Merge branch 'PHP-5.6'

* PHP-5.6:
  add NEWS
  Fixed bug #68776
  fix test
  update NEWS
  Fix bug #69646	OS command injection vulnerability in escapeshellarg
  Fix #69719 - more checks for nulls in paths
  fix test description
  Fixed Buf #68812 Unchecked return value.

Conflicts:
	ext/dom/document.c
	ext/gd/gd.c
	ext/standard/exec.c

diff --cc ext/dom/document.c
index d435b1c2813685a2dfe560cd38420b39f1aaaa89,1bf4c541ddd2b31f234aeebbf74ff90779a2f00b..3e4e298654d23bb32df5649c6963e969de2b4f69
--- 1/ext/dom/document.c
--- 2/ext/dom/document.c
+++ b/ext/dom/document.c
@@@ -1560,9 -1698,9 +1560,9 @@@ PHP_FUNCTION(dom_document_save
        dom_object *intern;
        dom_doc_propsptr doc_props;
        char *file;
 -      long options = 0;
 +      zend_long options = 0;
  
-       if (zend_parse_method_parameters(ZEND_NUM_ARGS(), getThis(), "Os|l", &id, dom_document_class_entry, &file, &file_len, &options) == FAILURE) {
 -      if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op|l", &id, dom_document_class_entry, &file, &file_len, &options) == FAILURE) {
++      if (zend_parse_method_parameters(ZEND_NUM_ARGS(), getThis(), "Op|l", &id, dom_document_class_entry, &file, &file_len, &options) == FAILURE) {
                return;
        }
  
@@@ -1793,7 -1930,7 +1793,7 @@@ static void _dom_document_schema_valida
        int                     is_valid;
        char resolved_path[MAXPATHLEN + 1];
  
-       if (zend_parse_method_parameters(ZEND_NUM_ARGS(), getThis(), "Op|l", &id, dom_document_class_entry, &source, &source_len, &flags) == FAILURE) {
 -      if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os|l", &id, dom_document_class_entry, &source, &source_len, &flags) == FAILURE) {
++      if (zend_parse_method_parameters(ZEND_NUM_ARGS(), getThis(), "Os|l", &id, dom_document_class_entry, &source, &source_len, &flags) == FAILURE) {
                return;
        }
  
@@@ -1806,9 -1943,13 +1806,13 @@@
  
        switch (type) {
        case DOM_LOAD_FILE:
-               valid_file = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN );
+               if (CHECK_NULL_PATH(source, source_len)) {
 -                      php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid Schema file source");
++                      php_error_docref(NULL, E_WARNING, "Invalid Schema file source");
+                       RETURN_FALSE;
+               }
+               valid_file = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN  TSRMLS_CC);
                if (!valid_file) {
 -                      php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid Schema file source");
 +                      php_error_docref(NULL, E_WARNING, "Invalid Schema file source");
                        RETURN_FALSE;
                }
                parser = xmlSchemaNewParserCtxt(valid_file);
@@@ -1889,7 -2030,7 +1893,7 @@@ static void _dom_document_relaxNG_valid
        int                     is_valid;
        char resolved_path[MAXPATHLEN + 1];
  
-       if (zend_parse_method_parameters(ZEND_NUM_ARGS(), getThis(), "Op", &id, dom_document_class_entry, &source, &source_len) == FAILURE) {
 -      if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Os", &id, dom_document_class_entry, &source, &source_len) == FAILURE) {
++      if (zend_parse_method_parameters(ZEND_NUM_ARGS(), getThis(), "Os", &id, dom_document_class_entry, &source, &source_len) == FAILURE) {
                return;
        }
  
@@@ -1902,9 -2043,13 +1906,13 @@@
  
        switch (type) {
        case DOM_LOAD_FILE:
-               valid_file = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN );
+               if (CHECK_NULL_PATH(source, source_len)) {
 -                      php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid RelaxNG file source");
++                      php_error_docref(NULL, E_WARNING, "Invalid RelaxNG file source");
+                       RETURN_FALSE;
+               }
+               valid_file = _dom_get_valid_file_path(source, resolved_path, MAXPATHLEN  TSRMLS_CC);
                if (!valid_file) {
 -                      php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid RelaxNG file source");
 +                      php_error_docref(NULL, E_WARNING, "Invalid RelaxNG file source");
                        RETURN_FALSE;
                }
                parser = xmlRelaxNGNewParserCtxt(valid_file);
@@@ -1983,7 -2127,7 +1991,7 @@@ static void dom_load_html(INTERNAL_FUNC
  
        id = getThis();
  
-       if (zend_parse_parameters(ZEND_NUM_ARGS(), "p|l", &source, &source_len, &options) == FAILURE) {
 -      if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s|l", &source, &source_len, &options) == FAILURE) {
++      if (zend_parse_parameters(ZEND_NUM_ARGS(), "s|l", &source, &source_len, &options) == FAILURE) {
                return;
        }
  
@@@ -1993,9 -2137,13 +2001,13 @@@
        }
  
        if (mode == DOM_LOAD_FILE) {
 -                      php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid file source");
+               if (CHECK_NULL_PATH(source, source_len)) {
++                      php_error_docref(NULL, E_WARNING, "Invalid file source");
+                       RETURN_FALSE;
+               }
                ctxt = htmlCreateFileParserCtxt(source, NULL);
        } else {
 -              source_len = xmlStrlen(source);
 +              source_len = xmlStrlen((xmlChar *) source);
                ctxt = htmlCreateMemoryParserCtxt(source, source_len);
        }
  
@@@ -2082,7 -2229,7 +2094,7 @@@ PHP_FUNCTION(dom_document_save_html_fil
        char *file;
        const char *encoding;
  
-       if (zend_parse_method_parameters(ZEND_NUM_ARGS(), getThis(), "Os", &id, dom_document_class_entry, &file, &file_len) == FAILURE) {
 -      if (zend_parse_method_parameters(ZEND_NUM_ARGS() TSRMLS_CC, getThis(), "Op", &id, dom_document_class_entry, &file, &file_len) == FAILURE) {
++      if (zend_parse_method_parameters(ZEND_NUM_ARGS(), getThis(), "Op", &id, dom_document_class_entry, &file, &file_len) == FAILURE) {
                return;
        }
  

diff --cc ext/standard/mail.c
index 5633372022655b73c24c1295f5a9499f460f4f46,74adc97f1c0577d86a388237ad1d45b475e1d0aa..a9046cea6981f71f571f28d5406e9b1a7faa99fc
--- 1/ext/standard/mail.c
--- 2/ext/standard/mail.c
+++ b/ext/standard/mail.c
@@@ -224,9 -223,47 +224,47 @@@ void php_mail_log_to_file(char *filenam
  }
  
  
+ static int php_mail_detect_multiple_crlf(char *hdr) {
+       /* This function detects multiple/malformed multiple newlines. */
+       size_t len;
+ 
+       if (!hdr) {
+               return 0;
+       }
+ 
+       /* Should not have any newlines at the beginning. */
+       /* RFC 2822 2.2. Header Fields */
+       if (*hdr < 33 || *hdr > 126 || *hdr == ':') {
+               return 1;
+       }
+ 
+       while(*hdr) {
+               if (*hdr == '\r') {
+                       if (*(hdr+1) == '\0' || *(hdr+1) == '\r' || (*(hdr+1) == '\n' && (*(hdr+2) == '\0' || *(hdr+2) == '\n' || *(hdr+2) == '\r'))) {
+                               /* Malformed or multiple newlines. */
+                               return 1;
+                       } else {
+                               hdr += 2;
+                       }
+               } else if (*hdr == '\n') {
+                       if (*(hdr+1) == '\0' || *(hdr+1) == '\r' || *(hdr+1) == '\n') {
+                               /* Malformed or multiple newlines. */
+                               return 1;
+                       } else {
+                               hdr += 2;
+                       }
+               } else {
+                       hdr++;
+               }
+       }
+ 
+       return 0;
+ }
+ 
+ 
  /* {{{ php_mail
   */
 -PHPAPI int php_mail(char *to, char *subject, char *message, char *headers, char *extra_cmd TSRMLS_DC)
 +PHPAPI int php_mail(char *to, char *subject, char *message, char *headers, char *extra_cmd)
  {
  #if (defined PHP_WIN32 || defined NETWARE)
        int tsm_err;
@@@ -278,20 -314,27 +316,26 @@@
  
                efree(tmp);
        }
+ 
        if (PG(mail_x_header)) {
 -              const char *tmp = zend_get_executed_filename(TSRMLS_C);
 -              char *f;
 -              size_t f_len;
 +              const char *tmp = zend_get_executed_filename();
 +              zend_string *f;
  
 -              php_basename(tmp, strlen(tmp), NULL, 0,&f, &f_len TSRMLS_CC);
 +              f = php_basename(tmp, strlen(tmp), NULL, 0);
  
                if (headers != NULL) {
 -                      spprintf(&hdr, 0, "X-PHP-Originating-Script: %ld:%s\n%s", php_getuid(TSRMLS_C), f, headers);
 +                      spprintf(&hdr, 0, "X-PHP-Originating-Script: " ZEND_LONG_FMT ":%s\n%s", php_getuid(), f->val, headers);
                } else {
 -                      spprintf(&hdr, 0, "X-PHP-Originating-Script: %ld:%s", php_getuid(TSRMLS_C), f);
 +                      spprintf(&hdr, 0, "X-PHP-Originating-Script: " ZEND_LONG_FMT ":%s", php_getuid(), f->val);
                }
 -              efree(f);
 +              zend_string_release(f);
        }
  
+       if (hdr && php_mail_detect_multiple_crlf(hdr)) {
+               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Multiple or malformed newlines found in additional_header");
+               MAIL_RET(0);
+       }
+ 
        if (!sendmail_path) {
  #if (defined PHP_WIN32 || defined NETWARE)
                /* handle old style win smtp sending */