Update version for PHP 7.3.2RC1

Merge branch 'PHP-7.2' into PHP-7.3
Checkin LiteSpeed SAPI 7.2.
2026-11-12 11:40:50 +00:00 · 2019-01-22 11:31:29 +00:00 · 2019-01-20 15:11:37 -05:00 · 2019-01-20 15:10:19 -05:00 · 2019-01-20 16:00:25 +01:00 · 2019-01-20 15:59:08 +01:00
157 changed files with 179160 additions and 168955 deletions
@@ -16,7 +16,7 @@ environment:
        PHP_BUILD_CACHE_BASE_DIR: c:\build-cache
        PHP_BUILD_OBJ_DIR: c:\obj
        PHP_BUILD_CACHE_SDK_DIR: c:\build-cache\sdk
-        PHP_BUILD_SDK_BRANCH: php-sdk-2.1.9beta1
+        PHP_BUILD_SDK_BRANCH: php-sdk-2.2.0beta1
        PHP_BUILD_CRT: vc15
        # ext and env setup for tests
        #MYSQL_TEST_PASSWD: Password12!
@@ -387,6 +387,7 @@ SINCE:               5.5.0
 EXTENSION:           openssl
 PRIMARY MAINTAINER:  Wez Furlong <wez@php.net> (2001 - 2006)
                     Pierre-Alain Joye <pajoye@php.net> (2006 - 2011)
+                     Jakub Zelenka <bukka@php.net> (2015 - 2019)
 MAINTENANCE:         Maintained
 STATUS:              Working
 SINCE:               4.0.4
@@ -1,6 +1,96 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? ????, PHP 7.3.1
+07 Feb 2019, PHP 7.3.2
+
+- Core:
+  . Fixed bug #77369 (memcpy with negative length via crafted DNS response). (Stas)
+  . Fixed bug #77387 (Recursion detection broken when printing GLOBALS).
+    (Laruence)
+  . Fixed bug #77376 ("undefined function" message no longer includes
+    namespace). (Laruence)
+  . Fixed bug #77357 (base64_encode / base64_decode doest not work on nested
+    VM). (Nikita)
+  . Fixed bug #77339 (__callStatic may get incorrect arguments). (Dmitry)
+  . Fixed bug #77317 (__DIR__, __FILE__, realpath() reveal physical path for
+    subst virtual drive). (Anatol)
+  . Fixed bug #77263 (Segfault when using 2 RecursiveFilterIterator). (Dmitry)
+  . Fixed bug #77447 (PHP 7.3 built with ASAN crashes in
+    zend_cpu_supports_avx2). (Nikita)
+  . Fixed bug #77484 (Zend engine crashes when calling realpath in invalid
+    working dir). (Anatol)
+
+- Curl:
+  . Fixed bug #76675 (Segfault with H2 server push). (Pedro Magalhães)
+
+- Fileinfo:
+  . Fixed bug #77346 (webm files incorrectly detected as
+    application/octet-stream). (Anatol)
+
+- FPM:
+  . Fixed bug #77430 (php-fpm crashes with Main process exited, code=dumped,
+    status=11/SEGV). (Jakub Zelenka)
+
+- GD:
+  . Fixed bug #73281 (imagescale(…, IMG_BILINEAR_FIXED) can cause black border).
+    (cmb)
+  . Fixed bug #73614 (gdImageFilledArc() doesn't properly draw pies). (cmb)
+  . Fixed bug #77272 (imagescale() may return image resource on failure). (cmb)
+  . Fixed bug #77391 (1bpp BMPs may fail to be loaded). (Romain Déoux, cmb)
+  . Fixed bug #77479 (imagewbmp() segfaults with very large images). (cmb)
+
+- ldap:
+  . Fixed bug #77440 (ldap_bind using ldaps or ldap_start_tls()=exception in
+    libcrypto-1_1-x64.dll). (Anatol)
+
+- Mbstring:
+  . Fixed bug #77428 (mb_ereg_replace() doesn't replace a substitution
+    variable). (Nikita)
+  . Fixed bug #77454 (mb_scrub() silently truncates after a null byte).
+    (64796c6e69 at gmail dot com)
+
+- MySQLnd:
+  . Fixed bug #77308 (Unbuffered queries memory leak). (Dmitry)
+  . Fixed bug #75684 (In mysqlnd_ext_plugin.h the plugin methods family has
+      no external visibility). (Anatol)
+
+- Opcache:
+  . Fixed bug #77266 (Assertion failed in dce_live_ranges). (Laruence)
+  . Fixed bug #77257 (value of variable assigned in a switch() construct gets
+    lost). (Nikita)
+  . Fixed bug #77434 (php-fpm workers are segfaulting in zend_gc_addre).
+    (Nikita)
+  . Fixed bug #77361 (configure fails on 64-bit AIX when opcache enabled).
+    (Kevin Adler)
+
+- PCRE:
+  . Fixed bug #77338 (get_browser with empty string). (Nikita)
+
+- PDO:
+  . Fixed bug #77273 (array_walk_recursive corrupts value types leading to PDO
+    failure). (Nikita)
+
+- PDO MySQL:
+  . Fixed bug #77289 (PDO MySQL segfaults with persistent connection).
+    (Lauri Kenttä)
+
+- SOAP:
+  . Fixed bug #77410 (Segmentation Fault when executing method with an empty
+    parameter). (Nikita)
+
+- Sockets:
+  . Fixed bug #76839 (socket_recvfrom may return an invalid 'from' address
+    on MacOS). (Michael Meyer)
+
+- SPL:
+  . Fixed bug #77298 (segfault occurs when add property to unserialized empty
+    ArrayObject). (jhdxr)
+
+- Standard:
+  . Fixed bug #77395 (segfault about array_multisort). (Laruence)
+  . Fixed bug #77439 (parse_str segfaults when inserting item into existing
+    array). (Nikita)
+
+10 Jan 2019, PHP 7.3.1

 - Core:
  . Fixed bug #76654 (Build failure on Mac OS X on 32-bit Intel). (Ryandesign)
@@ -27,6 +117,23 @@ PHP                                                                        NEWS
  . Fixed bug #77198 (auto cropping has insufficient precision). (cmb)
  . Fixed bug #77200 (imagecropauto(…, GD_CROP_SIDES) crops left but not right).
    (cmb)
+  . Fixed bug #77269 (efree() on uninitialized Heap data in imagescale leads to
+    use-after-free). (cmb)
+  . Fixed bug #77270 (imagecolormatch Out Of Bounds Write on Heap). (cmb)
+
+- MBString:
+  . Fixed bug #77367 (Negative size parameter in mb_split). (Stas)
+  . Fixed bug #77370 (Buffer overflow on mb regex functions - fetch_token).
+    (Stas)
+  . Fixed bug #77371 (heap buffer overflow in mb regex functions
+    - compile_string_node). (Stas)
+  . Fixed bug #77381 (heap buffer overflow in multibyte match_at). (Stas)
+  . Fixed bug #77382 (heap buffer overflow due to incorrect length in
+    expand_case_fold_string). (Stas)
+  . Fixed bug #77385 (buffer overflow in fetch_token). (Stas)
+  . Fixed bug #77394 (Buffer overflow in multibyte case folding - unicode).
+    (Stas)
+  . Fixed bug #77418 (Heap overflow in utf32be_mbc_to_code). (Stas)

 - OCI8:
  . Fixed bug #76804 (oci_pconnect with OCI_CRED_EXT not working). (KoenigsKind)
@@ -46,6 +153,9 @@ PHP                                                                        NEWS
  . Handle invalid index passed to PDOStatement::fetchColumn() as error. (Sergei
    Morozov)

+- Phar:
+  . Fixed bug #77247 (heap buffer overflow in phar_detect_phar_fname_ext). (Stas)
+
 - Soap:
  . Fixed bug #77088 (Segfault when using SoapClient with null options).
    (Laruence)
@@ -57,9 +167,17 @@ PHP                                                                        NEWS
 - Sodium:
  . Fixed bug #77297 (SodiumException segfaults on PHP 7.3). (Nikita, Scott)

+- SPL:
+  . Fixed bug #77359 (spl_autoload causes segfault). (Lauri Kenttä)
+  . Fixed bug #77360 (class_uses causes segfault). (Lauri Kenttä)
+
 - SQLite3:
  . Fixed bug #77051 (Issue with re-binding on SQLite3). (BohwaZ)

+- Xmlrpc:
+  . Fixed bug #77242 (heap out of bounds read in xmlrpc_decode()). (cmb)
+  . Fixed bug #77380 (Global out of bounds read in xmlrpc base64 code). (Stas)
+
 06 Dec 2018, PHP 7.3.0

 - Core:
@@ -215,6 +333,7 @@ PHP                                                                        NEWS
    (cmb)

 - IMAP:
+  . Fixed bug #77020 (null pointer dereference in imap_mail). (cmb)
  . Fixed bug #77153 (imap_open allows to run arbitrary shell commands via
    mailbox parameter). (Stas)

@@ -45,6 +45,13 @@ elseif (PHP_OS == 'FreeBSD') {
  if ($freeMemory < 2100*1024*1024) {
    die('skip Not enough memory.');
  }
+} elseif (PHP_OS == "WINNT") {
+  $s = trim(shell_exec("wmic OS get FreeVirtualMemory /Value 2>nil"));
+  $freeMemory = explode('=', $s)[1]*1;
+
+  if ($freeMemory < 2.1*1024*1024) {
+    die('skip Not enough memory.');
+  }
 }
 ?>
 --INI--
@@ -0,0 +1,15 @@
+--TEST--
+Bug #75426: "Cannot use empty array elements" reports wrong position
+--FILE--
+<?php
+$a = [
+    1,
+    2,
+    3,
+    ,
+    5,
+    6,
+];
+?>
+--EXPECTF--
+Fatal error: Cannot use empty array elements in arrays in %s on line 5
@@ -0,0 +1,33 @@
+--TEST--
+Bug #77339 (__callStatic may get incorrect arguments)
+--FILE--
+<?php
+class Foo
+{
+    static function __callStatic($name, $arguments) {
+       if ($name === 'get') {
+            if (!isset($arguments[0])) {
+                var_dump(['getSomeWhat']);
+                var_dump($arguments);
+                exit;
+            }
+        } 
+        echo "OK\n";
+    }
+
+    protected function get ($key) {
+        echo "BUG!!!\n";
+    }
+}
+
+class Bar
+{
+    static function __callStatic($name, $arguments) {
+        echo Foo::get('getSomeWhat');
+    }
+}
+
+Bar::someUndefinedStaticFunction();
+?>
+--EXPECT--
+OK
@@ -0,0 +1,12 @@
+--TEST--
+Bug #77376 ("undefined function" message no longer includes namespace)
+--FILE--
+<?php
+namespace Hello;
+World();
+?>
+--EXPECTF--
+Fatal error: Uncaught Error: Call to undefined function Hello\World() %sbug77376.php:%d
+Stack trace:
+#0 {main}
+  thrown in %sbug77376.php on line %d 
@@ -0,0 +1,23 @@
+--TEST--
+Use of self::class inside a constant in an unknown scope
+--FILE--
+<?php
+
+class Test {
+    public function foobar() {
+        eval("
+            const FOO = self::class;
+            var_dump(FOO);
+        ");
+    }
+}
+(new Test)->foobar();
+
+// This should error, but doesn't
+const BAR = self::class;
+var_dump(BAR);
+
+?>
+--EXPECT--
+string(4) "Test"
+string(0) ""
@@ -373,17 +373,17 @@ ZEND_API void zend_print_flat_zval_r(zval *expr) /* {{{ */
 	switch (Z_TYPE_P(expr)) {
 		case IS_ARRAY:
 			ZEND_PUTS("Array (");
-			if (Z_REFCOUNTED_P(expr)) {
-				if (Z_IS_RECURSIVE_P(expr)) {
+			if (!(GC_FLAGS(Z_ARRVAL_P(expr)) & GC_IMMUTABLE)) {
+				if (GC_IS_RECURSIVE(Z_ARRVAL_P(expr))) {
 					ZEND_PUTS(" *RECURSION*");
 					return;
 				}
-				Z_PROTECT_RECURSION_P(expr);
+				GC_PROTECT_RECURSION(Z_ARRVAL_P(expr));
 			}
 			print_flat_hash(Z_ARRVAL_P(expr));
 			ZEND_PUTS(")");
-			if (Z_REFCOUNTED_P(expr)) {
-				Z_UNPROTECT_RECURSION_P(expr);
+			if (!(GC_FLAGS(Z_ARRVAL_P(expr)) & GC_IMMUTABLE)) {
+				GC_UNPROTECT_RECURSION(Z_ARRVAL_P(expr));
 			}
 			break;
 		case IS_OBJECT:
@@ -393,7 +393,7 @@ ZEND_API void zend_print_flat_zval_r(zval *expr) /* {{{ */
 			zend_printf("%s Object (", ZSTR_VAL(class_name));
 			zend_string_release_ex(class_name, 0);

-			if (Z_IS_RECURSIVE_P(expr)) {
+			if (GC_IS_RECURSIVE(Z_OBJ_P(expr))) {
 				ZEND_PUTS(" *RECURSION*");
 				return;
 			}
@@ -402,9 +402,9 @@ ZEND_API void zend_print_flat_zval_r(zval *expr) /* {{{ */
 				properties = Z_OBJPROP_P(expr);
 			}
 			if (properties) {
-				Z_PROTECT_RECURSION_P(expr);
+				GC_PROTECT_RECURSION(Z_OBJ_P(expr));
 				print_flat_hash(properties);
-				Z_UNPROTECT_RECURSION_P(expr);
+				GC_UNPROTECT_RECURSION(Z_OBJ_P(expr));
 			}
 			ZEND_PUTS(")");
 			break;
@@ -424,16 +424,16 @@ static void zend_print_zval_r_to_buf(smart_str *buf, zval *expr, int indent) /*
 	switch (Z_TYPE_P(expr)) {
 		case IS_ARRAY:
 			smart_str_appends(buf, "Array\n");
-			if (Z_REFCOUNTED_P(expr)) {
-				if (Z_IS_RECURSIVE_P(expr)) {
+			if (!(GC_FLAGS(Z_ARRVAL_P(expr)) & GC_IMMUTABLE)) {
+				if (GC_IS_RECURSIVE(Z_ARRVAL_P(expr))) {
 					smart_str_appends(buf, " *RECURSION*");
 					return;
 				}
-				Z_PROTECT_RECURSION_P(expr);
+				GC_PROTECT_RECURSION(Z_ARRVAL_P(expr));
 			}
 			print_hash(buf, Z_ARRVAL_P(expr), indent, 0);
-			if (Z_REFCOUNTED_P(expr)) {
-				Z_UNPROTECT_RECURSION_P(expr);
+			if (!(GC_FLAGS(Z_ARRVAL_P(expr)) & GC_IMMUTABLE)) {
+				GC_UNPROTECT_RECURSION(Z_ARRVAL_P(expr));
 			}
 			break;
 		case IS_OBJECT:
@@ -446,7 +446,7 @@ static void zend_print_zval_r_to_buf(smart_str *buf, zval *expr, int indent) /*
 				zend_string_release_ex(class_name, 0);

 				smart_str_appends(buf, " Object\n");
-				if (Z_IS_RECURSIVE_P(expr)) {
+				if (GC_IS_RECURSIVE(Z_OBJ_P(expr))) {
 					smart_str_appends(buf, " *RECURSION*");
 					return;
 				}
@@ -454,9 +454,9 @@ static void zend_print_zval_r_to_buf(smart_str *buf, zval *expr, int indent) /*
 					break;
 				}

-				Z_PROTECT_RECURSION_P(expr);
+				GC_PROTECT_RECURSION(Z_OBJ_P(expr));
 				print_hash(buf, properties, indent, 1);
-				Z_UNPROTECT_RECURSION_P(expr);
+				GC_UNPROTECT_RECURSION(Z_OBJ_P(expr));

 				if (is_temp) {
 					zend_hash_destroy(properties);
@@ -20,7 +20,7 @@
 #ifndef ZEND_H
 #define ZEND_H

-#define ZEND_VERSION "3.3.1-dev"
+#define ZEND_VERSION "3.3.2RC1"

 #define ZEND_ENGINE_3

@@ -726,7 +726,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_exception(int num, cha
 		char *_error = NULL; \
 		zend_bool _dummy; \
 		zend_bool _optional = 0; \
-		int error_code = ZPP_ERROR_OK; \
+		int _error_code = ZPP_ERROR_OK; \
 		((void)_i); \
 		((void)_real_arg); \
 		((void)_arg); \
@@ -746,7 +746,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_exception(int num, cha
 						zend_wrong_parameters_count_error(_min_num_args, _max_num_args); \
 					} \
 				} \
-				error_code = ZPP_ERROR_FAILURE; \
+				_error_code = ZPP_ERROR_FAILURE; \
 				break; \
 			} \
 			_i = 0; \
@@ -764,21 +764,21 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_exception(int num, cha

 #define ZEND_PARSE_PARAMETERS_END_EX(failure) \
 		} while (0); \
-		if (UNEXPECTED(error_code != ZPP_ERROR_OK)) { \
+		if (UNEXPECTED(_error_code != ZPP_ERROR_OK)) { \
 			if (!(_flags & ZEND_PARSE_PARAMS_QUIET)) { \
-				if (error_code == ZPP_ERROR_WRONG_CALLBACK) { \
+				if (_error_code == ZPP_ERROR_WRONG_CALLBACK) { \
 					if (_flags & ZEND_PARSE_PARAMS_THROW) { \
 						zend_wrong_callback_exception(_i, _error); \
 					} else { \
 						zend_wrong_callback_error(_i, _error); \
 					} \
-				} else if (error_code == ZPP_ERROR_WRONG_CLASS) { \
+				} else if (_error_code == ZPP_ERROR_WRONG_CLASS) { \
 					if (_flags & ZEND_PARSE_PARAMS_THROW) { \
 						zend_wrong_parameter_class_exception(_i, _error, _arg); \
 					} else { \
 						zend_wrong_parameter_class_error(_i, _error, _arg); \
 					} \
-				} else if (error_code == ZPP_ERROR_WRONG_ARG) { \
+				} else if (_error_code == ZPP_ERROR_WRONG_ARG) { \
 					if (_flags & ZEND_PARSE_PARAMS_THROW) { \
 						zend_wrong_parameter_type_exception(_i, _expected_type, _arg); \
 					} else { \
@@ -818,7 +818,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_exception(int num, cha
 		Z_PARAM_PROLOGUE(deref, separate); \
 		if (UNEXPECTED(!zend_parse_arg_array(_arg, &dest, check_null, 0))) { \
 			_expected_type = Z_EXPECTED_ARRAY; \
-			error_code = ZPP_ERROR_WRONG_ARG; \
+			_error_code = ZPP_ERROR_WRONG_ARG; \
 			break; \
 		}

@@ -833,7 +833,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_exception(int num, cha
 		Z_PARAM_PROLOGUE(deref, separate); \
 		if (UNEXPECTED(!zend_parse_arg_array(_arg, &dest, check_null, 1))) { \
 			_expected_type = Z_EXPECTED_ARRAY; \
-			error_code = ZPP_ERROR_WRONG_ARG; \
+			_error_code = ZPP_ERROR_WRONG_ARG; \
 			break; \
 		}

@@ -848,7 +848,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_exception(int num, cha
 		Z_PARAM_PROLOGUE(deref, separate); \
 		if (UNEXPECTED(!zend_parse_arg_bool(_arg, &dest, &is_null, check_null))) { \
 			_expected_type = Z_EXPECTED_BOOL; \
-			error_code = ZPP_ERROR_WRONG_ARG; \
+			_error_code = ZPP_ERROR_WRONG_ARG; \
 			break; \
 		}

@@ -862,7 +862,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_exception(int num, cha
 #define Z_PARAM_CLASS_EX2(dest, check_null, deref, separate) \
 		Z_PARAM_PROLOGUE(deref, separate); \
 		if (UNEXPECTED(!zend_parse_arg_class(_arg, &dest, _i, check_null))) { \
-			error_code = ZPP_ERROR_FAILURE; \
+			_error_code = ZPP_ERROR_FAILURE; \
 			break; \
 		}

@@ -877,7 +877,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_exception(int num, cha
 		Z_PARAM_PROLOGUE(deref, separate); \
 		if (UNEXPECTED(!zend_parse_arg_double(_arg, &dest, &is_null, check_null))) { \
 			_expected_type = Z_EXPECTED_DOUBLE; \
-			error_code = ZPP_ERROR_WRONG_ARG; \
+			_error_code = ZPP_ERROR_WRONG_ARG; \
 			break; \
 		}

@@ -893,10 +893,10 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_exception(int num, cha
 		if (UNEXPECTED(!zend_parse_arg_func(_arg, &dest_fci, &dest_fcc, check_null, &_error))) { \
 			if (!_error) { \
 				_expected_type = Z_EXPECTED_FUNC; \
-				error_code = ZPP_ERROR_WRONG_ARG; \
+				_error_code = ZPP_ERROR_WRONG_ARG; \
 				break; \
 			} else { \
-				error_code = ZPP_ERROR_WRONG_CALLBACK; \
+				_error_code = ZPP_ERROR_WRONG_CALLBACK; \
 				break; \
 			} \
 		} else if (UNEXPECTED(_error != NULL)) { \
@@ -914,7 +914,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_exception(int num, cha
 		Z_PARAM_PROLOGUE(deref, separate); \
 		if (UNEXPECTED(!zend_parse_arg_array_ht(_arg, &dest, check_null, 0, separate))) { \
 			_expected_type = Z_EXPECTED_ARRAY; \
-			error_code = ZPP_ERROR_WRONG_ARG; \
+			_error_code = ZPP_ERROR_WRONG_ARG; \
 			break; \
 		}

@@ -929,7 +929,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_exception(int num, cha
 		Z_PARAM_PROLOGUE(deref, separate); \
 		if (UNEXPECTED(!zend_parse_arg_array_ht(_arg, &dest, check_null, 1, separate))) { \
 			_expected_type = Z_EXPECTED_ARRAY; \
-			error_code = ZPP_ERROR_WRONG_ARG; \
+			_error_code = ZPP_ERROR_WRONG_ARG; \
 			break; \
 		}

@@ -944,7 +944,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_exception(int num, cha
 		Z_PARAM_PROLOGUE(deref, separate); \
 		if (UNEXPECTED(!zend_parse_arg_long(_arg, &dest, &is_null, check_null, 0))) { \
 			_expected_type = Z_EXPECTED_LONG; \
-			error_code = ZPP_ERROR_WRONG_ARG; \
+			_error_code = ZPP_ERROR_WRONG_ARG; \
 			break; \
 		}

@@ -959,7 +959,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_exception(int num, cha
 		Z_PARAM_PROLOGUE(deref, separate); \
 		if (UNEXPECTED(!zend_parse_arg_long(_arg, &dest, &is_null, check_null, 1))) { \
 			_expected_type = Z_EXPECTED_LONG; \
-			error_code = ZPP_ERROR_WRONG_ARG; \
+			_error_code = ZPP_ERROR_WRONG_ARG; \
 			break; \
 		}

@@ -974,7 +974,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_exception(int num, cha
 		Z_PARAM_PROLOGUE(deref, separate); \
 		if (UNEXPECTED(!zend_parse_arg_object(_arg, &dest, NULL, check_null))) { \
 			_expected_type = Z_EXPECTED_OBJECT; \
-			error_code = ZPP_ERROR_WRONG_ARG; \
+			_error_code = ZPP_ERROR_WRONG_ARG; \
 			break; \
 		}

@@ -990,11 +990,11 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_exception(int num, cha
 		if (UNEXPECTED(!zend_parse_arg_object(_arg, &dest, _ce, check_null))) { \
 			if (_ce) { \
 				_error = ZSTR_VAL((_ce)->name); \
-				error_code = ZPP_ERROR_WRONG_CLASS; \
+				_error_code = ZPP_ERROR_WRONG_CLASS; \
 				break; \
 			} else { \
 				_expected_type = Z_EXPECTED_OBJECT; \
-				error_code = ZPP_ERROR_WRONG_ARG; \
+				_error_code = ZPP_ERROR_WRONG_ARG; \
 				break; \
 			} \
 		}
@@ -1010,7 +1010,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_exception(int num, cha
 		Z_PARAM_PROLOGUE(deref, separate); \
 		if (UNEXPECTED(!zend_parse_arg_path(_arg, &dest, &dest_len, check_null))) { \
 			_expected_type = Z_EXPECTED_PATH; \
-			error_code = ZPP_ERROR_WRONG_ARG; \
+			_error_code = ZPP_ERROR_WRONG_ARG; \
 			break; \
 		}

@@ -1025,7 +1025,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_exception(int num, cha
 		Z_PARAM_PROLOGUE(deref, separate); \
 		if (UNEXPECTED(!zend_parse_arg_path_str(_arg, &dest, check_null))) { \
 			_expected_type = Z_EXPECTED_PATH; \
-			error_code = ZPP_ERROR_WRONG_ARG; \
+			_error_code = ZPP_ERROR_WRONG_ARG; \
 			break; \
 		}

@@ -1040,7 +1040,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_exception(int num, cha
 		Z_PARAM_PROLOGUE(deref, separate); \
 		if (UNEXPECTED(!zend_parse_arg_resource(_arg, &dest, check_null))) { \
 			_expected_type = Z_EXPECTED_RESOURCE; \
-			error_code = ZPP_ERROR_WRONG_ARG; \
+			_error_code = ZPP_ERROR_WRONG_ARG; \
 			break; \
 		}

@@ -1055,7 +1055,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_exception(int num, cha
 		Z_PARAM_PROLOGUE(deref, separate); \
 		if (UNEXPECTED(!zend_parse_arg_string(_arg, &dest, &dest_len, check_null))) { \
 			_expected_type = Z_EXPECTED_STRING; \
-			error_code = ZPP_ERROR_WRONG_ARG; \
+			_error_code = ZPP_ERROR_WRONG_ARG; \
 			break; \
 		}

@@ -1070,7 +1070,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_exception(int num, cha
 		Z_PARAM_PROLOGUE(deref, separate); \
 		if (UNEXPECTED(!zend_parse_arg_str(_arg, &dest, check_null))) { \
 			_expected_type = Z_EXPECTED_STRING; \
-			error_code = ZPP_ERROR_WRONG_ARG; \
+			_error_code = ZPP_ERROR_WRONG_ARG; \
 			break; \
 		}

@@ -1499,7 +1499,7 @@ static zend_bool zend_try_compile_const_expr_resolve_class_name(zval *zv, zend_a

 	switch (fetch_type) {
 		case ZEND_FETCH_CLASS_SELF:
-			if (constant || (CG(active_class_entry) && zend_is_scope_known())) {
+			if (CG(active_class_entry) && zend_is_scope_known()) {
 				ZVAL_STR_COPY(zv, CG(active_class_entry)->name);
 			} else {
 				ZVAL_NULL(zv);
@@ -4153,6 +4153,14 @@ void zend_compile_static_call(znode *result, zend_ast *ast, uint32_t type) /* {{
 		if (ce) {
 			zend_string *lcname = Z_STR_P(CT_CONSTANT(opline->op2) + 1);
 			fbc = zend_hash_find_ptr(&ce->function_table, lcname);
+			if (fbc && !(fbc->common.fn_flags & ZEND_ACC_PUBLIC)) {
+				if (ce != CG(active_class_entry)
+				 &&((fbc->common.fn_flags & ZEND_ACC_PRIVATE)
+				  || !zend_check_protected(zend_get_function_root_class(fbc), CG(active_class_entry)))) {
+					/* incompatibe function */
+					fbc = NULL;
+				}
+			}
 		}
 	}

@@ -6987,6 +6995,7 @@ static inline void zend_ct_eval_greater(zval *result, zend_ast_kind kind, zval *
 static zend_bool zend_try_ct_eval_array(zval *result, zend_ast *ast) /* {{{ */
 {
 	zend_ast_list *list = zend_ast_get_list(ast);
+	zend_ast *last_elem_ast = NULL;
 	uint32_t i;
 	zend_bool is_constant = 1;

@@ -6999,6 +7008,10 @@ static zend_bool zend_try_ct_eval_array(zval *result, zend_ast *ast) /* {{{ */
 		zend_ast *elem_ast = list->child[i];

 		if (elem_ast == NULL) {
+			/* Report error at line of last non-empty element */
+			if (last_elem_ast) {
+				CG(zend_lineno) = zend_ast_get_lineno(last_elem_ast);
+			}
 			zend_error(E_COMPILE_ERROR, "Cannot use empty array elements in arrays");
 		}

@@ -7010,6 +7023,8 @@ static zend_bool zend_try_ct_eval_array(zval *result, zend_ast *ast) /* {{{ */
 		) {
 			is_constant = 0;
 		}
+
+		last_elem_ast = elem_ast;
 	}

 	if (!is_constant) {
@@ -8071,9 +8086,7 @@ void zend_compile_const_expr_magic_const(zend_ast **ast_ptr) /* {{{ */
 	zend_ast *ast = *ast_ptr;

 	/* Other cases already resolved by constant folding */
-	ZEND_ASSERT(ast->attr == T_CLASS_C &&
-	            CG(active_class_entry) &&
-	            (CG(active_class_entry)->ce_flags & ZEND_ACC_TRAIT) != 0);
+	ZEND_ASSERT(ast->attr == T_CLASS_C);

 	zend_ast_destroy(ast);
 	*ast_ptr = zend_ast_create(ZEND_AST_CONSTANT_CLASS);
@@ -77,16 +77,24 @@ void zend_cpu_startup(void)
 {
 	if (!cpuinfo.initialized) {
 		zend_cpu_info ebx;
+		int max_feature;

 		cpuinfo.initialized = 1;
 		__zend_cpuid(0, 0, &cpuinfo);
-		if (cpuinfo.eax == 0) {
+		max_feature = cpuinfo.eax;
+		if (max_feature == 0) {
 			return;
 		}
+
 		__zend_cpuid(1, 0, &cpuinfo);
+
 		/* for avx2 */
-		__zend_cpuid(7, 0, &ebx);
-		cpuinfo.ebx = ebx.ebx;
+		if (max_feature >= 7) {
+			__zend_cpuid(7, 0, &ebx);
+			cpuinfo.ebx = ebx.ebx;
+		} else {
+			cpuinfo.ebx = 0;
+		}
 	}
 }

@@ -100,12 +100,22 @@ typedef enum _zend_cpu_feature {
 void zend_cpu_startup();
 ZEND_API int zend_cpu_supports(zend_cpu_feature feature);

+/* Address sanitizer is incompatible with ifunc resolvers, so exclude the
+ * CPU support helpers from asan.
+ * See also https://github.com/google/sanitizers/issues/342. */
+#if __has_attribute(no_sanitize_address)
+# define ZEND_NO_SANITIZE_ADDRESS __attribute__((no_sanitize_address))
+#else
+# define ZEND_NO_SANITIZE_ADDRESS
+#endif
+
 #if PHP_HAVE_BUILTIN_CPU_SUPPORTS
 /* NOTE: you should use following inline function in
 * resolver functions (ifunc), as it could be called
 * before all PLT symbols are resloved. in other words,
 * resolver functions should not depends any external
 * functions */
+ZEND_NO_SANITIZE_ADDRESS
 static zend_always_inline int zend_cpu_supports_sse2() {
 #if PHP_HAVE_BUILTIN_CPU_INIT
 	__builtin_cpu_init();
@@ -113,6 +123,7 @@ static zend_always_inline int zend_cpu_supports_sse2() {
 	return __builtin_cpu_supports("sse2");
 }

+ZEND_NO_SANITIZE_ADDRESS
 static zend_always_inline int zend_cpu_supports_sse3() {
 #if PHP_HAVE_BUILTIN_CPU_INIT
 	__builtin_cpu_init();
@@ -120,6 +131,7 @@ static zend_always_inline int zend_cpu_supports_sse3() {
 	return __builtin_cpu_supports("sse3");
 }

+ZEND_NO_SANITIZE_ADDRESS
 static zend_always_inline int zend_cpu_supports_ssse3() {
 #if PHP_HAVE_BUILTIN_CPU_INIT
 	__builtin_cpu_init();
@@ -127,6 +139,7 @@ static zend_always_inline int zend_cpu_supports_ssse3() {
 	return __builtin_cpu_supports("ssse3");
 }

+ZEND_NO_SANITIZE_ADDRESS
 static zend_always_inline int zend_cpu_supports_sse41() {
 #if PHP_HAVE_BUILTIN_CPU_INIT
 	__builtin_cpu_init();
@@ -134,6 +147,7 @@ static zend_always_inline int zend_cpu_supports_sse41() {
 	return __builtin_cpu_supports("sse4.1");
 }

+ZEND_NO_SANITIZE_ADDRESS
 static zend_always_inline int zend_cpu_supports_sse42() {
 #if PHP_HAVE_BUILTIN_CPU_INIT
 	__builtin_cpu_init();
@@ -141,6 +155,7 @@ static zend_always_inline int zend_cpu_supports_sse42() {
 	return __builtin_cpu_supports("sse4.2");
 }

+ZEND_NO_SANITIZE_ADDRESS
 static zend_always_inline int zend_cpu_supports_avx() {
 #if PHP_HAVE_BUILTIN_CPU_INIT
 	__builtin_cpu_init();
@@ -148,6 +163,7 @@ static zend_always_inline int zend_cpu_supports_avx() {
 	return __builtin_cpu_supports("avx");
 }

+ZEND_NO_SANITIZE_ADDRESS
 static zend_always_inline int zend_cpu_supports_avx2() {
 #if PHP_HAVE_BUILTIN_CPU_INIT
 	__builtin_cpu_init();
@@ -170,9 +170,9 @@ ZEND_API const zend_internal_function zend_pass_function = {

 #define ZEND_VM_STACK_PAGE_SIZE  (ZEND_VM_STACK_PAGE_SLOTS * sizeof(zval))

-#define ZEND_VM_STACK_PAGE_ALIGNED_SIZE(size) \
+#define ZEND_VM_STACK_PAGE_ALIGNED_SIZE(size, page_size) \
 	(((size) + ZEND_VM_STACK_HEADER_SLOTS * sizeof(zval) \
-	  + (ZEND_VM_STACK_PAGE_SIZE - 1)) & ~(ZEND_VM_STACK_PAGE_SIZE - 1))
+	  + ((page_size) - 1)) & ~((page_size) - 1))

 static zend_always_inline zend_vm_stack zend_vm_stack_new_page(size_t size, zend_vm_stack prev) {
 	zend_vm_stack page = (zend_vm_stack)emalloc(size);
@@ -192,6 +192,16 @@ ZEND_API void zend_vm_stack_init(void)
 	EG(vm_stack_end) = EG(vm_stack)->end;
 }

+ZEND_API void zend_vm_stack_init_ex(size_t page_size)
+{
+	/* page_size must be a power of 2 */
+	ZEND_ASSERT(page_size > 0 && (page_size & (page_size - 1)) == 0);
+	EG(vm_stack_page_size) = page_size;
+	EG(vm_stack) = zend_vm_stack_new_page(page_size, NULL);
+	EG(vm_stack_top) = EG(vm_stack)->top;
+	EG(vm_stack_end) = EG(vm_stack)->end;
+}
+
 ZEND_API void zend_vm_stack_destroy(void)
 {
 	zend_vm_stack stack = EG(vm_stack);
@@ -212,7 +222,7 @@ ZEND_API void* zend_vm_stack_extend(size_t size)
 	stack->top = EG(vm_stack_top);
 	EG(vm_stack) = stack = zend_vm_stack_new_page(
 		EXPECTED(size < EG(vm_stack_page_size) - (ZEND_VM_STACK_HEADER_SLOTS * sizeof(zval))) ?
-			EG(vm_stack_page_size) : ZEND_VM_STACK_PAGE_ALIGNED_SIZE(size),
+			EG(vm_stack_page_size) : ZEND_VM_STACK_PAGE_ALIGNED_SIZE(size, EG(vm_stack_page_size)),
 		stack);
 	ptr = stack->top;
 	EG(vm_stack_top) = (void*)(((char*)ptr) + size);
@@ -168,6 +168,7 @@ struct _zend_vm_stack {
 #endif

 ZEND_API void zend_vm_stack_init(void);
+ZEND_API void zend_vm_stack_init_ex(size_t page_size);
 ZEND_API void zend_vm_stack_destroy(void);
 ZEND_API void* zend_vm_stack_extend(size_t size);

@@ -764,7 +764,7 @@ static size_t tsrm_realpath_r(char *path, size_t start, size_t len, int *ll, tim
 		if (i == len ||
 			(i + 1 == len && path[i] == '.')) {
 			/* remove double slashes and '.' */
-			len = i - 1;
+			len = EXPECTED(i > 0) ? i - 1 : 0;
 			is_dir = 1;
 			continue;
 		} else if (i + 2 == len && path[i] == '.' && path[i+1] == '.') {
@@ -1207,40 +1207,6 @@ static size_t tsrm_realpath_r(char *path, size_t start, size_t len, int *ll, tim
 }
 /* }}} */

-#ifdef ZEND_WIN32
-static size_t tsrm_win32_realpath_quick(char *path, size_t len, time_t *t) /* {{{ */
-{
-	char tmp_resolved_path[MAXPATHLEN];
-	int tmp_resolved_path_len;
-	BY_HANDLE_FILE_INFORMATION info;
-	realpath_cache_bucket *bucket;
-
-	if (!*t) {
-		*t = time(0);
-	}
-
-	if (CWDG(realpath_cache_size_limit) && (bucket = realpath_cache_find(path, len, *t)) != NULL) {
-		memcpy(path, bucket->realpath, bucket->realpath_len + 1);
-		return bucket->realpath_len;
-	}
-
-	if (!php_win32_ioutil_realpath_ex0(path, tmp_resolved_path, &info)) {
-		DWORD err = GetLastError();
-		SET_ERRNO_FROM_WIN32_CODE(err);
-		return (size_t)-1;
-	}
-
-	tmp_resolved_path_len = strlen(tmp_resolved_path);
-	if (CWDG(realpath_cache_size_limit)) {
-		realpath_cache_add(path, len, tmp_resolved_path, tmp_resolved_path_len, info.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY, *t);
-	}
-	memmove(path, tmp_resolved_path, tmp_resolved_path_len + 1);
-
-	return tmp_resolved_path_len;
-}
-/* }}} */
-#endif
-
 /* Resolve path relatively to state and put the real path into state */
 /* returns 0 for ok, 1 for error */
 CWD_API int virtual_file_ex(cwd_state *state, const char *path, verify_path_func verify_path, int use_realpath) /* {{{ */
@@ -1368,27 +1334,7 @@ CWD_API int virtual_file_ex(cwd_state *state, const char *path, verify_path_func

 	add_slash = (use_realpath != CWD_REALPATH) && path_length > 0 && IS_SLASH(resolved_path[path_length-1]);
 	t = CWDG(realpath_cache_ttl) ? 0 : -1;
-#ifdef ZEND_WIN32
-	if (CWD_EXPAND != use_realpath) {
-		size_t tmp_len = tsrm_win32_realpath_quick(resolved_path, path_length, &t);
-		if ((size_t)-1 != tmp_len) {
-			path_length = tmp_len;
-		} else {
-			DWORD err = GetLastError();
-			/* The access denied error can mean something completely else,
-				fallback to complicated way. */
-			if (CWD_REALPATH == use_realpath && ERROR_ACCESS_DENIED != err) {
-				SET_ERRNO_FROM_WIN32_CODE(err);
-				return 1;
-			}
-			path_length = tsrm_realpath_r(resolved_path, start, path_length, &ll, &t, use_realpath, 0, NULL);
-		}
-	} else {
-		path_length = tsrm_realpath_r(resolved_path, start, path_length, &ll, &t, use_realpath, 0, NULL);
-	}
-#else
 	path_length = tsrm_realpath_r(resolved_path, start, path_length, &ll, &t, use_realpath, 0, NULL);
-#endif

 	if (path_length == (size_t)-1) {
 		errno = ENOENT;
@@ -3099,6 +3099,10 @@ ZEND_VM_HOT_OBJ_HANDLER(112, ZEND_INIT_METHOD_CALL, CONST|TMPVAR|UNUSED|THIS|CV,
 		    EXPECTED(obj == orig_obj)) {
 			CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
 		}
+		if ((OP1_TYPE & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+			/* Reset "object" to trigger reference counting */
+			object = NULL;
+		}
 		if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
 			init_func_run_time_cache(&fbc->op_array);
 		}
@@ -3443,11 +3447,10 @@ ZEND_VM_HOT_HANDLER(69, ZEND_INIT_NS_FCALL_BY_NAME, ANY, CONST, NUM|CACHE_SLOT)

 	fbc = CACHED_PTR(opline->result.num);
 	if (UNEXPECTED(fbc == NULL)) {
-		func_name = RT_CONSTANT(opline, opline->op2) + 1;
-		func = zend_hash_find_ex(EG(function_table), Z_STR_P(func_name), 1);
+		func_name = (zval *)RT_CONSTANT(opline, opline->op2);
+		func = zend_hash_find_ex(EG(function_table), Z_STR_P(func_name + 1), 1);
 		if (func == NULL) {
-			func_name++;
-			func = zend_hash_find_ex(EG(function_table), Z_STR_P(func_name), 1);
+			func = zend_hash_find_ex(EG(function_table), Z_STR_P(func_name + 2), 1);
 			if (UNEXPECTED(func == NULL)) {
 				ZEND_VM_DISPATCH_TO_HELPER(zend_undefined_function_helper, function_name, func_name);
 			}
@@ -2153,11 +2153,10 @@ static ZEND_VM_HOT ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_NS_FCALL_BY_N

 	fbc = CACHED_PTR(opline->result.num);
 	if (UNEXPECTED(fbc == NULL)) {
-		func_name = RT_CONSTANT(opline, opline->op2) + 1;
-		func = zend_hash_find_ex(EG(function_table), Z_STR_P(func_name), 1);
+		func_name = (zval *)RT_CONSTANT(opline, opline->op2);
+		func = zend_hash_find_ex(EG(function_table), Z_STR_P(func_name + 1), 1);
 		if (func == NULL) {
-			func_name++;
-			func = zend_hash_find_ex(EG(function_table), Z_STR_P(func_name), 1);
+			func = zend_hash_find_ex(EG(function_table), Z_STR_P(func_name + 2), 1);
 			if (UNEXPECTED(func == NULL)) {
 				ZEND_VM_TAIL_CALL(zend_undefined_function_helper_SPEC(func_name ZEND_OPCODE_HANDLER_ARGS_PASSTHRU_CC));
 			}
@@ -5149,6 +5148,10 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_
 		    EXPECTED(obj == orig_obj)) {
 			CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
 		}
+		if ((IS_CONST & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+			/* Reset "object" to trigger reference counting */
+			object = NULL;
+		}
 		if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
 			init_func_run_time_cache(&fbc->op_array);
 		}
@@ -7326,6 +7329,10 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_
 		    EXPECTED(obj == orig_obj)) {
 			CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
 		}
+		if ((IS_CONST & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+			/* Reset "object" to trigger reference counting */
+			object = NULL;
+		}
 		if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
 			init_func_run_time_cache(&fbc->op_array);
 		}
@@ -10422,6 +10429,10 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_
 		    EXPECTED(obj == orig_obj)) {
 			CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
 		}
+		if ((IS_CONST & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+			/* Reset "object" to trigger reference counting */
+			object = NULL;
+		}
 		if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
 			init_func_run_time_cache(&fbc->op_array);
 		}
@@ -14150,6 +14161,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_TMPVAR_C
 		    EXPECTED(obj == orig_obj)) {
 			CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
 		}
+		if (((IS_TMP_VAR|IS_VAR) & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+			/* Reset "object" to trigger reference counting */
+			object = NULL;
+		}
 		if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
 			init_func_run_time_cache(&fbc->op_array);
 		}
@@ -15760,6 +15775,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_TMPVAR_T
 		    EXPECTED(obj == orig_obj)) {
 			CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
 		}
+		if (((IS_TMP_VAR|IS_VAR) & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+			/* Reset "object" to trigger reference counting */
+			object = NULL;
+		}
 		if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
 			init_func_run_time_cache(&fbc->op_array);
 		}
@@ -17637,6 +17656,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_TMPVAR_C
 		    EXPECTED(obj == orig_obj)) {
 			CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
 		}
+		if (((IS_TMP_VAR|IS_VAR) & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+			/* Reset "object" to trigger reference counting */
+			object = NULL;
+		}
 		if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
 			init_func_run_time_cache(&fbc->op_array);
 		}
@@ -32082,6 +32105,10 @@ static ZEND_VM_HOT ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_S
 		    EXPECTED(obj == orig_obj)) {
 			CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
 		}
+		if ((IS_UNUSED & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+			/* Reset "object" to trigger reference counting */
+			object = NULL;
+		}
 		if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
 			init_func_run_time_cache(&fbc->op_array);
 		}
@@ -33813,6 +33840,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_UNUSED_T
 		    EXPECTED(obj == orig_obj)) {
 			CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
 		}
+		if ((IS_UNUSED & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+			/* Reset "object" to trigger reference counting */
+			object = NULL;
+		}
 		if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
 			init_func_run_time_cache(&fbc->op_array);
 		}
@@ -36188,6 +36219,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_UNUSED_C
 		    EXPECTED(obj == orig_obj)) {
 			CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
 		}
+		if ((IS_UNUSED & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+			/* Reset "object" to trigger reference counting */
+			object = NULL;
+		}
 		if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
 			init_func_run_time_cache(&fbc->op_array);
 		}
@@ -41209,6 +41244,10 @@ static ZEND_VM_HOT ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_S
 		    EXPECTED(obj == orig_obj)) {
 			CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
 		}
+		if ((IS_CV & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+			/* Reset "object" to trigger reference counting */
+			object = NULL;
+		}
 		if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
 			init_func_run_time_cache(&fbc->op_array);
 		}
@@ -44972,6 +45011,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_CV_TMPVA
 		    EXPECTED(obj == orig_obj)) {
 			CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
 		}
+		if ((IS_CV & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+			/* Reset "object" to trigger reference counting */
+			object = NULL;
+		}
 		if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
 			init_func_run_time_cache(&fbc->op_array);
 		}
@@ -50770,6 +50813,10 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_METHOD_CALL_SPEC_CV_CV_HA
 		    EXPECTED(obj == orig_obj)) {
 			CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
 		}
+		if ((IS_CV & (IS_VAR|IS_TMP_VAR)) && UNEXPECTED(obj != orig_obj)) {
+			/* Reset "object" to trigger reference counting */
+			object = NULL;
+		}
 		if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!fbc->op_array.run_time_cache)) {
 			init_func_run_time_cache(&fbc->op_array);
 		}
@@ -992,7 +992,7 @@ function gen_code($f, $spec, $kind, $export, $code, $op1, $op2, $name, $extra_sp
 	}

 	/* Remove unused free_op1 and free_op2 declarations */
-	if ($spec && preg_match_all('/^\s*zend_free_op\s+[^;]+;\s*$/me', $code, $matches, PREG_SET_ORDER)) {
+	if ($spec && preg_match_all('/^\s*zend_free_op\s+[^;]+;\s*$/m', $code, $matches, PREG_SET_ORDER)) {
 		$n = 0;
 		foreach ($matches as $match) {
 		  $code = preg_replace('/'.preg_quote($match[0],'/').'/', "\$D$n", $code);
@@ -2671,6 +2671,7 @@ function gen_vm($def, $skel) {

 	// Generate specialized executor
 	gen_executor($f, $skl, ZEND_VM_SPEC, ZEND_VM_KIND, "execute", "zend_vm_init");
+	out($f, "\n");

 	// Generate zend_vm_get_opcode_handler() function
 	out($f, "static const void* ZEND_FASTCALL zend_vm_get_opcode_handler_ex(uint32_t spec, const zend_op* op)\n");
@@ -107,8 +107,8 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=3
-PHP_RELEASE_VERSION=1
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=2
+PHP_EXTRA_VERSION="RC1"
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -585,7 +585,10 @@ PHP_SOCKADDR_CHECKS

 dnl Checks for GCC function attributes on all systems except ones without glibc
 dnl Fix for these systems is already included in GCC 7, but not on GCC 6
-AS_CASE([$host_alias], [*-*-*android*|*-*-*uclibc*|*-*-*musl*], [true], [
+dnl
+dnl At least some versions of FreeBSD seem to have buggy ifunc support, see
+dnl bug #77284. Conservatively don't use ifuncs on FreeBSD.
+AS_CASE([$host_alias], [*-*-*android*|*-*-*uclibc*|*-*-*musl*|*freebsd*], [true], [
  AX_GCC_FUNC_ATTRIBUTE([ifunc])
  AX_GCC_FUNC_ATTRIBUTE([target])
 ])
@@ -502,6 +502,7 @@ static int _php_server_push_callback(CURL *parent_ch, CURL *easy, size_t num_hea
 	Z_ADDREF_P(pz_parent_ch);

 	res = zend_register_resource(ch, le_curl);
+	ch->res = res;
 	ZVAL_RES(&pz_ch, res);

 	size_t i;
@@ -0,0 +1,53 @@
+--TEST--
+Bug #76675 (Segfault with H2 server push write/writeheader handlers)
+--SKIPIF--
+<?php
+include 'skipif.inc';
+if (getenv("SKIP_ONLINE_TESTS")) {
+	die("skip online test");
+}
+$curl_version = curl_version();
+if ($curl_version['version_number'] < 0x073d00) {
+	exit("skip: test may crash with curl < 7.61.0");
+}
+?>
+--FILE--
+<?php
+$transfers = 1;
+$callback = function($parent, $passed) use (&$transfers) {
+    curl_setopt($passed, CURLOPT_WRITEFUNCTION, function ($ch, $data) {
+        echo "Received ".strlen($data);
+        return strlen($data);
+    });
+	$transfers++;
+	return CURL_PUSH_OK;
+};
+$mh = curl_multi_init();
+curl_multi_setopt($mh, CURLMOPT_PIPELINING, CURLPIPE_MULTIPLEX);
+curl_multi_setopt($mh, CURLMOPT_PUSHFUNCTION, $callback);
+$ch = curl_init();
+curl_setopt($ch, CURLOPT_URL, 'https://http2.golang.org/serverpush');
+curl_setopt($ch, CURLOPT_HTTP_VERSION, 3);
+curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
+curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
+curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
+curl_multi_add_handle($mh, $ch);
+$active = null;
+do {
+    $status = curl_multi_exec($mh, $active);
+    do {
+        $info = curl_multi_info_read($mh);
+        if (false !== $info && $info['msg'] == CURLMSG_DONE) {
+            $handle = $info['handle'];
+            if ($handle !== null) {
+                $transfers--;
+                curl_multi_remove_handle($mh, $handle);
+                curl_close($handle);
+            }
+        }
+    } while ($info);
+} while ($transfers);
+curl_multi_close($mh);
+?>
+--EXPECTREGEX--
+(Received \d+)+
@@ -51,17 +51,37 @@ static inline uint32_t timelib_conv_int_unsigned(uint32_t value)
 {
 	return value;
 }
+
+static inline uint64_t timelib_conv_int64_unsigned(uint64_t value)
+{
+	return value;
+}
 #else
 static inline uint32_t timelib_conv_int_unsigned(uint32_t value)
 {
-	return ((value & 0x000000ff) << 24) +
-		((value & 0x0000ff00) << 8) +
-		((value & 0x00ff0000) >> 8) +
+	return
+		((value & 0x000000ff) << 24) +
+		((value & 0x0000ff00) <<  8) +
+		((value & 0x00ff0000) >>  8) +
 		((value & 0xff000000) >> 24);
 }
+
+static inline uint64_t timelib_conv_int64_unsigned(uint64_t value)
+{
+	return
+		((value & 0x00000000000000ff) << 56) +
+		((value & 0x000000000000ff00) << 40) +
+		((value & 0x0000000000ff0000) << 24) +
+		((value & 0x00000000ff000000) <<  8) +
+		((value & 0x000000ff00000000) >>  8) +
+		((value & 0x0000ff0000000000) >> 24) +
+		((value & 0x00ff000000000000) >> 40) +
+		((value & 0xff00000000000000) >> 56);
+}
 #endif

 #define timelib_conv_int_signed(value) ((int32_t) timelib_conv_int_unsigned((int32_t) value))
+#define timelib_conv_int64_signed(value) ((int64_t) timelib_conv_int64_unsigned((int64_t) value))

 static int read_php_preamble(const unsigned char **tzf, timelib_tzinfo *tz)
 {
@@ -132,56 +152,49 @@ static int read_preamble(const unsigned char **tzf, timelib_tzinfo *tz, unsigned
 	}
 }

-static void read_header(const unsigned char **tzf, timelib_tzinfo *tz)
+static void read_32bit_header(const unsigned char **tzf, timelib_tzinfo *tz)
 {
 	uint32_t buffer[6];

 	memcpy(&buffer, *tzf, sizeof(buffer));
-	tz->bit32.ttisgmtcnt = timelib_conv_int_unsigned(buffer[0]);
-	tz->bit32.ttisstdcnt = timelib_conv_int_unsigned(buffer[1]);
-	tz->bit32.leapcnt    = timelib_conv_int_unsigned(buffer[2]);
-	tz->bit32.timecnt    = timelib_conv_int_unsigned(buffer[3]);
-	tz->bit32.typecnt    = timelib_conv_int_unsigned(buffer[4]);
-	tz->bit32.charcnt    = timelib_conv_int_unsigned(buffer[5]);
+	tz->_bit32.ttisgmtcnt = timelib_conv_int_unsigned(buffer[0]);
+	tz->_bit32.ttisstdcnt = timelib_conv_int_unsigned(buffer[1]);
+	tz->_bit32.leapcnt    = timelib_conv_int_unsigned(buffer[2]);
+	tz->_bit32.timecnt    = timelib_conv_int_unsigned(buffer[3]);
+	tz->_bit32.typecnt    = timelib_conv_int_unsigned(buffer[4]);
+	tz->_bit32.charcnt    = timelib_conv_int_unsigned(buffer[5]);
+
 	*tzf += sizeof(buffer);
 }

-static void skip_64bit_transitions(const unsigned char **tzf, timelib_tzinfo *tz)
+static int read_64bit_transitions(const unsigned char **tzf, timelib_tzinfo *tz)
 {
-	if (tz->bit64.timecnt) {
-		*tzf += (sizeof(int64_t) * tz->bit64.timecnt);
-		*tzf += (sizeof(unsigned char) * tz->bit64.timecnt);
-	}
-}
-
-static int read_transitions(const unsigned char **tzf, timelib_tzinfo *tz)
-{
-	int32_t *buffer = NULL;
+	int64_t *buffer = NULL;
 	uint32_t i;
 	unsigned char *cbuffer = NULL;

-	if (tz->bit32.timecnt) {
-		buffer = (int32_t*) timelib_malloc(tz->bit32.timecnt * sizeof(int32_t));
+	if (tz->bit64.timecnt) {
+		buffer = (int64_t*) timelib_malloc(tz->bit64.timecnt * sizeof(int64_t));
 		if (!buffer) {
 			return TIMELIB_ERROR_CANNOT_ALLOCATE;
 		}
-		memcpy(buffer, *tzf, sizeof(int32_t) * tz->bit32.timecnt);
-		*tzf += (sizeof(int32_t) * tz->bit32.timecnt);
-		for (i = 0; i < tz->bit32.timecnt; i++) {
-			buffer[i] = timelib_conv_int_signed(buffer[i]);
+		memcpy(buffer, *tzf, sizeof(int64_t) * tz->bit64.timecnt);
+		*tzf += (sizeof(int64_t) * tz->bit64.timecnt);
+		for (i = 0; i < tz->bit64.timecnt; i++) {
+			buffer[i] = timelib_conv_int64_signed(buffer[i]);
 			/* Sanity check to see whether TS is just increasing */
 			if (i > 0 && !(buffer[i] > buffer[i - 1])) {
 				return TIMELIB_ERROR_CORRUPT_TRANSITIONS_DONT_INCREASE;
 			}
 		}

-		cbuffer = (unsigned char*) timelib_malloc(tz->bit32.timecnt * sizeof(unsigned char));
+		cbuffer = (unsigned char*) timelib_malloc(tz->bit64.timecnt * sizeof(unsigned char));
 		if (!cbuffer) {
 			timelib_free(buffer);
 			return TIMELIB_ERROR_CANNOT_ALLOCATE;
 		}
-		memcpy(cbuffer, *tzf, sizeof(unsigned char) * tz->bit32.timecnt);
-		*tzf += sizeof(unsigned char) * tz->bit32.timecnt;
+		memcpy(cbuffer, *tzf, sizeof(unsigned char) * tz->bit64.timecnt);
+		*tzf += sizeof(unsigned char) * tz->bit64.timecnt;
 	}

 	tz->trans = buffer;
@@ -190,41 +203,35 @@ static int read_transitions(const unsigned char **tzf, timelib_tzinfo *tz)
 	return 0;
 }

-static void skip_64bit_types(const unsigned char **tzf, timelib_tzinfo *tz)
+static void skip_32bit_transitions(const unsigned char **tzf, timelib_tzinfo *tz)
 {
-	*tzf += sizeof(unsigned char) * 6 * tz->bit64.typecnt;
-	*tzf += sizeof(char) * tz->bit64.charcnt;
-	if (tz->bit64.leapcnt) {
-		*tzf += sizeof(int64_t) * tz->bit64.leapcnt * 2;
-	}
-	if (tz->bit64.ttisstdcnt) {
-		*tzf += sizeof(unsigned char) * tz->bit64.ttisstdcnt;
-	}
-	if (tz->bit64.ttisgmtcnt) {
-		*tzf += sizeof(unsigned char) * tz->bit64.ttisgmtcnt;
+	if (tz->_bit32.timecnt) {
+		*tzf += (sizeof(int32_t) * tz->_bit32.timecnt);
+		*tzf += sizeof(unsigned char) * tz->_bit32.timecnt;
 	}
 }

-static int read_types(const unsigned char **tzf, timelib_tzinfo *tz)
+static int read_64bit_types(const unsigned char **tzf, timelib_tzinfo *tz)
 {
 	unsigned char *buffer;
 	int32_t *leap_buffer;
 	unsigned int i, j;

-	buffer = (unsigned char*) timelib_malloc(tz->bit32.typecnt * sizeof(unsigned char) * 6);
+	/* Offset Types */
+	buffer = (unsigned char*) timelib_malloc(tz->bit64.typecnt * sizeof(unsigned char) * 6);
 	if (!buffer) {
 		return TIMELIB_ERROR_CANNOT_ALLOCATE;
 	}
-	memcpy(buffer, *tzf, sizeof(unsigned char) * 6 * tz->bit32.typecnt);
-	*tzf += sizeof(unsigned char) * 6 * tz->bit32.typecnt;
+	memcpy(buffer, *tzf, sizeof(unsigned char) * 6 * tz->bit64.typecnt);
+	*tzf += sizeof(unsigned char) * 6 * tz->bit64.typecnt;

-	tz->type = (ttinfo*) timelib_malloc(tz->bit32.typecnt * sizeof(ttinfo));
+	tz->type = (ttinfo*) timelib_malloc(tz->bit64.typecnt * sizeof(ttinfo));
 	if (!tz->type) {
 		timelib_free(buffer);
 		return TIMELIB_ERROR_CANNOT_ALLOCATE;
 	}

-	for (i = 0; i < tz->bit32.typecnt; i++) {
+	for (i = 0; i < tz->bit64.typecnt; i++) {
 		j = i * 6;
 		tz->type[i].offset = 0;
 		tz->type[i].offset += (int32_t) (((uint32_t) buffer[j]) << 24) + (buffer[j + 1] << 16) + (buffer[j + 2] << 8) + tz->type[i].offset + buffer[j + 3];
@@ -233,56 +240,60 @@ static int read_types(const unsigned char **tzf, timelib_tzinfo *tz)
 	}
 	timelib_free(buffer);

-	tz->timezone_abbr = (char*) timelib_malloc(tz->bit32.charcnt);
+	/* Abbreviations */
+	tz->timezone_abbr = (char*) timelib_malloc(tz->bit64.charcnt);
 	if (!tz->timezone_abbr) {
 		return TIMELIB_ERROR_CORRUPT_NO_ABBREVIATION;
 	}
-	memcpy(tz->timezone_abbr, *tzf, sizeof(char) * tz->bit32.charcnt);
-	*tzf += sizeof(char) * tz->bit32.charcnt;
+	memcpy(tz->timezone_abbr, *tzf, sizeof(char) * tz->bit64.charcnt);
+	*tzf += sizeof(char) * tz->bit64.charcnt;

-	if (tz->bit32.leapcnt) {
-		leap_buffer = (int32_t *) timelib_malloc(tz->bit32.leapcnt * 2 * sizeof(int32_t));
+	/* Leap seconds (only use in 'right/') format */
+	if (tz->bit64.leapcnt) {
+		leap_buffer = (int32_t *) timelib_malloc(tz->bit64.leapcnt * (sizeof(int64_t) + sizeof(int32_t)));
 		if (!leap_buffer) {
 			return TIMELIB_ERROR_CANNOT_ALLOCATE;
 		}
-		memcpy(leap_buffer, *tzf, sizeof(int32_t) * tz->bit32.leapcnt * 2);
-		*tzf += sizeof(int32_t) * tz->bit32.leapcnt * 2;
+		memcpy(leap_buffer, *tzf, tz->bit64.leapcnt * (sizeof(int64_t) + sizeof(int32_t)));
+		*tzf += tz->bit64.leapcnt * (sizeof(int64_t) + sizeof(int32_t));

-		tz->leap_times = (tlinfo*) timelib_malloc(tz->bit32.leapcnt * sizeof(tlinfo));
+		tz->leap_times = (tlinfo*) timelib_malloc(tz->bit64.leapcnt * sizeof(tlinfo));
 		if (!tz->leap_times) {
 			timelib_free(leap_buffer);
 			return TIMELIB_ERROR_CANNOT_ALLOCATE;
 		}
-		for (i = 0; i < tz->bit32.leapcnt; i++) {
-			tz->leap_times[i].trans = timelib_conv_int_signed(leap_buffer[i * 2]);
-			tz->leap_times[i].offset = timelib_conv_int_signed(leap_buffer[i * 2 + 1]);
+		for (i = 0; i < tz->bit64.leapcnt; i++) {
+			tz->leap_times[i].trans = timelib_conv_int64_signed(leap_buffer[i * 3 + 1] * 4294967296 + leap_buffer[i * 3]);
+			tz->leap_times[i].offset = timelib_conv_int_signed(leap_buffer[i * 3 + 2]);
 		}
 		timelib_free(leap_buffer);
 	}

-	if (tz->bit32.ttisstdcnt) {
-		buffer = (unsigned char*) timelib_malloc(tz->bit32.ttisstdcnt * sizeof(unsigned char));
+	/* Standard/Wall Indicators (unused) */
+	if (tz->bit64.ttisstdcnt) {
+		buffer = (unsigned char*) timelib_malloc(tz->bit64.ttisstdcnt * sizeof(unsigned char));
 		if (!buffer) {
 			return TIMELIB_ERROR_CANNOT_ALLOCATE;
 		}
-		memcpy(buffer, *tzf, sizeof(unsigned char) * tz->bit32.ttisstdcnt);
-		*tzf += sizeof(unsigned char) * tz->bit32.ttisstdcnt;
+		memcpy(buffer, *tzf, sizeof(unsigned char) * tz->bit64.ttisstdcnt);
+		*tzf += sizeof(unsigned char) * tz->bit64.ttisstdcnt;

-		for (i = 0; i < tz->bit32.ttisstdcnt; i++) {
+		for (i = 0; i < tz->bit64.ttisstdcnt; i++) {
 			tz->type[i].isstdcnt = buffer[i];
 		}
 		timelib_free(buffer);
 	}

-	if (tz->bit32.ttisgmtcnt) {
-		buffer = (unsigned char*) timelib_malloc(tz->bit32.ttisgmtcnt * sizeof(unsigned char));
+	/* UT/Local Time Indicators (unused) */
+	if (tz->bit64.ttisgmtcnt) {
+		buffer = (unsigned char*) timelib_malloc(tz->bit64.ttisgmtcnt * sizeof(unsigned char));
 		if (!buffer) {
 			return TIMELIB_ERROR_CANNOT_ALLOCATE;
 		}
-		memcpy(buffer, *tzf, sizeof(unsigned char) * tz->bit32.ttisgmtcnt);
-		*tzf += sizeof(unsigned char) * tz->bit32.ttisgmtcnt;
+		memcpy(buffer, *tzf, sizeof(unsigned char) * tz->bit64.ttisgmtcnt);
+		*tzf += sizeof(unsigned char) * tz->bit64.ttisgmtcnt;

-		for (i = 0; i < tz->bit32.ttisgmtcnt; i++) {
+		for (i = 0; i < tz->bit64.ttisgmtcnt; i++) {
 			tz->type[i].isgmtcnt = buffer[i];
 		}
 		timelib_free(buffer);
@@ -291,6 +302,30 @@ static int read_types(const unsigned char **tzf, timelib_tzinfo *tz)
 	return 0;
 }

+static void skip_32bit_types(const unsigned char **tzf, timelib_tzinfo *tz)
+{
+	/* Offset Types */
+	*tzf += sizeof(unsigned char) * 6 * tz->_bit32.typecnt;
+
+	/* Abbreviations */
+	*tzf += sizeof(char) * tz->_bit32.charcnt;
+
+	/* Leap seconds (only use in 'right/') format */
+	if (tz->_bit32.leapcnt) {
+		*tzf += sizeof(int32_t) * tz->_bit32.leapcnt * 2;
+	}
+
+	/* Standard/Wall Indicators (unused) */
+	if (tz->_bit32.ttisstdcnt) {
+		*tzf += sizeof(unsigned char) * tz->_bit32.ttisstdcnt;
+	}
+
+	/* UT/Local Time Indicators (unused) */
+	if (tz->_bit32.ttisgmtcnt) {
+		*tzf += sizeof(unsigned char) * tz->_bit32.ttisgmtcnt;
+	}
+}
+
 static void skip_posix_string(const unsigned char **tzf, timelib_tzinfo *tz)
 {
 	int n_count = 0;
@@ -339,14 +374,16 @@ void timelib_dump_tzinfo(timelib_tzinfo *tz)
 	printf("Geo Location:      %f,%f\n", tz->location.latitude, tz->location.longitude);
 	printf("Comments:\n%s\n",          tz->location.comments);
 	printf("BC:                %s\n",  tz->bc ? "" : "yes");
-	printf("UTC/Local count:   " TIMELIB_ULONG_FMT "\n", (timelib_ulong) tz->bit32.ttisgmtcnt);
-	printf("Std/Wall count:    " TIMELIB_ULONG_FMT "\n", (timelib_ulong) tz->bit32.ttisstdcnt);
-	printf("Leap.sec. count:   " TIMELIB_ULONG_FMT "\n", (timelib_ulong) tz->bit32.leapcnt);
-	printf("Trans. count:      " TIMELIB_ULONG_FMT "\n", (timelib_ulong) tz->bit32.timecnt);
-	printf("Local types count: " TIMELIB_ULONG_FMT "\n", (timelib_ulong) tz->bit32.typecnt);
-	printf("Zone Abbr. count:  " TIMELIB_ULONG_FMT "\n", (timelib_ulong) tz->bit32.charcnt);

-	printf ("%8s (%12s) = %3d [%5ld %1d %3d '%s' (%d,%d)]\n",
+	printf("\n64-bit:\n");
+	printf("UTC/Local count:   " TIMELIB_ULONG_FMT "\n", (timelib_ulong) tz->bit64.ttisgmtcnt);
+	printf("Std/Wall count:    " TIMELIB_ULONG_FMT "\n", (timelib_ulong) tz->bit64.ttisstdcnt);
+	printf("Leap.sec. count:   " TIMELIB_ULONG_FMT "\n", (timelib_ulong) tz->bit64.leapcnt);
+	printf("Trans. count:      " TIMELIB_ULONG_FMT "\n", (timelib_ulong) tz->bit64.timecnt);
+	printf("Local types count: " TIMELIB_ULONG_FMT "\n", (timelib_ulong) tz->bit64.typecnt);
+	printf("Zone Abbr. count:  " TIMELIB_ULONG_FMT "\n", (timelib_ulong) tz->bit64.charcnt);
+
+	printf ("%16s (%20s) = %3d [%5ld %1d %3d '%s' (%d,%d)]\n",
 		"", "", 0,
 		(long int) tz->type[0].offset,
 		tz->type[0].isdst,
@@ -355,8 +392,8 @@ void timelib_dump_tzinfo(timelib_tzinfo *tz)
 		tz->type[0].isstdcnt,
 		tz->type[0].isgmtcnt
 		);
-	for (i = 0; i < tz->bit32.timecnt; i++) {
-		printf ("%08X (%12d) = %3d [%5ld %1d %3d '%s' (%d,%d)]\n",
+	for (i = 0; i < tz->bit64.timecnt; i++) {
+		printf ("%016lX (%20ld) = %3d [%5ld %1d %3d '%s' (%d,%d)]\n",
 			tz->trans[i], tz->trans[i], tz->trans_idx[i],
 			(long int) tz->type[tz->trans_idx[i]].offset,
 			tz->type[tz->trans_idx[i]].isdst,
@@ -366,8 +403,8 @@ void timelib_dump_tzinfo(timelib_tzinfo *tz)
 			tz->type[tz->trans_idx[i]].isgmtcnt
 			);
 	}
-	for (i = 0; i < tz->bit32.leapcnt; i++) {
-		printf ("%08X (%12ld) = %d\n",
+	for (i = 0; i < tz->bit64.leapcnt; i++) {
+		printf ("%016lX (%20ld) = %d\n",
 			tz->leap_times[i].trans,
 			(long) tz->leap_times[i].trans,
 			tz->leap_times[i].offset);
@@ -470,31 +507,35 @@ timelib_tzinfo *timelib_parse_tzfile(char *timezone, const timelib_tzdb *tzdb, i
 			timelib_tzinfo_dtor(tmp);
 			return NULL;
 		}
+		if (version < 2 || version > 3) {
+			*error_code = TIMELIB_ERROR_UNSUPPORTED_VERSION;
+			timelib_tzinfo_dtor(tmp);
+			return NULL;
+		}
 //printf("- timezone: %s, version: %0d\n", timezone, version);

-		read_header(&tzf, tmp);
-		if ((transitions_result = read_transitions(&tzf, tmp)) != 0) {
+		read_32bit_header(&tzf, tmp);
+		skip_32bit_transitions(&tzf, tmp);
+		skip_32bit_types(&tzf, tmp);
+
+		if (!skip_64bit_preamble(&tzf, tmp)) {
+			/* 64 bit preamble is not in place */
+			*error_code = TIMELIB_ERROR_CORRUPT_NO_64BIT_PREAMBLE;
+			return NULL;
+		}
+		read_64bit_header(&tzf, tmp);
+		if ((transitions_result = read_64bit_transitions(&tzf, tmp)) != 0) {
 			/* Corrupt file as transitions do not increase */
 			*error_code = transitions_result;
 			timelib_tzinfo_dtor(tmp);
 			return NULL;
 		}
-		if ((types_result = read_types(&tzf, tmp)) != 0) {
+		if ((types_result = read_64bit_types(&tzf, tmp)) != 0) {
 			*error_code = types_result;
 			timelib_tzinfo_dtor(tmp);
 			return NULL;
 		}
-		if (version == 2 || version == 3) {
-			if (!skip_64bit_preamble(&tzf, tmp)) {
-				/* 64 bit preamble is not in place */
-				*error_code = TIMELIB_ERROR_CORRUPT_NO_64BIT_PREAMBLE;
-				return NULL;
-			}
-			read_64bit_header(&tzf, tmp);
-			skip_64bit_transitions(&tzf, tmp);
-			skip_64bit_types(&tzf, tmp);
-			skip_posix_string(&tzf, tmp);
-		}
+		skip_posix_string(&tzf, tmp);

 		if (type == TIMELIB_TZINFO_PHP) {
 			read_location(&tzf, tmp);
@@ -525,29 +566,35 @@ void timelib_tzinfo_dtor(timelib_tzinfo *tz)
 timelib_tzinfo *timelib_tzinfo_clone(timelib_tzinfo *tz)
 {
 	timelib_tzinfo *tmp = timelib_tzinfo_ctor(tz->name);
-	tmp->bit32.ttisgmtcnt = tz->bit32.ttisgmtcnt;
-	tmp->bit32.ttisstdcnt = tz->bit32.ttisstdcnt;
-	tmp->bit32.leapcnt = tz->bit32.leapcnt;
-	tmp->bit32.timecnt = tz->bit32.timecnt;
-	tmp->bit32.typecnt = tz->bit32.typecnt;
-	tmp->bit32.charcnt = tz->bit32.charcnt;
+	tmp->_bit32.ttisgmtcnt = tz->_bit32.ttisgmtcnt;
+	tmp->_bit32.ttisstdcnt = tz->_bit32.ttisstdcnt;
+	tmp->_bit32.leapcnt = tz->_bit32.leapcnt;
+	tmp->_bit32.timecnt = tz->_bit32.timecnt;
+	tmp->_bit32.typecnt = tz->_bit32.typecnt;
+	tmp->_bit32.charcnt = tz->_bit32.charcnt;
+	tmp->bit64.ttisgmtcnt = tz->bit64.ttisgmtcnt;
+	tmp->bit64.ttisstdcnt = tz->bit64.ttisstdcnt;
+	tmp->bit64.leapcnt = tz->bit64.leapcnt;
+	tmp->bit64.timecnt = tz->bit64.timecnt;
+	tmp->bit64.typecnt = tz->bit64.typecnt;
+	tmp->bit64.charcnt = tz->bit64.charcnt;

-	if (tz->bit32.timecnt) {
-		tmp->trans = (int32_t *) timelib_malloc(tz->bit32.timecnt * sizeof(int32_t));
-		tmp->trans_idx = (unsigned char*) timelib_malloc(tz->bit32.timecnt * sizeof(unsigned char));
-		memcpy(tmp->trans, tz->trans, tz->bit32.timecnt * sizeof(int32_t));
-		memcpy(tmp->trans_idx, tz->trans_idx, tz->bit32.timecnt * sizeof(unsigned char));
+	if (tz->bit64.timecnt) {
+		tmp->trans = (int64_t *) timelib_malloc(tz->bit64.timecnt * sizeof(int64_t));
+		tmp->trans_idx = (unsigned char*) timelib_malloc(tz->bit64.timecnt * sizeof(unsigned char));
+		memcpy(tmp->trans, tz->trans, tz->bit64.timecnt * sizeof(int64_t));
+		memcpy(tmp->trans_idx, tz->trans_idx, tz->bit64.timecnt * sizeof(unsigned char));
 	}

-	tmp->type = (ttinfo*) timelib_malloc(tz->bit32.typecnt * sizeof(ttinfo));
-	memcpy(tmp->type, tz->type, tz->bit32.typecnt * sizeof(ttinfo));
+	tmp->type = (ttinfo*) timelib_malloc(tz->bit64.typecnt * sizeof(ttinfo));
+	memcpy(tmp->type, tz->type, tz->bit64.typecnt * sizeof(ttinfo));

-	tmp->timezone_abbr = (char*) timelib_malloc(tz->bit32.charcnt);
-	memcpy(tmp->timezone_abbr, tz->timezone_abbr, tz->bit32.charcnt);
+	tmp->timezone_abbr = (char*) timelib_malloc(tz->bit64.charcnt);
+	memcpy(tmp->timezone_abbr, tz->timezone_abbr, tz->bit64.charcnt);

-	if (tz->bit32.leapcnt) {
-		tmp->leap_times = (tlinfo*) timelib_malloc(tz->bit32.leapcnt * sizeof(tlinfo));
-		memcpy(tmp->leap_times, tz->leap_times, tz->bit32.leapcnt * sizeof(tlinfo));
+	if (tz->bit64.leapcnt) {
+		tmp->leap_times = (tlinfo*) timelib_malloc(tz->bit64.leapcnt * sizeof(tlinfo));
+		memcpy(tmp->leap_times, tz->leap_times, tz->bit64.leapcnt * sizeof(tlinfo));
 	}

 	return tmp;
@@ -559,9 +606,9 @@ static ttinfo* fetch_timezone_offset(timelib_tzinfo *tz, timelib_sll ts, timelib

 	/* If there is no transition time, we pick the first one, if that doesn't
 	 * exist we return NULL */
-	if (!tz->bit32.timecnt || !tz->trans) {
+	if (!tz->bit64.timecnt || !tz->trans) {
 		*transition_time = 0;
-		if (tz->bit32.typecnt == 1) {
+		if (tz->bit64.typecnt == 1) {
 			return &(tz->type[0]);
 		}
 		return NULL;
@@ -572,40 +619,30 @@ static ttinfo* fetch_timezone_offset(timelib_tzinfo *tz, timelib_sll ts, timelib
 	 * one in case there are only DST entries. Not sure which smartass came up
 	 * with this idea in the first though :) */
 	if (ts < tz->trans[0]) {
-		uint32_t j;
-
-		*transition_time = 0;
-		j = 0;
-		while (j < tz->bit32.timecnt && tz->type[tz->trans_idx[j]].isdst) {
-			++j;
-		}
-		if (j == tz->bit32.timecnt) {
-			j = 0;
-		}
-		return &(tz->type[tz->trans_idx[j]]);
+		return &(tz->type[0]);
 	}

 	/* In all other cases we loop through the available transition times to find
 	 * the correct entry */
-	for (i = 0; i < tz->bit32.timecnt; i++) {
+	for (i = 0; i < tz->bit64.timecnt; i++) {
 		if (ts < tz->trans[i]) {
 			*transition_time = tz->trans[i - 1];
 			return &(tz->type[tz->trans_idx[i - 1]]);
 		}
 	}
-	*transition_time = tz->trans[tz->bit32.timecnt - 1];
-	return &(tz->type[tz->trans_idx[tz->bit32.timecnt - 1]]);
+	*transition_time = tz->trans[tz->bit64.timecnt - 1];
+	return &(tz->type[tz->trans_idx[tz->bit64.timecnt - 1]]);
 }

 static tlinfo* fetch_leaptime_offset(timelib_tzinfo *tz, timelib_sll ts)
 {
 	int i;

-	if (!tz->bit32.leapcnt || !tz->leap_times) {
+	if (!tz->bit64.leapcnt || !tz->leap_times) {
 		return NULL;
 	}

-	for (i = tz->bit32.leapcnt - 1; i > 0; i--) {
+	for (i = tz->bit64.leapcnt - 1; i > 0; i--) {
 		if (ts > tz->leap_times[i].trans) {
 			return &(tz->leap_times[i]);
 		}
@@ -153,7 +153,7 @@ typedef struct _timelib_tzinfo
 		uint32_t timecnt;
 		uint32_t typecnt;
 		uint32_t charcnt;
-	} bit32;
+	} _bit32;
 	struct {
 		uint64_t ttisgmtcnt;
 		uint64_t ttisstdcnt;
@@ -163,7 +163,7 @@ typedef struct _timelib_tzinfo
 		uint64_t charcnt;
 	} bit64;

-	int32_t *trans;
+	int64_t *trans;
 	unsigned char *trans_idx;

 	ttinfo  *type;
@@ -322,8 +322,8 @@ typedef struct _timelib_tzdb {
 #endif

 #define TIMELIB_VERSION 201801
-#define TIMELIB_EXTENDED_VERSION 20180104
-#define TIMELIB_ASCII_VERSION "2018.01RC2"
+#define TIMELIB_EXTENDED_VERSION 20180105
+#define TIMELIB_ASCII_VERSION "2018.01RC3"

 #define TIMELIB_NONE             0x00
 #define TIMELIB_OVERRIDE_TIME    0x01
@@ -123,7 +123,7 @@ struct _ttinfo

 struct _tlinfo
 {
-	int32_t  trans;
+	int64_t  trans;
 	int32_t  offset;
 };

@@ -4032,7 +4032,7 @@ PHP_FUNCTION(timezone_transitions_get)
 		add_assoc_string(&element, "abbr", &tzobj->tzi.tz->timezone_abbr[tzobj->tzi.tz->type[tzobj->tzi.tz->trans_idx[i]].abbr_idx]); \
 		add_next_index_zval(return_value, &element);

-#define add_last() add(tzobj->tzi.tz->bit32.timecnt - 1, timestamp_begin)
+#define add_last() add(tzobj->tzi.tz->bit64.timecnt - 1, timestamp_begin)

 	array_init(return_value);

@@ -4043,7 +4043,7 @@ PHP_FUNCTION(timezone_transitions_get)
 	} else {
 		begin = 0;
 		found = 0;
-		if (tzobj->tzi.tz->bit32.timecnt > 0) {
+		if (tzobj->tzi.tz->bit64.timecnt > 0) {
 			do {
 				if (tzobj->tzi.tz->trans[begin] > timestamp_begin) {
 					if (begin > 0) {
@@ -4055,19 +4055,19 @@ PHP_FUNCTION(timezone_transitions_get)
 					break;
 				}
 				begin++;
-			} while (begin < tzobj->tzi.tz->bit32.timecnt);
+			} while (begin < tzobj->tzi.tz->bit64.timecnt);
 		}
 	}

 	if (!found) {
-		if (tzobj->tzi.tz->bit32.timecnt > 0) {
+		if (tzobj->tzi.tz->bit64.timecnt > 0) {
 			add_last();
 		} else {
 			add_nominal();
 		}
 	} else {
 		unsigned int i;
-		for (i = begin; i < tzobj->tzi.tz->bit32.timecnt; ++i) {
+		for (i = begin; i < tzobj->tzi.tz->bit64.timecnt; ++i) {
 			if (tzobj->tzi.tz->trans[i] < timestamp_end) {
 				add(i, tzobj->tzi.tz->trans[i]);
 			}
@@ -95,11 +95,11 @@ print "wanted=Friday            00:00:00\n\n";

 print "TZ=Pacific/Kwajalein - wrong day.\n";
 date_default_timezone_set("Pacific/Kwajalein");
-$tStamp = mktime (17, 17, 17, 1, 8626, 1970);
+$tStamp = mktime (17, 17, 17, 1, 8627, 1970);
 print "tStamp=". date("l Y-m-d H:i:s T I", $tStamp). "\n";
-$strtotime_tstamp = strtotime("next Friday", $tStamp);
+$strtotime_tstamp = strtotime("next Saturday", $tStamp);
 print "result=".date("l Y-m-d H:i:s T I", $strtotime_tstamp)."\n";
-print "wanted=Friday            00:00:00\n\n";
+print "wanted=Sunday            00:00:00\n\n";

 print "TZ=Asia/Ulan_Bator - wrong day.\n";
 date_default_timezone_set("Asia/Ulan_Bator");
@@ -256,9 +256,9 @@ result=Friday 2003-04-04 00:00:00 EEST 1
 wanted=Friday            00:00:00

 TZ=Pacific/Kwajalein - wrong day.
-tStamp=Friday 1993-08-13 17:17:17 -12 0
-result=Saturday 1993-08-21 00:00:00 +12 0
-wanted=Friday            00:00:00
+tStamp=Saturday 1993-08-14 17:17:17 -12 0
+result=Sunday 1993-08-22 00:00:00 +12 0
+wanted=Sunday            00:00:00

 TZ=Asia/Ulan_Bator - wrong day.
 tStamp=Saturday 2001-09-22 17:17:17 +09 1
@@ -132,11 +132,11 @@ print "wanted=Wednesday            00:15:00\n\n";

 print "TZ=Pacific/Nauru - Is it OK for this to be 0:30? yes\n";
 date_default_timezone_set('Pacific/Nauru');
-$tStamp = mktime (17, 17, 17, 1, 3401, 1970);
+$tStamp = mktime (17, 17, 17, 2, 3, 1979);
 print "tStamp=". date("l Y-m-d H:i:s T I", $tStamp). "\n";
-$strtotime_tstamp = strtotime("next Tuesday", $tStamp);
+$strtotime_tstamp = strtotime("next Saturday +2 hours", $tStamp);
 print "result=".date("l Y-m-d H:i:s T I", $strtotime_tstamp)."\n";
-print "wanted=Tuesday            00:30:00\n\n";
+print "wanted=Saturday            02:30:00\n\n";

 print "TZ=Pacific/Niue - Is it OK for this to be 0:30 AM? yes\n";
 date_default_timezone_set('Pacific/Niue');
@@ -292,9 +292,9 @@ result=Wednesday 1986-01-01 00:15:00 +0545 0
 wanted=Wednesday            00:15:00

 TZ=Pacific/Nauru - Is it OK for this to be 0:30? yes
-tStamp=Tuesday 1979-04-24 17:17:17 +1130 0
-result=Tuesday 1979-05-01 00:30:00 +12 0
-wanted=Tuesday            00:30:00
+tStamp=Saturday 1979-02-03 17:17:17 +1130 0
+result=Saturday 1979-02-10 02:30:00 +12 0
+wanted=Saturday            02:30:00

 TZ=Pacific/Niue - Is it OK for this to be 0:30 AM? yes
 tStamp=Sunday 1978-09-24 17:17:17 -1130 0
@@ -3,7 +3,7 @@ date_modify() function [1]
 --FILE--
 <?php
 date_default_timezone_set("Pacific/Kwajalein");
-$ts = date_create("Thu Aug 19 1993 23:59:59");
+$ts = date_create("Fri Aug 20 1993 23:59:59");
 echo date_format($ts, 'D, d M Y H:i:s T'), "\n";
 $ts->modify("+1 second");
 echo date_format($ts, 'D, d M Y H:i:s T'), "\n";
@@ -20,8 +20,8 @@ $ts->modify("+ 1 hour 1 second");
 echo date_format($ts, 'D, d M Y H:i:s T'), "\n";
 ?>
 --EXPECT--
-Thu, 19 Aug 1993 23:59:59 -12
-Sat, 21 Aug 1993 00:00:00 +12
+Fri, 20 Aug 1993 23:59:59 -12
+Sun, 22 Aug 1993 00:00:00 +12
 Sun, 27 Mar 2005 01:59:59 CET
 Sun, 27 Mar 2005 03:00:00 CEST
 Sun, 30 Oct 2005 01:59:59 CEST
@@ -84,76 +84,6 @@ diff -u a/magic/Magdir/c-lang b/magic/Magdir/c-lang
 !:strength + 30
 !:mime	text/x-c++
 
-diff -u a/magic/Magdir/elf b/magic/Magdir/elf
--- a/magic/Magdir/elf	2018-03-11 01:46:42.000000000 +0100
-+++ b/magic/Magdir/elf	2018-11-10 12:27:29.858619326 +0100
-@@ -48,9 +48,8 @@
- !:mime	application/x-object
- >16	leshort		2		executable,
- !:mime	application/x-executable
->16	leshort		3		${x?pie executable:shared object}
-
-!:mime	application/x-${x?pie-executable:sharedlib}
-+>16	leshort		3		shared object,
-+!:mime	application/x-sharedlib
- >16	leshort		4		core file
- !:mime	application/x-coredump
- # Core file detection is not reliable.
-diff -u a/magic/Magdir/fsav b/magic/Magdir/fsav
--- a/magic/Magdir/fsav	2017-03-17 22:35:28.000000000 +0100
-+++ b/magic/Magdir/fsav	2018-11-10 12:27:29.858619326 +0100
-@@ -48,13 +48,15 @@
- >11	string		>\0		Clam AntiVirus database %-.23s
- >>34	string		:
- >>>35		string		!:	\b, version
->>>>35		string		x 	\b%-.1s
->>>>>36		string 		!:
-+>>>>35		string		x 	\b %-.1s
-+>>>>>36		string		!:
- >>>>>>36	string		x 	\b%-.1s
- >>>>>>>37	string		!:
- >>>>>>>>37	string		x 	\b%-.1s
- >>>>>>>>>38	string		!:
- >>>>>>>>>>38	string		x 	\b%-.1s
-+>>>>>>>>>>>39	string		!:
-+>>>>>>>>>>>>39	string		x 	\b%-.1s
- >512	string		\037\213	\b, gzipped
- >769	string		ustar\0		\b, tarred
- 
-diff -u a/magic/Magdir/images b/magic/Magdir/images
--- a/magic/Magdir/images	2018-03-11 01:46:42.000000000 +0100
-+++ b/magic/Magdir/images	2018-11-10 12:27:29.858619326 +0100
-@@ -464,7 +464,9 @@
- !:mime	image/x-unknown
- 
- # GIF
-+# Strength set up to beat 0x55AA DOS/MBR signature word lookups (+65)
- 0	string		GIF8		GIF image data
-+!:strength +80
- !:mime	image/gif
- !:apple	8BIMGIFf
- >4	string		7a		\b, version 8%s,
-Only in b/magic/Magdir/: images.orig
-diff -u a/magic/Magdir/linux b/magic/Magdir/linux
--- a/magic/Magdir/linux	2017-03-17 22:35:28.000000000 +0100
-+++ b/magic/Magdir/linux	2018-11-10 12:27:29.862619309 +0100
-@@ -94,6 +94,16 @@
- # From Daniel Novotny <dnovotny@redhat.com>
- # swap file for PowerPC
- 65526	string		SWAPSPACE2	Linux/ppc swap file
-+>0x400	long		x		version %d,
-+>0x404	long		x		size %d pages,
-+>1052	string		\0		no label,
-+>1052	string		>\0		LABEL=%s,
-+>0x40c	belong		x		UUID=%08x
-+>0x410	beshort		x		\b-%04x
-+>0x412	beshort		x		\b-%04x
-+>0x414	beshort		x		\b-%04x
-+>0x416	belong		x		\b-%08x
-+>0x41a	beshort		x		\b%04x
- 16374	string		SWAPSPACE2	Linux/ia64 swap file
- #
- # Linux kernel boot images, from Albert Cahalan <acahalan@cs.uml.edu>
 diff -u a/magic/Magdir/python b/magic/Magdir/python
 --- a/magic/Magdir/python	2017-08-14 09:40:38.000000000 +0200
 +++ b/magic/Magdir/python	2018-11-10 13:06:36.799268528 +0100
@@ -18,7 +18,7 @@ ksort($results);
 var_dump($results);
 ?>
 --EXPECTF--
-array(9) {
+array(%d) {
  ["%s/resources/dir.zip"]=>
  string(15) "application/zip"
  ["%s/resources/test.awk"]=>
@@ -37,4 +37,6 @@ array(9) {
  string(9) "image/png"
  ["%s/resources/test.ppt"]=>
  string(29) "application/vnd.ms-powerpoint"
+  ["%s/resources/test.webm"]=>
+  string(10) "video/webm"
 }
@@ -1593,7 +1593,7 @@ void gdImageFilledArc (gdImagePtr im, int cx, int cy, int w, int h, int s, int e
 	int i, pti;
 	int lx = 0, ly = 0;
 	int fx = 0, fy = 0;
-
+	int startx, starty, endx, endy;

    if ((s % 360)  == (e % 360)) {
 		s = 0; e = 360;
@@ -1620,8 +1620,8 @@ void gdImageFilledArc (gdImagePtr im, int cx, int cy, int w, int h, int s, int e

 	for (i = s, pti = 1; i <= e; i++, pti++) {
 		int x, y;
-		x = ((long) gdCosT[i % 360] * (long) w / (2 * 1024)) + cx;
-		y = ((long) gdSinT[i % 360] * (long) h / (2 * 1024)) + cy;
+		x = endx = ((long) gdCosT[i % 360] * (long) w / (2 * 1024)) + cx;
+		y = endy = ((long) gdSinT[i % 360] * (long) h / (2 * 1024)) + cy;
 		if (i != s) {
 			if (!(style & gdChord)) {
 				if (style & gdNoFill) {
@@ -1646,8 +1646,8 @@ void gdImageFilledArc (gdImagePtr im, int cx, int cy, int w, int h, int s, int e
 			if (!(style & (gdChord | gdNoFill))) {
 				pts[0].x = cx;
 				pts[0].y = cy;
-				pts[pti].x = x;
-				pts[pti].y = y;
+				pts[pti].x = startx = x;
+				pts[pti].y = starty = y;
 			}
 		}
 		lx = x;
@@ -1676,6 +1676,24 @@ void gdImageFilledArc (gdImagePtr im, int cx, int cy, int w, int h, int s, int e
 				gdImageLine(im, cx, cy, fx, fy, color);
 			}
 		} else {
+			if (e - s < 360) {
+				if (pts[1].x != startx && pts[1].y == starty) {
+					/* start point has been removed due to y-coord fix => insert it */
+					for (i = pti; i > 1; i--) {
+						pts[i].x = pts[i-1].x;
+						pts[i].y = pts[i-1].y;
+					}
+					pts[1].x = startx;
+					pts[1].y = starty;
+					pti++;
+				}
+				if (pts[pti-1].x != endx && pts[pti-1].y == endy) {
+					/* end point has been removed due to y-coord fix => insert it */
+					pts[pti].x = endx;
+					pts[pti].y = endy;
+					pti++;
+				}
+			}
 			pts[pti].x = cx;
 			pts[pti].y = cy;
 			gdImageFilledPolygon(im, pts, pti+1, color);
@@ -813,8 +813,8 @@ static int bmp_read_1bit(gdImagePtr im, gdIOCtxPtr infile, bmp_info_t *info, bmp
 		}
 	}

-	/* The line must be divisible by 4, else its padded with NULLs */
-	padding = ((int)ceil(0.1 * info->width)) % 4;
+	/* The line must be aligned on a 32 bits word, else it is padded with zeros */
+	padding = (info->width + 7) / 8 % 4;
 	if (padding) {
 		padding = 4 - padding;
 	}
@@ -33,8 +33,8 @@ int gdImageColorMatch (gdImagePtr im1, gdImagePtr im2)
 		return -4; /* At least 1 color must be allocated */
 	}

-	buf = (unsigned long *)safe_emalloc(sizeof(unsigned long), 5 * im2->colorsTotal, 0);
-	memset( buf, 0, sizeof(unsigned long) * 5 * im2->colorsTotal );
+	buf = (unsigned long *)safe_emalloc(sizeof(unsigned long), 5 * gdMaxColors, 0);
+	memset( buf, 0, sizeof(unsigned long) * 5 * gdMaxColors );

 	for (x=0; x<im1->sx; x++) {
 		for( y=0; y<im1->sy; y++ ) {
@@ -662,43 +662,7 @@ static inline int getPixelOverflowTC(gdImagePtr im, const int x, const int y, co
 		}
 		return c;
 	} else {
-		register int border = 0;
-
-		if (y < im->cy1) {
-			border = im->tpixels[0][im->cx1];
-			goto processborder;
-		}
-
-		if (y < im->cy1) {
-			border = im->tpixels[0][im->cx1];
-			goto processborder;
-		}
-
-		if (y > im->cy2) {
-			if (x >= im->cx1 && x <= im->cx1) {
-				border = im->tpixels[im->cy2][x];
-				goto processborder;
-			} else {
-				return gdTrueColorAlpha(0, 0, 0, 127);
-			}
-		}
-
-		/* y is bound safe at this point */
-		if (x < im->cx1) {
-			border = im->tpixels[y][im->cx1];
-			goto processborder;
-		}
-
-		if (x > im->cx2) {
-			border = im->tpixels[y][im->cx2];
-		}
-
-processborder:
-		if (border == im->transparent) {
-			return gdTrueColorAlpha(0, 0, 0, 127);
-		} else{
-			return gdTrueColorAlpha(gdTrueColorGetRed(border), gdTrueColorGetGreen(border), gdTrueColorGetBlue(border), 127);
-		}
+		return bgColor;
 	}
 }

@@ -713,42 +677,7 @@ static inline int getPixelOverflowPalette(gdImagePtr im, const int x, const int
 		}
 		return colorIndex2RGBA(c);
 	} else {
-		register int border = 0;
-		if (y < im->cy1) {
-			border = gdImageGetPixel(im, im->cx1, 0);
-			goto processborder;
-		}
-
-		if (y < im->cy1) {
-			border = gdImageGetPixel(im, im->cx1, 0);
-			goto processborder;
-		}
-
-		if (y > im->cy2) {
-			if (x >= im->cx1 && x <= im->cx1) {
-				border = gdImageGetPixel(im, x,  im->cy2);
-				goto processborder;
-			} else {
-				return gdTrueColorAlpha(0, 0, 0, 127);
-			}
-		}
-
-		/* y is bound safe at this point */
-		if (x < im->cx1) {
-			border = gdImageGetPixel(im, im->cx1, y);
-			goto processborder;
-		}
-
-		if (x > im->cx2) {
-			border = gdImageGetPixel(im, im->cx2, y);
-		}
-
-processborder:
-		if (border == im->transparent) {
-			return gdTrueColorAlpha(0, 0, 0, 127);
-		} else{
-			return colorIndex2RGBcustomA(border, 127);
-		}
+		return bgColor;
 	}
 }

@@ -890,8 +819,13 @@ static inline LineContribType * _gdContributionsAlloc(unsigned int line_length,
 {
 	unsigned int u = 0;
 	LineContribType *res;
-	int overflow_error = 0;
+	size_t weights_size;

+	if (overflow2(windows_size, sizeof(double))) {
+		return NULL;
+	} else {
+		weights_size = windows_size * sizeof(double);
+	}
 	res = (LineContribType *) gdMalloc(sizeof(LineContribType));
 	if (!res) {
 		return NULL;
@@ -908,15 +842,10 @@ static inline LineContribType * _gdContributionsAlloc(unsigned int line_length,
 		return NULL;
 	}
 	for (u = 0 ; u < line_length ; u++) {
-		if (overflow2(windows_size, sizeof(double))) {
-			overflow_error = 1;
-		} else {
-			res->ContribRow[u].Weights = (double *) gdMalloc(windows_size * sizeof(double));
-		}
-		if (overflow_error == 1 || res->ContribRow[u].Weights == NULL) {
+		res->ContribRow[u].Weights = (double *) gdMalloc(weights_size);
+		if (res->ContribRow[u].Weights == NULL) {
 			unsigned int i;
-			u--;
-			for (i=0;i<=u;i++) {
+			for (i=0;i<u;i++) {
 				gdFree(res->ContribRow[i].Weights);
 			}
 			gdFree(res->ContribRow);
@@ -1020,7 +949,7 @@ static inline void _gdScaleRow(gdImagePtr pSrc,  unsigned int src_width, gdImage
    }
 }

-static inline void _gdScaleHoriz(gdImagePtr pSrc, unsigned int src_width, unsigned int src_height, gdImagePtr pDst,  unsigned int dst_width, unsigned int dst_height)
+static inline int _gdScaleHoriz(gdImagePtr pSrc, unsigned int src_width, unsigned int src_height, gdImagePtr pDst,  unsigned int dst_width, unsigned int dst_height)
 {
 	unsigned int u;
 	LineContribType * contrib;
@@ -1035,13 +964,14 @@ static inline void _gdScaleHoriz(gdImagePtr pSrc, unsigned int src_width, unsign

 	contrib = _gdContributionsCalc(dst_width, src_width, (double)dst_width / (double)src_width, pSrc->interpolation);
 	if (contrib == NULL) {
-		return;
+		return 0;
 	}
 	/* Scale each row */
 	for (u = 0; u < dst_height - 1; u++) {
 		_gdScaleRow(pSrc, src_width, pDst, dst_width, u, contrib);
 	}
 	_gdContributionsFree (contrib);
+	return 1;
 }

 static inline void _gdScaleCol (gdImagePtr pSrc,  unsigned int src_width, gdImagePtr pRes, unsigned int dst_width, unsigned int dst_height, unsigned int uCol, LineContribType *contrib)
@@ -1066,7 +996,7 @@ static inline void _gdScaleCol (gdImagePtr pSrc,  unsigned int src_width, gdImag
 	}
 }

-static inline void _gdScaleVert (const gdImagePtr pSrc, const unsigned int src_width, const unsigned int src_height, const gdImagePtr pDst, const unsigned int dst_width, const unsigned int dst_height)
+static inline int _gdScaleVert (const gdImagePtr pSrc, const unsigned int src_width, const unsigned int src_height, const gdImagePtr pDst, const unsigned int dst_width, const unsigned int dst_height)
 {
 	unsigned int u;
 	LineContribType * contrib;
@@ -1081,19 +1011,21 @@ static inline void _gdScaleVert (const gdImagePtr pSrc, const unsigned int src_w

 	contrib = _gdContributionsCalc(dst_height, src_height, (double)(dst_height) / (double)(src_height), pSrc->interpolation);
 	if (contrib == NULL) {
-		return;
+		return 0;
 	}
 	/* scale each column */
 	for (u = 0; u < dst_width - 1; u++) {
 		_gdScaleCol(pSrc, src_width, pDst, dst_width, dst_height, u, contrib);
 	}
 	_gdContributionsFree(contrib);
+	return 1;
 }

 gdImagePtr gdImageScaleTwoPass(const gdImagePtr src, const unsigned int src_width, const unsigned int src_height, const unsigned int new_width, const unsigned int new_height)
 {
 	gdImagePtr tmp_im;
 	gdImagePtr dst;
+	int scale_pass_res;

 	if (new_width == 0 || new_height == 0) {
 		return NULL;
@@ -1109,7 +1041,11 @@ gdImagePtr gdImageScaleTwoPass(const gdImagePtr src, const unsigned int src_widt
 		return NULL;
 	}
 	gdImageSetInterpolationMethod(tmp_im, src->interpolation_id);
-	_gdScaleHoriz(src, src_width, src_height, tmp_im, new_width, src_height);
+	scale_pass_res = _gdScaleHoriz(src, src_width, src_height, tmp_im, new_width, src_height);
+	if (scale_pass_res != 1) {
+		gdImageDestroy(tmp_im);
+		return NULL;
+	}

 	dst = gdImageCreateTrueColor(new_width, new_height);
 	if (dst == NULL) {
@@ -1117,30 +1053,14 @@ gdImagePtr gdImageScaleTwoPass(const gdImagePtr src, const unsigned int src_widt
 		return NULL;
 	}
 	gdImageSetInterpolationMethod(dst, src->interpolation_id);
-	_gdScaleVert(tmp_im, new_width, src_height, dst, new_width, new_height);
-	gdImageDestroy(tmp_im);
-
-	return dst;
-}
-
-gdImagePtr Scale(const gdImagePtr src, const unsigned int src_width, const unsigned int src_height, const gdImagePtr dst, const unsigned int new_width, const unsigned int new_height)
-{
-	gdImagePtr tmp_im;
-
-	if (new_width == 0 || new_height == 0) {
+	scale_pass_res = _gdScaleVert(tmp_im, new_width, src_height, dst, new_width, new_height);
+	if (scale_pass_res != 1) {
+		gdImageDestroy(dst);
+		gdImageDestroy(tmp_im);
 		return NULL;
 	}
-
-	tmp_im = gdImageCreateTrueColor(new_width, src_height);
-	if (tmp_im == NULL) {
-		return NULL;
-	}
-	gdImageSetInterpolationMethod(tmp_im, src->interpolation_id);
-
-	_gdScaleHoriz(src, src_width, src_height, tmp_im, new_width, src_height);
-	_gdScaleVert(tmp_im, new_width, src_height, dst, new_width, new_height);
-
 	gdImageDestroy(tmp_im);
+
 	return dst;
 }

@@ -1315,11 +1235,11 @@ static gdImagePtr gdImageScaleBilinearPalette(gdImagePtr im, const unsigned int
 					f_b1, f_b2, f_b3, f_b4,
 					f_a1, f_a2, f_a3, f_a4;

-			/* zero for the background color, nothig gets outside anyway */
+			/* 0 for bgColor; (n,m) is supposed to be valid anyway */
 			pixel1 = getPixelOverflowPalette(im, n, m, 0);
-			pixel2 = getPixelOverflowPalette(im, n + 1, m, 0);
-			pixel3 = getPixelOverflowPalette(im, n, m + 1, 0);
-			pixel4 = getPixelOverflowPalette(im, n + 1, m + 1, 0);
+			pixel2 = getPixelOverflowPalette(im, n + 1, m, pixel1);
+			pixel3 = getPixelOverflowPalette(im, n, m + 1, pixel1);
+			pixel4 = getPixelOverflowPalette(im, n + 1, m + 1, pixel1);

 			f_r1 = gd_itofx(gdTrueColorGetRed(pixel1));
 			f_r2 = gd_itofx(gdTrueColorGetRed(pixel2));
@@ -1407,11 +1327,11 @@ static gdImagePtr gdImageScaleBilinearTC(gdImagePtr im, const unsigned int new_w
 					f_b1, f_b2, f_b3, f_b4,
 					f_a1, f_a2, f_a3, f_a4;
 			dwSrcTotalOffset = m + n;
-			/* 0 for bgColor, nothing gets outside anyway */
+			/* 0 for bgColor; (n,m) is supposed to be valid anyway */
 			pixel1 = getPixelOverflowTC(im, n, m, 0);
-			pixel2 = getPixelOverflowTC(im, n + 1, m, 0);
-			pixel3 = getPixelOverflowTC(im, n, m + 1, 0);
-			pixel4 = getPixelOverflowTC(im, n + 1, m + 1, 0);
+			pixel2 = getPixelOverflowTC(im, n + 1, m, pixel1);
+			pixel3 = getPixelOverflowTC(im, n, m + 1, pixel1);
+			pixel4 = getPixelOverflowTC(im, n + 1, m + 1, pixel1);

 			f_r1 = gd_itofx(gdTrueColorGetRed(pixel1));
 			f_r2 = gd_itofx(gdTrueColorGetRed(pixel2));
@@ -100,6 +100,7 @@ void gdImageWBMPCtx (gdImagePtr image, int fg, gdIOCtx * out)
 	/* create the WBMP */
 	if ((wbmp = createwbmp (gdImageSX (image), gdImageSY (image), WBMP_WHITE)) == NULL) {
 		gd_error("Could not create WBMP");
+		return;
 	}

 	/* fill up the WBMP structure */
@@ -0,0 +1,45 @@
+--TEST--
+Bug #73281 (imagescale(…, IMG_BILINEAR_FIXED) can cause black border)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.3', '<=')) die('skip upstream fix not yet released');
+?>
+--FILE--
+<?php
+$coordinates = [[0, 0], [0, 199], [199, 199], [199, 0]];
+
+$src = imagecreatetruecolor(100, 100);
+$white = imagecolorallocate($src, 255, 255, 255);
+imagefilledrectangle($src, 0,0, 99,99, $white);
+$dst = imagescale($src, 200, 200, IMG_BILINEAR_FIXED);
+echo "truecolor source\n";
+foreach ($coordinates as $coordinate) {
+    list($x, $y) = $coordinate;
+    printf("%3d, %3d: %x\n", $x, $y, imagecolorat($dst, $x, $y));
+}
+
+$src = imagecreate(100, 100);
+$white = imagecolorallocate($src, 255, 255, 255);
+imagefilledrectangle($src, 0,0, 99,99, $white);
+$dst = imagescale($src, 200, 200, IMG_BILINEAR_FIXED);
+echo "\npalette source\n";
+foreach ($coordinates as $coordinate) {
+    list($x, $y) = $coordinate;
+    printf("%3d, %3d: %x\n", $x, $y, imagecolorat($dst, $x, $y));
+}
+?>
+===DONE===
+--EXPECT--
+truecolor source
+  0,   0: ffffff
+  0, 199: ffffff
+199, 199: ffffff
+199,   0: ffffff
+
+palette source
+  0,   0: ffffff
+  0, 199: ffffff
+199, 199: ffffff
+199,   0: ffffff
+===DONE===
@@ -0,0 +1,27 @@
+--TEST--
+Bug #73614 (gdImageFilledArc() doesn't properly draw pies)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.5', '<=')) die('skip upstream bugfix not yet released');
+?>
+--FILE--
+<?php
+require_once __DIR__ . '/func.inc';
+
+$image = imagecreatetruecolor(500, 500);
+
+$white    = imagecolorallocate($image, 0xFF, 0xFF, 0xFF);
+$navy     = imagecolorallocate($image, 0x00, 0x00, 0x80);
+$red      = imagecolorallocate($image, 0xFF, 0x00, 0x00);
+
+imagefilledarc($image, 250, 250, 500, 250, 0, 88, $white, IMG_ARC_PIE);
+imagefilledarc($image, 250, 250, 500, 250, 88, 91 , $navy, IMG_ARC_PIE);
+imagefilledarc($image, 250, 250, 500, 250, 91, 360 , $red, IMG_ARC_PIE);
+
+test_image_equals_file(__DIR__ . '/bug73614.png', $image);
+?>
+===DONE===
+--EXPECT--
+The images are equal.
+===DONE===
@@ -0,0 +1,21 @@
+--TEST--
+Bug #77269 (Potential unsigned underflow in gdImageScale)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (getenv("SKIP_SLOW_TESTS")) die("skip slow test");
+?>
+--INI--
+memory_limit=2G
+--FILE--
+<?php
+$im = imagecreate(2**28, 1);
+if(is_resource($im)) {
+	imagescale($im, 1, 1, IMG_TRIANGLE);
+}
+?>
+===DONE===
+--EXPECTF--
+Warning: imagescale():%S product of memory allocation multiplication would exceed INT_MAX, failing operation gracefully
+ in %s on line %d
+===DONE===
@@ -0,0 +1,20 @@
+--TEST--
+Bug #77270 (imagecolormatch Out Of Bounds Write on Heap)
+--INI--
+memory_limit=-1
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.5', '<=')) die('skip upstream bugfix has not been released');
+?>
+--FILE--
+<?php
+$img1 = imagecreatetruecolor(0xfff, 0xfff);
+$img2 = imagecreate(0xfff, 0xfff);
+imagecolorallocate($img2, 0, 0, 0);
+imagesetpixel($img2, 0, 0, 255);
+imagecolormatch($img1, $img2);
+?>
+===DONE===
+--EXPECT--
+===DONE===
@@ -0,0 +1,21 @@
+--TEST--
+Bug #77272 (imagescale() may return image resource on failure)
+--INI--
+memory_limit=-1
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNGLED && version_compare(GD_VERSION, '2.2.5', '<=')) die('skip upstream fix not yet released');
+if (getenv("SKIP_SLOW_TESTS")) die("skip slow test");
+?>
+--FILE--
+<?php
+$img = imagecreate(2**28, 1);
+var_dump(imagescale($img, 1, 1, IMG_TRIANGLE));
+?>
+===DONE===
+--EXPECTF--
+Warning: imagescale():%S product of memory allocation multiplication would exceed INT_MAX, failing operation gracefully
+ in %s on line %d
+bool(false)
+===DONE===
@@ -0,0 +1,15 @@
+--TEST--
+Bug #77391 (1bpp BMPs may fail to be loaded)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (!GD_BUNDLED && version_compare(GD_VERSION, '2.2.5', '<=')) die('skip upstream not yet fixed');
+?>
+--FILE--
+<?php
+var_dump(imagecreatefrombmp(__DIR__ . '/bug77391.bmp'));
+?>
+===DONE===
+--EXPECTF--
+resource(%d) of type (gd)
+===DONE===
@@ -0,0 +1,26 @@
+--TEST--
+Bug #77479 (imagewbmp() segfaults with very large image)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+if (getenv("SKIP_SLOW_TESTS")) die("skip slow test");
+?>
+--INI--
+memory_limit=-1
+--FILE--
+<?php
+$im = imagecreate(40000, 20000);
+imagecolorallocate($im, 0, 0, 0);
+imagewbmp($im, __DIR__ . '/77479.wbmp');
+?>
+===DONE===
+--EXPECTF--
+Warning: imagewbmp():%S product of memory allocation multiplication would exceed INT_MAX, failing operation gracefully
+ in %s on line %d
+
+Warning: imagewbmp(): Could not create WBMP in %s on line %d
+===DONE===
+--CLEAN--
+<?php
+@unlink(__DIR__ . '/77479.wbmp');
+?>
@@ -5010,11 +5010,9 @@ PHP_FUNCTION(mb_chr)
 /* }}} */


-static inline char* php_mb_scrub(const char* str, size_t str_len, const mbfl_encoding *enc)
+static inline char* php_mb_scrub(const char* str, size_t str_len, const mbfl_encoding *enc, size_t *ret_len)
 {
-	size_t ret_len;
-
-	return php_mb_convert_encoding_ex(str, str_len, enc, enc, &ret_len);
+	return php_mb_convert_encoding_ex(str, str_len, enc, enc, ret_len);
 }


@@ -5027,6 +5025,7 @@ PHP_FUNCTION(mb_scrub)
 	char *enc_name = NULL;
 	size_t enc_name_len;
 	char *ret;
+	size_t ret_len;

 	ZEND_PARSE_PARAMETERS_START(1, 2)
 		Z_PARAM_STRING(str, str_len)
@@ -5039,13 +5038,13 @@ PHP_FUNCTION(mb_scrub)
 		RETURN_FALSE;
 	}

-	ret = php_mb_scrub(str, str_len, enc);
+	ret = php_mb_scrub(str, str_len, enc, &ret_len);

 	if (ret == NULL) {
 		RETURN_FALSE;
 	}

-	RETVAL_STRING(ret);
+	RETVAL_STRINGL(ret, ret_len);
 	efree(ret);
 }
 /* }}} */
@@ -540,13 +540,13 @@ compile_length_string_node(Node* node, regex_t* reg)
  ambig = NODE_STRING_IS_AMBIG(node);

  p = prev = sn->s;
-  prev_len = enclen(enc, p);
+  SAFE_ENC_LEN(enc, p, sn->end, prev_len);
  p += prev_len;
  slen = 1;
  rlen = 0;

  for (; p < sn->end; ) {
-    len = enclen(enc, p);
+    SAFE_ENC_LEN(enc, p, sn->end, len);
    if (len == prev_len) {
      slen++;
    }
@@ -591,12 +591,12 @@ compile_string_node(Node* node, regex_t* reg)
  ambig = NODE_STRING_IS_AMBIG(node);

  p = prev = sn->s;
-  prev_len = enclen(enc, p);
+  SAFE_ENC_LEN(enc, p, end, prev_len);
  p += prev_len;
  slen = 1;

  for (; p < end; ) {
-    len = enclen(enc, p);
+    SAFE_ENC_LEN(enc, p, end, len);
    if (len == prev_len) {
      slen++;
    }
@@ -3624,7 +3624,7 @@ expand_case_fold_string(Node* node, regex_t* reg)
      goto err;
    }

-    len = enclen(reg->enc, p);
+	SAFE_ENC_LEN(reg->enc, p, end, len);

    if (n == 0) {
      if (IS_NULL(snode)) {
@@ -393,14 +393,17 @@ save_entry(ScanEnv* env, enum SaveType type, int* id)
  c = ONIGENC_MBC_TO_CODE(enc, p, end); \
  pfetch_prev = p; \
  p += ONIGENC_MBC_ENC_LEN(enc, p); \
+  if(UNEXPECTED(p > end)) p = end; \
 } while (0)

 #define PINC_S     do { \
  p += ONIGENC_MBC_ENC_LEN(enc, p); \
+  if(UNEXPECTED(p > end)) p = end; \
 } while (0)
 #define PFETCH_S(c) do { \
  c = ONIGENC_MBC_TO_CODE(enc, p, end); \
  p += ONIGENC_MBC_ENC_LEN(enc, p); \
+  if(UNEXPECTED(p > end)) p = end; \
 } while (0)

 #define PPEEK        (p < end ? ONIGENC_MBC_TO_CODE(enc, p, end) : PEND_VALUE)
@@ -5409,7 +5412,9 @@ fetch_token(OnigToken* tok, UChar** src, UChar* end, ScanEnv* env)
          tok->u.code = c2;
        }
        else { /* string */
-          p = tok->backp + enclen(enc, tok->backp);
+          int len;
+          SAFE_ENC_LEN(enc, tok->backp, end, len);
+          p = tok->backp + len;
        }
      }
      break;
@@ -455,4 +455,16 @@ extern int onig_global_callout_names_free(void);
 extern int onig_print_names(FILE*, regex_t*);
 #endif

+#if (defined (__GNUC__) && __GNUC__ > 2 ) && !defined(DARWIN) && !defined(__hpux) && !defined(_AIX)
+# define UNEXPECTED(condition) __builtin_expect(condition, 0)
+#else
+# define UNEXPECTED(condition) (condition)
+#endif
+
+#define SAFE_ENC_LEN(enc, p, end, res) do {  \
+    int __res = enclen(enc, p);              \
+    if (UNEXPECTED(p + __res > end)) __res = end - p;    \
+	res = __res;                             \
+} while(0);
+
 #endif /* REGPARSE_H */
@@ -128,16 +128,18 @@ utf16be_is_mbc_newline(const UChar* p, const UChar* end)
 }

 static OnigCodePoint
-utf16be_mbc_to_code(const UChar* p, const UChar* end ARG_UNUSED)
+utf16be_mbc_to_code(const UChar* p, const UChar* end)
 {
  OnigCodePoint code;

  if (UTF16_IS_SURROGATE_FIRST(*p)) {
+    if (end - p < 4) return 0;
    code = ((((p[0] - 0xd8) << 2) + ((p[1] & 0xc0) >> 6) + 1) << 16)
         + ((((p[1] & 0x3f) << 2) + (p[2] - 0xdc)) << 8)
         + p[3];
  }
  else {
+    if (end - p < 2) return 0;
    code = p[0] * 256 + p[1];
  }
  return code;
@@ -141,13 +141,14 @@ utf16le_is_mbc_newline(const UChar* p, const UChar* end)
 }

 static OnigCodePoint
-utf16le_mbc_to_code(const UChar* p, const UChar* end ARG_UNUSED)
+utf16le_mbc_to_code(const UChar* p, const UChar* end)
 {
  OnigCodePoint code;
  UChar c0 = *p;
  UChar c1 = *(p+1);

  if (UTF16_IS_SURROGATE_FIRST(c1)) {
+    if (end - p < 4) return 0;
    code = ((((c1 - 0xd8) << 2) + ((c0  & 0xc0) >> 6) + 1) << 16)
         + ((((c0 & 0x3f) << 2) + (p[3] - 0xdc)) << 8)
         + p[2];
@@ -67,6 +67,7 @@ utf32be_is_mbc_newline(const UChar* p, const UChar* end)
 static OnigCodePoint
 utf32be_mbc_to_code(const UChar* p, const UChar* end ARG_UNUSED)
 {
+  if (end - p < 4) return 0;
  return (OnigCodePoint )(((p[0] * 256 + p[1]) * 256 + p[2]) * 256 + p[3]);
 }

@@ -67,6 +67,7 @@ utf32le_is_mbc_newline(const UChar* p, const UChar* end)
 static OnigCodePoint
 utf32le_mbc_to_code(const UChar* p, const UChar* end ARG_UNUSED)
 {
+  if (end - p < 4) return 0;
  return (OnigCodePoint )(((p[3] * 256 + p[2]) * 256 + p[1]) * 256 + p[0]);
 }

@@ -791,7 +791,9 @@ static inline void mb_regex_substitute(
 				no = onig_name_to_backref_number(regexp, (OnigUChar *)name, (OnigUChar *)name_end, regs);
 				break;
 			default:
-				p += clen;
+				/* We're not treating \ as an escape character and will interpret something like
+				 * \\1 as \ followed by \1, rather than \\ followed by 1. This is because this
+				 * function has not supported escaping of backslashes historically. */
 				smart_str_appendl(pbuf, sp, p - sp);
 				continue;
 		}
@@ -1238,7 +1240,6 @@ PHP_FUNCTION(mb_split)
 	size_t string_len;

 	int err;
-	size_t n;
 	zend_long count = -1;

 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "ss|l", &arg_pattern, &arg_pattern_len, &string, &string_len, &count) == FAILURE) {
@@ -1296,8 +1297,8 @@ PHP_FUNCTION(mb_split)
 	}

 	/* otherwise we just have one last element to add to the array */
-	n = ((OnigUChar *)(string + string_len) - chunk_pos);
-	if (n > 0) {
+	if ((OnigUChar *)(string + string_len) > chunk_pos) {
+		size_t n = ((OnigUChar *)(string + string_len) - chunk_pos);
 		add_next_index_stringl(return_value, (char *)chunk_pos, n);
 	} else {
 		add_next_index_stringl(return_value, "", 0);
@@ -0,0 +1,21 @@
+--TEST--
+Bug #77367 (Negative size parameter in mb_split)
+--SKIPIF--
+<?php
+if (!extension_loaded('mbstring')) die('mbstring extension not available');
+if (!function_exists('mb_split')) die('mb_split() not available');
+?>
+--FILE--
+<?php
+mb_regex_encoding('UTF-8');
+var_dump(mb_split("\\w", "\xfc"));
+?>
+===DONE===
+--EXPECT--
+array(2) {
+  [0]=>
+  string(0) ""
+  [1]=>
+  string(0) ""
+}
+===DONE===
@@ -0,0 +1,11 @@
+--TEST--
+Bug #77370 (Buffer overflow on mb regex functions - fetch_token)
+--SKIPIF--
+<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+--FILE--
+<?php
+var_dump(mb_split("   \xfd",""));
+?>
+--EXPECTF--
+Warning: mb_split(): mbregex compile err: invalid code point value in %sbug77370.php on line %d
+bool(false)
@@ -0,0 +1,11 @@
+--TEST--
+Bug #77371 (heap buffer overflow in mb regex functions - compile_string_node)
+--SKIPIF--
+<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+--FILE--
+<?php
+var_dump(mb_ereg("()0\xfc00000\xfc00000\xfc00000\xfc",""));
+?>
+--EXPECTF--
+Warning: mb_ereg(): mbregex compile err: invalid code point value in %sbug77371.php on line %d
+bool(false)
@@ -0,0 +1,23 @@
+--TEST--
+Bug #77381 (heap buffer overflow in multibyte match_at)
+--SKIPIF--
+<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+--FILE--
+<?php
+var_dump(mb_ereg("000||0\xfa","0"));
+var_dump(mb_ereg("(?i)000000000000000000000\xf0",""));
+var_dump(mb_ereg("0000\\"."\xf5","0"));
+var_dump(mb_ereg("(?i)FFF00000000000000000\xfd",""));
+?>
+--EXPECTF--
+Warning: mb_ereg(): mbregex compile err: invalid code point value in %sbug77381.php on line %d
+bool(false)
+
+Warning: mb_ereg(): mbregex compile err: invalid code point value in %sbug77381.php on line %d
+bool(false)
+
+Warning: mb_ereg(): mbregex compile err: invalid code point value in %sbug77381.php on line %d
+bool(false)
+
+Warning: mb_ereg(): mbregex compile err: invalid code point value in %sbug77381.php on line %d
+bool(false)
@@ -0,0 +1,14 @@
+--TEST--
+Bug #77371 (Heap overflow in utf32be_mbc_to_code)
+--SKIPIF--
+<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+--FILE--
+<?php
+mb_regex_encoding("UTF-32");
+var_dump(mb_split("\x00\x00\x00\x5c\x00\x00\x00B","000000000000000000000000000000"));
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  string(30) "000000000000000000000000000000"
+}
@@ -0,0 +1,14 @@
+--TEST--
+Bug #77428: mb_ereg_replace() doesn't replace a substitution variable 
+--FILE--
+<?php
+
+// This behavior is broken, but kept for BC reasons
+var_dump(mb_ereg_replace('(%)', '\\\1', 'a%c'));
+// For clarify, the above line is equivalent to:
+var_dump(mb_ereg_replace('(%)', '\\\\1', 'a%c'));
+
+?>
+--EXPECT--
+string(4) "a\%c"
+string(4) "a\%c"
@@ -0,0 +1,16 @@
+--TEST--
+Bug #77454: mb_scrub() silently truncates after a null byte
+--FILE--
+<?php
+$str = "before\0after";
+function test($str, $enc) {
+    echo str_replace("\0", '\0', mb_scrub($str, $enc)), "\n";
+}
+test($str, 'latin1');
+test($str, 'utf-8');
+test($str, 'ascii');
+?>
+--EXPECT--
+before\0after
+before\0after
+before\0after
@@ -188,7 +188,7 @@ PHPAPI void mysqlnd_free_result_bind_dtor(MYSQLND_RESULT_BIND * result_bind);
 PHPAPI const char * mysqlnd_field_type_name(const enum mysqlnd_field_types field_type);

 /* LOAD DATA LOCAL */
-void mysqlnd_local_infile_default(MYSQLND_CONN_DATA * conn);
+PHPAPI void mysqlnd_local_infile_default(MYSQLND_CONN_DATA * conn);

 /* Simple commands */
 #define mysqlnd_autocommit(conn, mode)		((conn)->data)->m->set_autocommit((conn)->data, (mode))
@@ -35,7 +35,7 @@ struct st_mysqlnd_plugin__plugin_area_getters
 	void ** (*get_vio_area)(const MYSQLND_VIO * vio, const unsigned int plugin_id);
 };

-extern struct st_mysqlnd_plugin__plugin_area_getters mysqlnd_plugin_area_getters;
+PHPAPI extern struct st_mysqlnd_plugin__plugin_area_getters mysqlnd_plugin_area_getters;

 #define mysqlnd_plugin_get_plugin_connection_data(c, p_id)				mysqlnd_plugin_area_getters.get_connection_area((c), (p_id))
 #define mysqlnd_plugin_get_plugin_connection_data_data(c, p_id)			mysqlnd_plugin_area_getters.get_connection_data_area((c), (p_id))
@@ -124,7 +124,7 @@ struct st_mysqlnd_plugin_methods_xetters
 	} command_factory;
 };

-extern struct st_mysqlnd_plugin_methods_xetters mysqlnd_plugin_methods_xetters;
+PHPAPI extern struct st_mysqlnd_plugin_methods_xetters mysqlnd_plugin_methods_xetters;


 #define mysqlnd_object_factory_get_methods()	mysqlnd_plugin_methods_xetters.object_factory.get()
@@ -123,7 +123,7 @@ void mysqlnd_local_infile_end(void * ptr)


 /* {{{ mysqlnd_local_infile_default */
-void
+PHPAPI void
 mysqlnd_local_infile_default(MYSQLND_CONN_DATA * conn)
 {
 	conn->infile.local_infile_init = mysqlnd_local_infile_init;
@@ -651,6 +651,7 @@ MYSQLND_METHOD(mysqlnd_result_unbuffered, fetch_row_c)(MYSQLND_RES * result, voi
 	MYSQLND_PACKET_ROW	*row_packet = result->unbuf->row_packet;
 	MYSQLND_RES_METADATA * const meta = result->meta;
 	MYSQLND_CONN_DATA * const conn = result->conn;
+	void *checkpoint;

 	DBG_ENTER("mysqlnd_result_unbuffered::fetch_row_c");

@@ -670,6 +671,9 @@ MYSQLND_METHOD(mysqlnd_result_unbuffered, fetch_row_c)(MYSQLND_RES * result, voi
 	/* Let the row packet fill our buffer and skip additional mnd_malloc + memcpy */
 	row_packet->skip_extraction = FALSE;

+	checkpoint = result->memory_pool->checkpoint;
+	mysqlnd_mempool_save_state(result->memory_pool);
+
 	/*
 	  If we skip rows (row == NULL) we have to
 	  result->m.unbuffered_free_last_data() before it. The function returns always true.
@@ -694,6 +698,8 @@ MYSQLND_METHOD(mysqlnd_result_unbuffered, fetch_row_c)(MYSQLND_RES * result, voi
 											conn->options->int_and_float_native,
 											conn->stats);
 			if (PASS != rc) {
+				mysqlnd_mempool_restore_state(result->memory_pool);
+				result->memory_pool->checkpoint = checkpoint;
 				DBG_RETURN(FAIL);
 			}
 			{
@@ -757,6 +763,9 @@ MYSQLND_METHOD(mysqlnd_result_unbuffered, fetch_row_c)(MYSQLND_RES * result, voi
 		result->unbuf->m.free_last_data(result->unbuf, conn->stats);
 	}

+	mysqlnd_mempool_restore_state(result->memory_pool);
+	result->memory_pool->checkpoint = checkpoint;
+
 	DBG_INF_FMT("ret=%s fetched=%u", ret == PASS? "PASS":"FAIL", *fetched_anything);
 	DBG_RETURN(PASS);
 }
@@ -805,9 +805,9 @@ void zend_optimizer_compact_literals(zend_op_array *op_array, zend_optimizer_ctx
 					zval *val = &op_array->literals[opline->op2.constant];

 					if (Z_TYPE_P(val) == IS_CONSTANT_AST) {
-						uint32_t slot = ZEND_MM_ALIGNED_SIZE_EX(op_array->cache_size, 8);
-
-						Z_CACHE_SLOT_P(val) = slot;
+						/* Ensure zval is aligned to 8 bytes */
+						op_array->cache_size = ZEND_MM_ALIGNED_SIZE_EX(op_array->cache_size, 8);
+						Z_CACHE_SLOT_P(val) = op_array->cache_size;
 						op_array->cache_size += sizeof(zval);
 					}
 				} else if (opline->opcode != ZEND_RECV) {
@@ -510,13 +510,54 @@ static void compress_block(zend_op_array *op_array, zend_basic_block *block)
 	}
 }

+static void replace_predecessor(zend_ssa *ssa, int block_id, int old_pred, int new_pred) {
+	zend_basic_block *block = &ssa->cfg.blocks[block_id];
+	int *predecessors = &ssa->cfg.predecessors[block->predecessor_offset];
+	zend_ssa_phi *phi;
+
+	int i;
+	int old_pred_idx = -1;
+	int new_pred_idx = -1;
+	for (i = 0; i < block->predecessors_count; i++) {
+		if (predecessors[i] == old_pred) {
+			old_pred_idx = i;
+		}
+		if (predecessors[i] == new_pred) {
+			new_pred_idx = i;
+		}
+	}
+
+	ZEND_ASSERT(old_pred_idx != -1);
+	if (new_pred_idx == -1) {
+		/* If the new predecessor doesn't exist yet, simply rewire the old one */
+		predecessors[old_pred_idx] = new_pred;
+	} else {
+		/* Otherwise, rewiring the old predecessor would make the new predecessor appear
+		 * twice, which violates our CFG invariants. Remove the old predecessor instead. */
+		memmove(
+			predecessors + old_pred_idx,
+			predecessors + old_pred_idx + 1,
+			sizeof(int) * (block->predecessors_count - old_pred_idx - 1)
+		);
+
+		/* Also remove the corresponding phi node entries */
+		for (phi = ssa->blocks[block_id].phis; phi; phi = phi->next) {
+			memmove(
+				phi->sources + old_pred_idx,
+				phi->sources + old_pred_idx + 1,
+				sizeof(int) * (block->predecessors_count - old_pred_idx - 1)
+			);
+		}
+
+		block->predecessors_count--;
+	}
+}
+
 static void zend_ssa_replace_control_link(zend_op_array *op_array, zend_ssa *ssa, int from, int to, int new_to)
 {
 	zend_basic_block *src = &ssa->cfg.blocks[from];
 	zend_basic_block *old = &ssa->cfg.blocks[to];
 	zend_basic_block *dst = &ssa->cfg.blocks[new_to];
-	int *predecessors = &ssa->cfg.predecessors[dst->predecessor_offset];
-	int dup = 0;
 	int i;
 	zend_op *opline;

@@ -585,16 +626,7 @@ static void zend_ssa_replace_control_link(zend_op_array *op_array, zend_ssa *ssa
 		}
 	}

-	for (i = 0; i < dst->predecessors_count; i++) {
-		if (dup) {
-			predecessors[i] = predecessors[i+1];
-		} else if (predecessors[i] == to) {
-			predecessors[i] = from;
-		} else if (predecessors[i] == from) {
-			dup = 1;
-			dst->predecessors_count--;
-		}
-	}
+	replace_predecessor(ssa, new_to, to, from);
 }

 static void zend_ssa_unlink_block(zend_op_array *op_array, zend_ssa *ssa, zend_basic_block *block, int block_num)
@@ -50,7 +50,7 @@
 	}										\
 	jmp_hitlist[jmp_hitlist_count++] = ZEND_OP2_JMP_ADDR(target);

-void zend_optimizer_pass3(zend_op_array *op_array)
+void zend_optimizer_pass3(zend_op_array *op_array, zend_optimizer_ctx *ctx)
 {
 	zend_op *opline;
 	zend_op *end = op_array->opcodes + op_array->last;
@@ -90,16 +90,17 @@ void zend_optimizer_pass3(zend_op_array *op_array)
 						break;
 					}

-					if ((opline->op2_type & (IS_VAR | IS_CV))
+					/* change $i=expr+$i to $i=$i+expr so that the following optimization
+					 * works on it. Only do this if we are ignoring operator overloading,
+					 * as operand order might be significant otherwise. */
+					if ((ctx->optimization_level & ZEND_OPTIMIZER_IGNORE_OVERLOADING)
+						&& (opline->op2_type & (IS_VAR | IS_CV))
 						&& opline->op2.var == next_opline->op1.var &&
 						(opline->opcode == ZEND_ADD ||
 						 opline->opcode == ZEND_MUL ||
 						 opline->opcode == ZEND_BW_OR ||
 						 opline->opcode == ZEND_BW_AND ||
 						 opline->opcode == ZEND_BW_XOR)) {
-						/* change $i=expr+$i to $i=$i+expr so that the next
-						* optimization works on it
-						*/
 						zend_uchar tmp_type = opline->op1_type;
 						znode_op tmp = opline->op1;

@@ -111,6 +112,7 @@ void zend_optimizer_pass3(zend_op_array *op_array)
 							COPY_NODE(opline->op2, tmp);
 						}
 					}
+
 					if ((opline->op1_type & (IS_VAR | IS_CV))
 						&& opline->op1.var == next_opline->op1.var
 						&& opline->op1_type == next_opline->op1_type) {
@@ -1102,6 +1102,10 @@ static void sccp_visit_instr(scdf_ctx *scdf, zend_op *opline, zend_ssa_op *ssa_o
 					SET_RESULT(result, data);
 					SET_RESULT(op1, &zv);
 				} else if (ct_eval_assign_dim(&zv, data, op2) == SUCCESS) {
+					/* Mark array containing partial array as partial */
+					if (IS_PARTIAL_ARRAY(data)) {
+						MAKE_PARTIAL_ARRAY(&zv);
+					}
 					SET_RESULT(result, data);
 					SET_RESULT(op1, &zv);
 				} else {
@@ -1401,19 +1405,24 @@ static void sccp_visit_instr(scdf_ctx *scdf, zend_op *opline, zend_ssa_op *ssa_o
 						if (IS_BOT(data)) {
 							dup_partial_array(&zv, op1);
 							ct_eval_del_array_elem(&zv, op2);
-						} else {
-							if (zend_optimizer_eval_binary_op(&tmp, zend_compound_assign_to_binary_op(opline->opcode), &tmp, data) != SUCCESS) {
-								SET_RESULT_BOT(result);
-								SET_RESULT_BOT(op1);
-								zval_ptr_dtor_nogc(&tmp);
-								break;
-							}
+							SET_RESULT_BOT(result);
+							SET_RESULT(op1, &zv);
+							zval_ptr_dtor_nogc(&tmp);
+							zval_ptr_dtor_nogc(&zv);
+							break;
+						}

-							if (IS_PARTIAL_ARRAY(op1)) {
-								dup_partial_array(&zv, op1);
-							} else {
-								ZVAL_COPY(&zv, op1);
-							}
+						if (zend_optimizer_eval_binary_op(&tmp, zend_compound_assign_to_binary_op(opline->opcode), &tmp, data) != SUCCESS) {
+							SET_RESULT_BOT(result);
+							SET_RESULT_BOT(op1);
+							zval_ptr_dtor_nogc(&tmp);
+							break;
+						}
+
+						if (IS_PARTIAL_ARRAY(op1)) {
+							dup_partial_array(&zv, op1);
+						} else {
+							ZVAL_COPY(&zv, op1);
 						}

 						if (ct_eval_assign_dim(&zv, &tmp, op2) == SUCCESS) {
@@ -1423,6 +1432,7 @@ static void sccp_visit_instr(scdf_ctx *scdf, zend_op *opline, zend_ssa_op *ssa_o
 							zval_ptr_dtor_nogc(&zv);
 							break;
 						}
+
 						zval_ptr_dtor_nogc(&tmp);
 						zval_ptr_dtor_nogc(&zv);
 					}
@@ -1440,17 +1450,22 @@ static void sccp_visit_instr(scdf_ctx *scdf, zend_op *opline, zend_ssa_op *ssa_o
 						if (IS_BOT(data)) {
 							dup_partial_object(&zv, op1);
 							ct_eval_del_obj_prop(&zv, op2);
-						} else {
-							if (zend_optimizer_eval_binary_op(&tmp, zend_compound_assign_to_binary_op(opline->opcode), &tmp, data) != SUCCESS) {
-								SET_RESULT_BOT(result);
-								SET_RESULT_BOT(op1);
-								zval_ptr_dtor_nogc(&tmp);
-								break;
-							}
-
-							dup_partial_object(&zv, op1);
+							SET_RESULT_BOT(result);
+							SET_RESULT(op1, &zv);
+							zval_ptr_dtor_nogc(&tmp);
+							zval_ptr_dtor_nogc(&zv);
+							break;
 						}

+						if (zend_optimizer_eval_binary_op(&tmp, zend_compound_assign_to_binary_op(opline->opcode), &tmp, data) != SUCCESS) {
+							SET_RESULT_BOT(result);
+							SET_RESULT_BOT(op1);
+							zval_ptr_dtor_nogc(&tmp);
+							break;
+						}
+
+						dup_partial_object(&zv, op1);
+
 						if (ct_eval_assign_obj(&zv, &tmp, op2) == SUCCESS) {
 							SET_RESULT(result, &tmp);
 							SET_RESULT(op1, &zv);
@@ -1458,6 +1473,7 @@ static void sccp_visit_instr(scdf_ctx *scdf, zend_op *opline, zend_ssa_op *ssa_o
 							zval_ptr_dtor_nogc(&zv);
 							break;
 						}
+
 						zval_ptr_dtor_nogc(&tmp);
 						zval_ptr_dtor_nogc(&zv);
 					}
@@ -2356,8 +2372,8 @@ int sccp_optimize_op_array(zend_optimizer_ctx *ctx, zend_op_array *op_array, zen
 			}
 			fprintf(stderr, "    #%d.", i);
 			zend_dump_var(op_array, IS_CV, ssa->vars[i].var);
-			if (IS_PARTIAL_ARRAY(zv)) {
-				fprintf(stderr, " = [");
+			if (Z_TYPE_P(zv) == IS_ARRAY || IS_PARTIAL_ARRAY(zv)) {
+				fprintf(stderr, " = %s[", IS_PARTIAL_ARRAY(zv) ? "partial " : "");
 				zend_dump_ht(Z_ARRVAL_P(zv));
 				fprintf(stderr, "]");
 			} else if (IS_PARTIAL_OBJECT(zv)) {
@@ -621,6 +621,39 @@ void zend_optimizer_remove_live_range(zend_op_array *op_array, uint32_t var)
 	}
 }

+static uint32_t zend_determine_constructor_call(zend_op_array *op_array, uint32_t start) {
+	int call = 0;
+	while (++start < op_array->last) {
+		switch (op_array->opcodes[start].opcode) {
+			case ZEND_INIT_FCALL_BY_NAME:
+			case ZEND_INIT_NS_FCALL_BY_NAME:
+			case ZEND_INIT_STATIC_METHOD_CALL:
+			case ZEND_INIT_METHOD_CALL:
+			case ZEND_INIT_FCALL:
+			case ZEND_NEW:
+			case ZEND_INIT_DYNAMIC_CALL:
+			case ZEND_INIT_USER_CALL:
+				call++;
+				break;
+			case ZEND_DO_FCALL:
+				if (call == 0) {
+					return start;
+				}
+			/* break missing intentionally */
+			case ZEND_DO_ICALL:
+			case ZEND_DO_UCALL:
+			case ZEND_DO_FCALL_BY_NAME:
+				call--;
+				break;
+			default:
+				break;
+		}
+	}
+
+	ZEND_ASSERT(0);
+	return -1;
+}
+
 void zend_optimizer_remove_live_range_ex(zend_op_array *op_array, uint32_t var, uint32_t start)
 {
 	uint32_t i = 0;
@@ -638,7 +671,12 @@ void zend_optimizer_remove_live_range_ex(zend_op_array *op_array, uint32_t var,
 		case ZEND_FE_RESET_R:
 		case ZEND_FE_RESET_RW:
 			var |= ZEND_LIVE_LOOP;
-			/* break missing intentionally */
+			start++;
+			break;
+		case ZEND_NEW:
+			start = zend_determine_constructor_call(op_array, start);
+			start++;
+			break;
 		default:
 			start++;
 	}
@@ -1093,7 +1131,7 @@ static void zend_optimize(zend_op_array      *op_array,
 	 * - change $i++ to ++$i where possible
 	 */
 	if (ZEND_OPTIMIZER_PASS_3 & ctx->optimization_level) {
-		zend_optimizer_pass3(op_array);
+		zend_optimizer_pass3(op_array, ctx);
 		if (ctx->debug_level & ZEND_DUMP_AFTER_PASS_3) {
 			zend_dump_op_array(op_array, 0, "after pass 3", NULL);
 		}
@@ -95,7 +95,7 @@ void zend_optimizer_remove_live_range(zend_op_array *op_array, uint32_t var);
 void zend_optimizer_remove_live_range_ex(zend_op_array *op_array, uint32_t var, uint32_t start);
 void zend_optimizer_pass1(zend_op_array *op_array, zend_optimizer_ctx *ctx);
 void zend_optimizer_pass2(zend_op_array *op_array);
-void zend_optimizer_pass3(zend_op_array *op_array);
+void zend_optimizer_pass3(zend_op_array *op_array, zend_optimizer_ctx *ctx);
 void zend_optimize_func_calls(zend_op_array *op_array, zend_optimizer_ctx *ctx);
 void zend_optimize_cfg(zend_op_array *op_array, zend_optimizer_ctx *ctx);
 void zend_optimize_dfa(zend_op_array *op_array, zend_optimizer_ctx *ctx);
@@ -90,23 +90,9 @@
 #ifndef ZEND_WIN32
 extern int lock_file;

-# if defined(__FreeBSD__) || defined(__FreeBSD_kernel__) || (defined(__APPLE__) && defined(__MACH__)/* Darwin */) || defined(__OpenBSD__) || defined(__NetBSD__)
+# if defined(HAVE_FLOCK_AIX64)
 #  define FLOCK_STRUCTURE(name, type, whence, start, len) \
-		struct flock name = {start, len, -1, type, whence}
-# elif defined(__svr4__)
-#  define FLOCK_STRUCTURE(name, type, whence, start, len) \
-		struct flock name = {type, whence, start, len}
-# elif defined(__linux__) || defined(__hpux) || defined(__GNU__)
-#  define FLOCK_STRUCTURE(name, type, whence, start, len) \
-		struct flock name = {type, whence, start, len, 0}
-# elif defined(_AIX)
-#  if defined(_LARGE_FILES) || defined(__64BIT__)
-#   define FLOCK_STRUCTURE(name, type, whence, start, len) \
 		struct flock name = {type, whence, 0, 0, 0, start, len }
-#  else
-#   define FLOCK_STRUCTURE(name, type, whence, start, len) \
-		struct flock name = {type, whence, start, len}
-#  endif
 # elif defined(HAVE_FLOCK_BSD)
 #  define FLOCK_STRUCTURE(name, type, whence, start, len) \
 		struct flock name = {start, len, -1, type, whence}
@@ -342,7 +342,25 @@ int main() {
  AC_MSG_RESULT([$msg])

 flock_type=unknown
-AC_MSG_CHECKING("whether flock struct is linux ordered")
+AC_MSG_CHECKING(for struct flock layout)
+
+if test "$flock_type" = "unknown"; then
+AC_RUN_IFELSE([AC_LANG_SOURCE([[
+  #include <fcntl.h>
+  struct flock lock = { 1, 2, 3, 4, 5, 6, 7 };
+  int main() {
+    if(lock.l_type == 1 && lock.l_whence == 2 && lock.l_start == 6 && lock.l_len== 7) {
+		return 0;
+    }
+    return 1;
+  }
+]])], [
+    flock_type=aix64
+    AC_DEFINE([HAVE_FLOCK_AIX64], [], [Struct flock is 64-bit AIX-type])
+], [])
+fi
+
+if test "$flock_type" = "unknown"; then
 AC_RUN_IFELSE([AC_LANG_SOURCE([[
  #include <fcntl.h>
  struct flock lock = { 1, 2, 3, 4, 5 };
@@ -355,10 +373,10 @@ AC_RUN_IFELSE([AC_LANG_SOURCE([[
 ]])], [
 	flock_type=linux
    AC_DEFINE([HAVE_FLOCK_LINUX], [], [Struct flock is Linux-type])
-    AC_MSG_RESULT("yes")
-], [AC_MSG_RESULT("no")], [AC_MSG_RESULT([no])])
+], [])
+fi

-AC_MSG_CHECKING("whether flock struct is BSD ordered")
+if test "$flock_type" = "unknown"; then
 AC_RUN_IFELSE([AC_LANG_SOURCE([[
  #include <fcntl.h>
  struct flock lock = { 1, 2, 3, 4, 5 };
@@ -371,8 +389,10 @@ AC_RUN_IFELSE([AC_LANG_SOURCE([[
 ]])], [
 	flock_type=bsd
    AC_DEFINE([HAVE_FLOCK_BSD], [], [Struct flock is BSD-type])
-    AC_MSG_RESULT("yes")
-], [AC_MSG_RESULT("no")], [AC_MSG_RESULT([no])])
+], [])
+fi
+
+AC_MSG_RESULT([$flock_type])

 if test "$flock_type" = "unknown"; then
 	AC_MSG_ERROR([Don't know how to define struct flock on this system[,] set --enable-opcache=no])
@@ -0,0 +1,21 @@
+--TEST--
+Bug #77257: value of variable assigned in a switch() construct gets lost
+--FILE--
+<?php
+function test($x) {
+    $a = false;
+    switch($x["y"]) {
+        case "a":
+            $a = true;
+            break;
+        case "b":
+            break;
+        case "c":
+            break;
+    }
+    return $a;
+}
+var_dump(test(["y" => "a"]));
+?>
+--EXPECT--
+bool(true)
@@ -0,0 +1,33 @@
+--TEST--
+Bug #77266 (Assertion failed in dce_live_ranges)
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.optimization_level=-1
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+final class Lock
+{
+	private static function clearOrphanedLocks()
+	{
+		$lockList = [];
+
+		$serverMonitors = array();
+		$listCount = count($lockList);
+		if ( is_array($lockList) && $listCount > 0 ) {
+			$v = explode(':', $value);
+			if (!$serverMonitors[$v[0]]['m']) {
+				$serverMonitors[$v[0]]['m'] = new ServerMonitor($v[0]);
+			}
+
+		}
+
+	}
+
+}
+?>
+okey
+--EXPECT--
+okey
@@ -0,0 +1,19 @@
+--TEST--
+Bug #77310 (1): Incorrect SCCP for compound assign to arrays
+--FILE--
+<?php
+
+function breakit($data_arr) {
+    $foo[0] = "";
+    for ($i = 0; $i < count($data_arr); $i++) {
+        $foo[0] .= $data_arr[$i];
+    }
+    echo $foo[0] . "\n";
+}
+
+$data = ['zero', 'one', 'two'];
+breakit($data);
+
+?>
+--EXPECT--
+zeroonetwo
@@ -0,0 +1,28 @@
+--TEST--
+Bug #77434: php-fpm workers are segfaulting in zend_gc_addref
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.optimization_level=-1
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+
+function test(int $x) {
+    $a = ['a' => 0, 'b' => $x];
+    $b = [];
+    $b[0] = $a;
+    $c = $b[0];
+}
+
+function test2(int $x) {
+    $a = ['a' => 0, 'b' => $x];
+    $b = [$a];
+    $c = $b[0];
+}
+
+?>
+===DONE===
+--EXPECT--
+===DONE===
@@ -0,0 +1,116 @@
+<?php
+
+class CertificateGenerator
+{
+    const CONFIG = __DIR__. DIRECTORY_SEPARATOR . 'openssl.cnf';
+
+    /** @var resource */
+    private $ca;
+
+    /** @var resource */
+    private $caKey;
+
+    /** @var resource|null */
+    private $lastCert;
+
+    /** @var resource|null */
+    private $lastKey;
+
+    public function __construct()
+    {
+        if (!extension_loaded('openssl')) {
+            throw new RuntimeException(
+                'openssl extension must be loaded to generate certificates'
+            );
+        }
+        $this->generateCa();
+    }
+
+    /**
+     * @param int|null $keyLength
+     * @return resource
+     */
+    private static function generateKey($keyLength = null)
+    {
+        if (null === $keyLength) {
+            $keyLength = 2048;
+        }
+
+        return openssl_pkey_new([
+            'private_key_bits' => $keyLength,
+            'private_key_type' => OPENSSL_KEYTYPE_RSA,
+            'encrypt_key' => false,
+        ]);
+    }
+
+    private function generateCa()
+    {
+        $this->caKey = self::generateKey();
+        $dn = [
+            'countryName' => 'GB',
+            'stateOrProvinceName' => 'Berkshire',
+            'localityName' => 'Newbury',
+            'organizationName' => 'Example Certificate Authority',
+            'commonName' => 'CA for PHP Tests'
+        ];
+
+        $this->ca = openssl_csr_sign(
+            openssl_csr_new(
+                $dn,
+                $this->caKey,
+                [
+                    'x509_extensions' => 'v3_ca',
+                    'config' => self::CONFIG,
+                ]
+            ),
+            null,
+            $this->caKey,
+            2
+        );
+    }
+
+    public function getCaCert()
+    {
+        $output = '';
+        openssl_x509_export($this->ca, $output);
+
+        return $output;
+    }
+
+    public function saveCaCert($file)
+    {
+        openssl_x509_export_to_file($this->ca, $file);
+    }
+
+    public function saveNewCertAsFileWithKey($commonNameForCert, $file, $keyLength = null)
+    {
+        $dn = [
+            'countryName' => 'BY',
+            'stateOrProvinceName' => 'Minsk',
+            'localityName' => 'Minsk',
+            'organizationName' => 'Example Org',
+            'commonName' => $commonNameForCert,
+        ];
+
+        $this->lastKey = self::generateKey($keyLength);
+        $this->lastCert = openssl_csr_sign(
+            openssl_csr_new($dn, $this->lastKey, ['req_extensions' => 'v3_req']),
+            $this->ca,
+            $this->caKey,
+            2
+        );
+
+        $certText = '';
+        openssl_x509_export($this->lastCert, $certText);
+
+        $keyText = '';
+        openssl_pkey_export($this->lastKey, $keyText);
+
+        file_put_contents($file, $certText . PHP_EOL . $keyText);
+    }
+
+    public function getCertDigest($algo)
+    {
+        return openssl_x509_fingerprint($this->lastCert, $algo);
+    }
+}
@@ -1,33 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIC5jCCAk+gAwIBAgIBADANBgkqhkiG9w0BAQQFADBcMQswCQYDVQQGEwJBVTET
-MBEGA1UECBMKUXVlZW5zbGFuZDEaMBgGA1UEChMRQ3J5cHRTb2Z0IFB0eSBMdGQx
-HDAaBgNVBAMTE1Rlc3QgUENBICgxMDI0IGJpdCkwHhcNOTkxMjAyMjEzNTQ4WhcN
-MDUwNzExMjEzNTQ4WjBcMQswCQYDVQQGEwJBVTETMBEGA1UECBMKUXVlZW5zbGFu
-ZDEaMBgGA1UEChMRQ3J5cHRTb2Z0IFB0eSBMdGQxHDAaBgNVBAMTE1Rlc3QgUENB
-ICgxMDI0IGJpdCkwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAJ2haT/f5Zwy
-V+MiuSDjSR62adBoSiBB7Usty44lXqsp9RICw+DCCxpsn/CfxPEDXLLd4olsWXc6
-JRcxGynbYmnzk+Z6aIPPJQhK3CTvaqGnWKZsA1m+WaUIUqJCuNTK4N+7hMAGaf6S
-S3e9HVgEQ4a34gXJ7VQFVIBNV1EnZRWHAgMBAAGjgbcwgbQwHQYDVR0OBBYEFE0R
-aEcrj18q1dw+G6nJbsTWR213MIGEBgNVHSMEfTB7gBRNEWhHK49fKtXcPhupyW7E
-1kdtd6FgpF4wXDELMAkGA1UEBhMCQVUxEzARBgNVBAgTClF1ZWVuc2xhbmQxGjAY
-BgNVBAoTEUNyeXB0U29mdCBQdHkgTHRkMRwwGgYDVQQDExNUZXN0IFBDQSAoMTAy
-NCBiaXQpggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAUa8B3pho
-+Mvxeq9HsEzJxHIFQla05S5J/e/V+DQTYoKiRFchKPrDAdrzYSEvP3h4QJEtsNqQ
-JfOxg5M42uLFq7aPGWkF6ZZqZsYS+zA9IVT14g7gNA6Ne+5QtJqQtH9HA24st0T0
-Tga/lZ9M2ovImovaxSL/kRHbpCWcqWVxpOw=
-----END CERTIFICATE-----
-----BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQCdoWk/3+WcMlfjIrkg40ketmnQaEogQe1LLcuOJV6rKfUSAsPg
-wgsabJ/wn8TxA1yy3eKJbFl3OiUXMRsp22Jp85PmemiDzyUIStwk72qhp1imbANZ
-vlmlCFKiQrjUyuDfu4TABmn+kkt3vR1YBEOGt+IFye1UBVSATVdRJ2UVhwIDAQAB
-AoGAba4fTtuap5l7/8ZsbE7Z1O32KJY4ZcOZukLOLUUhXxXduT+FTgGWujc0/rgc
-z9qYCLlNZHOouMYTgtSfYvuMuLZ11VIt0GYH+nRioLShE59Yy+zCRyC+gPigS1kz
-xvo14AsOIPYV14Tk/SsHyq6E0eTk7VzaIE197giiINUERPECQQDSKmtPTh/lRKw7
-HSZSM0I1mFWn/1zqrAbontRQY5w98QWIOe5qmzYyFbPXYT3d9BzlsMyhgiRNoBbD
-yvohSHXJAkEAwAHx6ezAZeWWzD5yXD36nyjpkVCw7Tk7TSmOceLJMWt1QcrCfqlS
-xA5jjpQ6Z8suU5DdtWAryM2sAir1WisYzwJAd6Zcx56jvAQ3xcPXsE6scBTVFzrj
-7FqZ6E+cclPzfLQ+QQsyOBE7bpI6e/FJppY26XGZXo3YGzV8IGXrt40oOQJALETG
-h86EFXo3qGOFbmsDy4pdP5nBERCu8X1xUCSfintiD4c2DInxgS5oGclnJeMcjTvL
-QjQoJCX3UJCi/OUO1QJBAKgcDHWjMvt+l1pjJBsSEZ0HX9AAIIVx0RQmbFGS+F2Q
-hhu5l77WnnZOQ9vvhV5u7NPCUF9nhU3jh60qWWO8mkc=
-----END RSA PRIVATE KEY-----
@@ -1,5 +1,5 @@
 --TEST--
-#46127, openssl_sign/verify: accept different algos
+#46127 php_openssl_tcp_sockop_accept forgets to set context on accepted stream
 --SKIPIF--
 <?php
 if (!extension_loaded("openssl")) die("skip openssl not loaded");
@@ -7,11 +7,13 @@ if (!function_exists("proc_open")) die("skip no proc_open");
 ?>
 --FILE--
 <?php
+$certFile = __DIR__ . DIRECTORY_SEPARATOR . 'bug46127.pem.tmp';
+
 $serverCode = <<<'CODE'
    $serverUri = "ssl://127.0.0.1:64321";
    $serverFlags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN;
    $serverCtx = stream_context_create(['ssl' => [
-        'local_cert' => __DIR__ . '/bug46127.pem',
+        'local_cert' => '%s',
    ]]);

    $sock = stream_socket_server($serverUri, $errno, $errstr, $serverFlags, $serverCtx);
@@ -20,6 +22,7 @@ $serverCode = <<<'CODE'
    $link = stream_socket_accept($sock);
    fwrite($link, "Sending bug 46127\n");
 CODE;
+$serverCode = sprintf($serverCode, $certFile);

 $clientCode = <<<'CODE'
    $serverUri = "ssl://127.0.0.1:64321";
@@ -36,8 +39,16 @@ $clientCode = <<<'CODE'
    echo fgets($sock);
 CODE;

+include 'CertificateGenerator.inc';
+$certificateGenerator = new CertificateGenerator();
+$certificateGenerator->saveNewCertAsFileWithKey('bug46127', $certFile);
+
 include 'ServerClientTestCase.inc';
 ServerClientTestCase::getInstance()->run($clientCode, $serverCode);
 ?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'bug46127.pem.tmp');
+?>
 --EXPECT--
 Sending bug 46127
@@ -7,11 +7,14 @@ if (!function_exists("proc_open")) die("skip no proc_open");
 ?>
 --FILE--
 <?php
+$certFile = __DIR__ . DIRECTORY_SEPARATOR . 'bug48182.pem.tmp';
+$cacertFile = __DIR__ . DIRECTORY_SEPARATOR . 'bug48182-ca.pem.tmp';
+
 $serverCode = <<<'CODE'
    $serverUri = "ssl://127.0.0.1:64321";
    $serverFlags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN;
    $serverCtx = stream_context_create(['ssl' => [
-        'local_cert' => __DIR__ . '/bug54992.pem'
+        'local_cert' => '%s'
    ]]);

    $server = stream_socket_server($serverUri, $errno, $errstr, $serverFlags, $serverCtx);
@@ -22,13 +25,15 @@ $serverCode = <<<'CODE'
    $data = "Sending bug48182\n" . fread($client, 8192);
    fwrite($client, $data);
 CODE;
+$serverCode = sprintf($serverCode, $certFile);

+$peerName = 'bug48182';
 $clientCode = <<<'CODE'
    $serverUri = "ssl://127.0.0.1:64321";
    $clientFlags = STREAM_CLIENT_CONNECT | STREAM_CLIENT_ASYNC_CONNECT;
    $clientCtx = stream_context_create(['ssl' => [
-        'cafile' => __DIR__ . '/bug54992-ca.pem',
-        'peer_name' => 'bug54992.local'
+        'cafile' => '%s',
+        'peer_name' => '%s'
    ]]);

    phpt_wait();
@@ -39,12 +44,23 @@ $clientCode = <<<'CODE'
    fwrite($client, $data);
    echo fread($client, 1024);
 CODE;
+$clientCode = sprintf($clientCode, $cacertFile, $peerName);

 echo "Running bug48182\n";

+include 'CertificateGenerator.inc';
+$certificateGenerator = new CertificateGenerator();
+$certificateGenerator->saveCaCert($cacertFile);
+$certificateGenerator->saveNewCertAsFileWithKey($peerName, $certFile);
+
 include 'ServerClientTestCase.inc';
 ServerClientTestCase::getInstance()->run($clientCode, $serverCode);
 ?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'bug48182.pem.tmp');
+@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'bug48182-ca.pem.tmp');
+?>
 --EXPECT--
 Running bug48182
 Sending bug48182
@@ -1,35 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIIGAzCCA+ugAwIBAgIUVL06vQzqQ1uRdJ7NAAZyylsKOpYwDQYJKoZIhvcNAQEL
-BQAwgZAxCzAJBgNVBAYTAlBUMQ8wDQYDVQQIDAZMaXNib2ExDzANBgNVBAcMBkxp
-c2JvYTEXMBUGA1UECgwOUEhQIEZvdW5kYXRpb24xHjAcBgNVBAMMFVJvb3QgQ0Eg
-Zm9yIFBIUCBUZXN0czEmMCQGCSqGSIb3DQEJARYXaW50ZXJuYWxzQGxpc3RzLnBo
-cC5uZXQwHhcNMTgxMjAxMjEzNTUwWhcNMTgxMjMxMjEzNTUwWjCBkDELMAkGA1UE
-BhMCUFQxDzANBgNVBAgMBkxpc2JvYTEPMA0GA1UEBwwGTGlzYm9hMRcwFQYDVQQK
-DA5QSFAgRm91bmRhdGlvbjEeMBwGA1UEAwwVUm9vdCBDQSBmb3IgUEhQIFRlc3Rz
-MSYwJAYJKoZIhvcNAQkBFhdpbnRlcm5hbHNAbGlzdHMucGhwLm5ldDCCAiIwDQYJ
-KoZIhvcNAQEBBQADggIPADCCAgoCggIBANVgTLlHH3bNkxx+XA1xhr842rf+lP5A
-XDhM5N9vRCXs/6FAB6iFAfnR+YVgcHD/ppgrrOlAIf6QF2J9EOA4h9oOtCrbhC9y
-3uKT/dnPWpa39NAdHDJMl2GndulhfyNzXoPmHR+UmVl8RIwJa2yzq8kfI28VZOdG
-4oW+L8hybO1r+7kewnI/3TQme+yxRMtI/RDAneBPUu4yx+VTy6gP1R7PMwEnMgLC
-msdBEJh2FR2rjboejZiBAHRG5cWbmRlYV0ApDZAgaKbKGCgken7FF9mImduv7c9H
-pHkSKAFdt5hYaeJJy48lh5wC7gMjBo62WKUnBqnV1gBBniWSfsgfNJKPV5a3EO32
-7KinHzzCH4V1C8tCU26om0CoRI+Bm/dpnwuDZWELzMnnyAeCmGWnPi2s/+QaWwKC
-sMXn0+3CFYtlZ+zEZm0KB10RMypRLhn9md9/TfxJNNjDIHCMCLJkxyxFnYOWqtCd
-zAA09r117AgM3tbRYY9NYvNzLw5hnPs2W3gB4vrUzqBcgdfIdVaE1QUyy8rWjMNI
-fIVJVFeyN2mcg3JQw2WmKINDQJWZxXFJR9BPgISpR93BF5zIfGZSSRPuBXaXQ6j/
-9aw+fnA8asietOL2wGa60zqX1WKopNYvRlt6CCIYkFcfRRkoEjcMRpyVsSn2U9Dd
-pFlDHq9iE6SLAgMBAAGjUzBRMB0GA1UdDgQWBBQKZYIWtrUo8Iv5zBWfBn40D7p9
-1DAfBgNVHSMEGDAWgBQKZYIWtrUo8Iv5zBWfBn40D7p91DAPBgNVHRMBAf8EBTAD
-AQH/MA0GCSqGSIb3DQEBCwUAA4ICAQAEJhZ6mMgRUJGF4dM5r+SfrwCTbNGDJkFz
-DSbeb6WMTtvzL1g2P5zHQ0OvlX+mvmqCRXM40sUFMHDLCQzIgKLpgd44yZM6k4wL
-hReX2okQ8tEwB73ahy/H3TaRr3B2l6s16kx4obDpyTsbrBZgiks515ru5EM2pv7x
-31Ya2sUlXBWt+Kc+Z/6UI2Eot7G4M11oeRGpWnFBqPFAIByEbnCR4NCPbAKl2t2q
-vhsQh0zAo9qB4uUyc/XblKKRtdupDnRceSCLg18ZwnBxrVZBuSK5oUCAwAFtE4BZ
-G793gbwIUeR0pFgNMKkfPnXy3Ii8OmPDc9CsxO0Qg4Xh2VXWpVI+N5xL5L/M3O1i
-UDDO2PeoaEVfz3htOCYo1U6BSQqMzg5JD2JifzKEscy3rFkpH21EHLg07Fv4ZSFo
-HG22zt00dJpNatyAzzaYHlMel4K1fwNrGrUH5M2OeRtvkUMlDKwp8qrKIDpTi6vT
-GW0woBoRlR1+qGGG9RHBqm937uhHJsLw8lFJmvO0ObqbdpdfW4nWugL8x1LZC9oz
-uaH7hwj5i0SKK/StuLxAPP6cl4RqQhXO5rxEz2iFjl4nwwtRH3KPEDEAvQcnNXpi
-2YV5z8C78j1amzbSJBlGpu3aoJNn+WPgjePmeBe7oE9t1/5kvIVIAj8kg6CaKfHz
-6hiK1Erl8g==
-----END CERTIFICATE-----
@@ -1,39 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIID7jCCAdYCFBDKe4ra5M5zJIb81D7zwFRmyHQGMA0GCSqGSIb3DQEBCwUAMIGQ
-MQswCQYDVQQGEwJQVDEPMA0GA1UECAwGTGlzYm9hMQ8wDQYDVQQHDAZMaXNib2Ex
-FzAVBgNVBAoMDlBIUCBGb3VuZGF0aW9uMR4wHAYDVQQDDBVSb290IENBIGZvciBQ
-SFAgVGVzdHMxJjAkBgkqhkiG9w0BCQEWF2ludGVybmFsc0BsaXN0cy5waHAubmV0
-MB4XDTE4MTIwMTIxNDU0MloXDTE4MTIzMTIxNDU0MlowWjEXMBUGA1UEAxMOYnVn
-NTQ5OTIubG9jYWwxCzAJBgNVBAYTAlBUMQ8wDQYDVQQHEwZMaXNib2ExDzANBgNV
-BAgTBkxpc2JvYTEQMA4GA1UEChMHcGhwLm5ldDCBnzANBgkqhkiG9w0BAQEFAAOB
-jQAwgYkCgYEAtUAVQKTgpUPgtFOJ3w3kDJETS45tWeT96kUg1NeYLKW+jNbFhxPo
-PJv7XhfemCaqh2tbq1cdYW906Wp1L+eNQvdTYA2IQG4EQBUlmfyIakOIMsN/RizV
-kF09vlNQwTpaMpqTv7wB8vvwbxb9jbC2ZhQUBEg6PIn18dSstbM9FZ0CAwEAATAN
-BgkqhkiG9w0BAQsFAAOCAgEAid90+ulRK+4ifB2tKnt2MyuqXZexv2yQ4u15EYmE
-NLOpP5ZWN8vSvRI3IGruNA00dX/F2EOT+u82ApOxzYyxceAx29Ytpt7PSd2nUqkN
-TbDAsDTUZdoDLUa6dGPe5Faaai00nfNJ3lqmC9xPbBPKyJ3hjz0Uj6gi51Lfi410
-4GZa4oIL3NEIKVtaK942EAYCjeWx1VT8AnsvK4Nqufo97sbZNHJhgY+ApM168kox
-kFA/RNYp/pNS0FCc8b9DwMnu38n2n33iDl3P54chpAcyuWJE5wL/kN2gnS6iMsLP
-14NtBg2mm++4XqBpt9glmWr56HZtvyFW0IhpDwQgRe4GSIwPES2g1s7iUs3T4VdJ
-aHkF4v8Bdl6DWXSVdbqIq8CpVZLhf7vt6pV/22YpVCjQFmiLtc8a4gWaYvpn6j+L
-nAajb9JpdkNeqNiBxmtfQwL7xtY+1goLd9OKtIO1b2517ZRgU9NkUfLKCTl2W2L8
-sMY7FPVs6Z1jfaXw+vIWKCJKe0thf0HMV4q11ptsqpzyIzAAjAfma1b/MM5ATHsa
-6h7Poh0yg+WMSdXurjhDWogOWrzPXSe0izUYpREkTVl1oLhzorxlEDh7vBLB2TS3
-TPAEdNxEbsIutMjoz5ql5dYxgZQGW7HARXrXhMbk6cBU8khNcGGqz1uzX1x7Vb2d
-hKs=
-----END CERTIFICATE-----
-----BEGIN RSA PRIVATE KEY-----
-MIICXgIBAAKBgQC1QBVApOClQ+C0U4nfDeQMkRNLjm1Z5P3qRSDU15gspb6M1sWH
-E+g8m/teF96YJqqHa1urVx1hb3TpanUv541C91NgDYhAbgRAFSWZ/IhqQ4gyw39G
-LNWQXT2+U1DBOloympO/vAHy+/BvFv2NsLZmFBQESDo8ifXx1Ky1sz0VnQIDAQAB
-AoGBALUEnHUkdgv4P7o5WJACAomedqPWSlYmgoVvpvuLmrq0ihuFAGAIvL+TlTgD
-JNfWfiejTDlSVtCSDTR1kzZVztitfXDxRkWEjGtFjMhk/DJkql3w10SUtcqCiWqw
-/XknyPHZ7A+w7Fu5KRO2LoSIze2ZLKvCfP/M/pLR2fTKGTHtAkEA2NreT1GUnvzj
-u1lb2J0nTZbSQHvEkfpEej9akl0Bc5UkskenEsiXE3cJYA1TbEGSqYCmt23x3Rd2
-FYxm6MwV6wJBANX34ZuUOllsS0FJPbkEAps3M4s59daQSFiEkQc5XjPgVB0xVV7s
-OEBlGkM3eqcCUOMnMI8L9wfBk49sELZCeJcCQQC/y/TL2q/EXo9c6I/faj+U1Exp
-VA5rvhpKtTX6NeBOxh6Kv+z5JAja4nGcTqz2FpkM6giKO+erUFDUhjWOuNK5AkEA
-xkmHnCRLxp8jRodXWeQrfigz7ixydLsVMGL5+9XgRPb5PGyBjwwePR70raH2Wls9
-FqU0zPvrnBZ6Zwlgm2cSVQJAPLYA51Z9piajbTuggpioQ5qbUEDkJjmYHbm8eJnK
-h5NW/EtCk4SBxAc+8ElPrvJjtZyOPWfm4vZF5sDKtC3Fkg==
-----END RSA PRIVATE KEY-----
@@ -7,11 +7,14 @@ if (!function_exists("proc_open")) die("skip no proc_open");
 ?>
 --FILE--
 <?php
+$certFile = __DIR__ . DIRECTORY_SEPARATOR . 'bug54992.pem.tmp';
+$cacertFile = __DIR__ . DIRECTORY_SEPARATOR . 'bug54992-ca.pem.tmp';
+
 $serverCode = <<<'CODE'
    $serverUri = "ssl://127.0.0.1:64321";
    $serverFlags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN;
    $serverCtx = stream_context_create(['ssl' => [
-        'local_cert' => __DIR__ . '/bug54992.pem',
+        'local_cert' => '%s',
    ]]);

    $server = stream_socket_server($serverUri, $errno, $errstr, $serverFlags, $serverCtx);
@@ -19,14 +22,17 @@ $serverCode = <<<'CODE'

    @stream_socket_accept($server, 1);
 CODE;
+$serverCode = sprintf($serverCode, $certFile);

+$peerName = 'bug54992_actual_peer_name';
+$wrongPeerName = 'bug54992_expected_peer_name';
 $clientCode = <<<'CODE'
    $serverUri = "ssl://127.0.0.1:64321";
    $clientFlags = STREAM_CLIENT_CONNECT;
    $clientCtx = stream_context_create(['ssl' => [
        'verify_peer' => true,
-        'cafile' => __DIR__ . '/bug54992-ca.pem',
-        'peer_name' => 'buga_buga',
+        'cafile' => '%s',
+        'peer_name' => '%s',
    ]]);

    phpt_wait();
@@ -34,12 +40,23 @@ $clientCode = <<<'CODE'

    var_dump($client);
 CODE;
+$clientCode = sprintf($clientCode, $cacertFile, $wrongPeerName);
+
+include 'CertificateGenerator.inc';
+$certificateGenerator = new CertificateGenerator();
+$certificateGenerator->saveCaCert($cacertFile);
+$certificateGenerator->saveNewCertAsFileWithKey($peerName, $certFile);

 include 'ServerClientTestCase.inc';
 ServerClientTestCase::getInstance()->run($clientCode, $serverCode);
 ?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'bug54992.pem.tmp');
+@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'bug54992-ca.pem.tmp');
+?>
 --EXPECTF--
-Warning: stream_socket_client(): Peer certificate CN=`bug54992.local' did not match expected CN=`buga_buga' in %s on line %d
+Warning: stream_socket_client(): Peer certificate CN=`bug54992_actual_peer_name' did not match expected CN=`bug54992_expected_peer_name' in %s on line %d

 Warning: stream_socket_client(): Failed to enable crypto in %s on line %d

@@ -7,11 +7,14 @@ if (!function_exists("proc_open")) die("skip no proc_open");
 ?>
 --FILE--
 <?php
+$certFile = __DIR__ . DIRECTORY_SEPARATOR . 'bug65538_001.pem.tmp';
+$cacertFile = __DIR__ . DIRECTORY_SEPARATOR . 'bug65538_001-ca.pem.tmp';
+
 $serverCode = <<<'CODE'
    $serverUri = "ssl://127.0.0.1:64321";
    $serverFlags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN;
    $serverCtx = stream_context_create(['ssl' => [
-        'local_cert' => __DIR__ . '/bug54992.pem',
+        'local_cert' => '%s',
    ]]);

    $server = stream_socket_server($serverUri, $errno, $errstr, $serverFlags, $serverCtx);
@@ -33,12 +36,14 @@ $serverCode = <<<'CODE'
        fclose($client);
    }
 CODE;
+$serverCode = sprintf($serverCode, $certFile);

+$peerName = 'bug65538_001';
 $clientCode = <<<'CODE'
    $serverUri = "https://127.0.0.1:64321/";
    $clientCtx = stream_context_create(['ssl' => [
-        'cafile' => 'file://' . __DIR__ . '/bug54992-ca.pem',
-        'peer_name' => 'bug54992.local',
+        'cafile' => 'file://%s',
+        'peer_name' => '%s',
    ]]);

    phpt_wait();
@@ -46,9 +51,20 @@ $clientCode = <<<'CODE'

    var_dump($html);
 CODE;
+$clientCode = sprintf($clientCode, $cacertFile, $peerName);
+
+include 'CertificateGenerator.inc';
+$certificateGenerator = new CertificateGenerator();
+$certificateGenerator->saveCaCert($cacertFile);
+$certificateGenerator->saveNewCertAsFileWithKey($peerName, $certFile);

 include 'ServerClientTestCase.inc';
 ServerClientTestCase::getInstance()->run($clientCode, $serverCode);
 ?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'bug65538_001.pem.tmp');
+@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'bug65538_001-ca.pem.tmp');
+?>
 --EXPECT--
 string(12) "Hello World!"
@@ -6,13 +6,20 @@ if (!extension_loaded("openssl")) die("skip openssl not loaded");
 if (!extension_loaded("phar")) die("skip phar not loaded");
 if (!function_exists("proc_open")) die("skip no proc_open");
 ?>
+--INI--
+phar.readonly=0
 --FILE--
 <?php
+$certFile = __DIR__ . DIRECTORY_SEPARATOR . 'bug65538_003.pem.tmp';
+
+$cacertFile = 'bug65538_003-ca.pem';
+$cacertPhar = __DIR__ . DIRECTORY_SEPARATOR . 'bug65538_003-ca.phar.tmp';
+
 $serverCode = <<<'CODE'
    $serverUri = "ssl://127.0.0.1:64321";
    $serverFlags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN;
    $serverCtx = stream_context_create(['ssl' => [
-        'local_cert' => __DIR__ . '/bug54992.pem',
+        'local_cert' => '%s',
    ]]);

    $server = stream_socket_server($serverUri, $errno, $errstr, $serverFlags, $serverCtx);
@@ -34,12 +41,14 @@ $serverCode = <<<'CODE'
        fclose($client);
    }
 CODE;
+$serverCode = sprintf($serverCode, $certFile);

+$peerName = 'bug65538_003';
 $clientCode = <<<'CODE'
    $serverUri = "https://127.0.0.1:64321/";
    $clientCtx = stream_context_create(['ssl' => [
-        'cafile' => 'phar://' . __DIR__ . '/bug65538.phar/bug54992-ca.pem',
-        'peer_name' => 'bug54992.local',
+        'cafile' => 'phar://%s/%s',
+        'peer_name' => '%s',
    ]]);

    phpt_wait();
@@ -47,9 +56,22 @@ $clientCode = <<<'CODE'

    var_dump($html);
 CODE;
+$clientCode = sprintf($clientCode, $cacertPhar, $cacertFile, $peerName);
+
+include 'CertificateGenerator.inc';
+$certificateGenerator = new CertificateGenerator();
+$certificateGenerator->saveNewCertAsFileWithKey($peerName, $certFile);
+
+$phar = new Phar($cacertPhar);
+$phar->addFromString($cacertFile, $certificateGenerator->getCaCert());

 include 'ServerClientTestCase.inc';
 ServerClientTestCase::getInstance()->run($clientCode, $serverCode);
 ?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'bug65538_003.pem.tmp');
+@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'bug65538_003-ca.phar.tmp');
+?>
 --EXPECT--
 string(12) "Hello World!"
@@ -7,8 +7,10 @@ if (!function_exists("proc_open")) die("skip no proc_open");
 ?>
 --FILE--
 <?php
+$certFile = __DIR__ . DIRECTORY_SEPARATOR . 'bug72333.pem.tmp';
+
 $serverCode = <<<'CODE'
-    $context = stream_context_create(['ssl' => ['local_cert' => __DIR__ . '/bug54992.pem']]);
+    $context = stream_context_create(['ssl' => ['local_cert' => '%s']]);

    $flags = STREAM_SERVER_BIND|STREAM_SERVER_LISTEN;
    $fp = stream_socket_server("ssl://127.0.0.1:10011", $errornum, $errorstr, $flags, $context);
@@ -31,14 +33,16 @@ $serverCode = <<<'CODE'
    }
    phpt_wait();
 CODE;
+$serverCode = sprintf($serverCode, $certFile);

+$peerName = 'bug72333';
 $clientCode = <<<'CODE'
-    $context = stream_context_create(['ssl' => ['verify_peer' => false, 'peer_name' => 'bug54992.local']]);
-    
+    $context = stream_context_create(['ssl' => ['verify_peer' => false, 'peer_name' => '%s']]);
+
    phpt_wait();
    $fp = stream_socket_client("ssl://127.0.0.1:10011", $errornum, $errorstr, 3000, STREAM_CLIENT_CONNECT, $context);
    stream_set_blocking($fp, false);
-    
+
    function blocking_fwrite($fp, $buf) {
        $write = [$fp];
        $total = 0;
@@ -59,9 +63,18 @@ $clientCode = <<<'CODE'
    phpt_notify();
    echo "done";
 CODE;
+$clientCode = sprintf($clientCode, $peerName);
+
+include 'CertificateGenerator.inc';
+$certificateGenerator = new CertificateGenerator();
+$certificateGenerator->saveNewCertAsFileWithKey($peerName, $certFile);

 include 'ServerClientTestCase.inc';
 ServerClientTestCase::getInstance()->run($clientCode, $serverCode);
 ?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'bug72333.pem.tmp');
+?>
 --EXPECT--
 done
@@ -7,6 +7,9 @@ if (!function_exists("proc_open")) die("skip no proc_open");
 ?>
 --FILE--
 <?php
+$certFile = __DIR__ . DIRECTORY_SEPARATOR . 'bug74159.pem.tmp';
+$cacertFile = __DIR__ . DIRECTORY_SEPARATOR . 'bug74159-ca.pem.tmp';
+
 // the server code is doing many readings in a short interval which is
 // not really reliable on more powerful machine but cover different
 // scenarios which might be useful. More reliable test is bug72333.phpt
@@ -14,7 +17,7 @@ $serverCode = <<<'CODE'
    $serverUri = "ssl://127.0.0.1:10012";
    $serverFlags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN;
    $serverCtx = stream_context_create(['ssl' => [
-        'local_cert' => __DIR__ . '/bug54992.pem',
+        'local_cert' => '%s',
        'crypto_method' => STREAM_CRYPTO_METHOD_TLSv1_2_SERVER,
    ]]);

@@ -39,7 +42,9 @@ $serverCode = <<<'CODE'

    fclose($client);
 CODE;
+$serverCode = sprintf($serverCode, $certFile);

+$peerName = 'bug74159';
 $clientCode = <<<'CODE'
    function streamRead($stream) : int {
        return strlen(fread($stream, 8192));
@@ -71,8 +76,8 @@ $clientCode = <<<'CODE'
    $clientFlags = STREAM_CLIENT_CONNECT;
    $clientCtx = stream_context_create(['ssl' => [
        'verify_peer' => true,
-        'cafile' => __DIR__ . '/bug54992-ca.pem',
-        'peer_name' => 'bug54992.local',
+        'cafile' => '%s',
+        'peer_name' => '%s',
    ]]);

    phpt_wait();
@@ -91,7 +96,7 @@ $clientCode = <<<'CODE'
        $data = substr($data, $written);
        waitForWrite($fp);
    }
-    printf("Written %d bytes\n", $total);
+    printf("Written %%d bytes\n", $total);

    while(waitForRead($fp)) {
        streamRead($fp);
@@ -102,10 +107,21 @@ $clientCode = <<<'CODE'

    exit("DONE\n");
 CODE;
+$clientCode = sprintf($clientCode, $cacertFile, $peerName);
+
+include 'CertificateGenerator.inc';
+$certificateGenerator = new CertificateGenerator();
+$certificateGenerator->saveCaCert($cacertFile);
+$certificateGenerator->saveNewCertAsFileWithKey($peerName, $certFile);

 include 'ServerClientTestCase.inc';
 ServerClientTestCase::getInstance()->run($clientCode, $serverCode);
 ?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'bug74159.pem.tmp');
+@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'bug74159-ca.pem.tmp');
+?>
 --EXPECT--
 Written 1048575 bytes
 DONE
@@ -7,11 +7,14 @@ if (!function_exists("proc_open")) die("skip no proc_open");
 ?>
 --FILE--
 <?php
+$certFile = __DIR__ . DIRECTORY_SEPARATOR . 'capture_peer_cert_001.pem.tmp';
+$cacertFile = __DIR__ . DIRECTORY_SEPARATOR . 'capture_peer_cert_001-ca.pem.tmp';
+
 $serverCode = <<<'CODE'
    $serverUri = "ssl://127.0.0.1:64321";
    $serverFlags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN;
    $serverCtx = stream_context_create(['ssl' => [
-        'local_cert' => __DIR__ . '/bug54992.pem'
+        'local_cert' => '%s'
    ]]);

    $server = stream_socket_server($serverUri, $errno, $errstr, $serverFlags, $serverCtx);
@@ -19,13 +22,15 @@ $serverCode = <<<'CODE'

    @stream_socket_accept($server, 1);
 CODE;
+$serverCode = sprintf($serverCode, $certFile);

+$peerName = 'capture_peer_cert_001';
 $clientCode = <<<'CODE'
    $serverUri = "ssl://127.0.0.1:64321";
    $clientFlags = STREAM_CLIENT_CONNECT;
    $clientCtx = stream_context_create(['ssl' => [
        'capture_peer_cert' => true,
-        'cafile' => __DIR__ . '/bug54992-ca.pem'
+        'cafile' => '%s'
    ]]);

    phpt_wait();
@@ -33,9 +38,20 @@ $clientCode = <<<'CODE'
    $cert = stream_context_get_options($clientCtx)['ssl']['peer_certificate'];
    var_dump(openssl_x509_parse($cert)['subject']['CN']);
 CODE;
+$clientCode = sprintf($clientCode, $cacertFile);
+
+include 'CertificateGenerator.inc';
+$certificateGenerator = new CertificateGenerator();
+$certificateGenerator->saveCaCert($cacertFile);
+$certificateGenerator->saveNewCertAsFileWithKey($peerName, $certFile);

 include 'ServerClientTestCase.inc';
 ServerClientTestCase::getInstance()->run($clientCode, $serverCode);
 ?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'capture_peer_cert_001.pem.tmp');
+@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'capture_peer_cert_001-ca.pem.tmp');
+?>
 --EXPECTF--
-string(%d) "bug54992.local"
+string(%d) "capture_peer_cert_001"
@@ -7,11 +7,14 @@ if (!function_exists("proc_open")) die("skip no proc_open");
 ?>
 --FILE--
 <?php
+$certFile = __DIR__ . DIRECTORY_SEPARATOR . 'openssl_peer_fingerprint_basic.pem.tmp';
+$cacertFile = __DIR__ . DIRECTORY_SEPARATOR . 'openssl_peer_fingerprint_basic-ca.pem.tmp';
+
 $serverCode = <<<'CODE'
    $serverUri = "ssl://127.0.0.1:64321";
    $serverFlags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN;
    $serverCtx = stream_context_create(['ssl' => [
-        'local_cert' => __DIR__ . '/bug54992.pem'
+        'local_cert' => '%s'
    ]]);

    $server = stream_socket_server($serverUri, $errno, $errstr, $serverFlags, $serverCtx);
@@ -20,32 +23,52 @@ $serverCode = <<<'CODE'
    @stream_socket_accept($server, 1);
    @stream_socket_accept($server, 1);
 CODE;
+$serverCode = sprintf($serverCode, $certFile);

+$peerName = 'openssl_peer_fingerprint_basic';
 $clientCode = <<<'CODE'
    $serverUri = "ssl://127.0.0.1:64321";
    $clientFlags = STREAM_CLIENT_CONNECT;
    $clientCtx = stream_context_create(['ssl' => [
        'verify_peer'       => true,
-        'cafile'            => __DIR__ . '/bug54992-ca.pem',
-        'capture_peer_cert'    => true,
-        'peer_name'          => 'bug54992.local',
+        'cafile'            => '%s',
+        'capture_peer_cert' => true,
+        'peer_name'         => '%s',
    ]]);

    phpt_wait();

-    // should be: 3610606deda596b3ae3859d33c4ce1d9
-    stream_context_set_option($clientCtx, 'ssl', 'peer_fingerprint', '3610606deda596b3ae3859d33c4ce1da');
+    stream_context_set_option($clientCtx, 'ssl', 'peer_fingerprint', '%s');
    var_dump(stream_socket_client($serverUri, $errno, $errstr, 2, $clientFlags, $clientCtx));

    stream_context_set_option($clientCtx, 'ssl', 'peer_fingerprint', [
-        'sha256' => 'dffa72247ab7e44d94b2858528e3f67015925782148d2cf0b15cd82d1c931215',
+        'sha256' => '%s',
    ]);
    var_dump(stream_socket_client($serverUri, $errno, $errstr, 2, $clientFlags, $clientCtx));
 CODE;

+include 'CertificateGenerator.inc';
+$certificateGenerator = new CertificateGenerator();
+$certificateGenerator->saveCaCert($cacertFile);
+$certificateGenerator->saveNewCertAsFileWithKey($peerName, $certFile);
+
+$actualMd5 = $certificateGenerator->getCertDigest('md5');
+$lastCharacter = substr($actualMd5, -1, 1);
+$brokenLastCharacter = dechex(hexdec($lastCharacter) ^ 1);
+$brokenMd5 = substr($actualMd5, 0, -1) . $brokenLastCharacter;
+$actualSha256 = $certificateGenerator->getCertDigest('sha256');
+
+$clientCode = sprintf($clientCode, $cacertFile, $peerName, $brokenMd5, $actualSha256);
+
+
 include 'ServerClientTestCase.inc';
 ServerClientTestCase::getInstance()->run($clientCode, $serverCode);
 ?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'openssl_peer_fingerprint_basic.pem.tmp');
+@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'openssl_peer_fingerprint_basic-ca.pem.tmp');
+?>
 --EXPECTF--
 Warning: stream_socket_client(): peer_fingerprint match failure in %s on line %d

@@ -43,9 +43,7 @@ if (file_exists($contentfile)) {
 ?>
 --CLEAN--
 <?php
-if (file_exists($pkcsfile)) {
-	unlink($pkcsfile);
-}
+unlink(__DIR__ . DIRECTORY_SEPARATOR . '/openssl_pkcs7_verify__pkcsfile.tmp');
 ?>
 --EXPECTF--
 int(-1)
@@ -7,11 +7,14 @@ if (!function_exists("proc_open")) die("skip no proc_open");
 ?>
 --FILE--
 <?php
+$certFile = __DIR__ . DIRECTORY_SEPARATOR . 'peer_verification.pem.tmp';
+$cacertFile = __DIR__ . DIRECTORY_SEPARATOR . 'peer_verification-ca.pem.tmp';
+
 $serverCode = <<<'CODE'
    $serverUri = "ssl://127.0.0.1:64321";
    $serverFlags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN;
    $serverCtx = stream_context_create(['ssl' => [
-        'local_cert' => __DIR__ . '/bug54992.pem'
+        'local_cert' => '%s'
    ]]);

    $server = stream_socket_server($serverUri, $errno, $errstr, $serverFlags, $serverCtx);
@@ -21,11 +24,13 @@ $serverCode = <<<'CODE'
        @stream_socket_accept($server, 1);
    }
 CODE;
+$serverCode = sprintf($serverCode, $certFile);

+$peerName = 'peer_verification';
 $clientCode = <<<'CODE'
    $serverUri = "ssl://127.0.0.1:64321";
    $clientFlags = STREAM_CLIENT_CONNECT;
-    $caFile = __DIR__ . '/bug54992-ca.pem';
+    $caFile = '%s';

    phpt_wait();

@@ -48,14 +53,25 @@ $clientCode = <<<'CODE'
    // Should succeed with CA file specified in context
    $clientCtx = stream_context_create(['ssl' => [
        'cafile'   => $caFile,
-        'peer_name' => 'bug54992.local',
+        'peer_name' => '%s',
    ]]);
    var_dump(stream_socket_client($serverUri, $errno, $errstr, 1, $clientFlags, $clientCtx));
 CODE;
+$clientCode = sprintf($clientCode, $cacertFile, $peerName);
+
+include 'CertificateGenerator.inc';
+$certificateGenerator = new CertificateGenerator();
+$certificateGenerator->saveCaCert($cacertFile);
+$certificateGenerator->saveNewCertAsFileWithKey($peerName, $certFile);

 include 'ServerClientTestCase.inc';
 ServerClientTestCase::getInstance()->run($clientCode, $serverCode);
 ?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'peer_verification.pem.tmp');
+@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'peer_verification-ca.pem.tmp');
+?>
 --EXPECTF--
 bool(false)
 bool(false)
@@ -7,11 +7,14 @@ if (!function_exists("proc_open")) die("skip no proc_open");
 ?>
 --FILE--
 <?php
+$certFile = __DIR__ . DIRECTORY_SEPARATOR . 'session_meta_capture.pem.tmp';
+$cacertFile = __DIR__ . DIRECTORY_SEPARATOR . 'session_meta_capture-ca.pem.tmp';
+
 $serverCode = <<<'CODE'
    $serverUri = "ssl://127.0.0.1:64321";
    $serverFlags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN;
    $serverCtx = stream_context_create(['ssl' => [
-        'local_cert' => __DIR__ . '/bug54992.pem'
+        'local_cert' => '%s'
    ]]);

    $server = stream_socket_server($serverUri, $errno, $errstr, $serverFlags, $serverCtx);
@@ -22,14 +25,16 @@ $serverCode = <<<'CODE'
    @stream_socket_accept($server, 1);
    @stream_socket_accept($server, 1);
 CODE;
+$serverCode = sprintf($serverCode, $certFile);

+$peerName = 'session_meta_capture';
 $clientCode = <<<'CODE'
    $serverUri = "ssl://127.0.0.1:64321";
    $clientFlags = STREAM_CLIENT_CONNECT;
    $clientCtx = stream_context_create(['ssl' => [
        'verify_peer' => true,
-        'cafile' => __DIR__ . '/bug54992-ca.pem',
-        'peer_name' => 'bug54992.local',
+        'cafile' => '%s',
+        'peer_name' => '%s',
        'capture_session_meta' => true,
    ]]);

@@ -50,10 +55,21 @@ $clientCode = <<<'CODE'
    $meta = stream_context_get_options($clientCtx)['ssl']['session_meta'];
    var_dump($meta['protocol']);
 CODE;
+$clientCode = sprintf($clientCode, $cacertFile, $peerName);
+
+include 'CertificateGenerator.inc';
+$certificateGenerator = new CertificateGenerator();
+$certificateGenerator->saveCaCert($cacertFile);
+$certificateGenerator->saveNewCertAsFileWithKey($peerName, $certFile);

 include 'ServerClientTestCase.inc';
 ServerClientTestCase::getInstance()->run($clientCode, $serverCode);
 ?>
+--CLEAN--
+<?php
+@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'session_meta_capture.pem.tmp');
+@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'session_meta_capture-ca.pem.tmp');
+?>
 --EXPECT--
 string(5) "TLSv1"
 string(7) "TLSv1.1"