Merge branch 'PHP-5.3' of git.php.net:/php-src into PHP-5.3

.gitattributes

@@ -15,6 +15,7 @@ ext/dba/libflatfile/flatfile.c  ident
 ext/dba/libcdb/cdb_make.c       ident
 ext/dba/libcdb/cdb.c            ident
 ext/filter/filter.c             ident
+ext/zip/php_zip.c               ident
 README.input_filter             ident
 run-tests.php                   ident
 sapi/nsapi/nsapi.c              ident

INSTALL

@@ -24,6 +24,7 @@ Installing PHP
           + Installing a PHP extension on Windows
           + Compiling shared PECL extensions with the pecl command
           + Compiling shared PECL extensions with phpize
+          + php-config
           + Compiling PECL extensions statically into PHP
      * Problems?
           + Read the FAQ
@@ -92,9 +93,9 @@ General Installation Considerations
    will  also  find  information  on  the  command  line executable in the
    following sections.
 
-   PHP source code and binary distributions for Windows can be found at »
-   http://www.php.net/downloads.php. We recommend you to choose a » mirror
-   nearest to you for downloading the distributions.
+   PHP  source  code  and binary distributions for Windows can be found at
+   » http://www.php.net/downloads.php.   We  recommend  you  to  choose  a
+   » mirror nearest to you for downloading the distributions.
      __________________________________________________________________
      __________________________________________________________________
 
@@ -140,9 +141,9 @@ Table of Contents
      * A web server
      * Any module specific components (such as GD, PDF libs, etc.)
 
-   When  building  directly from SVN sources or after custom modifications
+   When  building  directly from Git sources or after custom modifications
    you might also need:
-     * autoconf: 2.13
+     * autoconf: 2.13+ (for PHP < 5.4.0), 2.59+ (for PHP >= 5.4.0)
      * automake: 1.4+
      * libtool: 1.4.x+ (except 1.4.2)
      * re2c: Version 0.13.4 or newer
@@ -379,8 +380,8 @@ Apache 2.x on Unix systems
    information   on   the   Apache  2.x  server.  More  information  about
    installation options for Apache may be found there.
 
-   The  most  recent version of Apache HTTP Server may be obtained from »
-   Apache  download  site,  and  a  fitting  PHP  version  from  the above
+   The  most  recent  version  of  Apache HTTP Server may be obtained from
+   » Apache  download  site,  and  a  fitting  PHP  version from the above
    mentioned  places.  This  quick  guide  covers  only  the basics to get
    started with Apache 2.x and PHP. For more information read the » Apache
    Documentation.  The  version  numbers have been omitted here, to ensure
@@ -627,8 +628,8 @@ Sun, iPlanet and Netscape servers on Sun Solaris
    current web servers read the note about subrequests.
 
    You  can  find  more  information about setting up PHP for the Netscape
-   Enterprise Server (NES) here: »
-   http://benoit.noss.free.fr/php/install-php4.html
+   Enterprise Server (NES) here:
+   » http://benoit.noss.free.fr/php/install-php4.html
 
    To  build  PHP  with  Sun JSWS/Sun ONE WS/iPlanet/Netscape web servers,
    enter  the  proper install directory for the --with-nsapi=[DIR] option.
@@ -855,20 +856,20 @@ HP-UX specific installation notes
    There  are two main options for installing PHP on HP-UX systems. Either
    compile it, or install a pre-compiled binary.
 
-   Official     pre-compiled     packages    are    located    here:    »
-   http://software.hp.com/
+   Official      pre-compiled      packages      are     located     here:
+   » http://software.hp.com/
 
    Until  this  manual  section  is  rewritten,  the  documentation  about
    compiling  PHP  (and  related  extensions)  on  HP-UX  systems has been
-   removed.  For now, consider reading the following external resource: »
-   Building Apache and PHP on HP-UX 11.11
+   removed.  For  now,  consider  reading the following external resource:
+   » Building Apache and PHP on HP-UX 11.11
      __________________________________________________________________
      __________________________________________________________________
 
 OpenBSD installation notes
 
-   This  section contains notes and hints specific to installing PHP on »
-   OpenBSD 3.6.
+   This  section  contains  notes  and hints specific to installing PHP on
+   » OpenBSD 3.6.
 
 Using Binary Packages
 
@@ -951,18 +952,26 @@ Required software
 
    Solaris  installs  often lack C compilers and their related tools. Read
    this  FAQ  for  information on why using GNU versions for some of these
-   tools is necessary. The required software is as follows:
+   tools is necessary.
+
+   For unpacking the PHP distribution you need
+     * tar
+     * gzip or
+     * bzip2
+
+   For compiling PHP you need
      * gcc (recommended, other C compilers may work)
      * make
-     * flex
+     * GNU sed
+
+   For building extra extensions or hacking the code of PHP you might also
+   need
+     * flex (up to PHP 5.2)
+     * re2c
      * bison
      * m4
      * autoconf
      * automake
-     * perl
-     * gzip
-     * tar
-     * GNU sed
 
    In  addition,  you  will  need  to  install  (and possibly compile) any
    additional  software  specific to your configuration, such as Oracle or
@@ -971,14 +980,16 @@ Required software
 Using Packages
 
    You can simplify the Solaris install process by using pkgadd to install
-   most of your needed components.
+   most  of  your  needed components. The Image Packaging System (IPS) for
+   Solaris  11  Express  also contains most of the required components for
+   installation using the pkg command.
      __________________________________________________________________
      __________________________________________________________________
 
 Debian GNU/Linux installation notes
 
-   This  section contains notes and hints specific to installing PHP on »
-   Debian GNU/Linux.
+   This  section  contains  notes  and hints specific to installing PHP on
+   » Debian GNU/Linux.
    Warning
 
    Unofficial  builds  from third-parties are not supported here. Any bugs
@@ -1205,6 +1216,7 @@ Table of Contents
      * Installing a PHP extension on Windows
      * Compiling shared PECL extensions with the pecl command
      * Compiling shared PECL extensions with phpize
+     * php-config
      * Compiling PECL extensions statically into PHP
      __________________________________________________________________
 
@@ -1227,8 +1239,8 @@ Introduction to PECL Installations
    To this php.ini file, or through the use of the dl() function.
 
    When  building  PHP modules, it's important to have known-good versions
-   of  the  required  tools (autoconf, automake, libtool, etc.) See the »
-   Anonymous  SVN  Instructions  for  details  on  the required tools, and
+   of  the  required  tools  (autoconf,  automake,  libtool, etc.) See the
+   » Anonymous  Git  Instructions  for  details on the required tools, and
    required versions.
      __________________________________________________________________
      __________________________________________________________________
@@ -1424,6 +1436,51 @@ $ make
      __________________________________________________________________
      __________________________________________________________________
 
+php-config
+
+   php-config is a simple shell script for obtaining information about the
+   installed PHP configuration.
+
+   When compiling extensions, if you have multiple PHP versions installed,
+   you may specify for which installation you'd like to build by using the
+   --with-php-config  option  during configuration, specifying the path of
+   the respective php-config script.
+
+   The  list of command line options provided by the php-config script can
+   be queried anytime by running php-config with the -h switch:
+Usage: /usr/local/bin/php-config [OPTION]
+Options:
+  --prefix            [...]
+  --includes          [...]
+  --ldflags           [...]
+  --libs              [...]
+  --extension-dir     [...]
+  --include-dir       [...]
+  --php-binary        [...]
+  --php-sapis         [...]
+  --configure-options [...]
+  --version           [...]
+  --vernum            [...]
+
+   CAPTION: Command line options
+
+   Option Description
+   --prefix Directory prefix where PHP is installed, e.g. /usr/local
+   --includes List of -I options with all include files
+   --ldflags LD Flags which PHP was compiled with
+   --libs Extra libraries which PHP was compiled with
+   --extension-dir Directory where extensions are searched by default
+   --include-dir Directory prefix where header files are installed by
+   default
+   --php-binary Full path to php CLI or CGI binary
+   --php-sapis Show all SAPI modules available
+   --configure-options  Configure  options  to  recreate  configuration of
+   current PHP installation
+   --version PHP version
+   --vernum PHP version as integer
+     __________________________________________________________________
+     __________________________________________________________________
+
 Compiling PECL extensions statically into PHP
 
    You  might find that you need to build a PECL extension statically into
@@ -1485,11 +1542,11 @@ Other problems
    If  you  are  still stuck, someone on the PHP installation mailing list
    may  be  able  to  help you. You should check out the archive first, in
    case  someone already answered someone else who had the same problem as
-   you.   The   archives  are  available  from  the  support  page  on  »
-   http://www.php.net/support.php.  To  subscribe  to the PHP installation
-   mailing list, send an empty mail to »
-   php-install-subscribe@lists.php.net.  The  mailing  list  address is »
-   php-install@lists.php.net.
+   you.   The   archives   are   available   from   the  support  page  on
+   » http://www.php.net/support.php.  To subscribe to the PHP installation
+   mailing list, send an empty mail to
+   » php-install-subscribe@lists.php.net.  The  mailing  list  address  is
+   » php-install@lists.php.net.
 
    If  you  want to get help on the mailing list, please try to be precise
    and  give the necessary details about your environment (which operating
@@ -1528,14 +1585,14 @@ The configuration file
 
    The  configuration  file  (php.ini) is read when PHP starts up. For the
    server  module  versions  of  PHP,  this happens only once when the web
-   server  is  started.  For  the CGI and CLI version, it happens on every
+   server  is  started.  For the CGI and CLI versions, it happens on every
    invocation.
 
-   php.ini is searched in these locations (in order):
+   php.ini is searched for in these locations (in order):
      * SAPI  module specific location (PHPIniDir directive in Apache 2, -c
        command  line  option  in  CGI and CLI, php_ini parameter in NSAPI,
        PHP_INI_PATH environment variable in THTTPD)
-     * The  PHPRC  environment variable. Before PHP 5.2.0 this was checked
+     * The  PHPRC environment variable. Before PHP 5.2.0, this was checked
        after the registry key mentioned below.
      * As  of  PHP  5.2.0, the location of the php.ini file can be set for
        different versions of PHP. The following registry keys are examined
@@ -1543,33 +1600,33 @@ The configuration file
        [HKEY_LOCAL_MACHINE\SOFTWARE\PHP\x.y] and
        [HKEY_LOCAL_MACHINE\SOFTWARE\PHP\x],  where x, y and z mean the PHP
        major,  minor  and  release  versions.  If  there  is  a  value for
-       IniFilePath in these keys, then the first one found will be used as
-       the location of the php.ini (Windows only).
+       IniFilePath  in any of these keys, the first one found will be used
+       as the location of the php.ini (Windows only).
      * [HKEY_LOCAL_MACHINE\SOFTWARE\PHP],  value  of  IniFilePath (Windows
        only).
-     * Current working directory (except CLI)
+     * Current working directory (except CLI).
      * The  web server's directory (for SAPI modules), or directory of PHP
-       (otherwise in Windows)
+       (otherwise in Windows).
      * Windows  directory  (C:\windows  or  C:\winnt)  (for  Windows),  or
-       --with-config-file-path compile time option
+       --with-config-file-path compile time option.
 
-   If  php-SAPI.ini  exists  (where  SAPI is used SAPI, so the filename is
-   e.g. php-cli.ini or php-apache.ini), it's used instead of php.ini. SAPI
-   name can be determined by php_sapi_name().
+   If php-SAPI.ini exists (where SAPI is the SAPI in use, so, for example,
+   php-cli.ini or php-apache.ini), it is used instead of php.ini. The SAPI
+   name can be determined with php_sapi_name().
 
      Note:
 
-     The  Apache  web  server  changes  the  directory to root at startup
+     The  Apache  web  server  changes  the directory to root at startup,
      causing  PHP  to attempt to read php.ini from the root filesystem if
      it exists.
 
-   The   php.ini   directives   handled   by   extensions  are  documented
-   respectively on the pages of the extensions themselves. The list of the
-   core  directives  is  available  in  the appendix. Probably not all PHP
-   directives  are documented in the manual though. For a complete list of
+   The  php.ini  directives  handled  by  extensions are documented on the
+   respective  pages  of  the  extensions  themselves.  A list of the core
+   directives  is  available  in  the appendix. Not all PHP directives are
+   necessarily   documented  in  this  manual:  for  a  complete  list  of
    directives  available  in  your  PHP  version,  please  read  your well
-   commented  php.ini  file. Alternatively, you may find the » the latest
-   php.ini from SVN helpful too.
+   commented  php.ini  file.  Alternatively,  you  may  find  » the latest
+   php.ini from Git helpful too.
 
    Example #1 php.ini example
 ; any text on a line after an unquoted semicolon (;) is ignored
@@ -1635,12 +1692,13 @@ Where a configuration setting may be set
 
    CAPTION: Definition of PHP_INI_* modes
 
-        Mode      Value                        Meaning
-   PHP_INI_USER   1     Entry can be set in user scripts (like with ini_set())
-                        or in the Windows registry
-   PHP_INI_PERDIR 6     Entry can be set in php.ini, .htaccess or httpd.conf
-   PHP_INI_SYSTEM 4     Entry can be set in php.ini or httpd.conf
-   PHP_INI_ALL    7     Entry can be set anywhere
+   Mode Meaning
+   PHP_INI_USER Entry can be set in user scripts (like with ini_set()) or
+   in the Windows registry. Since PHP 5.3, entry can be set in .user.ini
+   PHP_INI_PERDIR  Entry  can  be set in php.ini, .htaccess, httpd.conf or
+   .user.ini (since PHP 5.3)
+   PHP_INI_SYSTEM Entry can be set in php.ini or httpd.conf
+   PHP_INI_ALL Entry can be set anywhere
      __________________________________________________________________
      __________________________________________________________________
 
@@ -1788,13 +1846,9 @@ Installation
           each  request to play in, further weaknesses are introduced into
           PHP's system.
 
-          If  you  feel  you have to use a threaded MPM, look at a FastCGI
+          If   you  want  to  use  a  threaded  MPM,  look  at  a  FastCGI
           configuration where PHP is running in its own memory space.
 
-          And finally, this warning against using a threaded MPM is not as
-          strong  for  Windows  systems  because  most  libraries  on that
-          platform tend to be threadsafe.
-
    Unix/Windows: Where should my php.ini file be located?
           By  default  on  Unix  it  should  be in /usr/local/lib which is
           <install-path>/lib.  Most  people  will  want  to change this at

NEWS

@@ -2,16 +2,122 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2012, PHP 5.3.16
 
-?? ??? 2012, PHP 5.3.15
-  (NEWS will be merged after release by johannes. Formerging changes to the  
-  PHP-5.3.15 release branch talk to johannes)
+- Core:
+  . Fixed bug #62763 (register_shutdown_function and extending class). 
+    (Laruence)
+  . Fixed bug #62744 (dangling pointers made by zend_disable_class). (Laruence)
+  . Fixed bug #62716 (munmap() is called with the incorrect length). 
+    (slangley@google.com)
+  . Fixed bug ##62460 (php binaries installed as binary.dSYM). (Reeze Xia)
+  . Fixed bug #60194 (--with-zend-multibyte and --enable-debug reports LEAK
+    with run-test.php). (Laruence)
 
 - CURL:
+  . Fixed bug #62839 (curl_copy_handle segfault with CURLOPT_FILE). (Pierrick)
   . Fixed bug #62499 (curl_setopt($ch, CURLOPT_COOKIEFILE, "") returns false).
     (r.hampartsumyan@gmail.com, Laruence)
 
 - DateTime:
-  . Fixed Bug #62500 (Segfault in DateInterval class when extended). (Laruence)
+  . Fixed bug #62852 (Unserialize invalid DateTime causes crash).
+    (reeze.xia@gmail.com)
+  . Fixed bug #62500 (Segfault in DateInterval class when extended). (Laruence)
+
+- Intl:
+  . Fix null pointer dereferences in some classes of ext/intl. (Gustavo)
+
+- MySQLnd:
+  . Fixed bug #62885 (mysqli_poll - Segmentation fault). (Laruence)
+
+- PDO:
+  . Fixed bug #62685 (Wrong return datatype in PDO::inTransaction()). (Laruence)
+
+- Reflection:
+  . Fixed bug #62715 (ReflectionParameter::isDefaultValueAvailable() wrong
+    result). (Laruence)
+
+- Session:
+  . Fixed bug (segfault due to retval is not initialized). (Laruence)
+
+- SPL:
+  . Fixed bug #62904 (Crash when cloning an object which inherits SplFixedArray)
+    (Laruence)
+  . Fixed bug #62616 (ArrayIterator::count() from IteratorIterator instance
+    gives Segmentation fault). (Laruence, Gustavo)
+
+- Enchant:
+  . Fixed bug #62838 (enchant_dict_quick_check() destroys zval, but fails to 
+  initialize it). (Tony, Mateusz Goik).
+
+19 Jul 2012, PHP 5.3.15
+
+- Zend Engine:
+  . Fixed bug #51094 (parse_ini_file() with INI_SCANNER_RAW cuts a value that
+    includes a semi-colon). (Pierrick)
+
+- COM:
+  . Fixed bug #62146 com_dotnet cannot be built shared. (Johannes)
+
+- Core:
+  . Fixed potential overflow in _php_stream_scandir, CVE-2012-2688. (Jason 
+    Powell, Stas)
+  . Fixed bug #62432 (ReflectionMethod random corrupt memory on high
+    concurrent). (Johannes)
+  . Fixed bug #62443 (Crypt SHA256/512 Segfaults With Malformed 
+    Salt). (Anthony Ferrara)
+
+- Fileinfo:
+  . Fixed magic file regex support. (Felipe)
+
+- FPM:
+  . Fixed bug #61045 (fpm don't send error log to fastcgi clients). (fat)
+  . Fixed bug #61835 (php-fpm is not allowed to run as root). (fat)
+  . Fixed bug #61295 (php-fpm should not fail with commented 'user'
+    for non-root start). (fat)
+  . Fixed bug #61026 (FPM pools can listen on the same address). (fat)
+  . Fixed bug #62033 (php-fpm exits with status 0 on some failures to start).
+    (fat)
+  . Fixed bug #62153 (when using unix sockets, multiples FPM instances
+    can be launched without errors). (fat)
+  . Fixed bug #62160 (Add process.priority to set nice(2) priorities). (fat)
+  . Fixed bug #61218 (FPM drops connection while receiving some binary values
+    in FastCGI requests). (fat)
+  . Fixed bug #62205 (php-fpm segfaults (null passed to strstr)). (fat)
+
+- Intl:
+  . Fixed bug #62083 (grapheme_extract() memory leaks). (Gustavo)
+  . Fixed bug #62081 (IntlDateFormatter constructor leaks memory when called
+    twice). (Gustavo)
+  . Fixed bug #62070 (Collator::getSortKey() returns garbage). (Gustavo)
+  . Fixed bug #62017 (datefmt_create with incorrectly encoded timezone leaks
+    pattern). (Gustavo)
+  . Fixed bug #60785 (memory leak in IntlDateFormatter constructor). (Gustavo)
+
+- JSON:
+  . Reverted fix for bug #61537. (Johannes)
+
+- Phar:
+  . Fixed bug #62227 (Invalid phar stream path causes crash). (Felipe)
+
+- Reflection:
+  . Fixed bug #62384 (Attempting to invoke a Closure more than once causes 
+    segfault). (Felipe)
+  . Fixed bug #62202 (ReflectionParameter::getDefaultValue() memory leaks 
+    with constant). (Laruence)
+
+- SPL:
+  . Fixed bug #62262 (RecursiveArrayIterator does not implement Countable).
+    (Nikita Popov)
+
+- SQLite:
+  . Fixed open_basedir bypass, CVE-2012-3365. (Johannes, reported by Yury
+    Maryshev)
+
+- XML Writer:
+  . Fixed bug #62064 (memory leak in the XML Writer module). 
+    (jean-pierre dot lozi at lip6 dot fr)
+
+- Zip:
+  . Upgraded libzip to 0.10.1 (Anatoliy)
 
 14 Jun 2012, PHP 5.3.14
 

Zend/tests/bug55509.phpt

@@ -5,6 +5,12 @@ Bug #55509 (segfault on x86_64 using more than 2G memory)
 if (PHP_INT_SIZE == 4) {
   die('skip Not for 32-bits OS');
 }
+
+$zend_mm_enabled = getenv("USE_ZEND_ALLOC");
+if ($zend_mm_enabled === "0") {
+    die("skip Zend MM disabled");
+}
+
 if (getenv("SKIP_SLOW_TESTS")) die("skip slow test");
 // check the available memory
 if (PHP_OS == 'Linux') {

Zend/tests/bug62680.phpt

@@ -0,0 +1,13 @@
+--TEST--
+Bug #62680 (Function isset() throws fatal error on set array if non-existent key depth >= 3)
+--XFAIL--
+see https://bugs.php.net/62680
+--FILE--
+<?php
+$array = array("");
+var_dump(isset($array[0]["a"]["b"]));
+var_dump(isset($array[0]["a"]["b"]["c"]));
+?>
+--EXPECT--
+bool(false)
+bool(false)

Zend/tests/bug62763.phpt

@@ -0,0 +1,23 @@
+--TEST--
+Bug #62763 (register_shutdown_function and extending class)
+--FILE--
+<?php
+class test1 {
+    public function __construct() {
+        register_shutdown_function(array($this, 'shutdown')); 
+    }
+    public function shutdown() { 
+        exit(__METHOD__);
+    }
+}
+
+class test2 extends test1 {
+    public function __destruct() { 
+       exit (__METHOD__); 
+    }
+}
+new test1;
+new test2;
+?>
+--EXPECT--
+test1::shutdowntest2::__destruct

Zend/zend_API.c

@@ -2342,16 +2342,15 @@ static const zend_function_entry disabled_class_new[] = {
 
 ZEND_API int zend_disable_class(char *class_name, uint class_name_length TSRMLS_DC) /* {{{ */
 {
-	zend_class_entry disabled_class;
+	zend_class_entry **disabled_class;
 
 	zend_str_tolower(class_name, class_name_length);
-	if (zend_hash_del(CG(class_table), class_name, class_name_length+1)==FAILURE) {
+	if (zend_hash_find(CG(class_table), class_name, class_name_length+1, (void **)&disabled_class)==FAILURE) {
 		return FAILURE;
 	}
-	INIT_OVERLOADED_CLASS_ENTRY_EX(disabled_class, class_name, class_name_length, disabled_class_new, NULL, NULL, NULL, NULL, NULL);
-	disabled_class.create_object = display_disabled_class;
-	disabled_class.name_length = class_name_length;
-	zend_register_internal_class(&disabled_class TSRMLS_CC);
+	INIT_CLASS_ENTRY_INIT_METHODS((**disabled_class), disabled_class_new, NULL, NULL, NULL, NULL, NULL);
+	(*disabled_class)->create_object = display_disabled_class;
+	zend_hash_clean(&((*disabled_class)->function_table));
 	return SUCCESS;
 }
 /* }}} */
@@ -2425,7 +2424,6 @@ static int zend_is_callable_check_class(const char *name, int name_len, zend_fca
 }
 /* }}} */
 
-
 static int zend_is_callable_check_func(int check_flags, zval *callable, zend_fcall_info_cache *fcc, int strict_class, char **error TSRMLS_DC) /* {{{ */
 {
 	zend_class_entry *ce_org = fcc->calling_scope;
@@ -2447,11 +2445,9 @@ static int zend_is_callable_check_func(int check_flags, zval *callable, zend_fca
 		/* Skip leading \ */
 		if (Z_STRVAL_P(callable)[0] == '\\') {
 			mlen = Z_STRLEN_P(callable) - 1;
-			mname = Z_STRVAL_P(callable) + 1;
 			lmname = zend_str_tolower_dup(Z_STRVAL_P(callable) + 1, mlen);
 		} else {
 			mlen = Z_STRLEN_P(callable);
-			mname = Z_STRVAL_P(callable);
 			lmname = zend_str_tolower_dup(Z_STRVAL_P(callable), mlen);
 		}
 		/* Check if function with given name exists.

Zend/zend_API.h

@@ -170,6 +170,11 @@ typedef struct _zend_fcall_info_cache {
 		int _len = class_name_len;								\
 		class_container.name = zend_strndup(class_name, _len);	\
 		class_container.name_length = _len;						\
+		INIT_CLASS_ENTRY_INIT_METHODS(class_container, functions, handle_fcall, handle_propget, handle_propset, handle_propunset, handle_propisset) \
+	}
+
+#define INIT_CLASS_ENTRY_INIT_METHODS(class_container, functions, handle_fcall, handle_propget, handle_propset, handle_propunset, handle_propisset) \
+	{															\
 		class_container.builtin_functions = functions;			\
 		class_container.constructor = NULL;						\
 		class_container.destructor = NULL;						\

Zend/zend_language_scanner.c

@@ -1,4 +1,4 @@
-/* Generated by re2c 0.13.5 on Wed Feb 15 17:38:31 2012 */
+/* Generated by re2c 0.13.5 on Sat Jul 28 16:59:07 2012 */
 #line 1 "Zend/zend_language_scanner.l"
 /*
    +----------------------------------------------------------------------+
@@ -287,7 +287,7 @@ ZEND_API int open_file_for_scanning(zend_file_handle *file_handle TSRMLS_DC)
 		zend_multibyte_set_filter(NULL TSRMLS_CC);
 
 		if (!SCNG(input_filter)) {
-			SCNG(script_filtered) = (unsigned char*)emalloc(SCNG(script_org_size)+1);
+			SCNG(script_filtered) = (unsigned char*)emalloc(SCNG(script_org_size)+2);
 			memcpy(SCNG(script_filtered), SCNG(script_org), SCNG(script_org_size)+1);
 			SCNG(script_filtered_size) = SCNG(script_org_size);
 		} else {
@@ -445,7 +445,7 @@ ZEND_API int zend_prepare_string_for_scanning(zval *str, char *filename TSRMLS_D
 	zend_multibyte_set_filter(CG(internal_encoding) TSRMLS_CC);
 
 	if (!SCNG(input_filter)) {
-		SCNG(script_filtered) = (unsigned char*)emalloc(SCNG(script_org_size)+1);
+		SCNG(script_filtered) = (unsigned char*)emalloc(SCNG(script_org_size)+2);
 		memcpy(SCNG(script_filtered), SCNG(script_org), SCNG(script_org_size)+1);
 		SCNG(script_filtered_size) = SCNG(script_org_size);
 	} else {

Zend/zend_language_scanner.l

@@ -285,7 +285,7 @@ ZEND_API int open_file_for_scanning(zend_file_handle *file_handle TSRMLS_DC)
 		zend_multibyte_set_filter(NULL TSRMLS_CC);
 
 		if (!SCNG(input_filter)) {
-			SCNG(script_filtered) = (unsigned char*)emalloc(SCNG(script_org_size)+1);
+			SCNG(script_filtered) = (unsigned char*)emalloc(SCNG(script_org_size)+2);
 			memcpy(SCNG(script_filtered), SCNG(script_org), SCNG(script_org_size)+1);
 			SCNG(script_filtered_size) = SCNG(script_org_size);
 		} else {
@@ -443,7 +443,7 @@ ZEND_API int zend_prepare_string_for_scanning(zval *str, char *filename TSRMLS_D
 	zend_multibyte_set_filter(CG(internal_encoding) TSRMLS_CC);
 
 	if (!SCNG(input_filter)) {
-		SCNG(script_filtered) = (unsigned char*)emalloc(SCNG(script_org_size)+1);
+		SCNG(script_filtered) = (unsigned char*)emalloc(SCNG(script_org_size)+2);
 		memcpy(SCNG(script_filtered), SCNG(script_org), SCNG(script_org_size)+1);
 		SCNG(script_filtered_size) = SCNG(script_org_size);
 	} else {

Zend/zend_language_scanner_defs.h

@@ -1,4 +1,4 @@
-/* Generated by re2c 0.13.5 on Wed Feb 15 17:38:31 2012 */
+/* Generated by re2c 0.13.5 on Sat Jul 28 16:59:07 2012 */
 #line 3 "Zend/zend_language_scanner_defs.h"
 
 enum YYCONDTYPE {

Zend/zend_stream.c

@@ -79,7 +79,7 @@ static size_t zend_stream_stdio_fsizer(void *handle TSRMLS_DC) /* {{{ */
 static void zend_stream_unmap(zend_stream *stream TSRMLS_DC) { /* {{{ */
 #if HAVE_MMAP
 	if (stream->mmap.map) {
-		munmap(stream->mmap.map, stream->mmap.len);
+		munmap(stream->mmap.map, stream->mmap.len + ZEND_MMAP_AHEAD);
 	} else
 #endif
 	if (stream->mmap.buf) {

configure.in

@@ -1335,10 +1335,10 @@ PHP_CONFIGURE_PART(Configuring libtool)
 
 LDFLAGS="$LDFLAGS $PHP_AIX_LDFLAGS"
 
-dnl Autoconf 2.13's libtool checks go slightly nuts on Mac OS X 10.5 and 10.6.
+dnl Autoconf 2.13's libtool checks go slightly nuts on Mac OS X 10.5, 10.6, 10.7 and 10.8.
 dnl This hack works around it. Ugly.
 case $host_alias in
-*darwin9*|*darwin10*)
+*darwin9*|*darwin10*|*darwin11*|*darwin12*)
   ac_cv_exeext=
   ;;
 esac

ext/curl/interface.c

@@ -1610,9 +1610,9 @@ PHP_FUNCTION(curl_copy_handle)
 	dupch->uses = 0;
 	ch->uses++;
 	if (ch->handlers->write->stream) {
-		Z_ADDREF_P(dupch->handlers->write->stream);
-		dupch->handlers->write->stream = ch->handlers->write->stream;
+		Z_ADDREF_P(ch->handlers->write->stream);
 	}
+	dupch->handlers->write->stream = ch->handlers->write->stream;
 	dupch->handlers->write->method = ch->handlers->write->method;
 	dupch->handlers->write->type   = ch->handlers->write->type;
 	if (ch->handlers->read->stream) {

ext/curl/tests/bug62839.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Bug #62839 (curl_copy_handle segfault with CURLOPT_FILE)
+--SKIPIF--
+<?php if (!extension_loaded("curl")) print "skip"; 
+?>
+--FILE--
+<?php
+$curl = curl_init();
+
+$fd = fopen('/tmp/test', 'wb');
+curl_setopt($curl, CURLOPT_FILE, $fd);
+
+curl_copy_handle($curl);
+
+echo 'DONE!';
+?>
+--EXPECTF--
+DONE!

ext/date/php_date.c

@@ -2544,6 +2544,9 @@ static int php_date_initialize_from_hash(zval **return_value, php_date_obj **dat
 		if (zend_hash_find(myht, "timezone_type", 14, (void**) &z_timezone_type) == SUCCESS) {
 			convert_to_long(*z_timezone_type);
 			if (zend_hash_find(myht, "timezone", 9, (void**) &z_timezone) == SUCCESS) {
+				zend_error_handling error_handling;
+
+				zend_replace_error_handling(EH_THROW, NULL, &error_handling TSRMLS_CC);
 				convert_to_string(*z_timezone);
 
 				switch (Z_LVAL_PP(z_timezone_type)) {
@@ -2551,9 +2554,9 @@ static int php_date_initialize_from_hash(zval **return_value, php_date_obj **dat
 					case TIMELIB_ZONETYPE_ABBR: {
 						char *tmp = emalloc(Z_STRLEN_PP(z_date) + Z_STRLEN_PP(z_timezone) + 2);
 						snprintf(tmp, Z_STRLEN_PP(z_date) + Z_STRLEN_PP(z_timezone) + 2, "%s %s", Z_STRVAL_PP(z_date), Z_STRVAL_PP(z_timezone));
-						php_date_initialize(*dateobj, tmp, Z_STRLEN_PP(z_date) + Z_STRLEN_PP(z_timezone) + 1, NULL, NULL, 0 TSRMLS_CC);
+						php_date_initialize(*dateobj, tmp, Z_STRLEN_PP(z_date) + Z_STRLEN_PP(z_timezone) + 1, NULL, NULL, 1 TSRMLS_CC);
 						efree(tmp);
-						return 1;
+						break;
 					}
 
 					case TIMELIB_ZONETYPE_ID:
@@ -2567,10 +2570,15 @@ static int php_date_initialize_from_hash(zval **return_value, php_date_obj **dat
 						tzobj->tzi.tz = tzi;
 						tzobj->initialized = 1;
 
-						php_date_initialize(*dateobj, Z_STRVAL_PP(z_date), Z_STRLEN_PP(z_date), NULL, tmp_obj, 0 TSRMLS_CC);
+						php_date_initialize(*dateobj, Z_STRVAL_PP(z_date), Z_STRLEN_PP(z_date), NULL, tmp_obj, 1 TSRMLS_CC);
 						zval_ptr_dtor(&tmp_obj);
-						return 1;
+						break;
+					default:
+						zend_restore_error_handling(&error_handling TSRMLS_CC);
+						return 0;
 				}
+				zend_restore_error_handling(&error_handling TSRMLS_CC);
+				return 1;
 			}
 		}
 	}

ext/date/tests/bug62852.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Bug #62852 (Unserialize invalid DateTime causes crash)
+--INI--
+date.timezone=GMT
+--FILE--
+<?php
+try {
+	$datetime = unserialize('O:8:"DateTime":3:{s:4:"date";s:20:"10007-06-07 03:51:49";s:13:"timezone_type";i:3;s:8:"timezone";s:3:"UTC";}');
+	var_dump($datetime);	
+} catch (Exception $e) {
+    var_dump($e->getMessage());
+}
+?>
+--EXPECTF--
+string(%d) "DateTime::__wakeup(): Failed to parse time string (%s) at position 12 (0): Double time specification"

ext/dom/documenttype.c

@@ -205,7 +205,11 @@ int dom_documenttype_internal_subset_read(dom_object *obj, zval **retval TSRMLS_
 		if (buff != NULL) {
 			xmlNodeDumpOutput (buff, NULL, (xmlNodePtr) intsubset, 0, 0, NULL);
 			xmlOutputBufferFlush(buff);
+#ifdef LIBXML2_NEW_BUFFER
+			ZVAL_STRINGL(*retval, xmlOutputBufferGetContent(buff), xmlOutputBufferGetSize(buff), 1);
+#else
 			ZVAL_STRINGL(*retval, buff->buffer->content, buff->buffer->use, 1);
+#endif
 			(void)xmlOutputBufferClose(buff);
 			return SUCCESS;
 		}

ext/dom/element.c

@@ -832,7 +832,7 @@ PHP_FUNCTION(dom_element_set_attribute_ns)
 			}
 
 			if (errorcode == 0 && is_xmlns == 0) {
-				attr = xmlSetNsProp(elemp, nsptr, (xmlChar *)localname, (xmlChar *)value);
+				xmlSetNsProp(elemp, nsptr, (xmlChar *)localname, (xmlChar *)value);
 			}
 		} else {
 			name_valid = xmlValidateName((xmlChar *) localname, 0);
@@ -844,7 +844,7 @@ PHP_FUNCTION(dom_element_set_attribute_ns)
 				if (attr != NULL && attr->type != XML_ATTRIBUTE_DECL) {
 					node_list_unlink(attr->children TSRMLS_CC);
 				}
-				attr = xmlSetProp(elemp, (xmlChar *)localname, (xmlChar *)value);
+				xmlSetProp(elemp, (xmlChar *)localname, (xmlChar *)value);
 			}
 		}
 	}

ext/dom/node.c

@@ -1895,9 +1895,17 @@ static void dom_canonicalization(INTERNAL_FUNCTION_PARAMETERS, int mode) /* {{{
         RETVAL_FALSE;
     } else {
 		if (mode == 0) {
+#ifdef LIBXML2_NEW_BUFFER
+			ret = xmlOutputBufferGetSize(buf);
+#else
 			ret = buf->buffer->use;
+#endif
 			if (ret > 0) {
+#ifdef LIBXML2_NEW_BUFFER
+				RETVAL_STRINGL((char *) xmlOutputBufferGetContent(buf), ret, 1);
+#else
 				RETVAL_STRINGL((char *) buf->buffer->content, ret, 1);
+#endif
 			} else {
 				RETVAL_EMPTY_STRING();
 			}

ext/enchant/enchant.c

@@ -729,6 +729,7 @@ PHP_FUNCTION(enchant_dict_quick_check)
 
 	if (sugg) {
 		zval_dtor(sugg);
+		array_init(sugg);
 	}
 
 	PHP_ENCHANT_GET_DICT;
@@ -742,8 +743,6 @@ PHP_FUNCTION(enchant_dict_quick_check)
 			RETURN_FALSE;
 		}
 
-		array_init(sugg);
-
 		suggs = enchant_dict_suggest(pdict->pdict, word, wordlen, &n_sugg_st);
 		memcpy(&n_sugg, &n_sugg_st, sizeof(n_sugg));
 		if (suggs && n_sugg) {

ext/exif/tests/bug60150.phpt

@@ -12,7 +12,7 @@ var_dump(exif_read_data($infile));
 ?>
 ===DONE===
 --EXPECTF--
-Warning: exif_read_data(bug60150.jpg): Process tag(x9003=DateTimeOri): Illegal pointer offset(x%x + x%x = x%x > x%x) in %s on line %d
+Warning: exif_read_data(bug60150.jpg): Process tag(x9003=DateTimeOri): Illegal pointer offset(%s) in %s on line %d
 
 Warning: exif_read_data(bug60150.jpg): Error reading from file: got=x%x(=%d) != itemlen-%d=x%x(=%d) in %s on line %d
 

ext/fileinfo/fileinfo.c

@@ -271,7 +271,7 @@ ZEND_GET_MODULE(fileinfo)
 PHP_MINFO_FUNCTION(fileinfo)
 {
 	php_info_print_table_start();
-	php_info_print_table_header(2, "fileinfo support", "enabled");
+	php_info_print_table_row(2, "fileinfo support", "enabled");
 	php_info_print_table_row(2, "version", PHP_FILEINFO_VERSION);
 	php_info_print_table_end();
 }

ext/intl/collator/collator_class.h

@@ -20,8 +20,9 @@
 
 #include <php.h>
 
-#include "intl_common.h"
-#include "intl_error.h"
+#include "../intl_common.h"
+#include "../intl_error.h"
+#include "../intl_data.h"
 
 #include <unicode/ucol.h>
 
@@ -54,9 +55,7 @@ extern zend_class_entry *Collator_ce_ptr;
     Collator_object*  co      = NULL;   \
     intl_error_reset( NULL TSRMLS_CC ); \
 
-#define COLLATOR_METHOD_FETCH_OBJECT                                           \
-    co = (Collator_object *) zend_object_store_get_object( object TSRMLS_CC ); \
-    intl_error_reset( COLLATOR_ERROR_P( co ) TSRMLS_CC );                      \
+#define COLLATOR_METHOD_FETCH_OBJECT	INTL_METHOD_FETCH_OBJECT(Collator, co)
 
 // Macro to check return value of a ucol_* function call.
 #define COLLATOR_CHECK_STATUS( co, msg )                                        \

ext/intl/collator/collator_create.c

@@ -45,7 +45,7 @@ static void collator_ctor(INTERNAL_FUNCTION_PARAMETERS)
 	}
 
 	INTL_CHECK_LOCALE_LEN_OBJ(locale_len, return_value);
-	co = (Collator_object *) zend_object_store_get_object( object TSRMLS_CC );
+	COLLATOR_METHOD_FETCH_OBJECT;
 
 	if(locale_len == 0) {
 		locale = INTL_G(default_locale);

ext/intl/dateformat/dateformat.c

@@ -108,7 +108,7 @@ static void datefmt_ctor(INTERNAL_FUNCTION_PARAMETERS)
 		goto error;
 	}
 	
-	DATE_FORMAT_METHOD_FETCH_OBJECT;
+	DATE_FORMAT_METHOD_FETCH_OBJECT_NO_CHECK;
 	
 	if (DATE_FORMAT_OBJECT(dfo) != NULL) {
 		intl_errors_set(INTL_DATA_ERROR_P(dfo), U_ILLEGAL_ARGUMENT_ERROR,

ext/intl/dateformat/dateformat_attr.c

@@ -17,8 +17,9 @@
 #include "config.h"
 #endif
 
-#include "php_intl.h"
-#include "intl_convert.h"
+#include "../php_intl.h"
+#include "dateformat_class.h"
+#include "../intl_convert.h"
 #include "dateformat_class.h"
 #include "dateformat_attr.h"
 

ext/intl/dateformat/dateformat_class.c

@@ -23,6 +23,8 @@
 #include "dateformat.h"
 #include "dateformat_attr.h"
 
+#include <zend_exceptions.h>
+
 zend_class_entry *IntlDateFormatter_ce_ptr = NULL;
 static zend_object_handlers IntlDateFormatter_handlers;
 
@@ -87,18 +89,23 @@ zend_object_value IntlDateFormatter_object_clone(zval *object TSRMLS_DC)
 	zend_object_handle handle = Z_OBJ_HANDLE_P(object);
 	IntlDateFormatter_object *dfo, *new_dfo;
 
-	DATE_FORMAT_METHOD_FETCH_OBJECT;
+	DATE_FORMAT_METHOD_FETCH_OBJECT_NO_CHECK;
+
 	new_obj_val = IntlDateFormatter_ce_ptr->create_object(IntlDateFormatter_ce_ptr TSRMLS_CC);
 	new_dfo = (IntlDateFormatter_object *)zend_object_store_get_object_by_handle(new_obj_val.handle TSRMLS_CC);
 	/* clone standard parts */	
 	zend_objects_clone_members(&new_dfo->zo, new_obj_val, &dfo->zo, handle TSRMLS_CC);
 	/* clone formatter object */
-	DATE_FORMAT_OBJECT(new_dfo) = udat_clone(DATE_FORMAT_OBJECT(dfo),  &INTL_DATA_ERROR_CODE(new_dfo));
-	if(U_FAILURE(INTL_DATA_ERROR_CODE(new_dfo))) {
+	if (dfo->datef_data.udatf != NULL) {
+		DATE_FORMAT_OBJECT(new_dfo) = udat_clone(DATE_FORMAT_OBJECT(dfo),  &INTL_DATA_ERROR_CODE(dfo));
+		if (U_FAILURE(INTL_DATA_ERROR_CODE(dfo))) {
 			/* set up error in case error handler is interested */
-		intl_error_set( NULL, INTL_DATA_ERROR_CODE(new_dfo), "Failed to clone IntlDateFormatter object", 0 TSRMLS_CC );
-		IntlDateFormatter_object_dtor(new_dfo, new_obj_val.handle TSRMLS_CC); /* free new object */
-		zend_error(E_ERROR, "Failed to clone IntlDateFormatter object");
+			intl_errors_set(INTL_DATA_ERROR_P(dfo), INTL_DATA_ERROR_CODE(dfo),
+					"Failed to clone IntlDateFormatter object", 0 TSRMLS_CC );
+			zend_throw_exception(NULL, "Failed to clone IntlDateFormatter object", 0 TSRMLS_CC);
+		}
+	} else {
+		zend_throw_exception(NULL, "Cannot clone unconstructed IntlDateFormatter", 0 TSRMLS_CC);
 	}
 	return new_obj_val;
 }

ext/intl/dateformat/dateformat_class.h

@@ -38,7 +38,15 @@ extern zend_class_entry *IntlDateFormatter_ce_ptr;
 /* Auxiliary macros */
 
 #define DATE_FORMAT_METHOD_INIT_VARS	INTL_METHOD_INIT_VARS(IntlDateFormatter, dfo)
-#define DATE_FORMAT_METHOD_FETCH_OBJECT	INTL_METHOD_FETCH_OBJECT(IntlDateFormatter, dfo)
+#define DATE_FORMAT_METHOD_FETCH_OBJECT_NO_CHECK	INTL_METHOD_FETCH_OBJECT(IntlDateFormatter, dfo)
+#define DATE_FORMAT_METHOD_FETCH_OBJECT				\
+		DATE_FORMAT_METHOD_FETCH_OBJECT_NO_CHECK;	\
+	if (dfo->datef_data.udatf == NULL)				\
+	{												\
+		intl_errors_set(&dfo->datef_data.error, U_ILLEGAL_ARGUMENT_ERROR, "Found unconstructed IntlDateFormatter", 0 TSRMLS_CC); \
+		RETURN_FALSE;								\
+	}
+
 #define DATE_FORMAT_OBJECT(dfo)		(dfo)->datef_data.udatf
 
 #endif // #ifndef DATE_FORMAT_CLASS_H

ext/intl/formatter/formatter_class.c

@@ -24,6 +24,8 @@
 #include "formatter_main.h"
 #include "formatter_attr.h"
 
+#include <zend_exceptions.h>
+
 zend_class_entry *NumberFormatter_ce_ptr = NULL;
 static zend_object_handlers NumberFormatter_handlers;
 
@@ -82,18 +84,23 @@ zend_object_value NumberFormatter_object_clone(zval *object TSRMLS_DC)
 	zend_object_handle handle = Z_OBJ_HANDLE_P(object);
 	NumberFormatter_object *nfo, *new_nfo;
 
-	FORMATTER_METHOD_FETCH_OBJECT;
+	FORMATTER_METHOD_FETCH_OBJECT_NO_CHECK;
 	new_obj_val = NumberFormatter_ce_ptr->create_object(NumberFormatter_ce_ptr TSRMLS_CC);
 	new_nfo = (NumberFormatter_object *)zend_object_store_get_object_by_handle(new_obj_val.handle TSRMLS_CC);
 	/* clone standard parts */	
 	zend_objects_clone_members(&new_nfo->zo, new_obj_val, &nfo->zo, handle TSRMLS_CC);
-	/* clone formatter object */
-	FORMATTER_OBJECT(new_nfo) = unum_clone(FORMATTER_OBJECT(nfo),  &INTL_DATA_ERROR_CODE(new_nfo));
-	if(U_FAILURE(INTL_DATA_ERROR_CODE(new_nfo))) {
+	/* clone formatter object. It may fail, the destruction code must handle this case */
+	if (FORMATTER_OBJECT(nfo) != NULL) {
+		FORMATTER_OBJECT(new_nfo) = unum_clone(FORMATTER_OBJECT(nfo),
+				&INTL_DATA_ERROR_CODE(nfo));
+		if (U_FAILURE(INTL_DATA_ERROR_CODE(nfo))) {
 			/* set up error in case error handler is interested */
-		intl_error_set( NULL, INTL_DATA_ERROR_CODE(new_nfo), "Failed to clone NumberFormatter object", 0 TSRMLS_CC );
-		NumberFormatter_object_dtor(new_nfo, new_obj_val.handle TSRMLS_CC); /* free new object */
-		zend_error(E_ERROR, "Failed to clone NumberFormatter object");
+			intl_errors_set(INTL_DATA_ERROR_P(nfo), INTL_DATA_ERROR_CODE(nfo),
+					"Failed to clone NumberFormatter object", 0 TSRMLS_CC);
+			zend_throw_exception(NULL, "Failed to clone NumberFormatter object", 0 TSRMLS_CC);
+		}
+	} else {
+		zend_throw_exception(NULL, "Cannot clone unconstructed NumberFormatter", 0 TSRMLS_CC);
 	}
 	return new_obj_val;
 }

ext/intl/formatter/formatter_class.h

@@ -35,7 +35,16 @@ extern zend_class_entry *NumberFormatter_ce_ptr;
 /* Auxiliary macros */
 
 #define FORMATTER_METHOD_INIT_VARS				INTL_METHOD_INIT_VARS(NumberFormatter, nfo)
-#define FORMATTER_METHOD_FETCH_OBJECT	INTL_METHOD_FETCH_OBJECT(NumberFormatter, nfo)                                                
 #define FORMATTER_OBJECT(nfo)					(nfo)->nf_data.unum
+#define FORMATTER_METHOD_FETCH_OBJECT_NO_CHECK	INTL_METHOD_FETCH_OBJECT(NumberFormatter, nfo)
+#define FORMATTER_METHOD_FETCH_OBJECT \
+	FORMATTER_METHOD_FETCH_OBJECT_NO_CHECK; \
+	if (FORMATTER_OBJECT(nfo) == NULL) \
+	{ \
+		intl_errors_set(&nfo->nf_data.error, U_ILLEGAL_ARGUMENT_ERROR, \
+				"Found unconstructed NumberFormatter", 0 TSRMLS_CC); \
+		RETURN_FALSE; \
+	}
+
 
 #endif // #ifndef FORMATTER_CLASS_H

ext/intl/formatter/formatter_main.c

@@ -47,7 +47,7 @@ static void numfmt_ctor(INTERNAL_FUNCTION_PARAMETERS)
 
 	INTL_CHECK_LOCALE_LEN_OBJ(locale_len, return_value);
 	object = return_value;
-	FORMATTER_METHOD_FETCH_OBJECT;
+	FORMATTER_METHOD_FETCH_OBJECT_NO_CHECK;
 
 	/* Convert pattern (if specified) to UTF-16. */
 	if(pattern && pattern_len) {