Update versions for PHP 7.2.16

* PHP-7.1:
  Fix bug #77630 - safer rename() procedure

.appveyor.yml

@@ -16,7 +16,7 @@ environment:
         PHP_BUILD_CACHE_BASE_DIR: c:\build-cache
         PHP_BUILD_OBJ_DIR: c:\obj
         PHP_BUILD_CACHE_SDK_DIR: c:\build-cache\sdk
-        PHP_BUILD_SDK_BRANCH: php-sdk-2.1.9beta1
+        PHP_BUILD_SDK_BRANCH: php-sdk-2.2.0beta3
         PHP_BUILD_CRT: vc15
         # ext and env setup for tests
         #MYSQL_TEST_PASSWD: Password12!

.travis.yml

@@ -1,3 +1,6 @@
+git:
+  quiet: true
+
 dist: trusty
 language: c
 sudo: required

NEWS

@@ -1,11 +1,191 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2018, PHP 7.2.13
+07 Mar 2019, PHP 7.2.16
+
+- Core:
+  . Fixed bug #77589 (Core dump using parse_ini_string with numeric sections).
+    (Laruence)
+  . Fixed bug #77630 (rename() across the device may allow unwanted access
+    during processing). (Stas)
+
+- COM:
+  . Fixed bug #77621 (Already defined constants are not properly reported).
+    (cmb)
+
+- EXIF:
+  . Fixed bug #77509 (Uninitialized read in exif_process_IFD_in_TIFF). (Stas)
+  . Fixed bug #77540 (Invalid Read on exif_process_SOFn). (Stas)
+  . Fixed bug #77563 (Uninitialized read in exif_process_IFD_in_MAKERNOTE). (Stas)
+  . Fixed bug #77659 (Uninitialized read in exif_process_IFD_in_MAKERNOTE). (Stas)
+
+- PDO_OCI:
+  . Support Oracle Database tracing attributes ACTION, MODULE,
+    CLIENT_INFO, and CLIENT_IDENTIFIER. (Cameron Porter)
+
+- PHAR:
+  . Fixed bug #77396 (Null Pointer Dereference in phar_create_or_parse_filename).
+    (bishop)
+
+- SPL:
+  . Fixed bug #51068 (DirectoryIterator glob:// don't support current path
+    relative queries). (Ahmed Abdou)
+  . Fixed bug #77431 (openFile() silently truncates after a null byte). (cmb)
+
+- Standard:
+  . Fixed bug #77552 (Unintialized php_stream_statbuf in stat functions).
+    (John Stevenson)
+
+- MySQL
+  . Disabled LOCAL INFILE by default, can be enabled using php.ini directive
+    mysqli.allow_local_infile for mysqli, or PDO::MYSQL_ATTR_LOCAL_INFILE
+    attribute for pdo_mysql. (Darek Slusarczyk)
+
+07 Feb 2019, PHP 7.2.15
+
+- Core:
+  . Fixed bug #77339 (__callStatic may get incorrect arguments). (Dmitry)
+  . Fixed bug #77494 (Disabling class causes segfault on member access).
+    (Dmitry)
+  . Fixed bug #77530 (PHP crashes when parsing `(2)::class`). (Ekin)
+
+- Curl:
+  . Fixed bug #76675 (Segfault with H2 server push). (Pedro Magalhães)
+
+- GD:
+  . Fixed bug #73281 (imagescale(…, IMG_BILINEAR_FIXED) can cause black border).
+    (cmb)
+  . Fixed bug #73614 (gdImageFilledArc() doesn't properly draw pies). (cmb)
+  . Fixed bug #77272 (imagescale() may return image resource on failure). (cmb)
+  . Fixed bug #77391 (1bpp BMPs may fail to be loaded). (Romain Déoux, cmb)
+  . Fixed bug #77479 (imagewbmp() segfaults with very large images). (cmb)
+
+- ldap:
+  . Fixed bug #77440 (ldap_bind using ldaps or ldap_start_tls()=exception in
+    libcrypto-1_1-x64.dll). (Anatol)
+
+- Mbstring:
+  . Fixed bug #77454 (mb_scrub() silently truncates after a null byte).
+    (64796c6e69 at gmail dot com)
+
+- MySQLnd:
+  . Fixed bug #75684 (In mysqlnd_ext_plugin.h the plugin methods family has
+    no external visibility). (Anatol)
+
+- Opcache:
+  . Fixed bug #77361 (configure fails on 64-bit AIX when opcache enabled).
+    (Kevin Adler)
+
+- OpenSSL:
+  . Fixed bug #77390 (feof might hang on TLS streams in case of fragmented TLS
+    records). (Abyl Valg, Jakub Zelenka)
+
+- PDO:
+  . Fixed bug #77273 (array_walk_recursive corrupts value types leading to PDO
+    failure). (Nikita)
+
+- phpdbg:
+  . Fixed bug #76596 (phpdbg support for display_errors=stderr). (kabel)
+
+- Sockets:
+  . Fixed bug #76839 (socket_recvfrom may return an invalid 'from' address
+    on MacOS). (Michael Meyer)
+
+- Standard:
+  . Fixed bug #77395 (segfault about array_multisort). (Laruence)
+  . Fixed bug #77439 (parse_str segfaults when inserting item into existing
+    array). (Nikita)
+
+10 Jan 2019, PHP 7.2.14
+
+- Core:
+  . Fixed bug #77369 (memcpy with negative length via crafted DNS response). (Stas)
+  . Fixed bug #71041 (zend_signal_startup() needs ZEND_API).
+    (Valentin V. Bartenev)
+  . Fixed bug #76046 (PHP generates "FE_FREE" opcode on the wrong line).
+    (Nikita)
+
+- COM:
+  . Fixed bug #77177 (Serializing or unserializing COM objects crashes). (cmb)
+
+- Date:
+  . Fixed bug #77097 (DateTime::diff gives wrong diff when the actual diff is
+    less than 1 second). (Derick)
+
+- Exif:
+  . Fixed bug #77184 (Unsigned rational numbers are written out as signed
+    rationals). (Colin Basnett)
+
+- GD:
+  . Fixed bug #77269 (efree() on uninitialized Heap data in imagescale leads to
+    use-after-free). (cmb)
+  . Fixed bug #77270 (imagecolormatch Out Of Bounds Write on Heap). (cmb)
+  . Fixed bug #77195 (Incorrect error handling of imagecreatefromjpeg()). (cmb)
+  . Fixed bug #77198 (auto cropping has insufficient precision). (cmb)
+  . Fixed bug #77200 (imagecropauto(…, GD_CROP_SIDES) crops left but not right).
+    (cmb)
+
+- IMAP:
+  . Fixed bug #77020 (null pointer dereference in imap_mail). (cmb)
+
+- Mbstring:
+  . Fixed bug #77370 (Buffer overflow on mb regex functions - fetch_token). (Stas)
+  . Fixed bug #77371 (heap buffer overflow in mb regex functions
+    - compile_string_node). (Stas)
+  . Fixed bug #77381 (heap buffer overflow in multibyte match_at). (Stas)
+  . Fixed bug #77382 (heap buffer overflow due to incorrect length in
+    expand_case_fold_string). (Stas)
+  . Fixed bug #77385 (buffer overflow in fetch_token). (Stas)
+  . Fixed bug #77394 (Buffer overflow in multibyte case folding - unicode). (Stas)
+  . Fixed bug #77418 (Heap overflow in utf32be_mbc_to_code). (Stas)
+
+- OCI8:
+  . Fixed bug #76804 (oci_pconnect with OCI_CRED_EXT not working). (KoenigsKind)
+  . Added oci_set_call_timeout() for call timeouts.
+  . Added oci_set_db_operation() for the DBOP end-to-end-tracing attribute.
+
+- Opcache:
+  . Fixed bug #77215 (CFG assertion failure on multiple finalizing switch
+    frees in one block). (Nikita)
+
+- PDO:
+  . Handle invalid index passed to PDOStatement::fetchColumn() as error. (Sergei
+    Morozov)
+
+- Phar:
+  . Fixed bug #77247 (heap buffer overflow in phar_detect_phar_fname_ext). (Stas)
+
+- Sockets:
+  . Fixed bug #77136 (Unsupported IPV6_RECVPKTINFO constants on macOS).
+    (Mizunashi Mana)
+
+- SQLite3:
+  . Fixed bug #77051 (Issue with re-binding on SQLite3). (BohwaZ)
+
+- Xmlrpc:
+  . Fixed bug #77242 (heap out of bounds read in xmlrpc_decode()). (cmb)
+  . Fixed bug #77380 (Global out of bounds read in xmlrpc base64 code). (Stas)
+
+06 Dec 2018, PHP 7.2.13
+
+- ftp:
+  . Fixed bug #77151 (ftp_close(): SSL_read on shutdown). (Remi)
+
+- CLI:
+  . Fixed bug #77111 (php-win.exe corrupts unicode symbols from cli
+    parameters). (Anatol)
 
 - Fileinfo:
   . Fixed bug #77095 (slowness regression in 7.2/7.3 (compared to 7.1)).
     (Anatol)
 
+- iconv:
+  . Fixed bug #77147 (Fixing 60494 ignored ICONV_MIME_DECODE_CONTINUE_ON_ERROR).
+    (cmb)
+
+- IMAP:
+  . Fixed bug #77153 (imap_open allows to run arbitrary shell commands via
+    mailbox parameter). (Stas)
+
 - ODBC:
   . Fixed bug #77079 (odbc_fetch_object has incorrect type signature).
     (Jon Allen)
@@ -14,10 +194,18 @@ PHP                                                                        NEWS
   . Fixed bug #77058 (Type inference in opcache causes side effects). (Nikita)
   . Fixed bug #77092 (array_diff_key() - segmentation fault). (Nikita)
 
+- PGSQL:
+  . Fixed bug #77047 (pg_convert has a broken regex for the 'TIME WITHOUT
+    TIMEZONE' data type). (Andy Gajetzki)
+
 - SOAP:
   . Fixed bug #50675 (SoapClient can't handle object references correctly).
     (Cameron Porter)
   . Fixed bug #76348 (WSDL_CACHE_MEMORY causes Segmentation fault). (cmb)
+  . Fixed bug #77141 (Signedness issue in SOAP when precision=-1). (cmb)
+
+- Sockets:
+  . Fixed bug #67619 (Validate length on socket_write). (thiagooak)
 
 08 Nov 2018, PHP 7.2.12
 

UPGRADING

@@ -99,6 +99,13 @@ PHP 7.2 UPGRADE NOTES
     from PHP 7.1 on 64-bit machines. This change was necessary to resolve a
     modulo bias bug in the implementation.
 
+- IMAP:
+  Starting with 7.2.13, rsh/ssh logins are disabled by default. Use
+  imap.enable_insecure_rsh if you want to enable them. Note that the IMAP
+  library does not filter mailbox names before passing them to rsh/ssh
+  command, thus passing untrusted data to this function with rsh/ssh enabled
+  is insecure.
+
 ========================================
 2. New Features
 ========================================

Zend/tests/bug55509.phpt

@@ -45,6 +45,13 @@ elseif (PHP_OS == 'FreeBSD') {
   if ($freeMemory < 2100*1024*1024) {
     die('skip Not enough memory.');
   }
+} elseif (PHP_OS == "WINNT") {
+  $s = trim(shell_exec("wmic OS get FreeVirtualMemory /Value 2>nil"));
+  $freeMemory = explode('=', $s)[1]*1;
+
+  if ($freeMemory < 2.1*1024*1024) {
+    die('skip Not enough memory.');
+  }
 }
 ?>
 --INI--

Zend/tests/bug75426.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Bug #75426: "Cannot use empty array elements" reports wrong position
+--FILE--
+<?php
+$a = [
+    1,
+    2,
+    3,
+    ,
+    5,
+    6,
+];
+?>
+--EXPECTF--
+Fatal error: Cannot use empty array elements in arrays in %s on line 5

Zend/tests/bug77339.phpt

@@ -0,0 +1,33 @@
+--TEST--
+Bug #77339 (__callStatic may get incorrect arguments)
+--FILE--
+<?php
+class Foo
+{
+    static function __callStatic($name, $arguments) {
+       if ($name === 'get') {
+            if (!isset($arguments[0])) {
+                var_dump(['getSomeWhat']);
+                var_dump($arguments);
+                exit;
+            }
+        } 
+        echo "OK\n";
+    }
+
+    protected function get ($key) {
+        echo "BUG!!!\n";
+    }
+}
+
+class Bar
+{
+    static function __callStatic($name, $arguments) {
+        echo Foo::get('getSomeWhat');
+    }
+}
+
+Bar::someUndefinedStaticFunction();
+?>
+--EXPECT--
+OK

Zend/tests/bug77494.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug #77494 (Disabling class causes segfault on member access)
+--SKIPIF--
+<?php if (!extension_loaded("curl")) exit("skip curl extension not loaded"); ?>
+--INI--
+disable_classes=CURLFile
+--FILE--
+<?php
+$a = new CURLFile();
+var_dump($a->name);
+?>
+--EXPECTF--
+Warning: CURLFile() has been disabled for security reasons in %sbug77494.php on line 2
+
+Notice: Undefined property: CURLFile::$name in %sbug77494.php on line 3
+NULL

Zend/tests/bug77530.phpt

@@ -0,0 +1,10 @@
+--TEST--
+Bug #77530: PHP crashes when parsing '(2)::class'
+--FILE--
+<?php
+
+echo (2)::class;
+
+?>
+--EXPECTF--
+Fatal error: Illegal class name in %s on line %d

Zend/tests/bug77589.phpt

@@ -0,0 +1,40 @@
+--TEST--
+BUG #77589 (Core dump using parse_ini_string with numeric sections)
+--FILE--
+<?php
+var_dump(
+	parse_ini_string(<<<INI
+[0]
+a = 1
+b = on
+c = true
+
+["true"]
+a = 100 
+b = null
+c = yes
+INI
+, TRUE, INI_SCANNER_TYPED));
+
+?>
+--EXPECT--
+array(2) {
+  [0]=>
+  array(3) {
+    ["a"]=>
+    int(1)
+    ["b"]=>
+    bool(true)
+    ["c"]=>
+    bool(true)
+  }
+  ["true"]=>
+  array(3) {
+    ["a"]=>
+    int(100)
+    ["b"]=>
+    NULL
+    ["c"]=>
+    bool(true)
+  }
+}

Zend/tests/self_class_const_in_unknown_scope.phpt

@@ -0,0 +1,23 @@
+--TEST--
+Use of self::class inside a constant in an unknown scope
+--FILE--
+<?php
+
+class Test {
+    public function foobar() {
+        eval("
+            const FOO = self::class;
+            var_dump(FOO);
+        ");
+    }
+}
+(new Test)->foobar();
+
+// This should error, but doesn't
+const BAR = self::class;
+var_dump(BAR);
+
+?>
+--EXPECT--
+string(4) "Test"
+string(0) ""

Zend/zend.c

@@ -930,10 +930,6 @@ void zend_shutdown(void) /* {{{ */
 	GLOBAL_CONSTANTS_TABLE = NULL;
 #endif
 	zend_destroy_rsrc_list_dtors();
-
-#ifndef ZTS
-	zend_interned_strings_dtor();
-#endif
 }
 /* }}} */
 

Zend/zend_API.c

@@ -2855,6 +2855,17 @@ static zend_object *display_disabled_class(zend_class_entry *class_type) /* {{{
 	zend_object *intern;
 
 	intern = zend_objects_new(class_type);
+
+	/* Initialize default properties */
+	if (EXPECTED(class_type->default_properties_count != 0)) {
+		zval *p = intern->properties_table;
+		zval *end = p + class_type->default_properties_count;
+		do {
+			ZVAL_UNDEF(p);
+			p++;
+		} while (p != end);
+	}
+
 	zend_error(E_WARNING, "%s() has been disabled for security reasons", ZSTR_VAL(class_type->name));
 	return intern;
 }

Zend/zend_alloc.c

@@ -193,9 +193,7 @@ typedef struct  _zend_mm_free_slot zend_mm_free_slot;
 typedef struct  _zend_mm_chunk     zend_mm_chunk;
 typedef struct  _zend_mm_huge_list zend_mm_huge_list;
 
-#ifdef MAP_HUGETLB
 int zend_mm_use_huge_pages = 0;
-#endif
 
 /*
  * Memory is retrived from OS by chunks of fixed size 2MB.
@@ -712,7 +710,9 @@ static void *zend_mm_chunk_alloc_int(size_t size, size_t alignment)
 		return NULL;
 	} else if (ZEND_MM_ALIGNED_OFFSET(ptr, alignment) == 0) {
 #ifdef MADV_HUGEPAGE
-	    madvise(ptr, size, MADV_HUGEPAGE);
+		if (zend_mm_use_huge_pages) {
+			madvise(ptr, size, MADV_HUGEPAGE);
+		}
 #endif
 		return ptr;
 	} else {
@@ -743,7 +743,9 @@ static void *zend_mm_chunk_alloc_int(size_t size, size_t alignment)
 			zend_mm_munmap((char*)ptr + size, alignment - REAL_PAGE_SIZE);
 		}
 # ifdef MADV_HUGEPAGE
-	    madvise(ptr, size, MADV_HUGEPAGE);
+		if (zend_mm_use_huge_pages) {
+			madvise(ptr, size, MADV_HUGEPAGE);
+		}
 # endif
 #endif
 		return ptr;
@@ -2600,8 +2602,9 @@ ZEND_API void shutdown_memory_manager(int silent, int full_shutdown)
 
 static void alloc_globals_ctor(zend_alloc_globals *alloc_globals)
 {
+	char *tmp;
 #if ZEND_MM_CUSTOM
-	char *tmp = getenv("USE_ZEND_ALLOC");
+	tmp = getenv("USE_ZEND_ALLOC");
 
 	if (tmp && !zend_atoi(tmp, 0)) {
 		alloc_globals->mm_heap = malloc(sizeof(zend_mm_heap));
@@ -2613,12 +2616,10 @@ static void alloc_globals_ctor(zend_alloc_globals *alloc_globals)
 		return;
 	}
 #endif
-#ifdef MAP_HUGETLB
 	tmp = getenv("USE_ZEND_ALLOC_HUGE_PAGES");
 	if (tmp && zend_atoi(tmp, 0)) {
 		zend_mm_use_huge_pages = 1;
 	}
-#endif
 	ZEND_TSRMLS_CACHE_UPDATE();
 	alloc_globals->mm_heap = zend_mm_init();
 }

Zend/zend_compile.c

@@ -1494,6 +1494,7 @@ static void zend_ensure_valid_class_fetch_type(uint32_t fetch_type) /* {{{ */
 static zend_bool zend_try_compile_const_expr_resolve_class_name(zval *zv, zend_ast *class_ast, zend_ast *name_ast, zend_bool constant) /* {{{ */
 {
 	uint32_t fetch_type;
+	zval *class_name;
 
 	if (name_ast->kind != ZEND_AST_ZVAL) {
 		return 0;
@@ -1508,12 +1509,18 @@ static zend_bool zend_try_compile_const_expr_resolve_class_name(zval *zv, zend_a
 			"Dynamic class names are not allowed in compile-time ::class fetch");
 	}
 
-	fetch_type = zend_get_class_fetch_type(zend_ast_get_str(class_ast));
+	class_name = zend_ast_get_zval(class_ast);
+
+	if (Z_TYPE_P(class_name) != IS_STRING) {
+		zend_error_noreturn(E_COMPILE_ERROR, "Illegal class name");
+	}
+
+	fetch_type = zend_get_class_fetch_type(Z_STR_P(class_name));
 	zend_ensure_valid_class_fetch_type(fetch_type);
 
 	switch (fetch_type) {
 		case ZEND_FETCH_CLASS_SELF:
-			if (constant || (CG(active_class_entry) && zend_is_scope_known())) {
+			if (CG(active_class_entry) && zend_is_scope_known()) {
 				ZVAL_STR_COPY(zv, CG(active_class_entry)->name);
 			} else {
 				ZVAL_NULL(zv);
@@ -3623,7 +3630,7 @@ int zend_compile_func_cuf(znode *result, zend_ast_list *args, zend_string *lcnam
 }
 /* }}} */
 
-static int zend_compile_assert(znode *result, zend_ast_list *args, zend_string *name, zend_function *fbc) /* {{{ */
+static void zend_compile_assert(znode *result, zend_ast_list *args, zend_string *name, zend_function *fbc) /* {{{ */
 {
 	if (EG(assertions) >= 0) {
 		znode name_node;
@@ -3666,8 +3673,6 @@ static int zend_compile_assert(znode *result, zend_ast_list *args, zend_string *
 		result->op_type = IS_CONST;
 		ZVAL_TRUE(&result->u.constant);
 	}
-
-	return SUCCESS;
 }
 /* }}} */
 
@@ -3875,10 +3880,6 @@ int zend_try_compile_special_func(znode *result, zend_string *lcname, zend_ast_l
 		return FAILURE;
 	}
 
-	if (zend_string_equals_literal(lcname, "assert")) {
-		return zend_compile_assert(result, args, lcname, fbc);
-	}
-
 	if (CG(compiler_options) & ZEND_COMPILE_NO_BUILTINS) {
 		return FAILURE;
 	}
@@ -3981,8 +3982,16 @@ void zend_compile_call(znode *result, zend_ast *ast, uint32_t type) /* {{{ */
 		zend_op *opline;
 
 		lcname = zend_string_tolower(Z_STR_P(name));
-
 		fbc = zend_hash_find_ptr(CG(function_table), lcname);
+
+		/* Special assert() handling should apply independently of compiler flags. */
+		if (fbc && zend_string_equals_literal(lcname, "assert")) {
+			zend_compile_assert(result, zend_ast_get_list(args_ast), lcname, fbc);
+			zend_string_release(lcname);
+			zval_ptr_dtor(&name_node.u.constant);
+			return;
+		}
+
 		if (!fbc
 		 || (fbc->type == ZEND_INTERNAL_FUNCTION && (CG(compiler_options) & ZEND_COMPILE_IGNORE_INTERNAL_FUNCTIONS))
 		 || (fbc->type == ZEND_USER_FUNCTION && (CG(compiler_options) & ZEND_COMPILE_IGNORE_USER_FUNCTIONS))
@@ -4127,6 +4136,14 @@ void zend_compile_static_call(znode *result, zend_ast *ast, uint32_t type) /* {{
 		if (ce) {
 			zend_string *lcname = Z_STR_P(CT_CONSTANT(opline->op2) + 1);
 			fbc = zend_hash_find_ptr(&ce->function_table, lcname);
+			if (fbc && !(fbc->common.fn_flags & ZEND_ACC_PUBLIC)) {
+				if (ce != CG(active_class_entry)
+				 &&((fbc->common.fn_flags & ZEND_ACC_PRIVATE)
+				  || !zend_check_protected(zend_get_function_root_class(fbc), CG(active_class_entry)))) {
+					/* incompatibe function */
+					fbc = NULL;
+				}
+			}
 		}
 	}
 
@@ -4797,6 +4814,10 @@ void zend_compile_foreach(zend_ast *ast) /* {{{ */
 
 	zend_compile_stmt(stmt_ast);
 
+	/* Place JMP and FE_FREE on the line where foreach starts. It would be
+	 * better to use the end line, but this information is not available
+	 * currently. */
+	CG(zend_lineno) = ast->lineno;
 	zend_emit_jump(opnum_fetch);
 
 	opline = &CG(active_op_array)->opcodes[opnum_reset];
@@ -4895,6 +4916,10 @@ static zend_uchar determine_switch_jumptable_type(zend_ast_list *cases) {
 }
 
 static zend_bool should_use_jumptable(zend_ast_list *cases, zend_uchar jumptable_type) {
+	if (CG(compiler_options) & ZEND_COMPILE_NO_JUMPTABLES) {
+		return 0;
+	}
+
 	/* Thresholds are chosen based on when the average switch time for equidistributed
 	 * input becomes smaller when using the jumptable optimization. */
 	if (jumptable_type == IS_LONG) {
@@ -6908,6 +6933,7 @@ static inline void zend_ct_eval_greater(zval *result, zend_ast_kind kind, zval *
 static zend_bool zend_try_ct_eval_array(zval *result, zend_ast *ast) /* {{{ */
 {
 	zend_ast_list *list = zend_ast_get_list(ast);
+	zend_ast *last_elem_ast = NULL;
 	uint32_t i;
 	zend_bool is_constant = 1;
 
@@ -6920,6 +6946,10 @@ static zend_bool zend_try_ct_eval_array(zval *result, zend_ast *ast) /* {{{ */
 		zend_ast *elem_ast = list->child[i];
 
 		if (elem_ast == NULL) {
+			/* Report error at line of last non-empty element */
+			if (last_elem_ast) {
+				CG(zend_lineno) = zend_ast_get_lineno(last_elem_ast);
+			}
 			zend_error(E_COMPILE_ERROR, "Cannot use empty array elements in arrays");
 		}
 
@@ -6931,6 +6961,8 @@ static zend_bool zend_try_ct_eval_array(zval *result, zend_ast *ast) /* {{{ */
 		) {
 			is_constant = 0;
 		}
+
+		last_elem_ast = elem_ast;
 	}
 
 	if (!is_constant) {
@@ -7990,9 +8022,7 @@ void zend_compile_const_expr_magic_const(zend_ast **ast_ptr) /* {{{ */
 	zend_ast *ast = *ast_ptr;
 
 	/* Other cases already resolved by constant folding */
-	ZEND_ASSERT(ast->attr == T_CLASS_C &&
-	            CG(active_class_entry) &&
-	            (CG(active_class_entry)->ce_flags & ZEND_ACC_TRAIT) != 0);
+	ZEND_ASSERT(ast->attr == T_CLASS_C);
 
 	{
 		zval const_zv;

Zend/zend_compile.h

@@ -1040,6 +1040,9 @@ END_EXTERN_C()
 /* disable builtin special case function calls */
 #define ZEND_COMPILE_NO_BUILTINS				(1<<10)
 
+/* disable jumptable optimization for switch statements */
+#define ZEND_COMPILE_NO_JUMPTABLES				(1<<11)
+
 /* The default value for CG(compiler_options) */
 #define ZEND_COMPILE_DEFAULT					ZEND_COMPILE_HANDLE_OP_ARRAY
 

Zend/zend_constants.c

@@ -341,7 +341,9 @@ ZEND_API zval *zend_get_constant_ex(zend_string *cname, zend_class_entry *scope,
 				ret_constant = NULL;
 			} else {
 				if (!zend_verify_const_access(c, scope)) {
-					zend_throw_error(NULL, "Cannot access %s const %s::%s", zend_visibility_string(Z_ACCESS_FLAGS(c->value)), ZSTR_VAL(class_name), ZSTR_VAL(constant_name));
+					if ((flags & ZEND_FETCH_CLASS_SILENT) == 0) {
+						zend_throw_error(NULL, "Cannot access %s const %s::%s", zend_visibility_string(Z_ACCESS_FLAGS(c->value)), ZSTR_VAL(class_name), ZSTR_VAL(constant_name));
+					}
 					goto failure;
 				}
 				ret_constant = &c->value;

Zend/zend_ini_scanner.c

@@ -144,13 +144,14 @@ ZEND_API zend_ini_scanner_globals ini_scanner_globals;
 	ZVAL_NEW_STR(retval, zend_string_init(str, len, ZEND_SYSTEM_INI))
 
 
-#define RETURN_TOKEN(type, str, len) {                       \
-	if (SCNG(scanner_mode) == ZEND_INI_SCANNER_TYPED) {      \
-		zend_ini_copy_typed_value(ini_lval, type, str, len); \
-	} else {                                                 \
-		zend_ini_copy_value(ini_lval, str, len);             \
-	}                                                        \
-	return type;                                             \
+#define RETURN_TOKEN(type, str, len) {                             \
+	if (SCNG(scanner_mode) == ZEND_INI_SCANNER_TYPED &&            \
+		(YYSTATE == STATE(ST_VALUE) || YYSTATE == STATE(ST_RAW))) {\
+		zend_ini_copy_typed_value(ini_lval, type, str, len);       \
+	} else {                                                       \
+		zend_ini_copy_value(ini_lval, str, len);                   \
+	}                                                              \
+	return type;                                                   \
 }
 
 static inline int convert_to_number(zval *retval, const char *str, const int str_len)
@@ -383,7 +384,7 @@ restart:
 		}
 	}
 
-#line 387 "Zend/zend_ini_scanner.c"
+#line 388 "Zend/zend_ini_scanner.c"
 {
 	YYCTYPE yych;
 	unsigned int yyaccept = 0;
@@ -505,7 +506,7 @@ yy4:
 yy5:
 		YYDEBUG(5, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 483 "Zend/zend_ini_scanner.l"
+#line 484 "Zend/zend_ini_scanner.l"
 		{ /* Get option name */
 	/* Eat leading whitespace */
 	EAT_LEADING_WHITESPACE();
@@ -515,7 +516,7 @@ yy5:
 
 	RETURN_TOKEN(TC_LABEL, yytext, yyleng);
 }
-#line 519 "Zend/zend_ini_scanner.c"
+#line 520 "Zend/zend_ini_scanner.c"
 yy6:
 		YYDEBUG(6, *YYCURSOR);
 		++YYCURSOR;
@@ -539,24 +540,24 @@ yy6:
 yy8:
 		YYDEBUG(8, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 636 "Zend/zend_ini_scanner.l"
+#line 637 "Zend/zend_ini_scanner.l"
 		{
 	/* eat whitespace */
 	goto restart;
 }
-#line 548 "Zend/zend_ini_scanner.c"
+#line 549 "Zend/zend_ini_scanner.c"
 yy9:
 		YYDEBUG(9, *YYCURSOR);
 		++YYCURSOR;
 yy10:
 		YYDEBUG(10, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 641 "Zend/zend_ini_scanner.l"
+#line 642 "Zend/zend_ini_scanner.l"
 		{
 	SCNG(lineno)++;
 	return END_OF_LINE;
 }
-#line 560 "Zend/zend_ini_scanner.c"
+#line 561 "Zend/zend_ini_scanner.c"
 yy11:
 		YYDEBUG(11, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -617,11 +618,11 @@ yy14:
 		++YYCURSOR;
 		YYDEBUG(15, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 564 "Zend/zend_ini_scanner.l"
+#line 565 "Zend/zend_ini_scanner.l"
 		{ /* Disallow these chars outside option values */
 	return yytext[0];
 }
-#line 625 "Zend/zend_ini_scanner.c"
+#line 626 "Zend/zend_ini_scanner.c"
 yy16:
 		YYDEBUG(16, *YYCURSOR);
 		++YYCURSOR;
@@ -629,11 +630,11 @@ yy16:
 		goto yy32;
 		YYDEBUG(17, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 657 "Zend/zend_ini_scanner.l"
+#line 658 "Zend/zend_ini_scanner.l"
 		{
 	return 0;
 }
-#line 637 "Zend/zend_ini_scanner.c"
+#line 638 "Zend/zend_ini_scanner.c"
 yy18:
 		YYDEBUG(18, *YYCURSOR);
 		++YYCURSOR;
@@ -644,7 +645,7 @@ yy18:
 		if (yych == ' ') goto yy18;
 		YYDEBUG(20, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 493 "Zend/zend_ini_scanner.l"
+#line 494 "Zend/zend_ini_scanner.l"
 		{ /* Start option value */
 	if (SCNG(scanner_mode) == ZEND_INI_SCANNER_RAW) {
 		BEGIN(ST_RAW);
@@ -653,7 +654,7 @@ yy18:
 	}
 	return '=';
 }
-#line 657 "Zend/zend_ini_scanner.c"
+#line 658 "Zend/zend_ini_scanner.c"
 yy21:
 		YYDEBUG(21, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -709,7 +710,7 @@ yy26:
 		++YYCURSOR;
 		YYDEBUG(27, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 408 "Zend/zend_ini_scanner.l"
+#line 409 "Zend/zend_ini_scanner.l"
 		{ /* Section start */
 	/* Enter section data lookup state */
 	if (SCNG(scanner_mode) == ZEND_INI_SCANNER_RAW) {
@@ -719,7 +720,7 @@ yy26:
 	}
 	return TC_SECTION;
 }
-#line 723 "Zend/zend_ini_scanner.c"
+#line 724 "Zend/zend_ini_scanner.c"
 yy28:
 		YYDEBUG(28, *YYCURSOR);
 		++YYCURSOR;
@@ -730,7 +731,7 @@ yy28:
 		if (yych == ' ') goto yy28;
 		YYDEBUG(30, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 433 "Zend/zend_ini_scanner.l"
+#line 434 "Zend/zend_ini_scanner.l"
 		{ /* Start of option with offset */
 	/* Eat leading whitespace */
 	EAT_LEADING_WHITESPACE();
@@ -743,7 +744,7 @@ yy28:
 
 	RETURN_TOKEN(TC_OFFSET, yytext, yyleng);
 }
-#line 747 "Zend/zend_ini_scanner.c"
+#line 748 "Zend/zend_ini_scanner.c"
 yy31:
 		YYDEBUG(31, *YYCURSOR);
 		++YYCURSOR;
@@ -761,13 +762,13 @@ yy33:
 yy34:
 		YYDEBUG(34, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 646 "Zend/zend_ini_scanner.l"
+#line 647 "Zend/zend_ini_scanner.l"
 		{ /* Comment */
 	BEGIN(INITIAL);
 	SCNG(lineno)++;
 	return END_OF_LINE;
 }
-#line 771 "Zend/zend_ini_scanner.c"
+#line 772 "Zend/zend_ini_scanner.c"
 yy35:
 		YYDEBUG(35, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -822,11 +823,11 @@ yy37:
 yy38:
 		YYDEBUG(38, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 475 "Zend/zend_ini_scanner.l"
+#line 476 "Zend/zend_ini_scanner.l"
 		{ /* FALSE value (when used outside option value/offset this causes parse error!)*/
 	RETURN_TOKEN(BOOL_FALSE, "", 0);
 }
-#line 830 "Zend/zend_ini_scanner.c"
+#line 831 "Zend/zend_ini_scanner.c"
 yy39:
 		YYDEBUG(39, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -883,11 +884,11 @@ yy41:
 yy43:
 		YYDEBUG(43, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 471 "Zend/zend_ini_scanner.l"
+#line 472 "Zend/zend_ini_scanner.l"
 		{ /* TRUE value (when used outside option value/offset this causes parse error!) */
 	RETURN_TOKEN(BOOL_TRUE, "1", 1);
 }
-#line 891 "Zend/zend_ini_scanner.c"
+#line 892 "Zend/zend_ini_scanner.c"
 yy44:
 		YYDEBUG(44, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -1034,11 +1035,11 @@ yy56:
 yy58:
 		YYDEBUG(58, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 479 "Zend/zend_ini_scanner.l"
+#line 480 "Zend/zend_ini_scanner.l"
 		{
 	RETURN_TOKEN(NULL_NULL, "", 0);
 }
-#line 1042 "Zend/zend_ini_scanner.c"
+#line 1043 "Zend/zend_ini_scanner.c"
 yy59:
 		YYDEBUG(59, *YYCURSOR);
 		++YYCURSOR;
@@ -1096,7 +1097,7 @@ yyc_ST_DOUBLE_QUOTES:
 yy64:
 		YYDEBUG(64, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 596 "Zend/zend_ini_scanner.l"
+#line 597 "Zend/zend_ini_scanner.l"
 		{ /* Escape double quoted string contents */
 	if (YYCURSOR > YYLIMIT) {
 		return 0;
@@ -1132,7 +1133,7 @@ yy64:
 	zend_ini_escape_string(ini_lval, yytext, yyleng, '"');
 	return TC_QUOTED_STRING;
 }
-#line 1136 "Zend/zend_ini_scanner.c"
+#line 1137 "Zend/zend_ini_scanner.c"
 yy65:
 		YYDEBUG(65, *YYCURSOR);
 		++YYCURSOR;
@@ -1144,12 +1145,12 @@ yy65:
 		}
 		YYDEBUG(67, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 591 "Zend/zend_ini_scanner.l"
+#line 592 "Zend/zend_ini_scanner.l"
 		{ /* Double quoted '"' string ends */
 	yy_pop_state();
 	return '"';
 }
-#line 1153 "Zend/zend_ini_scanner.c"
+#line 1154 "Zend/zend_ini_scanner.c"
 yy68:
 		YYDEBUG(68, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -1158,12 +1159,12 @@ yy68:
 		++YYCURSOR;
 		YYDEBUG(70, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 451 "Zend/zend_ini_scanner.l"
+#line 452 "Zend/zend_ini_scanner.l"
 		{ /* Variable start */
 	yy_push_state(ST_VARNAME);
 	return TC_DOLLAR_CURLY;
 }
-#line 1167 "Zend/zend_ini_scanner.c"
+#line 1168 "Zend/zend_ini_scanner.c"
 	}
 /* *********************************** */
 yyc_ST_OFFSET:
@@ -1263,11 +1264,11 @@ yy74:
 yy75:
 		YYDEBUG(75, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 582 "Zend/zend_ini_scanner.l"
+#line 583 "Zend/zend_ini_scanner.l"
 		{ /* Get rest as section/offset value */
 	RETURN_TOKEN(TC_STRING, yytext, yyleng);
 }
-#line 1271 "Zend/zend_ini_scanner.c"
+#line 1272 "Zend/zend_ini_scanner.c"
 yy76:
 		YYDEBUG(76, *YYCURSOR);
 		yyaccept = 0;
@@ -1307,22 +1308,22 @@ yy78:
 yy79:
 		YYDEBUG(79, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 657 "Zend/zend_ini_scanner.l"
+#line 658 "Zend/zend_ini_scanner.l"
 		{
 	return 0;
 }
-#line 1315 "Zend/zend_ini_scanner.c"
+#line 1316 "Zend/zend_ini_scanner.c"
 yy80:
 		YYDEBUG(80, *YYCURSOR);
 		++YYCURSOR;
 		YYDEBUG(81, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 586 "Zend/zend_ini_scanner.l"
+#line 587 "Zend/zend_ini_scanner.l"
 		{ /* Double quoted '"' string start */
 	yy_push_state(ST_DOUBLE_QUOTES);
 	return '"';
 }
-#line 1326 "Zend/zend_ini_scanner.c"
+#line 1327 "Zend/zend_ini_scanner.c"
 yy82:
 		YYDEBUG(82, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -1388,11 +1389,11 @@ yy85:
 yy87:
 		YYDEBUG(87, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 560 "Zend/zend_ini_scanner.l"
+#line 561 "Zend/zend_ini_scanner.l"
 		{ /* Get number option value as string */
 	RETURN_TOKEN(TC_NUMBER, yytext, yyleng);
 }
-#line 1396 "Zend/zend_ini_scanner.c"
+#line 1397 "Zend/zend_ini_scanner.c"
 yy88:
 		YYDEBUG(88, *YYCURSOR);
 		yyaccept = 3;
@@ -1425,11 +1426,11 @@ yy88:
 yy90:
 		YYDEBUG(90, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 556 "Zend/zend_ini_scanner.l"
+#line 557 "Zend/zend_ini_scanner.l"
 		{ /* Get constant option value */
 	RETURN_TOKEN(TC_CONSTANT, yytext, yyleng);
 }
-#line 1433 "Zend/zend_ini_scanner.c"
+#line 1434 "Zend/zend_ini_scanner.c"
 yy91:
 		YYDEBUG(91, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -1439,12 +1440,12 @@ yy92:
 		++YYCURSOR;
 		YYDEBUG(93, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 446 "Zend/zend_ini_scanner.l"
+#line 447 "Zend/zend_ini_scanner.l"
 		{ /* End of section or an option offset */
 	BEGIN(INITIAL);
 	return ']';
 }
-#line 1448 "Zend/zend_ini_scanner.c"
+#line 1449 "Zend/zend_ini_scanner.c"
 yy94:
 		YYDEBUG(94, *YYCURSOR);
 		++YYCURSOR;
@@ -1494,12 +1495,12 @@ yy99:
 		++YYCURSOR;
 		YYDEBUG(100, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 451 "Zend/zend_ini_scanner.l"
+#line 452 "Zend/zend_ini_scanner.l"
 		{ /* Variable start */
 	yy_push_state(ST_VARNAME);
 	return TC_DOLLAR_CURLY;
 }
-#line 1503 "Zend/zend_ini_scanner.c"
+#line 1504 "Zend/zend_ini_scanner.c"
 yy101:
 		YYDEBUG(101, *YYCURSOR);
 		++YYCURSOR;
@@ -1553,7 +1554,7 @@ yy105:
 		++YYCURSOR;
 		YYDEBUG(106, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 418 "Zend/zend_ini_scanner.l"
+#line 419 "Zend/zend_ini_scanner.l"
 		{ /* Raw string */
 	/* Eat leading and trailing single quotes */
 	if (yytext[0] == '\'' && yytext[yyleng - 1] == '\'') {
@@ -1562,7 +1563,7 @@ yy105:
 	}
 	RETURN_TOKEN(TC_RAW, yytext, yyleng);
 }
-#line 1566 "Zend/zend_ini_scanner.c"
+#line 1567 "Zend/zend_ini_scanner.c"
 	}
 /* *********************************** */
 yyc_ST_RAW:
@@ -1626,19 +1627,19 @@ yyc_ST_RAW:
 		++YYCURSOR;
 		YYDEBUG(110, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 652 "Zend/zend_ini_scanner.l"
+#line 653 "Zend/zend_ini_scanner.l"
 		{ /* End of option value (if EOF is reached before EOL */
 	BEGIN(INITIAL);
 	return END_OF_LINE;
 }
-#line 1635 "Zend/zend_ini_scanner.c"
+#line 1636 "Zend/zend_ini_scanner.c"
 yy111:
 		YYDEBUG(111, *YYCURSOR);
 		++YYCURSOR;
 yy112:
 		YYDEBUG(112, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 502 "Zend/zend_ini_scanner.l"
+#line 503 "Zend/zend_ini_scanner.l"
 		{ /* Raw value, only used when SCNG(scanner_mode) == ZEND_INI_SCANNER_RAW. */
 	unsigned char *sc = NULL;
 	EAT_LEADING_WHITESPACE();
@@ -1682,7 +1683,7 @@ end_raw_value_chars:
 
 	RETURN_TOKEN(TC_RAW, yytext, yyleng);
 }
-#line 1686 "Zend/zend_ini_scanner.c"
+#line 1687 "Zend/zend_ini_scanner.c"
 yy113:
 		YYDEBUG(113, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -1706,13 +1707,13 @@ yy114:
 yy115:
 		YYDEBUG(115, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 550 "Zend/zend_ini_scanner.l"
+#line 551 "Zend/zend_ini_scanner.l"
 		{ /* End of option value */
 	BEGIN(INITIAL);
 	SCNG(lineno)++;
 	return END_OF_LINE;
 }
-#line 1716 "Zend/zend_ini_scanner.c"
+#line 1717 "Zend/zend_ini_scanner.c"
 yy116:
 		YYDEBUG(116, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -1742,12 +1743,12 @@ yy119:
 yy120:
 		YYDEBUG(120, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 636 "Zend/zend_ini_scanner.l"
+#line 637 "Zend/zend_ini_scanner.l"
 		{
 	/* eat whitespace */
 	goto restart;
 }
-#line 1751 "Zend/zend_ini_scanner.c"
+#line 1752 "Zend/zend_ini_scanner.c"
 yy121:
 		YYDEBUG(121, *YYCURSOR);
 		++YYCURSOR;
@@ -1765,13 +1766,13 @@ yy123:
 yy124:
 		YYDEBUG(124, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 646 "Zend/zend_ini_scanner.l"
+#line 647 "Zend/zend_ini_scanner.l"
 		{ /* Comment */
 	BEGIN(INITIAL);
 	SCNG(lineno)++;
 	return END_OF_LINE;
 }
-#line 1775 "Zend/zend_ini_scanner.c"
+#line 1776 "Zend/zend_ini_scanner.c"
 yy125:
 		YYDEBUG(125, *YYCURSOR);
 		++YYCURSOR;
@@ -1834,21 +1835,21 @@ yy128:
 		}
 		YYDEBUG(130, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 546 "Zend/zend_ini_scanner.l"
+#line 547 "Zend/zend_ini_scanner.l"
 		{ /* Raw value, only used when SCNG(scanner_mode) == ZEND_INI_SCANNER_RAW. */
 	RETURN_TOKEN(TC_RAW, yytext, yyleng);
 }
-#line 1842 "Zend/zend_ini_scanner.c"
+#line 1843 "Zend/zend_ini_scanner.c"
 yy131:
 		YYDEBUG(131, *YYCURSOR);
 		++YYCURSOR;
 		YYDEBUG(132, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 657 "Zend/zend_ini_scanner.l"
+#line 658 "Zend/zend_ini_scanner.l"
 		{
 	return 0;
 }
-#line 1852 "Zend/zend_ini_scanner.c"
+#line 1853 "Zend/zend_ini_scanner.c"
 yy133:
 		YYDEBUG(133, *YYCURSOR);
 		++YYCURSOR;
@@ -1864,13 +1865,13 @@ yy133:
 yy135:
 		YYDEBUG(135, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 427 "Zend/zend_ini_scanner.l"
+#line 428 "Zend/zend_ini_scanner.l"
 		{ /* End of section */
 	BEGIN(INITIAL);
 	SCNG(lineno)++;
 	return ']';
 }
-#line 1874 "Zend/zend_ini_scanner.c"
+#line 1875 "Zend/zend_ini_scanner.c"
 yy136:
 		YYDEBUG(136, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -1979,11 +1980,11 @@ yy141:
 yy142:
 		YYDEBUG(142, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 582 "Zend/zend_ini_scanner.l"
+#line 583 "Zend/zend_ini_scanner.l"
 		{ /* Get rest as section/offset value */
 	RETURN_TOKEN(TC_STRING, yytext, yyleng);
 }
-#line 1987 "Zend/zend_ini_scanner.c"
+#line 1988 "Zend/zend_ini_scanner.c"
 yy143:
 		YYDEBUG(143, *YYCURSOR);
 		yyaccept = 0;
@@ -2023,22 +2024,22 @@ yy145:
 yy146:
 		YYDEBUG(146, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 657 "Zend/zend_ini_scanner.l"
+#line 658 "Zend/zend_ini_scanner.l"
 		{
 	return 0;
 }
-#line 2031 "Zend/zend_ini_scanner.c"
+#line 2032 "Zend/zend_ini_scanner.c"
 yy147:
 		YYDEBUG(147, *YYCURSOR);
 		++YYCURSOR;
 		YYDEBUG(148, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 586 "Zend/zend_ini_scanner.l"
+#line 587 "Zend/zend_ini_scanner.l"
 		{ /* Double quoted '"' string start */
 	yy_push_state(ST_DOUBLE_QUOTES);
 	return '"';
 }
-#line 2042 "Zend/zend_ini_scanner.c"
+#line 2043 "Zend/zend_ini_scanner.c"
 yy149:
 		YYDEBUG(149, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -2104,11 +2105,11 @@ yy152:
 yy154:
 		YYDEBUG(154, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 560 "Zend/zend_ini_scanner.l"
+#line 561 "Zend/zend_ini_scanner.l"
 		{ /* Get number option value as string */
 	RETURN_TOKEN(TC_NUMBER, yytext, yyleng);
 }
-#line 2112 "Zend/zend_ini_scanner.c"
+#line 2113 "Zend/zend_ini_scanner.c"
 yy155:
 		YYDEBUG(155, *YYCURSOR);
 		yyaccept = 3;
@@ -2141,11 +2142,11 @@ yy155:
 yy157:
 		YYDEBUG(157, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 556 "Zend/zend_ini_scanner.l"
+#line 557 "Zend/zend_ini_scanner.l"
 		{ /* Get constant option value */
 	RETURN_TOKEN(TC_CONSTANT, yytext, yyleng);
 }
-#line 2149 "Zend/zend_ini_scanner.c"
+#line 2150 "Zend/zend_ini_scanner.c"
 yy158:
 		YYDEBUG(158, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -2167,13 +2168,13 @@ yy159:
 yy161:
 		YYDEBUG(161, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 427 "Zend/zend_ini_scanner.l"
+#line 428 "Zend/zend_ini_scanner.l"
 		{ /* End of section */
 	BEGIN(INITIAL);
 	SCNG(lineno)++;
 	return ']';
 }
-#line 2177 "Zend/zend_ini_scanner.c"
+#line 2178 "Zend/zend_ini_scanner.c"
 yy162:
 		YYDEBUG(162, *YYCURSOR);
 		++YYCURSOR;
@@ -2223,12 +2224,12 @@ yy167:
 		++YYCURSOR;
 		YYDEBUG(168, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 451 "Zend/zend_ini_scanner.l"
+#line 452 "Zend/zend_ini_scanner.l"
 		{ /* Variable start */
 	yy_push_state(ST_VARNAME);
 	return TC_DOLLAR_CURLY;
 }
-#line 2232 "Zend/zend_ini_scanner.c"
+#line 2233 "Zend/zend_ini_scanner.c"
 yy169:
 		YYDEBUG(169, *YYCURSOR);
 		++YYCURSOR;
@@ -2291,7 +2292,7 @@ yy175:
 		++YYCURSOR;
 		YYDEBUG(176, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 418 "Zend/zend_ini_scanner.l"
+#line 419 "Zend/zend_ini_scanner.l"
 		{ /* Raw string */
 	/* Eat leading and trailing single quotes */
 	if (yytext[0] == '\'' && yytext[yyleng - 1] == '\'') {
@@ -2300,7 +2301,7 @@ yy175:
 	}
 	RETURN_TOKEN(TC_RAW, yytext, yyleng);
 }
-#line 2304 "Zend/zend_ini_scanner.c"
+#line 2305 "Zend/zend_ini_scanner.c"
 	}
 /* *********************************** */
 yyc_ST_VALUE:
@@ -2436,12 +2437,12 @@ yy179:
 yy180:
 		YYDEBUG(180, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 652 "Zend/zend_ini_scanner.l"
+#line 653 "Zend/zend_ini_scanner.l"
 		{ /* End of option value (if EOF is reached before EOL */
 	BEGIN(INITIAL);
 	return END_OF_LINE;
 }
-#line 2445 "Zend/zend_ini_scanner.c"
+#line 2446 "Zend/zend_ini_scanner.c"
 yy181:
 		YYDEBUG(181, *YYCURSOR);
 		yyaccept = 0;
@@ -2458,11 +2459,11 @@ yy182:
 yy183:
 		YYDEBUG(183, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 578 "Zend/zend_ini_scanner.l"
+#line 579 "Zend/zend_ini_scanner.l"
 		{ /* Get everything else as option/offset value */
 	RETURN_TOKEN(TC_STRING, yytext, yyleng);
 }
-#line 2466 "Zend/zend_ini_scanner.c"
+#line 2467 "Zend/zend_ini_scanner.c"
 yy184:
 		YYDEBUG(184, *YYCURSOR);
 		yyaccept = 1;
@@ -2487,24 +2488,24 @@ yy184:
 yy186:
 		YYDEBUG(186, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 632 "Zend/zend_ini_scanner.l"
+#line 633 "Zend/zend_ini_scanner.l"
 		{
 	RETURN_TOKEN(TC_WHITESPACE, yytext, yyleng);
 }
-#line 2495 "Zend/zend_ini_scanner.c"
+#line 2496 "Zend/zend_ini_scanner.c"
 yy187:
 		YYDEBUG(187, *YYCURSOR);
 		++YYCURSOR;
 yy188:
 		YYDEBUG(188, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 550 "Zend/zend_ini_scanner.l"
+#line 551 "Zend/zend_ini_scanner.l"
 		{ /* End of option value */
 	BEGIN(INITIAL);
 	SCNG(lineno)++;
 	return END_OF_LINE;
 }
-#line 2508 "Zend/zend_ini_scanner.c"
+#line 2509 "Zend/zend_ini_scanner.c"
 yy189:
 		YYDEBUG(189, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -2520,22 +2521,22 @@ yy190:
 		if (yych == ' ') goto yy190;
 		YYDEBUG(192, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 568 "Zend/zend_ini_scanner.l"
+#line 569 "Zend/zend_ini_scanner.l"
 		{ /* Boolean operators */
 	return yytext[0];
 }
-#line 2528 "Zend/zend_ini_scanner.c"
+#line 2529 "Zend/zend_ini_scanner.c"
 yy193:
 		YYDEBUG(193, *YYCURSOR);
 		++YYCURSOR;
 		YYDEBUG(194, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 586 "Zend/zend_ini_scanner.l"
+#line 587 "Zend/zend_ini_scanner.l"
 		{ /* Double quoted '"' string start */
 	yy_push_state(ST_DOUBLE_QUOTES);
 	return '"';
 }
-#line 2539 "Zend/zend_ini_scanner.c"
+#line 2540 "Zend/zend_ini_scanner.c"
 yy195:
 		YYDEBUG(195, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -2610,11 +2611,11 @@ yy198:
 yy200:
 		YYDEBUG(200, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 560 "Zend/zend_ini_scanner.l"
+#line 561 "Zend/zend_ini_scanner.l"
 		{ /* Get number option value as string */
 	RETURN_TOKEN(TC_NUMBER, yytext, yyleng);
 }
-#line 2618 "Zend/zend_ini_scanner.c"
+#line 2619 "Zend/zend_ini_scanner.c"
 yy201:
 		YYDEBUG(201, *YYCURSOR);
 		yyaccept = 2;
@@ -2625,13 +2626,13 @@ yy202:
 		++YYCURSOR;
 		YYDEBUG(203, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 572 "Zend/zend_ini_scanner.l"
+#line 573 "Zend/zend_ini_scanner.l"
 		{ /* Make = used in option value to trigger error */
 	yyless(0);
 	BEGIN(INITIAL);
 	return END_OF_LINE;
 }
-#line 2635 "Zend/zend_ini_scanner.c"
+#line 2636 "Zend/zend_ini_scanner.c"
 yy204:
 		YYDEBUG(204, *YYCURSOR);
 		yyaccept = 4;
@@ -2678,11 +2679,11 @@ yy204:
 yy206:
 		YYDEBUG(206, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 556 "Zend/zend_ini_scanner.l"
+#line 557 "Zend/zend_ini_scanner.l"
 		{ /* Get constant option value */
 	RETURN_TOKEN(TC_CONSTANT, yytext, yyleng);
 }
-#line 2686 "Zend/zend_ini_scanner.c"
+#line 2687 "Zend/zend_ini_scanner.c"
 yy207:
 		YYDEBUG(207, *YYCURSOR);
 		yyaccept = 4;
@@ -3036,12 +3037,12 @@ yy217:
 		++YYCURSOR;
 		YYDEBUG(218, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 451 "Zend/zend_ini_scanner.l"
+#line 452 "Zend/zend_ini_scanner.l"
 		{ /* Variable start */
 	yy_push_state(ST_VARNAME);
 	return TC_DOLLAR_CURLY;
 }
-#line 3045 "Zend/zend_ini_scanner.c"
+#line 3046 "Zend/zend_ini_scanner.c"
 yy219:
 		YYDEBUG(219, *YYCURSOR);
 		++YYCURSOR;
@@ -3107,13 +3108,13 @@ yy223:
 yy224:
 		YYDEBUG(224, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 646 "Zend/zend_ini_scanner.l"
+#line 647 "Zend/zend_ini_scanner.l"
 		{ /* Comment */
 	BEGIN(INITIAL);
 	SCNG(lineno)++;
 	return END_OF_LINE;
 }
-#line 3117 "Zend/zend_ini_scanner.c"
+#line 3118 "Zend/zend_ini_scanner.c"
 yy225:
 		YYDEBUG(225, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -3224,11 +3225,11 @@ yy227:
 yy228:
 		YYDEBUG(228, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 475 "Zend/zend_ini_scanner.l"
+#line 476 "Zend/zend_ini_scanner.l"
 		{ /* FALSE value (when used outside option value/offset this causes parse error!)*/
 	RETURN_TOKEN(BOOL_FALSE, "", 0);
 }
-#line 3232 "Zend/zend_ini_scanner.c"
+#line 3233 "Zend/zend_ini_scanner.c"
 yy229:
 		YYDEBUG(229, *YYCURSOR);
 		yyaccept = 4;
@@ -3375,11 +3376,11 @@ yy231:
 yy232:
 		YYDEBUG(232, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 471 "Zend/zend_ini_scanner.l"
+#line 472 "Zend/zend_ini_scanner.l"
 		{ /* TRUE value (when used outside option value/offset this causes parse error!) */
 	RETURN_TOKEN(BOOL_TRUE, "1", 1);
 }
-#line 3383 "Zend/zend_ini_scanner.c"
+#line 3384 "Zend/zend_ini_scanner.c"
 yy233:
 		YYDEBUG(233, *YYCURSOR);
 		yyaccept = 4;
@@ -3499,7 +3500,7 @@ yy237:
 		++YYCURSOR;
 		YYDEBUG(238, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 418 "Zend/zend_ini_scanner.l"
+#line 419 "Zend/zend_ini_scanner.l"
 		{ /* Raw string */
 	/* Eat leading and trailing single quotes */
 	if (yytext[0] == '\'' && yytext[yyleng - 1] == '\'') {
@@ -3508,7 +3509,7 @@ yy237:
 	}
 	RETURN_TOKEN(TC_RAW, yytext, yyleng);
 }
-#line 3512 "Zend/zend_ini_scanner.c"
+#line 3513 "Zend/zend_ini_scanner.c"
 yy239:
 		YYDEBUG(239, *YYCURSOR);
 		yyaccept = 4;
@@ -3823,11 +3824,11 @@ yy248:
 yy249:
 		YYDEBUG(249, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 479 "Zend/zend_ini_scanner.l"
+#line 480 "Zend/zend_ini_scanner.l"
 		{
 	RETURN_TOKEN(NULL_NULL, "", 0);
 }
-#line 3831 "Zend/zend_ini_scanner.c"
+#line 3832 "Zend/zend_ini_scanner.c"
 yy250:
 		YYDEBUG(250, *YYCURSOR);
 		++YYCURSOR;
@@ -3894,7 +3895,7 @@ yy254:
 		}
 		YYDEBUG(256, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 456 "Zend/zend_ini_scanner.l"
+#line 457 "Zend/zend_ini_scanner.l"
 		{ /* Variable name */
 	/* Eat leading whitespace */
 	EAT_LEADING_WHITESPACE();
@@ -3904,30 +3905,30 @@ yy254:
 
 	RETURN_TOKEN(TC_VARNAME, yytext, yyleng);
 }
-#line 3908 "Zend/zend_ini_scanner.c"
+#line 3909 "Zend/zend_ini_scanner.c"
 yy257:
 		YYDEBUG(257, *YYCURSOR);
 		++YYCURSOR;
 		YYDEBUG(258, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 657 "Zend/zend_ini_scanner.l"
+#line 658 "Zend/zend_ini_scanner.l"
 		{
 	return 0;
 }
-#line 3918 "Zend/zend_ini_scanner.c"
+#line 3919 "Zend/zend_ini_scanner.c"
 yy259:
 		YYDEBUG(259, *YYCURSOR);
 		++YYCURSOR;
 		YYDEBUG(260, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 466 "Zend/zend_ini_scanner.l"
+#line 467 "Zend/zend_ini_scanner.l"
 		{ /* Variable end */
 	yy_pop_state();
 	return '}';
 }
-#line 3929 "Zend/zend_ini_scanner.c"
+#line 3930 "Zend/zend_ini_scanner.c"
 	}
 }
-#line 661 "Zend/zend_ini_scanner.l"
+#line 662 "Zend/zend_ini_scanner.l"
 
 }

Zend/zend_ini_scanner.l

@@ -142,13 +142,14 @@ ZEND_API zend_ini_scanner_globals ini_scanner_globals;
 	ZVAL_NEW_STR(retval, zend_string_init(str, len, ZEND_SYSTEM_INI))
 
 
-#define RETURN_TOKEN(type, str, len) {                       \
-	if (SCNG(scanner_mode) == ZEND_INI_SCANNER_TYPED) {      \
-		zend_ini_copy_typed_value(ini_lval, type, str, len); \
-	} else {                                                 \
-		zend_ini_copy_value(ini_lval, str, len);             \
-	}                                                        \
-	return type;                                             \
+#define RETURN_TOKEN(type, str, len) {                             \
+	if (SCNG(scanner_mode) == ZEND_INI_SCANNER_TYPED &&            \
+		(YYSTATE == STATE(ST_VALUE) || YYSTATE == STATE(ST_RAW))) {\
+		zend_ini_copy_typed_value(ini_lval, type, str, len);       \
+	} else {                                                       \
+		zend_ini_copy_value(ini_lval, str, len);                   \
+	}                                                              \
+	return type;                                                   \
 }
 
 static inline int convert_to_number(zval *retval, const char *str, const int str_len)

Zend/zend_signal.c

@@ -399,7 +399,7 @@ void zend_signal_init(void) /* {{{ */
 
 /* {{{ zend_signal_startup
  * alloc zend signal globals */
-void zend_signal_startup(void)
+ZEND_API void zend_signal_startup(void)
 {
 
 #ifdef ZTS

Zend/zend_signal.h

@@ -89,7 +89,7 @@ ZEND_API void zend_signal_handler_unblock(void);
 void zend_signal_activate(void);
 void zend_signal_deactivate(void);
 BEGIN_EXTERN_C()
-void zend_signal_startup(void);
+ZEND_API void zend_signal_startup(void);
 END_EXTERN_C()
 void zend_signal_init(void);
 

Zend/zend_vm_gen.php

@@ -903,7 +903,7 @@ function gen_code($f, $spec, $kind, $export, $code, $op1, $op2, $name, $extra_sp
 	}
 
 	/* Remove unused free_op1 and free_op2 declarations */
-	if ($spec && preg_match_all('/^\s*zend_free_op\s+[^;]+;\s*$/me', $code, $matches, PREG_SET_ORDER)) {
+	if ($spec && preg_match_all('/^\s*zend_free_op\s+[^;]+;\s*$/m', $code, $matches, PREG_SET_ORDER)) {
 		$n = 0;
 		foreach ($matches as $match) {
 		  $code = preg_replace('/'.preg_quote($match[0],'/').'/', "\$D$n", $code);
@@ -2383,6 +2383,7 @@ function gen_vm($def, $skel) {
 
 	// Generate specialized executor
 	gen_executor($f, $skl, ZEND_VM_SPEC, ZEND_VM_KIND, "execute", "zend_init_opcodes_handlers");
+	out($f, "\n");
 
 	// Generate zend_vm_get_opcode_handler() function
 	out($f, "static const void *zend_vm_get_opcode_handler_ex(uint32_t spec, const zend_op* op)\n");

acinclude.m4

@@ -2201,45 +2201,79 @@ AC_DEFUN([PHP_SETUP_ICU],[
     PHP_ICU_DIR=DEFAULT
   fi
 
-  if test "$PHP_ICU_DIR" = "DEFAULT"; then
-    dnl Try to find icu-config
-    AC_PATH_PROG(ICU_CONFIG, icu-config, no, [$PATH:/usr/local/bin])
-  else
-    ICU_CONFIG="$PHP_ICU_DIR/bin/icu-config"
+  AC_MSG_CHECKING([for location of ICU headers and libraries])
+  found_icu=no
+
+  dnl First try to find pkg-config
+  if test -z "$PKG_CONFIG"; then
+    AC_PATH_PROG(PKG_CONFIG, pkg-config, no)
   fi
 
-  AC_MSG_CHECKING([for location of ICU headers and libraries])
+  dnl If pkg-config is found try using it
+  if test "$PHP_ICU_DIR" = "DEFAULT" && test -x "$PKG_CONFIG" && $PKG_CONFIG --exists icu-uc icu-io icu-i18n; then
+    if $PKG_CONFIG --atleast-version=40 icu-uc; then
+      found_icu=yes
+      icu_version_full=`$PKG_CONFIG --modversion icu-uc`
+      ac_IFS=$IFS
+      IFS="."
+      set $icu_version_full
+      IFS=$ac_IFS
+      icu_version=`expr [$]1 \* 1000 + [$]2`
+      AC_MSG_RESULT([found $icu_version_full])
 
-  dnl Trust icu-config to know better what the install prefix is..
-  icu_install_prefix=`$ICU_CONFIG --prefix 2> /dev/null`
-  if test "$?" != "0" || test -z "$icu_install_prefix"; then
-    AC_MSG_RESULT([not found])
-    AC_MSG_ERROR([Unable to detect ICU prefix or $ICU_CONFIG failed. Please verify ICU install prefix and make sure icu-config works.])
-  else
-    AC_MSG_RESULT([$icu_install_prefix])
+      ICU_LIBS=`$PKG_CONFIG --libs icu-uc icu-io icu-i18n`
+      ICU_INCS=`$PKG_CONFIG --cflags-only-I icu-uc icu-io icu-i18n`
+      ICU_CXXFLAGS="-DU_USING_ICU_NAMESPACE=1"
 
-    dnl Check ICU version
-    AC_MSG_CHECKING([for ICU 4.0 or greater])
-    icu_version_full=`$ICU_CONFIG --version`
-    ac_IFS=$IFS
-    IFS="."
-    set $icu_version_full
-    IFS=$ac_IFS
-    icu_version=`expr [$]1 \* 1000 + [$]2`
-    AC_MSG_RESULT([found $icu_version_full])
+      AC_MSG_RESULT([found $ICU_VERSION])
 
-    if test "$icu_version" -lt "4000"; then
-      AC_MSG_ERROR([ICU version 4.0 or later is required])
+      PHP_EVAL_LIBLINE($ICU_LIBS, $1)
+      PHP_EVAL_INCLINE($ICU_INCS)
+    else
+      AC_MSG_ERROR([ICU version 4.0 or later required.])
+    fi
+  fi
+
+  dnl If pkg-config fails for some reason, revert to the old method
+  if test "$found_icu" = "no"; then
+    if test "$PHP_ICU_DIR" = "DEFAULT"; then
+      dnl Try to find icu-config
+      AC_PATH_PROG(ICU_CONFIG, icu-config, no, [$PATH:/usr/local/bin])
+    else
+      ICU_CONFIG="$PHP_ICU_DIR/bin/icu-config"
     fi
 
-    ICU_VERSION=$icu_version
-    ICU_INCS=`$ICU_CONFIG --cppflags-searchpath`
-    ICU_LIBS=`$ICU_CONFIG --ldflags --ldflags-icuio`
-    PHP_EVAL_INCLINE($ICU_INCS)
-    PHP_EVAL_LIBLINE($ICU_LIBS, $1)
+    dnl Trust icu-config to know better what the install prefix is..
+    icu_install_prefix=`$ICU_CONFIG --prefix 2> /dev/null`
+    if test "$?" != "0" || test -z "$icu_install_prefix"; then
+      AC_MSG_RESULT([not found])
+      AC_MSG_ERROR([Unable to detect ICU prefix or $ICU_CONFIG failed. Please verify ICU install prefix and make sure icu-config works.])
+    else
+      AC_MSG_RESULT([$icu_install_prefix])
 
-    ICU_CXXFLAGS=`$ICU_CONFIG --cxxflags`
-    ICU_CXXFLAGS="$ICU_CXXFLAGS -DU_USING_ICU_NAMESPACE=1"
+      dnl Check ICU version
+      AC_MSG_CHECKING([for ICU 4.0 or greater])
+      icu_version_full=`$ICU_CONFIG --version`
+      ac_IFS=$IFS
+      IFS="."
+      set $icu_version_full
+      IFS=$ac_IFS
+      icu_version=`expr [$]1 \* 1000 + [$]2`
+      AC_MSG_RESULT([found $icu_version_full])
+
+      if test "$icu_version" -lt "4000"; then
+        AC_MSG_ERROR([ICU version 4.0 or later is required])
+      fi
+
+      ICU_VERSION=$icu_version
+      ICU_INCS=`$ICU_CONFIG --cppflags-searchpath`
+      ICU_LIBS=`$ICU_CONFIG --ldflags --ldflags-icuio`
+      PHP_EVAL_INCLINE($ICU_INCS)
+      PHP_EVAL_LIBLINE($ICU_LIBS, $1)
+
+      ICU_CXXFLAGS=`$ICU_CONFIG --cxxflags`
+      ICU_CXXFLAGS="$ICU_CXXFLAGS -DU_USING_ICU_NAMESPACE=1"
+    fi
   fi
 ])
 

configure.ac

@@ -107,8 +107,8 @@ int zend_sprintf(char *buffer, const char *format, ...);
 
 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=2
-PHP_RELEASE_VERSION=13
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=16
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
 

ext/com_dotnet/com_extension.c

@@ -30,6 +30,7 @@
 #include "php_com_dotnet.h"
 #include "php_com_dotnet_internal.h"
 #include "Zend/zend_exceptions.h"
+#include "Zend/zend_interfaces.h"
 
 ZEND_DECLARE_MODULE_GLOBALS(com_dotnet)
 static PHP_GINIT_FUNCTION(com_dotnet);
@@ -354,6 +355,8 @@ PHP_MINIT_FUNCTION(com_dotnet)
 {
 	zend_class_entry ce, *tmp;
 
+	zend_hash_init(&com_dotnet_object_properties, 0, NULL, NULL, 0);
+
 	php_com_wrapper_minit(INIT_FUNC_ARGS_PASSTHRU);
 	php_com_persist_minit(INIT_FUNC_ARGS_PASSTHRU);
 
@@ -372,11 +375,15 @@ PHP_MINIT_FUNCTION(com_dotnet)
 	ce.create_object = php_com_object_new;
 	php_com_variant_class_entry = zend_register_internal_class(&ce);
 	php_com_variant_class_entry->get_iterator = php_com_iter_get;
+	php_com_variant_class_entry->serialize = zend_class_serialize_deny;
+	php_com_variant_class_entry->unserialize = zend_class_unserialize_deny;
 
 	INIT_CLASS_ENTRY(ce, "com", NULL);
 	ce.create_object = php_com_object_new;
 	tmp = zend_register_internal_class_ex(&ce, php_com_variant_class_entry);
 	tmp->get_iterator = php_com_iter_get;
+	tmp->serialize = zend_class_serialize_deny;
+	tmp->unserialize = zend_class_unserialize_deny;
 
 	zend_ts_hash_init(&php_com_typelibraries, 0, NULL, php_com_typelibrary_dtor, 1);
 
@@ -385,6 +392,8 @@ PHP_MINIT_FUNCTION(com_dotnet)
 	ce.create_object = php_com_object_new;
 	tmp = zend_register_internal_class_ex(&ce, php_com_variant_class_entry);
 	tmp->get_iterator = php_com_iter_get;
+	tmp->serialize = zend_class_serialize_deny;
+	tmp->unserialize = zend_class_unserialize_deny;
 #endif
 
 	REGISTER_INI_ENTRIES();

ext/com_dotnet/com_handlers.c

@@ -29,6 +29,8 @@
 #include "php_com_dotnet_internal.h"
 #include "Zend/zend_exceptions.h"
 
+const HashTable com_dotnet_object_properties;
+
 static zval *com_property_read(zval *object, zval *member, int type, void **cahce_slot, zval *rv)
 {
 	php_com_dotnet_object *obj;
@@ -231,7 +233,7 @@ static HashTable *com_properties_get(zval *object)
 	 * infinite recursion when the hash is displayed via var_dump().
 	 * Perhaps it is best to leave it un-implemented.
 	 */
-	return NULL;
+	return &com_dotnet_object_properties;
 }
 
 static void function_dtor(zval *zv)

ext/com_dotnet/com_typeinfo.c

@@ -197,9 +197,10 @@ PHP_COM_DOTNET_API int php_com_import_typelib(ITypeLib *TL, int mode, int codepa
 				SysFreeString(bstr_ids);
 
 				/* sanity check for the case where the constant is already defined */
+				php_com_zval_from_variant(&value, pVarDesc->lpvarValue, codepage);
 				if ((exists = zend_get_constant(c.name)) != NULL) {
-					if (COMG(autoreg_verbose) && !compare_function(&results, &c.value, exists)) {
-						php_error_docref(NULL, E_WARNING, "Type library constant %s is already defined", c.name);
+					if (COMG(autoreg_verbose) && !compare_function(&results, &value, exists)) {
+						php_error_docref(NULL, E_WARNING, "Type library constant %s is already defined", ZSTR_VAL(c.name));
 					}
 					zend_string_release(c.name);
 					ITypeInfo_ReleaseVarDesc(TypeInfo, pVarDesc);
@@ -207,7 +208,6 @@ PHP_COM_DOTNET_API int php_com_import_typelib(ITypeLib *TL, int mode, int codepa
 				}
 
 				/* register the constant */
-				php_com_zval_from_variant(&value, pVarDesc->lpvarValue, codepage);
 				if (Z_TYPE(value) == IS_LONG) {
 					c.flags = mode;
 					ZVAL_LONG(&c.value, Z_LVAL(value));

ext/com_dotnet/php_com_dotnet_internal.h

@@ -31,6 +31,8 @@
 
 #include "zend_ts_hash.h"
 
+extern const HashTable com_dotnet_object_properties;
+
 typedef struct _php_com_dotnet_object {
 	zend_object zo;
 

ext/com_dotnet/tests/bug77177.phpt

@@ -0,0 +1,57 @@
+--TEST--
+Bug #77177 (Serializing or unserializing COM objects crashes)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+?>
+--FILE--
+<?php
+$com = new COM("WScript.Shell");
+$dotnet = new DOTNET("mscorlib", "System.Collections.Stack");
+$variant = new VARIANT;
+foreach ([$com, $dotnet, $variant] as $object) {
+    try {
+        serialize($object);
+    } catch (Exception $ex) {
+        echo "Exception: {$ex->getMessage()}\n";
+    }
+}
+
+$strings = ['C:3:"com":0:{}', 'C:6:"dotnet":0:{}', 'C:7:"variant":0:{}'];
+foreach ($strings as $string) {
+    try {
+        unserialize($string);
+    } catch (Exception $ex) {
+        echo "Exception: {$ex->getMessage()}\n";
+    }
+}
+
+$strings = ['O:3:"com":0:{}', 'O:6:"dotnet":0:{}', 'O:7:"variant":0:{}'];
+foreach ($strings as $string) {
+    var_dump(unserialize($string));
+}
+?>
+===DONE===
+--EXPECTF--
+Exception: Serialization of 'com' is not allowed
+Exception: Serialization of 'dotnet' is not allowed
+Exception: Serialization of 'variant' is not allowed
+Exception: Unserialization of 'com' is not allowed
+Exception: Unserialization of 'dotnet' is not allowed
+Exception: Unserialization of 'variant' is not allowed
+
+Warning: Erroneous data format for unserializing 'com' in %s on line %d
+
+Notice: unserialize(): Error at offset 13 of 14 bytes in %s on line %d
+bool(false)
+
+Warning: Erroneous data format for unserializing 'dotnet' in %s on line %d
+
+Notice: unserialize(): Error at offset 16 of 17 bytes in %s on line %d
+bool(false)
+
+Warning: Erroneous data format for unserializing 'variant' in %s on line %d
+
+Notice: unserialize(): Error at offset 17 of 18 bytes in %s on line %d
+bool(false)
+===DONE===

ext/com_dotnet/tests/bug77621.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug #77621 (Already defined constants are not properly reported)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+?>
+--INI--
+com.autoregister_verbose=1
+--FILE--
+<?php
+define('ADSTYPE_INVALID', 0);
+$root = dirname(array_change_key_case($_SERVER, CASE_UPPER)['COMSPEC']);
+com_load_typelib("$root\activeds.tlb");
+?>
+===DONE===
+--EXPECTF--
+Warning: com_load_typelib(): Type library constant ADSTYPE_INVALID is already defined in %s on line %d
+===DONE===

ext/curl/multi.c

@@ -509,6 +509,7 @@ static int _php_server_push_callback(CURL *parent_ch, CURL *easy, size_t num_hea
 	Z_ADDREF_P(pz_parent_ch);
 
 	res = zend_register_resource(ch, le_curl);
+	ch->res = res;
 	ZVAL_RES(&pz_ch, res);
 
 	size_t i;

ext/curl/tests/bug76675.phpt

@@ -0,0 +1,53 @@
+--TEST--
+Bug #76675 (Segfault with H2 server push write/writeheader handlers)
+--SKIPIF--
+<?php
+include 'skipif.inc';
+if (getenv("SKIP_ONLINE_TESTS")) {
+	die("skip online test");
+}
+$curl_version = curl_version();
+if ($curl_version['version_number'] < 0x073d00) {
+	exit("skip: test may crash with curl < 7.61.0");
+}
+?>
+--FILE--
+<?php
+$transfers = 1;
+$callback = function($parent, $passed) use (&$transfers) {
+    curl_setopt($passed, CURLOPT_WRITEFUNCTION, function ($ch, $data) {
+        echo "Received ".strlen($data);
+        return strlen($data);
+    });
+	$transfers++;
+	return CURL_PUSH_OK;
+};
+$mh = curl_multi_init();
+curl_multi_setopt($mh, CURLMOPT_PIPELINING, CURLPIPE_MULTIPLEX);
+curl_multi_setopt($mh, CURLMOPT_PUSHFUNCTION, $callback);
+$ch = curl_init();
+curl_setopt($ch, CURLOPT_URL, 'https://http2.golang.org/serverpush');
+curl_setopt($ch, CURLOPT_HTTP_VERSION, 3);
+curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
+curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
+curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
+curl_multi_add_handle($mh, $ch);
+$active = null;
+do {
+    $status = curl_multi_exec($mh, $active);
+    do {
+        $info = curl_multi_info_read($mh);
+        if (false !== $info && $info['msg'] == CURLMSG_DONE) {
+            $handle = $info['handle'];
+            if ($handle !== null) {
+                $transfers--;
+                curl_multi_remove_handle($mh, $handle);
+                curl_close($handle);
+            }
+        }
+    } while ($info);
+} while ($transfers);
+curl_multi_close($mh);
+?>
+--EXPECTREGEX--
+(Received \d+)+

ext/curl/tests/check_win_config.phpt

@@ -45,7 +45,7 @@ GSSAPI => No
 KERBEROS5 => Yes
 UNIX_SOCKETS => No
 PSL => No
-Protocols => dict, file, ftp, ftps, gopher, http, https, imap, imaps, ldap, pop3, pop3s, rtsp, scp, sftp, smb, smbs, smtp, smtps, telnet, tftp
+Protocols => dict, file, ftp, ftps, gopher, http, https, imap, imaps, ldap, ldaps, pop3, pop3s, rtsp, scp, sftp, smb, smbs, smtp, smtps, telnet, tftp
 Host => %s-pc-win32
 SSL Version => OpenSSL/%s
 ZLib Version => %s

ext/curl/tests/curl_basic_009.phpt

@@ -18,6 +18,6 @@ curl_close($ch);
 
 
 ?>
---EXPECTF--
-string(%d) "%Srotocol%s"
-int(1)
+--EXPECTREGEX--
+string\(\d+\) "([^\r\n]*rotocol[^\r\n]+|Could not resolve host: .+)"
+int\(\d\)

ext/date/config0.m4

@@ -1,8 +1,14 @@
 dnl $Id$
 dnl config.m4 for date extension
 
-sinclude(ext/date/lib/timelib.m4)
-sinclude(lib/timelib.m4)
+dnl Check for headers needed by timelib
+AC_CHECK_HEADERS([ \
+strings.h \
+io.h
+])
+
+dnl Check for strtoll, atoll
+AC_CHECK_FUNCS(strtoll atoll)
 
 PHP_DATE_CFLAGS="-I@ext_builddir@/lib -DZEND_ENABLE_STATIC_TSRMLS_CACHE=1 -DHAVE_TIMELIB_CONFIG_H=1"
 timelib_sources="lib/astro.c lib/dow.c lib/parse_date.c lib/parse_tz.c

ext/date/lib/interval.c

@@ -35,7 +35,10 @@ timelib_rel_time *timelib_diff(timelib_time *one, timelib_time *two)
 
 	rt = timelib_rel_time_ctor();
 	rt->invert = 0;
-	if (one->sse > two->sse) {
+	if (
+		(one->sse > two->sse) ||
+		(one->sse == two->sse && one->us > two->us)
+	) {
 		swp = two;
 		two = one;
 		one = swp;

ext/date/lib/timelib.h

@@ -310,9 +310,9 @@ typedef struct _timelib_tzdb {
 # define timelib_free    free
 #endif
 
-#define TIMELIB_VERSION 201708
-#define TIMELIB_EXTENDED_VERSION 20170800
-#define TIMELIB_ASCII_VERSION "2017.08"
+#define TIMELIB_VERSION 201709
+#define TIMELIB_EXTENDED_VERSION 20170900
+#define TIMELIB_ASCII_VERSION "2017.09"
 
 #define TIMELIB_NONE             0x00
 #define TIMELIB_OVERRIDE_TIME    0x01

ext/date/lib/timelib.m4

@@ -1,83 +0,0 @@
-dnl
-dnl $Id$
-dnl
-dnl
-dnl TL_DEF_HAVE(what [, why])
-dnl
-dnl Generates 'AC_DEFINE(HAVE_WHAT, 1, [WHY])'
-dnl
-AC_DEFUN([TL_DEF_HAVE],[AC_DEFINE([HAVE_]translit($1,a-z_.-,A-Z___),1,[ $2 ])])dnl
-
-dnl
-dnl TL_CHECK_INT_TYPE(type)
-dnl
-AC_DEFUN([TL_CHECK_INT_TYPE],[
-AC_CACHE_CHECK([for $1], ac_cv_int_type_$1, [
-AC_TRY_COMPILE([
-#if HAVE_SYS_TYPES_H
-# include <sys/types.h>
-#endif
-#if HAVE_INTTYPES_H
-# include <inttypes.h>
-#elif HAVE_STDINT_H   
-# include <stdint.h>  
-#endif],
-[if (($1 *) 0)
-  return 0;   
-if (sizeof ($1))
-  return 0;
-], [ac_cv_int_type_$1=yes], [ac_cv_int_type_$1=no])
-])
-if test "$ac_cv_int_type_$1" = "yes"; then
-  TL_DEF_HAVE($1, [Define if $1 type is present.])
-fi
-])dnl
-
-dnl
-dnl AC_TIMELIB_C_BIGENDIAN
-dnl Replacement macro for AC_C_BIGENDIAN
-dnl
-AC_DEFUN([AC_TIMELIB_C_BIGENDIAN],
-[AC_CACHE_CHECK([whether byte ordering is bigendian], ac_cv_c_bigendian_php,
- [
-  ac_cv_c_bigendian_php=unknown
-  AC_TRY_RUN(
-  [
-int main(void)
-{
-        short one = 1;
-        char *cp = (char *)&one;
-
-        if (*cp == 0) {
-                return(0);
-        } else {
-                return(1);
-        }
-} 
-  ], [ac_cv_c_bigendian_php=yes], [ac_cv_c_bigendian_php=no], [ac_cv_c_bigendian_php=unknown])
- ])
- if test $ac_cv_c_bigendian_php = yes; then
-   AC_DEFINE(WORDS_BIGENDIAN, [], [Define if processor uses big-endian word])
- fi
-])dnl
-
-dnl Check for types, sizes, etc. needed by timelib
-AC_CHECK_SIZEOF(long, 8)
-AC_CHECK_SIZEOF(int, 4)
-TL_CHECK_INT_TYPE(int32_t)
-TL_CHECK_INT_TYPE(uint32_t)
-
-dnl Check for headers needed by timelib
-AC_CHECK_HEADERS([ \
-sys/time.h \
-sys/types.h \
-stdint.h \
-dirent.h \
-string.h \
-strings.h \
-unistd.h \
-io.h
-])
-
-dnl Check for strtoll, atoll
-AC_CHECK_FUNCS(strtoll atoll strftime gettimeofday)

ext/date/php_date.c

@@ -5278,7 +5278,6 @@ PHP_METHOD(DatePeriod, __wakeup)
 /* {{{ date_period_read_property */
 static zval *date_period_read_property(zval *object, zval *member, int type, void **cache_slot, zval *rv)
 {
-	zval *zv;
 	if (type != BP_VAR_IS && type != BP_VAR_R) {
 		zend_throw_error(NULL, "Retrieval of DatePeriod properties for modification is unsupported");
 		return &EG(uninitialized_zval);
@@ -5286,13 +5285,7 @@ static zval *date_period_read_property(zval *object, zval *member, int type, voi
 
 	Z_OBJPROP_P(object); /* build properties hash table */
 
-	zv = std_object_handlers.read_property(object, member, type, cache_slot, rv);
-	if (Z_TYPE_P(zv) == IS_OBJECT && Z_OBJ_HANDLER_P(zv, clone_obj)) {
-		/* defensive copy */
-		ZVAL_OBJ(zv, Z_OBJ_HANDLER_P(zv, clone_obj)(zv));
-	}
-
-	return zv;
+	return std_object_handlers.read_property(object, member, type, cache_slot, rv);
 }
 /* }}} */
 

ext/date/tests/bug33414-1.phpt

@@ -95,11 +95,11 @@ print "wanted=Friday            00:00:00\n\n";
 
 print "TZ=Pacific/Kwajalein - wrong day.\n";
 date_default_timezone_set("Pacific/Kwajalein");
-$tStamp = mktime (17, 17, 17, 1, 8626, 1970);
+$tStamp = mktime (17, 17, 17, 1, 8627, 1970);
 print "tStamp=". date("l Y-m-d H:i:s T I", $tStamp). "\n";
-$strtotime_tstamp = strtotime("next Friday", $tStamp);
+$strtotime_tstamp = strtotime("next Saturday", $tStamp);
 print "result=".date("l Y-m-d H:i:s T I", $strtotime_tstamp)."\n";
-print "wanted=Friday            00:00:00\n\n";
+print "wanted=Sunday            00:00:00\n\n";
 
 print "TZ=Asia/Ulan_Bator - wrong day.\n";
 date_default_timezone_set("Asia/Ulan_Bator");
@@ -256,9 +256,9 @@ result=Friday 2003-04-04 00:00:00 EEST 1
 wanted=Friday            00:00:00
 
 TZ=Pacific/Kwajalein - wrong day.
-tStamp=Friday 1993-08-13 17:17:17 -12 0
-result=Saturday 1993-08-21 00:00:00 +12 0
-wanted=Friday            00:00:00
+tStamp=Saturday 1993-08-14 17:17:17 -12 0
+result=Sunday 1993-08-22 00:00:00 +12 0
+wanted=Sunday            00:00:00
 
 TZ=Asia/Ulan_Bator - wrong day.
 tStamp=Saturday 2001-09-22 17:17:17 +09 1

ext/date/tests/bug33415-2.phpt

@@ -132,11 +132,11 @@ print "wanted=Wednesday            00:15:00\n\n";
 
 print "TZ=Pacific/Nauru - Is it OK for this to be 0:30? yes\n";
 date_default_timezone_set('Pacific/Nauru');
-$tStamp = mktime (17, 17, 17, 1, 3401, 1970);
+$tStamp = mktime (17, 17, 17, 2, 3, 1979);
 print "tStamp=". date("l Y-m-d H:i:s T I", $tStamp). "\n";
-$strtotime_tstamp = strtotime("next Tuesday", $tStamp);
+$strtotime_tstamp = strtotime("next Saturday +2 hours", $tStamp);
 print "result=".date("l Y-m-d H:i:s T I", $strtotime_tstamp)."\n";
-print "wanted=Tuesday            00:30:00\n\n";
+print "wanted=Saturday            02:30:00\n\n";
 
 print "TZ=Pacific/Niue - Is it OK for this to be 0:30 AM? yes\n";
 date_default_timezone_set('Pacific/Niue');
@@ -292,9 +292,9 @@ result=Wednesday 1986-01-01 00:15:00 +0545 0
 wanted=Wednesday            00:15:00
 
 TZ=Pacific/Nauru - Is it OK for this to be 0:30? yes
-tStamp=Tuesday 1979-04-24 17:17:17 +1130 0
-result=Tuesday 1979-05-01 00:30:00 +12 0
-wanted=Tuesday            00:30:00
+tStamp=Saturday 1979-02-03 17:17:17 +1130 0
+result=Saturday 1979-02-10 02:30:00 +12 0
+wanted=Saturday            02:30:00
 
 TZ=Pacific/Niue - Is it OK for this to be 0:30 AM? yes
 tStamp=Sunday 1978-09-24 17:17:17 -1130 0

ext/date/tests/bug77097.phpt

@@ -0,0 +1,33 @@
+--TEST--
+Bug #77097 (DateTime::diff gives wrong diff when the actual diff is less than 1 second)
+--FILE--
+<?php
+$now = new DateTime('2018-11-03 11:34:20.781751');
+$ago = new DateTime('2018-11-03 11:34:20.000000');
+
+$diff = $now->diff($ago);
+var_dump($diff->invert, $diff->s, $diff->f);
+
+$diff = $ago->diff($now);
+var_dump($diff->invert, $diff->s, $diff->f);
+
+$diff = $now->diff($ago, true);
+var_dump($diff->invert, $diff->s, $diff->f);
+
+$diff = $ago->diff($now, true);
+var_dump($diff->invert, $diff->s, $diff->f);
+?>
+--EXPECTF--
+int(1)
+int(0)
+float(0.781751)
+int(0)
+int(0)
+float(0.781751)
+int(0)
+int(0)
+float(0.781751)
+int(0)
+int(0)
+float(0.781751)
+

ext/date/tests/date_modify-1.phpt

@@ -5,7 +5,7 @@ date_modify() function [1]
 --FILE--
 <?php
 date_default_timezone_set("Pacific/Kwajalein");
-$ts = date_create("Thu Aug 19 1993 23:59:59");
+$ts = date_create("Fri Aug 20 1993 23:59:59");
 echo date_format($ts, 'D, d M Y H:i:s T'), "\n";
 $ts->modify("+1 second");
 echo date_format($ts, 'D, d M Y H:i:s T'), "\n";
@@ -22,8 +22,8 @@ $ts->modify("+ 1 hour 1 second");
 echo date_format($ts, 'D, d M Y H:i:s T'), "\n";
 ?>
 --EXPECT--
-Thu, 19 Aug 1993 23:59:59 -12
-Sat, 21 Aug 1993 00:00:00 +12
+Fri, 20 Aug 1993 23:59:59 -12
+Sun, 22 Aug 1993 00:00:00 +12
 Sun, 27 Mar 2005 01:59:59 CET
 Sun, 27 Mar 2005 03:00:00 CEST
 Sun, 30 Oct 2005 01:59:59 CEST

ext/exif/exif.c

@@ -2440,7 +2440,7 @@ static void add_assoc_image_info(zval *value, int sub_array, image_info_type *im
 									break;
 
 								case TAG_FMT_URATIONAL:
-									snprintf(buffer, sizeof(buffer), "%i/%i", info_value->ur.num, info_value->ur.den);
+									snprintf(buffer, sizeof(buffer), "%u/%u", info_value->ur.num, info_value->ur.den);
 									if (l==1) {
 										add_assoc_string(&tmpi, name, buffer);
 									} else {
@@ -3152,7 +3152,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 		break;
 	}
 
-	if (maker_note->offset >= value_len) {
+	if (value_len < 2 || maker_note->offset >= value_len - 1) {
 		/* Do not go past the value end */
 		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "IFD data too short: 0x%04X offset 0x%04X", value_len, maker_note->offset);
 		return FALSE;
@@ -3207,6 +3207,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 #endif
 		default:
 		case MN_OFFSET_NORMAL:
+			data_len = value_len;
 			break;
 	}
 
@@ -3405,6 +3406,10 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				break;
 
 			case TAG_USERCOMMENT:
+				EFREE_IF(ImageInfo->UserComment);
+				ImageInfo->UserComment = NULL;
+				EFREE_IF(ImageInfo->UserCommentEncoding);
+				ImageInfo->UserCommentEncoding = NULL;
 				ImageInfo->UserCommentLength = exif_process_user_comment(ImageInfo, &(ImageInfo->UserComment), &(ImageInfo->UserCommentEncoding), value_ptr, byte_count);
 				break;
 
@@ -3926,7 +3931,7 @@ static int exif_scan_thumbnail(image_info_type *ImageInfo)
 			return FALSE;
 		marker = c;
 		length = php_jpg_get16(data+pos);
-		if (pos+length>=ImageInfo->Thumbnail.size) {
+		if (length > ImageInfo->Thumbnail.size || pos >= ImageInfo->Thumbnail.size - length) {
 			return FALSE;
 		}
 #ifdef EXIF_DEBUG
@@ -3947,6 +3952,10 @@ static int exif_scan_thumbnail(image_info_type *ImageInfo)
 			case M_SOF14:
 			case M_SOF15:
 				/* handle SOFn block */
+				if (length < 8 || ImageInfo->Thumbnail.size - 8 < pos) {
+					/* exif_process_SOFn needs 8 bytes */
+					return FALSE;
+				}
 				exif_process_SOFn(data+pos, marker, &sof_info);
 				ImageInfo->Thumbnail.height   = sof_info.height;
 				ImageInfo->Thumbnail.width    = sof_info.width;
@@ -3984,10 +3993,10 @@ static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offse
 	tag_table_type tag_table = exif_get_tag_table(section_index);
 
 	if (ImageInfo->ifd_nesting_level > MAX_IFD_NESTING_LEVEL) {
-                return FALSE;
-        }
+		return FALSE;
+	}
 
-	if (ImageInfo->FileSize >= dir_offset+2) {
+	if (ImageInfo->FileSize >= 2 && ImageInfo->FileSize - 2 >= dir_offset) {
 		sn = exif_file_sections_add(ImageInfo, M_PSEUDO, 2, NULL);
 #ifdef EXIF_DEBUG
 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read from TIFF: filesize(x%04X), IFD dir(x%04X + x%04X)", ImageInfo->FileSize, dir_offset, 2);
@@ -3995,8 +4004,8 @@ static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offse
 		php_stream_seek(ImageInfo->infile, dir_offset, SEEK_SET); /* we do not know the order of sections */
 		php_stream_read(ImageInfo->infile, (char*)ImageInfo->file.list[sn].data, 2);
 		num_entries = php_ifd_get16u(ImageInfo->file.list[sn].data, ImageInfo->motorola_intel);
-		dir_size = 2/*num dir entries*/ +12/*length of entry*/*num_entries +4/* offset to next ifd (points to thumbnail or NULL)*/;
-		if (ImageInfo->FileSize >= dir_offset+dir_size) {
+		dir_size = 2/*num dir entries*/ +12/*length of entry*/*(size_t)num_entries +4/* offset to next ifd (points to thumbnail or NULL)*/;
+		if (ImageInfo->FileSize >= dir_size && ImageInfo->FileSize - dir_size >= dir_offset) {
 #ifdef EXIF_DEBUG
 			exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read from TIFF: filesize(x%04X), IFD dir(x%04X + x%04X), IFD entries(%d)", ImageInfo->FileSize, dir_offset+2, dir_size-2, num_entries);
 #endif
@@ -4079,9 +4088,9 @@ static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offse
 					}
 				}
 			}
-			if (ImageInfo->FileSize >= dir_offset + ImageInfo->file.list[sn].size) {
+			if (ImageInfo->FileSize >= ImageInfo->file.list[sn].size && ImageInfo->FileSize - ImageInfo->file.list[sn].size >= dir_offset) {
 				if (ifd_size > dir_size) {
-					if (dir_offset + ifd_size > ImageInfo->FileSize) {
+					if (ImageInfo->FileSize < ifd_size || dir_offset > ImageInfo->FileSize - ifd_size) {
 						exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Error in TIFF: filesize(x%04X) less than size of IFD(x%04X + x%04X)", ImageInfo->FileSize, dir_offset, ifd_size);
 						return FALSE;
 					}
@@ -4678,7 +4687,9 @@ PHP_FUNCTION(exif_thumbnail)
 	ZVAL_STRINGL(return_value, ImageInfo.Thumbnail.data, ImageInfo.Thumbnail.size);
 	if (arg_c >= 3) {
 		if (!ImageInfo.Thumbnail.width || !ImageInfo.Thumbnail.height) {
-			exif_scan_thumbnail(&ImageInfo);
+			if (!exif_scan_thumbnail(&ImageInfo)) {
+				ImageInfo.Thumbnail.width = ImageInfo.Thumbnail.height = 0;
+			}
 		}
 		zval_dtor(z_width);
 		zval_dtor(z_height);

ext/exif/tests/bug77184/bug77184.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Bug #74428 (Unsigned rational numbers are written out as signed rationals)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--INI--
+output_handler=
+zlib.output_compression=0
+--FILE--
+<?php
+$infile = dirname(__FILE__).'/DJI_0245_tiny.JPG';
+$tags = exif_read_data($infile);
+echo $tags['GPSLatitude'][2], PHP_EOL;
+echo $tags['GPSLongitude'][2], PHP_EOL;
+?>
+===DONE===
+--EXPECTF--
+156691934/70000000
+2672193571/70000000
+===DONE===

ext/exif/tests/bug77540.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug 77540 (Invalid Read on exif_process_SOFn)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+$width = $height = 42;
+$s = exif_thumbnail(__DIR__."/bug77540.jpg", $width, $height);
+echo "Width ".$width."\n";
+echo "Height ".$height."\n";
+?>
+DONE
+--EXPECTF--
+Width 0
+Height 0
+DONE

ext/exif/tests/bug77563.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug 77563 (Uninitialized read in exif_process_IFD_in_MAKERNOTE)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+$s = exif_thumbnail(__DIR__."/bug77563.jpg");
+?>
+DONE
+--EXPECTF--
+Warning: exif_thumbnail(bug77563.jpg): IFD data too short: 0x0009 offset 0x0008 in %s%ebug77563.php on line %d
+
+Warning: exif_thumbnail(bug77563.jpg): File structure corrupted in %s%ebug77563.php on line %d
+
+Warning: exif_thumbnail(bug77563.jpg): Invalid JPEG file in %s%ebug77563.php on line %d
+DONE

ext/exif/tests/bug77564/bug77564.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug 77564 (Memory leak in exif_process_IFD_TAG)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+var_dump(exif_read_data(dirname(__FILE__) . '/bug77564.jpg'));
+?>
+DONE
+--EXPECTF--
+
+Warning: exif_read_data(bug77564.jpg): Illegal IFD offset in %sbug77564.php on line %d
+
+Warning: exif_read_data(bug77564.jpg): File structure corrupted in %sbug77564.php on line %d
+
+Warning: exif_read_data(bug77564.jpg): Invalid JPEG file in %sbug77564.php on line %d
+bool(false)
+DONE

ext/fileinfo/libmagic.patch

@@ -951,7 +951,7 @@ diff -u libmagic.orig/ascmagic.c libmagic/ascmagic.c
  }
 diff -u libmagic.orig/cdf.c libmagic/cdf.c
 --- libmagic.orig/cdf.c	2017-05-08 20:10:13.000000000 +0200
-+++ libmagic/cdf.c	2018-11-04 00:59:30.775724767 +0100
++++ libmagic/cdf.c	2018-11-07 19:06:50.045202539 +0100
 @@ -43,7 +43,17 @@
  #include <err.h>
  #endif
@@ -3205,7 +3205,7 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
  						*ec = '\0';
 diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 --- libmagic.orig/softmagic.c	2017-05-08 20:10:13.000000000 +0200
-+++ libmagic/softmagic.c	2018-11-05 20:23:12.586762678 +0100
++++ libmagic/softmagic.c	2018-11-10 13:08:23.811239067 +0100
 @@ -43,6 +43,10 @@
  #include <time.h>
  #include "der.h"
@@ -3267,7 +3267,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 -	if (rc) {
 -		file_regerror(&rx, rc, ms);
 +	(void)setlocale(LC_CTYPE, "C");
-+	pattern = zend_string_init("~%[-0-9.]*s~", sizeof("~%[-0-9.]*s~") - 1, 0);
++	pattern = zend_string_init("~%[-0-9\\.]*s~", sizeof("~%[-0-9\\.]*s~") - 1, 0);
 +	if ((pce = pcre_get_compiled_regex(pattern, &re_extra, &re_options)) == NULL) {
 +		rv = -1;
  	} else {
@@ -3303,21 +3303,16 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  private int32_t
  mprint(struct magic_set *ms, struct magic *m)
  {
-@@ -667,19 +657,18 @@
- 		t = ms->offset + sizeof(double);
-   		break;
- 
--	case FILE_SEARCH:
- 	case FILE_REGEX: {
+@@ -672,14 +662,10 @@
  		char *cp;
  		int rval;
  
 -		cp = strndup((const char *)ms->search.s, ms->search.rm_len);
+-		if (cp == NULL) {
+-			file_oomem(ms, ms->search.rm_len);
+-			return -1;
+-		}
 +		cp = estrndup((const char *)ms->search.s, ms->search.rm_len);
- 		if (cp == NULL) {
- 			file_oomem(ms, ms->search.rm_len);
- 			return -1;
- 		}
  		rval = file_printf(ms, F(ms, m, "%s"),
  		    file_printable(sbuf, sizeof(sbuf), cp));
 -		free(cp);
@@ -3325,23 +3320,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  
  		if (rval == -1)
  			return -1;
-@@ -691,6 +680,15 @@
- 		break;
- 	}
- 
-+	case FILE_SEARCH:
-+		if (file_printf(ms, F(ms, m, "%s"), m->value.s) == -1)
-+			return -1;
-+		if ((m->str_flags & REGEX_OFFSET_START))
-+			t = ms->search.offset;
-+		else
-+			t = ms->search.offset + m->vallen;
-+		break;
-+
- 	case FILE_DEFAULT:
- 	case FILE_CLEAR:
- 	  	if (file_printf(ms, "%s", m->desc) == -1)
-@@ -1373,9 +1371,6 @@
+@@ -1373,9 +1359,6 @@
  		    m->type, m->flag, offset, o, nbytes,
  		    *indir_count, *name_count);
  		mdebug(offset, (char *)(void *)p, sizeof(union VALUETYPE));
@@ -3351,7 +3330,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  	}
  
  	if (m->flag & INDIR) {
-@@ -1488,9 +1483,6 @@
+@@ -1488,9 +1471,6 @@
  		if ((ms->flags & MAGIC_DEBUG) != 0) {
  			mdebug(offset, (char *)(void *)p,
  			    sizeof(union VALUETYPE));
@@ -3361,7 +3340,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  		}
  	}
  
-@@ -1572,15 +1564,15 @@
+@@ -1572,15 +1552,15 @@
  		if (rv == 1) {
  			if ((ms->flags & MAGIC_NODESC) == 0 &&
  			    file_printf(ms, F(ms, m, "%u"), offset) == -1) {
@@ -3380,7 +3359,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  		return rv;
  
  	case FILE_USE:
-@@ -1703,6 +1695,41 @@
+@@ -1703,6 +1683,41 @@
  	return file_strncmp(a, b, len, flags);
  }
  
@@ -3422,7 +3401,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  private int
  magiccheck(struct magic_set *ms, struct magic *m)
  {
-@@ -1863,65 +1890,77 @@
+@@ -1863,65 +1878,77 @@
  		break;
  	}
  	case FILE_REGEX: {

ext/fileinfo/libmagic/softmagic.c

@@ -421,7 +421,7 @@ check_fmt(struct magic_set *ms, struct magic *m)
 		return 0;
 
 	(void)setlocale(LC_CTYPE, "C");
-	pattern = zend_string_init("~%[-0-9.]*s~", sizeof("~%[-0-9.]*s~") - 1, 0);
+	pattern = zend_string_init("~%[-0-9\\.]*s~", sizeof("~%[-0-9\\.]*s~") - 1, 0);
 	if ((pce = pcre_get_compiled_regex(pattern, &re_extra, &re_options)) == NULL) {
 		rv = -1;
 	} else {
@@ -657,15 +657,12 @@ mprint(struct magic_set *ms, struct magic *m)
 		t = ms->offset + sizeof(double);
   		break;
 
+	case FILE_SEARCH:
 	case FILE_REGEX: {
 		char *cp;
 		int rval;
 
 		cp = estrndup((const char *)ms->search.s, ms->search.rm_len);
-		if (cp == NULL) {
-			file_oomem(ms, ms->search.rm_len);
-			return -1;
-		}
 		rval = file_printf(ms, F(ms, m, "%s"),
 		    file_printable(sbuf, sizeof(sbuf), cp));
 		efree(cp);
@@ -680,15 +677,6 @@ mprint(struct magic_set *ms, struct magic *m)
 		break;
 	}
 
-	case FILE_SEARCH:
-		if (file_printf(ms, F(ms, m, "%s"), m->value.s) == -1)
-			return -1;
-		if ((m->str_flags & REGEX_OFFSET_START))
-			t = ms->search.offset;
-		else
-			t = ms->search.offset + m->vallen;
-		break;
-
 	case FILE_DEFAULT:
 	case FILE_CLEAR:
 	  	if (file_printf(ms, "%s", m->desc) == -1)

ext/fileinfo/magicdata.patch

@@ -1,65 +1,45 @@
-diff -u file-5.31.orig/magic/Magdir/cafebabe file-5.31/magic/Magdir/cafebabe
---- file-5.31.orig/magic/Magdir/cafebabe	2017-03-17 21:35:28.000000000 +0000
-+++ file-5.31/magic/Magdir/cafebabe	2017-10-11 14:30:57.476077825 +0000
-@@ -15,22 +15,6 @@
- # might add another one or two as time goes by...
- #
- ### JAVA START ###
--0	belong		0xcafebabe
-->4	belong		>30		compiled Java class data,
--!:mime	application/x-java-applet
-->>6	beshort		x	        version %d.
-->>4	beshort		x       	\b%d
--# Which is which?
--#>>4	belong		0x032d		(Java 1.0)
--#>>4	belong		0x032d		(Java 1.1)
-->>4	belong		0x002e		(Java 1.2)
-->>4	belong		0x002f		(Java 1.3)
-->>4	belong		0x0030		(Java 1.4)
-->>4	belong		0x0031		(Java 1.5)
-->>4	belong		0x0032		(Java 1.6)
-->>4	belong		0x0033		(Java 1.7)
-->>4	belong		0x0034		(Java 1.8)
--
- 0	belong		0xcafed00d	JAR compressed with pack200,
- >5	byte		x		version %d.
- >4	byte		x		\b%d
-@@ -52,15 +36,28 @@
+diff --git a/magic/Magdir/rpm b/magic/Magdir/rpm
+index 9a795f8..31db083 100644
+--- a/magic/Magdir/rpm
++++ b/magic/Magdir/rpm
+@@ -29,6 +29,7 @@
+ >>8	beshort		17		SuperH
+ >>8	beshort		18		Xtensa
+ >>8	beshort		255		noarch
++>>10	string		x		%s
  
- 0	belong		0xcafebabe
- >4	belong		1		Mach-O universal binary with 1 architecture:
--!:mime application/x-mach-binary
- >>8	use		mach-o		\b
-+0	belong		0xcafebabe
-+>4	belong		>30		compiled Java class data,
-+!:mime	application/x-java-applet
-+>>6	beshort		x	        version %d.
-+>>4	beshort		x       	\b%d
-+# Which is which?
-+#>>4	belong		0x032d		(Java 1.0)
-+#>>4	belong		0x032d		(Java 1.1)
-+>>4	belong		0x002e		(Java 1.2)
-+>>4	belong		0x002f		(Java 1.3)
-+>>4	belong		0x0030		(Java 1.4)
-+>>4	belong		0x0031		(Java 1.5)
-+>>4	belong		0x0032		(Java 1.6)
-+>>4	belong		0x0033		(Java 1.7)
-+>>4	belong		0x0034		(Java 1.8)
- >4	belong		>1
- >>4	belong		<20		Mach-O universal binary with %d architectures:
--!:mime application/x-mach-binary
- >>>8	use		mach-o		\b
-->>4	belong		2
-+>>4	belong		>2
- >>>28	use		mach-o		\b
-->>4	belong		3
-+>>4	belong		>3
- >>>48	use		mach-o		\b
- >>4	belong		4
- >>>68	use		mach-o		\b
-diff -u file-5.31.orig/magic/Magdir/commands file-5.31/magic/Magdir/commands
---- file-5.31.orig/magic/Magdir/commands	2017-04-04 20:34:24.000000000 +0000
-+++ file-5.31/magic/Magdir/commands	2017-10-11 14:29:57.653552987 +0000
+ #delta RPM    Daniel Novotny (dnovotny@redhat.com)
+ 0	string		drpm		Delta RPM
+diff --git a/magic/Magdir/securitycerts b/magic/Magdir/securitycerts
+index 8785dd8..1c340be 100644
+--- a/magic/Magdir/securitycerts
++++ b/magic/Magdir/securitycerts
+@@ -4,3 +4,5 @@
+ 0	search/1		-----BEGIN\ CERTIFICATE------	RFC1421 Security Certificate text
+ 0	search/1		-----BEGIN\ NEW\ CERTIFICATE	RFC1421 Security Certificate Signing Request text
+ 0	belong	0xedfeedfe	Sun 'jks' Java Keystore File data
++
++0	string \0volume_key	volume_key escrow packet
+From 898f5d27b66b5d5592cb56fa9da5b776628ea6ca Mon Sep 17 00:00:00 2001
+From: Christos Zoulas <christos@zoulas.com>
+Date: Wed, 31 May 2017 15:48:50 +0000
+Subject: [PATCH] Fix \s vs \w confusion.
+
+Upstream commit: https://github.com/file/file/commit/898f5d27b66b5d5592cb56fa9da5b776628ea6ca
+
+Fixes awk/perl script recognition 
+
+Signed-off-by: Marek Cermak <macermak@redhat.com>
+---
+ magic/Magdir/commands |  4 ++--
+ magic/Magdir/images   | 14 +++++++-------
+ magic/Magdir/python   |  4 ++--
+ 3 files changed, 11 insertions(+), 11 deletions(-)
+
+diff --git a/magic/Magdir/commands b/magic/Magdir/commands
+index 1a46efd8..f4326a9e 100644
+--- a/magic/Magdir/commands
++++ b/magic/Magdir/commands
 @@ -56,7 +56,7 @@
  !:mime	text/x-awk
  0	string/wt	#!\ /usr/bin/awk	awk script text executable
@@ -69,43 +49,10 @@ diff -u file-5.31.orig/magic/Magdir/commands file-5.31/magic/Magdir/commands
  
  # AT&T Bell Labs' Plan 9 shell
  0	string/wt	#!\ /bin/rc	Plan 9 rc shell script text executable
-diff -u file-5.31.orig/magic/Magdir/dump file-5.31/magic/Magdir/dump
---- file-5.31.orig/magic/Magdir/dump	2017-03-17 21:35:28.000000000 +0000
-+++ file-5.31/magic/Magdir/dump	2017-10-11 14:30:09.622057792 +0000
-@@ -69,6 +69,8 @@
- >0	use	old-dump-be
- 
- 24	lelong	60012		new-fs dump file (little endian),
-+# to correctly recognize '*.mo' GNU message catalog (little endian)
-+!:strength - 15
- >0	use	\^new-dump-be
- 
- 24	lelong	60011		old-fs dump file (little endian),
-diff -u file-5.31.orig/magic/Magdir/filesystems file-5.31/magic/Magdir/filesystems
---- file-5.31.orig/magic/Magdir/filesystems	2017-03-24 19:29:26.000000000 +0000
-+++ file-5.31/magic/Magdir/filesystems	2017-10-11 14:30:57.476077825 +0000
-@@ -254,7 +254,7 @@
- 30		search/481	\x55\xAA
- # to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111)
- # DOS BPB information (70) and after DOS floppy (120) like in previous file version
--!:strength +65
-+!:strength +0
- # for sector sizes < 512 Bytes
- >11		uleshort	<512
- >>(11.s-2)	uleshort	0xAA55		DOS/MBR boot sector
-@@ -266,7 +266,7 @@
- 0x1FE          leshort         0xAA55         	DOS/MBR boot sector
- #
- # to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version
--!:strength +65
-+!:strength +0
- >2		string		OSBS		OS/BS MBR
- # added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/
- # and http://en.wikipedia.org/wiki/Master_Boot_Record
-Only in file-5.31/magic/Magdir/: gconv
-diff -u file-5.31.orig/magic/Magdir/images file-5.31/magic/Magdir/images
---- file-5.31.orig/magic/Magdir/images	2017-04-04 20:34:24.000000000 +0000
-+++ file-5.31/magic/Magdir/images	2017-10-11 14:29:57.653552987 +0000
+diff --git a/magic/Magdir/images b/magic/Magdir/images
+index ce68e00d..d14c1de1 100644
+--- a/magic/Magdir/images
++++ b/magic/Magdir/images
 @@ -175,42 +175,42 @@
  >>>&0	regex		=[0-9]{1,50}			\b %s
  
@@ -155,9 +102,10 @@ diff -u file-5.31.orig/magic/Magdir/images file-5.31/magic/Magdir/images
  >>0	use		netpbm
  >>>0	string		x	\b, rawbits, pixmap
  !:strength + 45
-diff -u file-5.31.orig/magic/Magdir/python file-5.31/magic/Magdir/python
---- file-5.31.orig/magic/Magdir/python	2017-05-08 18:10:13.000000000 +0000
-+++ file-5.31/magic/Magdir/python	2017-10-11 14:29:57.653552987 +0000
+diff --git a/magic/Magdir/python b/magic/Magdir/python
+index 81d1cc39..d6c2220a 100644
+--- a/magic/Magdir/python
++++ b/magic/Magdir/python
 @@ -64,7 +64,7 @@
  # except: or finally:
  # block
@@ -167,120 +115,68 @@ diff -u file-5.31.orig/magic/Magdir/python file-5.31/magic/Magdir/python
  !:strength + 15
  !:mime text/x-python
  >&0	search/4096	finally:	Python script text executable
-diff -u file-5.31.orig/magic/Magdir/rpm file-5.31/magic/Magdir/rpm
---- file-5.31.orig/magic/Magdir/rpm	2017-03-17 21:34:26.000000000 +0000
-+++ file-5.31/magic/Magdir/rpm	2017-10-11 14:30:57.480078009 +0000
-@@ -29,6 +29,7 @@
- >>8	beshort		17		SuperH
- >>8	beshort		18		Xtensa
- >>8	beshort		255		noarch
-+>>10	string		x		%s
+-- 
+2.13.3
+
+From 2e5e9e16a4847b2e60cabc70e6b9bd7d633cb68a Mon Sep 17 00:00:00 2001
+From: Christos Zoulas <christos@zoulas.com>
+Date: Sat, 22 Jul 2017 17:21:24 +0000
+Subject: [PATCH] Strength decreased in magic file magic/Magdir/dump for new-fs
+ dump file (little endian) to correctly recognize '*.mo' GNU message catalog
+ (little endian).
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1226215
+
+Upstream commit: https://github.com/file/file/commit/2e5e9e16a4847b2e60cabc70e6b9bd7d633cb68a
+
+Signed-off-by: Marek Cermak <macermak@redhat.com>
+---
+ magic/Magdir/dump | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/magic/Magdir/dump b/magic/Magdir/dump
+index 64742b7a..c5711661 100644
+--- a/magic/Magdir/dump
++++ b/magic/Magdir/dump
+@@ -69,6 +69,8 @@
+ >0	use	old-dump-be
  
- #delta RPM    Daniel Novotny (dnovotny@redhat.com)
- 0	string		drpm		Delta RPM
-diff -u file-5.31.orig/magic/Magdir/ruby file-5.31/magic/Magdir/ruby
---- file-5.31.orig/magic/Magdir/ruby	2017-03-17 21:34:26.000000000 +0000
-+++ file-5.31/magic/Magdir/ruby	2017-10-11 14:30:24.410682267 +0000
-@@ -6,27 +6,46 @@
- # From: Reuben Thomas <rrt@sc3d.org>
+ 24	lelong	60012		new-fs dump file (little endian),
++# to correctly recognize '*.mo' GNU message catalog (little endian)
++!:strength - 15
+ >0	use	\^new-dump-be
  
- # Ruby scripts
--0	search/1/w	#!\ /usr/bin/ruby	Ruby script text executable
-+0	search/1/w	#!\ /usr/bin/ruby				Ruby script text executable
- !:strength + 15
- !:mime text/x-ruby
- 0	search/1/w	#!\ /usr/local/bin/ruby	Ruby script text executable
- !:strength + 15
- !:mime text/x-ruby
--0	search/1	#!/usr/bin/env\ ruby	Ruby script text executable
-+0	search/1	#!/usr/bin/env\ ruby				Ruby script text executable
- !:strength + 15
- !:mime text/x-ruby
--0	search/1	#!\ /usr/bin/env\ ruby	Ruby script text executable
-+0	search/1	#!\ /usr/bin/env\ ruby			Ruby script text executable
- !:strength + 15
- !:mime text/x-ruby
+ 24	lelong	60011		old-fs dump file (little endian),
+-- 
+2.13.3
+
+From f0e846528e1c839ab44895a1f13d167a4ad8def3 Mon Sep 17 00:00:00 2001
+From: Marek Cermak <macermak@redhat.com>
+Date: Wed, 20 Dec 2017 16:18:46 +0100
+Subject: [PATCH] Resolves: #1515180 - image/gif classifed as
+ application/octet-stream
+
+https://bugzilla.redhat.com/show_bug.cgi?id=1515180
+
+Signed-off-by: Marek Cermak <macermak@redhat.com>
+---
+ magic/Magdir/images | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/magic/Magdir/images b/magic/Magdir/images
+index 69e8e90f..76f7e7da 100644
+--- a/magic/Magdir/images
++++ b/magic/Magdir/images
+@@ -468,7 +468,9 @@
+ !:mime	image/x-unknown
  
- # What looks like ruby, but does not have a shebang
- # (modules and such)
- # From: Lubomir Rintel <lkundrak@v3.sk>
--0	regex		\^[\ \t]*require[\ \t]'[A-Za-z_/]+'
-->0	regex		include\ [A-Z]|def\ [a-z]|\ do$
-->>0	regex		\^[\ \t]*end([\ \t]*[;#].*)?$		Ruby script text
-+0	regex		\^[[:space:]]*require[[:space:]]'[A-Za-z_/]+'
-+>0	regex		def\ [a-z]|\ do$
-+>>&0	regex		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
-+!:strength + 30
- !:mime	text/x-ruby
--0	regex		\^[\ \t]*(class|module)[\ \t][A-Z]
-+0	regex		\^[[:space:]]*(class|module)[[:space:]][A-Z]
- >0	regex		(modul|includ)e\ [A-Z]|def\ [a-z]
-->>0	regex		\^[\ \t]*end([\ \t]*[;#].*)?$		Ruby module source text
-+>>&0	regex		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
-+!:strength + 30
-+!:mime	text/x-ruby
-+# Classes with no modules or defs, beats simple ASCII
-+0	regex		\^[[:space:]]*(class|module)[[:space:]][A-Z]
-+>&0	regex	\^[[:space:]]*end([[:space:]]+[;#if].*)?$		Ruby script text
-+!:strength + 10
-+!:mime	text/x-ruby
-+# Looks for function definiton to balance python magic
-+# def name (args)
-+# end
-+0	regex		\^[[:space:]]*def\ [a-z]|def\ [[:alpha:]]+::[a-z]
-+>&0	regex		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
-+!:strength + 10
-+!:mime	text/x-ruby
-+
-+0	regex		\^[[:space:]]*require[[:space:]]'[A-Za-z_/]+'	Ruby script text
-+!:mime	text/x-ruby
-+0 regex 	\^[[:space:]]*include\ ([A-Z]+[a-z]*(::))+	Ruby script text
- !:mime	text/x-ruby
-diff -u file-5.31.orig/magic/Magdir/securitycerts file-5.31/magic/Magdir/securitycerts
---- file-5.31.orig/magic/Magdir/securitycerts	2017-03-17 21:34:26.000000000 +0000
-+++ file-5.31/magic/Magdir/securitycerts	2017-10-11 14:30:57.480078009 +0000
-@@ -4,3 +4,5 @@
- 0	search/1		-----BEGIN\ CERTIFICATE------	RFC1421 Security Certificate text
- 0	search/1		-----BEGIN\ NEW\ CERTIFICATE	RFC1421 Security Certificate Signing Request text
- 0	belong	0xedfeedfe	Sun 'jks' Java Keystore File data
-+
-+0	string \0volume_key	volume_key escrow packet
-diff -u file-5.31.orig/magic/Magdir/varied.script file-5.31/magic/Magdir/varied.script
---- file-5.31.orig/magic/Magdir/varied.script	2017-03-17 21:34:26.000000000 +0000
-+++ file-5.31/magic/Magdir/varied.script	2017-10-11 14:30:57.480078009 +0000
-@@ -4,27 +4,35 @@
- 
- 0	string/t		#!\ /			a
- >3	string		>\0			%s script text executable
-+!:strength / 10
- 
- 0	string/b		#!\ /			a
- >3	string		>\0			%s script executable (binary data)
-+!:strength / 10
- 
- 0	string/t		#!\t/			a
- >3	string		>\0			%s script text executable
-+!:strength / 10
- 
- 0	string/b		#!\t/			a
- >3	string		>\0			%s script executable (binary data)
-+!:strength / 10
- 
- 0	string/t		#!/			a
- >2	string		>\0			%s script text executable
-+!:strength / 10
- 
- 0	string/b		#!/			a
- >2	string		>\0			%s script executable (binary data)
-+!:strength / 10
- 
- 0	string/t		#!\ 			script text executable
- >3	string		>\0			for %s
-+!:strength / 10
- 
- 0	string/b		#!\ 			script executable
- >3	string		>\0			for %s (binary data)
-+!:strength / 10
- 
- # using env
- 0	string/t	#!/usr/bin/env		a
+ # GIF
++# Strength set up to beat 0x55AA DOS/MBR signature word lookups (+65)
+ 0	string		GIF8		GIF image data
++!:strength +80
+ !:mime	image/gif
+ !:apple	8BIMGIFf
+ >4	string		7a		\b, version 8%s,
+-- 
+2.13.6
+

ext/fileinfo/tests/cve-2014-3538-nojit.phpt

@@ -0,0 +1,40 @@
+--TEST--
+Bug #66731: file: extensive backtraking, with pcre.jit=0
+--SKIPIF--
+<?php
+if (defined("PHP_DEBUG") && PHP_DEBUG)
+	die("skip not suitable for debug build");
+if (!class_exists('finfo'))
+	die('skip no fileinfo extension');
+?>
+--INI--
+pcre.jit=0
+--FILE--
+<?php
+$fd = __DIR__.'/cve-2014-3538.data';
+
+file_put_contents($fd,
+  'try:' .
+  str_repeat("\n", 1000000));
+
+$fi = finfo_open(FILEINFO_NONE);
+$t = microtime(true);
+var_dump(finfo_file($fi, $fd));
+$t = microtime(true) - $t;
+finfo_close($fi);
+if ($t < 1) {
+	echo "Ok\n";
+} else {
+	printf("Failed, time=%.2f\n", $t);
+}
+
+?>
+Done
+--CLEAN--
+<?php
+@unlink(__DIR__.'/cve-2014-3538.data');
+?>
+--EXPECTF--
+string(%d) "%s"
+Ok
+Done

ext/fileinfo/tests/magic

@@ -4829,6 +4829,22 @@
 # might add another one or two as time goes by...
 #
 ### JAVA START ###
+0	belong		0xcafebabe
+>4	belong		>30		compiled Java class data,
+!:mime	application/x-java-applet
+>>6	beshort		x	        version %d.
+>>4	beshort		x       	\b%d
+# Which is which?
+#>>4	belong		0x032d		(Java 1.0)
+#>>4	belong		0x032d		(Java 1.1)
+>>4	belong		0x002e		(Java 1.2)
+>>4	belong		0x002f		(Java 1.3)
+>>4	belong		0x0030		(Java 1.4)
+>>4	belong		0x0031		(Java 1.5)
+>>4	belong		0x0032		(Java 1.6)
+>>4	belong		0x0033		(Java 1.7)
+>>4	belong		0x0034		(Java 1.8)
+
 0	belong		0xcafed00d	JAR compressed with pack200,
 >5	byte		x		version %d.
 >4	byte		x		\b%d
@@ -4850,28 +4866,15 @@
 
 0	belong		0xcafebabe
 >4	belong		1		Mach-O universal binary with 1 architecture:
+!:mime application/x-mach-binary
 >>8	use		mach-o		\b
-0	belong		0xcafebabe
->4	belong		>30		compiled Java class data,
-!:mime	application/x-java-applet
->>6	beshort		x	        version %d.
->>4	beshort		x       	\b%d
-# Which is which?
-#>>4	belong		0x032d		(Java 1.0)
-#>>4	belong		0x032d		(Java 1.1)
->>4	belong		0x002e		(Java 1.2)
->>4	belong		0x002f		(Java 1.3)
->>4	belong		0x0030		(Java 1.4)
->>4	belong		0x0031		(Java 1.5)
->>4	belong		0x0032		(Java 1.6)
->>4	belong		0x0033		(Java 1.7)
->>4	belong		0x0034		(Java 1.8)
 >4	belong		>1
 >>4	belong		<20		Mach-O universal binary with %d architectures:
+!:mime application/x-mach-binary
 >>>8	use		mach-o		\b
->>4	belong		>2
+>>4	belong		2
 >>>28	use		mach-o		\b
->>4	belong		>3
+>>4	belong		3
 >>>48	use		mach-o		\b
 >>4	belong		4
 >>>68	use		mach-o		\b
@@ -8674,7 +8677,7 @@
 30		search/481	\x55\xAA
 # to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111)
 # DOS BPB information (70) and after DOS floppy (120) like in previous file version
-!:strength +0
+!:strength +65
 # for sector sizes < 512 Bytes
 >11		uleshort	<512
 >>(11.s-2)	uleshort	0xAA55		DOS/MBR boot sector
@@ -8686,7 +8689,7 @@
 0x1FE          leshort         0xAA55         	DOS/MBR boot sector
 #
 # to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version
-!:strength +0
+!:strength +65
 >2		string		OSBS		OS/BS MBR
 # added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/
 # and http://en.wikipedia.org/wiki/Master_Boot_Record
@@ -11681,16 +11684,6 @@
 >4	byte		43			for C++
 >4	byte		79			for Objective-C++
 
-#------------------------------------------------------------------------------
-# $File: gconv
-# gconv: file(1) magic for iconv/gconv module configuration cache
-#
-# Magic number defined in glibc/iconv/iconvconfig.h as GCONVCACHE_MAGIC
-#
-# From: Marek Cermak <macermak@redhat.com>
-#
-0		lelong		0x20010324 	gconv module configuration cache data
-
 #------------------------------------------------------------------------------
 # $File: geo,v 1.4 2017/03/17 21:35:28 christos Exp $
 # Geo- files from Kurt Schwehr <schwehr@ccom.unh.edu>
@@ -13706,7 +13699,9 @@
 !:mime	image/x-unknown
 
 # GIF
+# Strength set up to beat 0x55AA DOS/MBR signature word lookups (+65)
 0	string		GIF8		GIF image data
+!:strength +80
 !:mime	image/gif
 !:apple	8BIMGIFf
 >4	string		7a		\b, version 8%s,
@@ -21629,48 +21624,29 @@
 # From: Reuben Thomas <rrt@sc3d.org>
 
 # Ruby scripts
-0	search/1/w	#!\ /usr/bin/ruby				Ruby script text executable
+0	search/1/w	#!\ /usr/bin/ruby	Ruby script text executable
 !:strength + 15
 !:mime text/x-ruby
 0	search/1/w	#!\ /usr/local/bin/ruby	Ruby script text executable
 !:strength + 15
 !:mime text/x-ruby
-0	search/1	#!/usr/bin/env\ ruby				Ruby script text executable
+0	search/1	#!/usr/bin/env\ ruby	Ruby script text executable
 !:strength + 15
 !:mime text/x-ruby
-0	search/1	#!\ /usr/bin/env\ ruby			Ruby script text executable
+0	search/1	#!\ /usr/bin/env\ ruby	Ruby script text executable
 !:strength + 15
 !:mime text/x-ruby
 
 # What looks like ruby, but does not have a shebang
 # (modules and such)
 # From: Lubomir Rintel <lkundrak@v3.sk>
-0	regex		\^[[:space:]]*require[[:space:]]'[A-Za-z_/]+'
->0	regex		def\ [a-z]|\ do$
->>&0	regex		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
-!:strength + 30
+0	regex		\^[\ \t]*require[\ \t]'[A-Za-z_/]+'
+>0	regex		include\ [A-Z]|def\ [a-z]|\ do$
+>>0	regex		\^[\ \t]*end([\ \t]*[;#].*)?$		Ruby script text
 !:mime	text/x-ruby
-0	regex		\^[[:space:]]*(class|module)[[:space:]][A-Z]
+0	regex		\^[\ \t]*(class|module)[\ \t][A-Z]
 >0	regex		(modul|includ)e\ [A-Z]|def\ [a-z]
->>&0	regex		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
-!:strength + 30
-!:mime	text/x-ruby
-# Classes with no modules or defs, beats simple ASCII
-0	regex		\^[[:space:]]*(class|module)[[:space:]][A-Z]
->&0	regex	\^[[:space:]]*end([[:space:]]+[;#if].*)?$		Ruby script text
-!:strength + 10
-!:mime	text/x-ruby
-# Looks for function definiton to balance python magic
-# def name (args)
-# end
-0	regex		\^[[:space:]]*def\ [a-z]|def\ [[:alpha:]]+::[a-z]
->&0	regex		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
-!:strength + 10
-!:mime	text/x-ruby
-
-0	regex		\^[[:space:]]*require[[:space:]]'[A-Za-z_/]+'	Ruby script text
-!:mime	text/x-ruby
-0 regex 	\^[[:space:]]*include\ ([A-Z]+[a-z]*(::))+	Ruby script text
+>>0	regex		\^[\ \t]*end([\ \t]*[;#].*)?$		Ruby module source text
 !:mime	text/x-ruby
 
 #------------------------------------------------------------------------------
@@ -24194,35 +24170,27 @@
 
 0	string/t		#!\ /			a
 >3	string		>\0			%s script text executable
-!:strength / 10
 
 0	string/b		#!\ /			a
 >3	string		>\0			%s script executable (binary data)
-!:strength / 10
 
 0	string/t		#!\t/			a
 >3	string		>\0			%s script text executable
-!:strength / 10
 
 0	string/b		#!\t/			a
 >3	string		>\0			%s script executable (binary data)
-!:strength / 10
 
 0	string/t		#!/			a
 >2	string		>\0			%s script text executable
-!:strength / 10
 
 0	string/b		#!/			a
 >2	string		>\0			%s script executable (binary data)
-!:strength / 10
 
 0	string/t		#!\ 			script text executable
 >3	string		>\0			for %s
-!:strength / 10
 
 0	string/b		#!\ 			script executable
 >3	string		>\0			for %s (binary data)
-!:strength / 10
 
 # using env
 0	string/t	#!/usr/bin/env		a

ext/fileinfo/tests/magic私はガラスを食べられます

@@ -4829,6 +4829,22 @@
 # might add another one or two as time goes by...
 #
 ### JAVA START ###
+0	belong		0xcafebabe
+>4	belong		>30		compiled Java class data,
+!:mime	application/x-java-applet
+>>6	beshort		x	        version %d.
+>>4	beshort		x       	\b%d
+# Which is which?
+#>>4	belong		0x032d		(Java 1.0)
+#>>4	belong		0x032d		(Java 1.1)
+>>4	belong		0x002e		(Java 1.2)
+>>4	belong		0x002f		(Java 1.3)
+>>4	belong		0x0030		(Java 1.4)
+>>4	belong		0x0031		(Java 1.5)
+>>4	belong		0x0032		(Java 1.6)
+>>4	belong		0x0033		(Java 1.7)
+>>4	belong		0x0034		(Java 1.8)
+
 0	belong		0xcafed00d	JAR compressed with pack200,
 >5	byte		x		version %d.
 >4	byte		x		\b%d
@@ -4850,28 +4866,15 @@
 
 0	belong		0xcafebabe
 >4	belong		1		Mach-O universal binary with 1 architecture:
+!:mime application/x-mach-binary
 >>8	use		mach-o		\b
-0	belong		0xcafebabe
->4	belong		>30		compiled Java class data,
-!:mime	application/x-java-applet
->>6	beshort		x	        version %d.
->>4	beshort		x       	\b%d
-# Which is which?
-#>>4	belong		0x032d		(Java 1.0)
-#>>4	belong		0x032d		(Java 1.1)
->>4	belong		0x002e		(Java 1.2)
->>4	belong		0x002f		(Java 1.3)
->>4	belong		0x0030		(Java 1.4)
->>4	belong		0x0031		(Java 1.5)
->>4	belong		0x0032		(Java 1.6)
->>4	belong		0x0033		(Java 1.7)
->>4	belong		0x0034		(Java 1.8)
 >4	belong		>1
 >>4	belong		<20		Mach-O universal binary with %d architectures:
+!:mime application/x-mach-binary
 >>>8	use		mach-o		\b
->>4	belong		>2
+>>4	belong		2
 >>>28	use		mach-o		\b
->>4	belong		>3
+>>4	belong		3
 >>>48	use		mach-o		\b
 >>4	belong		4
 >>>68	use		mach-o		\b
@@ -8674,7 +8677,7 @@
 30		search/481	\x55\xAA
 # to display DOS/MBR boot sector (40) before old one (strength=50+21),Syslinux bootloader (71),SYSLINUX MBR (37+36),NetBSD mbr (110),AdvanceMAME mbr (111)
 # DOS BPB information (70) and after DOS floppy (120) like in previous file version
-!:strength +0
+!:strength +65
 # for sector sizes < 512 Bytes
 >11		uleshort	<512
 >>(11.s-2)	uleshort	0xAA55		DOS/MBR boot sector
@@ -8686,7 +8689,7 @@
 0x1FE          leshort         0xAA55         	DOS/MBR boot sector
 #
 # to display information (50) before DOS BPB (strength=70) and after DOS floppy (120) like in old file version
-!:strength +0
+!:strength +65
 >2		string		OSBS		OS/BS MBR
 # added by Joerg Jenderek at Feb 2013 according to http://thestarman.pcministry.com/asm/mbr/
 # and http://en.wikipedia.org/wiki/Master_Boot_Record
@@ -11681,16 +11684,6 @@
 >4	byte		43			for C++
 >4	byte		79			for Objective-C++
 
-#------------------------------------------------------------------------------
-# $File: gconv
-# gconv: file(1) magic for iconv/gconv module configuration cache
-#
-# Magic number defined in glibc/iconv/iconvconfig.h as GCONVCACHE_MAGIC
-#
-# From: Marek Cermak <macermak@redhat.com>
-#
-0		lelong		0x20010324 	gconv module configuration cache data
-
 #------------------------------------------------------------------------------
 # $File: geo,v 1.4 2017/03/17 21:35:28 christos Exp $
 # Geo- files from Kurt Schwehr <schwehr@ccom.unh.edu>
@@ -13706,7 +13699,9 @@
 !:mime	image/x-unknown
 
 # GIF
+# Strength set up to beat 0x55AA DOS/MBR signature word lookups (+65)
 0	string		GIF8		GIF image data
+!:strength +80
 !:mime	image/gif
 !:apple	8BIMGIFf
 >4	string		7a		\b, version 8%s,
@@ -21629,48 +21624,29 @@
 # From: Reuben Thomas <rrt@sc3d.org>
 
 # Ruby scripts
-0	search/1/w	#!\ /usr/bin/ruby				Ruby script text executable
+0	search/1/w	#!\ /usr/bin/ruby	Ruby script text executable
 !:strength + 15
 !:mime text/x-ruby
 0	search/1/w	#!\ /usr/local/bin/ruby	Ruby script text executable
 !:strength + 15
 !:mime text/x-ruby
-0	search/1	#!/usr/bin/env\ ruby				Ruby script text executable
+0	search/1	#!/usr/bin/env\ ruby	Ruby script text executable
 !:strength + 15
 !:mime text/x-ruby
-0	search/1	#!\ /usr/bin/env\ ruby			Ruby script text executable
+0	search/1	#!\ /usr/bin/env\ ruby	Ruby script text executable
 !:strength + 15
 !:mime text/x-ruby
 
 # What looks like ruby, but does not have a shebang
 # (modules and such)
 # From: Lubomir Rintel <lkundrak@v3.sk>
-0	regex		\^[[:space:]]*require[[:space:]]'[A-Za-z_/]+'
->0	regex		def\ [a-z]|\ do$
->>&0	regex		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
-!:strength + 30
+0	regex		\^[\ \t]*require[\ \t]'[A-Za-z_/]+'
+>0	regex		include\ [A-Z]|def\ [a-z]|\ do$
+>>0	regex		\^[\ \t]*end([\ \t]*[;#].*)?$		Ruby script text
 !:mime	text/x-ruby
-0	regex		\^[[:space:]]*(class|module)[[:space:]][A-Z]
+0	regex		\^[\ \t]*(class|module)[\ \t][A-Z]
 >0	regex		(modul|includ)e\ [A-Z]|def\ [a-z]
->>&0	regex		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
-!:strength + 30
-!:mime	text/x-ruby
-# Classes with no modules or defs, beats simple ASCII
-0	regex		\^[[:space:]]*(class|module)[[:space:]][A-Z]
->&0	regex	\^[[:space:]]*end([[:space:]]+[;#if].*)?$		Ruby script text
-!:strength + 10
-!:mime	text/x-ruby
-# Looks for function definiton to balance python magic
-# def name (args)
-# end
-0	regex		\^[[:space:]]*def\ [a-z]|def\ [[:alpha:]]+::[a-z]
->&0	regex		\^[[:space:]]*end([[:space:]]+[;#].*)?$		Ruby script text
-!:strength + 10
-!:mime	text/x-ruby
-
-0	regex		\^[[:space:]]*require[[:space:]]'[A-Za-z_/]+'	Ruby script text
-!:mime	text/x-ruby
-0 regex 	\^[[:space:]]*include\ ([A-Z]+[a-z]*(::))+	Ruby script text
+>>0	regex		\^[\ \t]*end([\ \t]*[;#].*)?$		Ruby module source text
 !:mime	text/x-ruby
 
 #------------------------------------------------------------------------------
@@ -24194,35 +24170,27 @@
 
 0	string/t		#!\ /			a
 >3	string		>\0			%s script text executable
-!:strength / 10
 
 0	string/b		#!\ /			a
 >3	string		>\0			%s script executable (binary data)
-!:strength / 10
 
 0	string/t		#!\t/			a
 >3	string		>\0			%s script text executable
-!:strength / 10
 
 0	string/b		#!\t/			a
 >3	string		>\0			%s script executable (binary data)
-!:strength / 10
 
 0	string/t		#!/			a
 >2	string		>\0			%s script text executable
-!:strength / 10
 
 0	string/b		#!/			a
 >2	string		>\0			%s script executable (binary data)
-!:strength / 10
 
 0	string/t		#!\ 			script text executable
 >3	string		>\0			for %s
-!:strength / 10
 
 0	string/b		#!\ 			script executable
 >3	string		>\0			for %s (binary data)
-!:strength / 10
 
 # using env
 0	string/t	#!/usr/bin/env		a

ext/ftp/ftp.c

@@ -1859,7 +1859,7 @@ data_accepted:
 						php_pollfd p;
 						int i;
 
-						p.fd = ftp->fd;
+						p.fd = data->fd;
 						p.events = (err == SSL_ERROR_WANT_READ) ? (POLLIN|POLLPRI) : POLLOUT;
 						p.revents = 0;
 
@@ -1908,10 +1908,10 @@ static void ftp_ssl_shutdown(ftpbuf_t *ftp, php_socket_t fd, SSL *ssl_handle) {
 		done = 0;
 	}
 
-	while (!done) {
-		if (data_available(ftp, fd)) {
-			ERR_clear_error();
-			nread = SSL_read(ssl_handle, buf, sizeof(buf));
+	while (!done && data_available(ftp, fd)) {
+		ERR_clear_error();
+		nread = SSL_read(ssl_handle, buf, sizeof(buf));
+		if (nread <= 0) {
 			err = SSL_get_error(ssl_handle, nread);
 			switch (err) {
 				case SSL_ERROR_NONE: /* this is not an error */
@@ -1929,9 +1929,11 @@ static void ftp_ssl_shutdown(ftpbuf_t *ftp, php_socket_t fd, SSL *ssl_handle) {
 					break;
 				default:
 					if ((sslerror = ERR_get_error())) {
-					    ERR_error_string_n(sslerror, buf, sizeof(buf));
+						ERR_error_string_n(sslerror, buf, sizeof(buf));
+						php_error_docref(NULL, E_WARNING, "SSL_read on shutdown: %s", buf);
+					} else if (errno) {
+						php_error_docref(NULL, E_WARNING, "SSL_read on shutdown: %s (%d)", strerror(errno), errno);
 					}
-					php_error_docref(NULL, E_WARNING, "SSL_read on shutdown: %s (%d)", (sslerror ? buf : strerror(errno)), errno);
 					done = 1;
 					break;
 			}

ext/gd/libgd/gd.c

@@ -1593,7 +1593,7 @@ void gdImageFilledArc (gdImagePtr im, int cx, int cy, int w, int h, int s, int e
 	int i, pti;
 	int lx = 0, ly = 0;
 	int fx = 0, fy = 0;
-
+	int startx, starty, endx, endy;
 
     if ((s % 360)  == (e % 360)) {
 		s = 0; e = 360;
@@ -1620,8 +1620,8 @@ void gdImageFilledArc (gdImagePtr im, int cx, int cy, int w, int h, int s, int e
 
 	for (i = s, pti = 1; i <= e; i++, pti++) {
 		int x, y;
-		x = ((long) gdCosT[i % 360] * (long) w / (2 * 1024)) + cx;
-		y = ((long) gdSinT[i % 360] * (long) h / (2 * 1024)) + cy;
+		x = endx = ((long) gdCosT[i % 360] * (long) w / (2 * 1024)) + cx;
+		y = endy = ((long) gdSinT[i % 360] * (long) h / (2 * 1024)) + cy;
 		if (i != s) {
 			if (!(style & gdChord)) {
 				if (style & gdNoFill) {
@@ -1646,8 +1646,8 @@ void gdImageFilledArc (gdImagePtr im, int cx, int cy, int w, int h, int s, int e
 			if (!(style & (gdChord | gdNoFill))) {
 				pts[0].x = cx;
 				pts[0].y = cy;
-				pts[pti].x = x;
-				pts[pti].y = y;
+				pts[pti].x = startx = x;
+				pts[pti].y = starty = y;
 			}
 		}
 		lx = x;
@@ -1676,6 +1676,24 @@ void gdImageFilledArc (gdImagePtr im, int cx, int cy, int w, int h, int s, int e
 				gdImageLine(im, cx, cy, fx, fy, color);
 			}
 		} else {
+			if (e - s < 360) {
+				if (pts[1].x != startx && pts[1].y == starty) {
+					/* start point has been removed due to y-coord fix => insert it */
+					for (i = pti; i > 1; i--) {
+						pts[i].x = pts[i-1].x;
+						pts[i].y = pts[i-1].y;
+					}
+					pts[1].x = startx;
+					pts[1].y = starty;
+					pti++;
+				}
+				if (pts[pti-1].x != endx && pts[pti-1].y == endy) {
+					/* end point has been removed due to y-coord fix => insert it */
+					pts[pti].x = endx;
+					pts[pti].y = endy;
+					pti++;
+				}
+			}
 			pts[pti].x = cx;
 			pts[pti].y = cy;
 			gdImageFilledPolygon(im, pts, pti+1, color);

ext/gd/libgd/gd_bmp.c

@@ -813,8 +813,8 @@ static int bmp_read_1bit(gdImagePtr im, gdIOCtxPtr infile, bmp_info_t *info, bmp
 		}
 	}
 
-	/* The line must be divisible by 4, else its padded with NULLs */
-	padding = ((int)ceil(0.1 * info->width)) % 4;
+	/* The line must be aligned on a 32 bits word, else it is padded with zeros */
+	padding = (info->width + 7) / 8 % 4;
 	if (padding) {
 		padding = 4 - padding;
 	}

ext/gd/libgd/gd_color_match.c

@@ -33,8 +33,8 @@ int gdImageColorMatch (gdImagePtr im1, gdImagePtr im2)
 		return -4; /* At least 1 color must be allocated */
 	}
 
-	buf = (unsigned long *)safe_emalloc(sizeof(unsigned long), 5 * im2->colorsTotal, 0);
-	memset( buf, 0, sizeof(unsigned long) * 5 * im2->colorsTotal );
+	buf = (unsigned long *)safe_emalloc(sizeof(unsigned long), 5 * gdMaxColors, 0);
+	memset( buf, 0, sizeof(unsigned long) * 5 * gdMaxColors );
 
 	for (x=0; x<im1->sx; x++) {
 		for( y=0; y<im1->sy; y++ ) {

ext/gd/libgd/gd_crop.c

@@ -163,30 +163,24 @@ gdImagePtr gdImageCropAuto(gdImagePtr im, const unsigned int mode)
 		}
 	}
 
-	/* Nothing to do > bye
-	 * Duplicate the image?
-	 */
-	if (y == height - 1) {
+	/* Whole image would be cropped > bye */
+	if (match) {
 		return NULL;
 	}
 
-	crop.y = y -1;
+	crop.y = y - 1;
+
 	match = 1;
 	for (y = height - 1; match && y >= 0; y--) {
 		for (x = 0; match && x < width; x++) {
 			match = (color == gdImageGetPixel(im, x,y));
 		}
 	}
-
-	if (y == 0) {
-		crop.height = height - crop.y + 1;
-	} else {
-		crop.height = y - crop.y + 2;
-	}
+	crop.height = y - crop.y + 2;
 
 	match = 1;
 	for (x = 0; match && x < width; x++) {
-		for (y = 0; match && y < crop.y + crop.height - 1; y++) {
+		for (y = 0; match && y < crop.y + crop.height; y++) {
 			match = (color == gdImageGetPixel(im, x,y));
 		}
 	}
@@ -194,12 +188,13 @@ gdImagePtr gdImageCropAuto(gdImagePtr im, const unsigned int mode)
 
 	match = 1;
 	for (x = width - 1; match && x >= 0; x--) {
-		for (y = 0; match &&  y < crop.y + crop.height - 1; y++) {
+		for (y = 0; match &&  y < crop.y + crop.height; y++) {
 			match = (color == gdImageGetPixel(im, x,y));
 		}
 	}
 	crop.width = x - crop.x + 2;
-	if (crop.x <= 0 || crop.y <= 0 || crop.width <= 0 || crop.height <= 0) {
+
+	if (crop.x < 0 || crop.y < 0 || crop.width <= 0 || crop.height <= 0) {
 		return NULL;
 	}
 	return gdImageCrop(im, &crop);
@@ -258,31 +253,24 @@ gdImagePtr gdImageCropThreshold(gdImagePtr im, const unsigned int color, const f
 		}
 	}
 
-	/* Pierre
-	 * Nothing to do > bye
-	 * Duplicate the image?
-	 */
-	if (y == height - 1) {
+	/* Whole image would be cropped > bye */
+	if (match) {
 		return NULL;
 	}
 
-	crop.y = y -1;
+	crop.y = y - 1;
+
 	match = 1;
 	for (y = height - 1; match && y >= 0; y--) {
 		for (x = 0; match && x < width; x++) {
 			match = (gdColorMatch(im, color, gdImageGetPixel(im, x, y), threshold)) > 0;
 		}
 	}
-
-	if (y == 0) {
-		crop.height = height - crop.y + 1;
-	} else {
-		crop.height = y - crop.y + 2;
-	}
+	crop.height = y - crop.y + 2;
 
 	match = 1;
 	for (x = 0; match && x < width; x++) {
-		for (y = 0; match && y < crop.y + crop.height - 1; y++) {
+		for (y = 0; match && y < crop.y + crop.height; y++) {
 			match = (gdColorMatch(im, color, gdImageGetPixel(im, x,y), threshold)) > 0;
 		}
 	}
@@ -290,7 +278,7 @@ gdImagePtr gdImageCropThreshold(gdImagePtr im, const unsigned int color, const f
 
 	match = 1;
 	for (x = width - 1; match && x >= 0; x--) {
-		for (y = 0; match &&  y < crop.y + crop.height - 1; y++) {
+		for (y = 0; match &&  y < crop.y + crop.height; y++) {
 			match = (gdColorMatch(im, color, gdImageGetPixel(im, x,y), threshold)) > 0;
 		}
 	}
@@ -327,7 +315,7 @@ static int gdGuessBackgroundColorFromCorners(gdImagePtr im, int *color)
 	} else if (tl == tr  || tl == bl || tl == br) {
 		*color = tl;
 		return 2;
-	} else if (tr == bl) {
+	} else if (tr == bl || tr == br) {
 		*color = tr;
 		return 2;
 	} else if (br == bl) {

ext/gd/libgd/gd_interpolation.c

@@ -662,43 +662,7 @@ static inline int getPixelOverflowTC(gdImagePtr im, const int x, const int y, co
 		}
 		return c;
 	} else {
-		register int border = 0;
-
-		if (y < im->cy1) {
-			border = im->tpixels[0][im->cx1];
-			goto processborder;
-		}
-
-		if (y < im->cy1) {
-			border = im->tpixels[0][im->cx1];
-			goto processborder;
-		}
-
-		if (y > im->cy2) {
-			if (x >= im->cx1 && x <= im->cx1) {
-				border = im->tpixels[im->cy2][x];
-				goto processborder;
-			} else {
-				return gdTrueColorAlpha(0, 0, 0, 127);
-			}
-		}
-
-		/* y is bound safe at this point */
-		if (x < im->cx1) {
-			border = im->tpixels[y][im->cx1];
-			goto processborder;
-		}
-
-		if (x > im->cx2) {
-			border = im->tpixels[y][im->cx2];
-		}
-
-processborder:
-		if (border == im->transparent) {
-			return gdTrueColorAlpha(0, 0, 0, 127);
-		} else{
-			return gdTrueColorAlpha(gdTrueColorGetRed(border), gdTrueColorGetGreen(border), gdTrueColorGetBlue(border), 127);
-		}
+		return bgColor;
 	}
 }
 
@@ -713,42 +677,7 @@ static inline int getPixelOverflowPalette(gdImagePtr im, const int x, const int
 		}
 		return colorIndex2RGBA(c);
 	} else {
-		register int border = 0;
-		if (y < im->cy1) {
-			border = gdImageGetPixel(im, im->cx1, 0);
-			goto processborder;
-		}
-
-		if (y < im->cy1) {
-			border = gdImageGetPixel(im, im->cx1, 0);
-			goto processborder;
-		}
-
-		if (y > im->cy2) {
-			if (x >= im->cx1 && x <= im->cx1) {
-				border = gdImageGetPixel(im, x,  im->cy2);
-				goto processborder;
-			} else {
-				return gdTrueColorAlpha(0, 0, 0, 127);
-			}
-		}
-
-		/* y is bound safe at this point */
-		if (x < im->cx1) {
-			border = gdImageGetPixel(im, im->cx1, y);
-			goto processborder;
-		}
-
-		if (x > im->cx2) {
-			border = gdImageGetPixel(im, im->cx2, y);
-		}
-
-processborder:
-		if (border == im->transparent) {
-			return gdTrueColorAlpha(0, 0, 0, 127);
-		} else{
-			return colorIndex2RGBcustomA(border, 127);
-		}
+		return bgColor;
 	}
 }
 
@@ -890,8 +819,13 @@ static inline LineContribType * _gdContributionsAlloc(unsigned int line_length,
 {
 	unsigned int u = 0;
 	LineContribType *res;
-	int overflow_error = 0;
+	size_t weights_size;
 
+	if (overflow2(windows_size, sizeof(double))) {
+		return NULL;
+	} else {
+		weights_size = windows_size * sizeof(double);
+	}
 	res = (LineContribType *) gdMalloc(sizeof(LineContribType));
 	if (!res) {
 		return NULL;
@@ -908,15 +842,10 @@ static inline LineContribType * _gdContributionsAlloc(unsigned int line_length,
 		return NULL;
 	}
 	for (u = 0 ; u < line_length ; u++) {
-		if (overflow2(windows_size, sizeof(double))) {
-			overflow_error = 1;
-		} else {
-			res->ContribRow[u].Weights = (double *) gdMalloc(windows_size * sizeof(double));
-		}
-		if (overflow_error == 1 || res->ContribRow[u].Weights == NULL) {
+		res->ContribRow[u].Weights = (double *) gdMalloc(weights_size);
+		if (res->ContribRow[u].Weights == NULL) {
 			unsigned int i;
-			u--;
-			for (i=0;i<=u;i++) {
+			for (i=0;i<u;i++) {
 				gdFree(res->ContribRow[i].Weights);
 			}
 			gdFree(res->ContribRow);
@@ -1021,7 +950,7 @@ static inline void _gdScaleRow(gdImagePtr pSrc,  unsigned int src_width, gdImage
     }
 }
 
-static inline void _gdScaleHoriz(gdImagePtr pSrc, unsigned int src_width, unsigned int src_height, gdImagePtr pDst,  unsigned int dst_width, unsigned int dst_height)
+static inline int _gdScaleHoriz(gdImagePtr pSrc, unsigned int src_width, unsigned int src_height, gdImagePtr pDst,  unsigned int dst_width, unsigned int dst_height)
 {
 	unsigned int u;
 	LineContribType * contrib;
@@ -1036,13 +965,14 @@ static inline void _gdScaleHoriz(gdImagePtr pSrc, unsigned int src_width, unsign
 
 	contrib = _gdContributionsCalc(dst_width, src_width, (double)dst_width / (double)src_width, pSrc->interpolation);
 	if (contrib == NULL) {
-		return;
+		return 0;
 	}
 	/* Scale each row */
 	for (u = 0; u < dst_height - 1; u++) {
 		_gdScaleRow(pSrc, src_width, pDst, dst_width, u, contrib);
 	}
 	_gdContributionsFree (contrib);
+	return 1;
 }
 
 static inline void _gdScaleCol (gdImagePtr pSrc,  unsigned int src_width, gdImagePtr pRes, unsigned int dst_width, unsigned int dst_height, unsigned int uCol, LineContribType *contrib)
@@ -1068,7 +998,7 @@ static inline void _gdScaleCol (gdImagePtr pSrc,  unsigned int src_width, gdImag
 	}
 }
 
-static inline void _gdScaleVert (const gdImagePtr pSrc, const unsigned int src_width, const unsigned int src_height, const gdImagePtr pDst, const unsigned int dst_width, const unsigned int dst_height)
+static inline int _gdScaleVert (const gdImagePtr pSrc, const unsigned int src_width, const unsigned int src_height, const gdImagePtr pDst, const unsigned int dst_width, const unsigned int dst_height)
 {
 	unsigned int u;
 	LineContribType * contrib;
@@ -1083,19 +1013,21 @@ static inline void _gdScaleVert (const gdImagePtr pSrc, const unsigned int src_w
 
 	contrib = _gdContributionsCalc(dst_height, src_height, (double)(dst_height) / (double)(src_height), pSrc->interpolation);
 	if (contrib == NULL) {
-		return;
+		return 0;
 	}
 	/* scale each column */
 	for (u = 0; u < dst_width - 1; u++) {
 		_gdScaleCol(pSrc, src_width, pDst, dst_width, dst_height, u, contrib);
 	}
 	_gdContributionsFree(contrib);
+	return 1;
 }
 
 gdImagePtr gdImageScaleTwoPass(const gdImagePtr src, const unsigned int src_width, const unsigned int src_height, const unsigned int new_width, const unsigned int new_height)
 {
 	gdImagePtr tmp_im;
 	gdImagePtr dst;
+	int scale_pass_res;
 
 	if (new_width == 0 || new_height == 0) {
 		return NULL;
@@ -1111,7 +1043,11 @@ gdImagePtr gdImageScaleTwoPass(const gdImagePtr src, const unsigned int src_widt
 		return NULL;
 	}
 	gdImageSetInterpolationMethod(tmp_im, src->interpolation_id);
-	_gdScaleHoriz(src, src_width, src_height, tmp_im, new_width, src_height);
+	scale_pass_res = _gdScaleHoriz(src, src_width, src_height, tmp_im, new_width, src_height);
+	if (scale_pass_res != 1) {
+		gdImageDestroy(tmp_im);
+		return NULL;
+	}
 
 	dst = gdImageCreateTrueColor(new_width, new_height);
 	if (dst == NULL) {
@@ -1119,30 +1055,14 @@ gdImagePtr gdImageScaleTwoPass(const gdImagePtr src, const unsigned int src_widt
 		return NULL;
 	}
 	gdImageSetInterpolationMethod(dst, src->interpolation_id);
-	_gdScaleVert(tmp_im, new_width, src_height, dst, new_width, new_height);
-	gdImageDestroy(tmp_im);
-
-	return dst;
-}
-
-gdImagePtr Scale(const gdImagePtr src, const unsigned int src_width, const unsigned int src_height, const gdImagePtr dst, const unsigned int new_width, const unsigned int new_height)
-{
-	gdImagePtr tmp_im;
-
-	if (new_width == 0 || new_height == 0) {
+	scale_pass_res = _gdScaleVert(tmp_im, new_width, src_height, dst, new_width, new_height);
+	if (scale_pass_res != 1) {
+		gdImageDestroy(dst);
+		gdImageDestroy(tmp_im);
 		return NULL;
 	}
-
-	tmp_im = gdImageCreateTrueColor(new_width, src_height);
-	if (tmp_im == NULL) {
-		return NULL;
-	}
-	gdImageSetInterpolationMethod(tmp_im, src->interpolation_id);
-
-	_gdScaleHoriz(src, src_width, src_height, tmp_im, new_width, src_height);
-	_gdScaleVert(tmp_im, new_width, src_height, dst, new_width, new_height);
-
 	gdImageDestroy(tmp_im);
+
 	return dst;
 }
 
@@ -1317,11 +1237,11 @@ static gdImagePtr gdImageScaleBilinearPalette(gdImagePtr im, const unsigned int
 					f_b1, f_b2, f_b3, f_b4,
 					f_a1, f_a2, f_a3, f_a4;
 
-			/* zero for the background color, nothig gets outside anyway */
+			/* 0 for bgColor; (n,m) is supposed to be valid anyway */
 			pixel1 = getPixelOverflowPalette(im, n, m, 0);
-			pixel2 = getPixelOverflowPalette(im, n + 1, m, 0);
-			pixel3 = getPixelOverflowPalette(im, n, m + 1, 0);
-			pixel4 = getPixelOverflowPalette(im, n + 1, m + 1, 0);
+			pixel2 = getPixelOverflowPalette(im, n + 1, m, pixel1);
+			pixel3 = getPixelOverflowPalette(im, n, m + 1, pixel1);
+			pixel4 = getPixelOverflowPalette(im, n + 1, m + 1, pixel1);
 
 			f_r1 = gd_itofx(gdTrueColorGetRed(pixel1));
 			f_r2 = gd_itofx(gdTrueColorGetRed(pixel2));
@@ -1409,11 +1329,11 @@ static gdImagePtr gdImageScaleBilinearTC(gdImagePtr im, const unsigned int new_w
 					f_b1, f_b2, f_b3, f_b4,
 					f_a1, f_a2, f_a3, f_a4;
 			dwSrcTotalOffset = m + n;
-			/* 0 for bgColor, nothing gets outside anyway */
+			/* 0 for bgColor; (n,m) is supposed to be valid anyway */
 			pixel1 = getPixelOverflowTC(im, n, m, 0);
-			pixel2 = getPixelOverflowTC(im, n + 1, m, 0);
-			pixel3 = getPixelOverflowTC(im, n, m + 1, 0);
-			pixel4 = getPixelOverflowTC(im, n + 1, m + 1, 0);
+			pixel2 = getPixelOverflowTC(im, n + 1, m, pixel1);
+			pixel3 = getPixelOverflowTC(im, n, m + 1, pixel1);
+			pixel4 = getPixelOverflowTC(im, n + 1, m + 1, pixel1);
 
 			f_r1 = gd_itofx(gdTrueColorGetRed(pixel1));
 			f_r2 = gd_itofx(gdTrueColorGetRed(pixel2));

ext/gd/libgd/gd_jpeg.c

@@ -67,14 +67,18 @@ static long php_jpeg_emit_message(j_common_ptr jpeg_info, int level)
 		 * unless strace_level >= 3
 		 */
 		if ((jpeg_info->err->num_warnings == 0) || (jpeg_info->err->trace_level >= 3)) {
-			gd_error_ex(ignore_warning ? GD_NOTICE : GD_WARNING, "gd-jpeg, libjpeg: recoverable error: %s\n", message);
+			if (!ignore_warning) {
+				gd_error("gd-jpeg, libjpeg: recoverable error: %s\n", message);
+			}
 		}
 
 		jpeg_info->err->num_warnings++;
 	} else {
 		/* strace msg, Show it if trace_level >= level. */
 		if (jpeg_info->err->trace_level >= level) {
-			gd_error_ex(GD_NOTICE, "gd-jpeg, libjpeg: strace message: %s\n", message);
+			if (!ignore_warning) {
+				gd_error("gd-jpeg, libjpeg: strace message: %s\n", message);
+			}
 		}
 	}
 	return 1;
@@ -86,9 +90,10 @@ static long php_jpeg_emit_message(j_common_ptr jpeg_info, int level)
 static void fatal_jpeg_error (j_common_ptr cinfo)
 {
 	jmpbuf_wrapper *jmpbufw;
+	char buffer[JMSG_LENGTH_MAX];
 
-	gd_error("gd-jpeg: JPEG library reports unrecoverable error: ");
-	(*cinfo->err->output_message) (cinfo);
+	(*cinfo->err->format_message)(cinfo, buffer);
+	gd_error_ex(GD_WARNING, "gd-jpeg: JPEG library reports unrecoverable error: %s", buffer);
 
 	jmpbufw = (jmpbuf_wrapper *) cinfo->client_data;
 	jpeg_destroy (cinfo);

ext/gd/libgd/gd_wbmp.c

@@ -100,6 +100,7 @@ void gdImageWBMPCtx (gdImagePtr image, int fg, gdIOCtx * out)
 	/* create the WBMP */
 	if ((wbmp = createwbmp (gdImageSX (image), gdImageSY (image), WBMP_WHITE)) == NULL) {
 		gd_error("Could not create WBMP");
+		return;
 	}
 
 	/* fill up the WBMP structure */

ext/gd/tests/bug73281.phpt

@@ -0,0 +1,45 @@
+--TEST--
+Bug #73281 (imagescale(…, IMG_BILINEAR_FIXED) can cause black border)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.3', '<=')) die('skip upstream fix not yet released');
+?>
+--FILE--
+<?php
+$coordinates = [[0, 0], [0, 199], [199, 199], [199, 0]];
+
+$src = imagecreatetruecolor(100, 100);
+$white = imagecolorallocate($src, 255, 255, 255);
+imagefilledrectangle($src, 0,0, 99,99, $white);
+$dst = imagescale($src, 200, 200, IMG_BILINEAR_FIXED);
+echo "truecolor source\n";
+foreach ($coordinates as $coordinate) {
+    list($x, $y) = $coordinate;
+    printf("%3d, %3d: %x\n", $x, $y, imagecolorat($dst, $x, $y));
+}
+
+$src = imagecreate(100, 100);
+$white = imagecolorallocate($src, 255, 255, 255);
+imagefilledrectangle($src, 0,0, 99,99, $white);
+$dst = imagescale($src, 200, 200, IMG_BILINEAR_FIXED);
+echo "\npalette source\n";
+foreach ($coordinates as $coordinate) {
+    list($x, $y) = $coordinate;
+    printf("%3d, %3d: %x\n", $x, $y, imagecolorat($dst, $x, $y));
+}
+?>
+===DONE===
+--EXPECT--
+truecolor source
+  0,   0: ffffff
+  0, 199: ffffff
+199, 199: ffffff
+199,   0: ffffff
+
+palette source
+  0,   0: ffffff
+  0, 199: ffffff
+199, 199: ffffff
+199,   0: ffffff
+===DONE===

ext/gd/tests/bug73614.phpt

@@ -0,0 +1,27 @@
+--TEST--
+Bug #73614 (gdImageFilledArc() doesn't properly draw pies)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.5', '<=')) die('skip upstream bugfix not yet released');
+?>
+--FILE--
+<?php
+require_once __DIR__ . '/func.inc';
+
+$image = imagecreatetruecolor(500, 500);
+
+$white    = imagecolorallocate($image, 0xFF, 0xFF, 0xFF);
+$navy     = imagecolorallocate($image, 0x00, 0x00, 0x80);
+$red      = imagecolorallocate($image, 0xFF, 0x00, 0x00);
+
+imagefilledarc($image, 250, 250, 500, 250, 0, 88, $white, IMG_ARC_PIE);
+imagefilledarc($image, 250, 250, 500, 250, 88, 91 , $navy, IMG_ARC_PIE);
+imagefilledarc($image, 250, 250, 500, 250, 91, 360 , $red, IMG_ARC_PIE);
+
+test_image_equals_file(__DIR__ . '/bug73614.png', $image);
+?>
+===DONE===
+--EXPECT--
+The images are equal.
+===DONE===

ext/gd/tests/bug77195.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Bug #77195 (Incorrect error handling of imagecreatefromjpeg())
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!gd_info()['JPEG Support']) die('skip JPEG support not available');
+?>
+--FILE--
+<?php
+$filename = __DIR__ . '/bug77195.jpeg';
+@imagecreatefromjpeg($filename);
+imagecreatefromjpeg($filename);
+?>
+===DONE===
+--EXPECTF--
+Warning: imagecreatefromjpeg(): gd-jpeg: JPEG library reports unrecoverable error: JPEG datastream contains no image in %s on line %d
+
+Warning: imagecreatefromjpeg(): '%s' is not a valid JPEG file in %s on line %d
+===DONE===

ext/gd/tests/bug77198_auto.phpt

@@ -0,0 +1,50 @@
+--TEST--
+Bug #77198 (auto cropping has insufficient precision)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNDLED) die('upstream bugfix has not been released');
+?>
+--FILE--
+<?php
+
+function createWhiteImageWithBlackPixelAt($x, $y)
+{
+    $im = imagecreatetruecolor(8, 8);
+    imagefilledrectangle($im, 0, 0, 7, 7, 0xffffff);
+    imagesetpixel($im, $x, $y, 0x000000);
+    return $im;
+}
+
+for ($y = 0; $y < 8; $y++) {
+    for ($x = 0; $x < 8; $x++) {
+        if (($x == 0 && ($y == 0 || $y == 7)) || ($x == 7 && ($y == 0 || $y == 7))) {
+            continue; // skip the corners
+        }
+        $orig = createWhiteImageWithBlackPixelAt($x, $y);
+        $cropped = imagecropauto($orig, IMG_CROP_SIDES);
+        if (!$cropped) {
+            printf("Pixel at %d, %d: unexpected NULL crop\n", $x, $y);
+        } else {
+            $width = imagesx($cropped);
+            if ($width !== 1) {
+                printf("Pixel at %d, %d: unexpected width (%d)\n", $x, $y, $width);
+            }
+            $height = imagesy($cropped);
+            if ($height !== 1) {
+                printf("Pixel at %d, %d: unexpected height (%d)\n", $x, $y, $height);
+            }
+            $color = imagecolorat($cropped, 0, 0);
+            if ($color !== 0x000000) {
+                printf("Pixel at %d, %d: unexpected color (%d)\n", $x, $y, $color);
+            }
+            imagedestroy($cropped);
+        }
+        imagedestroy($orig);
+    }
+}
+
+?>
+===DONE===
+--EXPECT--
+===DONE===

ext/gd/tests/bug77198_threshold.phpt

@@ -0,0 +1,47 @@
+--TEST--
+Bug #77198 (threshold cropping has insufficient precision)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNDLED) die('upstream bugfix has not been released');
+?>
+--FILE--
+<?php
+
+function createWhiteImageWithBlackPixelAt($x, $y)
+{
+    $im = imagecreatetruecolor(8, 8);
+    imagefilledrectangle($im, 0, 0, 7, 7, 0xffffff);
+    imagesetpixel($im, $x, $y, 0x000000);
+    return $im;
+}
+
+for ($y = 0; $y < 8; $y++) {
+    for ($x = 0; $x < 8; $x++) {
+        $orig = createWhiteImageWithBlackPixelAt($x, $y);
+        $cropped = imagecropauto($orig, IMG_CROP_THRESHOLD, 1, 0xffffff);
+        if (!$cropped) {
+            printf("Pixel at %d, %d: unexpected NULL crop\n", $x, $y);
+        } else {
+            $width = imagesx($cropped);
+            if ($width !== 1) {
+                printf("Pixel at %d, %d: unexpected width (%d)\n", $x, $y, $width);
+            }
+            $height = imagesy($cropped);
+            if ($height !== 1) {
+                printf("Pixel at %d, %d: unexpected height (%d)\n", $x, $y, $height);
+            }
+            $color = imagecolorat($cropped, 0, 0);
+            if ($color !== 0x000000) {
+                printf("Pixel at %d, %d: unexpected color (%d)\n", $x, $y, $color);
+            }
+            imagedestroy($cropped);
+        }
+        imagedestroy($orig);
+    }
+}
+
+?>
+===DONE===
+--EXPECT--
+===DONE===

ext/gd/tests/bug77200.phpt

@@ -0,0 +1,37 @@
+--TEST--
+Bug #77200 (imagecropauto(…, GD_CROP_SIDES) crops left but not right)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNDLED) die('upstream bugfix has not been released');
+?>
+--FILE--
+<?php
+
+$orig = imagecreatetruecolor(8, 8);
+$red = imagecolorallocate($orig, 255, 0, 0);
+$green = imagecolorallocate($orig, 0, 255, 0);
+$blue = imagecolorallocate($orig, 0, 0, 255);
+
+imagefilledrectangle($orig, 0, 0, 3, 3, $green); // tl
+imagefilledrectangle($orig, 4, 0, 7, 3, $red);   // tr
+imagefilledrectangle($orig, 0, 4, 3, 7, $green); // bl
+imagefilledrectangle($orig, 4, 4, 7, 7, $blue);  // br
+
+$cropped = imagecropauto($orig, IMG_CROP_SIDES);
+var_dump(imagesx($cropped));
+
+imagefilledrectangle($orig, 0, 0, 3, 3, $red);   // tl
+imagefilledrectangle($orig, 4, 0, 7, 3, $green); // tr
+imagefilledrectangle($orig, 0, 4, 3, 7, $blue);  // bl
+imagefilledrectangle($orig, 4, 4, 7, 7, $green); // br
+
+$cropped = imagecropauto($orig, IMG_CROP_SIDES);
+var_dump(imagesx($cropped));
+
+?>
+===DONE===
+--EXPECT--
+int(4)
+int(4)
+===DONE===

ext/gd/tests/bug77269.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Bug #77269 (Potential unsigned underflow in gdImageScale)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (getenv("SKIP_SLOW_TESTS")) die("skip slow test");
+?>
+--INI--
+memory_limit=2G
+--FILE--
+<?php
+$im = imagecreate(2**28, 1);
+if(is_resource($im)) {
+	imagescale($im, 1, 1, IMG_TRIANGLE);
+}
+?>
+===DONE===
+--EXPECTF--
+Warning: imagescale():%S product of memory allocation multiplication would exceed INT_MAX, failing operation gracefully
+ in %s on line %d
+===DONE===

ext/gd/tests/bug77270.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #77270 (imagecolormatch Out Of Bounds Write on Heap)
+--INI--
+memory_limit=-1
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.5', '<=')) die('skip upstream bugfix has not been released');
+?>
+--FILE--
+<?php
+$img1 = imagecreatetruecolor(0xfff, 0xfff);
+$img2 = imagecreate(0xfff, 0xfff);
+imagecolorallocate($img2, 0, 0, 0);
+imagesetpixel($img2, 0, 0, 255);
+imagecolormatch($img1, $img2);
+?>
+===DONE===
+--EXPECT--
+===DONE===

ext/gd/tests/bug77272.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Bug #77272 (imagescale() may return image resource on failure)
+--INI--
+memory_limit=-1
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNGLED && version_compare(GD_VERSION, '2.2.5', '<=')) die('skip upstream fix not yet released');
+if (getenv("SKIP_SLOW_TESTS")) die("skip slow test");
+?>
+--FILE--
+<?php
+$img = imagecreate(2**28, 1);
+var_dump(imagescale($img, 1, 1, IMG_TRIANGLE));
+?>
+===DONE===
+--EXPECTF--
+Warning: imagescale():%S product of memory allocation multiplication would exceed INT_MAX, failing operation gracefully
+ in %s on line %d
+bool(false)
+===DONE===

ext/gd/tests/bug77391.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Bug #77391 (1bpp BMPs may fail to be loaded)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.5', '<=')) die('skip upstream not yet fixed');
+?>
+--FILE--
+<?php
+var_dump(imagecreatefrombmp(__DIR__ . '/bug77391.bmp'));
+?>
+===DONE===
+--EXPECTF--
+resource(%d) of type (gd)
+===DONE===

ext/gd/tests/bug77479.phpt

@@ -0,0 +1,26 @@
+--TEST--
+Bug #77479 (imagewbmp() segfaults with very large image)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (getenv("SKIP_SLOW_TESTS")) die("skip slow test");
+?>
+--INI--
+memory_limit=-1
+--FILE--
+<?php
+$im = imagecreate(40000, 20000);
+imagecolorallocate($im, 0, 0, 0);
+imagewbmp($im, __DIR__ . '/77479.wbmp');
+?>
+===DONE===
+--EXPECTF--
+Warning: imagewbmp(): gd warning: product of memory allocation multiplication would exceed INT_MAX, failing operation gracefully
+ in %s on line %d
+
+Warning: imagewbmp(): Could not create WBMP in %s on line %d
+===DONE===
+--CLEAN--
+<?php
+@unlink(__DIR__ . '/77479.wbmp');
+?>

ext/iconv/iconv.c

@@ -1537,7 +1537,11 @@ static php_iconv_err_t _php_iconv_mime_decode(smart_str *pretval, const char *st
 					default: /* first letter of a non-encoded word */
 						err = _php_iconv_appendc(pretval, *p1, cd_pl);
 						if (err != PHP_ICONV_ERR_SUCCESS) {
-							goto out;
+							if (mode & PHP_ICONV_MIME_DECODE_CONTINUE_ON_ERROR) {
+								err = PHP_ICONV_ERR_SUCCESS;
+							} else {
+								goto out;
+							}
 						}
 						encoded_word = NULL;
 						if ((mode & PHP_ICONV_MIME_DECODE_STRICT)) {

ext/iconv/tests/bug77147.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Bug #77147 (Fixing 60494 ignored ICONV_MIME_DECODE_CONTINUE_ON_ERROR)
+--SKIPIF--
+<?php
+if (!extension_loaded('iconv')) die('skip iconv extension not available');
+?>
+--FILE--
+<?php
+$string = <<<EOF
+Feedback-ID: 014a93e3-1f5e-4df6-b347-6b59f0f746b8:b5891053-55d1-45bc-a0b5-47a7a9b59687:email:epslh1�
+EOF;
+$headers = iconv_mime_decode_headers($string, ICONV_MIME_DECODE_CONTINUE_ON_ERROR);
+var_dump($headers);
+?>
+===DONE===
+--EXPECT--
+array(1) {
+  ["Feedback-ID"]=>
+  string(86) "014a93e3-1f5e-4df6-b347-6b59f0f746b8:b5891053-55d1-45bc-a0b5-47a7a9b59687:email:epslh1"
+}
+===DONE===

ext/imap/php_imap.c

@@ -562,6 +562,15 @@ static const zend_module_dep imap_deps[] = {
 };
 /* }}} */
 
+
+/* {{{ PHP_INI
+ */
+PHP_INI_BEGIN()
+STD_PHP_INI_BOOLEAN("imap.enable_insecure_rsh", "0", PHP_INI_SYSTEM, OnUpdateBool, enable_rsh, zend_imap_globals, imap_globals)
+PHP_INI_END()
+/* }}} */
+
+
 /* {{{ imap_module_entry
  */
 zend_module_entry imap_module_entry = {
@@ -832,6 +841,8 @@ PHP_MINIT_FUNCTION(imap)
 {
 	unsigned long sa_all =	SA_MESSAGES | SA_RECENT | SA_UNSEEN | SA_UIDNEXT | SA_UIDVALIDITY;
 
+	REGISTER_INI_ENTRIES();
+
 #ifndef PHP_WIN32
 	mail_link(&unixdriver);		/* link in the unix driver */
 	mail_link(&mhdriver);		/* link in the mh driver */
@@ -1049,6 +1060,12 @@ PHP_MINIT_FUNCTION(imap)
 	GC_TEXTS               texts
 	*/
 
+	if (!IMAPG(enable_rsh)) {
+		/* disable SSH and RSH, see https://bugs.php.net/bug.php?id=77153 */
+		mail_parameters (NIL, SET_RSHTIMEOUT, 0);
+		mail_parameters (NIL, SET_SSHTIMEOUT, 0);
+	}
+
 	le_imap = zend_register_list_destructors_ex(mail_close_it, NULL, "imap", module_number);
 	return SUCCESS;
 }
@@ -1136,6 +1153,8 @@ PHP_MINFO_FUNCTION(imap)
 	php_info_print_table_row(2, "Kerberos Support", "enabled");
 #endif
 	php_info_print_table_end();
+
+	DISPLAY_INI_ENTRIES();
 }
 /* }}} */
 
@@ -4106,7 +4125,6 @@ PHP_FUNCTION(imap_mail)
 	if (!ZSTR_LEN(message)) {
 		/* this is not really an error, so it is allowed. */
 		php_error_docref(NULL, E_WARNING, "No message string in mail command");
-		message = NULL;
 	}
 
 	if (_php_imap_mail(ZSTR_VAL(to), ZSTR_VAL(subject), ZSTR_VAL(message), headers?ZSTR_VAL(headers):NULL, cc?ZSTR_VAL(cc):NULL,

ext/imap/php_imap.h

@@ -231,6 +231,7 @@ ZEND_BEGIN_MODULE_GLOBALS(imap)
 #endif
 	/* php_stream for php_mail_gets() */
 	php_stream *gets_stream;
+	zend_bool enable_rsh;
 ZEND_END_MODULE_GLOBALS(imap)
 
 #ifdef ZTS

ext/imap/tests/bug77020.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Bug #77020 (null pointer dereference in imap_mail)
+--SKIPIF--
+<?php
+if (!extension_loaded('imap')) die('skip imap extension not available');
+?>
+--FILE--
+<?php
+imap_mail('1', 1, NULL);
+?>
+===DONE===
+--EXPECTF--
+Warning: imap_mail(): No message string in mail command in %s on line %d
+%s
+===DONE===

ext/imap/tests/bug77153.phpt

@@ -0,0 +1,24 @@
+--TEST--                                 
+Bug #77153 (imap_open allows to run arbitrary shell commands via mailbox parameter)
+--SKIPIF--
+<?php
+        if (!extension_loaded("imap")) { 
+                die("skip imap extension not available");  
+        }
+?>
+--FILE--
+<?php
+$payload = "echo 'BUG'> " . __DIR__ . '/__bug';
+$payloadb64 = base64_encode($payload);
+$server = "x -oProxyCommand=echo\t$payloadb64|base64\t-d|sh}";
+@imap_open('{'.$server.':143/imap}INBOX', '', '');
+// clean
+imap_errors();
+var_dump(file_exists(__DIR__ . '/__bug'));
+?>
+--EXPECT--
+bool(false)
+--CLEAN--
+<?php
+if(file_exists(__DIR__ . '/__bug')) unlink(__DIR__ . '/__bug');
+?>

ext/mbstring/mbstring.c

@@ -5260,11 +5260,9 @@ PHP_FUNCTION(mb_chr)
 /* }}} */
 
 
-static inline char* php_mb_scrub(const char* str, size_t str_len, const char* enc)
+static inline char* php_mb_scrub(const char* str, size_t str_len, const char* enc, size_t *ret_len)
 {
-	size_t ret_len;
-
-	return php_mb_convert_encoding(str, str_len, enc, enc, &ret_len);
+	return php_mb_convert_encoding(str, str_len, enc, enc, ret_len);
 }
 
 
@@ -5276,6 +5274,7 @@ PHP_FUNCTION(mb_scrub)
 	char *enc = NULL;
 	size_t enc_len;
 	char *ret;
+	size_t ret_len;
 
 	ZEND_PARSE_PARAMETERS_START(1, 2)
 		Z_PARAM_STRING(str, str_len)
@@ -5290,13 +5289,13 @@ PHP_FUNCTION(mb_scrub)
 		RETURN_FALSE;
 	}
 
-	ret = php_mb_scrub(str, str_len, enc);
+	ret = php_mb_scrub(str, str_len, enc, &ret_len);
 
 	if (ret == NULL) {
 		RETURN_FALSE;
 	}
 
-	RETVAL_STRING(ret);
+	RETVAL_STRINGL(ret, ret_len);
 	efree(ret);
 }
 /* }}} */

ext/mbstring/oniguruma/src/regcomp.c

@@ -469,13 +469,13 @@ compile_length_string_node(Node* node, regex_t* reg)
   ambig = NSTRING_IS_AMBIG(node);
 
   p = prev = sn->s;
-  prev_len = enclen(enc, p);
+  SAFE_ENC_LEN(enc, p, sn->end, prev_len);
   p += prev_len;
   slen = 1;
   rlen = 0;
 
   for (; p < sn->end; ) {
-    len = enclen(enc, p);
+    SAFE_ENC_LEN(enc, p, sn->end, len);
     if (len == prev_len) {
       slen++;
     }
@@ -518,12 +518,12 @@ compile_string_node(Node* node, regex_t* reg)
   ambig = NSTRING_IS_AMBIG(node);
 
   p = prev = sn->s;
-  prev_len = enclen(enc, p);
+  SAFE_ENC_LEN(enc, p, end, prev_len);
   p += prev_len;
   slen = 1;
 
   for (; p < end; ) {
-    len = enclen(enc, p);
+    SAFE_ENC_LEN(enc, p, end, len);
     if (len == prev_len) {
       slen++;
     }
@@ -3435,7 +3435,7 @@ expand_case_fold_string(Node* node, regex_t* reg)
       goto err;
     }
 
-    len = enclen(reg->enc, p);
+	SAFE_ENC_LEN(reg->enc, p, end, len);
 
     if (n == 0) {
       if (IS_NULL(snode)) {

ext/mbstring/oniguruma/src/regparse.c

@@ -304,14 +304,17 @@ strdup_with_null(OnigEncoding enc, UChar* s, UChar* end)
   c = ONIGENC_MBC_TO_CODE(enc, p, end); \
   pfetch_prev = p; \
   p += ONIGENC_MBC_ENC_LEN(enc, p); \
+  if(UNEXPECTED(p > end)) p = end; \
 } while (0)
 
 #define PINC_S     do { \
   p += ONIGENC_MBC_ENC_LEN(enc, p); \
+  if(UNEXPECTED(p > end)) p = end; \
 } while (0)
 #define PFETCH_S(c) do { \
   c = ONIGENC_MBC_TO_CODE(enc, p, end); \
   p += ONIGENC_MBC_ENC_LEN(enc, p); \
+  if(UNEXPECTED(p > end)) p = end; \
 } while (0)
 
 #define PPEEK        (p < end ? ONIGENC_MBC_TO_CODE(enc, p, end) : PEND_VALUE)
@@ -3593,7 +3596,9 @@ fetch_token(OnigToken* tok, UChar** src, UChar* end, ScanEnv* env)
           tok->u.code = c2;
         }
         else { /* string */
-          p = tok->backp + enclen(enc, tok->backp);
+          int len;
+          SAFE_ENC_LEN(enc, tok->backp, end, len);
+          p = tok->backp + len;
         }
       }
       break;

ext/mbstring/oniguruma/src/regparse.h

@@ -348,4 +348,16 @@ extern int onig_print_names(FILE*, regex_t*);
 #endif
 #endif
 
+#if (defined (__GNUC__) && __GNUC__ > 2 ) && !defined(DARWIN) && !defined(__hpux) && !defined(_AIX)
+# define UNEXPECTED(condition) __builtin_expect(condition, 0)
+#else
+# define UNEXPECTED(condition) (condition)
+#endif
+
+#define SAFE_ENC_LEN(enc, p, end, res) do {  \
+    int __res = enclen(enc, p);              \
+    if (UNEXPECTED(p + __res > end)) __res = end - p;    \
+	res = __res;                             \
+} while(0);
+
 #endif /* REGPARSE_H */

ext/mbstring/oniguruma/src/utf16_be.c

@@ -82,16 +82,18 @@ utf16be_is_mbc_newline(const UChar* p, const UChar* end)
 }
 
 static OnigCodePoint
-utf16be_mbc_to_code(const UChar* p, const UChar* end ARG_UNUSED)
+utf16be_mbc_to_code(const UChar* p, const UChar* end)
 {
   OnigCodePoint code;
 
   if (UTF16_IS_SURROGATE_FIRST(*p)) {
+    if (end - p < 4) return 0;
     code = ((((p[0] - 0xd8) << 2) + ((p[1] & 0xc0) >> 6) + 1) << 16)
          + ((((p[1] & 0x3f) << 2) + (p[2] - 0xdc)) << 8)
          + p[3];
   }
   else {
+    if (end - p < 2) return 0;
     code = p[0] * 256 + p[1];
   }
   return code;

ext/mbstring/oniguruma/src/utf16_le.c

@@ -97,13 +97,14 @@ utf16le_is_mbc_newline(const UChar* p, const UChar* end)
 }
 
 static OnigCodePoint
-utf16le_mbc_to_code(const UChar* p, const UChar* end ARG_UNUSED)
+utf16le_mbc_to_code(const UChar* p, const UChar* end)
 {
   OnigCodePoint code;
   UChar c0 = *p;
   UChar c1 = *(p+1);
 
   if (UTF16_IS_SURROGATE_FIRST(c1)) {
+    if (end - p < 4) return 0;
     code = ((((c1 - 0xd8) << 2) + ((c0  & 0xc0) >> 6) + 1) << 16)
          + ((((c0 & 0x3f) << 2) + (p[3] - 0xdc)) << 8)
          + p[2];

ext/mbstring/oniguruma/src/utf32_be.c

@@ -67,6 +67,7 @@ utf32be_is_mbc_newline(const UChar* p, const UChar* end)
 static OnigCodePoint
 utf32be_mbc_to_code(const UChar* p, const UChar* end ARG_UNUSED)
 {
+  if (end - p < 4) return 0;
   return (OnigCodePoint )(((p[0] * 256 + p[1]) * 256 + p[2]) * 256 + p[3]);
 }
 

ext/mbstring/oniguruma/src/utf32_le.c

@@ -67,6 +67,7 @@ utf32le_is_mbc_newline(const UChar* p, const UChar* end)
 static OnigCodePoint
 utf32le_mbc_to_code(const UChar* p, const UChar* end ARG_UNUSED)
 {
+  if (end - p < 4) return 0;
   return (OnigCodePoint )(((p[3] * 256 + p[2]) * 256 + p[1]) * 256 + p[0]);
 }
 

ext/mbstring/tests/bug77370.phpt

@@ -0,0 +1,11 @@
+--TEST--
+Bug #77370 (Buffer overflow on mb regex functions - fetch_token)
+--SKIPIF--
+<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+--FILE--
+<?php
+var_dump(mb_split("   \xfd",""));
+?>
+--EXPECTF--
+Warning: mb_split(): mbregex compile err: invalid code point value in %sbug77370.php on line %d
+bool(false)

ext/mbstring/tests/bug77371.phpt

@@ -0,0 +1,11 @@
+--TEST--
+Bug #77371 (heap buffer overflow in mb regex functions - compile_string_node)
+--SKIPIF--
+<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+--FILE--
+<?php
+var_dump(mb_ereg("()0\xfc00000\xfc00000\xfc00000\xfc",""));
+?>
+--EXPECTF--
+Warning: mb_ereg(): mbregex compile err: invalid code point value in %sbug77371.php on line %d
+bool(false)

ext/mbstring/tests/bug77381.phpt

@@ -0,0 +1,23 @@
+--TEST--
+Bug #77381 (heap buffer overflow in multibyte match_at)
+--SKIPIF--
+<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+--FILE--
+<?php
+var_dump(mb_ereg("000||0\xfa","0"));
+var_dump(mb_ereg("(?i)000000000000000000000\xf0",""));
+var_dump(mb_ereg("0000\\"."\xf5","0"));
+var_dump(mb_ereg("(?i)FFF00000000000000000\xfd",""));
+?>
+--EXPECTF--
+Warning: mb_ereg(): mbregex compile err: invalid code point value in %sbug77381.php on line %d
+bool(false)
+
+Warning: mb_ereg(): mbregex compile err: invalid code point value in %sbug77381.php on line %d
+bool(false)
+
+Warning: mb_ereg(): mbregex compile err: invalid code point value in %sbug77381.php on line %d
+bool(false)
+
+Warning: mb_ereg(): mbregex compile err: invalid code point value in %sbug77381.php on line %d
+bool(false)

ext/mbstring/tests/bug77418.phpt

@@ -0,0 +1,14 @@
+--TEST--
+Bug #77371 (Heap overflow in utf32be_mbc_to_code)
+--SKIPIF--
+<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+--FILE--
+<?php
+mb_regex_encoding("UTF-32");
+var_dump(mb_split("\x00\x00\x00\x5c\x00\x00\x00B","000000000000000000000000000000"));
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  string(30) "000000000000000000000000000000"
+}