[packages/php/PHP_5_3] Rel 73; security fixes from php-src-backports 5.3 branch and php-src, CVE-2026-109618 as soft memory
arekm
arekm at pld-linux.org
Thu Oct 22 12:22:45 CEST 2026
commit ff4407b2ee5a421cabdee0b8621d820bccc242a9
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date: Thu Oct 22 12:21:44 2026 +0200
Rel 73; security fixes from php-src-backports 5.3 branch and php-src, CVE-2026-109618 as soft memory limit
mysql-devel < 8.0: builders resolve the bare BR to mysql 9.7, which 5.3 does not build with
CVE-2019-11043.patch | 22 -
php-5.3.29-CVE-2014-3597.patch | 256 -
php-5.3.29-CVE-2014-8142.patch | 53 -
php-5.3.29-CVE-2015-0231.patch | 53 -
php-5.3.29-CVE-2015-0232.patch | Bin 3127 -> 0 bytes
php-5.3.29-CVE-2025-14177.patch | 35 +
php-5.3.29-CVE-2025-1735.patch | 205 +
php-5.3.29-CVE-2025-1736.patch | 69 +
php-5.3.29-CVE-2026-109618.patch | 428 +
php-5.3.29-CVE-2026-6722.patch | 168 +
php-5.3.29-CVE-2026-7258.patch | 29 +
php-5.3.29-CVE-2026-7568.patch | 28 +
php-5.3.29-GHSA-ch8v-r6jh-4vvr.patch | 15 +
php-5.3.29-GHSA-wg4p-4hqh-c3g9.patch | 81 +
php-5.3.29-GHSA-www2-q4fc-65wf.patch | 83 +
php-5.3.29-libmagic-bug68819-71527.patch | 30 +
php-5.3.29-security-backports.patch | 37504 +++++++++++++++++++++++++++++
php-5.3.3-CVE-2011-4153.patch | 29 -
php-5.3.3-CVE-2014-2497.patch | 40 -
php-5.3.3-CVE-2014-3668.patch | 118 -
php-5.3.3-CVE-2014-3669.patch | 63 -
php-5.3.3-CVE-2014-3670.patch | 38 -
php-5.3.3-CVE-2014-4670.patch | 70 -
php-5.3.3-CVE-2014-4698.patch | 60 -
php.spec | 60 +-
25 files changed, 38703 insertions(+), 834 deletions(-)
---
diff --git a/php.spec b/php.spec
index c420284..d104883 100644
--- a/php.spec
+++ b/php.spec
@@ -143,7 +143,7 @@ ERROR: You need to select at least one Apache SAPI to build shared modules.
%undefine with_alternatives
%endif
-%define rel 72
+%define rel 73
%define orgname php
%define ver_suffix 53
%define php_suffix %{!?with_default_php:%{ver_suffix}}
@@ -257,23 +257,20 @@ Patch80: configure.patch
Patch81: types.patch
Patch82: includes.patch
# Fixes for security bugs
-# https://repo.webtatic.com/yum/centos/5/SRPMS/repoview/php.html
-# also from RHEL6/CentOS7
-Patch220: php-5.3.3-CVE-2011-4153.patch
-Patch221: CVE-2019-11043.patch
-
-Patch247: php-5.3.3-CVE-2014-2497.patch
-
-Patch249: php-5.3.29-CVE-2014-3597.patch
-Patch250: php-5.3.3-CVE-2014-4698.patch
-Patch251: php-5.3.3-CVE-2014-4670.patch
-Patch252: php-5.3.3-CVE-2014-3668.patch
-Patch253: php-5.3.3-CVE-2014-3669.patch
-Patch254: php-5.3.3-CVE-2014-3670.patch
-
-Patch256: php-5.3.29-CVE-2014-8142.patch
-Patch257: php-5.3.29-CVE-2015-0231.patch
-Patch258: php-5.3.29-CVE-2015-0232.patch
+# https://github.com/shivammathur/php-src-backports/tree/PHP-5.3-security-backports
+Patch220: php-5.3.29-security-backports.patch
+# backports of php-src fixes missing in the above
+Patch221: php-5.3.29-libmagic-bug68819-71527.patch
+Patch222: php-5.3.29-CVE-2025-1736.patch
+Patch223: php-5.3.29-GHSA-ch8v-r6jh-4vvr.patch
+Patch224: php-5.3.29-CVE-2026-7258.patch
+Patch225: php-5.3.29-CVE-2026-7568.patch
+Patch226: php-5.3.29-CVE-2025-14177.patch
+Patch227: php-5.3.29-GHSA-www2-q4fc-65wf.patch
+Patch228: php-5.3.29-GHSA-wg4p-4hqh-c3g9.patch
+Patch229: php-5.3.29-CVE-2025-1735.patch
+Patch230: php-5.3.29-CVE-2026-6722.patch
+Patch231: php-5.3.29-CVE-2026-109618.patch
URL: https://www.php.net/
%{?with_interbase:%{!?with_interbase_inst:BuildRequires: Firebird-devel >= 1.0.2.908-2}}
%{?with_pspell:BuildRequires: aspell-devel >= 2:0.50.0}
@@ -291,7 +288,7 @@ BuildRequires: file
%{?with_kerberos5:BuildRequires: heimdal-devel}
BuildRequires: libatomic-devel
%{?with_system_libzip:BuildRequires: libzip-devel >= 0.10-3}
-BuildRequires: mysql-devel
+BuildRequires: mysql-devel < 8.0
BuildRequires: pkgconfig
BuildRequires: re2c
BuildRequires: sed >= 4.0
@@ -2181,19 +2178,18 @@ gzip -dc %{SOURCE15} | tar xf - -C sapi/
%patch -P220 -p1
%patch -P221 -p1
-
-%patch -P247 -p1
-
-%patch -P249 -p1
-%patch -P250 -p1
-%patch -P251 -p1
-%patch -P252 -p1
-%patch -P253 -p1
-%patch -P254 -p1
-
-%patch -P256 -p1
-%patch -P257 -p1
-%patch -P258 -p1
+%patch -P222 -p1
+%patch -P223 -p1
+%patch -P224 -p1
+%patch -P225 -p1
+%patch -P226 -p1
+%patch -P227 -p1
+%patch -P228 -p1
+%patch -P229 -p1
+%patch -P230 -p1
+%patch -P231 -p1
+# the patches carry the regenerated scanners, keep make from rebuilding them
+touch ext/date/lib/parse_date.c ext/standard/var_unserializer.c Zend/zend_ini_parser.c
sed -E -i -e '1s,#!\s*/usr/bin/env\s+(.*),#!%{__bindir}\1,' \
run-tests.php
diff --git a/CVE-2019-11043.patch b/CVE-2019-11043.patch
deleted file mode 100644
index a841677..0000000
--- a/CVE-2019-11043.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-commit ab061f95ca966731b1c84cf5b7b20155c0a1c06a
-Author: Jakub Zelenka <bukka at php.net>
-Date: Sat Oct 12 15:56:16 2019 +0100
-
- Fix bug #78599 (env_path_info underflow can lead to RCE) (CVE-2019-11043)
-
-diff --git a/sapi/fpm/fpm/fpm_main.c b/sapi/fpm/fpm/fpm_main.c
-index 24a7e5d56a..50f92981f1 100644
---- a/sapi/fpm/fpm/fpm_main.c
-+++ b/sapi/fpm/fpm/fpm_main.c
-@@ -1209,8 +1209,8 @@ static void init_request_info(void)
- path_info = script_path_translated + ptlen;
- tflag = (slen != 0 && (!orig_path_info || strcmp(orig_path_info, path_info) != 0));
- } else {
-- path_info = env_path_info ? env_path_info + pilen - slen : NULL;
-- tflag = (orig_path_info != path_info);
-+ path_info = (env_path_info && pilen > slen) ? env_path_info + pilen - slen : NULL;
-+ tflag = path_info && (orig_path_info != path_info);
- }
-
- if (tflag) {
-
diff --git a/php-5.3.29-CVE-2014-3597.patch b/php-5.3.29-CVE-2014-3597.patch
deleted file mode 100644
index faaece3..0000000
--- a/php-5.3.29-CVE-2014-3597.patch
+++ /dev/null
@@ -1,256 +0,0 @@
---- a/ext/standard/dns.c 2014-08-13 19:22:50.000000000 +0000
-+++ b/ext/standard/dns.c 2014-10-12 20:00:54.000000000 +0000
-@@ -412,8 +412,14 @@
-
- #if HAVE_FULL_DNS_FUNCS
-
-+#define CHECKCP(n) do { \
-+ if (cp + n > end) { \
-+ return NULL; \
-+ } \
-+} while (0)
-+
- /* {{{ php_parserr */
--static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int store, zval **subarray)
-+static u_char *php_parserr(u_char *cp, u_char *end, querybuf *answer, int type_to_fetch, int store, zval **subarray)
- {
- u_short type, class, dlen;
- u_long ttl;
-@@ -425,16 +431,18 @@
-
- *subarray = NULL;
-
-- n = dn_expand(answer->qb2, answer->qb2+65536, cp, name, sizeof(name) - 2);
-+ n = dn_expand(answer->qb2, end, cp, name, sizeof(name) - 2);
- if (n < 0) {
- return NULL;
- }
- cp += n;
-
-+ CHECKCP(10);
- GETSHORT(type, cp);
- GETSHORT(class, cp);
- GETLONG(ttl, cp);
- GETSHORT(dlen, cp);
-+ CHECKCP(dlen);
- if (type_to_fetch != T_ANY && type != type_to_fetch) {
- cp += dlen;
- return cp;
-@@ -451,12 +459,14 @@
- add_assoc_string(*subarray, "host", name, 1);
- switch (type) {
- case DNS_T_A:
-+ CHECKCP(4);
- add_assoc_string(*subarray, "type", "A", 1);
- snprintf(name, sizeof(name), "%d.%d.%d.%d", cp[0], cp[1], cp[2], cp[3]);
- add_assoc_string(*subarray, "ip", name, 1);
- cp += dlen;
- break;
- case DNS_T_MX:
-+ CHECKCP(2);
- add_assoc_string(*subarray, "type", "MX", 1);
- GETSHORT(n, cp);
- add_assoc_long(*subarray, "pri", n);
-@@ -475,7 +485,7 @@
- if (type == DNS_T_PTR) {
- add_assoc_string(*subarray, "type", "PTR", 1);
- }
-- n = dn_expand(answer->qb2, answer->qb2+65536, cp, name, (sizeof name) - 2);
-+ n = dn_expand(answer->qb2, end, cp, name, (sizeof name) - 2);
- if (n < 0) {
- return NULL;
- }
-@@ -485,18 +495,22 @@
- case DNS_T_HINFO:
- /* See RFC 1010 for values */
- add_assoc_string(*subarray, "type", "HINFO", 1);
-+ CHECKCP(1);
- n = *cp & 0xFF;
- cp++;
-+ CHECKCP(n);
- add_assoc_stringl(*subarray, "cpu", (char*)cp, n, 1);
- cp += n;
-+ CHECKCP(1);
- n = *cp & 0xFF;
- cp++;
-+ CHECKCP(n);
- add_assoc_stringl(*subarray, "os", (char*)cp, n, 1);
- cp += n;
- break;
- case DNS_T_TXT:
- {
-- int ll = 0;
-+ int l1 = 0, l2 = 0;
- zval *entries = NULL;
-
- add_assoc_string(*subarray, "type", "TXT", 1);
-@@ -505,37 +519,42 @@
- MAKE_STD_ZVAL(entries);
- array_init(entries);
-
-- while (ll < dlen) {
-- n = cp[ll];
-- if ((ll + n) >= dlen) {
-+ while (l1 < dlen) {
-+ n = cp[l1];
-+ if ((l1 + n) >= dlen) {
- // Invalid chunk length, truncate
-- n = dlen - (ll + 1);
-+ n = dlen - (l1 + 1);
-+ }
-+ if (n) {
-+ memcpy(tp + l2 , cp + l1 + 1, n);
-+ add_next_index_stringl(entries, cp + l1 + 1, n, 1);
- }
-- memcpy(tp + ll , cp + ll + 1, n);
-- add_next_index_stringl(entries, cp + ll + 1, n, 1);
-- ll = ll + n + 1;
-+ l1 = l1 + n + 1;
-+ l2 = l2 + n;
- }
- tp[dlen] = '\0';
-+ tp[l2] = '\0';
- cp += dlen;
-
-- add_assoc_stringl(*subarray, "txt", tp, (dlen>0)?dlen - 1:0, 0);
-+ add_assoc_stringl(*subarray, "txt", tp, l2, 0);
- add_assoc_zval(*subarray, "entries", entries);
- }
- break;
- case DNS_T_SOA:
- add_assoc_string(*subarray, "type", "SOA", 1);
-- n = dn_expand(answer->qb2, answer->qb2+65536, cp, name, (sizeof name) -2);
-+ n = dn_expand(answer->qb2, end, cp, name, (sizeof name) -2);
- if (n < 0) {
- return NULL;
- }
- cp += n;
- add_assoc_string(*subarray, "mname", name, 1);
-- n = dn_expand(answer->qb2, answer->qb2+65536, cp, name, (sizeof name) -2);
-+ n = dn_expand(answer->qb2, end, cp, name, (sizeof name) -2);
- if (n < 0) {
- return NULL;
- }
- cp += n;
- add_assoc_string(*subarray, "rname", name, 1);
-+ CHECKCP(5*4);
- GETLONG(n, cp);
- add_assoc_long(*subarray, "serial", n);
- GETLONG(n, cp);
-@@ -549,6 +568,7 @@
- break;
- case DNS_T_AAAA:
- tp = (u_char*)name;
-+ CHECKCP(8*2);
- for(i=0; i < 8; i++) {
- GETSHORT(s, cp);
- if (s != 0) {
-@@ -583,6 +603,7 @@
- case DNS_T_A6:
- p = cp;
- add_assoc_string(*subarray, "type", "A6", 1);
-+ CHECKCP(1);
- n = ((int)cp[0]) & 0xFF;
- cp++;
- add_assoc_long(*subarray, "masklen", n);
-@@ -618,6 +639,7 @@
- cp++;
- }
- for (i = (n + 8) / 16; i < 8; i++) {
-+ CHECKCP(2);
- GETSHORT(s, cp);
- if (s != 0) {
- if (tp > (u_char *)name) {
-@@ -647,7 +669,7 @@
- tp[0] = '\0';
- add_assoc_string(*subarray, "ipv6", name, 1);
- if (cp < p + dlen) {
-- n = dn_expand(answer->qb2, answer->qb2+65536, cp, name, (sizeof name) - 2);
-+ n = dn_expand(answer->qb2, end, cp, name, (sizeof name) - 2);
- if (n < 0) {
- return NULL;
- }
-@@ -656,6 +678,7 @@
- }
- break;
- case DNS_T_SRV:
-+ CHECKCP(3*2);
- add_assoc_string(*subarray, "type", "SRV", 1);
- GETSHORT(n, cp);
- add_assoc_long(*subarray, "pri", n);
-@@ -663,7 +686,7 @@
- add_assoc_long(*subarray, "weight", n);
- GETSHORT(n, cp);
- add_assoc_long(*subarray, "port", n);
-- n = dn_expand(answer->qb2, answer->qb2+65536, cp, name, (sizeof name) - 2);
-+ n = dn_expand(answer->qb2, end, cp, name, (sizeof name) - 2);
- if (n < 0) {
- return NULL;
- }
-@@ -671,21 +694,35 @@
- add_assoc_string(*subarray, "target", name, 1);
- break;
- case DNS_T_NAPTR:
-+ CHECKCP(2*2);
- add_assoc_string(*subarray, "type", "NAPTR", 1);
- GETSHORT(n, cp);
- add_assoc_long(*subarray, "order", n);
- GETSHORT(n, cp);
- add_assoc_long(*subarray, "pref", n);
-+
-+ CHECKCP(1);
- n = (cp[0] & 0xFF);
-- add_assoc_stringl(*subarray, "flags", (char*)++cp, n, 1);
-+ cp++;
-+ CHECKCP(n);
-+ add_assoc_stringl(*subarray, "flags", (char*)cp, n, 1);
- cp += n;
-+
-+ CHECKCP(1);
- n = (cp[0] & 0xFF);
-- add_assoc_stringl(*subarray, "services", (char*)++cp, n, 1);
-+ cp++;
-+ CHECKCP(n);
-+ add_assoc_stringl(*subarray, "services", (char*)cp, n, 1);
- cp += n;
-+
-+ CHECKCP(1);
- n = (cp[0] & 0xFF);
-- add_assoc_stringl(*subarray, "regex", (char*)++cp, n, 1);
-+ cp++;
-+ CHECKCP(n);
-+ add_assoc_stringl(*subarray, "regex", (char*)cp, n, 1);
- cp += n;
-- n = dn_expand(answer->qb2, answer->qb2+65536, cp, name, (sizeof name) - 2);
-+
-+ n = dn_expand(answer->qb2, end, cp, name, (sizeof name) - 2);
- if (n < 0) {
- return NULL;
- }
-@@ -852,7 +889,7 @@
- while (an-- && cp && cp < end) {
- zval *retval;
-
-- cp = php_parserr(cp, &answer, type_to_fetch, store_results, &retval);
-+ cp = php_parserr(cp, end, &answer, type_to_fetch, store_results, &retval);
- if (retval != NULL && store_results) {
- add_next_index_zval(return_value, retval);
- }
-@@ -865,7 +902,7 @@
- while (ns-- > 0 && cp && cp < end) {
- zval *retval = NULL;
-
-- cp = php_parserr(cp, &answer, DNS_T_ANY, authns != NULL, &retval);
-+ cp = php_parserr(cp, end, &answer, DNS_T_ANY, authns != NULL, &retval);
- if (retval != NULL) {
- add_next_index_zval(authns, retval);
- }
-@@ -877,7 +914,7 @@
- while (ar-- > 0 && cp && cp < end) {
- zval *retval = NULL;
-
-- cp = php_parserr(cp, &answer, DNS_T_ANY, 1, &retval);
-+ cp = php_parserr(cp, end, &answer, DNS_T_ANY, 1, &retval);
- if (retval != NULL) {
- add_next_index_zval(addtl, retval);
- }
diff --git a/php-5.3.29-CVE-2014-8142.patch b/php-5.3.29-CVE-2014-8142.patch
deleted file mode 100644
index c5efe43..0000000
--- a/php-5.3.29-CVE-2014-8142.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-diff -Naur php-5.3.29-original/ext/standard/tests/serialize/bug68594.phpt php-5.3.29/ext/standard/tests/serialize/bug68594.phpt
---- php-5.3.29-original/ext/standard/tests/serialize/bug68594.phpt 1970-01-01 00:00:00.000000000 +0000
-+++ php-5.3.29/ext/standard/tests/serialize/bug68594.phpt 2015-01-24 13:14:16.222248839 +0000
-@@ -0,0 +1,23 @@
-+--TEST--
-+Bug #68545 Use after free vulnerability in unserialize()
-+--FILE--
-+<?php
-+for ($i=4; $i<100; $i++) {
-+ $m = new StdClass();
-+
-+ $u = array(1);
-+
-+ $m->aaa = array(1,2,&$u,4,5);
-+ $m->bbb = 1;
-+ $m->ccc = &$u;
-+ $m->ddd = str_repeat("A", $i);
-+
-+ $z = serialize($m);
-+ $z = str_replace("bbb", "aaa", $z);
-+ $y = unserialize($z);
-+ $z = serialize($y);
-+}
-+?>
-+===DONE===
-+--EXPECTF--
-+===DONE===
-diff -Naur php-5.3.29-original/ext/standard/var_unserializer.c php-5.3.29/ext/standard/var_unserializer.c
---- php-5.3.29-original/ext/standard/var_unserializer.c 2015-01-24 13:05:17.310236430 +0000
-+++ php-5.3.29/ext/standard/var_unserializer.c 2015-01-24 13:09:14.269241886 +0000
-@@ -298,6 +298,9 @@
- } else {
- /* object properties should include no integers */
- convert_to_string(key);
-+ if (zend_symtable_find(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, (void **)&old_data)==SUCCESS) {
-+ var_push_dtor(var_hash, old_data);
-+ }
- zend_hash_update(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, &data,
- sizeof data, NULL);
- }
-diff -Naur php-5.3.29-original/ext/standard/var_unserializer.re php-5.3.29/ext/standard/var_unserializer.re
---- php-5.3.29-original/ext/standard/var_unserializer.re 2015-01-24 13:05:17.310236430 +0000
-+++ php-5.3.29/ext/standard/var_unserializer.re 2015-01-24 13:07:59.593240167 +0000
-@@ -304,6 +304,9 @@
- } else {
- /* object properties should include no integers */
- convert_to_string(key);
-+ if (zend_symtable_find(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, (void **)&old_data)==SUCCESS) {
-+ var_push_dtor(var_hash, old_data);
-+ }
- zend_hash_update(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, &data,
- sizeof data, NULL);
- }
diff --git a/php-5.3.29-CVE-2015-0231.patch b/php-5.3.29-CVE-2015-0231.patch
deleted file mode 100644
index 38d70fd..0000000
--- a/php-5.3.29-CVE-2015-0231.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-diff -Naur php-5.3.29-original/ext/standard/tests/strings/bug68710.phpt php-5.3.29/ext/standard/tests/strings/bug68710.phpt
---- php-5.3.29-original/ext/standard/tests/strings/bug68710.phpt 1970-01-01 00:00:00.000000000 +0000
-+++ php-5.3.29/ext/standard/tests/strings/bug68710.phpt 2015-01-24 14:53:04.321385336 +0000
-@@ -0,0 +1,25 @@
-+--TEST--
-+Bug #68710 Use after free vulnerability in unserialize() (bypassing the
-+CVE-2014-8142 fix)
-+--FILE--
-+<?php
-+for ($i=4; $i<100; $i++) {
-+ $m = new StdClass();
-+
-+ $u = array(1);
-+
-+ $m->aaa = array(1,2,&$u,4,5);
-+ $m->bbb = 1;
-+ $m->ccc = &$u;
-+ $m->ddd = str_repeat("A", $i);
-+
-+ $z = serialize($m);
-+ $z = str_replace("aaa", "123", $z);
-+ $z = str_replace("bbb", "123", $z);
-+ $y = unserialize($z);
-+ $z = serialize($y);
-+}
-+?>
-+===DONE===
-+--EXPECTF--
-+===DONE===
-diff -Naur php-5.3.29-original/ext/standard/var_unserializer.c php-5.3.29/ext/standard/var_unserializer.c
---- php-5.3.29-original/ext/standard/var_unserializer.c 2015-01-24 14:50:14.682381430 +0000
-+++ php-5.3.29/ext/standard/var_unserializer.c 2015-01-24 14:51:47.623383570 +0000
-@@ -298,7 +298,7 @@
- } else {
- /* object properties should include no integers */
- convert_to_string(key);
-- if (zend_symtable_find(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, (void **)&old_data)==SUCCESS) {
-+ if (zend_hash_find(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, (void **)&old_data)==SUCCESS) {
- var_push_dtor(var_hash, old_data);
- }
- zend_hash_update(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, &data,
-diff -Naur php-5.3.29-original/ext/standard/var_unserializer.re php-5.3.29/ext/standard/var_unserializer.re
---- php-5.3.29-original/ext/standard/var_unserializer.re 2015-01-24 14:50:14.685381430 +0000
-+++ php-5.3.29/ext/standard/var_unserializer.re 2015-01-24 14:52:13.191384159 +0000
-@@ -304,7 +304,7 @@
- } else {
- /* object properties should include no integers */
- convert_to_string(key);
-- if (zend_symtable_find(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, (void **)&old_data)==SUCCESS) {
-+ if (zend_hash_find(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, (void **)&old_data)==SUCCESS) {
- var_push_dtor(var_hash, old_data);
- }
- zend_hash_update(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, &data,
diff --git a/php-5.3.29-CVE-2015-0232.patch b/php-5.3.29-CVE-2015-0232.patch
deleted file mode 100644
index 9ba13bd..0000000
Binary files a/php-5.3.29-CVE-2015-0232.patch and /dev/null differ
diff --git a/php-5.3.29-CVE-2025-14177.patch b/php-5.3.29-CVE-2025-14177.patch
new file mode 100644
index 0000000..eb45d43
--- /dev/null
+++ b/php-5.3.29-CVE-2025-14177.patch
@@ -0,0 +1,35 @@
+CVE-2025-14177 (GHSA-3237-qqm7-mfv7): getimagesize() APPn data from a short read exposed
+uninitialized heap memory; php-src c5f28c7cf0a0
+
+diff --git a/ext/standard/image.c b/ext/standard/image.c
+index 3f6ffd5b5..908970219 100644
+--- a/ext/standard/image.c
++++ b/ext/standard/image.c
+@@ -436,6 +436,7 @@ static int php_skip_variable(php_stream * stream TSRMLS_DC)
+ static int php_read_APP(php_stream * stream, unsigned int marker, zval *info TSRMLS_DC)
+ {
+ unsigned short length;
++ size_t read_total = 0;
+ unsigned char *buffer;
+ unsigned char markername[16];
+ zval *tmp;
+@@ -448,10 +449,15 @@ static int php_read_APP(php_stream * stream, unsigned int marker, zval *info TSR
+
+ buffer = emalloc(length);
+
+- if (php_stream_read(stream, buffer, (long) length) <= 0) {
+- efree(buffer);
+- return 0;
+- }
++ /* non-plain-file streams return at most one chunk per read */
++ do {
++ size_t read_now = php_stream_read(stream, buffer + read_total, length - read_total);
++ if (read_now == 0) {
++ efree(buffer);
++ return 0;
++ }
++ read_total += read_now;
++ } while (read_total < length);
+
+ snprintf(markername, sizeof(markername), "APP%d", marker - M_APP0);
+
diff --git a/php-5.3.29-CVE-2025-1735.patch b/php-5.3.29-CVE-2025-1735.patch
new file mode 100644
index 0000000..a9d5f9a
--- /dev/null
+++ b/php-5.3.29-CVE-2025-1735.patch
@@ -0,0 +1,205 @@
+CVE-2025-1735 (GHSA-hrwm-9436-5mv3): pgsql and pdo_pgsql ignored escaping errors;
+php-src 66bd809ac922. pg_meta_data() and pg_convert() escape with PQescapeStringConn(),
+as addslashes()/PQescapeString() do not follow the connection's standard_conforming_strings
+
+diff --git a/ext/pdo_pgsql/pgsql_driver.c b/ext/pdo_pgsql/pgsql_driver.c
+index 55f441808..d44677802 100644
+--- a/ext/pdo_pgsql/pgsql_driver.c
++++ b/ext/pdo_pgsql/pgsql_driver.c
+@@ -310,6 +310,7 @@ static int pgsql_handle_quoter(pdo_dbh_t *dbh, const char *unquoted, int unquote
+ unsigned char *escaped;
+ pdo_pgsql_db_handle *H = (pdo_pgsql_db_handle *)dbh->driver_data;
+ size_t tmp_len;
++ int err = 0;
+
+ switch (paramtype) {
+ case PDO_PARAM_LOB:
+@@ -319,6 +320,9 @@ static int pgsql_handle_quoter(pdo_dbh_t *dbh, const char *unquoted, int unquote
+ #else
+ escaped = PQescapeBytea(unquoted, unquotedlen, &tmp_len);
+ #endif
++ if (escaped == NULL) {
++ return 0;
++ }
+ *quotedlen = (int)tmp_len + 1;
+ *quoted = emalloc(*quotedlen + 1);
+ memcpy((*quoted)+1, escaped, *quotedlen-2);
+@@ -333,8 +337,13 @@ static int pgsql_handle_quoter(pdo_dbh_t *dbh, const char *unquoted, int unquote
+ #ifndef HAVE_PQESCAPE_CONN
+ *quotedlen = PQescapeString(*quoted + 1, unquoted, unquotedlen);
+ #else
+- *quotedlen = PQescapeStringConn(H->server, *quoted + 1, unquoted, unquotedlen, NULL);
++ *quotedlen = PQescapeStringConn(H->server, *quoted + 1, unquoted, unquotedlen, &err);
+ #endif
++ if (err) {
++ efree(*quoted);
++ *quoted = NULL;
++ return 0;
++ }
+ (*quoted)[*quotedlen + 1] = '\'';
+ (*quoted)[*quotedlen + 2] = '\0';
+ *quotedlen += 2;
+diff --git a/ext/pgsql/pgsql.c b/ext/pgsql/pgsql.c
+index af4ed81ed..207e5e760 100644
+--- a/ext/pgsql/pgsql.c
++++ b/ext/pgsql/pgsql.c
+@@ -4037,7 +4037,14 @@ PHP_FUNCTION(pg_escape_string)
+ #ifdef HAVE_PQESCAPE_CONN
+ if (pgsql_link != NULL || id != -1) {
+ ZEND_FETCH_RESOURCE2(pgsql, PGconn *, &pgsql_link, id, "PostgreSQL link", le_link, le_plink);
+- to_len = (int) PQescapeStringConn(pgsql, to, from, (size_t)from_len, NULL);
++ int err;
++
++ to_len = (int) PQescapeStringConn(pgsql, to, from, (size_t)from_len, &err);
++ if (err) {
++ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Escaping string failed");
++ efree(to);
++ RETURN_FALSE;
++ }
+ } else
+ #endif
+ to_len = (int) PQescapeString(to, from, (size_t)from_len);
+@@ -4082,6 +4089,11 @@ PHP_FUNCTION(pg_escape_bytea)
+ #endif
+ to = (char *)PQescapeBytea((unsigned char*)from, from_len, &to_len);
+
++ if (to == NULL) {
++ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Escape failure");
++ RETURN_FALSE;
++ }
++
+ RETVAL_STRINGL(to, to_len-1, 1); /* to_len includes addtional '\0' */
+ PQfreemem(to);
+ }
+@@ -4855,9 +4867,10 @@ PHP_PGSQL_API int php_pgsql_meta_data(PGconn *pg_link, const char *table_name, z
+ {
+ PGresult *pg_result;
+ char *src, *tmp_name, *tmp_name2 = NULL;
++ char *escaped;
+ smart_str querystr = {0};
+- int new_len;
+- int i, num_rows;
++ size_t new_len, len;
++ int i, num_rows, err = 0;
+ zval *elem;
+
+ if (!*table_name) {
+@@ -4882,18 +4895,45 @@ PHP_PGSQL_API int php_pgsql_meta_data(PGconn *pg_link, const char *table_name, z
+ "SELECT a.attname, a.attnum, t.typname, a.attlen, a.attnotnull, a.atthasdef, a.attndims, t.typtype = 'e' "
+ "FROM pg_class as c, pg_attribute a, pg_type t, pg_namespace n "
+ "WHERE a.attnum > 0 AND a.attrelid = c.oid AND c.relname = '");
+- tmp_name2 = php_addslashes(tmp_name2, strlen(tmp_name2), &new_len, 0 TSRMLS_CC);
+- smart_str_appendl(&querystr, tmp_name2, new_len);
+-
++ /* addslashes() does not protect a '' literal under standard_conforming_strings */
++ len = strlen(tmp_name2);
++ escaped = (char *)safe_emalloc(len, 2, 1);
++#ifdef HAVE_PQESCAPE_CONN
++ new_len = PQescapeStringConn(pg_link, escaped, tmp_name2, len, &err);
++#else
++ new_len = PQescapeString(escaped, tmp_name2, len);
++#endif
++ if (err) {
++ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Escaping table name '%s' failed", table_name);
++ efree(src);
++ efree(escaped);
++ smart_str_free(&querystr);
++ return FAILURE;
++ }
++ smart_str_appendl(&querystr, escaped, new_len);
++ efree(escaped);
++
+ smart_str_appends(&querystr, "' AND c.relnamespace = n.oid AND n.nspname = '");
+- tmp_name = php_addslashes(tmp_name, strlen(tmp_name), &new_len, 0 TSRMLS_CC);
+- smart_str_appendl(&querystr, tmp_name, new_len);
++ len = strlen(tmp_name);
++ escaped = (char *)safe_emalloc(len, 2, 1);
++#ifdef HAVE_PQESCAPE_CONN
++ new_len = PQescapeStringConn(pg_link, escaped, tmp_name, len, &err);
++#else
++ new_len = PQescapeString(escaped, tmp_name, len);
++#endif
++ if (err) {
++ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Escaping table namespace '%s' failed", table_name);
++ efree(src);
++ efree(escaped);
++ smart_str_free(&querystr);
++ return FAILURE;
++ }
++ smart_str_appendl(&querystr, escaped, new_len);
++ efree(escaped);
+
+ smart_str_appends(&querystr, "' AND a.atttypid = t.oid ORDER BY a.attnum;");
+ smart_str_0(&querystr);
+
+- efree(tmp_name2);
+- efree(tmp_name);
+ efree(src);
+
+ pg_result = PQexec(pg_link, querystr.c);
+@@ -5158,7 +5198,7 @@ PHP_PGSQL_API int php_pgsql_convert(PGconn *pg_link, const char *table_name, con
+ uint field_len = -1;
+ ulong num_idx = -1;
+ zval *meta, **def, **type, **not_null, **has_default, **is_enum, **val, *new_val;
+- int new_len, key_type, err = 0, skip_field;
++ int new_len, key_type, err = 0, escape_err = 0, skip_field;
+ php_pgsql_data_type data_type;
+
+ assert(pg_link != NULL);
+@@ -5386,14 +5426,28 @@ PHP_PGSQL_API int php_pgsql_convert(PGconn *pg_link, const char *table_name, con
+ #if HAVE_PQESCAPE
+ {
+ char *tmp;
++ size_t tmp_len;
+ tmp = (char *)safe_emalloc(Z_STRLEN_PP(val), 2, 1);
+- Z_STRLEN_P(new_val) = (int)PQescapeString(tmp, Z_STRVAL_PP(val), Z_STRLEN_PP(val));
+- Z_STRVAL_P(new_val) = tmp;
++#ifdef HAVE_PQESCAPE_CONN
++ tmp_len = PQescapeStringConn(pg_link, tmp, Z_STRVAL_PP(val), Z_STRLEN_PP(val), &escape_err);
++#else
++ tmp_len = PQescapeString(tmp, Z_STRVAL_PP(val), Z_STRLEN_PP(val));
++#endif
++ if (escape_err) {
++ efree(tmp);
++ ZVAL_NULL(new_val);
++ err = 1;
++ } else {
++ Z_STRLEN_P(new_val) = (int)tmp_len;
++ Z_STRVAL_P(new_val) = tmp;
++ }
+ }
+ #else
+ Z_STRVAL_P(new_val) = php_addslashes(Z_STRVAL_PP(val), Z_STRLEN_PP(val), &Z_STRLEN_P(new_val), 0 TSRMLS_CC);
+ #endif
+- php_pgsql_add_quotes(new_val, 1 TSRMLS_CC);
++ if (!err) {
++ php_pgsql_add_quotes(new_val, 1 TSRMLS_CC);
++ }
+ }
+ break;
+
+@@ -5416,7 +5470,11 @@ PHP_PGSQL_API int php_pgsql_convert(PGconn *pg_link, const char *table_name, con
+ }
+ PGSQL_CONV_CHECK_IGNORE();
+ if (err) {
+- php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Expects NULL, string, long or double value for PostgreSQL '%s' (%s)", Z_STRVAL_PP(type), field);
++ if (escape_err) {
++ php_error_docref(NULL TSRMLS_CC, E_NOTICE, "String value escaping failed for PostgreSQL '%s' (%s)", Z_STRVAL_PP(type), field);
++ } else {
++ php_error_docref(NULL TSRMLS_CC, E_NOTICE, "Expects NULL, string, long or double value for PostgreSQL '%s' (%s)", Z_STRVAL_PP(type), field);
++ }
+ }
+ break;
+
+@@ -5682,6 +5740,11 @@ PHP_PGSQL_API int php_pgsql_convert(PGconn *pg_link, const char *table_name, con
+ #else
+ tmp = PQescapeBytea(Z_STRVAL_PP(val), Z_STRLEN_PP(val), &to_len);
+ #endif
++ if (!tmp) {
++ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Escaping bytea value failed for PostgreSQL '%s' (%s)", Z_STRVAL_PP(type), field);
++ err = 1;
++ break;
++ }
+ Z_TYPE_P(new_val) = IS_STRING;
+ Z_STRLEN_P(new_val) = to_len-1; /* PQescapeBytea's to_len includes additional '\0' */
+ Z_STRVAL_P(new_val) = emalloc(to_len);
diff --git a/php-5.3.29-CVE-2025-1736.patch b/php-5.3.29-CVE-2025-1736.patch
new file mode 100644
index 0000000..b954b0d
--- /dev/null
+++ b/php-5.3.29-CVE-2025-1736.patch
@@ -0,0 +1,69 @@
+CVE-2025-1736 (GHSA-hgf5-96fm-v528): only a header name at the start of a CRLF line counts
+as a user header; php-src 41d49abbd99d
+
+diff --git a/ext/standard/http_fopen_wrapper.c b/ext/standard/http_fopen_wrapper.c
+index 0ec911cac..5ab60f9c1 100644
+--- a/ext/standard/http_fopen_wrapper.c
++++ b/ext/standard/http_fopen_wrapper.c
+@@ -395,6 +395,20 @@ static char *php_stream_http_response_headers_parse(php_stream_wrapper *wrapper,
+ return NULL;
+ }
+
++/* A bare LF does not end a header line, so only a match at the start or after CRLF counts */
++static int check_has_header(const char *headers, const char *header)
++{
++ const char *s = headers;
++
++ while ((s = strstr(s, header))) {
++ if (s == headers || (s - headers >= 2 && *(s-1) == '\n' && *(s-2) == '\r')) {
++ return 1;
++ }
++ s++;
++ }
++ return 0;
++}
++
+ php_stream *php_stream_url_wrap_http_ex(php_stream_wrapper *wrapper, char *path, char *mode, int options, char **opened_path, php_stream_context *context, int redirect_max, int flags STREAMS_DC TSRMLS_DC) /* {{{ */
+ {
+ php_stream *stream = NULL;
+@@ -794,34 +808,22 @@ finish:
+ user_headers = NULL;
+ }
+
+- if ((s = strstr(tmp, "user-agent:")) &&
+- (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' ||
+- *(s-1) == '\t' || *(s-1) == ' ')) {
++ if (check_has_header(tmp, "user-agent:")) {
+ have_header |= HTTP_HEADER_USER_AGENT;
+ }
+- if ((s = strstr(tmp, "host:")) &&
+- (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' ||
+- *(s-1) == '\t' || *(s-1) == ' ')) {
++ if (check_has_header(tmp, "host:")) {
+ have_header |= HTTP_HEADER_HOST;
+ }
+- if ((s = strstr(tmp, "from:")) &&
+- (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' ||
+- *(s-1) == '\t' || *(s-1) == ' ')) {
++ if (check_has_header(tmp, "from:")) {
+ have_header |= HTTP_HEADER_FROM;
+ }
+- if ((s = strstr(tmp, "authorization:")) &&
+- (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' ||
+- *(s-1) == '\t' || *(s-1) == ' ')) {
++ if (check_has_header(tmp, "authorization:")) {
+ have_header |= HTTP_HEADER_AUTH;
+ }
+- if ((s = strstr(tmp, "content-length:")) &&
+- (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' ||
+- *(s-1) == '\t' || *(s-1) == ' ')) {
++ if (check_has_header(tmp, "content-length:")) {
+ have_header |= HTTP_HEADER_CONTENT_LENGTH;
+ }
+- if ((s = strstr(tmp, "content-type:")) &&
+- (s == tmp || *(s-1) == '\r' || *(s-1) == '\n' ||
+- *(s-1) == '\t' || *(s-1) == ' ')) {
++ if (check_has_header(tmp, "content-type:")) {
+ have_header |= HTTP_HEADER_TYPE;
+ }
+ /* remove Proxy-Authorization header */
diff --git a/php-5.3.29-CVE-2026-109618.patch b/php-5.3.29-CVE-2026-109618.patch
new file mode 100644
index 0000000..3b61299
--- /dev/null
+++ b/php-5.3.29-CVE-2026-109618.patch
@@ -0,0 +1,428 @@
+CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): bailing out of the allocator at memory_limit
+could leave request state half updated for shutdown to use. As in php-src 3584a98bda0f
+the error is raised at the next safe point (between opcodes, around zend_call_function(),
+after the main script and after POST handling) and only a hard limit (twice memory_limit,
+or memory_limit + 1G above 1G) stops the process; replaces the branch's _exit() at
+memory_limit. POST parsing stops once over the limit, multipart bodies without
+Content-Length are held to post_max_size, and memory_limit cannot be set below the usage.
+The upstream fallible allocations are not ported: a single allocation over the hard limit
+still exits.
+
+diff --git a/Zend/zend.c b/Zend/zend.c
+index d1f4d3704..029905f55 100644
+--- a/Zend/zend.c
++++ b/Zend/zend.c
+@@ -551,6 +551,7 @@ static void executor_globals_ctor(zend_executor_globals *executor_globals TSRMLS
+ EG(exit_status) = 0;
+ EG(saved_fpu_cw) = NULL;
+ EG(active) = 0;
++ memset(&EG(delayed_oom), 0, sizeof(EG(delayed_oom)));
+ }
+ /* }}} */
+
+@@ -1257,6 +1258,9 @@ ZEND_API int zend_execute_scripts(int type TSRMLS_DC, zval **retval, int file_co
+ if (EG(active_op_array)) {
+ EG(return_value_ptr_ptr) = retval ? retval : NULL;
+ zend_execute(EG(active_op_array) TSRMLS_CC);
++ if (ZEND_HAS_OOM()) {
++ zend_handle_delayed_oom(TSRMLS_C);
++ }
+ zend_exception_restore(TSRMLS_C);
+ if (EG(exception)) {
+ if (EG(user_exception_handler)) {
+diff --git a/Zend/zend_alloc.c b/Zend/zend_alloc.c
+index f5ee84a1a..87f2b7e4e 100644
+--- a/Zend/zend_alloc.c
++++ b/Zend/zend_alloc.c
+@@ -1718,6 +1718,59 @@ static void zend_mm_safe_error(zend_mm_heap *heap,
+ size);
+ }
+
++/* Twice the limit, or the limit plus 1G for limits above 1G, as upstream */
++static size_t zend_mm_hard_limit(size_t limit)
++{
++ size_t offset = (size_t) 1 << 30;
++
++ if (limit <= offset) {
++ return limit * 2;
++ }
++ return limit > (size_t) -1 - offset ? (size_t) -1 : limit + offset;
++}
++
++/* Bailing out of the allocator may leave whatever its caller was updating
++ * half done, and request shutdown would then use it. Let the allocation
++ * succeed and raise the error at the next safe point in
++ * zend_handle_delayed_oom() instead; only the hard limit stops the process
++ * right away. */
++static void zend_mm_limit_exceeded(zend_mm_heap *heap, size_t add_size, size_t size ZEND_FILE_LINE_DC)
++{
++ size_t hard_limit = zend_mm_hard_limit(heap->limit);
++ TSRMLS_FETCH();
++
++ if (add_size > hard_limit || heap->real_size > hard_limit - add_size) {
++ zend_mm_safe_error_ex("Hard memory limit of %lu bytes exhausted (tried to allocate %lu bytes)", (unsigned long) hard_limit, (unsigned long) size);
++ }
++ if (EG(delayed_oom).state == ZEND_OOM_STATE_NONE) {
++ EG(delayed_oom).state = ZEND_OOM_STATE_PENDING;
++ EG(delayed_oom).limit = heap->limit;
++ EG(delayed_oom).size = size;
++#if ZEND_DEBUG
++ EG(delayed_oom).filename = __zend_filename;
++ EG(delayed_oom).lineno = __zend_lineno;
++#endif
++ }
++}
++
++ZEND_API void zend_handle_delayed_oom(TSRMLS_D)
++{
++ zend_oom_info *info = &EG(delayed_oom);
++
++ if (info->state != ZEND_OOM_STATE_PENDING) {
++ return;
++ }
++ /* error reporting itself may now go over the limit, up to the hard one */
++ info->state = ZEND_OOM_STATE_HANDLED;
++#if ZEND_DEBUG
++ zend_error(E_ERROR, "Allowed memory size of %ld bytes exhausted at %s:%d (tried to allocate %lu bytes)", (long) info->limit, info->filename, info->lineno, (unsigned long) info->size);
++#else
++ zend_error(E_ERROR, "Allowed memory size of %ld bytes exhausted (tried to allocate %lu bytes)", (long) info->limit, (unsigned long) info->size);
++#endif
++ /* php_error_cb() bails out only once the modules are initialized */
++ zend_bailout();
++}
++
+ static zend_mm_free_block *zend_mm_search_large_block(zend_mm_heap *heap, size_t true_size)
+ {
+ zend_mm_free_block *best_fit;
+@@ -1875,18 +1928,18 @@ static void *_zend_mm_alloc_int(zend_mm_heap *heap, size_t size ZEND_FILE_LINE_D
+
+ HANDLE_BLOCK_INTERRUPTIONS();
+
+- if (segment_size < true_size ||
+- heap->real_size + segment_size > heap->limit) {
++ if (segment_size < true_size) {
++ HANDLE_UNBLOCK_INTERRUPTIONS();
++ goto out_of_memory;
++ }
++ if (heap->real_size + segment_size > heap->limit) {
+ /* Memory limit overflow */
+ #if ZEND_MM_CACHE
+ zend_mm_free_cache(heap);
+ #endif
+- HANDLE_UNBLOCK_INTERRUPTIONS();
+-#if ZEND_DEBUG
+- zend_mm_safe_error(heap, "Allowed memory size of %ld bytes exhausted at %s:%d (tried to allocate %lu bytes)", heap->limit, __zend_filename, __zend_lineno, size);
+-#else
+- zend_mm_safe_error(heap, "Allowed memory size of %ld bytes exhausted (tried to allocate %lu bytes)", heap->limit, size);
+-#endif
++ if (heap->real_size + segment_size > heap->limit) {
++ zend_mm_limit_exceeded(heap, segment_size, size ZEND_FILE_LINE_RELAY_CC);
++ }
+ }
+
+ segment = (zend_mm_segment *) ZEND_MM_STORAGE_ALLOC(segment_size);
+@@ -2182,21 +2235,17 @@ realloc_segment:
+ }
+
+ segment_copy = (zend_mm_segment *) ((char *)mm_block - ZEND_MM_ALIGNED_SEGMENT_SIZE);
+- if (segment_size < true_size ||
+- heap->real_size + segment_size - segment_copy->size > heap->limit) {
++ if (segment_size < true_size) {
+ if (ZEND_MM_IS_FREE_BLOCK(next_block)) {
+ zend_mm_add_to_free_list(heap, (zend_mm_free_block *) next_block);
+ }
+-#if ZEND_MM_CACHE
+- zend_mm_free_cache(heap);
+-#endif
+ HANDLE_UNBLOCK_INTERRUPTIONS();
+-#if ZEND_DEBUG
+- zend_mm_safe_error(heap, "Allowed memory size of %ld bytes exhausted at %s:%d (tried to allocate %ld bytes)", heap->limit, __zend_filename, __zend_lineno, size);
+-#else
+- zend_mm_safe_error(heap, "Allowed memory size of %ld bytes exhausted (tried to allocate %ld bytes)", heap->limit, size);
+-#endif
+- return NULL;
++ goto out_of_memory;
++ }
++ if (heap->real_size + segment_size - segment_copy->size > heap->limit) {
++ /* next_block is out of the free list here, so the cache cannot be
++ * merged back to make room as in _zend_mm_alloc_int() */
++ zend_mm_limit_exceeded(heap, segment_size > segment_copy->size ? segment_size - segment_copy->size : 0, size ZEND_FILE_LINE_RELAY_CC);
+ }
+
+ segment = ZEND_MM_STORAGE_REALLOC(segment_copy, segment_size);
+@@ -2522,9 +2571,23 @@ ZEND_API char *zend_strndup(const char *s, uint length)
+
+ ZEND_API int zend_set_memory_limit(size_t memory_limit)
+ {
++ zend_mm_heap *heap;
+ TSRMLS_FETCH();
+
+- AG(mm_heap)->limit = (memory_limit >= AG(mm_heap)->block_size) ? memory_limit : AG(mm_heap)->block_size;
++ heap = AG(mm_heap);
++ if (memory_limit < heap->block_size) {
++ memory_limit = heap->block_size;
++ }
++ /* the hard limit is derived from this one and must stay above the memory in use */
++ if (memory_limit < heap->real_size) {
++#if ZEND_MM_CACHE
++ zend_mm_free_cache(heap);
++#endif
++ if (memory_limit < heap->real_size) {
++ return FAILURE;
++ }
++ }
++ heap->limit = memory_limit;
+
+ return SUCCESS;
+ }
+diff --git a/Zend/zend_alloc.h b/Zend/zend_alloc.h
+index 921105ddf..da6c5cbae 100644
+--- a/Zend/zend_alloc.h
++++ b/Zend/zend_alloc.h
+@@ -167,6 +167,25 @@ ZEND_API size_t zend_memory_peak_usage(int real_usage TSRMLS_DC);
+
+ ZEND_API void zend_mm_safe_error_ex(const char *format, ...);
+
++typedef enum _zend_oom_state {
++ ZEND_OOM_STATE_NONE = 0,
++ ZEND_OOM_STATE_PENDING,
++ ZEND_OOM_STATE_HANDLED
++} zend_oom_state;
++
++/* memory_limit exceeded, raised later by zend_handle_delayed_oom() */
++typedef struct _zend_oom_info {
++ zend_oom_state state;
++ size_t limit;
++ size_t size;
++ const char *filename;
++ uint lineno;
++} zend_oom_info;
++
++#define ZEND_HAS_OOM() UNEXPECTED(EG(delayed_oom).state != ZEND_OOM_STATE_NONE)
++
++ZEND_API void zend_handle_delayed_oom(TSRMLS_D);
++
+ END_EXTERN_C()
+
+ /* Macroses for zend_fast_cache.h compatibility */
+diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
+index f520707bf..3def9cd43 100644
+--- a/Zend/zend_execute_API.c
++++ b/Zend/zend_execute_API.c
+@@ -788,6 +788,10 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache TS
+ return FAILURE; /* executor is already inactive */
+ }
+
++ if (ZEND_HAS_OOM()) {
++ zend_handle_delayed_oom(TSRMLS_C);
++ }
++
+ if (EG(exception)) {
+ return FAILURE; /* we would result in an instable executor otherwise */
+ }
+@@ -1043,6 +1047,11 @@ int zend_call_function(zend_fcall_info *fci, zend_fcall_info_cache *fci_cache TS
+ EG(This) = current_this;
+ EG(current_execute_data) = EX(prev_execute_data);
+
++ /* internal functions do not reach the check in the executor loop */
++ if (ZEND_HAS_OOM()) {
++ zend_handle_delayed_oom(TSRMLS_C);
++ }
++
+ if (EG(exception)) {
+ zend_throw_exception_internal(NULL TSRMLS_CC);
+ }
+diff --git a/Zend/zend_globals.h b/Zend/zend_globals.h
+index 1c29f6016..6267d7e78 100644
+--- a/Zend/zend_globals.h
++++ b/Zend/zend_globals.h
+@@ -257,6 +257,9 @@ struct _zend_executor_globals {
+ void *saved_fpu_cw;
+
+ void *reserved[ZEND_MAX_RESERVED_RESOURCES];
++
++ /* last, so that the offsets used by extensions do not change */
++ zend_oom_info delayed_oom;
+ };
+
+ struct _zend_ini_scanner_globals {
+diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
+index 993b822aa..cb23e10bb 100644
+--- a/Zend/zend_vm_execute.h
++++ b/Zend/zend_vm_execute.h
+@@ -103,6 +103,10 @@ zend_vm_enter:
+ zend_timeout(0);
+ }
+ #endif
++ /* between two opcodes is a safe point for the memory limit error */
++ if (ZEND_HAS_OOM()) {
++ zend_handle_delayed_oom(TSRMLS_C);
++ }
+
+ if ((ret = EX(opline)->handler(execute_data TSRMLS_CC)) > 0) {
+ switch (ret) {
+diff --git a/Zend/zend_vm_execute.skl b/Zend/zend_vm_execute.skl
+index e5a143eaa..3132f5c1e 100644
+--- a/Zend/zend_vm_execute.skl
++++ b/Zend/zend_vm_execute.skl
+@@ -66,6 +66,10 @@ zend_vm_enter:
+ zend_timeout(0);
+ }
+ #endif
++ /* between two opcodes is a safe point for the memory limit error */
++ if (ZEND_HAS_OOM()) {
++ zend_handle_delayed_oom(TSRMLS_C);
++ }
+
+ {%ZEND_VM_DISPATCH%} {
+ {%INTERNAL_EXECUTOR%}
+diff --git a/main/SAPI.c b/main/SAPI.c
+index 02536ae33..f3e6f3d34 100644
+--- a/main/SAPI.c
++++ b/main/SAPI.c
+@@ -128,6 +128,10 @@ SAPI_API void sapi_handle_post(void *arg TSRMLS_DC)
+ }
+ efree(SG(request_info).content_type_dup);
+ SG(request_info).content_type_dup = NULL;
++
++ if (ZEND_HAS_OOM()) {
++ zend_handle_delayed_oom(TSRMLS_C);
++ }
+ }
+ }
+
+diff --git a/main/main.c b/main/main.c
+index 02768c639..aa111aba2 100644
+--- a/main/main.c
++++ b/main/main.c
+@@ -170,12 +170,23 @@ static PHP_INI_MH(OnSetPrecision)
+ */
+ static PHP_INI_MH(OnChangeMemoryLimit)
+ {
++ long value;
++
+ if (new_value) {
+- PG(memory_limit) = zend_atol(new_value, new_value_length);
++ value = zend_atol(new_value, new_value_length);
+ } else {
+- PG(memory_limit) = 1<<30; /* effectively, no limit */
++ value = 1<<30; /* effectively, no limit */
++ }
++ if (zend_set_memory_limit(value) == FAILURE) {
++ /* the request memory is still in use while ini entries are restored,
++ * php_request_shutdown() sets the limit again once it is released */
++ if (stage != ZEND_INI_STAGE_DEACTIVATE) {
++ zend_error(E_WARNING, "Failed to set memory limit to %ld bytes (Current memory usage is %ld bytes)", value, (long) zend_memory_usage(1 TSRMLS_CC));
++ return FAILURE;
++ }
+ }
+- return zend_set_memory_limit(PG(memory_limit));
++ PG(memory_limit) = value;
++ return SUCCESS;
+ }
+ /* }}} */
+
+@@ -1614,6 +1625,9 @@ void php_request_shutdown(void *dummy)
+ EG(opline_ptr) = NULL;
+ EG(active_op_array) = NULL;
+
++ /* a memory limit error is reported again if shutdown code goes over it */
++ EG(delayed_oom).state = ZEND_OOM_STATE_NONE;
++
+ php_deactivate_ticks(TSRMLS_C);
+
+ /* 1. Call all possible shutdown functions registered with register_shutdown_function() */
+@@ -1692,6 +1706,8 @@ void php_request_shutdown(void *dummy)
+ zend_try {
+ shutdown_memory_manager(CG(unclean_shutdown) || !report_memleaks, 0 TSRMLS_CC);
+ } zend_end_try();
++ EG(delayed_oom).state = ZEND_OOM_STATE_NONE;
++ zend_set_memory_limit(PG(memory_limit));
+
+ /* 12. Reset max_execution_time */
+ zend_try {
+diff --git a/main/php_variables.c b/main/php_variables.c
+index eca1155f2..511ceb8c8 100644
+--- a/main/php_variables.c
++++ b/main/php_variables.c
+@@ -171,6 +171,13 @@ PHPAPI void php_register_variable_ex(char *var_name, zval *val, zval *track_vars
+ return;
+ }
+
++ /* Each level retains an array, so stop once over the limit. */
++ if (ZEND_HAS_OOM()) {
++ zval_dtor(val);
++ efree(var_orig);
++ return;
++ }
++
+ ip++;
+ index_s = ip;
+ if (isspace(*ip)) {
+@@ -304,7 +311,8 @@ SAPI_API SAPI_POST_HANDLER_FUNC(php_std_post_handler)
+ zval *array_ptr = (zval *) arg;
+ long count = 0;
+
+- if (SG(request_info).post_data == NULL) {
++ /* reading the body may already have gone over the limit */
++ if (SG(request_info).post_data == NULL || ZEND_HAS_OOM()) {
+ return;
+ }
+
+@@ -326,10 +334,18 @@ last_value:
+ val++;
+ val_len = php_url_decode(val, (p - val));
+ val = estrndup(val, val_len);
++ /* registering copies the value once more */
++ if (ZEND_HAS_OOM()) {
++ efree(val);
++ return;
++ }
+ if (sapi_module.input_filter(PARSE_POST, var, &val, val_len, &new_val_len TSRMLS_CC)) {
+ php_register_variable_safe(var, val, new_val_len, array_ptr TSRMLS_CC);
+ }
+ efree(val);
++ if (ZEND_HAS_OOM()) {
++ return;
++ }
+ }
+ s = p + 1;
+ }
+diff --git a/main/rfc1867.c b/main/rfc1867.c
+index 3d1fecd0d..d42fac4be 100644
+--- a/main/rfc1867.c
++++ b/main/rfc1867.c
+@@ -317,6 +317,11 @@ static int fill_buffer(multipart_buffer *self TSRMLS_DC)
+
+ self->buf_begin = self->buffer;
+
++ /* a body without Content-Length passed the check in rfc1867_post_handler() */
++ if (SG(post_max_size) > 0 && SG(read_post_bytes) > SG(post_max_size)) {
++ return 0;
++ }
++
+ /* calculate the free space in the buffer */
+ bytes_to_read = self->bufsize - self->bytes_in_buffer;
+
+@@ -901,6 +906,11 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
+
+ zend_llist_clean(&header);
+
++ if (ZEND_HAS_OOM()) {
++ /* A previous body part has reached the soft memory limit: Stop here */
++ goto fileupload_done;
++ }
++
+ if (!multipart_buffer_headers(mbuff, &header TSRMLS_CC)) {
+ goto fileupload_done;
+ }
+@@ -1402,6 +1412,9 @@ filedone:
+ }
+
+ fileupload_done:
++ if (SG(post_max_size) > 0 && SG(read_post_bytes) > SG(post_max_size)) {
++ sapi_module.sapi_error(E_WARNING, "Actual POST length does not match Content-Length, and exceeds %ld bytes", SG(post_max_size));
++ }
+ if (php_rfc1867_callback != NULL) {
+ multipart_event_end event_end;
+
diff --git a/php-5.3.29-CVE-2026-6722.patch b/php-5.3.29-CVE-2026-6722.patch
new file mode 100644
index 0000000..d4ab25e
--- /dev/null
+++ b/php-5.3.29-CVE-2026-6722.patch
@@ -0,0 +1,168 @@
+CVE-2026-6722 (GHSA-85c2-q967-79q5): release the references the SOAP ref_map takes after
+decoding (php-src aee3b3ac9b81); the 5.x map also holds xmlNodePtr entries when encoding
+
+diff --git a/ext/soap/php_encoding.c b/ext/soap/php_encoding.c
+index 545c89339..92d9cf056 100644
+--- a/ext/soap/php_encoding.c
++++ b/ext/soap/php_encoding.c
+@@ -291,10 +291,16 @@ static encodePtr find_encoder_by_type_name(sdlPtr sdl, const char *type)
+ return NULL;
+ }
+
++/* User code (typemap callbacks, magic methods) runs inside a pass, so a map is
++ * only ever used by the kind of pass that first filled it. */
++#define SOAP_REF_MAP_USABLE(kind) \
++ (SOAP_GLOBAL(ref_map) && \
++ (SOAP_GLOBAL(ref_map_kind) == SOAP_REF_MAP_UNUSED || SOAP_GLOBAL(ref_map_kind) == (kind)))
++
+ static zend_bool soap_check_zval_ref(zval *data, xmlNodePtr node TSRMLS_DC) {
+ xmlNodePtr *node_ptr;
+
+- if (SOAP_GLOBAL(ref_map)) {
++ if (SOAP_REF_MAP_USABLE(SOAP_REF_MAP_ENCODE)) {
+ if (Z_TYPE_P(data) == IS_OBJECT) {
+ data = (zval*)zend_objects_get_address(data TSRMLS_CC);
+ }
+@@ -352,6 +358,7 @@ static zend_bool soap_check_zval_ref(zval *data, xmlNodePtr node TSRMLS_DC) {
+ smart_str_free(&prefix);
+ return 1;
+ } else {
++ SOAP_GLOBAL(ref_map_kind) = SOAP_REF_MAP_ENCODE;
+ zend_hash_index_update(SOAP_GLOBAL(ref_map), (ulong)data, (void**)&node, sizeof(xmlNodePtr), NULL);
+ }
+ }
+@@ -362,7 +369,7 @@ static zval* soap_find_xml_ref(xmlNodePtr node TSRMLS_DC)
+ {
+ zval **data_ptr;
+
+- if (SOAP_GLOBAL(ref_map) &&
++ if (SOAP_REF_MAP_USABLE(SOAP_REF_MAP_DECODE) &&
+ zend_hash_index_find(SOAP_GLOBAL(ref_map), (ulong)node, (void**)&data_ptr) == SUCCESS) {
+ Z_SET_ISREF_PP(data_ptr);
+ Z_ADDREF_PP(data_ptr);
+@@ -375,7 +382,7 @@ static zend_bool soap_check_xml_ref(zval **data, xmlNodePtr node TSRMLS_DC)
+ {
+ zval **data_ptr;
+
+- if (SOAP_GLOBAL(ref_map)) {
++ if (SOAP_REF_MAP_USABLE(SOAP_REF_MAP_DECODE)) {
+ if (zend_hash_index_find(SOAP_GLOBAL(ref_map), (ulong)node, (void**)&data_ptr) == SUCCESS) {
+ if (*data != *data_ptr) {
+ zval_ptr_dtor(data);
+@@ -385,7 +392,10 @@ static zend_bool soap_check_xml_ref(zval **data, xmlNodePtr node TSRMLS_DC)
+ return 1;
+ }
+ } else {
++ /* the decoder may free *data (a repeated Apache Map key) while a later
++ * href still resolves to it, so the map keeps its own reference */
+ Z_ADDREF_PP(data);
++ SOAP_GLOBAL(ref_map_kind) = SOAP_REF_MAP_DECODE;
+ zend_hash_index_update(SOAP_GLOBAL(ref_map), (ulong)node, (void**)data, sizeof(zval*), NULL);
+ }
+ }
+@@ -3604,17 +3614,44 @@ static void set_xsi_type(xmlNodePtr node, char *type)
+ set_ns_prop(node, XSI_NAMESPACE, "type", type);
+ }
+
++static void destroy_ref_map(TSRMLS_D)
++{
++ HashTable *ref_map = SOAP_GLOBAL(ref_map);
++ int kind = SOAP_GLOBAL(ref_map_kind);
++
++ /* releasing a zval may run a __destruct() that starts another SOAP pass */
++ SOAP_GLOBAL(ref_map) = NULL;
++ SOAP_GLOBAL(ref_map_kind) = SOAP_REF_MAP_UNUSED;
++ if (kind == SOAP_REF_MAP_DECODE) {
++ HashPosition pos;
++ zval **data;
++
++ for (zend_hash_internal_pointer_reset_ex(ref_map, &pos);
++ zend_hash_get_current_data_ex(ref_map, (void **)&data, &pos) == SUCCESS;
++ zend_hash_move_forward_ex(ref_map, &pos)) {
++ /* not zval_ptr_dtor(): it clears is_ref at one holder left and would
++ * undo the reference an href made; the map is no PHP-visible holder */
++ Z_DELREF_PP(data);
++ if (Z_REFCOUNT_PP(data) == 0) {
++ zval_dtor(*data);
++ FREE_ZVAL(*data);
++ }
++ }
++ }
++ zend_hash_destroy(ref_map);
++ efree(ref_map);
++}
++
+ void encode_reset_ns()
+ {
+ TSRMLS_FETCH();
+ SOAP_GLOBAL(cur_uniq_ns) = 0;
+ SOAP_GLOBAL(cur_uniq_ref) = 0;
+ SOAP_GLOBAL(decode_depth) = 0;
+- if (SOAP_GLOBAL(ref_map)) {
+- zend_hash_destroy(SOAP_GLOBAL(ref_map));
+- } else {
+- SOAP_GLOBAL(ref_map) = emalloc(sizeof(HashTable));
++ while (SOAP_GLOBAL(ref_map)) {
++ destroy_ref_map(TSRMLS_C);
+ }
++ SOAP_GLOBAL(ref_map) = emalloc(sizeof(HashTable));
+ zend_hash_init(SOAP_GLOBAL(ref_map), 0, NULL, NULL, 0);
+ }
+
+@@ -3624,10 +3661,8 @@ void encode_finish()
+ SOAP_GLOBAL(cur_uniq_ns) = 0;
+ SOAP_GLOBAL(cur_uniq_ref) = 0;
+ SOAP_GLOBAL(decode_depth) = 0;
+- if (SOAP_GLOBAL(ref_map)) {
+- zend_hash_destroy(SOAP_GLOBAL(ref_map));
+- efree(SOAP_GLOBAL(ref_map));
+- SOAP_GLOBAL(ref_map) = NULL;
++ while (SOAP_GLOBAL(ref_map)) {
++ destroy_ref_map(TSRMLS_C);
+ }
+ }
+
+diff --git a/ext/soap/php_soap.h b/ext/soap/php_soap.h
+index 47627f8c1..82b7ba91e 100644
+--- a/ext/soap/php_soap.h
++++ b/ext/soap/php_soap.h
+@@ -152,6 +152,11 @@ struct _soapService {
+ #define SOAP_MAX_XML_DEPTH 2048
+ #define SOAP_MAX_DECODE_DEPTH (SOAP_MAX_XML_DEPTH * 2)
+
++/* what SOAP_GLOBAL(ref_map) holds; fixed by the first pass that uses it */
++#define SOAP_REF_MAP_UNUSED 0
++#define SOAP_REF_MAP_ENCODE 1 /* zval/object address -> xmlNodePtr */
++#define SOAP_REF_MAP_DECODE 2 /* xmlNodePtr -> zval* the map holds a reference to */
++
+ ZEND_BEGIN_MODULE_GLOBALS(soap)
+ HashTable defEncNs; /* mapping of default namespaces to prefixes */
+ HashTable defEnc;
+@@ -176,6 +181,7 @@ ZEND_BEGIN_MODULE_GLOBALS(soap)
+ HashTable wsdl_cache;
+ int cur_uniq_ref;
+ HashTable *ref_map;
++ int ref_map_kind;
+ unsigned int decode_depth;
+ ZEND_END_MODULE_GLOBALS(soap)
+
+diff --git a/ext/soap/soap.c b/ext/soap/soap.c
+index 42fe3611a..9ad68cc5d 100644
+--- a/ext/soap/soap.c
++++ b/ext/soap/soap.c
+@@ -670,6 +670,7 @@ static void php_soap_init_globals(zend_soap_globals *soap_globals TSRMLS_DC)
+ soap_globals->soap_version = SOAP_1_1;
+ soap_globals->mem_cache = NULL;
+ soap_globals->ref_map = NULL;
++ soap_globals->ref_map_kind = SOAP_REF_MAP_UNUSED;
+ soap_globals->decode_depth = 0;
+ }
+
+@@ -699,6 +700,7 @@ PHP_RINIT_FUNCTION(soap)
+ SOAP_GLOBAL(class_map) = NULL;
+ SOAP_GLOBAL(features) = 0;
+ SOAP_GLOBAL(ref_map) = NULL;
++ SOAP_GLOBAL(ref_map_kind) = SOAP_REF_MAP_UNUSED;
+ return SUCCESS;
+ }
+
diff --git a/php-5.3.29-CVE-2026-7258.patch b/php-5.3.29-CVE-2026-7258.patch
new file mode 100644
index 0000000..487b8f2
--- /dev/null
+++ b/php-5.3.29-CVE-2026-7258.patch
@@ -0,0 +1,29 @@
+CVE-2026-7258 (GHSA-m8rr-4c36-8gq4): negative char passed to isxdigit() in urldecode();
+php-src a38418777f65
+
+diff --git a/ext/standard/url.c b/ext/standard/url.c
+index 2ee2163e4..6e01df5c3 100644
+--- a/ext/standard/url.c
++++ b/ext/standard/url.c
+@@ -579,8 +579,8 @@ PHPAPI int php_url_decode(char *str, int len)
+ if (*data == '+') {
+ *dest = ' ';
+ }
+- else if (*data == '%' && len >= 2 && isxdigit((int) *(data + 1))
+- && isxdigit((int) *(data + 2))) {
++ else if (*data == '%' && len >= 2 && isxdigit((unsigned char) *(data + 1))
++ && isxdigit((unsigned char) *(data + 2))) {
+ #ifndef CHARSET_EBCDIC
+ *dest = (char) php_htoi(data + 1);
+ #else
+@@ -677,8 +677,8 @@ PHPAPI int php_raw_url_decode(char *str, int len)
+ char *data = str;
+
+ while (len--) {
+- if (*data == '%' && len >= 2 && isxdigit((int) *(data + 1))
+- && isxdigit((int) *(data + 2))) {
++ if (*data == '%' && len >= 2 && isxdigit((unsigned char) *(data + 1))
++ && isxdigit((unsigned char) *(data + 2))) {
+ #ifndef CHARSET_EBCDIC
+ *dest = (char) php_htoi(data + 1);
+ #else
diff --git a/php-5.3.29-CVE-2026-7568.patch b/php-5.3.29-CVE-2026-7568.patch
new file mode 100644
index 0000000..253e98f
--- /dev/null
+++ b/php-5.3.29-CVE-2026-7568.patch
@@ -0,0 +1,28 @@
+CVE-2026-7568 (GHSA-96wq-48vp-hh57): metaphone() int phoneme buffer length overflows for
+large phonemes values; same issue as php-src 47def8ce1db1 in the 5.x code
+
+diff --git a/ext/standard/metaphone.c b/ext/standard/metaphone.c
+index 62c6df64a..fd5cb7ec6 100644
+--- a/ext/standard/metaphone.c
++++ b/ext/standard/metaphone.c
+@@ -144,6 +144,9 @@ static char Lookahead(char *word, int how_far)
+ * could be one though; or more too). */
+ #define Phonize(c) { \
+ if (p_idx >= max_buffer_len) { \
++ if (max_buffer_len > INT_MAX - 3) { \
++ return -1; \
++ } \
+ *phoned_word = safe_erealloc(*phoned_word, 2, sizeof(char), max_buffer_len); \
+ max_buffer_len += 2; \
+ } \
+@@ -183,6 +186,10 @@ static int metaphone(unsigned char *word, int word_len, long max_phonemes, char
+ if (word == NULL)
+ return -1;
+
++ /* p_idx and max_buffer_len are int; beyond INT_MAX the limit is never reached anyway */
++ if (max_phonemes > INT_MAX)
++ max_phonemes = 0;
++
+ /*-- Allocate memory for our phoned_phrase --*/
+ if (max_phonemes == 0) { /* Assume largest possible */
+ max_buffer_len = word_len;
diff --git a/php-5.3.29-GHSA-ch8v-r6jh-4vvr.patch b/php-5.3.29-GHSA-ch8v-r6jh-4vvr.patch
new file mode 100644
index 0000000..a7ec705
--- /dev/null
+++ b/php-5.3.29-GHSA-ch8v-r6jh-4vvr.patch
@@ -0,0 +1,15 @@
+GHSA-ch8v-r6jh-4vvr: FILTER_SANITIZE_ENCODED left 0xFF to stack garbage; php-src 7ac9700d0d46
+
+diff --git a/ext/filter/sanitizing_filters.c b/ext/filter/sanitizing_filters.c
+index a8eb9539a..a60284dcb 100644
+--- a/ext/filter/sanitizing_filters.c
++++ b/ext/filter/sanitizing_filters.c
+@@ -71,7 +71,7 @@ static void php_filter_encode_url(zval *value, const unsigned char* chars, const
+ unsigned char *s = (unsigned char *)chars;
+ unsigned char *e = s + char_len;
+
+- memset(tmp, 1, sizeof(tmp)-1);
++ memset(tmp, 1, sizeof(tmp));
+
+ while (s < e) {
+ tmp[*s++] = 0;
diff --git a/php-5.3.29-GHSA-wg4p-4hqh-c3g9.patch b/php-5.3.29-GHSA-wg4p-4hqh-c3g9.patch
new file mode 100644
index 0000000..446e083
--- /dev/null
+++ b/php-5.3.29-GHSA-wg4p-4hqh-c3g9.patch
@@ -0,0 +1,81 @@
+Bug #72714 and GHSA-wg4p-4hqh-c3g9: XML_OPTION_SKIP_TAGSTART beyond the tag name read out
+of bounds; php-src 9164dc11e, 0e715e71d945
+
+diff --git a/ext/xml/xml.c b/ext/xml/xml.c
+index d40df9b08..f8c3a9d0d 100644
+--- a/ext/xml/xml.c
++++ b/ext/xml/xml.c
+@@ -65,6 +65,8 @@ ZEND_GET_MODULE(xml)
+ #endif /* COMPILE_DL_XML */
+ /* }}} */
+
++#define SKIP_TAGSTART(str) ((str) + ((size_t) parser->toffset > strlen(str) ? strlen(str) : (size_t) parser->toffset))
++
+ /* {{{ function prototypes */
+ PHP_MINIT_FUNCTION(xml);
+ PHP_MINFO_FUNCTION(xml);
+@@ -884,7 +886,7 @@ void _xml_startElementHandler(void *userData, const XML_Char *name, const XML_Ch
+
+ if (parser->startElementHandler) {
+ args[0] = _xml_resource_zval(parser->index);
+- args[1] = _xml_string_zval(((char *) tag_name) + parser->toffset);
++ args[1] = _xml_string_zval(SKIP_TAGSTART((char *) tag_name));
+ MAKE_STD_ZVAL(args[2]);
+ array_init(args[2]);
+
+@@ -915,9 +917,9 @@ void _xml_startElementHandler(void *userData, const XML_Char *name, const XML_Ch
+ array_init(tag);
+ array_init(atr);
+
+- _xml_add_to_info(parser,((char *) tag_name) + parser->toffset);
++ _xml_add_to_info(parser,SKIP_TAGSTART((char *) tag_name));
+
+- add_assoc_string(tag,"tag",((char *) tag_name) + parser->toffset,1); /* cast to avoid gcc-warning */
++ add_assoc_string(tag,"tag",SKIP_TAGSTART((char *) tag_name),1);
+ add_assoc_string(tag,"type","open",1);
+ add_assoc_long(tag,"level",parser->level);
+
+@@ -969,7 +971,7 @@ void _xml_endElementHandler(void *userData, const XML_Char *name)
+
+ if (parser->endElementHandler) {
+ args[0] = _xml_resource_zval(parser->index);
+- args[1] = _xml_string_zval(((char *) tag_name) + parser->toffset);
++ args[1] = _xml_string_zval(SKIP_TAGSTART((char *) tag_name));
+
+ if ((retval = xml_call_handler(parser, parser->endElementHandler, parser->endElementPtr, 2, args))) {
+ zval_ptr_dtor(&retval);
+@@ -986,9 +988,9 @@ void _xml_endElementHandler(void *userData, const XML_Char *name)
+
+ array_init(tag);
+
+- _xml_add_to_info(parser,((char *) tag_name) + parser->toffset);
++ _xml_add_to_info(parser,SKIP_TAGSTART((char *) tag_name));
+
+- add_assoc_string(tag,"tag",((char *) tag_name) + parser->toffset,1); /* cast to avoid gcc-warning */
++ add_assoc_string(tag,"tag",SKIP_TAGSTART((char *) tag_name),1);
+ add_assoc_string(tag,"type","close",1);
+ add_assoc_long(tag,"level",parser->level);
+
+@@ -1089,9 +1091,9 @@ void _xml_characterDataHandler(void *userData, const XML_Char *s, int len)
+
+ array_init(tag);
+
+- _xml_add_to_info(parser,parser->ltags[parser->level-1] + parser->toffset);
++ _xml_add_to_info(parser,SKIP_TAGSTART(parser->ltags[parser->level-1]));
+
+- add_assoc_string(tag,"tag",parser->ltags[parser->level-1] + parser->toffset,1);
++ add_assoc_string(tag,"tag",SKIP_TAGSTART(parser->ltags[parser->level-1]),1);
+ add_assoc_string(tag,"value",decoded_value,0);
+ add_assoc_string(tag,"type","cdata",1);
+ add_assoc_long(tag,"level",parser->level);
+@@ -1732,6 +1734,10 @@ PHP_FUNCTION(xml_parser_set_option)
+ case PHP_XML_OPTION_SKIP_TAGSTART:
+ convert_to_long_ex(val);
+ parser->toffset = Z_LVAL_PP(val);
++ if (parser->toffset < 0) {
++ php_error_docref(NULL TSRMLS_CC, E_NOTICE, "tagstart ignored");
++ parser->toffset = 0;
++ }
+ break;
+ case PHP_XML_OPTION_SKIP_WHITE:
+ convert_to_long_ex(val);
diff --git a/php-5.3.29-GHSA-www2-q4fc-65wf.patch b/php-5.3.29-GHSA-www2-q4fc-65wf.patch
new file mode 100644
index 0000000..4999f14
--- /dev/null
+++ b/php-5.3.29-GHSA-www2-q4fc-65wf.patch
@@ -0,0 +1,83 @@
+GHSA-www2-q4fc-65wf: dns_get_record(), checkdnsrr(), getmxrr(), inet_pton(), ip2long(),
+getservby*() and getprotobyname() truncated arguments at NUL; php-src ed70b1ea43a9
+
+diff --git a/ext/standard/basic_functions.c b/ext/standard/basic_functions.c
+index ff3b888f4..ac25cfecd 100644
+--- a/ext/standard/basic_functions.c
++++ b/ext/standard/basic_functions.c
+@@ -3885,7 +3885,7 @@ PHP_NAMED_FUNCTION(php_inet_pton)
+ int address_len;
+ char buffer[17];
+
+- if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &address, &address_len) == FAILURE) {
++ if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &address, &address_len) == FAILURE) {
+ RETURN_FALSE;
+ }
+
+@@ -3925,7 +3925,7 @@ PHP_FUNCTION(ip2long)
+ unsigned long int ip;
+ #endif
+
+- if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &addr, &addr_len) == FAILURE) {
++ if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &addr, &addr_len) == FAILURE) {
+ return;
+ }
+
+@@ -5631,7 +5631,7 @@ PHP_FUNCTION(getservbyname)
+ int name_len, proto_len;
+ struct servent *serv;
+
+- if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ss", &name, &name_len, &proto, &proto_len) == FAILURE) {
++ if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "pp", &name, &name_len, &proto, &proto_len) == FAILURE) {
+ return;
+ }
+
+@@ -5665,7 +5665,7 @@ PHP_FUNCTION(getservbyport)
+ long port;
+ struct servent *serv;
+
+- if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ls", &port, &proto, &proto_len) == FAILURE) {
++ if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "lp", &port, &proto, &proto_len) == FAILURE) {
+ return;
+ }
+
+@@ -5689,7 +5689,7 @@ PHP_FUNCTION(getprotobyname)
+ int name_len;
+ struct protoent *ent;
+
+- if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &name, &name_len) == FAILURE) {
++ if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p", &name, &name_len) == FAILURE) {
+ return;
+ }
+
+diff --git a/ext/standard/dns.c b/ext/standard/dns.c
+index 1f3672acf..364d8540f 100644
+--- a/ext/standard/dns.c
++++ b/ext/standard/dns.c
+@@ -367,7 +367,7 @@ PHP_FUNCTION(dns_check_record)
+ struct __res_state *handle = &state;
+ #endif
+
+- if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|s", &hostname, &hostname_len, &rectype, &rectype_len) == FAILURE) {
++ if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|s", &hostname, &hostname_len, &rectype, &rectype_len) == FAILURE) {
+ return;
+ }
+
+@@ -776,7 +776,7 @@ PHP_FUNCTION(dns_get_record)
+ int n, qd, an, ns = 0, ar = 0;
+ int type, first_query = 1, store_results = 1;
+
+- if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|lzz", &hostname, &hostname_len, &type_param, &authns, &addtl) == FAILURE) {
++ if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "p|lzz", &hostname, &hostname_len, &type_param, &authns, &addtl) == FAILURE) {
+ return;
+ }
+
+@@ -962,7 +962,7 @@ PHP_FUNCTION(dns_get_mx)
+ struct __res_state *handle = &state;
+ #endif
+
+- if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "sz|z", &hostname, &hostname_len, &mx_list, &weight_list) == FAILURE) {
++ if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "pz|z", &hostname, &hostname_len, &mx_list, &weight_list) == FAILURE) {
+ return;
+ }
+
diff --git a/php-5.3.29-libmagic-bug68819-71527.patch b/php-5.3.29-libmagic-bug68819-71527.patch
new file mode 100644
index 0000000..e6480e1
--- /dev/null
+++ b/php-5.3.29-libmagic-bug68819-71527.patch
@@ -0,0 +1,30 @@
+Bundled libmagic (taken from PHP-5.6) fixes from php-src PHP-5.6:
+f938112c49 bug #68819 (CVE-2015-4604, CVE-2015-4605), fe13566c93 + 4b0b1cec00 bug #71527
+
+diff --git a/ext/fileinfo/libmagic/funcs.c b/ext/fileinfo/libmagic/funcs.c
+index c15d21fca..3efcb26a9 100644
+--- a/ext/fileinfo/libmagic/funcs.c
++++ b/ext/fileinfo/libmagic/funcs.c
+@@ -414,7 +414,7 @@ file_check_mem(struct magic_set *ms, unsigned int level)
+ size_t len;
+
+ if (level >= ms->c.len) {
+- len = (ms->c.len += 20) * sizeof(*ms->c.li);
++ len = (ms->c.len = 20 + level) * sizeof(*ms->c.li);
+ ms->c.li = CAST(struct level_info *, (ms->c.li == NULL) ?
+ emalloc(len) :
+ erealloc(ms->c.li, len));
+diff --git a/ext/fileinfo/libmagic/softmagic.c b/ext/fileinfo/libmagic/softmagic.c
+index 1ef31f0f8..04bff5001 100644
+--- a/ext/fileinfo/libmagic/softmagic.c
++++ b/ext/fileinfo/libmagic/softmagic.c
+@@ -1072,6 +1072,9 @@ mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
+ if (bytecnt > nbytes) {
+ bytecnt = nbytes;
+ }
++ if (offset > bytecnt) {
++ offset = bytecnt;
++ }
+ if (s == NULL) {
+ ms->search.s_len = 0;
+ ms->search.s = NULL;
diff --git a/php-5.3.29-security-backports.patch b/php-5.3.29-security-backports.patch
new file mode 100644
index 0000000..e3fb5c7
--- /dev/null
+++ b/php-5.3.29-security-backports.patch
@@ -0,0 +1,37504 @@
+Security fixes from the PHP-5.3-security-backports branch of
+https://github.com/shivammathur/php-src-backports (up to 0b939600a0fe), tests
+and bundled libmagic changes left out, adapted to the PLD patch set.
+Its memory_limit handling is reworked by php-5.3.29-CVE-2026-109618.patch.
+
+diff --git a/TSRM/tsrm_virtual_cwd.c b/TSRM/tsrm_virtual_cwd.c
+index 81e8c3716..074b57fc1 100644
+--- a/TSRM/tsrm_virtual_cwd.c
++++ b/TSRM/tsrm_virtual_cwd.c
+@@ -1173,7 +1173,7 @@ CWD_API int virtual_file_ex(cwd_state *state, const char *path, verify_path_func
+ void *tmp;
+ TSRMLS_FETCH();
+
+- if (path_length == 0 || path_length >= MAXPATHLEN-1) {
++ if (path_length <= 0 || path_length >= MAXPATHLEN-1) {
+ #ifdef TSRM_WIN32
+ # if _MSC_VER < 1300
+ errno = EINVAL;
+diff --git a/Zend/zend.h b/Zend/zend.h
+index 723caa00f..470e1d99b 100644
+--- a/Zend/zend.h
++++ b/Zend/zend.h
+@@ -690,6 +690,19 @@ END_EXTERN_C()
+ } \
+ }
+
++#define ZVAL_COPY_VALUE(z, v) \
++ do { \
++ (z)->value = (v)->value; \
++ Z_TYPE_P(z) = Z_TYPE_P(v); \
++ } while (0)
++
++#define INIT_PZVAL_COPY(z, v) \
++ do { \
++ ZVAL_COPY_VALUE(z, v); \
++ Z_SET_REFCOUNT_P(z, 1); \
++ Z_UNSET_ISREF_P(z); \
++ } while (0)
++
+ #define SEPARATE_ZVAL_IF_NOT_REF(ppzv) \
+ if (!PZVAL_IS_REF(*ppzv)) { \
+ SEPARATE_ZVAL(ppzv); \
+diff --git a/Zend/zend_API.c b/Zend/zend_API.c
+index 68e87ceb9..6db295595 100644
+--- a/Zend/zend_API.c
++++ b/Zend/zend_API.c
+@@ -397,6 +397,7 @@ static char *zend_parse_arg_impl(int arg_num, zval **arg, va_list *va, char **sp
+ }
+ break;
+
++ case 'p':
+ case 's':
+ {
+ char **p = va_arg(*va, char **);
+@@ -423,13 +424,16 @@ static char *zend_parse_arg_impl(int arg_num, zval **arg, va_list *va, char **sp
+ }
+ *p = Z_STRVAL_PP(arg);
+ *pl = Z_STRLEN_PP(arg);
++ if (c == 'p' && CHECK_ZVAL_NULL_PATH(*arg)) {
++ return "valid path";
++ }
+ break;
+
+ case IS_OBJECT:
+ case IS_ARRAY:
+ case IS_RESOURCE:
+ default:
+- return "string";
++ return c == 's' ? "string" : "valid path";
+ }
+ }
+ break;
+@@ -697,7 +701,7 @@ static int zend_parse_va_args(int num_args, char *type_spec, va_list *va, int fl
+ }
+ /* break missing intentionally */
+ case 'l': case 'd':
+- case 'H': case 'b':
++ case 'H': case 'b': case 'p':
+ case 'r': case 'a':
+ case 'o': case 'O':
+ case 'z': case 'Z':
+@@ -966,6 +970,15 @@ ZEND_API int _array_init(zval *arg, uint size ZEND_FILE_LINE_DC) /* {{{ */
+ }
+ /* }}} */
+
++ZEND_API int _array_init_singleton(zval *arg ZEND_FILE_LINE_DC) /* {{{ */
++{
++ _array_init(arg, 0 ZEND_FILE_LINE_RELAY_CC);
++ /* A zero mask denotes an uninitialized table, so two is the minimum size. */
++ Z_ARRVAL_P(arg)->nTableSize = 2;
++ return SUCCESS;
++}
++/* }}} */
++
+ static int zend_merge_property(zval **value TSRMLS_DC, int num_args, va_list args, const zend_hash_key *hash_key) /* {{{ */
+ {
+ /* which name should a numeric property have ? */
+@@ -3382,6 +3395,30 @@ ZEND_API void zend_update_property(zend_class_entry *scope, zval *object, char *
+ }
+ /* }}} */
+
++ZEND_API void zend_unset_property(zend_class_entry *scope, zval *object, char *name, int name_length TSRMLS_DC) /* {{{ */
++{
++ zval *property;
++ zend_class_entry *old_scope = EG(scope);
++
++ EG(scope) = scope;
++
++ if (!Z_OBJ_HT_P(object)->unset_property) {
++ char *class_name;
++ zend_uint class_name_len;
++
++ zend_get_object_classname(object, &class_name, &class_name_len TSRMLS_CC);
++
++ zend_error(E_CORE_ERROR, "Property %s of class %s cannot be unset", name, class_name);
++ }
++ MAKE_STD_ZVAL(property);
++ ZVAL_STRINGL(property, name, name_length, 1);
++ Z_OBJ_HT_P(object)->unset_property(object, property TSRMLS_CC);
++ zval_ptr_dtor(&property);
++
++ EG(scope) = old_scope;
++}
++/* }}} */
++
+ ZEND_API void zend_update_property_null(zend_class_entry *scope, zval *object, char *name, int name_length TSRMLS_DC) /* {{{ */
+ {
+ zval *tmp;
+diff --git a/Zend/zend_API.h b/Zend/zend_API.h
+index 304715d53..483902c36 100644
+--- a/Zend/zend_API.h
++++ b/Zend/zend_API.h
+@@ -314,6 +314,7 @@ ZEND_API void zend_update_property_long(zend_class_entry *scope, zval *object, c
+ ZEND_API void zend_update_property_double(zend_class_entry *scope, zval *object, char *name, int name_length, double value TSRMLS_DC);
+ ZEND_API void zend_update_property_string(zend_class_entry *scope, zval *object, char *name, int name_length, const char *value TSRMLS_DC);
+ ZEND_API void zend_update_property_stringl(zend_class_entry *scope, zval *object, char *name, int name_length, const char *value, int value_length TSRMLS_DC);
++ZEND_API void zend_unset_property(zend_class_entry *scope, zval *object, char *name, int name_length TSRMLS_DC);
+
+ ZEND_API int zend_update_static_property(zend_class_entry *scope, char *name, int name_length, zval *value TSRMLS_DC);
+ ZEND_API int zend_update_static_property_null(zend_class_entry *scope, char *name, int name_length TSRMLS_DC);
+@@ -345,11 +346,13 @@ ZEND_API char *zend_get_type_by_const(int type);
+ #endif
+
+ #define array_init(arg) _array_init((arg), 0 ZEND_FILE_LINE_CC)
++#define array_init_singleton(arg) _array_init_singleton((arg) ZEND_FILE_LINE_CC)
+ #define array_init_size(arg, size) _array_init((arg), (size) ZEND_FILE_LINE_CC)
+ #define object_init(arg) _object_init((arg) ZEND_FILE_LINE_CC TSRMLS_CC)
+ #define object_init_ex(arg, ce) _object_init_ex((arg), (ce) ZEND_FILE_LINE_CC TSRMLS_CC)
+ #define object_and_properties_init(arg, ce, properties) _object_and_properties_init((arg), (ce), (properties) ZEND_FILE_LINE_CC TSRMLS_CC)
+ ZEND_API int _array_init(zval *arg, uint size ZEND_FILE_LINE_DC);
++ZEND_API int _array_init_singleton(zval *arg ZEND_FILE_LINE_DC);
+ ZEND_API int _object_init(zval *arg ZEND_FILE_LINE_DC TSRMLS_DC);
+ ZEND_API int _object_init_ex(zval *arg, zend_class_entry *ce ZEND_FILE_LINE_DC TSRMLS_DC);
+ ZEND_API int _object_and_properties_init(zval *arg, zend_class_entry *ce, HashTable *properties ZEND_FILE_LINE_DC TSRMLS_DC);
+@@ -517,6 +520,9 @@ END_EXTERN_C()
+ #define CHECK_ZVAL_STRING_REL(z)
+ #endif
+
++#define CHECK_ZVAL_NULL_PATH(p) (Z_STRLEN_P(p) != strlen(Z_STRVAL_P(p)))
++#define CHECK_NULL_PATH(p, l) (strlen(p) != l)
++
+ #define ZVAL_RESOURCE(z, l) { \
+ Z_TYPE_P(z) = IS_RESOURCE; \
+ Z_LVAL_P(z) = l; \
+@@ -544,6 +550,9 @@ END_EXTERN_C()
+ #define ZVAL_STRING(z, s, duplicate) { \
+ const char *__s=(s); \
+ Z_STRLEN_P(z) = strlen(__s); \
++ if (UNEXPECTED(Z_STRLEN_P(z) < 0)) { \
++ zend_error(E_ERROR, "String size overflow"); \
++ } \
+ Z_STRVAL_P(z) = (duplicate?estrndup(__s, Z_STRLEN_P(z)):(char*)__s);\
+ Z_TYPE_P(z) = IS_STRING; \
+ }
+@@ -605,6 +614,19 @@ END_EXTERN_C()
+ #define RETURN_FALSE { RETVAL_FALSE; return; }
+ #define RETURN_TRUE { RETVAL_TRUE; return; }
+
++/* Check that returned string length fits int */
++#define RETVAL_STRINGL_CHECK(s, len, dup) do { \
++ size_t __len = (len); \
++ if (UNEXPECTED(__len > INT_MAX)) { \
++ php_error_docref(NULL TSRMLS_CC, E_WARNING, "String too long, max is %d", INT_MAX); \
++ if(!(dup)) { \
++ efree((s)); \
++ } \
++ RETURN_FALSE; \
++ } \
++ RETVAL_STRINGL((s), (int)__len, (dup)); \
++} while (0)
++
+ #define SET_VAR_STRING(n, v) { \
+ { \
+ zval *var; \
+diff --git a/Zend/zend_alloc.c b/Zend/zend_alloc.c
+index 116d55160..f5ee84a1a 100644
+--- a/Zend/zend_alloc.c
++++ b/Zend/zend_alloc.c
+@@ -22,6 +22,7 @@
+
+ #include "zend.h"
+ #include "zend_alloc.h"
++#include "zend_execute.h"
+ #include "zend_globals.h"
+ #include "zend_operators.h"
+
+@@ -91,7 +92,7 @@ static void zend_mm_panic(const char *message)
+ #if ZEND_DEBUG && defined(HAVE_KILL) && defined(HAVE_GETPID)
+ kill(getpid(), SIGSEGV);
+ #endif
+- exit(1);
++ _exit(1);
+ }
+
+ /*******************/
+@@ -1670,6 +1671,36 @@ ZEND_API void zend_mm_shutdown(zend_mm_heap *heap, int full_shutdown, int silent
+ }
+ }
+
++ZEND_API void zend_mm_safe_error_ex(const char *format, ...)
++{
++ const char *script_filename = NULL;
++ uint script_lineno = 0;
++ va_list args;
++ char buf[1024];
++ TSRMLS_FETCH();
++
++ if (zend_is_executing(TSRMLS_C)) {
++ script_filename = zend_get_executed_filename(TSRMLS_C);
++ script_lineno = zend_get_executed_lineno(TSRMLS_C);
++ } else if (zend_is_compiling(TSRMLS_C)) {
++ script_filename = zend_get_compiled_filename(TSRMLS_C);
++ script_lineno = zend_get_compiled_lineno(TSRMLS_C);
++ }
++
++ va_start(args, format);
++ vsnprintf(buf, sizeof(buf), format, args);
++ buf[sizeof(buf) - 1] = '\0';
++ va_end(args);
++ fprintf(stderr, "\nFatal error: %s in %s on line %d\n",
++ buf, script_filename ? script_filename : "Unknown", script_lineno);
++
++ /* See http://support.microsoft.com/kb/190351 */
++#ifdef ZEND_WIN32
++ fflush(stderr);
++#endif
++ _exit(1);
++}
++
+ static void zend_mm_safe_error(zend_mm_heap *heap,
+ const char *format,
+ size_t limit,
+@@ -1679,59 +1710,12 @@ static void zend_mm_safe_error(zend_mm_heap *heap,
+ #endif
+ size_t size)
+ {
+- if (heap->reserve) {
+- _zend_mm_free_int(heap, heap->reserve ZEND_FILE_LINE_CC ZEND_FILE_LINE_EMPTY_CC);
+- heap->reserve = NULL;
+- }
+- if (heap->overflow == 0) {
+- char *error_filename;
+- uint error_lineno;
+- TSRMLS_FETCH();
+- if (zend_is_compiling(TSRMLS_C)) {
+- error_filename = zend_get_compiled_filename(TSRMLS_C);
+- error_lineno = zend_get_compiled_lineno(TSRMLS_C);
+- } else if (EG(in_execution)) {
+- error_filename = EG(active_op_array)?EG(active_op_array)->filename:NULL;
+- error_lineno = EG(opline_ptr)?(*EG(opline_ptr))->lineno:0;
+- } else {
+- error_filename = NULL;
+- error_lineno = 0;
+- }
+- if (!error_filename) {
+- error_filename = "Unknown";
+- }
+- heap->overflow = 1;
+- zend_try {
+- zend_error_noreturn(E_ERROR,
+- format,
+- limit,
+-#if ZEND_DEBUG
+- filename,
+- lineno,
+-#endif
+- size);
+- } zend_catch {
+- if (heap->overflow == 2) {
+- fprintf(stderr, "\nFatal error: ");
+- fprintf(stderr,
+- format,
+- limit,
++ (void) heap;
++ zend_mm_safe_error_ex(format, limit,
+ #if ZEND_DEBUG
+- filename,
+- lineno,
++ filename, lineno,
+ #endif
+- size);
+- fprintf(stderr, " in %s on line %d\n", error_filename, error_lineno);
+- }
+-/* See http://support.microsoft.com/kb/190351 */
+-#ifdef PHP_WIN32
+- fflush(stderr);
+-#endif
+- } zend_end_try();
+- } else {
+- heap->overflow = 2;
+- }
+- zend_bailout();
++ size);
+ }
+
+ static zend_mm_free_block *zend_mm_search_large_block(zend_mm_heap *heap, size_t true_size)
+@@ -2393,7 +2377,7 @@ static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
+ "rm"(offset));
+
+ if (UNEXPECTED(overflow)) {
+- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
++ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
+ return 0;
+ }
+ return res;
+@@ -2423,7 +2407,7 @@ static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
+ #undef LP_SUFF
+
+ if (UNEXPECTED(overflow)) {
+- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
++ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
+ return 0;
+ }
+ return res;
+@@ -2436,7 +2420,7 @@ static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
+ zend_ulong64 res = (zend_ulong64)nmemb * (zend_ulong64)size + (zend_ulong64)offset;
+
+ if (UNEXPECTED(res > (zend_ulong64)0xFFFFFFFFL)) {
+- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
++ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
+ return 0;
+ }
+ return (size_t) res;
+@@ -2451,7 +2435,7 @@ static inline size_t safe_address(size_t nmemb, size_t size, size_t offset)
+ double _delta = (double)res - _d;
+
+ if (UNEXPECTED((_d + _delta ) != _d)) {
+- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
++ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
+ return 0;
+ }
+ return res;
+diff --git a/Zend/zend_alloc.h b/Zend/zend_alloc.h
+index a7474b19b..921105ddf 100644
+--- a/Zend/zend_alloc.h
++++ b/Zend/zend_alloc.h
+@@ -27,6 +27,12 @@
+ #include "../TSRM/TSRM.h"
+ #include "zend.h"
+
++#ifdef ZEND_WIN32
++# include <process.h>
++#elif defined(HAVE_UNISTD_H)
++# include <unistd.h>
++#endif
++
+ #ifndef ZEND_MM_ALIGNMENT
+ # define ZEND_MM_ALIGNMENT 8
+ # define ZEND_MM_ALIGNMENT_LOG2 3
+@@ -97,7 +103,7 @@ inline static void * __zend_malloc(size_t len)
+ return tmp;
+ }
+ fprintf(stderr, "Out of memory\n");
+- exit(1);
++ _exit(1);
+ }
+
+ inline static void * __zend_calloc(size_t nmemb, size_t len)
+@@ -114,7 +120,7 @@ inline static void * __zend_realloc(void *p, size_t len)
+ return p;
+ }
+ fprintf(stderr, "Out of memory\n");
+- exit(1);
++ _exit(1);
+ }
+
+
+@@ -159,6 +165,8 @@ void zend_debug_alloc_output(char *format, ...);
+ ZEND_API size_t zend_memory_usage(int real_usage TSRMLS_DC);
+ ZEND_API size_t zend_memory_peak_usage(int real_usage TSRMLS_DC);
+
++ZEND_API void zend_mm_safe_error_ex(const char *format, ...);
++
+ END_EXTERN_C()
+
+ /* Macroses for zend_fast_cache.h compatibility */
+diff --git a/Zend/zend_builtin_functions.c b/Zend/zend_builtin_functions.c
+index c60cff522..c52dc56ea 100644
+--- a/Zend/zend_builtin_functions.c
++++ b/Zend/zend_builtin_functions.c
+@@ -683,6 +683,9 @@ repeat:
+ }
+ c.flags = case_sensitive; /* non persistent */
+ c.name = zend_strndup(name, name_len);
++ if (c.name == NULL) {
++ RETURN_FALSE;
++ }
+ c.name_len = name_len+1;
+ c.module_number = PHP_USER_CONSTANT;
+ if (zend_register_constant(&c TSRMLS_CC) == SUCCESS) {
+diff --git a/Zend/zend_exceptions.c b/Zend/zend_exceptions.c
+index 6a20b843c..bc1a9dbe6 100644
+--- a/Zend/zend_exceptions.c
++++ b/Zend/zend_exceptions.c
+@@ -40,7 +40,7 @@ void zend_exception_set_previous(zval *exception, zval *add_previous TSRMLS_DC)
+ if (exception == add_previous || !add_previous || !exception) {
+ return;
+ }
+- if (Z_TYPE_P(add_previous) != IS_OBJECT && !instanceof_function(Z_OBJCE_P(add_previous), default_exception_ce TSRMLS_CC)) {
++ if (Z_TYPE_P(add_previous) != IS_OBJECT || !instanceof_function(Z_OBJCE_P(add_previous), default_exception_ce TSRMLS_CC)) {
+ zend_error(E_ERROR, "Cannot set non exception as previous exception");
+ return;
+ }
+@@ -205,6 +205,34 @@ ZEND_METHOD(exception, __construct)
+ }
+ /* }}} */
+
++/* {{{ proto Exception::__wakeup()
++ Exception unserialize checks */
++#define CHECK_EXC_TYPE(name, type) \
++ value = zend_read_property(default_exception_ce, object, name, sizeof(name)-1, 1 TSRMLS_CC); \
++ if (value && Z_TYPE_P(value) != IS_NULL && Z_TYPE_P(value) != type) { \
++ zend_unset_property(default_exception_ce, object, name, sizeof(name)-1 TSRMLS_CC); \
++ }
++
++ZEND_METHOD(exception, __wakeup)
++{
++ zval *value;
++ zval *object = getThis();
++ HashTable *intern_ht = zend_std_get_properties(getThis() TSRMLS_CC);
++ CHECK_EXC_TYPE("message", IS_STRING);
++ CHECK_EXC_TYPE("string", IS_STRING);
++ CHECK_EXC_TYPE("code", IS_LONG);
++ CHECK_EXC_TYPE("file", IS_STRING);
++ CHECK_EXC_TYPE("line", IS_LONG);
++ CHECK_EXC_TYPE("trace", IS_ARRAY);
++ value = zend_read_property(default_exception_ce, object, "previous", sizeof("previous")-1, 1 TSRMLS_CC);
++ if (value && Z_TYPE_P(value) != IS_NULL && (Z_TYPE_P(value) != IS_OBJECT ||
++ !instanceof_function(Z_OBJCE_P(value), default_exception_ce TSRMLS_CC) ||
++ value == object)) {
++ zend_unset_property(default_exception_ce, object, "previous", sizeof("previous")-1 TSRMLS_CC);
++ }
++}
++/* }}} */
++
+ /* {{{ proto ErrorException::__construct(string message, int code, int severity [, string filename [, int lineno [, Exception previous]]])
+ ErrorException constructor */
+ ZEND_METHOD(error_exception, __construct)
+@@ -523,6 +551,9 @@ ZEND_METHOD(exception, getTraceAsString)
+ str = &res;
+
+ trace = zend_read_property(default_exception_ce, getThis(), "trace", sizeof("trace")-1, 1 TSRMLS_CC);
++ if(Z_TYPE_P(trace) != IS_ARRAY) {
++ RETURN_FALSE;
++ }
+ zend_hash_apply_with_arguments(Z_ARRVAL_P(trace) TSRMLS_CC, (apply_func_args_t)_build_trace_string, 3, str, len, &num);
+
+ s_tmp = emalloc(1 + MAX_LENGTH_OF_LONG + 7 + 1);
+@@ -576,7 +607,7 @@ ZEND_METHOD(exception, __toString)
+ exception = getThis();
+ ZVAL_STRINGL(&fname, "gettraceasstring", sizeof("gettraceasstring")-1, 1);
+
+- while (exception && Z_TYPE_P(exception) == IS_OBJECT) {
++ while (exception && Z_TYPE_P(exception) == IS_OBJECT && instanceof_function(Z_OBJCE_P(exception), default_exception_ce TSRMLS_CC)){
+ prev_str = str;
+ _default_exception_get_entry(exception, "message", sizeof("message")-1, &message TSRMLS_CC);
+ _default_exception_get_entry(exception, "file", sizeof("file")-1, &file TSRMLS_CC);
+@@ -586,6 +617,7 @@ ZEND_METHOD(exception, __toString)
+ convert_to_string(&file);
+ convert_to_long(&line);
+
++ trace = NULL;
+ fci.size = sizeof(fci);
+ fci.function_table = &Z_OBJCE_P(exception)->function_table;
+ fci.function_name = &fname;
+@@ -598,7 +630,7 @@ ZEND_METHOD(exception, __toString)
+
+ zend_call_function(&fci, NULL TSRMLS_CC);
+
+- if (Z_TYPE_P(trace) != IS_STRING) {
++ if (trace && Z_TYPE_P(trace) != IS_STRING) {
+ zval_ptr_dtor(&trace);
+ trace = NULL;
+ }
+@@ -619,7 +651,11 @@ ZEND_METHOD(exception, __toString)
+ zval_dtor(&file);
+ zval_dtor(&line);
+
+- exception = zend_read_property(default_exception_ce, exception, "previous", sizeof("previous")-1, 0 TSRMLS_CC);
++ Z_OBJPROP_P(exception)->nApplyCount++;
++ exception = zend_read_property(default_exception_ce, exception, "previous", sizeof("previous")-1, 1 TSRMLS_CC);
++ if (exception && Z_TYPE_P(exception) == IS_OBJECT && Z_OBJPROP_P(exception)->nApplyCount > 0) {
++ exception = NULL;
++ }
+
+ if (trace) {
+ zval_ptr_dtor(&trace);
+@@ -627,6 +663,17 @@ ZEND_METHOD(exception, __toString)
+ }
+ zval_dtor(&fname);
+
++ /* Reset apply counts */
++ exception = getThis();
++ while (exception && Z_TYPE_P(exception) == IS_OBJECT && instanceof_function(Z_OBJCE_P(exception), default_exception_ce TSRMLS_CC)) {
++ if(Z_OBJPROP_P(exception)->nApplyCount) {
++ Z_OBJPROP_P(exception)->nApplyCount--;
++ } else {
++ break;
++ }
++ exception = zend_read_property(default_exception_ce, exception, "previous", sizeof("previous")-1, 1 TSRMLS_CC);
++ }
++
+ /* We store the result in the private property string so we can access
+ * the result in uncaught exception handlers without memleaks. */
+ zend_update_property_string(default_exception_ce, getThis(), "string", sizeof("string")-1, str TSRMLS_CC);
+@@ -654,6 +701,7 @@ ZEND_END_ARG_INFO()
+ const static zend_function_entry default_exception_functions[] = {
+ ZEND_ME(exception, __clone, NULL, ZEND_ACC_PRIVATE|ZEND_ACC_FINAL)
+ ZEND_ME(exception, __construct, arginfo_exception___construct, ZEND_ACC_PUBLIC)
++ ZEND_ME(exception, __wakeup, NULL, ZEND_ACC_PUBLIC)
+ ZEND_ME(exception, getMessage, NULL, ZEND_ACC_PUBLIC|ZEND_ACC_FINAL)
+ ZEND_ME(exception, getCode, NULL, ZEND_ACC_PUBLIC|ZEND_ACC_FINAL)
+ ZEND_ME(exception, getFile, NULL, ZEND_ACC_PUBLIC|ZEND_ACC_FINAL)
+diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
+index 687520d1a..f520707bf 100644
+--- a/Zend/zend_execute_API.c
++++ b/Zend/zend_execute_API.c
+@@ -342,6 +342,17 @@ void shutdown_executor(TSRMLS_D) /* {{{ */
+ zend_shutdown_fpu(TSRMLS_C);
+
+ EG(active) = 0;
++
++ /* May be accessed before init_executor(). */
++ EG(user_error_handler) = NULL;
++ EG(user_exception_handler) = NULL;
++ memset(&EG(user_error_handlers_error_reporting), 0, sizeof(EG(user_error_handlers_error_reporting)));
++ memset(&EG(user_error_handlers), 0, sizeof(EG(user_error_handlers)));
++ memset(&EG(user_exception_handlers), 0, sizeof(EG(user_exception_handlers)));
++ EG(error_handling) = EH_NORMAL;
++ EG(exception) = NULL;
++ EG(objects_store).object_buckets = NULL;
++ EG(objects_store).top = 1;
+ }
+ /* }}} */
+
+diff --git a/Zend/zend_ini_parser.y b/Zend/zend_ini_parser.y
+index 2d428c3fe..ed203e7ff 100644
+--- a/Zend/zend_ini_parser.y
++++ b/Zend/zend_ini_parser.y
+@@ -49,7 +49,7 @@ static void zend_ini_do_op(char type, zval *result, zval *op1, zval *op2)
+ {
+ int i_result;
+ int i_op1, i_op2;
+- char str_result[MAX_LENGTH_OF_LONG];
++ char str_result[MAX_LENGTH_OF_LONG+1];
+
+ i_op1 = atoi(Z_STRVAL_P(op1));
+ free(Z_STRVAL_P(op1));
+diff --git a/Zend/zend_llist.c b/Zend/zend_llist.c
+index 8aa369b50..dcdafc4bc 100644
+--- a/Zend/zend_llist.c
++++ b/Zend/zend_llist.c
+@@ -117,6 +117,8 @@ ZEND_API void zend_llist_destroy(zend_llist *l)
+ current = next;
+ }
+
++ l->head = NULL;
++ l->tail = NULL;
+ l->count = 0;
+ }
+
+diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c
+index 4619b73ef..247df1979 100644
+--- a/Zend/zend_operators.c
++++ b/Zend/zend_operators.c
+@@ -1199,8 +1199,11 @@ ZEND_API int shift_right_function(zval *result, zval *op1, zval *op2 TSRMLS_DC)
+ /* must support result==op1 */
+ ZEND_API int add_char_to_string(zval *result, const zval *op1, const zval *op2) /* {{{ */
+ {
++ if (UNEXPECTED(Z_STRLEN_P(op1) < 0 || Z_STRLEN_P(op1) == INT_MAX)) {
++ zend_mm_safe_error_ex("String size overflow");
++ }
+ Z_STRLEN_P(result) = Z_STRLEN_P(op1) + 1;
+- Z_STRVAL_P(result) = (char *) erealloc(Z_STRVAL_P(op1), Z_STRLEN_P(result)+1);
++ Z_STRVAL_P(result) = (char *) erealloc(Z_STRVAL_P(op1), (size_t)Z_STRLEN_P(result) + 1);
+ Z_STRVAL_P(result)[Z_STRLEN_P(result) - 1] = (char) Z_LVAL_P(op2);
+ Z_STRVAL_P(result)[Z_STRLEN_P(result)] = 0;
+ Z_TYPE_P(result) = IS_STRING;
+@@ -1211,9 +1214,15 @@ ZEND_API int add_char_to_string(zval *result, const zval *op1, const zval *op2)
+ /* must support result==op1 */
+ ZEND_API int add_string_to_string(zval *result, const zval *op1, const zval *op2) /* {{{ */
+ {
+- int length = Z_STRLEN_P(op1) + Z_STRLEN_P(op2);
++ int length;
++
++ if (UNEXPECTED(Z_STRLEN_P(op1) < 0 || Z_STRLEN_P(op2) < 0 ||
++ Z_STRLEN_P(op1) > INT_MAX - Z_STRLEN_P(op2))) {
++ zend_mm_safe_error_ex("String size overflow");
++ }
++ length = Z_STRLEN_P(op1) + Z_STRLEN_P(op2);
+
+- Z_STRVAL_P(result) = (char *) erealloc(Z_STRVAL_P(op1), length+1);
++ Z_STRVAL_P(result) = (char *) erealloc(Z_STRVAL_P(op1), (size_t)length + 1);
+ memcpy(Z_STRVAL_P(result)+Z_STRLEN_P(op1), Z_STRVAL_P(op2), Z_STRLEN_P(op2));
+ Z_STRVAL_P(result)[length] = 0;
+ Z_STRLEN_P(result) = length;
+@@ -1246,23 +1255,20 @@ ZEND_API int concat_function(zval *result, zval *op1, zval *op2 TSRMLS_DC) /* {{
+ if (use_copy2) {
+ op2 = &op2_copy;
+ }
++ if (UNEXPECTED(Z_STRLEN_P(op1) < 0 || Z_STRLEN_P(op2) < 0 ||
++ Z_STRLEN_P(op1) > INT_MAX - Z_STRLEN_P(op2))) {
++ zend_mm_safe_error_ex("String size overflow");
++ }
+ if (result==op1) { /* special case, perform operations on result */
+ uint res_len = Z_STRLEN_P(op1) + Z_STRLEN_P(op2);
+-
+- if (Z_STRLEN_P(result) < 0 || (int) (Z_STRLEN_P(op1) + Z_STRLEN_P(op2)) < 0) {
+- efree(Z_STRVAL_P(result));
+- ZVAL_EMPTY_STRING(result);
+- zend_error(E_ERROR, "String size overflow");
+- }
+-
+- Z_STRVAL_P(result) = erealloc(Z_STRVAL_P(result), res_len+1);
++ Z_STRVAL_P(result) = safe_erealloc(Z_STRVAL_P(result), res_len, 1, 1);
+
+ memcpy(Z_STRVAL_P(result)+Z_STRLEN_P(result), Z_STRVAL_P(op2), Z_STRLEN_P(op2));
+ Z_STRVAL_P(result)[res_len]=0;
+ Z_STRLEN_P(result) = res_len;
+ } else {
+ Z_STRLEN_P(result) = Z_STRLEN_P(op1) + Z_STRLEN_P(op2);
+- Z_STRVAL_P(result) = (char *) emalloc(Z_STRLEN_P(result) + 1);
++ Z_STRVAL_P(result) = (char *) safe_emalloc(Z_STRLEN_P(result), 1, 1);
+ memcpy(Z_STRVAL_P(result), Z_STRVAL_P(op1), Z_STRLEN_P(op1));
+ memcpy(Z_STRVAL_P(result)+Z_STRLEN_P(op1), Z_STRVAL_P(op2), Z_STRLEN_P(op2));
+ Z_STRVAL_P(result)[Z_STRLEN_P(result)] = 0;
+diff --git a/Zend/zend_strtod.c b/Zend/zend_strtod.c
+index 0af4c0fbc..afcc312bf 100644
+--- a/Zend/zend_strtod.c
++++ b/Zend/zend_strtod.c
+@@ -481,7 +481,7 @@ static Bigint * Balloc(int k)
+ Bigint *rv;
+
+ if (k > Kmax) {
+- zend_error(E_ERROR, "Balloc() allocation exceeds list boundary");
++ zend_mm_safe_error_ex("Balloc() allocation exceeds list boundary");
+ }
+
+ _THREAD_PRIVATE_MUTEX_LOCK(dtoa_mutex);
+@@ -492,7 +492,7 @@ static Bigint * Balloc(int k)
+ rv = (Bigint *)MALLOC(sizeof(Bigint) + (x-1)*sizeof(Long));
+ if (!rv) {
+ _THREAD_PRIVATE_MUTEX_UNLOCK(dtoa_mutex);
+- zend_error(E_ERROR, "Balloc() failed to allocate memory");
++ zend_mm_safe_error_ex("Balloc() failed to allocate memory");
+ }
+ rv->k = k;
+ rv->maxwds = x;
+diff --git a/Zend/zend_ts_hash.c b/Zend/zend_ts_hash.c
+index f517fe856..87988fd0a 100644
+--- a/Zend/zend_ts_hash.c
++++ b/Zend/zend_ts_hash.c
+@@ -151,7 +151,6 @@ ZEND_API void zend_ts_hash_graceful_destroy(TsHashTable *ht)
+
+ #ifdef ZTS
+ tsrm_mutex_free(ht->mx_reader);
+- tsrm_mutex_free(ht->mx_reader);
+ #endif
+ }
+
+diff --git a/ext/bcmath/bcmath.c b/ext/bcmath/bcmath.c
+index c5fbce94d..f0fe1282b 100644
+--- a/ext/bcmath/bcmath.c
++++ b/ext/bcmath/bcmath.c
+@@ -201,6 +201,21 @@ static void php_str2num(bc_num *num, char *str TSRMLS_DC)
+ }
+ /* }}} */
+
++/* {{{ split_bc_num
++ * Convert to bc_num detecting scale */
++static bc_num split_bc_num(bc_num num) {
++ bc_num newnum;
++ if (num->n_refs >= 1) {
++ return num;
++ }
++ newnum = _bc_new_num_ex(0, 0, 0);
++ *newnum = *num;
++ newnum->n_refs = 1;
++ num->n_refs--;
++ return newnum;
++}
++/* }}} */
++
+ /* {{{ proto string bcadd(string left_operand, string right_operand [, int scale])
+ Returns the sum of two arbitrary precision numbers */
+ PHP_FUNCTION(bcadd)
+@@ -227,6 +242,7 @@ PHP_FUNCTION(bcadd)
+ bc_add (first, second, &result, scale);
+
+ if (result->n_scale > scale) {
++ result = split_bc_num(result);
+ result->n_scale = scale;
+ }
+
+@@ -266,6 +282,7 @@ PHP_FUNCTION(bcsub)
+ bc_sub (first, second, &result, scale);
+
+ if (result->n_scale > scale) {
++ result = split_bc_num(result);
+ result->n_scale = scale;
+ }
+
+@@ -305,6 +322,7 @@ PHP_FUNCTION(bcmul)
+ bc_multiply (first, second, &result, scale TSRMLS_CC);
+
+ if (result->n_scale > scale) {
++ result = split_bc_num(result);
+ result->n_scale = scale;
+ }
+
+@@ -345,6 +363,7 @@ PHP_FUNCTION(bcdiv)
+ switch (bc_divide(first, second, &result, scale TSRMLS_CC)) {
+ case 0: /* OK */
+ if (result->n_scale > scale) {
++ result = split_bc_num(result);
+ result->n_scale = scale;
+ }
+ Z_STRVAL_P(return_value) = bc_num2str(result);
+@@ -424,8 +443,9 @@ PHP_FUNCTION(bcpowmod)
+ scale_int = (int) ((int)scale < 0) ? 0 : scale;
+
+ if (bc_raisemod(first, second, mod, &result, scale_int TSRMLS_CC) != -1) {
+- if (result->n_scale > scale) {
+- result->n_scale = scale;
++ if (result->n_scale > scale_int) {
++ result = split_bc_num(result);
++ result->n_scale = scale_int;
+ }
+ Z_STRVAL_P(return_value) = bc_num2str(result);
+ Z_STRLEN_P(return_value) = strlen(Z_STRVAL_P(return_value));
+@@ -468,6 +488,7 @@ PHP_FUNCTION(bcpow)
+ bc_raise (first, second, &result, scale TSRMLS_CC);
+
+ if (result->n_scale > scale) {
++ result = split_bc_num(result);
+ result->n_scale = scale;
+ }
+
+@@ -504,6 +525,7 @@ PHP_FUNCTION(bcsqrt)
+
+ if (bc_sqrt (&result, scale TSRMLS_CC) != 0) {
+ if (result->n_scale > scale) {
++ result = split_bc_num(result);
+ result->n_scale = scale;
+ }
+ Z_STRVAL_P(return_value) = bc_num2str(result);
+diff --git a/ext/bcmath/libbcmath/src/init.c b/ext/bcmath/libbcmath/src/init.c
+index 986ad1df2..c51133be7 100644
+--- a/ext/bcmath/libbcmath/src/init.c
++++ b/ext/bcmath/libbcmath/src/init.c
+@@ -49,7 +49,10 @@ _bc_new_num_ex (length, scale, persistent)
+ int length, scale, persistent;
+ {
+ bc_num temp;
+-
++ /* PHP Change: add length check */
++ if ((size_t)length+(size_t)scale > INT_MAX) {
++ zend_error(E_ERROR, "Result too long, max is %d", INT_MAX);
++ }
+ /* PHP Change: malloc() -> pemalloc(), removed free_list code */
+ temp = (bc_num) safe_pemalloc (1, sizeof(bc_struct)+length, scale, persistent);
+ #if 0
+diff --git a/ext/bcmath/libbcmath/src/str2num.c b/ext/bcmath/libbcmath/src/str2num.c
+index c484c158e..a5e785016 100644
+--- a/ext/bcmath/libbcmath/src/str2num.c
++++ b/ext/bcmath/libbcmath/src/str2num.c
+@@ -57,9 +57,9 @@ bc_str2num (bc_num *num, char *str, int scale TSRMLS_DC)
+ zero_int = FALSE;
+ if ( (*ptr == '+') || (*ptr == '-')) ptr++; /* Sign */
+ while (*ptr == '0') ptr++; /* Skip leading zeros. */
+- while (isdigit((int)*ptr)) ptr++, digits++; /* digits */
++ while (*ptr >= '0' && *ptr <= '9') ptr++, digits++; /* digits */
+ if (*ptr == '.') ptr++; /* decimal point */
+- while (isdigit((int)*ptr)) ptr++, strscale++; /* digits */
++ while (*ptr >= '0' && *ptr <= '9') ptr++, strscale++; /* digits */
+ if ((*ptr != '\0') || (digits+strscale == 0))
+ {
+ *num = bc_copy_num (BCG(_zero_));
+diff --git a/ext/bz2/bz2.c b/ext/bz2/bz2.c
+index 2cea53009..4a67d9089 100644
+--- a/ext/bz2/bz2.c
++++ b/ext/bz2/bz2.c
+@@ -137,15 +137,20 @@ struct php_bz2_stream_data_t {
+ static size_t php_bz2iop_read(php_stream *stream, char *buf, size_t count TSRMLS_DC)
+ {
+ struct php_bz2_stream_data_t *self = (struct php_bz2_stream_data_t *) stream->abstract;
+- size_t ret;
++ int bz2_ret;
+
+- ret = BZ2_bzread(self->bz_file, buf, count);
++ bz2_ret = BZ2_bzread(self->bz_file, buf, count);
+
+- if (ret == 0) {
++ if (bz2_ret < 0) {
+ stream->eof = 1;
++ return -1;
+ }
+
+- return ret;
++ if (bz2_ret == 0) {
++ stream->eof = 1;
++ }
++
++ return (size_t)bz2_ret;
+ }
+
+ static size_t php_bz2iop_write(php_stream *stream, const char *buf, size_t count TSRMLS_DC)
+@@ -571,15 +576,25 @@ static PHP_FUNCTION(bzdecompress)
+ /* compression is better then 2:1, need to allocate more memory */
+ bzs.avail_out = source_len;
+ size = (bzs.total_out_hi32 * (unsigned int) -1) + bzs.total_out_lo32;
++ if (size > INT_MAX) {
++ /* no reason to continue if we're going to drop it anyway */
++ break;
++ }
+ dest = safe_erealloc(dest, 1, bzs.avail_out+1, (size_t) size );
+ bzs.next_out = dest + size;
+ }
+
+ if (error == BZ_STREAM_END || error == BZ_OK) {
+ size = (bzs.total_out_hi32 * (unsigned int) -1) + bzs.total_out_lo32;
+- dest = safe_erealloc(dest, 1, (size_t) size, 1);
+- dest[size] = '\0';
+- RETVAL_STRINGL(dest, (int) size, 0);
++ if (size > INT_MAX) {
++ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Decompressed size too big, max is %d", INT_MAX);
++ efree(dest);
++ RETVAL_LONG(BZ_MEM_ERROR);
++ } else {
++ dest = safe_erealloc(dest, 1, (size_t) size, 1);
++ dest[size] = '\0';
++ RETVAL_STRINGL(dest, (int) size, 0);
++ }
+ } else { /* real error */
+ efree(dest);
+ RETVAL_LONG(error);
+diff --git a/ext/date/lib/parse_date.c b/ext/date/lib/parse_date.c
+index bf70be00f..c630d8aa4 100644
+--- a/ext/date/lib/parse_date.c
++++ b/ext/date/lib/parse_date.c
+@@ -1,4 +1,5 @@
+-/* Generated by re2c 0.13.5 on Fri Jul 18 16:11:36 2014 */
++/* Generated by re2c 0.13.5 */
++#line 1 "ext/date/lib/parse_date.re"
+ /*
+ +----------------------------------------------------------------------+
+ | PHP Version 5 |
+@@ -873,9 +874,11 @@ static int scan(Scanner *s, timelib_tz_get_wrapper tz_get_wrapper)
+ std:
+ s->tok = cursor;
+ s->len = 0;
++#line 1000 "ext/date/lib/parse_date.re"
+
+
+
++#line 882 "ext/date/lib/parse_date.c"
+ {
+ YYCTYPE yych;
+ unsigned int yyaccept = 0;
+@@ -915,7 +918,7 @@ std:
+ };
+
+ YYDEBUG(0, *YYCURSOR);
+- if ((YYLIMIT - YYCURSOR) < 31) YYFILL(31);
++ if ((YYLIMIT - YYCURSOR) < 33) YYFILL(33);
+ yych = *YYCURSOR;
+ YYDEBUG(-1, yych);
+ switch (yych) {
+@@ -995,6 +998,7 @@ std:
+ }
+ yy2:
+ YYDEBUG(2, *YYCURSOR);
++#line 1085 "ext/date/lib/parse_date.re"
+ {
+ DEBUG_OUTPUT("firstdayof | lastdayof");
+ TIMELIB_INIT;
+@@ -1010,6 +1014,7 @@ yy2:
+ TIMELIB_DEINIT;
+ return TIMELIB_LF_DAY_OF_MONTH;
+ }
++#line 1018 "ext/date/lib/parse_date.c"
+ yy3:
+ YYDEBUG(3, *YYCURSOR);
+ ++YYCURSOR;
+@@ -1019,19 +1024,20 @@ yy3:
+ } else {
+ if (yych <= '@') goto yy4;
+ if (yych <= 'D') goto yy141;
+- goto yy1523;
++ goto yy1465;
+ }
+ } else {
+ if (yych <= 'd') {
+ if (yych <= 'Z') goto yy141;
+ if (yych >= 'a') goto yy146;
+ } else {
+- if (yych <= 'e') goto yy1532;
++ if (yych <= 'e') goto yy1474;
+ if (yych <= 'z') goto yy146;
+ }
+ }
+ yy4:
+ YYDEBUG(4, *YYCURSOR);
++#line 1679 "ext/date/lib/parse_date.re"
+ {
+ int tz_not_found;
+ DEBUG_OUTPUT("tzcorrection | tz");
+@@ -1044,6 +1050,7 @@ yy4:
+ TIMELIB_DEINIT;
+ return TIMELIB_TIMEZONE;
+ }
++#line 1054 "ext/date/lib/parse_date.c"
+ yy5:
+ YYDEBUG(5, *YYCURSOR);
+ yych = *++YYCURSOR;
+@@ -1054,7 +1061,7 @@ yy5:
+ } else {
+ if (yych <= '@') goto yy4;
+ if (yych <= 'D') goto yy141;
+- goto yy1523;
++ goto yy1465;
+ }
+ } else {
+ if (yych <= 'd') {
+@@ -1062,7 +1069,7 @@ yy5:
+ if (yych <= '`') goto yy4;
+ goto yy141;
+ } else {
+- if (yych <= 'e') goto yy1523;
++ if (yych <= 'e') goto yy1465;
+ if (yych <= 'z') goto yy141;
+ goto yy4;
+ }
+@@ -1077,12 +1084,12 @@ yy6:
+ goto yy141;
+ } else {
+ if (yych <= 'H') {
+- if (yych <= 'E') goto yy1494;
++ if (yych <= 'E') goto yy1436;
+ goto yy141;
+ } else {
+- if (yych <= 'I') goto yy1495;
++ if (yych <= 'I') goto yy1437;
+ if (yych <= 'N') goto yy141;
+- goto yy1493;
++ goto yy1435;
+ }
+ }
+ } else {
+@@ -1091,15 +1098,15 @@ yy6:
+ if (yych <= 'Z') goto yy141;
+ goto yy4;
+ } else {
+- if (yych == 'e') goto yy1510;
++ if (yych == 'e') goto yy1452;
+ goto yy146;
+ }
+ } else {
+ if (yych <= 'n') {
+- if (yych <= 'i') goto yy1511;
++ if (yych <= 'i') goto yy1453;
+ goto yy146;
+ } else {
+- if (yych <= 'o') goto yy1509;
++ if (yych <= 'o') goto yy1451;
+ if (yych <= 'z') goto yy146;
+ goto yy4;
+ }
+@@ -1115,12 +1122,12 @@ yy7:
+ goto yy141;
+ } else {
+ if (yych <= 'H') {
+- if (yych <= 'E') goto yy1494;
++ if (yych <= 'E') goto yy1436;
+ goto yy141;
+ } else {
+- if (yych <= 'I') goto yy1495;
++ if (yych <= 'I') goto yy1437;
+ if (yych <= 'N') goto yy141;
+- goto yy1493;
++ goto yy1435;
+ }
+ }
+ } else {
+@@ -1129,15 +1136,15 @@ yy7:
+ if (yych <= 'Z') goto yy141;
+ goto yy4;
+ } else {
+- if (yych == 'e') goto yy1494;
++ if (yych == 'e') goto yy1436;
+ goto yy141;
+ }
+ } else {
+ if (yych <= 'n') {
+- if (yych <= 'i') goto yy1495;
++ if (yych <= 'i') goto yy1437;
+ goto yy141;
+ } else {
+- if (yych <= 'o') goto yy1493;
++ if (yych <= 'o') goto yy1435;
+ if (yych <= 'z') goto yy141;
+ goto yy4;
+ }
+@@ -1150,24 +1157,24 @@ yy8:
+ if (yych <= 'A') {
+ if (yych == ')') goto yy140;
+ if (yych <= '@') goto yy4;
+- goto yy1463;
++ goto yy1405;
+ } else {
+- if (yych == 'I') goto yy1464;
++ if (yych == 'I') goto yy1406;
+ if (yych <= 'N') goto yy141;
+- goto yy1465;
++ goto yy1407;
+ }
+ } else {
+ if (yych <= 'h') {
+ if (yych <= 'Z') goto yy141;
+ if (yych <= '`') goto yy4;
+- if (yych <= 'a') goto yy1478;
++ if (yych <= 'a') goto yy1420;
+ goto yy146;
+ } else {
+ if (yych <= 'n') {
+- if (yych <= 'i') goto yy1479;
++ if (yych <= 'i') goto yy1421;
+ goto yy146;
+ } else {
+- if (yych <= 'o') goto yy1480;
++ if (yych <= 'o') goto yy1422;
+ if (yych <= 'z') goto yy146;
+ goto yy4;
+ }
+@@ -1180,24 +1187,24 @@ yy9:
+ if (yych <= 'A') {
+ if (yych == ')') goto yy140;
+ if (yych <= '@') goto yy4;
+- goto yy1463;
++ goto yy1405;
+ } else {
+- if (yych == 'I') goto yy1464;
++ if (yych == 'I') goto yy1406;
+ if (yych <= 'N') goto yy141;
+- goto yy1465;
++ goto yy1407;
+ }
+ } else {
+ if (yych <= 'h') {
+ if (yych <= 'Z') goto yy141;
+ if (yych <= '`') goto yy4;
+- if (yych <= 'a') goto yy1463;
++ if (yych <= 'a') goto yy1405;
+ goto yy141;
+ } else {
+ if (yych <= 'n') {
+- if (yych <= 'i') goto yy1464;
++ if (yych <= 'i') goto yy1406;
+ goto yy141;
+ } else {
+- if (yych <= 'o') goto yy1465;
++ if (yych <= 'o') goto yy1407;
+ if (yych <= 'z') goto yy141;
+ goto yy4;
+ }
+@@ -1211,15 +1218,15 @@ yy10:
+ switch (yych) {
+ case ')': goto yy140;
+ case '0':
+- case '1': goto yy1393;
+- case '2': goto yy1394;
++ case '1': goto yy1335;
++ case '2': goto yy1336;
+ case '3':
+ case '4':
+ case '5':
+ case '6':
+ case '7':
+ case '8':
+- case '9': goto yy1395;
++ case '9': goto yy1337;
+ case 'A':
+ case 'B':
+ case 'C':
+@@ -1241,11 +1248,11 @@ yy10:
+ case 'X':
+ case 'Y':
+ case 'Z': goto yy141;
+- case 'E': goto yy1388;
+- case 'H': goto yy1389;
+- case 'O': goto yy1390;
+- case 'U': goto yy1391;
+- case 'W': goto yy1392;
++ case 'E': goto yy1330;
++ case 'H': goto yy1331;
++ case 'O': goto yy1332;
++ case 'U': goto yy1333;
++ case 'W': goto yy1334;
+ case 'a':
+ case 'b':
+ case 'c':
+@@ -1267,11 +1274,11 @@ yy10:
+ case 'x':
+ case 'y':
+ case 'z': goto yy146;
+- case 'e': goto yy1431;
+- case 'h': goto yy1432;
+- case 'o': goto yy1433;
+- case 'u': goto yy1434;
+- case 'w': goto yy1435;
++ case 'e': goto yy1373;
++ case 'h': goto yy1374;
++ case 'o': goto yy1375;
++ case 'u': goto yy1376;
++ case 'w': goto yy1377;
+ default: goto yy4;
+ }
+ yy11:
+@@ -1282,15 +1289,15 @@ yy11:
+ switch (yych) {
+ case ')': goto yy140;
+ case '0':
+- case '1': goto yy1393;
+- case '2': goto yy1394;
++ case '1': goto yy1335;
++ case '2': goto yy1336;
+ case '3':
+ case '4':
+ case '5':
+ case '6':
+ case '7':
+ case '8':
+- case '9': goto yy1395;
++ case '9': goto yy1337;
+ case 'A':
+ case 'B':
+ case 'C':
+@@ -1334,30 +1341,32 @@ yy11:
+ case 'y':
+ case 'z': goto yy141;
+ case 'E':
+- case 'e': goto yy1388;
++ case 'e': goto yy1330;
+ case 'H':
+- case 'h': goto yy1389;
++ case 'h': goto yy1331;
+ case 'O':
+- case 'o': goto yy1390;
++ case 'o': goto yy1332;
+ case 'U':
+- case 'u': goto yy1391;
++ case 'u': goto yy1333;
+ case 'W':
+- case 'w': goto yy1392;
++ case 'w': goto yy1334;
+ default: goto yy4;
+ }
+ yy12:
+ YYDEBUG(12, *YYCURSOR);
+ yyaccept = 1;
+ yych = *(YYMARKER = ++YYCURSOR);
+- if (yych == '-') goto yy1384;
++ if (yych == '-') goto yy1326;
+ if (yych <= '/') goto yy13;
+- if (yych <= '9') goto yy1385;
++ if (yych <= '9') goto yy1327;
+ yy13:
+ YYDEBUG(13, *YYCURSOR);
++#line 1774 "ext/date/lib/parse_date.re"
+ {
+ add_error(s, "Unexpected character");
+ goto std;
+ }
++#line 1370 "ext/date/lib/parse_date.c"
+ yy14:
+ YYDEBUG(14, *YYCURSOR);
+ yych = *++YYCURSOR;
+@@ -1369,16 +1378,16 @@ yy14:
+ } else {
+ if (yych <= '@') goto yy4;
+ if (yych <= 'D') goto yy141;
+- goto yy1320;
++ goto yy1261;
+ }
+ } else {
+ if (yych <= 'N') {
+- if (yych == 'I') goto yy1321;
++ if (yych == 'I') goto yy1262;
+ goto yy141;
+ } else {
+- if (yych <= 'O') goto yy1322;
++ if (yych <= 'O') goto yy1263;
+ if (yych <= 'Q') goto yy141;
+- goto yy1323;
++ goto yy1264;
+ }
+ }
+ } else {
+@@ -1388,16 +1397,16 @@ yy14:
+ if (yych <= '`') goto yy4;
+ goto yy146;
+ } else {
+- if (yych <= 'e') goto yy1361;
++ if (yych <= 'e') goto yy1303;
+ if (yych <= 'h') goto yy146;
+- goto yy1362;
++ goto yy1304;
+ }
+ } else {
+ if (yych <= 'q') {
+- if (yych == 'o') goto yy1363;
++ if (yych == 'o') goto yy1305;
+ goto yy146;
+ } else {
+- if (yych <= 'r') goto yy1364;
++ if (yych <= 'r') goto yy1306;
+ if (yych <= 'z') goto yy146;
+ goto yy4;
+ }
+@@ -1414,16 +1423,16 @@ yy15:
+ } else {
+ if (yych <= '@') goto yy4;
+ if (yych <= 'D') goto yy141;
+- goto yy1320;
++ goto yy1261;
+ }
+ } else {
+ if (yych <= 'N') {
+- if (yych == 'I') goto yy1321;
++ if (yych == 'I') goto yy1262;
+ goto yy141;
+ } else {
+- if (yych <= 'O') goto yy1322;
++ if (yych <= 'O') goto yy1263;
+ if (yych <= 'Q') goto yy141;
+- goto yy1323;
++ goto yy1264;
+ }
+ }
+ } else {
+@@ -1433,16 +1442,16 @@ yy15:
+ if (yych <= '`') goto yy4;
+ goto yy141;
+ } else {
+- if (yych <= 'e') goto yy1320;
++ if (yych <= 'e') goto yy1261;
+ if (yych <= 'h') goto yy141;
+- goto yy1321;
++ goto yy1262;
+ }
+ } else {
+ if (yych <= 'q') {
+- if (yych == 'o') goto yy1322;
++ if (yych == 'o') goto yy1263;
+ goto yy141;
+ } else {
+- if (yych <= 'r') goto yy1323;
++ if (yych <= 'r') goto yy1264;
+ if (yych <= 'z') goto yy141;
+ goto yy4;
+ }
+@@ -1454,13 +1463,13 @@ yy16:
+ if (yych <= 'A') {
+ if (yych == ')') goto yy140;
+ if (yych <= '@') goto yy4;
+- goto yy1307;
++ goto yy1248;
+ } else {
+ if (yych <= '`') {
+ if (yych <= 'Z') goto yy141;
+ goto yy4;
+ } else {
+- if (yych <= 'a') goto yy1317;
++ if (yych <= 'a') goto yy1258;
+ if (yych <= 'z') goto yy146;
+ goto yy4;
+ }
+@@ -1471,13 +1480,13 @@ yy17:
+ if (yych <= 'A') {
+ if (yych == ')') goto yy140;
+ if (yych <= '@') goto yy4;
+- goto yy1307;
++ goto yy1248;
+ } else {
+ if (yych <= '`') {
+ if (yych <= 'Z') goto yy141;
+ goto yy4;
+ } else {
+- if (yych <= 'a') goto yy1307;
++ if (yych <= 'a') goto yy1248;
+ if (yych <= 'z') goto yy141;
+ goto yy4;
+ }
+@@ -1488,13 +1497,13 @@ yy18:
+ if (yych <= 'A') {
+ if (yych == ')') goto yy140;
+ if (yych <= '@') goto yy4;
+- goto yy1287;
++ goto yy1227;
+ } else {
+ if (yych <= '`') {
+ if (yych <= 'Z') goto yy141;
+ goto yy4;
+ } else {
+- if (yych <= 'a') goto yy1304;
++ if (yych <= 'a') goto yy1245;
+ if (yych <= 'z') goto yy146;
+ goto yy4;
+ }
+@@ -1505,13 +1514,13 @@ yy19:
+ if (yych <= 'A') {
+ if (yych == ')') goto yy140;
+ if (yych <= '@') goto yy4;
+- goto yy1287;
++ goto yy1227;
+ } else {
+ if (yych <= '`') {
+ if (yych <= 'Z') goto yy141;
+ goto yy4;
+ } else {
+- if (yych <= 'a') goto yy1287;
++ if (yych <= 'a') goto yy1227;
+ if (yych <= 'z') goto yy141;
+ goto yy4;
+ }
+@@ -1526,17 +1535,17 @@ yy20:
+ goto yy140;
+ } else {
+ if (yych <= '@') goto yy4;
+- if (yych <= 'A') goto yy1230;
++ if (yych <= 'A') goto yy1170;
+ goto yy141;
+ }
+ } else {
+ if (yych <= 'H') {
+- if (yych <= 'E') goto yy1229;
++ if (yych <= 'E') goto yy1169;
+ goto yy141;
+ } else {
+- if (yych <= 'I') goto yy1231;
++ if (yych <= 'I') goto yy1171;
+ if (yych <= 'T') goto yy141;
+- goto yy1232;
++ goto yy1172;
+ }
+ }
+ } else {
+@@ -1545,16 +1554,16 @@ yy20:
+ if (yych <= 'Z') goto yy141;
+ goto yy4;
+ } else {
+- if (yych <= 'a') goto yy1259;
++ if (yych <= 'a') goto yy1199;
+ if (yych <= 'd') goto yy146;
+- goto yy1258;
++ goto yy1198;
+ }
+ } else {
+ if (yych <= 't') {
+- if (yych == 'i') goto yy1260;
++ if (yych == 'i') goto yy1200;
+ goto yy146;
+ } else {
+- if (yych <= 'u') goto yy1261;
++ if (yych <= 'u') goto yy1201;
+ if (yych <= 'z') goto yy146;
+ goto yy4;
+ }
+@@ -1570,17 +1579,17 @@ yy21:
+ goto yy140;
+ } else {
+ if (yych <= '@') goto yy4;
+- if (yych <= 'A') goto yy1230;
++ if (yych <= 'A') goto yy1170;
+ goto yy141;
+ }
+ } else {
+ if (yych <= 'H') {
+- if (yych <= 'E') goto yy1229;
++ if (yych <= 'E') goto yy1169;
+ goto yy141;
+ } else {
+- if (yych <= 'I') goto yy1231;
++ if (yych <= 'I') goto yy1171;
+ if (yych <= 'T') goto yy141;
+- goto yy1232;
++ goto yy1172;
+ }
+ }
+ } else {
+@@ -1589,16 +1598,16 @@ yy21:
+ if (yych <= 'Z') goto yy141;
+ goto yy4;
+ } else {
+- if (yych <= 'a') goto yy1230;
++ if (yych <= 'a') goto yy1170;
+ if (yych <= 'd') goto yy141;
+- goto yy1229;
++ goto yy1169;
+ }
+ } else {
+ if (yych <= 't') {
+- if (yych == 'i') goto yy1231;
++ if (yych == 'i') goto yy1171;
+ goto yy141;
+ } else {
+- if (yych <= 'u') goto yy1232;
++ if (yych <= 'u') goto yy1172;
+ if (yych <= 'z') goto yy141;
+ goto yy4;
+ }
+@@ -1612,18 +1621,18 @@ yy22:
+ if (yych == ')') goto yy140;
+ goto yy4;
+ } else {
+- if (yych == 'I') goto yy1199;
++ if (yych == 'I') goto yy1139;
+ if (yych <= 'K') goto yy141;
+- goto yy1200;
++ goto yy1140;
+ }
+ } else {
+ if (yych <= 'i') {
+ if (yych <= 'Z') goto yy141;
+ if (yych <= '`') goto yy4;
+ if (yych <= 'h') goto yy146;
+- goto yy1217;
++ goto yy1157;
+ } else {
+- if (yych == 'l') goto yy1218;
++ if (yych == 'l') goto yy1158;
+ if (yych <= 'z') goto yy146;
+ goto yy4;
+ }
+@@ -1636,18 +1645,18 @@ yy23:
+ if (yych == ')') goto yy140;
+ goto yy4;
+ } else {
+- if (yych == 'I') goto yy1199;
++ if (yych == 'I') goto yy1139;
+ if (yych <= 'K') goto yy141;
+- goto yy1200;
++ goto yy1140;
+ }
+ } else {
+ if (yych <= 'i') {
+ if (yych <= 'Z') goto yy141;
+ if (yych <= '`') goto yy4;
+ if (yych <= 'h') goto yy141;
+- goto yy1199;
++ goto yy1139;
+ } else {
+- if (yych == 'l') goto yy1200;
++ if (yych == 'l') goto yy1140;
+ if (yych <= 'z') goto yy141;
+ goto yy4;
+ }
+@@ -1662,7 +1671,7 @@ yy24:
+ } else {
+ if (yych <= '@') goto yy4;
+ if (yych <= 'Q') goto yy141;
+- goto yy1098;
++ goto yy1038;
+ }
+ } else {
+ if (yych <= 'q') {
+@@ -1670,7 +1679,7 @@ yy24:
+ if (yych <= '`') goto yy4;
+ goto yy146;
+ } else {
+- if (yych <= 'r') goto yy1192;
++ if (yych <= 'r') goto yy1132;
+ if (yych <= 'z') goto yy146;
+ goto yy4;
+ }
+@@ -1685,7 +1694,7 @@ yy25:
+ } else {
+ if (yych <= '@') goto yy4;
+ if (yych <= 'Q') goto yy141;
+- goto yy1098;
++ goto yy1038;
+ }
+ } else {
+ if (yych <= 'q') {
+@@ -1693,7 +1702,7 @@ yy25:
+ if (yych <= '`') goto yy4;
+ goto yy141;
+ } else {
+- if (yych <= 'r') goto yy1098;
++ if (yych <= 'r') goto yy1038;
+ if (yych <= 'z') goto yy141;
+ goto yy4;
+ }
+@@ -1704,7 +1713,7 @@ yy26:
+ yych = *(YYMARKER = ++YYCURSOR);
+ YYDEBUG(-1, yych);
+ switch (yych) {
+- case '\t': goto yy1052;
++ case '\t': goto yy992;
+ case ' ':
+ case 'A':
+ case 'D':
+@@ -1729,11 +1738,11 @@ yy26:
+ case 'm':
+ case 'o':
+ case 'w':
+- case 'y': goto yy1054;
+- case '-': goto yy473;
+- case '.': goto yy1064;
+- case '/': goto yy472;
+- case '0': goto yy1097;
++ case 'y': goto yy994;
++ case '-': goto yy413;
++ case '.': goto yy1004;
++ case '/': goto yy412;
++ case '0': goto yy1037;
+ case '1':
+ case '2':
+ case '3':
+@@ -1742,12 +1751,12 @@ yy26:
+ case '6':
+ case '7':
+ case '8':
+- case '9': goto yy1096;
+- case ':': goto yy1065;
+- case 'n': goto yy470;
+- case 'r': goto yy471;
+- case 's': goto yy464;
+- case 't': goto yy468;
++ case '9': goto yy1036;
++ case ':': goto yy1005;
++ case 'n': goto yy410;
++ case 'r': goto yy411;
++ case 's': goto yy404;
++ case 't': goto yy408;
+ default: goto yy13;
+ }
+ yy27:
+@@ -1756,7 +1765,7 @@ yy27:
+ yych = *(YYMARKER = ++YYCURSOR);
+ YYDEBUG(-1, yych);
+ switch (yych) {
+- case '\t': goto yy460;
++ case '\t': goto yy400;
+ case ' ':
+ case 'A':
+ case 'D':
+@@ -1783,25 +1792,25 @@ yy27:
+ case 'o':
+ case 'p':
+ case 'w':
+- case 'y': goto yy462;
+- case '-': goto yy473;
+- case '.': goto yy474;
+- case '/': goto yy472;
++ case 'y': goto yy402;
++ case '-': goto yy413;
++ case '.': goto yy414;
++ case '/': goto yy412;
+ case '0':
+ case '1':
+- case '2': goto yy1096;
++ case '2': goto yy1036;
+ case '3':
+ case '4':
+ case '5':
+ case '6':
+ case '7':
+ case '8':
+- case '9': goto yy1063;
+- case ':': goto yy483;
+- case 'n': goto yy470;
+- case 'r': goto yy471;
+- case 's': goto yy464;
+- case 't': goto yy468;
++ case '9': goto yy1003;
++ case ':': goto yy423;
++ case 'n': goto yy410;
++ case 'r': goto yy411;
++ case 's': goto yy404;
++ case 't': goto yy408;
+ default: goto yy13;
+ }
+ yy28:
+@@ -1810,7 +1819,7 @@ yy28:
+ yych = *(YYMARKER = ++YYCURSOR);
+ YYDEBUG(-1, yych);
+ switch (yych) {
+- case '\t': goto yy460;
++ case '\t': goto yy400;
+ case ' ':
+ case 'A':
+ case 'D':
+@@ -1837,25 +1846,25 @@ yy28:
+ case 'o':
+ case 'p':
+ case 'w':
+- case 'y': goto yy462;
+- case '-': goto yy473;
+- case '.': goto yy474;
+- case '/': goto yy472;
++ case 'y': goto yy402;
++ case '-': goto yy413;
++ case '.': goto yy414;
++ case '/': goto yy412;
+ case '0':
+ case '1':
+ case '2':
+ case '3':
+- case '4': goto yy1063;
++ case '4': goto yy1003;
+ case '5':
+ case '6':
+ case '7':
+ case '8':
+- case '9': goto yy1050;
+- case ':': goto yy483;
+- case 'n': goto yy470;
+- case 'r': goto yy471;
+- case 's': goto yy464;
+- case 't': goto yy468;
++ case '9': goto yy990;
++ case ':': goto yy423;
++ case 'n': goto yy410;
++ case 'r': goto yy411;
++ case 's': goto yy404;
++ case 't': goto yy408;
+ default: goto yy13;
+ }
+ yy29:
+@@ -1864,7 +1873,7 @@ yy29:
+ yych = *(YYMARKER = ++YYCURSOR);
+ YYDEBUG(-1, yych);
+ switch (yych) {
+- case '\t': goto yy460;
++ case '\t': goto yy400;
+ case ' ':
+ case 'A':
+ case 'D':
+@@ -1891,12 +1900,12 @@ yy29:
+ case 'o':
+ case 'p':
+ case 'w':
+- case 'y': goto yy462;
+- case '-': goto yy473;
+- case '.': goto yy474;
+- case '/': goto yy472;
++ case 'y': goto yy402;
++ case '-': goto yy413;
++ case '.': goto yy414;
++ case '/': goto yy412;
+ case '0':
+- case '1': goto yy1050;
++ case '1': goto yy990;
+ case '2':
+ case '3':
+ case '4':
+@@ -1904,12 +1913,12 @@ yy29:
+ case '6':
+ case '7':
+ case '8':
+- case '9': goto yy469;
+- case ':': goto yy483;
+- case 'n': goto yy470;
+- case 'r': goto yy471;
+- case 's': goto yy464;
+- case 't': goto yy468;
++ case '9': goto yy409;
++ case ':': goto yy423;
++ case 'n': goto yy410;
++ case 'r': goto yy411;
++ case 's': goto yy404;
++ case 't': goto yy408;
+ default: goto yy13;
+ }
+ yy30:
+@@ -1918,7 +1927,7 @@ yy30:
+ yych = *(YYMARKER = ++YYCURSOR);
+ YYDEBUG(-1, yych);
+ switch (yych) {
+- case '\t': goto yy460;
++ case '\t': goto yy400;
+ case ' ':
+ case 'A':
+ case 'D':
+@@ -1945,10 +1954,10 @@ yy30:
+ case 'o':
+ case 'p':
+ case 'w':
+- case 'y': goto yy462;
+- case '-': goto yy473;
+- case '.': goto yy474;
+- case '/': goto yy472;
++ case 'y': goto yy402;
++ case '-': goto yy413;
++ case '.': goto yy414;
++ case '/': goto yy412;
+ case '0':
+ case '1':
+ case '2':
+@@ -1958,12 +1967,12 @@ yy30:
+ case '6':
+ case '7':
+ case '8':
+- case '9': goto yy469;
+- case ':': goto yy483;
+- case 'n': goto yy470;
+- case 'r': goto yy471;
+- case 's': goto yy464;
+- case 't': goto yy468;
++ case '9': goto yy409;
++ case ':': goto yy423;
++ case 'n': goto yy410;
++ case 'r': goto yy411;
++ case 's': goto yy404;
++ case 't': goto yy408;
+ default: goto yy13;
+ }
+ yy31:
+@@ -1976,17 +1985,17 @@ yy31:
+ YYDEBUG(-1, yych);
+ switch (yych) {
+ case '+':
+- case '-': goto yy440;
++ case '-': goto yy380;
+ case '0':
+- case '1': goto yy437;
+- case '2': goto yy438;
++ case '1': goto yy377;
++ case '2': goto yy378;
+ case '3':
+ case '4':
+ case '5':
+ case '6':
+ case '7':
+ case '8':
+- case '9': goto yy439;
++ case '9': goto yy379;
+ default: goto yy13;
+ }
+ yy32:
+@@ -2017,13 +2026,13 @@ yy32:
+ if (yych <= '@') goto yy4;
+ goto yy141;
+ } else {
+- if (yych <= 'I') goto yy436;
++ if (yych <= 'I') goto yy376;
+ if (yych <= 'U') goto yy141;
+- goto yy435;
++ goto yy375;
+ }
+ } else {
+ if (yych <= 'Z') {
+- if (yych == 'X') goto yy435;
++ if (yych == 'X') goto yy375;
+ goto yy141;
+ } else {
+ if (yych <= '`') goto yy4;
+@@ -2054,7 +2063,7 @@ yy33:
+ goto yy141;
+ } else {
+ if (yych <= 'Z') {
+- if (yych <= 'I') goto yy432;
++ if (yych <= 'I') goto yy372;
+ goto yy141;
+ } else {
+ if (yych <= '`') goto yy4;
+@@ -2085,7 +2094,7 @@ yy34:
+ goto yy141;
+ } else {
+ if (yych <= 'Z') {
+- if (yych <= 'I') goto yy430;
++ if (yych <= 'I') goto yy370;
+ goto yy141;
+ } else {
+ if (yych <= '`') goto yy4;
+@@ -2102,17 +2111,17 @@ yy35:
+ if (yych == ')') goto yy140;
+ goto yy4;
+ } else {
+- if (yych <= 'A') goto yy413;
++ if (yych <= 'A') goto yy353;
+ if (yych <= 'T') goto yy141;
+- goto yy412;
++ goto yy352;
+ }
+ } else {
+ if (yych <= 'a') {
+ if (yych <= 'Z') goto yy141;
+ if (yych <= '`') goto yy4;
+- goto yy422;
++ goto yy362;
+ } else {
+- if (yych == 'u') goto yy421;
++ if (yych == 'u') goto yy361;
+ if (yych <= 'z') goto yy146;
+ goto yy4;
+ }
+@@ -2125,17 +2134,17 @@ yy36:
+ if (yych == ')') goto yy140;
+ goto yy4;
+ } else {
+- if (yych <= 'A') goto yy413;
++ if (yych <= 'A') goto yy353;
+ if (yych <= 'T') goto yy141;
+- goto yy412;
++ goto yy352;
+ }
+ } else {
+ if (yych <= 'a') {
+ if (yych <= 'Z') goto yy141;
+ if (yych <= '`') goto yy4;
+- goto yy413;
++ goto yy353;
+ } else {
+- if (yych == 'u') goto yy412;
++ if (yych == 'u') goto yy352;
+ if (yych <= 'z') goto yy141;
+ goto yy4;
+ }
+@@ -2150,12 +2159,12 @@ yy37:
+ goto yy141;
+ } else {
+ if (yych <= 'O') {
+- if (yych <= 'G') goto yy391;
++ if (yych <= 'G') goto yy331;
+ goto yy141;
+ } else {
+- if (yych <= 'P') goto yy390;
++ if (yych <= 'P') goto yy330;
+ if (yych <= 'T') goto yy141;
+- goto yy389;
++ goto yy329;
+ }
+ }
+ } else {
+@@ -2164,15 +2173,15 @@ yy37:
+ if (yych <= 'Z') goto yy141;
+ goto yy4;
+ } else {
+- if (yych == 'g') goto yy403;
++ if (yych == 'g') goto yy343;
+ goto yy146;
+ }
+ } else {
+ if (yych <= 't') {
+- if (yych <= 'p') goto yy402;
++ if (yych <= 'p') goto yy342;
+ goto yy146;
+ } else {
+- if (yych <= 'u') goto yy401;
++ if (yych <= 'u') goto yy341;
+ if (yych <= 'z') goto yy146;
+ goto yy4;
+ }
+@@ -2188,12 +2197,12 @@ yy38:
+ goto yy141;
+ } else {
+ if (yych <= 'O') {
+- if (yych <= 'G') goto yy391;
++ if (yych <= 'G') goto yy331;
+ goto yy141;
+ } else {
+- if (yych <= 'P') goto yy390;
++ if (yych <= 'P') goto yy330;
+ if (yych <= 'T') goto yy141;
+- goto yy389;
++ goto yy329;
+ }
+ }
+ } else {
+@@ -2202,15 +2211,15 @@ yy38:
+ if (yych <= 'Z') goto yy141;
+ goto yy4;
+ } else {
+- if (yych == 'g') goto yy391;
++ if (yych == 'g') goto yy331;
+ goto yy141;
+ }
+ } else {
+ if (yych <= 't') {
+- if (yych <= 'p') goto yy390;
++ if (yych <= 'p') goto yy330;
+ goto yy141;
+ } else {
+- if (yych <= 'u') goto yy389;
++ if (yych <= 'u') goto yy329;
+ if (yych <= 'z') goto yy141;
+ goto yy4;
+ }
+@@ -2226,7 +2235,7 @@ yy39:
+ } else {
+ if (yych <= '@') goto yy4;
+ if (yych <= 'B') goto yy141;
+- goto yy379;
++ goto yy319;
+ }
+ } else {
+ if (yych <= 'b') {
+@@ -2234,7 +2243,7 @@ yy39:
+ if (yych <= '`') goto yy4;
+ goto yy146;
+ } else {
+- if (yych <= 'c') goto yy384;
++ if (yych <= 'c') goto yy324;
+ if (yych <= 'z') goto yy146;
+ goto yy4;
+ }
+@@ -2249,7 +2258,7 @@ yy40:
+ } else {
+ if (yych <= '@') goto yy4;
+ if (yych <= 'B') goto yy141;
+- goto yy379;
++ goto yy319;
+ }
+ } else {
+ if (yych <= 'b') {
+@@ -2257,7 +2266,7 @@ yy40:
+ if (yych <= '`') goto yy4;
+ goto yy141;
+ } else {
+- if (yych <= 'c') goto yy379;
++ if (yych <= 'c') goto yy319;
+ if (yych <= 'z') goto yy141;
+ goto yy4;
+ }
+@@ -2280,7 +2289,7 @@ yy41:
+ if (yych <= '`') goto yy4;
+ goto yy146;
+ } else {
+- if (yych <= 'e') goto yy370;
++ if (yych <= 'e') goto yy310;
+ if (yych <= 'z') goto yy146;
+ goto yy4;
+ }
+@@ -2414,9 +2423,11 @@ yy49:
+ if (yych <= '9') goto yy55;
+ yy50:
+ YYDEBUG(50, *YYCURSOR);
++#line 1763 "ext/date/lib/parse_date.re"
+ {
+ goto std;
+ }
++#line 2431 "ext/date/lib/parse_date.c"
+ yy51:
+ YYDEBUG(51, *YYCURSOR);
+ yych = *++YYCURSOR;
+@@ -2425,10 +2436,12 @@ yy52:
+ YYDEBUG(52, *YYCURSOR);
+ ++YYCURSOR;
+ YYDEBUG(53, *YYCURSOR);
++#line 1768 "ext/date/lib/parse_date.re"
+ {
+ s->pos = cursor; s->line++;
+ goto std;
+ }
++#line 2445 "ext/date/lib/parse_date.c"
+ yy54:
+ YYDEBUG(54, *YYCURSOR);
+ yych = *++YYCURSOR;
+@@ -2519,13 +2532,13 @@ yy57:
+ if (yyaccept <= 5) {
+ goto yy194;
+ } else {
+- goto yy199;
++ goto yy208;
+ }
+ } else {
+ if (yyaccept <= 7) {
+- goto yy223;
++ goto yy222;
+ } else {
+- goto yy295;
++ goto yy333;
+ }
+ }
+ }
+@@ -2533,95 +2546,91 @@ yy57:
+ if (yyaccept <= 12) {
+ if (yyaccept <= 10) {
+ if (yyaccept <= 9) {
+- goto yy393;
++ goto yy416;
+ } else {
+- goto yy476;
++ goto yy431;
+ }
+ } else {
+ if (yyaccept <= 11) {
+- goto yy491;
++ goto yy552;
+ } else {
+- goto yy612;
++ goto yy597;
+ }
+ }
+ } else {
+ if (yyaccept <= 14) {
+ if (yyaccept <= 13) {
+- goto yy657;
++ goto yy607;
+ } else {
+- goto yy667;
++ goto yy704;
+ }
+ } else {
+ if (yyaccept <= 15) {
+- goto yy764;
++ goto yy724;
+ } else {
+- goto yy784;
++ goto yy755;
+ }
+ }
+ }
+ }
+ } else {
+- if (yyaccept <= 25) {
+- if (yyaccept <= 21) {
+- if (yyaccept <= 19) {
+- if (yyaccept <= 18) {
+- if (yyaccept <= 17) {
+- goto yy815;
+- } else {
+- goto yy822;
+- }
++ if (yyaccept <= 24) {
++ if (yyaccept <= 20) {
++ if (yyaccept <= 18) {
++ if (yyaccept <= 17) {
++ goto yy762;
+ } else {
+- goto yy849;
++ goto yy789;
+ }
+ } else {
+- if (yyaccept <= 20) {
+- goto yy794;
++ if (yyaccept <= 19) {
++ goto yy734;
+ } else {
+- goto yy455;
++ goto yy395;
+ }
+ }
+ } else {
+- if (yyaccept <= 23) {
+- if (yyaccept <= 22) {
+- goto yy974;
++ if (yyaccept <= 22) {
++ if (yyaccept <= 21) {
++ goto yy914;
+ } else {
+- goto yy843;
++ goto yy783;
+ }
+ } else {
+- if (yyaccept <= 24) {
+- goto yy1068;
++ if (yyaccept <= 23) {
++ goto yy1008;
+ } else {
+- goto yy1076;
++ goto yy1016;
+ }
+ }
+ }
+ } else {
+- if (yyaccept <= 29) {
+- if (yyaccept <= 27) {
+- if (yyaccept <= 26) {
+- goto yy1118;
++ if (yyaccept <= 28) {
++ if (yyaccept <= 26) {
++ if (yyaccept <= 25) {
++ goto yy1058;
+ } else {
+- goto yy1142;
++ goto yy1082;
+ }
+ } else {
+- if (yyaccept <= 28) {
+- goto yy1295;
++ if (yyaccept <= 27) {
++ goto yy1235;
+ } else {
+- goto yy1417;
++ goto yy1359;
+ }
+ }
+ } else {
+- if (yyaccept <= 31) {
+- if (yyaccept <= 30) {
+- goto yy1420;
++ if (yyaccept <= 30) {
++ if (yyaccept <= 29) {
++ goto yy1362;
+ } else {
+- goto yy1500;
++ goto yy1442;
+ }
+ } else {
+- if (yyaccept <= 32) {
+- goto yy1508;
++ if (yyaccept <= 31) {
++ goto yy1450;
+ } else {
+- goto yy1531;
++ goto yy1473;
+ }
+ }
+ }
+@@ -2815,6 +2824,7 @@ yy72:
+ if (yych == 's') goto yy74;
+ yy73:
+ YYDEBUG(73, *YYCURSOR);
++#line 1747 "ext/date/lib/parse_date.re"
+ {
+ timelib_ull i;
+ DEBUG_OUTPUT("relative");
+@@ -2829,6 +2839,7 @@ yy73:
+ TIMELIB_DEINIT;
+ return TIMELIB_RELATIVE;
+ }
++#line 2843 "ext/date/lib/parse_date.c"
+ yy74:
+ YYDEBUG(74, *YYCURSOR);
+ yych = *++YYCURSOR;
+@@ -3590,6 +3601,7 @@ yy166:
+ }
+ yy167:
+ YYDEBUG(167, *YYCURSOR);
++#line 1610 "ext/date/lib/parse_date.re"
+ {
+ const timelib_relunit* relunit;
+ DEBUG_OUTPUT("daytext");
+@@ -3606,6 +3618,7 @@ yy167:
+ TIMELIB_DEINIT;
+ return TIMELIB_WEEKDAY;
+ }
++#line 3622 "ext/date/lib/parse_date.c"
+ yy168:
+ YYDEBUG(168, *YYCURSOR);
+ yych = *++YYCURSOR;
+@@ -4111,20 +4124,21 @@ yy193:
+ if (yych <= '@') {
+ if (yych <= '9') goto yy196;
+ } else {
+- if (yych == 'E') goto yy202;
++ if (yych == 'E') goto yy201;
+ goto yy143;
+ }
+ } else {
+ if (yych <= 'd') {
+ if (yych >= 'a') goto yy143;
+ } else {
+- if (yych <= 'e') goto yy202;
++ if (yych <= 'e') goto yy201;
+ if (yych <= 'z') goto yy143;
+ }
+ }
+ }
+ yy194:
+ YYDEBUG(194, *YYCURSOR);
++#line 1669 "ext/date/lib/parse_date.re"
+ {
+ DEBUG_OUTPUT("monthtext");
+ TIMELIB_INIT;
+@@ -4133,10 +4147,11 @@ yy194:
+ TIMELIB_DEINIT;
+ return TIMELIB_DATE_TEXT;
+ }
++#line 4151 "ext/date/lib/parse_date.c"
+ yy195:
+ YYDEBUG(195, *YYCURSOR);
+ ++YYCURSOR;
+- if ((YYLIMIT - YYCURSOR) < 21) YYFILL(21);
++ if ((YYLIMIT - YYCURSOR) < 23) YYFILL(23);
+ yych = *YYCURSOR;
+ yy196:
+ YYDEBUG(196, *YYCURSOR);
<Skipped 35762 lines>
================================================================
---- gitweb:
http://git.pld-linux.org/gitweb.cgi/packages/php.git/commitdiff/ff4407b2ee5a421cabdee0b8621d820bccc242a9
More information about the pld-cvs-commit
mailing list