Update versions for PHP 7.2.24

Update NEWS for PHP 7.2.24
add NEWS entry for CVE-2019-11043
2026-11-09 02:00:49 +00:00 · 2019-10-22 08:15:44 +00:00 · 2019-10-22 08:15:44 +00:00 · 2019-10-22 09:36:13 +02:00 · 2019-10-22 09:34:42 +02:00 · 2019-10-08 09:24:52 +00:00
86 changed files with 169 additions and 1060 deletions
@@ -1,131 +1,8 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-14 May 2020, PHP 7.2.31
-
- Core:
-  . Fixed bug #78875 (Long filenames cause OOM and temp files are not cleaned). 
-    (CVE-2019-11048) (cmb)
-  . Fixed bug #78876 (Long variables in multipart/form-data cause OOM and temp 
-    files are not cleaned). (CVE-2019-11048) (cmb)
-
-16 Apr 2020, PHP 7.2.30
-
- Standard:
-  . Fixed bug #79468 (SIGSEGV when closing stream handle with a stream filter
-    appended). (dinosaur)
-  . Fixed bug #79330 (shell_exec() silently truncates after a null byte). (stas)
-  . Fixed bug #79465 (OOB Read in urldecode()). (stas)
-
-19 Mar 2020, PHP 7.2.29
-
- EXIF:
-  . Fixed bug #79282 (Use-of-uninitialized-value in exif). (CVE-2020-7064) 
-    (Nikita)
-
- Standard: 
-  . Fixed bug #79329 (get_headers() silently truncates after a null byte) 
-    (CVE-2020-7066). (cmb)
-
-20 Feb 2020, PHP 7.2.28
-
- DOM:
-  . Fixed bug #77569: (Write Access Violation in DomImplementation). (Nikita,
-    cmb)
-
- Phar:
-  . Fixed bug #79082 (Files added to tar with Phar::buildFromIterator have
-    all-access permissions). (CVE-2020-7063) (stas)
-
- Session:
-  . Fixed bug #79221 (Null Pointer Dereference in PHP Session Upload Progress).
-    (CVE-2020-7062) (stas)
-
-23 Jan 2020, PHP 7.2.27
-
- Mbstring:
-  . Fixed bug #79037 (global buffer-overflow in `mbfl_filt_conv_big5_wchar`). 
-    (CVE-2020-7060) (Nikita)
-
- Session:
-  . Fixed bug #79091 (heap use-after-free in session_create_id()). (cmb, Nikita)
-
- Standard:
-  . Fixed bug #79099 (OOB read in php_strip_tags_ex). (CVE-2020-7059). (cmb)
-
-18 Dec 2019, PHP 7.2.26
-
- Bcmath:
-  . Fixed bug #78878 (Buffer underflow in bc_shift_addsub). (CVE-2019-11046).
-    (cmb)
-
- Core:
-  . Fixed bug #78862 (link() silently truncates after a null byte on Windows).
-    (CVE-2019-11044). (cmb)
-  . Fixed bug #78863 (DirectoryIterator class silently truncates after a null
-    byte). (CVE-2019-11045). (cmb)
-
- EXIF:
-  . Fixed bug #78793 (Use-after-free in exif parsing under memory sanitizer).
-    (CVE-2019-11050). (Nikita)
-  . Fixed bug #78910 (Heap-buffer-overflow READ in exif). (CVE-2019-11047).
-    (Nikita)
-
- GD:
-  . Fixed bug #78849 (GD build broken with -D SIGNED_COMPARE_SLOW). (cmb)
-
- Intl:
-  . Fixed bug #78804 (Segmentation fault in Locale::filterMatches). (Stas)
-
- OPcache:
-  . Fixed $x = (bool)$x; with opcache (should emit undeclared variable notice).
-    (Tyson Andre)
-
- Standard:
-  . Fixed bug #78759 (array_search in $GLOBALS). (Nikita)
-  . Fixed bug #78833 (Integer overflow in pack causes out-of-bound access).
-    (cmb)
-  . Fixed bug #78814 (strip_tags allows / in tag name => whitelist bypass).
-    (cmb)
-
-21 Nov 2019, PHP 7.2.25
-
- Core:
-  . Fixed bug #78656 (Parse errors classified as highest log-level). (Erik
-    Lundin)
-  . Fixed bug #78752 (Segfault if GC triggered while generator stack frame is
-    being destroyed). (Nikita)
-  . Fixed bug #78689 (Closure::fromCallable() doesn't handle
-    [Closure, '__invoke']). (Nikita)
-
- COM:
-  . Fixed bug #78694 (Appending to a variant array causes segfault). (cmb)
-
- Date:
-  . Fixed bug #70153 (\DateInterval incorrectly unserialized). (Maksim Iakunin)
-  . Fixed bug #78751 (Serialising DatePeriod converts DateTimeImmutable). (cmb)
-
- Iconv:
-  . Fixed bug #78642 (Wrong libiconv version displayed). (gedas at martynas,
-    cmb).
-
- OpCache:
-  . Fixed bug #78654 (Incorrectly computed opcache checksum on files with
-    non-ascii characters). (mhagstrand)
-  . Fixed bug #78747 (OpCache corrupts custom extension result). (Nikita)
-
- OpenSSL:
-  . Fixed bug #78775 (TLS issues from HTTP request affecting other encrypted
-    connections). (Nikita)
-
- Reflection:
-  . Fixed bug #78697 (ReflectionClass::ImplementsInterface - inaccurate error
-    message with traits). (villfa)
-
- Sockets:
-  . Fixed bug #78665 (Multicasting may leak memory). (cmb)
-
 24 Oct 2019, PHP 7.2.24

+
 - Core:
  . Fixed bug #78535 (auto_detect_line_endings value not parsed as bool).
    (bugreportuser)
@@ -1,13 +0,0 @@
--TEST--
-Bug #78689: Closure::fromCallable() doesn't handle [Closure, '__invoke']
--FILE--
-<?php
-$a = [function () { echo "123\n"; }, '__invoke'];
-$a();
-
-$b = Closure::fromCallable($a);
-$b();
-?>
--EXPECT--
-123
-123
@@ -1,24 +0,0 @@
--TEST--
-Bug #78752: Segfault if GC triggered while generator stack frame is being destroyed
--FILE--
-<?php
-
-function gen(&$gen) {
-    $a = new stdClass;
-    $a->a = $a;
-    $b = new stdClass;
-    $b->b = $b;
-    yield 1;
-}
-
-$gen = gen($gen);
-var_dump($gen->current());
-for ($i = 0; $i < 9999; $i++) {
-    $a = new stdClass;
-    $a->a = $a;
-}
-$gen->next();
-
-?>
--EXPECT--
-int(1)
@@ -1,15 +0,0 @@
--TEST--
-Calling a static method on a non-existing class
--FILE--
-<?php
-
-$str = "foo";
-try {
-    Test::{$str . "bar"}();
-} catch (Error $e) {
-    echo $e->getMessage(), "\n";
-}
-
-?>
--EXPECT--
-Class 'Test' not found
@@ -268,16 +268,8 @@ static int zend_create_closure_from_callable(zval *return_value, zval *callable,

 	mptr = fcc.function_handler;
 	if (mptr->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
-		/* For Closure::fromCallable([$closure, "__invoke"]) return $closure. */
-		if (fcc.object && fcc.object->ce == zend_ce_closure
-				&& zend_string_equals_literal(mptr->common.function_name, "__invoke")) {
-			ZVAL_OBJ(return_value, fcc.object);
-			GC_REFCOUNT(fcc.object)++;
-			zend_free_trampoline(mptr);
-			return SUCCESS;
-		}
-
 		memset(&call, 0, sizeof(zend_internal_function));
+
 		call.type = ZEND_INTERNAL_FUNCTION;
 		call.handler = zend_closure_call_magic;
 		call.function_name = mptr->common.function_name;
@@ -97,18 +97,16 @@ ZEND_API zend_execute_data* zend_generator_freeze_call_stack(zend_execute_data *
 /* }}} */

 static void zend_generator_cleanup_unfinished_execution(
-		zend_generator *generator, zend_execute_data *execute_data, uint32_t catch_op_num) /* {{{ */
+		zend_generator *generator, uint32_t catch_op_num) /* {{{ */
 {
+	zend_execute_data *execute_data = generator->execute_data;
+
 	if (execute_data->opline != execute_data->func->op_array.opcodes) {
 		/* -1 required because we want the last run opcode, not the next to-be-run one. */
 		uint32_t op_num = execute_data->opline - execute_data->func->op_array.opcodes - 1;

 		if (UNEXPECTED(generator->frozen_call_stack)) {
-			/* Temporarily restore generator->execute_data if it has been NULLed out already. */
-			zend_execute_data *save_ex = generator->execute_data;
-			generator->execute_data = execute_data;
 			zend_generator_restore_call_stack(generator);
-			generator->execute_data = save_ex;
 		}
 		zend_cleanup_unfinished_execution(execute_data, op_num, catch_op_num);
 	}
@@ -119,9 +117,6 @@ ZEND_API void zend_generator_close(zend_generator *generator, zend_bool finished
 {
 	if (EXPECTED(generator->execute_data)) {
 		zend_execute_data *execute_data = generator->execute_data;
-		/* Null out execute_data early, to prevent double frees if GC runs while we're
-		 * already cleaning up execute_data. */
-		generator->execute_data = NULL;

 		if (EX_CALL_INFO() & ZEND_CALL_HAS_SYMBOL_TABLE) {
 			zend_clean_and_cache_symbol_table(execute_data->symbol_table);
@@ -140,12 +135,12 @@ ZEND_API void zend_generator_close(zend_generator *generator, zend_bool finished
 			return;
 		}

-		zend_vm_stack_free_extra_args(execute_data);
+		zend_vm_stack_free_extra_args(generator->execute_data);

 		/* Some cleanups are only necessary if the generator was closed
 		 * before it could finish execution (reach a return statement). */
 		if (UNEXPECTED(!finished_execution)) {
-			zend_generator_cleanup_unfinished_execution(generator, execute_data, 0);
+			zend_generator_cleanup_unfinished_execution(generator, 0);
 		}

 		/* Free closure object */
@@ -159,7 +154,8 @@ ZEND_API void zend_generator_close(zend_generator *generator, zend_bool finished
 			generator->gc_buffer = NULL;
 		}

-		efree(execute_data);
+		efree(generator->execute_data);
+		generator->execute_data = NULL;
 	}
 }
 /* }}} */
@@ -220,7 +216,7 @@ static void zend_generator_dtor_storage(zend_object *object) /* {{{ */
 	if (finally_op_num) {
 		zval *fast_call;

-		zend_generator_cleanup_unfinished_execution(generator, ex, finally_op_num);
+		zend_generator_cleanup_unfinished_execution(generator, finally_op_num);

 		fast_call = ZEND_CALL_VAR(ex, ex->func->op_array.opcodes[finally_op_end].op1.var);
 		Z_OBJ_P(fast_call) = EG(exception);
@@ -758,10 +758,8 @@ ZEND_VM_HANDLER(13, ZEND_BOOL_NOT, CONST|TMPVAR|CV, ANY)
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_FALSE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
-		/* The result and op1 can be the same cv zval */
-		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_TRUE(EX_VAR(opline->result.var));
-		if (OP1_TYPE == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
+		if (OP1_TYPE == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
 			SAVE_OPLINE();
 			GET_OP1_UNDEF_CV(val, BP_VAR_R);
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -3100,7 +3098,6 @@ ZEND_VM_HANDLER(113, ZEND_INIT_STATIC_METHOD_CALL, UNUSED|CLASS_FETCH|CONST|VAR,
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
-				FREE_UNFETCHED_OP2();
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -4757,10 +4754,8 @@ ZEND_VM_HANDLER(52, ZEND_BOOL, CONST|TMPVAR|CV, ANY)
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_TRUE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
-		/* The result and op1 can be the same cv zval */
-		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_FALSE(EX_VAR(opline->result.var));
-		if (OP1_TYPE == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
+		if (OP1_TYPE == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
 			SAVE_OPLINE();
 			GET_OP1_UNDEF_CV(val, BP_VAR_R);
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -2653,10 +2653,8 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_BOOL_NOT_SPEC_CONST_HANDLER(ZE
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_FALSE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
-		/* The result and op1 can be the same cv zval */
-		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_TRUE(EX_VAR(opline->result.var));
-		if (IS_CONST == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
+		if (IS_CONST == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
 			SAVE_OPLINE();
 			GET_OP1_UNDEF_CV(val, BP_VAR_R);
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -3187,10 +3185,8 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_BOOL_SPEC_CONST_HANDLER(ZEND_O
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_TRUE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
-		/* The result and op1 can be the same cv zval */
-		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_FALSE(EX_VAR(opline->result.var));
-		if (IS_CONST == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
+		if (IS_CONST == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
 			SAVE_OPLINE();
 			GET_OP1_UNDEF_CV(val, BP_VAR_R);
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -5421,7 +5417,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_C
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
-
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -7383,7 +7378,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_C
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
-
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -9472,7 +9466,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_C
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
-
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -11495,7 +11488,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_C
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
-				zval_ptr_dtor_nogc(EX_VAR(opline->op2.var));
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -19468,7 +19460,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_V
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
-
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -21268,7 +21259,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_V
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
-
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -23869,7 +23859,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_V
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
-
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -26370,7 +26359,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_V
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
-				zval_ptr_dtor_nogc(EX_VAR(opline->op2.var));
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -28290,7 +28278,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_U
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
-
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -29068,7 +29055,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_U
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
-
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -30901,7 +30887,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_U
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
-
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -32617,7 +32602,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_U
 			ce = zend_fetch_class_by_name(Z_STR_P(EX_CONSTANT(opline->op1)), EX_CONSTANT(opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
-				zval_ptr_dtor_nogc(EX_VAR(opline->op2.var));
 				HANDLE_EXCEPTION();
 			}
 			CACHE_PTR(Z_CACHE_SLOT_P(EX_CONSTANT(opline->op1)), ce);
@@ -32870,10 +32854,8 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_BOOL_NOT_SPEC_CV_HANDLER(ZEND_
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_FALSE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
-		/* The result and op1 can be the same cv zval */
-		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_TRUE(EX_VAR(opline->result.var));
-		if (IS_CV == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
+		if (IS_CV == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
 			SAVE_OPLINE();
 			GET_OP1_UNDEF_CV(val, BP_VAR_R);
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -33710,10 +33692,8 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_BOOL_SPEC_CV_HANDLER(ZEND_OPCO
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_TRUE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
-		/* The result and op1 can be the same cv zval */
-		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_FALSE(EX_VAR(opline->result.var));
-		if (IS_CV == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
+		if (IS_CV == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
 			SAVE_OPLINE();
 			GET_OP1_UNDEF_CV(val, BP_VAR_R);
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -48545,10 +48525,8 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_BOOL_NOT_SPEC_TMPVAR_HANDLER(Z
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_FALSE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
-		/* The result and op1 can be the same cv zval */
-		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_TRUE(EX_VAR(opline->result.var));
-		if ((IS_TMP_VAR|IS_VAR) == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
+		if ((IS_TMP_VAR|IS_VAR) == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
 			SAVE_OPLINE();
 			GET_OP1_UNDEF_CV(val, BP_VAR_R);
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -48811,10 +48789,8 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_BOOL_SPEC_TMPVAR_HANDLER(ZEND_
 	if (Z_TYPE_INFO_P(val) == IS_TRUE) {
 		ZVAL_TRUE(EX_VAR(opline->result.var));
 	} else if (EXPECTED(Z_TYPE_INFO_P(val) <= IS_TRUE)) {
-		/* The result and op1 can be the same cv zval */
-		const uint32_t orig_val_type = Z_TYPE_INFO_P(val);
 		ZVAL_FALSE(EX_VAR(opline->result.var));
-		if ((IS_TMP_VAR|IS_VAR) == IS_CV && UNEXPECTED(orig_val_type == IS_UNDEF)) {
+		if ((IS_TMP_VAR|IS_VAR) == IS_CV && UNEXPECTED(Z_TYPE_INFO_P(val) == IS_UNDEF)) {
 			SAVE_OPLINE();
 			GET_OP1_UNDEF_CV(val, BP_VAR_R);
 			ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
@@ -398,8 +398,6 @@ AC_DEFUN([PHP_EVAL_LIBLINE],[
        $2="[$]$2 -pthread"
      else
        PHP_RUN_ONCE(EXTRA_LDFLAGS, [$ac_i], [EXTRA_LDFLAGS="$EXTRA_LDFLAGS $ac_i"])
-        PHP_RUN_ONCE(EXTRA_LDFLAGS_PROGRAM, [$ac_i],
-            [EXTRA_LDFLAGS_PROGRAM="$EXTRA_LDFLAGS_PROGRAM $ac_i"])
      fi
    ;;
    -l*[)]
@@ -2221,8 +2219,7 @@ AC_DEFUN([PHP_SETUP_ICU],[

      ICU_LIBS=`$PKG_CONFIG --libs icu-uc icu-io icu-i18n`
      ICU_INCS=`$PKG_CONFIG --cflags-only-I icu-uc icu-io icu-i18n`
-      ICU_CXXFLAGS=`$PKG_CONFIG --variable=CXXFLAGS icu-uc`
-      ICU_CXXFLAGS="$ICU_CXXFLAGS -DU_USING_ICU_NAMESPACE=1"
+      ICU_CXXFLAGS="-DU_USING_ICU_NAMESPACE=1"

      AC_MSG_RESULT([found $ICU_VERSION])

@@ -107,7 +107,7 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=2
-PHP_RELEASE_VERSION=31
+PHP_RELEASE_VERSION=24
 PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
@@ -57,9 +57,9 @@ bc_str2num (bc_num *num, char *str, int scale)
  zero_int = FALSE;
  if ( (*ptr == '+') || (*ptr == '-'))  ptr++;  /* Sign */
  while (*ptr == '0') ptr++;			/* Skip leading zeros. */
-  while (*ptr >= '0' && *ptr <= '9') ptr++, digits++;	/* digits */
+  while (isdigit((int)*ptr)) ptr++, digits++;	/* digits */
  if (*ptr == '.') ptr++;			/* decimal point */
-  while (*ptr >= '0' && *ptr <= '9') ptr++, strscale++;	/* digits */
+  while (isdigit((int)*ptr)) ptr++, strscale++;	/* digits */
  if ((*ptr != '\0') || (digits+strscale == 0))
    {
      *num = bc_copy_num (BCG(_zero_));
@@ -1,13 +0,0 @@
--TEST--
-Bug #78878 (Buffer underflow in bc_shift_addsub)
--SKIPIF--
-<?php
-if (!extension_loaded('bcmath')) die('skip bcmath extension not available');
-?>
--FILE--
-<?php
-print @bcmul("\xB26483605105519922841849335928742092", bcpowmod(2, 65535, -4e-4));
-?>
--EXPECT--
-bc math warning: non-zero scale in modulus
-0
@@ -127,11 +127,6 @@ static void com_write_dimension(zval *object, zval *offset, zval *value)

 	obj = CDNO_FETCH(object);

-	if (offset == NULL) {
-		php_com_throw_exception(DISP_E_BADINDEX, "appending to variants is not supported");
-		return;
-	}
-
 	if (V_VT(&obj->v) == VT_DISPATCH) {
 		ZVAL_COPY_VALUE(&args[0], offset);
 		ZVAL_COPY_VALUE(&args[1], value);
@@ -1,19 +0,0 @@
--TEST--
-Bug #78694 (Appending to a variant array causes segfault)
--SKIPIF--
-<?php
-if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
-?>
--FILE--
-<?php
-foreach ([new com('WScript.Shell'), new variant([])] as $var) {
-    try {
-        $var[] = 42;
-    } catch (com_exception $ex) {
-        var_dump($ex->getMessage());
-    }
-}
-?>
--EXPECT--
-string(38) "appending to variants is not supported"
-string(38) "appending to variants is not supported"
@@ -1,34 +0,0 @@
--TEST--
-Bug #78775: TLS issues from HTTP request affecting other encrypted connections
--SKIPIF--
-<?php
-if (!extension_loaded('curl')) die('skip Requires curl');
-if (getenv('SKIP_ONLINE_TESTS')) die('skip Online test');
-?>
--FILE--
-<?php
-
-$sock = fsockopen("tls://google.com", 443);
-
-var_dump($sock);
-
-$handle = curl_init('https://self-signed.badssl.com/');
-curl_setopt_array(
-    $handle,
-    [
-        CURLOPT_RETURNTRANSFER => true,
-        CURLOPT_SSL_VERIFYPEER => true,
-    ]
-);
-
-var_dump(curl_exec($handle));
-curl_close($handle);
-
-fwrite($sock, "GET / HTTP/1.0\n\n");
-var_dump(fread($sock, 8));
-
-?>
--EXPECTF--
-resource(%d) of type (stream)
-bool(false)
-string(8) "HTTP/1.0"
@@ -4364,20 +4364,6 @@ static int php_date_interval_initialize_from_hash(zval **return_value, php_inter
 		} \
 	} while (0);

-#define PHP_DATE_INTERVAL_READ_PROPERTY_DAYS(member) \
-	do { \
-		zval *z_arg = zend_hash_str_find(myht, "days", sizeof("days") - 1); \
-		if (z_arg && Z_TYPE_P(z_arg) == IS_FALSE) { \
-			(*intobj)->diff->member = -99999; \
-		} else if (z_arg && Z_TYPE_P(z_arg) <= IS_STRING) { \
-			zend_string *str = zval_get_string(z_arg); \
-			DATE_A64I((*intobj)->diff->member, ZSTR_VAL(str)); \
-			zend_string_release(str); \
-		} else { \
-			(*intobj)->diff->member = -1LL; \
-		} \
-	} while (0);
-
 #define PHP_DATE_INTERVAL_READ_PROPERTY_DOUBLE(element, member, def) \
 	do { \
 		zval *z_arg = zend_hash_str_find(myht, element, sizeof(element) - 1); \
@@ -4406,7 +4392,7 @@ static int php_date_interval_initialize_from_hash(zval **return_value, php_inter
 	PHP_DATE_INTERVAL_READ_PROPERTY("weekday_behavior", weekday_behavior, int, -1)
 	PHP_DATE_INTERVAL_READ_PROPERTY("first_last_day_of", first_last_day_of, int, -1)
 	PHP_DATE_INTERVAL_READ_PROPERTY("invert", invert, int, 0);
-	PHP_DATE_INTERVAL_READ_PROPERTY_DAYS(days);
+	PHP_DATE_INTERVAL_READ_PROPERTY_I64("days", days);
 	PHP_DATE_INTERVAL_READ_PROPERTY("special_type", special.type, unsigned int, 0);
 	PHP_DATE_INTERVAL_READ_PROPERTY_I64("special_amount", special.amount);
 	PHP_DATE_INTERVAL_READ_PROPERTY("have_weekday_relative", have_weekday_relative, unsigned int, 0);
@@ -5171,7 +5157,7 @@ static HashTable *date_object_get_properties_period(zval *object) /* {{{ */

 	if (period_obj->start) {
 		php_date_obj *date_obj;
-		object_init_ex(&zv, period_obj->start_ce);
+		object_init_ex(&zv, date_ce_date);
 		date_obj = Z_PHPDATE_P(&zv);
 		date_obj->time = timelib_time_clone(period_obj->start);
 	} else {
@@ -5181,7 +5167,7 @@ static HashTable *date_object_get_properties_period(zval *object) /* {{{ */

 	if (period_obj->current) {
 		php_date_obj *date_obj;
-		object_init_ex(&zv, period_obj->start_ce);
+		object_init_ex(&zv, date_ce_date);
 		date_obj = Z_PHPDATE_P(&zv);
 		date_obj->time = timelib_time_clone(period_obj->current);
 	} else {
@@ -5191,7 +5177,7 @@ static HashTable *date_object_get_properties_period(zval *object) /* {{{ */

 	if (period_obj->end) {
 		php_date_obj *date_obj;
-		object_init_ex(&zv, period_obj->start_ce);
+		object_init_ex(&zv, date_ce_date);
 		date_obj = Z_PHPDATE_P(&zv);
 		date_obj->time = timelib_time_clone(period_obj->end);
 	} else {
@@ -5228,7 +5214,7 @@ static int php_date_period_initialize_from_hash(php_period_obj *period_obj, Hash

 	ht_entry = zend_hash_str_find(myht, "start", sizeof("start")-1);
 	if (ht_entry) {
-		if (Z_TYPE_P(ht_entry) == IS_OBJECT && instanceof_function(Z_OBJCE_P(ht_entry), date_ce_interface)) {
+		if (Z_TYPE_P(ht_entry) == IS_OBJECT && Z_OBJCE_P(ht_entry) == date_ce_date) {
 			php_date_obj *date_obj;
 			date_obj = Z_PHPDATE_P(ht_entry);
 			period_obj->start = timelib_time_clone(date_obj->time);
@@ -5242,7 +5228,7 @@ static int php_date_period_initialize_from_hash(php_period_obj *period_obj, Hash

 	ht_entry = zend_hash_str_find(myht, "end", sizeof("end")-1);
 	if (ht_entry) {
-		if (Z_TYPE_P(ht_entry) == IS_OBJECT && instanceof_function(Z_OBJCE_P(ht_entry), date_ce_interface)) {
+		if (Z_TYPE_P(ht_entry) == IS_OBJECT && Z_OBJCE_P(ht_entry) == date_ce_date) {
 			php_date_obj *date_obj;
 			date_obj = Z_PHPDATE_P(ht_entry);
 			period_obj->end = timelib_time_clone(date_obj->time);
@@ -5255,7 +5241,7 @@ static int php_date_period_initialize_from_hash(php_period_obj *period_obj, Hash

 	ht_entry = zend_hash_str_find(myht, "current", sizeof("current")-1);
 	if (ht_entry) {
-		if (Z_TYPE_P(ht_entry) == IS_OBJECT && instanceof_function(Z_OBJCE_P(ht_entry), date_ce_interface)) {
+		if (Z_TYPE_P(ht_entry) == IS_OBJECT && Z_OBJCE_P(ht_entry) == date_ce_date) {
 			php_date_obj *date_obj;
 			date_obj = Z_PHPDATE_P(ht_entry);
 			period_obj->current = timelib_time_clone(date_obj->time);
@@ -39,7 +39,7 @@ DateInterval Object
    [weekday_behavior] => 0
    [first_last_day_of] => 0
    [invert] => 0
-    [days] => 
+    [days] => 0
    [special_type] => 0
    [special_amount] => 0
    [have_weekday_relative] => 0
@@ -136,7 +136,7 @@ object(DatePeriod)#5 (6) {
    ["invert"]=>
    int(0)
    ["days"]=>
-    bool(false)
+    int(0)
    ["special_type"]=>
    int(0)
    ["special_amount"]=>
@@ -71,7 +71,7 @@ object(DateInterval)#2 (16) {
  ["invert"]=>
  int(0)
  ["days"]=>
-  bool(false)
+  int(0)
  ["special_type"]=>
  int(0)
  ["special_amount"]=>
@@ -1,14 +0,0 @@
--TEST--
-Bug #70153 (\DateInterval incorrectly unserialized)
--FILE--
-<?php
-$i1 = \DateInterval::createFromDateString('+1 month');
-$i2 = unserialize(serialize($i1));
-var_dump($i1->days, $i2->days);
-var_dump($i2->special_amount, $i2->special_amount);
-?>
--EXPECT--
-bool(false)
-bool(false)
-int(0)
-int(0)
@@ -1,16 +0,0 @@
--TEST--
-Bug #78751 (Serialising DatePeriod converts DateTimeImmutable)
--FILE--
-<?php
-$oDay = new DateTimeImmutable('2019-10-25');
-$oDateInterval = DateInterval::createFromDateString('1 day');
-$oDays = new DatePeriod($oDay, $oDateInterval, $oDay->modify('+1 day'));
-$oDays = unserialize(serialize($oDays));
-var_dump(
-    $oDays->start instanceof DateTimeImmutable,
-    $oDays->end instanceof DateTimeImmutable
-);
-?>
--EXPECT--
-bool(true)
-bool(true)
@@ -341,7 +341,7 @@ int dom_document_encoding_write(dom_object *obj, zval *newval)

 	str = zval_get_string(newval);

-	handler = xmlFindCharEncodingHandler(ZSTR_VAL(str));
+	handler = xmlFindCharEncodingHandler(Z_STRVAL_P(newval));

    if (handler != NULL) {
 		xmlCharEncCloseFunc(handler);
@@ -21,6 +21,6 @@ domdocumentloadxml_test_method.php
 --EXPECTF--
 Warning: DOMDocument::load%r(XML){0,1}%r(): Opening and ending tag mismatch: title line 5 and book %s

-Warning: DOMDocument::load%r(XML){0,1}%r(): %rexpected '>'|Opening and ending tag mismatch: book line 5 and books%r %s
+Warning: DOMDocument::load%r(XML){0,1}%r(): expected '>' %s

-Warning: DOMDocument::load%r(XML){0,1}%r(): %rPremature end of data in tag books|EndTag: '<\/' not found in Entity, line: 13%r %s
+Warning: DOMDocument::load%r(XML){0,1}%r(): Premature end of data in tag books %s
@@ -21,6 +21,6 @@ domdocumentload_test_method.php
 --EXPECTF--
 Warning: DOMDocument::load%r(XML){0,1}%r(): Opening and ending tag mismatch: title line 5 and book %s

-Warning: DOMDocument::load%r(XML){0,1}%r(): %rexpected '>'|Opening and ending tag mismatch: book line 5 and books%r %s
+Warning: DOMDocument::load%r(XML){0,1}%r(): expected '>' %s

-Warning: DOMDocument::load%r(XML){0,1}%r(): %rPremature end of data in tag books|EndTag: '<\/' not found%r %s
+Warning: DOMDocument::load%r(XML){0,1}%r(): Premature end of data in tag books %s
@@ -1,14 +0,0 @@
--TEST--
-Bug #77569 (Write Access Violation in DomImplementation)
--SKIPIF--
-<?php
-if (!extension_loaded('dom')) die('skip dom extension not available');
-?>
--FILE--
-<?php
-$imp = new DOMImplementation;
-$dom = $imp->createDocument("", "");
-$dom->encoding = null;
-?>
--EXPECTF--
-Warning: main(): Invalid Document Encoding in %s on line %d
@@ -3165,8 +3165,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 			continue;
 		if (maker_note->model && (!ImageInfo->model || strcmp(maker_note->model, ImageInfo->model)))
 			continue;
-		if (maker_note->id_string && value_len >= maker_note->id_string_len
-				&& strncmp(maker_note->id_string, value_ptr, maker_note->id_string_len))
+		if (maker_note->id_string && strncmp(maker_note->id_string, value_ptr, maker_note->id_string_len))
 			continue;
 		break;
 	}
@@ -3240,9 +3239,8 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 	}

 	for (de=0;de<NumDirEntries;de++) {
-		size_t offset = 2 + 12 * de;
-		if (!exif_process_IFD_TAG(ImageInfo, dir_start + offset,
-								  offset_base, data_len - offset, displacement, section_index, 0, maker_note->tag_table)) {
+		if (!exif_process_IFD_TAG(ImageInfo, dir_start + 2 + 12 * de,
+								  offset_base, data_len, displacement, section_index, 0, maker_note->tag_table)) {
 			return FALSE;
 		}
 	}
@@ -3296,6 +3294,11 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 		/*return TRUE;*/
 	}

+	if (components < 0) {
+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal components(%d)", tag, exif_get_tagname(tag, tagname, -12, tag_table), components);
+		return FALSE;
+	}
+
 	byte_count_signed = (int64_t)components * php_tiff_bytes_per_format[format];

 	if (byte_count_signed < 0 || (byte_count_signed > INT32_MAX)) {
@@ -3692,11 +3695,6 @@ static void exif_process_TIFF_in_JPEG(image_info_type *ImageInfo, char *CharBuf,
 {
 	unsigned exif_value_2a, offset_of_ifd;

-	if (length < 2) {
-		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Missing TIFF alignment marker");
-		return;
-	}
-
 	/* set the thumbnail stuff to nothing so we can test to see if they get set up */
 	if (memcmp(CharBuf, "II", 2) == 0) {
 		ImageInfo->motorola_intel = 0;
@@ -3849,7 +3847,7 @@ static int exif_scan_JPEG_header(image_info_type *ImageInfo)
 			return FALSE;
 		}

-		sn = exif_file_sections_add(ImageInfo, marker, itemlen, NULL);
+		sn = exif_file_sections_add(ImageInfo, marker, itemlen+1, NULL);
 		Data = ImageInfo->file.list[sn].data;

 		/* Store first two pre-read bytes. */
@@ -4605,9 +4603,8 @@ PHP_FUNCTION(exif_read_data)
 		exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "CCDWidth", "%dmm", (int)ImageInfo.CCDWidth);
 	}
 	if(ImageInfo.ExposureTime>0) {
-		float recip_exposure_time = 0.5f + 1.0f/ImageInfo.ExposureTime;
-		if (ImageInfo.ExposureTime <= 0.5 && recip_exposure_time < INT_MAX) {
-			exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "ExposureTime", "%0.3F s (1/%d)", ImageInfo.ExposureTime, (int) recip_exposure_time);
+		if(ImageInfo.ExposureTime <= 0.5) {
+			exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "ExposureTime", "%0.3F s (1/%d)", ImageInfo.ExposureTime, (int)(0.5 + 1/ImageInfo.ExposureTime));
 		} else {
 			exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "ExposureTime", "%0.3F s", ImageInfo.ExposureTime);
 		}
@@ -70,7 +70,7 @@ Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal f

 Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d

-Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal pointer offset(x30303030 + x30303030 = x60606060 > %s) in %sbug76557.php on line %d
+Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal pointer offset(x30303030 + x30303030 = x60606060 > x00EE) in %sbug76557.php on line %d

 Warning: exif_read_data(bug76557.jpg): File structure corrupted in %sbug76557.php on line %d

@@ -1,12 +0,0 @@
--TEST--
-Bug #78793: Use-after-free in exif parsing under memory sanitizer
--FILE--
-<?php
-$f = "ext/exif/tests/bug77950.tiff";
-for ($i = 0; $i < 10; $i++) {
-    @exif_read_data($f);
-}
-?>
-===DONE===
--EXPECT--
-===DONE===
@@ -1,17 +0,0 @@
--TEST--
-Bug #78910: Heap-buffer-overflow READ in exif (OSS-Fuzz #19044)
--FILE--
-<?php
-
-var_dump(exif_read_data('data:image/jpg;base64,TU0AKgAAAAwgICAgAAIBDwAEAAAAAgAAACKSfCAgAAAAAEZVSklGSUxN'));
-
-?>
--EXPECTF--
-Notice: exif_read_data(): Read from TIFF: tag(0x927C, MakerNote  ): Illegal format code 0x2020, switching to BYTE in %s on line %d
-
-Warning: exif_read_data(): Process tag(x927C=MakerNote  ): Illegal format code 0x2020, suppose BYTE in %s on line %d
-
-Warning: exif_read_data(): IFD data too short: 0x0000 offset 0x000C in %s on line %d
-
-Warning: exif_read_data(): Invalid TIFF file in %s on line %d
-bool(false)
@@ -1,15 +0,0 @@
--TEST--
-Bug #79282: Use-of-uninitialized-value in exif
--FILE--
-<?php
-
-var_dump(exif_read_data('data://image/jpeg;base64,/9jhAAlFeGlmAAAg'));
-
-?>
--EXPECTF--
-Warning: exif_read_data(): Missing TIFF alignment marker in %s on line %d
-
-Warning: exif_read_data(): File structure corrupted in %s on line %d
-
-Warning: exif_read_data(): Invalid JPEG file in %s on line %d
-bool(false)
@@ -1,11 +1,5 @@
 --TEST--
 OSS-Fuzz #17474: Memory leak on duplicate Copyright tags
--SKIPIF--
-<?php
-if (!extension_loaded('exif')) {
-    die('skip exif extension not available');
-}
-?>
 --FILE--
 <?php

@@ -1,11 +1,5 @@
 --TEST--
 OSS-Fuzz #17163: Out-of-bounds read due to tag with zero components
--SKIPIF--
-<?php
-if (!extension_loaded('exif')) {
-    die('skip exif extension not available');
-}
-?>
 --FILE--
 <?php

@@ -1,11 +1,5 @@
 --TEST--
 OSS-Fuzz: Temporary buffer leak in tag reading
--SKIPIF--
-<?php
-if (!extension_loaded('exif')) {
-    die('skip exif extension not available');
-}
-?>
 --FILE--
 <?php

@@ -1,11 +1,5 @@
 --TEST--
 OSS-Fuzz: Memory leak for zero-length MAKERNOTE
--SKIPIF--
-<?php
-if (!extension_loaded('exif')) {
-    die('skip exif extension not available');
-}
-?>
 --FILE--
 <?php

@@ -1011,9 +1011,8 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 				goto out;
 			}
 			nelements = CDF_GETUINT32(q, 1);
-			if (nelements > CDF_ELEMENT_LIMIT || nelements == 0) {
-				DPRINTF(("CDF_VECTOR with nelements == %"
-				    SIZE_T_FORMAT "u\n", nelements));
+			if (nelements == 0) {
+				DPRINTF(("CDF_VECTOR with nelements == 0\n"));
 				goto out;
 			}
 			slen = 2;
@@ -1055,6 +1054,8 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 					goto out;
 				inp += nelem;
 			}
+			DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n",
+			    nelements));
 			for (j = 0; j < nelements && i < sh.sh_properties;
 			    j++, i++)
 			{
@@ -50,7 +50,6 @@
 typedef int32_t cdf_secid_t;

 #define CDF_LOOP_LIMIT					10000
-#define CDF_ELEMENT_LIMIT				100000

 #define CDF_SECID_NULL					0
 #define CDF_SECID_FREE					-1
@@ -534,7 +534,7 @@ compress(int init_bits, gdIOCtxPtr outfile, gdImagePtr im, GifCtx *ctx)
    output( (code_int)ctx->ClearCode, ctx );

 #ifdef SIGNED_COMPARE_SLOW
-    while ( (c = GIFNextPixel( im, ctx )) != (unsigned) EOF ) {
+    while ( (c = GIFNextPixel( im )) != (unsigned) EOF ) {
 #else /*SIGNED_COMPARE_SLOW*/
    while ( (c = GIFNextPixel( im, ctx )) != EOF ) {  /* } */
 #endif /*SIGNED_COMPARE_SLOW*/
@@ -286,7 +286,7 @@ PHP_MINIT_FUNCTION(miconv)
 	{
 		static char buf[16];
 		snprintf(buf, sizeof(buf), "%d.%d",
-			_libiconv_version >> 8, _libiconv_version & 0xff);
+		    ((_libiconv_version >> 8) & 0x0f), (_libiconv_version & 0x0f));
 		version = buf;
 	}
 #elif HAVE_GLIBC_ICONV
@@ -1292,7 +1292,7 @@ PHP_FUNCTION(locale_filter_matches)
 	if( boolCanonical ){
 		/* canonicalize loc_range */
 		can_loc_range=get_icu_value_internal( loc_range , LOC_CANONICALIZE_TAG , &result , 0);
-		if( result <=0) {
+		if( result ==0) {
 			intl_error_set( NULL, status,
 				"locale_filter_matches : unable to canonicalize loc_range" , 0 );
 			RETURN_FALSE;
@@ -1300,7 +1300,7 @@ PHP_FUNCTION(locale_filter_matches)

 		/* canonicalize lang_tag */
 		can_lang_tag = get_icu_value_internal( lang_tag , LOC_CANONICALIZE_TAG , &result ,  0);
-		if( result <=0) {
+		if( result ==0) {
 			intl_error_set( NULL, status,
 				"locale_filter_matches : unable to canonicalize lang_tag" , 0 );
 			RETURN_FALSE;
@@ -1,13 +0,0 @@
--TEST--
-Bug #78804: Segmentation fault in Locale::filterMatches
--FILE--
-<?php
-
-if (Locale::filterMatches('en-US', 'und', true)) {
-    echo 'Matches';
-} else {
-    echo 'Not matches';
-}
-?>
--EXPECT--
-Not matches
@@ -138,17 +138,6 @@ static unsigned short cp950_pua_tbl[][4] = {
 	{0xf70f,0xf848,0xc740,0xc8fe},
 };

-static inline int is_in_cp950_pua(int c1, int c) {
-	if ((c1 >= 0xfa && c1 <= 0xfe) || (c1 >= 0x8e && c1 <= 0xa0) ||
-			(c1 >= 0x81 && c1 <= 0x8d) || (c1 >= 0xc7 && c1 <= 0xc8)) {
-		return (c >=0x40 && c <= 0x7e) || (c >= 0xa1 && c <= 0xfe);
-	}
-	if (c1 == 0xc6) {
-		return c >= 0xa1 && c <= 0xfe;
-	}
-	return 0;
-}
-
 /*
 * Big5 => wchar
 */
@@ -197,7 +186,11 @@ mbfl_filt_conv_big5_wchar(int c, mbfl_convert_filter *filter)

 			if (filter->from->no_encoding == mbfl_no_encoding_cp950) {
 				/* PUA for CP950 */
-				if (w <= 0 && is_in_cp950_pua(c1, c)) {
+				if (w <= 0 &&
+					(((c1 >= 0xfa && c1 <= 0xfe) || (c1 >= 0x8e && c1 <= 0xa0) ||
+					  (c1 >= 0x81 && c1 <= 0x8d) ||(c1 >= 0xc7 && c1 <= 0xc8))
+					 && ((c > 0x39 && c < 0x7f) || (c > 0xa0 && c < 0xff))) ||
+					((c1 == 0xc6) && (c > 0xa0 && c < 0xff))) {
 					c2 = c1 << 8 | c;
 					for (k = 0; k < sizeof(cp950_pua_tbl)/(sizeof(unsigned short)*4); k++) {
 						if (c2 >= cp950_pua_tbl[k][2] && c2 <= cp950_pua_tbl[k][3]) {
@@ -1,10 +0,0 @@
--TEST--
-Bug #79037: global buffer-overflow in `mbfl_filt_conv_big5_wchar`
--FILE--
-<?php
-
-var_dump(mb_convert_encoding("\x81\x3a", "UTF-8", "CP950"));
-
-?>
--EXPECT--
-string(1) "?"
@@ -1215,7 +1215,7 @@ uint32_t zend_get_func_info(const zend_call_info *call_info, const zend_ssa *ssa
 	if (call_info->callee_func->type == ZEND_INTERNAL_FUNCTION) {
 		func_info_t *info;

-		if (!call_info->callee_func->common.scope && (info = zend_hash_find_ptr(&func_info, Z_STR_P(CRT_CONSTANT_EX(call_info->caller_op_array, call_info->caller_init_opline->op2, ssa->rt_constants)))) != NULL) {
+		if ((info = zend_hash_find_ptr(&func_info, Z_STR_P(CRT_CONSTANT_EX(call_info->caller_op_array, call_info->caller_init_opline->op2, ssa->rt_constants)))) != NULL) {
 			if (UNEXPECTED(zend_optimizer_is_disabled_func(info->name, info->name_len))) {
 				ret = MAY_BE_NULL;
 			} else if (info->info_func) {
@@ -1,34 +0,0 @@
--TEST--
-$v = !$v/(bool)$v checks for undefined variables
--INI--
-opcache.enable=1
-opcache.enable_cli=1
-opcache.file_cache_only=0
--SKIPIF--
-<?php require_once('skipif.inc'); ?>
--FILE--
-<?php
-function undef_negation() {
-    echo "In undef_negation\n";
-    $v = !$v;
-    var_export($v);
-    echo "\n";
-}
-function undef_bool_cast() {
-    echo "In undef_bool_cast\n";
-    $v = (bool)$v;
-    var_export($v);
-    echo "\n";
-}
-undef_negation();
-undef_bool_cast();
-?>
--EXPECTF--
-In undef_negation
-
-Notice: Undefined variable: v in %s on line 4
-true
-In undef_bool_cast
-
-Notice: Undefined variable: v in %s on line 10
-false
@@ -1,14 +0,0 @@
--TEST--
-Internal static methods should not be confused with global functions
--SKIPIF--
-<?php
-if (!extension_loaded('zend-test')) die('skip requires zend-test');
-?>
--FILE--
-<?php
-
-var_dump(is_bool(_ZendTestClass::is_object()));
-
-?>
--EXPECT--
-bool(false)
@@ -735,11 +735,11 @@ zend_op_array* zend_accel_load_script(zend_persistent_script *persistent_script,
 #define ADLER32_DO8(buf, i)     ADLER32_DO4(buf, i); ADLER32_DO4(buf, i + 4);
 #define ADLER32_DO16(buf)       ADLER32_DO8(buf, 0); ADLER32_DO8(buf, 8);

-unsigned int zend_adler32(unsigned int checksum, unsigned char *buf, uint32_t len)
+unsigned int zend_adler32(unsigned int checksum, signed char *buf, uint32_t len)
 {
 	unsigned int s1 = checksum & 0xffff;
 	unsigned int s2 = (checksum >> 16) & 0xffff;
-	unsigned char *end;
+	signed char *end;

 	while (len >= ADLER32_NMAX) {
 		len -= ADLER32_NMAX;
@@ -777,15 +777,15 @@ unsigned int zend_adler32(unsigned int checksum, unsigned char *buf, uint32_t le

 unsigned int zend_accel_script_checksum(zend_persistent_script *persistent_script)
 {
-	unsigned char *mem = (unsigned char*)persistent_script->mem;
+	signed char *mem = (signed char*)persistent_script->mem;
 	size_t size = persistent_script->size;
 	size_t persistent_script_check_block_size = ((char *)&(persistent_script->dynamic_members)) - (char *)persistent_script;
 	unsigned int checksum = ADLER32_INIT;

-	if (mem < (unsigned char*)persistent_script) {
-		checksum = zend_adler32(checksum, mem, (unsigned char*)persistent_script - mem);
-		size -= (unsigned char*)persistent_script - mem;
-		mem  += (unsigned char*)persistent_script - mem;
+	if (mem < (signed char*)persistent_script) {
+		checksum = zend_adler32(checksum, mem, (signed char*)persistent_script - mem);
+		size -= (signed char*)persistent_script - mem;
+		mem  += (signed char*)persistent_script - mem;
 	}

 	zend_adler32(checksum, mem, persistent_script_check_block_size);
@@ -37,7 +37,7 @@ zend_op_array* zend_accel_load_script(zend_persistent_script *persistent_script,

 #define ADLER32_INIT 1     /* initial Adler-32 value */

-unsigned int zend_adler32(unsigned int checksum, unsigned char *buf, uint32_t len);
+unsigned int zend_adler32(unsigned int checksum, signed char *buf, uint32_t len);

 unsigned int zend_accel_script_checksum(zend_persistent_script *persistent_script);

@@ -868,7 +868,7 @@ int zend_file_cache_script_store(zend_persistent_script *script, int in_shm)
 	zend_shared_alloc_destroy_xlat_table();

 	info.checksum = zend_adler32(ADLER32_INIT, buf, script->size);
-	info.checksum = zend_adler32(info.checksum, (unsigned char*)ZSTR_VAL((zend_string*)ZCG(mem)), info.str_size);
+	info.checksum = zend_adler32(info.checksum, (signed char*)ZSTR_VAL((zend_string*)ZCG(mem)), info.str_size);

 #ifdef HAVE_SYS_UIO_H
 	vec[0].iov_base = &info;
@@ -1371,7 +1371,6 @@ zend_persistent_script *zend_file_cache_script_load(zend_file_handle *file_handl
 	zend_accel_hash_entry *bucket;
 	void *mem, *checkpoint, *buf;
 	int cache_it = 1;
-	unsigned int actual_checksum;
 	int ok;

 	if (!full_path) {
@@ -1459,8 +1458,8 @@ zend_persistent_script *zend_file_cache_script_load(zend_file_handle *file_handl

 	/* verify checksum */
 	if (ZCG(accel_directives).file_cache_consistency_checks &&
-	    (actual_checksum = zend_adler32(ADLER32_INIT, mem, info.mem_size + info.str_size)) != info.checksum) {
-		zend_accel_error(ACCEL_LOG_WARNING, "corrupted file '%s' excepted checksum: 0x%08x actual checksum: 0x%08x\n", filename, info.checksum, actual_checksum);
+	    zend_adler32(ADLER32_INIT, mem, info.mem_size + info.str_size) != info.checksum) {
+		zend_accel_error(ACCEL_LOG_WARNING, "corrupted file '%s'\n", filename);
 		unlink(filename);
 		zend_arena_release(&CG(arena), checkpoint);
 		efree(filename);
@@ -1546,8 +1545,6 @@ use_process_mem:
 		zend_accel_hash_update(&ZCSG(hash), ZSTR_VAL(script->script.filename), ZSTR_LEN(script->script.filename), 0, script);

 		zend_shared_alloc_unlock();
-		zend_accel_error(ACCEL_LOG_INFO, "File cached script loaded into memory '%s'", ZSTR_VAL(script->script.filename));
-
 		zend_arena_release(&CG(arena), checkpoint);
 	}
 	efree(filename);
@@ -1873,7 +1873,6 @@ static int php_openssl_enable_crypto(php_stream *stream,
 		do {
 			struct timeval cur_time, elapsed_time;

-			ERR_clear_error();
 			if (sslsock->is_client) {
 				n = SSL_connect(sslsock->ssl_handle);
 			} else {
@@ -2046,7 +2045,6 @@ static size_t php_openssl_sockop_io(int read, php_stream *stream, char *buf, siz
 			}

 			/* Now, do the IO operation. Don't block if we can't complete... */
-			ERR_clear_error();
 			if (read) {
 				nr_bytes = SSL_read(sslsock->ssl_handle, buf, (int)count);

@@ -322,7 +322,7 @@ static zend_always_inline int calculate_unit_length(pcre_cache_entry *pce, char

 /* {{{ pcre_get_compiled_regex_cache
 */
-PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache_ex(zend_string *regex, int locale_aware)
+PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(zend_string *regex)
 {
 	pcre				*re = NULL;
 	pcre_extra			*extra;
@@ -344,7 +344,7 @@ PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache_ex(zend_string *regex, in
 	zend_string 		*key;

 #if HAVE_SETLOCALE
-	if (locale_aware && BG(locale_string) &&
+	if (BG(locale_string) &&
 		(ZSTR_LEN(BG(locale_string)) != 1 && ZSTR_VAL(BG(locale_string))[0] != 'C')) {
 		key = zend_string_alloc(ZSTR_LEN(regex) + ZSTR_LEN(BG(locale_string)) + 1, 0);
 		memcpy(ZSTR_VAL(key), ZSTR_VAL(BG(locale_string)), ZSTR_LEN(BG(locale_string)) + 1);
@@ -636,14 +636,6 @@ PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache_ex(zend_string *regex, in
 }
 /* }}} */

-/* {{{ pcre_get_compiled_regex_cache
- */
-PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(zend_string *regex)
-{
-	return pcre_get_compiled_regex_cache_ex(regex, 1);
-}
-/* }}} */
-
 /* {{{ pcre_get_compiled_regex
 */
 PHPAPI pcre* pcre_get_compiled_regex(zend_string *regex, pcre_extra **extra, int *preg_options)
@@ -57,7 +57,6 @@ typedef struct {
 } pcre_cache_entry;

 PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(zend_string *regex);
-PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache_ex(zend_string *regex, int locale_aware);

 PHPAPI void  php_pcre_match_impl(  pcre_cache_entry *pce, char *subject, int subject_len, zval *return_value,
 	zval *subpats, int global, int use_flags, zend_long flags, zend_long start_offset);
@@ -1386,7 +1386,6 @@ int phar_create_or_parse_filename(char *fname, int fname_len, char *alias, int a
 	mydata = ecalloc(1, sizeof(phar_archive_data));
 	mydata->fname = expand_filepath(fname, NULL);
 	if (mydata->fname == NULL) {
-		efree(mydata);
 		return FAILURE;
 	}
 	fname_len = strlen(mydata->fname);
@@ -1439,7 +1439,6 @@ static int phar_build(zend_object_iterator *iter, void *puser) /* {{{ */
 	char *str_key;
 	zend_class_entry *ce = p_obj->c;
 	phar_archive_object *phar_obj = p_obj->p;
-	php_stream_statbuf ssb;

 	value = iter->funcs->get_current_data(iter);

@@ -1719,16 +1718,6 @@ after_open_fp:
 		php_stream_copy_to_stream_ex(fp, p_obj->fp, PHP_STREAM_COPY_ALL, &contents_len);
 		data->internal_file->uncompressed_filesize = data->internal_file->compressed_filesize =
 			php_stream_tell(p_obj->fp) - data->internal_file->offset;
-		if (php_stream_stat(fp, &ssb) != -1) {
-			data->internal_file->flags = ssb.sb.st_mode & PHAR_ENT_PERM_MASK ;
-		} else {
-#ifndef _WIN32
-			mode_t mask;
-			mask = umask(0);
-			umask(mask);
-			data->internal_file->flags &= ~mask;
-#endif
-		}
 	}

 	if (close_fp) {
@@ -5,11 +5,11 @@ Bug #77396 Relative filename exceeding maximum path length causes null pointer d
 --FILE--
 <?php
 $path = '../' . str_repeat("x", PHP_MAXPATHLEN) . '.tar';
-try {
-    $phar = new PharData($path);
-} catch (UnexpectedValueException $e) {
-    echo $e->getMessage(), "\n";
-}
+$phar = new PharData($path);
 ?>
--EXPECT--
-Phar creation or opening failed
+--EXPECTF--
+Fatal error: Uncaught UnexpectedValueException: Phar creation or opening failed in %s%ebug77396.php:%d
+Stack trace:
+#0 %s%ebug77396.php(%d): PharData->__construct(%s)
+#1 {main}
+  thrown in %s%ebug77396.php on line %d
@@ -1,52 +0,0 @@
--TEST--
-Phar: Bug #79082: Files added to tar with Phar::buildFromIterator have all-access permissions
--SKIPIF--
-<?php 
-if (!extension_loaded("phar")) die("skip"); 
-if (defined("PHP_WINDOWS_VERSION_MAJOR")) die("skip not for Windows")
-?>
--FILE--
-<?php
-umask(022);
-var_dump(decoct(umask()));
-chmod(__DIR__ . '/test79082/test79082-testfile', 0644);
-chmod(__DIR__ . '/test79082/test79082-testfile2', 0400);
-
-foreach([Phar::TAR => 'tar', Phar::ZIP => 'zip'] as $mode => $ext) {
-	clearstatcache();
-	$phar = new PharData(__DIR__ . '/test79082.' . $ext, null, null, $mode);
-	$phar->buildFromIterator(new \RecursiveDirectoryIterator(__DIR__ . '/test79082', \FilesystemIterator::SKIP_DOTS), __DIR__ . '/test79082');
-	$phar->extractTo(__DIR__);
-	var_dump(decoct(stat(__DIR__ . '/test79082-testfile')['mode']));
-	var_dump(decoct(stat(__DIR__ . '/test79082-testfile2')['mode']));
-	unlink(__DIR__ . '/test79082-testfile');
-	unlink(__DIR__ . '/test79082-testfile2');
-}
-foreach([Phar::TAR => 'tar', Phar::ZIP => 'zip'] as $mode => $ext) {
-	clearstatcache();
-	$phar = new PharData(__DIR__ . '/test79082-d.' . $ext, null, null, $mode);
-	$phar->buildFromDirectory(__DIR__ . '/test79082');
-	$phar->extractTo(__DIR__);
-	var_dump(decoct(stat(__DIR__ . '/test79082-testfile')['mode']));
-	var_dump(decoct(stat(__DIR__ . '/test79082-testfile2')['mode']));
-	unlink(__DIR__ . '/test79082-testfile');
-	unlink(__DIR__ . '/test79082-testfile2');
-}
-?>
--CLEAN--
-<?
-unlink(__DIR__ . '/test79082.tar');
-unlink(__DIR__ . '/test79082.zip');
-unlink(__DIR__ . '/test79082-d.tar');
-unlink(__DIR__ . '/test79082-d.zip');
-?>
--EXPECT--
-string(2) "22"
-string(6) "100644"
-string(6) "100400"
-string(6) "100644"
-string(6) "100400"
-string(6) "100644"
-string(6) "100400"
-string(6) "100644"
-string(6) "100400"
@@ -1 +0,0 @@
-test
@@ -1 +0,0 @@
-test
@@ -5140,7 +5140,7 @@ ZEND_METHOD(reflection_class, implementsInterface)

 	if (!(interface_ce->ce_flags & ZEND_ACC_INTERFACE)) {
 		zend_throw_exception_ex(reflection_exception_ptr, 0,
-				"%s is not an interface", ZSTR_VAL(interface_ce->name));
+				"Interface %s is a Class", ZSTR_VAL(interface_ce->name));
 		return;
 	}
 	RETURN_BOOL(instanceof_function(ce, interface_ce));
@@ -67,14 +67,14 @@ try {
 ?>
 --EXPECTF--
 Does A implement A? 
-   - Using object argument: A is not an interface
-   - Using string argument: A is not an interface
+   - Using object argument: Interface A is a Class
+   - Using string argument: Interface A is a Class
 Does A implement B? 
-   - Using object argument: B is not an interface
-   - Using string argument: B is not an interface
+   - Using object argument: Interface B is a Class
+   - Using string argument: Interface B is a Class
 Does A implement C? 
-   - Using object argument: C is not an interface
-   - Using string argument: C is not an interface
+   - Using object argument: Interface C is a Class
+   - Using string argument: Interface C is a Class
 Does A implement I1? 
   - Using object argument: bool(true)
   - Using string argument: bool(true)
@@ -82,14 +82,14 @@ Does A implement I2?
   - Using object argument: bool(false)
   - Using string argument: bool(false)
 Does B implement A? 
-   - Using object argument: A is not an interface
-   - Using string argument: A is not an interface
+   - Using object argument: Interface A is a Class
+   - Using string argument: Interface A is a Class
 Does B implement B? 
-   - Using object argument: B is not an interface
-   - Using string argument: B is not an interface
+   - Using object argument: Interface B is a Class
+   - Using string argument: Interface B is a Class
 Does B implement C? 
-   - Using object argument: C is not an interface
-   - Using string argument: C is not an interface
+   - Using object argument: Interface C is a Class
+   - Using string argument: Interface C is a Class
 Does B implement I1? 
   - Using object argument: bool(true)
   - Using string argument: bool(true)
@@ -97,14 +97,14 @@ Does B implement I2?
   - Using object argument: bool(false)
   - Using string argument: bool(false)
 Does C implement A? 
-   - Using object argument: A is not an interface
-   - Using string argument: A is not an interface
+   - Using object argument: Interface A is a Class
+   - Using string argument: Interface A is a Class
 Does C implement B? 
-   - Using object argument: B is not an interface
-   - Using string argument: B is not an interface
+   - Using object argument: Interface B is a Class
+   - Using string argument: Interface B is a Class
 Does C implement C? 
-   - Using object argument: C is not an interface
-   - Using string argument: C is not an interface
+   - Using object argument: Interface C is a Class
+   - Using string argument: Interface C is a Class
 Does C implement I1? 
   - Using object argument: bool(true)
   - Using string argument: bool(true)
@@ -112,14 +112,14 @@ Does C implement I2?
   - Using object argument: bool(true)
   - Using string argument: bool(true)
 Does I1 implement A? 
-   - Using object argument: A is not an interface
-   - Using string argument: A is not an interface
+   - Using object argument: Interface A is a Class
+   - Using string argument: Interface A is a Class
 Does I1 implement B? 
-   - Using object argument: B is not an interface
-   - Using string argument: B is not an interface
+   - Using object argument: Interface B is a Class
+   - Using string argument: Interface B is a Class
 Does I1 implement C? 
-   - Using object argument: C is not an interface
-   - Using string argument: C is not an interface
+   - Using object argument: Interface C is a Class
+   - Using string argument: Interface C is a Class
 Does I1 implement I1? 
   - Using object argument: bool(true)
   - Using string argument: bool(true)
@@ -127,14 +127,14 @@ Does I1 implement I2?
   - Using object argument: bool(false)
   - Using string argument: bool(false)
 Does I2 implement A? 
-   - Using object argument: A is not an interface
-   - Using string argument: A is not an interface
+   - Using object argument: Interface A is a Class
+   - Using string argument: Interface A is a Class
 Does I2 implement B? 
-   - Using object argument: B is not an interface
-   - Using string argument: B is not an interface
+   - Using object argument: Interface B is a Class
+   - Using string argument: Interface B is a Class
 Does I2 implement C? 
-   - Using object argument: C is not an interface
-   - Using string argument: C is not an interface
+   - Using object argument: Interface C is a Class
+   - Using string argument: Interface C is a Class
 Does I2 implement I1? 
   - Using object argument: bool(true)
   - Using string argument: bool(true)
@@ -1,14 +0,0 @@
--TEST--
-Bug #78697: ReflectionClass::implementsInterface - inaccurate error message with traits
--FILE--
-<?php
-trait T {}
-
-try {
-    (new ReflectionClass(new stdClass))->implementsInterface(T::class);
-} catch (ReflectionException $e) {
-    echo $e->getMessage();
-}
-?>
--EXPECT--
-T is not an interface
@@ -2198,7 +2198,6 @@ static PHP_FUNCTION(session_create_id)
 				/* Detect collision and retry */
 				if (PS(mod)->s_validate_sid(&PS(mod_data), new_id) == FAILURE) {
 					zend_string_release(new_id);
-					new_id = NULL;
 					continue;
 				}
 				break;
@@ -3219,12 +3218,10 @@ static int php_session_rfc1867_callback(unsigned int event, void *event_data, vo
 				if (PS(rfc1867_cleanup)) {
 					php_session_rfc1867_cleanup(progress);
 				} else {
-					if (!Z_ISUNDEF(progress->data)) {
-						SEPARATE_ARRAY(&progress->data);
-						add_assoc_bool_ex(&progress->data, "done", sizeof("done") - 1, 1);
-						Z_LVAL_P(progress->post_bytes_processed) = data->post_bytes_processed;
-						php_session_rfc1867_update(progress, 1);
-					}
+					SEPARATE_ARRAY(&progress->data);
+					add_assoc_bool_ex(&progress->data, "done", sizeof("done") - 1, 1);
+					Z_LVAL_P(progress->post_bytes_processed) = data->post_bytes_processed;
+					php_session_rfc1867_update(progress, 1);
 				}
 				php_rshutdown_session_globals();
 			}
@@ -1,67 +0,0 @@
--TEST--
-Bug #79091 (heap use-after-free in session_create_id())
--SKIPIF--
-<?php
-if (!extension_loaded('session')) die('skip session extension not available');
-?>
--FILE--
-<?php
-class MySessionHandler implements SessionHandlerInterface, SessionIdInterface, SessionUpdateTimestampHandlerInterface
-{
-    public function close()
-    {
-        return true;
-    }
-
-    public function destroy($session_id)
-    {
-        return true;
-    }
-
-    public function gc($maxlifetime)
-    {
-        return true;
-    }
-
-    public function open($save_path, $session_name)
-    {
-        return true;
-    }
-
-    public function read($session_id)
-    {
-        return '';
-    }
-
-    public function write($session_id, $session_data)
-    {
-        return true;
-    }
-
-    public function create_sid()
-    {
-        return uniqid();
-    }
-
-    public function updateTimestamp($key, $val)
-    {
-        return true;
-    }
-
-    public function validateId($key)
-    {
-        return false;
-    }
-}
-
-ob_start();
-var_dump(session_set_save_handler(new MySessionHandler()));
-var_dump(session_start());
-ob_flush();
-session_create_id();
-?>
--EXPECTF--
-bool(true)
-bool(true)
-
-Warning: session_create_id(): Failed to create new ID in %s on line %d
@@ -1,45 +0,0 @@
--TEST--
-Null Pointer Dereference in PHP Session Upload Progress
--INI--
-error_reporting=0
-file_uploads=1
-upload_max_filesize=1024
-session.save_path=
-session.name=PHPSESSID
-session.serialize_handler=php
-session.use_strict_mode=0
-session.use_cookies=1
-session.use_only_cookies=0
-session.upload_progress.enabled=1
-session.upload_progress.cleanup=0
-session.upload_progress.prefix=upload_progress_
-session.upload_progress.name=PHP_SESSION_UPLOAD_PROGRESS
-session.upload_progress.freq=1%
-session.upload_progress.min_freq=0.000000001
--COOKIE--
-PHPSESSID=session-upload
--POST_RAW--
-Content-Type: multipart/form-data; boundary=---------------------------20896060251896012921717172737
-----------------------------20896060251896012921717172737
-Content-Disposition: form-data; name="PHPSESSID"
-
-session-upload
-----------------------------20896060251896012921717172737
-Content-Disposition: form-data; name="PHP_SESSION_UPLOAD_PROGRESS"
-
-ryat
-----------------------------20896060251896012921717172737
-Content-Disposition: form-data; file="file"; ryat="filename"
-
-1
-----------------------------20896060251896012921717172737--
--FILE--
-<?php
-
-session_start();
-var_dump($_SESSION);
-session_destroy();
-
--EXPECTF--
-array(0) {
-}
@@ -3,7 +3,6 @@ Bug #76348 (WSDL_CACHE_MEMORY causes Segmentation fault)
 --SKIPIF--
 <?php
 if (!extension_loaded('soap')) die('skip soap extension not available');
-if (getenv("SKIP_ONLINE_TESTS")) die("skip online test");
 ?>
 --FILE--
 <?php
@@ -652,7 +652,6 @@ retry:
 		goto retry;
 	}
 	if (retval != NO_ERROR) {
-		efree(addr_table);
 		php_error_docref(NULL, E_WARNING,
 			"GetIpAddrTable failed with error %lu", retval);
 		return FAILURE;
@@ -661,11 +660,9 @@ retry:
 		MIB_IPADDRROW r = addr_table->table[i];
 		if (r.dwIndex == if_index) {
 			out_addr->s_addr = r.dwAddr;
-			efree(addr_table);
 			return SUCCESS;
 		}
 	}
-	efree(addr_table);
 	php_error_docref(NULL, E_WARNING,
 		"No interface with index %u was found", if_index);
 	return FAILURE;
@@ -695,7 +692,6 @@ retry:
 		goto retry;
 	}
 	if (retval != NO_ERROR) {
-		efree(addr_table);
 		php_error_docref(NULL, E_WARNING,
 			"GetIpAddrTable failed with error %lu", retval);
 		return FAILURE;
@@ -704,11 +700,9 @@ retry:
 		MIB_IPADDRROW r = addr_table->table[i];
 		if (r.dwAddr == addr->s_addr) {
 			*if_index = r.dwIndex;
-			efree(addr_table);
 			return SUCCESS;
 		}
 	}
-	efree(addr_table);

 	{
 		char addr_str[17] = {0};
@@ -708,10 +708,10 @@ void spl_filesystem_object_construct(INTERNAL_FUNCTION_PARAMETERS, zend_long cto

 	if (SPL_HAS_FLAG(ctor_flags, DIT_CTOR_FLAGS)) {
 		flags = SPL_FILE_DIR_KEY_AS_PATHNAME|SPL_FILE_DIR_CURRENT_AS_FILEINFO;
-		parsed = zend_parse_parameters(ZEND_NUM_ARGS(), "p|l", &path, &len, &flags);
+		parsed = zend_parse_parameters(ZEND_NUM_ARGS(), "s|l", &path, &len, &flags);
 	} else {
 		flags = SPL_FILE_DIR_KEY_AS_PATHNAME|SPL_FILE_DIR_CURRENT_AS_SELF;
-		parsed = zend_parse_parameters(ZEND_NUM_ARGS(), "p", &path, &len);
+		parsed = zend_parse_parameters(ZEND_NUM_ARGS(), "s", &path, &len);
 	}
 	if (SPL_HAS_FLAG(ctor_flags, SPL_FILE_DIR_SKIPDOTS)) {
 		flags |= SPL_FILE_DIR_SKIPDOTS;
@@ -5,7 +5,7 @@ Bug #54291 (Crash iterating DirectoryIterator for dir name starting with \0)
 $dir = new DirectoryIterator("\x00/abc");
 $dir->isFile();
 --EXPECTF--
-Fatal error: Uncaught UnexpectedValueException: DirectoryIterator::__construct() expects parameter 1 to be a valid path, string given in %s:%d
+Fatal error: Uncaught UnexpectedValueException: Failed to open directory "" in %s:%d
 Stack trace:
 #0 %s(%d): DirectoryIterator->__construct('\x00/abc')
 #1 {main}
@@ -1,31 +0,0 @@
--TEST--
-Bug #78863 (DirectoryIterator class silently truncates after a null byte)
--FILE--
-<?php
-$dir = __DIR__ . '/bug78863';
-mkdir($dir);
-touch("$dir/bad");
-mkdir("$dir/sub");
-touch("$dir/sub/good");
-
-$it = new DirectoryIterator(__DIR__ . "/bug78863\0/sub");
-foreach ($it as $fileinfo) {
-    if (!$fileinfo->isDot()) {
-        var_dump($fileinfo->getFilename());
-    }
-}
-?>
--EXPECTF--
-Fatal error: Uncaught UnexpectedValueException: DirectoryIterator::__construct() expects parameter 1 to be a valid path, string given in %s:%d
-Stack trace:
-#0 %s(%d): DirectoryIterator->__construct('%s')
-#1 {main}
-  thrown in %s on line %d
--CLEAN--
-<?php
-$dir = __DIR__ . '/bug78863';
-unlink("$dir/sub/good");
-rmdir("$dir/sub");
-unlink("$dir/bad");
-rmdir($dir);
-?>
@@ -1578,7 +1578,7 @@ static inline void php_search_array(INTERNAL_FUNCTION_PARAMETERS, int behavior)
 	ZEND_PARSE_PARAMETERS_END();

 	if (strict) {
-		ZEND_HASH_FOREACH_KEY_VAL_IND(Z_ARRVAL_P(array), num_idx, str_idx, entry) {
+		ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL_P(array), num_idx, str_idx, entry) {
 			ZVAL_DEREF(entry);
 			if (fast_is_identical_function(value, entry)) {
 				if (behavior == 0) {
@@ -1595,7 +1595,7 @@ static inline void php_search_array(INTERNAL_FUNCTION_PARAMETERS, int behavior)
 		} ZEND_HASH_FOREACH_END();
 	} else {
 		if (Z_TYPE_P(value) == IS_LONG) {
-			ZEND_HASH_FOREACH_KEY_VAL_IND(Z_ARRVAL_P(array), num_idx, str_idx, entry) {
+			ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL_P(array), num_idx, str_idx, entry) {
 				if (fast_equal_check_long(value, entry)) {
 					if (behavior == 0) {
 						RETURN_TRUE;
@@ -1610,7 +1610,7 @@ static inline void php_search_array(INTERNAL_FUNCTION_PARAMETERS, int behavior)
 				}
 			} ZEND_HASH_FOREACH_END();
 		} else if (Z_TYPE_P(value) == IS_STRING) {
-			ZEND_HASH_FOREACH_KEY_VAL_IND(Z_ARRVAL_P(array), num_idx, str_idx, entry) {
+			ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL_P(array), num_idx, str_idx, entry) {
 				if (fast_equal_check_string(value, entry)) {
 					if (behavior == 0) {
 						RETURN_TRUE;
@@ -1625,7 +1625,7 @@ static inline void php_search_array(INTERNAL_FUNCTION_PARAMETERS, int behavior)
 				}
 			} ZEND_HASH_FOREACH_END();
 		} else {
-			ZEND_HASH_FOREACH_KEY_VAL_IND(Z_ARRVAL_P(array), num_idx, str_idx, entry) {
+			ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL_P(array), num_idx, str_idx, entry) {
 				if (fast_equal_check_function(value, entry)) {
 					if (behavior == 0) {
 						RETURN_TRUE;
@@ -531,15 +531,6 @@ PHP_FUNCTION(shell_exec)
 		Z_PARAM_STRING(command, command_len)
 	ZEND_PARSE_PARAMETERS_END();

-	if (!command_len) {
-		php_error_docref(NULL, E_WARNING, "Cannot execute a blank command");
-		RETURN_FALSE;
-	}
-	if (strlen(command) != command_len) {
-		php_error_docref(NULL, E_WARNING, "NULL byte detected. Possible attack");
-		RETURN_FALSE;
-	}
-
 #ifdef PHP_WIN32
 	if ((in=VCWD_POPEN(command, "rt"))==NULL) {
 #else
@@ -211,7 +211,7 @@ PHP_FUNCTION(link)

 	/*First argument to link function is the target and hence should go to frompath
 	  Second argument to link function is the link itself and hence should go to topath */
-	if (zend_parse_parameters(ZEND_NUM_ARGS(), "pp", &frompath, &frompath_len, &topath, &topath_len) == FAILURE) {
+	if (zend_parse_parameters(ZEND_NUM_ARGS(), "ss", &frompath, &frompath_len, &topath, &topath_len) == FAILURE) {
 		return;
 	}

@@ -343,13 +343,10 @@ PHP_FUNCTION(pack)
 				if (arg < 0) {
 					arg = num_args - currentarg;
 				}
-				if (currentarg > INT_MAX - arg) {
-					goto too_few_args;
-				}
+
 				currentarg += arg;

 				if (currentarg > num_args) {
-too_few_args:
 					efree(formatcodes);
 					efree(formatargs);
 					php_error_docref(NULL, E_WARNING, "Type %c: too few arguments", code);
@@ -4663,7 +4663,7 @@ int php_tag_find(char *tag, size_t len, const char *set) {
 					if (state == 0) {
 						state=1;
 					}
-					if (c != '/' || (*(t-1) != '<' && *(t+1) != '>')) {
+					if (c != '/') {
 						*(n++) = c;
 					}
 				} else {
@@ -4816,7 +4816,7 @@ PHPAPI size_t php_strip_tags_ex(char *rbuf, size_t len, uint8_t *stateptr, const
 				switch (state) {
 					case 1: /* HTML/XML */
 						lc = '>';
-						if (is_xml && p >= buf + 1 && *(p-1) == '-') {
+						if (is_xml && *(p -1) == '-') {
 							break;
 						}
 						in_q = state = is_xml = 0;
@@ -4837,7 +4837,7 @@ PHPAPI size_t php_strip_tags_ex(char *rbuf, size_t len, uint8_t *stateptr, const
 						break;

 					case 2: /* PHP */
-						if (!br && lc != '\"' && p >= buf + 1 && *(p-1) == '?') {
+						if (!br && lc != '\"' && *(p-1) == '?') {
 							in_q = state = 0;
 							tp = tbuf;
 						}
@@ -4866,7 +4866,7 @@ PHPAPI size_t php_strip_tags_ex(char *rbuf, size_t len, uint8_t *stateptr, const
 				if (state == 4) {
 					/* Inside <!-- comment --> */
 					break;
-				} else if (state == 2 && p >= buf + 1 && *(p-1) != '\\') {
+				} else if (state == 2 && *(p-1) != '\\') {
 					if (lc == c) {
 						lc = '\0';
 					} else if (lc != '\\') {
@@ -4893,7 +4893,7 @@ PHPAPI size_t php_strip_tags_ex(char *rbuf, size_t len, uint8_t *stateptr, const

 			case '!':
 				/* JavaScript & Other HTML scripting languages */
-				if (state == 1 && p >= buf + 1 && *(p-1) == '<') {
+				if (state == 1 && *(p-1) == '<') {
 					state = 3;
 					lc = c;
 				} else {
@@ -4920,7 +4920,7 @@ PHPAPI size_t php_strip_tags_ex(char *rbuf, size_t len, uint8_t *stateptr, const

 			case '?':

-				if (state == 1 && p >= buf + 1 && *(p-1) == '<') {
+				if (state == 1 && *(p-1) == '<') {
 					br=0;
 					state=2;
 					break;
@@ -1,15 +0,0 @@
--TEST--
-Bug #78759: array_search in $GLOBALS
--FILE--
-<?php
-
-$a = 22;
-var_dump($GLOBALS["a"]);
-var_dump(array_search(22, $GLOBALS));
-var_dump(array_search(22, $GLOBALS, true));
-
-?>
--EXPECT--
-int(22)
-string(1) "a"
-string(1) "a"
@@ -1,32 +0,0 @@
--TEST--
-Bug #79099 (OOB read in php_strip_tags_ex)
--FILE--
-<?php
-$stream = fopen('php://memory', 'w+');
-fputs($stream, "<?\n\"\n");
-rewind($stream);
-var_dump(fgetss($stream));
-var_dump(fgetss($stream));
-fclose($stream);
-
-$stream = fopen('php://memory', 'w+');
-fputs($stream, "<\0\n!\n");
-rewind($stream);
-var_dump(fgetss($stream));
-var_dump(fgetss($stream));
-fclose($stream);
-
-$stream = fopen('php://memory', 'w+');
-fputs($stream, "<\0\n?\n");
-rewind($stream);
-var_dump(fgetss($stream));
-var_dump(fgetss($stream));
-fclose($stream);
-?>
--EXPECT--
-string(0) ""
-string(0) ""
-string(0) ""
-string(0) ""
-string(0) ""
-string(0) ""
@@ -1,17 +0,0 @@
--TEST--
-Bug #78862 (link() silently truncates after a null byte on Windows)
--FILE--
-<?php
-file_put_contents(__DIR__ . '/bug78862.target', 'foo');
-var_dump(link(__DIR__ . "/bug78862.target\0more", __DIR__ . "/bug78862.link\0more"));
-var_dump(file_exists(__DIR__ . '/bug78862.link'));
-?>
--EXPECTF--
-Warning: link() expects parameter 1 to be a valid path, string given in %s on line %d
-NULL
-bool(false)
--CLEAN--
-<?php
-unlink(__DIR__ . '/bug78862.target');
-unlink(__DIR__ . '/bug78862.link');
-?>
@@ -1,21 +0,0 @@
--TEST--
-Bug #79468	SIGSEGV when closing stream handle with a stream filter appended
--SKIPIF--
-<?php
-$filters = stream_get_filters();
-if(! in_array( "string.rot13", $filters )) die( "skip rot13 filter not available." );
-?>
--FILE--
-<?php
-$fp = fopen('php://temp', 'rb');
-$rot13_filter = stream_filter_append($fp, "string.rot13", STREAM_FILTER_WRITE);
-fwrite($fp, "This is ");
-fclose($fp);
-try {
-    stream_filter_remove($rot13_filter);
-} catch (\Throwable $e) {
-    var_dump($e->getMessage());
-}
-?>
--EXPECTF--
-Warning: stream_filter_remove(): Invalid resource given, not a stream filter in %s on line %d
@@ -1,8 +0,0 @@
--TEST--
-Bug #78814 (strip_tags allows / in tag name => whitelist bypass)
--FILE--
-<?php
-echo strip_tags("<s/trong>b</strong>", "<strong>");
-?>
--EXPECT--
-b</strong>
@@ -1,9 +0,0 @@
--TEST--
-Bug #78833 (Integer overflow in pack causes out-of-bound access)
--FILE--
-<?php
-var_dump(pack("E2E2147483647H*", 0x0, 0x0, 0x0));
-?>
--EXPECTF--
-Warning: pack(): Type E: too few arguments in %s on line %d
-bool(false)
@@ -559,7 +559,7 @@ PHPAPI size_t php_url_decode(char *str, size_t len)
 #ifndef CHARSET_EBCDIC
 			*dest = (char) php_htoi(data + 1);
 #else
-			*dest = os_toebcdic[(unsigned char) php_htoi(data + 1)];
+			*dest = os_toebcdic[(char) php_htoi(data + 1)];
 #endif
 			data += 2;
 			len -= 2;
@@ -651,7 +651,7 @@ PHPAPI size_t php_raw_url_decode(char *str, size_t len)
 #ifndef CHARSET_EBCDIC
 			*dest = (char) php_htoi(data + 1);
 #else
-			*dest = os_toebcdic[(unsigned char) php_htoi(data + 1)];
+			*dest = os_toebcdic[(char) php_htoi(data + 1)];
 #endif
 			data += 2;
 			len -= 2;
@@ -680,7 +680,7 @@ PHP_FUNCTION(get_headers)
 	php_stream_context *context;

 	ZEND_PARSE_PARAMETERS_START(1, 3)
-		Z_PARAM_PATH(url, url_len)
+		Z_PARAM_STRING(url, url_len)
 		Z_PARAM_OPTIONAL
 		Z_PARAM_LONG(format)
 		Z_PARAM_RESOURCE_EX(zcontext, 1, 0)
@@ -149,20 +149,17 @@ static zend_function *zend_test_class_method_get(zend_object **object, zend_stri
 /* }}} */

 static zend_function *zend_test_class_static_method_get(zend_class_entry *ce, zend_string *name) /* {{{ */ {
-	if (zend_string_equals_literal_ci(name, "test")) {
-		zend_internal_function *fptr = emalloc(sizeof(zend_internal_function));
-		fptr->type = ZEND_OVERLOADED_FUNCTION;
-		fptr->num_args = 1;
-		fptr->arg_info = NULL;
-		fptr->scope = ce;
-		fptr->fn_flags = ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_STATIC;
-		fptr->function_name = name;
-		fptr->handler = ZEND_FN(zend_test_func);
-		zend_set_function_arg_flags((zend_function*)fptr);
+	zend_internal_function *fptr = emalloc(sizeof(zend_internal_function));
+	fptr->type = ZEND_OVERLOADED_FUNCTION;
+	fptr->num_args = 1;
+	fptr->arg_info = NULL;
+	fptr->scope = ce;
+	fptr->fn_flags = ZEND_ACC_CALL_VIA_HANDLER|ZEND_ACC_STATIC;
+	fptr->function_name = name;
+	fptr->handler = ZEND_FN(zend_test_func);
+	zend_set_function_arg_flags((zend_function*)fptr);

-		return (zend_function*)fptr;
-	}
-	return zend_std_get_static_method(ce, name, NULL);
+	return (zend_function*)fptr;
 }
 /* }}} */

@@ -172,22 +169,11 @@ static int zend_test_class_call_method(zend_string *method, zend_object *object,
 }
 /* }}} */

-/* Internal function returns bool, we return int. */
-static ZEND_METHOD(_ZendTestClass, is_object) /* {{{ */ {
-	RETURN_LONG(42);
-}
-/* }}} */
-
 static ZEND_METHOD(_ZendTestTrait, testMethod) /* {{{ */ {
 	RETURN_TRUE;
 }
 /* }}} */

-static const zend_function_entry zend_test_class_methods[] = {
-	ZEND_ME(_ZendTestClass, is_object, NULL, ZEND_ACC_PUBLIC|ZEND_ACC_STATIC)
-	ZEND_FE_END
-};
-
 static zend_function_entry zend_test_trait_methods[] = {
    ZEND_ME(_ZendTestTrait, testMethod, NULL, ZEND_ACC_PUBLIC)
    ZEND_FE_END
@@ -200,7 +186,7 @@ PHP_MINIT_FUNCTION(zend_test)
 	INIT_CLASS_ENTRY(class_entry, "_ZendTestInterface", NULL);
 	zend_test_interface = zend_register_internal_interface(&class_entry);
 	zend_declare_class_constant_long(zend_test_interface, ZEND_STRL("DUMMY"), 0);
-	INIT_CLASS_ENTRY(class_entry, "_ZendTestClass", zend_test_class_methods);
+	INIT_CLASS_ENTRY(class_entry, "_ZendTestClass", NULL);
 	zend_test_class = zend_register_internal_class_ex(&class_entry, NULL);
 	zend_class_implements(zend_test_class, 1, zend_test_interface);
 	zend_test_class->create_object = zend_test_class_new;
@@ -1131,7 +1131,7 @@ static ZEND_COLD void php_error_cb(int type, const char *error_filename, const u
 				break;
 			case E_PARSE:
 				error_type_str = "Parse error";
-				syslog_type_int = LOG_ERR;
+				syslog_type_int = LOG_EMERG;
 				break;
 			case E_NOTICE:
 			case E_USER_NOTICE:
@@ -2,7 +2,7 @@
 /* edit configure.ac to change version number */
 #define PHP_MAJOR_VERSION 7
 #define PHP_MINOR_VERSION 2
-#define PHP_RELEASE_VERSION 31
+#define PHP_RELEASE_VERSION 24
 #define PHP_EXTRA_VERSION ""
-#define PHP_VERSION "7.2.31"
-#define PHP_VERSION_ID 70231
+#define PHP_VERSION "7.2.24"
+#define PHP_VERSION_ID 70224
@@ -616,7 +616,7 @@ static void *php_ap_memstr(char *haystack, int haystacklen, char *needle, int ne
 }

 /* read until a boundary condition */
-static size_t multipart_buffer_read(multipart_buffer *self, char *buf, size_t bytes, int *end)
+static int multipart_buffer_read(multipart_buffer *self, char *buf, size_t bytes, int *end)
 {
 	size_t len, max;
 	char *bound;
@@ -655,7 +655,7 @@ static size_t multipart_buffer_read(multipart_buffer *self, char *buf, size_t by
 		self->buf_begin += len;
 	}

-	return len;
+	return (int)len;
 }

 /*
@@ -665,7 +665,7 @@ static size_t multipart_buffer_read(multipart_buffer *self, char *buf, size_t by
 static char *multipart_buffer_read_body(multipart_buffer *self, size_t *len)
 {
 	char buf[FILLUNIT], *out=NULL;
-	size_t total_bytes=0, read_bytes=0;
+	int total_bytes=0, read_bytes=0;

 	while((read_bytes = multipart_buffer_read(self, buf, sizeof(buf), NULL))) {
 		out = erealloc(out, total_bytes + read_bytes + 1);
@@ -692,8 +692,7 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
 	char *boundary, *s = NULL, *boundary_end = NULL, *start_arr = NULL, *array_index = NULL;
 	char *lbuf = NULL, *abuf = NULL;
 	zend_string *temp_filename = NULL;
-	int boundary_len = 0, cancel_upload = 0, is_arr_upload = 0;
-	size_t array_len = 0;
+	int boundary_len = 0, cancel_upload = 0, is_arr_upload = 0, array_len = 0;
 	int64_t total_bytes = 0, max_file_size = 0;
 	int skip_upload = 0, anonindex = 0, is_anonymous;
 	HashTable *uploaded_files = NULL;
@@ -1127,7 +1126,7 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
 			is_arr_upload =	(start_arr = strchr(param,'[')) && (param[strlen(param)-1] == ']');

 			if (is_arr_upload) {
-				array_len = strlen(start_arr);
+				array_len = (int)strlen(start_arr);
 				if (array_index) {
 					efree(array_index);
 				}
@@ -477,15 +477,9 @@ fprintf(stderr, "stream_free: %s:%p[%s] preserve_handle=%d release_cast=%d remov

 	if (close_options & PHP_STREAM_FREE_RELEASE_STREAM) {
 		while (stream->readfilters.head) {
-			if (stream->readfilters.head->res != NULL) {
-				zend_list_close(stream->readfilters.head->res);
-			}
 			php_stream_filter_remove(stream->readfilters.head, 1);
 		}
 		while (stream->writefilters.head) {
-			if (stream->writefilters.head->res != NULL) {
-				zend_list_close(stream->writefilters.head->res);
-			}
 			php_stream_filter_remove(stream->writefilters.head, 1);
 		}

@@ -621,7 +621,7 @@ static int sapi_lsapi_activate()
 static sapi_module_struct lsapi_sapi_module =
 {
    "litespeed",
-    "LiteSpeed V7.6",
+    "LiteSpeed V7.5",

    php_lsapi_startup,              /* startup */
    php_module_shutdown_wrapper,    /* shutdown */
@@ -702,8 +702,6 @@ static void lsapi_sigsegv( int signal )
    _exit(1);
 }

-static int do_clean_shutdown = 1;
-
 static int clean_onexit = 1;


@@ -779,20 +777,18 @@ static int lsapi_module_main(int show_source)
        return -1;
    }

-    if (do_clean_shutdown) {
-        sigemptyset(&act.sa_mask);
-        act.sa_flags = SA_NODEFER;
-        act.sa_handler = lsapi_sigterm;
-        sa_rc = sigaction( SIGINT, &act, NULL);
-        sa_rc = sigaction( SIGQUIT, &act, NULL);
-        sa_rc = sigaction( SIGILL, &act, NULL);
-        sa_rc = sigaction( SIGABRT, &act, NULL);
-        sa_rc = sigaction( SIGBUS, &act, NULL);
-        sa_rc = sigaction( SIGSEGV, &act, NULL);
-        sa_rc = sigaction( SIGTERM, &act, NULL);
+    sigemptyset(&act.sa_mask);
+    act.sa_flags = SA_NODEFER;
+    act.sa_handler = lsapi_sigterm;
+    sa_rc = sigaction( SIGINT, &act, NULL);
+    sa_rc = sigaction( SIGQUIT, &act, NULL);
+    sa_rc = sigaction( SIGILL, &act, NULL);
+    sa_rc = sigaction( SIGABRT, &act, NULL);
+    sa_rc = sigaction( SIGBUS, &act, NULL);
+    sa_rc = sigaction( SIGSEGV, &act, NULL);
+    sa_rc = sigaction( SIGTERM, &act, NULL);

-        clean_onexit = 0;
-    }
+    clean_onexit = 0;

    if (show_source) {
        zend_syntax_highlighter_ini syntax_highlighter_ini;
@@ -1605,8 +1601,7 @@ int main( int argc, char * argv[] )
    int iRequestsProcessed = 0;
    int result;

-    if (do_clean_shutdown)
-        atexit(lsapi_atexit);
+    atexit(lsapi_atexit);

    while( ( result = LSAPI_Prefork_Accept_r( &g_req )) >= 0 ) {
 #if defined(linux) || defined(__linux) || defined(__linux__) || defined(__gnu_linux__)
@@ -1680,13 +1675,6 @@ static PHP_MINIT_FUNCTION(litespeed)
    if (p && 0 == strcasecmp(p, "on"))
        parse_user_ini = 1;

-    p = getenv("LSAPI_CLEAN_SHUTDOWN");
-    if (p) {
-        if (*p == '1' || 0 == strcasecmp(p, "on"))
-            do_clean_shutdown = 1;
-        else if (*p == '0' || 0 == strcasecmp(p, "off"))
-            do_clean_shutdown = 0;
-    }
    /*
     * mod_lsapi always sets this env var,
     * so we can detect mod_lsapi mode with its presense.
Author	SHA1	Message	Date
Remi Collet	d41dd0b518	Update versions for PHP 7.2.24	2019-10-22 08:15:44 +00:00
Remi Collet	46ac6549cc	Update NEWS for PHP 7.2.24	2019-10-22 08:15:44 +00:00
Remi Collet	92de579a00	add NEWS entry for CVE-2019-11043	2019-10-22 09:36:13 +02:00
Stanislav Malyshev	7a990257a0	Merge branch 'PHP-7.1' into PHP-7.2 * PHP-7.1: Fix bug #78599 (env_path_info underflow can lead to RCE) (CVE-2019-11043) bump versions after release set versions for release	2019-10-22 09:34:42 +02:00
Remi Collet	4104bc908e	Update NEWS for 7.2.24	2019-10-08 09:24:52 +00:00
Remi Collet	fe947d245b	Update CREDITS for PHP 7.2.24RC1	2019-10-08 09:12:10 +00:00
Remi Collet	75cc438262	Update NEWS for PHP 7.2.24RC1	2019-10-08 09:12:09 +00:00