Set versions and date

* PHP-5.6:
  [ci skip] Update NEWS

.appveyor.yml

@@ -23,7 +23,7 @@ environment:
         PHP_BUILD_CACHE_BASE_DIR: c:\build-cache  
         PHP_BUILD_OBJ_DIR: c:\obj
         PHP_BUILD_CACHE_SDK_DIR: c:\build-cache\sdk
-        PHP_BUILD_SDK_BRANCH: php-sdk-2.0.12
+        PHP_BUILD_SDK_BRANCH: php-sdk-2.0.13
         # ext and env setup for tests
         #MYSQL_TEST_PASSWD: Password12!
         #MYSQL_TEST_USER: root

EXTENSIONS

@@ -47,7 +47,7 @@ MAINTENANCE:         Maintained
 STATUS:              Working
 -------------------------------------------------------------------------------
 EXTENSION:           fpm
-PRIMARY MAINTAINER:  Antony Dovgal <tony2001@php.net>, Jerome Loyet <fat@php.net>
+PRIMARY MAINTAINER:  Jakub Zelenka <bukka@php.net>
 MAINTENANCE:         Maintained
 STATUS:              Working
 SINCE:               5.3.3

NEWS

@@ -1,8 +1,47 @@
 PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
-?? ??? 2017 PHP 7.0.27
+01 Mar 2018 PHP 7.0.28
 
+- Standard:
+  . Fixed bug #75981 (stack-buffer-overflow while parsing HTTP response). (Stas)
 
+04 Jan 2018 PHP 7.0.27
+
+- CLI Server:
+  . Fixed bug #60471 (Random "Invalid request (unexpected EOF)" using a router
+    script). (SammyK)
+
+- Core:
+  . Fixed bug #75384 (PHP seems incompatible with OneDrive files on demand).
+    (Anatol)
+  . Fixed bug #75573 (Segmentation fault in 7.1.12 and 7.0.26). (Laruence)
+
+- FPM:
+  . Fixed bug #64938 (libxml_disable_entity_loader setting is shared between
+    requests). (Remi)
+
+- GD:
+  . Fixed bug #75571 (Potential infinite loop in gdImageCreateFromGifCtx). (cmb)
+
+- Opcache:
+  . Fixed bug #75579 (Interned strings buffer overflow may cause crash).
+    (Dmitry)
+
+- PCRE:
+  . Fixed bug #74183 (preg_last_error not returning error code after error).
+    (Andrew Nester)
+
+- Phar:
+  . Fixed bug #74782 (Reflected XSS in .phar 404 page). (Stas)
+
+- Standard:
+  . Fixed bug #75535 (Inappropriately parsing HTTP response leads to PHP
+    segment fault). (Nikita)
+  . Fixed bug #75409 (accept EFAULT in addition to ENOSYS as indicator 
+    that getrandom() is missing). (sarciszewski)
+
+- Zip:
+  . Fixed bug #75540 (Segfault with libzip 1.3.1). (Remi)
 
 23 Nov 2017 PHP 7.0.26
 

Zend/tests/bug75573.phpt

@@ -0,0 +1,64 @@
+--TEST--
+Bug #75573 (Segmentation fault in 7.1.12 and 7.0.26)
+--FILE--
+<?php
+
+class A
+{
+	var $_stdObject;
+	function initialize($properties = FALSE) {
+		$this->_stdObject = $properties ? (object) $properties : new stdClass();
+		parent::initialize();
+	}
+	function &__get($property)
+	{
+		if (isset($this->_stdObject->{$property})) {
+			$retval =& $this->_stdObject->{$property};
+			return $retval;
+		} else {
+			return NULL;
+		}
+	}
+	function &__set($property, $value)
+	{
+		return $this->_stdObject->{$property} = $value;
+	}
+	function __isset($property_name)
+	{
+		return isset($this->_stdObject->{$property_name});
+	}
+}
+
+class B extends A
+{
+	function initialize($properties = array())
+	{
+		parent::initialize($properties);
+	}
+	function &__get($property)
+	{
+		if (isset($this->settings) && isset($this->settings[$property])) {
+			$retval =& $this->settings[$property];
+			return $retval;
+		} else {
+			return parent::__get($property);
+		}
+	}
+}
+
+$b = new B();
+$b->settings = [ "foo" => "bar", "name" => "abc" ];
+var_dump($b->name);
+var_dump($b->settings);
+?>
+--EXPECTF--
+Warning: Creating default object from empty value in %sbug75573.php on line %d
+
+Notice: Only variable references should be returned by reference in %sbug75573.php on line %d
+string(3) "abc"
+array(2) {
+  ["foo"]=>
+  string(3) "bar"
+  ["name"]=>
+  string(3) "abc"
+}

Zend/zend_API.h

@@ -709,7 +709,7 @@ ZEND_API ZEND_COLD void ZEND_FASTCALL zend_wrong_callback_error(int severity, in
 		int _num_args = EX_NUM_ARGS(); \
 		int _i; \
 		zval *_real_arg, *_arg = NULL; \
-		zend_expected_type _expected_type = IS_UNDEF; \
+		zend_expected_type _expected_type = Z_EXPECTED_LONG; \
 		char *_error = NULL; \
 		zend_bool _dummy; \
 		zend_bool _optional = 0; \

Zend/zend_compile.c

@@ -5601,7 +5601,7 @@ void zend_compile_use(zend_ast *ast) /* {{{ */
 			zend_string *ns_name = zend_string_alloc(ZSTR_LEN(current_ns) + 1 + ZSTR_LEN(new_name), 0);
 			zend_str_tolower_copy(ZSTR_VAL(ns_name), ZSTR_VAL(current_ns), ZSTR_LEN(current_ns));
 			ZSTR_VAL(ns_name)[ZSTR_LEN(current_ns)] = '\\';
-			memcpy(ZSTR_VAL(ns_name) + ZSTR_LEN(current_ns) + 1, ZSTR_VAL(lookup_name), ZSTR_LEN(lookup_name));
+			memcpy(ZSTR_VAL(ns_name) + ZSTR_LEN(current_ns) + 1, ZSTR_VAL(lookup_name), ZSTR_LEN(lookup_name) + 1);
 
 			zend_check_use_conflict(type, old_name, new_name, ns_name);
 

Zend/zend_multiply.h

@@ -53,8 +53,8 @@
 	__asm__("mul %0, %2, %3\n"										\
 		"smulh %1, %2, %3\n"										\
 		"sub %1, %1, %0, asr #63\n"									\
-			: "=X"(__tmpvar), "=X"(usedval)							\
-			: "X"(a), "X"(b));										\
+			: "=&r"(__tmpvar), "=&r"(usedval)						\
+			: "r"(a), "r"(b));										\
 	if (usedval) (dval) = (double) (a) * (double) (b);				\
 	else (lval) = __tmpvar;											\
 } while (0)

Zend/zend_object_handlers.c

@@ -602,8 +602,8 @@ zval *zend_std_read_property(zval *object, zval *member, int type, void **cache_
 			zval_ptr_dtor(&tmp_object);
 			goto exit;
 		} else {
-			zval_ptr_dtor(&tmp_object);
 			if (Z_STRVAL_P(member)[0] == '\0') {
+				zval_ptr_dtor(&tmp_object);
 				if (Z_STRLEN_P(member) == 0) {
 					zend_throw_error(NULL, "Cannot access empty property");
 					retval = &EG(uninitialized_zval);

Zend/zend_virtual_cwd.c

@@ -45,6 +45,19 @@
 #  define IO_REPARSE_TAG_DEDUP   0x80000013
 # endif
 
+# ifndef IO_REPARSE_TAG_CLOUD
+#  define IO_REPARSE_TAG_CLOUD    (0x9000001AL)
+# endif
+/* IO_REPARSE_TAG_CLOUD_1 through IO_REPARSE_TAG_CLOUD_F have values of 0x9000101AL
+   to 0x9000F01AL, they can be checked against the mask. */
+#ifndef IO_REPARSE_TAG_CLOUD_MASK
+#define IO_REPARSE_TAG_CLOUD_MASK (0x0000F000L)
+#endif
+
+#ifndef IO_REPARSE_TAG_ONEDRIVE
+#define IO_REPARSE_TAG_ONEDRIVE   (0x80000021L)
+#endif
+
 # ifndef VOLUME_NAME_NT
 #  define VOLUME_NAME_NT 0x2
 # endif
@@ -908,7 +921,7 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 				return -1;
 			}
 
-			hLink = CreateFile(path, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_FLAG_OPEN_REPARSE_POINT|FILE_FLAG_BACKUP_SEMANTICS, NULL);
+			hLink = CreateFile(path, 0, 0, NULL, OPEN_EXISTING, FILE_FLAG_OPEN_REPARSE_POINT|FILE_FLAG_BACKUP_SEMANTICS, NULL);
 			if(hLink == INVALID_HANDLE_VALUE) {
 				return -1;
 			}
@@ -977,7 +990,11 @@ static int tsrm_realpath_r(char *path, int start, int len, int *ll, time_t *t, i
 				};
 				substitutename[substitutename_len] = 0;
 			}
-			else if (pbuffer->ReparseTag == IO_REPARSE_TAG_DEDUP) {
+			else if (pbuffer->ReparseTag == IO_REPARSE_TAG_DEDUP ||
+					/* Starting with 1709. */
+					(pbuffer->ReparseTag & IO_REPARSE_TAG_CLOUD_MASK) != 0 && 0x90001018L != pbuffer->ReparseTag ||
+					IO_REPARSE_TAG_CLOUD == pbuffer->ReparseTag ||
+					IO_REPARSE_TAG_ONEDRIVE == pbuffer->ReparseTag) {
 				isabsolute = 1;
 				memcpy(substitutename, path, len + 1);
 				substitutename_len = len;

configure.in

@@ -119,8 +119,8 @@ int zend_sprintf(char *buffer, const char *format, ...);
 
 PHP_MAJOR_VERSION=7
 PHP_MINOR_VERSION=0
-PHP_RELEASE_VERSION=27
-PHP_EXTRA_VERSION="-dev"
+PHP_RELEASE_VERSION=28
+PHP_EXTRA_VERSION=""
 PHP_VERSION="$PHP_MAJOR_VERSION.$PHP_MINOR_VERSION.$PHP_RELEASE_VERSION$PHP_EXTRA_VERSION"
 PHP_VERSION_ID=`expr [$]PHP_MAJOR_VERSION \* 10000 + [$]PHP_MINOR_VERSION \* 100 + [$]PHP_RELEASE_VERSION`
 

ext/date/tests/010.phpt

@@ -8,17 +8,8 @@ date_default_timezone_set('UTC');
   echo "Done\n";
 ?>
 --EXPECTF--
-array(6) {
+array(5) {
   [0]=>
-  array(3) {
-    ["dst"]=>
-    bool(false)
-    ["offset"]=>
-    int(0)
-    ["timezone_id"]=>
-    string(16) "Antarctica/Troll"
-  }
-  [1]=>
   array(3) {
     ["dst"]=>
     bool(false)
@@ -27,7 +18,7 @@ array(6) {
     ["timezone_id"]=>
     string(13) "Etc/Universal"
   }
-  [2]=>
+  [1]=>
   array(3) {
     ["dst"]=>
     bool(false)
@@ -36,7 +27,7 @@ array(6) {
     ["timezone_id"]=>
     string(7) "Etc/UTC"
   }
-  [3]=>
+  [2]=>
   array(3) {
     ["dst"]=>
     bool(false)
@@ -45,6 +36,15 @@ array(6) {
     ["timezone_id"]=>
     string(8) "Etc/Zulu"
   }
+  [3]=>
+  array(3) {
+    ["dst"]=>
+    bool(false)
+    ["offset"]=>
+    int(0)
+    ["timezone_id"]=>
+    string(3) "UTC"
+  }
   [4]=>
   array(3) {
     ["dst"]=>
@@ -54,14 +54,5 @@ array(6) {
     ["timezone_id"]=>
     string(3) "UTC"
   }
-  [5]=>
-  array(3) {
-    ["dst"]=>
-    bool(false)
-    ["offset"]=>
-    int(0)
-    ["timezone_id"]=>
-    string(3) "UTC"
-  }
 }
 Done

ext/date/tests/DateTimeZone_getLocation.phpt

@@ -1,6 +1,5 @@
 --TEST--
-DateTimeZone::getLocation -- timezone_location_get — Returns location information for a timezone
-public array DateTimeZone::getLocation ( void ) ;
+DateTimeZone::getLocation -- timezone_location_get — Returns location information for a timezone public array DateTimeZone::getLocation ( void ) ;
 --CREDITS--
 marcosptf - <marcosptf@yahoo.com.br> - #phparty7 - @phpsp - novatec/2015 - sao paulo - br
 --SKIPIF--
@@ -53,30 +52,9 @@ Array
     [comments] => %s
 )
 Array
-(
-    [country_code] => %s
-    [latitude] => %f
-    [longitude] => %f
-    [comments] => 
-)
-Array
 (
     [country_code] => %s
     [latitude] => %f
     [longitude] => %f
     [comments] => %s
 )
-Array
-(
-    [country_code] => %s
-    [latitude] => %f
-    [longitude] => %f
-    [comments] => %s
-)
-Array
-(
-    [country_code] => %s
-    [latitude] => %f
-    [longitude] => %f
-    [comments] => 
-)

ext/date/tests/DateTimeZone_listAbbreviations_basic1.phpt

@@ -29,15 +29,15 @@ string(5) "array"
 int(%d)
 
 -- Format a sample entry --
-array(11) {
+array(12) {
   [0]=>
   array(3) {
     ["dst"]=>
-    bool(true)
+    bool(false)
     ["offset"]=>
-    int(-14400)
+    int(32400)
     ["timezone_id"]=>
-    string(18) "America/Porto_Acre"
+    string(18) "Australia/Adelaide"
   }
   [1]=>
   array(3) {
@@ -51,47 +51,47 @@ array(11) {
   [2]=>
   array(3) {
     ["dst"]=>
-    bool(true)
+    bool(false)
     ["offset"]=>
-    int(-14400)
+    int(32400)
     ["timezone_id"]=>
-    string(16) "America/Eirunepe"
+    string(21) "Australia/Broken_Hill"
   }
   [3]=>
   array(3) {
     ["dst"]=>
-    bool(true)
+    bool(false)
     ["offset"]=>
-    int(-14400)
+    int(32400)
     ["timezone_id"]=>
-    string(18) "America/Rio_Branco"
+    string(16) "Australia/Darwin"
   }
   [4]=>
   array(3) {
     ["dst"]=>
-    bool(true)
+    bool(false)
     ["offset"]=>
-    int(-14400)
+    int(32400)
     ["timezone_id"]=>
-    string(11) "Brazil/Acre"
+    string(15) "Australia/North"
   }
   [5]=>
   array(3) {
     ["dst"]=>
     bool(false)
     ["offset"]=>
-    int(34200)
+    int(32400)
     ["timezone_id"]=>
-    string(13) "Asia/Jayapura"
+    string(15) "Australia/South"
   }
   [6]=>
   array(3) {
     ["dst"]=>
     bool(false)
     ["offset"]=>
-    int(34200)
+    int(32400)
     ["timezone_id"]=>
-    string(21) "Australia/Broken_Hill"
+    string(20) "Australia/Yancowinna"
   }
   [7]=>
   array(3) {
@@ -100,7 +100,7 @@ array(11) {
     ["offset"]=>
     int(34200)
     ["timezone_id"]=>
-    string(16) "Australia/Darwin"
+    string(21) "Australia/Broken_Hill"
   }
   [8]=>
   array(3) {
@@ -109,7 +109,7 @@ array(11) {
     ["offset"]=>
     int(34200)
     ["timezone_id"]=>
-    string(15) "Australia/North"
+    string(16) "Australia/Darwin"
   }
   [9]=>
   array(3) {
@@ -118,9 +118,18 @@ array(11) {
     ["offset"]=>
     int(34200)
     ["timezone_id"]=>
-    string(15) "Australia/South"
+    string(15) "Australia/North"
   }
   [10]=>
+  array(3) {
+    ["dst"]=>
+    bool(false)
+    ["offset"]=>
+    int(34200)
+    ["timezone_id"]=>
+    string(15) "Australia/South"
+  }
+  [11]=>
   array(3) {
     ["dst"]=>
     bool(false)

ext/date/tests/bug45081.phpt

@@ -5,7 +5,7 @@ date.timezone=Asia/Singapore
 --FILE--
 <?php
 
-print strtotime('2008-05-23 00:00:00 SGT');
+print strtotime('2008-05-23 00:00:00 +08');
 print "\n";
 print strtotime('2008-05-23 00:00:00');
 

ext/date/tests/timezone_abbreviations_list_basic1.phpt

@@ -26,18 +26,18 @@ var_dump( $abbr["acst"] );
 --EXPECTF--
 *** Testing timezone_abbreviations_list() : basic functionality ***
 string(5) "array"
-int(%d)
+int(142)
 
 -- Format a sample entry --
-array(11) {
+array(12) {
   [0]=>
   array(3) {
     ["dst"]=>
-    bool(true)
+    bool(false)
     ["offset"]=>
-    int(-14400)
+    int(32400)
     ["timezone_id"]=>
-    string(18) "America/Porto_Acre"
+    string(18) "Australia/Adelaide"
   }
   [1]=>
   array(3) {
@@ -51,47 +51,47 @@ array(11) {
   [2]=>
   array(3) {
     ["dst"]=>
-    bool(true)
+    bool(false)
     ["offset"]=>
-    int(-14400)
+    int(32400)
     ["timezone_id"]=>
-    string(16) "America/Eirunepe"
+    string(21) "Australia/Broken_Hill"
   }
   [3]=>
   array(3) {
     ["dst"]=>
-    bool(true)
+    bool(false)
     ["offset"]=>
-    int(-14400)
+    int(32400)
     ["timezone_id"]=>
-    string(18) "America/Rio_Branco"
+    string(16) "Australia/Darwin"
   }
   [4]=>
   array(3) {
     ["dst"]=>
-    bool(true)
+    bool(false)
     ["offset"]=>
-    int(-14400)
+    int(32400)
     ["timezone_id"]=>
-    string(11) "Brazil/Acre"
+    string(15) "Australia/North"
   }
   [5]=>
   array(3) {
     ["dst"]=>
     bool(false)
     ["offset"]=>
-    int(34200)
+    int(32400)
     ["timezone_id"]=>
-    string(13) "Asia/Jayapura"
+    string(15) "Australia/South"
   }
   [6]=>
   array(3) {
     ["dst"]=>
     bool(false)
     ["offset"]=>
-    int(34200)
+    int(32400)
     ["timezone_id"]=>
-    string(21) "Australia/Broken_Hill"
+    string(20) "Australia/Yancowinna"
   }
   [7]=>
   array(3) {
@@ -100,7 +100,7 @@ array(11) {
     ["offset"]=>
     int(34200)
     ["timezone_id"]=>
-    string(16) "Australia/Darwin"
+    string(21) "Australia/Broken_Hill"
   }
   [8]=>
   array(3) {
@@ -109,7 +109,7 @@ array(11) {
     ["offset"]=>
     int(34200)
     ["timezone_id"]=>
-    string(15) "Australia/North"
+    string(16) "Australia/Darwin"
   }
   [9]=>
   array(3) {
@@ -118,9 +118,18 @@ array(11) {
     ["offset"]=>
     int(34200)
     ["timezone_id"]=>
-    string(15) "Australia/South"
+    string(15) "Australia/North"
   }
   [10]=>
+  array(3) {
+    ["dst"]=>
+    bool(false)
+    ["offset"]=>
+    int(34200)
+    ["timezone_id"]=>
+    string(15) "Australia/South"
+  }
+  [11]=>
   array(3) {
     ["dst"]=>
     bool(false)

ext/date/tests/timezone_name_from_abbr_basic1.phpt

@@ -24,11 +24,6 @@ var_dump( timezone_name_from_abbr("EDT") );
 echo "-- Lookup with name and offset--\n"; 
 var_dump( timezone_name_from_abbr("ADT", -10800) );
 var_dump( timezone_name_from_abbr("ADT", 14400) );
-var_dump( timezone_name_from_abbr("AKTT", 14400) );
-var_dump( timezone_name_from_abbr("aktt", 18000) );
-var_dump( timezone_name_from_abbr("Aktt", 21600) );
-var_dump( timezone_name_from_abbr("AMST", -10800) );
-var_dump( timezone_name_from_abbr("amst", 180000) );
 
 echo "-- Tests without valid name - uses gmtOffset and isdst to find match --\n"; 
 var_dump( timezone_name_from_abbr("", 3600, 1) );
@@ -51,12 +46,7 @@ string(13) "Europe/Berlin"
 string(16) "America/New_York"
 -- Lookup with name and offset--
 string(15) "America/Halifax"
-string(12) "Asia/Baghdad"
-string(11) "Asia/Aqtobe"
-string(11) "Asia/Aqtobe"
-string(11) "Asia/Aqtobe"
-string(17) "America/Boa_Vista"
-string(12) "Asia/Yerevan"
+string(15) "America/Halifax"
 -- Tests without valid name - uses gmtOffset and isdst to find match --
 string(13) "Europe/London"
 string(17) "America/Sao_Paulo"
@@ -65,4 +55,4 @@ string(15) "America/Halifax"
 -- Tests with invalid offsets --
 bool(false)
 bool(false)
-===DONE===
+===DONE===

ext/gd/libgd/gd_gif_in.c

@@ -261,10 +261,6 @@ terminated:
 	if (!im) {
 		return 0;
 	}
-	if (!im->colorsTotal) {
-		gdImageDestroy(im);
-		return 0;
-	}
 	/* Check for open colors at the end, so
 	   we can reduce colorsTotal and ultimately
 	   BitsPerPixel */
@@ -275,6 +271,10 @@ terminated:
 			break;
 		}
 	}
+	if (!im->colorsTotal) {
+		gdImageDestroy(im);
+		return 0;
+	}
 	return im;
 }
 /* }}} */
@@ -375,7 +375,7 @@ static int
 GetCode_(gdIOCtx *fd, CODE_STATIC_DATA *scd, int code_size, int flag, int *ZeroDataBlockP)
 {
 	int           i, j, ret;
-	unsigned char count;
+	int           count;
 
 	if (flag) {
 		scd->curbit = 0;

ext/gd/libgd/gd_interpolation.c

@@ -66,6 +66,16 @@ TODO:
 # include <emmintrin.h>
 #endif
 
+#ifndef HAVE_FLOORF
+# define HAVE_FLOORF 0
+#endif
+#if HAVE_FLOORF == 0
+# ifndef floorf
+/* float floorf(float x);*/
+#  define floorf(x) ((float)(floor(x)))
+# endif
+#endif
+
 #ifndef MIN
 #define MIN(a,b) ((a)<(b)?(a):(b))
 #endif

ext/gd/tests/bug75571.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Bug #75571 (Infinite loop in GIF reading causing DoS)
+--SKIPIF--
+<?php
+if (!extension_loaded('gd')) die('skip gd extension not available');
+?>
+--FILE--
+<?php
+var_dump(imagecreatefromgif(__DIR__ . '/bug75571.gif'));
+?>
+===DONE===
+--EXPECTF--
+Warning: imagecreatefromgif(): '%s' is not a valid GIF file in %s on line %d
+bool(false)
+===DONE===

ext/libxml/libxml.c

@@ -848,7 +848,6 @@ static PHP_MINIT_FUNCTION(libxml)
 	if (sapi_module.name) {
 		static const char * const supported_sapis[] = {
 			"cgi-fcgi",
-			"fpm-fcgi",
 			"litespeed",
 			NULL
 		};

ext/opcache/zend_file_cache.c

@@ -227,8 +227,17 @@ static void *zend_file_cache_unserialize_interned(zend_string *str, int in_shm)
 	if (in_shm) {
 		ret = accel_new_interned_string(str);
 		if (ret == str) {
+			/* We have to create new SHM allocated string */
+			size_t size = _ZSTR_STRUCT_SIZE(ZSTR_LEN(str));
+			ret = zend_shared_alloc(size);
+			if (!ret) {
+				zend_accel_schedule_restart_if_necessary(ACCEL_RESTART_OOM);
+				LONGJMP(*EG(bailout), FAILURE);
+			}
+			memcpy(ret, str, size);
 			/* String wasn't interned but we will use it as interned anyway */
-			GC_FLAGS(ret) |= IS_STR_INTERNED | IS_STR_PERMANENT;
+			GC_REFCOUNT(ret) = 1;
+			GC_TYPE_INFO(ret) = IS_STRING | ((IS_STR_INTERNED | IS_STR_PERSISTENT | IS_STR_PERMANENT) << 8);
 		}
 	} else {
 		ret = str;
@@ -1251,6 +1260,7 @@ zend_persistent_script *zend_file_cache_script_load(zend_file_handle *file_handl
 	zend_accel_hash_entry *bucket;
 	void *mem, *checkpoint, *buf;
 	int cache_it = 1;
+	int ok;
 
 	if (!full_path) {
 		return NULL;
@@ -1343,6 +1353,7 @@ zend_persistent_script *zend_file_cache_script_load(zend_file_handle *file_handl
 
 	if (!ZCG(accel_directives).file_cache_only &&
 	    !ZCSG(restart_in_progress) &&
+		!ZSMMG(memory_exhausted) &&
 	    accelerator_shm_read_lock() == SUCCESS) {
 		/* exclusive lock */
 		zend_shared_alloc_lock();
@@ -1392,7 +1403,24 @@ use_process_mem:
 	ZCG(mem) = ((char*)mem + info.mem_size);
 	script = (zend_persistent_script*)((char*)buf + info.script_offset);
 	script->corrupted = !cache_it; /* used to check if script restored to SHM or process memory */
-	zend_file_cache_unserialize(script, buf);
+
+	ok = 1;
+	zend_try {
+		zend_file_cache_unserialize(script, buf);
+	} zend_catch {
+		ok = 0;
+	} zend_end_try();
+	if (!ok) {
+		if (cache_it) {
+			zend_shared_alloc_unlock();
+			goto use_process_mem;
+		} else {
+			zend_arena_release(&CG(arena), checkpoint);
+			efree(filename);
+			return NULL;
+		}
+	}
+
 	script->corrupted = 0;
 
 	if (cache_it) {

ext/pcre/php_pcre.c

@@ -356,6 +356,7 @@ PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(zend_string *regex)
 #endif
 		php_error_docref(NULL, E_WARNING,
 						 p < ZSTR_VAL(regex) + ZSTR_LEN(regex) ? "Null byte in regex" : "Empty regular expression");
+		pcre_handle_exec_error(PCRE_ERROR_INTERNAL);
 		return NULL;
 	}
 
@@ -369,6 +370,7 @@ PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(zend_string *regex)
 		}
 #endif
 		php_error_docref(NULL,E_WARNING, "Delimiter must not be alphanumeric or backslash");
+		pcre_handle_exec_error(PCRE_ERROR_INTERNAL);
 		return NULL;
 	}
 
@@ -419,6 +421,7 @@ PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(zend_string *regex)
 		} else {
 			php_error_docref(NULL,E_WARNING, "No ending matching delimiter '%c' found", delimiter);
 		}
+		pcre_handle_exec_error(PCRE_ERROR_INTERNAL);
 		return NULL;
 	}
 
@@ -467,6 +470,7 @@ PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(zend_string *regex)
 				} else {
 					php_error_docref(NULL,E_WARNING, "Null byte in regex");
 				}
+				pcre_handle_exec_error(PCRE_ERROR_INTERNAL);
 				efree(pattern);
 #if HAVE_SETLOCALE
 				if (key != regex) {
@@ -497,6 +501,7 @@ PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(zend_string *regex)
 		}
 #endif
 		php_error_docref(NULL,E_WARNING, "Compilation failed: %s at offset %d", error, erroffset);
+		pcre_handle_exec_error(PCRE_ERROR_INTERNAL);
 		efree(pattern);
 		if (tables) {
 			pefree((void*)tables, 1);
@@ -528,6 +533,7 @@ PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(zend_string *regex)
 		}
 		if (error != NULL) {
 			php_error_docref(NULL, E_WARNING, "Error while studying pattern");
+			pcre_handle_exec_error(PCRE_ERROR_INTERNAL);
 		}
 	} else {
 		extra = NULL;
@@ -564,6 +570,7 @@ PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(zend_string *regex)
 		}
 #endif
 		php_error_docref(NULL, E_WARNING, "Internal pcre_fullinfo() error %d", rc);
+		pcre_handle_exec_error(PCRE_ERROR_INTERNAL);
 		return NULL;
 	}
 
@@ -575,6 +582,7 @@ PHPAPI pcre_cache_entry* pcre_get_compiled_regex_cache(zend_string *regex)
 		}
 #endif
 		php_error_docref(NULL, E_WARNING, "Internal pcre_fullinfo() error %d", rc);
+		pcre_handle_exec_error(PCRE_ERROR_INTERNAL);
 		return NULL;
 	}
 

ext/pcre/tests/bug74183.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Bug #74183 - preg_last_error not returning error code after error
+--FILE--
+<?php
+
+$sRegex = "/([A-Z]|[a-z]|[0-9]| |Ñ|ñ|!|&quot;|%|&amp;|'|´|-|:|;|>|=|&lt;|@|_|,|\{|\}|`|~|á|é|í|ó|ú|Á|É|Í|Ó|Ú|ü|Ü){1,300}/";
+$sTest = "Hello world";
+
+var_dump(preg_match($sRegex, $sTest));
+var_dump(preg_last_error() === \PREG_INTERNAL_ERROR);
+?>
+--EXPECTF--
+Warning: preg_match(): Compilation failed: regular expression is too large at offset %s in %s on line %s
+bool(false)
+bool(true)

ext/pcre/tests/bug75539.phpt

@@ -0,0 +1,13 @@
+--TEST--
+Bug #75539 - Recursive call errors are not reported by preg_last_error()
+--FILE--
+<?php
+
+var_dump(preg_match('/((?1)?z)/', ''));
+var_dump(preg_last_error() === \PREG_INTERNAL_ERROR);
+
+?>
+--EXPECTF--
+Warning: preg_match(): Compilation failed: recursive call could loop indefinitely at offset %s in %s on line %s
+bool(false)
+bool(true)

ext/phar/shortarc.php

@@ -74,7 +74,7 @@ if (@(isset($_SERVER['REQUEST_URI']) && isset($_SERVER['REQUEST_METHOD']) && ($_
     $a = realpath(Extract_Phar::$temp . DIRECTORY_SEPARATOR . $pt);
     if (!$a || strlen(dirname($a)) < strlen(Extract_Phar::$temp)) {
         header('HTTP/1.0 404 Not Found');
-        echo "<html>\n <head>\n  <title>File Not Found<title>\n </head>\n <body>\n  <h1>404 - File ", $pt, " Not Found</h1>\n </body>\n</html>";
+        echo "<html>\n <head>\n  <title>File Not Found<title>\n </head>\n <body>\n  <h1>404 - File Not Found</h1>\n </body>\n</html>";
         exit;
     }
     $b = pathinfo($a);

ext/phar/stub.h

@@ -22,13 +22,13 @@ static inline zend_string* phar_get_stub(const char *index_php, const char *web,
 {
 	static const char newstub0[] = "<?php\n\n$web = '";
 	static const char newstub1_0[] = "';\n\nif (in_array('phar', stream_get_wrappers()) && class_exists('Phar', 0)) {\nPhar::interceptFileFuncs();\nset_include_path('phar://' . __FILE__ . PATH_SEPARATOR . get_include_path());\nPhar::webPhar(null, $web);\ninclude 'phar://' . __FILE__ . '/' . Extract_Phar::START;\nreturn;\n}\n\nif (@(isset($_SERVER['REQUEST_URI']) && isset($_SERVER['REQUEST_METHOD']) && ($_SERVER['REQUEST_METHOD'] == 'GET' || $_SERVER['REQUEST_METHOD'] == 'POST'))) {\nExtract_Phar::go(true);\n$mimes = array(\n'phps' => 2,\n'c' => 'text/plain',\n'cc' => 'text/plain',\n'cpp' => 'text/plain',\n'c++' => 'text/plain',\n'dtd' => 'text/plain',\n'h' => 'text/plain',\n'log' => 'text/plain',\n'rng' => 'text/plain',\n'txt' => 'text/plain',\n'xsd' => 'text/plain',\n'php' => 1,\n'inc' => 1,\n'avi' => 'video/avi',\n'bmp' => 'image/bmp',\n'css' => 'text/css',\n'gif' => 'image/gif',\n'htm' => 'text/html',\n'html' => 'text/html',\n'htmls' => 'text/html',\n'ico' => 'image/x-ico',\n'jpe' => 'image/jpeg',\n'jpg' => 'image/jpeg',\n'jpeg' => 'image/jpeg',\n'js' => 'application/x-javascript',\n'midi' => 'audio/midi',\n'mid' => 'audio/midi',\n'mod' => 'audio/mod',\n'mov' => 'movie/quicktime',\n'mp3' => 'audio/mp3',\n'mpg' => 'video/mpeg',\n'mpeg' => 'video/mpeg',\n'pdf' => 'application/pdf',\n'png' => 'image/png',\n'swf' => 'application/shockwave-flash',\n'tif' => 'image/tiff',\n'tiff' => 'image/tiff',\n'wav' => 'audio/wav',\n'xbm' => 'image/xbm',\n'xml' => 'text/xml',\n);\n\nheader(\"Cache-Control: no-cache, must-revalidate\");\nheader(\"Pragma: no-cache\");\n\n$basename = basename(__FILE__);\nif (!strpos($_SERVER['REQUEST_URI'], $basename)) {\nchdir(Extract_Phar::$temp);\ninclude $web;\nreturn;\n}\n$pt = substr($_SERVER['REQUEST_URI'], strpos($_SERVER['REQUEST_URI'], $basename) + strlen($basename));\nif (!$pt || $pt == '/') {\n$pt = $web;\nheader('HTTP/1.1 301 Moved Permanently');\nheader('Location: ' . $_SERVER['REQUEST_URI'] . '/' . $pt);\nexit;\n}\n$a = realpath(Extract_Phar::$temp . DIRECTORY_SEPARATOR . $pt);\nif (!$a || strlen(dirname($a)) < strlen(";
-	static const char newstub1_1[] = "Extract_Phar::$temp)) {\nheader('HTTP/1.0 404 Not Found');\necho \"<html>\\n <head>\\n  <title>File Not Found<title>\\n </head>\\n <body>\\n  <h1>404 - File \", $pt, \" Not Found</h1>\\n </body>\\n</html>\";\nexit;\n}\n$b = pathinfo($a);\nif (!isset($b['extension'])) {\nheader('Content-Type: text/plain');\nheader('Content-Length: ' . filesize($a));\nreadfile($a);\nexit;\n}\nif (isset($mimes[$b['extension']])) {\nif ($mimes[$b['extension']] === 1) {\ninclude $a;\nexit;\n}\nif ($mimes[$b['extension']] === 2) {\nhighlight_file($a);\nexit;\n}\nheader('Content-Type: ' .$mimes[$b['extension']]);\nheader('Content-Length: ' . filesize($a));\nreadfile($a);\nexit;\n}\n}\n\nclass Extract_Phar\n{\nstatic $temp;\nstatic $origdir;\nconst GZ = 0x1000;\nconst BZ2 = 0x2000;\nconst MASK = 0x3000;\nconst START = '";
+	static const char newstub1_1[] = "Extract_Phar::$temp)) {\nheader('HTTP/1.0 404 Not Found');\necho \"<html>\\n <head>\\n  <title>File Not Found<title>\\n </head>\\n <body>\\n  <h1>404 - File Not Found</h1>\\n </body>\\n</html>\";\nexit;\n}\n$b = pathinfo($a);\nif (!isset($b['extension'])) {\nheader('Content-Type: text/plain');\nheader('Content-Length: ' . filesize($a));\nreadfile($a);\nexit;\n}\nif (isset($mimes[$b['extension']])) {\nif ($mimes[$b['extension']] === 1) {\ninclude $a;\nexit;\n}\nif ($mimes[$b['extension']] === 2) {\nhighlight_file($a);\nexit;\n}\nheader('Content-Type: ' .$mimes[$b['extension']]);\nheader('Content-Length: ' . filesize($a));\nreadfile($a);\nexit;\n}\n}\n\nclass Extract_Phar\n{\nstatic $temp;\nstatic $origdir;\nconst GZ = 0x1000;\nconst BZ2 = 0x2000;\nconst MASK = 0x3000;\nconst START = '";
 	static const char newstub2[] = "';\nconst LEN = ";
 	static const char newstub3_0[] = ";\n\nstatic function go($return = false)\n{\n$fp = fopen(__FILE__, 'rb');\nfseek($fp, self::LEN);\n$L = unpack('V', $a = (binary)fread($fp, 4));\n$m = (binary)'';\n\ndo {\n$read = 8192;\nif ($L[1] - strlen($m) < 8192) {\n$read = $L[1] - strlen($m);\n}\n$last = (binary)fread($fp, $read);\n$m .= $last;\n} while (strlen($last) && strlen($m) < $L[1]);\n\nif (strlen($m) < $L[1]) {\ndie('ERROR: manifest length read was \"' .\nstrlen($m) .'\" should be \"' .\n$L[1] . '\"');\n}\n\n$info = self::_unpack($m);\n$f = $info['c'];\n\nif ($f & self::GZ) {\nif (!function_exists('gzinflate')) {\ndie('Error: zlib extension is not enabled -' .\n' gzinflate() function needed for zlib-compressed .phars');\n}\n}\n\nif ($f & self::BZ2) {\nif (!function_exists('bzdecompress')) {\ndie('Error: bzip2 extension is not enabled -' .\n' bzdecompress() function needed for bz2-compressed .phars');\n}\n}\n\n$temp = self::tmpdir();\n\nif (!$temp || !is_writable($temp)) {\n$sessionpath = session_save_path();\nif (strpos ($sessionpath, \";\") !== false)\n$sessionpath = substr ($sessionpath, strpos ($sessionpath, \";\")+1);\nif (!file_exists($sessionpath) || !is_dir($sessionpath)) {\ndie('Could not locate temporary directory to extract phar');\n}\n$temp = $sessionpath;\n}\n\n$temp .= '/pharextract/'.basename(__FILE__, '.phar');\nself::$temp = $temp;\nself::$origdir = getcwd();\n@mkdir($temp, 0777, true);\n$temp = realpath($temp);\n\nif (!file_exists($temp . DIRECTORY_SEPARATOR . md5_file(__FILE__))) {\nself::_removeTmpFiles($temp, getcwd());\n@mkdir($temp, 0777, true);\n@file_put_contents($temp . '/' . md5_file(__FILE__), '');\n\nforeach ($info['m'] as $path => $file) {\n$a = !file_exists(dirname($temp . '/' . $path));\n@mkdir(dirname($temp . '/' . $path), 0777, true);\nclearstatcache();\n\nif ($path[strlen($path) - 1] == '/') {\n@mkdir($temp . '/' . $path, 0777);\n} else {\nfile_put_contents($temp . '/' . $path, self::extractFile($path, $file, $fp));\n@chmod($temp . '/' . $path, 0666);\n}\n}\n}\n\nchdir($temp);\n\nif (!$return) {\ninclude self::ST";
 	static const char newstub3_1[] = "ART;\n}\n}\n\nstatic function tmpdir()\n{\nif (strpos(PHP_OS, 'WIN') !== false) {\nif ($var = getenv('TMP') ? getenv('TMP') : getenv('TEMP')) {\nreturn $var;\n}\nif (is_dir('/temp') || mkdir('/temp')) {\nreturn realpath('/temp');\n}\nreturn false;\n}\nif ($var = getenv('TMPDIR')) {\nreturn $var;\n}\nreturn realpath('/tmp');\n}\n\nstatic function _unpack($m)\n{\n$info = unpack('V', substr($m, 0, 4));\n $l = unpack('V', substr($m, 10, 4));\n$m = substr($m, 14 + $l[1]);\n$s = unpack('V', substr($m, 0, 4));\n$o = 0;\n$start = 4 + $s[1];\n$ret['c'] = 0;\n\nfor ($i = 0; $i < $info[1]; $i++) {\n $len = unpack('V', substr($m, $start, 4));\n$start += 4;\n $savepath = substr($m, $start, $len[1]);\n$start += $len[1];\n   $ret['m'][$savepath] = array_values(unpack('Va/Vb/Vc/Vd/Ve/Vf', substr($m, $start, 24)));\n$ret['m'][$savepath][3] = sprintf('%u', $ret['m'][$savepath][3]\n& 0xffffffff);\n$ret['m'][$savepath][7] = $o;\n$o += $ret['m'][$savepath][2];\n$start += 24 + $ret['m'][$savepath][5];\n$ret['c'] |= $ret['m'][$savepath][4] & self::MASK;\n}\nreturn $ret;\n}\n\nstatic function extractFile($path, $entry, $fp)\n{\n$data = '';\n$c = $entry[2];\n\nwhile ($c) {\nif ($c < 8192) {\n$data .= @fread($fp, $c);\n$c = 0;\n} else {\n$c -= 8192;\n$data .= @fread($fp, 8192);\n}\n}\n\nif ($entry[4] & self::GZ) {\n$data = gzinflate($data);\n} elseif ($entry[4] & self::BZ2) {\n$data = bzdecompress($data);\n}\n\nif (strlen($data) != $entry[0]) {\ndie(\"Invalid internal .phar file (size error \" . strlen($data) . \" != \" .\n$stat[7] . \")\");\n}\n\nif ($entry[3] != sprintf(\"%u\", crc32((binary)$data) & 0xffffffff)) {\ndie(\"Invalid internal .phar file (checksum error)\");\n}\n\nreturn $data;\n}\n\nstatic function _removeTmpFiles($temp, $origdir)\n{\nchdir($temp);\n\nforeach (glob('*') as $f) {\nif (file_exists($f)) {\nis_dir($f) ? @rmdir($f) : @unlink($f);\nif (file_exists($f) && is_dir($f)) {\nself::_removeTmpFiles($f, getcwd());\n}\n}\n}\n\n@rmdir($temp);\nclearstatcache();\nchdir($origdir);\n}\n}\n\nExtract_Phar::go();\n__HALT_COMPIL";
 	static const char newstub3_2[] = "ER(); ?>";
 
-	static const int newstub_len = 6665;
+	static const int newstub_len = 6655;
 
 	return strpprintf(name_len + web_len + newstub_len, "%s%s%s%s%s%s%d%s%s%s", newstub0, web, newstub1_0, newstub1_1, index_php, newstub2, name_len + web_len + newstub_len, newstub3_0, newstub3_1, newstub3_2);
 }

ext/phar/tests/cache_list/copyonwrite11.phar.phpt

@@ -18,5 +18,5 @@ echo strlen($p2->getStub()),"\n";
 echo "ok\n";
 __HALT_COMPILER(); ?>
 "
-6685
+6675
 ok

ext/phar/tests/phar_commitwrite.phpt

@@ -29,7 +29,7 @@ unlink(dirname(__FILE__) . '/brandnewphar.phar');
 __HALT_COMPILER();
 ?>
 --EXPECT--
-int(6683)
+int(6673)
 string(200) "<?php
 function __autoload($class)
 {

ext/phar/tests/phar_convert_repeated.phpt

@@ -123,7 +123,7 @@ NULL
 bool(true)
 bool(false)
 bool(false)
-int(6683)
+int(6673)
 NULL
 ================= convertToZip() =====================
 bool(false)

ext/phar/tests/phar_create_in_cwd.phpt

@@ -32,7 +32,7 @@ __HALT_COMPILER();
 unlink(dirname(__FILE__) . '/brandnewphar.phar');
 ?>
 --EXPECT--
-int(6683)
+int(6673)
 string(200) "<?php
 function __autoload($class)
 {

ext/phar/tests/phar_createdefaultstub.phpt

@@ -34,7 +34,7 @@ echo $e->getMessage() . "\n";
 ?>
 ===DONE===
 --EXPECT--
-string(6683) "<?php
+string(6673) "<?php
 
 $web = 'index.php';
 
@@ -110,7 +110,7 @@ exit;
 $a = realpath(Extract_Phar::$temp . DIRECTORY_SEPARATOR . $pt);
 if (!$a || strlen(dirname($a)) < strlen(Extract_Phar::$temp)) {
 header('HTTP/1.0 404 Not Found');
-echo "<html>\n <head>\n  <title>File Not Found<title>\n </head>\n <body>\n  <h1>404 - File ", $pt, " Not Found</h1>\n </body>\n</html>";
+echo "<html>\n <head>\n  <title>File Not Found<title>\n </head>\n <body>\n  <h1>404 - File Not Found</h1>\n </body>\n</html>";
 exit;
 }
 $b = pathinfo($a);
@@ -144,7 +144,7 @@ const GZ = 0x1000;
 const BZ2 = 0x2000;
 const MASK = 0x3000;
 const START = 'index.php';
-const LEN = 6685;
+const LEN = 6675;
 
 static function go($return = false)
 {
@@ -328,7 +328,7 @@ Extract_Phar::go();
 __HALT_COMPILER(); ?>"
 ============================================================================
 ============================================================================
-string(6694) "<?php
+string(6684) "<?php
 
 $web = 'index.php';
 
@@ -404,7 +404,7 @@ exit;
 $a = realpath(Extract_Phar::$temp . DIRECTORY_SEPARATOR . $pt);
 if (!$a || strlen(dirname($a)) < strlen(Extract_Phar::$temp)) {
 header('HTTP/1.0 404 Not Found');
-echo "<html>\n <head>\n  <title>File Not Found<title>\n </head>\n <body>\n  <h1>404 - File ", $pt, " Not Found</h1>\n </body>\n</html>";
+echo "<html>\n <head>\n  <title>File Not Found<title>\n </head>\n <body>\n  <h1>404 - File Not Found</h1>\n </body>\n</html>";
 exit;
 }
 $b = pathinfo($a);
@@ -438,7 +438,7 @@ const GZ = 0x1000;
 const BZ2 = 0x2000;
 const MASK = 0x3000;
 const START = 'my/custom/thingy.php';
-const LEN = 6696;
+const LEN = 6686;
 
 static function go($return = false)
 {
@@ -622,7 +622,7 @@ Extract_Phar::go();
 __HALT_COMPILER(); ?>"
 ============================================================================
 ============================================================================
-int(7074)
+int(7064)
 ============================================================================
 ============================================================================
 Illegal filename passed in for stub creation, was 401 characters long, and only 400 or less is allowed
@@ -630,7 +630,7 @@ Illegal filename passed in for stub creation, was 401 characters long, and only
 ============================================================================
 ============================================================================
 ============================================================================
-string(6696) "<?php
+string(6686) "<?php
 
 $web = 'the/web.php';
 
@@ -706,7 +706,7 @@ exit;
 $a = realpath(Extract_Phar::$temp . DIRECTORY_SEPARATOR . $pt);
 if (!$a || strlen(dirname($a)) < strlen(Extract_Phar::$temp)) {
 header('HTTP/1.0 404 Not Found');
-echo "<html>\n <head>\n  <title>File Not Found<title>\n </head>\n <body>\n  <h1>404 - File ", $pt, " Not Found</h1>\n </body>\n</html>";
+echo "<html>\n <head>\n  <title>File Not Found<title>\n </head>\n <body>\n  <h1>404 - File Not Found</h1>\n </body>\n</html>";
 exit;
 }
 $b = pathinfo($a);
@@ -740,7 +740,7 @@ const GZ = 0x1000;
 const BZ2 = 0x2000;
 const MASK = 0x3000;
 const START = 'my/custom/thingy.php';
-const LEN = 6698;
+const LEN = 6688;
 
 static function go($return = false)
 {
@@ -924,6 +924,6 @@ Extract_Phar::go();
 __HALT_COMPILER(); ?>"
 ============================================================================
 ============================================================================
-int(7074)
+int(7064)
 Illegal web filename passed in for stub creation, was 401 characters long, and only 400 or less is allowed
 ===DONE===

ext/phar/tests/phar_offset_check.phpt

@@ -70,8 +70,8 @@ var_dump($phar->getAlias());
 Entry .phar/stub.php does not exist
 Entry .phar/alias.txt does not exist
 Cannot set stub ".phar/stub.php" directly in phar "%sphar_offset_check.phar.php", use setStub
-int(6685)
-int(6685)
+int(6675)
+int(6675)
 Cannot set alias ".phar/alias.txt" directly in phar "%sphar_offset_check.phar.php", use setAlias
 string(5) "susan"
 string(5) "susan"

ext/phar/tests/phar_setdefaultstub.phpt

@@ -54,7 +54,7 @@ try {
 unlink(dirname(__FILE__) . '/' . basename(__FILE__, '.clean.php') . '.phar');
 ?>
 --EXPECT--
-string(6685) "<?php
+string(6675) "<?php
 
 $web = 'index.php';
 
@@ -130,7 +130,7 @@ exit;
 $a = realpath(Extract_Phar::$temp . DIRECTORY_SEPARATOR . $pt);
 if (!$a || strlen(dirname($a)) < strlen(Extract_Phar::$temp)) {
 header('HTTP/1.0 404 Not Found');
-echo "<html>\n <head>\n  <title>File Not Found<title>\n </head>\n <body>\n  <h1>404 - File ", $pt, " Not Found</h1>\n </body>\n</html>";
+echo "<html>\n <head>\n  <title>File Not Found<title>\n </head>\n <body>\n  <h1>404 - File Not Found</h1>\n </body>\n</html>";
 exit;
 }
 $b = pathinfo($a);
@@ -164,7 +164,7 @@ const GZ = 0x1000;
 const BZ2 = 0x2000;
 const MASK = 0x3000;
 const START = 'index.php';
-const LEN = 6685;
+const LEN = 6675;
 
 static function go($return = false)
 {
@@ -349,7 +349,7 @@ __HALT_COMPILER(); ?>
 "
 ============================================================================
 ============================================================================
-string(6696) "<?php
+string(6686) "<?php
 
 $web = 'index.php';
 
@@ -425,7 +425,7 @@ exit;
 $a = realpath(Extract_Phar::$temp . DIRECTORY_SEPARATOR . $pt);
 if (!$a || strlen(dirname($a)) < strlen(Extract_Phar::$temp)) {
 header('HTTP/1.0 404 Not Found');
-echo "<html>\n <head>\n  <title>File Not Found<title>\n </head>\n <body>\n  <h1>404 - File ", $pt, " Not Found</h1>\n </body>\n</html>";
+echo "<html>\n <head>\n  <title>File Not Found<title>\n </head>\n <body>\n  <h1>404 - File Not Found</h1>\n </body>\n</html>";
 exit;
 }
 $b = pathinfo($a);
@@ -459,7 +459,7 @@ const GZ = 0x1000;
 const BZ2 = 0x2000;
 const MASK = 0x3000;
 const START = 'my/custom/thingy.php';
-const LEN = 6696;
+const LEN = 6686;
 
 static function go($return = false)
 {
@@ -644,7 +644,7 @@ __HALT_COMPILER(); ?>
 "
 ============================================================================
 ============================================================================
-string(6698) "<?php
+string(6688) "<?php
 
 $web = 'the/web.php';
 
@@ -720,7 +720,7 @@ exit;
 $a = realpath(Extract_Phar::$temp . DIRECTORY_SEPARATOR . $pt);
 if (!$a || strlen(dirname($a)) < strlen(Extract_Phar::$temp)) {
 header('HTTP/1.0 404 Not Found');
-echo "<html>\n <head>\n  <title>File Not Found<title>\n </head>\n <body>\n  <h1>404 - File ", $pt, " Not Found</h1>\n </body>\n</html>";
+echo "<html>\n <head>\n  <title>File Not Found<title>\n </head>\n <body>\n  <h1>404 - File Not Found</h1>\n </body>\n</html>";
 exit;
 }
 $b = pathinfo($a);
@@ -754,7 +754,7 @@ const GZ = 0x1000;
 const BZ2 = 0x2000;
 const MASK = 0x3000;
 const START = 'my/custom/thingy.php';
-const LEN = 6698;
+const LEN = 6688;
 
 static function go($return = false)
 {
@@ -939,6 +939,6 @@ __HALT_COMPILER(); ?>
 "
 ============================================================================
 ============================================================================
-int(7076)
+int(7066)
 Illegal filename passed in for stub creation, was 401 characters long, and only 400 or less is allowed
 ===DONE===

ext/phar/tests/tar/phar_convert_phar.phpt

@@ -47,12 +47,12 @@ __HALT_COMPILER();
 ?>
 --EXPECT--
 bool(false)
-int(6683)
+int(6673)
 bool(true)
 string(60) "<?php // tar-based phar archive stub file
 __HALT_COMPILER();"
 bool(true)
-int(6683)
+int(6673)
 bool(true)
-int(6683)
+int(6673)
 ===DONE===

ext/phar/tests/tar/phar_convert_phar2.phpt

@@ -49,14 +49,14 @@ __HALT_COMPILER();
 ?>
 --EXPECT--
 bool(false)
-int(6683)
+int(6673)
 bool(true)
 string(60) "<?php // tar-based phar archive stub file
 __HALT_COMPILER();"
 bool(true)
 int(4096)
-int(6683)
+int(6673)
 bool(true)
 bool(true)
-int(6683)
+int(6673)
 ===DONE===

ext/phar/tests/tar/phar_convert_phar3.phpt

@@ -49,14 +49,14 @@ __HALT_COMPILER();
 ?>
 --EXPECT--
 bool(false)
-int(6683)
+int(6673)
 bool(true)
 string(60) "<?php // tar-based phar archive stub file
 __HALT_COMPILER();"
 bool(true)
 int(8192)
-int(6683)
+int(6673)
 bool(true)
 bool(true)
-int(6683)
+int(6673)
 ===DONE===

ext/phar/tests/tar/phar_convert_phar4.phpt

@@ -54,7 +54,7 @@ __HALT_COMPILER();
 ?>
 --EXPECT--
 bool(false)
-int(6683)
+int(6673)
 string(2) "hi"
 bool(true)
 string(60) "<?php // tar-based phar archive stub file
@@ -62,10 +62,10 @@ __HALT_COMPILER();"
 string(2) "hi"
 bool(true)
 int(4096)
-int(6683)
+int(6673)
 string(2) "hi"
 bool(true)
 bool(true)
-int(6683)
+int(6673)
 string(2) "hi"
 ===DONE===

ext/phar/tests/zip/phar_convert_phar.phpt

@@ -46,12 +46,12 @@ __HALT_COMPILER();
 ?>
 --EXPECT--
 bool(false)
-int(6683)
+int(6673)
 bool(true)
 string(60) "<?php // zip-based phar archive stub file
 __HALT_COMPILER();"
 bool(true)
-int(6683)
+int(6673)
 bool(true)
-int(6683)
+int(6673)
 ===DONE===

ext/standard/http_fopen_wrapper.c

@@ -734,9 +734,9 @@ finish:
 								tmp_line, response_code);
 				}
 			}
-			if (tmp_line[tmp_line_len - 1] == '\n') {
+			if (tmp_line_len >= 1 && tmp_line[tmp_line_len - 1] == '\n') {
 				--tmp_line_len;
-				if (tmp_line[tmp_line_len - 1] == '\r') {
+				if (tmp_line_len >= 1 &&tmp_line[tmp_line_len - 1] == '\r') {
 					--tmp_line_len;
 				}
 			}
@@ -796,6 +796,10 @@ finish:
 						&& (*http_header_value == ' ' || *http_header_value == '\t')) {
 					http_header_value++;
 				}
+			} else {
+				/* There is no colon. Set the value to the end of the header line, which is
+				 * effectively an empty string. */
+				http_header_value = e;
 			}
 
 			if (!strncasecmp(http_header_line, "Location:", sizeof("Location:")-1)) {
@@ -812,11 +816,11 @@ finish:
 				strlcpy(location, http_header_value, sizeof(location));
 			} else if (!strncasecmp(http_header_line, "Content-Type:", sizeof("Content-Type:")-1)) {
 				php_stream_notify_info(context, PHP_STREAM_NOTIFY_MIME_TYPE_IS, http_header_value, 0);
-			} else if (!strncasecmp(http_header_line, "Content-Length:", sizeof("Content-Length")-1)) {
+			} else if (!strncasecmp(http_header_line, "Content-Length:", sizeof("Content-Length:")-1)) {
 				file_size = atoi(http_header_value);
 				php_stream_notify_file_size(context, file_size, http_header_line, 0);
 			} else if (
-				!strncasecmp(http_header_line, "Transfer-Encoding:", sizeof("Transfer-Encoding")-1)
+				!strncasecmp(http_header_line, "Transfer-Encoding:", sizeof("Transfer-Encoding:")-1)
 				&& !strncasecmp(http_header_value, "Chunked", sizeof("Chunked")-1)
 			) {
 

ext/standard/random.c

@@ -122,16 +122,10 @@ PHPAPI int php_random_bytes(void *bytes, size_t size, zend_bool should_throw)
 			} else if (errno == EINTR || errno == EAGAIN) {
 				/* Try again */
 				continue;
+			} else {
+			    /* If the syscall fails, fall back to reading from /dev/urandom */
+				break;
 			}
-			/*
-				If the syscall fails, we are doomed. The loop that calls
-				php_random_bytes should be terminated by the exception instead
-				of proceeding to demand more entropy.
-			*/
-			if (should_throw) {
-				zend_throw_exception(zend_ce_exception, "Could not gather sufficient random data", errno);
-			}
-			return FAILURE;
 		}
 
 		read_bytes += (size_t) n;

ext/standard/tests/http/bug75535.phpt

@@ -0,0 +1,31 @@
+--TEST--
+Bug #75535: Inappropriately parsing HTTP response leads to PHP segment fault
+--SKIPIF--
+<?php require 'server.inc'; http_server_skipif('tcp://127.0.0.1:22351'); ?>
+--INI--
+allow_url_fopen=1
+--FILE--
+<?php
+require 'server.inc';
+
+$responses = array(
+	"data://text/plain,HTTP/1.0 200 Ok\r\nContent-Length\r\n",
+);
+
+$pid = http_server("tcp://127.0.0.1:22351", $responses, $output);
+
+var_dump(file_get_contents('http://127.0.0.1:22351/'));
+var_dump($http_response_header);
+
+http_server_kill($pid);
+?>
+==DONE==
+--EXPECT--
+string(0) ""
+array(2) {
+  [0]=>
+  string(15) "HTTP/1.0 200 Ok"
+  [1]=>
+  string(14) "Content-Length"
+}
+==DONE==

ext/standard/tests/http/bug75981.phpt

@@ -0,0 +1,32 @@
+--TEST--
+Bug #75981 (stack-buffer-overflow while parsing HTTP response)
+--INI--
+allow_url_fopen=1
+--SKIPIF--
+<?php require 'server.inc'; http_server_skipif('tcp://127.0.0.1:12342'); ?>
+--FILE--
+<?php
+require 'server.inc';
+
+$options = [
+  'http' => [
+    'protocol_version' => '1.1',
+    'header' => 'Connection: Close'
+  ],
+];
+
+$ctx = stream_context_create($options);
+
+$responses = [
+	"data://text/plain,000000000100\xA\xA"
+];
+$pid = http_server('tcp://127.0.0.1:12342', $responses);
+
+echo @file_get_contents('http://127.0.0.1:12342/', false, $ctx);
+
+http_server_kill($pid);
+
+?>
+DONE
+--EXPECT--
+DONE

ext/zip/php_zip.c

@@ -1513,8 +1513,12 @@ static ZIPARCHIVE_METHOD(close)
 	ze_obj = Z_ZIP_P(self);
 
 	if ((err = zip_close(intern))) {
+#if LIBZIP_VERSION_MAJOR == 1 && LIBZIP_VERSION_MINOR == 3 && LIBZIP_VERSION_MICRO == 1
+		php_error_docref(NULL, E_WARNING, "%s", "zip_close have failed");
+#else
 		php_error_docref(NULL, E_WARNING, "%s", zip_strerror(intern));
 		zip_discard(intern);
+#endif
 	}
 
 	efree(ze_obj->filename);

main/main.c

@@ -259,17 +259,17 @@ static void php_disable_classes(void)
  */
 static void php_binary_init(void)
 {
-	char *binary_location;
+	char *binary_location = NULL;
 #ifdef PHP_WIN32
 	binary_location = (char *)malloc(MAXPATHLEN);
-	if (GetModuleFileName(0, binary_location, MAXPATHLEN) == 0) {
+	if (binary_location && GetModuleFileName(0, binary_location, MAXPATHLEN) == 0) {
 		free(binary_location);
 		PG(php_binary) = NULL;
 	}
 #else
 	if (sapi_module.executable_location) {
 		binary_location = (char *)malloc(MAXPATHLEN);
-		if (!strchr(sapi_module.executable_location, '/')) {
+		if (binary_location && !strchr(sapi_module.executable_location, '/')) {
 			char *envpath, *path;
 			int found = 0;
 
@@ -299,8 +299,6 @@ static void php_binary_init(void)
 			free(binary_location);
 			binary_location = NULL;
 		}
-	} else {
-		binary_location = NULL;
 	}
 #endif
 	PG(php_binary) = binary_location;

main/php_version.h

@@ -2,7 +2,7 @@
 /* edit configure.in to change version number */
 #define PHP_MAJOR_VERSION 7
 #define PHP_MINOR_VERSION 0
-#define PHP_RELEASE_VERSION 27
-#define PHP_EXTRA_VERSION "-dev"
-#define PHP_VERSION "7.0.27-dev"
-#define PHP_VERSION_ID 70027
+#define PHP_RELEASE_VERSION 28
+#define PHP_EXTRA_VERSION ""
+#define PHP_VERSION "7.0.28"
+#define PHP_VERSION_ID 70028

sapi/cli/php_cli_server.c

@@ -213,6 +213,8 @@ static php_cli_server_http_response_status_code_pair template_map[] = {
 static int php_cli_output_is_tty = OUTPUT_NOT_CHECKED;
 #endif
 
+static const char php_cli_server_request_error_unexpected_eof[] = "Unexpected EOF";
+
 static size_t php_cli_server_client_send_through(php_cli_server_client *client, const char *str, size_t str_len);
 static php_cli_server_chunk *php_cli_server_chunk_heap_new_self_contained(size_t len);
 static void php_cli_server_buffer_append(php_cli_server_buffer *buffer, php_cli_server_chunk *chunk);
@@ -1743,7 +1745,7 @@ static int php_cli_server_client_read_request(php_cli_server_client *client, cha
 		*errstr = php_socket_strerror(err, NULL, 0);
 		return -1;
 	} else if (nbytes_read == 0) {
-		*errstr = estrdup("Unexpected EOF");
+		*errstr = estrdup(php_cli_server_request_error_unexpected_eof);
 		return -1;
 	}
 	client->parser.data = client;
@@ -1880,7 +1882,7 @@ static void php_cli_server_client_dtor(php_cli_server_client *client) /* {{{ */
 
 static void php_cli_server_close_connection(php_cli_server *server, php_cli_server_client *client) /* {{{ */
 {
-#ifdef DEBUG
+#if PHP_DEBUG
 	php_cli_server_logf("%s Closing", client->addr_str);
 #endif
 	zend_hash_index_del(&server->clients, client->sock);
@@ -2369,7 +2371,13 @@ static int php_cli_server_recv_event_read_request(php_cli_server *server, php_cl
 	char *errstr = NULL;
 	int status = php_cli_server_client_read_request(client, &errstr);
 	if (status < 0) {
-		php_cli_server_logf("%s Invalid request (%s)", client->addr_str, errstr);
+		if (strcmp(errstr, php_cli_server_request_error_unexpected_eof) == 0 && client->parser.state == s_start_req) {
+#if PHP_DEBUG
+			php_cli_server_logf("%s Closed without sending a request; it was probably just an unused speculative preconnection", client->addr_str);
+#endif
+		} else {
+			php_cli_server_logf("%s Invalid request (%s)", client->addr_str, errstr);
+		}
 		efree(errstr);
 		php_cli_server_close_connection(server, client);
 		return FAILURE;
@@ -2453,7 +2461,7 @@ static int php_cli_server_do_event_for_each_fd_callback(void *_params, php_socke
 			closesocket(client_sock);
 			return SUCCESS;
 		}
-#ifdef DEBUG
+#if PHP_DEBUG
 		php_cli_server_logf("%s Accepted", client->addr_str);
 #endif
 		zend_hash_index_update_ptr(&server->clients, client_sock, client);

sapi/cli/php_http_parser.c

@@ -195,75 +195,6 @@ static const uint8_t normal_url_char[256] = {
         1,       1,       1,       1,       1,       1,       1,       0 };
 
 
-enum state
-  { s_dead = 1 /* important that this is > 0 */
-
-  , s_start_req_or_res
-  , s_res_or_resp_H
-  , s_start_res
-  , s_res_H
-  , s_res_HT
-  , s_res_HTT
-  , s_res_HTTP
-  , s_res_first_http_major
-  , s_res_http_major
-  , s_res_first_http_minor
-  , s_res_http_minor
-  , s_res_first_status_code
-  , s_res_status_code
-  , s_res_status
-  , s_res_line_almost_done
-
-  , s_start_req
-
-  , s_req_method
-  , s_req_spaces_before_url
-  , s_req_schema
-  , s_req_schema_slash
-  , s_req_schema_slash_slash
-  , s_req_host
-  , s_req_port
-  , s_req_path
-  , s_req_query_string_start
-  , s_req_query_string
-  , s_req_fragment_start
-  , s_req_fragment
-  , s_req_http_start
-  , s_req_http_H
-  , s_req_http_HT
-  , s_req_http_HTT
-  , s_req_http_HTTP
-  , s_req_first_http_major
-  , s_req_http_major
-  , s_req_first_http_minor
-  , s_req_http_minor
-  , s_req_line_almost_done
-
-  , s_header_field_start
-  , s_header_field
-  , s_header_value_start
-  , s_header_value
-
-  , s_header_almost_done
-
-  , s_headers_almost_done
-  /* Important: 's_headers_almost_done' must be the last 'header' state. All
-   * states beyond this must be 'body' states. It is used for overflow
-   * checking. See the PARSING_HEADER() macro.
-   */
-  , s_chunk_size_start
-  , s_chunk_size
-  , s_chunk_size_almost_done
-  , s_chunk_parameters
-  , s_chunk_data
-  , s_chunk_data_almost_done
-  , s_chunk_data_done
-
-  , s_body_identity
-  , s_body_identity_eof
-  };
-
-
 #define PARSING_HEADER(state) (state <= s_headers_almost_done && 0 == (parser->flags & F_TRAILING))
 
 

sapi/cli/php_http_parser.h

@@ -110,6 +110,73 @@ enum php_http_method
 
 enum php_http_parser_type { PHP_HTTP_REQUEST, PHP_HTTP_RESPONSE, PHP_HTTP_BOTH };
 
+enum state
+  { s_dead = 1 /* important that this is > 0 */
+
+  , s_start_req_or_res
+  , s_res_or_resp_H
+  , s_start_res
+  , s_res_H
+  , s_res_HT
+  , s_res_HTT
+  , s_res_HTTP
+  , s_res_first_http_major
+  , s_res_http_major
+  , s_res_first_http_minor
+  , s_res_http_minor
+  , s_res_first_status_code
+  , s_res_status_code
+  , s_res_status
+  , s_res_line_almost_done
+
+  , s_start_req
+
+  , s_req_method
+  , s_req_spaces_before_url
+  , s_req_schema
+  , s_req_schema_slash
+  , s_req_schema_slash_slash
+  , s_req_host
+  , s_req_port
+  , s_req_path
+  , s_req_query_string_start
+  , s_req_query_string
+  , s_req_fragment_start
+  , s_req_fragment
+  , s_req_http_start
+  , s_req_http_H
+  , s_req_http_HT
+  , s_req_http_HTT
+  , s_req_http_HTTP
+  , s_req_first_http_major
+  , s_req_http_major
+  , s_req_first_http_minor
+  , s_req_http_minor
+  , s_req_line_almost_done
+
+  , s_header_field_start
+  , s_header_field
+  , s_header_value_start
+  , s_header_value
+
+  , s_header_almost_done
+
+  , s_headers_almost_done
+  /* Important: 's_headers_almost_done' must be the last 'header' state. All
+   * states beyond this must be 'body' states. It is used for overflow
+   * checking. See the PARSING_HEADER() macro.
+   */
+  , s_chunk_size_start
+  , s_chunk_size
+  , s_chunk_size_almost_done
+  , s_chunk_parameters
+  , s_chunk_data
+  , s_chunk_data_almost_done
+  , s_chunk_data_done
+
+  , s_body_identity
+  , s_body_identity_eof
+  };
 
 struct php_http_parser {
   /** PRIVATE **/

win32/build/confutils.js

@@ -1848,7 +1848,7 @@ function generate_tmp_php_ini()
 		}
 		
 		var directive = "extension";
-		if ("opcache" == extensions_enabled[i][0]) {
+		if ("opcache" == extensions_enabled[i][0] || "xdebug" == extensions_enabled[i][0]) {
 			directive = "zend_extension";
 		}