Merge branch 'PHP-5.6'

* PHP-5.6:
  Updated NEWS for #70157
  Fixed #70157 parse_ini_string() segmentation fault with INI_SCANNER_TYPED

diff --cc Zend/zend_ini_parser.y
index 565d83eef820b18d55a9e2fdf8db64b939242855,22b92db03340ede1a2ed0afd2c9481c51348932f..2bcebe8a03cc673a96d30b64ddd20c40715de371
--- 1/Zend/zend_ini_parser.y
--- 2/Zend/zend_ini_parser.y
+++ b/Zend/zend_ini_parser.y
@@@ -102,12 -108,24 +102,20 @@@ static void zend_ini_init_string(zval *
  */
  static void zend_ini_add_string(zval *result, zval *op1, zval *op2)
  {
-       int op1_len = (int)Z_STRLEN_P(op1);
-       int length = op1_len + (int)Z_STRLEN_P(op2);
 -      int length;
++      int length, op1_len;
+ 
+       if (Z_TYPE_P(op1) != IS_STRING) {
 -              zval copy;
 -              MAKE_COPY_ZVAL(&op1, &copy);
 -              convert_to_string(&copy);
 -              Z_STRVAL_P(op1) = zend_strndup(Z_STRVAL(copy), Z_STRLEN(copy));
 -              Z_STRLEN_P(op1) = Z_STRLEN(copy);
 -              zval_dtor(&copy);
++              zend_string *str = zval_get_string(op1);
++              ZVAL_PSTRINGL(op1, str->val, str->len);
++              zend_string_release(str);
+       }
+ 
 -      length = Z_STRLEN_P(op1) + Z_STRLEN_P(op2);
++      op1_len = (int)Z_STRLEN_P(op1);
++      length = op1_len + (int)Z_STRLEN_P(op2);
  
 -      Z_STRVAL_P(result) = (char *) realloc(Z_STRVAL_P(op1), length+1);
 -      memcpy(Z_STRVAL_P(result)+Z_STRLEN_P(op1), Z_STRVAL_P(op2), Z_STRLEN_P(op2));
 +      ZVAL_NEW_STR(result, zend_string_extend(Z_STR_P(op1), length, 1));
 +      memcpy(Z_STRVAL_P(result)+op1_len, Z_STRVAL_P(op2), Z_STRLEN_P(op2));
        Z_STRVAL_P(result)[length] = 0;
 -      Z_STRLEN_P(result) = length;
 -      Z_TYPE_P(result) = IS_STRING;
  }
  /* }}} */
  
@@@ -298,12 -312,16 +306,16 @@@ statement
  #if DEBUG_CFG_PARSER
                        printf("OFFSET: '%s'[%s] = '%s'\n", Z_STRVAL($1), Z_STRVAL($2), Z_STRVAL($5));
  #endif
 -                      ZEND_INI_PARSER_CB(&$1, &$5, &$2, ZEND_INI_PARSER_POP_ENTRY, ZEND_INI_PARSER_ARG TSRMLS_CC);
 -                      free(Z_STRVAL($1));
 +                      ZEND_INI_PARSER_CB(&$1, &$5, &$2, ZEND_INI_PARSER_POP_ENTRY, ZEND_INI_PARSER_ARG);
 +                      zend_string_release(Z_STR($1));
-                       zend_string_release(Z_STR($2));
+                       if (Z_TYPE($2) == IS_STRING) {
 -                              free(Z_STRVAL($2));
++                              zend_string_release(Z_STR($2));
+                       } else {
+                               zval_dtor(&$2);
+                       }
 -                      zval_internal_dtor(&$5);
 +                      zval_ptr_dtor(&$5);
                }
 -      |       TC_LABEL        { ZEND_INI_PARSER_CB(&$1, NULL, NULL, ZEND_INI_PARSER_ENTRY, ZEND_INI_PARSER_ARG TSRMLS_CC); free(Z_STRVAL($1)); }
 +      |       TC_LABEL        { ZEND_INI_PARSER_CB(&$1, NULL, NULL, ZEND_INI_PARSER_ENTRY, ZEND_INI_PARSER_ARG); zend_string_release(Z_STR($1)); }
        |       END_OF_LINE
  ;
  

diff --cc ext/standard/basic_functions.c
index 3f03275aa59252f037504d407e5dafbd9d35905d,1abe3e60abbbfd96f3ccc0b891edbc5154ac73eb..8b83d558d32b37ff206beeaf22d25a4e6162dcfc
--- 1/ext/standard/basic_functions.c
--- 2/ext/standard/basic_functions.c
+++ b/ext/standard/basic_functions.c
@@@ -5839,17 -5894,20 +5839,17 @@@ static void php_simple_ini_parser_cb(zv
                                }
                        }
  
 -                      if (Z_TYPE_P(hash) != IS_ARRAY) {
 -                              zval_dtor(hash);
 -                              INIT_PZVAL(hash);
 -                              array_init(hash);
 +                      if (Z_TYPE_P(find_hash) != IS_ARRAY) {
 +                              zval_dtor(find_hash);
 +                              array_init(find_hash);
                        }
  
 -                      ALLOC_ZVAL(element);
 -                      MAKE_COPY_ZVAL(&arg2, element);
 -
 +                      ZVAL_DUP(&element, arg2);
- 
-                       if (arg3 && Z_STRLEN_P(arg3) > 0) {
-                               zend_symtable_update(Z_ARRVAL_P(find_hash), Z_STR_P(arg3), &element);
-                       } else {
+                       if (!arg3 || (Z_TYPE_P(arg3) == IS_STRING && Z_STRLEN_P(arg3) == 0)) {
 -                              add_next_index_zval(hash, element);
 +                              add_next_index_zval(find_hash, &element);
+                       } else {
 -                              array_set_zval_key(Z_ARRVAL_P(hash), arg3, element);
++                              array_set_zval_key(Z_ARRVAL_P(find_hash), arg3, &element);
+                               zval_ptr_dtor(&element);
                        }
                }
                break;