Update version for PHP 7.3.3

(cherry picked from commit 040196972c)

.appveyor.yml

@@ -16,7 +16,7 @@ environment:
         PHP_BUILD_CACHE_BASE_DIR: c:\build-cache
         PHP_BUILD_OBJ_DIR: c:\obj
         PHP_BUILD_CACHE_SDK_DIR: c:\build-cache\sdk
-        PHP_BUILD_SDK_BRANCH: php-sdk-2.1.9beta1
+        PHP_BUILD_SDK_BRANCH: php-sdk-2.2.0beta3
         PHP_BUILD_CRT: vc15
         # ext and env setup for tests
         #MYSQL_TEST_PASSWD: Password12!

.travis.yml

@@ -1,3 +1,6 @@
+git:
+  quiet: true
+
 dist: trusty
 language: c
 sudo: required

EXTENSIONS

@@ -387,6 +387,7 @@ SINCE:               5.5.0
 EXTENSION:           openssl
 PRIMARY MAINTAINER:  Wez Furlong <wez@php.net> (2001 - 2006)
                      Pierre-Alain Joye <pajoye@php.net> (2006 - 2011)
+                     Jakub Zelenka <bukka@php.net> (2015 - 2019)
 MAINTENANCE:         Maintained
 STATUS:              Working
 SINCE:               4.0.4

UPGRADING

@@ -53,7 +53,7 @@ Core:
                 case "baz":
                     continue;
                     // Warning: "continue" targeting switch is equivalent to
-                                "break". Did you mean to use "continue 2"?
+                    //          "break". Did you mean to use "continue 2"?
             }
         }
 
@@ -112,6 +112,12 @@ BCMath:
   . bcmul() and bcpow() now return numbers with the requested scale. Formerly,
     the returned numbers may have omitted trailing decimal zeroes.
 
+IMAP:
+  rsh/ssh logins are disabled by default. Use imap.enable_insecure_rsh if you want
+  to enable them. Note that the IMAP library does not filter mailbox names before
+  passing them to rsh/ssh command, thus passing untrusted data to this function
+  with rsh/ssh enabled is insecure.
+
 MBString:
   . Due to added support for named captures, mb_ereg_*() patterns using named
     captures will behave differently. In particular named captures will be part
@@ -245,6 +251,10 @@ Standard:
     PHP be linked against libargon2 reference library >= 20161029.
     (RFC: https://wiki.php.net/rfc/argon2_password_hash_enhancements).
 
+LDAP:
+  . Full support for LDAP Controls has been added to LDAP querying functions
+    and ldap_parse_result
+
 ========================================
 3. Changes in SAPI modules
 ========================================
@@ -254,6 +264,14 @@ phpdbg:
     PHPDBG_FUNC have been removed.
 
 FPM:
+  . A new global option log_limit has been added. It can be used for setting
+    log limit for logged line which allows to log messages longer than 1024
+    characters without wrapping. It also fixes various wrapping issues.
+  . A new global option log_buffering has been added. It allows an experimental
+    logging without extra buffering.
+  . A new pool option decorate_workers_output has been added. It allows
+    disabling output decoration for workers output when catch_workers_output
+    enabled.
   . The getallheaders() function is now also available.
 
 ========================================
@@ -309,7 +327,7 @@ Standard:
   . Passing a non-string needle to string search functions is deprecated. In the
     future the needle will be interpreted as a string instead of an ASCII codepoint.
     Depending on the intended behavior, you should either explicitly cast the
-    needle to string or perform an explicit call to ord(). The following functions
+    needle to string or perform an explicit call to chr(). The following functions
     are affected:
       . strpos()
       . strrpos()
@@ -355,6 +373,16 @@ Standard:
 PCRE:
   . preg_quote() now also escapes the '#' character.
 
+LDAP:
+  . Added a serverctrls parameter to send controls to the server in ldap_add,
+    ldap_mod_replace, ldap_mod_add, ldap_mod_del, ldap_rename,
+    ldap_compare, ldap_delete, ldap_modify_batch,
+    ldap_search, ldap_list, ldap_read
+  . Added an out parameter to get controls from the server in ldap_parse_result
+  . Fixed support for LDAP_OPT_SERVER_CONTROLS and LDAP_OPT_CLIENT_CONTROLS in
+    ldap_get_option and ldap_set_option.
+
+
 ========================================
 6. New Functions
 ========================================
@@ -369,6 +397,10 @@ Core:
     are available under Linux, FreeBSD, Windows, Mac, SunOS, AIX and their
     derivatives. If no required timers are provided by a corresponding
     platform, the function returns false.
+  . Added net_get_interfaces() to retrieve an array of available network
+    interfaces including several details.
+  . Added the gc_status() function to retrieve status information regarding the
+    cyclic GC.
 
 Date:
   . Added the DateTime::createFromImmutable() method, which mirrors
@@ -398,6 +430,10 @@ Intl:
   . Added Normalizer::getRawDecomposition() and normalizer_get_raw_decomposition(),
     to retrieve the Decomposition_Mapping property of a character.
 
+LDAP:
+  . Added ldap_exop_refresh() to conveniently perform a Refresh extended
+    operation.
+
 OpenSSL:
   . Added openssl_pkey_derive that derives a shared secret for DH, ECDH and
     possibly other future algorithms supported by EVP_PKEY_derive.
@@ -425,6 +461,13 @@ Standard:
     last key of an array, respectively.
     (RFC: <https://wiki.php.net/rfc/array_key_first_last>)
 
+LDAP:
+  . Added functions ldap_add_ext, ldap_bind_ext, ldap_delete_ext, ldap_mod_add_ext,
+    ldap_mod_replace_ext, ldap_mod_del_ext, ldap_rename_ext
+    which gives access to the result object to be able to parse it
+    with ldap_parse_result and get more information than just success/failure.
+
+
 ========================================
 7. New Classes and Interfaces
 ========================================
@@ -449,7 +492,7 @@ JSON:
     is fully backward compatible with former PHP versions.
   . FILTER_SANITIZE_ADD_SLASHES has been added as an alias of the 'magic_quotes'
     filter (FILTER_SANITIZE_MAGIC_QUOTES). The 'magic_quotes' filter is subject
-	to removal in future versions of PHP.
+  	to removal in future versions of PHP.
 
  FTP:
   . Set default transfer mode to binary
@@ -471,12 +514,22 @@ JSON:
     related constants for possible TLS protocol values have been added.
     See <https://github.com/php/php-src/pull/3317>.
 
-PCRE:
+ PCRE:
   . The PCRE extension has been upgraded to PCRE2, which may cause minor
     behavioral changes (for instance, character ranges in classes are now more
     strictly interpreted), and augments the existing regular expression syntax.
     See <https://wiki.php.net/rfc/pcre2-migration> for details.
 
+ PDO_DBLIB:
+  . Added the attribute PDO::DBLIB_ATTR_SKIP_EMPTY_ROWSETS to enable automatic
+    skipping of empty rowsets.
+  . Exposed the TDS version via the PDO::DBLIB_ATTR_TDS_VERSION attribute.
+  . DATETIME2 columns are now treated like DATETIME columns.
+
+ PDO_SQLite:
+  . SQLite3 databases can now be opened in read-only mode by setting the
+    new PDO::SQLITE_ATTR_OPEN_FLAGS attribute to PDO::SQLITE_READONLY.
+
  Standard:
   . var_export() now exports stdClass objects as an array casted to an object
     (`(object) array( ... )`), rather than using the nonexistent method
@@ -496,6 +549,10 @@ PCRE:
   . Building against the bundled libzip is discouraged, but still possible by
     adding `--without-libzip` to the configuration.
 
+ zlib:
+  . Added the zlib/level context option for the compress.zlib wrapper to
+    facilitate setting the desired compression level.
+
 ========================================
 10. New Global Constants
 ========================================
@@ -573,7 +630,6 @@ Curl:
   . CURL_VERSION_GSSNEGOTIATE
   . CURL_VERSION_HTTPS_PROXY
   . CURL_VERSION_IDN
-  . CURL_VERSION_KERBEROS5
   . CURL_VERSION_LARGEFILE
   . CURL_VERSION_MULTI_SSL
   . CURL_VERSION_NTLM
@@ -581,11 +637,19 @@ Curl:
   . CURL_VERSION_SPNEGO
   . CURL_VERSION_SSPI
   . CURL_VERSION_TLSAUTH_SRP
-  . CURL_VERSION_UNIX_SOCKETS
+
+Filter:
+  . FILTER_SANITIZE_ADD_SLASHES
 
 JSON:
   . JSON_THROW_ON_ERROR
 
+OpenSSL:
+  . STREAM_CRYPTO_PROTO_SSLv3
+  . STREAM_CRYPTO_PROTO_TLSv1_0
+  . STREAM_CRYPTO_PROTO_TLSv1_1
+  . STREAM_CRYPTO_PROTO_TLSv1_2
+
 MBString:
   . MB_CASE_FOLD
   . MB_CASE_LOWER_SIMPLE
@@ -606,6 +670,34 @@ PGSQL:
 Standard:
   . PASSWORD_ARGON2ID
 
+LDAP:
+  . LDAP_CONTROL_MANAGEDSAIT
+  . LDAP_CONTROL_PROXY_AUTHZ
+  . LDAP_CONTROL_SUBENTRIES
+  . LDAP_CONTROL_VALUESRETURNFILTER
+  . LDAP_CONTROL_ASSERT
+  . LDAP_CONTROL_PRE_READ
+  . LDAP_CONTROL_POST_READ
+  . LDAP_CONTROL_SORTREQUEST
+  . LDAP_CONTROL_SORTRESPONSE
+  . LDAP_CONTROL_PAGEDRESULTS
+  . LDAP_CONTROL_AUTHZID_REQUEST
+  . LDAP_CONTROL_AUTHZID_RESPONSE
+  . LDAP_CONTROL_SYNC
+  . LDAP_CONTROL_SYNC_STATE
+  . LDAP_CONTROL_SYNC_DONE
+  . LDAP_CONTROL_DONTUSECOPY
+  . LDAP_CONTROL_PASSWORDPOLICYREQUEST
+  . LDAP_CONTROL_PASSWORDPOLICYRESPONSE
+  . LDAP_CONTROL_X_INCREMENTAL_VALUES
+  . LDAP_CONTROL_X_DOMAIN_SCOPE
+  . LDAP_CONTROL_X_PERMISSIVE_MODIFY
+  . LDAP_CONTROL_X_SEARCH_OPTIONS
+  . LDAP_CONTROL_X_TREE_DELETE
+  . LDAP_CONTROL_X_EXTENDED_DN
+  . LDAP_CONTROL_VLVREQUEST
+  . LDAP_CONTROL_VLVRESPONSE
+
 ========================================
 11. Changes to INI File Handling
 ========================================
@@ -649,3 +741,7 @@ Standard:
 ========================================
 13. Other Changes
 ========================================
+
+. The cyclic GC has been enhanced, which may result in considerable performance
+  improvements.
+ 

Zend/tests/bug55509.phpt

@@ -45,6 +45,13 @@ elseif (PHP_OS == 'FreeBSD') {
   if ($freeMemory < 2100*1024*1024) {
     die('skip Not enough memory.');
   }
+} elseif (PHP_OS == "WINNT") {
+  $s = trim(shell_exec("wmic OS get FreeVirtualMemory /Value 2>nil"));
+  $freeMemory = explode('=', $s)[1]*1;
+
+  if ($freeMemory < 2.1*1024*1024) {
+    die('skip Not enough memory.');
+  }
 }
 ?>
 --INI--

Zend/tests/bug75426.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Bug #75426: "Cannot use empty array elements" reports wrong position
+--FILE--
+<?php
+$a = [
+    1,
+    2,
+    3,
+    ,
+    5,
+    6,
+];
+?>
+--EXPECTF--
+Fatal error: Cannot use empty array elements in arrays in %s on line 5

Zend/tests/bug77291.phpt

@@ -0,0 +1,42 @@
+--TEST--
+Bug #77291 (magic methods inherited from a trait may be ignored)
+--FILE--
+<?php
+
+trait AccessibleProperties
+{
+    public function __isset($property)
+    {
+        return property_exists($this, $property);
+    }
+
+    public function __get($property)
+    {
+        if (property_exists($this, $property)) {
+            return $this->$property;
+        }
+    }
+}
+
+class Foo4567 {
+    use AccessibleProperties;
+
+    protected $a = 'Some value';
+}
+
+class Foo45 {
+    use AccessibleProperties;
+
+    protected $a = 'Some value';
+}
+
+$foo = new Foo4567;
+var_dump(isset($foo->a));
+$foo = new Foo45;
+var_dump($foo->a);
+?>
+===DONE===
+--EXPECT--
+bool(true)
+string(10) "Some value"
+===DONE===

Zend/tests/bug77339.phpt

@@ -0,0 +1,33 @@
+--TEST--
+Bug #77339 (__callStatic may get incorrect arguments)
+--FILE--
+<?php
+class Foo
+{
+    static function __callStatic($name, $arguments) {
+       if ($name === 'get') {
+            if (!isset($arguments[0])) {
+                var_dump(['getSomeWhat']);
+                var_dump($arguments);
+                exit;
+            }
+        } 
+        echo "OK\n";
+    }
+
+    protected function get ($key) {
+        echo "BUG!!!\n";
+    }
+}
+
+class Bar
+{
+    static function __callStatic($name, $arguments) {
+        echo Foo::get('getSomeWhat');
+    }
+}
+
+Bar::someUndefinedStaticFunction();
+?>
+--EXPECT--
+OK

Zend/tests/bug77376.phpt

@@ -0,0 +1,12 @@
+--TEST--
+Bug #77376 ("undefined function" message no longer includes namespace)
+--FILE--
+<?php
+namespace Hello;
+World();
+?>
+--EXPECTF--
+Fatal error: Uncaught Error: Call to undefined function Hello\World() %sbug77376.php:%d
+Stack trace:
+#0 {main}
+  thrown in %sbug77376.php on line %d 

Zend/tests/bug77494.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug #77494 (Disabling class causes segfault on member access)
+--SKIPIF--
+<?php if (!extension_loaded("curl")) exit("skip curl extension not loaded"); ?>
+--INI--
+disable_classes=CURLFile
+--FILE--
+<?php
+$a = new CURLFile();
+var_dump($a->name);
+?>
+--EXPECTF--
+Warning: CURLFile() has been disabled for security reasons in %sbug77494.php on line 2
+
+Notice: Undefined property: CURLFile::$name in %sbug77494.php on line 3
+NULL

Zend/tests/bug77530.phpt

@@ -0,0 +1,10 @@
+--TEST--
+Bug #77530: PHP crashes when parsing '(2)::class'
+--FILE--
+<?php
+
+echo (2)::class;
+
+?>
+--EXPECTF--
+Fatal error: Illegal class name in %s on line %d

Zend/tests/bug77589.phpt

@@ -0,0 +1,40 @@
+--TEST--
+BUG #77589 (Core dump using parse_ini_string with numeric sections)
+--FILE--
+<?php
+var_dump(
+	parse_ini_string(<<<INI
+[0]
+a = 1
+b = on
+c = true
+
+["true"]
+a = 100 
+b = null
+c = yes
+INI
+, TRUE, INI_SCANNER_TYPED));
+
+?>
+--EXPECT--
+array(2) {
+  [0]=>
+  array(3) {
+    ["a"]=>
+    int(1)
+    ["b"]=>
+    bool(true)
+    ["c"]=>
+    bool(true)
+  }
+  ["true"]=>
+  array(3) {
+    ["a"]=>
+    int(100)
+    ["b"]=>
+    NULL
+    ["c"]=>
+    bool(true)
+  }
+}

Zend/tests/inherit_internal_static.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Inherit internal static property into userland class
+--SKIPIF--
+<?php if (!extension_loaded('zend-test')) die('skip requires zend-test'); ?>
+--FILE--
+<?php
+
+class Test extends _ZendTestClass {
+}
+
+var_dump(Test::$_StaticProp);
+_ZendTestClass::$_StaticProp = 42;
+var_dump(Test::$_StaticProp);
+
+?>
+--EXPECT--
+NULL
+int(42)

Zend/tests/self_class_const_in_unknown_scope.phpt

@@ -0,0 +1,23 @@
+--TEST--
+Use of self::class inside a constant in an unknown scope
+--FILE--
+<?php
+
+class Test {
+    public function foobar() {
+        eval("
+            const FOO = self::class;
+            var_dump(FOO);
+        ");
+    }
+}
+(new Test)->foobar();
+
+// This should error, but doesn't
+const BAR = self::class;
+var_dump(BAR);
+
+?>
+--EXPECT--
+string(4) "Test"
+string(0) ""

Zend/zend.c

@@ -373,17 +373,17 @@ ZEND_API void zend_print_flat_zval_r(zval *expr) /* {{{ */
 	switch (Z_TYPE_P(expr)) {
 		case IS_ARRAY:
 			ZEND_PUTS("Array (");
-			if (Z_REFCOUNTED_P(expr)) {
-				if (Z_IS_RECURSIVE_P(expr)) {
+			if (!(GC_FLAGS(Z_ARRVAL_P(expr)) & GC_IMMUTABLE)) {
+				if (GC_IS_RECURSIVE(Z_ARRVAL_P(expr))) {
 					ZEND_PUTS(" *RECURSION*");
 					return;
 				}
-				Z_PROTECT_RECURSION_P(expr);
+				GC_PROTECT_RECURSION(Z_ARRVAL_P(expr));
 			}
 			print_flat_hash(Z_ARRVAL_P(expr));
 			ZEND_PUTS(")");
-			if (Z_REFCOUNTED_P(expr)) {
-				Z_UNPROTECT_RECURSION_P(expr);
+			if (!(GC_FLAGS(Z_ARRVAL_P(expr)) & GC_IMMUTABLE)) {
+				GC_UNPROTECT_RECURSION(Z_ARRVAL_P(expr));
 			}
 			break;
 		case IS_OBJECT:
@@ -393,7 +393,7 @@ ZEND_API void zend_print_flat_zval_r(zval *expr) /* {{{ */
 			zend_printf("%s Object (", ZSTR_VAL(class_name));
 			zend_string_release_ex(class_name, 0);
 
-			if (Z_IS_RECURSIVE_P(expr)) {
+			if (GC_IS_RECURSIVE(Z_OBJ_P(expr))) {
 				ZEND_PUTS(" *RECURSION*");
 				return;
 			}
@@ -402,9 +402,9 @@ ZEND_API void zend_print_flat_zval_r(zval *expr) /* {{{ */
 				properties = Z_OBJPROP_P(expr);
 			}
 			if (properties) {
-				Z_PROTECT_RECURSION_P(expr);
+				GC_PROTECT_RECURSION(Z_OBJ_P(expr));
 				print_flat_hash(properties);
-				Z_UNPROTECT_RECURSION_P(expr);
+				GC_UNPROTECT_RECURSION(Z_OBJ_P(expr));
 			}
 			ZEND_PUTS(")");
 			break;
@@ -424,16 +424,16 @@ static void zend_print_zval_r_to_buf(smart_str *buf, zval *expr, int indent) /*
 	switch (Z_TYPE_P(expr)) {
 		case IS_ARRAY:
 			smart_str_appends(buf, "Array\n");
-			if (Z_REFCOUNTED_P(expr)) {
-				if (Z_IS_RECURSIVE_P(expr)) {
+			if (!(GC_FLAGS(Z_ARRVAL_P(expr)) & GC_IMMUTABLE)) {
+				if (GC_IS_RECURSIVE(Z_ARRVAL_P(expr))) {
 					smart_str_appends(buf, " *RECURSION*");
 					return;
 				}
-				Z_PROTECT_RECURSION_P(expr);
+				GC_PROTECT_RECURSION(Z_ARRVAL_P(expr));
 			}
 			print_hash(buf, Z_ARRVAL_P(expr), indent, 0);
-			if (Z_REFCOUNTED_P(expr)) {
-				Z_UNPROTECT_RECURSION_P(expr);
+			if (!(GC_FLAGS(Z_ARRVAL_P(expr)) & GC_IMMUTABLE)) {
+				GC_UNPROTECT_RECURSION(Z_ARRVAL_P(expr));
 			}
 			break;
 		case IS_OBJECT:
@@ -446,7 +446,7 @@ static void zend_print_zval_r_to_buf(smart_str *buf, zval *expr, int indent) /*
 				zend_string_release_ex(class_name, 0);
 
 				smart_str_appends(buf, " Object\n");
-				if (Z_IS_RECURSIVE_P(expr)) {
+				if (GC_IS_RECURSIVE(Z_OBJ_P(expr))) {
 					smart_str_appends(buf, " *RECURSION*");
 					return;
 				}
@@ -454,9 +454,9 @@ static void zend_print_zval_r_to_buf(smart_str *buf, zval *expr, int indent) /*
 					break;
 				}
 
-				Z_PROTECT_RECURSION_P(expr);
+				GC_PROTECT_RECURSION(Z_OBJ_P(expr));
 				print_hash(buf, properties, indent, 1);
-				Z_UNPROTECT_RECURSION_P(expr);
+				GC_UNPROTECT_RECURSION(Z_OBJ_P(expr));
 
 				if (is_temp) {
 					zend_hash_destroy(properties);

Zend/zend.h

@@ -20,7 +20,7 @@
 #ifndef ZEND_H
 #define ZEND_H
 
-#define ZEND_VERSION "3.3.0-dev"
+#define ZEND_VERSION "3.3.3"
 
 #define ZEND_ENGINE_3
 

Zend/zend_API.c

@@ -2861,6 +2861,17 @@ static zend_object *display_disabled_class(zend_class_entry *class_type) /* {{{
 	zend_object *intern;
 
 	intern = zend_objects_new(class_type);
+
+	/* Initialize default properties */
+	if (EXPECTED(class_type->default_properties_count != 0)) {
+		zval *p = intern->properties_table;
+		zval *end = p + class_type->default_properties_count;
+		do {
+			ZVAL_UNDEF(p);
+			p++;
+		} while (p != end);
+	}
+
 	zend_error(E_WARNING, "%s() has been disabled for security reasons", ZSTR_VAL(class_type->name));
 	return intern;
 }

Zend/zend_alloc.c

@@ -191,9 +191,7 @@ typedef struct  _zend_mm_free_slot zend_mm_free_slot;
 typedef struct  _zend_mm_chunk     zend_mm_chunk;
 typedef struct  _zend_mm_huge_list zend_mm_huge_list;
 
-#ifdef MAP_HUGETLB
 int zend_mm_use_huge_pages = 0;
-#endif
 
 /*
  * Memory is retrived from OS by chunks of fixed size 2MB.
@@ -714,7 +712,9 @@ static void *zend_mm_chunk_alloc_int(size_t size, size_t alignment)
 		return NULL;
 	} else if (ZEND_MM_ALIGNED_OFFSET(ptr, alignment) == 0) {
 #ifdef MADV_HUGEPAGE
-	    madvise(ptr, size, MADV_HUGEPAGE);
+		if (zend_mm_use_huge_pages) {
+			madvise(ptr, size, MADV_HUGEPAGE);
+		}
 #endif
 		return ptr;
 	} else {
@@ -745,7 +745,9 @@ static void *zend_mm_chunk_alloc_int(size_t size, size_t alignment)
 			zend_mm_munmap((char*)ptr + size, alignment - REAL_PAGE_SIZE);
 		}
 # ifdef MADV_HUGEPAGE
-	    madvise(ptr, size, MADV_HUGEPAGE);
+		if (zend_mm_use_huge_pages) {
+			madvise(ptr, size, MADV_HUGEPAGE);
+		}
 # endif
 #endif
 		return ptr;
@@ -2668,9 +2670,7 @@ ZEND_API void shutdown_memory_manager(int silent, int full_shutdown)
 
 static void alloc_globals_ctor(zend_alloc_globals *alloc_globals)
 {
-#if ZEND_MM_CUSTOM || MAP_HUGETLB
 	char *tmp;
-#endif
 
 #if ZEND_MM_CUSTOM
 	tmp = getenv("USE_ZEND_ALLOC");
@@ -2684,12 +2684,11 @@ static void alloc_globals_ctor(zend_alloc_globals *alloc_globals)
 		return;
 	}
 #endif
-#ifdef MAP_HUGETLB
+
 	tmp = getenv("USE_ZEND_ALLOC_HUGE_PAGES");
 	if (tmp && zend_atoi(tmp, 0)) {
 		zend_mm_use_huge_pages = 1;
 	}
-#endif
 	ZEND_TSRMLS_CACHE_UPDATE();
 	alloc_globals->mm_heap = zend_mm_init();
 }

Zend/zend_compile.c

@@ -480,10 +480,12 @@ static inline zend_string *zval_make_interned_string(zval *zv) /* {{{ */
 /* Common part of zend_add_literal and zend_append_individual_literal */
 static inline void zend_insert_literal(zend_op_array *op_array, zval *zv, int literal_position) /* {{{ */
 {
+	zval *lit = CT_CONSTANT_EX(op_array, literal_position);
 	if (Z_TYPE_P(zv) == IS_STRING) {
 		zval_make_interned_string(zv);
 	}
-	ZVAL_COPY_VALUE(CT_CONSTANT_EX(op_array, literal_position), zv);
+	ZVAL_COPY_VALUE(lit, zv);
+	Z_EXTRA_P(lit) = 0;
 }
 /* }}} */
 
@@ -1478,6 +1480,7 @@ static void zend_ensure_valid_class_fetch_type(uint32_t fetch_type) /* {{{ */
 static zend_bool zend_try_compile_const_expr_resolve_class_name(zval *zv, zend_ast *class_ast, zend_ast *name_ast, zend_bool constant) /* {{{ */
 {
 	uint32_t fetch_type;
+	zval *class_name;
 
 	if (name_ast->kind != ZEND_AST_ZVAL) {
 		return 0;
@@ -1492,12 +1495,18 @@ static zend_bool zend_try_compile_const_expr_resolve_class_name(zval *zv, zend_a
 			"Dynamic class names are not allowed in compile-time ::class fetch");
 	}
 
-	fetch_type = zend_get_class_fetch_type(zend_ast_get_str(class_ast));
+	class_name = zend_ast_get_zval(class_ast);
+
+	if (Z_TYPE_P(class_name) != IS_STRING) {
+		zend_error_noreturn(E_COMPILE_ERROR, "Illegal class name");
+	}
+
+	fetch_type = zend_get_class_fetch_type(Z_STR_P(class_name));
 	zend_ensure_valid_class_fetch_type(fetch_type);
 
 	switch (fetch_type) {
 		case ZEND_FETCH_CLASS_SELF:
-			if (constant || (CG(active_class_entry) && zend_is_scope_known())) {
+			if (CG(active_class_entry) && zend_is_scope_known()) {
 				ZVAL_STR_COPY(zv, CG(active_class_entry)->name);
 			} else {
 				ZVAL_NULL(zv);
@@ -2444,7 +2453,6 @@ static inline void zend_handle_numeric_dim(zend_op *opline, znode *dim_node) /*
 			return;
 		}
 	}
-	Z_EXTRA_P(CT_CONSTANT(opline->op2)) = 0;
 }
 /* }}} */
 
@@ -3650,7 +3658,7 @@ int zend_compile_func_cuf(znode *result, zend_ast_list *args, zend_string *lcnam
 }
 /* }}} */
 
-static int zend_compile_assert(znode *result, zend_ast_list *args, zend_string *name, zend_function *fbc) /* {{{ */
+static void zend_compile_assert(znode *result, zend_ast_list *args, zend_string *name, zend_function *fbc) /* {{{ */
 {
 	if (EG(assertions) >= 0) {
 		znode name_node;
@@ -3693,8 +3701,6 @@ static int zend_compile_assert(znode *result, zend_ast_list *args, zend_string *
 		result->op_type = IS_CONST;
 		ZVAL_TRUE(&result->u.constant);
 	}
-
-	return SUCCESS;
 }
 /* }}} */
 
@@ -3901,10 +3907,6 @@ int zend_try_compile_special_func(znode *result, zend_string *lcname, zend_ast_l
 		return FAILURE;
 	}
 
-	if (zend_string_equals_literal(lcname, "assert")) {
-		return zend_compile_assert(result, args, lcname, fbc);
-	}
-
 	if (CG(compiler_options) & ZEND_COMPILE_NO_BUILTINS) {
 		return FAILURE;
 	}
@@ -4007,8 +4009,16 @@ void zend_compile_call(znode *result, zend_ast *ast, uint32_t type) /* {{{ */
 		zend_op *opline;
 
 		lcname = zend_string_tolower(Z_STR_P(name));
-
 		fbc = zend_hash_find_ptr(CG(function_table), lcname);
+
+		/* Special assert() handling should apply independently of compiler flags. */
+		if (fbc && zend_string_equals_literal(lcname, "assert")) {
+			zend_compile_assert(result, zend_ast_get_list(args_ast), lcname, fbc);
+			zend_string_release(lcname);
+			zval_ptr_dtor(&name_node.u.constant);
+			return;
+		}
+
 		if (!fbc
 		 || (fbc->type == ZEND_INTERNAL_FUNCTION && (CG(compiler_options) & ZEND_COMPILE_IGNORE_INTERNAL_FUNCTIONS))
 		 || (fbc->type == ZEND_USER_FUNCTION && (CG(compiler_options) & ZEND_COMPILE_IGNORE_USER_FUNCTIONS))
@@ -4152,6 +4162,14 @@ void zend_compile_static_call(znode *result, zend_ast *ast, uint32_t type) /* {{
 		if (ce) {
 			zend_string *lcname = Z_STR_P(CT_CONSTANT(opline->op2) + 1);
 			fbc = zend_hash_find_ptr(&ce->function_table, lcname);
+			if (fbc && !(fbc->common.fn_flags & ZEND_ACC_PUBLIC)) {
+				if (ce != CG(active_class_entry)
+				 &&((fbc->common.fn_flags & ZEND_ACC_PRIVATE)
+				  || !zend_check_protected(zend_get_function_root_class(fbc), CG(active_class_entry)))) {
+					/* incompatibe function */
+					fbc = NULL;
+				}
+			}
 		}
 	}
 
@@ -4845,6 +4863,10 @@ void zend_compile_foreach(zend_ast *ast) /* {{{ */
 
 	zend_compile_stmt(stmt_ast);
 
+	/* Place JMP and FE_FREE on the line where foreach starts. It would be
+	 * better to use the end line, but this information is not available
+	 * currently. */
+	CG(zend_lineno) = ast->lineno;
 	zend_emit_jump(opnum_fetch);
 
 	opline = &CG(active_op_array)->opcodes[opnum_reset];
@@ -4943,6 +4965,10 @@ static zend_uchar determine_switch_jumptable_type(zend_ast_list *cases) {
 }
 
 static zend_bool should_use_jumptable(zend_ast_list *cases, zend_uchar jumptable_type) {
+	if (CG(compiler_options) & ZEND_COMPILE_NO_JUMPTABLES) {
+		return 0;
+	}
+
 	/* Thresholds are chosen based on when the average switch time for equidistributed
 	 * input becomes smaller when using the jumptable optimization. */
 	if (jumptable_type == IS_LONG) {
@@ -6982,6 +7008,7 @@ static inline void zend_ct_eval_greater(zval *result, zend_ast_kind kind, zval *
 static zend_bool zend_try_ct_eval_array(zval *result, zend_ast *ast) /* {{{ */
 {
 	zend_ast_list *list = zend_ast_get_list(ast);
+	zend_ast *last_elem_ast = NULL;
 	uint32_t i;
 	zend_bool is_constant = 1;
 
@@ -6994,6 +7021,10 @@ static zend_bool zend_try_ct_eval_array(zval *result, zend_ast *ast) /* {{{ */
 		zend_ast *elem_ast = list->child[i];
 
 		if (elem_ast == NULL) {
+			/* Report error at line of last non-empty element */
+			if (last_elem_ast) {
+				CG(zend_lineno) = zend_ast_get_lineno(last_elem_ast);
+			}
 			zend_error(E_COMPILE_ERROR, "Cannot use empty array elements in arrays");
 		}
 
@@ -7005,6 +7036,8 @@ static zend_bool zend_try_ct_eval_array(zval *result, zend_ast *ast) /* {{{ */
 		) {
 			is_constant = 0;
 		}
+
+		last_elem_ast = elem_ast;
 	}
 
 	if (!is_constant) {
@@ -8066,9 +8099,7 @@ void zend_compile_const_expr_magic_const(zend_ast **ast_ptr) /* {{{ */
 	zend_ast *ast = *ast_ptr;
 
 	/* Other cases already resolved by constant folding */
-	ZEND_ASSERT(ast->attr == T_CLASS_C &&
-	            CG(active_class_entry) &&
-	            (CG(active_class_entry)->ce_flags & ZEND_ACC_TRAIT) != 0);
+	ZEND_ASSERT(ast->attr == T_CLASS_C);
 
 	zend_ast_destroy(ast);
 	*ast_ptr = zend_ast_create(ZEND_AST_CONSTANT_CLASS);

Zend/zend_compile.h

@@ -1048,6 +1048,9 @@ END_EXTERN_C()
 /* result of compilation may be stored in file cache */
 #define ZEND_COMPILE_WITH_FILE_CACHE			(1<<11)
 
+/* disable jumptable optimization for switch statements */
+#define ZEND_COMPILE_NO_JUMPTABLES				(1<<12)
+
 /* The default value for CG(compiler_options) */
 #define ZEND_COMPILE_DEFAULT					ZEND_COMPILE_HANDLE_OP_ARRAY
 

Zend/zend_constants.c

@@ -378,7 +378,9 @@ ZEND_API zval *zend_get_constant_ex(zend_string *cname, zend_class_entry *scope,
 				ret_constant = NULL;
 			} else {
 				if (!zend_verify_const_access(c, scope)) {
-					zend_throw_error(NULL, "Cannot access %s const %s::%s", zend_visibility_string(Z_ACCESS_FLAGS(c->value)), ZSTR_VAL(class_name), ZSTR_VAL(constant_name));
+					if ((flags & ZEND_FETCH_CLASS_SILENT) == 0) {
+						zend_throw_error(NULL, "Cannot access %s const %s::%s", zend_visibility_string(Z_ACCESS_FLAGS(c->value)), ZSTR_VAL(class_name), ZSTR_VAL(constant_name));
+					}
 					goto failure;
 				}
 				ret_constant = &c->value;

Zend/zend_cpuinfo.c

@@ -36,11 +36,23 @@ static void __zend_cpuid(uint32_t func, uint32_t subfunc, zend_cpu_info *cpuinfo
 }
 # else
 static void __zend_cpuid(uint32_t func, uint32_t subfunc, zend_cpu_info *cpuinfo) {
+#if defined(__i386__) && (defined(__pic__) || defined(__PIC__))
+	/* PIC on i386 uses %ebx, so preserve it. */
+	__asm__ __volatile__ (
+		"pushl  %%ebx\n"
+		"cpuid\n"
+		"mov    %%ebx,%1\n"
+		"popl   %%ebx"
+		: "=a"(cpuinfo->eax), "=r"(cpuinfo->ebx), "=c"(cpuinfo->ecx), "=d"(cpuinfo->edx)
+		: "a"(func), "c"(subfunc)
+	);
+#else
 	__asm__ __volatile__ (
 		"cpuid"
 		: "=a"(cpuinfo->eax), "=b"(cpuinfo->ebx), "=c"(cpuinfo->ecx), "=d"(cpuinfo->edx)
 		: "a"(func), "c"(subfunc)
 	);
+#endif
 }
 # endif
 #elif defined(ZEND_WIN32) && !defined(__clang__)
@@ -65,16 +77,24 @@ void zend_cpu_startup(void)
 {
 	if (!cpuinfo.initialized) {
 		zend_cpu_info ebx;
+		int max_feature;
 
 		cpuinfo.initialized = 1;
 		__zend_cpuid(0, 0, &cpuinfo);
-		if (cpuinfo.eax == 0) {
+		max_feature = cpuinfo.eax;
+		if (max_feature == 0) {
 			return;
 		}
+
 		__zend_cpuid(1, 0, &cpuinfo);
+
 		/* for avx2 */
-		__zend_cpuid(7, 0, &ebx);
-		cpuinfo.ebx = ebx.ebx;
+		if (max_feature >= 7) {
+			__zend_cpuid(7, 0, &ebx);
+			cpuinfo.ebx = ebx.ebx;
+		} else {
+			cpuinfo.ebx = 0;
+		}
 	}
 }
 

Zend/zend_cpuinfo.h

@@ -100,12 +100,22 @@ typedef enum _zend_cpu_feature {
 void zend_cpu_startup();
 ZEND_API int zend_cpu_supports(zend_cpu_feature feature);
 
+/* Address sanitizer is incompatible with ifunc resolvers, so exclude the
+ * CPU support helpers from asan.
+ * See also https://github.com/google/sanitizers/issues/342. */
+#if __has_attribute(no_sanitize_address)
+# define ZEND_NO_SANITIZE_ADDRESS __attribute__((no_sanitize_address))
+#else
+# define ZEND_NO_SANITIZE_ADDRESS
+#endif
+
 #if PHP_HAVE_BUILTIN_CPU_SUPPORTS
 /* NOTE: you should use following inline function in
  * resolver functions (ifunc), as it could be called
  * before all PLT symbols are resloved. in other words,
  * resolver functions should not depends any external
  * functions */
+ZEND_NO_SANITIZE_ADDRESS
 static zend_always_inline int zend_cpu_supports_sse2() {
 #if PHP_HAVE_BUILTIN_CPU_INIT
 	__builtin_cpu_init();
@@ -113,6 +123,7 @@ static zend_always_inline int zend_cpu_supports_sse2() {
 	return __builtin_cpu_supports("sse2");
 }
 
+ZEND_NO_SANITIZE_ADDRESS
 static zend_always_inline int zend_cpu_supports_sse3() {
 #if PHP_HAVE_BUILTIN_CPU_INIT
 	__builtin_cpu_init();
@@ -120,6 +131,7 @@ static zend_always_inline int zend_cpu_supports_sse3() {
 	return __builtin_cpu_supports("sse3");
 }
 
+ZEND_NO_SANITIZE_ADDRESS
 static zend_always_inline int zend_cpu_supports_ssse3() {
 #if PHP_HAVE_BUILTIN_CPU_INIT
 	__builtin_cpu_init();
@@ -127,6 +139,7 @@ static zend_always_inline int zend_cpu_supports_ssse3() {
 	return __builtin_cpu_supports("ssse3");
 }
 
+ZEND_NO_SANITIZE_ADDRESS
 static zend_always_inline int zend_cpu_supports_sse41() {
 #if PHP_HAVE_BUILTIN_CPU_INIT
 	__builtin_cpu_init();
@@ -134,6 +147,7 @@ static zend_always_inline int zend_cpu_supports_sse41() {
 	return __builtin_cpu_supports("sse4.1");
 }
 
+ZEND_NO_SANITIZE_ADDRESS
 static zend_always_inline int zend_cpu_supports_sse42() {
 #if PHP_HAVE_BUILTIN_CPU_INIT
 	__builtin_cpu_init();
@@ -141,6 +155,7 @@ static zend_always_inline int zend_cpu_supports_sse42() {
 	return __builtin_cpu_supports("sse4.2");
 }
 
+ZEND_NO_SANITIZE_ADDRESS
 static zend_always_inline int zend_cpu_supports_avx() {
 #if PHP_HAVE_BUILTIN_CPU_INIT
 	__builtin_cpu_init();
@@ -148,6 +163,7 @@ static zend_always_inline int zend_cpu_supports_avx() {
 	return __builtin_cpu_supports("avx");
 }
 
+ZEND_NO_SANITIZE_ADDRESS
 static zend_always_inline int zend_cpu_supports_avx2() {
 #if PHP_HAVE_BUILTIN_CPU_INIT
 	__builtin_cpu_init();

Zend/zend_execute.c

@@ -170,9 +170,9 @@ ZEND_API const zend_internal_function zend_pass_function = {
 
 #define ZEND_VM_STACK_PAGE_SIZE  (ZEND_VM_STACK_PAGE_SLOTS * sizeof(zval))
 
-#define ZEND_VM_STACK_PAGE_ALIGNED_SIZE(size) \
+#define ZEND_VM_STACK_PAGE_ALIGNED_SIZE(size, page_size) \
 	(((size) + ZEND_VM_STACK_HEADER_SLOTS * sizeof(zval) \
-	  + (ZEND_VM_STACK_PAGE_SIZE - 1)) & ~(ZEND_VM_STACK_PAGE_SIZE - 1))
+	  + ((page_size) - 1)) & ~((page_size) - 1))
 
 static zend_always_inline zend_vm_stack zend_vm_stack_new_page(size_t size, zend_vm_stack prev) {
 	zend_vm_stack page = (zend_vm_stack)emalloc(size);
@@ -192,6 +192,16 @@ ZEND_API void zend_vm_stack_init(void)
 	EG(vm_stack_end) = EG(vm_stack)->end;
 }
 
+ZEND_API void zend_vm_stack_init_ex(size_t page_size)
+{
+	/* page_size must be a power of 2 */
+	ZEND_ASSERT(page_size > 0 && (page_size & (page_size - 1)) == 0);
+	EG(vm_stack_page_size) = page_size;
+	EG(vm_stack) = zend_vm_stack_new_page(page_size, NULL);
+	EG(vm_stack_top) = EG(vm_stack)->top;
+	EG(vm_stack_end) = EG(vm_stack)->end;
+}
+
 ZEND_API void zend_vm_stack_destroy(void)
 {
 	zend_vm_stack stack = EG(vm_stack);
@@ -212,7 +222,7 @@ ZEND_API void* zend_vm_stack_extend(size_t size)
 	stack->top = EG(vm_stack_top);
 	EG(vm_stack) = stack = zend_vm_stack_new_page(
 		EXPECTED(size < EG(vm_stack_page_size) - (ZEND_VM_STACK_HEADER_SLOTS * sizeof(zval))) ?
-			EG(vm_stack_page_size) : ZEND_VM_STACK_PAGE_ALIGNED_SIZE(size),
+			EG(vm_stack_page_size) : ZEND_VM_STACK_PAGE_ALIGNED_SIZE(size, EG(vm_stack_page_size)),
 		stack);
 	ptr = stack->top;
 	EG(vm_stack_top) = (void*)(((char*)ptr) + size);

Zend/zend_execute.h

@@ -168,6 +168,7 @@ struct _zend_vm_stack {
 #endif
 
 ZEND_API void zend_vm_stack_init(void);
+ZEND_API void zend_vm_stack_init_ex(size_t page_size);
 ZEND_API void zend_vm_stack_destroy(void);
 ZEND_API void* zend_vm_stack_extend(size_t size);
 

Zend/zend_inheritance.c

@@ -894,6 +894,9 @@ ZEND_API void zend_do_inheritance(zend_class_entry *ce, zend_class_entry *parent
 		}
 		if (UNEXPECTED(parent_ce->type != ce->type)) {
 			/* User class extends internal */
+			if (CE_STATIC_MEMBERS(parent_ce) == NULL) {
+				zend_class_init_statics(parent_ce);
+			}
 			if (UNEXPECTED(zend_update_class_constants(parent_ce) != SUCCESS)) {
 				ZEND_ASSERT(0);
 			}
@@ -1126,18 +1129,7 @@ static zend_bool zend_traits_method_compatibility_check(zend_function *fn, zend_
 
 static void zend_add_magic_methods(zend_class_entry* ce, zend_string* mname, zend_function* fe) /* {{{ */
 {
-	if (ZSTR_LEN(ce->name) == ZSTR_LEN(mname)) {
-		zend_string *lowercase_name = zend_string_tolower(ce->name);
-		lowercase_name = zend_new_interned_string(lowercase_name);
-		if (!memcmp(ZSTR_VAL(mname), ZSTR_VAL(lowercase_name), ZSTR_LEN(mname))) {
-			if (ce->constructor  && (!ce->parent || ce->constructor != ce->parent->constructor)) {
-				zend_error_noreturn(E_COMPILE_ERROR, "%s has colliding constructor definitions coming from traits", ZSTR_VAL(ce->name));
-			}
-			ce->constructor = fe;
-			fe->common.fn_flags |= ZEND_ACC_CTOR;
-		}
-		zend_string_release_ex(lowercase_name, 0);
-	} else if (ZSTR_VAL(mname)[0] != '_' || ZSTR_VAL(mname)[1] != '_') {
+	if (ZSTR_LEN(ce->name) != ZSTR_LEN(mname) && (ZSTR_VAL(mname)[0] != '_' || ZSTR_VAL(mname)[1] != '_')) {
 		/* pass */
 	} else if (zend_string_equals_literal(mname, ZEND_CLONE_FUNC_NAME)) {
 		ce->clone = fe;
@@ -1168,6 +1160,17 @@ static void zend_add_magic_methods(zend_class_entry* ce, zend_string* mname, zen
 		ce->__tostring = fe;
 	} else if (zend_string_equals_literal(mname, ZEND_DEBUGINFO_FUNC_NAME)) {
 		ce->__debugInfo = fe;
+	} else if (ZSTR_LEN(ce->name) == ZSTR_LEN(mname)) {
+		zend_string *lowercase_name = zend_string_tolower(ce->name);
+		lowercase_name = zend_new_interned_string(lowercase_name);
+		if (!memcmp(ZSTR_VAL(mname), ZSTR_VAL(lowercase_name), ZSTR_LEN(mname))) {
+			if (ce->constructor  && (!ce->parent || ce->constructor != ce->parent->constructor)) {
+				zend_error_noreturn(E_COMPILE_ERROR, "%s has colliding constructor definitions coming from traits", ZSTR_VAL(ce->name));
+			}
+			ce->constructor = fe;
+			fe->common.fn_flags |= ZEND_ACC_CTOR;
+		}
+		zend_string_release_ex(lowercase_name, 0);
 	}
 }
 /* }}} */

Zend/zend_ini_scanner.c

@@ -143,13 +143,14 @@ ZEND_API zend_ini_scanner_globals ini_scanner_globals;
 	ZVAL_NEW_STR(retval, zend_string_init(str, len, ZEND_SYSTEM_INI))
 
 
-#define RETURN_TOKEN(type, str, len) {                       \
-	if (SCNG(scanner_mode) == ZEND_INI_SCANNER_TYPED) {      \
-		zend_ini_copy_typed_value(ini_lval, type, str, len); \
-	} else {                                                 \
-		zend_ini_copy_value(ini_lval, str, len);             \
-	}                                                        \
-	return type;                                             \
+#define RETURN_TOKEN(type, str, len) {                             \
+	if (SCNG(scanner_mode) == ZEND_INI_SCANNER_TYPED &&            \
+		(YYSTATE == STATE(ST_VALUE) || YYSTATE == STATE(ST_RAW))) {\
+		zend_ini_copy_typed_value(ini_lval, type, str, len);       \
+	} else {                                                       \
+		zend_ini_copy_value(ini_lval, str, len);                   \
+	}                                                              \
+	return type;                                                   \
 }
 
 static inline int convert_to_number(zval *retval, const char *str, const int str_len)
@@ -382,7 +383,7 @@ restart:
 		}
 	}
 
-#line 386 "Zend/zend_ini_scanner.c"
+#line 387 "Zend/zend_ini_scanner.c"
 {
 	YYCTYPE yych;
 	unsigned int yyaccept = 0;
@@ -504,7 +505,7 @@ yy4:
 yy5:
 		YYDEBUG(5, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 481 "Zend/zend_ini_scanner.l"
+#line 482 "Zend/zend_ini_scanner.l"
 		{ /* Get option name */
 	/* Eat leading whitespace */
 	EAT_LEADING_WHITESPACE();
@@ -514,7 +515,7 @@ yy5:
 
 	RETURN_TOKEN(TC_LABEL, yytext, yyleng);
 }
-#line 518 "Zend/zend_ini_scanner.c"
+#line 519 "Zend/zend_ini_scanner.c"
 yy6:
 		YYDEBUG(6, *YYCURSOR);
 		++YYCURSOR;
@@ -538,24 +539,24 @@ yy6:
 yy8:
 		YYDEBUG(8, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 634 "Zend/zend_ini_scanner.l"
+#line 635 "Zend/zend_ini_scanner.l"
 		{
 	/* eat whitespace */
 	goto restart;
 }
-#line 547 "Zend/zend_ini_scanner.c"
+#line 548 "Zend/zend_ini_scanner.c"
 yy9:
 		YYDEBUG(9, *YYCURSOR);
 		++YYCURSOR;
 yy10:
 		YYDEBUG(10, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 639 "Zend/zend_ini_scanner.l"
+#line 640 "Zend/zend_ini_scanner.l"
 		{
 	SCNG(lineno)++;
 	return END_OF_LINE;
 }
-#line 559 "Zend/zend_ini_scanner.c"
+#line 560 "Zend/zend_ini_scanner.c"
 yy11:
 		YYDEBUG(11, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -616,11 +617,11 @@ yy14:
 		++YYCURSOR;
 		YYDEBUG(15, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 562 "Zend/zend_ini_scanner.l"
+#line 563 "Zend/zend_ini_scanner.l"
 		{ /* Disallow these chars outside option values */
 	return yytext[0];
 }
-#line 624 "Zend/zend_ini_scanner.c"
+#line 625 "Zend/zend_ini_scanner.c"
 yy16:
 		YYDEBUG(16, *YYCURSOR);
 		++YYCURSOR;
@@ -642,7 +643,7 @@ yy18:
 		if (yych == ' ') goto yy18;
 		YYDEBUG(20, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 491 "Zend/zend_ini_scanner.l"
+#line 492 "Zend/zend_ini_scanner.l"
 		{ /* Start option value */
 	if (SCNG(scanner_mode) == ZEND_INI_SCANNER_RAW) {
 		BEGIN(ST_RAW);
@@ -651,7 +652,7 @@ yy18:
 	}
 	return '=';
 }
-#line 655 "Zend/zend_ini_scanner.c"
+#line 656 "Zend/zend_ini_scanner.c"
 yy21:
 		YYDEBUG(21, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -707,7 +708,7 @@ yy26:
 		++YYCURSOR;
 		YYDEBUG(27, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 406 "Zend/zend_ini_scanner.l"
+#line 407 "Zend/zend_ini_scanner.l"
 		{ /* Section start */
 	/* Enter section data lookup state */
 	if (SCNG(scanner_mode) == ZEND_INI_SCANNER_RAW) {
@@ -717,7 +718,7 @@ yy26:
 	}
 	return TC_SECTION;
 }
-#line 721 "Zend/zend_ini_scanner.c"
+#line 722 "Zend/zend_ini_scanner.c"
 yy28:
 		YYDEBUG(28, *YYCURSOR);
 		++YYCURSOR;
@@ -728,7 +729,7 @@ yy28:
 		if (yych == ' ') goto yy28;
 		YYDEBUG(30, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 431 "Zend/zend_ini_scanner.l"
+#line 432 "Zend/zend_ini_scanner.l"
 		{ /* Start of option with offset */
 	/* Eat leading whitespace */
 	EAT_LEADING_WHITESPACE();
@@ -741,20 +742,20 @@ yy28:
 
 	RETURN_TOKEN(TC_OFFSET, yytext, yyleng);
 }
-#line 745 "Zend/zend_ini_scanner.c"
+#line 746 "Zend/zend_ini_scanner.c"
 yy31:
 		YYDEBUG(31, *YYCURSOR);
 		++YYCURSOR;
 yy32:
 		YYDEBUG(32, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 644 "Zend/zend_ini_scanner.l"
+#line 645 "Zend/zend_ini_scanner.l"
 		{ /* Comment */
 	BEGIN(INITIAL);
 	SCNG(lineno)++;
 	return END_OF_LINE;
 }
-#line 758 "Zend/zend_ini_scanner.c"
+#line 759 "Zend/zend_ini_scanner.c"
 yy33:
 		YYDEBUG(33, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -809,11 +810,11 @@ yy35:
 yy36:
 		YYDEBUG(36, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 473 "Zend/zend_ini_scanner.l"
+#line 474 "Zend/zend_ini_scanner.l"
 		{ /* FALSE value (when used outside option value/offset this causes parse error!)*/
 	RETURN_TOKEN(BOOL_FALSE, "", 0);
 }
-#line 817 "Zend/zend_ini_scanner.c"
+#line 818 "Zend/zend_ini_scanner.c"
 yy37:
 		YYDEBUG(37, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -870,11 +871,11 @@ yy39:
 yy41:
 		YYDEBUG(41, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 469 "Zend/zend_ini_scanner.l"
+#line 470 "Zend/zend_ini_scanner.l"
 		{ /* TRUE value (when used outside option value/offset this causes parse error!) */
 	RETURN_TOKEN(BOOL_TRUE, "1", 1);
 }
-#line 878 "Zend/zend_ini_scanner.c"
+#line 879 "Zend/zend_ini_scanner.c"
 yy42:
 		YYDEBUG(42, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -1021,11 +1022,11 @@ yy54:
 yy56:
 		YYDEBUG(56, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 477 "Zend/zend_ini_scanner.l"
+#line 478 "Zend/zend_ini_scanner.l"
 		{
 	RETURN_TOKEN(NULL_NULL, "", 0);
 }
-#line 1029 "Zend/zend_ini_scanner.c"
+#line 1030 "Zend/zend_ini_scanner.c"
 yy57:
 		YYDEBUG(57, *YYCURSOR);
 		++YYCURSOR;
@@ -1134,11 +1135,11 @@ yy62:
 yy63:
 		YYDEBUG(63, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 580 "Zend/zend_ini_scanner.l"
+#line 581 "Zend/zend_ini_scanner.l"
 		{ /* Get rest as section/offset value */
 	RETURN_TOKEN(TC_STRING, yytext, yyleng);
 }
-#line 1142 "Zend/zend_ini_scanner.c"
+#line 1143 "Zend/zend_ini_scanner.c"
 yy64:
 		YYDEBUG(64, *YYCURSOR);
 		yyaccept = 0;
@@ -1178,22 +1179,22 @@ yy66:
 yy67:
 		YYDEBUG(67, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 655 "Zend/zend_ini_scanner.l"
+#line 656 "Zend/zend_ini_scanner.l"
 		{
 	return 0;
 }
-#line 1186 "Zend/zend_ini_scanner.c"
+#line 1187 "Zend/zend_ini_scanner.c"
 yy68:
 		YYDEBUG(68, *YYCURSOR);
 		++YYCURSOR;
 		YYDEBUG(69, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 584 "Zend/zend_ini_scanner.l"
+#line 585 "Zend/zend_ini_scanner.l"
 		{ /* Double quoted '"' string start */
 	yy_push_state(ST_DOUBLE_QUOTES);
 	return '"';
 }
-#line 1197 "Zend/zend_ini_scanner.c"
+#line 1198 "Zend/zend_ini_scanner.c"
 yy70:
 		YYDEBUG(70, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -1258,11 +1259,11 @@ yy73:
 yy75:
 		YYDEBUG(75, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 558 "Zend/zend_ini_scanner.l"
+#line 559 "Zend/zend_ini_scanner.l"
 		{ /* Get number option value as string */
 	RETURN_TOKEN(TC_NUMBER, yytext, yyleng);
 }
-#line 1266 "Zend/zend_ini_scanner.c"
+#line 1267 "Zend/zend_ini_scanner.c"
 yy76:
 		YYDEBUG(76, *YYCURSOR);
 		yyaccept = 2;
@@ -1295,11 +1296,11 @@ yy76:
 yy78:
 		YYDEBUG(78, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 554 "Zend/zend_ini_scanner.l"
+#line 555 "Zend/zend_ini_scanner.l"
 		{ /* Get constant option value */
 	RETURN_TOKEN(TC_CONSTANT, yytext, yyleng);
 }
-#line 1303 "Zend/zend_ini_scanner.c"
+#line 1304 "Zend/zend_ini_scanner.c"
 yy79:
 		YYDEBUG(79, *YYCURSOR);
 		++YYCURSOR;
@@ -1311,12 +1312,12 @@ yy80:
 		++YYCURSOR;
 		YYDEBUG(81, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 444 "Zend/zend_ini_scanner.l"
+#line 445 "Zend/zend_ini_scanner.l"
 		{ /* End of section or an option offset */
 	BEGIN(INITIAL);
 	return ']';
 }
-#line 1320 "Zend/zend_ini_scanner.c"
+#line 1321 "Zend/zend_ini_scanner.c"
 yy82:
 		YYDEBUG(82, *YYCURSOR);
 		++YYCURSOR;
@@ -1356,12 +1357,12 @@ yy86:
 		++YYCURSOR;
 		YYDEBUG(87, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 449 "Zend/zend_ini_scanner.l"
+#line 450 "Zend/zend_ini_scanner.l"
 		{ /* Variable start */
 	yy_push_state(ST_VARNAME);
 	return TC_DOLLAR_CURLY;
 }
-#line 1365 "Zend/zend_ini_scanner.c"
+#line 1366 "Zend/zend_ini_scanner.c"
 yy88:
 		YYDEBUG(88, *YYCURSOR);
 		++YYCURSOR;
@@ -1415,7 +1416,7 @@ yy92:
 		++YYCURSOR;
 		YYDEBUG(93, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 416 "Zend/zend_ini_scanner.l"
+#line 417 "Zend/zend_ini_scanner.l"
 		{ /* Raw string */
 	/* Eat leading and trailing single quotes */
 	if (yytext[0] == '\'' && yytext[yyleng - 1] == '\'') {
@@ -1424,7 +1425,7 @@ yy92:
 	}
 	RETURN_TOKEN(TC_RAW, yytext, yyleng);
 }
-#line 1428 "Zend/zend_ini_scanner.c"
+#line 1429 "Zend/zend_ini_scanner.c"
 	}
 /* *********************************** */
 yyc_ST_SECTION_VALUE:
@@ -1524,11 +1525,11 @@ yy97:
 yy98:
 		YYDEBUG(98, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 580 "Zend/zend_ini_scanner.l"
+#line 581 "Zend/zend_ini_scanner.l"
 		{ /* Get rest as section/offset value */
 	RETURN_TOKEN(TC_STRING, yytext, yyleng);
 }
-#line 1532 "Zend/zend_ini_scanner.c"
+#line 1533 "Zend/zend_ini_scanner.c"
 yy99:
 		YYDEBUG(99, *YYCURSOR);
 		yyaccept = 0;
@@ -1568,22 +1569,22 @@ yy101:
 yy102:
 		YYDEBUG(102, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 655 "Zend/zend_ini_scanner.l"
+#line 656 "Zend/zend_ini_scanner.l"
 		{
 	return 0;
 }
-#line 1576 "Zend/zend_ini_scanner.c"
+#line 1577 "Zend/zend_ini_scanner.c"
 yy103:
 		YYDEBUG(103, *YYCURSOR);
 		++YYCURSOR;
 		YYDEBUG(104, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 584 "Zend/zend_ini_scanner.l"
+#line 585 "Zend/zend_ini_scanner.l"
 		{ /* Double quoted '"' string start */
 	yy_push_state(ST_DOUBLE_QUOTES);
 	return '"';
 }
-#line 1587 "Zend/zend_ini_scanner.c"
+#line 1588 "Zend/zend_ini_scanner.c"
 yy105:
 		YYDEBUG(105, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -1648,11 +1649,11 @@ yy108:
 yy110:
 		YYDEBUG(110, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 558 "Zend/zend_ini_scanner.l"
+#line 559 "Zend/zend_ini_scanner.l"
 		{ /* Get number option value as string */
 	RETURN_TOKEN(TC_NUMBER, yytext, yyleng);
 }
-#line 1656 "Zend/zend_ini_scanner.c"
+#line 1657 "Zend/zend_ini_scanner.c"
 yy111:
 		YYDEBUG(111, *YYCURSOR);
 		yyaccept = 2;
@@ -1685,11 +1686,11 @@ yy111:
 yy113:
 		YYDEBUG(113, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 554 "Zend/zend_ini_scanner.l"
+#line 555 "Zend/zend_ini_scanner.l"
 		{ /* Get constant option value */
 	RETURN_TOKEN(TC_CONSTANT, yytext, yyleng);
 }
-#line 1693 "Zend/zend_ini_scanner.c"
+#line 1694 "Zend/zend_ini_scanner.c"
 yy114:
 		YYDEBUG(114, *YYCURSOR);
 		++YYCURSOR;
@@ -1713,13 +1714,13 @@ yy115:
 yy117:
 		YYDEBUG(117, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 425 "Zend/zend_ini_scanner.l"
+#line 426 "Zend/zend_ini_scanner.l"
 		{ /* End of section */
 	BEGIN(INITIAL);
 	SCNG(lineno)++;
 	return ']';
 }
-#line 1723 "Zend/zend_ini_scanner.c"
+#line 1724 "Zend/zend_ini_scanner.c"
 yy118:
 		YYDEBUG(118, *YYCURSOR);
 		++YYCURSOR;
@@ -1759,12 +1760,12 @@ yy122:
 		++YYCURSOR;
 		YYDEBUG(123, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 449 "Zend/zend_ini_scanner.l"
+#line 450 "Zend/zend_ini_scanner.l"
 		{ /* Variable start */
 	yy_push_state(ST_VARNAME);
 	return TC_DOLLAR_CURLY;
 }
-#line 1768 "Zend/zend_ini_scanner.c"
+#line 1769 "Zend/zend_ini_scanner.c"
 yy124:
 		YYDEBUG(124, *YYCURSOR);
 		++YYCURSOR;
@@ -1827,7 +1828,7 @@ yy130:
 		++YYCURSOR;
 		YYDEBUG(131, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 416 "Zend/zend_ini_scanner.l"
+#line 417 "Zend/zend_ini_scanner.l"
 		{ /* Raw string */
 	/* Eat leading and trailing single quotes */
 	if (yytext[0] == '\'' && yytext[yyleng - 1] == '\'') {
@@ -1836,7 +1837,7 @@ yy130:
 	}
 	RETURN_TOKEN(TC_RAW, yytext, yyleng);
 }
-#line 1840 "Zend/zend_ini_scanner.c"
+#line 1841 "Zend/zend_ini_scanner.c"
 	}
 /* *********************************** */
 yyc_ST_VALUE:
@@ -1972,12 +1973,12 @@ yy134:
 yy135:
 		YYDEBUG(135, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 650 "Zend/zend_ini_scanner.l"
+#line 651 "Zend/zend_ini_scanner.l"
 		{ /* End of option value (if EOF is reached before EOL */
 	BEGIN(INITIAL);
 	return END_OF_LINE;
 }
-#line 1981 "Zend/zend_ini_scanner.c"
+#line 1982 "Zend/zend_ini_scanner.c"
 yy136:
 		YYDEBUG(136, *YYCURSOR);
 		yyaccept = 0;
@@ -1994,11 +1995,11 @@ yy137:
 yy138:
 		YYDEBUG(138, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 576 "Zend/zend_ini_scanner.l"
+#line 577 "Zend/zend_ini_scanner.l"
 		{ /* Get everything else as option/offset value */
 	RETURN_TOKEN(TC_STRING, yytext, yyleng);
 }
-#line 2002 "Zend/zend_ini_scanner.c"
+#line 2003 "Zend/zend_ini_scanner.c"
 yy139:
 		YYDEBUG(139, *YYCURSOR);
 		++YYCURSOR;
@@ -2022,24 +2023,24 @@ yy139:
 yy141:
 		YYDEBUG(141, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 630 "Zend/zend_ini_scanner.l"
+#line 631 "Zend/zend_ini_scanner.l"
 		{
 	RETURN_TOKEN(TC_WHITESPACE, yytext, yyleng);
 }
-#line 2030 "Zend/zend_ini_scanner.c"
+#line 2031 "Zend/zend_ini_scanner.c"
 yy142:
 		YYDEBUG(142, *YYCURSOR);
 		++YYCURSOR;
 yy143:
 		YYDEBUG(143, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 548 "Zend/zend_ini_scanner.l"
+#line 549 "Zend/zend_ini_scanner.l"
 		{ /* End of option value */
 	BEGIN(INITIAL);
 	SCNG(lineno)++;
 	return END_OF_LINE;
 }
-#line 2043 "Zend/zend_ini_scanner.c"
+#line 2044 "Zend/zend_ini_scanner.c"
 yy144:
 		YYDEBUG(144, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -2055,22 +2056,22 @@ yy145:
 		if (yych == ' ') goto yy145;
 		YYDEBUG(147, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 566 "Zend/zend_ini_scanner.l"
+#line 567 "Zend/zend_ini_scanner.l"
 		{ /* Boolean operators */
 	return yytext[0];
 }
-#line 2063 "Zend/zend_ini_scanner.c"
+#line 2064 "Zend/zend_ini_scanner.c"
 yy148:
 		YYDEBUG(148, *YYCURSOR);
 		++YYCURSOR;
 		YYDEBUG(149, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 584 "Zend/zend_ini_scanner.l"
+#line 585 "Zend/zend_ini_scanner.l"
 		{ /* Double quoted '"' string start */
 	yy_push_state(ST_DOUBLE_QUOTES);
 	return '"';
 }
-#line 2074 "Zend/zend_ini_scanner.c"
+#line 2075 "Zend/zend_ini_scanner.c"
 yy150:
 		YYDEBUG(150, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -2144,11 +2145,11 @@ yy153:
 yy155:
 		YYDEBUG(155, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 558 "Zend/zend_ini_scanner.l"
+#line 559 "Zend/zend_ini_scanner.l"
 		{ /* Get number option value as string */
 	RETURN_TOKEN(TC_NUMBER, yytext, yyleng);
 }
-#line 2152 "Zend/zend_ini_scanner.c"
+#line 2153 "Zend/zend_ini_scanner.c"
 yy156:
 		YYDEBUG(156, *YYCURSOR);
 		++YYCURSOR;
@@ -2165,13 +2166,13 @@ yy158:
 		++YYCURSOR;
 		YYDEBUG(159, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 570 "Zend/zend_ini_scanner.l"
+#line 571 "Zend/zend_ini_scanner.l"
 		{ /* Make = used in option value to trigger error */
 	yyless(0);
 	BEGIN(INITIAL);
 	return END_OF_LINE;
 }
-#line 2175 "Zend/zend_ini_scanner.c"
+#line 2176 "Zend/zend_ini_scanner.c"
 yy160:
 		YYDEBUG(160, *YYCURSOR);
 		yyaccept = 2;
@@ -2218,11 +2219,11 @@ yy160:
 yy162:
 		YYDEBUG(162, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 554 "Zend/zend_ini_scanner.l"
+#line 555 "Zend/zend_ini_scanner.l"
 		{ /* Get constant option value */
 	RETURN_TOKEN(TC_CONSTANT, yytext, yyleng);
 }
-#line 2226 "Zend/zend_ini_scanner.c"
+#line 2227 "Zend/zend_ini_scanner.c"
 yy163:
 		YYDEBUG(163, *YYCURSOR);
 		yyaccept = 2;
@@ -2556,12 +2557,12 @@ yy171:
 		++YYCURSOR;
 		YYDEBUG(172, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 449 "Zend/zend_ini_scanner.l"
+#line 450 "Zend/zend_ini_scanner.l"
 		{ /* Variable start */
 	yy_push_state(ST_VARNAME);
 	return TC_DOLLAR_CURLY;
 }
-#line 2565 "Zend/zend_ini_scanner.c"
+#line 2566 "Zend/zend_ini_scanner.c"
 yy173:
 		YYDEBUG(173, *YYCURSOR);
 		++YYCURSOR;
@@ -2627,13 +2628,13 @@ yy177:
 yy178:
 		YYDEBUG(178, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 644 "Zend/zend_ini_scanner.l"
+#line 645 "Zend/zend_ini_scanner.l"
 		{ /* Comment */
 	BEGIN(INITIAL);
 	SCNG(lineno)++;
 	return END_OF_LINE;
 }
-#line 2637 "Zend/zend_ini_scanner.c"
+#line 2638 "Zend/zend_ini_scanner.c"
 yy179:
 		YYDEBUG(179, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -2744,11 +2745,11 @@ yy181:
 yy182:
 		YYDEBUG(182, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 473 "Zend/zend_ini_scanner.l"
+#line 474 "Zend/zend_ini_scanner.l"
 		{ /* FALSE value (when used outside option value/offset this causes parse error!)*/
 	RETURN_TOKEN(BOOL_FALSE, "", 0);
 }
-#line 2752 "Zend/zend_ini_scanner.c"
+#line 2753 "Zend/zend_ini_scanner.c"
 yy183:
 		YYDEBUG(183, *YYCURSOR);
 		yyaccept = 2;
@@ -2895,11 +2896,11 @@ yy185:
 yy186:
 		YYDEBUG(186, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 469 "Zend/zend_ini_scanner.l"
+#line 470 "Zend/zend_ini_scanner.l"
 		{ /* TRUE value (when used outside option value/offset this causes parse error!) */
 	RETURN_TOKEN(BOOL_TRUE, "1", 1);
 }
-#line 2903 "Zend/zend_ini_scanner.c"
+#line 2904 "Zend/zend_ini_scanner.c"
 yy187:
 		YYDEBUG(187, *YYCURSOR);
 		yyaccept = 2;
@@ -3019,7 +3020,7 @@ yy191:
 		++YYCURSOR;
 		YYDEBUG(192, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 416 "Zend/zend_ini_scanner.l"
+#line 417 "Zend/zend_ini_scanner.l"
 		{ /* Raw string */
 	/* Eat leading and trailing single quotes */
 	if (yytext[0] == '\'' && yytext[yyleng - 1] == '\'') {
@@ -3028,7 +3029,7 @@ yy191:
 	}
 	RETURN_TOKEN(TC_RAW, yytext, yyleng);
 }
-#line 3032 "Zend/zend_ini_scanner.c"
+#line 3033 "Zend/zend_ini_scanner.c"
 yy193:
 		YYDEBUG(193, *YYCURSOR);
 		yyaccept = 2;
@@ -3343,11 +3344,11 @@ yy202:
 yy203:
 		YYDEBUG(203, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 477 "Zend/zend_ini_scanner.l"
+#line 478 "Zend/zend_ini_scanner.l"
 		{
 	RETURN_TOKEN(NULL_NULL, "", 0);
 }
-#line 3351 "Zend/zend_ini_scanner.c"
+#line 3352 "Zend/zend_ini_scanner.c"
 yy204:
 		YYDEBUG(204, *YYCURSOR);
 		++YYCURSOR;
@@ -3414,21 +3415,21 @@ yy208:
 		}
 		YYDEBUG(210, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 544 "Zend/zend_ini_scanner.l"
+#line 545 "Zend/zend_ini_scanner.l"
 		{ /* Raw value, only used when SCNG(scanner_mode) == ZEND_INI_SCANNER_RAW. */
 	RETURN_TOKEN(TC_RAW, yytext, yyleng);
 }
-#line 3422 "Zend/zend_ini_scanner.c"
+#line 3423 "Zend/zend_ini_scanner.c"
 yy211:
 		YYDEBUG(211, *YYCURSOR);
 		++YYCURSOR;
 		YYDEBUG(212, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 655 "Zend/zend_ini_scanner.l"
+#line 656 "Zend/zend_ini_scanner.l"
 		{
 	return 0;
 }
-#line 3432 "Zend/zend_ini_scanner.c"
+#line 3433 "Zend/zend_ini_scanner.c"
 yy213:
 		YYDEBUG(213, *YYCURSOR);
 		++YYCURSOR;
@@ -3444,13 +3445,13 @@ yy213:
 yy215:
 		YYDEBUG(215, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 425 "Zend/zend_ini_scanner.l"
+#line 426 "Zend/zend_ini_scanner.l"
 		{ /* End of section */
 	BEGIN(INITIAL);
 	SCNG(lineno)++;
 	return ']';
 }
-#line 3454 "Zend/zend_ini_scanner.c"
+#line 3455 "Zend/zend_ini_scanner.c"
 yy216:
 		YYDEBUG(216, *YYCURSOR);
 		++YYCURSOR;
@@ -3508,7 +3509,7 @@ yyc_ST_DOUBLE_QUOTES:
 yy221:
 		YYDEBUG(221, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 594 "Zend/zend_ini_scanner.l"
+#line 595 "Zend/zend_ini_scanner.l"
 		{ /* Escape double quoted string contents */
 	if (YYCURSOR > YYLIMIT) {
 		return 0;
@@ -3544,7 +3545,7 @@ yy221:
 	zend_ini_escape_string(ini_lval, yytext, yyleng, '"');
 	return TC_QUOTED_STRING;
 }
-#line 3548 "Zend/zend_ini_scanner.c"
+#line 3549 "Zend/zend_ini_scanner.c"
 yy222:
 		YYDEBUG(222, *YYCURSOR);
 		++YYCURSOR;
@@ -3556,12 +3557,12 @@ yy222:
 		}
 		YYDEBUG(224, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 589 "Zend/zend_ini_scanner.l"
+#line 590 "Zend/zend_ini_scanner.l"
 		{ /* Double quoted '"' string ends */
 	yy_pop_state();
 	return '"';
 }
-#line 3565 "Zend/zend_ini_scanner.c"
+#line 3566 "Zend/zend_ini_scanner.c"
 yy225:
 		YYDEBUG(225, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -3570,12 +3571,12 @@ yy225:
 		++YYCURSOR;
 		YYDEBUG(227, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 449 "Zend/zend_ini_scanner.l"
+#line 450 "Zend/zend_ini_scanner.l"
 		{ /* Variable start */
 	yy_push_state(ST_VARNAME);
 	return TC_DOLLAR_CURLY;
 }
-#line 3579 "Zend/zend_ini_scanner.c"
+#line 3580 "Zend/zend_ini_scanner.c"
 	}
 /* *********************************** */
 yyc_ST_VARNAME:
@@ -3633,7 +3634,7 @@ yy230:
 		}
 		YYDEBUG(232, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 454 "Zend/zend_ini_scanner.l"
+#line 455 "Zend/zend_ini_scanner.l"
 		{ /* Variable name */
 	/* Eat leading whitespace */
 	EAT_LEADING_WHITESPACE();
@@ -3643,28 +3644,28 @@ yy230:
 
 	RETURN_TOKEN(TC_VARNAME, yytext, yyleng);
 }
-#line 3647 "Zend/zend_ini_scanner.c"
+#line 3648 "Zend/zend_ini_scanner.c"
 yy233:
 		YYDEBUG(233, *YYCURSOR);
 		++YYCURSOR;
 		YYDEBUG(234, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 655 "Zend/zend_ini_scanner.l"
+#line 656 "Zend/zend_ini_scanner.l"
 		{
 	return 0;
 }
-#line 3657 "Zend/zend_ini_scanner.c"
+#line 3658 "Zend/zend_ini_scanner.c"
 yy235:
 		YYDEBUG(235, *YYCURSOR);
 		++YYCURSOR;
 		YYDEBUG(236, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 464 "Zend/zend_ini_scanner.l"
+#line 465 "Zend/zend_ini_scanner.l"
 		{ /* Variable end */
 	yy_pop_state();
 	return '}';
 }
-#line 3668 "Zend/zend_ini_scanner.c"
+#line 3669 "Zend/zend_ini_scanner.c"
 	}
 /* *********************************** */
 yyc_ST_RAW:
@@ -3728,19 +3729,19 @@ yyc_ST_RAW:
 		++YYCURSOR;
 		YYDEBUG(240, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 650 "Zend/zend_ini_scanner.l"
+#line 651 "Zend/zend_ini_scanner.l"
 		{ /* End of option value (if EOF is reached before EOL */
 	BEGIN(INITIAL);
 	return END_OF_LINE;
 }
-#line 3737 "Zend/zend_ini_scanner.c"
+#line 3738 "Zend/zend_ini_scanner.c"
 yy241:
 		YYDEBUG(241, *YYCURSOR);
 		++YYCURSOR;
 yy242:
 		YYDEBUG(242, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 500 "Zend/zend_ini_scanner.l"
+#line 501 "Zend/zend_ini_scanner.l"
 		{ /* Raw value, only used when SCNG(scanner_mode) == ZEND_INI_SCANNER_RAW. */
 	unsigned char *sc = NULL;
 	EAT_LEADING_WHITESPACE();
@@ -3784,7 +3785,7 @@ end_raw_value_chars:
 
 	RETURN_TOKEN(TC_RAW, yytext, yyleng);
 }
-#line 3788 "Zend/zend_ini_scanner.c"
+#line 3789 "Zend/zend_ini_scanner.c"
 yy243:
 		YYDEBUG(243, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -3808,13 +3809,13 @@ yy244:
 yy245:
 		YYDEBUG(245, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 548 "Zend/zend_ini_scanner.l"
+#line 549 "Zend/zend_ini_scanner.l"
 		{ /* End of option value */
 	BEGIN(INITIAL);
 	SCNG(lineno)++;
 	return END_OF_LINE;
 }
-#line 3818 "Zend/zend_ini_scanner.c"
+#line 3819 "Zend/zend_ini_scanner.c"
 yy246:
 		YYDEBUG(246, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -3851,25 +3852,25 @@ yy250:
 yy251:
 		YYDEBUG(251, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 634 "Zend/zend_ini_scanner.l"
+#line 635 "Zend/zend_ini_scanner.l"
 		{
 	/* eat whitespace */
 	goto restart;
 }
-#line 3860 "Zend/zend_ini_scanner.c"
+#line 3861 "Zend/zend_ini_scanner.c"
 yy252:
 		YYDEBUG(252, *YYCURSOR);
 		++YYCURSOR;
 yy253:
 		YYDEBUG(253, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 644 "Zend/zend_ini_scanner.l"
+#line 645 "Zend/zend_ini_scanner.l"
 		{ /* Comment */
 	BEGIN(INITIAL);
 	SCNG(lineno)++;
 	return END_OF_LINE;
 }
-#line 3873 "Zend/zend_ini_scanner.c"
+#line 3874 "Zend/zend_ini_scanner.c"
 yy254:
 		YYDEBUG(254, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -3877,6 +3878,6 @@ yy254:
 		goto yy253;
 	}
 }
-#line 659 "Zend/zend_ini_scanner.l"
+#line 660 "Zend/zend_ini_scanner.l"
 
 }

Zend/zend_ini_scanner.l

@@ -140,13 +140,14 @@ ZEND_API zend_ini_scanner_globals ini_scanner_globals;
 	ZVAL_NEW_STR(retval, zend_string_init(str, len, ZEND_SYSTEM_INI))
 
 
-#define RETURN_TOKEN(type, str, len) {                       \
-	if (SCNG(scanner_mode) == ZEND_INI_SCANNER_TYPED) {      \
-		zend_ini_copy_typed_value(ini_lval, type, str, len); \
-	} else {                                                 \
-		zend_ini_copy_value(ini_lval, str, len);             \
-	}                                                        \
-	return type;                                             \
+#define RETURN_TOKEN(type, str, len) {                             \
+	if (SCNG(scanner_mode) == ZEND_INI_SCANNER_TYPED &&            \
+		(YYSTATE == STATE(ST_VALUE) || YYSTATE == STATE(ST_RAW))) {\
+		zend_ini_copy_typed_value(ini_lval, type, str, len);       \
+	} else {                                                       \
+		zend_ini_copy_value(ini_lval, str, len);                   \
+	}                                                              \
+	return type;                                                   \
 }
 
 static inline int convert_to_number(zval *retval, const char *str, const int str_len)

Zend/zend_object_handlers.c

@@ -1374,14 +1374,14 @@ ZEND_API zend_function *zend_std_get_static_method(zend_class_entry *ce, zend_st
 }
 /* }}} */
 
-static void zend_intenal_class_init_statics(zend_class_entry *class_type) /* {{{ */
+ZEND_API void zend_class_init_statics(zend_class_entry *class_type) /* {{{ */
 {
 	int i;
 	zval *p;
 
 	if (!CE_STATIC_MEMBERS(class_type) && class_type->default_static_members_count) {
 		if (class_type->parent) {
-			zend_intenal_class_init_statics(class_type->parent);
+			zend_class_init_statics(class_type->parent);
 		}
 
 #if ZTS
@@ -1431,7 +1431,7 @@ ZEND_API zval *zend_std_get_static_property(zend_class_entry *ce, zend_string *p
 	/* check if static properties were destoyed */
 	if (UNEXPECTED(CE_STATIC_MEMBERS(ce) == NULL)) {
 		if (ce->type == ZEND_INTERNAL_CLASS) {
-			zend_intenal_class_init_statics(ce);
+			zend_class_init_statics(ce);
 		} else {
 undeclared_property:
 			if (!silent) {

Zend/zend_object_handlers.h

@@ -175,6 +175,7 @@ extern const ZEND_API zend_object_handlers std_object_handlers;
 #define ZEND_PROPERTY_NOT_EMPTY ZEND_ISEMPTY /* Property is not empty */
 #define ZEND_PROPERTY_EXISTS    0x2          /* Property exists */
 
+ZEND_API void zend_class_init_statics(zend_class_entry *ce);
 ZEND_API zend_function *zend_std_get_static_method(zend_class_entry *ce, zend_string *function_name_strval, const zval *key);
 ZEND_API zval *zend_std_get_static_property(zend_class_entry *ce, zend_string *property_name, zend_bool silent);
 ZEND_API ZEND_COLD zend_bool zend_std_unset_static_property(zend_class_entry *ce, zend_string *property_name);

Zend/zend_portability.h

@@ -577,7 +577,7 @@ static zend_always_inline double _zend_get_nan(void) /* {{{ */
 # define ZEND_INTRIN_SSSE3_FUNC_DECL(func)
 #endif
 
-#ifdef __SSE4_2__
+#if defined(HAVE_SSE4_2_DEF) || (defined(ZEND_WIN32) && defined(__SSE4_2__))
 /* Instructions compiled directly. */
 # define ZEND_INTRIN_SSE4_2_NATIVE 1
 #elif (defined(HAVE_FUNC_ATTRIBUTE_TARGET) && defined(PHP_HAVE_SSE4_2)) || defined(ZEND_WIN32)

Zend/zend_signal.c

@@ -397,7 +397,7 @@ void zend_signal_init(void) /* {{{ */
 
 /* {{{ zend_signal_startup
  * alloc zend signal globals */
-void zend_signal_startup(void)
+ZEND_API void zend_signal_startup(void)
 {
 
 #ifdef ZTS

Zend/zend_signal.h

@@ -87,7 +87,7 @@ ZEND_API void zend_signal_handler_unblock(void);
 void zend_signal_activate(void);
 void zend_signal_deactivate(void);
 BEGIN_EXTERN_C()
-void zend_signal_startup(void);
+ZEND_API void zend_signal_startup(void);
 END_EXTERN_C()
 void zend_signal_init(void);
 

Zend/zend_smart_str.c

@@ -155,7 +155,12 @@ ZEND_API void ZEND_FASTCALL _smart_string_alloc(smart_string *str, size_t len)
 			str->c = emalloc(SMART_STRING_START_LEN + 1);
 		} else {
 			str->a = ZEND_MM_ALIGNED_SIZE_EX(len + SMART_STRING_OVERHEAD, SMART_STRING_PAGE) - SMART_STRING_OVERHEAD;
-			str->c = emalloc_large(str->a + 1);
+			if (EXPECTED(str->a < (ZEND_MM_CHUNK_SIZE - SMART_STRING_OVERHEAD))) {
+				str->c = emalloc_large(str->a + 1);
+			} else {
+				/* allocate a huge chunk */
+				str->c = emalloc(str->a + 1);
+			}
 		}
 	} else {
 		if (UNEXPECTED((size_t) len > SIZE_MAX - str->len)) {

Zend/zend_string.c

@@ -392,7 +392,7 @@ ZEND_API zend_bool ZEND_FASTCALL I_WRAP_SONAME_FNNAME_ZU(NONE,zend_string_equal_
 }
 #endif
 
-#elif defined(__GNUC__) && defined(__x86_64__)
+#elif defined(__GNUC__) && defined(__x86_64__) && !defined(__ILP32__)
 ZEND_API zend_bool ZEND_FASTCALL zend_string_equal_val(zend_string *s1, zend_string *s2)
 {
 	char *ptr = ZSTR_VAL(s1);

Zend/zend_string.h

@@ -294,7 +294,7 @@ static zend_always_inline void zend_string_release_ex(zend_string *s, int persis
 	}
 }
 
-#if defined(__GNUC__) && (defined(__i386__) || defined(__x86_64__))
+#if defined(__GNUC__) && (defined(__i386__) || (defined(__x86_64__) && !defined(__ILP32__)))
 BEGIN_EXTERN_C()
 ZEND_API zend_bool ZEND_FASTCALL zend_string_equal_val(zend_string *s1, zend_string *s2);
 END_EXTERN_C()

Zend/zend_types.h

@@ -570,6 +570,14 @@ static zend_always_inline uint32_t zval_gc_info(uint32_t gc_type_info) {
 		GC_DEL_FLAGS(p, GC_PROTECTED); \
 	} while (0)
 
+#define GC_TRY_PROTECT_RECURSION(p) do { \
+		if (!(GC_FLAGS(p) & GC_IMMUTABLE)) GC_PROTECT_RECURSION(p); \
+	} while (0)
+
+#define GC_TRY_UNPROTECT_RECURSION(p) do { \
+		if (!(GC_FLAGS(p) & GC_IMMUTABLE)) GC_UNPROTECT_RECURSION(p); \
+	} while (0)
+
 #define Z_IS_RECURSIVE(zval)        GC_IS_RECURSIVE(Z_COUNTED(zval))
 #define Z_PROTECT_RECURSION(zval)   GC_PROTECT_RECURSION(Z_COUNTED(zval))
 #define Z_UNPROTECT_RECURSION(zval) GC_UNPROTECT_RECURSION(Z_COUNTED(zval))

Zend/zend_virtual_cwd.c

@@ -764,7 +764,7 @@ static size_t tsrm_realpath_r(char *path, size_t start, size_t len, int *ll, tim
 		if (i == len ||
 			(i + 1 == len && path[i] == '.')) {
 			/* remove double slashes and '.' */
-			len = i - 1;
+			len = EXPECTED(i > 0) ? i - 1 : 0;
 			is_dir = 1;
 			continue;
 		} else if (i + 2 == len && path[i] == '.' && path[i+1] == '.') {
@@ -1207,40 +1207,6 @@ static size_t tsrm_realpath_r(char *path, size_t start, size_t len, int *ll, tim
 }
 /* }}} */
 
-#ifdef ZEND_WIN32
-static size_t tsrm_win32_realpath_quick(char *path, size_t len, time_t *t) /* {{{ */
-{
-	char tmp_resolved_path[MAXPATHLEN];
-	int tmp_resolved_path_len;
-	BY_HANDLE_FILE_INFORMATION info;
-	realpath_cache_bucket *bucket;
-
-	if (!*t) {
-		*t = time(0);
-	}
-
-	if (CWDG(realpath_cache_size_limit) && (bucket = realpath_cache_find(path, len, *t)) != NULL) {
-		memcpy(path, bucket->realpath, bucket->realpath_len + 1);
-		return bucket->realpath_len;
-	}
-
-	if (!php_win32_ioutil_realpath_ex0(path, tmp_resolved_path, &info)) {
-		DWORD err = GetLastError();
-		SET_ERRNO_FROM_WIN32_CODE(err);
-		return (size_t)-1;
-	}
-
-	tmp_resolved_path_len = strlen(tmp_resolved_path);
-	if (CWDG(realpath_cache_size_limit)) {
-		realpath_cache_add(path, len, tmp_resolved_path, tmp_resolved_path_len, info.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY, *t);
-	}
-	memmove(path, tmp_resolved_path, tmp_resolved_path_len + 1);
-
-	return tmp_resolved_path_len;
-}
-/* }}} */
-#endif
-
 /* Resolve path relatively to state and put the real path into state */
 /* returns 0 for ok, 1 for error */
 CWD_API int virtual_file_ex(cwd_state *state, const char *path, verify_path_func verify_path, int use_realpath) /* {{{ */
@@ -1368,27 +1334,7 @@ CWD_API int virtual_file_ex(cwd_state *state, const char *path, verify_path_func
 
 	add_slash = (use_realpath != CWD_REALPATH) && path_length > 0 && IS_SLASH(resolved_path[path_length-1]);
 	t = CWDG(realpath_cache_ttl) ? 0 : -1;
-#ifdef ZEND_WIN32
-	if (CWD_EXPAND != use_realpath) {
-		size_t tmp_len = tsrm_win32_realpath_quick(resolved_path, path_length, &t);
-		if ((size_t)-1 != tmp_len) {
-			path_length = tmp_len;
-		} else {
-			DWORD err = GetLastError();
-			/* The access denied error can mean something completely else,
-				fallback to complicated way. */
-			if (CWD_REALPATH == use_realpath && ERROR_ACCESS_DENIED != err) {
-				SET_ERRNO_FROM_WIN32_CODE(err);
-				return 1;
-			}
-			path_length = tsrm_realpath_r(resolved_path, start, path_length, &ll, &t, use_realpath, 0, NULL);
-		}
-	} else {
-		path_length = tsrm_realpath_r(resolved_path, start, path_length, &ll, &t, use_realpath, 0, NULL);
-	}
-#else
 	path_length = tsrm_realpath_r(resolved_path, start, path_length, &ll, &t, use_realpath, 0, NULL);
-#endif
 
 	if (path_length == (size_t)-1) {
 		errno = ENOENT;

Zend/zend_vm_def.h

@@ -3099,6 +3099,10 @@ ZEND_VM_HOT_OBJ_HANDLER(112, ZEND_INIT_METHOD_CALL, CONST|TMPVAR|UNUSED|THIS|CV,
 		    EXPECTED(obj == orig_obj)) {
 			CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
 		}
+		if ((OP1_TYPE & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+			/* Reset "object" to trigger reference counting */
+			object = NULL;
+		}
 		if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
 			init_func_run_time_cache(&fbc->op_array);
 		}
@@ -3443,11 +3447,10 @@ ZEND_VM_HOT_HANDLER(69, ZEND_INIT_NS_FCALL_BY_NAME, ANY, CONST, NUM|CACHE_SLOT)
 
 	fbc = CACHED_PTR(opline->result.num);
 	if (UNEXPECTED(fbc == NULL)) {
-		func_name = RT_CONSTANT(opline, opline->op2) + 1;
-		func = zend_hash_find_ex(EG(function_table), Z_STR_P(func_name), 1);
+		func_name = (zval *)RT_CONSTANT(opline, opline->op2);
+		func = zend_hash_find_ex(EG(function_table), Z_STR_P(func_name + 1), 1);
 		if (func == NULL) {
-			func_name++;
-			func = zend_hash_find_ex(EG(function_table), Z_STR_P(func_name), 1);
+			func = zend_hash_find_ex(EG(function_table), Z_STR_P(func_name + 2), 1);
 			if (UNEXPECTED(func == NULL)) {
 				ZEND_VM_DISPATCH_TO_HELPER(zend_undefined_function_helper, function_name, func_name);
 			}

Zend/zend_vm_execute.h

@@ -2153,11 +2153,10 @@ static ZEND_VM_HOT ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_NS_FCALL_BY_N
 
 	fbc = CACHED_PTR(opline->result.num);
 	if (UNEXPECTED(fbc == NULL)) {
-		func_name = RT_CONSTANT(opline, opline->op2) + 1;
-		func = zend_hash_find_ex(EG(function_table), Z_STR_P(func_name), 1);
+		func_name = (zval *)RT_CONSTANT(opline, opline->op2);
+		func = zend_hash_find_ex(EG(function_table), Z_STR_P(func_name + 1), 1);
 		if (func == NULL) {
-			func_name++;
-			func = zend_hash_find_ex(EG(function_table), Z_STR_P(func_name), 1);
+			func = zend_hash_find_ex(EG(function_table), Z_STR_P(func_name + 2), 1);
 			if (UNEXPECTED(func == NULL)) {
 				ZEND_VM_TAIL_CALL(zend_undefined_function_helper_SPEC(func_name ZEND_OPCODE_HANDLER_ARGS_PASSTHRU_CC));
 			}
@@ -5149,6 +5148,10 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_
 		    EXPECTED(obj == orig_obj)) {
 			CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
 		}
+		if ((IS_CONST & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+			/* Reset "object" to trigger reference counting */
+			object = NULL;
+		}
 		if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
 			init_func_run_time_cache(&fbc->op_array);
 		}
@@ -7326,6 +7329,10 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_
 		    EXPECTED(obj == orig_obj)) {
 			CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
 		}
+		if ((IS_CONST & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+			/* Reset "object" to trigger reference counting */
+			object = NULL;
+		}
 		if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
 			init_func_run_time_cache(&fbc->op_array);
 		}
@@ -10422,6 +10429,10 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_
 		    EXPECTED(obj == orig_obj)) {
 			CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
 		}
+		if ((IS_CONST & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+			/* Reset "object" to trigger reference counting */
+			object = NULL;
+		}
 		if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
 			init_func_run_time_cache(&fbc->op_array);
 		}
@@ -14150,6 +14161,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_TMPVAR_C
 		    EXPECTED(obj == orig_obj)) {
 			CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
 		}
+		if (((IS_TMP_VAR|IS_VAR) & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+			/* Reset "object" to trigger reference counting */
+			object = NULL;
+		}
 		if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
 			init_func_run_time_cache(&fbc->op_array);
 		}
@@ -15760,6 +15775,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_TMPVAR_T
 		    EXPECTED(obj == orig_obj)) {
 			CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
 		}
+		if (((IS_TMP_VAR|IS_VAR) & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+			/* Reset "object" to trigger reference counting */
+			object = NULL;
+		}
 		if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
 			init_func_run_time_cache(&fbc->op_array);
 		}
@@ -17637,6 +17656,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_TMPVAR_C
 		    EXPECTED(obj == orig_obj)) {
 			CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
 		}
+		if (((IS_TMP_VAR|IS_VAR) & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+			/* Reset "object" to trigger reference counting */
+			object = NULL;
+		}
 		if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
 			init_func_run_time_cache(&fbc->op_array);
 		}
@@ -32082,6 +32105,10 @@ static ZEND_VM_HOT ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_S
 		    EXPECTED(obj == orig_obj)) {
 			CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
 		}
+		if ((IS_UNUSED & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+			/* Reset "object" to trigger reference counting */
+			object = NULL;
+		}
 		if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
 			init_func_run_time_cache(&fbc->op_array);
 		}
@@ -33813,6 +33840,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_UNUSED_T
 		    EXPECTED(obj == orig_obj)) {
 			CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
 		}
+		if ((IS_UNUSED & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+			/* Reset "object" to trigger reference counting */
+			object = NULL;
+		}
 		if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
 			init_func_run_time_cache(&fbc->op_array);
 		}
@@ -36188,6 +36219,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_UNUSED_C
 		    EXPECTED(obj == orig_obj)) {
 			CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
 		}
+		if ((IS_UNUSED & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+			/* Reset "object" to trigger reference counting */
+			object = NULL;
+		}
 		if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
 			init_func_run_time_cache(&fbc->op_array);
 		}
@@ -41209,6 +41244,10 @@ static ZEND_VM_HOT ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_S
 		    EXPECTED(obj == orig_obj)) {
 			CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
 		}
+		if ((IS_CV & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+			/* Reset "object" to trigger reference counting */
+			object = NULL;
+		}
 		if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
 			init_func_run_time_cache(&fbc->op_array);
 		}
@@ -44972,6 +45011,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_CV_TMPVA
 		    EXPECTED(obj == orig_obj)) {
 			CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
 		}
+		if ((IS_CV & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+			/* Reset "object" to trigger reference counting */
+			object = NULL;
+		}
 		if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
 			init_func_run_time_cache(&fbc->op_array);
 		}
@@ -50770,6 +50813,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_CV_CV_HA
 		    EXPECTED(obj == orig_obj)) {
 			CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
 		}
+		if ((IS_CV & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+			/* Reset "object" to trigger reference counting */
+			object = NULL;
+		}
 		if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
 			init_func_run_time_cache(&fbc->op_array);
 		}

Zend/zend_vm_gen.php

@@ -992,7 +992,7 @@ function gen_code($f, $spec, $kind, $export, $code, $op1, $op2, $name, $extra_sp
 	}
 
 	/* Remove unused free_op1 and free_op2 declarations */
-	if ($spec && preg_match_all('/^\s*zend_free_op\s+[^;]+;\s*$/me', $code, $matches, PREG_SET_ORDER)) {
+	if ($spec && preg_match_all('/^\s*zend_free_op\s+[^;]+;\s*$/m', $code, $matches, PREG_SET_ORDER)) {
 		$n = 0;
 		foreach ($matches as $match) {
 		  $code = preg_replace('/'.preg_quote($match[0],'/').'/', "\$D$n", $code);
@@ -2671,6 +2671,7 @@ function gen_vm($def, $skel) {
 
 	// Generate specialized executor
 	gen_executor($f, $skl, ZEND_VM_SPEC, ZEND_VM_KIND, "execute", "zend_vm_init");
+	out($f, "\n");
 
 	// Generate zend_vm_get_opcode_handler() function
 	out($f, "static const void* ZEND_FASTCALL zend_vm_get_opcode_handler_ex(uint32_t spec, const zend_op* op)\n");

acinclude.m4

@@ -2173,50 +2173,84 @@ AC_DEFUN([PHP_SETUP_ICU],[
     PHP_ICU_DIR=DEFAULT
   fi
 
-  if test "$PHP_ICU_DIR" = "DEFAULT"; then
-    dnl Try to find icu-config
-    AC_PATH_PROG(ICU_CONFIG, icu-config, no, [$PATH:/usr/local/bin])
-  else
-    ICU_CONFIG="$PHP_ICU_DIR/bin/icu-config"
+  AC_MSG_CHECKING([for location of ICU headers and libraries])
+  found_icu=no
+
+  dnl First try to find pkg-config
+  if test -z "$PKG_CONFIG"; then
+    AC_PATH_PROG(PKG_CONFIG, pkg-config, no)
   fi
 
-  AC_MSG_CHECKING([for location of ICU headers and libraries])
+  dnl If pkg-config is found try using it
+  if test "$PHP_ICU_DIR" = "DEFAULT" && test -x "$PKG_CONFIG" && $PKG_CONFIG --exists icu-uc icu-io icu-i18n; then
+    if $PKG_CONFIG --atleast-version=40 icu-uc; then
+      found_icu=yes
+      icu_version_full=`$PKG_CONFIG --modversion icu-uc`
+      ac_IFS=$IFS
+      IFS="."
+      set $icu_version_full
+      IFS=$ac_IFS
+      icu_version=`expr [$]1 \* 1000 + [$]2`
+      AC_MSG_RESULT([found $icu_version_full])
 
-  dnl Trust icu-config to know better what the install prefix is..
-  icu_install_prefix=`$ICU_CONFIG --prefix 2> /dev/null`
-  if test "$?" != "0" || test -z "$icu_install_prefix"; then
-    AC_MSG_RESULT([not found])
-    AC_MSG_ERROR([Unable to detect ICU prefix or $ICU_CONFIG failed. Please verify ICU install prefix and make sure icu-config works.])
-  else
-    AC_MSG_RESULT([$icu_install_prefix])
+      ICU_LIBS=`$PKG_CONFIG --libs icu-uc icu-io icu-i18n`
+      ICU_INCS=`$PKG_CONFIG --cflags-only-I icu-uc icu-io icu-i18n`
+      ICU_CXXFLAGS="-DU_USING_ICU_NAMESPACE=1"
 
-    dnl Check ICU version
-    AC_MSG_CHECKING([for ICU 4.0 or greater])
-    icu_version_full=`$ICU_CONFIG --version`
-    ac_IFS=$IFS
-    IFS="."
-    set $icu_version_full
-    IFS=$ac_IFS
-    icu_version=`expr [$]1 \* 1000 + [$]2`
-    AC_MSG_RESULT([found $icu_version_full])
+      AC_MSG_RESULT([found $ICU_VERSION])
 
-    if test "$icu_version" -lt "4000"; then
-      AC_MSG_ERROR([ICU version 4.0 or later is required])
+      PHP_EVAL_LIBLINE($ICU_LIBS, $1)
+      PHP_EVAL_INCLINE($ICU_INCS)
+    else
+      AC_MSG_ERROR([ICU version 4.0 or later required.])
+    fi
+  fi
+
+  dnl If pkg-config fails for some reason, revert to the old method
+  if test "$found_icu" = "no"; then
+    if test "$PHP_ICU_DIR" = "DEFAULT"; then
+      dnl Try to find icu-config
+      AC_PATH_PROG(ICU_CONFIG, icu-config, no, [$PATH:/usr/local/bin])
+    else
+      ICU_CONFIG="$PHP_ICU_DIR/bin/icu-config"
     fi
 
-    ICU_VERSION=$icu_version
-    ICU_INCS=`$ICU_CONFIG --cppflags-searchpath`
-    ICU_LIBS=`$ICU_CONFIG --ldflags --ldflags-icuio`
-    PHP_EVAL_INCLINE($ICU_INCS)
-    PHP_EVAL_LIBLINE($ICU_LIBS, $1)
+    dnl Trust icu-config to know better what the install prefix is..
+    icu_install_prefix=`$ICU_CONFIG --prefix 2> /dev/null`
+    if test "$?" != "0" || test -z "$icu_install_prefix"; then
+      AC_MSG_RESULT([not found])
+      AC_MSG_ERROR([Unable to detect ICU prefix or $ICU_CONFIG failed. Please verify ICU install prefix and make sure icu-config works.])
+    else
+      AC_MSG_RESULT([$icu_install_prefix])
 
-    ICU_CXXFLAGS=`$ICU_CONFIG --cxxflags`
-    if test "$icu_version" -ge "49000"; then
-      ICU_CXXFLAGS="$ICU_CXXFLAGS -DUNISTR_FROM_CHAR_EXPLICIT=explicit -DUNISTR_FROM_STRING_EXPLICIT=explicit"
-      ICU_CFLAGS="-DU_NO_DEFAULT_INCLUDE_UTF_HEADERS=1"
-    fi
-    if test "$icu_version" -ge "60000"; then
-      ICU_CFLAGS="$ICU_CFLAGS -DU_HIDE_OBSOLETE_UTF_OLD_H=1"
+      dnl Check ICU version
+      AC_MSG_CHECKING([for ICU 4.0 or greater])
+      icu_version_full=`$ICU_CONFIG --version`
+      ac_IFS=$IFS
+      IFS="."
+      set $icu_version_full
+      IFS=$ac_IFS
+      icu_version=`expr [$]1 \* 1000 + [$]2`
+      AC_MSG_RESULT([found $icu_version_full])
+
+      if test "$icu_version" -lt "4000"; then
+        AC_MSG_ERROR([ICU version 4.0 or later is required])
+      fi
+
+      ICU_VERSION=$icu_version
+      ICU_INCS=`$ICU_CONFIG --cppflags-searchpath`
+      ICU_LIBS=`$ICU_CONFIG --ldflags --ldflags-icuio`
+      PHP_EVAL_INCLINE($ICU_INCS)
+      PHP_EVAL_LIBLINE($ICU_LIBS, $1)
+
+      ICU_CXXFLAGS=`$ICU_CONFIG --cxxflags`
+      if test "$icu_version" -ge "49000"; then
+        ICU_CXXFLAGS="$ICU_CXXFLAGS -DUNISTR_FROM_CHAR_EXPLICIT=explicit -DUNISTR_FROM_STRING_EXPLICIT=explicit"
+        ICU_CFLAGS="-DU_NO_DEFAULT_INCLUDE_UTF_HEADERS=1"
+      fi
+      if test "$icu_version" -ge "60000"; then
+        ICU_CFLAGS="$ICU_CFLAGS -DU_HIDE_OBSOLETE_UTF_OLD_H=1"
+      fi
     fi
   fi
 ])

configure.ac

@@ -107,8 +107,8 @@ int zend_sprintf(char *buffer, const char *format, ...);
 
 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=3
-PHP_RELEASE_VERSION=0
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=3
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
 
@@ -565,6 +565,24 @@ PHP_CHECK_CPU_SUPPORTS([sse4.2])
 PHP_CHECK_CPU_SUPPORTS([avx])
 PHP_CHECK_CPU_SUPPORTS([avx2])
 
+dnl The ABI of php_addslashes in PHP 7.3 is dependent on __SSE4_2__,
+dnl which depends on target attributes. Use this check to make sure that
+dnl SSE 4.2 availability during the PHP compilation is used, independently
+dnl of whether extensions are compiled with SSE 4.2 support.
+AC_MSG_CHECKING([whether __SSE4_2__ is defined])
+AC_RUN_IFELSE([AC_LANG_SOURCE([[
+int main() {
+#if defined(__SSE4_2__)
+  return 0;
+#else
+  return 1;
+#endif
+}
+]])], [
+  AC_MSG_RESULT([yes])
+  AC_DEFINE(HAVE_SSE4_2_DEF, 1, [Define if __SSE4_2__ has been defined])
+], [AC_MSG_RESULT([no])], [AC_MSG_RESULT([no])])
+
 dnl Check for members of the stat structure
 AC_CHECK_MEMBERS([struct stat.st_blksize, struct stat.st_rdev])
 dnl AC_STRUCT_ST_BLOCKS will screw QNX because fileblocks.o does not exist
@@ -585,7 +603,10 @@ PHP_SOCKADDR_CHECKS
 
 dnl Checks for GCC function attributes on all systems except ones without glibc
 dnl Fix for these systems is already included in GCC 7, but not on GCC 6
-AS_CASE([$host_alias], [*-*-*android*|*-*-*uclibc*|*-*-*musl*], [true], [
+dnl
+dnl At least some versions of FreeBSD seem to have buggy ifunc support, see
+dnl bug #77284. Conservatively don't use ifuncs on FreeBSD.
+AS_CASE([$host_alias], [*-*-*android*|*-*-*uclibc*|*-*-*musl*|*freebsd*], [true], [
   AX_GCC_FUNC_ATTRIBUTE([ifunc])
   AX_GCC_FUNC_ATTRIBUTE([target])
 ])

ext/com_dotnet/com_extension.c

@@ -28,6 +28,7 @@
 #include "php_com_dotnet.h"
 #include "php_com_dotnet_internal.h"
 #include "Zend/zend_exceptions.h"
+#include "Zend/zend_interfaces.h"
 
 ZEND_DECLARE_MODULE_GLOBALS(com_dotnet)
 static PHP_GINIT_FUNCTION(com_dotnet);
@@ -310,11 +311,15 @@ PHP_MINIT_FUNCTION(com_dotnet)
 	ce.create_object = php_com_object_new;
 	php_com_variant_class_entry = zend_register_internal_class(&ce);
 	php_com_variant_class_entry->get_iterator = php_com_iter_get;
+	php_com_variant_class_entry->serialize = zend_class_serialize_deny;
+	php_com_variant_class_entry->unserialize = zend_class_unserialize_deny;
 
 	INIT_CLASS_ENTRY(ce, "com", NULL);
 	ce.create_object = php_com_object_new;
 	tmp = zend_register_internal_class_ex(&ce, php_com_variant_class_entry);
 	tmp->get_iterator = php_com_iter_get;
+	tmp->serialize = zend_class_serialize_deny;
+	tmp->unserialize = zend_class_unserialize_deny;
 
 	zend_ts_hash_init(&php_com_typelibraries, 0, NULL, php_com_typelibrary_dtor, 1);
 
@@ -323,6 +328,8 @@ PHP_MINIT_FUNCTION(com_dotnet)
 	ce.create_object = php_com_object_new;
 	tmp = zend_register_internal_class_ex(&ce, php_com_variant_class_entry);
 	tmp->get_iterator = php_com_iter_get;
+	tmp->serialize = zend_class_serialize_deny;
+	tmp->unserialize = zend_class_unserialize_deny;
 #endif
 
 	REGISTER_INI_ENTRIES();

ext/com_dotnet/com_handlers.c

@@ -229,7 +229,7 @@ static HashTable *com_properties_get(zval *object)
 	 * infinite recursion when the hash is displayed via var_dump().
 	 * Perhaps it is best to leave it un-implemented.
 	 */
-	return NULL;
+	return &zend_empty_array;
 }
 
 static void function_dtor(zval *zv)

ext/com_dotnet/com_typeinfo.c

@@ -184,7 +184,7 @@ PHP_COM_DOTNET_API int php_com_import_typelib(ITypeLib *TL, int mode, int codepa
 				}
 
 				const_name = php_com_olestring_to_string(bstr_ids, &len, codepage);
-				c.name = zend_string_init(const_name, len, 1);
+				c.name = zend_string_init(const_name, len, mode & CONST_PERSISTENT);
 				// TODO: avoid reallocation???
 				efree(const_name);
 				if(c.name == NULL) {
@@ -195,17 +195,17 @@ PHP_COM_DOTNET_API int php_com_import_typelib(ITypeLib *TL, int mode, int codepa
 				SysFreeString(bstr_ids);
 
 				/* sanity check for the case where the constant is already defined */
+				php_com_zval_from_variant(&value, pVarDesc->lpvarValue, codepage);
 				if ((exists = zend_get_constant(c.name)) != NULL) {
-					if (COMG(autoreg_verbose) && !compare_function(&results, &c.value, exists)) {
-						php_error_docref(NULL, E_WARNING, "Type library constant %s is already defined", c.name);
+					if (COMG(autoreg_verbose) && !compare_function(&results, &value, exists)) {
+						php_error_docref(NULL, E_WARNING, "Type library constant %s is already defined", ZSTR_VAL(c.name));
 					}
-					zend_string_release_ex(c.name, 1);
+					zend_string_release_ex(c.name, mode & CONST_PERSISTENT);
 					ITypeInfo_ReleaseVarDesc(TypeInfo, pVarDesc);
 					continue;
 				}
 
 				/* register the constant */
-				php_com_zval_from_variant(&value, pVarDesc->lpvarValue, codepage);
 				if (Z_TYPE(value) == IS_LONG) {
 					ZEND_CONSTANT_SET_FLAGS(&c, mode, 0);
 					ZVAL_LONG(&c.value, Z_LVAL(value));

ext/com_dotnet/tests/bug77177.phpt

@@ -0,0 +1,57 @@
+--TEST--
+Bug #77177 (Serializing or unserializing COM objects crashes)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+?>
+--FILE--
+<?php
+$com = new COM("WScript.Shell");
+$dotnet = new DOTNET("mscorlib", "System.Collections.Stack");
+$variant = new VARIANT;
+foreach ([$com, $dotnet, $variant] as $object) {
+    try {
+        serialize($object);
+    } catch (Exception $ex) {
+        echo "Exception: {$ex->getMessage()}\n";
+    }
+}
+
+$strings = ['C:3:"com":0:{}', 'C:6:"dotnet":0:{}', 'C:7:"variant":0:{}'];
+foreach ($strings as $string) {
+    try {
+        unserialize($string);
+    } catch (Exception $ex) {
+        echo "Exception: {$ex->getMessage()}\n";
+    }
+}
+
+$strings = ['O:3:"com":0:{}', 'O:6:"dotnet":0:{}', 'O:7:"variant":0:{}'];
+foreach ($strings as $string) {
+    var_dump(unserialize($string));
+}
+?>
+===DONE===
+--EXPECTF--
+Exception: Serialization of 'com' is not allowed
+Exception: Serialization of 'dotnet' is not allowed
+Exception: Serialization of 'variant' is not allowed
+Exception: Unserialization of 'com' is not allowed
+Exception: Unserialization of 'dotnet' is not allowed
+Exception: Unserialization of 'variant' is not allowed
+
+Warning: Erroneous data format for unserializing 'com' in %s on line %d
+
+Notice: unserialize(): Error at offset 13 of 14 bytes in %s on line %d
+bool(false)
+
+Warning: Erroneous data format for unserializing 'dotnet' in %s on line %d
+
+Notice: unserialize(): Error at offset 16 of 17 bytes in %s on line %d
+bool(false)
+
+Warning: Erroneous data format for unserializing 'variant' in %s on line %d
+
+Notice: unserialize(): Error at offset 17 of 18 bytes in %s on line %d
+bool(false)
+===DONE===

ext/com_dotnet/tests/bug77621.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug #77621 (Already defined constants are not properly reported)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+?>
+--INI--
+com.autoregister_verbose=1
+--FILE--
+<?php
+define('ADSTYPE_INVALID', 0);
+$root = dirname(array_change_key_case($_SERVER, CASE_UPPER)['COMSPEC']);
+com_load_typelib("$root\activeds.tlb");
+?>
+===DONE===
+--EXPECTF--
+Warning: com_load_typelib(): Type library constant ADSTYPE_INVALID is already defined in %s on line %d
+===DONE===

ext/curl/interface.c

@@ -3294,52 +3294,27 @@ PHP_FUNCTION(curl_getinfo)
 			CAAS("scheme", s_code);
 		}
 #endif
-#if LIBCURL_VERSION_NUM >= 0x073700 /* Available since 7.55.0 */
-		if (curl_easy_getinfo(ch->cp, CURLINFO_CONTENT_LENGTH_DOWNLOAD_T, &co) == CURLE_OK) {
-			CAAL("content_length_download", co);
-		}
-		if (curl_easy_getinfo(ch->cp, CURLINFO_CONTENT_LENGTH_UPLOAD_T, &co) == CURLE_OK) {
-			CAAL("content_length_upload", co);
-		}
-		if (curl_easy_getinfo(ch->cp, CURLINFO_SIZE_DOWNLOAD_T, &co) == CURLE_OK) {
-			CAAL("size_download", co);
-		}
-		if (curl_easy_getinfo(ch->cp, CURLINFO_SIZE_UPLOAD_T, &co) == CURLE_OK) {
-			CAAL("size_upload", co);
-		}
-		if (curl_easy_getinfo(ch->cp, CURLINFO_SPEED_DOWNLOAD_T, &co) == CURLE_OK) {
-			CAAL("speed_download", co);
-		}
-		if (curl_easy_getinfo(ch->cp, CURLINFO_SPEED_UPLOAD_T, &co) == CURLE_OK) {
-			CAAL("speed_upload", co);
-		}
-#endif
-#if LIBCURL_VERSION_NUM >= 0x073b00 /* Available since 7.59.0 */
-		if (curl_easy_getinfo(ch->cp, CURLINFO_FILETIME_T, &co) == CURLE_OK) {
-			CAAL("filetime", co);
-		}
-#endif
 #if LIBCURL_VERSION_NUM >= 0x073d00 /* Available since 7.61.0 */
 		if (curl_easy_getinfo(ch->cp, CURLINFO_APPCONNECT_TIME_T, &co) == CURLE_OK) {
-			CAAL("appconnect_time", co);
+			CAAL("appconnect_time_us", co);
 		}
 		if (curl_easy_getinfo(ch->cp, CURLINFO_CONNECT_TIME_T, &co) == CURLE_OK) {
-			CAAL("connect_time", co);
+			CAAL("connect_time_us", co);
 		}
 		if (curl_easy_getinfo(ch->cp, CURLINFO_NAMELOOKUP_TIME_T, &co) == CURLE_OK) {
-			CAAL("namelookup_time", co);
+			CAAL("namelookup_time_us", co);
 		}
 		if (curl_easy_getinfo(ch->cp, CURLINFO_PRETRANSFER_TIME_T, &co) == CURLE_OK) {
-			CAAL("pretransfer_time", co);
+			CAAL("pretransfer_time_us", co);
 		}
 		if (curl_easy_getinfo(ch->cp, CURLINFO_REDIRECT_TIME_T, &co) == CURLE_OK) {
-			CAAL("redirect_time", co);
+			CAAL("redirect_time_us", co);
 		}
 		if (curl_easy_getinfo(ch->cp, CURLINFO_STARTTRANSFER_TIME_T, &co) == CURLE_OK) {
-			CAAL("starttransfer_time", co);
+			CAAL("starttransfer_time_us", co);
 		}
 		if (curl_easy_getinfo(ch->cp, CURLINFO_TOTAL_TIME_T, &co) == CURLE_OK) {
-			CAAL("total_time", co);
+			CAAL("total_time_us", co);
 		}
 #endif
 		if (ch->header.str) {

ext/curl/multi.c

@@ -502,6 +502,7 @@ static int _php_server_push_callback(CURL *parent_ch, CURL *easy, size_t num_hea
 	Z_ADDREF_P(pz_parent_ch);
 
 	res = zend_register_resource(ch, le_curl);
+	ch->res = res;
 	ZVAL_RES(&pz_ch, res);
 
 	size_t i;

ext/curl/tests/bug76675.phpt

@@ -0,0 +1,53 @@
+--TEST--
+Bug #76675 (Segfault with H2 server push write/writeheader handlers)
+--SKIPIF--
+<?php
+include 'skipif.inc';
+if (getenv("SKIP_ONLINE_TESTS")) {
+	die("skip online test");
+}
+$curl_version = curl_version();
+if ($curl_version['version_number'] < 0x073d00) {
+	exit("skip: test may crash with curl < 7.61.0");
+}
+?>
+--FILE--
+<?php
+$transfers = 1;
+$callback = function($parent, $passed) use (&$transfers) {
+    curl_setopt($passed, CURLOPT_WRITEFUNCTION, function ($ch, $data) {
+        echo "Received ".strlen($data);
+        return strlen($data);
+    });
+	$transfers++;
+	return CURL_PUSH_OK;
+};
+$mh = curl_multi_init();
+curl_multi_setopt($mh, CURLMOPT_PIPELINING, CURLPIPE_MULTIPLEX);
+curl_multi_setopt($mh, CURLMOPT_PUSHFUNCTION, $callback);
+$ch = curl_init();
+curl_setopt($ch, CURLOPT_URL, 'https://http2.golang.org/serverpush');
+curl_setopt($ch, CURLOPT_HTTP_VERSION, 3);
+curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
+curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
+curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
+curl_multi_add_handle($mh, $ch);
+$active = null;
+do {
+    $status = curl_multi_exec($mh, $active);
+    do {
+        $info = curl_multi_info_read($mh);
+        if (false !== $info && $info['msg'] == CURLMSG_DONE) {
+            $handle = $info['handle'];
+            if ($handle !== null) {
+                $transfers--;
+                curl_multi_remove_handle($mh, $handle);
+                curl_close($handle);
+            }
+        }
+    } while ($info);
+} while ($transfers);
+curl_multi_close($mh);
+?>
+--EXPECTREGEX--
+(Received \d+)+

ext/curl/tests/check_win_config.phpt

@@ -48,7 +48,7 @@ PSL => No
 HTTPS_PROXY => Yes
 MULTI_SSL => %s
 BROTLI => %s
-Protocols => dict, file, ftp, ftps, gopher, http, https, imap, imaps, ldap, pop3, pop3s, rtsp, scp, sftp, smb, smbs, smtp, smtps, telnet, tftp
+Protocols => dict, file, ftp, ftps, gopher, http, https, imap, imaps, ldap, ldaps, pop3, pop3s, rtsp, scp, sftp, smb, smbs, smtp, smtps, telnet, tftp
 Host => %s-pc-win32
 SSL Version => OpenSSL/%s
 ZLib Version => %s

ext/curl/tests/curl_basic_009.phpt

@@ -18,6 +18,6 @@ curl_close($ch);
 
 
 ?>
---EXPECTF--
-string(%d) "%Srotocol%s"
-int(1)
+--EXPECTREGEX--
+string\(\d+\) "([^\r\n]*rotocol[^\r\n]+|Could not resolve host: .+)"
+int\(\d\)

ext/date/config0.m4

@@ -1,7 +1,13 @@
 dnl config.m4 for date extension
 
-sinclude(ext/date/lib/timelib.m4)
-sinclude(lib/timelib.m4)
+dnl Check for headers needed by timelib
+AC_CHECK_HEADERS([ \
+strings.h \
+io.h
+])
+
+dnl Check for strtoll, atoll
+AC_CHECK_FUNCS(strtoll atoll)
 
 PHP_DATE_CFLAGS="-I@ext_builddir@/lib -DZEND_ENABLE_STATIC_TSRMLS_CACHE=1 -DHAVE_TIMELIB_CONFIG_H=1"
 timelib_sources="lib/astro.c lib/dow.c lib/parse_date.c lib/parse_tz.c

ext/date/lib/interval.c

@@ -35,7 +35,10 @@ timelib_rel_time *timelib_diff(timelib_time *one, timelib_time *two)
 
 	rt = timelib_rel_time_ctor();
 	rt->invert = 0;
-	if (one->sse > two->sse) {
+	if (
+		(one->sse > two->sse) ||
+		(one->sse == two->sse && one->us > two->us)
+	) {
 		swp = two;
 		two = one;
 		one = swp;

ext/date/lib/parse_tz.c

@@ -51,17 +51,37 @@ static inline uint32_t timelib_conv_int_unsigned(uint32_t value)
 {
 	return value;
 }
+
+static inline uint64_t timelib_conv_int64_unsigned(uint64_t value)
+{
+	return value;
+}
 #else
 static inline uint32_t timelib_conv_int_unsigned(uint32_t value)
 {
-	return ((value & 0x000000ff) << 24) +
-		((value & 0x0000ff00) << 8) +
-		((value & 0x00ff0000) >> 8) +
+	return
+		((value & 0x000000ff) << 24) +
+		((value & 0x0000ff00) <<  8) +
+		((value & 0x00ff0000) >>  8) +
 		((value & 0xff000000) >> 24);
 }
+
+static inline uint64_t timelib_conv_int64_unsigned(uint64_t value)
+{
+	return
+		((value & 0x00000000000000ff) << 56) +
+		((value & 0x000000000000ff00) << 40) +
+		((value & 0x0000000000ff0000) << 24) +
+		((value & 0x00000000ff000000) <<  8) +
+		((value & 0x000000ff00000000) >>  8) +
+		((value & 0x0000ff0000000000) >> 24) +
+		((value & 0x00ff000000000000) >> 40) +
+		((value & 0xff00000000000000) >> 56);
+}
 #endif
 
 #define timelib_conv_int_signed(value) ((int32_t) timelib_conv_int_unsigned((int32_t) value))
+#define timelib_conv_int64_signed(value) ((int64_t) timelib_conv_int64_unsigned((int64_t) value))
 
 static int read_php_preamble(const unsigned char **tzf, timelib_tzinfo *tz)
 {
@@ -132,56 +152,49 @@ static int read_preamble(const unsigned char **tzf, timelib_tzinfo *tz, unsigned
 	}
 }
 
-static void read_header(const unsigned char **tzf, timelib_tzinfo *tz)
+static void read_32bit_header(const unsigned char **tzf, timelib_tzinfo *tz)
 {
 	uint32_t buffer[6];
 
 	memcpy(&buffer, *tzf, sizeof(buffer));
-	tz->bit32.ttisgmtcnt = timelib_conv_int_unsigned(buffer[0]);
-	tz->bit32.ttisstdcnt = timelib_conv_int_unsigned(buffer[1]);
-	tz->bit32.leapcnt    = timelib_conv_int_unsigned(buffer[2]);
-	tz->bit32.timecnt    = timelib_conv_int_unsigned(buffer[3]);
-	tz->bit32.typecnt    = timelib_conv_int_unsigned(buffer[4]);
-	tz->bit32.charcnt    = timelib_conv_int_unsigned(buffer[5]);
+	tz->_bit32.ttisgmtcnt = timelib_conv_int_unsigned(buffer[0]);
+	tz->_bit32.ttisstdcnt = timelib_conv_int_unsigned(buffer[1]);
+	tz->_bit32.leapcnt    = timelib_conv_int_unsigned(buffer[2]);
+	tz->_bit32.timecnt    = timelib_conv_int_unsigned(buffer[3]);
+	tz->_bit32.typecnt    = timelib_conv_int_unsigned(buffer[4]);
+	tz->_bit32.charcnt    = timelib_conv_int_unsigned(buffer[5]);
+
 	*tzf += sizeof(buffer);
 }
 
-static void skip_64bit_transitions(const unsigned char **tzf, timelib_tzinfo *tz)
+static int read_64bit_transitions(const unsigned char **tzf, timelib_tzinfo *tz)
 {
-	if (tz->bit64.timecnt) {
-		*tzf += (sizeof(int64_t) * tz->bit64.timecnt);
-		*tzf += (sizeof(unsigned char) * tz->bit64.timecnt);
-	}
-}
-
-static int read_transitions(const unsigned char **tzf, timelib_tzinfo *tz)
-{
-	int32_t *buffer = NULL;
+	int64_t *buffer = NULL;
 	uint32_t i;
 	unsigned char *cbuffer = NULL;
 
-	if (tz->bit32.timecnt) {
-		buffer = (int32_t*) timelib_malloc(tz->bit32.timecnt * sizeof(int32_t));
+	if (tz->bit64.timecnt) {
+		buffer = (int64_t*) timelib_malloc(tz->bit64.timecnt * sizeof(int64_t));
 		if (!buffer) {
 			return TIMELIB_ERROR_CANNOT_ALLOCATE;
 		}
-		memcpy(buffer, *tzf, sizeof(int32_t) * tz->bit32.timecnt);
-		*tzf += (sizeof(int32_t) * tz->bit32.timecnt);
-		for (i = 0; i < tz->bit32.timecnt; i++) {
-			buffer[i] = timelib_conv_int_signed(buffer[i]);
+		memcpy(buffer, *tzf, sizeof(int64_t) * tz->bit64.timecnt);
+		*tzf += (sizeof(int64_t) * tz->bit64.timecnt);
+		for (i = 0; i < tz->bit64.timecnt; i++) {
+			buffer[i] = timelib_conv_int64_signed(buffer[i]);
 			/* Sanity check to see whether TS is just increasing */
 			if (i > 0 && !(buffer[i] > buffer[i - 1])) {
 				return TIMELIB_ERROR_CORRUPT_TRANSITIONS_DONT_INCREASE;
 			}
 		}
 
-		cbuffer = (unsigned char*) timelib_malloc(tz->bit32.timecnt * sizeof(unsigned char));
+		cbuffer = (unsigned char*) timelib_malloc(tz->bit64.timecnt * sizeof(unsigned char));
 		if (!cbuffer) {
 			timelib_free(buffer);
 			return TIMELIB_ERROR_CANNOT_ALLOCATE;
 		}
-		memcpy(cbuffer, *tzf, sizeof(unsigned char) * tz->bit32.timecnt);
-		*tzf += sizeof(unsigned char) * tz->bit32.timecnt;
+		memcpy(cbuffer, *tzf, sizeof(unsigned char) * tz->bit64.timecnt);
+		*tzf += sizeof(unsigned char) * tz->bit64.timecnt;
 	}
 
 	tz->trans = buffer;
@@ -190,41 +203,35 @@ static int read_transitions(const unsigned char **tzf, timelib_tzinfo *tz)
 	return 0;
 }
 
-static void skip_64bit_types(const unsigned char **tzf, timelib_tzinfo *tz)
+static void skip_32bit_transitions(const unsigned char **tzf, timelib_tzinfo *tz)
 {
-	*tzf += sizeof(unsigned char) * 6 * tz->bit64.typecnt;
-	*tzf += sizeof(char) * tz->bit64.charcnt;
-	if (tz->bit64.leapcnt) {
-		*tzf += sizeof(int64_t) * tz->bit64.leapcnt * 2;
-	}
-	if (tz->bit64.ttisstdcnt) {
-		*tzf += sizeof(unsigned char) * tz->bit64.ttisstdcnt;
-	}
-	if (tz->bit64.ttisgmtcnt) {
-		*tzf += sizeof(unsigned char) * tz->bit64.ttisgmtcnt;
+	if (tz->_bit32.timecnt) {
+		*tzf += (sizeof(int32_t) * tz->_bit32.timecnt);
+		*tzf += sizeof(unsigned char) * tz->_bit32.timecnt;
 	}
 }
 
-static int read_types(const unsigned char **tzf, timelib_tzinfo *tz)
+static int read_64bit_types(const unsigned char **tzf, timelib_tzinfo *tz)
 {
 	unsigned char *buffer;
 	int32_t *leap_buffer;
 	unsigned int i, j;
 
-	buffer = (unsigned char*) timelib_malloc(tz->bit32.typecnt * sizeof(unsigned char) * 6);
+	/* Offset Types */
+	buffer = (unsigned char*) timelib_malloc(tz->bit64.typecnt * sizeof(unsigned char) * 6);
 	if (!buffer) {
 		return TIMELIB_ERROR_CANNOT_ALLOCATE;
 	}
-	memcpy(buffer, *tzf, sizeof(unsigned char) * 6 * tz->bit32.typecnt);
-	*tzf += sizeof(unsigned char) * 6 * tz->bit32.typecnt;
+	memcpy(buffer, *tzf, sizeof(unsigned char) * 6 * tz->bit64.typecnt);
+	*tzf += sizeof(unsigned char) * 6 * tz->bit64.typecnt;
 
-	tz->type = (ttinfo*) timelib_malloc(tz->bit32.typecnt * sizeof(ttinfo));
+	tz->type = (ttinfo*) timelib_malloc(tz->bit64.typecnt * sizeof(ttinfo));
 	if (!tz->type) {
 		timelib_free(buffer);
 		return TIMELIB_ERROR_CANNOT_ALLOCATE;
 	}
 
-	for (i = 0; i < tz->bit32.typecnt; i++) {
+	for (i = 0; i < tz->bit64.typecnt; i++) {
 		j = i * 6;
 		tz->type[i].offset = 0;
 		tz->type[i].offset += (int32_t) (((uint32_t) buffer[j]) << 24) + (buffer[j + 1] << 16) + (buffer[j + 2] << 8) + tz->type[i].offset + buffer[j + 3];
@@ -233,56 +240,60 @@ static int read_types(const unsigned char **tzf, timelib_tzinfo *tz)
 	}
 	timelib_free(buffer);
 
-	tz->timezone_abbr = (char*) timelib_malloc(tz->bit32.charcnt);
+	/* Abbreviations */
+	tz->timezone_abbr = (char*) timelib_malloc(tz->bit64.charcnt);
 	if (!tz->timezone_abbr) {
 		return TIMELIB_ERROR_CORRUPT_NO_ABBREVIATION;
 	}
-	memcpy(tz->timezone_abbr, *tzf, sizeof(char) * tz->bit32.charcnt);
-	*tzf += sizeof(char) * tz->bit32.charcnt;
+	memcpy(tz->timezone_abbr, *tzf, sizeof(char) * tz->bit64.charcnt);
+	*tzf += sizeof(char) * tz->bit64.charcnt;
 
-	if (tz->bit32.leapcnt) {
-		leap_buffer = (int32_t *) timelib_malloc(tz->bit32.leapcnt * 2 * sizeof(int32_t));
+	/* Leap seconds (only use in 'right/') format */
+	if (tz->bit64.leapcnt) {
+		leap_buffer = (int32_t *) timelib_malloc(tz->bit64.leapcnt * (sizeof(int64_t) + sizeof(int32_t)));
 		if (!leap_buffer) {
 			return TIMELIB_ERROR_CANNOT_ALLOCATE;
 		}
-		memcpy(leap_buffer, *tzf, sizeof(int32_t) * tz->bit32.leapcnt * 2);
-		*tzf += sizeof(int32_t) * tz->bit32.leapcnt * 2;
+		memcpy(leap_buffer, *tzf, tz->bit64.leapcnt * (sizeof(int64_t) + sizeof(int32_t)));
+		*tzf += tz->bit64.leapcnt * (sizeof(int64_t) + sizeof(int32_t));
 
-		tz->leap_times = (tlinfo*) timelib_malloc(tz->bit32.leapcnt * sizeof(tlinfo));
+		tz->leap_times = (tlinfo*) timelib_malloc(tz->bit64.leapcnt * sizeof(tlinfo));
 		if (!tz->leap_times) {
 			timelib_free(leap_buffer);
 			return TIMELIB_ERROR_CANNOT_ALLOCATE;
 		}
-		for (i = 0; i < tz->bit32.leapcnt; i++) {
-			tz->leap_times[i].trans = timelib_conv_int_signed(leap_buffer[i * 2]);
-			tz->leap_times[i].offset = timelib_conv_int_signed(leap_buffer[i * 2 + 1]);
+		for (i = 0; i < tz->bit64.leapcnt; i++) {
+			tz->leap_times[i].trans = timelib_conv_int64_signed(leap_buffer[i * 3 + 1] * 4294967296 + leap_buffer[i * 3]);
+			tz->leap_times[i].offset = timelib_conv_int_signed(leap_buffer[i * 3 + 2]);
 		}
 		timelib_free(leap_buffer);
 	}
 
-	if (tz->bit32.ttisstdcnt) {
-		buffer = (unsigned char*) timelib_malloc(tz->bit32.ttisstdcnt * sizeof(unsigned char));
+	/* Standard/Wall Indicators (unused) */
+	if (tz->bit64.ttisstdcnt) {
+		buffer = (unsigned char*) timelib_malloc(tz->bit64.ttisstdcnt * sizeof(unsigned char));
 		if (!buffer) {
 			return TIMELIB_ERROR_CANNOT_ALLOCATE;
 		}
-		memcpy(buffer, *tzf, sizeof(unsigned char) * tz->bit32.ttisstdcnt);
-		*tzf += sizeof(unsigned char) * tz->bit32.ttisstdcnt;
+		memcpy(buffer, *tzf, sizeof(unsigned char) * tz->bit64.ttisstdcnt);
+		*tzf += sizeof(unsigned char) * tz->bit64.ttisstdcnt;
 
-		for (i = 0; i < tz->bit32.ttisstdcnt; i++) {
+		for (i = 0; i < tz->bit64.ttisstdcnt; i++) {
 			tz->type[i].isstdcnt = buffer[i];
 		}
 		timelib_free(buffer);
 	}
 
-	if (tz->bit32.ttisgmtcnt) {
-		buffer = (unsigned char*) timelib_malloc(tz->bit32.ttisgmtcnt * sizeof(unsigned char));
+	/* UT/Local Time Indicators (unused) */
+	if (tz->bit64.ttisgmtcnt) {
+		buffer = (unsigned char*) timelib_malloc(tz->bit64.ttisgmtcnt * sizeof(unsigned char));
 		if (!buffer) {
 			return TIMELIB_ERROR_CANNOT_ALLOCATE;
 		}
-		memcpy(buffer, *tzf, sizeof(unsigned char) * tz->bit32.ttisgmtcnt);
-		*tzf += sizeof(unsigned char) * tz->bit32.ttisgmtcnt;
+		memcpy(buffer, *tzf, sizeof(unsigned char) * tz->bit64.ttisgmtcnt);
+		*tzf += sizeof(unsigned char) * tz->bit64.ttisgmtcnt;
 
-		for (i = 0; i < tz->bit32.ttisgmtcnt; i++) {
+		for (i = 0; i < tz->bit64.ttisgmtcnt; i++) {
 			tz->type[i].isgmtcnt = buffer[i];
 		}
 		timelib_free(buffer);
@@ -291,6 +302,30 @@ static int read_types(const unsigned char **tzf, timelib_tzinfo *tz)
 	return 0;
 }
 
+static void skip_32bit_types(const unsigned char **tzf, timelib_tzinfo *tz)
+{
+	/* Offset Types */
+	*tzf += sizeof(unsigned char) * 6 * tz->_bit32.typecnt;
+
+	/* Abbreviations */
+	*tzf += sizeof(char) * tz->_bit32.charcnt;
+
+	/* Leap seconds (only use in 'right/') format */
+	if (tz->_bit32.leapcnt) {
+		*tzf += sizeof(int32_t) * tz->_bit32.leapcnt * 2;
+	}
+
+	/* Standard/Wall Indicators (unused) */
+	if (tz->_bit32.ttisstdcnt) {
+		*tzf += sizeof(unsigned char) * tz->_bit32.ttisstdcnt;
+	}
+
+	/* UT/Local Time Indicators (unused) */
+	if (tz->_bit32.ttisgmtcnt) {
+		*tzf += sizeof(unsigned char) * tz->_bit32.ttisgmtcnt;
+	}
+}
+
 static void skip_posix_string(const unsigned char **tzf, timelib_tzinfo *tz)
 {
 	int n_count = 0;
@@ -339,14 +374,16 @@ void timelib_dump_tzinfo(timelib_tzinfo *tz)
 	printf("Geo Location:      %f,%f\n", tz->location.latitude, tz->location.longitude);
 	printf("Comments:\n%s\n",          tz->location.comments);
 	printf("BC:                %s\n",  tz->bc ? "" : "yes");
-	printf("UTC/Local count:   " TIMELIB_ULONG_FMT "\n", (timelib_ulong) tz->bit32.ttisgmtcnt);
-	printf("Std/Wall count:    " TIMELIB_ULONG_FMT "\n", (timelib_ulong) tz->bit32.ttisstdcnt);
-	printf("Leap.sec. count:   " TIMELIB_ULONG_FMT "\n", (timelib_ulong) tz->bit32.leapcnt);
-	printf("Trans. count:      " TIMELIB_ULONG_FMT "\n", (timelib_ulong) tz->bit32.timecnt);
-	printf("Local types count: " TIMELIB_ULONG_FMT "\n", (timelib_ulong) tz->bit32.typecnt);
-	printf("Zone Abbr. count:  " TIMELIB_ULONG_FMT "\n", (timelib_ulong) tz->bit32.charcnt);
 
-	printf ("%8s (%12s) = %3d [%5ld %1d %3d '%s' (%d,%d)]\n",
+	printf("\n64-bit:\n");
+	printf("UTC/Local count:   " TIMELIB_ULONG_FMT "\n", (timelib_ulong) tz->bit64.ttisgmtcnt);
+	printf("Std/Wall count:    " TIMELIB_ULONG_FMT "\n", (timelib_ulong) tz->bit64.ttisstdcnt);
+	printf("Leap.sec. count:   " TIMELIB_ULONG_FMT "\n", (timelib_ulong) tz->bit64.leapcnt);
+	printf("Trans. count:      " TIMELIB_ULONG_FMT "\n", (timelib_ulong) tz->bit64.timecnt);
+	printf("Local types count: " TIMELIB_ULONG_FMT "\n", (timelib_ulong) tz->bit64.typecnt);
+	printf("Zone Abbr. count:  " TIMELIB_ULONG_FMT "\n", (timelib_ulong) tz->bit64.charcnt);
+
+	printf ("%16s (%20s) = %3d [%5ld %1d %3d '%s' (%d,%d)]\n",
 		"", "", 0,
 		(long int) tz->type[0].offset,
 		tz->type[0].isdst,
@@ -355,8 +392,8 @@ void timelib_dump_tzinfo(timelib_tzinfo *tz)
 		tz->type[0].isstdcnt,
 		tz->type[0].isgmtcnt
 		);
-	for (i = 0; i < tz->bit32.timecnt; i++) {
-		printf ("%08X (%12d) = %3d [%5ld %1d %3d '%s' (%d,%d)]\n",
+	for (i = 0; i < tz->bit64.timecnt; i++) {
+		printf ("%016lX (%20ld) = %3d [%5ld %1d %3d '%s' (%d,%d)]\n",
 			tz->trans[i], tz->trans[i], tz->trans_idx[i],
 			(long int) tz->type[tz->trans_idx[i]].offset,
 			tz->type[tz->trans_idx[i]].isdst,
@@ -366,8 +403,8 @@ void timelib_dump_tzinfo(timelib_tzinfo *tz)
 			tz->type[tz->trans_idx[i]].isgmtcnt
 			);
 	}
-	for (i = 0; i < tz->bit32.leapcnt; i++) {
-		printf ("%08X (%12ld) = %d\n",
+	for (i = 0; i < tz->bit64.leapcnt; i++) {
+		printf ("%016lX (%20ld) = %d\n",
 			tz->leap_times[i].trans,
 			(long) tz->leap_times[i].trans,
 			tz->leap_times[i].offset);
@@ -470,31 +507,35 @@ timelib_tzinfo *timelib_parse_tzfile(char *timezone, const timelib_tzdb *tzdb, i
 			timelib_tzinfo_dtor(tmp);
 			return NULL;
 		}
+		if (version < 2 || version > 3) {
+			*error_code = TIMELIB_ERROR_UNSUPPORTED_VERSION;
+			timelib_tzinfo_dtor(tmp);
+			return NULL;
+		}
 //printf("- timezone: %s, version: %0d\n", timezone, version);
 
-		read_header(&tzf, tmp);
-		if ((transitions_result = read_transitions(&tzf, tmp)) != 0) {
+		read_32bit_header(&tzf, tmp);
+		skip_32bit_transitions(&tzf, tmp);
+		skip_32bit_types(&tzf, tmp);
+
+		if (!skip_64bit_preamble(&tzf, tmp)) {
+			/* 64 bit preamble is not in place */
+			*error_code = TIMELIB_ERROR_CORRUPT_NO_64BIT_PREAMBLE;
+			return NULL;
+		}
+		read_64bit_header(&tzf, tmp);
+		if ((transitions_result = read_64bit_transitions(&tzf, tmp)) != 0) {
 			/* Corrupt file as transitions do not increase */
 			*error_code = transitions_result;
 			timelib_tzinfo_dtor(tmp);
 			return NULL;
 		}
-		if ((types_result = read_types(&tzf, tmp)) != 0) {
+		if ((types_result = read_64bit_types(&tzf, tmp)) != 0) {
 			*error_code = types_result;
 			timelib_tzinfo_dtor(tmp);
 			return NULL;
 		}
-		if (version == 2 || version == 3) {
-			if (!skip_64bit_preamble(&tzf, tmp)) {
-				/* 64 bit preamble is not in place */
-				*error_code = TIMELIB_ERROR_CORRUPT_NO_64BIT_PREAMBLE;
-				return NULL;
-			}
-			read_64bit_header(&tzf, tmp);
-			skip_64bit_transitions(&tzf, tmp);
-			skip_64bit_types(&tzf, tmp);
-			skip_posix_string(&tzf, tmp);
-		}
+		skip_posix_string(&tzf, tmp);
 
 		if (type == TIMELIB_TZINFO_PHP) {
 			read_location(&tzf, tmp);
@@ -525,29 +566,35 @@ void timelib_tzinfo_dtor(timelib_tzinfo *tz)
 timelib_tzinfo *timelib_tzinfo_clone(timelib_tzinfo *tz)
 {
 	timelib_tzinfo *tmp = timelib_tzinfo_ctor(tz->name);
-	tmp->bit32.ttisgmtcnt = tz->bit32.ttisgmtcnt;
-	tmp->bit32.ttisstdcnt = tz->bit32.ttisstdcnt;
-	tmp->bit32.leapcnt = tz->bit32.leapcnt;
-	tmp->bit32.timecnt = tz->bit32.timecnt;
-	tmp->bit32.typecnt = tz->bit32.typecnt;
-	tmp->bit32.charcnt = tz->bit32.charcnt;
+	tmp->_bit32.ttisgmtcnt = tz->_bit32.ttisgmtcnt;
+	tmp->_bit32.ttisstdcnt = tz->_bit32.ttisstdcnt;
+	tmp->_bit32.leapcnt = tz->_bit32.leapcnt;
+	tmp->_bit32.timecnt = tz->_bit32.timecnt;
+	tmp->_bit32.typecnt = tz->_bit32.typecnt;
+	tmp->_bit32.charcnt = tz->_bit32.charcnt;
+	tmp->bit64.ttisgmtcnt = tz->bit64.ttisgmtcnt;
+	tmp->bit64.ttisstdcnt = tz->bit64.ttisstdcnt;
+	tmp->bit64.leapcnt = tz->bit64.leapcnt;
+	tmp->bit64.timecnt = tz->bit64.timecnt;
+	tmp->bit64.typecnt = tz->bit64.typecnt;
+	tmp->bit64.charcnt = tz->bit64.charcnt;
 
-	if (tz->bit32.timecnt) {
-		tmp->trans = (int32_t *) timelib_malloc(tz->bit32.timecnt * sizeof(int32_t));
-		tmp->trans_idx = (unsigned char*) timelib_malloc(tz->bit32.timecnt * sizeof(unsigned char));
-		memcpy(tmp->trans, tz->trans, tz->bit32.timecnt * sizeof(int32_t));
-		memcpy(tmp->trans_idx, tz->trans_idx, tz->bit32.timecnt * sizeof(unsigned char));
+	if (tz->bit64.timecnt) {
+		tmp->trans = (int64_t *) timelib_malloc(tz->bit64.timecnt * sizeof(int64_t));
+		tmp->trans_idx = (unsigned char*) timelib_malloc(tz->bit64.timecnt * sizeof(unsigned char));
+		memcpy(tmp->trans, tz->trans, tz->bit64.timecnt * sizeof(int64_t));
+		memcpy(tmp->trans_idx, tz->trans_idx, tz->bit64.timecnt * sizeof(unsigned char));
 	}
 
-	tmp->type = (ttinfo*) timelib_malloc(tz->bit32.typecnt * sizeof(ttinfo));
-	memcpy(tmp->type, tz->type, tz->bit32.typecnt * sizeof(ttinfo));
+	tmp->type = (ttinfo*) timelib_malloc(tz->bit64.typecnt * sizeof(ttinfo));
+	memcpy(tmp->type, tz->type, tz->bit64.typecnt * sizeof(ttinfo));
 
-	tmp->timezone_abbr = (char*) timelib_malloc(tz->bit32.charcnt);
-	memcpy(tmp->timezone_abbr, tz->timezone_abbr, tz->bit32.charcnt);
+	tmp->timezone_abbr = (char*) timelib_malloc(tz->bit64.charcnt);
+	memcpy(tmp->timezone_abbr, tz->timezone_abbr, tz->bit64.charcnt);
 
-	if (tz->bit32.leapcnt) {
-		tmp->leap_times = (tlinfo*) timelib_malloc(tz->bit32.leapcnt * sizeof(tlinfo));
-		memcpy(tmp->leap_times, tz->leap_times, tz->bit32.leapcnt * sizeof(tlinfo));
+	if (tz->bit64.leapcnt) {
+		tmp->leap_times = (tlinfo*) timelib_malloc(tz->bit64.leapcnt * sizeof(tlinfo));
+		memcpy(tmp->leap_times, tz->leap_times, tz->bit64.leapcnt * sizeof(tlinfo));
 	}
 
 	return tmp;
@@ -559,9 +606,9 @@ static ttinfo* fetch_timezone_offset(timelib_tzinfo *tz, timelib_sll ts, timelib
 
 	/* If there is no transition time, we pick the first one, if that doesn't
 	 * exist we return NULL */
-	if (!tz->bit32.timecnt || !tz->trans) {
+	if (!tz->bit64.timecnt || !tz->trans) {
 		*transition_time = 0;
-		if (tz->bit32.typecnt == 1) {
+		if (tz->bit64.typecnt == 1) {
 			return &(tz->type[0]);
 		}
 		return NULL;
@@ -572,40 +619,30 @@ static ttinfo* fetch_timezone_offset(timelib_tzinfo *tz, timelib_sll ts, timelib
 	 * one in case there are only DST entries. Not sure which smartass came up
 	 * with this idea in the first though :) */
 	if (ts < tz->trans[0]) {
-		uint32_t j;
-
-		*transition_time = 0;
-		j = 0;
-		while (j < tz->bit32.timecnt && tz->type[tz->trans_idx[j]].isdst) {
-			++j;
-		}
-		if (j == tz->bit32.timecnt) {
-			j = 0;
-		}
-		return &(tz->type[tz->trans_idx[j]]);
+		return &(tz->type[0]);
 	}
 
 	/* In all other cases we loop through the available transition times to find
 	 * the correct entry */
-	for (i = 0; i < tz->bit32.timecnt; i++) {
+	for (i = 0; i < tz->bit64.timecnt; i++) {
 		if (ts < tz->trans[i]) {
 			*transition_time = tz->trans[i - 1];
 			return &(tz->type[tz->trans_idx[i - 1]]);
 		}
 	}
-	*transition_time = tz->trans[tz->bit32.timecnt - 1];
-	return &(tz->type[tz->trans_idx[tz->bit32.timecnt - 1]]);
+	*transition_time = tz->trans[tz->bit64.timecnt - 1];
+	return &(tz->type[tz->trans_idx[tz->bit64.timecnt - 1]]);
 }
 
 static tlinfo* fetch_leaptime_offset(timelib_tzinfo *tz, timelib_sll ts)
 {
 	int i;
 
-	if (!tz->bit32.leapcnt || !tz->leap_times) {
+	if (!tz->bit64.leapcnt || !tz->leap_times) {
 		return NULL;
 	}
 
-	for (i = tz->bit32.leapcnt - 1; i > 0; i--) {
+	for (i = tz->bit64.leapcnt - 1; i > 0; i--) {
 		if (ts > tz->leap_times[i].trans) {
 			return &(tz->leap_times[i]);
 		}

ext/date/lib/timelib.h

@@ -153,7 +153,7 @@ typedef struct _timelib_tzinfo
 		uint32_t timecnt;
 		uint32_t typecnt;
 		uint32_t charcnt;
-	} bit32;
+	} _bit32;
 	struct {
 		uint64_t ttisgmtcnt;
 		uint64_t ttisstdcnt;
@@ -163,7 +163,7 @@ typedef struct _timelib_tzinfo
 		uint64_t charcnt;
 	} bit64;
 
-	int32_t *trans;
+	int64_t *trans;
 	unsigned char *trans_idx;
 
 	ttinfo  *type;
@@ -322,8 +322,8 @@ typedef struct _timelib_tzdb {
 #endif
 
 #define TIMELIB_VERSION 201801
-#define TIMELIB_EXTENDED_VERSION 20180103
-#define TIMELIB_ASCII_VERSION "2018.01RC1"
+#define TIMELIB_EXTENDED_VERSION 20180105
+#define TIMELIB_ASCII_VERSION "2018.01RC3"
 
 #define TIMELIB_NONE             0x00
 #define TIMELIB_OVERRIDE_TIME    0x01

ext/date/lib/timelib.m4

@@ -1,80 +0,0 @@
-dnl
-dnl TL_DEF_HAVE(what [, why])
-dnl
-dnl Generates 'AC_DEFINE(HAVE_WHAT, 1, [WHY])'
-dnl
-AC_DEFUN([TL_DEF_HAVE],[AC_DEFINE([HAVE_]translit($1,a-z_.-,A-Z___),1,[ $2 ])])dnl
-
-dnl
-dnl TL_CHECK_INT_TYPE(type)
-dnl
-AC_DEFUN([TL_CHECK_INT_TYPE],[
-AC_CACHE_CHECK([for $1], ac_cv_int_type_$1, [
-AC_TRY_COMPILE([
-#if HAVE_SYS_TYPES_H
-# include <sys/types.h>
-#endif
-#if HAVE_INTTYPES_H
-# include <inttypes.h>
-#elif HAVE_STDINT_H   
-# include <stdint.h>  
-#endif],
-[if (($1 *) 0)
-  return 0;   
-if (sizeof ($1))
-  return 0;
-], [ac_cv_int_type_$1=yes], [ac_cv_int_type_$1=no])
-])
-if test "$ac_cv_int_type_$1" = "yes"; then
-  TL_DEF_HAVE($1, [Define if $1 type is present.])
-fi
-])dnl
-
-dnl
-dnl AC_TIMELIB_C_BIGENDIAN
-dnl Replacement macro for AC_C_BIGENDIAN
-dnl
-AC_DEFUN([AC_TIMELIB_C_BIGENDIAN],
-[AC_CACHE_CHECK([whether byte ordering is bigendian], ac_cv_c_bigendian_php,
- [
-  ac_cv_c_bigendian_php=unknown
-  AC_TRY_RUN(
-  [
-int main(void)
-{
-        short one = 1;
-        char *cp = (char *)&one;
-
-        if (*cp == 0) {
-                return(0);
-        } else {
-                return(1);
-        }
-} 
-  ], [ac_cv_c_bigendian_php=yes], [ac_cv_c_bigendian_php=no], [ac_cv_c_bigendian_php=unknown])
- ])
- if test $ac_cv_c_bigendian_php = yes; then
-   AC_DEFINE(WORDS_BIGENDIAN, [], [Define if processor uses big-endian word])
- fi
-])dnl
-
-dnl Check for types, sizes, etc. needed by timelib
-AC_CHECK_SIZEOF(long, 8)
-AC_CHECK_SIZEOF(int, 4)
-TL_CHECK_INT_TYPE(int32_t)
-TL_CHECK_INT_TYPE(uint32_t)
-
-dnl Check for headers needed by timelib
-AC_CHECK_HEADERS([ \
-sys/time.h \
-sys/types.h \
-stdint.h \
-dirent.h \
-string.h \
-strings.h \
-unistd.h \
-io.h
-])
-
-dnl Check for strtoll, atoll
-AC_CHECK_FUNCS(strtoll atoll strftime gettimeofday)

ext/date/lib/timelib_private.h

@@ -123,7 +123,7 @@ struct _ttinfo
 
 struct _tlinfo
 {
-	int32_t  trans;
+	int64_t  trans;
 	int32_t  offset;
 };
 

ext/date/php_date.c

@@ -4032,7 +4032,7 @@ PHP_FUNCTION(timezone_transitions_get)
 		add_assoc_string(&element, "abbr", &tzobj->tzi.tz->timezone_abbr[tzobj->tzi.tz->type[tzobj->tzi.tz->trans_idx[i]].abbr_idx]); \
 		add_next_index_zval(return_value, &element);
 
-#define add_last() add(tzobj->tzi.tz->bit32.timecnt - 1, timestamp_begin)
+#define add_last() add(tzobj->tzi.tz->bit64.timecnt - 1, timestamp_begin)
 
 	array_init(return_value);
 
@@ -4043,7 +4043,7 @@ PHP_FUNCTION(timezone_transitions_get)
 	} else {
 		begin = 0;
 		found = 0;
-		if (tzobj->tzi.tz->bit32.timecnt > 0) {
+		if (tzobj->tzi.tz->bit64.timecnt > 0) {
 			do {
 				if (tzobj->tzi.tz->trans[begin] > timestamp_begin) {
 					if (begin > 0) {
@@ -4055,19 +4055,19 @@ PHP_FUNCTION(timezone_transitions_get)
 					break;
 				}
 				begin++;
-			} while (begin < tzobj->tzi.tz->bit32.timecnt);
+			} while (begin < tzobj->tzi.tz->bit64.timecnt);
 		}
 	}
 
 	if (!found) {
-		if (tzobj->tzi.tz->bit32.timecnt > 0) {
+		if (tzobj->tzi.tz->bit64.timecnt > 0) {
 			add_last();
 		} else {
 			add_nominal();
 		}
 	} else {
 		unsigned int i;
-		for (i = begin; i < tzobj->tzi.tz->bit32.timecnt; ++i) {
+		for (i = begin; i < tzobj->tzi.tz->bit64.timecnt; ++i) {
 			if (tzobj->tzi.tz->trans[i] < timestamp_end) {
 				add(i, tzobj->tzi.tz->trans[i]);
 			}
@@ -5275,7 +5275,6 @@ PHP_METHOD(DatePeriod, __wakeup)
 /* {{{ date_period_read_property */
 static zval *date_period_read_property(zval *object, zval *member, int type, void **cache_slot, zval *rv)
 {
-	zval *zv;
 	if (type != BP_VAR_IS && type != BP_VAR_R) {
 		zend_throw_error(NULL, "Retrieval of DatePeriod properties for modification is unsupported");
 		return &EG(uninitialized_zval);
@@ -5283,13 +5282,7 @@ static zval *date_period_read_property(zval *object, zval *member, int type, voi
 
 	Z_OBJPROP_P(object); /* build properties hash table */
 
-	zv = zend_std_read_property(object, member, type, cache_slot, rv);
-	if (Z_TYPE_P(zv) == IS_OBJECT && Z_OBJ_HANDLER_P(zv, clone_obj)) {
-		/* defensive copy */
-		ZVAL_OBJ(zv, Z_OBJ_HANDLER_P(zv, clone_obj)(zv));
-	}
-
-	return zv;
+	return zend_std_read_property(object, member, type, cache_slot, rv);
 }
 /* }}} */
 

ext/date/tests/bug33414-1.phpt

@@ -95,11 +95,11 @@ print "wanted=Friday            00:00:00\n\n";
 
 print "TZ=Pacific/Kwajalein - wrong day.\n";
 date_default_timezone_set("Pacific/Kwajalein");
-$tStamp = mktime (17, 17, 17, 1, 8626, 1970);
+$tStamp = mktime (17, 17, 17, 1, 8627, 1970);
 print "tStamp=". date("l Y-m-d H:i:s T I", $tStamp). "\n";
-$strtotime_tstamp = strtotime("next Friday", $tStamp);
+$strtotime_tstamp = strtotime("next Saturday", $tStamp);
 print "result=".date("l Y-m-d H:i:s T I", $strtotime_tstamp)."\n";
-print "wanted=Friday            00:00:00\n\n";
+print "wanted=Sunday            00:00:00\n\n";
 
 print "TZ=Asia/Ulan_Bator - wrong day.\n";
 date_default_timezone_set("Asia/Ulan_Bator");
@@ -256,9 +256,9 @@ result=Friday 2003-04-04 00:00:00 EEST 1
 wanted=Friday            00:00:00
 
 TZ=Pacific/Kwajalein - wrong day.
-tStamp=Friday 1993-08-13 17:17:17 -12 0
-result=Saturday 1993-08-21 00:00:00 +12 0
-wanted=Friday            00:00:00
+tStamp=Saturday 1993-08-14 17:17:17 -12 0
+result=Sunday 1993-08-22 00:00:00 +12 0
+wanted=Sunday            00:00:00
 
 TZ=Asia/Ulan_Bator - wrong day.
 tStamp=Saturday 2001-09-22 17:17:17 +09 1

ext/date/tests/bug33415-2.phpt

@@ -132,11 +132,11 @@ print "wanted=Wednesday            00:15:00\n\n";
 
 print "TZ=Pacific/Nauru - Is it OK for this to be 0:30? yes\n";
 date_default_timezone_set('Pacific/Nauru');
-$tStamp = mktime (17, 17, 17, 1, 3401, 1970);
+$tStamp = mktime (17, 17, 17, 2, 3, 1979);
 print "tStamp=". date("l Y-m-d H:i:s T I", $tStamp). "\n";
-$strtotime_tstamp = strtotime("next Tuesday", $tStamp);
+$strtotime_tstamp = strtotime("next Saturday +2 hours", $tStamp);
 print "result=".date("l Y-m-d H:i:s T I", $strtotime_tstamp)."\n";
-print "wanted=Tuesday            00:30:00\n\n";
+print "wanted=Saturday            02:30:00\n\n";
 
 print "TZ=Pacific/Niue - Is it OK for this to be 0:30 AM? yes\n";
 date_default_timezone_set('Pacific/Niue');
@@ -292,9 +292,9 @@ result=Wednesday 1986-01-01 00:15:00 +0545 0
 wanted=Wednesday            00:15:00
 
 TZ=Pacific/Nauru - Is it OK for this to be 0:30? yes
-tStamp=Tuesday 1979-04-24 17:17:17 +1130 0
-result=Tuesday 1979-05-01 00:30:00 +12 0
-wanted=Tuesday            00:30:00
+tStamp=Saturday 1979-02-03 17:17:17 +1130 0
+result=Saturday 1979-02-10 02:30:00 +12 0
+wanted=Saturday            02:30:00
 
 TZ=Pacific/Niue - Is it OK for this to be 0:30 AM? yes
 tStamp=Sunday 1978-09-24 17:17:17 -1130 0

ext/date/tests/bug77097.phpt

@@ -0,0 +1,33 @@
+--TEST--
+Bug #77097 (DateTime::diff gives wrong diff when the actual diff is less than 1 second)
+--FILE--
+<?php
+$now = new DateTime('2018-11-03 11:34:20.781751');
+$ago = new DateTime('2018-11-03 11:34:20.000000');
+
+$diff = $now->diff($ago);
+var_dump($diff->invert, $diff->s, $diff->f);
+
+$diff = $ago->diff($now);
+var_dump($diff->invert, $diff->s, $diff->f);
+
+$diff = $now->diff($ago, true);
+var_dump($diff->invert, $diff->s, $diff->f);
+
+$diff = $ago->diff($now, true);
+var_dump($diff->invert, $diff->s, $diff->f);
+?>
+--EXPECTF--
+int(1)
+int(0)
+float(0.781751)
+int(0)
+int(0)
+float(0.781751)
+int(0)
+int(0)
+float(0.781751)
+int(0)
+int(0)
+float(0.781751)
+

ext/date/tests/date_modify-1.phpt

@@ -3,7 +3,7 @@ date_modify() function [1]
 --FILE--
 <?php
 date_default_timezone_set("Pacific/Kwajalein");
-$ts = date_create("Thu Aug 19 1993 23:59:59");
+$ts = date_create("Fri Aug 20 1993 23:59:59");
 echo date_format($ts, 'D, d M Y H:i:s T'), "\n";
 $ts->modify("+1 second");
 echo date_format($ts, 'D, d M Y H:i:s T'), "\n";
@@ -20,8 +20,8 @@ $ts->modify("+ 1 hour 1 second");
 echo date_format($ts, 'D, d M Y H:i:s T'), "\n";
 ?>
 --EXPECT--
-Thu, 19 Aug 1993 23:59:59 -12
-Sat, 21 Aug 1993 00:00:00 +12
+Fri, 20 Aug 1993 23:59:59 -12
+Sun, 22 Aug 1993 00:00:00 +12
 Sun, 27 Mar 2005 01:59:59 CET
 Sun, 27 Mar 2005 03:00:00 CEST
 Sun, 30 Oct 2005 01:59:59 CEST

ext/exif/exif.c

@@ -2415,7 +2415,7 @@ static void add_assoc_image_info(zval *value, int sub_array, image_info_type *im
 									break;
 
 								case TAG_FMT_URATIONAL:
-									snprintf(buffer, sizeof(buffer), "%i/%i", info_value->ur.num, info_value->ur.den);
+									snprintf(buffer, sizeof(buffer), "%u/%u", info_value->ur.num, info_value->ur.den);
 									if (l==1) {
 										add_assoc_string(&tmpi, name, buffer);
 									} else {
@@ -3125,7 +3125,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 		break;
 	}
 
-	if (maker_note->offset >= value_len) {
+	if (value_len < 2 || maker_note->offset >= value_len - 1) {
 		/* Do not go past the value end */
 		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "IFD data too short: 0x%04X offset 0x%04X", value_len, maker_note->offset);
 		return FALSE;
@@ -3180,6 +3180,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 #endif
 		default:
 		case MN_OFFSET_NORMAL:
+			data_len = value_len;
 			break;
 	}
 
@@ -3378,6 +3379,10 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				break;
 
 			case TAG_USERCOMMENT:
+				EFREE_IF(ImageInfo->UserComment);
+				ImageInfo->UserComment = NULL;
+				EFREE_IF(ImageInfo->UserCommentEncoding);
+				ImageInfo->UserCommentEncoding = NULL;
 				ImageInfo->UserCommentLength = exif_process_user_comment(ImageInfo, &(ImageInfo->UserComment), &(ImageInfo->UserCommentEncoding), value_ptr, byte_count);
 				break;
 
@@ -3899,7 +3904,7 @@ static int exif_scan_thumbnail(image_info_type *ImageInfo)
 			return FALSE;
 		marker = c;
 		length = php_jpg_get16(data+pos);
-		if (pos+length>=ImageInfo->Thumbnail.size) {
+		if (length > ImageInfo->Thumbnail.size || pos >= ImageInfo->Thumbnail.size - length) {
 			return FALSE;
 		}
 #ifdef EXIF_DEBUG
@@ -3920,6 +3925,10 @@ static int exif_scan_thumbnail(image_info_type *ImageInfo)
 			case M_SOF14:
 			case M_SOF15:
 				/* handle SOFn block */
+				if (length < 8 || ImageInfo->Thumbnail.size - 8 < pos) {
+					/* exif_process_SOFn needs 8 bytes */
+					return FALSE;
+				}
 				exif_process_SOFn(data+pos, marker, &sof_info);
 				ImageInfo->Thumbnail.height   = sof_info.height;
 				ImageInfo->Thumbnail.width    = sof_info.width;
@@ -3957,10 +3966,10 @@ static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offse
 	tag_table_type tag_table = exif_get_tag_table(section_index);
 
 	if (ImageInfo->ifd_nesting_level > MAX_IFD_NESTING_LEVEL) {
-                return FALSE;
-        }
+		return FALSE;
+	}
 
-	if (ImageInfo->FileSize >= dir_offset+2) {
+	if (ImageInfo->FileSize >= 2 && ImageInfo->FileSize - 2 >= dir_offset) {
 		sn = exif_file_sections_add(ImageInfo, M_PSEUDO, 2, NULL);
 #ifdef EXIF_DEBUG
 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read from TIFF: filesize(x%04X), IFD dir(x%04X + x%04X)", ImageInfo->FileSize, dir_offset, 2);
@@ -3968,8 +3977,8 @@ static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offse
 		php_stream_seek(ImageInfo->infile, dir_offset, SEEK_SET); /* we do not know the order of sections */
 		php_stream_read(ImageInfo->infile, (char*)ImageInfo->file.list[sn].data, 2);
 		num_entries = php_ifd_get16u(ImageInfo->file.list[sn].data, ImageInfo->motorola_intel);
-		dir_size = 2/*num dir entries*/ +12/*length of entry*/*num_entries +4/* offset to next ifd (points to thumbnail or NULL)*/;
-		if (ImageInfo->FileSize >= dir_offset+dir_size) {
+		dir_size = 2/*num dir entries*/ +12/*length of entry*/*(size_t)num_entries +4/* offset to next ifd (points to thumbnail or NULL)*/;
+		if (ImageInfo->FileSize >= dir_size && ImageInfo->FileSize - dir_size >= dir_offset) {
 #ifdef EXIF_DEBUG
 			exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read from TIFF: filesize(x%04X), IFD dir(x%04X + x%04X), IFD entries(%d)", ImageInfo->FileSize, dir_offset+2, dir_size-2, num_entries);
 #endif
@@ -4052,9 +4061,9 @@ static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offse
 					}
 				}
 			}
-			if (ImageInfo->FileSize >= dir_offset + ImageInfo->file.list[sn].size) {
+			if (ImageInfo->FileSize >= ImageInfo->file.list[sn].size && ImageInfo->FileSize - ImageInfo->file.list[sn].size >= dir_offset) {
 				if (ifd_size > dir_size) {
-					if (dir_offset + ifd_size > ImageInfo->FileSize) {
+					if (ImageInfo->FileSize < ifd_size || dir_offset > ImageInfo->FileSize - ifd_size) {
 						exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Error in TIFF: filesize(x%04X) less than size of IFD(x%04X + x%04X)", ImageInfo->FileSize, dir_offset, ifd_size);
 						return FALSE;
 					}
@@ -4651,7 +4660,9 @@ PHP_FUNCTION(exif_thumbnail)
 	ZVAL_STRINGL(return_value, ImageInfo.Thumbnail.data, ImageInfo.Thumbnail.size);
 	if (arg_c >= 3) {
 		if (!ImageInfo.Thumbnail.width || !ImageInfo.Thumbnail.height) {
-			exif_scan_thumbnail(&ImageInfo);
+			if (!exif_scan_thumbnail(&ImageInfo)) {
+				ImageInfo.Thumbnail.width = ImageInfo.Thumbnail.height = 0;
+			}
 		}
 		zval_ptr_dtor(z_width);
 		zval_ptr_dtor(z_height);

ext/exif/tests/bug77184/bug77184.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Bug #74428 (Unsigned rational numbers are written out as signed rationals)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--INI--
+output_handler=
+zlib.output_compression=0
+--FILE--
+<?php
+$infile = dirname(__FILE__).'/DJI_0245_tiny.JPG';
+$tags = exif_read_data($infile);
+echo $tags['GPSLatitude'][2], PHP_EOL;
+echo $tags['GPSLongitude'][2], PHP_EOL;
+?>
+===DONE===
+--EXPECTF--
+156691934/70000000
+2672193571/70000000
+===DONE===

ext/exif/tests/bug77540.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug 77540 (Invalid Read on exif_process_SOFn)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+$width = $height = 42;
+$s = exif_thumbnail(__DIR__."/bug77540.jpg", $width, $height);
+echo "Width ".$width."\n";
+echo "Height ".$height."\n";
+?>
+DONE
+--EXPECTF--
+Width 0
+Height 0
+DONE

ext/exif/tests/bug77563.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug 77563 (Uninitialized read in exif_process_IFD_in_MAKERNOTE)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+$s = exif_thumbnail(__DIR__."/bug77563.jpg");
+?>
+DONE
+--EXPECTF--
+Warning: exif_thumbnail(bug77563.jpg): IFD data too short: 0x0009 offset 0x0008 in %s%ebug77563.php on line %d
+
+Warning: exif_thumbnail(bug77563.jpg): File structure corrupted in %s%ebug77563.php on line %d
+
+Warning: exif_thumbnail(bug77563.jpg): Invalid JPEG file in %s%ebug77563.php on line %d
+DONE

ext/exif/tests/bug77564/bug77564.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug 77564 (Memory leak in exif_process_IFD_TAG)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+var_dump(exif_read_data(dirname(__FILE__) . '/bug77564.jpg'));
+?>
+DONE
+--EXPECTF--
+
+Warning: exif_read_data(bug77564.jpg): Illegal IFD offset in %sbug77564.php on line %d
+
+Warning: exif_read_data(bug77564.jpg): File structure corrupted in %sbug77564.php on line %d
+
+Warning: exif_read_data(bug77564.jpg): Invalid JPEG file in %sbug77564.php on line %d
+bool(false)
+DONE

ext/fileinfo/libmagic.patch

@@ -3882,7 +3882,7 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
  	    if (NOTMIME(ms)) {
 diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 --- libmagic.orig/softmagic.c	2018-04-15 20:49:15.000000000 +0200
-+++ libmagic/softmagic.c	2018-11-05 21:33:14.919371593 +0100
++++ libmagic/softmagic.c	2018-11-10 12:18:21.864916065 +0100
 @@ -43,6 +43,10 @@
  #include <time.h>
  #include "der.h"
@@ -3944,7 +3944,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 -	if (rc) {
 -		file_regerror(&rx, rc, ms);
 +	(void)setlocale(LC_CTYPE, "C");
-+	pattern = zend_string_init("~%[-0-9.]*s~", sizeof("~%[-0-9.]*s~") - 1, 0);
++	pattern = zend_string_init("~%[-0-9\\.]*s~", sizeof("~%[-0-9\\.]*s~") - 1, 0);
 +	if ((pce = pcre_get_compiled_regex(pattern, &capture_count, &re_options)) == NULL) {
 +		rv = -1;
  	} else {

ext/fileinfo/libmagic/softmagic.c

@@ -431,7 +431,7 @@ check_fmt(struct magic_set *ms, const char *fmt)
 		return 0;
 
 	(void)setlocale(LC_CTYPE, "C");
-	pattern = zend_string_init("~%[-0-9.]*s~", sizeof("~%[-0-9.]*s~") - 1, 0);
+	pattern = zend_string_init("~%[-0-9\\.]*s~", sizeof("~%[-0-9\\.]*s~") - 1, 0);
 	if ((pce = pcre_get_compiled_regex(pattern, &capture_count, &re_options)) == NULL) {
 		rv = -1;
 	} else {

ext/fileinfo/magicdata.patch

@@ -1,86 +1,122 @@
-diff -u Magdir.orig/cafebabe Magdir/cafebabe
---- Magdir.orig/cafebabe	2017-05-25 22:07:23.000000000 +0200
-+++ Magdir/cafebabe	2018-04-28 12:26:00.840857162 +0200
-@@ -15,22 +15,6 @@
- # might add another one or two as time goes by...
- #
- ### JAVA START ###
--0	belong		0xcafebabe
-->4	belong		>30		compiled Java class data,
--!:mime	application/x-java-applet
-->>6	beshort		x	        version %d.
-->>4	beshort		x       	\b%d
--# Which is which?
--#>>4	belong		0x032d		(Java 1.0)
--#>>4	belong		0x032d		(Java 1.1)
-->>4	belong		0x002e		(Java 1.2)
-->>4	belong		0x002f		(Java 1.3)
-->>4	belong		0x0030		(Java 1.4)
-->>4	belong		0x0031		(Java 1.5)
-->>4	belong		0x0032		(Java 1.6)
-->>4	belong		0x0033		(Java 1.7)
-->>4	belong		0x0034		(Java 1.8)
--
- 0	belong		0xcafed00d	JAR compressed with pack200,
- >5	byte		x		version %d.
- >4	byte		x		\b%d
-@@ -52,15 +36,28 @@
+diff -u a/magic/Magdir/c-lang b/magic/Magdir/c-lang
+--- a/magic/Magdir/c-lang	2017-08-14 09:40:38.000000000 +0200
++++ b/magic/Magdir/c-lang	2018-11-10 13:06:33.171398452 +0100
+@@ -13,61 +13,61 @@
+ # C
+ # Check for class if include is found, otherwise class is beaten by include becouse of lowered strength
+ 0	regex	\^#include			C
+->0	regex	\^class[[:space:]]+
++>0	regex/4096	\^class[[:space:]]+
+ >>&0	regex 	\\{[\.\*]\\}(;)?$			\b++
+ >&0	clear	x				source text
+ !:strength + 13
+ !:mime	text/x-c
+-0	regex	\^#[[:space:]]*pragma	C source text
++0	regex/4096	\^#[[:space:]]*pragma	C source text
+ !:mime	text/x-c
+-0	regex	\^#[[:space:]]*(if\|ifn)def
+->&0	regex	\^#[[:space:]]*endif$	C source text
++0	regex/4096	\^#[[:space:]]*(if\|ifn)def
++>&0	regex/4096	\^#[[:space:]]*endif$	C source text
+ !:mime	text/x-c
+-0	regex	\^#[[:space:]]*(if\|ifn)def
+->&0	regex	\^#[[:space:]]*define	C source text
++0	regex/4096	\^#[[:space:]]*(if\|ifn)def
++>&0	regex/4096	\^#[[:space:]]*define	C source text
+ !:mime	text/x-c
+-0	regex	\^[[:space:]]*char(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$			C source text
++0	regex/4096	\^[[:space:]]*char(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$			C source text
+ !:mime	text/x-c
+-0	regex	\^[[:space:]]*double(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$			C source text
++0	regex/4096	\^[[:space:]]*double(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$			C source text
+ !:mime	text/x-c
+-0	regex	\^[[:space:]]*extern[[:space:]]+		C source text
++0	regex/4096	\^[[:space:]]*extern[[:space:]]+		C source text
+ !:mime	text/x-c
+-0	regex	\^[[:space:]]*float(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$			C source text
++0	regex/4096	\^[[:space:]]*float(\ \\*|\\*)(.+)(=.*)?;[[:space:]]*$			C source text
+ !:mime	text/x-c
+-0	regex	\^struct[[:space:]]+		C source text
++0	regex/4096	\^struct[[:space:]]+		C source text
+ !:mime	text/x-c
+-0	regex	\^union[[:space:]]+		C source text
++0	regex/4096	\^union[[:space:]]+		C source text
+ !:mime	text/x-c
+ 0	search/8192	main(
+->&0 regex	\\)[[:space:]]*\\{		C source text
++>&0 regex/4096	\\)[[:space:]]*\\{		C source text
+ !:mime	text/x-c
  
- 0	belong		0xcafebabe
- >4	belong		1		Mach-O universal binary with 1 architecture:
--!:mime application/x-mach-binary
- >>8	use		mach-o		\b
-+0	belong		0xcafebabe
-+>4	belong		>30		compiled Java class data,
-+!:mime	application/x-java-applet
-+>>6	beshort		x	        version %d.
-+>>4	beshort		x       	\b%d
-+# Which is which?
-+#>>4	belong		0x032d		(Java 1.0)
-+#>>4	belong		0x032d		(Java 1.1)
-+>>4	belong		0x002e		(Java 1.2)
-+>>4	belong		0x002f		(Java 1.3)
-+>>4	belong		0x0030		(Java 1.4)
-+>>4	belong		0x0031		(Java 1.5)
-+>>4	belong		0x0032		(Java 1.6)
-+>>4	belong		0x0033		(Java 1.7)
-+>>4	belong		0x0034		(Java 1.8)
- >4	belong		>1
- >>4	belong		<20		Mach-O universal binary with %d architectures:
--!:mime application/x-mach-binary
- >>>8	use		mach-o		\b
-->>4	belong		2
-+>>4	belong		>2
- >>>28	use		mach-o		\b
-->>4	belong		3
-+>>4	belong		>3
- >>>48	use		mach-o		\b
- >>4	belong		4
- >>>68	use		mach-o		\b
-diff -u Magdir.orig/filesystems Magdir/filesystems
---- Magdir.orig/filesystems	2018-03-11 01:46:42.000000000 +0100
-+++ Magdir/filesystems	2018-04-28 12:26:11.080817126 +0200
-@@ -254,7 +254,7 @@
- 30		search/481	\x55\xAA
- # to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111)
- # DOS BPB information (70) and after DOS floppy (120) like in previous file version
--!:strength +65
-+!:strength +0
- # for sector sizes < 512 Bytes
- >11		uleshort	<512
- >>(11.s-2)	uleshort	0xAA55		DOS/MBR boot sector
-@@ -266,7 +266,7 @@
- 0x1FE          leshort         0xAA55         	DOS/MBR boot sector
- #
- # to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version
--!:strength +65
-+!:strength +0
- >2		string		OSBS		OS/BS MBR
- # added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/
- # and http://en.wikipedia.org/wiki/Master_Boot_Record
-diff -u Magdir.orig/rpm Magdir/rpm
---- Magdir.orig/rpm	2013-01-11 17:45:23.000000000 +0100
-+++ Magdir/rpm	2018-04-28 12:26:14.072805431 +0200
+ # C++
+ # The strength of these rules is increased so they beat the C rules above
+-0	regex	\^namespace[[:space:]]+[_[:alpha:]]{1,30}[[:space:]]*\\{	C++ source text
++0	regex/4096	\^namespace[[:space:]]+[_[:alpha:]]{1,30}[[:space:]]*\\{	C++ source text
+ !:strength + 30
+ !:mime	text/x-c++
+ # using namespace [namespace] or using std::[lib]
+-0	regex	\^using[[:space:]]+(namespace\ )?std(::)?[[:alpha:]]*[[:space:]]*;		C++ source text
++0	regex/4096	\^using[[:space:]]+(namespace\ )?std(::)?[[:alpha:]]*[[:space:]]*;		C++ source text
+ !:strength + 30
+ !:mime	text/x-c++
+-0	regex	\^[[:space:]]*template[[:space:]]*<.*>[[:space:]]*$	C++ source text
++0	regex/4096	\^[[:space:]]*template[[:space:]]*<.*>[[:space:]]*$	C++ source text
+ !:strength + 30
+ !:mime	text/x-c++
+-0	regex	\^[[:space:]]*virtual[[:space:]]+.*[};][[:space:]]*$		C++ source text
++0	regex/4096	\^[[:space:]]*virtual[[:space:]]+.*[};][[:space:]]*$		C++ source text
+ !:strength + 30
+ !:mime	text/x-c++
+ # But class alone is reduced to avoid beating php (Jens Schleusener)
+-0	regex	\^[[:space:]]*class[[:space:]]+[[:digit:][:alpha:]:_]+[[:space:]]*\\{(.*[\n]*)*\\}(;)?$		C++ source text
++0	regex/4096	\^[[:space:]]*class[[:space:]]+[[:digit:][:alpha:]:_]+[[:space:]]*\\{(.*[\n]*)*\\}(;)?$		C++ source text
+ !:strength + 13
+ !:mime	text/x-c++
+-0	regex	\^[[:space:]]*public:		C++ source text
++0	regex/4096	\^[[:space:]]*public:		C++ source text
+ !:strength + 30
+ !:mime	text/x-c++
+-0	regex	\^[[:space:]]*private:		C++ source text
++0	regex/4096	\^[[:space:]]*private:		C++ source text
+ !:strength + 30
+ !:mime	text/x-c++
+-0	regex	\^[[:space:]]*protected:		C++ source text
++0	regex/4096	\^[[:space:]]*protected:		C++ source text
+ !:strength + 30
+ !:mime	text/x-c++
+ 
+diff -u a/magic/Magdir/python b/magic/Magdir/python
+--- a/magic/Magdir/python	2017-08-14 09:40:38.000000000 +0200
++++ b/magic/Magdir/python	2018-11-10 13:06:36.799268528 +0100
+@@ -63,7 +63,7 @@
+ !:mime text/x-python
+ 
+ # import module [as abrev]
+-0	regex	\^import\ [_[:alpha:]]+\ as\ [[:alpha:]][[:space:]]*$ Python script text executable
++0	regex/4096	\^import\ [_[:alpha:]]+\ as\ [[:alpha:]][[:space:]]*$ Python script text executable
+ !:mime text/x-python
+ 
+ # comments
+@@ -79,7 +79,7 @@
+ # except: or finally:
+ # block
+ 0	search/4096	try:
+->&0	regex	\^[[:space:]]*except.*:$	Python script text executable
++>&0	regex/4096	\^[[:space:]]*except.*:$	Python script text executable
+ !:strength + 15
+ !:mime text/x-python
+ >&0	search/4096	finally:	Python script text executable
+@@ -91,7 +91,7 @@
+ !:mime text/x-python
+ 
+ # def name(*args, **kwargs):
+-0	regex	 \^[[:space:]]{0,50}def\ {1,50}[_a-zA-Z]{1,100}
++0	regex/4096	 \^[[:space:]]{0,50}def\ {1,50}[_a-zA-Z]{1,100}
+ >&0	regex	 \\(([[:alpha:]*_,\ ]){0,255}\\):$ Python script text executable
+ !:strength + 15
+ !:mime text/x-python
+diff -u a/magic/Magdir/rpm b/magic/Magdir/rpm
+--- a/magic/Magdir/rpm	2013-01-11 17:45:23.000000000 +0100
++++ b/magic/Magdir/rpm	2018-11-10 12:27:29.858619326 +0100
 @@ -29,6 +29,7 @@
  >>8	beshort		17		SuperH
  >>8	beshort		18		Xtensa
@@ -89,51 +125,56 @@ diff -u Magdir.orig/rpm Magdir/rpm
  
  #delta RPM    Daniel Novotny (dnovotny@redhat.com)
  0	string		drpm		Delta RPM
-diff -u Magdir.orig/securitycerts Magdir/securitycerts
---- Magdir.orig/securitycerts	2009-09-19 18:28:12.000000000 +0200
-+++ Magdir/securitycerts	2018-04-28 12:26:14.072805431 +0200
+diff -u a/magic/Magdir/ruby b/magic/Magdir/ruby
+--- a/magic/Magdir/ruby	2017-08-14 15:39:18.000000000 +0200
++++ b/magic/Magdir/ruby	2018-11-10 13:06:28.703557761 +0100
+@@ -22,30 +22,30 @@
+ # What looks like ruby, but does not have a shebang
+ # (modules and such)
+ # From: Lubomir Rintel <lkundrak@v3.sk>
+-0	regex		\^[[:space:]]*require[[:space:]]'[A-Za-z_/]+'
++0	regex/4096		\^[[:space:]]*require[[:space:]]'[A-Za-z_/]+'
+ >0	regex		def\ [a-z]|\ do$
+->>&0	regex		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
++>>&0	regex/4096		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
+ !:strength + 30
+ !:mime	text/x-ruby
+-0	regex		\^[[:space:]]*(class|module)[[:space:]][A-Z]
++0	regex/4096		\^[[:space:]]*(class|module)[[:space:]][A-Z]
+ >0	regex		(modul|includ)e\ [A-Z]|def\ [a-z]
+->>&0	regex		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
++>>&0	regex/4096		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
+ !:strength + 30
+ !:mime	text/x-ruby
+ # Classes with no modules or defs, beats simple ASCII
+-0	regex		\^[[:space:]]*(class|module)[[:space:]][A-Z]
+->&0	regex	\^[[:space:]]*end([[:space:]]+[;#if].*)?$		Ruby script text
++0	regex/4096		\^[[:space:]]*(class|module)[[:space:]][A-Z]
++>&0	regex/4096	\^[[:space:]]*end([[:space:]]+[;#if].*)?$		Ruby script text
+ !:strength + 10
+ !:mime	text/x-ruby
+ # Looks for function definition to balance python magic
+ # def name (args)
+ # end
+-0	regex		\^[[:space:]]*def\ [a-z]|def\ [[:alpha:]]+::[a-z]
+->&0	regex		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
++0	regex/4096		\^[[:space:]]*def\ [a-z]|def\ [[:alpha:]]+::[a-z]
++>&0	regex/4096		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
+ !:strength + 10
+ !:mime	text/x-ruby
+ 
+-0	regex		\^[[:space:]]*require[[:space:]]'[A-Za-z_/]+'	Ruby script text
++0	regex/4096		\^[[:space:]]*require[[:space:]]'[A-Za-z_/]+'	Ruby script text
+ !:mime	text/x-ruby
+-0 regex 	\^[[:space:]]*include\ ([A-Z]+[a-z]*(::))+	Ruby script text
++0 regex/4096 	\^[[:space:]]*include\ ([A-Z]+[a-z]*(::))+	Ruby script text
+ !:mime	text/x-ruby
+diff -u a/magic/Magdir/securitycerts b/magic/Magdir/securitycerts
+--- a/magic/Magdir/securitycerts	2009-09-19 18:28:12.000000000 +0200
++++ b/magic/Magdir/securitycerts	2018-11-10 12:27:29.858619326 +0100
 @@ -4,3 +4,5 @@
  0	search/1		-----BEGIN\ CERTIFICATE------	RFC1421 Security Certificate text
  0	search/1		-----BEGIN\ NEW\ CERTIFICATE	RFC1421 Security Certificate Signing Request text
  0	belong	0xedfeedfe	Sun 'jks' Java Keystore File data
 +
 +0	string \0volume_key	volume_key escrow packet
-diff -u Magdir.orig/varied.script Magdir/varied.script
---- Magdir.orig/varied.script	2015-03-27 18:59:39.000000000 +0100
-+++ Magdir/varied.script	2018-04-28 12:26:14.072805431 +0200
-@@ -4,27 +4,35 @@
- 
- 0	string/t		#!\ /			a
- >3	string		>\0			%s script text executable
-+!:strength / 10
- 
- 0	string/b		#!\ /			a
- >3	string		>\0			%s script executable (binary data)
-+!:strength / 10
- 
- 0	string/t		#!\t/			a
- >3	string		>\0			%s script text executable
-+!:strength / 10
- 
- 0	string/b		#!\t/			a
- >3	string		>\0			%s script executable (binary data)
-+!:strength / 10
- 
- 0	string/t		#!/			a
- >2	string		>\0			%s script text executable
-+!:strength / 10
- 
- 0	string/b		#!/			a
- >2	string		>\0			%s script executable (binary data)
-+!:strength / 10
- 
- 0	string/t		#!\ 			script text executable
- >3	string		>\0			for %s
-+!:strength / 10
- 
- 0	string/b		#!\ 			script executable
- >3	string		>\0			for %s (binary data)
-+!:strength / 10
- 
- # using env
- 0	string/t	#!/usr/bin/env		a

ext/fileinfo/tests/cve-2014-3538-nojit.phpt

@@ -0,0 +1,40 @@
+--TEST--
+Bug #66731: file: extensive backtraking, with pcre.jit=0
+--SKIPIF--
+<?php
+if (defined("PHP_DEBUG") && PHP_DEBUG)
+	die("skip not suitable for debug build");
+if (!class_exists('finfo'))
+	die('skip no fileinfo extension');
+?>
+--INI--
+pcre.jit=0
+--FILE--
+<?php
+$fd = __DIR__.'/cve-2014-3538.data';
+
+file_put_contents($fd,
+  'try:' .
+  str_repeat("\n", 1000000));
+
+$fi = finfo_open(FILEINFO_NONE);
+$t = microtime(true);
+var_dump(finfo_file($fi, $fd));
+$t = microtime(true) - $t;
+finfo_close($fi);
+if ($t < 1) {
+	echo "Ok\n";
+} else {
+	printf("Failed, time=%.2f\n", $t);
+}
+
+?>
+Done
+--CLEAN--
+<?php
+@unlink(__DIR__.'/cve-2014-3538.data');
+?>
+--EXPECTF--
+string(%d) "%s"
+Ok
+Done

ext/fileinfo/tests/finfo_file_002.phpt

@@ -18,7 +18,7 @@ ksort($results);
 var_dump($results);
 ?>
 --EXPECTF--
-array(9) {
+array(%d) {
   ["%s/resources/dir.zip"]=>
   string(15) "application/zip"
   ["%s/resources/test.awk"]=>
@@ -37,4 +37,6 @@ array(9) {
   string(9) "image/png"
   ["%s/resources/test.ppt"]=>
   string(29) "application/vnd.ms-powerpoint"
+  ["%s/resources/test.webm"]=>
+  string(10) "video/webm"
 }

ext/ftp/ftp.c

@@ -1857,7 +1857,7 @@ data_accepted:
 						php_pollfd p;
 						int i;
 
-						p.fd = ftp->fd;
+						p.fd = data->fd;
 						p.events = (err == SSL_ERROR_WANT_READ) ? (POLLIN|POLLPRI) : POLLOUT;
 						p.revents = 0;
 
@@ -1906,10 +1906,10 @@ static void ftp_ssl_shutdown(ftpbuf_t *ftp, php_socket_t fd, SSL *ssl_handle) {
 		done = 0;
 	}
 
-	while (!done) {
-		if (data_available(ftp, fd)) {
-			ERR_clear_error();
-			nread = SSL_read(ssl_handle, buf, sizeof(buf));
+	while (!done && data_available(ftp, fd)) {
+		ERR_clear_error();
+		nread = SSL_read(ssl_handle, buf, sizeof(buf));
+		if (nread <= 0) {
 			err = SSL_get_error(ssl_handle, nread);
 			switch (err) {
 				case SSL_ERROR_NONE: /* this is not an error */
@@ -1927,9 +1927,11 @@ static void ftp_ssl_shutdown(ftpbuf_t *ftp, php_socket_t fd, SSL *ssl_handle) {
 					break;
 				default:
 					if ((sslerror = ERR_get_error())) {
-					    ERR_error_string_n(sslerror, buf, sizeof(buf));
+						ERR_error_string_n(sslerror, buf, sizeof(buf));
+						php_error_docref(NULL, E_WARNING, "SSL_read on shutdown: %s", buf);
+					} else if (errno) {
+						php_error_docref(NULL, E_WARNING, "SSL_read on shutdown: %s (%d)", strerror(errno), errno);
 					}
-					php_error_docref(NULL, E_WARNING, "SSL_read on shutdown: %s (%d)", (sslerror ? buf : strerror(errno)), errno);
 					done = 1;
 					break;
 			}

ext/gd/libgd/gd.c

@@ -1593,7 +1593,7 @@ void gdImageFilledArc (gdImagePtr im, int cx, int cy, int w, int h, int s, int e
 	int i, pti;
 	int lx = 0, ly = 0;
 	int fx = 0, fy = 0;
-
+	int startx, starty, endx, endy;
 
     if ((s % 360)  == (e % 360)) {
 		s = 0; e = 360;
@@ -1620,8 +1620,8 @@ void gdImageFilledArc (gdImagePtr im, int cx, int cy, int w, int h, int s, int e
 
 	for (i = s, pti = 1; i <= e; i++, pti++) {
 		int x, y;
-		x = ((long) gdCosT[i % 360] * (long) w / (2 * 1024)) + cx;
-		y = ((long) gdSinT[i % 360] * (long) h / (2 * 1024)) + cy;
+		x = endx = ((long) gdCosT[i % 360] * (long) w / (2 * 1024)) + cx;
+		y = endy = ((long) gdSinT[i % 360] * (long) h / (2 * 1024)) + cy;
 		if (i != s) {
 			if (!(style & gdChord)) {
 				if (style & gdNoFill) {
@@ -1646,8 +1646,8 @@ void gdImageFilledArc (gdImagePtr im, int cx, int cy, int w, int h, int s, int e
 			if (!(style & (gdChord | gdNoFill))) {
 				pts[0].x = cx;
 				pts[0].y = cy;
-				pts[pti].x = x;
-				pts[pti].y = y;
+				pts[pti].x = startx = x;
+				pts[pti].y = starty = y;
 			}
 		}
 		lx = x;
@@ -1676,6 +1676,24 @@ void gdImageFilledArc (gdImagePtr im, int cx, int cy, int w, int h, int s, int e
 				gdImageLine(im, cx, cy, fx, fy, color);
 			}
 		} else {
+			if (e - s < 360) {
+				if (pts[1].x != startx && pts[1].y == starty) {
+					/* start point has been removed due to y-coord fix => insert it */
+					for (i = pti; i > 1; i--) {
+						pts[i].x = pts[i-1].x;
+						pts[i].y = pts[i-1].y;
+					}
+					pts[1].x = startx;
+					pts[1].y = starty;
+					pti++;
+				}
+				if (pts[pti-1].x != endx && pts[pti-1].y == endy) {
+					/* end point has been removed due to y-coord fix => insert it */
+					pts[pti].x = endx;
+					pts[pti].y = endy;
+					pti++;
+				}
+			}
 			pts[pti].x = cx;
 			pts[pti].y = cy;
 			gdImageFilledPolygon(im, pts, pti+1, color);

ext/gd/libgd/gd_bmp.c

@@ -813,8 +813,8 @@ static int bmp_read_1bit(gdImagePtr im, gdIOCtxPtr infile, bmp_info_t *info, bmp
 		}
 	}
 
-	/* The line must be divisible by 4, else its padded with NULLs */
-	padding = ((int)ceil(0.1 * info->width)) % 4;
+	/* The line must be aligned on a 32 bits word, else it is padded with zeros */
+	padding = (info->width + 7) / 8 % 4;
 	if (padding) {
 		padding = 4 - padding;
 	}

ext/gd/libgd/gd_color_match.c

@@ -33,8 +33,8 @@ int gdImageColorMatch (gdImagePtr im1, gdImagePtr im2)
 		return -4; /* At least 1 color must be allocated */
 	}
 
-	buf = (unsigned long *)safe_emalloc(sizeof(unsigned long), 5 * im2->colorsTotal, 0);
-	memset( buf, 0, sizeof(unsigned long) * 5 * im2->colorsTotal );
+	buf = (unsigned long *)safe_emalloc(sizeof(unsigned long), 5 * gdMaxColors, 0);
+	memset( buf, 0, sizeof(unsigned long) * 5 * gdMaxColors );
 
 	for (x=0; x<im1->sx; x++) {
 		for( y=0; y<im1->sy; y++ ) {

ext/gd/libgd/gd_crop.c

@@ -127,30 +127,24 @@ gdImagePtr gdImageCropAuto(gdImagePtr im, const unsigned int mode)
 		}
 	}
 
-	/* Nothing to do > bye
-	 * Duplicate the image?
-	 */
-	if (y == height - 1) {
+	/* Whole image would be cropped > bye */
+	if (match) {
 		return NULL;
 	}
 
-	crop.y = y -1;
+	crop.y = y - 1;
+
 	match = 1;
 	for (y = height - 1; match && y >= 0; y--) {
 		for (x = 0; match && x < width; x++) {
 			match = (color == gdImageGetPixel(im, x,y));
 		}
 	}
-
-	if (y == 0) {
-		crop.height = height - crop.y + 1;
-	} else {
-		crop.height = y - crop.y + 2;
-	}
+	crop.height = y - crop.y + 2;
 
 	match = 1;
 	for (x = 0; match && x < width; x++) {
-		for (y = 0; match && y < crop.y + crop.height - 1; y++) {
+		for (y = 0; match && y < crop.y + crop.height; y++) {
 			match = (color == gdImageGetPixel(im, x,y));
 		}
 	}
@@ -158,12 +152,13 @@ gdImagePtr gdImageCropAuto(gdImagePtr im, const unsigned int mode)
 
 	match = 1;
 	for (x = width - 1; match && x >= 0; x--) {
-		for (y = 0; match &&  y < crop.y + crop.height - 1; y++) {
+		for (y = 0; match &&  y < crop.y + crop.height; y++) {
 			match = (color == gdImageGetPixel(im, x,y));
 		}
 	}
 	crop.width = x - crop.x + 2;
-	if (crop.x <= 0 || crop.y <= 0 || crop.width <= 0 || crop.height <= 0) {
+
+	if (crop.x < 0 || crop.y < 0 || crop.width <= 0 || crop.height <= 0) {
 		return NULL;
 	}
 	return gdImageCrop(im, &crop);
@@ -222,31 +217,24 @@ gdImagePtr gdImageCropThreshold(gdImagePtr im, const unsigned int color, const f
 		}
 	}
 
-	/* Pierre
-	 * Nothing to do > bye
-	 * Duplicate the image?
-	 */
-	if (y == height - 1) {
+	/* Whole image would be cropped > bye */
+	if (match) {
 		return NULL;
 	}
 
-	crop.y = y -1;
+	crop.y = y - 1;
+
 	match = 1;
 	for (y = height - 1; match && y >= 0; y--) {
 		for (x = 0; match && x < width; x++) {
 			match = (gdColorMatch(im, color, gdImageGetPixel(im, x, y), threshold)) > 0;
 		}
 	}
-
-	if (y == 0) {
-		crop.height = height - crop.y + 1;
-	} else {
-		crop.height = y - crop.y + 2;
-	}
+	crop.height = y - crop.y + 2;
 
 	match = 1;
 	for (x = 0; match && x < width; x++) {
-		for (y = 0; match && y < crop.y + crop.height - 1; y++) {
+		for (y = 0; match && y < crop.y + crop.height; y++) {
 			match = (gdColorMatch(im, color, gdImageGetPixel(im, x,y), threshold)) > 0;
 		}
 	}
@@ -254,7 +242,7 @@ gdImagePtr gdImageCropThreshold(gdImagePtr im, const unsigned int color, const f
 
 	match = 1;
 	for (x = width - 1; match && x >= 0; x--) {
-		for (y = 0; match &&  y < crop.y + crop.height - 1; y++) {
+		for (y = 0; match &&  y < crop.y + crop.height; y++) {
 			match = (gdColorMatch(im, color, gdImageGetPixel(im, x,y), threshold)) > 0;
 		}
 	}
@@ -291,7 +279,7 @@ static int gdGuessBackgroundColorFromCorners(gdImagePtr im, int *color)
 	} else if (tl == tr  || tl == bl || tl == br) {
 		*color = tl;
 		return 2;
-	} else if (tr == bl) {
+	} else if (tr == bl || tr == br) {
 		*color = tr;
 		return 2;
 	} else if (br == bl) {

ext/gd/libgd/gd_interpolation.c

@@ -662,43 +662,7 @@ static inline int getPixelOverflowTC(gdImagePtr im, const int x, const int y, co
 		}
 		return c;
 	} else {
-		register int border = 0;
-
-		if (y < im->cy1) {
-			border = im->tpixels[0][im->cx1];
-			goto processborder;
-		}
-
-		if (y < im->cy1) {
-			border = im->tpixels[0][im->cx1];
-			goto processborder;
-		}
-
-		if (y > im->cy2) {
-			if (x >= im->cx1 && x <= im->cx1) {
-				border = im->tpixels[im->cy2][x];
-				goto processborder;
-			} else {
-				return gdTrueColorAlpha(0, 0, 0, 127);
-			}
-		}
-
-		/* y is bound safe at this point */
-		if (x < im->cx1) {
-			border = im->tpixels[y][im->cx1];
-			goto processborder;
-		}
-
-		if (x > im->cx2) {
-			border = im->tpixels[y][im->cx2];
-		}
-
-processborder:
-		if (border == im->transparent) {
-			return gdTrueColorAlpha(0, 0, 0, 127);
-		} else{
-			return gdTrueColorAlpha(gdTrueColorGetRed(border), gdTrueColorGetGreen(border), gdTrueColorGetBlue(border), 127);
-		}
+		return bgColor;
 	}
 }
 
@@ -713,42 +677,7 @@ static inline int getPixelOverflowPalette(gdImagePtr im, const int x, const int
 		}
 		return colorIndex2RGBA(c);
 	} else {
-		register int border = 0;
-		if (y < im->cy1) {
-			border = gdImageGetPixel(im, im->cx1, 0);
-			goto processborder;
-		}
-
-		if (y < im->cy1) {
-			border = gdImageGetPixel(im, im->cx1, 0);
-			goto processborder;
-		}
-
-		if (y > im->cy2) {
-			if (x >= im->cx1 && x <= im->cx1) {
-				border = gdImageGetPixel(im, x,  im->cy2);
-				goto processborder;
-			} else {
-				return gdTrueColorAlpha(0, 0, 0, 127);
-			}
-		}
-
-		/* y is bound safe at this point */
-		if (x < im->cx1) {
-			border = gdImageGetPixel(im, im->cx1, y);
-			goto processborder;
-		}
-
-		if (x > im->cx2) {
-			border = gdImageGetPixel(im, im->cx2, y);
-		}
-
-processborder:
-		if (border == im->transparent) {
-			return gdTrueColorAlpha(0, 0, 0, 127);
-		} else{
-			return colorIndex2RGBcustomA(border, 127);
-		}
+		return bgColor;
 	}
 }
 
@@ -890,8 +819,13 @@ static inline LineContribType * _gdContributionsAlloc(unsigned int line_length,
 {
 	unsigned int u = 0;
 	LineContribType *res;
-	int overflow_error = 0;
+	size_t weights_size;
 
+	if (overflow2(windows_size, sizeof(double))) {
+		return NULL;
+	} else {
+		weights_size = windows_size * sizeof(double);
+	}
 	res = (LineContribType *) gdMalloc(sizeof(LineContribType));
 	if (!res) {
 		return NULL;
@@ -908,15 +842,10 @@ static inline LineContribType * _gdContributionsAlloc(unsigned int line_length,
 		return NULL;
 	}
 	for (u = 0 ; u < line_length ; u++) {
-		if (overflow2(windows_size, sizeof(double))) {
-			overflow_error = 1;
-		} else {
-			res->ContribRow[u].Weights = (double *) gdMalloc(windows_size * sizeof(double));
-		}
-		if (overflow_error == 1 || res->ContribRow[u].Weights == NULL) {
+		res->ContribRow[u].Weights = (double *) gdMalloc(weights_size);
+		if (res->ContribRow[u].Weights == NULL) {
 			unsigned int i;
-			u--;
-			for (i=0;i<=u;i++) {
+			for (i=0;i<u;i++) {
 				gdFree(res->ContribRow[i].Weights);
 			}
 			gdFree(res->ContribRow);
@@ -1020,7 +949,7 @@ static inline void _gdScaleRow(gdImagePtr pSrc,  unsigned int src_width, gdImage
     }
 }
 
-static inline void _gdScaleHoriz(gdImagePtr pSrc, unsigned int src_width, unsigned int src_height, gdImagePtr pDst,  unsigned int dst_width, unsigned int dst_height)
+static inline int _gdScaleHoriz(gdImagePtr pSrc, unsigned int src_width, unsigned int src_height, gdImagePtr pDst,  unsigned int dst_width, unsigned int dst_height)
 {
 	unsigned int u;
 	LineContribType * contrib;
@@ -1035,13 +964,14 @@ static inline void _gdScaleHoriz(gdImagePtr pSrc, unsigned int src_width, unsign
 
 	contrib = _gdContributionsCalc(dst_width, src_width, (double)dst_width / (double)src_width, pSrc->interpolation);
 	if (contrib == NULL) {
-		return;
+		return 0;
 	}
 	/* Scale each row */
 	for (u = 0; u < dst_height - 1; u++) {
 		_gdScaleRow(pSrc, src_width, pDst, dst_width, u, contrib);
 	}
 	_gdContributionsFree (contrib);
+	return 1;
 }
 
 static inline void _gdScaleCol (gdImagePtr pSrc,  unsigned int src_width, gdImagePtr pRes, unsigned int dst_width, unsigned int dst_height, unsigned int uCol, LineContribType *contrib)
@@ -1066,7 +996,7 @@ static inline void _gdScaleCol (gdImagePtr pSrc,  unsigned int src_width, gdImag
 	}
 }
 
-static inline void _gdScaleVert (const gdImagePtr pSrc, const unsigned int src_width, const unsigned int src_height, const gdImagePtr pDst, const unsigned int dst_width, const unsigned int dst_height)
+static inline int _gdScaleVert (const gdImagePtr pSrc, const unsigned int src_width, const unsigned int src_height, const gdImagePtr pDst, const unsigned int dst_width, const unsigned int dst_height)
 {
 	unsigned int u;
 	LineContribType * contrib;
@@ -1081,19 +1011,21 @@ static inline void _gdScaleVert (const gdImagePtr pSrc, const unsigned int src_w
 
 	contrib = _gdContributionsCalc(dst_height, src_height, (double)(dst_height) / (double)(src_height), pSrc->interpolation);
 	if (contrib == NULL) {
-		return;
+		return 0;
 	}
 	/* scale each column */
 	for (u = 0; u < dst_width - 1; u++) {
 		_gdScaleCol(pSrc, src_width, pDst, dst_width, dst_height, u, contrib);
 	}
 	_gdContributionsFree(contrib);
+	return 1;
 }
 
 gdImagePtr gdImageScaleTwoPass(const gdImagePtr src, const unsigned int src_width, const unsigned int src_height, const unsigned int new_width, const unsigned int new_height)
 {
 	gdImagePtr tmp_im;
 	gdImagePtr dst;
+	int scale_pass_res;
 
 	if (new_width == 0 || new_height == 0) {
 		return NULL;
@@ -1109,7 +1041,11 @@ gdImagePtr gdImageScaleTwoPass(const gdImagePtr src, const unsigned int src_widt
 		return NULL;
 	}
 	gdImageSetInterpolationMethod(tmp_im, src->interpolation_id);
-	_gdScaleHoriz(src, src_width, src_height, tmp_im, new_width, src_height);
+	scale_pass_res = _gdScaleHoriz(src, src_width, src_height, tmp_im, new_width, src_height);
+	if (scale_pass_res != 1) {
+		gdImageDestroy(tmp_im);
+		return NULL;
+	}
 
 	dst = gdImageCreateTrueColor(new_width, new_height);
 	if (dst == NULL) {
@@ -1117,30 +1053,14 @@ gdImagePtr gdImageScaleTwoPass(const gdImagePtr src, const unsigned int src_widt
 		return NULL;
 	}
 	gdImageSetInterpolationMethod(dst, src->interpolation_id);
-	_gdScaleVert(tmp_im, new_width, src_height, dst, new_width, new_height);
-	gdImageDestroy(tmp_im);
-
-	return dst;
-}
-
-gdImagePtr Scale(const gdImagePtr src, const unsigned int src_width, const unsigned int src_height, const gdImagePtr dst, const unsigned int new_width, const unsigned int new_height)
-{
-	gdImagePtr tmp_im;
-
-	if (new_width == 0 || new_height == 0) {
+	scale_pass_res = _gdScaleVert(tmp_im, new_width, src_height, dst, new_width, new_height);
+	if (scale_pass_res != 1) {
+		gdImageDestroy(dst);
+		gdImageDestroy(tmp_im);
 		return NULL;
 	}
-
-	tmp_im = gdImageCreateTrueColor(new_width, src_height);
-	if (tmp_im == NULL) {
-		return NULL;
-	}
-	gdImageSetInterpolationMethod(tmp_im, src->interpolation_id);
-
-	_gdScaleHoriz(src, src_width, src_height, tmp_im, new_width, src_height);
-	_gdScaleVert(tmp_im, new_width, src_height, dst, new_width, new_height);
-
 	gdImageDestroy(tmp_im);
+
 	return dst;
 }
 
@@ -1315,11 +1235,11 @@ static gdImagePtr gdImageScaleBilinearPalette(gdImagePtr im, const unsigned int
 					f_b1, f_b2, f_b3, f_b4,
 					f_a1, f_a2, f_a3, f_a4;
 
-			/* zero for the background color, nothig gets outside anyway */
+			/* 0 for bgColor; (n,m) is supposed to be valid anyway */
 			pixel1 = getPixelOverflowPalette(im, n, m, 0);
-			pixel2 = getPixelOverflowPalette(im, n + 1, m, 0);
-			pixel3 = getPixelOverflowPalette(im, n, m + 1, 0);
-			pixel4 = getPixelOverflowPalette(im, n + 1, m + 1, 0);
+			pixel2 = getPixelOverflowPalette(im, n + 1, m, pixel1);
+			pixel3 = getPixelOverflowPalette(im, n, m + 1, pixel1);
+			pixel4 = getPixelOverflowPalette(im, n + 1, m + 1, pixel1);
 
 			f_r1 = gd_itofx(gdTrueColorGetRed(pixel1));
 			f_r2 = gd_itofx(gdTrueColorGetRed(pixel2));
@@ -1407,11 +1327,11 @@ static gdImagePtr gdImageScaleBilinearTC(gdImagePtr im, const unsigned int new_w
 					f_b1, f_b2, f_b3, f_b4,
 					f_a1, f_a2, f_a3, f_a4;
 			dwSrcTotalOffset = m + n;
-			/* 0 for bgColor, nothing gets outside anyway */
+			/* 0 for bgColor; (n,m) is supposed to be valid anyway */
 			pixel1 = getPixelOverflowTC(im, n, m, 0);
-			pixel2 = getPixelOverflowTC(im, n + 1, m, 0);
-			pixel3 = getPixelOverflowTC(im, n, m + 1, 0);
-			pixel4 = getPixelOverflowTC(im, n + 1, m + 1, 0);
+			pixel2 = getPixelOverflowTC(im, n + 1, m, pixel1);
+			pixel3 = getPixelOverflowTC(im, n, m + 1, pixel1);
+			pixel4 = getPixelOverflowTC(im, n + 1, m + 1, pixel1);
 
 			f_r1 = gd_itofx(gdTrueColorGetRed(pixel1));
 			f_r2 = gd_itofx(gdTrueColorGetRed(pixel2));

ext/gd/libgd/gd_jpeg.c

@@ -67,14 +67,18 @@ static long php_jpeg_emit_message(j_common_ptr jpeg_info, int level)
 		 * unless strace_level >= 3
 		 */
 		if ((jpeg_info->err->num_warnings == 0) || (jpeg_info->err->trace_level >= 3)) {
-			gd_error_ex(ignore_warning ? GD_NOTICE : GD_WARNING, "gd-jpeg, libjpeg: recoverable error: %s\n", message);
+			if (!ignore_warning) {
+				gd_error("gd-jpeg, libjpeg: recoverable error: %s\n", message);
+			}
 		}
 
 		jpeg_info->err->num_warnings++;
 	} else {
 		/* strace msg, Show it if trace_level >= level. */
 		if (jpeg_info->err->trace_level >= level) {
-			gd_error_ex(GD_NOTICE, "gd-jpeg, libjpeg: strace message: %s\n", message);
+			if (!ignore_warning) {
+				gd_error("gd-jpeg, libjpeg: strace message: %s\n", message);
+			}
 		}
 	}
 	return 1;
@@ -86,9 +90,10 @@ static long php_jpeg_emit_message(j_common_ptr jpeg_info, int level)
 static void fatal_jpeg_error (j_common_ptr cinfo)
 {
 	jmpbuf_wrapper *jmpbufw;
+	char buffer[JMSG_LENGTH_MAX];
 
-	gd_error("gd-jpeg: JPEG library reports unrecoverable error: ");
-	(*cinfo->err->output_message) (cinfo);
+	(*cinfo->err->format_message)(cinfo, buffer);
+	gd_error_ex(GD_WARNING, "gd-jpeg: JPEG library reports unrecoverable error: %s", buffer);
 
 	jmpbufw = (jmpbuf_wrapper *) cinfo->client_data;
 	jpeg_destroy (cinfo);

ext/gd/libgd/gd_wbmp.c

@@ -100,6 +100,7 @@ void gdImageWBMPCtx (gdImagePtr image, int fg, gdIOCtx * out)
 	/* create the WBMP */
 	if ((wbmp = createwbmp (gdImageSX (image), gdImageSY (image), WBMP_WHITE)) == NULL) {
 		gd_error("Could not create WBMP");
+		return;
 	}
 
 	/* fill up the WBMP structure */

ext/gd/tests/bug73281.phpt

@@ -0,0 +1,45 @@
+--TEST--
+Bug #73281 (imagescale(…, IMG_BILINEAR_FIXED) can cause black border)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.3', '<=')) die('skip upstream fix not yet released');
+?>
+--FILE--
+<?php
+$coordinates = [[0, 0], [0, 199], [199, 199], [199, 0]];
+
+$src = imagecreatetruecolor(100, 100);
+$white = imagecolorallocate($src, 255, 255, 255);
+imagefilledrectangle($src, 0,0, 99,99, $white);
+$dst = imagescale($src, 200, 200, IMG_BILINEAR_FIXED);
+echo "truecolor source\n";
+foreach ($coordinates as $coordinate) {
+    list($x, $y) = $coordinate;
+    printf("%3d, %3d: %x\n", $x, $y, imagecolorat($dst, $x, $y));
+}
+
+$src = imagecreate(100, 100);
+$white = imagecolorallocate($src, 255, 255, 255);
+imagefilledrectangle($src, 0,0, 99,99, $white);
+$dst = imagescale($src, 200, 200, IMG_BILINEAR_FIXED);
+echo "\npalette source\n";
+foreach ($coordinates as $coordinate) {
+    list($x, $y) = $coordinate;
+    printf("%3d, %3d: %x\n", $x, $y, imagecolorat($dst, $x, $y));
+}
+?>
+===DONE===
+--EXPECT--
+truecolor source
+  0,   0: ffffff
+  0, 199: ffffff
+199, 199: ffffff
+199,   0: ffffff
+
+palette source
+  0,   0: ffffff
+  0, 199: ffffff
+199, 199: ffffff
+199,   0: ffffff
+===DONE===

ext/gd/tests/bug73614.phpt

@@ -0,0 +1,27 @@
+--TEST--
+Bug #73614 (gdImageFilledArc() doesn't properly draw pies)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.5', '<=')) die('skip upstream bugfix not yet released');
+?>
+--FILE--
+<?php
+require_once __DIR__ . '/func.inc';
+
+$image = imagecreatetruecolor(500, 500);
+
+$white    = imagecolorallocate($image, 0xFF, 0xFF, 0xFF);
+$navy     = imagecolorallocate($image, 0x00, 0x00, 0x80);
+$red      = imagecolorallocate($image, 0xFF, 0x00, 0x00);
+
+imagefilledarc($image, 250, 250, 500, 250, 0, 88, $white, IMG_ARC_PIE);
+imagefilledarc($image, 250, 250, 500, 250, 88, 91 , $navy, IMG_ARC_PIE);
+imagefilledarc($image, 250, 250, 500, 250, 91, 360 , $red, IMG_ARC_PIE);
+
+test_image_equals_file(__DIR__ . '/bug73614.png', $image);
+?>
+===DONE===
+--EXPECT--
+The images are equal.
+===DONE===

ext/gd/tests/bug77195.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Bug #77195 (Incorrect error handling of imagecreatefromjpeg())
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!gd_info()['JPEG Support']) die('skip JPEG support not available');
+?>
+--FILE--
+<?php
+$filename = __DIR__ . '/bug77195.jpeg';
+@imagecreatefromjpeg($filename);
+imagecreatefromjpeg($filename);
+?>
+===DONE===
+--EXPECTF--
+Warning: imagecreatefromjpeg(): gd-jpeg: JPEG library reports unrecoverable error: JPEG datastream contains no image in %s on line %d
+
+Warning: imagecreatefromjpeg(): '%s' is not a valid JPEG file in %s on line %d
+===DONE===

ext/gd/tests/bug77198_auto.phpt

@@ -0,0 +1,50 @@
+--TEST--
+Bug #77198 (auto cropping has insufficient precision)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNDLED) die('upstream bugfix has not been released');
+?>
+--FILE--
+<?php
+
+function createWhiteImageWithBlackPixelAt($x, $y)
+{
+    $im = imagecreatetruecolor(8, 8);
+    imagefilledrectangle($im, 0, 0, 7, 7, 0xffffff);
+    imagesetpixel($im, $x, $y, 0x000000);
+    return $im;
+}
+
+for ($y = 0; $y < 8; $y++) {
+    for ($x = 0; $x < 8; $x++) {
+        if (($x == 0 && ($y == 0 || $y == 7)) || ($x == 7 && ($y == 0 || $y == 7))) {
+            continue; // skip the corners
+        }
+        $orig = createWhiteImageWithBlackPixelAt($x, $y);
+        $cropped = imagecropauto($orig, IMG_CROP_SIDES);
+        if (!$cropped) {
+            printf("Pixel at %d, %d: unexpected NULL crop\n", $x, $y);
+        } else {
+            $width = imagesx($cropped);
+            if ($width !== 1) {
+                printf("Pixel at %d, %d: unexpected width (%d)\n", $x, $y, $width);
+            }
+            $height = imagesy($cropped);
+            if ($height !== 1) {
+                printf("Pixel at %d, %d: unexpected height (%d)\n", $x, $y, $height);
+            }
+            $color = imagecolorat($cropped, 0, 0);
+            if ($color !== 0x000000) {
+                printf("Pixel at %d, %d: unexpected color (%d)\n", $x, $y, $color);
+            }
+            imagedestroy($cropped);
+        }
+        imagedestroy($orig);
+    }
+}
+
+?>
+===DONE===
+--EXPECT--
+===DONE===

ext/gd/tests/bug77198_threshold.phpt

@@ -0,0 +1,47 @@
+--TEST--
+Bug #77198 (threshold cropping has insufficient precision)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNDLED) die('upstream bugfix has not been released');
+?>
+--FILE--
+<?php
+
+function createWhiteImageWithBlackPixelAt($x, $y)
+{
+    $im = imagecreatetruecolor(8, 8);
+    imagefilledrectangle($im, 0, 0, 7, 7, 0xffffff);
+    imagesetpixel($im, $x, $y, 0x000000);
+    return $im;
+}
+
+for ($y = 0; $y < 8; $y++) {
+    for ($x = 0; $x < 8; $x++) {
+        $orig = createWhiteImageWithBlackPixelAt($x, $y);
+        $cropped = imagecropauto($orig, IMG_CROP_THRESHOLD, 1, 0xffffff);
+        if (!$cropped) {
+            printf("Pixel at %d, %d: unexpected NULL crop\n", $x, $y);
+        } else {
+            $width = imagesx($cropped);
+            if ($width !== 1) {
+                printf("Pixel at %d, %d: unexpected width (%d)\n", $x, $y, $width);
+            }
+            $height = imagesy($cropped);
+            if ($height !== 1) {
+                printf("Pixel at %d, %d: unexpected height (%d)\n", $x, $y, $height);
+            }
+            $color = imagecolorat($cropped, 0, 0);
+            if ($color !== 0x000000) {
+                printf("Pixel at %d, %d: unexpected color (%d)\n", $x, $y, $color);
+            }
+            imagedestroy($cropped);
+        }
+        imagedestroy($orig);
+    }
+}
+
+?>
+===DONE===
+--EXPECT--
+===DONE===

ext/gd/tests/bug77200.phpt

@@ -0,0 +1,37 @@
+--TEST--
+Bug #77200 (imagecropauto(…, GD_CROP_SIDES) crops left but not right)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNDLED) die('upstream bugfix has not been released');
+?>
+--FILE--
+<?php
+
+$orig = imagecreatetruecolor(8, 8);
+$red = imagecolorallocate($orig, 255, 0, 0);
+$green = imagecolorallocate($orig, 0, 255, 0);
+$blue = imagecolorallocate($orig, 0, 0, 255);
+
+imagefilledrectangle($orig, 0, 0, 3, 3, $green); // tl
+imagefilledrectangle($orig, 4, 0, 7, 3, $red);   // tr
+imagefilledrectangle($orig, 0, 4, 3, 7, $green); // bl
+imagefilledrectangle($orig, 4, 4, 7, 7, $blue);  // br
+
+$cropped = imagecropauto($orig, IMG_CROP_SIDES);
+var_dump(imagesx($cropped));
+
+imagefilledrectangle($orig, 0, 0, 3, 3, $red);   // tl
+imagefilledrectangle($orig, 4, 0, 7, 3, $green); // tr
+imagefilledrectangle($orig, 0, 4, 3, 7, $blue);  // bl
+imagefilledrectangle($orig, 4, 4, 7, 7, $green); // br
+
+$cropped = imagecropauto($orig, IMG_CROP_SIDES);
+var_dump(imagesx($cropped));
+
+?>
+===DONE===
+--EXPECT--
+int(4)
+int(4)
+===DONE===