Merge branch 'PHP-5.6' into PHP-7.0

diff --cc NEWS
index 2a384db1e61476ce24ccafaa8f76d476abe5bc33,b11b28380a3feb7750592a03959f2de439365955..5e2dbd067d9061d80e5447d8c3eaa9298e5169b9
--- 1/NEWS
--- 2/NEWS
+++ b/NEWS
@@@ -1,7 -1,11 +1,11 @@@
  PHP                                                                        NEWS
  |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 -?? ??? 2016, PHP 5.6.27
 +?? ??? 2016 PHP 7.0.12
  
+ - Core:
+   . Fixed bug #73025 (Heap Buffer Overflow in virtual_popen of
+     zend_virtual_cwd.c). (cmb)
+ 
  - Filter:
    . Fixed bug #72972 (Bad filter for the flags FILTER_FLAG_NO_RES_RANGE and
      FILTER_FLAG_NO_PRIV_RANGE). (julien)

diff --cc Zend/zend_virtual_cwd.c
index 4dbbb5ea5b0e7fdfaccf18e6ae49b358bb3f5322,875c8da41c5ad9c8a384f6e23272650ab64b7c77..980cc0be18ee42f13700cac77e506691a426def6
--- 1/Zend/zend_virtual_cwd.c
--- 2/Zend/zend_virtual_cwd.c
+++ b/Zend/zend_virtual_cwd.c
@@@ -1852,9 -1894,9 +1852,9 @@@ CWD_API FILE *virtual_popen(const char 
  }
  /* }}} */
  #else /* Unix */
 -CWD_API FILE *virtual_popen(const char *command, const char *type TSRMLS_DC) /* {{{ */
 +CWD_API FILE *virtual_popen(const char *command, const char *type) /* {{{ */
  {
-       int command_length;
+       size_t command_length;
        int dir_length, extra = 0;
        char *command_line;
        char *ptr, *dir;