_row[field]);
 			}
 		}
 		mnd_efree(current_row);
@@ -3,6 +3,7 @@ oci_password_change()
 --SKIPIF--
 <?php
 $target_dbs = array('oracledb' => true, 'timesten' => false);  // test runs on thes
+require(dirname(__FILE__).'/skipif.inc');
 require(dirname(__FILE__).'/connect.inc');
 if (empty($dbase)) die ("skip requires database connection string be set");
 if ($test_drcp) die("skip password change not supported in DRCP Mode");
@@ -3,6 +3,7 @@ ocipasswordchange()
 --SKIPIF--
 <?php
 $target_dbs = array('oracledb' => true, 'timesten' => false);  // test runs on thes
+require(dirname(__FILE__).'/skipif.inc');
 require(dirname(__FILE__).'/connect.inc');
 if (empty($dbase)) die ("skip requires database connection string be set");
 if ($test_drcp) die("skip password change not supported in DRCP Mode");
@@ -1581,7 +1581,10 @@ static int replace_constant_operands(sccp_ctx *ctx) {
 					zend_ssa_remove_instr(ssa, opline, ssa_op);
 					removed_ops++;
 				}
-			} else if (ssa_op->op1_def == i) {
+			} else if (ssa_op->op1_def == i &&
+					(ssa_op->result_def < 0 ||
+					 (ssa->vars[ssa_op->result_def].use_chain < 0 &&
+					  ssa->vars[ssa_op->result_def].phi_use_chain == NULL))) {
 				/* Compound assign or incdec -> convert to direct ASSIGN */

 				/* Destroy previous op2 */
@@ -1595,10 +1598,8 @@ static int replace_constant_operands(sccp_ctx *ctx) {
 					ssa_op->op2_use_chain = -1;
 				}

-				/* Mark result unused, if possible */
-				if (ssa_op->result_def >= 0
-						&& ssa->vars[ssa_op->result_def].use_chain < 0
-						&& ssa->vars[ssa_op->result_def].phi_use_chain == NULL) {
+				/* We checked that result has no uses, mark unused */
+				if (ssa_op->result_def >= 0) {
 					if (opline->result_type & (IS_TMP_VAR|IS_VAR)) {
 						zend_optimizer_remove_live_range_ex(op_array, opline->result.var, var->definition);
 					}
@@ -74,8 +74,8 @@ static void zend_mark_reachable(zend_op *opcodes, zend_cfg *cfg, zend_basic_bloc
 					}
 				} else {
 					ZEND_ASSERT(opcode == ZEND_SWITCH_LONG || opcode == ZEND_SWITCH_STRING);
-					if (i == b->successors_count) {
-						succ->flags |= ZEND_BB_FOLLOW;
+					if (i == b->successors_count - 1) {
+						succ->flags |= ZEND_BB_FOLLOW | ZEND_BB_TARGET;
 					} else {
 						succ->flags |= ZEND_BB_TARGET;
 					}
@@ -2093,7 +2093,6 @@ static uint32_t assign_dim_result_type(
 		tmp |= MAY_BE_RC1 | MAY_BE_RCN;
 	}
 	if (tmp & MAY_BE_ARRAY) {
-		tmp |= (value_type & MAY_BE_ANY) << MAY_BE_ARRAY_SHIFT;
 		if (value_type & MAY_BE_UNDEF) {
 			tmp |= MAY_BE_ARRAY_OF_NULL;
 		}
@@ -2114,6 +2113,11 @@ static uint32_t assign_dim_result_type(
 				tmp |= MAY_BE_ARRAY_KEY_STRING;
 			}
 		}
+		/* Only add value type if we have a key type. It might be that the key type is illegal
+		 * for arrays. */
+		if (tmp & MAY_BE_ARRAY_KEY_ANY) {
+			tmp |= (value_type & MAY_BE_ANY) << MAY_BE_ARRAY_SHIFT;
+		}
 	}
 	return tmp;
 }
@@ -54,6 +54,14 @@ static zend_bool needs_pi(const zend_op_array *op_array, zend_dfg *dfg, zend_ssa
 		return 0;
 	}

+	/* Make sure that both sucessors of the from block aren't the same. Pi nodes are associated
+	 * with predecessor blocks, so we can't distinguish which edge the pi belongs to. */
+	from_block = &ssa->cfg.blocks[from];
+	ZEND_ASSERT(from_block->successors_count == 2);
+	if (from_block->successors[0] == from_block->successors[1]) {
+		return 0;
+	}
+
 	to_block = &ssa->cfg.blocks[to];
 	if (to_block->predecessors_count == 1) {
 		/* Always place pi if one predecessor (an if branch) */
@@ -62,8 +70,6 @@ static zend_bool needs_pi(const zend_op_array *op_array, zend_dfg *dfg, zend_ssa

 	/* Check that the other successor of the from block does not dominate all other predecessors.
 	 * If it does, we'd probably end up annihilating a positive+negative pi assertion. */
-	from_block = &ssa->cfg.blocks[from];
-	ZEND_ASSERT(from_block->successors_count == 2);
 	other_successor = from_block->successors[0] == to
 		? from_block->successors[1] : from_block->successors[0];
 	return !dominates_other_predecessors(&ssa->cfg, to_block, other_successor, from);
@@ -0,0 +1,26 @@
+--TEST--
+Bug #77691: Opcache passes wrong value for inline array push assignments
+--FILE--
+<?php
+
+if (true) {
+    function dump($str) {
+        var_dump($str);
+    }
+}
+
+function test() {
+    $array = [];
+    dump($array[] = 'test');
+    dump($array);
+}
+
+test();
+
+?>
+--EXPECT--
+string(4) "test"
+array(1) {
+  [0]=>
+  string(4) "test"
+}
@@ -0,0 +1,17 @@
+--TEST--
+Bug #77743: Incorrect pi node insertion for jmpznz with identical successors
+--FILE--
+<?php
+
+function buggy($a) {
+	$id_country = $a;
+	if ($id_country === false) {
+		if (true) {
+		}
+	}
+	var_dump($id_country);
+}
+
+buggy(42);
+--EXPECT--
+int(42)
@@ -0,0 +1,18 @@
+--TEST--
+Don't add array value type is key type is illegal
+--FILE--
+<?php
+
+function test(\SplObjectStorage $definitions = null) {
+    $argument = new stdClass;
+    $definitions[$argument] = 1;
+    $definitions[$argument] += 1;
+    $argument = [];
+    $definitions[$argument] = 1;
+    $definitions[$argument] += 1;
+}
+
+?>
+===DONE===
+--EXPECT--
+===DONE===
@@ -169,7 +169,11 @@ static int zend_file_cache_mkdir(char *filename, size_t start)
 		if (IS_SLASH(*s)) {
 			char old = *s;
 			*s = '\000';
+#ifndef ZEND_WIN32
 			if (mkdir(filename, S_IRWXU) < 0 && errno != EEXIST) {
+#else
+			if (php_win32_ioutil_mkdir(filename, 0700) < 0 && errno != EEXIST) {
+#endif
 				*s = old;
 				return FAILURE;
 			}
@@ -775,7 +779,21 @@ static char *zend_file_cache_get_bin_file_path(zend_string *script_path)
 	filename[len] = '\\';

 	memcpy(filename + len + 1, ZCG(system_id), 32);
-	if (ZSTR_LEN(script_path) >= 2 && ':' == ZSTR_VAL(script_path)[1]) {
+
+	if (ZSTR_LEN(script_path) >= 7 && ':' == ZSTR_VAL(script_path)[4] && '/' == ZSTR_VAL(script_path)[5]  && '/' == ZSTR_VAL(script_path)[6]) {
+		/* phar:// or file:// */
+		*(filename + len + 33) = '\\';
+		memcpy(filename + len + 34, ZSTR_VAL(script_path), 4);
+		if (ZSTR_LEN(script_path) - 7 >= 2 && ':' == ZSTR_VAL(script_path)[8]) {
+			*(filename + len + 38) = '\\';
+			*(filename + len + 39) = ZSTR_VAL(script_path)[7];
+			memcpy(filename + len + 40, ZSTR_VAL(script_path) + 9, ZSTR_LEN(script_path) - 9);
+			memcpy(filename + len + 40 + ZSTR_LEN(script_path) - 9, SUFFIX, sizeof(SUFFIX));
+		} else {
+			memcpy(filename + len + 38, ZSTR_VAL(script_path) + 7, ZSTR_LEN(script_path) - 7);
+			memcpy(filename + len + 38 + ZSTR_LEN(script_path) - 7, SUFFIX, sizeof(SUFFIX));
+		}
+	} else if (ZSTR_LEN(script_path) >= 2 && ':' == ZSTR_VAL(script_path)[1]) {
 		/* local fs */
 		*(filename + len + 33) = '\\';
 		*(filename + len + 34) = ZSTR_VAL(script_path)[0];
@@ -813,7 +831,7 @@ int zend_file_cache_script_store(zend_persistent_script *script, int in_shm)
 #ifndef ZEND_WIN32
 	fd = open(filename, O_CREAT | O_EXCL | O_RDWR | O_BINARY, S_IRUSR | S_IWUSR);
 #else
-	fd = open(filename, O_CREAT | O_EXCL | O_RDWR | O_BINARY, _S_IREAD | _S_IWRITE);
+	fd = php_win32_ioutil_open(filename, O_CREAT | O_EXCL | O_RDWR | O_BINARY, _S_IREAD | _S_IWRITE);
 #endif
 	if (fd < 0) {
 		if (errno != EEXIST) {
@@ -1360,7 +1378,11 @@ zend_persistent_script *zend_file_cache_script_load(zend_file_handle *file_handl
 	}
 	filename = zend_file_cache_get_bin_file_path(full_path);

+#ifndef ZEND_WIN32
 	fd = open(filename, O_RDONLY | O_BINARY);
+#else
+	fd = php_win32_ioutil_open(filename, O_RDONLY | O_BINARY);
+#endif
 	if (fd < 0) {
 		efree(filename);
 		return NULL;
@@ -6494,7 +6494,7 @@ static int php_openssl_cipher_update(const EVP_CIPHER *cipher_type,
 {
 	int i = 0;

-	if (mode->is_single_run_aead && !EVP_EncryptUpdate(cipher_ctx, NULL, &i, NULL, (int)data_len)) {
+	if (mode->is_single_run_aead && !EVP_CipherUpdate(cipher_ctx, NULL, &i, NULL, (int)data_len)) {
 		php_openssl_store_errors();
 		php_error_docref(NULL, E_WARNING, "Setting of data length failed");
 		return FAILURE;
@@ -9,9 +9,21 @@ function phpt_notify($worker = WORKER_DEFAULT_NAME)
    ServerClientTestCase::getInstance()->notify($worker);
 }

-function phpt_wait($worker = WORKER_DEFAULT_NAME)
+function phpt_wait($worker = WORKER_DEFAULT_NAME, $timeout = null)
 {
-    ServerClientTestCase::getInstance()->wait($worker);
+    ServerClientTestCase::getInstance()->wait($worker, $timeout);
+}
+
+function phpt_has_sslv3() {
+    static $result = null;
+    if (!is_null($result)) {
+        return $result;
+    }
+    $server = @stream_socket_server('sslv3://127.0.0.1:10013');
+    if ($result = !!$server) {
+        fclose($server);
+    }
+    return $result;
 }

 /**
@@ -121,9 +133,24 @@ class ServerClientTestCase
        }
    }

-    public function wait($worker)
+    public function wait($worker, $timeout = null)
    {
-        fgets($this->isWorker ? STDIN : $this->workerStdOut[$worker]);
+        $handle = $this->isWorker ? STDIN : $this->workerStdOut[$worker];
+        if ($timeout === null) {
+            fgets($handle);
+            return true;
+        }
+
+        stream_set_blocking($handle, false);
+        $read = [$handle];
+        $result = stream_select($read, $write, $except, $timeout);
+        if (!$result) {
+            return false;
+        }
+
+        fgets($handle);
+        stream_set_blocking($handle, true);
+        return true;
    }

    public function notify($worker)
@@ -12,90 +12,101 @@ $cacertFile = __DIR__ . DIRECTORY_SEPARATOR . 'bug77390-ca.pem.tmp';

 $peerName = 'bug77390';
 $clientCode = <<<'CODE'
-	$context = stream_context_create(['ssl' => ['verify_peer' => false, 'peer_name' => '%s']]);
+    $context = stream_context_create(['ssl' => ['verify_peer' => false, 'peer_name' => '%s']]);

-	phpt_wait('server');
-	phpt_notify('proxy');
-	
-	phpt_wait('proxy');
-	$fp = stream_socket_client("ssl://127.0.0.1:10012", $errornum, $errorstr, 3000, STREAM_CLIENT_CONNECT, $context);
-	stream_set_blocking($fp, false);
+    phpt_wait('server');
+    phpt_notify('proxy');

-	$read = [$fp];
-	$buf = '';
-	$printed = false;
-	while (stream_select($read, $write, $except, 1000)) {
-		$chunk = stream_get_contents($fp, 4096);
-		if ($chunk !== "") {
-		    var_dump($chunk);
-		    $buf .= $chunk;
-		} elseif (!$printed) {
-		    $printed = true;
-		    var_dump($chunk);
-		}
-		if ($buf === 'hello, world') {
-			break;
-		}
-	}
-	
-	phpt_notify('server');
-	phpt_notify('proxy');
+    phpt_wait('proxy');
+    $fp = stream_socket_client("ssl://127.0.0.1:10012", $errornum, $errorstr, 3000, STREAM_CLIENT_CONNECT, $context);
+    stream_set_blocking($fp, false);
+
+    $read = [$fp];
+    $buf = '';
+    $emptyChunkPrinted = false;
+    $warmedUp = false;
+    while (stream_select($read, $write, $except, 1000)) {
+        $chunk = stream_get_contents($fp, 4096);
+        $buf .= $chunk;
+        phpt_notify('proxy');
+        if (!$warmedUp) {
+            if ($buf !== 'warmup') {
+                continue;
+            }
+            $warmedUp = true;
+            $buf = '';
+            phpt_notify('server');
+            continue;
+        }
+        if ($chunk !== '' || !$emptyChunkPrinted) {
+            $emptyChunkPrinted = true;
+            var_dump($chunk);
+        }
+        if ($buf === 'hello, world') {
+            break;
+        }
+    }
+
+    phpt_notify('server');
+    phpt_notify('proxy');
 CODE;
 $clientCode = sprintf($clientCode, $peerName);

 $serverCode = <<<'CODE'
-	$context = stream_context_create(['ssl' => ['local_cert' => '%s']]);
+    $context = stream_context_create(['ssl' => ['local_cert' => '%s']]);

-	$flags = STREAM_SERVER_BIND|STREAM_SERVER_LISTEN;
-	$fp = stream_socket_server("ssl://127.0.0.1:10011", $errornum, $errorstr, $flags, $context);
-	phpt_notify();
-	
-	$conn = stream_socket_accept($fp);
-	fwrite($conn, 'hello, world');
-	
-	phpt_wait();
-	fclose($conn);
+    $flags = STREAM_SERVER_BIND|STREAM_SERVER_LISTEN;
+    $fp = stream_socket_server("ssl://127.0.0.1:10011", $errornum, $errorstr, $flags, $context);
+    phpt_notify();
+
+    $conn = stream_socket_accept($fp);
+    fwrite($conn, 'warmup');
+    phpt_wait();
+    fwrite($conn, 'hello, world');
+
+    phpt_wait();
+    fclose($conn);
 CODE;
 $serverCode = sprintf($serverCode, $certFile);

 $proxyCode = <<<'CODE'
-	phpt_wait();
+    phpt_wait();

-	$upstream = stream_socket_client("tcp://127.0.0.1:10011", $errornum, $errorstr, 3000, STREAM_CLIENT_CONNECT);
-	stream_set_blocking($upstream, false);
+    $upstream = stream_socket_client("tcp://127.0.0.1:10011", $errornum, $errorstr, 3000, STREAM_CLIENT_CONNECT);
+    stream_set_blocking($upstream, false);

-	$flags = STREAM_SERVER_BIND|STREAM_SERVER_LISTEN;
-	$server = stream_socket_server("tcp://127.0.0.1:10012", $errornum, $errorstr, $flags);
-	phpt_notify();
-	
-	$conn = stream_socket_accept($server);
-	stream_set_blocking($conn, false);
-	
-	$read = [$upstream, $conn];
-	while (stream_select($read, $write, $except, 1)) {
-		foreach ($read as $fp) {
-			$data = stream_get_contents($fp);
-			if ($fp === $conn) {
-				fwrite($upstream, $data);
-			} else {
-				if ($data !== '' && $data[0] === chr(23)) {
-					$parts = str_split($data, (int) ceil(strlen($data) / 3));
-					foreach ($parts as $part) {
-						fwrite($conn, $part);
-						usleep(1000);
-					}
-				} else {
-					fwrite($conn, $data);
-				}
-			}
-		}
-		if (feof($upstream)) {
-			break;
-		}
-		$read = [$upstream, $conn];
-	}
-	
-	phpt_wait();
+    $flags = STREAM_SERVER_BIND|STREAM_SERVER_LISTEN;
+    $server = stream_socket_server("tcp://127.0.0.1:10012", $errornum, $errorstr, $flags);
+    phpt_notify();
+
+    $conn = stream_socket_accept($server);
+    stream_set_blocking($conn, false);
+
+    $read = [$upstream, $conn];
+    while (stream_select($read, $write, $except, 1)) {
+        foreach ($read as $fp) {
+            $data = stream_get_contents($fp);
+            if ($fp === $conn) {
+                fwrite($upstream, $data);
+            } else {
+                if ($data !== '' && $data[0] === chr(23)) {
+                    $parts = str_split($data, (int) ceil(strlen($data) / 3));
+                    foreach ($parts as $part) {
+                        fwrite($conn, $part);
+                        phpt_wait(null, 1);
+                    }
+                } else {
+                    fwrite($conn, $data);
+                }
+            }
+        }
+        if (feof($upstream)) {
+            break;
+        }
+        $read = [$upstream, $conn];
+    }
+
+    phpt_wait();
 CODE;

 include 'CertificateGenerator.inc';
@@ -105,8 +116,8 @@ $certificateGenerator->saveNewCertAsFileWithKey($peerName, $certFile);

 include 'ServerClientTestCase.inc';
 ServerClientTestCase::getInstance()->run($clientCode, [
-	'server' => $serverCode,
-	'proxy' => $proxyCode,
+    'server' => $serverCode,
+    'proxy' => $proxyCode,
 ]);
 ?>
 --CLEAN--
@@ -16,7 +16,7 @@ $serverCode = <<<'CODE'
    $server = stream_socket_server('tls://127.0.0.1:64321', $errno, $errstr, $flags, $ctx);
    phpt_notify();

-    for ($i=0; $i < 6; $i++) {
+    for ($i = 0; $i < (phpt_has_sslv3() ? 6 : 5); $i++) {
        @stream_socket_accept($server, 3);
    }
 CODE;
@@ -16,7 +16,7 @@ $serverCode = <<<'CODE'
    $server = stream_socket_server('tlsv1.0://127.0.0.1:64321', $errno, $errstr, $flags, $ctx);
    phpt_notify();

-    for ($i=0; $i < 3; $i++) {
+    for ($i = 0; $i < (phpt_has_sslv3() ? 3 : 2); $i++) {
        @stream_socket_accept($server, 3);
    }
 CODE;
@@ -16,7 +16,7 @@ $serverCode = <<<'CODE'
    $server = stream_socket_server('tlsv1.1://127.0.0.1:64321', $errno, $errstr, $flags, $ctx);
    phpt_notify();

-    for ($i=0; $i < 3; $i++) {
+    for ($i = 0; $i < (phpt_has_sslv3() ? 3 : 2); $i++) {
        @stream_socket_accept($server, 3);
    }
 CODE;
@@ -16,7 +16,7 @@ $serverCode = <<<'CODE'
    $server = stream_socket_server('tlsv1.2://127.0.0.1:64321', $errno, $errstr, $flags, $ctx);
    phpt_notify();

-    for ($i=0; $i < 3; $i++) {
+    for ($i = 0; $i < (phpt_has_sslv3() ? 3 : 2); $i++) {
        @stream_socket_accept($server, 3);
    }
 CODE;
@@ -1819,7 +1819,7 @@ static int php_openssl_enable_crypto(php_stream *stream,
 {
 	int n;
 	int retry = 1;
-	int cert_captured;
+	int cert_captured = 0;
 	X509 *peer_cert;

 	if (cparam->inputs.activate && !sslsock->ssl_active) {
@@ -486,6 +486,7 @@ PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(zend_string *regex)

 			case ' ':
 			case '\n':
+			case '\r':
 				break;

 			default:
@@ -0,0 +1,14 @@
+--TEST--
+Bug #77827 (preg_match does not ignore \r in regex flags)
+--FILE--
+<?php
+var_dump(
+    preg_match("/foo/i\r", 'FOO'),
+    preg_last_error()
+);
+?>
+===DONE===
+--EXPECT--
+int(1)
+int(0)
+===DONE===
@@ -5,6 +5,9 @@ Test preg_match() function : error conditions - jit stacklimit exhausted
 if (ini_get("pcre.jit") === FALSE) {
 	die("skip no jit built");
 }
+?>
+--INI--
+pcre.jit=1
 --FILE--
 <?php
 var_dump(preg_match('/^(foo)+$/', str_repeat('foo', 1024*8192)));
@@ -1403,6 +1403,7 @@ void pdo_dbh_init(void)
 	pdo_dbh_object_handlers.offset = XtOffsetOf(pdo_dbh_object_t, std);
 	pdo_dbh_object_handlers.dtor_obj = zend_objects_destroy_object;
 	pdo_dbh_object_handlers.free_obj = pdo_dbh_free_storage;
+	pdo_dbh_object_handlers.clone_obj = NULL;
 	pdo_dbh_object_handlers.get_method = dbh_method_get;
 	pdo_dbh_object_handlers.compare_objects = dbh_compare;
 	pdo_dbh_object_handlers.get_gc = dbh_get_gc;
@@ -2266,22 +2266,6 @@ static int dbstmt_compare(zval *object1, zval *object2)
 	return -1;
 }

-static zend_object *dbstmt_clone_obj(zval *zobject)
-{
-	pdo_stmt_t *stmt;
-	pdo_stmt_t *old_stmt;
-
-	stmt = ecalloc(1, sizeof(pdo_stmt_t) + zend_object_properties_size(Z_OBJCE_P(zobject)));
-	zend_object_std_init(&stmt->std, Z_OBJCE_P(zobject));
-	object_properties_init(&stmt->std, Z_OBJCE_P(zobject));
-
-	old_stmt = Z_PDO_STMT_P(zobject);
-
-	zend_objects_clone_members(&stmt->std, &old_stmt->std);
-
-	return &stmt->std;
-}
-
 zend_object_handlers pdo_dbstmt_object_handlers;
 static int pdo_row_serialize(zval *object, unsigned char **buffer, size_t *buf_len, zend_serialize_data *data);

@@ -2304,7 +2288,7 @@ void pdo_stmt_init(void)
 	pdo_dbstmt_object_handlers.unset_property = dbstmt_prop_delete;
 	pdo_dbstmt_object_handlers.get_method = dbstmt_method_get;
 	pdo_dbstmt_object_handlers.compare_objects = dbstmt_compare;
-	pdo_dbstmt_object_handlers.clone_obj = dbstmt_clone_obj;
+	pdo_dbstmt_object_handlers.clone_obj = NULL;

 	INIT_CLASS_ENTRY(ce, "PDORow", pdo_row_functions);
 	pdo_row_ce = zend_register_internal_class(&ce);
@@ -0,0 +1,23 @@
+--TEST--
+PDO Common: Bug #77849 (Unexpected segfault attempting to use cloned PDO object)
+--SKIPIF--
+<?php
+if (!extension_loaded('pdo')) die('skip');
+$dir = getenv('REDIR_TEST_DIR');
+if (false == $dir) die('skip no driver');
+require_once $dir . 'pdo_test.inc';
+PDOTest::skip();
+?>
+--FILE--
+<?php
+if (getenv('REDIR_TEST_DIR') === false) putenv('REDIR_TEST_DIR='.dirname(__FILE__) . '/../../pdo/tests/');
+require_once getenv('REDIR_TEST_DIR') . 'pdo_test.inc';
+
+$db = PDOTest::factory();
+$db2 = clone $db;
+?>
+--EXPECTF--
+Fatal error: Uncaught Error: Trying to clone an uncloneable object of class PDO in %s
+Stack trace:
+#0 {main}
+  thrown in %s on line %d
@@ -0,0 +1,18 @@
+--TEST--
+PDO Common: Bug #77849 (inconsistent state of cloned statament object)
+--SKIPIF--
+<?php
+if (!extension_loaded('pdo')) die('skip');
+?>
+--FILE--
+<?php
+$stmt = new PDOStatement();
+
+clone $stmt;
+?>
+--EXPECTF--
+Fatal error: Uncaught Error: Trying to clone an uncloneable object of class PDOStatement in %s:4
+Stack trace:
+#0 {main}
+  thrown in %s on line 4
+