Update versions for PHP 7.2.24

Update NEWS for PHP 7.2.24
add NEWS entry for CVE-2019-11043
2026-11-12 11:40:50 +00:00 · 2019-10-22 08:15:44 +00:00 · 2019-10-22 08:15:44 +00:00 · 2019-10-22 09:36:13 +02:00 · 2019-10-22 09:34:42 +02:00 · 2019-10-08 09:24:52 +00:00
123 changed files with 2917 additions and 204 deletions
@@ -16,7 +16,7 @@ environment:
        PHP_BUILD_CACHE_BASE_DIR: c:\build-cache
        PHP_BUILD_OBJ_DIR: c:\obj
        PHP_BUILD_CACHE_SDK_DIR: c:\build-cache\sdk
-        PHP_BUILD_SDK_BRANCH: php-sdk-2.2.0beta6
+        PHP_BUILD_SDK_BRANCH: php-sdk-2.2.0
        PHP_BUILD_CRT: vc15
        # ext and env setup for tests
        #MYSQL_TEST_PASSWD: Password12!
@@ -1,9 +1,84 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2019, PHP 7.2.22
+24 Oct 2019, PHP 7.2.24
+
+
+- Core:
+  . Fixed bug #78535 (auto_detect_line_endings value not parsed as bool).
+    (bugreportuser)
+  . Fixed bug #78620 (Out of memory error). (cmb, Nikita)
+
+- Exif:
+  . Fixed bug #78442 ('Illegal component' on exif_read_data since PHP7)
+	(Kalle)
+
+- FPM:
+  . Fixed bug #78599 (env_path_info underflow in fpm_main.c can lead to RCE).
+    (CVE-2019-11043) (Jakub Zelenka)
+
+- MBString:
+  . Fixed bug #78579 (mb_decode_numericentity: args number inconsistency).
+    (cmb)
+  . Fixed bug #78609 (mb_check_encoding() no longer supports stringable
+    objects). (cmb)
+
+- MySQLi:
+  . Fixed bug #76809 (SSL settings aren't respected when persistent connections 
+    are used). (fabiomsouto)
+
+- PDO_MySQL:
+  . Fixed bug #78623 (Regression caused by "SP call yields additional empty
+    result set"). (cmb)
+
+- Session:
+  . Fixed bug #78624 (session_gc return value for user defined session 
+    handlers). (bshaffer)
+
+- Standard:
+  . Fixed bug #76342 (file_get_contents waits twice specified timeout).
+    (Thomas Calvet)
+  . Fixed bug #78612 (strtr leaks memory when integer keys are used and the
+    subject string shorter). (Nikita)
+  . Fixed bug #76859 (stream_get_line skips data if used with data-generating 
+    filter). (kkopachev)
+
+- Zip:
+  . Fixed bug #78641 (addGlob can modify given remove_path value). (cmb)
+
+26 Sep 2019, PHP 7.2.23
+
+- Core:
+  . Fixed bug #78220 (Can't access OneDrive folder). (cmb, ab)
+  . Fixed bug #78412 (Generator incorrectly reports non-releasable $this as GC
+    child). (Nikita)
+
+- FastCGI:
+  . Fixed bug #78469 (FastCGI on_accept hook is not called when using named
+    pipes on Windows). (Sergei Turchanov)
+
+- MySQLnd:
+  . Fixed connect_attr issues and added the _server_host connection attribute.
+    (Qianqian Bu)
+
+- ODBC:
+  . Fixed bug #78473 (odbc_close() closes arbitrary resources). (cmb)
+
+- PDO_MySQL:
+  . Fixed bug #41997 (SP call yields additional empty result set). (cmb)
+
+- sodium:
+  . Fixed bug #78510 (Partially uninitialized buffer returned by
+    sodium_crypto_generichash_init()). (Frank Denis, cmb)
+
+- SPL:
+  . Fixed bug #72884 (SplObject isCloneable() returns true but errs on clone).
+    (Chu Zhaowei)
+
+29 Aug 2019, PHP 7.2.22

 - Core:
  . Fixed bug #78363 (Buffer overflow in zendparse). (Nikita)
+  . Fixed bug #78379 (Cast to object confuses GC, causes crash). (Dmitry)

 - Curl:
  . Fixed bug #77946 (Bad cURL resources returned by curl_multi_info_read()).
@@ -23,9 +98,14 @@ PHP                                                                        NEWS
 - MySQLnd:
  . Fixed bug #78179 (MariaDB server version incorrectly detected). (cmb)

+- Opcache:
+  . Fixed bug #77191 (Assertion failure in dce_live_ranges() when silencing is
+    used). (Nikita)
+
 - Standard:
  . Fixed bug #69100 (Bus error from stream_copy_to_stream (file -> SSL stream)
    with invalid length). (Nikita)
+  . Fixed bug #78282 (atime and mtime mismatch). (cmb)
  . Fixed bug #78326 (improper memory deallocation on stream_get_contents()
    with fixed length buffer). (Albert Casademont)

@@ -130,6 +210,10 @@ PHP                                                                        NEWS

 30 May 2019, PHP 7.2.19

+- Date:
+  . Fixed bug #77909 (DatePeriod::__construct() with invalid recurrence count
+    value). (Ignace Nyamagana Butera)
+
 - EXIF:
  . Fixed bug #77988 (heap-buffer-overflow on php_jpg_get16).
    (CVE-2019-11040) (Stas)
@@ -176,10 +260,6 @@ PHP                                                                        NEWS
  . Fixed bug #77794 (Incorrect Date header format in built-in server).
    (kelunik)

- Date:
-  . Fixed bug #77909 (DatePeriod::__construct() with invalid recurrence count
-    value). (Ignace Nyamagana Butera)
-
 - EXIF
  . Fixed bug #77950 (Heap-buffer-overflow in _estrndup via exif_process_IFD_TAG).
    (CVE-2019-11036) (Stas)
@@ -804,7 +804,7 @@ static zend_always_inline void UnixTimeToFileTime(time_t t, LPFILETIME pft) /* {
 	// Note that LONGLONG is a 64-bit value
 	LONGLONG ll;

-	ll = t * 10000000 + 116444736000000000;
+	ll = t * 10000000LL + 116444736000000000LL;
 	pft->dwLowDateTime = (DWORD)ll;
 	pft->dwHighDateTime = ll >> 32;
 }
@@ -140,6 +140,7 @@ assert(0 && ($a = function () {
    if ($a) {
    } elseif ($b) {
    }
+    if ($a); else;
 }));

 ?>
@@ -292,4 +293,7 @@ Warning: assert(): assert(0 && ($a = function () {
    if ($a) {
    } elseif ($b) {
    }
+    if ($a) {
+    } else {
+    }
 })) failed in %sexpect_015.php on line %d
@@ -0,0 +1,32 @@
+--TEST--
+Bug #78379 (Cast to object confuses GC, causes crash)
+--INI--
+opcache.enable=0
+--FILE--
+<?php
+class C {
+	public function __construct() {
+		$this->p = (object)["x" => [1]];
+	}
+}
+class E {
+}
+$e = new E;
+$e->f = new E;
+$e->f->e = $e;
+$e->a = new C;
+$e = null;
+gc_collect_cycles();
+var_dump(new C);
+?>
+--EXPECTF--
+object(C)#%d (1) {
+  ["p"]=>
+  object(stdClass)#%d (1) {
+    ["x"]=>
+    array(1) {
+      [0]=>
+      int(1)
+    }
+  }
+}
@@ -0,0 +1,19 @@
+--TEST--
+Bug #78379.2 (Cast to object confuses GC, causes crash)
+--FILE--
+<?php
+class E {}
+function f() {
+	$e1 = new E;
+	$e2 = new E;
+	$a = ['e2' => $e2];
+	$e1->a = (object)$a;
+	$e2->e1 = $e1;
+	$e2->a = (object)$a;
+}
+f();
+gc_collect_cycles();
+echo "End\n";
+?>
+--EXPECT--
+End
@@ -0,0 +1,11 @@
+--TEST--
+Immediately invoked closure with extra args
+--FILE--
+<?php
+
+(function() {})(new stdClass);
+
+?>
+===DONE===
+--EXPECT--
+===DONE===
@@ -0,0 +1,35 @@
+--TEST--
+GC 041: Handling of references in nested data of objects with destructor
+--INI--
+zend.enable_gc = 1
+--FILE--
+<?php
+class ryat {
+	    var $ryat;
+        var $chtg;
+        var $nested;
+	    function __destruct() {
+	            $GLOBALS['x'] = $this;
+        }
+}
+$o = new ryat;
+$o->nested = [];
+$o->nested[] =& $o->nested;
+$o->ryat = $o;
+$x =& $o->chtg;
+unset($o);
+gc_collect_cycles();
+var_dump($x);
+?>
+--EXPECT--
+object(ryat)#1 (3) {
+  ["ryat"]=>
+  *RECURSION*
+  ["chtg"]=>
+  *RECURSION*
+  ["nested"]=>
+  &array(1) {
+    [0]=>
+    *RECURSION*
+  }
+}
@@ -0,0 +1,26 @@
+--TEST--
+Object properties HT may need to be removed from nested data
+--FILE--
+<?php
+
+class Test {
+    public function __destruct() {
+        $GLOBALS['x'] = $this;
+    }
+}
+
+$t = new Test;
+$t->x = new stdClass;
+$t->x->t = $t;
+$a = (array) $t->x;
+unset($t, $a);
+gc_collect_cycles();
+var_dump($x);
+
+// TODO: The destructor *should* be running here, but doesn't.
+// This works in PHP >= 7.3 though.
+
+?>
+--EXPECTF--
+Notice: Undefined variable: x in %s on line %d
+NULL
@@ -0,0 +1,8 @@
+--TEST--
+Using __COMPILER_HALF_OFFSET__ with trailing {} (OSS-Fuzz #17895)
+--FILE--
+<?php
+__COMPILER_HALT_OFFSET__;
+{}
+--EXPECTF--
+Warning: Use of undefined constant __COMPILER_HALT_OFFSET__ - assumed '__COMPILER_HALT_OFFSET__' (this will throw an Error in a future version of PHP) in %s on line %d
@@ -0,0 +1,17 @@
+--TEST--
+Memory leak on ** with result==op1 array
+--FILE--
+<?php
+
+$x = [0];
+$x **= 1;
+var_dump($x);
+
+$x = [0];
+$x **= $x;
+var_dump($x);
+
+?>
+--EXPECT--
+int(0)
+int(0)
@@ -980,7 +980,7 @@ get_chunk:
 				heap->cached_chunks = chunk->next;
 			} else {
 #if ZEND_MM_LIMIT
-				if (UNEXPECTED(heap->real_size + ZEND_MM_CHUNK_SIZE > heap->limit)) {
+				if (UNEXPECTED(ZEND_MM_CHUNK_SIZE > heap->limit - heap->real_size)) {
 					if (zend_mm_gc(heap)) {
 						goto get_chunk;
 					} else if (heap->overflow == 0) {
@@ -1484,8 +1484,8 @@ static void *zend_mm_realloc_heap(zend_mm_heap *heap, void *ptr, size_t size, si
 				}
 			} else /* if (new_size > old_size) */ {
 #if ZEND_MM_LIMIT
-				if (UNEXPECTED(heap->real_size + (new_size - old_size) > heap->limit)) {
-					if (zend_mm_gc(heap) && heap->real_size + (new_size - old_size) <= heap->limit) {
+				if (UNEXPECTED(new_size - old_size > heap->limit - heap->real_size)) {
+					if (zend_mm_gc(heap) && new_size - old_size <= heap->limit - heap->real_size) {
 						/* pass */
 					} else if (heap->overflow == 0) {
 #if ZEND_DEBUG
@@ -1723,15 +1723,20 @@ static void *zend_mm_alloc_huge(zend_mm_heap *heap, size_t size ZEND_FILE_LINE_D
 	 * We allocate them with 2MB size granularity, to avoid many
 	 * reallocations when they are extended by small pieces
 	 */
-	size_t new_size = ZEND_MM_ALIGNED_SIZE_EX(size, MAX(REAL_PAGE_SIZE, ZEND_MM_CHUNK_SIZE));
+	size_t alignment = MAX(REAL_PAGE_SIZE, ZEND_MM_CHUNK_SIZE);
 #else
-	size_t new_size = ZEND_MM_ALIGNED_SIZE_EX(size, REAL_PAGE_SIZE);
+	size_t alignment = REAL_PAGE_SIZE;
 #endif
+	size_t new_size = ZEND_MM_ALIGNED_SIZE_EX(size, alignment);
 	void *ptr;

+	if (UNEXPECTED(new_size < size)) {
+		zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu + %zu)", size, alignment);
+	}
+
 #if ZEND_MM_LIMIT
-	if (UNEXPECTED(heap->real_size + new_size > heap->limit)) {
-		if (zend_mm_gc(heap) && heap->real_size + new_size <= heap->limit) {
+	if (UNEXPECTED(new_size > heap->limit - heap->real_size)) {
+		if (zend_mm_gc(heap) && new_size <= heap->limit - heap->real_size) {
 			/* pass */
 		} else if (heap->overflow == 0) {
 #if ZEND_DEBUG
@@ -894,7 +894,7 @@ tail_call:
 		} else {
 			zend_ast_export_indent(str, indent);
 			smart_str_appends(str, "} else ");
-			if (ast->child[1]->kind == ZEND_AST_IF) {
+			if (ast->child[1] && ast->child[1]->kind == ZEND_AST_IF) {
 				list = (zend_ast_list*)ast->child[1];
 				goto tail_call;
 			} else {
@@ -6619,6 +6619,7 @@ void zend_compile_use(zend_ast *ast) /* {{{ */
 		}

 		zend_string_addref(old_name);
+		old_name = zend_new_interned_string(old_name);
 		if (!zend_hash_add_ptr(current_import, lookup_name, old_name)) {
 			zend_error_noreturn(E_COMPILE_ERROR, "Cannot use%s %s as %s because the name "
 				"is already in use", zend_get_use_type_str(type), ZSTR_VAL(old_name), ZSTR_VAL(new_name));
@@ -7675,6 +7676,9 @@ void zend_compile_const(znode *result, zend_ast *ast) /* {{{ */

 		while (last && last->kind == ZEND_AST_STMT_LIST) {
 			zend_ast_list *list = zend_ast_get_list(last);
+			if (list->children == 0) {
+				break;
+			}
 			last = list->child[list->children-1];
 		}
 		if (last && last->kind == ZEND_AST_HALT_COMPILER) {
@@ -388,11 +388,14 @@ tail_call:
 			ZVAL_OBJ(&tmp, obj);
 			ht = get_gc(&tmp, &zv, &n);
 			end = zv + n;
-			if (EXPECTED(!ht)) {
+			if (EXPECTED(!ht) || UNEXPECTED(GC_REF_GET_COLOR(ht) == GC_BLACK)) {
+				ht = NULL;
 				if (!n) return;
 				while (!Z_REFCOUNTED_P(--end)) {
 					if (zv == end) return;
 				}
+			} else {
+				GC_REF_SET_BLACK(ht);
 			}
 			while (zv != end) {
 				if (Z_REFCOUNTED_P(zv)) {
@@ -498,15 +501,19 @@ tail_call:
 				ZVAL_OBJ(&tmp, obj);
 				ht = get_gc(&tmp, &zv, &n);
 				end = zv + n;
-				if (EXPECTED(!ht)) {
+				if (EXPECTED(!ht) || UNEXPECTED(GC_REF_GET_COLOR(ht) == GC_GREY)) {
+					ht = NULL;
 					if (!n) return;
 					while (!Z_REFCOUNTED_P(--end)) {
 						if (zv == end) return;
 					}
+				} else {
+					GC_REF_SET_COLOR(ht, GC_GREY);
 				}
 				while (zv != end) {
 					if (Z_REFCOUNTED_P(zv)) {
 						ref = Z_COUNTED_P(zv);
+						ZEND_ASSERT(GC_REFCOUNT(ref) > 0);
 						GC_REFCOUNT(ref)--;
 						gc_mark_grey(ref);
 					}
@@ -514,6 +521,7 @@ tail_call:
 				}
 				if (EXPECTED(!ht)) {
 					ref = Z_COUNTED_P(zv);
+					ZEND_ASSERT(GC_REFCOUNT(ref) > 0);
 					GC_REFCOUNT(ref)--;
 					goto tail_call;
 				}
@@ -530,6 +538,7 @@ tail_call:
 		} else if (GC_TYPE(ref) == IS_REFERENCE) {
 			if (Z_REFCOUNTED(((zend_reference*)ref)->val)) {
 				ref = Z_COUNTED(((zend_reference*)ref)->val);
+				ZEND_ASSERT(GC_REFCOUNT(ref) > 0);
 				GC_REFCOUNT(ref)--;
 				goto tail_call;
 			}
@@ -559,6 +568,7 @@ tail_call:
 			}
 			if (Z_REFCOUNTED_P(zv)) {
 				ref = Z_COUNTED_P(zv);
+				ZEND_ASSERT(GC_REFCOUNT(ref) > 0);
 				GC_REFCOUNT(ref)--;
 				gc_mark_grey(ref);
 			}
@@ -569,6 +579,7 @@ tail_call:
 			zv = Z_INDIRECT_P(zv);
 		}
 		ref = Z_COUNTED_P(zv);
+		ZEND_ASSERT(GC_REFCOUNT(ref) > 0);
 		GC_REFCOUNT(ref)--;
 		goto tail_call;
 	}
@@ -611,11 +622,14 @@ tail_call:
 					ZVAL_OBJ(&tmp, obj);
 					ht = get_gc(&tmp, &zv, &n);
 					end = zv + n;
-					if (EXPECTED(!ht)) {
+					if (EXPECTED(!ht) || UNEXPECTED(GC_REF_GET_COLOR(ht) != GC_GREY)) {
+						ht = NULL;
 						if (!n) return;
 						while (!Z_REFCOUNTED_P(--end)) {
 							if (zv == end) return;
 						}
+					} else {
+						GC_REF_SET_COLOR(ht, GC_WHITE);
 					}
 					while (zv != end) {
 						if (Z_REFCOUNTED_P(zv)) {
@@ -786,7 +800,8 @@ tail_call:
 				ZVAL_OBJ(&tmp, obj);
 				ht = get_gc(&tmp, &zv, &n);
 				end = zv + n;
-				if (EXPECTED(!ht)) {
+				if (EXPECTED(!ht) || UNEXPECTED(GC_REF_GET_COLOR(ht) == GC_BLACK)) {
+					ht = NULL;
 					if (!n) return count;
 					while (!Z_REFCOUNTED_P(--end)) {
 						/* count non-refcounted for compatibility ??? */
@@ -795,6 +810,8 @@ tail_call:
 						}
 						if (zv == end) return count;
 					}
+				} else {
+					GC_REF_SET_BLACK(ht);
 				}
 				while (zv != end) {
 					if (Z_REFCOUNTED_P(zv)) {
@@ -936,11 +953,9 @@ static void gc_remove_nested_data_from_buffer(zend_refcounted *ref, gc_root_buff
 	zval *zv;

 tail_call:
-	if (root ||
-	    (GC_ADDRESS(GC_INFO(ref)) != 0 &&
-	     GC_REF_GET_COLOR(ref) == GC_BLACK)) {
-		GC_TRACE_REF(ref, "removing from buffer");
+	do {
 		if (root) {
+			GC_TRACE_REF(ref, "removing from buffer");
 			if (EXPECTED(GC_ADDRESS(GC_INFO(root->ref)) < GC_ROOT_BUFFER_MAX_ENTRIES)) {
 				gc_remove_from_roots(root);
 			} else {
@@ -948,8 +963,18 @@ tail_call:
 			}
 			GC_INFO(ref) = 0;
 			root = NULL;
-		} else {
+		} else if (GC_ADDRESS(GC_INFO(ref)) != 0
+		 && GC_REF_GET_COLOR(ref) == GC_BLACK) {
+			GC_TRACE_REF(ref, "removing from buffer");
 			GC_REMOVE_FROM_BUFFER(ref);
+		} else if (GC_TYPE(ref) == IS_REFERENCE) {
+			if (Z_REFCOUNTED(((zend_reference*)ref)->val)) {
+				ref = Z_COUNTED(((zend_reference*)ref)->val);
+				goto tail_call;
+			}
+			return;
+		} else {
+			return;
 		}

 		if (GC_TYPE(ref) == IS_OBJECT) {
@@ -982,17 +1007,15 @@ tail_call:
 					ref = Z_COUNTED_P(zv);
 					goto tail_call;
 				}
+				if (GC_ADDRESS(GC_INFO(ht)) != 0 && GC_REF_GET_COLOR(ht) == GC_BLACK) {
+					GC_TRACE_REF(ht, "removing from buffer");
+					GC_REMOVE_FROM_BUFFER(ht);
+				}
 			} else {
 				return;
 			}
 		} else if (GC_TYPE(ref) == IS_ARRAY) {
 			ht = (zend_array*)ref;
-		} else if (GC_TYPE(ref) == IS_REFERENCE) {
-			if (Z_REFCOUNTED(((zend_reference*)ref)->val)) {
-				ref = Z_COUNTED(((zend_reference*)ref)->val);
-				goto tail_call;
-			}
-			return;
 		} else {
 			return;
 		}
@@ -1028,7 +1051,7 @@ tail_call:
 		}
 		ref = Z_COUNTED_P(zv);
 		goto tail_call;
-	}
+	} while (0);
 }

 ZEND_API int zend_gc_collect_cycles(void)
@@ -271,7 +271,7 @@ static uint32_t calc_gc_buffer_size(zend_generator *generator) /* {{{ */
 		if (EX_CALL_INFO() & ZEND_CALL_FREE_EXTRA_ARGS) {
 			size += EX_NUM_ARGS() - op_array->num_args;
 		}
-		size += Z_TYPE(execute_data->This) == IS_OBJECT; /* $this */
+		size += (EX_CALL_INFO() & ZEND_CALL_RELEASE_THIS) != 0; /* $this */
 		size += (EX_CALL_INFO() & ZEND_CALL_CLOSURE) != 0; /* Closure object */

 		/* Live vars */
@@ -352,7 +352,7 @@ static HashTable *zend_generator_get_gc(zval *object, zval **table, int *n) /* {
 		}
 	}

-	if (Z_TYPE(execute_data->This) == IS_OBJECT) {
+	if (EX_CALL_INFO() & ZEND_CALL_RELEASE_THIS) {
 		ZVAL_OBJ(gc_buffer++, Z_OBJ(execute_data->This));
 	}
 	if (EX_CALL_INFO() & ZEND_CALL_CLOSURE) {
@@ -138,6 +138,11 @@ ZEND_API HashTable *zend_std_get_gc(zval *object, zval **table, int *n) /* {{{ *
 		if (zobj->properties) {
 			*table = NULL;
 			*n = 0;
+			if (UNEXPECTED(GC_REFCOUNT(zobj->properties) > 1)
+			 && EXPECTED(!(GC_FLAGS(zobj->properties) & IS_ARRAY_IMMUTABLE))) {
+				GC_REFCOUNT(zobj->properties)--;
+				zobj->properties = zend_array_dup(zobj->properties);
+			}
 			return zobj->properties;
 		} else {
 			*table = zobj->properties_table;
@@ -46,7 +46,8 @@ ZEND_API void zend_object_std_dtor(zend_object *object)

 	if (object->properties) {
 		if (EXPECTED(!(GC_FLAGS(object->properties) & IS_ARRAY_IMMUTABLE))) {
-			if (EXPECTED(--GC_REFCOUNT(object->properties) == 0)) {
+			if (EXPECTED(--GC_REFCOUNT(object->properties) == 0)
+					&& EXPECTED(GC_TYPE(object->properties) != IS_NULL)) {
 				zend_array_destroy(object->properties);
 			}
 		}
@@ -1128,12 +1128,18 @@ ZEND_API int ZEND_FASTCALL pow_function(zval *result, zval *op1, zval *op2) /* {

 					if (EXPECTED(op1 != op2)) {
 						if (Z_TYPE_P(op1) == IS_ARRAY) {
+							if (op1 == result) {
+								zval_ptr_dtor(result);
+							}
 							ZVAL_LONG(result, 0);
 							return SUCCESS;
 						} else {
 							zendi_convert_scalar_to_number(op1, op1_copy, result, 0);
 						}
 						if (Z_TYPE_P(op2) == IS_ARRAY) {
+							if (op1 == result) {
+								zval_ptr_dtor(result);
+							}
 							ZVAL_LONG(result, 1L);
 							return SUCCESS;
 						} else {
@@ -1141,6 +1147,9 @@ ZEND_API int ZEND_FASTCALL pow_function(zval *result, zval *op1, zval *op2) /* {
 						}
 					} else {
 						if (Z_TYPE_P(op1) == IS_ARRAY) {
+							if (op1 == result) {
+								zval_ptr_dtor(result);
+							}
 							ZVAL_LONG(result, 0);
 							return SUCCESS;
 						} else {
@@ -91,10 +91,10 @@ ZEND_API const char* ZEND_FASTCALL zend_memnstr_ex(const char *haystack, const c
 ZEND_API const char* ZEND_FASTCALL zend_memnrstr_ex(const char *haystack, const char *needle, size_t needle_len, const char *end);

 #if SIZEOF_ZEND_LONG == 4
-#	define ZEND_DOUBLE_FITS_LONG(d) (!((d) > ZEND_LONG_MAX || (d) < ZEND_LONG_MIN))
+#	define ZEND_DOUBLE_FITS_LONG(d) (!((d) > (double)ZEND_LONG_MAX || (d) < (double)ZEND_LONG_MIN))
 #else
 	/* >= as (double)ZEND_LONG_MAX is outside signed range */
-#	define ZEND_DOUBLE_FITS_LONG(d) (!((d) >= ZEND_LONG_MAX || (d) < ZEND_LONG_MIN))
+#	define ZEND_DOUBLE_FITS_LONG(d) (!((d) >= (double)ZEND_LONG_MAX || (d) < (double)ZEND_LONG_MIN))
 #endif

 #if ZEND_DVAL_TO_LVAL_CAST_OK
@@ -91,6 +91,8 @@ cwd_state main_cwd_state; /* True global */
 #include <unistd.h>
 #else
 #include <direct.h>
+#include "zend_globals.h"
+#include "zend_globals_macros.h"
 #endif

 #define CWD_STATE_COPY(d, s)				\
@@ -855,6 +857,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 		tmp = do_alloca(len+1, use_heap);
 		memcpy(tmp, path, len+1);

+retry:
 		if(save &&
 				!(IS_UNC_PATH(path, len) && len >= 3 && path[2] != '?') &&
                               (dataw.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT)
@@ -895,7 +898,21 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 				return -1;
 			}
 			if(!DeviceIoControl(hLink, FSCTL_GET_REPARSE_POINT, NULL, 0, pbuffer,  MAXIMUM_REPARSE_DATA_BUFFER_SIZE, &retlength, NULL)) {
+				BY_HANDLE_FILE_INFORMATION fileInformation;
+
 				free_alloca(pbuffer, use_heap_large);
+				if ((dataw.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT) &&
+						(dataw.dwReserved0 & ~IO_REPARSE_TAG_CLOUD_MASK) == IO_REPARSE_TAG_CLOUD &&
+						EG(windows_version_info).dwMajorVersion >= 10 &&
+						EG(windows_version_info).dwMinorVersion == 0 &&
+						EG(windows_version_info).dwBuildNumber >= 18362 &&
+						GetFileInformationByHandle(hLink, &fileInformation) &&
+						!(fileInformation.dwFileAttributes & FILE_ATTRIBUTE_REPARSE_POINT)) {
+					dataw.dwFileAttributes = fileInformation.dwFileAttributes;
+					CloseHandle(hLink);
+					(*ll)--;
+					goto retry;
+				}
 				free_alloca(tmp, use_heap);
 				CloseHandle(hLink);
 				FREE_PATHW()
@@ -975,8 +992,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 			}
 			else if (pbuffer->ReparseTag == IO_REPARSE_TAG_DEDUP ||
 					/* Starting with 1709. */
-					(pbuffer->ReparseTag & IO_REPARSE_TAG_CLOUD_MASK) != 0 && 0x90001018L != pbuffer->ReparseTag ||
-					IO_REPARSE_TAG_CLOUD == pbuffer->ReparseTag ||
+					(pbuffer->ReparseTag & ~IO_REPARSE_TAG_CLOUD_MASK) == IO_REPARSE_TAG_CLOUD ||
 					IO_REPARSE_TAG_ONEDRIVE == pbuffer->ReparseTag) {
 				isabsolute = 1;
 				substitutename = malloc((len + 1) * sizeof(char));
@@ -2398,6 +2398,11 @@ ZEND_VM_HELPER(zend_leave_helper, ANY, ANY)
 			zend_clean_and_cache_symbol_table(EX(symbol_table));
 		}
 		EG(current_execute_data) = EX(prev_execute_data);
+
+		/* Free extra args before releasing the closure,
+		 * as that may free the op_array. */
+		zend_vm_stack_free_extra_args_ex(call_info, execute_data);
+
 		if (UNEXPECTED(call_info & ZEND_CALL_RELEASE_THIS)) {
 			zend_object *object = Z_OBJ(execute_data->This);
 #if 0
@@ -2413,7 +2418,6 @@ ZEND_VM_HELPER(zend_leave_helper, ANY, ANY)
 			OBJ_RELEASE((zend_object*)execute_data->func->op_array.prototype);
 		}

-		zend_vm_stack_free_extra_args_ex(call_info, execute_data);
 		old_execute_data = execute_data;
 		execute_data = EX(prev_execute_data);
 		zend_vm_stack_free_call_frame_ex(call_info, old_execute_data);
@@ -468,6 +468,11 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_leave_helper_SPEC(ZEND_OPCODE_
 			zend_clean_and_cache_symbol_table(EX(symbol_table));
 		}
 		EG(current_execute_data) = EX(prev_execute_data);
+
+		/* Free extra args before releasing the closure,
+		 * as that may free the op_array. */
+		zend_vm_stack_free_extra_args_ex(call_info, execute_data);
+
 		if (UNEXPECTED(call_info & ZEND_CALL_RELEASE_THIS)) {
 			zend_object *object = Z_OBJ(execute_data->This);
 #if 0
@@ -483,7 +488,6 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL zend_leave_helper_SPEC(ZEND_OPCODE_
 			OBJ_RELEASE((zend_object*)execute_data->func->op_array.prototype);
 		}

-		zend_vm_stack_free_extra_args_ex(call_info, execute_data);
 		old_execute_data = execute_data;
 		execute_data = EX(prev_execute_data);
 		zend_vm_stack_free_call_frame_ex(call_info, old_execute_data);
@@ -2207,7 +2207,7 @@ AC_DEFUN([PHP_SETUP_ICU],[

  dnl If pkg-config is found try using it
  if test "$PHP_ICU_DIR" = "DEFAULT" && test -x "$PKG_CONFIG" && $PKG_CONFIG --exists icu-uc icu-io icu-i18n; then
-    if $PKG_CONFIG --atleast-version=40 icu-uc; then
+    if $PKG_CONFIG --atleast-version=4.0 icu-uc; then
      found_icu=yes
      icu_version_full=`$PKG_CONFIG --modversion icu-uc`
      ac_IFS=$IFS
@@ -107,8 +107,8 @@ int zend_sprintf(char *buffer, const char *format, ...);

 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=2
-PHP_RELEASE_VERSION=22
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=24
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`

@@ -2925,7 +2925,7 @@ static int php_date_initialize_from_hash(php_date_obj **dateobj, HashTable *myht
 	timelib_tzinfo   *tzi;
 	php_timezone_obj *tzobj;

-	z_date = zend_hash_str_find(myht, "date", sizeof("data")-1);
+	z_date = zend_hash_str_find(myht, "date", sizeof("date")-1);
 	if (z_date && Z_TYPE_P(z_date) == IS_STRING) {
 		z_timezone_type = zend_hash_str_find(myht, "timezone_type", sizeof("timezone_type")-1);
 		if (z_timezone_type && Z_TYPE_P(z_timezone_type) == IS_LONG) {
@@ -1002,7 +1002,6 @@ static tag_info_array tag_table_VND_PANASONIC = {
  { 0x0001, "Quality"},
  { 0x0002, "FirmwareVersion"},
  { 0x0003, "WhiteBalance"},
-  { 0x0004, "0x0004"},
  { 0x0007, "FocusMode"},
  { 0x000f, "AFMode"},
  { 0x001a, "ImageStabilization"},
@@ -1010,12 +1009,10 @@ static tag_info_array tag_table_VND_PANASONIC = {
  { 0x001f, "ShootingMode"},
  { 0x0020, "Audio"},
  { 0x0021, "DataDump"},
-  { 0x0022, "0x0022"},
  { 0x0023, "WhiteBalanceBias"},
  { 0x0024, "FlashBias"},
  { 0x0025, "InternalSerialNumber"},
  { 0x0026, "ExifVersion"},
-  { 0x0027, "0x0027"},
  { 0x0028, "ColorEffect"},
  { 0x0029, "TimeSincePowerOn"},
  { 0x002a, "BurstMode"},
@@ -1023,7 +1020,6 @@ static tag_info_array tag_table_VND_PANASONIC = {
  { 0x002c, "Contrast"},
  { 0x002d, "NoiseReduction"},
  { 0x002e, "SelfTimer"},
-  { 0x002f, "0x002f"},
  { 0x0030, "Rotation"},
  { 0x0031, "AFAssistLamp"},
  { 0x0032, "ColorMode"},
@@ -1090,7 +1086,6 @@ static tag_info_array tag_table_VND_PANASONIC = {
  { 0x00a3, "ClearRetouchValue"},
  { 0x00ab, "TouchAE"},
  { 0x0e00, "PrintIM"},
-  { 0x4449, "0x4449"},
  { 0x8000, "MakerNoteVersion"},
  { 0x8001, "SceneMode"},
  { 0x8004, "WBRedLevel"},
@@ -1125,22 +1120,20 @@ static tag_info_array tag_table_VND_SONY = {
  { 0x0112, "WhiteBalanceFineTune"},
  { 0x0114, "CameraSettings"},
  { 0x0115, "WhiteBalance"},
-  { 0x0116, "0x0116"},
+  { 0x0116, "ExtraInfo"},
  { 0x0e00, "PrintIM"},
  { 0x1000, "MultiBurstMode"},
  { 0x1001, "MultiBurstImageWidth"},
  { 0x1002, "MultiBurstImageHeight"},
  { 0x1003, "Panorama"},
-  { 0x2000, "0x2000"},
  { 0x2001, "PreviewImage"},
-  { 0x2002, "0x2002"},
-  { 0x2003, "0x2003"},
+  { 0x2002, "Rating"},
  { 0x2004, "Contrast"},
  { 0x2005, "Saturation"},
-  { 0x2006, "0x2006"},
-  { 0x2007, "0x2007"},
-  { 0x2008, "0x2008"},
-  { 0x2009, "0x2009"},
+  { 0x2006, "Sharpness"},
+  { 0x2007, "Brightness"},
+  { 0x2008, "LongExposureNoiseReduction"},
+  { 0x2009, "HighISONoiseReduction"},
  { 0x200a, "AutoHDR"},
  { 0x3000, "ShotInfo"},
  { 0xb000, "FileFormat"},
@@ -1167,8 +1160,9 @@ static tag_info_array tag_table_VND_SONY = {
  { 0xb049, "ReleaseMode"},
  { 0xb04a, "SequenceNumber"},
  { 0xb04b, "AntiBlur"},
-  { 0xb04e, "LongExposureNoiseReduction"},
+  { 0xb04e, "FocusMode"},
  { 0xb04f, "DynamicRangeOptimizer"},
+  { 0xb050, "HighISONoiseReduction2"},
  { 0xb052, "IntelligentAuto"},
  { 0xb054, "WhiteBalance2"},
  TAG_TABLE_END
@@ -1273,7 +1267,6 @@ static tag_info_array tag_table_VND_MINOLTA = {
  { 0x0100, "SceneMode"},
  { 0x0101, "ColorMode"},
  { 0x0102, "Quality"},
-  { 0x0103, "0x0103"},
  { 0x0104, "FlashExposureComp"},
  { 0x0105, "Teleconverter"},
  { 0x0107, "ImageStabilization"},
@@ -1369,6 +1362,7 @@ static const maker_note_type maker_note_array[] = {
  { tag_table_VND_PANASONIC, "Panasonic",               NULL, "Panasonic\x00\x00\x00",			 12, 12, MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
  { tag_table_VND_DJI,       "DJI",                     NULL, NULL,								 0, 0,   MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
  { tag_table_VND_SONY,      "SONY",                    NULL, "SONY DSC \x00\x00\x00",	         12, 12, MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
+  { tag_table_VND_SONY,      "SONY",                    NULL,								     0, 0,   MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
  { tag_table_VND_PENTAX,    "PENTAX",                  NULL, "AOC\x00",						 6,  6,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
  { tag_table_VND_MINOLTA,   "Minolta, KONICA MINOLTA", NULL, NULL,								 0,  0,  MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
  { tag_table_VND_SIGMA,     "SIGMA, FOVEON",           NULL, "SIGMA\x00\x00\x00",				 10, 10, MN_ORDER_NORMAL,   MN_OFFSET_NORMAL},
@@ -2328,14 +2322,11 @@ static void exif_iif_free(image_info_type *image_info, int section_index) {
 				efree(f);
 			}
 			switch(image_info->info_list[section_index].list[i].format) {
-				case TAG_FMT_SBYTE:
-				case TAG_FMT_BYTE:
-					/* in contrast to strings bytes do not need to allocate buffer for NULL if length==0 */
-					if (image_info->info_list[section_index].list[i].length<1)
-						break;
-				default:
 				case TAG_FMT_UNDEFINED:
 				case TAG_FMT_STRING:
+				case TAG_FMT_SBYTE:
+				case TAG_FMT_BYTE:
+				default:
 					if ((f=image_info->info_list[section_index].list[i].value.s) != NULL) {
 						efree(f);
 					}
@@ -3262,6 +3253,14 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
 }
 /* }}} */

+#define REQUIRE_NON_EMPTY() do { \
+	if (byte_count == 0) { \
+		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Cannot be empty", tag, exif_get_tagname(tag, tagname, -12, tag_table)); \
+		return FALSE; \
+	} \
+} while (0)
+
+
 /* {{{ exif_process_IFD_TAG
 * Process one of the nested IFDs directories. */
 static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, char *offset_base, size_t IFDlength, size_t displacement, int section_index, int ReadNextIFD, tag_table_type tag_table)
@@ -3295,7 +3294,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 		/*return TRUE;*/
 	}

-	if (components <= 0) {
+	if (components < 0) {
 		exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Process tag(x%04X=%s): Illegal components(%d)", tag, exif_get_tagname(tag, tagname, -12, tag_table), components);
 		return FALSE;
 	}
@@ -3379,8 +3378,12 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 	}
 #endif

+	/* NB: The following code may not assume that there is at least one component!
+	 * byte_count may be zero! */
+
 	if (section_index==SECTION_THUMBNAIL) {
 		if (!ImageInfo->Thumbnail.data) {
+			REQUIRE_NON_EMPTY();
 			switch(tag) {
 				case TAG_IMAGEWIDTH:
 				case TAG_COMP_IMAGE_WIDTH:
@@ -3424,6 +3427,9 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				if (byte_count>1 && (length=php_strnlen(value_ptr, byte_count)) > 0) {
 					if (length<byte_count-1) {
 						/* When there are any characters after the first NUL */
+						EFREE_IF(ImageInfo->CopyrightPhotographer);
+						EFREE_IF(ImageInfo->CopyrightEditor);
+						EFREE_IF(ImageInfo->Copyright);
 						ImageInfo->CopyrightPhotographer  = estrdup(value_ptr);
 						ImageInfo->CopyrightEditor        = estrndup(value_ptr+length+1, byte_count-length-1);
 						spprintf(&ImageInfo->Copyright, 0, "%s, %s", ImageInfo->CopyrightPhotographer, ImageInfo->CopyrightEditor);
@@ -3431,6 +3437,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 						/* but we are not supposed to change this                   */
 						/* keep in mind that image_info does not store editor value */
 					} else {
+						EFREE_IF(ImageInfo->Copyright);
 						ImageInfo->Copyright = estrndup(value_ptr, byte_count);
 					}
 				}
@@ -3459,6 +3466,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 			case TAG_FNUMBER:
 				/* Simplest way of expressing aperture, so I trust it the most.
 				   (overwrite previously computed value if there is one) */
+				REQUIRE_NON_EMPTY();
 				ImageInfo->ApertureFNumber = (float)exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel);
 				break;

@@ -3467,6 +3475,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				/* More relevant info always comes earlier, so only use this field if we don't
 				   have appropriate aperture information yet. */
 				if (ImageInfo->ApertureFNumber == 0) {
+					REQUIRE_NON_EMPTY();
 					ImageInfo->ApertureFNumber
 						= (float)exp(exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel)*log(2)*0.5);
 				}
@@ -3478,6 +3487,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				   SHUTTERSPEED comes after EXPOSURE TIME
 				  */
 				if (ImageInfo->ExposureTime == 0) {
+					REQUIRE_NON_EMPTY();
 					ImageInfo->ExposureTime
 						= (float)(1/exp(exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel)*log(2)));
 				}
@@ -3487,20 +3497,24 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				break;

 			case TAG_COMP_IMAGE_WIDTH:
+				REQUIRE_NON_EMPTY();
 				ImageInfo->ExifImageWidth = exif_convert_any_to_int(value_ptr, exif_rewrite_tag_format_to_unsigned(format), ImageInfo->motorola_intel);
 				break;

 			case TAG_FOCALPLANE_X_RES:
+				REQUIRE_NON_EMPTY();
 				ImageInfo->FocalplaneXRes = exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel);
 				break;

 			case TAG_SUBJECT_DISTANCE:
 				/* Inidcates the distacne the autofocus camera is focused to.
 				   Tends to be less accurate as distance increases. */
+				REQUIRE_NON_EMPTY();
 				ImageInfo->Distance = (float)exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel);
 				break;

 			case TAG_FOCALPLANE_RESOLUTION_UNIT:
+				REQUIRE_NON_EMPTY();
 				switch((int)exif_convert_any_format(value_ptr, format, ImageInfo->motorola_intel)) {
 					case 1: ImageInfo->FocalplaneUnits = 25.4; break; /* inch */
 					case 2:
@@ -3526,9 +3540,11 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 				break;

 			case TAG_MAKE:
+				EFREE_IF(ImageInfo->make);
 				ImageInfo->make = estrndup(value_ptr, byte_count);
 				break;
 			case TAG_MODEL:
+				EFREE_IF(ImageInfo->model);
 				ImageInfo->model = estrndup(value_ptr, byte_count);
 				break;

@@ -3543,6 +3559,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 			case TAG_GPS_IFD_POINTER:
 			case TAG_INTEROP_IFD_POINTER:
 				if (ReadNextIFD) {
+					REQUIRE_NON_EMPTY();
 					char *Subdir_start;
 					int sub_section_index = 0;
 					switch(tag) {
@@ -3571,9 +3588,11 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 					Subdir_start = offset_base + php_ifd_get32u(value_ptr, ImageInfo->motorola_intel);
 					if (Subdir_start < offset_base || Subdir_start > offset_base+IFDlength) {
 						exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD Pointer");
+						EFREE_IF(outside);
 						return FALSE;
 					}
 					if (!exif_process_IFD_in_JPEG(ImageInfo, Subdir_start, offset_base, IFDlength, displacement, sub_section_index, tag)) {
+						EFREE_IF(outside);
 						return FALSE;
 					}
 #ifdef EXIF_DEBUG
@@ -4,9 +4,48 @@ Bug #68547 (Exif Header component value check error)
 <?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
 --FILE--
 <?php
-exif_read_data(__DIR__ . DIRECTORY_SEPARATOR . 'bug68547.jpg');
+var_dump(exif_read_data(__DIR__ . DIRECTORY_SEPARATOR . 'bug68547.jpg'));
 ?>
 ===DONE===
 --EXPECTF--
-Warning: exif_read_data(bug68547.jpg): Process tag(x9C9E=Keywords   ): Illegal components(%d) in %sbug68547.php on line %d
+array(12) {
+  ["FileName"]=>
+  string(12) "bug68547.jpg"
+  ["FileDateTime"]=>
+  int(%d)
+  ["FileSize"]=>
+  int(713)
+  ["FileType"]=>
+  int(2)
+  ["MimeType"]=>
+  string(10) "image/jpeg"
+  ["SectionsFound"]=>
+  string(20) "ANY_TAG, IFD0, WINXP"
+  ["COMPUTED"]=>
+  array(5) {
+    ["html"]=>
+    string(20) "width="1" height="1""
+    ["Height"]=>
+    int(1)
+    ["Width"]=>
+    int(1)
+    ["IsColor"]=>
+    int(1)
+    ["ByteOrderMotorola"]=>
+    int(0)
+  }
+  ["Subject"]=>
+  string(10) "Subjec??.."
+  ["Keywords"]=>
+  string(0) ""
+  ["Author"]=>
+  string(9) "Rui Carmo"
+  ["Comments"]=>
+  string(29) "Comments
+Line2
+Line3
+Line4"
+  ["Title"]=>
+  string(8) "Title..."
+}
 ===DONE===
@@ -39,7 +39,6 @@ print_r(exif_read_data(__DIR__.'/bug68799.jpg'));

 ?>
 --EXPECTF--
-Warning: exif_read_data(bug68799.jpg): Process tag(x9C9D=Author     ): Illegal components(%d) in %s on line %d
 Array
 (
    [FileName] => bug68799.jpg
@@ -47,7 +46,7 @@ Array
    [FileSize] => 735
    [FileType] => 2
    [MimeType] => image/jpeg
-    [SectionsFound] => ANY_TAG, IFD0
+    [SectionsFound] => ANY_TAG, IFD0, WINXP
    [COMPUTED] => Array
        (
            [html] => width="1" height="1"
@@ -60,4 +59,5 @@ Array
    [XResolution] => 96/1
    [YResolution] => 96/1
    [ResolutionUnit] => 2
+    [Author] => 
 )
@@ -47,7 +47,7 @@ Warning: exif_read_data(bug72094_3.jpg): Process tag(x3030=UndefinedTa): Illegal

 Warning: exif_read_data(bug72094_3.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %s%ebug72094.php on line %d

-Warning: exif_read_data(bug72094_3.jpg): Process tag(x3030=UndefinedTa): Illegal components(%d) in %s%ebug72094.php on line %d
+Warning: exif_read_data(bug72094_3.jpg): Illegal IFD size in %s%ebug72094.php on line %d

 Warning: exif_read_data(bug72094_3.jpg): File structure corrupted in %s%ebug72094.php on line %d

@@ -8,7 +8,7 @@ Bug #73737 (Crash when parsing a tag format)
 	var_dump($exif);
 ?>
 --EXPECTF--
-Warning: exif_thumbnail(bug73737.tiff): Process tag(x0100=ImageWidth ): Illegal components(0) in %s on line %d
+Warning: exif_thumbnail(bug73737.tiff): Process tag(x0100=ImageWidth ): Cannot be empty in %s on line %d

 Warning: exif_thumbnail(bug73737.tiff): Error in TIFF: filesize(x0030) less than start of IFD dir(x10102) in %s line %d
 bool(false)
@@ -0,0 +1,12 @@
+--TEST--
+OSS-Fuzz #17474: Memory leak on duplicate Copyright tags
+--FILE--
+<?php
+
+// Only checking for an absence of leaks here.
+@exif_read_data(__DIR__ . '/duplicate_copyright_tag_leak.tiff');
+
+?>
+===DONE===
+--EXPECTF--
+===DONE===
@@ -0,0 +1,15 @@
+--TEST--
+OSS-Fuzz #17163: Out-of-bounds read due to tag with zero components
+--FILE--
+<?php
+
+var_dump(exif_read_data(__DIR__ . '/tag_with_illegal_zero_components.jpeg'));
+
+?>
+--EXPECTF--
+Warning: exif_read_data(tag_with_illegal_zero_components.jpeg): Process tag(x0202=JPEGInterch): Cannot be empty in %s on line %d
+
+Warning: exif_read_data(tag_with_illegal_zero_components.jpeg): File structure corrupted in %s on line %d
+
+Warning: exif_read_data(tag_with_illegal_zero_components.jpeg): Invalid JPEG file in %s on line %d
+bool(false)
@@ -0,0 +1,10 @@
+--TEST--
+OSS-Fuzz: Temporary buffer leak in tag reading
+--FILE--
+<?php
+
+var_dump(@exif_read_data(__DIR__ . '/temporary_buffer_leak.jpg'));
+
+?>
+--EXPECT--
+bool(false)
@@ -0,0 +1,11 @@
+--TEST--
+OSS-Fuzz: Memory leak for zero-length MAKERNOTE
+--FILE--
+<?php
+
+@exif_read_data(__DIR__ . '/zero_length_makernote_leak.tiff');
+
+?>
+===DONE===
+--EXPECT--
+===DONE===
@@ -3,7 +3,7 @@ Bug #77198 (auto cropping has insufficient precision)
 --SKIPIF--
 <?php
 if (!extension_loaded('gd')) die('skip gd extension not available');
-if (!GD_BUNDLED) die('upstream bugfix has not been released');
+if (!GD_BUNDLED) die('skip upstream bugfix has not been released');
 ?>
 --FILE--
 <?php
@@ -3,7 +3,7 @@ Bug #77198 (threshold cropping has insufficient precision)
 --SKIPIF--
 <?php
 if (!extension_loaded('gd')) die('skip gd extension not available');
-if (!GD_BUNDLED) die('upstream bugfix has not been released');
+if (!GD_BUNDLED) die('skip upstream bugfix has not been released');
 ?>
 --FILE--
 <?php
@@ -3,7 +3,7 @@ Bug #77200 (imagecropauto(…, GD_CROP_SIDES) crops left but not right)
 --SKIPIF--
 <?php
 if (!extension_loaded('gd')) die('skip gd extension not available');
-if (!GD_BUNDLED) die('upstream bugfix has not been released');
+if (!GD_BUNDLED) die('skip upstream bugfix has not been released');
 ?>
 --FILE--
 <?php
@@ -223,11 +223,23 @@ static void php_intl_idn_to(INTERNAL_FUNCTION_PARAMETERS,
 		UParseError parse_error;

 		status = U_ZERO_ERROR;
+#if defined(__clang__)
+# pragma clang diagnostic push
+# pragma clang diagnostic ignored "-Wdeprecated-declarations"
+#elif ZEND_GCC_VERSION >= 4008
+# pragma GCC diagnostic push
+# pragma GCC diagnostic ignored "-Wdeprecated-declarations"
+#endif
 		if (mode == INTL_IDN_TO_ASCII) {
 			converted_ret_len = uidna_IDNToASCII(ustring, ustring_len, converted, MAXPATHLEN, (int32_t)option, &parse_error, &status);
 		} else {
 			converted_ret_len = uidna_IDNToUnicode(ustring, ustring_len, converted, MAXPATHLEN, (int32_t)option, &parse_error, &status);
 		}
+#if defined(__clang__)
+# pragma clang diagnostic pop
+#elif ZEND_GCC_VERSION >= 4008
+# pragma GCC diagnostic pop
+#endif
 		efree(ustring);

 		if (U_FAILURE(status)) {
@@ -185,10 +185,10 @@ static HashTable *umsg_parse_format(MessageFormatter_object *mfo,

 		if (name_part.getType() == UMSGPAT_PART_TYPE_ARG_NAME) {
 			UnicodeString argName = mp.getSubstring(name_part);
-			if ((storedType = (Formattable::Type*)zend_hash_str_find_ptr(ret, (char*)argName.getBuffer(), argName.length())) == NULL) {
+			if ((storedType = (Formattable::Type*)zend_hash_str_find_ptr(ret, (char*)argName.getBuffer(), argName.length() * sizeof(UChar))) == NULL) {
 				/* not found already; create new entry in HT */
 				Formattable::Type bogusType = Formattable::kObject;
-				if ((storedType = (Formattable::Type*)zend_hash_str_update_mem(ret, (char*)argName.getBuffer(), argName.length(),
+				if ((storedType = (Formattable::Type*)zend_hash_str_update_mem(ret, (char*)argName.getBuffer(), argName.length() * sizeof(UChar),
 						(void*)&bogusType, sizeof(bogusType))) == NULL) {
 					intl_errors_set(&err, U_MEMORY_ALLOCATION_ERROR,
 						"Write to argument types hash table failed", 0);
@@ -450,7 +450,7 @@ U_CFUNC void umsg_format_helper(MessageFormatter_object *mfo,
 				continue;
 			}

-			storedArgType = (Formattable::Type*)zend_hash_str_find_ptr(types, (char*)key.getBuffer(), key.length());
+			storedArgType = (Formattable::Type*)zend_hash_str_find_ptr(types, (char*)key.getBuffer(), key.length() * sizeof(UChar));
 		}

 		if (storedArgType != NULL) {
@@ -2,6 +2,7 @@
 grapheme()
 --SKIPIF--
 <?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?>
+<?php if (version_compare(INTL_ICU_VERSION, '65.0') >= 0) die('skip for ICU < 65.0'); ?>
 --FILE--
 <?php

@@ -3,6 +3,7 @@ locale_get_display_name() icu >= 64.0
 --SKIPIF--
 <?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?>
 <?php if (version_compare(INTL_ICU_VERSION, '64.0') < 0) die('skip for ICU >= 64.0'); ?>
+<?php if (version_compare(INTL_ICU_VERSION, '65.0') >= 0) die('skip for ICU < 65.0'); ?>
 --FILE--
 <?php

@@ -0,0 +1,342 @@
+--TEST--
+locale_get_display_name() icu >= 64.0
+--SKIPIF--
+<?php if( !extension_loaded( 'intl' ) ) print 'skip'; ?>
+<?php if (version_compare(INTL_ICU_VERSION, '65.0') < 0) die('skip for ICU >= 65.0'); ?>
+--FILE--
+<?php
+
+/*
+ * Try getting the display_name for different locales
+ * with Procedural and Object methods.
+ */
+
+function ut_main()
+{
+    $res_str='';
+
+	$disp_locales=array('en','fr','de');
+
+    $locales = array(
+        'sl_IT_nedis_KIRTI',
+        'sl_IT_nedis-a-kirti-x-xyz',
+        'sl_IT_rozaj',
+        'sl_IT_NEDIS_ROJAZ_1901',
+        'i-enochian',
+        'zh-hakka',
+        'zh-wuu',
+        'i-tay',
+        'sgn-BE-nl',
+        'sgn-CH-de',
+        'sl_IT_rozaj@currency=EUR',
+        'uk-ua_CALIFORNIA@currency=;currency=GRN',
+        'root',
+        'uk@currency=EURO',
+        'Hindi',
+//Simple language subtag
+        'de',
+        'fr',
+        'ja',
+        'i-enochian', //(example of a grandfathered tag)
+//Language subtag plus Script subtag:
+        'zh-Hant',
+        'zh-Hans',
+        'sr-Cyrl',
+        'sr-Latn',
+//Language-Script-Region
+        'zh-Hans-CN',
+        'sr-Latn-CS',
+//Language-Variant
+        'sl-rozaj',
+        'sl-nedis',
+//Language-Region-Variant
+        'de-CH-1901',
+        'sl-IT-nedis',
+//Language-Script-Region-Variant
+        'sl-Latn-IT-nedis',
+//Language-Region:
+        'de-DE',
+        'en-US',
+        'es-419',
+//Private use subtags:
+        'de-CH-x-phonebk',
+        'az-Arab-x-AZE-derbend',
+//Extended language subtags
+        'zh-min',
+        'zh-min-nan-Hant-CN',
+//Private use registry values
+        'x-whatever',
+        'qaa-Qaaa-QM-x-southern',
+        'sr-Latn-QM',
+        'sr-Qaaa-CS',
+/*Tags that use extensions (examples ONLY: extensions MUST be defined
+   by revision or update to this document or by RFC): */
+        'en-US-u-islamCal',
+        'zh-CN-a-myExt-x-private',
+        'en-a-myExt-b-another',
+//Some Invalid Tags:
+        'de-419-DE',
+        'a-DE',
+        'ar-a-aaa-b-bbb-a-ccc'
+    );
+
+
+    $res_str = '';
+
+   	foreach( $locales as $locale )
+    {
+       	$res_str .= "locale='$locale'\n";
+   		foreach( $disp_locales as $disp_locale )
+    	{
+        	$scr = ut_loc_get_display_name( $locale ,$disp_locale );
+		$scr = str_replace(array('(', ')'), '#', $scr);
+        	$res_str .= "disp_locale=$disp_locale :  display_name=$scr";
+        	$res_str .= "\n";
+		}
+        $res_str .= "-----------------\n";
+    }
+
+    return $res_str;
+
+}
+
+include_once( 'ut_common.inc' );
+ut_run();
+
+?>
+--EXPECTREGEX--
+locale='sl_IT_nedis_KIRTI'
+disp_locale=en :  display_name=Slovenian #Italy, NEDIS_KIRTI#
+disp_locale=fr :  display_name=slovène #Italie, NEDIS_KIRTI#
+disp_locale=de :  display_name=Slowenisch #Italien, NEDIS_KIRTI#
+-----------------
+locale='sl_IT_nedis-a-kirti-x-xyz'
+disp_locale=en :  display_name=Slovenian #Italy, NEDIS_A_KIRTI_X_XYZ#
+disp_locale=fr :  display_name=slovène #Italie, NEDIS_A_KIRTI_X_XYZ#
+disp_locale=de :  display_name=Slowenisch #Italien, NEDIS_A_KIRTI_X_XYZ#
+-----------------
+locale='sl_IT_rozaj'
+disp_locale=en :  display_name=Slovenian #Italy, Resian#
+disp_locale=fr :  display_name=slovène #Italie, dialecte de Resia#
+disp_locale=de :  display_name=Slowenisch #Italien, (ROZAJ|Resianisch)#
+-----------------
+locale='sl_IT_NEDIS_ROJAZ_1901'
+disp_locale=en :  display_name=Slovenian #Italy, NEDIS_ROJAZ_1901#
+disp_locale=fr :  display_name=slovène #Italie, NEDIS_ROJAZ_1901#
+disp_locale=de :  display_name=Slowenisch #Italien, NEDIS_ROJAZ_1901#
+-----------------
+locale='i-enochian'
+disp_locale=en :  display_name=i-enochian #Private-Use=i-enochian#
+disp_locale=fr :  display_name=i-enochian #usage privé=i-enochian#
+disp_locale=de :  display_name=i-enochian #Privatnutzung=i-enochian#
+-----------------
+locale='zh-hakka'
+disp_locale=en :  display_name=Chinese( #HAKKA#)?
+disp_locale=fr :  display_name=chinois( #HAKKA#)?
+disp_locale=de :  display_name=Chinesisch( #HAKKA#)?
+-----------------
+locale='zh-wuu'
+disp_locale=en :  display_name=Chinese #WUU#
+disp_locale=fr :  display_name=chinois #WUU#
+disp_locale=de :  display_name=Chinesisch #WUU#
+-----------------
+locale='i-tay'
+disp_locale=en :  display_name=i-tay
+disp_locale=fr :  display_name=i-tay
+disp_locale=de :  display_name=i-tay
+-----------------
+locale='sgn-BE-nl'
+disp_locale=en :  display_name=sgn #Belgium, NL#
+disp_locale=fr :  display_name=sgn #Belgique, NL#
+disp_locale=de :  display_name=sgn #Belgien, NL#
+-----------------
+locale='sgn-CH-de'
+disp_locale=en :  display_name=sgn #Switzerland, DE#
+disp_locale=fr :  display_name=sgn #Suisse, DE#
+disp_locale=de :  display_name=sgn #Schweiz, DE#
+-----------------
+locale='sl_IT_rozaj@currency=EUR'
+disp_locale=en :  display_name=Slovenian #Italy, Resian, [Cc]urrency=Euro#
+disp_locale=fr :  display_name=slovène #Italie, dialecte de Resia, [Dd]evise=euro#
+disp_locale=de :  display_name=Slowenisch #Italien, (ROZAJ|Resianisch), Währung=Euro#
+-----------------
+locale='uk-ua_CALIFORNIA@currency=;currency=GRN'
+disp_locale=en :  display_name=
+disp_locale=fr :  display_name=
+disp_locale=de :  display_name=
+-----------------
+locale='root'
+disp_locale=en :  display_name=Unknown language
+disp_locale=fr :  display_name=langue indéterminée
+disp_locale=de :  display_name=Unbekannte Sprache
+-----------------
+locale='uk@currency=EURO'
+disp_locale=en :  display_name=Ukrainian #[Cc]urrency=EURO#
+disp_locale=fr :  display_name=ukrainien #[Dd]evise=EURO#
+disp_locale=de :  display_name=Ukrainisch #Währung=EURO#
+-----------------
+locale='Hindi'
+disp_locale=en :  display_name=hindi
+disp_locale=fr :  display_name=hindi
+disp_locale=de :  display_name=hindi
+-----------------
+locale='de'
+disp_locale=en :  display_name=German
+disp_locale=fr :  display_name=allemand
+disp_locale=de :  display_name=Deutsch
+-----------------
+locale='fr'
+disp_locale=en :  display_name=French
+disp_locale=fr :  display_name=français
+disp_locale=de :  display_name=Französisch
+-----------------
+locale='ja'
+disp_locale=en :  display_name=Japanese
+disp_locale=fr :  display_name=japonais
+disp_locale=de :  display_name=Japanisch
+-----------------
+locale='i-enochian'
+disp_locale=en :  display_name=i-enochian #Private-Use=i-enochian#
+disp_locale=fr :  display_name=i-enochian #usage privé=i-enochian#
+disp_locale=de :  display_name=i-enochian #Privatnutzung=i-enochian#
+-----------------
+locale='zh-Hant'
+disp_locale=en :  display_name=Chinese #Traditional#
+disp_locale=fr :  display_name=chinois #traditionnel#
+disp_locale=de :  display_name=Chinesisch #Traditionell#
+-----------------
+locale='zh-Hans'
+disp_locale=en :  display_name=Chinese #Simplified#
+disp_locale=fr :  display_name=chinois #simplifié#
+disp_locale=de :  display_name=Chinesisch #Vereinfacht#
+-----------------
+locale='sr-Cyrl'
+disp_locale=en :  display_name=Serbian #Cyrillic#
+disp_locale=fr :  display_name=serbe #cyrillique#
+disp_locale=de :  display_name=Serbisch #Kyrillisch#
+-----------------
+locale='sr-Latn'
+disp_locale=en :  display_name=Serbian #Latin#
+disp_locale=fr :  display_name=serbe #latin#
+disp_locale=de :  display_name=Serbisch #Lateinisch#
+-----------------
+locale='zh-Hans-CN'
+disp_locale=en :  display_name=Chinese #Simplified, China#
+disp_locale=fr :  display_name=chinois #simplifié, Chine#
+disp_locale=de :  display_name=Chinesisch #Vereinfacht, China#
+-----------------
+locale='sr-Latn-CS'
+disp_locale=en :  display_name=Serbian #Latin, Serbia#
+disp_locale=fr :  display_name=serbe #latin, Serbie#
+disp_locale=de :  display_name=Serbisch #Lateinisch, Serbien#
+-----------------
+locale='sl-rozaj'
+disp_locale=en :  display_name=Slovenian #Resian#
+disp_locale=fr :  display_name=slovène #dialecte de Resia#
+disp_locale=de :  display_name=Slowenisch( #(ROZAJ|Resianisch)#)?
+-----------------
+locale='sl-nedis'
+disp_locale=en :  display_name=Slovenian #Natisone dialect#
+disp_locale=fr :  display_name=slovène #dialecte de Natisone#
+disp_locale=de :  display_name=Slowenisch #Natisone-Dialekt#
+-----------------
+locale='de-CH-1901'
+disp_locale=en :  display_name=German #Switzerland, Traditional German orthography#
+disp_locale=fr :  display_name=allemand #Suisse, orthographe allemande traditionnelle#
+disp_locale=de :  display_name=Deutsch #Schweiz, (1901|[aA]lte deutsche Rechtschreibung)#
+-----------------
+locale='sl-IT-nedis'
+disp_locale=en :  display_name=Slovenian #Italy, Natisone dialect#
+disp_locale=fr :  display_name=slovène #Italie, dialecte de Natisone#
+disp_locale=de :  display_name=Slowenisch #Italien, (NEDIS|Natisone-Dialekt)#
+-----------------
+locale='sl-Latn-IT-nedis'
+disp_locale=en :  display_name=Slovenian #Latin, Italy, Natisone dialect#
+disp_locale=fr :  display_name=slovène #latin, Italie, dialecte de Natisone#
+disp_locale=de :  display_name=Slowenisch #Lateinisch, Italien, (NEDIS|Natisone-Dialekt)#
+-----------------
+locale='de-DE'
+disp_locale=en :  display_name=German #Germany#
+disp_locale=fr :  display_name=allemand #Allemagne#
+disp_locale=de :  display_name=Deutsch #Deutschland#
+-----------------
+locale='en-US'
+disp_locale=en :  display_name=English #United States#
+disp_locale=fr :  display_name=anglais #États-Unis#
+disp_locale=de :  display_name=Englisch #Vereinigte Staaten#
+-----------------
+locale='es-419'
+disp_locale=en :  display_name=Spanish #Latin America#
+disp_locale=fr :  display_name=espagnol #Amérique latine#
+disp_locale=de :  display_name=Spanisch #Lateinamerika#
+-----------------
+locale='de-CH-x-phonebk'
+disp_locale=en :  display_name=German #Switzerland, Private-Use=phonebk#
+disp_locale=fr :  display_name=allemand #Suisse, usage privé=phonebk#
+disp_locale=de :  display_name=Deutsch #Schweiz, Privatnutzung=phonebk#
+-----------------
+locale='az-Arab-x-AZE-derbend'
+disp_locale=en :  display_name=Azerbaijani #Arabic, Private-Use=aze-derbend#
+disp_locale=fr :  display_name=azéri #arabe, usage privé=aze-derbend#
+disp_locale=de :  display_name=Aserbaidschanisch #Arabisch, Privatnutzung=aze-derbend#
+-----------------
+locale='zh-min'
+disp_locale=en :  display_name=Chinese #MIN#
+disp_locale=fr :  display_name=chinois #MIN#
+disp_locale=de :  display_name=Chinesisch #MIN#
+-----------------
+locale='zh-min-nan-Hant-CN'
+disp_locale=en :  display_name=Chinese #MIN, NAN_HANT_CN#
+disp_locale=fr :  display_name=chinois #MIN, NAN_HANT_CN#
+disp_locale=de :  display_name=Chinesisch #MIN, NAN_HANT_CN#
+-----------------
+locale='x-whatever'
+disp_locale=en :  display_name=x-whatever #Private-Use=whatever#
+disp_locale=fr :  display_name=x-whatever #usage privé=whatever#
+disp_locale=de :  display_name=x-whatever #Privatnutzung=whatever#
+-----------------
+locale='qaa-Qaaa-QM-x-southern'
+disp_locale=en :  display_name=qaa #Qaaa, QM, Private-Use=southern#
+disp_locale=fr :  display_name=qaa #Qaaa, QM, usage privé=southern#
+disp_locale=de :  display_name=qaa #Qaaa, QM, Privatnutzung=southern#
+-----------------
+locale='sr-Latn-QM'
+disp_locale=en :  display_name=Serbian #Latin, QM#
+disp_locale=fr :  display_name=serbe #latin, QM#
+disp_locale=de :  display_name=Serbisch #Lateinisch, QM#
+-----------------
+locale='sr-Qaaa-CS'
+disp_locale=en :  display_name=Serbian #Qaaa, Serbia#
+disp_locale=fr :  display_name=serbe #Qaaa, Serbie#
+disp_locale=de :  display_name=Serbisch #Qaaa, Serbien#
+-----------------
+locale='en-US-u-islamCal'
+disp_locale=en :  display_name=English #United States, attribute=islamcal#
+disp_locale=fr :  display_name=anglais #États-Unis, attribute=islamcal#
+disp_locale=de :  display_name=Englisch #Vereinigte Staaten, attribute=islamcal#
+-----------------
+locale='zh-CN-a-myExt-x-private'
+disp_locale=en :  display_name=Chinese #China, a=myext, Private-Use=private#
+disp_locale=fr :  display_name=chinois #Chine, a=myext, usage privé=private#
+disp_locale=de :  display_name=Chinesisch #China, a=myext, Privatnutzung=private#
+-----------------
+locale='en-a-myExt-b-another'
+disp_locale=en :  display_name=English #a=myext, b=another#
+disp_locale=fr :  display_name=anglais #a=myext, b=another#
+disp_locale=de :  display_name=Englisch #a=myext, b=another#
+-----------------
+locale='de-419-DE'
+disp_locale=en :  display_name=German #Latin America, DE#
+disp_locale=fr :  display_name=allemand #Amérique latine, DE#
+disp_locale=de :  display_name=Deutsch #Lateinamerika, DE#
+-----------------
+locale='a-DE'
+disp_locale=en :  display_name=a #Germany#
+disp_locale=fr :  display_name=a #Allemagne#
+disp_locale=de :  display_name=a #Deutschland#
+-----------------
+locale='ar-a-aaa-b-bbb-a-ccc'
+disp_locale=en :  display_name=Arabic #a=aaa, b=bbb#
+disp_locale=fr :  display_name=arabe #a=aaa, b=bbb#
+disp_locale=de :  display_name=Arabisch #a=aaa, b=bbb#
+-----------------
@@ -3,6 +3,7 @@ Bug #76777 (first parameter of libxml_set_external_entity_loader callback undefi
 --SKIPIF--
 <?php
 if (!extension_loaded('libxml')) die('skip');
+if (!extension_loaded('dom')) die('skip dom extension not available');
 if (getenv("SKIP_ONLINE_TESTS")) die('skip online test');
 ?>
 --FILE--
@@ -414,6 +414,7 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_mb_decode_numericentity, 0, 0, 2)
 	ZEND_ARG_INFO(0, string)
 	ZEND_ARG_INFO(0, convmap)
 	ZEND_ARG_INFO(0, encoding)
+	ZEND_ARG_INFO(0, is_hex)
 ZEND_END_ARG_INFO()

 ZEND_BEGIN_ARG_INFO_EX(arginfo_mb_send_mail, 0, 0, 3)
@@ -5026,27 +5027,15 @@ PHP_FUNCTION(mb_check_encoding)
 		RETURN_FALSE;
 	}

-	switch(Z_TYPE_P(input)) {
-		case IS_LONG:
-		case IS_DOUBLE:
-		case IS_NULL:
-		case IS_TRUE:
-		case IS_FALSE:
-			RETURN_TRUE;
-			break;
-		case IS_STRING:
-			if (!php_mb_check_encoding(Z_STRVAL_P(input), Z_STRLEN_P(input), enc ? ZSTR_VAL(enc): NULL)) {
-				RETURN_FALSE;
-			}
-			break;
-		case IS_ARRAY:
-			if (!php_mb_check_encoding_recursive(HASH_OF(input), enc)) {
-				RETURN_FALSE;
-			}
-			break;
-		default:
-			php_error_docref(NULL, E_WARNING, "Input is something other than scalar or array");
+	if (Z_TYPE_P(input) == IS_ARRAY) {
+		if (!php_mb_check_encoding_recursive(HASH_OF(input), enc)) {
 			RETURN_FALSE;
+		}
+	} else {
+		convert_to_string(input);
+		if (!php_mb_check_encoding(Z_STRVAL_P(input), Z_STRLEN_P(input), enc ? ZSTR_VAL(enc): NULL)) {
+			RETURN_FALSE;
+		}
 	}
 	RETURN_TRUE;
 }
@@ -29,6 +29,7 @@

 #include "regint.h"

+#if 0
 static void
 conv_ext0be32(const UChar* s, const UChar* end, UChar* conv)
 {
@@ -158,6 +159,7 @@ conv_encoding(OnigEncoding from, OnigEncoding to, const UChar* s, const UChar* e

  return ONIGERR_NOT_SUPPORTED_ENCODING_COMBINATION;
 }
+#endif

 extern int
 onig_new_deluxe(regex_t** reg, const UChar* pattern, const UChar* pattern_end,
@@ -169,9 +171,7 @@ onig_new_deluxe(regex_t** reg, const UChar* pattern, const UChar* pattern_end,
  if (IS_NOT_NULL(einfo)) einfo->par = (UChar* )NULL;

  if (ci->pattern_enc != ci->target_enc) {
-    r = conv_encoding(ci->pattern_enc, ci->target_enc, pattern, pattern_end,
-                      &cpat, &cpat_end);
-    if (r) return r;
+    return ONIGERR_NOT_SUPPORTED_ENCODING_COMBINATION;
  }
  else {
    cpat     = (UChar* )pattern;
@@ -0,0 +1,20 @@
+--TEST--
+Bug #78609 (mb_check_encoding() no longer supports stringable objects)
+--SKIPIF--
+<?php
+if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
+?>
+--FILE--
+<?php
+class Foo
+{
+    public function __toString()
+    {
+        return 'string_representation';
+    }
+}
+
+var_dump(mb_check_encoding(new Foo, 'UTF-8'));
+?>
+--EXPECT--
+bool(true)
@@ -61,10 +61,12 @@ void mysqli_common_connect(INTERNAL_FUNCTION_PARAMETERS, zend_bool is_real_conne
 	MY_MYSQL			*mysql = NULL;
 	MYSQLI_RESOURCE		*mysqli_resource = NULL;
 	zval				*object = getThis();
-	char				*hostname = NULL, *username=NULL, *passwd=NULL, *dbname=NULL, *socket=NULL;
-	size_t					hostname_len = 0, username_len = 0, passwd_len = 0, dbname_len = 0, socket_len = 0;
-	zend_bool			persistent = FALSE;
-	zend_long				port = 0, flags = 0;
+	char				*hostname = NULL, *username=NULL, *passwd=NULL, *dbname=NULL, *socket=NULL,
+						*ssl_key = NULL, *ssl_cert = NULL, *ssl_ca = NULL, *ssl_capath = NULL,
+						*ssl_cipher = NULL;
+	size_t				hostname_len = 0, username_len = 0, passwd_len = 0, dbname_len = 0, socket_len = 0;
+	zend_bool			persistent = FALSE, ssl = FALSE;
+	zend_long			port = 0, flags = 0;
 	zend_string			*hash_key = NULL;
 	zend_bool			new_connection = FALSE;
 	zend_resource		*le;
@@ -189,6 +191,33 @@ void mysqli_common_connect(INTERNAL_FUNCTION_PARAMETERS, zend_bool is_real_conne

 								goto end;
 							} else {
+#ifdef MYSQLI_USE_MYSQLND
+								if (mysql->mysql->data->vio->data->ssl) {
+									/* copy over pre-existing ssl settings so we can reuse them when reconnecting */
+									ssl = TRUE;
+
+									ssl_key = my_estrdup(mysql->mysql->data->vio->data->options.ssl_key);
+									ssl_cert = my_estrdup(mysql->mysql->data->vio->data->options.ssl_cert);
+									ssl_ca = my_estrdup(mysql->mysql->data->vio->data->options.ssl_ca);
+									ssl_capath = my_estrdup(mysql->mysql->data->vio->data->options.ssl_capath);
+									ssl_cipher = my_estrdup(mysql->mysql->data->vio->data->options.ssl_cipher);
+								}
+#else
+								if (mysql->mysql->options.ssl_key
+										|| mysql->mysql->options.ssl_cert
+										|| mysql->mysql->options.ssl_ca
+										|| mysql->mysql->options.ssl_capath
+										|| mysql->mysql->options.ssl_cipher) {
+									/* copy over pre-existing ssl settings so we can reuse them when reconnecting */
+									ssl = TRUE;
+
+									ssl_key = my_estrdup(mysql->mysql->options.ssl_key);
+									ssl_cert = my_estrdup(mysql->mysql->options.ssl_cert);
+									ssl_ca = my_estrdup(mysql->mysql->options.ssl_ca);
+									ssl_capath = my_estrdup(mysql->mysql->options.ssl_capath);
+									ssl_cipher = my_estrdup(mysql->mysql->options.ssl_cipher);
+								}
+#endif
 								mysqli_close(mysql->mysql, MYSQLI_CLOSE_IMPLICIT);
 								mysql->mysql = NULL;
 							}
@@ -241,8 +270,28 @@ void mysqli_common_connect(INTERNAL_FUNCTION_PARAMETERS, zend_bool is_real_conne
 	/* BC for prior to bug fix #53425 */
 	flags |= CLIENT_MULTI_RESULTS;

+	if (ssl) {
+		/* if we're here, this means previous conn was ssl, repopulate settings */
+		mysql_ssl_set(mysql->mysql, ssl_key, ssl_cert, ssl_ca, ssl_capath, ssl_cipher);
+
+		my_efree(ssl_key);
+		my_efree(ssl_cert);
+		my_efree(ssl_ca);
+		my_efree(ssl_capath);
+		my_efree(ssl_cipher);
+	}
 	if (mysql_real_connect(mysql->mysql, hostname, username, passwd, dbname, port, socket, flags) == NULL)
 #else
+	if (ssl) {
+		/* if we're here, this means previous conn was ssl, repopulate settings */
+		mysql_ssl_set(mysql->mysql, ssl_key, ssl_cert, ssl_ca, ssl_capath, ssl_cipher);
+
+		my_efree(ssl_key);
+		my_efree(ssl_cert);
+		my_efree(ssl_ca);
+		my_efree(ssl_capath);
+		my_efree(ssl_cipher);
+	}
 	if (mysqlnd_connect(mysql->mysql, hostname, username, passwd, passwd_len, dbname, dbname_len,
 						port, socket, flags, MYSQLND_CLIENT_KNOWS_RSET_COPY_DATA) == NULL)
 #endif
@@ -7,10 +7,10 @@ mysqli autocommit/commit/rollback with innodb

 	require_once('connect.inc');
 	if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
-		die(sprintf("Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));
+		die(sprintf("skip Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));

 	if (!have_innodb($link))
-		die(sprintf("Needs InnoDB support, [%d] %s", $link->errno, $link->error));
+		die(sprintf("skip Needs InnoDB support, [%d] %s", $link->errno, $link->error));
 ?>
 --FILE--
 <?php
@@ -97,7 +97,7 @@ object(mysqli_stmt)#%d (%d) {
  ["sqlstate"]=>
  string(5) "00000"
  ["id"]=>
-  int(3)
+  int(%d)
 }
 bool(true)
 bool(false)
@@ -13,7 +13,7 @@ mysqli_autocommit()
 	}

 	if (!have_innodb($link))
-		die(sprintf("Needs InnoDB support, [%d] %s", $link->errno, $link->error));
+		die(sprintf("skip Needs InnoDB support, [%d] %s", $link->errno, $link->error));
 ?>
 --FILE--
 <?php
@@ -14,7 +14,7 @@ mysqli->autocommit()
 	}

 	if (!have_innodb($link))
-		die(sprintf("Needs InnoDB support, [%d] %s", $link->errno, $link->error));
+		die(sprintf("skip Needs InnoDB support, [%d] %s", $link->errno, $link->error));
 ?>
 --FILE--
 <?php
@@ -8,10 +8,10 @@ require_once('skipifconnectfailure.inc');

 require_once('connect.inc');
 if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
-	die(sprintf("Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));
+	die(sprintf("skip Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));

 if (!have_innodb($link))
-	die(sprintf("Needs InnoDB support, [%d] %s", $link->errno, $link->error));
+	die(sprintf("skip Needs InnoDB support, [%d] %s", $link->errno, $link->error));
 ?>
 --FILE--
 <?php
@@ -7,10 +7,10 @@ require_once('skipifemb.inc');
 require_once('skipifconnectfailure.inc');
 require_once('connect.inc');
 if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
-	die(sprintf("Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));
+	die(sprintf("skip Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));

 if (!have_innodb($link))
-	die(sprintf("Needs InnoDB support, [%d] %s", $link->errno, $link->error));
+	die(sprintf("skip Needs InnoDB support, [%d] %s", $link->errno, $link->error));
 ?>
 --FILE--
 <?php
@@ -8,10 +8,10 @@ require_once('skipifconnectfailure.inc');

 require_once('connect.inc');
 if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
-	die(sprintf("Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));
+	die(sprintf("skip Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));

 if (!have_innodb($link))
-	die(sprintf("Needs InnoDB support, [%d] %s", $link->errno, $link->error));
+	die(sprintf("skip Needs InnoDB support, [%d] %s", $link->errno, $link->error));
 ?>
 --FILE--
 <?php
@@ -8,10 +8,10 @@ require_once('skipifconnectfailure.inc');

 require_once('connect.inc');
 if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
-	die(sprintf("Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));
+	die(sprintf("skip Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));

 if (!have_innodb($link))
-	die(sprintf("Needs InnoDB support, [%d] %s", $link->errno, $link->error));
+	die(sprintf("skip Needs InnoDB support, [%d] %s", $link->errno, $link->error));
 ?>
 --FILE--
 <?php
@@ -0,0 +1,78 @@
+--TEST--
+mysqli check the session_connect_attrs table for connection attributes
+--SKIPIF--
+<?php
+require_once('skipif.inc');
+require_once('skipifconnectfailure.inc');
+
+if (!$IS_MYSQLND)
+	die("skip: test applies only to mysqlnd");
+
+if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
+	die("skip Cannot connect to the server");
+
+/* skip test if the server version does not have session_connect_attrs table yet*/
+if (!$res = mysqli_query($link, "select count(*) as count from information_schema.tables where table_schema='performance_schema' and table_name='session_connect_attrs';"))
+    die("skip select from information_schema.tables for session_connect_attrs  query failed");
+
+$tmp = mysqli_fetch_assoc($res);
+mysqli_free_result($res);
+if($tmp['count'] == "0") {
+    mysqli_close($link);
+    die("skip mysql does not support session_connect_attrs table yet");
+}
+
+/* skip test if performance_schema is OFF*/
+if (!$res = mysqli_query($link, "show variables like 'performance_schema';"))
+    die("skip show variables like 'performance_schema' failed");
+
+$tmp = mysqli_fetch_assoc($res);
+mysqli_free_result($res);
+if($tmp['Value'] == "OFF") {
+    mysqli_close($link);
+    die("skip performance_schema is OFF");
+}
+
+mysqli_close($link);
+?>
+--FILE--
+<?php
+	require_once("connect.inc");
+
+	$tmp    = NULL;
+	$link   = NULL;
+    $res    = NULL;
+	if (!$link = mysqli_connect($host, $user, $passwd, $db, $port, $socket))
+		printf("[001] Cannot connect to the server using host=%s, user=%s, passwd=***, dbname=%s, port=%s, socket=%s\n",$host, $user, $db, $port, $socket);
+
+    //in case $host is empty, do not test for _server_host field
+    if (isset($host) && trim($host) != '') {
+        if (!$res = mysqli_query($link, "select * from performance_schema.session_connect_attrs where ATTR_NAME='_server_host' and processlist_id = connection_id()")) {
+            printf("[002] [%d] %s\n", mysqli_errno($link), mysqli_error($link));
+        } else {
+            $tmp = mysqli_fetch_assoc($res);
+            if (!$tmp || !isset($tmp['ATTR_NAME'])) {
+                echo "[003] _server_host missing\n";
+            } elseif ($tmp['ATTR_VALUE'] !== $host) {
+                printf("[004] _server_host value mismatch\n") ;
+            }
+            mysqli_free_result($res);
+        }
+    }
+
+    if (!$res = mysqli_query($link, "select * from performance_schema.session_connect_attrs where ATTR_NAME='_client_name' and processlist_id = connection_id()")) {
+        printf("[005] [%d] %s\n", mysqli_errno($link), mysqli_error($link));
+    } else {
+        $tmp = mysqli_fetch_assoc($res);
+        if (!$tmp || !isset($tmp['ATTR_NAME'])) {
+            echo "[006] _client_name missing\n";
+        } elseif ($tmp['ATTR_VALUE'] !== "mysqlnd") {
+            printf("[007] _client_name value mismatch\n") ;
+        }
+        mysqli_free_result($res);
+    }
+
+    printf("done!");
+?>
+--EXPECTF--
+done!
@@ -14,10 +14,10 @@ if (!function_exists('posix_getpid'))

 require_once('connect.inc');
 if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
-	die(sprintf("Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));
+	die(sprintf("skip Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));

 if (!have_innodb($link))
-	die(sprintf("Needs InnoDB support, [%d] %s", $link->errno, $link->error));
+	die(sprintf("skip Needs InnoDB support, [%d] %s", $link->errno, $link->error));
 ?>
 --FILE--
 <?php
@@ -8,10 +8,10 @@ require_once('skipifconnectfailure.inc');

 require_once('connect.inc');
 if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
-	die(sprintf("Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));
+	die(sprintf("skip Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));

 if (!have_innodb($link))
-	die(sprintf("Needs InnoDB support, [%d] %s", $link->errno, $link->error));
+	die(sprintf("skip Needs InnoDB support, [%d] %s", $link->errno, $link->error));
 ?>
 --FILE--
 <?php
@@ -10,10 +10,10 @@ mysqli_rollback()

 	require_once('connect.inc');
 	if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
-		die(sprintf("Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));
+		die(sprintf("skip Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));

 	if (!have_innodb($link))
-		die(sprintf("Needs InnoDB support, [%d] %s", $link->errno, $link->error));
+		die(sprintf("skip Needs InnoDB support, [%d] %s", $link->errno, $link->error));
 ?>
 --FILE--
 <?php
@@ -8,10 +8,10 @@ require_once('skipifconnectfailure.inc');

 require_once('connect.inc');
 if (!$link = my_mysqli_connect($host, $user, $passwd, $db, $port, $socket))
-	die(sprintf("Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));
+	die(sprintf("skip Cannot connect, [%d] %s", mysqli_connect_errno(), mysqli_connect_error()));

 if (!have_innodb($link))
-	die(sprintf("Needs InnoDB support, [%d] %s", $link->errno, $link->error));
+	die(sprintf("skip Needs InnoDB support, [%d] %s", $link->errno, $link->error));
 ?>
 --FILE--
 <?php
@@ -97,7 +97,7 @@ memory_limit=256M
 	require_once("clean_table.inc");
 ?>
 --EXPECTF--
-int(1)
+int(%d)
 executing
 bool(true)
 done!
@@ -425,6 +425,9 @@ mysqlnd_auth_change_user(MYSQLND_CONN_DATA * const conn,
 		auth_packet->auth_data_len = auth_plugin_data_len;
 		auth_packet->auth_plugin_name = auth_protocol;

+        if (conn->server_capabilities & CLIENT_CONNECT_ATTRS) {
+			auth_packet->connect_attr = conn->options->connect_attr;
+        }

 		if (conn->m->get_server_version(conn) >= 50123) {
 			auth_packet->charset_no	= conn->charset->nr;
@@ -519,6 +519,10 @@ MYSQLND_METHOD(mysqlnd_conn_data, get_updated_connect_flags)(MYSQLND_CONN_DATA *
 	}
 #endif

+    if (conn->options->connect_attr && zend_hash_num_elements(conn->options->connect_attr)) {
+		mysql_flags |= CLIENT_CONNECT_ATTRS;
+	}
+
 	DBG_RETURN(mysql_flags);
 }
 /* }}} */
@@ -665,7 +669,7 @@ MYSQLND_METHOD(mysqlnd_conn_data, connect)(MYSQLND_CONN_DATA * conn,
 		password.s = "";
 		password.l = 0;
 	}
-	if (!database.s) {
+	if (!database.s || !database.s[0]) {
 		DBG_INF_FMT("no db given, using empty string");
 		database.s = "";
 		database.l = 0;
@@ -833,6 +837,9 @@ MYSQLND_METHOD(mysqlnd_conn, connect)(MYSQLND * conn_handle,

 	if (PASS == conn->m->local_tx_start(conn, this_func)) {
 		mysqlnd_options4(conn_handle, MYSQL_OPT_CONNECT_ATTR_ADD, "_client_name", "mysqlnd");
+        if (hostname.l > 0) {
+            mysqlnd_options4(conn_handle, MYSQL_OPT_CONNECT_ATTR_ADD, "_server_host", hostname.s);
+        }
 		ret = conn->m->connect(conn, hostname, username, password, database, port, socket_or_pipe, mysql_flags);

 		conn->m->local_tx_end(conn, this_func, FAIL);
@@ -552,7 +552,7 @@ size_t php_mysqlnd_auth_write(void * _packet)
 			p+= packet->auth_data_len;
 		}

-		if (packet->db) {
+		if (packet->db_len > 0) {
 			/* CLIENT_CONNECT_WITH_DB should have been set */
 			size_t real_db_len = MIN(MYSQLND_MAX_ALLOWED_DB_LEN, packet->db_len);
 			memcpy(p, packet->db, real_db_len);
@@ -2752,7 +2752,10 @@ PHP_FUNCTION(odbc_close)
 		return;
 	}

-	conn = (odbc_connection *)zend_fetch_resource2(Z_RES_P(pv_conn), "ODBC-Link", le_conn, le_pconn);
+	if (!(conn = (odbc_connection *)zend_fetch_resource2(Z_RES_P(pv_conn), "ODBC-Link", le_conn, le_pconn))) {
+		RETURN_FALSE;
+	}
+
 	if (Z_RES_P(pv_conn)->type == le_pconn) {
 		is_pconn = 1;
 	}
@@ -0,0 +1,14 @@
+--TEST--
+Bug #78473 (odbc_close() closes arbitrary resources)
+--SKIPIF--
+<?php
+if (!extension_loaded('odbc')) die('skip odbc extension not available');
+?>
+--FILE--
+<?php
+odbc_close(STDIN);
+var_dump(STDIN);
+?>
+--EXPECTF--
+Warning: odbc_close(): supplied resource is not a valid ODBC-Link resource in %s on line %d
+resource(%d) of type (stream)
@@ -565,7 +565,8 @@ static void dce_live_ranges(context *ctx, zend_op_array *op_array, zend_ssa *ssa

 			if ((op_array->opcodes[def].result_type == IS_UNUSED) &&
 					(UNEXPECTED(op_array->opcodes[def].opcode == ZEND_EXT_STMT) ||
-					UNEXPECTED(op_array->opcodes[def].opcode == ZEND_EXT_FCALL_END))) {
+					UNEXPECTED(op_array->opcodes[def].opcode == ZEND_EXT_FCALL_END) ||
+					UNEXPECTED(op_array->opcodes[def].opcode == ZEND_END_SILENCE))) {
 				def--;
 			}

@@ -302,7 +302,8 @@ static inline zend_bool can_elide_return_type_check(
 		return 0;
 	}

-	if (ZEND_TYPE_CODE(info->type) == IS_CALLABLE) {
+	/* These types are not represented exactly */
+	if (ZEND_TYPE_CODE(info->type) == IS_CALLABLE || ZEND_TYPE_CODE(info->type) == IS_ITERABLE) {
 		return 0;
 	}

@@ -277,7 +277,7 @@ static const func_info_t func_infos[] = {
 	F0("sleep",                        MAY_BE_FALSE | MAY_BE_LONG),
 	F0("usleep",                       MAY_BE_NULL | MAY_BE_FALSE),
 #if HAVE_NANOSLEEP
-	F0("time_nanosleep",               MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_TRUE),
+	F0("time_nanosleep",               MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_TRUE | MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_STRING | MAY_BE_ARRAY_OF_LONG),
 	F0("time_sleep_until",             MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_TRUE),
 #endif
 #if HAVE_STRPTIME
@@ -404,7 +404,7 @@ static const func_info_t func_infos[] = {
 	F1("system",                       MAY_BE_FALSE | MAY_BE_STRING),
 	F1("escapeshellcmd",               MAY_BE_NULL | MAY_BE_STRING),
 	F1("escapeshellarg",               MAY_BE_NULL | MAY_BE_STRING),
-	F1("passthru",                     MAY_BE_FALSE | MAY_BE_STRING),
+	F1("passthru",                     MAY_BE_NULL | MAY_BE_FALSE),
 	F1("shell_exec",                   MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_STRING),
 #ifdef PHP_CAN_SUPPORT_PROC_OPEN
 	F1("proc_open",                    MAY_BE_FALSE | MAY_BE_RESOURCE),
@@ -685,7 +685,7 @@ static const func_info_t func_infos[] = {
 	F1("stream_get_transports",        MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_LONG | MAY_BE_ARRAY_OF_STRING),
 	F1("stream_resolve_include_path",  MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_STRING),
 	F0("stream_is_local",              MAY_BE_FALSE | MAY_BE_TRUE),
-	F1("get_headers",                  MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_LONG | MAY_BE_ARRAY_OF_STRING | MAY_BE_ARRAY_OF_ARRAY),
+	F1("get_headers",                  MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_STRING | MAY_BE_ARRAY_OF_ARRAY),
 #if HAVE_SYS_TIME_H || defined(PHP_WIN32)
 	F0("stream_set_timeout",           MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_TRUE),
 	F0("socket_set_timeout",           MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_TRUE),
@@ -1192,7 +1192,7 @@ static const func_info_t func_infos[] = {
 	F1("hash_hmac_file",                        MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_STRING),
 	F1("hash_init",                             MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_OBJECT),
 	F0("hash_update",                           MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_TRUE),
-	F0("hash_update_stream",                    MAY_BE_NULL | MAY_BE_LONG),
+	F0("hash_update_stream",                    MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_LONG),
 	F0("hash_update_file",                      MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_TRUE),
 	F1("hash_final",                            MAY_BE_NULL | MAY_BE_STRING),
 	F1("hash_copy",                             MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_OBJECT),
@@ -0,0 +1,17 @@
+--TEST--
+Bug #77191: Assertion failure in dce_live_ranges() when silencing is used
+--FILE--
+<?php
+function test($x) {
+	switch (@$x['y']) {
+		case 1: return 'a';
+		case 2: return 'b';
+		case 3: return 'c';
+		case 4: return 'd';
+	}
+	return 'e';
+}
+var_dump(test([]));
+?>
+--EXPECT--
+string(1) "e"
@@ -0,0 +1,17 @@
+--TEST--
+Don't optimize object -> iterable
+--FILE--
+<?php
+
+function test(object $arg): iterable {
+    return $arg;
+}
+test(new stdClass);
+
+?>
+--EXPECTF--
+Fatal error: Uncaught TypeError: Return value of test() must be iterable, object returned in %s:%d
+Stack trace:
+#0 %s(%d): test(Object(stdClass))
+#1 {main}
+  thrown in %s on line %d
@@ -0,0 +1,10 @@
+--TEST--
+Bug #75457 (heap-use-after-free in php7.0.25)
+--FILE--
+<?php
+$pattern = "/(((?(?C)0?=))(?!()0|.(?0)0)())/";
+var_dump(preg_match($pattern, "hello"));
+?>
+--EXPECTF--
+Warning: preg_match(): Compilation failed: assertion expected after (?( or (?(?C) at offset 4 in %sbug75457.php on line %d
+bool(false)
@@ -0,0 +1,58 @@
+--TEST--
+PDO_MYSQL: check the session_connect_attrs table for connection attributes
+--SKIPIF--
+<?php
+require_once(__DIR__ . DIRECTORY_SEPARATOR . 'skipif.inc');
+require_once(__DIR__ . DIRECTORY_SEPARATOR . 'mysql_pdo_test.inc');
+MySQLPDOTest::skip();
+if (!MySQLPDOTest::isPDOMySQLnd()) die('skip only for mysqlnd');
+
+$pdo = MySQLPDOTest::factory();
+
+$stmt = $pdo->query("select count(*) from information_schema.tables where table_schema='performance_schema' and table_name='session_connect_attrs'");
+if (!$stmt || !$stmt->fetchColumn()) {
+    die("skip mysql does not support session_connect_attrs table yet");
+}
+
+$stmt = $pdo->query("show variables like 'performance_schema'");
+if (!$stmt || $stmt->fetchColumn(1) !== 'ON') {
+    die("skip performance_schema is OFF");
+}
+
+?>
+--FILE--
+<?php
+
+require_once(__DIR__ . DIRECTORY_SEPARATOR . 'mysql_pdo_test.inc');
+$pdo = MySQLPDOTest::factory();
+
+if (preg_match('/host=([^;]+)/', PDO_MYSQL_TEST_DSN, $m)) {
+    $host = $m[1];
+}
+
+//in case $host is empty, do not test for _server_host field
+if (isset($host) && $host !== '') {
+    $stmt = $pdo->query("select * from performance_schema.session_connect_attrs where ATTR_NAME='_server_host' and processlist_id = connection_id()");
+
+    $row = $stmt->fetch(PDO::FETCH_ASSOC);
+
+    if (!$row || !isset($row['attr_name'])) {
+        echo "_server_host missing\n";
+    } elseif ($row['attr_value'] !== $host) {
+        printf("_server_host mismatch (expected '%s', got '%s')\n", $host, $row['attr_value']);
+    }
+}
+
+$stmt = $pdo->query("select * from performance_schema.session_connect_attrs where ATTR_NAME='_client_name' and processlist_id = connection_id()");
+
+$row = $stmt->fetch(PDO::FETCH_ASSOC);
+if (!$row || !isset($row['attr_name'])) {
+    echo "_client_name missing\n";
+} elseif ($row['attr_value'] !== 'mysqlnd') {
+    printf("_client_name mismatch (expected 'mysqlnd', got '%s')\n", $row['attr_value']);
+}
+
+printf("done!");
+?>
+--EXPECT--
+done!
@@ -6,7 +6,8 @@ Francesco Fullone ff@ideato.it
 #PHPTestFest Cesena Italia on 2009-06-20
 --SKIPIF--
 <?php
-        if(!extension_loaded("posix")) print "skip - POSIX extension not loaded";
+if(!extension_loaded("posix")) print "skip posix extension not loaded";
+if(!extension_loaded("pcntl")) print "skip pcntl extension not loaded";
 ?>
 --FILE--
 <?php
@@ -192,14 +192,15 @@ PS_GC_FUNC(user)

 	if (Z_TYPE(retval) == IS_LONG) {
 		convert_to_long(&retval);
-		return Z_LVAL(retval);
+		*nrdels = Z_LVAL(retval);
+	} else if (Z_TYPE(retval) == IS_TRUE) {
+		/* This is for older API compatibility */
+		*nrdels = 1;
+	} else {
+		/* Anything else is some kind of error */
+		*nrdels = -1; // Error
 	}
-	/* This is for older API compatibility */
-	if (Z_TYPE(retval) == IS_TRUE) {
-		return 1;
-	}
-	/* Anything else is some kind of error */
-	return -1; // Error
+	return *nrdels;
 }

 PS_CREATE_SID_FUNC(user)
@@ -0,0 +1,62 @@
+--TEST--
+Test session_set_save_handler() : session_gc() returns the number of deleted records.
+--INI--
+session.name=PHPSESSID
+session.save_handler=files
+session.gc_probability=0
+--SKIPIF--
+<?php include('skipif.inc'); ?>
+--FILE--
+<?php
+
+ob_start();
+
+/*
+ * Prototype : bool session_set_save_handler(SessionHandler $handler [, bool $register_shutdown_function = true])
+ * Description : Sets user-level session storage functions
+ * Source code : ext/session/session.c
+ */
+
+echo "*** Test session_set_save_handler() : session_gc() returns the number of deleted records. ***\n";
+
+class MySession implements SessionHandlerInterface {
+    public function open($path, $name) {
+        echo 'Open', "\n";
+        return true;
+    }
+    public function read($key) {
+        echo 'Read ', session_id(), "\n";
+        return '';
+    }
+    public function write($key, $data) {
+        echo 'Write ', session_id(), "\n";
+        return true;
+    }
+    public function close() {
+        echo 'Close ', session_id(), "\n";
+        return true;
+    }
+    public function destroy($key) {
+        echo 'Destroy ', session_id(), "\n";
+        return true;
+    }
+    public function gc($ts) {
+        echo 'Garbage collect', "\n";
+        return 1;
+    }
+}
+
+$handler = new MySession;
+session_set_save_handler($handler);
+session_start();
+var_dump(session_gc());
+session_write_close();
+
+--EXPECTF--
+*** Test session_set_save_handler() : session_gc() returns the number of deleted records. ***
+Open
+Read %s
+Garbage collect
+int(1)
+Write %s
+Close %s
@@ -49,6 +49,12 @@ var_dump($_SESSION);
 $_SESSION['Bar'] = 'Foo';
 session_write_close();

+echo "Garbage collection..\n";
+session_id($session_id);
+session_start();
+var_dump(session_gc());
+session_write_close();
+
 echo "Cleanup..\n";
 session_id($session_id);
 session_start();
@@ -101,6 +107,12 @@ array(3) {
 }
 Write [%s,%s,Blah|s:12:"Hello World!";Foo|b:0;Guff|i:1234567890;Bar|s:3:"Foo";]
 Close [%s,PHPSESSID]
+Garbage collection..
+Open [%s,PHPSESSID]
+Read [%s,%s]
+int(0)
+Write [%s,%s,Blah|s:12:"Hello World!";Foo|b:0;Guff|i:1234567890;Bar|s:3:"Foo";]
+Close [%s,PHPSESSID]
 Cleanup..
 Open [%s,PHPSESSID]
 Read [%s,%s]
@@ -9,4 +9,4 @@ require_once (dirname(__FILE__).'/snmp_include.inc');
 //string $object_id  [, int $timeout  [, int $retries  ]] )

 if (snmpget($hostname, $community, '.1.3.6.1.2.1.1.1.0', $timeout) === false)
-	die('NO SNMPD on this host or community invalid');
+	die('skip NO SNMPD on this host or community invalid');
@@ -5,7 +5,7 @@ Olivier Doucet
 --SKIPIF--
 <?php
 require_once(dirname(__FILE__).'/skipif.inc');
-if (!function_exists('snmp_set_enum_print')) die('This function is only available if using NET_SNMP');
+if (!function_exists('snmp_set_enum_print')) die('skip This function is only available if using NET_SNMP');
 ?>
 --FILE--
 <?php
@@ -5,7 +5,7 @@ Olivier Doucet
 --SKIPIF--
 <?php
 require_once(dirname(__FILE__).'/skipif.inc');
-if (!function_exists('snmp_set_oid_output_format')) die('This function is only available if using NET_SNMP');
+if (!function_exists('snmp_set_oid_output_format')) die('skip This function is only available if using NET_SNMP');
 ?>
 --FILE--
 <?php
@@ -106,7 +106,7 @@ static void init_ancillary_registry(void)
 	entry.to_array		= to; \
 	key.cmsg_level		= level; \
 	key.cmsg_type		= type; \
-	zend_hash_str_update_mem(&ancillary_registry.ht, (char*)&key, sizeof(key) - 1, (void*)&entry, sizeof(entry))
+	zend_hash_str_update_mem(&ancillary_registry.ht, (char*)&key, sizeof(key), (void*)&entry, sizeof(entry))

 #if defined(IPV6_PKTINFO) && HAVE_IPV6
 	PUT_ENTRY(sizeof(struct in6_pktinfo), 0, 0, from_zval_write_in6_pktinfo,
@@ -156,7 +156,7 @@ ancillary_reg_entry *get_ancillary_reg_entry(int cmsg_level, int msg_type)
 	tsrm_mutex_unlock(ancillary_mutex);
 #endif

-	if ((entry = zend_hash_str_find_ptr(&ancillary_registry.ht, (char*)&key, sizeof(key) - 1)) != NULL) {
+	if ((entry = zend_hash_str_find_ptr(&ancillary_registry.ht, (char*)&key, sizeof(key))) != NULL) {
 		return entry;
 	} else {
 		return NULL;
@@ -934,6 +934,7 @@ PHP_FUNCTION(sodium_crypto_generichash_init)
 		zend_throw_exception(sodium_exception_ce, "unsupported key length", 0);
 		return;
 	}
+	memset(&state_tmp, 0, sizeof state_tmp);
 	if (crypto_generichash_init((void *) &state_tmp, key, (size_t) key_len,
 								(size_t) hash_len) != 0) {
 		zend_throw_exception(sodium_exception_ce, "internal error", 0);
@@ -379,8 +379,7 @@ static zend_object *spl_filesystem_object_clone(zval *zobject)
 			intern->u.dir.index = index;
 			break;
 		case SPL_FS_FILE:
-			zend_throw_error(NULL, "An object of class %s cannot be cloned", ZSTR_VAL(old_object->ce->name));
-			return new_object;
+			ZEND_ASSERT(0);
 	}

 	intern->file_class = source->file_class;
@@ -3168,6 +3167,7 @@ PHP_MINIT_FUNCTION(spl_directory)
 	REGISTER_SPL_IMPLEMENTS(RecursiveDirectoryIterator, RecursiveIterator);

 	memcpy(&spl_filesystem_object_check_handlers, &spl_filesystem_object_handlers, sizeof(zend_object_handlers));
+	spl_filesystem_object_check_handlers.clone_obj = NULL;
 	spl_filesystem_object_check_handlers.get_method = spl_filesystem_object_get_method_check;

 #ifdef HAVE_GLOB
@@ -787,6 +787,9 @@ SPL_METHOD(SplObjectStorage, unserialize)

 	--p; /* for ';' */
 	count = Z_LVAL_P(pcount);
+	if (count < 0) {
+		goto outexcept;
+	}

 	ZVAL_UNDEF(&entry);
 	ZVAL_UNDEF(&inf);
@@ -804,12 +807,14 @@ SPL_METHOD(SplObjectStorage, unserialize)
 		}
 		/* store reference to allow cross-references between different elements */
 		if (!php_var_unserialize(&entry, &p, s + buf_len, &var_hash)) {
+			zval_ptr_dtor(&entry);
 			goto outexcept;
 		}
 		if (*p == ',') { /* new version has inf */
 			++p;
 			if (!php_var_unserialize(&inf, &p, s + buf_len, &var_hash)) {
 				zval_ptr_dtor(&entry);
+				zval_ptr_dtor(&inf);
 				goto outexcept;
 			}
 		}
@@ -0,0 +1,10 @@
+--TEST--
+Bug #72884:  isCloneable() on SplFileObject should return false
+--FILE--
+<?php
+$x=new SplFileObject(__FILE__);
+$r=new ReflectionObject($x);
+var_dump($r->isCloneable());
+
+--EXPECT--
+bool(false)
@@ -12,7 +12,7 @@ try {
 var_dump($y);
 ?>
 --EXPECTF--
-string(49) "An object of class SplFileObject cannot be cloned"
+string(60) "Trying to clone an uncloneable object of class SplFileObject"

 Notice: Undefined variable: y in %sbug72888.php on line %d
 NULL
@@ -1,11 +1,11 @@
-/* 
+/*
                      DO NOT EDIT THIS FILE!

- it has been automaticaly created by php7/scripts/credits from  
+ it has been automaticaly created by php7/scripts/credits from
 the information found in the various php7/ext/.../CREDITS and
- php7/sapi/.../CREDITS files 
- 
- if you want to change an entry you have to edit the appropriate 
+ php7/sapi/.../CREDITS files
+
+ if you want to change an entry you have to edit the appropriate
 CREDITS file instead

 */
@@ -28,7 +28,7 @@ CREDIT_LINE("FTP", "Stefan Esser, Andrew Skalski");
 CREDIT_LINE("GD imaging", "Rasmus Lerdorf, Stig Bakken, Jim Winstead, Jouni Ahto, Ilia Alshanetsky, Pierre-Alain Joye, Marcus Boerger");
 CREDIT_LINE("GetText", "Alex Plotnick");
 CREDIT_LINE("GNU GMP support", "Stanislav Malyshev");
-CREDIT_LINE("Iconv", "Rui Hirokawa, Stig Bakken, Moriyoshi Koizumi ");
+CREDIT_LINE("Iconv", "Rui Hirokawa, Stig Bakken, Moriyoshi Koizumi");
 CREDIT_LINE("IMAP", "Rex Logan, Mark Musone, Brian Wang, Kaj-Michael Lang, Antoni Pamies Olive, Rasmus Lerdorf, Andrew Skalski, Chuck Hagenbuch, Daniel R Kalowsky");
 CREDIT_LINE("Input Filter", "Rasmus Lerdorf, Derick Rethans, Pierre-Alain Joye, Ilia Alshanetsky");
 CREDIT_LINE("InterBase", "Jouni Ahto, Andrew Avdeev, Ard Biesheuvel");
@@ -1,11 +1,11 @@
-/* 
+/*
                      DO NOT EDIT THIS FILE!

- it has been automaticaly created by php7/scripts/credits from  
+ it has been automaticaly created by php7/scripts/credits from
 the information found in the various php7/ext/.../CREDITS and
- php7/sapi/.../CREDITS files 
- 
- if you want to change an entry you have to edit the appropriate 
+ php7/sapi/.../CREDITS files
+
+ if you want to change an entry you have to edit the appropriate
 CREDITS file instead

 */
@@ -166,7 +166,7 @@ PHP_INI_BEGIN()
 	STD_PHP_INI_ENTRY("user_agent", NULL, PHP_INI_ALL, OnUpdateString, user_agent, php_file_globals, file_globals)
 	STD_PHP_INI_ENTRY("from", NULL, PHP_INI_ALL, OnUpdateString, from_address, php_file_globals, file_globals)
 	STD_PHP_INI_ENTRY("default_socket_timeout", "60", PHP_INI_ALL, OnUpdateLong, default_socket_timeout, php_file_globals, file_globals)
-	STD_PHP_INI_ENTRY("auto_detect_line_endings", "0", PHP_INI_ALL, OnUpdateLong, auto_detect_line_endings, php_file_globals, file_globals)
+	STD_PHP_INI_ENTRY("auto_detect_line_endings", "0", PHP_INI_ALL, OnUpdateBool, auto_detect_line_endings, php_file_globals, file_globals)
 PHP_INI_END()

 PHP_MINIT_FUNCTION(file)
@@ -726,6 +726,11 @@ finish:
 			}
 			ZVAL_STRINGL(&http_response, tmp_line, tmp_line_len);
 			zend_hash_next_index_insert(Z_ARRVAL_P(response_header), &http_response);
+		} else {
+			php_stream_close(stream);
+			stream = NULL;
+			php_stream_wrapper_log_error(wrapper, options, "HTTP request failed!");
+			goto out;
 		}
 	} else {
 		php_stream_wrapper_log_error(wrapper, options, "HTTP request failed, unexpected end of socket!");
@@ -3027,6 +3027,7 @@ static void php_strtr_array(zval *return_value, zend_string *input, HashTable *p
 				len = ZSTR_LEN(key_used);
 				if (UNEXPECTED(len > slen)) {
 					/* skip long patterns */
+					zend_string_release(key_used);
 					continue;
 				}
 				if (len > maxlen) {
@@ -0,0 +1,16 @@
+--TEST--
+Bug #78220 (Can't access OneDrive folder)
+--SKIPIF--
+<?php
+if (substr(PHP_OS, 0, 3) != 'WIN') die("skip this test is for Windows platforms only");
+?>
+--FILE--
+<?php
+$onedrive_dirs = array_unique([getenv('OneDrive'), getenv('OneDriveCommercial')]);
+foreach ($onedrive_dirs as $dir) {
+    if ($dir && scandir($dir) === FALSE) {
+        echo "can't scan $dir\n";
+    }
+}
+?>
+--EXPECT--
@@ -0,0 +1,24 @@
+--TEST--
+auto_detect_line_endings --INI-- bool
+--INI--
+auto_detect_line_endings=on
+--STDIN--
+fooBar1
fooBar2
fooBar3
+--FILE--
+<?php
+
+var_dump(ini_get("auto_detect_line_endings"));
+
+var_dump(fgets(STDIN));
+var_dump(fgets(STDIN));
+var_dump(fgets(STDIN));
+
+echo "Done\n";
+?>
+--EXPECTF--
+string(1) "1"
+string(8) "fooBar1
"
+string(8) "fooBar2
"
+string(8) "fooBar3
+"
+Done
@@ -0,0 +1,28 @@
+--TEST--
+ini_set auto_detect_line_endings bool
+--FILE--
+<?php
+
+ini_set("auto_detect_line_endings", "on");
+var_dump(ini_get("auto_detect_line_endings"));
+
+$filePath = __DIR__ . DIRECTORY_SEPARATOR . "auto_detect_line_endings_2.txt";
+file_put_contents($filePath, "fooBar1\rfooBar2\rfooBar3");
+
+$stdin = fopen($filePath, "r");
+var_dump(fgets($stdin));
+var_dump(fgets($stdin));
+var_dump(fgets($stdin));
+
+echo "Done\n";
+?>
+--EXPECTF--
+string(2) "on"
+string(8) "fooBar1
"
+string(8) "fooBar2
"
+string(7) "fooBar3"
+Done
+--CLEAN--
+<?php
+unlink(__DIR__ . DIRECTORY_SEPARATOR . "auto_detect_line_endings_2.txt");
+?>
Author	SHA1	Message	Date
Remi Collet	d41dd0b518	Update versions for PHP 7.2.24	2019-10-22 08:15:44 +00:00
Remi Collet	46ac6549cc	Update NEWS for PHP 7.2.24	2019-10-22 08:15:44 +00:00
Remi Collet	92de579a00	add NEWS entry for CVE-2019-11043	2019-10-22 09:36:13 +02:00
Stanislav Malyshev	7a990257a0	Merge branch 'PHP-7.1' into PHP-7.2 * PHP-7.1: Fix bug #78599 (env_path_info underflow can lead to RCE) (CVE-2019-11043) bump versions after release set versions for release	2019-10-22 09:34:42 +02:00
Remi Collet	4104bc908e	Update NEWS for 7.2.24	2019-10-08 09:24:52 +00:00
Remi Collet	fe947d245b	Update CREDITS for PHP 7.2.24RC1	2019-10-08 09:12:10 +00:00
Remi Collet	75cc438262	Update NEWS for PHP 7.2.24RC1	2019-10-08 09:12:09 +00:00
Christoph M. Becker	fd3118ffb0	Fix #78641 : addGlob can modify given remove_path value `remove_path` points to the given string, so we must not modify it. Instead we use a duplicate, if we need the modification. We may want to switch to `zend_string`s in master.	2019-10-08 09:45:05 +02:00
Nikita Popov	19e6abebc7	Check for object_init_ex() failure in user filter factory	2019-10-07 17:52:29 +02:00
Nikita Popov	7d19668f60	Set session.gc_probability=0 in bug78624.phpt We only want to test manually triggered session GC. Avoid spurious output due to automatic GC.	2019-10-07 16:43:19 +02:00
Christoph M. Becker	114c03b9a6	Fix #78623 : Regression caused by "SP call yields additional empty result set" This reverts commit `41a4379cb4`.	2019-10-07 09:15:51 +02:00
Christoph M. Becker	545412a6cd	Split intl tests for ICU 65	2019-10-04 13:53:22 +02:00
Christoph M. Becker	abaf9a76dc	Fix #78620 : Out of memory error The integer addition in `ZEND_MM_ALIGNED_SIZE_EX` can overflow, what we have to catch early.	2019-10-04 09:08:01 +02:00
Brent Shaffer	a6d219630c	fix #78624 : session_gc return value for user defined session handlers	2019-10-04 06:12:02 +02:00
Fábio Souto	9a2b42a5c1	Fix bug #76809 (SSL settings aren't respected when persistent connection is reused)	2019-10-03 06:56:21 +02:00
Konstantin Kopachev	05560b67bc	Fix #76859 stream_get_line skips data if used with data-generating filter stream_get-line repeatedly calls php_stream_fill_read_buffer until enough data is accumulated in buffer. However, when stream contains filters attached to it, then each call to fill buffer essentially resets buffer read/write pointers and new data is written over old. This causes stream_get_line to skip parts of data from stream This patch fixes such behavior, so fill buffer call will append.	2019-10-03 06:50:43 +02:00
Christoph M. Becker	f2fb37a772	Revert "Fix #78620 : Out of memory error" This reverts commit `8ce04df7e0`. Cf. <https://github.com/php/php-src/pull/4766#discussion_r330658679>.	2019-10-02 19:01:35 +02:00
Christoph M. Becker	8ce04df7e0	Fix #78620 : Out of memory error If the integer addition in `ZEND_MM_ALIGNED_SIZE_EX` overflows, the macro evaluates to `0`, what we should catch early.	2019-10-02 18:18:52 +02:00
Nikita Popov	a5d3620d93	Fix segfault with __COMPILER_HALT_OFFSET__ and trailing {} Fixes OSS-Fuzz #17895.	2019-10-02 12:07:15 +02:00
Dmitry Stogov	3124129ca8	Fixed test that "fails" from time to time	2019-10-02 00:54:59 +03:00
Dmitry Stogov	2fcb5eadbb	Fixed test that "fails" from time to time	2019-10-02 00:48:42 +03:00
Fabien Villepinte	209e37db7d	Add missing skip keyword in tests	2019-10-01 11:13:36 +02:00
Nikita Popov	6fcde56b03	Fixed bug #78612	2019-09-30 15:06:07 +02:00
Christoph M. Becker	45db6fa567	Fix #78609 : mb_check_encoding() no longer supports stringable objects We apply type juggling for other types than array.	2019-09-30 12:42:04 +02:00
Christoph M. Becker	f6bfbe9553	Fix build for libzip < 0.11.2 We must not define method entries, if the actual method definitions or the arginfo structures are not defined.	2019-09-29 13:33:18 +02:00
Fabien Villepinte	37d27e666a	Fix SKIPIF in ext/mysqli	2019-09-27 16:03:20 +02:00
Christoph M. Becker	115f6effec	Fix skipif.inc	2019-09-27 12:50:04 +02:00
Nikita Popov	ab938d7bbc	Fix memory leak with ** on array operands	2019-09-26 13:45:45 +02:00
Nikita Popov	8a9df88597	Fix null-pointer deref in if stmt printing Fixes OSS-Fuzz #17721.	2019-09-26 10:24:49 +02:00
Jinesh Patel	d2331cc3f2	Fix hash key length in umsg_parse_format() Fix array length passed to zend_hash_str_find_ptr() casting from UChar array to char array requires mul by sizeof(UChar).	2019-09-25 10:30:33 +02:00
Christoph M. Becker	ed099ab186	Fix NEWS entry Cf. <https://bugs.php.net/78590>.	2019-09-23 22:59:55 +02:00
Nikita Popov	3ddb63dce1	Fix skipif condition	2019-09-23 17:17:52 +02:00
Nikita Popov	bc4c4c658c	Skip test on 32-bit	2019-09-23 16:42:24 +02:00
Nikita Popov	8509970e6a	Fix signed integer overflow in SplObjectStorage unserialization If count is ZEND_LONG_MIN the count-- loop underflows. This is ultimately harmless, but results in a ubsan warning. Fix this by adding a sanity check that the count isn't negative, because that doesn't make sense...	2019-09-23 13:18:27 +02:00
Christoph M. Becker	697945aa89	Fix test to be skipped if dom is not available	2019-09-22 18:42:02 +02:00
Nikita Popov	f989a4cd44	Fix leak of temporary buffer during exif tag reading	2019-09-22 12:10:17 +02:00
Nikita Popov	0701835c01	Fix multiple leaks in exif_read_data() This fixes two leaks related to duplicate tags, as well as a leak of zero-length FMT_(S)BYTE with non-null value. This can show up for MAKERNOTE values where the original length is non-zero, but the first character is a null byte.	2019-09-21 20:40:03 +02:00
Jinesh Patel	0d6c2448a7	Fix length of key passed to zend_hash_str_find_ptr	2019-09-21 18:11:21 +02:00
Christoph M. Becker	398b308316	Fix #78579 : mb_decode_numericentity: args number inconsistency mb_decode_numericentity() accepts a fourth optional parameter, which is unused, however. Since this parameter doesn't do any harm, and to avoid the small BC break, we're keeping this parameter for PHP 7, but adjust the arginfo. For PHP 8, we will remove this parameter.	2019-09-21 16:15:23 +02:00
Nikita Popov	0fa13028cb	Fix out-of-bounds read in exif tag reading This issue was recently introduced in `c739023a50`, when the restriction that components>0 has been relaxed. We now need to make sure that any tags that expect at least one component check that this is the case.	2019-09-19 21:11:57 +02:00
Nikita Popov	003c13d7bc	Fix iterable return type optimization	2019-09-19 17:21:00 +02:00
Nikita Popov	3e139a4653	Fix exif leak on duplicate copyright tags	2019-09-19 14:19:31 +02:00
CJDennis	e3255a4f49	Fix typo `sizeof("data")-1` and `sizeof("date")-1` are both 4, so no change in behaviour	2019-09-19 11:36:00 +02:00
Nikita Popov	175f4f24ae	Increase timeout in test	2019-09-17 17:33:46 +02:00
fancyweb	e691a98c1f	Fix #76342 : file_get_contents waits twice specified timeout	2019-09-17 15:42:29 +02:00
Drakano	252ebce0d7	Add tilde to allowed status/ping path Because of user specific webdirs it should be possible to set a status/ping path like "/~username/status". Closes GH-4698.	2019-09-17 12:19:21 +02:00
Tyson Andre	29bced9521	Fix opcache return type for get_headers in zend_func_info https://www.php.net/manual/en/function.get-headers.php#refsect1-function.get-headers-examples shows that it will return string keys when the second argument is non-zero. I've verified that this is the case. This bug was there since the initial commit in `c88ffa9a56`. Closes GH-4702.	2019-09-17 12:08:29 +02:00
Nikita Popov	2f6efd835d	Fixed bug #78545 By using an explicit (double) cast.	2019-09-16 15:00:20 +02:00
Nikita Popov	8873df8e86	Fix leak in SplObjectStorage unserialization The result of php_var_unserialize always needs to be destroyed, even if the call failed.	2019-09-16 13:02:32 +02:00
Christoph M. Becker	81cefab7b0	Stick with zend_long for ABI compatibility Cf. <https://github.com/php/php-src/pull/4700#issuecomment-531515689>.	2019-09-15 15:11:25 +02:00
bugreportuser	fdcca93056	Fix #78535 : auto_detect_line_endings value not parsed as bool	2019-09-14 18:46:09 +02:00
Kalle Sommer Nielsen	716518373f	NEWS	2019-09-12 06:50:53 +03:00
Kalle Sommer Nielsen	2823e938d4	Fixed bug #78442 ('Illegal component' on exif_read_data since PHP7)	2019-09-12 06:21:39 +03:00
Sara Golemon	a270eb1911	Bump for 7.2.24	2019-09-10 13:04:01 -04:00
Remi Collet	c43fc204b1	Raise minimal GCC version, Test with 4.8 is OK With 4.4: error: #pragma GCC diagnostic not allowed inside functions	2019-09-10 16:28:35 +02:00
Christoph M. Becker	bca66002f1	Drop regression test The state returned by `sodium_crypto_generichash_init()` has to be regarded as opaque byte string; neither its size nor its exact structure are fixed, and actually vary for diffent libsodium versions. Therefore we drop the test altogether.	2019-09-10 10:07:39 +02:00
CHU Zhaowei	1ac6b0251b	Fix bug #72884 isCloneable() on SplFileObject should return false	2019-09-09 17:27:17 +02:00
Christoph M. Becker	8ead77936e	Fix #78510 : Partially uninitialized buffer returned by sodium_crypto_generichash_init() Backport jedisct1/libsodium.php@28d13bf437.	2019-09-09 15:30:28 +02:00
Christoph M. Becker	41a4379cb4	Fix #41997 : SP call yields additional empty result set When stored procedures are called, the "final result set is a status result that includes no result set". Calling `::nextRowset()` on the actual last result set should return FALSE, since there is actually no further result set to be processed.	2019-09-03 13:29:30 +02:00
Tyson Andre	9c3b7ccda5	Fix opcache return type for hash_update_stream It can return false if the resource type is wrong. ``` php > var_export(hash_update_stream(hash_init('md5'), imagecreate(1,1))); Warning: hash_update_stream(): supplied resource is not a valid stream resource in php shell code on line 1 false ``` The return types were initially added in `c88ffa9a56`	2019-09-03 09:23:39 +02:00
Christoph M. Becker	cd63908ab8	Fix #76577 : outdated documentation concerning track_errors	2019-09-02 15:05:01 +02:00
Nikita Popov	5a0980f1d9	Fix pkg-config version constraint for ICU On PHP 7.2 our minimum ICU version is 4.0, not 40.	2019-09-02 09:36:20 +02:00
Sergei Turchanov	8f564e5308	Fixed bug #78469 fcgi_accept_request function is supposed to call a FastCGI implementation's on_accept hook when entering an "accepting" stage (that is right before calling "accept"). This hook implementation (fpm_request_accepting) updates a worker state to an "accepting" state which is effectively an "Idle" state, and updates counters on the scoreboard of the corresponding pool (idle++, active--). But this is not done when listening for client connections on a named pipe on Windows platform. In that case a combination of ConnectNamedPipe/WaitForSingleObject is used (to be able to catch in_shutdown as far as I understand), but it is nonetheless functionally equivalent to "accept" call. Also by not calling on_hook neither a worker's state is updated to "accepting" state nor scoreboard counters are updated.	2019-08-30 16:06:50 +02:00
Nikita Popov	ed749edd47	Fix use-after-free of immediately invoked closure with extra args	2019-08-29 12:32:03 +02:00
Christoph M. Becker	b557265816	Fix #78473 : odbc_close() closes arbitrary resources We have to bail out, if an invalid resource is given. For consistency with the other `zend_fetch_resource(2)` calls, we return `FALSE`.	2019-08-28 17:55:15 +02:00
Christoph M. Becker	88ab374627	Update SDK version for AppVeyor	2019-08-27 13:34:35 +02:00
Nikita Popov	589542f50c	Remove properties HT from nested GC data The properties HT may be a GC root itself, so we need to remove it. I'm not sure this issue actually applies to PHP 7.2, but committing it there to be safe. As seen from the test case, the handling here is rather buggy on 7.2.	2019-08-26 17:49:37 +02:00
Tyson Andre	1e82a2d659	Also fix signature for passthru Backported from `a1a8d14485` https://www.php.net/manual/en/function.passthru.php#refsect1-function.passthru-returnvalues `passthru()` is false with invalid args `passthru('command')` is null.	2019-08-26 11:13:26 +02:00
Tyson Andre	f5bccc0eb5	Fix opcache optimizer info for time_nanosleep This can also return an array. See https://www.php.net/manual/en/function.time-nanosleep.php#refsect1-function.time-nanosleep-returnvalues > If the delay was interrupted by a signal, an associative array will be returned with the components: > > - seconds - number of seconds remaining in the delay > - nanoseconds - number of nanoseconds remaining in the delay Sending a SIGUSR1 to the below program would trigger this behavior. ``` pcntl_signal(\SIGUSR1, function ($signo, $signinfo) { echo "Handling a signal $signo\n"; }); echo "Sleeping for 100 seconds\n"; var_export(time_nanosleep(100, 0)); ``` The incomplete signature existed since `c88ffa9a5`. No phpt tests existed for time_nanosleep returning an array	2019-08-26 11:13:26 +02:00
Nikita Popov	16d35eb643	Fix overflow in memory limit checks Due to overflows in the memory limit checks, we were missing cases where the allocation size was close to the address space size, and caused an OOM condition rather than a memory limit error.	2019-08-26 10:25:30 +02:00
Stanislav Malyshev	4b4a656d9e	Merge branch 'PHP-7.1' into PHP-7.2 * PHP-7.1: Fix #75457: heap-use-after-free in php7.0.25	2019-08-25 19:20:59 -07:00
Christoph M. Becker	7bf1f9d561	Fix #75457 : heap-use-after-free in php7.0.25 Backport <https://vcs.pcre.org/pcre?view=revision&revision=1638>.	2019-08-25 19:19:50 -07:00
Stanislav Malyshev	087cb7bab2	Merge branch 'PHP-7.1' into PHP-7.2 * PHP-7.1: Fix CVE-2019-13224: don't allow different encodings for onig_new_deluxe() set version for release	2019-08-24 23:15:36 -07:00
Stanislav Malyshev	1258303e66	Fix CVE-2019-13224: don't allow different encodings for onig_new_deluxe() Backport from https://github.com/kkos/oniguruma/commit/0f7f61ed1b7b697e283e37bd2d731d0bd57adb55	2019-08-24 23:11:45 -07:00
Christoph M. Becker	ff7029b65b	Suppress deprecation warning on IDNA2003 ICU methods for clang	2019-08-23 12:18:58 +02:00
Qianqian Bu	cdf16c010a	fix the problem for connect_attr, set db condition, and add a new attribute _server_host	2019-08-20 13:31:58 +02:00
Christoph M. Becker	81f52158b4	Fix #78220 : Can't access OneDrive folder As of Windows 1903, when the OneDrive on-demand feature is enabled, the OneDrive folder is reported as reparse point by `FindFirstFile()`, but trying to get information about the reparse point using `DeviceIoControl()` fails with `ERROR_NOT_A_REPARSE_POINT`. We work around this problem by falling back to `GetFileInformationByHandle()` if that happens, but only if the reparse point is reported as cloud reparse point, and only if PHP is running on Windows 1903 or later. The patch has been developed in collaboration with ab@php.net. We should keep an eye on the somewhat quirky OneDrive behavior, since it might change again in a future Windows release.	2019-08-19 19:55:35 +02:00
Sara Golemon	725f439778	Suppress deprecation warning on IDNA2003 ICU methods	2019-08-16 12:40:20 -04:00
Nikita Popov	fcabe7e5e4	Fixed bug #78412 $this should only be included in the generator GC buffer, if it will be released on destruction.	2019-08-14 17:50:58 +02:00
Sara Golemon	4b64d47c99	Bump for 7.2.23	2019-08-13 19:32:12 -04:00
Nikita Popov	4eeb41d1ea	Fixed bug #77191	2019-08-13 11:19:58 +02:00
Nikita Popov	18f2918a0f	Don't destroy properties array with unset GC type As the properties array can also be a GC root, it might have already been destroyed.	2019-08-13 09:53:25 +02:00
Nikita Popov	f3fdf570b3	Intern alias old_name early This is likely going to end up interned lateron at some point when the new_name is referenced somewhere. However, it may be that there are some uses that do not get interned before that. In this case we will intern a string that already have zval users, without updating the refcounted flag on those zvals. In particular this can happen with something like [Foo::class], where Foo is an imported symbol. The string it resolves to won't get interned right away, but may be interned later. use Foo as Bar; $x = [Bar::class]; var_dump(Bar::X); debug_zval_dump($x); // Will show negative refcount class Foo { const X = 1; } However, this doesn't really fix the root cause, there are probably other situations where something similar can occur.	2019-08-12 17:12:28 +02:00
Dmitry Stogov	9b43e29d9b	Fixed handling of references in nested data of objects with destructor	2019-08-09 17:43:50 +03:00
Dmitry Stogov	6b1cc1252e	Fixed second part of the bug #78379 (Cast to object confuses GC, causes crash)	2019-08-09 15:42:39 +03:00
Dmitry Stogov	2e2cd65d73	Added asserts to catch GC errors when refcount goes below zero.	2019-08-09 13:37:23 +03:00
Matteo Beccati	796efd849e	Skip test when SIGKILL is not defined	2019-08-09 10:32:15 +02:00
Dmitry Stogov	358379be22	Fixed bug #78379 (Cast to object confuses GC, causes crash)	2019-08-08 10:00:39 +03:00
Christoph M. Becker	954543cec6	Fix #78282 : atime and mtime mismatch The fix for bug #78241 assumed that `time_t` would always be 64bit, but actually is 32bit for x86. We therefore enforce 64bit arithmetic to avoid wrapping. (cherry picked from commit `bf242d58e7`)	2019-08-06 17:25:54 +02:00
Joe Watkins	1c01a1579e	set version for release	2019-07-31 08:21:39 +02:00