Fix bug #79465 - use unsigneds as indexes.

(cherry picked from commit 9d6bf8221b)

NEWS

@@ -1,6 +1,168 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? ????, PHP 7.3.14
+16 Apr 2020, PHP 7.3.17
+
+- Core:
+  . Fixed bug #79364 (When copy empty array, next key is unspecified). (cmb)
+  . Fixed bug #78210 (Invalid pointer address). (cmb, Nikita)
+
+- CURL:
+  . Fixed bug #79199 (curl_copy_handle() memory leak). (cmb)
+
+- Date:
+  . Fixed bug #79396 (DateTime hour incorrect during DST jump forward). (Nate
+    Brunette)
+
+- Iconv:
+  . Fixed bug #79200 (Some iconv functions cut Windows-1258). (cmb)
+
+- OPcache:
+  . Fixed bug #79412 (Opcache chokes and uses 100% CPU on specific script).
+    (Dmitry)
+
+- Session:
+  . Fixed bug #79413 (session_create_id() fails for active sessions). (cmb)
+
+- Shmop:
+  . Fixed bug #79427 (Integer Overflow in shmop_open()). (cmb)
+
+- SimpleXML:
+  . Fixed bug #61597 (SXE properties may lack attributes and content). (cmb)
+
+- Spl:
+  . Fixed bug #75673 (SplStack::unserialize() behavior). (cmb)
+  . Fixed bug #79393 (Null coalescing operator failing with SplFixedArray).
+    (cmb)
+
+- Standard:
+  . Fixed bug #79330 (shell_exec() silently truncates after a null byte). (stas)
+  . Fixed bug #79465 (OOB Read in urldecode()). (stas)
+  . Fixed bug #79410 (system() swallows last chunk if it is exactly 4095 bytes
+    without newline). (Christian Schneider)
+
+- Zip:
+  . Fixed Bug #79296 (ZipArchive::open fails on empty file). (Remi)
+  . Fixed bug #79424 (php_zip_glob uses gl_pathc after call to globfree).
+    (Max Rees)
+
+19 Mar 2020, PHP 7.3.16
+
+- Core:
+  . Fixed bug #63206 (restore_error_handler does not restore previous errors
+    mask). (Mark Plomer)
+
+- COM:
+  . Fixed bug #66322 (COMPersistHelper::SaveToFile can save to wrong location).
+    (cmb)
+  . Fixed bug #79242 (COM error constants don't match com_exception codes on
+    x86). (cmb)
+  . Fixed bug #79248 (Traversing empty VT_ARRAY throws com_exception). (cmb)
+  . Fixed bug #79299 (com_print_typeinfo prints duplicate variables). (Litiano
+    Moura)
+  . Fixed bug #79332 (php_istreams are never freed). (cmb)
+  . Fixed bug #79333 (com_print_typeinfo() leaks memory). (cmb)
+
+- DOM:
+  . Fixed bug #77569: (Write Access Violation in DomImplementation). (Nikita,
+    cmb)
+  . Fixed bug #79271 (DOMDocumentType::$childNodes is NULL). (cmb)
+
+- Enchant:
+  . Fixed bug #79311 (enchant_dict_suggest() fails on big endian architecture).
+    (cmb)
+
+- EXIF:
+  . Fixed bug #79282 (Use-of-uninitialized-value in exif). (CVE-2020-7064)
+    (Nikita)
+
+- MBstring:
+  . Fixed bug #79371 (mb_strtolower (UTF-32LE): stack-buffer-overflow at 
+    php_unicode_tolower_full). (CVE-2020-7065) (cmb)
+
+- MySQLi:
+  . Fixed bug #64032 (mysqli reports different client_version). (cmb)
+
+- PCRE:
+  . Fixed bug #79188 (Memory corruption in preg_replace/preg_replace_callback
+    and unicode). (Nikita)
+
+- PDO_ODBC:
+  . Fixed bug #79038 (PDOStatement::nextRowset() leaks column values). (cmb)
+
+- Reflection:
+  . Fixed bug #79062 (Property with heredoc default value returns false for
+    getDocComment). (Nikita)
+
+- SQLite3:
+  . Fixed bug #79294 (::columnType() may fail after SQLite3Stmt::reset()). (cmb)
+
+- Standard:
+  . Fixed bug #79329 (get_headers() silently truncates after a null byte). 
+    (CVE-2020-7066) (cmb)
+  . Fixed bug #79254 (getenv() w/o arguments not showing changes). (cmb)
+  . Fixed bug #79265 (Improper injection of Host header when using fopen for
+    http requests). (Miguel Xavier Penha Neto)
+
+20 Feb 2020, PHP 7.3.15
+
+- Core:
+  . Fixed bug #71876 (Memory corruption htmlspecialchars(): charset `*' not
+    supported). (Nikita)
+  . Fixed bug #79146 (cscript can fail to run on some systems). (clarodeus)
+  . Fixed bug #78323 (Code 0 is returned on invalid options). (Ivan Mikheykin)
+  . Fixed bug #76047 (Use-after-free when accessing already destructed
+    backtrace arguments). (Nikita)
+
+- CURL:
+  . Fixed bug #79078 (Hypothetical use-after-free in curl_multi_add_handle()).
+    (cmb)
+
+- Intl:
+  . Fixed bug #79212 (NumberFormatter::format() may detect wrong type). (cmb)
+
+- Libxml:
+  . Fixed bug #79191 (Error in SoapClient ctor disables DOMDocument::save()).
+    (Nikita, cmb)
+
+- MBString:
+  . Fixed bug #79154 (mb_convert_encoding() can modify $from_encoding). (cmb)
+
+- MySQLnd:
+  . Fixed bug #79084 (mysqlnd may fetch wrong column indexes with MYSQLI_BOTH).
+    (cmb)
+
+- OpenSSL:
+  . Fixed bug #79145 (openssl memory leak). (cmb, Nikita)
+
+- Phar:
+  . Fixed bug #79082 (Files added to tar with Phar::buildFromIterator have
+    all-access permissions). (CVE-2020-7063) (stas)
+  . Fixed bug #79171 (heap-buffer-overflow in phar_extract_file).
+    (CVE-2020-7061) (cmb)
+  . Fixed bug #76584 (PharFileInfo::decompress not working). (cmb)
+
+- Reflection:
+  . Fixed bug #79115 (ReflectionClass::isCloneable call reflected class
+    __destruct). (Nikita)
+
+- Session:
+  . Fixed bug #79221 (Null Pointer Dereference in PHP Session Upload Progress).
+    (CVE-2020-7062) (stas)
+
+- SPL:
+  . Fixed bug #79151 (heap use after free caused by
+    spl_dllist_it_helper_move_forward). (Nikita)
+
+- Standard:
+  . Fixed bug #78902 (Memory leak when using stream_filter_append). (liudaixiao)
+
+- Testing:
+  . Fixed bug #78090 (bug45161.phpt takes forever to finish). (cmb)
+
+- XSL:
+  . Fixed bug #70078 (XSL callbacks with nodes as parameter leak memory). (cmb)
+
+23 Jan 2020, PHP 7.3.14
 
 - Core
   . Fixed bug #78999 (Cycle leak when using function result as temporary).
@@ -30,6 +192,10 @@ PHP                                                                        NEWS
 - Libxml:
   . Fixed bug #79029 (Use After Free's in XMLReader / XMLWriter). (Laruence)
 
+- Mbstring:
+  . Fixed bug #79037 (global buffer-overflow in `mbfl_filt_conv_big5_wchar`). 
+    (CVE-2020-7060) (Nikita)
+
 - OPcache:
   . Fixed bug #79040 (Warning Opcode handlers are unusable due to ASLR). (cmb)
 
@@ -45,10 +211,14 @@ PHP                                                                        NEWS
   . Fixed bug #78982 (pdo_pgsql returns dead persistent connection). (SATŌ
     Kentarō)
 
+- Session:
+  . Fixed bug #79091 (heap use-after-free in session_create_id()). (cmb, Nikita)
+
 - Shmop:
   . Fixed bug #78538 (shmop memory leak). (cmb)
 
 - Standard:
+  . Fixed bug #79099 (OOB read in php_strip_tags_ex). (CVE-2020-7059). (cmb)
   . Fixed bug #54298 (Using empty additional_headers adding extraneous CRLF).
     (cmb)
 

UPGRADING

@@ -112,6 +112,12 @@ BCMath:
   . bcmul() and bcpow() now return numbers with the requested scale. Formerly,
     the returned numbers may have omitted trailing decimal zeroes.
 
+DOM:
+  . As of PHP 7.3.16, the value of the $childNodes property of DOMDocument,
+    DOMNode, DOMProcessingInstruction, DOMComment, DOMText, DOMCdataSection and
+    DOMNotation is now an empty DOMNodeList instead of NULL, according to the
+    W3C and WHATWG standards and the PHP manual.
+
 IMAP:
   rsh/ssh logins are disabled by default. Use imap.enable_insecure_rsh if you want
   to enable them. Note that the IMAP library does not filter mailbox names before

Zend/tests/bug52361.phpt

@@ -25,9 +25,8 @@ try {
 --EXPECTF--
 1. Exception: aaa in %sbug52361.php:5
 Stack trace:
-#0 %sbug52361.php(13): aaa->__destruct()
-#1 %sbug52361.php(16): bbb()
-#2 {main}
+#0 %sbug52361.php(16): aaa->__destruct()
+#1 {main}
 2. Exception: bbb in %sbug52361.php:13
 Stack trace:
 #0 %sbug52361.php(16): bbb()

Zend/tests/bug63206.phpt

@@ -0,0 +1,29 @@
+--TEST--
+Bug #63206 Fully support error_handler stacking, even inside the error_handler
+--FILE--
+<?php
+
+set_error_handler(function() {
+    echo 'First handler' . PHP_EOL;
+});
+
+set_error_handler(function() {
+    echo 'Second handler' . PHP_EOL;
+
+    set_error_handler(function() {
+        echo 'Internal handler' . PHP_EOL;
+    });
+
+    $triggerInternalNotice++; // warnings while handling the error should go into internal handler
+
+    restore_error_handler();
+});
+
+$triggerNotice1++;
+$triggerNotice2++;
+?>
+--EXPECTF--
+Second handler
+Internal handler
+Second handler
+Internal handler

Zend/tests/bug63206_1.phpt

@@ -0,0 +1,26 @@
+--TEST--
+Bug #63206 Fully support error_handler stacking, even with null
+--FILE--
+<?php
+
+set_error_handler(function() {
+    echo 'First handler' . PHP_EOL;
+});
+
+set_error_handler(function() {
+    echo 'Second handler' . PHP_EOL;
+});
+
+set_error_handler(null);
+
+set_error_handler(function() {
+    echo 'Fourth handler' . PHP_EOL;
+});
+
+restore_error_handler();
+restore_error_handler();
+
+$triggerNotice++;
+?>
+--EXPECTF--
+Second handler

Zend/tests/bug63206_2.phpt

@@ -0,0 +1,26 @@
+--TEST--
+Bug #63206 Fully support exception_handler stacking, even with null
+--FILE--
+<?php
+
+set_exception_handler(function() {
+    echo 'First handler' . PHP_EOL;
+});
+
+set_exception_handler(function() {
+    echo 'Second handler' . PHP_EOL;
+});
+
+set_exception_handler(null);
+
+set_exception_handler(function() {
+    echo 'Fourth handler' . PHP_EOL;
+});
+
+restore_exception_handler();
+restore_exception_handler();
+
+throw new Exception();
+?>
+--EXPECTF--
+Second handler

Zend/tests/bug76047.phpt

@@ -0,0 +1,68 @@
+--TEST--
+Bug #76047: Use-after-free when accessing already destructed backtrace arguments
+--FILE--
+<?php
+
+class Vuln {
+    public $a;
+    public function __destruct() {
+        unset($this->a);
+        $backtrace = (new Exception)->getTrace();
+        var_dump($backtrace);
+    }
+}
+
+function test($arg) {
+    $arg = str_shuffle(str_repeat('A', 79));
+    $vuln = new Vuln();
+    $vuln->a = $arg;
+}
+
+function test2($arg) {
+    $$arg = 1; // Trigger symbol table
+    $arg = str_shuffle(str_repeat('A', 79));
+    $vuln = new Vuln();
+    $vuln->a = $arg;
+}
+
+test('x');
+test2('x');
+
+?>
+--EXPECTF--
+array(1) {
+  [0]=>
+  array(6) {
+    ["file"]=>
+    string(%d) "%s"
+    ["line"]=>
+    int(%d)
+    ["function"]=>
+    string(10) "__destruct"
+    ["class"]=>
+    string(4) "Vuln"
+    ["type"]=>
+    string(2) "->"
+    ["args"]=>
+    array(0) {
+    }
+  }
+}
+array(1) {
+  [0]=>
+  array(6) {
+    ["file"]=>
+    string(%d) "%s"
+    ["line"]=>
+    int(%d)
+    ["function"]=>
+    string(10) "__destruct"
+    ["class"]=>
+    string(4) "Vuln"
+    ["type"]=>
+    string(2) "->"
+    ["args"]=>
+    array(0) {
+    }
+  }
+}

Zend/tests/bug79364.phpt

@@ -0,0 +1,22 @@
+--TEST--
+Bug #79364 (When copy empty array, next key is unspecified)
+--FILE--
+<?php
+$a = [1, 2];
+unset($a[1], $a[0]);
+$b = $a;
+
+$a[] = 3;
+$b[] = 4;
+
+var_dump($a, $b);
+?>
+--EXPECT--
+array(1) {
+  [2]=>
+  int(3)
+}
+array(1) {
+  [2]=>
+  int(4)
+}

Zend/zend.h

@@ -20,7 +20,7 @@
 #ifndef ZEND_H
 #define ZEND_H
 
-#define ZEND_VERSION "3.3.14-dev"
+#define ZEND_VERSION "3.3.17"
 
 #define ZEND_ENGINE_3
 

Zend/zend_alloc.c

@@ -2103,6 +2103,7 @@ static zend_long zend_mm_find_leaks(zend_mm_heap *heap, zend_mm_chunk *p, uint32
 			}
 		}
 		p = p->next;
+		i = ZEND_MM_FIRST_PAGE;
 	} while (p != heap->main_chunk);
 	return count;
 }

Zend/zend_builtin_functions.c

@@ -1665,11 +1665,11 @@ ZEND_FUNCTION(set_error_handler)
 
 	if (Z_TYPE(EG(user_error_handler)) != IS_UNDEF) {
 		ZVAL_COPY(return_value, &EG(user_error_handler));
-
-		zend_stack_push(&EG(user_error_handlers_error_reporting), &EG(user_error_handler_error_reporting));
-		zend_stack_push(&EG(user_error_handlers), &EG(user_error_handler));
 	}
 
+	zend_stack_push(&EG(user_error_handlers_error_reporting), &EG(user_error_handler_error_reporting));
+	zend_stack_push(&EG(user_error_handlers), &EG(user_error_handler));
+
 	if (Z_TYPE_P(error_handler) == IS_NULL) { /* unset user-defined handler */
 		ZVAL_UNDEF(&EG(user_error_handler));
 		return;
@@ -1732,10 +1732,10 @@ ZEND_FUNCTION(set_exception_handler)
 
 	if (Z_TYPE(EG(user_exception_handler)) != IS_UNDEF) {
 		ZVAL_COPY(return_value, &EG(user_exception_handler));
-
-		zend_stack_push(&EG(user_exception_handlers), &EG(user_exception_handler));
 	}
 
+	zend_stack_push(&EG(user_exception_handlers), &EG(user_exception_handler));
+
 	if (Z_TYPE_P(exception_handler) == IS_NULL) { /* unset user-defined handler */
 		ZVAL_UNDEF(&EG(user_exception_handler));
 		return;

Zend/zend_hash.c

@@ -1934,7 +1934,7 @@ ZEND_API HashTable* ZEND_FASTCALL zend_array_dup(HashTable *source)
 		target->nTableMask = HT_MIN_MASK;
 		target->nNumUsed = 0;
 		target->nNumOfElements = 0;
-		target->nNextFreeElement = 0;
+		target->nNextFreeElement = source->nNextFreeElement;
 		target->nInternalPointer = 0;
 		HT_SET_DATA_ADDR(target, &uninitialized_bucket);
 	} else if (GC_FLAGS(source) & IS_ARRAY_IMMUTABLE) {

Zend/zend_language_scanner.c

@@ -1454,7 +1454,7 @@ yy3:
 		++YYCURSOR;
 		YYDEBUG(4, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 2765 "Zend/zend_language_scanner.l"
+#line 2768 "Zend/zend_language_scanner.l"
 		{
 	if (YYCURSOR > YYLIMIT) {
 		RETURN_TOKEN(END);
@@ -2269,7 +2269,7 @@ yy62:
 		++YYCURSOR;
 		YYDEBUG(63, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 2412 "Zend/zend_language_scanner.l"
+#line 2415 "Zend/zend_language_scanner.l"
 		{
 	BEGIN(ST_BACKQUOTE);
 	RETURN_TOKEN('`');
@@ -4730,6 +4730,7 @@ yy397:
 
 	if (is_heredoc && !SCNG(heredoc_scan_ahead)) {
 		zend_lex_state current_state;
+		zend_string *saved_doc_comment = CG(doc_comment);
 		int heredoc_nesting_level = 1;
 		int first_token = 0;
 		int error = 0;
@@ -4740,6 +4741,7 @@ yy397:
 		SCNG(heredoc_indentation) = 0;
 		SCNG(heredoc_indentation_uses_spaces) = 0;
 		LANG_SCNG(on_event) = NULL;
+		CG(doc_comment) = NULL;
 
 		zend_ptr_stack_reverse_apply(&current_state.heredoc_label_stack, copy_heredoc_label_stack);
 
@@ -4789,6 +4791,7 @@ yy397:
 		zend_restore_lexical_state(&current_state);
 		SCNG(heredoc_scan_ahead) = 0;
 		CG(increment_lineno) = 0;
+		CG(doc_comment) = saved_doc_comment;
 
 		if (PARSER_MODE() && error) {
 			RETURN_TOKEN(T_ERROR);
@@ -4797,7 +4800,7 @@ yy397:
 
 	RETURN_TOKEN(T_START_HEREDOC);
 }
-#line 4801 "Zend/zend_language_scanner.c"
+#line 4804 "Zend/zend_language_scanner.c"
 yy398:
 		YYDEBUG(398, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -4821,7 +4824,7 @@ yy400:
 		{
 	RETURN_TOKEN(T_ARRAY);
 }
-#line 4825 "Zend/zend_language_scanner.c"
+#line 4828 "Zend/zend_language_scanner.c"
 yy402:
 		YYDEBUG(402, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -4834,7 +4837,7 @@ yy402:
 		{
 	RETURN_TOKEN(T_BREAK);
 }
-#line 4838 "Zend/zend_language_scanner.c"
+#line 4841 "Zend/zend_language_scanner.c"
 yy404:
 		YYDEBUG(404, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -4853,7 +4856,7 @@ yy405:
 		{
 	RETURN_TOKEN(T_CATCH);
 }
-#line 4857 "Zend/zend_language_scanner.c"
+#line 4860 "Zend/zend_language_scanner.c"
 yy407:
 		YYDEBUG(407, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -4866,7 +4869,7 @@ yy407:
 		{
 	RETURN_TOKEN(T_CLASS);
 }
-#line 4870 "Zend/zend_language_scanner.c"
+#line 4873 "Zend/zend_language_scanner.c"
 yy409:
 		YYDEBUG(409, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -4879,7 +4882,7 @@ yy409:
 		{
 	RETURN_TOKEN(T_CLONE);
 }
-#line 4883 "Zend/zend_language_scanner.c"
+#line 4886 "Zend/zend_language_scanner.c"
 yy411:
 		YYDEBUG(411, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -4892,7 +4895,7 @@ yy411:
 		{
 	RETURN_TOKEN(T_CONST);
 }
-#line 4896 "Zend/zend_language_scanner.c"
+#line 4899 "Zend/zend_language_scanner.c"
 yy413:
 		YYDEBUG(413, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -4929,7 +4932,7 @@ yy417:
 		{
 	RETURN_TOKEN(T_EMPTY);
 }
-#line 4933 "Zend/zend_language_scanner.c"
+#line 4936 "Zend/zend_language_scanner.c"
 yy419:
 		YYDEBUG(419, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -4954,7 +4957,7 @@ yy421:
 		{
 	RETURN_TOKEN(T_ENDIF);
 }
-#line 4958 "Zend/zend_language_scanner.c"
+#line 4961 "Zend/zend_language_scanner.c"
 yy423:
 		YYDEBUG(423, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5000,7 +5003,7 @@ yy427:
 		{
 	RETURN_TOKEN(T_FINAL);
 }
-#line 5004 "Zend/zend_language_scanner.c"
+#line 5007 "Zend/zend_language_scanner.c"
 yy428:
 		YYDEBUG(428, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5061,7 +5064,7 @@ yy436:
 		{
 	RETURN_TOKEN(T_ISSET);
 }
-#line 5065 "Zend/zend_language_scanner.c"
+#line 5068 "Zend/zend_language_scanner.c"
 yy438:
 		YYDEBUG(438, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5080,7 +5083,7 @@ yy439:
 		{
 	RETURN_TOKEN(T_PRINT);
 }
-#line 5084 "Zend/zend_language_scanner.c"
+#line 5087 "Zend/zend_language_scanner.c"
 yy441:
 		YYDEBUG(441, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5135,7 +5138,7 @@ yy448:
 		{
 	RETURN_TOKEN(T_THROW);
 }
-#line 5139 "Zend/zend_language_scanner.c"
+#line 5142 "Zend/zend_language_scanner.c"
 yy450:
 		YYDEBUG(450, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5148,7 +5151,7 @@ yy450:
 		{
 	RETURN_TOKEN(T_TRAIT);
 }
-#line 5152 "Zend/zend_language_scanner.c"
+#line 5155 "Zend/zend_language_scanner.c"
 yy452:
 		YYDEBUG(452, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5161,7 +5164,7 @@ yy452:
 		{
 	RETURN_TOKEN(T_UNSET);
 }
-#line 5165 "Zend/zend_language_scanner.c"
+#line 5168 "Zend/zend_language_scanner.c"
 yy454:
 		YYDEBUG(454, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5174,7 +5177,7 @@ yy454:
 		{
 	RETURN_TOKEN(T_WHILE);
 }
-#line 5178 "Zend/zend_language_scanner.c"
+#line 5181 "Zend/zend_language_scanner.c"
 yy456:
 		YYDEBUG(456, *YYCURSOR);
 		yyaccept = 6;
@@ -5196,7 +5199,7 @@ yy457:
 		{
 	RETURN_TOKEN(T_YIELD);
 }
-#line 5200 "Zend/zend_language_scanner.c"
+#line 5203 "Zend/zend_language_scanner.c"
 yy458:
 		YYDEBUG(458, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5292,7 +5295,7 @@ yy471:
 		{
 	RETURN_TOKEN(T_BOOL_CAST);
 }
-#line 5296 "Zend/zend_language_scanner.c"
+#line 5299 "Zend/zend_language_scanner.c"
 yy474:
 		YYDEBUG(474, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5326,7 +5329,7 @@ yy478:
 		{
 	RETURN_TOKEN(T_DOUBLE_CAST);
 }
-#line 5330 "Zend/zend_language_scanner.c"
+#line 5333 "Zend/zend_language_scanner.c"
 yy480:
 		YYDEBUG(480, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5395,7 +5398,7 @@ yy489:
 		{
 	RETURN_TOKEN(T_ELSEIF);
 }
-#line 5399 "Zend/zend_language_scanner.c"
+#line 5402 "Zend/zend_language_scanner.c"
 yy491:
 		YYDEBUG(491, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5429,7 +5432,7 @@ yy493:
 		{
 	RETURN_TOKEN(T_ENDFOR);
 }
-#line 5433 "Zend/zend_language_scanner.c"
+#line 5436 "Zend/zend_language_scanner.c"
 yy494:
 		YYDEBUG(494, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5478,7 +5481,7 @@ yy500:
 		{
 	RETURN_TOKEN(T_GLOBAL);
 }
-#line 5482 "Zend/zend_language_scanner.c"
+#line 5485 "Zend/zend_language_scanner.c"
 yy502:
 		YYDEBUG(502, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5539,7 +5542,7 @@ yy510:
 		{
 	RETURN_TOKEN(T_PUBLIC);
 }
-#line 5543 "Zend/zend_language_scanner.c"
+#line 5546 "Zend/zend_language_scanner.c"
 yy512:
 		YYDEBUG(512, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5558,7 +5561,7 @@ yy513:
 		{
 	RETURN_TOKEN(T_RETURN);
 }
-#line 5562 "Zend/zend_language_scanner.c"
+#line 5565 "Zend/zend_language_scanner.c"
 yy515:
 		YYDEBUG(515, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5571,7 +5574,7 @@ yy515:
 		{
 	RETURN_TOKEN(T_STATIC);
 }
-#line 5575 "Zend/zend_language_scanner.c"
+#line 5578 "Zend/zend_language_scanner.c"
 yy517:
 		YYDEBUG(517, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5584,7 +5587,7 @@ yy517:
 		{
 	RETURN_TOKEN(T_SWITCH);
 }
-#line 5588 "Zend/zend_language_scanner.c"
+#line 5591 "Zend/zend_language_scanner.c"
 yy519:
 		YYDEBUG(519, *YYCURSOR);
 		++YYCURSOR;
@@ -5668,7 +5671,7 @@ yy530:
 		{
 	RETURN_TOKEN(T_ARRAY_CAST);
 }
-#line 5672 "Zend/zend_language_scanner.c"
+#line 5675 "Zend/zend_language_scanner.c"
 yy532:
 		YYDEBUG(532, *YYCURSOR);
 		++YYCURSOR;
@@ -5718,7 +5721,7 @@ yy538:
 		{
 	RETURN_TOKEN(T_UNSET_CAST);
 }
-#line 5722 "Zend/zend_language_scanner.c"
+#line 5725 "Zend/zend_language_scanner.c"
 yy540:
 		YYDEBUG(540, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5749,7 +5752,7 @@ yy543:
 		{
 	RETURN_TOKEN(T_DECLARE);
 }
-#line 5753 "Zend/zend_language_scanner.c"
+#line 5756 "Zend/zend_language_scanner.c"
 yy545:
 		YYDEBUG(545, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5762,7 +5765,7 @@ yy545:
 		{
 	RETURN_TOKEN(T_DEFAULT);
 }
-#line 5766 "Zend/zend_language_scanner.c"
+#line 5769 "Zend/zend_language_scanner.c"
 yy547:
 		YYDEBUG(547, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5799,7 +5802,7 @@ yy551:
 		{
 	RETURN_TOKEN(T_EXTENDS);
 }
-#line 5803 "Zend/zend_language_scanner.c"
+#line 5806 "Zend/zend_language_scanner.c"
 yy553:
 		YYDEBUG(553, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5812,7 +5815,7 @@ yy553:
 		{
 	RETURN_TOKEN(T_FINALLY);
 }
-#line 5816 "Zend/zend_language_scanner.c"
+#line 5819 "Zend/zend_language_scanner.c"
 yy555:
 		YYDEBUG(555, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5825,7 +5828,7 @@ yy555:
 		{
 	RETURN_TOKEN(T_FOREACH);
 }
-#line 5829 "Zend/zend_language_scanner.c"
+#line 5832 "Zend/zend_language_scanner.c"
 yy557:
 		YYDEBUG(557, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5863,7 +5866,7 @@ yy560:
 		{
 	RETURN_TOKEN(T_INCLUDE);
 }
-#line 5867 "Zend/zend_language_scanner.c"
+#line 5870 "Zend/zend_language_scanner.c"
 yy561:
 		YYDEBUG(561, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5900,7 +5903,7 @@ yy565:
 		{
 	RETURN_TOKEN(T_PRIVATE);
 }
-#line 5904 "Zend/zend_language_scanner.c"
+#line 5907 "Zend/zend_language_scanner.c"
 yy567:
 		YYDEBUG(567, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5932,7 +5935,7 @@ yy569:
 		{
 	RETURN_TOKEN(T_REQUIRE);
 }
-#line 5936 "Zend/zend_language_scanner.c"
+#line 5939 "Zend/zend_language_scanner.c"
 yy570:
 		YYDEBUG(570, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -5956,7 +5959,7 @@ yy572:
 		{
 	RETURN_TOKEN(T_DIR);
 }
-#line 5960 "Zend/zend_language_scanner.c"
+#line 5963 "Zend/zend_language_scanner.c"
 yy574:
 		YYDEBUG(574, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6005,7 +6008,7 @@ yy581:
 		{
 	RETURN_TOKEN(T_STRING_CAST);
 }
-#line 6009 "Zend/zend_language_scanner.c"
+#line 6012 "Zend/zend_language_scanner.c"
 yy583:
 		YYDEBUG(583, *YYCURSOR);
 		++YYCURSOR;
@@ -6015,7 +6018,7 @@ yy583:
 		{
 	RETURN_TOKEN(T_OBJECT_CAST);
 }
-#line 6019 "Zend/zend_language_scanner.c"
+#line 6022 "Zend/zend_language_scanner.c"
 yy585:
 		YYDEBUG(585, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6028,7 +6031,7 @@ yy585:
 		{
 	RETURN_TOKEN(T_ABSTRACT);
 }
-#line 6032 "Zend/zend_language_scanner.c"
+#line 6035 "Zend/zend_language_scanner.c"
 yy587:
 		YYDEBUG(587, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6041,7 +6044,7 @@ yy587:
 		{
 	RETURN_TOKEN(T_CALLABLE);
 }
-#line 6045 "Zend/zend_language_scanner.c"
+#line 6048 "Zend/zend_language_scanner.c"
 yy589:
 		YYDEBUG(589, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6054,7 +6057,7 @@ yy589:
 		{
 	RETURN_TOKEN(T_CONTINUE);
 }
-#line 6058 "Zend/zend_language_scanner.c"
+#line 6061 "Zend/zend_language_scanner.c"
 yy591:
 		YYDEBUG(591, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6085,7 +6088,7 @@ yy594:
 		{
 	RETURN_TOKEN(T_ENDWHILE);
 }
-#line 6089 "Zend/zend_language_scanner.c"
+#line 6092 "Zend/zend_language_scanner.c"
 yy596:
 		YYDEBUG(596, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6098,7 +6101,7 @@ yy596:
 		{
 	RETURN_TOKEN(T_FUNCTION);
 }
-#line 6102 "Zend/zend_language_scanner.c"
+#line 6105 "Zend/zend_language_scanner.c"
 yy598:
 		YYDEBUG(598, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6170,7 +6173,7 @@ yy608:
 		{
 	RETURN_TOKEN(T_FILE);
 }
-#line 6174 "Zend/zend_language_scanner.c"
+#line 6177 "Zend/zend_language_scanner.c"
 yy610:
 		YYDEBUG(610, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6195,7 +6198,7 @@ yy612:
 		{
 	RETURN_TOKEN(T_LINE);
 }
-#line 6199 "Zend/zend_language_scanner.c"
+#line 6202 "Zend/zend_language_scanner.c"
 yy614:
 		YYDEBUG(614, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6236,7 +6239,7 @@ yy619:
 		{
 	RETURN_TOKEN(T_ENDSWITCH);
 }
-#line 6240 "Zend/zend_language_scanner.c"
+#line 6243 "Zend/zend_language_scanner.c"
 yy621:
 		YYDEBUG(621, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6267,7 +6270,7 @@ yy624:
 		{
     RETURN_TOKEN(T_INSTEADOF);
 }
-#line 6271 "Zend/zend_language_scanner.c"
+#line 6274 "Zend/zend_language_scanner.c"
 yy626:
 		YYDEBUG(626, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6280,7 +6283,7 @@ yy626:
 		{
 	RETURN_TOKEN(T_INTERFACE);
 }
-#line 6284 "Zend/zend_language_scanner.c"
+#line 6287 "Zend/zend_language_scanner.c"
 yy628:
 		YYDEBUG(628, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6293,7 +6296,7 @@ yy628:
 		{
 	RETURN_TOKEN(T_NAMESPACE);
 }
-#line 6297 "Zend/zend_language_scanner.c"
+#line 6300 "Zend/zend_language_scanner.c"
 yy630:
 		YYDEBUG(630, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6306,7 +6309,7 @@ yy630:
 		{
 	RETURN_TOKEN(T_PROTECTED);
 }
-#line 6310 "Zend/zend_language_scanner.c"
+#line 6313 "Zend/zend_language_scanner.c"
 yy632:
 		YYDEBUG(632, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6331,7 +6334,7 @@ yy634:
 		{
 	RETURN_TOKEN(T_CLASS_C);
 }
-#line 6335 "Zend/zend_language_scanner.c"
+#line 6338 "Zend/zend_language_scanner.c"
 yy636:
 		YYDEBUG(636, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6367,7 +6370,7 @@ yy640:
 		{
 	RETURN_TOKEN(T_TRAIT_C);
 }
-#line 6371 "Zend/zend_language_scanner.c"
+#line 6374 "Zend/zend_language_scanner.c"
 yy642:
 		YYDEBUG(642, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6380,7 +6383,7 @@ yy642:
 		{
 	RETURN_TOKEN(T_ENDDECLARE);
 }
-#line 6384 "Zend/zend_language_scanner.c"
+#line 6387 "Zend/zend_language_scanner.c"
 yy644:
 		YYDEBUG(644, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6393,7 +6396,7 @@ yy644:
 		{
 	RETURN_TOKEN(T_ENDFOREACH);
 }
-#line 6397 "Zend/zend_language_scanner.c"
+#line 6400 "Zend/zend_language_scanner.c"
 yy646:
 		YYDEBUG(646, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6406,7 +6409,7 @@ yy646:
 		{
 	RETURN_TOKEN(T_IMPLEMENTS);
 }
-#line 6410 "Zend/zend_language_scanner.c"
+#line 6413 "Zend/zend_language_scanner.c"
 yy648:
 		YYDEBUG(648, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6425,7 +6428,7 @@ yy649:
 		{
 	RETURN_TOKEN(T_INSTANCEOF);
 }
-#line 6429 "Zend/zend_language_scanner.c"
+#line 6432 "Zend/zend_language_scanner.c"
 yy651:
 		YYDEBUG(651, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6477,7 +6480,7 @@ yy655:
 		{
 	RETURN_TOKEN(T_METHOD_C);
 }
-#line 6481 "Zend/zend_language_scanner.c"
+#line 6484 "Zend/zend_language_scanner.c"
 yy657:
 		YYDEBUG(657, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6507,7 +6510,7 @@ yy660:
 	HANDLE_NEWLINES(yytext, yyleng);
 	RETURN_TOKEN(T_YIELD_FROM);
 }
-#line 6511 "Zend/zend_language_scanner.c"
+#line 6514 "Zend/zend_language_scanner.c"
 yy662:
 		YYDEBUG(662, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6536,7 +6539,7 @@ yy665:
 		{
 	RETURN_TOKEN(T_INCLUDE_ONCE);
 }
-#line 6540 "Zend/zend_language_scanner.c"
+#line 6543 "Zend/zend_language_scanner.c"
 yy667:
 		YYDEBUG(667, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6549,7 +6552,7 @@ yy667:
 		{
 	RETURN_TOKEN(T_REQUIRE_ONCE);
 }
-#line 6553 "Zend/zend_language_scanner.c"
+#line 6556 "Zend/zend_language_scanner.c"
 yy669:
 		YYDEBUG(669, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6562,7 +6565,7 @@ yy669:
 		{
 	RETURN_TOKEN(T_FUNC_C);
 }
-#line 6566 "Zend/zend_language_scanner.c"
+#line 6569 "Zend/zend_language_scanner.c"
 yy671:
 		YYDEBUG(671, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6592,7 +6595,7 @@ yy674:
 		{
 	RETURN_TOKEN(T_NS_C);
 }
-#line 6596 "Zend/zend_language_scanner.c"
+#line 6599 "Zend/zend_language_scanner.c"
 yy676:
 		YYDEBUG(676, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6610,7 +6613,7 @@ yy677:
 		{
 	RETURN_TOKEN(T_HALT_COMPILER);
 }
-#line 6614 "Zend/zend_language_scanner.c"
+#line 6617 "Zend/zend_language_scanner.c"
 	}
 /* *********************************** */
 yyc_ST_LOOKING_FOR_PROPERTY:
@@ -6682,7 +6685,7 @@ yy682:
 	yy_pop_state();
 	goto restart;
 }
-#line 6686 "Zend/zend_language_scanner.c"
+#line 6689 "Zend/zend_language_scanner.c"
 yy683:
 		YYDEBUG(683, *YYCURSOR);
 		++YYCURSOR;
@@ -6698,7 +6701,7 @@ yy683:
 		{
 	goto return_whitespace;
 }
-#line 6702 "Zend/zend_language_scanner.c"
+#line 6705 "Zend/zend_language_scanner.c"
 yy686:
 		YYDEBUG(686, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6720,7 +6723,7 @@ yy687:
 	yy_pop_state();
 	RETURN_TOKEN_WITH_STR(T_STRING, 0);
 }
-#line 6724 "Zend/zend_language_scanner.c"
+#line 6727 "Zend/zend_language_scanner.c"
 yy690:
 		YYDEBUG(690, *YYCURSOR);
 		++YYCURSOR;
@@ -6730,7 +6733,7 @@ yy690:
 		{
 	RETURN_TOKEN(T_OBJECT_OPERATOR);
 }
-#line 6734 "Zend/zend_language_scanner.c"
+#line 6737 "Zend/zend_language_scanner.c"
 	}
 /* *********************************** */
 yyc_ST_BACKQUOTE:
@@ -6783,7 +6786,7 @@ yyc_ST_BACKQUOTE:
 yy695:
 		YYDEBUG(695, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 2504 "Zend/zend_language_scanner.l"
+#line 2507 "Zend/zend_language_scanner.l"
 		{
 	if (YYCURSOR > YYLIMIT) {
 		RETURN_TOKEN(END);
@@ -6828,7 +6831,7 @@ yy695:
 		RETURN_TOKEN(T_ERROR);
 	}
 }
-#line 6832 "Zend/zend_language_scanner.c"
+#line 6835 "Zend/zend_language_scanner.c"
 yy696:
 		YYDEBUG(696, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6852,12 +6855,12 @@ yy697:
 		++YYCURSOR;
 		YYDEBUG(698, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 2444 "Zend/zend_language_scanner.l"
+#line 2447 "Zend/zend_language_scanner.l"
 		{
 	BEGIN(ST_IN_SCRIPTING);
 	RETURN_TOKEN('`');
 }
-#line 6861 "Zend/zend_language_scanner.c"
+#line 6864 "Zend/zend_language_scanner.c"
 yy699:
 		YYDEBUG(699, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6882,7 +6885,7 @@ yy702:
 		{
 	RETURN_TOKEN_WITH_STR(T_VARIABLE, 1);
 }
-#line 6886 "Zend/zend_language_scanner.c"
+#line 6889 "Zend/zend_language_scanner.c"
 yy703:
 		YYDEBUG(703, *YYCURSOR);
 		++YYCURSOR;
@@ -6893,19 +6896,19 @@ yy703:
 	yy_push_state(ST_LOOKING_FOR_VARNAME);
 	RETURN_TOKEN(T_DOLLAR_OPEN_CURLY_BRACES);
 }
-#line 6897 "Zend/zend_language_scanner.c"
+#line 6900 "Zend/zend_language_scanner.c"
 yy705:
 		YYDEBUG(705, *YYCURSOR);
 		++YYCURSOR;
 		YYDEBUG(706, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 2432 "Zend/zend_language_scanner.l"
+#line 2435 "Zend/zend_language_scanner.l"
 		{
 	yy_push_state(ST_IN_SCRIPTING);
 	yyless(1);
 	RETURN_TOKEN(T_CURLY_OPEN);
 }
-#line 6909 "Zend/zend_language_scanner.c"
+#line 6912 "Zend/zend_language_scanner.c"
 yy707:
 		YYDEBUG(707, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6925,7 +6928,7 @@ yy709:
 	yy_push_state(ST_VAR_OFFSET);
 	RETURN_TOKEN_WITH_STR(T_VARIABLE, 1);
 }
-#line 6929 "Zend/zend_language_scanner.c"
+#line 6932 "Zend/zend_language_scanner.c"
 yy711:
 		YYDEBUG(711, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -6949,7 +6952,7 @@ yy712:
 	yy_push_state(ST_LOOKING_FOR_PROPERTY);
 	RETURN_TOKEN_WITH_STR(T_VARIABLE, 1);
 }
-#line 6953 "Zend/zend_language_scanner.c"
+#line 6956 "Zend/zend_language_scanner.c"
 	}
 /* *********************************** */
 yyc_ST_DOUBLE_QUOTES:
@@ -7002,7 +7005,7 @@ yyc_ST_DOUBLE_QUOTES:
 yy717:
 		YYDEBUG(717, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 2450 "Zend/zend_language_scanner.l"
+#line 2453 "Zend/zend_language_scanner.l"
 		{
 	if (GET_DOUBLE_QUOTES_SCANNED_LENGTH()) {
 		YYCURSOR += GET_DOUBLE_QUOTES_SCANNED_LENGTH() - 1;
@@ -7055,18 +7058,18 @@ double_quotes_scan_done:
 		RETURN_TOKEN(T_ERROR);
 	}
 }
-#line 7059 "Zend/zend_language_scanner.c"
+#line 7062 "Zend/zend_language_scanner.c"
 yy718:
 		YYDEBUG(718, *YYCURSOR);
 		++YYCURSOR;
 		YYDEBUG(719, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 2439 "Zend/zend_language_scanner.l"
+#line 2442 "Zend/zend_language_scanner.l"
 		{
 	BEGIN(ST_IN_SCRIPTING);
 	RETURN_TOKEN('"');
 }
-#line 7070 "Zend/zend_language_scanner.c"
+#line 7073 "Zend/zend_language_scanner.c"
 yy720:
 		YYDEBUG(720, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -7109,7 +7112,7 @@ yy724:
 		{
 	RETURN_TOKEN_WITH_STR(T_VARIABLE, 1);
 }
-#line 7113 "Zend/zend_language_scanner.c"
+#line 7116 "Zend/zend_language_scanner.c"
 yy725:
 		YYDEBUG(725, *YYCURSOR);
 		++YYCURSOR;
@@ -7120,19 +7123,19 @@ yy725:
 	yy_push_state(ST_LOOKING_FOR_VARNAME);
 	RETURN_TOKEN(T_DOLLAR_OPEN_CURLY_BRACES);
 }
-#line 7124 "Zend/zend_language_scanner.c"
+#line 7127 "Zend/zend_language_scanner.c"
 yy727:
 		YYDEBUG(727, *YYCURSOR);
 		++YYCURSOR;
 		YYDEBUG(728, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 2432 "Zend/zend_language_scanner.l"
+#line 2435 "Zend/zend_language_scanner.l"
 		{
 	yy_push_state(ST_IN_SCRIPTING);
 	yyless(1);
 	RETURN_TOKEN(T_CURLY_OPEN);
 }
-#line 7136 "Zend/zend_language_scanner.c"
+#line 7139 "Zend/zend_language_scanner.c"
 yy729:
 		YYDEBUG(729, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -7152,7 +7155,7 @@ yy731:
 	yy_push_state(ST_VAR_OFFSET);
 	RETURN_TOKEN_WITH_STR(T_VARIABLE, 1);
 }
-#line 7156 "Zend/zend_language_scanner.c"
+#line 7159 "Zend/zend_language_scanner.c"
 yy733:
 		YYDEBUG(733, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -7176,7 +7179,7 @@ yy734:
 	yy_push_state(ST_LOOKING_FOR_PROPERTY);
 	RETURN_TOKEN_WITH_STR(T_VARIABLE, 1);
 }
-#line 7180 "Zend/zend_language_scanner.c"
+#line 7183 "Zend/zend_language_scanner.c"
 	}
 /* *********************************** */
 yyc_ST_HEREDOC:
@@ -7225,7 +7228,7 @@ yyc_ST_HEREDOC:
 yy739:
 		YYDEBUG(739, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 2550 "Zend/zend_language_scanner.l"
+#line 2553 "Zend/zend_language_scanner.l"
 		{
 	zend_heredoc_label *heredoc_label = zend_ptr_stack_top(&SCNG(heredoc_label_stack));
 	int newline = 0, indentation = 0, spacing = 0;
@@ -7348,7 +7351,7 @@ heredoc_scan_done:
 
 	RETURN_TOKEN_WITH_VAL(T_ENCAPSED_AND_WHITESPACE);
 }
-#line 7352 "Zend/zend_language_scanner.c"
+#line 7355 "Zend/zend_language_scanner.c"
 yy740:
 		YYDEBUG(740, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -7391,7 +7394,7 @@ yy744:
 		{
 	RETURN_TOKEN_WITH_STR(T_VARIABLE, 1);
 }
-#line 7395 "Zend/zend_language_scanner.c"
+#line 7398 "Zend/zend_language_scanner.c"
 yy745:
 		YYDEBUG(745, *YYCURSOR);
 		++YYCURSOR;
@@ -7402,19 +7405,19 @@ yy745:
 	yy_push_state(ST_LOOKING_FOR_VARNAME);
 	RETURN_TOKEN(T_DOLLAR_OPEN_CURLY_BRACES);
 }
-#line 7406 "Zend/zend_language_scanner.c"
+#line 7409 "Zend/zend_language_scanner.c"
 yy747:
 		YYDEBUG(747, *YYCURSOR);
 		++YYCURSOR;
 		YYDEBUG(748, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 2432 "Zend/zend_language_scanner.l"
+#line 2435 "Zend/zend_language_scanner.l"
 		{
 	yy_push_state(ST_IN_SCRIPTING);
 	yyless(1);
 	RETURN_TOKEN(T_CURLY_OPEN);
 }
-#line 7418 "Zend/zend_language_scanner.c"
+#line 7421 "Zend/zend_language_scanner.c"
 yy749:
 		YYDEBUG(749, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -7434,7 +7437,7 @@ yy751:
 	yy_push_state(ST_VAR_OFFSET);
 	RETURN_TOKEN_WITH_STR(T_VARIABLE, 1);
 }
-#line 7438 "Zend/zend_language_scanner.c"
+#line 7441 "Zend/zend_language_scanner.c"
 yy753:
 		YYDEBUG(753, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -7458,7 +7461,7 @@ yy754:
 	yy_push_state(ST_LOOKING_FOR_PROPERTY);
 	RETURN_TOKEN_WITH_STR(T_VARIABLE, 1);
 }
-#line 7462 "Zend/zend_language_scanner.c"
+#line 7465 "Zend/zend_language_scanner.c"
 	}
 /* *********************************** */
 yyc_ST_LOOKING_FOR_VARNAME:
@@ -7522,7 +7525,7 @@ yy759:
 	yy_push_state(ST_IN_SCRIPTING);
 	goto restart;
 }
-#line 7526 "Zend/zend_language_scanner.c"
+#line 7529 "Zend/zend_language_scanner.c"
 yy760:
 		YYDEBUG(760, *YYCURSOR);
 		yych = *(YYMARKER = ++YYCURSOR);
@@ -7576,7 +7579,7 @@ yy764:
 	yy_push_state(ST_IN_SCRIPTING);
 	RETURN_TOKEN_WITH_STR(T_STRING_VARNAME, 0);
 }
-#line 7580 "Zend/zend_language_scanner.c"
+#line 7583 "Zend/zend_language_scanner.c"
 	}
 /* *********************************** */
 yyc_ST_VAR_OFFSET:
@@ -7665,7 +7668,7 @@ yy768:
 		++YYCURSOR;
 		YYDEBUG(769, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 2765 "Zend/zend_language_scanner.l"
+#line 2768 "Zend/zend_language_scanner.l"
 		{
 	if (YYCURSOR > YYLIMIT) {
 		RETURN_TOKEN(END);
@@ -7676,7 +7679,7 @@ yy768:
 	}
 	goto restart;
 }
-#line 7680 "Zend/zend_language_scanner.c"
+#line 7683 "Zend/zend_language_scanner.c"
 yy770:
 		YYDEBUG(770, *YYCURSOR);
 		++YYCURSOR;
@@ -7690,7 +7693,7 @@ yy770:
 	ZVAL_NULL(zendlval);
 	RETURN_TOKEN_WITH_VAL(T_ENCAPSED_AND_WHITESPACE);
 }
-#line 7694 "Zend/zend_language_scanner.c"
+#line 7697 "Zend/zend_language_scanner.c"
 yy772:
 		YYDEBUG(772, *YYCURSOR);
 		++YYCURSOR;
@@ -7702,7 +7705,7 @@ yy773:
 	/* Only '[' or '-' can be valid, but returning other tokens will allow a more explicit parse error */
 	RETURN_TOKEN(yytext[0]);
 }
-#line 7706 "Zend/zend_language_scanner.c"
+#line 7709 "Zend/zend_language_scanner.c"
 yy774:
 		YYDEBUG(774, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -7753,7 +7756,7 @@ string:
 	}
 	RETURN_TOKEN_WITH_VAL(T_NUM_STRING);
 }
-#line 7757 "Zend/zend_language_scanner.c"
+#line 7760 "Zend/zend_language_scanner.c"
 yy777:
 		YYDEBUG(777, *YYCURSOR);
 		++YYCURSOR;
@@ -7779,7 +7782,7 @@ yy779:
 		{
 	RETURN_TOKEN_WITH_STR(T_STRING, 0);
 }
-#line 7783 "Zend/zend_language_scanner.c"
+#line 7786 "Zend/zend_language_scanner.c"
 yy782:
 		YYDEBUG(782, *YYCURSOR);
 		++YYCURSOR;
@@ -7790,7 +7793,7 @@ yy782:
 	yy_pop_state();
 	RETURN_TOKEN(']');
 }
-#line 7794 "Zend/zend_language_scanner.c"
+#line 7797 "Zend/zend_language_scanner.c"
 yy784:
 		YYDEBUG(784, *YYCURSOR);
 		++YYCURSOR;
@@ -7819,7 +7822,7 @@ yy786:
 		{
 	RETURN_TOKEN_WITH_STR(T_VARIABLE, 1);
 }
-#line 7823 "Zend/zend_language_scanner.c"
+#line 7826 "Zend/zend_language_scanner.c"
 yy787:
 		YYDEBUG(787, *YYCURSOR);
 		++YYCURSOR;
@@ -7840,7 +7843,7 @@ yy789:
 	}
 	RETURN_TOKEN_WITH_VAL(T_NUM_STRING);
 }
-#line 7844 "Zend/zend_language_scanner.c"
+#line 7847 "Zend/zend_language_scanner.c"
 yy790:
 		YYDEBUG(790, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -7937,7 +7940,7 @@ inline_char_handler:
 	HANDLE_NEWLINES(yytext, yyleng);
 	RETURN_TOKEN_WITH_VAL(T_INLINE_HTML);
 }
-#line 7941 "Zend/zend_language_scanner.c"
+#line 7944 "Zend/zend_language_scanner.c"
 yy801:
 	YYDEBUG(801, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -7965,7 +7968,7 @@ yy803:
 		goto inline_char_handler;
 	}
 }
-#line 7969 "Zend/zend_language_scanner.c"
+#line 7972 "Zend/zend_language_scanner.c"
 yy804:
 	YYDEBUG(804, *YYCURSOR);
 	++YYCURSOR;
@@ -7979,7 +7982,7 @@ yy804:
 	}
 	RETURN_TOKEN(T_OPEN_TAG_WITH_ECHO);
 }
-#line 7983 "Zend/zend_language_scanner.c"
+#line 7986 "Zend/zend_language_scanner.c"
 yy806:
 	YYDEBUG(806, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -8019,7 +8022,7 @@ yy811:
 	}
 	RETURN_TOKEN(T_OPEN_TAG);
 }
-#line 8023 "Zend/zend_language_scanner.c"
+#line 8026 "Zend/zend_language_scanner.c"
 yy812:
 	YYDEBUG(812, *YYCURSOR);
 	yych = *++YYCURSOR;
@@ -8034,7 +8037,7 @@ yyc_ST_END_HEREDOC:
 	++YYCURSOR;
 	YYDEBUG(816, *YYCURSOR);
 	yyleng = YYCURSOR - SCNG(yy_text);
-#line 2418 "Zend/zend_language_scanner.l"
+#line 2421 "Zend/zend_language_scanner.l"
 	{
 	zend_heredoc_label *heredoc_label = zend_ptr_stack_pop(&SCNG(heredoc_label_stack));
 
@@ -8047,7 +8050,7 @@ yyc_ST_END_HEREDOC:
 	BEGIN(ST_IN_SCRIPTING);
 	RETURN_TOKEN(T_END_HEREDOC);
 }
-#line 8051 "Zend/zend_language_scanner.c"
+#line 8054 "Zend/zend_language_scanner.c"
 /* *********************************** */
 yyc_ST_NOWDOC:
 	YYDEBUG(817, *YYCURSOR);
@@ -8057,7 +8060,7 @@ yyc_ST_NOWDOC:
 	++YYCURSOR;
 	YYDEBUG(820, *YYCURSOR);
 	yyleng = YYCURSOR - SCNG(yy_text);
-#line 2674 "Zend/zend_language_scanner.l"
+#line 2677 "Zend/zend_language_scanner.l"
 	{
 	zend_heredoc_label *heredoc_label = zend_ptr_stack_top(&SCNG(heredoc_label_stack));
 	int newline = 0, indentation = 0, spacing = -1;
@@ -8147,9 +8150,9 @@ nowdoc_scan_done:
 	HANDLE_NEWLINES(yytext, yyleng - newline);
 	RETURN_TOKEN_WITH_VAL(T_ENCAPSED_AND_WHITESPACE);
 }
-#line 8151 "Zend/zend_language_scanner.c"
+#line 8154 "Zend/zend_language_scanner.c"
 }
-#line 2776 "Zend/zend_language_scanner.l"
+#line 2779 "Zend/zend_language_scanner.l"
 
 
 emit_token_with_str:

Zend/zend_language_scanner.l

@@ -2340,6 +2340,7 @@ skip_escape_conversion:
 
 	if (is_heredoc && !SCNG(heredoc_scan_ahead)) {
 		zend_lex_state current_state;
+		zend_string *saved_doc_comment = CG(doc_comment);
 		int heredoc_nesting_level = 1;
 		int first_token = 0;
 		int error = 0;
@@ -2350,6 +2351,7 @@ skip_escape_conversion:
 		SCNG(heredoc_indentation) = 0;
 		SCNG(heredoc_indentation_uses_spaces) = 0;
 		LANG_SCNG(on_event) = NULL;
+		CG(doc_comment) = NULL;
 
 		zend_ptr_stack_reverse_apply(&current_state.heredoc_label_stack, copy_heredoc_label_stack);
 
@@ -2399,6 +2401,7 @@ skip_escape_conversion:
 		zend_restore_lexical_state(&current_state);
 		SCNG(heredoc_scan_ahead) = 0;
 		CG(increment_lineno) = 0;
+		CG(doc_comment) = saved_doc_comment;
 
 		if (PARSER_MODE() && error) {
 			RETURN_TOKEN(T_ERROR);

Zend/zend_vm_def.h

@@ -2398,9 +2398,9 @@ ZEND_VM_HOT_HELPER(zend_leave_helper, ANY, ANY)
 	uint32_t call_info = EX_CALL_INFO();
 
 	if (EXPECTED((call_info & (ZEND_CALL_CODE|ZEND_CALL_TOP|ZEND_CALL_HAS_SYMBOL_TABLE|ZEND_CALL_FREE_EXTRA_ARGS|ZEND_CALL_ALLOCATED)) == 0)) {
+		EG(current_execute_data) = EX(prev_execute_data);
 		i_free_compiled_variables(execute_data);
 
-		EG(current_execute_data) = EX(prev_execute_data);
 		if (UNEXPECTED(call_info & ZEND_CALL_RELEASE_THIS)) {
 			zend_object *object = Z_OBJ(execute_data->This);
 #if 0
@@ -2426,12 +2426,12 @@ ZEND_VM_HOT_HELPER(zend_leave_helper, ANY, ANY)
 		LOAD_NEXT_OPLINE();
 		ZEND_VM_LEAVE();
 	} else if (EXPECTED((call_info & (ZEND_CALL_CODE|ZEND_CALL_TOP)) == 0)) {
+		EG(current_execute_data) = EX(prev_execute_data);
 		i_free_compiled_variables(execute_data);
 
 		if (UNEXPECTED(call_info & ZEND_CALL_HAS_SYMBOL_TABLE)) {
 			zend_clean_and_cache_symbol_table(EX(symbol_table));
 		}
-		EG(current_execute_data) = EX(prev_execute_data);
 
 		/* Free extra args before releasing the closure,
 		 * as that may free the op_array. */
@@ -2481,6 +2481,7 @@ ZEND_VM_HOT_HELPER(zend_leave_helper, ANY, ANY)
 		ZEND_VM_LEAVE();
 	} else {
 		if (EXPECTED((call_info & ZEND_CALL_CODE) == 0)) {
+			EG(current_execute_data) = EX(prev_execute_data);
 			i_free_compiled_variables(execute_data);
 			if (UNEXPECTED(call_info & (ZEND_CALL_HAS_SYMBOL_TABLE|ZEND_CALL_FREE_EXTRA_ARGS))) {
 				if (UNEXPECTED(call_info & ZEND_CALL_HAS_SYMBOL_TABLE)) {
@@ -2488,7 +2489,6 @@ ZEND_VM_HOT_HELPER(zend_leave_helper, ANY, ANY)
 				}
 				zend_vm_stack_free_extra_args_ex(call_info, execute_data);
 			}
-			EG(current_execute_data) = EX(prev_execute_data);
 			if (UNEXPECTED(call_info & ZEND_CALL_CLOSURE)) {
 				OBJ_RELEASE(ZEND_CLOSURE_OBJECT(EX(func)));
 			}

Zend/zend_vm_execute.h

@@ -507,9 +507,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_leave_helper_SPEC(ZEND_OPCODE_
 	uint32_t call_info = EX_CALL_INFO();
 
 	if (EXPECTED((call_info & (ZEND_CALL_CODE|ZEND_CALL_TOP|ZEND_CALL_HAS_SYMBOL_TABLE|ZEND_CALL_FREE_EXTRA_ARGS|ZEND_CALL_ALLOCATED)) == 0)) {
+		EG(current_execute_data) = EX(prev_execute_data);
 		i_free_compiled_variables(execute_data);
 
-		EG(current_execute_data) = EX(prev_execute_data);
 		if (UNEXPECTED(call_info & ZEND_CALL_RELEASE_THIS)) {
 			zend_object *object = Z_OBJ(execute_data->This);
 #if 0
@@ -535,12 +535,12 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_leave_helper_SPEC(ZEND_OPCODE_
 		LOAD_NEXT_OPLINE();
 		ZEND_VM_LEAVE();
 	} else if (EXPECTED((call_info & (ZEND_CALL_CODE|ZEND_CALL_TOP)) == 0)) {
+		EG(current_execute_data) = EX(prev_execute_data);
 		i_free_compiled_variables(execute_data);
 
 		if (UNEXPECTED(call_info & ZEND_CALL_HAS_SYMBOL_TABLE)) {
 			zend_clean_and_cache_symbol_table(EX(symbol_table));
 		}
-		EG(current_execute_data) = EX(prev_execute_data);
 
 		/* Free extra args before releasing the closure,
 		 * as that may free the op_array. */
@@ -590,6 +590,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_leave_helper_SPEC(ZEND_OPCODE_
 		ZEND_VM_LEAVE();
 	} else {
 		if (EXPECTED((call_info & ZEND_CALL_CODE) == 0)) {
+			EG(current_execute_data) = EX(prev_execute_data);
 			i_free_compiled_variables(execute_data);
 			if (UNEXPECTED(call_info & (ZEND_CALL_HAS_SYMBOL_TABLE|ZEND_CALL_FREE_EXTRA_ARGS))) {
 				if (UNEXPECTED(call_info & ZEND_CALL_HAS_SYMBOL_TABLE)) {
@@ -597,7 +598,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_leave_helper_SPEC(ZEND_OPCODE_
 				}
 				zend_vm_stack_free_extra_args_ex(call_info, execute_data);
 			}
-			EG(current_execute_data) = EX(prev_execute_data);
 			if (UNEXPECTED(call_info & ZEND_CALL_CLOSURE)) {
 				OBJ_RELEASE(ZEND_CLOSURE_OBJECT(EX(func)));
 			}
@@ -55379,9 +55379,9 @@ zend_leave_helper_SPEC_LABEL:
 	uint32_t call_info = EX_CALL_INFO();
 
 	if (EXPECTED((call_info & (ZEND_CALL_CODE|ZEND_CALL_TOP|ZEND_CALL_HAS_SYMBOL_TABLE|ZEND_CALL_FREE_EXTRA_ARGS|ZEND_CALL_ALLOCATED)) == 0)) {
+		EG(current_execute_data) = EX(prev_execute_data);
 		i_free_compiled_variables(execute_data);
 
-		EG(current_execute_data) = EX(prev_execute_data);
 		if (UNEXPECTED(call_info & ZEND_CALL_RELEASE_THIS)) {
 			zend_object *object = Z_OBJ(execute_data->This);
 #if 0
@@ -55407,12 +55407,12 @@ zend_leave_helper_SPEC_LABEL:
 		LOAD_NEXT_OPLINE();
 		ZEND_VM_LEAVE();
 	} else if (EXPECTED((call_info & (ZEND_CALL_CODE|ZEND_CALL_TOP)) == 0)) {
+		EG(current_execute_data) = EX(prev_execute_data);
 		i_free_compiled_variables(execute_data);
 
 		if (UNEXPECTED(call_info & ZEND_CALL_HAS_SYMBOL_TABLE)) {
 			zend_clean_and_cache_symbol_table(EX(symbol_table));
 		}
-		EG(current_execute_data) = EX(prev_execute_data);
 
 		/* Free extra args before releasing the closure,
 		 * as that may free the op_array. */
@@ -55462,6 +55462,7 @@ zend_leave_helper_SPEC_LABEL:
 		ZEND_VM_LEAVE();
 	} else {
 		if (EXPECTED((call_info & ZEND_CALL_CODE) == 0)) {
+			EG(current_execute_data) = EX(prev_execute_data);
 			i_free_compiled_variables(execute_data);
 			if (UNEXPECTED(call_info & (ZEND_CALL_HAS_SYMBOL_TABLE|ZEND_CALL_FREE_EXTRA_ARGS))) {
 				if (UNEXPECTED(call_info & ZEND_CALL_HAS_SYMBOL_TABLE)) {
@@ -55469,7 +55470,6 @@ zend_leave_helper_SPEC_LABEL:
 				}
 				zend_vm_stack_free_extra_args_ex(call_info, execute_data);
 			}
-			EG(current_execute_data) = EX(prev_execute_data);
 			if (UNEXPECTED(call_info & ZEND_CALL_CLOSURE)) {
 				OBJ_RELEASE(ZEND_CLOSURE_OBJECT(EX(func)));
 			}

buildconf.bat

@@ -1,5 +1,5 @@
 @echo off
-cscript /nologo win32\build\buildconf.js %*
+cscript /nologo /e:jscript win32\build\buildconf.js %*
 SET PHP_BUILDCONF_PATH=%~dp0
 copy %PHP_BUILDCONF_PATH%\win32\build\configure.bat %PHP_BUILDCONF_PATH% > nul
 SET PHP_SDK_SCRIPT_PATH=

configure.ac

@@ -107,8 +107,8 @@ int zend_sprintf(char *buffer, const char *format, ...);
 
 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=3
-PHP_RELEASE_VERSION=14
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=17
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
 

ext/calendar/tests/easter_date.phpt

@@ -2,6 +2,8 @@
 easter_date()
 --INI--
 date.timezone=UTC
+--ENV--
+TZ=UTC
 --SKIPIF--
 <?php include 'skipif.inc'; ?>
 --FILE--

ext/com_dotnet/com_extension.c

@@ -336,11 +336,15 @@ PHP_MINIT_FUNCTION(com_dotnet)
 
 #define COM_CONST(x) REGISTER_LONG_CONSTANT(#x, x, CONST_CS|CONST_PERSISTENT)
 
-#define COM_ERR_CONST(x) { \
+#if SIZEOF_ZEND_LONG == 8
+# define COM_ERR_CONST(x) { \
 	zend_long __tmp; \
 	ULongToIntPtr(x, &__tmp); \
 	REGISTER_LONG_CONSTANT(#x, __tmp, CONST_CS|CONST_PERSISTENT); \
 }
+#else
+# define COM_ERR_CONST COM_CONST
+#endif
 
 	COM_CONST(CLSCTX_INPROC_SERVER);
 	COM_CONST(CLSCTX_INPROC_HANDLER);

ext/com_dotnet/com_iterator.c

@@ -187,7 +187,7 @@ zend_object_iterator *php_com_iter_get(zend_class_entry *ce, zval *object, int b
 		SafeArrayGetUBound(V_ARRAY(&I->safe_array), 1, &I->sa_max);
 
 		/* pre-fetch the element */
-		if (php_com_safearray_get_elem(&I->safe_array, &I->v, bound)) {
+		if (I->sa_max >= bound && php_com_safearray_get_elem(&I->safe_array, &I->v, bound)) {
 			I->key = bound;
 			ZVAL_NULL(&ptr);
 			php_com_zval_from_variant(&ptr, &I->v, I->code_page);

ext/com_dotnet/com_persist.c

@@ -248,13 +248,6 @@ static struct IStreamVtbl php_istream_vtbl = {
 
 static void istream_destructor(php_istream *stm)
 {
-	if (stm->res) {
-		zend_resource *res = stm->res;
-		stm->res = NULL;
-		zend_list_delete(res);
-		return;
-	}
-
 	if (stm->refcount > 0) {
 		CoDisconnectObject((IUnknown*)stm, 0);
 	}
@@ -268,7 +261,6 @@ static void istream_destructor(php_istream *stm)
 PHP_COM_DOTNET_API IStream *php_com_wrapper_export_stream(php_stream *stream)
 {
 	php_istream *stm = (php_istream*)CoTaskMemAlloc(sizeof(*stm));
-	zval *tmp;
 
 	if (stm == NULL)
 		return NULL;
@@ -280,8 +272,7 @@ PHP_COM_DOTNET_API IStream *php_com_wrapper_export_stream(php_stream *stream)
 	stm->stream = stream;
 
 	GC_ADDREF(stream->res);
-	tmp = zend_list_insert(stm, le_istream);
-	stm->res = Z_RES_P(tmp);
+	stm->res = zend_register_resource(stm, le_istream);
 
 	return (IStream*)stm;
 }
@@ -398,7 +389,7 @@ CPH_METHOD(SaveToFile)
 				RETURN_FALSE;
 			}
 
-			olefilename = php_com_string_to_olestring(filename, strlen(fullpath), helper->codepage);
+			olefilename = php_com_string_to_olestring(fullpath, strlen(fullpath), helper->codepage);
 			efree(fullpath);
 		}
 		res = IPersistFile_Save(helper->ipf, olefilename, remember);

ext/com_dotnet/com_typeinfo.c

@@ -436,6 +436,7 @@ int php_com_process_typeinfo(ITypeInfo *typeinfo, HashTable *id_to_name, int pri
 	char *ansiname = NULL;
 	size_t ansinamelen;
 	int ret = 0;
+	DISPID lastid = 0;	/* for props */
 
 	if (FAILED(ITypeInfo_GetTypeAttr(typeinfo, &attr))) {
 		return 0;
@@ -469,7 +470,6 @@ int php_com_process_typeinfo(ITypeInfo *typeinfo, HashTable *id_to_name, int pri
 		/* So we've got the dispatch interface; lets list the event methods */
 		for (i = 0; i < attr->cFuncs; i++) {
 			zval tmp;
-			DISPID lastid = 0;	/* for props */
 			int isprop;
 
 			if (FAILED(ITypeInfo_GetFuncDesc(typeinfo, i, &func)))
@@ -582,8 +582,8 @@ int php_com_process_typeinfo(ITypeInfo *typeinfo, HashTable *id_to_name, int pri
 					ZVAL_STRINGL(&tmp, ansiname, ansinamelen);
 					zend_hash_index_update(id_to_name, func->memid, &tmp);
 					// TODO: avoid reallocation???
-					efree(ansiname);
 				}
+				efree(ansiname);
 			}
 			ITypeInfo_ReleaseFuncDesc(typeinfo, func);
 		}

ext/com_dotnet/tests/bug66322.phpt

@@ -0,0 +1,24 @@
+--TEST--
+Bug #66322 (COMPersistHelper::SaveToFile can save to wrong location)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+try {
+    new COM('Word.Application');
+} catch (com_exception $ex) {
+    die('skip MS Word not available');
+}
+if (getenv("SKIP_SLOW_TESTS")) die('skip slow test');
+?>
+--FILE--
+<?php
+$w = new COM('Word.Application');
+$doc = $w->Documents->Add();
+$ph = new COMPersistHelper($doc);
+$filename = __DIR__ . '\\..\\' . basename(__DIR__) . '\\66322.docx';
+$ph->SaveToFile($filename);
+var_dump(file_exists($filename));
+$w->Quit();
+?>
+--EXPECT--
+bool(true)

ext/com_dotnet/tests/bug73679.phpt

@@ -2,7 +2,9 @@
 Bug #73679 DOTNET read access violation using invalid codepage
 --SKIPIF--
 <?php # vim:ft=php
-if (!extension_loaded("com_dotnet")) print "skip COM/.Net support not present"; ?>
+if (!extension_loaded("com_dotnet")) print "skip COM/.Net support not present";
+if (PHP_INT_SIZE != 8) die("skip this test is for 64bit platforms only");
+?>
 --FILE--
 <?php
 

ext/com_dotnet/tests/bug79242.phpt

@@ -0,0 +1,22 @@
+--TEST--
+Bug #79242 (COM error constants don't match com_exception codes)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+if (PHP_INT_SIZE != 4) die("skip this test is for 32bit platforms only");
+?>
+--FILE--
+<?php
+var_dump(
+    DISP_E_DIVBYZERO,
+    DISP_E_OVERFLOW,
+    DISP_E_BADINDEX,
+    MK_E_UNAVAILABLE
+);
+?>
+--EXPECT--
+int(-2147352558)
+int(-2147352566)
+int(-2147352565)
+int(-2147221021)
+

ext/com_dotnet/tests/bug79248.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug #79248 (Traversing empty VT_ARRAY throws com_exception)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+?>
+--FILE--
+<?php
+$v = new variant([], VT_ARRAY);
+foreach ($v as $el) {
+    var_dump($el);
+}
+echo "done\n";
+?>
+--EXPECT--
+done

ext/com_dotnet/tests/bug79299.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #79299 (com_print_typeinfo prints duplicate variables)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+?>
+--FILE--
+<?php
+$dict = new COM("Scripting.Dictionary");
+ob_start();
+com_print_typeinfo($dict);
+$typeinfo = ob_get_clean();
+preg_match_all('/\/\* DISPID=9 \*\//', $typeinfo, $matches);
+var_dump($matches[0]);
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  string(14) "/* DISPID=9 */"
+}

ext/com_dotnet/tests/bug79332.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug #79332 (php_istreams are never freed)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+?>
+--FILE--
+<?php
+$ph = new COMPersistHelper(null);
+try {
+    $ph->LoadFromStream(fopen(__FILE__, 'r'));
+} catch (com_exception $ex) {
+    // use hard-coded message to avoid localization issues
+    echo "A com_exception has been thrown\n";
+}
+?>
+--EXPECT--
+A com_exception has been thrown

ext/curl/interface.c

@@ -1452,6 +1452,10 @@ PHP_MINIT_FUNCTION(curl)
 	REGISTER_CURL_CONSTANT(CURLOPT_TLS13_CIPHERS);
 #endif
 
+#if LIBCURL_VERSION_NUM >= 0x074000 /* Available since 7.64.0 */
+	REGISTER_CURL_CONSTANT(CURLOPT_HTTP09_ALLOWED);
+#endif
+
 #if LIBCURL_VERSION_NUM >= 0x074001 /* Available since 7.64.1 */
 	REGISTER_CURL_CONSTANT(CURL_VERSION_ALTSVC);
 #endif
@@ -2163,8 +2167,6 @@ PHP_FUNCTION(curl_copy_handle)
 
 	_php_setup_easy_copy_handlers(dupch, ch);
 
-	Z_ADDREF_P(zid);
-
 	ZVAL_RES(return_value, zend_register_resource(dupch, le_curl));
 	dupch->res = Z_RES_P(return_value);
 }
@@ -2365,6 +2367,9 @@ static int _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue) /* {{{
 #endif
 #if LIBCURL_VERSION_NUM >= 0x073d00 /* Available since 7.61.0 */
 		case CURLOPT_DISALLOW_USERNAME_IN_URL:
+#endif
+#if LIBCURL_VERSION_NUM >= 0x074000 /* Available since 7.64.0 */
+		case CURLOPT_HTTP09_ALLOWED:
 #endif
 			lval = zval_get_long(zvalue);
 #if LIBCURL_VERSION_NUM >= 0x071304

ext/curl/multi.c

@@ -92,6 +92,8 @@ PHP_FUNCTION(curl_multi_add_handle)
 		RETURN_FALSE;
 	}
 
+	_php_curl_verify_handlers(ch, 1);
+
 	_php_curl_cleanup_handle(ch);
 
 	GC_ADDREF(Z_RES_P(z_ch));

ext/curl/tests/bug45161.phpt

@@ -2,12 +2,7 @@
 Bug #45161 (Reusing a curl handle leaks memory)
 --SKIPIF--
 <?php
-if (substr(PHP_OS, 0, 3) == 'WIN') {
-	exit("skip not for Windows");
-}
-if (!extension_loaded("curl")) {
-	exit("skip curl extension not loaded");
-}
+include 'skipif.inc';
 $curl_version = curl_version();
 if ($curl_version['version_number'] < 0x071100) {
 	exit("skip: test works only with curl >= 7.17.0");
@@ -15,10 +10,12 @@ if ($curl_version['version_number'] < 0x071100) {
 ?>
 --FILE--
 <?php
+include 'server.inc';
+$host = curl_cli_server_start();
 
 // Fill memory for test
 $ch = curl_init();
-$fp = fopen('/dev/null', 'w');
+$fp = fopen(PHP_OS_FAMILY === 'Windows' ? 'nul' : '/dev/null', 'w');
 
 /*
 $i = $start = $end = 100000.00;
@@ -32,7 +29,7 @@ for ($i = 0; $i < 100; $i++) {
 // Start actual test
 $start = memory_get_usage() + 1024;
 for($i = 0; $i < 1024; $i++) {
-	curl_setopt($ch, CURLOPT_URL, 'http://127.0.0.1:9/');
+	curl_setopt($ch, CURLOPT_URL, "{$host}/get.inc");
 	curl_setopt($ch, CURLOPT_FILE, $fp);
 	curl_exec($ch);
 }

ext/curl/tests/bug46739.phpt

@@ -2,13 +2,14 @@
 Bug #46739 (array returned by curl_getinfo should contain content_type key)
 --SKIPIF--
 <?php
-if (!extension_loaded("curl")) {
-	exit("skip curl extension not loaded");
-}
+include 'skipif.inc';
 ?>
 --FILE--
 <?php
-$ch = curl_init('http://127.0.0.1:9/');
+include 'server.inc';
+$host = curl_cli_server_start();
+$ch = curl_init("{$host}/get.inc");
+curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
 
 curl_exec($ch);
 $info = curl_getinfo($ch);

ext/curl/tests/bug48203_multi.phpt

@@ -67,25 +67,25 @@ foreach($options_to_check as $option) {
 --CLEAN--
 <?php @unlink(dirname(__FILE__) . '/bug48203.tmp'); ?>
 --EXPECTF--
-Warning: curl_multi_exec(): CURLOPT_STDERR resource has gone away, resetting to stderr in %s on line %d
-
-Warning: curl_multi_exec(): CURLOPT_STDERR resource has gone away, resetting to stderr in %s on line %d
+Warning: curl_multi_add_handle(): CURLOPT_STDERR resource has gone away, resetting to stderr in %s on line %d
+%A
+Warning: curl_multi_add_handle(): CURLOPT_STDERR resource has gone away, resetting to stderr in %s on line %d
 %A
 Ok for CURLOPT_STDERR
 
-Warning: curl_multi_exec(): CURLOPT_WRITEHEADER resource has gone away, resetting to default in %s on line %d
+Warning: curl_multi_add_handle(): CURLOPT_WRITEHEADER resource has gone away, resetting to default in %s on line %d
 
-Warning: curl_multi_exec(): CURLOPT_WRITEHEADER resource has gone away, resetting to default in %s on line %d
+Warning: curl_multi_add_handle(): CURLOPT_WRITEHEADER resource has gone away, resetting to default in %s on line %d
 Ok for CURLOPT_WRITEHEADER
 
-Warning: curl_multi_exec(): CURLOPT_FILE resource has gone away, resetting to default in %s on line %d
+Warning: curl_multi_add_handle(): CURLOPT_FILE resource has gone away, resetting to default in %s on line %d
 
-Warning: curl_multi_exec(): CURLOPT_FILE resource has gone away, resetting to default in %s on line %d
+Warning: curl_multi_add_handle(): CURLOPT_FILE resource has gone away, resetting to default in %s on line %d
 Hello World!
 Hello World!Hello World!
 Hello World!Ok for CURLOPT_FILE
 
-Warning: curl_multi_exec(): CURLOPT_INFILE resource has gone away, resetting to default in %s on line %d
+Warning: curl_multi_add_handle(): CURLOPT_INFILE resource has gone away, resetting to default in %s on line %d
 
-Warning: curl_multi_exec(): CURLOPT_INFILE resource has gone away, resetting to default in %s on line %d
+Warning: curl_multi_add_handle(): CURLOPT_INFILE resource has gone away, resetting to default in %s on line %d
 Ok for CURLOPT_INFILE

ext/curl/tests/bug79199.phpt

@@ -0,0 +1,24 @@
+--TEST--
+Bug #79199 (curl_copy_handle() memory leak)
+--SKIPIF--
+<?php
+if (!extension_loaded('curl')) die('skip curl extension not available');
+?>
+--FILE--
+<?php
+$mem_old = 0;
+for($i = 0; $i < 50; ++$i) {
+    $c1 = curl_init();
+    $c2 = curl_copy_handle($c1);
+    curl_close($c2);
+    curl_close($c1);
+    $mem_new = memory_get_usage();
+    if ($mem_new <= $mem_old) {
+        break;
+    }
+    $mem_old = $mem_new;
+}
+echo $i < 50 ? "okay" : "leak", PHP_EOL;
+?>
+--EXPECT--
+okay

ext/date/php_date.c

@@ -3297,6 +3297,7 @@ PHP_METHOD(DateTimeImmutable, modify)
 
 	date_clone_immutable(object, &new_object);
 	if (!php_date_modify(&new_object, modify, modify_len)) {
+		zval_ptr_dtor(&new_object);
 		RETURN_FALSE;
 	}
 
@@ -3561,6 +3562,7 @@ static void php_date_time_set(zval *object, zend_long h, zend_long i, zend_long
 	dateobj->time->s = s;
 	dateobj->time->us = ms;
 	timelib_update_ts(dateobj->time, NULL);
+	timelib_update_from_sse(dateobj->time);
 } /* }}} */
 
 /* {{{ proto DateTime date_time_set(DateTime object, int hour, int minute[, int second[, int microseconds]])

ext/date/tests/DateTimeImmutable_modify_invalid_format.phpt

@@ -0,0 +1,12 @@
+--TEST--
+DateTimeImmutable::modify() with invalid format
+--FILE--
+<?php
+
+$datetime = new DateTimeImmutable;
+var_dump($datetime->modify(''));
+
+?>
+--EXPECTF--
+Warning: DateTimeImmutable::modify(): Failed to parse time string () at position 0 ( in %s on line %d
+bool(false)

ext/date/tests/bug79396-forward-transition-settime.phpt

@@ -0,0 +1,24 @@
+--TEST--
+Test for setting Date/Time during a forward DST transition
+--FILE--
+<?php
+date_default_timezone_set('America/Chicago');
+
+$date = new DateTime('2020-03-08 01:30:00');
+echo $date->setTime(2, 0)->format('Y-m-d H:i:s T/e - U') . "\n";
+
+$date = new DateTime('2020-03-08 01:30:00');
+echo $date->setTime(2, 30)->format('Y-m-d H:i:s T/e - U') . "\n";
+
+$date = new DateTime('2020-03-08 01:30:00');
+echo $date->setTime(3, 0)->format('Y-m-d H:i:s T/e - U') . "\n";
+
+$date = new DateTime('2020-03-08 01:30:00');
+echo $date->setTime(1, 59, 59)->format('Y-m-d H:i:s T/e - U') . "\n";
+
+?>
+--EXPECT--
+2020-03-08 03:00:00 CDT/America/Chicago - 1583654400
+2020-03-08 03:30:00 CDT/America/Chicago - 1583656200
+2020-03-08 03:00:00 CDT/America/Chicago - 1583654400
+2020-03-08 01:59:59 CST/America/Chicago - 1583654399

ext/dom/document.c

@@ -339,7 +339,7 @@ int dom_document_encoding_write(dom_object *obj, zval *newval)
 
 	str = zval_get_string(newval);
 
-	handler = xmlFindCharEncodingHandler(Z_STRVAL_P(newval));
+	handler = xmlFindCharEncodingHandler(ZSTR_VAL(str));
 
     if (handler != NULL) {
 		xmlCharEncCloseFunc(handler);

ext/dom/node.c

@@ -428,13 +428,9 @@ int dom_node_child_nodes_read(dom_object *obj, zval *retval)
 		return FAILURE;
 	}
 
-	if (dom_node_children_valid(nodep) == FAILURE) {
-		ZVAL_NULL(retval);
-	} else {
-		php_dom_create_interator(retval, DOM_NODELIST);
-		intern = Z_DOMOBJ_P(retval);
-		dom_namednode_iter(obj, XML_ELEMENT_NODE, intern, NULL, NULL, NULL);
-	}
+	php_dom_create_interator(retval, DOM_NODELIST);
+	intern = Z_DOMOBJ_P(retval);
+	dom_namednode_iter(obj, XML_ELEMENT_NODE, intern, NULL, NULL, NULL);
 
 	return SUCCESS;
 }

ext/dom/tests/bug69846.phpt

@@ -50,7 +50,7 @@ object(DOMText)#%d (19) {
   ["parentNode"]=>
   NULL
   ["childNodes"]=>
-  NULL
+  string(22) "(object value omitted)"
   ["firstChild"]=>
   NULL
   ["lastChild"]=>
@@ -140,7 +140,7 @@ object(DOMText)#%d (19) {
   ["parentNode"]=>
   NULL
   ["childNodes"]=>
-  NULL
+  string(22) "(object value omitted)"
   ["firstChild"]=>
   NULL
   ["lastChild"]=>

ext/dom/tests/bug77569.phpt

@@ -0,0 +1,14 @@
+--TEST--
+Bug #77569 (Write Access Violation in DomImplementation)
+--SKIPIF--
+<?php
+if (!extension_loaded('dom')) die('skip dom extension not available');
+?>
+--FILE--
+<?php
+$imp = new DOMImplementation;
+$dom = $imp->createDocument("", "");
+$dom->encoding = null;
+?>
+--EXPECTF--
+Warning: main(): Invalid Document Encoding in %s on line %d

ext/dom/tests/bug79271.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Bug #79271 (DOMDocumentType::$childNodes is NULL)
+--SKIPIF--
+<?php
+if (!extension_loaded('dom')) die('skip dom extension not available');
+?>
+--FILE--
+<?php
+$dom = new DOMImplementation();
+$type = $dom->createDocumentType('html');
+var_dump($type->childNodes);
+?>
+--EXPECTF--
+object(DOMNodeList)#%d (1) {
+  ["length"]=>
+  int(0)
+}

ext/enchant/enchant.c

@@ -723,18 +723,16 @@ PHP_FUNCTION(enchant_dict_quick_check)
 	PHP_ENCHANT_GET_DICT;
 
 	if (enchant_dict_check(pdict->pdict, word, wordlen) > 0) {
-		int n_sugg;
-		size_t n_sugg_st;
+		size_t n_sugg;
 		char **suggs;
 
 		if (!sugg && ZEND_NUM_ARGS() == 2) {
 			RETURN_FALSE;
 		}
 
-		suggs = enchant_dict_suggest(pdict->pdict, word, wordlen, &n_sugg_st);
-		memcpy(&n_sugg, &n_sugg_st, sizeof(n_sugg));
+		suggs = enchant_dict_suggest(pdict->pdict, word, wordlen, &n_sugg);
 		if (suggs && n_sugg) {
-			int i;
+			size_t i;
 			for (i = 0; i < n_sugg; i++) {
 				add_next_index_string(sugg, suggs[i]);
 			}
@@ -776,8 +774,7 @@ PHP_FUNCTION(enchant_dict_suggest)
 	size_t wordlen;
 	char **suggs;
 	enchant_dict *pdict;
-	int n_sugg;
-	size_t n_sugg_st;
+	size_t n_sugg;
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "rs", &dict, &word, &wordlen) == FAILURE) {
 		RETURN_FALSE;
@@ -785,10 +782,9 @@ PHP_FUNCTION(enchant_dict_suggest)
 
 	PHP_ENCHANT_GET_DICT;
 
-	suggs = enchant_dict_suggest(pdict->pdict, word, wordlen, &n_sugg_st);
-	memcpy(&n_sugg, &n_sugg_st, sizeof(n_sugg));
+	suggs = enchant_dict_suggest(pdict->pdict, word, wordlen, &n_sugg);
 	if (suggs && n_sugg) {
-		int i;
+		size_t i;
 
 		array_init(return_value);
 		for (i = 0; i < n_sugg; i++) {

ext/exif/exif.c

@@ -3665,6 +3665,11 @@ static void exif_process_TIFF_in_JPEG(image_info_type *ImageInfo, char *CharBuf,
 {
 	unsigned exif_value_2a, offset_of_ifd;
 
+	if (length < 2) {
+		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Missing TIFF alignment marker");
+		return;
+	}
+
 	/* set the thumbnail stuff to nothing so we can test to see if they get set up */
 	if (memcmp(CharBuf, "II", 2) == 0) {
 		ImageInfo->motorola_intel = 0;
@@ -3817,7 +3822,7 @@ static int exif_scan_JPEG_header(image_info_type *ImageInfo)
 			return FALSE;
 		}
 
-		sn = exif_file_sections_add(ImageInfo, marker, itemlen+1, NULL);
+		sn = exif_file_sections_add(ImageInfo, marker, itemlen, NULL);
 		Data = ImageInfo->file.list[sn].data;
 
 		/* Store first two pre-read bytes. */

ext/exif/tests/bug79282.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Bug #79282: Use-of-uninitialized-value in exif
+--FILE--
+<?php
+
+var_dump(exif_read_data('data://image/jpeg;base64,/9jhAAlFeGlmAAAg'));
+
+?>
+--EXPECTF--
+Warning: exif_read_data(): Missing TIFF alignment marker in %s on line %d
+
+Warning: exif_read_data(): File structure corrupted in %s on line %d
+
+Warning: exif_read_data(): Invalid JPEG file in %s on line %d
+bool(false)

ext/fileinfo/generate_patch.sh

@@ -0,0 +1,8 @@
+VERSION=5.33
+if [[ ! -d libmagic.orig ]]; then
+  mkdir libmagic.orig
+  wget -O - ftp://ftp.astron.com/pub/file/file-$VERSION.tar.gz \
+    | tar -xz --strip-components=2 -C libmagic.orig file-$VERSION/src
+fi
+sed -e "s/X\.YY/${VERSION//.}/g" libmagic.orig/magic.h.in > libmagic.orig/magic.h
+diff -u libmagic.orig libmagic | grep -v '^Only in' > libmagic.patch

ext/fileinfo/libmagic.patch

@@ -1,6 +1,6 @@
 diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 --- libmagic.orig/apprentice.c	2018-03-11 01:46:42.000000000 +0100
-+++ libmagic/apprentice.c	2018-11-05 00:16:58.812821826 +0100
++++ libmagic/apprentice.c	2020-02-26 09:55:13.842042400 +0100
 @@ -2,7 +2,7 @@
   * Copyright (c) Ian F. Darwin 1986-1995.
   * Software written by Ian F. Darwin and others;
@@ -1245,7 +1245,7 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  	switch (m->str_flags & PSTRING_LEN) {
 diff -u libmagic.orig/apptype.c libmagic/apptype.c
 --- libmagic.orig/apptype.c	2011-09-07 23:57:15.000000000 +0200
-+++ libmagic/apptype.c	2018-08-10 11:46:29.210671445 +0200
++++ libmagic/apptype.c	2020-02-26 09:55:13.843047200 +0100
 @@ -1,15 +1,15 @@
  /*
   * Adapted from: apptype.c, Written by Eberhard Mattes and put into the
@@ -1280,7 +1280,7 @@ diff -u libmagic.orig/apptype.c libmagic/apptype.c
  #include "file.h"
 diff -u libmagic.orig/ascmagic.c libmagic/ascmagic.c
 --- libmagic.orig/ascmagic.c	2017-11-02 21:25:39.000000000 +0100
-+++ libmagic/ascmagic.c	2018-08-10 11:46:29.210671445 +0200
++++ libmagic/ascmagic.c	2020-02-26 09:55:13.845043300 +0100
 @@ -90,7 +90,7 @@
  		rv = file_ascmagic_with_encoding(ms, &bb,
  		    ubuf, ulen, code, type, text);
@@ -1311,7 +1311,7 @@ diff -u libmagic.orig/ascmagic.c libmagic/ascmagic.c
  }
 diff -u libmagic.orig/buffer.c libmagic/buffer.c
 --- libmagic.orig/buffer.c	2018-03-11 01:46:42.000000000 +0100
-+++ libmagic/buffer.c	2018-08-10 11:46:29.210671445 +0200
++++ libmagic/buffer.c	2020-02-26 09:55:13.846042600 +0100
 @@ -31,7 +31,11 @@
  #endif	/* lint */
  
@@ -1362,7 +1362,7 @@ diff -u libmagic.orig/buffer.c libmagic/buffer.c
  
 diff -u libmagic.orig/cdf.c libmagic/cdf.c
 --- libmagic.orig/cdf.c	2018-03-11 01:46:42.000000000 +0100
-+++ libmagic/cdf.c	2018-08-10 11:46:29.214671395 +0200
++++ libmagic/cdf.c	2020-02-26 09:55:13.847043900 +0100
 @@ -43,7 +43,17 @@
  #include <err.h>
  #endif
@@ -1564,7 +1564,28 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
  	*maxcount = 0;
  	*info = NULL;
  	return NULL;
-@@ -1092,7 +1078,7 @@
+@@ -1003,8 +989,9 @@
+ 				goto out;
+ 			}
+ 			nelements = CDF_GETUINT32(q, 1);
+-			if (nelements == 0) {
+-				DPRINTF(("CDF_VECTOR with nelements == 0\n"));
++			if (nelements > CDF_ELEMENT_LIMIT || nelements == 0) {
++				DPRINTF(("CDF_VECTOR with nelements == %"
++				    SIZE_T_FORMAT "u\n", nelements));
+ 				goto out;
+ 			}
+ 			slen = 2;
+@@ -1046,8 +1033,6 @@
+ 					goto out;
+ 				inp += nelem;
+ 			}
+-			DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n",
+-			    nelements));
+ 			for (j = 0; j < nelements && i < sh.sh_properties;
+ 			    j++, i++)
+ 			{
+@@ -1092,7 +1077,7 @@
  	}
  	return 0;
  out:
@@ -1573,7 +1594,7 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
  	*info = NULL;
  	*count = 0;
  	*maxcount = 0;
-@@ -1383,7 +1369,7 @@
+@@ -1383,7 +1368,7 @@
  	cdf_directory_t *d;
  	char name[__arraycount(d->d_name)];
  	cdf_stream_t scn;
@@ -1582,7 +1603,7 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
  
  	static const char *types[] = { "empty", "user storage",
  	    "user stream", "lockbytes", "property", "root storage" };
-@@ -1425,7 +1411,7 @@
+@@ -1425,7 +1410,7 @@
  				break;
  			}
  			cdf_dump_stream(&scn);
@@ -1591,7 +1612,7 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
  			break;
  		default:
  			break;
-@@ -1438,7 +1424,7 @@
+@@ -1438,7 +1423,7 @@
  cdf_dump_property_info(const cdf_property_info_t *info, size_t count)
  {
  	cdf_timestamp_t tp;
@@ -1600,7 +1621,7 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
  	char buf[64];
  	size_t i, j;
  
-@@ -1523,7 +1509,7 @@
+@@ -1523,7 +1508,7 @@
  	(void)fprintf(stderr, "Class %s\n", buf);
  	(void)fprintf(stderr, "Count %d\n", ssi.si_count);
  	cdf_dump_property_info(info, count);
@@ -1609,7 +1630,7 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
  }
  
  
-@@ -1544,7 +1530,7 @@
+@@ -1544,7 +1529,7 @@
  		    cdf_u16tos8(sbuf, ce[i].ce_namlen, ce[i].ce_name),
  		    cdf_ctime(&ts.tv_sec, tbuf));
  	}
@@ -1620,7 +1641,7 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
  #endif
 diff -u libmagic.orig/cdf.h libmagic/cdf.h
 --- libmagic.orig/cdf.h	2017-03-09 17:57:17.000000000 +0100
-+++ libmagic/cdf.h	2018-08-10 11:46:29.214671395 +0200
++++ libmagic/cdf.h	2020-02-26 09:55:13.848043100 +0100
 @@ -35,10 +35,10 @@
  #ifndef _H_CDF_
  #define _H_CDF_
@@ -1635,7 +1656,15 @@ diff -u libmagic.orig/cdf.h libmagic/cdf.h
  #endif
  #ifdef __DJGPP__
  #define timespec timeval
-@@ -272,7 +272,7 @@
+@@ -48,6 +48,7 @@
+ typedef int32_t cdf_secid_t;
+ 
+ #define CDF_LOOP_LIMIT					10000
++#define CDF_ELEMENT_LIMIT				100000
+ 
+ #define CDF_SECID_NULL					0
+ #define CDF_SECID_FREE					-1
+@@ -272,7 +273,7 @@
  typedef struct {
  	uint16_t ce_namlen;
  	uint32_t ce_num;
@@ -1646,7 +1675,7 @@ diff -u libmagic.orig/cdf.h libmagic/cdf.h
  
 diff -u libmagic.orig/cdf_time.c libmagic/cdf_time.c
 --- libmagic.orig/cdf_time.c	2017-03-29 17:57:48.000000000 +0200
-+++ libmagic/cdf_time.c	2019-03-08 21:00:46.636733574 +0100
++++ libmagic/cdf_time.c	2020-02-26 09:55:13.849044200 +0100
 @@ -23,6 +23,7 @@
   * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
   * POSSIBILITY OF SUCH DAMAGE.
@@ -1693,7 +1722,7 @@ diff -u libmagic.orig/cdf_time.c libmagic/cdf_time.c
  	(void)snprintf(buf, 26, "*Bad* %#16.16" INT64_T_FORMAT "x\n",
 diff -u libmagic.orig/compress.c libmagic/compress.c
 --- libmagic.orig/compress.c	2017-11-02 21:25:39.000000000 +0100
-+++ libmagic/compress.c	2018-08-10 11:46:29.214671395 +0200
++++ libmagic/compress.c	2020-02-26 09:55:13.850043300 +0100
 @@ -2,7 +2,7 @@
   * Copyright (c) Ian F. Darwin 1986-1995.
   * Software written by Ian F. Darwin and others;
@@ -1994,7 +2023,7 @@ diff -u libmagic.orig/compress.c libmagic/compress.c
 +#endif /* if PHP_FILEINFO_UNCOMPRESS */
 diff -u libmagic.orig/der.c libmagic/der.c
 --- libmagic.orig/der.c	2017-02-10 19:14:01.000000000 +0100
-+++ libmagic/der.c	2018-08-10 11:46:29.214671395 +0200
++++ libmagic/der.c	2020-02-26 09:55:13.851044000 +0100
 @@ -51,7 +51,9 @@
  #include "magic.h"
  #include "der.h"
@@ -2051,7 +2080,7 @@ diff -u libmagic.orig/der.c libmagic/der.c
  		    der_tag(buf, sizeof(buf), tag), len);
 diff -u libmagic.orig/elfclass.h libmagic/elfclass.h
 --- libmagic.orig/elfclass.h	2014-12-17 00:18:40.000000000 +0100
-+++ libmagic/elfclass.h	2018-08-10 11:46:29.214671395 +0200
++++ libmagic/elfclass.h	2020-02-26 09:55:13.852043400 +0100
 @@ -1,7 +1,7 @@
  /*
   * Copyright (c) Christos Zoulas 2008.
@@ -2099,7 +2128,7 @@ diff -u libmagic.orig/elfclass.h libmagic/elfclass.h
  		    (int)elf_getu16(swap, elfhdr.e_shstrndx),
 diff -u libmagic.orig/encoding.c libmagic/encoding.c
 --- libmagic.orig/encoding.c	2017-11-02 21:25:39.000000000 +0100
-+++ libmagic/encoding.c	2018-08-10 11:46:29.214671395 +0200
++++ libmagic/encoding.c	2020-02-26 09:55:13.854045100 +0100
 @@ -88,12 +88,12 @@
  	*code_mime = "binary";
  
@@ -2129,7 +2158,7 @@ diff -u libmagic.orig/encoding.c libmagic/encoding.c
  }
 diff -u libmagic.orig/file.h libmagic/file.h
 --- libmagic.orig/file.h	2018-03-11 01:46:42.000000000 +0100
-+++ libmagic/file.h	2018-11-05 21:31:59.339653700 +0100
++++ libmagic/file.h	2020-02-26 09:55:13.856043400 +0100
 @@ -27,21 +27,15 @@
   */
  /*
@@ -2416,7 +2445,7 @@ diff -u libmagic.orig/file.h libmagic/file.h
  #endif
 diff -u libmagic.orig/fsmagic.c libmagic/fsmagic.c
 --- libmagic.orig/fsmagic.c	2017-05-24 21:17:50.000000000 +0200
-+++ libmagic/fsmagic.c	2018-08-10 11:46:29.214671395 +0200
++++ libmagic/fsmagic.c	2020-02-26 09:55:13.857043000 +0100
 @@ -2,7 +2,7 @@
   * Copyright (c) Ian F. Darwin 1986-1995.
   * Software written by Ian F. Darwin and others;
@@ -2777,7 +2806,7 @@ diff -u libmagic.orig/fsmagic.c libmagic/fsmagic.c
  	case S_IFSOCK:
 diff -u libmagic.orig/funcs.c libmagic/funcs.c
 --- libmagic.orig/funcs.c	2017-11-02 21:25:39.000000000 +0100
-+++ libmagic/funcs.c	2018-11-05 21:31:59.339653700 +0100
++++ libmagic/funcs.c	2020-02-26 09:55:13.859042500 +0100
 @@ -31,7 +31,6 @@
  #endif	/* lint */
  
@@ -3025,7 +3054,7 @@ diff -u libmagic.orig/funcs.c libmagic/funcs.c
  		if (ms->c.li == NULL) {
  			file_oomem(ms, len);
  			return -1;
-@@ -464,76 +470,41 @@
+@@ -464,76 +470,38 @@
  protected int
  file_replace(struct magic_set *ms, const char *pat, const char *rep)
  {
@@ -3053,11 +3082,9 @@ diff -u libmagic.orig/funcs.c libmagic/funcs.c
 +	zend_string *repl;
 +	size_t rep_cnt = 0;
 +
-+	(void)setlocale(LC_CTYPE, "C");
-+
 +	opts |= PCRE2_MULTILINE;
 +	convert_libmagic_pattern(&patt, (char*)pat, strlen(pat), opts);
-+	if ((pce = pcre_get_compiled_regex_cache(Z_STR(patt))) == NULL) {
++	if ((pce = pcre_get_compiled_regex_cache_ex(Z_STR(patt), 0)) == NULL) {
 +		zval_ptr_dtor(&patt);
 +		rep_cnt = -1;
 +		goto out;
@@ -3126,12 +3153,11 @@ diff -u libmagic.orig/funcs.c libmagic/funcs.c
 -	file_magerror(ms, "regex error %d for `%s', (%s)", rc, rx->pat,
 -	    errmsg);
 +out:
-+	(void)setlocale(LC_CTYPE, "");
 +	return rep_cnt;
  }
  
  protected file_pushbuf_t *
-@@ -544,7 +515,7 @@
+@@ -544,7 +512,7 @@
  	if (ms->event_flags & EVENT_HAD_ERR)
  		return NULL;
  
@@ -3140,7 +3166,7 @@ diff -u libmagic.orig/funcs.c libmagic/funcs.c
  		return NULL;
  
  	pb->buf = ms->o.buf;
-@@ -562,8 +533,8 @@
+@@ -562,8 +530,8 @@
  	char *rbuf;
  
  	if (ms->event_flags & EVENT_HAD_ERR) {
@@ -3151,7 +3177,7 @@ diff -u libmagic.orig/funcs.c libmagic/funcs.c
  		return NULL;
  	}
  
-@@ -572,7 +543,7 @@
+@@ -572,7 +540,7 @@
  	ms->o.buf = pb->buf;
  	ms->offset = pb->offset;
  
@@ -3162,7 +3188,7 @@ diff -u libmagic.orig/funcs.c libmagic/funcs.c
  
 diff -u libmagic.orig/magic.c libmagic/magic.c
 --- libmagic.orig/magic.c	2017-08-28 15:39:18.000000000 +0200
-+++ libmagic/magic.c	2018-08-10 11:46:29.214671395 +0200
++++ libmagic/magic.c	2020-02-26 09:55:13.861044300 +0100
 @@ -25,11 +25,6 @@
   * SUCH DAMAGE.
   */
@@ -3638,8 +3664,8 @@ diff -u libmagic.orig/magic.c libmagic/magic.c
  public const char *
  magic_error(struct magic_set *ms)
 diff -u libmagic.orig/magic.h libmagic/magic.h
---- libmagic.orig/magic.h	2018-11-13 21:40:06.272616270 +0100
-+++ libmagic/magic.h	2018-08-10 11:46:29.214671395 +0200
+--- libmagic.orig/magic.h	2020-02-26 09:56:58.945274100 +0100
++++ libmagic/magic.h	2020-02-26 09:55:13.862044300 +0100
 @@ -122,6 +122,7 @@
  
  const char *magic_getpath(const char *, int);
@@ -3650,7 +3676,7 @@ diff -u libmagic.orig/magic.h libmagic/magic.h
  
 diff -u libmagic.orig/print.c libmagic/print.c
 --- libmagic.orig/print.c	2017-02-10 19:14:01.000000000 +0100
-+++ libmagic/print.c	2019-03-08 21:00:46.636733574 +0100
++++ libmagic/print.c	2020-02-26 09:55:13.864043900 +0100
 @@ -2,7 +2,7 @@
   * Copyright (c) Ian F. Darwin 1986-1995.
   * Software written by Ian F. Darwin and others;
@@ -3733,7 +3759,7 @@ diff -u libmagic.orig/print.c libmagic/print.c
  		goto out;
 diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
 --- libmagic.orig/readcdf.c	2017-11-02 21:25:39.000000000 +0100
-+++ libmagic/readcdf.c	2018-08-10 11:46:29.214671395 +0200
++++ libmagic/readcdf.c	2020-02-26 09:55:13.865044100 +0100
 @@ -31,7 +31,11 @@
  
  #include <assert.h>
@@ -3757,12 +3783,13 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
  	return NULL;
  }
  
-@@ -116,30 +116,14 @@
+@@ -116,30 +116,24 @@
  {
  	size_t i;
  	const char *rv = NULL;
 -#ifdef USE_C_LOCALE
 -	locale_t old_lc_ctype, c_lc_ctype;
++	char *vbuf_lower;
  
 -	c_lc_ctype = newlocale(LC_CTYPE_MASK, "C", 0);
 -	assert(c_lc_ctype != NULL);
@@ -3771,9 +3798,18 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
 -#else
 -	char *old_lc_ctype = setlocale(LC_CTYPE, "C");
 -#endif
-+	(void)setlocale(LC_CTYPE, "C");
- 	for (i = 0; nv[i].pattern != NULL; i++)
- 		if (strcasestr(vbuf, nv[i].pattern) != NULL) {
+-	for (i = 0; nv[i].pattern != NULL; i++)
+-		if (strcasestr(vbuf, nv[i].pattern) != NULL) {
++	vbuf_lower = zend_str_tolower_dup(vbuf, strlen(vbuf));
++	for (i = 0; nv[i].pattern != NULL; i++) {
++		char *pattern_lower;
++		int found;
++
++		pattern_lower = zend_str_tolower_dup(nv[i].pattern, strlen(nv[i].pattern));
++		found = (strstr(vbuf_lower, pattern_lower) != NULL);
++		efree(pattern_lower);
++
++		if (found) {
  			rv = nv[i].mime;
  			break;
  		}
@@ -3786,11 +3822,13 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
 -#else
 -	setlocale(LC_CTYPE, old_lc_ctype);
 -#endif
-+	(void)setlocale(LC_CTYPE, "");
++	}
++
++	efree(vbuf_lower);
  	return rv;
  }
  
-@@ -155,6 +139,8 @@
+@@ -155,6 +149,8 @@
          const char *s, *e;
          int len;
  
@@ -3799,7 +3837,7 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
          if (!NOTMIME(ms) && root_storage)
  		str = cdf_clsid_to_mime(root_storage->d_storage_uuid,
  		    clsid2mime);
-@@ -281,10 +267,10 @@
+@@ -281,10 +277,10 @@
  			if (file_printf(ms, "%s%s",
  			    cdf_u16tos8(buf, ce[i].ce_namlen, ce[i].ce_name),
  			    i == cat->cat_num - 1 ? "]" : ", ") == -1) {
@@ -3812,7 +3850,7 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
  	} else {
  		if (file_printf(ms, "application/CDFV2") == -1)
  			return -1;
-@@ -345,7 +331,7 @@
+@@ -345,7 +341,7 @@
  	}
  
          m = cdf_file_property_info(ms, info, count, root_storage);
@@ -3821,7 +3859,7 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
  
          return m == -1 ? -2 : m;
  }
-@@ -353,11 +339,11 @@
+@@ -353,11 +349,11 @@
  #ifdef notdef
  private char *
  format_clsid(char *buf, size_t len, const uint64_t uuid[2]) {
@@ -3835,7 +3873,7 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
  	    (uuid[1] >> 48) & (uint64_t)0x0000000000000ffffULL,
  	    (uuid[1] >>  0) & (uint64_t)0x0000fffffffffffffULL);
  	return buf;
-@@ -436,7 +422,7 @@
+@@ -436,7 +432,7 @@
  	const char *sections[5];
  	const int  types[5];
  } sectioninfo[] = {
@@ -3844,7 +3882,7 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
  		{
  			"EncryptedPackage", "EncryptedSummary",
  			NULL, NULL, NULL,
-@@ -448,7 +434,7 @@
+@@ -448,7 +444,7 @@
  
  		},
  	},
@@ -3853,7 +3891,7 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
  		{
  #if 0
  			"TaxForms", "PDFTaxForms", "modulesInBackup",
-@@ -655,11 +641,11 @@
+@@ -655,11 +651,11 @@
  	cdf_zero_stream(&scn);
  	cdf_zero_stream(&sst);
  out3:
@@ -3870,7 +3908,7 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
  	    if (NOTMIME(ms)) {
 diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 --- libmagic.orig/softmagic.c	2018-04-15 20:49:15.000000000 +0200
-+++ libmagic/softmagic.c	2018-11-11 21:42:27.860274508 +0100
++++ libmagic/softmagic.c	2020-02-26 09:55:13.866043500 +0100
 @@ -43,6 +43,10 @@
  #include <time.h>
  #include "der.h"
@@ -3914,14 +3952,13 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  #define FLT (STRING_BINTEST | STRING_TEXTTEST)
  		     ((text && (m->str_flags & FLT) == STRING_BINTEST) ||
  		      (!text && (m->str_flags & FLT) == STRING_TEXTTEST))) ||
-@@ -416,42 +422,30 @@
+@@ -416,42 +422,28 @@
  private int
  check_fmt(struct magic_set *ms, const char *fmt)
  {
 -	file_regex_t rx;
 -	int rc, rv = -1;
-+	pcre2_code *pce;
-+	uint32_t re_options, capture_count;
++	pcre_cache_entry *pce;
 +	int rv = -1;
 +	zend_string *pattern;
  
@@ -3931,22 +3968,21 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 -	rc = file_regcomp(&rx, "%[-0-9\\.]*s", REG_EXTENDED|REG_NOSUB);
 -	if (rc) {
 -		file_regerror(&rx, rc, ms);
-+	(void)setlocale(LC_CTYPE, "C");
 +	pattern = zend_string_init("~%[-0-9\\.]*s~", sizeof("~%[-0-9\\.]*s~") - 1, 0);
-+	if ((pce = pcre_get_compiled_regex(pattern, &capture_count, &re_options)) == NULL) {
++	if ((pce = pcre_get_compiled_regex_cache_ex(pattern, 0)) == NULL) {
 +		rv = -1;
  	} else {
 -		rc = file_regexec(&rx, fmt, 0, 0, 0);
 -		rv = !rc;
-+		pcre2_match_data *match_data = php_pcre_create_match_data(capture_count, pce);
++		pcre2_code *re = php_pcre_pce_re(pce);
++		pcre2_match_data *match_data = php_pcre_create_match_data(0, re);
 +		if (match_data) {
-+			rv = pcre2_match(pce, (PCRE2_SPTR)fmt, strlen(fmt), 0, re_options, match_data, php_pcre_mctx()) > 0;
++			rv = pcre2_match(re, (PCRE2_SPTR)fmt, strlen(fmt), 0, 0, match_data, php_pcre_mctx()) > 0;
 +			php_pcre_free_match_data(match_data);
 +		}
  	}
 -	file_regfree(&rx);
-+	zend_string_release_ex(pattern, 0);
-+	(void)setlocale(LC_CTYPE, "");
++	zend_string_release(pattern);
  	return rv;
  }
  
@@ -3972,7 +4008,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  static int
  varexpand(char *buf, size_t len, const struct buffer *b, const char *str)
  {
-@@ -743,14 +737,10 @@
+@@ -743,14 +735,10 @@
  		char *cp;
  		int rval;
  
@@ -3989,7 +4025,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  
  		if (rval == -1)
  			return -1;
-@@ -1135,7 +1125,7 @@
+@@ -1135,7 +1123,7 @@
  			 * string by p->s, so we need to deduct sz.
  			 * Because we can use one of the bytes of the length
  			 * after we shifted as NUL termination.
@@ -3998,7 +4034,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  			len = sz;
  		}
  		while (len--)
-@@ -1209,7 +1199,7 @@
+@@ -1209,7 +1197,7 @@
  			goto out;
  		return 1;
  	case FILE_BEDOUBLE:
@@ -4007,7 +4043,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  		if (cvt_double(p, m) == -1)
  			goto out;
  		return 1;
-@@ -1481,8 +1471,6 @@
+@@ -1481,8 +1469,6 @@
  		return -1;
  	}
  
@@ -4016,7 +4052,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  	if (mcopy(ms, p, m->type, m->flag & INDIR, s, (uint32_t)(offset + o),
  	    (uint32_t)nbytes, m) == -1)
  		return -1;
-@@ -1494,9 +1482,6 @@
+@@ -1494,9 +1480,6 @@
  		    m->type, m->flag, offset, o, nbytes,
  		    *indir_count, *name_count);
  		mdebug(offset, (char *)(void *)p, sizeof(union VALUETYPE));
@@ -4026,7 +4062,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  	}
  
  	if (m->flag & INDIR) {
-@@ -1609,9 +1594,6 @@
+@@ -1609,9 +1592,6 @@
  		if ((ms->flags & MAGIC_DEBUG) != 0) {
  			mdebug(offset, (char *)(void *)p,
  			    sizeof(union VALUETYPE));
@@ -4036,7 +4072,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  		}
  	}
  
-@@ -1696,15 +1678,15 @@
+@@ -1696,15 +1676,15 @@
  		if (rv == 1) {
  			if ((ms->flags & MAGIC_NODESC) == 0 &&
  			    file_printf(ms, F(ms, m->desc, "%u"), offset) == -1) {
@@ -4055,7 +4091,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  		return rv;
  
  	case FILE_USE:
-@@ -1827,6 +1809,41 @@
+@@ -1827,6 +1807,41 @@
  	return file_strncmp(a, b, len, flags);
  }
  
@@ -4097,7 +4133,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  private int
  magiccheck(struct magic_set *ms, struct magic *m)
  {
-@@ -1987,65 +2004,77 @@
+@@ -1987,65 +2002,77 @@
  		break;
  	}
  	case FILE_REGEX: {
@@ -4229,7 +4265,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  	case FILE_INDIRECT:
 diff -u libmagic.orig/strcasestr.c libmagic/strcasestr.c
 --- libmagic.orig/strcasestr.c	2014-05-13 18:48:12.000000000 +0200
-+++ libmagic/strcasestr.c	2018-08-10 11:46:29.214671395 +0200
++++ libmagic/strcasestr.c	2019-04-02 11:56:06.853152400 +0200
 @@ -39,6 +39,8 @@
  
  #include "file.h"

ext/iconv/iconv.c

@@ -739,6 +739,7 @@ static php_iconv_err_t _php_iconv_strlen(size_t *pretval, const char *str, size_
 	size_t out_left;
 
 	size_t cnt;
+	int more;
 
 	*pretval = (size_t)-1;
 
@@ -758,25 +759,23 @@ static php_iconv_err_t _php_iconv_strlen(size_t *pretval, const char *str, size_
 
 	errno = 0;
 	out_left = 0;
+	more = nbytes > 0;
 
-	for (in_p = str, in_left = nbytes, cnt = 0; in_left > 0; cnt+=2) {
-		size_t prev_in_left;
+	for (in_p = str, in_left = nbytes, cnt = 0; more;) {
 		out_p = buf;
 		out_left = sizeof(buf);
 
-		prev_in_left = in_left;
+		more = in_left > 0;
 
-		if (iconv(cd, (char **)&in_p, &in_left, (char **) &out_p, &out_left) == (size_t)-1) {
-			if (prev_in_left == in_left) {
-				break;
-			}
+		iconv(cd, more ? (char **)&in_p : NULL, more ? &in_left : NULL, (char **) &out_p, &out_left);
+		if (out_left == sizeof(buf)) {
+			break;
+		} else {
+			ZEND_ASSERT((sizeof(buf) - out_left) % GENERIC_SUPERSET_NBYTES == 0);
+			cnt += (sizeof(buf) - out_left) / GENERIC_SUPERSET_NBYTES;
 		}
 	}
 
-	if (out_left > 0) {
-		cnt -= out_left / GENERIC_SUPERSET_NBYTES;
-	}
-
 #if ICONV_SUPPORTS_ERRNO
 	switch (errno) {
 		case EINVAL:
@@ -825,6 +824,7 @@ static php_iconv_err_t _php_iconv_substr(smart_str *pretval,
 
 	size_t cnt;
 	size_t total_len;
+	int more;
 
 	err = _php_iconv_strlen(&total_len, str, nbytes, enc);
 	if (err != PHP_ICONV_ERR_SUCCESS) {
@@ -879,18 +879,17 @@ static php_iconv_err_t _php_iconv_substr(smart_str *pretval,
 
 	cd2 = (iconv_t)NULL;
 	errno = 0;
+	more = nbytes > 0 && len > 0;
 
-	for (in_p = str, in_left = nbytes, cnt = 0; in_left > 0 && len > 0; ++cnt) {
-		size_t prev_in_left;
+	for (in_p = str, in_left = nbytes, cnt = 0; more; ++cnt) {
 		out_p = buf;
 		out_left = sizeof(buf);
 
-		prev_in_left = in_left;
+		more = in_left > 0 && len > 0;
 
-		if (iconv(cd1, (char **)&in_p, &in_left, (char **) &out_p, &out_left) == (size_t)-1) {
-			if (prev_in_left == in_left) {
-				break;
-			}
+		iconv(cd1, more ? (char **)&in_p : NULL, more ? &in_left : NULL, (char **) &out_p, &out_left);
+		if (out_left == sizeof(buf)) {
+			break;
 		}
 
 		if ((zend_long)cnt >= offset) {
@@ -978,6 +977,8 @@ static php_iconv_err_t _php_iconv_strpos(size_t *pretval,
 	size_t ndl_buf_left;
 
 	size_t match_ofs;
+	int more;
+	size_t iconv_ret;
 
 	*pretval = (size_t)-1;
 
@@ -1010,37 +1011,38 @@ static php_iconv_err_t _php_iconv_strpos(size_t *pretval,
 	ndl_buf_p = ZSTR_VAL(ndl_buf);
 	ndl_buf_left = ZSTR_LEN(ndl_buf);
 	match_ofs = (size_t)-1;
+	more = haystk_nbytes > 0;
 
-	for (in_p = haystk, in_left = haystk_nbytes, cnt = 0; in_left > 0; ++cnt) {
-		size_t prev_in_left;
+	for (in_p = haystk, in_left = haystk_nbytes, cnt = 0; more; ++cnt) {
 		out_p = buf;
 		out_left = sizeof(buf);
 
-		prev_in_left = in_left;
+		more = in_left > 0;
 
-		if (iconv(cd, (char **)&in_p, &in_left, (char **) &out_p, &out_left) == (size_t)-1) {
-			if (prev_in_left == in_left) {
+		iconv_ret = iconv(cd, more ? (char **)&in_p : NULL, more ? &in_left : NULL, (char **) &out_p, &out_left);
+		if (out_left == sizeof(buf)) {
+			break;
+		}
 #if ICONV_SUPPORTS_ERRNO
-				switch (errno) {
-					case EINVAL:
-						err = PHP_ICONV_ERR_ILLEGAL_CHAR;
-						break;
+		if (iconv_ret == (size_t)-1) {
+			switch (errno) {
+				case EINVAL:
+					err = PHP_ICONV_ERR_ILLEGAL_CHAR;
+					break;
 
-					case EILSEQ:
-						err = PHP_ICONV_ERR_ILLEGAL_SEQ;
-						break;
+				case EILSEQ:
+					err = PHP_ICONV_ERR_ILLEGAL_SEQ;
+					break;
 
-					case E2BIG:
-						break;
+				case E2BIG:
+					break;
 
-					default:
-						err = PHP_ICONV_ERR_UNKNOWN;
-						break;
-				}
-#endif
-				break;
+				default:
+					err = PHP_ICONV_ERR_UNKNOWN;
+					break;
 			}
 		}
+#endif
 		if (offset >= 0) {
 			if (cnt >= (size_t)offset) {
 				if (_php_iconv_memequal(buf, ndl_buf_p, sizeof(buf))) {
@@ -2012,6 +2014,13 @@ static php_iconv_err_t _php_iconv_mime_decode(smart_str *pretval, const char *st
 		*next_pos = p1;
 	}
 
+	if (cd != (iconv_t)(-1)) {
+		_php_iconv_appendl(pretval, NULL, 0, cd);
+	}
+	if (cd_pl != (iconv_t)(-1)) {
+		_php_iconv_appendl(pretval, NULL, 0, cd_pl);
+	}
+
 	smart_str_0(pretval);
 out:
 	if (cd != (iconv_t)(-1)) {

ext/iconv/tests/bug79200.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug #79200 (Some iconv functions cut Windows-1258)
+--SKIPIF--
+<?php
+if (!extension_loaded('iconv')) die('skip iconv extension not available');
+?>
+--FILE--
+<?php
+var_dump(iconv_mime_decode('=?windows-1258?Q?test=20test?=', 0, 'UTF-8'));
+var_dump(iconv_strlen('test test', 'WINDOWS-1258'));
+var_dump(iconv_strpos('test test', 'test test', 0, 'WINDOWS-1258'));
+var_dump(iconv_substr('test test', 0 , 9, 'WINDOWS-1258'));
+?>
+--EXPECT--
+string(9) "test test"
+int(9)
+int(0)
+string(9) "test test"

ext/intl/formatter/formatter_format.c

@@ -53,23 +53,23 @@ PHP_FUNCTION( numfmt_format )
 	/* Fetch the object. */
 	FORMATTER_METHOD_FETCH_OBJECT;
 
-	if(type == FORMAT_TYPE_DEFAULT) {
-		if(Z_TYPE_P(number) == IS_STRING) {
-			convert_scalar_to_number_ex(number);
-		}
-
-		if(Z_TYPE_P(number) == IS_LONG) {
-			/* take INT32 on 32-bit, int64 on 64-bit */
-			type = (sizeof(zend_long) == 8)?FORMAT_TYPE_INT64:FORMAT_TYPE_INT32;
-		} else if(Z_TYPE_P(number) == IS_DOUBLE) {
-			type = FORMAT_TYPE_DOUBLE;
-		} else {
-			type = FORMAT_TYPE_INT32;
-		}
+	if(Z_TYPE_P(number) != IS_ARRAY) {
+		convert_scalar_to_number_ex(number);
+	} else {
+		convert_to_long(number);
 	}
 
-	if(Z_TYPE_P(number) != IS_DOUBLE && Z_TYPE_P(number) != IS_LONG) {
-		convert_scalar_to_number(number );
+	if(type == FORMAT_TYPE_DEFAULT) {
+		switch(Z_TYPE_P(number)) {
+			case IS_LONG:
+				/* take INT32 on 32-bit, int64 on 64-bit */
+				type = (sizeof(zend_long) == 8)?FORMAT_TYPE_INT64:FORMAT_TYPE_INT32;
+				break;
+			case IS_DOUBLE:
+				type = FORMAT_TYPE_DOUBLE;
+				break;
+			EMPTY_SWITCH_DEFAULT_CASE();
+		}
 	}
 
 	switch(type) {

ext/intl/tests/bug79212.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug #79212 (NumberFormatter::format() may detect wrong type)
+--SKIPIF--
+<?php
+if (!extension_loaded('intl')) die('skip intl extension not available');
+if (!extension_loaded('gmp')) die('skip gmp extension not available');
+?>
+--FILE--
+<?php
+$fmt = new NumberFormatter('en_US', NumberFormatter::PATTERN_DECIMAL);
+var_dump($fmt->format(gmp_init('823749273428379492374')));
+
+$fmt = new NumberFormatter('en_US', NumberFormatter::PATTERN_DECIMAL);
+var_dump($fmt->format([1], NumberFormatter::TYPE_INT64));
+?>
+--EXPECTF--
+string(21) "823749273428379%c%c%c%c%c%c"
+string(1) "1"

ext/libxml/libxml.c

@@ -385,9 +385,6 @@ static int php_libxml_streams_IO_read(void *context, char *buffer, int len)
 
 static int php_libxml_streams_IO_write(void *context, const char *buffer, int len)
 {
-	if (CG(unclean_shutdown)) {
-		return -1;
-	}
 	return php_stream_write((php_stream*)context, buffer, len);
 }
 

ext/libxml/tests/bug79191.phpt

@@ -0,0 +1,24 @@
+--TEST--
+Bug #79191 (Error in SoapClient ctor disables DOMDocument::save())
+--SKIPIF--
+<?php
+if (!extension_loaded('soap')) die('skip soap extension not available');
+if (!extension_loaded('dom')) die('dom extension not available');
+?>
+--FILE--
+<?php
+try {
+    new \SoapClient('does-not-exist.wsdl');
+} catch (Throwable $t) {
+}
+
+$dom = new DOMDocument;
+$dom->loadxml('<?xml version="1.0" ?><root />');
+var_dump($dom->save(__DIR__ . '/bug79191.xml'));
+?>
+--CLEAN--
+<?php
+unlink(__DIR__ . '/bug79191.xml');
+?>
+--EXPECTF--
+int(%d)

ext/mbstring/libmbfl/filters/mbfilter_big5.c

@@ -145,10 +145,10 @@ static unsigned short cp950_pua_tbl[][4] = {
 static inline int is_in_cp950_pua(int c1, int c) {
 	if ((c1 >= 0xfa && c1 <= 0xfe) || (c1 >= 0x8e && c1 <= 0xa0) ||
 			(c1 >= 0x81 && c1 <= 0x8d) || (c1 >= 0xc7 && c1 <= 0xc8)) {
-		return (c > 0x39 && c < 0x7f) || (c > 0xa0 && c < 0xff);
+		return (c >=0x40 && c <= 0x7e) || (c >= 0xa1 && c <= 0xfe);
 	}
 	if (c1 == 0xc6) {
-		return c > 0xa0 && c < 0xff;
+		return c >= 0xa1 && c <= 0xfe;
 	}
 	return 0;
 }

ext/mbstring/mbstring.c

@@ -3232,18 +3232,18 @@ PHP_FUNCTION(mb_convert_encoding)
 				_from_encodings = NULL;
 
 				ZEND_HASH_FOREACH_VAL(target_hash, hash_entry) {
-
-					convert_to_string_ex(hash_entry);
+					zend_string *encoding_str = zval_get_string(hash_entry);
 
 					if ( _from_encodings) {
 						l = strlen(_from_encodings);
-						n = strlen(Z_STRVAL_P(hash_entry));
+						n = strlen(ZSTR_VAL(encoding_str));
 						_from_encodings = erealloc(_from_encodings, l+n+2);
 						memcpy(_from_encodings + l, ",", 1);
-						memcpy(_from_encodings + l + 1, Z_STRVAL_P(hash_entry), Z_STRLEN_P(hash_entry) + 1);
+						memcpy(_from_encodings + l + 1, ZSTR_VAL(encoding_str), ZSTR_LEN(encoding_str) + 1);
 					} else {
-						_from_encodings = estrdup(Z_STRVAL_P(hash_entry));
+						_from_encodings = estrdup(ZSTR_VAL(encoding_str));
 					}
+					zend_string_release(encoding_str);
 				} ZEND_HASH_FOREACH_END();
 
 				if (_from_encodings != NULL && !strlen(_from_encodings)) {
@@ -4850,7 +4850,7 @@ static inline zend_long php_mb_ord(const char* str, size_t str_len, const char*
 
 	no_enc = enc->no_encoding;
 	if (php_mb_is_unsupported_no_encoding(no_enc)) {
-		php_error_docref(NULL, E_WARNING, "Unsupported encoding \"%s\"", enc_name);
+		php_error_docref(NULL, E_WARNING, "Unsupported encoding \"%s\"", enc->name);
 		return -1;
 	}
 

ext/mbstring/php_mbregex.c

@@ -149,6 +149,7 @@ PHP_RSHUTDOWN_FUNCTION(mb_regex)
 		ZVAL_UNDEF(&MBREX(search_str));
 	}
 	MBREX(search_pos) = 0;
+	MBREX(search_re) = NULL;
 
 	if (MBREX(search_regs) != NULL) {
 		onig_region_free(MBREX(search_regs), 1);
@@ -1426,6 +1427,11 @@ _php_mb_regex_ereg_search_exec(INTERNAL_FUNCTION_PARAMETERS, int mode)
 		_php_mb_regex_init_options(arg_options, arg_options_len, &option, &syntax, NULL);
 	}
 
+	if (MBREX(search_regs)) {
+		onig_region_free(MBREX(search_regs), 1);
+		MBREX(search_regs) = NULL;
+	}
+
 	if (arg_pattern) {
 		/* create regex pattern buffer */
 		if ((MBREX(search_re) = php_mbregex_compile_pattern(arg_pattern, arg_pattern_len, option, MBREX(current_mbctype), MBREX(regex_default_syntax))) == NULL) {
@@ -1451,9 +1457,6 @@ _php_mb_regex_ereg_search_exec(INTERNAL_FUNCTION_PARAMETERS, int mode)
 		RETURN_FALSE;
 	}
 
-	if (MBREX(search_regs)) {
-		onig_region_free(MBREX(search_regs), 1);
-	}
 	MBREX(search_regs) = onig_region_new();
 
 	err = _php_mb_onig_search(MBREX(search_re), str, str + len, str + pos, str  + len, MBREX(search_regs), 0);

ext/mbstring/php_unicode.c

@@ -315,7 +315,7 @@ static int convert_case_filter(int c, void *void_data)
 
 	/* Handle invalid characters early, as we assign special meaning to
 	 * codepoints above 0xffffff. */
-	if (UNEXPECTED(c > 0xffffff)) {
+	if (UNEXPECTED((unsigned) c > 0xffffff)) {
 		(*data->next_filter->filter_function)(c, data->next_filter);
 		return 0;
 	}

ext/mbstring/tests/bug79037.phpt

@@ -0,0 +1,10 @@
+--TEST--
+Bug #79037: global buffer-overflow in `mbfl_filt_conv_big5_wchar`
+--FILE--
+<?php
+
+var_dump(mb_convert_encoding("\x81\x3a", "UTF-8", "CP950"));
+
+?>
+--EXPECT--
+string(1) "?"

ext/mbstring/tests/bug79154.phpt

@@ -0,0 +1,34 @@
+--TEST--
+Bug 79154 (mb_convert_encoding() can modify $from_encoding)
+--SKIPIF--
+<?php
+if (!extension_loaded('mbstring')) die('mbstring extension not available');
+?>
+--FILE--
+<?php
+class Utf8Encoding
+{
+    public function __toString()
+    {
+        return 'UTF-8';
+    }
+}
+
+$utf8encoding = new Utf8Encoding();
+$encodings = [$utf8encoding];
+var_dump($encodings);
+mb_convert_encoding('foo', 'UTF-8', $encodings);
+var_dump($encodings);
+
+?>
+--EXPECTF--
+array(1) {
+  [0]=>
+  object(Utf8Encoding)#%d (0) {
+  }
+}
+array(1) {
+  [0]=>
+  object(Utf8Encoding)#%d (0) {
+  }
+}

ext/mbstring/tests/bug79371.phpt

@@ -0,0 +1,14 @@
+--TEST--
+Bug #79371 (mb_strtolower (UTF-32LE): stack-buffer-overflow)
+--SKIPIF--
+<?php
+if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
+?>
+--FILE--
+<?php
+$bytes = array(0xef, 0xbf, 0xbd, 0xef);
+$str = implode(array_map("chr", $bytes));
+var_dump(bin2hex(mb_strtolower($str, "UTF-32LE")));
+?>
+--EXPECT--
+string(8) "3f000000"

ext/mbstring/tests/mb_ereg_search_invalid_pattern.phpt

@@ -0,0 +1,19 @@
+--TEST--
+mb_ereg_search() with invalid pattern should discard old matches
+--SKIPIF--
+<?php if (!function_exists("mb_ereg")) print "skip requires mbregex"; ?>
+--FILE--
+<?php
+
+mb_ereg_search_init('');
+var_dump(mb_ereg_search(''));
+var_dump(mb_ereg_search("\xff"));
+var_dump(mb_ereg_search_getregs());
+
+?>
+--EXPECTF--
+bool(true)
+
+Warning: mb_ereg_search(): Pattern is not valid under UTF-8 encoding in %s on line %d
+bool(false)
+bool(false)

ext/mbstring/tests/mb_ord.phpt

@@ -19,6 +19,9 @@ var_dump(
 	mb_ord("\u{d800}", "utf-7"),
 	mb_ord("")
 );
+
+mb_internal_encoding("utf-7");
+mb_ord("");
 ?>
 --EXPECTF--
 bool(true)
@@ -29,11 +32,11 @@ Warning: mb_ord(): Unknown encoding "typo" %s 10
 
 Warning: mb_ord(): Unsupported encoding "pass" %s 11
 
-Warning: mb_ord(): Unsupported encoding "jis" %s 12
+Warning: mb_ord(): Unsupported encoding "JIS" in %s on line %d
 
-Warning: mb_ord(): Unsupported encoding "cp50222" %s 13
+Warning: mb_ord(): Unsupported encoding "CP50222" in %s on line %d
 
-Warning: mb_ord(): Unsupported encoding "utf-7" %s 14
+Warning: mb_ord(): Unsupported encoding "UTF-7" in %s on line %d
 
 Warning: mb_ord(): Empty string in %s on line %d
 bool(false)
@@ -42,3 +45,5 @@ bool(false)
 bool(false)
 bool(false)
 bool(false)
+
+Warning: mb_ord(): Unsupported encoding "UTF-7" in %s on line %d

ext/mysqli/mysqli_driver.c

@@ -96,7 +96,7 @@ static zval *driver_embedded_read(mysqli_object *obj, zval *retval)
 /* {{{ property driver_client_version_read */
 static zval *driver_client_version_read(mysqli_object *obj, zval *retval)
 {
-	ZVAL_LONG(retval, MYSQL_VERSION_ID);
+	ZVAL_LONG(retval, mysql_get_client_version());
 	return retval;
 }
 /* }}} */

ext/mysqli/tests/bug79084.phpt

@@ -0,0 +1,79 @@
+--TEST--
+Bug #79084 (mysqlnd may fetch wrong column indexes with MYSQLI_BOTH)
+--SKIPIF--
+<?php
+require_once('skipif.inc');
+require_once('skipifconnectfailure.inc');
+?>
+--FILE--
+<?php
+require_once('connect.inc');
+$sql = "SELECT 0 as `2007`, 0 as `2008`, 0 as `2020`";
+
+// unbuffered
+$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket);
+$link->real_query($sql);
+$res = $link->use_result();
+$row = $res->fetch_array();
+var_dump($row);
+$link->close();
+
+// buffered
+ini_set('mysqlnd.fetch_data_copy', false);
+$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket);
+$res = $link->query($sql);
+$row = $res->fetch_array();
+var_dump($row);
+$link->close();
+
+// buffered copies
+ini_set('mysqlnd.fetch_data_copy', true);
+$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket);
+$res = $link->query($sql);
+$row = $res->fetch_array();
+var_dump($row);
+$link->close();
+?>
+--EXPECT--
+array(6) {
+  [0]=>
+  string(1) "0"
+  [2007]=>
+  string(1) "0"
+  [1]=>
+  string(1) "0"
+  [2008]=>
+  string(1) "0"
+  [2]=>
+  string(1) "0"
+  [2020]=>
+  string(1) "0"
+}
+array(6) {
+  [0]=>
+  string(1) "0"
+  [2007]=>
+  string(1) "0"
+  [1]=>
+  string(1) "0"
+  [2008]=>
+  string(1) "0"
+  [2]=>
+  string(1) "0"
+  [2020]=>
+  string(1) "0"
+}
+array(6) {
+  [0]=>
+  string(1) "0"
+  [2007]=>
+  string(1) "0"
+  [1]=>
+  string(1) "0"
+  [2008]=>
+  string(1) "0"
+  [2]=>
+  string(1) "0"
+  [2020]=>
+  string(1) "0"
+}

ext/mysqli/tests/bug79084_collision.phpt

@@ -0,0 +1,61 @@
+--TEST--
+Bug #79084 (mysqlnd may fetch wrong column indexes with MYSQLI_BOTH) - collision
+--SKIPIF--
+<?php
+require_once('skipif.inc');
+require_once('skipifconnectfailure.inc');
+?>
+--FILE--
+<?php
+require_once('connect.inc');
+$sql = "SELECT 11111 as `1`, 22222 as `2`";
+
+// unbuffered
+$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket);
+$link->real_query($sql);
+$res = $link->use_result();
+$row = $res->fetch_array();
+var_dump($row);
+$link->close();
+
+// buffered
+ini_set('mysqlnd.fetch_data_copy', false);
+$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket);
+$res = $link->query($sql);
+$row = $res->fetch_array();
+var_dump($row);
+$link->close();
+
+// buffered copies
+ini_set('mysqlnd.fetch_data_copy', true);
+$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket);
+$res = $link->query($sql);
+$row = $res->fetch_array();
+var_dump($row);
+$link->close();
+?>
+--EXPECT--
+array(3) {
+  [0]=>
+  string(5) "11111"
+  [1]=>
+  string(5) "11111"
+  [2]=>
+  string(5) "22222"
+}
+array(3) {
+  [0]=>
+  string(5) "11111"
+  [1]=>
+  string(5) "11111"
+  [2]=>
+  string(5) "22222"
+}
+array(3) {
+  [0]=>
+  string(5) "11111"
+  [1]=>
+  string(5) "11111"
+  [2]=>
+  string(5) "22222"
+}

ext/mysqli/tests/mysqli_debug_append.phpt

@@ -17,6 +17,8 @@ if (defined('MYSQLI_DEBUG_TRACE_ENABLED') && !MYSQLI_DEBUG_TRACE_ENABLED)
 
 if (!$IS_MYSQLND)
 	die("SKIP Libmysql feature not sufficiently spec'd in MySQL C API documentation");
+
+if (substr(PHP_OS, 0, 3) == 'WIN') die("skip this test is not for Windows platforms");
 ?>
 --FILE--
 <?php

ext/mysqli/tests/mysqli_debug_mysqlnd_control_string.phpt

@@ -89,7 +89,7 @@ if (!$IS_MYSQLND)
 	// F - file name
 	$trace = try_control_string($link, 't:O,' . $trace_file . ':F', $trace_file, 50);
 	// hopefully we'll never see a file name that's not covered by this regular expression...
-	if (!preg_match("@^\s*[/\w\\\\d\.\-]+\.[ch]@ismU", $trace))
+	if (!preg_match("@^\s*[/\w\\\\d\.:\-]+\.[ch]@ismU", $trace))
 		printf("[055] File names seem to be missing, first characters from trace are '%s'\n", substr($trace, 0, 80));
 
 	// -n - print function nesting depth

ext/mysqli/tests/mysqli_store_result_buffered_c.phpt

@@ -7,7 +7,7 @@ require_once('skipifemb.inc');
 require_once('skipifconnectfailure.inc');
 ?>
 --INI--
-mysqlnd.debug=d:t:O,/tmp/mysqlnd.trace
+mysqlnd.debug="d:t:O,{TMP}/mysqlnd.trace"
 --FILE--
 <?php
 	require_once("connect.inc");

ext/mysqli/tests/mysqli_store_result_copy.phpt

@@ -10,7 +10,7 @@ if (!$IS_MYSQLND) {
 }
 ?>
 --INI--
-mysqlnd.debug=d:t:O,/tmp/mysqlnd.trace
+mysqlnd.debug="d:t:O,{TMP}/mysqlnd.trace"
 mysqlnd.net_read_buffer_size=1
 mysqlnd.mempool_default_size=1
 mysqlnd.fetch_data_copy=0

ext/mysqlnd/mysqlnd_result.c

@@ -842,8 +842,9 @@ MYSQLND_METHOD(mysqlnd_result_unbuffered, fetch_row)(MYSQLND_RES * result, void
 					const size_t len = (Z_TYPE_P(data) == IS_STRING)? Z_STRLEN_P(data) : 0;
 
 					if (flags & MYSQLND_FETCH_NUM) {
-						Z_TRY_ADDREF_P(data);
-						zend_hash_next_index_insert(row_ht, data);
+						if (zend_hash_index_add(row_ht, i, data) != NULL) {
+							Z_TRY_ADDREF_P(data);
+						}
 					}
 					if (flags & MYSQLND_FETCH_ASSOC) {
 						/* zend_hash_quick_update needs length + trailing zero */
@@ -1099,8 +1100,9 @@ MYSQLND_METHOD(mysqlnd_result_buffered_zval, fetch_row)(MYSQLND_RES * result, vo
 			set->lengths[i] = (Z_TYPE_P(data) == IS_STRING)? Z_STRLEN_P(data) : 0;
 
 			if (flags & MYSQLND_FETCH_NUM) {
-				Z_TRY_ADDREF_P(data);
-				zend_hash_next_index_insert(Z_ARRVAL_P(row), data);
+				if (zend_hash_index_add(Z_ARRVAL_P(row), i, data) != NULL) {
+					Z_TRY_ADDREF_P(data);
+				}
 			}
 			if (flags & MYSQLND_FETCH_ASSOC) {
 				/* zend_hash_quick_update needs length + trailing zero */
@@ -1195,8 +1197,9 @@ MYSQLND_METHOD(mysqlnd_result_buffered_c, fetch_row)(MYSQLND_RES * result, void
 			set->lengths[i] = (Z_TYPE_P(data) == IS_STRING)? Z_STRLEN_P(data) : 0;
 
 			if (flags & MYSQLND_FETCH_NUM) {
-				Z_TRY_ADDREF_P(data);
-				zend_hash_next_index_insert(Z_ARRVAL_P(row), data);
+				if (zend_hash_index_add(Z_ARRVAL_P(row), i, data)) {
+					Z_TRY_ADDREF_P(data);
+				}
 			}
 			if (flags & MYSQLND_FETCH_ASSOC) {
 				/* zend_hash_quick_update needs length + trailing zero */

ext/opcache/Optimizer/dfa_pass.c

@@ -301,8 +301,10 @@ static void zend_ssa_remove_nops(zend_op_array *op_array, zend_ssa *ssa, zend_op
 			while (call_info) {
 				call_info->caller_init_opline -=
 					shiftlist[call_info->caller_init_opline - op_array->opcodes];
-				call_info->caller_call_opline -=
-					shiftlist[call_info->caller_call_opline - op_array->opcodes];
+				if (call_info->caller_call_opline) {
+					call_info->caller_call_opline -=
+						shiftlist[call_info->caller_call_opline - op_array->opcodes];
+				}
 				call_info = call_info->next_callee;
 			}
 		}
@@ -388,7 +390,8 @@ int zend_dfa_optimize_calls(zend_op_array *op_array, zend_ssa *ssa)
 		zend_call_info *call_info = func_info->callee_info;
 
 		do {
-			if (call_info->caller_call_opline->opcode == ZEND_DO_ICALL
+			if (call_info->caller_call_opline
+			 && call_info->caller_call_opline->opcode == ZEND_DO_ICALL
 			 && call_info->callee_func
 			 && ZSTR_LEN(call_info->callee_func->common.function_name) == sizeof("in_array")-1
 			 && memcmp(ZSTR_VAL(call_info->callee_func->common.function_name), "in_array", sizeof("in_array")-1) == 0

ext/opcache/Optimizer/sccp.c

@@ -1251,7 +1251,8 @@ static void sccp_visit_instr(scdf_ctx *scdf, zend_op *opline, zend_ssa_op *ssa_o
 			}
 
 			call = ctx->call_map[opline - ctx->scdf.op_array->opcodes];
-			if (IS_TOP(op1) || !call || call->caller_call_opline->opcode != ZEND_DO_ICALL) {
+			if (IS_TOP(op1) || !call || !call->caller_call_opline
+					|| call->caller_call_opline->opcode != ZEND_DO_ICALL) {
 				return;
 			}
 

ext/opcache/Optimizer/zend_call_graph.c

@@ -171,6 +171,10 @@ int zend_analyze_calls(zend_arena **arena, zend_script *script, uint32_t build_f
 					call_info->num_args = -1;
 				}
 				break;
+			case ZEND_EXIT:
+				/* In this case the DO_CALL opcode may have been dropped
+				 * and caller_call_opline will be NULL. */
+				break;
 		}
 		opline++;
 	}
@@ -280,7 +284,9 @@ zend_call_info **zend_build_call_map(zend_arena **arena, zend_func_info *info, z
 	for (call = info->callee_info; call; call = call->next_callee) {
 		int i;
 		map[call->caller_init_opline - op_array->opcodes] = call;
-		map[call->caller_call_opline - op_array->opcodes] = call;
+		if (call->caller_call_opline) {
+			map[call->caller_call_opline - op_array->opcodes] = call;
+		}
 		for (i = 0; i < call->num_args; i++) {
 			if (call->arg_info[i].opline) {
 				map[call->arg_info[i].opline - op_array->opcodes] = call;

ext/opcache/Optimizer/zend_inference.c

@@ -1807,12 +1807,25 @@ static int zend_infer_ranges(const zend_op_array *op_array, zend_ssa *ssa) /* {{
 				}
 			} WHILE_WORKLIST_END();
 
-			/* Add all SCC entry variables into worklist for narrowing */
+			/* initialize missing ranges */
 			for (j = scc_var[scc]; j >= 0; j = next_scc_var[j]) {
 				if (!ssa->var_info[j].has_range) {
 					zend_inference_init_range(op_array, ssa, j, 1, ZEND_LONG_MIN, ZEND_LONG_MAX, 1);
-				} else if (ssa->vars[j].definition_phi &&
-				           ssa->vars[j].definition_phi->pi < 0) {
+					FOR_EACH_VAR_USAGE(j, ADD_SCC_VAR);
+				}
+			}
+
+			/* widening (second round) */
+			WHILE_WORKLIST(worklist, worklist_len, j) {
+				if (zend_ssa_range_widening(op_array, ssa, j, scc)) {
+					FOR_EACH_VAR_USAGE(j, ADD_SCC_VAR);
+				}
+			} WHILE_WORKLIST_END();
+
+			/* Add all SCC entry variables into worklist for narrowing */
+			for (j = scc_var[scc]; j >= 0; j = next_scc_var[j]) {
+				if (ssa->vars[j].definition_phi
+				 && ssa->vars[j].definition_phi->pi < 0) {
 					/* narrowing Phi functions first */
 					zend_ssa_range_narrowing(op_array, ssa, j, scc);
 				}
@@ -2626,10 +2639,10 @@ static int zend_update_type_info(const zend_op_array *op_array,
 			}
 			if ((t1 & (MAY_BE_ANY|MAY_BE_UNDEF)) == MAY_BE_LONG) {
 				if (!ssa_var_info[ssa_ops[i].op1_use].has_range ||
-				     (opline->opcode == ZEND_PRE_DEC &&
+				     (opline->opcode == ZEND_POST_DEC &&
 				      (ssa_var_info[ssa_ops[i].op1_use].range.underflow ||
 				       ssa_var_info[ssa_ops[i].op1_use].range.min == ZEND_LONG_MIN)) ||
-				      (opline->opcode == ZEND_PRE_INC &&
+				      (opline->opcode == ZEND_POST_INC &&
 				       (ssa_var_info[ssa_ops[i].op1_use].range.overflow ||
 				        ssa_var_info[ssa_ops[i].op1_use].range.max == ZEND_LONG_MAX))) {
 					/* may overflow */
@@ -4145,7 +4158,7 @@ void zend_inference_check_recursive_dependencies(zend_op_array *op_array)
 	memset(worklist, 0, sizeof(zend_ulong) * worklist_len);
 	call_info = info->callee_info;
 	while (call_info) {
-		if (call_info->recursive &&
+		if (call_info->recursive && call_info->caller_call_opline &&
 		    info->ssa.ops[call_info->caller_call_opline - op_array->opcodes].result_def >= 0) {
 			zend_bitset_incl(worklist, info->ssa.ops[call_info->caller_call_opline - op_array->opcodes].result_def);
 		}

ext/opcache/tests/bug71443.phpt

@@ -3,7 +3,7 @@ Bug #71443 (Segfault using built-in webserver with intl using symfony)
 --INI--
 opcache.enable=1
 opcache.enable_cli=1
-opcache.file_cache={TMP}
+opcache.file_cache="{TMP}"
 opcache.file_cache_only=1
 --SKIPIF--
 <?php require_once('skipif.inc'); ?>

ext/opcache/tests/bug76275.phpt

@@ -3,7 +3,7 @@ Bug #76275: Assertion failure in file cache when unserializing empty try_catch_a
 --INI--
 opcache.enabled=1
 opcache.enable_cli=1
-opcache.file_cache={TMP}
+opcache.file_cache="{TMP}"
 --SKIPIF--
 <?php require_once('skipif.inc'); ?>
 --FILE--

ext/opcache/tests/bug78189.phpt

@@ -8,7 +8,7 @@ if (substr(PHP_OS, 0, 3) !== 'WIN') die('skip this test is for Windows platforms
 --INI--
 opcache.enable_cli=1
 opcache.optimization_level=-1
-opcache.file_cache={TMP}
+opcache.file_cache="{TMP}"
 opcache.file_cache_only=1
 --FILE--
 <?php

ext/opcache/tests/bug79412.phpt

@@ -0,0 +1,25 @@
+--TEST--
+Bug #79412 (Opcache chokes and uses 100% CPU on specific script)
+--INI--
+opcache.enable=1
+opcache.optimization_level=-1
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+$limitPerRun = 10;
+foreach ($foo as $bar) {
+    $count = 0;
+    foreach ($runs as $run) {
+        ++$count;
+        if ($count >= $limitPerRun) {
+            break;
+        }
+    }
+    foo($limitPerRun);
+}
+?>
+--EXPECTF--
+Notice: Undefined variable: foo in %s on line %d
+
+Warning: Invalid argument supplied for foreach() in %s on line %d

ext/opcache/tests/exit_in_call_arg.phpt

@@ -0,0 +1,19 @@
+--TEST--
+exit() may occur in a call argument
+--FILE--
+<?php
+
+function test($c) {
+    if ($c) {
+        var_dump(var_dump(exit("exit\n")));
+    } else {
+        var_dump("test");
+    }
+}
+test(false);
+test(true);
+
+?>
+--EXPECT--
+string(4) "test"
+exit

ext/openssl/openssl.c

@@ -4691,7 +4691,6 @@ PHP_FUNCTION(openssl_pkey_get_public)
 		RETURN_FALSE;
 	}
 	ZVAL_RES(return_value, res);
-	Z_ADDREF_P(return_value);
 }
 /* }}} */
 
@@ -4733,7 +4732,6 @@ PHP_FUNCTION(openssl_pkey_get_private)
 		RETURN_FALSE;
 	}
 	ZVAL_RES(return_value, res);
-	Z_ADDREF_P(return_value);
 }
 
 /* }}} */

ext/openssl/tests/bug79145.phpt

@@ -0,0 +1,26 @@
+--TEST--
+Bug #79145 (openssl memory leak)
+--SKIPIF--
+<?php
+if (!extension_loaded('openssl')) die('skip openssl extension not available');
+if (getenv('SKIP_SLOW_TESTS')) die('skip slow test');
+?>
+--FILE--
+<?php
+$b = '-----BEGIN PUBLIC KEY-----
+MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDaFhc31WeskqxwI+Si5R/fZrLK
+pJOlABiI3RZfKCHJVrXl3IvcHDFM/BHKUJoSi/ee8GS9iw0G4Z1eCzJdthXxHARh
+j85Q5OliVxOdB1LoTOsOmfFf/fdvpU3DsOWsDKlVrL41MHxXorwrwOiys/r/gv2d
+C9C4JmhTOjBVAK8SewIDAQAC
+-----END PUBLIC KEY-----';
+
+$start = memory_get_usage(true);
+for ($i = 0; $i < 100000; $i++) {
+    $a = openssl_get_publickey($b);
+    openssl_free_key($a);
+}
+$end = memory_get_usage(true);
+var_dump($end <= 1.1 * $start);
+?>
+--EXPECT--
+bool(true)

ext/pcre/php_pcre.c

@@ -1574,6 +1574,7 @@ PHPAPI zend_string *php_pcre_replace_impl(pcre_cache_entry *pce, zend_string *su
 	size_t			 match_len;			/* Length of the current match */
 	int				 backref;			/* Backreference number */
 	PCRE2_SIZE		 start_offset;		/* Where the new search starts */
+	size_t			 last_end_offset;	/* Where the last search ended */
 	char			*walkbuf,			/* Location of current replacement in the result */
 					*walk,				/* Used to walk the replacement string */
 					*match,				/* The current match */
@@ -1592,6 +1593,7 @@ PHPAPI zend_string *php_pcre_replace_impl(pcre_cache_entry *pce, zend_string *su
 	/* Initialize */
 	match = NULL;
 	start_offset = 0;
+	last_end_offset = 0;
 	result_len = 0;
 	PCRE_G(error_code) = PHP_PCRE_NO_ERROR;
 
@@ -1618,7 +1620,7 @@ PHPAPI zend_string *php_pcre_replace_impl(pcre_cache_entry *pce, zend_string *su
 			options, match_data, mctx);
 
 	while (1) {
-		piece = subject + start_offset;
+		piece = subject + last_end_offset;
 
 		if (count >= 0 && limit > 0) {
 			zend_bool simple_string;
@@ -1648,7 +1650,7 @@ matched:
 			/* Set the match location in subject */
 			match = subject + offsets[0];
 
-			new_len = result_len + offsets[0] - start_offset; /* part before the match */
+			new_len = result_len + offsets[0] - last_end_offset; /* part before the match */
 
 			walk = ZSTR_VAL(replace_str);
 			replace_end = walk + ZSTR_LEN(replace_str);
@@ -1725,7 +1727,7 @@ matched:
 			limit--;
 
 			/* Advance to the next piece. */
-			start_offset = offsets[1];
+			start_offset = last_end_offset = offsets[1];
 
 			/* If we have matched an empty string, mimic what Perl's /g options does.
 			   This turns out to be rather cunning. First we set PCRE2_NOTEMPTY_ATSTART and try
@@ -1745,10 +1747,7 @@ matched:
 					   to achieve this, unless we're already at the end of the string. */
 					if (start_offset < subject_len) {
 						size_t unit_len = calculate_unit_length(pce, piece);
-
 						start_offset += unit_len;
-						memcpy(ZSTR_VAL(result) + result_len, piece, unit_len);
-						result_len += unit_len;
 					} else {
 						goto not_matched;
 					}
@@ -1763,7 +1762,7 @@ not_matched:
 				result = zend_string_copy(subject_str);
 				break;
 			}
-			new_len = result_len + subject_len - start_offset;
+			new_len = result_len + subject_len - last_end_offset;
 			if (new_len >= alloc_len) {
 				alloc_len = new_len; /* now we know exactly how long it is */
 				if (NULL != result) {
@@ -1773,8 +1772,8 @@ not_matched:
 				}
 			}
 			/* stick that last bit of string on our output */
-			memcpy(ZSTR_VAL(result) + result_len, piece, subject_len - start_offset);
-			result_len += subject_len - start_offset;
+			memcpy(ZSTR_VAL(result) + result_len, piece, subject_len - last_end_offset);
+			result_len += subject_len - last_end_offset;
 			ZSTR_VAL(result)[result_len] = '\0';
 			ZSTR_LEN(result) = result_len;
 			break;
@@ -1816,6 +1815,7 @@ static zend_string *php_pcre_replace_func_impl(pcre_cache_entry *pce, zend_strin
 	size_t			 new_len;			/* Length of needed storage */
 	size_t			 alloc_len;			/* Actual allocated length */
 	PCRE2_SIZE		 start_offset;		/* Where the new search starts */
+	size_t			 last_end_offset;	/* Where the last search ended */
 	char			*match,				/* The current match */
 					*piece;				/* The current piece of subject */
 	size_t			result_len; 		/* Length of result */
@@ -1845,6 +1845,7 @@ static zend_string *php_pcre_replace_func_impl(pcre_cache_entry *pce, zend_strin
 	/* Initialize */
 	match = NULL;
 	start_offset = 0;
+	last_end_offset = 0;
 	result_len = 0;
 	PCRE_G(error_code) = PHP_PCRE_NO_ERROR;
 
@@ -1877,7 +1878,7 @@ static zend_string *php_pcre_replace_func_impl(pcre_cache_entry *pce, zend_strin
 			options, match_data, mctx);
 
 	while (1) {
-		piece = subject + start_offset;
+		piece = subject + last_end_offset;
 
 		if (count >= 0 && limit) {
 			/* Check for too many substrings condition. */
@@ -1905,7 +1906,7 @@ matched:
 			/* Set the match location in subject */
 			match = subject + offsets[0];
 
-			new_len = result_len + offsets[0] - start_offset; /* part before the match */
+			new_len = result_len + offsets[0] - last_end_offset; /* part before the match */
 
 			/* Use custom function to get replacement string and its length. */
 			eval_result = preg_do_repl_func(fci, fcc, subject, offsets, subpat_names, count,
@@ -1936,7 +1937,7 @@ matched:
 			limit--;
 
 			/* Advance to the next piece. */
-			start_offset = offsets[1];
+			start_offset = last_end_offset = offsets[1];
 
 			/* If we have matched an empty string, mimic what Perl's /g options does.
 			   This turns out to be rather cunning. First we set PCRE2_NOTEMPTY_ATSTART and try
@@ -1956,10 +1957,7 @@ matched:
 					   to achieve this, unless we're already at the end of the string. */
 					if (start_offset < subject_len) {
 						size_t unit_len = calculate_unit_length(pce, piece);
-
 						start_offset += unit_len;
-						memcpy(ZSTR_VAL(result) + result_len, piece, unit_len);
-						result_len += unit_len;
 					} else {
 						goto not_matched;
 					}
@@ -1974,7 +1972,7 @@ not_matched:
 				result = zend_string_copy(subject_str);
 				break;
 			}
-			new_len = result_len + subject_len - start_offset;
+			new_len = result_len + subject_len - last_end_offset;
 			if (new_len >= alloc_len) {
 				alloc_len = new_len; /* now we know exactly how long it is */
 				if (NULL != result) {
@@ -1984,8 +1982,8 @@ not_matched:
 				}
 			}
 			/* stick that last bit of string on our output */
-			memcpy(ZSTR_VAL(result) + result_len, piece, subject_len - start_offset);
-			result_len += subject_len - start_offset;
+			memcpy(ZSTR_VAL(result) + result_len, piece, subject_len - last_end_offset);
+			result_len += subject_len - last_end_offset;
 			ZSTR_VAL(result)[result_len] = '\0';
 			ZSTR_LEN(result) = result_len;
 			break;

ext/pcre/tests/bug79188.phpt

@@ -0,0 +1,13 @@
+--TEST--
+Bug #79188: Memory corruption in preg_replace/preg_replace_callback and unicode
+--FILE--
+<?php
+
+var_dump(preg_replace("//u", "", "a" . str_repeat("\u{1f612}", 10)));
+var_dump(preg_replace_callback(
+    "//u", function() { return ""; }, "a" . str_repeat("\u{1f612}", 10)));
+
+?>
+--EXPECT--
+string(41) "a😒😒😒😒😒😒😒😒😒😒"
+string(41) "a😒😒😒😒😒😒😒😒😒😒"

ext/pdo_odbc/odbc_stmt.c

@@ -126,13 +126,14 @@ static void free_cols(pdo_stmt_t *stmt, pdo_odbc_stmt *S)
 	if (S->cols) {
 		int i;
 
-		for (i = 0; i < stmt->column_count; i++) {
+		for (i = 0; i < S->col_count; i++) {
 			if (S->cols[i].data) {
 				efree(S->cols[i].data);
 			}
 		}
 		efree(S->cols);
 		S->cols = NULL;
+		S->col_count = 0;
 	}
 }
 
@@ -262,14 +263,14 @@ static int odbc_stmt_execute(pdo_stmt_t *stmt)
 	SQLRowCount(S->stmt, &row_count);
 	stmt->row_count = row_count;
 
-	if (!stmt->executed) {
+	if (S->cols == NULL) {
 		/* do first-time-only definition of bind/mapping stuff */
 		SQLSMALLINT colcount;
 
 		/* how many columns do we have ? */
 		SQLNumResultCols(S->stmt, &colcount);
 
-		stmt->column_count = (int)colcount;
+		stmt->column_count = S->col_count = (int)colcount;
 		S->cols = ecalloc(colcount, sizeof(pdo_odbc_column));
 		S->going_long = 0;
 	}
@@ -847,13 +848,25 @@ static int odbc_stmt_next_rowset(pdo_stmt_t *stmt)
 	free_cols(stmt, S);
 	/* how many columns do we have ? */
 	SQLNumResultCols(S->stmt, &colcount);
-	stmt->column_count = (int)colcount;
+	stmt->column_count = S->col_count = (int)colcount;
 	S->cols = ecalloc(colcount, sizeof(pdo_odbc_column));
 	S->going_long = 0;
 
 	return 1;
 }
 
+static int odbc_stmt_close_cursor(pdo_stmt_t *stmt)
+{
+	SQLRETURN rc;
+	pdo_odbc_stmt *S = (pdo_odbc_stmt*)stmt->driver_data;
+
+	rc = SQLCloseCursor(S->stmt);
+	if (rc != SQL_SUCCESS && rc != SQL_SUCCESS_WITH_INFO) {
+		return 0;
+	}
+	return 1;
+}
+
 const struct pdo_stmt_methods odbc_stmt_methods = {
 	odbc_stmt_dtor,
 	odbc_stmt_execute,
@@ -864,7 +877,8 @@ const struct pdo_stmt_methods odbc_stmt_methods = {
 	odbc_stmt_set_param,
 	odbc_stmt_get_attr, /* get attr */
 	NULL, /* get column meta */
-	odbc_stmt_next_rowset
+	odbc_stmt_next_rowset,
+	odbc_stmt_close_cursor
 };
 
 /*

ext/pdo_odbc/php_pdo_odbc_int.h

@@ -151,7 +151,8 @@ typedef struct {
 	zend_ulong convbufsize;
 	unsigned going_long:1;
 	unsigned assume_utf8:1;
-	unsigned _spare:30;
+	signed col_count:16;
+	unsigned _spare:14;
 } pdo_odbc_stmt;
 
 typedef struct {

ext/phar/phar_object.c

@@ -1404,6 +1404,7 @@ static int phar_build(zend_object_iterator *iter, void *puser) /* {{{ */
 	char *str_key;
 	zend_class_entry *ce = p_obj->c;
 	phar_archive_object *phar_obj = p_obj->p;
+	php_stream_statbuf ssb;
 
 	value = iter->funcs->get_current_data(iter);
 
@@ -1671,6 +1672,16 @@ after_open_fp:
 		php_stream_copy_to_stream_ex(fp, p_obj->fp, PHP_STREAM_COPY_ALL, &contents_len);
 		data->internal_file->uncompressed_filesize = data->internal_file->compressed_filesize =
 			php_stream_tell(p_obj->fp) - data->internal_file->offset;
+		if (php_stream_stat(fp, &ssb) != -1) {
+			data->internal_file->flags = ssb.sb.st_mode & PHAR_ENT_PERM_MASK ;
+		} else {
+#ifndef _WIN32
+			mode_t mask;
+			mask = umask(0);
+			umask(mask);
+			data->internal_file->flags &= ~mask;
+#endif
+		}
 	}
 
 	if (close_fp) {
@@ -4142,7 +4153,7 @@ static int phar_extract_file(zend_bool overwrite, phar_entry_info *entry, char *
 			if ('\\' == filename[cnt]) {
 				filename[cnt] = '/';
 			}
-		} while (cnt++ <= filename_len);
+		} while (cnt++ < filename_len);
 	}
 #endif
 
@@ -5011,6 +5022,7 @@ PHP_METHOD(PharFileInfo, compress)
 PHP_METHOD(PharFileInfo, decompress)
 {
 	char *error;
+	char *compression_type;
 	PHAR_ENTRY_OBJECT();
 
 	if (zend_parse_parameters_none() == FAILURE) {
@@ -5061,12 +5073,24 @@ PHP_METHOD(PharFileInfo, decompress)
 		/* re-populate after copy-on-write */
 		entry_obj->entry = zend_hash_str_find_ptr(&phar->manifest, entry_obj->entry->filename, entry_obj->entry->filename_len);
 	}
-	if (!entry_obj->entry->fp) {
-		if (FAILURE == phar_open_archive_fp(entry_obj->entry->phar)) {
-			zend_throw_exception_ex(spl_ce_BadMethodCallException, 0, "Cannot decompress entry \"%s\", phar error: Cannot open phar archive \"%s\" for reading", entry_obj->entry->filename, entry_obj->entry->phar->fname);
+	switch (entry_obj->entry->flags & PHAR_ENT_COMPRESSION_MASK) {
+		case PHAR_ENT_COMPRESSED_GZ:
+			compression_type = "gzip";
+			break;
+		case PHAR_ENT_COMPRESSED_BZ2:
+			compression_type = "bz2";
+			break;
+		default:
+			zend_throw_exception_ex(spl_ce_BadMethodCallException, 0,
+				"Cannot decompress file compressed with unknown compression type");
 			return;
-		}
-		entry_obj->entry->fp_type = PHAR_FP;
+	}
+	/* decompress this file indirectly */
+	if (SUCCESS != phar_open_entry_fp(entry_obj->entry, &error, 1)) {
+		zend_throw_exception_ex(spl_ce_BadMethodCallException, 0,
+			"Phar error: Cannot decompress %s-compressed file \"%s\" in phar \"%s\": %s", compression_type, entry_obj->entry->filename, entry_obj->entry->phar->fname, error);
+		efree(error);
+		return;
 	}
 
 	entry_obj->entry->old_flags = entry_obj->entry->flags;

ext/phar/tests/bug76584.phpt

@@ -0,0 +1,35 @@
+--TEST--
+Bug #76584 (PharFileInfo::decompress not working)
+--SKIPIF--
+<?php
+if (!extension_loaded('phar')) die('skip phar extension not available');
+if (!extension_loaded('zlib')) die('skip zlib extension not available');
+?>
+--INI--
+phar.readonly=0
+--FILE--
+<?php
+$phar = new Phar(__DIR__ . '/76584.phar');
+$phar->addFromString('76584.txt', 'This is a test file.');
+$file = $phar['76584.txt'];
+var_dump($file->compress(Phar::GZ));
+var_dump($file->isCompressed());
+var_dump($file->decompress());
+var_dump($file->isCompressed());
+mkdir(__DIR__ . '/76584');
+var_dump($phar->extractTo(__DIR__ . '/76584'));
+echo file_get_contents(__DIR__ . '/76584/76584.txt');
+?>
+--EXPECT--
+bool(true)
+bool(true)
+bool(true)
+bool(false)
+bool(true)
+This is a test file.
+--CLEAN--
+<?php
+unlink(__DIR__ . '/76584/76584.txt');
+rmdir(__DIR__ . '/76584');
+unlink(__DIR__ . '/76584.phar');
+?>

ext/phar/tests/bug79082.phpt

@@ -0,0 +1,52 @@
+--TEST--
+Phar: Bug #79082: Files added to tar with Phar::buildFromIterator have all-access permissions
+--SKIPIF--
+<?php 
+if (!extension_loaded("phar")) die("skip"); 
+if (defined("PHP_WINDOWS_VERSION_MAJOR")) die("skip not for Windows")
+?>
+--FILE--
+<?php
+umask(022);
+var_dump(decoct(umask()));
+chmod(__DIR__ . '/test79082/test79082-testfile', 0644);
+chmod(__DIR__ . '/test79082/test79082-testfile2', 0400);
+
+foreach([Phar::TAR => 'tar', Phar::ZIP => 'zip'] as $mode => $ext) {
+	clearstatcache();
+	$phar = new PharData(__DIR__ . '/test79082.' . $ext, null, null, $mode);
+	$phar->buildFromIterator(new \RecursiveDirectoryIterator(__DIR__ . '/test79082', \FilesystemIterator::SKIP_DOTS), __DIR__ . '/test79082');
+	$phar->extractTo(__DIR__);
+	var_dump(decoct(stat(__DIR__ . '/test79082-testfile')['mode']));
+	var_dump(decoct(stat(__DIR__ . '/test79082-testfile2')['mode']));
+	unlink(__DIR__ . '/test79082-testfile');
+	unlink(__DIR__ . '/test79082-testfile2');
+}
+foreach([Phar::TAR => 'tar', Phar::ZIP => 'zip'] as $mode => $ext) {
+	clearstatcache();
+	$phar = new PharData(__DIR__ . '/test79082-d.' . $ext, null, null, $mode);
+	$phar->buildFromDirectory(__DIR__ . '/test79082');
+	$phar->extractTo(__DIR__);
+	var_dump(decoct(stat(__DIR__ . '/test79082-testfile')['mode']));
+	var_dump(decoct(stat(__DIR__ . '/test79082-testfile2')['mode']));
+	unlink(__DIR__ . '/test79082-testfile');
+	unlink(__DIR__ . '/test79082-testfile2');
+}
+?>
+--CLEAN--
+<?
+unlink(__DIR__ . '/test79082.tar');
+unlink(__DIR__ . '/test79082.zip');
+unlink(__DIR__ . '/test79082-d.tar');
+unlink(__DIR__ . '/test79082-d.zip');
+?>
+--EXPECT--
+string(2) "22"
+string(6) "100644"
+string(6) "100400"
+string(6) "100644"
+string(6) "100400"
+string(6) "100644"
+string(6) "100400"
+string(6) "100644"
+string(6) "100400"

ext/phar/tests/test79082/test79082-testfile

@@ -0,0 +1 @@
+test

ext/phar/tests/test79082/test79082-testfile2

@@ -0,0 +1 @@
+test

ext/readline/tests/bug69054.phpt

@@ -3,7 +3,7 @@ Bug #69054 (Null dereference in readline_(read|write)_history() without paramete
 --SKIPIF--
 <?php if (!extension_loaded("readline") || !function_exists('readline_add_history')) die("skip"); ?>
 --INI--
-open_basedir={TMP}
+open_basedir="{TMP}"
 --FILE--
 <?php readline_read_history(); ?>
 ==DONE==

ext/reflection/php_reflection.c

@@ -4588,6 +4588,8 @@ ZEND_METHOD(reflection_class, isCloneable)
 			if (UNEXPECTED(object_init_ex(&obj, ce) != SUCCESS)) {
 				return;
 			}
+			/* We're not calling the constructor, so don't call the destructor either. */
+			zend_object_store_ctor_failed(Z_OBJ(obj));
 			RETVAL_BOOL(Z_OBJ_HANDLER(obj, clone_obj) != NULL);
 			zval_ptr_dtor(&obj);
 		}

ext/reflection/tests/bug79062.phpt

@@ -0,0 +1,34 @@
+--TEST--
+Bug #79062: Property with heredoc default value returns false for getDocComment
+--FILE--
+<?php
+
+class BugReportMailrcConfigTests
+{
+    /** @var string */
+    private $s1 = <<<STRING
+I'm a string :(
+STRING;
+    /** @var string */
+    private $s2 = <<<'STRING'
+I'm a string :)
+STRING;
+    /** @var string */
+    private $s3 = 'I\'m a string :)';
+}
+
+$ref = new \ReflectionClass(BugReportMailrcConfigTests::class);
+$s1 = $ref->getProperty('s1');
+var_dump($s1->getDocComment());
+
+$s2 = $ref->getProperty('s2');
+var_dump($s2->getDocComment());
+
+$s3 = $ref->getProperty('s3');
+var_dump($s2->getDocComment());
+
+?>
+--EXPECT--
+string(18) "/** @var string */"
+string(18) "/** @var string */"
+string(18) "/** @var string */"

ext/reflection/tests/bug79115.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug #79115: ReflectionClass::isCloneable call reflected class __destruct
+--FILE--
+<?php
+
+class A {
+    function __construct() { echo __FUNCTION__ . "\n"; }
+    function __destruct() { echo __FUNCTION__ . "\n"; }
+}
+
+$c = new ReflectionClass('A');
+var_dump($c->isCloneable());
+
+?>
+--EXPECT--
+bool(true)

ext/session/session.c

@@ -2223,7 +2223,7 @@ static PHP_FUNCTION(session_regenerate_id)
 		RETURN_FALSE;
 	}
 	if (PS(use_strict_mode) && PS(mod)->s_validate_sid &&
-		PS(mod)->s_validate_sid(&PS(mod_data), PS(id)) == FAILURE) {
+		PS(mod)->s_validate_sid(&PS(mod_data), PS(id)) == SUCCESS) {
 		zend_string_release_ex(PS(id), 0);
 		PS(id) = PS(mod)->s_create_sid(&PS(mod_data));
 		if (!PS(id)) {
@@ -2285,8 +2285,9 @@ static PHP_FUNCTION(session_create_id)
 				break;
 			} else {
 				/* Detect collision and retry */
-				if (PS(mod)->s_validate_sid(&PS(mod_data), new_id) == FAILURE) {
+				if (PS(mod)->s_validate_sid(&PS(mod_data), new_id) == SUCCESS) {
 					zend_string_release_ex(new_id, 0);
+                    new_id = NULL;
 					continue;
 				}
 				break;
@@ -3307,10 +3308,12 @@ static int php_session_rfc1867_callback(unsigned int event, void *event_data, vo
 				if (PS(rfc1867_cleanup)) {
 					php_session_rfc1867_cleanup(progress);
 				} else {
-					SEPARATE_ARRAY(&progress->data);
-					add_assoc_bool_ex(&progress->data, "done", sizeof("done") - 1, 1);
-					Z_LVAL_P(progress->post_bytes_processed) = data->post_bytes_processed;
-					php_session_rfc1867_update(progress, 1);
+					if (!Z_ISUNDEF(progress->data)) {
+						SEPARATE_ARRAY(&progress->data);
+						add_assoc_bool_ex(&progress->data, "done", sizeof("done") - 1, 1);
+						Z_LVAL_P(progress->post_bytes_processed) = data->post_bytes_processed;
+						php_session_rfc1867_update(progress, 1);
+					}
 				}
 				php_rshutdown_session_globals();
 			}

ext/session/tests/bug32330.phpt

@@ -6,7 +6,7 @@ Bug #32330 (session_destroy, "Failed to initialize storage module", custom sessi
 session.use_trans_sid=0
 session.use_cookies=1
 session.name=sid
-session.save_path={TMP}
+session.save_path="{TMP}"
 session.gc_probability=1
 session.gc_divisor=1
 session.save_handler=files

ext/session/tests/bug79091.phpt

@@ -0,0 +1,67 @@
+--TEST--
+Bug #79091 (heap use-after-free in session_create_id())
+--SKIPIF--
+<?php
+if (!extension_loaded('session')) die('skip session extension not available');
+?>
+--FILE--
+<?php
+class MySessionHandler implements SessionHandlerInterface, SessionIdInterface, SessionUpdateTimestampHandlerInterface
+{
+    public function close()
+    {
+        return true;
+    }
+
+    public function destroy($session_id)
+    {
+        return true;
+    }
+
+    public function gc($maxlifetime)
+    {
+        return true;
+    }
+
+    public function open($save_path, $session_name)
+    {
+        return true;
+    }
+
+    public function read($session_id)
+    {
+        return '';
+    }
+
+    public function write($session_id, $session_data)
+    {
+        return true;
+    }
+
+    public function create_sid()
+    {
+        return uniqid();
+    }
+
+    public function updateTimestamp($key, $val)
+    {
+        return true;
+    }
+
+    public function validateId($key)
+    {
+        return true;
+    }
+}
+
+ob_start();
+var_dump(session_set_save_handler(new MySessionHandler()));
+var_dump(session_start());
+ob_flush();
+session_create_id();
+?>
+--EXPECTF--
+bool(true)
+bool(true)
+
+Warning: session_create_id(): Failed to create new ID in %s on line %d

ext/session/tests/bug79221.phpt

@@ -0,0 +1,45 @@
+--TEST--
+Null Pointer Dereference in PHP Session Upload Progress
+--INI--
+error_reporting=0
+file_uploads=1
+upload_max_filesize=1024
+session.save_path=
+session.name=PHPSESSID
+session.serialize_handler=php
+session.use_strict_mode=0
+session.use_cookies=1
+session.use_only_cookies=0
+session.upload_progress.enabled=1
+session.upload_progress.cleanup=0
+session.upload_progress.prefix=upload_progress_
+session.upload_progress.name=PHP_SESSION_UPLOAD_PROGRESS
+session.upload_progress.freq=1%
+session.upload_progress.min_freq=0.000000001
+--COOKIE--
+PHPSESSID=session-upload
+--POST_RAW--
+Content-Type: multipart/form-data; boundary=---------------------------20896060251896012921717172737
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="PHPSESSID"
+
+session-upload
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; name="PHP_SESSION_UPLOAD_PROGRESS"
+
+ryat
+-----------------------------20896060251896012921717172737
+Content-Disposition: form-data; file="file"; ryat="filename"
+
+1
+-----------------------------20896060251896012921717172737--
+--FILE--
+<?php
+
+session_start();
+var_dump($_SESSION);
+session_destroy();
+
+--EXPECTF--
+array(0) {
+}

ext/session/tests/bug79413.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Bug #79413 (session_create_id() fails for active sessions)
+--SKIPIF--
+<?php
+if (!extension_loaded('session')) die('skip session extension not available');
+?>
+--FILE--
+<?php
+session_start();
+$old = session_id();
+$new = session_create_id();
+var_dump($new !== $old);
+?>
+--EXPECT--
+bool(true)