Imported Upstream version 5.3.7upstream/5.3.7

76 files changed, 1297 insertions, 408 deletions

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 030bb0e4f..f0ed03b0c 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -21,7 +21,7 @@
    +----------------------------------------------------------------------+
 */
 
-/* $Id: array.c 306939 2011-01-01 02:19:59Z felipe $ */
+/* $Id: array.c 309986 2011-04-06 10:23:06Z aharvey $ */
 
 #include "php.h"
 #include "php_ini.h"
@@ -606,7 +606,7 @@ static int php_array_user_compare(const void *a, const void *b TSRMLS_DC) /* {{{
 
 	/* Clear FCI cache otherwise : for example the same or other array with
 	 * (partly) the same key values has been sorted with uasort() or
-	 * other sorting function the comparison is cached, however the the name
+	 * other sorting function the comparison is cached, however the name
 	 * of the function for comparison is not respected. see bug #28739 AND #33295
 	 *
 	 * Following defines will assist in backup / restore values. */
@@ -1688,28 +1688,32 @@ PHP_FUNCTION(range)
 		}
 
 	} else if (Z_TYPE_P(zlow) == IS_DOUBLE || Z_TYPE_P(zhigh) == IS_DOUBLE || is_step_double) {
-		double low, high;
+		double low, high, value;
+		long i;
 double_str:
 		convert_to_double(zlow);
 		convert_to_double(zhigh);
 		low = Z_DVAL_P(zlow);
 		high = Z_DVAL_P(zhigh);
+		i = 0;
 
 		if (low > high) { 		/* Negative steps */
 			if (low - high < step || step <= 0) {
 				err = 1;
 				goto err;
 			}
-			for (; low >= (high - DOUBLE_DRIFT_FIX); low -= step) {
-				add_next_index_double(return_value, low);
+
+			for (value = low; value >= (high - DOUBLE_DRIFT_FIX); value = low - (++i * step)) {
+				add_next_index_double(return_value, value);
 			}
 		} else if (high > low) { 	/* Positive steps */
 			if (high - low < step || step <= 0) {
 				err = 1;
 				goto err;
 			}
-			for (; low <= (high + DOUBLE_DRIFT_FIX); low += step) {
-				add_next_index_double(return_value, low);
+
+			for (value = low; value <= (high + DOUBLE_DRIFT_FIX); value = low + (++i * step)) {
+				add_next_index_double(return_value, value);
 			}
 		} else {
 			add_next_index_double(return_value, low);
diff --git a/ext/standard/assert.c b/ext/standard/assert.c
index 778628613..c0f8cd4b5 100644
--- a/ext/standard/assert.c
+++ b/ext/standard/assert.c
@@ -16,7 +16,7 @@
    +----------------------------------------------------------------------+
 */
 
-/* $Id: assert.c 306939 2011-01-01 02:19:59Z felipe $ */
+/* $Id: assert.c 311451 2011-05-26 18:17:43Z iliaa $ */
 
 /* {{{ includes */
 #include "php.h"
@@ -253,8 +253,8 @@ PHP_FUNCTION(assert_options)
 	case ASSERT_ACTIVE:
 		oldint = ASSERTG(active);
 		if (ac == 2) {
-			convert_to_long_ex(value);
-			ASSERTG(active) = Z_LVAL_PP(value);
+			convert_to_string_ex(value);
+			zend_alter_ini_entry_ex("assert.active", sizeof("assert.active"), Z_STRVAL_PP(value), Z_STRLEN_PP(value), PHP_INI_USER, PHP_INI_STAGE_RUNTIME, 0 TSRMLS_CC);
 		}
 		RETURN_LONG(oldint);
 		break;
@@ -262,8 +262,8 @@ PHP_FUNCTION(assert_options)
 	case ASSERT_BAIL:
 		oldint = ASSERTG(bail);
 		if (ac == 2) {
-			convert_to_long_ex(value);
-			ASSERTG(bail) = Z_LVAL_PP(value);
+			convert_to_string_ex(value);
+			zend_alter_ini_entry_ex("assert.bail", sizeof("assert.bail"), Z_STRVAL_PP(value), Z_STRLEN_PP(value), PHP_INI_USER, PHP_INI_STAGE_RUNTIME, 0 TSRMLS_CC);
 		}
 		RETURN_LONG(oldint);
 		break;
@@ -271,8 +271,8 @@ PHP_FUNCTION(assert_options)
 	case ASSERT_QUIET_EVAL:
 		oldint = ASSERTG(quiet_eval);
 		if (ac == 2) {
-			convert_to_long_ex(value);
-			ASSERTG(quiet_eval) = Z_LVAL_PP(value);
+			convert_to_string_ex(value);
+			zend_alter_ini_entry_ex("assert.quiet_eval", sizeof("assert.quiet_eval"), Z_STRVAL_PP(value), Z_STRLEN_PP(value), PHP_INI_USER, PHP_INI_STAGE_RUNTIME, 0 TSRMLS_CC);
 		}
 		RETURN_LONG(oldint);
 		break;
@@ -280,8 +280,8 @@ PHP_FUNCTION(assert_options)
 	case ASSERT_WARNING:
 		oldint = ASSERTG(warning);
 		if (ac == 2) {
-			convert_to_long_ex(value);
-			ASSERTG(warning) = Z_LVAL_PP(value);
+			convert_to_string_ex(value);
+			zend_alter_ini_entry_ex("assert.warning", sizeof("assert.warning"), Z_STRVAL_PP(value), Z_STRLEN_PP(value), PHP_INI_USER, PHP_INI_STAGE_RUNTIME, 0 TSRMLS_CC);
 		}
 		RETURN_LONG(oldint);
 		break;
diff --git a/ext/standard/basic_functions.c b/ext/standard/basic_functions.c
index de8a2cea7..6df993858 100644
--- a/ext/standard/basic_functions.c
+++ b/ext/standard/basic_functions.c
@@ -17,7 +17,7 @@
    +----------------------------------------------------------------------+
  */
 
-/* $Id: basic_functions.c 308127 2011-02-08 16:29:34Z cataphract $ */
+/* $Id: basic_functions.c 314452 2011-08-08 00:47:40Z laruence $ */
 
 #include "php.h"
 #include "php_streams.h"
@@ -3360,7 +3360,7 @@ const zend_function_entry basic_functions[] = { /* {{{ */
 
 	PHP_FE(sys_get_temp_dir,												arginfo_sys_get_temp_dir)
 
-	{NULL, NULL, NULL}
+	PHP_FE_END
 };
 /* }}} */
 
@@ -3401,7 +3401,7 @@ PHP_INI_END()
 
 static const zend_module_dep standard_deps[] = { /* {{{ */
 	ZEND_MOD_OPTIONAL("session")
-	{NULL, NULL, NULL}
+	ZEND_MOD_END
 };
 /* }}} */
 
@@ -3803,6 +3803,7 @@ PHP_RSHUTDOWN_FUNCTION(basic) /* {{{ */
 	}
 
 	PHP_RSHUTDOWN(user_filters)(SHUTDOWN_FUNC_ARGS_PASSTHRU);
+	PHP_RSHUTDOWN(browscap)(SHUTDOWN_FUNC_ARGS_PASSTHRU);
 
  	BG(page_uid) = -1;
  	BG(page_gid) = -1;
@@ -4257,7 +4258,8 @@ PHP_FUNCTION(getopt)
 	/* Get argv from the global symbol table. We calculate argc ourselves
 	 * in order to be on the safe side, even though it is also available
 	 * from the symbol table. */
-	if ((zend_hash_find(HASH_OF(PG(http_globals)[TRACK_VARS_SERVER]), "argv", sizeof("argv"), (void **) &args) != FAILURE ||
+	if (PG(http_globals)[TRACK_VARS_SERVER] &&
+		(zend_hash_find(HASH_OF(PG(http_globals)[TRACK_VARS_SERVER]), "argv", sizeof("argv"), (void **) &args) != FAILURE ||
 		zend_hash_find(&EG(symbol_table), "argv", sizeof("argv"), (void **) &args) != FAILURE) && Z_TYPE_PP(args) == IS_ARRAY
 	) {
 		int pos = 0;
@@ -4316,10 +4318,6 @@ PHP_FUNCTION(getopt)
 
 		memset(opts, 0, count * sizeof(opt_struct));
 
-		if (!opts) {
-			RETURN_FALSE;
-		}
-
 		/* Reset the array indexes. */
 		zend_hash_internal_pointer_reset(Z_ARRVAL_P(p_longopts));
 
@@ -4676,7 +4674,7 @@ PHP_FUNCTION(error_log)
 		opt_err = erropt;
 	}
 
-	if (opt_err == 3) {
+	if (opt_err == 3 && opt) {
 		if (strlen(opt) != opt_len) {
 			RETURN_FALSE;
 		}
diff --git a/ext/standard/basic_functions.h b/ext/standard/basic_functions.h
index 337b003bd..248a4aa53 100644
--- a/ext/standard/basic_functions.h
+++ b/ext/standard/basic_functions.h
@@ -17,7 +17,7 @@
    +----------------------------------------------------------------------+
 */
 
-/* $Id: basic_functions.h 306939 2011-01-01 02:19:59Z felipe $ */
+/* $Id: basic_functions.h 310691 2011-05-01 18:37:20Z cataphract $ */
 
 #ifndef BASIC_FUNCTIONS_H
 #define BASIC_FUNCTIONS_H
@@ -140,6 +140,7 @@ PHP_FUNCTION(stream_bucket_append);
 PHP_FUNCTION(stream_bucket_new);
 PHP_MINIT_FUNCTION(user_filters);
 PHP_RSHUTDOWN_FUNCTION(user_filters);
+PHP_RSHUTDOWN_FUNCTION(browscap);
 
 /* Left for BC (not binary safe!) */
 PHPAPI int _php_error_log(int opt_err, char *message, char *opt, char *headers TSRMLS_DC);
diff --git a/ext/standard/browscap.c b/ext/standard/browscap.c
index 9a3672d8c..68b5c5c8c 100644
--- a/ext/standard/browscap.c
+++ b/ext/standard/browscap.c
@@ -16,7 +16,7 @@
    +----------------------------------------------------------------------+
  */
 
-/* $Id: browscap.c 306939 2011-01-01 02:19:59Z felipe $ */
+/* $Id: browscap.c 311764 2011-06-03 09:39:45Z cataphract $ */
 
 #include "php.h"
 #include "php_browscap.h"
@@ -27,18 +27,51 @@
 #include "zend_ini_scanner.h"
 #include "zend_globals.h"
 
-static HashTable browser_hash;
-static zval *current_section;
-static char *current_section_name;
+typedef struct {
+	HashTable *htab;
+	zval *current_section;
+	char *current_section_name;
+	char filename[MAXPATHLEN];
+} browser_data;
+
+/* browser data defined in startup phase, eagerly loaded in MINIT */
+static browser_data global_bdata = {0};
+
+/* browser data defined in activation phase, lazily loaded in get_browser.
+ * Per request and per thread, if applicable */
+ZEND_BEGIN_MODULE_GLOBALS(browscap)
+	browser_data activation_bdata;
+ZEND_END_MODULE_GLOBALS(browscap)
+
+ZEND_DECLARE_MODULE_GLOBALS(browscap);
+
+#ifdef ZTS
+#define BROWSCAP_G(v)	TSRMG(browscap_globals_id, zend_browscap_globals *, v)
+#else
+#define BROWSCAP_G(v)	(browscap_globals.v)
+#endif
 
 #define DEFAULT_SECTION_NAME "Default Browser Capability Settings"
 
 /* OBJECTS_FIXME: This whole extension needs going through. The use of objects looks pretty broken here */
 
-static void browscap_entry_dtor(zval **zvalue) /* {{{ */
+static void browscap_entry_dtor_request(zval **zvalue) /* {{{ */
 {
 	if (Z_TYPE_PP(zvalue) == IS_ARRAY) {
 		zend_hash_destroy(Z_ARRVAL_PP(zvalue));
+		efree(Z_ARRVAL_PP(zvalue));
+	} else if (Z_TYPE_PP(zvalue) == IS_STRING) {
+		if (Z_STRVAL_PP(zvalue)) {
+			efree(Z_STRVAL_PP(zvalue));
+		}
+	}
+	efree(*zvalue);
+}
+/* }}} */
+
+static void browscap_entry_dtor_persistent(zval **zvalue) /* {{{ */ {
+	if (Z_TYPE_PP(zvalue) == IS_ARRAY) {
+		zend_hash_destroy(Z_ARRVAL_PP(zvalue));
 		free(Z_ARRVAL_PP(zvalue));
 	} else if (Z_TYPE_PP(zvalue) == IS_STRING) {
 		if (Z_STRVAL_PP(zvalue)) {
@@ -49,16 +82,16 @@ static void browscap_entry_dtor(zval **zvalue) /* {{{ */
 }
 /* }}} */
 
-static void convert_browscap_pattern(zval *pattern) /* {{{ */
+static void convert_browscap_pattern(zval *pattern, int persistent) /* {{{ */
 {
 	int i, j=0;
 	char *t;
 
 	php_strtolower(Z_STRVAL_P(pattern), Z_STRLEN_P(pattern));
 
-	t = (char *) safe_pemalloc(Z_STRLEN_P(pattern), 2, 5, 1);
+	t = (char *) safe_pemalloc(Z_STRLEN_P(pattern), 2, 5, persistent);
 
-	t[j++] = '§';
+	t[j++] = '\xA7'; /* section sign */
 	t[j++] = '^';
 
 	for (i=0; i<Z_STRLEN_P(pattern); i++, j++) {
@@ -86,9 +119,9 @@ static void convert_browscap_pattern(zval *pattern) /* {{{ */
 				t[j++] = '\\';
 				t[j] = ')';
 				break;
-			case '§':
+			case '\xA7':
 				t[j++] = '\\';
-				t[j] = '§';
+				t[j] = '\xA7';
 				break;
 			default:
 				t[j] = Z_STRVAL_P(pattern)[i];
@@ -97,7 +130,7 @@ static void convert_browscap_pattern(zval *pattern) /* {{{ */
 	}
 
 	t[j++] = '$';
-	t[j++] = '§';
+	t[j++] = '\xA7';
 
 	t[j]=0;
 	Z_STRVAL_P(pattern) = t;
@@ -107,26 +140,31 @@ static void convert_browscap_pattern(zval *pattern) /* {{{ */
 
 static void php_browscap_parser_cb(zval *arg1, zval *arg2, zval *arg3, int callback_type, void *arg TSRMLS_DC) /* {{{ */
 {
+	browser_data *bdata = arg;
+	int persistent = bdata->htab->persistent;
+	
 	if (!arg1) {
 		return;
 	}
 
 	switch (callback_type) {
 		case ZEND_INI_PARSER_ENTRY:
-			if (current_section && arg2) {
+			if (bdata->current_section && arg2) {
 				zval *new_property;
 				char *new_key;
 
 				/* parent entry can not be same as current section -> causes infinite loop! */
 				if (!strcasecmp(Z_STRVAL_P(arg1), "parent") && 
-					current_section_name != NULL &&
-					!strcasecmp(current_section_name, Z_STRVAL_P(arg2))
+					bdata->current_section_name != NULL &&
+					!strcasecmp(bdata->current_section_name, Z_STRVAL_P(arg2))
 				) {
-					zend_error(E_CORE_ERROR, "Invalid browscap ini file: 'Parent' value cannot be same as the section name: %s (in file %s)", current_section_name, INI_STR("browscap"));
+					zend_error(E_CORE_ERROR, "Invalid browscap ini file: "
+						"'Parent' value cannot be same as the section name: %s "
+						"(in file %s)", bdata->current_section_name, INI_STR("browscap"));
 					return;
 				}
 
-				new_property = (zval *) pemalloc(sizeof(zval), 1);
+				new_property = (zval *) pemalloc(sizeof(zval), persistent);
 				INIT_PZVAL(new_property);
 				Z_TYPE_P(new_property) = IS_STRING;
 
@@ -135,7 +173,7 @@ static void php_browscap_parser_cb(zval *arg1, zval *arg2, zval *arg3, int callb
 					(Z_STRLEN_P(arg2) == 3 && !strncasecmp(Z_STRVAL_P(arg2), "yes", sizeof("yes") - 1)) ||
 					(Z_STRLEN_P(arg2) == 4 && !strncasecmp(Z_STRVAL_P(arg2), "true", sizeof("true") - 1))
 				) {
-					Z_STRVAL_P(new_property) = zend_strndup("1", 1);
+					Z_STRVAL_P(new_property) = pestrndup("1", 1, persistent);
 					Z_STRLEN_P(new_property) = 1;
 				} else if (
 					(Z_STRLEN_P(arg2) == 2 && !strncasecmp(Z_STRVAL_P(arg2), "no", sizeof("no") - 1)) ||
@@ -143,16 +181,17 @@ static void php_browscap_parser_cb(zval *arg1, zval *arg2, zval *arg3, int callb
 					(Z_STRLEN_P(arg2) == 4 && !strncasecmp(Z_STRVAL_P(arg2), "none", sizeof("none") - 1)) ||
 					(Z_STRLEN_P(arg2) == 5 && !strncasecmp(Z_STRVAL_P(arg2), "false", sizeof("false") - 1))
 				) {
-					Z_STRVAL_P(new_property) = zend_strndup("", 0);
+					Z_STRVAL_P(new_property) = pestrndup("", 0, persistent);
 					Z_STRLEN_P(new_property) = 0;
 				} else { /* Other than true/false setting */
-					Z_STRVAL_P(new_property) = zend_strndup(Z_STRVAL_P(arg2), Z_STRLEN_P(arg2));
+					Z_STRVAL_P(new_property) = pestrndup(Z_STRVAL_P(arg2),
+							Z_STRLEN_P(arg2), persistent);
 					Z_STRLEN_P(new_property) = Z_STRLEN_P(arg2);
 				}
-				new_key = zend_strndup(Z_STRVAL_P(arg1), Z_STRLEN_P(arg1));
+				new_key = pestrndup(Z_STRVAL_P(arg1), Z_STRLEN_P(arg1), persistent);
 				zend_str_tolower(new_key, Z_STRLEN_P(arg1));
-				zend_hash_update(Z_ARRVAL_P(current_section), new_key, Z_STRLEN_P(arg1) + 1, &new_property, sizeof(zval *), NULL);
-				free(new_key);
+				zend_hash_update(Z_ARRVAL_P(bdata->current_section), new_key, Z_STRLEN_P(arg1) + 1, &new_property, sizeof(zval *), NULL);
+				pefree(new_key, persistent);
 			}
 			break;
 		case ZEND_INI_PARSER_SECTION: {
@@ -161,23 +200,27 @@ static void php_browscap_parser_cb(zval *arg1, zval *arg2, zval *arg3, int callb
 				HashTable *section_properties;
 
 				/*printf("'%s' (%d)\n",$1.value.str.val,$1.value.str.len + 1);*/
-				current_section = (zval *) pemalloc(sizeof(zval), 1);
-				INIT_PZVAL(current_section);
-				processed = (zval *) pemalloc(sizeof(zval), 1);
+				bdata->current_section = (zval *) pemalloc(sizeof(zval), persistent);
+				INIT_PZVAL(bdata->current_section);
+				processed = (zval *) pemalloc(sizeof(zval), persistent);
 				INIT_PZVAL(processed);
-				unprocessed = (zval *) pemalloc(sizeof(zval), 1);
+				unprocessed = (zval *) pemalloc(sizeof(zval), persistent);
 				INIT_PZVAL(unprocessed);
 
-				section_properties = (HashTable *) pemalloc(sizeof(HashTable), 1);
-				zend_hash_init(section_properties, 0, NULL, (dtor_func_t) browscap_entry_dtor, 1);
-				Z_ARRVAL_P(current_section) = section_properties;
-				Z_TYPE_P(current_section) = IS_ARRAY;
-				if (current_section_name) {
-					free(current_section_name);
+				section_properties = (HashTable *) pemalloc(sizeof(HashTable), persistent);
+				zend_hash_init(section_properties, 0, NULL,
+						(dtor_func_t) (persistent?browscap_entry_dtor_persistent
+												 :browscap_entry_dtor_request),
+						persistent);
+				Z_ARRVAL_P(bdata->current_section) = section_properties;
+				Z_TYPE_P(bdata->current_section) = IS_ARRAY;
+				if (bdata->current_section_name) {
+					pefree(bdata->current_section_name, persistent);
 				}
-				current_section_name = zend_strndup(Z_STRVAL_P(arg1), Z_STRLEN_P(arg1));
+				bdata->current_section_name = pestrndup(Z_STRVAL_P(arg1),
+						Z_STRLEN_P(arg1), persistent);
 
-				zend_hash_update(&browser_hash, Z_STRVAL_P(arg1), Z_STRLEN_P(arg1) + 1, (void *) &current_section, sizeof(zval *), NULL);
+				zend_hash_update(bdata->htab, Z_STRVAL_P(arg1), Z_STRLEN_P(arg1) + 1, (void *) &bdata->current_section, sizeof(zval *), NULL);
 
 				Z_STRVAL_P(processed) = Z_STRVAL_P(arg1);
 				Z_STRLEN_P(processed) = Z_STRLEN_P(arg1);
@@ -185,9 +228,9 @@ static void php_browscap_parser_cb(zval *arg1, zval *arg2, zval *arg3, int callb
 				Z_STRVAL_P(unprocessed) = Z_STRVAL_P(arg1);
 				Z_STRLEN_P(unprocessed) = Z_STRLEN_P(arg1);
 				Z_TYPE_P(unprocessed) = IS_STRING;
-				Z_STRVAL_P(unprocessed) = zend_strndup(Z_STRVAL_P(unprocessed), Z_STRLEN_P(unprocessed));
+				Z_STRVAL_P(unprocessed) = pestrndup(Z_STRVAL_P(unprocessed), Z_STRLEN_P(unprocessed), persistent);
 
-				convert_browscap_pattern(processed);
+				convert_browscap_pattern(processed, persistent);
 				zend_hash_update(section_properties, "browser_name_regex", sizeof("browser_name_regex"), (void *) &processed, sizeof(zval *), NULL);
 				zend_hash_update(section_properties, "browser_name_pattern", sizeof("browser_name_pattern"), (void *) &unprocessed, sizeof(zval *), NULL);
 			}
@@ -196,45 +239,132 @@ static void php_browscap_parser_cb(zval *arg1, zval *arg2, zval *arg3, int callb
 }
 /* }}} */
 
-PHP_MINIT_FUNCTION(browscap) /* {{{ */
+static int browscap_read_file(char *filename, browser_data *browdata, int persistent TSRMLS_DC) /* {{{ */
 {
-	char *browscap = INI_STR("browscap");
+	zend_file_handle fh = {0};
+	
+	if (filename == NULL || filename[0] == '\0') {
+		return FAILURE;
+	}
+	
+	browdata->htab = pemalloc(sizeof *browdata->htab, persistent);
+	if (browdata->htab == NULL) {
+		return FAILURE;
+	}
 
-	if (browscap && browscap[0]) {
-		zend_file_handle fh;
-		memset(&fh, 0, sizeof(fh));
+	if (zend_hash_init_ex(browdata->htab, 0, NULL,
+			(dtor_func_t) (persistent?browscap_entry_dtor_persistent
+									 :browscap_entry_dtor_request),
+			persistent, 0) == FAILURE) {
+		pefree(browdata->htab, persistent);
+		browdata->htab = NULL;
+		return FAILURE;
+	}
+
+	fh.handle.fp = VCWD_FOPEN(filename, "r");
+	fh.opened_path = NULL;
+	fh.free_filename = 0;
+	if (!fh.handle.fp) {
+		zend_hash_destroy(browdata->htab);
+		pefree(browdata->htab, persistent);
+		browdata->htab = NULL;
+		zend_error(E_CORE_WARNING, "Cannot open '%s' for reading", filename);
+		return FAILURE;
+	}
+	fh.filename = filename;
+	Z_TYPE(fh) = ZEND_HANDLE_FP;
+	browdata->current_section_name = NULL;
+	zend_parse_ini_file(&fh, 1, ZEND_INI_SCANNER_RAW,
+			(zend_ini_parser_cb_t) php_browscap_parser_cb, browdata TSRMLS_CC);
+	if (browdata->current_section_name != NULL) {
+		pefree(browdata->current_section_name, persistent);
+		browdata->current_section_name = NULL;
+	}
+	
+	return SUCCESS;
+}
+/* }}} */
+
+#ifdef ZTS
+static void browscap_globals_ctor(zend_browscap_globals *browscap_globals TSRMLS_DC) /* {{{ */
+{
+	browscap_globals->activation_bdata.htab = NULL;
+	browscap_globals->activation_bdata.current_section = NULL;
+	browscap_globals->activation_bdata.current_section_name = NULL;
+	browscap_globals->activation_bdata.filename[0] = '\0';
+}
+/* }}} */
+#endif
+
+static void browscap_bdata_dtor(browser_data *bdata, int persistent TSRMLS_DC) /* {{{ */
+{
+	if (bdata->htab != NULL) {
+		zend_hash_destroy(bdata->htab);
+		pefree(bdata->htab, persistent);
+		bdata->htab = NULL;
+	}
+	bdata->filename[0] = '\0';
+	/* current_section_* are only used during parsing */
+}
+/* }}} */
 
-		if (zend_hash_init_ex(&browser_hash, 0, NULL, (dtor_func_t) browscap_entry_dtor, 1, 0) == FAILURE) {
+/* {{{ PHP_INI_MH
+ */
+PHP_INI_MH(OnChangeBrowscap)
+{
+	if (stage == PHP_INI_STAGE_STARTUP) {
+		/* value handled in browscap.c's MINIT */
+		return SUCCESS;
+	} else if (stage == PHP_INI_STAGE_ACTIVATE) {
+		browser_data *bdata = &BROWSCAP_G(activation_bdata);
+		if (bdata->filename[0] != '\0') {
+			browscap_bdata_dtor(bdata, 0 TSRMLS_CC);
+		}
+		if (VCWD_REALPATH(new_value, bdata->filename) == NULL) {
 			return FAILURE;
 		}
+		return SUCCESS;
+	}
+	
+	return FAILURE;
+}
+/* }}} */
 
-		fh.handle.fp = VCWD_FOPEN(browscap, "r");
-		fh.opened_path = NULL;
-		fh.free_filename = 0;
-		if (!fh.handle.fp) {
-			zend_error(E_CORE_WARNING, "Cannot open '%s' for reading", browscap);
+PHP_MINIT_FUNCTION(browscap) /* {{{ */
+{
+	char *browscap = INI_STR("browscap");
+	
+#ifdef ZTS
+	ts_allocate_id(&browscap_globals_id, sizeof(browser_data),
+		(ts_allocate_ctor)browscap_globals_ctor, NULL);
+#endif
+	/* ctor call not really needed for non-ZTS */
+
+	if (browscap && browscap[0]) {
+		if (browscap_read_file(browscap, &global_bdata, 1 TSRMLS_CC) == FAILURE) {
 			return FAILURE;
 		}
-		fh.filename = browscap;
-		Z_TYPE(fh) = ZEND_HANDLE_FP;
-		current_section_name = NULL;
-		zend_parse_ini_file(&fh, 1, ZEND_INI_SCANNER_RAW, (zend_ini_parser_cb_t) php_browscap_parser_cb, &browser_hash TSRMLS_CC);
-		if (current_section_name) {
-			free(current_section_name);
-			current_section_name = NULL;
-		}
 	}
 
 	return SUCCESS;
 }
 /* }}} */
 
-PHP_MSHUTDOWN_FUNCTION(browscap) /* {{{ */
+PHP_RSHUTDOWN_FUNCTION(browscap) /* {{{ */
 {
-	char *browscap = INI_STR("browscap");
-	if (browscap && browscap[0]) {
-		zend_hash_destroy(&browser_hash);
+	browser_data *bdata = &BROWSCAP_G(activation_bdata);
+	if (bdata->filename[0] != '\0') {
+		browscap_bdata_dtor(bdata, 0 TSRMLS_CC);
 	}
+	
+	return SUCCESS;
+}
+/* }}} */
+
+PHP_MSHUTDOWN_FUNCTION(browscap) /* {{{ */
+{
+	browscap_bdata_dtor(&global_bdata, 1 TSRMLS_CC);
+	
 	return SUCCESS;
 }
 /* }}} */
@@ -331,11 +461,21 @@ PHP_FUNCTION(get_browser)
 	zval **agent, **z_agent_name, **http_user_agent;
 	zval *found_browser_entry, *tmp_copy;
 	char *lookup_browser_name;
-	char *browscap = INI_STR("browscap");
+	browser_data *bdata;
 
-	if (!browscap || !browscap[0]) {
-		php_error_docref(NULL TSRMLS_CC, E_WARNING, "browscap ini directive not set");
-		RETURN_FALSE;
+	if (BROWSCAP_G(activation_bdata).filename[0] != '\0') {
+		bdata = &BROWSCAP_G(activation_bdata);
+		if (bdata->htab == NULL) { /* not initialized yet */
+			if (browscap_read_file(bdata->filename, bdata, 0 TSRMLS_CC) == FAILURE) {
+				RETURN_FALSE;
+			}
+		}
+	} else {
+		if (!global_bdata.htab) {
+			php_error_docref(NULL TSRMLS_CC, E_WARNING, "browscap ini directive not set");
+			RETURN_FALSE;
+		}
+		bdata = &global_bdata;
 	}
 
 	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|s!b", &agent_name, &agent_name_len, &return_array) == FAILURE) {
@@ -357,13 +497,13 @@ PHP_FUNCTION(get_browser)
 	lookup_browser_name = estrndup(agent_name, agent_name_len);
 	php_strtolower(lookup_browser_name, agent_name_len);
 
-	if (zend_hash_find(&browser_hash, lookup_browser_name, agent_name_len + 1, (void **) &agent) == FAILURE) {
+	if (zend_hash_find(bdata->htab, lookup_browser_name, agent_name_len + 1, (void **) &agent) == FAILURE) {
 		found_browser_entry = NULL;
-		zend_hash_apply_with_arguments(&browser_hash TSRMLS_CC, (apply_func_args_t) browser_reg_compare, 3, lookup_browser_name, agent_name_len, &found_browser_entry);
+		zend_hash_apply_with_arguments(bdata->htab TSRMLS_CC, (apply_func_args_t) browser_reg_compare, 3, lookup_browser_name, agent_name_len, &found_browser_entry);
 
 		if (found_browser_entry) {
 			agent = &found_browser_entry;
-		} else if (zend_hash_find(&browser_hash, DEFAULT_SECTION_NAME, sizeof(DEFAULT_SECTION_NAME), (void **) &agent) == FAILURE) {
+		} else if (zend_hash_find(bdata->htab, DEFAULT_SECTION_NAME, sizeof(DEFAULT_SECTION_NAME), (void **) &agent) == FAILURE) {
 			efree(lookup_browser_name);
 			RETURN_FALSE;
 		}
@@ -379,7 +519,7 @@ PHP_FUNCTION(get_browser)
 	}
 
 	while (zend_hash_find(Z_ARRVAL_PP(agent), "parent", sizeof("parent"), (void **) &z_agent_name) == SUCCESS) {
-		if (zend_hash_find(&browser_hash, Z_STRVAL_PP(z_agent_name), Z_STRLEN_PP(z_agent_name) + 1, (void **)&agent) == FAILURE) {
+		if (zend_hash_find(bdata->htab, Z_STRVAL_PP(z_agent_name), Z_STRLEN_PP(z_agent_name) + 1, (void **)&agent) == FAILURE) {
 			break;
 		}
 
diff --git a/ext/standard/credits.c b/ext/standard/credits.c
index 21272edc1..d4bf4116b 100644
--- a/ext/standard/credits.c
+++ b/ext/standard/credits.c
@@ -17,7 +17,7 @@
    +----------------------------------------------------------------------+
 */
 
-/* $Id: credits.c 306939 2011-01-01 02:19:59Z felipe $ */
+/* $Id: credits.c 311822 2011-06-05 06:57:13Z philip $ */
 
 #include "php.h"
 #include "info.h"
@@ -96,7 +96,7 @@ PHPAPI void php_print_credits(int flag TSRMLS_DC) /* {{{ */
 		php_info_print_table_colspan_header(2, "PHP Documentation");
 		CREDIT_LINE("Authors", "Mehdi Achour, Friedhelm Betz, Antony Dovgal, Nuno Lopes, Hannes Magnusson, Georg Richter, Damien Seguy, Jakub Vrana");
 		CREDIT_LINE("Editor", "Philip Olson");
-		CREDIT_LINE("User Note Maintainers", "Friedhelm Betz, Etienne Kneuss, Nuno Lopes, Hannes Magnusson, Felipe Pena, Maciek Sokolewicz, Daniel P. Brown");
+		CREDIT_LINE("User Note Maintainers", "Daniel P. Brown, Thiago Henrique Pojda");
 		CREDIT_LINE("Other Contributors", "Previously active authors, editors and other contributors are listed in the manual.");
 		php_info_print_table_end();
 	}
diff --git a/ext/standard/crypt.c b/ext/standard/crypt.c
index 77e459d9f..cda330b5d 100644
--- a/ext/standard/crypt.c
+++ b/ext/standard/crypt.c
@@ -19,7 +19,7 @@
    +----------------------------------------------------------------------+
 */
 
-/* $Id: crypt.c 306939 2011-01-01 02:19:59Z felipe $ */
+/* $Id: crypt.c 314641 2011-08-09 12:16:58Z laruence $ */
 
 #include <stdlib.h>
 
@@ -170,15 +170,17 @@ PHP_FUNCTION(crypt)
 	/* The automatic salt generation covers standard DES, md5-crypt and Blowfish (simple) */
 	if (!*salt) {
 #if PHP_MD5_CRYPT
-		strcpy(salt, "$1$");
+		strncpy(salt, "$1$", PHP_MAX_SALT_LEN);
 		php_to64(&salt[3], PHP_CRYPT_RAND, 4);
 		php_to64(&salt[7], PHP_CRYPT_RAND, 4);
-		strcpy(&salt[11], "$");
+		strncpy(&salt[11], "$", PHP_MAX_SALT_LEN - 11);
 #elif PHP_STD_DES_CRYPT
 		php_to64(&salt[0], PHP_CRYPT_RAND, 2);
 		salt[2] = '\0';
 #endif
 		salt_in_len = strlen(salt);
+	} else {
+		salt_in_len = MIN(PHP_MAX_SALT_LEN, salt_in_len);
 	}
 
 /* Windows (win32/crypt) has a stripped down version of libxcrypt and 
@@ -240,7 +242,7 @@ PHP_FUNCTION(crypt)
 		} else if (
 				salt[0] == '$' &&
 				salt[1] == '2' &&
-				salt[2] == 'a' &&
+				salt[2] >= 'a' && salt[2] <= 'z' &&
 				salt[3] == '$' &&
 				salt[4] >= '0' && salt[4] <= '3' &&
 				salt[5] >= '0' && salt[5] <= '9' &&
diff --git a/ext/standard/crypt_blowfish.c b/ext/standard/crypt_blowfish.c
index 37160842e..fb9577208 100644
--- a/ext/standard/crypt_blowfish.c
+++ b/ext/standard/crypt_blowfish.c
@@ -1,28 +1,39 @@
+/* $Id: crypt_blowfish.c 313406 2011-07-18 21:26:29Z pajoye $ */
 /*
-  $Id: crypt_blowfish.c 295339 2010-02-21 23:47:14Z pajoye $ 
-*/
-/*
+ * The crypt_blowfish homepage is:
+ *
+ *	http://www.openwall.com/crypt/
+ *
  * This code comes from John the Ripper password cracker, with reentrant
  * and crypt(3) interfaces added, but optimizations specific to password
  * cracking removed.
  *
- * Written by Solar Designer <solar at openwall.com> in 1998-2002 and
- * placed in the public domain.
+ * Written by Solar Designer <solar at openwall.com> in 1998-2011.
+ * No copyright is claimed, and the software is hereby placed in the public
+ * domain. In case this attempt to disclaim copyright and place the software
+ * in the public domain is deemed null and void, then the software is
+ * Copyright (c) 1998-2011 Solar Designer and it is hereby released to the
+ * general public under the following terms:
  *
- * There's absolutely no warranty.
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted.
+ *
+ * There's ABSOLUTELY NO WARRANTY, express or implied.
  *
  * It is my intent that you should be able to use this on your system,
- * as a part of a software package, or anywhere else to improve security,
+ * as part of a software package, or anywhere else to improve security,
  * ensure compatibility, or for any other purpose. I would appreciate
  * it if you give credit where it is due and keep your modifications in
  * the public domain as well, but I don't require that in order to let
  * you place this code and any modifications you make under a license
  * of your choice.
  *
- * This implementation is compatible with OpenBSD bcrypt.c (version 2a)
- * by Niels Provos <provos at citi.umich.edu>, and uses some of his
+ * This implementation is mostly compatible with OpenBSD's bcrypt.c (prefix
+ * "$2a$") by Niels Provos <provos at citi.umich.edu>, and uses some of his
  * ideas. The password hashing algorithm was designed by David Mazieres
- * <dm at lcs.mit.edu>.
+ * <dm at lcs.mit.edu>. For more information on the level of compatibility,
+ * please refer to the comments in BF_set_key() below and to the crypt(3)
+ * man page included in the crypt_blowfish tarball.
  *
  * There's a paper on the algorithm that explains its design decisions:
  *
@@ -40,16 +51,8 @@
 #define __set_errno(val) errno = (val)
 #endif
 
-
-#ifndef __const
-#ifdef __GNUC__
-#define __CONST __const
-#else
-#define __CONST
-#endif
-#else
-#define __CONST __const
-#endif
+/* Just to make sure the prototypes match the actual definitions */
+#include "crypt_blowfish.h"
 
 #ifdef __i386__
 #define BF_ASM				0
@@ -63,6 +66,7 @@
 #endif
 
 typedef unsigned int BF_word;
+typedef signed int BF_word_signed;
 
 /* Number of Blowfish rounds, this is also hardcoded into a few places */
 #define BF_N				16
@@ -370,35 +374,21 @@ static unsigned char BF_atoi64[0x60] = {
 	43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 64, 64, 64, 64, 64
 };
 
-/*
- * This may be optimized out if built with function inlining and no BF_ASM.
- */
-static void clean(void *data, int size)
-{
-#if BF_ASM
-	extern void _BF_clean(void *data);
-#endif
-	memset(data, 0, size);
-#if BF_ASM
-	_BF_clean(data);
-#endif
-}
-
 #define BF_safe_atoi64(dst, src) \
 { \
 	tmp = (unsigned char)(src); \
-	if (tmp == '$') break; \
+	if (tmp == '$') break; /* PHP hack */ \
 	if ((unsigned int)(tmp -= 0x20) >= 0x60) return -1; \
 	tmp = BF_atoi64[tmp]; \
 	if (tmp > 63) return -1; \
 	(dst) = tmp; \
 }
 
-static int BF_decode(BF_word *dst, __CONST char *src, int size)
+static int BF_decode(BF_word *dst, const char *src, int size)
 {
 	unsigned char *dptr = (unsigned char *)dst;
 	unsigned char *end = dptr + size;
-	unsigned char *sptr = (unsigned char *)src;
+	const unsigned char *sptr = (const unsigned char *)src;
 	unsigned int tmp, c1, c2, c3, c4;
 
 	do {
@@ -415,16 +405,16 @@ static int BF_decode(BF_word *dst, __CONST char *src, int size)
 		*dptr++ = ((c3 & 0x03) << 6) | c4;
 	} while (dptr < end);
 
-	while (dptr < end)
+	while (dptr < end) /* PHP hack */
 		*dptr++ = 0;
 
 	return 0;
 }
 
-static void BF_encode(char *dst, __CONST BF_word *src, int size)
+static void BF_encode(char *dst, const BF_word *src, int size)
 {
-	unsigned char *sptr = (unsigned char *)src;
-	unsigned char *end = sptr + size;
+	const unsigned char *sptr = (const unsigned char *)src;
+	const unsigned char *end = sptr + size;
 	unsigned char *dptr = (unsigned char *)dst;
 	unsigned int c1, c2;
 
@@ -555,32 +545,117 @@ static void BF_swap(BF_word *x, int count)
 	} while (ptr < &data.ctx.S[3][0xFF]);
 #endif
 
-static void BF_set_key(__CONST char *key, BF_key expanded, BF_key initial)
+static void BF_set_key(const char *key, BF_key expanded, BF_key initial,
+    unsigned char flags)
 {
-	__CONST char *ptr = key;
-	int i, j;
-	BF_word tmp;
+	const char *ptr = key;
+	unsigned int bug, i, j;
+	BF_word safety, sign, diff, tmp[2];
+
+/*
+ * There was a sign extension bug in older revisions of this function. While
+ * we would have liked to simply fix the bug and move on, we have to provide
+ * a backwards compatibility feature (essentially the bug) for some systems and
+ * a safety measure for some others. The latter is needed because for certain
+ * multiple inputs to the buggy algorithm there exist easily found inputs to
+ * the correct algorithm that produce the same hash. Thus, we optionally
+ * deviate from the correct algorithm just enough to avoid such collisions.
+ * While the bug itself affected the majority of passwords containing
+ * characters with the 8th bit set (although only a percentage of those in a
+ * collision-producing way), the anti-collision safety measure affects
+ * only a subset of passwords containing the '\xff' character (not even all of
+ * those passwords, just some of them). This character is not found in valid
+ * UTF-8 sequences and is rarely used in popular 8-bit character encodings.
+ * Thus, the safety measure is unlikely to cause much annoyance, and is a
+ * reasonable tradeoff to use when authenticating against existing hashes that
+ * are not reliably known to have been computed with the correct algorithm.
+ *
+ * We use an approach that tries to minimize side-channel leaks of password
+ * information - that is, we mostly use fixed-cost bitwise operations instead
+ * of branches or table lookups. (One conditional branch based on password
+ * length remains. It is not part of the bug aftermath, though, and is
+ * difficult and possibly unreasonable to avoid given the use of C strings by
+ * the caller, which results in similar timing leaks anyway.)
+ *
+ * For actual implementation, we set an array index in the variable "bug"
+ * (0 means no bug, 1 means sign extension bug emulation) and a flag in the
+ * variable "safety" (bit 16 is set when the safety measure is requested).
+ * Valid combinations of settings are:
+ *
+ * Prefix "$2a$": bug = 0, safety = 0x10000
+ * Prefix "$2x$": bug = 1, safety = 0
+ * Prefix "$2y$": bug = 0, safety = 0
+ */
+	bug = (unsigned int)flags & 1;
+	safety = ((BF_word)flags & 2) << 15;
+
+	sign = diff = 0;
 
 	for (i = 0; i < BF_N + 2; i++) {
-		tmp = 0;
+		tmp[0] = tmp[1] = 0;
 		for (j = 0; j < 4; j++) {
-			tmp <<= 8;
-			tmp |= *ptr;
-
-			if (!*ptr) ptr = key; else ptr++;
+			tmp[0] <<= 8;
+			tmp[0] |= (unsigned char)*ptr; /* correct */
+			tmp[1] <<= 8;
+			tmp[1] |= (BF_word_signed)(signed char)*ptr; /* bug */
+/*
+ * Sign extension in the first char has no effect - nothing to overwrite yet,
+ * and those extra 24 bits will be fully shifted out of the 32-bit word. For
+ * chars 2, 3, 4 in each four-char block, we set bit 7 of "sign" if sign
+ * extension in tmp[1] occurs. Once this flag is set, it remains set.
+ */
+			if (j)
+				sign |= tmp[1] & 0x80;
+			if (!*ptr)
+				ptr = key;
+			else
+				ptr++;
 		}
+		diff |= tmp[0] ^ tmp[1]; /* Non-zero on any differences */
 
-		expanded[i] = tmp;
-		initial[i] = BF_init_state.P[i] ^ tmp;
+		expanded[i] = tmp[bug];
+		initial[i] = BF_init_state.P[i] ^ tmp[bug];
 	}
+
+/*
+ * At this point, "diff" is zero iff the correct and buggy algorithms produced
+ * exactly the same result. If so and if "sign" is non-zero, which indicates
+ * that there was a non-benign sign extension, this means that we have a
+ * collision between the correctly computed hash for this password and a set of
+ * passwords that could be supplied to the buggy algorithm. Our safety measure
+ * is meant to protect from such many-buggy to one-correct collisions, by
+ * deviating from the correct algorithm in such cases. Let's check for this.
+ */
+	diff |= diff >> 16; /* still zero iff exact match */
+	diff &= 0xffff; /* ditto */
+	diff += 0xffff; /* bit 16 set iff "diff" was non-zero (on non-match) */
+	sign <<= 9; /* move the non-benign sign extension flag to bit 16 */
+	sign &= ~diff & safety; /* action needed? */
+
+/*
+ * If we have determined that we need to deviate from the correct algorithm,
+ * flip bit 16 in initial expanded key. (The choice of 16 is arbitrary, but
+ * let's stick to it now. It came out of the approach we used above, and it's
+ * not any worse than any other choice we could make.)
+ *
+ * It is crucial that we don't do the same to the expanded key used in the main
+ * Eksblowfish loop. By doing it to only one of these two, we deviate from a
+ * state that could be directly specified by a password to the buggy algorithm
+ * (and to the fully correct one as well, but that's a side-effect).
+ */
+	initial[0] ^= sign;
 }
 
-char *php_crypt_blowfish_rn(__CONST char *key, __CONST char *setting,
-	char *output, int size)
+static char *BF_crypt(const char *key, const char *setting,
+	char *output, int size,
+	BF_word min)
 {
 #if BF_ASM
 	extern void _BF_body_r(BF_ctx *ctx);
 #endif
+	static const unsigned char flags_by_subtype[26] =
+		{2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+		0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 4, 0};
 	struct {
 		BF_ctx ctx;
 		BF_key expanded_key;
@@ -602,7 +677,8 @@ char *php_crypt_blowfish_rn(__CONST char *key, __CONST char *setting,
 
 	if (setting[0] != '$' ||
 	    setting[1] != '2' ||
-	    setting[2] != 'a' ||
+	    setting[2] < 'a' || setting[2] > 'z' ||
+	    !flags_by_subtype[(unsigned int)(unsigned char)setting[2] - 'a'] ||
 	    setting[3] != '$' ||
 	    setting[4] < '0' || setting[4] > '3' ||
 	    setting[5] < '0' || setting[5] > '9' ||
@@ -613,15 +689,14 @@ char *php_crypt_blowfish_rn(__CONST char *key, __CONST char *setting,
 	}
 
 	count = (BF_word)1 << ((setting[4] - '0') * 10 + (setting[5] - '0'));
-	if (count < 16 || BF_decode(data.binary.salt, &setting[7], 16)) {
-		clean(data.binary.salt, sizeof(data.binary.salt));
+	if (count < min || BF_decode(data.binary.salt, &setting[7], 16)) {
 		__set_errno(EINVAL);
 		return NULL;
 	}
-
 	BF_swap(data.binary.salt, 4);
 
-	BF_set_key(key, data.expanded_key, data.ctx.P);
+	BF_set_key(key, data.expanded_key, data.ctx.P,
+	    flags_by_subtype[(unsigned int)(unsigned char)setting[2] - 'a']);
 
 	memcpy(data.ctx.S, BF_init_state.S, sizeof(data.ctx.S));
 
@@ -651,51 +726,33 @@ char *php_crypt_blowfish_rn(__CONST char *key, __CONST char *setting,
 	} while (ptr < &data.ctx.S[3][0xFF]);
 
 	do {
-		data.ctx.P[0] ^= data.expanded_key[0];
-		data.ctx.P[1] ^= data.expanded_key[1];
-		data.ctx.P[2] ^= data.expanded_key[2];
-		data.ctx.P[3] ^= data.expanded_key[3];
-		data.ctx.P[4] ^= data.expanded_key[4];
-		data.ctx.P[5] ^= data.expanded_key[5];
-		data.ctx.P[6] ^= data.expanded_key[6];
-		data.ctx.P[7] ^= data.expanded_key[7];
-		data.ctx.P[8] ^= data.expanded_key[8];
-		data.ctx.P[9] ^= data.expanded_key[9];
-		data.ctx.P[10] ^= data.expanded_key[10];
-		data.ctx.P[11] ^= data.expanded_key[11];
-		data.ctx.P[12] ^= data.expanded_key[12];
-		data.ctx.P[13] ^= data.expanded_key[13];
-		data.ctx.P[14] ^= data.expanded_key[14];
-		data.ctx.P[15] ^= data.expanded_key[15];
-		data.ctx.P[16] ^= data.expanded_key[16];
-		data.ctx.P[17] ^= data.expanded_key[17];
-
-		BF_body();
-
-		tmp1 = data.binary.salt[0];
-		tmp2 = data.binary.salt[1];
-		tmp3 = data.binary.salt[2];
-		tmp4 = data.binary.salt[3];
-		data.ctx.P[0] ^= tmp1;
-		data.ctx.P[1] ^= tmp2;
-		data.ctx.P[2] ^= tmp3;
-		data.ctx.P[3] ^= tmp4;
-		data.ctx.P[4] ^= tmp1;
-		data.ctx.P[5] ^= tmp2;
-		data.ctx.P[6] ^= tmp3;
-		data.ctx.P[7] ^= tmp4;
-		data.ctx.P[8] ^= tmp1;
-		data.ctx.P[9] ^= tmp2;
-		data.ctx.P[10] ^= tmp3;
-		data.ctx.P[11] ^= tmp4;
-		data.ctx.P[12] ^= tmp1;
-		data.ctx.P[13] ^= tmp2;
-		data.ctx.P[14] ^= tmp3;
-		data.ctx.P[15] ^= tmp4;
-		data.ctx.P[16] ^= tmp1;
-		data.ctx.P[17] ^= tmp2;
-
-		BF_body();
+		int done;
+
+		for (i = 0; i < BF_N + 2; i += 2) {
+			data.ctx.P[i] ^= data.expanded_key[i];
+			data.ctx.P[i + 1] ^= data.expanded_key[i + 1];
+		}
+
+		done = 0;
+		do {
+			BF_body();
+			if (done)
+				break;
+			done = 1;
+
+			tmp1 = data.binary.salt[0];
+			tmp2 = data.binary.salt[1];
+			tmp3 = data.binary.salt[2];
+			tmp4 = data.binary.salt[3];
+			for (i = 0; i < BF_N; i += 4) {
+				data.ctx.P[i] ^= tmp1;
+				data.ctx.P[i + 1] ^= tmp2;
+				data.ctx.P[i + 2] ^= tmp3;
+				data.ctx.P[i + 3] ^= tmp4;
+			}
+			data.ctx.P[16] ^= tmp1;
+			data.ctx.P[17] ^= tmp2;
+		} while (1);
 	} while (--count);
 
 	for (i = 0; i < 6; i += 2) {
@@ -721,19 +778,114 @@ char *php_crypt_blowfish_rn(__CONST char *key, __CONST char *setting,
 	BF_encode(&output[7 + 22], data.binary.output, 23);
 	output[7 + 22 + 31] = '\0';
 
-/* Overwrite the most obvious sensitive data we have on the stack. Note
- * that this does not guarantee there's no sensitive data left on the
- * stack and/or in registers; I'm not aware of portable code that does. */
-	clean(&data, sizeof(data));
-
 	return output;
 }
 
-char *php_crypt_gensalt_blowfish_rn(unsigned long count,
-	__CONST char *input, int size, char *output, int output_size)
+static int _crypt_output_magic(const char *setting, char *output, int size)
+{
+	if (size < 3)
+		return -1;
+
+	output[0] = '*';
+	output[1] = '0';
+	output[2] = '\0';
+
+	if (setting[0] == '*' && setting[1] == '0')
+		output[1] = '1';
+
+	return 0;
+}
+
+/*
+ * Please preserve the runtime self-test. It serves two purposes at once:
+ *
+ * 1. We really can't afford the risk of producing incompatible hashes e.g.
+ * when there's something like gcc bug 26587 again, whereas an application or
+ * library integrating this code might not also integrate our external tests or
+ * it might not run them after every build. Even if it does, the miscompile
+ * might only occur on the production build, but not on a testing build (such
+ * as because of different optimization settings). It is painful to recover
+ * from incorrectly-computed hashes - merely fixing whatever broke is not
+ * enough. Thus, a proactive measure like this self-test is needed.
+ *
+ * 2. We don't want to leave sensitive data from our actual password hash
+ * computation on the stack or in registers. Previous revisions of the code
+ * would do explicit cleanups, but simply running the self-test after hash
+ * computation is more reliable.
+ *
+ * The performance cost of this quick self-test is around 0.6% at the "$2a$08"
+ * setting.
+ */
+char *php_crypt_blowfish_rn(const char *key, const char *setting,
+	char *output, int size)
+{
+	const char *test_key = "8b \xd0\xc1\xd2\xcf\xcc\xd8";
+	const char *test_setting = "$2a$00$abcdefghijklmnopqrstuu";
+	static const char * const test_hash[2] =
+		{"VUrPmXD6q/nVSSp7pNDhCR9071IfIRe\0\x55", /* $2x$ */
+		"i1D709vfamulimlGcq0qq3UvuUasvEa\0\x55"}; /* $2a$, $2y$ */
+	char *retval;
+	const char *p;
+	int save_errno, ok;
+	struct {
+		char s[7 + 22 + 1];
+		char o[7 + 22 + 31 + 1 + 1 + 1];
+	} buf;
+
+/* Hash the supplied password */
+	_crypt_output_magic(setting, output, size);
+	retval = BF_crypt(key, setting, output, size, 16);
+	save_errno = errno;
+
+/*
+ * Do a quick self-test. It is important that we make both calls to BF_crypt()
+ * from the same scope such that they likely use the same stack locations,
+ * which makes the second call overwrite the first call's sensitive data on the
+ * stack and makes it more likely that any alignment related issues would be
+ * detected by the self-test.
+ */
+	memcpy(buf.s, test_setting, sizeof(buf.s));
+	if (retval)
+		buf.s[2] = setting[2];
+	memset(buf.o, 0x55, sizeof(buf.o));
+	buf.o[sizeof(buf.o) - 1] = 0;
+	p = BF_crypt(test_key, buf.s, buf.o, sizeof(buf.o) - (1 + 1), 1);
+
+	ok = (p == buf.o &&
+	    !memcmp(p, buf.s, 7 + 22) &&
+	    !memcmp(p + (7 + 22),
+	    test_hash[(unsigned int)(unsigned char)buf.s[2] & 1],
+	    31 + 1 + 1 + 1));
+
+	{
+		const char *k = "\xff\xa3" "34" "\xff\xff\xff\xa3" "345";
+		BF_key ae, ai, ye, yi;
+		BF_set_key(k, ae, ai, 2); /* $2a$ */
+		BF_set_key(k, ye, yi, 4); /* $2y$ */
+		ai[0] ^= 0x10000; /* undo the safety (for comparison) */
+		ok = ok && ai[0] == 0xdb9c59bc && ye[17] == 0x33343500 &&
+		    !memcmp(ae, ye, sizeof(ae)) &&
+		    !memcmp(ai, yi, sizeof(ai));
+	}
+
+	__set_errno(save_errno);
+	if (ok)
+		return retval;
+
+/* Should not happen */
+	_crypt_output_magic(setting, output, size);
+	__set_errno(EINVAL); /* pretend we don't support this hash type */
+	return NULL;
+}
+
+#if 0
+char *_crypt_gensalt_blowfish_rn(const char *prefix, unsigned long count,
+	const char *input, int size, char *output, int output_size)
 {
 	if (size < 16 || output_size < 7 + 22 + 1 ||
-	    (count && (count < 4 || count > 31))) {
+	    (count && (count < 4 || count > 31)) ||
+	    prefix[0] != '$' || prefix[1] != '2' ||
+	    (prefix[2] != 'a' && prefix[2] != 'y')) {
 		if (output_size > 0) output[0] = '\0';
 		__set_errno((output_size < 7 + 22 + 1) ? ERANGE : EINVAL);
 		return NULL;
@@ -743,14 +895,15 @@ char *php_crypt_gensalt_blowfish_rn(unsigned long count,
 
 	output[0] = '$';
 	output[1] = '2';
-	output[2] = 'a';
+	output[2] = prefix[2];
 	output[3] = '$';
 	output[4] = '0' + count / 10;
 	output[5] = '0' + count % 10;
 	output[6] = '$';
 
-	BF_encode(&output[7], (BF_word *)input, 16);
+	BF_encode(&output[7], (const BF_word *)input, 16);
 	output[7 + 22] = '\0';
 
 	return output;
 }
+#endif
diff --git a/ext/standard/crypt_blowfish.h b/ext/standard/crypt_blowfish.h
new file mode 100644
index 000000000..da374730e
--- /dev/null
+++ b/ext/standard/crypt_blowfish.h
@@ -0,0 +1,32 @@
+/* $Id$ */

+/*

+ * Written by Solar Designer <solar at openwall.com> in 2000-2011.

+ * No copyright is claimed, and the software is hereby placed in the public

+ * domain. In case this attempt to disclaim copyright and place the software

+ * in the public domain is deemed null and void, then the software is

+ * Copyright (c) 2000-2011 Solar Designer and it is hereby released to the

+ * general public under the following terms:

+ *

+ * Redistribution and use in source and binary forms, with or without

+ * modification, are permitted.

+ *

+ * There's ABSOLUTELY NO WARRANTY, express or implied.

+ *

+ * See crypt_blowfish.c for more information.

+ */

+

+#ifndef _CRYPT_BLOWFISH_H

+#define _CRYPT_BLOWFISH_H

+

+#if 0

+extern int _crypt_output_magic(const char *setting, char *output, int size);

+#endif

+extern char *php_crypt_blowfish_rn(const char *key, const char *setting,

+	char *output, int size);

+#if 0

+extern char *_crypt_gensalt_blowfish_rn(const char *prefix,

+	unsigned long count,

+	const char *input, int size, char *output, int output_size);

+#endif

+

+#endif

diff --git a/ext/standard/crypt_sha256.c b/ext/standard/crypt_sha256.c
index f9daed909..0923aae30 100644
--- a/ext/standard/crypt_sha256.c
+++ b/ext/standard/crypt_sha256.c
@@ -395,9 +395,10 @@ char * php_sha256_crypt_r(const char *key, const char *salt, char *buffer, int b
 	}
 
 	if ((salt - (char *) 0) % __alignof__(uint32_t) != 0) {
-		char *tmp = (char *) alloca(salt_len + __alignof__(uint32_t));
+		char *tmp = (char *) alloca(salt_len + 1 + __alignof__(uint32_t));
 		salt = copied_salt =
 		memcpy(tmp + __alignof__(uint32_t) - (tmp - (char *) 0) % __alignof__ (uint32_t), salt, salt_len);
+		copied_salt[salt_len] = 0;
 	}
 
 	/* Prepare for the real work.  */
diff --git a/ext/standard/crypt_sha512.c b/ext/standard/crypt_sha512.c
index f78ff0398..cbc97a328 100644
--- a/ext/standard/crypt_sha512.c
+++ b/ext/standard/crypt_sha512.c
@@ -430,9 +430,9 @@ php_sha512_crypt_r(const char *key, const char *salt, char *buffer, int buflen)
 	}
 
 	if ((salt - (char *) 0) % __alignof__ (uint64_t) != 0) {
-		char *tmp = (char *) alloca(salt_len + __alignof__(uint64_t));
-
+		char *tmp = (char *) alloca(salt_len + 1 + __alignof__(uint64_t));
 		salt = copied_salt = memcpy(tmp + __alignof__(uint64_t) - (tmp - (char *) 0) % __alignof__(uint64_t), salt, salt_len);
+		copied_salt[salt_len] = 0;
 	}
 
 	/* Prepare for the real work.  */
diff --git a/ext/standard/dl.c b/ext/standard/dl.c
index 79d0d20a1..81b12838d 100644
--- a/ext/standard/dl.c
+++ b/ext/standard/dl.c
@@ -18,7 +18,7 @@
    +----------------------------------------------------------------------+
 */
 
-/* $Id: dl.c 306939 2011-01-01 02:19:59Z felipe $ */
+/* $Id: dl.c 311444 2011-05-26 14:37:13Z pajoye $ */
 
 #include "php.h"
 #include "dl.h"
@@ -148,7 +148,7 @@ PHPAPI int php_load_extension(char *filename, int type, int start_now TSRMLS_DC)
 	if (!handle) {
 #if PHP_WIN32
 		char *err = GET_DL_ERROR();
-		if (err) {
+		if (err && (*err != "")) {
 			php_error_docref(NULL TSRMLS_CC, error_type, "Unable to load dynamic library '%s' - %s", libpath, err);
 			LocalFree(err);
 		} else {
diff --git a/ext/standard/dns.c b/ext/standard/dns.c
index 0db3480e5..8453ad887 100644
--- a/ext/standard/dns.c
+++ b/ext/standard/dns.c
@@ -18,7 +18,7 @@
    +----------------------------------------------------------------------+
  */
 
-/* $Id: dns.c 306939 2011-01-01 02:19:59Z felipe $ */
+/* $Id: dns.c 314766 2011-08-10 17:40:56Z rasmus $ */
 
 /* {{{ includes */
 #include "php.h"
@@ -62,6 +62,16 @@
 #define AF_INET 2   /* internetwork: UDP, TCP, etc. */
 #endif
 
+#ifndef MAXHOSTNAMELEN
+#define MAXHOSTNAMELEN 255
+#endif
+
+/* For the local hostname obtained via gethostname which is different from the
+   dns-related MAXHOSTNAMELEN constant above */
+#ifndef HOST_NAME_MAX
+#define HOST_NAME_MAX 255
+#endif
+
 #include "php_dns.h"
 
 /* type compat */
@@ -118,7 +128,7 @@ static char *php_gethostbyname(char *name);
    Get the host name of the current machine */
 PHP_FUNCTION(gethostname)
 {
-	char buf[4096];
+	char buf[HOST_NAME_MAX];
 
 	if (zend_parse_parameters_none() == FAILURE) {
 		return;
@@ -794,12 +804,14 @@ PHP_FUNCTION(dns_get_record)
 #if defined(HAVE_DNS_SEARCH)
 			handle = dns_open(NULL);
 			if (handle == NULL) {
+				zval_dtor(return_value);
 				RETURN_FALSE;
 			}
 #elif defined(HAVE_RES_NSEARCH)
 		    memset(&state, 0, sizeof(state));
 		    if (res_ninit(handle)) {
-					RETURN_FALSE;
+		    	zval_dtor(return_value);
+				RETURN_FALSE;
 			}
 #else
 			res_init();
diff --git a/ext/standard/file.c b/ext/standard/file.c
index 3bf1c47bb..091eb4390 100644
--- a/ext/standard/file.c
+++ b/ext/standard/file.c
@@ -21,7 +21,7 @@
    +----------------------------------------------------------------------+
 */
 
-/* $Id: file.c 306939 2011-01-01 02:19:59Z felipe $ */
+/* $Id: file.c 312285 2011-06-19 14:50:44Z felipe $ */
 
 /* Synced with php 3.0 revision 1.218 1999-06-16 [ssb] */
 
@@ -1498,20 +1498,20 @@ PHP_FUNCTION(umask)
 {
 	long arg1 = 0;
 	int oldumask;
-	int arg_count = ZEND_NUM_ARGS();
-
+	
 	oldumask = umask(077);
 
 	if (BG(umask) == -1) {
 		BG(umask) = oldumask;
 	}
+	
+	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|l", &arg1) == FAILURE) {
+		RETURN_FALSE;
+	}
 
-	if (arg_count == 0) {
+	if (ZEND_NUM_ARGS() == 0) {
 		umask(oldumask);
 	} else {
-		if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|l", &arg1) == FAILURE) {
-			RETURN_FALSE;
-		}
 		umask(arg1);
 	}
 
@@ -2196,30 +2196,17 @@ PHPAPI void php_fgetcsv(php_stream *stream, char delimiter, char enclosure, char
 		char *comp_end, *hunk_begin;
 
 		tptr = temp;
-
-		/* 1. Strip any leading space */
-		for (;;) {
-			inc_len = (bptr < limit ? (*bptr == '\0' ? 1: php_mblen(bptr, limit - bptr)): 0);
-			switch (inc_len) {
-				case -2:
-				case -1:
-					inc_len = 1;
-					php_mblen(NULL, 0);
-					break;
-				case 0:
-					goto quit_loop_1;
-				case 1:
-					if (!isspace((int)*(unsigned char *)bptr) || *bptr == delimiter) {
-						goto quit_loop_1;
-					}
-					break;
-				default:
-					goto quit_loop_1;
+		inc_len = (bptr < limit ? (*bptr == '\0' ? 1: php_mblen(bptr, limit - bptr)): 0);
+		if (inc_len == 1) {
+			char *tmp = bptr;
+			while (isspace((int)*(unsigned char *)tmp)) {
+				tmp++;
+			}
+			if (*tmp == enclosure) {
+				bptr = tmp;
 			}
-			bptr += inc_len;
 		}
 
-	quit_loop_1:
 		if (first_field && bptr == line_end) {
 			add_next_index_null(return_value);
 			break;
@@ -2618,6 +2605,9 @@ PHP_FUNCTION(fnmatch)
    Returns directory path used for temporary files */
 PHP_FUNCTION(sys_get_temp_dir)
 {
+	if (zend_parse_parameters_none() == FAILURE) {
+		return;
+	}
 	RETURN_STRING((char *)php_get_temporary_directory(), 1);
 }
 /* }}} */
diff --git a/ext/standard/filters.c b/ext/standard/filters.c
index 4ffda5d51..80ce98f34 100644
--- a/ext/standard/filters.c
+++ b/ext/standard/filters.c
@@ -20,7 +20,7 @@
    +----------------------------------------------------------------------+
 */
 
-/* $Id: filters.c 306939 2011-01-01 02:19:59Z felipe $ */
+/* $Id: filters.c 311407 2011-05-24 23:49:26Z felipe $ */
 
 #include "php.h"
 #include "php_globals.h"
@@ -1050,20 +1050,16 @@ static php_conv_err_t php_conv_qprint_decode_convert(php_conv_qprint_decode *ins
 				}
 			} /* break is missing intentionally */
 
-			case 2: {
-				unsigned int nbl;
-	
+			case 2: {	
 				if (icnt <= 0) {
 					goto out;
 				}
-				nbl = (*ps >= 'A' ? *ps - 0x37 : *ps - 0x30);
 
-				if (nbl > 15) {
+				if (!isxdigit((int) *ps)) {
 					err = PHP_CONV_ERR_INVALID_SEQ;
 					goto out;
 				}
-				next_char = (next_char << 4) | nbl;
-
+				next_char = (next_char << 4) | (*ps >= 'A' ? *ps - 0x37 : *ps - 0x30);
 				scan_stat++;
 				ps++, icnt--;
 				if (scan_stat != 3) {
diff --git a/ext/standard/head.c b/ext/standard/head.c
index c29e95490..3ad04b04a 100644
--- a/ext/standard/head.c
+++ b/ext/standard/head.c
@@ -15,7 +15,7 @@
    | Author: Rasmus Lerdorf <rasmus@lerdorf.on.ca>                        |
    +----------------------------------------------------------------------+
  */
-/* $Id: head.c 306939 2011-01-01 02:19:59Z felipe $ */
+/* $Id: head.c 314486 2011-08-08 12:10:27Z iliaa $ */
 
 #include <stdio.h>
 #include "php.h"
@@ -115,10 +115,9 @@ PHPAPI int php_setcookie(char *name, int name_len, char *value, int value_len, t
 		/* 
 		 * MSIE doesn't delete a cookie when you set it to a null value
 		 * so in order to force cookies to be deleted, even on MSIE, we
-		 * pick an expiry date 1 year and 1 second in the past
+		 * pick an expiry date in the past
 		 */
-		time_t t = time(NULL) - 31536001;
-		dt = php_format_date("D, d-M-Y H:i:s T", sizeof("D, d-M-Y H:i:s T")-1, t, 0 TSRMLS_CC);
+		dt = php_format_date("D, d-M-Y H:i:s T", sizeof("D, d-M-Y H:i:s T")-1, 1, 0 TSRMLS_CC);
 		snprintf(cookie, len + 100, "Set-Cookie: %s=deleted; expires=%s", name, dt);
 		efree(dt);
 	} else {
@@ -129,7 +128,7 @@ PHPAPI int php_setcookie(char *name, int name_len, char *value, int value_len, t
 			dt = php_format_date("D, d-M-Y H:i:s T", sizeof("D, d-M-Y H:i:s T")-1, expires, 0 TSRMLS_CC);
 			/* check to make sure that the year does not exceed 4 digits in length */
 			p = zend_memrchr(dt, '-', strlen(dt));
-			if (*(p + 5) != ' ') {
+			if (!p || *(p + 5) != ' ') {
 				efree(dt);
 				efree(cookie);
 				efree(encoded_value);
diff --git a/ext/standard/http_fopen_wrapper.c b/ext/standard/http_fopen_wrapper.c
index 678e711f7..2fd25e0da 100644
--- a/ext/standard/http_fopen_wrapper.c
+++ b/ext/standard/http_fopen_wrapper.c
@@ -19,7 +19,7 @@
    |          Sara Golemon <pollita@php.net>                              |
    +----------------------------------------------------------------------+
  */
-/* $Id: http_fopen_wrapper.c 307815 2011-01-28 10:33:47Z dmitry $ */ 
+/* $Id: http_fopen_wrapper.c 314641 2011-08-09 12:16:58Z laruence $ */ 
 
 #include "php.h"
 #include "php_globals.h"
@@ -330,7 +330,7 @@ finish:
 				scratch_len = strlen(path) + 29 + Z_STRLEN_PP(tmpzval);
 				scratch = emalloc(scratch_len);
 				strlcpy(scratch, Z_STRVAL_PP(tmpzval), Z_STRLEN_PP(tmpzval) + 1);
-				strcat(scratch, " ");
+				strncat(scratch, " ", 1);
 			}
 		}
 	}
@@ -344,7 +344,7 @@ finish:
 	if (!scratch) {
 		scratch_len = strlen(path) + 29 + protocol_version_len;
 		scratch = emalloc(scratch_len);
-		strcpy(scratch, "GET ");
+		strncpy(scratch, "GET ", scratch_len);
 	}
 
 	/* Should we send the entire path in the request line, default to no. */
@@ -545,7 +545,7 @@ finish:
 	/* if the user has configured who they are, send a From: line */
 	{
 		char *from_address = php_ini_string("from", sizeof("from"), 0);
-		if (((have_header & HTTP_HEADER_FROM) == 0) && from_address[0] != '\0') {
+		if (((have_header & HTTP_HEADER_FROM) == 0) && from_address && from_address[0] != '\0') {
 			if (snprintf(scratch, scratch_len, "From: %s\r\n", from_address) > 0)
 				php_stream_write(stream, scratch, strlen(scratch));
 		}
@@ -631,7 +631,6 @@ finish:
 		}
 		php_stream_write(stream, "\r\n", sizeof("\r\n")-1);
 		php_stream_write(stream, Z_STRVAL_PP(tmpzval), Z_STRLEN_PP(tmpzval));
-		php_stream_write(stream, "\r\n\r\n", sizeof("\r\n\r\n")-1);
 	} else {
 		php_stream_write(stream, "\r\n", sizeof("\r\n")-1);
 	}
diff --git a/ext/standard/image.c b/ext/standard/image.c
index 9654ed7e5..fc17ff67e 100644
--- a/ext/standard/image.c
+++ b/ext/standard/image.c
@@ -17,7 +17,7 @@
    +----------------------------------------------------------------------+
  */
 
-/* $Id: image.c 306939 2011-01-01 02:19:59Z felipe $ */
+/* $Id: image.c 310980 2011-05-13 05:06:48Z scottmac $ */
 
 #include "php.h"
 #include <stdio.h>
@@ -51,7 +51,7 @@ PHPAPI const char php_sig_jp2[12] = {(char)0x00, (char)0x00, (char)0x00, (char)0
                                      (char)0x6a, (char)0x50, (char)0x20, (char)0x20,
                                      (char)0x0d, (char)0x0a, (char)0x87, (char)0x0a};
 PHPAPI const char php_sig_iff[4] = {'F','O','R','M'};
-PHPAPI const char php_sig_ico[3] = {(char)0x00, (char)0x00, (char)0x01};
+PHPAPI const char php_sig_ico[4] = {(char)0x00, (char)0x00, (char)0x01, (char)0x00};
 
 /* REMEMBER TO ADD MIME-TYPE TO FUNCTION php_image_type_to_mime_type */
 /* PCX must check first 64bytes and byte 0=0x0a and byte2 < 0x06 */
@@ -1265,7 +1265,7 @@ PHPAPI int php_getimagetype(php_stream * stream, char *filetype TSRMLS_DC)
 		return IMAGE_FILETYPE_TIFF_MM;
 	} else if (!memcmp(filetype, php_sig_iff, 4)) {
 		return IMAGE_FILETYPE_IFF;
-	} else if (!memcmp(filetype, php_sig_ico, 3)) {
+	} else if (!memcmp(filetype, php_sig_ico, 4)) {
 		return IMAGE_FILETYPE_ICO;
 	}
 
diff --git a/ext/standard/info.c b/ext/standard/info.c
index f33e537e9..f7b697773 100644
--- a/ext/standard/info.c
+++ b/ext/standard/info.c
@@ -18,7 +18,7 @@
    +----------------------------------------------------------------------+
 */
 
-/* $Id: info.c 306939 2011-01-01 02:19:59Z felipe $ */
+/* $Id: info.c 313538 2011-07-21 14:49:55Z pajoye $ */
 
 #include "php.h"
 #include "php_ini.h"
@@ -289,7 +289,7 @@ char* php_get_windows_name()
 					major = "Windows Server 2008";
 				}
 			} else
-			if ( osvi.dwMinorVersion == 2 ) {
+			if ( osvi.dwMinorVersion == 1 ) {
 				if( osvi.wProductType == VER_NT_WORKSTATION )  {
 					major = "Windows 7";
 				} else {
diff --git a/ext/standard/link_win32.c b/ext/standard/link_win32.c
index 143b5be4a..37a5fd252 100644
--- a/ext/standard/link_win32.c
+++ b/ext/standard/link_win32.c
@@ -16,7 +16,7 @@
    +----------------------------------------------------------------------+
  */
 
-/* $Id: link_win32.c 306939 2011-01-01 02:19:59Z felipe $ */
+/* $Id: link_win32.c 313176 2011-07-12 15:15:17Z pajoye $ */
 #ifdef PHP_WIN32
 
 #include "php.h"
@@ -69,6 +69,7 @@ PHP_FUNCTION(readlink)
 
 	if (php_sys_readlink(link, target, MAXPATHLEN) == -1) {
 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "readlink failed to read the symbolic link (%s), error %d)", link, GetLastError());
+		RETURN_FALSE;
 	}
 	RETURN_STRING(target, 1);
 }
diff --git a/ext/standard/math.c b/ext/standard/math.c
index 8333fe7c5..b656fafae 100644
--- a/ext/standard/math.c
+++ b/ext/standard/math.c
@@ -13,13 +13,13 @@
    | license@php.net so we can mail you a copy immediately.               |
    +----------------------------------------------------------------------+
    | Authors: Jim Winstead <jimw@php.net>                                 |
-   |          Stig Sæther Bakken <ssb@php.net>                            |
+   |          Stig Sæther Bakken <ssb@php.net>                            |
    |          Zeev Suraski <zeev@zend.com>                                |
    | PHP 4.0 patches by Thies C. Arntzen <thies@thieso.net>               |
    +----------------------------------------------------------------------+
 */
 
-/* $Id: math.c 306939 2011-01-01 02:19:59Z felipe $ */
+/* $Id: math.c 312074 2011-06-12 00:56:18Z cataphract $ */
 
 #include "php.h"
 #include "php_math.h"
@@ -92,6 +92,18 @@ static inline double php_intpow10(int power) {
 }
 /* }}} */
 
+/* {{{ php_math_is_finite */
+static inline int php_math_is_finite(double value) {
+#if defined(PHP_WIN32)
+	return _finite(value);
+#elif defined(isfinite)
+	return isfinite(value);
+#else
+	return value == value && (value == 0. || value * 2. != value);
+#endif
+}
+/* }}} */
+
 /* {{{ php_round_helper
        Actually performs the rounding of a value to integer in a certain mode */
 static inline double php_round_helper(double value, int mode) {
@@ -129,11 +141,11 @@ PHPAPI double _php_math_round(double value, int places, int mode) {
 	double tmp_value;
 	int precision_places;
 
-	if ((precision_places = php_intlog10abs(value)) > 0) {
-		precision_places = 14 - php_intlog10abs(value);
-	} else {
-		precision_places = 14;
+	if (!php_math_is_finite(value)) {
+		return value;
 	}
+	
+	precision_places = 14 - php_intlog10abs(value);
 
 	f1 = php_intpow10(abs(places));
 
diff --git a/ext/standard/php_crypt_r.c b/ext/standard/php_crypt_r.c
index 08c713fe3..a1e0f3229 100644
--- a/ext/standard/php_crypt_r.c
+++ b/ext/standard/php_crypt_r.c
@@ -1,4 +1,4 @@
-/* $Id: php_crypt_r.c 306939 2011-01-01 02:19:59Z felipe $ */
+/* $Id: php_crypt_r.c 314438 2011-08-07 16:10:34Z rasmus $ */
 /*
    +----------------------------------------------------------------------+
    | PHP Version 5                                                        |
@@ -94,7 +94,8 @@ void _crypt_extended_init_r(void)
 	if (!initialized) {
 #ifdef PHP_WIN32
 		InterlockedIncrement(&initialized);
-#elif (defined(__GNUC__) && (__GNUC__ >= 4 && __GNUC_MINOR__ >= 2))
+#elif (defined(__GNUC__) && !defined(__hpux) && (__GNUC__ > 4 || \
+    (__GNUC__ == 4 && (__GNUC_MINOR__ > 1 || (__GNUC_MINOR__ == 1 && __GNUC_PATCHLEVEL__ > 1)))))
 		__sync_fetch_and_add(&initialized, 1);
 #elif defined(HAVE_ATOMIC_H) /* Solaris 10 defines atomic API within */
 		membar_producer();
@@ -197,7 +198,7 @@ char * php_md5_crypt_r(const char *pw, const char *salt, char *out) {
 		goto _destroyCtx1;
 	}
 
-	dwHashLen = pwl + sl + pwl;
+	dwHashLen = 16;
 	CryptGetHashParam(ctx1, HP_HASHVAL, final, &dwHashLen, 0);
 	/*  MD5(pw,salt,pw). Valid. */
 
@@ -381,7 +382,7 @@ char * php_md5_crypt_r(const char *pw, const char *salt, char *out)
 	/* Now make the output string */
 	memcpy(passwd, MD5_MAGIC, MD5_MAGIC_LEN);
 	strlcpy(passwd + MD5_MAGIC_LEN, sp, sl + 1);
-	strcat(passwd, "$");
+	strlcat(passwd, "$", 1);
 
 	PHP_MD5Final(final, &ctx);
 
diff --git a/ext/standard/php_crypt_r.h b/ext/standard/php_crypt_r.h
index 7c73718b2..f153ac322 100644
--- a/ext/standard/php_crypt_r.h
+++ b/ext/standard/php_crypt_r.h
@@ -1,4 +1,4 @@
-/* $Id: php_crypt_r.h 306939 2011-01-01 02:19:59Z felipe $ */
+/* $Id: php_crypt_r.h 313406 2011-07-18 21:26:29Z pajoye $ */
 /*
    +----------------------------------------------------------------------+
    | PHP Version 5                                                        |
@@ -46,9 +46,9 @@ PHPAPI char *php_crypt_r (const char *__key, const char *__salt, struct php_cryp
 
 #define MD5_HASH_MAX_LEN 120
 
+#include "crypt_blowfish.h"
+
 extern char * php_md5_crypt_r(const char *pw, const char *salt, char *out);
-extern char * php_crypt_blowfish_rn(__CONST char *key, __CONST char *setting,
-	char *output, int size);
 extern char * php_sha512_crypt_r (const char *key, const char *salt, char *buffer, int buflen);
 extern char * php_sha256_crypt_r (const char *key, const char *salt, char *buffer, int buflen);
 
diff --git a/ext/standard/proc_open.c b/ext/standard/proc_open.c
index ecf5e35d1..b9411aebc 100644
--- a/ext/standard/proc_open.c
+++ b/ext/standard/proc_open.c
@@ -15,7 +15,7 @@
    | Author: Wez Furlong <wez@thebrainroom.com>                           |
    +----------------------------------------------------------------------+
  */
-/* $Id: proc_open.c 306939 2011-01-01 02:19:59Z felipe $ */
+/* $Id: proc_open.c 314641 2011-08-09 12:16:58Z laruence $ */
 
 #if 0 && (defined(__linux__) || defined(sun) || defined(__IRIX__))
 # define _BSD_SOURCE 		/* linux wants this when XOPEN mode is on */
@@ -183,8 +183,8 @@ static php_process_env_t _php_array_to_envp(zval *environment, int is_persistent
 
 				l = string_length + el_len + 1;
 				memcpy(p, string_key, string_length);
-				strcat(p, "=");
-				strcat(p, data);
+				strncat(p, "=", 1);
+				strncat(p, data, el_len);
 
 #ifndef PHP_WIN32
 				*ep = p;
diff --git a/ext/standard/string.c b/ext/standard/string.c
index a3a3c84e0..9d9e5b3f4 100644
--- a/ext/standard/string.c
+++ b/ext/standard/string.c
@@ -18,7 +18,7 @@
    +----------------------------------------------------------------------+
  */
 
-/* $Id: string.c 306939 2011-01-01 02:19:59Z felipe $ */
+/* $Id: string.c 310401 2011-04-21 01:51:24Z pierrick $ */
 
 /* Synced with php 3.0 revision 1.193 1999-06-16 [ssb] */
 
@@ -2352,20 +2352,35 @@ PHP_FUNCTION(substr_replace)
 
 		zend_hash_internal_pointer_reset_ex(Z_ARRVAL_PP(str), &pos_str);
 		while (zend_hash_get_current_data_ex(Z_ARRVAL_PP(str), (void **) &tmp_str, &pos_str) == SUCCESS) {
-			convert_to_string_ex(tmp_str);
+			zval *orig_str;
+			zval dummy;
+			if(Z_TYPE_PP(tmp_str) != IS_STRING) {
+				dummy = **tmp_str;
+				orig_str = &dummy;
+				zval_copy_ctor(orig_str);
+				convert_to_string(orig_str);
+			} else {
+				orig_str = *tmp_str;
+			}
 
 			if (Z_TYPE_PP(from) == IS_ARRAY) {
 				if (SUCCESS == zend_hash_get_current_data_ex(Z_ARRVAL_PP(from), (void **) &tmp_from, &pos_from)) {
-					convert_to_long_ex(tmp_from);
+					if(Z_TYPE_PP(tmp_from) != IS_LONG) {
+						zval dummy = **tmp_from;
+						zval_copy_ctor(&dummy);
+						convert_to_long(&dummy);
+						f = Z_LVAL(dummy);
+					} else {
+						f = Z_LVAL_PP(tmp_from);
+					}
 
-					f = Z_LVAL_PP(tmp_from);
 					if (f < 0) {
-						f = Z_STRLEN_PP(tmp_str) + f;
+						f = Z_STRLEN_P(orig_str) + f;
 						if (f < 0) {
 							f = 0;
 						}
-					} else if (f > Z_STRLEN_PP(tmp_str)) {
-						f = Z_STRLEN_PP(tmp_str);
+					} else if (f > Z_STRLEN_P(orig_str)) {
+						f = Z_STRLEN_P(orig_str);
 					}
 					zend_hash_move_forward_ex(Z_ARRVAL_PP(from), &pos_from);
 				} else {
@@ -2374,72 +2389,92 @@ PHP_FUNCTION(substr_replace)
 			} else {
 				f = Z_LVAL_PP(from);
 				if (f < 0) {
-					f = Z_STRLEN_PP(tmp_str) + f;
+					f = Z_STRLEN_P(orig_str) + f;
 					if (f < 0) {
 						f = 0;
 					}
-				} else if (f > Z_STRLEN_PP(tmp_str)) {
-					f = Z_STRLEN_PP(tmp_str);
+				} else if (f > Z_STRLEN_P(orig_str)) {
+					f = Z_STRLEN_P(orig_str);
 				}
 			}
 
 			if (argc > 3 && Z_TYPE_PP(len) == IS_ARRAY) {
 				if (SUCCESS == zend_hash_get_current_data_ex(Z_ARRVAL_PP(len), (void **) &tmp_len, &pos_len)) {
-					convert_to_long_ex(tmp_len);
-
-					l = Z_LVAL_PP(tmp_len);
+					if(Z_TYPE_PP(tmp_len) != IS_LONG) {
+						zval dummy = **tmp_len;
+						zval_copy_ctor(&dummy);
+						convert_to_long(&dummy);
+						l = Z_LVAL(dummy);
+					} else {
+						l = Z_LVAL_PP(tmp_len);
+					}
 					zend_hash_move_forward_ex(Z_ARRVAL_PP(len), &pos_len);
 				} else {
-					l = Z_STRLEN_PP(tmp_str);
+					l = Z_STRLEN_P(orig_str);
 				}
 			} else if (argc > 3) { 
 				l = Z_LVAL_PP(len);
 			} else {
-				l = Z_STRLEN_PP(tmp_str);
+				l = Z_STRLEN_P(orig_str);
 			}
 
 			if (l < 0) {
-				l = (Z_STRLEN_PP(tmp_str) - f) + l;
+				l = (Z_STRLEN_P(orig_str) - f) + l;
 				if (l < 0) {
 					l = 0;
 				}
 			}
 
-			if ((f + l) > Z_STRLEN_PP(tmp_str)) {
-				l = Z_STRLEN_PP(tmp_str) - f;
+			if ((f + l) > Z_STRLEN_P(orig_str)) {
+				l = Z_STRLEN_P(orig_str) - f;
 			}
 
-			result_len = Z_STRLEN_PP(tmp_str) - l;
+			result_len = Z_STRLEN_P(orig_str) - l;
 
 			if (Z_TYPE_PP(repl) == IS_ARRAY) {
 				if (SUCCESS == zend_hash_get_current_data_ex(Z_ARRVAL_PP(repl), (void **) &tmp_repl, &pos_repl)) {
-					convert_to_string_ex(tmp_repl);
-					result_len += Z_STRLEN_PP(tmp_repl);
+					zval *repl_str;
+					zval zrepl;
+					if(Z_TYPE_PP(tmp_repl) != IS_STRING) {
+						zrepl = **tmp_repl;
+						repl_str = &zrepl;
+						zval_copy_ctor(repl_str);
+						convert_to_string(repl_str);
+					} else {
+						repl_str = *tmp_repl;
+					}
+
+					result_len += Z_STRLEN_P(repl_str);
 					zend_hash_move_forward_ex(Z_ARRVAL_PP(repl), &pos_repl);	
 					result = emalloc(result_len + 1);
 
-					memcpy(result, Z_STRVAL_PP(tmp_str), f);
-					memcpy((result + f), Z_STRVAL_PP(tmp_repl), Z_STRLEN_PP(tmp_repl));
-					memcpy((result + f + Z_STRLEN_PP(tmp_repl)), Z_STRVAL_PP(tmp_str) + f + l, Z_STRLEN_PP(tmp_str) - f - l);
+					memcpy(result, Z_STRVAL_P(orig_str), f);
+					memcpy((result + f), Z_STRVAL_P(repl_str), Z_STRLEN_P(repl_str));
+					memcpy((result + f + Z_STRLEN_P(repl_str)), Z_STRVAL_P(orig_str) + f + l, Z_STRLEN_P(orig_str) - f - l);
+					if(Z_TYPE_PP(tmp_repl) != IS_STRING) {
+						zval_dtor(repl_str);
+					}
 				} else {
 					result = emalloc(result_len + 1);
 	
-					memcpy(result, Z_STRVAL_PP(tmp_str), f);
-					memcpy((result + f), Z_STRVAL_PP(tmp_str) + f + l, Z_STRLEN_PP(tmp_str) - f - l);
+					memcpy(result, Z_STRVAL_P(orig_str), f);
+					memcpy((result + f), Z_STRVAL_P(orig_str) + f + l, Z_STRLEN_P(orig_str) - f - l);
 				}
 			} else {
 				result_len += Z_STRLEN_PP(repl);
 
 				result = emalloc(result_len + 1);
 
-				memcpy(result, Z_STRVAL_PP(tmp_str), f);
+				memcpy(result, Z_STRVAL_P(orig_str), f);
 				memcpy((result + f), Z_STRVAL_PP(repl), Z_STRLEN_PP(repl));
-				memcpy((result + f + Z_STRLEN_PP(repl)), Z_STRVAL_PP(tmp_str) + f + l, Z_STRLEN_PP(tmp_str) - f - l);
+				memcpy((result + f + Z_STRLEN_PP(repl)), Z_STRVAL_P(orig_str) + f + l, Z_STRLEN_P(orig_str) - f - l);
 			}
 
 			result[result_len] = '\0';
 			add_next_index_stringl(return_value, result, result_len, 0);
-
+			if(Z_TYPE_PP(tmp_str) != IS_STRING) {
+				zval_dtor(orig_str);
+			}
 			zend_hash_move_forward_ex(Z_ARRVAL_PP(str), &pos_str);
 		} /*while*/
 	} /* if */
diff --git a/ext/standard/tests/array/array_shift_variation5.phpt b/ext/standard/tests/array/array_shift_variation5.phpt
index 2ac15da6b..578b870d9 100644
--- a/ext/standard/tests/array/array_shift_variation5.phpt
+++ b/ext/standard/tests/array/array_shift_variation5.phpt
@@ -9,7 +9,7 @@ Test array_shift() function : usage variations - call recursively
 
 /*
  * Use the result of one call to array_shift 
- * as the the $stack argument of another call to array_shift()
+ * as the $stack argument of another call to array_shift()
  * When done in one statement causes strict error messages. 
  */
 
@@ -42,4 +42,4 @@ string(4) "zero"
 
 -- Correct Method: --
 string(4) "zero"
-Done
\ No newline at end of file
+Done
diff --git a/ext/standard/tests/array/bug48484.phpt b/ext/standard/tests/array/bug48484.phpt
index 006c3cc98..0b4afe277 100644
--- a/ext/standard/tests/array/bug48484.phpt
+++ b/ext/standard/tests/array/bug48484.phpt
@@ -6,11 +6,3 @@ var_dump(array_product(array()));
 ?>
 --EXPECT--	
 int(1)
---TEST--
-Bug 48484 (array_product() always returns 0 for an empty array)
---FILE--
-<?php
-var_dump(array_product(array()));
-?>
---EXPECT--	
-int(1)
diff --git a/ext/standard/tests/array/bug54459.phpt b/ext/standard/tests/array/bug54459.phpt
new file mode 100644
index 000000000..e46cfcb14
--- /dev/null
+++ b/ext/standard/tests/array/bug54459.phpt
@@ -0,0 +1,215 @@
+--TEST--
+Bug #54459 (Range function accuracy)
+--INI--
+precision=14
+--FILE--
+<?php
+foreach (range(90, 100, .1) as $i => $v){
+  echo $i, ' = ', $v, PHP_EOL;
+}
+foreach (range("90", "100", .1) as $i => $v){
+  echo $i, ' = ', $v, PHP_EOL;
+}
+--EXPECT--
+0 = 90
+1 = 90.1
+2 = 90.2
+3 = 90.3
+4 = 90.4
+5 = 90.5
+6 = 90.6
+7 = 90.7
+8 = 90.8
+9 = 90.9
+10 = 91
+11 = 91.1
+12 = 91.2
+13 = 91.3
+14 = 91.4
+15 = 91.5
+16 = 91.6
+17 = 91.7
+18 = 91.8
+19 = 91.9
+20 = 92
+21 = 92.1
+22 = 92.2
+23 = 92.3
+24 = 92.4
+25 = 92.5
+26 = 92.6
+27 = 92.7
+28 = 92.8
+29 = 92.9
+30 = 93
+31 = 93.1
+32 = 93.2
+33 = 93.3
+34 = 93.4
+35 = 93.5
+36 = 93.6
+37 = 93.7
+38 = 93.8
+39 = 93.9
+40 = 94
+41 = 94.1
+42 = 94.2
+43 = 94.3
+44 = 94.4
+45 = 94.5
+46 = 94.6
+47 = 94.7
+48 = 94.8
+49 = 94.9
+50 = 95
+51 = 95.1
+52 = 95.2
+53 = 95.3
+54 = 95.4
+55 = 95.5
+56 = 95.6
+57 = 95.7
+58 = 95.8
+59 = 95.9
+60 = 96
+61 = 96.1
+62 = 96.2
+63 = 96.3
+64 = 96.4
+65 = 96.5
+66 = 96.6
+67 = 96.7
+68 = 96.8
+69 = 96.9
+70 = 97
+71 = 97.1
+72 = 97.2
+73 = 97.3
+74 = 97.4
+75 = 97.5
+76 = 97.6
+77 = 97.7
+78 = 97.8
+79 = 97.9
+80 = 98
+81 = 98.1
+82 = 98.2
+83 = 98.3
+84 = 98.4
+85 = 98.5
+86 = 98.6
+87 = 98.7
+88 = 98.8
+89 = 98.9
+90 = 99
+91 = 99.1
+92 = 99.2
+93 = 99.3
+94 = 99.4
+95 = 99.5
+96 = 99.6
+97 = 99.7
+98 = 99.8
+99 = 99.9
+100 = 100
+0 = 90
+1 = 90.1
+2 = 90.2
+3 = 90.3
+4 = 90.4
+5 = 90.5
+6 = 90.6
+7 = 90.7
+8 = 90.8
+9 = 90.9
+10 = 91
+11 = 91.1
+12 = 91.2
+13 = 91.3
+14 = 91.4
+15 = 91.5
+16 = 91.6
+17 = 91.7
+18 = 91.8
+19 = 91.9
+20 = 92
+21 = 92.1
+22 = 92.2
+23 = 92.3
+24 = 92.4
+25 = 92.5
+26 = 92.6
+27 = 92.7
+28 = 92.8
+29 = 92.9
+30 = 93
+31 = 93.1
+32 = 93.2
+33 = 93.3
+34 = 93.4
+35 = 93.5
+36 = 93.6
+37 = 93.7
+38 = 93.8
+39 = 93.9
+40 = 94
+41 = 94.1
+42 = 94.2
+43 = 94.3
+44 = 94.4
+45 = 94.5
+46 = 94.6
+47 = 94.7
+48 = 94.8
+49 = 94.9
+50 = 95
+51 = 95.1
+52 = 95.2
+53 = 95.3
+54 = 95.4
+55 = 95.5
+56 = 95.6
+57 = 95.7
+58 = 95.8
+59 = 95.9
+60 = 96
+61 = 96.1
+62 = 96.2
+63 = 96.3
+64 = 96.4
+65 = 96.5
+66 = 96.6
+67 = 96.7
+68 = 96.8
+69 = 96.9
+70 = 97
+71 = 97.1
+72 = 97.2
+73 = 97.3
+74 = 97.4
+75 = 97.5
+76 = 97.6
+77 = 97.7
+78 = 97.8
+79 = 97.9
+80 = 98
+81 = 98.1
+82 = 98.2
+83 = 98.3
+84 = 98.4
+85 = 98.5
+86 = 98.6
+87 = 98.7
+88 = 98.8
+89 = 98.9
+90 = 99
+91 = 99.1
+92 = 99.2
+93 = 99.3
+94 = 99.4
+95 = 99.5
+96 = 99.6
+97 = 99.7
+98 = 99.8
+99 = 99.9
+100 = 100
diff --git a/ext/standard/tests/class_object/is_subclass_of_variation_001.phpt b/ext/standard/tests/class_object/is_subclass_of_variation_001.phpt
index f11183d48..14aaa3347 100644
--- a/ext/standard/tests/class_object/is_subclass_of_variation_001.phpt
+++ b/ext/standard/tests/class_object/is_subclass_of_variation_001.phpt
@@ -150,21 +150,17 @@ Arg value
 bool(false)
 
 Arg value  
-Error: 2 - Unknown class passed as parameter, %s(79)
 bool(false)
 
 Arg value  
-Error: 2 - Unknown class passed as parameter, %s(79)
 bool(false)
 
 Arg value string 
 In __autoload(string)
-Error: 2 - Unknown class passed as parameter, %s(79)
 bool(false)
 
 Arg value String 
 In __autoload(String)
-Error: 2 - Unknown class passed as parameter, %s(79)
 bool(false)
 
 Arg value  
diff --git a/ext/standard/tests/class_object/is_subclass_of_variation_004.phpt b/ext/standard/tests/class_object/is_subclass_of_variation_004.phpt
index 72a02a0b2..2f46c4a8d 100644
--- a/ext/standard/tests/class_object/is_subclass_of_variation_004.phpt
+++ b/ext/standard/tests/class_object/is_subclass_of_variation_004.phpt
@@ -150,21 +150,17 @@ Arg value
 bool(false)
 
 Arg value  
-Error: 2 - Unknown class passed as parameter, %s(79)
 bool(false)
 
 Arg value  
-Error: 2 - Unknown class passed as parameter, %s(79)
 bool(false)
 
 Arg value string 
 In __autoload(string)
-Error: 2 - Unknown class passed as parameter, %s(79)
 bool(false)
 
 Arg value String 
 In __autoload(String)
-Error: 2 - Unknown class passed as parameter, %s(79)
 bool(false)
 
 Arg value  
diff --git a/ext/standard/tests/file/001.phpt b/ext/standard/tests/file/001.phpt
index e3768b19d..d604699ac 100644
--- a/ext/standard/tests/file/001.phpt
+++ b/ext/standard/tests/file/001.phpt
@@ -5,6 +5,7 @@ File type functions
 if (substr(PHP_OS, 0, 3) == 'WIN') {
     die('skip no symlinks on Windows');
 }
+if (getenv("SKIP_SLOW_TESTS")) die("skip slow test");
 ?>
 --FILE--
 <?php
diff --git a/ext/standard/tests/file/005_variation.phpt b/ext/standard/tests/file/005_variation.phpt
index e46df865f..7e5eedc2b 100644
--- a/ext/standard/tests/file/005_variation.phpt
+++ b/ext/standard/tests/file/005_variation.phpt
@@ -5,6 +5,9 @@ Test fileatime(), filemtime(), filectime() & touch() functions : usage variation
 if (substr(PHP_OS, 0, 3) == 'WIN') {
     die('skip Do not run on Windows');
 }
+if (getenv("SKIP_SLOW_TESTS")) {
+    die("skip slow test");
+}
 ?>
 --FILE--
 <?php
diff --git a/ext/standard/tests/file/005_variation2.phpt b/ext/standard/tests/file/005_variation2.phpt
index d70ce1251..d14a9bddd 100644
--- a/ext/standard/tests/file/005_variation2.phpt
+++ b/ext/standard/tests/file/005_variation2.phpt
@@ -49,11 +49,17 @@ function stat_fn( $filename ) {
 
 echo "*** Testing fileattime(), filemtime(), filectime() & touch() : usage variations ***\n";
 echo "\n*** testing touch ***\n";
-var_dump(touch(NULL));
-var_dump(touch(false));
-var_dump(touch(''));
-var_dump(touch(' '));
-var_dump(touch('|'));
+$a = touch(NULL);
+$b = touch(false);
+$c = touch('');
+$d = touch(' ');
+$e = touch('|');
+
+var_dump($a);
+var_dump($b);
+var_dump($c);
+var_dump($d);
+var_dump($e);
 
 echo "\n*** testing file info ***";
 stat_fn(NULL);
@@ -72,13 +78,13 @@ echo "Done";
 
 *** testing touch ***
 
-Warning: touch(): Unable to create file  because %s in %s on line %d
-bool(false)
+Warning: touch(): Unable to create file  because No such file or directory in %s on line %d
 
-Warning: touch(): Unable to create file  because %s in %s on line %d
-bool(false)
+Warning: touch(): Unable to create file  because No such file or directory in %s on line %d
 
-Warning: touch(): Unable to create file  because %s in %s on line %d
+Warning: touch(): Unable to create file  because No such file or directory in %s on line %d
+bool(false)
+bool(false)
 bool(false)
 bool(true)
 bool(true)
diff --git a/ext/standard/tests/file/bug39863.phpt b/ext/standard/tests/file/bug39863.phpt
index 520a46412..6913655ee 100644
--- a/ext/standard/tests/file/bug39863.phpt
+++ b/ext/standard/tests/file/bug39863.phpt
@@ -16,8 +16,6 @@ else {
 ?>
 ===DONE===
 <?php exit(0); ?>
---XFAIL--
-Needs bug #39863 fixed
 --EXPECT--
 PASS
 ===DONE===
diff --git a/ext/standard/tests/file/bug53848.phpt b/ext/standard/tests/file/bug53848.phpt
new file mode 100644
index 000000000..016d59d0c
--- /dev/null
+++ b/ext/standard/tests/file/bug53848.phpt
@@ -0,0 +1,25 @@
+--TEST--
+Bug #53848 (fgetcsv removes leading spaces from fields)
+--FILE--
+<?php
+$file = dirname(__FILE__) . "/bug39538.csv";
+@unlink($file);
+file_put_contents($file, "a,b\n  c,  d");
+$fp = fopen($file, "r");
+while ($l = fgetcsv($fp)) var_dump($l);
+fclose($fp);
+@unlink($file);
+?>
+--EXPECT--
+array(2) {
+  [0]=>
+  string(1) "a"
+  [1]=>
+  string(1) "b"
+}
+array(2) {
+  [0]=>
+  string(3) "  c"
+  [1]=>
+  string(3) "  d"
+}
diff --git a/ext/standard/tests/file/copy_variation4.phpt b/ext/standard/tests/file/copy_variation4.phpt
index 32756c1ed..0a965fd54 100644
--- a/ext/standard/tests/file/copy_variation4.phpt
+++ b/ext/standard/tests/file/copy_variation4.phpt
diff --git a/ext/standard/tests/file/file_put_contents_variation8.phpt b/ext/standard/tests/file/file_put_contents_variation8.phpt
index c35ace47b..79586ada2 100644
--- a/ext/standard/tests/file/file_put_contents_variation8.phpt
+++ b/ext/standard/tests/file/file_put_contents_variation8.phpt
diff --git a/ext/standard/tests/file/fread_socket_variation1.phpt b/ext/standard/tests/file/fread_socket_variation1.phpt
index bd3d23ac5..50ee79bbf 100644
--- a/ext/standard/tests/file/fread_socket_variation1.phpt
+++ b/ext/standard/tests/file/fread_socket_variation1.phpt
@@ -1,5 +1,9 @@
 --TEST--
 Testing fread() on a TCP server socket
+--SKIPIF--
+<?php
+if (getenv("SKIP_SLOW_TESTS")) die("skip slow test");
+?>
 --FILE--
 <?php
 
diff --git a/ext/standard/tests/file/fscanf_variation39.phpt b/ext/standard/tests/file/fscanf_variation39.phpt
index f0d406c58..1b17015bc 100644
--- a/ext/standard/tests/file/fscanf_variation39.phpt
+++ b/ext/standard/tests/file/fscanf_variation39.phpt
@@ -1,5 +1,11 @@
 --TEST--
 Test fscanf() function: usage variations - unsigned int formats with integer values 
+--SKIPIF--
+<?php
+if (PHP_INT_SIZE != 4) {
+	die("skip this test is for 32bit platform only");
+}
+?>
 --FILE--
 <?php
 
diff --git a/ext/standard/tests/file/fscanf_variation55.phpt b/ext/standard/tests/file/fscanf_variation55.phpt
index 9b02d136d..1777f797b 100644
--- a/ext/standard/tests/file/fscanf_variation55.phpt
+++ b/ext/standard/tests/file/fscanf_variation55.phpt
@@ -1,5 +1,11 @@
 --TEST--
 Test fscanf() function: usage variations - tracking file pointer while reading 
+--SKIPIF--
+<?php
+if (PHP_INT_SIZE != 4) {
+	die("skip this test is for 32bit platform only");
+}
+?>
 --FILE--
 <?php
 
diff --git a/ext/standard/tests/file/lstat_stat_variation9.phpt b/ext/standard/tests/file/lstat_stat_variation9.phpt
index b3c1281e6..63c6ff8a7 100644
--- a/ext/standard/tests/file/lstat_stat_variation9.phpt
+++ b/ext/standard/tests/file/lstat_stat_variation9.phpt
@@ -36,7 +36,7 @@ fclose($file_handle);
 
 $old_stat = stat($dirname);
 
-/* now delete teh surdir and file and record the stat */
+/* now delete the surdir and file and record the stat */
 unlink("$dirname/lstat_stat_variation9a.tmp");
 rmdir("$dirname/lstat_stat_variation9_subdir");
 
diff --git a/ext/standard/tests/file/readfile_variation10.phpt b/ext/standard/tests/file/readfile_variation10.phpt
index 2caa2de1d..76f1d2dbf 100644
--- a/ext/standard/tests/file/readfile_variation10.phpt
+++ b/ext/standard/tests/file/readfile_variation10.phpt
diff --git a/ext/standard/tests/filters/bug50363.phpt b/ext/standard/tests/filters/bug50363.phpt
new file mode 100644
index 000000000..3395edebc
--- /dev/null
+++ b/ext/standard/tests/filters/bug50363.phpt
@@ -0,0 +1,17 @@
+--TEST--
+Bug #50363 (Invalid parsing in convert.quoted-printable-decode filter)
+--FILE--
+<?php
+
+$foo = "Sauvegarder=C3=A9ussi(e) n=C3=A3o N=C3=83O\n";
+$foo .= "Sauvegarder=c3=a9ussi(e) n=c3=a3o N=c3=83O\n"; // Does not work!
+$b = fopen('php://temp', 'w+');
+stream_filter_append($b, 'convert.quoted-printable-decode', STREAM_FILTER_WRITE);
+fwrite($b, $foo);
+rewind($b);
+fpassthru($b);
+
+?>
+--EXPECTF--
+Sauvegarderéussi(e) não NÃO
+Sauvegarderéussi(e) não NÃO
diff --git a/ext/standard/tests/general_functions/ini_get_all.phpt b/ext/standard/tests/general_functions/ini_get_all.phpt
index a13b0a475..60cd38a72 100644
--- a/ext/standard/tests/general_functions/ini_get_all.phpt
+++ b/ext/standard/tests/general_functions/ini_get_all.phpt
@@ -1,7 +1,7 @@
 --TEST--
 ini_get_all() tests
 --INI--
-pcre.backtrack_limit=100000
+pcre.backtrack_limit=1000000
 pcre.recursion_limit=100000
 --SKIPIF--
 <?php if (!extension_loaded("reflection")) die("skip"); ?>
@@ -34,9 +34,9 @@ array(2) {
   ["pcre.backtrack_limit"]=>
   array(3) {
     ["global_value"]=>
-    string(6) "100000"
+    string(7) "1000000"
     ["local_value"]=>
-    string(6) "100000"
+    string(7) "1000000"
     ["access"]=>
     int(7)
   }
@@ -52,7 +52,7 @@ array(2) {
 }
 array(2) {
   ["pcre.backtrack_limit"]=>
-  string(6) "100000"
+  string(7) "1000000"
   ["pcre.recursion_limit"]=>
   string(6) "100000"
 }
diff --git a/ext/standard/tests/general_functions/proc_open02.phpt b/ext/standard/tests/general_functions/proc_open02.phpt
index 3cba15e9a..3406f6806 100644
--- a/ext/standard/tests/general_functions/proc_open02.phpt
+++ b/ext/standard/tests/general_functions/proc_open02.phpt
@@ -4,6 +4,7 @@ proc_open
 <?php
 if (!is_executable('/bin/sleep')) echo 'skip no sleep';
 if (!is_executable('/usr/bin/nohup')) echo 'skip no nohup';
+if (getenv('SKIP_SLOW_TESTS')) echo 'skip slow test';
 ?>
 --FILE--
 <?php
diff --git a/ext/standard/tests/general_functions/var_export_basic9.phpt b/ext/standard/tests/general_functions/var_export_basic9.phpt
new file mode 100644
index 000000000..3c9706edf
--- /dev/null
+++ b/ext/standard/tests/general_functions/var_export_basic9.phpt
@@ -0,0 +1,11 @@
+--TEST--
+Bug #55082: var_export() doesn't escape properties properly
+--FILE--
+<?php
+	$x = new stdClass();
+	$x->{'\'\\'} = 7;
+	echo var_export($x);
+--EXPECT--
+stdClass::__set_state(array(
+   '\'\\' => 7,
+))
diff --git a/ext/standard/tests/math/mt_rand_variation1.phpt b/ext/standard/tests/math/mt_rand_variation1.phpt
index f2ba9bc34..aa4371611 100644
--- a/ext/standard/tests/math/mt_rand_variation1.phpt
+++ b/ext/standard/tests/math/mt_rand_variation1.phpt
@@ -38,7 +38,7 @@ $inputs = array(
        // float data
 /*6*/  10.5,
        -10.5,
-       12.3456789000e10,
+       12.3456789000E8,
        12.3456789000E-10,
        .5,
 
@@ -79,7 +79,7 @@ $inputs = array(
 $iterator = 1;
 foreach($inputs as $input) {
 	echo "\n-- Iteration $iterator --\n";
-	var_dump(mt_rand($input, 100));
+	var_dump(mt_rand($input, mt_getrandmax()));
 	$iterator++;
 };
 fclose($fp);
diff --git a/ext/standard/tests/math/mt_rand_variation2.phpt b/ext/standard/tests/math/mt_rand_variation2.phpt
index 28b2304a3..2174a349e 100644
--- a/ext/standard/tests/math/mt_rand_variation2.phpt
+++ b/ext/standard/tests/math/mt_rand_variation2.phpt
@@ -79,7 +79,7 @@ $inputs = array(
 $iterator = 1;
 foreach($inputs as $input) {
 	echo "\n-- Iteration $iterator --\n";
-	var_dump(mt_rand(100, $input));
+	var_dump(mt_rand(-1 * mt_getrandmax(), $input));
 	$iterator++;
 };
 fclose($fp);
diff --git a/ext/standard/tests/misc/time_nanosleep_basic.phpt b/ext/standard/tests/misc/time_nanosleep_basic.phpt
index 799c57209..3f20b00f7 100644
--- a/ext/standard/tests/misc/time_nanosleep_basic.phpt
+++ b/ext/standard/tests/misc/time_nanosleep_basic.phpt
@@ -1,7 +1,9 @@
 --TEST--
 time_nanosleep — Delay for a number of seconds and nanoseconds
 --SKIPIF--
-<?php if (!function_exists('time_nanosleep')) die("skip"); ?>
+<?php if (!function_exists('time_nanosleep')) die("skip");
+if (getenv("SKIP_SLOW_TESTS")) die("skip slow test");
+?>
 --CREDITS--
 Àlex Corretgé - alex@corretge.cat
 --FILE--
diff --git a/ext/standard/tests/network/gethostbynamel_error.phpt b/ext/standard/tests/network/gethostbynamel_error.phpt
index 4a13bf021..7aa00e537 100644
--- a/ext/standard/tests/network/gethostbynamel_error.phpt
+++ b/ext/standard/tests/network/gethostbynamel_error.phpt
@@ -19,11 +19,6 @@ echo "\n-- Testing gethostbynamel() function with more than expected no. of argu
 $hostname = 'string_val';
 $extra_arg = 10;
 var_dump( gethostbynamel($hostname, $extra_arg) );
-
-echo "\n-- Testing gethostbynamel() with an unknown host --\n";
-$hostname = 'unknownhost_zzz_xxx_yyy.';
-var_dump( gethostbynamel($hostname) );
-
 echo "Done";
 ?>
 --EXPECTF--
@@ -38,7 +33,4 @@ NULL
 
 Warning: gethostbynamel() expects exactly 1 parameter, 2 given in %s on line %d
 NULL
-
--- Testing gethostbynamel() with an unknown host --
-bool(false)
 Done
diff --git a/ext/standard/tests/php_ini_loaded_file.phpt b/ext/standard/tests/php_ini_loaded_file.phpt
index b443c5f70..7958eb127 100644
--- a/ext/standard/tests/php_ini_loaded_file.phpt
+++ b/ext/standard/tests/php_ini_loaded_file.phpt
@@ -1,9 +1,11 @@
 --TEST--
-Check the php_ini_loaded_file() function. No file is loaded in test, so false ins returned
+Check the php_ini_loaded_file() function
 --CREDITS--
 Sebastian Schürmann
 sschuermann@chip.de
 Testfest 2009 Munich
+--INI--
+precision=12
 --FILE--
 <?php
 var_dump(php_ini_loaded_file());
diff --git a/ext/standard/tests/serialize/001.phpt b/ext/standard/tests/serialize/001.phpt
index 21a2d6c53..600c9b706 100644
--- a/ext/standard/tests/serialize/001.phpt
+++ b/ext/standard/tests/serialize/001.phpt
@@ -1,5 +1,7 @@
 --TEST--
 serialize()/unserialize()/var_dump()
+--INI--
+serialize_precision=100
 --FILE--
 <?php 
 class t
diff --git a/ext/standard/tests/serialize/serialization_arrays_001.phpt b/ext/standard/tests/serialize/serialization_arrays_001.phpt
index ff5f34c5b..51acfc4b4 100644
--- a/ext/standard/tests/serialize/serialization_arrays_001.phpt
+++ b/ext/standard/tests/serialize/serialization_arrays_001.phpt
@@ -1,5 +1,7 @@
 --TEST--
 Test serialize() & unserialize() functions: arrays (circular references)
+--INI--
+serialize_precision=100
 --FILE--
 <?php 
 /* Prototype  : proto string serialize(mixed variable)
diff --git a/ext/standard/tests/serialize/serialization_miscTypes_001.phpt b/ext/standard/tests/serialize/serialization_miscTypes_001.phpt
index 276913524..038068249 100644
--- a/ext/standard/tests/serialize/serialization_miscTypes_001.phpt
+++ b/ext/standard/tests/serialize/serialization_miscTypes_001.phpt
diff --git a/ext/standard/tests/serialize/serialization_objects_001.phpt b/ext/standard/tests/serialize/serialization_objects_001.phpt
index aafb26629..f85b89e10 100644
--- a/ext/standard/tests/serialize/serialization_objects_001.phpt
+++ b/ext/standard/tests/serialize/serialization_objects_001.phpt
diff --git a/ext/standard/tests/serialize/serialization_objects_002.phpt b/ext/standard/tests/serialize/serialization_objects_002.phpt
index 95c2dfb68..fbd9e2612 100644
--- a/ext/standard/tests/serialize/serialization_objects_002.phpt
+++ b/ext/standard/tests/serialize/serialization_objects_002.phpt
diff --git a/ext/standard/tests/serialize/serialization_objects_003.phpt b/ext/standard/tests/serialize/serialization_objects_003.phpt
index c20590b79..2313ffab8 100644
--- a/ext/standard/tests/serialize/serialization_objects_003.phpt
+++ b/ext/standard/tests/serialize/serialization_objects_003.phpt
@@ -1,5 +1,7 @@
 --TEST--
 Test serialize() & unserialize() functions: objects (abstract classes)
+--INI--
+serialize_precision=100
 --FILE--
 <?php 
 /* Prototype  : proto string serialize(mixed variable)
@@ -64,4 +66,4 @@ object(extendName)#%d (3) {
 string(18) "s:10:"extendName";"
 string(10) "extendName"
 
-Done
\ No newline at end of file
+Done
diff --git a/ext/standard/tests/streams/bug54623.phpt b/ext/standard/tests/streams/bug54623.phpt
new file mode 100644
index 000000000..cd83854f4
--- /dev/null
+++ b/ext/standard/tests/streams/bug54623.phpt
@@ -0,0 +1,17 @@
+--TEST--
+Bug #54623: Segfault when when writing to a persistent socket after closing a copy of the socket
+--FILE--
+<?php
+$sock = pfsockopen('udp://127.0.0.1', '63844');
+var_dump((int)$sock);
+fwrite($sock, "1");
+$sock2 = pfsockopen('udp://127.0.0.1', '63844');
+var_dump((int)$sock2);
+fwrite($sock2, "2");
+fclose($sock2);
+fwrite($sock, "3");
+--EXPECTF--
+int(%d)
+int(%d)
+
+Warning: fwrite(): %d is not a valid stream resource in %s on line %d
diff --git a/ext/standard/tests/streams/bug54946.phpt b/ext/standard/tests/streams/bug54946.phpt
new file mode 100644
index 000000000..b3fa73df5
--- /dev/null
+++ b/ext/standard/tests/streams/bug54946.phpt
@@ -0,0 +1,40 @@
+--TEST--
+Bug#54946 stream_get_contents infinite loop
+--FILE--
+<?php
+$filename = tempnam(sys_get_temp_dir(), "phpbug");
+
+$stream = fopen($filename, "w"); // w or a
+$retval = stream_get_contents($stream, 1, 1);
+
+var_dump($retval);
+unlink($filename);
+
+
+
+$filename = tempnam(sys_get_temp_dir(), "phpbug2");
+
+$stream = fopen($filename, "a");
+$retval = stream_get_contents($stream, 1, 1);
+
+var_dump($retval);
+unlink($filename);
+
+
+
+$filename = tempnam(sys_get_temp_dir(), "phpbug3");
+
+$stream = fopen($filename, "a");
+fseek($stream, 1);
+$retval = stream_get_contents($stream, 1);
+
+var_dump($retval);
+unlink($filename);
+?>
+===DONE===
+--EXPECT--
+string(0) ""
+string(0) ""
+string(0) ""
+===DONE===
+
diff --git a/ext/standard/tests/strings/006.phpt b/ext/standard/tests/strings/006.phpt
index fdfd58c02..afb5d24db 100644
--- a/ext/standard/tests/strings/006.phpt
+++ b/ext/standard/tests/strings/006.phpt
@@ -1,7 +1,5 @@
 --TEST--
 highlight_file() and output buffer
---SKIPIF--
-<?php if( substr(PHP_OS, 0, 3) == "WIN") die('skip Non windows test');?>
 --INI--
 log_errors_max_len=4096
 --FILE--
diff --git a/ext/standard/tests/strings/bug54238.phpt b/ext/standard/tests/strings/bug54238.phpt
new file mode 100644
index 000000000..0f60098ff
--- /dev/null
+++ b/ext/standard/tests/strings/bug54238.phpt
@@ -0,0 +1,25 @@
+--TEST--
+Bug #54238 (use-after-free in substr_replace())
+--INI--
+error_reporting=E_ALL&~E_NOTICE
+--FILE--
+<?php
+$f = array(array('A', 'A'));
+
+$z = substr_replace($f, $f, $f, 1);
+var_dump($z, $f);
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  string(9) "AArrayray"
+}
+array(1) {
+  [0]=>
+  array(2) {
+    [0]=>
+    string(1) "A"
+    [1]=>
+    string(1) "A"
+  }
+}
diff --git a/ext/standard/tests/strings/006-win32.phpt b/ext/standard/tests/strings/bug54332.phpt
index b78fc1ada..122b387ec 100644
--- a/ext/standard/tests/strings/006-win32.phpt
+++ b/ext/standard/tests/strings/bug54332.phpt
@@ -1,23 +1,8 @@
 --TEST--
-highlight_file() and output buffer
---SKIPIF--
-<?php if( substr(PHP_OS, 0, 3) != "WIN") die('skip Windows only test');?>
---INI--
-log_errors_max_len=4096
+Bug #54332 (Crash in zend_mm_check_ptr // Heap corruption)
 --FILE--
 <?php
-
-$file = str_repeat("A", 1024);
-
-var_dump(highlight_file($file, true));
-var_dump(ob_get_contents());
-
+echo number_format(1e300, 2006, '', ' ') . "\n";
 ?>
-===DONE===
---EXPECTF--
-Warning: highlight_file(AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA): failed to open stream: No such file or directory in %s on line %d
-
-Warning: highlight_file(): Failed opening 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA' for highlighting in %s on line %d
-bool(false)
-bool(false)
-===DONE===
+--EXPECT--
+1 000 000 000 000 000 052 504 760 255 204 420 248 704 468 581 108 159 154 915 854 115 511 802 457 988 908 195 786 371 375 080 447 864 043 704 443 832 883 878 176 942 523 235 360 430 575 644 792 184 786 706 982 848 387 200 926 575 803 737 830 233 794 788 090 059 368 953 234 970 799 945 081 119 038 967 640 880 074 652 742 780 142 494 579 258 788 820 056 842 838 115 669 472 196 386 865 459 400 540 16000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
diff --git a/ext/standard/tests/strings/bug54721.phpt b/ext/standard/tests/strings/bug54721.phpt
new file mode 100644
index 000000000..3851df154
--- /dev/null
+++ b/ext/standard/tests/strings/bug54721.phpt
@@ -0,0 +1,20 @@
+--TEST--
+Bug #54721 (Different Hashes on Windows, BSD and Linux on wrong Salt size)
+--FILE--
+<?php 
+echo crypt("", '$1$dW0.is5.$10CH101gGOr1677ZYd517.') . "\n";
+echo crypt("b", '$1$dW0.is5.$10CH101gGOr1677ZYd517.') . "\n";
+echo crypt("bu", '$1$dW0.is5.$10CH101gGOr1677ZYd517.') . "\n";
+echo crypt("bug", '$1$dW0.is5.$10CH101gGOr1677ZYd517.') . "\n";
+echo crypt("pass", '$1$dW0.is5.$10CH101gGOr1677ZYd517.') . "\n";
+echo crypt("buged", '$1$dW0.is5.$10CH101gGOr1677ZYd517.') . "\n";
+echo crypt("aaaaaaaaaaaaaaaaaaaaaaaaa ", '$1$dW0.is5.$10CH101gGOr1677ZYd517.') . "\n";
+?>
+--EXPECT--
+$1$dW0.is5.$I0iqTYHPzkP4YnRgnXxZW0
+$1$dW0.is5.$KaspRpPQ9U7Xb5Vv5c.WE/
+$1$dW0.is5.$X9G1x/Ep8zYQSrU4/lKUg.
+$1$dW0.is5.$wE5Rz/HxPtDMfqil6kK980
+$1$dW0.is5.$2E4/ZDY1vr73HqLl1bLs9.
+$1$dW0.is5.$lvGhphTQwqgKxWhWwYERr1
+$1$dW0.is5.$XzsWcLSBj2BvhOKH0xdpZ0
diff --git a/ext/standard/tests/strings/crypt_blowfish.phpt b/ext/standard/tests/strings/crypt_blowfish.phpt
new file mode 100644
index 000000000..cce09c151
--- /dev/null
+++ b/ext/standard/tests/strings/crypt_blowfish.phpt
@@ -0,0 +1,50 @@
+--TEST--
+Official blowfish tests (http://cvsweb.openwall.com/cgi/cvsweb.cgi/Owl/packages/glibc/crypt_blowfish/wrapper.c)
+--SKIPIF--
+<?php
+if (!function_exists('crypt') || !defined("CRYPT_BLOWFISH")) {
+    die("SKIP crypt()-blowfish is not available");
+}
+?>
+--FILE--
+<?php
+
+$tests =array(
+	array('$2a$05$CCCCCCCCCCCCCCCCCCCCC.E5YPO9kmyuRGyh0XouQYb4YMJKvyOeW', 'U*U'),
+	array('$2a$05$CCCCCCCCCCCCCCCCCCCCC.VGOzA784oUp/Z0DY336zx7pLYAy0lwK', 'U*U*'),
+	array('$2a$05$XXXXXXXXXXXXXXXXXXXXXOAcXxm9kjPGEMsLznoKqmqw7tc8WCx4a', 'U*U*U'),
+	array('$2a$05$abcdefghijklmnopqrstuu5s2v8.iXieOjg/.AySBTTZIIVFJeBui', '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789chars after 72 are ignored'),
+	array('$2x$05$/OK.fbVrR/bpIqNJ5ianF.CE5elHaaO4EbggVDjb8P19RukzXSM3e', "\xa3"),
+	array('$2a$05$/OK.fbVrR/bpIqNJ5ianF.Sa7shbm4.OzKpvFnX1pQLmQW96oUlCq', "\xa3"),
+	array('$2x$05$6bNw2HLQYeqHYyBfLMsv/OiwqTymGIGzFsA4hOTWebfehXHNprcAS', "\xd1\x91"),
+	array('$2x$05$6bNw2HLQYeqHYyBfLMsv/O9LIGgn8OMzuDoHfof8AQimSGfcSWxnS', "\xd0\xc1\xd2\xcf\xcc\xd8"),
+	array('$2a$05$/OK.fbVrR/bpIqNJ5ianF.swQOIzjOiJ9GHEPuhEkvqrUyvWhEMx6', "\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaa\xaachars after 72 are ignored as usual"),
+	array('$2a$05$/OK.fbVrR/bpIqNJ5ianF.R9xrDjiycxMbQE2bp.vgqlYpW5wx2yy', "\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55\xaa\x55"),
+	array('$2a$05$/OK.fbVrR/bpIqNJ5ianF.9tQZzcJfm3uj2NvJ/n5xkhpqLrMpWCe', "\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff\x55\xaa\xff"),
+	 array('$2a$05$CCCCCCCCCCCCCCCCCCCCC.7uG0VCzI2bS7j6ymqJi9CdcdxiRTWNy', ''),
+
+);
+$i=0;
+foreach($tests as $test) {
+  if(crypt($test[1], $test[0]) == $test[0]) {
+    echo "$i. OK\n";
+  } else {
+    echo "$i. Not OK: $test[0] ".crypt($test[1], $test[0])."\n";
+  }
+  $i++;
+}
+
+?>
+--EXPECT--
+0. OK
+1. OK
+2. OK
+3. OK
+4. OK
+5. OK
+6. OK
+7. OK
+8. OK
+9. OK
+10. OK
+11. OK
\ No newline at end of file
diff --git a/ext/standard/tests/strings/crypt_variation1.phpt b/ext/standard/tests/strings/crypt_variation1.phpt
new file mode 100644
index 000000000..6e0d3fe12
--- /dev/null
+++ b/ext/standard/tests/strings/crypt_variation1.phpt
@@ -0,0 +1,23 @@
+--TEST--
+crypt() function - long salt
+--SKIPIF--
+<?php
+if (!function_exists('crypt')) {
+	die("SKIP crypt() is not available");
+}
+?> 
+--FILE--
+<?php
+
+$b = str_repeat("A", 124);
+echo crypt("A", "$5$" . $b)."\n";
+$b = str_repeat("A", 125);
+echo crypt("A", "$5$" . $b)."\n";
+$b = str_repeat("A", 4096);
+echo crypt("A", "$5$" . $b)."\n";
+
+?>
+--EXPECTF--
+$5$AAAAAAAAAAAAAAAA$frotiiztWZiwcncxnY5tWG9Ida2WOZEximjLXCleQu6
+$5$AAAAAAAAAAAAAAAA$frotiiztWZiwcncxnY5tWG9Ida2WOZEximjLXCleQu6
+$5$AAAAAAAAAAAAAAAA$frotiiztWZiwcncxnY5tWG9Ida2WOZEximjLXCleQu6
diff --git a/ext/standard/tests/strings/htmlentities_html4.phpt b/ext/standard/tests/strings/htmlentities_html4.phpt
index 3f700e828..d7bff707f 100644
--- a/ext/standard/tests/strings/htmlentities_html4.phpt
+++ b/ext/standard/tests/strings/htmlentities_html4.phpt
@@ -1,5 +1,9 @@
 --TEST--
 htmlentities() conformance check (HTML 4)
+--SKIPIF--
+<?php
+if (getenv("SKIP_SLOW_TESTS")) die("skip slow test");
+?>
 --FILE--
 <?php
 function utf32_utf8($k) {
diff --git a/ext/standard/tests/strings/printf_64bit.phpt b/ext/standard/tests/strings/printf_64bit.phpt
index e2e8b2273..d0b7aaff4 100755
--- a/ext/standard/tests/strings/printf_64bit.phpt
+++ b/ext/standard/tests/strings/printf_64bit.phpt
@@ -671,7 +671,7 @@ Array
 *** Output for precision value more than maximum ***
 
 Notice: printf(): Requested precision of 988 digits was truncated to PHP maximum of %d digits in %s on line %d
-12345678900.0000000000000000000000000000000000000000
+12345678900.0000000000%d
 
 *** Output for invalid width(-15) specifier ***
 15s
diff --git a/ext/standard/tests/strings/sscanf_basic6.phpt b/ext/standard/tests/strings/sscanf_basic6.phpt
index 4506c4ba9..6efdd0b68 100644
--- a/ext/standard/tests/strings/sscanf_basic6.phpt
+++ b/ext/standard/tests/strings/sscanf_basic6.phpt
@@ -1,5 +1,11 @@
 --TEST--
 Test sscanf() function : basic functionality - unsigned format
+--SKIPIF--
+<?php
+if (PHP_INT_SIZE != 4) {
+	die("skip this test is for 32bit platform only");
+}
+?>
 --FILE--
 <?php
 
diff --git a/ext/standard/tests/url/bug54180.phpt b/ext/standard/tests/url/bug54180.phpt
new file mode 100644
index 000000000..2e64e27d0
--- /dev/null
+++ b/ext/standard/tests/url/bug54180.phpt
@@ -0,0 +1,32 @@
+--TEST--
+Bug #54180 (parse_url() incorrectly parses path when ? in fragment)
+--FILE--
+<?php
+
+var_dump(parse_url("http://example.com/path/script.html?t=1#fragment?data"));
+var_dump(parse_url("http://example.com/path/script.html#fragment?data"));
+
+?>
+--EXPECTF--
+array(5) {
+  ["scheme"]=>
+  string(4) "http"
+  ["host"]=>
+  string(11) "example.com"
+  ["path"]=>
+  string(17) "/path/script.html"
+  ["query"]=>
+  string(3) "t=1"
+  ["fragment"]=>
+  string(13) "fragment?data"
+}
+array(4) {
+  ["scheme"]=>
+  string(4) "http"
+  ["host"]=>
+  string(11) "example.com"
+  ["path"]=>
+  string(17) "/path/script.html"
+  ["fragment"]=>
+  string(13) "fragment?data"
+}
diff --git a/ext/standard/tests/url/bug55399.phpt b/ext/standard/tests/url/bug55399.phpt
new file mode 100644
index 000000000..619c08da6
--- /dev/null
+++ b/ext/standard/tests/url/bug55399.phpt
@@ -0,0 +1,10 @@
+--TEST--
+Bug #55399 (parse_url() incorrectly treats ':' as a valid path)
+--FILE--
+<?php
+
+var_dump(parse_url(":"));
+
+?>
+--EXPECT--
+bool(false)
diff --git a/ext/standard/url.c b/ext/standard/url.c
index 5446c87ac..22a8471be 100644
--- a/ext/standard/url.c
+++ b/ext/standard/url.c
@@ -15,7 +15,7 @@
    | Author: Jim Winstead <jimw@php.net>                                  |
    +----------------------------------------------------------------------+
  */
-/* $Id: url.c 309175 2011-03-13 17:14:18Z pierrick $ */
+/* $Id: url.c 314783 2011-08-11 13:01:52Z iliaa $ */
 
 #include <stdlib.h>
 #include <string.h>
@@ -197,6 +197,10 @@ PHPAPI php_url *php_url_parse_ex(char const *str, int length)
 				efree(ret);
 				return NULL;
 			}
+		} else if (p == pp && *pp == '\0') {
+			STR_FREE(ret->scheme);
+			efree(ret);
+			return NULL;
 		} else {
 			goto just_path;
 		}
@@ -316,6 +320,10 @@ PHPAPI php_url *php_url_parse_ex(char const *str, int length)
 		pp = strchr(s, '#');
 
 		if (pp && pp < p) {
+			if (pp - s) {
+				ret->path = estrndup(s, (pp-s));
+				php_replace_controlchars_ex(ret->path, (pp - s));
+			}
 			p = pp;
 			goto label_parse;
 		}
diff --git a/ext/standard/url_scanner_ex.c b/ext/standard/url_scanner_ex.c
index cd4ca9e91..d22ee057d 100644
--- a/ext/standard/url_scanner_ex.c
+++ b/ext/standard/url_scanner_ex.c
@@ -17,7 +17,7 @@
   +----------------------------------------------------------------------+
 */
 
-/* $Id: url_scanner_ex.c 306939 2011-01-01 02:19:59Z felipe $ */
+/* $Id: url_scanner_ex.c 313832 2011-07-28 10:52:45Z pajoye $ */
 
 #include "php.h"
 
@@ -56,9 +56,12 @@ static PHP_INI_MH(OnUpdateTags)
 	
 	if (ctx->tags)
 		zend_hash_destroy(ctx->tags);
-	else
+	else {
 		ctx->tags = malloc(sizeof(HashTable));
-	
+		if (!ctx->tags) {
+			return FAILURE;
+		}
+	}
 	zend_hash_init(ctx->tags, 0, NULL, NULL, 1);
 	
 	for (key = php_strtok_r(tmp, ",", &lasts);
diff --git a/ext/standard/url_scanner_ex.c.orig b/ext/standard/url_scanner_ex.c.orig
index cbc3f57bc..1ffa3698f 100644
--- a/ext/standard/url_scanner_ex.c.orig
+++ b/ext/standard/url_scanner_ex.c.orig
@@ -18,7 +18,7 @@
   +----------------------------------------------------------------------+
 */
 
-/* $Id: url_scanner_ex.c 306939 2011-01-01 02:19:59Z felipe $ */
+/* $Id: url_scanner_ex.c 313832 2011-07-28 10:52:45Z pajoye $ */
 
 #include "php.h"
 
@@ -57,9 +57,12 @@ static PHP_INI_MH(OnUpdateTags)
 	
 	if (ctx->tags)
 		zend_hash_destroy(ctx->tags);
-	else
+	else {
 		ctx->tags = malloc(sizeof(HashTable));
-	
+		if (!ctx->tags) {
+			return FAILURE;
+		}
+	}
 	zend_hash_init(ctx->tags, 0, NULL, NULL, 1);
 	
 	for (key = php_strtok_r(tmp, ",", &lasts);
diff --git a/ext/standard/url_scanner_ex.re b/ext/standard/url_scanner_ex.re
index 7609bd59a..c3bb39540 100644
--- a/ext/standard/url_scanner_ex.re
+++ b/ext/standard/url_scanner_ex.re
@@ -16,7 +16,7 @@
   +----------------------------------------------------------------------+
 */
 
-/* $Id: url_scanner_ex.re 296107 2010-03-12 10:28:59Z jani $ */
+/* $Id: url_scanner_ex.re 313832 2011-07-28 10:52:45Z pajoye $ */
 
 #include "php.h"
 
@@ -55,9 +55,13 @@ static PHP_INI_MH(OnUpdateTags)
 	
 	if (ctx->tags)
 		zend_hash_destroy(ctx->tags);
-	else
+	else {
 		ctx->tags = malloc(sizeof(HashTable));
-	
+		if (!ctx->tags) {
+			return FAILURE;
+		}
+	}
+
 	zend_hash_init(ctx->tags, 0, NULL, NULL, 1);
 	
 	for (key = php_strtok_r(tmp, ",", &lasts);
diff --git a/ext/standard/user_filters.c b/ext/standard/user_filters.c
index acd414277..449c42db1 100644
--- a/ext/standard/user_filters.c
+++ b/ext/standard/user_filters.c
@@ -18,7 +18,7 @@
    +----------------------------------------------------------------------+
 */
 
-/* $Id: user_filters.c 306939 2011-01-01 02:19:59Z felipe $ */
+/* $Id: user_filters.c 314641 2011-08-09 12:16:58Z laruence $ */
 
 #include "php.h"
 #include "php_globals.h"
@@ -71,7 +71,7 @@ static const zend_function_entry user_filter_class_funcs[] = {
 	PHP_NAMED_FE(filter,	PHP_FN(user_filter_nop),		arginfo_php_user_filter_filter)
 	PHP_NAMED_FE(onCreate,	PHP_FN(user_filter_nop),		arginfo_php_user_filter_onCreate)
 	PHP_NAMED_FE(onClose,	PHP_FN(user_filter_nop),		arginfo_php_user_filter_onClose)
-	{ NULL, NULL, NULL }
+	PHP_FE_END
 };
 
 static zend_class_entry user_filter_class_entry;
@@ -311,7 +311,7 @@ static php_stream_filter *user_filter_factory_create(const char *filtername,
 			period = wildcard + (period - filtername);
 			while (period) {
 				*period = '\0';
-				strcat(wildcard, ".*");
+				strncat(wildcard, ".*", 2);
 				if (SUCCESS == zend_hash_find(BG(user_filter_map), wildcard, strlen(wildcard) + 1, (void**)&fdat)) {
 					period = NULL;
 				} else {
diff --git a/ext/standard/var.c b/ext/standard/var.c
index 633b5685d..c8a89b746 100644
--- a/ext/standard/var.c
+++ b/ext/standard/var.c
@@ -18,7 +18,7 @@
    +----------------------------------------------------------------------+
 */
 
-/* $Id: var.c 306939 2011-01-01 02:19:59Z felipe $ */
+/* $Id: var.c 314403 2011-08-07 06:04:11Z pierrick $ */
 
 /* {{{ includes
 */
@@ -242,7 +242,6 @@ PHPAPI void php_debug_zval_dump(zval **struc, int level TSRMLS_DC) /* {{{ */
 	HashTable *myht = NULL;
 	char *class_name;
 	zend_uint class_name_len;
-	zend_class_entry *ce;
 	int (*zval_element_dump_func)(zval** TSRMLS_DC, int, va_list, zend_hash_key*);
 	int is_temp = 0;
 
@@ -283,7 +282,6 @@ PHPAPI void php_debug_zval_dump(zval **struc, int level TSRMLS_DC) /* {{{ */
 			PUTS("*RECURSION*\n");
 			return;
 		}
-		ce = Z_OBJCE_PP(struc);
 		if (Z_OBJ_HANDLER_PP(struc, get_class_name)) {
 			Z_OBJ_HANDLER_PP(struc, get_class_name)(*struc, &class_name, &class_name_len, 0 TSRMLS_CC);
 			php_printf("%sobject(%s)#%d (%d) refcount(%u){\n", COMMON, class_name, Z_OBJ_HANDLE_PP(struc), myht ? zend_hash_num_elements(myht) : 0, Z_REFCOUNT_PP(struc));
@@ -387,18 +385,26 @@ static int php_object_element_export(zval **zv TSRMLS_DC, int num_args, va_list
 {
 	int level;
 	smart_str *buf;
-	char *prop_name, *class_name;
 
 	level = va_arg(args, int);
 	buf = va_arg(args, smart_str *);
 
 	buffer_append_spaces(buf, level + 2);
 	if (hash_key->nKeyLength != 0) {
-		zend_unmangle_property_name(hash_key->arKey, hash_key->nKeyLength - 1, &class_name, &prop_name);
+		char *class_name, /* ignored, but must be passed to unmangle */
+			 *pname,
+			 *pname_esc;
+		int  pname_esc_len;
+		
+		zend_unmangle_property_name(hash_key->arKey, hash_key->nKeyLength - 1,
+				&class_name, &pname);
+		pname_esc = php_addcslashes(pname, strlen(pname), &pname_esc_len, 0,
+			"'\\", 2 TSRMLS_CC);
 
 		smart_str_appendc(buf, '\'');
-		smart_str_appends(buf, prop_name);
+		smart_str_appendl(buf, pname_esc, pname_esc_len);
 		smart_str_appendc(buf, '\'');
+		efree(pname_esc);
 	} else {
 		smart_str_append_long(buf, hash_key->h);
 	}