Prepare 7.3.22 tag

Prepare for 7.3.22RC1
Fix HTTP response status code
2026-11-11 11:10:49 +00:00 · 2020-09-01 10:33:15 +02:00 · 2020-08-18 09:19:25 +02:00 · 2020-08-18 08:33:45 +02:00 · 2020-08-14 15:51:31 +02:00 · 2020-08-11 17:12:48 +02:00
101 changed files with 1519 additions and 711 deletions
@@ -1,6 +1,92 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? ????, PHP 7.3.20
+03 Sep 2020, PHP 7.3.22
+
+- Core:
+  . Fixed bug #79884 (PHP_CONFIG_FILE_PATH is meaningless). (cmb)
+  . Fixed bug #77932 (File extensions are case-sensitive). (cmb)
+  . Fixed bug #79806 (realpath() erroneously resolves link to link). (cmb)
+  . Fixed bug #79895 (PHP_CHECK_GCC_ARG does not allow flags with equal sign).
+    (Santiago M. Mola)
+  . Fixed bug #79919 (Stack use-after-scope in define()). (cmb)
+  . Fixed bug #79934 (CRLF-only line in heredoc causes parsing error).
+    (Pieter van den Ham)
+
+- COM:
+  . Fixed bug #48585 (com_load_typelib holds reference, fails on second call).
+    (cmb)
+
+- Exif:
+  . Fixed bug #75785 (Many errors from exif_read_data).
+    (Níckolas Daniel da Silva)
+
+- Gettext:
+  . Fixed bug #70574 (Tests fail due to relying on Linux fallback behavior for
+    gettext()). (Florian Engelhardt)
+
+- LDAP:
+  . Fixed memory leaks. (ptomulik)
+
+- OPcache:
+  . Fixed bug #73060 (php failed with error after temp folder cleaned up).
+    (cmb)
+
+- PDO:
+  . Fixed bug #64705 (errorInfo property of PDOException is null when
+    PDO::__construct() fails). (Ahmed Abdou)
+
+- Standard:
+  . Fixed bug #79930 (array_merge_recursive() crashes when called with array
+    with single reference). (Nikita)
+  . Fixed bug #79944 (getmxrr always returns true on Alpine linux). (Nikita)
+  . Fixed bug #79951 (Memory leak in str_replace of empty string). (Nikita)
+
+- XML:
+  . Fixed bug #79922 (Crash after multiple calls to xml_parser_free()). (cmb)
+
+06 Aug 2020, PHP 7.3.21
+
+- Apache:
+  . Fixed bug #79030 (Upgrade apache2handler's php_apache_sapi_get_request_time
+    to return usec). (Herbert256)
+
+- Core:
+  . Fixed bug #79877 (getimagesize function silently truncates after a null 
+    byte) (cmb)
+  . Fixed bug #79778 (Assertion failure if dumping closure with unresolved
+    static variable). (Nikita)
+  . Fixed bug #79792 (HT iterators not removed if empty array is destroyed).
+    (Nikita)
+
+- COM:
+  . Fixed bug #63208 (BSTR to PHP string conversion not binary safe). (cmb)
+  . Fixed bug #63527 (DCOM does not work with Username, Password parameter).
+    (cmb)
+
+- Curl:
+  . Fixed bug #79741 (curl_setopt CURLOPT_POSTFIELDS asserts on object with
+    declared properties). (Nikita)
+
+- Fileinfo:
+  . Fixed bug #79756 (finfo_file crash (FILEINFO_MIME)). (cmb)
+
+- FTP:
+  . Fixed bug #55857 (ftp_size on large files). (cmb)
+
+- Mbstring:
+  . Fixed bug #79787 (mb_strimwidth does not trim string). (XXiang)
+
+- Phar:
+  . Fixed bug #79797 (Use of freed hash key in the phar_parse_zipfile
+    function). (CVE-2020-7068) (cmb)
+
+- Standard:
+  . Fixed bug #70362 (Can't copy() large 'data://' with open_basedir). (cmb)
+  . Fixed bug #79817 (str_replace() does not handle INDIRECT elements). (Nikita)
+  . Fixed bug #78008 (dns_check_record() always return true on Alpine).
+    (Andy Postnikov)
+
+09 Jul 2020, PHP 7.3.20

 - Core:
  . Fixed bug #79650 (php-win.exe 100% cpu lockup). (cmb)
@@ -26,7 +26,7 @@ namespace N2 {
    echo $a->hello(), PHP_EOL;
    echo $a->foo(), PHP_EOL;
    try {
-    } catch(namespace \Foo $e)
+    } catch(namespace\Foo $e)
    {
    }
 }
@@ -0,0 +1,26 @@
+--TEST--
+Bug #79778: Assertion failure if dumping closure with unresolved static variable
+--FILE--
+<?php
+$closure1 = function() {
+    static $var = CONST_REF;
+};
+var_dump($closure1);
+print_r($closure1);
+?>
+--EXPECT--
+object(Closure)#1 (1) {
+  ["static"]=>
+  array(1) {
+    ["var"]=>
+    string(14) "<constant ast>"
+  }
+}
+Closure Object
+(
+    [static] => Array
+        (
+            [var] => <constant ast>
+        )
+
+)
@@ -0,0 +1,16 @@
+--TEST--
+Bug #79792: HT iterators not removed if empty array is destroyed
+--FILE--
+<?php
+$a = [42];
+foreach ($a as &$c) {
+    // Make the array empty.
+    unset($a[0]);
+    // Destroy the array.
+    $a = null;
+}
+?>
+===DONE===
+--EXPECTF--
+Warning: Invalid argument supplied for foreach() in %s on line %d
+===DONE===
@@ -0,0 +1,14 @@
+--TEST--
+Bug #79919 (Stack use-after-scope in define())
+--SKIPIF--
+<?php
+if (!extension_loaded('simplexml')) die('skip simplexml extension not available');
+?>
+--FILE--
+<?php
+$b = error_log(0);
+$b = simplexml_load_string('<xml/>', null, $b);
+define(0, $b);
+?>
+--EXPECT--
+0
@@ -0,0 +1,29 @@
+--TEST--
+Bug #79934: CRLF-only line in heredoc causes parsing error
+--DESCRIPTION--
+This test covers different variations of whitespace-only lines in heredoc strings.
+These whitespace-only lines should be ignored when stripping indentation.
+--FILE--
+<?php
+// lines with only CRLF should not cause a parse error
+eval("\$s1 = <<<HEREDOC\r\n    a\r\n\r\n    b\r\n    HEREDOC;");
+var_dump(addcslashes($s1, "\r\n"));
+
+// lines with only a LF should not cause a parse error
+eval("\$s2 = <<<HEREDOC\n    a\n\n    b\n    HEREDOC;");
+var_dump(addcslashes($s2, "\n"));
+
+// lines with only a CR should not cause a parse error
+eval("\$s3 = <<<HEREDOC\r    a\r\r    b\r    HEREDOC;");
+var_dump(addcslashes($s3, "\r"));
+
+// lines with only whitespace should not cause a parse error
+eval("\$s4 = <<<HEREDOC\r    a\r\n  \r\n    b\r    HEREDOC;");
+var_dump(addcslashes($s4, "\n\r"));
+
+?>
+--EXPECT--
+string(10) "a\r\n\r\nb"
+string(6) "a\n\nb"
+string(6) "a\r\rb"
+string(10) "a\r\n\r\nb"
@@ -0,0 +1,20 @@
+--TEST--
+Leak when setting recursive previous exception in finally handling
+--FILE--
+<?php
+
+try {
+    try {
+        throw new Exception("Test");
+    } catch (Exception $e) {
+        throw $e;
+    } finally {
+        throw $e;
+    }
+} catch (Exception $e2) {
+    echo $e2->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+Test
@@ -20,7 +20,7 @@
 #ifndef ZEND_H
 #define ZEND_H

-#define ZEND_VERSION "3.3.20-dev"
+#define ZEND_VERSION "3.3.22"

 #define ZEND_ENGINE_3

@@ -882,9 +882,7 @@ repeat:
 		case IS_OBJECT:
 			if (Z_TYPE(val_free) == IS_UNDEF) {
 				if (Z_OBJ_HT_P(val)->get) {
-					zval rv;
-					val = Z_OBJ_HT_P(val)->get(val, &rv);
-					ZVAL_COPY_VALUE(&val_free, val);
+					val = Z_OBJ_HT_P(val)->get(val, &val_free);
 					goto repeat;
 				} else if (Z_OBJ_HT_P(val)->cast_object) {
 					if (Z_OBJ_HT_P(val)->cast_object(val, &val_free, IS_STRING) == SUCCESS) {
@@ -506,9 +506,16 @@ static HashTable *zend_closure_get_debug_info(zval *object, int *is_temp) /* {{{
 	debug_info = zend_new_array(8);

 	if (closure->func.type == ZEND_USER_FUNCTION && closure->func.op_array.static_variables) {
+		zval *var;
 		HashTable *static_variables = closure->func.op_array.static_variables;
 		ZVAL_ARR(&val, zend_array_dup(static_variables));
 		zend_hash_update(debug_info, ZSTR_KNOWN(ZEND_STR_STATIC), &val);
+		ZEND_HASH_FOREACH_VAL(Z_ARRVAL(val), var) {
+			if (Z_TYPE_P(var) == IS_CONSTANT_AST) {
+				zval_ptr_dtor(var);
+				ZVAL_STRING(var, "<constant ast>");
+			}
+		} ZEND_HASH_FOREACH_END();
 	}

 	if (Z_TYPE(closure->this_ptr) != IS_UNDEF) {
@@ -76,9 +76,15 @@ void zend_exception_set_previous(zend_object *exception, zend_object *add_previo
 	zval  pv, zv, rv;
 	zend_class_entry *base_ce;

-	if (exception == add_previous || !add_previous || !exception) {
+	if (!exception || !add_previous) {
 		return;
 	}
+
+	if (exception == add_previous) {
+		OBJ_RELEASE(add_previous);
+		return;
+	}
+
 	ZVAL_OBJ(&pv, add_previous);
 	if (!instanceof_function(Z_OBJCE(pv), zend_ce_throwable)) {
 		zend_error_noreturn(E_CORE_ERROR, "Previous exception must implement Throwable");
@@ -253,10 +253,6 @@ static void zend_generator_free_storage(zend_object *object) /* {{{ */
 	}

 	zend_object_std_dtor(&generator->std);
-
-	if (generator->iterator) {
-		zend_iterator_dtor(generator->iterator);
-	}
 }
 /* }}} */

@@ -1504,11 +1504,11 @@ ZEND_API void ZEND_FASTCALL zend_array_destroy(HashTable *ht)
 				}
 			} while (++p != end);
 		}
-		zend_hash_iterators_remove(ht);
-		SET_INCONSISTENT(HT_DESTROYED);
 	} else if (EXPECTED(!(HT_FLAGS(ht) & HASH_FLAG_INITIALIZED))) {
 		goto free_ht;
 	}
+	zend_hash_iterators_remove(ht);
+	SET_INCONSISTENT(HT_DESTROYED);
 	efree(HT_GET_DATA_ADDR(ht));
 free_ht:
 	FREE_HASHTABLE(ht);
@@ -1112,6 +1112,7 @@ static const char *next_newline(const char *str, const char *end, size_t *newlin
 	for (; str < end; str++) {
 		if (*str == '\r') {
 			*newline_len = str + 1 < end && *(str + 1) == '\n' ? 2 : 1;
+			return str;
 		} else if (*str == '\n') {
 			*newline_len = 1;
 			return str;
@@ -1,5 +1,4 @@
-/* Generated by re2c 1.0.1 */
-#line 3 "Zend/zend_language_scanner_defs.h"
+/* Generated by re2c 1.3 */

 enum YYCONDTYPE {
 	yycST_IN_SCRIPTING,
@@ -845,6 +845,7 @@ static size_t tsrm_realpath_r(char *path, size_t start, size_t len, int *ll, tim
 		}

 #ifdef ZEND_WIN32
+retry_reparse_point:
 		if (save) {
 			pathw = php_win32_ioutil_any_to_w(path);
 			if (!pathw) {
@@ -867,7 +868,7 @@ static size_t tsrm_realpath_r(char *path, size_t start, size_t len, int *ll, tim
 		tmp = do_alloca(len+1, use_heap);
 		memcpy(tmp, path, len+1);

-retry:
+retry_reparse_tag_cloud:
 		if(save &&
 				!(IS_UNC_PATH(path, len) && len >= 3 && path[2] != '?') &&
                               (dataw.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT)
@@ -928,7 +929,7 @@ retry:
 					dataw.dwFileAttributes = fileInformation.dwFileAttributes;
 					CloseHandle(hLink);
 					(*ll)--;
-					goto retry;
+					goto retry_reparse_tag_cloud;
 				}
 				free_alloca(tmp, use_heap);
 				CloseHandle(hLink);
@@ -1075,6 +1076,22 @@ retry:
 			free_alloca(pbuffer, use_heap_large);
 			free(substitutename);

+			{
+				DWORD attrs;
+
+				FREE_PATHW()
+				pathw = php_win32_ioutil_any_to_w(path);
+				if (!pathw) {
+					return (size_t)-1;
+				}
+				attrs = GetFileAttributesW(pathw);
+				if (!isVolume && attrs != INVALID_FILE_ATTRIBUTES && (attrs & FILE_ATTRIBUTE_REPARSE_POINT)) {
+					free_alloca(tmp, use_heap);
+					FREE_PATHW()
+					goto retry_reparse_point;
+				}
+			}
+
 			if(isabsolute == 1) {
 				if (!((j == 3) && (path[1] == ':') && (path[2] == '\\'))) {
 					/* use_realpath is 0 in the call below coz path is absolute*/
@@ -329,8 +329,8 @@ dnl
 dnl PHP_CHECK_GCC_ARG(arg, action-if-found, action-if-not-found)
 dnl
 AC_DEFUN([PHP_CHECK_GCC_ARG],[
-  gcc_arg_name=[ac_cv_gcc_arg]translit($1,A-Z-,a-z_)
-  AC_CACHE_CHECK([whether $CC supports $1], [ac_cv_gcc_arg]translit($1,A-Z-,a-z_), [
+  gcc_arg_name=[ac_cv_gcc_arg]translit($1,A-Z=-,a-z__)
+  AC_CACHE_CHECK([whether $CC supports $1], [ac_cv_gcc_arg]translit($1,A-Z=-,a-z__), [
  echo 'void somefunc() { };' > conftest.c
  cmd='$CC $1 -c conftest.c'
  if eval $cmd 2>&1 | $EGREP -e $1 >/dev/null ; then
@@ -107,8 +107,8 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=3
-PHP_RELEASE_VERSION=20
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=22
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -133,7 +133,7 @@ PHP_FUNCTION(com_create_instance)
 		info.pwszName = php_com_string_to_olestring(server_name, server_name_len, obj->code_page);

 		if (user_name) {
-			authid.User = php_com_string_to_olestring(user_name, -1, obj->code_page);
+			authid.User = (OLECHAR*)user_name;
 			authid.UserLength = (ULONG)user_name_len;

 			if (password) {
@@ -248,7 +248,7 @@ PHP_FUNCTION(com_create_instance)
 		TL = php_com_load_typelib_via_cache(typelib_name, obj->code_page, &cached);

 		if (TL) {
-			if (COMG(autoreg_on) && !cached) {
+			if (COMG(autoreg_on)) {
 				php_com_import_typelib(TL, mode, obj->code_page);
 			}

@@ -838,9 +838,7 @@ PHP_FUNCTION(com_load_typelib)
 	php_com_initialize();
 	pTL = php_com_load_typelib_via_cache(name, codepage, &cached);
 	if (pTL) {
-		if (cached) {
-			RETVAL_TRUE;
-		} else if (php_com_import_typelib(pTL, cs ? CONST_CS : 0, codepage) == SUCCESS) {
+		if (php_com_import_typelib(pTL, cs ? CONST_CS : 0, codepage) == SUCCESS) {
 			RETVAL_TRUE;
 		}

@@ -252,9 +252,7 @@ static PHP_INI_MH(OnTypeLibFileUpdate)
 		}

 		if ((pTL = php_com_load_typelib_via_cache(typelib_name, COMG(code_page), &cached)) != NULL) {
-			if (!cached) {
-				php_com_import_typelib(pTL, mode, COMG(code_page));
-			}
+			php_com_import_typelib(pTL, mode, COMG(code_page));
 			ITypeLib_Release(pTL);
 		}
 	}
@@ -103,3 +103,58 @@ PHP_COM_DOTNET_API char *php_com_olestring_to_string(OLECHAR *olestring, size_t

 	return string;
 }
+
+BSTR php_com_string_to_bstr(zend_string *string, int codepage)
+{
+	BSTR bstr = NULL;
+	DWORD flags = codepage == CP_UTF8 ? 0 : MB_PRECOMPOSED | MB_ERR_INVALID_CHARS;
+	size_t mb_len = ZSTR_LEN(string);
+	int wc_len;
+
+	if ((wc_len = MultiByteToWideChar(codepage, flags, ZSTR_VAL(string), (int)mb_len + 1, NULL, 0)) <= 0) {
+		goto fail;
+	}
+	if ((bstr = SysAllocStringLen(NULL, (UINT)(wc_len - 1))) == NULL) {
+		goto fail;
+	}
+	if ((wc_len = MultiByteToWideChar(codepage, flags, ZSTR_VAL(string), (int)mb_len + 1, bstr, wc_len)) <= 0) {
+		goto fail;
+	}
+	return bstr;
+
+fail:
+	char *msg = php_win32_error_to_msg(GetLastError());
+	php_error_docref(NULL, E_WARNING,
+		"Could not convert string to unicode: `%s'", msg);
+	LocalFree(msg);
+	SysFreeString(bstr);
+	return SysAllocString(L"");
+}
+
+zend_string *php_com_bstr_to_string(BSTR bstr, int codepage)
+{
+	zend_string *string = NULL;
+	UINT wc_len = SysStringLen(bstr);
+	int mb_len;
+
+	mb_len = WideCharToMultiByte(codepage, 0, bstr, wc_len + 1, NULL, 0, NULL, NULL);
+	if (mb_len > 0) {
+		string = zend_string_alloc(mb_len - 1, 0);
+		mb_len = WideCharToMultiByte(codepage, 0, bstr, wc_len + 1, ZSTR_VAL(string), mb_len, NULL, NULL);
+	}
+
+	if (mb_len <= 0) {
+		char *msg = php_win32_error_to_msg(GetLastError());
+
+		php_error_docref(NULL, E_WARNING,
+			"Could not convert string from unicode: `%s'", msg);
+		LocalFree(msg);
+
+		if (string != NULL) {
+			zend_string_release(string);
+		}
+		string = ZSTR_EMPTY_ALLOC();
+	}
+
+	return string;
+}
@@ -96,7 +96,6 @@ bogus:

 PHP_COM_DOTNET_API void php_com_variant_from_zval(VARIANT *v, zval *z, int codepage)
 {
-	OLECHAR *olestring;
 	php_com_dotnet_object *obj;
 	zend_uchar ztype = IS_NULL;

@@ -164,13 +163,7 @@ PHP_COM_DOTNET_API void php_com_variant_from_zval(VARIANT *v, zval *z, int codep

 		case IS_STRING:
 			V_VT(v) = VT_BSTR;
-			olestring = php_com_string_to_olestring(Z_STRVAL_P(z), Z_STRLEN_P(z), codepage);
-			if (CP_UTF8 == codepage) {
-				V_BSTR(v) = SysAllocStringByteLen((char*)olestring, (UINT)(wcslen(olestring) * sizeof(OLECHAR)));
-			} else {
-				V_BSTR(v) = SysAllocStringByteLen((char*)olestring, (UINT)(Z_STRLEN_P(z) * sizeof(OLECHAR)));
-			}
-			efree(olestring);
+			V_BSTR(v) = php_com_string_to_bstr(Z_STR_P(z), codepage);
 			break;

 		case IS_RESOURCE:
@@ -236,12 +229,8 @@ PHP_COM_DOTNET_API int php_com_zval_from_variant(zval *z, VARIANT *v, int codepa
 		case VT_BSTR:
 			olestring = V_BSTR(v);
 			if (olestring) {
-				size_t len;
-				char *str = php_com_olestring_to_string(olestring,
-					&len, codepage);
-				ZVAL_STRINGL(z, str, len);
-				// TODO: avoid reallocation???
-				efree(str);
+				zend_string *str = php_com_bstr_to_string(olestring, codepage);
+				ZVAL_STR(z, str);
 				olestring = NULL;
 			}
 			break;
@@ -89,6 +89,8 @@ PHP_COM_DOTNET_API char *php_com_olestring_to_string(OLECHAR *olestring,
 		size_t *string_len, int codepage);
 PHP_COM_DOTNET_API OLECHAR *php_com_string_to_olestring(char *string,
 		size_t string_len, int codepage);
+BSTR php_com_string_to_bstr(zend_string *string, int codepage);
+zend_string *php_com_bstr_to_string(BSTR bstr, int codepage);


 /* com_com.c */
@@ -0,0 +1,17 @@
+--TEST--
+Bug #63208 (BSTR to PHP string conversion not binary safe)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+?>
+--FILE--
+<?php
+$string = "\u{0905}b\0cd";
+$variant = new VARIANT($string, VT_ARRAY | VT_UI1, CP_UTF8); // Array of bytes
+$converted = (string) $variant;
+var_dump(bin2hex($string));
+var_dump(bin2hex($converted));
+?>
+--EXPECT--
+string(14) "e0a48562006364"
+string(14) "e0a48562006364"
@@ -2719,7 +2719,7 @@ static int _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue) /* {{{
 				return FAILURE;
 			}

-			ZEND_HASH_FOREACH_VAL(ph, current) {
+			ZEND_HASH_FOREACH_VAL_IND(ph, current) {
 				ZVAL_DEREF(current);
 				val = zval_get_tmp_string(current, &tmp_val);
 				slist = curl_slist_append(slist, ZSTR_VAL(val));
@@ -2797,7 +2797,7 @@ static int _php_curl_setopt(php_curl *ch, zend_long option, zval *zvalue) /* {{{
 				}
 #endif

-				ZEND_HASH_FOREACH_KEY_VAL(postfields, num_key, string_key, current) {
+				ZEND_HASH_FOREACH_KEY_VAL_IND(postfields, num_key, string_key, current) {
 					zend_string *postval, *tmp_postval;
 					/* Pretend we have a string_key here */
 					if (!string_key) {
@@ -0,0 +1,16 @@
+--TEST--
+Bug #79741: curl_setopt CURLOPT_POSTFIELDS asserts on object with declared properties
+--FILE--
+<?php
+
+class Test {
+	public $prop = "value";
+}
+
+$ch = curl_init();
+curl_setopt($ch, CURLOPT_POSTFIELDS, new Test);
+
+?>
+===DONE===
+--EXPECT--
+===DONE===
@@ -66,7 +66,7 @@ typedef unsigned char uchar;

 #define EFREE_IF(ptr)	if (ptr) efree(ptr)

-#define MAX_IFD_NESTING_LEVEL 150
+#define MAX_IFD_NESTING_LEVEL 200

 /* {{{ arginfo */
 ZEND_BEGIN_ARG_INFO(arginfo_exif_tagname, 0)
@@ -3173,6 +3173,23 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu

 	NumDirEntries = php_ifd_get16u(dir_start, ImageInfo->motorola_intel);

+	/* It can be that motorola_intel is wrongly mapped, let's try inverting it */
+	if ((2+NumDirEntries*12) > value_len) {
+		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Potentially invalid endianess, trying again with different endianness before imminent failure.");
+
+		ImageInfo->motorola_intel = ImageInfo->motorola_intel == 0 ? 1 : 0;
+		NumDirEntries = php_ifd_get16u(dir_start, ImageInfo->motorola_intel);
+	}
+
+	if ((2+NumDirEntries*12) > value_len) {
+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 2 + 0x%04X*12 = 0x%04X > 0x%04X", NumDirEntries, 2+NumDirEntries*12, value_len);
+		return FALSE;
+	}
+	if ((dir_start - value_ptr) > value_len - (2+NumDirEntries*12)) {
+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 0x%04X > 0x%04X", (dir_start - value_ptr) + (2+NumDirEntries*12), value_len);
+		return FALSE;
+	}
+
 	switch (maker_note->offset_mode) {
 		case MN_OFFSET_MAKER:
 			offset_base = value_ptr;
@@ -3203,15 +3220,6 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 			break;
 	}

-	if ((2+NumDirEntries*12) > value_len) {
-		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 2 + 0x%04X*12 = 0x%04X > 0x%04X", NumDirEntries, 2+NumDirEntries*12, value_len);
-		return FALSE;
-	}
-	if ((dir_start - value_ptr) > value_len - (2+NumDirEntries*12)) {
-		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 0x%04X > 0x%04X", (dir_start - value_ptr) + (2+NumDirEntries*12), value_len);
-		return FALSE;
-	}
-
 	for (de=0;de<NumDirEntries;de++) {
 		size_t offset = 2 + 12 * de;
 		if (!exif_process_IFD_TAG(ImageInfo, dir_start + offset,
@@ -0,0 +1,17 @@
+--TEST--
+Bug #75785 fix corrupt EXIF header issues; Related to mixed endianness. (Thank you @Richard Matzinger for providing the test photo)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+$mixedEndiannessFile = dirname(__FILE__).'/P1000506.JPG';
+$tags = exif_read_data($mixedEndiannessFile, 'EXIF', true, false);
+
+echo $tags['GPS']['GPSLatitude'][0] . PHP_EOL;
+echo $tags['GPS']['GPSLongitude'][0] . PHP_EOL;
+?>
+===DONE===
+--EXPECTF--
+38/1
+122/1
+===DONE===
@@ -0,0 +1,16 @@
+--TEST--
+Bug #79756 (finfo_file crash (FILEINFO_MIME))
+--SKIPIF--
+<?php
+if (!extension_loaded('fileinfo')) die('skip fileinfo extension not available');
+?>
+--FILE--
+<?php
+$filename = __DIR__ . '/bug79756.xls';
+$finfo = finfo_open(FILEINFO_MIME);
+$mime = finfo_file($finfo, $filename);
+finfo_close($finfo);
+echo $mime;
+?>
+--EXPECT--
+application/vnd.ms-excel; charset=binary
@@ -1133,6 +1133,8 @@ bail:
 zend_long
 ftp_size(ftpbuf_t *ftp, const char *path, const size_t path_len)
 {
+	zend_long res;
+
 	if (ftp == NULL) {
 		return -1;
 	}
@@ -1145,7 +1147,8 @@ ftp_size(ftpbuf_t *ftp, const char *path, const size_t path_len)
 	if (!ftp_getresp(ftp) || ftp->resp != 213) {
 		return -1;
 	}
-	return atol(ftp->inbuf);
+	ZEND_ATOL(res, ftp->inbuf);
+	return res;
 }
 /* }}} */

@@ -167,15 +167,17 @@ static void _php_ldap_control_to_array(LDAP *ld, LDAPControl* ctrl, zval* array,
 		}
 	} else if (strcmp(ctrl->ldctl_oid, LDAP_CONTROL_PAGEDRESULTS) == 0) {
 		int lestimated, rc;
-		struct berval lcookie;
+		struct berval lcookie = { 0L, NULL };
 		zval value;

 		if (ctrl->ldctl_value.bv_len) {
+			/* ldap_parse_pageresponse_control() allocates lcookie.bv_val */
 			rc = ldap_parse_pageresponse_control(ld, ctrl, &lestimated, &lcookie);
 		} else {
 			/* ldap_parse_pageresponse_control will crash if value is empty */
 			rc = -1;
 		}
+
 		if ( rc == LDAP_SUCCESS ) {
 			array_init(&value);
 			add_assoc_long(&value, "size", lestimated);
@@ -184,6 +186,10 @@ static void _php_ldap_control_to_array(LDAP *ld, LDAPControl* ctrl, zval* array,
 		} else {
 			add_assoc_null(array, "value");
 		}
+
+		if (lcookie.bv_val) {
+			ldap_memfree(lcookie.bv_val);
+		}
 	} else if ((strcmp(ctrl->ldctl_oid, LDAP_CONTROL_PRE_READ) == 0) || (strcmp(ctrl->ldctl_oid, LDAP_CONTROL_POST_READ) == 0)) {
 		BerElement *ber;
 		struct berval bv;
@@ -283,7 +289,8 @@ static int _php_ldap_control_from_array(LDAP *ld, LDAPControl** ctrl, zval* arra
 	int control_iscritical = 0, rc = LDAP_SUCCESS;
 	char** ldap_attrs = NULL;
 	LDAPSortKey** sort_keys = NULL;
-	zend_string *tmpstring = NULL;
+	zend_string *tmpstring = NULL, **tmpstrings1 = NULL, **tmpstrings2 = NULL;
+	size_t num_tmpstrings1 = 0, num_tmpstrings2 = 0;

 	if ((val = zend_hash_str_find(Z_ARRVAL_P(array), "oid", sizeof("oid") - 1)) == NULL) {
 		php_error_docref(NULL, E_WARNING, "Control must have an oid key");
@@ -301,27 +308,23 @@ static int _php_ldap_control_from_array(LDAP *ld, LDAPControl** ctrl, zval* arra
 		control_iscritical = 0;
 	}

-	struct berval *control_value = NULL;
+	BerElement *ber = NULL;
+	struct berval control_value = { 0L, NULL };
+	int control_value_alloc = 0;

 	if ((val = zend_hash_str_find(Z_ARRVAL_P(array), "value", sizeof("value") - 1)) != NULL) {
 		if (Z_TYPE_P(val) != IS_ARRAY) {
-			control_value = ber_memalloc(sizeof * control_value);
-			if (control_value == NULL) {
+			tmpstring = zval_get_string(val);
+			if (EG(exception)) {
 				rc = -1;
-				php_error_docref(NULL, E_WARNING, "Failed to allocate control value");
-			} else {
-				tmpstring = zval_get_string(val);
-				if (EG(exception)) {
-					rc = -1;
-					goto failure;
-				}
-				control_value->bv_val = ZSTR_VAL(tmpstring);
-				control_value->bv_len = ZSTR_LEN(tmpstring);
+				goto failure;
 			}
+			control_value.bv_val = ZSTR_VAL(tmpstring);
+			control_value.bv_len = ZSTR_LEN(tmpstring);
 		} else if (strcmp(ZSTR_VAL(control_oid), LDAP_CONTROL_PAGEDRESULTS) == 0) {
 			zval* tmp;
 			int pagesize = 1;
-			struct berval cookie = { 0, NULL };
+			struct berval cookie = { 0L, NULL };
 			if ((tmp = zend_hash_str_find(Z_ARRVAL_P(val), "size", sizeof("size") - 1)) != NULL) {
 				pagesize = zval_get_long(tmp);
 			}
@@ -334,15 +337,11 @@ static int _php_ldap_control_from_array(LDAP *ld, LDAPControl** ctrl, zval* arra
 				cookie.bv_val = ZSTR_VAL(tmpstring);
 				cookie.bv_len = ZSTR_LEN(tmpstring);
 			}
-			control_value = ber_memalloc(sizeof * control_value);
-			if (control_value == NULL) {
-				rc = -1;
-				php_error_docref(NULL, E_WARNING, "Failed to allocate control value");
-			} else {
-				rc = ldap_create_page_control_value(ld, pagesize, &cookie, control_value);
-				if (rc != LDAP_SUCCESS) {
-					php_error_docref(NULL, E_WARNING, "Failed to create paged result control value: %s (%d)", ldap_err2string(rc), rc);
-				}
+			/* ldap_create_page_control_value() allocates memory for control_value.bv_val */
+			control_value_alloc = 1;
+			rc = ldap_create_page_control_value(ld, pagesize, &cookie, &control_value);
+			if (rc != LDAP_SUCCESS) {
+				php_error_docref(NULL, E_WARNING, "Failed to create paged result control value: %s (%d)", ldap_err2string(rc), rc);
 			}
 		} else if (strcmp(ZSTR_VAL(control_oid), LDAP_CONTROL_ASSERT) == 0) {
 			zval* tmp;
@@ -356,19 +355,15 @@ static int _php_ldap_control_from_array(LDAP *ld, LDAPControl** ctrl, zval* arra
 					rc = -1;
 					goto failure;
 				}
-				control_value = ber_memalloc(sizeof * control_value);
-				if (control_value == NULL) {
-					rc = -1;
-					php_error_docref(NULL, E_WARNING, "Failed to allocate control value");
-				} else {
-					/* ldap_create_assertion_control_value does not reset ld_errno, we need to do it ourselves
-					   See http://www.openldap.org/its/index.cgi/Incoming?id=8674 */
-					int success = LDAP_SUCCESS;
-					ldap_set_option(ld, LDAP_OPT_RESULT_CODE, &success);
-					rc = ldap_create_assertion_control_value(ld, ZSTR_VAL(assert), control_value);
-					if (rc != LDAP_SUCCESS) {
-						php_error_docref(NULL, E_WARNING, "Failed to create assert control value: %s (%d)", ldap_err2string(rc), rc);
-					}
+				/* ldap_create_assertion_control_value does not reset ld_errno, we need to do it ourselves
+					 See http://www.openldap.org/its/index.cgi/Incoming?id=8674 */
+				int success = LDAP_SUCCESS;
+				ldap_set_option(ld, LDAP_OPT_RESULT_CODE, &success);
+				/* ldap_create_assertion_control_value() allocates memory for control_value.bv_val */
+				control_value_alloc = 1;
+				rc = ldap_create_assertion_control_value(ld, ZSTR_VAL(assert), &control_value);
+				if (rc != LDAP_SUCCESS) {
+					php_error_docref(NULL, E_WARNING, "Failed to create assert control value: %s (%d)", ldap_err2string(rc), rc);
 				}
 				zend_string_release(assert);
 			}
@@ -378,9 +373,8 @@ static int _php_ldap_control_from_array(LDAP *ld, LDAPControl** ctrl, zval* arra
 				rc = -1;
 				php_error_docref(NULL, E_WARNING, "Filter missing from control value array");
 			} else {
-				BerElement *vrber = ber_alloc_t(LBER_USE_DER);
-				control_value = ber_memalloc(sizeof * control_value);
-				if ((control_value == NULL) || (vrber == NULL)) {
+				ber = ber_alloc_t(LBER_USE_DER);
+				if (ber == NULL) {
 					rc = -1;
 					php_error_docref(NULL, E_WARNING, "Failed to allocate control value");
 				} else {
@@ -389,15 +383,11 @@ static int _php_ldap_control_from_array(LDAP *ld, LDAPControl** ctrl, zval* arra
 						rc = -1;
 						goto failure;
 					}
-					if (ldap_put_vrFilter(vrber, ZSTR_VAL(tmpstring)) == -1) {
-						ber_free(vrber, 1);
+					if (ldap_put_vrFilter(ber, ZSTR_VAL(tmpstring)) == -1) {
 						rc = -1;
 						php_error_docref(NULL, E_WARNING, "Failed to create control value: Bad ValuesReturnFilter: %s", ZSTR_VAL(tmpstring));
-					} else {
-						if (ber_flatten2(vrber, control_value, 0) == -1) {
-							rc = -1;
-						}
-						ber_free(vrber, 1);
+					} else if (ber_flatten2(ber, &control_value, control_value_alloc) == -1) {
+						rc = -1;
 					}
 				}
 			}
@@ -407,10 +397,9 @@ static int _php_ldap_control_from_array(LDAP *ld, LDAPControl** ctrl, zval* arra
 				rc = -1;
 				php_error_docref(NULL, E_WARNING, "Attributes list missing from control value array");
 			} else {
-				BerElement *ber = ber_alloc_t(LBER_USE_DER);
+				ber = ber_alloc_t(LBER_USE_DER);

-				control_value = ber_memalloc(sizeof * control_value);
-				if ((control_value == NULL) || (ber == NULL)) {
+				if (ber == NULL) {
 					rc = -1;
 					php_error_docref(NULL, E_WARNING, "Failed to allocate control value");
 				} else {
@@ -419,6 +408,8 @@ static int _php_ldap_control_from_array(LDAP *ld, LDAPControl** ctrl, zval* arra

 					num_attribs = zend_hash_num_elements(Z_ARRVAL_P(tmp));
 					ldap_attrs = safe_emalloc((num_attribs+1), sizeof(char *), 0);
+					tmpstrings1 = safe_emalloc(num_attribs, sizeof(zend_string*), 0);
+					num_tmpstrings1 = 0;

 					for (i = 0; i<num_attribs; i++) {
 						if ((attr = zend_hash_index_find(Z_ARRVAL_P(tmp), i)) == NULL) {
@@ -427,12 +418,13 @@ static int _php_ldap_control_from_array(LDAP *ld, LDAPControl** ctrl, zval* arra
 							goto failure;
 						}

-						tmpstring = zval_get_string(attr);
+						tmpstrings1[num_tmpstrings1] = zval_get_string(attr);
 						if (EG(exception)) {
 							rc = -1;
 							goto failure;
 						}
-						ldap_attrs[i] = ZSTR_VAL(tmpstring);
+						ldap_attrs[i] = ZSTR_VAL(tmpstrings1[num_tmpstrings1]);
+						++num_tmpstrings1;
 					}
 					ldap_attrs[num_attribs] = NULL;

@@ -443,7 +435,7 @@ static int _php_ldap_control_from_array(LDAP *ld, LDAPControl** ctrl, zval* arra
 						php_error_docref(NULL, E_WARNING, "Failed to encode attribute list");
 					} else {
 						int err;
-						err = ber_flatten2(ber, control_value, 0);
+						err = ber_flatten2(ber, &control_value, control_value_alloc);
 						if (err < 0) {
 							rc = -1;
 							php_error_docref(NULL, E_WARNING, "Failed to encode control value (%d)", err);
@@ -457,6 +449,10 @@ static int _php_ldap_control_from_array(LDAP *ld, LDAPControl** ctrl, zval* arra

 			num_keys = zend_hash_num_elements(Z_ARRVAL_P(val));
 			sort_keys = safe_emalloc((num_keys+1), sizeof(LDAPSortKey*), 0);
+			tmpstrings1 = safe_emalloc(num_keys, sizeof(zend_string*), 0);
+			tmpstrings2 = safe_emalloc(num_keys, sizeof(zend_string*), 0);
+			num_tmpstrings1 = 0;
+			num_tmpstrings2 = 0;

 			for (i = 0; i<num_keys; i++) {
 				if ((sortkey = zend_hash_index_find(Z_ARRVAL_P(val), i)) == NULL) {
@@ -471,20 +467,22 @@ static int _php_ldap_control_from_array(LDAP *ld, LDAPControl** ctrl, zval* arra
 					goto failure;
 				}
 				sort_keys[i] = emalloc(sizeof(LDAPSortKey));
-				tmpstring = zval_get_string(tmp);
+				tmpstrings1[num_tmpstrings1] = zval_get_string(tmp);
 				if (EG(exception)) {
 					rc = -1;
 					goto failure;
 				}
-				sort_keys[i]->attributeType = ZSTR_VAL(tmpstring);
+				sort_keys[i]->attributeType = ZSTR_VAL(tmpstrings1[num_tmpstrings1]);
+				++num_tmpstrings1;

 				if ((tmp = zend_hash_str_find(Z_ARRVAL_P(sortkey), "oid", sizeof("oid") - 1)) != NULL) {
-					tmpstring = zval_get_string(tmp);
+					tmpstrings2[num_tmpstrings2] = zval_get_string(tmp);
 					if (EG(exception)) {
 						rc = -1;
 						goto failure;
 					}
-					sort_keys[i]->orderingRule = ZSTR_VAL(tmpstring);
+					sort_keys[i]->orderingRule = ZSTR_VAL(tmpstrings2[num_tmpstrings2]);
+					++num_tmpstrings2;
 				} else {
 					sort_keys[i]->orderingRule = NULL;
 				}
@@ -496,15 +494,11 @@ static int _php_ldap_control_from_array(LDAP *ld, LDAPControl** ctrl, zval* arra
 				}
 			}
 			sort_keys[num_keys] = NULL;
-			control_value = ber_memalloc(sizeof * control_value);
-			if (control_value == NULL) {
-				rc = -1;
-				php_error_docref(NULL, E_WARNING, "Failed to allocate control value");
-			} else {
-				rc = ldap_create_sort_control_value(ld, sort_keys, control_value);
-				if (rc != LDAP_SUCCESS) {
-					php_error_docref(NULL, E_WARNING, "Failed to create sort control value: %s (%d)", ldap_err2string(rc), rc);
-				}
+			/* ldap_create_sort_control_value() allocates memory for control_value.bv_val */
+			control_value_alloc = 1;
+			rc = ldap_create_sort_control_value(ld, sort_keys, &control_value);
+			if (rc != LDAP_SUCCESS) {
+				php_error_docref(NULL, E_WARNING, "Failed to create sort control value: %s (%d)", ldap_err2string(rc), rc);
 			}
 		} else if (strcmp(ZSTR_VAL(control_oid), LDAP_CONTROL_VLVREQUEST) == 0) {
 			zval* tmp;
@@ -566,15 +560,11 @@ static int _php_ldap_control_from_array(LDAP *ld, LDAPControl** ctrl, zval* arra
 				vlvInfo.ldvlv_context = NULL;
 			}

-			control_value = ber_memalloc(sizeof * control_value);
-			if (control_value == NULL) {
-				rc = -1;
-				php_error_docref(NULL, E_WARNING, "Failed to allocate control value");
-			} else {
-				rc = ldap_create_vlv_control_value(ld, &vlvInfo, control_value);
-				if (rc != LDAP_SUCCESS) {
-					php_error_docref(NULL, E_WARNING, "Failed to create VLV control value: %s (%d)", ldap_err2string(rc), rc);
-				}
+			/* ldap_create_vlv_control_value() allocates memory for control_value.bv_val */
+			control_value_alloc = 1;
+			rc = ldap_create_vlv_control_value(ld, &vlvInfo, &control_value);
+			if (rc != LDAP_SUCCESS) {
+				php_error_docref(NULL, E_WARNING, "Failed to create VLV control value: %s (%d)", ldap_err2string(rc), rc);
 			}
 		} else {
 			php_error_docref(NULL, E_WARNING, "Control OID %s does not expect an array as value", ZSTR_VAL(control_oid));
@@ -583,7 +573,7 @@ static int _php_ldap_control_from_array(LDAP *ld, LDAPControl** ctrl, zval* arra
 	}

 	if (rc == LDAP_SUCCESS) {
-		rc = ldap_control_create(ZSTR_VAL(control_oid), control_iscritical, control_value, 1, ctrl);
+		rc = ldap_control_create(ZSTR_VAL(control_oid), control_iscritical, &control_value, 1, ctrl);
 	}

 failure:
@@ -591,9 +581,25 @@ failure:
 	if (tmpstring != NULL) {
 		zend_string_release(tmpstring);
 	}
-	if (control_value != NULL) {
-		ber_memfree(control_value);
-		control_value = NULL;
+	if (tmpstrings1 != NULL) {
+		int i;
+		for (i = 0; i < num_tmpstrings1; ++i) {
+			zend_string_release(tmpstrings1[i]);
+		}
+		efree(tmpstrings1);
+	}
+	if (tmpstrings2 != NULL) {
+		int i;
+		for (i = 0; i < num_tmpstrings2; ++i) {
+			zend_string_release(tmpstrings2[i]);
+		}
+		efree(tmpstrings2);
+	}
+	if (control_value.bv_val != NULL && control_value_alloc != 0) {
+		ber_memfree(control_value.bv_val);
+	}
+	if (ber != NULL) {
+		ber_free(ber, 1);
 	}
 	if (ldap_attrs != NULL) {
 		efree(ldap_attrs);
@@ -1465,7 +1471,7 @@ static void php_ldap_do_search(INTERNAL_FUNCTION_PARAMETERS, int scope)
 	zend_string *ldap_filter = NULL, *ldap_base_dn = NULL;
 	char **ldap_attrs = NULL;
 	ldap_linkdata *ld = NULL;
-	LDAPMessage *ldap_res;
+	LDAPMessage *ldap_res = NULL;
 	LDAPControl **lserverctrls = NULL;
 	int ldap_attrsonly = 0, ldap_sizelimit = -1, ldap_timelimit = -1, ldap_deref = -1;
 	int old_ldap_sizelimit = -1, old_ldap_timelimit = -1, old_ldap_deref = -1;
@@ -1665,6 +1671,11 @@ cleanup_parallel:
 			&& errno != LDAP_REFERRAL
 #endif
 		) {
+			/* ldap_res should be freed regardless of return value of ldap_search_ext_s()
+			 * see: https://linux.die.net/man/3/ldap_search_ext_s */
+			if (ldap_res != NULL) {
+				ldap_msgfree(ldap_res);
+			}
 			php_error_docref(NULL, E_WARNING, "Search: %s", ldap_err2string(errno));
 			ret = 0;
 		} else {
@@ -3438,6 +3449,7 @@ PHP_FUNCTION(ldap_parse_result)
 	/* Reverse -> fall through */
 	switch (myargcount) {
 		case 7:
+			zval_ptr_dtor(serverctrls);
 			_php_ldap_controls_to_array(ld->link, lserverctrls, serverctrls, 0);
 		case 6:
 			zval_ptr_dtor(referrals);
@@ -3992,7 +4004,7 @@ PHP_FUNCTION(ldap_control_paged_result)
 	zval *link;
 	char *cookie = NULL;
 	size_t cookie_len = 0;
-	struct berval lcookie = { 0, NULL };
+	struct berval lcookie = { 0L, NULL };
 	ldap_linkdata *ld;
 	LDAP *ldap;
 	BerElement *ber = NULL;
@@ -4287,38 +4299,31 @@ PHP_FUNCTION(ldap_exop)
 PHP_FUNCTION(ldap_exop_passwd)
 {
 	zval *link, *serverctrls;
-	struct berval luser, loldpw, lnewpw, lgenpasswd;
-	LDAPControl **lserverctrls = NULL, **requestctrls = NULL;
-	LDAPControl *ctrl, **ctrlp;
-	LDAPMessage* ldap_res;
+	struct berval luser = { 0L, NULL };
+	struct berval loldpw = { 0L, NULL };
+	struct berval lnewpw = { 0L, NULL };
+	struct berval lgenpasswd = { 0L, NULL };
+	LDAPControl *ctrl, **lserverctrls = NULL, *requestctrls[2] = { NULL, NULL };
+	LDAPMessage* ldap_res = NULL;
 	ldap_linkdata *ld;
 	int rc, myargcount = ZEND_NUM_ARGS(), msgid, err;
-	char* errmsg;
-
-	luser.bv_len = 0;
-	loldpw.bv_len = 0;
-	lnewpw.bv_len = 0;
+	char* errmsg = NULL;

 	if (zend_parse_parameters(myargcount, "r|sssz/", &link, &luser.bv_val, &luser.bv_len, &loldpw.bv_val, &loldpw.bv_len, &lnewpw.bv_val, &lnewpw.bv_len, &serverctrls) == FAILURE) {
 		return;
 	}

 	if ((ld = (ldap_linkdata *)zend_fetch_resource(Z_RES_P(link), "ldap link", le_link)) == NULL) {
-		RETURN_FALSE;
+		RETVAL_FALSE;
+		goto cleanup;
 	}

 	switch (myargcount) {
 		case 5:
-			requestctrls = safe_emalloc(2, sizeof(*requestctrls), 0);
-			*requestctrls = NULL;
-			ctrlp = requestctrls;
-
+			/* ldap_create_passwordpolicy_control() allocates ctrl */
 			if (ldap_create_passwordpolicy_control(ld->link, &ctrl) == LDAP_SUCCESS) {
-				*ctrlp = ctrl;
-				++ctrlp;
+				requestctrls[0] = ctrl;
 			}
-
-			*ctrlp = NULL;
 	}

 	/* asynchronous call to get result and controls */
@@ -4327,31 +4332,45 @@ PHP_FUNCTION(ldap_exop_passwd)
 		lnewpw.bv_len > 0 ? &lnewpw : NULL,
 		requestctrls,
 		NULL, &msgid);
+
+	if (requestctrls[0] != NULL) {
+		ldap_control_free(requestctrls[0]);
+	}
+
 	if (rc != LDAP_SUCCESS ) {
 		php_error_docref(NULL, E_WARNING, "Passwd modify extended operation failed: %s (%d)", ldap_err2string(rc), rc);
-		RETURN_FALSE;
+		RETVAL_FALSE;
+		goto cleanup;
 	}

 	rc = ldap_result(ld->link, msgid, 1 /* LDAP_MSG_ALL */, NULL, &ldap_res);
 	if ((rc < 0) || !ldap_res) {
 		rc = _get_lderrno(ld->link);
 		php_error_docref(NULL, E_WARNING, "Passwd modify extended operation failed: %s (%d)", ldap_err2string(rc), rc);
-		RETURN_FALSE;
+		RETVAL_FALSE;
+		goto cleanup;
 	}

 	rc = ldap_parse_passwd(ld->link, ldap_res, &lgenpasswd);
 	if( rc != LDAP_SUCCESS ) {
 		php_error_docref(NULL, E_WARNING, "Passwd modify extended operation failed: %s (%d)", ldap_err2string(rc), rc);
-		ldap_msgfree(ldap_res);
-		RETURN_FALSE;
+		RETVAL_FALSE;
+		goto cleanup;
 	}

-	rc = ldap_parse_result(ld->link, ldap_res, &err, NULL, &errmsg, NULL, (myargcount > 4 ? &lserverctrls : NULL), 1);
+	rc = ldap_parse_result(ld->link, ldap_res, &err, NULL, &errmsg, NULL, (myargcount > 4 ? &lserverctrls : NULL), 0);
 	if( rc != LDAP_SUCCESS ) {
 		php_error_docref(NULL, E_WARNING, "Passwd modify extended operation failed: %s (%d)", ldap_err2string(rc), rc);
-		RETURN_FALSE;
+		RETVAL_FALSE;
+		goto cleanup;
 	}

+	if (myargcount > 4) {
+		zval_ptr_dtor(serverctrls);
+		_php_ldap_controls_to_array(ld->link, lserverctrls, serverctrls, 0);
+	}
+
+	/* return */
 	if (lnewpw.bv_len == 0) {
 		if (lgenpasswd.bv_len == 0) {
 			RETVAL_EMPTY_STRING();
@@ -4365,11 +4384,16 @@ PHP_FUNCTION(ldap_exop_passwd)
 		RETVAL_FALSE;
 	}

-	if (myargcount > 4) {
-		_php_ldap_controls_to_array(ld->link, lserverctrls, serverctrls, 0);
+cleanup:
+	if (lgenpasswd.bv_val != NULL) {
+		ldap_memfree(lgenpasswd.bv_val);
+	}
+	if (ldap_res != NULL) {
+		ldap_msgfree(ldap_res);
+	}
+	if (errmsg != NULL) {
+		ldap_memfree(errmsg);
 	}
-
-	ldap_memfree(lgenpasswd.bv_val);
 }
 /* }}} */
 #endif
@@ -1734,13 +1734,17 @@ mbfl_strimwidth(
 		mbfl_convert_filter_flush(encoder);
 		if (pc.status != 0 && mkwidth > 0) {
 			pc.width += mkwidth;
-			while (n > 0) {
-				if ((*encoder->filter_function)(*p++, encoder) < 0) {
-					break;
+			if (n > 0) {
+				while (n > 0) {
+					if ((*encoder->filter_function)(*p++, encoder) < 0) {
+						break;
+					}
+					n--;
 				}
-				n--;
+				mbfl_convert_filter_flush(encoder);
+			} else if (pc.outwidth > pc.width) {
+				pc.status++;
 			}
-			mbfl_convert_filter_flush(encoder);
 			if (pc.status != 1) {
 				pc.status = 10;
 				pc.device.pos = pc.endpos;
@@ -0,0 +1,20 @@
+--TEST--
+Bug #79787 mb_strimwidth does not trim string
+--SKIPIF--
+<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+--FILE--
+<?php
+echo mb_strimwidth("一二三", 0, 4, '.', 'UTF-8')."\n";
+echo mb_strimwidth("一二三", 0, 5, '.', 'UTF-8')."\n";
+echo mb_strimwidth("一二三", 0, 6, '.', 'UTF-8')."\n";
+echo mb_strimwidth("abcdef", 0, 4, '.', 'UTF-8')."\n";
+echo mb_strimwidth("abcdef", 0, 5, '.', 'UTF-8')."\n";
+echo mb_strimwidth("abcdef", 0, 6, '.', 'UTF-8')."\n";
+?>
+--EXPECT--
+一.
+一二.
+一二三
+abc.
+abcd.
+abcdef
@@ -223,6 +223,9 @@ void zend_optimizer_compact_literals(zend_op_array *op_array, zend_optimizer_ctx
 				case ZEND_POST_INC_OBJ:
 				case ZEND_POST_DEC_OBJ:
 				case ZEND_ISSET_ISEMPTY_PROP_OBJ:
+					if (opline->op1_type == IS_CONST) {
+						LITERAL_INFO(opline->op1.constant, LITERAL_VALUE, 1);
+					}
 					if (opline->op2_type == IS_CONST) {
 						LITERAL_INFO(opline->op2.constant, LITERAL_PROPERTY, 1);
 					}
@@ -31,10 +31,11 @@

 #define ACCEL_FILEMAP_NAME "ZendOPcache.SharedMemoryArea"
 #define ACCEL_MUTEX_NAME "ZendOPcache.SharedMemoryMutex"
-#define ACCEL_FILEMAP_BASE_DEFAULT 0x01000000
-#define ACCEL_FILEMAP_BASE "ZendOPcache.MemoryBase"
 #define ACCEL_EVENT_SOURCE "Zend OPcache"

+/* address of mapping base and address of execute_ex */
+#define ACCEL_BASE_POINTER_SIZE (2 * sizeof(void*))
+
 static HANDLE memfile = NULL, memory_mutex = NULL;
 static void *mapping_base;

@@ -93,28 +94,6 @@ static char *create_name_with_username(char *name)
 	return newname;
 }

-static char *get_mmap_base_file(void)
-{
-	static char windir[MAXPATHLEN+UNLEN + 3 + sizeof("\\\\@") + 1 + 32 + 21];
-	char *uname;
-	int l;
-
-	uname = php_win32_get_username();
-	if (!uname) {
-		return NULL;
-	}
-	GetTempPath(MAXPATHLEN, windir);
-	l = strlen(windir);
-	if ('\\' == windir[l-1]) {
-		l--;
-	}
-	snprintf(windir + l, sizeof(windir) - l - 1, "\\%s@%s@%.20s@%.32s", ACCEL_FILEMAP_BASE, uname, sapi_module.name, ZCG(system_id));
-
-	free(uname);
-
-	return windir;
-}
-
 void zend_shared_alloc_create_lock(void)
 {
 	memory_mutex = CreateMutex(NULL, FALSE, create_name_with_username(ACCEL_MUTEX_NAME));
@@ -143,39 +122,20 @@ static int zend_shared_alloc_reattach(size_t requested_size, char **error_in)
 {
 	int err;
 	void *wanted_mapping_base;
-	char *mmap_base_file = get_mmap_base_file();
-	FILE *fp = fopen(mmap_base_file, "r");
 	MEMORY_BASIC_INFORMATION info;
 	void *execute_ex_base;
 	int execute_ex_moved;

-	if (!fp) {
-		err = GetLastError();
-		zend_win_error_message(ACCEL_LOG_WARNING, mmap_base_file, err);
-		zend_win_error_message(ACCEL_LOG_FATAL, "Unable to open base address file", err);
-		*error_in="fopen";
-		return ALLOC_FAILURE;
-	}
-	if (!fscanf(fp, "%p", &wanted_mapping_base)) {
+	mapping_base = MapViewOfFileEx(memfile, FILE_MAP_ALL_ACCESS, 0, 0, ACCEL_BASE_POINTER_SIZE, NULL);
+	if (mapping_base == NULL) {
 		err = GetLastError();
 		zend_win_error_message(ACCEL_LOG_FATAL, "Unable to read base address", err);
 		*error_in="read mapping base";
-		fclose(fp);
 		return ALLOC_FAILURE;
 	}
-	if (!fscanf(fp, "%p", &execute_ex_base)) {
-		err = GetLastError();
-		zend_win_error_message(ACCEL_LOG_FATAL, "Unable to read execute_ex base address", err);
-		*error_in="read execute_ex base";
-		fclose(fp);
-		return ALLOC_FAILURE;
-	}
-	fclose(fp);
-
-	if (0 > win32_utime(mmap_base_file, NULL)) {
-		err = GetLastError();
-		zend_win_error_message(ACCEL_LOG_WARNING, mmap_base_file, err);
-	}
+	wanted_mapping_base = ((void**)mapping_base)[0];
+	execute_ex_base = ((void**)mapping_base)[1];
+	UnmapViewOfFile(mapping_base);

 	execute_ex_moved = (void *)execute_ex != execute_ex_base;

@@ -231,7 +191,7 @@ static int zend_shared_alloc_reattach(size_t requested_size, char **error_in)
 		}
 		return ALLOC_FAIL_MAPPING;
 	}
-	smm_shared_globals = (zend_smm_shared_globals *) mapping_base;
+	smm_shared_globals = (zend_smm_shared_globals *) ((char*)mapping_base + ACCEL_BASE_POINTER_SIZE);

 	return SUCCESSFULLY_REATTACHED;
 }
@@ -349,23 +309,12 @@ static int create_segments(size_t requested_size, zend_shared_segment ***shared_
 		*error_in = "MapViewOfFile";
 		return ALLOC_FAILURE;
 	} else {
-		char *mmap_base_file = get_mmap_base_file();
-		void *execute_ex_base = (void *)execute_ex;
-		FILE *fp = fopen(mmap_base_file, "w");
-		if (!fp) {
-			err = GetLastError();
-			zend_shared_alloc_unlock_win32();
-			zend_win_error_message(ACCEL_LOG_WARNING, mmap_base_file, err);
-			zend_win_error_message(ACCEL_LOG_FATAL, "Unable to write base address", err);
-			return ALLOC_FAILURE;
-		}
-		fprintf(fp, "%p\n", mapping_base);
-		fprintf(fp, "%p\n", execute_ex_base);
-		fclose(fp);
+		((void**)mapping_base)[0] = mapping_base;
+		((void**)mapping_base)[1] = (void*)execute_ex;
 	}

-	shared_segment->pos = 0;
-	shared_segment->size = requested_size;
+	shared_segment->pos = ACCEL_BASE_POINTER_SIZE;
+	shared_segment->size = requested_size - ACCEL_BASE_POINTER_SIZE;

 	zend_shared_alloc_unlock_win32();

@@ -870,7 +870,7 @@ int zend_file_cache_script_store(zend_persistent_script *script, int in_shm)
 	info.checksum = zend_adler32(info.checksum, (unsigned char*)ZSTR_VAL((zend_string*)ZCG(mem)), info.str_size);

 #ifdef HAVE_SYS_UIO_H
-	vec[0].iov_base = &info;
+	vec[0].iov_base = (void *)&info;
 	vec[0].iov_len = sizeof(info);
 	vec[1].iov_base = buf;
 	vec[1].iov_len = script->size;
@@ -36,6 +36,33 @@

 static int pdo_dbh_attribute_set(pdo_dbh_t *dbh, zend_long attr, zval *value);

+void pdo_throw_exception(unsigned int driver_errcode, char *driver_errmsg, pdo_error_type *pdo_error)
+{
+		zval error_info,pdo_exception;
+		char *pdo_exception_message;
+
+		object_init_ex(&pdo_exception, php_pdo_get_exception());
+		array_init(&error_info);
+
+		add_next_index_string(&error_info, *pdo_error);
+		add_next_index_long(&error_info, driver_errcode);
+		add_next_index_string(&error_info, driver_errmsg);
+
+		spprintf(&pdo_exception_message, 0,"SQLSTATE[%s] [%d] %s",*pdo_error, driver_errcode, driver_errmsg);
+		zend_update_property(php_pdo_get_exception(), &pdo_exception, "errorInfo", sizeof("errorInfo")-1, &error_info);
+		zend_update_property_long(php_pdo_get_exception(), &pdo_exception, "code", sizeof("code")-1, driver_errcode);
+		zend_update_property_string(
+			php_pdo_get_exception(),
+			&pdo_exception,
+			"message",
+			sizeof("message")-1,
+			pdo_exception_message
+		);
+		efree(pdo_exception_message);
+		zval_ptr_dtor(&error_info);
+		zend_throw_exception_object(&pdo_exception);
+}
+
 void pdo_raise_impl_error(pdo_dbh_t *dbh, pdo_stmt_t *stmt, const char *sqlstate, const char *supp) /* {{{ */
 {
 	pdo_error_type *pdo_err = &dbh->error_code;
@@ -691,6 +691,7 @@ PDO_API void php_pdo_dbh_delref(pdo_dbh_t *dbh);
 PDO_API void php_pdo_free_statement(pdo_stmt_t *stmt);


+PDO_API void pdo_throw_exception(unsigned int driver_errcode, char *driver_errmsg, pdo_error_type *pdo_error);
 #endif /* PHP_PDO_DRIVER_H */
 /*
 * Local variables:
@@ -103,8 +103,7 @@ int _pdo_mysql_error(pdo_dbh_t *dbh, pdo_stmt_t *stmt, const char *file, int lin

 	if (!dbh->methods) {
 		PDO_DBG_INF("Throwing exception");
-		zend_throw_exception_ex(php_pdo_get_exception(), einfo->errcode, "SQLSTATE[%s] [%d] %s",
-				*pdo_err, einfo->errcode, einfo->errmsg);
+		pdo_throw_exception(einfo->errcode, einfo->errmsg, pdo_err);
 	}

 	PDO_DBG_RETURN(einfo->errcode);
@@ -0,0 +1,17 @@
+--TEST--
+Bug #64705 errorInfo property of PDOException is null when PDO::__construct() fails
+--SKIPIF--
+<?php
+if (!extension_loaded('pdo_mysql')) print 'skip not loaded';
+?>
+--FILE--
+<?php
+$dsn = 'mysql:host=DonotExistsHost;dbname=test;user=foo;password=wrongpass';
+try {
+  $pdo = new \PDO($dsn, null, null);
+} catch (\PDOException $e) {
+  var_dump(!empty($e->errorInfo) && is_array($e->errorInfo));
+}
+?>
+--EXPECTF--
+bool(true)
@@ -101,8 +101,7 @@ int _pdo_pgsql_error(pdo_dbh_t *dbh, pdo_stmt_t *stmt, int errcode, const char *
 	}

 	if (!dbh->methods) {
-		zend_throw_exception_ex(php_pdo_get_exception(), einfo->errcode, "SQLSTATE[%s] [%d] %s",
-				*pdo_err, einfo->errcode, einfo->errmsg);
+		pdo_throw_exception(einfo->errcode, einfo->errmsg, pdo_err);
 	}

 	return errcode;
@@ -0,0 +1,17 @@
+--TEST--
+Bug #64705 errorInfo property of PDOException is null when PDO::__construct() fails
+--SKIPIF--
+<?php
+if (!extension_loaded('pdo_pgsql')) print 'skip not loaded';
+?>
+--FILE--
+<?php
+$dsn = 'pgsql:host=DonotExistsHost;dbname=test;user=foo;password=wrongpass';
+try {
+  $pdo = new \PDO($dsn, null, null);
+} catch (\PDOException $e) {
+  var_dump(!empty($e->errorInfo) && is_array($e->errorInfo));
+}
+?>
+--EXPECTF--
+bool(true)
@@ -76,8 +76,7 @@ int _pdo_sqlite_error(pdo_dbh_t *dbh, pdo_stmt_t *stmt, const char *file, int li
 	}

 	if (!dbh->methods) {
-		zend_throw_exception_ex(php_pdo_get_exception(), einfo->errcode, "SQLSTATE[%s] [%d] %s",
-				*pdo_err, einfo->errcode, einfo->errmsg);
+		pdo_throw_exception(einfo->errcode, einfo->errmsg, pdo_err);
 	}

 	return einfo->errcode;
@@ -282,7 +282,7 @@ static int pdo_sqlite_stmt_describe(pdo_stmt_t *stmt, int colno)

 	str = sqlite3_column_name(S->stmt, colno);
 	stmt->columns[colno].name = zend_string_init(str, strlen(str), 0);
-	stmt->columns[colno].maxlen = 0xffffffff;
+	stmt->columns[colno].maxlen = SIZE_MAX;
 	stmt->columns[colno].precision = 0;

 	switch (sqlite3_column_type(S->stmt, colno)) {
@@ -24,7 +24,7 @@ array(6) {
  ["name"]=>
  string(1) "1"
  ["len"]=>
-  int(4294967295)
+  int(-1)
  ["precision"]=>
  int(0)
  ["pdo_type"]=>
@@ -0,0 +1,17 @@
+--TEST--
+Bug #64705 errorInfo property of PDOException is null when PDO::__construct() fails
+--SKIPIF--
+<?php
+if (!extension_loaded('pdo_sqlite')) print 'skip not loaded';
+?>
+--FILE--
+<?php
+$dsn = 'sqlite:./bug64705NonExistingDir/bug64705NonExistingDb';
+try {
+  $pdo = new \PDO($dsn, null, null);
+} catch (\PDOException $e) {
+  var_dump(!empty($e->errorInfo) && is_array($e->errorInfo));
+}
+?>
+--EXPECTF--
+bool(true)
@@ -0,0 +1,14 @@
+--TEST--
+Bug #79797 (Use of freed hash key in the phar_parse_zipfile function)
+--SKIPIF--
+<?php
+if (!extension_loaded('phar')) die('skip phar extension not available');
+?>
+--INI--
+phar.cache_list={PWD}/bug79797.phar
+--FILE--
+<?php
+echo "done\n";
+?>
+--EXPECT--
+done
@@ -705,7 +705,7 @@ foundit:
 			efree(actual_alias);
 		}

-		zend_hash_str_add_ptr(&(PHAR_G(phar_alias_map)), actual_alias, mydata->alias_len, mydata);
+		zend_hash_str_add_ptr(&(PHAR_G(phar_alias_map)), mydata->alias, mydata->alias_len, mydata);
 	} else {
 		phar_archive_data *fd_ptr;

@@ -29,10 +29,12 @@ $_SESSION["Blah"] = "Hello World!";
 $_SESSION["Foo"] = FALSE;
 $_SESSION["Guff"] = 1234567890;
 var_dump($_SESSION);
+$oldsession = $_SESSION;

 var_dump(session_write_close());
 session_start();
-var_dump($_SESSION);
+// the session may have been GC'd or not; we accept either outcome
+var_dump($_SESSION === $oldsession || $_SESSION === []);
 var_dump(session_destroy());
 session_start();
 var_dump($_SESSION);
@@ -51,14 +53,7 @@ array(3) {
  int(1234567890)
 }
 bool(true)
-array(3) {
-  ["Blah"]=>
-  string(12) "Hello World!"
-  ["Foo"]=>
-  bool(false)
-  ["Guff"]=>
-  int(1234567890)
-}
+bool(true)
 bool(true)
 array(0) {
 }
@@ -2059,7 +2059,7 @@ static void soap_server_fault_ex(sdlFunctionPtr function, zval* fault, soapHeade
 	   our fault code with their own handling... Figure this out later
 	*/
 	if (use_http_error_status) {
-		sapi_add_header("HTTP/1.1 500 Internal Service Error", sizeof("HTTP/1.1 500 Internal Service Error")-1, 1);
+		sapi_add_header("HTTP/1.1 500 Internal Server Error", sizeof("HTTP/1.1 500 Internal Server Error")-1, 1);
 	}
 	if (zend_ini_long("zlib.output_compression", sizeof("zlib.output_compression"), 0)) {
 		sapi_add_header("Connection: close", sizeof("Connection: close")-1, 1);
@@ -197,14 +197,13 @@ PHP_FUNCTION(socket_sendmsg)
 	res = sendmsg(php_sock->bsd_socket, msghdr, (int)flags);

 	if (res != -1) {
-		zend_llist_destroy(allocations);
-		efree(allocations);
-
-		RETURN_LONG((zend_long)res);
+		RETVAL_LONG((zend_long)res);
 	} else {
 		PHP_SOCKET_ERROR(php_sock, "error in sendmsg", errno);
-		RETURN_FALSE;
+		RETVAL_FALSE;
 	}
+
+	allocations_dispose(&allocations);
 }

 PHP_FUNCTION(socket_recvmsg)
@@ -254,7 +253,6 @@ PHP_FUNCTION(socket_recvmsg)

 		/* we don;t need msghdr anymore; free it */
 		msghdr = NULL;
-		allocations_dispose(&allocations);

 		zval_ptr_dtor(zmsg);
 		if (!err.has_error) {
@@ -265,14 +263,15 @@ PHP_FUNCTION(socket_recvmsg)
 			/* no need to destroy/free zres -- it's NULL in this circumstance */
 			assert(zres == NULL);
 		}
+		RETVAL_LONG((zend_long)res);
 	} else {
 		SOCKETS_G(last_error) = errno;
 		php_error_docref(NULL, E_WARNING, "error in recvmsg [%d]: %s",
 				errno, sockets_strerror(errno));
-		RETURN_FALSE;
+		RETVAL_FALSE;
 	}

-	RETURN_LONG((zend_long)res);
+	allocations_dispose(&allocations);
 }

 PHP_FUNCTION(socket_cmsg_space)
@@ -0,0 +1,15 @@
+--TEST--
+Error during socket_sendmsg() or socket_recvmsg()
+--FILE--
+<?php
+
+$socket = socket_create(AF_INET, SOCK_DGRAM, SOL_UDP);
+socket_sendmsg($socket, [], -1);
+$message = ['controllen' => 1];
+socket_recvmsg($socket, $message, -1);
+
+?>
+--EXPECTF--
+Warning: socket_sendmsg(): error in sendmsg [%d]: %a in %s on line %d
+
+Warning: socket_recvmsg(): error in recvmsg [%d]: %a in %s on line %d
@@ -2885,6 +2885,7 @@ PHP_FUNCTION(sodium_crypto_kx_keypair)
 		zend_throw_exception(sodium_exception_ce, "internal error", 0);
 		return;
 	}
+	ZSTR_VAL(keypair)[crypto_kx_SECRETKEYBYTES + crypto_kx_PUBLICKEYBYTES] = 0;
 	RETURN_STR(keypair);
 }

@@ -3615,7 +3615,7 @@ PHPAPI int php_array_merge_recursive(HashTable *dest, HashTable *src) /* {{{ */
 						return 0;
 					}
 				} else {
-					Z_TRY_ADDREF_P(src_entry);
+					Z_TRY_ADDREF_P(src_zval);
 					zend_hash_next_index_insert(Z_ARRVAL_P(dest_zval), src_zval);
 				}
 				zval_ptr_dtor(&tmp);
@@ -349,10 +349,8 @@ static void _php_dns_free_res(struct __res_state *res) { /* {{{ */
   Check DNS records corresponding to a given Internet host name or IP address */
 PHP_FUNCTION(dns_check_record)
 {
-#ifndef MAXPACKET
-#define MAXPACKET  8192 /* max packet size used internally by BIND */
-#endif
-	u_char ans[MAXPACKET];
+	HEADER *hp;
+	querybuf answer;
 	char *hostname, *rectype = NULL;
 	size_t hostname_len, rectype_len = 0;
 	int type = T_MX, i;
@@ -410,14 +408,14 @@ PHP_FUNCTION(dns_check_record)
 	res_init();
 #endif

-	RETVAL_TRUE;
-	i = php_dns_search(handle, hostname, C_IN, type, ans, sizeof(ans));
+	i = php_dns_search(handle, hostname, C_IN, type, answer.qb2, sizeof answer);
+	php_dns_free_handle(handle);

 	if (i < 0) {
-		RETVAL_FALSE;
+		RETURN_FALSE;
 	}
-
-	php_dns_free_handle(handle);
+	hp = (HEADER *)&answer;
+	RETURN_BOOL(ntohs(hp->ancount) != 0);
 }
 /* }}} */

@@ -1033,7 +1031,7 @@ PHP_FUNCTION(dns_get_mx)
 	zval *mx_list, *weight_list = NULL;
 	int count, qdc;
 	u_short type, weight;
-	u_char ans[MAXPACKET];
+	querybuf answer;
 	char buf[MAXHOSTNAMELEN];
 	HEADER *hp;
 	u_char *cp, *end;
@@ -1076,16 +1074,14 @@ PHP_FUNCTION(dns_get_mx)
 	res_init();
 #endif

-	i = php_dns_search(handle, hostname, C_IN, DNS_T_MX, (u_char *)&ans, sizeof(ans));
+	i = php_dns_search(handle, hostname, C_IN, DNS_T_MX, answer.qb2, sizeof answer);
 	if (i < 0) {
+		php_dns_free_handle(handle);
 		RETURN_FALSE;
 	}
-	if (i > (int)sizeof(ans)) {
-		i = sizeof(ans);
-	}
-	hp = (HEADER *)&ans;
-	cp = (u_char *)&ans + HFIXEDSZ;
-	end = (u_char *)&ans +i;
+	hp = (HEADER *)&answer;
+	cp = answer.qb2 + HFIXEDSZ;
+	end = answer.qb2 + i;
 	for (qdc = ntohs((unsigned short)hp->qdcount); qdc--; cp += i + QFIXEDSZ) {
 		if ((i = dn_skipname(cp, end)) < 0 ) {
 			php_dns_free_handle(handle);
@@ -1107,7 +1103,7 @@ PHP_FUNCTION(dns_get_mx)
 			continue;
 		}
 		GETSHORT(weight, cp);
-		if ((i = dn_expand(ans, end, cp, buf, sizeof(buf)-1)) < 0) {
+		if ((i = dn_expand(answer.qb2, end, cp, buf, sizeof(buf)-1)) < 0) {
 			php_dns_free_handle(handle);
 			RETURN_FALSE;
 		}
@@ -1118,7 +1114,7 @@ PHP_FUNCTION(dns_get_mx)
 		}
 	}
 	php_dns_free_handle(handle);
-	RETURN_TRUE;
+	RETURN_BOOL(zend_hash_num_elements(Z_ARRVAL_P(mx_list)) != 0);
 }
 /* }}} */
 #endif /* HAVE_FULL_DNS_FUNCS */
@@ -1669,7 +1669,7 @@ PHP_FUNCTION(copy)
 		Z_PARAM_RESOURCE_EX(zcontext, 1, 0)
 	ZEND_PARSE_PARAMETERS_END();

-	if (php_check_open_basedir(source)) {
+	if (php_stream_locate_url_wrapper(source, NULL, 0) == &php_plain_files_wrapper && php_check_open_basedir(source)) {
 		RETURN_FALSE;
 	}

@@ -1496,6 +1496,11 @@ static void php_getimagesize_from_any(INTERNAL_FUNCTION_PARAMETERS, int mode) {
 		Z_PARAM_ZVAL_DEREF(info)
 	ZEND_PARSE_PARAMETERS_END();

+	if (mode == FROM_PATH && CHECK_NULL_PATH(input, input_len)) {
+		php_error_docref(NULL, E_WARNING, "Invalid path");
+		return;
+	}
+
 	if (argc == 2) {
 		zval_ptr_dtor(info);
 		array_init(info);
@@ -2610,7 +2610,7 @@ PHP_FUNCTION(substr_replace)

 		from_idx = len_idx = repl_idx = 0;

-		ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL_P(str), num_index, str_index, tmp_str) {
+		ZEND_HASH_FOREACH_KEY_VAL_IND(Z_ARRVAL_P(str), num_index, str_index, tmp_str) {
 			zend_string *tmp_orig_str;
 			zend_string *orig_str = zval_get_tmp_string(tmp_str, &tmp_orig_str);

@@ -2823,8 +2823,9 @@ PHP_FUNCTION(chr)
   Uppercase the first character of the word in a native string */
 static zend_string* php_ucfirst(zend_string *str)
 {
-	unsigned char r = toupper(ZSTR_VAL(str)[0]);
-	if (r == ZSTR_VAL(str)[0]) {
+	const unsigned char ch = ZSTR_VAL(str)[0];
+	unsigned char r = toupper(ch);
+	if (r == ch) {
 		return zend_string_copy(str);
 	} else {
 		zend_string *s = zend_string_init(ZSTR_VAL(str), ZSTR_LEN(str), 0);
@@ -3062,7 +3063,7 @@ static void php_strtr_array(zval *return_value, zend_string *input, HashTable *p
 		zend_string *key_used;
 		/* we have to rebuild HashTable with numeric keys */
 		zend_hash_init(&str_hash, zend_hash_num_elements(pats), NULL, NULL, 0);
-		ZEND_HASH_FOREACH_KEY_VAL(pats, num_key, str_key, entry) {
+		ZEND_HASH_FOREACH_KEY_VAL_IND(pats, num_key, str_key, entry) {
 			if (UNEXPECTED(!str_key)) {
 				key_used = zend_long_to_str(num_key);
 				len = ZSTR_LEN(key_used);
@@ -3508,7 +3509,7 @@ PHP_FUNCTION(strtr)
 			zend_string *str_key, *tmp_str, *replace, *tmp_replace;
 			zval *entry;

-			ZEND_HASH_FOREACH_KEY_VAL(pats, num_key, str_key, entry) {
+			ZEND_HASH_FOREACH_KEY_VAL_IND(pats, num_key, str_key, entry) {
 				tmp_str = NULL;
 				if (UNEXPECTED(!str_key)) {
 					str_key = tmp_str = zend_long_to_str(num_key);
@@ -4268,12 +4269,9 @@ PHPAPI void php_stripslashes(zend_string *str)
 */
 static zend_long php_str_replace_in_subject(zval *search, zval *replace, zval *subject, zval *result, int case_sensitivity)
 {
-	zval		*search_entry,
-				*replace_entry = NULL;
+	zval		*search_entry;
 	zend_string	*tmp_result,
-	            *tmp_subject_str,
-	            *tmp_replace_entry_str = NULL,
-				*replace_entry_str;
+	            *tmp_subject_str;
 	char		*replace_value = NULL;
 	size_t		 replace_len = 0;
 	zend_long	 replace_count = 0;
@@ -4303,14 +4301,16 @@ static zend_long php_str_replace_in_subject(zval *search, zval *replace, zval *s
 		}

 		/* For each entry in the search array, get the entry */
-		ZEND_HASH_FOREACH_VAL(Z_ARRVAL_P(search), search_entry) {
+		ZEND_HASH_FOREACH_VAL_IND(Z_ARRVAL_P(search), search_entry) {
 			/* Make sure we're dealing with strings. */
 			zend_string *tmp_search_str;
 			zend_string *search_str = zval_get_tmp_string(search_entry, &tmp_search_str);
+			zend_string *replace_entry_str, *tmp_replace_entry_str = NULL;

 			/* If replace is an array. */
 			if (Z_TYPE_P(replace) == IS_ARRAY) {
 				/* Get current entry */
+				zval *replace_entry = NULL;
 				while (replace_idx < Z_ARRVAL_P(replace)->nNumUsed) {
 					replace_entry = &Z_ARRVAL_P(replace)->arData[replace_idx].val;
 					if (Z_TYPE_P(replace_entry) != IS_UNDEF) {
@@ -4367,15 +4367,12 @@ static zend_long php_str_replace_in_subject(zval *search, zval *replace, zval *s
 				}
 			} else {
 				zend_tmp_string_release(tmp_search_str);
+				zend_tmp_string_release(tmp_replace_entry_str);
 				continue;
 			}

 			zend_tmp_string_release(tmp_search_str);
-
-			if (tmp_replace_entry_str) {
-				zend_string_release_ex(tmp_replace_entry_str, 0);
-				tmp_replace_entry_str = NULL;
-			}
+			zend_tmp_string_release(tmp_replace_entry_str);

 			if (subject_str == tmp_result) {
 				zend_string_delref(subject_str);
@@ -4463,7 +4460,7 @@ static void php_str_replace_common(INTERNAL_FUNCTION_PARAMETERS, int case_sensit

 		/* For each subject entry, convert it to string, then perform replacement
 		   and add the result to the return_value array. */
-		ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL_P(subject), num_key, string_key, subject_entry) {
+		ZEND_HASH_FOREACH_KEY_VAL_IND(Z_ARRVAL_P(subject), num_key, string_key, subject_entry) {
 			ZVAL_DEREF(subject_entry);
 			if (Z_TYPE_P(subject_entry) != IS_ARRAY && Z_TYPE_P(subject_entry) != IS_OBJECT) {
 				count += php_str_replace_in_subject(search, replace, subject_entry, &result, case_sensitivity);
@@ -0,0 +1,33 @@
+--TEST--
+Bug #79930: array_merge_recursive() crashes when called with array with single reference
+--FILE--
+<?php
+
+$a = 'a';
+$array = [
+    'value' => $a . 'b',
+];
+
+// Create rc=1 reference.
+array_walk($array, function () {});
+
+$m = array_merge_recursive(['value' => 'a'], $array);
+
+var_dump($a, $array, $m);
+
+?>
+--EXPECT--
+string(1) "a"
+array(1) {
+  ["value"]=>
+  string(2) "ab"
+}
+array(1) {
+  ["value"]=>
+  array(2) {
+    [0]=>
+    string(1) "a"
+    [1]=>
+    string(2) "ab"
+  }
+}
@@ -0,0 +1,23 @@
+--TEST--
+Bug #79821 (array grow during var_dump)
+--FILE--
+<?php
+
+foreach (['var_dump', 'debug_zval_dump', 'var_export'] as $output) {
+    $foo = $bar = [];
+    for ($i = 0; $i < 3; $i++) {
+        $foo = [$foo, [&$bar]];
+    }
+    ob_start(function (string $buffer) use (&$bar) {
+        $bar[][] = null;
+        return '';
+    }, 64);
+    $output($foo[0]);
+    ob_end_clean();
+}
+
+echo "OK\n";
+
+?>
+--EXPECT--
+OK
@@ -1,11 +1,5 @@
 --TEST--
 Test realpath() with relative paths
--SKIPIF--
-<?php
-if (substr(PHP_OS, 0, 3) == 'WIN') {
-    die('skip no symlinks on Windows');
-}
-?>
 --FILE--
 <?php
 $file_path = dirname(__FILE__);
@@ -0,0 +1,9 @@
+--TEST--
+Bug #79877 (getimagesize function silently truncates after a null byte)
+--FILE--
+<?php
+var_dump(getimagesize("/tmp/a.png\0xx"));
+?>
+--EXPECTF--
+Warning: getimagesize(): Invalid path in %s on line %d
+NULL
@@ -0,0 +1,16 @@
+--TEST--
+Test invalid bindto
+--FILE--
+<?php
+$ctx = stream_context_create([
+    'socket' => [
+        'bindto' => 'invalid',
+    ],
+]);
+$fp = stream_socket_client(
+    'tcp://www.' . str_repeat('x', 100) . '.com:80',
+    $errno, $errstr, 30, STREAM_CLIENT_CONNECT, $ctx
+);
+?>
+--EXPECTF--
+Warning: stream_socket_client(): unable to connect to tcp://%s:80 (Failed to parse address "invalid") in %s on line %d
@@ -10,15 +10,19 @@ if (substr(PHP_OS, 0, 3) == 'WIN') {
 ?>
 --FILE--
 <?php
-$domains = array( 'mx1.tests.php.net', 'mx2.tests.php.net' );
-foreach ( $domains as $domain )
-{
-    if ( getmxrr( $domain, $hosts, $weights ) )
-    {
-        echo "Hosts: " . count( $hosts ) . ", weights: " . count( $weights ) . "\n";
-    }
+$domains = array(
+    'mx1.tests.php.net',
+    'mx2.tests.php.net',
+    'qa.php.net',
+);
+foreach ($domains as $domain) {
+    $result = getmxrr($domain, $hosts, $weights);
+    echo "Result: " . ($result ? "true" : "false")
+       . ", hosts: " . count( $hosts )
+       . ", weights: " . count( $weights ) . "\n";
 }
 ?>
 --EXPECT--
-Hosts: 1, weights: 1
-Hosts: 2, weights: 2
+Result: true, hosts: 1, weights: 1
+Result: true, hosts: 2, weights: 2
+Result: false, hosts: 0, weights: 0
@@ -0,0 +1,15 @@
+--TEST--
+Bug #70362 (Can't copy() large 'data://' with open_basedir)
+--INI--
+open_basedir=.
+--FILE--
+<?php
+$temp = tempnam(__DIR__, 'test');
+$data = str_repeat('0', 4096);
+$data = 'data://plain/text;base64,' . base64_encode($data);
+var_dump(copy($data, $temp));
+echo file_get_contents($temp);
+?>
+--EXPECT--
+bool(true)
+0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
@@ -0,0 +1,10 @@
+--TEST--
+Bug #79951: Memory leak in str_replace of empty string
+--FILE--
+<?php
+
+var_dump(str_replace([""], [1000], "foo"));
+
+?>
+--EXPECT--
+string(3) "foo"
@@ -117,21 +117,26 @@ again:
 			break;
 		case IS_ARRAY:
 			myht = Z_ARRVAL_P(struc);
-			if (level > 1 && !(GC_FLAGS(myht) & GC_IMMUTABLE)) {
-				if (GC_IS_RECURSIVE(myht)) {
-					PUTS("*RECURSION*\n");
-					return;
+			if (!(GC_FLAGS(myht) & GC_IMMUTABLE)) {
+				if (level > 1) {
+					if (GC_IS_RECURSIVE(myht)) {
+						PUTS("*RECURSION*\n");
+						return;
+					}
+					GC_PROTECT_RECURSION(myht);
 				}
-				GC_PROTECT_RECURSION(myht);
+				GC_ADDREF(myht);
 			}
 			count = zend_array_count(myht);
 			php_printf("%sarray(%d) {\n", COMMON, count);
-
 			ZEND_HASH_FOREACH_KEY_VAL_IND(myht, num, key, val) {
 				php_array_element_dump(val, num, key, level);
 			} ZEND_HASH_FOREACH_END();
-			if (level > 1 && !(GC_FLAGS(myht) & GC_IMMUTABLE)) {
-				GC_UNPROTECT_RECURSION(myht);
+			if (!(GC_FLAGS(myht) & GC_IMMUTABLE)) {
+				if (level > 1) {
+					GC_UNPROTECT_RECURSION(myht);
+				}
+				GC_DELREF(myht);
 			}
 			if (level > 1) {
 				php_printf("%*c", level-1, ' ');
@@ -284,20 +289,26 @@ again:
 		break;
 	case IS_ARRAY:
 		myht = Z_ARRVAL_P(struc);
-		if (level > 1 && !(GC_FLAGS(myht) & GC_IMMUTABLE)) {
-			if (GC_IS_RECURSIVE(myht)) {
-				PUTS("*RECURSION*\n");
-				return;
+		if (!(GC_FLAGS(myht) & GC_IMMUTABLE)) {
+			if (level > 1) {
+				if (GC_IS_RECURSIVE(myht)) {
+					PUTS("*RECURSION*\n");
+					return;
+				}
+				GC_PROTECT_RECURSION(myht);
 			}
-			GC_PROTECT_RECURSION(myht);
+			GC_ADDREF(myht);
 		}
 		count = zend_array_count(myht);
-		php_printf("%sarray(%d) refcount(%u){\n", COMMON, count, Z_REFCOUNTED_P(struc) ? Z_REFCOUNT_P(struc) : 1);
+		php_printf("%sarray(%d) refcount(%u){\n", COMMON, count, Z_REFCOUNTED_P(struc) ? Z_REFCOUNT_P(struc) - 1 : 1);
 		ZEND_HASH_FOREACH_KEY_VAL_IND(myht, index, key, val) {
 			zval_array_element_dump(val, index, key, level);
 		} ZEND_HASH_FOREACH_END();
-		if (level > 1 && !(GC_FLAGS(myht) & GC_IMMUTABLE)) {
-			GC_UNPROTECT_RECURSION(myht);
+		if (!(GC_FLAGS(myht) & GC_IMMUTABLE)) {
+			if (level > 1) {
+				GC_UNPROTECT_RECURSION(myht);
+			}
+			GC_DELREF(myht);
 		}
 		if (is_temp) {
 			zend_hash_destroy(myht);
@@ -496,6 +507,7 @@ again:
 					zend_error(E_WARNING, "var_export does not handle circular references");
 					return;
 				}
+				GC_ADDREF(myht);
 				GC_PROTECT_RECURSION(myht);
 			}
 			if (level > 1) {
@@ -508,6 +520,7 @@ again:
 			} ZEND_HASH_FOREACH_END();
 			if (!(GC_FLAGS(myht) & GC_IMMUTABLE)) {
 				GC_UNPROTECT_RECURSION(myht);
+				GC_DELREF(myht);
 			}
 			if (level > 1) {
 				buffer_append_spaces(buf, level - 1);
@@ -0,0 +1,17 @@
+--TEST--
+Bug #79922 (Crash after multiple calls to xml_parser_free())
+--SKIPIF--
+<?php
+if (!extension_loaded('xml')) die('skip xml extension not available');
+?>
+--FILE--
+<?php
+$c=xml_parser_create_ns();
+$a=xml_parser_free($c);
+$a=xml_parser_free($c);
+$c=0;
+var_dump($a);
+?>
+--EXPECTF--
+Warning: xml_parser_free(): supplied resource is not a valid XML Parser resource in %s on line %d
+bool(false)
@@ -1132,7 +1132,7 @@ static void php_xml_parser_create_impl(INTERNAL_FUNCTION_PARAMETERS, int ns_supp
 	XML_SetUserData(parser->parser, parser);

 	RETVAL_RES(zend_register_resource(parser, le_xml_parser));
-	ZVAL_COPY(&parser->index, return_value);
+	ZVAL_COPY_VALUE(&parser->index, return_value);
 }
 /* }}} */

@@ -1559,7 +1559,7 @@ PHP_FUNCTION(xml_parser_free)
 		RETURN_FALSE;
 	}

-	if (zend_list_delete(Z_RES(parser->index)) == FAILURE) {
+	if (zend_list_close(Z_RES(parser->index)) == FAILURE) {
 		RETURN_FALSE;
 	}

@@ -2,7 +2,7 @@
 /* edit configure.ac to change version number */
 #define PHP_MAJOR_VERSION 7
 #define PHP_MINOR_VERSION 3
-#define PHP_RELEASE_VERSION 20
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "7.3.20-dev"
-#define PHP_VERSION_ID 70320
+#define PHP_RELEASE_VERSION 22
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "7.3.22"
+#define PHP_VERSION_ID 70322
@@ -187,11 +187,14 @@ PHPAPI char *php_ctime_r(const time_t *clock, char *buf)
 	local_lock(CTIME_R);

 	tmp = ctime(clock);
-	strcpy(buf, tmp);
+	if (tmp) {
+		strcpy(buf, tmp);
+		tmp = buf;
+	}

 	local_unlock(CTIME_R);

-	return buf;
+	return tmp;
 }

 #endif
@@ -205,11 +208,14 @@ PHPAPI char *php_asctime_r(const struct tm *tm, char *buf)
 	local_lock(ASCTIME_R);

 	tmp = asctime(tm);
-	strcpy(buf, tmp);
+	if (tmp) {
+		strcpy(buf, tmp);
+		tmp = buf;
+	}

 	local_unlock(ASCTIME_R);

-	return buf;
+	return tmp;
 }

 #endif
@@ -744,6 +744,10 @@ static inline int php_tcp_sockop_connect(php_stream *stream, php_netstream_data_
 			return -1;
 		}
 		bindto = parse_ip_address_ex(Z_STRVAL_P(tmpzval), Z_STRLEN_P(tmpzval), &bindport, xparam->want_errortext, &xparam->outputs.error_text);
+		if (bindto == NULL) {
+			efree(host);
+			return -1;
+		}
 	}

 #ifdef SO_BROADCAST
@@ -362,7 +362,7 @@ static void php_apache_sapi_log_message_ex(char *msg, request_rec *r)
 static double php_apache_sapi_get_request_time(void)
 {
 	php_struct *ctx = SG(server_context);
-	return ((double) apr_time_as_msec(ctx->r->request_time)) / 1000.0;
+	return ((double) ctx->r->request_time) / 1000000.0;
 }

 extern zend_module_entry php_apache_module;
@@ -365,7 +365,13 @@ static void append_essential_headers(smart_str* buffer, php_cli_server_client *c

 static const char *get_mime_type(const php_cli_server *server, const char *ext, size_t ext_len) /* {{{ */
 {
-	return (const char*)zend_hash_str_find_ptr(&server->extension_mime_types, ext, ext_len);
+	char *ret;
+	ALLOCA_FLAG(use_heap)
+	char *ext_lower = do_alloca(ext_len + 1, use_heap);
+	zend_str_tolower_copy(ext_lower, ext, ext_len);
+	ret = zend_hash_str_find_ptr(&server->extension_mime_types, ext_lower, ext_len);
+	free_alloca(ext_lower, use_heap);
+	return (const char*)ret;
 } /* }}} */

 PHP_FUNCTION(apache_request_headers) /* {{{ */
@@ -2140,9 +2146,12 @@ static int php_cli_server_dispatch_router(php_cli_server *server, php_cli_server
 static int php_cli_server_dispatch(php_cli_server *server, php_cli_server_client *client) /* {{{ */
 {
 	int is_static_file  = 0;
+	const char *ext = client->request.ext;

 	SG(server_context) = client;
-	if (client->request.ext_len != 3 || memcmp(client->request.ext, "php", 3) || !client->request.path_translated) {
+	if (client->request.ext_len != 3
+	 || (ext[0] != 'p' && ext[0] != 'P') || (ext[1] != 'h' && ext[1] != 'H') || (ext[2] != 'p' && ext[2] != 'P')
+	 || !client->request.path_translated) {
 		is_static_file = 1;
 	}

@@ -61,7 +61,7 @@
 #include "lscriu.c"
 #endif

-#define SAPI_LSAPI_MAX_HEADER_LENGTH 2048
+#define SAPI_LSAPI_MAX_HEADER_LENGTH LSAPI_RESP_HTTP_HEADER_MAX

 /* Key for each cache entry is dirname(PATH_TRANSLATED).
 *
@@ -610,7 +610,7 @@ static int sapi_lsapi_activate()
 static sapi_module_struct lsapi_sapi_module =
 {
    "litespeed",
-    "LiteSpeed V7.6",
+    "LiteSpeed V7.7",

    php_lsapi_startup,              /* startup */
    php_module_shutdown_wrapper,    /* shutdown */
@@ -1752,7 +1752,7 @@ PHP_FUNCTION(litespeed_response_headers)
        if ( h->header_len > 0 ) {
            p = strchr( h->header, ':' );
            len = p - h->header;
-            if (( p )&&( len > 0 )) {
+            if (p && len > 0 && len < LSAPI_RESP_HTTP_HEADER_MAX) {
                memmove( headerBuf, h->header, len );
                while( len > 0 && (isspace( headerBuf[len-1])) ) {
                    --len;
@@ -126,7 +126,7 @@ enum
    LSAPI_STATE_ACCEPTING,
 };

-typedef struct _lsapi_child_status
+typedef struct lsapi_child_status
 {
    int     m_pid;
    long    m_tmStart;
@@ -790,10 +790,10 @@ static int lsapi_load_lve_lib(void)
                int uid = getuid();
                if ( uid )
                {
-                    setreuid( s_uid, uid );
+                    if (setreuid( s_uid, uid )) {};
                    if ( !(*fp_lve_is_available)() )
                        s_enable_lve = 0;
-                    setreuid( uid, s_uid );
+                    if (setreuid( uid, s_uid )) {};
                }
            }
        }
@@ -898,7 +898,7 @@ static int LSAPI_perror_r( LSAPI_Request * pReq, const char * pErr1, const char
    if ( pReq )
        LSAPI_Write_Stderr_r( pReq, achError, n );
    else
-        write( STDERR_FILENO, achError, n );
+        if (write( STDERR_FILENO, achError, n )) {};
    return 0;
 }

@@ -2622,7 +2622,8 @@ int LSAPI_ParseSockAddr( const char * pBind, struct sockaddr * pAddr )
    while( isspace( *pBind ) )
        ++pBind;

-    strncpy( achAddr, pBind, 256 );
+    strncpy(achAddr, pBind, 255);
+    achAddr[255] = 0;

    switch( *p )
    {
@@ -2775,6 +2776,9 @@ int LSAPI_Init_Prefork_Server( int max_children, fn_select_t fp, int avoidFork )
        g_prefork_server->m_iMaxIdleChildren = 1;
    g_prefork_server->m_iChildrenMaxIdleTime = 300;
    g_prefork_server->m_iMaxReqProcessTime = 3600;
+
+    setsid();
+
    return 0;
 }

@@ -2830,6 +2834,11 @@ static lsapi_child_status * find_child_status( int pid )
    {
        if ( pStatus->m_pid == pid )
        {
+            if (pid == 0)
+            {
+                memset(pStatus, 0, sizeof( *pStatus ) );
+                pStatus->m_pid = -1;
+            }
            if ( pStatus + 1 > g_prefork_server->m_pChildrenStatusCur )
                g_prefork_server->m_pChildrenStatusCur = pStatus + 1;
            return pStatus;
@@ -2928,7 +2937,10 @@ static void lsapi_sigchild( int signal )
 static int lsapi_init_children_status(void)
 {
    int size = 4096;
-    int max_children = g_prefork_server->m_iMaxChildren
+    int max_children;
+    if (g_prefork_server->m_pChildrenStatus)
+        return 0;
+    max_children = g_prefork_server->m_iMaxChildren
                        + g_prefork_server->m_iExtraChildren;

    char * pBuf;
@@ -2949,6 +2961,8 @@ static int lsapi_init_children_status(void)
    s_accepting_workers = s_busy_workers + 1;
    s_global_counter = s_accepting_workers + 1;
    s_avail_pages = (size_t *)(s_global_counter + 1);
+
+    setsid();
    return 0;
 }

@@ -3118,8 +3132,6 @@ static int lsapi_prefork_server_accept( lsapi_prefork_server * pServer,

    lsapi_init_children_status();

-    setsid();
-
    act.sa_flags = 0;
    act.sa_handler = lsapi_sigchild;
    sigemptyset(&(act.sa_mask));
@@ -3141,7 +3153,7 @@ static int lsapi_prefork_server_accept( lsapi_prefork_server * pServer,
        perror( "Can't set signals" );
        return -1;
    }
-    s_stop = 0;
+
    while( !s_stop )
    {
        if (s_proc_group_timer_cb != NULL) {
@@ -3219,8 +3231,6 @@ static int lsapi_prefork_server_accept( lsapi_prefork_server * pServer,
        {
            wait_secs = 0;
            child_status = find_child_status( 0 );
-            if ( child_status )
-                memset( child_status, 0, sizeof( *child_status ) );

            sigemptyset( &mask );
            sigaddset( &mask, SIGCHLD );
@@ -3312,6 +3322,210 @@ static int lsapi_prefork_server_accept( lsapi_prefork_server * pServer,
 }


+static struct sigaction old_term, old_quit, old_int,
+                    old_usr1, old_child;
+
+
+int LSAPI_Postfork_Child(LSAPI_Request * pReq)
+{
+    int max_children = g_prefork_server->m_iMaxChildren;
+    s_pid = getpid();
+    __sync_lock_test_and_set(&pReq->child_status->m_pid, s_pid);
+    s_worker_status = pReq->child_status;
+
+    setsid();
+    g_prefork_server = NULL;
+    s_ppid = getppid();
+    s_req_processed = 0;
+    s_proc_group_timer_cb = NULL;
+
+    if (pthread_atfork_func)
+        (*pthread_atfork_func)(NULL, NULL, set_skip_write);
+
+    __sync_lock_test_and_set(&s_worker_status->m_state,
+                                LSAPI_STATE_CONNECTED);
+    if (s_busy_workers)
+        __sync_add_and_fetch(s_busy_workers, 1);
+    lsapi_set_nblock( pReq->m_fd, 0 );
+    //keep it open if busy_count is used.
+    if (s_busy_workers
+        && *s_busy_workers > (max_children >> 1))
+        s_keepListener = 1;
+    if ((s_uid == 0 || !s_keepListener || !is_enough_free_mem())
+        && pReq->m_fdListen != -1 )
+    {
+        close(pReq->m_fdListen);
+        pReq->m_fdListen = -1;
+    }
+
+    //init_conn_key( pReq->m_fd );
+    lsapi_notify_pid(pReq->m_fd);
+    s_notified_pid = 1;
+    //if ( s_accept_notify )
+    //    return notify_req_received( pReq->m_fd );
+    return 0;
+}
+
+
+int LSAPI_Postfork_Parent(LSAPI_Request * pReq)
+{
+    ++g_prefork_server->m_iCurChildren;
+    if (pReq->child_status)
+    {
+        time_t curTime = time( NULL );
+        pReq->child_status->m_tmWaitBegin = curTime;
+        pReq->child_status->m_tmStart = curTime;
+    }
+    close(pReq->m_fd);
+    pReq->m_fd = -1;
+    return 0;
+}
+
+
+int LSAPI_Accept_Before_Fork(LSAPI_Request * pReq)
+{
+    time_t          lastTime = 0;
+    time_t          curTime = 0;
+    fd_set          readfds;
+    struct timeval  timeout;
+    int             wait_secs = 0;
+    int             ret = 0;
+
+    lsapi_prefork_server * pServer = g_prefork_server;
+
+    struct sigaction act;
+
+    lsapi_init_children_status();
+
+    act.sa_flags = 0;
+    act.sa_handler = lsapi_sigchild;
+    sigemptyset(&(act.sa_mask));
+    if (sigaction(SIGCHLD, &act, &old_child))
+    {
+        perror( "Can't set signal handler for SIGCHILD" );
+        return -1;
+    }
+
+    /* Set up handler to kill children upon exit */
+    act.sa_flags = 0;
+    act.sa_handler = lsapi_cleanup;
+    sigemptyset(&(act.sa_mask));
+    if (sigaction(SIGTERM, &act, &old_term) ||
+        sigaction(SIGINT,  &act, &old_int ) ||
+        sigaction(SIGUSR1, &act, &old_usr1) ||
+        sigaction(SIGQUIT, &act, &old_quit))
+    {
+        perror( "Can't set signals" );
+        return -1;
+    }
+    s_stop = 0;
+    pReq->m_reqState = 0;
+
+    while(!s_stop)
+    {
+        if (s_proc_group_timer_cb != NULL) {
+            s_proc_group_timer_cb(&s_ignore_pid);
+        }
+
+        curTime = time(NULL);
+        if (curTime != lastTime)
+        {
+            lastTime = curTime;
+            if (lsapi_parent_dead())
+                break;
+            lsapi_check_child_status(curTime);
+            if (pServer->m_iServerMaxIdle)
+            {
+                if (pServer->m_iCurChildren <= 0)
+                {
+                    ++wait_secs;
+                    if ( wait_secs > pServer->m_iServerMaxIdle )
+                        return -1;
+                }
+                else
+                    wait_secs = 0;
+            }
+        }
+
+#if defined(linux) || defined(__linux) || defined(__linux__) || defined(__gnu_linux__)
+        *s_avail_pages = sysconf(_SC_AVPHYS_PAGES);
+//        lsapi_log("Memory total: %zd, free: %zd, free %%%zd\n",
+//                  s_total_pages, *s_avail_pages, *s_avail_pages * 100 / s_total_pages);
+
+#endif
+        FD_ZERO(&readfds);
+        FD_SET(pServer->m_fd, &readfds);
+        timeout.tv_sec = 1;
+        timeout.tv_usec = 0;
+        ret = (*g_fnSelect)(pServer->m_fd+1, &readfds, NULL, NULL, &timeout);
+        if (ret == 1 )
+        {
+            int accepting = 0;
+            if (s_accepting_workers)
+                accepting = __sync_add_and_fetch(s_accepting_workers, 0);
+
+            if (pServer->m_iCurChildren > 0
+                && accepting > 0)
+            {
+                usleep( 400);
+                while(accepting-- > 0)
+                    sched_yield();
+                continue;
+            }
+        }
+        else if (ret == -1)
+        {
+            if (errno == EINTR)
+                continue;
+            /* perror( "select()" ); */
+            break;
+        }
+        else
+        {
+            continue;
+        }
+
+        if (pServer->m_iCurChildren >=
+            pServer->m_iMaxChildren + pServer->m_iExtraChildren)
+        {
+            lsapi_log("Reached max children process limit: %d, extra: %d,"
+                     " current: %d, busy: %d, please increase LSAPI_CHILDREN.\n",
+                     pServer->m_iMaxChildren, pServer->m_iExtraChildren,
+                     pServer->m_iCurChildren,
+                     s_busy_workers ? *s_busy_workers : -1);
+            usleep(100000);
+            continue;
+        }
+
+        pReq->m_fd = lsapi_accept(pServer->m_fd);
+        if (pReq->m_fd != -1)
+        {
+            wait_secs = 0;
+            pReq->child_status = find_child_status(0);
+
+            ret = 0;
+            break;
+        }
+        else
+        {
+            if ((errno == EINTR) || (errno == EAGAIN))
+                continue;
+            perror( "accept() failed" );
+            ret = -1;
+            break;
+        }
+    }
+
+    sigaction(SIGCHLD, &old_child, 0);
+    sigaction(SIGTERM, &old_term, 0);
+    sigaction(SIGQUIT, &old_quit, 0);
+    sigaction(SIGINT,  &old_int,  0);
+    sigaction(SIGUSR1, &old_usr1, 0);
+
+    return ret;
+}
+
+
 void lsapi_perror( const char * pMessage, int err_no )
 {
    lsapi_log("%s, errno: %d (%s)\n", pMessage, err_no,
@@ -70,7 +70,7 @@ struct LSAPI_key_value_pair
    int    valLen;
 };

-
+struct lsapi_child_status;
 #define LSAPI_MAX_RESP_HEADERS  1000

 typedef struct lsapi_request
@@ -91,6 +91,7 @@ typedef struct lsapi_request
    char            * m_pRespHeaderBuf;
    char            * m_pRespHeaderBufEnd;
    char            * m_pRespHeaderBufPos;
+    struct lsapi_child_status * child_status;


    struct iovec    * m_pIovec;
@@ -395,6 +396,12 @@ void LSAPI_Register_Pgrp_Timer_Callback(LSAPI_On_Timer_pf);

 int LSAPI_Inc_Req_Processed(int cnt);

+int LSAPI_Accept_Before_Fork(LSAPI_Request * pReq);
+
+int LSAPI_Postfork_Child(LSAPI_Request * pReq);
+
+int LSAPI_Postfork_Parent(LSAPI_Request * pReq);
+
 #define LSAPI_LOG_LEVEL_BITS    0xff
 #define LSAPI_LOG_FLAG_NONE     0
 #define LSAPI_LOG_FLAG_DEBUG    1
@@ -1,4 +1,5 @@
 #!/bin/bash
+set -ex
 if [[ "$ENABLE_MAINTAINER_ZTS" == 1 ]]; then
 	TS="--enable-maintainer-zts";
 else
@@ -9,7 +9,7 @@
 #define NTDDI_VERSION 0x06010000

 /* Default PHP / PEAR directories */
-#define PHP_CONFIG_FILE_PATH (getenv("SystemRoot")?getenv("SystemRoot"):"")
+#define PHP_CONFIG_FILE_PATH ""
 #define CONFIGURATION_FILE_PATH "php.ini"
 #define PEAR_INSTALLDIR "@PREFIX@\\pear"
 #define PHP_BINDIR "@PREFIX@"
Author	SHA1	Message	Date
Christoph M. Becker	c15e2532a2	Prepare 7.3.22 tag	2020-09-01 10:33:15 +02:00
Christoph M. Becker	3edc6eea84	Prepare for 7.3.22RC1	2020-08-18 09:19:25 +02:00
Christoph M. Becker	1ae80f8c92	Fix HTTP response status code	2020-08-18 08:33:45 +02:00
Nikita Popov	f6d7af21a3	Null terminate the sodium_crypto_kx_keypair() result	2020-08-14 15:51:31 +02:00
Ahmed Abdou	2fe2e5b48f	Fix #64705 errorInfo property of PDOException is null when PDO::__construct() fails PDO driver constructors are throwing PdoException without setting errorInfo, so create a new reusable function that throws exceptions for PDO and will also set the errorInfo. Use this function in pdo_mysql, pdo_sqlite, and pdo_pgsql.	2020-08-11 17:12:48 +02:00
Nawarian	2fa4ca95db	Fix bug #75785 by attempt switching endianness on Maker's Note Different manufacturer models may come with a different endianness (motorola/intel) format. In order to avoid a big refactor and a gigantic lookup table, this commit simply attempts to switch the endianness and proceed when values are acceptable. Closes GH-5849.	2020-08-11 16:26:34 +02:00
Christoph M. Becker	dc108feab8	Fix #48585 : com_load_typelib holds reference, fails on second call Whether the type library is cached is actually irrelevant here; what matters is that the symbols are imported, and since these are not cached, we have to import them for every request. And we cannot cache the symbols, because the import depends on the current codepage, but the codepage is a `PHP_INI_ALL` setting.	2020-08-11 11:26:50 +02:00
Nikita Popov	9d9dffe60a	Fixed bug #79951 One branch did not release tmp_replace_entry_str. Also reduce the scope of some variables.	2020-08-11 10:33:59 +02:00
George Wang	07cb2755be	Make sure string is NUL byte terminated.	2020-08-10 19:11:03 -04:00
Nikita Popov	4723bd4ffa	Check the correct list This was supposed to check mx_list, not weight_list... oops.	2020-08-10 21:52:36 +02:00
Nikita Popov	a06eed0c0e	Fix bug #79944 Only return true from dns_get_mx if we actually found any MX record.	2020-08-10 20:42:50 +02:00
Christoph M. Becker	0af3f49312	Fix #79922 : Crash after multiple calls to xml_parser_free() We must not call `zend_list_delete()` in resource closer functions exposed to userland, because decreasing the refcount there leads to use-after-free scenarios. In this case, commit `4a42fbb` worked for typical use-cases where `xml_parser_free()` has been called exactly once for the resource, because there is an internal zval (`->index`) referencing the same resource which already increased the refcount by one. However, when `xml_parser_free()` is called multiple times on the same XML parser resource, the resource would be freed prematurely. Instead we forcefully close the resource in `xml_parser_free()`. We also could decrease the refcount of the resource there, but that would require to call `xml_parser_free()` which is somewhat uncommon, and would be particularly bad wrt. PHP 8 where that function is a NOP, and as such doesn't have to be called. So we do no longer increase the refcount of the resource when copying it to the internal zval, and let the usualy refcounting semantics take care of the resource destruction. [1] <http://git.php.net/?p=php-src.git;a=commit;h=4a42fbbbc73aad7427aef5c89974d1833636e082>	2020-08-10 12:23:44 +02:00
Florian Engelhardt	5be670265b	Fix bug #70574 : Move files to proper locale dir Closes GH-5940.	2020-08-07 14:37:27 +02:00
Pieter van den Ham	06ade15528	Fix #79934 : CRLF-only line in heredoc causes parsing error Fixes the function `next_newline()` in zend_language_scanner.l. The function now correctly returns a newline_len of 2 for "\r\n". Closes GH-5944.	2020-08-06 12:02:54 +02:00
Nikita Popov	6a1bd57df5	Fix memory leak on socket_sendmsg() / socket_recvmsg() error	2020-08-05 16:41:40 +02:00
Nikita Popov	da786a22af	Fixed bug #79930 We're inserting src_zval, so that's what we should addref.	2020-08-05 15:43:41 +02:00
David Carlier	12db8b90a7	Fix iov_base pointer type for illumos These systems has two versions of the iovec interface dependent on compiler flags passed, the legacy version causing little build issue. Closes GH-5939.	2020-08-05 15:17:51 +02:00
Christoph M. Becker	c4677af67e	[ci skip] Fix 7.3.21 release date	2020-08-04 12:31:24 +02:00
Remi Collet	4221e000b1	Merge branch 'PHP-7.2' into PHP-7.3 * PHP-7.2: bump version to 7.2.34-dev Update NEWS	2020-08-04 09:55:40 +02:00
Remi Collet	6b8ffdbdeb	bump version to 7.2.34-dev	2020-08-04 09:55:29 +02:00
Graham Campbell	f3a43e85e7	Removed space from bug55086.phpt Closes GH-5923.	2020-08-03 15:14:15 +02:00
Santiago M. Mola	fdf6b0fefe	set -ex on travis/compile.sh -e to fail early: ./configure may fail and further errors from make bury the original problem in the logs. -x for easier debugging	2020-08-03 14:48:00 +02:00
Christoph M. Becker	17d64af186	[ci skip] Add missing NEWS entries	2020-08-03 11:18:18 +02:00
Stanislav Malyshev	07aeb9171d	Update NEWS	2020-08-03 01:14:38 -07:00
Stanislav Malyshev	5b29af5c78	Merge branch 'PHP-7.2' into PHP-7.3 * PHP-7.2: Fix #79877: getimagesize function silently truncates after a null byte Fix #79797: Use of freed hash key in the phar_parse_zipfile function	2020-08-02 23:56:37 -07:00
Christoph M. Becker	ff577b04c0	Fix #79877 : getimagesize function silently truncates after a null byte We have to check for NUL bytes if `getimagesize()` has been called.	2020-08-02 15:33:24 -07:00
Christoph M. Becker	7355ab8176	Fix #79797 : Use of freed hash key in the phar_parse_zipfile function We must not use heap memory after we freed it.	2020-08-02 15:31:29 -07:00
Christoph M. Becker	1e0bc6e30f	Fix #79919 : Stack use-after-scope in define() Instead of the temporary `rv`, we use the `val_free` which is there for this purpose.	2020-07-31 10:54:41 +02:00
Christoph M. Becker	d95c53834c	Amendment to OPcache base file removal We fix the erroneous segment size. We also keep the segment pointer at the allocated address, but increase the position instead.	2020-07-29 18:44:08 +02:00
Nikita Popov	57ad5b3432	Consider op1 literal of FETCH_OBJ_R FETCH_OBJ_R may have an op1 CONST operand, even though it will always error. We should take this into account when compacting literals.	2020-07-29 17:04:23 +02:00
Nikita Popov	99c48a2477	Fix test	2020-07-29 15:04:05 +02:00
Santiago M. Mola	e767ca60a0	Fix #79895 : support = in PHP_CHECK_GCC_ARG m4 macro Closes GH-5890.	2020-07-29 12:36:52 +02:00
twosee	0b8c83f593	Handle bindto error Closes GH-5903.	2020-07-29 17:46:27 +08:00
Christoph M. Becker	9a744c66e7	Fix #73060 : php failed with error after temp folder cleaned up Instead of storing the mapping base address and the address of `execute_ex()` in a separate file in the temporary folder, we store them right at the beginning of the memory mapping.	2020-07-29 10:07:23 +02:00
Christoph M. Becker	c756f82c02	Fix #79806 : realpath() erroneously resolves link to link After resolving reparse points, the path still may be a reparse point; in that case we have to resolve that reparse point as well.	2020-07-28 13:55:22 +02:00
Paweł Tomulik	efe6d96b45	fix memory leaks in ext/ldap/ldap.c	2020-07-28 10:23:10 +02:00
Christoph M. Becker	1aeff522b8	Revert "Fix #79806 : realpath() erroneously resolves link to link" This reverts commit `d5b59b4303`.	2020-07-27 17:50:41 +02:00
Christoph M. Becker	d5b59b4303	Fix #79806 : realpath() erroneously resolves link to link After resolving reparse points, the path still may be a reparse point; in that case we have to resolve that reparse point as well.	2020-07-27 15:08:39 +02:00
Christoph M. Becker	6f18d7e2f9	Fix #77932 : File extensions are case-sensitive The file extension to mime type mapping must not depend on the file extension's case for case-insensitive file systems, and should not for case-sensitive file systems.	2020-07-27 11:52:18 +02:00
George Wang	874284d1c9	Merge branch 'PHP-7.2' into PHP-7.3	2020-07-23 15:36:35 -04:00
George Wang	c39f5fe94e	Security: update to LiteSpeed SAPI v7.7 to address an buffer overflow, and some log message tunings.	2020-07-23 15:35:32 -04:00
Christoph M. Becker	15efb96d4c	Fix #79884 : PHP_CONFIG_FILE_PATH is meaningless It does not make sense to make assumptions about `PHP_CONFIG_FILE_PATH` during build time, since that value is never used during run time on Windows. Since there is no `--with-config-file-path` on Windows either, we define `PHP_CONFIG_FILE_PATH` as `""`.	2020-07-23 15:39:22 +02:00
Christoph M. Becker	6b99a8be4d	Fix brittle test This test fails occasionally due to timing issues, because the session file may have been unlinked by the first `session_start()`'s GC. We adapt the test expectation to this reality.	2020-07-22 20:45:56 +02:00
Christoph M. Becker	2c0a6977dd	7.3 is now 7.3.22-dev	2020-07-21 09:18:07 +02:00
Christoph M. Becker	b2e3fd1e69	Fix #63527 : DCOM does not work with Username, Password parameter We must not mix multibyte and wide character strings in the `COAUTHIDENTITY` structure. Using wide character strings throughout would have the advantage that the remote connection can be established regardless of the code page of the server, but that would more likely break BC, so we just drop the wide character string conversion of the username.	2020-07-20 14:43:29 +02:00
Andy Postnikov	2c57378bd3	Fix bug #78008 : dns_check_record() always return true on Alpine - free handle before return result - cleaned up remaining usage of MAXPACKET - update dns_get_mx() to use the same approach Closes GH-5854.	2020-07-15 15:10:19 +02:00
Evgeny Stepanischev	ce149b0cb8	Fixed bug #79849 Closes GH-5853.	2020-07-14 12:41:43 +02:00
twosee	f0b2c2cb98	Fixed BC break of php_debug_zval_dump It introduced by fixing bug #79830	2020-07-11 18:30:28 +08:00
twosee	56dec3cc73	Fixed bug #79830 introduced by fixing bug #79821 This also fixes memory error in debug_zval_dump and var_export.	2020-07-11 14:37:25 +08:00
twosee	150504e6b1	Fixed bug #79821 HashTable was reallocated (zend_hash_packed_grow) during php_var_dump, so we should call GC_ADDREF to make SEPARATE_ARRAY work. Closes GH-5837.	2020-07-11 06:14:22 +08:00
Nikita Popov	a72c53a070	Fixed bug #79817 Use *_IND macros in a few places in string.c.	2020-07-10 14:06:41 +02:00
Paweł Tomulik	23ef0a1285	Fix some memory bugs in ldap.c	2020-07-09 18:35:00 +02:00
XXiang	3d5de7d746	Fix bug #79787 Closes GH-5807.	2020-07-08 11:20:58 +02:00
Nikita Popov	e6160e99d8	Report len as -1 instead of INT_MAX Per docs it should be -1. And would be on 32-bit systems, but not on 64-bit systems. (cherry picked from commit `39111585a2`)	2020-07-08 10:38:11 +02:00
Sara Golemon	e54f18ae0f	Merge branch 'PHP-7.2' into PHP-7.3 * PHP-7.2: Prep for 7.2.33 Prep NEWS for 7.2.32 release	2020-07-07 19:33:48 +00:00
Sara Golemon	c68d48de9e	Prep for 7.2.33	2020-07-07 19:32:15 +00:00
Sara Golemon	9588c8474e	Prep NEWS for 7.2.32 release	2020-07-07 19:31:05 +00:00
Christoph M. Becker	f23bd48892	Don't use deprecated curly brace offset syntax (cherry picked from commit `7ec3aa1871`) Better safe than sorry in case someone ever builds PHP 7.3 with a future version of PHP SDK with bundled PHP 8.	2020-07-07 13:55:08 +02:00
Nikita Popov	64931fd3c4	Fixed bug #79792 We need to remove the iterators even if the array is empty (we will not create one if the first place, but the array may become empty after the fact).	2020-07-07 11:58:25 +02:00
Nikita Popov	b765f96f5f	Fixed bug #79778 In the interest of avoiding side-effects during dumping, I'm replacing the value with a <constant ast> string instead of performing an update constant operation.	2020-07-07 10:19:39 +02:00
Nikita Popov	187a72d563	Remove bogus generator iterator dtor Fixes a use-after-free encountered in Symfony's SecurityBundle. I don't have a reproducer for this, and believe the issue can only occur if we leak an iterator (the leak is a separate issue). We should not free the generator iterator here, because we do not own it. The code that fetched the iterator is responsible for releasing it. In the rare case where we do hit this code-path, we cause a use-after-free.	2020-06-30 17:32:42 +02:00
Nikita Popov	fc6f53d426	Fix leak when setting cyclic previous exception in finally A curious exception handling pattern found in Symfony's HttpClient.	2020-06-30 12:24:32 +02:00
Christoph M. Becker	7f3bc64287	Fix #70362 : Can't copy() large 'data://' with open_basedir open_basedir is only relevant for plain files, so there is no need to check it for other URL wrappers.	2020-06-30 10:46:53 +02:00
Christoph M. Becker	a385cfa7ad	Fix #63208 : BSTR to PHP string conversion not binary safe A `BSTR` is similar to a `zend_string`; it stores the length of the string just before the actual string, and thus the string may contain NUL bytes. However, `php_com_olestring_to_string()` is supposed to deal with arbitrary `OLECHAR*`s which may not be `BSTR`s, so we introduce `php_com_bstr_to_string()` and use it for the only case where we actually have to deal with `BSTR`s which may contain NUL bytes. Contrary to `php_com_olestring_to_string()` we return a `zend_string`, so we can save the re-allocation when converting to a `zval`. We also cater to `php_com_string_to_olestring()` not being binary safe, with basically the same fix we did for `php_com_olestring_to_string()`.	2020-06-29 19:05:02 +02:00
Christoph M. Becker	816b4c1235	Fix #79756 : finfo_file crash (FILEINFO_MIME) If `ctime` or `asctime` return `NULL`, we must not attempt to copy the buffer, but rather return `NULL` as well.	2020-06-29 17:45:28 +02:00
Nikita Popov	43cd3f6814	Fixed bug #79741	2020-06-26 12:28:39 +02:00
Herbert256	4a26628b29	Fixed bug #79030 Use usec from apache request time Don't unnecessarily truncate to milliseconds. Closes GH-5760.	2020-06-24 14:41:50 +02:00
Christoph M. Becker	e94126aac7	Fix #55857 : ftp_size on large files `atol()` returns a `long` which is not the same as `zend_long` on LLP64; we use `ZEND_ATOL()` instead. There is no need for a new test case, since filesize_large.phpt already tests for that behavior; unfortunately, the FTP test suite relies on `pcntl_fork()` and therefore cannot be run on Windows.	2020-06-23 15:57:24 +02:00
Christoph M. Becker	91982bad63	7.3 is now 7.3.21-dev	2020-06-23 10:29:42 +02:00