PHP security-update.

Package-Manager: portage-2.0.53_rc6

23 files changed, 3046 insertions, 28 deletions

diff --git a/dev-lang/php/ChangeLog b/dev-lang/php/ChangeLog
index 0cc8373746d3..5b39c9174e87 100644
--- a/dev-lang/php/ChangeLog
+++ b/dev-lang/php/ChangeLog
@@ -1,6 +1,30 @@
 # ChangeLog for dev-lang/php
 # Copyright 1999-2005 Gentoo Foundation; Distributed under the GPL v2
-# $Header: /var/cvsroot/gentoo-x86/dev-lang/php/ChangeLog,v 1.49 2005/10/31 14:10:39 chtekk Exp $
+# $Header: /var/cvsroot/gentoo-x86/dev-lang/php/ChangeLog,v 1.50 2005/11/03 14:09:24 chtekk Exp $
+
+*php-5.0.5-r3 (02 Nov 2005)
+*php-5.0.4-r3 (02 Nov 2005)
+*php-4.4.1 (02 Nov 2005)
+*php-4.4.0-r3 (02 Nov 2005)
+*php-4.3.11-r3 (02 Nov 2005)
+
+  02 Nov 2005; Luca Longinotti <chtekk@gentoo.org>
+  +files/4.3.11/php4.3.11-curl_safemode.patch,
+  +files/4.3.11/php4.3.11-globals_overwrite.patch,
+  +files/4.3.11/php4.3.11-phpinfo_xss.patch,
+  +files/4.4.0/php4.4.0-curl_safemode.patch,
+  +files/4.4.0/php4.4.0-globals_overwrite.patch,
+  +files/4.4.0/php4.4.0-phpinfo_xss.patch,
+  +files/5.0.4/php5.0.4-curl_safemode.patch,
+  +files/5.0.4/php5.0.4-globals_overwrite.patch,
+  +files/5.0.4/php5.0.4-phpinfo_xss.patch,
+  +files/5.0.5/php5.0.5-curl_safemode.patch,
+  +files/5.0.5/php5.0.5-globals_overwrite.patch, -php-4.3.11-r2.ebuild,
+  +php-4.3.11-r3.ebuild, -php-4.4.0-r2.ebuild, +php-4.4.0-r3.ebuild,
+  +php-4.4.1.ebuild, -php-5.0.4-r2.ebuild, +php-5.0.4-r3.ebuild,
+  -php-5.0.5-r2.ebuild, +php-5.0.5-r3.ebuild:
+  Security-update: fix bugs #111032, #111015, #111011 and bug #111014. Also
+  add PHP 4.4.1 to the tree, wich fixes those vulnerabilities.
 
 *php-5.0.5-r2 (31 Oct 2005)
 *php-5.0.4-r2 (31 Oct 2005)
diff --git a/dev-lang/php/Manifest b/dev-lang/php/Manifest
index 3cd7dc8ad050..d202e17278e4 100644
--- a/dev-lang/php/Manifest
+++ b/dev-lang/php/Manifest
@@ -1,7 +1,4 @@
------BEGIN PGP SIGNED MESSAGE-----
-Hash: SHA1
-
-MD5 d488db4999a774213ac88afa0b1203f8 ChangeLog 7255
+MD5 45f44f5a2b220b261c25edac7484c214 ChangeLog 8299
 MD5 389638f1d46b6c41cd4d87b471572f4b files/4-any/apache-1.3/70_mod_php.conf 484
 MD5 ee36e31632adb08b7abf70f78b5b2125 files/4-any/apache-2.0/70_mod_php.conf 485
 MD5 f0acca9c6387b8ca139d2849665bd16f files/4-any/php4-fastbuild.patch 9012
@@ -10,14 +7,20 @@ MD5 22ed61ab0175cd83985a90e5d2b3b8b2 files/4-any/php4-iodbc-config.diff 511
 MD5 a7036ee38aa3b37256c0a6fe2afdbbe2 files/4-any/php4-libtool-1.5.patch 613
 MD5 d3a9c21b313d418005ad021cc194d0aa files/4-any/php4-uClibc-have_dn_skipname.patch 968
 MD5 f2ab14c7be0482a4f25fc438fa6f5399 files/4-any/php4-with-iodbc.diff 443
+MD5 09637e8f6f861b1f3698ec0390ec6b57 files/4.3.11/php4.3.11-curl_safemode.patch 5129
 MD5 cb36a386184ed6a887f62d2205f57173 files/4.3.11/php4.3.11-fopen_wrappers.patch 1481
 MD5 4db8e0b66cde22dd4e4d9f51e59f6098 files/4.3.11/php4.3.11-gd_safe_mode.patch 1573
+MD5 480060d9a5de72030e2fce541e2830f8 files/4.3.11/php4.3.11-globals_overwrite.patch 18395
 MD5 3f80d0c6c58fd4ea02b7efdf69265721 files/4.3.11/php4.3.11-pcre-security.patch 1667
+MD5 43b4113d1fb159955b0d5ed307cac143 files/4.3.11/php4.3.11-phpinfo_xss.patch 2518
 MD5 48d9c939434e9b01d0696410d59c503c files/4.3.11/php4.3.11-pspell-ext-segf.patch 8482
 MD5 17b906361a7ab8a3008446871623eeae files/4.3.11/php4.3.11-session_save_path-segf.patch 4938
+MD5 0429f8334ba4bab659a2e41ce5debc80 files/4.4.0/php4.4.0-curl_safemode.patch 1937
 MD5 cb36a386184ed6a887f62d2205f57173 files/4.4.0/php4.4.0-fopen_wrappers.patch 1481
 MD5 a540c54ba22dc16b157edcf1ecb6258f files/4.4.0/php4.4.0-gd_safe_mode.patch 883
+MD5 ac3e0691fbecf920d030a35bc8e02109 files/4.4.0/php4.4.0-globals_overwrite.patch 10115
 MD5 5f1f48c87cafe0949e73ef064c99e5ed files/4.4.0/php4.4.0-pcre-security.patch 1741
+MD5 57644300fb52ad610fa52ae8ba6b522b files/4.4.0/php4.4.0-phpinfo_xss.patch 1284
 MD5 48d9c939434e9b01d0696410d59c503c files/4.4.0/php4.4.0-pspell-ext-segf.patch 8482
 MD5 83fb9efb602c178741ea2e40e13b014f files/4.4.0/php4.4.0-session_save_path-segf.patch 4132
 MD5 96ed6efe383833dbb880fef3b6c562bb files/5.0-any/apache-1.3/70_mod_php5.conf 524
@@ -28,14 +31,19 @@ MD5 7530065b6851a15b1c9d8b0ee5fb0a98 files/5.0-any/php5-libtool-1.5.patch 613
 MD5 058042718bc876bf27ab902673919ca9 files/5.0-any/php5-prefork.patch 850
 MD5 273799e60d5a41a1e6f5ac53781a152f files/5.0-any/php5-soap_persistence_session.diff 1976
 MD5 f2ab14c7be0482a4f25fc438fa6f5399 files/5.0-any/php5-with-iodbc.diff 443
+MD5 9a0a0587350d748d5fbbb3d34da7d488 files/5.0.4/php5.0.4-curl_safemode.patch 5262
 MD5 2eddbf70a0b940789a0e68f029beb2b3 files/5.0.4/php5.0.4-fopen_wrappers.patch 1554
 MD5 89b001b449fdd567ffba6aaf2a3e804f files/5.0.4/php5.0.4-gd_safe_mode.patch 1216
+MD5 923a659668d907e94d093486f7df6b94 files/5.0.4/php5.0.4-globals_overwrite.patch 32692
 MD5 03a57319b93ee44a2fe159a0fb67592e files/5.0.4/php5.0.4-pcre-security.patch 1659
+MD5 2c557f6641927cbf40e25abf71e46a1b files/5.0.4/php5.0.4-phpinfo_xss.patch 2476
 MD5 ab931f65aefab4da99c6353b2c503d70 files/5.0.4/php5.0.4-pspell-ext-segf.patch 9422
 MD5 a0b87571b3bf155e835edc4497d1c4bf files/5.0.4/php5.0.4-session_save_path-segf.patch 5127
 MD5 e157161249ad2b217dc532f5289ba74b files/5.0.4/php5.0.4-xmlrcp-ccode.diff 750
+MD5 3a3e34b20c95ab90b8a9ceeb787462bd files/5.0.5/php5.0.5-curl_safemode.patch 2061
 MD5 9e31c5edb0ded1d57ed90859d3ef168c files/5.0.5/php5.0.5-fopen_wrappers.patch 942
 MD5 8f52c6df24afb096109118582c1bf3eb files/5.0.5/php5.0.5-gd_safe_mode.patch 875
+MD5 fe69695583b11b8be29dd59318f77f68 files/5.0.5/php5.0.5-globals_overwrite.patch 6671
 MD5 b95f630e058c1b0f9cc47e186ef182cf files/5.0.5/php5.0.5-obj-serialize.patch 1364
 MD5 ab931f65aefab4da99c6353b2c503d70 files/5.0.5/php5.0.5-pspell-ext-segf.patch 9422
 MD5 8845848ffde7cfee1a3f57f6feaae8dd files/5.0.5/php5.0.5-session_save_path-segf.patch 4090
@@ -47,19 +55,14 @@ MD5 63c7937867dd8cc04b5089c3678ef359 files/5.1-any/php5-iodbc-config.diff 519
 MD5 058042718bc876bf27ab902673919ca9 files/5.1-any/php5-prefork.patch 850
 MD5 273799e60d5a41a1e6f5ac53781a152f files/5.1-any/php5-soap_persistence_session.diff 1976
 MD5 f2ab14c7be0482a4f25fc438fa6f5399 files/5.1-any/php5-with-iodbc.diff 443
-MD5 5f8f18e68edb61b60cfa21a4ff65170b files/digest-php-4.3.11-r2 223
-MD5 c9e2d252f3ae26871c06d35ebfe6fb1e files/digest-php-4.4.0-r2 221
-MD5 71facfede997494a03e635bc07a14a2f files/digest-php-5.0.4-r2 220
-MD5 96fdb35fc6f5b775c569db88d89200d7 files/digest-php-5.0.5-r2 143
+MD5 5f8f18e68edb61b60cfa21a4ff65170b files/digest-php-4.3.11-r3 223
+MD5 c9e2d252f3ae26871c06d35ebfe6fb1e files/digest-php-4.4.0-r3 221
+MD5 c4b89187ccc40af42b7304a0b74ee661 files/digest-php-4.4.1 63
+MD5 71facfede997494a03e635bc07a14a2f files/digest-php-5.0.4-r3 220
+MD5 96fdb35fc6f5b775c569db88d89200d7 files/digest-php-5.0.5-r3 143
 MD5 c58d07ca1c1235bbad9bccaec96fc062 metadata.xml 157
-MD5 67ba8c3a515b8bfa3bf1ae1e86384979 php-4.3.11-r2.ebuild 8861
-MD5 0002f829be314cc3df32a8881f3fe66a php-4.4.0-r2.ebuild 8862
-MD5 cc79bb6e1971f1aef8c625d2292c7602 php-5.0.4-r2.ebuild 5920
-MD5 7d1b40bbac8d9bb8c90219926183086f php-5.0.5-r2.ebuild 5387
------BEGIN PGP SIGNATURE-----
-Version: GnuPG v1.4.2 (GNU/Linux)
-
-iD8DBQFDaAQUgIKl8Uu19MoRArJaAJ91jSTfbX/Z9Jb8+nMdZaHqa3PzyACffmI5
-Z8NVCLuesYnM6VjlKRJD82M=
-=DRSm
------END PGP SIGNATURE-----
+MD5 dd4e596a3be26f261e3a5a52330f9b2d php-4.3.11-r3.ebuild 9240
+MD5 466de8a0d0e1860f4487428a1c7106d5 php-4.4.0-r3.ebuild 9235
+MD5 6af42707b3ac28685aed7d12667f6913 php-4.4.1.ebuild 7304
+MD5 6e8ab5a55a1bc9eda90d0f8fa7e93b32 php-5.0.4-r3.ebuild 6293
+MD5 6ad12146831f0ab9b9bae8a5f6bfe566 php-5.0.5-r3.ebuild 5654
diff --git a/dev-lang/php/files/4.3.11/php4.3.11-curl_safemode.patch b/dev-lang/php/files/4.3.11/php4.3.11-curl_safemode.patch
new file mode 100644
index 000000000000..f308dea57dde
--- /dev/null
+++ b/dev-lang/php/files/4.3.11/php4.3.11-curl_safemode.patch
@@ -0,0 +1,141 @@
+--- ext/curl/curl.c	2005-03-14 10:03:09.000000000 +0100
++++ ext/curl/curl.c	2005-10-17 04:42:51.000000000 +0200
+@@ -16,7 +16,7 @@
+    +----------------------------------------------------------------------+
+ */
+ 
+-/* $Id: curl.c,v 1.124.2.29 2005/03/14 09:03:09 sniper Exp $ */
++/* $Id: curl.c,v 1.124.2.30.2.3 2005/10/17 02:42:51 iliaa Exp $ */
+ 
+ #ifdef HAVE_CONFIG_H
+ #include "config.h"
+@@ -66,7 +66,7 @@
+ #define CAAZ(s, v) add_assoc_zval_ex(return_value, s, sizeof(s), (zval *) v);
+ 
+ #define PHP_CURL_CHECK_OPEN_BASEDIR(str, len)													\
+-	if (PG(open_basedir) && *PG(open_basedir) &&                                                \
++	if (((PG(open_basedir) && *PG(open_basedir)) || PG(safe_mode)) &&                                                \
+ 	    strncasecmp(str, "file://", sizeof("file://") - 1) == 0)								\
+ 	{ 																							\
+ 		php_url *tmp_url; 																		\
+@@ -76,7 +76,7 @@
+ 			RETURN_FALSE; 																		\
+ 		} 																						\
+ 																								\
+-		if (php_check_open_basedir(tmp_url->path TSRMLS_CC) || 									\
++		if (tmp_url->query || php_check_open_basedir(tmp_url->path TSRMLS_CC) || 									\
+ 			(PG(safe_mode) && !php_checkuid(tmp_url->path, "rb+", CHECKUID_CHECK_MODE_PARAM))	\
+ 		) { 																					\
+ 			php_url_free(tmp_url); 																\
+@@ -436,10 +436,12 @@
+ 		zend_list_addref(ch->id);
+ 		ZVAL_STRINGL(argv[1], data, length, 1);
+ 
++		ch->in_callback = 1;
+ 		error = call_user_function(EG(function_table),
+ 		                           NULL,
+ 		                           t->func,
+ 		                           retval, 2, argv TSRMLS_CC);
++		ch->in_callback = 0;
+ 		if (error == FAILURE) {
+ 			php_error(E_WARNING, "%s(): Couldn't call the CURLOPT_WRITEFUNCTION", 
+ 					  get_active_function_name(TSRMLS_C));
+@@ -495,10 +497,12 @@
+ 		zend_list_addref(t->fd);
+ 		ZVAL_LONG(argv[2], (int) size * nmemb);
+ 
++		ch->in_callback = 1;
+ 		error = call_user_function(EG(function_table),
+ 		                           NULL,
+ 		                           t->func,
+ 		                           retval, 3, argv TSRMLS_CC);
++		ch->in_callback = 0;
+ 		if (error == FAILURE) {
+ 			php_error(E_WARNING, "%s(): Cannot call the CURLOPT_READFUNCTION", 
+ 					  get_active_function_name(TSRMLS_C));
+@@ -553,10 +557,12 @@
+ 			zend_list_addref(ch->id);
+ 			ZVAL_STRINGL(argv[1], data, length, 1);
+ 
++			ch->in_callback = 1;
+ 			error = call_user_function(EG(function_table),
+ 									   NULL,
+ 									   t->func,
+ 									   retval, 2, argv TSRMLS_CC);
++			ch->in_callback = 0;
+ 			if (error == FAILURE) {
+ 				php_error(E_WARNING, "%s(): Couldn't call the CURLOPT_HEADERFUNCTION", 
+ 						  get_active_function_name(TSRMLS_C));
+@@ -606,10 +612,12 @@
+ 	ZVAL_STRING(argv[1], prompt, 1);
+ 	ZVAL_LONG(argv[2], buflen);
+ 
++	ch->in_callback = 1;
+ 	error = call_user_function(EG(function_table),
+ 	                           NULL,
+ 	                           func,
+ 	                           retval, 2, argv TSRMLS_CC);
++	ch->in_callback = 0;
+ 	if (error == FAILURE) {
+ 		php_error(E_WARNING, "%s(): Couldn't call the CURLOPT_PASSWDFUNCTION", get_active_function_name(TSRMLS_C));
+ 	} else if (Z_TYPE_P(retval) == IS_STRING) {
+@@ -680,7 +688,9 @@
+ 	(*ch)->handlers->write_header = ecalloc(1, sizeof(php_curl_write));
+ 	(*ch)->handlers->read  = ecalloc(1, sizeof(php_curl_read));
+ 	memset(&(*ch)->err, 0, sizeof((*ch)->err));
+-	
++
++	(*ch)->in_callback = 0;
++
+ 	zend_llist_init(&(*ch)->to_free.str, sizeof(char *), 
+ 	                (void(*)(void *)) curl_free_string, 0);
+ 	zend_llist_init(&(*ch)->to_free.slist, sizeof(struct curl_slist),
+@@ -982,10 +992,15 @@
+ 				
+ 					postval = Z_STRVAL_PP(current);
+ 					if (*postval == '@') {
++						++postval;
++						/* safe_mode / open_basedir check */
++						if (php_check_open_basedir(postval TSRMLS_CC) || (PG(safe_mode) && !php_checkuid(postval, "rb+", CHECKUID_CHECK_MODE_PARAM))) {
++							RETURN_FALSE;
++						}
+ 						error = curl_formadd(&first, &last, 
+ 											 CURLFORM_COPYNAME, string_key,
+ 											 CURLFORM_NAMELENGTH, (long)string_key_len - 1,
+-											 CURLFORM_FILE, ++postval, 
++											 CURLFORM_FILE, postval, 
+ 											 CURLFORM_END);
+ 					}
+ 					else {
+@@ -1337,7 +1352,11 @@
+ 		WRONG_PARAM_COUNT;
+ 	}
+ 	ZEND_FETCH_RESOURCE(ch, php_curl *, zid, -1, le_curl_name, le_curl);
+-	
++
++	if (ch->in_callback) {
++		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Attempt to close CURL handle from a callback");
++		return;
++	}
+ 	zend_list_delete(Z_LVAL_PP(zid));
+ }
+ /* }}} */
+--- ext/curl/php_curl.h	2002-12-31 17:34:15.000000000 +0100
++++ ext/curl/php_curl.h	2005-06-02 23:05:06.000000000 +0200
+@@ -17,7 +17,7 @@
+    +----------------------------------------------------------------------+
+ */
+ 
+-/* $Id: php_curl.h,v 1.29.2.1 2002/12/31 16:34:15 sebastian Exp $ */
++/* $Id: php_curl.h,v 1.29.2.2 2005/06/02 21:05:06 tony2001 Exp $ */
+ 
+ #ifndef _PHP_CURL_H
+ #define _PHP_CURL_H
+@@ -93,6 +93,7 @@
+ 	struct _php_curl_free    to_free;
+ 	long                     id;
+ 	unsigned int             uses;
++	zend_bool                in_callback;
+ } php_curl;
+ 
+ /* streams support */
diff --git a/dev-lang/php/files/4.3.11/php4.3.11-globals_overwrite.patch b/dev-lang/php/files/4.3.11/php4.3.11-globals_overwrite.patch
new file mode 100644
index 000000000000..d3eb55c5ee3e
--- /dev/null
+++ b/dev-lang/php/files/4.3.11/php4.3.11-globals_overwrite.patch
@@ -0,0 +1,559 @@
+--- ext/standard/array.c	2004-12-23 17:40:03.000000000 +0100
++++ ext/standard/array.c	2005-10-31 23:26:23.000000000 +0100
+@@ -22,7 +22,7 @@
+ */
+ 
+ 
+-/* $Id: array.c,v 1.199.2.42 2004/12/23 16:40:03 tony2001 Exp $ */
++/* $Id: array.c,v 1.199.2.44.2.9 2005/10/03 14:05:07 iliaa Exp $ */
+ 
+ #include "php.h"
+ #include "php_ini.h"
+@@ -631,7 +640,7 @@
+ 	s = *((Bucket **) b);
+ 
+ 	if (f->nKeyLength) {
+-		Z_STRVAL(key1) = estrndup(f->arKey, f->nKeyLength);
++		Z_STRVAL(key1) = estrndup(f->arKey, f->nKeyLength-1);
+ 		Z_STRLEN(key1) = f->nKeyLength-1;
+ 		Z_TYPE(key1) = IS_STRING;
+ 	} else {
+@@ -639,7 +648,7 @@
+ 		Z_TYPE(key1) = IS_LONG;
+ 	}
+ 	if (s->nKeyLength) {
+-		Z_STRVAL(key2) = estrndup(s->arKey, s->nKeyLength);
++		Z_STRVAL(key2) = estrndup(s->arKey, s->nKeyLength-1);
+ 		Z_STRLEN(key2) = s->nKeyLength-1;
+ 		Z_TYPE(key2) = IS_STRING;
+ 	} else {
+@@ -1243,6 +1252,10 @@
+ 				/* break omitted intentionally */
+ 
+ 			case EXTR_OVERWRITE:
++				/* GLOBALS protection */
++				if (var_exists && !strcmp(var_name, "GLOBALS")) {
++					break;
++				}
+ 				smart_str_appendl(&final_name, var_name, var_name_len);
+ 				break;
+ 
+@@ -1291,14 +1304,18 @@
+ 					zval **orig_var;
+ 
+ 					if (zend_hash_find(EG(active_symbol_table), final_name.c, final_name.len+1, (void **) &orig_var) == SUCCESS) {
+-						zval_ptr_dtor(orig_var);
+-
+ 						SEPARATE_ZVAL_TO_MAKE_IS_REF(entry);
+ 						zval_add_ref(entry);
+ 						
++						zval_ptr_dtor(orig_var);
++
+ 						*orig_var = *entry;
+ 					} else {
+-						(*entry)->is_ref = 1;
++						if ((*var_array)->refcount > 1) {
++							SEPARATE_ZVAL_TO_MAKE_IS_REF(entry);
++						} else {
++							(*entry)->is_ref = 1;
++						}
+ 						zval_add_ref(entry);
+ 						zend_hash_update(EG(active_symbol_table), final_name.c, final_name.len+1, (void **) entry, sizeof(zval *), NULL);
+ 					}
+@@ -1818,8 +1835,8 @@
+ 	   hashtable and replace it with new one */
+ 	new_hash = php_splice(Z_ARRVAL_P(stack), 0, 0, &args[1], argc-1, NULL);
+ 	zend_hash_destroy(Z_ARRVAL_P(stack));
+-	efree(Z_ARRVAL_P(stack));
+-	Z_ARRVAL_P(stack) = new_hash;
++	*Z_ARRVAL_P(stack) = *new_hash;
++	FREE_HASHTABLE(new_hash);
+ 
+ 	/* Clean up and return the number of elements in the stack */
+ 	efree(args);
+@@ -1896,8 +1913,8 @@
+ 	
+ 	/* Replace input array's hashtable with the new one */
+ 	zend_hash_destroy(Z_ARRVAL_P(array));
+-	efree(Z_ARRVAL_P(array));
+-	Z_ARRVAL_P(array) = new_hash;
++	*Z_ARRVAL_P(array) = *new_hash;
++	FREE_HASHTABLE(new_hash);
+ 	
+ 	/* Clean up */
+ 	if (argc == 4)
+@@ -2384,8 +2401,8 @@
+ 	
+ 	/* Copy the result hash into return value */
+ 	zend_hash_destroy(Z_ARRVAL_P(return_value));
+-	efree(Z_ARRVAL_P(return_value));
+-	Z_ARRVAL_P(return_value) = new_hash;
++	*Z_ARRVAL_P(return_value) = *new_hash;
++	FREE_HASHTABLE(new_hash);
+ 	
+ 	/* Clean up */
+ 	efree(pads);
+@@ -2483,7 +2500,7 @@
+ 				zend_hash_index_update(Z_ARRVAL_P(return_value), num_key, entry, sizeof(entry), NULL);
+ 				break;
+ 			case HASH_KEY_IS_STRING:
+-				new_key=estrndup(string_key,str_key_len);
++				new_key=estrndup(string_key,str_key_len - 1);
+ 				if (change_to_upper)
+ 					php_strtoupper(new_key, str_key_len - 1);
+ 				else
+@@ -2609,6 +2626,15 @@
+ 	/* copy the argument array */
+ 	*return_value = **args[0];
+ 	zval_copy_ctor(return_value);
++	if (return_value->value.ht == &EG(symbol_table)) {
++		HashTable *ht;
++		zval *tmp;
++
++		ALLOC_HASHTABLE(ht);
++		zend_hash_init(ht, 0, NULL, ZVAL_PTR_DTOR, 0);
++		zend_hash_copy(ht, return_value->value.ht, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
++		return_value->value.ht = ht;		
++	}
+ 
+ 	/* go through the lists and look for common values */
+ 	while (*ptrs[0]) {
+@@ -2759,6 +2785,15 @@
+ 	/* copy the argument array */
+ 	*return_value = **args[0];
+ 	zval_copy_ctor(return_value);
++	if (return_value->value.ht == &EG(symbol_table)) {
++		HashTable *ht;
++		zval *tmp;
++
++		ALLOC_HASHTABLE(ht);
++		zend_hash_init(ht, 0, NULL, ZVAL_PTR_DTOR, 0);
++		zend_hash_copy(ht, return_value->value.ht, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
++		return_value->value.ht = ht;		
++	}
+ 
+ 	/* go through the lists and look for values of ptr[0]
+ 		   that are not in the others */
+@@ -3229,8 +3264,11 @@
+ 	efree(callback_name);
+ 
+ 	if (ZEND_NUM_ARGS() > 2) {
+-		convert_to_long_ex(initial);
+-		result = *initial;
++		ALLOC_ZVAL(result);
++		*result = **initial;
++		zval_copy_ctor(result);
++		convert_to_long(result);
++		INIT_PZVAL(result);
+ 	} else {
+ 		MAKE_STD_ZVAL(result);
+ 		ZVAL_NULL(result);
+@@ -3246,6 +3284,7 @@
+ 		if (result) {
+ 			*return_value = *result;
+ 			zval_copy_ctor(return_value);
++			zval_ptr_dtor(&result);
+ 		}
+ 		return;
+ 	}
+@@ -3282,6 +3321,7 @@
+ PHP_FUNCTION(array_filter)
+ {
+ 	zval **input, **callback = NULL;
++	zval *array, *func = NULL;
+ 	zval **operand;
+ 	zval **args[1];
+ 	zval *retval = NULL;
+@@ -3300,9 +3340,13 @@
+ 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "The first argument should be an array");
+ 		return;
+ 	}
++	if (callback) {
++		func = *callback;
++	}
++	array = *input;
+ 
+ 	if (ZEND_NUM_ARGS() > 1) {
+-		if (!zend_is_callable(*callback, 0, &callback_name)) {
++		if (!zend_is_callable(func, 0, &callback_name)) {
+ 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "The second argument, '%s', should be a valid callback", callback_name);
+ 			efree(callback_name);
+ 			return;
+@@ -3311,16 +3355,16 @@
+ 	}
+ 
+ 	array_init(return_value);
+-	if (zend_hash_num_elements(Z_ARRVAL_PP(input)) == 0)
++	if (zend_hash_num_elements(Z_ARRVAL_P(array)) == 0)
+ 		return;
+ 
+-	for (zend_hash_internal_pointer_reset_ex(Z_ARRVAL_PP(input), &pos);
+-		 zend_hash_get_current_data_ex(Z_ARRVAL_PP(input), (void **)&operand, &pos) == SUCCESS;
+-		 zend_hash_move_forward_ex(Z_ARRVAL_PP(input), &pos)) {
++	for (zend_hash_internal_pointer_reset_ex(Z_ARRVAL_P(array), &pos);
++		 zend_hash_get_current_data_ex(Z_ARRVAL_P(array), (void **)&operand, &pos) == SUCCESS;
++		 zend_hash_move_forward_ex(Z_ARRVAL_P(array), &pos)) {
+ 
+-		if (callback) {
++		if (func) {
+ 			args[0] = operand;
+-			if (call_user_function_ex(EG(function_table), NULL, *callback, &retval, 1, args, 0, NULL TSRMLS_CC) == SUCCESS && retval) {
++			if (call_user_function_ex(EG(function_table), NULL, func, &retval, 1, args, 0, NULL TSRMLS_CC) == SUCCESS && retval) {
+ 				if (!zend_is_true(retval)) {
+ 					zval_ptr_dtor(&retval);
+ 					continue;
+@@ -3334,7 +3378,7 @@
+ 			continue;
+ 
+ 		zval_add_ref(operand);
+-		switch (zend_hash_get_current_key_ex(Z_ARRVAL_PP(input), &string_key, &string_key_len, &num_key, 0, &pos)) {
++		switch (zend_hash_get_current_key_ex(Z_ARRVAL_P(array), &string_key, &string_key_len, &num_key, 0, &pos)) {
+ 			case HASH_KEY_IS_STRING:
+ 				zend_hash_update(Z_ARRVAL_P(return_value), string_key,
+ 								 string_key_len, operand, sizeof(zval *), NULL);
+@@ -3401,6 +3445,7 @@
+ 			efree(array_pos);
+ 			return;
+ 		}
++		SEPARATE_ZVAL_IF_NOT_REF(pargs[i]);
+ 		args[i] = *pargs[i];
+ 		array_len[i] = zend_hash_num_elements(Z_ARRVAL_PP(pargs[i]));
+ 		if (array_len[i] > maxlen) {
+--- ext/standard/basic_functions.c	2005-01-18 12:01:20.000000000 +0100
++++ ext/standard/basic_functions.c	2005-10-31 23:29:26.000000000 +0100
+@@ -17,7 +17,7 @@
+    +----------------------------------------------------------------------+
+  */
+ 
+-/* $Id: basic_functions.c,v 1.543.2.47 2005/01/18 11:01:20 sniper Exp $ */
++/* $Id: basic_functions.c,v 1.543.2.51.2.3 2005/09/29 16:31:48 iliaa Exp $ */
+ 
+ #include "php.h"
+ #include "php_streams.h"
+@@ -42,18 +42,7 @@
+ #include <time.h>
+ #include <stdio.h>
+ 
+-#ifndef NETWARE
+ #include <netdb.h>
+-#else
+-/*#include "netware/env.h"*/    /* Temporary */
+-#ifdef NEW_LIBC /* Same headers hold good for Winsock and Berkeley sockets */
+-#include <netinet/in.h>
+-/*#include <arpa/inet.h>*/
+-#include <netdb.h>
+-#else
+-#include <sys/socket.h>
+-#endif
+-#endif
+ 
+ #if HAVE_ARPA_INET_H
+ # include <arpa/inet.h>
+@@ -813,8 +802,8 @@
+ 	PHP_FE(prev,					first_arg_force_ref)
+ 	PHP_FE(next,					first_arg_force_ref)
+ 	PHP_FE(reset,					first_arg_force_ref)
+-	PHP_FE(current,					first_arg_force_ref)
+-	PHP_FE(key,						first_arg_force_ref)
++	PHP_FE(current,					NULL)
++	PHP_FE(key,					NULL)
+ 	PHP_FE(min,																NULL)
+ 	PHP_FE(max,																NULL)
+ 	PHP_FE(in_array,														NULL)
+@@ -944,6 +933,13 @@
+ static void php_putenv_destructor(putenv_entry *pe)
+ {
+ 	if (pe->previous_value) {
++#if _MSC_VER
++		/* VS.Net has a bug in putenv() when setting a variable that
++		 * is already set; if the SetEnvironmentVariable() API call
++		 * fails, the Crt will double free() a string.
++		 * We try to avoid this by setting our own value first */
++		SetEnvironmentVariable(pe->key, "bugbug");
++#endif
+ 		putenv(pe->previous_value);
+ 	} else {
+ # if HAVE_UNSETENV
+@@ -1232,11 +1228,10 @@
+ 	}
+ 	STR_FREE(BG(locale_string));
+ 
+-	if (FG(stream_wrappers)) {
+-		zend_hash_destroy(FG(stream_wrappers));
+-		efree(FG(stream_wrappers));
+-		FG(stream_wrappers) = NULL;
+- 	}
++	/*
++	 FG(stream_wrappers) are destroyed
++	 during php_request_shutdown()
++	 */
+ 
+ 	PHP_RSHUTDOWN(fsock) (SHUTDOWN_FUNC_ARGS_PASSTHRU);
+ 	PHP_RSHUTDOWN(filestat) (SHUTDOWN_FUNC_ARGS_PASSTHRU);
+@@ -1430,6 +1425,14 @@
+ 			}
+ 		}
+ 
++#if _MSC_VER
++		/* VS.Net has a bug in putenv() when setting a variable that
++		 * is already set; if the SetEnvironmentVariable() API call
++		 * fails, the Crt will double free() a string.
++		 * We try to avoid this by setting our own value first */
++		SetEnvironmentVariable(pe.key, "bugbug");
++#endif
++
+ 		if (putenv(pe.putenv_string) == 0) {	/* success */
+ 			zend_hash_add(&BG(putenv_ht), pe.key, pe.key_len+1, (void **) &pe, sizeof(putenv_entry), NULL);
+ #ifdef HAVE_TZSET
+@@ -2089,17 +2092,21 @@
+ static int user_shutdown_function_call(php_shutdown_function_entry *shutdown_function_entry TSRMLS_DC)
+ {
+ 	zval retval;
++	char *function_name = NULL;
+ 
+-	if (call_user_function(	EG(function_table), NULL,
+-							shutdown_function_entry->arguments[0],
+-							&retval, 
+-							shutdown_function_entry->arg_count - 1,
+-							shutdown_function_entry->arguments + 1 
+-							TSRMLS_CC ) == SUCCESS ) {
++	if (!zend_is_callable(shutdown_function_entry->arguments[0], 0, &function_name)) {
++		php_error(E_WARNING, "(Registered shutdown functions) Unable to call %s() - function does not exist", function_name);
++	} else if (call_user_function(EG(function_table), NULL,
++								shutdown_function_entry->arguments[0],
++								&retval, 
++								shutdown_function_entry->arg_count - 1,
++								shutdown_function_entry->arguments + 1 
++								TSRMLS_CC ) == SUCCESS)
++	{
+ 		zval_dtor(&retval);
+-
+-	} else {
+-		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to call %s() - function does not exist", Z_STRVAL_P(shutdown_function_entry->arguments[0]));
++	} 
++	if (function_name) {
++		efree(function_name);
+ 	}
+ 	return 0;
+ }
+@@ -2192,6 +2199,7 @@
+ PHP_FUNCTION(register_shutdown_function)
+ {
+ 	php_shutdown_function_entry shutdown_function_entry;
++	char *function_name = NULL;
+ 	int i;
+ 
+ 	shutdown_function_entry.arg_count = ZEND_NUM_ARGS();
+@@ -2200,26 +2208,31 @@
+ 		WRONG_PARAM_COUNT;
+ 	}
+ 
+-	shutdown_function_entry.arguments = (pval **) safe_emalloc(sizeof(pval *), shutdown_function_entry.arg_count, 0);
++	shutdown_function_entry.arguments = (zval **) safe_emalloc(sizeof(zval *), shutdown_function_entry.arg_count, 0);
+ 
+ 	if (zend_get_parameters_array(ht, shutdown_function_entry.arg_count, shutdown_function_entry.arguments) == FAILURE) {
+ 		RETURN_FALSE;
+ 	}
+ 	
+-	/* Prevent entering of anything but arrays/strings */
+-	if (Z_TYPE_P(shutdown_function_entry.arguments[0]) != IS_ARRAY) {
+-		convert_to_string(shutdown_function_entry.arguments[0]);
+-	}
+-	
+-	if (!BG(user_shutdown_function_names)) {
+-		ALLOC_HASHTABLE(BG(user_shutdown_function_names));
+-		zend_hash_init(BG(user_shutdown_function_names), 0, NULL, (void (*)(void *)) user_shutdown_function_dtor, 0);
+-	}
++	/* Prevent entering of anything but valid callback (syntax check only!) */
++	if (!zend_is_callable(shutdown_function_entry.arguments[0], 1, &function_name)) {
++		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid shutdown callback '%s' passed", function_name);
++		efree(shutdown_function_entry.arguments);
++		RETVAL_FALSE;
++	} else {
++		if (!BG(user_shutdown_function_names)) {
++			ALLOC_HASHTABLE(BG(user_shutdown_function_names));
++			zend_hash_init(BG(user_shutdown_function_names), 0, NULL, (void (*)(void *)) user_shutdown_function_dtor, 0);
++		}
+ 
+-	for (i = 0; i < shutdown_function_entry.arg_count; i++) {
+-		shutdown_function_entry.arguments[i]->refcount++;
++		for (i = 0; i < shutdown_function_entry.arg_count; i++) {
++			shutdown_function_entry.arguments[i]->refcount++;
++		}
++		zend_hash_next_index_insert(BG(user_shutdown_function_names), &shutdown_function_entry, sizeof(php_shutdown_function_entry), NULL);
++	}
++	if (function_name) {
++		efree(function_name);
+ 	}
+-	zend_hash_next_index_insert(BG(user_shutdown_function_names), &shutdown_function_entry, sizeof(php_shutdown_function_entry), NULL);
+ }
+ /* }}} */
+ 
+@@ -3014,11 +3027,25 @@
+ 	prefix = va_arg(args, char *);
+ 	prefix_len = va_arg(args, uint);
+ 
+-	new_key_len = prefix_len + hash_key->nKeyLength;
+-	new_key = (char *) emalloc(new_key_len);
++	if (!prefix_len) {
++		if (!hash_key->nKeyLength) {
++			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Numeric key detected - possible security hazard.");
++			return 0;
++		} else if (!strcmp(hash_key->arKey, "GLOBALS")) {
++			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Attempted GLOBALS variable overwrite.");
++			return 0; 
++		}
++	}
++
++	if (hash_key->nKeyLength) {
++		new_key_len = prefix_len + hash_key->nKeyLength;
++		new_key = (char *) emalloc(new_key_len);
+ 
+-	memcpy(new_key, prefix, prefix_len);
+-	memcpy(new_key+prefix_len, hash_key->arKey, hash_key->nKeyLength);
++		memcpy(new_key, prefix, prefix_len);
++		memcpy(new_key+prefix_len, hash_key->arKey, hash_key->nKeyLength);
++	} else {
++		new_key_len = spprintf(&new_key, 0, "%s%ld", prefix, hash_key->h);
++	}
+ 
+ 	zend_hash_del(&EG(symbol_table), new_key, new_key_len);
+ 	ZEND_SET_SYMBOL_WITH_LENGTH(&EG(symbol_table), new_key, new_key_len, *var, (*var)->refcount+1, 0);
+--- ext/standard/string.c	2005-01-20 18:57:41.000000000 +0100
++++ ext/standard/string.c	2005-10-31 23:34:37.000000000 +0100
+@@ -18,7 +18,7 @@
+    +----------------------------------------------------------------------+
+  */
+ 
+-/* $Id: string.c,v 1.333.2.48 2005/01/20 17:57:41 iliaa Exp $ */
++/* $Id: string.c,v 1.333.2.52.2.1 2005/09/28 22:34:04 iliaa Exp $ */
+ 
+ /* Synced with php 3.0 revision 1.193 1999-06-16 [ssb] */
+ 
+@@ -1317,8 +1317,6 @@
+ 		if (!Z_STRLEN_PP(needle)) {
+ 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Empty delimiter.");
+ 			efree(haystack_orig);
+-			zval_ptr_dtor(haystack);
+-			zval_ptr_dtor(needle);
+ 			RETURN_FALSE;
+ 		}
+ 
+@@ -1339,8 +1337,6 @@
+ 		RETVAL_FALSE;
+ 	}
+ 
+-	zval_ptr_dtor(haystack);
+-	zval_ptr_dtor(needle);
+ 	efree(haystack_orig);
+ }
+ /* }}} */
+@@ -1576,7 +1572,13 @@
+ 	}
+ 
+ 	if (chunklen > Z_STRLEN_PP(p_str)) {
+-		RETURN_STRINGL(Z_STRVAL_PP(p_str), Z_STRLEN_PP(p_str), 1);	
++		/* to maintain BC, we must return original string + ending */
++		result_len = endlen + Z_STRLEN_PP(p_str);
++		result = emalloc(result_len + 1);
++		memcpy(result, Z_STRVAL_PP(p_str), Z_STRLEN_PP(p_str));
++		memcpy(result + Z_STRLEN_PP(p_str), end, endlen);
++		result[result_len] = '\0'; 
++		RETURN_STRINGL(result, result_len, 0);	
+ 	}
+ 
+ 	if (!Z_STRLEN_PP(p_str)) {
+@@ -3169,7 +3179,6 @@
+ 	zval *sarg;
+ 	char *res = NULL;
+ 	int argCount;
+-	int old_rg;
+ 
+ 	argCount = ARG_COUNT(ht);
+ 	if (argCount < 1 || argCount > 2 || zend_get_parameters_ex(argCount, &arg, &arrayArg) == FAILURE) {
+@@ -3182,19 +3191,18 @@
+ 		res = estrndup(Z_STRVAL_P(sarg), Z_STRLEN_P(sarg));
+ 	}
+ 
+-	old_rg = PG(register_globals);
+ 	if (argCount == 1) {
+-		PG(register_globals) = 1;
+-		sapi_module.treat_data(PARSE_STRING, res, NULL TSRMLS_CC);
++		zval tmp;
++		Z_ARRVAL(tmp) = EG(active_symbol_table);
++
++		sapi_module.treat_data(PARSE_STRING, res, &tmp TSRMLS_CC);
+ 	} else 	{
+-		PG(register_globals) = 0;
+ 		/* Clear out the array that was passed in. */
+ 		zval_dtor(*arrayArg);
+ 		array_init(*arrayArg);
+ 		
+ 		sapi_module.treat_data(PARSE_STRING, res, *arrayArg TSRMLS_CC);
+ 	}
+-	PG(register_globals) = old_rg;
+ }
+ /* }}} */
+ 
+--- main/php_variables.c	2004-10-18 17:08:46.000000000 +0200
++++ main/php_variables.c	2005-10-31 23:39:38.000000000 +0100
+@@ -16,7 +16,7 @@
+    |          Zeev Suraski <zeev@zend.com>                                |
+    +----------------------------------------------------------------------+
+  */
+-/* $Id: php_variables.c,v 1.45.2.8 2004/10/18 15:08:46 tony2001 Exp $ */
++/* $Id: php_variables.c,v 1.45.2.13.2.4 2005/10/02 11:33:27 rrichards Exp $ */
+ 
+ #include <stdio.h>
+ #include "php.h"
+@@ -73,6 +73,10 @@
+ 		symtable1 = Z_ARRVAL_P(track_vars_array);
+ 	} else if (PG(register_globals)) {
+ 		symtable1 = EG(active_symbol_table);
++		/* GLOBALS hijack attempt, reject parameter */
++		if (!strncmp("GLOBALS", var, sizeof("GLOBALS")) || !strncmp("GLOBALS", var, sizeof("GLOBALS[")-1)) {
++			return;
++		}
+ 	}
+ 	if (!symtable1) {
+ 		/* Nothing to do */
+@@ -99,6 +103,13 @@
+ 		zval_dtor(val);
+ 		return;
+ 	}
++
++	/* GLOBALS hijack attempt, reject parameter */
++	if (symtable1 == EG(active_symbol_table) && !strcmp("GLOBALS", var)) {
++		zval_dtor(val);
++		return;
++	}
++
+ 	/* ensure that we don't have spaces or dots in the variable name (not binary safe) */
+ 	for (p=var; *p; p++) {
+ 		switch(*p) {
+@@ -182,11 +193,25 @@
+ 			if (!index) {
+ 				zend_hash_next_index_insert(symtable1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p);
+ 			} else {
++				zval **tmp;
++			
+ 				if (PG(magic_quotes_gpc) && (index!=var)) {
+ 					char *escaped_index = php_addslashes(index, index_len, &index_len, 0 TSRMLS_CC);
++					
++					if (PG(http_globals)[TRACK_VARS_COOKIE] && symtable1 == Z_ARRVAL_P(PG(http_globals)[TRACK_VARS_COOKIE]) && 
++							zend_hash_find(symtable1, escaped_index, index_len+1, (void **) &tmp) != FAILURE) {
++						efree(escaped_index);
++						break;
++					}
++					
+ 					zend_hash_update(symtable1, escaped_index, index_len+1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p);
+ 					efree(escaped_index);
+ 				} else {
++					if (PG(http_globals)[TRACK_VARS_COOKIE] && symtable1 == Z_ARRVAL_P(PG(http_globals)[TRACK_VARS_COOKIE]) && 
++							zend_hash_find(symtable1, index, index_len+1, (void **) &tmp) != FAILURE) {
++						break;
++					}
++				
+ 					zend_hash_update(symtable1, index, index_len+1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p);
+ 				}
+ 			}
diff --git a/dev-lang/php/files/4.3.11/php4.3.11-phpinfo_xss.patch b/dev-lang/php/files/4.3.11/php4.3.11-phpinfo_xss.patch
new file mode 100644
index 000000000000..2c7d9991794f
--- /dev/null
+++ b/dev-lang/php/files/4.3.11/php4.3.11-phpinfo_xss.patch
@@ -0,0 +1,75 @@
+--- ext/standard/info.c	2004-06-09 17:10:19.000000000 +0200
++++ ext/standard/info.c	2005-11-01 01:22:42.000000000 +0100
+@@ -18,7 +18,7 @@
+    +----------------------------------------------------------------------+
+ */
+ 
+-/* $Id: info.c,v 1.218.2.16 2004/06/09 15:10:19 iliaa Exp $ */
++/* $Id: info.c,v 1.218.2.18.2.4 2005/08/16 00:26:02 iliaa Exp $ */
+ 
+ #include "php.h"
+ #include "php_ini.h"
+@@ -133,10 +133,21 @@
+ 				PUTS(" => ");
+ 			}
+ 			if (Z_TYPE_PP(tmp) == IS_ARRAY) {
++				zval *tmp3;
++				MAKE_STD_ZVAL(tmp3);
+ 				if (!sapi_module.phpinfo_as_text) {
+ 					PUTS("<pre>");
+ 				}
++				php_start_ob_buffer(NULL, 4096, 1 TSRMLS_CC);
+ 				zend_print_zval_r(*tmp, 0);
++				php_ob_get_buffer(tmp3 TSRMLS_CC);
++				php_end_ob_buffer(0, 0 TSRMLS_CC);
++				
++				elem_esc = php_info_html_esc(Z_STRVAL_P(tmp3) TSRMLS_CC);
++				PUTS(elem_esc);
++				efree(elem_esc);
++				zval_ptr_dtor(&tmp3);
++
+ 				if (!sapi_module.phpinfo_as_text) {
+ 					PUTS("</pre>");
+ 				}
+@@ -196,7 +207,7 @@
+ PHPAPI char *php_info_html_esc(char *string TSRMLS_DC)
+ {
+ 	int new_len;
+-	return php_escape_html_entities(string, strlen(string), &new_len, 0, ENT_NOQUOTES, NULL TSRMLS_CC);
++	return php_escape_html_entities(string, strlen(string), &new_len, 0, ENT_QUOTES, NULL TSRMLS_CC);
+ }
+ /* }}} */
+ 
+@@ -408,7 +419,9 @@
+ 		if (expose_php && !sapi_module.phpinfo_as_text) {
+ 			PUTS("<a href=\"http://www.php.net/\"><img border=\"0\" src=\"");
+ 			if (SG(request_info).request_uri) {
+-				PUTS(SG(request_info).request_uri);
++				char *elem_esc = php_info_html_esc(SG(request_info).request_uri TSRMLS_CC);
++				PUTS(elem_esc);
++				efree(elem_esc);
+ 			}
+ 			if ((ta->tm_mon==3) && (ta->tm_mday==1)) {
+ 				PUTS("?="PHP_EGG_LOGO_GUID"\" alt=\"Nadia!\" /></a>");
+@@ -510,7 +529,9 @@
+ 		if (expose_php && !sapi_module.phpinfo_as_text) {
+ 			PUTS("<a href=\"http://www.zend.com/\"><img border=\"0\" src=\"");
+ 			if (SG(request_info).request_uri) {
+-				PUTS(SG(request_info).request_uri);
++				char *elem_esc = php_info_html_esc(SG(request_info).request_uri TSRMLS_CC);
++				PUTS(elem_esc);
++				efree(elem_esc);
+ 			}
+ 			PUTS("?="ZEND_LOGO_GUID"\" alt=\"Zend logo\" /></a>\n");
+ 		}
+@@ -525,7 +546,9 @@
+ 		php_info_print_hr();
+ 		PUTS("<h1><a href=\"");
+ 		if (SG(request_info).request_uri) {
+-			PUTS(SG(request_info).request_uri);
++			char *elem_esc = php_info_html_esc(SG(request_info).request_uri TSRMLS_CC);
++			PUTS(elem_esc);
++			efree(elem_esc);
+ 		}
+ 		PUTS("?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000\">");
+ 		PUTS("PHP Credits");
diff --git a/dev-lang/php/files/4.4.0/php4.4.0-curl_safemode.patch b/dev-lang/php/files/4.4.0/php4.4.0-curl_safemode.patch
new file mode 100644
index 000000000000..32a82e072077
--- /dev/null
+++ b/dev-lang/php/files/4.4.0/php4.4.0-curl_safemode.patch
@@ -0,0 +1,46 @@
+--- ext/curl/curl.c	2005-06-02 23:05:06.000000000 +0200
++++ ext/curl/curl.c	2005-10-17 04:42:51.000000000 +0200
+@@ -16,7 +16,7 @@
+    +----------------------------------------------------------------------+
+ */
+ 
+-/* $Id: curl.c,v 1.124.2.30 2005/06/02 21:05:06 tony2001 Exp $ */
++/* $Id: curl.c,v 1.124.2.30.2.3 2005/10/17 02:42:51 iliaa Exp $ */
+ 
+ #ifdef HAVE_CONFIG_H
+ #include "config.h"
+@@ -66,7 +66,7 @@
+ #define CAAZ(s, v) add_assoc_zval_ex(return_value, s, sizeof(s), (zval *) v);
+ 
+ #define PHP_CURL_CHECK_OPEN_BASEDIR(str, len)													\
+-	if (PG(open_basedir) && *PG(open_basedir) &&                                                \
++	if (((PG(open_basedir) && *PG(open_basedir)) || PG(safe_mode)) &&                                                \
+ 	    strncasecmp(str, "file://", sizeof("file://") - 1) == 0)								\
+ 	{ 																							\
+ 		php_url *tmp_url; 																		\
+@@ -76,7 +76,7 @@
+ 			RETURN_FALSE; 																		\
+ 		} 																						\
+ 																								\
+-		if (php_check_open_basedir(tmp_url->path TSRMLS_CC) || 									\
++		if (tmp_url->query || php_check_open_basedir(tmp_url->path TSRMLS_CC) || 									\
+ 			(PG(safe_mode) && !php_checkuid(tmp_url->path, "rb+", CHECKUID_CHECK_MODE_PARAM))	\
+ 		) { 																					\
+ 			php_url_free(tmp_url); 																\
+@@ -992,10 +992,15 @@
+ 				
+ 					postval = Z_STRVAL_PP(current);
+ 					if (*postval == '@') {
++						++postval;
++						/* safe_mode / open_basedir check */
++						if (php_check_open_basedir(postval TSRMLS_CC) || (PG(safe_mode) && !php_checkuid(postval, "rb+", CHECKUID_CHECK_MODE_PARAM))) {
++							RETURN_FALSE;
++						}
+ 						error = curl_formadd(&first, &last, 
+ 											 CURLFORM_COPYNAME, string_key,
+ 											 CURLFORM_NAMELENGTH, (long)string_key_len - 1,
+-											 CURLFORM_FILE, ++postval, 
++											 CURLFORM_FILE, postval, 
+ 											 CURLFORM_END);
+ 					}
+ 					else {
diff --git a/dev-lang/php/files/4.4.0/php4.4.0-globals_overwrite.patch b/dev-lang/php/files/4.4.0/php4.4.0-globals_overwrite.patch
new file mode 100644
index 000000000000..3aefaee16295
--- /dev/null
+++ b/dev-lang/php/files/4.4.0/php4.4.0-globals_overwrite.patch
@@ -0,0 +1,314 @@
+--- ext/standard/array.c	2005-06-21 14:11:19.000000000 +0200
++++ ext/standard/array.c	2005-11-01 00:40:11.000000000 +0100
+@@ -22,7 +22,7 @@
+ */
+ 
+ 
+-/* $Id: array.c,v 1.199.2.44.2.2 2005/06/21 12:11:19 dmitry Exp $ */
++/* $Id: array.c,v 1.199.2.44.2.9 2005/10/03 14:05:07 iliaa Exp $ */
+ 
+ #include "php.h"
+ #include "php_ini.h"
+@@ -1252,6 +1252,10 @@
+ 				/* break omitted intentionally */
+ 
+ 			case EXTR_OVERWRITE:
++				/* GLOBALS protection */
++				if (var_exists && !strcmp(var_name, "GLOBALS")) {
++					break;
++				}
+ 				smart_str_appendl(&final_name, var_name, var_name_len);
+ 				break;
+ 
+@@ -1300,11 +1304,11 @@
+ 					zval **orig_var;
+ 
+ 					if (zend_hash_find(EG(active_symbol_table), final_name.c, final_name.len+1, (void **) &orig_var) == SUCCESS) {
+-						zval_ptr_dtor(orig_var);
+-
+ 						SEPARATE_ZVAL_TO_MAKE_IS_REF(entry);
+ 						zval_add_ref(entry);
+ 						
++						zval_ptr_dtor(orig_var);
++
+ 						*orig_var = *entry;
+ 					} else {
+ 						if ((*var_array)->refcount > 1) {
+@@ -1831,8 +1835,8 @@
+ 	   hashtable and replace it with new one */
+ 	new_hash = php_splice(Z_ARRVAL_P(stack), 0, 0, &args[1], argc-1, NULL);
+ 	zend_hash_destroy(Z_ARRVAL_P(stack));
+-	efree(Z_ARRVAL_P(stack));
+-	Z_ARRVAL_P(stack) = new_hash;
++	*Z_ARRVAL_P(stack) = *new_hash;
++	FREE_HASHTABLE(new_hash);
+ 
+ 	/* Clean up and return the number of elements in the stack */
+ 	efree(args);
+@@ -1909,8 +1913,8 @@
+ 	
+ 	/* Replace input array's hashtable with the new one */
+ 	zend_hash_destroy(Z_ARRVAL_P(array));
+-	efree(Z_ARRVAL_P(array));
+-	Z_ARRVAL_P(array) = new_hash;
++	*Z_ARRVAL_P(array) = *new_hash;
++	FREE_HASHTABLE(new_hash);
+ 	
+ 	/* Clean up */
+ 	if (argc == 4)
+@@ -2397,8 +2401,8 @@
+ 	
+ 	/* Copy the result hash into return value */
+ 	zend_hash_destroy(Z_ARRVAL_P(return_value));
+-	efree(Z_ARRVAL_P(return_value));
+-	Z_ARRVAL_P(return_value) = new_hash;
++	*Z_ARRVAL_P(return_value) = *new_hash;
++	FREE_HASHTABLE(new_hash);
+ 	
+ 	/* Clean up */
+ 	efree(pads);
+@@ -2622,6 +2626,15 @@
+ 	/* copy the argument array */
+ 	*return_value = **args[0];
+ 	zval_copy_ctor(return_value);
++	if (return_value->value.ht == &EG(symbol_table)) {
++		HashTable *ht;
++		zval *tmp;
++
++		ALLOC_HASHTABLE(ht);
++		zend_hash_init(ht, 0, NULL, ZVAL_PTR_DTOR, 0);
++		zend_hash_copy(ht, return_value->value.ht, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
++		return_value->value.ht = ht;		
++	}
+ 
+ 	/* go through the lists and look for common values */
+ 	while (*ptrs[0]) {
+@@ -2772,6 +2785,15 @@
+ 	/* copy the argument array */
+ 	*return_value = **args[0];
+ 	zval_copy_ctor(return_value);
++	if (return_value->value.ht == &EG(symbol_table)) {
++		HashTable *ht;
++		zval *tmp;
++
++		ALLOC_HASHTABLE(ht);
++		zend_hash_init(ht, 0, NULL, ZVAL_PTR_DTOR, 0);
++		zend_hash_copy(ht, return_value->value.ht, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
++		return_value->value.ht = ht;		
++	}
+ 
+ 	/* go through the lists and look for values of ptr[0]
+ 		   that are not in the others */
+@@ -3299,6 +3321,7 @@
+ PHP_FUNCTION(array_filter)
+ {
+ 	zval **input, **callback = NULL;
++	zval *array, *func = NULL;
+ 	zval **operand;
+ 	zval **args[1];
+ 	zval *retval = NULL;
+@@ -3317,9 +3340,13 @@
+ 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "The first argument should be an array");
+ 		return;
+ 	}
++	if (callback) {
++		func = *callback;
++	}
++	array = *input;
+ 
+ 	if (ZEND_NUM_ARGS() > 1) {
+-		if (!zend_is_callable(*callback, 0, &callback_name)) {
++		if (!zend_is_callable(func, 0, &callback_name)) {
+ 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "The second argument, '%s', should be a valid callback", callback_name);
+ 			efree(callback_name);
+ 			return;
+@@ -3328,16 +3355,16 @@
+ 	}
+ 
+ 	array_init(return_value);
+-	if (zend_hash_num_elements(Z_ARRVAL_PP(input)) == 0)
++	if (zend_hash_num_elements(Z_ARRVAL_P(array)) == 0)
+ 		return;
+ 
+-	for (zend_hash_internal_pointer_reset_ex(Z_ARRVAL_PP(input), &pos);
+-		 zend_hash_get_current_data_ex(Z_ARRVAL_PP(input), (void **)&operand, &pos) == SUCCESS;
+-		 zend_hash_move_forward_ex(Z_ARRVAL_PP(input), &pos)) {
++	for (zend_hash_internal_pointer_reset_ex(Z_ARRVAL_P(array), &pos);
++		 zend_hash_get_current_data_ex(Z_ARRVAL_P(array), (void **)&operand, &pos) == SUCCESS;
++		 zend_hash_move_forward_ex(Z_ARRVAL_P(array), &pos)) {
+ 
+-		if (callback) {
++		if (func) {
+ 			args[0] = operand;
+-			if (call_user_function_ex(EG(function_table), NULL, *callback, &retval, 1, args, 0, NULL TSRMLS_CC) == SUCCESS && retval) {
++			if (call_user_function_ex(EG(function_table), NULL, func, &retval, 1, args, 0, NULL TSRMLS_CC) == SUCCESS && retval) {
+ 				if (!zend_is_true(retval)) {
+ 					zval_ptr_dtor(&retval);
+ 					continue;
+@@ -3351,7 +3378,7 @@
+ 			continue;
+ 
+ 		zval_add_ref(operand);
+-		switch (zend_hash_get_current_key_ex(Z_ARRVAL_PP(input), &string_key, &string_key_len, &num_key, 0, &pos)) {
++		switch (zend_hash_get_current_key_ex(Z_ARRVAL_P(array), &string_key, &string_key_len, &num_key, 0, &pos)) {
+ 			case HASH_KEY_IS_STRING:
+ 				zend_hash_update(Z_ARRVAL_P(return_value), string_key,
+ 								 string_key_len, operand, sizeof(zval *), NULL);
+@@ -3418,6 +3445,7 @@
+ 			efree(array_pos);
+ 			return;
+ 		}
++		SEPARATE_ZVAL_IF_NOT_REF(pargs[i]);
+ 		args[i] = *pargs[i];
+ 		array_len[i] = zend_hash_num_elements(Z_ARRVAL_PP(pargs[i]));
+ 		if (array_len[i] > maxlen) {
+--- ext/standard/basic_functions.c	2005-05-16 10:55:31.000000000 +0200
++++ ext/standard/basic_functions.c	2005-11-01 00:40:30.000000000 +0100
+@@ -17,7 +17,7 @@
+    +----------------------------------------------------------------------+
+  */
+ 
+-/* $Id: basic_functions.c,v 1.543.2.51 2005/05/16 08:55:31 tony2001 Exp $ */
++/* $Id: basic_functions.c,v 1.543.2.51.2.3 2005/09/29 16:31:48 iliaa Exp $ */
+ 
+ #include "php.h"
+ #include "php_streams.h"
+@@ -42,18 +42,7 @@
+ #include <time.h>
+ #include <stdio.h>
+ 
+-#ifndef NETWARE
+ #include <netdb.h>
+-#else
+-/*#include "netware/env.h"*/    /* Temporary */
+-#ifdef NEW_LIBC /* Same headers hold good for Winsock and Berkeley sockets */
+-#include <netinet/in.h>
+-/*#include <arpa/inet.h>*/
+-#include <netdb.h>
+-#else
+-#include <sys/socket.h>
+-#endif
+-#endif
+ 
+ #if HAVE_ARPA_INET_H
+ # include <arpa/inet.h>
+@@ -813,8 +802,8 @@
+ 	PHP_FE(prev,					first_arg_force_ref)
+ 	PHP_FE(next,					first_arg_force_ref)
+ 	PHP_FE(reset,					first_arg_force_ref)
+-	PHP_FE(current,					first_arg_force_ref)
+-	PHP_FE(key,						first_arg_force_ref)
++	PHP_FE(current,					NULL)
++	PHP_FE(key,					NULL)
+ 	PHP_FE(min,																NULL)
+ 	PHP_FE(max,																NULL)
+ 	PHP_FE(in_array,														NULL)
+@@ -3038,11 +3027,25 @@
+ 	prefix = va_arg(args, char *);
+ 	prefix_len = va_arg(args, uint);
+ 
+-	new_key_len = prefix_len + hash_key->nKeyLength;
+-	new_key = (char *) emalloc(new_key_len);
++	if (!prefix_len) {
++		if (!hash_key->nKeyLength) {
++			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Numeric key detected - possible security hazard.");
++			return 0;
++		} else if (!strcmp(hash_key->arKey, "GLOBALS")) {
++			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Attempted GLOBALS variable overwrite.");
++			return 0; 
++		}
++	}
++
++	if (hash_key->nKeyLength) {
++		new_key_len = prefix_len + hash_key->nKeyLength;
++		new_key = (char *) emalloc(new_key_len);
+ 
+-	memcpy(new_key, prefix, prefix_len);
+-	memcpy(new_key+prefix_len, hash_key->arKey, hash_key->nKeyLength);
++		memcpy(new_key, prefix, prefix_len);
++		memcpy(new_key+prefix_len, hash_key->arKey, hash_key->nKeyLength);
++	} else {
++		new_key_len = spprintf(&new_key, 0, "%s%ld", prefix, hash_key->h);
++	}
+ 
+ 	zend_hash_del(&EG(symbol_table), new_key, new_key_len);
+ 	ZEND_SET_SYMBOL_WITH_LENGTH(&EG(symbol_table), new_key, new_key_len, *var, (*var)->refcount+1, 0);
+--- ext/standard/string.c	2005-06-02 10:50:52.000000000 +0200
++++ ext/standard/string.c	2005-11-01 00:40:20.000000000 +0100
+@@ -18,7 +18,7 @@
+    +----------------------------------------------------------------------+
+  */
+ 
+-/* $Id: string.c,v 1.333.2.52 2005/06/02 08:50:52 derick Exp $ */
++/* $Id: string.c,v 1.333.2.52.2.1 2005/09/28 22:34:04 iliaa Exp $ */
+ 
+ /* Synced with php 3.0 revision 1.193 1999-06-16 [ssb] */
+ 
+@@ -3179,7 +3179,6 @@
+ 	zval *sarg;
+ 	char *res = NULL;
+ 	int argCount;
+-	int old_rg;
+ 
+ 	argCount = ARG_COUNT(ht);
+ 	if (argCount < 1 || argCount > 2 || zend_get_parameters_ex(argCount, &arg, &arrayArg) == FAILURE) {
+@@ -3192,19 +3191,18 @@
+ 		res = estrndup(Z_STRVAL_P(sarg), Z_STRLEN_P(sarg));
+ 	}
+ 
+-	old_rg = PG(register_globals);
+ 	if (argCount == 1) {
+-		PG(register_globals) = 1;
+-		sapi_module.treat_data(PARSE_STRING, res, NULL TSRMLS_CC);
++		zval tmp;
++		Z_ARRVAL(tmp) = EG(active_symbol_table);
++
++		sapi_module.treat_data(PARSE_STRING, res, &tmp TSRMLS_CC);
+ 	} else 	{
+-		PG(register_globals) = 0;
+ 		/* Clear out the array that was passed in. */
+ 		zval_dtor(*arrayArg);
+ 		array_init(*arrayArg);
+ 		
+ 		sapi_module.treat_data(PARSE_STRING, res, *arrayArg TSRMLS_CC);
+ 	}
+-	PG(register_globals) = old_rg;
+ }
+ /* }}} */
+ 
+--- main/php_variables.c	2005-05-17 20:42:35.000000000 +0200
++++ main/php_variables.c	2005-11-01 00:42:56.000000000 +0100
+@@ -16,7 +16,7 @@
+    |          Zeev Suraski <zeev@zend.com>                                |
+    +----------------------------------------------------------------------+
+  */
+-/* $Id: php_variables.c,v 1.45.2.13 2005/05/17 18:42:35 iliaa Exp $ */
++/* $Id: php_variables.c,v 1.45.2.13.2.4 2005/10/02 11:33:27 rrichards Exp $ */
+ 
+ #include <stdio.h>
+ #include "php.h"
+@@ -73,6 +73,10 @@
+ 		symtable1 = Z_ARRVAL_P(track_vars_array);
+ 	} else if (PG(register_globals)) {
+ 		symtable1 = EG(active_symbol_table);
++		/* GLOBALS hijack attempt, reject parameter */
++		if (!strncmp("GLOBALS", var, sizeof("GLOBALS")) || !strncmp("GLOBALS", var, sizeof("GLOBALS[")-1)) {
++			return;
++		}
+ 	}
+ 	if (!symtable1) {
+ 		/* Nothing to do */
+@@ -99,6 +103,13 @@
+ 		zval_dtor(val);
+ 		return;
+ 	}
++
++	/* GLOBALS hijack attempt, reject parameter */
++	if (symtable1 == EG(active_symbol_table) && !strcmp("GLOBALS", var)) {
++		zval_dtor(val);
++		return;
++	}
++
+ 	/* ensure that we don't have spaces or dots in the variable name (not binary safe) */
+ 	for (p=var; *p; p++) {
+ 		switch(*p) {
diff --git a/dev-lang/php/files/4.4.0/php4.4.0-phpinfo_xss.patch b/dev-lang/php/files/4.4.0/php4.4.0-phpinfo_xss.patch
new file mode 100644
index 000000000000..2f03ce4e273e
--- /dev/null
+++ b/dev-lang/php/files/4.4.0/php4.4.0-phpinfo_xss.patch
@@ -0,0 +1,42 @@
+--- ext/standard/info.c	2005-06-07 15:37:33.000000000 +0200
++++ ext/standard/info.c	2005-11-01 01:26:54.000000000 +0100
+@@ -18,7 +18,7 @@
+    +----------------------------------------------------------------------+
+ */
+ 
+-/* $Id: info.c,v 1.218.2.18.2.1 2005/06/07 13:37:33 derick Exp $ */
++/* $Id: info.c,v 1.218.2.18.2.4 2005/08/16 00:26:02 iliaa Exp $ */
+ 
+ #include "php.h"
+ #include "php_ini.h"
+@@ -133,10 +133,21 @@
+ 				PUTS(" => ");
+ 			}
+ 			if (Z_TYPE_PP(tmp) == IS_ARRAY) {
++				zval *tmp3;
++				MAKE_STD_ZVAL(tmp3);
+ 				if (!sapi_module.phpinfo_as_text) {
+ 					PUTS("<pre>");
+ 				}
++				php_start_ob_buffer(NULL, 4096, 1 TSRMLS_CC);
+ 				zend_print_zval_r(*tmp, 0);
++				php_ob_get_buffer(tmp3 TSRMLS_CC);
++				php_end_ob_buffer(0, 0 TSRMLS_CC);
++				
++				elem_esc = php_info_html_esc(Z_STRVAL_P(tmp3) TSRMLS_CC);
++				PUTS(elem_esc);
++				efree(elem_esc);
++				zval_ptr_dtor(&tmp3);
++
+ 				if (!sapi_module.phpinfo_as_text) {
+ 					PUTS("</pre>");
+ 				}
+@@ -196,7 +207,7 @@
+ PHPAPI char *php_info_html_esc(char *string TSRMLS_DC)
+ {
+ 	int new_len;
+-	return php_escape_html_entities(string, strlen(string), &new_len, 0, ENT_NOQUOTES, NULL TSRMLS_CC);
++	return php_escape_html_entities(string, strlen(string), &new_len, 0, ENT_QUOTES, NULL TSRMLS_CC);
+ }
+ /* }}} */
+ 
diff --git a/dev-lang/php/files/5.0.4/php5.0.4-curl_safemode.patch b/dev-lang/php/files/5.0.4/php5.0.4-curl_safemode.patch
new file mode 100644
index 000000000000..6c498a75206b
--- /dev/null
+++ b/dev-lang/php/files/5.0.4/php5.0.4-curl_safemode.patch
@@ -0,0 +1,161 @@
+--- ext/curl/interface.c	2005-03-14 10:02:42.000000000 +0100
++++ ext/curl/interface.c	2005-10-31 23:09:15.000000000 +0100
+@@ -16,7 +16,7 @@
+    +----------------------------------------------------------------------+
+ */
+ 
+-/* $Id: interface.c,v 1.46.2.7 2005/03/14 09:02:42 sniper Exp $ */
++/* $Id: interface.c,v 1.46.2.11 2005/10/17 02:42:32 iliaa Exp $ */
+ 
+ #define ZEND_INCLUDE_FULL_WINDOWS_HEADERS
+ 
+@@ -62,7 +62,7 @@
+ #define CAAZ(s, v) add_assoc_zval_ex(return_value, s, sizeof(s), (zval *) v);
+ 
+ #define PHP_CURL_CHECK_OPEN_BASEDIR(str, len)													\
+-	if (PG(open_basedir) && *PG(open_basedir) &&                                                \
++	if (((PG(open_basedir) && *PG(open_basedir)) || PG(safe_mode)) &&                                                \
+ 	    strncasecmp(str, "file://", sizeof("file://") - 1) == 0)								\
+ 	{ 																							\
+ 		php_url *tmp_url; 																		\
+@@ -72,7 +72,7 @@
+ 			RETURN_FALSE; 																		\
+ 		} 																						\
+ 																								\
+-		if (php_check_open_basedir(tmp_url->path TSRMLS_CC) || 									\
++		if (tmp_url->query || php_check_open_basedir(tmp_url->path TSRMLS_CC) || 									\
+ 			(PG(safe_mode) && !php_checkuid(tmp_url->path, "rb+", CHECKUID_CHECK_MODE_PARAM))	\
+ 		) { 																					\
+ 			php_url_free(tmp_url); 																\
+@@ -484,20 +484,22 @@
+ 			fci.no_separation = 0;
+ 			fci.symbol_table = NULL;
+ 
++			ch->in_callback = 1;
+ 			error = zend_call_function(&fci, &t->fci_cache TSRMLS_CC);
++			ch->in_callback = 0;
+ 			if (error == FAILURE) {
+ 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not call the CURLOPT_WRITEFUNCTION");
+ 				length = -1;
+-			} else {
++			} else if (retval_ptr) {
+ 				if (Z_TYPE_P(retval_ptr) != IS_LONG) {
+ 					convert_to_long_ex(&retval_ptr);
+ 				}
+ 				length = Z_LVAL_P(retval_ptr);
++				zval_ptr_dtor(&retval_ptr);
+ 			}
+ 
+ 			zval_ptr_dtor(argv[0]);
+ 			zval_ptr_dtor(argv[1]);
+-			zval_ptr_dtor(&retval_ptr);
+ 			break;
+ 		}
+ 	}
+@@ -554,20 +556,22 @@
+ 			fci.no_separation = 0;
+ 			fci.symbol_table = NULL;
+ 
++			ch->in_callback = 1;
+ 			error = zend_call_function(&fci, &t->fci_cache TSRMLS_CC);
++			ch->in_callback = 0;
+ 			if (error == FAILURE) {
+ 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Cannot call the CURLOPT_READFUNCTION"); 
+-			} else {
++			} else if (retval_ptr) {
+ 				if (Z_TYPE_P(retval_ptr) == IS_STRING) {
+ 					length = MIN(size * nmemb, Z_STRLEN_P(retval_ptr));
+ 					memcpy(data, Z_STRVAL_P(retval_ptr), length);
+ 				}
++				zval_ptr_dtor(&retval_ptr);
+ 			}
+ 
+ 			zval_ptr_dtor(argv[0]);
+ 			zval_ptr_dtor(argv[1]);
+ 			zval_ptr_dtor(argv[2]);
+-			zval_ptr_dtor(&retval_ptr);
+ 			break;
+ 		}
+ 	}
+@@ -625,19 +629,21 @@
+ 			fci.params = argv;
+ 			fci.no_separation = 0;
+ 
++			ch->in_callback = 1;
+ 			error = zend_call_function(&fci, &t->fci_cache TSRMLS_CC);
++			ch->in_callback = 0;
+ 			if (error == FAILURE) {
+ 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not call the CURLOPT_HEADERFUNCTION");
+ 				length = -1;
+-			} else {
++			} else if (retval_ptr) {
+ 				if (Z_TYPE_P(retval_ptr) != IS_LONG) {
+ 					convert_to_long_ex(&retval_ptr);
+ 				}
+ 				length = Z_LVAL_P(retval_ptr);
++				zval_ptr_dtor(&retval_ptr);
+ 			}
+ 			zval_ptr_dtor(argv[0]);
+ 			zval_ptr_dtor(argv[1]);
+-			zval_ptr_dtor(&retval_ptr);
+ 			break;
+ 		}
+ 
+@@ -773,6 +779,8 @@
+ 	(*ch)->handlers->write_header = ecalloc(1, sizeof(php_curl_write));
+ 	(*ch)->handlers->read         = ecalloc(1, sizeof(php_curl_read));
+ 
++	(*ch)->in_callback = 0;
++	
+ 	memset(&(*ch)->err, 0, sizeof((*ch)->err));
+ 	
+ 	zend_llist_init(&(*ch)->to_free.str,   sizeof(char *),            (void(*)(void *)) curl_free_string, 0);
+@@ -1120,10 +1128,15 @@
+ 					 * must be explicitly cast to long in curl_formadd
+ 					 * use since curl needs a long not an int. */
+ 					if (*postval == '@') {
++						++postval;
++						/* safe_mode / open_basedir check */
++						if (php_check_open_basedir(postval TSRMLS_CC) || (PG(safe_mode) && !php_checkuid(postval, "rb+", CHECKUID_CHECK_MODE_PARAM))) {
++							RETURN_FALSE;
++						}
+ 						error = curl_formadd(&first, &last, 
+ 											 CURLFORM_COPYNAME, string_key,
+ 											 CURLFORM_NAMELENGTH, (long)string_key_len - 1,
+-											 CURLFORM_FILE, ++postval, 
++											 CURLFORM_FILE, postval, 
+ 											 CURLFORM_END);
+ 					} else {
+ 						error = curl_formadd(&first, &last, 
+@@ -1468,6 +1481,12 @@
+ 	}
+ 
+ 	ZEND_FETCH_RESOURCE(ch, php_curl *, zid, -1, le_curl_name, le_curl);
++
++	if (ch->in_callback) {
++		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Attempt to close CURL handle from a callback");
++		return;
++	}
++	
+ 	if (ch->uses) {	
+ 		ch->uses--;
+ 	} else {
+--- ext/curl/php_curl.h	2004/03/12 18:37:55	1.41
++++ ext/curl/php_curl.h	2005/06/02 21:04:43	1.41.2.1
+@@ -17,7 +17,7 @@
+    +----------------------------------------------------------------------+
+ */
+
+-/* $Id: php_curl.h,v 1.41 2004/03/12 18:37:55 sterling Exp $ */
++/* $Id: php_curl.h,v 1.41.2.1 2005/06/02 21:04:43 tony2001 Exp $ */
+
+ #ifndef _PHP_CURL_H
+ #define _PHP_CURL_H
+@@ -121,6 +121,7 @@ typedef struct {
+ 	php_curl_handlers       *handlers;
+ 	long                     id;
+ 	unsigned int             uses;
++	zend_bool                in_callback;
+ } php_curl;
+
+ typedef struct {
diff --git a/dev-lang/php/files/5.0.4/php5.0.4-globals_overwrite.patch b/dev-lang/php/files/5.0.4/php5.0.4-globals_overwrite.patch
new file mode 100644
index 000000000000..02a9a83eff0c
--- /dev/null
+++ b/dev-lang/php/files/5.0.4/php5.0.4-globals_overwrite.patch
@@ -0,0 +1,1013 @@
+--- ext/standard/array.c	2005-03-12 11:12:49.000000000 +0100
++++ ext/standard/array.c	2005-11-01 01:03:21.000000000 +0100
+@@ -21,7 +21,7 @@
+    +----------------------------------------------------------------------+
+ */
+ 
+-/* $Id: array.c,v 1.266.2.15 2005/03/12 10:12:49 andrey Exp $ */
++/* $Id: array.c,v 1.266.2.29 2005/10/28 09:57:15 dmitry Exp $ */
+ 
+ #include "php.h"
+ #include "php_ini.h"
+@@ -578,43 +578,66 @@
+ 	}
+ }
+ 
+-/* check is comparison function is valid */
++/* check if comparison function is valid */
+ #define PHP_ARRAY_CMP_FUNC_CHECK(func_name)	\
+ 	if (!zend_is_callable(*func_name, 0, NULL)) {	\
+ 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid comparison function.");	\
++		BG(user_compare_fci_cache) = old_user_compare_fci_cache; \
+ 		BG(user_compare_func_name) = old_compare_func;	\
+ 		RETURN_FALSE;	\
+ 	}	\
+ 
++    /* clear FCI cache otherwise : for example the same or other array with
++       (partly) the same key values has been sorted with uasort() or
++       other sorting function the comparison is cached, however the the name
++       of the function for comparison is not respected. see bug #28739 AND #33295
++
++       following defines will assist in backup / restore values.
++    */
++
++#define PHP_ARRAY_CMP_FUNC_VARS \
++	zval **old_compare_func; \
++	zend_fcall_info_cache old_user_compare_fci_cache
++
++#define PHP_ARRAY_CMP_FUNC_BACKUP() \
++	old_compare_func = BG(user_compare_func_name); \
++	old_user_compare_fci_cache = BG(user_compare_fci_cache); \
++	BG(user_compare_fci_cache) = empty_fcall_info_cache
++
++#define PHP_ARRAY_CMP_FUNC_RESTORE() \
++        BG(user_compare_fci_cache) = old_user_compare_fci_cache; \
++        BG(user_compare_func_name) = old_compare_func
++
++
+ /* {{{ proto bool usort(array array_arg, string cmp_function)
+    Sort an array by values using a user-defined comparison function */
+ PHP_FUNCTION(usort)
+ {
+ 	zval **array;
+-	zval **old_compare_func;
+ 	HashTable *target_hash;
++	PHP_ARRAY_CMP_FUNC_VARS;
++
++	PHP_ARRAY_CMP_FUNC_BACKUP();
+ 
+-	old_compare_func = BG(user_compare_func_name);
+-	BG(user_compare_fci_cache) = empty_fcall_info_cache;
+ 
+ 	if (ZEND_NUM_ARGS() != 2 || zend_get_parameters_ex(2, &array, &BG(user_compare_func_name)) == FAILURE) {
+-		BG(user_compare_func_name) = old_compare_func;
++		PHP_ARRAY_CMP_FUNC_RESTORE();
+ 		WRONG_PARAM_COUNT;
+ 	}
+ 	target_hash = HASH_OF(*array);
+ 	if (!target_hash) {
+ 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "The argument should be an array");
+-		BG(user_compare_func_name) = old_compare_func;
++		PHP_ARRAY_CMP_FUNC_RESTORE();
+ 		RETURN_FALSE;
+ 	}
+ 
+ 	PHP_ARRAY_CMP_FUNC_CHECK(BG(user_compare_func_name))
+ 	
+ 	if (zend_hash_sort(target_hash, zend_qsort, array_user_compare, 1 TSRMLS_CC) == FAILURE) {
+-		BG(user_compare_func_name) = old_compare_func;
++		PHP_ARRAY_CMP_FUNC_RESTORE();
+ 		RETURN_FALSE;
+ 	}
+-	BG(user_compare_func_name) = old_compare_func;
++	PHP_ARRAY_CMP_FUNC_RESTORE();
+ 	RETURN_TRUE;
+ }
+ /* }}} */
+@@ -624,29 +647,30 @@
+ PHP_FUNCTION(uasort)
+ {
+ 	zval **array;
+-	zval **old_compare_func;
+ 	HashTable *target_hash;
++	PHP_ARRAY_CMP_FUNC_VARS;
++
++	PHP_ARRAY_CMP_FUNC_BACKUP();
+ 
+-	old_compare_func = BG(user_compare_func_name);
+-	BG(user_compare_fci_cache) = empty_fcall_info_cache;
+ 	if (ZEND_NUM_ARGS() != 2 || zend_get_parameters_ex(2, &array, &BG(user_compare_func_name)) == FAILURE) {
+-		BG(user_compare_func_name) = old_compare_func;
++		PHP_ARRAY_CMP_FUNC_RESTORE();
+ 		WRONG_PARAM_COUNT;
+ 	}
+ 	target_hash = HASH_OF(*array);
+ 	if (!target_hash) {
+ 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "The argument should be an array");
+-		BG(user_compare_func_name) = old_compare_func;
++		PHP_ARRAY_CMP_FUNC_RESTORE();
+ 		RETURN_FALSE;
+ 	}
+ 
+ 	PHP_ARRAY_CMP_FUNC_CHECK(BG(user_compare_func_name))
+ 
+ 	if (zend_hash_sort(target_hash, zend_qsort, array_user_compare, 0 TSRMLS_CC) == FAILURE) {
+-		BG(user_compare_func_name) = old_compare_func;
++		PHP_ARRAY_CMP_FUNC_RESTORE();
+ 		RETURN_FALSE;
+ 	}
+-	BG(user_compare_func_name) = old_compare_func;
++	PHP_ARRAY_CMP_FUNC_RESTORE();
++
+ 	RETURN_TRUE;
+ }
+ /* }}} */
+@@ -669,7 +693,7 @@
+ 	s = *((Bucket **) b);
+ 
+ 	if (f->nKeyLength) {
+-		Z_STRVAL(key1) = estrndup(f->arKey, f->nKeyLength);
++		Z_STRVAL(key1) = estrndup(f->arKey, f->nKeyLength-1);
+ 		Z_STRLEN(key1) = f->nKeyLength-1;
+ 		Z_TYPE(key1) = IS_STRING;
+ 	} else {
+@@ -677,7 +701,7 @@
+ 		Z_TYPE(key1) = IS_LONG;
+ 	}
+ 	if (s->nKeyLength) {
+-		Z_STRVAL(key2) = estrndup(s->arKey, s->nKeyLength);
++		Z_STRVAL(key2) = estrndup(s->arKey, s->nKeyLength-1);
+ 		Z_STRLEN(key2) = s->nKeyLength-1;
+ 		Z_TYPE(key2) = IS_STRING;
+ 	} else {
+@@ -703,28 +727,33 @@
+ PHP_FUNCTION(uksort)
+ {
+ 	zval **array;
+-	zval **old_compare_func;
+ 	HashTable *target_hash;
++	PHP_ARRAY_CMP_FUNC_VARS;
++
++
++	PHP_ARRAY_CMP_FUNC_BACKUP();
+ 
+-	old_compare_func = BG(user_compare_func_name);
+ 	if (ZEND_NUM_ARGS() != 2 || zend_get_parameters_ex(2, &array, &BG(user_compare_func_name)) == FAILURE) {
+-		BG(user_compare_func_name) = old_compare_func;
++		PHP_ARRAY_CMP_FUNC_RESTORE();
+ 		WRONG_PARAM_COUNT;
+ 	}
+ 	target_hash = HASH_OF(*array);
+ 	if (!target_hash) {
+ 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "The argument should be an array");
+-		BG(user_compare_func_name) = old_compare_func;
++		PHP_ARRAY_CMP_FUNC_RESTORE();
++
+ 		RETURN_FALSE;
+ 	}
+ 
+ 	PHP_ARRAY_CMP_FUNC_CHECK(BG(user_compare_func_name))
+ 
+ 	if (zend_hash_sort(target_hash, zend_qsort, array_user_key_compare, 0 TSRMLS_CC) == FAILURE) {
+-		BG(user_compare_func_name) = old_compare_func;
++		PHP_ARRAY_CMP_FUNC_RESTORE();
++
+ 		RETURN_FALSE;
+ 	}
+-	BG(user_compare_func_name) = old_compare_func;
++
++	PHP_ARRAY_CMP_FUNC_RESTORE();
+ 	RETURN_TRUE;
+ }
+ /* }}} */
+@@ -1008,6 +1037,7 @@
+ 	uint   string_key_len;
+ 	ulong  num_key;
+ 	HashPosition pos;
++	zend_fcall_info_cache array_walk_fci_cache = empty_fcall_info_cache;
+ 
+ 	/* Set up known arguments */
+ 	args[1] = &key;
+@@ -1020,6 +1050,7 @@
+ 		if (recursive && Z_TYPE_PP(args[0]) == IS_ARRAY) {
+ 			HashTable *thash;
+ 			
++			SEPARATE_ZVAL_TO_MAKE_IS_REF(args[0]);
+ 			thash = HASH_OF(*(args[0]));
+ 			if (thash == target_hash) {
+ 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "recursion detected");
+@@ -1051,7 +1082,7 @@
+ 			fci.no_separation = 0;
+ 
+ 			/* Call the userland function */
+-			if (zend_call_function(&fci, &BG(array_walk_fci_cache) TSRMLS_CC) == SUCCESS) {
++			if (zend_call_function(&fci, &array_walk_fci_cache TSRMLS_CC) == SUCCESS) {
+ 				if (retval_ptr) {
+ 					zval_ptr_dtor(&retval_ptr);
+ 				}
+@@ -1094,7 +1125,6 @@
+ 	HashTable *target_hash;
+ 
+ 	argc = ZEND_NUM_ARGS();
+-	BG(array_walk_fci_cache) = empty_fcall_info_cache;
+ 	old_walk_func_name = BG(array_walk_func_name);
+ 	if (argc < 2 || argc > 3 ||
+ 		zend_get_parameters_ex(argc, &array, &BG(array_walk_func_name), &userdata) == FAILURE) {
+@@ -1131,7 +1161,6 @@
+ 
+ 	argc = ZEND_NUM_ARGS();
+ 	old_walk_func_name = BG(array_walk_func_name);
+-	BG(array_walk_fci_cache) = empty_fcall_info_cache;
+ 	
+ 	if (argc < 2 || argc > 3 ||
+ 		zend_get_parameters_ex(argc, &array, &BG(array_walk_func_name), &userdata) == FAILURE) {
+@@ -1345,6 +1374,10 @@
+ 				/* break omitted intentionally */
+ 
+ 			case EXTR_OVERWRITE:
++				/* GLOBALS protection */
++				if (var_exists && !strcmp(var_name, "GLOBALS")) {
++					break;
++				}
+ 				smart_str_appendl(&final_name, var_name, var_name_len);
+ 				break;
+ 
+@@ -1393,14 +1426,18 @@
+ 					zval **orig_var;
+ 
+ 					if (zend_hash_find(EG(active_symbol_table), final_name.c, final_name.len+1, (void **) &orig_var) == SUCCESS) {
+-						zval_ptr_dtor(orig_var);
+-
+ 						SEPARATE_ZVAL_TO_MAKE_IS_REF(entry);
+ 						zval_add_ref(entry);
+ 						
++						zval_ptr_dtor(orig_var);
++
+ 						*orig_var = *entry;
+ 					} else {
+-						(*entry)->is_ref = 1;
++						if ((*var_array)->refcount > 1) {
++							SEPARATE_ZVAL_TO_MAKE_IS_REF(entry);
++						} else {
++							(*entry)->is_ref = 1;
++						}
+ 						zval_add_ref(entry);
+ 						zend_hash_update(EG(active_symbol_table), final_name.c, final_name.len+1, (void **) entry, sizeof(zval *), NULL);
+ 					}
+@@ -2005,8 +2042,8 @@
+ 	   hashtable and replace it with new one */
+ 	new_hash = php_splice(Z_ARRVAL_P(stack), 0, 0, &args[1], argc-1, NULL);
+ 	zend_hash_destroy(Z_ARRVAL_P(stack));
+-	efree(Z_ARRVAL_P(stack));
+-	Z_ARRVAL_P(stack) = new_hash;
++	*Z_ARRVAL_P(stack) = *new_hash;
++	FREE_HASHTABLE(new_hash);
+ 
+ 	/* Clean up and return the number of elements in the stack */
+ 	efree(args);
+@@ -2082,8 +2119,8 @@
+ 	
+ 	/* Replace input array's hashtable with the new one */
+ 	zend_hash_destroy(Z_ARRVAL_P(array));
+-	efree(Z_ARRVAL_P(array));
+-	Z_ARRVAL_P(array) = new_hash;
++	*Z_ARRVAL_P(array) = *new_hash;
++	FREE_HASHTABLE(new_hash);
+ 	
+ 	/* Clean up */
+ 	if (argc == 4)
+@@ -2443,7 +2480,6 @@
+ 	zend_hash_internal_pointer_reset_ex(myht, &pos);
+ 	while (zend_hash_get_current_data_ex(myht, (void **)&entry, &pos) == SUCCESS) {
+ 		if (Z_TYPE_PP(entry) == IS_LONG) {
+-int_key:
+ 			if (zend_hash_index_find(Z_ARRVAL_P(return_value), 
+ 									 Z_LVAL_PP(entry), 
+ 									 (void**)&tmp) == FAILURE) {
+@@ -2456,11 +2492,31 @@
+ 				Z_LVAL_PP(tmp)++;
+ 			}
+ 		} else if (Z_TYPE_PP(entry) == IS_STRING) {
+-			/* make sure our array does not end up with numeric string keys */
+-			if (is_numeric_string(Z_STRVAL_PP(entry), Z_STRLEN_PP(entry), NULL, NULL, 0) == IS_LONG) {
+-				SEPARATE_ZVAL(entry);
+-				convert_to_long_ex(entry);
+-				goto int_key;
++			/* make sure our array does not end up with numeric string keys
++			 * but don't touch those strings that start with 0 */
++			if (!(Z_STRLEN_PP(entry) > 1 && Z_STRVAL_PP(entry)[0] == '0') && is_numeric_string(Z_STRVAL_PP(entry), Z_STRLEN_PP(entry), NULL, NULL, 0) == IS_LONG) {
++				zval tmp_entry;
++				
++				tmp_entry = **entry;
++				zval_copy_ctor(&tmp_entry);
++
++				convert_to_long(&tmp_entry);
++
++				if (zend_hash_index_find(Z_ARRVAL_P(return_value), 
++										 Z_LVAL(tmp_entry), 
++										 (void**)&tmp) == FAILURE) {
++					zval *data;
++					MAKE_STD_ZVAL(data);
++					Z_TYPE_P(data) = IS_LONG;
++					Z_LVAL_P(data) = 1;
++					zend_hash_index_update(Z_ARRVAL_P(return_value), Z_LVAL(tmp_entry), &data, sizeof(data), NULL);
++				} else {
++					Z_LVAL_PP(tmp)++;
++				}
++				
++				zval_dtor(&tmp_entry);
++				zend_hash_move_forward_ex(myht, &pos);
++				continue;
+ 			}
+ 		
+ 			if (zend_hash_find(Z_ARRVAL_P(return_value), Z_STRVAL_PP(entry), Z_STRLEN_PP(entry)+1, (void**)&tmp) == FAILURE) {
+@@ -2598,8 +2654,8 @@
+ 
+ 	/* Copy the result hash into return value */
+ 	zend_hash_destroy(Z_ARRVAL_P(return_value));
+-	efree(Z_ARRVAL_P(return_value));
+-	Z_ARRVAL_P(return_value) = new_hash;
++	*Z_ARRVAL_P(return_value) = *new_hash;
++	FREE_HASHTABLE(new_hash);
+ 	
+ 	/* Clean up */
+ 	efree(pads);
+@@ -2697,7 +2753,7 @@
+ 				zend_hash_index_update(Z_ARRVAL_P(return_value), num_key, entry, sizeof(entry), NULL);
+ 				break;
+ 			case HASH_KEY_IS_STRING:
+-				new_key=estrndup(string_key,str_key_len);
++				new_key=estrndup(string_key,str_key_len - 1);
+ 				if (change_to_upper)
+ 					php_strtoupper(new_key, str_key_len - 1);
+ 				else
+@@ -2787,7 +2843,8 @@
+ 	Bucket ***lists, **list, ***ptrs, *p;
+ 	
+ 	char *callback_name;
+-	zval **old_compare_func;
++	PHP_ARRAY_CMP_FUNC_VARS;
++
+ 	
+ 	int (*intersect_key_compare_func)(const void *, const void * TSRMLS_DC);
+ 	int (*intersect_data_compare_func)(const void *, const void * TSRMLS_DC);
+@@ -2801,13 +2858,7 @@
+ 		WRONG_PARAM_COUNT;
+ 	}
+ 
+-	old_compare_func = BG(user_compare_func_name);
+-	/* clear FCI cache otherwise : for example the same or other array with 
+-	   (partly) the same key values has been sorted with uasort() or
+-	   other sorting function the comparison is cached, however the the name
+-	   of the function for comparison is not respected. see bug #28739
+-	*/
+-	BG(user_compare_fci_cache) = empty_fcall_info_cache;
++	PHP_ARRAY_CMP_FUNC_BACKUP();
+ 
+ 	if (behavior == INTERSECT_NORMAL) {
+ 		intersect_key_compare_func = array_key_compare;
+@@ -2962,6 +3013,15 @@
+ 	/* copy the argument array */
+ 	*return_value = **args[0];
+ 	zval_copy_ctor(return_value);
++	if (return_value->value.ht == &EG(symbol_table)) {
++		HashTable *ht;
++		zval *tmp;
++
++		ALLOC_HASHTABLE(ht);
++		zend_hash_init(ht, 0, NULL, ZVAL_PTR_DTOR, 0);
++		zend_hash_copy(ht, return_value->value.ht, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
++		return_value->value.ht = ht;		
++	}
+ 
+ 	if (behavior == INTERSECT_NORMAL && data_compare_type == INTERSECT_COMP_DATA_USER) {
+ 		/* array_uintersect() */
+@@ -3069,7 +3129,8 @@
+ 		pefree(lists[i], hash->persistent);
+ 	}
+ 	
+-	BG(user_compare_func_name) = old_compare_func;
++	PHP_ARRAY_CMP_FUNC_RESTORE();
++
+ 	
+ 	efree(ptrs);
+ 	efree(lists);
+@@ -3141,7 +3202,8 @@
+ 	Bucket ***lists, **list, ***ptrs, *p;
+ 	char *callback_name;
+ 	
+-	zval **old_compare_func;
++	PHP_ARRAY_CMP_FUNC_VARS;
++
+ 	int (*diff_key_compare_func)(const void *, const void * TSRMLS_DC);
+ 	int (*diff_data_compare_func)(const void *, const void * TSRMLS_DC);
+ 	
+@@ -3155,13 +3217,7 @@
+ 		WRONG_PARAM_COUNT;
+ 	}
+ 
+-	old_compare_func = BG(user_compare_func_name);
+-	/* clear FCI cache otherwise : for example the same or other array with 
+-	   (partly) the same key values has been sorted with uasort() or
+-	   other sorting function the comparison is cached, however the the name
+-	   of the function for comparison is not respected. see bug #28739
+-	*/
+-	BG(user_compare_fci_cache) = empty_fcall_info_cache;
++	PHP_ARRAY_CMP_FUNC_BACKUP();
+ 
+ 	if (behavior == DIFF_NORMAL) {
+ 		diff_key_compare_func = array_key_compare;
+@@ -3316,6 +3372,15 @@
+ 	/* copy the argument array */
+ 	*return_value = **args[0];
+ 	zval_copy_ctor(return_value);
++	if (return_value->value.ht == &EG(symbol_table)) {
++		HashTable *ht;
++		zval *tmp;
++
++		ALLOC_HASHTABLE(ht);
++		zend_hash_init(ht, 0, NULL, ZVAL_PTR_DTOR, 0);
++		zend_hash_copy(ht, return_value->value.ht, (copy_ctor_func_t) zval_add_ref, (void *) &tmp, sizeof(zval *));
++		return_value->value.ht = ht;		
++	}
+ 
+ 	if (behavior == DIFF_NORMAL && data_compare_type == DIFF_COMP_DATA_USER) {
+ 		/* array_udiff() */
+@@ -3410,7 +3475,8 @@
+ 		pefree(lists[i], hash->persistent);
+ 	}
+ 
+-	BG(user_compare_func_name) = old_compare_func;			
++	PHP_ARRAY_CMP_FUNC_RESTORE();
++
+ 	
+ 	efree(ptrs);
+ 	efree(lists);
+@@ -3845,8 +3911,11 @@
+ 	efree(callback_name);
+ 
+ 	if (ZEND_NUM_ARGS() > 2) {
+-		convert_to_long_ex(initial);
+-		result = *initial;
++		ALLOC_ZVAL(result);
++		*result = **initial;
++		zval_copy_ctor(result);
++		convert_to_long(result);
++		INIT_PZVAL(result);
+ 	} else {
+ 		MAKE_STD_ZVAL(result);
+ 		ZVAL_NULL(result);
+@@ -3862,6 +3931,7 @@
+ 		if (result) {
+ 			*return_value = *result;
+ 			zval_copy_ctor(return_value);
++			zval_ptr_dtor(&result);
+ 		}
+ 		return;
+ 	}
+@@ -3911,6 +3981,7 @@
+ PHP_FUNCTION(array_filter)
+ {
+ 	zval **input, **callback = NULL;
++	zval *array, *func = NULL;
+ 	zval **operand;
+ 	zval **args[1];
+ 	zval *retval = NULL;
+@@ -3930,9 +4001,13 @@
+ 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "The first argument should be an array");
+ 		return;
+ 	}
++	if (callback) {
++		func = *callback;
++	}
++	array = *input;
+ 
+ 	if (ZEND_NUM_ARGS() > 1) {
+-		if (!zend_is_callable(*callback, 0, &callback_name)) {
++		if (!zend_is_callable(func, 0, &callback_name)) {
+ 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "The second argument, '%s', should be a valid callback", callback_name);
+ 			efree(callback_name);
+ 			return;
+@@ -3941,22 +4016,22 @@
+ 	}
+ 
+ 	array_init(return_value);
+-	if (zend_hash_num_elements(Z_ARRVAL_PP(input)) == 0) {
++	if (zend_hash_num_elements(Z_ARRVAL_P(array)) == 0) {
+ 		return;
+ 	}
+ 
+-	for (zend_hash_internal_pointer_reset_ex(Z_ARRVAL_PP(input), &pos);
+-		 zend_hash_get_current_data_ex(Z_ARRVAL_PP(input), (void **)&operand, &pos) == SUCCESS;
+-		 zend_hash_move_forward_ex(Z_ARRVAL_PP(input), &pos)) {
++	for (zend_hash_internal_pointer_reset_ex(Z_ARRVAL_P(array), &pos);
++		 zend_hash_get_current_data_ex(Z_ARRVAL_P(array), (void **)&operand, &pos) == SUCCESS;
++		 zend_hash_move_forward_ex(Z_ARRVAL_P(array), &pos)) {
+ 
+-		if (callback) {
++		if (func) {
+ 			zend_fcall_info fci;
+ 
+ 			args[0] = operand;
+ 
+ 			fci.size = sizeof(fci);
+ 			fci.function_table = EG(function_table);
+-			fci.function_name = *callback;
++			fci.function_name = func;
+ 			fci.symbol_table = NULL;
+ 			fci.object_pp = NULL;
+ 			fci.retval_ptr_ptr = &retval;
+@@ -3980,7 +4055,7 @@
+ 		}
+ 
+ 		zval_add_ref(operand);
+-		switch (zend_hash_get_current_key_ex(Z_ARRVAL_PP(input), &string_key, &string_key_len, &num_key, 0, &pos)) {
++		switch (zend_hash_get_current_key_ex(Z_ARRVAL_P(array), &string_key, &string_key_len, &num_key, 0, &pos)) {
+ 			case HASH_KEY_IS_STRING:
+ 				zend_hash_update(Z_ARRVAL_P(return_value), string_key, string_key_len, operand, sizeof(zval *), NULL);
+ 				break;
+@@ -4046,6 +4121,7 @@
+ 			efree(array_pos);
+ 			return;
+ 		}
++		SEPARATE_ZVAL_IF_NOT_REF(pargs[i]);
+ 		args[i] = *pargs[i];
+ 		array_len[i] = zend_hash_num_elements(Z_ARRVAL_PP(pargs[i]));
+ 		if (array_len[i] > maxlen) {
+--- ext/standard/basic_functions.c	2005-03-10 13:10:57.000000000 +0100
++++ ext/standard/basic_functions.c	2005-11-01 01:03:31.000000000 +0100
+@@ -17,7 +17,7 @@
+    +----------------------------------------------------------------------+
+  */
+ 
+-/* $Id: basic_functions.c,v 1.673.2.13 2005/03/10 12:10:57 hyanantha Exp $ */
++/* $Id: basic_functions.c,v 1.673.2.21 2005/09/29 16:31:20 iliaa Exp $ */
+ 
+ #include "php.h"
+ #include "php_streams.h"
+@@ -469,7 +469,6 @@
+ 	PHP_FALIAS(show_source, 		highlight_file,							NULL)
+ 	PHP_FE(highlight_string,												NULL)
+ 	PHP_FE(php_strip_whitespace,												NULL)
+-	PHP_FE(php_check_syntax,												second_arg_force_ref)
+ 
+ 	PHP_FE(ini_get,															NULL)
+ 	PHP_FE(ini_get_all,														NULL)
+@@ -743,8 +743,8 @@
+ 	PHP_FE(prev,					first_arg_force_ref)
+ 	PHP_FE(next,					first_arg_force_ref)
+ 	PHP_FE(reset,					first_arg_force_ref)
+-	PHP_FE(current,					first_arg_force_ref)
+-	PHP_FE(key,						first_arg_force_ref)
++	PHP_FE(current,					NULL)
++	PHP_FE(key,					NULL)
+ 	PHP_FE(min,																NULL)
+ 	PHP_FE(max,																NULL)
+ 	PHP_FE(in_array,														NULL)
+@@ -930,7 +930,6 @@
+ 	BG(user_tick_functions) = NULL;
+ 	BG(user_filter_map) = NULL;
+ 	BG(user_compare_fci_cache) = empty_fcall_info_cache;
+-	/*BG(array_walk_fci_cache) = empty_fcall_info_cache;*/
+ 	zend_hash_init(&BG(sm_protected_env_vars), 5, NULL, NULL, 1);
+ 	BG(sm_allowed_env_vars) = NULL;
+ 
+@@ -1192,17 +1191,10 @@
+ 	}
+ 	STR_FREE(BG(locale_string));
+ 
+-	if (FG(stream_wrappers)) {
+-		zend_hash_destroy(FG(stream_wrappers));
+-		efree(FG(stream_wrappers));
+-		FG(stream_wrappers) = NULL;
+-	}
+-
+-	if (FG(stream_filters)) {
+-		zend_hash_destroy(FG(stream_filters));
+-		efree(FG(stream_filters));
+-		FG(stream_filters) = NULL;
+-	}
++	/*
++	 FG(stream_wrappers) and FG(stream_filters) are destroyed
++	 during php_request_shutdown()
++	 */
+ 
+ 	PHP_RSHUTDOWN(filestat)(SHUTDOWN_FUNC_ARGS_PASSTHRU);
+ #ifdef HAVE_SYSLOG_H
+@@ -2103,17 +2095,21 @@
+ static int user_shutdown_function_call(php_shutdown_function_entry *shutdown_function_entry TSRMLS_DC)
+ {
+ 	zval retval;
++	char *function_name = NULL;
+ 
+-	if (call_user_function(	EG(function_table), NULL,
+-							shutdown_function_entry->arguments[0],
+-							&retval, 
+-							shutdown_function_entry->arg_count - 1,
+-							shutdown_function_entry->arguments + 1 
+-							TSRMLS_CC ) == SUCCESS ) {
++	if (!zend_is_callable(shutdown_function_entry->arguments[0], 0, &function_name)) {
++		php_error(E_WARNING, "(Registered shutdown functions) Unable to call %s() - function does not exist", function_name);
++	} else if (call_user_function(EG(function_table), NULL,
++								shutdown_function_entry->arguments[0],
++								&retval, 
++								shutdown_function_entry->arg_count - 1,
++								shutdown_function_entry->arguments + 1 
++								TSRMLS_CC ) == SUCCESS)
++	{
+ 		zval_dtor(&retval);
+-
+-	} else {
+-		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to call %s() - function does not exist", Z_STRVAL_P(shutdown_function_entry->arguments[0]));
++	} 
++	if (function_name) {
++		efree(function_name);
+ 	}
+ 	return 0;
+ }
+@@ -2206,6 +2202,7 @@
+ PHP_FUNCTION(register_shutdown_function)
+ {
+ 	php_shutdown_function_entry shutdown_function_entry;
++	char *function_name = NULL;
+ 	int i;
+ 
+ 	shutdown_function_entry.arg_count = ZEND_NUM_ARGS();
+@@ -2214,26 +2211,31 @@
+ 		WRONG_PARAM_COUNT;
+ 	}
+ 
+-	shutdown_function_entry.arguments = (pval **) safe_emalloc(sizeof(pval *), shutdown_function_entry.arg_count, 0);
++	shutdown_function_entry.arguments = (zval **) safe_emalloc(sizeof(zval *), shutdown_function_entry.arg_count, 0);
+ 
+ 	if (zend_get_parameters_array(ht, shutdown_function_entry.arg_count, shutdown_function_entry.arguments) == FAILURE) {
+ 		RETURN_FALSE;
+ 	}
+ 	
+-	/* Prevent entering of anything but arrays/strings */
+-	if (Z_TYPE_P(shutdown_function_entry.arguments[0]) != IS_ARRAY) {
+-		convert_to_string(shutdown_function_entry.arguments[0]);
+-	}
+-	
+-	if (!BG(user_shutdown_function_names)) {
+-		ALLOC_HASHTABLE(BG(user_shutdown_function_names));
+-		zend_hash_init(BG(user_shutdown_function_names), 0, NULL, (void (*)(void *)) user_shutdown_function_dtor, 0);
+-	}
++	/* Prevent entering of anything but valid callback (syntax check only!) */
++	if (!zend_is_callable(shutdown_function_entry.arguments[0], 1, &function_name)) {
++		php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid shutdown callback '%s' passed", function_name);
++		efree(shutdown_function_entry.arguments);
++		RETVAL_FALSE;
++	} else {
++		if (!BG(user_shutdown_function_names)) {
++			ALLOC_HASHTABLE(BG(user_shutdown_function_names));
++			zend_hash_init(BG(user_shutdown_function_names), 0, NULL, (void (*)(void *)) user_shutdown_function_dtor, 0);
++		}
+ 
+-	for (i = 0; i < shutdown_function_entry.arg_count; i++) {
+-		shutdown_function_entry.arguments[i]->refcount++;
++		for (i = 0; i < shutdown_function_entry.arg_count; i++) {
++			shutdown_function_entry.arguments[i]->refcount++;
++		}
++		zend_hash_next_index_insert(BG(user_shutdown_function_names), &shutdown_function_entry, sizeof(php_shutdown_function_entry), NULL);
++	}
++	if (function_name) {
++		efree(function_name);
+ 	}
+-	zend_hash_next_index_insert(BG(user_shutdown_function_names), &shutdown_function_entry, sizeof(php_shutdown_function_entry), NULL);
+ }
+ /* }}} */
+ 
+@@ -2323,49 +2325,6 @@
+ }
+ /* }}} */
+ 
+-/* {{{ proto bool php_check_syntax(string file_name [, &$error_message])
+-   Check the syntax of the specified file. */
+-PHP_FUNCTION(php_check_syntax)
+-{
+-	char *filename;
+-	int filename_len;
+-	zval *errm=NULL;
+-	zend_file_handle file_handle = {0};
+-
+-	int old_errors = PG(display_errors);
+-	int log_errors = PG(log_errors);
+-
+-	if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|z", &filename, &filename_len, &errm) == FAILURE) {
+-		RETURN_FALSE;
+-	}
+-
+-	file_handle.type = ZEND_HANDLE_FILENAME;
+-	file_handle.filename = filename;
+-	file_handle.free_filename = 0;
+-	file_handle.opened_path = NULL;	
+-
+-	PG(log_errors) = PG(display_errors) = 0;
+-
+-	if (php_lint_script(&file_handle TSRMLS_CC) != SUCCESS) {
+-		if (errm) {
+-			char *error_str;
+-
+-			zval_dtor(errm);
+-			spprintf(&error_str, 0, "%s in %s on line %d", PG(last_error_message), PG(last_error_file), PG(last_error_lineno));
+-			ZVAL_STRING(errm, error_str, 0);
+-		}
+-		RETVAL_FALSE;
+-	} else {
+-		RETVAL_TRUE;
+-	}
+-
+-	PG(display_errors) = old_errors;
+-	PG(log_errors) = log_errors;
+-
+-	return;
+-}
+-/* }}} */
+-
+ /* {{{ proto bool highlight_string(string string [, bool return] )
+    Syntax highlight a string or optionally return it */
+ PHP_FUNCTION(highlight_string)
+@@ -3118,11 +3077,25 @@
+ 	prefix = va_arg(args, char *);
+ 	prefix_len = va_arg(args, uint);
+ 
+-	new_key_len = prefix_len + hash_key->nKeyLength;
+-	new_key = (char *) emalloc(new_key_len);
++	if (!prefix_len) {
++		if (!hash_key->nKeyLength) {
++			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Numeric key detected - possible security hazard.");
++			return 0;
++		} else if (!strcmp(hash_key->arKey, "GLOBALS")) {
++			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Attempted GLOBALS variable overwrite.");
++			return 0; 
++		}
++	}
++
++	if (hash_key->nKeyLength) {
++		new_key_len = prefix_len + hash_key->nKeyLength;
++		new_key = (char *) emalloc(new_key_len);
+ 
+-	memcpy(new_key, prefix, prefix_len);
+-	memcpy(new_key+prefix_len, hash_key->arKey, hash_key->nKeyLength);
++		memcpy(new_key, prefix, prefix_len);
++		memcpy(new_key+prefix_len, hash_key->arKey, hash_key->nKeyLength);
++	} else {
++		new_key_len = spprintf(&new_key, 0, "%s%ld", prefix, hash_key->h);
++	}
+ 
+ 	zend_hash_del(&EG(symbol_table), new_key, new_key_len);
+ 	ZEND_SET_SYMBOL_WITH_LENGTH(&EG(symbol_table), new_key, new_key_len, *var, (*var)->refcount+1, 0);
+--- ext/standard/string.c	2005-03-01 16:01:08.000000000 +0100
++++ ext/standard/string.c	2005-11-01 01:03:40.000000000 +0100
+@@ -18,7 +18,7 @@
+    +----------------------------------------------------------------------+
+  */
+ 
+-/* $Id: string.c,v 1.420.2.6 2005/03/01 15:01:08 hyanantha Exp $ */
++/* $Id: string.c,v 1.420.2.13 2005/09/28 22:35:43 iliaa Exp $ */
+ 
+ /* Synced with php 3.0 revision 1.193 1999-06-16 [ssb] */
+ 
+@@ -1175,6 +1175,22 @@
+ 			return len;
+ 		}
+ 	}
++#elif defined(NETWARE)
++	/*
++	 * Find the first occurence of : from the left 
++	 * move the path pointer to the position just after :
++	 * increment the len_adjust to the length of path till colon character(inclusive)
++	 * If there is no character beyond : simple return len
++	 */
++	char *colonpos = NULL;
++	colonpos = strchr(path, ':');
++	if(colonpos != NULL) {
++		len_adjust = ((colonpos - path) + 1);
++		path += len_adjust;
++		if(len_adjust == len) {
++			return len;
++		}
++	}
+ #endif
+ 
+ 	if (len == 0) {
+@@ -1199,9 +1215,21 @@
+ 	}
+ 	if (end < path) {
+ 		/* No slash found, therefore return '.' */
++#ifdef NETWARE
++		if(len_adjust == 0) {
++			path[0] = '.';
++			path[1] = '\0';
++			return 1; //only one character
++		} 
++		else {
++			path[0] = '\0';
++			return len_adjust;
++		}
++#else
+ 		path[0] = '.';
+ 		path[1] = '\0';
+ 		return 1 + len_adjust;
++#endif
+ 	}
+ 
+ 	/* Strip slashes which came before the file name */
+@@ -1382,8 +1410,6 @@
+ 		if (!Z_STRLEN_PP(needle)) {
+ 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Empty delimiter.");
+ 			efree(haystack_orig);
+-			zval_ptr_dtor(haystack);
+-			zval_ptr_dtor(needle);
+ 			RETURN_FALSE;
+ 		}
+ 
+@@ -1409,8 +1435,6 @@
+ 		RETVAL_FALSE;
+ 	}
+ 
+-	zval_ptr_dtor(haystack);
+-	zval_ptr_dtor(needle);
+ 	efree(haystack_orig);
+ }
+ /* }}} */
+@@ -1839,7 +1863,13 @@
+ 	}
+ 
+ 	if (chunklen > Z_STRLEN_PP(p_str)) {
+-		RETURN_STRINGL(Z_STRVAL_PP(p_str), Z_STRLEN_PP(p_str), 1);	
++		/* to maintain BC, we must return original string + ending */
++		result_len = endlen + Z_STRLEN_PP(p_str);
++		result = emalloc(result_len + 1);
++		memcpy(result, Z_STRVAL_PP(p_str), Z_STRLEN_PP(p_str));
++		memcpy(result + Z_STRLEN_PP(p_str), end, endlen);
++		result[result_len] = '\0'; 
++		RETURN_STRINGL(result, result_len, 0);	
+ 	}
+ 
+ 	if (!Z_STRLEN_PP(p_str)) {
+@@ -2937,7 +2975,7 @@
+ 	char *source, *target, *tmp, *source_end=str+len, *tmp_end = NULL;
+ 	
+ 	for (source = str; source < source_end; source++) {
+-		if (*source == from) {
++		if ((case_sensitivity && *source == from) || (!case_sensitivity && tolower(*source) == tolower(from))) {
+ 			char_count++;
+ 		}
+ 	}
+@@ -3771,7 +3809,6 @@
+ 	zval *sarg;
+ 	char *res = NULL;
+ 	int argCount;
+-	int old_rg;
+ 
+ 	argCount = ZEND_NUM_ARGS();
+ 	if (argCount < 1 || argCount > 2 || zend_get_parameters_ex(argCount, &arg, &arrayArg) == FAILURE) {
+@@ -3784,19 +3821,18 @@
+ 		res = estrndup(Z_STRVAL_P(sarg), Z_STRLEN_P(sarg));
+ 	}
+ 
+-	old_rg = PG(register_globals);
+ 	if (argCount == 1) {
+-		PG(register_globals) = 1;
+-		sapi_module.treat_data(PARSE_STRING, res, NULL TSRMLS_CC);
++		zval tmp;
++		Z_ARRVAL(tmp) = EG(active_symbol_table);
++
++		sapi_module.treat_data(PARSE_STRING, res, &tmp TSRMLS_CC);
+ 	} else 	{
+-		PG(register_globals) = 0;
+ 		/* Clear out the array that was passed in. */
+ 		zval_dtor(*arrayArg);
+ 		array_init(*arrayArg);
+ 		
+ 		sapi_module.treat_data(PARSE_STRING, res, *arrayArg TSRMLS_CC);
+ 	}
+-	PG(register_globals) = old_rg;
+ }
+ /* }}} */
+ 
+--- main/php_variables.c	2005-02-17 05:46:10.000000000 +0100
++++ main/php_variables.c	2005-11-01 01:07:38.000000000 +0100
+@@ -17,7 +17,7 @@
+    +----------------------------------------------------------------------+
+  */
+ 
+-/* $Id: php_variables.c,v 1.81.2.3 2005/02/17 04:46:10 iliaa Exp $ */
++/* $Id: php_variables.c,v 1.81.2.13 2005/09/28 22:35:42 iliaa Exp $ */
+ 
+ #include <stdio.h>
+ #include "php.h"
+@@ -103,6 +103,13 @@
+ 		zval_dtor(val);
+ 		return;
+ 	}
++
++	/* GLOBALS hijack attempt, reject parameter */
++	if (symtable1 == EG(active_symbol_table) && !strcmp("GLOBALS", var)) {
++		zval_dtor(val);
++		return;
++	}
++
+ 	/* ensure that we don't have spaces or dots in the variable name (not binary safe) */
+ 	for (p=var; *p; p++) {
+ 		switch(*p) {
+@@ -186,7 +193,19 @@
+ 			if (!index) {
+ 				zend_hash_next_index_insert(symtable1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p);
+ 			} else {
++				zval **tmp;
+ 				char *escaped_index = php_addslashes(index, index_len, &index_len, 0 TSRMLS_CC);
++				/* 
++				 * According to rfc2965, more specific paths are listed above the less specific ones.
++				 * If we encounter a duplicate cookie name, we should skip it, since it is not possible
++				 * to have the same (plain text) cookie name for the same path and we should not overwrite
++				 * more specific cookies with the less specific ones.
++				 */
++				if (PG(http_globals)[TRACK_VARS_COOKIE] && symtable1 == Z_ARRVAL_P(PG(http_globals)[TRACK_VARS_COOKIE]) && 
++					zend_symtable_find(symtable1, escaped_index, index_len+1, (void **) &tmp) != FAILURE) {
++					efree(escaped_index);
++					break;
++				}
+ 				zend_symtable_update(symtable1, escaped_index, index_len+1, &gpc_element, sizeof(zval *), (void **) &gpc_element_p);
+ 				efree(escaped_index);
+ 			}
+@@ -250,12 +269,21 @@
+ 			INIT_PZVAL(array_ptr);
+ 			switch (arg) {
+ 				case PARSE_POST:
++					if (PG(http_globals)[TRACK_VARS_POST]) {
++						zval_ptr_dtor(&PG(http_globals)[TRACK_VARS_POST]);
++					}
+ 					PG(http_globals)[TRACK_VARS_POST] = array_ptr;
+ 					break;
+ 				case PARSE_GET:
++					if (PG(http_globals)[TRACK_VARS_GET]) {
++						zval_ptr_dtor(&PG(http_globals)[TRACK_VARS_GET]);
++					}
+ 					PG(http_globals)[TRACK_VARS_GET] = array_ptr;
+ 					break;
+ 				case PARSE_COOKIE:
++					if (PG(http_globals)[TRACK_VARS_COOKIE]) {
++						zval_ptr_dtor(&PG(http_globals)[TRACK_VARS_COOKIE]);
++					}
+ 					PG(http_globals)[TRACK_VARS_COOKIE] = array_ptr;
+ 					break;
+ 			}
+@@ -500,6 +528,9 @@
+ 	ALLOC_ZVAL(array_ptr);
+ 	array_init(array_ptr);
+ 	INIT_PZVAL(array_ptr);
++	if (PG(http_globals)[TRACK_VARS_SERVER]) {
++		zval_ptr_dtor(&PG(http_globals)[TRACK_VARS_SERVER]);
++	}
+ 	PG(http_globals)[TRACK_VARS_SERVER] = array_ptr;
+ 	PG(magic_quotes_gpc) = 0;
+ 
+@@ -675,8 +706,8 @@
+ 			PG(http_globals)[i] = dummy_track_vars_array;
+ 		}
+ 
+-		zend_hash_update(&EG(symbol_table), auto_global_records[i].name, auto_global_records[i].name_len, &PG(http_globals)[i], sizeof(zval *), NULL);
+ 		PG(http_globals)[i]->refcount++;
++		zend_hash_update(&EG(symbol_table), auto_global_records[i].name, auto_global_records[i].name_len, &PG(http_globals)[i], sizeof(zval *), NULL);
+ 		if (PG(register_long_arrays)) {
+ 			zend_hash_update(&EG(symbol_table), auto_global_records[i].long_name, auto_global_records[i].long_name_len, &PG(http_globals)[i], sizeof(zval *), NULL);
+ 			PG(http_globals)[i]->refcount++;
+@@ -696,7 +727,18 @@
+ 
+ static zend_bool php_auto_globals_create_server(char *name, uint name_len TSRMLS_DC)
+ {
+-	php_register_server_variables(TSRMLS_C);
++	if (PG(variables_order) && (strchr(PG(variables_order),'S') || strchr(PG(variables_order),'s'))) {
++		php_register_server_variables(TSRMLS_C);
++	} else {
++		zval *server_vars=NULL;
++		ALLOC_ZVAL(server_vars);
++		array_init(server_vars);
++		INIT_PZVAL(server_vars);
++		if (PG(http_globals)[TRACK_VARS_SERVER]) {
++			zval_ptr_dtor(&PG(http_globals)[TRACK_VARS_SERVER]);
++		}
++		PG(http_globals)[TRACK_VARS_SERVER] = server_vars;
++	}
+ 
+ 	zend_hash_update(&EG(symbol_table), name, name_len+1, &PG(http_globals)[TRACK_VARS_SERVER], sizeof(zval *), NULL);
+ 	PG(http_globals)[TRACK_VARS_SERVER]->refcount++;
+@@ -716,9 +758,14 @@
+ 	ALLOC_ZVAL(env_vars);
+ 	array_init(env_vars);
+ 	INIT_PZVAL(env_vars);
++	if (PG(http_globals)[TRACK_VARS_ENV]) {
++		zval_ptr_dtor(&PG(http_globals)[TRACK_VARS_ENV]);
++	}
+ 	PG(http_globals)[TRACK_VARS_ENV] = env_vars;
+ 	
+-	php_import_environment_variables(PG(http_globals)[TRACK_VARS_ENV] TSRMLS_CC);
++	if (PG(variables_order) && (strchr(PG(variables_order),'E') || strchr(PG(variables_order),'e'))) {
++		php_import_environment_variables(PG(http_globals)[TRACK_VARS_ENV] TSRMLS_CC);
++	}
+ 
+ 	zend_hash_update(&EG(symbol_table), name, name_len+1, &PG(http_globals)[TRACK_VARS_ENV], sizeof(zval *), NULL);
+ 	PG(http_globals)[TRACK_VARS_ENV]->refcount++;
diff --git a/dev-lang/php/files/5.0.4/php5.0.4-phpinfo_xss.patch b/dev-lang/php/files/5.0.4/php5.0.4-phpinfo_xss.patch
new file mode 100644
index 000000000000..e19c9fe11a53
--- /dev/null
+++ b/dev-lang/php/files/5.0.4/php5.0.4-phpinfo_xss.patch
@@ -0,0 +1,79 @@
+--- ext/standard/info.c	2004-05-02 15:23:30.000000000 +0200
++++ ext/standard/info.c	2005-11-01 01:30:58.000000000 +0100
+@@ -18,7 +18,7 @@
+    +----------------------------------------------------------------------+
+ */
+ 
+-/* $Id: info.c,v 1.245 2004/05/02 13:23:30 helly Exp $ */
++/* $Id: info.c,v 1.245.2.5 2005/08/16 00:25:46 iliaa Exp $ */
+ 
+ #include "php.h"
+ #include "php_ini.h"
+@@ -135,10 +135,25 @@
+ 				PUTS(" => ");
+ 			}
+ 			if (Z_TYPE_PP(tmp) == IS_ARRAY) {
++				zval *tmp3;
++
++				MAKE_STD_ZVAL(tmp3);
++
+ 				if (!sapi_module.phpinfo_as_text) {
+ 					PUTS("<pre>");
+ 				}
++				php_start_ob_buffer(NULL, 4096, 1 TSRMLS_CC);
++				
+ 				zend_print_zval_r(*tmp, 0 TSRMLS_CC);
++				
++				php_ob_get_buffer(tmp3 TSRMLS_CC);
++				php_end_ob_buffer(0, 0 TSRMLS_CC);
++				
++				elem_esc = php_info_html_esc(Z_STRVAL_P(tmp3) TSRMLS_CC);
++				PUTS(elem_esc);
++				efree(elem_esc);
++				zval_ptr_dtor(&tmp3);
++
+ 				if (!sapi_module.phpinfo_as_text) {
+ 					PUTS("</pre>");
+ 				}
+@@ -198,7 +213,7 @@
+ PHPAPI char *php_info_html_esc(char *string TSRMLS_DC)
+ {
+ 	int new_len;
+-	return php_escape_html_entities(string, strlen(string), &new_len, 0, ENT_NOQUOTES, NULL TSRMLS_CC);
++	return php_escape_html_entities(string, strlen(string), &new_len, 0, ENT_QUOTES, NULL TSRMLS_CC);
+ }
+ /* }}} */
+ 
+@@ -406,7 +421,9 @@
+ 		if (expose_php && !sapi_module.phpinfo_as_text) {
+ 			PUTS("<a href=\"http://www.php.net/\"><img border=\"0\" src=\"");
+ 			if (SG(request_info).request_uri) {
+-				PUTS(SG(request_info).request_uri);
++				char *elem_esc = php_info_html_esc(SG(request_info).request_uri TSRMLS_CC);
++				PUTS(elem_esc);
++				efree(elem_esc);
+ 			}
+ 			PUTS("?=");
+ 			logo_guid = php_logo_guid();
+@@ -551,7 +574,9 @@
+ 		if (expose_php && !sapi_module.phpinfo_as_text) {
+ 			PUTS("<a href=\"http://www.zend.com/\"><img border=\"0\" src=\"");
+ 			if (SG(request_info).request_uri) {
+-				PUTS(SG(request_info).request_uri);
++				char *elem_esc = php_info_html_esc(SG(request_info).request_uri TSRMLS_CC);
++				PUTS(elem_esc);
++				efree(elem_esc);
+ 			}
+ 			PUTS("?="ZEND_LOGO_GUID"\" alt=\"Zend logo\" /></a>\n");
+ 		}
+@@ -570,7 +595,9 @@
+ 		php_info_print_hr();
+ 		PUTS("<h1><a href=\"");
+ 		if (SG(request_info).request_uri) {
+-			PUTS(SG(request_info).request_uri);
++			char *elem_esc = php_info_html_esc(SG(request_info).request_uri TSRMLS_CC);
++			PUTS(elem_esc);
++			efree(elem_esc);
+ 		}
+ 		PUTS("?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000\">");
+ 		PUTS("PHP Credits");
diff --git a/dev-lang/php/files/5.0.5/php5.0.5-curl_safemode.patch b/dev-lang/php/files/5.0.5/php5.0.5-curl_safemode.patch
new file mode 100644
index 000000000000..91424e451974
--- /dev/null
+++ b/dev-lang/php/files/5.0.5/php5.0.5-curl_safemode.patch
@@ -0,0 +1,46 @@
+--- ext/curl/interface.c	2005-06-02 23:04:43.000000000 +0200
++++ ext/curl/interface.c.new	2005-10-31 23:18:13.000000000 +0100
+@@ -16,7 +16,7 @@
+    +----------------------------------------------------------------------+
+ */
+ 
+-/* $Id: interface.c,v 1.46.2.8 2005/06/02 21:04:43 tony2001 Exp $ */
++/* $Id: interface.c,v 1.46.2.11 2005/10/17 02:42:32 iliaa Exp $ */
+ 
+ #define ZEND_INCLUDE_FULL_WINDOWS_HEADERS
+ 
+@@ -62,7 +62,7 @@
+ #define CAAZ(s, v) add_assoc_zval_ex(return_value, s, sizeof(s), (zval *) v);
+ 
+ #define PHP_CURL_CHECK_OPEN_BASEDIR(str, len)													\
+-	if (PG(open_basedir) && *PG(open_basedir) &&                                                \
++	if (((PG(open_basedir) && *PG(open_basedir)) || PG(safe_mode)) &&                                                \
+ 	    strncasecmp(str, "file://", sizeof("file://") - 1) == 0)								\
+ 	{ 																							\
+ 		php_url *tmp_url; 																		\
+@@ -72,7 +72,7 @@
+ 			RETURN_FALSE; 																		\
+ 		} 																						\
+ 																								\
+-		if (php_check_open_basedir(tmp_url->path TSRMLS_CC) || 									\
++		if (tmp_url->query || php_check_open_basedir(tmp_url->path TSRMLS_CC) || 									\
+ 			(PG(safe_mode) && !php_checkuid(tmp_url->path, "rb+", CHECKUID_CHECK_MODE_PARAM))	\
+ 		) { 																					\
+ 			php_url_free(tmp_url); 																\
+@@ -1128,10 +1128,15 @@
+ 					 * must be explicitly cast to long in curl_formadd
+ 					 * use since curl needs a long not an int. */
+ 					if (*postval == '@') {
++						++postval;
++						/* safe_mode / open_basedir check */
++						if (php_check_open_basedir(postval TSRMLS_CC) || (PG(safe_mode) && !php_checkuid(postval, "rb+", CHECKUID_CHECK_MODE_PARAM))) {
++							RETURN_FALSE;
++						}
+ 						error = curl_formadd(&first, &last, 
+ 											 CURLFORM_COPYNAME, string_key,
+ 											 CURLFORM_NAMELENGTH, (long)string_key_len - 1,
+-											 CURLFORM_FILE, ++postval, 
++											 CURLFORM_FILE, postval, 
+ 											 CURLFORM_END);
+ 					} else {
+ 						error = curl_formadd(&first, &last, 
diff --git a/dev-lang/php/files/5.0.5/php5.0.5-globals_overwrite.patch b/dev-lang/php/files/5.0.5/php5.0.5-globals_overwrite.patch
new file mode 100644
index 000000000000..cdae541d5eef
--- /dev/null
+++ b/dev-lang/php/files/5.0.5/php5.0.5-globals_overwrite.patch
@@ -0,0 +1,203 @@
+--- ext/standard/array.c	2005-09-01 14:01:01.000000000 +0200
++++ ext/standard/array.c	2005-11-01 01:15:13.000000000 +0100
+@@ -21,7 +21,7 @@
+    +----------------------------------------------------------------------+
+ */
+ 
+-/* $Id: array.c,v 1.266.2.25 2005/09/01 12:01:01 dmitry Exp $ */
++/* $Id: array.c,v 1.266.2.29 2005/10/28 09:57:15 dmitry Exp $ */
+ 
+ #include "php.h"
+ #include "php_ini.h"
+@@ -1050,6 +1050,7 @@
+ 		if (recursive && Z_TYPE_PP(args[0]) == IS_ARRAY) {
+ 			HashTable *thash;
+ 			
++			SEPARATE_ZVAL_TO_MAKE_IS_REF(args[0]);
+ 			thash = HASH_OF(*(args[0]));
+ 			if (thash == target_hash) {
+ 				php_error_docref(NULL TSRMLS_CC, E_WARNING, "recursion detected");
+@@ -1373,6 +1374,10 @@
+ 				/* break omitted intentionally */
+ 
+ 			case EXTR_OVERWRITE:
++				/* GLOBALS protection */
++				if (var_exists && !strcmp(var_name, "GLOBALS")) {
++					break;
++				}
+ 				smart_str_appendl(&final_name, var_name, var_name_len);
+ 				break;
+ 
+@@ -2487,8 +2492,9 @@
+ 				Z_LVAL_PP(tmp)++;
+ 			}
+ 		} else if (Z_TYPE_PP(entry) == IS_STRING) {
+-			/* make sure our array does not end up with numeric string keys */
+-			if (is_numeric_string(Z_STRVAL_PP(entry), Z_STRLEN_PP(entry), NULL, NULL, 0) == IS_LONG) {
++			/* make sure our array does not end up with numeric string keys
++			 * but don't touch those strings that start with 0 */
++			if (!(Z_STRLEN_PP(entry) > 1 && Z_STRVAL_PP(entry)[0] == '0') && is_numeric_string(Z_STRVAL_PP(entry), Z_STRLEN_PP(entry), NULL, NULL, 0) == IS_LONG) {
+ 				zval tmp_entry;
+ 				
+ 				tmp_entry = **entry;
+@@ -3975,7 +3981,7 @@
+ PHP_FUNCTION(array_filter)
+ {
+ 	zval **input, **callback = NULL;
+-	zval *array;
++	zval *array, *func = NULL;
+ 	zval **operand;
+ 	zval **args[1];
+ 	zval *retval = NULL;
+@@ -3995,10 +4001,13 @@
+ 		php_error_docref(NULL TSRMLS_CC, E_WARNING, "The first argument should be an array");
+ 		return;
+ 	}
++	if (callback) {
++		func = *callback;
++	}
+ 	array = *input;
+ 
+ 	if (ZEND_NUM_ARGS() > 1) {
+-		if (!zend_is_callable(*callback, 0, &callback_name)) {
++		if (!zend_is_callable(func, 0, &callback_name)) {
+ 			php_error_docref(NULL TSRMLS_CC, E_WARNING, "The second argument, '%s', should be a valid callback", callback_name);
+ 			efree(callback_name);
+ 			return;
+@@ -4015,14 +4024,14 @@
+ 		 zend_hash_get_current_data_ex(Z_ARRVAL_P(array), (void **)&operand, &pos) == SUCCESS;
+ 		 zend_hash_move_forward_ex(Z_ARRVAL_P(array), &pos)) {
+ 
+-		if (callback) {
++		if (func) {
+ 			zend_fcall_info fci;
+ 
+ 			args[0] = operand;
+ 
+ 			fci.size = sizeof(fci);
+ 			fci.function_table = EG(function_table);
+-			fci.function_name = *callback;
++			fci.function_name = func;
+ 			fci.symbol_table = NULL;
+ 			fci.object_pp = NULL;
+ 			fci.retval_ptr_ptr = &retval;
+--- ext/standard/basic_functions.c	2005-08-21 20:36:33.000000000 +0200
++++ ext/standard/basic_functions.c	2005-11-01 01:15:20.000000000 +0100
+@@ -17,7 +17,7 @@
+    +----------------------------------------------------------------------+
+  */
+ 
+-/* $Id: basic_functions.c,v 1.673.2.18 2005/08/21 18:36:33 zeev Exp $ */
++/* $Id: basic_functions.c,v 1.673.2.21 2005/09/29 16:31:20 iliaa Exp $ */
+ 
+ #include "php.h"
+ #include "php_streams.h"
+@@ -742,8 +743,8 @@
+ 	PHP_FE(prev,					first_arg_force_ref)
+ 	PHP_FE(next,					first_arg_force_ref)
+ 	PHP_FE(reset,					first_arg_force_ref)
+-	PHP_FE(current,					first_arg_force_ref)
+-	PHP_FE(key,						first_arg_force_ref)
++	PHP_FE(current,					NULL)
++	PHP_FE(key,					NULL)
+ 	PHP_FE(min,																NULL)
+ 	PHP_FE(max,																NULL)
+ 	PHP_FE(in_array,														NULL)
+@@ -3076,11 +3077,25 @@
+ 	prefix = va_arg(args, char *);
+ 	prefix_len = va_arg(args, uint);
+ 
+-	new_key_len = prefix_len + hash_key->nKeyLength;
+-	new_key = (char *) emalloc(new_key_len);
++	if (!prefix_len) {
++		if (!hash_key->nKeyLength) {
++			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Numeric key detected - possible security hazard.");
++			return 0;
++		} else if (!strcmp(hash_key->arKey, "GLOBALS")) {
++			php_error_docref(NULL TSRMLS_CC, E_WARNING, "Attempted GLOBALS variable overwrite.");
++			return 0; 
++		}
++	}
++
++	if (hash_key->nKeyLength) {
++		new_key_len = prefix_len + hash_key->nKeyLength;
++		new_key = (char *) emalloc(new_key_len);
+ 
+-	memcpy(new_key, prefix, prefix_len);
+-	memcpy(new_key+prefix_len, hash_key->arKey, hash_key->nKeyLength);
++		memcpy(new_key, prefix, prefix_len);
++		memcpy(new_key+prefix_len, hash_key->arKey, hash_key->nKeyLength);
++	} else {
++		new_key_len = spprintf(&new_key, 0, "%s%ld", prefix, hash_key->h);
++	}
+ 
+ 	zend_hash_del(&EG(symbol_table), new_key, new_key_len);
+ 	ZEND_SET_SYMBOL_WITH_LENGTH(&EG(symbol_table), new_key, new_key_len, *var, (*var)->refcount+1, 0);
+--- ext/standard/string.c	2005-07-16 13:18:35.000000000 +0200
++++ ext/standard/string.c	2005-11-01 01:15:27.000000000 +0100
+@@ -18,7 +18,7 @@
+    +----------------------------------------------------------------------+
+  */
+ 
+-/* $Id: string.c,v 1.420.2.12 2005/07/16 11:18:35 hyanantha Exp $ */
++/* $Id: string.c,v 1.420.2.13 2005/09/28 22:35:43 iliaa Exp $ */
+ 
+ /* Synced with php 3.0 revision 1.193 1999-06-16 [ssb] */
+ 
+@@ -3809,7 +3809,6 @@
+ 	zval *sarg;
+ 	char *res = NULL;
+ 	int argCount;
+-	int old_rg;
+ 
+ 	argCount = ZEND_NUM_ARGS();
+ 	if (argCount < 1 || argCount > 2 || zend_get_parameters_ex(argCount, &arg, &arrayArg) == FAILURE) {
+@@ -3822,19 +3821,18 @@
+ 		res = estrndup(Z_STRVAL_P(sarg), Z_STRLEN_P(sarg));
+ 	}
+ 
+-	old_rg = PG(register_globals);
+ 	if (argCount == 1) {
+-		PG(register_globals) = 1;
+-		sapi_module.treat_data(PARSE_STRING, res, NULL TSRMLS_CC);
++		zval tmp;
++		Z_ARRVAL(tmp) = EG(active_symbol_table);
++
++		sapi_module.treat_data(PARSE_STRING, res, &tmp TSRMLS_CC);
+ 	} else 	{
+-		PG(register_globals) = 0;
+ 		/* Clear out the array that was passed in. */
+ 		zval_dtor(*arrayArg);
+ 		array_init(*arrayArg);
+ 		
+ 		sapi_module.treat_data(PARSE_STRING, res, *arrayArg TSRMLS_CC);
+ 	}
+-	PG(register_globals) = old_rg;
+ }
+ /* }}} */
+ 
+--- main/php_variables.c	2005-09-01 21:15:51.000000000 +0200
++++ main/php_variables.c	2005-11-01 01:16:22.000000000 +0100
+@@ -17,7 +17,7 @@
+    +----------------------------------------------------------------------+
+  */
+ 
+-/* $Id: php_variables.c,v 1.81.2.12 2005/09/01 19:15:51 iliaa Exp $ */
++/* $Id: php_variables.c,v 1.81.2.13 2005/09/28 22:35:42 iliaa Exp $ */
+ 
+ #include <stdio.h>
+ #include "php.h"
+@@ -103,6 +103,13 @@
+ 		zval_dtor(val);
+ 		return;
+ 	}
++
++	/* GLOBALS hijack attempt, reject parameter */
++	if (symtable1 == EG(active_symbol_table) && !strcmp("GLOBALS", var)) {
++		zval_dtor(val);
++		return;
++	}
++
+ 	/* ensure that we don't have spaces or dots in the variable name (not binary safe) */
+ 	for (p=var; *p; p++) {
+ 		switch(*p) {
diff --git a/dev-lang/php/files/digest-php-4.3.11-r2 b/dev-lang/php/files/digest-php-4.3.11-r3
index 65531066fd6b..65531066fd6b 100644
--- a/dev-lang/php/files/digest-php-4.3.11-r2
+++ b/dev-lang/php/files/digest-php-4.3.11-r3
diff --git a/dev-lang/php/files/digest-php-4.4.0-r2 b/dev-lang/php/files/digest-php-4.4.0-r3
index 5cf0a8b3bd28..5cf0a8b3bd28 100644
--- a/dev-lang/php/files/digest-php-4.4.0-r2
+++ b/dev-lang/php/files/digest-php-4.4.0-r3
diff --git a/dev-lang/php/files/digest-php-4.4.1 b/dev-lang/php/files/digest-php-4.4.1
new file mode 100644
index 000000000000..f88fc54cea9e
--- /dev/null
+++ b/dev-lang/php/files/digest-php-4.4.1
@@ -0,0 +1 @@
+MD5 6b5726471189f8a1f26dd7cc5e19b442 php-4.4.1.tar.bz2 4157749
diff --git a/dev-lang/php/files/digest-php-5.0.4-r2 b/dev-lang/php/files/digest-php-5.0.4-r3
index 6b6d1ce71bb5..6b6d1ce71bb5 100644
--- a/dev-lang/php/files/digest-php-5.0.4-r2
+++ b/dev-lang/php/files/digest-php-5.0.4-r3
diff --git a/dev-lang/php/files/digest-php-5.0.5-r2 b/dev-lang/php/files/digest-php-5.0.5-r3
index 9a62d89ecd07..9a62d89ecd07 100644
--- a/dev-lang/php/files/digest-php-5.0.5-r2
+++ b/dev-lang/php/files/digest-php-5.0.5-r3
diff --git a/dev-lang/php/php-4.3.11-r2.ebuild b/dev-lang/php/php-4.3.11-r3.ebuild
index 14e1d1b0c910..34dd2554145a 100644
--- a/dev-lang/php/php-4.3.11-r2.ebuild
+++ b/dev-lang/php/php-4.3.11-r3.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2005 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/dev-lang/php/php-4.3.11-r2.ebuild,v 1.2 2005/11/02 00:10:23 vapier Exp $
+# $Header: /var/cvsroot/gentoo-x86/dev-lang/php/php-4.3.11-r3.ebuild,v 1.1 2005/11/03 14:09:24 chtekk Exp $
 
 IUSE="cgi cli discard-path force-cgi-redirect"
 KEYWORDS="~arm ~s390 ~sparc ~x86"
@@ -80,11 +80,14 @@ src_unpack() {
 	cd "${S}"
 
 	# fix PHP branding
-	sed -e 's|^EXTRA_VERSION=""|EXTRA_VERSION="-pl2-gentoo"|g' -i configure.in
+	sed -e 's|^EXTRA_VERSION=""|EXTRA_VERSION="-pl3-gentoo"|g' -i configure.in
 
 	# patch to fix pspell extension, bug #99312 (new patch by upstream)
 	use spell && epatch "${FILESDIR}/4.3.11/php4.3.11-pspell-ext-segf.patch"
 
+	# patch fo fix safe_mode bypass in CURL extension, bug #111032
+	use curl && epatch "${FILESDIR}/4.3.11/php4.3.11-curl_safemode.patch"
+
 	# patch to fix safe_mode bypass in GD extension, bug #109669
 	if use gd || use gd-external ; then
 		epatch "${FILESDIR}/4.3.11/php4.3.11-gd_safe_mode.patch"
@@ -93,6 +96,12 @@ src_unpack() {
 	# patch open_basedir directory bypass, bug #102943
 	epatch "${FILESDIR}/4.3.11/php4.3.11-fopen_wrappers.patch"
 
+	# patch $GLOBALS overwrite vulnerability, bug #111011 and bug #111014
+	epatch "${FILESDIR}/4.3.11/php4.3.11-globals_overwrite.patch"
+
+	# patch phpinfo() XSS vulnerability, bug #111015
+	epatch "${FILESDIR}/4.3.11/php4.3.11-phpinfo_xss.patch"
+
 	# patch to fix session.save_path segfault and other issues in
 	# the apache2handler SAPI, bug #107602
 	epatch "${FILESDIR}/4.3.11/php4.3.11-session_save_path-segf.patch"
diff --git a/dev-lang/php/php-4.4.0-r2.ebuild b/dev-lang/php/php-4.4.0-r3.ebuild
index 81fcd5a72c67..136f04d5dc05 100644
--- a/dev-lang/php/php-4.4.0-r2.ebuild
+++ b/dev-lang/php/php-4.4.0-r3.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2005 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/dev-lang/php/php-4.4.0-r2.ebuild,v 1.2 2005/11/02 00:10:23 vapier Exp $
+# $Header: /var/cvsroot/gentoo-x86/dev-lang/php/php-4.4.0-r3.ebuild,v 1.1 2005/11/03 14:09:24 chtekk Exp $
 
 IUSE="cgi cli discard-path force-cgi-redirect"
 KEYWORDS="~amd64 ~arm ~ppc ~s390 ~sparc ~x86"
@@ -80,11 +80,14 @@ src_unpack() {
 	cd "${S}"
 
 	# fix PHP branding
-	sed -e 's|^EXTRA_VERSION=""|EXTRA_VERSION="-pl2-gentoo"|g' -i configure.in
+	sed -e 's|^EXTRA_VERSION=""|EXTRA_VERSION="-pl3-gentoo"|g' -i configure.in
 
 	# patch to fix pspell extension, bug #99312 (new patch by upstream)
 	use spell && epatch "${FILESDIR}/4.4.0/php4.4.0-pspell-ext-segf.patch"
 
+	# patch fo fix safe_mode bypass in CURL extension, bug #111032
+	use curl && epatch "${FILESDIR}/4.4.0/php4.4.0-curl_safemode.patch"
+
 	# patch to fix safe_mode bypass in GD extension, bug #109669
 	if use gd || use gd-external ; then
 		epatch "${FILESDIR}/4.4.0/php4.4.0-gd_safe_mode.patch"
@@ -93,6 +96,12 @@ src_unpack() {
 	# patch open_basedir directory bypass, bug #102943
 	epatch "${FILESDIR}/4.4.0/php4.4.0-fopen_wrappers.patch"
 
+	# patch $GLOBALS overwrite vulnerability, bug #111011 and bug #111014
+	epatch "${FILESDIR}/4.4.0/php4.4.0-globals_overwrite.patch"
+
+	# patch phpinfo() XSS vulnerability, bug #111015
+	epatch "${FILESDIR}/4.4.0/php4.4.0-phpinfo_xss.patch"
+
 	# patch to fix session.save_path segfault and other issues in
 	# the apache2handler SAPI, bug #107602
 	epatch "${FILESDIR}/4.4.0/php4.4.0-session_save_path-segf.patch"
diff --git a/dev-lang/php/php-4.4.1.ebuild b/dev-lang/php/php-4.4.1.ebuild
new file mode 100644
index 000000000000..63ac3c5114cc
--- /dev/null
+++ b/dev-lang/php/php-4.4.1.ebuild
@@ -0,0 +1,278 @@
+# Copyright 1999-2005 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+# $Header: /var/cvsroot/gentoo-x86/dev-lang/php/php-4.4.1.ebuild,v 1.1 2005/11/03 14:09:24 chtekk Exp $
+
+IUSE="cgi cli discard-path force-cgi-redirect"
+KEYWORDS="~x86"
+
+# NOTE: Portage doesn't support setting PROVIDE based on the USE flags
+#		that have been enabled, so we have to PROVIDE everything for now
+#		and hope for the best
+#
+#		This will be sorted out when GLEP 37 is implemented
+
+PROVIDE="virtual/php virtual/httpd-php"
+
+# php package settings
+SLOT="4"
+MY_PHP_P="php-${PV}"
+PHP_PACKAGE=1
+
+inherit eutils php4_4-sapi apache-module
+
+want_apache
+
+DESCRIPTION="The PHP language runtime engine"
+
+DEPEND="${DEPEND} app-admin/eselect-php"
+RDEPEND="${RDEPEND} app-admin/eselect-php"
+
+pkg_setup() {
+	# make sure the user has specified a SAPI
+	einfo "Determining SAPI(s) to build"
+	confutils_require_any "  Enabled  SAPI:" "  Disabled SAPI:" cli cgi apache apache2
+
+	if useq apache || useq apache2 ; then
+		if [ "${APACHE_VERSION}" != "0" ] ; then
+			if ! useq threads ; then
+				APACHE2_SAFE_MPMS="peruser prefork"
+			else
+				APACHE2_SAFE_MPMS="event leader metuxmpm perchild threadpool worker"
+			fi
+
+			ewarn
+			ewarn "If this package fails with a fatal error about Apache2 not having"
+			ewarn "been compiled with a compatible MPM, this is normally because you"
+			ewarn "need to toggle the 'threads' USE flag."
+			ewarn
+			ewarn "If 'threads' is off, try switching it on."
+			ewarn "If 'threads' is on, try switching it off."
+			ewarn
+
+			apache-module_pkg_setup
+		fi
+	fi
+
+	if useq fastbuild ; then
+		ewarn
+		ewarn "'fastbuild' attempts to build all SAPIs in a single pass."
+		ewarn "This is an experimental feature, which may fail to compile"
+		ewarn "and may produce PHP binaries which are broken."
+		ewarn
+		ewarn "Rebuild without 'fastbuild' and reproduce any bugs before filing"
+		ewarn "any bugs in Gentoo's Bugzilla or bugs.php.net."
+		ewarn
+	fi
+
+	php4_4-sapi_pkg_setup
+}
+
+php_determine_sapis() {
+
+	# holds the list of sapis that we want to build
+	PHPSAPIS=
+
+	if useq cli ; then
+		PHPSAPIS="${PHPSAPIS} cli"
+	fi
+
+	if useq cgi ; then
+		PHPSAPIS="${PHPSAPIS} cgi"
+	fi
+
+	# note - we can only build one apache sapi for now
+	# note - apache SAPI comes after the simpler cli/cgi sapis
+
+	if useq apache || useq apache2 ; then
+		if [ "${APACHE_VERSION}" != "0" ]; then
+			PHPSAPIS="${PHPSAPIS} apache${APACHE_VERSION}"
+		fi
+	fi
+}
+
+src_compile() {
+	if useq fastbuild ; then
+		src_compile_fastbuild
+	else
+		src_compile_normal
+	fi
+}
+
+src_compile_fastbuild() {
+	php_determine_sapis
+
+	build_cli=0
+	build_cgi=0
+	build_apache=0
+
+	for x in ${PHPSAPIS} ; do
+		case ${x} in
+			cli)
+				build_cli=1
+				;;
+			cgi)
+				build_cgi=1
+				;;
+			apache*)
+				build_apache=1
+				;;
+		esac
+	done
+
+	if [[ ${build_cli} = 1 ]] ; then
+		my_conf="${my_conf} --enable-cli"
+	else
+		my_conf="${my_conf} --disable-cli"
+	fi
+
+	if [[ ${build_cgi} = 1 ]] ; then
+		my_conf="${my_conf} --enable-cgi --enable-fastcgi"
+		enable_extension_enable "discard-path" "discard-path" 0
+		enable_extension_enable "force-cgi-redirect" "force-cgi-redirect" 0
+	else
+		my_conf="${my_conf} --disable-cgi"
+	fi
+
+	if [[ ${build_apache} = 1 ]] ; then
+		my_conf="${my_conf} --with-apxs${USE_APACHE2}=/usr/sbin/apxs${USE_APACHE2}"
+	fi
+
+	# now we know what we are building, build it
+	php4_4-sapi_src_compile
+
+	# to keep the separate php.ini files for each SAPI, we change the
+	# build-defs.h and recompile
+
+	if [[ ${build_cli} = 1 ]] ; then
+		einfo
+		einfo "Building CLI SAPI"
+		einfo
+
+		sed -e 's|^#define PHP_CONFIG_FILE_PATH.*|#define PHP_CONFIG_FILE_PATH "/etc/php/cli-php4"|g;' -i main/build-defs.h
+		sed -e 's|^#define PHP_CONFIG_FILE_SCAN_DIR.*|#define PHP_CONFIG_FILE_SCAN_DIR "/etc/php/cli-php4/ext-active"|g;' -i main/build-defs.h
+		for x in main/main.o main/main.lo main/php_ini.o main/php_ini.lo ; do
+			[[ -f ${x} ]] && rm -f ${x}
+		done
+		make sapi/cli/php || die "Unable to make CLI SAPI"
+		cp sapi/cli/php php-cli || die "Unable to copy CLI SAPI"
+	fi
+	if [[ ${build_cgi} = 1 ]] ; then
+		einfo
+		einfo "Building CGI SAPI"
+		einfo
+
+		sed -e 's|^#define PHP_CONFIG_FILE_PATH.*|#define PHP_CONFIG_FILE_PATH "/etc/php/cgi-php4"|g;' -i main/build-defs.h
+		sed -e 's|^#define PHP_CONFIG_FILE_SCAN_DIR.*|#define PHP_CONFIG_FILE_SCAN_DIR "/etc/php/cgi-php4/ext-active"|g;' -i main/build-defs.h
+		for x in main/main.o main/main.lo main/php_ini.o main/php_ini.lo ; do
+			[[ -f ${x} ]] && rm -f ${x}
+		done
+		make sapi/cgi/php || die "Unable to make CGI SAPI"
+		cp sapi/cgi/php php-cgi || die "Unable to copy CGI SAPI"
+	fi
+	if [[ ${build_apache} = 1 ]] ; then
+		einfo
+		einfo "Building apache${USE_APACHE2} SAPI"
+		einfo
+
+		sed -e "s|^#define PHP_CONFIG_FILE_PATH.*|#define PHP_CONFIG_FILE_PATH \"/etc/php/apache${APACHE_VERSION}-php4\"|g;" -i main/build-defs.h
+		sed -e "s|^#define PHP_CONFIG_FILE_SCAN_DIR.*|#define PHP_CONFIG_FILE_SCAN_DIR \"/etc/php/apache${APACHE_VERSION}-php4/ext-active\"|g;" -i main/build-defs.h
+		for x in main/main.o main/main.lo main/php_ini.o main/php_ini.lo ; do
+			[[ -f ${x} ]] && rm -f ${x}
+		done
+		make || die "Unable to build mod_php"
+	fi
+}
+
+src_compile_normal() {
+	php_determine_sapis
+
+	CLEAN_REQUIRED=0
+
+	for x in ${PHPSAPIS} ; do
+		if [ "${CLEAN_REQUIRED}" = 1 ]; then
+			make clean
+			# echo > /dev/null
+		fi
+
+		PHPSAPI=${x}
+		case ${x} in
+			cli)
+				my_conf="--enable-cli --disable-cgi"
+				php4_4-sapi_src_compile
+				cp sapi/cli/php php-cli
+				;;
+			cgi)
+				my_conf="${orig_conf} --disable-cli --enable-cgi --enable-fastcgi"
+				enable_extension_enable "discard-path" "discard-path" 0
+				enable_extension_enable "force-cgi-redirect" "force-cgi-redirect" 0
+				php4_4-sapi_src_compile
+				cp sapi/cgi/php php-cgi
+				;;
+			apache*)
+				my_conf="${orig_conf} --disable-cli --with-apxs${USE_APACHE2}=/usr/sbin/apxs${USE_APACHE2}"
+				php4_4-sapi_src_compile
+				;;
+		esac
+
+		CLEAN_REQUIRED=1
+	done
+}
+
+src_install() {
+	php_determine_sapis
+
+	destdir=/usr/$(get_libdir)/php4
+
+	# let the eclass do the heavy lifting
+	php4_4-sapi_src_install
+
+	einfo
+	einfo "Installing SAPI(s) ${PHPSAPIS}"
+	einfo
+
+	for x in ${PHPSAPIS} ; do
+		PHPSAPI=${x}
+		case ${x} in
+			cli)
+				einfo "Installing CLI SAPI"
+				into ${destdir}
+				newbin php-cli php || die "Unable to install ${x} sapi"
+				php4_4-sapi_install_ini
+				;;
+			cgi)
+				einfo "Installing CGI SAPI"
+				into ${destdir}
+				dobin php-cgi || die "Unable to install ${x} sapi"
+				php4_4-sapi_install_ini
+				;;
+			apache*)
+				einfo "Installing apache${USE_APACHE2} SAPI"
+				make INSTALL_ROOT="${D}" install-sapi || die "Unable to install ${x} SAPI"
+				if [ -n "${USE_APACHE2}" ] ; then
+					einfo "Installing Apache2 config for PHP (70_mod_php.conf)"
+					insinto ${APACHE_MODULES_CONFDIR}
+					doins "${FILESDIR}/4-any/apache-2.0/70_mod_php.conf"
+				else
+					einfo "Installing Apache config for PHP (70_mod_php.conf)"
+					insinto ${APACHE_MODULES_CONFDIR}
+					doins "${FILESDIR}/4-any/apache-1.3/70_mod_php.conf"
+				fi
+				php4_4-sapi_install_ini
+				;;
+		esac
+	done
+
+}
+
+pkg_postinst()
+{
+	# Output some general info to the user
+	if useq apache || useq apache2 ; then
+		APACHE1_MOD_DEFINE="PHP4"
+		APACHE1_MOD_CONF="70_mod_php"
+		APACHE2_MOD_DEFINE="PHP4"
+		APACHE2_MOD_CONF="70_mod_php"
+		apache-module_pkg_postinst
+	fi
+	php4_4-sapi_pkg_postinst
+}
diff --git a/dev-lang/php/php-5.0.4-r2.ebuild b/dev-lang/php/php-5.0.4-r3.ebuild
index cd172d9ea58d..92c012411c88 100644
--- a/dev-lang/php/php-5.0.4-r2.ebuild
+++ b/dev-lang/php/php-5.0.4-r3.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2005 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/dev-lang/php/php-5.0.4-r2.ebuild,v 1.2 2005/11/02 00:10:23 vapier Exp $
+# $Header: /var/cvsroot/gentoo-x86/dev-lang/php/php-5.0.4-r3.ebuild,v 1.1 2005/11/03 14:09:24 chtekk Exp $
 
 IUSE="cgi cli discard-path force-cgi-redirect"
 KEYWORDS="~amd64 ~arm ~ppc ~s390 ~sparc ~x86"
@@ -69,7 +69,7 @@ src_unpack() {
 	cd "${S}"
 
 	# fix PHP branding
-	sed -e 's|^EXTRA_VERSION=""|EXTRA_VERSION="-pl2-gentoo"|g' -i configure.in
+	sed -e 's|^EXTRA_VERSION=""|EXTRA_VERSION="-pl3-gentoo"|g' -i configure.in
 
 	# fix a GCC4 compile bug in XMLRPC extension, bug #96813
 	use xmlrpc && epatch "${FILESDIR}/5.0.4/php5.0.4-xmlrcp-ccode.diff"
@@ -77,6 +77,9 @@ src_unpack() {
 	# patch to fix pspell extension, bug #99312 (new patch by upstream)
 	use spell && epatch "${FILESDIR}/5.0.4/php5.0.4-pspell-ext-segf.patch"
 
+	# patch fo fix safe_mode bypass in CURL extension, bug #111032
+	use curl && epatch "${FILESDIR}/5.0.4/php5.0.4-curl_safemode.patch"
+
 	# patch to fix safe_mode bypass in GD extension, bug #109669
 	if use gd || use gd-external ; then
 		epatch "${FILESDIR}/5.0.4/php5.0.4-gd_safe_mode.patch"
@@ -85,6 +88,12 @@ src_unpack() {
 	# patch open_basedir directory bypass, bug #102943
 	epatch "${FILESDIR}/5.0.4/php5.0.4-fopen_wrappers.patch"
 
+	# patch $GLOBALS overwrite vulnerability, bug #111011 and bug #111014
+	epatch "${FILESDIR}/5.0.4/php5.0.4-globals_overwrite.patch"
+
+	# patch phpinfo() XSS vulnerability, bug #111015
+	epatch "${FILESDIR}/5.0.4/php5.0.4-phpinfo_xss.patch"
+
 	# patch to fix session.save_path segfault and other issues in
 	# the apache2handler SAPI, bug #107602
 	epatch "${FILESDIR}/5.0.4/php5.0.4-session_save_path-segf.patch"
diff --git a/dev-lang/php/php-5.0.5-r2.ebuild b/dev-lang/php/php-5.0.5-r3.ebuild
index e25dedf488c6..fc499c47d969 100644
--- a/dev-lang/php/php-5.0.5-r2.ebuild
+++ b/dev-lang/php/php-5.0.5-r3.ebuild
@@ -1,6 +1,6 @@
 # Copyright 1999-2005 Gentoo Foundation
 # Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/dev-lang/php/php-5.0.5-r2.ebuild,v 1.2 2005/11/02 00:10:23 vapier Exp $
+# $Header: /var/cvsroot/gentoo-x86/dev-lang/php/php-5.0.5-r3.ebuild,v 1.1 2005/11/03 14:09:24 chtekk Exp $
 
 IUSE="cgi cli discard-path force-cgi-redirect"
 KEYWORDS="~amd64 ~arm ~ppc ~s390 ~sparc ~x86"
@@ -66,11 +66,14 @@ src_unpack() {
 	cd "${S}"
 
 	# fix PHP branding
-	sed -e 's|^EXTRA_VERSION=""|EXTRA_VERSION="-pl2-gentoo"|g' -i configure.in
+	sed -e 's|^EXTRA_VERSION=""|EXTRA_VERSION="-pl3-gentoo"|g' -i configure.in
 
 	# patch to fix pspell extension, bug #99312 (new patch by upstream)
 	use spell && epatch "${FILESDIR}/5.0.5/php5.0.5-pspell-ext-segf.patch"
 
+	# patch fo fix safe_mode bypass in CURL extension, bug #111032
+	use curl && epatch "${FILESDIR}/5.0.5/php5.0.5-curl_safemode.patch"
+
 	# patch to fix safe_mode bypass in GD extension, bug #109669
 	if use gd || use gd-external ; then
 		epatch "${FILESDIR}/5.0.5/php5.0.5-gd_safe_mode.patch"
@@ -79,6 +82,9 @@ src_unpack() {
 	# patch open_basedir directory bypass, bug #102943
 	epatch "${FILESDIR}/5.0.5/php5.0.5-fopen_wrappers.patch"
 
+	# patch $GLOBALS overwrite vulnerability, bug #111011 and bug #111014
+	epatch "${FILESDIR}/5.0.5/php5.0.5-globals_overwrite.patch"
+
 	# patch to fix session.save_path segfault and other issues in
 	# the apache2handler SAPI, bug #107602
 	epatch "${FILESDIR}/5.0.5/php5.0.5-session_save_path-segf.patch"