Update versions for PHP 8.0.7RC1

Mark for RC1
Remove 8.0.8 on this branch
2026-11-11 19:20:50 +00:00 · 2021-05-19 17:58:53 +00:00 · 2021-05-19 17:57:54 +00:00 · 2021-05-19 17:51:45 +00:00 · 2021-05-18 13:29:48 +00:00 · 2021-05-18 13:22:34 +00:00
266 changed files with 3770 additions and 907 deletions
@@ -11,9 +11,7 @@ end

 define ____executor_globals
 	if basic_functions_module.zts
-		if !$tsrm_ls
-			set $tsrm_ls = ts_resource_ex(0, 0)
-		end
+		set $tsrm_ls = _tsrm_ls_cache
 		set $eg = ((zend_executor_globals*) (*((void ***) $tsrm_ls))[executor_globals_id-1])
 		set $cg = ((zend_compiler_globals*) (*((void ***) $tsrm_ls))[compiler_globals_id-1])
 		set $eg_ptr = $eg
@@ -68,12 +68,6 @@ env:

 jobs:
    include:
-        - env: ENABLE_ZTS=0 ENABLE_DEBUG=0
-          arch: amd64
-          if: type = cron
-        - env: ENABLE_ZTS=1 ENABLE_DEBUG=1
-          arch: amd64
-          if: type = cron
        - env: ENABLE_ZTS=1 ENABLE_DEBUG=1 SKIP_IO_CAPTURE_TESTS=1 ARM64=1
          arch: arm64
          if: type = cron
@@ -1,6 +1,177 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2021, PHP 8.0.3
+20 May 2021, PHP 8.0.7RC1
+
+- Core:
+  . Fixed bug #80960 (opendir() warning wrong info when failed on Windows).
+    (cmb)
+  . Fixed bug #67792 (HTTP Authorization schemes are treated as case-sensitive).
+    (cmb)
+  . Fixed bug #80972 (Memory exhaustion on invalid string offset). (girgias)
+
+- FPM:
+  . Fixed bug #65800 (Events port mechanism). (psumbera)
+
+- FTP:
+  . Fixed bug #80901 (Info leak in ftp extension). (cmb)
+  . Fixed bug #79100 (Wrong FTP error messages). (cmb)
+
+- GD:
+  . Fixed bug #81032 (GD install is affected by external libgd installation).
+    (Flavio Heleno, cmb)
+
+- Intl:
+  . Fixed bug #81019 (Unable to clone NumberFormatter after failed parse()).
+    (Nikita)
+
+- MBString:
+  . Fixed bug #81011 (mb_convert_encoding removes references from arrays). (cmb)
+
+- ODBC:
+  . Fixed bug #80460 (ODBC doesn't account for SQL_NO_TOTAL indicator). (cmb)
+
+- Opcache:
+  . Fixed bug #81007 (JIT "not supported" on 32-bit x86 -- build problem?).
+    (Nikita)
+  . Fixed bug #81015 (Opcache optimization assumes wrong part of ternary
+    operator in if-condition). (Nikita)
+  . Fixed bug #81046 (Literal compaction merges non-equal related literals).
+    (Nikita)
+
+- PDO_MySQL:
+  . Fixed bug #81037 (PDO discards error message text from prepared 
+    statement). (Kamil Tekiela)
+
+- PDO_ODBC:
+  . Fixed bug #44643 (bound parameters ignore explicit type definitions). (cmb)
+
+- pgsql:
+  . Fixed php_pgsql_fd_cast() wrt. php_stream_can_cast(). (cmb)
+
+- SPL:
+  . Fixed bug #80933 (SplFileObject::DROP_NEW_LINE is broken for NUL and CR).
+    (cmb, Nikita)
+
+- XMLReader:
+  . Fixed bug #73246 (XMLReader: encoding length not checked). (cmb)
+
+- Zip:
+  . Fixed bug #80863 (ZipArchive::extractTo() ignores references). (cmb)
+
+06 May 2021, PHP 8.0.6
+
+- PDO_pgsql:
+  . Revert "Fixed bug #80892 (PDO::PARAM_INT is treated the same as PDO::PARAM_STR)"
+    from PHP 8.0.5.
+
+29 Apr 2021, PHP 8.0.5
+
+- Core:
+  . Changed PowerPC CPU registers used by Zend VM to work around GCC bug.
+    Old registers (r28/r29) might be clobbered by _restgpr routine used for
+    return from C function compiled with -Os. (Dmitry)
+
+- DOM:
+  . Fixed bug #66783 (UAF when appending DOMDocument to element). (cmb)
+
+- FFI:
+  . Fixed bug #80847 (CData structs with fields of type struct can't be passed
+    as C function argument). (Nickolas Daniel da Silva, Dmitry)
+
+- FPM:
+  . Fixed bug #80024 (Duplication of info about inherited socket after pool
+    removing). (Jakub Zelenka)
+
+- FTP:
+  . Fixed bug #80880 (SSL_read on shutdown, ftp/proc_open). (cmb, Jakub
+    Zelenka)
+
+- Imap:
+  . Fixed bug #80710 (imap_mail_compose() header injection). (cmb, Stas)
+
+- LibXML:
+  . Fixed bug #73533 (Invalid memory access in php_libxml_xmlCheckUTF8). (cmb)
+
+- Opcache:
+  . Fixed bug #80839 (PHP problem with JIT). (Dmitry)
+  . Fixed bug #80861 (erronous array key overflow in 2D array with JIT).
+    (Dmitry)
+
+- Pcntl:
+  . Fixed bug #79812 (Potential integer overflow in pcntl_exec()). (cmb)
+
+- PDO_ODBC:
+  . Fixed bug #80783 (PDO ODBC truncates BLOB records at every 256th byte).
+    (cmb)
+
+- PDO_pgsql:
+  . Fixed bug #80892 (PDO::PARAM_INT is treated the same as PDO::PARAM_STR).
+    (Matteo)
+
+- Session:
+  . Fixed bug #80889 (Cannot set save handler when save_handler is invalid).
+    (cmb)
+
+- SOAP:
+  . Fixed bug #69668 (SOAP special XML characters in namespace URIs not
+    encoded). (cmb)
+
+- Standard:
+  . Fixed bug #80915 (Taking a reference to $_SERVER hides its values from
+    phpinfo()). (Rowan Tommins)
+  . Fixed bug #80914 ('getdir' accidentally defined as an alias of 'dir').
+    (Rowan Tommins)
+
+01 Apr 2021, PHP 8.0.4
+
+- Core:
+  . Fixed bug #75776 (Flushing streams with compression filter is broken). (cmb)
+  . Fixed bug #80811 (Function exec without $output but with $restult_code
+    parameter crashes). (Nikita)
+  . Fixed bug #80814 (threaded mod_php won't load on FreeBSD: No space
+    available for static Thread Local Storage). (Dmitry)
+
+- Dba:
+  . Fixed bug #80817 (dba_popen() may cause segfault during RSHUTDOWN). (cmb)
+
+- IMAP:
+  . Fixed bug #80800 (imap_open() fails when the flags parameter includes
+    CL_EXPUNGE). (girgias)
+
+- Intl:
+  . Fixed bug #80763 (msgfmt_format() does not accept DateTime references).
+    (cmb)
+
+- Libxml:
+  . Fixed bug #51903 (simplexml_load_file() doesn't use HTTP headers). (cmb)
+
+- MySQLnd:
+  . Fixed bug #80837 (Calling stmt_store_result after fetch doesn't throw an
+    error). (Kamil Tekiela)
+
+- Opcache:
+  . Fixed bug #80786 (PHP crash using JIT). (Nikita)
+  . Fixed bug #80782 (DASM_S_RANGE_VREG on PHP_INT_MIN-1). (Dmitry)
+
+- PCRE:
+  . Fixed bug #80866 (preg_split ignores limit flag when pattern with \K has
+    0-width fullstring match). (Kamil Tekiela)
+
+- Session:
+  . Fixed bug #80774 (session_name() problem with backslash). (cmb)
+
+- Standard:
+  . Fixed bug #80771 (phpinfo(INFO_CREDITS) displays nothing in CLI). (cmb)
+  . Fixed bug #78719 (http wrapper silently ignores long Location headers).
+    (cmb)
+  . Fixed bug #80838 (HTTP wrapper waits for HTTP 1 response after HTTP 101).
+    (manuelm)
+
+- Zip:
+  . Fixed bug #80825 (ZipArchive::isCompressionMethodSupported does not exist).
+    (cmb)
+
+18 Feb 2021, PHP 8.0.3

 - Core:
  . Fixed #80706 (mail(): Headers after Bcc headers may be ignored). (cmb)
@@ -598,4 +769,3 @@ PHP                                                                        NEWS
  . Fixed bug #71417 (fread() does not report zlib.inflate errors). (cmb)
  . Fixed bug #78792 (zlib.output_compression disabled by Content-Type: image/).
    (cmb)
-
@@ -729,13 +729,13 @@ TSRM_API size_t tsrm_get_ls_cache_tcb_offset(void)
 #if defined(__APPLE__) && defined(__x86_64__)
    // TODO: Implement support for fast JIT ZTS code ???
 	return 0;
-#elif defined(__x86_64__) && defined(__GNUC__)
+#elif defined(__x86_64__) && defined(__GNUC__) && !defined(__FreeBSD__)
 	size_t ret;

 	asm ("movq _tsrm_ls_cache@gottpoff(%%rip),%0"
          : "=r" (ret));
 	return ret;
-#elif defined(__i386__) && defined(__GNUC__)
+#elif defined(__i386__) && defined(__GNUC__) && !defined(__FreeBSD__)
 	size_t ret;

 	asm ("leal _tsrm_ls_cache@ntpoff,%0"
@@ -147,7 +147,7 @@ TSRM_API const char *tsrm_api_name(void);
 # define __has_attribute(x) 0
 #endif

-#if !__has_attribute(tls_model)
+#if !__has_attribute(tls_model) || defined(__FreeBSD__)
 # define TSRM_TLS_MODEL_ATTR
 #elif __PIC__
 # define TSRM_TLS_MODEL_ATTR __attribute__((tls_model("initial-exec")))
@@ -0,0 +1,15 @@
+--TEST--
+HT iterator should be destroyed if array becomes empty during array_splice
+--FILE--
+<?php
+$a=[4];
+$i = 0;
+foreach ($a as &$r) {
+    var_dump($r);
+    $a = array_splice($a, 0);
+    if (++$i == 2) break;
+}
+?>
+--EXPECT--
+int(4)
+int(4)
@@ -8,4 +8,4 @@ class A1 { }

 ?>
 --EXPECTF--
-Fatal error: Attribute::__construct(): Argument #1 ($flags) must must be of type int, string given in %s
+Fatal error: Attribute::__construct(): Argument #1 ($flags) must be of type int, string given in %s
@@ -35,11 +35,12 @@ try {
 }
 echo $simpleString["0"] === "B"?"ok\n":"bug\n";
 try {
+    /* This must not affect the string value */
    $simpleString["wrong"] = "f";
 } catch (\TypeError $e) {
    echo $e->getMessage() . \PHP_EOL;
 }
-echo $simpleString["0"] === "f"?"ok\n":"bug\n";
+echo $simpleString["0"] === "B"?"ok\n":"bug\n";
 ?>
 --EXPECTF--
 bool(false)
@@ -58,7 +58,7 @@ Warning: Illegal string offset -1 in %s on line %d
 NULL
 string(0) ""
 Cannot access offset of type string on string
-string(1) "a"
+string(0) ""
 Error: [] operator not supported for strings
 string(0) ""
 Error: Cannot use assign-op operators with string offsets
@@ -39,7 +39,7 @@ string(36) "#0 [internal function]: ()

 Array of array of NULL values:

-Warning: Function name is not a string in %s on line %d
+Warning: File name is not a string in %s on line %d

 Warning: Value for class is not a string in %s on line %d

@@ -48,5 +48,5 @@ Warning: Value for type is not a string in %s on line %d
 Warning: Value for function is not a string in %s on line %d

 Warning: args element is not an array in %s on line %d
-string(60) "#0 [unknown function][unknown][unknown][unknown]()
+string(58) "#0 [unknown file]: [unknown][unknown][unknown]()
 #1 {main}"
@@ -0,0 +1,31 @@
+--TEST--
+Bug #80781: Error handler that throws ErrorException infinite loop
+--FILE--
+<?php
+
+function handle(int $severity, string $message, string $file, int $line): bool {
+	if((error_reporting() & $severity) !== 0) {
+		throw new \ErrorException($message, 0, $severity, $file, $line);
+	}
+
+	return true; // stfu operator
+}
+
+set_error_handler('handle');
+
+function getPlugin(string $plugin) : bool{
+	return false;
+}
+
+$data = [];
+$array = [];
+if (isset($array[$data]) or getPlugin($data)) {
+
+}
+
+?>
+--EXPECTF--
+Fatal error: Uncaught TypeError: Illegal offset type in isset or empty in %s:%d
+Stack trace:
+#0 {main}
+  thrown in %s on line %d
@@ -0,0 +1,19 @@
+--TEST--
+Bug #80811: Function exec without $output but with $restult_code parameter crashes
+--FILE--
+<?php
+
+echo 'Executing with all params:' . PHP_EOL;
+exec('echo Something', output: $output, result_code: $resultCode);
+var_dump($resultCode);
+
+echo 'Executing without output param:' . PHP_EOL;
+exec('echo Something', result_code: $resultCode);
+var_dump($resultCode);
+
+?>
+--EXPECT--
+Executing with all params:
+int(0)
+Executing without output param:
+int(0)
@@ -0,0 +1,41 @@
+--TEST--
+Bug #80972: Memory exhaustion on invalid string offset
+--FILE--
+<?php
+
+function exceptions_error_handler($severity, $message, $filename, $lineno) {
+    if (error_reporting() & $severity) {
+        throw new ErrorException($message, 0, $severity, $filename, $lineno);
+    }
+}
+set_error_handler('exceptions_error_handler');
+
+$float = 10e120;
+$string_float = (string) $float;
+
+$string = 'Here is some text for good measure';
+
+try {
+    echo 'Float casted to string compile', \PHP_EOL;
+    $string[(string) 10e120] = 'E';
+    var_dump($string);
+} catch (\TypeError $e) {
+    echo $e->getMessage(), \PHP_EOL;
+}
+
+/* This same bug also permits to modify the first byte of a string even if
+ * the offset is invalid */
+try {
+    /* This must not affect the string value */
+    $string["wrong"] = "f";
+} catch (\Throwable $e) {
+    echo $e->getMessage() . \PHP_EOL;
+}
+var_dump($string);
+
+?>
+--EXPECT--
+Float casted to string compile
+Cannot access offset of type string on string
+Cannot access offset of type string on string
+string(34) "Here is some text for good measure"
@@ -0,0 +1,56 @@
+--TEST--
+Bug #80929: Method name corruption related to zend_closure_call_magic
+--FILE--
+<?php
+class DefaultListener
+{
+    public function handleDefaultEvent($event) { }
+}
+
+class SubscriberProxy
+{
+    private array $subscribedEvents;
+    private object $subscriber;
+    private Closure $listener;
+
+    public function __construct(array $subscribedEvents, object $subscriber)
+    {
+        $this->subscribedEvents = $subscribedEvents;
+        $this->subscriber = $subscriber;
+        foreach ($this->subscribedEvents as $eventName => $params) {
+            $this->listener = Closure::fromCallable([$this, $params]);
+        }
+    }
+
+    public function __call(string $name, array $arguments)
+    {
+        return $this->subscriber->$name(...$arguments);
+    }
+
+    public function dispatch($event, string $eventName)
+    {
+        ($this->listener)($event, $eventName, null);
+    }
+}
+
+$proxy = new SubscriberProxy(
+    ['defaultEvent' => 'handleDefaultEvent'],
+    new DefaultListener()
+);
+
+for ($i = 0; $i < 10; $i++) {
+    echo $i . PHP_EOL;
+    $proxy->dispatch(null, 'defaultEvent');
+}
+?>
+--EXPECT--
+0
+1
+2
+3
+4
+5
+6
+7
+8
+9
@@ -0,0 +1,30 @@
+--TEST--
+Dynamic static call of non-static method
+--FILE--
+<?php
+class Foo {
+    function test1() {
+        $method = ['Foo', 'bar'];
+        $method();
+    }
+    function test2() {
+        $method = 'Foo::bar';
+        $method();
+    }
+    function __call($name, $args) {}
+}
+$x = new Foo;
+try {
+    $x->test1();
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    $x->test2();
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+?>
+--EXPECT--
+Non-static method Foo::bar() cannot be called statically
+Non-static method Foo::bar() cannot be called statically
@@ -52,7 +52,7 @@ foreach ($testvalues as $testvalue) {
 }

 ?>
--EXPECTF--
+--EXPECT--
 *** Indexing - Testing value assignment with key ***
 array(1) {
  ["foo"]=>
@@ -74,12 +74,8 @@ array(1) {
    int(1)
  }
 }
-
-Warning: Array to string conversion in %s on line %d
 Cannot access offset of type string on string
 string(0) ""
-
-Warning: Array to string conversion in %s on line %d
 Cannot access offset of type string on string
 string(1) " "
 Cannot use a scalar value as an array
@@ -0,0 +1,15 @@
+--TEST--
+Iterator::key() with by-ref return
+--FILE--
+<?php
+class Test extends ArrayIterator {
+    function &key() {
+        return $foo;
+    }
+}
+foreach (new Test([0]) as $k => $v) {
+    var_dump($k);
+}
+?>
+--EXPECT--
+NULL
@@ -0,0 +1,36 @@
+--TEST--
+A failed assignment should not be considered an initialization
+--FILE--
+<?php
+
+class Test {
+    public int $prop;
+
+    public function __get($name) {
+        echo "__get() called\n";
+        return 0;
+    }
+}
+
+$test = new Test;
+try {
+    $test->prop;
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    $test->prop = "foo";
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+try {
+    $test->prop;
+} catch (Error $e) {
+    echo $e->getMessage(), "\n";
+}
+
+?>
+--EXPECT--
+Typed property Test::$prop must not be accessed before initialization
+Cannot assign string to property Test::$prop of type int
+Typed property Test::$prop must not be accessed before initialization
@@ -0,0 +1,20 @@
+--TEST--
+Everything is trivially a subtype of mixed
+--FILE--
+<?php
+
+spl_autoload_register(function($class) {
+    echo "Loading $class\n";
+});
+
+class A {
+    public function test(): mixed {}
+}
+class B extends A {
+    public function test(): X {}
+}
+
+?>
+===DONE===
+--EXPECT--
+===DONE===
@@ -20,7 +20,7 @@
 #ifndef ZEND_H
 #define ZEND_H

-#define ZEND_VERSION "4.0.3-dev"
+#define ZEND_VERSION "4.0.7RC1"

 #define ZEND_ENGINE_3

@@ -1099,7 +1099,7 @@ static zend_always_inline void zend_mm_free_pages_ex(zend_mm_heap *heap, zend_mm
 		/* this setting may be not accurate */
 		chunk->free_tail = page_num;
 	}
-	if (free_chunk && chunk->free_pages == ZEND_MM_PAGES - ZEND_MM_FIRST_PAGE) {
+	if (free_chunk && chunk != heap->main_chunk && chunk->free_pages == ZEND_MM_PAGES - ZEND_MM_FIRST_PAGE) {
 		zend_mm_delete_chunk(heap, chunk);
 	}
 }
@@ -42,7 +42,7 @@ void validate_attribute(zend_attribute *attr, uint32_t target, zend_class_entry

 		if (Z_TYPE(flags) != IS_LONG) {
 			zend_error_noreturn(E_ERROR,
-				"Attribute::__construct(): Argument #1 ($flags) must must be of type int, %s given",
+				"Attribute::__construct(): Argument #1 ($flags) must be of type int, %s given",
 				zend_zval_type_name(&flags)
 			);
 		}
@@ -288,7 +288,6 @@ static ZEND_NAMED_FUNCTION(zend_closure_call_magic) /* {{{ */ {

 	zend_call_function(&fci, &fcc);

-	zval_ptr_dtor(&fci.params[0]);
 	zval_ptr_dtor(&fci.params[1]);
 }
 /* }}} */
@@ -485,6 +484,8 @@ static void zend_closure_free_storage(zend_object *object) /* {{{ */

 	if (closure->func.type == ZEND_USER_FUNCTION) {
 		destroy_op_array(&closure->func.op_array);
+	} else if (closure->orig_internal_handler == zend_closure_call_magic) {
+		zend_string_release(closure->func.common.function_name);
 	}

 	if (Z_TYPE(closure->this_ptr) != IS_UNDEF) {
@@ -543,20 +543,17 @@ static void _build_trace_string(smart_str *str, HashTable *ht, uint32_t num) /*
 	file = zend_hash_find_ex(ht, ZSTR_KNOWN(ZEND_STR_FILE), 1);
 	if (file) {
 		if (Z_TYPE_P(file) != IS_STRING) {
-			zend_error(E_WARNING, "Function name is not a string");
-			smart_str_appends(str, "[unknown function]");
+			zend_error(E_WARNING, "File name is not a string");
+			smart_str_appends(str, "[unknown file]: ");
 		} else{
-			zend_long line;
+			zend_long line = 0;
 			tmp = zend_hash_find_ex(ht, ZSTR_KNOWN(ZEND_STR_LINE), 1);
 			if (tmp) {
 				if (Z_TYPE_P(tmp) == IS_LONG) {
 					line = Z_LVAL_P(tmp);
 				} else {
 					zend_error(E_WARNING, "Line is not an int");
-					line = 0;
 				}
-			} else {
-				line = 0;
 			}
 			smart_str_append(str, Z_STR_P(file));
 			smart_str_appendc(str, '(');
@@ -54,11 +54,11 @@
 #  define ZEND_VM_FP_GLOBAL_REG "%r14"
 #  define ZEND_VM_IP_GLOBAL_REG "%r15"
 # elif defined(__GNUC__) && ZEND_GCC_VERSION >= 4008 && defined(__powerpc64__)
-#  define ZEND_VM_FP_GLOBAL_REG "r28"
-#  define ZEND_VM_IP_GLOBAL_REG "r29"
+#  define ZEND_VM_FP_GLOBAL_REG "r14"
+#  define ZEND_VM_IP_GLOBAL_REG "r15"
 # elif defined(__IBMC__) && ZEND_GCC_VERSION >= 4002 && defined(__powerpc64__)
-#  define ZEND_VM_FP_GLOBAL_REG "r28"
-#  define ZEND_VM_IP_GLOBAL_REG "r29"
+#  define ZEND_VM_FP_GLOBAL_REG "r14"
+#  define ZEND_VM_IP_GLOBAL_REG "r15"
 # elif defined(__GNUC__) && ZEND_GCC_VERSION >= 4008 && defined(__aarch64__)
 #  define ZEND_VM_FP_GLOBAL_REG "x27"
 #  define ZEND_VM_IP_GLOBAL_REG "x28"
@@ -1525,6 +1525,14 @@ static zend_never_inline void zend_assign_to_string_offset(zval *str, zval *dim,
 	zend_long offset;

 	offset = zend_check_string_offset(dim, BP_VAR_W EXECUTE_DATA_CC);
+	/* Illegal offset assignment */
+	if (UNEXPECTED(EG(exception) != NULL)) {
+		if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
+			ZVAL_UNDEF(EX_VAR(opline->result.var));
+		}
+		return;
+	}
+
 	if (offset < -(zend_long)Z_STRLEN_P(str)) {
 		/* Error on negative offset */
 		zend_error(E_WARNING, "Illegal string offset " ZEND_LONG_FMT, offset);
@@ -4005,6 +4013,10 @@ static zend_never_inline zend_execute_data *zend_init_dynamic_call_string(zend_s

 		if (UNEXPECTED(!(fbc->common.fn_flags & ZEND_ACC_STATIC))) {
 			zend_non_static_method_call(fbc);
+			if (fbc->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
+				zend_string_release_ex(fbc->common.function_name, 0);
+				zend_free_trampoline(fbc);
+			}
 			return NULL;
 		}
 		if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
@@ -4129,6 +4141,10 @@ static zend_never_inline zend_execute_data *zend_init_dynamic_call_array(zend_ar
 			}
 			if (!(fbc->common.fn_flags & ZEND_ACC_STATIC)) {
 				zend_non_static_method_call(fbc);
+				if (fbc->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE) {
+					zend_string_release_ex(fbc->common.function_name, 0);
+					zend_free_trampoline(fbc);
+				}
 				return NULL;
 			}
 			object_or_called_scope = called_scope;
@@ -4571,6 +4587,9 @@ ZEND_API zend_result ZEND_FASTCALL zend_handle_undef_args(zend_execute_data *cal
 			}

 			ZVAL_COPY_VALUE(arg, &default_value);
+			if (ZEND_ARG_SEND_MODE(arg_info) & ZEND_SEND_BY_REF) {
+				ZVAL_NEW_REF(arg, arg);
+			}
 		}
 	}

@@ -1655,10 +1655,10 @@ ZEND_API void ZEND_FASTCALL zend_array_destroy(HashTable *ht)
 	} else if (EXPECTED(HT_FLAGS(ht) & HASH_FLAG_UNINITIALIZED)) {
 		goto free_ht;
 	}
-	zend_hash_iterators_remove(ht);
 	SET_INCONSISTENT(HT_DESTROYED);
 	efree(HT_GET_DATA_ADDR(ht));
 free_ht:
+	zend_hash_iterators_remove(ht);
 	FREE_HASHTABLE(ht);
 }

@@ -429,6 +429,13 @@ static inheritance_status zend_perform_covariant_type_check(
 {
 	ZEND_ASSERT(ZEND_TYPE_IS_SET(fe_type) && ZEND_TYPE_IS_SET(proto_type));

+	/* Apart from void, everything is trivially covariant to the mixed type.
+	 * Handle this case separately to ensure it never requires class loading. */
+	if (ZEND_TYPE_PURE_MASK(proto_type) == MAY_BE_ANY &&
+			!ZEND_TYPE_CONTAINS_CODE(fe_type, IS_VOID)) {
+		return INHERITANCE_SUCCESS;
+	}
+
 	/* Builtin types may be removed, but not added */
 	uint32_t fe_type_mask = ZEND_TYPE_PURE_MASK(fe_type);
 	uint32_t proto_type_mask = ZEND_TYPE_PURE_MASK(proto_type);
@@ -154,6 +154,9 @@ ZEND_API void zend_user_it_get_current_key(zend_object_iterator *_iter, zval *ke
 	zend_user_iterator *iter = (zend_user_iterator*)_iter;
 	zval *object = &iter->it.data;
 	zend_call_method_with_0_params(Z_OBJ_P(object), iter->ce, &iter->ce->iterator_funcs_ptr->zf_key, "key", key);
+	if (UNEXPECTED(Z_ISREF_P(key))) {
+		zend_unwrap_reference(key);
+	}
 }
 /* }}} */

@@ -728,7 +728,6 @@ found:
 		}
 		if (Z_PROP_FLAG_P(variable_ptr) == IS_PROP_UNINIT) {
 			/* Writes to uninitializde typed properties bypass __set(). */
-			Z_PROP_FLAG_P(variable_ptr) = 0;
 			goto write_std_property;
 		}
 	} else if (EXPECTED(IS_DYNAMIC_PROPERTY_OFFSET(property_offset))) {
@@ -783,6 +782,7 @@ write_std_property:
 					goto exit;
 				}
 				value = &tmp;
+				Z_PROP_FLAG_P(variable_ptr) = 0;
 				goto found; /* might have been updated via e.g. __toString() */
 			}

@@ -1061,6 +1061,11 @@ CWD_API int virtual_file_ex(cwd_state *state, const char *path, verify_path_func
 			}
 #endif
 			if (path_length + state_cwd_length + 1 >= MAXPATHLEN-1) {
+#ifdef ZEND_WIN32
+				SET_ERRNO_FROM_WIN32_CODE(ERROR_BUFFER_OVERFLOW);
+#else
+				errno = ENAMETOOLONG;
+#endif
 				return 1;
 			}
 			memcpy(resolved_path, state->cwd, state_cwd_length);
@@ -1089,6 +1094,7 @@ CWD_API int virtual_file_ex(cwd_state *state, const char *path, verify_path_func
 #ifdef ZEND_WIN32
 	if (memchr(resolved_path, '*', path_length) ||
 		memchr(resolved_path, '?', path_length)) {
+		SET_ERRNO_FROM_WIN32_CODE(ERROR_INVALID_NAME);
 		return 1;
 	}
 #endif
@@ -102,6 +102,6 @@ nmake test TESTS="%OPCACHE_OPTS% -q --offline --show-diff --show-slow 1000 --set

 set EXIT_CODE=%errorlevel%

-powershell -Command "$wc = New-Object 'System.Net.WebClient'; $wc.UploadFile('https://ci.appveyor.com/api/testresults/junit/%APPVEYOR_JOB_ID%', 'c:\junit.out.xml')"
+appveyor PushArtifact %TEST_PHP_JUNIT%

 exit /b %EXIT_CODE%
@@ -16,21 +16,11 @@ jobs:
  - job: ${{ parameters.configurationName }}
    timeoutInMinutes: ${{ parameters.timeoutInMinutes }}
    pool:
-      vmImage: 'ubuntu-18.04'
+      vmImage: 'ubuntu-20.04'
    variables:
      ubsan_options: 'print_stacktrace=1'
    steps:
    - template: apt.yml
-    - script: |
-        # Compile a newer version of curl, otherwise there will be an asan warning
-        # when running symfony tests.
-        wget https://curl.haxx.se/download/curl-7.65.3.tar.gz
-        tar xzf curl-7.65.3.tar.gz
-        cd curl-7.65.3/
-        ./configure
-        make -j2
-        sudo make install
-      displayName: 'Build Curl'
    - template: configure.yml
      parameters:
        configurationParameters: ${{ parameters.configurationParameters }}
@@ -51,6 +41,7 @@ jobs:
    - script: |
        git clone https://github.com/laravel/framework.git --branch=master --depth=1
        cd framework
+        git rev-parse HEAD
        php7.4 /usr/bin/composer install --no-progress
        # Hack to disable a test that hangs on azure
        sed -i 's/PHP_OS/"Darwin"/' tests/Filesystem/FilesystemTest.php
@@ -64,6 +55,7 @@ jobs:
    - script: |
        git clone https://github.com/symfony/symfony.git --depth=1
        cd symfony
+        git rev-parse HEAD
        php7.4 /usr/bin/composer install --no-progress
        php7.4 ./phpunit install
        export USE_ZEND_ALLOC=0
@@ -83,6 +75,7 @@ jobs:
    - script: |
        git clone https://github.com/amphp/amp.git --branch=master --depth=1
        cd amp
+        git rev-parse HEAD
        php /usr/bin/composer install --no-progress --ignore-platform-reqs
        export USE_ZEND_ALLOC=0
        sed -i 's/$exit = true/$exit = false/g' vendor/phpunit/phpunit/src/TextUI/Command.php
@@ -92,6 +85,7 @@ jobs:
    - script: |
        git clone https://github.com/sebastianbergmann/phpunit.git --branch=master --depth=1
        cd phpunit
+        git rev-parse HEAD
        export USE_ZEND_ALLOC=0
        export USE_TRACKED_ALLOC=1
        export ASAN_OPTIONS=exitcode=139
@@ -104,6 +98,7 @@ jobs:
    - script: |
        php7.4 /usr/bin/composer create-project symfony/symfony-demo symfony_demo --no-progress
        cd symfony_demo
+        git rev-parse HEAD
        export USE_ZEND_ALLOC=0
        export USE_TRACKED_ALLOC=1
        sed -i 's/PHP_SAPI/"cli-server"/g' var/cache/dev/App_KernelDevDebugContainer.preload.php
@@ -8,7 +8,7 @@ jobs:
  - job: ${{ parameters.configurationName }}
    timeoutInMinutes: ${{ parameters.timeoutInMinutes }}
    pool:
-      vmImage: 'ubuntu-18.04'
+      vmImage: 'ubuntu-20.04'
    steps:
    - template: apt.yml
    - script: |
@@ -8,7 +8,7 @@ jobs:
  - job: ${{ parameters.configurationName }}
    timeoutInMinutes: ${{ parameters.timeoutInMinutes }}
    pool:
-      vmImage: 'ubuntu-18.04'
+      vmImage: 'ubuntu-20.04'
    steps:
    - template: apt.yml
    - template: configure.yml
@@ -8,7 +8,7 @@ jobs:
  - job: ${{ parameters.configurationName }}
    timeoutInMinutes: ${{ parameters.timeoutInMinutes }}
    pool:
-      vmImage: 'ubuntu-18.04'
+      vmImage: 'ubuntu-20.04'
    steps:
    - template: apt.yml
    - script: |
@@ -12,7 +12,6 @@ steps:
      export TEST_PHP_JUNIT=junit.xml
      export REPORT_EXIT_STATUS=no
      export SKIP_IO_CAPTURE_TESTS=1
-      export MSAN_SYMBOLIZER_PATH=/usr/lib/llvm-6.0/bin/llvm-symbolizer
      rm -rf junit.xml | true
      php run-tests.php -P -q \
          -j$(/usr/bin/nproc) \
@@ -17,7 +17,7 @@ dnl Basic autoconf initialization, generation of config.nice.
 dnl ----------------------------------------------------------------------------

 AC_PREREQ([2.68])
-AC_INIT([PHP],[8.0.3-dev],[https://bugs.php.net],[php],[https://www.php.net])
+AC_INIT([PHP],[8.0.7RC1],[https://bugs.php.net],[php],[https://www.php.net])
 AC_CONFIG_SRCDIR([main/php_version.h])
 AC_CONFIG_AUX_DIR([build])
 AC_PRESERVE_HELP_ORDER
@@ -524,7 +524,7 @@ dnl Fix for these systems is already included in GCC 7, but not on GCC 6.
 dnl
 dnl At least some versions of FreeBSD seem to have buggy ifunc support, see
 dnl bug #77284. Conservatively don't use ifuncs on FreeBSD.
-AS_CASE([$host_alias], [*-*-*android*|*-*-*uclibc*|*-*-*musl*|*freebsd*], [true], [
+AS_CASE([$host_alias], [*-*-*android*|*-*-*uclibc*|*-*-*musl*|*freebsd*|*openbsd*], [true], [
  AX_GCC_FUNC_ATTRIBUTE([ifunc])
  AX_GCC_FUNC_ATTRIBUTE([target])
 ])
@@ -39,6 +39,7 @@ typedef struct _php_bz2_filter_data {
 	enum strm_status status;              /* Decompress option */
 	unsigned int small_footprint : 1;     /* Decompress option */
 	unsigned int expect_concatenated : 1; /* Decompress option */
+	unsigned int is_flushed : 1;          /* only for compression */

 	int persistent;
 } php_bz2_filter_data;
@@ -227,6 +228,8 @@ static php_stream_filter_status_t php_bz2_compress_filter(
 		bucket = php_stream_bucket_make_writeable(buckets_in->head);

 		while (bin < bucket->buflen) {
+			int flush_mode;
+
 			desired = bucket->buflen - bin;
 			if (desired > data->inbuf_len) {
 				desired = data->inbuf_len;
@@ -234,7 +237,9 @@ static php_stream_filter_status_t php_bz2_compress_filter(
 			memcpy(data->strm.next_in, bucket->buf + bin, desired);
 			data->strm.avail_in = desired;

-			status = BZ2_bzCompress(&(data->strm), flags & PSFS_FLAG_FLUSH_CLOSE ? BZ_FINISH : (flags & PSFS_FLAG_FLUSH_INC ? BZ_FLUSH : BZ_RUN));
+			flush_mode = flags & PSFS_FLAG_FLUSH_CLOSE ? BZ_FINISH : (flags & PSFS_FLAG_FLUSH_INC ? BZ_FLUSH : BZ_RUN);
+			data->is_flushed = flush_mode != BZ_RUN;
+			status = BZ2_bzCompress(&(data->strm), flush_mode);
 			if (status != BZ_RUN_OK && status != BZ_FLUSH_OK && status != BZ_FINISH_OK) {
 				/* Something bad happened */
 				php_stream_bucket_delref(bucket);
@@ -260,11 +265,12 @@ static php_stream_filter_status_t php_bz2_compress_filter(
 		php_stream_bucket_delref(bucket);
 	}

-	if (flags & PSFS_FLAG_FLUSH_CLOSE) {
+	if (flags & PSFS_FLAG_FLUSH_CLOSE || ((flags & PSFS_FLAG_FLUSH_INC) && !data->is_flushed)) {
 		/* Spit it out! */
 		status = BZ_FINISH_OK;
 		while (status == BZ_FINISH_OK) {
-			status = BZ2_bzCompress(&(data->strm), BZ_FINISH);
+			status = BZ2_bzCompress(&(data->strm), (flags & PSFS_FLAG_FLUSH_CLOSE ? BZ_FINISH : BZ_FLUSH));
+			data->is_flushed = 1;
 			if (data->strm.avail_out < data->outbuf_len) {
 				size_t bucketlen = data->outbuf_len - data->strm.avail_out;

@@ -380,6 +386,7 @@ static php_stream_filter *php_bz2_filter_create(const char *filtername, zval *fi
 		}

 		status = BZ2_bzCompressInit(&(data->strm), blockSize100k, 0, workFactor);
+		data->is_flushed = 1;
 		fops = &php_bz2_compress_ops;
 	} else {
 		status = BZ_DATA_ERROR;
@@ -0,0 +1,24 @@
+--TEST--
+Bug #75776 (Flushing streams with compression filter is broken)
+--SKIPIF--
+<?php
+if (!extension_loaded('bz2')) die('skip bz2 extension not available');
+?>
+--FILE--
+<?php
+$text = str_repeat('0123456789abcdef', 1000);
+
+$temp = fopen('php://temp', 'r+');
+stream_filter_append($temp, 'bzip2.compress', STREAM_FILTER_WRITE);
+fwrite($temp, $text);
+
+rewind($temp);
+
+var_dump(bin2hex(stream_get_contents($temp)));
+var_dump(ftell($temp));
+
+fclose($temp);
+?>
+--EXPECT--
+string(144) "425a68343141592653599fe7bbbf0001f389007fe03f002000902980026826aa80003ea9061520c6a41954833a9069520d6a41b54837a9071520e6a41d5483ba9079520f6a41f548"
+int(72)
@@ -863,9 +863,9 @@ restart:
 				zend_bool close_both;

 				close_both = (info->fp != info->lock.fp);
-				php_stream_close(info->lock.fp);
+				php_stream_free(info->lock.fp, persistent ? PHP_STREAM_FREE_CLOSE_PERSISTENT : PHP_STREAM_FREE_CLOSE);
 				if (close_both) {
-					php_stream_close(info->fp);
+					php_stream_free(info->fp, persistent ? PHP_STREAM_FREE_CLOSE_PERSISTENT : PHP_STREAM_FREE_CLOSE);
 				}
 				info->fp = NULL;
 				info->lock.fp = NULL;
@@ -1243,9 +1243,13 @@ int dom_hierarchy(xmlNodePtr parent, xmlNodePtr child)
 {
 	xmlNodePtr nodep;

-    if (parent == NULL || child == NULL || child->doc != parent->doc) {
-        return SUCCESS;
-    }
+	if (parent == NULL || child == NULL || child->doc != parent->doc) {
+		return SUCCESS;
+	}
+
+	if (child->type == XML_DOCUMENT_NODE) {
+		return FAILURE;
+	}

 	nodep = parent;

@@ -9,7 +9,7 @@ require_once __DIR__ .'/skipif.inc';
 ?>
 --FILE--
 <?php
-$filename = __DIR__."/tmp_savehtmlfile".time().".html";
+$filename = __DIR__."/DOMDocument_saveHTMLFile_basic.html";
 $doc = new DOMDocument('1.0');
 $root = $doc->createElement('html');
 $root = $doc->appendChild($root);
@@ -9,7 +9,7 @@ require_once __DIR__ .'/skipif.inc';
 ?>
 --FILE--
 <?php
-$filename = __DIR__."/tmp_savehtmlfile".time().".html";
+$filename = __DIR__."/DOMDocument_saveHTMLFile_formatOutput.html";
 $doc = new DOMDocument('1.0');
 $doc->formatOutput = true;
 $root = $doc->createElement('html');
@@ -0,0 +1,19 @@
+--TEST--
+Bug #66783 (UAF when appending DOMDocument to element)
+--SKIPIF--
+<?php
+if (!extension_loaded('dom')) die('skip dom extension not available');
+?>
+--FILE--
+<?php
+$doc = new DomDocument;
+$doc->loadXML('<root></root>');
+$e = $doc->createElement('e');
+try {
+    $e->appendChild($doc);
+} catch (DOMException $ex) {
+    echo $ex->getMessage(), PHP_EOL;
+}
+?>
+--EXPECTF--
+Hierarchy Request Error
@@ -1,5 +1,7 @@
 --TEST--
 Bug #79852: count(DOMNodeList) doesn't match count(IteratorIterator(DOMNodeList))
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
 --FILE--
 <?php

@@ -1,5 +1,7 @@
 --TEST--
 dom: DOMChildNode::remove does not work on character data
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
 --FILE--
 <?php

@@ -293,57 +293,85 @@ static int zend_ffi_is_compatible_type(zend_ffi_type *dst_type, zend_ffi_type *s
 }
 /* }}} */

-static ffi_type *zend_ffi_make_fake_struct_type(zend_ffi_type *type) /* {{{ */
+static ffi_type* zend_ffi_face_struct_add_fields(ffi_type* t, zend_ffi_type *type, int *i, size_t size)
 {
-	ffi_type *t = emalloc(sizeof(ffi_type) + sizeof(ffi_type*) * (zend_hash_num_elements(&type->record.fields) + 1));
-	int i;
 	zend_ffi_field *field;

-	t->size = type->size;
-	t->alignment = type->align;
-	t->type = FFI_TYPE_STRUCT;
-	t->elements = (ffi_type**)(t + 1);
-	i = 0;
 	ZEND_HASH_FOREACH_PTR(&type->record.fields, field) {
 		switch (ZEND_FFI_TYPE(field->type)->kind) {
 			case ZEND_FFI_TYPE_FLOAT:
-				t->elements[i] = &ffi_type_float;
+				t->elements[(*i)++] = &ffi_type_float;
 				break;
 			case ZEND_FFI_TYPE_DOUBLE:
-				t->elements[i] = &ffi_type_double;
+				t->elements[(*i)++] = &ffi_type_double;
 				break;
 #ifdef HAVE_LONG_DOUBLE
 			case ZEND_FFI_TYPE_LONGDOUBLE:
-				t->elements[i] = &ffi_type_longdouble;
+				t->elements[(*i)++] = &ffi_type_longdouble;
 				break;
 #endif
 			case ZEND_FFI_TYPE_SINT8:
 			case ZEND_FFI_TYPE_UINT8:
 			case ZEND_FFI_TYPE_BOOL:
 			case ZEND_FFI_TYPE_CHAR:
-				t->elements[i] = &ffi_type_uint8;
+				t->elements[(*i)++] = &ffi_type_uint8;
 				break;
 			case ZEND_FFI_TYPE_SINT16:
 			case ZEND_FFI_TYPE_UINT16:
-				t->elements[i] = &ffi_type_uint16;
+				t->elements[(*i)++] = &ffi_type_uint16;
 				break;
 			case ZEND_FFI_TYPE_SINT32:
 			case ZEND_FFI_TYPE_UINT32:
-				t->elements[i] = &ffi_type_uint32;
+				t->elements[(*i)++] = &ffi_type_uint32;
 				break;
 			case ZEND_FFI_TYPE_SINT64:
 			case ZEND_FFI_TYPE_UINT64:
-				t->elements[i] = &ffi_type_uint64;
+				t->elements[(*i)++] = &ffi_type_uint64;
 				break;
 			case ZEND_FFI_TYPE_POINTER:
-				t->elements[i] = &ffi_type_pointer;
+				t->elements[(*i)++] = &ffi_type_pointer;
+				break;
+			case ZEND_FFI_TYPE_STRUCT: {
+				zend_ffi_type *field_type = ZEND_FFI_TYPE(field->type);
+				/* for unions we use only the first field */
+				int num_fields = !(field_type->attr & ZEND_FFI_ATTR_UNION) ?
+					zend_hash_num_elements(&field_type->record.fields) : 1;
+
+				if (num_fields > 1) {
+					size += sizeof(ffi_type*) * (num_fields - 1);
+					t = erealloc(t, size);
+					t->elements = (ffi_type**)(t + 1);
+				}
+				t = zend_ffi_face_struct_add_fields(t, field_type, i, size);
 				break;
-			default:
-				efree(t);
-				return NULL;
 			}
-		i++;
+			default:
+				t->elements[(*i)++] = &ffi_type_void;
+				break;
+		}
+		if (type->attr & ZEND_FFI_ATTR_UNION) {
+			/* for unions we use only the first field */
+			break;
+		}
 	} ZEND_HASH_FOREACH_END();
+	return t;
+}
+
+static ffi_type *zend_ffi_make_fake_struct_type(zend_ffi_type *type) /* {{{ */
+{
+	/* for unions we use only the first field */
+	int num_fields = !(type->attr & ZEND_FFI_ATTR_UNION) ?
+		zend_hash_num_elements(&type->record.fields) : 1;
+	size_t size = sizeof(ffi_type) + sizeof(ffi_type*) * (num_fields + 1);
+	ffi_type *t = emalloc(size);
+	int i;
+
+	t->size = type->size;
+	t->alignment = type->align;
+	t->type = FFI_TYPE_STRUCT;
+	t->elements = (ffi_type**)(t + 1);
+	i = 0;
+	t = zend_ffi_face_struct_add_fields(t, type, &i, size);
 	t->elements[i] = NULL;
 	return t;
 }
@@ -391,11 +419,7 @@ again:
 			kind = type->enumeration.kind;
 			goto again;
 		case ZEND_FFI_TYPE_STRUCT:
-			if (!(type->attr & ZEND_FFI_ATTR_UNION)) {
-				ffi_type *t = zend_ffi_make_fake_struct_type(type);
-				return t;
-			}
-			break;
+			return zend_ffi_make_fake_struct_type(type);
 		default:
 			break;
 	}
@@ -2534,18 +2558,13 @@ again:
 			kind = type->enumeration.kind;
 			goto again;
 		case ZEND_FFI_TYPE_STRUCT:
-			if (!(type->attr & ZEND_FFI_ATTR_UNION)
-			 && Z_TYPE_P(arg) == IS_OBJECT && Z_OBJCE_P(arg) == zend_ffi_cdata_ce) {
+			if (Z_TYPE_P(arg) == IS_OBJECT && Z_OBJCE_P(arg) == zend_ffi_cdata_ce) {
 				zend_ffi_cdata *cdata = (zend_ffi_cdata*)Z_OBJ_P(arg);

 				if (zend_ffi_is_compatible_type(type, ZEND_FFI_TYPE(cdata->type))) {
-				    /* Create a fake structure type */
-					ffi_type *t = zend_ffi_make_fake_struct_type(type);
-					if (t) {
-						*pass_type = t;
-						arg_values[n] = cdata->ptr;
-						break;
-					}
+					*pass_type = zend_ffi_make_fake_struct_type(type);;
+					arg_values[n] = cdata->ptr;
+					break;
 				}
 			}
 			zend_ffi_pass_incompatible(arg, type, n, execute_data);
@@ -0,0 +1,68 @@
+--TEST--
+Bug #80847 (Nested structs)
+--SKIPIF--
+<?php
+if (!extension_loaded('ffi')) die('skip ffi extension not available');
+if (!extension_loaded('zend-test')) die('skip zend-test extension not available');
+if (PHP_OS_FAMILY == 'Windows' && ((1 << 31) > 0)) die('xfail libffi doesn\'t properly support passing big strctures by value on Windows/64');
+?>
+--FILE--
+<?php
+require_once('utils.inc');
+$header = <<<HEADER
+    typedef struct bug80847_01 {
+        uint64_t b;
+        double c;
+    } bug80847_01;
+
+    typedef struct bug80847_02 {
+        bug80847_01 a;
+    } bug80847_02;
+
+	bug80847_02 ffi_bug80847(bug80847_02 s);
+HEADER;
+
+if (PHP_OS_FAMILY !== 'Windows') {
+    $ffi = FFI::cdef($header);
+} else {
+    try {
+        $ffi = FFI::cdef($header, 'php_zend_test.dll');
+    } catch (FFI\Exception $ex) {
+        $ffi = FFI::cdef($header, ffi_get_php_dll_name());
+    }
+}
+$x = $ffi->new('bug80847_02');
+$x->a->b = 42;
+$x->a->c = 42.5;
+var_dump($x);
+$y = $ffi->ffi_bug80847($x);
+var_dump($x, $y);
+?>
+--EXPECTF--
+object(FFI\CData:struct bug80847_02)#%d (1) {
+  ["a"]=>
+  object(FFI\CData:struct bug80847_01)#%d (2) {
+    ["b"]=>
+    int(42)
+    ["c"]=>
+    float(42.5)
+  }
+}
+object(FFI\CData:struct bug80847_02)#%d (1) {
+  ["a"]=>
+  object(FFI\CData:struct bug80847_01)#%d (2) {
+    ["b"]=>
+    int(42)
+    ["c"]=>
+    float(42.5)
+  }
+}
+object(FFI\CData:struct bug80847_02)#%d (1) {
+  ["a"]=>
+  object(FFI\CData:struct bug80847_01)#%d (2) {
+    ["b"]=>
+    int(52)
+    ["c"]=>
+    float(32.5)
+  }
+}
@@ -59,6 +59,11 @@
 #include "ftp.h"
 #include "ext/standard/fsock.h"

+#ifdef PHP_WIN32
+# undef ETIMEDOUT
+# define ETIMEDOUT WSAETIMEDOUT
+#endif
+
 /* sends an ftp command, returns true on success, false on error.
 * it sends the string "cmd args\r\n" if args is non-null, or
 * "cmd\r\n" if args is null
@@ -1260,7 +1265,8 @@ ftp_putcmd(ftpbuf_t *ftp, const char *cmd, const size_t cmd_len, const char *arg

 	data = ftp->outbuf;

-	/* Clear the extra-lines buffer */
+	/* Clear the inbuf and extra-lines buffer */
+	ftp->inbuf[0] = '\0';
 	ftp->extra = NULL;

 	if (my_send(ftp, ftp->fd, data, size) != size) {
@@ -1313,10 +1319,12 @@ ftp_readline(ftpbuf_t *ftp)

 		data = eol;
 		if ((rcvd = my_recv(ftp, ftp->fd, data, size)) < 1) {
+			*data = 0;
 			return 0;
 		}
 	} while (size);

+	*data = 0;
 	return 0;
 }
 /* }}} */
@@ -1428,15 +1436,15 @@ my_send(ftpbuf_t *ftp, php_socket_t s, void *buf, size_t len)
 		n = php_pollfd_for_ms(s, POLLOUT, ftp->timeout_sec * 1000);

 		if (n < 1) {
+			char buf[256];
+			if (n == 0) {
 #ifdef PHP_WIN32
-			if (n == 0) {
 				_set_errno(ETIMEDOUT);
-			}
 #else
-			if (n == 0) {
 				errno = ETIMEDOUT;
-			}
 #endif
+			}
+			php_error_docref(NULL, E_WARNING, "%s", php_socket_strerror(errno, buf, sizeof buf));
 			return -1;
 		}

@@ -1464,18 +1472,17 @@ my_recv(ftpbuf_t *ftp, php_socket_t s, void *buf, size_t len)
 	SSL *handle = NULL;
 	php_socket_t fd;
 #endif
-
 	n = php_pollfd_for_ms(s, PHP_POLLREADABLE, ftp->timeout_sec * 1000);
 	if (n < 1) {
+		char buf[256];
+		if (n == 0) {
 #ifdef PHP_WIN32
-		if (n == 0) {
 			_set_errno(ETIMEDOUT);
-		}
 #else
-		if (n == 0) {
 			errno = ETIMEDOUT;
-		}
 #endif
+		}
+		php_error_docref(NULL, E_WARNING, "%s", php_socket_strerror(errno, buf, sizeof buf));
 		return -1;
 	}

@@ -1541,15 +1548,15 @@ data_available(ftpbuf_t *ftp, php_socket_t s)

 	n = php_pollfd_for_ms(s, PHP_POLLREADABLE, 1000);
 	if (n < 1) {
+		char buf[256];
+		if (n == 0) {
 #ifdef PHP_WIN32
-		if (n == 0) {
 			_set_errno(ETIMEDOUT);
-		}
 #else
-		if (n == 0) {
 			errno = ETIMEDOUT;
-		}
 #endif
+		}
+		php_error_docref(NULL, E_WARNING, "%s", php_socket_strerror(errno, buf, sizeof buf));
 		return 0;
 	}

@@ -1564,15 +1571,15 @@ data_writeable(ftpbuf_t *ftp, php_socket_t s)

 	n = php_pollfd_for_ms(s, POLLOUT, 1000);
 	if (n < 1) {
+		char buf[256];
+		if (n == 0) {
 #ifdef PHP_WIN32
-		if (n == 0) {
 			_set_errno(ETIMEDOUT);
-		}
 #else
-		if (n == 0) {
 			errno = ETIMEDOUT;
-		}
 #endif
+		}
+		php_error_docref(NULL, E_WARNING, "%s", php_socket_strerror(errno, buf, sizeof buf));
 		return 0;
 	}

@@ -1588,15 +1595,15 @@ my_accept(ftpbuf_t *ftp, php_socket_t s, struct sockaddr *addr, socklen_t *addrl

 	n = php_pollfd_for_ms(s, PHP_POLLREADABLE, ftp->timeout_sec * 1000);
 	if (n < 1) {
+		char buf[256];
+		if (n == 0) {
 #ifdef PHP_WIN32
-		if (n == 0) {
 			_set_errno(ETIMEDOUT);
-		}
 #else
-		if (n == 0) {
 			errno = ETIMEDOUT;
-		}
 #endif
+		}
+		php_error_docref(NULL, E_WARNING, "%s", php_socket_strerror(errno, buf, sizeof buf));
 		return -1;
 	}

@@ -1886,6 +1893,12 @@ static void ftp_ssl_shutdown(ftpbuf_t *ftp, php_socket_t fd, SSL *ssl_handle) {
 					/* SSL wants a write. Really odd. Let's bail out. */
 					done = 1;
 					break;
+				case SSL_ERROR_SYSCALL:
+					/* most likely the peer closed the connection without
+					   sending a close_notify shutdown alert;
+					   bail out to avoid raising a spurious warning */
+					done = 1;
+					break;
 				default:
 					if ((sslerror = ERR_get_error())) {
 						ERR_error_string_n(sslerror, buf, sizeof(buf));
@@ -200,7 +200,9 @@ PHP_FUNCTION(ftp_login)

 	/* log in */
 	if (!ftp_login(ftp, user, user_len, pass, pass_len)) {
-		php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		if (*ftp->inbuf) {
+			php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		}
 		RETURN_FALSE;
 	}

@@ -224,7 +226,9 @@ PHP_FUNCTION(ftp_pwd)
 	}

 	if (!(pwd = ftp_pwd(ftp))) {
-		php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		if (*ftp->inbuf) {
+			php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		}
 		RETURN_FALSE;
 	}

@@ -247,7 +251,9 @@ PHP_FUNCTION(ftp_cdup)
 	}

 	if (!ftp_cdup(ftp)) {
-		php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		if (*ftp->inbuf) {
+			php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		}
 		RETURN_FALSE;
 	}

@@ -273,7 +279,9 @@ PHP_FUNCTION(ftp_chdir)

 	/* change directories */
 	if (!ftp_chdir(ftp, dir, dir_len)) {
-		php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		if (*ftp->inbuf) {
+			php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		}
 		RETURN_FALSE;
 	}

@@ -299,7 +307,9 @@ PHP_FUNCTION(ftp_exec)

 	/* execute serverside command */
 	if (!ftp_exec(ftp, cmd, cmd_len)) {
-		php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		if (*ftp->inbuf) {
+			php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		}
 		RETURN_FALSE;
 	}

@@ -347,7 +357,9 @@ PHP_FUNCTION(ftp_mkdir)

 	/* create directory */
 	if (NULL == (tmp = ftp_mkdir(ftp, dir, dir_len))) {
-		php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		if (*ftp->inbuf) {
+			php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		}
 		RETURN_FALSE;
 	}

@@ -373,7 +385,9 @@ PHP_FUNCTION(ftp_rmdir)

 	/* remove directorie */
 	if (!ftp_rmdir(ftp, dir, dir_len)) {
-		php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		if (*ftp->inbuf) {
+			php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		}
 		RETURN_FALSE;
 	}

@@ -399,7 +413,9 @@ PHP_FUNCTION(ftp_chmod)
 	}

 	if (!ftp_chmod(ftp, mode, filename, filename_len)) {
-		php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		if (*ftp->inbuf) {
+			php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		}
 		RETURN_FALSE;
 	}

@@ -548,7 +564,9 @@ PHP_FUNCTION(ftp_systype)
 	}

 	if (NULL == (syst = ftp_syst(ftp))) {
-		php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		if (*ftp->inbuf) {
+			php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		}
 		RETURN_FALSE;
 	}

@@ -593,7 +611,9 @@ PHP_FUNCTION(ftp_fget)
 	}

 	if (!ftp_get(ftp, stream, file, file_len, xtype, resumepos)) {
-		php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		if (*ftp->inbuf) {
+			php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		}
 		RETURN_FALSE;
 	}

@@ -642,7 +662,9 @@ PHP_FUNCTION(ftp_nb_fget)
 	ftp->closestream = 0; /* do not close */

 	if ((ret = ftp_nb_get(ftp, stream, file, file_len, xtype, resumepos)) == PHP_FTP_FAILED) {
-		php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		if (*ftp->inbuf) {
+			php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		}
 		RETURN_LONG(ret);
 	}

@@ -728,7 +750,9 @@ PHP_FUNCTION(ftp_get)
 	if (!ftp_get(ftp, outstream, remote, remote_len, xtype, resumepos)) {
 		php_stream_close(outstream);
 		VCWD_UNLINK(local);
-		php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		if (*ftp->inbuf) {
+			php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		}
 		RETURN_FALSE;
 	}

@@ -796,7 +820,9 @@ PHP_FUNCTION(ftp_nb_get)
 		php_stream_close(outstream);
 		ftp->stream = NULL;
 		VCWD_UNLINK(local);
-		php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		if (*ftp->inbuf) {
+			php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		}
 		RETURN_LONG(PHP_FTP_FAILED);
 	}

@@ -888,7 +914,9 @@ PHP_FUNCTION(ftp_fput)
 	}

 	if (!ftp_put(ftp, remote, remote_len, stream, xtype, startpos)) {
-		php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		if (*ftp->inbuf) {
+			php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		}
 		RETURN_FALSE;
 	}

@@ -941,7 +969,9 @@ PHP_FUNCTION(ftp_nb_fput)
 	ftp->closestream = 0; /* do not close */

 	if (((ret = ftp_nb_put(ftp, remote, remote_len, stream, xtype, startpos)) == PHP_FTP_FAILED)) {
-		php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		if (*ftp->inbuf) {
+			php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		}
 		RETURN_LONG(ret);
 	}

@@ -994,7 +1024,9 @@ PHP_FUNCTION(ftp_put)

 	if (!ftp_put(ftp, remote, remote_len, instream, xtype, startpos)) {
 		php_stream_close(instream);
-		php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		if (*ftp->inbuf) {
+			php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		}
 		RETURN_FALSE;
 	}
 	php_stream_close(instream);
@@ -1029,7 +1061,9 @@ PHP_FUNCTION(ftp_append)

 	if (!ftp_append(ftp, remote, remote_len, instream, xtype)) {
 		php_stream_close(instream);
-		php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		if (*ftp->inbuf) {
+			php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		}
 		RETURN_FALSE;
 	}
 	php_stream_close(instream);
@@ -1159,7 +1193,9 @@ PHP_FUNCTION(ftp_rename)

 	/* rename the file */
 	if (!ftp_rename(ftp, src, src_len, dest, dest_len)) {
-		php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		if (*ftp->inbuf) {
+			php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		}
 		RETURN_FALSE;
 	}

@@ -1185,7 +1221,9 @@ PHP_FUNCTION(ftp_delete)

 	/* delete the file */
 	if (!ftp_delete(ftp, file, file_len)) {
-		php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		if (*ftp->inbuf) {
+			php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		}
 		RETURN_FALSE;
 	}

@@ -1211,7 +1249,9 @@ PHP_FUNCTION(ftp_site)

 	/* send the site command */
 	if (!ftp_site(ftp, cmd, cmd_len)) {
-		php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		if (*ftp->inbuf) {
+			php_error_docref(NULL, E_WARNING, "%s", ftp->inbuf);
+		}
 		RETURN_FALSE;
 	}

@@ -0,0 +1,22 @@
+--TEST--
+Bug #79100 (Wrong FTP error messages)
+--SKIPIF--
+<?php
+require 'skipif.inc';
+?>
+--FILE--
+<?php
+$bug79100 = true;
+require 'server.inc';
+
+$ftp = ftp_connect("127.0.0.1", $port);
+if (!$ftp) die("Couldn't connect to the server");
+var_dump(ftp_login($ftp, 'user', 'pass'));
+var_dump(ftp_set_option($ftp, FTP_TIMEOUT_SEC, 1));
+ftp_systype($ftp);
+?>
+--EXPECTF--
+bool(true)
+bool(true)
+
+Warning: ftp_systype(): %rConnection|Operation%r timed out in %s on line %d
@@ -0,0 +1,22 @@
+--TEST--
+Bug #80901 (Info leak in ftp extension)
+--SKIPIF--
+<?php
+require 'skipif.inc';
+?>
+--INI--
+log_errors_max_len=0
+--FILE--
+<?php
+$bug80901 = true;
+require 'server.inc';
+
+$ftp = ftp_connect("127.0.0.1", $port);
+if (!$ftp) die("Couldn't connect to the server");
+var_dump(ftp_login($ftp, 'user', 'pass'));
+ftp_systype($ftp);
+?>
+--EXPECTF--
+bool(true)
+
+Warning: ftp_systype(): **************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************************** in %s on line %d
@@ -107,6 +107,7 @@ if ($pid) {
                fputs($s, "234 auth type accepted\r\n");
            } else {
                fputs($s, "666 dummy\r\n");
+                sleep(1);
                fputs($s, "666 bogus msg\r\n");
                exit;
            }
@@ -197,6 +198,10 @@ if ($pid) {
        } elseif ($buf === "SYST\r\n") {
            if (isset($bug27809)) {
                fputs($s, "215   OS/400 is the remote operating system. The TCP/IP version is \"V5R2M0\"\r\n");
+            } elseif (isset($bug79100)) {
+                // do nothing so test hits timeout
+            } elseif (isset($bug80901)) {
+                fputs($s, "\r\n" . str_repeat("*", 4096) . "\r\n");
            } else {
                fputs($s, "215 UNIX Type: L8.\r\n");
            }
@@ -59,13 +59,23 @@

 static int le_gd_font;

-#include <gd.h>
-#include <gd_errors.h>
-#include <gdfontt.h>  /* 1 Tiny font */
-#include <gdfonts.h>  /* 2 Small font */
-#include <gdfontmb.h> /* 3 Medium bold font */
-#include <gdfontl.h>  /* 4 Large font */
-#include <gdfontg.h>  /* 5 Giant font */
+#ifdef HAVE_GD_BUNDLED
+# include "libgd/gd.h"
+# include "libgd/gd_errors.h"
+# include "libgd/gdfontt.h"  /* 1 Tiny font */
+# include "libgd/gdfonts.h"  /* 2 Small font */
+# include "libgd/gdfontmb.h" /* 3 Medium bold font */
+# include "libgd/gdfontl.h"  /* 4 Large font */
+# include "libgd/gdfontg.h"  /* 5 Giant font */
+#else
+# include <gd.h>
+# include <gd_errors.h>
+# include <gdfontt.h>  /* 1 Tiny font */
+# include <gdfonts.h>  /* 2 Small font */
+# include <gdfontmb.h> /* 3 Medium bold font */
+# include <gdfontl.h>  /* 4 Large font */
+# include <gdfontg.h>  /* 5 Giant font */
+#endif

 #if defined(HAVE_GD_FREETYPE) && defined(HAVE_GD_BUNDLED)
 # include <ft2build.h>
@@ -2601,7 +2611,7 @@ PHP_FUNCTION(imageinterlace)
 		gdImageInterlace(im, INT);
 	}

-	RETURN_LONG(gdImageGetInterlaced(im));
+	RETURN_BOOL(gdImageGetInterlaced(im));
 }
 /* }}} */

@@ -177,9 +177,9 @@ function imagefill(GdImage $image, int $x, int $y, int $color): bool {}

 function imagecolorstotal(GdImage $image): int {}

-function imagecolortransparent(GdImage $image, ?int $color = null): ?int {}
+function imagecolortransparent(GdImage $image, ?int $color = null): int {}

-function imageinterlace(GdImage $image, ?bool $enable = null): ?int {}
+function imageinterlace(GdImage $image, ?bool $enable = null): bool {}

 function imagepolygon(GdImage $image, array $points, int $num_points_or_color, ?int $color = null): bool {}

@@ -1,5 +1,5 @@
 /* This is a generated file, edit the .stub.php file instead.
- * Stub hash: 63898b501cc3ae38585fe0c6f70a9f7865fbee4d */
+ * Stub hash: 012a149dba5332fcb73544771b881fc7e6d53925 */

 ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_gd_info, 0, 0, IS_ARRAY, 0)
 ZEND_END_ARG_INFO()
@@ -358,12 +358,12 @@ ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_imagecolorstotal, 0, 1, IS_LONG,
 	ZEND_ARG_OBJ_INFO(0, image, GdImage, 0)
 ZEND_END_ARG_INFO()

-ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_imagecolortransparent, 0, 1, IS_LONG, 1)
+ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_imagecolortransparent, 0, 1, IS_LONG, 0)
 	ZEND_ARG_OBJ_INFO(0, image, GdImage, 0)
 	ZEND_ARG_TYPE_INFO_WITH_DEFAULT_VALUE(0, color, IS_LONG, 1, "null")
 ZEND_END_ARG_INFO()

-ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_imageinterlace, 0, 1, IS_LONG, 1)
+ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_imageinterlace, 0, 1, _IS_BOOL, 0)
 	ZEND_ARG_OBJ_INFO(0, image, GdImage, 0)
 	ZEND_ARG_TYPE_INFO_WITH_DEFAULT_VALUE(0, enable, _IS_BOOL, 1, "null")
 ZEND_END_ARG_INFO()
@@ -19,11 +19,12 @@
 *  (end code)
 **/

-#include <gd.h>
 #include <stdlib.h>
 #include <string.h>
 #include <math.h>

+#include "gd.h"
+
 static int gdGuessBackgroundColorFromCorners(gdImagePtr im, int *color);
 static int gdColorMatch(gdImagePtr im, int col1, int col2, float threshold);

@@ -58,7 +58,7 @@ TODO:
 #include <string.h>
 #include <math.h>

-#include <gd.h>
+#include "gd.h"
 #include "gdhelpers.h"

 #ifdef _MSC_VER
@@ -51,13 +51,13 @@
   ----------------------------------------------------------------------------
 */

-#include <gd.h>
-#include <gdfonts.h>
-#include <gd_errors.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <limits.h>

+#include "gd.h"
+#include "gdfonts.h"
+#include "gd_errors.h"
 #include "wbmp.h"


@@ -8,14 +8,14 @@ if (!extension_loaded('gd')) die('skip gd extension not available');
 <?php
 $im = imagecreatetruecolor(10, 10);
 imagefilledrectangle($im, 0, 0, 9, 9, imagecolorallocate($im, 255, 255, 255));
-imageinterlace($im, 1);
+imageinterlace($im, true);
 imagegif($im, __DIR__ . 'bug77700.gif');

 $im = imagecreatefromgif(__DIR__ . 'bug77700.gif');
 var_dump(imageinterlace($im));
 ?>
 --EXPECT--
-int(1)
+bool(true)
 --CLEAN--
 <?php
 unlink(__DIR__ . 'bug77700.gif');
@@ -14,4 +14,4 @@ $image = imagecreatetruecolor(100, 100);
 var_dump(imageinterlace($image));
 ?>
 --EXPECT--
-int(0)
+bool(false)
@@ -12,9 +12,9 @@ if (!extension_loaded("gd")) die("skip GD not present");

 $image = imagecreatetruecolor(100, 100);

-var_dump(imageinterlace($image, 1));
+var_dump(imageinterlace($image, true));
 var_dump(imageinterlace($image));
 ?>
 --EXPECT--
-int(1)
-int(1)
+bool(true)
+bool(true)
@@ -13,12 +13,12 @@ if (!extension_loaded("gd")) die("skip GD not present");
 $image = imagecreatetruecolor(100, 100);

 //setting the interlace bit to on
-imageinterlace($image, 1);
+imageinterlace($image, true);

 //setting de interlace bit to off
-var_dump(imageinterlace($image, 0));
+var_dump(imageinterlace($image, false));
 var_dump(imageinterlace($image));
 ?>
 --EXPECT--
-int(0)
-int(0)
+bool(false)
+bool(false)
@@ -735,7 +735,11 @@ PHP_FUNCTION(imap_open)
 		RETURN_THROWS();
 	}

-	if (flags && ((flags & ~(OP_READONLY | OP_ANONYMOUS | OP_HALFOPEN | CL_EXPUNGE | OP_DEBUG | OP_SHORTCACHE
+	/* Check for PHP_EXPUNGE and not CL_EXPUNGE as the user land facing CL_EXPUNGE constant is defined
+	 * to something different to prevent clashes between CL_EXPUNGE and an OP_* constant allowing setting
+	 * the CL_EXPUNGE flag which will expunge when the mailbox is closed (be that manually, or via the
+	 * IMAPConnection object being destroyed naturally at the end of the PHP script */
+	if (flags && ((flags & ~(OP_READONLY | OP_ANONYMOUS | OP_HALFOPEN | PHP_EXPUNGE | OP_DEBUG | OP_SHORTCACHE
 	 		| OP_SILENT | OP_PROTOTYPE | OP_SECURE)) != 0)) {
 		zend_argument_value_error(4, "must be a bitmask of the OP_* constants, and CL_EXPUNGE");
 		RETURN_THROWS();
@@ -858,7 +862,11 @@ PHP_FUNCTION(imap_reopen)
 	}

 	/* TODO Verify these are the only options available as they are pulled from the php.net documentation */
-	if (options && ((options & ~(OP_READONLY | OP_ANONYMOUS | OP_HALFOPEN | OP_EXPUNGE | CL_EXPUNGE)) != 0)) {
+	/* Check for PHP_EXPUNGE and not CL_EXPUNGE as the user land facing CL_EXPUNGE constant is defined
+     * to something different to prevent clashes between CL_EXPUNGE and an OP_* constant allowing setting
+     * the CL_EXPUNGE flag which will expunge when the mailbox is closed (be that manually, or via the
+     * IMAPConnection object being destroyed naturally at the end of the PHP script */
+	if (options && ((options & ~(OP_READONLY | OP_ANONYMOUS | OP_HALFOPEN | OP_EXPUNGE | PHP_EXPUNGE)) != 0)) {
 		zend_argument_value_error(3, "must be a bitmask of OP_READONLY, OP_ANONYMOUS, OP_HALFOPEN, "
 			"OP_EXPUNGE, and CL_EXPUNGE");
 		RETURN_THROWS();
@@ -3055,6 +3063,23 @@ PHP_FUNCTION(imap_fetch_overview)
 }
 /* }}} */

+static zend_bool header_injection(zend_string *str, zend_bool adrlist)
+{
+	char *p = ZSTR_VAL(str);
+
+	while ((p = strpbrk(p, "\r\n")) != NULL) {
+		if (!(p[0] == '\r' && p[1] == '\n')
+		 /* adrlists do not support folding, but swallow trailing line breaks */
+		 && !((adrlist && p[1] == '\0')
+		  /* other headers support folding */
+		  || (!adrlist && (p[1] == ' ' || p[1] == '\t')))) {
+			return 1;
+		}
+		p++;
+	}
+	return 0;
+}
+
 /* {{{ Create a MIME message based on given envelope and body sections */
 PHP_FUNCTION(imap_mail_compose)
 {
@@ -3078,6 +3103,13 @@ PHP_FUNCTION(imap_mail_compose)
 		zend_argument_value_error(2, "cannot be empty");
 	}

+#define CHECK_HEADER_INJECTION(zstr, adrlist, header) \
+	if (header_injection(zstr, adrlist)) { \
+		php_error_docref(NULL, E_WARNING, "header injection attempt in " header); \
+		RETVAL_FALSE; \
+		goto done; \
+	}
+
 #define PHP_RFC822_PARSE_ADRLIST(target, value) \
 	str_copy = estrndup(Z_STRVAL_P(value), Z_STRLEN_P(value)); \
 	rfc822_parse_adrlist(target, str_copy, "NO HOST"); \
@@ -3086,46 +3118,57 @@ PHP_FUNCTION(imap_mail_compose)
 	env = mail_newenvelope();
 	if ((pvalue = zend_hash_str_find(envelope, "remail", sizeof("remail") - 1)) != NULL) {
 		convert_to_string_ex(pvalue);
+		CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "remail");
 		env->remail = cpystr(Z_STRVAL_P(pvalue));
 	}
 	if ((pvalue = zend_hash_str_find(envelope, "return_path", sizeof("return_path") - 1)) != NULL) {
 		convert_to_string_ex(pvalue);
+		CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 1, "return_path");
 		PHP_RFC822_PARSE_ADRLIST(&env->return_path, pvalue);
 	}
 	if ((pvalue = zend_hash_str_find(envelope, "date", sizeof("date") - 1)) != NULL) {
 		convert_to_string_ex(pvalue);
+		CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "date");
 		env->date = (unsigned char*)cpystr(Z_STRVAL_P(pvalue));
 	}
 	if ((pvalue = zend_hash_str_find(envelope, "from", sizeof("from") - 1)) != NULL) {
 		convert_to_string_ex(pvalue);
+		CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 1, "from");
 		PHP_RFC822_PARSE_ADRLIST(&env->from, pvalue);
 	}
 	if ((pvalue = zend_hash_str_find(envelope, "reply_to", sizeof("reply_to") - 1)) != NULL) {
 		convert_to_string_ex(pvalue);
+		CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 1, "reply_to");
 		PHP_RFC822_PARSE_ADRLIST(&env->reply_to, pvalue);
 	}
 	if ((pvalue = zend_hash_str_find(envelope, "in_reply_to", sizeof("in_reply_to") - 1)) != NULL) {
 		convert_to_string_ex(pvalue);
+		CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "in_reply_to");
 		env->in_reply_to = cpystr(Z_STRVAL_P(pvalue));
 	}
 	if ((pvalue = zend_hash_str_find(envelope, "subject", sizeof("subject") - 1)) != NULL) {
 		convert_to_string_ex(pvalue);
+		CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "subject");
 		env->subject = cpystr(Z_STRVAL_P(pvalue));
 	}
 	if ((pvalue = zend_hash_str_find(envelope, "to", sizeof("to") - 1)) != NULL) {
 		convert_to_string_ex(pvalue);
+		CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 1, "to");
 		PHP_RFC822_PARSE_ADRLIST(&env->to, pvalue);
 	}
 	if ((pvalue = zend_hash_str_find(envelope, "cc", sizeof("cc") - 1)) != NULL) {
 		convert_to_string_ex(pvalue);
+		CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 1, "cc");
 		PHP_RFC822_PARSE_ADRLIST(&env->cc, pvalue);
 	}
 	if ((pvalue = zend_hash_str_find(envelope, "bcc", sizeof("bcc") - 1)) != NULL) {
 		convert_to_string_ex(pvalue);
+		CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 1, "bcc");
 		PHP_RFC822_PARSE_ADRLIST(&env->bcc, pvalue);
 	}
 	if ((pvalue = zend_hash_str_find(envelope, "message_id", sizeof("message_id") - 1)) != NULL) {
 		convert_to_string_ex(pvalue);
+		CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "message_id");
 		env->message_id=cpystr(Z_STRVAL_P(pvalue));
 	}

@@ -3136,6 +3179,7 @@ PHP_FUNCTION(imap_mail_compose)
 			ZEND_HASH_FOREACH_VAL(Z_ARRVAL_P(pvalue), env_data) {
 				custom_headers_param = mail_newbody_parameter();
 				convert_to_string_ex(env_data);
+				CHECK_HEADER_INJECTION(Z_STR_P(env_data), 0, "custom_headers");
 				custom_headers_param->value = (char *) fs_get(Z_STRLEN_P(env_data) + 1);
 				custom_headers_param->attribute = NULL;
 				memcpy(custom_headers_param->value, Z_STRVAL_P(env_data), Z_STRLEN_P(env_data) + 1);
@@ -3178,6 +3222,7 @@ PHP_FUNCTION(imap_mail_compose)
 			}
 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "charset", sizeof("charset") - 1)) != NULL) {
 				convert_to_string_ex(pvalue);
+				CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body charset");
 				tmp_param = mail_newbody_parameter();
 				tmp_param->value = cpystr(Z_STRVAL_P(pvalue));
 				tmp_param->attribute = cpystr("CHARSET");
@@ -3190,9 +3235,11 @@ PHP_FUNCTION(imap_mail_compose)
 					SEPARATE_ARRAY(pvalue);
 					ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(pvalue), key, disp_data) {
 						if (key == NULL) continue;
+						CHECK_HEADER_INJECTION(key, 0, "body disposition key");
 						disp_param = mail_newbody_parameter();
 						disp_param->attribute = cpystr(ZSTR_VAL(key));
 						convert_to_string_ex(disp_data);
+						CHECK_HEADER_INJECTION(Z_STR_P(disp_data), 0, "body disposition value");
 						disp_param->value = (char *) fs_get(Z_STRLEN_P(disp_data) + 1);
 						memcpy(disp_param->value, Z_STRVAL_P(disp_data), Z_STRLEN_P(disp_data) + 1);
 						disp_param->next = tmp_param;
@@ -3203,18 +3250,22 @@ PHP_FUNCTION(imap_mail_compose)
 			}
 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "subtype", sizeof("subtype") - 1)) != NULL) {
 				convert_to_string_ex(pvalue);
+				CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body subtype");
 				bod->subtype = cpystr(Z_STRVAL_P(pvalue));
 			}
 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "id", sizeof("id") - 1)) != NULL) {
 				convert_to_string_ex(pvalue);
+				CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body id");
 				bod->id = cpystr(Z_STRVAL_P(pvalue));
 			}
 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "description", sizeof("description") - 1)) != NULL) {
 				convert_to_string_ex(pvalue);
+				CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body description");
 				bod->description = cpystr(Z_STRVAL_P(pvalue));
 			}
 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "disposition.type", sizeof("disposition.type") - 1)) != NULL) {
 				convert_to_string_ex(pvalue);
+				CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body disposition.type");
 				bod->disposition.type = (char *) fs_get(Z_STRLEN_P(pvalue) + 1);
 				memcpy(bod->disposition.type, Z_STRVAL_P(pvalue), Z_STRLEN_P(pvalue)+1);
 			}
@@ -3224,9 +3275,11 @@ PHP_FUNCTION(imap_mail_compose)
 					SEPARATE_ARRAY(pvalue);
 					ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(pvalue), key, disp_data) {
 						if (key == NULL) continue;
+						CHECK_HEADER_INJECTION(key, 0, "body type.parameters key");
 						disp_param = mail_newbody_parameter();
 						disp_param->attribute = cpystr(ZSTR_VAL(key));
 						convert_to_string_ex(disp_data);
+						CHECK_HEADER_INJECTION(Z_STR_P(disp_data), 0, "body type.parameters value");
 						disp_param->value = (char *) fs_get(Z_STRLEN_P(disp_data) + 1);
 						memcpy(disp_param->value, Z_STRVAL_P(disp_data), Z_STRLEN_P(disp_data) + 1);
 						disp_param->next = tmp_param;
@@ -3257,6 +3310,7 @@ PHP_FUNCTION(imap_mail_compose)
 			}
 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "md5", sizeof("md5") - 1)) != NULL) {
 				convert_to_string_ex(pvalue);
+				CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body md5");
 				bod->md5 = cpystr(Z_STRVAL_P(pvalue));
 			}
 		} else if (Z_TYPE_P(data) == IS_ARRAY && topbod->type == TYPEMULTIPART) {
@@ -3289,6 +3343,7 @@ PHP_FUNCTION(imap_mail_compose)
 			}
 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "charset", sizeof("charset") - 1)) != NULL) {
 				convert_to_string_ex(pvalue);
+				CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body charset");
 				tmp_param = mail_newbody_parameter();
 				tmp_param->value = (char *) fs_get(Z_STRLEN_P(pvalue) + 1);
 				memcpy(tmp_param->value, Z_STRVAL_P(pvalue), Z_STRLEN_P(pvalue) + 1);
@@ -3302,9 +3357,11 @@ PHP_FUNCTION(imap_mail_compose)
 					SEPARATE_ARRAY(pvalue);
 					ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(pvalue), key, disp_data) {
 						if (key == NULL) continue;
+						CHECK_HEADER_INJECTION(key, 0, "body type.parameters key");
 						disp_param = mail_newbody_parameter();
 						disp_param->attribute = cpystr(ZSTR_VAL(key));
 						convert_to_string_ex(disp_data);
+						CHECK_HEADER_INJECTION(Z_STR_P(disp_data), 0, "body type.parameters value");
 						disp_param->value = (char *)fs_get(Z_STRLEN_P(disp_data) + 1);
 						memcpy(disp_param->value, Z_STRVAL_P(disp_data), Z_STRLEN_P(disp_data) + 1);
 						disp_param->next = tmp_param;
@@ -3315,18 +3372,22 @@ PHP_FUNCTION(imap_mail_compose)
 			}
 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "subtype", sizeof("subtype") - 1)) != NULL) {
 				convert_to_string_ex(pvalue);
+				CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body subtype");
 				bod->subtype = cpystr(Z_STRVAL_P(pvalue));
 			}
 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "id", sizeof("id") - 1)) != NULL) {
 				convert_to_string_ex(pvalue);
+				CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body id");
 				bod->id = cpystr(Z_STRVAL_P(pvalue));
 			}
 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "description", sizeof("description") - 1)) != NULL) {
 				convert_to_string_ex(pvalue);
+				CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body description");
 				bod->description = cpystr(Z_STRVAL_P(pvalue));
 			}
 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "disposition.type", sizeof("disposition.type") - 1)) != NULL) {
 				convert_to_string_ex(pvalue);
+				CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body disposition.type");
 				bod->disposition.type = (char *) fs_get(Z_STRLEN_P(pvalue) + 1);
 				memcpy(bod->disposition.type, Z_STRVAL_P(pvalue), Z_STRLEN_P(pvalue)+1);
 			}
@@ -3336,9 +3397,11 @@ PHP_FUNCTION(imap_mail_compose)
 					SEPARATE_ARRAY(pvalue);
 					ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(pvalue), key, disp_data) {
 						if (key == NULL) continue;
+						CHECK_HEADER_INJECTION(key, 0, "body disposition key");
 						disp_param = mail_newbody_parameter();
 						disp_param->attribute = cpystr(ZSTR_VAL(key));
 						convert_to_string_ex(disp_data);
+						CHECK_HEADER_INJECTION(Z_STR_P(disp_data), 0, "body disposition value");
 						disp_param->value = (char *) fs_get(Z_STRLEN_P(disp_data) + 1);
 						memcpy(disp_param->value, Z_STRVAL_P(disp_data), Z_STRLEN_P(disp_data) + 1);
 						disp_param->next = tmp_param;
@@ -3369,6 +3432,7 @@ PHP_FUNCTION(imap_mail_compose)
 			}
 			if ((pvalue = zend_hash_str_find(Z_ARRVAL_P(data), "md5", sizeof("md5") - 1)) != NULL) {
 				convert_to_string_ex(pvalue);
+				CHECK_HEADER_INJECTION(Z_STR_P(pvalue), 0, "body md5");
 				bod->md5 = cpystr(Z_STRVAL_P(pvalue));
 			}
 		}
@@ -0,0 +1,37 @@
+--TEST--
+Bug #80710 (imap_mail_compose() header injection) - MIME Splitting Attack
+--SKIPIF--
+<?php
+if (!extension_loaded("imap")) die("skip imap extension not available");
+?>
+--FILE--
+<?php
+$envelope["from"]= "joe@example.com\n From : X-INJECTED";
+$envelope["to"]  = "foo@example.com\nFrom: X-INJECTED";
+$envelope["cc"]  = "bar@example.com\nFrom: X-INJECTED";
+$envelope["subject"]  = "bar@example.com\n\n From : X-INJECTED";
+$envelope["x-remail"]  = "bar@example.com\nFrom: X-INJECTED";
+$envelope["something"]  = "bar@example.com\nFrom: X-INJECTED";
+
+$part1["type"] = TYPEMULTIPART;
+$part1["subtype"] = "mixed";
+
+$part2["type"] = TYPEAPPLICATION;
+$part2["encoding"] = ENCBINARY;
+$part2["subtype"] = "octet-stream\nContent-Type: X-INJECTED";
+$part2["description"] = "some file\nContent-Type: X-INJECTED";
+$part2["contents.data"] = "ABC\nContent-Type: X-INJECTED";
+
+$part3["type"] = TYPETEXT;
+$part3["subtype"] = "plain";
+$part3["description"] = "description3";
+$part3["contents.data"] = "contents.data3\n\n\n\t";
+
+$body[1] = $part1;
+$body[2] = $part2;
+$body[3] = $part3;
+
+echo imap_mail_compose($envelope, $body);
+?>
+--EXPECTF--
+Warning: imap_mail_compose(): header injection attempt in from in %s on line %d
@@ -0,0 +1,37 @@
+--TEST--
+Bug #80710 (imap_mail_compose() header injection) - Remail
+--SKIPIF--
+<?php
+if (!extension_loaded("imap")) die("skip imap extension not available");
+?>
+--FILE--
+<?php
+$envelope["from"]= "joe@example.com\n From : X-INJECTED";
+$envelope["to"]  = "foo@example.com\nFrom: X-INJECTED";
+$envelope["cc"]  = "bar@example.com\nFrom: X-INJECTED";
+$envelope["subject"]  = "bar@example.com\n\n From : X-INJECTED";
+$envelope["remail"]  = "X-INJECTED-REMAIL: X-INJECTED\nFrom: X-INJECTED-REMAIL-FROM"; //<--- Injected as first hdr
+$envelope["something"]  = "bar@example.com\nFrom: X-INJECTED";
+
+$part1["type"] = TYPEMULTIPART;
+$part1["subtype"] = "mixed";
+
+$part2["type"] = TYPEAPPLICATION;
+$part2["encoding"] = ENCBINARY;
+$part2["subtype"] = "octet-stream\nContent-Type: X-INJECTED";
+$part2["description"] = "some file\nContent-Type: X-INJECTED";
+$part2["contents.data"] = "ABC\nContent-Type: X-INJECTED";
+
+$part3["type"] = TYPETEXT;
+$part3["subtype"] = "plain";
+$part3["description"] = "description3";
+$part3["contents.data"] = "contents.data3\n\n\n\t";
+
+$body[1] = $part1;
+$body[2] = $part2;
+$body[3] = $part3;
+
+echo imap_mail_compose($envelope, $body);
+?>
+--EXPECTF--
+Warning: imap_mail_compose(): header injection attempt in remail in %s on line %d
@@ -0,0 +1,21 @@
+--TEST--
+Bug #80800: imap_open() fails when the flags parameter includes CL_EXPUNGE
+--SKIPIF--
+<?php
+require_once(__DIR__.'/setup/skipif.inc');
+?>
+--FILE--
+<?php
+
+require_once __DIR__.'/setup/imap_include.inc';
+
+$mail_box = imap_open(IMAP_DEFAULT_MAILBOX, IMAP_MAILBOX_USERNAME, IMAP_MAILBOX_PASSWORD, flags: CL_EXPUNGE);
+var_dump(imap_reopen($mail_box, IMAP_DEFAULT_MAILBOX, flags: CL_EXPUNGE));
+imap_close($mail_box);
+
+echo 'Connected without any issues', "\n";
+
+?>
+--EXPECT--
+bool(true)
+Connected without any issues
@@ -0,0 +1,43 @@
+--TEST--
+Test imap_open() using the CL_EXPUNGE flag
+--SKIPIF--
+<?php
+require_once(__DIR__.'/setup/skipif.inc');
+?>
+--FILE--
+<?php
+
+// include file for required variables in imap_open()
+require_once(__DIR__.'/setup/imap_include.inc');
+
+// set up temp mailbox with 3 messages
+$stream_id = setup_test_mailbox('imapopenwithclexpunge', 3, $mailbox, flags: CL_EXPUNGE);
+
+// mark messages in inbox for deletion
+for ($i = 1; $i < 4; $i++) {
+    imap_delete($stream_id, $i);
+}
+
+echo "\n-- Call to imap_close() --\n";
+var_dump( imap_close($stream_id) );
+
+// check that CL_EXPUNGE in previous imap_open() call worked
+$stream_id = imap_open($mailbox, IMAP_MAILBOX_USERNAME, IMAP_MAILBOX_PASSWORD);
+echo "There are now " . imap_num_msg($stream_id) . " msgs in mailbox '$mailbox'\n";
+
+// Close connection
+var_dump( imap_close($stream_id) );
+?>
+--CLEAN--
+<?php
+$mailbox_suffix = 'imapopenwithclexpunge';
+require_once(__DIR__.'/setup/clean.inc');
+?>
+--EXPECTF--
+Create a temporary mailbox and add 3 msgs
+New mailbox created
+
+-- Call to imap_close() --
+bool(true)
+There are now 0 msgs in mailbox '%sINBOX.phpttestimapopenwithclexpunge'
+bool(true)
@@ -0,0 +1,48 @@
+--TEST--
+Test imap_reopen() using the CL_EXPUNGE flag
+--SKIPIF--
+<?php
+require_once(__DIR__.'/setup/skipif.inc');
+?>
+--FILE--
+<?php
+
+// include file for required variables in imap_open()
+require_once(__DIR__.'/setup/imap_include.inc');
+
+$mailbox_suffix = 'imapreopenwithclexpunge';
+
+// set up temp mailbox with 3 messages
+$stream_id = setup_test_mailbox($mailbox_suffix , 3, $mailbox);
+
+var_dump(imap_reopen($stream_id, IMAP_DEFAULT_MAILBOX . '.' . IMAP_MAILBOX_PHPT_PREFIX . $mailbox_suffix, flags: CL_EXPUNGE));
+
+// mark messages in inbox for deletion
+for ($i = 1; $i < 4; $i++) {
+    imap_delete($stream_id, $i);
+}
+
+echo "\n-- Call to imap_close() --\n";
+var_dump( imap_close($stream_id) );
+
+// check that CL_EXPUNGE in previous imap_reopen() call worked
+$stream_id = imap_open($mailbox, IMAP_MAILBOX_USERNAME, IMAP_MAILBOX_PASSWORD);
+echo "There are now " . imap_num_msg($stream_id) . " msgs in mailbox '$mailbox'\n";
+
+// Close connection
+var_dump( imap_close($stream_id) );
+?>
+--CLEAN--
+<?php
+$mailbox_suffix = 'imapreopenwithclexpunge';
+require_once(__DIR__.'/setup/clean.inc');
+?>
+--EXPECTF--
+Create a temporary mailbox and add 3 msgs
+New mailbox created
+bool(true)
+
+-- Call to imap_close() --
+bool(true)
+There are now 0 msgs in mailbox '%sINBOX.phpttestimapreopenwithclexpunge'
+bool(true)
@@ -63,12 +63,19 @@ function displayOverviewFields($resp, array $fields = MANDATORY_OVERVIEW_FIELDS)
 * @param int message_count number of test msgs to be written to new mailbox
 * @param null $new_mailbox
 * @param bool $simpleMessages
+ * @param int $flags OP_* (or CL_EXPUNGE) flags to pass to imap_open() sub-call
 * @return resource IMAP stream to new mailbox
 * @throws Exception
 */
-function setup_test_mailbox(string $mailbox_suffix, int $message_count, &$new_mailbox = null, bool $simpleMessages = true){
+function setup_test_mailbox(
+    string $mailbox_suffix,
+    int $message_count,
+    &$new_mailbox = null,
+    bool $simpleMessages = true,
+    int $flags = 0,
+){
    // open a stream to default mailbox
-    $imap_stream = imap_open(IMAP_DEFAULT_MAILBOX, IMAP_MAILBOX_USERNAME, IMAP_MAILBOX_PASSWORD);
+    $imap_stream = imap_open(IMAP_DEFAULT_MAILBOX, IMAP_MAILBOX_USERNAME, IMAP_MAILBOX_PASSWORD, flags: $flags);

    if ($imap_stream === false) {
        throw new Exception("Cannot connect to IMAP server " . IMAP_SERVER . ": " . imap_last_error());
@@ -173,6 +173,7 @@ U_CFUNC double intl_zval_to_millis(zval *z, intl_error *err, const char *func)
 		return ZEND_NAN;
 	}

+try_again:
 	switch (Z_TYPE_P(z)) {
 	case IS_STRING:
 		type = is_numeric_string(Z_STRVAL_P(z), Z_STRLEN_P(z), &lv, &rv, 0);
@@ -225,6 +226,9 @@ U_CFUNC double intl_zval_to_millis(zval *z, intl_error *err, const char *func)
 			efree(message);
 		}
 		break;
+	case IS_REFERENCE:
+		z = Z_REFVAL_P(z);
+		goto try_again;
 	default:
 		spprintf(&message, 0, "%s: invalid PHP type for date", func);
 		intl_errors_set(err, U_ILLEGAL_ARGUMENT_ERROR,
@@ -11,7 +11,7 @@ class UConverter

    /**
     * @param int $error
-     * @return string|null
+     * @return string|int|array|null
     */
    public function fromUCallback(int $reason, array $source, int $codePoint, &$error) {}

@@ -59,7 +59,7 @@ class UConverter

    /**
     * @param int $error
-     * @return string|null
+     * @return string|int|array|null
     */
    public function toUCallback(int $reason, string $source, string $codeUnits, &$error) {}

@@ -1,5 +1,5 @@
 /* This is a generated file, edit the .stub.php file instead.
- * Stub hash: e33e2614c969c59b79c6062f7a347a8e8e486d85 */
+ * Stub hash: 07a152ecebadf8f1766fb231cd60bfefda0dd6a6 */

 ZEND_BEGIN_ARG_INFO_EX(arginfo_class_UConverter___construct, 0, 0, 0)
 	ZEND_ARG_TYPE_INFO_WITH_DEFAULT_VALUE(0, destination_encoding, IS_STRING, 1, "null")
@@ -77,6 +77,7 @@ zend_object *IntlDateFormatter_object_clone(zend_object *object)
 	zend_object *new_obj;

 	dfo = php_intl_dateformatter_fetch_object(object);
+	intl_error_reset(INTL_DATA_ERROR_P(dfo));

 	new_obj = IntlDateFormatter_ce_ptr->create_object(object->ce);
 	new_dfo = php_intl_dateformatter_fetch_object(new_obj);
@@ -64,6 +64,8 @@ zend_object *NumberFormatter_object_clone(zend_object *object)
 	zend_object *new_obj;

 	nfo = php_intl_number_format_fetch_object(object);
+	intl_error_reset(INTL_DATA_ERROR_P(nfo));
+
 	new_obj = NumberFormatter_ce_ptr->create_object(object->ce);
 	new_nfo = php_intl_number_format_fetch_object(new_obj);
 	/* clone standard parts */
@@ -62,6 +62,8 @@ zend_object *MessageFormatter_object_clone(zend_object *object)
 	zend_object *new_obj;

 	mfo = php_intl_messageformatter_fetch_object(object);
+	intl_error_reset(INTL_DATA_ERROR_P(mfo));
+
 	new_obj = MessageFormatter_ce_ptr->create_object(object->ce);
 	new_mfo = php_intl_messageformatter_fetch_object(new_obj);
 	/* clone standard parts */
@@ -0,0 +1,16 @@
+--TEST--
+Bug #80763 (msgfmt_format() does not accept DateTime references)
+--SKIPIF--
+<?php
+if (!extension_loaded('intl')) die('skip intl extension not available');
+?>
+--FILE--
+<?php
+$today = new DateTime('2021-02-17 12:00:00');
+$formatter = new \MessageFormatter('en_US', 'Today is {today, date, full}.');
+$params = ['today' => $today];
+array_walk($params, fn() => 1);
+var_dump($formatter->format($params));
+?>
+--EXPECT--
+string(38) "Today is Wednesday, February 17, 2021."
@@ -0,0 +1,21 @@
+--TEST--
+Bug #81019: Unable to clone NumberFormatter after failed parse()
+--FILE--
+<?php
+
+$fmt = new NumberFormatter('en_US', NumberFormatter::DECIMAL);
+$fmt->parse('abc');
+$fmt2 = clone $fmt;
+
+$datefmt = new IntlDateFormatter('en_US', IntlDateFormatter::FULL, IntlDateFormatter::FULL);
+$datefmt->parse('abc');
+$datefmt2 = clone $datefmt;
+
+$msgfmt = new MessageFormatter('en_US', '{0,number,integer}');
+$msgfmt->parse('abc');
+$msgfmt2 = clone $msgfmt;
+
+?>
+===DONE===
+--EXPECT--
+===DONE===
@@ -1602,11 +1602,15 @@ cleanup_parallel:

 		if (!base_dn_str) {
 			zend_argument_type_error(2, "must be of type string when argument #1 ($ldap) is a resource");
+			ret = 0;
+			goto cleanup;
 		}
 		ldap_base_dn = zend_string_copy(base_dn_str);

 		if (!filter_str) {
 			zend_argument_type_error(3, "must be of type string when argument #1 ($ldap) is a resource");
+			ret = 0;
+			goto cleanup;
 		}
 		ldap_filter = zend_string_copy(filter_str);

@@ -70,10 +70,10 @@ function ldap_first_entry($ldap, $result) {}

 /**
 * @param resource $ldap
- * @param resource $result
+ * @param resource $entry
 * @return resource|false
 */
-function ldap_next_entry($ldap, $result) {}
+function ldap_next_entry($ldap, $entry) {}

 /**
 * @param resource $ldap
@@ -1,5 +1,5 @@
 /* This is a generated file, edit the .stub.php file instead.
- * Stub hash: 9d6315aeee2e3a1be51c05b65a960ed433bbe4ec */
+ * Stub hash: 9e097927708f5f1d0a2ed8267422e6095e8583b0 */

 #if defined(HAVE_ORALDAP)
 ZEND_BEGIN_ARG_INFO_EX(arginfo_ldap_connect, 0, 0, 0)
@@ -78,7 +78,10 @@ ZEND_BEGIN_ARG_INFO_EX(arginfo_ldap_first_entry, 0, 0, 2)
 	ZEND_ARG_INFO(0, result)
 ZEND_END_ARG_INFO()

-#define arginfo_ldap_next_entry arginfo_ldap_first_entry
+ZEND_BEGIN_ARG_INFO_EX(arginfo_ldap_next_entry, 0, 0, 2)
+	ZEND_ARG_INFO(0, ldap)
+	ZEND_ARG_INFO(0, entry)
+ZEND_END_ARG_INFO()

 ZEND_BEGIN_ARG_WITH_RETURN_TYPE_MASK_EX(arginfo_ldap_get_entries, 0, 2, MAY_BE_ARRAY|MAY_BE_FALSE)
 	ZEND_ARG_INFO(0, ldap)
@@ -39,6 +39,18 @@ try {
    echo $exception->getMessage() . "\n";
 }

+try {
+    ldap_search($link, [], []);
+} catch (TypeError $exception) {
+    echo $exception->getMessage() . "\n";
+}
+
+try {
+    ldap_search($link, "", []);
+} catch (TypeError $exception) {
+    echo $exception->getMessage() . "\n";
+}
+
 ?>
 --EXPECTF--
 Warning: ldap_search(): Search: No such object in %s on line %d
@@ -49,3 +61,5 @@ bool(false)
 ldap_search(): Argument #1 ($ldap) cannot be empty
 ldap_search(): Argument #2 ($base) must have the same number of elements as the links array
 ldap_search(): Argument #3 ($filter) must have the same number of elements as the links array
+ldap_search(): Argument #2 ($base) must be of type string when argument #1 ($ldap) is a resource
+ldap_search(): Argument #3 ($filter) must be of type string when argument #1 ($ldap) is a resource
@@ -361,6 +361,54 @@ php_libxml_input_buffer_create_filename(const char *URI, xmlCharEncoding enc)
 		return(NULL);
 	}

+	/* Check if there's been an external transport protocol with an encoding information */
+	if (enc == XML_CHAR_ENCODING_NONE) {
+		php_stream *s  = (php_stream *) context;
+
+		if (Z_TYPE(s->wrapperdata) == IS_ARRAY) {
+			zval *header;
+
+			ZEND_HASH_FOREACH_VAL_IND(Z_ARRVAL(s->wrapperdata), header) {
+				const char buf[] = "Content-Type:";
+				if (Z_TYPE_P(header) == IS_STRING &&
+						!zend_binary_strncasecmp(Z_STRVAL_P(header), Z_STRLEN_P(header), buf, sizeof(buf)-1, sizeof(buf)-1)) {
+					char *needle = estrdup("charset=");
+					char *haystack = estrndup(Z_STRVAL_P(header), Z_STRLEN_P(header));
+					char *encoding = php_stristr(haystack, needle, Z_STRLEN_P(header), sizeof("charset=")-1);
+
+					if (encoding) {
+						char *end;
+						
+						encoding += sizeof("charset=")-1;
+						if (*encoding == '"') {
+							encoding++;
+						}
+						end = strchr(encoding, ';');
+						if (end == NULL) {
+							end = encoding + strlen(encoding);
+						}
+						end--; /* end == encoding-1 isn't a buffer underrun */
+						while (*end == ' ' || *end == '\t') {
+							end--;
+						}
+						if (*end == '"') {
+							end--;
+						}
+						if (encoding >= end) continue;
+						*(end+1) = '\0';
+						enc = xmlParseCharEncoding(encoding);
+						if (enc <= XML_CHAR_ENCODING_NONE) {
+							enc = XML_CHAR_ENCODING_NONE;
+						}
+					}
+					efree(haystack);
+					efree(needle);
+					break; /* found content-type */
+				}
+			} ZEND_HASH_FOREACH_END();
+		}
+	}
+
 	/* Allocate the Input buffer front-end. */
 	ret = xmlAllocParserInputBuffer(enc);
 	if (ret != NULL) {
@@ -1110,7 +1158,7 @@ PHP_FUNCTION(libxml_set_external_entity_loader)
 /* {{{ Common functions shared by extensions */
 int php_libxml_xmlCheckUTF8(const unsigned char *s)
 {
-	int i;
+	size_t i;
 	unsigned char c;

 	for (i = 0; (c = s[i++]);) {
@@ -0,0 +1,38 @@
+--TEST--
+Bug #51903 (simplexml_load_file() doesn't use HTTP headers)
+--SKIPIF--
+<?php
+if (!extension_loaded('simplexml')) die('skip simplexml extension not available');
+if (@!include "./ext/standard/tests/http/server.inc") die('skip server.inc not available');
+http_server_skipif();
+?>
+--FILE--
+<?php
+require "./ext/standard/tests/http/server.inc";
+$responses = [
+    "data://text/plain,HTTP/1.1 200 OK\r\n"
+    . "Content-Type: text/xml; charset=ISO-8859-1\r\n\r\n"
+    . "<?xml version=\"1.0\"?>\n"
+    . "<root>\xE4\xF6\xFC</root>\n",
+    "data://text/plain,HTTP/1.1 200 OK\r\n"
+    . "Content-Type: text/xml; charset=ISO-8859-1; foo=bar\r\n\r\n"
+    . "<?xml version=\"1.0\"?>\n"
+    . "<root>\xE4\xF6\xFC</root>\n",
+    "data://text/plain,HTTP/1.1 200 OK\r\n"
+    . "Content-Type: text/xml; charset=\"ISO-8859-1\" ; foo=bar\r\n\r\n"
+    . "<?xml version=\"1.0\"?>\n"
+    . "<root>\xE4\xF6\xFC</root>\n",
+];
+['pid' => $pid, 'uri' => $uri] = http_server($responses);
+
+for ($i = 0; $i < count($responses); $i++) {
+    $sxe = simplexml_load_file($uri);
+    echo "$sxe\n";
+}
+
+http_server_kill($pid);
+?>
+--EXPECT--
+äöü
+äöü
+äöü
@@ -2451,6 +2451,7 @@ MBSTRING_API HashTable *php_mb_convert_encoding_recursive(HashTable *input, cons
 		}
 		/* convert value */
 		ZEND_ASSERT(entry);
+try_again:
 		switch(Z_TYPE_P(entry)) {
 			case IS_STRING:
 				cval = php_mb_convert_encoding(
@@ -2475,6 +2476,9 @@ MBSTRING_API HashTable *php_mb_convert_encoding_recursive(HashTable *input, cons
 					ZVAL_EMPTY_ARRAY(&entry_tmp);
 				}
 				break;
+			case IS_REFERENCE:
+				entry = Z_REFVAL_P(entry);
+				goto try_again;
 			case IS_OBJECT:
 			default:
 				if (key) {
@@ -0,0 +1,85 @@
+--TEST--
+Bug #81011 (mb_convert_encoding removes references from arrays)
+--SKIPIF--
+<?php
+if (!extension_loaded('mbstring')) die("skip mbstring extension not available");
+?>
+--FILE--
+<?php
+$array = [
+    'ads' => [
+        123 => ['name' => 'this', 'id' => 444],
+        234 => ['name' => 'that', 'id' => 555],
+    ],
+    'other' => ['one', 'two']
+    ];
+         
+// we modify array elements using reference     
+foreach( $array['ads'] as &$ad ){
+    $ad['premium'] = (int)($ad['id'] == 555);
+}
+
+var_dump($array);
+var_dump(mb_convert_encoding($array, 'UTF-8', 'UTF-8'));
+?>
+--EXPECT--
+array(2) {
+  ["ads"]=>
+  array(2) {
+    [123]=>
+    array(3) {
+      ["name"]=>
+      string(4) "this"
+      ["id"]=>
+      int(444)
+      ["premium"]=>
+      int(0)
+    }
+    [234]=>
+    &array(3) {
+      ["name"]=>
+      string(4) "that"
+      ["id"]=>
+      int(555)
+      ["premium"]=>
+      int(1)
+    }
+  }
+  ["other"]=>
+  array(2) {
+    [0]=>
+    string(3) "one"
+    [1]=>
+    string(3) "two"
+  }
+}
+array(2) {
+  ["ads"]=>
+  array(2) {
+    [123]=>
+    array(3) {
+      ["name"]=>
+      string(4) "this"
+      ["id"]=>
+      int(444)
+      ["premium"]=>
+      int(0)
+    }
+    [234]=>
+    array(3) {
+      ["name"]=>
+      string(4) "that"
+      ["id"]=>
+      int(555)
+      ["premium"]=>
+      int(1)
+    }
+  }
+  ["other"]=>
+  array(2) {
+    [0]=>
+    string(3) "one"
+    [1]=>
+    string(3) "two"
+  }
+}
@@ -113,7 +113,7 @@ class mysqli
    public function get_warnings() {}

    /**
-     * @return mysqli|false
+     * @return null|false
     */
    public function init() {}

@@ -1,5 +1,5 @@
 /* This is a generated file, edit the .stub.php file instead.
- * Stub hash: 36c7ee22aa4c5bb5e0174031a3defcaaadde0dbd */
+ * Stub hash: c2ab263780902447855ecb0d8a9e3432577a32d1 */

 ZEND_BEGIN_ARG_WITH_RETURN_TYPE_MASK_EX(arginfo_mysqli_affected_rows, 0, 1, MAY_BE_LONG|MAY_BE_STRING)
 	ZEND_ARG_OBJ_INFO(0, mysql, mysqli, 0)
@@ -0,0 +1,38 @@
+--TEST--
+Bug #80837 Calling stmt_store_result after fetch doesn't throw an error
+--SKIPIF--
+<?php
+require_once 'skipif.inc';
+require_once 'skipifconnectfailure.inc';
+if (!defined('MYSQLI_STORE_RESULT_COPY_DATA')) die('skip requires mysqlnd');
+?>
+--FILE--
+<?php
+require_once "connect.inc";
+
+mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);
+$mysqli = new my_mysqli($host, $user, $passwd, $db, $port, $socket);
+
+$mysqli->query('DROP TABLE IF EXISTS test');
+$mysqli->query('CREATE TABLE test (b int)');
+$mysqli->query('INSERT INTO test VALUES (1),(2),(3)');
+
+$statement = $mysqli->prepare("SELECT b FROM test");
+$statement->execute();
+$statement->bind_result($name);
+$statement->fetch();
+try {
+    $statement->store_result();
+} catch (mysqli_sql_exception $e) {
+    echo $e->getMessage();
+}
+
+$mysqli->close();
+
+?>
+--CLEAN--
+<?php
+require_once "clean_table.inc";
+?>
+--EXPECTF--
+Commands out of sync; you can't run this command now
@@ -101,8 +101,8 @@ max_execution_time=240
    require_once('table.inc');

    if (!$link = my_mysqli_connect($host, 'pamtest', 'pamtest', $db, $port, $socket)) {
-        printf("[001] Cannot connect to the server using host=%s, user=%s, passwd=***, dbname=%s, port=%s, socket=%s\n",
-            $host, $user, $db, $port, $socket);
+        printf("[001] Cannot connect to the server using host=%s, user=pamtest, passwd=pamtest dbname=%s, port=%s, socket=%s\n",
+            $host, $db, $port, $socket);
    } else {

      if (!$res = $link->query("SELECT id FROM test WHERE id = 1"))
@@ -89,7 +89,7 @@ MYSQLND_METHOD(mysqlnd_stmt, store_result)(MYSQLND_STMT * const s)

 	/* Nothing to store for UPSERT/LOAD DATA*/
 	if (!mysqlnd_stmt_check_state(stmt)) {
-		SET_CLIENT_ERROR(conn->error_info, CR_COMMANDS_OUT_OF_SYNC, UNKNOWN_SQLSTATE, mysqlnd_out_of_sync);
+		SET_CLIENT_ERROR(stmt->error_info, CR_COMMANDS_OUT_OF_SYNC, UNKNOWN_SQLSTATE, mysqlnd_out_of_sync);
 		DBG_RETURN(NULL);
 	}

@@ -22,8 +22,11 @@ function oci_bind_by_name($statement, string $param, mixed &$var, int $max_lengt
 */
 function ocibindbyname($statement, string $param, mixed &$var, int $max_length = -1, int $type = 0): bool {}

-/** @param resource $statement */
-function oci_bind_array_by_name($statement, string $param, mixed &$var, int $max_array_length, int $max_item_length = -1, int $type = SQLT_AFC): bool {}
+/**
+ * @param resource $statement
+ * @param array $var
+ */
+function oci_bind_array_by_name($statement, string $param, &$var, int $max_array_length, int $max_item_length = -1, int $type = SQLT_AFC): bool {}

 function oci_free_descriptor(OCILob $lob): bool {}

@@ -247,7 +250,7 @@ function oci_fetch_all($statement, &$output, int $offset = 0, int $limit = -1, i
 function ocifetchstatement($statement, &$output, int $offset = 0, int $limit = -1, int $flags = 0): int {}

 /** @param resource $statement */
-function oci_fetch_object($statement, int $mode = PHP_OCI_ASSOC | PHP_OCI_RETURN_NULLS): stdClass|null|false {}
+function oci_fetch_object($statement, int $mode = PHP_OCI_ASSOC | PHP_OCI_RETURN_NULLS): stdClass|false {}

 /** @param resource $statement */
 function oci_fetch_row($statement): array|false {}
@@ -1,5 +1,5 @@
 /* This is a generated file, edit the .stub.php file instead.
- * Stub hash: e7a7a9402b2668136f9f47d6e547e3af46a78a50 */
+ * Stub hash: 7355ccbef6b490db7ddec94d485fbfb4597c3150 */

 ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_oci_define_by_name, 0, 3, _IS_BOOL, 0)
 	ZEND_ARG_INFO(0, statement)
@@ -23,7 +23,7 @@ ZEND_END_ARG_INFO()
 ZEND_BEGIN_ARG_WITH_RETURN_TYPE_INFO_EX(arginfo_oci_bind_array_by_name, 0, 4, _IS_BOOL, 0)
 	ZEND_ARG_INFO(0, statement)
 	ZEND_ARG_TYPE_INFO(0, param, IS_STRING, 0)
-	ZEND_ARG_TYPE_INFO(1, var, IS_MIXED, 0)
+	ZEND_ARG_INFO(1, var)
 	ZEND_ARG_TYPE_INFO(0, max_array_length, IS_LONG, 0)
 	ZEND_ARG_TYPE_INFO_WITH_DEFAULT_VALUE(0, max_item_length, IS_LONG, 0, "-1")
 	ZEND_ARG_TYPE_INFO_WITH_DEFAULT_VALUE(0, type, IS_LONG, 0, "SQLT_AFC")
@@ -221,7 +221,7 @@ ZEND_END_ARG_INFO()

 #define arginfo_ocifetchstatement arginfo_oci_fetch_all

-ZEND_BEGIN_ARG_WITH_RETURN_OBJ_TYPE_MASK_EX(arginfo_oci_fetch_object, 0, 1, stdClass, MAY_BE_NULL|MAY_BE_FALSE)
+ZEND_BEGIN_ARG_WITH_RETURN_OBJ_TYPE_MASK_EX(arginfo_oci_fetch_object, 0, 1, stdClass, MAY_BE_FALSE)
 	ZEND_ARG_INFO(0, statement)
 	ZEND_ARG_TYPE_INFO_WITH_DEFAULT_VALUE(0, mode, IS_LONG, 0, "PHP_OCI_ASSOC | PHP_OCI_RETURN_NULLS")
 ZEND_END_ARG_INFO()
@@ -1447,6 +1447,9 @@ static void php_odbc_fetch_hash(INTERNAL_FUNCTION_PARAMETERS, int result_type)
 				} else if (result->values[i].vallen == SQL_NULL_DATA) {
 					ZVAL_NULL(&tmp);
 					break;
+				} else if (result->values[i].vallen == SQL_NO_TOTAL) {
+					php_error_docref(NULL, E_WARNING, "Cannot get data of column #%d (driver cannot determine length)", i + 1);
+					ZVAL_FALSE(&tmp);
 				} else {
 					ZVAL_STRINGL(&tmp, buf, result->values[i].vallen);
 				}
@@ -1456,6 +1459,10 @@ static void php_odbc_fetch_hash(INTERNAL_FUNCTION_PARAMETERS, int result_type)
 				if (result->values[i].vallen == SQL_NULL_DATA) {
 					ZVAL_NULL(&tmp);
 					break;
+				} else if (result->values[i].vallen == SQL_NO_TOTAL) {
+					php_error_docref(NULL, E_WARNING, "Cannot get data of column #%d (driver cannot determine length)", i + 1);
+					ZVAL_FALSE(&tmp);
+					break;
 				}
 				ZVAL_STRINGL(&tmp, result->values[i].value, result->values[i].vallen);
 				break;
@@ -1600,6 +1607,9 @@ PHP_FUNCTION(odbc_fetch_into)
 				} else if (result->values[i].vallen == SQL_NULL_DATA) {
 					ZVAL_NULL(&tmp);
 					break;
+				} else if (result->values[i].vallen == SQL_NO_TOTAL) {
+					php_error_docref(NULL, E_WARNING, "Cannot get data of column #%d (driver cannot determine length)", i + 1);
+					ZVAL_FALSE(&tmp);
 				} else {
 					ZVAL_STRINGL(&tmp, buf, result->values[i].vallen);
 				}
@@ -1609,6 +1619,10 @@ PHP_FUNCTION(odbc_fetch_into)
 				if (result->values[i].vallen == SQL_NULL_DATA) {
 					ZVAL_NULL(&tmp);
 					break;
+				} else if (result->values[i].vallen == SQL_NO_TOTAL) {
+					php_error_docref(NULL, E_WARNING, "Cannot get data of column #%d (driver cannot determine length)", i + 1);
+					ZVAL_FALSE(&tmp);
+					break;
 				}
 				ZVAL_STRINGL(&tmp, result->values[i].value, result->values[i].vallen);
 				break;
@@ -1836,6 +1850,10 @@ PHP_FUNCTION(odbc_result)
 			} else if (result->values[field_ind].vallen == SQL_NULL_DATA) {
 				zend_string_efree(field_str);
 				RETURN_NULL();
+			} else if (result->values[field_ind].vallen == SQL_NO_TOTAL) {
+				zend_string_efree(field_str);
+				php_error_docref(NULL, E_WARNING, "Cannot get data of column #%d (driver cannot determine length)", field_ind + 1);
+				RETURN_FALSE;
 			}
 			/* Reduce fieldlen by 1 if we have char data. One day we might
 			   have binary strings... */
@@ -1859,6 +1877,9 @@ PHP_FUNCTION(odbc_result)
 		default:
 			if (result->values[field_ind].vallen == SQL_NULL_DATA) {
 				RETURN_NULL();
+			} else if (result->values[field_ind].vallen == SQL_NO_TOTAL) {
+				php_error_docref(NULL, E_WARNING, "Cannot get data of column #%d (driver cannot determine length)", field_ind + 1);
+				RETURN_FALSE;
 			} else {
 				RETURN_STRINGL(result->values[field_ind].value, result->values[field_ind].vallen);
 			}
@@ -1890,6 +1911,10 @@ PHP_FUNCTION(odbc_result)
 		if (result->values[field_ind].vallen == SQL_NULL_DATA) {
 			efree(field);
 			RETURN_NULL();
+		} else if (result->values[field_ind].vallen == SQL_NO_TOTAL) {
+			php_error_docref(NULL, E_WARNING, "Cannot get data of column #%d (driver cannot determine length)", field_ind + 1);
+			efree(field);
+			RETURN_FALSE;
 		}
 		/* chop the trailing \0 by outputting only 4095 bytes */
 		PHPWRITE(field,(rc == SQL_SUCCESS_WITH_INFO) ? 4095 : result->values[field_ind].vallen);
@@ -1994,7 +2019,14 @@ PHP_FUNCTION(odbc_result_all)
 						RETURN_FALSE;
 					}
 					if (rc == SQL_SUCCESS_WITH_INFO) {
-						PHPWRITE(buf, result->longreadlen);
+						if (result->values[i].vallen == SQL_NO_TOTAL) {
+							php_printf("</td></tr></table>");
+							php_error_docref(NULL, E_WARNING, "Cannot get data of column #%zu (driver cannot determine length)", i + 1);
+							efree(buf);
+							RETURN_FALSE;
+						} else {
+							PHPWRITE(buf, result->longreadlen);
+						}
 					} else if (rc != SQL_SUCCESS) {
 						php_printf("</td></tr></table>");
 						php_error_docref(NULL, E_WARNING, "Cannot get data of column #%zu (retcode %u)", i + 1, rc);
@@ -2011,6 +2043,9 @@ PHP_FUNCTION(odbc_result_all)
 				default:
 					if (result->values[i].vallen == SQL_NULL_DATA) {
 						php_printf("<td>NULL</td>");
+					} else if (result->values[i].vallen == SQL_NO_TOTAL) {
+						php_error_docref(NULL, E_WARNING, "Cannot get data of column #%zu (driver cannot determine length)", i + 1);
+						php_printf("<td>FALSE</td>");
 					} else {
 						php_printf("<td>%s</td>", result->values[i].value);
 					}
@@ -113,6 +113,41 @@ static uint32_t add_static_slot(HashTable     *hash,
 	return ret;
 }

+static zend_string *create_str_cache_key(zval *literal, uint32_t flags)
+{
+	ZEND_ASSERT(Z_TYPE_P(literal) == IS_STRING);
+	uint32_t num_related = LITERAL_NUM_RELATED(flags);
+	if (num_related == 1) {
+		return zend_string_copy(Z_STR_P(literal));
+	}
+	if ((flags & LITERAL_KIND_MASK) == LITERAL_VALUE) {
+		/* Don't merge LITERAL_VALUE that has related literals */
+		return NULL;
+	}
+
+	/* Concatenate all the related literals for the cache key. */
+	zend_string *key;
+	if (num_related == 2) {
+		ZEND_ASSERT(Z_TYPE_P(literal + 1) == IS_STRING);
+		key = zend_string_concat2(
+			Z_STRVAL_P(literal), Z_STRLEN_P(literal),
+			Z_STRVAL_P(literal + 1), Z_STRLEN_P(literal + 1));
+	} else if (num_related == 3) {
+		ZEND_ASSERT(Z_TYPE_P(literal + 1) == IS_STRING && Z_TYPE_P(literal + 2) == IS_STRING);
+		key = zend_string_concat3(
+			Z_STRVAL_P(literal), Z_STRLEN_P(literal),
+			Z_STRVAL_P(literal + 1), Z_STRLEN_P(literal + 1),
+			Z_STRVAL_P(literal + 2), Z_STRLEN_P(literal + 2));
+	} else {
+		ZEND_ASSERT(0 && "Currently not needed");
+	}
+
+	/* Add a bias to the hash so we can distinguish keys
+	 * that would otherwise be the same after concatenation. */
+	ZSTR_H(key) = zend_string_hash_val(key) + num_related - 1;
+	return key;
+}
+
 void zend_optimizer_compact_literals(zend_op_array *op_array, zend_optimizer_ctx *ctx)
 {
 	zend_op *opline, *end;
@@ -407,16 +442,7 @@ void zend_optimizer_compact_literals(zend_op_array *op_array, zend_optimizer_ctx
 					}
 					break;
 				case IS_STRING: {
-					if (LITERAL_NUM_RELATED(info[i].flags) == 1) {
-						key = zend_string_copy(Z_STR(op_array->literals[i]));
-					} else if ((info[i].flags & LITERAL_KIND_MASK) != LITERAL_VALUE) {
-						key = zend_string_init(Z_STRVAL(op_array->literals[i]), Z_STRLEN(op_array->literals[i]), 0);
-						ZSTR_H(key) = ZSTR_HASH(Z_STR(op_array->literals[i])) +
-							LITERAL_NUM_RELATED(info[i].flags) - 1;
-					} else {
-						/* Don't merge LITERAL_VALUE that has related literals */
-						key = NULL;
-					}
+					key = create_str_cache_key(&op_array->literals[i], info[i].flags);
 					if (key && (pos = zend_hash_find(&hash, key)) != NULL &&
 					    Z_TYPE(op_array->literals[Z_LVAL_P(pos)]) == IS_STRING &&
 					    LITERAL_NUM_RELATED(info[i].flags) == LITERAL_NUM_RELATED(info[Z_LVAL_P(pos)].flags) &&
@@ -373,6 +373,10 @@ static zend_bool try_remove_var_def(context *ctx, int free_var, int use_chain, z
 	return 0;
 }

+static zend_always_inline zend_bool may_be_refcounted(uint32_t type) {
+	return (type & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF)) != 0;
+}
+
 /* Returns whether the instruction has been DCEd */
 static zend_bool dce_instr(context *ctx, zend_op *opline, zend_ssa_op *ssa_op) {
 	zend_ssa *ssa = ctx->ssa;
@@ -384,17 +388,15 @@ static zend_bool dce_instr(context *ctx, zend_op *opline, zend_ssa_op *ssa_op) {
 	}

 	/* We mark FREEs as dead, but they're only really dead if the destroyed var is dead */
-	if (opline->opcode == ZEND_FREE
-			&& (ssa->var_info[ssa_op->op1_use].type & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))
+	if (opline->opcode == ZEND_FREE && may_be_refcounted(ssa->var_info[ssa_op->op1_use].type)
 			&& !is_var_dead(ctx, ssa_op->op1_use)) {
 		return 0;
 	}

 	if ((opline->op1_type & (IS_VAR|IS_TMP_VAR))&& !is_var_dead(ctx, ssa_op->op1_use)) {
 		if (!try_remove_var_def(ctx, ssa_op->op1_use, ssa_op->op1_use_chain, opline)) {
-			if (ssa->var_info[ssa_op->op1_use].type & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF)
-				&& opline->opcode != ZEND_CASE
-				&& opline->opcode != ZEND_CASE_STRICT) {
+			if (may_be_refcounted(ssa->var_info[ssa_op->op1_use].type)
+					&& opline->opcode != ZEND_CASE && opline->opcode != ZEND_CASE_STRICT) {
 				free_var = ssa_op->op1_use;
 				free_var_type = opline->op1_type;
 			}
@@ -402,7 +404,7 @@ static zend_bool dce_instr(context *ctx, zend_op *opline, zend_ssa_op *ssa_op) {
 	}
 	if ((opline->op2_type & (IS_VAR|IS_TMP_VAR)) && !is_var_dead(ctx, ssa_op->op2_use)) {
 		if (!try_remove_var_def(ctx, ssa_op->op2_use, ssa_op->op2_use_chain, opline)) {
-			if (ssa->var_info[ssa_op->op2_use].type & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF)) {
+			if (may_be_refcounted(ssa->var_info[ssa_op->op2_use].type)) {
 				if (free_var >= 0) {
 					// TODO: We can't free two vars. Keep instruction alive.
 					zend_bitset_excl(ctx->instr_dead, opline - ctx->op_array->opcodes);
@@ -509,6 +511,17 @@ int dce_optimize_op_array(zend_op_array *op_array, zend_ssa *ssa, zend_bool reor
 	ctx.phi_dead = alloca(sizeof(zend_ulong) * ctx.phi_worklist_len);
 	memset(ctx.phi_dead, 0xff, sizeof(zend_ulong) * ctx.phi_worklist_len);

+	/* Mark non-CV phis as live. Even if the result is unused, we generally cannot remove one
+	 * of the producing instructions, as it combines producing the result with control flow.
+	 * This can be made more precise if there are any cases where this is not the case. */
+	FOREACH_PHI(phi) {
+		if (phi->var >= op_array->last_var
+				&& may_be_refcounted(ssa->var_info[phi->ssa_var].type)) {
+			zend_bitset_excl(ctx.phi_dead, phi->ssa_var);
+			add_phi_sources_to_worklists(&ctx, phi, 0);
+		}
+	} FOREACH_PHI_END();
+
 	/* Mark reacable instruction without side effects as dead */
 	int b = ssa->cfg.blocks_count;
 	while (b > 0) {
@@ -1983,7 +1983,7 @@ static void sccp_mark_feasible_successors(
 				scdf_mark_edge_feasible(scdf, block_num, target);
 				return;
 			}
-			s = 0;
+			s = block->successors_count - 1;
 			break;
 		}
 		default:
@@ -212,7 +212,7 @@ static const func_info_t func_infos[] = {
 	F1("base64_decode",                MAY_BE_FALSE | MAY_BE_STRING),
 	F1("base64_encode",                MAY_BE_STRING),
 	F1("password_hash",                MAY_BE_STRING),
-	F1("password_get_info",            MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_STRING | MAY_BE_ARRAY_OF_LONG | MAY_BE_ARRAY_OF_STRING | MAY_BE_ARRAY_OF_ARRAY),
+	F1("password_get_info",            MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_STRING | MAY_BE_ARRAY_OF_NULL | MAY_BE_ARRAY_OF_LONG | MAY_BE_ARRAY_OF_STRING | MAY_BE_ARRAY_OF_ARRAY),
 	F1("convert_uuencode",             MAY_BE_STRING),
 	F1("convert_uudecode",             MAY_BE_FALSE | MAY_BE_STRING),
 	F1("pow",                          MAY_BE_LONG | MAY_BE_DOUBLE | MAY_BE_OBJECT),
@@ -382,7 +382,6 @@ static const func_info_t func_infos[] = {
 	F1("array_count_values",           MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_LONG),
 	F1("array_column",                 MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_REF | MAY_BE_ARRAY_OF_ANY),
 	F1("array_reverse",                MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_REF | MAY_BE_ARRAY_OF_ANY),
-	F1("array_reduce",                 UNKNOWN_INFO),
 	F1("array_flip",                   MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_LONG | MAY_BE_ARRAY_OF_STRING),
 	F1("array_change_key_case",        MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_REF | MAY_BE_ARRAY_OF_ANY),
 	FN("array_rand",                   MAY_BE_LONG | MAY_BE_STRING | MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_LONG | MAY_BE_ARRAY_OF_LONG | MAY_BE_ARRAY_OF_STRING),
@@ -404,8 +403,6 @@ static const func_info_t func_infos[] = {
 	F1("array_filter",                 MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_REF | MAY_BE_ARRAY_OF_ANY),
 	F1("array_chunk",                  MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_REF | MAY_BE_ARRAY_OF_ANY),
 	F1("array_combine",                MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_REF | MAY_BE_ARRAY_OF_ANY),
-	F1("pos",                          UNKNOWN_INFO),
-	F1("assert_options",               MAY_BE_NULL | MAY_BE_LONG | MAY_BE_STRING | MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_LONG | MAY_BE_ARRAY_OF_STRING | MAY_BE_ARRAY_OF_OBJECT | MAY_BE_OBJECT),
 	F1("str_rot13",                    MAY_BE_STRING),
 	F1("stream_get_filters",           MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_LONG | MAY_BE_ARRAY_OF_STRING),
 	F1("stream_bucket_make_writeable", MAY_BE_NULL | MAY_BE_OBJECT),
@@ -418,7 +415,7 @@ static const func_info_t func_infos[] = {
 	F1("strftime",                              MAY_BE_FALSE | MAY_BE_STRING),
 	F1("gmstrftime",                            MAY_BE_FALSE | MAY_BE_STRING),
 	F1("localtime",                             MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_LONG),
-	F1("getdate",                               MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_STRING | MAY_BE_ARRAY_OF_LONG | MAY_BE_ARRAY_OF_STRING),
+	F1("getdate",                               MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_LONG | MAY_BE_ARRAY_OF_STRING),
 	F1("date_create",                           MAY_BE_FALSE | MAY_BE_OBJECT),
 	F1("date_create_immutable",                 MAY_BE_FALSE | MAY_BE_OBJECT),
 	F1("date_create_from_format",               MAY_BE_FALSE | MAY_BE_OBJECT),
@@ -461,7 +458,7 @@ static const func_info_t func_infos[] = {
 	F1("mysqli_query",							MAY_BE_FALSE | MAY_BE_TRUE | MAY_BE_OBJECT),
 	F1("mysqli_get_charset", 					MAY_BE_NULL | MAY_BE_OBJECT),
 	F1("mysqli_fetch_array",					MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY),
-	F1("mysqli_fetch_assoc",					MAY_BE_NULL | MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_STRING | MAY_BE_ARRAY_OF_ANY),
+	F1("mysqli_fetch_assoc",					MAY_BE_NULL | MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY),
 	F1("mysqli_fetch_all",						MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY),
 	F1("mysqli_fetch_object",					MAY_BE_NULL | MAY_BE_OBJECT),
 	F1("mysqli_affected_rows",					MAY_BE_LONG | MAY_BE_STRING),
@@ -686,7 +683,7 @@ static const func_info_t func_infos[] = {
 	F1("session_encode",						MAY_BE_FALSE | MAY_BE_STRING),

 	/* ext/pgsql */
-	F1("pg_connect",							MAY_BE_FALSE | MAY_BE_RESOURCE),
+	FN("pg_connect",							MAY_BE_FALSE | MAY_BE_RESOURCE),
 	FN("pg_pconnect",							MAY_BE_FALSE | MAY_BE_RESOURCE),
 	F1("pg_dbname",								MAY_BE_STRING),
 	F1("pg_last_error",							MAY_BE_STRING),
@@ -707,7 +704,7 @@ static const func_info_t func_infos[] = {
 	F1("pg_field_type_oid",						MAY_BE_LONG | MAY_BE_STRING),
 	F1("pg_fetch_result",						MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_STRING),
 	F1("pg_fetch_row",							MAY_BE_FALSE | MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_LONG | MAY_BE_ARRAY_OF_NULL | MAY_BE_ARRAY_OF_STRING),
-	F1("pg_fetch_assoc",						MAY_BE_FALSE | MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_STRING | MAY_BE_ARRAY_OF_NULL | MAY_BE_ARRAY_OF_STRING),
+	F1("pg_fetch_assoc",						MAY_BE_FALSE | MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_NULL | MAY_BE_ARRAY_OF_STRING),
 	F1("pg_fetch_array",						MAY_BE_FALSE | MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_NULL | MAY_BE_ARRAY_OF_STRING),
 	F1("pg_fetch_object",						MAY_BE_FALSE | MAY_BE_OBJECT),
 	F1("pg_fetch_all",							MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_LONG | MAY_BE_ARRAY_OF_ARRAY),
@@ -755,7 +752,7 @@ static const func_info_t func_infos[] = {
 	FN("filter_input",							UNKNOWN_INFO),
 	FN("filter_var",							UNKNOWN_INFO),
 	F1("filter_input_array",					MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY),
-	F1("filter_var_array",						MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY),
+	F1("filter_var_array",						MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF),
 	F1("filter_list",							MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_LONG | MAY_BE_ARRAY_OF_STRING),

 	/* ext/gettext */
@@ -1941,6 +1941,18 @@ static void add_usages(const zend_op_array *op_array, zend_ssa *ssa, zend_bitset
 				if (op->op2_def >= 0) {
 					zend_bitset_incl(worklist, op->op2_def);
 				}
+			} else if (use + 1 < op_array->last
+			 && op_array->opcodes[use + 1].opcode == ZEND_OP_DATA) {
+				op++;
+				if (op->result_def >= 0) {
+					zend_bitset_incl(worklist, op->result_def);
+				}
+				if (op->op1_def >= 0) {
+					zend_bitset_incl(worklist, op->op1_def);
+				}
+				if (op->op2_def >= 0) {
+					zend_bitset_incl(worklist, op->op2_def);
+				}
 			}
 			use = zend_ssa_next_use(ssa->ops, var, use);
 		} while (use >= 0);
@@ -2316,10 +2328,6 @@ static uint32_t zend_fetch_prop_type(const zend_script *script, zend_property_in
 	}
 	if (prop_info && ZEND_TYPE_IS_SET(prop_info->type)) {
 		uint32_t type = zend_convert_type_declaration_mask(ZEND_TYPE_PURE_MASK(prop_info->type));
-
-		if (type & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) {
-			type |= MAY_BE_RC1 | MAY_BE_RCN;
-		}
 		if (ZEND_TYPE_HAS_CLASS(prop_info->type)) {
 			type |= MAY_BE_OBJECT;
 			if (pce) {
@@ -2332,6 +2340,9 @@ static uint32_t zend_fetch_prop_type(const zend_script *script, zend_property_in
 				}
 			}
 		}
+		if (type & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) {
+			type |= MAY_BE_RC1 | MAY_BE_RCN;
+		}
 		return type;
 	}
 	return MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF | MAY_BE_RC1 | MAY_BE_RCN;
@@ -285,6 +285,14 @@ static void place_essa_pis(
 			default:
 				continue;
 		}
+
+		/* The following patterns all inspect the opline directly before the JMPZ opcode.
+		 * Make sure that it is part of the same block, otherwise it might not be a dominating
+		 * assignment. */
+		if (blocks[j].len == 1) {
+			continue;
+		}
+
 		if (opline->op1_type == IS_TMP_VAR &&
 		    ((opline-1)->opcode == ZEND_IS_EQUAL ||
 		     (opline-1)->opcode == ZEND_IS_NOT_EQUAL ||