Update versions for PHP 7.2.19

Update NEWS for PHP 7.2.19
add NEWS entries for sec fix
2026-11-08 17:50:50 +00:00 · 2019-05-29 06:58:04 +00:00 · 2019-05-29 06:58:04 +00:00 · 2019-05-29 08:52:17 +02:00 · 2019-05-29 08:45:04 +02:00 · 2019-05-29 08:44:45 +02:00
338 changed files with 251133 additions and 276535 deletions
@@ -16,7 +16,7 @@ environment:
        PHP_BUILD_CACHE_BASE_DIR: c:\build-cache
        PHP_BUILD_OBJ_DIR: c:\obj
        PHP_BUILD_CACHE_SDK_DIR: c:\build-cache\sdk
-        PHP_BUILD_SDK_BRANCH: php-sdk-2.2.0
+        PHP_BUILD_SDK_BRANCH: php-sdk-2.2.0beta5
        PHP_BUILD_CRT: vc15
        # ext and env setup for tests
        #MYSQL_TEST_PASSWD: Password12!
@@ -3,32 +3,45 @@
 root = true

 [*]
-trim_trailing_whitespace = true
-insert_final_newline     = true
-end_of_line              = lf
-charset                  = utf-8
 tab_width                = 4

-[{*.{awk,bat,c,cpp,d,h,l,mk,re,skl,w32,y},Makefile*}]
+[*.{c,h,y,awk,w32,bat,mk,frag,cpp}]
+charset                  = utf-8
+end_of_line              = lf
 indent_size              = 4
 indent_style             = tab
+trim_trailing_whitespace = true
+insert_final_newline     = true

-[*.{dtd,html,inc,php,phpt,rng,wsdl,xml,xsd,xsl}]
+[*.{php,phpt,inc}]
+charset                  = utf-8
+end_of_line              = lf
 indent_size              = 4
 indent_style             = space
+trim_trailing_whitespace = true
+insert_final_newline     = true

-[*.{ac,m4,sh,yml}]
+[*.{yml,m4,sh}]
+charset                  = utf-8
+end_of_line              = lf
 indent_size              = 2
 indent_style             = space
+trim_trailing_whitespace = true
+insert_final_newline     = true

 [*.md]
+charset                  = utf-8
+end_of_line              = lf
 indent_style             = space
+trim_trailing_whitespace = true
+insert_final_newline     = true
 max_line_length          = 80

 [COMMIT_EDITMSG]
+charset                  = utf-8
+end_of_line              = lf
 indent_size              = 4
 indent_style             = space
+trim_trailing_whitespace = true
+insert_final_newline     = true
 max_line_length          = 80
-
-[*.patch]
-trim_trailing_whitespace = false
@@ -1,342 +1,7 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-14 May 2020, PHP 7.2.31
-
- Core:
-  . Fixed bug #78875 (Long filenames cause OOM and temp files are not cleaned). 
-    (CVE-2019-11048) (cmb)
-  . Fixed bug #78876 (Long variables in multipart/form-data cause OOM and temp 
-    files are not cleaned). (CVE-2019-11048) (cmb)
-
-16 Apr 2020, PHP 7.2.30
-
- Standard:
-  . Fixed bug #79468 (SIGSEGV when closing stream handle with a stream filter
-    appended). (dinosaur)
-  . Fixed bug #79330 (shell_exec() silently truncates after a null byte). (stas)
-  . Fixed bug #79465 (OOB Read in urldecode()). (stas)
-
-19 Mar 2020, PHP 7.2.29
-
- EXIF:
-  . Fixed bug #79282 (Use-of-uninitialized-value in exif). (CVE-2020-7064) 
-    (Nikita)
-
- Standard: 
-  . Fixed bug #79329 (get_headers() silently truncates after a null byte) 
-    (CVE-2020-7066). (cmb)
-
-20 Feb 2020, PHP 7.2.28
-
- DOM:
-  . Fixed bug #77569: (Write Access Violation in DomImplementation). (Nikita,
-    cmb)
-
- Phar:
-  . Fixed bug #79082 (Files added to tar with Phar::buildFromIterator have
-    all-access permissions). (CVE-2020-7063) (stas)
-
- Session:
-  . Fixed bug #79221 (Null Pointer Dereference in PHP Session Upload Progress).
-    (CVE-2020-7062) (stas)
-
-23 Jan 2020, PHP 7.2.27
-
- Mbstring:
-  . Fixed bug #79037 (global buffer-overflow in `mbfl_filt_conv_big5_wchar`). 
-    (CVE-2020-7060) (Nikita)
-
- Session:
-  . Fixed bug #79091 (heap use-after-free in session_create_id()). (cmb, Nikita)
-
- Standard:
-  . Fixed bug #79099 (OOB read in php_strip_tags_ex). (CVE-2020-7059). (cmb)
-
-18 Dec 2019, PHP 7.2.26
-
- Bcmath:
-  . Fixed bug #78878 (Buffer underflow in bc_shift_addsub). (CVE-2019-11046).
-    (cmb)
-
- Core:
-  . Fixed bug #78862 (link() silently truncates after a null byte on Windows).
-    (CVE-2019-11044). (cmb)
-  . Fixed bug #78863 (DirectoryIterator class silently truncates after a null
-    byte). (CVE-2019-11045). (cmb)
-
- EXIF:
-  . Fixed bug #78793 (Use-after-free in exif parsing under memory sanitizer).
-    (CVE-2019-11050). (Nikita)
-  . Fixed bug #78910 (Heap-buffer-overflow READ in exif). (CVE-2019-11047).
-    (Nikita)
-
- GD:
-  . Fixed bug #78849 (GD build broken with -D SIGNED_COMPARE_SLOW). (cmb)
-
- Intl:
-  . Fixed bug #78804 (Segmentation fault in Locale::filterMatches). (Stas)
-
- OPcache:
-  . Fixed $x = (bool)$x; with opcache (should emit undeclared variable notice).
-    (Tyson Andre)
-
- Standard:
-  . Fixed bug #78759 (array_search in $GLOBALS). (Nikita)
-  . Fixed bug #78833 (Integer overflow in pack causes out-of-bound access).
-    (cmb)
-  . Fixed bug #78814 (strip_tags allows / in tag name => whitelist bypass).
-    (cmb)
-
-21 Nov 2019, PHP 7.2.25
-
- Core:
-  . Fixed bug #78656 (Parse errors classified as highest log-level). (Erik
-    Lundin)
-  . Fixed bug #78752 (Segfault if GC triggered while generator stack frame is
-    being destroyed). (Nikita)
-  . Fixed bug #78689 (Closure::fromCallable() doesn't handle
-    [Closure, '__invoke']). (Nikita)
-
- COM:
-  . Fixed bug #78694 (Appending to a variant array causes segfault). (cmb)
-
- Date:
-  . Fixed bug #70153 (\DateInterval incorrectly unserialized). (Maksim Iakunin)
-  . Fixed bug #78751 (Serialising DatePeriod converts DateTimeImmutable). (cmb)
-
- Iconv:
-  . Fixed bug #78642 (Wrong libiconv version displayed). (gedas at martynas,
-    cmb).
-
- OpCache:
-  . Fixed bug #78654 (Incorrectly computed opcache checksum on files with
-    non-ascii characters). (mhagstrand)
-  . Fixed bug #78747 (OpCache corrupts custom extension result). (Nikita)
-
- OpenSSL:
-  . Fixed bug #78775 (TLS issues from HTTP request affecting other encrypted
-    connections). (Nikita)
-
- Reflection:
-  . Fixed bug #78697 (ReflectionClass::ImplementsInterface - inaccurate error
-    message with traits). (villfa)
-
- Sockets:
-  . Fixed bug #78665 (Multicasting may leak memory). (cmb)
-
-24 Oct 2019, PHP 7.2.24
-
- Core:
-  . Fixed bug #78535 (auto_detect_line_endings value not parsed as bool).
-    (bugreportuser)
-  . Fixed bug #78620 (Out of memory error). (cmb, Nikita)
-
- Exif:
-  . Fixed bug #78442 ('Illegal component' on exif_read_data since PHP7)
-	(Kalle)
-
- FPM:
-  . Fixed bug #78599 (env_path_info underflow in fpm_main.c can lead to RCE).
-    (CVE-2019-11043) (Jakub Zelenka)
-
- MBString:
-  . Fixed bug #78579 (mb_decode_numericentity: args number inconsistency).
-    (cmb)
-  . Fixed bug #78609 (mb_check_encoding() no longer supports stringable
-    objects). (cmb)
-
- MySQLi:
-  . Fixed bug #76809 (SSL settings aren't respected when persistent connections 
-    are used). (fabiomsouto)
-
- PDO_MySQL:
-  . Fixed bug #78623 (Regression caused by "SP call yields additional empty
-    result set"). (cmb)
-
- Session:
-  . Fixed bug #78624 (session_gc return value for user defined session 
-    handlers). (bshaffer)
-
- Standard:
-  . Fixed bug #76342 (file_get_contents waits twice specified timeout).
-    (Thomas Calvet)
-  . Fixed bug #78612 (strtr leaks memory when integer keys are used and the
-    subject string shorter). (Nikita)
-  . Fixed bug #76859 (stream_get_line skips data if used with data-generating 
-    filter). (kkopachev)
-
- Zip:
-  . Fixed bug #78641 (addGlob can modify given remove_path value). (cmb)
-
-26 Sep 2019, PHP 7.2.23
-
- Core:
-  . Fixed bug #78220 (Can't access OneDrive folder). (cmb, ab)
-  . Fixed bug #78412 (Generator incorrectly reports non-releasable $this as GC
-    child). (Nikita)
-
- FastCGI:
-  . Fixed bug #78469 (FastCGI on_accept hook is not called when using named
-    pipes on Windows). (Sergei Turchanov)
-
- MySQLnd:
-  . Fixed connect_attr issues and added the _server_host connection attribute.
-    (Qianqian Bu)
-
- ODBC:
-  . Fixed bug #78473 (odbc_close() closes arbitrary resources). (cmb)
-
- PDO_MySQL:
-  . Fixed bug #41997 (SP call yields additional empty result set). (cmb)
-
- sodium:
-  . Fixed bug #78510 (Partially uninitialized buffer returned by
-    sodium_crypto_generichash_init()). (Frank Denis, cmb)
-
- SPL:
-  . Fixed bug #72884 (SplObject isCloneable() returns true but errs on clone).
-    (Chu Zhaowei)
-
-29 Aug 2019, PHP 7.2.22
-
- Core:
-  . Fixed bug #78363 (Buffer overflow in zendparse). (Nikita)
-  . Fixed bug #78379 (Cast to object confuses GC, causes crash). (Dmitry)
-
- Curl:
-  . Fixed bug #77946 (Bad cURL resources returned by curl_multi_info_read()).
-    (Abyr Valg)
-
- Exif:
-  . Fixed bug #78333 (Exif crash (bus error) due to wrong alignment and
-    invalid cast). (Nikita)
-
- Iconv:
-  . Fixed bug #78342 (Bus error in configure test for iconv //IGNORE). (Rainer
-    Jung)
-
- LiteSpeed:
-  . Updated to LiteSpeed SAPI V7.5 (Fixed clean shutdown). (George Wang)
-
- MySQLnd:
-  . Fixed bug #78179 (MariaDB server version incorrectly detected). (cmb)
-
- Opcache:
-  . Fixed bug #77191 (Assertion failure in dce_live_ranges() when silencing is
-    used). (Nikita)
-
- Standard:
-  . Fixed bug #69100 (Bus error from stream_copy_to_stream (file -> SSL stream)
-    with invalid length). (Nikita)
-  . Fixed bug #78282 (atime and mtime mismatch). (cmb)
-  . Fixed bug #78326 (improper memory deallocation on stream_get_contents()
-    with fixed length buffer). (Albert Casademont)
-
-01 Aug 2019, PHP 7.2.21
-
- Date:
-  . Fixed bug #69044 (discrepency between time and microtime). (krakjoe)
-
- EXIF:
-  . Fixed bug #78256 (heap-buffer-overflow on exif_process_user_comment).
-    (CVE-2019-11042) (Stas)
-  . Fixed bug #78222 (heap-buffer-overflow on exif_scan_thumbnail).
-    (CVE-2019-11041) (Stas)
-
- Fileinfo:
-  . Fixed bug #78183 (finfo_file shows wrong mime-type for .tga file).
-    (Joshua Westerheide)
-
- FTP:
-  . Fixed bug #77124 (FTP with SSL memory leak). (Nikita)
-
- Libxml:
-  . Fixed bug #78279 (libxml_disable_entity_loader settings is shared between
-    requests (cgi-fcgi)). (Nikita)
-
- LiteSpeed:
-  . Updated to LiteSpeed SAPI V7.4.3 (increased response header count limit from
-    100 to 1000, added crash handler to cleanly shutdown PHP request, added
-    CloudLinux mod_lsapi mode). (George Wang)
-  . Fixed bug #76058 (After "POST data can't be buffered", using php://input
-    makes huge tmp files). (George Wang)
-
- Openssl:
-  . Fixed bug #78231 (Segmentation fault upon stream_socket_accept of exported
-    socket-to-stream). (Nikita)
-
- OPcache:
-  . Fixed bug #78189 (file cache strips last character of uname hash). (cmb)
-  . Fixed bug #78202 (Opcache stats for cache hits are capped at 32bit NUM).
-    (cmb)
-  . Fixed bug #78291 (opcache_get_configuration doesn't list all directives).
-    (Andrew Collington)
-
- Phar:
-  . Fixed bug #77919 (Potential UAF in Phar RSHUTDOWN). (cmb)
-
- Phpdbg:
-  . Fixed bug #78297 (Include unexistent file memory leak). (Nikita)
-
- PDO_Sqlite:
-  . Fixed bug #78192 (SegFault when reuse statement after schema has changed).
-    (Vincent Quatrevieux)
-
- SQLite:
-  . Upgraded to SQLite 3.28.0. (cmb)
-
- Standard:
-  . Fixed bug #78241 (touch() does not handle dates after 2038 in PHP 64-bit).
-    (cmb)
-  . Fixed bug #78269 (password_hash uses weak options for argon2). (Remi)
-
- XMLRPC:
-  . Fixed bug #78173 (XML-RPC mutates immutable objects during encoding).
-    (Asher Baker)
-
-04 Jul 2019, PHP 7.2.20
-
- Core:
-  . Fixed bug #76980 (Interface gets skipped if autoloader throws an exception).
-    (Nikita)
-
- DOM:
-  . Fixed bug #78025 (segfault when accessing properties of DOMDocumentType).
-    (cmb)
-
- MySQLi:
-  . Fixed bug #77956 (When mysqli.allow_local_infile = Off, use a meaningful
-    error message). (Sjon Hortensius)
-  . Fixed bug #38546 (bindParam incorrect processing of bool types).
-    (camporter)
-
- Opcache:
-  . Fixed bug #78106 (Path resolution fails if opcache disabled during request).
-    (Nikita)
-  . Fixed bug #78185 (File cache no longer works). (Dmitry)
-
- OpenSSL:
-  . Fixed bug #78079 (openssl_encrypt_ccm.phpt fails with OpenSSL 1.1.1c).
-    (Jakub Zelenka)
-
- Sockets:
-  . Fixed bug #78038 (Socket_select fails when resource array contains
-    references). (Nikita)
-
- Standard:
-  . Fixed bug #77135 (Extract with EXTR_SKIP should skip $this).
-    (Craig Duncan, Dmitry)
-  . Fixed bug ##77937	(preg_match failed). (cmb, Anatol)
-
- Zip:
-  . Fixed bug #76345 (zip.h not found). (Michael Maroszek)
-
 30 May 2019, PHP 7.2.19

- Date:
-  . Fixed bug #77909 (DatePeriod::__construct() with invalid recurrence count
-    value). (Ignace Nyamagana Butera)
-
 - EXIF:
  . Fixed bug #77988 (heap-buffer-overflow on php_jpg_get16).
    (CVE-2019-11040) (Stas)
@@ -383,8 +48,12 @@ PHP                                                                        NEWS
  . Fixed bug #77794 (Incorrect Date header format in built-in server).
    (kelunik)

+- Date:
+  . Fixed bug #77909 (DatePeriod::__construct() with invalid recurrence count
+    value). (Ignace Nyamagana Butera)
+
 - EXIF
-  . Fixed bug #77950 (Heap-buffer-overflow in _estrndup via exif_process_IFD_TAG).
+  . Fixed bug #77950 (Heap-buffer-overflow in _estrndup via exif_process_IFD_TAG). 
    (CVE-2019-11036) (Stas)

 - Interbase:
@@ -415,7 +84,7 @@ PHP                                                                        NEWS
  . Fixed bug #77800 (phpdbg segfaults on listing some conditional breakpoints).
    (krakjoe)
  . Fixed bug #77805 (phpdbg build fails when readline is shared). (krakjoe)
-
+    
 - Reflection:
  . Fixed bug #77772 (ReflectionClass::getMethods(null) doesn't work). (Nikita)
  . Fixed bug #77882 (Different behavior: always calls destructor). (Nikita)
@@ -458,7 +127,7 @@ PHP                                                                        NEWS
 - EXIF:
  . Fixed bug #77753 (Heap-buffer-overflow in php_ifd_get32s). (CVE-2019-11034)
    (Stas)
-  . Fixed bug #77831 (Heap-buffer-overflow in exif_iif_add_value).
+  . Fixed bug #77831 (Heap-buffer-overflow in exif_iif_add_value). 
    (CVE-2019-11035) (Stas)

 - FPM:
@@ -179,7 +179,13 @@ TSRM_API uint8_t tsrm_is_main_thread(void);
 #define TSRMG_BULK_STATIC(id, type)	((type) (*((void ***) TSRMLS_CACHE))[TSRM_UNSHUFFLE_RSRC_ID(id)])
 #define TSRMLS_CACHE_EXTERN() extern TSRM_TLS void *TSRMLS_CACHE;
 #define TSRMLS_CACHE_DEFINE() TSRM_TLS void *TSRMLS_CACHE = NULL;
+#if ZEND_DEBUG
 #define TSRMLS_CACHE_UPDATE() TSRMLS_CACHE = tsrm_get_ls_cache()
+#define TSRMLS_CACHE_RESET()
+#else
+#define TSRMLS_CACHE_UPDATE() if (!TSRMLS_CACHE) TSRMLS_CACHE = tsrm_get_ls_cache()
+#define TSRMLS_CACHE_RESET()  TSRMLS_CACHE = NULL
+#endif
 #define TSRMLS_CACHE _tsrm_ls_cache

 /* BC only */
@@ -804,7 +804,7 @@ static zend_always_inline void UnixTimeToFileTime(time_t t, LPFILETIME pft) /* {
 	// Note that LONGLONG is a 64-bit value
 	LONGLONG ll;

-	ll = t * 10000000LL + 116444736000000000LL;
+	ll = Int32x32To64(t, 10000000) + 116444736000000000;
 	pft->dwLowDateTime = (DWORD)ll;
 	pft->dwHighDateTime = ll >> 32;
 }
@@ -140,7 +140,6 @@ assert(0 && ($a = function () {
    if ($a) {
    } elseif ($b) {
    }
-    if ($a); else;
 }));

 ?>
@@ -293,7 +292,4 @@ Warning: assert(): assert(0 && ($a = function () {
    if ($a) {
    } elseif ($b) {
    }
-    if ($a) {
-    } else {
-    }
 })) failed in %sexpect_015.php on line %d
@@ -1,17 +0,0 @@
--TEST--
-AST pretty-printer
--INI--
-zend.assertions=1
-assert.exception=0
--FILE--
-<?php
-assert(0 && ($a = function () {
-	$var = 'test';
-	$str = "$var, $var[1], {$var}[], {$var[1]}[], ${var}[], ${var[1]}[]";
-}));
-?>
--EXPECTF--
-Warning: assert(): assert(0 && ($a = function () {
-    $var = 'test';
-    $str = "$var, {$var[1]}, {$var}[], {$var[1]}[], {$var}[], {$var[1]}[]";
-})) failed in %sexpect_020.php on line %d
@@ -1,32 +0,0 @@
--TEST--
-Bug #78379 (Cast to object confuses GC, causes crash)
--INI--
-opcache.enable=0
--FILE--
-<?php
-class C {
-	public function __construct() {
-		$this->p = (object)["x" => [1]];
-	}
-}
-class E {
-}
-$e = new E;
-$e->f = new E;
-$e->f->e = $e;
-$e->a = new C;
-$e = null;
-gc_collect_cycles();
-var_dump(new C);
-?>
--EXPECTF--
-object(C)#%d (1) {
-  ["p"]=>
-  object(stdClass)#%d (1) {
-    ["x"]=>
-    array(1) {
-      [0]=>
-      int(1)
-    }
-  }
-}
@@ -1,19 +0,0 @@
--TEST--
-Bug #78379.2 (Cast to object confuses GC, causes crash)
--FILE--
-<?php
-class E {}
-function f() {
-	$e1 = new E;
-	$e2 = new E;
-	$a = ['e2' => $e2];
-	$e1->a = (object)$a;
-	$e2->e1 = $e1;
-	$e2->a = (object)$a;
-}
-f();
-gc_collect_cycles();
-echo "End\n";
-?>
--EXPECT--
-End
@@ -1,13 +0,0 @@
--TEST--
-Bug #78689: Closure::fromCallable() doesn't handle [Closure, '__invoke']
--FILE--
-<?php
-$a = [function () { echo "123\n"; }, '__invoke'];
-$a();
-
-$b = Closure::fromCallable($a);
-$b();
-?>
--EXPECT--
-123
-123
@@ -1,24 +0,0 @@
--TEST--
-Bug #78752: Segfault if GC triggered while generator stack frame is being destroyed
--FILE--
-<?php
-
-function gen(&$gen) {
-    $a = new stdClass;
-    $a->a = $a;
-    $b = new stdClass;
-    $b->b = $b;
-    yield 1;
-}
-
-$gen = gen($gen);
-var_dump($gen->current());
-for ($i = 0; $i < 9999; $i++) {
-    $a = new stdClass;
-    $a->a = $a;
-}
-$gen->next();
-
-?>
--EXPECT--
-int(1)
@@ -1,11 +0,0 @@
--TEST--
-Immediately invoked closure with extra args
--FILE--
-<?php
-
-(function() {})(new stdClass);
-
-?>
-===DONE===
--EXPECT--
-===DONE===
@@ -1,35 +0,0 @@
--TEST--
-GC 041: Handling of references in nested data of objects with destructor
--INI--
-zend.enable_gc = 1
--FILE--
-<?php
-class ryat {
-	    var $ryat;
-        var $chtg;
-        var $nested;
-	    function __destruct() {
-	            $GLOBALS['x'] = $this;
-        }
-}
-$o = new ryat;
-$o->nested = [];
-$o->nested[] =& $o->nested;
-$o->ryat = $o;
-$x =& $o->chtg;
-unset($o);
-gc_collect_cycles();
-var_dump($x);
-?>
--EXPECT--
-object(ryat)#1 (3) {
-  ["ryat"]=>
-  *RECURSION*
-  ["chtg"]=>
-  *RECURSION*
-  ["nested"]=>
-  &array(1) {
-    [0]=>
-    *RECURSION*
-  }
-}
@@ -1,26 +0,0 @@
--TEST--
-Object properties HT may need to be removed from nested data
--FILE--
-<?php
-
-class Test {
-    public function __destruct() {
-        $GLOBALS['x'] = $this;
-    }
-}
-
-$t = new Test;
-$t->x = new stdClass;
-$t->x->t = $t;
-$a = (array) $t->x;
-unset($t, $a);
-gc_collect_cycles();
-var_dump($x);
-
-// TODO: The destructor *should* be running here, but doesn't.
-// This works in PHP >= 7.3 though.
-
-?>
--EXPECTF--
-Notice: Undefined variable: x in %s on line %d
-NULL
@@ -1,8 +0,0 @@
--TEST--
-Using __COMPILER_HALF_OFFSET__ with trailing {} (OSS-Fuzz #17895)
--FILE--
-<?php
-__COMPILER_HALT_OFFSET__;
-{}
--EXPECTF--
-Warning: Use of undefined constant __COMPILER_HALT_OFFSET__ - assumed '__COMPILER_HALT_OFFSET__' (this will throw an Error in a future version of PHP) in %s on line %d
@@ -1,17 +0,0 @@
--TEST--
-Memory leak on ** with result==op1 array
--FILE--
-<?php
-
-$x = [0];
-$x **= 1;
-var_dump($x);
-
-$x = [0];
-$x **= $x;
-var_dump($x);
-
-?>
--EXPECT--
-int(0)
-int(0)
@@ -1,15 +0,0 @@
--TEST--
-Calling a static method on a non-existing class
--FILE--
-<?php
-
-$str = "foo";
-try {
-    Test::{$str . "bar"}();
-} catch (Error $e) {
-    echo $e->getMessage(), "\n";
-}
-
-?>
--EXPECT--
-Class 'Test' not found
@@ -2837,7 +2837,7 @@ ZEND_API int zend_disable_function(char *function_name, size_t function_name_len
 {
 	zend_internal_function *func;
 	if ((func = zend_hash_str_find_ptr(CG(function_table), function_name, function_name_length))) {
-	    func->fn_flags &= ~(ZEND_ACC_VARIADIC | ZEND_ACC_HAS_TYPE_HINTS | ZEND_ACC_HAS_RETURN_TYPE);
+	    func->fn_flags &= ~(ZEND_ACC_VARIADIC | ZEND_ACC_HAS_TYPE_HINTS);
 		func->num_args = 0;
 		func->arg_info = NULL;
 		func->handler = ZEND_FN(display_disabled_function);
@@ -980,7 +980,7 @@ get_chunk:
 				heap->cached_chunks = chunk->next;
 			} else {
 #if ZEND_MM_LIMIT
-				if (UNEXPECTED(ZEND_MM_CHUNK_SIZE > heap->limit - heap->real_size)) {
+				if (UNEXPECTED(heap->real_size + ZEND_MM_CHUNK_SIZE > heap->limit)) {
 					if (zend_mm_gc(heap)) {
 						goto get_chunk;
 					} else if (heap->overflow == 0) {
@@ -1484,8 +1484,8 @@ static void *zend_mm_realloc_heap(zend_mm_heap *heap, void *ptr, size_t size, si
 				}
 			} else /* if (new_size > old_size) */ {
 #if ZEND_MM_LIMIT
-				if (UNEXPECTED(new_size - old_size > heap->limit - heap->real_size)) {
-					if (zend_mm_gc(heap) && new_size - old_size <= heap->limit - heap->real_size) {
+				if (UNEXPECTED(heap->real_size + (new_size - old_size) > heap->limit)) {
+					if (zend_mm_gc(heap) && heap->real_size + (new_size - old_size) <= heap->limit) {
 						/* pass */
 					} else if (heap->overflow == 0) {
 #if ZEND_DEBUG
@@ -1723,20 +1723,15 @@ static void *zend_mm_alloc_huge(zend_mm_heap *heap, size_t size ZEND_FILE_LINE_D
 	 * We allocate them with 2MB size granularity, to avoid many
 	 * reallocations when they are extended by small pieces
 	 */
-	size_t alignment = MAX(REAL_PAGE_SIZE, ZEND_MM_CHUNK_SIZE);
+	size_t new_size = ZEND_MM_ALIGNED_SIZE_EX(size, MAX(REAL_PAGE_SIZE, ZEND_MM_CHUNK_SIZE));
 #else
-	size_t alignment = REAL_PAGE_SIZE;
+	size_t new_size = ZEND_MM_ALIGNED_SIZE_EX(size, REAL_PAGE_SIZE);
 #endif
-	size_t new_size = ZEND_MM_ALIGNED_SIZE_EX(size, alignment);
 	void *ptr;

-	if (UNEXPECTED(new_size < size)) {
-		zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu + %zu)", size, alignment);
-	}
-
 #if ZEND_MM_LIMIT
-	if (UNEXPECTED(new_size > heap->limit - heap->real_size)) {
-		if (zend_mm_gc(heap) && new_size <= heap->limit - heap->real_size) {
+	if (UNEXPECTED(heap->real_size + new_size > heap->limit)) {
+		if (zend_mm_gc(heap) && heap->real_size + new_size <= heap->limit) {
 			/* pass */
 		} else if (heap->overflow == 0) {
 #if ZEND_DEBUG
@@ -731,11 +731,6 @@ static int zend_ast_valid_var_name(const char *s, size_t len)
 	return 1;
 }

-static ZEND_COLD int zend_ast_var_needs_braces(char ch)
-{
-	return ch == '[' || zend_ast_valid_var_char(ch);
-}
-
 static void zend_ast_export_var(smart_str *str, zend_ast *ast, int priority, int indent)
 {
 	if (ast->kind == ZEND_AST_ZVAL) {
@@ -783,7 +778,7 @@ static void zend_ast_export_encaps_list(smart_str *str, char quote, zend_ast_lis
 		           ast->child[0]->kind == ZEND_AST_ZVAL &&
 		           (i + 1 == list->children ||
 		            list->child[i + 1]->kind != ZEND_AST_ZVAL ||
-		            !zend_ast_var_needs_braces(
+		            !zend_ast_valid_var_char(
 		                *Z_STRVAL_P(
 		                    zend_ast_get_zval(list->child[i + 1]))))) {
 			zend_ast_export_ex(str, ast, 0, indent);
@@ -894,7 +889,7 @@ tail_call:
 		} else {
 			zend_ast_export_indent(str, indent);
 			smart_str_appends(str, "} else ");
-			if (ast->child[1] && ast->child[1]->kind == ZEND_AST_IF) {
+			if (ast->child[1]->kind == ZEND_AST_IF) {
 				list = (zend_ast_list*)ast->child[1];
 				goto tail_call;
 			} else {
@@ -1395,8 +1390,6 @@ simple_list:
 				zend_ast_export_ex(str, ast->child[1], 80, indent);
 				smart_str_appends(str, " => ");
 			}
-			if (ast->attr)
-				smart_str_appendc(str, '&');
 			zend_ast_export_ex(str, ast->child[0], 80, indent);
 			break;
 		case ZEND_AST_NEW:
@@ -268,16 +268,8 @@ static int zend_create_closure_from_callable(zval *return_value, zval *callable,

 	mptr = fcc.function_handler;
 	if (mptr->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
-		/* For Closure::fromCallable([$closure, "__invoke"]) return $closure. */
-		if (fcc.object && fcc.object->ce == zend_ce_closure
-				&& zend_string_equals_literal(mptr->common.function_name, "__invoke")) {
-			ZVAL_OBJ(return_value, fcc.object);
-			GC_REFCOUNT(fcc.object)++;
-			zend_free_trampoline(mptr);
-			return SUCCESS;
-		}
-
 		memset(&call, 0, sizeof(zend_internal_function));
+
 		call.type = ZEND_INTERNAL_FUNCTION;
 		call.handler = zend_closure_call_magic;
 		call.function_name = mptr->common.function_name;
@@ -6619,7 +6619,6 @@ void zend_compile_use(zend_ast *ast) /* {{{ */
 		}

 		zend_string_addref(old_name);
-		old_name = zend_new_interned_string(old_name);
 		if (!zend_hash_add_ptr(current_import, lookup_name, old_name)) {
 			zend_error_noreturn(E_COMPILE_ERROR, "Cannot use%s %s as %s because the name "
 				"is already in use", zend_get_use_type_str(type), ZSTR_VAL(old_name), ZSTR_VAL(new_name));
@@ -7676,9 +7675,6 @@ void zend_compile_const(znode *result, zend_ast *ast) /* {{{ */

 		while (last && last->kind == ZEND_AST_STMT_LIST) {
 			zend_ast_list *list = zend_ast_get_list(last);
-			if (list->children == 0) {
-				break;
-			}
 			last = list->child[list->children-1];
 		}
 		if (last && last->kind == ZEND_AST_HALT_COMPILER) {
@@ -388,14 +388,11 @@ tail_call:
 			ZVAL_OBJ(&tmp, obj);
 			ht = get_gc(&tmp, &zv, &n);
 			end = zv + n;
-			if (EXPECTED(!ht) || UNEXPECTED(GC_REF_GET_COLOR(ht) == GC_BLACK)) {
-				ht = NULL;
+			if (EXPECTED(!ht)) {
 				if (!n) return;
 				while (!Z_REFCOUNTED_P(--end)) {
 					if (zv == end) return;
 				}
-			} else {
-				GC_REF_SET_BLACK(ht);
 			}
 			while (zv != end) {
 				if (Z_REFCOUNTED_P(zv)) {
@@ -501,19 +498,15 @@ tail_call:
 				ZVAL_OBJ(&tmp, obj);
 				ht = get_gc(&tmp, &zv, &n);
 				end = zv + n;
-				if (EXPECTED(!ht) || UNEXPECTED(GC_REF_GET_COLOR(ht) == GC_GREY)) {
-					ht = NULL;
+				if (EXPECTED(!ht)) {
 					if (!n) return;
 					while (!Z_REFCOUNTED_P(--end)) {
 						if (zv == end) return;
 					}
-				} else {
-					GC_REF_SET_COLOR(ht, GC_GREY);
 				}
 				while (zv != end) {
 					if (Z_REFCOUNTED_P(zv)) {
 						ref = Z_COUNTED_P(zv);
-						ZEND_ASSERT(GC_REFCOUNT(ref) > 0);
 						GC_REFCOUNT(ref)--;
 						gc_mark_grey(ref);
 					}
@@ -521,7 +514,6 @@ tail_call:
 				}
 				if (EXPECTED(!ht)) {
 					ref = Z_COUNTED_P(zv);
-					ZEND_ASSERT(GC_REFCOUNT(ref) > 0);
 					GC_REFCOUNT(ref)--;
 					goto tail_call;
 				}
@@ -538,7 +530,6 @@ tail_call:
 		} else if (GC_TYPE(ref) == IS_REFERENCE) {
 			if (Z_REFCOUNTED(((zend_reference*)ref)->val)) {
 				ref = Z_COUNTED(((zend_reference*)ref)->val);
-				ZEND_ASSERT(GC_REFCOUNT(ref) > 0);
 				GC_REFCOUNT(ref)--;
 				goto tail_call;
 			}
@@ -568,7 +559,6 @@ tail_call:
 			}
 			if (Z_REFCOUNTED_P(zv)) {
 				ref = Z_COUNTED_P(zv);
-				ZEND_ASSERT(GC_REFCOUNT(ref) > 0);
 				GC_REFCOUNT(ref)--;
 				gc_mark_grey(ref);
 			}
@@ -579,7 +569,6 @@ tail_call:
 			zv = Z_INDIRECT_P(zv);
 		}
 		ref = Z_COUNTED_P(zv);
-		ZEND_ASSERT(GC_REFCOUNT(ref) > 0);
 		GC_REFCOUNT(ref)--;
 		goto tail_call;
 	}
@@ -622,14 +611,11 @@ tail_call:
 					ZVAL_OBJ(&tmp, obj);
 					ht = get_gc(&tmp, &zv, &n);
 					end = zv + n;
-					if (EXPECTED(!ht) || UNEXPECTED(GC_REF_GET_COLOR(ht) != GC_GREY)) {
-						ht = NULL;
+					if (EXPECTED(!ht)) {
 						if (!n) return;
 						while (!Z_REFCOUNTED_P(--end)) {
 							if (zv == end) return;
 						}
-					} else {
-						GC_REF_SET_COLOR(ht, GC_WHITE);
 					}
 					while (zv != end) {
 						if (Z_REFCOUNTED_P(zv)) {
@@ -800,8 +786,7 @@ tail_call:
 				ZVAL_OBJ(&tmp, obj);
 				ht = get_gc(&tmp, &zv, &n);
 				end = zv + n;
-				if (EXPECTED(!ht) || UNEXPECTED(GC_REF_GET_COLOR(ht) == GC_BLACK)) {
-					ht = NULL;
+				if (EXPECTED(!ht)) {
 					if (!n) return count;
 					while (!Z_REFCOUNTED_P(--end)) {
 						/* count non-refcounted for compatibility ??? */
@@ -810,8 +795,6 @@ tail_call:
 						}
 						if (zv == end) return count;
 					}
-				} else {
-					GC_REF_SET_BLACK(ht);
 				}
 				while (zv != end) {
 					if (Z_REFCOUNTED_P(zv)) {
@@ -953,9 +936,11 @@ static void gc_remove_nested_data_from_buffer(zend_refcounted *ref, gc_root_buff
 	zval *zv;

 tail_call:
-	do {
+	if (root ||
+	    (GC_ADDRESS(GC_INFO(ref)) != 0 &&
+	     GC_REF_GET_COLOR(ref) == GC_BLACK)) {
+		GC_TRACE_REF(ref, "removing from buffer");
 		if (root) {
-			GC_TRACE_REF(ref, "removing from buffer");
 			if (EXPECTED(GC_ADDRESS(GC_INFO(root->ref)) < GC_ROOT_BUFFER_MAX_ENTRIES)) {
 				gc_remove_from_roots(root);
 			} else {
@@ -963,18 +948,8 @@ tail_call:
 			}
 			GC_INFO(ref) = 0;
 			root = NULL;
-		} else if (GC_ADDRESS(GC_INFO(ref)) != 0
-		 && GC_REF_GET_COLOR(ref) == GC_BLACK) {
-			GC_TRACE_REF(ref, "removing from buffer");
-			GC_REMOVE_FROM_BUFFER(ref);
-		} else if (GC_TYPE(ref) == IS_REFERENCE) {
-			if (Z_REFCOUNTED(((zend_reference*)ref)->val)) {
-				ref = Z_COUNTED(((zend_reference*)ref)->val);
-				goto tail_call;
-			}
-			return;
 		} else {
-			return;
+			GC_REMOVE_FROM_BUFFER(ref);
 		}

 		if (GC_TYPE(ref) == IS_OBJECT) {
@@ -1007,15 +982,17 @@ tail_call:
 					ref = Z_COUNTED_P(zv);
 					goto tail_call;
 				}
-				if (GC_ADDRESS(GC_INFO(ht)) != 0 && GC_REF_GET_COLOR(ht) == GC_BLACK) {
-					GC_TRACE_REF(ht, "removing from buffer");
-					GC_REMOVE_FROM_BUFFER(ht);
-				}
 			} else {
 				return;
 			}
 		} else if (GC_TYPE(ref) == IS_ARRAY) {
 			ht = (zend_array*)ref;
+		} else if (GC_TYPE(ref) == IS_REFERENCE) {
+			if (Z_REFCOUNTED(((zend_reference*)ref)->val)) {
+				ref = Z_COUNTED(((zend_reference*)ref)->val);
+				goto tail_call;
+			}
+			return;
 		} else {
 			return;
 		}
@@ -1051,7 +1028,7 @@ tail_call:
 		}
 		ref = Z_COUNTED_P(zv);
 		goto tail_call;
-	} while (0);
+	}
 }

 ZEND_API int zend_gc_collect_cycles(void)
@@ -97,18 +97,16 @@ ZEND_API zend_execute_data* zend_generator_freeze_call_stack(zend_execute_data *
 /* }}} */

 static void zend_generator_cleanup_unfinished_execution(
-		zend_generator *generator, zend_execute_data *execute_data, uint32_t catch_op_num) /* {{{ */
+		zend_generator *generator, uint32_t catch_op_num) /* {{{ */
 {
+	zend_execute_data *execute_data = generator->execute_data;
+
 	if (execute_data->opline != execute_data->func->op_array.opcodes) {
 		/* -1 required because we want the last run opcode, not the next to-be-run one. */
 		uint32_t op_num = execute_data->opline - execute_data->func->op_array.opcodes - 1;

 		if (UNEXPECTED(generator->frozen_call_stack)) {
-			/* Temporarily restore generator->execute_data if it has been NULLed out already. */
-			zend_execute_data *save_ex = generator->execute_data;
-			generator->execute_data = execute_data;
 			zend_generator_restore_call_stack(generator);
-			generator->execute_data = save_ex;
 		}
 		zend_cleanup_unfinished_execution(execute_data, op_num, catch_op_num);
 	}
@@ -119,9 +117,6 @@ ZEND_API void zend_generator_close(zend_generator *generator, zend_bool finished
 {
 	if (EXPECTED(generator->execute_data)) {
 		zend_execute_data *execute_data = generator->execute_data;
-		/* Null out execute_data early, to prevent double frees if GC runs while we're
-		 * already cleaning up execute_data. */
-		generator->execute_data = NULL;

 		if (EX_CALL_INFO() & ZEND_CALL_HAS_SYMBOL_TABLE) {
 			zend_clean_and_cache_symbol_table(execute_data->symbol_table);
@@ -140,12 +135,12 @@ ZEND_API void zend_generator_close(zend_generator *generator, zend_bool finished
 			return;
 		}

-		zend_vm_stack_free_extra_args(execute_data);
+		zend_vm_stack_free_extra_args(generator->execute_data);

 		/* Some cleanups are only necessary if the generator was closed
 		 * before it could finish execution (reach a return statement). */
 		if (UNEXPECTED(!finished_execution)) {
-			zend_generator_cleanup_unfinished_execution(generator, execute_data, 0);
+			zend_generator_cleanup_unfinished_execution(generator, 0);
 		}

 		/* Free closure object */
@@ -159,7 +154,8 @@ ZEND_API void zend_generator_close(zend_generator *generator, zend_bool finished
 			generator->gc_buffer = NULL;
 		}

-		efree(execute_data);
+		efree(generator->execute_data);
+		generator->execute_data = NULL;
 	}
 }
 /* }}} */
@@ -220,7 +216,7 @@ static void zend_generator_dtor_storage(zend_object *object) /* {{{ */
 	if (finally_op_num) {
 		zval *fast_call;

-		zend_generator_cleanup_unfinished_execution(generator, ex, finally_op_num);
+		zend_generator_cleanup_unfinished_execution(generator, finally_op_num);

 		fast_call = ZEND_CALL_VAR(ex, ex->func->op_array.opcodes[finally_op_end].op1.var);
 		Z_OBJ_P(fast_call) = EG(exception);
@@ -275,7 +271,7 @@ static uint32_t calc_gc_buffer_size(zend_generator *generator) /* {{{ */
 		if (EX_CALL_INFO() & ZEND_CALL_FREE_EXTRA_ARGS) {
 			size += EX_NUM_ARGS() - op_array->num_args;
 		}
-		size += (EX_CALL_INFO() & ZEND_CALL_RELEASE_THIS) != 0; /* $this */
+		size += Z_TYPE(execute_data->This) == IS_OBJECT; /* $this */
 		size += (EX_CALL_INFO() & ZEND_CALL_CLOSURE) != 0; /* Closure object */

 		/* Live vars */
@@ -356,7 +352,7 @@ static HashTable *zend_generator_get_gc(zval *object, zval **table, int *n) /* {
 		}
 	}

-	if (EX_CALL_INFO() & ZEND_CALL_RELEASE_THIS) {
+	if (Z_TYPE(execute_data->This) == IS_OBJECT) {
 		ZVAL_OBJ(gc_buffer++, Z_OBJ(execute_data->This));
 	}
 	if (EX_CALL_INFO() & ZEND_CALL_CLOSURE) {
@@ -1315,7 +1315,7 @@ static YYSIZE_T zend_yytnamerr(char *yyres, const char *yystr)

 		if (LANG_SCNG(yy_text)[0] == 0 &&
 			LANG_SCNG(yy_leng) == 1 &&
-			strcmp(yystr, "\"end of file\"") == 0) {
+			memcmp(yystr, "\"end of file\"", sizeof("\"end of file\"") - 1) == 0) {
 			if (yyres) {
 				yystpcpy(yyres, "end of file");
 			}
@@ -138,11 +138,6 @@ ZEND_API HashTable *zend_std_get_gc(zval *object, zval **table, int *n) /* {{{ *
 		if (zobj->properties) {
 			*table = NULL;
 			*n = 0;
-			if (UNEXPECTED(GC_REFCOUNT(zobj->properties) > 1)
-			 && EXPECTED(!(GC_FLAGS(zobj->properties) & IS_ARRAY_IMMUTABLE))) {
-				GC_REFCOUNT(zobj->properties)--;
-				zobj->properties = zend_array_dup(zobj->properties);
-			}
 			return zobj->properties;
 		} else {
 			*table = zobj->properties_table;
@@ -46,8 +46,7 @@ ZEND_API void zend_object_std_dtor(zend_object *object)

 	if (object->properties) {
 		if (EXPECTED(!(GC_FLAGS(object->properties) & IS_ARRAY_IMMUTABLE))) {
-			if (EXPECTED(--GC_REFCOUNT(object->properties) == 0)
-					&& EXPECTED(GC_TYPE(object->properties) != IS_NULL)) {
+			if (EXPECTED(--GC_REFCOUNT(object->properties) == 0)) {
 				zend_array_destroy(object->properties);
 			}
 		}
@@ -1128,18 +1128,12 @@ ZEND_API int ZEND_FASTCALL pow_function(zval *result, zval *op1, zval *op2) /* {

 					if (EXPECTED(op1 != op2)) {
 						if (Z_TYPE_P(op1) == IS_ARRAY) {
-							if (op1 == result) {
-								zval_ptr_dtor(result);
-							}
 							ZVAL_LONG(result, 0);
 							return SUCCESS;
 						} else {
 							zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
 						}
 						if (Z_TYPE_P(op2) == IS_ARRAY) {
-							if (op1 == result) {
-								zval_ptr_dtor(result);
-							}
 							ZVAL_LONG(result, 1L);
 							return SUCCESS;
 						} else {
@@ -1147,9 +1141,6 @@ ZEND_API int ZEND_FASTCALL pow_function(zval *result, zval *op1, zval *op2) /* {
 						}
 					} else {
 						if (Z_TYPE_P(op1) == IS_ARRAY) {
-							if (op1 == result) {
-								zval_ptr_dtor(result);
-							}
 							ZVAL_LONG(result, 0);
 							return SUCCESS;
 						} else {
@@ -91,10 +91,10 @@ ZEND_API const char* ZEND_FASTCALL zend_memnstr_ex(const char *haystack, const c
 ZEND_API const char* ZEND_FASTCALL zend_memnrstr_ex(const char *haystack, const char *needle, size_t needle_len, const char *end);

 #if SIZEOF_ZEND_LONG == 4
-#	define ZEND_DOUBLE_FITS_LONG(d) (!((d) > (double)ZEND_LONG_MAX || (d) < (double)ZEND_LONG_MIN))
+#	define ZEND_DOUBLE_FITS_LONG(d) (!((d) > ZEND_LONG_MAX || (d) < ZEND_LONG_MIN))
 #else
 	/* >= as (double)ZEND_LONG_MAX is outside signed range */
-#	define ZEND_DOUBLE_FITS_LONG(d) (!((d) >= (double)ZEND_LONG_MAX || (d) < (double)ZEND_LONG_MIN))
+#	define ZEND_DOUBLE_FITS_LONG(d) (!((d) >= ZEND_LONG_MAX || (d) < ZEND_LONG_MIN))
 #endif

 #if ZEND_DVAL_TO_LVAL_CAST_OK
@@ -330,13 +330,13 @@ void zend_signal_activate(void)

 	SIGG(active) = 1;
 	SIGG(depth)  = 0;
-	SIGG(check)  = ZEND_DEBUG;
 } /* }}} */

 /* {{{ zend_signal_deactivate
 * */
 void zend_signal_deactivate(void)
 {
+
 	if (SIGG(check)) {
 		size_t x;
 		struct sigaction sa;
@@ -344,32 +344,21 @@ void zend_signal_deactivate(void)
 		if (SIGG(depth) != 0) {
 			zend_error(E_CORE_WARNING, "zend_signal: shutdown with non-zero blocking depth (%d)", SIGG(depth));
 		}
-
 		/* did anyone steal our installed handler */
 		for (x = 0; x < sizeof(zend_sigs) / sizeof(*zend_sigs); x++) {
 			sigaction(zend_sigs[x], NULL, &sa);
-			if (sa.sa_sigaction != zend_signal_handler_defer &&
-					sa.sa_sigaction != (void *) SIG_IGN) {
+			if (sa.sa_sigaction != zend_signal_handler_defer) {
 				zend_error(E_CORE_WARNING, "zend_signal: handler was replaced for signal (%d) after startup", zend_sigs[x]);
 			}
 		}
 	}

-	/* After active=0 is set, signal handlers will be called directly and other
-	 * state that is reset below will not be accessed. */
-	*((volatile int *) &SIGG(active)) = 0;
-
+	SIGNAL_BEGIN_CRITICAL();
+	SIGG(active) = 0;
 	SIGG(running) = 0;
 	SIGG(blocked) = 0;
 	SIGG(depth) = 0;
-
-	/* If there are any queued signals because of a missed unblock, drop them. */
-	if (SIGG(phead) && SIGG(ptail)) {
-		SIGG(ptail)->next = SIGG(pavail);
-		SIGG(pavail) = SIGG(phead);
-		SIGG(phead) = NULL;
-		SIGG(ptail) = NULL;
-	}
+	SIGNAL_END_CRITICAL();
 }
 /* }}} */

@@ -91,8 +91,6 @@ cwd_state main_cwd_state; /* True global */
 #include <unistd.h>
 #else
 #include <direct.h>
-#include "zend_globals.h"
-#include "zend_globals_macros.h"
 #endif

 #define CWD_STATE_COPY(d, s)				\
@@ -857,7 +855,6 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 		tmp = do_alloca(len+1, use_heap);
 		memcpy(tmp, path, len+1);

-retry:
 		if(save &&
 				!(IS_UNC_PATH(path, len) && len >= 3 && path[2] != '?') &&
                               (dataw.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT)
@@ -898,21 +895,7 @@ retry:
 				return -1;
 			}
 			if(!DeviceIoControl(hLink, FSCTL_GET_REPARSE_POINT, NULL, 0, pbuffer,  MAXIMUM_REPARSE_DATA_BUFFER_SIZE, &retlength, NULL)) {
-				BY_HANDLE_FILE_INFORMATION fileInformation;
-
 				free_alloca(pbuffer, use_heap_large);
-				if ((dataw.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT) &&
-						(dataw.dwReserved0 & ~IO_REPARSE_TAG_CLOUD_MASK) == IO_REPARSE_TAG_CLOUD &&
-						EG(windows_version_info).dwMajorVersion >= 10 &&
-						EG(windows_version_info).dwMinorVersion == 0 &&
-						EG(windows_version_info).dwBuildNumber >= 18362 &&
-						GetFileInformationByHandle(hLink, &fileInformation) &&
-						!(fileInformation.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT)) {
-					dataw.dwFileAttributes = fileInformation.dwFileAttributes;
-					CloseHandle(hLink);
-					(*ll)--;
-					goto retry;
-				}
 				free_alloca(tmp, use_heap);
 				CloseHandle(hLink);
 				FREE_PATHW()
@@ -992,7 +975,8 @@ retry:
 			}
 			else if (pbuffer->ReparseTag == IO_REPARSE_TAG_DEDUP ||
 					/* Starting with 1709. */
-					(pbuffer->ReparseTag & ~IO_REPARSE_TAG_CLOUD_MASK) == IO_REPARSE_TAG_CLOUD ||
+					(pbuffer->ReparseTag & IO_REPARSE_TAG_CLOUD_MASK) != 0 && 0x90001018L != pbuffer->ReparseTag ||
+					IO_REPARSE_TAG_CLOUD == pbuffer->ReparseTag ||
 					IO_REPARSE_TAG_ONEDRIVE == pbuffer->ReparseTag) {
 				isabsolute = 1;
 				substitutename = malloc((len + 1) * sizeof(char));
@@ -758,10 +758,8 @@ ZEND_VM_HANDLER(13, ZEND_BOOL_NOT, CONST|TMPVAR|CV, ANY)
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_FALSE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
-		/* The result and op1 can be the same cv zval */
-		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_TRUE(EX_VAR(opline->result.var));
-		if (OP1_TYPE == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
+		if (OP1_TYPE == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
 			SAVE_OPLINE();
 			GET_OP1_UNDEF_CV(val, BP_VAR_R);
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -2400,11 +2398,6 @@ ZEND_VM_HELPER(zend_leave_helper, ANY, ANY)
 			zend_clean_and_cache_symbol_table(EX(symbol_table));
 		}
 		EG(current_execute_data) = EX(prev_execute_data);
-
-		/* Free extra args before releasing the closure,
-		 * as that may free the op_array. */
-		zend_vm_stack_free_extra_args_ex(call_info, execute_data);
-
 		if (UNEXPECTED(call_info & ZEND_CALL_RELEASE_THIS)) {
 			zend_object *object = Z_OBJ(execute_data->This);
 #if 0
@@ -2420,6 +2413,7 @@ ZEND_VM_HELPER(zend_leave_helper, ANY, ANY)
 			OBJ_RELEASE((zend_object*)execute_data->func->op_array.prototype);
 		}

+		zend_vm_stack_free_extra_args_ex(call_info, execute_data);
 		old_execute_data = execute_data;
 		execute_data = EX(prev_execute_data);
 		zend_vm_stack_free_call_frame_ex(call_info, old_execute_data);
@@ -3100,7 +3094,6 @@ ZEND_VM_HANDLER(113, ZEND_INIT_STATIC_METHOD_CALL, UNUSED|CLASS_FETCH|CONST|VAR,
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
-				FREE_UNFETCHED_OP2();
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -4757,10 +4750,8 @@ ZEND_VM_HANDLER(52, ZEND_BOOL, CONST|TMPVAR|CV, ANY)
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_TRUE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
-		/* The result and op1 can be the same cv zval */
-		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_FALSE(EX_VAR(opline->result.var));
-		if (OP1_TYPE == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
+		if (OP1_TYPE == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
 			SAVE_OPLINE();
 			GET_OP1_UNDEF_CV(val, BP_VAR_R);
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -8553,7 +8544,7 @@ ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_IS_SMALLER_OR_EQUAL, (op1_info == MAY_BE_DOUB
 	ZEND_VM_NEXT_OPCODE();
 }

-ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_PRE_INC, (res_info == MAY_BE_LONG && op1_info == MAY_BE_LONG), ZEND_PRE_INC_LONG_NO_OVERFLOW, CV, ANY, SPEC(RETVAL))
+ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_PRE_INC, (res_info == MAY_BE_LONG && op1_info == MAY_BE_LONG), ZEND_PRE_INC_LONG_NO_OVERFLOW, TMPVARCV, ANY, SPEC(RETVAL))
 {
 	USE_OPLINE
 	zval *var_ptr;
@@ -8566,7 +8557,7 @@ ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_PRE_INC, (res_info == MAY_BE_LONG && op1_info
 	ZEND_VM_NEXT_OPCODE();
 }

-ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_PRE_INC, (op1_info == MAY_BE_LONG), ZEND_PRE_INC_LONG, CV, ANY, SPEC(RETVAL))
+ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_PRE_INC, (op1_info == MAY_BE_LONG), ZEND_PRE_INC_LONG, TMPVARCV, ANY, SPEC(RETVAL))
 {
 	USE_OPLINE
 	zval *var_ptr;
@@ -8579,7 +8570,7 @@ ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_PRE_INC, (op1_info == MAY_BE_LONG), ZEND_PRE_
 	ZEND_VM_NEXT_OPCODE();
 }

-ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_PRE_INC, (op1_info == (MAY_BE_LONG|MAY_BE_DOUBLE)), ZEND_PRE_INC_LONG_OR_DOUBLE, CV, ANY, SPEC(RETVAL))
+ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_PRE_INC, (op1_info == (MAY_BE_LONG|MAY_BE_DOUBLE)), ZEND_PRE_INC_LONG_OR_DOUBLE, TMPVARCV, ANY, SPEC(RETVAL))
 {
 	USE_OPLINE
 	zval *var_ptr;
@@ -8596,7 +8587,7 @@ ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_PRE_INC, (op1_info == (MAY_BE_LONG|MAY_BE_DOU
 	ZEND_VM_NEXT_OPCODE();
 }

-ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_PRE_DEC, (res_info == MAY_BE_LONG && op1_info == MAY_BE_LONG), ZEND_PRE_DEC_LONG_NO_OVERFLOW, CV, ANY, SPEC(RETVAL))
+ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_PRE_DEC, (res_info == MAY_BE_LONG && op1_info == MAY_BE_LONG), ZEND_PRE_DEC_LONG_NO_OVERFLOW, TMPVARCV, ANY, SPEC(RETVAL))
 {
 	USE_OPLINE
 	zval *var_ptr;
@@ -8609,7 +8600,7 @@ ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_PRE_DEC, (res_info == MAY_BE_LONG && op1_info
 	ZEND_VM_NEXT_OPCODE();
 }

-ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_PRE_DEC, (op1_info == MAY_BE_LONG), ZEND_PRE_DEC_LONG, CV, ANY, SPEC(RETVAL))
+ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_PRE_DEC, (op1_info == MAY_BE_LONG), ZEND_PRE_DEC_LONG, TMPVARCV, ANY, SPEC(RETVAL))
 {
 	USE_OPLINE
 	zval *var_ptr;
@@ -8622,7 +8613,7 @@ ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_PRE_DEC, (op1_info == MAY_BE_LONG), ZEND_PRE_
 	ZEND_VM_NEXT_OPCODE();
 }

-ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_PRE_DEC, (op1_info == (MAY_BE_LONG|MAY_BE_DOUBLE)), ZEND_PRE_DEC_LONG_OR_DOUBLE, CV, ANY, SPEC(RETVAL))
+ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_PRE_DEC, (op1_info == (MAY_BE_LONG|MAY_BE_DOUBLE)), ZEND_PRE_DEC_LONG_OR_DOUBLE, TMPVARCV, ANY, SPEC(RETVAL))
 {
 	USE_OPLINE
 	zval *var_ptr;
@@ -8639,7 +8630,7 @@ ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_PRE_DEC, (op1_info == (MAY_BE_LONG|MAY_BE_DOU
 	ZEND_VM_NEXT_OPCODE();
 }

-ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_POST_INC, (res_info == MAY_BE_LONG && op1_info == MAY_BE_LONG), ZEND_POST_INC_LONG_NO_OVERFLOW, CV, ANY)
+ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_POST_INC, (res_info == MAY_BE_LONG && op1_info == MAY_BE_LONG), ZEND_POST_INC_LONG_NO_OVERFLOW, TMPVARCV, ANY)
 {
 	USE_OPLINE
 	zval *var_ptr;
@@ -8650,7 +8641,7 @@ ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_POST_INC, (res_info == MAY_BE_LONG && op1_inf
 	ZEND_VM_NEXT_OPCODE();
 }

-ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_POST_INC, (op1_info == MAY_BE_LONG), ZEND_POST_INC_LONG, CV, ANY)
+ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_POST_INC, (op1_info == MAY_BE_LONG), ZEND_POST_INC_LONG, TMPVARCV, ANY)
 {
 	USE_OPLINE
 	zval *var_ptr;
@@ -8661,7 +8652,7 @@ ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_POST_INC, (op1_info == MAY_BE_LONG), ZEND_POS
 	ZEND_VM_NEXT_OPCODE();
 }

-ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_POST_INC, (op1_info == (MAY_BE_LONG|MAY_BE_DOUBLE)), ZEND_POST_INC_LONG_OR_DOUBLE, CV, ANY)
+ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_POST_INC, (op1_info == (MAY_BE_LONG|MAY_BE_DOUBLE)), ZEND_POST_INC_LONG_OR_DOUBLE, TMPVARCV, ANY)
 {
 	USE_OPLINE
 	zval *var_ptr;
@@ -8676,7 +8667,7 @@ ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_POST_INC, (op1_info == (MAY_BE_LONG|MAY_BE_DO
 	ZEND_VM_NEXT_OPCODE();
 }

-ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_POST_DEC, (res_info == MAY_BE_LONG && op1_info == MAY_BE_LONG), ZEND_POST_DEC_LONG_NO_OVERFLOW, CV, ANY)
+ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_POST_DEC, (res_info == MAY_BE_LONG && op1_info == MAY_BE_LONG), ZEND_POST_DEC_LONG_NO_OVERFLOW, TMPVARCV, ANY)
 {
 	USE_OPLINE
 	zval *var_ptr;
@@ -8687,7 +8678,7 @@ ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_POST_DEC, (res_info == MAY_BE_LONG && op1_inf
 	ZEND_VM_NEXT_OPCODE();
 }

-ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_POST_DEC, (op1_info == MAY_BE_LONG), ZEND_POST_DEC_LONG, CV, ANY)
+ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_POST_DEC, (op1_info == MAY_BE_LONG), ZEND_POST_DEC_LONG, TMPVARCV, ANY)
 {
 	USE_OPLINE
 	zval *var_ptr;
@@ -8698,7 +8689,7 @@ ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_POST_DEC, (op1_info == MAY_BE_LONG), ZEND_POS
 	ZEND_VM_NEXT_OPCODE();
 }

-ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_POST_DEC, (op1_info == (MAY_BE_LONG|MAY_BE_DOUBLE)), ZEND_POST_DEC_LONG_OR_DOUBLE, CV, ANY)
+ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_POST_DEC, (op1_info == (MAY_BE_LONG|MAY_BE_DOUBLE)), ZEND_POST_DEC_LONG_OR_DOUBLE, TMPVARCV, ANY)
 {
 	USE_OPLINE
 	zval *var_ptr;
@@ -331,7 +331,7 @@ $op1_get_zval_ptr_ptr_undef = array(
 	"UNUSED"   => "NULL",
 	"CV"       => "_get_zval_ptr_cv_undef_\\1(opline->op1.var EXECUTE_DATA_CC)",
 	"TMPVAR"   => "???",
-	"TMPVARCV" => "???",
+	"TMPVARCV" => "EX_VAR(opline->op1.var)",
 );

 $op2_get_zval_ptr_ptr_undef = array(
@@ -342,7 +342,7 @@ $op2_get_zval_ptr_ptr_undef = array(
 	"UNUSED"   => "NULL",
 	"CV"       => "_get_zval_ptr_cv_undef_\\1(opline->op2.var EXECUTE_DATA_CC)",
 	"TMPVAR"   => "???",
-	"TMPVARCV" => "???",
+	"TMPVARCV" => "EX_VAR(opline->op2.var)",
 );

 $op1_get_obj_zval_ptr = array(
@@ -441,7 +441,7 @@ $op1_get_obj_zval_ptr_ptr_undef = array(
 	"UNUSED"   => "_get_obj_zval_ptr_unused(EXECUTE_DATA_C)",
 	"CV"       => "_get_zval_ptr_cv_undef_\\1(opline->op1.var EXECUTE_DATA_CC)",
 	"TMPVAR"   => "???",
-	"TMPVARCV" => "???",
+	"TMPVARCV" => "EX_VAR(opline->op1.var)",
 );

 $op2_get_obj_zval_ptr_ptr_undef = array(
@@ -452,7 +452,7 @@ $op2_get_obj_zval_ptr_ptr_undef = array(
 	"UNUSED"   => "_get_obj_zval_ptr_unused(EXECUTE_DATA_C)",
 	"CV"       => "_get_zval_ptr_cv_undef_\\1(opline->op2.var EXECUTE_DATA_CC)",
 	"TMPVAR"   => "???",
-	"TMPVARCV" => "???",
+	"TMPVARCV" => "EX_VAR(opline->op2.var)",
 );

 $op1_free_op = array(
@@ -398,8 +398,6 @@ AC_DEFUN([PHP_EVAL_LIBLINE],[
        $2="[$]$2 -pthread"
      else
        PHP_RUN_ONCE(EXTRA_LDFLAGS, [$ac_i], [EXTRA_LDFLAGS="$EXTRA_LDFLAGS $ac_i"])
-        PHP_RUN_ONCE(EXTRA_LDFLAGS_PROGRAM, [$ac_i],
-            [EXTRA_LDFLAGS_PROGRAM="$EXTRA_LDFLAGS_PROGRAM $ac_i"])
      fi
    ;;
    -l*[)]
@@ -2209,7 +2207,7 @@ AC_DEFUN([PHP_SETUP_ICU],[

  dnl If pkg-config is found try using it
  if test "$PHP_ICU_DIR" = "DEFAULT" && test -x "$PKG_CONFIG" && $PKG_CONFIG --exists icu-uc icu-io icu-i18n; then
-    if $PKG_CONFIG --atleast-version=4.0 icu-uc; then
+    if $PKG_CONFIG --atleast-version=40 icu-uc; then
      found_icu=yes
      icu_version_full=`$PKG_CONFIG --modversion icu-uc`
      ac_IFS=$IFS
@@ -2221,8 +2219,7 @@ AC_DEFUN([PHP_SETUP_ICU],[

      ICU_LIBS=`$PKG_CONFIG --libs icu-uc icu-io icu-i18n`
      ICU_INCS=`$PKG_CONFIG --cflags-only-I icu-uc icu-io icu-i18n`
-      ICU_CXXFLAGS=`$PKG_CONFIG --variable=CXXFLAGS icu-uc`
-      ICU_CXXFLAGS="$ICU_CXXFLAGS -DU_USING_ICU_NAMESPACE=1"
+      ICU_CXXFLAGS="-DU_USING_ICU_NAMESPACE=1"

      AC_MSG_RESULT([found $ICU_VERSION])

@@ -32,7 +32,7 @@ if /i "%APPVEYOR_REPO_BRANCH:~0,4%" equ "php-" (
 	set BRANCH=master
 )
 set STABILITY=staging
-set DEPS_DIR=%PHP_BUILD_CACHE_BASE_DIR%\deps-%BRANCH%-%PHP_SDK_VS%-%PHP_SDK_ARCH%
+set DEPS_DIR=%PHP_BUILD_CACHE_BASE_DIR%\deps-%BRANCH%-%PHP_SDK_VC%-%PHP_SDK_ARCH%
 rem SDK is cached, deps info is cached as well
 echo Updating dependencies in %DEPS_DIR%
 cmd /c phpsdk_deps --update --no-backup --branch %BRANCH% --stability %STABILITY% --deps %DEPS_DIR% --crt %PHP_BUILD_CRT%
@@ -11,7 +11,7 @@ if /i "%APPVEYOR_REPO_BRANCH:~0,4%" equ "php-" (
 	set BRANCH=master
 	set STABILITY=staging
 )
-set DEPS_DIR=%PHP_BUILD_CACHE_BASE_DIR%\deps-%BRANCH%-%PHP_SDK_VS%-%PHP_SDK_ARCH%
+set DEPS_DIR=%PHP_BUILD_CACHE_BASE_DIR%\deps-%BRANCH%-%PHP_SDK_VC%-%PHP_SDK_ARCH%
 if not exist "%DEPS_DIR%" (
 	echo "%DEPS_DIR%" doesn't exist
 	exit /b 3
@@ -107,7 +107,7 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=2
-PHP_RELEASE_VERSION=31
+PHP_RELEASE_VERSION=19
 PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
@@ -57,9 +57,9 @@ bc_str2num (bc_num *num, char *str, int scale)
  zero_int = FALSE;
  if ( (*ptr == '+') || (*ptr == '-'))  ptr++;  /* Sign */
  while (*ptr == '0') ptr++;			/* Skip leading zeros. */
-  while (*ptr >= '0' && *ptr <= '9') ptr++, digits++;	/* digits */
+  while (isdigit((int)*ptr)) ptr++, digits++;	/* digits */
  if (*ptr == '.') ptr++;			/* decimal point */
-  while (*ptr >= '0' && *ptr <= '9') ptr++, strscale++;	/* digits */
+  while (isdigit((int)*ptr)) ptr++, strscale++;	/* digits */
  if ((*ptr != '\0') || (digits+strscale == 0))
    {
      *num = bc_copy_num (BCG(_zero_));
@@ -1,13 +0,0 @@
--TEST--
-Bug #78878 (Buffer underflow in bc_shift_addsub)
--SKIPIF--
-<?php
-if (!extension_loaded('bcmath')) die('skip bcmath extension not available');
-?>
--FILE--
-<?php
-print @bcmul("\xB26483605105519922841849335928742092", bcpowmod(2, 65535, -4e-4));
-?>
--EXPECT--
-bc math warning: non-zero scale in modulus
-0
@@ -127,11 +127,6 @@ static void com_write_dimension(zval *object, zval *offset, zval *value)

 	obj = CDNO_FETCH(object);

-	if (offset == NULL) {
-		php_com_throw_exception(DISP_E_BADINDEX, "appending to variants is not supported");
-		return;
-	}
-
 	if (V_VT(&obj->v) == VT_DISPATCH) {
 		ZVAL_COPY_VALUE(&args[0], offset);
 		ZVAL_COPY_VALUE(&args[1], value);
@@ -1,19 +0,0 @@
--TEST--
-Bug #78694 (Appending to a variant array causes segfault)
--SKIPIF--
-<?php
-if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
-?>
--FILE--
-<?php
-foreach ([new com('WScript.Shell'), new variant([])] as $var) {
-    try {
-        $var[] = 42;
-    } catch (com_exception $ex) {
-        var_dump($ex->getMessage());
-    }
-}
-?>
--EXPECT--
-string(38) "appending to variants is not supported"
-string(38) "appending to variants is not supported"
@@ -152,6 +152,8 @@ static void _php_curl_close_ex(php_curl *ch);
 static void _php_curl_close(zend_resource *rsrc);


+#define SAVE_CURL_ERROR(__handle, __err) (__handle)->err.no = (int) __err;
+
 #define CAAL(s, v) add_assoc_long_ex(return_value, s, sizeof(s) - 1, (zend_long) v);
 #define CAAD(s, v) add_assoc_double_ex(return_value, s, sizeof(s) - 1, (double) v);
 #define CAAS(s, v) add_assoc_string_ex(return_value, s, sizeof(s) - 1, (char *) (v ? v : ""));
@@ -233,7 +233,7 @@ PHP_FUNCTION(curl_multi_select)
 	}

 #if LIBCURL_VERSION_NUM >= 0x071c00 /* Available since 7.28.0 */
-	error = curl_multi_wait(mh->multi, NULL, 0, (unsigned long) (timeout * 1000.0), &numfds);
+	error = curl_multi_wait(mh->multi, NULL, 0, (unsigned long) timeout * 1000.0, &numfds);
 	if (CURLM_OK != error) {
 		SAVE_CURLM_ERROR(mh, error);
 		RETURN_LONG(-1);
@@ -339,7 +339,6 @@ PHP_FUNCTION(curl_multi_info_read)
 	CURLMsg	  *tmp_msg;
 	int        queued_msgs;
 	zval      *zmsgs_in_queue = NULL;
-	php_curl  *ch;

 	ZEND_PARSE_PARAMETERS_START(1, 2)
 		Z_PARAM_RESOURCE(z_mh)
@@ -377,10 +376,6 @@ PHP_FUNCTION(curl_multi_info_read)
 			   being done in add_assoc_resource */
 			Z_ADDREF_P(pz_ch);

-			/* we must save result to be able to read error message */
-			ch = (php_curl*)zend_fetch_resource(Z_RES_P(pz_ch), le_curl_name, le_curl);
-			SAVE_CURL_ERROR(ch, tmp_msg->data.result);
-
 			/* add_assoc_resource automatically creates a new zval to
 			   wrap the "resource" represented by the current pz_ch */

@@ -60,8 +60,6 @@ extern zend_module_entry curl_module_entry;
 #define PHP_CURL_RETURN 4
 #define PHP_CURL_IGNORE 7

-#define SAVE_CURL_ERROR(__handle, __err) (__handle)->err.no = (int) __err;
-
 extern int  le_curl;
 #define le_curl_name "cURL handle"
 extern int  le_curl_multi_handle;
@@ -1,43 +0,0 @@
--TEST--
-Bug #77946 (Errored cURL resources returned by curl_multi_info_read() must be compatible with curl_errno() and curl_error())
--SKIPIF--
-<?php
-
-if (!extension_loaded('curl')) {
-	exit('skip curl extension not loaded');
-}
-
-?>
--FILE--
-<?php
-$urls = array(
-   'unknown://scheme.tld',
-);
-
-$mh = curl_multi_init();
-
-foreach ($urls as $i => $url) {
-    $conn[$i] = curl_init($url);
-    curl_multi_add_handle($mh, $conn[$i]);
-}
-
-do {
-    $status = curl_multi_exec($mh, $active);
-    $info = curl_multi_info_read($mh);
-    if (false !== $info) {
-        var_dump($info['result']);
-        var_dump(curl_errno($info['handle']));
-        var_dump(curl_error($info['handle']));
-    }
-} while ($status === CURLM_CALL_MULTI_PERFORM || $active);
-
-foreach ($urls as $i => $url) {
-    curl_close($conn[$i]);
-}
-
-curl_multi_close($mh);
-?>
--EXPECTF--
-int(1)
-int(1)
-string(%d) "Protocol %Sunknown%S not supported or disabled in libcurl"
@@ -1,34 +0,0 @@
--TEST--
-Bug #78775: TLS issues from HTTP request affecting other encrypted connections
--SKIPIF--
-<?php
-if (!extension_loaded('curl')) die('skip Requires curl');
-if (getenv('SKIP_ONLINE_TESTS')) die('skip Online test');
-?>
--FILE--
-<?php
-
-$sock = fsockopen("tls://google.com", 443);
-
-var_dump($sock);
-
-$handle = curl_init('https://self-signed.badssl.com/');
-curl_setopt_array(
-    $handle,
-    [
-        CURLOPT_RETURNTRANSFER => true,
-        CURLOPT_SSL_VERIFYPEER => true,
-    ]
-);
-
-var_dump(curl_exec($handle));
-curl_close($handle);
-
-fwrite($sock, "GET / HTTP/1.0\n\n");
-var_dump(fread($sock, 8));
-
-?>
--EXPECTF--
-resource(%d) of type (stream)
-bool(false)
-string(8) "HTTP/1.0"
@@ -43,7 +43,7 @@ TLS-SRP => No
 HTTP2 => Yes
 GSSAPI => No
 KERBEROS5 => Yes
-UNIX_SOCKETS => %r(Yes|No)%r
+UNIX_SOCKETS => No
 PSL => No
 Protocols => dict, file, ftp, ftps, gopher, http, https, imap, imaps, ldap, ldaps, pop3, pop3s, rtsp, scp, sftp, smb, smbs, smtp, smtps, telnet, tftp
 Host => %s-pc-win32
@@ -26,5 +26,5 @@ curl_close($ch);

 ?>
 --EXPECTF--
-string(%d) "%r(Couldn't resolve proxy|Could not resolve proxy:|Could not resolve host:|Could not resolve:|Unsupported proxy syntax in)%r %s"
+string(%d) "%r(Couldn't resolve proxy|Could not resolve proxy:|Could not resolve host:|Could not resolve:)%r %s"
 int(5)
@@ -62,22 +62,6 @@ static inline long long php_date_llabs( long long i ) { return i >= 0 ? i : -i;
 #endif
 #endif

-PHPAPI time_t php_time()
-{
-#ifdef HAVE_GETTIMEOFDAY
-    struct timeval tm;
-
-    if (UNEXPECTED(gettimeofday(&tm, NULL) != SUCCESS)) {
-        /* fallback, can't reasonably happen */
-        return time(NULL);
-    }
-
-    return tm.tv_sec;
-#else
-    return time(NULL);
-#endif
-}
-
 /* {{{ arginfo */
 ZEND_BEGIN_ARG_INFO_EX(arginfo_date, 0, 0, 1)
 	ZEND_ARG_INFO(0, format)
@@ -1281,7 +1265,7 @@ static void php_date(INTERNAL_FUNCTION_PARAMETERS, int localtime)
 	ZEND_PARSE_PARAMETERS_END_EX(RETURN_FALSE);

 	if (ZEND_NUM_ARGS() == 1) {
-		ts = php_time();
+		ts = time(NULL);
 	}

 	RETURN_STR(php_format_date(ZSTR_VAL(format), ZSTR_LEN(format), ts, localtime));
@@ -1446,7 +1430,7 @@ PHP_FUNCTION(idate)
 	}

 	if (ZEND_NUM_ARGS() == 1) {
-		ts = php_time();
+		ts = time(NULL);
 	}

 	ret = php_idate(ZSTR_VAL(format)[0], ts, 0);
@@ -1518,7 +1502,7 @@ PHP_FUNCTION(strtotime)
 	now->tz_info = tzi;
 	now->zone_type = TIMELIB_ZONETYPE_ID;
 	timelib_unixtime2local(now,
-		(ZEND_NUM_ARGS() == 2) ? (timelib_sll) preset_ts : (timelib_sll) php_time());
+		(ZEND_NUM_ARGS() == 2) ? (timelib_sll) preset_ts : (timelib_sll) time(NULL));

 	t = timelib_strtotime(ZSTR_VAL(times), ZSTR_LEN(times), &error,
 		DATE_TIMEZONEDB, php_date_parse_tzfile_wrapper);
@@ -1561,12 +1545,12 @@ PHPAPI void php_mktime(INTERNAL_FUNCTION_PARAMETERS, int gmt)
 	/* Initialize structure with current time */
 	now = timelib_time_ctor();
 	if (gmt) {
-		timelib_unixtime2gmt(now, (timelib_sll) php_time());
+		timelib_unixtime2gmt(now, (timelib_sll) time(NULL));
 	} else {
 		tzi = get_timezone_info();
 		now->tz_info = tzi;
 		now->zone_type = TIMELIB_ZONETYPE_ID;
-		timelib_unixtime2local(now, (timelib_sll) php_time());
+		timelib_unixtime2local(now, (timelib_sll) time(NULL));
 	}
 	/* Fill in the new data */
 	switch (ZEND_NUM_ARGS()) {
@@ -1667,7 +1651,7 @@ PHPAPI void php_strftime(INTERNAL_FUNCTION_PARAMETERS, int gmt)
 	timelib_time_offset *offset = NULL;
 	zend_string 		*buf;

-	timestamp = (zend_long) php_time();
+	timestamp = (zend_long) time(NULL);

 	ZEND_PARSE_PARAMETERS_START(1, 2)
 		Z_PARAM_STR(format)
@@ -1771,7 +1755,7 @@ PHP_FUNCTION(gmstrftime)
   Return current UNIX timestamp */
 PHP_FUNCTION(time)
 {
-	RETURN_LONG((zend_long)php_time());
+	RETURN_LONG((zend_long)time(NULL));
 }
 /* }}} */

@@ -1779,7 +1763,7 @@ PHP_FUNCTION(time)
   Returns the results of the C system call localtime as an associative array if the associative_array argument is set to 1 other wise it is a regular array */
 PHP_FUNCTION(localtime)
 {
-	zend_long timestamp = (zend_long)php_time();
+	zend_long timestamp = (zend_long)time(NULL);
 	zend_bool associative = 0;
 	timelib_tzinfo *tzi;
 	timelib_time   *ts;
@@ -1828,7 +1812,7 @@ PHP_FUNCTION(localtime)
   Get date/time information */
 PHP_FUNCTION(getdate)
 {
-	zend_long timestamp = (zend_long)php_time();
+	zend_long timestamp = (zend_long)time(NULL);
 	timelib_tzinfo *tzi;
 	timelib_time   *ts;

@@ -2925,7 +2909,7 @@ static int php_date_initialize_from_hash(php_date_obj **dateobj, HashTable *myht
 	timelib_tzinfo   *tzi;
 	php_timezone_obj *tzobj;

-	z_date = zend_hash_str_find(myht, "date", sizeof("date")-1);
+	z_date = zend_hash_str_find(myht, "date", sizeof("data")-1);
 	if (z_date && Z_TYPE_P(z_date) == IS_STRING) {
 		z_timezone_type = zend_hash_str_find(myht, "timezone_type", sizeof("timezone_type")-1);
 		if (z_timezone_type && Z_TYPE_P(z_timezone_type) == IS_LONG) {
@@ -4364,20 +4348,6 @@ static int php_date_interval_initialize_from_hash(zval **return_value, php_inter
 		} \
 	} while (0);

-#define PHP_DATE_INTERVAL_READ_PROPERTY_DAYS(member) \
-	do { \
-		zval *z_arg = zend_hash_str_find(myht, "days", sizeof("days") - 1); \
-		if (z_arg && Z_TYPE_P(z_arg) == IS_FALSE) { \
-			(*intobj)->diff->member = -99999; \
-		} else if (z_arg && Z_TYPE_P(z_arg) <= IS_STRING) { \
-			zend_string *str = zval_get_string(z_arg); \
-			DATE_A64I((*intobj)->diff->member, ZSTR_VAL(str)); \
-			zend_string_release(str); \
-		} else { \
-			(*intobj)->diff->member = -1LL; \
-		} \
-	} while (0);
-
 #define PHP_DATE_INTERVAL_READ_PROPERTY_DOUBLE(element, member, def) \
 	do { \
 		zval *z_arg = zend_hash_str_find(myht, element, sizeof(element) - 1); \
@@ -4406,7 +4376,7 @@ static int php_date_interval_initialize_from_hash(zval **return_value, php_inter
 	PHP_DATE_INTERVAL_READ_PROPERTY("weekday_behavior", weekday_behavior, int, -1)
 	PHP_DATE_INTERVAL_READ_PROPERTY("first_last_day_of", first_last_day_of, int, -1)
 	PHP_DATE_INTERVAL_READ_PROPERTY("invert", invert, int, 0);
-	PHP_DATE_INTERVAL_READ_PROPERTY_DAYS(days);
+	PHP_DATE_INTERVAL_READ_PROPERTY_I64("days", days);
 	PHP_DATE_INTERVAL_READ_PROPERTY("special_type", special.type, unsigned int, 0);
 	PHP_DATE_INTERVAL_READ_PROPERTY_I64("special_amount", special.amount);
 	PHP_DATE_INTERVAL_READ_PROPERTY("have_weekday_relative", have_weekday_relative, unsigned int, 0);
@@ -5171,7 +5141,7 @@ static HashTable *date_object_get_properties_period(zval *object) /* {{{ */

 	if (period_obj->start) {
 		php_date_obj *date_obj;
-		object_init_ex(&zv, period_obj->start_ce);
+		object_init_ex(&zv, date_ce_date);
 		date_obj = Z_PHPDATE_P(&zv);
 		date_obj->time = timelib_time_clone(period_obj->start);
 	} else {
@@ -5181,7 +5151,7 @@ static HashTable *date_object_get_properties_period(zval *object) /* {{{ */

 	if (period_obj->current) {
 		php_date_obj *date_obj;
-		object_init_ex(&zv, period_obj->start_ce);
+		object_init_ex(&zv, date_ce_date);
 		date_obj = Z_PHPDATE_P(&zv);
 		date_obj->time = timelib_time_clone(period_obj->current);
 	} else {
@@ -5191,7 +5161,7 @@ static HashTable *date_object_get_properties_period(zval *object) /* {{{ */

 	if (period_obj->end) {
 		php_date_obj *date_obj;
-		object_init_ex(&zv, period_obj->start_ce);
+		object_init_ex(&zv, date_ce_date);
 		date_obj = Z_PHPDATE_P(&zv);
 		date_obj->time = timelib_time_clone(period_obj->end);
 	} else {
@@ -5228,7 +5198,7 @@ static int php_date_period_initialize_from_hash(php_period_obj *period_obj, Hash

 	ht_entry = zend_hash_str_find(myht, "start", sizeof("start")-1);
 	if (ht_entry) {
-		if (Z_TYPE_P(ht_entry) == IS_OBJECT && instanceof_function(Z_OBJCE_P(ht_entry), date_ce_interface)) {
+		if (Z_TYPE_P(ht_entry) == IS_OBJECT && Z_OBJCE_P(ht_entry) == date_ce_date) {
 			php_date_obj *date_obj;
 			date_obj = Z_PHPDATE_P(ht_entry);
 			period_obj->start = timelib_time_clone(date_obj->time);
@@ -5242,7 +5212,7 @@ static int php_date_period_initialize_from_hash(php_period_obj *period_obj, Hash

 	ht_entry = zend_hash_str_find(myht, "end", sizeof("end")-1);
 	if (ht_entry) {
-		if (Z_TYPE_P(ht_entry) == IS_OBJECT && instanceof_function(Z_OBJCE_P(ht_entry), date_ce_interface)) {
+		if (Z_TYPE_P(ht_entry) == IS_OBJECT && Z_OBJCE_P(ht_entry) == date_ce_date) {
 			php_date_obj *date_obj;
 			date_obj = Z_PHPDATE_P(ht_entry);
 			period_obj->end = timelib_time_clone(date_obj->time);
@@ -5255,7 +5225,7 @@ static int php_date_period_initialize_from_hash(php_period_obj *period_obj, Hash

 	ht_entry = zend_hash_str_find(myht, "current", sizeof("current")-1);
 	if (ht_entry) {
-		if (Z_TYPE_P(ht_entry) == IS_OBJECT && instanceof_function(Z_OBJCE_P(ht_entry), date_ce_interface)) {
+		if (Z_TYPE_P(ht_entry) == IS_OBJECT && Z_OBJCE_P(ht_entry) == date_ce_date) {
 			php_date_obj *date_obj;
 			date_obj = Z_PHPDATE_P(ht_entry);
 			period_obj->current = timelib_time_clone(date_obj->time);
@@ -5340,35 +5310,12 @@ PHP_METHOD(DatePeriod, __wakeup)
 }
 /* }}} */

-/* {{{ date_period_is_magic_property
- *  Common for date_period_read_property() and date_period_write_property() functions
- */
-static int date_period_is_magic_property(zend_string *name)
-{
-	if (zend_string_equals_literal(name, "recurrences")
-		|| zend_string_equals_literal(name, "include_start_date")
-		|| zend_string_equals_literal(name, "start")
-		|| zend_string_equals_literal(name, "current")
-		|| zend_string_equals_literal(name, "end")
-		|| zend_string_equals_literal(name, "interval")
-	) {
-		return 1;
-	}
-	return 0;
-}
-/* }}} */
-
 /* {{{ date_period_read_property */
 static zval *date_period_read_property(zval *object, zval *member, int type, void **cache_slot, zval *rv)
 {
 	if (type != BP_VAR_IS && type != BP_VAR_R) {
-		zend_string *name = zval_get_string(member);
-		if (date_period_is_magic_property(name)) {
-			zend_throw_error(NULL, "Retrieval of DatePeriod->%s for modification is unsupported", ZSTR_VAL(name));
-			zend_string_release(name);
-			return &EG(uninitialized_zval);
-		}
-		zend_string_release(name);
+		zend_throw_error(NULL, "Retrieval of DatePeriod properties for modification is unsupported");
+		return &EG(uninitialized_zval);
 	}

 	Z_OBJPROP_P(object); /* build properties hash table */
@@ -5380,15 +5327,7 @@ static zval *date_period_read_property(zval *object, zval *member, int type, voi
 /* {{{ date_period_write_property */
 static void date_period_write_property(zval *object, zval *member, zval *value, void **cache_slot)
 {
-	zend_string *name = zval_get_string(member);
-	if (date_period_is_magic_property(name)) {
-		zend_throw_error(NULL, "Writing to DatePeriod->%s is unsupported", ZSTR_VAL(name));
-		zend_string_release(name);
-		return;
-	}
-	zend_string_release(name);
-
-	std_object_handlers.write_property(object, member, value, cache_slot);
+	zend_throw_error(NULL, "Writing to DatePeriod properties is unsupported");
 }
 /* }}} */

@@ -205,8 +205,6 @@ ZEND_END_MODULE_GLOBALS(date)

 #define DATEG(v) ZEND_MODULE_GLOBALS_ACCESSOR(date, v)

-PHPAPI time_t php_time();
-
 /* Backwards compatibility wrapper */
 PHPAPI zend_long php_parse_date(char *string, zend_long *now);
 PHPAPI void php_mktime(INTERNAL_FUNCTION_PARAMETERS, int gmt);
@@ -1,37 +0,0 @@
--TEST--
-DatePeriod: Test read only properties
--INI--
-date.timezone=UTC
--FILE--
-<?php
-
-$start = new DateTime;
-$interval = new DateInterval('P1D');
-$end = new DateTime;
-$period = new DatePeriod($start, $interval, $end);
-
-echo "recurrences: ";
-var_dump($period->recurrences);
-
-echo "include_start_date: ";
-var_dump($period->include_start_date);
-
-echo "start: ";
-var_dump($period->start == $start);
-
-echo "current: ";
-var_dump($period->current);
-
-echo "end: ";
-var_dump($period->end == $end);
-
-echo "interval: ";
-var_dump($period->interval->format("%R%d"));
-?>
--EXPECT--
-recurrences: int(1)
-include_start_date: bool(true)
-start: bool(true)
-current: NULL
-end: bool(true)
-interval: string(2) "+1"
@@ -1,46 +0,0 @@
--TEST--
-DatePeriod: Test cannot modify read only properties
--INI--
-date.timezone=UTC
--FILE--
-<?php
-
-$period = new DatePeriod(new DateTime, new DateInterval('P1D'), new DateTime);
-
-$properties = [
-    "recurrences",
-    "include_start_date",
-    "start",
-    "current",
-    "end",
-    "interval",
-];
-
-foreach ($properties as $property) {
-    try {
-        $period->$property = "new";
-    } catch (Error $e) {
-        echo $e->getMessage() . "\n";
-    }
-
-    try {
-        $period->$property[] = "extra";
-    } catch (Error $e) {
-        echo $e->getMessage() . "\n";
-    }
-}
-
-?>
--EXPECT--
-Writing to DatePeriod->recurrences is unsupported
-Retrieval of DatePeriod->recurrences for modification is unsupported
-Writing to DatePeriod->include_start_date is unsupported
-Retrieval of DatePeriod->include_start_date for modification is unsupported
-Writing to DatePeriod->start is unsupported
-Retrieval of DatePeriod->start for modification is unsupported
-Writing to DatePeriod->current is unsupported
-Retrieval of DatePeriod->current for modification is unsupported
-Writing to DatePeriod->end is unsupported
-Retrieval of DatePeriod->end for modification is unsupported
-Writing to DatePeriod->interval is unsupported
-Retrieval of DatePeriod->interval for modification is unsupported
@@ -39,7 +39,7 @@ DateInterval Object
    [weekday_behavior] => 0
    [first_last_day_of] => 0
    [invert] => 0
-    [days] => 
+    [days] => 0
    [special_type] => 0
    [special_amount] => 0
    [have_weekday_relative] => 0
@@ -136,7 +136,7 @@ object(DatePeriod)#5 (6) {
    ["invert"]=>
    int(0)
    ["days"]=>
-    bool(false)
+    int(0)
    ["special_type"]=>
    int(0)
    ["special_amount"]=>
@@ -71,7 +71,7 @@ object(DateInterval)#2 (16) {
  ["invert"]=>
  int(0)
  ["days"]=>
-  bool(false)
+  int(0)
  ["special_type"]=>
  int(0)
  ["special_amount"]=>
@@ -1,44 +0,0 @@
--TEST--
-Test for bug #65672: Broken classes inherited from DatePeriod
--INI--
-date.timezone=UTC
--FILE--
-<?php
-
-$interval = new DateInterval('P1D');
-$period = new class(new DateTime, $interval, new DateTime) extends DatePeriod {
-    public $extra = "stuff";
-};
-
-var_dump($period->extra);
-$period->extra = "modified";
-var_dump($period->extra);
-
-# Ensure we can modify properties (retrieve for write)
-$period->extra = [];
-$period->extra[] = "array";
-var_dump($period->extra);
-
-var_dump(isset($period->dynamic1));
-$period->dynamic1 = "dynamic";
-var_dump($period->dynamic1);
-
-# Ensure we can modify properties (retrieve for write)
-$period->dynamic2 = [];
-$period->dynamic2[] = "array";
-var_dump($period->dynamic2);
-
-?>
--EXPECT--
-string(5) "stuff"
-string(8) "modified"
-array(1) {
-  [0]=>
-  string(5) "array"
-}
-bool(false)
-string(7) "dynamic"
-array(1) {
-  [0]=>
-  string(5) "array"
-}
@@ -1,14 +0,0 @@
--TEST--
-Bug #70153 (\DateInterval incorrectly unserialized)
--FILE--
-<?php
-$i1 = \DateInterval::createFromDateString('+1 month');
-$i2 = unserialize(serialize($i1));
-var_dump($i1->days, $i2->days);
-var_dump($i2->special_amount, $i2->special_amount);
-?>
--EXPECT--
-bool(false)
-bool(false)
-int(0)
-int(0)
@@ -1,16 +0,0 @@
--TEST--
-Bug #78751 (Serialising DatePeriod converts DateTimeImmutable)
--FILE--
-<?php
-$oDay = new DateTimeImmutable('2019-10-25');
-$oDateInterval = DateInterval::createFromDateString('1 day');
-$oDays = new DatePeriod($oDay, $oDateInterval, $oDay->modify('+1 day'));
-$oDays = unserialize(serialize($oDays));
-var_dump(
-    $oDays->start instanceof DateTimeImmutable,
-    $oDays->end instanceof DateTimeImmutable
-);
-?>
--EXPECT--
-bool(true)
-bool(true)
@@ -341,7 +341,7 @@ int dom_document_encoding_write(dom_object *obj, zval *newval)

 	str = zval_get_string(newval);

-	handler = xmlFindCharEncodingHandler(ZSTR_VAL(str));
+	handler = xmlFindCharEncodingHandler(Z_STRVAL_P(newval));

    if (handler != NULL) {
 		xmlCharEncCloseFunc(handler);
@@ -52,7 +52,7 @@ int dom_documenttype_name_read(dom_object *obj, zval *retval)
 		return FAILURE;
 	}

-	ZVAL_STRING(retval, dtdptr->name ? (char *) (dtdptr->name) : "");
+	ZVAL_STRING(retval, (char *) (dtdptr->name));

 	return SUCCESS;
 }
@@ -21,6 +21,6 @@ domdocumentloadxml_test_method.php
 --EXPECTF--
 Warning: DOMDocument::load%r(XML){0,1}%r(): Opening and ending tag mismatch: title line 5 and book %s

-Warning: DOMDocument::load%r(XML){0,1}%r(): %rexpected '>'|Opening and ending tag mismatch: book line 5 and books%r %s
+Warning: DOMDocument::load%r(XML){0,1}%r(): expected '>' %s

-Warning: DOMDocument::load%r(XML){0,1}%r(): %rPremature end of data in tag books|EndTag: '<\/' not found in Entity, line: 13%r %s
+Warning: DOMDocument::load%r(XML){0,1}%r(): Premature end of data in tag books %s
@@ -21,6 +21,6 @@ domdocumentload_test_method.php
 --EXPECTF--
 Warning: DOMDocument::load%r(XML){0,1}%r(): Opening and ending tag mismatch: title line 5 and book %s

-Warning: DOMDocument::load%r(XML){0,1}%r(): %rexpected '>'|Opening and ending tag mismatch: book line 5 and books%r %s
+Warning: DOMDocument::load%r(XML){0,1}%r(): expected '>' %s

-Warning: DOMDocument::load%r(XML){0,1}%r(): %rPremature end of data in tag books|EndTag: '<\/' not found%r %s
+Warning: DOMDocument::load%r(XML){0,1}%r(): Premature end of data in tag books %s
@@ -1,14 +0,0 @@
--TEST--
-Bug #77569 (Write Access Violation in DomImplementation)
--SKIPIF--
-<?php
-if (!extension_loaded('dom')) die('skip dom extension not available');
-?>
--FILE--
-<?php
-$imp = new DOMImplementation;
-$dom = $imp->createDocument("", "");
-$dom->encoding = null;
-?>
--EXPECTF--
-Warning: main(): Invalid Document Encoding in %s on line %d
@@ -1,18 +0,0 @@
--TEST--
-Bug #78025 (segfault when accessing properties of DOMDocumentType)
--SKIPIF--
-<?php
-if (!extension_loaded('dom')) die('skip dom extension not available');
-?>
--FILE--
-<?php
-$htm = "<!DOCTYPE><html></html>";
-$dom = new DOMDocument;
-$dom->loadHTML($htm);
-var_dump($dom->doctype->name);
-?>
-===DONE===
--EXPECTF--
-Warning: DOMDocument::loadHTML(): htmlParseDocTypeDecl : no DOCTYPE name ! in Entity, line: 1 in %s on line %d
-string(0) ""
-===DONE===
@@ -1002,6 +1002,7 @@ static tag_info_array tag_table_VND_PANASONIC = {
  { 0x0001, "Quality"},
  { 0x0002, "FirmwareVersion"},
  { 0x0003, "WhiteBalance"},
+  { 0x0004, "0x0004"},
  { 0x0007, "FocusMode"},
  { 0x000f, "AFMode"},
  { 0x001a, "ImageStabilization"},
@@ -1009,10 +1010,12 @@ static tag_info_array tag_table_VND_PANASONIC = {
  { 0x001f, "ShootingMode"},
  { 0x0020, "Audio"},
  { 0x0021, "DataDump"},
+  { 0x0022, "0x0022"},
  { 0x0023, "WhiteBalanceBias"},
  { 0x0024, "FlashBias"},
  { 0x0025, "InternalSerialNumber"},
  { 0x0026, "ExifVersion"},
+  { 0x0027, "0x0027"},
  { 0x0028, "ColorEffect"},
  { 0x0029, "TimeSincePowerOn"},
  { 0x002a, "BurstMode"},
@@ -1020,6 +1023,7 @@ static tag_info_array tag_table_VND_PANASONIC = {
  { 0x002c, "Contrast"},
  { 0x002d, "NoiseReduction"},
  { 0x002e, "SelfTimer"},
+  { 0x002f, "0x002f"},
  { 0x0030, "Rotation"},
  { 0x0031, "AFAssistLamp"},
  { 0x0032, "ColorMode"},
@@ -1086,6 +1090,7 @@ static tag_info_array tag_table_VND_PANASONIC = {
  { 0x00a3, "ClearRetouchValue"},
  { 0x00ab, "TouchAE"},
  { 0x0e00, "PrintIM"},
+  { 0x4449, "0x4449"},
  { 0x8000, "MakerNoteVersion"},
  { 0x8001, "SceneMode"},
  { 0x8004, "WBRedLevel"},
@@ -1120,20 +1125,22 @@ static tag_info_array tag_table_VND_SONY = {
  { 0x0112, "WhiteBalanceFineTune"},
  { 0x0114, "CameraSettings"},
  { 0x0115, "WhiteBalance"},
-  { 0x0116, "ExtraInfo"},
+  { 0x0116, "0x0116"},
  { 0x0e00, "PrintIM"},
  { 0x1000, "MultiBurstMode"},
  { 0x1001, "MultiBurstImageWidth"},
  { 0x1002, "MultiBurstImageHeight"},
  { 0x1003, "Panorama"},
+  { 0x2000, "0x2000"},
  { 0x2001, "PreviewImage"},
-  { 0x2002, "Rating"},
+  { 0x2002, "0x2002"},
+  { 0x2003, "0x2003"},
  { 0x2004, "Contrast"},
  { 0x2005, "Saturation"},
-  { 0x2006, "Sharpness"},
-  { 0x2007, "Brightness"},
-  { 0x2008, "LongExposureNoiseReduction"},
-  { 0x2009, "HighISONoiseReduction"},
+  { 0x2006, "0x2006"},
+  { 0x2007, "0x2007"},
+  { 0x2008, "0x2008"},
+  { 0x2009, "0x2009"},
  { 0x200a, "AutoHDR"},
  { 0x3000, "ShotInfo"},
  { 0xb000, "FileFormat"},
@@ -1160,9 +1167,8 @@ static tag_info_array tag_table_VND_SONY = {
  { 0xb049, "ReleaseMode"},
  { 0xb04a, "SequenceNumber"},
  { 0xb04b, "AntiBlur"},
-  { 0xb04e, "FocusMode"},
+  { 0xb04e, "LongExposureNoiseReduction"},
  { 0xb04f, "DynamicRangeOptimizer"},
-  { 0xb050, "HighISONoiseReduction2"},
  { 0xb052, "IntelligentAuto"},
  { 0xb054, "WhiteBalance2"},
  TAG_TABLE_END
@@ -1267,6 +1273,7 @@ static tag_info_array tag_table_VND_MINOLTA = {
  { 0x0100, "SceneMode"},
  { 0x0101, "ColorMode"},
  { 0x0102, "Quality"},
+  { 0x0103, "0x0103"},
  { 0x0104, "FlashExposureComp"},
  { 0x0105, "Teleconverter"},
  { 0x0107, "ImageStabilization"},
@@ -1362,7 +1369,6 @@ static const maker_note_type maker_note_array[] = {
  { tag_table_VND_PANASONIC, "Panasonic",               NULL, "Panasonic\x00\x00\x00",			 12, 12, MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
  { tag_table_VND_DJI,       "DJI",                     NULL, NULL,								 0, 0,   MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
  { tag_table_VND_SONY,      "SONY",                    NULL, "SONY DSC \x00\x00\x00",	         12, 12, MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
-  { tag_table_VND_SONY,      "SONY",                    NULL,								     0, 0,   MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
  { tag_table_VND_PENTAX,    "PENTAX",                  NULL, "AOC\x00",						 6,  6,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
  { tag_table_VND_MINOLTA,   "Minolta, KONICA MINOLTA", NULL, NULL,								 0,  0,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
  { tag_table_VND_SIGMA,     "SIGMA, FOVEON",           NULL, "SIGMA\x00\x00\x00",				 10, 10, MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
@@ -1535,20 +1541,6 @@ static void php_ifd_set32u(char *data, size_t value, int motorola_intel)
 }
 /* }}} */

-static float php_ifd_get_float(char *data) {
-	/* Copy to avoid alignment issues */
-	float f;
-	memcpy(&f, data, sizeof(float));
-	return f;
-}
-
-static double php_ifd_get_double(char *data) {
-	/* Copy to avoid alignment issues */
-	double f;
-	memcpy(&f, data, sizeof(double));
-	return f;
-}
-
 #ifdef EXIF_DEBUG
 char * exif_dump_data(int *dump_free, int format, int components, int length, int motorola_intel, char *value_ptr) /* {{{ */
 {
@@ -1661,12 +1653,12 @@ static double exif_convert_any_format(void *value, int format, int motorola_inte
 #ifdef EXIF_DEBUG
 			php_error_docref(NULL, E_NOTICE, "Found value of type single");
 #endif
-			return (double) php_ifd_get_float(value);
+			return (double)*(float *)value;
 		case TAG_FMT_DOUBLE:
 #ifdef EXIF_DEBUG
 			php_error_docref(NULL, E_NOTICE, "Found value of type double");
 #endif
-			return php_ifd_get_double(value);
+			return *(double *)value;
 	}
 	return 0;
 }
@@ -1724,12 +1716,12 @@ static size_t exif_convert_any_to_int(void *value, int format, int motorola_inte
 #ifdef EXIF_DEBUG
 			php_error_docref(NULL, E_NOTICE, "Found value of type single");
 #endif
-			return (size_t) php_ifd_get_float(value);
+			return (size_t)*(float *)value;
 		case TAG_FMT_DOUBLE:
 #ifdef EXIF_DEBUG
 			php_error_docref(NULL, E_NOTICE, "Found value of type double");
 #endif
-			return (size_t) php_ifd_get_double(value);
+			return (size_t)*(double *)value;
 	}
 	return 0;
 }
@@ -2196,13 +2188,13 @@ static void exif_iif_add_value(image_info_type *image_info, int section_index, c
 #ifdef EXIF_DEBUG
 						php_error_docref(NULL, E_WARNING, "Found value of type single");
 #endif
-						info_value->f = php_ifd_get_float(value);
+						info_value->f = *(float *)value;
 						break;
 					case TAG_FMT_DOUBLE:
 #ifdef EXIF_DEBUG
 						php_error_docref(NULL, E_WARNING, "Found value of type double");
 #endif
-						info_value->d = php_ifd_get_double(value);
+						info_value->d = *(double *)value;
 						break;
 				}
 			}
@@ -2322,11 +2314,14 @@ static void exif_iif_free(image_info_type *image_info, int section_index) {
 				efree(f);
 			}
 			switch(image_info->info_list[section_index].list[i].format) {
-				case TAG_FMT_UNDEFINED:
-				case TAG_FMT_STRING:
 				case TAG_FMT_SBYTE:
 				case TAG_FMT_BYTE:
+					/* in contrast to strings bytes do not need to allocate buffer for NULL if length==0 */
+					if (image_info->info_list[section_index].list[i].length<1)
+						break;
 				default:
+				case TAG_FMT_UNDEFINED:
+				case TAG_FMT_STRING:
 					if ((f=image_info->info_list[section_index].list[i].value.s) != NULL) {
 						efree(f);
 					}
@@ -3045,11 +3040,11 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
 			/* First try to detect BOM: ZERO WIDTH NOBREAK SPACE (FEFF 16)
 			 * since we have no encoding support for the BOM yet we skip that.
 			 */
-			if (ByteCount >=2 && !memcmp(szValuePtr, "\xFE\xFF", 2)) {
+			if (!memcmp(szValuePtr, "\xFE\xFF", 2)) {
 				decode = "UCS-2BE";
 				szValuePtr = szValuePtr+2;
 				ByteCount -= 2;
-			} else if (ByteCount >=2 && !memcmp(szValuePtr, "\xFF\xFE", 2)) {
+			} else if (!memcmp(szValuePtr, "\xFF\xFE", 2)) {
 				decode = "UCS-2LE";
 				szValuePtr = szValuePtr+2;
 				ByteCount -= 2;
@@ -3165,8 +3160,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 			continue;
 		if (maker_note->model && (!ImageInfo->model || strcmp(maker_note->model, ImageInfo->model)))
 			continue;
-		if (maker_note->id_string && value_len >= maker_note->id_string_len
-				&& strncmp(maker_note->id_string, value_ptr, maker_note->id_string_len))
+		if (maker_note->id_string && strncmp(maker_note->id_string, value_ptr, maker_note->id_string_len))
 			continue;
 		break;
 	}
@@ -3240,9 +3234,8 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 	}

 	for (de=0;de<NumDirEntries;de++) {
-		size_t offset = 2 + 12 * de;
-		if (!exif_process_IFD_TAG(ImageInfo, dir_start + offset,
-								  offset_base, data_len - offset, displacement, section_index, 0, maker_note->tag_table)) {
+		if (!exif_process_IFD_TAG(ImageInfo, dir_start + 2 + 12 * de,
+								  offset_base, data_len, displacement, section_index, 0, maker_note->tag_table)) {
 			return FALSE;
 		}
 	}
@@ -3255,14 +3248,6 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 }
 /* }}} */

-#define REQUIRE_NON_EMPTY() do { \
-	if (byte_count == 0) { \
-		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Cannot be empty", tag, exif_get_tagname(tag, tagname, -12, tag_table)); \
-		return FALSE; \
-	} \
-} while (0)
-
-
 /* {{{ exif_process_IFD_TAG
 * Process one of the nested IFDs directories. */
 static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, char *offset_base, size_t IFDlength, size_t displacement, int section_index, int ReadNextIFD, tag_table_type tag_table)
@@ -3296,6 +3281,11 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 		/*return TRUE;*/
 	}

+	if (components <= 0) {
+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal components(%d)", tag, exif_get_tagname(tag, tagname, -12, tag_table), components);
+		return FALSE;
+	}
+
 	byte_count_signed = (int64_t)components * php_tiff_bytes_per_format[format];

 	if (byte_count_signed < 0 || (byte_count_signed > INT32_MAX)) {
@@ -3375,12 +3365,8 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 	}
 #endif

-	/* NB: The following code may not assume that there is at least one component!
-	 * byte_count may be zero! */
-
 	if (section_index==SECTION_THUMBNAIL) {
 		if (!ImageInfo->Thumbnail.data) {
-			REQUIRE_NON_EMPTY();
 			switch(tag) {
 				case TAG_IMAGEWIDTH:
 				case TAG_COMP_IMAGE_WIDTH:
@@ -3424,9 +3410,6 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				if (byte_count>1 && (length=php_strnlen(value_ptr, byte_count)) > 0) {
 					if (length<byte_count-1) {
 						/* When there are any characters after the first NUL */
-						EFREE_IF(ImageInfo->CopyrightPhotographer);
-						EFREE_IF(ImageInfo->CopyrightEditor);
-						EFREE_IF(ImageInfo->Copyright);
 						ImageInfo->CopyrightPhotographer  = estrdup(value_ptr);
 						ImageInfo->CopyrightEditor        = estrndup(value_ptr+length+1, byte_count-length-1);
 						spprintf(&ImageInfo->Copyright, 0, "%s, %s", ImageInfo->CopyrightPhotographer, ImageInfo->CopyrightEditor);
@@ -3434,7 +3417,6 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 						/* but we are not supposed to change this                   */
 						/* keep in mind that image_info does not store editor value */
 					} else {
-						EFREE_IF(ImageInfo->Copyright);
 						ImageInfo->Copyright = estrndup(value_ptr, byte_count);
 					}
 				}
@@ -3463,7 +3445,6 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 			case TAG_FNUMBER:
 				/* Simplest way of expressing aperture, so I trust it the most.
 				   (overwrite previously computed value if there is one) */
-				REQUIRE_NON_EMPTY();
 				ImageInfo->ApertureFNumber = (float)exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel);
 				break;

@@ -3472,7 +3453,6 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				/* More relevant info always comes earlier, so only use this field if we don't
 				   have appropriate aperture information yet. */
 				if (ImageInfo->ApertureFNumber == 0) {
-					REQUIRE_NON_EMPTY();
 					ImageInfo->ApertureFNumber
 						= (float)exp(exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel)*log(2)*0.5);
 				}
@@ -3484,7 +3464,6 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				   SHUTTERSPEED comes after EXPOSURE TIME
 				  */
 				if (ImageInfo->ExposureTime == 0) {
-					REQUIRE_NON_EMPTY();
 					ImageInfo->ExposureTime
 						= (float)(1/exp(exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel)*log(2)));
 				}
@@ -3494,24 +3473,20 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				break;

 			case TAG_COMP_IMAGE_WIDTH:
-				REQUIRE_NON_EMPTY();
 				ImageInfo->ExifImageWidth = exif_convert_any_to_int(value_ptr, exif_rewrite_tag_format_to_unsigned(format), ImageInfo->motorola_intel);
 				break;

 			case TAG_FOCALPLANE_X_RES:
-				REQUIRE_NON_EMPTY();
 				ImageInfo->FocalplaneXRes = exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel);
 				break;

 			case TAG_SUBJECT_DISTANCE:
 				/* Inidcates the distacne the autofocus camera is focused to.
 				   Tends to be less accurate as distance increases. */
-				REQUIRE_NON_EMPTY();
 				ImageInfo->Distance = (float)exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel);
 				break;

 			case TAG_FOCALPLANE_RESOLUTION_UNIT:
-				REQUIRE_NON_EMPTY();
 				switch((int)exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel)) {
 					case 1: ImageInfo->FocalplaneUnits = 25.4; break; /* inch */
 					case 2:
@@ -3537,11 +3512,9 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				break;

 			case TAG_MAKE:
-				EFREE_IF(ImageInfo->make);
 				ImageInfo->make = estrndup(value_ptr, byte_count);
 				break;
 			case TAG_MODEL:
-				EFREE_IF(ImageInfo->model);
 				ImageInfo->model = estrndup(value_ptr, byte_count);
 				break;

@@ -3556,7 +3529,6 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 			case TAG_GPS_IFD_POINTER:
 			case TAG_INTEROP_IFD_POINTER:
 				if (ReadNextIFD) {
-					REQUIRE_NON_EMPTY();
 					char *Subdir_start;
 					int sub_section_index = 0;
 					switch(tag) {
@@ -3585,11 +3557,9 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 					Subdir_start = offset_base + php_ifd_get32u(value_ptr, ImageInfo->motorola_intel);
 					if (Subdir_start < offset_base || Subdir_start > offset_base+IFDlength) {
 						exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD Pointer");
-						EFREE_IF(outside);
 						return FALSE;
 					}
 					if (!exif_process_IFD_in_JPEG(ImageInfo, Subdir_start, offset_base, IFDlength, displacement, sub_section_index, tag)) {
-						EFREE_IF(outside);
 						return FALSE;
 					}
 #ifdef EXIF_DEBUG
@@ -3692,11 +3662,6 @@ static void exif_process_TIFF_in_JPEG(image_info_type *ImageInfo, char *CharBuf,
 {
 	unsigned exif_value_2a, offset_of_ifd;

-	if (length < 2) {
-		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Missing TIFF alignment marker");
-		return;
-	}
-
 	/* set the thumbnail stuff to nothing so we can test to see if they get set up */
 	if (memcmp(CharBuf, "II", 2) == 0) {
 		ImageInfo->motorola_intel = 0;
@@ -3849,7 +3814,7 @@ static int exif_scan_JPEG_header(image_info_type *ImageInfo)
 			return FALSE;
 		}

-		sn = exif_file_sections_add(ImageInfo, marker, itemlen, NULL);
+		sn = exif_file_sections_add(ImageInfo, marker, itemlen+1, NULL);
 		Data = ImageInfo->file.list[sn].data;

 		/* Store first two pre-read bytes. */
@@ -3954,7 +3919,7 @@ static int exif_scan_thumbnail(image_info_type *ImageInfo)
 	size_t          length=2, pos=0;
 	jpeg_sof_info   sof_info;

-	if (!data || ImageInfo->Thumbnail.size < 4) {
+	if (!data) {
 		return FALSE; /* nothing to do here */
 	}
 	if (memcmp(data, "\xFF\xD8\xFF", 3)) {
@@ -4605,9 +4570,8 @@ PHP_FUNCTION(exif_read_data)
 		exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "CCDWidth", "%dmm", (int)ImageInfo.CCDWidth);
 	}
 	if(ImageInfo.ExposureTime>0) {
-		float recip_exposure_time = 0.5f + 1.0f/ImageInfo.ExposureTime;
-		if (ImageInfo.ExposureTime <= 0.5 && recip_exposure_time < INT_MAX) {
-			exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "ExposureTime", "%0.3F s (1/%d)", ImageInfo.ExposureTime, (int) recip_exposure_time);
+		if(ImageInfo.ExposureTime <= 0.5) {
+			exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "ExposureTime", "%0.3F s (1/%d)", ImageInfo.ExposureTime, (int)(0.5 + 1/ImageInfo.ExposureTime));
 		} else {
 			exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "ExposureTime", "%0.3F s", ImageInfo.ExposureTime);
 		}
@@ -4,48 +4,9 @@ Bug #68547 (Exif Header component value check error)
 <?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
 --FILE--
 <?php
-var_dump(exif_read_data(__DIR__ . DIRECTORY_SEPARATOR . 'bug68547.jpg'));
+exif_read_data(__DIR__ . DIRECTORY_SEPARATOR . 'bug68547.jpg');
 ?>
 ===DONE===
 --EXPECTF--
-array(12) {
-  ["FileName"]=>
-  string(12) "bug68547.jpg"
-  ["FileDateTime"]=>
-  int(%d)
-  ["FileSize"]=>
-  int(713)
-  ["FileType"]=>
-  int(2)
-  ["MimeType"]=>
-  string(10) "image/jpeg"
-  ["SectionsFound"]=>
-  string(20) "ANY_TAG, IFD0, WINXP"
-  ["COMPUTED"]=>
-  array(5) {
-    ["html"]=>
-    string(20) "width="1" height="1""
-    ["Height"]=>
-    int(1)
-    ["Width"]=>
-    int(1)
-    ["IsColor"]=>
-    int(1)
-    ["ByteOrderMotorola"]=>
-    int(0)
-  }
-  ["Subject"]=>
-  string(10) "Subjec??.."
-  ["Keywords"]=>
-  string(0) ""
-  ["Author"]=>
-  string(9) "Rui Carmo"
-  ["Comments"]=>
-  string(29) "Comments
-Line2
-Line3
-Line4"
-  ["Title"]=>
-  string(8) "Title..."
-}
+Warning: exif_read_data(bug68547.jpg): Process tag(x9C9E=Keywords   ): Illegal components(%d) in %sbug68547.php on line %d
 ===DONE===
@@ -39,6 +39,7 @@ print_r(exif_read_data(__DIR__.'/bug68799.jpg'));

 ?>
 --EXPECTF--
+Warning: exif_read_data(bug68799.jpg): Process tag(x9C9D=Author     ): Illegal components(%d) in %s on line %d
 Array
 (
    [FileName] => bug68799.jpg
@@ -46,7 +47,7 @@ Array
    [FileSize] => 735
    [FileType] => 2
    [MimeType] => image/jpeg
-    [SectionsFound] => ANY_TAG, IFD0, WINXP
+    [SectionsFound] => ANY_TAG, IFD0
    [COMPUTED] => Array
        (
            [html] => width="1" height="1"
@@ -59,5 +60,4 @@ Array
    [XResolution] => 96/1
    [YResolution] => 96/1
    [ResolutionUnit] => 2
-    [Author] => 
 )
@@ -47,7 +47,7 @@ Warning: exif_read_data(bug72094_3.jpg): Process tag(x3030=UndefinedTa): Illegal

 Warning: exif_read_data(bug72094_3.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d

-Warning: exif_read_data(bug72094_3.jpg): Illegal IFD size in %s%ebug72094.php on line %d
+Warning: exif_read_data(bug72094_3.jpg): Process tag(x3030=UndefinedTa): Illegal components(%d) in %s%ebug72094.php on line %d

 Warning: exif_read_data(bug72094_3.jpg): File structure corrupted in %s%ebug72094.php on line %d

@@ -8,7 +8,7 @@ Bug #73737 (Crash when parsing a tag format)
 	var_dump($exif);
 ?>
 --EXPECTF--
-Warning: exif_thumbnail(bug73737.tiff): Process tag(x0100=ImageWidth ): Cannot be empty in %s on line %d
+Warning: exif_thumbnail(bug73737.tiff): Process tag(x0100=ImageWidth ): Illegal components(0) in %s on line %d

 Warning: exif_thumbnail(bug73737.tiff): Error in TIFF: filesize(x0030) less than start of IFD dir(x10102) in %s line %d
 bool(false)
@@ -70,7 +70,7 @@ Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal f

 Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d

-Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal pointer offset(x30303030 + x30303030 = x60606060 > %s) in %sbug76557.php on line %d
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal pointer offset(x30303030 + x30303030 = x60606060 > x00EE) in %sbug76557.php on line %d

 Warning: exif_read_data(bug76557.jpg): File structure corrupted in %sbug76557.php on line %d

@@ -1,11 +0,0 @@
--TEST--
-Bug #78222 (heap-buffer-overflow on exif_scan_thumbnail)
--SKIPIF--
-<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
--FILE--
-<?php
-exif_read_data(__DIR__."/bug78222.jpg", 'THUMBNAIL', FALSE, TRUE);
-?>
-DONE
--EXPECTF--
-DONE
@@ -1,11 +0,0 @@
--TEST--
-Bug #78256 (heap-buffer-overflow on exif_process_user_comment)
--SKIPIF--
-<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
--FILE--
-<?php
-@exif_read_data(__DIR__."/bug78256.jpg", 'COMMENT', FALSE, TRUE);
-?>
-DONE
--EXPECTF--
-DONE
@@ -1,12 +0,0 @@
--TEST--
-Bug #78793: Use-after-free in exif parsing under memory sanitizer
--FILE--
-<?php
-$f = "ext/exif/tests/bug77950.tiff";
-for ($i = 0; $i < 10; $i++) {
-    @exif_read_data($f);
-}
-?>
-===DONE===
--EXPECT--
-===DONE===
@@ -1,17 +0,0 @@
--TEST--
-Bug #78910: Heap-buffer-overflow READ in exif (OSS-Fuzz #19044)
--FILE--
-<?php
-
-var_dump(exif_read_data('data:image/jpg;base64,TU0AKgAAAAwgICAgAAIBDwAEAAAAAgAAACKSfCAgAAAAAEZVSklGSUxN'));
-
-?>
--EXPECTF--
-Notice: exif_read_data(): Read from TIFF: tag(0x927C, MakerNote  ): Illegal format code 0x2020, switching to BYTE in %s on line %d
-
-Warning: exif_read_data(): Process tag(x927C=MakerNote  ): Illegal format code 0x2020, suppose BYTE in %s on line %d
-
-Warning: exif_read_data(): IFD data too short: 0x0000 offset 0x000C in %s on line %d
-
-Warning: exif_read_data(): Invalid TIFF file in %s on line %d
-bool(false)
@@ -1,15 +0,0 @@
--TEST--
-Bug #79282: Use-of-uninitialized-value in exif
--FILE--
-<?php
-
-var_dump(exif_read_data('data://image/jpeg;base64,/9jhAAlFeGlmAAAg'));
-
-?>
--EXPECTF--
-Warning: exif_read_data(): Missing TIFF alignment marker in %s on line %d
-
-Warning: exif_read_data(): File structure corrupted in %s on line %d
-
-Warning: exif_read_data(): Invalid JPEG file in %s on line %d
-bool(false)
@@ -1,18 +0,0 @@
--TEST--
-OSS-Fuzz #17474: Memory leak on duplicate Copyright tags
--SKIPIF--
-<?php
-if (!extension_loaded('exif')) {
-    die('skip exif extension not available');
-}
-?>
--FILE--
-<?php
-
-// Only checking for an absence of leaks here.
-@exif_read_data(__DIR__ . '/duplicate_copyright_tag_leak.tiff');
-
-?>
-===DONE===
--EXPECTF--
-===DONE===
@@ -1,21 +0,0 @@
--TEST--
-OSS-Fuzz #17163: Out-of-bounds read due to tag with zero components
--SKIPIF--
-<?php
-if (!extension_loaded('exif')) {
-    die('skip exif extension not available');
-}
-?>
--FILE--
-<?php
-
-var_dump(exif_read_data(__DIR__ . '/tag_with_illegal_zero_components.jpeg'));
-
-?>
--EXPECTF--
-Warning: exif_read_data(tag_with_illegal_zero_components.jpeg): Process tag(x0202=JPEGInterch): Cannot be empty in %s on line %d
-
-Warning: exif_read_data(tag_with_illegal_zero_components.jpeg): File structure corrupted in %s on line %d
-
-Warning: exif_read_data(tag_with_illegal_zero_components.jpeg): Invalid JPEG file in %s on line %d
-bool(false)
@@ -1,16 +0,0 @@
--TEST--
-OSS-Fuzz: Temporary buffer leak in tag reading
--SKIPIF--
-<?php
-if (!extension_loaded('exif')) {
-    die('skip exif extension not available');
-}
-?>
--FILE--
-<?php
-
-var_dump(@exif_read_data(__DIR__ . '/temporary_buffer_leak.jpg'));
-
-?>
--EXPECT--
-bool(false)
@@ -1,17 +0,0 @@
--TEST--
-OSS-Fuzz: Memory leak for zero-length MAKERNOTE
--SKIPIF--
-<?php
-if (!extension_loaded('exif')) {
-    die('skip exif extension not available');
-}
-?>
--FILE--
-<?php
-
-@exif_read_data(__DIR__ . '/zero_length_makernote_leak.tiff');
-
-?>
-===DONE===
--EXPECT--
-===DONE===
@@ -1011,9 +1011,8 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 				goto out;
 			}
 			nelements = CDF_GETUINT32(q, 1);
-			if (nelements > CDF_ELEMENT_LIMIT || nelements == 0) {
-				DPRINTF(("CDF_VECTOR with nelements == %"
-				    SIZE_T_FORMAT "u\n", nelements));
+			if (nelements == 0) {
+				DPRINTF(("CDF_VECTOR with nelements == 0\n"));
 				goto out;
 			}
 			slen = 2;
@@ -1055,6 +1054,8 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 					goto out;
 				inp += nelem;
 			}
+			DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n",
+			    nelements));
 			for (j = 0; j < nelements && i < sh.sh_properties;
 			    j++, i++)
 			{
@@ -50,7 +50,6 @@
 typedef int32_t cdf_secid_t;

 #define CDF_LOOP_LIMIT					10000
-#define CDF_ELEMENT_LIMIT				100000

 #define CDF_SECID_NULL					0
 #define CDF_SECID_FREE					-1
@@ -180,41 +180,3 @@ index 69e8e90f..76f7e7da 100644
 -- 
 2.13.6

-From bb421c437d406760fb9f70f49e2eb5c504528450 Mon Sep 17 00:00:00 2001
-From: Christos Zoulas <christos@zoulas.com>
-Date: Mon, 5 Jun 2017 17:40:31 +0000
-Subject: [PATCH] use default to avoid dup printing (Stephan Kulow)
-
---
- magic/Magdir/images | 13 +++++++------
- 1 file changed, 7 insertions(+), 6 deletions(-)
-
-diff --git a/magic/Magdir/images b/magic/Magdir/images
-index d14c1de19..7e6f74d5e 100644
--- a/magic/Magdir/images
-+++ b/magic/Magdir/images
-@@ -35,11 +35,6 @@
- >>>16	ubyte			<33
- # skip more by looking for pixel size 0Fh 10h 18h 20h
- >>>>16	ubyte&0xC0		0x00
-# skip 260-16.ico by looking for no color map
->>>>>1	ubyte			0
-# implies no first map entry
->>>>>>3	uleshort		0
->>>>>>>0	use		tga-image
- # Color Map
- >>>>>1	belong&0xfff7ffff	0x01010000
- >>>>>>0		use		tga-image
-@@ -47,6 +42,12 @@
- >>>>>>0		use		tga-image
- >>>>>1	belong&0xfff7ffff	0x00030000
- >>>>>>0		use		tga-image
-+>>>>>1	default			x
-+# skip 260-16.ico by looking for no color map
-+>>>>>>1	ubyte			0
-+# implies no first map entry
-+>>>>>>>3	uleshort		0
-+>>>>>>>>0	use		tga-image
- #	display tga bitmap image information
- 0	name				tga-image
- >2	ubyte		<34		Targa image data
@@ -18,7 +18,7 @@ ksort($results);
 var_dump($results);
 ?>
 --EXPECTF--
-array(10) {
+array(9) {
  ["%s/resources/dir.zip"]=>
  string(15) "application/zip"
  ["%s/resources/test.awk"]=>
@@ -37,6 +37,4 @@ array(10) {
  string(9) "image/png"
  ["%s/resources/test.ppt"]=>
  string(29) "application/vnd.ms-powerpoint"
-  ["%s/resources/test.tga"]=>
-  string(11) "image/x-tga"
 }
@@ -1682,7 +1682,7 @@
 # http://home.earthlink.net/~hughhood/appleiiworksenvoy/
 # ('p' + 1-byte ProDOS File Type + 2-byte ProDOS Aux Type')
 # $70 $1A $F8 $FF is this the apple type ?
-#:apple pdosp��
+#:apple pdospøÿ
 !:ext awp
 # minimum version needed to read this files. SFMinVers (0 , 30~3.0 )
 >>>183	ubyte		30	3.0
@@ -7299,9 +7299,9 @@
 #>>52	ulelong		3		\b, CleanShutdown
 >>52	ulelong		4		\b, BeingConverted
 >>52	ulelong		5		\b, ForceDetach
-# Windows�NT major version when the databases indexes were updated.
+# Windows NT major version when the databases indexes were updated.
 >>216	ulelong		x		\b, Windows version %d
-# Windows�NT minor version
+# Windows NT minor version
 >>220	ulelong		x		\b.%d

 # From: Joerg Jenderek
@@ -13280,6 +13280,11 @@
 >>>16	ubyte			<33
 # skip more by looking for pixel size 0Fh 10h 18h 20h
 >>>>16	ubyte&0xC0		0x00
+# skip 260-16.ico by looking for no color map
+>>>>>1	ubyte			0
+# implies no first map entry
+>>>>>>3	uleshort		0
+>>>>>>>0	use		tga-image
 # Color Map
 >>>>>1	belong&0xfff7ffff	0x01010000
 >>>>>>0		use		tga-image
@@ -13287,12 +13292,6 @@
 >>>>>>0		use		tga-image
 >>>>>1	belong&0xfff7ffff	0x00030000
 >>>>>>0		use		tga-image
->>>>>1	default			x
-# skip 260-16.ico by looking for no color map
->>>>>>1	ubyte			0
-# implies no first map entry
->>>>>>>3	uleshort		0
->>>>>>>>0	use		tga-image
 #	display tga bitmap image information
 0	name				tga-image
 >2	ubyte		<34		Targa image data
@@ -1682,7 +1682,7 @@
 # http://home.earthlink.net/~hughhood/appleiiworksenvoy/
 # ('p' + 1-byte ProDOS File Type + 2-byte ProDOS Aux Type')
 # $70 $1A $F8 $FF is this the apple type ?
-#:apple pdosp��
+#:apple pdospøÿ
 !:ext awp
 # minimum version needed to read this files. SFMinVers (0 , 30~3.0 )
 >>>183	ubyte		30	3.0
@@ -7299,9 +7299,9 @@
 #>>52	ulelong		3		\b, CleanShutdown
 >>52	ulelong		4		\b, BeingConverted
 >>52	ulelong		5		\b, ForceDetach
-# Windows�NT major version when the databases indexes were updated.
+# Windows NT major version when the databases indexes were updated.
 >>216	ulelong		x		\b, Windows version %d
-# Windows�NT minor version
+# Windows NT minor version
 >>220	ulelong		x		\b.%d

 # From: Joerg Jenderek
@@ -13280,6 +13280,11 @@
 >>>16	ubyte			<33
 # skip more by looking for pixel size 0Fh 10h 18h 20h
 >>>>16	ubyte&0xC0		0x00
+# skip 260-16.ico by looking for no color map
+>>>>>1	ubyte			0
+# implies no first map entry
+>>>>>>3	uleshort		0
+>>>>>>>0	use		tga-image
 # Color Map
 >>>>>1	belong&0xfff7ffff	0x01010000
 >>>>>>0		use		tga-image
@@ -13287,12 +13292,6 @@
 >>>>>>0		use		tga-image
 >>>>>1	belong&0xfff7ffff	0x00030000
 >>>>>>0		use		tga-image
->>>>>1	default			x
-# skip 260-16.ico by looking for no color map
->>>>>>1	ubyte			0
-# implies no first map entry
->>>>>>>3	uleshort		0
->>>>>>>>0	use		tga-image
 #	display tga bitmap image information
 0	name				tga-image
 >2	ubyte		<34		Targa image data
@@ -18471,23 +18470,23 @@

 # skip some AppleWorks word like Tomahawk.Awp, WIN98SE-DE.vhd
 # by looking for trailing nul of maximal file name string
-0x52	ubyte	0
+0x52	ubyte	0	
 # test for flag byte: FFh~complete file, 00h~split file
 # FFh -127 =	-1 -127 =	-128
 # 00h -127 =	 0 -127 =	-127
 >0	byte-127	<-126
 # plausibility check for file name length
->>0x53	ubyte-1	<78
+>>0x53	ubyte-1	<78	
 # looking for terminating nul of file name string
->>>(0x53.b+4)	ubyte	0
+>>>(0x53.b+4)	ubyte	0	
 # looking if last char of string is valid DOS file name
->>>>(0x53.b+3)	ubyte	>0x1F
+>>>>(0x53.b+3)	ubyte	>0x1F	
 # actually 44 nul bytes
 # but sometimes garbage according to Ralf Quint. So can not be used as test
 #>0x54	string	\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
 # first char of full file name is DOS (5Ch) or UNIX (2Fh) path separator
-# only DOS variant found. UNIX variant according to V32SLASH.TXT in archive PD0315.EXE
->>>>>5	ubyte&0x8C	0x0C
+# only DOS variant found. UNIX variant according to V32SLASH.TXT in archive PD0315.EXE 
+>>>>>5	ubyte&0x8C	0x0C	
 # ./msdos (version 5.30) labeled the entry as
 # "DOS 2.0 backed up file %s, split file, sequence %d" or
 # "DOS 2.0 backed up file %s, complete file"
@@ -18502,7 +18501,7 @@
 # magic/Magdir/msdos, 1169: Warning: EXTENSION type `     *' has bad char '*'
 # file: line 1169: Bad magic entry '  *'
 # after header original file content
->>>>>>128	indirect x	\b;
+>>>>>>128	indirect x	\b; 


 # DOS backup 3.3 to 5.x
@@ -289,10 +289,9 @@ ftp_login(ftpbuf_t *ftp, const char *user, const size_t user_len, const char *pa
 		SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_BOTH);

 		ftp->ssl_handle = SSL_new(ctx);
-		SSL_CTX_free(ctx);
-
 		if (ftp->ssl_handle == NULL) {
 			php_error_docref(NULL, E_WARNING, "failed to create the SSL handle");
+			SSL_CTX_free(ctx);
 			return 0;
 		}

@@ -534,7 +534,7 @@ compress(int init_bits, gdIOCtxPtr outfile, gdImagePtr im, GifCtx *ctx)
    output( (code_int)ctx->ClearCode, ctx );

 #ifdef SIGNED_COMPARE_SLOW
-    while ( (c = GIFNextPixel( im, ctx )) != (unsigned) EOF ) {
+    while ( (c = GIFNextPixel( im )) != (unsigned) EOF ) {
 #else /*SIGNED_COMPARE_SLOW*/
    while ( (c = GIFNextPixel( im, ctx )) != EOF ) {  /* } */
 #endif /*SIGNED_COMPARE_SLOW*/
@@ -3,7 +3,7 @@ Bug #77198 (auto cropping has insufficient precision)
 --SKIPIF--
 <?php
 if (!extension_loaded('gd')) die('skip gd extension not available');
-if (!GD_BUNDLED) die('skip upstream bugfix has not been released');
+if (!GD_BUNDLED) die('upstream bugfix has not been released');
 ?>
 --FILE--
 <?php
@@ -3,7 +3,7 @@ Bug #77198 (threshold cropping has insufficient precision)
 --SKIPIF--
 <?php
 if (!extension_loaded('gd')) die('skip gd extension not available');
-if (!GD_BUNDLED) die('skip upstream bugfix has not been released');
+if (!GD_BUNDLED) die('upstream bugfix has not been released');
 ?>
 --FILE--
 <?php
@@ -3,7 +3,7 @@ Bug #77200 (imagecropauto(…, GD_CROP_SIDES) crops left but not right)
 --SKIPIF--
 <?php
 if (!extension_loaded('gd')) die('skip gd extension not available');
-if (!GD_BUNDLED) die('skip upstream bugfix has not been released');
+if (!GD_BUNDLED) die('upstream bugfix has not been released');
 ?>
 --FILE--
 <?php
@@ -166,9 +166,6 @@ int main() {

 int main() {
  iconv_t cd = iconv_open( "UTF-8//IGNORE", "UTF-8" );
-  if(cd == (iconv_t)-1) {
-    return 1;
-  }
  char *in_p = "\xC3\xC3\xC3\xB8";
  size_t in_left = 4, out_left = 4096;
  char *out = malloc(out_left);
Author	SHA1	Message	Date
Remi Collet	e845291527	Update versions for PHP 7.2.19	2019-05-29 06:58:04 +00:00
Remi Collet	663983e237	Update NEWS for PHP 7.2.19	2019-05-29 06:58:04 +00:00
Remi Collet	abcd793ad5	add NEWS entries for sec fix	2019-05-29 08:52:17 +02:00
Stanislav Malyshev	750687806d	Merge branch 'PHP-7.1' into PHP-7.2 * PHP-7.1: Fix bug #77967 - Bypassing open_basedir restrictions via file uris	2019-05-29 08:45:04 +02:00
Stanislav Malyshev	810161b704	Merge branch 'PHP-7.1' into PHP-7.2 * PHP-7.1: Fix bug #77988 - heap-buffer-overflow on php_jpg_get16	2019-05-29 08:44:45 +02:00
Stanislav Malyshev	ef2d071ad1	Fix function name	2019-05-29 08:44:28 +02:00
Stanislav Malyshev	3c0614f325	Merge branch 'PHP-7.1' into PHP-7.2 * PHP-7.1: Update NEWS Fix bug #78069 - Out-of-bounds read in iconv.c:_php_iconv_mime_decode() due to integer overflow Fix #77973: Uninitialized read in gdImageCreateFromXbm	2019-05-29 08:44:06 +02:00
Sara Golemon	1b47faea37	NEWS for 7.2.19	2019-05-28 10:42:21 -04:00
Sara Golemon	af575fd96c	Update CREDITS for PHP 7.2.19RC1	2019-05-14 16:21:04 +00:00
Sara Golemon	8c174da5a0	Update NEWS for PHP 7.2.19RC1	2019-05-14 16:21:04 +00:00