Merge branch 'PHP-5.5' into PHP-5.6

Conflicts:
	main/streams/memory.c

diff --cc NEWS
index 5c94e125191692e0ce396e0b47f1f2353d5a9dca,dd20fa9bd7254ae144f1c8ba23e09eee7ffe55a2..063e752feccb72c26795944a9d36d9febfc6a999
--- 1/NEWS
--- 2/NEWS
+++ b/NEWS
@@@ -1,13 -1,14 +1,15 @@@
 -PHP                                                                        NEWS
 +PHP                                                                        NEWS
  |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 -?? ??? 2015, PHP 5.5.23
 +?? Feb 2015, PHP 5.6.7
  
  
 -?? ??? 2015, PHP 5.5.22
 +
 +?? Feb 2015, PHP 5.6.6
  
  - Core:
 -  . Fixed bug #67068 (getClosure returns somethings that's not a closure). 
+   . Fixed bug #68986 (pointer returned by php_stream_fopen_temporary_file
+     not validated in memory.c). (nayana at ddproperty dot com)
 +  . Fixed bug #67068 (getClosure returns somethings that's not a closure).
      (Danack at basereality dot com)
    . Fixed bug #68925 (Mitigation for CVE-2015-0235 – GHOST: glibc gethostbyname
      buffer overflow). (Stas)

diff --cc main/streams/memory.c
index 1577ae5d60236e2f3e7deb98764b02649fbba319,d0f2511aa709a6066a53256a51f2dddb969c5707..e5b65728a1b304a0d72402b4e17c808d93643bb4
--- 1/main/streams/memory.c
--- 2/main/streams/memory.c
+++ b/main/streams/memory.c
@@@ -374,7 -373,11 +374,11 @@@ static size_t php_stream_temp_write(php
                char *membuf = php_stream_memory_get_buffer(ts->innerstream, &memsize);
  
                if (memsize + count >= ts->smax) {
 -                      php_stream *file = php_stream_fopen_tmpfile();
 +                      php_stream *file = php_stream_fopen_temporary_file(ts->tmpdir, "php", NULL);
+                       if (file == NULL) {
+                               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to create temporary file, Check permissions in temporary files directory.");
+                               return 0;
+                       }
                        php_stream_write(file, membuf, memsize);
                        php_stream_free_enclosed(ts->innerstream, PHP_STREAM_FREE_CLOSE);
                        ts->innerstream = file;