Merge branch 'PHP-7.1' of git.php.net:/php-src into PHP-7.1

29 files changed, 306 insertions, 61 deletions

diff --git a/.appveyor.yml b/.appveyor.yml
index 9a7cd876d8..5e4a2ae3a4 100644
--- a/.appveyor.yml
+++ b/.appveyor.yml
@@ -23,7 +23,7 @@ environment:
         PHP_BUILD_CACHE_BASE_DIR: c:\build-cache  
         PHP_BUILD_OBJ_DIR: c:\obj
         PHP_BUILD_CACHE_SDK_DIR: c:\build-cache\sdk
-        PHP_BUILD_SDK_BRANCH: php-sdk-2.1.3
+        PHP_BUILD_SDK_BRANCH: php-sdk-2.1.5
         # ext and env setup for tests
         #MYSQL_TEST_PASSWD: Password12!
         #MYSQL_TEST_USER: root
diff --git a/.gdbinit b/.gdbinit
index 5a2675d37e..f33a72bc68 100644
--- a/.gdbinit
+++ b/.gdbinit
@@ -16,9 +16,11 @@ define ____executor_globals
 		end
 		set $eg = ((zend_executor_globals*) (*((void ***) $tsrm_ls))[executor_globals_id-1])
 		set $cg = ((zend_compiler_globals*) (*((void ***) $tsrm_ls))[compiler_globals_id-1])
+		set $eg_ptr = $eg
 	else
 		set $eg = executor_globals
 		set $cg = compiler_globals
+		set $eg_ptr = (zend_executor_globals*) &executor_globals
 	end
 end
 
@@ -289,6 +291,16 @@ define ____printzv
 	end
 end
 
+define print_global_vars
+	____executor_globals
+	set $symtable = ((HashTable *)&($eg_ptr->symbol_table))
+	print_ht $symtable
+end
+
+document print_global_vars
+	Prints the global variables
+end
+
 define print_const_table
 	set $ind = 1
 	printf "[%p] {\n", $arg0
diff --git a/NEWS b/NEWS
index ff7e6ce75d..339353dc5e 100644
--- a/NEWS
+++ b/NEWS
@@ -2,7 +2,23 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 7.1.19
 
+- CLI Server:
+  . Fixed bug #76333 (PHP built-in server does not find files if root path
+    contains special characters). (Anatol)
+
+- OpenSSL:
+  . Fixed bug #76296 (openssl_pkey_get_public does not respect open_basedir).
+    (Erik Lax, Jakub Zelenka)
+  . Fixed bug #76174 (openssl extension fails to build with LibreSSL 2.7).
+    (Jakub Zelenka)
 
+- SPL:
+  . Fixed bug #76367 (NoRewindIterator segfault 11). (Laruence)
+
+- Standard:
+  . Fixed bug #76335 ("link(): Bad file descriptor" with non-ASCII path).
+    (Anatol)
+  . Fixed bug #76383 (array_map on $GLOBALS returns IS_INDIRECT). (Bob)
 
 24 May 2018, PHP 7.1.18
 
diff --git a/Zend/tests/bug76383.phpt b/Zend/tests/bug76383.phpt
new file mode 100644
index 0000000000..ae26ba8acd
--- /dev/null
+++ b/Zend/tests/bug76383.phpt
@@ -0,0 +1,13 @@
+--TEST--
+Bug #76383: array_map on $GLOBALS returns IS_INDIRECT
+--FILE--
+<?php
+
+$a = 1;
+array_map(function($x) use (&$lastval) { $lastval = $x; }, $GLOBALS);
+var_dump(gettype($lastval), $lastval); // will contain $a
+
+?>
+--EXPECT--
+string(7) "integer"
+int(1)
diff --git a/ext/bcmath/tests/bug72093-win32.phpt b/ext/bcmath/tests/bug72093-win32.phpt
index a9b2077823..5ee9b068b3 100644
--- a/ext/bcmath/tests/bug72093-win32.phpt
+++ b/ext/bcmath/tests/bug72093-win32.phpt
@@ -6,6 +6,11 @@ if(!extension_loaded("bcmath")) print "skip";
 if (substr(PHP_OS, 0, 3) != 'WIN') {
     die('skip valid only for windows');
 }
+$cur = PHP_WINDOWS_VERSION_MAJOR.'.'.PHP_WINDOWS_VERSION_MINOR.'.'.PHP_WINDOWS_VERSION_BUILD;
+$req = "10.0.17134";
+if (version_compare($cur, $req) >= 0) {
+	echo "skip Only for Windows systems < $req";
+}
 ?>
 --FILE--
 <?php
@@ -14,5 +19,4 @@ var_dump(bcpowmod(1, 1.2, 1, 1));
 ?>
 --EXPECTF--
 string(1) "1"
-string(3) "0.0"
-bc math warning: non-zero scale in exponent
+%Astring(3) "0.0"%A
diff --git a/ext/bcmath/tests/bug72093.phpt b/ext/bcmath/tests/bug72093.phpt
index 911af5698f..a8b6471098 100644
--- a/ext/bcmath/tests/bug72093.phpt
+++ b/ext/bcmath/tests/bug72093.phpt
@@ -4,7 +4,11 @@ Bug 72093: bcpowmod accepts negative scale and corrupts _one_ definition
 <?php
 if(!extension_loaded("bcmath")) print "skip";
 if (substr(PHP_OS, 0, 3) == 'WIN') {
-    die('skip Not valid for windows');
+	$cur = PHP_WINDOWS_VERSION_MAJOR.'.'.PHP_WINDOWS_VERSION_MINOR.'.'.PHP_WINDOWS_VERSION_BUILD;
+	$req = "10.0.17134";
+	if (version_compare($cur, $req) < 0) {
+		echo "skip Compatible on Windows systems >= $req";
+	}
 }
 ?>
 --FILE--
diff --git a/ext/bcmath/tests/bug75178-win32.phpt b/ext/bcmath/tests/bug75178-win32.phpt
index bae590fb5b..9d71434f6c 100644
--- a/ext/bcmath/tests/bug75178-win32.phpt
+++ b/ext/bcmath/tests/bug75178-win32.phpt
@@ -6,6 +6,11 @@ if (!extension_loaded('bcmath')) die('skip bcmath extension is not available');
 if (substr(PHP_OS, 0, 3) != 'WIN') {
     die('skip valid only for windows');
 }
+$cur = PHP_WINDOWS_VERSION_MAJOR.'.'.PHP_WINDOWS_VERSION_MINOR.'.'.PHP_WINDOWS_VERSION_BUILD;
+$req = "10.0.17134";
+if (version_compare($cur, $req) >= 0) {
+	echo "skip Only for Windows systems < $req";
+}
 ?>
 --FILE--
 <?php
@@ -13,9 +18,7 @@ var_dump(bcpowmod('4.1', '4', '3', 3));
 var_dump(bcpowmod('4', '4', '3.1', 3));
 ?>
 ===DONE===
---EXPECT--
-string(5) "1.000"
-string(5) "1.000"
-===DONE===
-bc math warning: non-zero scale in base
-bc math warning: non-zero scale in modulus
+--EXPECTF--
+%Astring(5) "1.000"
+%Astring(5) "1.000"
+===DONE===%A
diff --git a/ext/bcmath/tests/bug75178.phpt b/ext/bcmath/tests/bug75178.phpt
index bdfa25a2e1..c56b54f209 100644
--- a/ext/bcmath/tests/bug75178.phpt
+++ b/ext/bcmath/tests/bug75178.phpt
@@ -4,7 +4,11 @@ Bug #75178 (bcpowmod() misbehaves for non-integer base or modulus)
 <?php
 if (!extension_loaded('bcmath')) die('skip bcmath extension is not available');
 if (substr(PHP_OS, 0, 3) == 'WIN') {
-    die('skip Not valid for windows');
+	$cur = PHP_WINDOWS_VERSION_MAJOR.'.'.PHP_WINDOWS_VERSION_MINOR.'.'.PHP_WINDOWS_VERSION_BUILD;
+	$req = "10.0.17134";
+	if (version_compare($cur, $req) < 0) {
+		echo "skip Compatible on Windows systems >= $req";
+	}
 }
 ?>
 --FILE--
diff --git a/ext/curl/tests/bug48203-win32.phpt b/ext/curl/tests/bug48203-win32.phpt
index 947c33a3d1..d3affdb71d 100644
--- a/ext/curl/tests/bug48203-win32.phpt
+++ b/ext/curl/tests/bug48203-win32.phpt
@@ -30,7 +30,8 @@ echo "Ok\n";
 <?php @unlink(dirname(__FILE__) . '/bug48203.tmp'); ?>
 --EXPECTF--
 Warning: curl_exec(): CURLOPT_STDERR resource has gone away, resetting to stderr in %s on line %d
-Hello World!
-Hello World!Ok
 %A
+Hello World!
+Hello World!* Closing connection 0
+Ok
 
diff --git a/ext/curl/tests/bug54798-win32.phpt b/ext/curl/tests/bug54798-win32.phpt
index c3b240dea7..bce39903ba 100644
--- a/ext/curl/tests/bug54798-win32.phpt
+++ b/ext/curl/tests/bug54798-win32.phpt
@@ -65,4 +65,3 @@ Hello World!Ok for CURLOPT_FILE
 
 %AOk for CURLOPT_INFILE
 ===DONE===
-%A
diff --git a/ext/curl/tests/server.inc b/ext/curl/tests/server.inc
index ed351b72cb..27f0cbbc84 100644
--- a/ext/curl/tests/server.inc
+++ b/ext/curl/tests/server.inc
@@ -13,17 +13,23 @@ function curl_cli_server_start() {
     $doc_root = __DIR__;
     $router = "responder/get.php";
 
-    $descriptorspec = array(
-        0 => STDIN,
-        1 => STDOUT,
-        2 => STDERR,
-    );
-
     if (substr(PHP_OS, 0, 3) == 'WIN') {
+        $descriptorspec = array(
+            0 => STDIN,
+            1 => STDOUT,
+            2 => array("pipe", "w"),
+        );
+
         $cmd = "{$php_executable} -t {$doc_root} -n -S " . PHP_CURL_SERVER_ADDRESS;
         $cmd .= " {$router}";
         $handle = proc_open(addslashes($cmd), $descriptorspec, $pipes, $doc_root, NULL, array("bypass_shell" => true,  "suppress_errors" => true));
     } else {
+        $descriptorspec = array(
+            0 => STDIN,
+            1 => STDOUT,
+            2 => STDERR,
+        );
+
         $cmd = "exec {$php_executable} -t {$doc_root} -n -S " . PHP_CURL_SERVER_ADDRESS;
         $cmd .= " {$router}";
         $cmd .= " 2>/dev/null";
diff --git a/ext/opcache/tests/php_cli_server.inc b/ext/opcache/tests/php_cli_server.inc
index 456ed663b8..ca781b7cd7 100644
--- a/ext/opcache/tests/php_cli_server.inc
+++ b/ext/opcache/tests/php_cli_server.inc
@@ -7,16 +7,22 @@ function php_cli_server_start($ini = "") {
 	$php_executable = getenv('TEST_PHP_EXECUTABLE');
 	$doc_root = __DIR__;
 
-	$descriptorspec = array(
-		0 => STDIN,
-		1 => STDOUT,
-		2 => STDERR,
-	);
-
 	if (substr(PHP_OS, 0, 3) == 'WIN') {
+		$descriptorspec = array(
+			0 => STDIN,
+			1 => STDOUT,
+			2 => array("pipe", "w"),
+		);
+
 		$cmd = "{$php_executable} -t {$doc_root} $ini -S " . PHP_CLI_SERVER_ADDRESS;
 		$handle = proc_open(addslashes($cmd), $descriptorspec, $pipes, $doc_root, NULL, array("bypass_shell" => true,  "suppress_errors" => true));
 	} else {
+		$descriptorspec = array(
+			0 => STDIN,
+			1 => STDOUT,
+			2 => STDERR,
+		);
+
 		$cmd = "exec {$php_executable} -t {$doc_root} $ini -S " . PHP_CLI_SERVER_ADDRESS . " 2>/dev/null";
 		$handle = proc_open($cmd, $descriptorspec, $pipes, $doc_root);
 	}
diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c
index 7651e64da6..44fe00b7fe 100644
--- a/ext/openssl/openssl.c
+++ b/ext/openssl/openssl.c
@@ -73,7 +73,7 @@
 #ifdef HAVE_OPENSSL_MD2_H
 #define OPENSSL_ALGO_MD2	4
 #endif
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
+#if PHP_OPENSSL_API_VERSION < 0x10100
 #define OPENSSL_ALGO_DSS1	5
 #endif
 #define OPENSSL_ALGO_SHA224 6
@@ -560,7 +560,7 @@ ZEND_GET_MODULE(openssl)
 #endif
 
 /* {{{ OpenSSL compatibility functions and macros */
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
+#if PHP_OPENSSL_API_VERSION < 0x10100
 #define EVP_PKEY_get0_RSA(_pkey) _pkey->pkey.rsa
 #define EVP_PKEY_get0_DH(_pkey) _pkey->pkey.dh
 #define EVP_PKEY_get0_DSA(_pkey) _pkey->pkey.dsa
@@ -677,7 +677,7 @@ static const unsigned char *ASN1_STRING_get0_data(const ASN1_STRING *asn1)
 	return M_ASN1_STRING_data(asn1);
 }
 
-#if OPENSSL_VERSION_NUMBER < 0x10002000L || defined (LIBRESSL_VERSION_NUMBER)
+#if PHP_OPENSSL_API_VERSION < 0x10002
 
 static int X509_get_signature_nid(const X509 *x)
 {
@@ -1237,7 +1237,7 @@ static void php_openssl_dispose_config(struct php_x509_request * req) /* {{{ */
 }
 /* }}} */
 
-#if defined(PHP_WIN32) || (OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER))
+#if defined(PHP_WIN32) || PHP_OPENSSL_API_VERSION >= 0x10100
 #define PHP_OPENSSL_RAND_ADD_TIME() ((void) 0)
 #else
 #define PHP_OPENSSL_RAND_ADD_TIME() php_openssl_rand_add_timeval()
@@ -1324,7 +1324,7 @@ static EVP_MD * php_openssl_get_evp_md_from_algo(zend_long algo) { /* {{{ */
 			mdtype = (EVP_MD *) EVP_md2();
 			break;
 #endif
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
+#if PHP_OPENSSL_API_VERSION < 0x10100
 		case OPENSSL_ALGO_DSS1:
 			mdtype = (EVP_MD *) EVP_dss1();
 			break;
@@ -1450,7 +1450,7 @@ PHP_MINIT_FUNCTION(openssl)
 #ifdef HAVE_OPENSSL_MD2_H
 	REGISTER_LONG_CONSTANT("OPENSSL_ALGO_MD2", OPENSSL_ALGO_MD2, CONST_CS|CONST_PERSISTENT);
 #endif
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
+#if PHP_OPENSSL_API_VERSION < 0x10100
 	REGISTER_LONG_CONSTANT("OPENSSL_ALGO_DSS1", OPENSSL_ALGO_DSS1, CONST_CS|CONST_PERSISTENT);
 #endif
 	REGISTER_LONG_CONSTANT("OPENSSL_ALGO_SHA224", OPENSSL_ALGO_SHA224, CONST_CS|CONST_PERSISTENT);
@@ -3620,7 +3620,7 @@ PHP_FUNCTION(openssl_csr_get_public_key)
 		RETURN_FALSE;
 	}
 
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
+#if PHP_OPENSSL_API_VERSION >= 0x10100
 	/* Due to changes in OpenSSL 1.1 related to locking when decoding CSR,
 	 * the pub key is not changed after assigning. It means if we pass
 	 * a private key, it will be returned including the private part.
@@ -3631,7 +3631,7 @@ PHP_FUNCTION(openssl_csr_get_public_key)
 	/* Retrieve the public key from the CSR */
 	tpubkey = X509_REQ_get_pubkey(csr);
 
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
+#if PHP_OPENSSL_API_VERSION >= 0x10100
 	/* We need to free the CSR as it was duplicated */
 	X509_REQ_free(csr);
 #endif
@@ -3785,6 +3785,9 @@ static EVP_PKEY * php_openssl_evp_from_zval(
 
 		if (Z_STRLEN_P(val) > 7 && memcmp(Z_STRVAL_P(val), "file://", sizeof("file://") - 1) == 0) {
 			filename = Z_STRVAL_P(val) + (sizeof("file://") - 1);
+			if (php_openssl_open_base_dir_chk(filename)) {
+				TMP_CLEAN;
+			}
 		}
 		/* it's an X509 file/cert of some kind, and we need to extract the data from that */
 		if (public_key) {
@@ -3811,9 +3814,6 @@ static EVP_PKEY * php_openssl_evp_from_zval(
 			BIO *in;
 
 			if (filename) {
-				if (php_openssl_open_base_dir_chk(filename)) {
-					TMP_CLEAN;
-				}
 				in = BIO_new_file(filename, PHP_OPENSSL_BIO_MODE_R(PKCS7_BINARY));
 			} else {
 				in = BIO_new_mem_buf(Z_STRVAL_P(val), (int)Z_STRLEN_P(val));
diff --git a/ext/openssl/php_openssl.h b/ext/openssl/php_openssl.h
index f13225d049..a03581c983 100644
--- a/ext/openssl/php_openssl.h
+++ b/ext/openssl/php_openssl.h
@@ -29,6 +29,25 @@ extern zend_module_entry openssl_module_entry;
 #include "php_version.h"
 #define PHP_OPENSSL_VERSION PHP_VERSION
 
+#include <openssl/opensslv.h>
+#if defined(LIBRESSL_VERSION_NUMBER)
+/* LibreSSL version check */
+#if LIBRESSL_VERSION_NUMBER < 0x20700000L
+#define PHP_OPENSSL_API_VERSION 0x10001
+#else
+#define PHP_OPENSSL_API_VERSION 0x10100
+#endif
+#else
+/* OpenSSL version check */
+#if OPENSSL_VERSION_NUMBER < 0x10002000L
+#define PHP_OPENSSL_API_VERSION 0x10001
+#elif OPENSSL_VERSION_NUMBER < 0x10100000L
+#define PHP_OPENSSL_API_VERSION 0x10002
+#else
+#define PHP_OPENSSL_API_VERSION 0x10100
+#endif
+#endif
+
 #define OPENSSL_RAW_DATA 1
 #define OPENSSL_ZERO_PADDING 2
 #define OPENSSL_DONT_ZERO_PAD_KEY 4
diff --git a/ext/openssl/tests/bug76296.phpt b/ext/openssl/tests/bug76296.phpt
new file mode 100644
index 0000000000..7ab15dfbf3
--- /dev/null
+++ b/ext/openssl/tests/bug76296.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Bug #76296 openssl_pkey_get_public does not respect open_basedir
+--SKIPIF--
+<?php if (!extension_loaded("openssl")) print "skip"; ?>
+--FILE--
+<?php
+$dir = __DIR__ . '/bug76296_openbasedir';
+$pem = 'file://' . __DIR__ . '/public.key';
+if (!is_dir($dir)) {
+	mkdir($dir);
+}
+
+ini_set('open_basedir', $dir);
+
+var_dump(openssl_pkey_get_public($pem));
+?>
+--EXPECTF--
+
+Warning: openssl_pkey_get_public(): open_basedir restriction in effect. File(%s) is not within the allowed path(s): (%s) in %s on line %d
+bool(false)
+--CLEAN--
+@rmdir(__DIR__ . '/bug76296_openbasedir');
diff --git a/ext/openssl/xp_ssl.c b/ext/openssl/xp_ssl.c
index b70becec7b..5207657ef2 100644
--- a/ext/openssl/xp_ssl.c
+++ b/ext/openssl/xp_ssl.c
@@ -91,7 +91,7 @@
 /* Used for peer verification in windows */
 #define PHP_X509_NAME_ENTRY_TO_UTF8(ne, i, out) ASN1_STRING_to_UTF8(&out, X509_NAME_ENTRY_get_data(X509_NAME_get_entry(ne, i)))
 
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
+#if PHP_OPENSSL_API_VERSION < 0x10100
 static RSA *tmp_rsa_cb(SSL *s, int is_export, int keylength);
 #endif
 
@@ -1128,7 +1128,7 @@ static void init_server_reneg_limit(php_stream *stream, php_openssl_netstream_da
 }
 /* }}} */
 
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
+#if PHP_OPENSSL_API_VERSION < 0x10100
 static RSA *tmp_rsa_cb(SSL *s, int is_export, int keylength)
 {
 	BIGNUM *bn = NULL;
@@ -1197,7 +1197,7 @@ static int set_server_dh_param(php_stream * stream, SSL_CTX *ctx) /* {{{ */
 }
 /* }}} */
 
-#if defined(HAVE_ECDH) && (OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER))
+#if defined(HAVE_ECDH) && PHP_OPENSSL_API_VERSION < 0x10100
 static int set_server_ecdh_curve(php_stream *stream, SSL_CTX *ctx) /* {{{ */
 {
 	zval *zvcurve;
@@ -1240,13 +1240,13 @@ static int set_server_specific_opts(php_stream *stream, SSL_CTX *ctx) /* {{{ */
 	zval *zv;
 	long ssl_ctx_options = SSL_CTX_get_options(ctx);
 
-#if defined(HAVE_ECDH) && (OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER))
+#if defined(HAVE_ECDH) && PHP_OPENSSL_API_VERSION < 0x10100
 	if (set_server_ecdh_curve(stream, ctx) == FAILURE) {
 		return FAILURE;
 	}
 #endif
 
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
+#if PHP_OPENSSL_API_VERSION < 0x10100
 	SSL_CTX_set_tmp_rsa_callback(ctx, tmp_rsa_cb);
 #endif
 	/* We now use tmp_rsa_cb to generate a key of appropriate size whenever necessary */
diff --git a/ext/pdo/Makefile.frag b/ext/pdo/Makefile.frag
index 58125ed872..d2b59744ef 100644
--- a/ext/pdo/Makefile.frag
+++ b/ext/pdo/Makefile.frag
@@ -7,7 +7,12 @@ PDO_HEADER_FILES= \
 
 
 $(srcdir)/pdo_sql_parser.c: $(srcdir)/pdo_sql_parser.re
-	(cd $(top_srcdir); $(RE2C) --no-generation-date -o ext/pdo/pdo_sql_parser.c ext/pdo/pdo_sql_parser.re)
+	@(cd $(top_srcdir); \
+	if test -f ./pdo_sql_parser.re; then \
+		$(RE2C) --no-generation-date -o pdo_sql_parser.c pdo_sql_parser.re; \
+	else \
+		$(RE2C) --no-generation-date -o ext/pdo/pdo_sql_parser.c ext/pdo/pdo_sql_parser.re; \
+	fi)
 
 install-pdo-headers:
 	@echo "Installing PDO headers:           $(INSTALL_ROOT)$(phpincludedir)/ext/pdo/"
diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
index 8abb3ba7ed..0a3032263c 100644
--- a/ext/spl/spl_array.c
+++ b/ext/spl/spl_array.c
@@ -1039,7 +1039,7 @@ static zval *spl_array_it_get_current_data(zend_object_iterator *iter) /* {{{ */
 		return zend_user_it_get_current_data(iter);
 	} else {
 		zval *data = zend_hash_get_current_data_ex(aht, spl_array_get_pos_ptr(aht, object));
-		if (Z_TYPE_P(data) == IS_INDIRECT) {
+		if (data && Z_TYPE_P(data) == IS_INDIRECT) {
 			data = Z_INDIRECT_P(data);
 		}
 		return data;
diff --git a/ext/spl/tests/bug76367.phpt b/ext/spl/tests/bug76367.phpt
new file mode 100644
index 0000000000..f34e8a39de
--- /dev/null
+++ b/ext/spl/tests/bug76367.phpt
@@ -0,0 +1,16 @@
+--TEST--
+Bug #76367 (NoRewindIterator segfault 11)
+--FILE--
+<?php
+$arr = [1,3,55,66,43,6];
+
+$iter = new NoRewindIterator(new ArrayIterator($arr));
+
+while($iter->valid()) {
+	    $iter->next();
+}
+
+var_dump($iter->current()); 
+?>
+--EXPECT--
+NULL
diff --git a/ext/standard/array.c b/ext/standard/array.c
index 970735cf47..183cf123c3 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -2099,10 +2099,18 @@ PHP_FUNCTION(range)
 	}
 
 	if (zstep) {
-		if (Z_TYPE_P(zstep) == IS_DOUBLE ||
-			(Z_TYPE_P(zstep) == IS_STRING && is_numeric_string(Z_STRVAL_P(zstep), Z_STRLEN_P(zstep), NULL, NULL, 0) == IS_DOUBLE)
-		) {
+		if (Z_TYPE_P(zstep) == IS_DOUBLE) {
 			is_step_double = 1;
+		} else if (Z_TYPE_P(zstep) == IS_STRING) {
+			int type = is_numeric_string(Z_STRVAL_P(zstep), Z_STRLEN_P(zstep), NULL, NULL, 0);
+			if (type == IS_DOUBLE) {
+				is_step_double = 1;
+			}
+			if (type == 0) {
+				/* bad number */
+				php_error_docref(NULL, E_WARNING, "Invalid range string - must be numeric");
+				RETURN_FALSE;
+			}
 		}
 
 		step = zval_get_double(zstep);
@@ -2242,6 +2250,10 @@ long_str:
 		}
 
 		lstep = step;
+		if (step <= 0) {
+			err = 1;
+			goto err;
+		}
 
 		Z_TYPE_INFO(tmp) = IS_LONG;
 		if (low > high) { 		/* Negative steps */
@@ -5348,7 +5360,7 @@ PHP_FUNCTION(array_map)
 
 		array_init_size(return_value, maxlen);
 
-		ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL(arrays[0]), num_key, str_key, zv) {
+		ZEND_HASH_FOREACH_KEY_VAL_IND(Z_ARRVAL(arrays[0]), num_key, str_key, zv) {
 			fci.retval = &result;
 			fci.param_count = 1;
 			fci.params = &arg;
diff --git a/ext/standard/config.m4 b/ext/standard/config.m4
index 61eefdc339..ebf4b79f1a 100644
--- a/ext/standard/config.m4
+++ b/ext/standard/config.m4
@@ -319,7 +319,7 @@ case "$PHP_SAPI" in
   none)
     for PROG in $PHP_BINARIES; do
       case "$PROG" in
-        cgi|cli)
+        cgi|cli|phpdbg)
           PHP_ENABLE_CHROOT_FUNC=yes
         ;;
 
diff --git a/ext/standard/link_win32.c b/ext/standard/link_win32.c
index 35ea1cd1ef..898928b2af 100644
--- a/ext/standard/link_win32.c
+++ b/ext/standard/link_win32.c
@@ -196,6 +196,7 @@ PHP_FUNCTION(link)
 	int ret;
 	char source_p[MAXPATHLEN];
 	char dest_p[MAXPATHLEN];
+	wchar_t *dstw, *srcw;
 
 	/*First argument to link function is the target and hence should go to frompath
 	  Second argument to link function is the link itself and hence should go to topath */
@@ -224,16 +225,38 @@ PHP_FUNCTION(link)
 	}
 
 #ifndef ZTS
-	ret = CreateHardLinkA(topath, frompath, NULL);
+# define _TO_PATH topath
+# define _FROM_PATH frompath
 #else
-	ret = CreateHardLinkA(dest_p, source_p, NULL);
+# define _TO_PATH dest_p
+# define _FROM_PATH source_p
 #endif
+	dstw = php_win32_ioutil_any_to_w(_TO_PATH);
+	if (!dstw) {
+		php_error_docref(NULL, E_WARNING, "UTF-16 conversion failed (error %d)", GetLastError());
+		RETURN_FALSE;
+	}
+	srcw = php_win32_ioutil_any_to_w(_FROM_PATH);
+	if (!srcw) {
+		free(dstw);
+		php_error_docref(NULL, E_WARNING, "UTF-16 conversion failed (error %d)", GetLastError());
+		RETURN_FALSE;
+	}
+#undef _TO_PATH
+#undef _FROM_PATH
+
+	ret = CreateHardLinkW(dstw, srcw, NULL);
 
 	if (ret == 0) {
+		free(dstw);
+		free(srcw);
 		php_error_docref(NULL, E_WARNING, "%s", strerror(errno));
 		RETURN_FALSE;
 	}
 
+	free(dstw);
+	free(srcw);
+
 	RETURN_TRUE;
 }
 /* }}} */
diff --git a/ext/standard/tests/array/range_errors.phpt b/ext/standard/tests/array/range_errors.phpt
index 9652e28340..45c30f5acf 100644
--- a/ext/standard/tests/array/range_errors.phpt
+++ b/ext/standard/tests/array/range_errors.phpt
@@ -27,6 +27,8 @@ var_dump( range(1) );  // No.of args < expected
 var_dump( range(1,2,3,4) );  // No.of args > expected
 var_dump( range(-1, -2, 2) );  
 var_dump( range("a", "j", "z") );
+var_dump( range(0, 1, "140962482048819216326.24") );
+var_dump( range(0, 1, "140962482048819216326.24.") );
 
 echo "\n-- Testing Invalid steps --";
 $step_arr = array( "string", NULL, FALSE, "", "\0" );
@@ -78,11 +80,17 @@ bool(false)
 Warning: range(): step exceeds the specified range in %s on line %d
 bool(false)
 
+Warning: range(): Invalid range string - must be numeric in %s on line %d
+bool(false)
+
 Warning: range(): step exceeds the specified range in %s on line %d
 bool(false)
 
+Warning: range(): Invalid range string - must be numeric in %s on line %d
+bool(false)
+
 -- Testing Invalid steps --
-Warning: range(): step exceeds the specified range in %s on line %d
+Warning: range(): Invalid range string - must be numeric in %s on line %d
 bool(false)
 
 Warning: range(): step exceeds the specified range in %s on line %d
@@ -91,9 +99,9 @@ bool(false)
 Warning: range(): step exceeds the specified range in %s on line %d
 bool(false)
 
-Warning: range(): step exceeds the specified range in %s on line %d
+Warning: range(): Invalid range string - must be numeric in %s on line %d
 bool(false)
 
-Warning: range(): step exceeds the specified range in %s on line %d
+Warning: range(): Invalid range string - must be numeric in %s on line %d
 bool(false)
 Done
diff --git a/ext/standard/tests/file/windows_links/bug76335.phpt b/ext/standard/tests/file/windows_links/bug76335.phpt
new file mode 100644
index 0000000000..866057fe02
--- /dev/null
+++ b/ext/standard/tests/file/windows_links/bug76335.phpt
@@ -0,0 +1,52 @@
+--TEST--
+Bug #76335 "link(): Bad file descriptor" with non-ASCII path
+--SKIPIF--
+<?php
+if(substr(PHP_OS, 0, 3) != 'WIN' ) {
+    die('skip windows only test');
+}
+?>
+--FILE--
+<?php
+
+$d0 = dirname(__FILE__) . DIRECTORY_SEPARATOR . "á";
+$d1 = dirname(__FILE__) . DIRECTORY_SEPARATOR . "a";
+
+$fn = dirname(__FILE__) . DIRECTORY_SEPARATOR . "file";
+
+$l0 = $d0 . DIRECTORY_SEPARATOR . "b";
+$l1 = $d1 . DIRECTORY_SEPARATOR . "b";
+
+mkdir($d0);
+mkdir($d1);
+
+file_put_contents($fn, "");
+
+chdir($d0);
+var_dump(link($d0 . DIRECTORY_SEPARATOR . ".." . DIRECTORY_SEPARATOR . "file", $l0));
+
+chdir($d1);
+var_dump(link($d1 . DIRECTORY_SEPARATOR . ".." . DIRECTORY_SEPARATOR . "file", $l1));
+
+?>
+--CLEAN--
+<?php
+
+$d0 = dirname(__FILE__) . DIRECTORY_SEPARATOR . "á";
+$d1 = dirname(__FILE__) . DIRECTORY_SEPARATOR . "a";
+
+$fn = dirname(__FILE__) . DIRECTORY_SEPARATOR . "file";
+
+$l0 = $d0 . DIRECTORY_SEPARATOR . "b";
+$l1 = $d1 . DIRECTORY_SEPARATOR . "b";
+
+unlink($l0);
+unlink($l1);
+unlink($fn);
+rmdir($d0);
+rmdir($d1);
+?>
+--EXPECT--
+bool(true)
+bool(true)
+
diff --git a/php.ini-development b/php.ini-development
index bad3017695..9e7094c4fb 100644
--- a/php.ini-development
+++ b/php.ini-development
@@ -1905,6 +1905,10 @@ ldap.max_links = -1
 ; Prevent name collisions in chroot'ed environment.
 ;opcache.validate_root=0
 
+; If specified, it produces opcode dumps for debugging different stages of
+; optimizations.
+;opcache.opt_debug_level=0
+
 [curl]
 ; A default value for the CURLOPT_CAINFO option. This is required to be an
 ; absolute path.
diff --git a/php.ini-production b/php.ini-production
index 2232d75a59..dafddedac1 100644
--- a/php.ini-production
+++ b/php.ini-production
@@ -1905,6 +1905,10 @@ ldap.max_links = -1
 ; Prevent name collisions in chroot'ed environment.
 ;opcache.validate_root=0
 
+; If specified, it produces opcode dumps for debugging different stages of
+; optimizations.
+;opcache.opt_debug_level=0
+
 [curl]
 ; A default value for the CURLOPT_CAINFO option. This is required to be an
 ; absolute path.
diff --git a/sapi/cli/php_cli_server.c b/sapi/cli/php_cli_server.c
index 17c854caad..5844cdfe8e 100644
--- a/sapi/cli/php_cli_server.c
+++ b/sapi/cli/php_cli_server.c
@@ -2044,9 +2044,11 @@ static int php_cli_server_begin_send_static(php_cli_server *server, php_cli_serv
 		 ' ' == client->request.path_translated[client->request.path_translated_len-1])) {
 		return php_cli_server_send_error_page(server, client, 500);
 	}
-#endif
 
+	fd = client->request.path_translated ? php_win32_ioutil_open(client->request.path_translated, O_RDONLY): -1;
+#else
 	fd = client->request.path_translated ? open(client->request.path_translated, O_RDONLY): -1;
+#endif
 	if (fd < 0) {
 		return php_cli_server_send_error_page(server, client, 404);
 	}
diff --git a/sapi/cli/tests/php_cli_server.inc b/sapi/cli/tests/php_cli_server.inc
index 5ee3887957..2a21ba35d0 100644
--- a/sapi/cli/tests/php_cli_server.inc
+++ b/sapi/cli/tests/php_cli_server.inc
@@ -11,13 +11,13 @@ function php_cli_server_start($code = 'echo "Hello world";', $router = 'index.ph
 		file_put_contents($doc_root . '/' . ($router ?: 'index.php'), '<?php ' . $code . ' ?>');
 	}
 
-	$descriptorspec = array(
-		0 => STDIN,
-		1 => STDOUT,
-		2 => STDERR,
-	);
-
 	if (substr(PHP_OS, 0, 3) == 'WIN') {
+		$descriptorspec = array(
+			0 => STDIN,
+			1 => STDOUT,
+			2 => array("pipe", "w"),
+		);
+
 		$cmd = "{$php_executable} -t {$doc_root} -n {$cmd_args} -S " . PHP_CLI_SERVER_ADDRESS;
 		if (!is_null($router)) {
 			$cmd .= " {$router}";
@@ -25,6 +25,12 @@ function php_cli_server_start($code = 'echo "Hello world";', $router = 'index.ph
 
 		$handle = proc_open(addslashes($cmd), $descriptorspec, $pipes, $doc_root, NULL, array("bypass_shell" => true,  "suppress_errors" => true));
 	} else {
+		$descriptorspec = array(
+			0 => STDIN,
+			1 => STDOUT,
+			2 => STDERR,
+		);
+
 		$cmd = "exec {$php_executable} -t {$doc_root} -n {$cmd_args} -S " . PHP_CLI_SERVER_ADDRESS;
 		if (!is_null($router)) {
 			$cmd .= " {$router}";
diff --git a/win32/build/confutils.js b/win32/build/confutils.js
index 99a2521301..b33600ce3f 100644
--- a/win32/build/confutils.js
+++ b/win32/build/confutils.js
@@ -3104,6 +3104,10 @@ function toolset_setup_common_cflags()
 			}
 		}
 
+		if (VCVERS >= 1914) {
+			/* This is only in effect for CXX sources, __cplusplus is not defined in C sources. */
+			ADD_FLAG("CFLAGS", "/Zc:__cplusplus");
+		}
 	} else if (CLANG_TOOLSET) {
 		if (X64) {
 			ADD_FLAG('CFLAGS', '-m64');