Merge branch 'PHP-5.6' into PHP-7.0

* PHP-5.6:
  More string length checks & fixes

diff --cc ext/imap/php_imap.c
Simple merge

diff --cc ext/intl/intl_convert.c
Simple merge

diff --cc ext/intl/locale/locale_methods.c
index 18a051fe20222b550e4dcff977be3db3a6cda869,39d80d524a4b3b8371a1411d823a5444ce703825..12cf6c1ce3b4cfc8c9fcc299139cf98988bd015e
--- 1/ext/intl/locale/locale_methods.c
--- 2/ext/intl/locale/locale_methods.c
+++ b/ext/intl/locale/locale_methods.c
@@@ -713,8 -705,10 +716,10 @@@ PHP_FUNCTION( locale_get_keywords 
          RETURN_FALSE;
      }
  
+       INTL_CHECK_LOCALE_LEN(strlen(loc_name));
+ 
      if(loc_name_len == 0) {
 -        loc_name = intl_locale_get_default(TSRMLS_C);
 +        loc_name = intl_locale_get_default();
      }
  
        /* Get the keywords */
@@@ -1120,8 -1114,10 +1125,10 @@@ PHP_FUNCTION(locale_parse
          RETURN_FALSE;
      }
  
+     INTL_CHECK_LOCALE_LEN(strlen(loc_name));
+ 
      if(loc_name_len == 0) {
 -        loc_name = intl_locale_get_default(TSRMLS_C);
 +        loc_name = intl_locale_get_default();
      }
  
        array_init( return_value );

diff --cc ext/intl/msgformat/msgformat_data.c
Simple merge

diff --cc ext/zip/php_zip.c
index cfac56650668f37b9b0d4cbc9afd0ab525b444ea,9f2b3768d3ca65e43f5ebbaa44ccf57856bd597f..473e231b46fd3e0408ce9432ebee9d46abf9c2aa
--- 1/ext/zip/php_zip.c
--- 2/ext/zip/php_zip.c
+++ b/ext/zip/php_zip.c
@@@ -1803,19 -1913,19 +1803,19 @@@ static ZIPARCHIVE_METHOD(addFromString
                return;
        }
  
 -      ze_obj = (ze_zip_object*) zend_object_store_get_object(this TSRMLS_CC);
 +      ze_obj = Z_ZIP_P(self);
        if (ze_obj->buffers_cnt) {
-               ze_obj->buffers = (char **)erealloc(ze_obj->buffers, sizeof(char *) * (ze_obj->buffers_cnt+1));
+               ze_obj->buffers = (char **)safe_erealloc(ze_obj->buffers, sizeof(char *), (ze_obj->buffers_cnt+1), 0);
                pos = ze_obj->buffers_cnt++;
        } else {
                ze_obj->buffers = (char **)emalloc(sizeof(char *));
                ze_obj->buffers_cnt++;
                pos = 0;
        }
-       ze_obj->buffers[pos] = (char *)emalloc(ZSTR_LEN(buffer) + 1);
 -      ze_obj->buffers[pos] = (char *)safe_emalloc(buffer_len, 1, 1);
 -      memcpy(ze_obj->buffers[pos], buffer, buffer_len + 1);
++      ze_obj->buffers[pos] = (char *)safe_emalloc(ZSTR_LEN(buffer), 1, 1);
 +      memcpy(ze_obj->buffers[pos], ZSTR_VAL(buffer), ZSTR_LEN(buffer) + 1);
  
 -      zs = zip_source_buffer(intern, ze_obj->buffers[pos], buffer_len, 0);
 +      zs = zip_source_buffer(intern, ze_obj->buffers[pos], ZSTR_LEN(buffer), 0);
  
        if (zs == NULL) {
                RETURN_FALSE;