Prepare PHP 7.3.12

* PHP-7.2:
  Bump for 7.2.26-dev

.appveyor.yml

@@ -16,7 +16,7 @@ environment:
         PHP_BUILD_CACHE_BASE_DIR: c:\build-cache
         PHP_BUILD_OBJ_DIR: c:\obj
         PHP_BUILD_CACHE_SDK_DIR: c:\build-cache\sdk
-        PHP_BUILD_SDK_BRANCH: php-sdk-2.2.0beta6
+        PHP_BUILD_SDK_BRANCH: php-sdk-2.2.0
         PHP_BUILD_CRT: vc15
         # ext and env setup for tests
         #MYSQL_TEST_PASSWD: Password12!

NEWS

@@ -1,10 +1,145 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? ????, PHP 7.3.9
+21 Nov 2019, PHP 7.3.12
+
+- Core:
+  . Fixed bug #78658 (Memory corruption using Closure::bindTo). (Nikita)
+  . Fixed bug #78656 (Parse errors classified as highest log-level). (Erik
+    Lundin)
+  . Fixed bug #78752 (Segfault if GC triggered while generator stack frame is
+    being destroyed). (Nikita)
+  . Fixed bug #78689 (Closure::fromCallable() doesn't handle
+    [Closure, '__invoke']). (Nikita)
+
+- COM:
+  . Fixed bug #78694 (Appending to a variant array causes segfault). (cmb)
+
+- Date:
+  . Fixed bug #70153 (\DateInterval incorrectly unserialized). (Maksim Iakunin)
+  . Fixed bug #78751 (Serialising DatePeriod converts DateTimeImmutable). (cmb)
+
+- Iconv:
+  . Fixed bug #78642 (Wrong libiconv version displayed). (gedas at martynas,
+    cmb).
+
+- OpCache:
+  . Fixed bug #78654 (Incorrectly computed opcache checksum on files with 
+    non-ascii characters). (mhagstrand)
+  . Fixed bug #78747 (OpCache corrupts custom extension result). (Nikita)
+
+- OpenSSL:
+  . Fixed bug #78775 (TLS issues from HTTP request affecting other encrypted
+    connections). (Nikita)
+
+- Reflection:
+  . Fixed bug #78697 (ReflectionClass::ImplementsInterface - inaccurate error 
+    message with traits). (villfa)
+
+- Sockets:
+  . Fixed bug #78665 (Multicasting may leak memory). (cmb)
+
+24 Oct 2019, PHP 7.3.11
+
+- Core:
+  . Fixed bug #78535 (auto_detect_line_endings value not parsed as bool).
+    (bugreportuser)
+  . Fixed bug #78620 (Out of memory error). (cmb, Nikita)
+
+- Exif :
+  . Fixed bug #78442 ('Illegal component' on exif_read_data since PHP7)
+	(Kalle)
+
+- FPM:
+  . Fixed bug #78599 (env_path_info underflow in fpm_main.c can lead to RCE).
+    (CVE-2019-11043) (Jakub Zelenka)
+  . Fixed bug #78413 (request_terminate_timeout does not take effect after
+    fastcgi_finish_request). (Sergei Turchanov)
+
+- MBString:
+  . Fixed bug #78633 (Heap buffer overflow (read) in mb_eregi). (cmb)
+  . Fixed bug #78579 (mb_decode_numericentity: args number inconsistency).
+    (cmb)
+  . Fixed bug #78609 (mb_check_encoding() no longer supports stringable
+    objects). (cmb)
+
+- MySQLi:
+  . Fixed bug #76809 (SSL settings aren't respected when persistent connections 
+    are used). (fabiomsouto)
+
+- Mysqlnd:
+  . Fixed bug #78525 (Memory leak in pdo when reusing native prepared
+    statements). (Nikita)
+
+- PCRE:
+  . Fixed bug #78272 (calling preg_match() before pcntl_fork() will freeze
+    child process). (Nikita)
+
+- PDO_MySQL:
+  . Fixed bug #78623 (Regression caused by "SP call yields additional empty
+    result set"). (cmb)
+
+- Session:
+  . Fixed bug #78624 (session_gc return value for user defined session 
+    handlers). (bshaffer)
+
+- Standard:
+  . Fixed bug #76342 (file_get_contents waits twice specified timeout).
+    (Thomas Calvet)
+  . Fixed bug #78612 (strtr leaks memory when integer keys are used and the
+    subject string shorter). (Nikita)
+  . Fixed bug #76859 (stream_get_line skips data if used with data-generating 
+    filter). (kkopachev)
+
+- Zip:
+  . Fixed bug #78641 (addGlob can modify given remove_path value). (cmb)
+
+26 Sep 2019, PHP 7.3.10
+
+- Core:
+  . Fixed bug #78220 (Can't access OneDrive folder). (cmb, ab)
+  . Fixed bug #77922 (Double release of doc comment on inherited shadow
+    property). (Nikita)
+  . Fixed bug #78441 (Parse error due to heredoc identifier followed by digit).
+    (cmb)
+  . Fixed bug #77812 (Interactive mode does not support PHP 7.3-style heredoc).
+    (cmb, Nikita)
+
+- FastCGI:
+  . Fixed bug #78469 (FastCGI on_accept hook is not called when using named
+    pipes on Windows). (Sergei Turchanov)
+
+- FPM:
+  . Fixed bug #78334 (fpm log prefix message includes wrong stdout/stderr
+    notation). (Tsuyoshi Sadakata)
+
+- Intl:
+  . Ensure IDNA2003 rules are used with idn_to_ascii() and idn_to_utf8()
+    when requested. (Sara)
+
+- MBString:
+  . Fixed bug #78559 (Heap buffer overflow in mb_eregi). (cmb)
+
+- MySQLnd:
+  . Fixed connect_attr issues and added the _server_host connection attribute.
+    (Qianqian Bu)
+
+- ODBC:
+  . Fixed bug #78473 (odbc_close() closes arbitrary resources). (cmb)
+
+- PDO_MySQL:
+  . Fixed bug #41997 (SP call yields additional empty result set). (cmb)
+
+- sodium:
+  . Fixed bug #78510 (Partially uninitialized buffer returned by
+    sodium_crypto_generichash_init()). (Frank Denis, cmb)
+
+29 Aug 2019, PHP 7.3.9
 
 - Core:
   . Fixed bug #78363 (Buffer overflow in zendparse). (Nikita)
   . Fixed bug #78379 (Cast to object confuses GC, causes crash). (Dmitry)
+  . Fixed bug #78412 (Generator incorrectly reports non-releasable $this as GC
+    child). (Nikita)
 
 - Curl:
   . Fixed bug #77946 (Bad cURL resources returned by curl_multi_info_read()).
@@ -25,6 +160,9 @@ PHP                                                                        NEWS
 - LiteSpeed:
   . Updated to LiteSpeed SAPI V7.5 (Fixed clean shutdown). (George Wang)
 
+- MBString:
+  . Fixed bug #78380 (Oniguruma 6.9.3 fixes CVEs). (CVE-2019-13224) (Stas)
+
 - MySQLnd:
   . Fixed bug #78179 (MariaDB server version incorrectly detected). (cmb)
   . Fixed bug #78213 (Empty row pocket). (cmb)
@@ -161,6 +299,10 @@ PHP                                                                        NEWS
   . Implemented FR #72189 (Add missing CURL_VERSION_* constants). (Javier
     Spagnoletti)
 
+- Date:
+  . Fixed bug #77909 (DatePeriod::__construct() with invalid recurrence count
+    value). (Ignace Nyamagana Butera)
+
 - EXIF:
   . Fixed bug #77988 (heap-buffer-overflow on php_jpg_get16).
     (CVE-2019-11040) (Stas)

UPGRADING

@@ -273,6 +273,10 @@ FPM:
     disabling output decoration for workers output when catch_workers_output
     enabled.
   . The getallheaders() function is now also available.
+  . In PHP 7.3.11 a new pool option
+    request_terminate_timeout_track_finished has been added. When enabled,
+    request_terminate_timeout will also apply after fastcgi_finish_request()
+    has been called, as well as during execution of shutdown functions.
 
 ========================================
 4. Deprecated Functionality

Zend/tests/assert/expect_015.phpt

@@ -140,6 +140,7 @@ assert(0 && ($a = function () {
     if ($a) {
     } elseif ($b) {
     }
+    if ($a); else;
 }));
 
 ?>
@@ -292,4 +293,7 @@ Warning: assert(): assert(0 && ($a = function () {
     if ($a) {
     } elseif ($b) {
     }
+    if ($a) {
+    } else {
+    }
 })) failed in %sexpect_015.php on line %d

Zend/tests/bug77922.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Bug #77922: Double release of doc comment on inherited shadow property
+--FILE--
+<?php
+
+class A {
+    /** Foo */
+    private $prop;
+}
+
+class B extends A {
+}
+
+class C extends B {
+}
+
+?>
+===DONE===
+--EXPECT--
+===DONE===

Zend/tests/bug78658.phpt

@@ -0,0 +1,14 @@
+--TEST--
+Bug #78658: Memory corruption using Closure::bindTo()
+--FILE--
+<?php
+
+$c = function(){};
+
+$scope = "AAAA";
+$scope = "{$scope}BBBB";
+$c->bindTo(new stdClass, $scope);
+
+?>
+--EXPECTF--
+Warning: Class 'AAAABBBB' not found in %s on line %d

Zend/tests/bug78689.phpt

@@ -0,0 +1,13 @@
+--TEST--
+Bug #78689: Closure::fromCallable() doesn't handle [Closure, '__invoke']
+--FILE--
+<?php
+$a = [function () { echo "123\n"; }, '__invoke'];
+$a();
+
+$b = Closure::fromCallable($a);
+$b();
+?>
+--EXPECT--
+123
+123

Zend/tests/bug78752.phpt

@@ -0,0 +1,24 @@
+--TEST--
+Bug #78752: Segfault if GC triggered while generator stack frame is being destroyed
+--FILE--
+<?php
+
+function gen(&$gen) {
+    $a = new stdClass;
+    $a->a = $a;
+    $b = new stdClass;
+    $b->b = $b;
+    yield 1;
+}
+
+$gen = gen($gen);
+var_dump($gen->current());
+for ($i = 0; $i < 9999; $i++) {
+    $a = new stdClass;
+    $a->a = $a;
+}
+$gen->next();
+
+?>
+--EXPECT--
+int(1)

Zend/tests/closure_extra_args.phpt

@@ -0,0 +1,11 @@
+--TEST--
+Immediately invoked closure with extra args
+--FILE--
+<?php
+
+(function() {})(new stdClass);
+
+?>
+===DONE===
+--EXPECT--
+===DONE===

Zend/tests/gc_042.phpt

@@ -0,0 +1,28 @@
+--TEST--
+Object properties HT may need to be removed from nested data
+--FILE--
+<?php
+
+class Test {
+    public function __destruct() {
+        $GLOBALS['x'] = $this;
+    }
+}
+
+$t = new Test;
+$t->x = new stdClass;
+$t->x->t = $t;
+$a = (array) $t->x;
+unset($t, $a);
+gc_collect_cycles();
+var_dump($x);
+
+?>
+--EXPECT--
+object(Test)#1 (1) {
+  ["x"]=>
+  object(stdClass)#2 (1) {
+    ["t"]=>
+    *RECURSION*
+  }
+}

Zend/tests/grammar/bug78441.phpt

@@ -0,0 +1,24 @@
+--TEST--
+Bug #78441 (Parse error due to heredoc identifier followed by digit)
+--FILE--
+<?php
+echo <<<FOO
+FOO4
+FOO, PHP_EOL;
+
+echo <<<FOO
+bar
+FOO4
+FOO, PHP_EOL;
+
+echo <<<'FOO'
+bar
+FOO4
+FOO, PHP_EOL;
+?>
+--EXPECT--
+FOO4
+bar
+FOO4
+bar
+FOO4

Zend/tests/halt_compiler5.phpt

@@ -0,0 +1,8 @@
+--TEST--
+Using __COMPILER_HALF_OFFSET__ with trailing {} (OSS-Fuzz #17895)
+--FILE--
+<?php
+__COMPILER_HALT_OFFSET__;
+{}
+--EXPECTF--
+Warning: Use of undefined constant __COMPILER_HALT_OFFSET__ - assumed '__COMPILER_HALT_OFFSET__' (this will throw an Error in a future version of PHP) in %s on line %d

Zend/tests/pow_array_leak.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Memory leak on ** with result==op1 array
+--FILE--
+<?php
+
+$x = [0];
+$x **= 1;
+var_dump($x);
+
+$x = [0];
+$x **= $x;
+var_dump($x);
+
+?>
+--EXPECT--
+int(0)
+int(0)

Zend/tests/static_method_non_existing_class.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Calling a static method on a non-existing class
+--FILE--
+<?php
+
+$str = "foo";
+try {
+    Test::{$str . "bar"}();
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+Class 'Test' not found

Zend/tests/warning_during_heredoc_scan_ahead.phpt

@@ -0,0 +1,20 @@
+--TEST--
+No warnings should be thrown during heredoc scan-ahead
+--FILE--
+<?php
+
+<<<TEST
+${x
}
+\400
+${/*}
+TEST;
+
+?>
+--EXPECTF--
+Warning: Unexpected character in input:  '
' (ASCII=1) state=0 in %s on line %d
+
+Warning: Octal escape sequence overflow \400 is greater than \377 in %s on line %d
+
+Warning: Unterminated comment starting line %d in %s on line %d
+
+Parse error: syntax error, unexpected end of file in %s on line %d

Zend/zend.h

@@ -20,7 +20,7 @@
 #ifndef ZEND_H
 #define ZEND_H
 
-#define ZEND_VERSION "3.3.9-dev"
+#define ZEND_VERSION "3.3.12"
 
 #define ZEND_ENGINE_3
 

Zend/zend_alloc.c

@@ -982,7 +982,7 @@ get_chunk:
 				heap->cached_chunks = chunk->next;
 			} else {
 #if ZEND_MM_LIMIT
-				if (UNEXPECTED(heap->real_size + ZEND_MM_CHUNK_SIZE > heap->limit)) {
+				if (UNEXPECTED(ZEND_MM_CHUNK_SIZE > heap->limit - heap->real_size)) {
 					if (zend_mm_gc(heap)) {
 						goto get_chunk;
 					} else if (heap->overflow == 0) {
@@ -1510,8 +1510,8 @@ static zend_never_inline void *zend_mm_realloc_huge(zend_mm_heap *heap, void *pt
 			}
 		} else /* if (new_size > old_size) */ {
 #if ZEND_MM_LIMIT
-			if (UNEXPECTED(heap->real_size + (new_size - old_size) > heap->limit)) {
-				if (zend_mm_gc(heap) && heap->real_size + (new_size - old_size) <= heap->limit) {
+			if (UNEXPECTED(new_size - old_size > heap->limit - heap->real_size)) {
+				if (zend_mm_gc(heap) && new_size - old_size <= heap->limit - heap->real_size) {
 					/* pass */
 				} else if (heap->overflow == 0) {
 #if ZEND_DEBUG
@@ -1792,15 +1792,20 @@ static void *zend_mm_alloc_huge(zend_mm_heap *heap, size_t size ZEND_FILE_LINE_D
 	 * We allocate them with 2MB size granularity, to avoid many
 	 * reallocations when they are extended by small pieces
 	 */
-	size_t new_size = ZEND_MM_ALIGNED_SIZE_EX(size, MAX(REAL_PAGE_SIZE, ZEND_MM_CHUNK_SIZE));
+	size_t alignment = MAX(REAL_PAGE_SIZE, ZEND_MM_CHUNK_SIZE);
 #else
-	size_t new_size = ZEND_MM_ALIGNED_SIZE_EX(size, REAL_PAGE_SIZE);
+	size_t alignment = REAL_PAGE_SIZE;
 #endif
+	size_t new_size = ZEND_MM_ALIGNED_SIZE_EX(size, alignment);
 	void *ptr;
 
+	if (UNEXPECTED(new_size < size)) {
+		zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu + %zu)", size, alignment);
+	}
+
 #if ZEND_MM_LIMIT
-	if (UNEXPECTED(heap->real_size + new_size > heap->limit)) {
-		if (zend_mm_gc(heap) && heap->real_size + new_size <= heap->limit) {
+	if (UNEXPECTED(new_size > heap->limit - heap->real_size)) {
+		if (zend_mm_gc(heap) && new_size <= heap->limit - heap->real_size) {
 			/* pass */
 		} else if (heap->overflow == 0) {
 #if ZEND_DEBUG

Zend/zend_ast.c

@@ -1158,7 +1158,7 @@ tail_call:
 		} else {
 			zend_ast_export_indent(str, indent);
 			smart_str_appends(str, "} else ");
-			if (ast->child[1]->kind == ZEND_AST_IF) {
+			if (ast->child[1] && ast->child[1]->kind == ZEND_AST_IF) {
 				list = (zend_ast_list*)ast->child[1];
 				goto tail_call;
 			} else {

Zend/zend_closures.c

@@ -200,7 +200,7 @@ ZEND_METHOD(Closure, bind)
 				ce = closure->func.common.scope;
 			} else if ((ce = zend_lookup_class_ex(class_name, NULL, 1)) == NULL) {
 				zend_error(E_WARNING, "Class '%s' not found", ZSTR_VAL(class_name));
-				zend_string_release_ex(class_name, 0);
+				zend_tmp_string_release(tmp_class_name);
 				RETURN_NULL();
 			}
 			zend_tmp_string_release(tmp_class_name);
@@ -268,8 +268,16 @@ static int zend_create_closure_from_callable(zval *return_value, zval *callable,
 
 	mptr = fcc.function_handler;
 	if (mptr->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
-		memset(&call, 0, sizeof(zend_internal_function));
+		/* For Closure::fromCallable([$closure, "__invoke"]) return $closure. */
+		if (fcc.object && fcc.object->ce == zend_ce_closure
+				&& zend_string_equals_literal(mptr->common.function_name, "__invoke")) {
+			ZVAL_OBJ(return_value, fcc.object);
+			GC_ADDREF(fcc.object);
+			zend_free_trampoline(mptr);
+			return SUCCESS;
+		}
 
+		memset(&call, 0, sizeof(zend_internal_function));
 		call.type = ZEND_INTERNAL_FUNCTION;
 		call.fn_flags = mptr->common.fn_flags & ZEND_ACC_STATIC;
 		call.handler = zend_closure_call_magic;

Zend/zend_compile.c

@@ -1693,13 +1693,17 @@ ZEND_API void zend_activate_auto_globals(void) /* {{{ */
 int ZEND_FASTCALL zendlex(zend_parser_stack_elem *elem) /* {{{ */
 {
 	zval zv;
+	int ret;
 
 	if (CG(increment_lineno)) {
 		CG(zend_lineno)++;
 		CG(increment_lineno) = 0;
 	}
 
-	return lex_scan(&zv, elem);
+	ret = lex_scan(&zv, elem);
+	ZEND_ASSERT(!EG(exception) || ret == T_ERROR);
+	return ret;
+
 }
 /* }}} */
 
@@ -7764,6 +7768,9 @@ void zend_compile_const(znode *result, zend_ast *ast) /* {{{ */
 
 		while (last && last->kind == ZEND_AST_STMT_LIST) {
 			zend_ast_list *list = zend_ast_get_list(last);
+			if (list->children == 0) {
+				break;
+			}
 			last = list->child[list->children-1];
 		}
 		if (last && last->kind == ZEND_AST_HALT_COMPILER) {

Zend/zend_gc.c

@@ -1400,6 +1400,10 @@ tail_call:
 					ref = Z_COUNTED_P(zv);
 					goto tail_call;
 				}
+				if (GC_REF_ADDRESS(ht) != 0 && GC_REF_CHECK_COLOR(ht, GC_BLACK)) {
+					GC_TRACE_REF(ht, "removing from buffer");
+					GC_REMOVE_FROM_BUFFER(ht);
+				}
 			} else {
 				return;
 			}

Zend/zend_generators.c

@@ -96,16 +96,18 @@ ZEND_API zend_execute_data* zend_generator_freeze_call_stack(zend_execute_data *
 /* }}} */
 
 static void zend_generator_cleanup_unfinished_execution(
-		zend_generator *generator, uint32_t catch_op_num) /* {{{ */
+		zend_generator *generator, zend_execute_data *execute_data, uint32_t catch_op_num) /* {{{ */
 {
-	zend_execute_data *execute_data = generator->execute_data;
-
 	if (execute_data->opline != execute_data->func->op_array.opcodes) {
 		/* -1 required because we want the last run opcode, not the next to-be-run one. */
 		uint32_t op_num = execute_data->opline - execute_data->func->op_array.opcodes - 1;
 
 		if (UNEXPECTED(generator->frozen_call_stack)) {
+			/* Temporarily restore generator->execute_data if it has been NULLed out already. */
+			zend_execute_data *save_ex = generator->execute_data;
+			generator->execute_data = execute_data;
 			zend_generator_restore_call_stack(generator);
+			generator->execute_data = save_ex;
 		}
 		zend_cleanup_unfinished_execution(execute_data, op_num, catch_op_num);
 	}
@@ -116,6 +118,9 @@ ZEND_API void zend_generator_close(zend_generator *generator, zend_bool finished
 {
 	if (EXPECTED(generator->execute_data)) {
 		zend_execute_data *execute_data = generator->execute_data;
+		/* Null out execute_data early, to prevent double frees if GC runs while we're
+		 * already cleaning up execute_data. */
+		generator->execute_data = NULL;
 
 		if (EX_CALL_INFO() & ZEND_CALL_HAS_SYMBOL_TABLE) {
 			zend_clean_and_cache_symbol_table(execute_data->symbol_table);
@@ -134,12 +139,12 @@ ZEND_API void zend_generator_close(zend_generator *generator, zend_bool finished
 			return;
 		}
 
-		zend_vm_stack_free_extra_args(generator->execute_data);
+		zend_vm_stack_free_extra_args(execute_data);
 
 		/* Some cleanups are only necessary if the generator was closed
 		 * before it could finish execution (reach a return statement). */
 		if (UNEXPECTED(!finished_execution)) {
-			zend_generator_cleanup_unfinished_execution(generator, 0);
+			zend_generator_cleanup_unfinished_execution(generator, execute_data, 0);
 		}
 
 		/* Free closure object */
@@ -153,8 +158,7 @@ ZEND_API void zend_generator_close(zend_generator *generator, zend_bool finished
 			generator->gc_buffer = NULL;
 		}
 
-		efree(generator->execute_data);
-		generator->execute_data = NULL;
+		efree(execute_data);
 	}
 }
 /* }}} */
@@ -215,7 +219,7 @@ static void zend_generator_dtor_storage(zend_object *object) /* {{{ */
 	if (finally_op_num) {
 		zval *fast_call;
 
-		zend_generator_cleanup_unfinished_execution(generator, finally_op_num);
+		zend_generator_cleanup_unfinished_execution(generator, ex, finally_op_num);
 
 		fast_call = ZEND_CALL_VAR(ex, ex->func->op_array.opcodes[finally_op_end].op1.var);
 		Z_OBJ_P(fast_call) = EG(exception);
@@ -271,7 +275,7 @@ static uint32_t calc_gc_buffer_size(zend_generator *generator) /* {{{ */
 		if (EX_CALL_INFO() & ZEND_CALL_FREE_EXTRA_ARGS) {
 			size += EX_NUM_ARGS() - op_array->num_args;
 		}
-		size += Z_TYPE(execute_data->This) == IS_OBJECT; /* $this */
+		size += (EX_CALL_INFO() & ZEND_CALL_RELEASE_THIS) != 0; /* $this */
 		size += (EX_CALL_INFO() & ZEND_CALL_CLOSURE) != 0; /* Closure object */
 
 		/* Live vars */
@@ -352,7 +356,7 @@ static HashTable *zend_generator_get_gc(zval *object, zval **table, int *n) /* {
 		}
 	}
 
-	if (Z_TYPE(execute_data->This) == IS_OBJECT) {
+	if (EX_CALL_INFO() & ZEND_CALL_RELEASE_THIS) {
 		ZVAL_OBJ(gc_buffer++, Z_OBJ(execute_data->This));
 	}
 	if (EX_CALL_INFO() & ZEND_CALL_CLOSURE) {

Zend/zend_language_scanner.l

@@ -115,6 +115,7 @@ do {																			\
 #define GET_DOUBLE_QUOTES_SCANNED_LENGTH()    SCNG(scanned_string_len)
 
 #define IS_LABEL_START(c) (((c) >= 'a' && (c) <= 'z') || ((c) >= 'A' && (c) <= 'Z') || (c) == '_' || (c) >= 0x80)
+#define IS_LABEL_SUCCESSOR(c) (((c) >= 'a' && (c) <= 'z') || ((c) >= 'A' && (c) <= 'Z') || ((c) >= '0' && (c) <= '9') || (c) == '_' || (c) >= 0x80)
 
 #define ZEND_IS_OCT(c)  ((c)>='0' && (c)<='7')
 #define ZEND_IS_HEX(c)  (((c)>='0' && (c)<='9') || ((c)>='a' && (c)<='f') || ((c)>='A' && (c)<='F'))
@@ -2097,7 +2098,7 @@ inline_char_handler:
 
 	if (YYCURSOR < YYLIMIT) {
 		YYCURSOR++;
-	} else {
+	} else if (!SCNG(heredoc_scan_ahead)) {
 		zend_error(E_COMPILE_WARNING, "Unterminated comment starting line %d", CG(zend_lineno));
 	}
 
@@ -2319,9 +2320,12 @@ skip_escape_conversion:
 
 	/* Check for ending label on the next line */
 	if (heredoc_label->length < YYLIMIT - YYCURSOR && !memcmp(YYCURSOR, s, heredoc_label->length)) {
-		if (!IS_LABEL_START(YYCURSOR[heredoc_label->length])) {
+		if (!IS_LABEL_SUCCESSOR(YYCURSOR[heredoc_label->length])) {
 			if (spacing == (HEREDOC_USING_SPACES | HEREDOC_USING_TABS)) {
 				zend_throw_exception(zend_ce_parse_error, "Invalid indentation - tabs and spaces cannot be mixed", 0);
+				if (PARSER_MODE()) {
+					RETURN_TOKEN(T_ERROR);
+				}
 			}
 
 			YYCURSOR = saved_cursor;
@@ -2338,6 +2342,7 @@ skip_escape_conversion:
 		zend_lex_state current_state;
 		int heredoc_nesting_level = 1;
 		int first_token = 0;
+		int error = 0;
 
 		zend_save_lexical_state(&current_state);
 
@@ -2385,6 +2390,7 @@ skip_escape_conversion:
 		     || first_token == T_CURLY_OPEN
 		    ) && SCNG(heredoc_indentation)) {
 			zend_throw_exception_ex(zend_ce_parse_error, 0, "Invalid body indentation level (expecting an indentation level of at least %d)", SCNG(heredoc_indentation));
+			error = 1;
 		}
 
 		heredoc_label->indentation = SCNG(heredoc_indentation);
@@ -2393,6 +2399,10 @@ skip_escape_conversion:
 		zend_restore_lexical_state(&current_state);
 		SCNG(heredoc_scan_ahead) = 0;
 		CG(increment_lineno) = 0;
+
+		if (PARSER_MODE() && error) {
+			RETURN_TOKEN(T_ERROR);
+		}
 	}
 
 	RETURN_TOKEN(T_START_HEREDOC);
@@ -2576,12 +2586,15 @@ double_quotes_scan_done:
 
 				/* Check for ending label on the next line */
 				if (IS_LABEL_START(*YYCURSOR) && heredoc_label->length < YYLIMIT - YYCURSOR && !memcmp(YYCURSOR, heredoc_label->label, heredoc_label->length)) {
-					if (IS_LABEL_START(YYCURSOR[heredoc_label->length])) {
+					if (IS_LABEL_SUCCESSOR(YYCURSOR[heredoc_label->length])) {
 						continue;
 					}
 
 					if (spacing == (HEREDOC_USING_SPACES | HEREDOC_USING_TABS)) {
 						zend_throw_exception(zend_ce_parse_error, "Invalid indentation - tabs and spaces cannot be mixed", 0);
+						if (PARSER_MODE()) {
+							RETURN_TOKEN(T_ERROR);
+						}
 					}
 
 					/* newline before label will be subtracted from returned text, but
@@ -2697,12 +2710,15 @@ heredoc_scan_done:
 
 				/* Check for ending label on the next line */
 				if (IS_LABEL_START(*YYCURSOR) && heredoc_label->length < YYLIMIT - YYCURSOR && !memcmp(YYCURSOR, heredoc_label->label, heredoc_label->length)) {
-					if (IS_LABEL_START(YYCURSOR[heredoc_label->length])) {
+					if (IS_LABEL_SUCCESSOR(YYCURSOR[heredoc_label->length])) {
 						continue;
 					}
 
 					if (spacing == (HEREDOC_USING_SPACES | HEREDOC_USING_TABS)) {
 						zend_throw_exception(zend_ce_parse_error, "Invalid indentation - tabs and spaces cannot be mixed", 0);
+						if (PARSER_MODE()) {
+							RETURN_TOKEN(T_ERROR);
+						}
 					}
 
 					/* newline before label will be subtracted from returned text, but
@@ -2751,7 +2767,9 @@ nowdoc_scan_done:
 		RETURN_TOKEN(END);
 	}
 
-	zend_error(E_COMPILE_WARNING,"Unexpected character in input:  '%c' (ASCII=%d) state=%d", yytext[0], yytext[0], YYSTATE);
+	if (!SCNG(heredoc_scan_ahead)) {
+		zend_error(E_COMPILE_WARNING, "Unexpected character in input:  '%c' (ASCII=%d) state=%d", yytext[0], yytext[0], YYSTATE);
+	}
 	goto restart;
 }
 

Zend/zend_opcode.c

@@ -235,7 +235,8 @@ ZEND_API void destroy_zend_class(zval *zv)
 				efree(ce->default_static_members_table);
 			}
 			ZEND_HASH_FOREACH_PTR(&ce->properties_info, prop_info) {
-				if (prop_info->ce == ce || (prop_info->flags & ZEND_ACC_SHADOW)) {
+				if (prop_info->ce == ce ||
+						((prop_info->flags & ZEND_ACC_SHADOW) && prop_info->ce == ce->parent)) {
 					zend_string_release_ex(prop_info->name, 0);
 					if (prop_info->doc_comment) {
 						zend_string_release_ex(prop_info->doc_comment, 0);

Zend/zend_operators.c

@@ -1193,12 +1193,18 @@ ZEND_API int ZEND_FASTCALL pow_function(zval *result, zval *op1, zval *op2) /* {
 
 				if (EXPECTED(op1 != op2)) {
 					if (Z_TYPE_P(op1) == IS_ARRAY) {
+						if (op1 == result) {
+							zval_ptr_dtor(result);
+						}
 						ZVAL_LONG(result, 0);
 						return SUCCESS;
 					} else {
 						op1 = zendi_convert_scalar_to_number(op1, &op1_copy, result, 0);
 					}
 					if (Z_TYPE_P(op2) == IS_ARRAY) {
+						if (op1 == result) {
+							zval_ptr_dtor(result);
+						}
 						ZVAL_LONG(result, 1L);
 						return SUCCESS;
 					} else {
@@ -1206,6 +1212,9 @@ ZEND_API int ZEND_FASTCALL pow_function(zval *result, zval *op1, zval *op2) /* {
 					}
 				} else {
 					if (Z_TYPE_P(op1) == IS_ARRAY) {
+						if (op1 == result) {
+							zval_ptr_dtor(result);
+						}
 						ZVAL_LONG(result, 0);
 						return SUCCESS;
 					} else {

Zend/zend_operators.h

@@ -90,10 +90,10 @@ ZEND_API const char* ZEND_FASTCALL zend_memnstr_ex(const char *haystack, const c
 ZEND_API const char* ZEND_FASTCALL zend_memnrstr_ex(const char *haystack, const char *needle, size_t needle_len, const char *end);
 
 #if SIZEOF_ZEND_LONG == 4
-#	define ZEND_DOUBLE_FITS_LONG(d) (!((d) > ZEND_LONG_MAX || (d) < ZEND_LONG_MIN))
+#	define ZEND_DOUBLE_FITS_LONG(d) (!((d) > (double)ZEND_LONG_MAX || (d) < (double)ZEND_LONG_MIN))
 #else
 	/* >= as (double)ZEND_LONG_MAX is outside signed range */
-#	define ZEND_DOUBLE_FITS_LONG(d) (!((d) >= ZEND_LONG_MAX || (d) < ZEND_LONG_MIN))
+#	define ZEND_DOUBLE_FITS_LONG(d) (!((d) >= (double)ZEND_LONG_MAX || (d) < (double)ZEND_LONG_MIN))
 #endif
 
 #if ZEND_DVAL_TO_LVAL_CAST_OK

Zend/zend_virtual_cwd.c

@@ -89,6 +89,8 @@ static cwd_state main_cwd_state; /* True global */
 #include <unistd.h>
 #else
 #include <direct.h>
+#include "zend_globals.h"
+#include "zend_globals_macros.h"
 #endif
 
 #define CWD_STATE_COPY(d, s)				\
@@ -857,6 +859,7 @@ static size_t tsrm_realpath_r(char *path, size_t start, size_t len, int *ll, tim
 		tmp = do_alloca(len+1, use_heap);
 		memcpy(tmp, path, len+1);
 
+retry:
 		if(save &&
 				!(IS_UNC_PATH(path, len) && len >= 3 && path[2] != '?') &&
                                (dataw.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT)
@@ -904,7 +907,21 @@ static size_t tsrm_realpath_r(char *path, size_t start, size_t len, int *ll, tim
 				return (size_t)-1;
 			}
 			if(!DeviceIoControl(hLink, FSCTL_GET_REPARSE_POINT, NULL, 0, pbuffer,  MAXIMUM_REPARSE_DATA_BUFFER_SIZE, &retlength, NULL)) {
+				BY_HANDLE_FILE_INFORMATION fileInformation;
+
 				free_alloca(pbuffer, use_heap_large);
+				if ((dataw.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT) &&
+						(dataw.dwReserved0 & ~IO_REPARSE_TAG_CLOUD_MASK) == IO_REPARSE_TAG_CLOUD &&
+						EG(windows_version_info).dwMajorVersion >= 10 &&
+						EG(windows_version_info).dwMinorVersion == 0 &&
+						EG(windows_version_info).dwBuildNumber >= 18362 &&
+						GetFileInformationByHandle(hLink, &fileInformation) &&
+						!(fileInformation.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT)) {
+					dataw.dwFileAttributes = fileInformation.dwFileAttributes;
+					CloseHandle(hLink);
+					(*ll)--;
+					goto retry;
+				}
 				free_alloca(tmp, use_heap);
 				CloseHandle(hLink);
 				FREE_PATHW()
@@ -984,8 +1001,7 @@ static size_t tsrm_realpath_r(char *path, size_t start, size_t len, int *ll, tim
 			}
 			else if (pbuffer->ReparseTag == IO_REPARSE_TAG_DEDUP ||
 					/* Starting with 1709. */
-					(pbuffer->ReparseTag & IO_REPARSE_TAG_CLOUD_MASK) != 0 && 0x90001018L != pbuffer->ReparseTag ||
-					IO_REPARSE_TAG_CLOUD == pbuffer->ReparseTag ||
+					(pbuffer->ReparseTag & ~IO_REPARSE_TAG_CLOUD_MASK) == IO_REPARSE_TAG_CLOUD ||
 					IO_REPARSE_TAG_ONEDRIVE == pbuffer->ReparseTag) {
 				isabsolute = 1;
 				substitutename = malloc((len + 1) * sizeof(char));

Zend/zend_vm_def.h

@@ -2430,6 +2430,11 @@ ZEND_VM_HOT_HELPER(zend_leave_helper, ANY, ANY)
 			zend_clean_and_cache_symbol_table(EX(symbol_table));
 		}
 		EG(current_execute_data) = EX(prev_execute_data);
+
+		/* Free extra args before releasing the closure,
+		 * as that may free the op_array. */
+		zend_vm_stack_free_extra_args_ex(call_info, execute_data);
+
 		if (UNEXPECTED(call_info & ZEND_CALL_RELEASE_THIS)) {
 			zend_object *object = Z_OBJ(execute_data->This);
 #if 0
@@ -2445,7 +2450,6 @@ ZEND_VM_HOT_HELPER(zend_leave_helper, ANY, ANY)
 			OBJ_RELEASE(ZEND_CLOSURE_OBJECT(EX(func)));
 		}
 
-		zend_vm_stack_free_extra_args_ex(call_info, execute_data);
 		old_execute_data = execute_data;
 		execute_data = EX(prev_execute_data);
 		zend_vm_stack_free_call_frame_ex(call_info, old_execute_data);
@@ -3157,6 +3161,7 @@ ZEND_VM_HANDLER(113, ZEND_INIT_STATIC_METHOD_CALL, UNUSED|CLASS_FETCH|CONST|VAR,
 			ce = zend_fetch_class_by_name(Z_STR_P(RT_CONSTANT(opline, opline->op1)), RT_CONSTANT(opline, opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+				FREE_UNFETCHED_OP2();
 				HANDLE_EXCEPTION();
 			}
 			if (OP2_TYPE != IS_CONST) {

Zend/zend_vm_execute.h

@@ -541,6 +541,11 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_leave_helper_SPEC(ZEND_OPCODE_
 			zend_clean_and_cache_symbol_table(EX(symbol_table));
 		}
 		EG(current_execute_data) = EX(prev_execute_data);
+
+		/* Free extra args before releasing the closure,
+		 * as that may free the op_array. */
+		zend_vm_stack_free_extra_args_ex(call_info, execute_data);
+
 		if (UNEXPECTED(call_info & ZEND_CALL_RELEASE_THIS)) {
 			zend_object *object = Z_OBJ(execute_data->This);
 #if 0
@@ -556,7 +561,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_leave_helper_SPEC(ZEND_OPCODE_
 			OBJ_RELEASE(ZEND_CLOSURE_OBJECT(EX(func)));
 		}
 
-		zend_vm_stack_free_extra_args_ex(call_info, execute_data);
 		old_execute_data = execute_data;
 		execute_data = EX(prev_execute_data);
 		zend_vm_stack_free_call_frame_ex(call_info, old_execute_data);
@@ -5205,6 +5209,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_C
 			ce = zend_fetch_class_by_name(Z_STR_P(RT_CONSTANT(opline, opline->op1)), RT_CONSTANT(opline, opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			if (IS_CONST != IS_CONST) {
@@ -7386,6 +7391,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_C
 			ce = zend_fetch_class_by_name(Z_STR_P(RT_CONSTANT(opline, opline->op1)), RT_CONSTANT(opline, opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+				zval_ptr_dtor_nogc(EX_VAR(opline->op2.var));
 				HANDLE_EXCEPTION();
 			}
 			if ((IS_TMP_VAR|IS_VAR) != IS_CONST) {
@@ -8619,6 +8625,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_C
 			ce = zend_fetch_class_by_name(Z_STR_P(RT_CONSTANT(opline, opline->op1)), RT_CONSTANT(opline, opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			if (IS_UNUSED != IS_CONST) {
@@ -10486,6 +10493,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_C
 			ce = zend_fetch_class_by_name(Z_STR_P(RT_CONSTANT(opline, opline->op1)), RT_CONSTANT(opline, opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			if (IS_CV != IS_CONST) {
@@ -23501,6 +23509,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_V
 			ce = zend_fetch_class_by_name(Z_STR_P(RT_CONSTANT(opline, opline->op1)), RT_CONSTANT(opline, opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			if (IS_CONST != IS_CONST) {
@@ -25815,6 +25824,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_V
 			ce = zend_fetch_class_by_name(Z_STR_P(RT_CONSTANT(opline, opline->op1)), RT_CONSTANT(opline, opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+				zval_ptr_dtor_nogc(EX_VAR(opline->op2.var));
 				HANDLE_EXCEPTION();
 			}
 			if ((IS_TMP_VAR|IS_VAR) != IS_CONST) {
@@ -27374,6 +27384,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_V
 			ce = zend_fetch_class_by_name(Z_STR_P(RT_CONSTANT(opline, opline->op1)), RT_CONSTANT(opline, opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			if (IS_UNUSED != IS_CONST) {
@@ -29812,6 +29823,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_V
 			ce = zend_fetch_class_by_name(Z_STR_P(RT_CONSTANT(opline, opline->op1)), RT_CONSTANT(opline, opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			if (IS_CV != IS_CONST) {
@@ -31914,6 +31926,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_U
 			ce = zend_fetch_class_by_name(Z_STR_P(RT_CONSTANT(opline, opline->op1)), RT_CONSTANT(opline, opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			if (IS_CONST != IS_CONST) {
@@ -33649,6 +33662,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_U
 			ce = zend_fetch_class_by_name(Z_STR_P(RT_CONSTANT(opline, opline->op1)), RT_CONSTANT(opline, opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+				zval_ptr_dtor_nogc(EX_VAR(opline->op2.var));
 				HANDLE_EXCEPTION();
 			}
 			if ((IS_TMP_VAR|IS_VAR) != IS_CONST) {
@@ -34187,6 +34201,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_U
 			ce = zend_fetch_class_by_name(Z_STR_P(RT_CONSTANT(opline, opline->op1)), RT_CONSTANT(opline, opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			if (IS_UNUSED != IS_CONST) {
@@ -36028,6 +36043,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_INIT_STATIC_METHOD_CALL_SPEC_U
 			ce = zend_fetch_class_by_name(Z_STR_P(RT_CONSTANT(opline, opline->op1)), RT_CONSTANT(opline, opline->op1) + 1, ZEND_FETCH_CLASS_DEFAULT |  ZEND_FETCH_CLASS_EXCEPTION);
 			if (UNEXPECTED(ce == NULL)) {
 				ZEND_ASSERT(EG(exception));
+
 				HANDLE_EXCEPTION();
 			}
 			if (IS_CV != IS_CONST) {
@@ -55375,6 +55391,11 @@ zend_leave_helper_SPEC_LABEL:
 			zend_clean_and_cache_symbol_table(EX(symbol_table));
 		}
 		EG(current_execute_data) = EX(prev_execute_data);
+
+		/* Free extra args before releasing the closure,
+		 * as that may free the op_array. */
+		zend_vm_stack_free_extra_args_ex(call_info, execute_data);
+
 		if (UNEXPECTED(call_info & ZEND_CALL_RELEASE_THIS)) {
 			zend_object *object = Z_OBJ(execute_data->This);
 #if 0
@@ -55390,7 +55411,6 @@ zend_leave_helper_SPEC_LABEL:
 			OBJ_RELEASE(ZEND_CLOSURE_OBJECT(EX(func)));
 		}
 
-		zend_vm_stack_free_extra_args_ex(call_info, execute_data);
 		old_execute_data = execute_data;
 		execute_data = EX(prev_execute_data);
 		zend_vm_stack_free_call_frame_ex(call_info, old_execute_data);

acinclude.m4

@@ -395,6 +395,8 @@ AC_DEFUN([PHP_EVAL_LIBLINE],[
         $2="[$]$2 -pthread"
       else
         PHP_RUN_ONCE(EXTRA_LDFLAGS, [$ac_i], [EXTRA_LDFLAGS="$EXTRA_LDFLAGS $ac_i"])
+        PHP_RUN_ONCE(EXTRA_LDFLAGS_PROGRAM, [$ac_i],
+            [EXTRA_LDFLAGS_PROGRAM="$EXTRA_LDFLAGS_PROGRAM $ac_i"])
       fi
     ;;
     -l*[)]
@@ -2179,7 +2181,7 @@ AC_DEFUN([PHP_SETUP_ICU],[
 
   dnl If pkg-config is found try using it
   if test "$PHP_ICU_DIR" = "DEFAULT" && test -x "$PKG_CONFIG" && $PKG_CONFIG --exists icu-uc icu-io icu-i18n; then
-    if $PKG_CONFIG --atleast-version=40 icu-uc; then
+    if $PKG_CONFIG --atleast-version=4.0 icu-uc; then
       found_icu=yes
       icu_version_full=`$PKG_CONFIG --modversion icu-uc`
       ac_IFS=$IFS
@@ -2191,7 +2193,8 @@ AC_DEFUN([PHP_SETUP_ICU],[
 
       ICU_LIBS=`$PKG_CONFIG --libs icu-uc icu-io icu-i18n`
       ICU_INCS=`$PKG_CONFIG --cflags-only-I icu-uc icu-io icu-i18n`
-      ICU_CXXFLAGS="-DU_USING_ICU_NAMESPACE=1"
+      ICU_CXXFLAGS=`$PKG_CONFIG --variable=CXXFLAGS icu-uc`
+      ICU_CXXFLAGS="$ICU_CXXFLAGS -DU_USING_ICU_NAMESPACE=1"
 
       AC_MSG_RESULT([found $ICU_VERSION])
 

configure.ac

@@ -107,8 +107,8 @@ int zend_sprintf(char *buffer, const char *format, ...);
 
 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=3
-PHP_RELEASE_VERSION=9
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=12
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
 

ext/com_dotnet/com_handlers.c

@@ -123,6 +123,11 @@ static void com_write_dimension(zval *object, zval *offset, zval *value)
 
 	obj = CDNO_FETCH(object);
 
+	if (offset == NULL) {
+		php_com_throw_exception(DISP_E_BADINDEX, "appending to variants is not supported");
+		return;
+	}
+
 	if (V_VT(&obj->v) == VT_DISPATCH) {
 		ZVAL_COPY_VALUE(&args[0], offset);
 		ZVAL_COPY_VALUE(&args[1], value);

ext/com_dotnet/tests/bug78694.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Bug #78694 (Appending to a variant array causes segfault)
+--SKIPIF--
+<?php
+if (!extension_loaded('com_dotnet')) die('skip com_dotnet extension not available');
+?>
+--FILE--
+<?php
+foreach ([new com('WScript.Shell'), new variant([])] as $var) {
+    try {
+        $var[] = 42;
+    } catch (com_exception $ex) {
+        var_dump($ex->getMessage());
+    }
+}
+?>
+--EXPECT--
+string(38) "appending to variants is not supported"
+string(38) "appending to variants is not supported"

ext/curl/tests/bug78775.phpt

@@ -0,0 +1,34 @@
+--TEST--
+Bug #78775: TLS issues from HTTP request affecting other encrypted connections
+--SKIPIF--
+<?php
+if (!extension_loaded('curl')) die('skip Requires curl');
+if (getenv('SKIP_ONLINE_TESTS')) die('skip Online test');
+?>
+--FILE--
+<?php
+
+$sock = fsockopen("tls://google.com", 443);
+
+var_dump($sock);
+
+$handle = curl_init('https://self-signed.badssl.com/');
+curl_setopt_array(
+    $handle,
+    [
+        CURLOPT_RETURNTRANSFER => true,
+        CURLOPT_SSL_VERIFYPEER => true,
+    ]
+);
+
+var_dump(curl_exec($handle));
+curl_close($handle);
+
+fwrite($sock, "GET / HTTP/1.0\n\n");
+var_dump(fread($sock, 8));
+
+?>
+--EXPECTF--
+resource(%d) of type (stream)
+bool(false)
+string(8) "HTTP/1.0"

ext/date/lib/dow.c

@@ -144,7 +144,7 @@ void timelib_isodate_from_date(timelib_sll y, timelib_sll m, timelib_sll d, time
 	*id = timelib_day_of_week_ex(y, m, d, 1);
 }
 
-static timelib_sll timelib_daynr_from_weeknr_ex(timelib_sll iy, timelib_sll iw, timelib_sll id, timelib_sll *y)
+timelib_sll timelib_daynr_from_weeknr(timelib_sll iy, timelib_sll iw, timelib_sll id)
 {
 	timelib_sll dow, day;
 
@@ -152,54 +152,41 @@ static timelib_sll timelib_daynr_from_weeknr_ex(timelib_sll iy, timelib_sll iw,
 	dow = timelib_day_of_week(iy, 1, 1);
 	/* then use that to figure out the offset for day 1 of week 1 */
 	day = 0 - (dow > 4 ? dow - 7 : dow);
-	/* and adjust the year to the natural year if we need to */
-	*y = (iw == 1 && day < 0 && id < dow) ? iy - 1 : iy;
 
 	/* Add weeks and days */
 	return day + ((iw - 1) * 7) + id;
 }
 
-timelib_sll timelib_daynr_from_weeknr(timelib_sll iy, timelib_sll iw, timelib_sll id)
-{
-	timelib_sll dummy_iso_year;
-
-	return timelib_daynr_from_weeknr_ex(iy, iw, id, &dummy_iso_year);
-}
-
 void timelib_date_from_isodate(timelib_sll iy, timelib_sll iw, timelib_sll id, timelib_sll *y, timelib_sll *m, timelib_sll *d)
 {
-	timelib_sll daynr = timelib_daynr_from_weeknr_ex(iy, iw, id, y) + 1;
+	timelib_sll daynr = timelib_daynr_from_weeknr(iy, iw, id) + 1;
 	int *table;
+	bool is_leap_year;
 
-	*m = 0;
+	// Invariant: is_leap_year == timelib_is_leap(*y)
+	*y = iy;
+	is_leap_year = timelib_is_leap(*y);
 
-	if (daynr <= 0) {
-		*y += 1;
-	}
-
-	if (timelib_is_leap(*y)) {
-		table = ml_table_leap;
-		if (daynr > 366) {
-			*y += 1;
-			daynr -= 366;
-		}
-	} else {
-		table = ml_table_common;
-		if (daynr > 365) {
-			*y += 1;
-			daynr -= 365;
-		}
-	}
-
-	do {
-		daynr -= table[*m];
-		(*m)++;
-	} while (daynr > table[*m]);
-
-	if (daynr <= 0) {
-		daynr += 31;
+	// Establish invariant that daynr >= 0
+	while (daynr <= 0) {
 		*y -= 1;
-		*m = 12;
+		daynr += (is_leap_year = timelib_is_leap(*y)) ? 366 : 365;
+	}
+
+	// Establish invariant that daynr <= number of days in *yr
+	while (daynr > (is_leap_year ? 366 : 365)) {
+		daynr -= is_leap_year ? 366 : 365;
+		*y += 1;
+		is_leap_year = timelib_is_leap(*y);
+	}
+
+	table = is_leap_year ? ml_table_leap : ml_table_common;
+
+	// Establish invariant that daynr <= number of days in *m
+	*m = 1;
+	while (daynr > table[*m]) {
+		daynr -= table[*m];
+		*m += 1;
 	}
 
 	*d = daynr;

ext/date/lib/timelib.h

@@ -322,9 +322,9 @@ typedef struct _timelib_tzdb {
 # define timelib_free    free
 #endif
 
-#define TIMELIB_VERSION 201802
-#define TIMELIB_EXTENDED_VERSION 20180201
-#define TIMELIB_ASCII_VERSION "2018.02"
+#define TIMELIB_VERSION 201803
+#define TIMELIB_EXTENDED_VERSION 20180301
+#define TIMELIB_ASCII_VERSION "2018.03"
 
 #define TIMELIB_NONE             0x00
 #define TIMELIB_OVERRIDE_TIME    0x01

ext/date/lib/tm2unixtime.c

@@ -33,18 +33,6 @@ static int month_tab[12]          = {   0,  31,  59,  90, 120, 151, 181, 212, 24
 static int days_in_month_leap[13] = {  31,  31,  29,  31,  30,  31,  30,  31,  31,  30,  31,  30,  31 };
 static int days_in_month[13]      = {  31,  31,  28,  31,  30,  31,  30,  31,  31,  30,  31,  30,  31 };
 
-static void do_range_limit_fraction(timelib_sll *fraction, timelib_sll *seconds)
-{
-	if (*fraction < 0) {
-		*fraction += 1000000;
-		*seconds -= 1;
-	}
-	if (*fraction >= 1000000) {
-		*fraction -= 1000000;
-		*seconds += 1;
-	}
-}
-
 static void do_range_limit(timelib_sll start, timelib_sll end, timelib_sll adj, timelib_sll *a, timelib_sll *b)
 {
 	if (*a < start) {
@@ -194,7 +182,7 @@ static void do_adjust_for_weekday(timelib_time* time)
 
 void timelib_do_rel_normalize(timelib_time *base, timelib_rel_time *rt)
 {
-	do_range_limit_fraction(&rt->us, &rt->s);
+	do_range_limit(0, 1000000, 1000000, &rt->us, &rt->s);
 	do_range_limit(0, 60, 60, &rt->s, &rt->i);
 	do_range_limit(0, 60, 60, &rt->i, &rt->h);
 	do_range_limit(0, 24, 24, &rt->h, &rt->d);
@@ -234,7 +222,7 @@ static void magic_date_calc(timelib_time *time)
 
 void timelib_do_normalize(timelib_time* time)
 {
-	if (time->us != TIMELIB_UNSET) do_range_limit_fraction(&time->us, &time->s);
+	if (time->us != TIMELIB_UNSET) do_range_limit(0, 1000000, 1000000, &time->us, &time->s);
 	if (time->s != TIMELIB_UNSET) do_range_limit(0, 60, 60, &time->s, &time->i);
 	if (time->s != TIMELIB_UNSET) do_range_limit(0, 60, 60, &time->i, &time->h);
 	if (time->s != TIMELIB_UNSET) do_range_limit(0, 24, 24, &time->h, &time->d);

ext/date/php_date.c

@@ -2923,7 +2923,7 @@ static int php_date_initialize_from_hash(php_date_obj **dateobj, HashTable *myht
 	zval              tmp_obj;
 	timelib_tzinfo   *tzi;
 
-	z_date = zend_hash_str_find(myht, "date", sizeof("data")-1);
+	z_date = zend_hash_str_find(myht, "date", sizeof("date")-1);
 	if (z_date && Z_TYPE_P(z_date) == IS_STRING) {
 		zval *z_timezone_type = zend_hash_str_find(myht, "timezone_type", sizeof("timezone_type")-1);
 		if (z_timezone_type && Z_TYPE_P(z_timezone_type) == IS_LONG) {
@@ -4359,6 +4359,20 @@ static int php_date_interval_initialize_from_hash(zval **return_value, php_inter
 		} \
 	} while (0);
 
+#define PHP_DATE_INTERVAL_READ_PROPERTY_DAYS(member) \
+	do { \
+		zval *z_arg = zend_hash_str_find(myht, "days", sizeof("days") - 1); \
+		if (z_arg && Z_TYPE_P(z_arg) == IS_FALSE) { \
+			(*intobj)->diff->member = -99999; \
+		} else if (z_arg && Z_TYPE_P(z_arg) <= IS_STRING) { \
+			zend_string *str = zval_get_string(z_arg); \
+			DATE_A64I((*intobj)->diff->member, ZSTR_VAL(str)); \
+			zend_string_release(str); \
+		} else { \
+			(*intobj)->diff->member = -1LL; \
+		} \
+	} while (0);
+
 #define PHP_DATE_INTERVAL_READ_PROPERTY_DOUBLE(element, member, def) \
 	do { \
 		zval *z_arg = zend_hash_str_find(myht, element, sizeof(element) - 1); \
@@ -4387,7 +4401,7 @@ static int php_date_interval_initialize_from_hash(zval **return_value, php_inter
 	PHP_DATE_INTERVAL_READ_PROPERTY("weekday_behavior", weekday_behavior, int, -1)
 	PHP_DATE_INTERVAL_READ_PROPERTY("first_last_day_of", first_last_day_of, int, -1)
 	PHP_DATE_INTERVAL_READ_PROPERTY("invert", invert, int, 0);
-	PHP_DATE_INTERVAL_READ_PROPERTY_I64("days", days);
+	PHP_DATE_INTERVAL_READ_PROPERTY_DAYS(days);
 	PHP_DATE_INTERVAL_READ_PROPERTY("special_type", special.type, unsigned int, 0);
 	PHP_DATE_INTERVAL_READ_PROPERTY_I64("special_amount", special.amount);
 	PHP_DATE_INTERVAL_READ_PROPERTY("have_weekday_relative", have_weekday_relative, unsigned int, 0);
@@ -5154,7 +5168,7 @@ static HashTable *date_object_get_properties_period(zval *object) /* {{{ */
 
 	if (period_obj->start) {
 		php_date_obj *date_obj;
-		object_init_ex(&zv, date_ce_date);
+		object_init_ex(&zv, period_obj->start_ce);
 		date_obj = Z_PHPDATE_P(&zv);
 		date_obj->time = timelib_time_clone(period_obj->start);
 	} else {
@@ -5164,7 +5178,7 @@ static HashTable *date_object_get_properties_period(zval *object) /* {{{ */
 
 	if (period_obj->current) {
 		php_date_obj *date_obj;
-		object_init_ex(&zv, date_ce_date);
+		object_init_ex(&zv, period_obj->start_ce);
 		date_obj = Z_PHPDATE_P(&zv);
 		date_obj->time = timelib_time_clone(period_obj->current);
 	} else {
@@ -5174,7 +5188,7 @@ static HashTable *date_object_get_properties_period(zval *object) /* {{{ */
 
 	if (period_obj->end) {
 		php_date_obj *date_obj;
-		object_init_ex(&zv, date_ce_date);
+		object_init_ex(&zv, period_obj->start_ce);
 		date_obj = Z_PHPDATE_P(&zv);
 		date_obj->time = timelib_time_clone(period_obj->end);
 	} else {
@@ -5211,7 +5225,7 @@ static int php_date_period_initialize_from_hash(php_period_obj *period_obj, Hash
 
 	ht_entry = zend_hash_str_find(myht, "start", sizeof("start")-1);
 	if (ht_entry) {
-		if (Z_TYPE_P(ht_entry) == IS_OBJECT && Z_OBJCE_P(ht_entry) == date_ce_date) {
+		if (Z_TYPE_P(ht_entry) == IS_OBJECT && instanceof_function(Z_OBJCE_P(ht_entry), date_ce_interface)) {
 			php_date_obj *date_obj;
 			date_obj = Z_PHPDATE_P(ht_entry);
 			period_obj->start = timelib_time_clone(date_obj->time);
@@ -5225,7 +5239,7 @@ static int php_date_period_initialize_from_hash(php_period_obj *period_obj, Hash
 
 	ht_entry = zend_hash_str_find(myht, "end", sizeof("end")-1);
 	if (ht_entry) {
-		if (Z_TYPE_P(ht_entry) == IS_OBJECT && Z_OBJCE_P(ht_entry) == date_ce_date) {
+		if (Z_TYPE_P(ht_entry) == IS_OBJECT && instanceof_function(Z_OBJCE_P(ht_entry), date_ce_interface)) {
 			php_date_obj *date_obj;
 			date_obj = Z_PHPDATE_P(ht_entry);
 			period_obj->end = timelib_time_clone(date_obj->time);
@@ -5238,7 +5252,7 @@ static int php_date_period_initialize_from_hash(php_period_obj *period_obj, Hash
 
 	ht_entry = zend_hash_str_find(myht, "current", sizeof("current")-1);
 	if (ht_entry) {
-		if (Z_TYPE_P(ht_entry) == IS_OBJECT && Z_OBJCE_P(ht_entry) == date_ce_date) {
+		if (Z_TYPE_P(ht_entry) == IS_OBJECT && instanceof_function(Z_OBJCE_P(ht_entry), date_ce_interface)) {
 			php_date_obj *date_obj;
 			date_obj = Z_PHPDATE_P(ht_entry);
 			period_obj->current = timelib_time_clone(date_obj->time);

ext/date/tests/bug48678.phpt

@@ -39,7 +39,7 @@ DateInterval Object
     [weekday_behavior] => 0
     [first_last_day_of] => 0
     [invert] => 0
-    [days] => 0
+    [days] => 
     [special_type] => 0
     [special_amount] => 0
     [have_weekday_relative] => 0

ext/date/tests/bug53437.phpt

@@ -136,7 +136,7 @@ object(DatePeriod)#%d (6) {
     ["invert"]=>
     int(0)
     ["days"]=>
-    int(0)
+    bool(false)
     ["special_type"]=>
     int(0)
     ["special_amount"]=>

ext/date/tests/bug53437_var2.phpt

@@ -71,7 +71,7 @@ object(DateInterval)#2 (16) {
   ["invert"]=>
   int(0)
   ["days"]=>
-  int(0)
+  bool(false)
   ["special_type"]=>
   int(0)
   ["special_amount"]=>

ext/date/tests/bug70153.phpt

@@ -0,0 +1,14 @@
+--TEST--
+Bug #70153 (\DateInterval incorrectly unserialized)
+--FILE--
+<?php
+$i1 = \DateInterval::createFromDateString('+1 month');
+$i2 = unserialize(serialize($i1));
+var_dump($i1->days, $i2->days);
+var_dump($i2->special_amount, $i2->special_amount);
+?>
+--EXPECT--
+bool(false)
+bool(false)
+int(0)
+int(0)

ext/date/tests/bug78751.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Bug #78751 (Serialising DatePeriod converts DateTimeImmutable)
+--FILE--
+<?php
+$oDay = new DateTimeImmutable('2019-10-25');
+$oDateInterval = DateInterval::createFromDateString('1 day');
+$oDays = new DatePeriod($oDay, $oDateInterval, $oDay->modify('+1 day'));
+$oDays = unserialize(serialize($oDays));
+var_dump(
+    $oDays->start instanceof DateTimeImmutable,
+    $oDays->end instanceof DateTimeImmutable
+);
+?>
+--EXPECT--
+bool(true)
+bool(true)

ext/dom/tests/DOMDocument_loadXML_error1.phpt

@@ -21,6 +21,6 @@ domdocumentloadxml_test_method.php
 --EXPECTF--
 Warning: DOMDocument::load%r(XML){0,1}%r(): Opening and ending tag mismatch: title line 5 and book %s
 
-Warning: DOMDocument::load%r(XML){0,1}%r(): expected '>' %s
+Warning: DOMDocument::load%r(XML){0,1}%r(): %rexpected '>'|Opening and ending tag mismatch: book line 5 and books%r %s
 
-Warning: DOMDocument::load%r(XML){0,1}%r(): Premature end of data in tag books %s
+Warning: DOMDocument::load%r(XML){0,1}%r(): %rPremature end of data in tag books|EndTag: '<\/' not found in Entity, line: 13%r %s

ext/dom/tests/DOMDocument_load_error1.phpt

@@ -21,6 +21,6 @@ domdocumentload_test_method.php
 --EXPECTF--
 Warning: DOMDocument::load%r(XML){0,1}%r(): Opening and ending tag mismatch: title line 5 and book %s
 
-Warning: DOMDocument::load%r(XML){0,1}%r(): expected '>' %s
+Warning: DOMDocument::load%r(XML){0,1}%r(): %rexpected '>'|Opening and ending tag mismatch: book line 5 and books%r %s
 
-Warning: DOMDocument::load%r(XML){0,1}%r(): Premature end of data in tag books %s
+Warning: DOMDocument::load%r(XML){0,1}%r(): %rPremature end of data in tag books|EndTag: '<\/' not found%r %s

ext/exif/exif.c

@@ -978,7 +978,6 @@ static tag_info_array tag_table_VND_PANASONIC = {
   { 0x0001, "Quality"},
   { 0x0002, "FirmwareVersion"},
   { 0x0003, "WhiteBalance"},
-  { 0x0004, "0x0004"},
   { 0x0007, "FocusMode"},
   { 0x000f, "AFMode"},
   { 0x001a, "ImageStabilization"},
@@ -986,12 +985,10 @@ static tag_info_array tag_table_VND_PANASONIC = {
   { 0x001f, "ShootingMode"},
   { 0x0020, "Audio"},
   { 0x0021, "DataDump"},
-  { 0x0022, "0x0022"},
   { 0x0023, "WhiteBalanceBias"},
   { 0x0024, "FlashBias"},
   { 0x0025, "InternalSerialNumber"},
   { 0x0026, "ExifVersion"},
-  { 0x0027, "0x0027"},
   { 0x0028, "ColorEffect"},
   { 0x0029, "TimeSincePowerOn"},
   { 0x002a, "BurstMode"},
@@ -999,7 +996,6 @@ static tag_info_array tag_table_VND_PANASONIC = {
   { 0x002c, "Contrast"},
   { 0x002d, "NoiseReduction"},
   { 0x002e, "SelfTimer"},
-  { 0x002f, "0x002f"},
   { 0x0030, "Rotation"},
   { 0x0031, "AFAssistLamp"},
   { 0x0032, "ColorMode"},
@@ -1066,7 +1062,6 @@ static tag_info_array tag_table_VND_PANASONIC = {
   { 0x00a3, "ClearRetouchValue"},
   { 0x00ab, "TouchAE"},
   { 0x0e00, "PrintIM"},
-  { 0x4449, "0x4449"},
   { 0x8000, "MakerNoteVersion"},
   { 0x8001, "SceneMode"},
   { 0x8004, "WBRedLevel"},
@@ -1101,22 +1096,20 @@ static tag_info_array tag_table_VND_SONY = {
   { 0x0112, "WhiteBalanceFineTune"},
   { 0x0114, "CameraSettings"},
   { 0x0115, "WhiteBalance"},
-  { 0x0116, "0x0116"},
+  { 0x0116, "ExtraInfo"},
   { 0x0e00, "PrintIM"},
   { 0x1000, "MultiBurstMode"},
   { 0x1001, "MultiBurstImageWidth"},
   { 0x1002, "MultiBurstImageHeight"},
   { 0x1003, "Panorama"},
-  { 0x2000, "0x2000"},
   { 0x2001, "PreviewImage"},
-  { 0x2002, "0x2002"},
-  { 0x2003, "0x2003"},
+  { 0x2002, "Rating"},
   { 0x2004, "Contrast"},
   { 0x2005, "Saturation"},
-  { 0x2006, "0x2006"},
-  { 0x2007, "0x2007"},
-  { 0x2008, "0x2008"},
-  { 0x2009, "0x2009"},
+  { 0x2006, "Sharpness"},
+  { 0x2007, "Brightness"},
+  { 0x2008, "LongExposureNoiseReduction"},
+  { 0x2009, "HighISONoiseReduction"},
   { 0x200a, "AutoHDR"},
   { 0x3000, "ShotInfo"},
   { 0xb000, "FileFormat"},
@@ -1143,8 +1136,9 @@ static tag_info_array tag_table_VND_SONY = {
   { 0xb049, "ReleaseMode"},
   { 0xb04a, "SequenceNumber"},
   { 0xb04b, "AntiBlur"},
-  { 0xb04e, "LongExposureNoiseReduction"},
+  { 0xb04e, "FocusMode"},
   { 0xb04f, "DynamicRangeOptimizer"},
+  { 0xb050, "HighISONoiseReduction2"},
   { 0xb052, "IntelligentAuto"},
   { 0xb054, "WhiteBalance2"},
   TAG_TABLE_END
@@ -1249,7 +1243,6 @@ static tag_info_array tag_table_VND_MINOLTA = {
   { 0x0100, "SceneMode"},
   { 0x0101, "ColorMode"},
   { 0x0102, "Quality"},
-  { 0x0103, "0x0103"},
   { 0x0104, "FlashExposureComp"},
   { 0x0105, "Teleconverter"},
   { 0x0107, "ImageStabilization"},
@@ -1334,27 +1327,28 @@ typedef struct {
 
 /* Remember to update PHP_MINFO if updated */
 static const maker_note_type maker_note_array[] = {
-  { tag_table_VND_CANON,     "Canon",                   NULL,								 0,  0,  MN_ORDER_INTEL,    MN_OFFSET_NORMAL},
-  { tag_table_VND_CASIO,     "CASIO",                   NULL,								 0,  0,  MN_ORDER_MOTOROLA, MN_OFFSET_NORMAL},
-  { tag_table_VND_FUJI,      "FUJIFILM",                "FUJIFILM\x0C\x00\x00\x00",			 12, 12, MN_ORDER_INTEL,    MN_OFFSET_MAKER},
-  { tag_table_VND_NIKON,     "NIKON",                   "Nikon\x00\x01\x00",				 8,  8,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
-  { tag_table_VND_NIKON_990, "NIKON",                   NULL,								 0,  0,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
-  { tag_table_VND_OLYMPUS,   "OLYMPUS OPTICAL CO.,LTD", "OLYMP\x00\x01\x00",				 8,  8,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
-  { tag_table_VND_SAMSUNG,   "SAMSUNG",                 NULL,								 0,  0,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
-  { tag_table_VND_PANASONIC, "Panasonic",               "Panasonic\x00\x00\x00",			 12, 12, MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
-  { tag_table_VND_DJI,       "DJI",                     NULL,								 0, 0,   MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
-  { tag_table_VND_SONY,      "SONY",                   "SONY DSC \x00\x00\x00",				 12, 12, MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
-  { tag_table_VND_PENTAX,    "PENTAX",                  "AOC\x00",							 6,  6,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
-  { tag_table_VND_MINOLTA,   "Minolta, KONICA MINOLTA", NULL,								 0,  0,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
-  { tag_table_VND_SIGMA,     "SIGMA, FOVEON",           "SIGMA\x00\x00\x00",				 10, 10, MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
-  { tag_table_VND_SIGMA,     "SIGMA, FOVEON",           "FOVEON\x00\x00\x00",				 10, 10, MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
-  { tag_table_VND_KYOCERA,   "KYOCERA, CONTAX",			"KYOCERA            \x00\x00\x00",	 22, 22, MN_ORDER_NORMAL,   MN_OFFSET_MAKER},
-  { tag_table_VND_RICOH,	 "RICOH",					"Ricoh",							 5,  5,  MN_ORDER_MOTOROLA, MN_OFFSET_NORMAL},
-  { tag_table_VND_RICOH,     "RICOH",					"RICOH",							 5,  5,  MN_ORDER_MOTOROLA, MN_OFFSET_NORMAL},
+  { tag_table_VND_CANON,     "Canon",                   NULL,								0,  0,  MN_ORDER_INTEL,    MN_OFFSET_NORMAL},
+  { tag_table_VND_CASIO,     "CASIO",                   NULL,							 	0,  0,  MN_ORDER_MOTOROLA, MN_OFFSET_NORMAL},
+  { tag_table_VND_FUJI,      "FUJIFILM",                "FUJIFILM\x0C\x00\x00\x00",		 	12, 12, MN_ORDER_INTEL,    MN_OFFSET_MAKER},
+  { tag_table_VND_NIKON,     "NIKON",                   "Nikon\x00\x01\x00",				8,  8,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
+  { tag_table_VND_NIKON_990, "NIKON",                   NULL,								0,  0,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
+  { tag_table_VND_OLYMPUS,   "OLYMPUS OPTICAL CO.,LTD", "OLYMP\x00\x01\x00",				8,  8,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
+  { tag_table_VND_SAMSUNG,   "SAMSUNG",                 NULL,								0,  0,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
+  { tag_table_VND_PANASONIC, "Panasonic",               "Panasonic\x00\x00\x00",			12, 12, MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
+  { tag_table_VND_DJI,       "DJI",                     NULL,								0,  0,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
+  { tag_table_VND_SONY,      "SONY",                    "SONY DSC \x00\x00\x00",			12, 12, MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
+  { tag_table_VND_SONY,      "SONY",                    NULL,								0,  0,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
+  { tag_table_VND_PENTAX,    "PENTAX",                  "AOC\x00",						 	6,  6,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
+  { tag_table_VND_MINOLTA,   "Minolta, KONICA MINOLTA", NULL,								0,  0,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
+  { tag_table_VND_SIGMA,     "SIGMA, FOVEON",           "SIGMA\x00\x00\x00",				10, 10, MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
+  { tag_table_VND_SIGMA,     "SIGMA, FOVEON",           "FOVEON\x00\x00\x00",				10, 10, MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
+  { tag_table_VND_KYOCERA,   "KYOCERA, CONTAX",			"KYOCERA            \x00\x00\x00",	22, 22, MN_ORDER_NORMAL,   MN_OFFSET_MAKER},
+  { tag_table_VND_RICOH,	 "RICOH",					"Ricoh",							5,  5,  MN_ORDER_MOTOROLA, MN_OFFSET_NORMAL},
+  { tag_table_VND_RICOH,     "RICOH",					"RICOH",							5,  5,  MN_ORDER_MOTOROLA, MN_OFFSET_NORMAL},
 
   /* These re-uses existing formats */
-  { tag_table_VND_OLYMPUS,   "AGFA",					"AGFA \x00\x01",					 8,  8,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
-  { tag_table_VND_OLYMPUS,   "EPSON",					"EPSON\x00\x01\x00",			     8,  8,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL}
+  { tag_table_VND_OLYMPUS,   "AGFA",					"AGFA \x00\x01",					8,  8,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
+  { tag_table_VND_OLYMPUS,   "EPSON",					"EPSON\x00\x01\x00",				8,  8,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL}
 };
 /* }}} */
 
@@ -2303,14 +2297,11 @@ static void exif_iif_free(image_info_type *image_info, int section_index) {
 				efree(f);
 			}
 			switch(image_info->info_list[section_index].list[i].format) {
-				case TAG_FMT_SBYTE:
-				case TAG_FMT_BYTE:
-					/* in contrast to strings bytes do not need to allocate buffer for NULL if length==0 */
-					if (image_info->info_list[section_index].list[i].length<1)
-						break;
-				default:
 				case TAG_FMT_UNDEFINED:
 				case TAG_FMT_STRING:
+				case TAG_FMT_SBYTE:
+				case TAG_FMT_BYTE:
+				default:
 					if ((f=image_info->info_list[section_index].list[i].value.s) != NULL) {
 						efree(f);
 					}
@@ -3235,6 +3226,14 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 }
 /* }}} */
 
+#define REQUIRE_NON_EMPTY() do { \
+	if (byte_count == 0) { \
+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Cannot be empty", tag, exif_get_tagname(tag, tagname, -12, tag_table)); \
+		return FALSE; \
+	} \
+} while (0)
+
+
 /* {{{ exif_process_IFD_TAG
  * Process one of the nested IFDs directories. */
 static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, char *offset_base, size_t IFDlength, size_t displacement, int section_index, int ReadNextIFD, tag_table_type tag_table)
@@ -3268,11 +3267,6 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 		/*return TRUE;*/
 	}
 
-	if (components <= 0) {
-		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal components(%d)", tag, exif_get_tagname(tag, tagname, -12, tag_table), components);
-		return FALSE;
-	}
-
 	byte_count_signed = (int64_t)components * php_tiff_bytes_per_format[format];
 
 	if (byte_count_signed < 0 || (byte_count_signed > INT32_MAX)) {
@@ -3352,8 +3346,12 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 	}
 #endif
 
+	/* NB: The following code may not assume that there is at least one component!
+	 * byte_count may be zero! */
+
 	if (section_index==SECTION_THUMBNAIL) {
 		if (!ImageInfo->Thumbnail.data) {
+			REQUIRE_NON_EMPTY();
 			switch(tag) {
 				case TAG_IMAGEWIDTH:
 				case TAG_COMP_IMAGE_WIDTH:
@@ -3397,6 +3395,9 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				if (byte_count>1 && (length=php_strnlen(value_ptr, byte_count)) > 0) {
 					if (length<byte_count-1) {
 						/* When there are any characters after the first NUL */
+						EFREE_IF(ImageInfo->CopyrightPhotographer);
+						EFREE_IF(ImageInfo->CopyrightEditor);
+						EFREE_IF(ImageInfo->Copyright);
 						ImageInfo->CopyrightPhotographer  = estrdup(value_ptr);
 						ImageInfo->CopyrightEditor        = estrndup(value_ptr+length+1, byte_count-length-1);
 						spprintf(&ImageInfo->Copyright, 0, "%s, %s", ImageInfo->CopyrightPhotographer, ImageInfo->CopyrightEditor);
@@ -3404,6 +3405,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 						/* but we are not supposed to change this                   */
 						/* keep in mind that image_info does not store editor value */
 					} else {
+						EFREE_IF(ImageInfo->Copyright);
 						ImageInfo->Copyright = estrndup(value_ptr, byte_count);
 					}
 				}
@@ -3432,6 +3434,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 			case TAG_FNUMBER:
 				/* Simplest way of expressing aperture, so I trust it the most.
 				   (overwrite previously computed value if there is one) */
+				REQUIRE_NON_EMPTY();
 				ImageInfo->ApertureFNumber = (float)exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel);
 				break;
 
@@ -3440,6 +3443,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				/* More relevant info always comes earlier, so only use this field if we don't
 				   have appropriate aperture information yet. */
 				if (ImageInfo->ApertureFNumber == 0) {
+					REQUIRE_NON_EMPTY();
 					ImageInfo->ApertureFNumber
 						= (float)exp(exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel)*log(2)*0.5);
 				}
@@ -3451,6 +3455,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				   SHUTTERSPEED comes after EXPOSURE TIME
 				  */
 				if (ImageInfo->ExposureTime == 0) {
+					REQUIRE_NON_EMPTY();
 					ImageInfo->ExposureTime
 						= (float)(1/exp(exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel)*log(2)));
 				}
@@ -3460,20 +3465,24 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				break;
 
 			case TAG_COMP_IMAGE_WIDTH:
+				REQUIRE_NON_EMPTY();
 				ImageInfo->ExifImageWidth = exif_convert_any_to_int(value_ptr, exif_rewrite_tag_format_to_unsigned(format), ImageInfo->motorola_intel);
 				break;
 
 			case TAG_FOCALPLANE_X_RES:
+				REQUIRE_NON_EMPTY();
 				ImageInfo->FocalplaneXRes = exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel);
 				break;
 
 			case TAG_SUBJECT_DISTANCE:
 				/* Inidcates the distacne the autofocus camera is focused to.
 				   Tends to be less accurate as distance increases. */
+				REQUIRE_NON_EMPTY();
 				ImageInfo->Distance = (float)exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel);
 				break;
 
 			case TAG_FOCALPLANE_RESOLUTION_UNIT:
+				REQUIRE_NON_EMPTY();
 				switch((int)exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel)) {
 					case 1: ImageInfo->FocalplaneUnits = 25.4; break; /* inch */
 					case 2:
@@ -3499,9 +3508,11 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				break;
 
 			case TAG_MAKE:
+				EFREE_IF(ImageInfo->make);
 				ImageInfo->make = estrndup(value_ptr, byte_count);
 				break;
 			case TAG_MODEL:
+				EFREE_IF(ImageInfo->model);
 				ImageInfo->model = estrndup(value_ptr, byte_count);
 				break;
 
@@ -3516,6 +3527,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 			case TAG_GPS_IFD_POINTER:
 			case TAG_INTEROP_IFD_POINTER:
 				if (ReadNextIFD) {
+					REQUIRE_NON_EMPTY();
 					char *Subdir_start;
 					int sub_section_index = 0;
 					switch(tag) {
@@ -3544,9 +3556,11 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 					Subdir_start = offset_base + php_ifd_get32u(value_ptr, ImageInfo->motorola_intel);
 					if (Subdir_start < offset_base || Subdir_start > offset_base+IFDlength) {
 						exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD Pointer");
+						EFREE_IF(outside);
 						return FALSE;
 					}
 					if (!exif_process_IFD_in_JPEG(ImageInfo, Subdir_start, offset_base, IFDlength, displacement, sub_section_index, tag)) {
+						EFREE_IF(outside);
 						return FALSE;
 					}
 #ifdef EXIF_DEBUG
@@ -4557,8 +4571,9 @@ PHP_FUNCTION(exif_read_data)
 		exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "CCDWidth", "%dmm", (int)ImageInfo.CCDWidth);
 	}
 	if(ImageInfo.ExposureTime>0) {
-		if(ImageInfo.ExposureTime <= 0.5) {
-			exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "ExposureTime", "%0.3F s (1/%d)", ImageInfo.ExposureTime, (int)(0.5 + 1/ImageInfo.ExposureTime));
+		float recip_exposure_time = 0.5f + 1.0f/ImageInfo.ExposureTime;
+		if (ImageInfo.ExposureTime <= 0.5 && recip_exposure_time < INT_MAX) {
+			exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "ExposureTime", "%0.3F s (1/%d)", ImageInfo.ExposureTime, (int) recip_exposure_time);
 		} else {
 			exif_iif_add_fmt(&ImageInfo, SECTION_COMPUTED, "ExposureTime", "%0.3F s", ImageInfo.ExposureTime);
 		}

ext/exif/tests/bug68547.phpt

@@ -4,9 +4,48 @@ Bug #68547 (Exif Header component value check error)
 <?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
 --FILE--
 <?php
-exif_read_data(__DIR__ . DIRECTORY_SEPARATOR . 'bug68547.jpg');
+var_dump(exif_read_data(__DIR__ . DIRECTORY_SEPARATOR . 'bug68547.jpg'));
 ?>
 ===DONE===
 --EXPECTF--
-Warning: exif_read_data(bug68547.jpg): Process tag(x9C9E=Keywords   ): Illegal components(%d) in %sbug68547.php on line %d
+array(12) {
+  ["FileName"]=>
+  string(12) "bug68547.jpg"
+  ["FileDateTime"]=>
+  int(%d)
+  ["FileSize"]=>
+  int(713)
+  ["FileType"]=>
+  int(2)
+  ["MimeType"]=>
+  string(10) "image/jpeg"
+  ["SectionsFound"]=>
+  string(20) "ANY_TAG, IFD0, WINXP"
+  ["COMPUTED"]=>
+  array(5) {
+    ["html"]=>
+    string(20) "width="1" height="1""
+    ["Height"]=>
+    int(1)
+    ["Width"]=>
+    int(1)
+    ["IsColor"]=>
+    int(1)
+    ["ByteOrderMotorola"]=>
+    int(0)
+  }
+  ["Subject"]=>
+  string(10) "Subjec??.."
+  ["Keywords"]=>
+  string(0) ""
+  ["Author"]=>
+  string(9) "Rui Carmo"
+  ["Comments"]=>
+  string(29) "Comments
+Line2
+Line3
+Line4"
+  ["Title"]=>
+  string(8) "Title..."
+}
 ===DONE===

ext/exif/tests/bug68799.phpt

@@ -39,7 +39,6 @@ print_r(exif_read_data(__DIR__.'/bug68799.jpg'));
 
 ?>
 --EXPECTF--
-Warning: exif_read_data(bug68799.jpg): Process tag(x9C9D=Author     ): Illegal components(%d) in %s on line %d
 Array
 (
     [FileName] => bug68799.jpg
@@ -47,7 +46,7 @@ Array
     [FileSize] => 735
     [FileType] => 2
     [MimeType] => image/jpeg
-    [SectionsFound] => ANY_TAG, IFD0
+    [SectionsFound] => ANY_TAG, IFD0, WINXP
     [COMPUTED] => Array
         (
             [html] => width="1" height="1"
@@ -60,4 +59,5 @@ Array
     [XResolution] => 96/1
     [YResolution] => 96/1
     [ResolutionUnit] => 2
+    [Author] => 
 )

ext/exif/tests/bug72094.phpt

@@ -47,7 +47,7 @@ Warning: exif_read_data(bug72094_3.jpg): Process tag(x3030=UndefinedTa): Illegal
 
 Warning: exif_read_data(bug72094_3.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d
 
-Warning: exif_read_data(bug72094_3.jpg): Process tag(x3030=UndefinedTa): Illegal components(%d) in %s%ebug72094.php on line %d
+Warning: exif_read_data(bug72094_3.jpg): Illegal IFD size in %s%ebug72094.php on line %d
 
 Warning: exif_read_data(bug72094_3.jpg): File structure corrupted in %s%ebug72094.php on line %d
 

ext/exif/tests/bug73737.phpt

@@ -8,7 +8,7 @@ Bug #73737 (Crash when parsing a tag format)
 	var_dump($exif);
 ?>
 --EXPECTF--
-Warning: exif_thumbnail(bug73737.tiff): Process tag(x0100=ImageWidth ): Illegal components(0) in %s on line %d
+Warning: exif_thumbnail(bug73737.tiff): Process tag(x0100=ImageWidth ): Cannot be empty in %s on line %d
 
 Warning: exif_thumbnail(bug73737.tiff): Error in TIFF: filesize(x0030) less than start of IFD dir(x10102) in %s line %d
 bool(false)

ext/exif/tests/duplicate_copyright_tag_leak.phpt

@@ -0,0 +1,18 @@
+--TEST--
+OSS-Fuzz #17474: Memory leak on duplicate Copyright tags
+--SKIPIF--
+<?php
+if (!extension_loaded('exif')) {
+    die('skip exif extension not available');
+}
+?>
+--FILE--
+<?php
+
+// Only checking for an absence of leaks here.
+@exif_read_data(__DIR__ . '/duplicate_copyright_tag_leak.tiff');
+
+?>
+===DONE===
+--EXPECTF--
+===DONE===

ext/exif/tests/tag_with_illegal_zero_components.phpt

@@ -0,0 +1,21 @@
+--TEST--
+OSS-Fuzz #17163: Out-of-bounds read due to tag with zero components
+--SKIPIF--
+<?php
+if (!extension_loaded('exif')) {
+    die('skip exif extension not available');
+}
+?>
+--FILE--
+<?php
+
+var_dump(exif_read_data(__DIR__ . '/tag_with_illegal_zero_components.jpeg'));
+
+?>
+--EXPECTF--
+Warning: exif_read_data(tag_with_illegal_zero_components.jpeg): Process tag(x0202=JPEGInterch): Cannot be empty in %s on line %d
+
+Warning: exif_read_data(tag_with_illegal_zero_components.jpeg): File structure corrupted in %s on line %d
+
+Warning: exif_read_data(tag_with_illegal_zero_components.jpeg): Invalid JPEG file in %s on line %d
+bool(false)

ext/exif/tests/temporary_buffer_leak.phpt

@@ -0,0 +1,16 @@
+--TEST--
+OSS-Fuzz: Temporary buffer leak in tag reading
+--SKIPIF--
+<?php
+if (!extension_loaded('exif')) {
+    die('skip exif extension not available');
+}
+?>
+--FILE--
+<?php
+
+var_dump(@exif_read_data(__DIR__ . '/temporary_buffer_leak.jpg'));
+
+?>
+--EXPECT--
+bool(false)

ext/exif/tests/zero_length_makernote_leak.phpt

@@ -0,0 +1,17 @@
+--TEST--
+OSS-Fuzz: Memory leak for zero-length MAKERNOTE
+--SKIPIF--
+<?php
+if (!extension_loaded('exif')) {
+    die('skip exif extension not available');
+}
+?>
+--FILE--
+<?php
+
+@exif_read_data(__DIR__ . '/zero_length_makernote_leak.tiff');
+
+?>
+===DONE===
+--EXPECT--
+===DONE===

ext/fileinfo/libmagic/cdf.c

@@ -989,8 +989,9 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 				goto out;
 			}
 			nelements = CDF_GETUINT32(q, 1);
-			if (nelements == 0) {
-				DPRINTF(("CDF_VECTOR with nelements == 0\n"));
+			if (nelements > CDF_ELEMENT_LIMIT || nelements == 0) {
+				DPRINTF(("CDF_VECTOR with nelements == %"
+				    SIZE_T_FORMAT "u\n", nelements));
 				goto out;
 			}
 			slen = 2;
@@ -1032,8 +1033,6 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 					goto out;
 				inp += nelem;
 			}
-			DPRINTF(("nelements = %" SIZE_T_FORMAT "u\n",
-			    nelements));
 			for (j = 0; j < nelements && i < sh.sh_properties;
 			    j++, i++)
 			{

ext/fileinfo/libmagic/cdf.h

@@ -48,6 +48,7 @@
 typedef int32_t cdf_secid_t;
 
 #define CDF_LOOP_LIMIT					10000
+#define CDF_ELEMENT_LIMIT				100000
 
 #define CDF_SECID_NULL					0
 #define CDF_SECID_FREE					-1

ext/gd/tests/bug77198_auto.phpt

@@ -3,7 +3,7 @@ Bug #77198 (auto cropping has insufficient precision)
 --SKIPIF--
 <?php
 if (!extension_loaded('gd')) die('skip gd extension not available');
-if (!GD_BUNDLED) die('upstream bugfix has not been released');
+if (!GD_BUNDLED) die('skip upstream bugfix has not been released');
 ?>
 --FILE--
 <?php

ext/gd/tests/bug77198_threshold.phpt

@@ -3,7 +3,7 @@ Bug #77198 (threshold cropping has insufficient precision)
 --SKIPIF--
 <?php
 if (!extension_loaded('gd')) die('skip gd extension not available');
-if (!GD_BUNDLED) die('upstream bugfix has not been released');
+if (!GD_BUNDLED) die('skip upstream bugfix has not been released');
 ?>
 --FILE--
 <?php

ext/gd/tests/bug77200.phpt

@@ -3,7 +3,7 @@ Bug #77200 (imagecropauto(…, GD_CROP_SIDES) crops left but not right)
 --SKIPIF--
 <?php
 if (!extension_loaded('gd')) die('skip gd extension not available');
-if (!GD_BUNDLED) die('upstream bugfix has not been released');
+if (!GD_BUNDLED) die('skip upstream bugfix has not been released');
 ?>
 --FILE--
 <?php

ext/iconv/iconv.c

@@ -284,7 +284,7 @@ PHP_MINIT_FUNCTION(miconv)
 	{
 		static char buf[16];
 		snprintf(buf, sizeof(buf), "%d.%d",
-		    ((_libiconv_version >> 8) & 0x0f), (_libiconv_version & 0x0f));
+			_libiconv_version >> 8, _libiconv_version & 0xff);
 		version = buf;
 	}
 #elif HAVE_GLIBC_ICONV

ext/intl/idn/idn.c

@@ -224,33 +224,27 @@ static void php_intl_idn_to(INTERNAL_FUNCTION_PARAMETERS,
 		}
 		RETURN_FALSE;
 	} else {
+		UParseError parse_error;
 		UChar       converted[MAXPATHLEN];
 		int32_t     converted_ret_len;
 
 		status = U_ZERO_ERROR;
-
-#if U_ICU_VERSION_MAJOR_NUM >= 55
-		UIDNAInfo info = UIDNA_INFO_INITIALIZER;
-		UIDNA *idna = uidna_openUTS46((int32_t)option, &status);
-
-		if (U_FAILURE(status)) {
-			intl_error_set( NULL, status, "idn_to_ascii: failed to create an UIDNA instance", 0 );
-			RETURN_FALSE;
-		}
-
-		if (mode == INTL_IDN_TO_ASCII) {
-			converted_ret_len = uidna_nameToASCII(idna, ustring, ustring_len, converted, MAXPATHLEN, &info, &status);
-		} else {
-			converted_ret_len = uidna_nameToUnicode(idna, ustring, ustring_len, converted, MAXPATHLEN, &info, &status);
-		}
-		uidna_close(idna);
-#else
-		UParseError parse_error;
+#if defined(__clang__)
+# pragma clang diagnostic push
+# pragma clang diagnostic ignored "-Wdeprecated-declarations"
+#elif ZEND_GCC_VERSION >= 4008
+# pragma GCC diagnostic push
+# pragma GCC diagnostic ignored "-Wdeprecated-declarations"
+#endif
 		if (mode == INTL_IDN_TO_ASCII) {
 			converted_ret_len = uidna_IDNToASCII(ustring, ustring_len, converted, MAXPATHLEN, (int32_t)option, &parse_error, &status);
 		} else {
 			converted_ret_len = uidna_IDNToUnicode(ustring, ustring_len, converted, MAXPATHLEN, (int32_t)option, &parse_error, &status);
 		}
+#if defined(__clang__)
+# pragma clang diagnostic pop
+#elif ZEND_GCC_VERSION >= 4008
+# pragma GCC diagnostic pop
 #endif
 		efree(ustring);
 

ext/intl/msgformat/msgformat_helpers.cpp

@@ -191,10 +191,10 @@ static HashTable *umsg_parse_format(MessageFormatter_object *mfo,
 
 		if (name_part.getType() == UMSGPAT_PART_TYPE_ARG_NAME) {
 			UnicodeString argName = mp.getSubstring(name_part);
-			if ((storedType = (Formattable::Type*)zend_hash_str_find_ptr(ret, (char*)argName.getBuffer(), argName.length())) == NULL) {
+			if ((storedType = (Formattable::Type*)zend_hash_str_find_ptr(ret, (char*)argName.getBuffer(), argName.length() * sizeof(UChar))) == NULL) {
 				/* not found already; create new entry in HT */
 				Formattable::Type bogusType = Formattable::kObject;
-				storedType = (Formattable::Type*)zend_hash_str_update_mem(ret, (char*)argName.getBuffer(), argName.length(),
+				storedType = (Formattable::Type*)zend_hash_str_update_mem(ret, (char*)argName.getBuffer(), argName.length() * sizeof(UChar),
 						(void*)&bogusType, sizeof(bogusType));
 			}
 		} else if (name_part.getType() == UMSGPAT_PART_TYPE_ARG_NUMBER) {
@@ -450,7 +450,7 @@ U_CFUNC void umsg_format_helper(MessageFormatter_object *mfo,
 				continue;
 			}
 
-			storedArgType = (Formattable::Type*)zend_hash_str_find_ptr(types, (char*)key.getBuffer(), key.length());
+			storedArgType = (Formattable::Type*)zend_hash_str_find_ptr(types, (char*)key.getBuffer(), key.length() * sizeof(UChar));
 		}
 
 		if (storedArgType != NULL) {

ext/intl/tests/grapheme.phpt

@@ -2,6 +2,7 @@
 grapheme()
 --SKIPIF--
 <?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?>
+<?php if (version_compare(INTL_ICU_VERSION, '65.0') >= 0) die('skip for ICU < 65.0'); ?>
 --FILE--
 <?php
 

ext/intl/tests/locale_get_display_name6.phpt

@@ -3,6 +3,7 @@ locale_get_display_name() icu >= 64.0
 --SKIPIF--
 <?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?>
 <?php if (version_compare(INTL_ICU_VERSION, '64.0') < 0) die('skip for ICU >= 64.0'); ?>
+<?php if (version_compare(INTL_ICU_VERSION, '65.0') >= 0) die('skip for ICU < 65.0'); ?>
 --FILE--
 <?php
 

ext/intl/tests/locale_get_display_name7.phpt

@@ -0,0 +1,342 @@
+--TEST--
+locale_get_display_name() icu >= 64.0
+--SKIPIF--
+<?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?>
+<?php if (version_compare(INTL_ICU_VERSION, '65.0') < 0) die('skip for ICU >= 65.0'); ?>
+--FILE--
+<?php
+
+/*
+ * Try getting the display_name for different locales
+ * with Procedural and Object methods.
+ */
+
+function ut_main()
+{
+    $res_str='';
+
+	$disp_locales=array('en','fr','de');
+
+    $locales = array(
+        'sl_IT_nedis_KIRTI',
+        'sl_IT_nedis-a-kirti-x-xyz',
+        'sl_IT_rozaj',
+        'sl_IT_NEDIS_ROJAZ_1901',
+        'i-enochian',
+        'zh-hakka',
+        'zh-wuu',
+        'i-tay',
+        'sgn-BE-nl',
+        'sgn-CH-de',
+        'sl_IT_rozaj@currency=EUR',
+        'uk-ua_CALIFORNIA@currency=;currency=GRN',
+        'root',
+        'uk@currency=EURO',
+        'Hindi',
+//Simple language subtag
+        'de',
+        'fr',
+        'ja',
+        'i-enochian', //(example of a grandfathered tag)
+//Language subtag plus Script subtag:
+        'zh-Hant',
+        'zh-Hans',
+        'sr-Cyrl',
+        'sr-Latn',
+//Language-Script-Region
+        'zh-Hans-CN',
+        'sr-Latn-CS',
+//Language-Variant
+        'sl-rozaj',
+        'sl-nedis',
+//Language-Region-Variant
+        'de-CH-1901',
+        'sl-IT-nedis',
+//Language-Script-Region-Variant
+        'sl-Latn-IT-nedis',
+//Language-Region:
+        'de-DE',
+        'en-US',
+        'es-419',
+//Private use subtags:
+        'de-CH-x-phonebk',
+        'az-Arab-x-AZE-derbend',
+//Extended language subtags
+        'zh-min',
+        'zh-min-nan-Hant-CN',
+//Private use registry values
+        'x-whatever',
+        'qaa-Qaaa-QM-x-southern',
+        'sr-Latn-QM',
+        'sr-Qaaa-CS',
+/*Tags that use extensions (examples ONLY: extensions MUST be defined
+   by revision or update to this document or by RFC): */
+        'en-US-u-islamCal',
+        'zh-CN-a-myExt-x-private',
+        'en-a-myExt-b-another',
+//Some Invalid Tags:
+        'de-419-DE',
+        'a-DE',
+        'ar-a-aaa-b-bbb-a-ccc'
+    );
+
+
+    $res_str = '';
+
+   	foreach( $locales as $locale )
+    {
+       	$res_str .= "locale='$locale'\n";
+   		foreach( $disp_locales as $disp_locale )
+    	{
+        	$scr = ut_loc_get_display_name( $locale ,$disp_locale );
+		$scr = str_replace(array('(', ')'), '#', $scr);
+        	$res_str .= "disp_locale=$disp_locale :  display_name=$scr";
+        	$res_str .= "\n";
+		}
+        $res_str .= "-----------------\n";
+    }
+
+    return $res_str;
+
+}
+
+include_once( 'ut_common.inc' );
+ut_run();
+
+?>
+--EXPECTREGEX--
+locale='sl_IT_nedis_KIRTI'
+disp_locale=en :  display_name=Slovenian #Italy, NEDIS_KIRTI#
+disp_locale=fr :  display_name=slovène #Italie, NEDIS_KIRTI#
+disp_locale=de :  display_name=Slowenisch #Italien, NEDIS_KIRTI#
+-----------------
+locale='sl_IT_nedis-a-kirti-x-xyz'
+disp_locale=en :  display_name=Slovenian #Italy, NEDIS_A_KIRTI_X_XYZ#
+disp_locale=fr :  display_name=slovène #Italie, NEDIS_A_KIRTI_X_XYZ#
+disp_locale=de :  display_name=Slowenisch #Italien, NEDIS_A_KIRTI_X_XYZ#
+-----------------
+locale='sl_IT_rozaj'
+disp_locale=en :  display_name=Slovenian #Italy, Resian#
+disp_locale=fr :  display_name=slovène #Italie, dialecte de Resia#
+disp_locale=de :  display_name=Slowenisch #Italien, (ROZAJ|Resianisch)#
+-----------------
+locale='sl_IT_NEDIS_ROJAZ_1901'
+disp_locale=en :  display_name=Slovenian #Italy, NEDIS_ROJAZ_1901#
+disp_locale=fr :  display_name=slovène #Italie, NEDIS_ROJAZ_1901#
+disp_locale=de :  display_name=Slowenisch #Italien, NEDIS_ROJAZ_1901#
+-----------------
+locale='i-enochian'
+disp_locale=en :  display_name=i-enochian #Private-Use=i-enochian#
+disp_locale=fr :  display_name=i-enochian #usage privé=i-enochian#
+disp_locale=de :  display_name=i-enochian #Privatnutzung=i-enochian#
+-----------------
+locale='zh-hakka'
+disp_locale=en :  display_name=Chinese( #HAKKA#)?
+disp_locale=fr :  display_name=chinois( #HAKKA#)?
+disp_locale=de :  display_name=Chinesisch( #HAKKA#)?
+-----------------
+locale='zh-wuu'
+disp_locale=en :  display_name=Chinese #WUU#
+disp_locale=fr :  display_name=chinois #WUU#
+disp_locale=de :  display_name=Chinesisch #WUU#
+-----------------
+locale='i-tay'
+disp_locale=en :  display_name=i-tay
+disp_locale=fr :  display_name=i-tay
+disp_locale=de :  display_name=i-tay
+-----------------
+locale='sgn-BE-nl'
+disp_locale=en :  display_name=sgn #Belgium, NL#
+disp_locale=fr :  display_name=sgn #Belgique, NL#
+disp_locale=de :  display_name=sgn #Belgien, NL#
+-----------------
+locale='sgn-CH-de'
+disp_locale=en :  display_name=sgn #Switzerland, DE#
+disp_locale=fr :  display_name=sgn #Suisse, DE#
+disp_locale=de :  display_name=sgn #Schweiz, DE#
+-----------------
+locale='sl_IT_rozaj@currency=EUR'
+disp_locale=en :  display_name=Slovenian #Italy, Resian, [Cc]urrency=Euro#
+disp_locale=fr :  display_name=slovène #Italie, dialecte de Resia, [Dd]evise=euro#
+disp_locale=de :  display_name=Slowenisch #Italien, (ROZAJ|Resianisch), Währung=Euro#
+-----------------
+locale='uk-ua_CALIFORNIA@currency=;currency=GRN'
+disp_locale=en :  display_name=
+disp_locale=fr :  display_name=
+disp_locale=de :  display_name=
+-----------------
+locale='root'
+disp_locale=en :  display_name=Unknown language
+disp_locale=fr :  display_name=langue indéterminée
+disp_locale=de :  display_name=Unbekannte Sprache
+-----------------
+locale='uk@currency=EURO'
+disp_locale=en :  display_name=Ukrainian #[Cc]urrency=EURO#
+disp_locale=fr :  display_name=ukrainien #[Dd]evise=EURO#
+disp_locale=de :  display_name=Ukrainisch #Währung=EURO#
+-----------------
+locale='Hindi'
+disp_locale=en :  display_name=hindi
+disp_locale=fr :  display_name=hindi
+disp_locale=de :  display_name=hindi
+-----------------
+locale='de'
+disp_locale=en :  display_name=German
+disp_locale=fr :  display_name=allemand
+disp_locale=de :  display_name=Deutsch
+-----------------
+locale='fr'
+disp_locale=en :  display_name=French
+disp_locale=fr :  display_name=français
+disp_locale=de :  display_name=Französisch
+-----------------
+locale='ja'
+disp_locale=en :  display_name=Japanese
+disp_locale=fr :  display_name=japonais
+disp_locale=de :  display_name=Japanisch
+-----------------
+locale='i-enochian'
+disp_locale=en :  display_name=i-enochian #Private-Use=i-enochian#
+disp_locale=fr :  display_name=i-enochian #usage privé=i-enochian#
+disp_locale=de :  display_name=i-enochian #Privatnutzung=i-enochian#
+-----------------
+locale='zh-Hant'
+disp_locale=en :  display_name=Chinese #Traditional#
+disp_locale=fr :  display_name=chinois #traditionnel#
+disp_locale=de :  display_name=Chinesisch #Traditionell#
+-----------------
+locale='zh-Hans'
+disp_locale=en :  display_name=Chinese #Simplified#
+disp_locale=fr :  display_name=chinois #simplifié#
+disp_locale=de :  display_name=Chinesisch #Vereinfacht#
+-----------------
+locale='sr-Cyrl'
+disp_locale=en :  display_name=Serbian #Cyrillic#
+disp_locale=fr :  display_name=serbe #cyrillique#
+disp_locale=de :  display_name=Serbisch #Kyrillisch#
+-----------------
+locale='sr-Latn'
+disp_locale=en :  display_name=Serbian #Latin#
+disp_locale=fr :  display_name=serbe #latin#
+disp_locale=de :  display_name=Serbisch #Lateinisch#
+-----------------
+locale='zh-Hans-CN'
+disp_locale=en :  display_name=Chinese #Simplified, China#
+disp_locale=fr :  display_name=chinois #simplifié, Chine#
+disp_locale=de :  display_name=Chinesisch #Vereinfacht, China#
+-----------------
+locale='sr-Latn-CS'
+disp_locale=en :  display_name=Serbian #Latin, Serbia#
+disp_locale=fr :  display_name=serbe #latin, Serbie#
+disp_locale=de :  display_name=Serbisch #Lateinisch, Serbien#
+-----------------
+locale='sl-rozaj'
+disp_locale=en :  display_name=Slovenian #Resian#
+disp_locale=fr :  display_name=slovène #dialecte de Resia#
+disp_locale=de :  display_name=Slowenisch( #(ROZAJ|Resianisch)#)?
+-----------------
+locale='sl-nedis'
+disp_locale=en :  display_name=Slovenian #Natisone dialect#
+disp_locale=fr :  display_name=slovène #dialecte de Natisone#
+disp_locale=de :  display_name=Slowenisch #Natisone-Dialekt#
+-----------------
+locale='de-CH-1901'
+disp_locale=en :  display_name=German #Switzerland, Traditional German orthography#
+disp_locale=fr :  display_name=allemand #Suisse, orthographe allemande traditionnelle#
+disp_locale=de :  display_name=Deutsch #Schweiz, (1901|[aA]lte deutsche Rechtschreibung)#
+-----------------
+locale='sl-IT-nedis'
+disp_locale=en :  display_name=Slovenian #Italy, Natisone dialect#
+disp_locale=fr :  display_name=slovène #Italie, dialecte de Natisone#
+disp_locale=de :  display_name=Slowenisch #Italien, (NEDIS|Natisone-Dialekt)#
+-----------------
+locale='sl-Latn-IT-nedis'
+disp_locale=en :  display_name=Slovenian #Latin, Italy, Natisone dialect#
+disp_locale=fr :  display_name=slovène #latin, Italie, dialecte de Natisone#
+disp_locale=de :  display_name=Slowenisch #Lateinisch, Italien, (NEDIS|Natisone-Dialekt)#
+-----------------
+locale='de-DE'
+disp_locale=en :  display_name=German #Germany#
+disp_locale=fr :  display_name=allemand #Allemagne#
+disp_locale=de :  display_name=Deutsch #Deutschland#
+-----------------
+locale='en-US'
+disp_locale=en :  display_name=English #United States#
+disp_locale=fr :  display_name=anglais #États-Unis#
+disp_locale=de :  display_name=Englisch #Vereinigte Staaten#
+-----------------
+locale='es-419'
+disp_locale=en :  display_name=Spanish #Latin America#
+disp_locale=fr :  display_name=espagnol #Amérique latine#
+disp_locale=de :  display_name=Spanisch #Lateinamerika#
+-----------------
+locale='de-CH-x-phonebk'
+disp_locale=en :  display_name=German #Switzerland, Private-Use=phonebk#
+disp_locale=fr :  display_name=allemand #Suisse, usage privé=phonebk#
+disp_locale=de :  display_name=Deutsch #Schweiz, Privatnutzung=phonebk#
+-----------------
+locale='az-Arab-x-AZE-derbend'
+disp_locale=en :  display_name=Azerbaijani #Arabic, Private-Use=aze-derbend#
+disp_locale=fr :  display_name=azéri #arabe, usage privé=aze-derbend#
+disp_locale=de :  display_name=Aserbaidschanisch #Arabisch, Privatnutzung=aze-derbend#
+-----------------
+locale='zh-min'
+disp_locale=en :  display_name=Chinese #MIN#
+disp_locale=fr :  display_name=chinois #MIN#
+disp_locale=de :  display_name=Chinesisch #MIN#
+-----------------
+locale='zh-min-nan-Hant-CN'
+disp_locale=en :  display_name=Chinese #MIN, NAN_HANT_CN#
+disp_locale=fr :  display_name=chinois #MIN, NAN_HANT_CN#
+disp_locale=de :  display_name=Chinesisch #MIN, NAN_HANT_CN#
+-----------------
+locale='x-whatever'
+disp_locale=en :  display_name=x-whatever #Private-Use=whatever#
+disp_locale=fr :  display_name=x-whatever #usage privé=whatever#
+disp_locale=de :  display_name=x-whatever #Privatnutzung=whatever#
+-----------------
+locale='qaa-Qaaa-QM-x-southern'
+disp_locale=en :  display_name=qaa #Qaaa, QM, Private-Use=southern#
+disp_locale=fr :  display_name=qaa #Qaaa, QM, usage privé=southern#
+disp_locale=de :  display_name=qaa #Qaaa, QM, Privatnutzung=southern#
+-----------------
+locale='sr-Latn-QM'
+disp_locale=en :  display_name=Serbian #Latin, QM#
+disp_locale=fr :  display_name=serbe #latin, QM#
+disp_locale=de :  display_name=Serbisch #Lateinisch, QM#
+-----------------
+locale='sr-Qaaa-CS'
+disp_locale=en :  display_name=Serbian #Qaaa, Serbia#
+disp_locale=fr :  display_name=serbe #Qaaa, Serbie#
+disp_locale=de :  display_name=Serbisch #Qaaa, Serbien#
+-----------------
+locale='en-US-u-islamCal'
+disp_locale=en :  display_name=English #United States, attribute=islamcal#
+disp_locale=fr :  display_name=anglais #États-Unis, attribute=islamcal#
+disp_locale=de :  display_name=Englisch #Vereinigte Staaten, attribute=islamcal#
+-----------------
+locale='zh-CN-a-myExt-x-private'
+disp_locale=en :  display_name=Chinese #China, a=myext, Private-Use=private#
+disp_locale=fr :  display_name=chinois #Chine, a=myext, usage privé=private#
+disp_locale=de :  display_name=Chinesisch #China, a=myext, Privatnutzung=private#
+-----------------
+locale='en-a-myExt-b-another'
+disp_locale=en :  display_name=English #a=myext, b=another#
+disp_locale=fr :  display_name=anglais #a=myext, b=another#
+disp_locale=de :  display_name=Englisch #a=myext, b=another#
+-----------------
+locale='de-419-DE'
+disp_locale=en :  display_name=German #Latin America, DE#
+disp_locale=fr :  display_name=allemand #Amérique latine, DE#
+disp_locale=de :  display_name=Deutsch #Lateinamerika, DE#
+-----------------
+locale='a-DE'
+disp_locale=en :  display_name=a #Germany#
+disp_locale=fr :  display_name=a #Allemagne#
+disp_locale=de :  display_name=a #Deutschland#
+-----------------
+locale='ar-a-aaa-b-bbb-a-ccc'
+disp_locale=en :  display_name=Arabic #a=aaa, b=bbb#
+disp_locale=fr :  display_name=arabe #a=aaa, b=bbb#
+disp_locale=de :  display_name=Arabisch #a=aaa, b=bbb#
+-----------------

ext/ldap/ldap.c

@@ -146,7 +146,7 @@ static void _php_ldap_control_to_array(LDAP *ld, LDAPControl* ctrl, zval* array,
 		add_assoc_bool(array, "iscritical", (ctrl->ldctl_iscritical != 0));
 	}
 
-	// If it is a known oid, parse to values
+	/* If it is a known oid, parse to values */
 	if (strcmp(ctrl->ldctl_oid, LDAP_CONTROL_PASSWORDPOLICYRESPONSE) == 0) {
 		int expire = 0, grace = 0, rc;
 		LDAPPasswordPolicyError pperr;
@@ -361,8 +361,8 @@ static int _php_ldap_control_from_array(LDAP *ld, LDAPControl** ctrl, zval* arra
 					rc = -1;
 					php_error_docref(NULL, E_WARNING, "Failed to allocate control value");
 				} else {
-					// ldap_create_assertion_control_value does not reset ld_errno, we need to do it ourselves
-					// See http://www.openldap.org/its/index.cgi/Incoming?id=8674
+					/* ldap_create_assertion_control_value does not reset ld_errno, we need to do it ourselves
+					   See http://www.openldap.org/its/index.cgi/Incoming?id=8674 */
 					int success = LDAP_SUCCESS;
 					ldap_set_option(ld, LDAP_OPT_RESULT_CODE, &success);
 					rc = ldap_create_assertion_control_value(ld, ZSTR_VAL(assert), control_value);
@@ -612,7 +612,7 @@ failure:
 		return LDAP_SUCCESS;
 	}
 
-	// Failed
+	/* Failed */
 	*ctrl = NULL;
 	return -1;
 }
@@ -1589,7 +1589,7 @@ static void php_ldap_do_search(INTERNAL_FUNCTION_PARAMETERS, int scope)
 			}
 
 			if (argcount > 8) {
-				// We have to parse controls again for each link as they use it
+				/* We have to parse controls again for each link as they use it */
 				_php_ldap_controls_free(&lserverctrls);
 				lserverctrls = _php_ldap_controls_from_array(ld->link, serverctrls);
 				if (lserverctrls == NULL) {

ext/libxml/tests/bug76777.phpt

@@ -3,6 +3,7 @@ Bug #76777 (first parameter of libxml_set_external_entity_loader callback undefi
 --SKIPIF--
 <?php
 if (!extension_loaded('libxml')) die('skip');
+if (!extension_loaded('dom')) die('skip dom extension not available');
 if (getenv("SKIP_ONLINE_TESTS")) die('skip online test');
 ?>
 --FILE--

ext/mbstring/mbstring.c

@@ -407,6 +407,7 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_mb_decode_numericentity, 0, 0, 2)
 	ZEND_ARG_INFO(0, string)
 	ZEND_ARG_INFO(0, convmap)
 	ZEND_ARG_INFO(0, encoding)
+	ZEND_ARG_INFO(0, is_hex)
 ZEND_END_ARG_INFO()
 
 ZEND_BEGIN_ARG_INFO_EX(arginfo_mb_send_mail, 0, 0, 3)
@@ -4822,27 +4823,15 @@ PHP_FUNCTION(mb_check_encoding)
 		RETURN_FALSE;
 	}
 
-	switch(Z_TYPE_P(input)) {
-		case IS_LONG:
-		case IS_DOUBLE:
-		case IS_NULL:
-		case IS_TRUE:
-		case IS_FALSE:
-			RETURN_TRUE;
-			break;
-		case IS_STRING:
-			if (!php_mb_check_encoding(Z_STRVAL_P(input), Z_STRLEN_P(input), enc ? ZSTR_VAL(enc): NULL)) {
-				RETURN_FALSE;
-			}
-			break;
-		case IS_ARRAY:
-			if (!php_mb_check_encoding_recursive(HASH_OF(input), enc)) {
-				RETURN_FALSE;
-			}
-			break;
-		default:
-			php_error_docref(NULL, E_WARNING, "Input is something other than scalar or array");
+	if (Z_TYPE_P(input) == IS_ARRAY) {
+		if (!php_mb_check_encoding_recursive(HASH_OF(input), enc)) {
 			RETURN_FALSE;
+		}
+	} else {
+		convert_to_string(input);
+		if (!php_mb_check_encoding(Z_STRVAL_P(input), Z_STRLEN_P(input), enc ? ZSTR_VAL(enc): NULL)) {
+			RETURN_FALSE;
+		}
 	}
 	RETURN_TRUE;
 }

ext/mbstring/oniguruma.patch

@@ -1,28 +0,0 @@
- ext/mbstring/oniguruma/src/config.h.win32 | 1 +
- ext/mbstring/oniguruma/src/config.h.win64 | 1 +
- 2 files changed, 2 insertions(+)
-
-diff --git a/ext/mbstring/oniguruma/src/config.h.win32 b/ext/mbstring/oniguruma/src/config.h.win32
-index bdbdaf25c1..9a9c43f26d 100644
---- a/ext/mbstring/oniguruma/src/config.h.win32
-+++ b/ext/mbstring/oniguruma/src/config.h.win32
-@@ -15,6 +15,7 @@
- #define SIZEOF_VOIDP 4
- #define SIZEOF_FLOAT 4
- #define SIZEOF_DOUBLE 8
-+#define SIZEOF_SIZE_T 4
- #define HAVE_PROTOTYPES 1
- #define TOKEN_PASTE(x,y) x##y
- #define HAVE_STDARG_PROTOTYPES 1
-diff --git a/ext/mbstring/oniguruma/src/config.h.win64 b/ext/mbstring/oniguruma/src/config.h.win64
-index 01a86c7bb9..dec7b75773 100644
---- a/ext/mbstring/oniguruma/src/config.h.win64
-+++ b/ext/mbstring/oniguruma/src/config.h.win64
-@@ -15,6 +15,7 @@
- #define SIZEOF_VOIDP 8
- #define SIZEOF_FLOAT 4
- #define SIZEOF_DOUBLE 8
-+#define SIZEOF_SIZE_T 8
- #define HAVE_PROTOTYPES 1
- #define TOKEN_PASTE(x,y) x##y
- #define HAVE_STDARG_PROTOTYPES 1

ext/mbstring/oniguruma/COPYING

@@ -1,7 +1,7 @@
 Oniguruma LICENSE
 -----------------
 
-Copyright (c) 2002-2018  K.Kosako  <kkosako0@gmail.com>
+Copyright (c) 2002-2019  K.Kosako  <kkosako0@gmail.com>
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without

ext/mbstring/oniguruma/HISTORY

@@ -1,5 +1,62 @@
 History
 
+2019/08/06: Version 6.9.3 (secirity fix release)
+
+2019/07/30: add ONIG_SYN_ALLOW_INVALID_CODE_END_OF_RANGE
+2019/07/29: add STK_PREC_READ_START/END stack type
+2019/07/29: Fix #147: Stack Exhaustion Problem caused by some parsing functions
+2019/07/11: add a dictionary file for libfuzzer
+2019/07/07: add harnesses directory
+2019/07/05-2019/07/29: fix many problems found by libfuzzer programs
+2019/06/27: deprecate onig_new_deluxe()
+2019/06/27: Fix CVE-2019-13224: don't allow different encodings for onig_new_deluxe()
+2019/06/27: Fix CVE-2019-13225: problem in converting if-then-else pattern
+
+2019/05/07: Version 6.9.2 (same as Release Candidate 3)
+
+2019/04/23: Release Candidate 3 for 6.9.2
+2019/04/23: add doc/SYNTAX.md into distribution file
+2019/04/09: Release Candidate 2 for 6.9.2
+2019/04/09: fix #139: UAF in match_at()
+2019/04/01: Release Candidate 1 for 6.9.2
+2019/04/01: update Unicode version to 12.1.0 (draft)
+2019/03/29: allow {n,m} (n>m) as possessive interval
+2019/03/25: add ONIG_SYN_OP2_OPTION_ONIGURUMA
+2019/03/22: add new options ONIG_OPTION_TEXT_SEGMENT_EXTENDED_GRAPHEME_CLUSTER and
+            ONIG_OPTION_TEXT_SEGMENT_WORD
+2019/03/21: PR #137: fix cross-compilation
+2019/03/20: update Unicode version to 12.0.0
+2019/03/17: add doc/SYNTAX.md
+2019/03/13: {n,m}+ and {n,m}? are possessive and reluctant range operator
+            in Perl syntax
+2019/03/04: fix #132: don't execute testp if ENABLE_POSIX_API == no
+2019/02/28: re-implement bytecode by using Operation struct
+2019/02/26: fix #130: Build error on UWP with VS2017
+2019/02/03: PR #128: regerror/toascii: do not attempt to serialize NULL pointer
+2019/01/30: Build breaks without autoreconf #73
+2019/01/02: fix #127: Windows VS 2008 build errors
+2018/12/19: fix #126: Unable to compile when USE_CALLOUT is not defined
+
+2018/12/11: Version 6.9.1
+
+2018/10/08: use ENC_FLAG_SKIP_OFFSET_XXX values
+2018/10/06: UTF-8 supports code range from 0x0000 to 0x10FFFF
+            (https://tools.ietf.org/html/rfc3629)
+2018/10/05: speed improvement
+2018/10/03: use OPTIMIZE_STR_CASE_FOLD_FAST
+2018/10/01: convert CRLF line endings to LF
+2018/09/27: set SIZEOF_SIZE_T for windows platforms
+2018/09/22: use Sunday quick search algorithm instead of Boyer-Moor-Horspool
+2018/09/20: introduce threaded code into match_at()
+2018/09/17: remove HAVE_STRINGS_H
+2018/09/16: remove HAVE_PROTOTYPES and HAVE_STDARG_PROTOTYPES
+2018/09/14: add a command line option '-gc' for make_unicode_property_data.py.
+2018/09/08: remove AC_HEADER_STDC
+2018/09/06: remove AC_OUTPUT macro call
+2018/09/06: remove AC_FUNC_MEMCMP, AC_HEADER_TIME, AC_C_CONST, HAVE__SETJMP and
+            HAVE_STRING_H
+2018/09/05: remove HAVE_LIMITS_H, HAVE_FLOAT_H and HAVE_STDLIB_H
+
 2018/09/03: Version 6.9.0
 
 2018/08/24: add Unicode Emoji properties
@@ -394,12 +451,12 @@ History
 2006/11/07: [dist] remove test.rb, testconv.rb and testconvu.rb.
 2006/11/07: [bug]  get_case_fold_codes_by_str() should handle 'Ss' and 'sS'
                    combination for ess-tsett.
-2006/11/07: [impl] apply_all_case_fold() doesn't need to return all 
+2006/11/07: [impl] apply_all_case_fold() doesn't need to return all
                    case character combination for multi-character folding.
                    (ONIGENC_CASE_FOLD_MULTI_CHAR)
 2006/11/07: [bug]  (thanks Byte)
                    add { 0xa3, 0xb3 } to CaseFoldMap[] for KOI8-R.
-2006/11/06: [spec] change ONIG_OPTION_FIND_LONGEST to search all of 
+2006/11/06: [spec] change ONIG_OPTION_FIND_LONGEST to search all of
                    the string range.
                    add USE_FIND_LONGEST_SEARCH_ALL_OF_RANGE.
 2006/11/02: [impl] re-implement expand_case_fold_string() for
@@ -667,7 +724,7 @@ History
 
 2006/05/11: [test] success in ruby 1.9.0 (2006-03-01) [i686-linux].
 2006/05/11: [bug]  (thanks Yuji Kaneda)
-                   dead-lock in onig_end().              
+                   dead-lock in onig_end().
 2006/05/11: [dist] update index.html.
 
 2006/05/08: Version 4.0.3
@@ -719,7 +776,7 @@ History
                    use GNU libtool/automake.
                    change configure.in and add Makefile.am, sample/Makefile.am.
                    add AUTHORS file.
-2006/01/24: [dist] test programs return exit code -1 when test fails. 
+2006/01/24: [dist] test programs return exit code -1 when test fails.
 2006/01/24: [bug] (thanks KIMURA Koichi)
                    invalid syntax definition in ONIG_SYNTAX_GREP.
                    ONIG_SYN_OP_BRACE_INTERVAL
@@ -737,7 +794,7 @@ History
 2005/11/24: [test] success in ruby 1.9.0 (2005-08-09) [i686-linux].
 2005/11/21: [test] success in ruby 1.9.0 (2005-11-20) [i386-cygwin].
 2005/11/21: [bug]  (thanks Allan Odgaard)
-                   utf-8 character comments in extended mode leads 
+                   utf-8 character comments in extended mode leads
                    invalid result.
                    ex. /(?x)(?<= # <any-utf-8 multibyte char>o\n~) /
                    fix onigenc_unicode_is_code_ctype() and
@@ -819,7 +876,7 @@ History
                    add new character encoding ONIG_ENCODING_GB18030.
 2005/06/30: [bug]  invalid ctype check for multibyte encodings.
                    ("graph", "print")
-                   fix onigenc_mb2/4_is_code_ctype(), 
+                   fix onigenc_mb2/4_is_code_ctype(),
                    eucjp_is_code_ctype() and sjis_is_code_ctype().
 2005/06/30: [bug]  invalid conversion from code point to mbc in
                    onigenc_mb4_code_to_mbc().
@@ -894,7 +951,7 @@ History
                    remove oniggnu.h from make 19.
 2005/03/01: [bug]  (thanks matz) [ruby-dev:25778]
                    uninitialized member (OptEnv.backrefed_status)
-                   was used. 
+                   was used.
 
 2005/02/19: Version 3.7.0
 
@@ -945,7 +1002,7 @@ History
 2005/01/19: [bug]  (thanks Isao Sonobe)
                    callback function argument name_end of onig_foreach_name()
                    was wrong.
-                   name key of name table should be null terminated for 
+                   name key of name table should be null terminated for
                    character encoding length.
                    add strdup_with_null(), rename onig_strdup() to k_strdup().
                    use e->name_len in i_names().
@@ -1217,7 +1274,7 @@ History
                    RelAddrType, AbsAddrType and LengthType change
                    from short int to int type for the very long string match.
 2004/06/14: [bug]  (thanks Greg A. Woods)
-                   fix nmatch argument of regexec() is smaller than 
+                   fix nmatch argument of regexec() is smaller than
                    reg->num_mem + 1 case. (POSIX API)
 2004/06/14: [spec] (thanks Greg A. Woods)
                    set pmatch to NULL if nmatch is 0 in regexec(). (POSIX API)
@@ -1397,7 +1454,7 @@ History
 2004/02/23: [new]  support ISO-8859-10. (ONIG_ENCODING_ISO_8859_10)
 2004/02/20: [bug]  fix iso_8859_4_mbc_is_case_ambig().
 2004/02/20: [new]  support ISO-8859-9. (ONIG_ENCODING_ISO_8859_9)
-2004/02/19: [bug]  correct ctype tables for ISO-8859-3, ISO-8859-4, 
+2004/02/19: [bug]  correct ctype tables for ISO-8859-3, ISO-8859-4,
                    ISO-8859-6, ISO-8859-7, ISO-8859-8, KOI8_R.
 2004/02/18: [bug]  wrong replaced name OnigSyntaxGnuOnigex.
 2004/02/17: [spec] check capture status for empty infinite loop.
@@ -1570,7 +1627,7 @@ History
 2003/11/11: [spec] add syntax op. REG_SYN_OP_VARIABLE_META_CHARS.
 2003/11/11: [spec] rename REG_SYN_OP_ESC_CAPITAL_Q_QUOTE to
                    REG_SYN_OP2_ESC_CAPITAL_Q_QUOTE,
-                   REG_SYN_OP_QMARK_GROUP_EFFECT to 
+                   REG_SYN_OP_QMARK_GROUP_EFFECT to
                    REG_SYN_OP2_QMARK_GROUP_EFFECT.
 2003/11/06: [impl] define THREAD_PASS as rb_thread_schedule() in Ruby mode.
 2003/11/05: [spec] add syntax behavior REG_SYN_WARN_REDUNDANT_NESTED_REPEAT.
@@ -1587,7 +1644,7 @@ History
 2003/10/03: [bug]  (thanks nobu)  [ruby-dev:21472]
                    sub-anchor of optimization map info was wrong
                    in concat_left_node_opt_info().
-                   ex. /^(x?y)/ = "xy" fail. 
+                   ex. /^(x?y)/ = "xy" fail.
 
 2003/09/17: Version 1.9.4
 
@@ -1650,7 +1707,7 @@ History
 2003/09/01: [dist] update doc/RE and doc/RE.ja.
 2003/08/26: [bug]  (thanks Guy Decoux)
                    should not double free node at the case TK_CC_CC_OPEN
-                   in parse_char_class().  
+                   in parse_char_class().
 
 2003/08/19: Version 1.9.3
 
@@ -1662,8 +1719,8 @@ History
                    REG_SYN_OP2_ATMARK_CAPTURE_HISTORY.
 2003/08/18: [spec] (thanks nobu)
                    don't use IMPORT in oniguruma.h and onigposix.h.
-2003/08/18: [impl] (thanks nobu) change error output to stdout in testconv.rb. 
-2003/08/18: [inst] (thanks nobu) lacked $(srcdir) in Makefile.in.  
+2003/08/18: [impl] (thanks nobu) change error output to stdout in testconv.rb.
+2003/08/18: [inst] (thanks nobu) lacked $(srcdir) in Makefile.in.
 2003/08/18: [bug]  REG_MBLEN_TABLE[SJIS][0xFD-0xFF] should be 1.
 2003/08/18: [bug]  (thanks nobu) mbctab_sjis[0x80] should be 0.
 2003/08/18: [bug]  (thanks nobu)
@@ -1692,7 +1749,7 @@ History
 2003/07/29: [new]  add regex_get_encoding(), regex_get_options() and
                    regex_get_syntax().
 2003/07/25: [spec] (thanks akr)
-                   change group(...) to shy-group(?:...) if named group is 
+                   change group(...) to shy-group(?:...) if named group is
                    used in the pattern.
                    add REG_SYN_CAPTURE_ONLY_NAMED_GROUP.
 2003/07/24: [spec] rename REG_OPTION_CAPTURE_ONLY_NAMED_GROUP to
@@ -1720,7 +1777,7 @@ History
                    set option status to effect memory in optimize_node_left().
 2003/07/07: [impl] add opcode OP_ANYCHAR_ML, OP_ANYCHAR_ML_STAR and
                    OP_ANYCHAR_ML_START_PEEK_NEXT.
-2003/07/07: [bug]  (thanks nobu) REG_MBLEN_TABLE[SJIS][0x80] should be 1. 
+2003/07/07: [bug]  (thanks nobu) REG_MBLEN_TABLE[SJIS][0x80] should be 1.
 2003/07/07: [spec] rename REG_SYN_OP_QUOTE to REG_SYN_OP_ESC_Q_QUOTE.
 
 2003/07/04: Version 1.9.1
@@ -1783,7 +1840,7 @@ History
 2003/06/12: [spec] add syntax behavior REG_SYN_WARN_FOR_CC_OP_NOT_ESCAPEED.
 2003/06/12: [spec] invalid POSIX bracket should be error.   ex. [[:upper :]]
 2003/06/11: [new]  char-class in char-class (as Java(TM)).
-2003/06/11: [spec] change AND operator in char-class from &&[..] to &&. 
+2003/06/11: [spec] change AND operator in char-class from &&[..] to &&.
 2003/06/04: [spec] {n,m}+ should not be possessive operator.
                    ex. a{3}+ should be (?:a{3})+
 2003/06/03: [bug]  should compare strings with min-length in is_not_included().
@@ -1947,7 +2004,7 @@ History
 2003/02/26: [impl] add -win option to testconv.rb.
 2003/02/25: [spec] allow to assign same name to different group.
                    add OP_BACKREF_MULTI.
-2003/02/24: [impl] reduce redundant repeat of empty target. 
+2003/02/24: [impl] reduce redundant repeat of empty target.
 	           ex. /()*/ ==> /()?/, /()+/ ==> /()/, /(?:)+/ ==> //
 2003/02/24: [impl] change condition in regex_is_allow_reverse_match().
 2003/02/24: [impl] convert i(/../, ...) functions in testconv.rb.
@@ -2016,7 +2073,7 @@ History
 2003/02/04: [bug]  typo miss in regex_region_copy().
 2003/02/04: [impl] change THREAD_PASS macro. (regint.h)
 2003/02/04: [dist] add API document file doc/API.
-2003/02/04: [tune] if sub_anchor has ANCHOR_BEGIN_LINE then 
+2003/02/04: [tune] if sub_anchor has ANCHOR_BEGIN_LINE then
                    set REG_OPTIMIZE_EXACT_BM in set_optimize_exact_info().
 2003/02/04: [spec] reimplement regex_clone() and it is obsoleted.
 2003/02/04: [bug]  add REGERR_OVER_THREAD_PASS_LIMIT_COUNT
@@ -2136,7 +2193,7 @@ History
 2002/04/01: [dist] add COPYING.
 2002/03/30: [spec] warn redundant nested repeat operator
                    in Ruby verbose mode.  ex. (?:a*)?
-2002/03/30: [spec] nested repeat operator error check should be 
+2002/03/30: [spec] nested repeat operator error check should be
                    same with GNU regex.             (thanks Guy Decoux)
 2002/03/30: [new]  add \x{hexadecimal-wide-char}.   (thanks matz)
 2002/03/27: [bug]  MBCTYPE_XXX symbol values should be same with GNU regex.
@@ -2199,7 +2256,7 @@ History
                    ex. /(?:abc){10}/
 2002/03/06: [new]  add a symbol REG_TRANSTABLE_USE_DEFAULT in regex.h.
 2002/03/06: [impl] rename RegDefaultCharCode to RegDefaultCharEncoding.
-2002/03/06: [bug]  if pattern has NULL(\000) char, infinite loop happens 
+2002/03/06: [bug]  if pattern has NULL(\000) char, infinite loop happens
                    in ScanMakeNode(). (beware of strchr(). thanks Nobu)
 2002/03/06: [bug]  range argument of ForwardSearchRange() is wrong.
                    ex. /\A.a/, /\G.a/ mismatched with "aa". (thanks Nobu)

ext/mbstring/oniguruma/README

@@ -94,7 +94,7 @@ Usage
   See doc/API for Oniguruma API.
 
   If you want to disable UChar type (== unsigned char) definition
-  in oniguruma.h, define ONIG_ESCAPE_UCHAR_COLLISION and then 
+  in oniguruma.h, define ONIG_ESCAPE_UCHAR_COLLISION and then
   include oniguruma.h.
 
   If you want to disable regex_t type definition in oniguruma.h,

ext/mbstring/oniguruma/README.md

@@ -1,4 +1,6 @@
 [![Build Status](https://travis-ci.org/kkos/oniguruma.svg?branch=master)](https://travis-ci.org/kkos/oniguruma)
+[![Code Quality: Cpp](https://img.shields.io/lgtm/grade/cpp/g/kkos/oniguruma.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/kkos/oniguruma/context:cpp)
+[![Total Alerts](https://img.shields.io/lgtm/alerts/g/kkos/oniguruma.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/kkos/oniguruma/alerts)
 
 Oniguruma
 =========
@@ -22,31 +24,58 @@ Supported character encodings:
 
 * GB18030: contributed by KUBO Takehiro
 * CP1251:  contributed by Byte
+* doc/SYNTAX.md: contributed by seanofw
 
 
-New feature of version 6.9.0
---------------------------
+Version 6.9.3 (security fix release)
+------------------------------------
+
+* Fixed CVE-2019-13224
+* Fixed CVE-2019-13225
+* Fixed many problems (found by libfuzzer programs)
+
+
+Version 6.9.2 (Reiwa)
+---------------------
+
+* add doc/SYNTAX.md
+* Update Unicode version 12.1.0
+* NEW: Unicode Text Segment mode option (?y{g}) (?y{w})  (*original)
+
+  g: Extended Grapheme Cluster mode / w: Word mode
+
+  (Unicode Standard Annex #29 [http://unicode.org/reports/tr29/])
+
+
+Version 6.9.1
+-------------
+
+* Speed improvement (* especially UTF-8)
+
+
+Version 6.9.0
+-------------
 
 * Update Unicode version 11.0.0
 * NEW: add Emoji properties
 
 
-New feature of version 6.8.2
---------------------------
+Version 6.8.2
+-------------
 
 * Fix: #80 UChar in header causes issue
 * NEW API: onig_set_callout_user_data_of_match_param()  (* omission in 6.8.0)
 * add doc/CALLOUTS.API and doc/CALLOUTS.API.ja
 
 
-New feature of version 6.8.1
---------------------------
+Version 6.8.1
+-------------
 
 * Update shared library version to 5.0.0 for API incompatible changes from 6.7.1
 
 
-New feature of version 6.8.0
---------------------------
+Version 6.8.0
+-------------
 
 * Retry-limit-in-match function enabled by default
 * NEW: configure option --enable-posix-api=no  (* enabled by default)
@@ -57,14 +86,14 @@ New feature of version 6.8.0
 * Examples of Callouts program: [callout.c](sample/callout.c), [count.c](sample/count.c), [echo.c](sample/echo.c)
 
 
-New feature of version 6.7.1
---------------------------
+Version 6.7.1
+-------------
 
 * NEW: Mechanism of retry-limit-in-match (* disabled by default)
 
 
-New feature of version 6.7.0
---------------------------
+Version 6.7.0
+-------------
 
 * NEW: hexadecimal codepoint \uHHHH
 * NEW: add ONIG_SYNTAX_ONIGURUMA (== ONIG_SYNTAX_DEFAULT)
@@ -72,17 +101,17 @@ New feature of version 6.7.0
 * Reduced size of object file
 
 
-New feature of version 6.6.0
---------------------------
+Version 6.6.0
+-------------
 
 * NEW: ASCII only mode options for character type/property (?WDSP)
-* NEW: Extended Grapheme Cluster boundary \y, \Y (*original)
+* NEW: Extended Grapheme Cluster boundary \y, \Y
 * NEW: Extended Grapheme Cluster \X
 * Range-clear (Absent-clear) operator restores previous range in retractions.
 
 
-New feature of version 6.5.0
---------------------------
+Version 6.5.0
+-------------
 
 * NEW: \K (keep)
 * NEW: \R (general newline) \N (no newline)
@@ -94,16 +123,16 @@ New feature of version 6.5.0
 * NEW: Absent stopper (?~|absent)     (*original)
 
 
-New feature of version 6.4.0
---------------------------
+Version 6.4.0
+-------------
 
 * Fix fatal problem of endless repeat on Windows
 * NEW: call zero (call the total regexp) \g<0>
 * NEW: relative backref/call by positive number \k<+n>, \g<+n>
 
 
-New feature of version 6.3.0
---------------------------
+Version 6.3.0
+-------------
 
 * NEW: octal codepoint \o{.....}
 * Fixed CVE-2017-9224
@@ -114,20 +143,20 @@ New feature of version 6.3.0
 * Fixed CVE-2017-9229
 
 
-New feature of version 6.1.2
---------------------------
+Version 6.1.2
+-------------
 
 * allow word bound, word begin and word end in look-behind.
 * NEW option: ONIG_OPTION_CHECK_VALIDITY_OF_STRING
 
-New feature of version 6.1
---------------------------
+Version 6.1
+-----------
 
 * improved doc/RE
 * NEW API: onig_scan()
 
-New feature of version 6.0
---------------------------
+Version 6.0
+-----------
 
 * Update Unicode 8.0 Property/Case-folding
 * NEW API: onig_unicode_define_user_property()
@@ -193,7 +222,7 @@ Usage
   See doc/API for Oniguruma API.
 
   If you want to disable UChar type (== unsigned char) definition
-  in oniguruma.h, define ONIG_ESCAPE_UCHAR_COLLISION and then 
+  in oniguruma.h, define ONIG_ESCAPE_UCHAR_COLLISION and then
   include oniguruma.h.
 
   If you want to disable regex_t type definition in oniguruma.h,
@@ -294,4 +323,4 @@ Source Files
 |utf32_le.c         |UTF-32LE encoding                                       |
 |unicode.c          |common codes of Unicode encoding                        |
 |unicode_fold_data.c|Unicode folding data                                    |
-|windows/testc.c    |Test program for Windowns (VC++)                        |
+|windows/testc.c    |Test program for Windows (VC++)                        |

ext/mbstring/oniguruma/doc/API

@@ -1,4 +1,4 @@
-Oniguruma API  Version 6.8.0  2018/03/13
+Oniguruma API  Version 6.9.3  2019/07/06
 
 #include <oniguruma.h>
 
@@ -92,6 +92,8 @@ Oniguruma API  Version 6.8.0  2018/03/13
                                      (alnum, alpha, blank, cntrl, digit, graph,
                                       lower, print, punct, space, upper, xdigit,
                                       word)
+      ONIG_OPTION_TEXT_SEGMENT_EXTENDED_GRAPHEME_CLUSTER  Extended Grapheme Cluster mode
+      ONIG_OPTION_TEXT_SEGMENT_WORD                       Word mode
 
   5 enc:        character encoding.
 
@@ -166,6 +168,9 @@ Oniguruma API  Version 6.8.0  2018/03/13
 # int onig_new_deluxe(regex_t** reg, const UChar* pattern, const UChar* pattern_end,
                       OnigCompileInfo* ci, OnigErrorInfo* einfo)
 
+  This function is deprecate, and it does not allow the case where
+  the encoding of pattern and target is different.
+
   Create a regex object.
   This function is deluxe version of onig_new().
 
@@ -182,7 +187,7 @@ Oniguruma API  Version 6.8.0  2018/03/13
     ci->target_enc:      target string character encoding.
     ci->syntax:          address of pattern syntax definition.
     ci->option:          compile time option.
-    ci->case_fold_flag:  character matching case fold bit flag for 
+    ci->case_fold_flag:  character matching case fold bit flag for
                          ONIG_OPTION_IGNORECASE mode.
 
        ONIGENC_CASE_FOLD_MIN:           minimum
@@ -297,6 +302,7 @@ Oniguruma API  Version 6.8.0  2018/03/13
                    const UChar* range, OnigRegion* region, OnigOptionType option)
 
   Search string and return search result and matching region.
+  Do not pass invalid byte string in the regex character encoding.
 
   normal return: match position offset (i.e.  p - str >= 0)
   not found:     ONIG_MISMATCH (< 0)
@@ -321,15 +327,19 @@ Oniguruma API  Version 6.8.0  2018/03/13
                    const UChar* start, const UChar* range, OnigRegion* region,
                    OnigOptionType option, OnigMatchParam* mp)
 
-   arguments
-   1-7:  same as onig_search()
-   8 mp: match parameter values (match_stack_limit, retry_limit_in_match)
+  Search string and return search result and matching region.
+  Do not pass invalid byte string in the regex character encoding.
+
+  arguments
+  1-7:  same as onig_search()
+  8 mp: match parameter values (match_stack_limit, retry_limit_in_match)
 
 
 # int onig_match(regex_t* reg, const UChar* str, const UChar* end, const UChar* at,
                  OnigRegion* region, OnigOptionType option)
 
   Match string and return result and matching region.
+  Do not pass invalid byte string in the regex character encoding.
 
   normal return: match length  (>= 0)
   not match:     ONIG_MISMATCH ( < 0)
@@ -351,6 +361,9 @@ Oniguruma API  Version 6.8.0  2018/03/13
                             const UChar* at, OnigRegion* region,
                             OnigOptionType option, OnigMatchParam* mp)
 
+  Match string and return result and matching region.
+  Do not pass invalid byte string in the regex character encoding.
+
    arguments
    1-6:  same as onig_match()
    7 mp: match parameter values (match_stack_limit, retry_limit_in_match)
@@ -362,6 +375,7 @@ Oniguruma API  Version 6.8.0  2018/03/13
                 void* callback_arg)
 
   Scan string and callback with matching region.
+  Do not pass invalid byte string in the regex character encoding.
 
   normal return: number of matching times
   error:         error code
@@ -609,14 +623,20 @@ Oniguruma API  Version 6.8.0  2018/03/13
 
 
 # int onigenc_strlen(OnigEncoding enc, const UChar* s, const UChar* end)
+
+  Return number of characters in the string.
+
+
 # int onigenc_strlen_null(OnigEncoding enc, const UChar* s)
 
   Return number of characters in the string.
+  Do not pass invalid byte string in the character encoding.
 
 
 # int onigenc_str_bytelen_null(OnigEncoding enc, const UChar* s)
 
   Return number of bytes in the string.
+  Do not pass invalid byte string in the character encoding.
 
 
 # int onig_set_default_syntax(OnigSyntaxType* syntax)

ext/mbstring/oniguruma/doc/API.ja

@@ -1,4 +1,4 @@
-鬼車インターフェース Version 6.8.0   2018/03/13
+鬼車インターフェース Version 6.9.3   2019/07/06
 
 #include <oniguruma.h>
 
@@ -91,6 +91,8 @@
                                      (alnum, alpha, blank, cntrl, digit, graph,
                                       lower, print, punct, space, upper, xdigit,
                                       word)
+      ONIG_OPTION_TEXT_SEGMENT_EXTENDED_GRAPHEME_CLUSTER  拡張書記素房モード
+      ONIG_OPTION_TEXT_SEGMENT_WORD                       単語モード
 
   5 enc:        文字エンコーディング
 
@@ -165,6 +167,9 @@
 # int onig_new_deluxe(regex_t** reg, const UChar* pattern, const UChar* pattern_end,
                       OnigCompileInfo* ci, OnigErrorInfo* einfo)
 
+  この関数は廃止予定。
+  パターンと対象文字列の文字エンコーディングが異なる場合を許さなくなった。
+
   正規表現オブジェクト(regex)を作成する。
   この関数は、onig_new()のデラックス版。
 
@@ -296,6 +301,7 @@
                    const UChar* range, OnigRegion* region, OnigOptionType option)
 
   正規表現で文字列を検索し、検索結果とマッチ領域を返す。
+  正規表現オブジェクトの文字エンコーディングで、検索文字列として不正な文字列を渡してはいけない。
 
   正常終了戻り値: マッチ位置 (p - str >= 0)
   検索失敗:       ONIG_MISMATCH (< 0)
@@ -320,15 +326,19 @@
                    const UChar* start, const UChar* range, OnigRegion* region,
                    OnigOptionType option, OnigMatchParam* mp)
 
+  正規表現で文字列を検索し、検索結果とマッチ領域を返す。
+  正規表現オブジェクトの文字エンコーディングで、検索文字列として不正な文字列を渡してはいけない。
+
   引数
   1-7:  onig_search()と同じ
   8 mp: マッチパラメタ値 (match_stack_limit, retry_limit_in_match)
 
 
-# int onig_match(regex_t* reg, const UChar* str, const UChar* end, const UChar* at,
-		 OnigRegion* region, OnigOptionType option)
+# int onig_match(regex_t* reg, const UChar* str, const UChar* end,
+                 const UChar* at, OnigRegion* region, OnigOptionType option)
 
   文字列の指定位置でマッチングを行い、結果とマッチ領域を返す。
+  正規表現オブジェクトの文字エンコーディングで、検索文字列として不正な文字列を渡してはいけない。
 
   正常終了戻り値: マッチしたバイト長 (>= 0)
   not match:      ONIG_MISMATCH      ( < 0)
@@ -350,6 +360,9 @@
                             const UChar* at, OnigRegion* region,
                             OnigOptionType option, OnigMatchParam* mp)
 
+  文字列の指定位置でマッチングを行い、結果とマッチ領域を返す。
+  正規表現オブジェクトの文字エンコーディングで、検索文字列として不正な文字列を渡してはいけない。
+
   引数
   1-6:  onig_match()と同じ
   7 mp: マッチパラメタ値 (match_stack_limit, retry_limit_in_match)
@@ -361,6 +374,7 @@
                 void* callback_arg)
 
   正規表現で文字列をスキャンして、マッチングする毎にコールバック関数を呼び出す。
+  正規表現オブジェクトの文字エンコーディングで、検索文字列として不正な文字列を渡してはいけない。
 
   正常終了: マッチ回数 (0回も含める)
   エラー:   エラーコード (< 0)
@@ -614,14 +628,20 @@
 
 
 # int onigenc_strlen(OnigEncoding enc, const UChar* s, const UChar* end)
+
+  文字列の文字数を返す。
+
+
 # int onigenc_strlen_null(OnigEncoding enc, const UChar* s)
 
   文字列の文字数を返す。
+  文字エンコーディングに対して、不正な文字列を渡してはいけない。
 
 
 # int onigenc_str_bytelen_null(OnigEncoding enc, const UChar* s)
 
   文字列のバイト数を返す。
+  文字エンコーディングに対して、不正な文字列を渡してはいけない。
 
 
 # int onig_set_default_syntax(OnigSyntaxType* syntax)

ext/mbstring/oniguruma/doc/RE

@@ -1,4 +1,4 @@
-Oniguruma Regular Expressions Version 6.8.0    2018/07/26
+Oniguruma Regular Expressions Version 6.9.2    2019/03/29
 
 syntax: ONIG_SYNTAX_ONIGURUMA (default)
 
@@ -81,16 +81,24 @@ syntax: ONIG_SYNTAX_ONIGURUMA (default)
 
   \O       true anychar      (?m:.)    (* original function)
 
-  \X       Extended Grapheme Cluster    (?>\O(?:\Y\O)*)
+  \X       Text Segment    \X === (?>\O(?:\Y\O)*)
 
-           \X doesn't check whether matching start position is boundary.
-           Write as \y\X if you want to ensure it.
+           The meaning of this operator changes depending on the setting of
+           the option (?y{..}).
 
-           Unicode case:
+           \X doesn't check whether matching start position is boundary or not.
+           Please write as \y\X if you want to ensure it.
+
+           [Extended Grapheme Cluster mode] (default)
+             Unicode case:
+               See [Unicode Standard Annex #29: http://unicode.org/reports/tr29/]
+
+             Not Unicode case:  \X === (?>\r\n|\O)
+
+           [Word mode]
+             Currently, this mode is supported in Unicode only.
              See [Unicode Standard Annex #29: http://unicode.org/reports/tr29/]
 
-           Not Unicode:   (?>\r\n|\O)
-
 
   Character Property
 
@@ -119,17 +127,17 @@ syntax: ONIG_SYNTAX_ONIGURUMA (default)
     ?       1 or 0 times
     *       0 or more times
     +       1 or more times
-    {n,m}   at least n but no more than m times
+    {n,m}   (n <= m)  at least n but no more than m times
     {n,}    at least n times
     {,n}    at least 0 but no more than n times ({0,n})
     {n}     n times
 
   reluctant
 
-    ??      1 or 0 times
+    ??      0 or 1 times
     *?      0 or more times
     +?      1 or more times
-    {n,m}?  at least n but not more than m times
+    {n,m}?  (n <= m)  at least n but not more than m times
     {n,}?   at least n times
     {,n}?   at least 0 but not more than n times (== {0,n}?)
 
@@ -138,8 +146,10 @@ syntax: ONIG_SYNTAX_ONIGURUMA (default)
     ?+      1 or 0 times
     *+      0 or more times
     ++      1 or more times
+    {n,m}   (n > m)  at least m but not more than n times
 
-    ({n,m}+, {n,}+, {n}+ are possessive op. in ONIG_SYNTAX_JAVA only)
+    {n,m}+, {n,}+, {n}+ are possessive operators in ONIG_SYNTAX_JAVA and
+    ONIG_SYNTAX_PERL only.
 
     ex. /a*+/ === /(?>a*)/
 
@@ -150,8 +160,6 @@ syntax: ONIG_SYNTAX_ONIGURUMA (default)
   $       end of the line
   \b      word boundary
   \B      non-word boundary
-  \y      Extended Grapheme Cluster boundary
-  \Y      Extended Grapheme Cluster non-boundary
 
   \A      beginning of string
   \Z      end of string, or before newline at the end
@@ -160,6 +168,24 @@ syntax: ONIG_SYNTAX_ONIGURUMA (default)
   \K      keep (keep start position of the result string)
 
 
+  \y      Text Segment boundary
+  \Y      Text Segment non-boundary
+
+          The meaning of these operators(\y, \Y) changes depending on the setting
+          of the option (?y{..}).
+
+          [Extended Grapheme Cluster mode] (default)
+            Unicode case:
+              See [Unicode Standard Annex #29: http://unicode.org/reports/tr29/]
+
+            Not Unicode:
+              All positions except between \r and \n.
+
+          [Word mode]
+            Currently, this mode is supported in Unicode only.
+            See [Unicode Standard Annex #29: http://unicode.org/reports/tr29/]
+
+
 
 6. Character class
 
@@ -221,20 +247,28 @@ syntax: ONIG_SYNTAX_ONIGURUMA (default)
 
   (?#...)            comment
 
-  (?imxWDSP-imxWDSP:subexp)  option on/off for subexp
+  (?imxWDSPy-imxWDSP:subexp)  option on/off for subexp
 
-                               i: ignore case
-                               m: multi-line (dot (.) also matches newline)
-                               x: extended form
-                               W: ASCII only word (\w, \p{Word}, [[:word:]])
-                                  ASCII only word bound (\b)
-                               D: ASCII only digit (\d, \p{Digit}, [[:digit:]])
-                               S: ASCII only space (\s, \p{Space}, [[:space:]])
-                               P: ASCII only POSIX properties (includes W,D,S)
-                                  (alnum, alpha, blank, cntrl, digit, graph,
-                                   lower, print, punct, space, upper, xdigit, word)
+                           i: ignore case
+                           m: multi-line (dot (.) also matches newline)
+                           x: extended form
+                           W: ASCII only word (\w, \p{Word}, [[:word:]])
+                              ASCII only word bound (\b)
+                           D: ASCII only digit (\d, \p{Digit}, [[:digit:]])
+                           S: ASCII only space (\s, \p{Space}, [[:space:]])
+                           P: ASCII only POSIX properties (includes W,D,S)
+                              (alnum, alpha, blank, cntrl, digit, graph,
+                               lower, print, punct, space, upper, xdigit, word)
 
-  (?imxWDSP-imxWDSP)  isolated option
+                           y{?}: Text Segment mode
+                              This option changes the meaning of \X, \y, \Y.
+                              Currently, this option is supported in Unicode only.
+
+                              y{g}: Extended Grapheme Cluster mode (default)
+                              y{w}: Word mode
+                              See [Unicode Standard Annex #29]
+
+  (?imxWDSPy-imxWDSP)  isolated option
 
                       * It makes a group to the next ')' or end of the pattern.
                         /ab(?i)c|def|gh/ == /ab(?i:c|def|gh)/
@@ -336,7 +370,7 @@ syntax: ONIG_SYNTAX_ONIGURUMA (default)
                else_exp can be omitted.
                Then it works as a backreference validity checker.
 
-  [ backreference validity checker ]   (* original)
+  [ Backreference validity checker ]   (* original)
 
     (?(n)), (?(-n)), (?(+n)), (?(n+level)) ...
     (?(<n>)), (?('-n')), (?(<+n>)) ...
@@ -470,10 +504,15 @@ A-1. Syntax-dependent options
 
 A-2. Original extensions
 
-   + hexadecimal digit char type  \h, \H
-   + named group                  (?<name>...), (?'name'...)
-   + named backref                \k<name>
-   + subexp call                  \g<name>, \g<group-num>
+   + hexadecimal digit char type     \h, \H
+   + true anychar                    \O
+   + text segment boundary           \y, \Y
+   + backreference validity checker  (?(...))
+   + named group                     (?<name>...), (?'name'...)
+   + named backref                   \k<name>
+   + subexp call                     \g<name>, \g<group-num>
+   + absent expression               (?~|...|...)
+   + absent stopper                  (?|...)
 
 
 A-3. Missing features compared with perl 5.8.0
@@ -528,28 +567,4 @@ A-4. Differences with Japanized GNU regex(version 0.12) of Ruby 1.8
      /(?:()|())*\1\2/ =~ ""
      /(?:\1a|())*/ =~ "a"
 
-
-A-5. Features disabled in default syntax
-
-   + capture history
-
-     (?@...) and (?@<name>...)
-
-     ex. /(?@a)*/.match("aaa") ==> [<0-1>, <1-2>, <2-3>]
-
-     see sample/listcap.c file.
-
-
-A-6. Problems
-
-   + Invalid encoding byte sequence is not checked.
-
-     ex. UTF-8
-
-     * Invalid first byte is treated as a character.
-       /./u =~ "\xa3"
-
-     * Incomplete byte sequence is not checked.
-       /\w+/ =~ "a\xf3\x8ec"
-
 // END

ext/mbstring/oniguruma/doc/RE.ja

@@ -1,4 +1,4 @@
-鬼車 正規表現 Version 6.8.0    2018/07/26
+鬼車 正規表現 Version 6.9.2    2019/03/29
 
 使用文法: ONIG_SYNTAX_ONIGURUMA (既定値)
 
@@ -54,7 +54,7 @@
              \t, \n, \v, \f, \r, \x20
 
            Unicodeの場合:
-             U+0009, U+000A, U+000B, U+000C, U+000D, U+0085(NEL), 
+             U+0009, U+000A, U+000B, U+000C, U+000D, U+0085(NEL),
              General_Category -- Line_Separator
                               -- Paragraph_Separator
                               -- Space_Separator
@@ -81,15 +81,22 @@
 
   \O       真任意文字  (?m:.)      (* 原作)
 
-  \X       拡張書記素房     (?>\O(?:\Y\O)*)
+  \X       文章区分    \X === (?>\O(?:\Y\O)*)
 
-           \Xは照合の開始位置が拡張書記素房の境界かどうかを確認しない。
+           この演算子の意味は、オプション (?y{..})の設定によって変化する。
+
+           \Xは照合の開始位置が区分の境界かどうかを確認しない。
            それを確実にしたければ、\y\Xと書けば良い。
 
-           Unicodeの場合:
-             参照 [Unicode Standard Annex #29: http://unicode.org/reports/tr29/]
+           [拡張書記素房-状態のとき] (デフォルト)
+             Unicodeの場合:
+               参照 [Unicode Standard Annex #29: http://unicode.org/reports/tr29/]
 
-           Unicode以外の場合:   (?>\r\n|\O)
+             Unicode以外の場合:  \X === (?>\r\n|\O)
+
+           [単語-状態のとき]
+             現在、Unicodeしかサポートしていない。
+             参照 [Unicode Standard Annex #29: http://unicode.org/reports/tr29/]
 
 
   Character Property
@@ -119,17 +126,17 @@
     ?       一回または零回
     *       零回以上
     +       一回以上
-    {n,m}   n回以上m回以下
+    {n,m}   (n <= m)  n回以上 かつ m回以下
     {n,}    n回以上
     {,n}    零回以上n回以下 ({0,n})
     {n}     n回
 
   無欲
 
-    ??      一回または零回
+    ??      零回または一回
     *?      零回以上
     +?      一回以上
-    {n,m}?  n回以上m回以下
+    {n,m}?  (n <= m)  n回以上 かつ m回以下
     {n,}?   n回以上
     {,n}?   零回以上n回以下 (== {0,n}?)
 
@@ -138,8 +145,9 @@
     ?+      一回または零回
     *+      零回以上
     ++      一回以上
+    {n,m}   (n > m)  m回以上 かつ n回以下
 
-    ({n,m}+, {n,}+, {n}+ は、ONIG_SYNTAX_JAVAでのみ強欲な指定子)
+    {n,m}+, {n,}+, {n}+ は、ONIG_SYNTAX_JAVAとONIG_SYNTAX_PERLでのみ強欲な指定子
 
     例. /a*+/ === /(?>a*)/
 
@@ -150,8 +158,6 @@
   $       行末
   \b      単語境界
   \B      非単語境界
-  \y      拡張書記素房 境界
-  \Y      拡張書記素房 非境界
 
   \A      文字列先頭
   \Z      文字列末尾、または文字列末尾の改行の直前
@@ -160,6 +166,23 @@
   \K      保持 (結果の開始位置をこの位置に保つ)
 
 
+  \y      文章区分 境界
+  \Y      文章区分 非境界
+
+          この演算子の意味は、オプション (?y{..})の設定によって変化する。
+
+           [拡張書記素房-状態のとき] (デフォルト)
+             Unicodeの場合:
+               参照 [Unicode Standard Annex #29: http://unicode.org/reports/tr29/]
+
+             Unicode以外の場合:
+               \rと\nの間を除く全ての位置
+
+           [単語-状態のとき]
+             現在、Unicodeしかサポートしていない。
+             参照 [Unicode Standard Annex #29: http://unicode.org/reports/tr29/]
+
+
 
 6. 文字集合
 
@@ -220,7 +243,7 @@
 
   (?#...)           注釈
 
-  (?imxWDSP-imxWDSP:式)   式オプション
+  (?imxWDSPy-imxWDSP:式)   式オプション
 
                             i: 大文字小文字照合
                             m: 複数行
@@ -233,7 +256,14 @@
                                (alnum, alpha, blank, cntrl, digit, graph,
                                 lower, print, punct, space, upper, xdigit, word)
 
-  (?imxWDSP-imxWDSP)  孤立オプション
+                            y{?}: 文章区分状態
+                               このオプションは\X, \y, \Yの意味を変更する。
+                               現在このオプションはUnicodeでしかサポートしていない
+                               y{g}: 拡張書記素房-状態 (デフォルト)
+                               y{w}: 単語-状態
+                                     参照 [Unicode Standard Annex #29]
+
+  (?imxWDSPy-imxWDSP)  孤立オプション
 
                       * これは次の')'またはパターンの終わりまでのグループを形成する
                         /ab(?i)c|def|gh/ == /ab(?i:c|def|gh)/
@@ -482,9 +512,14 @@
 補記 2. 独自拡張機能
 
    + 16進数数字、非16進数字  \h, \H
+   + 真任意文字              \O
+   + 文章区分境界            \y, \Y
+   + 後方参照値有効性確認器  (?(...))
    + 名前付き捕獲式集合      (?<name>...), (?'name'...)
    + 名前指定後方参照        \k<name>
    + 部分式呼出し            \g<name>, \g<group-num>
+   + 不在式                 (?~|...|...)
+   + 不在停止               (?|...)
 
 
 補記 3. Perl 5.8.0と比較して存在しない機能
@@ -539,35 +574,4 @@
      /(?:()|())*\1\2/ =~ ""
      /(?:\1a|())*/ =~ "a"
 
-
-
-補記 5. 実装されているが、既定値では有効にしていない機能
-
-   + 捕獲履歴参照
-
-     (?@...) と (?@<name>...)
-
-     例. /(?@a)*/.match("aaa") ==> [<0-1>, <1-2>, <2-3>]
-
-     使用方法は、sample/listcap.cを参照
-
-     有効にしていない理由は、どの程度役に立つかはっきりしないため。
-
-
-補記 6. 問題点
-
-   + エンコーディングバイト値が適正な価かどうかのチェックは行なっていない。
-
-     例: UTF-8
-
-     * 先頭バイトとして不正なバイトを一文字とみなす
-       /./u =~ "\xa3"
-
-     * 不完全なバイトシーケンスのチェックをしない
-      /\w+/u =~ "a\xf3\x8ec"
-
-     これを調べることは可能ではあるが、遅くなるので行なわない。
-
-     文字列として、そのようなバイト列を指定した場合の動作は保証しない。
-
 終り

ext/mbstring/oniguruma/index.html

@@ -8,7 +8,7 @@
 <h1>Oniguruma</h1> (<a href="index_ja.html">Japanese</a>)
 
 <p>
-(c) K.Kosako, updated at: 2018/08/31
+(c) K.Kosako, updated at: 2019/08/05
 </p>
 
 <dl>
@@ -16,6 +16,9 @@
 <dt><b>What's new</b>
 </font>
 <ul>
+<li>2019/08/06: Version 6.9.3 released.</li>
+<li>2019/05/07: Version 6.9.2 released.</li>
+<li>2018/12/11: Version 6.9.1 released.</li>
 <li>2018/09/03: Version 6.9.0 released.</li>
 <li>2018/04/17: Version 6.8.2 released.</li>
 <li>2018/03/19: Version 6.8.1 released.</li>

ext/mbstring/oniguruma/index_ja.html

@@ -8,7 +8,7 @@
 <h1>鬼車</h1>
 
 <p>
-(c) K.Kosako, 最終更新: 2018/09/03
+(c) K.Kosako, 最終更新: 2019/08/05
 </p>
 
 <dl>
@@ -16,6 +16,9 @@
 <dt><b>更新情報</b>
 </font>
 <ul>
+<li>2019/08/06: Version 6.9.3 リリース</li>
+<li>2019/05/07: Version 6.9.2 リリース</li>
+<li>2018/12/11: Version 6.9.1 リリース</li>
 <li>2018/09/03: Version 6.9.0 リリース</li>
 <li>2018/04/17: Version 6.8.2 リリース</li>
 <li>2018/03/19: Version 6.8.1 リリース</li>

ext/mbstring/oniguruma/src/ascii.c

@@ -113,6 +113,6 @@ OnigEncodingType OnigEncodingASCII = {
   init,
   0, /* is_initialized */
   onigenc_always_true_is_valid_mbc_string,
-  ENC_FLAG_ASCII_COMPATIBLE,
+  ENC_FLAG_ASCII_COMPATIBLE|ENC_FLAG_SKIP_OFFSET_1,
   0, 0
 };

ext/mbstring/oniguruma/src/big5.c

@@ -102,7 +102,7 @@ big5_mbc_case_fold(OnigCaseFoldType flag, const UChar** pp, const UChar* end,
 #if 0
 static int
 big5_is_mbc_ambiguous(OnigCaseFoldType flag,
-		      const UChar** pp, const UChar* end)
+                      const UChar** pp, const UChar* end)
 {
   return onigenc_mbn_is_mbc_ambiguous(ONIG_ENCODING_BIG5, flag, pp, end);
 }
@@ -148,10 +148,10 @@ big5_left_adjust_char_head(const UChar* start, const UChar* s)
   if (BIG5_ISMB_TRAIL(*p)) {
     while (p > start) {
       if (! BIG5_ISMB_FIRST(*--p)) {
-	p++;
-	break;
+        p++;
+        break;
       }
-    } 
+    }
   }
   len = enclen(ONIG_ENCODING_BIG5, p);
   if (p + len > s) return (UChar* )p;
@@ -187,6 +187,6 @@ OnigEncodingType OnigEncodingBIG5 = {
   NULL, /* init */
   NULL, /* is_initialized */
   is_valid_mbc_string,
-  ENC_FLAG_ASCII_COMPATIBLE,
+  ENC_FLAG_ASCII_COMPATIBLE|ENC_FLAG_SKIP_OFFSET_1,
   0, 0
 };

ext/mbstring/oniguruma/src/cp1251.c

@@ -164,7 +164,7 @@ static const OnigPairCaseFoldCodes CaseFoldMap[] = {
 
 static int
 cp1251_apply_all_case_fold(OnigCaseFoldType flag,
-			       OnigApplyAllCaseFoldFunc f, void* arg)
+                           OnigApplyAllCaseFoldFunc f, void* arg)
 {
   return onigenc_apply_all_case_fold_with_map(
              sizeof(CaseFoldMap)/sizeof(OnigPairCaseFoldCodes), CaseFoldMap, 0,
@@ -176,8 +176,8 @@ cp1251_get_case_fold_codes_by_str(OnigCaseFoldType flag,
     const OnigUChar* p, const OnigUChar* end, OnigCaseFoldCodeItem items[])
 {
   return onigenc_get_case_fold_codes_by_str_with_map(
-	     sizeof(CaseFoldMap)/sizeof(OnigPairCaseFoldCodes), CaseFoldMap, 0,
-	     flag, p, end, items);
+                 sizeof(CaseFoldMap)/sizeof(OnigPairCaseFoldCodes), CaseFoldMap, 0,
+                 flag, p, end, items);
 }
 
 OnigEncodingType OnigEncodingCP1251 = {
@@ -200,6 +200,6 @@ OnigEncodingType OnigEncodingCP1251 = {
   NULL, /* init */
   NULL, /* is_initialized */
   onigenc_always_true_is_valid_mbc_string,
-  ENC_FLAG_ASCII_COMPATIBLE,
+  ENC_FLAG_ASCII_COMPATIBLE|ENC_FLAG_SKIP_OFFSET_1,
   0, 0
 };

ext/mbstring/oniguruma/src/euc_jp.c

@@ -151,13 +151,13 @@ code_to_mbc(OnigCodePoint code, UChar *buf)
 #if 1
   if (enclen(ONIG_ENCODING_EUC_JP, buf) != (p - buf))
     return ONIGERR_INVALID_CODE_POINT_VALUE;
-#endif  
+#endif
   return (int )(p - buf);
 }
 
 static int
 mbc_case_fold(OnigCaseFoldType flag ARG_UNUSED,
-	      const UChar** pp, const UChar* end ARG_UNUSED, UChar* lower)
+              const UChar** pp, const UChar* end ARG_UNUSED, UChar* lower)
 {
   int len;
   const UChar* p = *pp;
@@ -269,7 +269,7 @@ is_code_ctype(OnigCodePoint code, unsigned int ctype)
 
 static int
 get_ctype_code_range(OnigCtype ctype, OnigCodePoint* sb_out,
-		     const OnigCodePoint* ranges[])
+                     const OnigCodePoint* ranges[])
 {
   if (ctype <= ONIGENC_MAX_STD_CTYPE) {
     return ONIG_NO_SUPPORT_CONFIG;
@@ -307,6 +307,6 @@ OnigEncodingType OnigEncodingEUC_JP = {
   NULL, /* init */
   NULL, /* is_initialized */
   is_valid_mbc_string,
-  ENC_FLAG_ASCII_COMPATIBLE,
+  ENC_FLAG_ASCII_COMPATIBLE|ENC_FLAG_SKIP_OFFSET_1_OR_0,
   0, 0
 };

ext/mbstring/oniguruma/src/euc_jp_prop.c

@@ -1,5 +1,5 @@
 /* ANSI-C code produced by gperf version 3.1 */
-/* Command-line: /usr/bin/gperf -pt -T -L ANSI-C -N onigenc_euc_jp_lookup_property_name --output-file gperf1.tmp euc_jp_prop.gperf  */
+/* Command-line: /usr/local/bin/gperf -pt -T -L ANSI-C -N onigenc_euc_jp_lookup_property_name --output-file gperf1.tmp euc_jp_prop.gperf  */
 /* Computed positions: -k'1,3' */
 
 #if !((' ' == 32) && ('!' == 33) && ('"' == 34) && ('#' == 35) \

ext/mbstring/oniguruma/src/euc_kr.c

@@ -68,7 +68,7 @@ is_valid_mbc_string(const UChar* p, const UChar* end)
       p++;
       if (p >= end) return FALSE;
       if (*p < 0xa1 || *p == 0xff)
-	return FALSE;
+        return FALSE;
       p++;
     }
     else
@@ -101,7 +101,7 @@ euckr_mbc_case_fold(OnigCaseFoldType flag, const UChar** pp, const UChar* end,
 #if 0
 static int
 euckr_is_mbc_ambiguous(OnigCaseFoldType flag,
-		       const UChar** pp, const UChar* end)
+                       const UChar** pp, const UChar* end)
 {
   return onigenc_mbn_is_mbc_ambiguous(ONIG_ENCODING_EUC_KR, flag, pp, end);
 }
@@ -161,7 +161,9 @@ OnigEncodingType OnigEncodingEUC_KR = {
   euckr_is_allowed_reverse_match,
   NULL, /* init */
   NULL, /* is_initialized */
-  is_valid_mbc_string
+  is_valid_mbc_string,
+  ENC_FLAG_ASCII_COMPATIBLE|ENC_FLAG_SKIP_OFFSET_1_OR_0,
+  0, 0  
 };
 
 /* Same with OnigEncodingEUC_KR except the name */
@@ -185,6 +187,6 @@ OnigEncodingType OnigEncodingEUC_CN = {
   NULL, /* init */
   NULL, /* is_initialized */
   is_valid_mbc_string,
-  ENC_FLAG_ASCII_COMPATIBLE,
+  ENC_FLAG_ASCII_COMPATIBLE|ENC_FLAG_SKIP_OFFSET_1_OR_0,
   0, 0
 };

ext/mbstring/oniguruma/src/euc_tw.c

@@ -63,27 +63,27 @@ is_valid_mbc_string(const UChar* p, const UChar* end)
     }
     else if (*p < 0xa1) {
       if (*p == 0x8e) {
-	p++;
-	if (p >= end) return FALSE;
-	if (*p < 0xa1 || *p > 0xb0) return FALSE;
-	p++;
-	if (p >= end) return FALSE;
-	if (*p < 0xa1 || *p == 0xff)
-	  return FALSE;
-	p++;
-	if (p >= end) return FALSE;
-	if (*p < 0xa1 || *p == 0xff)
-	  return FALSE;
-	p++;
+        p++;
+        if (p >= end) return FALSE;
+        if (*p < 0xa1 || *p > 0xb0) return FALSE;
+        p++;
+        if (p >= end) return FALSE;
+        if (*p < 0xa1 || *p == 0xff)
+          return FALSE;
+        p++;
+        if (p >= end) return FALSE;
+        if (*p < 0xa1 || *p == 0xff)
+          return FALSE;
+        p++;
       }
       else
-	return FALSE;
+        return FALSE;
     }
     else if (*p < 0xff) {
       p++;
       if (p >= end) return FALSE;
       if (*p < 0xa1 || *p == 0xff)
-	return FALSE;
+        return FALSE;
       p++;
     }
     else
@@ -168,6 +168,6 @@ OnigEncodingType OnigEncodingEUC_TW = {
   NULL, /* init */
   NULL, /* is_initialized */
   is_valid_mbc_string,
-  ENC_FLAG_ASCII_COMPATIBLE,
+  ENC_FLAG_ASCII_COMPATIBLE|ENC_FLAG_SKIP_OFFSET_1,
   0, 0
 };

ext/mbstring/oniguruma/src/gb18030.c

@@ -2,7 +2,7 @@
   gb18030.c -  Oniguruma (regular expression library)
 **********************************************************************/
 /*-
- * Copyright (c) 2005-2018  KUBO Takehiro <kubo AT jiubao DOT org>
+ * Copyright (c) 2005-2019  KUBO Takehiro <kubo AT jiubao DOT org>
  *                          K.Kosako <sndgk393 AT ybb DOT ne DOT jp>
  * All rights reserved.
  *
@@ -67,11 +67,11 @@ gb18030_mbc_enc_len(const UChar* p)
 {
   if (GB18030_MAP[*p] != CM)
     return 1;
+
   p++;
   if (GB18030_MAP[*p] == C4)
     return 4;
-  if (GB18030_MAP[*p] == C1)
-    return 1; /* illegal sequence */
+
   return 2;
 }
 
@@ -535,6 +535,6 @@ OnigEncodingType OnigEncodingGB18030 = {
   NULL, /* init */
   NULL, /* is_initialized */
   is_valid_mbc_string,
-  ENC_FLAG_ASCII_COMPATIBLE,
+  ENC_FLAG_ASCII_COMPATIBLE|ENC_FLAG_SKIP_OFFSET_1,
   0, 0
 };

ext/mbstring/oniguruma/src/iso8859_1.c

@@ -103,7 +103,7 @@ static const OnigPairCaseFoldCodes CaseFoldMap[] = {
 
 static int
 apply_all_case_fold(OnigCaseFoldType flag,
-		    OnigApplyAllCaseFoldFunc f, void* arg)
+                    OnigApplyAllCaseFoldFunc f, void* arg)
 {
   return onigenc_apply_all_case_fold_with_map(
             sizeof(CaseFoldMap)/sizeof(OnigPairCaseFoldCodes), CaseFoldMap, 1,
@@ -112,15 +112,15 @@ apply_all_case_fold(OnigCaseFoldType flag,
 
 static int
 get_case_fold_codes_by_str(OnigCaseFoldType flag ARG_UNUSED,
-			   const OnigUChar* p, const OnigUChar* end,
-			   OnigCaseFoldCodeItem items[])
+                           const OnigUChar* p, const OnigUChar* end,
+                           OnigCaseFoldCodeItem items[])
 {
   if (0x41 <= *p && *p <= 0x5a) {
     items[0].byte_len = 1;
     items[0].code_len = 1;
     items[0].code[0] = (OnigCodePoint )(*p + 0x20);
     if (*p == 0x53 && end > p + 1
-	&& (*(p+1) == 0x53 || *(p+1) == 0x73)) { /* SS */
+        && (*(p+1) == 0x53 || *(p+1) == 0x73)) { /* SS */
       items[1].byte_len = 2;
       items[1].code_len = 1;
       items[1].code[0] = (OnigCodePoint )0xdf;
@@ -134,7 +134,7 @@ get_case_fold_codes_by_str(OnigCaseFoldType flag ARG_UNUSED,
     items[0].code_len = 1;
     items[0].code[0] = (OnigCodePoint )(*p - 0x20);
     if (*p == 0x73 && end > p + 1
-	&& (*(p+1) == 0x73 || *(p+1) == 0x53)) { /* ss */
+        && (*(p+1) == 0x73 || *(p+1) == 0x53)) { /* ss */
       items[1].byte_len = 2;
       items[1].code_len = 1;
       items[1].code[0] = (OnigCodePoint )0xdf;
@@ -200,7 +200,7 @@ get_case_fold_codes_by_str(OnigCaseFoldType flag ARG_UNUSED,
 
 static int
 mbc_case_fold(OnigCaseFoldType flag, const UChar** pp,
-	      const UChar* end ARG_UNUSED, UChar* lower)
+              const UChar* end ARG_UNUSED, UChar* lower)
 {
   const UChar* p = *pp;
 
@@ -218,8 +218,7 @@ mbc_case_fold(OnigCaseFoldType flag, const UChar** pp,
 
 #if 0
 static int
-is_mbc_ambiguous(OnigCaseFoldType flag,
-		 const UChar** pp, const UChar* end)
+is_mbc_ambiguous(OnigCaseFoldType flag, const UChar** pp, const UChar* end)
 {
   int v;
   const UChar* p = *pp;
@@ -272,6 +271,6 @@ OnigEncodingType OnigEncodingISO_8859_1 = {
   NULL, /* init */
   NULL, /* is_initialized */
   onigenc_always_true_is_valid_mbc_string,
-  ENC_FLAG_ASCII_COMPATIBLE,
+  ENC_FLAG_ASCII_COMPATIBLE|ENC_FLAG_SKIP_OFFSET_1,
   0, 0
 };

ext/mbstring/oniguruma/src/iso8859_10.c

@@ -105,7 +105,7 @@ static const unsigned short EncISO_8859_10_CtypeTable[256] = {
 
 static int
 mbc_case_fold(OnigCaseFoldType flag,
-	      const UChar** pp, const UChar* end ARG_UNUSED, UChar* lower)
+              const UChar** pp, const UChar* end ARG_UNUSED, UChar* lower)
 {
   const UChar* p = *pp;
 
@@ -203,7 +203,7 @@ static const OnigPairCaseFoldCodes CaseFoldMap[] = {
 
 static int
 apply_all_case_fold(OnigCaseFoldType flag,
-		    OnigApplyAllCaseFoldFunc f, void* arg)
+                    OnigApplyAllCaseFoldFunc f, void* arg)
 {
   return onigenc_apply_all_case_fold_with_map(
              sizeof(CaseFoldMap)/sizeof(OnigPairCaseFoldCodes), CaseFoldMap, 1,
@@ -215,8 +215,8 @@ get_case_fold_codes_by_str(OnigCaseFoldType flag,
     const OnigUChar* p, const OnigUChar* end, OnigCaseFoldCodeItem items[])
 {
   return onigenc_get_case_fold_codes_by_str_with_map(
-	     sizeof(CaseFoldMap)/sizeof(OnigPairCaseFoldCodes), CaseFoldMap, 1,
-	     flag, p, end, items);
+                 sizeof(CaseFoldMap)/sizeof(OnigPairCaseFoldCodes), CaseFoldMap, 1,
+                 flag, p, end, items);
 }
 
 OnigEncodingType OnigEncodingISO_8859_10 = {
@@ -239,6 +239,6 @@ OnigEncodingType OnigEncodingISO_8859_10 = {
   NULL, /* init */
   NULL, /* is_initialized */
   onigenc_always_true_is_valid_mbc_string,
-  ENC_FLAG_ASCII_COMPATIBLE,
+  ENC_FLAG_ASCII_COMPATIBLE|ENC_FLAG_SKIP_OFFSET_1,
   0, 0
 };

ext/mbstring/oniguruma/src/iso8859_11.c

@@ -96,6 +96,6 @@ OnigEncodingType OnigEncodingISO_8859_11 = {
   NULL, /* init */
   NULL, /* is_initialized */
   onigenc_always_true_is_valid_mbc_string,
-  ENC_FLAG_ASCII_COMPATIBLE,
+  ENC_FLAG_ASCII_COMPATIBLE|ENC_FLAG_SKIP_OFFSET_1,
   0, 0
 };

ext/mbstring/oniguruma/src/iso8859_13.c

@@ -105,7 +105,7 @@ static const unsigned short EncISO_8859_13_CtypeTable[256] = {
 
 static int
 mbc_case_fold(OnigCaseFoldType flag,
-	      const UChar** pp, const UChar* end ARG_UNUSED, UChar* lower)
+              const UChar** pp, const UChar* end ARG_UNUSED, UChar* lower)
 {
   const UChar* p = *pp;
 
@@ -192,7 +192,7 @@ static const OnigPairCaseFoldCodes CaseFoldMap[] = {
 
 static int
 apply_all_case_fold(OnigCaseFoldType flag,
-		    OnigApplyAllCaseFoldFunc f, void* arg)
+                    OnigApplyAllCaseFoldFunc f, void* arg)
 {
   return onigenc_apply_all_case_fold_with_map(
              sizeof(CaseFoldMap)/sizeof(OnigPairCaseFoldCodes), CaseFoldMap, 1,
@@ -204,8 +204,8 @@ get_case_fold_codes_by_str(OnigCaseFoldType flag,
    const OnigUChar* p, const OnigUChar* end, OnigCaseFoldCodeItem items[])
 {
   return onigenc_get_case_fold_codes_by_str_with_map(
-	     sizeof(CaseFoldMap)/sizeof(OnigPairCaseFoldCodes), CaseFoldMap, 1,
-	     flag, p, end, items);
+                 sizeof(CaseFoldMap)/sizeof(OnigPairCaseFoldCodes), CaseFoldMap, 1,
+                 flag, p, end, items);
 }
 
 OnigEncodingType OnigEncodingISO_8859_13 = {
@@ -228,6 +228,6 @@ OnigEncodingType OnigEncodingISO_8859_13 = {
   NULL, /* init */
   NULL, /* is_initialized */
   onigenc_always_true_is_valid_mbc_string,
-  ENC_FLAG_ASCII_COMPATIBLE,
+  ENC_FLAG_ASCII_COMPATIBLE|ENC_FLAG_SKIP_OFFSET_1,
   0, 0
 };