updated libmagic.patch in 5.6

1 files changed, 194 insertions, 43 deletions

diff --git a/ext/fileinfo/libmagic.patch b/ext/fileinfo/libmagic.patch
index 8b0b9a8911..2d987e4573 100644
--- a/ext/fileinfo/libmagic.patch
+++ b/ext/fileinfo/libmagic.patch
@@ -1,6 +1,6 @@
 diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
 --- libmagic.orig/apprentice.c	Tue Nov 19 22:01:12 2013
-+++ libmagic/apprentice.c	Mon Mar 31 17:15:53 2014
++++ libmagic/apprentice.c	Fri Oct  3 22:48:34 2014
 @@ -29,6 +29,8 @@
   * apprentice - make one pass through /etc/magic, learning its secrets.
   */
@@ -454,6 +454,15 @@ diff -u libmagic.orig/apprentice.c libmagic/apprentice.c
  		return NULL;
  	}
  	return map;
+@@ -1248,7 +1272,7 @@
+ 		 * the sign extension must have happened.
+ 		 */
+ 		case FILE_BYTE:
+-			v = (char) v;
++			v = (signed char) v;
+ 			break;
+ 		case FILE_SHORT:
+ 		case FILE_BESHORT:
 @@ -1516,7 +1540,7 @@
  		if (me->cont_count == me->max_count) {
  			struct magic *nm;
@@ -822,7 +831,7 @@ diff -u libmagic.orig/ascmagic.c libmagic/ascmagic.c
  }
 diff -u libmagic.orig/cdf.c libmagic/cdf.c
 --- libmagic.orig/cdf.c	Tue Feb 26 17:20:42 2013
-+++ libmagic/cdf.c	Tue Jul  1 08:57:25 2014
++++ libmagic/cdf.c	Fri Oct  3 22:48:34 2014
 @@ -35,7 +35,7 @@
  #include "file.h"
  
@@ -937,7 +946,7 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
  
  	/* If the it is not there, just fake it; some docs don't have it */
  	if (d->d_stream_first_sector < 0)
-@@ -796,7 +815,11 @@
+@@ -796,11 +815,15 @@
  	if (cdf_check_stream_offset(sst, h, e, 0, __LINE__) == -1)
  		goto out;
  	for (i = 0; i < sh.sh_properties; i++) {
@@ -950,6 +959,11 @@ diff -u libmagic.orig/cdf.c libmagic/cdf.c
  		q = (const uint8_t *)(const void *)
  		    ((const char *)(const void *)p + ofs
  		    - 2 * sizeof(uint32_t));
+-		if (q > e) {
++		if (q < p || q > e) {
+ 			DPRINTF(("Ran of the end %p > %p\n", q, e));
+ 			goto out;
+ 		}
 @@ -810,6 +833,10 @@
  		    i, inp[i].pi_id, inp[i].pi_type, q - p, offs));
  		if (inp[i].pi_type & CDF_VECTOR) {
@@ -1814,7 +1828,16 @@ diff -u libmagic.orig/fsmagic.c libmagic/fsmagic.c
  }
 diff -u libmagic.orig/funcs.c libmagic/funcs.c
 --- libmagic.orig/funcs.c	Thu Feb 13 00:20:53 2014
-+++ libmagic/funcs.c	Wed Mar 19 13:28:34 2014
++++ libmagic/funcs.c	Fri Oct  3 22:48:34 2014
+@@ -27,7 +27,7 @@
+ #include "file.h"
+ 
+ #ifndef	lint
+-FILE_RCSID("@(#)$File: funcs.c,v 1.67 2014/02/12 23:20:53 christos Exp $")
++FILE_RCSID("@(#)$File: funcs.c,v 1.68 2014/02/18 11:09:31 kim Exp $")
+ #endif	/* lint */
+ 
+ #include "magic.h"
 @@ -41,79 +41,79 @@
  #if defined(HAVE_WCTYPE_H)
  #include <wctype.h>
@@ -1947,7 +1970,26 @@ diff -u libmagic.orig/funcs.c libmagic/funcs.c
  {
  	int m = 0, rv = 0, looks_text = 0;
  	int mime = ms->flags & MAGIC_MIME;
-@@ -203,10 +202,10 @@
+@@ -174,8 +173,7 @@
+ 	const char *code_mime = "binary";
+ 	const char *type = "application/octet-stream";
+ 	const char *def = "data";
+-
+-
++	const char *ftype = NULL;
+ 
+ 	if (nb == 0) {
+ 		def = "empty";
+@@ -188,7 +186,7 @@
+ 
+ 	if ((ms->flags & MAGIC_NO_CHECK_ENCODING) == 0) {
+ 		looks_text = file_encoding(ms, ubuf, nb, &u8buf, &ulen,
+-		    &code, &code_mime, &type);
++		    &code, &code_mime, &ftype);
+ 	}
+ 
+ #ifdef __EMX__
+@@ -203,10 +201,10 @@
  		}
  	}
  #endif
@@ -1961,7 +2003,7 @@ diff -u libmagic.orig/funcs.c libmagic/funcs.c
  			if ((ms->flags & MAGIC_DEBUG) != 0)
  				(void)fprintf(stderr, "zmagic %d\n", m);
  			goto done_encoding;
-@@ -221,12 +220,17 @@
+@@ -221,12 +219,17 @@
  		}
  
  	/* Check if we have a CDF file */
@@ -1984,7 +2026,16 @@ diff -u libmagic.orig/funcs.c libmagic/funcs.c
  
  	/* try soft magic tests */
  	if ((ms->flags & MAGIC_NO_CHECK_SOFT) == 0)
-@@ -300,7 +304,6 @@
+@@ -268,7 +271,7 @@
+ 		if ((ms->flags & MAGIC_NO_CHECK_ENCODING) == 0) {
+ 			if (looks_text == 0)
+ 				if ((m = file_ascmagic_with_encoding( ms, ubuf,
+-				    nb, u8buf, ulen, code, type, looks_text))
++				    nb, u8buf, ulen, code, ftype, looks_text))
+ 				    != 0) {
+ 					if ((ms->flags & MAGIC_DEBUG) != 0)
+ 						(void)fprintf(stderr,
+@@ -300,7 +303,6 @@
  
  	return m;
  }
@@ -1992,7 +2043,7 @@ diff -u libmagic.orig/funcs.c libmagic/funcs.c
  
  protected int
  file_reset(struct magic_set *ms)
-@@ -310,11 +313,11 @@
+@@ -310,11 +312,11 @@
  		return -1;
  	}
  	if (ms->o.buf) {
@@ -2006,7 +2057,7 @@ diff -u libmagic.orig/funcs.c libmagic/funcs.c
  		ms->o.pbuf = NULL;
  	}
  	ms->event_flags &= ~EVENT_HAD_ERR;
-@@ -333,7 +336,7 @@
+@@ -333,7 +335,7 @@
  protected const char *
  file_getbuffer(struct magic_set *ms)
  {
@@ -2015,7 +2066,7 @@ diff -u libmagic.orig/funcs.c libmagic/funcs.c
  	size_t psize, len;
  
  	if (ms->event_flags & EVENT_HAD_ERR)
-@@ -348,15 +351,13 @@
+@@ -348,15 +350,13 @@
  	/* * 4 is for octal representation, + 1 is for NUL */
  	len = strlen(ms->o.buf);
  	if (len > (SIZE_MAX - 1) / 4) {
@@ -2032,7 +2083,7 @@ diff -u libmagic.orig/funcs.c libmagic/funcs.c
  
  #if defined(HAVE_WCHAR_H) && defined(HAVE_MBRTOWC) && defined(HAVE_WCWIDTH)
  	{
-@@ -416,8 +417,8 @@
+@@ -416,8 +416,8 @@
  	if (level >= ms->c.len) {
  		len = (ms->c.len += 20) * sizeof(*ms->c.li);
  		ms->c.li = CAST(struct level_info *, (ms->c.li == NULL) ?
@@ -2043,7 +2094,7 @@ diff -u libmagic.orig/funcs.c libmagic/funcs.c
  		if (ms->c.li == NULL) {
  			file_oomem(ms, len);
  			return -1;
-@@ -437,32 +438,50 @@
+@@ -437,32 +437,50 @@
  	return ms->o.buf == NULL ? 0 : strlen(ms->o.buf);
  }
  
@@ -2706,7 +2757,7 @@ diff -u libmagic.orig/print.c libmagic/print.c
  	}
 diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
 --- libmagic.orig/readcdf.c	Tue Jan  7 04:13:42 2014
-+++ libmagic/readcdf.c	Thu Jun  5 18:05:33 2014
++++ libmagic/readcdf.c	Sat Oct 25 11:50:04 2014
 @@ -26,11 +26,15 @@
  #include "file.h"
  
@@ -2724,7 +2775,7 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
  #include <string.h>
  #include <time.h>
  #include <ctype.h>
-@@ -69,6 +73,44 @@
+@@ -69,6 +73,50 @@
  	{ NULL,				NULL,			},
  };
  
@@ -2743,6 +2794,9 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
 +		{ 0x00000000000c1084LLU, 0x46000000000000c0LLU },
 +#endif
 +		"x-msi",
++	},
++	{	{ 0,			 0			},
++		NULL,
 +	}
 +}, clsid2desc[] = {
 +	{
@@ -2753,6 +2807,9 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
 +#endif
 +		"MSI Installer",
 +	},
++	{	{ 0,			 0			},
++		NULL,
++	}
 +};
 +
 +private const char *
@@ -2769,7 +2826,7 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
  private const char *
  cdf_app_to_mime(const char *vbuf, const struct nv *nv)
  {
-@@ -87,16 +129,21 @@
+@@ -87,16 +135,21 @@
  
  private int
  cdf_file_property_info(struct magic_set *ms, const cdf_property_info_t *info,
@@ -2793,7 +2850,7 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
          for (i = 0; i < count; i++) {
                  cdf_print_property_name(buf, sizeof(buf), info[i].pi_id);
                  switch (info[i].pi_type) {
-@@ -153,7 +200,7 @@
+@@ -153,7 +206,7 @@
                                                      buf, vbuf) == -1)
                                                          return -1;
                                          }
@@ -2802,7 +2859,7 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
  				    CDF_PROPERTY_NAME_OF_APPLICATION) {
  					str = cdf_app_to_mime(vbuf, app2mime);
  				}
-@@ -162,8 +209,12 @@
+@@ -162,8 +215,12 @@
                  case CDF_FILETIME:
                          tp = info[i].pi_tp;
                          if (tp != 0) {
@@ -2817,7 +2874,7 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
                                          cdf_print_elapsed_time(tbuf,
                                              sizeof(tbuf), tp);
                                          if (NOTMIME(ms) && file_printf(ms,
-@@ -171,8 +222,11 @@
+@@ -171,8 +228,11 @@
                                                  return -1;
                                  } else {
                                          char *c, *ec;
@@ -2831,7 +2888,7 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
                                          if (c != NULL &&
  					    (ec = strchr(c, '\n')) != NULL)
  						*ec = '\0';
-@@ -200,7 +254,7 @@
+@@ -200,7 +260,7 @@
  
  private int
  cdf_file_summary_info(struct magic_set *ms, const cdf_header_t *h,
@@ -2840,7 +2897,7 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
  {
          cdf_summary_info_header_t si;
          cdf_property_info_t *info;
-@@ -211,6 +265,8 @@
+@@ -211,6 +271,8 @@
                  return -1;
  
          if (NOTMIME(ms)) {
@@ -2849,7 +2906,7 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
                  if (file_printf(ms, "Composite Document File V2 Document")
  		    == -1)
                          return -1;
-@@ -238,9 +294,15 @@
+@@ -238,9 +300,15 @@
                                  return -2;
                          break;
                  }
@@ -2867,7 +2924,7 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
          free(info);
  
          return m == -1 ? -2 : m;
-@@ -258,6 +320,7 @@
+@@ -258,6 +326,7 @@
          int i;
          const char *expn = "";
          const char *corrupt = "corrupt: ";
@@ -2875,7 +2932,7 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
  
          info.i_fd = fd;
          info.i_buf = buf;
-@@ -291,7 +354,8 @@
+@@ -291,7 +360,8 @@
                  goto out2;
          }
  
@@ -2885,7 +2942,7 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
                  expn = "Cannot read short stream";
                  goto out3;
          }
-@@ -312,23 +376,21 @@
+@@ -312,23 +382,21 @@
  #ifdef CDF_DEBUG
          cdf_dump_summary_info(&h, &scn);
  #endif
@@ -2918,7 +2975,7 @@ diff -u libmagic.orig/readcdf.c libmagic/readcdf.c
  			if (str != NULL) {
 diff -u libmagic.orig/readelf.c libmagic/readelf.c
 --- libmagic.orig/readelf.c	Tue Nov  5 16:44:01 2013
-+++ libmagic/readelf.c	Fri Feb 21 00:21:27 2014
++++ libmagic/readelf.c	Sat Oct 25 11:50:04 2014
 @@ -48,8 +48,8 @@
  private int dophn_exec(struct magic_set *, int, int, int, off_t, int, size_t,
      off_t, int *, int);
@@ -2983,7 +3040,21 @@ diff -u libmagic.orig/readelf.c libmagic/readelf.c
  			file_badread(ms);
  			return -1;
  		}
-@@ -913,24 +928,12 @@
+@@ -477,6 +492,13 @@
+ 	uint32_t namesz, descsz;
+ 	unsigned char *nbuf = CAST(unsigned char *, vbuf);
+ 
++	if (xnh_sizeof + offset > size) {
++		/*
++		 * We're out of note headers.
++		 */
++		return xnh_sizeof + offset;
++	}
++
+ 	(void)memcpy(xnh_addr, &nbuf[offset], xnh_sizeof);
+ 	offset += xnh_sizeof;
+ 
+@@ -913,24 +935,12 @@
  		return 0;
  	}
  
@@ -3011,7 +3082,7 @@ diff -u libmagic.orig/readelf.c libmagic/readelf.c
  			file_badread(ms);
  			return -1;
  		}
-@@ -955,14 +958,17 @@
+@@ -955,14 +965,17 @@
  		/* Things we can determine when we seek */
  		switch (xsh_type) {
  		case SHT_NOTE:
@@ -3034,7 +3105,7 @@ diff -u libmagic.orig/readelf.c libmagic/readelf.c
  				return -1;
  			}
  
-@@ -971,25 +977,16 @@
+@@ -971,25 +984,16 @@
  				if (noff >= (off_t)xsh_size)
  					break;
  				noff = donote(ms, nbuf, (size_t)noff,
@@ -3065,7 +3136,7 @@ diff -u libmagic.orig/readelf.c libmagic/readelf.c
  				file_badseek(ms);
  				return -1;
  			}
-@@ -1001,7 +998,7 @@
+@@ -1001,7 +1005,7 @@
  				    MAX(sizeof cap32, sizeof cap64)];
  				if ((coff += xcap_sizeof) > (off_t)xsh_size)
  					break;
@@ -3074,7 +3145,7 @@ diff -u libmagic.orig/readelf.c libmagic/readelf.c
  				    (ssize_t)xcap_sizeof) {
  					file_badread(ms);
  					return -1;
-@@ -1027,13 +1024,12 @@
+@@ -1027,13 +1031,12 @@
  					break;
  				}
  			}
@@ -3090,7 +3161,7 @@ diff -u libmagic.orig/readelf.c libmagic/readelf.c
  	if (file_printf(ms, ", %sstripped", stripped ? "" : "not ") == -1)
  		return -1;
  	if (cap_hw1) {
-@@ -1112,7 +1108,7 @@
+@@ -1112,7 +1115,7 @@
  	const char *shared_libraries = "";
  	unsigned char nbuf[BUFSIZ];
  	ssize_t bufsize;
@@ -3099,7 +3170,7 @@ diff -u libmagic.orig/readelf.c libmagic/readelf.c
  	
  	if (size != xph_sizeof) {
  		if (file_printf(ms, ", corrupted program header size") == -1)
-@@ -1121,8 +1117,13 @@
+@@ -1121,8 +1124,13 @@
  	}
  
    	for ( ; num; num--) {
@@ -3115,7 +3186,7 @@ diff -u libmagic.orig/readelf.c libmagic/readelf.c
  			return -1;
  		}
  
-@@ -1160,9 +1161,12 @@
+@@ -1160,9 +1168,12 @@
  			 * This is a PT_NOTE section; loop through all the notes
  			 * in the section.
  			 */
@@ -3131,7 +3202,7 @@ diff -u libmagic.orig/readelf.c libmagic/readelf.c
  			if (bufsize == -1) {
  				file_badread(ms);
  				return -1;
-@@ -1223,7 +1227,7 @@
+@@ -1223,7 +1234,7 @@
  	/*
  	 * If we cannot seek, it must be a pipe, socket or fifo.
  	 */
@@ -3163,7 +3234,7 @@ diff -u libmagic.orig/readelf.h libmagic/readelf.h
  typedef uint8_t		Elf64_Char;
 diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 --- libmagic.orig/softmagic.c	Thu Feb 13 00:20:53 2014
-+++ libmagic/softmagic.c	Tue Jul  1 08:57:25 2014
++++ libmagic/softmagic.c	Mon Aug  4 14:58:55 2014
 @@ -50,6 +50,11 @@
  #include <locale.h>
  #endif
@@ -3176,6 +3247,15 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  
  private int match(struct magic_set *, struct magic *, uint32_t,
      const unsigned char *, size_t, size_t, int, int, int, int, int *, int *,
+@@ -62,7 +67,7 @@
+ private int32_t moffset(struct magic_set *, struct magic *);
+ private void mdebug(uint32_t, const char *, size_t);
+ private int mcopy(struct magic_set *, union VALUETYPE *, int, int,
+-    const unsigned char *, uint32_t, size_t, size_t);
++    const unsigned char *, uint32_t, size_t, struct magic *);
+ private int mconvert(struct magic_set *, struct magic *, int);
+ private int print_sep(struct magic_set *, int);
+ private int handle_annotation(struct magic_set *, struct magic *);
 @@ -71,7 +76,8 @@
  private void cvt_32(union VALUETYPE *, const struct magic *);
  private void cvt_64(union VALUETYPE *, const struct magic *);
@@ -3320,9 +3400,72 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  		while (len--)
  			*ptr1++ = *ptr2++;
  		*ptr1 = '\0';
-@@ -1178,9 +1170,6 @@
- 		    "nbytes=%zu, count=%u)\n", m->type, m->flag, offset, o,
- 		    nbytes, count);
+@@ -1046,7 +1038,7 @@
+ 
+ private int
+ mcopy(struct magic_set *ms, union VALUETYPE *p, int type, int indir,
+-    const unsigned char *s, uint32_t offset, size_t nbytes, size_t linecnt)
++    const unsigned char *s, uint32_t offset, size_t nbytes, struct magic *m)
+ {
+ 	/*
+ 	 * Note: FILE_SEARCH and FILE_REGEX do not actually copy
+@@ -1066,15 +1058,24 @@
+ 			const char *last;	/* end of search region */
+ 			const char *buf;	/* start of search region */
+ 			const char *end;
+-			size_t lines;
++			size_t lines, linecnt, bytecnt;
+ 
++			linecnt = m->str_range;
++			bytecnt = linecnt * 80;
++
++			if (bytecnt == 0) {
++				bytecnt = 8192;
++			}
++			if (bytecnt > nbytes) {
++				bytecnt = nbytes;
++			}
+ 			if (s == NULL) {
+ 				ms->search.s_len = 0;
+ 				ms->search.s = NULL;
+ 				return 0;
+ 			}
+ 			buf = RCAST(const char *, s) + offset;
+-			end = last = RCAST(const char *, s) + nbytes;
++			end = last = RCAST(const char *, s) + bytecnt;
+ 			/* mget() guarantees buf <= last */
+ 			for (lines = linecnt, b = buf; lines && b < end &&
+ 			     ((b = CAST(const char *,
+@@ -1087,7 +1088,7 @@
+ 					b++;
+ 			}
+ 			if (lines)
+-				last = RCAST(const char *, s) + nbytes;
++				last = RCAST(const char *, s) + bytecnt;
+ 
+ 			ms->search.s = buf;
+ 			ms->search.s_len = last - buf;
+@@ -1158,7 +1159,6 @@
+     int *need_separator, int *returnval)
+ {
+ 	uint32_t soffset, offset = ms->offset;
+-	uint32_t count = m->str_range;
+ 	int rv, oneed_separator, in_type;
+ 	char *sbuf, *rbuf;
+ 	union VALUETYPE *p = &ms->ms_value;
+@@ -1170,17 +1170,13 @@
+ 	}
+ 
+ 	if (mcopy(ms, p, m->type, m->flag & INDIR, s, (uint32_t)(offset + o),
+-	    (uint32_t)nbytes, count) == -1)
++	    (uint32_t)nbytes, m) == -1)
+ 		return -1;
+ 
+ 	if ((ms->flags & MAGIC_DEBUG) != 0) {
+ 		fprintf(stderr, "mget(type=%d, flag=%x, offset=%u, o=%zu, "
+-		    "nbytes=%zu, count=%u)\n", m->type, m->flag, offset, o,
+-		    nbytes, count);
++		    "nbytes=%zu)\n", m->type, m->flag, offset, o, nbytes);
  		mdebug(offset, (char *)(void *)p, sizeof(union VALUETYPE));
 -#ifndef COMPILE_ONLY
 -		file_mdump(m);
@@ -3330,7 +3473,15 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  	}
  
  	if (m->flag & INDIR) {
-@@ -1679,9 +1668,6 @@
+@@ -1672,16 +1668,13 @@
+ 			if ((ms->flags & MAGIC_DEBUG) != 0)
+ 				fprintf(stderr, "indirect +offs=%u\n", offset);
+ 		}
+-		if (mcopy(ms, p, m->type, 0, s, offset, nbytes, count) == -1)
++		if (mcopy(ms, p, m->type, 0, s, offset, nbytes, m) == -1)
+ 			return -1;
+ 		ms->offset = offset;
+ 
  		if ((ms->flags & MAGIC_DEBUG) != 0) {
  			mdebug(offset, (char *)(void *)p,
  			    sizeof(union VALUETYPE));
@@ -3340,7 +3491,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  		}
  	}
  
-@@ -1755,11 +1741,21 @@
+@@ -1755,11 +1748,21 @@
  		ms->offset = soffset;
  		if (rv == 1) {
  			if ((ms->flags & (MAGIC_MIME|MAGIC_APPLE)) == 0 &&
@@ -3365,7 +3516,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  		}
  		return rv;
  
-@@ -1875,6 +1871,42 @@
+@@ -1875,6 +1878,42 @@
  	return file_strncmp(a, b, len, flags);
  }
  
@@ -3408,7 +3559,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
  private int
  magiccheck(struct magic_set *ms, struct magic *m)
  {
-@@ -2035,63 +2067,151 @@
+@@ -2035,63 +2074,151 @@
  		break;
  	}
  	case FILE_REGEX: {
@@ -3444,7 +3595,7 @@ diff -u libmagic.orig/softmagic.c libmagic/softmagic.c
 +			zval *retval;
 +			zval *subpats;
 +			char *haystack;
-+			
++
 +			MAKE_STD_ZVAL(retval);
 +			ALLOC_INIT_ZVAL(subpats);
 +