Update versions for PHP 7.2.19

* PHP-7.1:
  Fix bug #77967 - Bypassing open_basedir restrictions via file uris

.appveyor.yml

@@ -16,7 +16,7 @@ environment:
         PHP_BUILD_CACHE_BASE_DIR: c:\build-cache
         PHP_BUILD_OBJ_DIR: c:\obj
         PHP_BUILD_CACHE_SDK_DIR: c:\build-cache\sdk
-        PHP_BUILD_SDK_BRANCH: php-sdk-2.2.0beta1
+        PHP_BUILD_SDK_BRANCH: php-sdk-2.2.0beta5
         PHP_BUILD_CRT: vc15
         # ext and env setup for tests
         #MYSQL_TEST_PASSWD: Password12!

.editorconfig

@@ -1,17 +1,19 @@
-# http://editorconfig.org/
+# https://editorconfig.org/
 
 root = true
 
-[*.{c,h,awk,w32,bat,mk,frag}]
+[*]
+tab_width                = 4
+
+[*.{c,h,y,awk,w32,bat,mk,frag,cpp}]
 charset                  = utf-8
 end_of_line              = lf
 indent_size              = 4
 indent_style             = tab
-tab_width                = 4
 trim_trailing_whitespace = true
 insert_final_newline     = true
 
-[*.{php,phpt}]
+[*.{php,phpt,inc}]
 charset                  = utf-8
 end_of_line              = lf
 indent_size              = 4
@@ -31,5 +33,15 @@ insert_final_newline     = true
 charset                  = utf-8
 end_of_line              = lf
 indent_style             = space
-trim_trailing_whitespace = false
+trim_trailing_whitespace = true
 insert_final_newline     = true
+max_line_length          = 80
+
+[COMMIT_EDITMSG]
+charset                  = utf-8
+end_of_line              = lf
+indent_size              = 4
+indent_style             = space
+trim_trailing_whitespace = true
+insert_final_newline     = true
+max_line_length          = 80

NEWS

@@ -1,9 +1,219 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2019, PHP 7.2.15
+30 May 2019, PHP 7.2.19
+
+- EXIF:
+  . Fixed bug #77988 (heap-buffer-overflow on php_jpg_get16).
+    (CVE-2019-11040) (Stas)
+
+- FPM:
+  . Fixed bug #77934 (php-fpm kill -USR2 not working). (Jakub Zelenka)
+  . Fixed bug #77921 (static.php.net doesn't work anymore). (Peter Kokot)
+
+- GD:
+  . Fixed bug #77943 (imageantialias($image, false); does not work). (cmb)
+  . Fixed bug #77973 (Uninitialized read in gdImageCreateFromXbm).
+    (CVE-2019-11038) (cmb)
+
+- Iconv:
+  . Fixed bug #78069 (Out-of-bounds read in iconv.c:_php_iconv_mime_decode()
+    due to integer overflow). (CVE-2019-11039). (maris dot adam)
+
+- JSON:
+  . Fixed bug #77843 (Use after free with json serializer). (Nikita)
+
+- Opcache:
+  . Fixed possible crashes, because of inconsistent PCRE cache and opcache
+    SHM reset. (Alexey Kalinin, Dmitry)
+
+- PDO_MySQL:
+  . Fixed bug #77944 (Wrong meta pdo_type for bigint on LLP64). (cmb)
+
+- Reflection:
+  . Fixed bug #75186 (Inconsistent reflection of Closure:::__invoke()). (Nikita)
+
+- Session:
+  . Fixed bug #77911 (Wrong warning for session.sid_bits_per_character). (cmb)
+
+- SPL:
+  . Fixed bug #77024 (SplFileObject::__toString() may return array). (Craig
+    Duncan)
+
+- SQLite:
+  . Fixed bug #77967 (Bypassing open_basedir restrictions via file uris). (Stas)
+
+02 May 2019, PHP 7.2.18
+
+- CLI:
+  . Fixed bug #77794 (Incorrect Date header format in built-in server).
+    (kelunik)
+
+- Date:
+  . Fixed bug #77909 (DatePeriod::__construct() with invalid recurrence count
+    value). (Ignace Nyamagana Butera)
+
+- EXIF
+  . Fixed bug #77950 (Heap-buffer-overflow in _estrndup via exif_process_IFD_TAG). 
+    (CVE-2019-11036) (Stas)
+
+- Interbase:
+  . Fixed bug #72175 (Impossibility of creating multiple connections to
+    Interbase with php 7.x). (Nikita)
+
+- Intl:
+  . Fixed bug #77895 (IntlDateFormatter::create fails in strict mode if $locale
+    = null). (Nikita)
+
+- litespeed:
+  . LiteSpeed SAPI 7.3.1, better process management, new API function
+    litespeed_finish_request(). (George Wang)
+
+- Mail
+  . Fixed bug #77821 (Potential heap corruption in TSendMail()). (cmb)
+
+- PCRE:
+  . Fixed bug #77827 (preg_match does not ignore \r in regex flags). (requinix,
+    cmb)
+
+- PDO:
+  . Fixed bug #77849 (Disable cloning of PDO handle/connection objects).
+    (camporter)
+
+- phpdbg:
+  . Fixed bug #76801 (too many open files). (alekitto)
+  . Fixed bug #77800 (phpdbg segfaults on listing some conditional breakpoints).
+    (krakjoe)
+  . Fixed bug #77805 (phpdbg build fails when readline is shared). (krakjoe)
+    
+- Reflection:
+  . Fixed bug #77772 (ReflectionClass::getMethods(null) doesn't work). (Nikita)
+  . Fixed bug #77882 (Different behavior: always calls destructor). (Nikita)
+
+- SOAP:
+  . Fixed bug #77945 (Segmentation fault when constructing SoapClient with
+    WSDL_CACHE_BOTH). (Nikita)
+
+- Standard:
+  . Fixed bug #77680 (recursive mkdir on ftp stream wrapper is incorrect).
+    (Vlad Temian)
+  . Fixed bug #77844 (Crash due to null pointer in parse_ini_string with
+    INI_SCANNER_TYPED). (Nikita)
+  . Fixed bug #77853 (Inconsistent substr_compare behaviour with empty
+    haystack). (Nikita)
+
+04 Apr 2019, PHP 7.2.17
+
+- Core:
+  . Fixed bug #77738 (Nullptr deref in zend_compile_expr). (Laruence)
+  . Fixed bug #77660 (Segmentation fault on break 2147483648). (Laruence)
+  . Fixed bug #77652 (Anonymous classes can lose their interface information).
+    (Nikita)
+  . Fixed bug #77676 (Unable to run tests when building shared extension on
+    AIX). (Kevin Adler)
+
+- Bcmath:
+  . Fixed bug #77742 (bcpow() implementation related to gcc compiler
+    optimization). (Nikita)
+
+- COM:
+  . Fixed bug #77578 (Crash when php unload). (cmb)
+
+- Date:
+  . Fixed bug #50020 (DateInterval:createDateFromString() silently fails).
+    (Derick)
+  . Fixed bug #75113 (Added DatePeriod::getRecurrences() method). (Ignace
+    Nyamagana Butera)
+
+- EXIF:
+  . Fixed bug #77753 (Heap-buffer-overflow in php_ifd_get32s). (CVE-2019-11034)
+    (Stas)
+  . Fixed bug #77831 (Heap-buffer-overflow in exif_iif_add_value). 
+    (CVE-2019-11035) (Stas)
+
+- FPM:
+  . Fixed bug #77677 (FPM fails to build on AIX due to missing WCOREDUMP).
+    (Kevin Adler)
+
+- GD:
+  . Fixed bug #77700 (Writing truecolor images as GIF ignores interlace flag).
+    (cmb)
+
+- MySQLi:
+  . Fixed bug #77597 (mysqli_fetch_field hangs scripts). (Nikita)
+
+- Opcache:
+  . Fixed bug #77691 (Opcache passes wrong value for inline array push
+    assignments). (Nikita)
+  . Fixed bug #77743 (Incorrect pi node insertion for jmpznz with identical
+    successors). (Nikita)
+
+- phpdbg:
+  . Fixed bug #77767 (phpdbg break cmd aliases listed in help do not match
+    actual aliases). (Miriam Lauter)
+
+- sodium:
+  . Fixed bug #77646 (sign_detached() strings not terminated). (Frank)
+
+- SQLite3:
+  . Added sqlite3.defensive INI directive. (BohwaZ)
+
+- Standard:
+  . Fixed bug #77664 (Segmentation fault when using undefined constant in
+    custom wrapper). (Laruence)
+  . Fixed bug #77669 (Crash in extract() when overwriting extracted array).
+    (Nikita)
+  . Fixed bug #76717 (var_export() does not create a parsable value for
+    PHP_INT_MIN). (Nikita)
+  . Fixed bug #77765 (FTP stream wrapper should set the directory as
+    executable). (Vlad Temian)
+
+07 Mar 2019, PHP 7.2.16
+
+- Core:
+  . Fixed bug #77589 (Core dump using parse_ini_string with numeric sections).
+    (Laruence)
+  . Fixed bug #77630 (rename() across the device may allow unwanted access
+    during processing). (Stas)
+
+- COM:
+  . Fixed bug #77621 (Already defined constants are not properly reported).
+    (cmb)
+
+- EXIF:
+  . Fixed bug #77509 (Uninitialized read in exif_process_IFD_in_TIFF). (Stas)
+  . Fixed bug #77540 (Invalid Read on exif_process_SOFn). (Stas)
+  . Fixed bug #77563 (Uninitialized read in exif_process_IFD_in_MAKERNOTE). (Stas)
+  . Fixed bug #77659 (Uninitialized read in exif_process_IFD_in_MAKERNOTE). (Stas)
+
+- PDO_OCI:
+  . Support Oracle Database tracing attributes ACTION, MODULE,
+    CLIENT_INFO, and CLIENT_IDENTIFIER. (Cameron Porter)
+
+- PHAR:
+  . Fixed bug #77396 (Null Pointer Dereference in phar_create_or_parse_filename).
+    (bishop)
+
+- SPL:
+  . Fixed bug #51068 (DirectoryIterator glob:// don't support current path
+    relative queries). (Ahmed Abdou)
+  . Fixed bug #77431 (openFile() silently truncates after a null byte). (cmb)
+
+- Standard:
+  . Fixed bug #77552 (Unintialized php_stream_statbuf in stat functions).
+    (John Stevenson)
+
+- MySQL
+  . Disabled LOCAL INFILE by default, can be enabled using php.ini directive
+    mysqli.allow_local_infile for mysqli, or PDO::MYSQL_ATTR_LOCAL_INFILE
+    attribute for pdo_mysql. (Darek Slusarczyk)
+
+07 Feb 2019, PHP 7.2.15
 
 - Core:
   . Fixed bug #77339 (__callStatic may get incorrect arguments). (Dmitry)
+  . Fixed bug #77494 (Disabling class causes segfault on member access).
+    (Dmitry)
+  . Fixed bug #77530 (PHP crashes when parsing `(2)::class`). (Ekin)
 
 - Curl:
   . Fixed bug #76675 (Segfault with H2 server push). (Pedro Magalhães)
@@ -32,10 +242,17 @@ PHP                                                                        NEWS
   . Fixed bug #77361 (configure fails on 64-bit AIX when opcache enabled).
     (Kevin Adler)
 
+- OpenSSL:
+  . Fixed bug #77390 (feof might hang on TLS streams in case of fragmented TLS
+    records). (Abyl Valg, Jakub Zelenka)
+
 - PDO:
   . Fixed bug #77273 (array_walk_recursive corrupts value types leading to PDO
     failure). (Nikita)
 
+- phpdbg:
+  . Fixed bug #76596 (phpdbg support for display_errors=stderr). (kabel)
+
 - Sockets:
   . Fixed bug #76839 (socket_recvfrom may return an invalid 'from' address
     on MacOS). (Michael Meyer)

Zend/tests/bug55509.phpt

@@ -46,7 +46,7 @@ elseif (PHP_OS == 'FreeBSD') {
     die('skip Not enough memory.');
   }
 } elseif (PHP_OS == "WINNT") {
-  $s = trim(shell_exec("wmic OS get FreeVirtualMemory /Value 2>nil"));
+  $s = trim(shell_exec("wmic OS get FreeVirtualMemory /Value 2>nul"));
   $freeMemory = explode('=', $s)[1]*1;
 
   if ($freeMemory < 2.1*1024*1024) {

Zend/tests/bug77494.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug #77494 (Disabling class causes segfault on member access)
+--SKIPIF--
+<?php if (!extension_loaded("curl")) exit("skip curl extension not loaded"); ?>
+--INI--
+disable_classes=CURLFile
+--FILE--
+<?php
+$a = new CURLFile();
+var_dump($a->name);
+?>
+--EXPECTF--
+Warning: CURLFile() has been disabled for security reasons in %sbug77494.php on line 2
+
+Notice: Undefined property: CURLFile::$name in %sbug77494.php on line 3
+NULL

Zend/tests/bug77530.phpt

@@ -0,0 +1,10 @@
+--TEST--
+Bug #77530: PHP crashes when parsing '(2)::class'
+--FILE--
+<?php
+
+echo (2)::class;
+
+?>
+--EXPECTF--
+Fatal error: Illegal class name in %s on line %d

Zend/tests/bug77589.phpt

@@ -0,0 +1,40 @@
+--TEST--
+BUG #77589 (Core dump using parse_ini_string with numeric sections)
+--FILE--
+<?php
+var_dump(
+	parse_ini_string(<<<INI
+[0]
+a = 1
+b = on
+c = true
+
+["true"]
+a = 100 
+b = null
+c = yes
+INI
+, TRUE, INI_SCANNER_TYPED));
+
+?>
+--EXPECT--
+array(2) {
+  [0]=>
+  array(3) {
+    ["a"]=>
+    int(1)
+    ["b"]=>
+    bool(true)
+    ["c"]=>
+    bool(true)
+  }
+  ["true"]=>
+  array(3) {
+    ["a"]=>
+    int(100)
+    ["b"]=>
+    NULL
+    ["c"]=>
+    bool(true)
+  }
+}

Zend/tests/bug77652.inc

@@ -0,0 +1,6 @@
+<?php
+return [
+  'I' => function() {
+    return new class implements I {};
+  },
+];

Zend/tests/bug77652.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug #77652: Anonymous classes can lose their interface information
+--FILE--
+<?php
+
+interface I {}
+require __DIR__ . '/bug77652.inc';
+$data = require __DIR__ . '/bug77652.inc';
+print_r(class_implements($data['I']()));
+
+?>
+--EXPECT--
+Array
+(
+    [I] => I
+)

Zend/tests/bug77660.phpt

@@ -0,0 +1,10 @@
+--TEST--
+Bug #77660 (Segmentation fault on break 2147483648)
+--SKIPIF--
+<?php if (PHP_INT_SIZE != 8) die("skip this test is for 64bit platform only"); ?>
+--FILE--
+<?php
+for(;;) break 2147483648;
+?>
+--EXPECTF--
+Fatal error: Cannot 'break' 2147483648 levels in %sbug77660.php on line %d

Zend/tests/bug77738.phpt

@@ -0,0 +1,8 @@
+--TEST--
+Bug #77738 (Nullptr deref in zend_compile_expr)
+--FILE--
+<?php
+__COMPILER_HALT_OFFSET__;
+; // <- important
+--EXPECTF--
+Warning: Use of undefined constant __COMPILER_HALT_OFFSET__ - assumed '__COMPILER_HALT_OFFSET__' %sbug77738.php on line %d

Zend/tests/bug77993.phpt

@@ -0,0 +1,7 @@
+--TEST--
+Bug #77993 (Wrong parse error for invalid hex literal on Windows)
+--FILE--
+<?php
+0xg10;
+--EXPECTF--
+Parse error: syntax error, unexpected 'xg10' (T_STRING) in %s on line %d

Zend/tests/exception_getters_with_ref_props.phpt

@@ -0,0 +1,30 @@
+--TEST--
+Calling exception getters when properties hold references
+--FILE--
+<?php
+
+class MyException extends Exception {
+    public function __construct(&$refMsg, &$refCode, &$refFile, &$refLine) {
+        $this->message =& $refMsg;
+        $this->code =& $refCode;
+        $this->file =& $refFile;
+        $this->line =& $refLine;
+    }
+}
+
+$refMsg = "foo";
+$refCode = 0;
+$refFile = "foobar";
+$refLine = 42;
+$ex = new MyException($refMsg, $refCode, $refFile, $refLine);
+var_dump($ex->getMessage());
+var_dump($ex->getCode());
+var_dump($ex->getFile());
+var_dump($ex->getLine());
+
+?>
+--EXPECT--
+string(3) "foo"
+int(0)
+string(6) "foobar"
+int(42)

Zend/tests/object_gc_in_shutdown.phpt

@@ -0,0 +1,14 @@
+--TEST--
+Bug object gc not working in shutdown
+--FILE--
+<?php
+ini_set('memory_limit', '2M');
+register_shutdown_function(function () {
+    for ($n = 1000 * 1000; $n--;) {
+        new stdClass;
+    }
+    echo "OK\n";
+});
+?>
+--EXPECT--
+OK

Zend/tests/type_declarations/parent_is_not_proto.phpt

@@ -0,0 +1,17 @@
+--TEST--
+The parent class is not necessarily the class of the prototype
+--FILE--
+<?php
+
+class A {
+    function test(): B {}
+}
+class B extends A {}
+class C extends B {
+    function test(): parent {}
+}
+
+?>
+===DONE===
+--EXPECT--
+===DONE===

Zend/zend_API.c

@@ -2855,6 +2855,17 @@ static zend_object *display_disabled_class(zend_class_entry *class_type) /* {{{
 	zend_object *intern;
 
 	intern = zend_objects_new(class_type);
+
+	/* Initialize default properties */
+	if (EXPECTED(class_type->default_properties_count != 0)) {
+		zval *p = intern->properties_table;
+		zval *end = p + class_type->default_properties_count;
+		do {
+			ZVAL_UNDEF(p);
+			p++;
+		} while (p != end);
+	}
+
 	zend_error(E_WARNING, "%s() has been disabled for security reasons", ZSTR_VAL(class_type->name));
 	return intern;
 }

Zend/zend_API.h

@@ -737,7 +737,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_error(zend_bool throw_
 		char *_error = NULL; \
 		zend_bool _dummy; \
 		zend_bool _optional = 0; \
-		int _error_code = ZPP_ERROR_OK; \
+		int error_code = ZPP_ERROR_OK; \
 		((void)_i); \
 		((void)_real_arg); \
 		((void)_arg); \
@@ -753,7 +753,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_error(zend_bool throw_
 				if (!(_flags & ZEND_PARSE_PARAMS_QUIET)) { \
 					zend_wrong_parameters_count_error(_flags & ZEND_PARSE_PARAMS_THROW, _num_args, _min_num_args, _max_num_args); \
 				} \
-				_error_code = ZPP_ERROR_FAILURE; \
+				error_code = ZPP_ERROR_FAILURE; \
 				break; \
 			} \
 			_i = 0; \
@@ -764,13 +764,13 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_error(zend_bool throw_
 
 #define ZEND_PARSE_PARAMETERS_END_EX(failure) \
 		} while (0); \
-		if (UNEXPECTED(_error_code != ZPP_ERROR_OK)) { \
+		if (UNEXPECTED(error_code != ZPP_ERROR_OK)) { \
 			if (!(_flags & ZEND_PARSE_PARAMS_QUIET)) { \
-				if (_error_code == ZPP_ERROR_WRONG_CALLBACK) { \
+				if (error_code == ZPP_ERROR_WRONG_CALLBACK) { \
 					zend_wrong_callback_error(_flags & ZEND_PARSE_PARAMS_THROW, E_WARNING, _i, _error); \
-				} else if (_error_code == ZPP_ERROR_WRONG_CLASS) { \
+				} else if (error_code == ZPP_ERROR_WRONG_CLASS) { \
 					zend_wrong_parameter_class_error(_flags & ZEND_PARSE_PARAMS_THROW, _i, _error, _arg); \
-				} else if (_error_code == ZPP_ERROR_WRONG_ARG) { \
+				} else if (error_code == ZPP_ERROR_WRONG_ARG) { \
 					zend_wrong_parameter_type_error(_flags & ZEND_PARSE_PARAMS_THROW, _i, _expected_type, _arg); \
 				} \
 			} \
@@ -806,7 +806,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_error(zend_bool throw_
 		Z_PARAM_PROLOGUE(deref, separate); \
 		if (UNEXPECTED(!zend_parse_arg_array(_arg, &dest, check_null, 0))) { \
 			_expected_type = Z_EXPECTED_ARRAY; \
-			_error_code = ZPP_ERROR_WRONG_ARG; \
+			error_code = ZPP_ERROR_WRONG_ARG; \
 			break; \
 		}
 
@@ -821,7 +821,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_error(zend_bool throw_
 		Z_PARAM_PROLOGUE(deref, separate); \
 		if (UNEXPECTED(!zend_parse_arg_array(_arg, &dest, check_null, 1))) { \
 			_expected_type = Z_EXPECTED_ARRAY; \
-			_error_code = ZPP_ERROR_WRONG_ARG; \
+			error_code = ZPP_ERROR_WRONG_ARG; \
 			break; \
 		}
 
@@ -836,7 +836,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_error(zend_bool throw_
 		Z_PARAM_PROLOGUE(deref, separate); \
 		if (UNEXPECTED(!zend_parse_arg_bool(_arg, &dest, &is_null, check_null))) { \
 			_expected_type = Z_EXPECTED_BOOL; \
-			_error_code = ZPP_ERROR_WRONG_ARG; \
+			error_code = ZPP_ERROR_WRONG_ARG; \
 			break; \
 		}
 
@@ -850,7 +850,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_error(zend_bool throw_
 #define Z_PARAM_CLASS_EX2(dest, check_null, deref, separate) \
 		Z_PARAM_PROLOGUE(deref, separate); \
 		if (UNEXPECTED(!zend_parse_arg_class(_arg, &dest, _i, check_null))) { \
-			_error_code = ZPP_ERROR_FAILURE; \
+			error_code = ZPP_ERROR_FAILURE; \
 			break; \
 		}
 
@@ -865,7 +865,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_error(zend_bool throw_
 		Z_PARAM_PROLOGUE(deref, separate); \
 		if (UNEXPECTED(!zend_parse_arg_double(_arg, &dest, &is_null, check_null))) { \
 			_expected_type = Z_EXPECTED_DOUBLE; \
-			_error_code = ZPP_ERROR_WRONG_ARG; \
+			error_code = ZPP_ERROR_WRONG_ARG; \
 			break; \
 		}
 
@@ -881,10 +881,10 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_error(zend_bool throw_
 		if (UNEXPECTED(!zend_parse_arg_func(_arg, &dest_fci, &dest_fcc, check_null, &_error))) { \
 			if (!_error) { \
 				_expected_type = Z_EXPECTED_FUNC; \
-				_error_code = ZPP_ERROR_WRONG_ARG; \
+				error_code = ZPP_ERROR_WRONG_ARG; \
 				break; \
 			} else { \
-				_error_code = ZPP_ERROR_WRONG_CALLBACK; \
+				error_code = ZPP_ERROR_WRONG_CALLBACK; \
 				break; \
 			} \
 		} else if (UNEXPECTED(_error != NULL)) { \
@@ -902,7 +902,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_error(zend_bool throw_
 		Z_PARAM_PROLOGUE(deref, separate); \
 		if (UNEXPECTED(!zend_parse_arg_array_ht(_arg, &dest, check_null, 0, separate))) { \
 			_expected_type = Z_EXPECTED_ARRAY; \
-			_error_code = ZPP_ERROR_WRONG_ARG; \
+			error_code = ZPP_ERROR_WRONG_ARG; \
 			break; \
 		}
 
@@ -917,7 +917,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_error(zend_bool throw_
 		Z_PARAM_PROLOGUE(deref, separate); \
 		if (UNEXPECTED(!zend_parse_arg_array_ht(_arg, &dest, check_null, 1, separate))) { \
 			_expected_type = Z_EXPECTED_ARRAY; \
-			_error_code = ZPP_ERROR_WRONG_ARG; \
+			error_code = ZPP_ERROR_WRONG_ARG; \
 			break; \
 		}
 
@@ -932,7 +932,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_error(zend_bool throw_
 		Z_PARAM_PROLOGUE(deref, separate); \
 		if (UNEXPECTED(!zend_parse_arg_long(_arg, &dest, &is_null, check_null, 0))) { \
 			_expected_type = Z_EXPECTED_LONG; \
-			_error_code = ZPP_ERROR_WRONG_ARG; \
+			error_code = ZPP_ERROR_WRONG_ARG; \
 			break; \
 		}
 
@@ -947,7 +947,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_error(zend_bool throw_
 		Z_PARAM_PROLOGUE(deref, separate); \
 		if (UNEXPECTED(!zend_parse_arg_long(_arg, &dest, &is_null, check_null, 1))) { \
 			_expected_type = Z_EXPECTED_LONG; \
-			_error_code = ZPP_ERROR_WRONG_ARG; \
+			error_code = ZPP_ERROR_WRONG_ARG; \
 			break; \
 		}
 
@@ -962,7 +962,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_error(zend_bool throw_
 		Z_PARAM_PROLOGUE(deref, separate); \
 		if (UNEXPECTED(!zend_parse_arg_object(_arg, &dest, NULL, check_null))) { \
 			_expected_type = Z_EXPECTED_OBJECT; \
-			_error_code = ZPP_ERROR_WRONG_ARG; \
+			error_code = ZPP_ERROR_WRONG_ARG; \
 			break; \
 		}
 
@@ -978,11 +978,11 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_error(zend_bool throw_
 		if (UNEXPECTED(!zend_parse_arg_object(_arg, &dest, _ce, check_null))) { \
 			if (_ce) { \
 				_error = ZSTR_VAL((_ce)->name); \
-				_error_code = ZPP_ERROR_WRONG_CLASS; \
+				error_code = ZPP_ERROR_WRONG_CLASS; \
 				break; \
 			} else { \
 				_expected_type = Z_EXPECTED_OBJECT; \
-				_error_code = ZPP_ERROR_WRONG_ARG; \
+				error_code = ZPP_ERROR_WRONG_ARG; \
 				break; \
 			} \
 		}
@@ -998,7 +998,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_error(zend_bool throw_
 		Z_PARAM_PROLOGUE(deref, separate); \
 		if (UNEXPECTED(!zend_parse_arg_path(_arg, &dest, &dest_len, check_null))) { \
 			_expected_type = Z_EXPECTED_PATH; \
-			_error_code = ZPP_ERROR_WRONG_ARG; \
+			error_code = ZPP_ERROR_WRONG_ARG; \
 			break; \
 		}
 
@@ -1013,7 +1013,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_error(zend_bool throw_
 		Z_PARAM_PROLOGUE(deref, separate); \
 		if (UNEXPECTED(!zend_parse_arg_path_str(_arg, &dest, check_null))) { \
 			_expected_type = Z_EXPECTED_PATH; \
-			_error_code = ZPP_ERROR_WRONG_ARG; \
+			error_code = ZPP_ERROR_WRONG_ARG; \
 			break; \
 		}
 
@@ -1028,7 +1028,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_error(zend_bool throw_
 		Z_PARAM_PROLOGUE(deref, separate); \
 		if (UNEXPECTED(!zend_parse_arg_resource(_arg, &dest, check_null))) { \
 			_expected_type = Z_EXPECTED_RESOURCE; \
-			_error_code = ZPP_ERROR_WRONG_ARG; \
+			error_code = ZPP_ERROR_WRONG_ARG; \
 			break; \
 		}
 
@@ -1043,7 +1043,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_error(zend_bool throw_
 		Z_PARAM_PROLOGUE(deref, separate); \
 		if (UNEXPECTED(!zend_parse_arg_string(_arg, &dest, &dest_len, check_null))) { \
 			_expected_type = Z_EXPECTED_STRING; \
-			_error_code = ZPP_ERROR_WRONG_ARG; \
+			error_code = ZPP_ERROR_WRONG_ARG; \
 			break; \
 		}
 
@@ -1058,7 +1058,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_error(zend_bool throw_
 		Z_PARAM_PROLOGUE(deref, separate); \
 		if (UNEXPECTED(!zend_parse_arg_str(_arg, &dest, check_null))) { \
 			_expected_type = Z_EXPECTED_STRING; \
-			_error_code = ZPP_ERROR_WRONG_ARG; \
+			error_code = ZPP_ERROR_WRONG_ARG; \
 			break; \
 		}
 

Zend/zend_alloc.c

@@ -193,9 +193,7 @@ typedef struct  _zend_mm_free_slot zend_mm_free_slot;
 typedef struct  _zend_mm_chunk     zend_mm_chunk;
 typedef struct  _zend_mm_huge_list zend_mm_huge_list;
 
-#ifdef MAP_HUGETLB
 int zend_mm_use_huge_pages = 0;
-#endif
 
 /*
  * Memory is retrived from OS by chunks of fixed size 2MB.
@@ -712,7 +710,9 @@ static void *zend_mm_chunk_alloc_int(size_t size, size_t alignment)
 		return NULL;
 	} else if (ZEND_MM_ALIGNED_OFFSET(ptr, alignment) == 0) {
 #ifdef MADV_HUGEPAGE
-	    madvise(ptr, size, MADV_HUGEPAGE);
+		if (zend_mm_use_huge_pages) {
+			madvise(ptr, size, MADV_HUGEPAGE);
+		}
 #endif
 		return ptr;
 	} else {
@@ -743,7 +743,9 @@ static void *zend_mm_chunk_alloc_int(size_t size, size_t alignment)
 			zend_mm_munmap((char*)ptr + size, alignment - REAL_PAGE_SIZE);
 		}
 # ifdef MADV_HUGEPAGE
-	    madvise(ptr, size, MADV_HUGEPAGE);
+		if (zend_mm_use_huge_pages) {
+			madvise(ptr, size, MADV_HUGEPAGE);
+		}
 # endif
 #endif
 		return ptr;
@@ -2600,8 +2602,9 @@ ZEND_API void shutdown_memory_manager(int silent, int full_shutdown)
 
 static void alloc_globals_ctor(zend_alloc_globals *alloc_globals)
 {
+	char *tmp;
 #if ZEND_MM_CUSTOM
-	char *tmp = getenv("USE_ZEND_ALLOC");
+	tmp = getenv("USE_ZEND_ALLOC");
 
 	if (tmp && !zend_atoi(tmp, 0)) {
 		alloc_globals->mm_heap = malloc(sizeof(zend_mm_heap));
@@ -2613,12 +2616,10 @@ static void alloc_globals_ctor(zend_alloc_globals *alloc_globals)
 		return;
 	}
 #endif
-#ifdef MAP_HUGETLB
 	tmp = getenv("USE_ZEND_ALLOC_HUGE_PAGES");
 	if (tmp && zend_atoi(tmp, 0)) {
 		zend_mm_use_huge_pages = 1;
 	}
-#endif
 	ZEND_TSRMLS_CACHE_UPDATE();
 	alloc_globals->mm_heap = zend_mm_init();
 }

Zend/zend_compile.c

@@ -1494,6 +1494,7 @@ static void zend_ensure_valid_class_fetch_type(uint32_t fetch_type) /* {{{ */
 static zend_bool zend_try_compile_const_expr_resolve_class_name(zval *zv, zend_ast *class_ast, zend_ast *name_ast, zend_bool constant) /* {{{ */
 {
 	uint32_t fetch_type;
+	zval *class_name;
 
 	if (name_ast->kind != ZEND_AST_ZVAL) {
 		return 0;
@@ -1508,7 +1509,13 @@ static zend_bool zend_try_compile_const_expr_resolve_class_name(zval *zv, zend_a
 			"Dynamic class names are not allowed in compile-time ::class fetch");
 	}
 
-	fetch_type = zend_get_class_fetch_type(zend_ast_get_str(class_ast));
+	class_name = zend_ast_get_zval(class_ast);
+
+	if (Z_TYPE_P(class_name) != IS_STRING) {
+		zend_error_noreturn(E_COMPILE_ERROR, "Illegal class name");
+	}
+
+	fetch_type = zend_get_class_fetch_type(Z_STR_P(class_name));
 	zend_ensure_valid_class_fetch_type(fetch_type);
 
 	switch (fetch_type) {
@@ -3623,7 +3630,7 @@ int zend_compile_func_cuf(znode *result, zend_ast_list *args, zend_string *lcnam
 }
 /* }}} */
 
-static int zend_compile_assert(znode *result, zend_ast_list *args, zend_string *name, zend_function *fbc) /* {{{ */
+static void zend_compile_assert(znode *result, zend_ast_list *args, zend_string *name, zend_function *fbc) /* {{{ */
 {
 	if (EG(assertions) >= 0) {
 		znode name_node;
@@ -3666,8 +3673,6 @@ static int zend_compile_assert(znode *result, zend_ast_list *args, zend_string *
 		result->op_type = IS_CONST;
 		ZVAL_TRUE(&result->u.constant);
 	}
-
-	return SUCCESS;
 }
 /* }}} */
 
@@ -3875,10 +3880,6 @@ int zend_try_compile_special_func(znode *result, zend_string *lcname, zend_ast_l
 		return FAILURE;
 	}
 
-	if (zend_string_equals_literal(lcname, "assert")) {
-		return zend_compile_assert(result, args, lcname, fbc);
-	}
-
 	if (CG(compiler_options) & ZEND_COMPILE_NO_BUILTINS) {
 		return FAILURE;
 	}
@@ -3981,8 +3982,16 @@ void zend_compile_call(znode *result, zend_ast *ast, uint32_t type) /* {{{ */
 		zend_op *opline;
 
 		lcname = zend_string_tolower(Z_STR_P(name));
-
 		fbc = zend_hash_find_ptr(CG(function_table), lcname);
+
+		/* Special assert() handling should apply independently of compiler flags. */
+		if (fbc && zend_string_equals_literal(lcname, "assert")) {
+			zend_compile_assert(result, zend_ast_get_list(args_ast), lcname, fbc);
+			zend_string_release(lcname);
+			zval_ptr_dtor(&name_node.u.constant);
+			return;
+		}
+
 		if (!fbc
 		 || (fbc->type == ZEND_INTERNAL_FUNCTION && (CG(compiler_options) & ZEND_COMPILE_IGNORE_INTERNAL_FUNCTIONS))
 		 || (fbc->type == ZEND_USER_FUNCTION && (CG(compiler_options) & ZEND_COMPILE_IGNORE_USER_FUNCTIONS))
@@ -4499,7 +4508,7 @@ void zend_compile_break_continue(zend_ast *ast) /* {{{ */
 	zend_ast *depth_ast = ast->child[0];
 
 	zend_op *opline;
-	int depth;
+	zend_long depth;
 
 	ZEND_ASSERT(ast->kind == ZEND_AST_BREAK || ast->kind == ZEND_AST_CONTINUE);
 
@@ -4526,7 +4535,7 @@ void zend_compile_break_continue(zend_ast *ast) /* {{{ */
 			ast->kind == ZEND_AST_BREAK ? "break" : "continue");
 	} else {
 		if (!zend_handle_loops_and_finally_ex(depth, NULL)) {
-			zend_error_noreturn(E_COMPILE_ERROR, "Cannot '%s' %d level%s",
+			zend_error_noreturn(E_COMPILE_ERROR, "Cannot '%s' " ZEND_LONG_FMT " level%s",
 				ast->kind == ZEND_AST_BREAK ? "break" : "continue",
 				depth, depth == 1 ? "" : "s");
 		}
@@ -4907,6 +4916,10 @@ static zend_uchar determine_switch_jumptable_type(zend_ast_list *cases) {
 }
 
 static zend_bool should_use_jumptable(zend_ast_list *cases, zend_uchar jumptable_type) {
+	if (CG(compiler_options) & ZEND_COMPILE_NO_JUMPTABLES) {
+		return 0;
+	}
+
 	/* Thresholds are chosen based on when the average switch time for equidistributed
 	 * input becomes smaller when using the jumptable optimization. */
 	if (jumptable_type == IS_LONG) {
@@ -6352,10 +6365,32 @@ void zend_compile_class_decl(zend_ast *ast) /* {{{ */
 		if (!zend_hash_exists(CG(class_table), lcname)) {
 			zend_hash_add_ptr(CG(class_table), lcname, ce);
 		} else {
-			/* this anonymous class has been included */
+			/* This anonymous class has been included, reuse the existing definition.
+			 * NB: This behavior is buggy, and this should always result in a separate
+			 * class declaration. However, until the problem of RTD key collisions is
+			 * solved, this gives a behavior close to what is expected. */
 			zval zv;
 			ZVAL_PTR(&zv, ce);
 			destroy_zend_class(&zv);
+			ce = zend_hash_find_ptr(CG(class_table), lcname);
+
+			/* Manually replicate emission of necessary inheritance opcodes here. We cannot
+			 * reuse the general code, as we only want to emit the opcodes, without modifying
+			 * the reused class definition. */
+			if (ce->ce_flags & ZEND_ACC_IMPLEMENT_TRAITS) {
+				zend_emit_op(NULL, ZEND_BIND_TRAITS, &declare_node, NULL);
+			}
+			if (implements_ast) {
+				zend_ast_list *iface_list = zend_ast_get_list(implements_ast);
+				uint32_t i;
+				for (i = 0; i < iface_list->children; i++) {
+					opline = zend_emit_op(NULL, ZEND_ADD_INTERFACE, &declare_node, NULL);
+					opline->op2_type = IS_CONST;
+					opline->op2.constant = zend_add_class_name_literal(CG(active_op_array),
+						zend_resolve_class_name_ast(iface_list->child[i]));
+				}
+				zend_emit_op(NULL, ZEND_VERIFY_ABSTRACT_CLASS, &declare_node, NULL);
+			}
 			return;
 		}
 	} else {
@@ -7638,11 +7673,11 @@ void zend_compile_const(znode *result, zend_ast *ast) /* {{{ */
 	if (zend_string_equals_literal(resolved_name, "__COMPILER_HALT_OFFSET__") || (name_ast->attr != ZEND_NAME_RELATIVE && zend_string_equals_literal(orig_name, "__COMPILER_HALT_OFFSET__"))) {
 		zend_ast *last = CG(ast);
 
-		while (last->kind == ZEND_AST_STMT_LIST) {
+		while (last && last->kind == ZEND_AST_STMT_LIST) {
 			zend_ast_list *list = zend_ast_get_list(last);
 			last = list->child[list->children-1];
 		}
-		if (last->kind == ZEND_AST_HALT_COMPILER) {
+		if (last && last->kind == ZEND_AST_HALT_COMPILER) {
 			result->op_type = IS_CONST;
 			ZVAL_LONG(&result->u.constant, Z_LVAL_P(zend_ast_get_zval(last->child[0])));
 			zend_string_release(resolved_name);

Zend/zend_compile.h

@@ -1040,6 +1040,9 @@ END_EXTERN_C()
 /* disable builtin special case function calls */
 #define ZEND_COMPILE_NO_BUILTINS				(1<<10)
 
+/* disable jumptable optimization for switch statements */
+#define ZEND_COMPILE_NO_JUMPTABLES				(1<<11)
+
 /* The default value for CG(compiler_options) */
 #define ZEND_COMPILE_DEFAULT					ZEND_COMPILE_HANDLE_OP_ARRAY
 

Zend/zend_constants.c

@@ -341,7 +341,9 @@ ZEND_API zval *zend_get_constant_ex(zend_string *cname, zend_class_entry *scope,
 				ret_constant = NULL;
 			} else {
 				if (!zend_verify_const_access(c, scope)) {
-					zend_throw_error(NULL, "Cannot access %s const %s::%s", zend_visibility_string(Z_ACCESS_FLAGS(c->value)), ZSTR_VAL(class_name), ZSTR_VAL(constant_name));
+					if ((flags & ZEND_FETCH_CLASS_SILENT) == 0) {
+						zend_throw_error(NULL, "Cannot access %s const %s::%s", zend_visibility_string(Z_ACCESS_FLAGS(c->value)), ZSTR_VAL(class_name), ZSTR_VAL(constant_name));
+					}
 					goto failure;
 				}
 				ret_constant = &c->value;

Zend/zend_exceptions.c

@@ -401,11 +401,13 @@ ZEND_METHOD(error_exception, __construct)
    Get the file in which the exception occurred */
 ZEND_METHOD(exception, getFile)
 {
-	zval rv;
+	zval *prop, rv;
 
 	DEFAULT_0_PARAMS;
 
-	ZVAL_COPY(return_value, GET_PROPERTY(getThis(), ZEND_STR_FILE));
+	prop = GET_PROPERTY(getThis(), ZEND_STR_FILE);
+	ZVAL_DEREF(prop);
+	ZVAL_COPY(return_value, prop);
 }
 /* }}} */
 
@@ -413,11 +415,13 @@ ZEND_METHOD(exception, getFile)
    Get the line in which the exception occurred */
 ZEND_METHOD(exception, getLine)
 {
-	zval rv;
+	zval *prop, rv;
 
 	DEFAULT_0_PARAMS;
 
-	ZVAL_COPY(return_value, GET_PROPERTY(getThis(), ZEND_STR_LINE));
+	prop = GET_PROPERTY(getThis(), ZEND_STR_LINE);
+	ZVAL_DEREF(prop);
+	ZVAL_COPY(return_value, prop);
 }
 /* }}} */
 
@@ -425,11 +429,13 @@ ZEND_METHOD(exception, getLine)
    Get the exception message */
 ZEND_METHOD(exception, getMessage)
 {
-	zval rv;
+	zval *prop, rv;
 
 	DEFAULT_0_PARAMS;
 
-	ZVAL_COPY(return_value, GET_PROPERTY(getThis(), ZEND_STR_MESSAGE));
+	prop = GET_PROPERTY(getThis(), ZEND_STR_MESSAGE);
+	ZVAL_DEREF(prop);
+	ZVAL_COPY(return_value, prop);
 }
 /* }}} */
 
@@ -437,11 +443,13 @@ ZEND_METHOD(exception, getMessage)
    Get the exception code */
 ZEND_METHOD(exception, getCode)
 {
-	zval rv;
+	zval *prop, rv;
 
 	DEFAULT_0_PARAMS;
 
-	ZVAL_COPY(return_value, GET_PROPERTY(getThis(), ZEND_STR_CODE));
+	prop = GET_PROPERTY(getThis(), ZEND_STR_CODE);
+	ZVAL_DEREF(prop);
+	ZVAL_COPY(return_value, prop);
 }
 /* }}} */
 
@@ -449,11 +457,13 @@ ZEND_METHOD(exception, getCode)
    Get the stack trace for the location in which the exception occurred */
 ZEND_METHOD(exception, getTrace)
 {
-	zval rv;
+	zval *prop, rv;
 
 	DEFAULT_0_PARAMS;
 
-	ZVAL_COPY(return_value, GET_PROPERTY(getThis(), ZEND_STR_TRACE));
+	prop = GET_PROPERTY(getThis(), ZEND_STR_TRACE);
+	ZVAL_DEREF(prop);
+	ZVAL_COPY(return_value, prop);
 }
 /* }}} */
 
@@ -461,11 +471,13 @@ ZEND_METHOD(exception, getTrace)
    Get the exception severity */
 ZEND_METHOD(error_exception, getSeverity)
 {
-	zval rv;
+	zval *prop, rv;
 
 	DEFAULT_0_PARAMS;
 
-	ZVAL_COPY(return_value, GET_PROPERTY(getThis(), ZEND_STR_SEVERITY));
+	prop = GET_PROPERTY(getThis(), ZEND_STR_SEVERITY);
+	ZVAL_DEREF(prop);
+	ZVAL_COPY(return_value, prop);
 }
 /* }}} */
 

Zend/zend_globals.h

@@ -230,8 +230,9 @@ struct _zend_executor_globals {
 	void *reserved[ZEND_MAX_RESERVED_RESOURCES];
 };
 
-#define EG_FLAGS_INITIAL	0x00
-#define EG_FLAGS_IN_SHUTDOWN	0x01
+#define EG_FLAGS_INITIAL				(0)
+#define EG_FLAGS_IN_SHUTDOWN			(1<<0)
+#define EG_FLAGS_OBJECT_STORE_NO_REUSE	(1<<1)
 
 struct _zend_ini_scanner_globals {
 	zend_file_handle *yy_in;

Zend/zend_hash.c

@@ -61,7 +61,7 @@ static void _zend_is_inconsistent(const HashTable *ht, const char *file, int lin
 			zend_output_debug_string(1, "%s(%d) : ht=%p is inconsistent", file, line, ht);
 			break;
 	}
-	zend_bailout();
+	ZEND_ASSERT(0);
 }
 #define IS_CONSISTENT(a) _zend_is_inconsistent(a, __FILE__, __LINE__);
 #define SET_INCONSISTENT(n) do { \

Zend/zend_inheritance.c

@@ -193,8 +193,8 @@ static int zend_do_perform_type_hint_check(const zend_function *fe, zend_arg_inf
 		fe_class_name = ZEND_TYPE_NAME(fe_arg_info->type);
 		class_name = ZSTR_VAL(fe_class_name);
 		class_name_len = ZSTR_LEN(fe_class_name);
-		if (class_name_len == sizeof("parent")-1 && !strcasecmp(class_name, "parent") && proto->common.scope) {
-			fe_class_name = zend_string_copy(proto->common.scope->name);
+		if (class_name_len == sizeof("parent")-1 && !strcasecmp(class_name, "parent") && fe->common.scope && fe->common.scope->parent) {
+			fe_class_name = zend_string_copy(fe->common.scope->parent->name);
 		} else if (class_name_len == sizeof("self")-1 && !strcasecmp(class_name, "self") && fe->common.scope) {
 			fe_class_name = zend_string_copy(fe->common.scope->name);
 		} else {

Zend/zend_ini_parser.y

@@ -48,6 +48,22 @@ int ini_parse(void);
 
 #define ZEND_SYSTEM_INI CG(ini_parser_unbuffered_errors)
 
+static int get_int_val(zval *op) {
+	switch (Z_TYPE_P(op)) {
+		case IS_LONG:
+			return Z_LVAL_P(op);
+		case IS_DOUBLE:
+			return (int)Z_DVAL_P(op);
+		case IS_STRING:
+		{
+			int val = atoi(Z_STRVAL_P(op));
+			zend_string_free(Z_STR_P(op));
+			return val;
+		}
+		EMPTY_SWITCH_DEFAULT_CASE()
+	}
+}
+
 /* {{{ zend_ini_do_op()
 */
 static void zend_ini_do_op(char type, zval *result, zval *op1, zval *op2)
@@ -57,22 +73,8 @@ static void zend_ini_do_op(char type, zval *result, zval *op1, zval *op2)
 	int str_len;
 	char str_result[MAX_LENGTH_OF_LONG+1];
 
-	if (IS_LONG == Z_TYPE_P(op1)) {
-		i_op1 = Z_LVAL_P(op1);
-	} else {
-		i_op1 = atoi(Z_STRVAL_P(op1));
-		zend_string_free(Z_STR_P(op1));
-	}
-	if (op2) {
-		if (IS_LONG == Z_TYPE_P(op2)) {
-			i_op2 = Z_LVAL_P(op2);
-		} else {
-			i_op2 = atoi(Z_STRVAL_P(op2));
-			zend_string_free(Z_STR_P(op2));
-		}
-	} else {
-		i_op2 = 0;
-	}
+	i_op1 = get_int_val(op1);
+	i_op2 = op2 ? get_int_val(op2) : 0;
 
 	switch (type) {
 		case '|':

Zend/zend_ini_scanner.c

@@ -144,13 +144,14 @@ ZEND_API zend_ini_scanner_globals ini_scanner_globals;
 	ZVAL_NEW_STR(retval, zend_string_init(str, len, ZEND_SYSTEM_INI))
 
 
-#define RETURN_TOKEN(type, str, len) {                       \
-	if (SCNG(scanner_mode) == ZEND_INI_SCANNER_TYPED) {      \
-		zend_ini_copy_typed_value(ini_lval, type, str, len); \
-	} else {                                                 \
-		zend_ini_copy_value(ini_lval, str, len);             \
-	}                                                        \
-	return type;                                             \
+#define RETURN_TOKEN(type, str, len) {                             \
+	if (SCNG(scanner_mode) == ZEND_INI_SCANNER_TYPED &&            \
+		(YYSTATE == STATE(ST_VALUE) || YYSTATE == STATE(ST_RAW))) {\
+		zend_ini_copy_typed_value(ini_lval, type, str, len);       \
+	} else {                                                       \
+		zend_ini_copy_value(ini_lval, str, len);                   \
+	}                                                              \
+	return type;                                                   \
 }
 
 static inline int convert_to_number(zval *retval, const char *str, const int str_len)
@@ -383,7 +384,7 @@ restart:
 		}
 	}
 
-#line 387 "Zend/zend_ini_scanner.c"
+#line 388 "Zend/zend_ini_scanner.c"
 {
 	YYCTYPE yych;
 	unsigned int yyaccept = 0;
@@ -505,7 +506,7 @@ yy4:
 yy5:
 		YYDEBUG(5, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 483 "Zend/zend_ini_scanner.l"
+#line 484 "Zend/zend_ini_scanner.l"
 		{ /* Get option name */
 	/* Eat leading whitespace */
 	EAT_LEADING_WHITESPACE();
@@ -515,7 +516,7 @@ yy5:
 
 	RETURN_TOKEN(TC_LABEL, yytext, yyleng);
 }
-#line 519 "Zend/zend_ini_scanner.c"
+#line 520 "Zend/zend_ini_scanner.c"
 yy6:
 		YYDEBUG(6, *YYCURSOR);
 		++YYCURSOR;
@@ -539,24 +540,24 @@ yy6:
 yy8:
 		YYDEBUG(8, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 636 "Zend/zend_ini_scanner.l"
+#line 637 "Zend/zend_ini_scanner.l"
 		{
 	/* eat whitespace */
 	goto restart;
 }
-#line 548 "Zend/zend_ini_scanner.c"
+#line 549 "Zend/zend_ini_scanner.c"
 yy9:
 		YYDEBUG(9, *YYCURSOR);
 		++YYCURSOR;
 yy10:
 		YYDEBUG(10, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 641 "Zend/zend_ini_scanner.l"
+#line 642 "Zend/zend_ini_scanner.l"
 		{
 	SCNG(lineno)++;
 	return END_OF_LINE;
 }
-#line 560 "Zend/zend_ini_scanner.c"
+#line 561 "Zend/zend_ini_scanner.c"
 yy11:
 		YYDEBUG(11, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -617,11 +618,11 @@ yy14:
 		++YYCURSOR;
 		YYDEBUG(15, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 564 "Zend/zend_ini_scanner.l"
+#line 565 "Zend/zend_ini_scanner.l"
 		{ /* Disallow these chars outside option values */
 	return yytext[0];
 }
-#line 625 "Zend/zend_ini_scanner.c"
+#line 626 "Zend/zend_ini_scanner.c"
 yy16:
 		YYDEBUG(16, *YYCURSOR);
 		++YYCURSOR;
@@ -629,11 +630,11 @@ yy16:
 		goto yy32;
 		YYDEBUG(17, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 657 "Zend/zend_ini_scanner.l"
+#line 658 "Zend/zend_ini_scanner.l"
 		{
 	return 0;
 }
-#line 637 "Zend/zend_ini_scanner.c"
+#line 638 "Zend/zend_ini_scanner.c"
 yy18:
 		YYDEBUG(18, *YYCURSOR);
 		++YYCURSOR;
@@ -644,7 +645,7 @@ yy18:
 		if (yych == ' ') goto yy18;
 		YYDEBUG(20, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 493 "Zend/zend_ini_scanner.l"
+#line 494 "Zend/zend_ini_scanner.l"
 		{ /* Start option value */
 	if (SCNG(scanner_mode) == ZEND_INI_SCANNER_RAW) {
 		BEGIN(ST_RAW);
@@ -653,7 +654,7 @@ yy18:
 	}
 	return '=';
 }
-#line 657 "Zend/zend_ini_scanner.c"
+#line 658 "Zend/zend_ini_scanner.c"
 yy21:
 		YYDEBUG(21, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -709,7 +710,7 @@ yy26:
 		++YYCURSOR;
 		YYDEBUG(27, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 408 "Zend/zend_ini_scanner.l"
+#line 409 "Zend/zend_ini_scanner.l"
 		{ /* Section start */
 	/* Enter section data lookup state */
 	if (SCNG(scanner_mode) == ZEND_INI_SCANNER_RAW) {
@@ -719,7 +720,7 @@ yy26:
 	}
 	return TC_SECTION;
 }
-#line 723 "Zend/zend_ini_scanner.c"
+#line 724 "Zend/zend_ini_scanner.c"
 yy28:
 		YYDEBUG(28, *YYCURSOR);
 		++YYCURSOR;
@@ -730,7 +731,7 @@ yy28:
 		if (yych == ' ') goto yy28;
 		YYDEBUG(30, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 433 "Zend/zend_ini_scanner.l"
+#line 434 "Zend/zend_ini_scanner.l"
 		{ /* Start of option with offset */
 	/* Eat leading whitespace */
 	EAT_LEADING_WHITESPACE();
@@ -743,7 +744,7 @@ yy28:
 
 	RETURN_TOKEN(TC_OFFSET, yytext, yyleng);
 }
-#line 747 "Zend/zend_ini_scanner.c"
+#line 748 "Zend/zend_ini_scanner.c"
 yy31:
 		YYDEBUG(31, *YYCURSOR);
 		++YYCURSOR;
@@ -761,13 +762,13 @@ yy33:
 yy34:
 		YYDEBUG(34, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 646 "Zend/zend_ini_scanner.l"
+#line 647 "Zend/zend_ini_scanner.l"
 		{ /* Comment */
 	BEGIN(INITIAL);
 	SCNG(lineno)++;
 	return END_OF_LINE;
 }
-#line 771 "Zend/zend_ini_scanner.c"
+#line 772 "Zend/zend_ini_scanner.c"
 yy35:
 		YYDEBUG(35, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -822,11 +823,11 @@ yy37:
 yy38:
 		YYDEBUG(38, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 475 "Zend/zend_ini_scanner.l"
+#line 476 "Zend/zend_ini_scanner.l"
 		{ /* FALSE value (when used outside option value/offset this causes parse error!)*/
 	RETURN_TOKEN(BOOL_FALSE, "", 0);
 }
-#line 830 "Zend/zend_ini_scanner.c"
+#line 831 "Zend/zend_ini_scanner.c"
 yy39:
 		YYDEBUG(39, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -883,11 +884,11 @@ yy41:
 yy43:
 		YYDEBUG(43, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 471 "Zend/zend_ini_scanner.l"
+#line 472 "Zend/zend_ini_scanner.l"
 		{ /* TRUE value (when used outside option value/offset this causes parse error!) */
 	RETURN_TOKEN(BOOL_TRUE, "1", 1);
 }
-#line 891 "Zend/zend_ini_scanner.c"
+#line 892 "Zend/zend_ini_scanner.c"
 yy44:
 		YYDEBUG(44, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -1034,11 +1035,11 @@ yy56:
 yy58:
 		YYDEBUG(58, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 479 "Zend/zend_ini_scanner.l"
+#line 480 "Zend/zend_ini_scanner.l"
 		{
 	RETURN_TOKEN(NULL_NULL, "", 0);
 }
-#line 1042 "Zend/zend_ini_scanner.c"
+#line 1043 "Zend/zend_ini_scanner.c"
 yy59:
 		YYDEBUG(59, *YYCURSOR);
 		++YYCURSOR;
@@ -1096,7 +1097,7 @@ yyc_ST_DOUBLE_QUOTES:
 yy64:
 		YYDEBUG(64, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 596 "Zend/zend_ini_scanner.l"
+#line 597 "Zend/zend_ini_scanner.l"
 		{ /* Escape double quoted string contents */
 	if (YYCURSOR > YYLIMIT) {
 		return 0;
@@ -1132,7 +1133,7 @@ yy64:
 	zend_ini_escape_string(ini_lval, yytext, yyleng, '"');
 	return TC_QUOTED_STRING;
 }
-#line 1136 "Zend/zend_ini_scanner.c"
+#line 1137 "Zend/zend_ini_scanner.c"
 yy65:
 		YYDEBUG(65, *YYCURSOR);
 		++YYCURSOR;
@@ -1144,12 +1145,12 @@ yy65:
 		}
 		YYDEBUG(67, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 591 "Zend/zend_ini_scanner.l"
+#line 592 "Zend/zend_ini_scanner.l"
 		{ /* Double quoted '"' string ends */
 	yy_pop_state();
 	return '"';
 }
-#line 1153 "Zend/zend_ini_scanner.c"
+#line 1154 "Zend/zend_ini_scanner.c"
 yy68:
 		YYDEBUG(68, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -1158,12 +1159,12 @@ yy68:
 		++YYCURSOR;
 		YYDEBUG(70, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 451 "Zend/zend_ini_scanner.l"
+#line 452 "Zend/zend_ini_scanner.l"
 		{ /* Variable start */
 	yy_push_state(ST_VARNAME);
 	return TC_DOLLAR_CURLY;
 }
-#line 1167 "Zend/zend_ini_scanner.c"
+#line 1168 "Zend/zend_ini_scanner.c"
 	}
 /* *********************************** */
 yyc_ST_OFFSET:
@@ -1263,11 +1264,11 @@ yy74:
 yy75:
 		YYDEBUG(75, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 582 "Zend/zend_ini_scanner.l"
+#line 583 "Zend/zend_ini_scanner.l"
 		{ /* Get rest as section/offset value */
 	RETURN_TOKEN(TC_STRING, yytext, yyleng);
 }
-#line 1271 "Zend/zend_ini_scanner.c"
+#line 1272 "Zend/zend_ini_scanner.c"
 yy76:
 		YYDEBUG(76, *YYCURSOR);
 		yyaccept = 0;
@@ -1307,22 +1308,22 @@ yy78:
 yy79:
 		YYDEBUG(79, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 657 "Zend/zend_ini_scanner.l"
+#line 658 "Zend/zend_ini_scanner.l"
 		{
 	return 0;
 }
-#line 1315 "Zend/zend_ini_scanner.c"
+#line 1316 "Zend/zend_ini_scanner.c"
 yy80:
 		YYDEBUG(80, *YYCURSOR);
 		++YYCURSOR;
 		YYDEBUG(81, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 586 "Zend/zend_ini_scanner.l"
+#line 587 "Zend/zend_ini_scanner.l"
 		{ /* Double quoted '"' string start */
 	yy_push_state(ST_DOUBLE_QUOTES);
 	return '"';
 }
-#line 1326 "Zend/zend_ini_scanner.c"
+#line 1327 "Zend/zend_ini_scanner.c"
 yy82:
 		YYDEBUG(82, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -1388,11 +1389,11 @@ yy85:
 yy87:
 		YYDEBUG(87, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 560 "Zend/zend_ini_scanner.l"
+#line 561 "Zend/zend_ini_scanner.l"
 		{ /* Get number option value as string */
 	RETURN_TOKEN(TC_NUMBER, yytext, yyleng);
 }
-#line 1396 "Zend/zend_ini_scanner.c"
+#line 1397 "Zend/zend_ini_scanner.c"
 yy88:
 		YYDEBUG(88, *YYCURSOR);
 		yyaccept = 3;
@@ -1425,11 +1426,11 @@ yy88:
 yy90:
 		YYDEBUG(90, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 556 "Zend/zend_ini_scanner.l"
+#line 557 "Zend/zend_ini_scanner.l"
 		{ /* Get constant option value */
 	RETURN_TOKEN(TC_CONSTANT, yytext, yyleng);
 }
-#line 1433 "Zend/zend_ini_scanner.c"
+#line 1434 "Zend/zend_ini_scanner.c"
 yy91:
 		YYDEBUG(91, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -1439,12 +1440,12 @@ yy92:
 		++YYCURSOR;
 		YYDEBUG(93, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 446 "Zend/zend_ini_scanner.l"
+#line 447 "Zend/zend_ini_scanner.l"
 		{ /* End of section or an option offset */
 	BEGIN(INITIAL);
 	return ']';
 }
-#line 1448 "Zend/zend_ini_scanner.c"
+#line 1449 "Zend/zend_ini_scanner.c"
 yy94:
 		YYDEBUG(94, *YYCURSOR);
 		++YYCURSOR;
@@ -1494,12 +1495,12 @@ yy99:
 		++YYCURSOR;
 		YYDEBUG(100, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 451 "Zend/zend_ini_scanner.l"
+#line 452 "Zend/zend_ini_scanner.l"
 		{ /* Variable start */
 	yy_push_state(ST_VARNAME);
 	return TC_DOLLAR_CURLY;
 }
-#line 1503 "Zend/zend_ini_scanner.c"
+#line 1504 "Zend/zend_ini_scanner.c"
 yy101:
 		YYDEBUG(101, *YYCURSOR);
 		++YYCURSOR;
@@ -1553,7 +1554,7 @@ yy105:
 		++YYCURSOR;
 		YYDEBUG(106, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 418 "Zend/zend_ini_scanner.l"
+#line 419 "Zend/zend_ini_scanner.l"
 		{ /* Raw string */
 	/* Eat leading and trailing single quotes */
 	if (yytext[0] == '\'' && yytext[yyleng - 1] == '\'') {
@@ -1562,7 +1563,7 @@ yy105:
 	}
 	RETURN_TOKEN(TC_RAW, yytext, yyleng);
 }
-#line 1566 "Zend/zend_ini_scanner.c"
+#line 1567 "Zend/zend_ini_scanner.c"
 	}
 /* *********************************** */
 yyc_ST_RAW:
@@ -1626,19 +1627,19 @@ yyc_ST_RAW:
 		++YYCURSOR;
 		YYDEBUG(110, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 652 "Zend/zend_ini_scanner.l"
+#line 653 "Zend/zend_ini_scanner.l"
 		{ /* End of option value (if EOF is reached before EOL */
 	BEGIN(INITIAL);
 	return END_OF_LINE;
 }
-#line 1635 "Zend/zend_ini_scanner.c"
+#line 1636 "Zend/zend_ini_scanner.c"
 yy111:
 		YYDEBUG(111, *YYCURSOR);
 		++YYCURSOR;
 yy112:
 		YYDEBUG(112, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 502 "Zend/zend_ini_scanner.l"
+#line 503 "Zend/zend_ini_scanner.l"
 		{ /* Raw value, only used when SCNG(scanner_mode) == ZEND_INI_SCANNER_RAW. */
 	unsigned char *sc = NULL;
 	EAT_LEADING_WHITESPACE();
@@ -1682,7 +1683,7 @@ end_raw_value_chars:
 
 	RETURN_TOKEN(TC_RAW, yytext, yyleng);
 }
-#line 1686 "Zend/zend_ini_scanner.c"
+#line 1687 "Zend/zend_ini_scanner.c"
 yy113:
 		YYDEBUG(113, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -1706,13 +1707,13 @@ yy114:
 yy115:
 		YYDEBUG(115, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 550 "Zend/zend_ini_scanner.l"
+#line 551 "Zend/zend_ini_scanner.l"
 		{ /* End of option value */
 	BEGIN(INITIAL);
 	SCNG(lineno)++;
 	return END_OF_LINE;
 }
-#line 1716 "Zend/zend_ini_scanner.c"
+#line 1717 "Zend/zend_ini_scanner.c"
 yy116:
 		YYDEBUG(116, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -1742,12 +1743,12 @@ yy119:
 yy120:
 		YYDEBUG(120, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 636 "Zend/zend_ini_scanner.l"
+#line 637 "Zend/zend_ini_scanner.l"
 		{
 	/* eat whitespace */
 	goto restart;
 }
-#line 1751 "Zend/zend_ini_scanner.c"
+#line 1752 "Zend/zend_ini_scanner.c"
 yy121:
 		YYDEBUG(121, *YYCURSOR);
 		++YYCURSOR;
@@ -1765,13 +1766,13 @@ yy123:
 yy124:
 		YYDEBUG(124, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 646 "Zend/zend_ini_scanner.l"
+#line 647 "Zend/zend_ini_scanner.l"
 		{ /* Comment */
 	BEGIN(INITIAL);
 	SCNG(lineno)++;
 	return END_OF_LINE;
 }
-#line 1775 "Zend/zend_ini_scanner.c"
+#line 1776 "Zend/zend_ini_scanner.c"
 yy125:
 		YYDEBUG(125, *YYCURSOR);
 		++YYCURSOR;
@@ -1834,21 +1835,21 @@ yy128:
 		}
 		YYDEBUG(130, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 546 "Zend/zend_ini_scanner.l"
+#line 547 "Zend/zend_ini_scanner.l"
 		{ /* Raw value, only used when SCNG(scanner_mode) == ZEND_INI_SCANNER_RAW. */
 	RETURN_TOKEN(TC_RAW, yytext, yyleng);
 }
-#line 1842 "Zend/zend_ini_scanner.c"
+#line 1843 "Zend/zend_ini_scanner.c"
 yy131:
 		YYDEBUG(131, *YYCURSOR);
 		++YYCURSOR;
 		YYDEBUG(132, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 657 "Zend/zend_ini_scanner.l"
+#line 658 "Zend/zend_ini_scanner.l"
 		{
 	return 0;
 }
-#line 1852 "Zend/zend_ini_scanner.c"
+#line 1853 "Zend/zend_ini_scanner.c"
 yy133:
 		YYDEBUG(133, *YYCURSOR);
 		++YYCURSOR;
@@ -1864,13 +1865,13 @@ yy133:
 yy135:
 		YYDEBUG(135, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 427 "Zend/zend_ini_scanner.l"
+#line 428 "Zend/zend_ini_scanner.l"
 		{ /* End of section */
 	BEGIN(INITIAL);
 	SCNG(lineno)++;
 	return ']';
 }
-#line 1874 "Zend/zend_ini_scanner.c"
+#line 1875 "Zend/zend_ini_scanner.c"
 yy136:
 		YYDEBUG(136, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -1979,11 +1980,11 @@ yy141:
 yy142:
 		YYDEBUG(142, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 582 "Zend/zend_ini_scanner.l"
+#line 583 "Zend/zend_ini_scanner.l"
 		{ /* Get rest as section/offset value */
 	RETURN_TOKEN(TC_STRING, yytext, yyleng);
 }
-#line 1987 "Zend/zend_ini_scanner.c"
+#line 1988 "Zend/zend_ini_scanner.c"
 yy143:
 		YYDEBUG(143, *YYCURSOR);
 		yyaccept = 0;
@@ -2023,22 +2024,22 @@ yy145:
 yy146:
 		YYDEBUG(146, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 657 "Zend/zend_ini_scanner.l"
+#line 658 "Zend/zend_ini_scanner.l"
 		{
 	return 0;
 }
-#line 2031 "Zend/zend_ini_scanner.c"
+#line 2032 "Zend/zend_ini_scanner.c"
 yy147:
 		YYDEBUG(147, *YYCURSOR);
 		++YYCURSOR;
 		YYDEBUG(148, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 586 "Zend/zend_ini_scanner.l"
+#line 587 "Zend/zend_ini_scanner.l"
 		{ /* Double quoted '"' string start */
 	yy_push_state(ST_DOUBLE_QUOTES);
 	return '"';
 }
-#line 2042 "Zend/zend_ini_scanner.c"
+#line 2043 "Zend/zend_ini_scanner.c"
 yy149:
 		YYDEBUG(149, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -2104,11 +2105,11 @@ yy152:
 yy154:
 		YYDEBUG(154, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 560 "Zend/zend_ini_scanner.l"
+#line 561 "Zend/zend_ini_scanner.l"
 		{ /* Get number option value as string */
 	RETURN_TOKEN(TC_NUMBER, yytext, yyleng);
 }
-#line 2112 "Zend/zend_ini_scanner.c"
+#line 2113 "Zend/zend_ini_scanner.c"
 yy155:
 		YYDEBUG(155, *YYCURSOR);
 		yyaccept = 3;
@@ -2141,11 +2142,11 @@ yy155:
 yy157:
 		YYDEBUG(157, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 556 "Zend/zend_ini_scanner.l"
+#line 557 "Zend/zend_ini_scanner.l"
 		{ /* Get constant option value */
 	RETURN_TOKEN(TC_CONSTANT, yytext, yyleng);
 }
-#line 2149 "Zend/zend_ini_scanner.c"
+#line 2150 "Zend/zend_ini_scanner.c"
 yy158:
 		YYDEBUG(158, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -2167,13 +2168,13 @@ yy159:
 yy161:
 		YYDEBUG(161, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 427 "Zend/zend_ini_scanner.l"
+#line 428 "Zend/zend_ini_scanner.l"
 		{ /* End of section */
 	BEGIN(INITIAL);
 	SCNG(lineno)++;
 	return ']';
 }
-#line 2177 "Zend/zend_ini_scanner.c"
+#line 2178 "Zend/zend_ini_scanner.c"
 yy162:
 		YYDEBUG(162, *YYCURSOR);
 		++YYCURSOR;
@@ -2223,12 +2224,12 @@ yy167:
 		++YYCURSOR;
 		YYDEBUG(168, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 451 "Zend/zend_ini_scanner.l"
+#line 452 "Zend/zend_ini_scanner.l"
 		{ /* Variable start */
 	yy_push_state(ST_VARNAME);
 	return TC_DOLLAR_CURLY;
 }
-#line 2232 "Zend/zend_ini_scanner.c"
+#line 2233 "Zend/zend_ini_scanner.c"
 yy169:
 		YYDEBUG(169, *YYCURSOR);
 		++YYCURSOR;
@@ -2291,7 +2292,7 @@ yy175:
 		++YYCURSOR;
 		YYDEBUG(176, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 418 "Zend/zend_ini_scanner.l"
+#line 419 "Zend/zend_ini_scanner.l"
 		{ /* Raw string */
 	/* Eat leading and trailing single quotes */
 	if (yytext[0] == '\'' && yytext[yyleng - 1] == '\'') {
@@ -2300,7 +2301,7 @@ yy175:
 	}
 	RETURN_TOKEN(TC_RAW, yytext, yyleng);
 }
-#line 2304 "Zend/zend_ini_scanner.c"
+#line 2305 "Zend/zend_ini_scanner.c"
 	}
 /* *********************************** */
 yyc_ST_VALUE:
@@ -2436,12 +2437,12 @@ yy179:
 yy180:
 		YYDEBUG(180, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 652 "Zend/zend_ini_scanner.l"
+#line 653 "Zend/zend_ini_scanner.l"
 		{ /* End of option value (if EOF is reached before EOL */
 	BEGIN(INITIAL);
 	return END_OF_LINE;
 }
-#line 2445 "Zend/zend_ini_scanner.c"
+#line 2446 "Zend/zend_ini_scanner.c"
 yy181:
 		YYDEBUG(181, *YYCURSOR);
 		yyaccept = 0;
@@ -2458,11 +2459,11 @@ yy182:
 yy183:
 		YYDEBUG(183, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 578 "Zend/zend_ini_scanner.l"
+#line 579 "Zend/zend_ini_scanner.l"
 		{ /* Get everything else as option/offset value */
 	RETURN_TOKEN(TC_STRING, yytext, yyleng);
 }
-#line 2466 "Zend/zend_ini_scanner.c"
+#line 2467 "Zend/zend_ini_scanner.c"
 yy184:
 		YYDEBUG(184, *YYCURSOR);
 		yyaccept = 1;
@@ -2487,24 +2488,24 @@ yy184:
 yy186:
 		YYDEBUG(186, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 632 "Zend/zend_ini_scanner.l"
+#line 633 "Zend/zend_ini_scanner.l"
 		{
 	RETURN_TOKEN(TC_WHITESPACE, yytext, yyleng);
 }
-#line 2495 "Zend/zend_ini_scanner.c"
+#line 2496 "Zend/zend_ini_scanner.c"
 yy187:
 		YYDEBUG(187, *YYCURSOR);
 		++YYCURSOR;
 yy188:
 		YYDEBUG(188, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 550 "Zend/zend_ini_scanner.l"
+#line 551 "Zend/zend_ini_scanner.l"
 		{ /* End of option value */
 	BEGIN(INITIAL);
 	SCNG(lineno)++;
 	return END_OF_LINE;
 }
-#line 2508 "Zend/zend_ini_scanner.c"
+#line 2509 "Zend/zend_ini_scanner.c"
 yy189:
 		YYDEBUG(189, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -2520,22 +2521,22 @@ yy190:
 		if (yych == ' ') goto yy190;
 		YYDEBUG(192, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 568 "Zend/zend_ini_scanner.l"
+#line 569 "Zend/zend_ini_scanner.l"
 		{ /* Boolean operators */
 	return yytext[0];
 }
-#line 2528 "Zend/zend_ini_scanner.c"
+#line 2529 "Zend/zend_ini_scanner.c"
 yy193:
 		YYDEBUG(193, *YYCURSOR);
 		++YYCURSOR;
 		YYDEBUG(194, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 586 "Zend/zend_ini_scanner.l"
+#line 587 "Zend/zend_ini_scanner.l"
 		{ /* Double quoted '"' string start */
 	yy_push_state(ST_DOUBLE_QUOTES);
 	return '"';
 }
-#line 2539 "Zend/zend_ini_scanner.c"
+#line 2540 "Zend/zend_ini_scanner.c"
 yy195:
 		YYDEBUG(195, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -2610,11 +2611,11 @@ yy198:
 yy200:
 		YYDEBUG(200, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 560 "Zend/zend_ini_scanner.l"
+#line 561 "Zend/zend_ini_scanner.l"
 		{ /* Get number option value as string */
 	RETURN_TOKEN(TC_NUMBER, yytext, yyleng);
 }
-#line 2618 "Zend/zend_ini_scanner.c"
+#line 2619 "Zend/zend_ini_scanner.c"
 yy201:
 		YYDEBUG(201, *YYCURSOR);
 		yyaccept = 2;
@@ -2625,13 +2626,13 @@ yy202:
 		++YYCURSOR;
 		YYDEBUG(203, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 572 "Zend/zend_ini_scanner.l"
+#line 573 "Zend/zend_ini_scanner.l"
 		{ /* Make = used in option value to trigger error */
 	yyless(0);
 	BEGIN(INITIAL);
 	return END_OF_LINE;
 }
-#line 2635 "Zend/zend_ini_scanner.c"
+#line 2636 "Zend/zend_ini_scanner.c"
 yy204:
 		YYDEBUG(204, *YYCURSOR);
 		yyaccept = 4;
@@ -2678,11 +2679,11 @@ yy204:
 yy206:
 		YYDEBUG(206, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 556 "Zend/zend_ini_scanner.l"
+#line 557 "Zend/zend_ini_scanner.l"
 		{ /* Get constant option value */
 	RETURN_TOKEN(TC_CONSTANT, yytext, yyleng);
 }
-#line 2686 "Zend/zend_ini_scanner.c"
+#line 2687 "Zend/zend_ini_scanner.c"
 yy207:
 		YYDEBUG(207, *YYCURSOR);
 		yyaccept = 4;
@@ -3036,12 +3037,12 @@ yy217:
 		++YYCURSOR;
 		YYDEBUG(218, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 451 "Zend/zend_ini_scanner.l"
+#line 452 "Zend/zend_ini_scanner.l"
 		{ /* Variable start */
 	yy_push_state(ST_VARNAME);
 	return TC_DOLLAR_CURLY;
 }
-#line 3045 "Zend/zend_ini_scanner.c"
+#line 3046 "Zend/zend_ini_scanner.c"
 yy219:
 		YYDEBUG(219, *YYCURSOR);
 		++YYCURSOR;
@@ -3107,13 +3108,13 @@ yy223:
 yy224:
 		YYDEBUG(224, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 646 "Zend/zend_ini_scanner.l"
+#line 647 "Zend/zend_ini_scanner.l"
 		{ /* Comment */
 	BEGIN(INITIAL);
 	SCNG(lineno)++;
 	return END_OF_LINE;
 }
-#line 3117 "Zend/zend_ini_scanner.c"
+#line 3118 "Zend/zend_ini_scanner.c"
 yy225:
 		YYDEBUG(225, *YYCURSOR);
 		yych = *++YYCURSOR;
@@ -3224,11 +3225,11 @@ yy227:
 yy228:
 		YYDEBUG(228, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 475 "Zend/zend_ini_scanner.l"
+#line 476 "Zend/zend_ini_scanner.l"
 		{ /* FALSE value (when used outside option value/offset this causes parse error!)*/
 	RETURN_TOKEN(BOOL_FALSE, "", 0);
 }
-#line 3232 "Zend/zend_ini_scanner.c"
+#line 3233 "Zend/zend_ini_scanner.c"
 yy229:
 		YYDEBUG(229, *YYCURSOR);
 		yyaccept = 4;
@@ -3375,11 +3376,11 @@ yy231:
 yy232:
 		YYDEBUG(232, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 471 "Zend/zend_ini_scanner.l"
+#line 472 "Zend/zend_ini_scanner.l"
 		{ /* TRUE value (when used outside option value/offset this causes parse error!) */
 	RETURN_TOKEN(BOOL_TRUE, "1", 1);
 }
-#line 3383 "Zend/zend_ini_scanner.c"
+#line 3384 "Zend/zend_ini_scanner.c"
 yy233:
 		YYDEBUG(233, *YYCURSOR);
 		yyaccept = 4;
@@ -3499,7 +3500,7 @@ yy237:
 		++YYCURSOR;
 		YYDEBUG(238, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 418 "Zend/zend_ini_scanner.l"
+#line 419 "Zend/zend_ini_scanner.l"
 		{ /* Raw string */
 	/* Eat leading and trailing single quotes */
 	if (yytext[0] == '\'' && yytext[yyleng - 1] == '\'') {
@@ -3508,7 +3509,7 @@ yy237:
 	}
 	RETURN_TOKEN(TC_RAW, yytext, yyleng);
 }
-#line 3512 "Zend/zend_ini_scanner.c"
+#line 3513 "Zend/zend_ini_scanner.c"
 yy239:
 		YYDEBUG(239, *YYCURSOR);
 		yyaccept = 4;
@@ -3823,11 +3824,11 @@ yy248:
 yy249:
 		YYDEBUG(249, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 479 "Zend/zend_ini_scanner.l"
+#line 480 "Zend/zend_ini_scanner.l"
 		{
 	RETURN_TOKEN(NULL_NULL, "", 0);
 }
-#line 3831 "Zend/zend_ini_scanner.c"
+#line 3832 "Zend/zend_ini_scanner.c"
 yy250:
 		YYDEBUG(250, *YYCURSOR);
 		++YYCURSOR;
@@ -3894,7 +3895,7 @@ yy254:
 		}
 		YYDEBUG(256, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 456 "Zend/zend_ini_scanner.l"
+#line 457 "Zend/zend_ini_scanner.l"
 		{ /* Variable name */
 	/* Eat leading whitespace */
 	EAT_LEADING_WHITESPACE();
@@ -3904,30 +3905,30 @@ yy254:
 
 	RETURN_TOKEN(TC_VARNAME, yytext, yyleng);
 }
-#line 3908 "Zend/zend_ini_scanner.c"
+#line 3909 "Zend/zend_ini_scanner.c"
 yy257:
 		YYDEBUG(257, *YYCURSOR);
 		++YYCURSOR;
 		YYDEBUG(258, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 657 "Zend/zend_ini_scanner.l"
+#line 658 "Zend/zend_ini_scanner.l"
 		{
 	return 0;
 }
-#line 3918 "Zend/zend_ini_scanner.c"
+#line 3919 "Zend/zend_ini_scanner.c"
 yy259:
 		YYDEBUG(259, *YYCURSOR);
 		++YYCURSOR;
 		YYDEBUG(260, *YYCURSOR);
 		yyleng = YYCURSOR - SCNG(yy_text);
-#line 466 "Zend/zend_ini_scanner.l"
+#line 467 "Zend/zend_ini_scanner.l"
 		{ /* Variable end */
 	yy_pop_state();
 	return '}';
 }
-#line 3929 "Zend/zend_ini_scanner.c"
+#line 3930 "Zend/zend_ini_scanner.c"
 	}
 }
-#line 661 "Zend/zend_ini_scanner.l"
+#line 662 "Zend/zend_ini_scanner.l"
 
 }

Zend/zend_ini_scanner.l

@@ -142,13 +142,14 @@ ZEND_API zend_ini_scanner_globals ini_scanner_globals;
 	ZVAL_NEW_STR(retval, zend_string_init(str, len, ZEND_SYSTEM_INI))
 
 
-#define RETURN_TOKEN(type, str, len) {                       \
-	if (SCNG(scanner_mode) == ZEND_INI_SCANNER_TYPED) {      \
-		zend_ini_copy_typed_value(ini_lval, type, str, len); \
-	} else {                                                 \
-		zend_ini_copy_value(ini_lval, str, len);             \
-	}                                                        \
-	return type;                                             \
+#define RETURN_TOKEN(type, str, len) {                             \
+	if (SCNG(scanner_mode) == ZEND_INI_SCANNER_TYPED &&            \
+		(YYSTATE == STATE(ST_VALUE) || YYSTATE == STATE(ST_RAW))) {\
+		zend_ini_copy_typed_value(ini_lval, type, str, len);       \
+	} else {                                                       \
+		zend_ini_copy_value(ini_lval, str, len);                   \
+	}                                                              \
+	return type;                                                   \
 }
 
 static inline int convert_to_number(zval *retval, const char *str, const int str_len)

Zend/zend_language_scanner.l

@@ -1648,7 +1648,8 @@ NEWLINE ("\r"|"\n"|"\r\n")
 	char *end;
 	if (yyleng < MAX_LENGTH_OF_LONG - 1) { /* Won't overflow */
 		errno = 0;
-		ZVAL_LONG(zendlval, ZEND_STRTOL(yytext, &end, 0));
+		/* base must be passed explicitly for correct parse error on Windows */
+		ZVAL_LONG(zendlval, ZEND_STRTOL(yytext, &end, yytext[0] == '0' ? 8 : 10));
 		/* This isn't an assert, we need to ensure 019 isn't valid octal
 		 * Because the lexing itself doesn't do that for us
 		 */

Zend/zend_language_scanner_defs.h

@@ -1,4 +1,4 @@
-/* Generated by re2c 0.16 */
+/* Generated by re2c 1.0.1 */
 #line 3 "Zend/zend_language_scanner_defs.h"
 
 enum YYCONDTYPE {

Zend/zend_objects_API.c

@@ -43,6 +43,7 @@ ZEND_API void zend_objects_store_destroy(zend_objects_store *objects)
 
 ZEND_API void zend_objects_store_call_destructors(zend_objects_store *objects)
 {
+	EG(flags) |= EG_FLAGS_OBJECT_STORE_NO_REUSE;
 	if (objects->top > 1) {
 		uint32_t i;
 		for (i = 1; i < objects->top; i++) {
@@ -133,10 +134,10 @@ ZEND_API void zend_objects_store_put(zend_object *object)
 {
 	int handle;
 
-	/* When in shutdown sequesnce - do not reuse previously freed handles, to make sure
+	/* When in shutdown sequence - do not reuse previously freed handles, to make sure
 	 * the dtors for newly created objects are called in zend_objects_store_call_destructors() loop
 	 */
-	if (!(EG(flags) & EG_FLAGS_IN_SHUTDOWN) && EG(objects_store).free_list_head != -1) {
+	if (EG(objects_store).free_list_head != -1 && EXPECTED(!(EG(flags) & EG_FLAGS_OBJECT_STORE_NO_REUSE))) {
 		handle = EG(objects_store).free_list_head;
 		EG(objects_store).free_list_head = GET_OBJ_BUCKET_NUMBER(EG(objects_store).object_buckets[handle]);
 	} else {

Zend/zend_vm_gen.php

@@ -1805,7 +1805,7 @@ function gen_executor($f, $skl, $spec, $kind, $executor_name, $initializer_name)
 						$prolog = $m[1];
 						out($f,$prolog."if (UNEXPECTED(execute_data == NULL)) {\n");
 						out($f,$prolog."\tstatic const void* labels[] = {\n");
-						gen_labels($f, $spec, ZEND_VM_KIND_GOTO, $prolog."\t\t", $specs);
+						gen_labels($f, $spec, ($kind == ZEND_VM_KIND_HYBRID) ? ZEND_VM_KIND_GOTO : $kind, $prolog."\t\t", $specs);
 						out($f,$prolog."\t};\n");
 						out($f,$prolog."\tzend_opcode_handlers = (const void **) labels;\n");
 						out($f,$prolog."\tzend_handlers_count = sizeof(labels) / sizeof(void*);\n");
@@ -1920,7 +1920,7 @@ function gen_executor($f, $skl, $spec, $kind, $executor_name, $initializer_name)
 						out($f,$prolog.$executor_name."_ex(NULL);\n");
 					} else {
 						out($f,$prolog."static const void *labels[] = {\n");
-						gen_labels($f, $spec, ZEND_VM_KIND_CALL, $prolog."\t", $specs, $switch_labels);
+						gen_labels($f, $spec, ($kind == ZEND_VM_KIND_HYBRID) ? ZEND_VM_KIND_CALL : $kind, $prolog."\t", $specs, $switch_labels);
 						out($f,$prolog."};\n");
 						out($f,$prolog."static const uint32_t specs[] = {\n");
 						gen_specs($f, $prolog."\t", $specs);

acinclude.m4

@@ -836,15 +836,11 @@ dnl from object_var in build-dir.
 dnl
 AC_DEFUN([PHP_SHARED_MODULE],[
   install_modules="install-modules"
+  suffix=la
 
   case $host_alias in
     *aix*[)]
-      suffix=so
-      link_cmd='$(LIBTOOL) --mode=link ifelse($4,,[$(CC)],[$(CXX)]) $(COMMON_FLAGS) $(CFLAGS_CLEAN) $(EXTRA_CFLAGS) $(LDFLAGS) -Wl,-G -o '$3'/$1.la -export-dynamic -avoid-version -prefer-pic -module -rpath $(phplibdir) $(EXTRA_LDFLAGS) $($2) $(translit($1,a-z_-,A-Z__)_SHARED_LIBADD) && mv -f '$3'/.libs/$1.so '$3'/$1.so'
-      ;;
-    *[)]
-      suffix=la
-      link_cmd='$(LIBTOOL) --mode=link ifelse($4,,[$(CC)],[$(CXX)]) $(COMMON_FLAGS) $(CFLAGS_CLEAN) $(EXTRA_CFLAGS) $(LDFLAGS) -o [$]@ -export-dynamic -avoid-version -prefer-pic -module -rpath $(phplibdir) $(EXTRA_LDFLAGS) $($2) $(translit($1,a-z_-,A-Z__)_SHARED_LIBADD)'
+      additional_flags="-Wl,-G"
       ;;
   esac
 
@@ -859,7 +855,7 @@ AC_DEFUN([PHP_SHARED_MODULE],[
 	\$(LIBTOOL) --mode=install cp $3/$1.$suffix \$(phplibdir)
 
 $3/$1.$suffix: \$($2) \$(translit($1,a-z_-,A-Z__)_SHARED_DEPENDENCIES)
-	$link_cmd
+	\$(LIBTOOL) --mode=link ifelse($4,,[\$(CC)],[\$(CXX)]) \$(COMMON_FLAGS) \$(CFLAGS_CLEAN) \$(EXTRA_CFLAGS) \$(LDFLAGS) $additional_flags -o [\$]@ -export-dynamic -avoid-version -prefer-pic -module -rpath \$(phplibdir) \$(EXTRA_LDFLAGS) \$($2) \$(translit($1,a-z_-,A-Z__)_SHARED_LIBADD)
 
 EOF
 ])
@@ -975,7 +971,7 @@ dnl ---------------------------------------------- Shared module
 dnl ---------------------------------------------- CLI static module
     [PHP_]translit($1,a-z_-,A-Z__)[_SHARED]=no
     case "$PHP_SAPI" in
-      cgi|embed[)]
+      cgi|embed|phpdbg[)]
         PHP_ADD_SOURCES($ext_dir,$2,$ac_extra,)
         EXT_STATIC="$EXT_STATIC $1;$ext_dir"
         ;;
@@ -2201,45 +2197,79 @@ AC_DEFUN([PHP_SETUP_ICU],[
     PHP_ICU_DIR=DEFAULT
   fi
 
-  if test "$PHP_ICU_DIR" = "DEFAULT"; then
-    dnl Try to find icu-config
-    AC_PATH_PROG(ICU_CONFIG, icu-config, no, [$PATH:/usr/local/bin])
-  else
-    ICU_CONFIG="$PHP_ICU_DIR/bin/icu-config"
+  AC_MSG_CHECKING([for location of ICU headers and libraries])
+  found_icu=no
+
+  dnl First try to find pkg-config
+  if test -z "$PKG_CONFIG"; then
+    AC_PATH_PROG(PKG_CONFIG, pkg-config, no)
   fi
 
-  AC_MSG_CHECKING([for location of ICU headers and libraries])
+  dnl If pkg-config is found try using it
+  if test "$PHP_ICU_DIR" = "DEFAULT" && test -x "$PKG_CONFIG" && $PKG_CONFIG --exists icu-uc icu-io icu-i18n; then
+    if $PKG_CONFIG --atleast-version=40 icu-uc; then
+      found_icu=yes
+      icu_version_full=`$PKG_CONFIG --modversion icu-uc`
+      ac_IFS=$IFS
+      IFS="."
+      set $icu_version_full
+      IFS=$ac_IFS
+      icu_version=`expr [$]1 \* 1000 + [$]2`
+      AC_MSG_RESULT([found $icu_version_full])
 
-  dnl Trust icu-config to know better what the install prefix is..
-  icu_install_prefix=`$ICU_CONFIG --prefix 2> /dev/null`
-  if test "$?" != "0" || test -z "$icu_install_prefix"; then
-    AC_MSG_RESULT([not found])
-    AC_MSG_ERROR([Unable to detect ICU prefix or $ICU_CONFIG failed. Please verify ICU install prefix and make sure icu-config works.])
-  else
-    AC_MSG_RESULT([$icu_install_prefix])
+      ICU_LIBS=`$PKG_CONFIG --libs icu-uc icu-io icu-i18n`
+      ICU_INCS=`$PKG_CONFIG --cflags-only-I icu-uc icu-io icu-i18n`
+      ICU_CXXFLAGS="-DU_USING_ICU_NAMESPACE=1"
 
-    dnl Check ICU version
-    AC_MSG_CHECKING([for ICU 4.0 or greater])
-    icu_version_full=`$ICU_CONFIG --version`
-    ac_IFS=$IFS
-    IFS="."
-    set $icu_version_full
-    IFS=$ac_IFS
-    icu_version=`expr [$]1 \* 1000 + [$]2`
-    AC_MSG_RESULT([found $icu_version_full])
+      AC_MSG_RESULT([found $ICU_VERSION])
 
-    if test "$icu_version" -lt "4000"; then
-      AC_MSG_ERROR([ICU version 4.0 or later is required])
+      PHP_EVAL_LIBLINE($ICU_LIBS, $1)
+      PHP_EVAL_INCLINE($ICU_INCS)
+    else
+      AC_MSG_ERROR([ICU version 4.0 or later required.])
+    fi
+  fi
+
+  dnl If pkg-config fails for some reason, revert to the old method
+  if test "$found_icu" = "no"; then
+    if test "$PHP_ICU_DIR" = "DEFAULT"; then
+      dnl Try to find icu-config
+      AC_PATH_PROG(ICU_CONFIG, icu-config, no, [$PATH:/usr/local/bin])
+    else
+      ICU_CONFIG="$PHP_ICU_DIR/bin/icu-config"
     fi
 
-    ICU_VERSION=$icu_version
-    ICU_INCS=`$ICU_CONFIG --cppflags-searchpath`
-    ICU_LIBS=`$ICU_CONFIG --ldflags --ldflags-icuio`
-    PHP_EVAL_INCLINE($ICU_INCS)
-    PHP_EVAL_LIBLINE($ICU_LIBS, $1)
+    dnl Trust icu-config to know better what the install prefix is..
+    icu_install_prefix=`$ICU_CONFIG --prefix 2> /dev/null`
+    if test "$?" != "0" || test -z "$icu_install_prefix"; then
+      AC_MSG_RESULT([not found])
+      AC_MSG_ERROR([Unable to detect ICU prefix or $ICU_CONFIG failed. Please verify ICU install prefix and make sure icu-config works.])
+    else
+      AC_MSG_RESULT([$icu_install_prefix])
 
-    ICU_CXXFLAGS=`$ICU_CONFIG --cxxflags`
-    ICU_CXXFLAGS="$ICU_CXXFLAGS -DU_USING_ICU_NAMESPACE=1"
+      dnl Check ICU version
+      AC_MSG_CHECKING([for ICU 4.0 or greater])
+      icu_version_full=`$ICU_CONFIG --version`
+      ac_IFS=$IFS
+      IFS="."
+      set $icu_version_full
+      IFS=$ac_IFS
+      icu_version=`expr [$]1 \* 1000 + [$]2`
+      AC_MSG_RESULT([found $icu_version_full])
+
+      if test "$icu_version" -lt "4000"; then
+        AC_MSG_ERROR([ICU version 4.0 or later is required])
+      fi
+
+      ICU_VERSION=$icu_version
+      ICU_INCS=`$ICU_CONFIG --cppflags-searchpath`
+      ICU_LIBS=`$ICU_CONFIG --ldflags --ldflags-icuio`
+      PHP_EVAL_INCLINE($ICU_INCS)
+      PHP_EVAL_LIBLINE($ICU_LIBS, $1)
+
+      ICU_CXXFLAGS=`$ICU_CONFIG --cxxflags`
+      ICU_CXXFLAGS="$ICU_CXXFLAGS -DU_USING_ICU_NAMESPACE=1"
+    fi
   fi
 ])
 

appveyor/build.bat

@@ -1,6 +1,6 @@
 @echo off
 
-set SDK_REMOTE=https://github.com/OSTC/php-sdk-binary-tools.git
+set SDK_REMOTE=https://github.com/Microsoft/php-sdk-binary-tools.git
 set SDK_BRANCH=%PHP_BUILD_SDK_BRANCH%
 set SDK_RUNNER=%PHP_BUILD_CACHE_SDK_DIR%\phpsdk-%PHP_BUILD_CRT%-%PLATFORM%.bat
 

appveyor/test_task.bat

@@ -27,7 +27,7 @@ set PDO_MYSQL_TEST_USER=%MYSQL_TEST_USER%
 set PDO_MYSQL_TEST_PASS=%MYSQL_PWD%
 set PDO_MYSQL_TEST_HOST=%MYSQL_TEST_HOST%
 set PDO_MYSQL_TEST_PORT=%MYSQL_TEST_PORT%
-set PDO_MYSQL_TEST_DSN=mysql:host=%PDO_MYSQL_TEST_HOST% port=%PDO_MYSQL_TEST_PORT% dbname=test user=%PDO_MYSQL_TEST_USER% password=%MYSQL_PW%
+set PDO_MYSQL_TEST_DSN=mysql:host=%PDO_MYSQL_TEST_HOST%;port=%PDO_MYSQL_TEST_PORT%;dbname=test;user=%PDO_MYSQL_TEST_USER%;password=%MYSQL_PW%
 "C:\Program Files\MySql\MySQL Server 5.7\bin\mysql.exe" --user=%MYSQL_TEST_USER% -e "CREATE DATABASE IF NOT EXISTS test"
 if %errorlevel% neq 0 exit /b 3
 
@@ -52,7 +52,7 @@ rem set OPENSSL_CONF=
 rem set SSLEAY_CONF=
 
 rem prepare for Opcache
-if "%OPCACHE%" equ "1" set OPCACHE_OPTS=-d opcache.enabled=1 -d opcache.enable_cli=1
+if "%OPCACHE%" equ "1" set OPCACHE_OPTS=-d opcache.enable=1 -d opcache.enable_cli=1
 
 rem prepare for enchant
 mkdir c:\enchant_plugins

configure.ac

@@ -107,8 +107,8 @@ int zend_sprintf(char *buffer, const char *format, ...);
 
 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=2
-PHP_RELEASE_VERSION=15
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=19
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
 

ext/bcmath/libbcmath/src/num2long.c

@@ -54,12 +54,19 @@ bc_num2long (num)
   /* Extract the int value, ignore the fraction. */
   val = 0;
   nptr = num->n_value;
-  for (index=num->n_len; (index>0) && (val<=(LONG_MAX/BASE)); index--)
-    val = val*BASE + *nptr++;
+  for (index = num->n_len; index > 0; index--) {
+    char n = *nptr++;
 
-  /* Check for overflow.  If overflow, return zero. */
-  if (index>0) val = 0;
-  if (val < 0) val = 0;
+    if (val > LONG_MAX/BASE) {
+      return 0;
+    }
+    val *= BASE;
+
+    if (val > LONG_MAX - n) {
+      return 0;
+    }
+    val += n;
+  }
 
   /* Return the value. */
   if (num->n_sign == PLUS)

ext/com_dotnet/com_typeinfo.c

@@ -197,9 +197,10 @@ PHP_COM_DOTNET_API int php_com_import_typelib(ITypeLib *TL, int mode, int codepa
 				SysFreeString(bstr_ids);
 
 				/* sanity check for the case where the constant is already defined */
+				php_com_zval_from_variant(&value, pVarDesc->lpvarValue, codepage);
 				if ((exists = zend_get_constant(c.name)) != NULL) {
-					if (COMG(autoreg_verbose) && !compare_function(&results, &c.value, exists)) {
-						php_error_docref(NULL, E_WARNING, "Type library constant %s is already defined", c.name);
+					if (COMG(autoreg_verbose) && !compare_function(&results, &value, exists)) {
+						php_error_docref(NULL, E_WARNING, "Type library constant %s is already defined", ZSTR_VAL(c.name));
 					}
 					zend_string_release(c.name);
 					ITypeInfo_ReleaseVarDesc(TypeInfo, pVarDesc);
@@ -207,7 +208,6 @@ PHP_COM_DOTNET_API int php_com_import_typelib(ITypeLib *TL, int mode, int codepa
 				}
 
 				/* register the constant */
-				php_com_zval_from_variant(&value, pVarDesc->lpvarValue, codepage);
 				if (Z_TYPE(value) == IS_LONG) {
 					c.flags = mode;
 					ZVAL_LONG(&c.value, Z_LVAL(value));
@@ -225,8 +225,8 @@ PHP_COM_DOTNET_API int php_com_import_typelib(ITypeLib *TL, int mode, int codepa
 /* Type-library stuff */
 void php_com_typelibrary_dtor(zval *pDest)
 {
-	ITypeLib **Lib = (ITypeLib**)Z_PTR_P(pDest);
-	ITypeLib_Release(*Lib);
+	ITypeLib *Lib = (ITypeLib*)Z_PTR_P(pDest);
+	ITypeLib_Release(Lib);
 }
 
 PHP_COM_DOTNET_API ITypeLib *php_com_load_typelib_via_cache(char *search_string,

ext/com_dotnet/tests/bug77578.phpt

@@ -0,0 +1,23 @@
+--TEST--
+Bug #77578 (Crash when php unload)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+?>
+--FILE--
+<?php
+// To actually be able to verify the crash during shutdown on Windows, we have
+// to execute a PHP subprocess, and check its exit status.
+$php = PHP_BINARY;
+$ini = php_ini_loaded_file();
+$iniopt = $ini ? "-c $ini" : '';
+$command = "$php $iniopt -d com.autoregister_typelib=1 -r \"new COM('WbemScripting.SWbemLocator');\"";
+exec($command, $output, $status);
+var_dump($output, $status);
+?>
+===DONE===
+--EXPECT--
+array(0) {
+}
+int(0)
+===DONE===

ext/com_dotnet/tests/bug77621.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug #77621 (Already defined constants are not properly reported)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+?>
+--INI--
+com.autoregister_verbose=1
+--FILE--
+<?php
+define('ADSTYPE_INVALID', 0);
+$root = dirname(array_change_key_case($_SERVER, CASE_UPPER)['COMSPEC']);
+com_load_typelib("$root\activeds.tlb");
+?>
+===DONE===
+--EXPECTF--
+Warning: com_load_typelib(): Type library constant ADSTYPE_INVALID is already defined in %s on line %d
+===DONE===

ext/curl/interface.c

@@ -3310,8 +3310,12 @@ PHP_FUNCTION(curl_error)
 		RETURN_FALSE;
 	}
 
-	ch->err.str[CURL_ERROR_SIZE] = 0;
-	RETURN_STRING(ch->err.str);
+	if (ch->err.no) {
+		ch->err.str[CURL_ERROR_SIZE] = 0;
+		RETURN_STRING(ch->err.str);
+	} else {
+		RETURN_EMPTY_STRING();
+	}
 }
 /* }}} */
 

ext/curl/multi.c

@@ -425,6 +425,7 @@ void _php_curl_multi_close(zend_resource *rsrc) /* {{{ */
 		curl_multi_cleanup(mh->multi);
 		zend_llist_clean(&mh->easyh);
 		if (mh->handlers->server_push) {
+			zval_ptr_dtor(&mh->handlers->server_push->func_name);
 			efree(mh->handlers->server_push);
 		}
 		if (mh->handlers) {
@@ -587,11 +588,6 @@ static int _php_curl_multi_setopt(php_curlm *mh, zend_long option, zval *zvalue,
 
 			ZVAL_COPY(&mh->handlers->server_push->func_name, zvalue);
 			mh->handlers->server_push->method = PHP_CURL_USER;
-			if (!Z_ISUNDEF(mh->handlers->server_push->func_name)) {
-				zval_ptr_dtor(&mh->handlers->server_push->func_name);
-				mh->handlers->server_push->fci_cache = empty_fcall_info_cache;
-
-			}
 			error = curl_multi_setopt(mh->multi, option, _php_server_push_callback);
 			if (error != CURLM_OK) {
 				return 0;

ext/curl/tests/bug77535.phpt

@@ -0,0 +1,77 @@
+--TEST--
+Bug #77535 (Invalid callback, h2 server push)
+--SKIPIF--
+<?php
+include 'skipif.inc';
+if (getenv("SKIP_ONLINE_TESTS")) {
+	die("skip online test");
+}
+$curl_version = curl_version();
+if ($curl_version['version_number'] < 0x073d00) {
+	exit("skip: test may crash with curl < 7.61.0");
+}
+?>
+--FILE--
+<?php
+class MyHttpClient
+{
+    private $mh;
+    private $curl;
+
+    public function sendRequest()
+    {
+        if (false === $this->mh = curl_multi_init()) {
+            throw new \RuntimeException('Unable to create a new cURL multi handle');
+        }
+
+        $this->addServerPushCallback();
+
+        $this->curl = curl_init();
+        curl_setopt($this->curl, CURLOPT_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS);
+        curl_setopt($this->curl, CURLOPT_REDIR_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS);
+        curl_setopt($this->curl, CURLOPT_HEADER, false);
+        curl_setopt($this->curl, CURLOPT_RETURNTRANSFER, false);
+        curl_setopt($this->curl, CURLOPT_FAILONERROR, false);
+        curl_setopt($this->curl, CURLOPT_URL, 'https://http2.golang.org/serverpush');
+        curl_setopt($this->curl, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2_0);
+        curl_setopt($this->curl, CURLOPT_HEADERFUNCTION, function ($ch, $data) {
+            return \strlen($data);
+        });
+        curl_setopt($this->curl, CURLOPT_WRITEFUNCTION, function ($ch, $data) {
+            return \strlen($data);
+        });
+        curl_multi_add_handle($this->mh, $this->curl);
+        
+        $stillRunning = null;
+        while (true) {
+            do {
+                $mrc = curl_multi_exec($this->mh, $stillRunning);
+            } while (CURLM_CALL_MULTI_PERFORM === $mrc);
+
+            $info = curl_multi_info_read($this->mh);
+            while (false !== $info && $info['msg'] == CURLMSG_DONE) {
+                if (CURLMSG_DONE !== $info['msg']) {
+                    continue;
+                }
+                die("Start handle request.");
+            }
+        }
+    }
+
+    private function addServerPushCallback(): void
+    {
+
+        $callback = static function () {
+            return CURL_PUSH_OK;
+        };
+
+        curl_multi_setopt($this->mh, CURLMOPT_PIPELINING, CURLPIPE_MULTIPLEX);
+        curl_multi_setopt($this->mh, CURLMOPT_PUSHFUNCTION, $callback);
+    }
+}
+
+$buzz = new MyHttpClient();
+$buzz->sendRequest();
+--EXPECT--
+Start handle request.
+

ext/curl/tests/check_win_config.phpt

@@ -45,7 +45,7 @@ GSSAPI => No
 KERBEROS5 => Yes
 UNIX_SOCKETS => No
 PSL => No
-Protocols => dict, file, ftp, ftps, gopher, http, https, imap, imaps, ldap, pop3, pop3s, rtsp, scp, sftp, smb, smbs, smtp, smtps, telnet, tftp
+Protocols => dict, file, ftp, ftps, gopher, http, https, imap, imaps, ldap, ldaps, pop3, pop3s, rtsp, scp, sftp, smb, smbs, smtp, smtps, telnet, tftp
 Host => %s-pc-win32
 SSL Version => OpenSSL/%s
 ZLib Version => %s

ext/curl/tests/curl_basic_009.phpt

@@ -18,6 +18,6 @@ curl_close($ch);
 
 
 ?>
---EXPECTF--
-string(%d) "%Srotocol%s"
-int(1)
+--EXPECTREGEX--
+string\(\d+\) "([^\r\n]*rotocol[^\r\n]+|Could not resolve host: .+)"
+int\(\d\)

ext/date/config0.m4

@@ -1,8 +1,14 @@
 dnl $Id$
 dnl config.m4 for date extension
 
-sinclude(ext/date/lib/timelib.m4)
-sinclude(lib/timelib.m4)
+dnl Check for headers needed by timelib
+AC_CHECK_HEADERS([ \
+strings.h \
+io.h
+])
+
+dnl Check for strtoll, atoll
+AC_CHECK_FUNCS(strtoll atoll)
 
 PHP_DATE_CFLAGS="-I@ext_builddir@/lib -DZEND_ENABLE_STATIC_TSRMLS_CACHE=1 -DHAVE_TIMELIB_CONFIG_H=1"
 timelib_sources="lib/astro.c lib/dow.c lib/parse_date.c lib/parse_tz.c

ext/date/lib/timelib.m4

@@ -1,83 +0,0 @@
-dnl
-dnl $Id$
-dnl
-dnl
-dnl TL_DEF_HAVE(what [, why])
-dnl
-dnl Generates 'AC_DEFINE(HAVE_WHAT, 1, [WHY])'
-dnl
-AC_DEFUN([TL_DEF_HAVE],[AC_DEFINE([HAVE_]translit($1,a-z_.-,A-Z___),1,[ $2 ])])dnl
-
-dnl
-dnl TL_CHECK_INT_TYPE(type)
-dnl
-AC_DEFUN([TL_CHECK_INT_TYPE],[
-AC_CACHE_CHECK([for $1], ac_cv_int_type_$1, [
-AC_TRY_COMPILE([
-#if HAVE_SYS_TYPES_H
-# include <sys/types.h>
-#endif
-#if HAVE_INTTYPES_H
-# include <inttypes.h>
-#elif HAVE_STDINT_H   
-# include <stdint.h>  
-#endif],
-[if (($1 *) 0)
-  return 0;   
-if (sizeof ($1))
-  return 0;
-], [ac_cv_int_type_$1=yes], [ac_cv_int_type_$1=no])
-])
-if test "$ac_cv_int_type_$1" = "yes"; then
-  TL_DEF_HAVE($1, [Define if $1 type is present.])
-fi
-])dnl
-
-dnl
-dnl AC_TIMELIB_C_BIGENDIAN
-dnl Replacement macro for AC_C_BIGENDIAN
-dnl
-AC_DEFUN([AC_TIMELIB_C_BIGENDIAN],
-[AC_CACHE_CHECK([whether byte ordering is bigendian], ac_cv_c_bigendian_php,
- [
-  ac_cv_c_bigendian_php=unknown
-  AC_TRY_RUN(
-  [
-int main(void)
-{
-        short one = 1;
-        char *cp = (char *)&one;
-
-        if (*cp == 0) {
-                return(0);
-        } else {
-                return(1);
-        }
-} 
-  ], [ac_cv_c_bigendian_php=yes], [ac_cv_c_bigendian_php=no], [ac_cv_c_bigendian_php=unknown])
- ])
- if test $ac_cv_c_bigendian_php = yes; then
-   AC_DEFINE(WORDS_BIGENDIAN, [], [Define if processor uses big-endian word])
- fi
-])dnl
-
-dnl Check for types, sizes, etc. needed by timelib
-AC_CHECK_SIZEOF(long, 8)
-AC_CHECK_SIZEOF(int, 4)
-TL_CHECK_INT_TYPE(int32_t)
-TL_CHECK_INT_TYPE(uint32_t)
-
-dnl Check for headers needed by timelib
-AC_CHECK_HEADERS([ \
-sys/time.h \
-sys/types.h \
-stdint.h \
-dirent.h \
-string.h \
-strings.h \
-unistd.h \
-io.h
-])
-
-dnl Check for strtoll, atoll
-AC_CHECK_FUNCS(strtoll atoll strftime gettimeofday)

ext/date/php_date.c

@@ -543,6 +543,7 @@ const zend_function_entry date_funcs_period[] = {
 	PHP_ME(DatePeriod,                getStartDate,                NULL, ZEND_ACC_PUBLIC)
 	PHP_ME(DatePeriod,                getEndDate,                  NULL, ZEND_ACC_PUBLIC)
 	PHP_ME(DatePeriod,                getDateInterval,             NULL, ZEND_ACC_PUBLIC)
+	PHP_ME(DatePeriod,                getRecurrences,              NULL, ZEND_ACC_PUBLIC)
 	PHP_FE_END
 };
 
@@ -4435,12 +4436,21 @@ PHP_FUNCTION(date_interval_create_from_date_string)
 		Z_PARAM_STR(time_str)
 	ZEND_PARSE_PARAMETERS_END_EX(RETURN_FALSE);
 
-	php_date_instantiate(date_ce_interval, return_value);
-
 	time = timelib_strtotime(ZSTR_VAL(time_str), ZSTR_LEN(time_str), &err, DATE_TIMEZONEDB, php_date_parse_tzfile_wrapper);
+
+	if (err->error_count > 0)  {
+		php_error_docref(NULL, E_WARNING, "Unknown or bad format (%s) at position %d (%c): %s", ZSTR_VAL(time_str),
+			err->error_messages[0].position, err->error_messages[0].character ? err->error_messages[0].character : ' ', err->error_messages[0].message);
+		RETVAL_FALSE;
+		goto cleanup;
+	}
+
+	php_date_instantiate(date_ce_interval, return_value);
 	diobj = Z_PHPINTERVAL_P(return_value);
 	diobj->diff = timelib_rel_time_clone(&time->relative);
 	diobj->initialized = 1;
+
+cleanup:
 	timelib_time_dtor(time);
 	timelib_error_container_dtor(err);
 }
@@ -4635,6 +4645,10 @@ PHP_METHOD(DatePeriod, __construct)
 			dpobj->end = clone;
 		}
 	}
+ 
+	if (dpobj->end == NULL && recurrences < 1) {
+		php_error_docref(NULL, E_WARNING, "The recurrence count '%d' is invalid. Needs to be > 0", (int) recurrences);
+	}
 
 	/* options */
 	dpobj->include_start_date = !(options & PHP_DATE_PERIOD_EXCLUDE_START_DATE);
@@ -4727,6 +4741,27 @@ PHP_METHOD(DatePeriod, getDateInterval)
 }
 /* }}} */
 
+/* {{{ proto int DatePeriod::getRecurrences()
+   Get recurrences.
+*/
+PHP_METHOD(DatePeriod, getRecurrences)
+{
+	php_period_obj *dpobj;
+
+	if (zend_parse_parameters_none() == FAILURE) {
+		return;
+	}
+
+	dpobj = Z_PHPPERIOD_P(getThis());
+
+	if (0 == dpobj->recurrences - dpobj->include_start_date) {
+		return;
+	}
+
+	RETURN_LONG(dpobj->recurrences - dpobj->include_start_date);
+}
+/* }}} */
+
 static int check_id_allowed(char *id, zend_long what) /* {{{ */
 {
 	if (what & PHP_DATE_TIMEZONE_GROUP_AFRICA     && strncasecmp(id, "Africa/",      7) == 0) return 1;
@@ -5278,7 +5313,6 @@ PHP_METHOD(DatePeriod, __wakeup)
 /* {{{ date_period_read_property */
 static zval *date_period_read_property(zval *object, zval *member, int type, void **cache_slot, zval *rv)
 {
-	zval *zv;
 	if (type != BP_VAR_IS && type != BP_VAR_R) {
 		zend_throw_error(NULL, "Retrieval of DatePeriod properties for modification is unsupported");
 		return &EG(uninitialized_zval);
@@ -5286,13 +5320,7 @@ static zval *date_period_read_property(zval *object, zval *member, int type, voi
 
 	Z_OBJPROP_P(object); /* build properties hash table */
 
-	zv = std_object_handlers.read_property(object, member, type, cache_slot, rv);
-	if (Z_TYPE_P(zv) == IS_OBJECT && Z_OBJ_HANDLER_P(zv, clone_obj)) {
-		/* defensive copy */
-		ZVAL_OBJ(zv, Z_OBJ_HANDLER_P(zv, clone_obj)(zv));
-	}
-
-	return zv;
+	return std_object_handlers.read_property(object, member, type, cache_slot, rv);
 }
 /* }}} */
 

ext/date/php_date.h

@@ -112,6 +112,7 @@ PHP_METHOD(DatePeriod, __set_state);
 PHP_METHOD(DatePeriod, getStartDate);
 PHP_METHOD(DatePeriod, getEndDate);
 PHP_METHOD(DatePeriod, getDateInterval);
+PHP_METHOD(DatePeriod, getRecurrences);
 
 /* Options and Configuration */
 PHP_FUNCTION(date_default_timezone_set);

ext/date/tests/DatePeriod_getter.phpt

@@ -8,6 +8,7 @@ $start = new DateTime('2000-01-01 00:00:00', new DateTimeZone('Europe/Berlin'));
 $end   = new DateTime('2000-01-31 00:00:00', new DateTimeZone('UTC'));
 $interval = new DateInterval('P1D');
 $period   = new DatePeriod($start, $interval, $end);
+$recurrences = 4;
 
 var_dump($period->getStartDate()->format('Y-m-d H:i:s'));
 var_dump($period->getStartDate()->getTimeZone()->getName());
@@ -16,6 +17,17 @@ var_dump($period->getEndDate()->format('Y-m-d H:i:s'));
 var_dump($period->getEndDate()->getTimeZone()->getName());
 
 var_dump($period->getDateInterval()->format('%R%y-%m-%d-%h-%i-%s'));
+var_dump($period->getRecurrences());
+
+$periodWithRecurrences = new DatePeriod($start, $interval, $recurrences);
+
+var_dump($periodWithRecurrences->getRecurrences());
+var_dump($periodWithRecurrences->getEndDate());
+
+$periodWithRecurrencesWithoutStart = new DatePeriod($start, $interval, $recurrences, DatePeriod::EXCLUDE_START_DATE);
+
+var_dump($periodWithRecurrences->getRecurrences());
+
 ?>
 --EXPECTF--
 string(19) "2000-01-01 00:00:00"
@@ -23,3 +35,7 @@ string(13) "Europe/Berlin"
 string(19) "2000-01-31 00:00:00"
 string(3) "UTC"
 string(12) "+0-0-1-0-0-0"
+NULL
+int(4)
+NULL
+int(4)

ext/date/tests/DatePeriod_wrong_recurrence_on_constructor.phpt

@@ -0,0 +1,19 @@
+--TEST--
+DatePeriod: Test wrong recurrence parameter on __construct
+--FILE--
+<?php
+try {
+    new DatePeriod(new DateTime('yesterday'), new DateInterval('P1D'), 0);
+} catch (Exception $exception) {
+    echo $exception->getMessage(), "\n";
+}
+
+try {
+    new DatePeriod(new DateTime('yesterday'), new DateInterval('P1D'),-1);
+} catch (Exception $exception) {
+    echo $exception->getMessage(), "\n";
+}
+?>
+--EXPECTF--
+DatePeriod::__construct(): The recurrence count '0' is invalid. Needs to be > 0
+DatePeriod::__construct(): The recurrence count '-1' is invalid. Needs to be > 0

ext/date/tests/date_interval_create_from_date_string_broken.phpt

@@ -0,0 +1,10 @@
+--TEST--
+Test date_interval_create_from_date_string() function : nonsense data
+--FILE--
+<?php
+$i = date_interval_create_from_date_string("foobar");
+var_dump($i);
+?>
+--EXPECTF--
+Warning: date_interval_create_from_date_string(): Unknown or bad format (foobar) at position 0 (f): The timezone could not be found in the database in %sdate_interval_create_from_date_string_broken.php on line 2
+bool(false)

ext/date/tests/date_interval_create_from_date_string_nullparam.phpt

@@ -4,41 +4,9 @@ Test date_interval_create_from_date_string() function : null parameter
 Rodrigo Prado de Jesus <royopa [at] gmail [dot] com>
 --FILE--
 <?php
-$i = date_interval_create_from_date_string(null); //returns a empty object
+$i = date_interval_create_from_date_string(null);
 var_dump($i);
 ?>
 --EXPECTF--
-object(DateInterval)#%d (16) {
-  ["y"]=>
-  int(0)
-  ["m"]=>
-  int(0)
-  ["d"]=>
-  int(0)
-  ["h"]=>
-  int(0)
-  ["i"]=>
-  int(0)
-  ["s"]=>
-  int(0)
-  ["f"]=>
-  float(0)
-  ["weekday"]=>
-  int(0)
-  ["weekday_behavior"]=>
-  int(0)
-  ["first_last_day_of"]=>
-  int(0)
-  ["invert"]=>
-  int(0)
-  ["days"]=>
-  int(0)
-  ["special_type"]=>
-  int(0)
-  ["special_amount"]=>
-  int(0)
-  ["have_weekday_relative"]=>
-  int(0)
-  ["have_special_relative"]=>
-  int(0)
-}
+Warning: date_interval_create_from_date_string(): Unknown or bad format () at position 0 ( ): Empty string in %sdate_interval_create_from_date_string_nullparam.php on line 2
+bool(false)

ext/exif/exif.c

@@ -2062,10 +2062,10 @@ static int exif_file_sections_free(image_info_type *ImageInfo)
 /* {{{ exif_iif_add_value
  Add a value to image_info
 */
-static void exif_iif_add_value(image_info_type *image_info, int section_index, char *name, int tag, int format, int length, void* value, int motorola_intel)
+static void exif_iif_add_value(image_info_type *image_info, int section_index, char *name, int tag, int format, int length, void* value, size_t value_len, int motorola_intel)
 {
 	size_t idex;
-	void *vptr;
+	void *vptr, *vptr_end;
 	image_info_value *info_value;
 	image_info_data  *info_data;
 	image_info_data  *list;
@@ -2087,8 +2087,12 @@ static void exif_iif_add_value(image_info_type *image_info, int section_index, c
 
 	switch (format) {
 		case TAG_FMT_STRING:
+			if (length > value_len) {
+				exif_error_docref("exif_iif_add_value" EXIFERR_CC, image_info, E_WARNING, "length > value_len: %d > %zu", length, value_len);
+				value = NULL;
+			}
 			if (value) {
-				length = php_strnlen(value, length);
+				length = (int)php_strnlen(value, length);
 				info_value->s = estrndup(value, length);
 				info_data->length = length;
 			} else {
@@ -2110,6 +2114,10 @@ static void exif_iif_add_value(image_info_type *image_info, int section_index, c
 			if (!length)
 				break;
 		case TAG_FMT_UNDEFINED:
+			if (length > value_len) {
+				exif_error_docref("exif_iif_add_value" EXIFERR_CC, image_info, E_WARNING, "length > value_len: %d > %zu", length, value_len);
+				value = NULL;
+			}
 			if (value) {
 				if (tag == TAG_MAKER_NOTE) {
 					length = (int) php_strnlen(value, length);
@@ -2140,7 +2148,12 @@ static void exif_iif_add_value(image_info_type *image_info, int section_index, c
 			} else {
 				info_value = &info_data->value;
 			}
+			vptr_end = (char *) value + value_len;
 			for (idex=0,vptr=value; idex<(size_t)length; idex++,vptr=(char *) vptr + php_tiff_bytes_per_format[format]) {
+				if ((char *) vptr_end - (char *) vptr < php_tiff_bytes_per_format[format]) {
+					exif_error_docref("exif_iif_add_value" EXIFERR_CC, image_info, E_WARNING, "Value too short");
+					break;
+				}
 				if (length>1) {
 					info_value = &info_data->value.list[idex];
 				}
@@ -2176,7 +2189,7 @@ static void exif_iif_add_value(image_info_type *image_info, int section_index, c
 						php_error_docref(NULL, E_WARNING, "Found value of type single");
 #endif
 						info_value->f = *(float *)value;
-
+						break;
 					case TAG_FMT_DOUBLE:
 #ifdef EXIF_DEBUG
 						php_error_docref(NULL, E_WARNING, "Found value of type double");
@@ -2194,9 +2207,9 @@ static void exif_iif_add_value(image_info_type *image_info, int section_index, c
 /* {{{ exif_iif_add_tag
  Add a tag from IFD to image_info
 */
-static void exif_iif_add_tag(image_info_type *image_info, int section_index, char *name, int tag, int format, size_t length, void* value)
+static void exif_iif_add_tag(image_info_type *image_info, int section_index, char *name, int tag, int format, size_t length, void* value, size_t value_len)
 {
-	exif_iif_add_value(image_info, section_index, name, tag, format, (int)length, value, image_info->motorola_intel);
+	exif_iif_add_value(image_info, section_index, name, tag, format, (int)length, value, value_len, image_info->motorola_intel);
 }
 /* }}} */
 
@@ -2617,7 +2630,7 @@ static void add_assoc_image_info(zval *value, int sub_array, image_info_type *im
 */
 static void exif_process_COM (image_info_type *image_info, char *value, size_t length)
 {
-	exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_STRING, length-2, value+2);
+	exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_STRING, length-2, value+2, length-2);
 }
 /* }}} */
 
@@ -2632,17 +2645,17 @@ static void exif_process_CME (image_info_type *image_info, char *value, size_t l
 	if (length>3) {
 		switch(value[2]) {
 			case 0:
-				exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_UNDEFINED, length, value);
+				exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_UNDEFINED, length, value, length);
 				break;
 			case 1:
-				exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_STRING, length, value);
+				exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_STRING, length, value, length);
 				break;
 			default:
 				php_error_docref(NULL, E_NOTICE, "Undefined JPEG2000 comment encoding");
 				break;
 		}
 	} else {
-		exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_UNDEFINED, 0, NULL);
+		exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_UNDEFINED, 0, NULL, 0);
 		php_error_docref(NULL, E_NOTICE, "JPEG2000 comment section too small");
 	}
 }
@@ -3152,7 +3165,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 		break;
 	}
 
-	if (maker_note->offset >= value_len) {
+	if (value_len < 2 || maker_note->offset >= value_len - 1) {
 		/* Do not go past the value end */
 		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "IFD data too short: 0x%04X offset 0x%04X", value_len, maker_note->offset);
 		return FALSE;
@@ -3207,6 +3220,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 #endif
 		default:
 		case MN_OFFSET_NORMAL:
+			data_len = value_len;
 			break;
 	}
 
@@ -3214,6 +3228,10 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 2 + 0x%04X*12 = 0x%04X > 0x%04X", NumDirEntries, 2+NumDirEntries*12, value_len);
 		return FALSE;
 	}
+	if ((dir_start - value_ptr) > value_len - (2+NumDirEntries*12)) {
+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 0x%04X > 0x%04X", (dir_start - value_ptr) + (2+NumDirEntries*12), value_len);
+		return FALSE;
+	}
 
 	for (de=0;de<NumDirEntries;de++) {
 		if (!exif_process_IFD_TAG(ImageInfo, dir_start + 2 + 12 * de,
@@ -3235,7 +3253,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, char *offset_base, size_t IFDlength, size_t displacement, int section_index, int ReadNextIFD, tag_table_type tag_table)
 {
 	size_t length;
-	int tag, format, components;
+	unsigned int tag, format, components;
 	char *value_ptr, tagname[64], cbuf[32], *outside=NULL;
 	size_t byte_count, offset_val, fpos, fgot;
 	int64_t byte_count_signed;
@@ -3286,7 +3304,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
             offset_base is ImageInfo->file.list[sn].data-dir_offset
             dir_entry - offset_base is dir_offset+2+i*12
         */
-		if (byte_count > IFDlength || offset_val > IFDlength-byte_count || value_ptr < dir_entry || offset_val < (size_t)(dir_entry-offset_base)) {
+		if (byte_count > IFDlength || offset_val > IFDlength-byte_count || value_ptr < dir_entry || offset_val < (size_t)(dir_entry-offset_base) || dir_entry <= offset_base) {
 			/* It is important to check for IMAGE_FILETYPE_TIFF
 			 * JPEG does not use absolute pointers instead its pointers are
 			 * relative to the start of the TIFF header in APP1 section. */
@@ -3405,6 +3423,10 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				break;
 
 			case TAG_USERCOMMENT:
+				EFREE_IF(ImageInfo->UserComment);
+				ImageInfo->UserComment = NULL;
+				EFREE_IF(ImageInfo->UserCommentEncoding);
+				ImageInfo->UserCommentEncoding = NULL;
 				ImageInfo->UserCommentLength = exif_process_user_comment(ImageInfo, &(ImageInfo->UserComment), &(ImageInfo->UserCommentEncoding), value_ptr, byte_count);
 				break;
 
@@ -3546,7 +3568,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				}
 		}
 	}
-	exif_iif_add_tag(ImageInfo, section_index, exif_get_tagname(tag, tagname, sizeof(tagname), tag_table), tag, format, components, value_ptr);
+	exif_iif_add_tag(ImageInfo, section_index, exif_get_tagname(tag, tagname, sizeof(tagname), tag_table), tag, format, components, value_ptr, byte_count);
 	EFREE_IF(outside);
 	return TRUE;
 }
@@ -3708,10 +3730,10 @@ static void exif_process_APP12(image_info_type *ImageInfo, char *buffer, size_t
 	size_t l1, l2=0;
 
 	if ((l1 = php_strnlen(buffer+2, length-2)) > 0) {
-		exif_iif_add_tag(ImageInfo, SECTION_APP12, "Company", TAG_NONE, TAG_FMT_STRING, l1, buffer+2);
+		exif_iif_add_tag(ImageInfo, SECTION_APP12, "Company", TAG_NONE, TAG_FMT_STRING, l1, buffer+2, l1);
 		if (length > 2+l1+1) {
 			l2 = php_strnlen(buffer+2+l1+1, length-2-l1-1);
-			exif_iif_add_tag(ImageInfo, SECTION_APP12, "Info", TAG_NONE, TAG_FMT_STRING, l2, buffer+2+l1+1);
+			exif_iif_add_tag(ImageInfo, SECTION_APP12, "Info", TAG_NONE, TAG_FMT_STRING, l2, buffer+2+l1+1, l2);
 		}
 	}
 #ifdef EXIF_DEBUG
@@ -3925,8 +3947,10 @@ static int exif_scan_thumbnail(image_info_type *ImageInfo)
 		if (c == 0xFF)
 			return FALSE;
 		marker = c;
+		if (pos>=ImageInfo->Thumbnail.size)
+			return FALSE;
 		length = php_jpg_get16(data+pos);
-		if (pos+length>=ImageInfo->Thumbnail.size) {
+		if (length > ImageInfo->Thumbnail.size || pos >= ImageInfo->Thumbnail.size - length) {
 			return FALSE;
 		}
 #ifdef EXIF_DEBUG
@@ -3947,6 +3971,10 @@ static int exif_scan_thumbnail(image_info_type *ImageInfo)
 			case M_SOF14:
 			case M_SOF15:
 				/* handle SOFn block */
+				if (length < 8 || ImageInfo->Thumbnail.size - 8 < pos) {
+					/* exif_process_SOFn needs 8 bytes */
+					return FALSE;
+				}
 				exif_process_SOFn(data+pos, marker, &sof_info);
 				ImageInfo->Thumbnail.height   = sof_info.height;
 				ImageInfo->Thumbnail.width    = sof_info.width;
@@ -3984,10 +4012,10 @@ static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offse
 	tag_table_type tag_table = exif_get_tag_table(section_index);
 
 	if (ImageInfo->ifd_nesting_level > MAX_IFD_NESTING_LEVEL) {
-                return FALSE;
-        }
+		return FALSE;
+	}
 
-	if (ImageInfo->FileSize >= dir_offset+2) {
+	if (ImageInfo->FileSize >= 2 && ImageInfo->FileSize - 2 >= dir_offset) {
 		sn = exif_file_sections_add(ImageInfo, M_PSEUDO, 2, NULL);
 #ifdef EXIF_DEBUG
 		exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read from TIFF: filesize(x%04X), IFD dir(x%04X + x%04X)", ImageInfo->FileSize, dir_offset, 2);
@@ -3995,8 +4023,8 @@ static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offse
 		php_stream_seek(ImageInfo->infile, dir_offset, SEEK_SET); /* we do not know the order of sections */
 		php_stream_read(ImageInfo->infile, (char*)ImageInfo->file.list[sn].data, 2);
 		num_entries = php_ifd_get16u(ImageInfo->file.list[sn].data, ImageInfo->motorola_intel);
-		dir_size = 2/*num dir entries*/ +12/*length of entry*/*num_entries +4/* offset to next ifd (points to thumbnail or NULL)*/;
-		if (ImageInfo->FileSize >= dir_offset+dir_size) {
+		dir_size = 2/*num dir entries*/ +12/*length of entry*/*(size_t)num_entries +4/* offset to next ifd (points to thumbnail or NULL)*/;
+		if (ImageInfo->FileSize >= dir_size && ImageInfo->FileSize - dir_size >= dir_offset) {
 #ifdef EXIF_DEBUG
 			exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read from TIFF: filesize(x%04X), IFD dir(x%04X + x%04X), IFD entries(%d)", ImageInfo->FileSize, dir_offset+2, dir_size-2, num_entries);
 #endif
@@ -4079,9 +4107,9 @@ static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offse
 					}
 				}
 			}
-			if (ImageInfo->FileSize >= dir_offset + ImageInfo->file.list[sn].size) {
+			if (ImageInfo->FileSize >= ImageInfo->file.list[sn].size && ImageInfo->FileSize - ImageInfo->file.list[sn].size >= dir_offset) {
 				if (ifd_size > dir_size) {
-					if (dir_offset + ifd_size > ImageInfo->FileSize) {
+					if (ImageInfo->FileSize < ifd_size || dir_offset > ImageInfo->FileSize - ifd_size) {
 						exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Error in TIFF: filesize(x%04X) less than size of IFD(x%04X + x%04X)", ImageInfo->FileSize, dir_offset, ifd_size);
 						return FALSE;
 					}
@@ -4575,7 +4603,7 @@ PHP_FUNCTION(exif_read_data)
 	if (ImageInfo.Thumbnail.size) {
 		if (read_thumbnail) {
 			/* not exif_iif_add_str : this is a buffer */
-			exif_iif_add_tag(&ImageInfo, SECTION_THUMBNAIL, "THUMBNAIL", TAG_NONE, TAG_FMT_UNDEFINED, ImageInfo.Thumbnail.size, ImageInfo.Thumbnail.data);
+			exif_iif_add_tag(&ImageInfo, SECTION_THUMBNAIL, "THUMBNAIL", TAG_NONE, TAG_FMT_UNDEFINED, ImageInfo.Thumbnail.size, ImageInfo.Thumbnail.data, ImageInfo.Thumbnail.size);
 		}
 		if (!ImageInfo.Thumbnail.width || !ImageInfo.Thumbnail.height) {
 			/* try to evaluate if thumbnail data is present */
@@ -4678,7 +4706,9 @@ PHP_FUNCTION(exif_thumbnail)
 	ZVAL_STRINGL(return_value, ImageInfo.Thumbnail.data, ImageInfo.Thumbnail.size);
 	if (arg_c >= 3) {
 		if (!ImageInfo.Thumbnail.width || !ImageInfo.Thumbnail.height) {
-			exif_scan_thumbnail(&ImageInfo);
+			if (!exif_scan_thumbnail(&ImageInfo)) {
+				ImageInfo.Thumbnail.width = ImageInfo.Thumbnail.height = 0;
+			}
 		}
 		zval_dtor(z_width);
 		zval_dtor(z_height);

ext/exif/tests/bug77540.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug 77540 (Invalid Read on exif_process_SOFn)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+$width = $height = 42;
+$s = exif_thumbnail(__DIR__."/bug77540.jpg", $width, $height);
+echo "Width ".$width."\n";
+echo "Height ".$height."\n";
+?>
+DONE
+--EXPECTF--
+Width 0
+Height 0
+DONE

ext/exif/tests/bug77563.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug 77563 (Uninitialized read in exif_process_IFD_in_MAKERNOTE)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+$s = exif_thumbnail(__DIR__."/bug77563.jpg");
+?>
+DONE
+--EXPECTF--
+Warning: exif_thumbnail(bug77563.jpg): IFD data too short: 0x0009 offset 0x0008 in %s%ebug77563.php on line %d
+
+Warning: exif_thumbnail(bug77563.jpg): File structure corrupted in %s%ebug77563.php on line %d
+
+Warning: exif_thumbnail(bug77563.jpg): Invalid JPEG file in %s%ebug77563.php on line %d
+DONE

ext/exif/tests/bug77564/bug77564.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug 77564 (Memory leak in exif_process_IFD_TAG)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+var_dump(exif_read_data(dirname(__FILE__) . '/bug77564.jpg'));
+?>
+DONE
+--EXPECTF--
+
+Warning: exif_read_data(bug77564.jpg): Illegal IFD offset in %sbug77564.php on line %d
+
+Warning: exif_read_data(bug77564.jpg): File structure corrupted in %sbug77564.php on line %d
+
+Warning: exif_read_data(bug77564.jpg): Invalid JPEG file in %sbug77564.php on line %d
+bool(false)
+DONE

ext/exif/tests/bug77753.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug #77753 (Heap-buffer-overflow in php_ifd_get32s)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+var_dump(exif_read_data(__DIR__."/bug77753.tiff"));
+?>
+DONE
+--EXPECTF--
+%A
+Warning: exif_read_data(bug77753.tiff): Illegal IFD size: 0x006A > 0x0065 in %sbug77753.php on line %d
+
+Warning: exif_read_data(bug77753.tiff): Invalid TIFF file in %sbug77753.php on line %d
+bool(false)
+DONE

ext/exif/tests/bug77831.phpt

@@ -0,0 +1,13 @@
+--TEST--
+Bug #77831 (Heap-buffer-overflow in exif_iif_add_value in EXIF)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+var_dump(exif_read_data(__DIR__."/bug77831.tiff"));
+?>
+DONE
+--EXPECTF--
+%A
+bool(false)
+DONE

ext/exif/tests/bug77950.phpt

@@ -0,0 +1,12 @@
+--TEST--
+Bug #77950 (Heap-buffer-overflow in _estrndup via exif_process_IFD_TAG)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+exif_read_data(__DIR__."/bug77950.tiff");
+?>
+DONE
+--EXPECTF--
+%A
+DONE

ext/exif/tests/bug77988.phpt

@@ -0,0 +1,11 @@
+--TEST--
+Bug #77988 (heap-buffer-overflow on php_jpg_get16)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+exif_read_data(__DIR__."/bug77988.jpg", 'COMMENT', FALSE, TRUE);
+?>
+DONE
+--EXPECTF--
+DONE

ext/ftp/ftp.c

@@ -1859,7 +1859,7 @@ data_accepted:
 						php_pollfd p;
 						int i;
 
-						p.fd = ftp->fd;
+						p.fd = data->fd;
 						p.events = (err == SSL_ERROR_WANT_READ) ? (POLLIN|POLLPRI) : POLLOUT;
 						p.revents = 0;
 

ext/ftp/tests/server.inc

@@ -289,8 +289,13 @@ if ($pid) {
             }
 
 		}elseif (preg_match("~^CWD ([A-Za-z./]+)\r\n$~", $buf, $m)) {
-			change_dir($m[1]);
-			fputs($s, "250 CWD command successful.\r\n");
+			if (isset($bug77680)) {
+				fputs($s, "550 Directory change to $m[1] failed: file does not exist\r\n");
+				var_dump($buf);
+			} else {
+				change_dir($m[1]);
+				fputs($s, "250 CWD command successful.\r\n");
+			}
 
 		} elseif (preg_match("~^NLST(?: ([A-Za-z./]+))?\r\n$~", $buf, $m)) {
 
@@ -332,6 +337,9 @@ if ($pid) {
 			if (isset($bug7216)) {
 				fputs($s, "257 OK.\r\n");
 			} else {
+				if (isset($bug77680)) {
+					var_dump($buf);
+				}
 				fputs($s, "257 \"/path/to/ftproot$cwd$m[1]\" created.\r\n");
 			}
 

ext/gd/gd.c

@@ -4699,7 +4699,11 @@ PHP_FUNCTION(imageantialias)
 	if ((im = (gdImagePtr)zend_fetch_resource(Z_RES_P(IM), "Image", le_gd)) == NULL) {
 		RETURN_FALSE;
 	}
-	gdImageSetAntiAliased(im, 0);
+
+	if (im->trueColor) {
+		im->AA = alias;
+	}
+
 	RETURN_TRUE;
 }
 /* }}} */

ext/gd/libgd/gd_gif_out.c

@@ -132,7 +132,7 @@ void gdImageGifCtx(gdImagePtr im, gdIOCtxPtr out)
 	BitsPerPixel = colorstobpp(tim->colorsTotal);
 	/* All set, let's do it. */
 	GIFEncode(
-		out, tim->sx, tim->sy, tim->interlace, 0, tim->transparent, BitsPerPixel,
+		out, tim->sx, tim->sy, interlace, 0, tim->transparent, BitsPerPixel,
 		tim->red, tim->green, tim->blue, tim);
 	if (pim) {
 		/* Destroy palette based temporary image. */

ext/gd/libgd/gd_xbm.c

@@ -136,7 +136,11 @@ gdImagePtr gdImageCreateFromXbm(FILE * fd)
 			}
 			h[3] = ch;
 		}
-		sscanf(h, "%x", &b);
+		if (sscanf(h, "%x", &b) != 1) {
+			gd_error("invalid XBM");
+			gdImageDestroy(im);
+			return 0;
+		}
 		for (bit = 1; bit <= max_bit; bit = bit << 1) {
 			gdImageSetPixel(im, x++, y, (b & bit) ? 1 : 0);
 			if (x == im->sx) {

ext/gd/tests/bug77700.phpt

@@ -0,0 +1,24 @@
+--TEST--
+Bug #77700 (Writing truecolor images as GIF ignores interlace flag)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+$im = imagecreatetruecolor(10, 10);
+imagefilledrectangle($im, 0, 0, 9, 9, imagecolorallocate($im, 255, 255, 255));
+imageinterlace($im, 1);
+imagegif($im, __DIR__ . 'bug77700.gif');
+
+$im = imagecreatefromgif(__DIR__ . 'bug77700.gif');
+var_dump(imageinterlace($im));
+?>
+===DONE===
+--EXPECT--
+int(1)
+===DONE===
+--CLEAN--
+<?php
+unlink(__DIR__ . 'bug77700.gif');
+?>

ext/gd/tests/bug77943.phpt

@@ -0,0 +1,29 @@
+--TEST--
+Bug #77943 (imageantialias($image, false); does not work)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+require_once __DIR__ . '/func.inc';
+
+$width = 400;
+$height = 300;
+$im = imagecreatetruecolor($width, $height);
+$white = imagecolorallocate($im, 255, 255, 255);
+$blue = imagecolorallocate($im, 0, 0, 255);
+
+imageantialias($im, false);
+imagefilledrectangle($im, 0, 0, $width-1, $height-1, $white);
+
+imageline($im, 0, 0, $width, $height, $blue);
+imagesetthickness($im, 3);
+imageline($im, 10, 0, $width, $height-10, $blue);
+
+test_image_equals_file(__DIR__ . '/bug77943.png', $im);
+?>
+===DONE===
+--EXPECT--
+The images are equal.
+===DONE===

ext/gd/tests/bug77973.phpt

@@ -0,0 +1,26 @@
+--TEST--
+Bug #77973 (Uninitialized read in gdImageCreateFromXbm)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die("skip gd extension not available");
+if (!function_exists('imagecreatefromxbm')) die("skip imagecreatefromxbm not available");
+?>
+--FILE--
+<?php
+$contents = hex2bin("23646566696e6520776964746820320a23646566696e652068656967687420320a737461746963206368617220626974735b5d203d7b0a7a7a787a7a");
+$filepath = __DIR__ . '/bug77973.xbm';
+file_put_contents($filepath, $contents);
+$im = imagecreatefromxbm($filepath);
+var_dump($im);
+?>
+===DONE===
+--EXPECTF--
+Warning: imagecreatefromxbm(): invalid XBM in %s on line %d
+
+Warning: imagecreatefromxbm(): '%s' is not a valid XBM file in %s on line %d
+bool(false)
+===DONE===
+--CLEAN--
+<?php
+unlink(__DIR__ . '/bug77973.xbm');
+?>

ext/hash/hash_sha3.c

@@ -194,7 +194,7 @@ static void PHP_SHA3_Final(unsigned char* digest,
 	}
 
 	// Zero out context
-	memset(ctx, 0, sizeof(PHP_SHA3_CTX));
+	ZEND_SECURE_ZERO(ctx, sizeof(PHP_SHA3_CTX));
 }
 
 // ==========================================================================

ext/hash/hash_snefru.c

@@ -129,7 +129,7 @@ static inline void SnefruTransform(PHP_SNEFRU_CTX *context, const unsigned char
 								((input[i+2] & 0xff) << 8) | (input[i+3] & 0xff);
 	}
 	Snefru(context->state);
-	memset(&context->state[8], 0, sizeof(uint32_t) * 8);
+	ZEND_SECURE_ZERO(&context->state[8], sizeof(uint32_t) * 8);
 }
 
 PHP_HASH_API void PHP_SNEFRUInit(PHP_SNEFRU_CTX *context)

ext/iconv/iconv.c

@@ -1664,7 +1664,9 @@ static php_iconv_err_t _php_iconv_mime_decode(smart_str *pretval, const char *st
 							 * we can do at this point. */
 							if (*(p1 + 1) == '=') {
 								++p1;
-								--str_left;
+								if (str_left > 1) {
+									--str_left;
+								}
 							}
 
 							err = _php_iconv_appendl(pretval, encoded_word, (size_t)((p1 + 1) - encoded_word), cd_pl);

ext/iconv/tests/bug78069.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Bug #78069 (Out-of-bounds read in iconv.c:_php_iconv_mime_decode() due to integer overflow)
+--SKIPIF--
+<?php
+if (!extension_loaded('iconv')) die('skip ext/iconv required');
+?>
+--FILE--
+<?php
+$hdr = iconv_mime_decode_headers(file_get_contents(__DIR__ . "/bug78069.data"),2);
+var_dump(count($hdr));
+?>
+DONE
+--EXPECT--
+int(1)
+DONE

ext/interbase/interbase.c

@@ -939,13 +939,15 @@ static void _php_ibase_connect(INTERNAL_FUNCTION_PARAMETERS, int persistent) /*
 
 		xlink = (zend_resource*) le->ptr;
 		if ((!persistent && xlink->type == le_link) || xlink->type == le_plink) {
-			if (IBG(default_link)) {
-				zend_list_close(IBG(default_link));
+			if (IBG(default_link) != xlink) {
+				GC_REFCOUNT(xlink)++;
+				if (IBG(default_link)) {
+					zend_list_delete(IBG(default_link));
+				}
+				IBG(default_link) = xlink;
 			}
-			xlink->gc.refcount++;
-			xlink->gc.refcount++;
-			IBG(default_link) = xlink;
-			RETVAL_RES(xlink);
+			GC_REFCOUNT(xlink)++;
+			RETURN_RES(xlink);
 		} else {
 			zend_hash_str_del(&EG(regular_list), hash, sizeof(hash)-1);
 		}

ext/intl/dateformat/dateformat_create.cpp

@@ -74,7 +74,7 @@ static int datefmt_ctor(INTERNAL_FUNCTION_PARAMETERS, zend_bool is_constructor)
 	intl_error_reset(NULL);
 	object = return_value;
 	/* Parse parameters. */
-	if (zend_parse_parameters_ex(zpp_flags, ZEND_NUM_ARGS(), "sll|zzs",
+	if (zend_parse_parameters_ex(zpp_flags, ZEND_NUM_ARGS(), "s!ll|zzs",
 			&locale_str, &locale_len, &date_type, &time_type, &timezone_zv,
 			&calendar_zv, &pattern_str, &pattern_str_len) == FAILURE) {
 		intl_error_set( NULL, U_ILLEGAL_ARGUMENT_ERROR,	"datefmt_create: "

ext/intl/dateformat/dateformat_format_object.cpp

@@ -169,7 +169,7 @@ U_CFUNC PHP_FUNCTION(datefmt_format_object)
 			goto cleanup;
 		}
 		cal = obj_cal->clone();
-	} else if (instanceof_function(instance_ce, php_date_get_date_ce())) {
+	} else if (instanceof_function(instance_ce, php_date_get_interface_ce())) {
 		if (intl_datetime_decompose(object, &date, &timeZone, NULL,
 				"datefmt_format_object") == FAILURE) {
 			RETURN_FALSE;

ext/intl/resourcebundle/TODO

@@ -1 +1 @@
-- var_dump support
+- var_dump support

ext/intl/tests/bug77895.phpt

@@ -0,0 +1,13 @@
+--TEST--
+Bug #77895: IntlDateFormatter::create fails in strict mode if $locale = null 
+--FILE--
+<?php
+
+declare(strict_types=1);
+
+var_dump(IntlDateFormatter::create(null, IntlDateFormatter::NONE, IntlDateFormatter::NONE));
+
+?>
+--EXPECT--
+object(IntlDateFormatter)#1 (0) {
+}

ext/intl/tests/dateformat_bug65683_2.phpt

@@ -0,0 +1,12 @@
+--TEST--
+Bug #65683: Intl does not support DateTimeImmutable (using datefmt_format_object)
+--FILE--
+<?php
+$date = date_create('1970-01-01');
+$date_imm = date_create_immutable('1970-01-01');
+var_dump(datefmt_format_object($date, null, 'fr_FR'));
+var_dump(datefmt_format_object($date_imm, null, 'fr_FR'));
+?>
+--EXPECTF--
+string(%d) "%s"
+string(%d) "%s"

ext/json/json_encoder.c

@@ -542,8 +542,16 @@ again:
 				return php_json_encode_serializable_object(buf, val, options, encoder);
 			}
 			/* fallthrough -- Non-serializable object */
-		case IS_ARRAY:
-			return php_json_encode_array(buf, val, options, encoder);
+		case IS_ARRAY: {
+			/* Avoid modifications (and potential freeing) of the array through a reference when a
+			 * jsonSerialize() method is invoked. */
+			zval zv;
+			int res;
+			ZVAL_COPY(&zv, val);
+			res = php_json_encode_array(buf, &zv, options, encoder);
+			zval_ptr_dtor_nogc(&zv);
+			return res;
+		}
 
 		case IS_REFERENCE:
 			val = Z_REFVAL_P(val);

ext/json/tests/bug77843.phpt

@@ -0,0 +1,25 @@
+--TEST--
+Bug #77843: Use after free with json serializer
+--FILE--
+<?php
+
+class X implements JsonSerializable {
+    public $prop = "value";
+    public function jsonSerialize() {
+        global $arr;
+        unset($arr[0]);
+        var_dump($this);
+        return $this;
+    }
+}
+
+$arr = [new X()];
+var_dump(json_encode([&$arr]));
+
+?>
+--EXPECT--
+object(X)#1 (1) {
+  ["prop"]=>
+  string(5) "value"
+}
+string(20) "[[{"prop":"value"}]]"

ext/mbstring/mbstring.c

@@ -3269,7 +3269,7 @@ MBSTRING_API HashTable *php_mb_convert_encoding_recursive(HashTable *input, cons
 {
 	HashTable *output, *chash;
 	zend_long idx;
-	zend_string *key, *key_tmp;
+	zend_string *key;
 	zval *entry, entry_tmp;
 	size_t ckey_len, cval_len;
 	char *ckey, *cval;
@@ -3289,7 +3289,8 @@ MBSTRING_API HashTable *php_mb_convert_encoding_recursive(HashTable *input, cons
 		/* convert key */
 		if (key) {
 			ckey = php_mb_convert_encoding(ZSTR_VAL(key), ZSTR_LEN(key), _to_encoding, _from_encodings, &ckey_len);
-			key_tmp = zend_string_init(ckey, ckey_len, 0);
+			key = zend_string_init(ckey, ckey_len, 0);
+			efree(ckey);
 		}
 		/* convert value */
 		ZEND_ASSERT(entry);
@@ -3317,13 +3318,14 @@ MBSTRING_API HashTable *php_mb_convert_encoding_recursive(HashTable *input, cons
 			case IS_OBJECT:
 			default:
 				if (key) {
-					efree(key_tmp);
+					zend_string_release(key);
 				}
 				php_error_docref(NULL, E_WARNING, "Object is not supported");
 				continue;
 		}
 		if (key) {
-			zend_hash_add(output, key_tmp, &entry_tmp);
+			zend_hash_add(output, key, &entry_tmp);
+			zend_string_release(key);
 		} else {
 			zend_hash_index_add(output, idx, &entry_tmp);
 		}

ext/mbstring/php_mbregex.c

@@ -448,13 +448,18 @@ static php_mb_regex_t *php_mbregex_compile_pattern(const char *pattern, int patl
 	OnigErrorInfo err_info;
 	OnigUChar err_str[ONIG_MAX_ERROR_MESSAGE_LEN];
 
+	if (!php_mb_check_encoding(pattern, patlen, _php_mb_regex_mbctype2name(enc))) {
+		php_error_docref(NULL, E_WARNING,
+			"Pattern is not valid under %s encoding", _php_mb_regex_mbctype2name(enc));
+		return NULL;
+	}
+
 	rc = zend_hash_str_find_ptr(&MBREX(ht_rc), (char *)pattern, patlen);
 	if (!rc || onig_get_options(rc) != options || onig_get_encoding(rc) != enc || onig_get_syntax(rc) != syntax) {
 		if ((err_code = onig_new(&retval, (OnigUChar *)pattern, (OnigUChar *)(pattern + patlen), options, enc, syntax, &err_info)) != ONIG_NORMAL) {
 			onig_error_code_to_str(err_str, err_code, &err_info);
 			php_error_docref(NULL, E_WARNING, "mbregex compile err: %s", err_str);
-			retval = NULL;
-			goto out;
+			return NULL;
 		}
 		if (rc == MBREX(search_re)) {
 			/* reuse the new rc? see bug #72399 */
@@ -464,7 +469,6 @@ static php_mb_regex_t *php_mbregex_compile_pattern(const char *pattern, int patl
 	} else {
 		retval = rc;
 	}
-out:
 	return retval;
 }
 /* }}} */
@@ -1107,6 +1111,11 @@ PHP_FUNCTION(mb_split)
 		count--;
 	}
 
+	if (!php_mb_check_encoding(string, string_len,
+			_php_mb_regex_mbctype2name(MBREX(current_mbctype)))) {
+		RETURN_FALSE;
+	}
+
 	/* create regex pattern buffer */
 	if ((re = php_mbregex_compile_pattern(arg_pattern, arg_pattern_len, MBREX(regex_default_options), MBREX(current_mbctype), MBREX(regex_default_syntax))) == NULL) {
 		RETURN_FALSE;
@@ -1196,6 +1205,11 @@ PHP_FUNCTION(mb_ereg_match)
 		}
 	}
 
+	if (!php_mb_check_encoding(string, string_len,
+			_php_mb_regex_mbctype2name(MBREX(current_mbctype)))) {
+		RETURN_FALSE;
+	}
+
 	if ((re = php_mbregex_compile_pattern(arg_pattern, arg_pattern_len, option, MBREX(current_mbctype), syntax)) == NULL) {
 		RETURN_FALSE;
 	}

ext/mbstring/tests/bug43301.phpt

@@ -1,7 +1,10 @@
 --TEST--
 Bug #43301 (mb_ereg*_replace() crashes when replacement string is invalid PHP expression and 'e' option is used)
 --SKIPIF--
-<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+<?php
+if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
+if (!function_exists('mb_ereg_replace')) die('skip mb_ereg_replace() not available');
+?>
 --FILE--
 <?php
 

ext/mbstring/tests/bug69151.phpt

@@ -1,7 +1,10 @@
 --TEST--
 Bug #69151 (mb_ereg should reject ill-formed byte sequence)
 --SKIPIF--
-<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+<?php
+if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
+if (!function_exists('mb_ereg')) die('skip mb_ereg() not available');
+?>
 --FILE--
 <?php
 $str = "\x80";

ext/mbstring/tests/bug72164.phpt

@@ -1,7 +1,10 @@
 --TEST--
 Bug #72164 (Null Pointer Dereference - mb_ereg_replace)
 --SKIPIF--
-<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+<?php
+if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
+if (!function_exists('mb_ereg_replace')) die('skip mb_ereg_replace() not available');
+?>
 --FILE--
 <?php
 $var0 = "e";

ext/mbstring/tests/bug72399.phpt

@@ -1,5 +1,10 @@
 --TEST--
 Bug #72399 (Use-After-Free in MBString (search_re))
+--SKIPIF--
+<?php
+if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
+if (!function_exists('mb_ereg_replace')) die('skip mb_ereg_replace() not available');
+?>
 --FILE--
 <?php
 $var5 = mbereg_search_init("","2");

ext/mbstring/tests/bug72402.phpt

@@ -1,7 +1,10 @@
 --TEST--
 Bug #72402: _php_mb_regex_ereg_replace_exec - double free
 --SKIPIF--
-<?php extension_loaded('mbstring') or die('skip mbstring not available'); ?>
+<?php
+if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
+if (!function_exists('mb_ereg_replace_callback')) die('skip mb_ereg_replace_callback() not available');
+?>
 --FILE--
 <?php
 function throwit() {

ext/mbstring/tests/bug72691.phpt

@@ -2,7 +2,8 @@
 Bug #72691 (mb_ereg_search raises a warning if a match zero-width)
 --SKIPIF--
 <?php
-if (!extension_loaded('mbstring')) die('skip ext/mbstring required');
+if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
+if (!function_exists('mb_ereg_search_init')) die('skip mb_ereg_search_init() not available');
 ?>
 --FILE--
 <?php

ext/mbstring/tests/bug72693.phpt

@@ -2,7 +2,8 @@
 Bug #72693 (mb_ereg_search increments search position when a match zero-width)
 --SKIPIF--
 <?php
-if (!extension_loaded('mbstring')) die('skip ext/mbstring required');
+if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
+if (!function_exists('mb_ereg_search_init')) die('skip mb_ereg_search_init() not available');
 ?>
 --FILE--
 <?php