Merge branch 'master' into too_few_args

* master: Added specialized handlers for SEND_VAR/SEND_VAR_EX opcodes. Fixed mistakes in type inference rules. Fixed expected test outcome due to rule changes Updated to version 2016.5 (2016e) Updated to version 2016.5 (2016e) Updated to version 2016.5 (2016e) These bugs are also in 7.1-alpha Fixed(attempt to) bug #72405 (mb_ereg_replace - mbc_to_code (oniguruma) - oob read access) Maybe fix bug #72011 Fix #50845: exif_process_IFD_TAG: Use the right offset if reading from stream Improve the signature Unused var C89 compatibility Fix bug #72138 - Integer Overflow in Length of String-typed ZVAL
2024-11-27 03:44:07 +08:00 · 2016-06-15 23:25:02 +03:00 · 2016-06-15 23:25:02 +03:00 · d3ebf02270
commit d3ebf02270
parent 1e809bca38 006b8417d1
15 changed files with 2163 additions and 1417 deletions
--- a/9
+++ b/9
@ -7,9 +7,18 @@ PHP                                                                        NEWS
  . Fixed bug #72373 (TypeError after Generator function w/declared return type
    finishes). (Nikita)

+- Mbstring:
+  . Fixed bug #72405 (mb_ereg_replace - mbc_to_code (oniguruma) -
+    oob read access). (Laruence)
+  . Fixed bug #72399 (Use-After-Free in MBString (search_re)). (Laruence)
+
 - Sqlite3:
  . Implemented FR #72385 (Update SQLite bundle lib(3.13.0)). (Laruence)

+- Standard:
+  . Fixed bug #72306 (Heap overflow through proc_open and $env parameter).
+    (Laruence)
+
 09 Jun 2016, PHP 7.1.0alpha1

 - Core:
--- a/Zend/zend_ast.h
+++ b/Zend/zend_ast.h
@ -266,10 +266,11 @@ static zend_always_inline zend_ast *zend_ast_create_assign_op(uint32_t opcode, z
 static zend_always_inline zend_ast *zend_ast_create_cast(uint32_t type, zend_ast *op0) {
 	return zend_ast_create_ex(ZEND_AST_CAST, type, op0);
 }
-static zend_always_inline void zend_ast_list_rtrim(zend_ast *ast) {
+static zend_always_inline zend_ast *zend_ast_list_rtrim(zend_ast *ast) {
 	zend_ast_list *list = zend_ast_get_list(ast);
 	if (list->children && list->child[list->children - 1] == NULL) {
 		list->children--;
 	}
+	return ast;
 }
 #endif
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@ -7084,6 +7084,7 @@ void zend_compile_array(znode *result, zend_ast *ast) /* {{{ */
 		zend_ast *elem_ast = list->child[i];
 		zend_ast *value_ast, *key_ast;
 		zend_bool by_ref;
+		znode value_node, key_node, *key_node_ptr = NULL;

 		if (elem_ast == NULL) {
 			zend_error(E_COMPILE_ERROR, "Cannot use empty array elements in arrays");
@ -7093,8 +7094,6 @@ void zend_compile_array(znode *result, zend_ast *ast) /* {{{ */
 		key_ast = elem_ast->child[1];
 		by_ref = elem_ast->attr;

-		znode value_node, key_node, *key_node_ptr = NULL;
-
 		if (key_ast) {
 			zend_compile_expr(&key_node, key_ast);
 			zend_handle_numeric_op(&key_node);
--- a/Zend/zend_language_parser.y
+++ b/Zend/zend_language_parser.y
@ -1183,7 +1183,8 @@ property_name:
 ;

 array_pair_list:
-		non_empty_array_pair_list { /* allow single trailing comma */ zend_ast_list_rtrim($$ = $1); }
+		non_empty_array_pair_list
+			{ /* allow single trailing comma */ $$ = zend_ast_list_rtrim($1); }
 ;

 possible_array_pair:
--- a/Zend/zend_vm_def.h
+++ b/Zend/zend_vm_def.h
@ -8543,4 +8543,50 @@ ZEND_VM_C_LABEL(fetch_dim_r_index_undef):
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }

+ZEND_VM_TYPE_SPEC_HANDLER(ZEND_SEND_VAR, (op1_info & (MAY_BE_UNDEF|MAY_BE_REF)) == 0, ZEND_SEND_VAR_SIMPLE, CV|VAR, NUM)
+{
+	USE_OPLINE
+	zval *varptr, *arg;
+	zend_free_op free_op1;
+
+	varptr = GET_OP1_ZVAL_PTR_UNDEF(BP_VAR_R);
+	arg = ZEND_CALL_VAR(EX(call), opline->result.var);
+
+	if (OP1_TYPE == IS_CV) {
+		ZVAL_COPY(arg, varptr);
+	} else /* if (OP1_TYPE == IS_VAR) */ {
+		ZVAL_COPY_VALUE(arg, varptr);
+	}
+
+	ZEND_VM_NEXT_OPCODE();
+}
+
+ZEND_VM_TYPE_SPEC_HANDLER(ZEND_SEND_VAR_EX, (op1_info & (MAY_BE_UNDEF|MAY_BE_REF)) == 0, ZEND_SEND_VAR_EX_SIMPLE, CV|VAR, NUM, SPEC(QUICK_ARG))
+{
+	USE_OPLINE
+	zval *varptr, *arg;
+	zend_free_op free_op1;
+	uint32_t arg_num = opline->op2.num;
+
+	if (EXPECTED(arg_num <= MAX_ARG_FLAG_NUM)) {
+		if (QUICK_ARG_SHOULD_BE_SENT_BY_REF(EX(call)->func, arg_num)) {
+			ZEND_VM_C_GOTO(send_var_by_ref);
+		}
+	} else if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->func, arg_num)) {
+ZEND_VM_C_LABEL(send_var_by_ref):
+		ZEND_VM_DISPATCH_TO_HANDLER(ZEND_SEND_REF);
+	}
+
+	varptr = GET_OP1_ZVAL_PTR_UNDEF(BP_VAR_R);
+	arg = ZEND_CALL_VAR(EX(call), opline->result.var);
+
+	if (OP1_TYPE == IS_CV) {
+		ZVAL_COPY(arg, varptr);
+	} else /* if (OP1_TYPE == IS_VAR) */ {
+		ZVAL_COPY_VALUE(arg, varptr);
+	}
+
+	ZEND_VM_NEXT_OPCODE();
+}
+
 ZEND_VM_DEFINE_OP(137, ZEND_OP_DATA);
--- a/Zend/zend_vm_execute.h
+++ b/Zend/zend_vm_execute.h
@ -17014,6 +17014,80 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_TYPE_CHECK_SPEC_VAR_HANDLER(ZE
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }

+static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_SEND_VAR_SIMPLE_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
+{
+	USE_OPLINE
+	zval *varptr, *arg;
+	zend_free_op free_op1;
+
+	varptr = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1);
+	arg = ZEND_CALL_VAR(EX(call), opline->result.var);
+
+	if (IS_VAR == IS_CV) {
+		ZVAL_COPY(arg, varptr);
+	} else /* if (IS_VAR == IS_VAR) */ {
+		ZVAL_COPY_VALUE(arg, varptr);
+	}
+
+	ZEND_VM_NEXT_OPCODE();
+}
+
+static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_SEND_VAR_EX_SIMPLE_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
+{
+	USE_OPLINE
+	zval *varptr, *arg;
+	zend_free_op free_op1;
+	uint32_t arg_num = opline->op2.num;
+
+	if (EXPECTED(0)) {
+		if (QUICK_ARG_SHOULD_BE_SENT_BY_REF(EX(call)->func, arg_num)) {
+			goto send_var_by_ref;
+		}
+	} else if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->func, arg_num)) {
+send_var_by_ref:
+		ZEND_VM_TAIL_CALL(ZEND_SEND_REF_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU));
+	}
+
+	varptr = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1);
+	arg = ZEND_CALL_VAR(EX(call), opline->result.var);
+
+	if (IS_VAR == IS_CV) {
+		ZVAL_COPY(arg, varptr);
+	} else /* if (IS_VAR == IS_VAR) */ {
+		ZVAL_COPY_VALUE(arg, varptr);
+	}
+
+	ZEND_VM_NEXT_OPCODE();
+}
+
+static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_SEND_VAR_EX_SIMPLE_SPEC_VAR_QUICK_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
+{
+	USE_OPLINE
+	zval *varptr, *arg;
+	zend_free_op free_op1;
+	uint32_t arg_num = opline->op2.num;
+
+	if (EXPECTED(1)) {
+		if (QUICK_ARG_SHOULD_BE_SENT_BY_REF(EX(call)->func, arg_num)) {
+			goto send_var_by_ref;
+		}
+	} else if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->func, arg_num)) {
+send_var_by_ref:
+		ZEND_VM_TAIL_CALL(ZEND_SEND_REF_SPEC_VAR_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU));
+	}
+
+	varptr = _get_zval_ptr_var(opline->op1.var, execute_data, &free_op1);
+	arg = ZEND_CALL_VAR(EX(call), opline->result.var);
+
+	if (IS_VAR == IS_CV) {
+		ZVAL_COPY(arg, varptr);
+	} else /* if (IS_VAR == IS_VAR) */ {
+		ZVAL_COPY_VALUE(arg, varptr);
+	}
+
+	ZEND_VM_NEXT_OPCODE();
+}
+
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_IS_IDENTICAL_SPEC_VAR_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 {
 	USE_OPLINE
@ -37937,6 +38011,80 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_TYPE_CHECK_SPEC_CV_HANDLER(ZEN
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }

+static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_SEND_VAR_SIMPLE_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
+{
+	USE_OPLINE
+	zval *varptr, *arg;
+
+
+	varptr = _get_zval_ptr_cv_undef(execute_data, opline->op1.var);
+	arg = ZEND_CALL_VAR(EX(call), opline->result.var);
+
+	if (IS_CV == IS_CV) {
+		ZVAL_COPY(arg, varptr);
+	} else /* if (IS_CV == IS_VAR) */ {
+		ZVAL_COPY_VALUE(arg, varptr);
+	}
+
+	ZEND_VM_NEXT_OPCODE();
+}
+
+static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_SEND_VAR_EX_SIMPLE_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
+{
+	USE_OPLINE
+	zval *varptr, *arg;
+
+	uint32_t arg_num = opline->op2.num;
+
+	if (EXPECTED(0)) {
+		if (QUICK_ARG_SHOULD_BE_SENT_BY_REF(EX(call)->func, arg_num)) {
+			goto send_var_by_ref;
+		}
+	} else if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->func, arg_num)) {
+send_var_by_ref:
+		ZEND_VM_TAIL_CALL(ZEND_SEND_REF_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU));
+	}
+
+	varptr = _get_zval_ptr_cv_undef(execute_data, opline->op1.var);
+	arg = ZEND_CALL_VAR(EX(call), opline->result.var);
+
+	if (IS_CV == IS_CV) {
+		ZVAL_COPY(arg, varptr);
+	} else /* if (IS_CV == IS_VAR) */ {
+		ZVAL_COPY_VALUE(arg, varptr);
+	}
+
+	ZEND_VM_NEXT_OPCODE();
+}
+
+static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_SEND_VAR_EX_SIMPLE_SPEC_CV_QUICK_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
+{
+	USE_OPLINE
+	zval *varptr, *arg;
+
+	uint32_t arg_num = opline->op2.num;
+
+	if (EXPECTED(1)) {
+		if (QUICK_ARG_SHOULD_BE_SENT_BY_REF(EX(call)->func, arg_num)) {
+			goto send_var_by_ref;
+		}
+	} else if (ARG_SHOULD_BE_SENT_BY_REF(EX(call)->func, arg_num)) {
+send_var_by_ref:
+		ZEND_VM_TAIL_CALL(ZEND_SEND_REF_SPEC_CV_HANDLER(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU));
+	}
+
+	varptr = _get_zval_ptr_cv_undef(execute_data, opline->op1.var);
+	arg = ZEND_CALL_VAR(EX(call), opline->result.var);
+
+	if (IS_CV == IS_CV) {
+		ZVAL_COPY(arg, varptr);
+	} else /* if (IS_CV == IS_VAR) */ {
+		ZVAL_COPY_VALUE(arg, varptr);
+	}
+
+	ZEND_VM_NEXT_OPCODE();
+}
+
 static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_ADD_SPEC_CV_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
 {
 	USE_OPLINE
@ -63757,6 +63905,21 @@ void zend_init_opcodes_handlers(void)
 		ZEND_FETCH_DIM_R_INDEX_SPEC_CV_TMPVAR_HANDLER,
 		ZEND_NULL_HANDLER,
 		ZEND_FETCH_DIM_R_INDEX_SPEC_CV_CV_HANDLER,
+		ZEND_NULL_HANDLER,
+		ZEND_NULL_HANDLER,
+		ZEND_SEND_VAR_SIMPLE_SPEC_VAR_HANDLER,
+		ZEND_NULL_HANDLER,
+		ZEND_SEND_VAR_SIMPLE_SPEC_CV_HANDLER,
+		ZEND_NULL_HANDLER,
+		ZEND_NULL_HANDLER,
+		ZEND_NULL_HANDLER,
+		ZEND_NULL_HANDLER,
+		ZEND_SEND_VAR_EX_SIMPLE_SPEC_VAR_HANDLER,
+		ZEND_SEND_VAR_EX_SIMPLE_SPEC_VAR_QUICK_HANDLER,
+		ZEND_NULL_HANDLER,
+		ZEND_NULL_HANDLER,
+		ZEND_SEND_VAR_EX_SIMPLE_SPEC_CV_HANDLER,
+		ZEND_SEND_VAR_EX_SIMPLE_SPEC_CV_QUICK_HANDLER,
 		ZEND_NULL_HANDLER
 	};
 	static const uint32_t specs[] = {
@ -63809,9 +63972,9 @@ void zend_init_opcodes_handlers(void)
 		1423 | SPEC_RULE_OP1,
 		1428 | SPEC_RULE_OP1,
 		1433 | SPEC_RULE_OP1 | SPEC_RULE_OP2,
-		4481,
+		4496,
 		1458 | SPEC_RULE_OP1 | SPEC_RULE_QUICK_ARG,
-		4481,
+		4496,
 		1468 | SPEC_RULE_OP1,
 		1473 | SPEC_RULE_OP1 | SPEC_RULE_OP2,
 		1498 | SPEC_RULE_OP1 | SPEC_RULE_OP2,
@ -63860,7 +64023,7 @@ void zend_init_opcodes_handlers(void)
 		2207 | SPEC_RULE_OP1 | SPEC_RULE_OP2,
 		2232 | SPEC_RULE_OP1 | SPEC_RULE_OP2,
 		2257 | SPEC_RULE_OP1 | SPEC_RULE_OP2,
-		4481,
+		4496,
 		2282,
 		2283,
 		2284,
@ -63944,7 +64107,7 @@ void zend_init_opcodes_handlers(void)
 		3456 | SPEC_RULE_OP1 | SPEC_RULE_OP2,
 		3481 | SPEC_RULE_OP1 | SPEC_RULE_OP2,
 		3506 | SPEC_RULE_OP1 | SPEC_RULE_OP2,
-		4481
+		4496
 	};
 	zend_opcode_handlers = labels;
 		zend_handlers_count = sizeof(labels) / sizeof(void*);
@ -64225,11 +64388,21 @@ ZEND_API void zend_vm_set_opcode_handler_ex(zend_op* op, uint32_t op1_info, uint
 				spec = 4441 | SPEC_RULE_OP1;
 			}
 			break;
+		case ZEND_SEND_VAR_EX:
+			if ((op1_info & (MAY_BE_UNDEF|MAY_BE_REF)) == 0) {
+				spec = 4486 | SPEC_RULE_OP1 | SPEC_RULE_QUICK_ARG;
+			}
+			break;
 		case ZEND_FETCH_DIM_R:
 			if ((!(op2_info & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF)))) {
 				spec = 4456 | SPEC_RULE_OP1 | SPEC_RULE_OP2;
 			}
 			break;
+		case ZEND_SEND_VAR:
+			if ((op1_info & (MAY_BE_UNDEF|MAY_BE_REF)) == 0) {
+				spec = 4481 | SPEC_RULE_OP1;
+			}
+			break;
 		default:
 			break;
 	}
--- a/ext/date/lib/timezonedb.h
+++ b/ext/date/lib/timezonedb.h
--- a/ext/date/php_date.c
+++ b/ext/date/php_date.c
@ -2013,6 +2013,7 @@ static void date_register_classes(void) /* {{{ */
 	date_object_handlers_immutable.clone_obj = date_object_clone_date;
 	date_object_handlers_immutable.compare_objects = date_object_compare_date;
 	date_object_handlers_immutable.get_properties = date_object_get_properties;
+	date_object_handlers_immutable.get_gc = date_object_get_gc;
 	zend_class_implements(date_ce_immutable, 1, date_ce_interface);

 	INIT_CLASS_ENTRY(ce_timezone, "DateTimeZone", date_funcs_timezone);
@ -2170,7 +2171,7 @@ static HashTable *date_object_get_properties(zval *object) /* {{{ */

 	props = zend_std_get_properties(object);

-	if (!dateobj->time || GC_G(gc_active)) {
+	if (!dateobj->time) {
 		return props;
 	}

@ -4851,7 +4852,7 @@ static HashTable *date_object_get_properties_period(zval *object) /* {{{ */

 	props = zend_std_get_properties(object);

-	if (!period_obj->start || GC_G(gc_active)) {
+	if (!period_obj->start) {
 		return props;
 	}

--- a/ext/date/tests/bug33414-1.phpt
+++ b/ext/date/tests/bug33414-1.phpt
@ -49,9 +49,9 @@ print "TZ=Asia/Baku - wrong day.\n";
 date_default_timezone_set("Asia/Baku");
 $tStamp = mktime (17, 17, 17, 1, 8299, 1970);
 print "tStamp=". date("l Y-m-d H:i:s T I", $tStamp). "\n";
-$strtotime_tstamp = strtotime("next Sunday", $tStamp);
+$strtotime_tstamp = strtotime("second Monday", $tStamp);
 print "result=".date("l Y-m-d H:i:s T I", $strtotime_tstamp)."\n";
-print "wanted=Sunday              00:00:00\n\n";
+print "wanted=Monday              00:00:00\n\n";

 print "TZ=America/Noronha - wrong day.\n";
 date_default_timezone_set("America/Noronha");
@ -227,8 +227,8 @@ wanted=Thursday             00:00:00

 TZ=Asia/Baku - wrong day.
 tStamp=Sunday 1992-09-20 17:17:17 AZST 1
-result=Sunday 1992-09-27 00:00:00 AZT 0
-wanted=Sunday              00:00:00
+result=Monday 1992-09-28 00:00:00 AZT 0
+wanted=Monday              00:00:00

 TZ=America/Noronha - wrong day.
 tStamp=Friday 1999-10-01 17:17:17 FNT 0
--- a/ext/exif/exif.c
+++ b/ext/exif/exif.c
@ -2869,11 +2869,11 @@ static int exif_process_IFD_TAG(image_info_type *ImageInfo, char *dir_entry, cha
 			}

 			fpos = php_stream_tell(ImageInfo->infile);
-			php_stream_seek(ImageInfo->infile, offset_val, SEEK_SET);
+			php_stream_seek(ImageInfo->infile, displacement+offset_val, SEEK_SET);
 			fgot = php_stream_tell(ImageInfo->infile);
-			if (fgot!=offset_val) {
+			if (fgot!=displacement+offset_val) {
 				EFREE_IF(outside);
-				exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Wrong file pointer: 0x%08X != 0x%08X", fgot, offset_val);
+				exif_error_docref(NULL EXIFERR_CC, ImageInfo, E_WARNING, "Wrong file pointer: 0x%08X != 0x%08X", fgot, displacement+offset_val);
 				return FALSE;
 			}
 			fgot = php_stream_read(ImageInfo->infile, value_ptr, byte_count);
--- a/ext/exif/tests/bug50845.jpg
+++ b/ext/exif/tests/bug50845.jpg
--- a/ext/exif/tests/bug50845.phpt
+++ b/ext/exif/tests/bug50845.phpt
@ -0,0 +1,140 @@
+--TEST--
+Bug #50845 (exif_read_data() returns corrupted exif headers)
+--SKIPIF--
+<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
+--FILE--
+<?php
+$infile = dirname(__FILE__).'/bug50845.jpg';
+var_dump(exif_read_data($infile));
+--EXPECTF--
+array(44) {
+  ["FileName"]=>
+  string(12) "bug50845.jpg"
+  ["FileDateTime"]=>
+  int(%d)
+  ["FileSize"]=>
+  int(803603)
+  ["FileType"]=>
+  int(2)
+  ["MimeType"]=>
+  string(10) "image/jpeg"
+  ["SectionsFound"]=>
+  string(30) "ANY_TAG, IFD0, THUMBNAIL, EXIF"
+  ["COMPUTED"]=>
+  array(9) {
+    ["html"]=>
+    string(26) "width="5472" height="3648""
+    ["Height"]=>
+    int(3648)
+    ["Width"]=>
+    int(5472)
+    ["IsColor"]=>
+    int(1)
+    ["ByteOrderMotorola"]=>
+    int(0)
+    ["ApertureFNumber"]=>
+    string(5) "f/7.1"
+    ["Copyright"]=>
+    string(13) "Public Domain"
+    ["Thumbnail.FileType"]=>
+    int(2)
+    ["Thumbnail.MimeType"]=>
+    string(10) "image/jpeg"
+  }
+  ["ImageDescription"]=>
+  string(295) "A U.S. Marine Corps MV-22 Osprey lands on the USS Whidbey Island (LSD-41), May 5, 2016. The vehicles were loaded to support a theater security cooperation event as a part of a MEU readiness exercise. (U.S. Marine Corps photo by Lance Cpl. Koby I. Saunders/22 Marine Expeditionary Unit/ Released)"
+  ["Make"]=>
+  string(5) "Canon"
+  ["Model"]=>
+  string(22) "Canon EOS-1D X Mark II"
+  ["Orientation"]=>
+  int(1)
+  ["XResolution"]=>
+  string(5) "240/1"
+  ["YResolution"]=>
+  string(5) "240/1"
+  ["ResolutionUnit"]=>
+  int(2)
+  ["Artist"]=>
+  string(24) "Lance Cpl. Koby Saunders"
+  ["Copyright"]=>
+  string(13) "Public Domain"
+  ["Exif_IFD_Pointer"]=>
+  int(12572)
+  ["THUMBNAIL"]=>
+  array(6) {
+    ["Compression"]=>
+    int(6)
+    ["XResolution"]=>
+    string(5) "240/1"
+    ["YResolution"]=>
+    string(5) "240/1"
+    ["ResolutionUnit"]=>
+    int(2)
+    ["JPEGInterchangeFormat"]=>
+    int(860)
+    ["JPEGInterchangeFormatLength"]=>
+    int(11204)
+  }
+  ["ExposureTime"]=>
+  string(5) "1/200"
+  ["FNumber"]=>
+  string(5) "71/10"
+  ["ExposureProgram"]=>
+  int(1)
+  ["ISOSpeedRatings"]=>
+  int(100)
+  ["UndefinedTag:0x8830"]=>
+  int(2)
+  ["UndefinedTag:0x8832"]=>
+  int(100)
+  ["ExifVersion"]=>
+  string(4) "0230"
+  ["ShutterSpeedValue"]=>
+  string(15) "7643856/1000000"
+  ["ApertureValue"]=>
+  string(15) "5655638/1000000"
+  ["ExposureBiasValue"]=>
+  string(3) "0/1"
+  ["MaxApertureValue"]=>
+  string(3) "4/1"
+  ["MeteringMode"]=>
+  int(5)
+  ["Flash"]=>
+  int(16)
+  ["FocalLength"]=>
+  string(4) "24/1"
+  ["ColorSpace"]=>
+  int(65535)
+  ["FocalPlaneXResolution"]=>
+  string(12) "5472000/1438"
+  ["FocalPlaneYResolution"]=>
+  string(11) "3648000/958"
+  ["FocalPlaneResolutionUnit"]=>
+  int(2)
+  ["CustomRendered"]=>
+  int(0)
+  ["ExposureMode"]=>
+  int(1)
+  ["WhiteBalance"]=>
+  int(0)
+  ["SceneCaptureType"]=>
+  int(0)
+  ["UndefinedTag:0xA431"]=>
+  string(12) "002099000358"
+  ["UndefinedTag:0xA432"]=>
+  array(4) {
+    [0]=>
+    string(4) "24/1"
+    [1]=>
+    string(5) "105/1"
+    [2]=>
+    string(3) "0/0"
+    [3]=>
+    string(3) "0/0"
+  }
+  ["UndefinedTag:0xA434"]=>
+  string(22) "EF24-105mm f/4L IS USM"
+  ["UndefinedTag:0xA435"]=>
+  string(10) "000044bc4c"
+}
--- a/ext/mbstring/php_mbregex.c
+++ b/ext/mbstring/php_mbregex.c
@ -811,7 +811,7 @@ static void _php_mb_regex_ereg_replace_exec(INTERNAL_FUNCTION_PARAMETERS, OnigOp
 	OnigUChar *pos;
 	OnigUChar *string_lim;
 	char *description = NULL;
-	char pat_buf[4];
+	char pat_buf[6];

 	const mbfl_encoding *enc;

@ -864,6 +864,8 @@ static void _php_mb_regex_ereg_replace_exec(INTERNAL_FUNCTION_PARAMETERS, OnigOp
 		pat_buf[1] = '\0';
 		pat_buf[2] = '\0';
 		pat_buf[3] = '\0';
+		pat_buf[4] = '\0';
+		pat_buf[5] = '\0';

 		arg_pattern = pat_buf;
 		arg_pattern_len = 1;
--- a/ext/opcache/Optimizer/zend_inference.c
+++ b/ext/opcache/Optimizer/zend_inference.c
@ -3112,6 +3112,9 @@ static void zend_update_type_info(const zend_op_array *op_array,
 					tmp = MAY_BE_RCN;
 				}
 			}
+			if (opline->opcode == ZEND_FE_FETCH_R && (t2 & MAY_BE_REF)) {
+				tmp |= MAY_BE_REF;
+			}
 			UPDATE_SSA_TYPE(tmp, ssa_ops[i].op2_def);
 			if (ssa_ops[i].result_def >= 0) {
 				tmp = MAY_BE_RC1;
@ -3734,6 +3737,9 @@ void zend_init_func_return_info(const zend_op_array   *op_array,
 		zend_ssa_range tmp_range = {0, 0, 0, 0};

 		ret->type = zend_fetch_arg_info(script, ret_info, &ret->ce);
+		if (op_array->fn_flags & ZEND_ACC_RETURN_REFERENCE) {
+			ret->type |= MAY_BE_REF;
+		}
 		ret->is_instanceof = (ret->ce) ? 1 : 0;
 		ret->range = tmp_range;
 		ret->has_range = 0;
--- a/ext/xml/xml.c
+++ b/ext/xml/xml.c
@ -1554,7 +1554,6 @@ PHP_FUNCTION(xml_parser_free)
 {
 	zval *pind;
 	xml_parser *parser;
-	zend_resource *res;

 	if (zend_parse_parameters(ZEND_NUM_ARGS(), "r", &pind) == FAILURE) {
 		return;