[packages/php/PHP_5_5] Rel 48. Security backports for EOL 5.5: shivammathur's PHP-5.5 branch (Patch200+) plus Remi, PLD 5.6
arekm
arekm at pld-linux.org
Thu Oct 22 09:36:10 CEST 2026
commit 4b8db7eb5e6f8dce26050f40a238e62ede49c837
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date: Thu Oct 22 09:34:10 2026 +0200
Rel 48. Security backports for EOL 5.5: shivammathur's PHP-5.5 branch (Patch200+)
plus Remi, PLD 5.6 and php-src ports (Patch400+); re2c regenerates parsers in %prep.
php-bug47925.patch | 38 +
php-bug66502.patch | 53 +
php-bug69090.patch | 178 +++
php-bug70213.patch | 61 +
php-bug70436.patch | 88 ++
php-bug71882.patch | 49 +
php-bug71894.patch | 92 ++
php-bug72085.patch | 102 ++
php-bug72135.patch | 20 +
php-bug72142.patch | 48 +
php-bug72293.patch | 32 +
php-bug72482.patch | 229 ++++
php-bug72494.patch | 60 +
php-bug72535.patch | 46 +
php-bug72627.patch | 99 ++
php-bug72663.patch | 103 ++
php-bug72681.patch | 121 ++
php-bug72682.patch | 40 +
php-bug72696.patch | 43 +
php-bug72697.patch | 70 ++
php-bug72708.patch | 18 +
php-bug72709.patch | 63 ++
php-bug72710.patch | 40 +
php-bug72716.patch | 20 +
php-bug72730.patch | 42 +
php-bug72749.patch | 81 ++
php-bug72750.patch | 63 ++
php-bug72771.patch | 19 +
php-bug72776.patch | 20 +
php-bug72787.patch | 43 +
php-bug72790.patch | 122 ++
php-bug72807.patch | 33 +
php-bug72823.patch | 52 +
php-bug72836.patch | 31 +
php-bug72837.patch | 38 +
php-bug72838.patch | 21 +
php-bug72848.patch | 21 +
php-bug72849.patch | 23 +
php-bug72850.patch | 30 +
php-bug72860.patch | 52 +
php-bug72907.patch | 151 +++
php-bug72910.patch | 36 +
php-bug72926.patch | 22 +
php-bug72928.patch | 102 ++
php-bug72994.patch | 54 +
php-bug73003.patch | 27 +
php-bug73007.patch | 18 +
php-bug73017.patch | 53 +
php-bug73029.patch | 69 ++
php-bug73035.patch | 18 +
php-bug73052.patch | 52 +
php-bug73065.patch | 81 ++
php-bug73073.patch | 58 +
php-bug73082.patch | 45 +
php-bug73100.patch | 47 +
php-bug73144.patch | 56 +
php-bug73147.patch | 95 ++
php-bug73150.patch | 31 +
php-bug73174.patch | 66 ++
php-bug73188.patch | 63 ++
php-bug73189.patch | 42 +
php-bug73190.patch | 121 ++
php-bug73192.patch | 338 ++++++
php-bug73208.patch | 18 +
php-bug73213.patch | 111 ++
php-bug73218.patch | 98 ++
php-bug73240.patch | 96 ++
php-bug73275.patch | 39 +
php-bug73276.patch | 35 +
php-bug73280.patch | 23 +
php-bug73284.patch | 91 ++
php-bug73293.patch | 62 ++
php-bug73331.patch | 192 ++++
php-bug73342.patch | 36 +
php-bug73356.patch | 253 +++++
php-bug73418.patch | 20 +
php-bug73473.patch | 17 +
php-bug73549.patch | 86 ++
php-bug73631.patch | 53 +
php-bug73737.patch | 36 +
php-bug73764.patch | 50 +
php-bug73768.patch | 48 +
php-bug73773.patch | 27 +
php-bug73809.patch | 71 ++
php-bug73825.patch | 78 ++
php-bug73868.patch | 57 +
php-bug73869.patch | 55 +
php-bug74111.patch | 40 +
php-bug74145.patch | 72 ++
php-bug74435.patch | 55 +
php-bug74603.patch | 56 +
php-bug74651.patch | 83 ++
php-bug74782.patch | 396 +++++++
php-bug75055.patch | 75 ++
php-bug75571.patch | 66 ++
php-bug75981.patch | 58 +
php-bug76129.patch | 171 +++
php-bug76130.patch | 47 +
php-bug76248.patch | 22 +
php-bug76249.patch | 40 +
php-bug76423.patch | 46 +
php-bug76448.patch | 68 ++
php-bug76452.patch | 99 ++
php-bug76557.patch | 63 ++
php-bug76582.patch | 20 +
php-bug77020.patch | 41 +
php-bug77022.patch | 97 ++
php-bug77143.patch | 126 +++
php-bug77153.patch | 88 ++
php-bug77231.patch | 18 +
php-bug77242.patch | 35 +
php-bug77247.patch | 38 +
php-bug77269.patch | 73 ++
php-bug77270.patch | 48 +
php-bug77367.patch | 35 +
php-bug77369.patch | 20 +
php-bug77370.patch | 52 +
php-bug77371.patch | 119 ++
php-bug77380.patch | 49 +
php-bug77396.patch | 39 +
php-bug77418.patch | 89 ++
php-bug77423.patch | 159 +++
php-bug77431.patch | 36 +
php-bug77540.patch | 63 ++
php-bug77563.patch | 47 +
php-bug77586.patch | 62 ++
php-bug77630.patch | 83 ++
php-bug77753.patch | 20 +
php-bug77831.patch | 167 +++
php-bug77919.patch | 47 +
php-bug77950.patch | 22 +
php-bug77967.patch | 25 +
php-bug77973.patch | 56 +
php-bug77988.patch | 18 +
php-bug78069.patch | 20 +
php-bug78222.patch | 18 +
php-bug78256.patch | 50 +
php-bug78559.patch | 19 +
php-bug78599.patch | 20 +
php-bug78793.patch | 38 +
php-bug78863.patch | 74 ++
php-bug78875.patch | 26 +
php-bug78876.patch | 45 +
php-bug78878.patch | 42 +
php-bug78910.patch | 41 +
php-bug79037.patch | 55 +
php-bug79082.patch | 34 +
php-bug79099.patch | 83 ++
php-bug79221.patch | 74 ++
php-bug79265.patch | 278 +++++
php-bug79282.patch | 30 +
php-bug79329.patch | 18 +
php-bug79330.patch | 25 +
php-bug79465.patch | 27 +
php-bug79797.patch | 20 +
php-bug79877.patch | 23 +
php-bug79971.patch | 109 ++
php-bug80672.patch | 180 +++
php-bug80710.patch | 338 ++++++
php-bug81026.patch | 392 +++++++
php-bug81122.patch | 50 +
php-bug81211.patch | 96 ++
php-bug81719.patch | 19 +
php-bug81720.patch | 123 +++
php-bug81726.patch | 79 ++
php-bug81727.patch | 50 +
php-bug81740.patch | 44 +
php-cve-2016-7479.patch | 169 +++
php-cve-2017-11145.patch | 38 +
php-cve-2017-7272.patch | 110 ++
php-cve-2018-10545.patch | 65 ++
php-cve-2019-13224.patch | 38 +
php-cve-2020-7070.patch | 31 +
php-cve-2023-0567.patch | 154 +++
php-cve-2023-0568.patch | 55 +
php-cve-2023-0662.patch | 68 ++
php-cve-2023-3247.patch | 75 ++
php-cve-2023-3823.patch | 346 ++++++
php-cve-2023-3824.patch | 83 ++
php-cve-2024-11233.patch | 116 ++
php-cve-2024-11234.patch | 92 ++
php-cve-2024-11236.patch | 101 ++
php-cve-2024-2756.patch | 148 +++
php-cve-2024-3096.patch | 42 +
php-cve-2024-8925.patch | 152 +++
php-cve-2024-8927.patch | 48 +
php-cve-2024-8929.patch | 2207 +++++++++++++++++++++++++++++++++++++
php-cve-2025-1217.patch | 1453 ++++++++++++++++++++++++
php-cve-2025-1220.patch | 137 +++
php-cve-2025-14177.patch | 122 ++
php-cve-2025-14181.patch | 93 ++
php-cve-2025-1735.patch | 381 +++++++
php-cve-2025-6491.patch | 92 ++
php-cve-2026-109618.patch | 562 ++++++++++
php-cve-2026-14355.patch | 49 +
php-cve-2026-17543.patch | 164 +++
php-cve-2026-6103.patch | 383 +++++++
php-cve-2026-6722.patch | 189 ++++
php-cve-2026-6735.patch | 65 ++
php-cve-2026-7258.patch | 39 +
php-cve-2026-7260.patch | 95 ++
php-cve-2026-7261.patch | 118 ++
php-cve-2026-7262.patch | 65 ++
php-cve-2026-91765.patch | 414 +++++++
php-cve-2026-91766.patch | 406 +++++++
php-cve-2026-91768.patch | 18 +
php-cve-2026-92842.patch | 77 ++
php-cve-2026-93682.patch | 121 ++
php-cve-2026-9672.patch | 38 +
php-exif-32bit-overflows.patch | 46 +
php-gh22761.patch | 39 +
php-ghsa-4w77-75f9-2c8w.patch | 87 ++
php-ghsa-ch8v-r6jh-4vvr.patch | 42 +
php-ghsa-www2-q4fc-65wf.patch | 302 +++++
php-glob-open-basedir.patch | 78 ++
php-libmagic-cve-2019-18218.patch | 43 +
php-mssql-dbconvert.patch | 46 +
php-onig-cve-2017-9224.patch | 24 +
php-onig-cve-2017-9226.patch | 39 +
php-onig-cve-2017-9227.patch | 18 +
php-onig-cve-2017-9228.patch | 20 +
php-onig-cve-2017-9229.patch | 32 +
php-onig-cve-2019-19204.patch | 20 +
php-soap-props-inplace.patch | 81 ++
php-sqlite3-defensive.patch | 139 +++
php-zpp-path-checks.patch | 43 +
php.spec | 469 +++++++-
227 files changed, 22275 insertions(+), 2 deletions(-)
---
diff --git a/php.spec b/php.spec
index 88c39f0..af95902 100644
--- a/php.spec
+++ b/php.spec
@@ -140,7 +140,7 @@ ERROR: You need to select at least one Apache SAPI to build shared modules.
%undefine with_filter
%endif
-%define rel 47
+%define rel 48
%define orgname php
%define ver_suffix 55
%define php_suffix %{!?with_default_php:%{ver_suffix}}
@@ -159,7 +159,7 @@ Epoch: 4
# TSRM is licensed under BSD
License: PHP 3.01 and Zend and BSD
Group: Libraries
-Source0: http://www.php.net/distributions/%{orgname}-%{version}.tar.xz
+Source0: https://www.php.net/distributions/%{orgname}-%{version}.tar.xz
# Source0-md5: 72302e26f153687e2ca922909f927443
Source2: %{orgname}-mod_%{orgname}.conf
Source3: %{orgname}-cgi-fcgi.ini
@@ -231,6 +231,239 @@ Patch73: libxml2.patch
Patch74: configure.patch
Patch75: types.patch
Patch76: includes.patch
+# Patch200+: security backports for EOL 5.5 from
+# https://github.com/shivammathur/php-src-backports/commits/PHP-5.5-security-backports
+# one patch per fix, the branch's later fix-ups folded into the patch they fix;
+# "PLD:" header lines name changes against the branch; binary test fixtures are
+# left out (GNU patch cannot apply them), so those tests fail
+Patch200: php-bug72837.patch
+Patch201: php-bug70436.patch
+Patch202: php-bug72663.patch
+Patch203: php-bug72681.patch
+Patch204: php-bug72807.patch
+Patch205: php-bug72838.patch
+Patch206: php-bug72697.patch
+Patch207: php-bug72730.patch
+Patch208: php-bug72708.patch
+Patch209: php-bug72848.patch
+Patch210: php-bug72849.patch
+Patch211: php-bug72850.patch
+Patch212: php-bug72771.patch
+Patch213: php-bug72749.patch
+Patch214: php-bug72750.patch
+Patch215: php-bug72790.patch
+Patch216: php-bug73052.patch
+Patch217: php-bug72293.patch
+Patch218: php-bug72860.patch
+Patch219: php-bug72928.patch
+Patch220: php-bug73007.patch
+Patch221: php-bug73029.patch
+Patch222: php-bug73065.patch
+Patch223: php-bug73189.patch
+Patch224: php-bug73147.patch
+Patch225: php-bug73190.patch
+Patch226: php-bug73150.patch
+Patch227: php-bug73284.patch
+Patch228: php-bug73003.patch
+Patch229: php-bug73218.patch
+Patch230: php-bug73208.patch
+Patch231: php-bug73082.patch
+Patch232: php-bug73174.patch
+Patch233: php-bug73276.patch
+Patch234: php-bug73275.patch
+Patch235: php-bug73017.patch
+Patch236: php-bug73240.patch
+Patch237: php-bug73073.patch
+Patch238: php-bug73293.patch
+Patch239: php-bug73280.patch
+Patch240: php-bug72482.patch
+Patch241: php-bug72696.patch
+Patch242: php-bug73418.patch
+Patch243: php-bug73144.patch
+Patch244: php-bug73192.patch
+Patch245: php-bug73331.patch
+Patch246: php-soap-props-inplace.patch
+Patch247: php-bug73631.patch
+Patch248: php-bug73737.patch
+Patch249: php-bug73868.patch
+Patch250: php-bug73869.patch
+Patch251: php-bug73764.patch
+Patch252: php-bug73768.patch
+Patch253: php-bug73773.patch
+Patch254: php-bug73825.patch
+Patch255: php-bug72627.patch
+Patch256: php-bug69090.patch
+Patch257: php-bug74145.patch
+Patch258: php-bug74651.patch
+Patch259: php-cve-2017-11145.patch
+Patch260: php-bug74435.patch
+Patch261: php-onig-cve-2017-9226.patch
+Patch262: php-onig-cve-2017-9224.patch
+Patch263: php-onig-cve-2017-9227.patch
+Patch264: php-onig-cve-2017-9228.patch
+Patch265: php-onig-cve-2017-9229.patch
+Patch266: php-bug74603.patch
+Patch267: php-bug75055.patch
+Patch268: php-bug72535.patch
+Patch269: php-bug75571.patch
+Patch270: php-bug74782.patch
+Patch271: php-cve-2018-10545.patch
+Patch272: php-bug76130.patch
+Patch273: php-bug76249.patch
+Patch274: php-bug76248.patch
+Patch275: php-bug76129.patch
+Patch276: php-bug75981.patch
+Patch277: php-bug77153.patch
+Patch278: php-bug77242.patch
+Patch279: php-bug77247.patch
+Patch280: php-bug77269.patch
+Patch281: php-bug77270.patch
+Patch282: php-bug77371.patch
+Patch283: php-bug77380.patch
+Patch284: php-bug77418.patch
+Patch285: php-bug77630.patch
+Patch286: php-bug77431.patch
+Patch287: php-bug77396.patch
+Patch288: php-bug77540.patch
+Patch289: php-bug77586.patch
+Patch290: php-bug77563.patch
+Patch291: php-bug76557.patch
+Patch292: php-bug78069.patch
+Patch293: php-bug77967.patch
+Patch294: php-bug77973.patch
+Patch295: php-bug77988.patch
+Patch296: php-bug78256.patch
+Patch297: php-bug78222.patch
+Patch298: php-cve-2019-13224.patch
+Patch299: php-bug78599.patch
+Patch300: php-bug78910.patch
+Patch301: php-bug78878.patch
+Patch302: php-bug78793.patch
+Patch303: php-bug78863.patch
+Patch304: php-bug79037.patch
+Patch305: php-bug79099.patch
+Patch306: php-bug79082.patch
+Patch307: php-bug79221.patch
+Patch308: php-bug79329.patch
+Patch309: php-bug79282.patch
+Patch310: php-bug79330.patch
+Patch311: php-bug79465.patch
+Patch312: php-bug78875.patch
+Patch313: php-bug78876.patch
+Patch314: php-bug79877.patch
+Patch315: php-cve-2020-7070.patch
+Patch316: php-bug73809.patch
+Patch317: php-bug80672.patch
+Patch318: php-bug76448.patch
+Patch319: php-bug81211.patch
+Patch320: php-bug79971.patch
+Patch321: php-bug81026.patch
+Patch322: php-bug81720.patch
+Patch323: php-bug81719.patch
+Patch324: php-bug81122.patch
+Patch325: php-bug76452.patch
+Patch326: php-bug81726.patch
+Patch327: php-bug81727.patch
+Patch328: php-bug81740.patch
+Patch329: php-cve-2023-0568.patch
+Patch330: php-cve-2023-0567.patch
+Patch331: php-cve-2023-0662.patch
+Patch332: php-cve-2023-3823.patch
+Patch333: php-cve-2023-3824.patch
+Patch334: php-cve-2023-3247.patch
+Patch335: php-cve-2024-2756.patch
+Patch336: php-cve-2024-3096.patch
+Patch337: php-cve-2024-8925.patch
+Patch338: php-cve-2024-8927.patch
+Patch339: php-cve-2024-11233.patch
+Patch340: php-cve-2024-11234.patch
+Patch341: php-cve-2024-11236.patch
+Patch342: php-cve-2024-8929.patch
+Patch343: php-bug77423.patch
+Patch344: php-bug79797.patch
+Patch345: php-bug77143.patch
+Patch346: php-bug77020.patch
+Patch347: php-bug76423.patch
+Patch348: php-bug76582.patch
+Patch349: php-bug77753.patch
+Patch350: php-bug77367.patch
+Patch351: php-bug77831.patch
+Patch352: php-bug77950.patch
+Patch353: php-bug77369.patch
+Patch354: php-cve-2025-1217.patch
+Patch355: php-cve-2025-6491.patch
+Patch356: php-cve-2025-1220.patch
+Patch357: php-bug78559.patch
+Patch358: php-cve-2026-6722.patch
+Patch359: php-cve-2026-7262.patch
+Patch360: php-cve-2026-7261.patch
+Patch361: php-cve-2026-6735.patch
+Patch362: php-cve-2026-14355.patch
+Patch363: php-cve-2026-7260.patch
+Patch364: php-cve-2026-9672.patch
+Patch365: php-cve-2026-17543.patch
+Patch366: php-bug77370.patch
+Patch367: php-exif-32bit-overflows.patch
+Patch368: php-cve-2025-1735.patch
+Patch369: php-bug79265.patch
+Patch370: php-cve-2026-92842.patch
+Patch371: php-cve-2025-14181.patch
+Patch372: php-cve-2026-6103.patch
+Patch373: php-cve-2026-91765.patch
+Patch374: php-cve-2026-91766.patch
+Patch375: php-cve-2026-93682.patch
+Patch376: php-cve-2026-91768.patch
+Patch377: php-bug72926.patch
+Patch378: php-bug73035.patch
+Patch379: php-bug77231.patch
+Patch380: php-bug72135.patch
+Patch381: php-bug73473.patch
+Patch382: php-bug74111.patch
+Patch383: php-bug72682.patch
+Patch384: php-bug73342.patch
+Patch385: php-cve-2016-7479.patch
+Patch386: php-cve-2017-7272.patch
+Patch387: php-cve-2026-109618.patch
+# Patch400+: fixes that branch lacks, from Remi Collet's scl-php55, PLD's PHP_5_6
+# branch and php-src/oniguruma commits; each patch header names its source
+Patch400: php-bug72716.patch
+Patch401: php-bug72836.patch
+Patch402: php-bug72910.patch
+Patch403: php-bug73356.patch
+Patch404: php-bug73549.patch
+Patch405: php-bug47925.patch
+Patch406: php-bug77919.patch
+Patch407: php-bug80710.patch
+Patch408: php-cve-2025-14177.patch
+Patch409: php-cve-2026-7258.patch
+Patch410: php-gh22761.patch
+Patch411: php-ghsa-4w77-75f9-2c8w.patch
+Patch412: php-ghsa-ch8v-r6jh-4vvr.patch
+Patch413: php-ghsa-www2-q4fc-65wf.patch
+Patch414: php-libmagic-cve-2019-18218.patch
+Patch415: php-sqlite3-defensive.patch
+Patch416: php-zpp-path-checks.patch
+Patch417: php-bug72494.patch
+Patch418: php-onig-cve-2019-19204.patch
+Patch419: php-glob-open-basedir.patch
+Patch420: php-bug77022.patch
+Patch421: php-bug72142.patch
+Patch422: php-bug72710.patch
+Patch423: php-bug66502.patch
+Patch424: php-bug71894.patch
+Patch425: php-bug72709.patch
+Patch426: php-bug72823.patch
+Patch427: php-bug72994.patch
+Patch428: php-bug72085.patch
+Patch429: php-bug72787.patch
+Patch430: php-bug72776.patch
+Patch431: php-bug73188.patch
+Patch432: php-bug73100.patch
+Patch433: php-bug70213.patch
+Patch434: php-bug72907.patch
+Patch435: php-bug71882.patch
+Patch436: php-bug73213.patch
+Patch437: php-mssql-dbconvert.patch
URL: https://www.php.net/
%{?with_interbase:%{!?with_interbase_inst:BuildRequires: Firebird-devel >= 1.0.2.908-2}}
%{?with_pspell:BuildRequires: aspell-devel >= 2:0.50.0}
@@ -287,6 +520,7 @@ BuildRequires: pam-devel
BuildRequires: pkgconfig
%{?with_pgsql:BuildRequires: postgresql-backend-devel >= 7.2}
%{?with_pgsql:BuildRequires: postgresql-devel}
+BuildRequires: re2c >= 0.13.4
BuildRequires: readline-devel
%{?with_recode:BuildRequires: recode-devel >= 3.5d-3}
BuildRequires: rpm >= 4.4.9-56
@@ -2117,6 +2351,237 @@ exit 1
%patch -P74 -p1
%patch -P75 -p1
%patch -P76 -p1
+%patch -P200 -p1
+%patch -P201 -p1
+%patch -P202 -p1
+%patch -P203 -p1
+%patch -P204 -p1
+%patch -P205 -p1
+%patch -P206 -p1
+%patch -P207 -p1
+%patch -P208 -p1
+%patch -P209 -p1
+%patch -P210 -p1
+%patch -P211 -p1
+%patch -P212 -p1
+%patch -P213 -p1
+%patch -P214 -p1
+%patch -P215 -p1
+%patch -P216 -p1
+%patch -P217 -p1
+%patch -P218 -p1
+%patch -P219 -p1
+%patch -P220 -p1
+%patch -P221 -p1
+%patch -P222 -p1
+%patch -P223 -p1
+%patch -P224 -p1
+%patch -P225 -p1
+%patch -P226 -p1
+%patch -P227 -p1
+%patch -P228 -p1
+%patch -P229 -p1
+%patch -P230 -p1
+%patch -P231 -p1
+%patch -P232 -p1
+%patch -P233 -p1
+%patch -P234 -p1
+%patch -P235 -p1
+%patch -P236 -p1
+%patch -P237 -p1
+%patch -P238 -p1
+%patch -P239 -p1
+%patch -P240 -p1
+%patch -P241 -p1
+%patch -P242 -p1
+%patch -P243 -p1
+%patch -P244 -p1
+%patch -P245 -p1
+%patch -P246 -p1
+%patch -P247 -p1
+%patch -P248 -p1
+%patch -P249 -p1
+%patch -P250 -p1
+%patch -P251 -p1
+%patch -P252 -p1
+%patch -P253 -p1
+%patch -P254 -p1
+%patch -P255 -p1
+%patch -P256 -p1
+%patch -P257 -p1
+%patch -P258 -p1
+%patch -P259 -p1
+%patch -P260 -p1
+%patch -P261 -p1
+%patch -P262 -p1
+%patch -P263 -p1
+%patch -P264 -p1
+%patch -P265 -p1
+%patch -P266 -p1
+%patch -P267 -p1
+%patch -P268 -p1
+%patch -P269 -p1
+%patch -P270 -p1
+%patch -P271 -p1
+%patch -P272 -p1
+%patch -P273 -p1
+%patch -P274 -p1
+%patch -P275 -p1
+%patch -P276 -p1
+%patch -P277 -p1
+%patch -P278 -p1
+%patch -P279 -p1
+%patch -P280 -p1
+%patch -P281 -p1
+%patch -P282 -p1
+%patch -P283 -p1
+%patch -P284 -p1
+%patch -P285 -p1
+%patch -P286 -p1
+%patch -P287 -p1
+%patch -P288 -p1
+%patch -P289 -p1
+%patch -P290 -p1
+%patch -P291 -p1
+%patch -P292 -p1
+%patch -P293 -p1
+%patch -P294 -p1
+%patch -P295 -p1
+%patch -P296 -p1
+%patch -P297 -p1
+%patch -P298 -p1
+%patch -P299 -p1
+%patch -P300 -p1
+%patch -P301 -p1
+%patch -P302 -p1
+%patch -P303 -p1
+%patch -P304 -p1
+%patch -P305 -p1
+%patch -P306 -p1
+%patch -P307 -p1
+%patch -P308 -p1
+%patch -P309 -p1
+%patch -P310 -p1
+%patch -P311 -p1
+%patch -P312 -p1
+%patch -P313 -p1
+%patch -P314 -p1
+%patch -P315 -p1
+%patch -P316 -p1
+%patch -P317 -p1
+%patch -P318 -p1
+%patch -P319 -p1
+%patch -P320 -p1
+%patch -P321 -p1
+%patch -P322 -p1
+%patch -P323 -p1
+%patch -P324 -p1
+%patch -P325 -p1
+%patch -P326 -p1
+%patch -P327 -p1
+%patch -P328 -p1
+%patch -P329 -p1
+%patch -P330 -p1
+%patch -P331 -p1
+%patch -P332 -p1
+%patch -P333 -p1
+%patch -P334 -p1
+%patch -P335 -p1
+%patch -P336 -p1
+%patch -P337 -p1
+%patch -P338 -p1
+%patch -P339 -p1
+%patch -P340 -p1
+%patch -P341 -p1
+%patch -P342 -p1
+%patch -P343 -p1
+%patch -P344 -p1
+%patch -P345 -p1
+%patch -P346 -p1
+%patch -P347 -p1
+%patch -P348 -p1
+%patch -P349 -p1
+%patch -P350 -p1
+%patch -P351 -p1
+%patch -P352 -p1
+%patch -P353 -p1
+%patch -P354 -p1
+%patch -P355 -p1
+%patch -P356 -p1
+%patch -P357 -p1
+%patch -P358 -p1
+%patch -P359 -p1
+%patch -P360 -p1
+%patch -P361 -p1
+%patch -P362 -p1
+%patch -P363 -p1
+%patch -P364 -p1
+%patch -P365 -p1
+%patch -P366 -p1
+%patch -P367 -p1
+%patch -P368 -p1
+%patch -P369 -p1
+%patch -P370 -p1
+%patch -P371 -p1
+%patch -P372 -p1
+%patch -P373 -p1
+%patch -P374 -p1
+%patch -P375 -p1
+%patch -P376 -p1
+%patch -P377 -p1
+%patch -P378 -p1
+%patch -P379 -p1
+%patch -P380 -p1
+%patch -P381 -p1
+%patch -P382 -p1
+%patch -P383 -p1
+%patch -P384 -p1
+%patch -P385 -p1
+%patch -P386 -p1
+%patch -P387 -p1
+%patch -P400 -p1
+%patch -P401 -p1
+%patch -P402 -p1
+%patch -P403 -p1
+%patch -P404 -p1
+%patch -P405 -p1
+%patch -P406 -p1
+%patch -P407 -p1
+%patch -P408 -p1
+%patch -P409 -p1
+%patch -P410 -p1
+%patch -P411 -p1
+%patch -P412 -p1
+%patch -P413 -p1
+%patch -P414 -p1
+%patch -P415 -p1
+%patch -P416 -p1
+%patch -P417 -p1
+%patch -P418 -p1
+%patch -P419 -p1
+%patch -P420 -p1
+%patch -P421 -p1
+%patch -P422 -p1
+%patch -P423 -p1
+%patch -P424 -p1
+%patch -P425 -p1
+%patch -P426 -p1
+%patch -P427 -p1
+%patch -P428 -p1
+%patch -P429 -p1
+%patch -P430 -p1
+%patch -P431 -p1
+%patch -P432 -p1
+%patch -P433 -p1
+%patch -P434 -p1
+%patch -P435 -p1
+%patch -P436 -p1
+%patch -P437 -p1
+
+# backports patch only the .re sources; date has no make rule and the
+# unserializer one is skipped silently when configure finds no re2c
+re2c --no-generation-date -b -o ext/standard/var_unserializer.c ext/standard/var_unserializer.re
+re2c --no-generation-date -d -b -o ext/date/lib/parse_date.c ext/date/lib/parse_date.re
sed -E -i -e '1s,#!\s*/usr/bin/env\s+(.*),#!%{__bindir}\1,' \
run-tests.php
diff --git a/php-bug47925.patch b/php-bug47925.patch
new file mode 100644
index 0000000..df715d3
--- /dev/null
+++ b/php-bug47925.patch
@@ -0,0 +1,38 @@
+From 582b22583f53fcfeea4ba397cd8b2295bdb40dfb Mon Sep 17 00:00:00 2001
+From: Niels Dossche <7771979+nielsdos at users.noreply.github.com>
+Date: Sat, 25 May 2024 16:11:43 +0200
+Subject: [PATCH] Fix bug #47925: PHPClient can't decompress response
+
+Backport of https://github.com/php/php-src/commit/35e62e9b590690f24fe78e3097d5bddcfb913e61
+and https://github.com/php/php-src/commit/ce7ed6e040f4c57604a19e6a7d2ed5e401f6f02d
+(net effect: gzip bodies go to gzdecode() whole, deflate unchanged)
+
+5.6: the old code passed http_body+10 with length http_body_size-10 without
+copying, so a gzip response shorter than 10 bytes gave gzinflate() a
+negative length and inflate() read past the heap buffer. Not an upstream
+advisory; the test needs pcntl and the 8.x server.inc API and is not
+included.
+
+Source: PLD php PHP_5_6 branch, https://git.pld-linux.org/?p=packages/php.git;a=blob_plain;hb=refs/heads/PHP_5_6;f=php-bug47925.patch
+---
+diff --git a/ext/soap/php_http.c b/ext/soap/php_http.c
+--- a/ext/soap/php_http.c
++++ b/ext/soap/php_http.c
+@@ -1256,12 +1256,14 @@ try_again:
+ zval param;
+ zval *params[1];
+
++ /* Warning: the zlib function names are chosen in an unfortunate manner.
++ * Check zlib.c to see how a function corresponds with a particular format. */
+ if ((strcmp(content_encoding,"gzip") == 0 ||
+ strcmp(content_encoding,"x-gzip") == 0) &&
+- zend_hash_exists(EG(function_table), "gzinflate", sizeof("gzinflate"))) {
+- ZVAL_STRING(&func, "gzinflate", 0);
++ zend_hash_exists(EG(function_table), "gzdecode", sizeof("gzdecode"))) {
++ ZVAL_STRING(&func, "gzdecode", 0);
+ params[0] = ¶m;
+- ZVAL_STRINGL(params[0], http_body+10, http_body_size-10, 0);
++ ZVAL_STRINGL(params[0], http_body, http_body_size, 0);
+ INIT_PZVAL(params[0]);
+ } else if (strcmp(content_encoding,"deflate") == 0 &&
+ zend_hash_exists(EG(function_table), "gzuncompress", sizeof("gzuncompress"))) {
diff --git a/php-bug66502.patch b/php-bug66502.patch
new file mode 100644
index 0000000..024cda5
--- /dev/null
+++ b/php-bug66502.patch
@@ -0,0 +1,53 @@
+From a4aa4f9772a6c30f69db8560cde1f5fe4545b174 Mon Sep 17 00:00:00 2001
+From: "Christoph M. Becker" <cmb at php.net>
+Date: Fri, 15 Jul 2016 00:57:36 +0200
+Subject: [PATCH] Fix bug #66502: DOM document dangling reference
+
+When we decrement the refcount of a node's document, we state that we
+won't need it anymore. Therefore we can *always* set the pointer to the
+document to NULL, what avoids invalid memory accesses for some edge cases
+as demonstrated with the PHPT.
+
+Original patch provided by Sean Heelan.
+
+Source: upstream https://github.com/php/php-src/commit/a4aa4f9772 (5.6.25)
+---
+diff --git a/ext/dom/tests/bug66502.phpt b/ext/dom/tests/bug66502.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/dom/tests/bug66502.phpt
+@@ -0,0 +1,20 @@
++--TEST--
++Bug #66502 (DOM document dangling reference)
++--SKIPIF--
++<?php
++if (!extension_loaded('dom')) die('skip requires ext/dom');
++?>
++--FILE--
++<?php
++$dom = new DOMDocument('1.0', 'UTF-8');
++$element = $dom->appendChild(new DOMElement('root'));
++$comment = new DOMComment("Comment 0");
++$comment = $element->appendChild($comment);
++
++$comment->__construct("Comment 1");
++$comment->__construct("Comment 2");
++$comment->__construct("Comment 3");
++echo 'DONE', PHP_EOL;
++?>
++--EXPECT--
++DONE
+\ No newline at end of file
+diff --git a/ext/libxml/libxml.c b/ext/libxml/libxml.c
+--- a/ext/libxml/libxml.c
++++ b/ext/libxml/libxml.c
+@@ -1286,8 +1286,8 @@ PHP_LIBXML_API int php_libxml_decrement_doc_ref(php_libxml_node_object *object T
+ efree(object->document->doc_props);
+ }
+ efree(object->document);
+- object->document = NULL;
+ }
++ object->document = NULL;
+ }
+
+ return ret_refcount;
diff --git a/php-bug69090.patch b/php-bug69090.patch
new file mode 100644
index 0000000..f85a5e2
--- /dev/null
+++ b/php-bug69090.patch
@@ -0,0 +1,178 @@
+From: Dmitry Stogov <dmitry at zend.com>
+Date: Wed Nov 16 12:43:10 2016 +0300
+Subject: [PATCH] Fixed bug #69090 (check cached files permissions)
+
+5.5 backport: https://github.com/shivammathur/php-src-backports/commit/6e599aa06756528a49fe91a8eb9cc9846ba954f5
+PLD: with upstream follow-up 8202b970 "Use full path" (Ubuntu trusty CVE-2015-8994-2.patch)
+---
+diff --git a/ext/opcache/ZendAccelerator.c b/ext/opcache/ZendAccelerator.c
+--- a/ext/opcache/ZendAccelerator.c
++++ b/ext/opcache/ZendAccelerator.c
+@@ -1559,6 +1559,28 @@ zend_op_array *persistent_compile_file(zend_file_handle *file_handle, int type T
+ persistent_script = NULL;
+ }
+
++ /* Revalidate acessibility of cached file */
++ if (EXPECTED(persistent_script != NULL) &&
++ UNEXPECTED(ZCG(accel_directives).validate_permission) &&
++ file_handle->type == ZEND_HANDLE_FILENAME &&
++ UNEXPECTED(access(persistent_script->full_path, R_OK) != 0)) {
++ if (type == ZEND_REQUIRE) {
++#if ZEND_EXTENSION_API_NO < PHP_5_3_X_API_NO
++ zend_message_dispatcher(ZMSG_FAILED_REQUIRE_FOPEN, file_handle->filename);
++#else
++ zend_message_dispatcher(ZMSG_FAILED_REQUIRE_FOPEN, file_handle->filename TSRMLS_CC);
++#endif
++ zend_bailout();
++ } else {
++#if ZEND_EXTENSION_API_NO < PHP_5_3_X_API_NO
++ zend_message_dispatcher(ZMSG_FAILED_INCLUDE_FOPEN, file_handle->filename);
++#else
++ zend_message_dispatcher(ZMSG_FAILED_INCLUDE_FOPEN, file_handle->filename TSRMLS_CC);
++#endif
++ }
++ return NULL;
++ }
++
+ SHM_UNPROTECT();
+
+ /* If script is found then validate_timestamps if option is enabled */
+@@ -2071,6 +2093,27 @@ static void accel_activate(void)
+ return;
+ }
+
++#ifndef ZEND_WIN32
++ if (ZCG(accel_directives).validate_root) {
++ struct stat buf;
++
++ if (stat("/", &buf) != 0) {
++ ZCG(root_hash) = 0;
++ } else {
++ ZCG(root_hash) = buf.st_ino;
++ if (sizeof(buf.st_ino) > sizeof(ZCG(root_hash))) {
++ if (ZCG(root_hash) != buf.st_ino) {
++ zend_alter_ini_entry("opcache.enable", sizeof("opcache.enable"), "0", 1, ZEND_INI_SYSTEM, ZEND_INI_STAGE_RUNTIME);
++ zend_accel_error(ACCEL_LOG_WARNING, "Can't cache files in chroot() directory with too big inode");
++ return;
++ }
++ }
++ }
++ } else {
++ ZCG(root_hash) = 0;
++ }
++#endif
++
+ SHM_UNPROTECT();
+ /* PHP-5.4 and above return "double", but we use 1 sec precision */
+ ZCG(request_time) = (time_t)sapi_get_request_time(TSRMLS_C);
+diff --git a/ext/opcache/ZendAccelerator.h b/ext/opcache/ZendAccelerator.h
+--- a/ext/opcache/ZendAccelerator.h
++++ b/ext/opcache/ZendAccelerator.h
+@@ -229,6 +229,8 @@ typedef struct _zend_accel_directives {
+ zend_bool file_override_enabled;
+ zend_bool inherited_hack;
+ zend_bool enable_cli;
++ zend_bool validate_permission;
++ zend_bool validate_root;
+ unsigned long revalidate_freq;
+ unsigned long file_update_protection;
+ char *error_log;
+@@ -263,6 +265,9 @@ typedef struct _zend_accel_globals {
+ int include_path_len; /* "include_path" string length */
+ int include_path_check;
+ time_t request_time;
++#ifndef ZEND_WIN32
++ unsigned long root_hash;
++#endif
+ /* preallocated shared-memory block to save current script */
+ void *mem;
+ /* cache to save hash lookup on the same INCLUDE opcode */
+diff --git a/ext/opcache/zend_accelerator_hash.c b/ext/opcache/zend_accelerator_hash.c
+--- a/ext/opcache/zend_accelerator_hash.c
++++ b/ext/opcache/zend_accelerator_hash.c
+@@ -77,6 +77,9 @@ zend_accel_hash_entry* zend_accel_hash_update(zend_accel_hash *accel_hash, char
+ zend_ulong index;
+ zend_accel_hash_entry *entry;
+ zend_accel_hash_entry *indirect_bucket = NULL;
++#ifndef ZEND_WIN32
++ TSRMLS_FETCH();
++#endif
+
+ if (indirect) {
+ indirect_bucket = (zend_accel_hash_entry*)data;
+@@ -86,6 +89,9 @@ zend_accel_hash_entry* zend_accel_hash_update(zend_accel_hash *accel_hash, char
+ }
+
+ hash_value = zend_inline_hash_func(key, key_length);
++#ifndef ZEND_WIN32
++ hash_value ^= ZCG(root_hash);
++#endif
+ index = hash_value % accel_hash->max_num_entries;
+
+ /* try to see if the element already exists in the hash */
+@@ -145,8 +151,14 @@ void* zend_accel_hash_find(zend_accel_hash *accel_hash, char *key, zend_uint key
+ zend_ulong hash_value;
+ zend_ulong index;
+ zend_accel_hash_entry *entry;
++#ifndef ZEND_WIN32
++ TSRMLS_FETCH();
++#endif
+
+ hash_value = zend_inline_hash_func(key, key_length);
++#ifndef ZEND_WIN32
++ hash_value ^= ZCG(root_hash);
++#endif
+ index = hash_value % accel_hash->max_num_entries;
+
+ entry = accel_hash->hash_table[index];
+@@ -173,8 +185,14 @@ zend_accel_hash_entry* zend_accel_hash_find_entry(zend_accel_hash *accel_hash, c
+ zend_ulong hash_value;
+ zend_ulong index;
+ zend_accel_hash_entry *entry;
++#ifndef ZEND_WIN32
++ TSRMLS_FETCH();
++#endif
+
+ hash_value = zend_inline_hash_func(key, key_length);
++#ifndef ZEND_WIN32
++ hash_value ^= ZCG(root_hash);
++#endif
+ index = hash_value % accel_hash->max_num_entries;
+
+ entry = accel_hash->hash_table[index];
+@@ -198,8 +216,14 @@ int zend_accel_hash_unlink(zend_accel_hash *accel_hash, char *key, zend_uint key
+ zend_ulong hash_value;
+ zend_ulong index;
+ zend_accel_hash_entry *entry, *last_entry=NULL;
++#ifndef ZEND_WIN32
++ TSRMLS_FETCH();
++#endif
+
+ hash_value = zend_inline_hash_func(key, key_length);
++#ifndef ZEND_WIN32
++ hash_value ^= ZCG(root_hash);
++#endif
+ index = hash_value % accel_hash->max_num_entries;
+
+ entry = accel_hash->hash_table[index];
+diff --git a/ext/opcache/zend_accelerator_module.c b/ext/opcache/zend_accelerator_module.c
+--- a/ext/opcache/zend_accelerator_module.c
++++ b/ext/opcache/zend_accelerator_module.c
+@@ -251,6 +251,8 @@ ZEND_INI_BEGIN()
+ STD_PHP_INI_BOOLEAN("opcache.enable" , "1", PHP_INI_ALL, OnEnable, enabled , zend_accel_globals, accel_globals)
+ STD_PHP_INI_BOOLEAN("opcache.use_cwd" , "1", PHP_INI_SYSTEM, OnUpdateBool, accel_directives.use_cwd , zend_accel_globals, accel_globals)
+ STD_PHP_INI_BOOLEAN("opcache.validate_timestamps", "1", PHP_INI_ALL , OnUpdateBool, accel_directives.validate_timestamps, zend_accel_globals, accel_globals)
++ STD_PHP_INI_BOOLEAN("opcache.validate_permission", "0", PHP_INI_SYSTEM, OnUpdateBool, accel_directives.validate_permission, zend_accel_globals, accel_globals)
++ STD_PHP_INI_BOOLEAN("opcache.validate_root" , "0", PHP_INI_SYSTEM, OnUpdateBool, accel_directives.validate_root , zend_accel_globals, accel_globals)
+ STD_PHP_INI_BOOLEAN("opcache.inherited_hack" , "1", PHP_INI_SYSTEM, OnUpdateBool, accel_directives.inherited_hack , zend_accel_globals, accel_globals)
+ STD_PHP_INI_BOOLEAN("opcache.dups_fix" , "0", PHP_INI_ALL , OnUpdateBool, accel_directives.ignore_dups , zend_accel_globals, accel_globals)
+ STD_PHP_INI_BOOLEAN("opcache.revalidate_path" , "0", PHP_INI_ALL , OnUpdateBool, accel_directives.revalidate_path , zend_accel_globals, accel_globals)
+@@ -659,6 +661,8 @@ static ZEND_FUNCTION(opcache_get_configuration)
+ add_assoc_bool(directives, "opcache.enable_cli", ZCG(accel_directives).enable_cli);
+ add_assoc_bool(directives, "opcache.use_cwd", ZCG(accel_directives).use_cwd);
+ add_assoc_bool(directives, "opcache.validate_timestamps", ZCG(accel_directives).validate_timestamps);
++ add_assoc_bool(directives, "opcache.validate_permission", ZCG(accel_directives).validate_permission);
++ add_assoc_bool(directives, "opcache.validate_root", ZCG(accel_directives).validate_root);
+ add_assoc_bool(directives, "opcache.inherited_hack", ZCG(accel_directives).inherited_hack);
+ add_assoc_bool(directives, "opcache.dups_fix", ZCG(accel_directives).ignore_dups);
+ add_assoc_bool(directives, "opcache.revalidate_path", ZCG(accel_directives).revalidate_path);
diff --git a/php-bug70213.patch b/php-bug70213.patch
new file mode 100644
index 0000000..dd064c6
--- /dev/null
+++ b/php-bug70213.patch
@@ -0,0 +1,61 @@
+From a65ad951ad95944e357703caa2001f06a4225bf6 Mon Sep 17 00:00:00 2001
+From: Nikita Popov <nikic at php.net>
+Date: Sun, 1 Jan 2017 14:10:49 +0100
+Subject: [PATCH] FIx bug #70213
+
+Source: upstream https://github.com/php/php-src/commit/a65ad951ad (5.6.30); generated var_unserializer.c left out, %prep regenerates it
+---
+diff --git a/ext/standard/tests/serialize/bug70213.phpt b/ext/standard/tests/serialize/bug70213.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/standard/tests/serialize/bug70213.phpt
+@@ -0,0 +1,30 @@
++--TEST--
++Bug #70213: Unserialize context shared on double class lookup
++--FILE--
++<?php
++
++ini_set('unserialize_callback_func', 'evil');
++
++function evil() {
++ function __autoload($arg) {
++ var_dump(unserialize('R:1;'));
++ }
++}
++
++var_dump(unserialize('a:2:{i:0;i:42;i:1;O:4:"evil":0:{}}'));
++
++?>
++--EXPECTF--
++Notice: unserialize(): Error at offset 4 of 4 bytes in %s on line %d
++bool(false)
++
++Warning: unserialize(): Function evil() hasn't defined the class it was called for in %s on line %d
++array(2) {
++ [0]=>
++ int(42)
++ [1]=>
++ object(__PHP_Incomplete_Class)#1 (1) {
++ ["__PHP_Incomplete_Class_Name"]=>
++ string(4) "evil"
++ }
++}
+diff --git a/ext/standard/var_unserializer.re b/ext/standard/var_unserializer.re
+--- a/ext/standard/var_unserializer.re
++++ b/ext/standard/var_unserializer.re
+@@ -841,6 +841,7 @@ object ":" uiv ":" ["] {
+ }
+
+ /* The callback function may have defined the class */
++ BG(serialize_lock)++;
+ if (zend_lookup_class(class_name, len2, &pce TSRMLS_CC) == SUCCESS) {
+ ce = *pce;
+ } else {
+@@ -848,6 +849,7 @@ object ":" uiv ":" ["] {
+ incomplete_class = 1;
+ ce = PHP_IC_ENTRY;
+ }
++ BG(serialize_lock)--;
+
+ zval_ptr_dtor(&user_func);
+ zval_ptr_dtor(&arg_func_name);
diff --git a/php-bug70436.patch b/php-bug70436.patch
new file mode 100644
index 0000000..3186102
--- /dev/null
+++ b/php-bug70436.patch
@@ -0,0 +1,88 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Sun Aug 7 15:16:28 2016 -0700
+Subject: [PATCH] Fix bug #70436: Use After Free Vulnerability in unserialize()
+
+5.5 backport: https://github.com/shivammathur/php-src-backports/commit/6cb6d355a1849030f3ac75699a72ca1071cf04ed
+---
+diff --git a/ext/standard/tests/strings/bug70436.phpt b/ext/standard/tests/strings/bug70436.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/standard/tests/strings/bug70436.phpt
+@@ -0,0 +1,65 @@
++--TEST--
++Bug #70436: Use After Free Vulnerability in unserialize()
++--FILE--
++<?php
++
++class obj implements Serializable
++{
++ var $data;
++
++ function serialize()
++ {
++ return serialize($this->data);
++ }
++
++ function unserialize($data)
++ {
++ $this->data = unserialize($data);
++ }
++}
++
++$fakezval = ptr2str(1122334455);
++$fakezval .= ptr2str(0);
++$fakezval .= "\x00\x00\x00\x00";
++$fakezval .= "\x01";
++$fakezval .= "\x00";
++$fakezval .= "\x00\x00";
++
++$inner = 'C:3:"obj":3:{ryat';
++$exploit = 'a:4:{i:0;i:1;i:1;C:3:"obj":'.strlen($inner).':{'.$inner.'}i:2;s:'.strlen($fakezval).':"'.$fakezval.'";i:3;R:5;}';
++
++$data = unserialize($exploit);
++
++var_dump($data);
++
++function ptr2str($ptr)
++{
++ $out = '';
++
++ for ($i = 0; $i < 8; $i++) {
++ $out .= chr($ptr & 0xff);
++ $ptr >>= 8;
++ }
++
++ return $out;
++}
++?>
++DONE
++--EXPECTF--
++Notice: unserialize(): Error at offset 0 of 3 bytes in %sbug70436.php on line %d
++
++Notice: unserialize(): Error at offset 16 of 17 bytes in %sbug70436.php on line %d
++array(4) {
++ [0]=>
++ int(1)
++ [1]=>
++ object(obj)#%d (1) {
++ ["data"]=>
++ bool(false)
++ }
++ [2]=>
++ string(24) "%s"
++ [3]=>
++ bool(false)
++}
++DONE
+\ No newline at end of file
+diff --git a/ext/standard/var.c b/ext/standard/var.c
+--- a/ext/standard/var.c
++++ b/ext/standard/var.c
+@@ -965,6 +965,7 @@ PHP_FUNCTION(unserialize)
+ p = (const unsigned char*) buf;
+ PHP_VAR_UNSERIALIZE_INIT(var_hash);
+ if (!php_var_unserialize(&return_value, &p, p + buf_len, &var_hash TSRMLS_CC)) {
++ var_push_dtor(&var_hash, &return_value);
+ PHP_VAR_UNSERIALIZE_DESTROY(var_hash);
+ zval_dtor(return_value);
+ if (!EG(exception)) {
diff --git a/php-bug71882.patch b/php-bug71882.patch
new file mode 100644
index 0000000..9c74819
--- /dev/null
+++ b/php-bug71882.patch
@@ -0,0 +1,49 @@
+From 207dab585aadd9f320976a0895734d7d9ca7b862 Mon Sep 17 00:00:00 2001
+From: "Christoph M. Becker" <cmbecker69 at gmx.de>
+Date: Tue, 30 Aug 2016 01:53:27 +0200
+Subject: [PATCH] Fix #71882: Negative ftruncate() on php://memory exhausts
+ memory
+
+We must not pass negative sizes to a size_t parameter.
+
+From 314a9f8553625eec8f5cfc60360790533d786bc5 Mon Sep 17 00:00:00 2001
+From: "Christoph M. Becker" <cmbecker69 at gmx.de>
+Date: Wed, 31 Aug 2016 14:51:37 +0200
+Subject: [PATCH] Fix #71882 amendment: Negative ftruncate() on php://memory
+ exhausts memory
+
+To avoid BC breaks, we do not raise a warning for now.
+
+Source: upstream https://github.com/php/php-src/commit/207dab585a + amendment https://github.com/php/php-src/commit/314a9f8553 (5.6.26), test as in 5.6.40
+---
+diff --git a/ext/standard/file.c b/ext/standard/file.c
+--- a/ext/standard/file.c
++++ b/ext/standard/file.c
+@@ -1508,6 +1508,11 @@ PHP_NAMED_FUNCTION(php_if_ftruncate)
+ RETURN_FALSE;
+ }
+
++ if (size < 0) {
++ /* php_error_docref(NULL TSRMLS_CC, E_WARNING, "Negative size is not supported"); */
++ RETURN_FALSE;
++ }
++
+ PHP_STREAM_TO_ZVAL(stream, &fp);
+
+ if (!php_stream_truncate_supported(stream)) {
+diff --git a/ext/standard/tests/file/bug71882.phpt b/ext/standard/tests/file/bug71882.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/standard/tests/file/bug71882.phpt
+@@ -0,0 +1,11 @@
++--TEST--
++Bug #71882 (Negative ftruncate() on php://memory exhausts memory)
++--FILE--
++<?php
++$fd = fopen("php://memory", "w+");
++var_dump(ftruncate($fd, -1));
++?>
++==DONE==
++--EXPECTF--
++bool(false)
++==DONE==
diff --git a/php-bug71894.patch b/php-bug71894.patch
new file mode 100644
index 0000000..22fec89
--- /dev/null
+++ b/php-bug71894.patch
@@ -0,0 +1,92 @@
+From f67ccd4a7b8fb4b9e55796e69b152e2a899ba3cd Mon Sep 17 00:00:00 2001
+From: "Christoph M. Becker" <cmb at php.net>
+Date: Fri, 29 Jul 2016 00:24:46 +0200
+Subject: [PATCH] Fix #71894: AddressSanitizer: global-buffer-overflow in
+ zif_cal_from_jd
+
+Julian days < 347998 denote invalid Jewish calendar dates, so
+cal_from_jd($jd, CAL_JEWISH) and jdmonthname($jd, CAL_MONTH_JEWISH) should
+actually fail. For BC we don't yet let them though, but we fix the OOB read
+that happens in this case, and we also adjust cal_from_jd()'s return value
+to have empty strings for "abbrevdayname" and "dayname" instead of "Sun"/
+"Sunday" and NULL for "dow" instead of 0, which doesn't make any sense.
+
+Source: upstream https://github.com/php/php-src/commit/f67ccd4a7b (5.6.25)
+---
+diff --git a/ext/calendar/calendar.c b/ext/calendar/calendar.c
+--- a/ext/calendar/calendar.c
++++ b/ext/calendar/calendar.c
+@@ -416,15 +416,21 @@ PHP_FUNCTION(cal_from_jd)
+ add_assoc_long(return_value, "year", year);
+
+ /* day of week */
+- dow = DayOfWeek(jd);
+- add_assoc_long(return_value, "dow", dow);
+- add_assoc_string(return_value, "abbrevdayname", DayNameShort[dow], 1);
+- add_assoc_string(return_value, "dayname", DayNameLong[dow], 1);
++ if (cal != CAL_JEWISH || year > 0) {
++ dow = DayOfWeek(jd);
++ add_assoc_long(return_value, "dow", dow);
++ add_assoc_string(return_value, "abbrevdayname", DayNameShort[dow], 1);
++ add_assoc_string(return_value, "dayname", DayNameLong[dow], 1);
++ } else {
++ add_assoc_null(return_value, "dow");
++ add_assoc_string(return_value, "abbrevdayname", "", 1);
++ add_assoc_string(return_value, "dayname", "", 1);
++ }
+ /* month name */
+ if(cal == CAL_JEWISH) {
+ /* special case for Jewish calendar */
+- add_assoc_string(return_value, "abbrevmonth", JEWISH_MONTH_NAME(year)[month], 1);
+- add_assoc_string(return_value, "monthname", JEWISH_MONTH_NAME(year)[month], 1);
++ add_assoc_string(return_value, "abbrevmonth", (year > 0 ? JEWISH_MONTH_NAME(year)[month] : ""), 1);
++ add_assoc_string(return_value, "monthname", (year > 0 ? JEWISH_MONTH_NAME(year)[month] : ""), 1);
+ } else {
+ add_assoc_string(return_value, "abbrevmonth", calendar->month_name_short[month], 1);
+ add_assoc_string(return_value, "monthname", calendar->month_name_long[month], 1);
+@@ -737,7 +743,7 @@ PHP_FUNCTION(jdmonthname)
+ break;
+ case CAL_MONTH_JEWISH: /* jewish month */
+ SdnToJewish(julday, &year, &month, &day);
+- monthname = JEWISH_MONTH_NAME(year)[month];
++ monthname = (year > 0 ? JEWISH_MONTH_NAME(year)[month] : "");
+ break;
+ case CAL_MONTH_FRENCH: /* french month */
+ SdnToFrench(julday, &year, &month, &day);
+diff --git a/ext/calendar/tests/bug71894.phpt b/ext/calendar/tests/bug71894.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/calendar/tests/bug71894.phpt
+@@ -0,0 +1,32 @@
++--TEST--
++Bug #71894 (AddressSanitizer: global-buffer-overflow in zif_cal_from_jd)
++--SKIPIF--
++<?php
++if (!extension_loaded('calendar')) die('skip ext/calendar required');
++?>
++--FILE--
++<?php
++var_dump(cal_from_jd(347997, CAL_JEWISH));
++var_dump(jdmonthname(347997,CAL_MONTH_JEWISH));?>
++--EXPECT--
++array(9) {
++ ["date"]=>
++ string(5) "0/0/0"
++ ["month"]=>
++ int(0)
++ ["day"]=>
++ int(0)
++ ["year"]=>
++ int(0)
++ ["dow"]=>
++ NULL
++ ["abbrevdayname"]=>
++ string(0) ""
++ ["dayname"]=>
++ string(0) ""
++ ["abbrevmonth"]=>
++ string(0) ""
++ ["monthname"]=>
++ string(0) ""
++}
++string(0) ""
diff --git a/php-bug72085.patch b/php-bug72085.patch
new file mode 100644
index 0000000..17d35f3
--- /dev/null
+++ b/php-bug72085.patch
@@ -0,0 +1,102 @@
+From 1bb92d52121cf2635df163911216bf2958db4d34 Mon Sep 17 00:00:00 2001
+From: "Christoph M. Becker" <cmbecker69 at gmx.de>
+Date: Wed, 17 Aug 2016 00:41:31 +0200
+Subject: [PATCH] #72085: SEGV on unknown address zif_xml_parse
+
+We better make sure that the ZVALs we're accessing as arrays are indeed
+arrays.
+
+Source: upstream https://github.com/php/php-src/commit/1bb92d5212 (5.6.26)
+---
+diff --git a/ext/xml/tests/bug72085.phpt b/ext/xml/tests/bug72085.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/xml/tests/bug72085.phpt
+@@ -0,0 +1,74 @@
++--TEST--
++Bug #72085 (SEGV on unknown address zif_xml_parse)
++--SKIPIF--
++<?php
++if (!extension_loaded('xml')) die('skip xml extension not available');
++?>
++--FILE--
++<?php
++$var1 = xml_parser_create_ns();
++xml_set_element_handler($var1, new Exception(""), 4096);
++xml_parse($var1, str_repeat("<a>", 10));
++?>
++===DONE===
++--EXPECTF--
++Warning: Invalid callback exception 'Exception' in %s%ebug72085.php:%d
++Stack trace:
++#0 {main}, no array or string given in %s%ebug72085.php on line %d
++
++Warning: xml_parse(): Unable to call handler in %s%ebug72085.php on line %d
++
++Warning: Invalid callback exception 'Exception' in %s%ebug72085.php:%d
++Stack trace:
++#0 {main}, no array or string given in %s%ebug72085.php on line %d
++
++Warning: xml_parse(): Unable to call handler in %s%ebug72085.php on line %d
++
++Warning: Invalid callback exception 'Exception' in %s%ebug72085.php:%d
++Stack trace:
++#0 {main}, no array or string given in %s%ebug72085.php on line %d
++
++Warning: xml_parse(): Unable to call handler in %s%ebug72085.php on line %d
++
++Warning: Invalid callback exception 'Exception' in %s%ebug72085.php:%d
++Stack trace:
++#0 {main}, no array or string given in %s%ebug72085.php on line %d
++
++Warning: xml_parse(): Unable to call handler in %s%ebug72085.php on line %d
++
++Warning: Invalid callback exception 'Exception' in %s%ebug72085.php:%d
++Stack trace:
++#0 {main}, no array or string given in %s%ebug72085.php on line %d
++
++Warning: xml_parse(): Unable to call handler in %s%ebug72085.php on line %d
++
++Warning: Invalid callback exception 'Exception' in %s%ebug72085.php:%d
++Stack trace:
++#0 {main}, no array or string given in %s%ebug72085.php on line %d
++
++Warning: xml_parse(): Unable to call handler in %s%ebug72085.php on line %d
++
++Warning: Invalid callback exception 'Exception' in %s%ebug72085.php:%d
++Stack trace:
++#0 {main}, no array or string given in %s%ebug72085.php on line %d
++
++Warning: xml_parse(): Unable to call handler in %s%ebug72085.php on line %d
++
++Warning: Invalid callback exception 'Exception' in %s%ebug72085.php:%d
++Stack trace:
++#0 {main}, no array or string given in %s%ebug72085.php on line %d
++
++Warning: xml_parse(): Unable to call handler in %s%ebug72085.php on line %d
++
++Warning: Invalid callback exception 'Exception' in %s%ebug72085.php:%d
++Stack trace:
++#0 {main}, no array or string given in %s%ebug72085.php on line %d
++
++Warning: xml_parse(): Unable to call handler in %s%ebug72085.php on line %d
++
++Warning: Invalid callback exception 'Exception' in %s%ebug72085.php:%d
++Stack trace:
++#0 {main}, no array or string given in %s%ebug72085.php on line %d
++
++Warning: xml_parse(): Unable to call handler in %s%ebug72085.php on line %d
++===DONE===
+diff --git a/ext/xml/xml.c b/ext/xml/xml.c
+--- a/ext/xml/xml.c
++++ b/ext/xml/xml.c
+@@ -535,7 +535,8 @@ static zval *xml_call_handler(xml_parser *parser, zval *handler, zend_function *
+
+ if (Z_TYPE_P(handler) == IS_STRING) {
+ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to call handler %s()", Z_STRVAL_P(handler));
+- } else if (zend_hash_index_find(Z_ARRVAL_P(handler), 0, (void **) &obj) == SUCCESS &&
++ } else if (Z_TYPE_P(handler) == IS_ARRAY &&
++ zend_hash_index_find(Z_ARRVAL_P(handler), 0, (void **) &obj) == SUCCESS &&
+ zend_hash_index_find(Z_ARRVAL_P(handler), 1, (void **) &method) == SUCCESS &&
+ Z_TYPE_PP(obj) == IS_OBJECT &&
+ Z_TYPE_PP(method) == IS_STRING) {
diff --git a/php-bug72135.patch b/php-bug72135.patch
new file mode 100644
index 0000000..f8b8dce
--- /dev/null
+++ b/php-bug72135.patch
@@ -0,0 +1,20 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Sun May 15 23:26:51 2016 -0700
+Subject: [PATCH] Fix bug #72135 - don't create strings with lengths outside int range
+
+5.5 backport: https://github.com/shivammathur/php-src-backports/commit/d59f0aea3e2e0ebb0b4a97551d89dc9ad214fcd4
+---
+diff --git a/ext/standard/html.c b/ext/standard/html.c
+--- a/ext/standard/html.c
++++ b/ext/standard/html.c
+@@ -1449,6 +1449,10 @@ static void php_html_entities(INTERNAL_FUNCTION_PARAMETERS, int all)
+ }
+
+ replaced = php_escape_html_entities_ex(str, str_len, &new_len, all, (int) flags, hint_charset, double_encode TSRMLS_CC);
++ if (new_len > INT_MAX) {
++ efree(replaced);
++ RETURN_FALSE;
++ }
+ RETVAL_STRINGL(replaced, (int)new_len, 0);
+ }
+ /* }}} */
diff --git a/php-bug72142.patch b/php-bug72142.patch
new file mode 100644
index 0000000..382ef77
--- /dev/null
+++ b/php-bug72142.patch
@@ -0,0 +1,48 @@
+From e87ac688d5e700fdb56b37fda8b011d6b05b97fc Mon Sep 17 00:00:00 2001
+From: Nikita Popov <nikic at php.net>
+Date: Sat, 30 Jul 2016 15:10:54 +0200
+Subject: [PATCH] Fixed bug #72142
+
+Source: upstream https://github.com/php/php-src/commit/e87ac688d5 (5.6.25)
+---
+diff --git a/ext/wddx/tests/bug72142.phpt b/ext/wddx/tests/bug72142.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/wddx/tests/bug72142.phpt
+@@ -0,0 +1,13 @@
++--TEST--
++Bug #72142: WDDX Packet Injection Vulnerability in wddx_serialize_value()
++--FILE--
++<?php
++
++$wddx = wddx_serialize_value('', '</comment></header><data><struct><var name="php_class_name"><string>stdClass</string></var></struct></data></wddxPacket>');
++var_dump($wddx);
++var_dump(wddx_deserialize($wddx));
++
++?>
++--EXPECT--
++string(301) "<wddxPacket version='1.0'><header><comment></comment></header><data><struct><var name="php_class_name"><string>stdClass</string></var></struct></data></wddxPacket></comment></header><data><string></string></data></wddxPacket>"
++string(0) ""
+diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c
+--- a/ext/wddx/wddx.c
++++ b/ext/wddx/wddx.c
+@@ -374,11 +374,18 @@ void php_wddx_packet_start(wddx_packet *packet, char *comment, int comment_len)
+ {
+ php_wddx_add_chunk_static(packet, WDDX_PACKET_S);
+ if (comment) {
++ char *escaped;
++ size_t escaped_len;
++ escaped = php_escape_html_entities(
++ comment, comment_len, &escaped_len, 0, ENT_QUOTES, NULL TSRMLS_CC);
++
+ php_wddx_add_chunk_static(packet, WDDX_HEADER_S);
+ php_wddx_add_chunk_static(packet, WDDX_COMMENT_S);
+- php_wddx_add_chunk_ex(packet, comment, comment_len);
++ php_wddx_add_chunk_ex(packet, escaped, escaped_len);
+ php_wddx_add_chunk_static(packet, WDDX_COMMENT_E);
+ php_wddx_add_chunk_static(packet, WDDX_HEADER_E);
++
++ str_efree(escaped);
+ } else {
+ php_wddx_add_chunk_static(packet, WDDX_HEADER);
+ }
diff --git a/php-bug72293.patch b/php-bug72293.patch
new file mode 100644
index 0000000..71cd2c8
--- /dev/null
+++ b/php-bug72293.patch
@@ -0,0 +1,32 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Mon Sep 12 20:25:08 2016 -0700
+Subject: [PATCH] Fix bug #72293 - Heap overflow in mysqlnd related to BIT fields
+
+5.5 backport: https://github.com/shivammathur/php-src-backports/commit/f4815cd8c2e2e7668b009346fce4f1f2ba5e275e
+---
+diff --git a/ext/mysqlnd/mysqlnd_wireprotocol.c b/ext/mysqlnd/mysqlnd_wireprotocol.c
+--- a/ext/mysqlnd/mysqlnd_wireprotocol.c
++++ b/ext/mysqlnd/mysqlnd_wireprotocol.c
+@@ -1585,6 +1585,7 @@ php_mysqlnd_rowp_read_text_protocol(MYSQLND_MEMORY_POOL_CHUNK * row_buffer, zval
+ zend_uchar * p = row_buffer->ptr;
+ size_t data_size = row_buffer->app;
+ zend_uchar * bit_area = (zend_uchar*) row_buffer->ptr + data_size + 1; /* we allocate from here */
++ const zend_uchar * const packet_end = (zend_uchar*) row_buffer->ptr + data_size;
+
+ DBG_ENTER("php_mysqlnd_rowp_read_text_protocol");
+
+@@ -1606,8 +1607,13 @@ php_mysqlnd_rowp_read_text_protocol(MYSQLND_MEMORY_POOL_CHUNK * row_buffer, zval
+ /* Don't reverse the order. It is significant!*/
+ zend_uchar *this_field_len_pos = p;
+ /* php_mysqlnd_net_field_length() call should be after *this_field_len_pos = p; */
+- unsigned long len = php_mysqlnd_net_field_length(&p);
++ const unsigned long len = php_mysqlnd_net_field_length(&p);
+
++ if (len != MYSQLND_NULL_LENGTH && ((p + len) > packet_end)) {
++ php_error_docref(NULL, E_WARNING, "Malformed server packet. Field length pointing "MYSQLND_SZ_T_SPEC
++ " bytes after end of packet", (p + len) - packet_end - 1);
++ DBG_RETURN(FAIL);
++ }
+ if (current_field > start_field && last_field_was_string) {
+ /*
+ Normal queries:
diff --git a/php-bug72482.patch b/php-bug72482.patch
new file mode 100644
index 0000000..1e1e018
--- /dev/null
+++ b/php-bug72482.patch
@@ -0,0 +1,229 @@
+From: Christoph M. Becker <cmbecker69 at gmx.de>
+Date: Tue Oct 25 15:14:22 2016 +0200
+Subject: [PATCH] Fix #72482: Ilegal write/read access caused by gdImageAALine overflow
+
+Instead of rolling our own bounds check we use clip_1d() as it's done
+in gdImageLine() and in external libgd. We must not pass the image
+width and height, respectively, but rather the largest ordinate value
+that is allowed to be accessed, i.e. width-1 and height-1,
+respectively.
+
+Upstream: https://github.com/php/php-src/commit/6499581af76cfe986e12330faabb3a7c36d45ffc
+
+5.5 backport: https://github.com/shivammathur/php-src-backports/commit/1f961ff71b795890c1f49202cd6581f23421b6b3
+Binary test fixtures not included: ext/gd/tests/bug72482_2.png
+---
+diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c
+--- a/ext/gd/libgd/gd.c
++++ b/ext/gd/libgd/gd.c
+@@ -1115,7 +1115,7 @@ void gdImageLine (gdImagePtr im, int x1, int y1, int x2, int y2, int color)
+ }
+
+ /* 2.0.10: Nick Atty: clip to edges of drawing rectangle, return if no points need to be drawn */
+- if (!clip_1d(&x1,&y1,&x2,&y2,gdImageSX(im)) || !clip_1d(&y1,&x1,&y2,&x2,gdImageSY(im))) {
++ if (!clip_1d(&x1,&y1,&x2,&y2,gdImageSX(im)-1) || !clip_1d(&y1,&x1,&y2,&x2,gdImageSY(im)-1)) {
+ return;
+ }
+
+@@ -1299,55 +1299,10 @@ void gdImageAALine (gdImagePtr im, int x1, int y1, int x2, int y2, int col)
+ long x, y, inc;
+ long dx, dy,tmp;
+
+- if (y1 < 0 && y2 < 0) {
+- return;
+- }
+- if (y1 < 0) {
+- x1 += (y1 * (x1 - x2)) / (y2 - y1);
+- y1 = 0;
+- }
+- if (y2 < 0) {
+- x2 += (y2 * (x1 - x2)) / (y2 - y1);
+- y2 = 0;
+- }
+-
+- /* bottom edge */
+- if (y1 >= im->sy && y2 >= im->sy) {
+- return;
+- }
+- if (y1 >= im->sy) {
+- x1 -= ((im->sy - y1) * (x1 - x2)) / (y2 - y1);
+- y1 = im->sy - 1;
+- }
+- if (y2 >= im->sy) {
+- x2 -= ((im->sy - y2) * (x1 - x2)) / (y2 - y1);
+- y2 = im->sy - 1;
+- }
+-
+- /* left edge */
+- if (x1 < 0 && x2 < 0) {
+- return;
+- }
+- if (x1 < 0) {
+- y1 += (x1 * (y1 - y2)) / (x2 - x1);
+- x1 = 0;
+- }
+- if (x2 < 0) {
+- y2 += (x2 * (y1 - y2)) / (x2 - x1);
+- x2 = 0;
+- }
+- /* right edge */
+- if (x1 >= im->sx && x2 >= im->sx) {
++ /* 2.0.10: Nick Atty: clip to edges of drawing rectangle, return if no points need to be drawn */
++ if (!clip_1d(&x1,&y1,&x2,&y2,gdImageSX(im)-1) || !clip_1d(&y1,&x1,&y2,&x2,gdImageSY(im)-1)) {
+ return;
+ }
+- if (x1 >= im->sx) {
+- y1 -= ((im->sx - x1) * (y1 - y2)) / (x2 - x1);
+- x1 = im->sx - 1;
+- }
+- if (x2 >= im->sx) {
+- y2 -= ((im->sx - x2) * (y1 - y2)) / (x2 - x1);
+- x2 = im->sx - 1;
+- }
+
+ dx = x2 - x1;
+ dy = y2 - y1;
+diff --git a/ext/gd/tests/bug72482.phpt b/ext/gd/tests/bug72482.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/gd/tests/bug72482.phpt
+@@ -0,0 +1,19 @@
++--TEST--
++Bug #72482 (Ilegal write/read access caused by gdImageAALine overflow)
++--SKIPIF--
++<?php
++if (!extension_loaded('gd')) die('skip gd extension not available');
++?>
++--FILE--
++<?php
++$img = imagecreatetruecolor(13, 1007);
++imageantialias($img, true);
++imageline($img, 0, 0, 1073745919, 1073745919, 4096);
++
++$img = imagecreatetruecolor(100, 100);
++imageantialias($img, true);
++imageline($img, 1094795585, 0, 2147483647, 255, 0xff);
++?>
++===DONE===
++--EXPECT--
++===DONE===
+diff --git a/ext/gd/tests/bug72482_2.phpt b/ext/gd/tests/bug72482_2.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/gd/tests/bug72482_2.phpt
+@@ -0,0 +1,21 @@
++--TEST--
++Bug 72482 (Ilegal write/read access caused by gdImageAALine overflow)
++--SKIPIF--
++<?php
++if (!extension_loaded('gd')) die('skip gd extension not available');
++?>
++--FILE--
++<?php
++require_once __DIR__ . DIRECTORY_SEPARATOR . 'func.inc';
++
++$im = imagecreatetruecolor(10, 10);
++imagefilledrectangle($im, 0, 0, 9, 9, imagecolorallocate($im, 255, 255, 255));
++imageantialias($im, true);
++imageline($im, 0, 0, 10, 10, imagecolorallocate($im, 0, 0, 0));
++
++test_image_equals_file(__DIR__ . DIRECTORY_SEPARATOR . 'bug72482_2.png', $im);
++?>
++===DONE===
++--EXPECT--
++The images are equal.
++===DONE===
+diff --git a/ext/gd/tests/func.inc b/ext/gd/tests/func.inc
+--- a/ext/gd/tests/func.inc
++++ b/ext/gd/tests/func.inc
+@@ -59,3 +59,90 @@ function get_libxpm_version()
+ return $version;
+ }
+
++/**
++ * Tests that an in-memory image equals a PNG file.
++ *
++ * It checks for equal image sizes, and whether any pixels are different.
++ * The textual result is printed, so the EXPECT section should contain the line
++ * "The images are equal."
++ *
++ * If the PNG file does not exists, or the images are not equal, a diagnostic
++ * message is printed, and the actual file is stored right beside the temporary
++ * .php test file with the extension .out.png, to be able to manually inspect
++ * the result.
++ *
++ * @param string $filename
++ * @param resource $actual
++ * @return void
++ */
++function test_image_equals_file($filename, $actual)
++{
++ if (!file_exists($filename)) {
++ echo "The expected image does not exist.\n";
++ save_actual_image($actual);
++ return;
++ }
++ $actual = test_to_truecolor($actual);
++ $expected = imagecreatefrompng($filename);
++ $expected = test_to_truecolor($expected);
++ $exp_x = imagesx($expected);
++ $exp_y = imagesy($expected);
++ $act_x = imagesx($actual);
++ $act_y = imagesy($actual);
++ if ($exp_x != $act_x || $exp_y != $act_y) {
++ echo "The image size differs: expected {$exp_x}x{$exp_y}, got {$act_x}x{$act_y}.\n";
++ save_actual_image($actual);
++ return;
++ }
++ $pixels_changed = 0;
++ for ($y = 0; $y < $exp_y; $y++) {
++ for ($x = 0; $x < $exp_x; $x ++) {
++ $exp_c = imagecolorat($expected, $x, $y);
++ $act_c = imagecolorat($actual, $x, $y);
++ if ($exp_c != $act_c) {
++ $pixels_changed++;
++ }
++ }
++ }
++ if (!$pixels_changed) {
++ echo "The images are equal.\n";
++ } else {
++ echo "The images differ in {$pixels_changed} pixels.\n";
++ save_actual_image($actual);
++ }
++}
++
++/**
++ * Returns the truecolor version of an image.
++ *
++ * @param resource $image
++ * @return resource
++ */
++function test_to_truecolor($image)
++{
++ if (imageistruecolor($image)) {
++ return $image;
++ } else {
++ $width = imagesx($image);
++ $height = imagesy($image);
++ $result = imagecreatetruecolor($width, $height);
++ imagecopy($result, $image, 0,0, 0,0, $width, $height);
++ return $result;
++ }
++}
++
++/**
++ * Saves an actual image to disk.
++ *
++ * The image is saved right beside the temporary .php test file with the
++ * extension .out.png.
++ *
++ * @param resource $image
++ * @return void
++ */
++function save_actual_image($image)
++{
++ $pathinfo = pathinfo($_SERVER['SCRIPT_FILENAME']);
++ $filename = "{$pathinfo['dirname']}/{$pathinfo['filename']}.out.png";
++ imagepng($image, $filename);
++}
diff --git a/php-bug72494.patch b/php-bug72494.patch
new file mode 100644
index 0000000..cf2c634
--- /dev/null
+++ b/php-bug72494.patch
@@ -0,0 +1,60 @@
+From cd13d0260a9327af541176235e76cdef8af3a27a Mon Sep 17 00:00:00 2001
+From: "Christoph M. Becker" <cmbecker69 at gmx.de>
+Date: Tue, 25 Oct 2016 14:19:36 +0200
+Subject: [PATCH] Fix #72494: imagecropauto out-of-bounds access
+
+This issue has actually already been fixed with commit 46f2c690. We're
+adding a regression test and a NEWS entry, and also port the fix in
+gdImageCropThreshold() from libgd:
+ * <https://github.com/libgd/libgd/commit/b347e034>
+ * <https://github.com/libgd/libgd/commit/46f2c690>
+
+Source: CVE-2016-6128; upstream https://github.com/php/php-src/commit/cd13d0260a (5.6.25)
+PLD: with the imagecropauto() range check and warning in ext/gd/gd.c as in 5.6.40
+---
+diff --git a/ext/gd/gd.c b/ext/gd/gd.c
+--- a/ext/gd/gd.c
++++ b/ext/gd/gd.c
+@@ -5082,7 +5082,7 @@ PHP_FUNCTION(imagecropauto)
+ break;
+
+ case GD_CROP_THRESHOLD:
+- if (color < 0) {
++ if (color < 0 || (!gdImageTrueColor(im) && color >= gdImageColorsTotal(im))) {
+ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Color argument missing with threshold mode");
+ RETURN_FALSE;
+ }
+diff --git a/ext/gd/libgd/gd_crop.c b/ext/gd/libgd/gd_crop.c
+--- a/ext/gd/libgd/gd_crop.c
++++ b/ext/gd/libgd/gd_crop.c
+@@ -243,6 +243,10 @@ gdImagePtr gdImageCropThreshold(gdImagePtr im, const unsigned int color, const f
+ return NULL;
+ }
+
++ if (!gdImageTrueColor(im) && color >= gdImageColorsTotal(im)) {
++ return NULL;
++ }
++
+ /* TODO: Add gdImageGetRowPtr and works with ptr at the row level
+ * for the true color and palette images
+ * new formats will simply work with ptr
+diff --git a/ext/gd/tests/bug72494.phpt b/ext/gd/tests/bug72494.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/gd/tests/bug72494.phpt
+@@ -0,0 +1,15 @@
++--TEST--
++Bug #72494 (imagecropauto out-of-bounds access)
++--SKIPIF--
++<?php
++if (!extension_loaded('gd')) die('skip gd extension not available');
++?>
++--FILE--
++<?php
++$im = imagecreate(10,10);
++imagecropauto($im, IMG_CROP_THRESHOLD, 0, 1337);
++?>
++===DONE===
++--EXPECTF--
++Warning: imagecropauto(): Color argument missing with threshold mode in %s on line %d
++===DONE===
diff --git a/php-bug72535.patch b/php-bug72535.patch
new file mode 100644
index 0000000..a5859bd
--- /dev/null
+++ b/php-bug72535.patch
@@ -0,0 +1,46 @@
+From: Anatol Belski <ab at php.net>
+Date: Tue Oct 24 13:59:18 2017 +0200
+Subject: [PATCH] Fixed bug #72535 arcfour encryption stream filter crashes php
+
+5.5 backport: https://github.com/shivammathur/php-src-backports/commit/73a76f29d1cfaeeef83ef20bb77b34b251f43836
+---
+diff --git a/ext/mcrypt/mcrypt_filter.c b/ext/mcrypt/mcrypt_filter.c
+--- a/ext/mcrypt/mcrypt_filter.c
++++ b/ext/mcrypt/mcrypt_filter.c
+@@ -89,7 +89,7 @@ static php_stream_filter_status_t php_mcrypt_filter(
+ php_stream_bucket_delref(bucket TSRMLS_CC);
+ } else {
+ /* Stream cipher */
+- php_stream_bucket_make_writeable(bucket TSRMLS_CC);
++ bucket = php_stream_bucket_make_writeable(bucket TSRMLS_CC);
+ if (data->encrypt) {
+ mcrypt_generic(data->module, bucket->buf, bucket->buflen);
+ } else {
+diff --git a/ext/mcrypt/tests/bug72535.phpt b/ext/mcrypt/tests/bug72535.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/mcrypt/tests/bug72535.phpt
+@@ -0,0 +1,23 @@
++--TEST--
++Bug #72535 arcfour encryption stream filter crashes php
++--SKIPIF--
++<?php if (!extension_loaded("mcrypt")) print "skip"; ?>
++--FILE--
++<?php
++$passphrase = 'My secret';
++$plaintext = 'Secret secret secret data';
++
++$iv = substr(md5('iv' . $passphrase, true), 0, 8);
++$key = substr(md5('pass1' . $passphrase, true) .
++ md5('pass2' . $passphrase, true), 0, 24);
++$opts = array('iv' => $iv, 'key' => $key, 'mode' => 'stream');
++
++$expected = substr($plaintext . $plaintext, 0, 48);
++
++$fp = fopen('php://memory', 'wb+');
++stream_filter_append($fp, 'mcrypt.arcfour', STREAM_FILTER_WRITE, $opts);
++fwrite($fp, $plaintext);
++?>
++==NOCRASH==
++--EXPECT--
++==NOCRASH==
diff --git a/php-bug72627.patch b/php-bug72627.patch
new file mode 100644
index 0000000..6c40dea
--- /dev/null
+++ b/php-bug72627.patch
@@ -0,0 +1,99 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Mon Aug 8 00:49:34 2016 -0700
+Subject: [PATCH] Fixed bug #72627: Memory Leakage In exif_process_IFD_in_TIFF
+
+5.5 backport: https://github.com/shivammathur/php-src-backports/commit/e25449539623f6f3abb971e1aa5e9247d0e220dc
+Binary test fixtures not included: ext/exif/tests/bug72627.tiff
+---
+diff --git a/ext/exif/exif.c b/ext/exif/exif.c
+--- a/ext/exif/exif.c
++++ b/ext/exif/exif.c
+@@ -3768,8 +3768,11 @@ static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offse
+ fgot = php_stream_read(ImageInfo->infile, ImageInfo->Thumbnail.data, ImageInfo->Thumbnail.size);
+ if (fgot < ImageInfo->Thumbnail.size) {
+ EXIF_ERRLOG_THUMBEOF(ImageInfo)
++ efree(ImageInfo->Thumbnail.data);
++ ImageInfo->Thumbnail.data = NULL;
++ } else {
++ exif_thumbnail_build(ImageInfo TSRMLS_CC);
+ }
+- exif_thumbnail_build(ImageInfo TSRMLS_CC);
+ }
+ #ifdef EXIF_DEBUG
+ exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_NOTICE, "Read next IFD (THUMBNAIL) done");
+diff --git a/ext/exif/tests/bug72627.phpt b/ext/exif/tests/bug72627.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/exif/tests/bug72627.phpt
+@@ -0,0 +1,71 @@
++--TEST--
++Bug #72627 (Memory Leakage In exif_process_IFD_in_TIFF)
++--SKIPIF--
++<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
++--FILE--
++<?php
++ $exif = exif_read_data(__DIR__ . '/bug72627.tiff',0,0,true);
++ var_dump($exif);
++?>
++--EXPECTF--
++Warning: exif_read_data(%s): Thumbnail goes IFD boundary or end of file reached in %sbug72627.php on line %d
++
++Warning: exif_read_data(%s): Error in TIFF: filesize(x04E2) less than start of IFD dir(x829A0004) in %sbug72627.php on line %d
++
++Warning: exif_read_data(%s): Thumbnail goes IFD boundary or end of file reached in %sbug72627.php on line %d
++array(11) {
++ ["FileName"]=>
++ string(13) "bug72627.tiff"
++ ["FileDateTime"]=>
++ int(%d)
++ ["FileSize"]=>
++ int(1250)
++ ["FileType"]=>
++ int(7)
++ ["MimeType"]=>
++ string(10) "image/tiff"
++ ["SectionsFound"]=>
++ string(30) "ANY_TAG, IFD0, THUMBNAIL, EXIF"
++ ["COMPUTED"]=>
++ array(10) {
++ ["html"]=>
++ string(24) "width="128" height="132""
++ ["Height"]=>
++ int(132)
++ ["Width"]=>
++ int(128)
++ ["IsColor"]=>
++ int(0)
++ ["ByteOrderMotorola"]=>
++ int(0)
++ ["ApertureFNumber"]=>
++ string(5) "f/1.0"
++ ["Thumbnail.FileType"]=>
++ int(2)
++ ["Thumbnail.MimeType"]=>
++ string(10) "image/jpeg"
++ ["Thumbnail.Height"]=>
++ int(132)
++ ["Thumbnail.Width"]=>
++ int(128)
++ }
++ ["XResolution"]=>
++ string(21) "1414812756/1414812756"
++ ["THUMBNAIL"]=>
++ array(5) {
++ ["ImageWidth"]=>
++ int(128)
++ ["ImageLength"]=>
++ int(132)
++ ["JPEGInterchangeFormat"]=>
++ int(1280)
++ ["JPEGInterchangeFormatLength"]=>
++ int(100)
++ ["THUMBNAIL"]=>
++ NULL
++ }
++ ["ExposureTime"]=>
++ string(21) "1414812756/1414812756"
++ ["FNumber"]=>
++ string(21) "1414812756/1414812756"
++}
diff --git a/php-bug72663.patch b/php-bug72663.patch
new file mode 100644
index 0000000..20e9a63
--- /dev/null
+++ b/php-bug72663.patch
@@ -0,0 +1,103 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Tue Aug 2 01:08:42 2016 -0700
+Subject: [PATCH] Fix bug #72663 - destroy broken object when unserializing
+
+5.5 backport: https://github.com/shivammathur/php-src-backports/commit/0a752c635dc58c30481030ed6626590efe991d14
+---
+diff --git a/ext/standard/tests/strings/bug72663.phpt b/ext/standard/tests/strings/bug72663.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/standard/tests/strings/bug72663.phpt
+@@ -0,0 +1,26 @@
++--TEST--
++Bug #72663: Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization
++--FILE--
++<?php
++class obj implements Serializable {
++ var $data;
++ function serialize() {
++ return serialize($this->data);
++ }
++ function unserialize($data) {
++ $this->data = unserialize($data);
++ }
++}
++
++$inner = 'a:1:{i:0;O:9:"Exception":2:{s:7:"'."\0".'*'."\0".'file";R:4;}';
++$exploit = 'a:2:{i:0;C:3:"obj":'.strlen($inner).':{'.$inner.'}i:1;R:4;}';
++
++$data = unserialize($exploit);
++echo $data[1];
++?>
++DONE
++--EXPECTF--
++Notice: unserialize(): Unexpected end of serialized data in %sbug72663.php on line %d
++
++Notice: unserialize(): Error at offset 46 of 47 bytes in %sbug72663.php on line %d
++DONE
+\ No newline at end of file
+diff --git a/ext/standard/tests/strings/bug72663_2.phpt b/ext/standard/tests/strings/bug72663_2.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/standard/tests/strings/bug72663_2.phpt
+@@ -0,0 +1,17 @@
++--TEST--
++Bug #72663: Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization
++--FILE--
++<?php
++
++ini_set('session.serialize_handler', 'php_serialize');
++session_start();
++$sess = 'O:9:"Exception":2:{s:7:"'."\0".'*'."\0".'file";R:1;}';
++session_decode($sess);
++var_dump($_SESSION);
++?>
++DONE
++--EXPECTF--
++Notice: session_decode(): Unexpected end of serialized data in %sbug72663_2.php on line %d
++array(0) {
++}
++DONE
+\ No newline at end of file
+diff --git a/ext/standard/tests/strings/bug72663_3.phpt b/ext/standard/tests/strings/bug72663_3.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/standard/tests/strings/bug72663_3.phpt
+@@ -0,0 +1,18 @@
++--TEST--
++Bug #72663: Create an Unexpected Object and Don't Invoke __wakeup() in Deserialization
++--FILE--
++<?php
++class obj {
++ var $ryat;
++ function __wakeup() {
++ $this->ryat = str_repeat('A', 0x112);
++ }
++}
++
++$poc = 'O:8:"stdClass":1:{i:0;O:3:"obj":1:{s:4:"ryat";R:1;';
++unserialize($poc);
++?>
++DONE
++--EXPECTF--
++Notice: unserialize(): Error at offset 50 of 50 bytes in %sbug72663_3.php on line %d
++DONE
+diff --git a/ext/standard/var_unserializer.re b/ext/standard/var_unserializer.re
+--- a/ext/standard/var_unserializer.re
++++ b/ext/standard/var_unserializer.re
+@@ -443,6 +443,15 @@ static inline int object_common2(UNSERIALIZE_PARAMETER, long elements)
+ }
+
+ if (!process_nested_data(UNSERIALIZE_PASSTHRU, Z_OBJPROP_PP(rval), elements, 1)) {
++ /* We've got partially constructed object on our hands here. Wipe it. */
++ if(Z_TYPE_PP(rval) == IS_OBJECT) {
++ zend_hash_clean(Z_OBJPROP_PP(rval));
++ }
++ ZVAL_NULL(*rval);
++ return 0;
++ }
++
++ if (Z_TYPE_PP(rval) != IS_OBJECT) {
+ return 0;
+ }
+
diff --git a/php-bug72681.patch b/php-bug72681.patch
new file mode 100644
index 0000000..b1aca66
--- /dev/null
+++ b/php-bug72681.patch
@@ -0,0 +1,121 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Wed Aug 3 00:30:12 2016 -0700
+Subject: [PATCH] Fix bug #72681 - consume data even if we're not storing them
+
+5.5 backport: https://github.com/shivammathur/php-src-backports/commit/1caa6c49d9dc2fb50c6a74d7b85d3d3628e0b3cc
+---
+diff --git a/ext/session/session.c b/ext/session/session.c
+--- a/ext/session/session.c
++++ b/ext/session/session.c
+@@ -923,11 +923,13 @@ PS_SERIALIZER_DECODE_FUNC(php_binary) /* {{{ */
+ int namelen;
+ int has_value;
+ php_unserialize_data_t var_hash;
++ int skip = 0;
+
+ PHP_VAR_UNSERIALIZE_INIT(var_hash);
+
+ for (p = val; p < endptr; ) {
+ zval **tmp;
++ skip = 0;
+ namelen = ((unsigned char)(*p)) & (~PS_BIN_UNDEF);
+
+ if (namelen < 0 || namelen > PS_BIN_MAX || (p + namelen) >= endptr) {
+@@ -943,22 +945,25 @@ PS_SERIALIZER_DECODE_FUNC(php_binary) /* {{{ */
+
+ if (zend_hash_find(&EG(symbol_table), name, namelen + 1, (void **) &tmp) == SUCCESS) {
+ if ((Z_TYPE_PP(tmp) == IS_ARRAY && Z_ARRVAL_PP(tmp) == &EG(symbol_table)) || *tmp == PS(http_session_vars)) {
+- efree(name);
+- continue;
++ skip = 1;
+ }
+ }
+
+ if (has_value) {
+ ALLOC_INIT_ZVAL(current);
+ if (php_var_unserialize(¤t, (const unsigned char **) &p, (const unsigned char *) endptr, &var_hash TSRMLS_CC)) {
+- php_set_session_var(name, namelen, current, &var_hash TSRMLS_CC);
++ if (!skip) {
++ php_set_session_var(name, namelen, current, &var_hash TSRMLS_CC);
++ }
+ } else {
+ PHP_VAR_UNSERIALIZE_DESTROY(var_hash);
+ return FAILURE;
+ }
+ var_push_dtor_no_addref(&var_hash, ¤t);
+ }
+- PS_ADD_VARL(name, namelen);
++ if (!skip) {
++ PS_ADD_VARL(name, namelen);
++ }
+ efree(name);
+ }
+
+@@ -1015,6 +1020,7 @@ PS_SERIALIZER_DECODE_FUNC(php) /* {{{ */
+ int namelen;
+ int has_value;
+ php_unserialize_data_t var_hash;
++ int skip = 0;
+
+ PHP_VAR_UNSERIALIZE_INIT(var_hash);
+
+@@ -1022,6 +1028,7 @@ PS_SERIALIZER_DECODE_FUNC(php) /* {{{ */
+
+ while (p < endptr) {
+ zval **tmp;
++ skip = 0;
+ q = p;
+ while (*q != PS_DELIMITER) {
+ if (++q >= endptr) goto break_outer_loop;
+@@ -1039,14 +1046,16 @@ PS_SERIALIZER_DECODE_FUNC(php) /* {{{ */
+
+ if (zend_hash_find(&EG(symbol_table), name, namelen + 1, (void **) &tmp) == SUCCESS) {
+ if ((Z_TYPE_PP(tmp) == IS_ARRAY && Z_ARRVAL_PP(tmp) == &EG(symbol_table)) || *tmp == PS(http_session_vars)) {
+- goto skip;
++ skip = 1;
+ }
+ }
+
+ if (has_value) {
+ ALLOC_INIT_ZVAL(current);
+ if (php_var_unserialize(¤t, (const unsigned char **) &q, (const unsigned char *) endptr, &var_hash TSRMLS_CC)) {
+- php_set_session_var(name, namelen, current, &var_hash TSRMLS_CC);
++ if (!skip) {
++ php_set_session_var(name, namelen, current, &var_hash TSRMLS_CC);
++ }
+ } else {
+ var_push_dtor_no_addref(&var_hash, ¤t);
+ efree(name);
+@@ -1055,8 +1064,9 @@ PS_SERIALIZER_DECODE_FUNC(php) /* {{{ */
+ }
+ var_push_dtor_no_addref(&var_hash, ¤t);
+ }
+- PS_ADD_VARL(name, namelen);
+-skip:
++ if (!skip) {
++ PS_ADD_VARL(name, namelen);
++ }
+ efree(name);
+
+ p = q;
+diff --git a/ext/session/tests/bug72681.phpt b/ext/session/tests/bug72681.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/session/tests/bug72681.phpt
+@@ -0,0 +1,16 @@
++--TEST--
++Bug #72681: PHP Session Data Injection Vulnerability
++--SKIPIF--
++<?php include('skipif.inc'); ?>
++--FILE--
++<?php
++ini_set('session.serialize_handler', 'php');
++session_start();
++$_SESSION['_SESSION'] = 'ryat|O:8:"stdClass":0:{}';
++session_write_close();
++session_start();
++var_dump($_SESSION);
++?>
++--EXPECT--
++array(0) {
++}
diff --git a/php-bug72682.patch b/php-bug72682.patch
new file mode 100644
index 0000000..92178db
--- /dev/null
+++ b/php-bug72682.patch
@@ -0,0 +1,40 @@
+From: Kalle Sommer Nielsen <kalle at php.net>
+Date: Wed Aug 3 17:33:18 2016 +0200
+Subject: [PATCH] Fixed bug #72682 (exif_read_data() fails to read all data for some images)
+
+This is fixed by adding DJI signatures to the MAKERNOTE and its supported tags, list is credits to ExifTool documentation.
+
+5.5 backport: https://github.com/shivammathur/php-src-backports/commit/c5c54656b46b94e0e38ad2b3c7101b792927405e
+---
+diff --git a/ext/exif/exif.c b/ext/exif/exif.c
+--- a/ext/exif/exif.c
++++ b/ext/exif/exif.c
+@@ -971,6 +971,20 @@ static tag_info_array tag_table_VND_OLYMPUS = {
+ TAG_TABLE_END
+ };
+
++static tag_info_array tag_table_VND_DJI = {
++ { 0x0001, "Make"},
++ { 0x0003, "SpeedX"},
++ { 0x0004, "SpeedY"},
++ { 0x0005, "SpeedZ"},
++ { 0x0006, "Pitch"},
++ { 0x0007, "Yaw"},
++ { 0x0008, "Roll"},
++ { 0x0009, "CameraPitch"},
++ { 0x000a, "CameraYaw"},
++ { 0x000b, "CameraRoll"},
++ TAG_TABLE_END
++};
++
+ typedef enum mn_byte_order_t {
+ MN_ORDER_INTEL = 0,
+ MN_ORDER_MOTOROLA = 1,
+@@ -1002,6 +1016,7 @@ static const maker_note_type maker_note_array[] = {
+ { tag_table_VND_NIKON, "NIKON", NULL, "Nikon\x00\x01\x00", 8, 8, MN_ORDER_NORMAL, MN_OFFSET_NORMAL},
+ { tag_table_VND_NIKON_990, "NIKON", NULL, NULL, 0, 0, MN_ORDER_NORMAL, MN_OFFSET_NORMAL},
+ { tag_table_VND_OLYMPUS, "OLYMPUS OPTICAL CO.,LTD", NULL, "OLYMP\x00\x01\x00", 8, 8, MN_ORDER_NORMAL, MN_OFFSET_NORMAL},
++ { tag_table_VND_DJI, "DJI", NULL, NULL, 0, 0, MN_ORDER_NORMAL, MN_OFFSET_NORMAL}
+ };
+ /* }}} */
+
diff --git a/php-bug72696.patch b/php-bug72696.patch
new file mode 100644
index 0000000..ed4dd96
--- /dev/null
+++ b/php-bug72696.patch
@@ -0,0 +1,43 @@
+From: Christoph M. Becker <cmbecker69 at gmx.de>
+Date: Tue Oct 25 13:23:16 2016 +0200
+Subject: [PATCH] Fix #72696: imagefilltoborder stackoverflow on truecolor images
+
+We must not allow negative color values be passed to
+gdImageFillToBorder(), because that can lead to infinite recursion
+since the recursion termination condition will not necessarily be met.
+
+Upstream: https://github.com/php/php-src/commit/863d37ea66d5c960db08d6f4a2cbd2518f0f80d1
+
+5.5 backport: https://github.com/shivammathur/php-src-backports/commit/109a23e7b96ae81416568d76eaaf57314cb4df3d
+---
+diff --git a/ext/gd/libgd/gd.c b/ext/gd/libgd/gd.c
+--- a/ext/gd/libgd/gd.c
++++ b/ext/gd/libgd/gd.c
+@@ -1726,7 +1726,7 @@ void gdImageFillToBorder (gdImagePtr im, int x, int y, int border, int color)
+ int leftLimit = -1, rightLimit;
+ int i, restoreAlphaBlending = 0;
+
+- if (border < 0) {
++ if (border < 0 || color < 0) {
+ /* Refuse to fill to a non-solid border */
+ return;
+ }
+diff --git a/ext/gd/tests/bug72696.phpt b/ext/gd/tests/bug72696.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/gd/tests/bug72696.phpt
+@@ -0,0 +1,14 @@
++--TEST--
++Bug #72696 (imagefilltoborder stackoverflow on truecolor images)
++--SKIPIF--
++<?php
++if (!extension_loaded('gd')) die('skip gd extension not available');
++?>
++--FILE--
++<?php
++$im = imagecreatetruecolor(10, 10);
++imagefilltoborder($im, 0, 0, 1, -2);
++?>
++===DONE===
++--EXPECT--
++===DONE===
diff --git a/php-bug72697.patch b/php-bug72697.patch
new file mode 100644
index 0000000..0305a5e
--- /dev/null
+++ b/php-bug72697.patch
@@ -0,0 +1,70 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Wed Aug 10 00:00:14 2016 -0700
+Subject: [PATCH] Fix bug#72697 - select_colors write out-of-bounds
+
+5.5 backport: https://github.com/shivammathur/php-src-backports/commit/97c0d6c3a6042304742e94800746071207bccd5b
+---
+diff --git a/ext/gd/gd.c b/ext/gd/gd.c
+--- a/ext/gd/gd.c
++++ b/ext/gd/gd.c
+@@ -1615,11 +1615,11 @@ PHP_FUNCTION(imagetruecolortopalette)
+
+ ZEND_FETCH_RESOURCE(im, gdImagePtr, &IM, -1, "Image", le_gd);
+
+- if (ncolors <= 0) {
+- php_error_docref(NULL TSRMLS_CC, E_WARNING, "Number of colors has to be greater than zero");
++ if (ncolors <= 0 || ncolors > INT_MAX) {
++ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Number of colors has to be greater than zero and no more than %d", INT_MAX);
+ RETURN_FALSE;
+ }
+- gdImageTrueColorToPalette(im, dither, ncolors);
++ gdImageTrueColorToPalette(im, dither, (int)ncolors);
+
+ RETURN_TRUE;
+ }
+diff --git a/ext/gd/tests/bug72697.phpt b/ext/gd/tests/bug72697.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/gd/tests/bug72697.phpt
+@@ -0,0 +1,17 @@
++--TEST--
++Bug #72697: select_colors write out-of-bounds
++--SKIPIF--
++<?php
++if (!function_exists("imagecreatetruecolor")) die("skip");
++if (PHP_INT_MAX !== 9223372036854775807) die("skip for 64-bit long systems only");
++?>
++--FILE--
++<?php
++
++$img=imagecreatetruecolor(10, 10);
++imagetruecolortopalette($img, false, PHP_INT_MAX / 8);
++?>
++DONE
++--EXPECTF--
++Warning: imagetruecolortopalette(): Number of colors has to be greater than zero and no more than 2147483647 in %sbug72697.php on line %d
++DONE
+\ No newline at end of file
+diff --git a/ext/gd/tests/imagetruecolortopalette_error3.phpt b/ext/gd/tests/imagetruecolortopalette_error3.phpt
+--- a/ext/gd/tests/imagetruecolortopalette_error3.phpt
++++ b/ext/gd/tests/imagetruecolortopalette_error3.phpt
+@@ -25,4 +25,4 @@ Warning: imagetruecolortopalette() expects parameter 3 to be long, resource give
+
+ Warning: imagetruecolortopalette() expects parameter 3 to be long, array given in %s on line %d
+
+-Warning: imagetruecolortopalette(): Number of colors has to be greater than zero in %s on line %d
+\ No newline at end of file
++Warning: imagetruecolortopalette(): Number of colors has to be greater than zero and no more than %d in %s on line %d
+diff --git a/ext/gd/tests/imagetruecolortopalette_error4.phpt b/ext/gd/tests/imagetruecolortopalette_error4.phpt
+--- a/ext/gd/tests/imagetruecolortopalette_error4.phpt
++++ b/ext/gd/tests/imagetruecolortopalette_error4.phpt
+@@ -16,6 +16,6 @@ imagetruecolortopalette($image, true, -1);
+
+ ?>
+ --EXPECTF--
+-Warning: imagetruecolortopalette(): Number of colors has to be greater than zero in %s on line %d
++Warning: imagetruecolortopalette(): Number of colors has to be greater than zero and no more than %d in %s on line %d
+
+-Warning: imagetruecolortopalette(): Number of colors has to be greater than zero in %s on line %d
+\ No newline at end of file
++Warning: imagetruecolortopalette(): Number of colors has to be greater than zero and no more than %d in %s on line %d
diff --git a/php-bug72708.patch b/php-bug72708.patch
new file mode 100644
index 0000000..67f1f64
--- /dev/null
+++ b/php-bug72708.patch
@@ -0,0 +1,18 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Wed Aug 3 22:37:57 2016 -0700
+Subject: [PATCH] Fix bug #72708 - php_snmp_parse_oid integer overflow in memory allocation
+
+5.5 backport: https://github.com/shivammathur/php-src-backports/commit/d5b6213851929cd435645db8a94118e21d5bad16
+---
+diff --git a/ext/snmp/snmp.c b/ext/snmp/snmp.c
+--- a/ext/snmp/snmp.c
++++ b/ext/snmp/snmp.c
+@@ -1034,7 +1034,7 @@ static int php_snmp_parse_oid(zval *object, int st, struct objid_query *objid_qu
+ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Got empty OID array");
+ return FALSE;
+ }
+- objid_query->vars = (snmpobjarg *)emalloc(sizeof(snmpobjarg) * zend_hash_num_elements(Z_ARRVAL_PP(oid)));
++ objid_query->vars = (snmpobjarg *)safe_emalloc(sizeof(snmpobjarg), zend_hash_num_elements(Z_ARRVAL_PP(oid)), 0);
+ if (objid_query->vars == NULL) {
+ php_error_docref(NULL TSRMLS_CC, E_WARNING, "emalloc() failed while parsing oid array: %s", strerror(errno));
+ efree(objid_query->vars);
diff --git a/php-bug72709.patch b/php-bug72709.patch
new file mode 100644
index 0000000..8e7ba20
--- /dev/null
+++ b/php-bug72709.patch
@@ -0,0 +1,63 @@
+From f5622f5c8763fe180310ed7a47b999f160d7750b Mon Sep 17 00:00:00 2001
+From: "Christoph M. Becker" <cmb at php.net>
+Date: Tue, 2 Aug 2016 18:41:20 +0200
+Subject: [PATCH] Fix #72709: imagesetstyle() causes OOB read for empty $styles
+
+Calling imagesetstyle() with an empty $styles array caused gdImageSetStyle()
+to be called with `noOfPixels==0`, what could have lead to OOB reads.
+Actually, this issue will be fixed in libgd, but to avoid issues when older
+libgd is in use, we simply disallow passing an empty $styles array to
+imagesetstyle(), what wouldn't serve a useful purpose anyway.
+
+Source: upstream https://github.com/php/php-src/commit/f5622f5c87 (5.6.25)
+---
+diff --git a/ext/gd/gd.c b/ext/gd/gd.c
+--- a/ext/gd/gd.c
++++ b/ext/gd/gd.c
+@@ -1519,6 +1519,7 @@ PHP_FUNCTION(imagesetstyle)
+ int * stylearr;
+ int index;
+ HashPosition pos;
++ int num_styles;
+
+ if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ra", &IM, &styles) == FAILURE) {
+ return;
+@@ -1526,8 +1527,14 @@ PHP_FUNCTION(imagesetstyle)
+
+ ZEND_FETCH_RESOURCE(im, gdImagePtr, &IM, -1, "Image", le_gd);
+
++ num_styles = zend_hash_num_elements(HASH_OF(styles));
++ if (num_styles == 0) {
++ php_error_docref(NULL, E_WARNING, "styles array must not be empty");
++ RETURN_FALSE;
++ }
++
+ /* copy the style values in the stylearr */
+- stylearr = safe_emalloc(sizeof(int), zend_hash_num_elements(HASH_OF(styles)), 0);
++ stylearr = safe_emalloc(sizeof(int), num_styles, 0);
+
+ zend_hash_internal_pointer_reset_ex(HASH_OF(styles), &pos);
+
+diff --git a/ext/gd/tests/bug72709.phpt b/ext/gd/tests/bug72709.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/gd/tests/bug72709.phpt
+@@ -0,0 +1,18 @@
++--TEST--
++Bug #72709 (imagesetstyle() causes OOB read for empty $styles)
++--SKIPIF--
++<?php
++if (!extension_loaded('gd')) die('skip ext/gd not available');
++?>
++--FILE--
++<?php
++$im = imagecreatetruecolor(1, 1);
++var_dump(imagesetstyle($im, array()));
++imagesetpixel($im, 0, 0, IMG_COLOR_STYLED);
++imagedestroy($im);
++?>
++====DONE====
++--EXPECTF--
++Warning: imagesetstyle(): styles array must not be empty in %s%ebug72709.php on line %d
++bool(false)
++====DONE====
diff --git a/php-bug72710.patch b/php-bug72710.patch
new file mode 100644
index 0000000..f191c39
--- /dev/null
+++ b/php-bug72710.patch
@@ -0,0 +1,40 @@
+From 1d32b809034ea4cd0e765ae9fda6ca16ae045fdd Mon Sep 17 00:00:00 2001
+From: ju1ius <ju1ius at laposte.net>
+Date: Sat, 30 Jul 2016 06:08:25 +0200
+Subject: [PATCH] fixes bad address given to onig_error_code_to_str
+
+Closes bug #72710
+
+(cherry picked from commit 0fb7eb6723bcc6fd98053911543e801edb5ab763)
+
+Source: upstream https://github.com/php/php-src/commit/1d32b80903 (5.6.25)
+---
+diff --git a/ext/mbstring/php_mbregex.c b/ext/mbstring/php_mbregex.c
+--- a/ext/mbstring/php_mbregex.c
++++ b/ext/mbstring/php_mbregex.c
+@@ -456,7 +456,7 @@ static php_mb_regex_t *php_mbregex_compile_pattern(const char *pattern, int patl
+ found = zend_hash_find(&MBREX(ht_rc), (char *)pattern, patlen+1, (void **) &rc);
+ if (found == FAILURE || (*rc)->options != options || (*rc)->enc != enc || (*rc)->syntax != syntax) {
+ if ((err_code = onig_new(&retval, (OnigUChar *)pattern, (OnigUChar *)(pattern + patlen), options, enc, syntax, &err_info)) != ONIG_NORMAL) {
+- onig_error_code_to_str(err_str, err_code, err_info);
++ onig_error_code_to_str(err_str, err_code, &err_info);
+ php_error_docref(NULL TSRMLS_CC, E_WARNING, "mbregex compile err: %s", err_str);
+ retval = NULL;
+ goto out;
+diff --git a/ext/mbstring/tests/bug72710.phpt b/ext/mbstring/tests/bug72710.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/mbstring/tests/bug72710.phpt
+@@ -0,0 +1,12 @@
++--TEST--
++Bug #72710 (`mb_ereg` causes buffer overflow on regexp compile error)
++--SKIPIF--
++<?php
++if (!extension_loaded('mbstring')) die('skip ext/mbstring required');
++?>
++--FILE--
++<?php
++mb_ereg('(?<0>a)', 'a');
++?>
++--EXPECTF--
++Warning: mb_ereg(): mbregex compile err: invalid group name <0> in %s on line %d
diff --git a/php-bug72716.patch b/php-bug72716.patch
new file mode 100644
index 0000000..d258b5b
--- /dev/null
+++ b/php-bug72716.patch
@@ -0,0 +1,20 @@
+Backported from 5.6.25 by Remi.
+
+From 9c291f0fa0c8b8c6994f521f5863c407494eb1dc Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas at php.net>
+Date: Wed, 3 Aug 2016 22:59:01 -0700
+Subject: [PATCH] Fix bug #72716 - initialize buffer before read
+
+Source: Remi Collet scl-php55, https://git.remirepo.net/cgit/rpms/scl-php55/php.git/tree/bug72716.patch
+---
+diff --git a/ext/standard/ftp_fopen_wrapper.c b/ext/standard/ftp_fopen_wrapper.c
+--- a/ext/standard/ftp_fopen_wrapper.c
++++ b/ext/standard/ftp_fopen_wrapper.c
+@@ -82,6 +82,7 @@ typedef struct _php_ftp_dirstream_data {
+ */
+ static inline int get_ftp_result(php_stream *stream, char *buffer, size_t buffer_size TSRMLS_DC)
+ {
++ buffer[0] = '\0'; /* in case read fails to read anything */
+ while (php_stream_gets(stream, buffer, buffer_size-1) &&
+ !(isdigit((int) buffer[0]) && isdigit((int) buffer[1]) &&
+ isdigit((int) buffer[2]) && buffer[3] == ' '));
diff --git a/php-bug72730.patch b/php-bug72730.patch
new file mode 100644
index 0000000..8fe7ab4
--- /dev/null
+++ b/php-bug72730.patch
@@ -0,0 +1,42 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Wed Aug 10 00:14:58 2016 -0700
+Subject: [PATCH] Fix bug #72730 - imagegammacorrect allows arbitrary write access
+
+5.5 backport: https://github.com/shivammathur/php-src-backports/commit/0a38701578a4bd16686cb902a1f94c5bfdddb3a2
+---
+diff --git a/ext/gd/gd.c b/ext/gd/gd.c
+--- a/ext/gd/gd.c
++++ b/ext/gd/gd.c
+@@ -3036,6 +3036,11 @@ PHP_FUNCTION(imagegammacorrect)
+ return;
+ }
+
++ if ( input <= 0.0 || output <= 0.0 ) {
++ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Gamma values should be positive");
++ RETURN_FALSE;
++ }
++
+ ZEND_FETCH_RESOURCE(im, gdImagePtr, &IM, -1, "Image", le_gd);
+
+ if (gdImageTrueColor(im)) {
+diff --git a/ext/gd/tests/bug72730.phpt b/ext/gd/tests/bug72730.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/gd/tests/bug72730.phpt
+@@ -0,0 +1,15 @@
++--TEST--
++Bug #72730: imagegammacorrect allows arbitrary write access
++--SKIPIF--
++<?php
++if (!function_exists("imagecreatetruecolor")) die("skip");
++?>
++--FILE--
++<?php
++$img = imagecreatetruecolor(1, 1);
++imagegammacorrect($img, -1, 1337);
++?>
++DONE
++--EXPECTF--
++Warning: imagegammacorrect(): Gamma values should be positive in %sbug72730.php on line %d
++DONE
+\ No newline at end of file
diff --git a/php-bug72749.patch b/php-bug72749.patch
new file mode 100644
index 0000000..f6366db
--- /dev/null
+++ b/php-bug72749.patch
@@ -0,0 +1,81 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Thu Aug 4 00:17:42 2016 -0700
+Subject: [PATCH] Fix bug #72749: wddx_deserialize allows illegal memory access
+
+5.5 backport: https://github.com/shivammathur/php-src-backports/commit/95c7e03e5161ff48faf5fc3660df52cb525f3a76
+---
+diff --git a/ext/wddx/tests/bug72749.phpt b/ext/wddx/tests/bug72749.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/wddx/tests/bug72749.phpt
+@@ -0,0 +1,34 @@
++--TEST--
++Bug #72749: wddx_deserialize allows illegal memory access
++--SKIPIF--
++<?php
++if (!extension_loaded('wddx')) {
++ die('skip. wddx not available');
++}
++?>
++--FILE--
++<?php
++$xml = <<<XML
++<?xml version='1.0'?>
++<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
++<wddxPacket version='1.0'>
++<header/>
++ <data>
++ <struct>
++ <var name='aDateTime3'>
++ <dateTime>2\r2004-09-10T05:52:49+00</dateTime>
++ </var>
++ </struct>
++ </data>
++</wddxPacket>
++XML;
++
++$array = wddx_deserialize($xml);
++var_dump($array);
++?>
++--EXPECT--
++array(1) {
++ ["aDateTime3"]=>
++ string(24) "2
++2004-09-10T05:52:49+00"
++}
+diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c
+--- a/ext/wddx/wddx.c
++++ b/ext/wddx/wddx.c
+@@ -1116,18 +1116,26 @@ static void php_wddx_process_data(void *user_data, const XML_Char *s, int len)
+ case ST_DATETIME: {
+ char *tmp;
+
+- tmp = emalloc(len + 1);
+- memcpy(tmp, s, len);
++ if (Z_TYPE_P(ent->data) == IS_STRING) {
++ tmp = safe_emalloc(Z_STRLEN_P(ent->data), 1, (size_t)len + 1);
++ memcpy(tmp, Z_STRVAL_P(ent->data), Z_STRLEN_P(ent->data));
++ memcpy(tmp + Z_STRLEN_P(ent->data), s, len);
++ len += Z_STRLEN_P(ent->data);
++ efree(Z_STRVAL_P(ent->data));
++ Z_TYPE_P(ent->data) = IS_LONG;
++ } else {
++ tmp = emalloc(len + 1);
++ memcpy(tmp, s, len);
++ }
+ tmp[len] = '\0';
+
+ Z_LVAL_P(ent->data) = php_parse_date(tmp, NULL);
+ /* date out of range < 1969 or > 2038 */
+ if (Z_LVAL_P(ent->data) == -1) {
+- Z_TYPE_P(ent->data) = IS_STRING;
+- Z_STRLEN_P(ent->data) = len;
+- Z_STRVAL_P(ent->data) = estrndup(s, len);
++ ZVAL_STRINGL(ent->data, tmp, len, 0);
++ } else {
++ efree(tmp);
+ }
+- efree(tmp);
+ }
+ break;
+
diff --git a/php-bug72750.patch b/php-bug72750.patch
new file mode 100644
index 0000000..f4e9a63
--- /dev/null
+++ b/php-bug72750.patch
@@ -0,0 +1,63 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Sun Aug 7 16:26:52 2016 -0700
+Subject: [PATCH] Fix bug #72750: wddx_deserialize null dereference
+
+5.5 backport: https://github.com/shivammathur/php-src-backports/commit/d3c2604030c7c5912f4d1e4b2a822852b222a741
+---
+diff --git a/ext/wddx/tests/bug72750.phpt b/ext/wddx/tests/bug72750.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/wddx/tests/bug72750.phpt
+@@ -0,0 +1,34 @@
++--TEST--
++Bug #72750: wddx_deserialize null dereference
++--SKIPIF--
++<?php
++if (!extension_loaded('wddx')) {
++ die('skip. wddx not available');
++}
++?>
++--FILE--
++<?php
++
++$xml = <<< XML
++<?xml version='1.0'?>
++<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
++<wddxPacket version='1.0'>
++<header/>
++ <data>
++ <struct>
++ <var name='aBinary'>
++ <binary length='11'>\\tYmluYXJRhdGE=</binary>
++ </var>
++ </struct>
++ </data>
++</wddxPacket>
++XML;
++
++$array = wddx_deserialize($xml);
++var_dump($array);
++?>
++--EXPECT--
++array(1) {
++ ["aBinary"]=>
++ string(0) ""
++}
+diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c
+--- a/ext/wddx/wddx.c
++++ b/ext/wddx/wddx.c
+@@ -952,8 +952,12 @@ static void php_wddx_pop_element(void *user_data, const XML_Char *name)
+
+ new_str = php_base64_decode(Z_STRVAL_P(ent1->data), Z_STRLEN_P(ent1->data), &new_len);
+ STR_FREE(Z_STRVAL_P(ent1->data));
+- Z_STRVAL_P(ent1->data) = new_str;
+- Z_STRLEN_P(ent1->data) = new_len;
++ if (new_str) {
++ Z_STRVAL_P(ent1->data) = new_str;
++ Z_STRLEN_P(ent1->data) = new_len;
++ } else {
++ ZVAL_EMPTY_STRING(ent1->data);
++ }
+ }
+
+ /* Call __wakeup() method on the object. */
diff --git a/php-bug72771.patch b/php-bug72771.patch
new file mode 100644
index 0000000..4bdb4fb
--- /dev/null
+++ b/php-bug72771.patch
@@ -0,0 +1,19 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Sun Aug 7 16:17:54 2016 -0700
+Subject: [PATCH] Fix bug #72771: ftps:// opendir wrapper is vulnerable to protocol downgrade attack
+
+5.5 backport: https://github.com/shivammathur/php-src-backports/commit/bd925690792e765128876e55cd05e9062b8bad6f
+---
+diff --git a/ext/standard/ftp_fopen_wrapper.c b/ext/standard/ftp_fopen_wrapper.c
+--- a/ext/standard/ftp_fopen_wrapper.c
++++ b/ext/standard/ftp_fopen_wrapper.c
+@@ -186,7 +186,8 @@ static php_stream *php_ftp_fopen_connect(php_stream_wrapper *wrapper, char *path
+ /* get the response */
+ result = GET_FTP_RESULT(stream);
+ if (result != 334) {
+- use_ssl = 0;
++ php_stream_wrapper_log_error(wrapper, options TSRMLS_CC, "Server doesn't support FTPS.");
++ goto connect_errexit;
+ } else {
+ /* we must reuse the old SSL session id */
+ /* if we talk to an old ftpd-ssl */
diff --git a/php-bug72776.patch b/php-bug72776.patch
new file mode 100644
index 0000000..3c495df
--- /dev/null
+++ b/php-bug72776.patch
@@ -0,0 +1,20 @@
+From 493b2bff02531b0ead233177a2a0846c75e94777 Mon Sep 17 00:00:00 2001
+From: Jakub Zelenka <bukka at php.net>
+Date: Sun, 6 Nov 2016 20:40:51 +0000
+Subject: [PATCH] Fix bug #72776 (Invalid parameter in memcpy function trough
+ openssl_pbkdf2)
+
+Source: upstream https://github.com/php/php-src/commit/493b2bff02 (5.6.29)
+---
+diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c
+--- a/ext/openssl/openssl.c
++++ b/ext/openssl/openssl.c
+@@ -3678,7 +3678,7 @@ PHP_FUNCTION(openssl_pbkdf2)
+ return;
+ }
+
+- if (key_length <= 0) {
++ if (key_length <= 0 || key_length > INT_MAX) {
+ RETURN_FALSE;
+ }
+
diff --git a/php-bug72787.patch b/php-bug72787.patch
new file mode 100644
index 0000000..7d2cfb4
--- /dev/null
+++ b/php-bug72787.patch
@@ -0,0 +1,43 @@
+From 9f1d962ed6057a3996f1b5aa82467a3172e41e8f Mon Sep 17 00:00:00 2001
+From: Jakub Zelenka <bukka at php.net>
+Date: Sun, 14 Aug 2016 13:52:59 +0100
+Subject: [PATCH] Fixed bug #72787 (json_decode reads out of bounds)
+
+Source: upstream https://github.com/php/php-src/commit/9f1d962ed6 (5.6.26)
+---
+diff --git a/ext/json/json.c b/ext/json/json.c
+--- a/ext/json/json.c
++++ b/ext/json/json.c
+@@ -683,6 +683,12 @@ PHP_JSON_API void php_json_decode_ex(zval *return_value, char *str, int str_len,
+ RETURN_NULL();
+ }
+
++ if (depth > INT_MAX) {
++ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Depth must be lower than %d", INT_MAX);
++ efree(utf16);
++ RETURN_NULL();
++ }
++
+ ALLOC_INIT_ZVAL(z);
+ jp = new_JSON_parser(depth);
+ if (parse_JSON_ex(jp, z, utf16, utf16_len, options TSRMLS_CC)) {
+diff --git a/ext/json/tests/bug72787.phpt b/ext/json/tests/bug72787.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/json/tests/bug72787.phpt
+@@ -0,0 +1,15 @@
++--TEST--
++Bug #72787 (json_decode reads out of bounds)
++--SKIPIF--
++<?php if (!extension_loaded("json")) print "skip"; ?>
++<?php if (PHP_INT_SIZE != 8) die("skip this test is for 64bit platform only"); ?>
++--FILE--
++<?php
++
++var_dump(json_decode('[]', false, 0x100000000));
++
++?>
++--EXPECTF--
++
++Warning: json_decode(): Depth must be lower than %d in %s on line %d
++NULL
diff --git a/php-bug72790.patch b/php-bug72790.patch
new file mode 100644
index 0000000..f67a96b
--- /dev/null
+++ b/php-bug72790.patch
@@ -0,0 +1,122 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Wed Aug 10 23:43:56 2016 -0700
+Subject: [PATCH] Fix for bug #72790 and bug #72799
+
+5.5 backport: https://github.com/shivammathur/php-src-backports/commit/5408c02a5e41a7e689d368d68fecb753c73eaafb
+---
+diff --git a/ext/wddx/tests/bug72790.phpt b/ext/wddx/tests/bug72790.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/wddx/tests/bug72790.phpt
+@@ -0,0 +1,35 @@
++--TEST--
++Bug 72790: wddx_deserialize null dereference with invalid xml
++--SKIPIF--
++<?php
++if (!extension_loaded('wddx')) {
++ die('skip. wddx not available');
++}
++?>
++--FILE--
++<?php
++
++$xml = <<< XML
++<?xml version='1.0' ?>
++<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
++<wddxPacket version='1.0'>
++ |array>
++ <var name="XXXX">
++ <boolean value="this">
++ </boolean>
++ </var>
++ <var name="YYYY">
++ <var name="UUUU">
++ <var name="EZEZ">
++ </var>
++ </var>
++ </var>
++ </array>
++</wddxPacket>
++XML;
++
++$array = wddx_deserialize($xml);
++var_dump($array);
++?>
++--EXPECT--
++NULL
+\ No newline at end of file
+diff --git a/ext/wddx/tests/bug72799.phpt b/ext/wddx/tests/bug72799.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/wddx/tests/bug72799.phpt
+@@ -0,0 +1,28 @@
++--TEST--
++Bug #72799: wddx_deserialize null dereference in php_wddx_pop_element
++--SKIPIF--
++<?php
++if (!extension_loaded('wddx')) {
++ die('skip. wddx not available');
++}
++?>
++--FILE--
++<?php
++
++$xml = <<<XML
++<?xml version='1.0'?>
++<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
++<wddxPacket version="1.0">
++ <var name="XXXX">
++ <boolean value="1">
++ <dateTime>1998-06-12T04:32:12+00</dateTime>
++ </boolean>
++ </var>
++</wddxPacket>
++XML;
++
++$array = wddx_deserialize($xml);
++var_dump($array);
++?>
++--EXPECT--
++NULL
+\ No newline at end of file
+diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c
+--- a/ext/wddx/wddx.c
++++ b/ext/wddx/wddx.c
+@@ -939,10 +939,10 @@ static void php_wddx_pop_element(void *user_data, const XML_Char *name)
+ if (!ent1->data) {
+ if (stack->top > 1) {
+ stack->top--;
++ efree(ent1);
+ } else {
+ stack->done = 1;
+ }
+- efree(ent1);
+ return;
+ }
+
+@@ -981,7 +981,7 @@ static void php_wddx_pop_element(void *user_data, const XML_Char *name)
+ wddx_stack_top(stack, (void**)&ent2);
+
+ /* if non-existent field */
+- if (ent2->type == ST_FIELD && ent2->data == NULL) {
++ if (ent2->data == NULL) {
+ zval_ptr_dtor(&ent1->data);
+ efree(ent1);
+ return;
+@@ -1172,9 +1172,13 @@ int php_wddx_deserialize_ex(char *value, int vallen, zval *return_value)
+
+ if (stack.top == 1) {
+ wddx_stack_top(&stack, (void**)&ent);
+- *return_value = *(ent->data);
+- zval_copy_ctor(return_value);
+- retval = SUCCESS;
++ if(ent->data == NULL) {
++ retval = FAILURE;
++ } else {
++ *return_value = *(ent->data);
++ zval_copy_ctor(return_value);
++ retval = SUCCESS;
++ }
+ } else {
+ retval = FAILURE;
+ }
diff --git a/php-bug72807.patch b/php-bug72807.patch
new file mode 100644
index 0000000..5e1b26c
--- /dev/null
+++ b/php-bug72807.patch
@@ -0,0 +1,33 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Thu Aug 11 23:36:25 2016 -0700
+Subject: [PATCH] Fix for bug #72807 - do not produce strings with negative length
+
+5.5 backport: https://github.com/shivammathur/php-src-backports/commit/53fe0b29d7a4d2d645eadf9f38c370c56c685e3b
+---
+diff --git a/Zend/zend_API.h b/Zend/zend_API.h
+--- a/Zend/zend_API.h
++++ b/Zend/zend_API.h
+@@ -575,6 +575,9 @@ END_EXTERN_C()
+ const char *__s=(s); \
+ zval *__z = (z); \
+ Z_STRLEN_P(__z) = strlen(__s); \
++ if (UNEXPECTED(Z_STRLEN_P(__z) < 0)) { \
++ zend_error(E_ERROR, "String size overflow"); \
++ } \
+ Z_STRVAL_P(__z) = (duplicate?estrndup(__s, Z_STRLEN_P(__z)):(char*)__s);\
+ Z_TYPE_P(__z) = IS_STRING; \
+ } while (0)
+diff --git a/ext/curl/interface.c b/ext/curl/interface.c
+--- a/ext/curl/interface.c
++++ b/ext/curl/interface.c
+@@ -3506,6 +3506,10 @@ PHP_FUNCTION(curl_escape)
+ ZEND_FETCH_RESOURCE(ch, php_curl *, &zid, -1, le_curl_name, le_curl);
+
+ if ((res = curl_easy_escape(ch->cp, str, str_len))) {
++ if (strlen(res) > INT_MAX) {
++ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Escaped string is too long, maximum is %d", INT_MAX);
++ RETURN_FALSE;
++ }
+ RETVAL_STRING(res, 1);
+ curl_free(res);
+ } else {
diff --git a/php-bug72823.patch b/php-bug72823.patch
new file mode 100644
index 0000000..0af5352
--- /dev/null
+++ b/php-bug72823.patch
@@ -0,0 +1,52 @@
+From ae3b2078eac226c61bc325527e607ad275936d22 Mon Sep 17 00:00:00 2001
+From: "Christoph M. Becker" <cmbecker69 at gmx.de>
+Date: Sat, 13 Aug 2016 11:39:16 +0200
+Subject: [PATCH] Fix #72823: strtr out-of-bound access
+
+If php_strtr_array_prepare_repls() reports pattern_len == 0, we return
+early to avoid OOB accesses, and because there is nothing to replace anyway.
+
+Source: upstream https://github.com/php/php-src/commit/ae3b2078ea (5.6.26)
+---
+diff --git a/ext/standard/string.c b/ext/standard/string.c
+--- a/ext/standard/string.c
++++ b/ext/standard/string.c
+@@ -3007,7 +3007,7 @@ static PPRES *php_strtr_array_prepare(STR *text, PATNREPL *patterns, int patnum,
+ res->m = L(&patterns[i].pat);
+ }
+ }
+- assert(res->m > 0);
++ assert(res->m > 0 && res->m != (STRLEN)-1);
+ res->B = B = MIN(B, res->m);
+ res->Bp = Bp = MIN(Bp, res->m);
+
+@@ -3149,6 +3149,12 @@ static void php_strtr_array(zval *return_value, char *str, int slen, HashTable *
+ if (patterns == NULL) {
+ RETURN_FALSE;
+ }
++ if (patterns_len == 0) {
++ efree(patterns);
++ zend_llist_destroy(allocs);
++ efree(allocs);
++ RETURN_STRINGL(str, slen, 1);
++ }
+ data = php_strtr_array_prepare(&text, patterns, patterns_len, 2, 2);
+ efree(patterns);
+ php_strtr_array_do_repl(&text, data, return_value);
+diff --git a/ext/standard/tests/strings/bug72823.phpt b/ext/standard/tests/strings/bug72823.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/standard/tests/strings/bug72823.phpt
+@@ -0,0 +1,12 @@
++--TEST--
++Bug #72823 (strtr out-of-bound access)
++--FILE--
++<?php
++var_dump(
++ strtr(11, array('aaa' => 'bbb'))
++);
++?>
++===DONE===
++--EXPECT--
++string(2) "11"
++===DONE===
diff --git a/php-bug72836.patch b/php-bug72836.patch
new file mode 100644
index 0000000..c1b3ba9
--- /dev/null
+++ b/php-bug72836.patch
@@ -0,0 +1,31 @@
+Backported from 5.6.25 by Remi.
+
+From f973877a2f8d58b857f0f02b8a88a2ee05a1cbb0 Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas at php.net>
+Date: Sun, 14 Aug 2016 23:13:30 -0700
+Subject: [PATCH] Fix bug #72836 - integer overflow in base64_decode caused
+ heap corruption
+
+From f01446dacf3eeab888b500115f0d71df7918c353 Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas at php.net>
+Date: Tue, 16 Aug 2016 16:34:35 -0700
+Subject: [PATCH] Fix TSRM build
+
+Source: Remi Collet scl-php55, https://git.remirepo.net/cgit/rpms/scl-php55/php.git/tree/bug72836.patch
+---
+diff --git a/ext/standard/base64.c b/ext/standard/base64.c
+--- a/ext/standard/base64.c
++++ b/ext/standard/base64.c
+@@ -66,6 +66,12 @@ PHPAPI unsigned char *php_base64_encode(const unsigned char *str, int length, in
+ return NULL;
+ }
+
++ if (((size_t)length + 2) / 3 > INT_MAX/4 ) {
++ TSRMLS_FETCH();
++ php_error_docref(NULL TSRMLS_CC, E_WARNING, "String too long, maximum is %d", INT_MAX/4);
++ return NULL;
++ }
++
+ result = (unsigned char *) safe_emalloc((length + 2) / 3, 4 * sizeof(char), 1);
+ p = result;
+
diff --git a/php-bug72837.patch b/php-bug72837.patch
new file mode 100644
index 0000000..248cd23
--- /dev/null
+++ b/php-bug72837.patch
@@ -0,0 +1,38 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Mon Aug 15 23:17:26 2016 -0700
+Subject: [PATCH] Fix bug #72837 - integer overflow in bzdecompress caused heap corruption
+
+5.5 backport: https://github.com/shivammathur/php-src-backports/commit/9bab7bf9d7f4faeed95fb390daf7ccc0be13d4c8
+---
+diff --git a/ext/bz2/bz2.c b/ext/bz2/bz2.c
+--- a/ext/bz2/bz2.c
++++ b/ext/bz2/bz2.c
+@@ -573,15 +573,25 @@ static PHP_FUNCTION(bzdecompress)
+ /* compression is better then 2:1, need to allocate more memory */
+ bzs.avail_out = source_len;
+ size = (bzs.total_out_hi32 * (unsigned int) -1) + bzs.total_out_lo32;
++ if (size > INT_MAX) {
++ /* no reason to continue if we're going to drop it anyway */
++ break;
++ }
+ dest = safe_erealloc(dest, 1, bzs.avail_out+1, (size_t) size );
+ bzs.next_out = dest + size;
+ }
+
+ if (error == BZ_STREAM_END || error == BZ_OK) {
+ size = (bzs.total_out_hi32 * (unsigned int) -1) + bzs.total_out_lo32;
+- dest = safe_erealloc(dest, 1, (size_t) size, 1);
+- dest[size] = '\0';
+- RETVAL_STRINGL(dest, (int) size, 0);
++ if (size > INT_MAX) {
++ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Decompressed size too big, max is %d", INT_MAX);
++ efree(dest);
++ RETVAL_LONG(BZ_MEM_ERROR);
++ } else {
++ dest = safe_erealloc(dest, 1, (size_t) size, 1);
++ dest[size] = '\0';
++ RETVAL_STRINGL(dest, (int) size, 0);
++ }
+ } else { /* real error */
+ efree(dest);
+ RETVAL_LONG(error);
diff --git a/php-bug72838.patch b/php-bug72838.patch
new file mode 100644
index 0000000..091b935
--- /dev/null
+++ b/php-bug72838.patch
@@ -0,0 +1,21 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Mon Aug 15 23:43:59 2016 -0700
+Subject: [PATCH] Fix bug #72838 - Integer overflow lead to heap corruption in sql_regcase
+
+5.5 backport: https://github.com/shivammathur/php-src-backports/commit/8217d2c74b0ccc08ee8da414c7e6d3954c0c28a8
+---
+diff --git a/ext/ereg/ereg.c b/ext/ereg/ereg.c
+--- a/ext/ereg/ereg.c
++++ b/ext/ereg/ereg.c
+@@ -743,6 +743,11 @@ PHP_EREG_API PHP_FUNCTION(sql_regcase)
+
+ for (i = j = 0; i < string_len; i++) {
+ c = (unsigned char) string[i];
++ if ( j >= INT_MAX - 1 || (isalpha(c) && j >= INT_MAX - 4)) {
++ php_error_docref(NULL TSRMLS_CC, E_WARNING, "String too long, max length is %d", INT_MAX);
++ efree(tmp);
++ RETURN_FALSE;
++ }
+ if (isalpha(c)) {
+ tmp[j++] = '[';
+ tmp[j++] = toupper(c);
diff --git a/php-bug72848.patch b/php-bug72848.patch
new file mode 100644
index 0000000..b2173d3
--- /dev/null
+++ b/php-bug72848.patch
@@ -0,0 +1,21 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Tue Aug 16 15:48:31 2016 -0700
+Subject: [PATCH] Fix bug #72848 - integer overflow in quoted_printable_encode caused heap corruption
+
+5.5 backport: https://github.com/shivammathur/php-src-backports/commit/4f27c5d3544713f702504268db12bec3ba0667e5
+---
+diff --git a/ext/standard/quot_print.c b/ext/standard/quot_print.c
+--- a/ext/standard/quot_print.c
++++ b/ext/standard/quot_print.c
+@@ -275,6 +275,11 @@ PHP_FUNCTION(quoted_printable_encode)
+ }
+
+ new_str = (char *)php_quot_print_encode((unsigned char *)str, (size_t)str_len, &new_str_len);
++ if (new_str_len > INT_MAX) {
++ php_error_docref(NULL TSRMLS_CC, E_WARNING, "String too long, max length is %d", INT_MAX);
++ efree(new_str);
++ RETURN_FALSE;
++ }
+ RETURN_STRINGL(new_str, new_str_len, 0);
+ }
+ /* }}} */
diff --git a/php-bug72849.patch b/php-bug72849.patch
new file mode 100644
index 0000000..1983f61
--- /dev/null
+++ b/php-bug72849.patch
@@ -0,0 +1,23 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Tue Aug 16 15:58:05 2016 -0700
+Subject: [PATCH] Fixed bug #72849 - integer overflow in urlencode
+
+5.5 backport: https://github.com/shivammathur/php-src-backports/commit/083c182f9ac08e3d484b83c8029bffbafd9749f0
+---
+diff --git a/ext/standard/url.c b/ext/standard/url.c
+--- a/ext/standard/url.c
++++ b/ext/standard/url.c
+@@ -520,6 +520,13 @@ PHPAPI char *php_url_encode(char const *s, int len, int *new_length)
+ *to++ = c;
+ }
+ }
++
++ if ((to-start) > INT_MAX) {
++ TSRMLS_FETCH();
++ /* E_ERROR since most clients won't check for error, and this is rather rare condition */
++ php_error_docref(NULL TSRMLS_CC, E_ERROR, "String overflow, max length is %d", INT_MAX);
++ }
++
+ *to = 0;
+ if (new_length) {
+ *new_length = to - start;
diff --git a/php-bug72850.patch b/php-bug72850.patch
new file mode 100644
index 0000000..6468d5c
--- /dev/null
+++ b/php-bug72850.patch
@@ -0,0 +1,30 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Tue Aug 16 16:03:44 2016 -0700
+Subject: [PATCH] Fix bug #72850 - integer overflow in uuencode
+
+5.5 backport: https://github.com/shivammathur/php-src-backports/commit/efd5faae2cf27873936f4851f533581dc83fff68
+---
+diff --git a/ext/standard/uuencode.c b/ext/standard/uuencode.c
+--- a/ext/standard/uuencode.c
++++ b/ext/standard/uuencode.c
+@@ -168,7 +168,7 @@ PHPAPI int php_uudecode(char *src, int src_len, char **dest) /* {{{ */
+ s++;
+ }
+
+- if ((len = total_len > (p - *dest))) {
++ if ((len = total_len) > (p - *dest)) {
+ *p++ = PHP_UU_DEC(*s) << 2 | PHP_UU_DEC(*(s + 1)) >> 4;
+ if (len > 1) {
+ *p++ = PHP_UU_DEC(*(s + 1)) << 4 | PHP_UU_DEC(*(s + 2)) >> 2;
+@@ -200,6 +200,11 @@ PHP_FUNCTION(convert_uuencode)
+ }
+
+ dst_len = php_uuencode(src, src_len, &dst);
++ if (dst_len < 0) {
++ php_error_docref(NULL TSRMLS_CC, E_WARNING, "String too long, max length is %d", INT_MAX);
++ efree(dst);
++ RETURN_FALSE;
++ }
+
+ RETURN_STRINGL(dst, dst_len, 0);
+ }
diff --git a/php-bug72860.patch b/php-bug72860.patch
new file mode 100644
index 0000000..ef5546a
--- /dev/null
+++ b/php-bug72860.patch
@@ -0,0 +1,52 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Mon Sep 5 23:42:31 2016 -0700
+Subject: [PATCH] Fix bug #72860: wddx_deserialize use-after-free
+
+5.5 backport: https://github.com/shivammathur/php-src-backports/commit/5a37ffac6af7f08d9200cb1dbeb515052e291434
+---
+diff --git a/ext/wddx/tests/bug72860.phpt b/ext/wddx/tests/bug72860.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/wddx/tests/bug72860.phpt
+@@ -0,0 +1,27 @@
++--TEST--
++Bug #72860: wddx_deserialize use-after-free
++--SKIPIF--
++<?php
++if (!extension_loaded('wddx')) {
++ die('skip. wddx not available');
++}
++?>
++--FILE--
++<?php
++
++$xml=<<<XML
++<?xml version='1.0'?>
++<!DOCTYPE wddxPacket SYSTEM 'wddx_0100.dtd'>
++<wddxPacket version='1.0'>
++ <recordset fieldNames='F'>
++ <field name='F'>
++ </recordset>
++</wddxPacket>
++XML;
++
++var_dump(wddx_deserialize($xml));
++?>
++DONE
++--EXPECT--
++NULL
++DONE
+\ No newline at end of file
+diff --git a/ext/wddx/wddx.c b/ext/wddx/wddx.c
+--- a/ext/wddx/wddx.c
++++ b/ext/wddx/wddx.c
+@@ -232,7 +232,8 @@ static int wddx_stack_destroy(wddx_stack *stack)
+
+ if (stack->elements) {
+ for (i = 0; i < stack->top; i++) {
+- if (((st_entry *)stack->elements[i])->data) {
++ if (((st_entry *)stack->elements[i])->data
++ && ((st_entry *)stack->elements[i])->type != ST_FIELD) {
+ zval_ptr_dtor(&((st_entry *)stack->elements[i])->data);
+ }
+ if (((st_entry *)stack->elements[i])->varname) {
diff --git a/php-bug72907.patch b/php-bug72907.patch
new file mode 100644
index 0000000..8476b1e
--- /dev/null
+++ b/php-bug72907.patch
@@ -0,0 +1,151 @@
+From b740bb3987ba4f181dfda91ce3bd9fe663155574 Mon Sep 17 00:00:00 2001
+From: Xinchen Hui <laruence at gmail.com>
+Date: Sun, 21 Aug 2016 17:10:10 +0800
+Subject: [PATCH] Fixed bug #72907 (null pointer deref, segfault in
+ gc_remove_zval_from_buffer (zend_gc.c:260))
+
+Source: upstream https://github.com/php/php-src/commit/b740bb3987 (5.6.26)
+---
+diff --git a/Zend/tests/bug72907.phpt b/Zend/tests/bug72907.phpt
+new file mode 100644
+--- /dev/null
++++ b/Zend/tests/bug72907.phpt
+@@ -0,0 +1,18 @@
++--TEST--
++Bug #72907 (null pointer deref, segfault in gc_remove_zval_from_buffer (zend_gc.c:260))
++--FILE--
++<?php
++
++$a = 0;
++
++($a->a = &$E) + ($b = $a->b->i -= 0);
++
++?>
++--EXPECTF--
++Warning: Attempt to modify property of non-object in %sbug72907.php on line %d
++
++Warning: Attempt to modify property of non-object in %sbug72907.php on line %d
++
++Warning: Creating default object from empty value in %sbug72907.php on line %d
++
++Notice: Undefined property: stdClass::$i in %sbug72907.php on line %d
+diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c
+--- a/Zend/zend_execute.c
++++ b/Zend/zend_execute.c
+@@ -512,9 +512,7 @@ static void zend_assign_to_variable_reference(zval **variable_ptr_ptr, zval **va
+ zval *variable_ptr = *variable_ptr_ptr;
+ zval *value_ptr = *value_ptr_ptr;
+
+- if (variable_ptr == &EG(error_zval) || value_ptr == &EG(error_zval)) {
+- variable_ptr_ptr = &EG(uninitialized_zval_ptr);
+- } else if (variable_ptr != value_ptr) {
++ if (variable_ptr != value_ptr) {
+ if (!PZVAL_IS_REF(value_ptr)) {
+ /* break it away */
+ Z_DELREF_P(value_ptr);
+diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
+--- a/Zend/zend_vm_def.h
++++ b/Zend/zend_vm_def.h
+@@ -1808,11 +1808,14 @@ ZEND_VM_HANDLER(39, ZEND_ASSIGN_REF, VAR|CV, VAR|CV)
+ if ((OP2_TYPE == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||
+ (OP1_TYPE == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL))) {
+ zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets nor overloaded objects");
+- }
+- zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
+-
+- if (OP2_TYPE == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
+- Z_DELREF_PP(variable_ptr_ptr);
++ } else if ((OP2_TYPE == IS_VAR && UNEXPECTED(*value_ptr_ptr == &EG(error_zval))) ||
++ (OP1_TYPE == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval)))) {
++ variable_ptr_ptr = &EG(uninitialized_zval_ptr);
++ } else {
++ zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
++ if (OP2_TYPE == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
++ Z_DELREF_PP(variable_ptr_ptr);
++ }
+ }
+
+ if (RETURN_VALUE_USED(opline)) {
+diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
+--- a/Zend/zend_vm_execute.h
++++ b/Zend/zend_vm_execute.h
+@@ -19973,11 +19973,14 @@ static int ZEND_FASTCALL ZEND_ASSIGN_REF_SPEC_VAR_VAR_HANDLER(ZEND_OPCODE_HANDL
+ if ((IS_VAR == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||
+ (IS_VAR == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL))) {
+ zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets nor overloaded objects");
+- }
+- zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
+-
+- if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
+- Z_DELREF_PP(variable_ptr_ptr);
++ } else if ((IS_VAR == IS_VAR && UNEXPECTED(*value_ptr_ptr == &EG(error_zval))) ||
++ (IS_VAR == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval)))) {
++ variable_ptr_ptr = &EG(uninitialized_zval_ptr);
++ } else {
++ zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
++ if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
++ Z_DELREF_PP(variable_ptr_ptr);
++ }
+ }
+
+ if (RETURN_VALUE_USED(opline)) {
+@@ -23446,11 +23449,14 @@ static int ZEND_FASTCALL ZEND_ASSIGN_REF_SPEC_VAR_CV_HANDLER(ZEND_OPCODE_HANDLE
+ if ((IS_CV == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||
+ (IS_VAR == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL))) {
+ zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets nor overloaded objects");
+- }
+- zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
+-
+- if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
+- Z_DELREF_PP(variable_ptr_ptr);
++ } else if ((IS_CV == IS_VAR && UNEXPECTED(*value_ptr_ptr == &EG(error_zval))) ||
++ (IS_VAR == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval)))) {
++ variable_ptr_ptr = &EG(uninitialized_zval_ptr);
++ } else {
++ zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
++ if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
++ Z_DELREF_PP(variable_ptr_ptr);
++ }
+ }
+
+ if (RETURN_VALUE_USED(opline)) {
+@@ -37133,11 +37139,14 @@ static int ZEND_FASTCALL ZEND_ASSIGN_REF_SPEC_CV_VAR_HANDLER(ZEND_OPCODE_HANDLE
+ if ((IS_VAR == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||
+ (IS_CV == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL))) {
+ zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets nor overloaded objects");
+- }
+- zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
+-
+- if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
+- Z_DELREF_PP(variable_ptr_ptr);
++ } else if ((IS_VAR == IS_VAR && UNEXPECTED(*value_ptr_ptr == &EG(error_zval))) ||
++ (IS_CV == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval)))) {
++ variable_ptr_ptr = &EG(uninitialized_zval_ptr);
++ } else {
++ zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
++ if (IS_VAR == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
++ Z_DELREF_PP(variable_ptr_ptr);
++ }
+ }
+
+ if (RETURN_VALUE_USED(opline)) {
+@@ -40321,11 +40330,14 @@ static int ZEND_FASTCALL ZEND_ASSIGN_REF_SPEC_CV_CV_HANDLER(ZEND_OPCODE_HANDLER
+ if ((IS_CV == IS_VAR && UNEXPECTED(value_ptr_ptr == NULL)) ||
+ (IS_CV == IS_VAR && UNEXPECTED(variable_ptr_ptr == NULL))) {
+ zend_error_noreturn(E_ERROR, "Cannot create references to/from string offsets nor overloaded objects");
+- }
+- zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
+-
+- if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
+- Z_DELREF_PP(variable_ptr_ptr);
++ } else if ((IS_CV == IS_VAR && UNEXPECTED(*value_ptr_ptr == &EG(error_zval))) ||
++ (IS_CV == IS_VAR && UNEXPECTED(*variable_ptr_ptr == &EG(error_zval)))) {
++ variable_ptr_ptr = &EG(uninitialized_zval_ptr);
++ } else {
++ zend_assign_to_variable_reference(variable_ptr_ptr, value_ptr_ptr TSRMLS_CC);
++ if (IS_CV == IS_VAR && opline->extended_value == ZEND_RETURNS_NEW) {
++ Z_DELREF_PP(variable_ptr_ptr);
++ }
+ }
+
+ if (RETURN_VALUE_USED(opline)) {
diff --git a/php-bug72910.patch b/php-bug72910.patch
new file mode 100644
index 0000000..2ed4285
--- /dev/null
+++ b/php-bug72910.patch
@@ -0,0 +1,36 @@
+Backported from 5.6.26 by Remi.
+
+From 486056b2153f7177cd8a7c78d93968726ee8fa65 Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas at php.net>
+Date: Thu, 1 Sep 2016 23:27:06 -0700
+Subject: [PATCH] Fix bug #72910
+
+Merge upstream patch from https://github.com/kkos/oniguruma/commit/65bdf2a0d160d06556415e5f396a75f6b11bad5c
+
+From b570c506815212c7702bfb0046e87d541e171eb7 Mon Sep 17 00:00:00 2001
+From: Stanislav Malyshev <stas at php.net>
+Date: Sun, 4 Sep 2016 19:13:22 -0700
+Subject: [PATCH] Sync fix for bug #72910 with current upstream
+
+Source: Remi Collet scl-php55, https://git.remirepo.net/cgit/rpms/scl-php55/php.git/tree/bug72910.patch
+---
+diff --git a/ext/mbstring/oniguruma/enc/utf8.c b/ext/mbstring/oniguruma/enc/utf8.c
+--- a/ext/mbstring/oniguruma/enc/utf8.c
++++ b/ext/mbstring/oniguruma/enc/utf8.c
+@@ -91,12 +91,14 @@ is_mbc_newline(const UChar* p, const UChar* end)
+ }
+
+ static OnigCodePoint
+-mbc_to_code(const UChar* p, const UChar* end ARG_UNUSED)
++mbc_to_code(const UChar* p, const UChar* end)
+ {
+ int c, len;
+ OnigCodePoint n;
+
+- len = enclen(ONIG_ENCODING_UTF8, p);
++ len = mbc_enc_len(p);
++ if (len > end - p) len = end - p;
++
+ c = *p++;
+ if (len > 1) {
+ len--;
diff --git a/php-bug72926.patch b/php-bug72926.patch
new file mode 100644
index 0000000..7b7f7e4
--- /dev/null
+++ b/php-bug72926.patch
@@ -0,0 +1,22 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Sun Sep 4 20:49:34 2016 -0700
+Subject: [PATCH] Same issue as #72926 in another place.
+
+5.5 backport: https://github.com/shivammathur/php-src-backports/commit/f931d7eedaaf74d99cab0dbfb360d7601a819ec1
+---
+diff --git a/ext/exif/exif.c b/ext/exif/exif.c
+--- a/ext/exif/exif.c
++++ b/ext/exif/exif.c
+@@ -3767,8 +3767,11 @@ static int exif_process_IFD_in_TIFF(image_info_type *ImageInfo, size_t dir_offse
+ fgot = php_stream_read(ImageInfo->infile, ImageInfo->Thumbnail.data, ImageInfo->Thumbnail.size);
+ if (fgot < ImageInfo->Thumbnail.size) {
+ EXIF_ERRLOG_THUMBEOF(ImageInfo)
++ efree(ImageInfo->Thumbnail.data);
++ ImageInfo->Thumbnail.data = NULL;
++ } else {
++ exif_thumbnail_build(ImageInfo TSRMLS_CC);
+ }
+- exif_thumbnail_build(ImageInfo TSRMLS_CC);
+ }
+ }
+ }
diff --git a/php-bug72928.patch b/php-bug72928.patch
new file mode 100644
index 0000000..705aedb
--- /dev/null
+++ b/php-bug72928.patch
@@ -0,0 +1,102 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Sun Sep 4 22:07:35 2016 -0700
+Subject: [PATCH] Fix bug #72928 - Out of bound when verify signature of zip phar in phar_parse_zipfile
+
+5.5 backport: https://github.com/shivammathur/php-src-backports/commit/653a06552e2bba2758993e1603f08800f44bc987
+Binary test fixtures not included: ext/phar/tests/bug72928.zip
+---
+diff --git a/ext/phar/tests/bug72928.phpt b/ext/phar/tests/bug72928.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/phar/tests/bug72928.phpt
+@@ -0,0 +1,18 @@
++--TEST--
++Phar: #72928 (Out of bound when verify signature of zip phar in phar_parse_zipfile)
++--SKIPIF--
++<?php if (!extension_loaded("phar")) die("skip"); ?>
++--FILE--
++<?php
++chdir(__DIR__);
++try {
++$phar = new PharData('bug72928.zip');
++var_dump($phar);
++} catch(UnexpectedValueException $e) {
++ print $e->getMessage()."\n";
++}
++?>
++DONE
++--EXPECTF--
++phar error: signature cannot be read in zip-based phar "%sbug72928.zip"
++DONE
+\ No newline at end of file
+diff --git a/ext/phar/util.c b/ext/phar/util.c
+--- a/ext/phar/util.c
++++ b/ext/phar/util.c
+@@ -1657,6 +1657,13 @@ int phar_verify_signature(php_stream *fp, size_t end_of_phar, php_uint32 sig_typ
+ unsigned char digest[64];
+ PHP_SHA512_CTX context;
+
++ if (sig_len < sizeof(digest)) {
++ if (error) {
++ spprintf(error, 0, "broken signature");
++ }
++ return FAILURE;
++ }
++
+ PHP_SHA512Init(&context);
+ read_len = end_of_phar;
+
+@@ -1690,6 +1697,13 @@ int phar_verify_signature(php_stream *fp, size_t end_of_phar, php_uint32 sig_typ
+ unsigned char digest[32];
+ PHP_SHA256_CTX context;
+
++ if (sig_len < sizeof(digest)) {
++ if (error) {
++ spprintf(error, 0, "broken signature");
++ }
++ return FAILURE;
++ }
++
+ PHP_SHA256Init(&context);
+ read_len = end_of_phar;
+
+@@ -1731,6 +1745,13 @@ int phar_verify_signature(php_stream *fp, size_t end_of_phar, php_uint32 sig_typ
+ unsigned char digest[20];
+ PHP_SHA1_CTX context;
+
++ if (sig_len < sizeof(digest)) {
++ if (error) {
++ spprintf(error, 0, "broken signature");
++ }
++ return FAILURE;
++ }
++
+ PHP_SHA1Init(&context);
+ read_len = end_of_phar;
+
+@@ -1764,6 +1785,13 @@ int phar_verify_signature(php_stream *fp, size_t end_of_phar, php_uint32 sig_typ
+ unsigned char digest[16];
+ PHP_MD5_CTX context;
+
++ if (sig_len < sizeof(digest)) {
++ if (error) {
++ spprintf(error, 0, "broken signature");
++ }
++ return FAILURE;
++ }
++
+ PHP_MD5Init(&context);
+ read_len = end_of_phar;
+
+diff --git a/ext/phar/zip.c b/ext/phar/zip.c
+--- a/ext/phar/zip.c
++++ b/ext/phar/zip.c
+@@ -430,7 +430,7 @@ foundit:
+ php_stream_seek(fp, sizeof(phar_zip_file_header) + entry.header_offset + entry.filename_len + PHAR_GET_16(zipentry.extra_len), SEEK_SET);
+ sig = (char *) emalloc(entry.uncompressed_filesize);
+ read = php_stream_read(fp, sig, entry.uncompressed_filesize);
+- if (read != entry.uncompressed_filesize) {
++ if (read != entry.uncompressed_filesize || read <= 8) {
+ php_stream_close(sigfile);
+ efree(sig);
+ PHAR_ZIP_FAIL("signature cannot be read");
diff --git a/php-bug72994.patch b/php-bug72994.patch
new file mode 100644
index 0000000..f5fb1a0
--- /dev/null
+++ b/php-bug72994.patch
@@ -0,0 +1,54 @@
+From b7259b71b430ed733441261f7cf1282f04bb80f1 Mon Sep 17 00:00:00 2001
+From: "Christoph M. Becker" <cmbecker69 at gmx.de>
+Date: Sun, 4 Sep 2016 16:37:06 +0200
+Subject: [PATCH] Fix #72994: mbc_to_code() out of bounds read
+
+We're backporting commit 999a3553 to the still supported PHP 5.6.
+
+Source: upstream https://github.com/php/php-src/commit/b7259b71b4 (5.6.27)
+---
+diff --git a/ext/mbstring/php_mbregex.c b/ext/mbstring/php_mbregex.c
+--- a/ext/mbstring/php_mbregex.c
++++ b/ext/mbstring/php_mbregex.c
+@@ -811,7 +811,7 @@ static void _php_mb_regex_ereg_replace_exec(INTERNAL_FUNCTION_PARAMETERS, OnigOp
+ OnigUChar *pos;
+ OnigUChar *string_lim;
+ char *description = NULL;
+- char pat_buf[2];
++ char pat_buf[6];
+
+ const mbfl_encoding *enc;
+
+@@ -862,6 +862,10 @@ static void _php_mb_regex_ereg_replace_exec(INTERNAL_FUNCTION_PARAMETERS, OnigOp
+ convert_to_long_ex(arg_pattern_zval);
+ pat_buf[0] = (char)Z_LVAL_PP(arg_pattern_zval);
+ pat_buf[1] = '\0';
++ pat_buf[2] = '\0';
++ pat_buf[3] = '\0';
++ pat_buf[4] = '\0';
++ pat_buf[5] = '\0';
+
+ arg_pattern = pat_buf;
+ arg_pattern_len = 1;
+diff --git a/ext/mbstring/tests/bug72994.phpt b/ext/mbstring/tests/bug72994.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/mbstring/tests/bug72994.phpt
+@@ -0,0 +1,17 @@
++--TEST--
++Bug #72994 (mbc_to_code() out of bounds read)
++--SKIPIF--
++<?php
++if (!extension_loaded('mbstring')) die('skip mbstring extension not available');
++if (!function_exists('mbereg_replace')) die('skip mbereg_replace() not available');
++?>
++--FILE--
++<?php
++$var1 = mbereg_replace($var-232338951,NULL,NULL,NULL);
++var_dump($var1);
++?>
++===DONE===
++--EXPECTF--
++Notice: Undefined variable: var in %s on line %d
++string(0) ""
++===DONE===
diff --git a/php-bug73003.patch b/php-bug73003.patch
new file mode 100644
index 0000000..f096c9b
--- /dev/null
+++ b/php-bug73003.patch
@@ -0,0 +1,27 @@
+From: Christoph M. Becker <cmbecker69 at gmx.de>
+Date: Fri Sep 16 11:31:21 2016 +0200
+Subject: [PATCH] Fix #73003: Integer Overflow in gdImageWebpCtx of gd_webp.c
+
+We add the missing integer overflow check to avoid potential buffer overflows.
+
+5.5 backport: https://github.com/shivammathur/php-src-backports/commit/5bec2c41cebd1b36d23d7d95ea104c24034252db
+---
+diff --git a/ext/gd/libgd/gd_webp.c b/ext/gd/libgd/gd_webp.c
+--- a/ext/gd/libgd/gd_webp.c
++++ b/ext/gd/libgd/gd_webp.c
+@@ -180,6 +180,15 @@ void gdImageWebpCtx (gdImagePtr im, gdIOCtx * outfile, int quantization)
+ /* Conversion to Y,U,V buffer */
+ yuv_width = (width + 1) >> 1;
+ yuv_height = (height + 1) >> 1;
++
++ if (overflow2(width, height)) {
++ return;
++ }
++ /* simplification possible, because WebP must not be larger than 16384**2 */
++ if (overflow2(width * height, 2 * sizeof(unsigned char))) {
++ return;
++ }
++
+ yuv_nbytes = width * height + 2 * yuv_width * yuv_height;
+
+ if ((Y = (unsigned char *)gdCalloc(yuv_nbytes, sizeof(unsigned char))) == NULL) {
diff --git a/php-bug73007.patch b/php-bug73007.patch
new file mode 100644
index 0000000..098cdf8
--- /dev/null
+++ b/php-bug73007.patch
@@ -0,0 +1,18 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Mon Sep 5 18:01:35 2016 -0700
+Subject: [PATCH] Fix bug #73007: add locale length check
+
+5.5 backport: https://github.com/shivammathur/php-src-backports/commit/d632ef5b8e23d81a8780d3b09275f2e2be08139f
+---
+diff --git a/ext/intl/msgformat/msgformat_format.c b/ext/intl/msgformat/msgformat_format.c
+--- a/ext/intl/msgformat/msgformat_format.c
++++ b/ext/intl/msgformat/msgformat_format.c
+@@ -118,6 +118,8 @@ PHP_FUNCTION( msgfmt_format_message )
+ RETURN_FALSE;
+ }
+
++ INTL_CHECK_LOCALE_LEN(slocale_len);
++
+ msgformat_data_init(&mfo->mf_data TSRMLS_CC);
+
+ if(pattern && pattern_len) {
diff --git a/php-bug73017.patch b/php-bug73017.patch
new file mode 100644
index 0000000..e25b37c
--- /dev/null
+++ b/php-bug73017.patch
@@ -0,0 +1,53 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Mon Oct 3 18:06:59 2016 -0700
+Subject: [PATCH] Really fix bug #73017
+
+5.5 backport: https://github.com/shivammathur/php-src-backports/commit/c4e902a74be8af8b673fc45e47733629f234eb68
+---
+diff --git a/ext/standard/string.c b/ext/standard/string.c
+--- a/ext/standard/string.c
++++ b/ext/standard/string.c
+@@ -891,11 +891,12 @@ PHP_FUNCTION(wordwrap)
+ {
+ const char *text, *breakchar = "\n";
+ char *newtext;
+- int textlen, breakcharlen = 1, newtextlen, chk;
++ int textlen, breakcharlen = 1, chk;
+ size_t alloced;
+- long current = 0, laststart = 0, lastspace = 0;
++ size_t current = 0, laststart = 0, lastspace = 0;
+ long linelength = 75;
+ zend_bool docut = 0;
++ size_t newtextlen;
+
+ if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|lsb", &text, &textlen, &linelength, &breakchar, &breakcharlen, &docut) == FAILURE) {
+ return;
+@@ -915,6 +916,15 @@ PHP_FUNCTION(wordwrap)
+ RETURN_FALSE;
+ }
+
++ if (linelength < 0) {
++ /* For BC */
++ linelength = 0;
++ }
++ if (linelength > INT_MAX) {
++ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Length should be between 0 and %d", INT_MAX);
++ RETURN_FALSE;
++ }
++
+ /* Special case for a single-character break as it needs no
+ additional storage space */
+ if (breakcharlen == 1 && !docut) {
+@@ -942,10 +952,10 @@ PHP_FUNCTION(wordwrap)
+ if (linelength > 0) {
+ chk = (int)(textlen/linelength + 1);
+ newtext = safe_emalloc(chk, breakcharlen, textlen + 1);
+- alloced = textlen + chk * breakcharlen + 1;
++ alloced = (size_t)textlen + chk * (size_t)breakcharlen + 1;
+ } else {
+ chk = textlen;
+- alloced = textlen * (breakcharlen + 1) + 1;
++ alloced = (size_t)textlen * ((size_t)breakcharlen + 1) + 1;
+ newtext = safe_emalloc(textlen, (breakcharlen + 1), 1);
+ }
+
diff --git a/php-bug73029.patch b/php-bug73029.patch
new file mode 100644
index 0000000..4da2459
--- /dev/null
+++ b/php-bug73029.patch
@@ -0,0 +1,69 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Sun Sep 11 20:24:13 2016 -0700
+Subject: [PATCH] Fix bug #73029 - Missing type check when unserializing SplArray
+
+5.5 backport: https://github.com/shivammathur/php-src-backports/commit/b40da4fdbf8fb642840bb576002ea40856f7b704
+---
+diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
+--- a/ext/spl/spl_array.c
++++ b/ext/spl/spl_array.c
+@@ -306,7 +306,7 @@ static zval **spl_array_get_dimension_ptr_ptr(int check_inherited, zval *object,
+ long index;
+ HashTable *ht = spl_array_get_hash_table(intern, 0 TSRMLS_CC);
+
+- if (!offset) {
++ if (!offset || !ht) {
+ return &EG(uninitialized_zval_ptr);
+ }
+
+@@ -1796,7 +1796,9 @@ SPL_METHOD(Array, unserialize)
+ intern->ar_flags |= flags & SPL_ARRAY_CLONE_MASK;
+ zval_ptr_dtor(&intern->array);
+ ALLOC_INIT_ZVAL(intern->array);
+- if (!php_var_unserialize(&intern->array, &p, s + buf_len, &var_hash TSRMLS_CC)) {
++ if (!php_var_unserialize(&intern->array, &p, s + buf_len, &var_hash TSRMLS_CC)
++ || (Z_TYPE_P(intern->array) != IS_ARRAY && Z_TYPE_P(intern->array) != IS_OBJECT)) {
++ zval_ptr_dtor(&intern->array);
+ goto outexcept;
+ }
+ var_push_dtor(&var_hash, &intern->array);
+diff --git a/ext/spl/tests/bug70068.phpt b/ext/spl/tests/bug70068.phpt
+--- a/ext/spl/tests/bug70068.phpt
++++ b/ext/spl/tests/bug70068.phpt
+@@ -2,8 +2,11 @@
+ Bug #70068 (Dangling pointer in the unserialization of ArrayObject items)
+ --FILE--
+ <?php
++try {
+ $a = unserialize('a:3:{i:0;C:11:"ArrayObject":20:{x:i:0;r:3;;m:a:0:{};}i:1;d:11;i:2;S:31:"AAAAAAAABBBBCCCC\01\00\00\00\04\00\00\00\00\00\00\00\00\00\00";}');
++} catch (UnexpectedValueException $e) {
++ echo "Rejected malformed ArrayObject\n";
++}
+ ?>
+-OK
+ --EXPECT--
+-OK
+\ No newline at end of file
++Rejected malformed ArrayObject
+\ No newline at end of file
+diff --git a/ext/spl/tests/bug73029.phpt b/ext/spl/tests/bug73029.phpt
+new file mode 100644
+--- /dev/null
++++ b/ext/spl/tests/bug73029.phpt
+@@ -0,0 +1,16 @@
++--TEST--
++Bug #73029: Missing type check when unserializing SplArray
++--FILE--
++<?php
++try {
++$a = 'C:11:"ArrayObject":19:0x:i:0;r:2;;m:a:0:{}}';
++$m = unserialize($a);
++$x = $m[2];
++} catch(UnexpectedValueException $e) {
++ print $e->getMessage() . "\n";
++}
++?>
++DONE
++--EXPECTF--
++Error at offset 10 of 19 bytes
++DONE
diff --git a/php-bug73035.patch b/php-bug73035.patch
new file mode 100644
index 0000000..4b0dc38
--- /dev/null
+++ b/php-bug73035.patch
@@ -0,0 +1,18 @@
+From: Stanislav Malyshev <stas at php.net>
+Date: Sun Sep 11 21:37:44 2016 -0700
+Subject: [PATCH] Fix bug #73035 (Out of bound when verify signature of tar phar in phar_parse_tarfile)
<Skipped 19924 lines>
================================================================
---- gitweb:
http://git.pld-linux.org/gitweb.cgi/packages/php.git/commitdiff/4b8db7eb5e6f8dce26050f40a238e62ede49c837
More information about the pld-cvs-commit
mailing list