Update versions for PHP 7.2.27

Update CREDITS for PHP 7.2.27
Update NEWS for PHP 7.2.27
2026-11-12 19:50:50 +00:00 · 2020-01-22 07:45:58 +00:00 · 2020-01-22 07:45:58 +00:00 · 2020-01-22 07:45:58 +00:00 · 2020-01-20 22:12:32 -08:00 · 2020-01-20 21:43:42 -08:00
153 changed files with 3231 additions and 301 deletions
@@ -1,6 +1,134 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2019, PHP 7.2.23
+23 Jan 2020, PHP 7.2.27
+
+- Mbstring:
+  . Fixed bug #79037 (global buffer-overflow in `mbfl_filt_conv_big5_wchar`). 
+    (CVE-2020-7060) (Nikita)
+
+- Session:
+  . Fixed bug #79091 (heap use-after-free in session_create_id()). (cmb, Nikita)
+
+- Standard:
+  . Fixed bug #79099 (OOB read in php_strip_tags_ex). (CVE-2020-7059). (cmb)
+
+18 Dec 2019, PHP 7.2.26
+
+- Bcmath:
+  . Fixed bug #78878 (Buffer underflow in bc_shift_addsub). (CVE-2019-11046).
+    (cmb)
+
+- Core:
+  . Fixed bug #78862 (link() silently truncates after a null byte on Windows).
+    (CVE-2019-11044). (cmb)
+  . Fixed bug #78863 (DirectoryIterator class silently truncates after a null
+    byte). (CVE-2019-11045). (cmb)
+
+- EXIF:
+  . Fixed bug #78793 (Use-after-free in exif parsing under memory sanitizer).
+    (CVE-2019-11050). (Nikita)
+  . Fixed bug #78910 (Heap-buffer-overflow READ in exif). (CVE-2019-11047).
+    (Nikita)
+
+- GD:
+  . Fixed bug #78849 (GD build broken with -D SIGNED_COMPARE_SLOW). (cmb)
+
+- Intl:
+  . Fixed bug #78804 (Segmentation fault in Locale::filterMatches). (Stas)
+
+- OPcache:
+  . Fixed $x = (bool)$x; with opcache (should emit undeclared variable notice).
+    (Tyson Andre)
+
+- Standard:
+  . Fixed bug #78759 (array_search in $GLOBALS). (Nikita)
+  . Fixed bug #78833 (Integer overflow in pack causes out-of-bound access).
+    (cmb)
+  . Fixed bug #78814 (strip_tags allows / in tag name => whitelist bypass).
+    (cmb)
+
+21 Nov 2019, PHP 7.2.25
+
+- Core:
+  . Fixed bug #78656 (Parse errors classified as highest log-level). (Erik
+    Lundin)
+  . Fixed bug #78752 (Segfault if GC triggered while generator stack frame is
+    being destroyed). (Nikita)
+  . Fixed bug #78689 (Closure::fromCallable() doesn't handle
+    [Closure, '__invoke']). (Nikita)
+
+- COM:
+  . Fixed bug #78694 (Appending to a variant array causes segfault). (cmb)
+
+- Date:
+  . Fixed bug #70153 (\DateInterval incorrectly unserialized). (Maksim Iakunin)
+  . Fixed bug #78751 (Serialising DatePeriod converts DateTimeImmutable). (cmb)
+
+- Iconv:
+  . Fixed bug #78642 (Wrong libiconv version displayed). (gedas at martynas,
+    cmb).
+
+- OpCache:
+  . Fixed bug #78654 (Incorrectly computed opcache checksum on files with
+    non-ascii characters). (mhagstrand)
+  . Fixed bug #78747 (OpCache corrupts custom extension result). (Nikita)
+
+- OpenSSL:
+  . Fixed bug #78775 (TLS issues from HTTP request affecting other encrypted
+    connections). (Nikita)
+
+- Reflection:
+  . Fixed bug #78697 (ReflectionClass::ImplementsInterface - inaccurate error
+    message with traits). (villfa)
+
+- Sockets:
+  . Fixed bug #78665 (Multicasting may leak memory). (cmb)
+
+24 Oct 2019, PHP 7.2.24
+
+- Core:
+  . Fixed bug #78535 (auto_detect_line_endings value not parsed as bool).
+    (bugreportuser)
+  . Fixed bug #78620 (Out of memory error). (cmb, Nikita)
+
+- Exif:
+  . Fixed bug #78442 ('Illegal component' on exif_read_data since PHP7)
+	(Kalle)
+
+- FPM:
+  . Fixed bug #78599 (env_path_info underflow in fpm_main.c can lead to RCE).
+    (CVE-2019-11043) (Jakub Zelenka)
+
+- MBString:
+  . Fixed bug #78579 (mb_decode_numericentity: args number inconsistency).
+    (cmb)
+  . Fixed bug #78609 (mb_check_encoding() no longer supports stringable
+    objects). (cmb)
+
+- MySQLi:
+  . Fixed bug #76809 (SSL settings aren't respected when persistent connections 
+    are used). (fabiomsouto)
+
+- PDO_MySQL:
+  . Fixed bug #78623 (Regression caused by "SP call yields additional empty
+    result set"). (cmb)
+
+- Session:
+  . Fixed bug #78624 (session_gc return value for user defined session 
+    handlers). (bshaffer)
+
+- Standard:
+  . Fixed bug #76342 (file_get_contents waits twice specified timeout).
+    (Thomas Calvet)
+  . Fixed bug #78612 (strtr leaks memory when integer keys are used and the
+    subject string shorter). (Nikita)
+  . Fixed bug #76859 (stream_get_line skips data if used with data-generating 
+    filter). (kkopachev)
+
+- Zip:
+  . Fixed bug #78641 (addGlob can modify given remove_path value). (cmb)
+
+26 Sep 2019, PHP 7.2.23

 - Core:
  . Fixed bug #78220 (Can't access OneDrive folder). (cmb, ab)
@@ -165,6 +293,10 @@ PHP                                                                        NEWS

 30 May 2019, PHP 7.2.19

+- Date:
+  . Fixed bug #77909 (DatePeriod::__construct() with invalid recurrence count
+    value). (Ignace Nyamagana Butera)
+
 - EXIF:
  . Fixed bug #77988 (heap-buffer-overflow on php_jpg_get16).
    (CVE-2019-11040) (Stas)
@@ -211,10 +343,6 @@ PHP                                                                        NEWS
  . Fixed bug #77794 (Incorrect Date header format in built-in server).
    (kelunik)

- Date:
-  . Fixed bug #77909 (DatePeriod::__construct() with invalid recurrence count
-    value). (Ignace Nyamagana Butera)
-
 - EXIF
  . Fixed bug #77950 (Heap-buffer-overflow in _estrndup via exif_process_IFD_TAG).
    (CVE-2019-11036) (Stas)
@@ -140,6 +140,7 @@ assert(0 && ($a = function () {
    if ($a) {
    } elseif ($b) {
    }
+    if ($a); else;
 }));

 ?>
@@ -292,4 +293,7 @@ Warning: assert(): assert(0 && ($a = function () {
    if ($a) {
    } elseif ($b) {
    }
+    if ($a) {
+    } else {
+    }
 })) failed in %sexpect_015.php on line %d
@@ -0,0 +1,13 @@
+--TEST--
+Bug #78689: Closure::fromCallable() doesn't handle [Closure, '__invoke']
+--FILE--
+<?php
+$a = [function () { echo "123\n"; }, '__invoke'];
+$a();
+
+$b = Closure::fromCallable($a);
+$b();
+?>
+--EXPECT--
+123
+123
@@ -0,0 +1,24 @@
+--TEST--
+Bug #78752: Segfault if GC triggered while generator stack frame is being destroyed
+--FILE--
+<?php
+
+function gen(&$gen) {
+    $a = new stdClass;
+    $a->a = $a;
+    $b = new stdClass;
+    $b->b = $b;
+    yield 1;
+}
+
+$gen = gen($gen);
+var_dump($gen->current());
+for ($i = 0; $i < 9999; $i++) {
+    $a = new stdClass;
+    $a->a = $a;
+}
+$gen->next();
+
+?>
+--EXPECT--
+int(1)
@@ -0,0 +1,8 @@
+--TEST--
+Using __COMPILER_HALF_OFFSET__ with trailing {} (OSS-Fuzz #17895)
+--FILE--
+<?php
+__COMPILER_HALT_OFFSET__;
+{}
+--EXPECTF--
+Warning: Use of undefined constant __COMPILER_HALT_OFFSET__ - assumed '__COMPILER_HALT_OFFSET__' (this will throw an Error in a future version of PHP) in %s on line %d
@@ -0,0 +1,17 @@
+--TEST--
+Memory leak on ** with result==op1 array
+--FILE--
+<?php
+
+$x = [0];
+$x **= 1;
+var_dump($x);
+
+$x = [0];
+$x **= $x;
+var_dump($x);
+
+?>
+--EXPECT--
+int(0)
+int(0)
@@ -0,0 +1,15 @@
+--TEST--
+Calling a static method on a non-existing class
+--FILE--
+<?php
+
+$str = "foo";
+try {
+    Test::{$str . "bar"}();
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+Class 'Test' not found
@@ -1723,12 +1723,17 @@ static void *zend_mm_alloc_huge(zend_mm_heap *heap, size_t size ZEND_FILE_LINE_D
 	 * We allocate them with 2MB size granularity, to avoid many
 	 * reallocations when they are extended by small pieces
 	 */
-	size_t new_size = ZEND_MM_ALIGNED_SIZE_EX(size, MAX(REAL_PAGE_SIZE, ZEND_MM_CHUNK_SIZE));
+	size_t alignment = MAX(REAL_PAGE_SIZE, ZEND_MM_CHUNK_SIZE);
 #else
-	size_t new_size = ZEND_MM_ALIGNED_SIZE_EX(size, REAL_PAGE_SIZE);
+	size_t alignment = REAL_PAGE_SIZE;
 #endif
+	size_t new_size = ZEND_MM_ALIGNED_SIZE_EX(size, alignment);
 	void *ptr;

+	if (UNEXPECTED(new_size < size)) {
+		zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu + %zu)", size, alignment);
+	}
+
 #if ZEND_MM_LIMIT
 	if (UNEXPECTED(new_size > heap->limit - heap->real_size)) {
 		if (zend_mm_gc(heap) && new_size <= heap->limit - heap->real_size) {
@@ -894,7 +894,7 @@ tail_call:
 		} else {
 			zend_ast_export_indent(str, indent);
 			smart_str_appends(str, "} else ");
-			if (ast->child[1]->kind == ZEND_AST_IF) {
+			if (ast->child[1] && ast->child[1]->kind == ZEND_AST_IF) {
 				list = (zend_ast_list*)ast->child[1];
 				goto tail_call;
 			} else {
@@ -268,8 +268,16 @@ static int zend_create_closure_from_callable(zval *return_value, zval *callable,

 	mptr = fcc.function_handler;
 	if (mptr->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
-		memset(&call, 0, sizeof(zend_internal_function));
+		/* For Closure::fromCallable([$closure, "__invoke"]) return $closure. */
+		if (fcc.object && fcc.object->ce == zend_ce_closure
+				&& zend_string_equals_literal(mptr->common.function_name, "__invoke")) {
+			ZVAL_OBJ(return_value, fcc.object);
+			GC_REFCOUNT(fcc.object)++;
+			zend_free_trampoline(mptr);
+			return SUCCESS;
+		}

+		memset(&call, 0, sizeof(zend_internal_function));
 		call.type = ZEND_INTERNAL_FUNCTION;
 		call.handler = zend_closure_call_magic;
 		call.function_name = mptr->common.function_name;
@@ -7676,6 +7676,9 @@ void zend_compile_const(znode *result, zend_ast *ast) /* {{{ */

 		while (last && last->kind == ZEND_AST_STMT_LIST) {
 			zend_ast_list *list = zend_ast_get_list(last);
+			if (list->children == 0) {
+				break;
+			}
 			last = list->child[list->children-1];
 		}
 		if (last && last->kind == ZEND_AST_HALT_COMPILER) {
@@ -97,16 +97,18 @@ ZEND_API zend_execute_data* zend_generator_freeze_call_stack(zend_execute_data *
 /* }}} */

 static void zend_generator_cleanup_unfinished_execution(
-		zend_generator *generator, uint32_t catch_op_num) /* {{{ */
+		zend_generator *generator, zend_execute_data *execute_data, uint32_t catch_op_num) /* {{{ */
 {
-	zend_execute_data *execute_data = generator->execute_data;
-
 	if (execute_data->opline != execute_data->func->op_array.opcodes) {
 		/* -1 required because we want the last run opcode, not the next to-be-run one. */
 		uint32_t op_num = execute_data->opline - execute_data->func->op_array.opcodes - 1;

 		if (UNEXPECTED(generator->frozen_call_stack)) {
+			/* Temporarily restore generator->execute_data if it has been NULLed out already. */
+			zend_execute_data *save_ex = generator->execute_data;
+			generator->execute_data = execute_data;
 			zend_generator_restore_call_stack(generator);
+			generator->execute_data = save_ex;
 		}
 		zend_cleanup_unfinished_execution(execute_data, op_num, catch_op_num);
 	}
@@ -117,6 +119,9 @@ ZEND_API void zend_generator_close(zend_generator *generator, zend_bool finished
 {
 	if (EXPECTED(generator->execute_data)) {
 		zend_execute_data *execute_data = generator->execute_data;
+		/* Null out execute_data early, to prevent double frees if GC runs while we're
+		 * already cleaning up execute_data. */
+		generator->execute_data = NULL;

 		if (EX_CALL_INFO() & ZEND_CALL_HAS_SYMBOL_TABLE) {
 			zend_clean_and_cache_symbol_table(execute_data->symbol_table);
@@ -135,12 +140,12 @@ ZEND_API void zend_generator_close(zend_generator *generator, zend_bool finished
 			return;
 		}

-		zend_vm_stack_free_extra_args(generator->execute_data);
+		zend_vm_stack_free_extra_args(execute_data);

 		/* Some cleanups are only necessary if the generator was closed
 		 * before it could finish execution (reach a return statement). */
 		if (UNEXPECTED(!finished_execution)) {
-			zend_generator_cleanup_unfinished_execution(generator, 0);
+			zend_generator_cleanup_unfinished_execution(generator, execute_data, 0);
 		}

 		/* Free closure object */
@@ -154,8 +159,7 @@ ZEND_API void zend_generator_close(zend_generator *generator, zend_bool finished
 			generator->gc_buffer = NULL;
 		}

-		efree(generator->execute_data);
-		generator->execute_data = NULL;
+		efree(execute_data);
 	}
 }
 /* }}} */
@@ -216,7 +220,7 @@ static void zend_generator_dtor_storage(zend_object *object) /* {{{ */
 	if (finally_op_num) {
 		zval *fast_call;

-		zend_generator_cleanup_unfinished_execution(generator, finally_op_num);
+		zend_generator_cleanup_unfinished_execution(generator, ex, finally_op_num);

 		fast_call = ZEND_CALL_VAR(ex, ex->func->op_array.opcodes[finally_op_end].op1.var);
 		Z_OBJ_P(fast_call) = EG(exception);
@@ -1128,12 +1128,18 @@ ZEND_API int ZEND_FASTCALL pow_function(zval *result, zval *op1, zval *op2) /* {

 					if (EXPECTED(op1 != op2)) {
 						if (Z_TYPE_P(op1) == IS_ARRAY) {
+							if (op1 == result) {
+								zval_ptr_dtor(result);
+							}
 							ZVAL_LONG(result, 0);
 							return SUCCESS;
 						} else {
 							zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
 						}
 						if (Z_TYPE_P(op2) == IS_ARRAY) {
+							if (op1 == result) {
+								zval_ptr_dtor(result);
+							}
 							ZVAL_LONG(result, 1L);
 							return SUCCESS;
 						} else {
@@ -1141,6 +1147,9 @@ ZEND_API int ZEND_FASTCALL pow_function(zval *result, zval *op1, zval *op2) /* {
 						}
 					} else {
 						if (Z_TYPE_P(op1) == IS_ARRAY) {
+							if (op1 == result) {
+								zval_ptr_dtor(result);
+							}
 							ZVAL_LONG(result, 0);
 							return SUCCESS;
 						} else {
@@ -91,10 +91,10 @@ ZEND_API const char* ZEND_FASTCALL zend_memnstr_ex(const char *haystack, const c
 ZEND_API const char* ZEND_FASTCALL zend_memnrstr_ex(const char *haystack, const char *needle, size_t needle_len, const char *end);

 #if SIZEOF_ZEND_LONG == 4
-#	define ZEND_DOUBLE_FITS_LONG(d) (!((d) > ZEND_LONG_MAX || (d) < ZEND_LONG_MIN))
+#	define ZEND_DOUBLE_FITS_LONG(d) (!((d) > (double)ZEND_LONG_MAX || (d) < (double)ZEND_LONG_MIN))
 #else
 	/* >= as (double)ZEND_LONG_MAX is outside signed range */
-#	define ZEND_DOUBLE_FITS_LONG(d) (!((d) >= ZEND_LONG_MAX || (d) < ZEND_LONG_MIN))
+#	define ZEND_DOUBLE_FITS_LONG(d) (!((d) >= (double)ZEND_LONG_MAX || (d) < (double)ZEND_LONG_MIN))
 #endif

 #if ZEND_DVAL_TO_LVAL_CAST_OK
@@ -758,8 +758,10 @@ ZEND_VM_HANDLER(13, ZEND_BOOL_NOT, CONST|TMPVAR|CV, ANY)
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_FALSE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
+		/* The result and op1 can be the same cv zval */
+		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_TRUE(EX_VAR(opline->result.var));
-		if (OP1_TYPE == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
+		if (OP1_TYPE == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
 			SAVE_OPLINE();
 			GET_OP1_UNDEF_CV(val, BP_VAR_R);
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -3098,6 +3100,7 @@ ZEND_VM_HANDLER(113, ZEND_INIT_STATIC_METHOD_CALL, UNUSED|CLASS_FETCH|CONST|VAR,
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+				FREE_UNFETCHED_OP2();
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -4754,8 +4757,10 @@ ZEND_VM_HANDLER(52, ZEND_BOOL, CONST|TMPVAR|CV, ANY)
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_TRUE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
+		/* The result and op1 can be the same cv zval */
+		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_FALSE(EX_VAR(opline->result.var));
-		if (OP1_TYPE == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
+		if (OP1_TYPE == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
 			SAVE_OPLINE();
 			GET_OP1_UNDEF_CV(val, BP_VAR_R);
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -2653,8 +2653,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_BOOL_NOT_SPEC_CONST_HANDLER(ZE
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_FALSE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
+		/* The result and op1 can be the same cv zval */
+		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_TRUE(EX_VAR(opline->result.var));
-		if (IS_CONST == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
+		if (IS_CONST == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
 			SAVE_OPLINE();
 			GET_OP1_UNDEF_CV(val, BP_VAR_R);
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -3185,8 +3187,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_BOOL_SPEC_CONST_HANDLER(ZEND_O
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_TRUE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
+		/* The result and op1 can be the same cv zval */
+		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_FALSE(EX_VAR(opline->result.var));
-		if (IS_CONST == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
+		if (IS_CONST == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
 			SAVE_OPLINE();
 			GET_OP1_UNDEF_CV(val, BP_VAR_R);
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -5417,6 +5421,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_C
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -7378,6 +7383,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_C
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -9466,6 +9472,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_C
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -11488,6 +11495,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_C
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+				zval_ptr_dtor_nogc(EX_VAR(opline->op2.var));
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -19460,6 +19468,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_V
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -21259,6 +21268,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_V
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -23859,6 +23869,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_V
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -26359,6 +26370,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_V
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+				zval_ptr_dtor_nogc(EX_VAR(opline->op2.var));
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -28278,6 +28290,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_U
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -29055,6 +29068,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_U
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -30887,6 +30901,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_U
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -32602,6 +32617,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_U
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+				zval_ptr_dtor_nogc(EX_VAR(opline->op2.var));
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -32854,8 +32870,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_BOOL_NOT_SPEC_CV_HANDLER(ZEND_
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_FALSE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
+		/* The result and op1 can be the same cv zval */
+		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_TRUE(EX_VAR(opline->result.var));
-		if (IS_CV == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
+		if (IS_CV == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
 			SAVE_OPLINE();
 			GET_OP1_UNDEF_CV(val, BP_VAR_R);
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -33692,8 +33710,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_BOOL_SPEC_CV_HANDLER(ZEND_OPCO
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_TRUE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
+		/* The result and op1 can be the same cv zval */
+		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_FALSE(EX_VAR(opline->result.var));
-		if (IS_CV == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
+		if (IS_CV == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
 			SAVE_OPLINE();
 			GET_OP1_UNDEF_CV(val, BP_VAR_R);
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -48525,8 +48545,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_BOOL_NOT_SPEC_TMPVAR_HANDLER(Z
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_FALSE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
+		/* The result and op1 can be the same cv zval */
+		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_TRUE(EX_VAR(opline->result.var));
-		if ((IS_TMP_VAR|IS_VAR) == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
+		if ((IS_TMP_VAR|IS_VAR) == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
 			SAVE_OPLINE();
 			GET_OP1_UNDEF_CV(val, BP_VAR_R);
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -48789,8 +48811,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_BOOL_SPEC_TMPVAR_HANDLER(ZEND_
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_TRUE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
+		/* The result and op1 can be the same cv zval */
+		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_FALSE(EX_VAR(opline->result.var));
-		if ((IS_TMP_VAR|IS_VAR) == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
+		if ((IS_TMP_VAR|IS_VAR) == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
 			SAVE_OPLINE();
 			GET_OP1_UNDEF_CV(val, BP_VAR_R);
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -398,6 +398,8 @@ AC_DEFUN([PHP_EVAL_LIBLINE],[
        $2="[$]$2 -pthread"
      else
        PHP_RUN_ONCE(EXTRA_LDFLAGS, [$ac_i], [EXTRA_LDFLAGS="$EXTRA_LDFLAGS $ac_i"])
+        PHP_RUN_ONCE(EXTRA_LDFLAGS_PROGRAM, [$ac_i],
+            [EXTRA_LDFLAGS_PROGRAM="$EXTRA_LDFLAGS_PROGRAM $ac_i"])
      fi
    ;;
    -l*[)]
@@ -2219,7 +2221,8 @@ AC_DEFUN([PHP_SETUP_ICU],[

      ICU_LIBS=`$PKG_CONFIG --libs icu-uc icu-io icu-i18n`
      ICU_INCS=`$PKG_CONFIG --cflags-only-I icu-uc icu-io icu-i18n`
-      ICU_CXXFLAGS="-DU_USING_ICU_NAMESPACE=1"
+      ICU_CXXFLAGS=`$PKG_CONFIG --variable=CXXFLAGS icu-uc`
+      ICU_CXXFLAGS="$ICU_CXXFLAGS -DU_USING_ICU_NAMESPACE=1"

      AC_MSG_RESULT([found $ICU_VERSION])

@@ -107,8 +107,8 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=2
-PHP_RELEASE_VERSION=23
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=27
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -57,9 +57,9 @@ bc_str2num (bc_num *num, char *str, int scale)
  zero_int = FALSE;
  if ( (*ptr == '+') || (*ptr == '-'))  ptr++;  /* Sign */
  while (*ptr == '0') ptr++;			/* Skip leading zeros. */
-  while (isdigit((int)*ptr)) ptr++, digits++;	/* digits */
+  while (*ptr >= '0' && *ptr <= '9') ptr++, digits++;	/* digits */
  if (*ptr == '.') ptr++;			/* decimal point */
-  while (isdigit((int)*ptr)) ptr++, strscale++;	/* digits */
+  while (*ptr >= '0' && *ptr <= '9') ptr++, strscale++;	/* digits */
  if ((*ptr != '\0') || (digits+strscale == 0))
    {
      *num = bc_copy_num (BCG(_zero_));
@@ -0,0 +1,13 @@
+--TEST--
+Bug #78878 (Buffer underflow in bc_shift_addsub)
+--SKIPIF--
+<?php
+if (!extension_loaded('bcmath')) die('skip bcmath extension not available');
+?>
+--FILE--
+<?php
+print @bcmul("\xB26483605105519922841849335928742092", bcpowmod(2, 65535, -4e-4));
+?>
+--EXPECT--
+bc math warning: non-zero scale in modulus
+0
@@ -127,6 +127,11 @@ static void com_write_dimension(zval *object, zval *offset, zval *value)

 	obj = CDNO_FETCH(object);

+	if (offset == NULL) {
+		php_com_throw_exception(DISP_E_BADINDEX, "appending to variants is not supported");
+		return;
+	}
+
 	if (V_VT(&obj->v) == VT_DISPATCH) {
 		ZVAL_COPY_VALUE(&args[0], offset);
 		ZVAL_COPY_VALUE(&args[1], value);
@@ -0,0 +1,19 @@
+--TEST--
+Bug #78694 (Appending to a variant array causes segfault)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+?>
+--FILE--
+<?php
+foreach ([new com('WScript.Shell'), new variant([])] as $var) {
+    try {
+        $var[] = 42;
+    } catch (com_exception $ex) {
+        var_dump($ex->getMessage());
+    }
+}
+?>
+--EXPECT--
+string(38) "appending to variants is not supported"
+string(38) "appending to variants is not supported"
@@ -0,0 +1,34 @@
+--TEST--
+Bug #78775: TLS issues from HTTP request affecting other encrypted connections
+--SKIPIF--
+<?php
+if (!extension_loaded('curl')) die('skip Requires curl');
+if (getenv('SKIP_ONLINE_TESTS')) die('skip Online test');
+?>
+--FILE--
+<?php
+
+$sock = fsockopen("tls://google.com", 443);
+
+var_dump($sock);
+
+$handle = curl_init('https://self-signed.badssl.com/');
+curl_setopt_array(
+    $handle,
+    [
+        CURLOPT_RETURNTRANSFER => true,
+        CURLOPT_SSL_VERIFYPEER => true,
+    ]
+);
+
+var_dump(curl_exec($handle));
+curl_close($handle);
+
+fwrite($sock, "GET / HTTP/1.0\n\n");
+var_dump(fread($sock, 8));
+
+?>
+--EXPECTF--
+resource(%d) of type (stream)
+bool(false)
+string(8) "HTTP/1.0"
@@ -2925,7 +2925,7 @@ static int php_date_initialize_from_hash(php_date_obj **dateobj, HashTable *myht
 	timelib_tzinfo   *tzi;
 	php_timezone_obj *tzobj;

-	z_date = zend_hash_str_find(myht, "date", sizeof("data")-1);
+	z_date = zend_hash_str_find(myht, "date", sizeof("date")-1);
 	if (z_date && Z_TYPE_P(z_date) == IS_STRING) {
 		z_timezone_type = zend_hash_str_find(myht, "timezone_type", sizeof("timezone_type")-1);
 		if (z_timezone_type && Z_TYPE_P(z_timezone_type) == IS_LONG) {
@@ -4364,6 +4364,20 @@ static int php_date_interval_initialize_from_hash(zval **return_value, php_inter
 		} \
 	} while (0);

+#define PHP_DATE_INTERVAL_READ_PROPERTY_DAYS(member) \
+	do { \
+		zval *z_arg = zend_hash_str_find(myht, "days", sizeof("days") - 1); \
+		if (z_arg && Z_TYPE_P(z_arg) == IS_FALSE) { \
+			(*intobj)->diff->member = -99999; \
+		} else if (z_arg && Z_TYPE_P(z_arg) <= IS_STRING) { \
+			zend_string *str = zval_get_string(z_arg); \
+			DATE_A64I((*intobj)->diff->member, ZSTR_VAL(str)); \
+			zend_string_release(str); \
+		} else { \
+			(*intobj)->diff->member = -1LL; \
+		} \
+	} while (0);
+
 #define PHP_DATE_INTERVAL_READ_PROPERTY_DOUBLE(element, member, def) \
 	do { \
 		zval *z_arg = zend_hash_str_find(myht, element, sizeof(element) - 1); \
@@ -4392,7 +4406,7 @@ static int php_date_interval_initialize_from_hash(zval **return_value, php_inter
 	PHP_DATE_INTERVAL_READ_PROPERTY("weekday_behavior", weekday_behavior, int, -1)
 	PHP_DATE_INTERVAL_READ_PROPERTY("first_last_day_of", first_last_day_of, int, -1)
 	PHP_DATE_INTERVAL_READ_PROPERTY("invert", invert, int, 0);
-	PHP_DATE_INTERVAL_READ_PROPERTY_I64("days", days);
+	PHP_DATE_INTERVAL_READ_PROPERTY_DAYS(days);
 	PHP_DATE_INTERVAL_READ_PROPERTY("special_type", special.type, unsigned int, 0);
 	PHP_DATE_INTERVAL_READ_PROPERTY_I64("special_amount", special.amount);
 	PHP_DATE_INTERVAL_READ_PROPERTY("have_weekday_relative", have_weekday_relative, unsigned int, 0);
@@ -5157,7 +5171,7 @@ static HashTable *date_object_get_properties_period(zval *object) /* {{{ */

 	if (period_obj->start) {
 		php_date_obj *date_obj;
-		object_init_ex(&zv, date_ce_date);
+		object_init_ex(&zv, period_obj->start_ce);
 		date_obj = Z_PHPDATE_P(&zv);
 		date_obj->time = timelib_time_clone(period_obj->start);
 	} else {
@@ -5167,7 +5181,7 @@ static HashTable *date_object_get_properties_period(zval *object) /* {{{ */

 	if (period_obj->current) {
 		php_date_obj *date_obj;
-		object_init_ex(&zv, date_ce_date);
+		object_init_ex(&zv, period_obj->start_ce);
 		date_obj = Z_PHPDATE_P(&zv);
 		date_obj->time = timelib_time_clone(period_obj->current);
 	} else {
@@ -5177,7 +5191,7 @@ static HashTable *date_object_get_properties_period(zval *object) /* {{{ */

 	if (period_obj->end) {
 		php_date_obj *date_obj;
-		object_init_ex(&zv, date_ce_date);
+		object_init_ex(&zv, period_obj->start_ce);
 		date_obj = Z_PHPDATE_P(&zv);
 		date_obj->time = timelib_time_clone(period_obj->end);
 	} else {
@@ -5214,7 +5228,7 @@ static int php_date_period_initialize_from_hash(php_period_obj *period_obj, Hash

 	ht_entry = zend_hash_str_find(myht, "start", sizeof("start")-1);
 	if (ht_entry) {
-		if (Z_TYPE_P(ht_entry) == IS_OBJECT && Z_OBJCE_P(ht_entry) == date_ce_date) {
+		if (Z_TYPE_P(ht_entry) == IS_OBJECT && instanceof_function(Z_OBJCE_P(ht_entry), date_ce_interface)) {
 			php_date_obj *date_obj;
 			date_obj = Z_PHPDATE_P(ht_entry);
 			period_obj->start = timelib_time_clone(date_obj->time);
@@ -5228,7 +5242,7 @@ static int php_date_period_initialize_from_hash(php_period_obj *period_obj, Hash

 	ht_entry = zend_hash_str_find(myht, "end", sizeof("end")-1);
 	if (ht_entry) {
-		if (Z_TYPE_P(ht_entry) == IS_OBJECT && Z_OBJCE_P(ht_entry) == date_ce_date) {
+		if (Z_TYPE_P(ht_entry) == IS_OBJECT && instanceof_function(Z_OBJCE_P(ht_entry), date_ce_interface)) {
 			php_date_obj *date_obj;
 			date_obj = Z_PHPDATE_P(ht_entry);
 			period_obj->end = timelib_time_clone(date_obj->time);
@@ -5241,7 +5255,7 @@ static int php_date_period_initialize_from_hash(php_period_obj *period_obj, Hash

 	ht_entry = zend_hash_str_find(myht, "current", sizeof("current")-1);
 	if (ht_entry) {
-		if (Z_TYPE_P(ht_entry) == IS_OBJECT && Z_OBJCE_P(ht_entry) == date_ce_date) {
+		if (Z_TYPE_P(ht_entry) == IS_OBJECT && instanceof_function(Z_OBJCE_P(ht_entry), date_ce_interface)) {
 			php_date_obj *date_obj;
 			date_obj = Z_PHPDATE_P(ht_entry);
 			period_obj->current = timelib_time_clone(date_obj->time);
@@ -39,7 +39,7 @@ DateInterval Object
    [weekday_behavior] => 0
    [first_last_day_of] => 0
    [invert] => 0
-    [days] => 0
+    [days] => 
    [special_type] => 0
    [special_amount] => 0
    [have_weekday_relative] => 0
@@ -136,7 +136,7 @@ object(DatePeriod)#5 (6) {
    ["invert"]=>
    int(0)
    ["days"]=>
-    int(0)
+    bool(false)
    ["special_type"]=>
    int(0)
    ["special_amount"]=>
@@ -71,7 +71,7 @@ object(DateInterval)#2 (16) {
  ["invert"]=>
  int(0)
  ["days"]=>
-  int(0)
+  bool(false)
  ["special_type"]=>
  int(0)
  ["special_amount"]=>
@@ -0,0 +1,14 @@
+--TEST--
+Bug #70153 (\DateInterval incorrectly unserialized)
+--FILE--
+<?php
+$i1 = \DateInterval::createFromDateString('+1 month');
+$i2 = unserialize(serialize($i1));
+var_dump($i1->days, $i2->days);
+var_dump($i2->special_amount, $i2->special_amount);
+?>
+--EXPECT--
+bool(false)
+bool(false)
+int(0)
+int(0)
@@ -0,0 +1,16 @@
+--TEST--
+Bug #78751 (Serialising DatePeriod converts DateTimeImmutable)
+--FILE--
+<?php
+$oDay = new DateTimeImmutable('2019-10-25');
+$oDateInterval = DateInterval::createFromDateString('1 day');
+$oDays = new DatePeriod($oDay, $oDateInterval, $oDay->modify('+1 day'));
+$oDays = unserialize(serialize($oDays));
+var_dump(
+    $oDays->start instanceof DateTimeImmutable,
+    $oDays->end instanceof DateTimeImmutable
+);
+?>
+--EXPECT--
+bool(true)
+bool(true)
@@ -21,6 +21,6 @@ domdocumentloadxml_test_method.php
 --EXPECTF--
 Warning: DOMDocument::load%r(XML){0,1}%r(): Opening and ending tag mismatch: title line 5 and book %s

-Warning: DOMDocument::load%r(XML){0,1}%r(): expected '>' %s
+Warning: DOMDocument::load%r(XML){0,1}%r(): %rexpected '>'|Opening and ending tag mismatch: book line 5 and books%r %s

-Warning: DOMDocument::load%r(XML){0,1}%r(): Premature end of data in tag books %s
+Warning: DOMDocument::load%r(XML){0,1}%r(): %rPremature end of data in tag books|EndTag: '<\/' not found in Entity, line: 13%r %s
@@ -21,6 +21,6 @@ domdocumentload_test_method.php
 --EXPECTF--
 Warning: DOMDocument::load%r(XML){0,1}%r(): Opening and ending tag mismatch: title line 5 and book %s

-Warning: DOMDocument::load%r(XML){0,1}%r(): expected '>' %s
+Warning: DOMDocument::load%r(XML){0,1}%r(): %rexpected '>'|Opening and ending tag mismatch: book line 5 and books%r %s

-Warning: DOMDocument::load%r(XML){0,1}%r(): Premature end of data in tag books %s
+Warning: DOMDocument::load%r(XML){0,1}%r(): %rPremature end of data in tag books|EndTag: '<\/' not found%r %s
@@ -1002,7 +1002,6 @@ static tag_info_array tag_table_VND_PANASONIC = {
  { 0x0001, "Quality"},
  { 0x0002, "FirmwareVersion"},
  { 0x0003, "WhiteBalance"},
-  { 0x0004, "0x0004"},
  { 0x0007, "FocusMode"},
  { 0x000f, "AFMode"},
  { 0x001a, "ImageStabilization"},
@@ -1010,12 +1009,10 @@ static tag_info_array tag_table_VND_PANASONIC = {
  { 0x001f, "ShootingMode"},
  { 0x0020, "Audio"},
  { 0x0021, "DataDump"},
-  { 0x0022, "0x0022"},
  { 0x0023, "WhiteBalanceBias"},
  { 0x0024, "FlashBias"},
  { 0x0025, "InternalSerialNumber"},
  { 0x0026, "ExifVersion"},
-  { 0x0027, "0x0027"},
  { 0x0028, "ColorEffect"},
  { 0x0029, "TimeSincePowerOn"},
  { 0x002a, "BurstMode"},
@@ -1023,7 +1020,6 @@ static tag_info_array tag_table_VND_PANASONIC = {
  { 0x002c, "Contrast"},
  { 0x002d, "NoiseReduction"},
  { 0x002e, "SelfTimer"},
-  { 0x002f, "0x002f"},
  { 0x0030, "Rotation"},
  { 0x0031, "AFAssistLamp"},
  { 0x0032, "ColorMode"},
@@ -1090,7 +1086,6 @@ static tag_info_array tag_table_VND_PANASONIC = {
  { 0x00a3, "ClearRetouchValue"},
  { 0x00ab, "TouchAE"},
  { 0x0e00, "PrintIM"},
-  { 0x4449, "0x4449"},
  { 0x8000, "MakerNoteVersion"},
  { 0x8001, "SceneMode"},
  { 0x8004, "WBRedLevel"},
@@ -1125,22 +1120,20 @@ static tag_info_array tag_table_VND_SONY = {
  { 0x0112, "WhiteBalanceFineTune"},
  { 0x0114, "CameraSettings"},
  { 0x0115, "WhiteBalance"},
-  { 0x0116, "0x0116"},
+  { 0x0116, "ExtraInfo"},
  { 0x0e00, "PrintIM"},
  { 0x1000, "MultiBurstMode"},
  { 0x1001, "MultiBurstImageWidth"},
  { 0x1002, "MultiBurstImageHeight"},
  { 0x1003, "Panorama"},
-  { 0x2000, "0x2000"},
  { 0x2001, "PreviewImage"},
-  { 0x2002, "0x2002"},
-  { 0x2003, "0x2003"},
+  { 0x2002, "Rating"},
  { 0x2004, "Contrast"},
  { 0x2005, "Saturation"},
-  { 0x2006, "0x2006"},
-  { 0x2007, "0x2007"},
-  { 0x2008, "0x2008"},
-  { 0x2009, "0x2009"},
+  { 0x2006, "Sharpness"},
+  { 0x2007, "Brightness"},
+  { 0x2008, "LongExposureNoiseReduction"},
+  { 0x2009, "HighISONoiseReduction"},
  { 0x200a, "AutoHDR"},
  { 0x3000, "ShotInfo"},
  { 0xb000, "FileFormat"},
@@ -1167,8 +1160,9 @@ static tag_info_array tag_table_VND_SONY = {
  { 0xb049, "ReleaseMode"},
  { 0xb04a, "SequenceNumber"},
  { 0xb04b, "AntiBlur"},
-  { 0xb04e, "LongExposureNoiseReduction"},
+  { 0xb04e, "FocusMode"},
  { 0xb04f, "DynamicRangeOptimizer"},
+  { 0xb050, "HighISONoiseReduction2"},
  { 0xb052, "IntelligentAuto"},
  { 0xb054, "WhiteBalance2"},
  TAG_TABLE_END
@@ -1273,7 +1267,6 @@ static tag_info_array tag_table_VND_MINOLTA = {
  { 0x0100, "SceneMode"},
  { 0x0101, "ColorMode"},
  { 0x0102, "Quality"},
-  { 0x0103, "0x0103"},
  { 0x0104, "FlashExposureComp"},
  { 0x0105, "Teleconverter"},
  { 0x0107, "ImageStabilization"},
@@ -1369,6 +1362,7 @@ static const maker_note_type maker_note_array[] = {
  { tag_table_VND_PANASONIC, "Panasonic",               NULL, "Panasonic\x00\x00\x00",			 12, 12, MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
  { tag_table_VND_DJI,       "DJI",                     NULL, NULL,								 0, 0,   MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
  { tag_table_VND_SONY,      "SONY",                    NULL, "SONY DSC \x00\x00\x00",	         12, 12, MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
+  { tag_table_VND_SONY,      "SONY",                    NULL,								     0, 0,   MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
  { tag_table_VND_PENTAX,    "PENTAX",                  NULL, "AOC\x00",						 6,  6,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
  { tag_table_VND_MINOLTA,   "Minolta, KONICA MINOLTA", NULL, NULL,								 0,  0,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
  { tag_table_VND_SIGMA,     "SIGMA, FOVEON",           NULL, "SIGMA\x00\x00\x00",				 10, 10, MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
@@ -2328,14 +2322,11 @@ static void exif_iif_free(image_info_type *image_info, int section_index) {
 				efree(f);
 			}
 			switch(image_info->info_list[section_index].list[i].format) {
-				case TAG_FMT_SBYTE:
-				case TAG_FMT_BYTE:
-					/* in contrast to strings bytes do not need to allocate buffer for NULL if length==0 */
-					if (image_info->info_list[section_index].list[i].length<1)
-						break;
-				default:
 				case TAG_FMT_UNDEFINED:
 				case TAG_FMT_STRING:
+				case TAG_FMT_SBYTE:
+				case TAG_FMT_BYTE:
+				default:
 					if ((f=image_info->info_list[section_index].list[i].value.s) != NULL) {
 						efree(f);
 					}
@@ -3174,7 +3165,8 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 			continue;
 		if (maker_note->model && (!ImageInfo->model || strcmp(maker_note->model, ImageInfo->model)))
 			continue;
-		if (maker_note->id_string && strncmp(maker_note->id_string, value_ptr, maker_note->id_string_len))
+		if (maker_note->id_string && value_len >= maker_note->id_string_len
+				&& strncmp(maker_note->id_string, value_ptr, maker_note->id_string_len))
 			continue;
 		break;
 	}
@@ -3248,8 +3240,9 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 	}

 	for (de=0;de<NumDirEntries;de++) {
-		if (!exif_process_IFD_TAG(ImageInfo, dir_start + 2 + 12 * de,
-								  offset_base, data_len, displacement, section_index, 0, maker_note->tag_table)) {
+		size_t offset = 2 + 12 * de;
+		if (!exif_process_IFD_TAG(ImageInfo, dir_start + offset,
+								  offset_base, data_len - offset, displacement, section_index, 0, maker_note->tag_table)) {
 			return FALSE;
 		}
 	}
@@ -3262,6 +3255,14 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 }
 /* }}} */

+#define REQUIRE_NON_EMPTY() do { \
+	if (byte_count == 0) { \
+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Cannot be empty", tag, exif_get_tagname(tag, tagname, -12, tag_table)); \
+		return FALSE; \
+	} \
+} while (0)
+
+
 /* {{{ exif_process_IFD_TAG
 * Process one of the nested IFDs directories. */
 static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, char *offset_base, size_t IFDlength, size_t displacement, int section_index, int ReadNextIFD, tag_table_type tag_table)
@@ -3295,11 +3296,6 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 		/*return TRUE;*/
 	}

-	if (components <= 0) {
-		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal components(%d)", tag, exif_get_tagname(tag, tagname, -12, tag_table), components);
-		return FALSE;
-	}
-
 	byte_count_signed = (int64_t)components * php_tiff_bytes_per_format[format];

 	if (byte_count_signed < 0 || (byte_count_signed > INT32_MAX)) {
@@ -3379,8 +3375,12 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 	}
 #endif

+	/* NB: The following code may not assume that there is at least one component!
+	 * byte_count may be zero! */
+
 	if (section_index==SECTION_THUMBNAIL) {
 		if (!ImageInfo->Thumbnail.data) {
+			REQUIRE_NON_EMPTY();
 			switch(tag) {
 				case TAG_IMAGEWIDTH:
 				case TAG_COMP_IMAGE_WIDTH:
@@ -3424,6 +3424,9 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				if (byte_count>1 && (length=php_strnlen(value_ptr, byte_count)) > 0) {
 					if (length<byte_count-1) {
 						/* When there are any characters after the first NUL */
+						EFREE_IF(ImageInfo->CopyrightPhotographer);
+						EFREE_IF(ImageInfo->CopyrightEditor);
+						EFREE_IF(ImageInfo->Copyright);
 						ImageInfo->CopyrightPhotographer  = estrdup(value_ptr);
 						ImageInfo->CopyrightEditor        = estrndup(value_ptr+length+1, byte_count-length-1);
 						spprintf(&ImageInfo->Copyright, 0, "%s, %s", ImageInfo->CopyrightPhotographer, ImageInfo->CopyrightEditor);
@@ -3431,6 +3434,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 						/* but we are not supposed to change this                   */
 						/* keep in mind that image_info does not store editor value */
 					} else {
+						EFREE_IF(ImageInfo->Copyright);
 						ImageInfo->Copyright = estrndup(value_ptr, byte_count);
 					}
 				}
@@ -3459,6 +3463,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 			case TAG_FNUMBER:
 				/* Simplest way of expressing aperture, so I trust it the most.
 				   (overwrite previously computed value if there is one) */
+				REQUIRE_NON_EMPTY();
 				ImageInfo->ApertureFNumber = (float)exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel);
 				break;

@@ -3467,6 +3472,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				/* More relevant info always comes earlier, so only use this field if we don't
 				   have appropriate aperture information yet. */
 				if (ImageInfo->ApertureFNumber == 0) {
+					REQUIRE_NON_EMPTY();
 					ImageInfo->ApertureFNumber
 						= (float)exp(exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel)*log(2)*0.5);
 				}
@@ -3478,6 +3484,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				   SHUTTERSPEED comes after EXPOSURE TIME
 				  */
 				if (ImageInfo->ExposureTime == 0) {
+					REQUIRE_NON_EMPTY();
 					ImageInfo->ExposureTime
 						= (float)(1/exp(exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel)*log(2)));
 				}
@@ -3487,20 +3494,24 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				break;

 			case TAG_COMP_IMAGE_WIDTH:
+				REQUIRE_NON_EMPTY();
 				ImageInfo->ExifImageWidth = exif_convert_any_to_int(value_ptr, exif_rewrite_tag_format_to_unsigned(format), ImageInfo->motorola_intel);
 				break;

 			case TAG_FOCALPLANE_X_RES:
+				REQUIRE_NON_EMPTY();
 				ImageInfo->FocalplaneXRes = exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel);
 				break;

 			case TAG_SUBJECT_DISTANCE:
 				/* Inidcates the distacne the autofocus camera is focused to.
 				   Tends to be less accurate as distance increases. */
+				REQUIRE_NON_EMPTY();
 				ImageInfo->Distance = (float)exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel);
 				break;

 			case TAG_FOCALPLANE_RESOLUTION_UNIT:
+				REQUIRE_NON_EMPTY();
 				switch((int)exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel)) {
 					case 1: ImageInfo->FocalplaneUnits = 25.4; break; /* inch */
 					case 2:
@@ -3526,9 +3537,11 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				break;

 			case TAG_MAKE:
+				EFREE_IF(ImageInfo->make);
 				ImageInfo->make = estrndup(value_ptr, byte_count);
 				break;
 			case TAG_MODEL:
+				EFREE_IF(ImageInfo->model);
 				ImageInfo->model = estrndup(value_ptr, byte_count);
 				break;

@@ -3543,6 +3556,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 			case TAG_GPS_IFD_POINTER:
 			case TAG_INTEROP_IFD_POINTER:
 				if (ReadNextIFD) {
+					REQUIRE_NON_EMPTY();
 					char *Subdir_start;
 					int sub_section_index = 0;
 					switch(tag) {
@@ -3571,9 +3585,11 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 					Subdir_start = offset_base + php_ifd_get32u(value_ptr, ImageInfo->motorola_intel);
 					if (Subdir_start < offset_base || Subdir_start > offset_base+IFDlength) {
 						exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD Pointer");
+						EFREE_IF(outside);
 						return FALSE;
 					}
 					if (!exif_process_IFD_in_JPEG(ImageInfo, Subdir_start, offset_base, IFDlength, displacement, sub_section_index, tag)) {
+						EFREE_IF(outside);
 						return FALSE;
 					}
 #ifdef EXIF_DEBUG
@@ -4584,8 +4600,9 @@ PHP_FUNCTION(exif_read_data)
 		exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "CCDWidth", "%dmm", (int)ImageInfo.CCDWidth);
 	}
 	if(ImageInfo.ExposureTime>0) {
-		if(ImageInfo.ExposureTime <= 0.5) {
-			exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "ExposureTime", "%0.3F s (1/%d)", ImageInfo.ExposureTime, (int)(0.5 + 1/ImageInfo.ExposureTime));
+		float recip_exposure_time = 0.5f + 1.0f/ImageInfo.ExposureTime;
+		if (ImageInfo.ExposureTime <= 0.5 && recip_exposure_time < INT_MAX) {
+			exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "ExposureTime", "%0.3F s (1/%d)", ImageInfo.ExposureTime, (int) recip_exposure_time);
 		} else {
 			exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "ExposureTime", "%0.3F s", ImageInfo.ExposureTime);
 		}
@@ -4,9 +4,48 @@ Bug #68547 (Exif Header component value check error)
 <?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
 --FILE--
 <?php
-exif_read_data(__DIR__ . DIRECTORY_SEPARATOR . 'bug68547.jpg');
+var_dump(exif_read_data(__DIR__ . DIRECTORY_SEPARATOR . 'bug68547.jpg'));
 ?>
 ===DONE===
 --EXPECTF--
-Warning: exif_read_data(bug68547.jpg): Process tag(x9C9E=Keywords   ): Illegal components(%d) in %sbug68547.php on line %d
+array(12) {
+  ["FileName"]=>
+  string(12) "bug68547.jpg"
+  ["FileDateTime"]=>
+  int(%d)
+  ["FileSize"]=>
+  int(713)
+  ["FileType"]=>
+  int(2)
+  ["MimeType"]=>
+  string(10) "image/jpeg"
+  ["SectionsFound"]=>
+  string(20) "ANY_TAG, IFD0, WINXP"
+  ["COMPUTED"]=>
+  array(5) {
+    ["html"]=>
+    string(20) "width="1" height="1""
+    ["Height"]=>
+    int(1)
+    ["Width"]=>
+    int(1)
+    ["IsColor"]=>
+    int(1)
+    ["ByteOrderMotorola"]=>
+    int(0)
+  }
+  ["Subject"]=>
+  string(10) "Subjec??.."
+  ["Keywords"]=>
+  string(0) ""
+  ["Author"]=>
+  string(9) "Rui Carmo"
+  ["Comments"]=>
+  string(29) "Comments
+Line2
+Line3
+Line4"
+  ["Title"]=>
+  string(8) "Title..."
+}
 ===DONE===
@@ -39,7 +39,6 @@ print_r(exif_read_data(__DIR__.'/bug68799.jpg'));

 ?>
 --EXPECTF--
-Warning: exif_read_data(bug68799.jpg): Process tag(x9C9D=Author     ): Illegal components(%d) in %s on line %d
 Array
 (
    [FileName] => bug68799.jpg
@@ -47,7 +46,7 @@ Array
    [FileSize] => 735
    [FileType] => 2
    [MimeType] => image/jpeg
-    [SectionsFound] => ANY_TAG, IFD0
+    [SectionsFound] => ANY_TAG, IFD0, WINXP
    [COMPUTED] => Array
        (
            [html] => width="1" height="1"
@@ -60,4 +59,5 @@ Array
    [XResolution] => 96/1
    [YResolution] => 96/1
    [ResolutionUnit] => 2
+    [Author] => 
 )
@@ -47,7 +47,7 @@ Warning: exif_read_data(bug72094_3.jpg): Process tag(x3030=UndefinedTa): Illegal

 Warning: exif_read_data(bug72094_3.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d

-Warning: exif_read_data(bug72094_3.jpg): Process tag(x3030=UndefinedTa): Illegal components(%d) in %s%ebug72094.php on line %d
+Warning: exif_read_data(bug72094_3.jpg): Illegal IFD size in %s%ebug72094.php on line %d

 Warning: exif_read_data(bug72094_3.jpg): File structure corrupted in %s%ebug72094.php on line %d

@@ -8,7 +8,7 @@ Bug #73737 (Crash when parsing a tag format)
 	var_dump($exif);
 ?>
 --EXPECTF--
-Warning: exif_thumbnail(bug73737.tiff): Process tag(x0100=ImageWidth ): Illegal components(0) in %s on line %d
+Warning: exif_thumbnail(bug73737.tiff): Process tag(x0100=ImageWidth ): Cannot be empty in %s on line %d

 Warning: exif_thumbnail(bug73737.tiff): Error in TIFF: filesize(x0030) less than start of IFD dir(x10102) in %s line %d
 bool(false)
@@ -70,7 +70,7 @@ Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal f

 Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d

-Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal pointer offset(x30303030 + x30303030 = x60606060 > x00EE) in %sbug76557.php on line %d
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal pointer offset(x30303030 + x30303030 = x60606060 > %s) in %sbug76557.php on line %d

 Warning: exif_read_data(bug76557.jpg): File structure corrupted in %sbug76557.php on line %d

@@ -0,0 +1,12 @@
+--TEST--
+Bug #78793: Use-after-free in exif parsing under memory sanitizer
+--FILE--
+<?php
+$f = "ext/exif/tests/bug77950.tiff";
+for ($i = 0; $i < 10; $i++) {
+    @exif_read_data($f);
+}
+?>
+===DONE===
+--EXPECT--
+===DONE===
@@ -0,0 +1,17 @@
+--TEST--
+Bug #78910: Heap-buffer-overflow READ in exif (OSS-Fuzz #19044)
+--FILE--
+<?php
+
+var_dump(exif_read_data('data:image/jpg;base64,TU0AKgAAAAwgICAgAAIBDwAEAAAAAgAAACKSfCAgAAAAAEZVSklGSUxN'));
+
+?>
+--EXPECTF--
+Notice: exif_read_data(): Read from TIFF: tag(0x927C, MakerNote  ): Illegal format code 0x2020, switching to BYTE in %s on line %d
+
+Warning: exif_read_data(): Process tag(x927C=MakerNote  ): Illegal format code 0x2020, suppose BYTE in %s on line %d
+
+Warning: exif_read_data(): IFD data too short: 0x0000 offset 0x000C in %s on line %d
+
+Warning: exif_read_data(): Invalid TIFF file in %s on line %d
+bool(false)
@@ -0,0 +1,18 @@
+--TEST--
+OSS-Fuzz #17474: Memory leak on duplicate Copyright tags
+--SKIPIF--
+<?php
+if (!extension_loaded('exif')) {
+    die('skip exif extension not available');
+}
+?>
+--FILE--
+<?php
+
+// Only checking for an absence of leaks here.
+@exif_read_data(__DIR__ . '/duplicate_copyright_tag_leak.tiff');
+
+?>
+===DONE===
+--EXPECTF--
+===DONE===
@@ -0,0 +1,21 @@
+--TEST--
+OSS-Fuzz #17163: Out-of-bounds read due to tag with zero components
+--SKIPIF--
+<?php
+if (!extension_loaded('exif')) {
+    die('skip exif extension not available');
+}
+?>
+--FILE--
+<?php
+
+var_dump(exif_read_data(__DIR__ . '/tag_with_illegal_zero_components.jpeg'));
+
+?>
+--EXPECTF--
+Warning: exif_read_data(tag_with_illegal_zero_components.jpeg): Process tag(x0202=JPEGInterch): Cannot be empty in %s on line %d
+
+Warning: exif_read_data(tag_with_illegal_zero_components.jpeg): File structure corrupted in %s on line %d
+
+Warning: exif_read_data(tag_with_illegal_zero_components.jpeg): Invalid JPEG file in %s on line %d
+bool(false)
@@ -0,0 +1,16 @@
+--TEST--
+OSS-Fuzz: Temporary buffer leak in tag reading
+--SKIPIF--
+<?php
+if (!extension_loaded('exif')) {
+    die('skip exif extension not available');
+}
+?>
+--FILE--
+<?php
+
+var_dump(@exif_read_data(__DIR__ . '/temporary_buffer_leak.jpg'));
+
+?>
+--EXPECT--
+bool(false)
@@ -0,0 +1,17 @@
+--TEST--
+OSS-Fuzz: Memory leak for zero-length MAKERNOTE
+--SKIPIF--
+<?php
+if (!extension_loaded('exif')) {
+    die('skip exif extension not available');
+}
+?>
+--FILE--
+<?php
+
+@exif_read_data(__DIR__ . '/zero_length_makernote_leak.tiff');
+
+?>
+===DONE===
+--EXPECT--
+===DONE===
@@ -1011,8 +1011,9 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 				goto out;
 			}
 			nelements = CDF_GETUINT32(q, 1);
-			if (nelements == 0) {
-				DPRINTF(("CDF_VECTOR with nelements == 0\n"));
+			if (nelements > CDF_ELEMENT_LIMIT || nelements == 0) {
+				DPRINTF(("CDF_VECTOR with nelements == %"
+				    SIZE_T_FORMAT "u\n", nelements));
 				goto out;
 			}
 			slen = 2;
@@ -1054,8 +1055,6 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 					goto out;
 				inp += nelem;
 			}
-			DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n",
-			    nelements));
 			for (j = 0; j < nelements && i < sh.sh_properties;
 			    j++, i++)
 			{
@@ -50,6 +50,7 @@
 typedef int32_t cdf_secid_t;

 #define CDF_LOOP_LIMIT					10000
+#define CDF_ELEMENT_LIMIT				100000

 #define CDF_SECID_NULL					0
 #define CDF_SECID_FREE					-1
@@ -534,7 +534,7 @@ compress(int init_bits, gdIOCtxPtr outfile, gdImagePtr im, GifCtx *ctx)
    output( (code_int)ctx->ClearCode, ctx );

 #ifdef SIGNED_COMPARE_SLOW
-    while ( (c = GIFNextPixel( im )) != (unsigned) EOF ) {
+    while ( (c = GIFNextPixel( im, ctx )) != (unsigned) EOF ) {
 #else /*SIGNED_COMPARE_SLOW*/
    while ( (c = GIFNextPixel( im, ctx )) != EOF ) {  /* } */
 #endif /*SIGNED_COMPARE_SLOW*/
@@ -3,7 +3,7 @@ Bug #77198 (auto cropping has insufficient precision)
 --SKIPIF--
 <?php
 if (!extension_loaded('gd')) die('skip gd extension not available');
-if (!GD_BUNDLED) die('upstream bugfix has not been released');
+if (!GD_BUNDLED) die('skip upstream bugfix has not been released');
 ?>
 --FILE--
 <?php
@@ -3,7 +3,7 @@ Bug #77198 (threshold cropping has insufficient precision)
 --SKIPIF--
 <?php
 if (!extension_loaded('gd')) die('skip gd extension not available');
-if (!GD_BUNDLED) die('upstream bugfix has not been released');
+if (!GD_BUNDLED) die('skip upstream bugfix has not been released');
 ?>
 --FILE--
 <?php
@@ -3,7 +3,7 @@ Bug #77200 (imagecropauto(…, GD_CROP_SIDES) crops left but not right)
 --SKIPIF--
 <?php
 if (!extension_loaded('gd')) die('skip gd extension not available');
-if (!GD_BUNDLED) die('upstream bugfix has not been released');
+if (!GD_BUNDLED) die('skip upstream bugfix has not been released');
 ?>
 --FILE--
 <?php
@@ -286,7 +286,7 @@ PHP_MINIT_FUNCTION(miconv)
 	{
 		static char buf[16];
 		snprintf(buf, sizeof(buf), "%d.%d",
-		    ((_libiconv_version >> 8) & 0x0f), (_libiconv_version & 0x0f));
+			_libiconv_version >> 8, _libiconv_version & 0xff);
 		version = buf;
 	}
 #elif HAVE_GLIBC_ICONV
@@ -1292,7 +1292,7 @@ PHP_FUNCTION(locale_filter_matches)
 	if( boolCanonical ){
 		/* canonicalize loc_range */
 		can_loc_range=get_icu_value_internal( loc_range , LOC_CANONICALIZE_TAG , &result , 0);
-		if( result ==0) {
+		if( result <=0) {
 			intl_error_set( NULL, status,
 				"locale_filter_matches : unable to canonicalize loc_range" , 0 );
 			RETURN_FALSE;
@@ -1300,7 +1300,7 @@ PHP_FUNCTION(locale_filter_matches)

 		/* canonicalize lang_tag */
 		can_lang_tag = get_icu_value_internal( lang_tag , LOC_CANONICALIZE_TAG , &result ,  0);
-		if( result ==0) {
+		if( result <=0) {
 			intl_error_set( NULL, status,
 				"locale_filter_matches : unable to canonicalize lang_tag" , 0 );
 			RETURN_FALSE;
@@ -185,10 +185,10 @@ static HashTable *umsg_parse_format(MessageFormatter_object *mfo,

 		if (name_part.getType() == UMSGPAT_PART_TYPE_ARG_NAME) {
 			UnicodeString argName = mp.getSubstring(name_part);
-			if ((storedType = (Formattable::Type*)zend_hash_str_find_ptr(ret, (char*)argName.getBuffer(), argName.length())) == NULL) {
+			if ((storedType = (Formattable::Type*)zend_hash_str_find_ptr(ret, (char*)argName.getBuffer(), argName.length() * sizeof(UChar))) == NULL) {
 				/* not found already; create new entry in HT */
 				Formattable::Type bogusType = Formattable::kObject;
-				if ((storedType = (Formattable::Type*)zend_hash_str_update_mem(ret, (char*)argName.getBuffer(), argName.length(),
+				if ((storedType = (Formattable::Type*)zend_hash_str_update_mem(ret, (char*)argName.getBuffer(), argName.length() * sizeof(UChar),
 						(void*)&bogusType, sizeof(bogusType))) == NULL) {
 					intl_errors_set(&err, U_MEMORY_ALLOCATION_ERROR,
 						"Write to argument types hash table failed", 0);
@@ -450,7 +450,7 @@ U_CFUNC void umsg_format_helper(MessageFormatter_object *mfo,
 				continue;
 			}

-			storedArgType = (Formattable::Type*)zend_hash_str_find_ptr(types, (char*)key.getBuffer(), key.length());
+			storedArgType = (Formattable::Type*)zend_hash_str_find_ptr(types, (char*)key.getBuffer(), key.length() * sizeof(UChar));
 		}

 		if (storedArgType != NULL) {
@@ -0,0 +1,13 @@
+--TEST--
+Bug #78804: Segmentation fault in Locale::filterMatches
+--FILE--
+<?php
+
+if (Locale::filterMatches('en-US', 'und', true)) {
+    echo 'Matches';
+} else {
+    echo 'Not matches';
+}
+?>
+--EXPECT--
+Not matches
@@ -2,6 +2,7 @@
 grapheme()
 --SKIPIF--
 <?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?>
+<?php if (version_compare(INTL_ICU_VERSION, '65.0') >= 0) die('skip for ICU < 65.0'); ?>
 --FILE--
 <?php

@@ -3,6 +3,7 @@ locale_get_display_name() icu >= 64.0
 --SKIPIF--
 <?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?>
 <?php if (version_compare(INTL_ICU_VERSION, '64.0') < 0) die('skip for ICU >= 64.0'); ?>
+<?php if (version_compare(INTL_ICU_VERSION, '65.0') >= 0) die('skip for ICU < 65.0'); ?>
 --FILE--
 <?php

@@ -0,0 +1,342 @@
+--TEST--
+locale_get_display_name() icu >= 64.0
+--SKIPIF--
+<?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?>
+<?php if (version_compare(INTL_ICU_VERSION, '65.0') < 0) die('skip for ICU >= 65.0'); ?>
+--FILE--
+<?php
+
+/*
+ * Try getting the display_name for different locales
+ * with Procedural and Object methods.
+ */
+
+function ut_main()
+{
+    $res_str='';
+
+	$disp_locales=array('en','fr','de');
+
+    $locales = array(
+        'sl_IT_nedis_KIRTI',
+        'sl_IT_nedis-a-kirti-x-xyz',
+        'sl_IT_rozaj',
+        'sl_IT_NEDIS_ROJAZ_1901',
+        'i-enochian',
+        'zh-hakka',
+        'zh-wuu',
+        'i-tay',
+        'sgn-BE-nl',
+        'sgn-CH-de',
+        'sl_IT_rozaj@currency=EUR',
+        'uk-ua_CALIFORNIA@currency=;currency=GRN',
+        'root',
+        'uk@currency=EURO',
+        'Hindi',
+//Simple language subtag
+        'de',
+        'fr',
+        'ja',
+        'i-enochian', //(example of a grandfathered tag)
+//Language subtag plus Script subtag:
+        'zh-Hant',
+        'zh-Hans',
+        'sr-Cyrl',
+        'sr-Latn',
+//Language-Script-Region
+        'zh-Hans-CN',
+        'sr-Latn-CS',
+//Language-Variant
+        'sl-rozaj',
+        'sl-nedis',
+//Language-Region-Variant
+        'de-CH-1901',
+        'sl-IT-nedis',
+//Language-Script-Region-Variant
+        'sl-Latn-IT-nedis',
+//Language-Region:
+        'de-DE',
+        'en-US',
+        'es-419',
+//Private use subtags:
+        'de-CH-x-phonebk',
+        'az-Arab-x-AZE-derbend',
+//Extended language subtags
+        'zh-min',
+        'zh-min-nan-Hant-CN',
+//Private use registry values
+        'x-whatever',
+        'qaa-Qaaa-QM-x-southern',
+        'sr-Latn-QM',
+        'sr-Qaaa-CS',
+/*Tags that use extensions (examples ONLY: extensions MUST be defined
+   by revision or update to this document or by RFC): */
+        'en-US-u-islamCal',
+        'zh-CN-a-myExt-x-private',
+        'en-a-myExt-b-another',
+//Some Invalid Tags:
+        'de-419-DE',
+        'a-DE',
+        'ar-a-aaa-b-bbb-a-ccc'
+    );
+
+
+    $res_str = '';
+
+   	foreach( $locales as $locale )
+    {
+       	$res_str .= "locale='$locale'\n";
+   		foreach( $disp_locales as $disp_locale )
+    	{
+        	$scr = ut_loc_get_display_name( $locale ,$disp_locale );
+		$scr = str_replace(array('(', ')'), '#', $scr);
+        	$res_str .= "disp_locale=$disp_locale :  display_name=$scr";
+        	$res_str .= "\n";
+		}
+        $res_str .= "-----------------\n";
+    }
+
+    return $res_str;
+
+}
+
+include_once( 'ut_common.inc' );
+ut_run();
+
+?>
+--EXPECTREGEX--
+locale='sl_IT_nedis_KIRTI'
+disp_locale=en :  display_name=Slovenian #Italy, NEDIS_KIRTI#
+disp_locale=fr :  display_name=slovène #Italie, NEDIS_KIRTI#
+disp_locale=de :  display_name=Slowenisch #Italien, NEDIS_KIRTI#
+-----------------
+locale='sl_IT_nedis-a-kirti-x-xyz'
+disp_locale=en :  display_name=Slovenian #Italy, NEDIS_A_KIRTI_X_XYZ#
+disp_locale=fr :  display_name=slovène #Italie, NEDIS_A_KIRTI_X_XYZ#
+disp_locale=de :  display_name=Slowenisch #Italien, NEDIS_A_KIRTI_X_XYZ#
+-----------------
+locale='sl_IT_rozaj'
+disp_locale=en :  display_name=Slovenian #Italy, Resian#
+disp_locale=fr :  display_name=slovène #Italie, dialecte de Resia#
+disp_locale=de :  display_name=Slowenisch #Italien, (ROZAJ|Resianisch)#
+-----------------
+locale='sl_IT_NEDIS_ROJAZ_1901'
+disp_locale=en :  display_name=Slovenian #Italy, NEDIS_ROJAZ_1901#
+disp_locale=fr :  display_name=slovène #Italie, NEDIS_ROJAZ_1901#
+disp_locale=de :  display_name=Slowenisch #Italien, NEDIS_ROJAZ_1901#
+-----------------
+locale='i-enochian'
+disp_locale=en :  display_name=i-enochian #Private-Use=i-enochian#
+disp_locale=fr :  display_name=i-enochian #usage privé=i-enochian#
+disp_locale=de :  display_name=i-enochian #Privatnutzung=i-enochian#
+-----------------
+locale='zh-hakka'
+disp_locale=en :  display_name=Chinese( #HAKKA#)?
+disp_locale=fr :  display_name=chinois( #HAKKA#)?
+disp_locale=de :  display_name=Chinesisch( #HAKKA#)?
+-----------------
+locale='zh-wuu'
+disp_locale=en :  display_name=Chinese #WUU#
+disp_locale=fr :  display_name=chinois #WUU#
+disp_locale=de :  display_name=Chinesisch #WUU#
+-----------------
+locale='i-tay'
+disp_locale=en :  display_name=i-tay
+disp_locale=fr :  display_name=i-tay
+disp_locale=de :  display_name=i-tay
+-----------------
+locale='sgn-BE-nl'
+disp_locale=en :  display_name=sgn #Belgium, NL#
+disp_locale=fr :  display_name=sgn #Belgique, NL#
+disp_locale=de :  display_name=sgn #Belgien, NL#
+-----------------
+locale='sgn-CH-de'
+disp_locale=en :  display_name=sgn #Switzerland, DE#
+disp_locale=fr :  display_name=sgn #Suisse, DE#
+disp_locale=de :  display_name=sgn #Schweiz, DE#
+-----------------
+locale='sl_IT_rozaj@currency=EUR'
+disp_locale=en :  display_name=Slovenian #Italy, Resian, [Cc]urrency=Euro#
+disp_locale=fr :  display_name=slovène #Italie, dialecte de Resia, [Dd]evise=euro#
+disp_locale=de :  display_name=Slowenisch #Italien, (ROZAJ|Resianisch), Währung=Euro#
+-----------------
+locale='uk-ua_CALIFORNIA@currency=;currency=GRN'
+disp_locale=en :  display_name=
+disp_locale=fr :  display_name=
+disp_locale=de :  display_name=
+-----------------
+locale='root'
+disp_locale=en :  display_name=Unknown language
+disp_locale=fr :  display_name=langue indéterminée
+disp_locale=de :  display_name=Unbekannte Sprache
+-----------------
+locale='uk@currency=EURO'
+disp_locale=en :  display_name=Ukrainian #[Cc]urrency=EURO#
+disp_locale=fr :  display_name=ukrainien #[Dd]evise=EURO#
+disp_locale=de :  display_name=Ukrainisch #Währung=EURO#
+-----------------
+locale='Hindi'
+disp_locale=en :  display_name=hindi
+disp_locale=fr :  display_name=hindi
+disp_locale=de :  display_name=hindi
+-----------------
+locale='de'
+disp_locale=en :  display_name=German
+disp_locale=fr :  display_name=allemand
+disp_locale=de :  display_name=Deutsch
+-----------------
+locale='fr'
+disp_locale=en :  display_name=French
+disp_locale=fr :  display_name=français
+disp_locale=de :  display_name=Französisch
+-----------------
+locale='ja'
+disp_locale=en :  display_name=Japanese
+disp_locale=fr :  display_name=japonais
+disp_locale=de :  display_name=Japanisch
+-----------------
+locale='i-enochian'
+disp_locale=en :  display_name=i-enochian #Private-Use=i-enochian#
+disp_locale=fr :  display_name=i-enochian #usage privé=i-enochian#
+disp_locale=de :  display_name=i-enochian #Privatnutzung=i-enochian#
+-----------------
+locale='zh-Hant'
+disp_locale=en :  display_name=Chinese #Traditional#
+disp_locale=fr :  display_name=chinois #traditionnel#
+disp_locale=de :  display_name=Chinesisch #Traditionell#
+-----------------
+locale='zh-Hans'
+disp_locale=en :  display_name=Chinese #Simplified#
+disp_locale=fr :  display_name=chinois #simplifié#
+disp_locale=de :  display_name=Chinesisch #Vereinfacht#
+-----------------
+locale='sr-Cyrl'
+disp_locale=en :  display_name=Serbian #Cyrillic#
+disp_locale=fr :  display_name=serbe #cyrillique#
+disp_locale=de :  display_name=Serbisch #Kyrillisch#
+-----------------
+locale='sr-Latn'
+disp_locale=en :  display_name=Serbian #Latin#
+disp_locale=fr :  display_name=serbe #latin#
+disp_locale=de :  display_name=Serbisch #Lateinisch#
+-----------------
+locale='zh-Hans-CN'
+disp_locale=en :  display_name=Chinese #Simplified, China#
+disp_locale=fr :  display_name=chinois #simplifié, Chine#
+disp_locale=de :  display_name=Chinesisch #Vereinfacht, China#
+-----------------
+locale='sr-Latn-CS'
+disp_locale=en :  display_name=Serbian #Latin, Serbia#
+disp_locale=fr :  display_name=serbe #latin, Serbie#
+disp_locale=de :  display_name=Serbisch #Lateinisch, Serbien#
+-----------------
+locale='sl-rozaj'
+disp_locale=en :  display_name=Slovenian #Resian#
+disp_locale=fr :  display_name=slovène #dialecte de Resia#
+disp_locale=de :  display_name=Slowenisch( #(ROZAJ|Resianisch)#)?
+-----------------
+locale='sl-nedis'
+disp_locale=en :  display_name=Slovenian #Natisone dialect#
+disp_locale=fr :  display_name=slovène #dialecte de Natisone#
+disp_locale=de :  display_name=Slowenisch #Natisone-Dialekt#
+-----------------
+locale='de-CH-1901'
+disp_locale=en :  display_name=German #Switzerland, Traditional German orthography#
+disp_locale=fr :  display_name=allemand #Suisse, orthographe allemande traditionnelle#
+disp_locale=de :  display_name=Deutsch #Schweiz, (1901|[aA]lte deutsche Rechtschreibung)#
+-----------------
+locale='sl-IT-nedis'
+disp_locale=en :  display_name=Slovenian #Italy, Natisone dialect#
+disp_locale=fr :  display_name=slovène #Italie, dialecte de Natisone#
+disp_locale=de :  display_name=Slowenisch #Italien, (NEDIS|Natisone-Dialekt)#
+-----------------
+locale='sl-Latn-IT-nedis'
+disp_locale=en :  display_name=Slovenian #Latin, Italy, Natisone dialect#
+disp_locale=fr :  display_name=slovène #latin, Italie, dialecte de Natisone#
+disp_locale=de :  display_name=Slowenisch #Lateinisch, Italien, (NEDIS|Natisone-Dialekt)#
+-----------------
+locale='de-DE'
+disp_locale=en :  display_name=German #Germany#
+disp_locale=fr :  display_name=allemand #Allemagne#
+disp_locale=de :  display_name=Deutsch #Deutschland#
+-----------------
+locale='en-US'
+disp_locale=en :  display_name=English #United States#
+disp_locale=fr :  display_name=anglais #États-Unis#
+disp_locale=de :  display_name=Englisch #Vereinigte Staaten#
+-----------------
+locale='es-419'
+disp_locale=en :  display_name=Spanish #Latin America#
+disp_locale=fr :  display_name=espagnol #Amérique latine#
+disp_locale=de :  display_name=Spanisch #Lateinamerika#
+-----------------
+locale='de-CH-x-phonebk'
+disp_locale=en :  display_name=German #Switzerland, Private-Use=phonebk#
+disp_locale=fr :  display_name=allemand #Suisse, usage privé=phonebk#
+disp_locale=de :  display_name=Deutsch #Schweiz, Privatnutzung=phonebk#
+-----------------
+locale='az-Arab-x-AZE-derbend'
+disp_locale=en :  display_name=Azerbaijani #Arabic, Private-Use=aze-derbend#
+disp_locale=fr :  display_name=azéri #arabe, usage privé=aze-derbend#
+disp_locale=de :  display_name=Aserbaidschanisch #Arabisch, Privatnutzung=aze-derbend#
+-----------------
+locale='zh-min'
+disp_locale=en :  display_name=Chinese #MIN#
+disp_locale=fr :  display_name=chinois #MIN#
+disp_locale=de :  display_name=Chinesisch #MIN#
+-----------------
+locale='zh-min-nan-Hant-CN'
+disp_locale=en :  display_name=Chinese #MIN, NAN_HANT_CN#
+disp_locale=fr :  display_name=chinois #MIN, NAN_HANT_CN#
+disp_locale=de :  display_name=Chinesisch #MIN, NAN_HANT_CN#
+-----------------
+locale='x-whatever'
+disp_locale=en :  display_name=x-whatever #Private-Use=whatever#
+disp_locale=fr :  display_name=x-whatever #usage privé=whatever#
+disp_locale=de :  display_name=x-whatever #Privatnutzung=whatever#
+-----------------
+locale='qaa-Qaaa-QM-x-southern'
+disp_locale=en :  display_name=qaa #Qaaa, QM, Private-Use=southern#
+disp_locale=fr :  display_name=qaa #Qaaa, QM, usage privé=southern#
+disp_locale=de :  display_name=qaa #Qaaa, QM, Privatnutzung=southern#
+-----------------
+locale='sr-Latn-QM'
+disp_locale=en :  display_name=Serbian #Latin, QM#
+disp_locale=fr :  display_name=serbe #latin, QM#
+disp_locale=de :  display_name=Serbisch #Lateinisch, QM#
+-----------------
+locale='sr-Qaaa-CS'
+disp_locale=en :  display_name=Serbian #Qaaa, Serbia#
+disp_locale=fr :  display_name=serbe #Qaaa, Serbie#
+disp_locale=de :  display_name=Serbisch #Qaaa, Serbien#
+-----------------
+locale='en-US-u-islamCal'
+disp_locale=en :  display_name=English #United States, attribute=islamcal#
+disp_locale=fr :  display_name=anglais #États-Unis, attribute=islamcal#
+disp_locale=de :  display_name=Englisch #Vereinigte Staaten, attribute=islamcal#
+-----------------
+locale='zh-CN-a-myExt-x-private'
+disp_locale=en :  display_name=Chinese #China, a=myext, Private-Use=private#
+disp_locale=fr :  display_name=chinois #Chine, a=myext, usage privé=private#
+disp_locale=de :  display_name=Chinesisch #China, a=myext, Privatnutzung=private#
+-----------------
+locale='en-a-myExt-b-another'
+disp_locale=en :  display_name=English #a=myext, b=another#
+disp_locale=fr :  display_name=anglais #a=myext, b=another#
+disp_locale=de :  display_name=Englisch #a=myext, b=another#
+-----------------
+locale='de-419-DE'
+disp_locale=en :  display_name=German #Latin America, DE#
+disp_locale=fr :  display_name=allemand #Amérique latine, DE#
+disp_locale=de :  display_name=Deutsch #Lateinamerika, DE#
+-----------------
+locale='a-DE'
+disp_locale=en :  display_name=a #Germany#
+disp_locale=fr :  display_name=a #Allemagne#
+disp_locale=de :  display_name=a #Deutschland#
+-----------------
+locale='ar-a-aaa-b-bbb-a-ccc'
+disp_locale=en :  display_name=Arabic #a=aaa, b=bbb#
+disp_locale=fr :  display_name=arabe #a=aaa, b=bbb#
+disp_locale=de :  display_name=Arabisch #a=aaa, b=bbb#
+-----------------
@@ -3,6 +3,7 @@ Bug #76777 (first parameter of libxml_set_external_entity_loader callback undefi
 --SKIPIF--
 <?php
 if (!extension_loaded('libxml')) die('skip');
+if (!extension_loaded('dom')) die('skip dom extension not available');
 if (getenv("SKIP_ONLINE_TESTS")) die('skip online test');
 ?>
 --FILE--
@@ -138,6 +138,17 @@ static unsigned short cp950_pua_tbl[][4] = {
 	{0xf70f,0xf848,0xc740,0xc8fe},
 };

+static inline int is_in_cp950_pua(int c1, int c) {
+	if ((c1 >= 0xfa && c1 <= 0xfe) || (c1 >= 0x8e && c1 <= 0xa0) ||
+			(c1 >= 0x81 && c1 <= 0x8d) || (c1 >= 0xc7 && c1 <= 0xc8)) {
+		return (c >=0x40 && c <= 0x7e) || (c >= 0xa1 && c <= 0xfe);
+	}
+	if (c1 == 0xc6) {
+		return c >= 0xa1 && c <= 0xfe;
+	}
+	return 0;
+}
+
 /*
 * Big5 => wchar
 */
@@ -186,11 +197,7 @@ mbfl_filt_conv_big5_wchar(int c, mbfl_convert_filter *filter)

 			if (filter->from->no_encoding == mbfl_no_encoding_cp950) {
 				/* PUA for CP950 */
-				if (w <= 0 &&
-					(((c1 >= 0xfa && c1 <= 0xfe) || (c1 >= 0x8e && c1 <= 0xa0) ||
-					  (c1 >= 0x81 && c1 <= 0x8d) ||(c1 >= 0xc7 && c1 <= 0xc8))
-					 && ((c > 0x39 && c < 0x7f) || (c > 0xa0 && c < 0xff))) ||
-					((c1 == 0xc6) && (c > 0xa0 && c < 0xff))) {
+				if (w <= 0 && is_in_cp950_pua(c1, c)) {
 					c2 = c1 << 8 | c;
 					for (k = 0; k < sizeof(cp950_pua_tbl)/(sizeof(unsigned short)*4); k++) {
 						if (c2 >= cp950_pua_tbl[k][2] && c2 <= cp950_pua_tbl[k][3]) {
@@ -414,6 +414,7 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_mb_decode_numericentity, 0, 0, 2)
 	ZEND_ARG_INFO(0, string)
 	ZEND_ARG_INFO(0, convmap)
 	ZEND_ARG_INFO(0, encoding)
+	ZEND_ARG_INFO(0, is_hex)
 ZEND_END_ARG_INFO()

 ZEND_BEGIN_ARG_INFO_EX(arginfo_mb_send_mail, 0, 0, 3)
@@ -5026,27 +5027,15 @@ PHP_FUNCTION(mb_check_encoding)
 		RETURN_FALSE;
 	}

-	switch(Z_TYPE_P(input)) {
-		case IS_LONG:
-		case IS_DOUBLE:
-		case IS_NULL:
-		case IS_TRUE:
-		case IS_FALSE:
-			RETURN_TRUE;
-			break;
-		case IS_STRING:
-			if (!php_mb_check_encoding(Z_STRVAL_P(input), Z_STRLEN_P(input), enc ? ZSTR_VAL(enc): NULL)) {
-				RETURN_FALSE;
-			}
-			break;
-		case IS_ARRAY:
-			if (!php_mb_check_encoding_recursive(HASH_OF(input), enc)) {
-				RETURN_FALSE;
-			}
-			break;
-		default:
-			php_error_docref(NULL, E_WARNING, "Input is something other than scalar or array");
+	if (Z_TYPE_P(input) == IS_ARRAY) {
+		if (!php_mb_check_encoding_recursive(HASH_OF(input), enc)) {
 			RETURN_FALSE;
+		}
+	} else {
+		convert_to_string(input);
+		if (!php_mb_check_encoding(Z_STRVAL_P(input), Z_STRLEN_P(input), enc ? ZSTR_VAL(enc): NULL)) {
+			RETURN_FALSE;
+		}
 	}
 	RETURN_TRUE;
 }
@@ -0,0 +1,20 @@
+--TEST--
+Bug #78609 (mb_check_encoding() no longer supports stringable objects)
+--SKIPIF--
+<?php
+if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
+?>
+--FILE--
+<?php
+class Foo
+{
+    public function __toString()
+    {
+        return 'string_representation';
+    }
+}
+
+var_dump(mb_check_encoding(new Foo, 'UTF-8'));
+?>
+--EXPECT--
+bool(true)
@@ -0,0 +1,10 @@
+--TEST--
+Bug #79037: global buffer-overflow in `mbfl_filt_conv_big5_wchar`
+--FILE--
+<?php
+
+var_dump(mb_convert_encoding("\x81\x3a", "UTF-8", "CP950"));
+
+?>
+--EXPECT--
+string(1) "?"
@@ -61,10 +61,12 @@ void mysqli_common_connect(INTERNAL_FUNCTION_PARAMETERS, zend_bool is_real_conne
 	MY_MYSQL			*mysql = NULL;
 	MYSQLI_RESOURCE		*mysqli_resource = NULL;
 	zval				*object = getThis();
-	char				*hostname = NULL, *username=NULL, *passwd=NULL, *dbname=NULL, *socket=NULL;
-	size_t					hostname_len = 0, username_len = 0, passwd_len = 0, dbname_len = 0, socket_len = 0;
-	zend_bool			persistent = FALSE;
-	zend_long				port = 0, flags = 0;
+	char				*hostname = NULL, *username=NULL, *passwd=NULL, *dbname=NULL, *socket=NULL,
+						*ssl_key = NULL, *ssl_cert = NULL, *ssl_ca = NULL, *ssl_capath = NULL,
+						*ssl_cipher = NULL;
+	size_t				hostname_len = 0, username_len = 0, passwd_len = 0, dbname_len = 0, socket_len = 0;
+	zend_bool			persistent = FALSE, ssl = FALSE;
+	zend_long			port = 0, flags = 0;
 	zend_string			*hash_key = NULL;
 	zend_bool			new_connection = FALSE;
 	zend_resource		*le;
@@ -189,6 +191,33 @@ void mysqli_common_connect(INTERNAL_FUNCTION_PARAMETERS, zend_bool is_real_conne

 								goto end;
 							} else {
+#ifdef MYSQLI_USE_MYSQLND
+								if (mysql->mysql->data->vio->data->ssl) {
+									/* copy over pre-existing ssl settings so we can reuse them when reconnecting */
+									ssl = TRUE;
+
+									ssl_key = my_estrdup(mysql->mysql->data->vio->data->options.ssl_key);
+									ssl_cert = my_estrdup(mysql->mysql->data->vio->data->options.ssl_cert);
+									ssl_ca = my_estrdup(mysql->mysql->data->vio->data->options.ssl_ca);
+									ssl_capath = my_estrdup(mysql->mysql->data->vio->data->options.ssl_capath);
+									ssl_cipher = my_estrdup(mysql->mysql->data->vio->data->options.ssl_cipher);
+								}
+#else
+								if (mysql->mysql->options.ssl_key
+										|| mysql->mysql->options.ssl_cert
+										|| mysql->mysql->options.ssl_ca
+										|| mysql->mysql->options.ssl_capath
+										|| mysql->mysql->options.ssl_cipher) {
+									/* copy over pre-existing ssl settings so we can reuse them when reconnecting */
+									ssl = TRUE;
+
+									ssl_key = my_estrdup(mysql->mysql->options.ssl_key);
+									ssl_cert = my_estrdup(mysql->mysql->options.ssl_cert);
+									ssl_ca = my_estrdup(mysql->mysql->options.ssl_ca);
+									ssl_capath = my_estrdup(mysql->mysql->options.ssl_capath);
+									ssl_cipher = my_estrdup(mysql->mysql->options.ssl_cipher);
+								}
+#endif
 								mysqli_close(mysql->mysql, MYSQLI_CLOSE_IMPLICIT);
 								mysql->mysql = NULL;
 							}
@@ -241,8 +270,28 @@ void mysqli_common_connect(INTERNAL_FUNCTION_PARAMETERS, zend_bool is_real_conne
 	/* BC for prior to bug fix #53425 */
 	flags |= CLIENT_MULTI_RESULTS;

+	if (ssl) {
+		/* if we're here, this means previous conn was ssl, repopulate settings */
+		mysql_ssl_set(mysql->mysql, ssl_key, ssl_cert, ssl_ca, ssl_capath, ssl_cipher);
+
+		my_efree(ssl_key);
+		my_efree(ssl_cert);
+		my_efree(ssl_ca);
+		my_efree(ssl_capath);
+		my_efree(ssl_cipher);
+	}
 	if (mysql_real_connect(mysql->mysql, hostname, username, passwd, dbname, port, socket, flags) == NULL)
 #else
+	if (ssl) {
+		/* if we're here, this means previous conn was ssl, repopulate settings */
+		mysql_ssl_set(mysql->mysql, ssl_key, ssl_cert, ssl_ca, ssl_capath, ssl_cipher);
+
+		my_efree(ssl_key);
+		my_efree(ssl_cert);
+		my_efree(ssl_ca);
+		my_efree(ssl_capath);
+		my_efree(ssl_cipher);
+	}
 	if (mysqlnd_connect(mysql->mysql, hostname, username, passwd, passwd_len, dbname, dbname_len,
 						port, socket, flags, MYSQLND_CLIENT_KNOWS_RSET_COPY_DATA) == NULL)
 #endif
@@ -7,10 +7,10 @@ mysqli autocommit/commit/rollback with innodb

 	require_once('connect.inc');
 	if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
-		die(sprintf("Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));
+		die(sprintf("skip Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));

 	if (!have_innodb($link))
-		die(sprintf("Needs InnoDB support, [%d] %s", $link->errno, $link->error));
+		die(sprintf("skip Needs InnoDB support, [%d] %s", $link->errno, $link->error));
 ?>
 --FILE--
 <?php
@@ -97,7 +97,7 @@ object(mysqli_stmt)#%d (%d) {
  ["sqlstate"]=>
  string(5) "00000"
  ["id"]=>
-  int(3)
+  int(%d)
 }
 bool(true)
 bool(false)
@@ -13,7 +13,7 @@ mysqli_autocommit()
 	}

 	if (!have_innodb($link))
-		die(sprintf("Needs InnoDB support, [%d] %s", $link->errno, $link->error));
+		die(sprintf("skip Needs InnoDB support, [%d] %s", $link->errno, $link->error));
 ?>
 --FILE--
 <?php
@@ -14,7 +14,7 @@ mysqli->autocommit()
 	}

 	if (!have_innodb($link))
-		die(sprintf("Needs InnoDB support, [%d] %s", $link->errno, $link->error));
+		die(sprintf("skip Needs InnoDB support, [%d] %s", $link->errno, $link->error));
 ?>
 --FILE--
 <?php
@@ -8,10 +8,10 @@ require_once('skipifconnectfailure.inc');

 require_once('connect.inc');
 if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
-	die(sprintf("Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));
+	die(sprintf("skip Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));

 if (!have_innodb($link))
-	die(sprintf("Needs InnoDB support, [%d] %s", $link->errno, $link->error));
+	die(sprintf("skip Needs InnoDB support, [%d] %s", $link->errno, $link->error));
 ?>
 --FILE--
 <?php
@@ -7,10 +7,10 @@ require_once('skipifemb.inc');
 require_once('skipifconnectfailure.inc');
 require_once('connect.inc');
 if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
-	die(sprintf("Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));
+	die(sprintf("skip Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));

 if (!have_innodb($link))
-	die(sprintf("Needs InnoDB support, [%d] %s", $link->errno, $link->error));
+	die(sprintf("skip Needs InnoDB support, [%d] %s", $link->errno, $link->error));
 ?>
 --FILE--
 <?php
@@ -8,10 +8,10 @@ require_once('skipifconnectfailure.inc');

 require_once('connect.inc');
 if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
-	die(sprintf("Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));
+	die(sprintf("skip Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));

 if (!have_innodb($link))
-	die(sprintf("Needs InnoDB support, [%d] %s", $link->errno, $link->error));
+	die(sprintf("skip Needs InnoDB support, [%d] %s", $link->errno, $link->error));
 ?>
 --FILE--
 <?php
@@ -8,10 +8,10 @@ require_once('skipifconnectfailure.inc');

 require_once('connect.inc');
 if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
-	die(sprintf("Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));
+	die(sprintf("skip Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));

 if (!have_innodb($link))
-	die(sprintf("Needs InnoDB support, [%d] %s", $link->errno, $link->error));
+	die(sprintf("skip Needs InnoDB support, [%d] %s", $link->errno, $link->error));
 ?>
 --FILE--
 <?php
@@ -14,10 +14,10 @@ if (!function_exists('posix_getpid'))

 require_once('connect.inc');
 if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
-	die(sprintf("Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));
+	die(sprintf("skip Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));

 if (!have_innodb($link))
-	die(sprintf("Needs InnoDB support, [%d] %s", $link->errno, $link->error));
+	die(sprintf("skip Needs InnoDB support, [%d] %s", $link->errno, $link->error));
 ?>
 --FILE--
 <?php
@@ -8,10 +8,10 @@ require_once('skipifconnectfailure.inc');

 require_once('connect.inc');
 if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
-	die(sprintf("Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));
+	die(sprintf("skip Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));

 if (!have_innodb($link))
-	die(sprintf("Needs InnoDB support, [%d] %s", $link->errno, $link->error));
+	die(sprintf("skip Needs InnoDB support, [%d] %s", $link->errno, $link->error));
 ?>
 --FILE--
 <?php
@@ -10,10 +10,10 @@ mysqli_rollback()

 	require_once('connect.inc');
 	if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
-		die(sprintf("Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));
+		die(sprintf("skip Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));

 	if (!have_innodb($link))
-		die(sprintf("Needs InnoDB support, [%d] %s", $link->errno, $link->error));
+		die(sprintf("skip Needs InnoDB support, [%d] %s", $link->errno, $link->error));
 ?>
 --FILE--
 <?php
@@ -8,10 +8,10 @@ require_once('skipifconnectfailure.inc');

 require_once('connect.inc');
 if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
-	die(sprintf("Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));
+	die(sprintf("skip Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));

 if (!have_innodb($link))
-	die(sprintf("Needs InnoDB support, [%d] %s", $link->errno, $link->error));
+	die(sprintf("skip Needs InnoDB support, [%d] %s", $link->errno, $link->error));
 ?>
 --FILE--
 <?php
@@ -97,7 +97,7 @@ memory_limit=256M
 	require_once("clean_table.inc");
 ?>
 --EXPECTF--
-int(1)
+int(%d)
 executing
 bool(true)
 done!
@@ -302,7 +302,8 @@ static inline zend_bool can_elide_return_type_check(
 		return 0;
 	}

-	if (ZEND_TYPE_CODE(info->type) == IS_CALLABLE) {
+	/* These types are not represented exactly */
+	if (ZEND_TYPE_CODE(info->type) == IS_CALLABLE || ZEND_TYPE_CODE(info->type) == IS_ITERABLE) {
 		return 0;
 	}

@@ -685,7 +685,7 @@ static const func_info_t func_infos[] = {
 	F1("stream_get_transports",        MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_LONG | MAY_BE_ARRAY_OF_STRING),
 	F1("stream_resolve_include_path",  MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_STRING),
 	F0("stream_is_local",              MAY_BE_FALSE | MAY_BE_TRUE),
-	F1("get_headers",                  MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_LONG | MAY_BE_ARRAY_OF_STRING | MAY_BE_ARRAY_OF_ARRAY),
+	F1("get_headers",                  MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_STRING | MAY_BE_ARRAY_OF_ARRAY),
 #if HAVE_SYS_TIME_H || defined(PHP_WIN32)
 	F0("stream_set_timeout",           MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_TRUE),
 	F0("socket_set_timeout",           MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_TRUE),
@@ -1215,7 +1215,7 @@ uint32_t zend_get_func_info(const zend_call_info *call_info, const zend_ssa *ssa
 	if (call_info->callee_func->type == ZEND_INTERNAL_FUNCTION) {
 		func_info_t *info;

-		if ((info = zend_hash_find_ptr(&func_info, Z_STR_P(CRT_CONSTANT_EX(call_info->caller_op_array, call_info->caller_init_opline->op2, ssa->rt_constants)))) != NULL) {
+		if (!call_info->callee_func->common.scope && (info = zend_hash_find_ptr(&func_info, Z_STR_P(CRT_CONSTANT_EX(call_info->caller_op_array, call_info->caller_init_opline->op2, ssa->rt_constants)))) != NULL) {
 			if (UNEXPECTED(zend_optimizer_is_disabled_func(info->name, info->name_len))) {
 				ret = MAY_BE_NULL;
 			} else if (info->info_func) {
@@ -0,0 +1,34 @@
+--TEST--
+$v = !$v/(bool)$v checks for undefined variables
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_cache_only=0
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+function undef_negation() {
+    echo "In undef_negation\n";
+    $v = !$v;
+    var_export($v);
+    echo "\n";
+}
+function undef_bool_cast() {
+    echo "In undef_bool_cast\n";
+    $v = (bool)$v;
+    var_export($v);
+    echo "\n";
+}
+undef_negation();
+undef_bool_cast();
+?>
+--EXPECTF--
+In undef_negation
+
+Notice: Undefined variable: v in %s on line 4
+true
+In undef_bool_cast
+
+Notice: Undefined variable: v in %s on line 10
+false
@@ -0,0 +1,14 @@
+--TEST--
+Internal static methods should not be confused with global functions
+--SKIPIF--
+<?php
+if (!extension_loaded('zend-test')) die('skip requires zend-test');
+?>
+--FILE--
+<?php
+
+var_dump(is_bool(_ZendTestClass::is_object()));
+
+?>
+--EXPECT--
+bool(false)
@@ -0,0 +1,17 @@
+--TEST--
+Don't optimize object -> iterable
+--FILE--
+<?php
+
+function test(object $arg): iterable {
+    return $arg;
+}
+test(new stdClass);
+
+?>
+--EXPECTF--
+Fatal error: Uncaught TypeError: Return value of test() must be iterable, object returned in %s:%d
+Stack trace:
+#0 %s(%d): test(Object(stdClass))
+#1 {main}
+  thrown in %s on line %d
@@ -735,11 +735,11 @@ zend_op_array* zend_accel_load_script(zend_persistent_script *persistent_script,
 #define ADLER32_DO8(buf, i)     ADLER32_DO4(buf, i); ADLER32_DO4(buf, i + 4);
 #define ADLER32_DO16(buf)       ADLER32_DO8(buf, 0); ADLER32_DO8(buf, 8);

-unsigned int zend_adler32(unsigned int checksum, signed char *buf, uint32_t len)
+unsigned int zend_adler32(unsigned int checksum, unsigned char *buf, uint32_t len)
 {
 	unsigned int s1 = checksum & 0xffff;
 	unsigned int s2 = (checksum >> 16) & 0xffff;
-	signed char *end;
+	unsigned char *end;

 	while (len >= ADLER32_NMAX) {
 		len -= ADLER32_NMAX;
@@ -777,15 +777,15 @@ unsigned int zend_adler32(unsigned int checksum, signed char *buf, uint32_t len)

 unsigned int zend_accel_script_checksum(zend_persistent_script *persistent_script)
 {
-	signed char *mem = (signed char*)persistent_script->mem;
+	unsigned char *mem = (unsigned char*)persistent_script->mem;
 	size_t size = persistent_script->size;
 	size_t persistent_script_check_block_size = ((char *)&(persistent_script->dynamic_members)) - (char *)persistent_script;
 	unsigned int checksum = ADLER32_INIT;

-	if (mem < (signed char*)persistent_script) {
-		checksum = zend_adler32(checksum, mem, (signed char*)persistent_script - mem);
-		size -= (signed char*)persistent_script - mem;
-		mem  += (signed char*)persistent_script - mem;
+	if (mem < (unsigned char*)persistent_script) {
+		checksum = zend_adler32(checksum, mem, (unsigned char*)persistent_script - mem);
+		size -= (unsigned char*)persistent_script - mem;
+		mem  += (unsigned char*)persistent_script - mem;
 	}

 	zend_adler32(checksum, mem, persistent_script_check_block_size);
@@ -37,7 +37,7 @@ zend_op_array* zend_accel_load_script(zend_persistent_script *persistent_script,

 #define ADLER32_INIT 1     /* initial Adler-32 value */

-unsigned int zend_adler32(unsigned int checksum, signed char *buf, uint32_t len);
+unsigned int zend_adler32(unsigned int checksum, unsigned char *buf, uint32_t len);

 unsigned int zend_accel_script_checksum(zend_persistent_script *persistent_script);

@@ -868,7 +868,7 @@ int zend_file_cache_script_store(zend_persistent_script *script, int in_shm)
 	zend_shared_alloc_destroy_xlat_table();

 	info.checksum = zend_adler32(ADLER32_INIT, buf, script->size);
-	info.checksum = zend_adler32(info.checksum, (signed char*)ZSTR_VAL((zend_string*)ZCG(mem)), info.str_size);
+	info.checksum = zend_adler32(info.checksum, (unsigned char*)ZSTR_VAL((zend_string*)ZCG(mem)), info.str_size);

 #ifdef HAVE_SYS_UIO_H
 	vec[0].iov_base = &info;
@@ -1371,6 +1371,7 @@ zend_persistent_script *zend_file_cache_script_load(zend_file_handle *file_handl
 	zend_accel_hash_entry *bucket;
 	void *mem, *checkpoint, *buf;
 	int cache_it = 1;
+	unsigned int actual_checksum;
 	int ok;

 	if (!full_path) {
@@ -1458,8 +1459,8 @@ zend_persistent_script *zend_file_cache_script_load(zend_file_handle *file_handl

 	/* verify checksum */
 	if (ZCG(accel_directives).file_cache_consistency_checks &&
-	    zend_adler32(ADLER32_INIT, mem, info.mem_size + info.str_size) != info.checksum) {
-		zend_accel_error(ACCEL_LOG_WARNING, "corrupted file '%s'\n", filename);
+	    (actual_checksum = zend_adler32(ADLER32_INIT, mem, info.mem_size + info.str_size)) != info.checksum) {
+		zend_accel_error(ACCEL_LOG_WARNING, "corrupted file '%s' excepted checksum: 0x%08x actual checksum: 0x%08x\n", filename, info.checksum, actual_checksum);
 		unlink(filename);
 		zend_arena_release(&CG(arena), checkpoint);
 		efree(filename);
@@ -1545,6 +1546,8 @@ use_process_mem:
 		zend_accel_hash_update(&ZCSG(hash), ZSTR_VAL(script->script.filename), ZSTR_LEN(script->script.filename), 0, script);

 		zend_shared_alloc_unlock();
+		zend_accel_error(ACCEL_LOG_INFO, "File cached script loaded into memory '%s'", ZSTR_VAL(script->script.filename));
+
 		zend_arena_release(&CG(arena), checkpoint);
 	}
 	efree(filename);
@@ -1873,6 +1873,7 @@ static int php_openssl_enable_crypto(php_stream *stream,
 		do {
 			struct timeval cur_time, elapsed_time;

+			ERR_clear_error();
 			if (sslsock->is_client) {
 				n = SSL_connect(sslsock->ssl_handle);
 			} else {
@@ -2045,6 +2046,7 @@ static size_t php_openssl_sockop_io(int read, php_stream *stream, char *buf, siz
 			}

 			/* Now, do the IO operation. Don't block if we can't complete... */
+			ERR_clear_error();
 			if (read) {
 				nr_bytes = SSL_read(sslsock->ssl_handle, buf, (int)count);

@@ -322,7 +322,7 @@ static zend_always_inline int calculate_unit_length(pcre_cache_entry *pce, char

 /* {{{ pcre_get_compiled_regex_cache
 */
-PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(zend_string *regex)
+PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache_ex(zend_string *regex, int locale_aware)
 {
 	pcre				*re = NULL;
 	pcre_extra			*extra;
@@ -344,7 +344,7 @@ PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(zend_string *regex)
 	zend_string 		*key;

 #if HAVE_SETLOCALE
-	if (BG(locale_string) &&
+	if (locale_aware && BG(locale_string) &&
 		(ZSTR_LEN(BG(locale_string)) != 1 && ZSTR_VAL(BG(locale_string))[0] != 'C')) {
 		key = zend_string_alloc(ZSTR_LEN(regex) + ZSTR_LEN(BG(locale_string)) + 1, 0);
 		memcpy(ZSTR_VAL(key), ZSTR_VAL(BG(locale_string)), ZSTR_LEN(BG(locale_string)) + 1);
@@ -636,6 +636,14 @@ PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(zend_string *regex)
 }
 /* }}} */

+/* {{{ pcre_get_compiled_regex_cache
+ */
+PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(zend_string *regex)
+{
+	return pcre_get_compiled_regex_cache_ex(regex, 1);
+}
+/* }}} */
+
 /* {{{ pcre_get_compiled_regex
 */
 PHPAPI pcre* pcre_get_compiled_regex(zend_string *regex, pcre_extra **extra, int *preg_options)
@@ -57,6 +57,7 @@ typedef struct {
 } pcre_cache_entry;

 PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(zend_string *regex);
+PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache_ex(zend_string *regex, int locale_aware);

 PHPAPI void  php_pcre_match_impl(  pcre_cache_entry *pce, char *subject, int subject_len, zval *return_value,
 	zval *subpats, int global, int use_flags, zend_long flags, zend_long start_offset);
@@ -425,14 +425,14 @@ static int pdo_mysql_stmt_next_rowset(pdo_stmt_t *stmt) /* {{{ */
 		pdo_mysql_error_stmt(stmt);
 		PDO_DBG_RETURN(0);
 	} else {
-		PDO_DBG_RETURN(pdo_mysql_fill_stmt_from_result(stmt) && stmt->row_count);
+		PDO_DBG_RETURN(pdo_mysql_fill_stmt_from_result(stmt));
 	}
 #else
 	if (mysql_next_result(H->server) > 0) {
 		pdo_mysql_error_stmt(stmt);
 		PDO_DBG_RETURN(0);
 	} else {
-		PDO_DBG_RETURN(pdo_mysql_fill_stmt_from_result(stmt) && stmt->row_count);
+		PDO_DBG_RETURN(pdo_mysql_fill_stmt_from_result(stmt));
 	}
 #endif
 }
@@ -18,6 +18,8 @@ if ($version < 50000)
 	die(sprintf("skip Need MySQL Server 5.0.0+, found %d.%02d.%02d (%d)\n",
 		$matches[0], $matches[1], $matches[2], $version));
 ?>
+--XFAIL--
+nextRowset() problem with stored proc & emulation mode & mysqlnd
 --FILE--
 <?php
 require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'mysql_pdo_test.inc');
@@ -1,5 +1,7 @@
 --TEST--
 PDO MySQL Bug #41997 (stored procedure call returning single rowset blocks future queries)
+--XFAIL--
+nextRowset() problem with stored proc & emulation mode & mysqlnd
 --SKIPIF--
 <?php
 require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'skipif.inc');
@@ -1,5 +1,7 @@
 --TEST--
 MySQL Prepared Statements and different column counts
+--XFAIL--
+nextRowset() problem with stored proc & emulation mode & mysqlnd
 --SKIPIF--
 <?php
 require_once(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'skipif.inc');
@@ -1386,6 +1386,7 @@ int phar_create_or_parse_filename(char *fname, int fname_len, char *alias, int a
 	mydata = ecalloc(1, sizeof(phar_archive_data));
 	mydata->fname = expand_filepath(fname, NULL);
 	if (mydata->fname == NULL) {
+		efree(mydata);
 		return FAILURE;
 	}
 	fname_len = strlen(mydata->fname);
@@ -5,11 +5,11 @@ Bug #77396 Relative filename exceeding maximum path length causes null pointer d
 --FILE--
 <?php
 $path = '../' . str_repeat("x", PHP_MAXPATHLEN) . '.tar';
-$phar = new PharData($path);
+try {
+    $phar = new PharData($path);
+} catch (UnexpectedValueException $e) {
+    echo $e->getMessage(), "\n";
+}
 ?>
--EXPECTF--
-Fatal error: Uncaught UnexpectedValueException: Phar creation or opening failed in %s%ebug77396.php:%d
-Stack trace:
-#0 %s%ebug77396.php(%d): PharData->__construct(%s)
-#1 {main}
-  thrown in %s%ebug77396.php on line %d
+--EXPECT--
+Phar creation or opening failed
@@ -5140,7 +5140,7 @@ ZEND_METHOD(reflection_class, implementsInterface)

 	if (!(interface_ce->ce_flags & ZEND_ACC_INTERFACE)) {
 		zend_throw_exception_ex(reflection_exception_ptr, 0,
-				"Interface %s is a Class", ZSTR_VAL(interface_ce->name));
+				"%s is not an interface", ZSTR_VAL(interface_ce->name));
 		return;
 	}
 	RETURN_BOOL(instanceof_function(ce, interface_ce));
@@ -67,14 +67,14 @@ try {
 ?>
 --EXPECTF--
 Does A implement A? 
-   - Using object argument: Interface A is a Class
-   - Using string argument: Interface A is a Class
+   - Using object argument: A is not an interface
+   - Using string argument: A is not an interface
 Does A implement B? 
-   - Using object argument: Interface B is a Class
-   - Using string argument: Interface B is a Class
+   - Using object argument: B is not an interface
+   - Using string argument: B is not an interface
 Does A implement C? 
-   - Using object argument: Interface C is a Class
-   - Using string argument: Interface C is a Class
+   - Using object argument: C is not an interface
+   - Using string argument: C is not an interface
 Does A implement I1? 
   - Using object argument: bool(true)
   - Using string argument: bool(true)
@@ -82,14 +82,14 @@ Does A implement I2?
   - Using object argument: bool(false)
   - Using string argument: bool(false)
 Does B implement A? 
-   - Using object argument: Interface A is a Class
-   - Using string argument: Interface A is a Class
+   - Using object argument: A is not an interface
+   - Using string argument: A is not an interface
 Does B implement B? 
-   - Using object argument: Interface B is a Class
-   - Using string argument: Interface B is a Class
+   - Using object argument: B is not an interface
+   - Using string argument: B is not an interface
 Does B implement C? 
-   - Using object argument: Interface C is a Class
-   - Using string argument: Interface C is a Class
+   - Using object argument: C is not an interface
+   - Using string argument: C is not an interface
 Does B implement I1? 
   - Using object argument: bool(true)
   - Using string argument: bool(true)
@@ -97,14 +97,14 @@ Does B implement I2?
   - Using object argument: bool(false)
   - Using string argument: bool(false)
 Does C implement A? 
-   - Using object argument: Interface A is a Class
-   - Using string argument: Interface A is a Class
+   - Using object argument: A is not an interface
+   - Using string argument: A is not an interface
 Does C implement B? 
-   - Using object argument: Interface B is a Class
-   - Using string argument: Interface B is a Class
+   - Using object argument: B is not an interface
+   - Using string argument: B is not an interface
 Does C implement C? 
-   - Using object argument: Interface C is a Class
-   - Using string argument: Interface C is a Class
+   - Using object argument: C is not an interface
+   - Using string argument: C is not an interface
 Does C implement I1? 
   - Using object argument: bool(true)
   - Using string argument: bool(true)
@@ -112,14 +112,14 @@ Does C implement I2?
   - Using object argument: bool(true)
   - Using string argument: bool(true)
 Does I1 implement A? 
-   - Using object argument: Interface A is a Class
-   - Using string argument: Interface A is a Class
+   - Using object argument: A is not an interface
+   - Using string argument: A is not an interface
 Does I1 implement B? 
-   - Using object argument: Interface B is a Class
-   - Using string argument: Interface B is a Class
+   - Using object argument: B is not an interface
+   - Using string argument: B is not an interface
 Does I1 implement C? 
-   - Using object argument: Interface C is a Class
-   - Using string argument: Interface C is a Class
+   - Using object argument: C is not an interface
+   - Using string argument: C is not an interface
 Does I1 implement I1? 
   - Using object argument: bool(true)
   - Using string argument: bool(true)
@@ -127,14 +127,14 @@ Does I1 implement I2?
   - Using object argument: bool(false)
   - Using string argument: bool(false)
 Does I2 implement A? 
-   - Using object argument: Interface A is a Class
-   - Using string argument: Interface A is a Class
+   - Using object argument: A is not an interface
+   - Using string argument: A is not an interface
 Does I2 implement B? 
-   - Using object argument: Interface B is a Class
-   - Using string argument: Interface B is a Class
+   - Using object argument: B is not an interface
+   - Using string argument: B is not an interface
 Does I2 implement C? 
-   - Using object argument: Interface C is a Class
-   - Using string argument: Interface C is a Class
+   - Using object argument: C is not an interface
+   - Using string argument: C is not an interface
 Does I2 implement I1? 
   - Using object argument: bool(true)
   - Using string argument: bool(true)
@@ -0,0 +1,14 @@
+--TEST--
+Bug #78697: ReflectionClass::implementsInterface - inaccurate error message with traits
+--FILE--
+<?php
+trait T {}
+
+try {
+    (new ReflectionClass(new stdClass))->implementsInterface(T::class);
+} catch (ReflectionException $e) {
+    echo $e->getMessage();
+}
+?>
+--EXPECT--
+T is not an interface
Author	SHA1	Message	Date
Remi Collet	40c86aa3af	Update versions for PHP 7.2.27	2020-01-22 07:45:58 +00:00
Remi Collet	525e494fe5	Update CREDITS for PHP 7.2.27	2020-01-22 07:45:58 +00:00
Remi Collet	5765d9844f	Update NEWS for PHP 7.2.27	2020-01-22 07:45:58 +00:00
Stanislav Malyshev	5c90f8eb66	Update NEWS	2020-01-20 22:12:32 -08:00
Stanislav Malyshev	2bcbc95f03	Fix bug #79037 (global buffer-overflow in `mbfl_filt_conv_big5_wchar`)	2020-01-20 21:43:42 -08:00
Stanislav Malyshev	0f79b1bf30	Fix #79099 : OOB read in php_strip_tags_ex	2020-01-20 21:43:42 -08:00
Christoph M. Becker	f79c774274	Fix #79091 : heap use-after-free in session_create_id() If the `new_id` is released, we must not use it again.	2020-01-20 21:43:42 -08:00
Remi Collet	864f5ef12f	fix release date	2019-12-18 14:16:19 +01:00
Stanislav Malyshev	9705e631a4	[ci skip] Update NEWS	2019-12-16 23:41:04 -08:00
Stanislav Malyshev	6d5cddabaf	Fix test	2019-12-16 10:03:43 -08:00
Stanislav Malyshev	c14eb8de97	Fix bug #78793	2019-12-16 01:14:58 -08:00
Stanislav Malyshev	d348cfb96f	Fixed bug #78910	2019-12-16 00:10:39 -08:00
Christoph M. Becker	eb23c60087	Fix #78878 : Buffer underflow in bc_shift_addsub We must not rely on `isdigit()` to detect digits, since we only support decimal ASCII digits in the following processing.	2019-12-16 00:05:03 -08:00
Stanislav Malyshev	b771a18133	Fix test	2019-12-16 00:03:18 -08:00
Christoph M. Becker	0e6c0654ed	Fix #78862 : link() silently truncates after a null byte on Windows Since link() is supposed to accepts paths (i.e. strings without NUL bytes), we must not accept arbitrary strings.	2019-12-16 00:03:06 -08:00
Christoph M. Becker	a5a15965da	Fix #78863 : DirectoryIterator class silently truncates after a null byte Since the constructor of DirectoryIterator and friends is supposed to accepts paths (i.e. strings without NUL bytes), we must not accept arbitrary strings.	2019-12-16 00:02:57 -08:00
Remi Collet	d2cfb63f02	next is 7.2.27	2019-12-03 11:25:37 +01:00
Christoph M. Becker	600f1f898f	Fix #78814 : strip_tags allows / in tag name => whitelist bypass When normalizing tags to check whether they are contained in the set of allowable tags, we must not strip slashes, unless they come immediately after the opening `<`, or immediately before the closing `>`.	2019-12-02 11:37:25 +01:00
Christoph M. Becker	db420cb6a1	Fix #78833 : Integer overflow in pack causes out-of-bound access We check for potential signed integer overflow, and bail out gracefully, in that case.	2019-12-02 11:18:19 +01:00
George Wang	c7141412ce	Added environment LSAPI_CLEAN_SHUTDOWN to control clean shutdown. Update SAPI version to LiteSpeed v7.6 .	2019-11-21 17:57:50 -05:00
Christoph M. Becker	9b92c1d154	Fix #78849 : GD build broken with -D SIGNED_COMPARE_SLOW Apparently, this has not been tested for a long time, and might be a refactoring relict. Anyhow, we have to pass the context to `GIFNextPixel` as well.	2019-11-21 09:59:26 +01:00
Christoph M. Becker	f6eac76b65	Update NEWS	2019-11-18 12:46:43 +01:00
Tyson Andre	a2c41c0ea6	Fix $x = (bool)$x; for undefined with opcache And `$x = !$x` Noticed while working on GH-4912 The included test would not emit undefined variable errors in php 8.0 with opcache enabled. The command used: ``` php -d zend_extension=opcache.so --no-php-ini -d error_reporting=E_ALL \ -d opcache.file_cache= -d opcache.enable_cli=1 test.php ```	2019-11-18 11:24:03 +03:00
Stanislav Malyshev	2c9926f156	Fix bug #78804 - Segmentation fault in Locale::filterMatches	2019-11-11 22:32:35 -08:00
Nikita Popov	ee243bc471	Remove outdated comments in test	2019-11-07 14:06:23 +01:00
Nikita Popov	5fa6dcd972	Fixed bug #78759 Handle INDIRECT values in array.	2019-11-07 11:15:29 +01:00
Sara Golemon	d317e16e89	Bump for 7.2.26-dev	2019-11-05 10:57:29 -05:00
Nikita Popov	4f984a2fdb	Fixed bug #78775 Clear the OpenSSL error queue before performing SSL stream operations. As we don't control all code that could possibly be using OpenSSL, we can't rely on the error queue being empty.	2019-11-05 12:13:46 +01:00
Christoph M. Becker	e29922f054	Fix test cases for libxml2 2.9.10 Since the error reporting has been slightly changed, we have to adapt the two affected test cases.	2019-10-31 16:07:34 +01:00
Nikita Popov	5f6eaf355c	Add missing refcount increment	2019-10-30 09:22:20 +01:00
Nikita Popov	f9895b4bf5	Fixed bug #78689	2019-10-29 15:06:16 +01:00
Stanislav Malyshev	2bdb13a1f7	Merge branch 'PHP-7.1' into PHP-7.2 * PHP-7.1: Fix libmagic buffer overflow issue (CVE-2019-18218) bump version set versions for release	2019-10-28 20:47:30 -07:00
Christoph M. Becker	89c327f884	Fix #78751 : Serialising DatePeriod converts DateTimeImmutable When getting the properties of a DatePeriod instance we have to retain the proper classes, and when restoring a DatePeriod instance we have to cater to DateTimeImmutable instances as well.	2019-10-28 13:07:28 +01:00
Nikita Popov	16c4910876	Fix bug #78752 NULL out the execute_data before destroying it, otherwise GC may trigger while the execute_data is partially destroyed, resulting in double-frees. The handling of call stack unfreezing is a bit awkward because it's a ZEND_API function, so we can't change the signature.	2019-10-28 10:27:32 +01:00
Stanislav Malyshev	469820048d	Fix libmagic buffer overflow issue (CVE-2019-18218) Ported from https://github.com/file/file/commit/46a8443f76cec4b41ec736eca396984c74664f84	2019-10-27 16:30:38 -07:00
Nikita Popov	5249993814	Fixed bug #78747	2019-10-25 12:47:18 +02:00
Ryan Schmidt	8daf96cef3	Use ICU's CXXFLAGS when using pkg-config This mirrors how ICU's CXXFLAGS are already used when using icu-config.	2019-10-23 11:17:37 +02:00
Nikita Popov	fa89c41f37	Add "-pthread" to EXTRA_LDFLAGS_PROGRAM as well This is a backport of `c518932c03` from the PHP 7.4 branch.	2019-10-23 11:06:51 +02:00
Joe Watkins	52f049879a	bump version	2019-10-22 18:58:39 +02:00
Joe Watkins	326cd05dae	set versions for release	2019-10-22 18:56:55 +02:00
Remi Collet	2213bd36fd	add NEWS entry	2019-10-22 09:37:35 +02:00
Stanislav Malyshev	4b5cdda0c7	Merge branch 'PHP-7.1' into PHP-7.2 * PHP-7.1: Fix bug #78599 (env_path_info underflow can lead to RCE) (CVE-2019-11043) bump versions after release set versions for release	2019-10-21 13:17:09 -07:00
Fabien Villepinte	bea2ff88c9	Fix bug #78697 : inaccurate error message	2019-10-21 09:22:09 +02:00
Jakub Zelenka	ab061f95ca	Fix bug #78599 (env_path_info underflow can lead to RCE) (CVE-2019-11043)	2019-10-20 22:50:04 -07:00
Christoph M. Becker	45a7723267	Fix #78694 : Appending to a variant array causes segfault `write_dimension` object handlers have to be able to handle `NULL` `offset`s; for now we simply throw an exception instead of following the `NULL` pointer.	2019-10-19 11:47:00 +02:00
m.yakunin	d2cde0bfd3	Fix #70153 \DateInterval incorrectly unserialized Added a separate macro for reading 'days' property, so that bool(false) is correctly converted to the proper internal representation.	2019-10-18 15:31:14 +02:00
Mitch Hagstrand	e2a6bf482f	Fix checksum calculation for opcache	2019-10-14 16:46:42 +02:00
Christoph M. Becker	900bdcbd03	Fix #78665 : Multicasting may leak memory	2019-10-12 14:43:43 +02:00
Nikita Popov	46561dab6a	Fix leak in phar open	2019-10-10 16:14:21 +02:00
Nikita Popov	96c84b7bc1	Fix leak on static method call on non-existent class	2019-10-10 11:40:49 +02:00
Nikita Popov	daf1fc6e31	Avoid float to int cast UB in exif	2019-10-09 17:33:29 +02:00
Erik Lundin	3164186d53	Fix #78656 : Parse errors classified as highest log-level	2019-10-09 17:27:32 +02:00
Nikita Popov	d6ca174d5b	Remove redundant components < 0 check components is an unsigned number, it cannot be smaller than zero.	2019-10-09 14:57:24 +02:00
Sergei Turchanov	a8f60ac9dd	Add pcre_get_compiled_regex_cache_ex() with local_aware flag A new function `pcre_get_compiled_regex_cache_ex()` is introduced, which allows to compile regexp pattern using the "C" locale instead of a current locale. This will be needed to replace setlocale() usage in fileinfo, which is not thread-safe.	2019-10-08 16:11:55 +02:00
Fabien Villepinte	46894580b0	Add missing SKIPIFs in exif tests	2019-10-08 14:11:32 +02:00
Christoph M. Becker	195c2008e8	Fix #78642 : Wrong libiconv version displayed The high byte of `_libiconv_version` specifies the major version; the low byte the minor version.	2019-10-08 12:09:11 +02:00
Remi Collet	05d6878b3b	next is 7.2.25	2019-10-08 11:36:10 +02:00
Christoph M. Becker	fd3118ffb0	Fix #78641 : addGlob can modify given remove_path value `remove_path` points to the given string, so we must not modify it. Instead we use a duplicate, if we need the modification. We may want to switch to `zend_string`s in master.	2019-10-08 09:45:05 +02:00
Nikita Popov	19e6abebc7	Check for object_init_ex() failure in user filter factory	2019-10-07 17:52:29 +02:00
Nikita Popov	7d19668f60	Set session.gc_probability=0 in bug78624.phpt We only want to test manually triggered session GC. Avoid spurious output due to automatic GC.	2019-10-07 16:43:19 +02:00
Christoph M. Becker	114c03b9a6	Fix #78623 : Regression caused by "SP call yields additional empty result set" This reverts commit `41a4379cb4`.	2019-10-07 09:15:51 +02:00
Christoph M. Becker	545412a6cd	Split intl tests for ICU 65	2019-10-04 13:53:22 +02:00
Christoph M. Becker	abaf9a76dc	Fix #78620 : Out of memory error The integer addition in `ZEND_MM_ALIGNED_SIZE_EX` can overflow, what we have to catch early.	2019-10-04 09:08:01 +02:00
Brent Shaffer	a6d219630c	fix #78624 : session_gc return value for user defined session handlers	2019-10-04 06:12:02 +02:00
Fábio Souto	9a2b42a5c1	Fix bug #76809 (SSL settings aren't respected when persistent connection is reused)	2019-10-03 06:56:21 +02:00
Konstantin Kopachev	05560b67bc	Fix #76859 stream_get_line skips data if used with data-generating filter stream_get-line repeatedly calls php_stream_fill_read_buffer until enough data is accumulated in buffer. However, when stream contains filters attached to it, then each call to fill buffer essentially resets buffer read/write pointers and new data is written over old. This causes stream_get_line to skip parts of data from stream This patch fixes such behavior, so fill buffer call will append.	2019-10-03 06:50:43 +02:00
Christoph M. Becker	f2fb37a772	Revert "Fix #78620 : Out of memory error" This reverts commit `8ce04df7e0`. Cf. <https://github.com/php/php-src/pull/4766#discussion_r330658679>.	2019-10-02 19:01:35 +02:00
Christoph M. Becker	8ce04df7e0	Fix #78620 : Out of memory error If the integer addition in `ZEND_MM_ALIGNED_SIZE_EX` overflows, the macro evaluates to `0`, what we should catch early.	2019-10-02 18:18:52 +02:00
Nikita Popov	a5d3620d93	Fix segfault with __COMPILER_HALT_OFFSET__ and trailing {} Fixes OSS-Fuzz #17895.	2019-10-02 12:07:15 +02:00
Dmitry Stogov	3124129ca8	Fixed test that "fails" from time to time	2019-10-02 00:54:59 +03:00
Dmitry Stogov	2fcb5eadbb	Fixed test that "fails" from time to time	2019-10-02 00:48:42 +03:00
Fabien Villepinte	209e37db7d	Add missing skip keyword in tests	2019-10-01 11:13:36 +02:00
Nikita Popov	6fcde56b03	Fixed bug #78612	2019-09-30 15:06:07 +02:00
Christoph M. Becker	45db6fa567	Fix #78609 : mb_check_encoding() no longer supports stringable objects We apply type juggling for other types than array.	2019-09-30 12:42:04 +02:00
Christoph M. Becker	f6bfbe9553	Fix build for libzip < 0.11.2 We must not define method entries, if the actual method definitions or the arginfo structures are not defined.	2019-09-29 13:33:18 +02:00
Fabien Villepinte	37d27e666a	Fix SKIPIF in ext/mysqli	2019-09-27 16:03:20 +02:00
Christoph M. Becker	115f6effec	Fix skipif.inc	2019-09-27 12:50:04 +02:00
Nikita Popov	ab938d7bbc	Fix memory leak with ** on array operands	2019-09-26 13:45:45 +02:00
Nikita Popov	8a9df88597	Fix null-pointer deref in if stmt printing Fixes OSS-Fuzz #17721.	2019-09-26 10:24:49 +02:00
Jinesh Patel	d2331cc3f2	Fix hash key length in umsg_parse_format() Fix array length passed to zend_hash_str_find_ptr() casting from UChar array to char array requires mul by sizeof(UChar).	2019-09-25 10:30:33 +02:00
Christoph M. Becker	ed099ab186	Fix NEWS entry Cf. <https://bugs.php.net/78590>.	2019-09-23 22:59:55 +02:00
Nikita Popov	3ddb63dce1	Fix skipif condition	2019-09-23 17:17:52 +02:00
Nikita Popov	bc4c4c658c	Skip test on 32-bit	2019-09-23 16:42:24 +02:00
Nikita Popov	8509970e6a	Fix signed integer overflow in SplObjectStorage unserialization If count is ZEND_LONG_MIN the count-- loop underflows. This is ultimately harmless, but results in a ubsan warning. Fix this by adding a sanity check that the count isn't negative, because that doesn't make sense...	2019-09-23 13:18:27 +02:00
Christoph M. Becker	697945aa89	Fix test to be skipped if dom is not available	2019-09-22 18:42:02 +02:00
Nikita Popov	f989a4cd44	Fix leak of temporary buffer during exif tag reading	2019-09-22 12:10:17 +02:00
Nikita Popov	0701835c01	Fix multiple leaks in exif_read_data() This fixes two leaks related to duplicate tags, as well as a leak of zero-length FMT_(S)BYTE with non-null value. This can show up for MAKERNOTE values where the original length is non-zero, but the first character is a null byte.	2019-09-21 20:40:03 +02:00
Jinesh Patel	0d6c2448a7	Fix length of key passed to zend_hash_str_find_ptr	2019-09-21 18:11:21 +02:00
Christoph M. Becker	398b308316	Fix #78579 : mb_decode_numericentity: args number inconsistency mb_decode_numericentity() accepts a fourth optional parameter, which is unused, however. Since this parameter doesn't do any harm, and to avoid the small BC break, we're keeping this parameter for PHP 7, but adjust the arginfo. For PHP 8, we will remove this parameter.	2019-09-21 16:15:23 +02:00
Nikita Popov	0fa13028cb	Fix out-of-bounds read in exif tag reading This issue was recently introduced in `c739023a50`, when the restriction that components>0 has been relaxed. We now need to make sure that any tags that expect at least one component check that this is the case.	2019-09-19 21:11:57 +02:00
Nikita Popov	003c13d7bc	Fix iterable return type optimization	2019-09-19 17:21:00 +02:00
Nikita Popov	3e139a4653	Fix exif leak on duplicate copyright tags	2019-09-19 14:19:31 +02:00
CJDennis	e3255a4f49	Fix typo `sizeof("data")-1` and `sizeof("date")-1` are both 4, so no change in behaviour	2019-09-19 11:36:00 +02:00
Nikita Popov	175f4f24ae	Increase timeout in test	2019-09-17 17:33:46 +02:00
fancyweb	e691a98c1f	Fix #76342 : file_get_contents waits twice specified timeout	2019-09-17 15:42:29 +02:00
Drakano	252ebce0d7	Add tilde to allowed status/ping path Because of user specific webdirs it should be possible to set a status/ping path like "/~username/status". Closes GH-4698.	2019-09-17 12:19:21 +02:00
Tyson Andre	29bced9521	Fix opcache return type for get_headers in zend_func_info https://www.php.net/manual/en/function.get-headers.php#refsect1-function.get-headers-examples shows that it will return string keys when the second argument is non-zero. I've verified that this is the case. This bug was there since the initial commit in `c88ffa9a56`. Closes GH-4702.	2019-09-17 12:08:29 +02:00
Nikita Popov	2f6efd835d	Fixed bug #78545 By using an explicit (double) cast.	2019-09-16 15:00:20 +02:00
Nikita Popov	8873df8e86	Fix leak in SplObjectStorage unserialization The result of php_var_unserialize always needs to be destroyed, even if the call failed.	2019-09-16 13:02:32 +02:00
Christoph M. Becker	81cefab7b0	Stick with zend_long for ABI compatibility Cf. <https://github.com/php/php-src/pull/4700#issuecomment-531515689>.	2019-09-15 15:11:25 +02:00
bugreportuser	fdcca93056	Fix #78535 : auto_detect_line_endings value not parsed as bool	2019-09-14 18:46:09 +02:00
Kalle Sommer Nielsen	716518373f	NEWS	2019-09-12 06:50:53 +03:00
Kalle Sommer Nielsen	2823e938d4	Fixed bug #78442 ('Illegal component' on exif_read_data since PHP7)	2019-09-12 06:21:39 +03:00
Sara Golemon	a270eb1911	Bump for 7.2.24	2019-09-10 13:04:01 -04:00
Joe Watkins	fadd7f0f1e	bump versions after release	2019-08-28 09:08:23 +02:00
Joe Watkins	481520d381	set versions for release	2019-08-28 09:06:38 +02:00