Merge remote-tracking branch 'origin/PHP-5.6' into str_size_and_int64_56_backport

* origin/PHP-5.6:
  updated NEWS
  updated NEWS
  Fixed bug #66084 simplexml_load_string() mangles empty node name
  cleanup NEWS
  NEWS
  NEWS
  Fix Bug #66736 	fpassthru broken

Author: weltling

NEWS

@@ -9,6 +9,7 @@ PHP                                                                        NEWS
   . Fixed bug #64330 (stream_socket_server() creates wrong Abstract Namespace 
     UNIX sockets). (Mike)
   . Fixed bug #66182 (exit in stream filter produces segfault). (Mike)  
+  . Fixed bug #66736 (fpassthru broken). (Mike)
   . Fixed bug #66822 (Cannot use T_POW in const expression) (Tjerk)
 
 - SPL:
@@ -106,6 +107,10 @@ PHP                                                                        NEWS
   . New pg_flush() and pg_consume_input() functions added to manually complete
     non-blocking reads/writes to underlying connection sockets. (Daniel Lowrey)
 
+- SimpleXML:
+  . Fixed bug #66084 (simplexml_load_string() mangles empty node name)
+    (Anatol)
+
 - SQLite:
   . Updated the bundled libsqlite to the version 3.8.3.1 (Anatol)
 

ext/simplexml/simplexml.c

@@ -1129,7 +1129,7 @@ static HashTable * sxe_get_prop_hash(zval *object, int is_debug TSRMLS_DC) /* {{
 			node = NULL;
 		} else if (sxe->iter.type != SXE_ITER_CHILD) {
 
-			if ( !node->children || !node->parent || node->children->next || node->children->children || node->parent->children == node->parent->last ) {
+			if ( !node->children || !node->parent || !node->next || node->children->next || node->children->children || node->parent->children == node->parent->last ) {
 				node = node->children;
 			} else {
 				iter_data = sxe->iter.data;

ext/simplexml/tests/bug66084_0.phpt

@@ -0,0 +1,68 @@
+--TEST--
+Bug #66084 simplexml_load_string() mangles empty node name, var_dump variant
+--SKIPIF--
+<?php if (!extension_loaded("simplexml")) print "skip simplexml not available"; ?>
+--FILE--
+<?php
+echo var_dump(simplexml_load_string('<a><b/><c><x/></c></a>')), "\n";
+echo var_dump(simplexml_load_string('<a><b/><d/><c><x/></c></a>')), "\n";
+echo var_dump(simplexml_load_string('<a><b/><c><d/><x/></c></a>')), "\n";
+echo var_dump(simplexml_load_string('<a><b/><c><d><x/></d></c></a>')), "\n";
+?>
+--EXPECT--
+object(SimpleXMLElement)#1 (2) {
+  ["b"]=>
+  object(SimpleXMLElement)#2 (0) {
+  }
+  ["c"]=>
+  object(SimpleXMLElement)#3 (1) {
+    ["x"]=>
+    object(SimpleXMLElement)#4 (0) {
+    }
+  }
+}
+
+object(SimpleXMLElement)#1 (3) {
+  ["b"]=>
+  object(SimpleXMLElement)#3 (0) {
+  }
+  ["d"]=>
+  object(SimpleXMLElement)#2 (0) {
+  }
+  ["c"]=>
+  object(SimpleXMLElement)#4 (1) {
+    ["x"]=>
+    object(SimpleXMLElement)#5 (0) {
+    }
+  }
+}
+
+object(SimpleXMLElement)#1 (2) {
+  ["b"]=>
+  object(SimpleXMLElement)#4 (0) {
+  }
+  ["c"]=>
+  object(SimpleXMLElement)#2 (2) {
+    ["d"]=>
+    object(SimpleXMLElement)#3 (0) {
+    }
+    ["x"]=>
+    object(SimpleXMLElement)#5 (0) {
+    }
+  }
+}
+
+object(SimpleXMLElement)#1 (2) {
+  ["b"]=>
+  object(SimpleXMLElement)#2 (0) {
+  }
+  ["c"]=>
+  object(SimpleXMLElement)#4 (1) {
+    ["d"]=>
+    object(SimpleXMLElement)#5 (1) {
+      ["x"]=>
+      object(SimpleXMLElement)#3 (0) {
+      }
+    }
+  }
+}

ext/simplexml/tests/bug66084_1.phpt

@@ -0,0 +1,17 @@
+--TEST--
+Bug #66084 simplexml_load_string() mangles empty node name, json variant
+--SKIPIF--
+<?php if (!extension_loaded("simplexml")) print "skip simplexml not available"; ?>
+<?php if (!extension_loaded("json")) print "skip json not available"; ?>
+--FILE--
+<?php
+echo json_encode(simplexml_load_string('<a><b/><c><x/></c></a>')), "\n";
+echo json_encode(simplexml_load_string('<a><b/><d/><c><x/></c></a>')), "\n";
+echo json_encode(simplexml_load_string('<a><b/><c><d/><x/></c></a>')), "\n";
+echo json_encode(simplexml_load_string('<a><b/><c><d><x/></d></c></a>')), "\n";
+?>
+--EXPECT--
+{"b":{},"c":{"x":{}}}
+{"b":{},"d":{},"c":{"x":{}}}
+{"b":{},"c":{"d":{},"x":{}}}
+{"b":{},"c":{"d":{"x":{}}}}

main/output.c

@@ -234,6 +234,13 @@ PHPAPI int php_output_get_status(TSRMLS_D)
  * Unbuffered write */
 PHPAPI php_size_t php_output_write_unbuffered(const char *str, php_size_t len TSRMLS_DC)
 {
+#if PHP_DEBUG
+	if (len > UINT_MAX) {
+		php_error(E_WARNING, "Attempt to output more than UINT_MAX bytes at once; "
+				"output will be truncated %lu => %lu",
+				(unsigned long) len, (unsigned long) (len % UINT_MAX));
+	}
+#endif
 	if (OG(flags) & PHP_OUTPUT_DISABLED) {
 		return 0;
 	}
@@ -248,6 +255,13 @@ PHPAPI php_size_t php_output_write_unbuffered(const char *str, php_size_t len TS
  * Buffered write */
 PHPAPI php_size_t php_output_write(const char *str, php_size_t len TSRMLS_DC)
 {
+#if PHP_DEBUG
+	if (len > UINT_MAX) {
+		php_error(E_WARNING, "Attempt to output more than UINT_MAX bytes at once; "
+				"output will be truncated %lu => %lu",
+				(unsigned long) len, (unsigned long) (len % UINT_MAX));
+	}
+#endif
 	if (OG(flags) & PHP_OUTPUT_DISABLED) {
 		return 0;
 	}

main/streams/streams.c

@@ -1400,11 +1400,16 @@ PHPAPI size_t _php_stream_passthru(php_stream * stream STREAMS_DC TSRMLS_DC)
 		p = php_stream_mmap_range(stream, php_stream_tell(stream), PHP_STREAM_MMAP_ALL, PHP_STREAM_MAP_MODE_SHARED_READONLY, &mapped);
 
 		if (p) {
-			PHPWRITE(p, mapped);
+			do {
+				/* output functions return int, so pass in int max */
+				if (0 < (b = PHPWRITE(p, MIN(mapped - bcount, INT_MAX)))) {
+					bcount += b;
+				}
+			} while (b > 0 && mapped > bcount);
 
 			php_stream_mmap_unmap_ex(stream, mapped);
 
-			return mapped;
+			return bcount;
 		}
 	}