Update versions for PHP 7.2.32

Prep NEWS for 7.2.32 release
bump version to 7.2.32-dev
2026-11-11 19:20:50 +00:00 · 2020-07-07 19:39:50 +00:00 · 2020-07-07 19:31:05 +00:00 · 2020-05-12 09:16:01 +02:00 · 2020-05-11 14:28:51 -07:00 · 2020-05-11 13:48:40 -07:00
91 changed files with 1156 additions and 186 deletions
@@ -1,6 +1,136 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2019, PHP 7.2.24
+09 Jul 2020, PHP 7.2.32
+
+- Core:
+  . No source changes to this release.
+    Vesion number added for reproduction of Windows builds. (cmb)
+
+14 May 2020, PHP 7.2.31
+
+- Core:
+  . Fixed bug #78875 (Long filenames cause OOM and temp files are not cleaned). 
+    (CVE-2019-11048) (cmb)
+  . Fixed bug #78876 (Long variables in multipart/form-data cause OOM and temp 
+    files are not cleaned). (CVE-2019-11048) (cmb)
+
+16 Apr 2020, PHP 7.2.30
+
+- Standard:
+  . Fixed bug #79468 (SIGSEGV when closing stream handle with a stream filter
+    appended). (dinosaur)
+  . Fixed bug #79330 (shell_exec() silently truncates after a null byte). (stas)
+  . Fixed bug #79465 (OOB Read in urldecode()). (stas)
+
+19 Mar 2020, PHP 7.2.29
+
+- EXIF:
+  . Fixed bug #79282 (Use-of-uninitialized-value in exif). (CVE-2020-7064) 
+    (Nikita)
+
+- Standard: 
+  . Fixed bug #79329 (get_headers() silently truncates after a null byte) 
+    (CVE-2020-7066). (cmb)
+
+20 Feb 2020, PHP 7.2.28
+
+- DOM:
+  . Fixed bug #77569: (Write Access Violation in DomImplementation). (Nikita,
+    cmb)
+
+- Phar:
+  . Fixed bug #79082 (Files added to tar with Phar::buildFromIterator have
+    all-access permissions). (CVE-2020-7063) (stas)
+
+- Session:
+  . Fixed bug #79221 (Null Pointer Dereference in PHP Session Upload Progress).
+    (CVE-2020-7062) (stas)
+
+23 Jan 2020, PHP 7.2.27
+
+- Mbstring:
+  . Fixed bug #79037 (global buffer-overflow in `mbfl_filt_conv_big5_wchar`). 
+    (CVE-2020-7060) (Nikita)
+
+- Session:
+  . Fixed bug #79091 (heap use-after-free in session_create_id()). (cmb, Nikita)
+
+- Standard:
+  . Fixed bug #79099 (OOB read in php_strip_tags_ex). (CVE-2020-7059). (cmb)
+
+18 Dec 2019, PHP 7.2.26
+
+- Bcmath:
+  . Fixed bug #78878 (Buffer underflow in bc_shift_addsub). (CVE-2019-11046).
+    (cmb)
+
+- Core:
+  . Fixed bug #78862 (link() silently truncates after a null byte on Windows).
+    (CVE-2019-11044). (cmb)
+  . Fixed bug #78863 (DirectoryIterator class silently truncates after a null
+    byte). (CVE-2019-11045). (cmb)
+
+- EXIF:
+  . Fixed bug #78793 (Use-after-free in exif parsing under memory sanitizer).
+    (CVE-2019-11050). (Nikita)
+  . Fixed bug #78910 (Heap-buffer-overflow READ in exif). (CVE-2019-11047).
+    (Nikita)
+
+- GD:
+  . Fixed bug #78849 (GD build broken with -D SIGNED_COMPARE_SLOW). (cmb)
+
+- Intl:
+  . Fixed bug #78804 (Segmentation fault in Locale::filterMatches). (Stas)
+
+- OPcache:
+  . Fixed $x = (bool)$x; with opcache (should emit undeclared variable notice).
+    (Tyson Andre)
+
+- Standard:
+  . Fixed bug #78759 (array_search in $GLOBALS). (Nikita)
+  . Fixed bug #78833 (Integer overflow in pack causes out-of-bound access).
+    (cmb)
+  . Fixed bug #78814 (strip_tags allows / in tag name => whitelist bypass).
+    (cmb)
+
+21 Nov 2019, PHP 7.2.25
+
+- Core:
+  . Fixed bug #78656 (Parse errors classified as highest log-level). (Erik
+    Lundin)
+  . Fixed bug #78752 (Segfault if GC triggered while generator stack frame is
+    being destroyed). (Nikita)
+  . Fixed bug #78689 (Closure::fromCallable() doesn't handle
+    [Closure, '__invoke']). (Nikita)
+
+- COM:
+  . Fixed bug #78694 (Appending to a variant array causes segfault). (cmb)
+
+- Date:
+  . Fixed bug #70153 (\DateInterval incorrectly unserialized). (Maksim Iakunin)
+  . Fixed bug #78751 (Serialising DatePeriod converts DateTimeImmutable). (cmb)
+
+- Iconv:
+  . Fixed bug #78642 (Wrong libiconv version displayed). (gedas at martynas,
+    cmb).
+
+- OpCache:
+  . Fixed bug #78654 (Incorrectly computed opcache checksum on files with
+    non-ascii characters). (mhagstrand)
+  . Fixed bug #78747 (OpCache corrupts custom extension result). (Nikita)
+
+- OpenSSL:
+  . Fixed bug #78775 (TLS issues from HTTP request affecting other encrypted
+    connections). (Nikita)
+
+- Reflection:
+  . Fixed bug #78697 (ReflectionClass::ImplementsInterface - inaccurate error
+    message with traits). (villfa)
+
+- Sockets:
+  . Fixed bug #78665 (Multicasting may leak memory). (cmb)
+
+24 Oct 2019, PHP 7.2.24

 - Core:
  . Fixed bug #78535 (auto_detect_line_endings value not parsed as bool).
@@ -11,6 +141,10 @@ PHP                                                                        NEWS
  . Fixed bug #78442 ('Illegal component' on exif_read_data since PHP7)
 	(Kalle)

+- FPM:
+  . Fixed bug #78599 (env_path_info underflow in fpm_main.c can lead to RCE).
+    (CVE-2019-11043) (Jakub Zelenka)
+
 - MBString:
  . Fixed bug #78579 (mb_decode_numericentity: args number inconsistency).
    (cmb)
@@ -0,0 +1,13 @@
+--TEST--
+Bug #78689: Closure::fromCallable() doesn't handle [Closure, '__invoke']
+--FILE--
+<?php
+$a = [function () { echo "123\n"; }, '__invoke'];
+$a();
+
+$b = Closure::fromCallable($a);
+$b();
+?>
+--EXPECT--
+123
+123
@@ -0,0 +1,24 @@
+--TEST--
+Bug #78752: Segfault if GC triggered while generator stack frame is being destroyed
+--FILE--
+<?php
+
+function gen(&$gen) {
+    $a = new stdClass;
+    $a->a = $a;
+    $b = new stdClass;
+    $b->b = $b;
+    yield 1;
+}
+
+$gen = gen($gen);
+var_dump($gen->current());
+for ($i = 0; $i < 9999; $i++) {
+    $a = new stdClass;
+    $a->a = $a;
+}
+$gen->next();
+
+?>
+--EXPECT--
+int(1)
@@ -0,0 +1,15 @@
+--TEST--
+Calling a static method on a non-existing class
+--FILE--
+<?php
+
+$str = "foo";
+try {
+    Test::{$str . "bar"}();
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+Class 'Test' not found
@@ -268,8 +268,16 @@ static int zend_create_closure_from_callable(zval *return_value, zval *callable,

 	mptr = fcc.function_handler;
 	if (mptr->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
-		memset(&call, 0, sizeof(zend_internal_function));
+		/* For Closure::fromCallable([$closure, "__invoke"]) return $closure. */
+		if (fcc.object && fcc.object->ce == zend_ce_closure
+				&& zend_string_equals_literal(mptr->common.function_name, "__invoke")) {
+			ZVAL_OBJ(return_value, fcc.object);
+			GC_REFCOUNT(fcc.object)++;
+			zend_free_trampoline(mptr);
+			return SUCCESS;
+		}

+		memset(&call, 0, sizeof(zend_internal_function));
 		call.type = ZEND_INTERNAL_FUNCTION;
 		call.handler = zend_closure_call_magic;
 		call.function_name = mptr->common.function_name;
@@ -97,16 +97,18 @@ ZEND_API zend_execute_data* zend_generator_freeze_call_stack(zend_execute_data *
 /* }}} */

 static void zend_generator_cleanup_unfinished_execution(
-		zend_generator *generator, uint32_t catch_op_num) /* {{{ */
+		zend_generator *generator, zend_execute_data *execute_data, uint32_t catch_op_num) /* {{{ */
 {
-	zend_execute_data *execute_data = generator->execute_data;
-
 	if (execute_data->opline != execute_data->func->op_array.opcodes) {
 		/* -1 required because we want the last run opcode, not the next to-be-run one. */
 		uint32_t op_num = execute_data->opline - execute_data->func->op_array.opcodes - 1;

 		if (UNEXPECTED(generator->frozen_call_stack)) {
+			/* Temporarily restore generator->execute_data if it has been NULLed out already. */
+			zend_execute_data *save_ex = generator->execute_data;
+			generator->execute_data = execute_data;
 			zend_generator_restore_call_stack(generator);
+			generator->execute_data = save_ex;
 		}
 		zend_cleanup_unfinished_execution(execute_data, op_num, catch_op_num);
 	}
@@ -117,6 +119,9 @@ ZEND_API void zend_generator_close(zend_generator *generator, zend_bool finished
 {
 	if (EXPECTED(generator->execute_data)) {
 		zend_execute_data *execute_data = generator->execute_data;
+		/* Null out execute_data early, to prevent double frees if GC runs while we're
+		 * already cleaning up execute_data. */
+		generator->execute_data = NULL;

 		if (EX_CALL_INFO() & ZEND_CALL_HAS_SYMBOL_TABLE) {
 			zend_clean_and_cache_symbol_table(execute_data->symbol_table);
@@ -135,12 +140,12 @@ ZEND_API void zend_generator_close(zend_generator *generator, zend_bool finished
 			return;
 		}

-		zend_vm_stack_free_extra_args(generator->execute_data);
+		zend_vm_stack_free_extra_args(execute_data);

 		/* Some cleanups are only necessary if the generator was closed
 		 * before it could finish execution (reach a return statement). */
 		if (UNEXPECTED(!finished_execution)) {
-			zend_generator_cleanup_unfinished_execution(generator, 0);
+			zend_generator_cleanup_unfinished_execution(generator, execute_data, 0);
 		}

 		/* Free closure object */
@@ -154,8 +159,7 @@ ZEND_API void zend_generator_close(zend_generator *generator, zend_bool finished
 			generator->gc_buffer = NULL;
 		}

-		efree(generator->execute_data);
-		generator->execute_data = NULL;
+		efree(execute_data);
 	}
 }
 /* }}} */
@@ -216,7 +220,7 @@ static void zend_generator_dtor_storage(zend_object *object) /* {{{ */
 	if (finally_op_num) {
 		zval *fast_call;

-		zend_generator_cleanup_unfinished_execution(generator, finally_op_num);
+		zend_generator_cleanup_unfinished_execution(generator, ex, finally_op_num);

 		fast_call = ZEND_CALL_VAR(ex, ex->func->op_array.opcodes[finally_op_end].op1.var);
 		Z_OBJ_P(fast_call) = EG(exception);
@@ -758,8 +758,10 @@ ZEND_VM_HANDLER(13, ZEND_BOOL_NOT, CONST|TMPVAR|CV, ANY)
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_FALSE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
+		/* The result and op1 can be the same cv zval */
+		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_TRUE(EX_VAR(opline->result.var));
-		if (OP1_TYPE == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
+		if (OP1_TYPE == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
 			SAVE_OPLINE();
 			GET_OP1_UNDEF_CV(val, BP_VAR_R);
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -3098,6 +3100,7 @@ ZEND_VM_HANDLER(113, ZEND_INIT_STATIC_METHOD_CALL, UNUSED|CLASS_FETCH|CONST|VAR,
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+				FREE_UNFETCHED_OP2();
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -4754,8 +4757,10 @@ ZEND_VM_HANDLER(52, ZEND_BOOL, CONST|TMPVAR|CV, ANY)
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_TRUE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
+		/* The result and op1 can be the same cv zval */
+		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_FALSE(EX_VAR(opline->result.var));
-		if (OP1_TYPE == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
+		if (OP1_TYPE == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
 			SAVE_OPLINE();
 			GET_OP1_UNDEF_CV(val, BP_VAR_R);
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -2653,8 +2653,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_BOOL_NOT_SPEC_CONST_HANDLER(ZE
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_FALSE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
+		/* The result and op1 can be the same cv zval */
+		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_TRUE(EX_VAR(opline->result.var));
-		if (IS_CONST == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
+		if (IS_CONST == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
 			SAVE_OPLINE();
 			GET_OP1_UNDEF_CV(val, BP_VAR_R);
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -3185,8 +3187,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_BOOL_SPEC_CONST_HANDLER(ZEND_O
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_TRUE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
+		/* The result and op1 can be the same cv zval */
+		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_FALSE(EX_VAR(opline->result.var));
-		if (IS_CONST == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
+		if (IS_CONST == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
 			SAVE_OPLINE();
 			GET_OP1_UNDEF_CV(val, BP_VAR_R);
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -5417,6 +5421,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_C
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -7378,6 +7383,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_C
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -9466,6 +9472,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_C
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -11488,6 +11495,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_C
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+				zval_ptr_dtor_nogc(EX_VAR(opline->op2.var));
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -19460,6 +19468,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_V
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -21259,6 +21268,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_V
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -23859,6 +23869,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_V
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -26359,6 +26370,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_V
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+				zval_ptr_dtor_nogc(EX_VAR(opline->op2.var));
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -28278,6 +28290,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_U
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -29055,6 +29068,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_U
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -30887,6 +30901,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_U
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -32602,6 +32617,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_U
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+				zval_ptr_dtor_nogc(EX_VAR(opline->op2.var));
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -32854,8 +32870,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_BOOL_NOT_SPEC_CV_HANDLER(ZEND_
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_FALSE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
+		/* The result and op1 can be the same cv zval */
+		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_TRUE(EX_VAR(opline->result.var));
-		if (IS_CV == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
+		if (IS_CV == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
 			SAVE_OPLINE();
 			GET_OP1_UNDEF_CV(val, BP_VAR_R);
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -33692,8 +33710,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_BOOL_SPEC_CV_HANDLER(ZEND_OPCO
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_TRUE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
+		/* The result and op1 can be the same cv zval */
+		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_FALSE(EX_VAR(opline->result.var));
-		if (IS_CV == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
+		if (IS_CV == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
 			SAVE_OPLINE();
 			GET_OP1_UNDEF_CV(val, BP_VAR_R);
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -48525,8 +48545,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_BOOL_NOT_SPEC_TMPVAR_HANDLER(Z
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_FALSE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
+		/* The result and op1 can be the same cv zval */
+		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_TRUE(EX_VAR(opline->result.var));
-		if ((IS_TMP_VAR|IS_VAR) == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
+		if ((IS_TMP_VAR|IS_VAR) == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
 			SAVE_OPLINE();
 			GET_OP1_UNDEF_CV(val, BP_VAR_R);
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -48789,8 +48811,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_BOOL_SPEC_TMPVAR_HANDLER(ZEND_
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_TRUE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
+		/* The result and op1 can be the same cv zval */
+		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_FALSE(EX_VAR(opline->result.var));
-		if ((IS_TMP_VAR|IS_VAR) == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
+		if ((IS_TMP_VAR|IS_VAR) == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
 			SAVE_OPLINE();
 			GET_OP1_UNDEF_CV(val, BP_VAR_R);
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -398,6 +398,8 @@ AC_DEFUN([PHP_EVAL_LIBLINE],[
        $2="[$]$2 -pthread"
      else
        PHP_RUN_ONCE(EXTRA_LDFLAGS, [$ac_i], [EXTRA_LDFLAGS="$EXTRA_LDFLAGS $ac_i"])
+        PHP_RUN_ONCE(EXTRA_LDFLAGS_PROGRAM, [$ac_i],
+            [EXTRA_LDFLAGS_PROGRAM="$EXTRA_LDFLAGS_PROGRAM $ac_i"])
      fi
    ;;
    -l*[)]
@@ -2219,7 +2221,8 @@ AC_DEFUN([PHP_SETUP_ICU],[

      ICU_LIBS=`$PKG_CONFIG --libs icu-uc icu-io icu-i18n`
      ICU_INCS=`$PKG_CONFIG --cflags-only-I icu-uc icu-io icu-i18n`
-      ICU_CXXFLAGS="-DU_USING_ICU_NAMESPACE=1"
+      ICU_CXXFLAGS=`$PKG_CONFIG --variable=CXXFLAGS icu-uc`
+      ICU_CXXFLAGS="$ICU_CXXFLAGS -DU_USING_ICU_NAMESPACE=1"

      AC_MSG_RESULT([found $ICU_VERSION])

@@ -107,8 +107,8 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=2
-PHP_RELEASE_VERSION=24
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=32
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -57,9 +57,9 @@ bc_str2num (bc_num *num, char *str, int scale)
  zero_int = FALSE;
  if ( (*ptr == '+') || (*ptr == '-'))  ptr++;  /* Sign */
  while (*ptr == '0') ptr++;			/* Skip leading zeros. */
-  while (isdigit((int)*ptr)) ptr++, digits++;	/* digits */
+  while (*ptr >= '0' && *ptr <= '9') ptr++, digits++;	/* digits */
  if (*ptr == '.') ptr++;			/* decimal point */
-  while (isdigit((int)*ptr)) ptr++, strscale++;	/* digits */
+  while (*ptr >= '0' && *ptr <= '9') ptr++, strscale++;	/* digits */
  if ((*ptr != '\0') || (digits+strscale == 0))
    {
      *num = bc_copy_num (BCG(_zero_));
@@ -0,0 +1,13 @@
+--TEST--
+Bug #78878 (Buffer underflow in bc_shift_addsub)
+--SKIPIF--
+<?php
+if (!extension_loaded('bcmath')) die('skip bcmath extension not available');
+?>
+--FILE--
+<?php
+print @bcmul("\xB26483605105519922841849335928742092", bcpowmod(2, 65535, -4e-4));
+?>
+--EXPECT--
+bc math warning: non-zero scale in modulus
+0
@@ -127,6 +127,11 @@ static void com_write_dimension(zval *object, zval *offset, zval *value)

 	obj = CDNO_FETCH(object);

+	if (offset == NULL) {
+		php_com_throw_exception(DISP_E_BADINDEX, "appending to variants is not supported");
+		return;
+	}
+
 	if (V_VT(&obj->v) == VT_DISPATCH) {
 		ZVAL_COPY_VALUE(&args[0], offset);
 		ZVAL_COPY_VALUE(&args[1], value);
@@ -0,0 +1,19 @@
+--TEST--
+Bug #78694 (Appending to a variant array causes segfault)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+?>
+--FILE--
+<?php
+foreach ([new com('WScript.Shell'), new variant([])] as $var) {
+    try {
+        $var[] = 42;
+    } catch (com_exception $ex) {
+        var_dump($ex->getMessage());
+    }
+}
+?>
+--EXPECT--
+string(38) "appending to variants is not supported"
+string(38) "appending to variants is not supported"
@@ -0,0 +1,34 @@
+--TEST--
+Bug #78775: TLS issues from HTTP request affecting other encrypted connections
+--SKIPIF--
+<?php
+if (!extension_loaded('curl')) die('skip Requires curl');
+if (getenv('SKIP_ONLINE_TESTS')) die('skip Online test');
+?>
+--FILE--
+<?php
+
+$sock = fsockopen("tls://google.com", 443);
+
+var_dump($sock);
+
+$handle = curl_init('https://self-signed.badssl.com/');
+curl_setopt_array(
+    $handle,
+    [
+        CURLOPT_RETURNTRANSFER => true,
+        CURLOPT_SSL_VERIFYPEER => true,
+    ]
+);
+
+var_dump(curl_exec($handle));
+curl_close($handle);
+
+fwrite($sock, "GET / HTTP/1.0\n\n");
+var_dump(fread($sock, 8));
+
+?>
+--EXPECTF--
+resource(%d) of type (stream)
+bool(false)
+string(8) "HTTP/1.0"
@@ -4364,6 +4364,20 @@ static int php_date_interval_initialize_from_hash(zval **return_value, php_inter
 		} \
 	} while (0);

+#define PHP_DATE_INTERVAL_READ_PROPERTY_DAYS(member) \
+	do { \
+		zval *z_arg = zend_hash_str_find(myht, "days", sizeof("days") - 1); \
+		if (z_arg && Z_TYPE_P(z_arg) == IS_FALSE) { \
+			(*intobj)->diff->member = -99999; \
+		} else if (z_arg && Z_TYPE_P(z_arg) <= IS_STRING) { \
+			zend_string *str = zval_get_string(z_arg); \
+			DATE_A64I((*intobj)->diff->member, ZSTR_VAL(str)); \
+			zend_string_release(str); \
+		} else { \
+			(*intobj)->diff->member = -1LL; \
+		} \
+	} while (0);
+
 #define PHP_DATE_INTERVAL_READ_PROPERTY_DOUBLE(element, member, def) \
 	do { \
 		zval *z_arg = zend_hash_str_find(myht, element, sizeof(element) - 1); \
@@ -4392,7 +4406,7 @@ static int php_date_interval_initialize_from_hash(zval **return_value, php_inter
 	PHP_DATE_INTERVAL_READ_PROPERTY("weekday_behavior", weekday_behavior, int, -1)
 	PHP_DATE_INTERVAL_READ_PROPERTY("first_last_day_of", first_last_day_of, int, -1)
 	PHP_DATE_INTERVAL_READ_PROPERTY("invert", invert, int, 0);
-	PHP_DATE_INTERVAL_READ_PROPERTY_I64("days", days);
+	PHP_DATE_INTERVAL_READ_PROPERTY_DAYS(days);
 	PHP_DATE_INTERVAL_READ_PROPERTY("special_type", special.type, unsigned int, 0);
 	PHP_DATE_INTERVAL_READ_PROPERTY_I64("special_amount", special.amount);
 	PHP_DATE_INTERVAL_READ_PROPERTY("have_weekday_relative", have_weekday_relative, unsigned int, 0);
@@ -5157,7 +5171,7 @@ static HashTable *date_object_get_properties_period(zval *object) /* {{{ */

 	if (period_obj->start) {
 		php_date_obj *date_obj;
-		object_init_ex(&zv, date_ce_date);
+		object_init_ex(&zv, period_obj->start_ce);
 		date_obj = Z_PHPDATE_P(&zv);
 		date_obj->time = timelib_time_clone(period_obj->start);
 	} else {
@@ -5167,7 +5181,7 @@ static HashTable *date_object_get_properties_period(zval *object) /* {{{ */

 	if (period_obj->current) {
 		php_date_obj *date_obj;
-		object_init_ex(&zv, date_ce_date);
+		object_init_ex(&zv, period_obj->start_ce);
 		date_obj = Z_PHPDATE_P(&zv);
 		date_obj->time = timelib_time_clone(period_obj->current);
 	} else {
@@ -5177,7 +5191,7 @@ static HashTable *date_object_get_properties_period(zval *object) /* {{{ */

 	if (period_obj->end) {
 		php_date_obj *date_obj;
-		object_init_ex(&zv, date_ce_date);
+		object_init_ex(&zv, period_obj->start_ce);
 		date_obj = Z_PHPDATE_P(&zv);
 		date_obj->time = timelib_time_clone(period_obj->end);
 	} else {
@@ -5214,7 +5228,7 @@ static int php_date_period_initialize_from_hash(php_period_obj *period_obj, Hash

 	ht_entry = zend_hash_str_find(myht, "start", sizeof("start")-1);
 	if (ht_entry) {
-		if (Z_TYPE_P(ht_entry) == IS_OBJECT && Z_OBJCE_P(ht_entry) == date_ce_date) {
+		if (Z_TYPE_P(ht_entry) == IS_OBJECT && instanceof_function(Z_OBJCE_P(ht_entry), date_ce_interface)) {
 			php_date_obj *date_obj;
 			date_obj = Z_PHPDATE_P(ht_entry);
 			period_obj->start = timelib_time_clone(date_obj->time);
@@ -5228,7 +5242,7 @@ static int php_date_period_initialize_from_hash(php_period_obj *period_obj, Hash

 	ht_entry = zend_hash_str_find(myht, "end", sizeof("end")-1);
 	if (ht_entry) {
-		if (Z_TYPE_P(ht_entry) == IS_OBJECT && Z_OBJCE_P(ht_entry) == date_ce_date) {
+		if (Z_TYPE_P(ht_entry) == IS_OBJECT && instanceof_function(Z_OBJCE_P(ht_entry), date_ce_interface)) {
 			php_date_obj *date_obj;
 			date_obj = Z_PHPDATE_P(ht_entry);
 			period_obj->end = timelib_time_clone(date_obj->time);
@@ -5241,7 +5255,7 @@ static int php_date_period_initialize_from_hash(php_period_obj *period_obj, Hash

 	ht_entry = zend_hash_str_find(myht, "current", sizeof("current")-1);
 	if (ht_entry) {
-		if (Z_TYPE_P(ht_entry) == IS_OBJECT && Z_OBJCE_P(ht_entry) == date_ce_date) {
+		if (Z_TYPE_P(ht_entry) == IS_OBJECT && instanceof_function(Z_OBJCE_P(ht_entry), date_ce_interface)) {
 			php_date_obj *date_obj;
 			date_obj = Z_PHPDATE_P(ht_entry);
 			period_obj->current = timelib_time_clone(date_obj->time);
@@ -39,7 +39,7 @@ DateInterval Object
    [weekday_behavior] => 0
    [first_last_day_of] => 0
    [invert] => 0
-    [days] => 0
+    [days] => 
    [special_type] => 0
    [special_amount] => 0
    [have_weekday_relative] => 0
@@ -136,7 +136,7 @@ object(DatePeriod)#5 (6) {
    ["invert"]=>
    int(0)
    ["days"]=>
-    int(0)
+    bool(false)
    ["special_type"]=>
    int(0)
    ["special_amount"]=>
@@ -71,7 +71,7 @@ object(DateInterval)#2 (16) {
  ["invert"]=>
  int(0)
  ["days"]=>
-  int(0)
+  bool(false)
  ["special_type"]=>
  int(0)
  ["special_amount"]=>
@@ -0,0 +1,14 @@
+--TEST--
+Bug #70153 (\DateInterval incorrectly unserialized)
+--FILE--
+<?php
+$i1 = \DateInterval::createFromDateString('+1 month');
+$i2 = unserialize(serialize($i1));
+var_dump($i1->days, $i2->days);
+var_dump($i2->special_amount, $i2->special_amount);
+?>
+--EXPECT--
+bool(false)
+bool(false)
+int(0)
+int(0)
@@ -0,0 +1,16 @@
+--TEST--
+Bug #78751 (Serialising DatePeriod converts DateTimeImmutable)
+--FILE--
+<?php
+$oDay = new DateTimeImmutable('2019-10-25');
+$oDateInterval = DateInterval::createFromDateString('1 day');
+$oDays = new DatePeriod($oDay, $oDateInterval, $oDay->modify('+1 day'));
+$oDays = unserialize(serialize($oDays));
+var_dump(
+    $oDays->start instanceof DateTimeImmutable,
+    $oDays->end instanceof DateTimeImmutable
+);
+?>
+--EXPECT--
+bool(true)
+bool(true)
@@ -341,7 +341,7 @@ int dom_document_encoding_write(dom_object *obj, zval *newval)

 	str = zval_get_string(newval);

-	handler = xmlFindCharEncodingHandler(Z_STRVAL_P(newval));
+	handler = xmlFindCharEncodingHandler(ZSTR_VAL(str));

    if (handler != NULL) {
 		xmlCharEncCloseFunc(handler);
@@ -21,6 +21,6 @@ domdocumentloadxml_test_method.php
 --EXPECTF--
 Warning: DOMDocument::load%r(XML){0,1}%r(): Opening and ending tag mismatch: title line 5 and book %s

-Warning: DOMDocument::load%r(XML){0,1}%r(): expected '>' %s
+Warning: DOMDocument::load%r(XML){0,1}%r(): %rexpected '>'|Opening and ending tag mismatch: book line 5 and books%r %s

-Warning: DOMDocument::load%r(XML){0,1}%r(): Premature end of data in tag books %s
+Warning: DOMDocument::load%r(XML){0,1}%r(): %rPremature end of data in tag books|EndTag: '<\/' not found in Entity, line: 13%r %s
@@ -21,6 +21,6 @@ domdocumentload_test_method.php
 --EXPECTF--
 Warning: DOMDocument::load%r(XML){0,1}%r(): Opening and ending tag mismatch: title line 5 and book %s

-Warning: DOMDocument::load%r(XML){0,1}%r(): expected '>' %s
+Warning: DOMDocument::load%r(XML){0,1}%r(): %rexpected '>'|Opening and ending tag mismatch: book line 5 and books%r %s

-Warning: DOMDocument::load%r(XML){0,1}%r(): Premature end of data in tag books %s
+Warning: DOMDocument::load%r(XML){0,1}%r(): %rPremature end of data in tag books|EndTag: '<\/' not found%r %s
@@ -0,0 +1,14 @@
+--TEST--
+Bug #77569 (Write Access Violation in DomImplementation)
+--SKIPIF--
+<?php
+if (!extension_loaded('dom')) die('skip dom extension not available');
+?>
+--FILE--
+<?php
+$imp = new DOMImplementation;
+$dom = $imp->createDocument("", "");
+$dom->encoding = null;
+?>
+--EXPECTF--
+Warning: main(): Invalid Document Encoding in %s on line %d
@@ -3165,7 +3165,8 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 			continue;
 		if (maker_note->model && (!ImageInfo->model || strcmp(maker_note->model, ImageInfo->model)))
 			continue;
-		if (maker_note->id_string && strncmp(maker_note->id_string, value_ptr, maker_note->id_string_len))
+		if (maker_note->id_string && value_len >= maker_note->id_string_len
+				&& strncmp(maker_note->id_string, value_ptr, maker_note->id_string_len))
 			continue;
 		break;
 	}
@@ -3239,8 +3240,9 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 	}

 	for (de=0;de<NumDirEntries;de++) {
-		if (!exif_process_IFD_TAG(ImageInfo, dir_start + 2 + 12 * de,
-								  offset_base, data_len, displacement, section_index, 0, maker_note->tag_table)) {
+		size_t offset = 2 + 12 * de;
+		if (!exif_process_IFD_TAG(ImageInfo, dir_start + offset,
+								  offset_base, data_len - offset, displacement, section_index, 0, maker_note->tag_table)) {
 			return FALSE;
 		}
 	}
@@ -3294,11 +3296,6 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 		/*return TRUE;*/
 	}

-	if (components < 0) {
-		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal components(%d)", tag, exif_get_tagname(tag, tagname, -12, tag_table), components);
-		return FALSE;
-	}
-
 	byte_count_signed = (int64_t)components * php_tiff_bytes_per_format[format];

 	if (byte_count_signed < 0 || (byte_count_signed > INT32_MAX)) {
@@ -3695,6 +3692,11 @@ static void exif_process_TIFF_in_JPEG(image_info_type *ImageInfo, char *CharBuf,
 {
 	unsigned exif_value_2a, offset_of_ifd;

+	if (length < 2) {
+		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Missing TIFF alignment marker");
+		return;
+	}
+
 	/* set the thumbnail stuff to nothing so we can test to see if they get set up */
 	if (memcmp(CharBuf, "II", 2) == 0) {
 		ImageInfo->motorola_intel = 0;
@@ -3847,7 +3849,7 @@ static int exif_scan_JPEG_header(image_info_type *ImageInfo)
 			return FALSE;
 		}

-		sn = exif_file_sections_add(ImageInfo, marker, itemlen+1, NULL);
+		sn = exif_file_sections_add(ImageInfo, marker, itemlen, NULL);
 		Data = ImageInfo->file.list[sn].data;

 		/* Store first two pre-read bytes. */
@@ -4603,8 +4605,9 @@ PHP_FUNCTION(exif_read_data)
 		exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "CCDWidth", "%dmm", (int)ImageInfo.CCDWidth);
 	}
 	if(ImageInfo.ExposureTime>0) {
-		if(ImageInfo.ExposureTime <= 0.5) {
-			exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "ExposureTime", "%0.3F s (1/%d)", ImageInfo.ExposureTime, (int)(0.5 + 1/ImageInfo.ExposureTime));
+		float recip_exposure_time = 0.5f + 1.0f/ImageInfo.ExposureTime;
+		if (ImageInfo.ExposureTime <= 0.5 && recip_exposure_time < INT_MAX) {
+			exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "ExposureTime", "%0.3F s (1/%d)", ImageInfo.ExposureTime, (int) recip_exposure_time);
 		} else {
 			exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "ExposureTime", "%0.3F s", ImageInfo.ExposureTime);
 		}
@@ -70,7 +70,7 @@ Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal f

 Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d

-Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal pointer offset(x30303030 + x30303030 = x60606060 > x00EE) in %sbug76557.php on line %d
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal pointer offset(x30303030 + x30303030 = x60606060 > %s) in %sbug76557.php on line %d

 Warning: exif_read_data(bug76557.jpg): File structure corrupted in %sbug76557.php on line %d

@@ -0,0 +1,12 @@
+--TEST--
+Bug #78793: Use-after-free in exif parsing under memory sanitizer
+--FILE--
+<?php
+$f = "ext/exif/tests/bug77950.tiff";
+for ($i = 0; $i < 10; $i++) {
+    @exif_read_data($f);
+}
+?>
+===DONE===
+--EXPECT--
+===DONE===
@@ -0,0 +1,17 @@
+--TEST--
+Bug #78910: Heap-buffer-overflow READ in exif (OSS-Fuzz #19044)
+--FILE--
+<?php
+
+var_dump(exif_read_data('data:image/jpg;base64,TU0AKgAAAAwgICAgAAIBDwAEAAAAAgAAACKSfCAgAAAAAEZVSklGSUxN'));
+
+?>
+--EXPECTF--
+Notice: exif_read_data(): Read from TIFF: tag(0x927C, MakerNote  ): Illegal format code 0x2020, switching to BYTE in %s on line %d
+
+Warning: exif_read_data(): Process tag(x927C=MakerNote  ): Illegal format code 0x2020, suppose BYTE in %s on line %d
+
+Warning: exif_read_data(): IFD data too short: 0x0000 offset 0x000C in %s on line %d
+
+Warning: exif_read_data(): Invalid TIFF file in %s on line %d
+bool(false)
@@ -0,0 +1,15 @@
+--TEST--
+Bug #79282: Use-of-uninitialized-value in exif
+--FILE--
+<?php
+
+var_dump(exif_read_data('data://image/jpeg;base64,/9jhAAlFeGlmAAAg'));
+
+?>
+--EXPECTF--
+Warning: exif_read_data(): Missing TIFF alignment marker in %s on line %d
+
+Warning: exif_read_data(): File structure corrupted in %s on line %d
+
+Warning: exif_read_data(): Invalid JPEG file in %s on line %d
+bool(false)
@@ -1,5 +1,11 @@
 --TEST--
 OSS-Fuzz #17474: Memory leak on duplicate Copyright tags
+--SKIPIF--
+<?php
+if (!extension_loaded('exif')) {
+    die('skip exif extension not available');
+}
+?>
 --FILE--
 <?php

@@ -1,5 +1,11 @@
 --TEST--
 OSS-Fuzz #17163: Out-of-bounds read due to tag with zero components
+--SKIPIF--
+<?php
+if (!extension_loaded('exif')) {
+    die('skip exif extension not available');
+}
+?>
 --FILE--
 <?php

@@ -1,5 +1,11 @@
 --TEST--
 OSS-Fuzz: Temporary buffer leak in tag reading
+--SKIPIF--
+<?php
+if (!extension_loaded('exif')) {
+    die('skip exif extension not available');
+}
+?>
 --FILE--
 <?php

@@ -1,5 +1,11 @@
 --TEST--
 OSS-Fuzz: Memory leak for zero-length MAKERNOTE
+--SKIPIF--
+<?php
+if (!extension_loaded('exif')) {
+    die('skip exif extension not available');
+}
+?>
 --FILE--
 <?php

@@ -1011,8 +1011,9 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 				goto out;
 			}
 			nelements = CDF_GETUINT32(q, 1);
-			if (nelements == 0) {
-				DPRINTF(("CDF_VECTOR with nelements == 0\n"));
+			if (nelements > CDF_ELEMENT_LIMIT || nelements == 0) {
+				DPRINTF(("CDF_VECTOR with nelements == %"
+				    SIZE_T_FORMAT "u\n", nelements));
 				goto out;
 			}
 			slen = 2;
@@ -1054,8 +1055,6 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 					goto out;
 				inp += nelem;
 			}
-			DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n",
-			    nelements));
 			for (j = 0; j < nelements && i < sh.sh_properties;
 			    j++, i++)
 			{
@@ -50,6 +50,7 @@
 typedef int32_t cdf_secid_t;

 #define CDF_LOOP_LIMIT					10000
+#define CDF_ELEMENT_LIMIT				100000

 #define CDF_SECID_NULL					0
 #define CDF_SECID_FREE					-1
@@ -534,7 +534,7 @@ compress(int init_bits, gdIOCtxPtr outfile, gdImagePtr im, GifCtx *ctx)
    output( (code_int)ctx->ClearCode, ctx );

 #ifdef SIGNED_COMPARE_SLOW
-    while ( (c = GIFNextPixel( im )) != (unsigned) EOF ) {
+    while ( (c = GIFNextPixel( im, ctx )) != (unsigned) EOF ) {
 #else /*SIGNED_COMPARE_SLOW*/
    while ( (c = GIFNextPixel( im, ctx )) != EOF ) {  /* } */
 #endif /*SIGNED_COMPARE_SLOW*/
@@ -286,7 +286,7 @@ PHP_MINIT_FUNCTION(miconv)
 	{
 		static char buf[16];
 		snprintf(buf, sizeof(buf), "%d.%d",
-		    ((_libiconv_version >> 8) & 0x0f), (_libiconv_version & 0x0f));
+			_libiconv_version >> 8, _libiconv_version & 0xff);
 		version = buf;
 	}
 #elif HAVE_GLIBC_ICONV
@@ -1292,7 +1292,7 @@ PHP_FUNCTION(locale_filter_matches)
 	if( boolCanonical ){
 		/* canonicalize loc_range */
 		can_loc_range=get_icu_value_internal( loc_range , LOC_CANONICALIZE_TAG , &result , 0);
-		if( result ==0) {
+		if( result <=0) {
 			intl_error_set( NULL, status,
 				"locale_filter_matches : unable to canonicalize loc_range" , 0 );
 			RETURN_FALSE;
@@ -1300,7 +1300,7 @@ PHP_FUNCTION(locale_filter_matches)

 		/* canonicalize lang_tag */
 		can_lang_tag = get_icu_value_internal( lang_tag , LOC_CANONICALIZE_TAG , &result ,  0);
-		if( result ==0) {
+		if( result <=0) {
 			intl_error_set( NULL, status,
 				"locale_filter_matches : unable to canonicalize lang_tag" , 0 );
 			RETURN_FALSE;
@@ -0,0 +1,13 @@
+--TEST--
+Bug #78804: Segmentation fault in Locale::filterMatches
+--FILE--
+<?php
+
+if (Locale::filterMatches('en-US', 'und', true)) {
+    echo 'Matches';
+} else {
+    echo 'Not matches';
+}
+?>
+--EXPECT--
+Not matches
@@ -138,6 +138,17 @@ static unsigned short cp950_pua_tbl[][4] = {
 	{0xf70f,0xf848,0xc740,0xc8fe},
 };

+static inline int is_in_cp950_pua(int c1, int c) {
+	if ((c1 >= 0xfa && c1 <= 0xfe) || (c1 >= 0x8e && c1 <= 0xa0) ||
+			(c1 >= 0x81 && c1 <= 0x8d) || (c1 >= 0xc7 && c1 <= 0xc8)) {
+		return (c >=0x40 && c <= 0x7e) || (c >= 0xa1 && c <= 0xfe);
+	}
+	if (c1 == 0xc6) {
+		return c >= 0xa1 && c <= 0xfe;
+	}
+	return 0;
+}
+
 /*
 * Big5 => wchar
 */
@@ -186,11 +197,7 @@ mbfl_filt_conv_big5_wchar(int c, mbfl_convert_filter *filter)

 			if (filter->from->no_encoding == mbfl_no_encoding_cp950) {
 				/* PUA for CP950 */
-				if (w <= 0 &&
-					(((c1 >= 0xfa && c1 <= 0xfe) || (c1 >= 0x8e && c1 <= 0xa0) ||
-					  (c1 >= 0x81 && c1 <= 0x8d) ||(c1 >= 0xc7 && c1 <= 0xc8))
-					 && ((c > 0x39 && c < 0x7f) || (c > 0xa0 && c < 0xff))) ||
-					((c1 == 0xc6) && (c > 0xa0 && c < 0xff))) {
+				if (w <= 0 && is_in_cp950_pua(c1, c)) {
 					c2 = c1 << 8 | c;
 					for (k = 0; k < sizeof(cp950_pua_tbl)/(sizeof(unsigned short)*4); k++) {
 						if (c2 >= cp950_pua_tbl[k][2] && c2 <= cp950_pua_tbl[k][3]) {
@@ -0,0 +1,10 @@
+--TEST--
+Bug #79037: global buffer-overflow in `mbfl_filt_conv_big5_wchar`
+--FILE--
+<?php
+
+var_dump(mb_convert_encoding("\x81\x3a", "UTF-8", "CP950"));
+
+?>
+--EXPECT--
+string(1) "?"
@@ -1215,7 +1215,7 @@ uint32_t zend_get_func_info(const zend_call_info *call_info, const zend_ssa *ssa
 	if (call_info->callee_func->type == ZEND_INTERNAL_FUNCTION) {
 		func_info_t *info;

-		if ((info = zend_hash_find_ptr(&func_info, Z_STR_P(CRT_CONSTANT_EX(call_info->caller_op_array, call_info->caller_init_opline->op2, ssa->rt_constants)))) != NULL) {
+		if (!call_info->callee_func->common.scope && (info = zend_hash_find_ptr(&func_info, Z_STR_P(CRT_CONSTANT_EX(call_info->caller_op_array, call_info->caller_init_opline->op2, ssa->rt_constants)))) != NULL) {
 			if (UNEXPECTED(zend_optimizer_is_disabled_func(info->name, info->name_len))) {
 				ret = MAY_BE_NULL;
 			} else if (info->info_func) {
@@ -0,0 +1,34 @@
+--TEST--
+$v = !$v/(bool)$v checks for undefined variables
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_cache_only=0
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+function undef_negation() {
+    echo "In undef_negation\n";
+    $v = !$v;
+    var_export($v);
+    echo "\n";
+}
+function undef_bool_cast() {
+    echo "In undef_bool_cast\n";
+    $v = (bool)$v;
+    var_export($v);
+    echo "\n";
+}
+undef_negation();
+undef_bool_cast();
+?>
+--EXPECTF--
+In undef_negation
+
+Notice: Undefined variable: v in %s on line 4
+true
+In undef_bool_cast
+
+Notice: Undefined variable: v in %s on line 10
+false
@@ -0,0 +1,14 @@
+--TEST--
+Internal static methods should not be confused with global functions
+--SKIPIF--
+<?php
+if (!extension_loaded('zend-test')) die('skip requires zend-test');
+?>
+--FILE--
+<?php
+
+var_dump(is_bool(_ZendTestClass::is_object()));
+
+?>
+--EXPECT--
+bool(false)
@@ -735,11 +735,11 @@ zend_op_array* zend_accel_load_script(zend_persistent_script *persistent_script,
 #define ADLER32_DO8(buf, i)     ADLER32_DO4(buf, i); ADLER32_DO4(buf, i + 4);
 #define ADLER32_DO16(buf)       ADLER32_DO8(buf, 0); ADLER32_DO8(buf, 8);

-unsigned int zend_adler32(unsigned int checksum, signed char *buf, uint32_t len)
+unsigned int zend_adler32(unsigned int checksum, unsigned char *buf, uint32_t len)
 {
 	unsigned int s1 = checksum & 0xffff;
 	unsigned int s2 = (checksum >> 16) & 0xffff;
-	signed char *end;
+	unsigned char *end;

 	while (len >= ADLER32_NMAX) {
 		len -= ADLER32_NMAX;
@@ -777,15 +777,15 @@ unsigned int zend_adler32(unsigned int checksum, signed char *buf, uint32_t len)

 unsigned int zend_accel_script_checksum(zend_persistent_script *persistent_script)
 {
-	signed char *mem = (signed char*)persistent_script->mem;
+	unsigned char *mem = (unsigned char*)persistent_script->mem;
 	size_t size = persistent_script->size;
 	size_t persistent_script_check_block_size = ((char *)&(persistent_script->dynamic_members)) - (char *)persistent_script;
 	unsigned int checksum = ADLER32_INIT;

-	if (mem < (signed char*)persistent_script) {
-		checksum = zend_adler32(checksum, mem, (signed char*)persistent_script - mem);
-		size -= (signed char*)persistent_script - mem;
-		mem  += (signed char*)persistent_script - mem;
+	if (mem < (unsigned char*)persistent_script) {
+		checksum = zend_adler32(checksum, mem, (unsigned char*)persistent_script - mem);
+		size -= (unsigned char*)persistent_script - mem;
+		mem  += (unsigned char*)persistent_script - mem;
 	}

 	zend_adler32(checksum, mem, persistent_script_check_block_size);
@@ -37,7 +37,7 @@ zend_op_array* zend_accel_load_script(zend_persistent_script *persistent_script,

 #define ADLER32_INIT 1     /* initial Adler-32 value */

-unsigned int zend_adler32(unsigned int checksum, signed char *buf, uint32_t len);
+unsigned int zend_adler32(unsigned int checksum, unsigned char *buf, uint32_t len);

 unsigned int zend_accel_script_checksum(zend_persistent_script *persistent_script);

@@ -868,7 +868,7 @@ int zend_file_cache_script_store(zend_persistent_script *script, int in_shm)
 	zend_shared_alloc_destroy_xlat_table();

 	info.checksum = zend_adler32(ADLER32_INIT, buf, script->size);
-	info.checksum = zend_adler32(info.checksum, (signed char*)ZSTR_VAL((zend_string*)ZCG(mem)), info.str_size);
+	info.checksum = zend_adler32(info.checksum, (unsigned char*)ZSTR_VAL((zend_string*)ZCG(mem)), info.str_size);

 #ifdef HAVE_SYS_UIO_H
 	vec[0].iov_base = &info;
@@ -1371,6 +1371,7 @@ zend_persistent_script *zend_file_cache_script_load(zend_file_handle *file_handl
 	zend_accel_hash_entry *bucket;
 	void *mem, *checkpoint, *buf;
 	int cache_it = 1;
+	unsigned int actual_checksum;
 	int ok;

 	if (!full_path) {
@@ -1458,8 +1459,8 @@ zend_persistent_script *zend_file_cache_script_load(zend_file_handle *file_handl

 	/* verify checksum */
 	if (ZCG(accel_directives).file_cache_consistency_checks &&
-	    zend_adler32(ADLER32_INIT, mem, info.mem_size + info.str_size) != info.checksum) {
-		zend_accel_error(ACCEL_LOG_WARNING, "corrupted file '%s'\n", filename);
+	    (actual_checksum = zend_adler32(ADLER32_INIT, mem, info.mem_size + info.str_size)) != info.checksum) {
+		zend_accel_error(ACCEL_LOG_WARNING, "corrupted file '%s' excepted checksum: 0x%08x actual checksum: 0x%08x\n", filename, info.checksum, actual_checksum);
 		unlink(filename);
 		zend_arena_release(&CG(arena), checkpoint);
 		efree(filename);
@@ -1545,6 +1546,8 @@ use_process_mem:
 		zend_accel_hash_update(&ZCSG(hash), ZSTR_VAL(script->script.filename), ZSTR_LEN(script->script.filename), 0, script);

 		zend_shared_alloc_unlock();
+		zend_accel_error(ACCEL_LOG_INFO, "File cached script loaded into memory '%s'", ZSTR_VAL(script->script.filename));
+
 		zend_arena_release(&CG(arena), checkpoint);
 	}
 	efree(filename);
@@ -1873,6 +1873,7 @@ static int php_openssl_enable_crypto(php_stream *stream,
 		do {
 			struct timeval cur_time, elapsed_time;

+			ERR_clear_error();
 			if (sslsock->is_client) {
 				n = SSL_connect(sslsock->ssl_handle);
 			} else {
@@ -2045,6 +2046,7 @@ static size_t php_openssl_sockop_io(int read, php_stream *stream, char *buf, siz
 			}

 			/* Now, do the IO operation. Don't block if we can't complete... */
+			ERR_clear_error();
 			if (read) {
 				nr_bytes = SSL_read(sslsock->ssl_handle, buf, (int)count);

@@ -322,7 +322,7 @@ static zend_always_inline int calculate_unit_length(pcre_cache_entry *pce, char

 /* {{{ pcre_get_compiled_regex_cache
 */
-PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(zend_string *regex)
+PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache_ex(zend_string *regex, int locale_aware)
 {
 	pcre				*re = NULL;
 	pcre_extra			*extra;
@@ -344,7 +344,7 @@ PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(zend_string *regex)
 	zend_string 		*key;

 #if HAVE_SETLOCALE
-	if (BG(locale_string) &&
+	if (locale_aware && BG(locale_string) &&
 		(ZSTR_LEN(BG(locale_string)) != 1 && ZSTR_VAL(BG(locale_string))[0] != 'C')) {
 		key = zend_string_alloc(ZSTR_LEN(regex) + ZSTR_LEN(BG(locale_string)) + 1, 0);
 		memcpy(ZSTR_VAL(key), ZSTR_VAL(BG(locale_string)), ZSTR_LEN(BG(locale_string)) + 1);
@@ -636,6 +636,14 @@ PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(zend_string *regex)
 }
 /* }}} */

+/* {{{ pcre_get_compiled_regex_cache
+ */
+PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(zend_string *regex)
+{
+	return pcre_get_compiled_regex_cache_ex(regex, 1);
+}
+/* }}} */
+
 /* {{{ pcre_get_compiled_regex
 */
 PHPAPI pcre* pcre_get_compiled_regex(zend_string *regex, pcre_extra **extra, int *preg_options)
@@ -57,6 +57,7 @@ typedef struct {
 } pcre_cache_entry;

 PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(zend_string *regex);
+PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache_ex(zend_string *regex, int locale_aware);

 PHPAPI void  php_pcre_match_impl(  pcre_cache_entry *pce, char *subject, int subject_len, zval *return_value,
 	zval *subpats, int global, int use_flags, zend_long flags, zend_long start_offset);
@@ -1386,6 +1386,7 @@ int phar_create_or_parse_filename(char *fname, int fname_len, char *alias, int a
 	mydata = ecalloc(1, sizeof(phar_archive_data));
 	mydata->fname = expand_filepath(fname, NULL);
 	if (mydata->fname == NULL) {
+		efree(mydata);
 		return FAILURE;
 	}
 	fname_len = strlen(mydata->fname);
@@ -1439,6 +1439,7 @@ static int phar_build(zend_object_iterator *iter, void *puser) /* {{{ */
 	char *str_key;
 	zend_class_entry *ce = p_obj->c;
 	phar_archive_object *phar_obj = p_obj->p;
+	php_stream_statbuf ssb;

 	value = iter->funcs->get_current_data(iter);

@@ -1718,6 +1719,16 @@ after_open_fp:
 		php_stream_copy_to_stream_ex(fp, p_obj->fp, PHP_STREAM_COPY_ALL, &contents_len);
 		data->internal_file->uncompressed_filesize = data->internal_file->compressed_filesize =
 			php_stream_tell(p_obj->fp) - data->internal_file->offset;
+		if (php_stream_stat(fp, &ssb) != -1) {
+			data->internal_file->flags = ssb.sb.st_mode & PHAR_ENT_PERM_MASK ;
+		} else {
+#ifndef _WIN32
+			mode_t mask;
+			mask = umask(0);
+			umask(mask);
+			data->internal_file->flags &= ~mask;
+#endif
+		}
 	}

 	if (close_fp) {
@@ -5,11 +5,11 @@ Bug #77396 Relative filename exceeding maximum path length causes null pointer d
 --FILE--
 <?php
 $path = '../' . str_repeat("x", PHP_MAXPATHLEN) . '.tar';
-$phar = new PharData($path);
+try {
+    $phar = new PharData($path);
+} catch (UnexpectedValueException $e) {
+    echo $e->getMessage(), "\n";
+}
 ?>
--EXPECTF--
-Fatal error: Uncaught UnexpectedValueException: Phar creation or opening failed in %s%ebug77396.php:%d
-Stack trace:
-#0 %s%ebug77396.php(%d): PharData->__construct(%s)
-#1 {main}
-  thrown in %s%ebug77396.php on line %d
+--EXPECT--
+Phar creation or opening failed
@@ -0,0 +1,52 @@
+--TEST--
+Phar: Bug #79082: Files added to tar with Phar::buildFromIterator have all-access permissions
+--SKIPIF--
+<?php 
+if (!extension_loaded("phar")) die("skip"); 
+if (defined("PHP_WINDOWS_VERSION_MAJOR")) die("skip not for Windows")
+?>
+--FILE--
+<?php
+umask(022);
+var_dump(decoct(umask()));
+chmod(__DIR__ . '/test79082/test79082-testfile', 0644);
+chmod(__DIR__ . '/test79082/test79082-testfile2', 0400);
+
+foreach([Phar::TAR => 'tar', Phar::ZIP => 'zip'] as $mode => $ext) {
+	clearstatcache();
+	$phar = new PharData(__DIR__ . '/test79082.' . $ext, null, null, $mode);
+	$phar->buildFromIterator(new \RecursiveDirectoryIterator(__DIR__ . '/test79082', \FilesystemIterator::SKIP_DOTS), __DIR__ . '/test79082');
+	$phar->extractTo(__DIR__);
+	var_dump(decoct(stat(__DIR__ . '/test79082-testfile')['mode']));
+	var_dump(decoct(stat(__DIR__ . '/test79082-testfile2')['mode']));
+	unlink(__DIR__ . '/test79082-testfile');
+	unlink(__DIR__ . '/test79082-testfile2');
+}
+foreach([Phar::TAR => 'tar', Phar::ZIP => 'zip'] as $mode => $ext) {
+	clearstatcache();
+	$phar = new PharData(__DIR__ . '/test79082-d.' . $ext, null, null, $mode);
+	$phar->buildFromDirectory(__DIR__ . '/test79082');
+	$phar->extractTo(__DIR__);
+	var_dump(decoct(stat(__DIR__ . '/test79082-testfile')['mode']));
+	var_dump(decoct(stat(__DIR__ . '/test79082-testfile2')['mode']));
+	unlink(__DIR__ . '/test79082-testfile');
+	unlink(__DIR__ . '/test79082-testfile2');
+}
+?>
+--CLEAN--
+<?
+unlink(__DIR__ . '/test79082.tar');
+unlink(__DIR__ . '/test79082.zip');
+unlink(__DIR__ . '/test79082-d.tar');
+unlink(__DIR__ . '/test79082-d.zip');
+?>
+--EXPECT--
+string(2) "22"
+string(6) "100644"
+string(6) "100400"
+string(6) "100644"
+string(6) "100400"
+string(6) "100644"
+string(6) "100400"
+string(6) "100644"
+string(6) "100400"
@@ -0,0 +1 @@
+test
@@ -0,0 +1 @@
+test
@@ -5140,7 +5140,7 @@ ZEND_METHOD(reflection_class, implementsInterface)

 	if (!(interface_ce->ce_flags & ZEND_ACC_INTERFACE)) {
 		zend_throw_exception_ex(reflection_exception_ptr, 0,
-				"Interface %s is a Class", ZSTR_VAL(interface_ce->name));
+				"%s is not an interface", ZSTR_VAL(interface_ce->name));
 		return;
 	}
 	RETURN_BOOL(instanceof_function(ce, interface_ce));
@@ -67,14 +67,14 @@ try {
 ?>
 --EXPECTF--
 Does A implement A? 
-   - Using object argument: Interface A is a Class
-   - Using string argument: Interface A is a Class
+   - Using object argument: A is not an interface
+   - Using string argument: A is not an interface
 Does A implement B? 
-   - Using object argument: Interface B is a Class
-   - Using string argument: Interface B is a Class
+   - Using object argument: B is not an interface
+   - Using string argument: B is not an interface
 Does A implement C? 
-   - Using object argument: Interface C is a Class
-   - Using string argument: Interface C is a Class
+   - Using object argument: C is not an interface
+   - Using string argument: C is not an interface
 Does A implement I1? 
   - Using object argument: bool(true)
   - Using string argument: bool(true)
@@ -82,14 +82,14 @@ Does A implement I2?
   - Using object argument: bool(false)
   - Using string argument: bool(false)
 Does B implement A? 
-   - Using object argument: Interface A is a Class
-   - Using string argument: Interface A is a Class
+   - Using object argument: A is not an interface
+   - Using string argument: A is not an interface
 Does B implement B? 
-   - Using object argument: Interface B is a Class
-   - Using string argument: Interface B is a Class
+   - Using object argument: B is not an interface
+   - Using string argument: B is not an interface
 Does B implement C? 
-   - Using object argument: Interface C is a Class
-   - Using string argument: Interface C is a Class
+   - Using object argument: C is not an interface
+   - Using string argument: C is not an interface
 Does B implement I1? 
   - Using object argument: bool(true)
   - Using string argument: bool(true)
@@ -97,14 +97,14 @@ Does B implement I2?
   - Using object argument: bool(false)
   - Using string argument: bool(false)
 Does C implement A? 
-   - Using object argument: Interface A is a Class
-   - Using string argument: Interface A is a Class
+   - Using object argument: A is not an interface
+   - Using string argument: A is not an interface
 Does C implement B? 
-   - Using object argument: Interface B is a Class
-   - Using string argument: Interface B is a Class
+   - Using object argument: B is not an interface
+   - Using string argument: B is not an interface
 Does C implement C? 
-   - Using object argument: Interface C is a Class
-   - Using string argument: Interface C is a Class
+   - Using object argument: C is not an interface
+   - Using string argument: C is not an interface
 Does C implement I1? 
   - Using object argument: bool(true)
   - Using string argument: bool(true)
@@ -112,14 +112,14 @@ Does C implement I2?
   - Using object argument: bool(true)
   - Using string argument: bool(true)
 Does I1 implement A? 
-   - Using object argument: Interface A is a Class
-   - Using string argument: Interface A is a Class
+   - Using object argument: A is not an interface
+   - Using string argument: A is not an interface
 Does I1 implement B? 
-   - Using object argument: Interface B is a Class
-   - Using string argument: Interface B is a Class
+   - Using object argument: B is not an interface
+   - Using string argument: B is not an interface
 Does I1 implement C? 
-   - Using object argument: Interface C is a Class
-   - Using string argument: Interface C is a Class
+   - Using object argument: C is not an interface
+   - Using string argument: C is not an interface
 Does I1 implement I1? 
   - Using object argument: bool(true)
   - Using string argument: bool(true)
@@ -127,14 +127,14 @@ Does I1 implement I2?
   - Using object argument: bool(false)
   - Using string argument: bool(false)
 Does I2 implement A? 
-   - Using object argument: Interface A is a Class
-   - Using string argument: Interface A is a Class
+   - Using object argument: A is not an interface
+   - Using string argument: A is not an interface
 Does I2 implement B? 
-   - Using object argument: Interface B is a Class
-   - Using string argument: Interface B is a Class
+   - Using object argument: B is not an interface
+   - Using string argument: B is not an interface
 Does I2 implement C? 
-   - Using object argument: Interface C is a Class
-   - Using string argument: Interface C is a Class
+   - Using object argument: C is not an interface
+   - Using string argument: C is not an interface
 Does I2 implement I1? 
   - Using object argument: bool(true)
   - Using string argument: bool(true)
@@ -0,0 +1,14 @@
+--TEST--
+Bug #78697: ReflectionClass::implementsInterface - inaccurate error message with traits
+--FILE--
+<?php
+trait T {}
+
+try {
+    (new ReflectionClass(new stdClass))->implementsInterface(T::class);
+} catch (ReflectionException $e) {
+    echo $e->getMessage();
+}
+?>
+--EXPECT--
+T is not an interface
@@ -2198,6 +2198,7 @@ static PHP_FUNCTION(session_create_id)
 				/* Detect collision and retry */
 				if (PS(mod)->s_validate_sid(&PS(mod_data), new_id) == FAILURE) {
 					zend_string_release(new_id);
+					new_id = NULL;
 					continue;
 				}
 				break;
@@ -3218,10 +3219,12 @@ static int php_session_rfc1867_callback(unsigned int event, void *event_data, vo
 				if (PS(rfc1867_cleanup)) {
 					php_session_rfc1867_cleanup(progress);
 				} else {
-					SEPARATE_ARRAY(&progress->data);
-					add_assoc_bool_ex(&progress->data, "done", sizeof("done") - 1, 1);
-					Z_LVAL_P(progress->post_bytes_processed) = data->post_bytes_processed;
-					php_session_rfc1867_update(progress, 1);
+					if (!Z_ISUNDEF(progress->data)) {
+						SEPARATE_ARRAY(&progress->data);
+						add_assoc_bool_ex(&progress->data, "done", sizeof("done") - 1, 1);
+						Z_LVAL_P(progress->post_bytes_processed) = data->post_bytes_processed;
+						php_session_rfc1867_update(progress, 1);
+					}
 				}
 				php_rshutdown_session_globals();
 			}
@@ -0,0 +1,67 @@
+--TEST--
+Bug #79091 (heap use-after-free in session_create_id())
+--SKIPIF--
+<?php
+if (!extension_loaded('session')) die('skip session extension not available');
+?>
+--FILE--
+<?php
+class MySessionHandler implements SessionHandlerInterface, SessionIdInterface, SessionUpdateTimestampHandlerInterface
+{
+    public function close()
+    {
+        return true;
+    }
+
+    public function destroy($session_id)
+    {
+        return true;
+    }
+
+    public function gc($maxlifetime)
+    {
+        return true;
+    }
+
+    public function open($save_path, $session_name)
+    {
+        return true;
+    }
+
+    public function read($session_id)
+    {
+        return '';
+    }
+
+    public function write($session_id, $session_data)
+    {
+        return true;
+    }
+
+    public function create_sid()
+    {
+        return uniqid();
+    }
+
+    public function updateTimestamp($key, $val)
+    {
+        return true;
+    }
+
+    public function validateId($key)
+    {
+        return false;
+    }
+}
+
+ob_start();
+var_dump(session_set_save_handler(new MySessionHandler()));
+var_dump(session_start());
+ob_flush();
+session_create_id();
+?>
+--EXPECTF--
+bool(true)
+bool(true)
+
+Warning: session_create_id(): Failed to create new ID in %s on line %d
@@ -0,0 +1,45 @@
+--TEST--
+Null Pointer Dereference in PHP Session Upload Progress
+--INI--
+error_reporting=0
+file_uploads=1
+upload_max_filesize=1024
+session.save_path=
+session.name=PHPSESSID
+session.serialize_handler=php
+session.use_strict_mode=0
+session.use_cookies=1
+session.use_only_cookies=0
+session.upload_progress.enabled=1
+session.upload_progress.cleanup=0
+session.upload_progress.prefix=upload_progress_
+session.upload_progress.name=PHP_SESSION_UPLOAD_PROGRESS
+session.upload_progress.freq=1%
+session.upload_progress.min_freq=0.000000001
+--COOKIE--
+PHPSESSID=session-upload
+--POST_RAW--
+Content-Type: multipart/form-data; boundary=---------------------------20896060251896012921717172737
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="PHPSESSID"
+
+session-upload
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="PHP_SESSION_UPLOAD_PROGRESS"
+
+ryat
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; file="file"; ryat="filename"
+
+1
+-----------------------------20896060251896012921717172737--
+--FILE--
+<?php
+
+session_start();
+var_dump($_SESSION);
+session_destroy();
+
+--EXPECTF--
+array(0) {
+}
@@ -3,6 +3,7 @@ Bug #76348 (WSDL_CACHE_MEMORY causes Segmentation fault)
 --SKIPIF--
 <?php
 if (!extension_loaded('soap')) die('skip soap extension not available');
+if (getenv("SKIP_ONLINE_TESTS")) die("skip online test");
 ?>
 --FILE--
 <?php
@@ -652,6 +652,7 @@ retry:
 		goto retry;
 	}
 	if (retval != NO_ERROR) {
+		efree(addr_table);
 		php_error_docref(NULL, E_WARNING,
 			"GetIpAddrTable failed with error %lu", retval);
 		return FAILURE;
@@ -660,9 +661,11 @@ retry:
 		MIB_IPADDRROW r = addr_table->table[i];
 		if (r.dwIndex == if_index) {
 			out_addr->s_addr = r.dwAddr;
+			efree(addr_table);
 			return SUCCESS;
 		}
 	}
+	efree(addr_table);
 	php_error_docref(NULL, E_WARNING,
 		"No interface with index %u was found", if_index);
 	return FAILURE;
@@ -692,6 +695,7 @@ retry:
 		goto retry;
 	}
 	if (retval != NO_ERROR) {
+		efree(addr_table);
 		php_error_docref(NULL, E_WARNING,
 			"GetIpAddrTable failed with error %lu", retval);
 		return FAILURE;
@@ -700,9 +704,11 @@ retry:
 		MIB_IPADDRROW r = addr_table->table[i];
 		if (r.dwAddr == addr->s_addr) {
 			*if_index = r.dwIndex;
+			efree(addr_table);
 			return SUCCESS;
 		}
 	}
+	efree(addr_table);

 	{
 		char addr_str[17] = {0};
@@ -708,10 +708,10 @@ void spl_filesystem_object_construct(INTERNAL_FUNCTION_PARAMETERS, zend_long cto

 	if (SPL_HAS_FLAG(ctor_flags, DIT_CTOR_FLAGS)) {
 		flags = SPL_FILE_DIR_KEY_AS_PATHNAME|SPL_FILE_DIR_CURRENT_AS_FILEINFO;
-		parsed = zend_parse_parameters(ZEND_NUM_ARGS(), "s|l", &path, &len, &flags);
+		parsed = zend_parse_parameters(ZEND_NUM_ARGS(), "p|l", &path, &len, &flags);
 	} else {
 		flags = SPL_FILE_DIR_KEY_AS_PATHNAME|SPL_FILE_DIR_CURRENT_AS_SELF;
-		parsed = zend_parse_parameters(ZEND_NUM_ARGS(), "s", &path, &len);
+		parsed = zend_parse_parameters(ZEND_NUM_ARGS(), "p", &path, &len);
 	}
 	if (SPL_HAS_FLAG(ctor_flags, SPL_FILE_DIR_SKIPDOTS)) {
 		flags |= SPL_FILE_DIR_SKIPDOTS;
@@ -5,7 +5,7 @@ Bug #54291 (Crash iterating DirectoryIterator for dir name starting with \0)
 $dir = new DirectoryIterator("\x00/abc");
 $dir->isFile();
 --EXPECTF--
-Fatal error: Uncaught UnexpectedValueException: Failed to open directory "" in %s:%d
+Fatal error: Uncaught UnexpectedValueException: DirectoryIterator::__construct() expects parameter 1 to be a valid path, string given in %s:%d
 Stack trace:
 #0 %s(%d): DirectoryIterator->__construct('\x00/abc')
 #1 {main}
@@ -0,0 +1,31 @@
+--TEST--
+Bug #78863 (DirectoryIterator class silently truncates after a null byte)
+--FILE--
+<?php
+$dir = __DIR__ . '/bug78863';
+mkdir($dir);
+touch("$dir/bad");
+mkdir("$dir/sub");
+touch("$dir/sub/good");
+
+$it = new DirectoryIterator(__DIR__ . "/bug78863\0/sub");
+foreach ($it as $fileinfo) {
+    if (!$fileinfo->isDot()) {
+        var_dump($fileinfo->getFilename());
+    }
+}
+?>
+--EXPECTF--
+Fatal error: Uncaught UnexpectedValueException: DirectoryIterator::__construct() expects parameter 1 to be a valid path, string given in %s:%d
+Stack trace:
+#0 %s(%d): DirectoryIterator->__construct('%s')
+#1 {main}
+  thrown in %s on line %d
+--CLEAN--
+<?php
+$dir = __DIR__ . '/bug78863';
+unlink("$dir/sub/good");
+rmdir("$dir/sub");
+unlink("$dir/bad");
+rmdir($dir);
+?>
@@ -1578,7 +1578,7 @@ static inline void php_search_array(INTERNAL_FUNCTION_PARAMETERS, int behavior)
 	ZEND_PARSE_PARAMETERS_END();

 	if (strict) {
-		ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL_P(array), num_idx, str_idx, entry) {
+		ZEND_HASH_FOREACH_KEY_VAL_IND(Z_ARRVAL_P(array), num_idx, str_idx, entry) {
 			ZVAL_DEREF(entry);
 			if (fast_is_identical_function(value, entry)) {
 				if (behavior == 0) {
@@ -1595,7 +1595,7 @@ static inline void php_search_array(INTERNAL_FUNCTION_PARAMETERS, int behavior)
 		} ZEND_HASH_FOREACH_END();
 	} else {
 		if (Z_TYPE_P(value) == IS_LONG) {
-			ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL_P(array), num_idx, str_idx, entry) {
+			ZEND_HASH_FOREACH_KEY_VAL_IND(Z_ARRVAL_P(array), num_idx, str_idx, entry) {
 				if (fast_equal_check_long(value, entry)) {
 					if (behavior == 0) {
 						RETURN_TRUE;
@@ -1610,7 +1610,7 @@ static inline void php_search_array(INTERNAL_FUNCTION_PARAMETERS, int behavior)
 				}
 			} ZEND_HASH_FOREACH_END();
 		} else if (Z_TYPE_P(value) == IS_STRING) {
-			ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL_P(array), num_idx, str_idx, entry) {
+			ZEND_HASH_FOREACH_KEY_VAL_IND(Z_ARRVAL_P(array), num_idx, str_idx, entry) {
 				if (fast_equal_check_string(value, entry)) {
 					if (behavior == 0) {
 						RETURN_TRUE;
@@ -1625,7 +1625,7 @@ static inline void php_search_array(INTERNAL_FUNCTION_PARAMETERS, int behavior)
 				}
 			} ZEND_HASH_FOREACH_END();
 		} else {
-			ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL_P(array), num_idx, str_idx, entry) {
+			ZEND_HASH_FOREACH_KEY_VAL_IND(Z_ARRVAL_P(array), num_idx, str_idx, entry) {
 				if (fast_equal_check_function(value, entry)) {
 					if (behavior == 0) {
 						RETURN_TRUE;
@@ -1,11 +1,11 @@
-/* 
+/*
                      DO NOT EDIT THIS FILE!

- it has been automaticaly created by php7/scripts/credits from  
+ it has been automaticaly created by php7/scripts/credits from
 the information found in the various php7/ext/.../CREDITS and
- php7/sapi/.../CREDITS files 
- 
- if you want to change an entry you have to edit the appropriate 
+ php7/sapi/.../CREDITS files
+
+ if you want to change an entry you have to edit the appropriate
 CREDITS file instead

 */
@@ -28,7 +28,7 @@ CREDIT_LINE("FTP", "Stefan Esser, Andrew Skalski");
 CREDIT_LINE("GD imaging", "Rasmus Lerdorf, Stig Bakken, Jim Winstead, Jouni Ahto, Ilia Alshanetsky, Pierre-Alain Joye, Marcus Boerger");
 CREDIT_LINE("GetText", "Alex Plotnick");
 CREDIT_LINE("GNU GMP support", "Stanislav Malyshev");
-CREDIT_LINE("Iconv", "Rui Hirokawa, Stig Bakken, Moriyoshi Koizumi ");
+CREDIT_LINE("Iconv", "Rui Hirokawa, Stig Bakken, Moriyoshi Koizumi");
 CREDIT_LINE("IMAP", "Rex Logan, Mark Musone, Brian Wang, Kaj-Michael Lang, Antoni Pamies Olive, Rasmus Lerdorf, Andrew Skalski, Chuck Hagenbuch, Daniel R Kalowsky");
 CREDIT_LINE("Input Filter", "Rasmus Lerdorf, Derick Rethans, Pierre-Alain Joye, Ilia Alshanetsky");
 CREDIT_LINE("InterBase", "Jouni Ahto, Andrew Avdeev, Ard Biesheuvel");
@@ -1,11 +1,11 @@
-/* 
+/*
                      DO NOT EDIT THIS FILE!

- it has been automaticaly created by php7/scripts/credits from  
+ it has been automaticaly created by php7/scripts/credits from
 the information found in the various php7/ext/.../CREDITS and
- php7/sapi/.../CREDITS files 
- 
- if you want to change an entry you have to edit the appropriate 
+ php7/sapi/.../CREDITS files
+
+ if you want to change an entry you have to edit the appropriate
 CREDITS file instead

 */
@@ -531,6 +531,15 @@ PHP_FUNCTION(shell_exec)
 		Z_PARAM_STRING(command, command_len)
 	ZEND_PARSE_PARAMETERS_END();

+	if (!command_len) {
+		php_error_docref(NULL, E_WARNING, "Cannot execute a blank command");
+		RETURN_FALSE;
+	}
+	if (strlen(command) != command_len) {
+		php_error_docref(NULL, E_WARNING, "NULL byte detected. Possible attack");
+		RETURN_FALSE;
+	}
+
 #ifdef PHP_WIN32
 	if ((in=VCWD_POPEN(command, "rt"))==NULL) {
 #else
@@ -211,7 +211,7 @@ PHP_FUNCTION(link)

 	/*First argument to link function is the target and hence should go to frompath
 	  Second argument to link function is the link itself and hence should go to topath */
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "ss", &frompath, &frompath_len, &topath, &topath_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS(), "pp", &frompath, &frompath_len, &topath, &topath_len) == FAILURE) {
 		return;
 	}

@@ -343,10 +343,13 @@ PHP_FUNCTION(pack)
 				if (arg < 0) {
 					arg = num_args - currentarg;
 				}
-
+				if (currentarg > INT_MAX - arg) {
+					goto too_few_args;
+				}
 				currentarg += arg;

 				if (currentarg > num_args) {
+too_few_args:
 					efree(formatcodes);
 					efree(formatargs);
 					php_error_docref(NULL, E_WARNING, "Type %c: too few arguments", code);
@@ -4663,7 +4663,7 @@ int php_tag_find(char *tag, size_t len, const char *set) {
 					if (state == 0) {
 						state=1;
 					}
-					if (c != '/') {
+					if (c != '/' || (*(t-1) != '<' && *(t+1) != '>')) {
 						*(n++) = c;
 					}
 				} else {
@@ -4816,7 +4816,7 @@ PHPAPI size_t php_strip_tags_ex(char *rbuf, size_t len, uint8_t *stateptr, const
 				switch (state) {
 					case 1: /* HTML/XML */
 						lc = '>';
-						if (is_xml && *(p -1) == '-') {
+						if (is_xml && p >= buf + 1 && *(p-1) == '-') {
 							break;
 						}
 						in_q = state = is_xml = 0;
@@ -4837,7 +4837,7 @@ PHPAPI size_t php_strip_tags_ex(char *rbuf, size_t len, uint8_t *stateptr, const
 						break;

 					case 2: /* PHP */
-						if (!br && lc != '\"' && *(p-1) == '?') {
+						if (!br && lc != '\"' && p >= buf + 1 && *(p-1) == '?') {
 							in_q = state = 0;
 							tp = tbuf;
 						}
@@ -4866,7 +4866,7 @@ PHPAPI size_t php_strip_tags_ex(char *rbuf, size_t len, uint8_t *stateptr, const
 				if (state == 4) {
 					/* Inside <!-- comment --> */
 					break;
-				} else if (state == 2 && *(p-1) != '\\') {
+				} else if (state == 2 && p >= buf + 1 && *(p-1) != '\\') {
 					if (lc == c) {
 						lc = '\0';
 					} else if (lc != '\\') {
@@ -4893,7 +4893,7 @@ PHPAPI size_t php_strip_tags_ex(char *rbuf, size_t len, uint8_t *stateptr, const

 			case '!':
 				/* JavaScript & Other HTML scripting languages */
-				if (state == 1 && *(p-1) == '<') {
+				if (state == 1 && p >= buf + 1 && *(p-1) == '<') {
 					state = 3;
 					lc = c;
 				} else {
@@ -4920,7 +4920,7 @@ PHPAPI size_t php_strip_tags_ex(char *rbuf, size_t len, uint8_t *stateptr, const

 			case '?':

-				if (state == 1 && *(p-1) == '<') {
+				if (state == 1 && p >= buf + 1 && *(p-1) == '<') {
 					br=0;
 					state=2;
 					break;
@@ -0,0 +1,15 @@
+--TEST--
+Bug #78759: array_search in $GLOBALS
+--FILE--
+<?php
+
+$a = 22;
+var_dump($GLOBALS["a"]);
+var_dump(array_search(22, $GLOBALS));
+var_dump(array_search(22, $GLOBALS, true));
+
+?>
+--EXPECT--
+int(22)
+string(1) "a"
+string(1) "a"
@@ -0,0 +1,32 @@
+--TEST--
+Bug #79099 (OOB read in php_strip_tags_ex)
+--FILE--
+<?php
+$stream = fopen('php://memory', 'w+');
+fputs($stream, "<?\n\"\n");
+rewind($stream);
+var_dump(fgetss($stream));
+var_dump(fgetss($stream));
+fclose($stream);
+
+$stream = fopen('php://memory', 'w+');
+fputs($stream, "<\0\n!\n");
+rewind($stream);
+var_dump(fgetss($stream));
+var_dump(fgetss($stream));
+fclose($stream);
+
+$stream = fopen('php://memory', 'w+');
+fputs($stream, "<\0\n?\n");
+rewind($stream);
+var_dump(fgetss($stream));
+var_dump(fgetss($stream));
+fclose($stream);
+?>
+--EXPECT--
+string(0) ""
+string(0) ""
+string(0) ""
+string(0) ""
+string(0) ""
+string(0) ""
@@ -0,0 +1,17 @@
+--TEST--
+Bug #78862 (link() silently truncates after a null byte on Windows)
+--FILE--
+<?php
+file_put_contents(__DIR__ . '/bug78862.target', 'foo');
+var_dump(link(__DIR__ . "/bug78862.target\0more", __DIR__ . "/bug78862.link\0more"));
+var_dump(file_exists(__DIR__ . '/bug78862.link'));
+?>
+--EXPECTF--
+Warning: link() expects parameter 1 to be a valid path, string given in %s on line %d
+NULL
+bool(false)
+--CLEAN--
+<?php
+unlink(__DIR__ . '/bug78862.target');
+unlink(__DIR__ . '/bug78862.link');
+?>
@@ -0,0 +1,21 @@
+--TEST--
+Bug #79468	SIGSEGV when closing stream handle with a stream filter appended
+--SKIPIF--
+<?php
+$filters = stream_get_filters();
+if(! in_array( "string.rot13", $filters )) die( "skip rot13 filter not available." );
+?>
+--FILE--
+<?php
+$fp = fopen('php://temp', 'rb');
+$rot13_filter = stream_filter_append($fp, "string.rot13", STREAM_FILTER_WRITE);
+fwrite($fp, "This is ");
+fclose($fp);
+try {
+    stream_filter_remove($rot13_filter);
+} catch (\Throwable $e) {
+    var_dump($e->getMessage());
+}
+?>
+--EXPECTF--
+Warning: stream_filter_remove(): Invalid resource given, not a stream filter in %s on line %d
@@ -0,0 +1,8 @@
+--TEST--
+Bug #78814 (strip_tags allows / in tag name => whitelist bypass)
+--FILE--
+<?php
+echo strip_tags("<s/trong>b</strong>", "<strong>");
+?>
+--EXPECT--
+b</strong>
@@ -0,0 +1,9 @@
+--TEST--
+Bug #78833 (Integer overflow in pack causes out-of-bound access)
+--FILE--
+<?php
+var_dump(pack("E2E2147483647H*", 0x0, 0x0, 0x0));
+?>
+--EXPECTF--
+Warning: pack(): Type E: too few arguments in %s on line %d
+bool(false)
@@ -559,7 +559,7 @@ PHPAPI size_t php_url_decode(char *str, size_t len)
 #ifndef CHARSET_EBCDIC
 			*dest = (char) php_htoi(data + 1);
 #else
-			*dest = os_toebcdic[(char) php_htoi(data + 1)];
+			*dest = os_toebcdic[(unsigned char) php_htoi(data + 1)];
 #endif
 			data += 2;
 			len -= 2;
@@ -651,7 +651,7 @@ PHPAPI size_t php_raw_url_decode(char *str, size_t len)
 #ifndef CHARSET_EBCDIC
 			*dest = (char) php_htoi(data + 1);
 #else
-			*dest = os_toebcdic[(char) php_htoi(data + 1)];
+			*dest = os_toebcdic[(unsigned char) php_htoi(data + 1)];
 #endif
 			data += 2;
 			len -= 2;
@@ -680,7 +680,7 @@ PHP_FUNCTION(get_headers)
 	php_stream_context *context;

 	ZEND_PARSE_PARAMETERS_START(1, 3)
-		Z_PARAM_STRING(url, url_len)
+		Z_PARAM_PATH(url, url_len)
 		Z_PARAM_OPTIONAL
 		Z_PARAM_LONG(format)
 		Z_PARAM_RESOURCE_EX(zcontext, 1, 0)
@@ -149,17 +149,20 @@ static zend_function *zend_test_class_method_get(zend_object **object, zend_stri
 /* }}} */

 static zend_function *zend_test_class_static_method_get(zend_class_entry *ce, zend_string *name) /* {{{ */ {
-	zend_internal_function *fptr = emalloc(sizeof(zend_internal_function));
-	fptr->type = ZEND_OVERLOADED_FUNCTION;
-	fptr->num_args = 1;
-	fptr->arg_info = NULL;
-	fptr->scope = ce;
-	fptr->fn_flags = ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_STATIC;
-	fptr->function_name = name;
-	fptr->handler = ZEND_FN(zend_test_func);
-	zend_set_function_arg_flags((zend_function*)fptr);
+	if (zend_string_equals_literal_ci(name, "test")) {
+		zend_internal_function *fptr = emalloc(sizeof(zend_internal_function));
+		fptr->type = ZEND_OVERLOADED_FUNCTION;
+		fptr->num_args = 1;
+		fptr->arg_info = NULL;
+		fptr->scope = ce;
+		fptr->fn_flags = ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_STATIC;
+		fptr->function_name = name;
+		fptr->handler = ZEND_FN(zend_test_func);
+		zend_set_function_arg_flags((zend_function*)fptr);

-	return (zend_function*)fptr;
+		return (zend_function*)fptr;
+	}
+	return zend_std_get_static_method(ce, name, NULL);
 }
 /* }}} */

@@ -169,11 +172,22 @@ static int zend_test_class_call_method(zend_string *method, zend_object *object,
 }
 /* }}} */

+/* Internal function returns bool, we return int. */
+static ZEND_METHOD(_ZendTestClass, is_object) /* {{{ */ {
+	RETURN_LONG(42);
+}
+/* }}} */
+
 static ZEND_METHOD(_ZendTestTrait, testMethod) /* {{{ */ {
 	RETURN_TRUE;
 }
 /* }}} */

+static const zend_function_entry zend_test_class_methods[] = {
+	ZEND_ME(_ZendTestClass, is_object, NULL, ZEND_ACC_PUBLIC|ZEND_ACC_STATIC)
+	ZEND_FE_END
+};
+
 static zend_function_entry zend_test_trait_methods[] = {
    ZEND_ME(_ZendTestTrait, testMethod, NULL, ZEND_ACC_PUBLIC)
    ZEND_FE_END
@@ -186,7 +200,7 @@ PHP_MINIT_FUNCTION(zend_test)
 	INIT_CLASS_ENTRY(class_entry, "_ZendTestInterface", NULL);
 	zend_test_interface = zend_register_internal_interface(&class_entry);
 	zend_declare_class_constant_long(zend_test_interface, ZEND_STRL("DUMMY"), 0);
-	INIT_CLASS_ENTRY(class_entry, "_ZendTestClass", NULL);
+	INIT_CLASS_ENTRY(class_entry, "_ZendTestClass", zend_test_class_methods);
 	zend_test_class = zend_register_internal_class_ex(&class_entry, NULL);
 	zend_class_implements(zend_test_class, 1, zend_test_interface);
 	zend_test_class->create_object = zend_test_class_new;
@@ -1131,7 +1131,7 @@ static ZEND_COLD void php_error_cb(int type, const char *error_filename, const u
 				break;
 			case E_PARSE:
 				error_type_str = "Parse error";
-				syslog_type_int = LOG_EMERG;
+				syslog_type_int = LOG_ERR;
 				break;
 			case E_NOTICE:
 			case E_USER_NOTICE:
@@ -2,7 +2,7 @@
 /* edit configure.ac to change version number */
 #define PHP_MAJOR_VERSION 7
 #define PHP_MINOR_VERSION 2
-#define PHP_RELEASE_VERSION 24
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "7.2.24-dev"
-#define PHP_VERSION_ID 70224
+#define PHP_RELEASE_VERSION 32
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "7.2.32"
+#define PHP_VERSION_ID 70232
@@ -616,7 +616,7 @@ static void *php_ap_memstr(char *haystack, int haystacklen, char *needle, int ne
 }

 /* read until a boundary condition */
-static int multipart_buffer_read(multipart_buffer *self, char *buf, size_t bytes, int *end)
+static size_t multipart_buffer_read(multipart_buffer *self, char *buf, size_t bytes, int *end)
 {
 	size_t len, max;
 	char *bound;
@@ -655,7 +655,7 @@ static int multipart_buffer_read(multipart_buffer *self, char *buf, size_t bytes
 		self->buf_begin += len;
 	}

-	return (int)len;
+	return len;
 }

 /*
@@ -665,7 +665,7 @@ static int multipart_buffer_read(multipart_buffer *self, char *buf, size_t bytes
 static char *multipart_buffer_read_body(multipart_buffer *self, size_t *len)
 {
 	char buf[FILLUNIT], *out=NULL;
-	int total_bytes=0, read_bytes=0;
+	size_t total_bytes=0, read_bytes=0;

 	while((read_bytes = multipart_buffer_read(self, buf, sizeof(buf), NULL))) {
 		out = erealloc(out, total_bytes + read_bytes + 1);
@@ -692,7 +692,8 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
 	char *boundary, *s = NULL, *boundary_end = NULL, *start_arr = NULL, *array_index = NULL;
 	char *lbuf = NULL, *abuf = NULL;
 	zend_string *temp_filename = NULL;
-	int boundary_len = 0, cancel_upload = 0, is_arr_upload = 0, array_len = 0;
+	int boundary_len = 0, cancel_upload = 0, is_arr_upload = 0;
+	size_t array_len = 0;
 	int64_t total_bytes = 0, max_file_size = 0;
 	int skip_upload = 0, anonindex = 0, is_anonymous;
 	HashTable *uploaded_files = NULL;
@@ -1126,7 +1127,7 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
 			is_arr_upload =	(start_arr = strchr(param,'[')) && (param[strlen(param)-1] == ']');

 			if (is_arr_upload) {
-				array_len = (int)strlen(start_arr);
+				array_len = strlen(start_arr);
 				if (array_index) {
 					efree(array_index);
 				}
@@ -477,9 +477,15 @@ fprintf(stderr, "stream_free: %s:%p[%s] preserve_handle=%d release_cast=%d remov

 	if (close_options & PHP_STREAM_FREE_RELEASE_STREAM) {
 		while (stream->readfilters.head) {
+			if (stream->readfilters.head->res != NULL) {
+				zend_list_close(stream->readfilters.head->res);
+			}
 			php_stream_filter_remove(stream->readfilters.head, 1);
 		}
 		while (stream->writefilters.head) {
+			if (stream->writefilters.head->res != NULL) {
+				zend_list_close(stream->writefilters.head->res);
+			}
 			php_stream_filter_remove(stream->writefilters.head, 1);
 		}

@@ -1209,8 +1209,8 @@ static void init_request_info(void)
 								path_info = script_path_translated + ptlen;
 								tflag = (slen != 0 && (!orig_path_info || strcmp(orig_path_info, path_info) != 0));
 							} else {
-								path_info = env_path_info ? env_path_info + pilen - slen : NULL;
-								tflag = (orig_path_info != path_info);
+								path_info = (env_path_info && pilen > slen) ? env_path_info + pilen - slen : NULL;
+								tflag = path_info && (orig_path_info != path_info);
 							}

 							if (tflag) {
@@ -0,0 +1,61 @@
+--TEST--
+FPM: bug78599 - env_path_info underflow - CVE-2019-11043
+--SKIPIF--
+<?php include "skipif.inc"; ?>
+--FILE--
+<?php
+
+require_once "tester.inc";
+
+$cfg = <<<EOT
+[global]
+error_log = {{FILE:LOG}}
+[unconfined]
+listen = {{ADDR}}
+pm = dynamic
+pm.max_children = 5
+pm.start_servers = 1
+pm.min_spare_servers = 1
+pm.max_spare_servers = 3
+EOT;
+
+$code = <<<EOT
+<?php
+echo "Test Start\n";
+var_dump(\$_SERVER["PATH_INFO"]);
+echo "Test End\n";
+EOT;
+
+$tester = new FPM\Tester($cfg, $code);
+$tester->start();
+$tester->expectLogStartNotices();
+$uri = $tester->makeSourceFile();
+$tester
+    ->request(
+        '',
+        [
+            'SCRIPT_FILENAME' => $uri . "/" . str_repeat('A', 35),
+            'PATH_INFO'       => '',
+            'HTTP_HUI'        => str_repeat('PTEST', 1000),
+        ],
+        $uri
+    )
+    ->expectBody(
+        [
+            'Test Start',
+            'string(0) ""',
+            'Test End'
+        ]
+    );
+$tester->terminate();
+$tester->close();
+
+?>
+Done
+--EXPECT--
+Done
+--CLEAN--
+<?php
+require_once "tester.inc";
+FPM\Tester::clean();
+?>
@@ -513,7 +513,7 @@ class Tester
            return new Response(null, true);
        }
        if (is_null($uri)) {
-            $uri = $this->makeFile('src.php', $this->code);
+            $uri = $this->makeSourceFile();
        }

        $params = array_merge(
@@ -538,7 +538,6 @@ class Tester
            ],
            $headers
        );
-
        try {
            $this->response = new Response(
                $this->getClient($address, $connKeepAlive)->request_data($params, false)
@@ -944,6 +943,14 @@ class Tester
        return $filePath;
    }

+    /**
+     * @return string
+     */
+    public function makeSourceFile()
+    {
+        return $this->makeFile('src.php', $this->code);
+    }
+
    /**
     * @param string|null $msg
     */
@@ -621,7 +621,7 @@ static int sapi_lsapi_activate()
 static sapi_module_struct lsapi_sapi_module =
 {
    "litespeed",
-    "LiteSpeed V7.5",
+    "LiteSpeed V7.6",

    php_lsapi_startup,              /* startup */
    php_module_shutdown_wrapper,    /* shutdown */
@@ -702,6 +702,8 @@ static void lsapi_sigsegv( int signal )
    _exit(1);
 }

+static int do_clean_shutdown = 1;
+
 static int clean_onexit = 1;


@@ -777,18 +779,20 @@ static int lsapi_module_main(int show_source)
        return -1;
    }

-    sigemptyset(&act.sa_mask);
-    act.sa_flags = SA_NODEFER;
-    act.sa_handler = lsapi_sigterm;
-    sa_rc = sigaction( SIGINT, &act, NULL);
-    sa_rc = sigaction( SIGQUIT, &act, NULL);
-    sa_rc = sigaction( SIGILL, &act, NULL);
-    sa_rc = sigaction( SIGABRT, &act, NULL);
-    sa_rc = sigaction( SIGBUS, &act, NULL);
-    sa_rc = sigaction( SIGSEGV, &act, NULL);
-    sa_rc = sigaction( SIGTERM, &act, NULL);
+    if (do_clean_shutdown) {
+        sigemptyset(&act.sa_mask);
+        act.sa_flags = SA_NODEFER;
+        act.sa_handler = lsapi_sigterm;
+        sa_rc = sigaction( SIGINT, &act, NULL);
+        sa_rc = sigaction( SIGQUIT, &act, NULL);
+        sa_rc = sigaction( SIGILL, &act, NULL);
+        sa_rc = sigaction( SIGABRT, &act, NULL);
+        sa_rc = sigaction( SIGBUS, &act, NULL);
+        sa_rc = sigaction( SIGSEGV, &act, NULL);
+        sa_rc = sigaction( SIGTERM, &act, NULL);

-    clean_onexit = 0;
+        clean_onexit = 0;
+    }

    if (show_source) {
        zend_syntax_highlighter_ini syntax_highlighter_ini;
@@ -1601,7 +1605,8 @@ int main( int argc, char * argv[] )
    int iRequestsProcessed = 0;
    int result;

-    atexit(lsapi_atexit);
+    if (do_clean_shutdown)
+        atexit(lsapi_atexit);

    while( ( result = LSAPI_Prefork_Accept_r( &g_req )) >= 0 ) {
 #if defined(linux) || defined(__linux) || defined(__linux__) || defined(__gnu_linux__)
@@ -1675,6 +1680,13 @@ static PHP_MINIT_FUNCTION(litespeed)
    if (p && 0 == strcasecmp(p, "on"))
        parse_user_ini = 1;

+    p = getenv("LSAPI_CLEAN_SHUTDOWN");
+    if (p) {
+        if (*p == '1' || 0 == strcasecmp(p, "on"))
+            do_clean_shutdown = 1;
+        else if (*p == '0' || 0 == strcasecmp(p, "off"))
+            do_clean_shutdown = 0;
+    }
    /*
     * mod_lsapi always sets this env var,
     * so we can detect mod_lsapi mode with its presense.
Author	SHA1	Message	Date
Sara Golemon	dcccdf8170	Update versions for PHP 7.2.32	2020-07-07 19:39:50 +00:00
Sara Golemon	9588c8474e	Prep NEWS for 7.2.32 release	2020-07-07 19:31:05 +00:00
Remi Collet	4cf8be71df	bump version to 7.2.32-dev	2020-05-12 09:16:01 +02:00
Stanislav Malyshev	b4afd21428	Update NEWS	2020-05-11 14:28:51 -07:00
Christoph M. Becker	3c8582ca4b	Fix #78876 : Long variables cause OOM and temp files are not cleaned We use the proper type for size calculations, which is `size_t`.	2020-05-11 13:48:40 -07:00
Christoph M. Becker	1c9bd513ac	Fix #78875 : Long filenames cause OOM and temp files are not cleaned We must not cast `size_t` to `int` (unless the `size_t` value is guaranteed to be less than or equal to `INT_MAX`). In this case we can declare `array_len` as `size_t` in the first place.	2020-05-11 13:47:38 -07:00
Sara Golemon	bef96b9d2c	Update NEWS for 7.2.31	2020-04-14 15:38:55 +00:00
Sara Golemon	cf083535f8	Update CREDITS for PHP 7.2.30	2020-04-14 15:16:26 +00:00
Sara Golemon	bd49622a9a	Update NEWS for PHP 7.2.30	2020-04-14 15:16:26 +00:00
dinosaur	13842eda37	Fixed bug #79468 Close the stream filter resources when removing them from the stream.	2020-04-14 10:27:28 -04:00
Sara Golemon	6df761b7ff	NEWS	2020-04-14 10:25:37 -04:00
Stanislav Malyshev	9d6bf8221b	Fix bug #79465 - use unsigneds as indexes.	2020-04-13 21:08:37 -07:00
Stanislav Malyshev	14fcc81394	Fix bug #79330 - make all execution modes consistent in rejecting \0	2020-04-13 21:08:30 -07:00
Remi Collet	3072b77c21	bump verison to 7.2.30-dev	2020-03-17 11:28:34 +01:00
Christoph M. Becker	6a4fff4682	Fix NEWS	2020-03-17 11:06:45 +01:00
Stanislav Malyshev	c8d21d7728	[ci skip] Update NEWS	2020-03-15 19:38:31 -07:00
Stanislav Malyshev	2c081b7e26	Fix test	2020-03-15 17:55:28 -07:00
Stanislav Malyshev	0d139c5b94	Fix bug #79329 - get_headers should not accept \0	2020-03-15 17:30:44 -07:00
Stanislav Malyshev	41f66e2a2c	Fixed bug #79282	2020-03-15 17:26:00 -07:00
Remi Collet	63f6608f89	bump version to 7.2.29	2020-02-18 11:00:28 +01:00
Christoph M. Becker	5009b9811d	Update NEWS [ci skip]	2020-02-17 19:21:51 +01:00
Nikita Popov	2826364298	Mark bug76348.phpt as online test	2020-02-16 22:40:25 -08:00
Stanislav Malyshev	e5c95234d8	Fix bug #79082 - Files added to tar with Phar::buildFromIterator have all-access permissions	2020-02-16 22:38:38 -08:00
Stanislav Malyshev	d76f7c6c63	Fix bug #79221 - Null Pointer Dereference in PHP Session Upload Progress	2020-02-15 20:52:19 -08:00
Christoph M. Becker	8308196c97	Fix typo in recent bugfix	2020-02-14 09:21:13 +01:00
Christoph M. Becker	cec8b24c84	Fix #77569 : Write Acess Violation in DomImplementation We must not assume that the zval IS_STRING.	2020-02-13 15:13:26 +01:00
Stanislav Malyshev	2dc170e25d	More checks for php_strip_tags_ex	2020-01-22 22:37:30 -08:00
Remi Collet	7e2bd95fa5	next will be 7.2.28	2020-01-22 09:17:00 +01:00
Stanislav Malyshev	5c90f8eb66	Update NEWS	2020-01-20 22:12:32 -08:00
Stanislav Malyshev	2bcbc95f03	Fix bug #79037 (global buffer-overflow in `mbfl_filt_conv_big5_wchar`)	2020-01-20 21:43:42 -08:00
Stanislav Malyshev	0f79b1bf30	Fix #79099 : OOB read in php_strip_tags_ex	2020-01-20 21:43:42 -08:00
Christoph M. Becker	f79c774274	Fix #79091 : heap use-after-free in session_create_id() If the `new_id` is released, we must not use it again.	2020-01-20 21:43:42 -08:00
Remi Collet	864f5ef12f	fix release date	2019-12-18 14:16:19 +01:00
Stanislav Malyshev	9705e631a4	[ci skip] Update NEWS	2019-12-16 23:41:04 -08:00
Stanislav Malyshev	6d5cddabaf	Fix test	2019-12-16 10:03:43 -08:00
Stanislav Malyshev	c14eb8de97	Fix bug #78793	2019-12-16 01:14:58 -08:00
Stanislav Malyshev	d348cfb96f	Fixed bug #78910	2019-12-16 00:10:39 -08:00
Christoph M. Becker	eb23c60087	Fix #78878 : Buffer underflow in bc_shift_addsub We must not rely on `isdigit()` to detect digits, since we only support decimal ASCII digits in the following processing.	2019-12-16 00:05:03 -08:00
Stanislav Malyshev	b771a18133	Fix test	2019-12-16 00:03:18 -08:00
Christoph M. Becker	0e6c0654ed	Fix #78862 : link() silently truncates after a null byte on Windows Since link() is supposed to accepts paths (i.e. strings without NUL bytes), we must not accept arbitrary strings.	2019-12-16 00:03:06 -08:00
Christoph M. Becker	a5a15965da	Fix #78863 : DirectoryIterator class silently truncates after a null byte Since the constructor of DirectoryIterator and friends is supposed to accepts paths (i.e. strings without NUL bytes), we must not accept arbitrary strings.	2019-12-16 00:02:57 -08:00
Remi Collet	d2cfb63f02	next is 7.2.27	2019-12-03 11:25:37 +01:00
Christoph M. Becker	600f1f898f	Fix #78814 : strip_tags allows / in tag name => whitelist bypass When normalizing tags to check whether they are contained in the set of allowable tags, we must not strip slashes, unless they come immediately after the opening `<`, or immediately before the closing `>`.	2019-12-02 11:37:25 +01:00
Christoph M. Becker	db420cb6a1	Fix #78833 : Integer overflow in pack causes out-of-bound access We check for potential signed integer overflow, and bail out gracefully, in that case.	2019-12-02 11:18:19 +01:00
George Wang	c7141412ce	Added environment LSAPI_CLEAN_SHUTDOWN to control clean shutdown. Update SAPI version to LiteSpeed v7.6 .	2019-11-21 17:57:50 -05:00
Christoph M. Becker	9b92c1d154	Fix #78849 : GD build broken with -D SIGNED_COMPARE_SLOW Apparently, this has not been tested for a long time, and might be a refactoring relict. Anyhow, we have to pass the context to `GIFNextPixel` as well.	2019-11-21 09:59:26 +01:00
Christoph M. Becker	f6eac76b65	Update NEWS	2019-11-18 12:46:43 +01:00
Tyson Andre	a2c41c0ea6	Fix $x = (bool)$x; for undefined with opcache And `$x = !$x` Noticed while working on GH-4912 The included test would not emit undefined variable errors in php 8.0 with opcache enabled. The command used: ``` php -d zend_extension=opcache.so --no-php-ini -d error_reporting=E_ALL \ -d opcache.file_cache= -d opcache.enable_cli=1 test.php ```	2019-11-18 11:24:03 +03:00
Stanislav Malyshev	2c9926f156	Fix bug #78804 - Segmentation fault in Locale::filterMatches	2019-11-11 22:32:35 -08:00
Nikita Popov	ee243bc471	Remove outdated comments in test	2019-11-07 14:06:23 +01:00
Nikita Popov	5fa6dcd972	Fixed bug #78759 Handle INDIRECT values in array.	2019-11-07 11:15:29 +01:00
Sara Golemon	d317e16e89	Bump for 7.2.26-dev	2019-11-05 10:57:29 -05:00
Nikita Popov	4f984a2fdb	Fixed bug #78775 Clear the OpenSSL error queue before performing SSL stream operations. As we don't control all code that could possibly be using OpenSSL, we can't rely on the error queue being empty.	2019-11-05 12:13:46 +01:00
Christoph M. Becker	e29922f054	Fix test cases for libxml2 2.9.10 Since the error reporting has been slightly changed, we have to adapt the two affected test cases.	2019-10-31 16:07:34 +01:00
Nikita Popov	5f6eaf355c	Add missing refcount increment	2019-10-30 09:22:20 +01:00
Nikita Popov	f9895b4bf5	Fixed bug #78689	2019-10-29 15:06:16 +01:00
Stanislav Malyshev	2bdb13a1f7	Merge branch 'PHP-7.1' into PHP-7.2 * PHP-7.1: Fix libmagic buffer overflow issue (CVE-2019-18218) bump version set versions for release	2019-10-28 20:47:30 -07:00
Christoph M. Becker	89c327f884	Fix #78751 : Serialising DatePeriod converts DateTimeImmutable When getting the properties of a DatePeriod instance we have to retain the proper classes, and when restoring a DatePeriod instance we have to cater to DateTimeImmutable instances as well.	2019-10-28 13:07:28 +01:00
Nikita Popov	16c4910876	Fix bug #78752 NULL out the execute_data before destroying it, otherwise GC may trigger while the execute_data is partially destroyed, resulting in double-frees. The handling of call stack unfreezing is a bit awkward because it's a ZEND_API function, so we can't change the signature.	2019-10-28 10:27:32 +01:00
Stanislav Malyshev	469820048d	Fix libmagic buffer overflow issue (CVE-2019-18218) Ported from https://github.com/file/file/commit/46a8443f76cec4b41ec736eca396984c74664f84	2019-10-27 16:30:38 -07:00
Nikita Popov	5249993814	Fixed bug #78747	2019-10-25 12:47:18 +02:00
Ryan Schmidt	8daf96cef3	Use ICU's CXXFLAGS when using pkg-config This mirrors how ICU's CXXFLAGS are already used when using icu-config.	2019-10-23 11:17:37 +02:00
Nikita Popov	fa89c41f37	Add "-pthread" to EXTRA_LDFLAGS_PROGRAM as well This is a backport of `c518932c03` from the PHP 7.4 branch.	2019-10-23 11:06:51 +02:00
Joe Watkins	52f049879a	bump version	2019-10-22 18:58:39 +02:00
Joe Watkins	326cd05dae	set versions for release	2019-10-22 18:56:55 +02:00
Remi Collet	2213bd36fd	add NEWS entry	2019-10-22 09:37:35 +02:00
Stanislav Malyshev	4b5cdda0c7	Merge branch 'PHP-7.1' into PHP-7.2 * PHP-7.1: Fix bug #78599 (env_path_info underflow can lead to RCE) (CVE-2019-11043) bump versions after release set versions for release	2019-10-21 13:17:09 -07:00
Fabien Villepinte	bea2ff88c9	Fix bug #78697 : inaccurate error message	2019-10-21 09:22:09 +02:00
Jakub Zelenka	ab061f95ca	Fix bug #78599 (env_path_info underflow can lead to RCE) (CVE-2019-11043)	2019-10-20 22:50:04 -07:00
Christoph M. Becker	45a7723267	Fix #78694 : Appending to a variant array causes segfault `write_dimension` object handlers have to be able to handle `NULL` `offset`s; for now we simply throw an exception instead of following the `NULL` pointer.	2019-10-19 11:47:00 +02:00
m.yakunin	d2cde0bfd3	Fix #70153 \DateInterval incorrectly unserialized Added a separate macro for reading 'days' property, so that bool(false) is correctly converted to the proper internal representation.	2019-10-18 15:31:14 +02:00
Mitch Hagstrand	e2a6bf482f	Fix checksum calculation for opcache	2019-10-14 16:46:42 +02:00
Christoph M. Becker	900bdcbd03	Fix #78665 : Multicasting may leak memory	2019-10-12 14:43:43 +02:00
Nikita Popov	46561dab6a	Fix leak in phar open	2019-10-10 16:14:21 +02:00
Nikita Popov	96c84b7bc1	Fix leak on static method call on non-existent class	2019-10-10 11:40:49 +02:00
Nikita Popov	daf1fc6e31	Avoid float to int cast UB in exif	2019-10-09 17:33:29 +02:00
Erik Lundin	3164186d53	Fix #78656 : Parse errors classified as highest log-level	2019-10-09 17:27:32 +02:00
Nikita Popov	d6ca174d5b	Remove redundant components < 0 check components is an unsigned number, it cannot be smaller than zero.	2019-10-09 14:57:24 +02:00
Sergei Turchanov	a8f60ac9dd	Add pcre_get_compiled_regex_cache_ex() with local_aware flag A new function `pcre_get_compiled_regex_cache_ex()` is introduced, which allows to compile regexp pattern using the "C" locale instead of a current locale. This will be needed to replace setlocale() usage in fileinfo, which is not thread-safe.	2019-10-08 16:11:55 +02:00
Fabien Villepinte	46894580b0	Add missing SKIPIFs in exif tests	2019-10-08 14:11:32 +02:00
Christoph M. Becker	195c2008e8	Fix #78642 : Wrong libiconv version displayed The high byte of `_libiconv_version` specifies the major version; the low byte the minor version.	2019-10-08 12:09:11 +02:00
Remi Collet	05d6878b3b	next is 7.2.25	2019-10-08 11:36:10 +02:00
Joe Watkins	fadd7f0f1e	bump versions after release	2019-08-28 09:08:23 +02:00
Joe Watkins	481520d381	set versions for release	2019-08-28 09:06:38 +02:00