docker-php74/php
Add PHP 7.4.34 security backport
Commit 2625569e · User Name · 2026-10-21T18:01:55+02:00
Comments
No comments yet.
Diff
diff --git a/.gitattributes b/.gitattributes
index 4523e2f7..487080d6 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -2,3 +2,5 @@
/*/**/apache2-foreground linguist-generated
/*/**/docker-php-* linguist-generated
/Dockerfile*.template linguist-language=Dockerfile
+/.gitattributes text eol=lf
+/7.4/buster/apache/* text eol=lf
diff --git a/7.4/buster/apache/Dockerfile b/7.4/buster/apache/Dockerfile
index e9b2850f..520967e2 100644
--- a/7.4/buster/apache/Dockerfile
+++ b/7.4/buster/apache/Dockerfile
@@ -26,10 +26,16 @@ ENV PHPIZE_DEPS \
libc-dev \
make \
pkg-config \
+ patch \
re2c
# persistent / runtime deps
RUN set -eux; \
+ sed -i \
+ -e 's|deb.debian.org/debian|archive.debian.org/debian|g' \
+ -e 's|security.debian.org/debian-security|archive.debian.org/debian-security|g' \
+ /etc/apt/sources.list; \
+ echo 'Acquire::Check-Valid-Until "false";' > /etc/apt/apt.conf.d/99no-check-valid-until; \
apt-get update; \
apt-get install -y --no-install-recommends \
$PHPIZE_DEPS \
@@ -118,8 +124,10 @@ ENV PHP_LDFLAGS="-Wl,-O1 -pie"
ENV GPG_KEYS 42670A7FE4D0441C8E4632349E4FDC074A4EF02D 5A52880781F755608BF815FC910DEB46F53EA312
-ENV PHP_VERSION 7.4.33
-ENV PHP_URL="https://www.php.net/distributions/php-7.4.33.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-7.4.33.tar.xz.asc"
+# Internal version for the PHP 7.4.33 source with the security backport below.
+ENV PHP_VERSION 7.4.34
+ENV PHP_SOURCE_VERSION 7.4.33
+ENV PHP_URL="https://www.php.net/distributions/php-$PHP_SOURCE_VERSION.tar.xz" PHP_ASC_URL="https://www.php.net/distributions/php-$PHP_SOURCE_VERSION.tar.xz.asc"
ENV PHP_SHA256="924846abf93bc613815c55dd3f5809377813ac62a9ec4eb3778675b82a27b927"
RUN set -eux; \
@@ -154,6 +162,8 @@ RUN set -eux; \
apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false
COPY docker-php-source /usr/local/bin/
+COPY php-7.4-cve-2026-109618-109619.patch /tmp/php-7.4-cve-2026-109618-109619.patch
+COPY php-7.4.34-version.patch /tmp/php-7.4.34-version.patch
RUN set -eux; \
\
@@ -179,6 +189,8 @@ RUN set -eux; \
; \
docker-php-source extract; \
cd /usr/src/php; \
+ patch -p1 < /tmp/php-7.4-cve-2026-109618-109619.patch; \
+ rm /tmp/php-7.4-cve-2026-109618-109619.patch; \
gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)"; \
# https://bugs.php.net/bug.php?id=74125
@@ -234,6 +246,8 @@ RUN set -eux; \
\
--with-apxs2 \
; \
+ patch -p1 < /tmp/php-7.4.34-version.patch; \
+ rm /tmp/php-7.4.34-version.patch; \
make -j "$(nproc)"; \
find -type f -name '*.a' -delete; \
make install; \
diff --git a/7.4/buster/apache/php-7.4-cve-2026-109618-109619.patch b/7.4/buster/apache/php-7.4-cve-2026-109618-109619.patch
new file mode 100644
index 00000000..c1827598
--- /dev/null
+++ b/7.4/buster/apache/php-7.4-cve-2026-109618-109619.patch
@@ -0,0 +1,984 @@
+diff --git a/NEWS b/NEWS
+index 8a8c0c92..b9d1fe39 100644
+--- a/NEWS
++++ b/NEWS
+@@ -1,5 +1,8 @@
+ PHP NEWS
+ |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
++?? ??? 2022, PHP 7.4.34
++
++
+ 03 Nov 2022, PHP 7.4.33
+
+ - GD:
+diff --git a/Zend/zend_API.h b/Zend/zend_API.h
+index 2a3b5829..26f7726b 100644
+--- a/Zend/zend_API.h
++++ b/Zend/zend_API.h
+@@ -380,6 +380,7 @@ ZEND_API char *zend_get_type_by_const(int type);
+
+ #define array_init(arg) ZVAL_ARR((arg), zend_new_array(0))
+ #define array_init_size(arg, size) ZVAL_ARR((arg), zend_new_array(size))
++#define array_init_singleton(arg) ZVAL_ARR((arg), zend_new_array_singleton())
+ ZEND_API int object_init(zval *arg);
+ ZEND_API int object_init_ex(zval *arg, zend_class_entry *ce);
+ ZEND_API int object_and_properties_init(zval *arg, zend_class_entry *ce, HashTable *properties);
+diff --git a/Zend/zend_alloc.c b/Zend/zend_alloc.c
+index 3a33e544..be9b9754 100644
+--- a/Zend/zend_alloc.c
++++ b/Zend/zend_alloc.c
+@@ -57,6 +57,7 @@
+ #include "zend_operators.h"
+ #include "zend_multiply.h"
+ #include "zend_bitset.h"
++#include "zend_execute.h"
+ #include <signal.h>
+
+ #ifdef HAVE_UNISTD_H
+@@ -363,7 +364,42 @@ static ZEND_COLD ZEND_NORETURN void zend_mm_panic(const char *message)
+ #if ZEND_DEBUG && defined(HAVE_KILL) && defined(HAVE_GETPID)
+ kill(getpid(), SIGSEGV);
+ #endif
+- exit(1);
++ _exit(1);
++}
++
++ZEND_API ZEND_COLD ZEND_NORETURN void zend_mm_safe_error_ex(const char *format, ...)
++{
++ zend_string *script_filename = NULL;
++ uint32_t script_lineno = 0;
++
++ if (zend_is_executing()) {
++ script_filename = zend_get_executed_filename_ex();
++ script_lineno = zend_get_executed_lineno();
++ } else if (zend_is_compiling()) {
++ script_filename = zend_get_compiled_filename();
++ script_lineno = zend_get_compiled_lineno();
++ }
++
++ va_list args;
++ va_start(args, format);
++
++ char buf[1024];
++ vsnprintf(buf, sizeof(buf), format, args);
++
++ va_end(args);
++
++ fprintf(stderr,
++ "\nFatal error: %s in %s on line %d\n",
++ buf,
++ script_filename ? ZSTR_VAL(script_filename) : "Unknown",
++ script_lineno);
++
++ /* See http://support.microsoft.com/kb/190351 */
++# ifdef ZEND_WIN32
++ fflush(stderr);
++# endif
++
++ _exit(1);
+ }
+
+ static ZEND_COLD ZEND_NORETURN void zend_mm_safe_error(zend_mm_heap *heap,
+@@ -375,22 +411,14 @@ static ZEND_COLD ZEND_NORETURN void zend_mm_safe_error(zend_mm_heap *heap,
+ #endif
+ size_t size)
+ {
++ (void) heap;
+
+- heap->overflow = 1;
+- zend_try {
+- zend_error_noreturn(E_ERROR,
+- format,
+- limit,
++ zend_mm_safe_error_ex(format, limit,
+ #if ZEND_DEBUG
+- filename,
+- lineno,
++ filename,
++ lineno,
+ #endif
+- size);
+- } zend_catch {
+- } zend_end_try();
+- heap->overflow = 0;
+- zend_bailout();
+- exit(1);
++ size);
+ }
+
+ #ifdef _WIN32
+@@ -1318,7 +1346,7 @@ static zend_always_inline void *zend_mm_alloc_heap(zend_mm_heap *heap, size_t si
+ size = MAX(size, 1);
+ size = ZEND_MM_ALIGNED_SIZE(size) + ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info));
+ if (UNEXPECTED(size < real_size)) {
+- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu + %zu)", ZEND_MM_ALIGNED_SIZE(real_size), ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info)));
++ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu + %zu)", ZEND_MM_ALIGNED_SIZE(real_size), ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info)));
+ return NULL;
+ }
+ #endif
+@@ -1762,7 +1790,7 @@ static void *zend_mm_alloc_huge(zend_mm_heap *heap, size_t size ZEND_FILE_LINE_D
+ void *ptr;
+
+ if (UNEXPECTED(new_size < size)) {
+- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu + %zu)", size, alignment);
++ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu + %zu)", size, alignment);
+ }
+
+ #if ZEND_MM_LIMIT
+@@ -2617,7 +2645,7 @@ ZEND_API char* ZEND_FASTCALL _estrdup(const char *s ZEND_FILE_LINE_DC ZEND_FILE_
+
+ length = strlen(s);
+ if (UNEXPECTED(length + 1 == 0)) {
+- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (1 * %zu + 1)", length);
++ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (1 * %zu + 1)", length);
+ }
+ p = (char *) _emalloc(length + 1 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
+ memcpy(p, s, length+1);
+@@ -2629,7 +2657,7 @@ ZEND_API char* ZEND_FASTCALL _estrndup(const char *s, size_t length ZEND_FILE_LI
+ char *p;
+
+ if (UNEXPECTED(length + 1 == 0)) {
+- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (1 * %zu + 1)", length);
++ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (1 * %zu + 1)", length);
+ }
+ p = (char *) _emalloc(length + 1 ZEND_FILE_LINE_RELAY_CC ZEND_FILE_LINE_ORIG_RELAY_CC);
+ memcpy(p, s, length);
+@@ -2643,7 +2671,7 @@ ZEND_API char* ZEND_FASTCALL zend_strndup(const char *s, size_t length)
+ char *p;
+
+ if (UNEXPECTED(length + 1 == 0)) {
+- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (1 * %zu + 1)", length);
++ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (1 * %zu + 1)", length);
+ }
+ p = (char *) malloc(length + 1);
+ if (UNEXPECTED(p == NULL)) {
+@@ -2974,7 +3002,7 @@ ZEND_API zend_mm_heap *zend_mm_startup_ex(const zend_mm_handlers *handlers, void
+ static ZEND_COLD ZEND_NORETURN void zend_out_of_memory(void)
+ {
+ fprintf(stderr, "Out of memory\n");
+- exit(1);
++ _exit(1);
+ }
+
+ ZEND_API void * __zend_malloc(size_t len)
+diff --git a/Zend/zend_alloc.h b/Zend/zend_alloc.h
+index 8bb85432..2ed2ed8b 100644
+--- a/Zend/zend_alloc.h
++++ b/Zend/zend_alloc.h
+@@ -402,6 +402,8 @@ static void apc_init_heap(void)
+ size_t zend_mm_globals_size(void);
+ #endif
+
++ZEND_API ZEND_COLD ZEND_NORETURN void zend_mm_safe_error_ex(const char *format, ...);
++
+ END_EXTERN_C()
+
+ #endif
+diff --git a/Zend/zend_execute_API.c b/Zend/zend_execute_API.c
+index f4f0fa14..724b6e5c 100644
+--- a/Zend/zend_execute_API.c
++++ b/Zend/zend_execute_API.c
+@@ -337,10 +337,21 @@ void shutdown_executor(void) /* {{{ */
+ gc_collect_cycles();
+ }
+ #endif
++ } else {
++ /* may be used by zend_error_zstr_at before init_executor */
++ ZVAL_UNDEF(&EG(user_error_handler));
++ ZVAL_UNDEF(&EG(user_exception_handler));
++ memset(&EG(user_error_handlers_error_reporting), 0, sizeof(EG(user_error_handlers_error_reporting)));
++ memset(&EG(user_error_handlers), 0, sizeof(EG(user_error_handlers)));
++ memset(&EG(user_exception_handlers), 0, sizeof(EG(user_exception_handlers)));
+ }
+
+ zend_objects_store_free_object_storage(&EG(objects_store), fast_shutdown);
+
++ /* may be used by zend_error_zstr_at before init_executor */
++ EG(error_handling) = EH_NORMAL;
++ EG(exception) = NULL;
++
+ zend_weakrefs_shutdown();
+
+ zend_try {
+@@ -357,6 +368,8 @@ void shutdown_executor(void) /* {{{ */
+ zend_hash_discard(EG(function_table), EG(persistent_functions_count));
+ zend_hash_discard(EG(class_table), EG(persistent_classes_count));
+ zend_cleanup_internal_classes();
++ EG(objects_store).object_buckets = NULL;
++ EG(objects_store).top = 1;
+ } else {
+ zend_vm_stack_destroy();
+
+diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
+index da150bd7..ef3d301d 100644
+--- a/Zend/zend_hash.c
++++ b/Zend/zend_hash.c
+@@ -97,7 +97,7 @@ static zend_always_inline uint32_t zend_hash_check_size(uint32_t nSize)
+ if (nSize <= HT_MIN_SIZE) {
+ return HT_MIN_SIZE;
+ } else if (UNEXPECTED(nSize >= HT_MAX_SIZE)) {
+- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%u * %zu + %zu)", nSize, sizeof(Bucket), sizeof(Bucket));
++ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%u * %zu + %zu)", nSize, sizeof(Bucket), sizeof(Bucket));
+ }
+
+ #if defined(ZEND_WIN32)
+@@ -251,6 +251,13 @@ ZEND_API HashTable* ZEND_FASTCALL _zend_new_array_0(void)
+ return ht;
+ }
+
++ZEND_API HashTable* ZEND_FASTCALL zend_new_array_singleton(void)
++{
++ HashTable *ht = _zend_new_array_0();
++ ht->nTableSize = 1;
++ return ht;
++}
++
+ ZEND_API HashTable* ZEND_FASTCALL _zend_new_array(uint32_t nSize)
+ {
+ HashTable *ht = emalloc(sizeof(HashTable));
+@@ -282,7 +289,7 @@ static void ZEND_FASTCALL zend_hash_packed_grow(HashTable *ht)
+ {
+ HT_ASSERT_RC1(ht);
+ if (ht->nTableSize >= HT_MAX_SIZE) {
+- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket), sizeof(Bucket));
++ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket), sizeof(Bucket));
+ }
+ ht->nTableSize += ht->nTableSize;
+ HT_SET_DATA_ADDR(ht, perealloc2(HT_GET_DATA_ADDR(ht), HT_SIZE_EX(ht->nTableSize, HT_MIN_MASK), HT_USED_SIZE(ht), GC_FLAGS(ht) & IS_ARRAY_PERSISTENT));
+@@ -1164,7 +1171,7 @@ static void ZEND_FASTCALL zend_hash_do_resize(HashTable *ht)
+ pefree(old_data, GC_FLAGS(ht) & IS_ARRAY_PERSISTENT);
+ zend_hash_rehash(ht);
+ } else {
+- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket) + sizeof(uint32_t), sizeof(Bucket));
++ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%u * %zu + %zu)", ht->nTableSize * 2, sizeof(Bucket) + sizeof(uint32_t), sizeof(Bucket));
+ }
+ }
+
+diff --git a/Zend/zend_hash.h b/Zend/zend_hash.h
+index f1e2d346..b833479e 100644
+--- a/Zend/zend_hash.h
++++ b/Zend/zend_hash.h
+@@ -296,6 +296,7 @@ ZEND_API int ZEND_FASTCALL zend_hash_rehash(HashTable *ht);
+ #endif
+
+ ZEND_API HashTable* ZEND_FASTCALL _zend_new_array_0(void);
++ZEND_API HashTable* ZEND_FASTCALL zend_new_array_singleton(void);
+ ZEND_API HashTable* ZEND_FASTCALL _zend_new_array(uint32_t size);
+ ZEND_API HashTable* ZEND_FASTCALL zend_new_pair(zval *val1, zval *val2);
+ ZEND_API uint32_t zend_array_count(HashTable *ht);
+diff --git a/Zend/zend_llist.c b/Zend/zend_llist.c
+index 4a2c22e6..0955e953 100644
+--- a/Zend/zend_llist.c
++++ b/Zend/zend_llist.c
+@@ -112,6 +112,8 @@ ZEND_API void zend_llist_destroy(zend_llist *l)
+ current = next;
+ }
+
++ l->head = NULL;
++ l->tail = NULL;
+ l->count = 0;
+ }
+
+diff --git a/Zend/zend_multiply.h b/Zend/zend_multiply.h
+index a3827d25..a9bbda55 100644
+--- a/Zend/zend_multiply.h
++++ b/Zend/zend_multiply.h
+@@ -321,7 +321,7 @@ static zend_always_inline size_t zend_safe_address_guarded(size_t nmemb, size_t
+ size_t ret = zend_safe_address(nmemb, size, offset, &overflow);
+
+ if (UNEXPECTED(overflow)) {
+- zend_error_noreturn(E_ERROR, "Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
++ zend_mm_safe_error_ex("Possible integer overflow in memory allocation (%zu * %zu + %zu)", nmemb, size, offset);
+ return 0;
+ }
+ return ret;
+@@ -334,7 +334,7 @@ static zend_always_inline size_t zend_safe_addmult(size_t nmemb, size_t size, si
+ size_t ret = zend_safe_address(nmemb, size, offset, &overflow);
+
+ if (UNEXPECTED(overflow)) {
+- zend_error_noreturn(E_ERROR, "Possible integer overflow in %s (%zu * %zu + %zu)", message, nmemb, size, offset);
++ zend_mm_safe_error_ex("Possible integer overflow in %s (%zu * %zu + %zu)", message, nmemb, size, offset);
+ return 0;
+ }
+ return ret;
+diff --git a/Zend/zend_strtod.c b/Zend/zend_strtod.c
+index 2228e226..ad8df201 100644
+--- a/Zend/zend_strtod.c
++++ b/Zend/zend_strtod.c
+@@ -603,7 +603,7 @@ Balloc
+ rv = (Bigint *)MALLOC(sizeof(Bigint) + (x-1)*sizeof(ULong));
+ if (!rv) {
+ FREE_DTOA_LOCK(0);
+- zend_error_noreturn(E_ERROR, "Balloc() failed to allocate memory");
++ zend_mm_safe_error_ex("Balloc() failed to allocate memory");
+ }
+ #else
+ len = (sizeof(Bigint) + (x-1)*sizeof(ULong) + sizeof(double) - 1)
+@@ -616,7 +616,7 @@ Balloc
+ rv = (Bigint*)MALLOC(len*sizeof(double));
+ if (!rv) {
+ FREE_DTOA_LOCK(0);
+- zend_error_noreturn(E_ERROR, "Balloc() failed to allocate memory");
++ zend_mm_safe_error_ex("Balloc() failed to allocate memory");
+ }
+ #endif
+ rv->k = k;
+diff --git a/Zend/zend_types.h b/Zend/zend_types.h
+index 7b8c079c..f7828eb6 100644
+--- a/Zend/zend_types.h
++++ b/Zend/zend_types.h
+@@ -330,17 +330,21 @@ struct _zend_array {
+ # define HT_HASH_RESET(ht) do { \
+ char *p = (char*)&HT_HASH(ht, (ht)->nTableMask); \
+ size_t size = HT_HASH_SIZE((ht)->nTableMask); \
+- __m128i xmm0 = _mm_setzero_si128(); \
+- xmm0 = _mm_cmpeq_epi8(xmm0, xmm0); \
+- ZEND_ASSERT(size >= 64 && ((size & 0x3f) == 0)); \
+- do { \
+- _mm_storeu_si128((__m128i*)p, xmm0); \
+- _mm_storeu_si128((__m128i*)(p+16), xmm0); \
+- _mm_storeu_si128((__m128i*)(p+32), xmm0); \
+- _mm_storeu_si128((__m128i*)(p+48), xmm0); \
+- p += 64; \
+- size -= 64; \
+- } while (size != 0); \
++ if (UNEXPECTED(size < 64)) { \
++ memset(p, HT_INVALID_IDX, size); \
++ } else { \
++ __m128i xmm0 = _mm_setzero_si128(); \
++ xmm0 = _mm_cmpeq_epi8(xmm0, xmm0); \
++ ZEND_ASSERT(size >= 64 && ((size & 0x3f) == 0)); \
++ do { \
++ _mm_storeu_si128((__m128i*)p, xmm0); \
++ _mm_storeu_si128((__m128i*)(p+16), xmm0); \
++ _mm_storeu_si128((__m128i*)(p+32), xmm0); \
++ _mm_storeu_si128((__m128i*)(p+48), xmm0); \
++ p += 64; \
++ size -= 64; \
++ } while (size != 0); \
++ } \
+ } while (0)
+ #else
+ # define HT_HASH_RESET(ht) \
+diff --git a/Zend/zend_vm_def.h b/Zend/zend_vm_def.h
+index d362b016..3af90d70 100644
+--- a/Zend/zend_vm_def.h
++++ b/Zend/zend_vm_def.h
+@@ -417,7 +417,7 @@ ZEND_VM_HANDLER(8, ZEND_CONCAT, CONST|TMPVAR|CV, CONST|TMPVAR|CV, SPEC(NO_CONST_
+ size_t len = ZSTR_LEN(op1_str);
+
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
+- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
+ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -426,6 +426,9 @@ ZEND_VM_HANDLER(8, ZEND_CONCAT, CONST|TMPVAR|CV, CONST|TMPVAR|CV, SPEC(NO_CONST_
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -3210,6 +3213,9 @@ ZEND_VM_COLD_CONSTCONST_HANDLER(53, ZEND_FAST_CONCAT, CONST|TMPVAR|CV, CONST|TMP
+ !ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
+ size_t len = ZSTR_LEN(op1_str);
+
++ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+ ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
+@@ -3217,6 +3223,9 @@ ZEND_VM_COLD_CONSTCONST_HANDLER(53, ZEND_FAST_CONCAT, CONST|TMPVAR|CV, CONST|TMP
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+diff --git a/Zend/zend_vm_execute.h b/Zend/zend_vm_execute.h
+index 2875fd37..8701e77e 100644
+--- a/Zend/zend_vm_execute.h
++++ b/Zend/zend_vm_execute.h
+@@ -5631,6 +5631,9 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_
+ !ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
+ size_t len = ZSTR_LEN(op1_str);
+
++ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+ ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
+@@ -5638,6 +5641,9 @@ static ZEND_VM_COLD ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -7491,6 +7497,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CONST_TMPVAR_HANDL
+ !ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
+ size_t len = ZSTR_LEN(op1_str);
+
++ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+ ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
+@@ -7498,6 +7507,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CONST_TMPVAR_HANDL
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -7900,7 +7912,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CONST_TMPVAR_
+ size_t len = ZSTR_LEN(op1_str);
+
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
+- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
+ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -7909,6 +7921,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CONST_TMPVAR_
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -9952,6 +9967,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CONST_CV_HANDLER(Z
+ !ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
+ size_t len = ZSTR_LEN(op1_str);
+
++ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+ ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
+@@ -9959,6 +9977,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CONST_CV_HANDLER(Z
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -10361,7 +10382,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CONST_CV_HAND
+ size_t len = ZSTR_LEN(op1_str);
+
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
+- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
+ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -10370,6 +10391,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CONST_CV_HAND
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -13928,6 +13952,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_TMPVAR_CONST_HANDL
+ !ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
+ size_t len = ZSTR_LEN(op1_str);
+
++ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+ ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
+@@ -13935,6 +13962,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_TMPVAR_CONST_HANDL
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -14681,7 +14711,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_TMPVAR_CONST_
+ size_t len = ZSTR_LEN(op1_str);
+
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
+- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
+ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -14690,6 +14720,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_TMPVAR_CONST_
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -15353,7 +15386,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_TMPVAR_TMPVAR_HAND
+ size_t len = ZSTR_LEN(op1_str);
+
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
+- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
+ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -15362,6 +15395,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_TMPVAR_TMPVAR_HAND
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -16107,6 +16143,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_TMPVAR_TMPVAR
+ !ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
+ size_t len = ZSTR_LEN(op1_str);
+
++ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+ ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
+@@ -16114,6 +16153,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_TMPVAR_TMPVAR
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -17040,7 +17082,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_TMPVAR_CV_HANDLER(
+ size_t len = ZSTR_LEN(op1_str);
+
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
+- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
+ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -17049,6 +17091,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_TMPVAR_CV_HANDLER(
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -17401,6 +17446,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_TMPVAR_CV_HAN
+ !ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
+ size_t len = ZSTR_LEN(op1_str);
+
++ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+ ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
+@@ -17408,6 +17456,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_TMPVAR_CV_HAN
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -38348,7 +38399,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CV_CONST_HANDLER(Z
+ size_t len = ZSTR_LEN(op1_str);
+
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
+- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
+ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -38357,6 +38408,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CV_CONST_HANDLER(Z
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -40727,7 +40781,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CV_CONST_HAND
+ size_t len = ZSTR_LEN(op1_str);
+
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
+- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
+ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -40736,6 +40790,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CV_CONST_HAND
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -41849,6 +41906,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CV_TMPVAR_HANDLER(
+ !ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
+ size_t len = ZSTR_LEN(op1_str);
+
++ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+ ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
+@@ -41856,6 +41916,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CV_TMPVAR_HANDLER(
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -44132,6 +44195,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CV_TMPVAR_HAN
+ !ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
+ size_t len = ZSTR_LEN(op1_str);
+
++ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+ ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
+@@ -44139,6 +44205,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CV_TMPVAR_HAN
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -46857,7 +46926,7 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CV_CV_HANDLER(ZEND
+ size_t len = ZSTR_LEN(op1_str);
+
+ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
+- zend_error_noreturn(E_ERROR, "Integer overflow in memory allocation");
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
+ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -46866,6 +46935,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_CONCAT_SPEC_CV_CV_HANDLER(ZEND
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+@@ -49268,6 +49340,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CV_CV_HANDLER
+ !ZSTR_IS_INTERNED(op1_str) && GC_REFCOUNT(op1_str) == 1) {
+ size_t len = ZSTR_LEN(op1_str);
+
++ if (UNEXPECTED(len > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_extend(op1_str, len + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str) + len, ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+ ZVAL_NEW_STR(EX_VAR(opline->result.var), str);
+@@ -49275,6 +49350,9 @@ static ZEND_OPCODE_HANDLER_RET ZEND_FASTCALL ZEND_FAST_CONCAT_SPEC_CV_CV_HANDLER
+ zend_string_release_ex(op2_str, 0);
+ }
+ } else {
++ if (UNEXPECTED(ZSTR_LEN(op1_str) > ZSTR_MAX_LEN - ZSTR_LEN(op2_str))) {
++ zend_mm_safe_error_ex("Integer overflow in memory allocation");
++ }
+ str = zend_string_alloc(ZSTR_LEN(op1_str) + ZSTR_LEN(op2_str), 0);
+ memcpy(ZSTR_VAL(str), ZSTR_VAL(op1_str), ZSTR_LEN(op1_str));
+ memcpy(ZSTR_VAL(str) + ZSTR_LEN(op1_str), ZSTR_VAL(op2_str), ZSTR_LEN(op2_str)+1);
+diff --git a/configure.ac b/configure.ac
+index 21c92b3f..dac63f55 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -17,7 +17,7 @@ dnl Basic autoconf initialization, generation of config.nice.
+ dnl ----------------------------------------------------------------------------
+
+ AC_PREREQ([2.68])
+-AC_INIT([PHP],[7.4.33],[https://bugs.php.net],[php],[https://www.php.net])
++AC_INIT([PHP],[7.4.34-dev],[https://bugs.php.net],[php],[https://www.php.net])
+ AC_CONFIG_SRCDIR([main/php_version.h])
+ AC_CONFIG_AUX_DIR([build])
+ AC_PRESERVE_HELP_ORDER
+diff --git a/ext/session/session.c b/ext/session/session.c
+index 8fb6dd2c..89a7400a 100644
+--- a/ext/session/session.c
++++ b/ext/session/session.c
+@@ -3174,7 +3174,7 @@ static int php_session_rfc1867_callback(unsigned int event, void *event_data, vo
+ if (php_session_rfc1867_orig_callback) {
+ retval = php_session_rfc1867_orig_callback(event, event_data, extra);
+ }
+- if (!PS(rfc1867_enabled)) {
++ if (!PS(rfc1867_enabled) || true) {
+ return retval;
+ }
+
+diff --git a/main/SAPI.c b/main/SAPI.c
+index a5a68f8c..1c320f6e 100644
+--- a/main/SAPI.c
++++ b/main/SAPI.c
+@@ -509,18 +509,23 @@ SAPI_API void sapi_deactivate(void)
+ }
+ if (SG(request_info).auth_user) {
+ efree(SG(request_info).auth_user);
++ SG(request_info).auth_user = NULL;
+ }
+ if (SG(request_info).auth_password) {
+ efree(SG(request_info).auth_password);
++ SG(request_info).auth_password = NULL;
+ }
+ if (SG(request_info).auth_digest) {
+ efree(SG(request_info).auth_digest);
++ SG(request_info).auth_digest = NULL;
+ }
+ if (SG(request_info).content_type_dup) {
+ efree(SG(request_info).content_type_dup);
++ SG(request_info).content_type_dup = NULL;
+ }
+ if (SG(request_info).current_user) {
+ efree(SG(request_info).current_user);
++ SG(request_info).current_user = NULL;
+ }
+ if (sapi_module.deactivate) {
+ sapi_module.deactivate();
+diff --git a/main/main.c b/main/main.c
+index 0b33b2b5..bb8501f9 100644
+--- a/main/main.c
++++ b/main/main.c
+@@ -836,6 +836,7 @@ PHP_INI_BEGIN()
+ PHP_INI_ENTRY("disable_functions", "", PHP_INI_SYSTEM, NULL)
+ PHP_INI_ENTRY("disable_classes", "", PHP_INI_SYSTEM, NULL)
+ PHP_INI_ENTRY("max_file_uploads", "20", PHP_INI_SYSTEM|PHP_INI_PERDIR, NULL)
++ PHP_INI_ENTRY("max_multipart_body_parts", "-1", PHP_INI_SYSTEM|PHP_INI_PERDIR, NULL)
+
+ STD_PHP_INI_BOOLEAN("allow_url_fopen", "1", PHP_INI_SYSTEM, OnUpdateBool, allow_url_fopen, php_core_globals, core_globals)
+ STD_PHP_INI_BOOLEAN("allow_url_include", "0", PHP_INI_SYSTEM, OnUpdateBool, allow_url_include, php_core_globals, core_globals)
+@@ -1960,6 +1961,8 @@ void php_request_shutdown(void *dummy)
+
+ for (i=0; i<NUM_TRACK_VARS; i++) {
+ zval_ptr_dtor(&PG(http_globals)[i]);
++ /* May be accessed before php_request_startup() */
++ ZVAL_UNDEF(&PG(http_globals)[i]);
+ }
+ } zend_end_try();
+
+@@ -2012,6 +2015,9 @@ void php_request_shutdown(void *dummy)
+ #ifdef HAVE_DTRACE
+ DTRACE_REQUEST_SHUTDOWN(SAFE_FILENAME(SG(request_info).path_translated), SAFE_FILENAME(SG(request_info).request_uri), (char *)SAFE_FILENAME(SG(request_info).request_method));
+ #endif /* HAVE_DTRACE */
++
++ /* May be accessed before php_request_startup() */
++ PG(modules_activated) = 0;
+ }
+ /* }}} */
+
+diff --git a/main/php_variables.c b/main/php_variables.c
+index 18f6b65a..c920e4d5 100644
+--- a/main/php_variables.c
++++ b/main/php_variables.c
+@@ -218,7 +218,7 @@ PHPAPI void php_register_variable_ex(char *var_name, zval *val, zval *track_vars
+ }
+
+ if (!index) {
+- array_init(&gpc_element);
++ array_init_singleton(&gpc_element);
+ if ((gpc_element_p = zend_hash_next_index_insert(symtable1, &gpc_element)) == NULL) {
+ zend_array_destroy(Z_ARR(gpc_element));
+ zval_ptr_dtor_nogc(val);
+@@ -229,7 +229,7 @@ PHPAPI void php_register_variable_ex(char *var_name, zval *val, zval *track_vars
+ gpc_element_p = zend_symtable_str_find(symtable1, index, index_len);
+ if (!gpc_element_p) {
+ zval tmp;
+- array_init(&tmp);
++ array_init_singleton(&tmp);
+ gpc_element_p = zend_symtable_str_update_ind(symtable1, index, index_len, &tmp);
+ } else {
+ if (Z_TYPE_P(gpc_element_p) == IS_INDIRECT) {
+@@ -237,7 +237,7 @@ PHPAPI void php_register_variable_ex(char *var_name, zval *val, zval *track_vars
+ }
+ if (Z_TYPE_P(gpc_element_p) != IS_ARRAY) {
+ zval_ptr_dtor_nogc(gpc_element_p);
+- array_init(gpc_element_p);
++ array_init_singleton(gpc_element_p);
+ } else {
+ SEPARATE_ARRAY(gpc_element_p);
+ }
+@@ -429,7 +429,7 @@ SAPI_API SAPI_TREAT_DATA_FUNC(php_default_treat_data)
+ case PARSE_POST:
+ case PARSE_GET:
+ case PARSE_COOKIE:
+- array_init(&array);
++ array_init_singleton(&array);
+ switch (arg) {
+ case PARSE_POST:
+ zval_ptr_dtor_nogc(&PG(http_globals)[TRACK_VARS_POST]);
+diff --git a/main/php_version.h b/main/php_version.h
+index f2b90483..2e190984 100644
+--- a/main/php_version.h
++++ b/main/php_version.h
+@@ -2,7 +2,7 @@
+ /* edit configure.ac to change version number */
+ #define PHP_MAJOR_VERSION 7
+ #define PHP_MINOR_VERSION 4
+-#define PHP_RELEASE_VERSION 33
+-#define PHP_EXTRA_VERSION ""
+-#define PHP_VERSION "7.4.33"
+-#define PHP_VERSION_ID 70433
++#define PHP_RELEASE_VERSION 31
++#define PHP_EXTRA_VERSION "-dev"
++#define PHP_VERSION "7.4.31-dev"
++#define PHP_VERSION_ID 70431
+diff --git a/main/rfc1867.c b/main/rfc1867.c
+index edef19c1..4946df0c 100644
+--- a/main/rfc1867.c
++++ b/main/rfc1867.c
+@@ -397,6 +397,14 @@ static int find_boundary(multipart_buffer *self, char *boundary)
+ return 0;
+ }
+
++static zend_bool php_mime_should_save_hdr(const char *name)
++{
++ return !strcasecmp(name, "Content-Disposition")
++ || !strcasecmp(name, "Content-Type");
++}
++
++static char *php_mime_get_hdr_value(zend_llist header, char *key);
++
+ /* parse headers */
+ static int multipart_buffer_headers(multipart_buffer *self, zend_llist *header)
+ {
+@@ -437,10 +445,16 @@ static int multipart_buffer_headers(multipart_buffer *self, zend_llist *header)
+ }
+
+ *value = '\0';
+- do { value++; } while (isspace(*value));
+
+- key = estrdup(line);
+- smart_string_appends(&buf_value, value);
++ /* Keep only headers we use, and ignore duplicates */
++ if (!php_mime_should_save_hdr(line)
++ || php_mime_get_hdr_value(*header, line)) {
++ key = NULL;
++ } else {
++ key = estrdup(line);
++ do { value++; } while (isspace((unsigned char)*value));
++ smart_string_appends(&buf_value, value);
++ }
+ } else if (buf_value.c) { /* If no ':' on the line, add to previous line */
+ smart_string_appends(&buf_value, line);
+ } else {
+@@ -514,11 +528,11 @@ static char *php_ap_getword(const zend_encoding *encoding, char **line, char sto
+ return res;
+ }
+
+-static char *substring_conf(char *start, int len, char quote)
++static char *substring_conf(char *start, size_t len, char quote)
+ {
+ char *result = emalloc(len + 1);
+ char *resp = result;
+- int i;
++ size_t i;
+
+ for (i = 0; i < len && start[i] != quote; ++i) {
+ if (start[i] == '\\' && (start[i + 1] == '\\' || (quote && start[i + 1] == quote))) {
+@@ -546,14 +560,14 @@ static char *php_ap_getword_conf(const zend_encoding *encoding, char *str)
+ char quote = *str;
+
+ str++;
+- return substring_conf(str, (int)strlen(str), quote);
++ return substring_conf(str, strlen(str), quote);
+ } else {
+ char *strend = str;
+
+ while (*strend && !isspace(*strend)) {
+ ++strend;
+ }
+- return substring_conf(str, strend - str, 0);
++ return substring_conf(str, (size_t)(strend - str), 0);
+ }
+ }
+
+@@ -694,6 +708,7 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
+ void *event_extra_data = NULL;
+ unsigned int llen = 0;
+ int upload_cnt = INI_INT("max_file_uploads");
++ int body_parts_cnt = INI_INT("max_multipart_body_parts");
+ const zend_encoding *internal_encoding = zend_multibyte_get_internal_encoding();
+ php_rfc1867_getword_t getword;
+ php_rfc1867_getword_conf_t getword_conf;
+@@ -715,6 +730,11 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
+ return;
+ }
+
++ if (body_parts_cnt < 0) {
++ body_parts_cnt = PG(max_input_vars) + upload_cnt;
++ }
++ int body_parts_limit = body_parts_cnt;
++
+ /* Get the boundary */
+ boundary = strstr(content_type_dup, "boundary");
+ if (!boundary) {
+@@ -799,6 +819,11 @@ SAPI_API SAPI_POST_HANDLER_FUNC(rfc1867_post_handler) /* {{{ */
+ char *pair = NULL;
+ int end = 0;
+
++ if (--body_parts_cnt < 0) {
++ php_error_docref(NULL, E_WARNING, "Multipart body parts limit exceeded %d. To increase the limit change max_multipart_body_parts in php.ini.", body_parts_limit);
++ goto fileupload_done;
++ }
++
+ while (isspace(*cd)) {
+ ++cd;
+ }
diff --git a/7.4/buster/apache/php-7.4.34-version.patch b/7.4/buster/apache/php-7.4.34-version.patch
new file mode 100644
index 00000000..6dc19eb9
--- /dev/null
+++ b/7.4/buster/apache/php-7.4.34-version.patch
@@ -0,0 +1,12 @@
+--- a/main/php_version.h
++++ b/main/php_version.h
+@@ -3,6 +3,6 @@
+ #define PHP_MAJOR_VERSION 7
+ #define PHP_MINOR_VERSION 4
+-#define PHP_RELEASE_VERSION 33
++#define PHP_RELEASE_VERSION 34
+ #define PHP_EXTRA_VERSION ""
+-#define PHP_VERSION "7.4.33"
+-#define PHP_VERSION_ID 70433
++#define PHP_VERSION "7.4.34"
++#define PHP_VERSION_ID 70434