Merge branch 'master' of https://git.php.net/push/php-src

* 'master' of https://git.php.net/push/php-src: (6215 commits)
  Extra comma
  Moved proxy object support in ASSIGN_ADD (and family) from VM to slow paths of corresponding operators
  Simplification
  zend_get_property_info_quick() cleanup and optimization
  initialize lineno before calling compile file file in phar
  Use ADDREF instead of DUP, it must be enough.
  Removed old irrelevant comment
  fixed compilation error
  Fix bug #68262: Broken reference across cloned objects
  export functions needed for phpdbg
  Fixed compilation
  Optimized property access handlers. Removed EG(std_property_info).
  Fixed bug #68199 (PDO::pgsqlGetNotify doesn't support NOTIFY payloads)
  Don't make difference between undefined and unaccessible properies when call __get() and family
  Don't make useless CSE
  array_pop/array_shift optimization
  check for zlib headers as well as lib for mysqlnd
  a realpath cache key can be int or float, catching this
  News entry for new curl constants
  News entry for new curl constants
  ...

1 files changed, 9 insertions, 6 deletions

diff --git a/ext/xmlrpc/libxmlrpc/xmlrpc.c b/ext/xmlrpc/libxmlrpc/xmlrpc.c
index ce70c2afd9..fed73bbfa8 100644
--- a/ext/xmlrpc/libxmlrpc/xmlrpc.c
+++ b/ext/xmlrpc/libxmlrpc/xmlrpc.c
@@ -219,16 +219,19 @@ static int date_from_ISO8601 (const char *text, time_t * value) {
    n = 10;
    tm.tm_mon = 0;
    for(i = 0; i < 2; i++) {
-      XMLRPC_IS_NUMBER(text[i])
+      XMLRPC_IS_NUMBER(text[i+4])
       tm.tm_mon += (text[i+4]-'0')*n;
       n /= 10;
    }
    tm.tm_mon --;
+   if(tm.tm_mon < 0 || tm.tm_mon > 11) {
+       return -1;
+   }
 
    n = 10;
    tm.tm_mday = 0;
    for(i = 0; i < 2; i++) {
-      XMLRPC_IS_NUMBER(text[i])
+      XMLRPC_IS_NUMBER(text[i+6])
       tm.tm_mday += (text[i+6]-'0')*n;
       n /= 10;
    }
@@ -236,7 +239,7 @@ static int date_from_ISO8601 (const char *text, time_t * value) {
    n = 10;
    tm.tm_hour = 0;
    for(i = 0; i < 2; i++) {
-      XMLRPC_IS_NUMBER(text[i])
+      XMLRPC_IS_NUMBER(text[i+9])
       tm.tm_hour += (text[i+9]-'0')*n;
       n /= 10;
    }
@@ -244,7 +247,7 @@ static int date_from_ISO8601 (const char *text, time_t * value) {
    n = 10;
    tm.tm_min = 0;
    for(i = 0; i < 2; i++) {
-      XMLRPC_IS_NUMBER(text[i])
+      XMLRPC_IS_NUMBER(text[i+12])
       tm.tm_min += (text[i+12]-'0')*n;
       n /= 10;
    }
@@ -252,7 +255,7 @@ static int date_from_ISO8601 (const char *text, time_t * value) {
    n = 10;
    tm.tm_sec = 0;
    for(i = 0; i < 2; i++) {
-      XMLRPC_IS_NUMBER(text[i])
+      XMLRPC_IS_NUMBER(text[i+15])
       tm.tm_sec += (text[i+15]-'0')*n;
       n /= 10;
    }
@@ -2394,7 +2397,7 @@ void XMLRPC_ServerDestroy(XMLRPC_SERVER server) {
          my_free(sm);
          sm = Q_Next(&server->methodlist);
       }
-      if(server->xIntrospection) {
+      if (server->xIntrospection) {
          XMLRPC_CleanupValue(server->xIntrospection);
       }