[packages/php/PHP_5_6] Security backports
arekm
arekm at pld-linux.org
Wed Oct 21 18:51:07 CEST 2026
commit 96b88e9f80a1774d03670f38e899d5553ef78bbf
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date: Wed Oct 21 18:42:53 2026 +0200
Security backports
CVE-2019-9022, CVE-2019-9637, CVE-2019-9638, CVE-2019-9639,
CVE-2019-9640, CVE-2019-9675, CVE-2019-11034, CVE-2019-11035,
CVE-2019-11036, CVE-2019-11039, CVE-2019-11040, CVE-2019-11041,
CVE-2019-11042, CVE-2019-11044, CVE-2019-11045, CVE-2019-11046,
CVE-2019-11047, CVE-2019-11048, CVE-2019-11050, CVE-2019-13224,
CVE-2019-18218, CVE-2020-7059, CVE-2020-7060, CVE-2020-7062,
CVE-2020-7063, CVE-2020-7064, CVE-2020-7066, CVE-2020-7067,
CVE-2020-7068, CVE-2020-7070, CVE-2020-7071, CVE-2021-21702,
CVE-2021-21703, CVE-2021-21704, CVE-2021-21705, CVE-2021-21707,
CVE-2022-31625, CVE-2022-31626, CVE-2022-31628, CVE-2022-31629,
CVE-2022-31631, CVE-2023-0567, CVE-2023-0568, CVE-2023-0662,
CVE-2023-3247, CVE-2023-3823, CVE-2023-3824, CVE-2024-2756,
CVE-2024-3096, CVE-2024-4577, CVE-2024-5458, CVE-2024-8925,
CVE-2024-8926, CVE-2024-8927, CVE-2024-8929, CVE-2024-8932,
CVE-2024-11233, CVE-2024-11234, CVE-2024-11236, CVE-2025-1217,
CVE-2025-1218, CVE-2025-1219, CVE-2025-1220, CVE-2025-1734,
CVE-2025-1735, CVE-2025-1736, CVE-2025-1861, CVE-2025-6491,
CVE-2025-14177, CVE-2025-14181, CVE-2026-6103, CVE-2026-6722,
CVE-2026-6735, CVE-2026-7258, CVE-2026-7260, CVE-2026-7261,
CVE-2026-7262, CVE-2026-9672, CVE-2026-14355, CVE-2026-17543,
CVE-2026-91765, CVE-2026-91766, CVE-2026-91767, CVE-2026-91768,
CVE-2026-91769, CVE-2026-92842, CVE-2026-93682, CVE-2026-109618,
CVE-2026-109619
php-bug47925.patch | 40 +
php-bug69899.patch | 72 +
php-bug75457.patch | 86 +
php-bug76450.patch | 412 +++++
php-bug77396.patch | 76 +
php-bug77423.patch | 415 +++++
php-bug77431.patch | 66 +
php-bug77540.patch | 101 ++
php-bug77563.patch | 39 +
php-bug77586.patch | 102 ++
php-bug77630.patch | 86 +
php-bug77753.patch | 34 +
php-bug77831.patch | 196 +++
php-bug77919.patch | 52 +
php-bug77950.patch | 39 +
php-bug77967.patch | 32 +
php-bug77988.patch | 34 +
php-bug78069.patch | 36 +
php-bug78222.patch | 32 +
php-bug78256.patch | 47 +
php-bug78380.patch | 59 +
php-bug78793.patch | 47 +
php-bug78862.patch | 53 +
php-bug78863.patch | 72 +
php-bug78875.patch | 50 +
php-bug78878.patch | 51 +
php-bug78910.patch | 133 ++
php-bug79037.patch | 73 +
php-bug79082.patch | 133 ++
php-bug79099.patch | 113 ++
php-bug79221.patch | 86 +
php-bug79282.patch | 113 ++
php-bug79329.patch | 38 +
php-bug79330.patch | 58 +
php-bug79465.patch | 42 +
php-bug79699.patch | 125 ++
php-bug79797.patch | 35 +
php-bug79877.patch | 69 +
php-bug79971.patch | 216 +++
php-bug80672.patch | 223 +++
php-bug80710.patch | 355 ++++
php-bug81026.patch | 415 +++++
php-bug81122.patch | 88 +
php-bug81211.patch | 148 ++
php-bug81719.patch | 47 +
php-bug81720.patch | 80 +
php-bug81726.patch | 147 ++
php-bug81727.patch | 64 +
php-bug81740.patch | 95 ++
php-bug81744.patch | 190 +++
php-bug81746.patch | 81 +
php-cve-2019-9022.patch | 15 +
php-cve-2023-0662.patch | 120 ++
php-cve-2023-3247.patch | 44 +
php-cve-2023-3823.patch | 96 ++
php-cve-2023-3824.patch | 427 +++++
php-cve-2024-11233.patch | 166 ++
php-cve-2024-11234.patch | 112 ++
php-cve-2024-11236.patch | 98 ++
php-cve-2024-2756.patch | 186 ++
php-cve-2024-3096.patch | 79 +
php-cve-2024-5458.patch | 247 +++
php-cve-2024-8925.patch | 245 +++
php-cve-2024-8926.patch | 215 +++
php-cve-2024-8927.patch | 80 +
php-cve-2024-8929.patch | 2309 +++++++++++++++++++++++++
php-cve-2024-8932.patch | 131 ++
php-cve-2025-1217.patch | 908 ++++++++++
php-cve-2025-1218.patch | 3310 ++++++++++++++++++++++++++++++++++++
php-cve-2025-1219.patch | 442 +++++
php-cve-2025-1220.patch | 152 ++
php-cve-2025-14177.patch | 127 ++
php-cve-2025-14181.patch | 65 +
php-cve-2025-1734.patch | 232 +++
php-cve-2025-1735.patch | 447 +++++
php-cve-2025-1736.patch | 631 +++++++
php-cve-2025-1861.patch | 342 ++++
php-cve-2025-6491.patch | 37 +
php-cve-2026-109618.patch | 604 +++++++
php-cve-2026-14355.patch | 106 ++
php-cve-2026-17543.patch | 219 +++
php-cve-2026-6103.patch | 398 +++++
php-cve-2026-6722.patch | 212 +++
php-cve-2026-6735.patch | 211 +++
php-cve-2026-7258.patch | 41 +
php-cve-2026-7260.patch | 172 ++
php-cve-2026-7261.patch | 150 ++
php-cve-2026-7262.patch | 102 ++
php-cve-2026-91765.patch | 444 +++++
php-cve-2026-91766.patch | 373 ++++
php-cve-2026-91767.patch | 120 ++
php-cve-2026-91768.patch | 165 ++
php-cve-2026-91769.patch | 403 +++++
php-cve-2026-92842.patch | 80 +
php-cve-2026-93682.patch | 129 ++
php-cve-2026-9672.patch | 108 ++
php-gh22761.patch | 82 +
php-ghsa-4w77-75f9-2c8w.patch | 101 ++
php-ghsa-ch8v-r6jh-4vvr.patch | 47 +
php-ghsa-www2-q4fc-65wf.patch | 325 ++++
php-libmagic-cve-2019-18218.patch | 37 +
php-mysqlnd-row-uninit-free.patch | 94 +
php-sqlite3-defensive.patch | 151 ++
php-systzdata.patch | 2 +-
php-tests-http-server-8.0.patch | 140 ++
php-tests-openssl-server-8.1.patch | 218 +++
php.spec | 227 ++-
types.patch | 40 -
108 files changed, 22217 insertions(+), 43 deletions(-)
---
diff --git a/php.spec b/php.spec
index dd3f4b7..5fa3612 100644
--- a/php.spec
+++ b/php.spec
@@ -155,7 +155,7 @@ ERROR: You need to select at least one Apache SAPI to build shared modules.
%undefine with_filter
%endif
-%define rel 40
+%define rel 41
%define orgname php
%define ver_suffix 56
%define php_suffix %{!?with_default_php:%{ver_suffix}}
@@ -174,7 +174,7 @@ Epoch: 4
# TSRM is licensed under BSD
License: PHP 3.01 and Zend and BSD
Group: Libraries
-Source0: http://www.php.net/distributions/%{orgname}-%{version}.tar.xz
+Source0: https://www.php.net/distributions/%{orgname}-%{version}.tar.xz
# Source0-md5: c7dde3afb16ce7b761abf2805125d372
Source2: %{orgname}-mod_%{orgname}.conf
Source3: %{orgname}-cgi-fcgi.ini
@@ -251,6 +251,124 @@ Patch77: libxml2.patch
Patch78: configure.patch
Patch79: types.patch
Patch80: includes.patch
+# Patch200+: security backports for EOL 5.6 by Remi Collet, numbered as in
+# https://git.remirepo.net/cgit/rpms/scl-php56/php.git/tree/php.spec
+# with NEWS hunks dropped; his php-bug78599.patch is Patch68 here
+Patch208: php-bug77396.patch
+Patch209: php-bug77431.patch
+Patch210: php-bug77540.patch
+Patch211: php-bug77563.patch
+Patch212: php-bug77586.patch
+Patch213: php-bug77630.patch
+Patch215: php-sqlite3-defensive.patch
+Patch216: php-bug77753.patch
+Patch217: php-bug77831.patch
+Patch218: php-bug77950.patch
+Patch219: php-bug78069.patch
+Patch220: php-bug77988.patch
+Patch221: php-bug77967.patch
+Patch222: php-bug78222.patch
+Patch223: php-bug78256.patch
+Patch224: php-bug77919.patch
+Patch225: php-bug75457.patch
+Patch226: php-bug78380.patch
+Patch228: php-bug78878.patch
+Patch229: php-bug78862.patch
+Patch230: php-bug78863.patch
+Patch231: php-bug78793.patch
+Patch232: php-bug78910.patch
+Patch233: php-bug79099.patch
+Patch234: php-bug79037.patch
+Patch236: php-bug79221.patch
+Patch237: php-bug79082.patch
+Patch238: php-bug79282.patch
+Patch239: php-bug79329.patch
+Patch240: php-bug79330.patch
+Patch241: php-bug79465.patch
+Patch242: php-bug78875.patch
+Patch243: php-bug79797.patch
+Patch244: php-bug79877.patch
+Patch246: php-bug79699.patch
+Patch247: php-bug77423.patch
+Patch248: php-bug80672.patch
+Patch249: php-bug80710.patch
+Patch250: php-bug81122.patch
+Patch251: php-bug76450.patch
+Patch252: php-bug81211.patch
+Patch253: php-bug81026.patch
+Patch254: php-bug79971.patch
+Patch255: php-bug81719.patch
+Patch256: php-bug81720.patch
+Patch257: php-bug81727.patch
+Patch258: php-bug81726.patch
+Patch259: php-bug81740.patch
+Patch260: php-bug81744.patch
+Patch261: php-bug81746.patch
+Patch262: php-cve-2023-0662.patch
+Patch263: php-cve-2023-3247.patch
+# Remi's 2023-3823 and 2023-3824 file names are swapped: 264 is the phar fix, 265 the libxml one
+Patch264: php-cve-2023-3823.patch
+Patch265: php-cve-2023-3824.patch
+Patch266: php-cve-2024-2756.patch
+Patch267: php-cve-2024-3096.patch
+Patch268: php-cve-2024-5458.patch
+Patch269: php-cve-2024-8925.patch
+Patch270: php-cve-2024-8926.patch
+Patch271: php-cve-2024-8927.patch
+Patch273: php-cve-2024-11234.patch
+Patch274: php-cve-2024-8932.patch
+Patch275: php-cve-2024-11233.patch
+Patch276: php-ghsa-4w77-75f9-2c8w.patch
+Patch277: php-cve-2026-7261.patch
+Patch278: php-cve-2026-7262.patch
+Patch279: php-cve-2026-6735.patch
+Patch280: php-cve-2026-14355.patch
+# Patch300+: security backports for EOL 5.6 by Freexian ELTS, from php5 5.6.40+dfsg-0+deb8u23
+# https://deb.freexian.com/extended-lts/pool/main/p/php5/
+# https://github.com/php/php-src/commit/8d3dfabef459fe7815e8ea2fd68753fd17859d7b
+Patch300: php-cve-2019-9022.patch
+# bundled libmagic: https://github.com/file/file/commit/46a8443f76cec4b41ec736eca396984c74664f84
+Patch301: php-libmagic-cve-2019-18218.patch
+Patch302: php-cve-2024-11236.patch
+Patch303: php-cve-2024-8929.patch
+Patch304: php-bug69899.patch
+# test-only: ServerClientTestCase and server-8.0.inc used by the CVE-2025 http tests
+Patch305: php-tests-http-server-8.0.patch
+Patch306: php-tests-openssl-server-8.1.patch
+Patch307: php-cve-2025-1217.patch
+Patch308: php-cve-2025-1219.patch
+Patch309: php-cve-2025-1734.patch
+Patch310: php-cve-2025-1736.patch
+Patch311: php-cve-2025-1861.patch
+# CVE-2026-109618, CVE-2026-109619: upstream minimal mitigation for EOL branches, 5.6 port from
+# https://github.com/shivammathur/php-src-backports/commit/b18ab39d35ca71365193143283fa621d45628156
+Patch400: php-cve-2026-109618.patch
+# Patch410+: 5.6 ports of upstream fixes no 5.6 tree carries; each names its upstream commit
+Patch410: php-cve-2025-1220.patch
+Patch411: php-ghsa-www2-q4fc-65wf.patch
+Patch412: php-cve-2026-7258.patch
+Patch413: php-cve-2026-92842.patch
+Patch414: php-ghsa-ch8v-r6jh-4vvr.patch
+Patch415: php-cve-2026-91766.patch
+Patch416: php-cve-2026-93682.patch
+Patch417: php-cve-2026-91769.patch
+Patch418: php-cve-2026-91767.patch
+Patch419: php-cve-2026-91768.patch
+Patch420: php-cve-2026-6103.patch
+Patch421: php-cve-2026-7260.patch
+Patch422: php-cve-2026-9672.patch
+Patch423: php-cve-2025-14177.patch
+Patch424: php-cve-2025-1735.patch
+Patch425: php-cve-2026-17543.patch
+Patch426: php-cve-2025-1218.patch
+Patch427: php-cve-2025-14181.patch
+Patch428: php-cve-2026-6722.patch
+Patch429: php-cve-2026-91765.patch
+Patch430: php-cve-2025-6491.patch
+Patch431: php-bug47925.patch
+Patch432: php-gh22761.patch
+# PLD-only: text-protocol row fields left untyped when decoding fails, then freed (5.6-specific code)
+Patch433: php-mysqlnd-row-uninit-free.patch
URL: https://www.php.net/
%{?with_interbase:%{!?with_interbase_inst:BuildRequires: Firebird-devel >= 1.0.2.908-2}}
%{?with_pspell:BuildRequires: aspell-devel >= 2:0.50.0}
@@ -2192,6 +2310,111 @@ exit 1
%patch -P78 -p1
%patch -P79 -p1
%patch -P80 -p1
+%patch -P208 -p1
+%patch -P209 -p1
+%patch -P210 -p1
+%patch -P211 -p1
+%patch -P212 -p1
+%patch -P213 -p1
+%patch -P215 -p1
+%patch -P216 -p1
+%patch -P217 -p1
+%patch -P218 -p1
+%patch -P219 -p1
+%patch -P220 -p1
+%patch -P221 -p1
+%patch -P222 -p1
+%patch -P223 -p1
+%patch -P224 -p1
+%patch -P225 -p1
+%patch -P226 -p1
+%patch -P228 -p1
+%patch -P229 -p1
+%patch -P230 -p1
+%patch -P231 -p1
+%patch -P232 -p1
+%patch -P233 -p1
+%patch -P234 -p1
+%patch -P236 -p1
+%patch -P237 -p1
+%patch -P238 -p1
+%patch -P239 -p1
+%patch -P240 -p1
+%patch -P241 -p1
+%patch -P242 -p1
+%patch -P243 -p1
+%patch -P244 -p1
+%patch -P246 -p1
+%patch -P247 -p1
+%patch -P248 -p1
+%patch -P249 -p1
+%patch -P250 -p1
+%patch -P251 -p1
+%patch -P252 -p1
+%patch -P253 -p1
+%patch -P254 -p1
+%patch -P255 -p1
+%patch -P256 -p1
+%patch -P257 -p1
+%patch -P258 -p1
+%patch -P259 -p1
+%patch -P260 -p1
+%patch -P261 -p1
+%patch -P262 -p1
+%patch -P263 -p1
+%patch -P264 -p1
+%patch -P265 -p1
+%patch -P266 -p1
+%patch -P267 -p1
+%patch -P268 -p1
+%patch -P269 -p1
+%patch -P270 -p1
+%patch -P271 -p1
+%patch -P273 -p1
+%patch -P274 -p1
+%patch -P275 -p1
+%patch -P276 -p1
+%patch -P277 -p1
+%patch -P278 -p1
+%patch -P279 -p1
+%patch -P280 -p1
+%patch -P300 -p1
+%patch -P301 -p1
+%patch -P302 -p1
+%patch -P303 -p1
+%patch -P304 -p1
+%patch -P305 -p1
+%patch -P306 -p1
+%patch -P307 -p1
+%patch -P308 -p1
+%patch -P309 -p1
+%patch -P310 -p1
+%patch -P311 -p1
+%patch -P400 -p1
+%patch -P410 -p1
+%patch -P411 -p1
+%patch -P412 -p1
+%patch -P413 -p1
+%patch -P414 -p1
+%patch -P415 -p1
+%patch -P416 -p1
+%patch -P417 -p1
+%patch -P418 -p1
+%patch -P419 -p1
+%patch -P420 -p1
+%patch -P421 -p1
+%patch -P422 -p1
+%patch -P423 -p1
+%patch -P424 -p1
+%patch -P425 -p1
+%patch -P426 -p1
+%patch -P427 -p1
+%patch -P428 -p1
+%patch -P429 -p1
+%patch -P430 -p1
+%patch -P431 -p1
+%patch -P432 -p1
+%patch -P433 -p1
sed -E -i -e '1s,#!\s*/usr/bin/env\s+(.*),#!%{__bindir}\1,' \
run-tests.php
diff --git a/php-bug47925.patch b/php-bug47925.patch
new file mode 100644
index 0000000..01a3a8c
--- /dev/null
+++ b/php-bug47925.patch
@@ -0,0 +1,40 @@
+From 582b22583f53fcfeea4ba397cd8b2295bdb40dfb Mon Sep 17 00:00:00 2001
+From: Niels Dossche <7771979+nielsdos at users.noreply.github.com>
+Date: Sat, 25 May 2024 16:11:43 +0200
+Subject: [PATCH] Fix bug #47925: PHPClient can't decompress response
+
+Backport of https://github.com/php/php-src/commit/35e62e9b590690f24fe78e3097d5bddcfb913e61
+and https://github.com/php/php-src/commit/ce7ed6e040f4c57604a19e6a7d2ed5e401f6f02d
+(net effect: gzip bodies go to gzdecode() whole, deflate unchanged)
+
+5.6: the old code passed http_body+10 with length http_body_size-10 without
+copying, so a gzip response shorter than 10 bytes gave gzinflate() a
+negative length and inflate() read past the heap buffer. Not an upstream
+advisory; the test needs pcntl and the 8.x server.inc API and is not
+included.
+---
+ ext/soap/php_http.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+diff --git a/ext/soap/php_http.c b/ext/soap/php_http.c
+index f222dcf..e908644 100644
+--- a/ext/soap/php_http.c
++++ b/ext/soap/php_http.c
+@@ -1255,12 +1255,14 @@ try_again:
+ zval param;
+ zval *params[1];
+
++ /* Warning: the zlib function names are chosen in an unfortunate manner.
++ * Check zlib.c to see how a function corresponds with a particular format. */
+ if ((strcmp(content_encoding,"gzip") == 0 ||
+ strcmp(content_encoding,"x-gzip") == 0) &&
+- zend_hash_exists(EG(function_table), "gzinflate", sizeof("gzinflate"))) {
+- ZVAL_STRING(&func, "gzinflate", 0);
++ zend_hash_exists(EG(function_table), "gzdecode", sizeof("gzdecode"))) {
++ ZVAL_STRING(&func, "gzdecode", 0);
+ params[0] = ¶m;
+- ZVAL_STRINGL(params[0], http_body+10, http_body_size-10, 0);
++ ZVAL_STRINGL(params[0], http_body, http_body_size, 0);
+ INIT_PZVAL(params[0]);
+ } else if (strcmp(content_encoding,"deflate") == 0 &&
+ zend_hash_exists(EG(function_table), "gzuncompress", sizeof("gzuncompress"))) {
diff --git a/php-bug69899.patch b/php-bug69899.patch
new file mode 100644
index 0000000..dc2d44d
--- /dev/null
+++ b/php-bug69899.patch
@@ -0,0 +1,72 @@
+From: rfussenegger <richard.fussenegger at trivago.com>
+Date: Fri, 30 Sep 2016 10:49:08 +0200
+Subject: Fix bug #69899
+
+Origin: https://github.com/php/php-src/commit/bd75f9e61375c7632bb55b0d49b470ecd94e8ec7
+Bug: https://bugs.php.net/bug.php?id=69899
+---
+ ext/mysqli/tests/bug69899.phpt | 38 ++++++++++++++++++++++++++++++++++++++
+ ext/mysqlnd/mysqlnd_ps.c | 5 +++--
+ 2 files changed, 41 insertions(+), 2 deletions(-)
+ create mode 100644 ext/mysqli/tests/bug69899.phpt
+
+diff --git a/ext/mysqli/tests/bug69899.phpt b/ext/mysqli/tests/bug69899.phpt
+new file mode 100644
+index 0000000..177b5e3
+--- /dev/null
++++ b/ext/mysqli/tests/bug69899.phpt
+@@ -0,0 +1,38 @@
++--TEST--
++Bug #69899: Segfault on stmt close after free_result with mysqlnd.
++--DESCRIPTION--
++The segfault happens only if the database connection was already closed and
++free_result is called on a prepared statement followed by closing that
++statement. This is due to mysqlnd_stmt::free_result (mysqlnd_ps.c) which
++unconditionally sets the connection of the statement to ready, despite the fact
++that it might already be closed.
++--SKIPIF--
++<?php
++require_once __DIR__ . '/skipif.inc';
++require_once __DIR__ . '/skipifconnectfailure.inc';
++require_once __DIR__ . '/connect.inc';
++if (!$IS_MYSQLND) {
++ die('mysqlnd only');
++}
++?>
++--FILE--
++<?php
++
++require_once __DIR__ . '/connect.inc';
++
++mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);
++
++$mysqli = new mysqli($host, $user, $passwd, $db, $port, $socket);
++$stmt = $mysqli->prepare('SELECT 1');
++
++var_dump(
++ $mysqli->close(),
++ $stmt->free_result(),
++ $stmt->close()
++);
++
++?>
++--EXPECT--
++bool(true)
++NULL
++bool(true)
+diff --git a/ext/mysqlnd/mysqlnd_ps.c b/ext/mysqlnd/mysqlnd_ps.c
+index e3bfc7b..5ed2ff0 100644
+--- a/ext/mysqlnd/mysqlnd_ps.c
++++ b/ext/mysqlnd/mysqlnd_ps.c
+@@ -1975,8 +1975,9 @@ MYSQLND_METHOD(mysqlnd_stmt, free_result)(MYSQLND_STMT * const s TSRMLS_DC)
+ stmt->state = MYSQLND_STMT_PREPARED;
+ }
+
+- /* Line is free! */
+- CONN_SET_STATE(stmt->conn, CONN_READY);
++ if (CONN_GET_STATE(stmt->conn) != CONN_QUIT_SENT) {
++ CONN_SET_STATE(stmt->conn, CONN_READY);
++ }
+
+ DBG_RETURN(PASS);
+ }
diff --git a/php-bug75457.patch b/php-bug75457.patch
new file mode 100644
index 0000000..88a1061
--- /dev/null
+++ b/php-bug75457.patch
@@ -0,0 +1,86 @@
+From 582128d6b5acdef94752cc4ea4a049497067bb38 Mon Sep 17 00:00:00 2001
+From: "Christoph M. Becker" <cmbecker69 at gmx.de>
+Date: Fri, 16 Aug 2019 14:29:19 +0200
+Subject: [PATCH 1/3] Fix #75457: heap-use-after-free in php7.0.25
+
+Backport <https://vcs.pcre.org/pcre?view=revision&revision=1638>.
+
+(cherry picked from commit 7bf1f9d561826c4a3ed748e55bb756375cdf28b9)
+---
+ ext/pcre/pcrelib/pcre_compile.c | 11 ++++++++++-
+ ext/pcre/tests/bug75457.phpt | 10 ++++++++++
+ 2 files changed, 20 insertions(+), 1 deletion(-)
+ create mode 100644 ext/pcre/tests/bug75457.phpt
+
+diff --git a/ext/pcre/pcrelib/pcre_compile.c b/ext/pcre/pcrelib/pcre_compile.c
+index c9171cbee9..1d37671635 100644
+--- a/ext/pcre/pcrelib/pcre_compile.c
++++ b/ext/pcre/pcrelib/pcre_compile.c
+@@ -485,7 +485,7 @@ static const char error_texts[] =
+ "lookbehind assertion is not fixed length\0"
+ "malformed number or name after (?(\0"
+ "conditional group contains more than two branches\0"
+- "assertion expected after (?(\0"
++ "assertion expected after (?( or (?(?C)\0"
+ "(?R or (?[+-]digits must be followed by )\0"
+ /* 30 */
+ "unknown POSIX class name\0"
+@@ -6734,6 +6734,15 @@ for (;; ptr++)
+ for (i = 3;; i++) if (!IS_DIGIT(ptr[i])) break;
+ if (ptr[i] == CHAR_RIGHT_PARENTHESIS)
+ tempptr += i + 1;
++
++ /* tempptr should now be pointing to the opening parenthesis of the
++ assertion condition. */
++
++ if (*tempptr != CHAR_LEFT_PARENTHESIS)
++ {
++ *errorcodeptr = ERR28;
++ goto FAILED;
++ }
+ }
+
+ /* For conditions that are assertions, check the syntax, and then exit
+diff --git a/ext/pcre/tests/bug75457.phpt b/ext/pcre/tests/bug75457.phpt
+new file mode 100644
+index 0000000000..c7ce9ed0f9
+--- /dev/null
++++ b/ext/pcre/tests/bug75457.phpt
+@@ -0,0 +1,10 @@
++--TEST--
++Bug #75457 (heap-use-after-free in php7.0.25)
++--FILE--
++<?php
++$pattern = "/(((?(?C)0?=))(?!()0|.(?0)0)())/";
++var_dump(preg_match($pattern, "hello"));
++?>
++--EXPECTF--
++Warning: preg_match(): Compilation failed: assertion expected after (?( or (?(?C) at offset 4 in %sbug75457.php on line %d
++bool(false)
+--
+2.20.1
+
+From b781eb2900cc0d74e385e704711a0002a9ecc8cb Mon Sep 17 00:00:00 2001
+From: Remi Collet <remi at remirepo.net>
+Date: Wed, 28 Aug 2019 14:34:48 +0200
+Subject: [PATCH] relax test, offset may be different on various system lib
+ versions
+
+---
+ ext/pcre/tests/bug75457.phpt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/ext/pcre/tests/bug75457.phpt b/ext/pcre/tests/bug75457.phpt
+index c7ce9ed0f9..571a4bde77 100644
+--- a/ext/pcre/tests/bug75457.phpt
++++ b/ext/pcre/tests/bug75457.phpt
+@@ -6,5 +6,5 @@ $pattern = "/(((?(?C)0?=))(?!()0|.(?0)0)())/";
+ var_dump(preg_match($pattern, "hello"));
+ ?>
+ --EXPECTF--
+-Warning: preg_match(): Compilation failed: assertion expected after (?( or (?(?C) at offset 4 in %sbug75457.php on line %d
++Warning: preg_match(): Compilation failed: assertion expected after (?( or (?(?C) at offset %d in %sbug75457.php on line %d
+ bool(false)
+--
+2.20.1
+
diff --git a/php-bug76450.patch b/php-bug76450.patch
new file mode 100644
index 0000000..26f3d6d
--- /dev/null
+++ b/php-bug76450.patch
@@ -0,0 +1,412 @@
+From 24dbc542d1ef501479dcd365f1bc53a859981dc0 Mon Sep 17 00:00:00 2001
+From: sim1984 <sim-mail at list.ru>
+Date: Mon, 25 Jun 2018 21:35:51 +0300
+Subject: [PATCH 1/9] Fix bug #76488 Memory leak when fetching a BLOB field
+
+Add a phpt test
+
+(cherry picked from commit 3847a6fcb63c362548e9434b195232f2dcf7a6c7)
+(cherry picked from commit b671a8dd887ae7f661f6233e734179e8bca3daf6)
+---
+ ext/pdo_firebird/firebird_statement.c | 4 ++--
+ ext/pdo_firebird/tests/bug_76488.phpt | 32 +++++++++++++++++++++++++++
+ 2 files changed, 34 insertions(+), 2 deletions(-)
+ create mode 100644 ext/pdo_firebird/tests/bug_76488.phpt
+
+diff --git a/ext/pdo_firebird/firebird_statement.c b/ext/pdo_firebird/firebird_statement.c
+index d1f1012637..8b8f82252a 100644
+--- a/ext/pdo_firebird/firebird_statement.c
++++ b/ext/pdo_firebird/firebird_statement.c
+@@ -267,8 +267,8 @@ static int firebird_fetch_blob(pdo_stmt_t *stmt, int colno, char **ptr, /* {{{ *
+ unsigned short seg_len;
+ ISC_STATUS stat;
+
+- *ptr = S->fetch_buf[colno] = erealloc(*ptr, *len+1);
+-
++ *ptr = S->fetch_buf[colno] = erealloc(S->fetch_buf[colno], *len+1);
++
+ for (cur_len = stat = 0; (!stat || stat == isc_segment) && cur_len < *len; cur_len += seg_len) {
+
+ unsigned short chunk_size = (*len-cur_len) > USHRT_MAX ? USHRT_MAX
+diff --git a/ext/pdo_firebird/tests/bug_76488.phpt b/ext/pdo_firebird/tests/bug_76488.phpt
+new file mode 100644
+index 0000000000..dba6734c28
+--- /dev/null
++++ b/ext/pdo_firebird/tests/bug_76488.phpt
+@@ -0,0 +1,32 @@
++--TEST--
++PDO_Firebird: Bug #76488 Memory leak when fetching a BLOB field
++--SKIPIF--
++<?php if (!extension_loaded('interbase') || !extension_loaded('pdo_firebird')) die('skip'); ?>
++--FILE--
++<?php
++require 'testdb.inc';
++$dbh = new PDO('firebird:dbname='.$test_base, $user, $password) or die;
++
++$sql = '
++with recursive r(n) as (
++ select 1 from rdb$database
++ union all
++ select n+1 from r where n < 1000
++)
++select n,
++ cast(lpad(\'A\', 8000, \'A\') as BLOB sub_type TEXT) as SRC
++from r
++';
++
++ for ($i = 0; $i < 10; $i++) {
++ $sth = $dbh->prepare($sql);
++ $sth->execute();
++ $rows = $sth->fetchAll();
++ unset($rows);
++ unset($sth);
++ }
++ unset($dbh);
++ echo "OK";
++?>
++--EXPECT--
++OK
+\ No newline at end of file
+--
+2.31.1
+
+From 7024ff99e8659d9e2d80299ea35f9a78292fa064 Mon Sep 17 00:00:00 2001
+From: "Christoph M. Becker" <cmbecker69 at gmx.de>
+Date: Wed, 5 May 2021 12:42:17 +0200
+Subject: [PATCH 2/9] Fix #76452: Crash while parsing blob data in
+ firebird_fetch_blob
+
+We need to prevent integer overflow when calling `erealloc()` with
+`len+1`.
+
+(cherry picked from commit 286162e9b03071c4308e7e92597bca4239f49d89)
+---
+ ext/pdo_firebird/firebird_statement.c | 5 +++++
+ ext/pdo_firebird/tests/bug_76452.data | Bin 0 -> 856 bytes
+ ext/pdo_firebird/tests/bug_76452.phpt | 31 ++++++++++++++++++++++++++
+ 3 files changed, 36 insertions(+)
+ create mode 100644 ext/pdo_firebird/tests/bug_76452.data
+ create mode 100644 ext/pdo_firebird/tests/bug_76452.phpt
+
+diff --git a/ext/pdo_firebird/firebird_statement.c b/ext/pdo_firebird/firebird_statement.c
+index 8b8f82252a..cb7e4bd83a 100644
+--- a/ext/pdo_firebird/firebird_statement.c
++++ b/ext/pdo_firebird/firebird_statement.c
+@@ -267,6 +267,11 @@ static int firebird_fetch_blob(pdo_stmt_t *stmt, int colno, char **ptr, /* {{{ *
+ unsigned short seg_len;
+ ISC_STATUS stat;
+
++ /* prevent overflow */
++ if (*len == ZEND_ULONG_MAX) {
++ result = 0;
++ goto fetch_blob_end;
++ }
+ *ptr = S->fetch_buf[colno] = erealloc(S->fetch_buf[colno], *len+1);
+
+ for (cur_len = stat = 0; (!stat || stat == isc_segment) && cur_len < *len; cur_len += seg_len) {
+
+From b0fed22401d1237a26ec9ac951ca4c7abf512883 Mon Sep 17 00:00:00 2001
+From: "Christoph M. Becker" <cmbecker69 at gmx.de>
+Date: Fri, 30 Apr 2021 14:10:50 +0200
+Subject: [PATCH 3/9] Fix #76450: SIGSEGV in firebird_stmt_execute
+
+We need to verify that the `result_size` is not larger than our buffer,
+and also should make sure that the `len` which is passed to
+`isc_vax_integer()` has a permissible value; otherwise we bail out.
+
+(cherry picked from commit bcbf8aa0c96d8d9e81ec3428232485555fae0b37)
+---
+ ext/pdo_firebird/firebird_statement.c | 9 +++++++-
+ ext/pdo_firebird/tests/bug_76450.data | Bin 0 -> 464 bytes
+ ext/pdo_firebird/tests/bug_76450.phpt | 29 ++++++++++++++++++++++++++
+ 3 files changed, 37 insertions(+), 1 deletion(-)
+ create mode 100644 ext/pdo_firebird/tests/bug_76450.data
+ create mode 100644 ext/pdo_firebird/tests/bug_76450.phpt
+
+diff --git a/ext/pdo_firebird/firebird_statement.c b/ext/pdo_firebird/firebird_statement.c
+index cb7e4bd83a..a87bcc1d40 100644
+--- a/ext/pdo_firebird/firebird_statement.c
++++ b/ext/pdo_firebird/firebird_statement.c
+@@ -120,8 +120,14 @@ static int firebird_stmt_execute(pdo_stmt_t *stmt TSRMLS_DC) /* {{{ */
+ }
+ if (result[0] == isc_info_sql_records) {
+ unsigned i = 3, result_size = isc_vax_integer(&result[1], 2);
++ if (result_size > sizeof(result)) {
++ goto error;
++ }
+ while (result[i] != isc_info_end && i < result_size) {
+ short len = (short) isc_vax_integer(&result[i + 1], 2);
++ if (len != 1 && len != 2 && len != 4) {
++ goto error;
++ }
+ if (result[i] != isc_info_req_select_count) {
+ affected_rows += isc_vax_integer(&result[i + 3], len);
+ }
+@@ -145,7 +151,8 @@ static int firebird_stmt_execute(pdo_stmt_t *stmt TSRMLS_DC) /* {{{ */
+ return 1;
+ } while (0);
+
+- RECORD_ERROR(stmt);
++error:
++ RECORD_ERROR(stmt);
+
+ return 0;
+ }
+
+From d5572d9dbcc90366e043521b43e7553b75d20662 Mon Sep 17 00:00:00 2001
+From: "Christoph M. Becker" <cmbecker69 at gmx.de>
+Date: Fri, 30 Apr 2021 13:53:21 +0200
+Subject: [PATCH 4/9] Fix #76449: SIGSEGV in firebird_handle_doer
+
+We need to verify that the `result_size` is not larger than our buffer,
+and also should make sure that the `len` which is passed to
+`isc_vax_integer()` has a permissible value; otherwise we bail out.
+
+(cherry picked from commit 08da7c73726f7b86b67d6f0ff87c73c585a7834a)
+---
+ ext/pdo_firebird/firebird_driver.c | 9 +++++++++
+ ext/pdo_firebird/tests/bug_76449.data | Bin 0 -> 464 bytes
+ ext/pdo_firebird/tests/bug_76449.phpt | 23 +++++++++++++++++++++++
+ 3 files changed, 32 insertions(+)
+ create mode 100644 ext/pdo_firebird/tests/bug_76449.data
+ create mode 100644 ext/pdo_firebird/tests/bug_76449.phpt
+
+diff --git a/ext/pdo_firebird/firebird_driver.c b/ext/pdo_firebird/firebird_driver.c
+index a3f34d554f..fef58cb3b4 100644
+--- a/ext/pdo_firebird/firebird_driver.c
++++ b/ext/pdo_firebird/firebird_driver.c
+@@ -253,8 +253,17 @@ static long firebird_handle_doer(pdo_dbh_t *dbh, const char *sql, long sql_len T
+ if (result[0] == isc_info_sql_records) {
+ unsigned i = 3, result_size = isc_vax_integer(&result[1],2);
+
++ if (result_size > sizeof(result)) {
++ ret = -1;
++ goto free_statement;
++ }
+ while (result[i] != isc_info_end && i < result_size) {
+ short len = (short)isc_vax_integer(&result[i+1],2);
++ /* bail out on bad len */
++ if (len != 1 && len != 2 && len != 4) {
++ ret = -1;
++ goto free_statement;
++ }
+ if (result[i] != isc_info_req_select_count) {
+ ret += isc_vax_integer(&result[i+3],len);
+ }
+
+From 2e174eac00ecffc4dd4884e801d15d22f80ffa98 Mon Sep 17 00:00:00 2001
+From: "Christoph M. Becker" <cmbecker69 at gmx.de>
+Date: Thu, 29 Apr 2021 15:26:22 +0200
+Subject: [PATCH 5/9] Fix #76448: Stack buffer overflow in firebird_info_cb
+
+We ensure not to overflow the stack allocated buffer by using `strlcat`.
+
+(cherry picked from commit 67afa32541ebc4abbf633cb1e7e879b2fbb616ad)
+---
+ ext/pdo_firebird/firebird_driver.c | 10 ++++++----
+ ext/pdo_firebird/tests/bug_76448.data | Bin 0 -> 749 bytes
+ ext/pdo_firebird/tests/bug_76448.phpt | 23 +++++++++++++++++++++++
+ 3 files changed, 29 insertions(+), 4 deletions(-)
+ create mode 100644 ext/pdo_firebird/tests/bug_76448.data
+ create mode 100644 ext/pdo_firebird/tests/bug_76448.phpt
+
+diff --git a/ext/pdo_firebird/firebird_driver.c b/ext/pdo_firebird/firebird_driver.c
+index fef58cb3b4..5f3d3cdb02 100644
+--- a/ext/pdo_firebird/firebird_driver.c
++++ b/ext/pdo_firebird/firebird_driver.c
+@@ -540,14 +540,16 @@ static int firebird_handle_set_attribute(pdo_dbh_t *dbh, long attr, zval *val TS
+ }
+ /* }}} */
+
++#define INFO_BUF_LEN 512
++
+ /* callback to used to report database server info */
+ static void firebird_info_cb(void *arg, char const *s) /* {{{ */
+ {
+ if (arg) {
+ if (*(char*)arg) { /* second call */
+- strcat(arg, " ");
++ strlcat(arg, " ", INFO_BUF_LEN);
+ }
+- strcat(arg, s);
++ strlcat(arg, s, INFO_BUF_LEN);
+ }
+ }
+ /* }}} */
+@@ -558,8 +560,8 @@ static int firebird_handle_get_attribute(pdo_dbh_t *dbh, long attr, zval *val TS
+ pdo_firebird_db_handle *H = (pdo_firebird_db_handle *)dbh->driver_data;
+
+ switch (attr) {
+- char tmp[512];
+-
++ char tmp[INFO_BUF_LEN];
++
+ case PDO_ATTR_AUTOCOMMIT:
+ ZVAL_LONG(val,dbh->auto_commit);
+ return 1;
+
+From bd5936bc8ce2e3c8497b9083f5530e83f5a19616 Mon Sep 17 00:00:00 2001
+From: Dorin Marcoci <dorin.marcoci at marcodor.com>
+Date: Sat, 24 Dec 2016 13:57:03 +0200
+Subject: [PATCH 7/9] Fixes #65689. PDO_Firebrid / exec() does not free
+ allocated statement.
+
+(cherry picked from commit e926bf65076cb5c8da6bf8f32635f696de5ff9aa)
+---
+ ext/pdo_firebird/firebird_driver.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/ext/pdo_firebird/firebird_driver.c b/ext/pdo_firebird/firebird_driver.c
+index 5f3d3cdb02..589312ac3a 100644
+--- a/ext/pdo_firebird/firebird_driver.c
++++ b/ext/pdo_firebird/firebird_driver.c
+@@ -240,14 +240,16 @@ static long firebird_handle_doer(pdo_dbh_t *dbh, const char *sql, long sql_len T
+ /* execute the statement */
+ if (isc_dsql_execute2(H->isc_status, &H->tr, &stmt, PDO_FB_SQLDA_VERSION, &in_sqlda, &out_sqlda)) {
+ RECORD_ERROR(dbh);
+- return -1;
++ ret = -1;
++ goto free_statement;
+ }
+
+ /* find out how many rows were affected */
+ if (isc_dsql_sql_info(H->isc_status, &stmt, sizeof(info_count), const_cast(info_count),
+ sizeof(result), result)) {
+ RECORD_ERROR(dbh);
+- return -1;
++ ret = -1;
++ goto free_statement;
+ }
+
+ if (result[0] == isc_info_sql_records) {
+@@ -276,6 +278,12 @@ static long firebird_handle_doer(pdo_dbh_t *dbh, const char *sql, long sql_len T
+ RECORD_ERROR(dbh);
+ }
+
++free_statement:
++
++ if (isc_dsql_free_statement(H->isc_status, &stmt, DSQL_drop)) {
++ RECORD_ERROR(dbh);
++ }
++
+ return ret;
+ }
+ /* }}} */
+--
+2.31.1
+
+From 79aadb61954cb38b7b97897482e0a3a08cd90874 Mon Sep 17 00:00:00 2001
+From: Anatol Belski <ab at php.net>
+Date: Mon, 6 Jun 2016 13:30:17 +0200
+Subject: [PATCH 8/9] fix ibase handle initialization, mostly compiler warnings
+
+(cherry picked from commit 3e6c02b91a62e3fd640dfa199f8e4178a6680821)
+---
+ ext/pdo_firebird/firebird_driver.c | 4 ++--
+ ext/pdo_firebird/firebird_statement.c | 4 ++--
+ ext/pdo_firebird/php_pdo_firebird_int.h | 6 ++++++
+ 3 files changed, 10 insertions(+), 4 deletions(-)
+
+diff --git a/ext/pdo_firebird/firebird_driver.c b/ext/pdo_firebird/firebird_driver.c
+index 589312ac3a..84de8affd6 100644
+--- a/ext/pdo_firebird/firebird_driver.c
++++ b/ext/pdo_firebird/firebird_driver.c
+@@ -140,7 +140,7 @@ static int firebird_handle_preparer(pdo_dbh_t *dbh, const char *sql, long sql_le
+ HashTable *np;
+
+ do {
+- isc_stmt_handle s = NULL;
++ isc_stmt_handle s = PDO_FIREBIRD_HANDLE_INITIALIZER;
+ XSQLDA num_sqlda;
+ static char const info[] = { isc_info_sql_stmt_type };
+ char result[8];
+@@ -221,7 +221,7 @@ static int firebird_handle_preparer(pdo_dbh_t *dbh, const char *sql, long sql_le
+ static long firebird_handle_doer(pdo_dbh_t *dbh, const char *sql, long sql_len TSRMLS_DC) /* {{{ */
+ {
+ pdo_firebird_db_handle *H = (pdo_firebird_db_handle *)dbh->driver_data;
+- isc_stmt_handle stmt = NULL;
++ isc_stmt_handle stmt = PDO_FIREBIRD_HANDLE_INITIALIZER;
+ static char const info_count[] = { isc_info_sql_records };
+ char result[64];
+ int ret = 0;
+diff --git a/ext/pdo_firebird/firebird_statement.c b/ext/pdo_firebird/firebird_statement.c
+index a87bcc1d40..dc64c19687 100644
+--- a/ext/pdo_firebird/firebird_statement.c
++++ b/ext/pdo_firebird/firebird_statement.c
+@@ -230,7 +230,7 @@ static int firebird_fetch_blob(pdo_stmt_t *stmt, int colno, char **ptr, /* {{{ *
+ {
+ pdo_firebird_stmt *S = (pdo_firebird_stmt*)stmt->driver_data;
+ pdo_firebird_db_handle *H = S->H;
+- isc_blob_handle blobh = NULL;
++ isc_blob_handle blobh = PDO_FIREBIRD_HANDLE_INITIALIZER;
+ char const bl_item = isc_info_blob_total_length;
+ char bl_info[20];
+ unsigned short i;
+@@ -424,7 +424,7 @@ static int firebird_bind_blob(pdo_stmt_t *stmt, ISC_QUAD *blob_id, zval *param T
+ {
+ pdo_firebird_stmt *S = (pdo_firebird_stmt*)stmt->driver_data;
+ pdo_firebird_db_handle *H = S->H;
+- isc_blob_handle h = NULL;
++ isc_blob_handle h = PDO_FIREBIRD_HANDLE_INITIALIZER;
+ unsigned long put_cnt = 0, rem_cnt;
+ unsigned short chunk_size;
+ int result = 1;
+diff --git a/ext/pdo_firebird/php_pdo_firebird_int.h b/ext/pdo_firebird/php_pdo_firebird_int.h
+index 796f3837c8..09cd485121 100644
+--- a/ext/pdo_firebird/php_pdo_firebird_int.h
++++ b/ext/pdo_firebird/php_pdo_firebird_int.h
+@@ -61,6 +61,12 @@ typedef void (*info_func_t)(char*);
+ #define min(a,b) ((a)<(b)?(a):(b))
+ #endif
+
++#if defined(_LP64) || defined(__LP64__) || defined(__arch64__) || defined(_WIN64)
++# define PDO_FIREBIRD_HANDLE_INITIALIZER 0U
++#else
++# define PDO_FIREBIRD_HANDLE_INITIALIZER NULL
++#endif
++
+ typedef struct {
+
+ /* the result of the last API call */
+--
+2.31.1
+
+From 82b3778dcb7ad665e6fd299e0c811bb94195bf49 Mon Sep 17 00:00:00 2001
+From: Remi Collet <remi at remirepo.net>
+Date: Mon, 28 Jun 2021 14:31:02 +0200
+Subject: [PATCH 9/9] adapt for 5.6 without ZEND_ULONG_MAX
+
+---
+ ext/pdo_firebird/firebird_statement.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/ext/pdo_firebird/firebird_statement.c b/ext/pdo_firebird/firebird_statement.c
+index dc64c19687..ea3c704fbb 100644
+--- a/ext/pdo_firebird/firebird_statement.c
++++ b/ext/pdo_firebird/firebird_statement.c
+@@ -275,7 +275,7 @@ static int firebird_fetch_blob(pdo_stmt_t *stmt, int colno, char **ptr, /* {{{ *
+ ISC_STATUS stat;
+
+ /* prevent overflow */
+- if (*len == ZEND_ULONG_MAX) {
++ if (*len == (LONG_MAX * 2UL +1UL)) {
+ result = 0;
+ goto fetch_blob_end;
+ }
+--
+2.31.1
+
+From 7ce2b28871fcf07a9f3ac0947bb6c4973b28224f Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas at php.net>
+Date: Sun, 20 Jun 2021 22:20:38 -0700
+Subject: [PATCH 6/9] Update NEWS
+
+(cherry picked from commit c68a687566591e2268f35d124a90c7d556ce968b)
+(cherry picked from commit 7598733c51af30611aa64e456c9a777069d2efb9)
+---
+ NEWS | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--
+2.31.1
+
diff --git a/php-bug77396.patch b/php-bug77396.patch
new file mode 100644
index 0000000..4a37472
--- /dev/null
+++ b/php-bug77396.patch
@@ -0,0 +1,76 @@
+From 0bfb626af1429dbd51b9f860bc54027d4e94b754 Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas at php.net>
+Date: Sun, 3 Mar 2019 18:22:32 -0800
+Subject: [PATCH] Fix bug #77396 - Null Pointer Dereference in
+ phar_create_or_parse_filename
+
+(cherry picked from commit 7f0ab7c20c83a52862ad7c8acf31c3fa739f1274)
+---
+ ext/phar/phar.c | 3 +++
+ ext/phar/tests/bug77396.phpt | 15 +++++++++++++++
+ 2 files changed, 18 insertions(+)
+ create mode 100644 ext/phar/tests/bug77396.phpt
+
+diff --git a/ext/phar/phar.c b/ext/phar/phar.c
+index 6e5cec2462..850a6e6c46 100644
+--- a/ext/phar/phar.c
++++ b/ext/phar/phar.c
+@@ -1385,6 +1385,9 @@ int phar_create_or_parse_filename(char *fname, int fname_len, char *alias, int a
+ /* set up our manifest */
+ mydata = ecalloc(1, sizeof(phar_archive_data));
+ mydata->fname = expand_filepath(fname, NULL TSRMLS_CC);
++ if (mydata->fname == NULL) {
++ return FAILURE;
++ }
+ fname_len = strlen(mydata->fname);
+ #ifdef PHP_WIN32
+ phar_unixify_path_separators(mydata->fname, fname_len);
+diff --git a/ext/phar/tests/bug77396.phpt b/ext/phar/tests/bug77396.phpt
+new file mode 100644
+index 0000000000..f7a2a2f026
+--- /dev/null
++++ b/ext/phar/tests/bug77396.phpt
+@@ -0,0 +1,15 @@
++--TEST--
++Bug #77396 Relative filename exceeding maximum path length causes null pointer dereference.
++--SKIPIF--
++<?php if (!extension_loaded("phar")) die("skip"); ?>
++--FILE--
++<?php
++$path = '../' . str_repeat("x", PHP_MAXPATHLEN) . '.tar';
++$phar = new PharData($path);
++?>
++--EXPECTF--
++Fatal error: Uncaught UnexpectedValueException: Phar creation or opening failed in %s/bug77396.php:%d
++Stack trace:
++#0 %s/bug77396.php(%d): PharData->__construct(%s)
++#1 {main}
++ thrown in %s/bug77396.php on line %d
+
+From e03269512a8c092f1b1d2320b9f993795cf0fb76 Mon Sep 17 00:00:00 2001
+From: Anatol Belski <ab at php.net>
+Date: Mon, 4 Mar 2019 14:28:47 +0100
+Subject: [PATCH] Fix test portability
+
+(cherry picked from commit 040196972c7a757200c2e1aa88f360322c38ffde)
+---
+ ext/exif/tests/bug77563.phpt | 8 ++++----
+ ext/phar/tests/bug77396.phpt | 6 +++---
+ 2 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/ext/phar/tests/bug77396.phpt b/ext/phar/tests/bug77396.phpt
+index f7a2a2f026..ede25ff81f 100644
+--- a/ext/phar/tests/bug77396.phpt
++++ b/ext/phar/tests/bug77396.phpt
+@@ -8,8 +8,8 @@ $path = '../' . str_repeat("x", PHP_MAXPATHLEN) . '.tar';
+ $phar = new PharData($path);
+ ?>
+ --EXPECTF--
+-Fatal error: Uncaught UnexpectedValueException: Phar creation or opening failed in %s/bug77396.php:%d
++Fatal error: Uncaught UnexpectedValueException: Phar creation or opening failed in %s%ebug77396.php:%d
+ Stack trace:
+-#0 %s/bug77396.php(%d): PharData->__construct(%s)
++#0 %s%ebug77396.php(%d): PharData->__construct(%s)
+ #1 {main}
+- thrown in %s/bug77396.php on line %d
++ thrown in %s%ebug77396.php on line %d
diff --git a/php-bug77423.patch b/php-bug77423.patch
new file mode 100644
index 0000000..56a819c
--- /dev/null
+++ b/php-bug77423.patch
@@ -0,0 +1,415 @@
+From 7a90808f97cee0c12ae5c219eddc522721740d71 Mon Sep 17 00:00:00 2001
+From: "Christoph M. Becker" <cmbecker69 at gmx.de>
+Date: Wed, 13 May 2020 09:36:52 +0200
+Subject: [PATCH 1/2] Fix #77423: parse_url() will deliver a wrong host to user
+
+To avoid that `parse_url()` returns an erroneous host, which would be
+valid for `FILTER_VALIDATE_URL`, we make sure that only userinfo which
+is valid according to RFC 3986 is treated as such.
+
+For consistency with the existing url parsing code, we use ctype
+functions, although that is not necessarily correct.
+
+(cherry picked from commit 2d3d72412a6734e19a38ed10f385227a6238e4a6)
+(cherry picked from commit 31459f94f2780e748e15d5c2951ba20adbba2366)
+---
+ ext/standard/tests/strings/url_t.phpt | 6 ++--
+ ext/standard/tests/url/bug77423.phpt | 30 +++++++++++++++++++
+ .../tests/url/parse_url_basic_001.phpt | 6 ++--
+ .../tests/url/parse_url_basic_003.phpt | 2 +-
+ .../tests/url/parse_url_basic_005.phpt | 2 +-
+ ext/standard/url.c | 21 +++++++++++++
+ 6 files changed, 57 insertions(+), 10 deletions(-)
+ create mode 100644 ext/standard/tests/url/bug77423.phpt
+
+diff --git a/ext/standard/tests/strings/url_t.phpt b/ext/standard/tests/strings/url_t.phpt
+index e172061ec2..80e164a08e 100644
+--- a/ext/standard/tests/strings/url_t.phpt
++++ b/ext/standard/tests/strings/url_t.phpt
+@@ -575,15 +575,13 @@ $sample_urls = array (
+ string(16) "some_page_ref123"
+ }
+
+---> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(7) {
++--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(6) {
+ ["scheme"]=>
+ string(4) "http"
+ ["host"]=>
+- string(11) "www.php.net"
++ string(26) "secret at hideout@www.php.net"
+ ["port"]=>
+ int(80)
+- ["user"]=>
+- string(14) "secret at hideout"
+ ["path"]=>
+ string(10) "/index.php"
+ ["query"]=>
+diff --git a/ext/standard/tests/url/bug77423.phpt b/ext/standard/tests/url/bug77423.phpt
+new file mode 100644
+index 0000000000..be03fe95e2
+--- /dev/null
++++ b/ext/standard/tests/url/bug77423.phpt
+@@ -0,0 +1,30 @@
++--TEST--
++Bug #77423 (parse_url() will deliver a wrong host to user)
++--FILE--
++<?php
++$urls = array(
++ "http://php.net\@aliyun.com/aaa.do",
++ "https://example.com\uFF03@bing.com",
++);
++foreach ($urls as $url) {
++ var_dump(filter_var($url, FILTER_VALIDATE_URL));
++ var_dump(parse_url($url));
++}
++?>
++--EXPECT--
++bool(false)
++array(3) {
++ ["scheme"]=>
++ string(4) "http"
++ ["host"]=>
++ string(19) "php.net\@aliyun.com"
++ ["path"]=>
++ string(7) "/aaa.do"
++}
++bool(false)
++array(2) {
++ ["scheme"]=>
++ string(5) "https"
++ ["host"]=>
++ string(26) "example.com\uFF03 at bing.com"
++}
+diff --git a/ext/standard/tests/url/parse_url_basic_001.phpt b/ext/standard/tests/url/parse_url_basic_001.phpt
+index e468066a42..c9e9d32de0 100644
+--- a/ext/standard/tests/url/parse_url_basic_001.phpt
++++ b/ext/standard/tests/url/parse_url_basic_001.phpt
+@@ -507,15 +507,13 @@ echo "Done";
+ string(16) "some_page_ref123"
+ }
+
+---> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(7) {
++--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(6) {
+ ["scheme"]=>
+ string(4) "http"
+ ["host"]=>
+- string(11) "www.php.net"
++ string(26) "secret at hideout@www.php.net"
+ ["port"]=>
+ int(80)
+- ["user"]=>
+- string(14) "secret at hideout"
+ ["path"]=>
+ string(10) "/index.php"
+ ["query"]=>
+diff --git a/ext/standard/tests/url/parse_url_basic_003.phpt b/ext/standard/tests/url/parse_url_basic_003.phpt
+index 70dc4bb90b..431de27009 100644
+--- a/ext/standard/tests/url/parse_url_basic_003.phpt
++++ b/ext/standard/tests/url/parse_url_basic_003.phpt
+@@ -68,7 +68,7 @@ echo "Done";
+ --> http://secret:@www.php.net/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(11) "www.php.net"
+ --> http://:hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(11) "www.php.net"
+ --> http://secret:hideout@www.php.net/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(11) "www.php.net"
+---> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(11) "www.php.net"
++--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(26) "secret at hideout@www.php.net"
+ --> http://secret:hid:out@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(11) "www.php.net"
+ --> nntp://news.php.net : string(12) "news.php.net"
+ --> ftp://ftp.gnu.org/gnu/glic/glibc.tar.gz : string(11) "ftp.gnu.org"
+diff --git a/ext/standard/tests/url/parse_url_basic_005.phpt b/ext/standard/tests/url/parse_url_basic_005.phpt
+index b2ca06ff96..b2c1a1d6dd 100644
+--- a/ext/standard/tests/url/parse_url_basic_005.phpt
++++ b/ext/standard/tests/url/parse_url_basic_005.phpt
+@@ -68,7 +68,7 @@ echo "Done";
+ --> http://secret:@www.php.net/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(6) "secret"
+ --> http://:hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(0) ""
+ --> http://secret:hideout@www.php.net/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(6) "secret"
+---> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(14) "secret at hideout"
++--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : NULL
+ --> http://secret:hid:out@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(6) "secret"
+ --> nntp://news.php.net : NULL
+ --> ftp://ftp.gnu.org/gnu/glic/glibc.tar.gz : NULL
+diff --git a/ext/standard/url.c b/ext/standard/url.c
+index 0278bd47e8..8da9da3d6a 100644
+--- a/ext/standard/url.c
++++ b/ext/standard/url.c
+@@ -92,6 +92,22 @@ PHPAPI php_url *php_url_parse(char const *str)
+ return php_url_parse_ex(str, strlen(str));
+ }
+
++static int is_userinfo_valid(const char *str, size_t len)
++{
++ char *valid = "-._~!$&'()*+,;=:";
++ char *p = str;
++ while (p - str < len) {
++ if (isalpha(*p) || isdigit(*p) || strchr(valid, *p)) {
++ p++;
++ } else if (*p == '%' && p - str <= len - 3 && isdigit(*(p+1)) && isxdigit(*(p+2))) {
++ p += 3;
++ } else {
++ return 0;
++ }
++ }
++ return 1;
++}
++
+ /* {{{ php_url_parse
+ */
+ PHPAPI php_url *php_url_parse_ex(char const *str, int length)
+@@ -230,13 +246,18 @@ PHPAPI php_url *php_url_parse_ex(char const *str, int length)
+ ret->pass = estrndup(pp, (p-pp));
+ php_replace_controlchars_ex(ret->pass, (p-pp));
+ } else {
++ if (!is_userinfo_valid(s, p-s)) {
++ goto check_port;
++ }
+ ret->user = estrndup(s, (p-s));
+ php_replace_controlchars_ex(ret->user, (p-s));
++
+ }
+
+ s = p + 1;
+ }
+
++check_port:
+ /* check for port */
+ if (s < ue && *s == '[' && *(e-1) == ']') {
+ /* Short circuit portscan,
+--
+2.29.2
+
+From d45b940106cb5a3bfc43f7a9616dde23f9ad1f43 Mon Sep 17 00:00:00 2001
+From: Remi Collet <remi at remirepo.net>
+Date: Mon, 4 Jan 2021 14:20:55 +0100
+Subject: [PATCH 2/2] NEWS
+
+(cherry picked from commit c784479182b92b9b3b96a7be42aa86a6c6d0b693)
+---
+ NEWS | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--
+2.29.2
+
+From b837c01d4cd290d87d2dd4c2d1195e9f209fe749 Mon Sep 17 00:00:00 2001
+From: "Christoph M. Becker" <cmbecker69 at gmx.de>
+Date: Tue, 19 Jan 2021 11:23:25 +0100
+Subject: [PATCH] Alternative fix for bug 77423
+
+That bug report originally was about `parse_url()` misbehaving, but the
+security aspect was actually only regarding `FILTER_VALIDATE_URL`.
+Since the changes to `parse_url_ex()` apparently affect userland code
+which is relying on the sloppy URL parsing[1], this alternative
+restores the old parsing behavior, but ensures that the userinfo is
+checked for correctness for `FILTER_VALIDATE_URL`.
+
+[1] <https://github.com/php/php-src/commit/5174de7cd33c3d4fa591c9c93859ff9989b07e8c#commitcomment-45967652>
+
+(cherry picked from commit 4a89e726bd4d0571991dc22a9a1ad4509e8fe347)
+(cherry picked from commit 9c673083cd46ee2a954a62156acbe4b6e657c048)
+(cherry picked from commit 356f7008f36da60ec9794d48c55d117f1dd31903)
+(cherry picked from commit b5d4f109bab648c0d07273d2a52a5f2560e7832b)
+(cherry picked from commit efb6c49f08314aca84733b0e83d72cd20c8e0015)
+---
+ ext/filter/logical_filters.c | 25 +++++++++++++++++++
+ .../tests/url => filter/tests}/bug77423.phpt | 15 -----------
+ ext/standard/tests/strings/url_t.phpt | 6 +++--
+ .../tests/url/parse_url_basic_001.phpt | 6 +++--
+ .../tests/url/parse_url_basic_003.phpt | 2 +-
+ .../tests/url/parse_url_basic_005.phpt | 2 +-
+ ext/standard/url.c | 21 ----------------
+ 7 files changed, 35 insertions(+), 42 deletions(-)
+ rename ext/{standard/tests/url => filter/tests}/bug77423.phpt (53%)
+
+diff --git a/ext/filter/logical_filters.c b/ext/filter/logical_filters.c
+index 39a035f3af..9e1daffaab 100644
+--- a/ext/filter/logical_filters.c
++++ b/ext/filter/logical_filters.c
+@@ -445,6 +445,24 @@ void php_filter_validate_regexp(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
+ }
+ /* }}} */
+
++static int is_userinfo_valid(char *str)
++{
++ const char *valid = "-._~!$&'()*+,;=:";
++ const char *p = str;
++ size_t len = strlen(str);
++
++ while (p - str < len) {
++ if (isalpha(*p) || isdigit(*p) || strchr(valid, *p)) {
++ p++;
++ } else if (*p == '%' && p - str <= len - 3 && isdigit(*(p+1)) && isxdigit(*(p+2))) {
++ p += 3;
++ } else {
++ return 0;
++ }
++ }
++ return 1;
++}
++
+ void php_filter_validate_url(PHP_INPUT_FILTER_PARAM_DECL) /* {{{ */
+ {
+ php_url *url;
+@@ -496,6 +514,13 @@ bad_url:
+ php_url_free(url);
+ RETURN_VALIDATION_FAILED
+ }
++
++ if (url->user != NULL && !is_userinfo_valid(url->user)) {
++ php_url_free(url);
++ RETURN_VALIDATION_FAILED
++
++ }
++
+ php_url_free(url);
+ }
+ /* }}} */
+diff --git a/ext/standard/tests/url/bug77423.phpt b/ext/filter/tests/bug77423.phpt
+similarity index 53%
+rename from ext/standard/tests/url/bug77423.phpt
+rename to ext/filter/tests/bug77423.phpt
+index be03fe95e2..761c7c359a 100644
+--- a/ext/standard/tests/url/bug77423.phpt
++++ b/ext/filter/tests/bug77423.phpt
+@@ -8,23 +8,8 @@ $urls = array(
+ );
+ foreach ($urls as $url) {
+ var_dump(filter_var($url, FILTER_VALIDATE_URL));
+- var_dump(parse_url($url));
+ }
+ ?>
+ --EXPECT--
+ bool(false)
+-array(3) {
+- ["scheme"]=>
+- string(4) "http"
+- ["host"]=>
+- string(19) "php.net\@aliyun.com"
+- ["path"]=>
+- string(7) "/aaa.do"
+-}
+ bool(false)
+-array(2) {
+- ["scheme"]=>
+- string(5) "https"
+- ["host"]=>
+- string(26) "example.com\uFF03 at bing.com"
+-}
+diff --git a/ext/standard/tests/strings/url_t.phpt b/ext/standard/tests/strings/url_t.phpt
+index 80e164a08e..e172061ec2 100644
+--- a/ext/standard/tests/strings/url_t.phpt
++++ b/ext/standard/tests/strings/url_t.phpt
+@@ -575,13 +575,15 @@ $sample_urls = array (
+ string(16) "some_page_ref123"
+ }
+
+---> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(6) {
++--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(7) {
+ ["scheme"]=>
+ string(4) "http"
+ ["host"]=>
+- string(26) "secret at hideout@www.php.net"
++ string(11) "www.php.net"
+ ["port"]=>
+ int(80)
++ ["user"]=>
++ string(14) "secret at hideout"
+ ["path"]=>
+ string(10) "/index.php"
+ ["query"]=>
+diff --git a/ext/standard/tests/url/parse_url_basic_001.phpt b/ext/standard/tests/url/parse_url_basic_001.phpt
+index c9e9d32de0..e468066a42 100644
+--- a/ext/standard/tests/url/parse_url_basic_001.phpt
++++ b/ext/standard/tests/url/parse_url_basic_001.phpt
+@@ -507,13 +507,15 @@ echo "Done";
+ string(16) "some_page_ref123"
+ }
+
+---> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(6) {
++--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123: array(7) {
+ ["scheme"]=>
+ string(4) "http"
+ ["host"]=>
+- string(26) "secret at hideout@www.php.net"
++ string(11) "www.php.net"
+ ["port"]=>
+ int(80)
++ ["user"]=>
++ string(14) "secret at hideout"
+ ["path"]=>
+ string(10) "/index.php"
+ ["query"]=>
+diff --git a/ext/standard/tests/url/parse_url_basic_003.phpt b/ext/standard/tests/url/parse_url_basic_003.phpt
+index 431de27009..70dc4bb90b 100644
+--- a/ext/standard/tests/url/parse_url_basic_003.phpt
++++ b/ext/standard/tests/url/parse_url_basic_003.phpt
+@@ -68,7 +68,7 @@ echo "Done";
+ --> http://secret:@www.php.net/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(11) "www.php.net"
+ --> http://:hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(11) "www.php.net"
+ --> http://secret:hideout@www.php.net/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(11) "www.php.net"
+---> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(26) "secret at hideout@www.php.net"
++--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(11) "www.php.net"
+ --> http://secret:hid:out@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(11) "www.php.net"
+ --> nntp://news.php.net : string(12) "news.php.net"
+ --> ftp://ftp.gnu.org/gnu/glic/glibc.tar.gz : string(11) "ftp.gnu.org"
+diff --git a/ext/standard/tests/url/parse_url_basic_005.phpt b/ext/standard/tests/url/parse_url_basic_005.phpt
+index b2c1a1d6dd..b2ca06ff96 100644
+--- a/ext/standard/tests/url/parse_url_basic_005.phpt
++++ b/ext/standard/tests/url/parse_url_basic_005.phpt
+@@ -68,7 +68,7 @@ echo "Done";
+ --> http://secret:@www.php.net/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(6) "secret"
+ --> http://:hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(0) ""
+ --> http://secret:hideout@www.php.net/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(6) "secret"
+---> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : NULL
++--> http://secret@hideout@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(14) "secret at hideout"
+ --> http://secret:hid:out@www.php.net:80/index.php?test=1&test2=char&test3=mixesCI#some_page_ref123 : string(6) "secret"
+ --> nntp://news.php.net : NULL
+ --> ftp://ftp.gnu.org/gnu/glic/glibc.tar.gz : NULL
+diff --git a/ext/standard/url.c b/ext/standard/url.c
+index 8da9da3d6a..0278bd47e8 100644
+--- a/ext/standard/url.c
++++ b/ext/standard/url.c
+@@ -92,22 +92,6 @@ PHPAPI php_url *php_url_parse(char const *str)
+ return php_url_parse_ex(str, strlen(str));
+ }
+
+-static int is_userinfo_valid(const char *str, size_t len)
+-{
+- char *valid = "-._~!$&'()*+,;=:";
+- char *p = str;
+- while (p - str < len) {
+- if (isalpha(*p) || isdigit(*p) || strchr(valid, *p)) {
+- p++;
+- } else if (*p == '%' && p - str <= len - 3 && isdigit(*(p+1)) && isxdigit(*(p+2))) {
+- p += 3;
+- } else {
+- return 0;
+- }
+- }
+- return 1;
+-}
+-
+ /* {{{ php_url_parse
+ */
+ PHPAPI php_url *php_url_parse_ex(char const *str, int length)
+@@ -246,18 +230,13 @@ PHPAPI php_url *php_url_parse_ex(char const *str, int length)
+ ret->pass = estrndup(pp, (p-pp));
+ php_replace_controlchars_ex(ret->pass, (p-pp));
+ } else {
+- if (!is_userinfo_valid(s, p-s)) {
+- goto check_port;
+- }
+ ret->user = estrndup(s, (p-s));
+ php_replace_controlchars_ex(ret->user, (p-s));
+-
+ }
+
+ s = p + 1;
+ }
+
+-check_port:
+ /* check for port */
+ if (s < ue && *s == '[' && *(e-1) == ']') {
+ /* Short circuit portscan,
+--
+2.29.2
+
diff --git a/php-bug77431.patch b/php-bug77431.patch
new file mode 100644
index 0000000..c0c27b3
--- /dev/null
+++ b/php-bug77431.patch
@@ -0,0 +1,66 @@
+From 6d9dcae7b2828a2c4d1853eecc2e62743515b36b Mon Sep 17 00:00:00 2001
+From: "Christoph M. Becker" <cmbecker69 at gmx.de>
+Date: Wed, 9 Jan 2019 14:26:18 +0100
+Subject: [PATCH] Fix #77431 SplFileInfo::__construct() accepts NUL bytes
+
+`SplFileInfo::__construct()` has to expect a path instead of a string,
+analogous to `SplFileObject::__construct()`.
+
+(cherry picked from commit 254a5914ad7f9dbdc4f6090229f6b0f4317a695e)
+---
+ ext/spl/spl_directory.c | 2 +-
+ ext/spl/tests/bug77431.phpt | 9 +++++++++
+ 2 files changed, 10 insertions(+), 1 deletion(-)
+ create mode 100644 ext/spl/tests/bug77431.phpt
+
+diff --git a/ext/spl/spl_directory.c b/ext/spl/spl_directory.c
+index c08334573e..fbcf892c3d 100644
+--- a/ext/spl/spl_directory.c
++++ b/ext/spl/spl_directory.c
+@@ -1135,7 +1135,7 @@ SPL_METHOD(SplFileInfo, __construct)
+
+ zend_replace_error_handling(EH_THROW, spl_ce_RuntimeException, &error_handling TSRMLS_CC);
+
+- if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &path, &len) == FAILURE) {
++ if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &path, &len) == FAILURE) {
+ zend_restore_error_handling(&error_handling TSRMLS_CC);
+ return;
+ }
+diff --git a/ext/spl/tests/bug77431.phpt b/ext/spl/tests/bug77431.phpt
+new file mode 100644
+index 0000000000..eb1ca96b75
+--- /dev/null
++++ b/ext/spl/tests/bug77431.phpt
+@@ -0,0 +1,9 @@
++--TEST--
++Bug #77431 (SplFileInfo::__construct() accepts NUL bytes)
++--FILE--
++<?php
++new SplFileInfo("bad\0good");
++?>
++--EXPECTF--
++Fatal error: Uncaught TypeError: SplFileInfo::__construct() expects parameter 1 to be a valid path, string given in %s:%d
++Stack trace:%A
+\ No newline at end of file
+From dfea88758c8add916be72e666b193a993540cfde Mon Sep 17 00:00:00 2001
+From: Anatol Belski <ab at php.net>
+Date: Wed, 6 Mar 2019 12:19:33 +0100
+Subject: [PATCH] Fix test
+
+---
+ ext/spl/tests/bug77431.phpt | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/ext/spl/tests/bug77431.phpt b/ext/spl/tests/bug77431.phpt
+index eb1ca96b75..04e4ce2eba 100644
+--- a/ext/spl/tests/bug77431.phpt
++++ b/ext/spl/tests/bug77431.phpt
+@@ -5,5 +5,5 @@ Bug #77431 (SplFileInfo::__construct() accepts NUL bytes)
+ new SplFileInfo("bad\0good");
+ ?>
+ --EXPECTF--
+-Fatal error: Uncaught TypeError: SplFileInfo::__construct() expects parameter 1 to be a valid path, string given in %s:%d
+-Stack trace:%A
+\ No newline at end of file
++Fatal error: Uncaught exception 'RuntimeException' with message 'SplFileInfo::__construct() expects parameter 1 to be a valid path, string given' in %s:%d
++Stack trace:%A
diff --git a/php-bug77540.patch b/php-bug77540.patch
new file mode 100644
index 0000000..946b3cb
--- /dev/null
+++ b/php-bug77540.patch
@@ -0,0 +1,101 @@
+From 3f875bf0da30b46aaa772367b9638b867e2b7690 Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas at php.net>
+Date: Fri, 1 Mar 2019 23:25:45 -0800
+Subject: [PATCH] Fix integer overflows on 32-bits
+
+(cherry picked from commit 5e824a88d073d282c4f358f186cb87ddc284f83d)
+---
+ ext/exif/exif.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/ext/exif/exif.c b/ext/exif/exif.c
+index cad29b7295..47055a180c 100644
+--- a/ext/exif/exif.c
++++ b/ext/exif/exif.c
+@@ -3577,10 +3577,10 @@ static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offse
+ tag_table_type tag_table = exif_get_tag_table(section_index);
+
+ if (ImageInfo->ifd_nesting_level > MAX_IFD_NESTING_LEVEL) {
+- return FALSE;
+- }
++ return FALSE;
++ }
+
+- if (ImageInfo->FileSize >= dir_offset+2) {
++ if (ImageInfo->FileSize >= 2 && ImageInfo->FileSize - 2 >= dir_offset) {
+ sn = exif_file_sections_add(ImageInfo, M_PSEUDO, 2, NULL);
+ #ifdef EXIF_DEBUG
+ exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read from TIFF: filesize(x%04X), IFD dir(x%04X + x%04X)", ImageInfo->FileSize, dir_offset, 2);
+@@ -3588,8 +3588,8 @@ static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offse
+ php_stream_seek(ImageInfo->infile, dir_offset, SEEK_SET); /* we do not know the order of sections */
+ php_stream_read(ImageInfo->infile, (char*)ImageInfo->file.list[sn].data, 2);
+ num_entries = php_ifd_get16u(ImageInfo->file.list[sn].data, ImageInfo->motorola_intel);
+- dir_size = 2/*num dir entries*/ +12/*length of entry*/*num_entries +4/* offset to next ifd (points to thumbnail or NULL)*/;
+- if (ImageInfo->FileSize >= dir_offset+dir_size) {
++ dir_size = 2/*num dir entries*/ +12/*length of entry*/*(size_t)num_entries +4/* offset to next ifd (points to thumbnail or NULL)*/;
++ if (ImageInfo->FileSize >= dir_size && ImageInfo->FileSize - dir_size >= dir_offset) {
+ #ifdef EXIF_DEBUG
+ exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read from TIFF: filesize(x%04X), IFD dir(x%04X + x%04X), IFD entries(%d)", ImageInfo->FileSize, dir_offset+2, dir_size-2, num_entries);
+ #endif
+@@ -3672,9 +3672,9 @@ static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offse
+ }
+ }
+ }
+- if (ImageInfo->FileSize >= dir_offset + ImageInfo->file.list[sn].size) {
++ if (ImageInfo->FileSize >= ImageInfo->file.list[sn].size && ImageInfo->FileSize - ImageInfo->file.list[sn].size >= dir_offset) {
+ if (ifd_size > dir_size) {
+- if (dir_offset + ifd_size > ImageInfo->FileSize) {
++ if (ImageInfo->FileSize < ifd_size || dir_offset > ImageInfo->FileSize - ifd_size) {
+ exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Error in TIFF: filesize(x%04X) less than size of IFD(x%04X + x%04X)", ImageInfo->FileSize, dir_offset, ifd_size);
+ return FALSE;
+ }
+From 67d1a5b7d7330ceb414fd3d33ab3243fc06fa0dc Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas at php.net>
+Date: Sat, 2 Mar 2019 13:38:00 -0800
+Subject: [PATCH] Fix bug #77540 - Invalid Read on exif_process_SOFn
+
+(cherry picked from commit 5f0e62a3e5b525163e538aaab0161c2c8c5d057b)
+---
+ ext/exif/exif.c | 10 ++++++++--
+ ext/exif/tests/bug77540.jpg | Bin 0 -> 91 bytes
+ ext/exif/tests/bug77540.phpt | 16 ++++++++++++++++
+ 3 files changed, 24 insertions(+), 2 deletions(-)
+ create mode 100644 ext/exif/tests/bug77540.jpg
+ create mode 100644 ext/exif/tests/bug77540.phpt
+
+diff --git a/ext/exif/exif.c b/ext/exif/exif.c
+index 47055a180c..5497068fb1 100644
+--- a/ext/exif/exif.c
++++ b/ext/exif/exif.c
+@@ -3519,7 +3519,7 @@ static int exif_scan_thumbnail(image_info_type *ImageInfo TSRMLS_DC)
+ return FALSE;
+ marker = c;
+ length = php_jpg_get16(data+pos);
+- if (pos+length>=ImageInfo->Thumbnail.size) {
++ if (length > ImageInfo->Thumbnail.size || pos >= ImageInfo->Thumbnail.size - length) {
+ return FALSE;
+ }
+ #ifdef EXIF_DEBUG
+@@ -3540,6 +3540,10 @@ static int exif_scan_thumbnail(image_info_type *ImageInfo TSRMLS_DC)
+ case M_SOF14:
+ case M_SOF15:
+ /* handle SOFn block */
++ if (length < 8 || ImageInfo->Thumbnail.size - 8 < pos) {
++ /* exif_process_SOFn needs 8 bytes */
++ return FALSE;
++ }
+ exif_process_SOFn(data+pos, marker, &sof_info);
+ ImageInfo->Thumbnail.height = sof_info.height;
+ ImageInfo->Thumbnail.width = sof_info.width;
+@@ -4183,7 +4187,9 @@ PHP_FUNCTION(exif_thumbnail)
+ ZVAL_STRINGL(return_value, ImageInfo.Thumbnail.data, ImageInfo.Thumbnail.size, 1);
+ if (arg_c >= 3) {
+ if (!ImageInfo.Thumbnail.width || !ImageInfo.Thumbnail.height) {
+- exif_scan_thumbnail(&ImageInfo TSRMLS_CC);
++ if (!exif_scan_thumbnail(&ImageInfo TSRMLS_CC)) {
++ ImageInfo.Thumbnail.width = ImageInfo.Thumbnail.height = 0;
++ }
+ }
+ zval_dtor(p_width);
+ zval_dtor(p_height);
+
diff --git a/php-bug77563.patch b/php-bug77563.patch
new file mode 100644
index 0000000..2fc6dea
--- /dev/null
+++ b/php-bug77563.patch
@@ -0,0 +1,39 @@
+From ac4a9cd56f8145c0b1226fe977772a40e3a994a9 Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas at php.net>
+Date: Sat, 2 Mar 2019 15:07:40 -0800
+Subject: [PATCH] Fix bug #77563 - Uninitialized read in
+ exif_process_IFD_in_MAKERNOTE
+
+Also fix for bug #77659
+
+(cherry picked from commit 8ac6fee8562533a15db90062117210ed28b44fea)
+---
+ ext/exif/exif.c | 3 ++-
+ ext/exif/tests/bug77563.jpg | Bin 0 -> 63 bytes
+ ext/exif/tests/bug77563.phpt | 16 ++++++++++++++++
+ 3 files changed, 18 insertions(+), 1 deletion(-)
+ create mode 100644 ext/exif/tests/bug77563.jpg
+ create mode 100644 ext/exif/tests/bug77563.phpt
+
+diff --git a/ext/exif/exif.c b/ext/exif/exif.c
+index 5497068fb1..ce8db170c7 100644
+--- a/ext/exif/exif.c
++++ b/ext/exif/exif.c
+@@ -2751,7 +2751,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
+ break;
+ }
+
+- if (maker_note->offset >= value_len) {
++ if (value_len < 2 || maker_note->offset >= value_len - 1) {
+ /* Do not go past the value end */
+ exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "IFD data too short: 0x%04X offset 0x%04X", value_len, maker_note->offset);
+ return FALSE;
+@@ -2804,6 +2804,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
+ break;
+ default:
+ case MN_OFFSET_NORMAL:
++ data_len = value_len;
+ break;
+ }
+
+
diff --git a/php-bug77586.patch b/php-bug77586.patch
new file mode 100644
index 0000000..45a983f
--- /dev/null
+++ b/php-bug77586.patch
@@ -0,0 +1,102 @@
+From 11dda9a4fb4106bb2f35a717ca0bfb379fa7d1ad Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas at php.net>
+Date: Sun, 3 Mar 2019 22:33:38 -0800
+Subject: [PATCH] Fix bug #77586 - phar_tar_writeheaders_int() buffer overflow
+
+(cherry picked from commit e0f5d62bd6690169998474b62f92a8c5ddf0e699)
+---
+ ext/phar/tar.c | 7 ++++++-
+ ext/phar/tests/bug71488.phpt | 5 +++--
+ ext/phar/tests/bug77586.phpt | 21 +++++++++++++++++++
+ ...-dne29hvpNWXiVbepwIf8-NRHWM9LITLo3nXZnKVNC | 1 +
+ 4 files changed, 31 insertions(+), 3 deletions(-)
+ create mode 100644 ext/phar/tests/bug77586.phpt
+ create mode 100644 ext/phar/tests/bug77586/files/link-nktarAMLdJBv7BGYnpzg-ZDycSpWN3Ne3kacltOSE-EqfhStJ1EoBpGuoua6VE-dne29hvpNWXiVbepwIf8-NRHWM9LITLo3nXZnKVNC
+
+diff --git a/ext/phar/tar.c b/ext/phar/tar.c
+index 898ff859ab..7ad95ebba6 100644
+--- a/ext/phar/tar.c
++++ b/ext/phar/tar.c
+@@ -765,7 +765,12 @@ static int phar_tar_writeheaders(void *pDest, void *argument TSRMLS_DC) /* {{{ *
+ header.typeflag = entry->tar_type;
+
+ if (entry->link) {
+- strncpy(header.linkname, entry->link, strlen(entry->link));
++ if (strlcpy(header.linkname, entry->link, sizeof(header.linkname)) >= sizeof(header.linkname)) {
++ if (fp->error) {
++ spprintf(fp->error, 4096, "tar-based phar \"%s\" cannot be created, link \"%s\" is too long for format", entry->phar->fname, entry->link);
++ }
++ return ZEND_HASH_APPLY_STOP;
++ }
+ }
+
+ strncpy(header.magic, "ustar", sizeof("ustar")-1);
+diff --git a/ext/phar/tests/bug71488.phpt b/ext/phar/tests/bug71488.phpt
+index 22d2bf098f..65bd7b2d3c 100644
+--- a/ext/phar/tests/bug71488.phpt
++++ b/ext/phar/tests/bug71488.phpt
+@@ -13,5 +13,6 @@ DONE
+ <?php
+ @unlink(__DIR__."/bug71488.test");
+ ?>
+---EXPECT--
+-DONE
+\ No newline at end of file
++--EXPECTF--
++Fatal error: Uncaught BadMethodCallException: tar-based phar "%s/bug71488.test" cannot be created, link "%s" is too long for format in %sbug71488.php:%d
++Stack trace:%A
+diff --git a/ext/phar/tests/bug77586.phpt b/ext/phar/tests/bug77586.phpt
+new file mode 100644
+index 0000000000..039cc16994
+--- /dev/null
++++ b/ext/phar/tests/bug77586.phpt
+@@ -0,0 +1,21 @@
++--TEST--
++Bug #77586 Symbolic link names in tar-formatted phar must be less than 100 bytes.
++--SKIPIF--
++<?php if (!extension_loaded("phar") || true /* blocked by bug 65332 */) die("skip"); ?>
++--FILE--
++<?php
++$dir = __DIR__."/bug77586";
++$phar = new PharData($dir . "/bug77586.tar");
++$phar->buildFromDirectory($dir . "/files");
++?>
++--CLEAN--
++<?php
++$dir = __DIR__."/bug77586";
++unlink($dir . "/bug77586.tar");
++?>
++--EXPECTF--
++Fatal error: Uncaught PharException: tar-based phar "%s/bug77586.tar" cannot be created, link "%s" is too long for format %s
++Stack trace:
++#0 %s/bug77586.php(%d): PharData->buildFromDirectory('%s')
++#1 {main}
++ thrown in %s/bug77586.php %s on line %d
+diff --git a/ext/phar/tests/bug77586/files/link-nktarAMLdJBv7BGYnpzg-ZDycSpWN3Ne3kacltOSE-EqfhStJ1EoBpGuoua6VE-dne29hvpNWXiVbepwIf8-NRHWM9LITLo3nXZnKVNC b/ext/phar/tests/bug77586/files/link-nktarAMLdJBv7BGYnpzg-ZDycSpWN3Ne3kacltOSE-EqfhStJ1EoBpGuoua6VE-dne29hvpNWXiVbepwIf8-NRHWM9LITLo3nXZnKVNC
+new file mode 100644
+index 0000000000..1de565933b
+--- /dev/null
++++ b/ext/phar/tests/bug77586/files/link-nktarAMLdJBv7BGYnpzg-ZDycSpWN3Ne3kacltOSE-EqfhStJ1EoBpGuoua6VE-dne29hvpNWXiVbepwIf8-NRHWM9LITLo3nXZnKVNC
+@@ -0,0 +1 @@
++target
+\ No newline at end of file
+From 426ecc2f86e65a6105d510569b9f7bbbe67f765a Mon Sep 17 00:00:00 2001
+From: Anatol Belski <ab at php.net>
+Date: Wed, 6 Mar 2019 12:48:42 +0100
+Subject: [PATCH] Fix test
+
+---
+ ext/phar/tests/bug71488.phpt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/ext/phar/tests/bug71488.phpt b/ext/phar/tests/bug71488.phpt
+index 65bd7b2d3c..8468ce212a 100644
+--- a/ext/phar/tests/bug71488.phpt
++++ b/ext/phar/tests/bug71488.phpt
+@@ -14,5 +14,5 @@ DONE
+ @unlink(__DIR__."/bug71488.test");
+ ?>
+ --EXPECTF--
+-Fatal error: Uncaught BadMethodCallException: tar-based phar "%s/bug71488.test" cannot be created, link "%s" is too long for format in %sbug71488.php:%d
++Fatal error: Uncaught exception 'BadMethodCallException' with message 'tar-based phar "%sbug71488.test" cannot be created, link "%s" is too long for format' in %sbug71488.php:%d
+ Stack trace:%A
diff --git a/php-bug77630.patch b/php-bug77630.patch
new file mode 100644
index 0000000..71cbf12
--- /dev/null
+++ b/php-bug77630.patch
@@ -0,0 +1,86 @@
+From 0c78ce21f96537dbea40c1d4f7467617600d266b Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas at php.net>
+Date: Sat, 2 Mar 2019 23:42:53 -0800
+Subject: [PATCH] Fix bug #77630 - safer rename() procedure
+
+In order to rename safer, we do the following:
+- set umask to 077 (unfortunately, not TS, so excluding ZTS)
+- chown() first, to set proper group before allowing group access
+- chmod() after, even if chown() fails
+
+(cherry picked from commit e3133e4db70476fb7adfdedb738483e2255ce0e1)
+---
+ main/streams/plain_wrapper.c | 48 ++++++++++++++++++++++++------------
+ 1 file changed, 32 insertions(+), 16 deletions(-)
+
+diff --git a/main/streams/plain_wrapper.c b/main/streams/plain_wrapper.c
+index f472bad4b9..3e114a64ea 100644
+--- a/main/streams/plain_wrapper.c
++++ b/main/streams/plain_wrapper.c
+@@ -1126,34 +1126,50 @@ static int php_plain_files_rename(php_stream_wrapper *wrapper, const char *url_f
+ # ifdef EXDEV
+ if (errno == EXDEV) {
+ struct stat sb;
++# if !defined(ZTS) && !defined(TSRM_WIN32) && !defined(NETWARE)
++ /* not sure what to do in ZTS case, umask is not thread-safe */
++ int oldmask = umask(077);
++# endif
++ int success = 0;
+ if (php_copy_file(url_from, url_to TSRMLS_CC) == SUCCESS) {
+ if (VCWD_STAT(url_from, &sb) == 0) {
++ success = 1;
+ # if !defined(TSRM_WIN32) && !defined(NETWARE)
+- if (VCWD_CHMOD(url_to, sb.st_mode)) {
++ /*
++ * Try to set user and permission info on the target.
++ * If we're not root, then some of these may fail.
++ * We try chown first, to set proper group info, relying
++ * on the system environment to have proper umask to not allow
++ * access to the file in the meantime.
++ */
++ if (VCWD_CHOWN(url_to, sb.st_uid, sb.st_gid)) {
++ php_error_docref2(NULL TSRMLS_CC, url_from, url_to, E_WARNING, "%s", strerror(errno));
+ if (errno == EPERM) {
+- php_error_docref2(NULL TSRMLS_CC, url_from, url_to, E_WARNING, "%s", strerror(errno));
+- VCWD_UNLINK(url_from);
+- return 1;
++ success = 0;
+ }
+- php_error_docref2(NULL TSRMLS_CC, url_from, url_to, E_WARNING, "%s", strerror(errno));
+- return 0;
+ }
+- if (VCWD_CHOWN(url_to, sb.st_uid, sb.st_gid)) {
+- if (errno == EPERM) {
++ if (success) {
++ if (VCWD_CHMOD(url_to, sb.st_mode)) {
+ php_error_docref2(NULL TSRMLS_CC, url_from, url_to, E_WARNING, "%s", strerror(errno));
+- VCWD_UNLINK(url_from);
+- return 1;
++ if (errno == EPERM) {
++ success = 0;
++ }
+ }
+- php_error_docref2(NULL TSRMLS_CC, url_from, url_to, E_WARNING, "%s", strerror(errno));
+- return 0;
+ }
+ # endif
+- VCWD_UNLINK(url_from);
+- return 1;
++ if (success) {
++ VCWD_UNLINK(url_from);
++ }
++ } else {
++ php_error_docref2(NULL TSRMLS_CC, url_from, url_to, E_WARNING, "%s", strerror(errno));
+ }
++ } else {
++ php_error_docref2(NULL TSRMLS_CC, url_from, url_to, E_WARNING, "%s", strerror(errno));
+ }
+- php_error_docref2(NULL TSRMLS_CC, url_from, url_to, E_WARNING, "%s", strerror(errno));
+- return 0;
++# if !defined(ZTS) && !defined(TSRM_WIN32) && !defined(NETWARE)
++ umask(oldmask);
++# endif
++ return success;
+ }
+ # endif
+ #endif
diff --git a/php-bug77753.patch b/php-bug77753.patch
new file mode 100644
index 0000000..bcb324d
--- /dev/null
+++ b/php-bug77753.patch
@@ -0,0 +1,34 @@
+Without test as binary patch not supported
+
+
+
+
+From 1e7511f2476380f9eb523f60817610c8eab6b116 Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas at php.net>
+Date: Sun, 17 Mar 2019 22:54:46 -0700
+Subject: [PATCH] Fix bug #77753 - Heap-buffer-overflow in php_ifd_get32s
+
+(cherry picked from commit f3aefc6d071b807ddacae0a0bc49f09c38e18490)
+---
+ ext/exif/exif.c | 4 ++++
+ ext/exif/tests/bug77753.phpt | 16 ++++++++++++++++
+ ext/exif/tests/bug77753.tiff | Bin 0 -> 873 bytes
+ 3 files changed, 20 insertions(+)
+ create mode 100644 ext/exif/tests/bug77753.phpt
+ create mode 100644 ext/exif/tests/bug77753.tiff
+
+diff --git a/ext/exif/exif.c b/ext/exif/exif.c
+index ce8db170c7..4350124305 100644
+--- a/ext/exif/exif.c
++++ b/ext/exif/exif.c
+@@ -2812,6 +2812,10 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
+ exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 2 + 0x%04X*12 = 0x%04X > 0x%04X", NumDirEntries, 2+NumDirEntries*12, value_len);
+ return FALSE;
+ }
++ if ((dir_start - value_ptr) > value_len - (2+NumDirEntries*12)) {
++ exif_error_docref("exif_read_data#error_ifd" EXIFERR_CC, ImageInfo, E_WARNING, "Illegal IFD size: 0x%04X > 0x%04X", (dir_start - value_ptr) + (2+NumDirEntries*12), value_len);
++ return FALSE;
++ }
+
+ for (de=0;de<NumDirEntries;de++) {
+ if (!exif_process_IFD_TAG(ImageInfo, dir_start + 2 + 12 * de,
diff --git a/php-bug77831.patch b/php-bug77831.patch
new file mode 100644
index 0000000..a2a1ac4
--- /dev/null
+++ b/php-bug77831.patch
@@ -0,0 +1,196 @@
+Without test as binary patch not supported
+
+
+
+
+From 1f2fdcd9a2471e6fac220ec2e7a2ca56b7879113 Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas at php.net>
+Date: Tue, 2 Apr 2019 00:12:26 -0700
+Subject: [PATCH] Fixed bug #77831 - Heap-buffer-overflow in exif_iif_add_value
+ in EXIF
+
+(cherry picked from commit 887a7b571407f7a49a5e7cf1e612d21ef83fedb4)
+---
+ NEWS | 4 ++++
+ ext/exif/exif.c | 43 +++++++++++++++++++++++------------
+ ext/exif/tests/bug77831.phpt | 13 +++++++++++
+ ext/exif/tests/bug77831.tiff | Bin 0 -> 49 bytes
+ 4 files changed, 45 insertions(+), 15 deletions(-)
+ create mode 100644 ext/exif/tests/bug77831.phpt
+ create mode 100644 ext/exif/tests/bug77831.tiff
+
+diff --git a/ext/exif/exif.c b/ext/exif/exif.c
+index 4350124305..547bd58dfb 100644
+--- a/ext/exif/exif.c
++++ b/ext/exif/exif.c
+@@ -1660,10 +1660,10 @@ static int exif_file_sections_free(image_info_type *ImageInfo)
+ /* {{{ exif_iif_add_value
+ Add a value to image_info
+ */
+-static void exif_iif_add_value(image_info_type *image_info, int section_index, char *name, int tag, int format, int length, void* value, int motorola_intel TSRMLS_DC)
++static void exif_iif_add_value(image_info_type *image_info, int section_index, char *name, int tag, int format, int length, void* value, size_t value_len, int motorola_intel TSRMLS_DC)
+ {
+ size_t idex;
+- void *vptr;
++ void *vptr, *vptr_end;
+ image_info_value *info_value;
+ image_info_data *info_data;
+ image_info_data *list;
+@@ -1685,8 +1685,12 @@ static void exif_iif_add_value(image_info_type *image_info, int section_index, c
+
+ switch (format) {
+ case TAG_FMT_STRING:
++ if (length > value_len) {
++ exif_error_docref("exif_iif_add_value" EXIFERR_CC, image_info, E_WARNING, "length > value_len: %d > %zu", length, value_len);
++ value = NULL;
++ }
+ if (value) {
+- length = php_strnlen(value, length);
++ length = (int)php_strnlen(value, length);
+ info_value->s = estrndup(value, length);
+ info_data->length = length;
+ } else {
+@@ -1708,6 +1712,10 @@ static void exif_iif_add_value(image_info_type *image_info, int section_index, c
+ if (!length)
+ break;
+ case TAG_FMT_UNDEFINED:
++ if (length > value_len) {
++ exif_error_docref("exif_iif_add_value" EXIFERR_CC, image_info, E_WARNING, "length > value_len: %d > %zu", length, value_len);
++ value = NULL;
++ }
+ if (value) {
+ if (tag == TAG_MAKER_NOTE) {
+ length = (int) php_strnlen(value, length);
+@@ -1738,7 +1746,12 @@ static void exif_iif_add_value(image_info_type *image_info, int section_index, c
+ } else {
+ info_value = &info_data->value;
+ }
++ vptr_end = value+value_len;
+ for (idex=0,vptr=value; idex<(size_t)length; idex++,vptr=(char *) vptr + php_tiff_bytes_per_format[format]) {
++ if (vptr_end - vptr < php_tiff_bytes_per_format[format]) {
++ exif_error_docref("exif_iif_add_value" EXIFERR_CC, image_info, E_WARNING, "Value too short");
++ break;
++ }
+ if (length>1) {
+ info_value = &info_data->value.list[idex];
+ }
+@@ -1774,7 +1787,7 @@ static void exif_iif_add_value(image_info_type *image_info, int section_index, c
+ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Found value of type single");
+ #endif
+ info_value->f = *(float *)value;
+-
++ break;
+ case TAG_FMT_DOUBLE:
+ #ifdef EXIF_DEBUG
+ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Found value of type double");
+@@ -1792,9 +1805,9 @@ static void exif_iif_add_value(image_info_type *image_info, int section_index, c
+ /* {{{ exif_iif_add_tag
+ Add a tag from IFD to image_info
+ */
+-static void exif_iif_add_tag(image_info_type *image_info, int section_index, char *name, int tag, int format, size_t length, void* value TSRMLS_DC)
++static void exif_iif_add_tag(image_info_type *image_info, int section_index, char *name, int tag, int format, size_t length, void* value, size_t value_len TSRMLS_DC)
+ {
+- exif_iif_add_value(image_info, section_index, name, tag, format, (int)length, value, image_info->motorola_intel TSRMLS_CC);
++ exif_iif_add_value(image_info, section_index, name, tag, format, (int)length, value, value_len, image_info->motorola_intel TSRMLS_CC);
+ }
+ /* }}} */
+
+@@ -2218,7 +2231,7 @@ static void add_assoc_image_info(zval *value, int sub_array, image_info_type *im
+ */
+ static void exif_process_COM (image_info_type *image_info, char *value, size_t length TSRMLS_DC)
+ {
+- exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_STRING, length-2, value+2 TSRMLS_CC);
++ exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_STRING, length-2, value+2, length-2 TSRMLS_CC);
+ }
+ /* }}} */
+
+@@ -2233,17 +2246,17 @@ static void exif_process_CME (image_info_type *image_info, char *value, size_t l
+ if (length>3) {
+ switch(value[2]) {
+ case 0:
+- exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_UNDEFINED, length, value TSRMLS_CC);
++ exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_UNDEFINED, length, value, length TSRMLS_CC);
+ break;
+ case 1:
+- exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_STRING, length, value);
++ exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_STRING, length, value, length);
+ break;
+ default:
+ php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Undefined JPEG2000 comment encoding");
+ break;
+ }
+ } else {
+- exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_UNDEFINED, 0, NULL);
++ exif_iif_add_tag(image_info, SECTION_COMMENT, "Comment", TAG_COMPUTED_VALUE, TAG_FMT_UNDEFINED, 0, NULL, 0 TSRMLS_CC);
+ php_error_docref(NULL TSRMLS_CC, E_NOTICE, "JPEG2000 comment section too small");
+ }
+ }
+@@ -2837,7 +2850,7 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
+ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, char *offset_base, size_t IFDlength, size_t displacement, int section_index, int ReadNextIFD, tag_table_type tag_table TSRMLS_DC)
+ {
+ size_t length;
+- int tag, format, components;
++ unsigned int tag, format, components;
+ char *value_ptr, tagname[64], cbuf[32], *outside=NULL;
+ size_t byte_count, offset_val, fpos, fgot;
+ int64_t byte_count_signed;
+@@ -3148,7 +3161,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
+ }
+ }
+ }
+- exif_iif_add_tag(ImageInfo, section_index, exif_get_tagname(tag, tagname, sizeof(tagname), tag_table TSRMLS_CC), tag, format, components, value_ptr TSRMLS_CC);
++ exif_iif_add_tag(ImageInfo, section_index, exif_get_tagname(tag, tagname, sizeof(tagname), tag_table TSRMLS_CC), tag, format, components, value_ptr, byte_count TSRMLS_CC);
+ EFREE_IF(outside);
+ return TRUE;
+ }
+@@ -3306,10 +3319,10 @@ static void exif_process_APP12(image_info_type *ImageInfo, char *buffer, size_t
+ size_t l1, l2=0;
+
+ if ((l1 = php_strnlen(buffer+2, length-2)) > 0) {
+- exif_iif_add_tag(ImageInfo, SECTION_APP12, "Company", TAG_NONE, TAG_FMT_STRING, l1, buffer+2 TSRMLS_CC);
++ exif_iif_add_tag(ImageInfo, SECTION_APP12, "Company", TAG_NONE, TAG_FMT_STRING, l1, buffer+2, l1 TSRMLS_CC);
+ if (length > 2+l1+1) {
+ l2 = php_strnlen(buffer+2+l1+1, length-2-l1-1);
+- exif_iif_add_tag(ImageInfo, SECTION_APP12, "Info", TAG_NONE, TAG_FMT_STRING, l2, buffer+2+l1+1 TSRMLS_CC);
++ exif_iif_add_tag(ImageInfo, SECTION_APP12, "Info", TAG_NONE, TAG_FMT_STRING, l2, buffer+2+l1+1, l2 TSRMLS_CC);
+ }
+ }
+ #ifdef EXIF_DEBUG
+@@ -4107,7 +4120,7 @@ PHP_FUNCTION(exif_read_data)
+ if (ImageInfo.Thumbnail.size) {
+ if (read_thumbnail) {
+ /* not exif_iif_add_str : this is a buffer */
+- exif_iif_add_tag(&ImageInfo, SECTION_THUMBNAIL, "THUMBNAIL", TAG_NONE, TAG_FMT_UNDEFINED, ImageInfo.Thumbnail.size, ImageInfo.Thumbnail.data TSRMLS_CC);
++ exif_iif_add_tag(&ImageInfo, SECTION_THUMBNAIL, "THUMBNAIL", TAG_NONE, TAG_FMT_UNDEFINED, ImageInfo.Thumbnail.size, ImageInfo.Thumbnail.data, ImageInfo.Thumbnail.size TSRMLS_CC);
+ }
+ if (!ImageInfo.Thumbnail.width || !ImageInfo.Thumbnail.height) {
+ /* try to evaluate if thumbnail data is present */
+From 8b4b035dcd3f382e9de4e2f661df2dc0797fc478 Mon Sep 17 00:00:00 2001
+From: "Christoph M. Becker" <cmbecker69 at gmx.de>
+Date: Tue, 2 Apr 2019 10:37:40 +0200
+Subject: [PATCH] Pointer arithmetic on void pointers is illegal
+
+We quick-fix this by casting to char*; it might be more appropriate to
+use char pointers in the first place.
+
+(cherry picked from commit 01a4de5c5821f67daeff487ef9b3047ce7b47c4c)
+---
+ ext/exif/exif.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/ext/exif/exif.c b/ext/exif/exif.c
+index 547bd58dfb..81cf438a8e 100644
+--- a/ext/exif/exif.c
++++ b/ext/exif/exif.c
+@@ -1746,9 +1746,9 @@ static void exif_iif_add_value(image_info_type *image_info, int section_index, c
+ } else {
+ info_value = &info_data->value;
+ }
+- vptr_end = value+value_len;
++ vptr_end = (char *) value + value_len;
+ for (idex=0,vptr=value; idex<(size_t)length; idex++,vptr=(char *) vptr + php_tiff_bytes_per_format[format]) {
+- if (vptr_end - vptr < php_tiff_bytes_per_format[format]) {
++ if ((char *) vptr_end - (char *) vptr < php_tiff_bytes_per_format[format]) {
+ exif_error_docref("exif_iif_add_value" EXIFERR_CC, image_info, E_WARNING, "Value too short");
+ break;
+ }
diff --git a/php-bug77919.patch b/php-bug77919.patch
new file mode 100644
index 0000000..526fd79
--- /dev/null
+++ b/php-bug77919.patch
@@ -0,0 +1,52 @@
+From 245e5011da14098b8158cf5c5400483399729298 Mon Sep 17 00:00:00 2001
+From: "Christoph M. Becker" <cmbecker69 at gmx.de>
+Date: Mon, 29 Jul 2019 16:08:03 +0200
+Subject: [PATCH] Fix #77919: Potential UAF in Phar RSHUTDOWN
+
+We have to properly clean up in case phar_flush() is failing.
+
+We also make the expectation of the respective test case less liberal
+to avoid missing such bugs in the future.
+
+(cherry picked from commit cd1101e8c87aa175c2d5e87ddec656e50ef4ab5d)
+---
+ NEWS | 10 ++++++++++
+ ext/phar/phar_object.c | 4 +++-
+ ext/phar/tests/bug71488.phpt | 5 ++++-
+ 3 files changed, 17 insertions(+), 2 deletions(-)
+
+diff --git a/ext/phar/phar_object.c b/ext/phar/phar_object.c
+index 77e08c52a5..d69837218f 100644
+--- a/ext/phar/phar_object.c
++++ b/ext/phar/phar_object.c
+@@ -2026,7 +2026,7 @@ static zval *phar_rename_archive(phar_archive_data **sphar, char *ext, zend_bool
+ char *newname = NULL, *newpath = NULL;
+ zval *ret, arg1;
+ zend_class_entry *ce;
+- char *error;
++ char *error = NULL;
+ const char *pcr_error;
+ int ext_len = ext ? strlen(ext) : 0;
+ int oldname_len;
+@@ -2186,6 +2186,8 @@ static zval *phar_rename_archive(phar_archive_data **sphar, char *ext, zend_bool
+ phar_flush(phar, 0, 0, 1, &error TSRMLS_CC);
+
+ if (error) {
++ zend_hash_del(&(PHAR_G(phar_fname_map)), newpath, phar->fname_len);
++ *sphar = NULL;
+ zend_throw_exception_ex(spl_ce_BadMethodCallException, 0 TSRMLS_CC, "%s", error);
+ efree(error);
+ efree(oldpath);
+diff --git a/ext/phar/tests/bug71488.phpt b/ext/phar/tests/bug71488.phpt
+index 8468ce212a..b8c0f33250 100644
+--- a/ext/phar/tests/bug71488.phpt
++++ b/ext/phar/tests/bug71488.phpt
+@@ -15,4 +15,7 @@ DONE
+ ?>
+ --EXPECTF--
+ Fatal error: Uncaught exception 'BadMethodCallException' with message 'tar-based phar "%sbug71488.test" cannot be created, link "%s" is too long for format' in %sbug71488.php:%d
+-Stack trace:%A
++Stack trace:
++#0 %s(%d): PharData->decompress('test')
++#1 {main}
++ thrown in %s on line %d
diff --git a/php-bug77950.patch b/php-bug77950.patch
new file mode 100644
index 0000000..b3020da
--- /dev/null
+++ b/php-bug77950.patch
@@ -0,0 +1,39 @@
+Without test as binary patch not supported
+
+
+
+
+From 7cbf6a0ca98a187be1b31b1e85935319430d9e61 Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas at php.net>
+Date: Mon, 29 Apr 2019 23:38:12 -0700
+Subject: [PATCH] Fix bug #77950 - Heap-buffer-overflow in _estrndup via
+ exif_process_IFD_TAG
+
+I do not completely understand what is going on there, but I am pretty
+sure dir_entry <= offset_base if not a normal situation, so we better not
+to rely on such dir_entry.
+
+(cherry picked from commit f80ad18afae2230c2c1802c7d829100af646874e)
+---
+ NEWS | 12 ++++++++++--
+ ext/exif/exif.c | 2 +-
+ ext/exif/tests/bug77950.phpt | 12 ++++++++++++
+ ext/exif/tests/bug77950.tiff | Bin 0 -> 1267 bytes
+ 4 files changed, 23 insertions(+), 3 deletions(-)
+ create mode 100644 ext/exif/tests/bug77950.phpt
+ create mode 100644 ext/exif/tests/bug77950.tiff
+
+diff --git a/ext/exif/exif.c b/ext/exif/exif.c
+index 81cf438a8e..15e091b6c5 100644
+--- a/ext/exif/exif.c
++++ b/ext/exif/exif.c
+@@ -2901,7 +2901,7 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
+ offset_base is ImageInfo->file.list[sn].data-dir_offset
+ dir_entry - offset_base is dir_offset+2+i*12
+ */
+- if (byte_count > IFDlength || offset_val > IFDlength-byte_count || value_ptr < dir_entry || offset_val < (size_t)(dir_entry-offset_base)) {
++ if (byte_count > IFDlength || offset_val > IFDlength-byte_count || value_ptr < dir_entry || offset_val < (size_t)(dir_entry-offset_base) || dir_entry <= offset_base) {
+ /* It is important to check for IMAGE_FILETYPE_TIFF
+ * JPEG does not use absolute pointers instead its pointers are
+ * relative to the start of the TIFF header in APP1 section. */
+
diff --git a/php-bug77967.patch b/php-bug77967.patch
new file mode 100644
index 0000000..5699841
--- /dev/null
+++ b/php-bug77967.patch
@@ -0,0 +1,32 @@
+From 7de8c0284cd9e237eb8a1faa9b41af1d3ef32ea9 Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas at php.net>
+Date: Mon, 27 May 2019 18:04:00 -0700
+Subject: [PATCH] Fix bug #77967 - Bypassing open_basedir restrictions via file
+ uris
+
+(cherry picked from commit c34895e837b50213c2bb201c612904342d2bd216)
+---
+ NEWS | 7 +++++--
+ ext/sqlite3/sqlite3.c | 9 +++++++++
+ 2 files changed, 14 insertions(+), 2 deletions(-)
+
+diff --git a/ext/sqlite3/sqlite3.c b/ext/sqlite3/sqlite3.c
+index 761b777d06..7bf873ff69 100644
+--- a/ext/sqlite3/sqlite3.c
++++ b/ext/sqlite3/sqlite3.c
+@@ -2062,6 +2062,15 @@ static int php_sqlite3_authorizer(void *autharg, int access_type, const char *ar
+ }
+ #endif
+
++ if (strncmp(arg3, "file:", 5) == 0) {
++ /* starts with "file:" */
++ if (!arg3[5]) {
++ return SQLITE_DENY;
++ }
++ if (php_check_open_basedir(arg3 + 5 TSRMLS_CC)) {
++ return SQLITE_DENY;
++ }
++ }
+ if (php_check_open_basedir(arg3 TSRMLS_CC)) {
+ return SQLITE_DENY;
+ }
diff --git a/php-bug77988.patch b/php-bug77988.patch
new file mode 100644
index 0000000..381e19a
--- /dev/null
+++ b/php-bug77988.patch
@@ -0,0 +1,34 @@
+Without test as binary patch not supported
+
+
+
+
+From 9e0574adfd9566ed6308291e4917b095a238fa79 Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas at php.net>
+Date: Mon, 27 May 2019 17:16:29 -0700
+Subject: [PATCH] Fix bug #77988 - heap-buffer-overflow on php_jpg_get16
+
+(cherry picked from commit 73ff4193be24192c894dc0502d06e2b2db35eefb)
+---
+ NEWS | 14 ++++++++++++++
+ ext/exif/exif.c | 2 ++
+ ext/exif/tests/bug77988.jpg | Bin 0 -> 1202 bytes
+ ext/exif/tests/bug77988.phpt | 11 +++++++++++
+ 4 files changed, 27 insertions(+)
+ create mode 100644 ext/exif/tests/bug77988.jpg
+ create mode 100644 ext/exif/tests/bug77988.phpt
+
+diff --git a/ext/exif/exif.c b/ext/exif/exif.c
+index 15e091b6c5..b6c31773ab 100644
+--- a/ext/exif/exif.c
++++ b/ext/exif/exif.c
+@@ -3536,6 +3536,8 @@ static int exif_scan_thumbnail(image_info_type *ImageInfo TSRMLS_DC)
+ if (c == 0xFF)
+ return FALSE;
+ marker = c;
++ if (pos>=ImageInfo->Thumbnail.size)
++ return FALSE;
+ length = php_jpg_get16(data+pos);
+ if (length > ImageInfo->Thumbnail.size || pos >= ImageInfo->Thumbnail.size - length) {
+ return FALSE;
+
diff --git a/php-bug78069.patch b/php-bug78069.patch
new file mode 100644
index 0000000..583db1d
--- /dev/null
+++ b/php-bug78069.patch
@@ -0,0 +1,36 @@
+Without test as binary patch not supported
+
+
+
+
+From aabd02d6dd1eab180486cff933dc8d08d4297e38 Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas at php.net>
+Date: Mon, 27 May 2019 16:32:42 -0700
+Subject: [PATCH] Fix bug #78069 - Out-of-bounds read in
+ iconv.c:_php_iconv_mime_decode() due to integer overflow
+
+(cherry picked from commit 7cf7148a8f8f4f55fb04de2a517d740bb6253eac)
+---
+ ext/iconv/iconv.c | 4 +++-
+ ext/iconv/tests/bug78069.data | Bin 0 -> 107 bytes
+ ext/iconv/tests/bug78069.phpt | 15 +++++++++++++++
+ 3 files changed, 18 insertions(+), 1 deletion(-)
+ create mode 100644 ext/iconv/tests/bug78069.data
+ create mode 100644 ext/iconv/tests/bug78069.phpt
+
+diff --git a/ext/iconv/iconv.c b/ext/iconv/iconv.c
+index 335dbd17e9..bbc4b0f5e3 100644
+--- a/ext/iconv/iconv.c
++++ b/ext/iconv/iconv.c
+@@ -1645,7 +1645,9 @@ static php_iconv_err_t _php_iconv_mime_decode(smart_str *pretval, const char *st
+ * we can do at this point. */
+ if (*(p1 + 1) == '=') {
+ ++p1;
+- --str_left;
++ if (str_left > 1) {
++ --str_left;
++ }
+ }
+
+ err = _php_iconv_appendl(pretval, encoded_word, (size_t)((p1 + 1) - encoded_word), cd_pl);
+
diff --git a/php-bug78222.patch b/php-bug78222.patch
new file mode 100644
index 0000000..13ea1d5
--- /dev/null
+++ b/php-bug78222.patch
@@ -0,0 +1,32 @@
+Without test as binary patch not supported
+
+
+
+
+From 13cbda640120afdaf68f44bb482723d451bc86ec Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas at php.net>
+Date: Sun, 7 Jul 2019 17:01:01 -0700
+Subject: [PATCH] Fix bug #78222 (heap-buffer-overflow on exif_scan_thumbnail)
+
+(cherry picked from commit dea2989ab8ba87a6180af497b2efaf0527e985c5)
+---
+ ext/exif/exif.c | 2 +-
+ ext/exif/tests/bug78222.jpg | Bin 0 -> 91 bytes
+ ext/exif/tests/bug78222.phpt | 11 +++++++++++
+ 3 files changed, 12 insertions(+), 1 deletion(-)
+ create mode 100644 ext/exif/tests/bug78222.jpg
+ create mode 100644 ext/exif/tests/bug78222.phpt
+
+diff --git a/ext/exif/exif.c b/ext/exif/exif.c
+index b6c31773ab..a5fa0b8fb0 100644
+--- a/ext/exif/exif.c
++++ b/ext/exif/exif.c
+@@ -3508,7 +3508,7 @@ static int exif_scan_thumbnail(image_info_type *ImageInfo TSRMLS_DC)
+ size_t length=2, pos=0;
+ jpeg_sof_info sof_info;
+
+- if (!data) {
++ if (!data || ImageInfo->Thumbnail.size < 4) {
+ return FALSE; /* nothing to do here */
+ }
+ if (memcmp(data, "\xFF\xD8\xFF", 3)) {
diff --git a/php-bug78256.patch b/php-bug78256.patch
new file mode 100644
index 0000000..553bcac
--- /dev/null
+++ b/php-bug78256.patch
@@ -0,0 +1,47 @@
+Without test as binary patch not supported
+
+
+
+
+From 63c0ed60c2b5580b1542690d52d4a26401342563 Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas at php.net>
+Date: Sun, 7 Jul 2019 17:39:59 -0700
+Subject: [PATCH] Fix bug #78256 (heap-buffer-overflow on
+ exif_process_user_comment)
+
+(cherry picked from commit aeb6d13185a2ea4f1496ede2697469faed98ce05)
+---
+ ext/exif/exif.c | 6 +++---
+ ext/exif/tests/bug78256.jpg | Bin 0 -> 69 bytes
+ ext/exif/tests/bug78256.phpt | 11 +++++++++++
+ 3 files changed, 14 insertions(+), 3 deletions(-)
+ create mode 100644 ext/exif/tests/bug78256.jpg
+ create mode 100644 ext/exif/tests/bug78256.phpt
+
+diff --git a/ext/exif/exif.c b/ext/exif/exif.c
+index a5fa0b8fb0..ec362f7e6d 100644
+--- a/ext/exif/exif.c
++++ b/ext/exif/exif.c
+@@ -2628,7 +2628,7 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
+ {
+ int a;
+ char *decode;
+- size_t len;;
++ size_t len;
+
+ *pszEncoding = NULL;
+ /* Copy the comment */
+@@ -2641,11 +2641,11 @@ static int exif_process_user_comment(image_info_type *ImageInfo, char **pszInfoP
+ /* First try to detect BOM: ZERO WIDTH NOBREAK SPACE (FEFF 16)
+ * since we have no encoding support for the BOM yet we skip that.
+ */
+- if (!memcmp(szValuePtr, "\xFE\xFF", 2)) {
++ if (ByteCount >=2 && !memcmp(szValuePtr, "\xFE\xFF", 2)) {
+ decode = "UCS-2BE";
+ szValuePtr = szValuePtr+2;
+ ByteCount -= 2;
+- } else if (!memcmp(szValuePtr, "\xFF\xFE", 2)) {
++ } else if (ByteCount >=2 && !memcmp(szValuePtr, "\xFF\xFE", 2)) {
+ decode = "UCS-2LE";
+ szValuePtr = szValuePtr+2;
+ ByteCount -= 2;
diff --git a/php-bug78380.patch b/php-bug78380.patch
new file mode 100644
index 0000000..1a82daf
--- /dev/null
+++ b/php-bug78380.patch
@@ -0,0 +1,59 @@
+From 8cc1b123b05c51442b9a4fc4ea61d7719ee96e0e Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas at php.net>
+Date: Sat, 24 Aug 2019 23:11:45 -0700
+Subject: [PATCH 2/3] Fix CVE-2019-13224: don't allow different encodings for
+ onig_new_deluxe()
+
+Backport from https://github.com/kkos/oniguruma/commit/0f7f61ed1b7b697e283e37bd2d731d0bd57adb55
+
+(cherry picked from commit 1258303e66d8dede4f02347334b9f6576e98a21b)
+---
+ ext/mbstring/oniguruma/regext.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/ext/mbstring/oniguruma/regext.c b/ext/mbstring/oniguruma/regext.c
+index b1b957b40c..b108e638c6 100644
+--- a/ext/mbstring/oniguruma/regext.c
++++ b/ext/mbstring/oniguruma/regext.c
+@@ -29,6 +29,7 @@
+
+ #include "regint.h"
+
++#if 0
+ static void
+ conv_ext0be32(const UChar* s, const UChar* end, UChar* conv)
+ {
+@@ -158,6 +159,7 @@ conv_encoding(OnigEncoding from, OnigEncoding to, const UChar* s, const UChar* e
+
+ return ONIGERR_NOT_SUPPORTED_ENCODING_COMBINATION;
+ }
++#endif
+
+ extern int
+ onig_new_deluxe(regex_t** reg, const UChar* pattern, const UChar* pattern_end,
+@@ -169,9 +171,7 @@ onig_new_deluxe(regex_t** reg, const UChar* pattern, const UChar* pattern_end,
+ if (IS_NOT_NULL(einfo)) einfo->par = (UChar* )NULL;
+
+ if (ci->pattern_enc != ci->target_enc) {
+- r = conv_encoding(ci->pattern_enc, ci->target_enc, pattern, pattern_end,
+- &cpat, &cpat_end);
+- if (r) return r;
++ return ONIGERR_NOT_SUPPORTED_ENCODING_COMBINATION;
+ }
+ else {
+ cpat = (UChar* )pattern;
+--
+2.20.1
+
+From b0aa68eade0d15274465136a6d6b84edd8ab6e4b Mon Sep 17 00:00:00 2001
+From: Remi Collet <remi at remirepo.net>
+Date: Wed, 28 Aug 2019 14:06:50 +0200
+Subject: [PATCH 3/3] NEWS
+
+---
+ NEWS | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--
+2.20.1
+
diff --git a/php-bug78793.patch b/php-bug78793.patch
new file mode 100644
index 0000000..4476df6
--- /dev/null
+++ b/php-bug78793.patch
@@ -0,0 +1,47 @@
+From 7dffbc16e459f1c0379eb75a32bdf8a8666c4ca1 Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas at php.net>
+Date: Mon, 16 Dec 2019 01:14:38 -0800
+Subject: [PATCH] Fix bug #78793
+
+(cherry picked from commit c14eb8de974fc8a4d74f3515424c293bc7a40fba)
+---
+ NEWS | 4 ++++
+ ext/exif/exif.c | 5 +++--
+ ext/exif/tests/bug78793.phpt | 12 ++++++++++++
+ 3 files changed, 19 insertions(+), 2 deletions(-)
+ create mode 100644 ext/exif/tests/bug78793.phpt
+
+diff --git a/ext/exif/exif.c b/ext/exif/exif.c
+index ec362f7e6d..6a3bb912c3 100644
+--- a/ext/exif/exif.c
++++ b/ext/exif/exif.c
+@@ -2831,8 +2831,9 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
+ }
+
+ for (de=0;de<NumDirEntries;de++) {
+- if (!exif_process_IFD_TAG(ImageInfo, dir_start + 2 + 12 * de,
+- offset_base, data_len, displacement, section_index, 0, maker_note->tag_table TSRMLS_CC)) {
++ size_t offset = 2 + 12 * de;
++ if (!exif_process_IFD_TAG(ImageInfo, dir_start + offset,
++ offset_base, data_len - offset, displacement, section_index, 0, maker_note->tag_table TSRMLS_CC)) {
+ return FALSE;
+ }
+ }
+diff --git a/ext/exif/tests/bug78793.phpt b/ext/exif/tests/bug78793.phpt
+new file mode 100644
+index 0000000000..033f255ace
+--- /dev/null
++++ b/ext/exif/tests/bug78793.phpt
+@@ -0,0 +1,12 @@
++--TEST--
++Bug #78793: Use-after-free in exif parsing under memory sanitizer
++--FILE--
++<?php
++$f = "ext/exif/tests/bug77950.tiff";
++for ($i = 0; $i < 10; $i++) {
++ @exif_read_data($f);
++}
++?>
++===DONE===
++--EXPECT--
++===DONE===
diff --git a/php-bug78862.patch b/php-bug78862.patch
new file mode 100644
index 0000000..f5d6b58
--- /dev/null
+++ b/php-bug78862.patch
@@ -0,0 +1,53 @@
+From 51eb09b2b14711c1d81c075429811c5f2a885be4 Mon Sep 17 00:00:00 2001
+From: "Christoph M. Becker" <cmbecker69 at gmx.de>
+Date: Sat, 23 Nov 2019 13:01:33 +0100
+Subject: [PATCH] Fix #78862: link() silently truncates after a null byte on
+ Windows
+
+Since link() is supposed to accepts paths (i.e. strings without NUL
+bytes), we must not accept arbitrary strings.
+
+(cherry picked from commit 0e6c0654ed06751ced134515f7629c40bd979d7f)
+---
+ NEWS | 4 ++++
+ ext/standard/link_win32.c | 2 +-
+ .../tests/file/windows_links/bug78862.phpt | 17 +++++++++++++++++
+ 3 files changed, 22 insertions(+), 1 deletion(-)
+ create mode 100644 ext/standard/tests/file/windows_links/bug78862.phpt
+
+diff --git a/ext/standard/link_win32.c b/ext/standard/link_win32.c
+index 059201c6b2..4c537dbf69 100644
+--- a/ext/standard/link_win32.c
++++ b/ext/standard/link_win32.c
+@@ -208,7 +208,7 @@ PHP_FUNCTION(link)
+
+ /*First argument to link function is the target and hence should go to frompath
+ Second argument to link function is the link itself and hence should go to topath */
+- if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ss", &frompath, &frompath_len, &topath, &topath_len) == FAILURE) {
++ if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "pp", &frompath, &frompath_len, &topath, &topath_len) == FAILURE) {
+ return;
+ }
+
+diff --git a/ext/standard/tests/file/windows_links/bug78862.phpt b/ext/standard/tests/file/windows_links/bug78862.phpt
+new file mode 100644
+index 0000000000..33b4b49293
+--- /dev/null
++++ b/ext/standard/tests/file/windows_links/bug78862.phpt
+@@ -0,0 +1,17 @@
++--TEST--
++Bug #78862 (link() silently truncates after a null byte on Windows)
++--FILE--
++<?php
++file_put_contents(__DIR__ . '/bug78862.target', 'foo');
++var_dump(link(__DIR__ . "/bug78862.target\0more", __DIR__ . "/bug78862.link\0more"));
++var_dump(file_exists(__DIR__ . '/bug78862.link'));
++?>
++--EXPECTF--
++Warning: link() expects parameter 1 to be a valid path, string given in %s on line %d
++NULL
++bool(false)
++--CLEAN--
++<?php
++unlink(__DIR__ . '/bug78862.target');
++unlink(__DIR__ . '/bug78862.link');
++?>
diff --git a/php-bug78863.patch b/php-bug78863.patch
new file mode 100644
index 0000000..dacf5d7
--- /dev/null
+++ b/php-bug78863.patch
@@ -0,0 +1,72 @@
+From 4fe7ea95d92de389bbfa46e155f7dd97b0d4d320 Mon Sep 17 00:00:00 2001
+From: "Christoph M. Becker" <cmbecker69 at gmx.de>
+Date: Mon, 25 Nov 2019 16:56:34 +0100
+Subject: [PATCH] Fix #78863: DirectoryIterator class silently truncates after
+ a null byte
+
+Since the constructor of DirectoryIterator and friends is supposed to
+accepts paths (i.e. strings without NUL bytes), we must not accept
+arbitrary strings.
+
+(cherry picked from commit a5a15965da23c8e97657278fc8dfbf1dfb20c016)
+---
+ NEWS | 2 ++
+ ext/spl/spl_directory.c | 4 ++--
+ ext/spl/tests/bug78863.phpt | 31 +++++++++++++++++++++++++++++++
+ 3 files changed, 35 insertions(+), 2 deletions(-)
+ create mode 100644 ext/spl/tests/bug78863.phpt
+
+diff --git a/ext/spl/spl_directory.c b/ext/spl/spl_directory.c
+index fbcf892c3d..3a22357a26 100644
+--- a/ext/spl/spl_directory.c
++++ b/ext/spl/spl_directory.c
+@@ -691,10 +691,10 @@ void spl_filesystem_object_construct(INTERNAL_FUNCTION_PARAMETERS, long ctor_fla
+
+ if (SPL_HAS_FLAG(ctor_flags, DIT_CTOR_FLAGS)) {
+ flags = SPL_FILE_DIR_KEY_AS_PATHNAME|SPL_FILE_DIR_CURRENT_AS_FILEINFO;
+- parsed = zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|l", &path, &len, &flags);
++ parsed = zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|l", &path, &len, &flags);
+ } else {
+ flags = SPL_FILE_DIR_KEY_AS_PATHNAME|SPL_FILE_DIR_CURRENT_AS_SELF;
+- parsed = zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &path, &len);
++ parsed = zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &path, &len);
+ }
+ if (SPL_HAS_FLAG(ctor_flags, SPL_FILE_DIR_SKIPDOTS)) {
+ flags |= SPL_FILE_DIR_SKIPDOTS;
+diff --git a/ext/spl/tests/bug78863.phpt b/ext/spl/tests/bug78863.phpt
+new file mode 100644
+index 0000000000..dc88d98dee
+--- /dev/null
++++ b/ext/spl/tests/bug78863.phpt
+@@ -0,0 +1,31 @@
++--TEST--
++Bug #78863 (DirectoryIterator class silently truncates after a null byte)
++--FILE--
++<?php
++$dir = __DIR__ . '/bug78863';
++mkdir($dir);
++touch("$dir/bad");
++mkdir("$dir/sub");
++touch("$dir/sub/good");
++
++$it = new DirectoryIterator(__DIR__ . "/bug78863\0/sub");
++foreach ($it as $fileinfo) {
++ if (!$fileinfo->isDot()) {
++ var_dump($fileinfo->getFilename());
++ }
++}
++?>
++--EXPECTF--
++Fatal error: Uncaught UnexpectedValueException: DirectoryIterator::__construct() expects parameter 1 to be a valid path, string given in %s:%d
++Stack trace:
++#0 %s(%d): DirectoryIterator->__construct('%s')
++#1 {main}
++ thrown in %s on line %d
++--CLEAN--
++<?php
++$dir = __DIR__ . '/bug78863';
++unlink("$dir/sub/good");
++rmdir("$dir/sub");
++unlink("$dir/bad");
++rmdir($dir);
++?>
diff --git a/php-bug78875.patch b/php-bug78875.patch
new file mode 100644
index 0000000..4085871
--- /dev/null
+++ b/php-bug78875.patch
@@ -0,0 +1,50 @@
+From a41cbed4532cc4d3d2fd1a8fa1a4ace5bdfcafc9 Mon Sep 17 00:00:00 2001
+From: Remi Collet <remi at remirepo.net>
+Date: Wed, 13 May 2020 09:03:49 +0200
+Subject: [PATCH] Backports from 7.2.31
+
+ Fix #78875: Long filenames cause OOM and temp files are not cleaned
+(from 1c9bd513ac5c7c1d13d7f0dfa7c16a7ad2ce0f87)
+
+ Fix #78876: Long variables cause OOM and temp files are not cleaned
+(from 3c8582ca4b8e84e5647220b647914876d2c3b124)
+---
+ NEWS | 8 ++++++++
+ main/rfc1867.c | 9 +++++----
+ 2 files changed, 13 insertions(+), 4 deletions(-)
+
+diff --git a/main/rfc1867.c b/main/rfc1867.c
+index 0ddf0ed8f0..fb3035072a 100644
+--- a/main/rfc1867.c
++++ b/main/rfc1867.c
+@@ -609,9 +609,9 @@ static void *php_ap_memstr(char *haystack, int haystacklen, char *needle, int ne
+ }
+
+ /* read until a boundary condition */
+-static int multipart_buffer_read(multipart_buffer *self, char *buf, int bytes, int *end TSRMLS_DC)
++static unsigned int multipart_buffer_read(multipart_buffer *self, char *buf, unsigned int bytes, int *end TSRMLS_DC)
+ {
+- int len, max;
++ unsigned int len, max;
+ char *bound;
+
+ /* fill buffer if needed */
+@@ -658,7 +658,7 @@ static int multipart_buffer_read(multipart_buffer *self, char *buf, int bytes, i
+ static char *multipart_buffer_read_body(multipart_buffer *self, unsigned int *len TSRMLS_DC)
+ {
+ char buf[FILLUNIT], *out=NULL;
+- int total_bytes=0, read_bytes=0;
++ unsigned int total_bytes=0, read_bytes=0;
+
+ while((read_bytes = multipart_buffer_read(self, buf, sizeof(buf), NULL TSRMLS_CC))) {
+ out = erealloc(out, total_bytes + read_bytes + 1);
+@@ -684,7 +684,8 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
+ {
+ char *boundary, *s = NULL, *boundary_end = NULL, *start_arr = NULL, *array_index = NULL;
+ char *temp_filename = NULL, *lbuf = NULL, *abuf = NULL;
+- int boundary_len = 0, cancel_upload = 0, is_arr_upload = 0, array_len = 0;
++ int boundary_len = 0, cancel_upload = 0, is_arr_upload = 0;
++ unsigned int array_len = 0;
+ int64_t total_bytes = 0, max_file_size = 0;
+ int skip_upload = 0, anonindex = 0, is_anonymous;
+ zval *http_post_files = NULL;
diff --git a/php-bug78878.patch b/php-bug78878.patch
new file mode 100644
index 0000000..f92e5d2
--- /dev/null
+++ b/php-bug78878.patch
@@ -0,0 +1,51 @@
+From e6614bec92634d91d2406bf9e997675b52971769 Mon Sep 17 00:00:00 2001
+From: "Christoph M. Becker" <cmbecker69 at gmx.de>
+Date: Sat, 30 Nov 2019 12:26:37 +0100
+Subject: [PATCH] Fix #78878: Buffer underflow in bc_shift_addsub
+
+We must not rely on `isdigit()` to detect digits, since we only support
+decimal ASCII digits in the following processing.
+
+(cherry picked from commit eb23c6008753b1cdc5359dead3a096dce46c9018)
+---
+ NEWS | 6 ++++++
+ ext/bcmath/libbcmath/src/str2num.c | 4 ++--
+ ext/bcmath/tests/bug78878.phpt | 13 +++++++++++++
+ 3 files changed, 21 insertions(+), 2 deletions(-)
+ create mode 100644 ext/bcmath/tests/bug78878.phpt
+
+diff --git a/ext/bcmath/libbcmath/src/str2num.c b/ext/bcmath/libbcmath/src/str2num.c
+index c484c158e5..a5e7850160 100644
+--- a/ext/bcmath/libbcmath/src/str2num.c
++++ b/ext/bcmath/libbcmath/src/str2num.c
+@@ -57,9 +57,9 @@ bc_str2num (bc_num *num, char *str, int scale TSRMLS_DC)
+ zero_int = FALSE;
+ if ( (*ptr == '+') || (*ptr == '-')) ptr++; /* Sign */
+ while (*ptr == '0') ptr++; /* Skip leading zeros. */
+- while (isdigit((int)*ptr)) ptr++, digits++; /* digits */
++ while (*ptr >= '0' && *ptr <= '9') ptr++, digits++; /* digits */
+ if (*ptr == '.') ptr++; /* decimal point */
+- while (isdigit((int)*ptr)) ptr++, strscale++; /* digits */
++ while (*ptr >= '0' && *ptr <= '9') ptr++, strscale++; /* digits */
+ if ((*ptr != '\0') || (digits+strscale == 0))
+ {
+ *num = bc_copy_num (BCG(_zero_));
+diff --git a/ext/bcmath/tests/bug78878.phpt b/ext/bcmath/tests/bug78878.phpt
+new file mode 100644
+index 0000000000..2c9d72b946
+--- /dev/null
++++ b/ext/bcmath/tests/bug78878.phpt
+@@ -0,0 +1,13 @@
++--TEST--
++Bug #78878 (Buffer underflow in bc_shift_addsub)
++--SKIPIF--
++<?php
++if (!extension_loaded('bcmath')) die('skip bcmath extension not available');
++?>
++--FILE--
++<?php
++print @bcmul("\xB26483605105519922841849335928742092", bcpowmod(2, 65535, -4e-4));
++?>
++--EXPECT--
++bc math warning: non-zero scale in modulus
++0
diff --git a/php-bug78910.patch b/php-bug78910.patch
new file mode 100644
index 0000000..e274623
--- /dev/null
+++ b/php-bug78910.patch
@@ -0,0 +1,133 @@
+From b02ca1de8e0e5862df3c2c84358d2da624d39a1b Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas at php.net>
+Date: Mon, 16 Dec 2019 00:10:39 -0800
+Subject: [PATCH] Fixed bug #78910
+
+(cherry picked from commit d348cfb96f2543565691010ade5e0346338be5a7)
+---
+ NEWS | 2 ++
+ ext/exif/exif.c | 3 ++-
+ ext/exif/tests/bug78910.phpt | 17 +++++++++++++++++
+ 3 files changed, 21 insertions(+), 1 deletion(-)
+ create mode 100644 ext/exif/tests/bug78910.phpt
+
+diff --git a/ext/exif/exif.c b/ext/exif/exif.c
+index 6a3bb912c3..f64a14ed9c 100644
+--- a/ext/exif/exif.c
++++ b/ext/exif/exif.c
+@@ -2759,7 +2759,8 @@ static int exif_process_IFD_in_MAKERNOTE(image_info_type *ImageInfo, char * valu
+ continue;
+ if (maker_note->model && (!ImageInfo->model || strcmp(maker_note->model, ImageInfo->model)))
+ continue;
+- if (maker_note->id_string && strncmp(maker_note->id_string, value_ptr, maker_note->id_string_len))
++ if (maker_note->id_string && value_len >= maker_note->id_string_len
++ && strncmp(maker_note->id_string, value_ptr, maker_note->id_string_len))
+ continue;
+ break;
+ }
+diff --git a/ext/exif/tests/bug78910.phpt b/ext/exif/tests/bug78910.phpt
+new file mode 100644
+index 0000000000..f5b1c32c1b
+--- /dev/null
++++ b/ext/exif/tests/bug78910.phpt
+@@ -0,0 +1,17 @@
++--TEST--
++Bug #78910: Heap-buffer-overflow READ in exif (OSS-Fuzz #19044)
++--FILE--
++<?php
++
++var_dump(exif_read_data('data:image/jpg;base64,TU0AKgAAAAwgICAgAAIBDwAEAAAAAgAAACKSfCAgAAAAAEZVSklGSUxN'));
++
++?>
++--EXPECTF--
++Notice: exif_read_data(): Read from TIFF: tag(0x927C, MakerNote ): Illegal format code 0x2020, switching to BYTE in %s on line %d
++
++Warning: exif_read_data(): Process tag(x927C=MakerNote ): Illegal format code 0x2020, suppose BYTE in %s on line %d
++
++Warning: exif_read_data(): IFD data too short: 0x0000 offset 0x000C in %s on line %d
++
++Warning: exif_read_data(): Invalid TIFF file in %s on line %d
++bool(false)
+From 10c1c8cb32eb507e045414392b6f51d3512e6cb0 Mon Sep 17 00:00:00 2001
+From: "Christoph M. Becker" <cmbecker69 at gmx.de>
+Date: Tue, 17 Dec 2019 15:24:23 +0100
+Subject: [PATCH] Fix tests
+
+---
+ ext/bcmath/tests/bug78878.phpt | 3 +--
+ ext/exif/tests/bug76557.phpt | 2 +-
+ ext/exif/tests/bug78910.phpt | 8 ++++----
+ ext/spl/tests/bug54291.phpt | 2 +-
+ ext/spl/tests/bug78863.phpt | 2 +-
+ 5 files changed, 8 insertions(+), 9 deletions(-)
+
+diff --git a/ext/bcmath/tests/bug78878.phpt b/ext/bcmath/tests/bug78878.phpt
+index 2c9d72b946..3337270aad 100644
+--- a/ext/bcmath/tests/bug78878.phpt
++++ b/ext/bcmath/tests/bug78878.phpt
+@@ -9,5 +9,4 @@ if (!extension_loaded('bcmath')) die('skip bcmath extension not available');
+ print @bcmul("\xB26483605105519922841849335928742092", bcpowmod(2, 65535, -4e-4));
+ ?>
+ --EXPECT--
+-bc math warning: non-zero scale in modulus
+-0
++0bc math warning: non-zero scale in modulus
+diff --git a/ext/exif/tests/bug76557.phpt b/ext/exif/tests/bug76557.phpt
+index 4553b62772..8920de658a 100644
+--- a/ext/exif/tests/bug76557.phpt
++++ b/ext/exif/tests/bug76557.phpt
+@@ -70,7 +70,7 @@ Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal f
+
+ Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal format code 0x3030, suppose BYTE in %sbug76557.php on line %d
+
+-Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal pointer offset(x30303030 + x30303030 = x60606060 > x00EE) in %sbug76557.php on line %d
++Warning: exif_read_data(bug76557.jpg): Process tag(x3030=UndefinedTa): Illegal pointer offset(x30303030 + x30303030 = x60606060 > %s) in %sbug76557.php on line %d
+
+ Warning: exif_read_data(bug76557.jpg): File structure corrupted in %sbug76557.php on line %d
+
+diff --git a/ext/exif/tests/bug78910.phpt b/ext/exif/tests/bug78910.phpt
+index f5b1c32c1b..7e40b82389 100644
+--- a/ext/exif/tests/bug78910.phpt
++++ b/ext/exif/tests/bug78910.phpt
+@@ -7,11 +7,11 @@ var_dump(exif_read_data('data:image/jpg;base64,TU0AKgAAAAwgICAgAAIBDwAEAAAAAgAAA
+
+ ?>
+ --EXPECTF--
+-Notice: exif_read_data(): Read from TIFF: tag(0x927C, MakerNote ): Illegal format code 0x2020, switching to BYTE in %s on line %d
++Notice: exif_read_data(jpg;base64,TU0AKgAAAAwgICAgAAIBDwAEAAAAAgAAACKSfCAgAAAAAEZVSklGSUxN): Read from TIFF: tag(0x927C, MakerNote ): Illegal format code 0x2020, switching to BYTE in %s on line %d
+
+-Warning: exif_read_data(): Process tag(x927C=MakerNote ): Illegal format code 0x2020, suppose BYTE in %s on line %d
++Warning: exif_read_data(jpg;base64,TU0AKgAAAAwgICAgAAIBDwAEAAAAAgAAACKSfCAgAAAAAEZVSklGSUxN): Process tag(x927C=MakerNote ): Illegal format code 0x2020, suppose BYTE in %s on line %d
+
+-Warning: exif_read_data(): IFD data too short: 0x0000 offset 0x000C in %s on line %d
++Warning: exif_read_data(jpg;base64,TU0AKgAAAAwgICAgAAIBDwAEAAAAAgAAACKSfCAgAAAAAEZVSklGSUxN): IFD data too short: 0x0000 offset 0x000C in %s on line %d
+
+-Warning: exif_read_data(): Invalid TIFF file in %s on line %d
++Warning: exif_read_data(jpg;base64,TU0AKgAAAAwgICAgAAIBDwAEAAAAAgAAACKSfCAgAAAAAEZVSklGSUxN): Invalid TIFF file in %s on line %d
+ bool(false)
+diff --git a/ext/spl/tests/bug54291.phpt b/ext/spl/tests/bug54291.phpt
+index 9314b6b9ff..510963c688 100644
+--- a/ext/spl/tests/bug54291.phpt
++++ b/ext/spl/tests/bug54291.phpt
+@@ -5,7 +5,7 @@ Bug #54291 (Crash iterating DirectoryIterator for dir name starting with \0)
+ $dir = new DirectoryIterator("\x00/abc");
+ $dir->isFile();
+ --EXPECTF--
+-Fatal error: Uncaught exception 'UnexpectedValueException' with message 'Failed to open directory ""' in %s:%d
++Fatal error: Uncaught exception 'UnexpectedValueException' with message 'DirectoryIterator::__construct() expects parameter 1 to be a valid path, string given' in %s:%d
+ Stack trace:
+ #0 %s(%d): DirectoryIterator->__construct('\x00/abc')
+ #1 {main}
+diff --git a/ext/spl/tests/bug78863.phpt b/ext/spl/tests/bug78863.phpt
+index dc88d98dee..53a1110bc6 100644
+--- a/ext/spl/tests/bug78863.phpt
++++ b/ext/spl/tests/bug78863.phpt
+@@ -16,7 +16,7 @@ foreach ($it as $fileinfo) {
+ }
+ ?>
+ --EXPECTF--
+-Fatal error: Uncaught UnexpectedValueException: DirectoryIterator::__construct() expects parameter 1 to be a valid path, string given in %s:%d
++Fatal error: Uncaught exception 'UnexpectedValueException' with message 'DirectoryIterator::__construct() expects parameter 1 to be a valid path, string given' in %s:%d
+ Stack trace:
+ #0 %s(%d): DirectoryIterator->__construct('%s')
+ #1 {main}
diff --git a/php-bug79037.patch b/php-bug79037.patch
new file mode 100644
index 0000000..376cebd
--- /dev/null
+++ b/php-bug79037.patch
@@ -0,0 +1,73 @@
+From 31b5f3736519f3cb1af875f22f70423934a636d6 Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas at php.net>
+Date: Mon, 20 Jan 2020 21:42:44 -0800
+Subject: [PATCH] Fix bug #79037 (global buffer-overflow in
+ `mbfl_filt_conv_big5_wchar`)
+
+(cherry picked from commit 2bcbc95f033c31b00595ed39f79c3a99b4ed0501)
+---
+ ext/mbstring/libmbfl/filters/mbfilter_big5.c | 17 ++++++++++++-----
+ ext/mbstring/tests/bug79037.phpt | 10 ++++++++++
+ 2 files changed, 22 insertions(+), 5 deletions(-)
+ create mode 100644 ext/mbstring/tests/bug79037.phpt
+
+diff --git a/ext/mbstring/libmbfl/filters/mbfilter_big5.c b/ext/mbstring/libmbfl/filters/mbfilter_big5.c
+index 099f8e6af0..e04d81d220 100644
+--- a/ext/mbstring/libmbfl/filters/mbfilter_big5.c
++++ b/ext/mbstring/libmbfl/filters/mbfilter_big5.c
+@@ -138,6 +138,17 @@ static unsigned short cp950_pua_tbl[][4] = {
+ {0xf70f,0xf848,0xc740,0xc8fe},
+ };
+
++static inline int is_in_cp950_pua(int c1, int c) {
++ if ((c1 >= 0xfa && c1 <= 0xfe) || (c1 >= 0x8e && c1 <= 0xa0) ||
++ (c1 >= 0x81 && c1 <= 0x8d) || (c1 >= 0xc7 && c1 <= 0xc8)) {
++ return (c >=0x40 && c <= 0x7e) || (c >= 0xa1 && c <= 0xfe);
++ }
++ if (c1 == 0xc6) {
++ return c >= 0xa1 && c <= 0xfe;
++ }
++ return 0;
++}
++
+ /*
+ * Big5 => wchar
+ */
+@@ -186,11 +197,7 @@ mbfl_filt_conv_big5_wchar(int c, mbfl_convert_filter *filter)
+
+ if (filter->from->no_encoding == mbfl_no_encoding_cp950) {
+ /* PUA for CP950 */
+- if (w <= 0 &&
+- (((c1 >= 0xfa && c1 <= 0xfe) || (c1 >= 0x8e && c1 <= 0xa0) ||
+- (c1 >= 0x81 && c1 <= 0x8d) ||(c1 >= 0xc7 && c1 <= 0xc8))
+- && ((c > 0x39 && c < 0x7f) || (c > 0xa0 && c < 0xff))) ||
+- ((c1 == 0xc6) && (c > 0xa0 && c < 0xff))) {
++ if (w <= 0 && is_in_cp950_pua(c1, c)) {
+ c2 = c1 << 8 | c;
+ for (k = 0; k < sizeof(cp950_pua_tbl)/(sizeof(unsigned short)*4); k++) {
+ if (c2 >= cp950_pua_tbl[k][2] && c2 <= cp950_pua_tbl[k][3]) {
+diff --git a/ext/mbstring/tests/bug79037.phpt b/ext/mbstring/tests/bug79037.phpt
+new file mode 100644
+index 0000000000..94ff01a4a1
+--- /dev/null
++++ b/ext/mbstring/tests/bug79037.phpt
+@@ -0,0 +1,10 @@
++--TEST--
++Bug #79037: global buffer-overflow in `mbfl_filt_conv_big5_wchar`
++--FILE--
++<?php
++
++var_dump(mb_convert_encoding("\x81\x3a", "UTF-8", "CP950"));
++
++?>
++--EXPECT--
++string(1) "?"
+From f90b183c1ff88efc6e499811dc008a90f32989f0 Mon Sep 17 00:00:00 2001
+From: Remi Collet <remi at remirepo.net>
+Date: Tue, 21 Jan 2020 10:12:44 +0100
+Subject: [PATCH] update NEWS
+
+---
+ NEWS | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
diff --git a/php-bug79082.patch b/php-bug79082.patch
new file mode 100644
index 0000000..84a3296
--- /dev/null
+++ b/php-bug79082.patch
@@ -0,0 +1,133 @@
+From ed163ca242932e7f60467fb32ec00166f4318a40 Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas at php.net>
+Date: Sat, 15 Feb 2020 22:17:14 -0800
+Subject: [PATCH 2/3] Fix bug #79082 - Files added to tar with
+ Phar::buildFromIterator have all-access permissions
+
+(cherry picked from commit e5c95234d87fcb8f6b7569a96a89d1e1544749a6)
+---
+ ext/phar/phar_object.c | 11 +++++
+ ext/phar/tests/bug79082.phpt | 52 ++++++++++++++++++++
+ ext/phar/tests/test79082/test79082-testfile | 1 +
+ ext/phar/tests/test79082/test79082-testfile2 | 1 +
+ 4 files changed, 65 insertions(+)
+ create mode 100644 ext/phar/tests/bug79082.phpt
+ create mode 100644 ext/phar/tests/test79082/test79082-testfile
+ create mode 100644 ext/phar/tests/test79082/test79082-testfile2
+
+diff --git a/ext/phar/phar_object.c b/ext/phar/phar_object.c
+index d69837218f..5722828c37 100644
+--- a/ext/phar/phar_object.c
++++ b/ext/phar/phar_object.c
+@@ -1427,6 +1427,7 @@ static int phar_build(zend_object_iterator *iter, void *puser TSRMLS_DC) /* {{{
+ zend_class_entry *ce = p_obj->c;
+ phar_archive_object *phar_obj = p_obj->p;
+ char *str = "[stream]";
++ php_stream_statbuf ssb;
+
+ iter->funcs->get_current_data(iter, &value TSRMLS_CC);
+
+@@ -1709,6 +1710,16 @@ after_open_fp:
+ php_stream_copy_to_stream_ex(fp, p_obj->fp, PHP_STREAM_COPY_ALL, &contents_len);
+ data->internal_file->uncompressed_filesize = data->internal_file->compressed_filesize =
+ php_stream_tell(p_obj->fp) - data->internal_file->offset;
++ if (php_stream_stat(fp, &ssb) != -1) {
++ data->internal_file->flags = ssb.sb.st_mode & PHAR_ENT_PERM_MASK ;
++ } else {
++#ifndef _WIN32
++ mode_t mask;
++ mask = umask(0);
++ umask(mask);
++ data->internal_file->flags &= ~mask;
++#endif
++ }
+ }
+
+ if (close_fp) {
+diff --git a/ext/phar/tests/bug79082.phpt b/ext/phar/tests/bug79082.phpt
+new file mode 100644
+index 0000000000..ca453d1b57
+--- /dev/null
++++ b/ext/phar/tests/bug79082.phpt
+@@ -0,0 +1,52 @@
++--TEST--
++Phar: Bug #79082: Files added to tar with Phar::buildFromIterator have all-access permissions
++--SKIPIF--
++<?php
++if (!extension_loaded("phar")) die("skip");
++if (defined("PHP_WINDOWS_VERSION_MAJOR")) die("skip not for Windows")
++?>
++--FILE--
++<?php
++umask(022);
++var_dump(decoct(umask()));
++chmod(__DIR__ . '/test79082/test79082-testfile', 0644);
++chmod(__DIR__ . '/test79082/test79082-testfile2', 0400);
++
++foreach([Phar::TAR => 'tar', Phar::ZIP => 'zip'] as $mode => $ext) {
++ clearstatcache();
++ $phar = new PharData(__DIR__ . '/test79082.' . $ext, null, null, $mode);
++ $phar->buildFromIterator(new \RecursiveDirectoryIterator(__DIR__ . '/test79082', \FilesystemIterator::SKIP_DOTS), __DIR__ . '/test79082');
++ $phar->extractTo(__DIR__);
++ var_dump(decoct(stat(__DIR__ . '/test79082-testfile')['mode']));
++ var_dump(decoct(stat(__DIR__ . '/test79082-testfile2')['mode']));
++ unlink(__DIR__ . '/test79082-testfile');
++ unlink(__DIR__ . '/test79082-testfile2');
++}
++foreach([Phar::TAR => 'tar', Phar::ZIP => 'zip'] as $mode => $ext) {
++ clearstatcache();
++ $phar = new PharData(__DIR__ . '/test79082-d.' . $ext, null, null, $mode);
++ $phar->buildFromDirectory(__DIR__ . '/test79082');
++ $phar->extractTo(__DIR__);
++ var_dump(decoct(stat(__DIR__ . '/test79082-testfile')['mode']));
++ var_dump(decoct(stat(__DIR__ . '/test79082-testfile2')['mode']));
++ unlink(__DIR__ . '/test79082-testfile');
++ unlink(__DIR__ . '/test79082-testfile2');
++}
++?>
++--CLEAN--
++<?
++unlink(__DIR__ . '/test79082.tar');
++unlink(__DIR__ . '/test79082.zip');
++unlink(__DIR__ . '/test79082-d.tar');
++unlink(__DIR__ . '/test79082-d.zip');
++?>
++--EXPECT--
++string(2) "22"
++string(6) "100644"
++string(6) "100400"
++string(6) "100644"
++string(6) "100400"
++string(6) "100644"
++string(6) "100400"
++string(6) "100644"
++string(6) "100400"
+diff --git a/ext/phar/tests/test79082/test79082-testfile b/ext/phar/tests/test79082/test79082-testfile
+new file mode 100644
+index 0000000000..9daeafb986
+--- /dev/null
++++ b/ext/phar/tests/test79082/test79082-testfile
+@@ -0,0 +1 @@
++test
+diff --git a/ext/phar/tests/test79082/test79082-testfile2 b/ext/phar/tests/test79082/test79082-testfile2
+new file mode 100644
+index 0000000000..9daeafb986
+--- /dev/null
++++ b/ext/phar/tests/test79082/test79082-testfile2
+@@ -0,0 +1 @@
++test
+--
+2.24.1
+
+From dbac37b3ea68d8a0ba7e4e519e1386bbe8eff400 Mon Sep 17 00:00:00 2001
+From: Remi Collet <remi at remirepo.net>
+Date: Tue, 18 Feb 2020 06:36:07 +0100
+Subject: [PATCH 3/3] NEWS
+
+---
+ NEWS | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--
+2.24.1
+
diff --git a/php-bug79099.patch b/php-bug79099.patch
new file mode 100644
index 0000000..4997c77
--- /dev/null
+++ b/php-bug79099.patch
@@ -0,0 +1,113 @@
+From 9db5a8f58dd26d547cf530beeb41155d97e700f0 Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas at php.net>
+Date: Mon, 20 Jan 2020 21:33:17 -0800
+Subject: [PATCH] Fix #79099: OOB read in php_strip_tags_ex
+
+(cherry picked from commit 0f79b1bf301f455967676b5129240140c5c45b09)
+---
+ ext/standard/string.c | 6 ++---
+ ext/standard/tests/file/bug79099.phpt | 32 +++++++++++++++++++++++++++
+ 2 files changed, 35 insertions(+), 3 deletions(-)
+ create mode 100644 ext/standard/tests/file/bug79099.phpt
+
+diff --git a/ext/standard/string.c b/ext/standard/string.c
+index 569452ca93..9b75adc3b7 100644
+--- a/ext/standard/string.c
++++ b/ext/standard/string.c
+@@ -4770,7 +4770,7 @@ PHPAPI size_t php_strip_tags_ex(char *rbuf, int len, int *stateptr, char *allow,
+ if (state == 4) {
+ /* Inside <!-- comment --> */
+ break;
+- } else if (state == 2 && *(p-1) != '\\') {
++ } else if (state == 2 && p >= buf + 1 && *(p-1) != '\\') {
+ if (lc == c) {
+ lc = '\0';
+ } else if (lc != '\\') {
+@@ -4797,7 +4797,7 @@ PHPAPI size_t php_strip_tags_ex(char *rbuf, int len, int *stateptr, char *allow,
+
+ case '!':
+ /* JavaScript & Other HTML scripting languages */
+- if (state == 1 && *(p-1) == '<') {
++ if (state == 1 && p >= buf + 1 && *(p-1) == '<') {
+ state = 3;
+ lc = c;
+ } else {
+@@ -4824,7 +4824,7 @@ PHPAPI size_t php_strip_tags_ex(char *rbuf, int len, int *stateptr, char *allow,
+
+ case '?':
+
+- if (state == 1 && *(p-1) == '<') {
++ if (state == 1 && p >= buf + 1 && *(p-1) == '<') {
+ br=0;
+ state=2;
+ break;
+diff --git a/ext/standard/tests/file/bug79099.phpt b/ext/standard/tests/file/bug79099.phpt
+new file mode 100644
+index 0000000000..7c842f4654
+--- /dev/null
++++ b/ext/standard/tests/file/bug79099.phpt
+@@ -0,0 +1,32 @@
++--TEST--
++Bug #79099 (OOB read in php_strip_tags_ex)
++--FILE--
++<?php
++$stream = fopen('php://memory', 'w+');
++fputs($stream, "<?\n\"\n");
++rewind($stream);
++var_dump(fgetss($stream));
++var_dump(fgetss($stream));
++fclose($stream);
++
++$stream = fopen('php://memory', 'w+');
++fputs($stream, "<\0\n!\n");
++rewind($stream);
++var_dump(fgetss($stream));
++var_dump(fgetss($stream));
++fclose($stream);
++
++$stream = fopen('php://memory', 'w+');
++fputs($stream, "<\0\n?\n");
++rewind($stream);
++var_dump(fgetss($stream));
++var_dump(fgetss($stream));
++fclose($stream);
++?>
++--EXPECT--
++string(0) ""
++string(0) ""
++string(0) ""
++string(0) ""
++string(0) ""
++string(0) ""
+From 0ec0b030131845d8d84f79151727a1b13a78166c Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas at php.net>
+Date: Wed, 22 Jan 2020 22:36:53 -0800
+Subject: [PATCH] More checks for php_strip_tags_ex
+
+(cherry picked from commit 2dc170e25d86a725fefd4c08f2bd8378820b28f5)
+---
+ ext/standard/string.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/ext/standard/string.c b/ext/standard/string.c
+index 9b75adc3b7..4687b20221 100644
+--- a/ext/standard/string.c
++++ b/ext/standard/string.c
+@@ -4720,7 +4720,7 @@ PHPAPI size_t php_strip_tags_ex(char *rbuf, int len, int *stateptr, char *allow,
+ switch (state) {
+ case 1: /* HTML/XML */
+ lc = '>';
+- if (is_xml && *(p -1) == '-') {
++ if (is_xml && p >= buf + 1 && *(p-1) == '-') {
+ break;
+ }
+ in_q = state = is_xml = 0;
+@@ -4741,7 +4741,7 @@ PHPAPI size_t php_strip_tags_ex(char *rbuf, int len, int *stateptr, char *allow,
+ break;
+
+ case 2: /* PHP */
+- if (!br && lc != '\"' && *(p-1) == '?') {
++ if (!br && lc != '\"' && p >= buf + 1 && *(p-1) == '?') {
+ in_q = state = 0;
+ tp = tbuf;
+ }
diff --git a/php-bug79221.patch b/php-bug79221.patch
new file mode 100644
index 0000000..5940baf
--- /dev/null
+++ b/php-bug79221.patch
@@ -0,0 +1,86 @@
+From a8b5510a30a5e8761e841c799a472c6f25560698 Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas at php.net>
+Date: Sat, 15 Feb 2020 20:52:19 -0800
+Subject: [PATCH 1/3] Fix bug #79221 - Null Pointer Dereference in PHP Session
+ Upload Progress
+
+(cherry picked from commit d76f7c6c636b8240e06a1fa29eebb98ad005008a)
+---
+ ext/session/session.c | 8 +++---
+ ext/session/tests/bug79221.phpt | 45 +++++++++++++++++++++++++++++++++
+ 2 files changed, 50 insertions(+), 3 deletions(-)
+ create mode 100644 ext/session/tests/bug79221.phpt
+
+diff --git a/ext/session/session.c b/ext/session/session.c
+index b2d02361df..d759fcabbf 100644
+--- a/ext/session/session.c
++++ b/ext/session/session.c
+@@ -2820,9 +2820,11 @@ static int php_session_rfc1867_callback(unsigned int event, void *event_data, vo
+ if (PS(rfc1867_cleanup)) {
+ php_session_rfc1867_cleanup(progress TSRMLS_CC);
+ } else {
+- add_assoc_bool_ex(progress->data, "done", sizeof("done"), 1);
+- Z_LVAL_P(progress->post_bytes_processed) = data->post_bytes_processed;
+- php_session_rfc1867_update(progress, 1 TSRMLS_CC);
++ if (progress->data) {
++ add_assoc_bool_ex(progress->data, "done", sizeof("done"), 1);
++ Z_LVAL_P(progress->post_bytes_processed) = data->post_bytes_processed;
++ php_session_rfc1867_update(progress, 1 TSRMLS_CC);
++ }
+ }
+ php_rshutdown_session_globals(TSRMLS_C);
+ }
+diff --git a/ext/session/tests/bug79221.phpt b/ext/session/tests/bug79221.phpt
+new file mode 100644
+index 0000000000..b0972c4697
+--- /dev/null
++++ b/ext/session/tests/bug79221.phpt
+@@ -0,0 +1,45 @@
++--TEST--
++Null Pointer Dereference in PHP Session Upload Progress
++--INI--
++error_reporting=0
++file_uploads=1
++upload_max_filesize=1024
++session.save_path=
++session.name=PHPSESSID
++session.serialize_handler=php
++session.use_strict_mode=0
++session.use_cookies=1
++session.use_only_cookies=0
++session.upload_progress.enabled=1
++session.upload_progress.cleanup=0
++session.upload_progress.prefix=upload_progress_
++session.upload_progress.name=PHP_SESSION_UPLOAD_PROGRESS
++session.upload_progress.freq=1%
++session.upload_progress.min_freq=0.000000001
++--COOKIE--
++PHPSESSID=session-upload
++--POST_RAW--
++Content-Type: multipart/form-data; boundary=---------------------------20896060251896012921717172737
++-----------------------------20896060251896012921717172737
++Content-Disposition: form-data; name="PHPSESSID"
++
++session-upload
++-----------------------------20896060251896012921717172737
++Content-Disposition: form-data; name="PHP_SESSION_UPLOAD_PROGRESS"
++
++ryat
++-----------------------------20896060251896012921717172737
++Content-Disposition: form-data; file="file"; ryat="filename"
++
++1
++-----------------------------20896060251896012921717172737--
++--FILE--
++<?php
++
++session_start();
++var_dump($_SESSION);
++session_destroy();
++
++--EXPECTF--
++array(0) {
++}
+--
+2.24.1
+
diff --git a/php-bug79282.patch b/php-bug79282.patch
new file mode 100644
index 0000000..9441159
--- /dev/null
+++ b/php-bug79282.patch
@@ -0,0 +1,113 @@
+From 5ac3ebcd4f9509d1a7e54f30117227822fbc0648 Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas at php.net>
+Date: Sun, 15 Mar 2020 17:26:00 -0700
+Subject: [PATCH] Fixed bug #79282
+
+(cherry picked from commit 41f66e2a2cfd611e35be5ac3bf747f0b56161216)
+(cherry picked from commit 8577fa5891220dac40d42b2f745fa159dcd871ad)
+(cherry picked from commit 59119490c9e2359ea720928b2e71b68e5c20f195)
+---
+ ext/exif/exif.c | 7 ++++++-
+ ext/exif/tests/bug79282.phpt | 15 +++++++++++++++
+ 2 files changed, 21 insertions(+), 1 deletion(-)
+ create mode 100644 ext/exif/tests/bug79282.phpt
+
+diff --git a/ext/exif/exif.c b/ext/exif/exif.c
+index f64a14ed9c..bf2fd61cd1 100644
+--- a/ext/exif/exif.c
++++ b/ext/exif/exif.c
+@@ -3253,6 +3253,11 @@ static void exif_process_TIFF_in_JPEG(image_info_type *ImageInfo, char *CharBuf,
+ {
+ unsigned exif_value_2a, offset_of_ifd;
+
++ if (length < 2) {
++ exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Missing TIFF alignment marker");
++ return;
++ }
++
+ /* set the thumbnail stuff to nothing so we can test to see if they get set up */
+ if (memcmp(CharBuf, "II", 2) == 0) {
+ ImageInfo->motorola_intel = 0;
+@@ -3405,7 +3410,7 @@ static int exif_scan_JPEG_header(image_info_type *ImageInfo TSRMLS_DC)
+ return FALSE;
+ }
+
+- sn = exif_file_sections_add(ImageInfo, marker, itemlen+1, NULL);
++ sn = exif_file_sections_add(ImageInfo, marker, itemlen, NULL);
+ Data = ImageInfo->file.list[sn].data;
+
+ /* Store first two pre-read bytes. */
+diff --git a/ext/exif/tests/bug79282.phpt b/ext/exif/tests/bug79282.phpt
+new file mode 100644
+index 0000000000..7b7e365657
+--- /dev/null
++++ b/ext/exif/tests/bug79282.phpt
+@@ -0,0 +1,15 @@
++--TEST--
++Bug #79282: Use-of-uninitialized-value in exif
++--FILE--
++<?php
++
++var_dump(exif_read_data('data://image/jpeg;base64,/9jhAAlFeGlmAAAg'));
++
++?>
++--EXPECTF--
++Warning: exif_read_data(): Invalid TIFF alignment marker in %s on line %d
++
++Warning: exif_read_data(): File structure corrupted in %s on line %d
++
++Warning: exif_read_data(): Invalid JPEG file in %s on line %d
++bool(false)
+From 90ca028814e7ba32e58b55f0b4db306f1809af3d Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas at php.net>
+Date: Sun, 15 Mar 2020 17:55:28 -0700
+Subject: [PATCH] Fix test
+
+(cherry picked from commit 2c081b7e269d0f63cd9d60a40997f18b5cf793be)
+(cherry picked from commit ad05ad4dbafc29dd23828760d4bfa2be12ccbb1c)
+(cherry picked from commit c1d08859cdac23aeff99953797231f6824d045c5)
+---
+ ext/exif/tests/bug79282.phpt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/ext/exif/tests/bug79282.phpt b/ext/exif/tests/bug79282.phpt
+index 7b7e365657..df91127c9c 100644
+--- a/ext/exif/tests/bug79282.phpt
++++ b/ext/exif/tests/bug79282.phpt
+@@ -7,7 +7,7 @@ var_dump(exif_read_data('data://image/jpeg;base64,/9jhAAlFeGlmAAAg'));
+
+ ?>
+ --EXPECTF--
+-Warning: exif_read_data(): Invalid TIFF alignment marker in %s on line %d
++Warning: exif_read_data(): Missing TIFF alignment marker in %s on line %d
+
+ Warning: exif_read_data(): File structure corrupted in %s on line %d
+
+From 4a281e20969e209bfdd2c88560ce5f57806d0b31 Mon Sep 17 00:00:00 2001
+From: Remi Collet <remi at remirepo.net>
+Date: Tue, 17 Mar 2020 07:23:32 +0100
+Subject: [PATCH] fix test
+
+(cherry picked from commit b42b6d0ff774fdced1155cb0c721d91914d619f5)
+(cherry picked from commit 51cc7a6225bbf1f7dfe0ffeb318fb0ff098780f9)
+---
+ ext/exif/tests/bug79282.phpt | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/ext/exif/tests/bug79282.phpt b/ext/exif/tests/bug79282.phpt
+index df91127c9c..142cf28a6c 100644
+--- a/ext/exif/tests/bug79282.phpt
++++ b/ext/exif/tests/bug79282.phpt
+@@ -7,9 +7,9 @@ var_dump(exif_read_data('data://image/jpeg;base64,/9jhAAlFeGlmAAAg'));
+
+ ?>
+ --EXPECTF--
+-Warning: exif_read_data(): Missing TIFF alignment marker in %s on line %d
++Warning: exif_read_data(%s): Missing TIFF alignment marker in %s on line %d
+
+-Warning: exif_read_data(): File structure corrupted in %s on line %d
++Warning: exif_read_data(%s): File structure corrupted in %s on line %d
+
+-Warning: exif_read_data(): Invalid JPEG file in %s on line %d
++Warning: exif_read_data(%s): Invalid JPEG file in %s on line %d
+ bool(false)
diff --git a/php-bug79329.patch b/php-bug79329.patch
new file mode 100644
index 0000000..7cffc6a
--- /dev/null
+++ b/php-bug79329.patch
@@ -0,0 +1,38 @@
+From c3582855b88cfde8e69734da738803b54c2c2e26 Mon Sep 17 00:00:00 2001
+From: Remi Collet <remi at remirepo.net>
+Date: Tue, 17 Mar 2020 07:25:12 +0100
+Subject: [PATCH] Fix bug #79329 - get_headers should not accept \0
+
+From 0d139c5b94a5f485a66901919e51faddb0371c43
+
+(cherry picked from commit b7b9302660a23a67285e204bc3d7fcf6ba7f6533)
+(cherry picked from commit b9a1e6bfd762d2bf7fa3c5bbcfbb6dcdfdfa982c)
+---
+ ext/standard/url.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/ext/standard/url.c b/ext/standard/url.c
+index 6ecace53e5..d6e71fa487 100644
+--- a/ext/standard/url.c
++++ b/ext/standard/url.c
+@@ -675,7 +675,7 @@ PHP_FUNCTION(get_headers)
+ HashTable *hashT;
+ long format = 0;
+
+- if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|l", &url, &url_len, &format) == FAILURE) {
++ if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|l", &url, &url_len, &format) == FAILURE) {
+ return;
+ }
+ context = FG(default_context) ? FG(default_context) : (FG(default_context) = php_stream_context_alloc(TSRMLS_C));
+From f94716859dfa52416754faa226d1bd642373f117 Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas at php.net>
+Date: Sun, 15 Mar 2020 19:35:26 -0700
+Subject: [PATCH] [ci skip] Update NEWS
+
+(cherry picked from commit c8d21d7728109b0f911033c098cfaeb7438ba1d5)
+(cherry picked from commit 03471e31c9b467d1d8d944e44fa009ef247e81bd)
+(cherry picked from commit 4844343ac37e8e3ca4d995b1d91fc0f9daf03d5f)
+---
+ NEWS | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
diff --git a/php-bug79330.patch b/php-bug79330.patch
new file mode 100644
index 0000000..2c112ef
--- /dev/null
+++ b/php-bug79330.patch
@@ -0,0 +1,58 @@
+From 258ad37fe3f91cf862c2870d18d53e5cdb3b3752 Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas at php.net>
+Date: Mon, 13 Apr 2020 21:00:44 -0700
+Subject: [PATCH] Fix bug #79330 - make all execution modes consistent in
+ rejecting \0
+
+(cherry picked from commit 14fcc813948254b84f382ff537247d8a7e5e0e62)
+---
+ ext/standard/exec.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/ext/standard/exec.c b/ext/standard/exec.c
+index 88a6b4ab79..a586b786ee 100644
+--- a/ext/standard/exec.c
++++ b/ext/standard/exec.c
+@@ -537,6 +537,15 @@ PHP_FUNCTION(shell_exec)
+ return;
+ }
+
++ if (!command_len) {
++ php_error_docref(NULL, E_WARNING, "Cannot execute a blank command");
++ RETURN_FALSE;
++ }
++ if (strlen(command) != command_len) {
++ php_error_docref(NULL, E_WARNING, "NULL byte detected. Possible attack");
++ RETURN_FALSE;
++ }
++
+ #ifdef PHP_WIN32
+ if ((in=VCWD_POPEN(command, "rt"))==NULL) {
+ #else
+From 6117c162636bfd7e981f7531dc4d48e358e62be4 Mon Sep 17 00:00:00 2001
+From: Remi Collet <remi at remirepo.net>
+Date: Tue, 14 Apr 2020 08:15:07 +0200
+Subject: [PATCH] ZTS
+
+---
+ ext/standard/exec.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/ext/standard/exec.c b/ext/standard/exec.c
+index a586b786ee..40eca2b2c6 100644
+--- a/ext/standard/exec.c
++++ b/ext/standard/exec.c
+@@ -538,11 +538,11 @@ PHP_FUNCTION(shell_exec)
+ }
+
+ if (!command_len) {
+- php_error_docref(NULL, E_WARNING, "Cannot execute a blank command");
++ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot execute a blank command");
+ RETURN_FALSE;
+ }
+ if (strlen(command) != command_len) {
+- php_error_docref(NULL, E_WARNING, "NULL byte detected. Possible attack");
++ php_error_docref(NULL TSRMLS_CC, E_WARNING, "NULL byte detected. Possible attack");
+ RETURN_FALSE;
+ }
+
diff --git a/php-bug79465.patch b/php-bug79465.patch
new file mode 100644
index 0000000..1d35292
--- /dev/null
+++ b/php-bug79465.patch
@@ -0,0 +1,42 @@
+From 26770fed5530c46a68653e868be0a266c42c33e8 Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas at php.net>
+Date: Mon, 13 Apr 2020 21:07:04 -0700
+Subject: [PATCH] Fix bug #79465 - use unsigneds as indexes.
+
+(cherry picked from commit 9d6bf8221b05f86ce5875832f0f646c4c1f218be)
+---
+ ext/standard/url.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/ext/standard/url.c b/ext/standard/url.c
+index d6e71fa487..0278bd47e8 100644
+--- a/ext/standard/url.c
++++ b/ext/standard/url.c
+@@ -545,7 +545,7 @@ PHPAPI int php_url_decode(char *str, int len)
+ #ifndef CHARSET_EBCDIC
+ *dest = (char) php_htoi(data + 1);
+ #else
+- *dest = os_toebcdic[(char) php_htoi(data + 1)];
++ *dest = os_toebcdic[(unsigned char) php_htoi(data + 1)];
+ #endif
+ data += 2;
+ len -= 2;
+@@ -647,7 +647,7 @@ PHPAPI int php_raw_url_decode(char *str, int len)
+ #ifndef CHARSET_EBCDIC
+ *dest = (char) php_htoi(data + 1);
+ #else
+- *dest = os_toebcdic[(char) php_htoi(data + 1)];
++ *dest = os_toebcdic[(unsigned char) php_htoi(data + 1)];
+ #endif
+ data += 2;
+ len -= 2;
+From c1f77159cfd61479bc22cf41d7964673c31b222a Mon Sep 17 00:00:00 2001
+From: Remi Collet <remi at remirepo.net>
+Date: Tue, 14 Apr 2020 08:02:28 +0200
+Subject: [PATCH] NEWS
+
+(cherry picked from commit bd4a5ebe653f36ea7705fbc95a6ec4842d7f86fc)
+---
+ NEWS | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
diff --git a/php-bug79699.patch b/php-bug79699.patch
new file mode 100644
index 0000000..09be5fd
--- /dev/null
+++ b/php-bug79699.patch
@@ -0,0 +1,125 @@
+From 21babd0059d6661573b44349d5ee5589677b9645 Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas at php.net>
+Date: Sun, 20 Sep 2020 18:08:55 -0700
+Subject: [PATCH] Do not decode cookie names anymore
+
+(cherry picked from commit 6559fe912661ca5ce5f0eeeb591d928451428ed0)
+---
+ main/php_variables.c | 8 ++++++--
+ tests/basic/022.phpt | 10 +++++++---
+ tests/basic/023.phpt | 4 +++-
+ tests/basic/bug79699.phpt | 22 ++++++++++++++++++++++
+ 4 files changed, 38 insertions(+), 6 deletions(-)
+ create mode 100644 tests/basic/bug79699.phpt
+
+diff --git a/main/php_variables.c b/main/php_variables.c
+index 6da79bddc3..084b10fa56 100644
+--- a/main/php_variables.c
++++ b/main/php_variables.c
+@@ -472,7 +472,9 @@ SAPI_API SAPI_TREAT_DATA_FUNC(php_default_treat_data)
+ unsigned int new_val_len;
+
+ *val++ = '\0';
+- php_url_decode(var, strlen(var));
++ if (arg != PARSE_COOKIE) {
++ php_url_decode(var, strlen(var));
++ }
+ val_len = php_url_decode(val, strlen(val));
+ val = estrndup(val, val_len);
+ if (sapi_module.input_filter(arg, var, &val, val_len, &new_val_len TSRMLS_CC)) {
+@@ -483,7 +485,9 @@ SAPI_API SAPI_TREAT_DATA_FUNC(php_default_treat_data)
+ int val_len;
+ unsigned int new_val_len;
+
+- php_url_decode(var, strlen(var));
++ if (arg != PARSE_COOKIE) {
++ php_url_decode(var, strlen(var));
++ }
+ val_len = 0;
+ val = estrndup("", val_len);
+ if (sapi_module.input_filter(arg, var, &val, val_len, &new_val_len TSRMLS_CC)) {
+diff --git a/tests/basic/022.phpt b/tests/basic/022.phpt
+index 0ab70d4be7..bd1db13701 100644
+--- a/tests/basic/022.phpt
++++ b/tests/basic/022.phpt
+@@ -10,7 +10,7 @@ cookie1=val1 ; cookie2=val2%20; cookie3=val 3.; cookie 4= value 4 %3B; cookie1=
+ var_dump($_COOKIE);
+ ?>
+ --EXPECT--
+-array(10) {
++array(12) {
+ ["cookie1"]=>
+ string(6) "val1 "
+ ["cookie2"]=>
+@@ -19,11 +19,15 @@ array(10) {
+ string(6) "val 3."
+ ["cookie_4"]=>
+ string(10) " value 4 ;"
++ ["%20cookie1"]=>
++ string(6) "ignore"
++ ["+cookie1"]=>
++ string(6) "ignore"
+ ["cookie__5"]=>
+ string(7) " value"
+- ["cookie_6"]=>
++ ["cookie%206"]=>
+ string(3) "���"
+- ["cookie_7"]=>
++ ["cookie+7"]=>
+ string(0) ""
+ ["$cookie_8"]=>
+ string(0) ""
+diff --git a/tests/basic/023.phpt b/tests/basic/023.phpt
+index ca5f1dcfbb..0e2e0ac669 100644
+--- a/tests/basic/023.phpt
++++ b/tests/basic/023.phpt
+@@ -10,9 +10,11 @@ c o o k i e=value; c o o k i e= v a l u e ;;c%20o+o k+i%20e=v;name="value","valu
+ var_dump($_COOKIE);
+ ?>
+ --EXPECT--
+-array(3) {
++array(4) {
+ ["c_o_o_k_i_e"]=>
+ string(5) "value"
++ ["c%20o+o_k+i%20e"]=>
++ string(1) "v"
+ ["name"]=>
+ string(24) ""value","value",UEhQIQ=="
+ ["UEhQIQ"]=>
+diff --git a/tests/basic/bug79699.phpt b/tests/basic/bug79699.phpt
+new file mode 100644
+index 0000000000..fc3d3fedb0
+--- /dev/null
++++ b/tests/basic/bug79699.phpt
+@@ -0,0 +1,22 @@
++--TEST--
++Cookies Security Bug
++--INI--
++max_input_vars=1000
++filter.default=unsafe_raw
++--COOKIE--
++__%48ost-evil=evil; __Host-evil=good; %66oo=baz;foo=bar
++--FILE--
++<?php
++var_dump($_COOKIE);
++?>
++--EXPECT--
++array(4) {
++ ["__%48ost-evil"]=>
++ string(4) "evil"
++ ["__Host-evil"]=>
++ string(4) "good"
++ ["%66oo"]=>
++ string(3) "baz"
++ ["foo"]=>
++ string(3) "bar"
++}
+From a9195bc602c7df0c569731bb1a7ddc72cdabfed1 Mon Sep 17 00:00:00 2001
+From: Remi Collet <remi at remirepo.net>
+Date: Tue, 29 Sep 2020 09:20:11 +0200
+Subject: [PATCH] NEWS
+
+---
+ NEWS | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
diff --git a/php-bug79797.patch b/php-bug79797.patch
new file mode 100644
index 0000000..08d9d6a
--- /dev/null
+++ b/php-bug79797.patch
@@ -0,0 +1,35 @@
+Partial, without binary part
+
+
+
+From d7980cd5ef5862d9a01a0f34ee44bec07be88096 Mon Sep 17 00:00:00 2001
+From: "Christoph M. Becker" <cmbecker69 at gmx.de>
+Date: Tue, 14 Jul 2020 17:04:24 +0200
+Subject: [PATCH] Fix #79797: Use of freed hash key in the phar_parse_zipfile
+ function
+
+We must not use heap memory after we freed it.
+
+(cherry picked from commit 7355ab81763a3d6a04ac11660e6a16d58838d187)
+---
+ NEWS | 6 ++++++
+ ext/phar/tests/bug79797.phar | Bin 0 -> 274 bytes
+ ext/phar/tests/bug79797.phpt | 14 ++++++++++++++
+ ext/phar/zip.c | 2 +-
+ 4 files changed, 21 insertions(+), 1 deletion(-)
+ create mode 100644 ext/phar/tests/bug79797.phar
+ create mode 100644 ext/phar/tests/bug79797.phpt
+
+diff --git a/ext/phar/zip.c b/ext/phar/zip.c
+index ed156a2d00..3ab02ab35a 100644
+--- a/ext/phar/zip.c
++++ b/ext/phar/zip.c
+@@ -682,7 +682,7 @@ int phar_parse_zipfile(php_stream *fp, char *fname, int fname_len, char *alias,
+ efree(actual_alias);
+ }
+
+- zend_hash_add(&(PHAR_GLOBALS->phar_alias_map), actual_alias, mydata->alias_len, (void*)&mydata, sizeof(phar_archive_data*), NULL);
++ zend_hash_add(&(PHAR_GLOBALS->phar_alias_map), mydata->alias, mydata->alias_len, (void*)&mydata, sizeof(phar_archive_data*), NULL);
+ } else {
+ phar_archive_data **fd_ptr;
+
diff --git a/php-bug79877.patch b/php-bug79877.patch
new file mode 100644
index 0000000..28323fe
--- /dev/null
+++ b/php-bug79877.patch
@@ -0,0 +1,69 @@
+From 5389b1e6bb048369715aba73473625d760a39e89 Mon Sep 17 00:00:00 2001
+From: "Christoph M. Becker" <cmbecker69 at gmx.de>
+Date: Tue, 21 Jul 2020 11:07:43 +0200
+Subject: [PATCH] Fix #79877: getimagesize function silently truncates after a
+ null byte
+
+We have to check for NUL bytes if `getimagesize()` has been called.
+
+(cherry picked from commit ff577b04c0d250473a0ef46f8e332960fec3ca2c)
+---
+ NEWS | 4 ++++
+ ext/standard/image.c | 5 +++++
+ ext/standard/tests/image/bug79877.phpt | 9 +++++++++
+ 3 files changed, 18 insertions(+)
+ create mode 100644 ext/standard/tests/image/bug79877.phpt
+
+diff --git a/ext/standard/image.c b/ext/standard/image.c
+index d58d543abd..f663e7c0c2 100644
+--- a/ext/standard/image.c
++++ b/ext/standard/image.c
+@@ -1398,6 +1398,11 @@ static void php_getimagesize_from_any(INTERNAL_FUNCTION_PARAMETERS, int mode) {
+ return;
+ }
+
++ if (mode == FROM_PATH && CHECK_NULL_PATH(input, input_len)) {
++ php_error_docref(NULL, E_WARNING, "Invalid path");
++ return;
++ }
++
+ if (argc == 2) {
+ zval_dtor(*info);
+ array_init(*info);
+diff --git a/ext/standard/tests/image/bug79877.phpt b/ext/standard/tests/image/bug79877.phpt
+new file mode 100644
+index 0000000000..92e93e59e5
+--- /dev/null
++++ b/ext/standard/tests/image/bug79877.phpt
+@@ -0,0 +1,9 @@
++--TEST--
++Bug #79877 (getimagesize function silently truncates after a null byte)
++--FILE--
++<?php
++var_dump(getimagesize("/tmp/a.png\0xx"));
++?>
++--EXPECTF--
++Warning: getimagesize(): Invalid path in %s on line %d
++NULL
+From bcec8f78b57189a654524b737562d1da235c6553 Mon Sep 17 00:00:00 2001
+From: Remi Collet <remi at remirepo.net>
+Date: Tue, 4 Aug 2020 07:40:22 +0200
+Subject: [PATCH] ZTS fix
+
+---
+ ext/standard/image.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/ext/standard/image.c b/ext/standard/image.c
+index f663e7c0c2..db64b3a48e 100644
+--- a/ext/standard/image.c
++++ b/ext/standard/image.c
+@@ -1399,7 +1399,7 @@ static void php_getimagesize_from_any(INTERNAL_FUNCTION_PARAMETERS, int mode) {
+ }
+
+ if (mode == FROM_PATH && CHECK_NULL_PATH(input, input_len)) {
+- php_error_docref(NULL, E_WARNING, "Invalid path");
++ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid path");
+ return;
+ }
+
diff --git a/php-bug79971.patch b/php-bug79971.patch
new file mode 100644
index 0000000..5359cc6
--- /dev/null
+++ b/php-bug79971.patch
@@ -0,0 +1,216 @@
+From a9a1eb2383f7b95c4e6a52d40dd99651e0c1c53c Mon Sep 17 00:00:00 2001
+From: "Christoph M. Becker" <cmbecker69 at gmx.de>
+Date: Tue, 1 Sep 2020 10:04:28 +0200
+Subject: [PATCH 1/4] Fix #79971: special character is breaking the path in xml
+ function
<Skipped 19095 lines>
================================================================
---- gitweb:
http://git.pld-linux.org/gitweb.cgi/packages/php.git/commitdiff/96b88e9f80a1774d03670f38e899d5553ef78bbf
More information about the pld-cvs-commit
mailing list